@q9labsai/chalk-client 4.0.0

package/dist/webhooks/index.cjs

@@ -0,0 +1,1242 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/webhooks/index.ts
+var index_exports = {};
+__export(index_exports, {
+  WebhookServerOnlyError: () => WebhookServerOnlyError,
+  WebhookVerificationError: () => WebhookVerificationError,
+  createWebhookProcessor: () => createWebhookProcessor,
+  knownWebhookEventNamesV1: () => knownWebhookEventNamesV1,
+  toWebhookResponse: () => toWebhookResponse,
+  verifyWebhook: () => verifyWebhook,
+  webhookEventSchemaV1: () => webhookEventSchemaV1
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/webhooks/errors.ts
+var messages = {
+  missing_headers: "Required webhook headers are missing.",
+  malformed_headers: "Webhook headers are malformed.",
+  invalid_secret: "A webhook signing secret is invalid.",
+  stale_timestamp: "The webhook timestamp is outside the allowed tolerance.",
+  invalid_signature: "The webhook signature is invalid.",
+  invalid_json: "The webhook body is not valid JSON.",
+  identifier_mismatch: "The webhook identifiers do not match.",
+  unsupported_api_version: "The webhook API version is unsupported.",
+  invalid_event_body: "The webhook Event body is invalid."
+};
+var WebhookVerificationError = class extends Error {
+  code;
+  constructor(code) {
+    super(messages[code]);
+    this.name = "WebhookVerificationError";
+    this.code = code;
+  }
+};
+var WebhookServerOnlyError = class extends Error {
+  constructor() {
+    super("Chalk webhook receivers are available only in server and edge runtimes.");
+    this.name = "WebhookServerOnlyError";
+  }
+};
+
+// src/webhooks/generated/event-v1.ts
+var webhookEventSchemaV1 = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: "https://chalk.dev/contracts/webhooks/v1/event.schema.json",
+  title: "Chalk webhook Event version 1",
+  type: "object",
+  required: ["id", "event", "api_version", "occurred_at", "tenant_id", "data"],
+  properties: {
+    id: {
+      $ref: "#/$defs/uuid"
+    },
+    event: {
+      type: "string"
+    },
+    api_version: {
+      const: 1
+    },
+    occurred_at: {
+      $ref: "#/$defs/timestamp"
+    },
+    tenant_id: {
+      $ref: "#/$defs/uuid"
+    },
+    data: {
+      type: "object"
+    }
+  },
+  additionalProperties: true,
+  oneOf: [
+    {
+      $ref: "#/$defs/spaceCreated"
+    },
+    {
+      $ref: "#/$defs/spaceUpdated"
+    },
+    {
+      $ref: "#/$defs/spaceArchived"
+    },
+    {
+      $ref: "#/$defs/spaceRestored"
+    },
+    {
+      $ref: "#/$defs/episodeStarted"
+    },
+    {
+      $ref: "#/$defs/episodeEnded"
+    },
+    {
+      $ref: "#/$defs/participantJoined"
+    },
+    {
+      $ref: "#/$defs/participantLeft"
+    },
+    {
+      $ref: "#/$defs/recordingStarted"
+    },
+    {
+      $ref: "#/$defs/recordingCompleted"
+    },
+    {
+      $ref: "#/$defs/recordingFailed"
+    },
+    {
+      $ref: "#/$defs/transcriptStarted"
+    },
+    {
+      $ref: "#/$defs/transcriptCompleted"
+    },
+    {
+      $ref: "#/$defs/transcriptFailed"
+    },
+    {
+      $ref: "#/$defs/endpointTest"
+    }
+  ],
+  $defs: {
+    uuid: {
+      type: "string",
+      format: "uuid",
+      pattern: "^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
+    },
+    timestamp: {
+      type: "string",
+      format: "date-time",
+      pattern: "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}\\.[0-9]{3}Z$"
+    },
+    nullableTimestamp: {
+      oneOf: [
+        {
+          $ref: "#/$defs/timestamp"
+        },
+        {
+          type: "null"
+        }
+      ]
+    },
+    nullableUUID: {
+      oneOf: [
+        {
+          $ref: "#/$defs/uuid"
+        },
+        {
+          type: "null"
+        }
+      ]
+    },
+    failure: {
+      oneOf: [
+        {
+          type: "null"
+        },
+        {
+          type: "object",
+          required: ["code"],
+          properties: {
+            code: {
+              type: "string",
+              minLength: 1,
+              maxLength: 96
+            }
+          },
+          additionalProperties: true
+        }
+      ]
+    },
+    spaceObject: {
+      type: "object",
+      required: ["id", "name", "slug", "media_plane", "created_at", "updated_at"],
+      properties: {
+        id: {
+          $ref: "#/$defs/uuid"
+        },
+        name: {
+          type: "string"
+        },
+        slug: {
+          type: "string"
+        },
+        media_plane: {
+          type: "string"
+        },
+        archived_at: {
+          $ref: "#/$defs/nullableTimestamp"
+        },
+        created_at: {
+          $ref: "#/$defs/timestamp"
+        },
+        updated_at: {
+          $ref: "#/$defs/timestamp"
+        }
+      },
+      additionalProperties: true
+    },
+    episodeObject: {
+      type: "object",
+      required: ["id", "space_id", "status", "started_at", "ended_at", "created_at", "updated_at"],
+      properties: {
+        id: {
+          $ref: "#/$defs/uuid"
+        },
+        space_id: {
+          $ref: "#/$defs/uuid"
+        },
+        status: {
+          enum: ["active", "ended"]
+        },
+        started_at: {
+          $ref: "#/$defs/timestamp"
+        },
+        ended_at: {
+          $ref: "#/$defs/nullableTimestamp"
+        },
+        created_at: {
+          $ref: "#/$defs/timestamp"
+        },
+        updated_at: {
+          $ref: "#/$defs/timestamp"
+        }
+      },
+      additionalProperties: true
+    },
+    participantObject: {
+      type: "object",
+      required: ["id", "identity_id", "space_id", "episode_id", "name", "status", "joined_at", "left_at"],
+      properties: {
+        id: {
+          $ref: "#/$defs/uuid"
+        },
+        identity_id: {
+          $ref: "#/$defs/nullableUUID"
+        },
+        space_id: {
+          $ref: "#/$defs/uuid"
+        },
+        episode_id: {
+          $ref: "#/$defs/uuid"
+        },
+        name: {
+          type: ["string", "null"]
+        },
+        status: {
+          enum: ["active", "left"]
+        },
+        joined_at: {
+          $ref: "#/$defs/timestamp"
+        },
+        left_at: {
+          $ref: "#/$defs/nullableTimestamp"
+        }
+      },
+      additionalProperties: true
+    },
+    recordingObject: {
+      type: "object",
+      required: ["id", "space_id", "episode_id", "status", "started_at", "completed_at", "failed_at", "failure", "created_at", "updated_at"],
+      properties: {
+        id: {
+          $ref: "#/$defs/uuid"
+        },
+        space_id: {
+          $ref: "#/$defs/uuid"
+        },
+        episode_id: {
+          $ref: "#/$defs/uuid"
+        },
+        status: {
+          enum: ["started", "completed", "failed"]
+        },
+        started_at: {
+          $ref: "#/$defs/timestamp"
+        },
+        completed_at: {
+          $ref: "#/$defs/nullableTimestamp"
+        },
+        failed_at: {
+          $ref: "#/$defs/nullableTimestamp"
+        },
+        failure: {
+          $ref: "#/$defs/failure"
+        },
+        created_at: {
+          $ref: "#/$defs/timestamp"
+        },
+        updated_at: {
+          $ref: "#/$defs/timestamp"
+        }
+      },
+      additionalProperties: true
+    },
+    transcriptObject: {
+      type: "object",
+      required: ["id", "recording_id", "space_id", "episode_id", "status", "languages", "started_at", "completed_at", "failed_at", "failure", "created_at", "updated_at"],
+      properties: {
+        id: {
+          $ref: "#/$defs/uuid"
+        },
+        recording_id: {
+          $ref: "#/$defs/uuid"
+        },
+        space_id: {
+          $ref: "#/$defs/uuid"
+        },
+        episode_id: {
+          $ref: "#/$defs/uuid"
+        },
+        status: {
+          enum: ["started", "completed", "failed"]
+        },
+        languages: {
+          type: "array",
+          items: {
+            type: "string"
+          },
+          uniqueItems: true
+        },
+        started_at: {
+          $ref: "#/$defs/timestamp"
+        },
+        completed_at: {
+          $ref: "#/$defs/nullableTimestamp"
+        },
+        failed_at: {
+          $ref: "#/$defs/nullableTimestamp"
+        },
+        failure: {
+          $ref: "#/$defs/failure"
+        },
+        created_at: {
+          $ref: "#/$defs/timestamp"
+        },
+        updated_at: {
+          $ref: "#/$defs/timestamp"
+        }
+      },
+      additionalProperties: true
+    },
+    spaceData: {
+      type: "object",
+      required: ["object"],
+      properties: {
+        object: {
+          $ref: "#/$defs/spaceObject"
+        }
+      },
+      additionalProperties: true
+    },
+    spaceUpdatedData: {
+      type: "object",
+      required: ["object", "changed_fields"],
+      properties: {
+        object: {
+          $ref: "#/$defs/spaceObject"
+        },
+        changed_fields: {
+          type: "array",
+          minItems: 1,
+          uniqueItems: true,
+          items: {
+            enum: ["admission_policy", "default_episode_duration_seconds", "linger_window_seconds", "maximum_episode_duration_seconds", "media_plane", "metadata", "name", "recurring_policy", "slug"]
+          }
+        }
+      },
+      additionalProperties: true
+    },
+    episodeData: {
+      type: "object",
+      required: ["object"],
+      properties: {
+        object: {
+          $ref: "#/$defs/episodeObject"
+        }
+      },
+      additionalProperties: true
+    },
+    participantData: {
+      type: "object",
+      required: ["object"],
+      properties: {
+        object: {
+          $ref: "#/$defs/participantObject"
+        }
+      },
+      additionalProperties: true
+    },
+    recordingData: {
+      type: "object",
+      required: ["object"],
+      properties: {
+        object: {
+          $ref: "#/$defs/recordingObject"
+        }
+      },
+      additionalProperties: true
+    },
+    transcriptData: {
+      type: "object",
+      required: ["object"],
+      properties: {
+        object: {
+          $ref: "#/$defs/transcriptObject"
+        }
+      },
+      additionalProperties: true
+    },
+    spaceCreated: {
+      $ref: "#/$defs/spaceCreatedShape"
+    },
+    spaceCreatedShape: {
+      properties: {
+        event: {
+          const: "space.created"
+        },
+        data: {
+          $ref: "#/$defs/spaceData"
+        }
+      }
+    },
+    spaceUpdated: {
+      properties: {
+        event: {
+          const: "space.updated"
+        },
+        data: {
+          $ref: "#/$defs/spaceUpdatedData"
+        }
+      }
+    },
+    spaceArchived: {
+      properties: {
+        event: {
+          const: "space.archived"
+        },
+        data: {
+          allOf: [
+            {
+              $ref: "#/$defs/spaceData"
+            },
+            {
+              properties: {
+                object: {
+                  required: ["archived_at"],
+                  properties: {
+                    archived_at: {
+                      $ref: "#/$defs/timestamp"
+                    }
+                  }
+                }
+              }
+            }
+          ]
+        }
+      }
+    },
+    spaceRestored: {
+      properties: {
+        event: {
+          const: "space.restored"
+        },
+        data: {
+          $ref: "#/$defs/spaceData"
+        }
+      }
+    },
+    episodeStarted: {
+      properties: {
+        event: {
+          const: "episode.started"
+        },
+        data: {
+          allOf: [
+            {
+              $ref: "#/$defs/episodeData"
+            },
+            {
+              properties: {
+                object: {
+                  properties: {
+                    status: {
+                      const: "active"
+                    },
+                    ended_at: {
+                      type: "null"
+                    }
+                  }
+                }
+              }
+            }
+          ]
+        }
+      }
+    },
+    episodeEnded: {
+      properties: {
+        event: {
+          const: "episode.ended"
+        },
+        data: {
+          allOf: [
+            {
+              $ref: "#/$defs/episodeData"
+            },
+            {
+              properties: {
+                object: {
+                  properties: {
+                    status: {
+                      const: "ended"
+                    },
+                    ended_at: {
+                      $ref: "#/$defs/timestamp"
+                    }
+                  }
+                }
+              }
+            }
+          ]
+        }
+      }
+    },
+    participantJoined: {
+      properties: {
+        event: {
+          const: "participant.joined"
+        },
+        data: {
+          allOf: [
+            {
+              $ref: "#/$defs/participantData"
+            },
+            {
+              properties: {
+                object: {
+                  properties: {
+                    status: {
+                      const: "active"
+                    },
+                    left_at: {
+                      type: "null"
+                    }
+                  }
+                }
+              }
+            }
+          ]
+        }
+      }
+    },
+    participantLeft: {
+      properties: {
+        event: {
+          const: "participant.left"
+        },
+        data: {
+          allOf: [
+            {
+              $ref: "#/$defs/participantData"
+            },
+            {
+              properties: {
+                object: {
+                  properties: {
+                    status: {
+                      const: "left"
+                    },
+                    left_at: {
+                      $ref: "#/$defs/timestamp"
+                    }
+                  }
+                }
+              }
+            }
+          ]
+        }
+      }
+    },
+    recordingStarted: {
+      properties: {
+        event: {
+          const: "recording.started"
+        },
+        data: {
+          allOf: [
+            {
+              $ref: "#/$defs/recordingData"
+            },
+            {
+              properties: {
+                object: {
+                  properties: {
+                    status: {
+                      const: "started"
+                    },
+                    completed_at: {
+                      type: "null"
+                    },
+                    failed_at: {
+                      type: "null"
+                    },
+                    failure: {
+                      type: "null"
+                    }
+                  }
+                }
+              }
+            }
+          ]
+        }
+      }
+    },
+    recordingCompleted: {
+      properties: {
+        event: {
+          const: "recording.completed"
+        },
+        data: {
+          allOf: [
+            {
+              $ref: "#/$defs/recordingData"
+            },
+            {
+              properties: {
+                object: {
+                  properties: {
+                    status: {
+                      const: "completed"
+                    },
+                    completed_at: {
+                      $ref: "#/$defs/timestamp"
+                    },
+                    failed_at: {
+                      type: "null"
+                    },
+                    failure: {
+                      type: "null"
+                    }
+                  }
+                }
+              }
+            }
+          ]
+        }
+      }
+    },
+    recordingFailed: {
+      properties: {
+        event: {
+          const: "recording.failed"
+        },
+        data: {
+          allOf: [
+            {
+              $ref: "#/$defs/recordingData"
+            },
+            {
+              properties: {
+                object: {
+                  properties: {
+                    status: {
+                      const: "failed"
+                    },
+                    completed_at: {
+                      type: "null"
+                    },
+                    failed_at: {
+                      $ref: "#/$defs/timestamp"
+                    },
+                    failure: {
+                      type: "object"
+                    }
+                  }
+                }
+              }
+            }
+          ]
+        }
+      }
+    },
+    transcriptStarted: {
+      properties: {
+        event: {
+          const: "transcript.started"
+        },
+        data: {
+          allOf: [
+            {
+              $ref: "#/$defs/transcriptData"
+            },
+            {
+              properties: {
+                object: {
+                  properties: {
+                    status: {
+                      const: "started"
+                    },
+                    completed_at: {
+                      type: "null"
+                    },
+                    failed_at: {
+                      type: "null"
+                    },
+                    failure: {
+                      type: "null"
+                    }
+                  }
+                }
+              }
+            }
+          ]
+        }
+      }
+    },
+    transcriptCompleted: {
+      properties: {
+        event: {
+          const: "transcript.completed"
+        },
+        data: {
+          allOf: [
+            {
+              $ref: "#/$defs/transcriptData"
+            },
+            {
+              properties: {
+                object: {
+                  properties: {
+                    status: {
+                      const: "completed"
+                    },
+                    completed_at: {
+                      $ref: "#/$defs/timestamp"
+                    },
+                    failed_at: {
+                      type: "null"
+                    },
+                    failure: {
+                      type: "null"
+                    }
+                  }
+                }
+              }
+            }
+          ]
+        }
+      }
+    },
+    transcriptFailed: {
+      properties: {
+        event: {
+          const: "transcript.failed"
+        },
+        data: {
+          allOf: [
+            {
+              $ref: "#/$defs/transcriptData"
+            },
+            {
+              properties: {
+                object: {
+                  properties: {
+                    status: {
+                      const: "failed"
+                    },
+                    completed_at: {
+                      type: "null"
+                    },
+                    failed_at: {
+                      $ref: "#/$defs/timestamp"
+                    },
+                    failure: {
+                      type: "object"
+                    }
+                  }
+                }
+              }
+            }
+          ]
+        }
+      }
+    },
+    endpointTest: {
+      properties: {
+        event: {
+          const: "endpoint.test"
+        },
+        data: {
+          type: "object",
+          required: ["object"],
+          properties: {
+            object: {
+              type: "object",
+              required: ["endpoint_id"],
+              properties: {
+                endpoint_id: {
+                  $ref: "#/$defs/uuid"
+                }
+              },
+              additionalProperties: true
+            }
+          },
+          additionalProperties: true
+        }
+      }
+    }
+  }
+};
+var knownWebhookEventNamesV1 = [
+  "space.created",
+  "space.updated",
+  "space.archived",
+  "space.restored",
+  "episode.started",
+  "episode.ended",
+  "participant.joined",
+  "participant.left",
+  "recording.started",
+  "recording.completed",
+  "recording.failed",
+  "transcript.started",
+  "transcript.completed",
+  "transcript.failed",
+  "endpoint.test"
+];
+
+// src/webhooks/validate.ts
+var isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var resolveRef = (ref) => {
+  const name = ref.startsWith("#/$defs/") ? ref.slice(8) : "";
+  return webhookEventSchemaV1.$defs[name];
+};
+var typeMatchers = {
+  array: Array.isArray,
+  integer: Number.isInteger,
+  null: (value) => value === null,
+  object: isObject
+};
+var matchesType = (value, type) => typeMatchers[type]?.(value) ?? typeof value === type;
+var hasUniqueItems = (values) => {
+  const serialized = values.map((value) => JSON.stringify(value));
+  return new Set(serialized).size === serialized.length;
+};
+var isUtcMillisecondTimestamp = (value) => {
+  const milliseconds = Date.parse(value);
+  return Number.isFinite(milliseconds) && new Date(milliseconds).toISOString() === value;
+};
+var validatesReference = (value, schema) => {
+  if (typeof schema.$ref !== "string") return void 0;
+  const resolved = resolveRef(schema.$ref);
+  return resolved !== void 0 && validateSchema(value, resolved);
+};
+var validatesConstants = (value, schema) => {
+  if ("const" in schema && !Object.is(value, schema.const)) return false;
+  return !Array.isArray(schema.enum) || schema.enum.some((entry) => Object.is(entry, value));
+};
+var validatesDeclaredType = (value, schema) => {
+  if (typeof schema.type === "string") return matchesType(value, schema.type);
+  return !Array.isArray(schema.type) || schema.type.some((type) => typeof type === "string" && matchesType(value, type));
+};
+var validatesCompositions = (value, schema) => {
+  const oneOfMatches = Array.isArray(schema.oneOf) ? schema.oneOf.filter((entry) => isObject(entry) && validateSchema(value, entry)).length : 1;
+  if (oneOfMatches !== 1) return false;
+  return !Array.isArray(schema.allOf) || schema.allOf.every((entry) => isObject(entry) && validateSchema(value, entry));
+};
+var validatesPattern = (value, schema) => typeof schema.pattern !== "string" || new RegExp(schema.pattern, "u").test(value);
+var validatesFormat = (value, schema) => schema.format !== "date-time" || isUtcMillisecondTimestamp(value);
+var validatesMinimumLength = (value, schema) => typeof schema.minLength !== "number" || value.length >= schema.minLength;
+var validatesMaximumLength = (value, schema) => typeof schema.maxLength !== "number" || value.length <= schema.maxLength;
+var stringValidators = [validatesPattern, validatesFormat, validatesMinimumLength, validatesMaximumLength];
+var validatesString = (value, schema) => stringValidators.every((validate) => validate(value, schema));
+var validatesMinimumItems = (value, schema) => typeof schema.minItems !== "number" || value.length >= schema.minItems;
+var validatesUniqueItems = (value, schema) => schema.uniqueItems !== true || hasUniqueItems(value);
+var validatesItems = (value, schema) => !isObject(schema.items) || value.every((entry) => validateSchema(entry, schema.items));
+var arrayValidators = [validatesMinimumItems, validatesUniqueItems, validatesItems];
+var validatesArray = (value, schema) => arrayValidators.every((validate) => validate(value, schema));
+var validatesRequiredProperties = (value, schema) => !Array.isArray(schema.required) || schema.required.every((key) => typeof key === "string" && key in value);
+var validatesProperties = (value, schema) => {
+  if (!isObject(schema.properties)) return true;
+  if (!validatesRequiredProperties(value, schema)) return false;
+  return Object.entries(schema.properties).every(([key, propertySchema]) => !(key in value) || isObject(propertySchema) && validateSchema(value[key], propertySchema));
+};
+var schemaValidators = [validatesConstants, validatesDeclaredType, validatesCompositions];
+var validatesValueConstraints = (value, schema) => {
+  if (typeof value === "string") return validatesString(value, schema);
+  if (Array.isArray(value)) return validatesArray(value, schema);
+  if (isObject(value)) return validatesProperties(value, schema);
+  return true;
+};
+var validateSchema = (value, schema) => {
+  const referenceResult = validatesReference(value, schema);
+  if (referenceResult !== void 0) return referenceResult;
+  if (!schemaValidators.every((validate) => validate(value, schema))) return false;
+  return validatesValueConstraints(value, schema);
+};
+var validateWebhookEnvelopeV1 = (value) => {
+  const { oneOf: _oneOf, ...envelopeSchema } = webhookEventSchemaV1;
+  return validateSchema(value, envelopeSchema);
+};
+var validateKnownWebhookEventV1 = (value) => validateSchema(value, webhookEventSchemaV1);
+
+// src/webhooks/verify.ts
+var DEFAULT_TOLERANCE_SECONDS = 300;
+var MAX_HEADER_LENGTH = 4096;
+var MAX_SIGNATURES = 32;
+var MAX_SECRETS = 16;
+var MAX_BODY_BYTES = 256 * 1024;
+var encoder = new TextEncoder();
+var decoder = new TextDecoder("utf-8", { fatal: true });
+var knownNames = new Set(knownWebhookEventNamesV1);
+var normalizeHeaderValue = (value, allowArray) => {
+  if (!Array.isArray(value)) return value;
+  if (!allowArray || value.length === 0) throw new WebhookVerificationError("malformed_headers");
+  return value.join(" ");
+};
+var getRecordHeader = (headers, name, allowArray) => {
+  const entries = Object.entries(headers).filter(([key]) => key.toLowerCase() === name);
+  if (entries.length > 1) throw new WebhookVerificationError("malformed_headers");
+  return normalizeHeaderValue(entries[0]?.[1], allowArray);
+};
+var getHeader = (headers, name, allowArray = false) => {
+  if (headers instanceof Headers) return headers.get(name) ?? void 0;
+  return getRecordHeader(headers, name, allowArray);
+};
+var parseBase64 = (value) => {
+  if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u.test(value)) return void 0;
+  try {
+    const binary = atob(value);
+    return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+  } catch {
+    return void 0;
+  }
+};
+var decodeSecrets = (secrets) => {
+  if (!Array.isArray(secrets) || secrets.length === 0 || secrets.length > MAX_SECRETS) {
+    throw new WebhookVerificationError("invalid_secret");
+  }
+  return secrets.map(decodeSecret);
+};
+var decodeSecret = (secret) => {
+  if (typeof secret !== "string") throw new WebhookVerificationError("invalid_secret");
+  if (!secret.startsWith("whsec_")) throw new WebhookVerificationError("invalid_secret");
+  return requireSecretBytes(parseBase64(secret.slice(6)));
+};
+var requireSecretBytes = (decoded) => {
+  if (decoded === void 0) throw new WebhookVerificationError("invalid_secret");
+  if (decoded.length !== 32) throw new WebhookVerificationError("invalid_secret");
+  return decoded;
+};
+var parseTimestamp = (timestampValue) => {
+  if (timestampValue.length > 16 || !/^[0-9]+$/u.test(timestampValue)) throw new WebhookVerificationError("malformed_headers");
+  const timestamp = Number(timestampValue);
+  if (!Number.isSafeInteger(timestamp)) throw new WebhookVerificationError("malformed_headers");
+  return timestamp;
+};
+var parseSignature = (part) => {
+  const match = /^v1,([A-Za-z0-9+/]+={0,2})$/u.exec(part);
+  if (!match) throw new WebhookVerificationError("malformed_headers");
+  return requireSignatureBytes(parseBase64(match[1] ?? ""));
+};
+var requireSignatureBytes = (bytes) => {
+  if (bytes === void 0) throw new WebhookVerificationError("malformed_headers");
+  if (bytes.length !== 32) throw new WebhookVerificationError("malformed_headers");
+  return bytes;
+};
+var parseSignatures = (signatureValue) => {
+  if (signatureValue.length > MAX_HEADER_LENGTH) throw new WebhookVerificationError("malformed_headers");
+  const parts = signatureValue.split(" ");
+  if (parts.length === 0 || parts.length > MAX_SIGNATURES) throw new WebhookVerificationError("malformed_headers");
+  return parts.map(parseSignature);
+};
+var requireHeader = (headers, name, allowArray = false) => {
+  const value = getHeader(headers, name, allowArray);
+  if (value === void 0) throw new WebhookVerificationError("missing_headers");
+  return value;
+};
+var parseHeaders = (headers) => {
+  const id = requireHeader(headers, "webhook-id");
+  const timestampValue = requireHeader(headers, "webhook-timestamp");
+  const signatureValue = requireHeader(headers, "webhook-signature", true);
+  if (id.length === 0 || id.length > 128) throw new WebhookVerificationError("malformed_headers");
+  return { id, timestamp: parseTimestamp(timestampValue), timestampValue, signatures: parseSignatures(signatureValue) };
+};
+var signedPayload = (id, timestamp, rawBody) => {
+  const prefix = encoder.encode(`${id}.${timestamp}.`);
+  const payload = new Uint8Array(prefix.length + rawBody.length);
+  payload.set(prefix);
+  payload.set(rawBody, prefix.length);
+  return payload;
+};
+var constantTimeEqual = (left, right) => {
+  let difference = left.length ^ right.length;
+  const length = Math.max(left.length, right.length);
+  for (let index = 0; index < length; index += 1) difference |= (left[index] ?? 0) ^ (right[index] ?? 0);
+  return difference === 0;
+};
+var signatureSetMatches = (expected, signatures) => {
+  let matched = false;
+  for (const supplied of signatures) matched = constantTimeEqual(expected, supplied) || matched;
+  return matched;
+};
+var signPayload = async (payload, secret) => {
+  const key = await crypto.subtle.importKey("raw", new Uint8Array(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  return new Uint8Array(await crypto.subtle.sign("HMAC", key, new Uint8Array(payload)));
+};
+var verifySignature = async (payload, secrets, signatures) => {
+  let matched = false;
+  for (const secret of secrets) {
+    matched = signatureSetMatches(await signPayload(payload, secret), signatures) || matched;
+  }
+  if (!matched) throw new WebhookVerificationError("invalid_signature");
+};
+var isFreezable = (value) => Boolean(value) && typeof value === "object";
+var deepFreeze = (value) => {
+  if (!isFreezable(value)) return value;
+  if (Object.isFrozen(value)) return value;
+  for (const child of Object.values(value)) deepFreeze(child);
+  Object.freeze(value);
+  return value;
+};
+var validateTolerance = (tolerance) => {
+  if (!Number.isSafeInteger(tolerance) || tolerance < 0) throw new WebhookVerificationError("malformed_headers");
+};
+var currentSeconds = (now) => {
+  const currentTimeMilliseconds = now instanceof Date ? now.getTime() : Number.NaN;
+  if (!Number.isFinite(currentTimeMilliseconds)) throw new WebhookVerificationError("stale_timestamp");
+  return Math.floor(currentTimeMilliseconds / 1e3);
+};
+var validateTimestamp = (timestamp, tolerance, now) => {
+  validateTolerance(tolerance);
+  if (Math.abs(currentSeconds(now) - timestamp) > tolerance) throw new WebhookVerificationError("stale_timestamp");
+};
+var parseBody = (rawBody) => {
+  try {
+    return JSON.parse(decoder.decode(rawBody));
+  } catch {
+    throw new WebhookVerificationError("invalid_json");
+  }
+};
+var invalidApiVersion = (body) => typeof body === "object" && body !== null && "api_version" in body && body.api_version !== 1;
+var assertValidEnvelope = (body) => {
+  if (validateWebhookEnvelopeV1(body)) return;
+  if (invalidApiVersion(body)) throw new WebhookVerificationError("unsupported_api_version");
+  throw new WebhookVerificationError("invalid_event_body");
+};
+var assertEventShape = (body) => {
+  if (typeof body.event !== "string") throw new WebhookVerificationError("invalid_event_body");
+  if (!isEventData(body.data)) throw new WebhookVerificationError("invalid_event_body");
+};
+var isEventData = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var validateEnvelope = (body, headerId) => {
+  assertValidEnvelope(body);
+  if (body.api_version !== 1) throw new WebhookVerificationError("unsupported_api_version");
+  if (body.id !== headerId) throw new WebhookVerificationError("identifier_mismatch");
+  assertEventShape(body);
+};
+var validatedEvent = (body, headerId) => {
+  validateEnvelope(body, headerId);
+  if (!knownNames.has(body.event)) return deepFreeze(body);
+  if (!validateKnownWebhookEventV1(body)) throw new WebhookVerificationError("invalid_event_body");
+  return deepFreeze(body);
+};
+var verifyWebhook = async (input) => {
+  assertBodySize(input.rawBody);
+  const parsedHeaders = parseHeaders(input.headers);
+  validateTimestamp(parsedHeaders.timestamp, input.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS, input.now?.() ?? /* @__PURE__ */ new Date());
+  const secrets = decodeSecrets(input.secrets);
+  await verifySignature(signedPayload(parsedHeaders.id, parsedHeaders.timestampValue, input.rawBody), secrets, parsedHeaders.signatures);
+  return validatedEvent(parseBody(input.rawBody), parsedHeaders.id);
+};
+function assertBodySize(rawBody) {
+  if (rawBody.byteLength > MAX_BODY_BYTES) throw new WebhookVerificationError("invalid_event_body");
+}
+
+// src/webhooks/processor.ts
+var knownNames2 = new Set(knownWebhookEventNamesV1);
+var MAX_LEASE_MILLISECONDS = 3e5;
+var result = (value) => Object.freeze(value);
+var observe = (callback) => {
+  if (!callback) return;
+  try {
+    void Promise.resolve(callback()).catch(() => void 0);
+  } catch {
+  }
+};
+var emitDiagnostic = (callback, event, startedAt) => {
+  observe(callback ? () => callback(Object.freeze({ ...event, durationMilliseconds: Math.max(0, performance.now() - startedAt) })) : void 0);
+};
+var safeRetryAfter = (value) => {
+  if (!Number.isFinite(value) || value <= 0) return 1;
+  return Math.min(300, Math.ceil(value));
+};
+var releaseLease = async (inbox, eventId, token) => {
+  try {
+    await inbox.release({ eventId, token });
+  } catch {
+  }
+};
+var failedResult = (options, startedAt, errorCode, identity = {}) => {
+  emitDiagnostic(options.onDiagnostic, { phase: "failed", outcome: "failed", ...identity }, startedAt);
+  return result({ status: 500, outcome: "failed", errorCode, ...identity });
+};
+var loadSecrets = async (options, startedAt) => {
+  try {
+    const secrets = typeof options.secrets === "function" ? await options.secrets() : options.secrets;
+    return { ok: true, secrets };
+  } catch {
+    return { ok: false, failure: failedResult(options, startedAt, "secret_provider_unavailable") };
+  }
+};
+var rejectedResult = (options, startedAt, error) => {
+  const errorCode = error instanceof WebhookVerificationError ? error.code : "verification_failed";
+  if (errorCode === "invalid_secret") return failedResult(options, startedAt, errorCode);
+  emitDiagnostic(options.onDiagnostic, { phase: "rejected", outcome: "rejected" }, startedAt);
+  return result({ status: errorCode === "invalid_signature" ? 401 : 400, outcome: "rejected", errorCode });
+};
+var verifyInput = async (input, secrets, options, startedAt) => {
+  try {
+    return await verifyWebhook({ ...input, secrets, toleranceSeconds: options.toleranceSeconds });
+  } catch (error) {
+    return rejectedResult(options, startedAt, error);
+  }
+};
+var acquireLease = async (options, leaseMilliseconds, identity, startedAt) => {
+  try {
+    const claim = await options.inbox.acquire({ eventId: identity.eventId, leaseMilliseconds });
+    if (claim.state === "completed") return result({ status: 200, outcome: "duplicate", ...identity });
+    if (claim.state === "busy") return result({ status: 503, outcome: "busy", retryAfterSeconds: safeRetryAfter(claim.retryAfterSeconds), ...identity });
+    return claim;
+  } catch {
+    return failedResult(options, startedAt, "inbox_unavailable", identity);
+  }
+};
+var knownHandler = (event, handlers) => handlers[event.event];
+var handleKnownEvent = async (event, options) => {
+  const handler = knownHandler(event, options.handlers);
+  if (typeof handler !== "function") return "handler_missing";
+  await handler(event);
+  return void 0;
+};
+var observeUnknownEvent = (event, callback) => {
+  if (!callback) return;
+  observe(() => callback(event));
+};
+var handleAuthenticatedEvent = async (event, options) => {
+  if (knownNames2.has(event.event)) return handleKnownEvent(event, options);
+  observeUnknownEvent(event, options.onUnknownEvent);
+  return void 0;
+};
+var handleEvent = async (event, claim, options, identity, startedAt) => {
+  try {
+    const errorCode = await handleAuthenticatedEvent(event, options);
+    if (errorCode) {
+      await releaseLease(options.inbox, event.id, claim.token);
+      return failedResult(options, startedAt, errorCode, identity);
+    }
+    emitDiagnostic(options.onDiagnostic, { phase: "handled", outcome: "processed", ...identity }, startedAt);
+    return void 0;
+  } catch {
+    await releaseLease(options.inbox, event.id, claim.token);
+    return failedResult(options, startedAt, "handler_failed", identity);
+  }
+};
+var completeLease = async (claim, options, identity, startedAt) => {
+  try {
+    await options.inbox.complete({ eventId: identity.eventId, token: claim.token });
+    return void 0;
+  } catch {
+    return failedResult(options, startedAt, "inbox_complete_failed", identity);
+  }
+};
+var requireSecretLoad = (load) => {
+  if (!load.ok) throw new ProcessingStopped(load.failure);
+  return load.secrets;
+};
+var requireValue = (value) => {
+  if ("status" in value) throw new ProcessingStopped(value);
+  return value;
+};
+var requireSuccess = (failure) => {
+  if (failure) throw new ProcessingStopped(failure);
+};
+var ProcessingStopped = class extends Error {
+  constructor(processResult) {
+    super("Webhook processing stopped with a bounded result.");
+    this.processResult = processResult;
+  }
+  processResult;
+};
+var runProcessingStages = async (input, options, leaseMilliseconds, startedAt) => {
+  const secrets = requireSecretLoad(await loadSecrets(options, startedAt));
+  const event = requireValue(await verifyInput(input, secrets, options, startedAt));
+  const identity = { eventId: event.id, eventName: event.event, apiVersion: event.api_version };
+  emitDiagnostic(options.onDiagnostic, { phase: "verified", outcome: "processed", ...identity }, startedAt);
+  const claim = requireValue(await acquireLease(options, leaseMilliseconds, identity, startedAt));
+  emitDiagnostic(options.onDiagnostic, { phase: "acquired", outcome: "processed", ...identity }, startedAt);
+  requireSuccess(await handleEvent(event, claim, options, identity, startedAt));
+  requireSuccess(await completeLease(claim, options, identity, startedAt));
+  const outcome = knownNames2.has(event.event) ? "processed" : "ignored";
+  emitDiagnostic(options.onDiagnostic, { phase: "completed", outcome, ...identity }, startedAt);
+  return result({ status: 200, outcome, ...identity });
+};
+var processWebhook = async (input, options, leaseMilliseconds) => {
+  const startedAt = performance.now();
+  try {
+    return await runProcessingStages(input, options, leaseMilliseconds, startedAt);
+  } catch (error) {
+    if (error instanceof ProcessingStopped) return error.processResult;
+    throw error;
+  }
+};
+var createWebhookProcessor = (options) => {
+  const leaseMilliseconds = options.leaseMilliseconds ?? 3e4;
+  if (!validLeaseMilliseconds(leaseMilliseconds)) {
+    throw new RangeError("Webhook leaseMilliseconds must be an integer from 1 through 300000.");
+  }
+  return {
+    process: (input) => processWebhook(input, options, leaseMilliseconds)
+  };
+};
+var validLeaseMilliseconds = (value) => Number.isInteger(value) && value >= 1 && value <= MAX_LEASE_MILLISECONDS;
+var toWebhookResponse = (processResult) => {
+  const headers = new Headers();
+  if (processResult.retryAfterSeconds !== void 0) headers.set("Retry-After", String(processResult.retryAfterSeconds));
+  return new Response(null, { status: processResult.status, headers });
+};