@run402/functions 2.7.0 → 3.0.0

package/dist/lib/actor-context-verify.js

@@ -0,0 +1,200 @@
+/**
+ * SDK runtime verifier for the gateway-signed actor-context envelope.
+ *
+ * Why this lives in `packages/functions/src/lib/` (vendored shape):
+ *   - `@run402/functions` is published independently; it must NOT depend
+ *     on `@run402/gateway` types or runtime.
+ *   - The verifier is small, deterministic, and security-critical — easier
+ *     to audit when it lives next to the consumer.
+ *   - Matches the convention used for `jwt.ts` (vendored upstream copy of
+ *     the verifier we trust).
+ *
+ * Contract — the encoded envelope is `base64url(canonical_json) + "." +
+ * base64url(hmac_sha256)`. Canonical JSON has a fixed key order; the
+ * verifier doesn't re-canonicalise, it just rehmac's the body bytes that
+ * were base64-decoded. (Trying to re-derive canonical JSON from the parsed
+ * object would re-introduce key-order brittleness; verify the bytes you
+ * received, parse only to read fields.)
+ *
+ * Lookup of `actor_context_signing_key[kid]`:
+ *   1. `ACTOR_CONTEXT_SIGNING_KEY_MAP_JSON` env (`{kid: base64}` JSON).
+ *   2. `ACTOR_CONTEXT_SIGNING_KEY_<KID_UPPER>` env (one var per kid).
+ *   3. Test injection via `_setActorContextKeyMapForTest` on this module.
+ *
+ * Verification failure modes (mirrors the gateway side):
+ *   - "malformed"               — encoded shape rejected before parse
+ *   - "unknown_kid"             — envelope's kid not in the verifier map
+ *   - "bad_signature"           — HMAC mismatch
+ *   - "iss_mismatch"            — envelope.iss !== "run402-gateway"
+ *   - "aud_mismatch"            — envelope.aud !== "run402-functions-runtime"
+ *   - "expired"                 — envelope.exp <= now
+ *   - "lifetime_too_long"       — envelope.exp - envelope.iat > 60s
+ *   - "project_id_mismatch"     — envelope.project_id !== request's
+ *   - "request_id_mismatch"     — envelope.request_id !== request's
+ *   - "method_mismatch"         — different HTTP method
+ *   - "host_mismatch"           — different host (after default-port normalise)
+ *   - "path_mismatch"           — different path (compared by sha256)
+ *   - "version_mismatch"        — schema version not what we compiled
+ *
+ * On ANY failure the SDK runtime treats the request as anonymous AND
+ * logs `R402_AUTH_ACTOR_HEADER_SPOOF` so spoofs / replays are visible
+ * in observability.
+ *
+ * @see openspec/changes/auth-aware-ssr/specs/routed-http-functions/spec.md
+ */
+import crypto from "node:crypto";
+export const ACTOR_CONTEXT_ENVELOPE_VERSION = 1;
+export const ACTOR_CONTEXT_ENVELOPE_ISS = "run402-gateway";
+export const ACTOR_CONTEXT_ENVELOPE_AUD = "run402-functions-runtime";
+export const ACTOR_CONTEXT_MAX_LIFETIME_SEC = 60;
+/** Inbound header carrying the encoded envelope. The runtime reads from
+ *  the request headers in `RunRequestContext.request.headers`. */
+export const ACTOR_CONTEXT_HEADER = "x-run402-actor-context";
+// ---------------------------------------------------------------------------
+// Key store (env-loaded, test-injectable)
+// ---------------------------------------------------------------------------
+const KEY_MIN_BYTES = 32;
+let keyMap = null;
+function loadKeyMap() {
+    if (keyMap)
+        return keyMap;
+    const map = new Map();
+    const mapJson = process.env.ACTOR_CONTEXT_SIGNING_KEY_MAP_JSON;
+    if (mapJson) {
+        let parsed;
+        try {
+            parsed = JSON.parse(mapJson);
+        }
+        catch (err) {
+            throw new Error(`ACTOR_CONTEXT_SIGNING_KEY_MAP_JSON is not valid JSON: ${err.message}`);
+        }
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error("ACTOR_CONTEXT_SIGNING_KEY_MAP_JSON must be an object {kid: base64}");
+        }
+        for (const [kid, b64] of Object.entries(parsed)) {
+            if (typeof b64 !== "string")
+                continue;
+            const buf = Buffer.from(b64, "base64");
+            if (buf.length >= KEY_MIN_BYTES)
+                map.set(kid, buf);
+        }
+    }
+    for (const [envName, envValue] of Object.entries(process.env)) {
+        const match = envName.match(/^ACTOR_CONTEXT_SIGNING_KEY_([A-Z0-9_-]+)$/);
+        if (!match)
+            continue;
+        if (envName === "ACTOR_CONTEXT_SIGNING_KEY_CURRENT_KID" ||
+            envName === "ACTOR_CONTEXT_SIGNING_KEY_MAP_JSON") {
+            continue;
+        }
+        if (typeof envValue !== "string" || envValue.length === 0)
+            continue;
+        const kid = match[1].toLowerCase().replace(/_/g, "-");
+        if (map.has(kid))
+            continue;
+        const buf = Buffer.from(envValue, "base64");
+        if (buf.length >= KEY_MIN_BYTES)
+            map.set(kid, buf);
+    }
+    keyMap = map;
+    return map;
+}
+/** Test injection. NEVER call from production code. */
+export function _setActorContextKeyMapForTest(map) {
+    if (map === null) {
+        keyMap = null;
+        return;
+    }
+    const m = new Map();
+    for (const [kid, value] of Object.entries(map)) {
+        const buf = Buffer.isBuffer(value) ? value : Buffer.from(value, "base64");
+        if (buf.length < KEY_MIN_BYTES) {
+            throw new Error(`Actor-context key for kid "${kid}" is too short`);
+        }
+        m.set(kid, buf);
+    }
+    keyMap = m;
+}
+// ---------------------------------------------------------------------------
+// Verifier
+// ---------------------------------------------------------------------------
+export function verifyActorContextEnvelope(encoded, ctx) {
+    if (typeof encoded !== "string" || encoded.length === 0) {
+        return { ok: false, reason: "malformed" };
+    }
+    const dot = encoded.indexOf(".");
+    if (dot <= 0 || dot === encoded.length - 1) {
+        return { ok: false, reason: "malformed" };
+    }
+    const bodyB64 = encoded.slice(0, dot);
+    const sigB64 = encoded.slice(dot + 1);
+    if (!/^[A-Za-z0-9_-]+$/.test(bodyB64) || !/^[A-Za-z0-9_-]+$/.test(sigB64)) {
+        return { ok: false, reason: "malformed" };
+    }
+    let bodyBuf;
+    let envelope;
+    try {
+        bodyBuf = Buffer.from(bodyB64, "base64url");
+        envelope = JSON.parse(bodyBuf.toString("utf8"));
+    }
+    catch {
+        return { ok: false, reason: "malformed" };
+    }
+    if (!envelope || typeof envelope !== "object") {
+        return { ok: false, reason: "malformed" };
+    }
+    if (envelope.v !== ACTOR_CONTEXT_ENVELOPE_VERSION) {
+        return { ok: false, reason: "version_mismatch" };
+    }
+    if (typeof envelope.kid !== "string")
+        return { ok: false, reason: "malformed" };
+    const key = loadKeyMap().get(envelope.kid);
+    if (!key)
+        return { ok: false, reason: "unknown_kid" };
+    const sigBuf = Buffer.from(sigB64, "base64url");
+    const expectedSig = crypto.createHmac("sha256", key).update(bodyBuf).digest();
+    if (sigBuf.length !== expectedSig.length) {
+        return { ok: false, reason: "bad_signature" };
+    }
+    if (!crypto.timingSafeEqual(sigBuf, expectedSig)) {
+        return { ok: false, reason: "bad_signature" };
+    }
+    if (envelope.iss !== ACTOR_CONTEXT_ENVELOPE_ISS) {
+        return { ok: false, reason: "iss_mismatch" };
+    }
+    if (envelope.aud !== ACTOR_CONTEXT_ENVELOPE_AUD) {
+        return { ok: false, reason: "aud_mismatch" };
+    }
+    if (typeof envelope.iat !== "number" || typeof envelope.exp !== "number") {
+        return { ok: false, reason: "malformed" };
+    }
+    if (envelope.exp - envelope.iat > ACTOR_CONTEXT_MAX_LIFETIME_SEC) {
+        return { ok: false, reason: "lifetime_too_long" };
+    }
+    const nowSec = Math.floor((ctx.now ?? new Date()).getTime() / 1000);
+    if (envelope.exp <= nowSec)
+        return { ok: false, reason: "expired" };
+    if (envelope.project_id !== ctx.projectId) {
+        return { ok: false, reason: "project_id_mismatch" };
+    }
+    if (envelope.request_id !== ctx.requestId) {
+        return { ok: false, reason: "request_id_mismatch" };
+    }
+    if (envelope.method !== ctx.method.toUpperCase()) {
+        return { ok: false, reason: "method_mismatch" };
+    }
+    if (envelope.host !== normaliseHost(ctx.host)) {
+        return { ok: false, reason: "host_mismatch" };
+    }
+    if (envelope.path_hash !== sha256Hex(ctx.path)) {
+        return { ok: false, reason: "path_mismatch" };
+    }
+    return { ok: true, envelope };
+}
+function normaliseHost(host) {
+    return host.toLowerCase().replace(/:80$/, "").replace(/:443$/, "");
+}
+function sha256Hex(s) {
+    return crypto.createHash("sha256").update(s, "utf8").digest("hex");
+}
+//# sourceMappingURL=actor-context-verify.js.map

package/dist/lib/actor-context-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor-context-verify.js","sourceRoot":"","sources":["../../src/lib/actor-context-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAU,CAAC;AACzD,MAAM,CAAC,MAAM,0BAA0B,GAAG,gBAAgB,CAAC;AAC3D,MAAM,CAAC,MAAM,0BAA0B,GAAG,0BAA0B,CAAC;AACrE,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAEjD;kEACkE;AAClE,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AAwD7D,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,IAAI,MAAM,GAA+B,IAAI,CAAC;AAE9C,SAAS,UAAU;IACjB,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEtC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC;IAC/D,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,yDAA0D,GAAa,CAAC,OAAO,EAAE,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;YAC3E,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,SAAS;YACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACvC,IAAI,GAAG,CAAC,MAAM,IAAI,aAAa;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IACE,OAAO,KAAK,uCAAuC;YACnD,OAAO,KAAK,oCAAoC,EAChD,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACpE,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvD,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC5C,IAAI,GAAG,CAAC,MAAM,IAAI,aAAa;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,GAAG,GAAG,CAAC;IACb,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,6BAA6B,CAC3C,GAA2C;IAE3C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,GAAG,IAAI,CAAC;QACd,OAAO;IACT,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC1E,IAAI,GAAG,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,gBAAgB,CAAC,CAAC;QACrE,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,CAAC,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,MAAM,UAAU,0BAA0B,CACxC,OAAe,EACf,GAAyB;IAEzB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,OAAe,CAAC;IACpB,IAAI,QAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC5C,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAqB,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,QAAQ,CAAC,CAAC,KAAK,8BAA8B,EAAE,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAEhF,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAEtD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9E,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IAED,IAAI,QAAQ,CAAC,GAAG,KAAK,0BAA0B,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC/C,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,KAAK,0BAA0B,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC/C,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,GAAG,QAAQ,CAAC,GAAG,GAAG,8BAA8B,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACpE,IAAI,QAAQ,CAAC,GAAG,IAAI,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAEpE,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC"}

package/dist/runtime-context.d.ts

@@ -27,6 +27,15 @@
  * @see openspec/changes/astro-ssr-runtime/specs/routed-http-functions/spec.md
  */
 import { AsyncLocalStorage } from "node:async_hooks";
+import { type VerifiedActorPayload } from "./lib/actor-context-verify.js";
+/** Capability `auth-aware-ssr`: the verified actor payload the SDK
+ *  exposes via `auth.user()` etc. Populated by `runWithContext` after
+ *  it verifies the inbound actor-context envelope. `null` when the
+ *  request is anonymous OR when verification failed (defense in depth:
+ *  forged envelopes never surface as a non-null actor). */
+export type ActorContext = VerifiedActorPayload & {
+    sessionId: string;
+};
 /** The shape stored in AsyncLocalStorage. See the spec referenced above
  *  for the canonical definition. */
 export interface RunRequestContext {
@@ -52,6 +61,10 @@ export interface RunRequestContext {
         url: string;
         headers: Record<string, string | string[] | undefined>;
     };
+    /** Capability `auth-aware-ssr`: actor populated from the verified
+     *  gateway-signed envelope. The SDK's `auth.user()` returns this
+     *  verbatim; consumer code never sees the raw envelope. */
+    actor: ActorContext | null;
     /** Mutable ref: SDK functions that read request-scoped auth or invoke
      *  payment primitives set `value = true`. The SSR Lambda runtime
      *  returns the final value to the gateway in the response metadata
@@ -85,7 +98,7 @@ export declare function getCurrentContext(): RunRequestContext | undefined;
  * runtime) flips it to `false` after the response body is materialized.
  * Don't call this from user code — it's the runtime's primitive.
  */
-export declare function runWithContext<T>(context: Omit<RunRequestContext, "cacheBypassTainted" | "active"> & Partial<Pick<RunRequestContext, "cacheBypassTainted" | "active">>, callback: () => Promise<T> | T): Promise<T> | T;
+export declare function runWithContext<T>(context: Omit<RunRequestContext, "cacheBypassTainted" | "active" | "actor"> & Partial<Pick<RunRequestContext, "cacheBypassTainted" | "active" | "actor">>, callback: () => Promise<T> | T): Promise<T> | T;
 /**
  * Throw a structured `R402_SDK_OUTSIDE_REQUEST_CONTEXT` error. Used by
  * SDK functions when they're invoked with no ALS store OR while the

package/dist/runtime-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-context.d.ts","sourceRoot":"","sources":["../src/runtime-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD;oCACoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB;yBACqB;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;qDACiD;IACjD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;yDACqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb;;;uBAGmB;IACnB,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;KACxD,CAAC;IACF;;;oBAGgB;IAChB,kBAAkB,EAAE;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;IACvC;;;8CAG0C;IAC1C,MAAM,EAAE;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;CAC5B;AAED;oEACoE;AACpE,eAAO,MAAM,GAAG,sCAA6C,CAAC;AAE9D;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,iBAAiB,GAAG,SAAS,CAEjE;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAC9B,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,oBAAoB,GAAG,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,oBAAoB,GAAG,QAAQ,CAAC,CAAC,EACrI,QAAQ,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAC7B,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAOhB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IACzD,QAAQ,CAAC,IAAI,sCAAsC;IACnD,QAAQ,CAAC,IAAI,iEAAiE;IAC9E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,kBAAkB,CAAC;gBAEtC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,kBAAkB;CAc1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,iBAAiB,CAS3E;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAKvC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAUjD,CAAC;AAEH;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,SAAS,OAAO,EAAE,EAAE,OAAO,EAC/D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,KAAK,OAAO,GAChC,CAAC,GAAG,IAAI,EAAE,KAAK,KAAK,OAAO,CAe7B"}
+{"version":3,"file":"runtime-context.d.ts","sourceRoot":"","sources":["../src/runtime-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAGL,KAAK,oBAAoB,EAE1B,MAAM,+BAA+B,CAAC;AAEvC;;;;2DAI2D;AAC3D,MAAM,MAAM,YAAY,GAAG,oBAAoB,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE;oCACoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB;yBACqB;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;qDACiD;IACjD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;yDACqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb;;;uBAGmB;IACnB,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;KACxD,CAAC;IACF;;+DAE2D;IAC3D,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3B;;;oBAGgB;IAChB,kBAAkB,EAAE;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;IACvC;;;8CAG0C;IAC1C,MAAM,EAAE;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;CAC5B;AAED;oEACoE;AACpE,eAAO,MAAM,GAAG,sCAA6C,CAAC;AAE9D;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,iBAAiB,GAAG,SAAS,CAEjE;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAC9B,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,oBAAoB,GAAG,QAAQ,GAAG,OAAO,CAAC,GACzE,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,oBAAoB,GAAG,QAAQ,GAAG,OAAO,CAAC,CAAC,EAC7E,QAAQ,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAC7B,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAgBhB;AA6DD;;;;;;;;;;;GAWG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IACzD,QAAQ,CAAC,IAAI,sCAAsC;IACnD,QAAQ,CAAC,IAAI,iEAAiE;IAC9E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,kBAAkB,CAAC;gBAEtC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,kBAAkB;CAc1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,iBAAiB,CAS3E;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAKvC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAUjD,CAAC;AAEH;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,SAAS,OAAO,EAAE,EAAE,OAAO,EAC/D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,KAAK,OAAO,GAChC,CAAC,GAAG,IAAI,EAAE,KAAK,KAAK,OAAO,CAe7B"}

package/dist/runtime-context.js

@@ -27,6 +27,7 @@
  * @see openspec/changes/astro-ssr-runtime/specs/routed-http-functions/spec.md
  */
 import { AsyncLocalStorage } from "node:async_hooks";
+import { verifyActorContextEnvelope, ACTOR_CONTEXT_HEADER, } from "./lib/actor-context-verify.js";
 /** The shared ALS instance. Modules in @run402/functions read from
  *  this; the SSR Lambda runtime (in @run402/astro) writes to it. */
 export const als = new AsyncLocalStorage();
@@ -48,13 +49,72 @@ export function getCurrentContext() {
  * Don't call this from user code — it's the runtime's primitive.
  */
 export function runWithContext(context, callback) {
+    // Resolve the actor either from the caller-provided override (tests, the
+    // SSR runtime when it has pre-verified the envelope) or by verifying the
+    // inbound actor-context header against the request bound to this context.
+    // Failure is non-fatal: the request becomes anonymous AND we log
+    // `R402_AUTH_ACTOR_HEADER_SPOOF` so spoof attempts surface in metrics.
+    const actor = context.actor !== undefined
+        ? context.actor
+        : verifyEnvelopeFromRequest(context);
     const full = {
         ...context,
+        actor,
         cacheBypassTainted: context.cacheBypassTainted ?? { value: false },
         active: context.active ?? { value: true },
     };
     return als.run(full, callback);
 }
+function verifyEnvelopeFromRequest(ctx) {
+    const headers = ctx.request.headers;
+    const headerValue = headers[ACTOR_CONTEXT_HEADER];
+    const encoded = Array.isArray(headerValue) ? headerValue[0] : headerValue;
+    if (!encoded || typeof encoded !== "string")
+        return null;
+    // The runtime sees `request.url` as a full path-only string from the
+    // SSR Lambda envelope (e.g. `/forum/topic-1?q=astro`). The signing side
+    // hashed the path-only URL, so we hash the same here. The query string
+    // is part of the binding so `/forum?topic=1` and `/forum?topic=2` can't
+    // accept the same envelope.
+    const path = ctx.request.url;
+    const outcome = verifyActorContextEnvelope(encoded, {
+        projectId: ctx.projectId,
+        requestId: ctx.requestId,
+        method: ctx.request.method,
+        host: ctx.host,
+        path,
+    });
+    if (!outcome.ok) {
+        logActorContextSpoof(outcome.reason, ctx.requestId);
+        return null;
+    }
+    return {
+        id: outcome.envelope.actor.id,
+        email: outcome.envelope.actor.email,
+        emailVerified: outcome.envelope.actor.emailVerified,
+        authTime: outcome.envelope.actor.authTime,
+        amr: outcome.envelope.actor.amr,
+        amrTimes: outcome.envelope.actor.amrTimes,
+        authzVersion: outcome.envelope.actor.authzVersion,
+        // session_id is NOT in the envelope — it's gateway-internal state.
+        // For now we mint a deterministic-by-request id so downstream code
+        // has a string to hang `db()` set_config on. Once the gateway adds
+        // session_id to the envelope (planned in section 4 of the spec),
+        // populate it here from outcome.envelope.actor.sessionId.
+        sessionId: outcome.envelope.request_id,
+    };
+}
+function logActorContextSpoof(reason, requestId) {
+    // Structured one-line log so observability can alert on rate. The
+    // SDK runs in Lambda; CloudWatch picks this up.
+    // eslint-disable-next-line no-console
+    console.warn(JSON.stringify({
+        level: "warn",
+        event: "R402_AUTH_ACTOR_HEADER_SPOOF",
+        reason,
+        request_id: requestId,
+    }));
+}
 /**
  * Throw a structured `R402_SDK_OUTSIDE_REQUEST_CONTEXT` error. Used by
  * SDK functions when they're invoked with no ALS store OR while the

package/dist/runtime-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-context.js","sourceRoot":"","sources":["../src/runtime-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAuCrD;oEACoE;AACpE,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,iBAAiB,EAAqB,CAAC;AAE9D;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAqI,EACrI,QAA8B;IAE9B,MAAM,IAAI,GAAsB;QAC9B,GAAG,OAAO;QACV,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE;QAClE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;KAC1C,CAAC;IACF,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IAChD,IAAI,GAAG,kCAAkC,CAAC;IAC1C,IAAI,GAAG,6DAA6D,CAAC;IACrE,YAAY,CAAS;IACrB,WAAW,CAAS;IACpB,KAAK,CAAoC;IAElD,YAAY,WAAmB,EAAE,KAAwC;QACvE,MAAM,QAAQ,GACZ,KAAK,KAAK,YAAY;YACpB,CAAC,CAAC,2EAA2E;YAC7E,CAAC,CAAC,sGAAsG,CAAC;QAC7G,KAAK,CAAC,GAAG,WAAW,KAAK,QAAQ,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,YAAY;YACf,KAAK,KAAK,YAAY;gBACpB,CAAC,CAAC,YAAY,WAAW,oIAAoI;gBAC7J,CAAC,CAAC,2BAA2B,WAAW,4HAA4H,CAAC;IAC3K,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC3B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,gCAAgC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,gCAAgC,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC3B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,GAAG,CAAC,kBAAkB,CAAC,KAAK,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;AAC7D,gEAAgE;AAChE,mEAAmE;AACnE,qEAAqE;AACrE,gBAAgB;AAChB,mEAAmE;AACnE,2BAA2B;AAC3B,wBAAwB;AACxB,qBAAqB;AACrB,wBAAwB;CACzB,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,IAAiC;IAEjC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,kEAAkE;QAClE,qEAAqE;QACrE,qEAAqE;QACrE,sCAAsC;QACtC,OAAO,CAAC,IAAI,CACV,8BAA8B,IAAI,kBAAkB,IAAI,kCAAkC;YACxF,kGAAkG,CACrG,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,IAAW,EAAW,EAAE;QACjC,gBAAgB,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"runtime-context.js","sourceRoot":"","sources":["../src/runtime-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,GAGrB,MAAM,+BAA+B,CAAC;AAkDvC;oEACoE;AACpE,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,iBAAiB,EAAqB,CAAC;AAE9D;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,OAC6E,EAC7E,QAA8B;IAE9B,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,iEAAiE;IACjE,uEAAuE;IACvE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS;QACvC,CAAC,CAAC,OAAO,CAAC,KAAK;QACf,CAAC,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,IAAI,GAAsB;QAC9B,GAAG,OAAO;QACV,KAAK;QACL,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE;QAClE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;KAC1C,CAAC;IACF,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,yBAAyB,CAChC,GAA4E;IAE5E,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;IACpC,MAAM,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IAC1E,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEzD,qEAAqE;IACrE,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,4BAA4B;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;IAE7B,MAAM,OAAO,GAAG,0BAA0B,CAAC,OAAO,EAAE;QAClD,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM;QAC1B,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI;KACL,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,oBAAoB,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;QAC7B,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK;QACnC,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa;QACnD,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ;QACzC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG;QAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ;QACzC,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY;QACjD,mEAAmE;QACnE,mEAAmE;QACnE,mEAAmE;QACnE,iEAAiE;QACjE,0DAA0D;QAC1D,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU;KACvC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,MAA2B,EAAE,SAAiB;IAC1E,kEAAkE;IAClE,gDAAgD;IAChD,sCAAsC;IACtC,OAAO,CAAC,IAAI,CACV,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,8BAA8B;QACrC,MAAM;QACN,UAAU,EAAE,SAAS;KACtB,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IAChD,IAAI,GAAG,kCAAkC,CAAC;IAC1C,IAAI,GAAG,6DAA6D,CAAC;IACrE,YAAY,CAAS;IACrB,WAAW,CAAS;IACpB,KAAK,CAAoC;IAElD,YAAY,WAAmB,EAAE,KAAwC;QACvE,MAAM,QAAQ,GACZ,KAAK,KAAK,YAAY;YACpB,CAAC,CAAC,2EAA2E;YAC7E,CAAC,CAAC,sGAAsG,CAAC;QAC7G,KAAK,CAAC,GAAG,WAAW,KAAK,QAAQ,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,YAAY;YACf,KAAK,KAAK,YAAY;gBACpB,CAAC,CAAC,YAAY,WAAW,oIAAoI;gBAC7J,CAAC,CAAC,2BAA2B,WAAW,4HAA4H,CAAC;IAC3K,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC3B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,gCAAgC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,gCAAgC,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC3B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,GAAG,CAAC,kBAAkB,CAAC,KAAK,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;AAC7D,gEAAgE;AAChE,mEAAmE;AACnE,qEAAqE;AACrE,gBAAgB;AAChB,mEAAmE;AACnE,2BAA2B;AAC3B,wBAAwB;AACxB,qBAAqB;AACrB,wBAAwB;CACzB,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,IAAiC;IAEjC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,kEAAkE;QAClE,qEAAqE;QACrE,qEAAqE;QACrE,sCAAsC;QACtC,OAAO,CAAC,IAAI,CACV,8BAA8B,IAAI,kBAAkB,IAAI,kCAAkC;YACxF,kGAAkG,CACrG,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,IAAW,EAAW,EAAE;QACjC,gBAAgB,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC"}

package/dist/verify-webhook.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Verify a Run402 operator-notifications webhook request.
+ *
+ * Run402 signs every webhook delivery with HMAC-SHA256 in Stripe shape:
+ *   Run402-Signature: t=<unix_seconds>,v1=<hex_digest>
+ *
+ * where `<hex_digest>` is `HMAC_SHA256(secret, "${t}.${rawBody}")`.
+ *
+ * Receivers should call `verifyWebhook(headers, rawBody, secret)` BEFORE
+ * parsing or trusting the body. Pass the EXACT raw request body — re-
+ * serializing JSON will change byte order and break the HMAC.
+ *
+ * Dual-secret rotation: pass `previousSecret` (returned from
+ * `POST /agent/v1/webhook-secret/rotate` before rotation) to accept
+ * signatures created with either secret during the 24h grace window.
+ *
+ * Replay protection: the function rejects signatures whose `t` is more
+ * than `toleranceSeconds` (default 300 = 5 minutes) away from the
+ * current time.
+ *
+ * @example
+ * ```ts
+ * import { verifyWebhook } from "@run402/functions";
+ *
+ * export default async (req: Request) => {
+ *   const rawBody = await req.text();
+ *   const result = verifyWebhook(req.headers, rawBody, process.env.RUN402_WEBHOOK_SECRET!);
+ *   if (!result.valid) {
+ *     return new Response(`bad signature: ${result.reason}`, { status: 401 });
+ *   }
+ *   const event = JSON.parse(rawBody);
+ *   // …handle event…
+ *   return new Response("ok");
+ * };
+ * ```
+ */
+export interface VerifyWebhookOptions {
+    /** Maximum age of the signed timestamp, in seconds. Default 300 (5 min). */
+    toleranceSeconds?: number;
+    /** Optional previous secret accepted during a 24h rotation grace window. */
+    previousSecret?: string | null;
+    /** Override the current Unix timestamp (for tests). */
+    nowSeconds?: () => number;
+}
+export type VerifyWebhookResult = {
+    valid: true;
+    timestamp: number;
+    secret_used: "current" | "previous";
+} | {
+    valid: false;
+    reason: "missing_signature_header" | "malformed_signature_header" | "missing_timestamp" | "missing_v1" | "timestamp_out_of_tolerance" | "signature_mismatch";
+};
+/**
+ * Verify a Run402-signed webhook.
+ *
+ * @param headers Either an instance of `Headers` (Web API), a Node
+ *                `IncomingHttpHeaders`-shaped record, or any object with
+ *                `get(name)` and case-insensitive header access.
+ * @param rawBody The exact raw request body bytes received. Must NOT be
+ *                re-serialized from a parsed JSON object — byte-level
+ *                equality with the signed payload is required.
+ * @param secret The current webhook signing secret returned by
+ *               `POST /agent/v1/webhook-secret/rotate`.
+ * @param options Optional behavior tweaks.
+ */
+export declare function verifyWebhook(headers: HeadersLike, rawBody: string, secret: string, options?: VerifyWebhookOptions): VerifyWebhookResult;
+/** Anything we can read a header from. */
+export type HeadersLike = Headers | Record<string, string | string[] | undefined> | {
+    get(name: string): string | null;
+};
+//# sourceMappingURL=verify-webhook.d.ts.map

package/dist/verify-webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-webhook.d.ts","sourceRoot":"","sources":["../src/verify-webhook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,MAAM,WAAW,oBAAoB;IACnC,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,SAAS,GAAG,UAAU,CAAA;CAAE,GACvE;IACE,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EACF,0BAA0B,GAC1B,4BAA4B,GAC5B,mBAAmB,GACnB,YAAY,GACZ,4BAA4B,GAC5B,oBAAoB,CAAC;CAC1B,CAAC;AAEN;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,oBAAyB,GACjC,mBAAmB,CAoCrB;AAOD,0CAA0C;AAC1C,MAAM,MAAM,WAAW,GACnB,OAAO,GACP,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAC7C;IAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC"}

package/dist/verify-webhook.js

@@ -0,0 +1,147 @@
+/**
+ * Verify a Run402 operator-notifications webhook request.
+ *
+ * Run402 signs every webhook delivery with HMAC-SHA256 in Stripe shape:
+ *   Run402-Signature: t=<unix_seconds>,v1=<hex_digest>
+ *
+ * where `<hex_digest>` is `HMAC_SHA256(secret, "${t}.${rawBody}")`.
+ *
+ * Receivers should call `verifyWebhook(headers, rawBody, secret)` BEFORE
+ * parsing or trusting the body. Pass the EXACT raw request body — re-
+ * serializing JSON will change byte order and break the HMAC.
+ *
+ * Dual-secret rotation: pass `previousSecret` (returned from
+ * `POST /agent/v1/webhook-secret/rotate` before rotation) to accept
+ * signatures created with either secret during the 24h grace window.
+ *
+ * Replay protection: the function rejects signatures whose `t` is more
+ * than `toleranceSeconds` (default 300 = 5 minutes) away from the
+ * current time.
+ *
+ * @example
+ * ```ts
+ * import { verifyWebhook } from "@run402/functions";
+ *
+ * export default async (req: Request) => {
+ *   const rawBody = await req.text();
+ *   const result = verifyWebhook(req.headers, rawBody, process.env.RUN402_WEBHOOK_SECRET!);
+ *   if (!result.valid) {
+ *     return new Response(`bad signature: ${result.reason}`, { status: 401 });
+ *   }
+ *   const event = JSON.parse(rawBody);
+ *   // …handle event…
+ *   return new Response("ok");
+ * };
+ * ```
+ */
+import { createHmac, timingSafeEqual } from "node:crypto";
+/**
+ * Verify a Run402-signed webhook.
+ *
+ * @param headers Either an instance of `Headers` (Web API), a Node
+ *                `IncomingHttpHeaders`-shaped record, or any object with
+ *                `get(name)` and case-insensitive header access.
+ * @param rawBody The exact raw request body bytes received. Must NOT be
+ *                re-serialized from a parsed JSON object — byte-level
+ *                equality with the signed payload is required.
+ * @param secret The current webhook signing secret returned by
+ *               `POST /agent/v1/webhook-secret/rotate`.
+ * @param options Optional behavior tweaks.
+ */
+export function verifyWebhook(headers, rawBody, secret, options = {}) {
+    const tolerance = options.toleranceSeconds ?? 300;
+    const nowSeconds = options.nowSeconds ?? (() => Math.floor(Date.now() / 1000));
+    const headerValue = getHeader(headers, "run402-signature");
+    if (headerValue === null) {
+        // Header not present at all.
+        return { valid: false, reason: "missing_signature_header" };
+    }
+    const parsed = parseSignatureHeader(headerValue);
+    if (parsed === null) {
+        return { valid: false, reason: "malformed_signature_header" };
+    }
+    if (parsed.t === null) {
+        return { valid: false, reason: "missing_timestamp" };
+    }
+    if (parsed.v1Hex === null) {
+        return { valid: false, reason: "missing_v1" };
+    }
+    const now = nowSeconds();
+    if (Math.abs(now - parsed.t) > tolerance) {
+        return { valid: false, reason: "timestamp_out_of_tolerance" };
+    }
+    const signedPayload = `${parsed.t}.${rawBody}`;
+    if (constantTimeEqualHex(parsed.v1Hex, computeHmacHex(secret, signedPayload))) {
+        return { valid: true, timestamp: parsed.t, secret_used: "current" };
+    }
+    if (options.previousSecret) {
+        if (constantTimeEqualHex(parsed.v1Hex, computeHmacHex(options.previousSecret, signedPayload))) {
+            return { valid: true, timestamp: parsed.t, secret_used: "previous" };
+        }
+    }
+    return { valid: false, reason: "signature_mismatch" };
+}
+function getHeader(headers, name) {
+    // Web Headers: has .get and case-insensitive.
+    if (typeof headers.get === "function" && headers.get.length === 1) {
+        return headers.get(name);
+    }
+    // Plain object: case-insensitive lookup.
+    const lower = name.toLowerCase();
+    const rec = headers;
+    for (const key of Object.keys(rec)) {
+        if (key.toLowerCase() === lower) {
+            const v = rec[key];
+            if (Array.isArray(v))
+                return v[0] ?? null;
+            return v ?? null;
+        }
+    }
+    return null;
+}
+function parseSignatureHeader(value) {
+    // Format: t=<unix>,v1=<hex>[,v2=...]
+    // Use comma + equals splitting; reject anything else.
+    const trimmed = value.trim();
+    if (trimmed === "")
+        return null;
+    const parts = trimmed.split(",");
+    let t = null;
+    let v1Hex = null;
+    for (const raw of parts) {
+        const segment = raw.trim();
+        const eq = segment.indexOf("=");
+        if (eq <= 0)
+            return null;
+        const key = segment.slice(0, eq).trim();
+        const val = segment.slice(eq + 1).trim();
+        if (!key || !val)
+            return null;
+        if (key === "t") {
+            const n = Number(val);
+            if (!Number.isFinite(n) || !Number.isInteger(n) || n <= 0)
+                return null;
+            t = n;
+        }
+        else if (key === "v1") {
+            if (!/^[0-9a-f]{64}$/i.test(val))
+                return null;
+            v1Hex = val.toLowerCase();
+        }
+        // Unknown keys ignored — forward-compat for future v2 schemes.
+    }
+    return { t, v1Hex };
+}
+// ---------------------------------------------------------------------------
+// Crypto.
+// ---------------------------------------------------------------------------
+function computeHmacHex(secret, payload) {
+    return createHmac("sha256", secret).update(payload).digest("hex");
+}
+function constantTimeEqualHex(a, b) {
+    if (a.length !== b.length)
+        return false;
+    // Convert both to Buffer of equal length, then timingSafeEqual.
+    return timingSafeEqual(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
+}
+//# sourceMappingURL=verify-webhook.js.map

package/dist/verify-webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-webhook.js","sourceRoot":"","sources":["../src/verify-webhook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAwB1D;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAoB,EACpB,OAAe,EACf,MAAc,EACd,UAAgC,EAAE;IAElC,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,IAAI,GAAG,CAAC;IAClD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAE/E,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAC3D,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,6BAA6B;QAC7B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,SAAS,EAAE,CAAC;QACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,MAAM,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;IAC/C,IAAI,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,IAAI,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;YAC9F,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;QACvE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;AACxD,CAAC;AAaD,SAAS,SAAS,CAAC,OAAoB,EAAE,IAAY;IACnD,8CAA8C;IAC9C,IAAI,OAAQ,OAAmB,CAAC,GAAG,KAAK,UAAU,IAAK,OAAmB,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5F,OAAQ,OAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,yCAAyC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,OAAwD,CAAC;IACrE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACnB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;YAC1C,OAAO,CAAC,IAAI,IAAI,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAWD,SAAS,oBAAoB,CAAC,KAAa;IACzC,qCAAqC;IACrC,sDAAsD;IACtD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,GAAkB,IAAI,CAAC;IAC5B,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YAChB,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvE,CAAC,GAAG,CAAC,CAAC;QACR,CAAC;aAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9C,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5B,CAAC;QACD,+DAA+D;IACjE,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;AACtB,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,cAAc,CAAC,MAAc,EAAE,OAAe;IACrD,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAS,EAAE,CAAS;IAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,gEAAgE;IAChE,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@run402/functions",
-  "version": "2.7.0",
-  "description": "In-function helper library for Run402 serverless functions — db, adminDb, getUser, email, ai, assets. Auto-bundled into deployed functions; also installable for local TypeScript autocomplete.",
+  "version": "3.0.0",
+  "description": "In-function helper library for Run402 serverless functions — db, adminDb, getUser, email, ai, assets, verifyWebhook. Auto-bundled into deployed functions; also installable for local TypeScript autocomplete.",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",