@runcore-sh/runcore 0.1.7 → 0.1.9

package/dist/vault/store.js

@@ -6,6 +6,7 @@
 import { readFile, writeFile, mkdir } from "node:fs/promises";
 import { join } from "node:path";
 import { encrypt, decrypt } from "../auth/crypto.js";
+import { shouldHydrateKey } from "../integrations/gate.js";
 const VAULT_DIR = join(process.cwd(), "brain", "vault");
 const VAULT_FILE = join(VAULT_DIR, "keys.json");
 // In-memory cache — populated by loadVault, read by list/hydrate
@@ -53,8 +54,10 @@ async function saveVault(key) {
 export async function setVaultKey(name, value, key, label) {
     vaultCache[name] = { value, label };
     await saveVault(key);
-    // Keep process.env in sync
-    process.env[name] = value;
+    // Keep process.env in sync — but respect the integration gate
+    if (shouldHydrateKey(name)) {
+        process.env[name] = value;
+    }
 }
 /**
  * Remove a key from the vault. Persists immediately.
@@ -100,12 +103,19 @@ export function getDashReadableVault() {
         .map(([name, entry]) => ({ name, value: entry.value, label: entry.label }));
 }
 /**
- * Push all vault values into process.env.
+ * Push vault values into process.env, filtered by the integration gate.
+ * Disabled integrations have their secrets actively removed from process.env.
  * Called after loadVault so consumer modules (LLM, search) pick them up.
  */
-function hydrateEnv() {
+export function hydrateEnv() {
     for (const [name, entry] of Object.entries(vaultCache)) {
-        process.env[name] = entry.value;
+        if (shouldHydrateKey(name)) {
+            process.env[name] = entry.value;
+        }
+        else {
+            // Actively remove blocked keys — they may have been set by a prior hydration
+            delete process.env[name];
+        }
     }
 }
 //# sourceMappingURL=store.js.map

package/dist/vault/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/vault/store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAyB,MAAM,mBAAmB,CAAC;AAE5E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACxD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAgBhD,iEAAiE;AACjE,IAAI,UAAU,GAAc,EAAE,CAAC;AAE/B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,IAAI,GAAkB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAqB;YAChC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;QACF,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACxC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAc,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;QACpD,UAAU,GAAG,EAAE,CAAC;IAClB,CAAC;IACD,UAAU,EAAE,CAAC;AACf,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,IAAI,GAAkB;QAC1B,CAAC,EAAE,CAAC;QACJ,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;IACF,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAY,EACZ,KAAa,EACb,GAAW,EACX,KAAc;IAEd,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACpC,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IACrB,2BAA2B;IAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,GAAW;IAC5D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IACrB,kEAAkE;IAClE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI;QACJ,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI;QACJ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAEjE,MAAM,UAAU,oBAAoB;IAClC,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;SAC9B,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SACrG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU;IACjB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;IAClC,CAAC;AACH,CAAC"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/vault/store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAyB,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACxD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAgBhD,iEAAiE;AACjE,IAAI,UAAU,GAAc,EAAE,CAAC;AAE/B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,IAAI,GAAkB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAqB;YAChC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;QACF,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACxC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAc,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;QACpD,UAAU,GAAG,EAAE,CAAC;IAClB,CAAC;IACD,UAAU,EAAE,CAAC;AACf,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,IAAI,GAAkB;QAC1B,CAAC,EAAE,CAAC;QACJ,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;IACF,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAY,EACZ,KAAa,EACb,GAAW,EACX,KAAc;IAEd,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACpC,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IACrB,8DAA8D;IAC9D,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,GAAW;IAC5D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IACrB,kEAAkE;IAClE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI;QACJ,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI;QACJ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAEjE,MAAM,UAAU,oBAAoB;IAClC,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;SAC9B,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SACrG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU;IACxB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,6EAA6E;YAC7E,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/vault/transfer.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Vault portable export/import.
+ *
+ * DPAPI ties session keys to the Windows user profile, making vault secrets
+ * non-portable. This module provides passphrase-based export/import so
+ * secrets can move across machines and operating systems.
+ *
+ * Export format: self-describing JSON envelope (.vault) with AES-256-GCM
+ * encrypted payload, key derived via PBKDF2 from a case-sensitive passphrase.
+ */
+export interface ExportStats {
+    vaultKeys: number;
+    credentials: number;
+    personalFields: number;
+}
+export interface ExportResult {
+    filePath: string;
+    stats: ExportStats;
+}
+export interface ImportResult {
+    stats: ExportStats & {
+        skipped: number;
+    };
+}
+export interface VerifyResult {
+    message: string;
+    stats: ExportStats;
+}
+export type ConflictStrategy = "overwrite" | "skip" | "rename";
+export declare function exportVault(passphrase: string, outputDir?: string): Promise<ExportResult>;
+export declare function verifyExport(filePath: string, passphrase: string): Promise<VerifyResult>;
+export declare function importVault(filePath: string, passphrase: string, strategy: ConflictStrategy | undefined, sessionKey: Buffer): Promise<ImportResult>;
+//# sourceMappingURL=transfer.d.ts.map

package/dist/vault/transfer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transfer.d.ts","sourceRoot":"","sources":["../../src/vault/transfer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAkDH,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,WAAW,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,WAAW,CAAC;CACpB;AAED,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,MAAM,GAAG,QAAQ,CAAC;AAsD/D,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,YAAY,CAAC,CA+CvB;AAID,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,YAAY,CAAC,CAUvB;AAID,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,gBAAgB,YAAS,EACnC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,YAAY,CAAC,CAqCvB"}

package/dist/vault/transfer.js

@@ -0,0 +1,187 @@
+/**
+ * Vault portable export/import.
+ *
+ * DPAPI ties session keys to the Windows user profile, making vault secrets
+ * non-portable. This module provides passphrase-based export/import so
+ * secrets can move across machines and operating systems.
+ *
+ * Export format: self-describing JSON envelope (.vault) with AES-256-GCM
+ * encrypted payload, key derived via PBKDF2 from a case-sensitive passphrase.
+ */
+import { pbkdf2Sync, randomBytes, createHash } from "node:crypto";
+import { writeFile, readFile, mkdir } from "node:fs/promises";
+import { join } from "node:path";
+import { encrypt, decrypt } from "../auth/crypto.js";
+import { getVaultEntries, setVaultKey } from "./store.js";
+import { readBrainLines, appendBrainLine } from "../lib/brain-io.js";
+import { getEncryptionKey } from "../lib/key-store.js";
+import { getInstanceName } from "../instance.js";
+// ── Constants ────────────────────────────────────────────────────────────────
+const VAULT_DIR = join(process.cwd(), "brain", "vault");
+const CRED_FILE = join(process.cwd(), "brain", "vault", "credentials.enc.jsonl");
+const PERSONAL_FILE = join(process.cwd(), "brain", "vault", "personal.enc.jsonl");
+const FORMAT = "core-vault-export";
+const VERSION = 1;
+const ITERATIONS = 600_000;
+const KEY_LENGTH = 32;
+const SALT_LENGTH = 16;
+// ── Key derivation (case-sensitive, unlike safe word) ────────────────────────
+function deriveExportKey(passphrase, salt) {
+    return pbkdf2Sync(passphrase, salt, ITERATIONS, KEY_LENGTH, "sha256");
+}
+function hashKey(key) {
+    return createHash("sha256").update(key).digest("hex");
+}
+// ── Helpers ──────────────────────────────────────────────────────────────────
+/** Read JSONL entries, skipping schema headers. */
+async function readJsonlEntries(filePath) {
+    const lines = await readBrainLines(filePath);
+    const entries = [];
+    for (const line of lines) {
+        try {
+            const obj = JSON.parse(line);
+            if (obj._schema)
+                continue;
+            entries.push(obj);
+        }
+        catch {
+            // skip malformed
+        }
+    }
+    return entries;
+}
+/** Deduplicate credentials by id (last occurrence wins), filter active only. */
+function deduplicateCredentials(creds) {
+    const map = new Map();
+    for (const c of creds) {
+        if (c.id)
+            map.set(c.id, c);
+    }
+    return Array.from(map.values()).filter((c) => c.status !== "archived");
+}
+/** Deduplicate personal fields by field name (last wins), filter active. */
+function deduplicatePersonal(entries) {
+    const map = new Map();
+    for (const e of entries) {
+        if (e.status === "archived") {
+            map.delete(e.field);
+        }
+        else {
+            map.set(e.field, e);
+        }
+    }
+    return Array.from(map.values());
+}
+// ── Export ────────────────────────────────────────────────────────────────────
+export async function exportVault(passphrase, outputDir) {
+    const sessionKey = getEncryptionKey();
+    if (!sessionKey)
+        throw new Error("Not authenticated — session key not set");
+    // Collect secrets
+    const vaultKeys = getVaultEntries();
+    const rawCredentials = await readJsonlEntries(CRED_FILE);
+    const credentials = deduplicateCredentials(rawCredentials);
+    const rawPersonal = await readJsonlEntries(PERSONAL_FILE);
+    const personalFields = deduplicatePersonal(rawPersonal);
+    const payload = { vaultKeys, credentials, personalFields };
+    // Derive export key (case-sensitive)
+    const salt = randomBytes(SALT_LENGTH);
+    const exportKey = deriveExportKey(passphrase, salt);
+    const keyHash = hashKey(exportKey);
+    // Encrypt
+    const encrypted = encrypt(JSON.stringify(payload), exportKey);
+    const envelope = {
+        format: FORMAT,
+        version: VERSION,
+        exportedAt: new Date().toISOString(),
+        sourceInstance: getInstanceName(),
+        salt: salt.toString("hex"),
+        iterations: ITERATIONS,
+        keyHash,
+        payload: encrypted,
+    };
+    // Write file
+    const dir = outputDir ?? VAULT_DIR;
+    await mkdir(dir, { recursive: true });
+    const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
+    const filePath = join(dir, `export-${timestamp}.vault`);
+    await writeFile(filePath, JSON.stringify(envelope, null, 2), "utf-8");
+    return {
+        filePath,
+        stats: {
+            vaultKeys: vaultKeys.length,
+            credentials: credentials.length,
+            personalFields: personalFields.length,
+        },
+    };
+}
+// ── Verify ───────────────────────────────────────────────────────────────────
+export async function verifyExport(filePath, passphrase) {
+    const payload = await decryptEnvelope(filePath, passphrase);
+    return {
+        message: "Export verified successfully",
+        stats: {
+            vaultKeys: payload.vaultKeys.length,
+            credentials: payload.credentials.length,
+            personalFields: payload.personalFields.length,
+        },
+    };
+}
+// ── Import ───────────────────────────────────────────────────────────────────
+export async function importVault(filePath, passphrase, strategy = "skip", sessionKey) {
+    const payload = await decryptEnvelope(filePath, passphrase);
+    let skipped = 0;
+    // Import vault keys
+    const existingKeys = new Set(getVaultEntries().map((e) => e.name));
+    for (const entry of payload.vaultKeys) {
+        if (existingKeys.has(entry.name)) {
+            if (strategy === "skip") {
+                skipped++;
+                continue;
+            }
+            if (strategy === "rename") {
+                const renamed = `${entry.name}_imported`;
+                await setVaultKey(renamed, entry.value, sessionKey, entry.label);
+                continue;
+            }
+            // overwrite — fall through
+        }
+        await setVaultKey(entry.name, entry.value, sessionKey, entry.label);
+    }
+    // Import credentials (append-only JSONL)
+    for (const cred of payload.credentials) {
+        await appendBrainLine(CRED_FILE, JSON.stringify(cred));
+    }
+    // Import personal fields (append-only JSONL)
+    for (const field of payload.personalFields) {
+        await appendBrainLine(PERSONAL_FILE, JSON.stringify(field));
+    }
+    return {
+        stats: {
+            vaultKeys: payload.vaultKeys.length,
+            credentials: payload.credentials.length,
+            personalFields: payload.personalFields.length,
+            skipped,
+        },
+    };
+}
+// ── Shared decrypt ───────────────────────────────────────────────────────────
+async function decryptEnvelope(filePath, passphrase) {
+    const raw = await readFile(filePath, "utf-8");
+    const envelope = JSON.parse(raw);
+    if (envelope.format !== FORMAT) {
+        throw new Error(`Unknown export format: ${envelope.format}`);
+    }
+    if (envelope.version !== VERSION) {
+        throw new Error(`Unsupported export version: ${envelope.version}`);
+    }
+    const salt = Buffer.from(envelope.salt, "hex");
+    const exportKey = deriveExportKey(passphrase, salt);
+    // Fast wrong-passphrase detection
+    if (hashKey(exportKey) !== envelope.keyHash) {
+        throw new Error("Wrong passphrase");
+    }
+    const plaintext = decrypt(envelope.payload, exportKey);
+    return JSON.parse(plaintext);
+}
+//# sourceMappingURL=transfer.js.map

package/dist/vault/transfer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transfer.js","sourceRoot":"","sources":["../../src/vault/transfer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAyB,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAIjD,gFAAgF;AAEhF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACxD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC;AACjF,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAC;AAElF,MAAM,MAAM,GAAG,mBAAmB,CAAC;AACnC,MAAM,OAAO,GAAG,CAAC,CAAC;AAClB,MAAM,UAAU,GAAG,OAAO,CAAC;AAC3B,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,WAAW,GAAG,EAAE,CAAC;AAiDvB,gFAAgF;AAEhF,SAAS,eAAe,CAAC,UAAkB,EAAE,IAAY;IACvD,OAAO,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,gFAAgF;AAEhF,mDAAmD;AACnD,KAAK,UAAU,gBAAgB,CAAI,QAAgB;IACjD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAQ,EAAE,CAAC;IACxB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,GAAG,CAAC,OAAO;gBAAE,SAAS;YAC1B,OAAO,CAAC,IAAI,CAAC,GAAQ,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gFAAgF;AAChF,SAAS,sBAAsB,CAAC,KAAmB;IACjD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;AACzE,CAAC;AAED,4EAA4E;AAC5E,SAAS,mBAAmB,CAAC,OAAqB;IAChD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC5B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,iFAAiF;AAEjF,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,UAAkB,EAClB,SAAkB;IAElB,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAC;IACtC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAE5E,kBAAkB;IAClB,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;IACpC,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAa,SAAS,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAa,aAAa,CAAC,CAAC;IACtE,MAAM,cAAc,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAExD,MAAM,OAAO,GAAuB,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;IAE/E,qCAAqC;IACrC,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAEnC,UAAU;IACV,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC;IAE9D,MAAM,QAAQ,GAAwB;QACpC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,cAAc,EAAE,eAAe,EAAE;QACjC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC1B,UAAU,EAAE,UAAU;QACtB,OAAO;QACP,OAAO,EAAE,SAAS;KACnB,CAAC;IAEF,aAAa;IACb,MAAM,GAAG,GAAG,SAAS,IAAI,SAAS,CAAC;IACnC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,SAAS,QAAQ,CAAC,CAAC;IACxD,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAEtE,OAAO;QACL,QAAQ;QACR,KAAK,EAAE;YACL,SAAS,EAAE,SAAS,CAAC,MAAM;YAC3B,WAAW,EAAE,WAAW,CAAC,MAAM;YAC/B,cAAc,EAAE,cAAc,CAAC,MAAM;SACtC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,UAAkB;IAElB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC5D,OAAO;QACL,OAAO,EAAE,8BAA8B;QACvC,KAAK,EAAE;YACL,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM;YACnC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,MAAM;YACvC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,MAAM;SAC9C;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,EAChB,UAAkB,EAClB,WAA6B,MAAM,EACnC,UAAkB;IAElB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC5D,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,oBAAoB;IACpB,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;gBAAC,OAAO,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC;YACjD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,IAAI,WAAW,CAAC;gBACzC,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACjE,SAAS;YACX,CAAC;YACD,2BAA2B;QAC7B,CAAC;QACD,MAAM,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IAED,yCAAyC;IACzC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,6CAA6C;IAC7C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3C,MAAM,eAAe,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO;QACL,KAAK,EAAE;YACL,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM;YACnC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,MAAM;YACvC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,MAAM;YAC7C,OAAO;SACR;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,KAAK,UAAU,eAAe,CAC5B,QAAgB,EAChB,UAAkB;IAElB,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAwB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEtD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAEpD,kCAAkC;IAClC,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAuB,CAAC;AACrD,CAAC"}

package/dist/voucher.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Decoder Ring — brain-to-brain voucher system.
+ * Short-lived tokens the human carries between brains as proof of intent.
+ * Vouchers live in procedural memory (append-only JSONL).
+ */
+import type { LongTermMemoryStore } from "./memory/long-term.js";
+export interface VoucherResult {
+    valid: boolean;
+    scope?: string;
+}
+/**
+ * Issue a voucher: generate a token, store it in procedural memory.
+ * @returns The token string for the human to carry.
+ */
+export declare function issueVoucher(ltm: LongTermMemoryStore, scope?: string, ttlMinutes?: number): Promise<string>;
+/**
+ * Check a voucher: scan procedural memory for the token.
+ * Returns valid only if the token exists, is active, hasn't expired,
+ * and no later entry has archived/revoked it.
+ */
+export declare function checkVoucher(ltm: LongTermMemoryStore, token: string): Promise<VoucherResult>;
+/**
+ * Revoke a voucher: append an archived entry for the token.
+ */
+export declare function revokeVoucher(ltm: LongTermMemoryStore, token: string): Promise<boolean>;
+type AlertFn = (subject: string, body: string) => Promise<unknown>;
+/**
+ * Register an alert function to be called on failed voucher checks.
+ * Keeps voucher.ts decoupled from the alert system — caller wires the dependency.
+ */
+export declare function setVoucherAlertFn(fn: AlertFn): void;
+/**
+ * Check a voucher with alerting on failure.
+ * Wraps checkVoucher() — if the token is invalid/expired, fires an alert.
+ * Use this at trust boundaries (MCP tools, mesh auth) instead of raw checkVoucher().
+ */
+export declare function checkVoucherWithAlert(ltm: LongTermMemoryStore, token: string, context?: string): Promise<VoucherResult>;
+export {};
+//# sourceMappingURL=voucher.d.ts.map

package/dist/voucher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"voucher.d.ts","sourceRoot":"","sources":["../src/voucher.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAKjE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAMD;;;GAGG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,mBAAmB,EACxB,KAAK,CAAC,EAAE,MAAM,EACd,UAAU,GAAE,MAAW,GACtB,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,mBAAmB,EACxB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,CAAC,CA2BxB;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,mBAAmB,EACxB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAelB;AAID,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAGnE;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,OAAO,GAAG,IAAI,CAEnD;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,mBAAmB,EACxB,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC,CAmBxB"}

package/dist/voucher.js

@@ -0,0 +1,105 @@
+/**
+ * Decoder Ring — brain-to-brain voucher system.
+ * Short-lived tokens the human carries between brains as proof of intent.
+ * Vouchers live in procedural memory (append-only JSONL).
+ */
+import { randomBytes } from "node:crypto";
+import { createLogger } from "./utils/logger.js";
+const log = createLogger("voucher");
+function generateToken() {
+    return `vch_${randomBytes(4).toString("hex")}`;
+}
+/**
+ * Issue a voucher: generate a token, store it in procedural memory.
+ * @returns The token string for the human to carry.
+ */
+export async function issueVoucher(ltm, scope, ttlMinutes = 30) {
+    const token = generateToken();
+    const expires = new Date(Date.now() + ttlMinutes * 60_000).toISOString();
+    await ltm.add({
+        type: "procedural",
+        content: `Voucher ${token} issued`,
+        meta: {
+            voucher: true,
+            token,
+            ...(scope ? { scope } : {}),
+            status: "active",
+            expires,
+        },
+    });
+    return token;
+}
+/**
+ * Check a voucher: scan procedural memory for the token.
+ * Returns valid only if the token exists, is active, hasn't expired,
+ * and no later entry has archived/revoked it.
+ */
+export async function checkVoucher(ltm, token) {
+    // Get all entries for this token (both active and archived)
+    const entries = await ltm.search({
+        type: "procedural",
+        meta: { voucher: true, token },
+    });
+    if (entries.length === 0)
+        return { valid: false };
+    // Sort newest-first — the latest status wins
+    const sorted = entries.sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
+    const latest = sorted[0];
+    const meta = latest.meta;
+    if (!meta || meta.status !== "active")
+        return { valid: false };
+    // Check expiry
+    if (meta.expires && new Date(meta.expires) < new Date()) {
+        return { valid: false };
+    }
+    return {
+        valid: true,
+        scope: meta.scope,
+    };
+}
+/**
+ * Revoke a voucher: append an archived entry for the token.
+ */
+export async function revokeVoucher(ltm, token) {
+    const check = await checkVoucher(ltm, token);
+    if (!check.valid)
+        return false;
+    await ltm.add({
+        type: "procedural",
+        content: `Voucher ${token} revoked`,
+        meta: {
+            voucher: true,
+            token,
+            status: "archived",
+        },
+    });
+    return true;
+}
+let _alertFn = null;
+/**
+ * Register an alert function to be called on failed voucher checks.
+ * Keeps voucher.ts decoupled from the alert system — caller wires the dependency.
+ */
+export function setVoucherAlertFn(fn) {
+    _alertFn = fn;
+}
+/**
+ * Check a voucher with alerting on failure.
+ * Wraps checkVoucher() — if the token is invalid/expired, fires an alert.
+ * Use this at trust boundaries (MCP tools, mesh auth) instead of raw checkVoucher().
+ */
+export async function checkVoucherWithAlert(ltm, token, context) {
+    const result = await checkVoucher(ltm, token);
+    if (!result.valid) {
+        const masked = token.length > 8 ? token.slice(0, 8) + "..." : token;
+        const where = context ? ` (${context})` : "";
+        log.warn("Voucher check failed", { token: masked, context });
+        if (_alertFn) {
+            _alertFn(`Voucher check failed${where}`, `Someone tried token "${masked}"${where} at ${new Date().toISOString()}. The voucher was invalid or expired.`).catch((err) => {
+                log.debug("Alert dispatch failed", { error: err instanceof Error ? err.message : String(err) });
+            });
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=voucher.js.map

package/dist/voucher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"voucher.js","sourceRoot":"","sources":["../src/voucher.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;AAOpC,SAAS,aAAa;IACpB,OAAO,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAwB,EACxB,KAAc,EACd,aAAqB,EAAE;IAEvB,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAEzE,MAAM,GAAG,CAAC,GAAG,CAAC;QACZ,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,WAAW,KAAK,SAAS;QAClC,IAAI,EAAE;YACJ,OAAO,EAAE,IAAI;YACb,KAAK;YACL,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,MAAM,EAAE,QAAQ;YAChB,OAAO;SACR;KACF,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAwB,EACxB,KAAa;IAEb,4DAA4D;IAC5D,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;QAC/B,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE;KAC/B,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAElD,6CAA6C;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CACzB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAC5E,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,MAAM,CAAC,IAA6D,CAAC;IAElF,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAE/D,eAAe;IACf,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,OAAiB,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QAClE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,IAAI,CAAC,KAA2B;KACxC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAwB,EACxB,KAAa;IAEb,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAE/B,MAAM,GAAG,CAAC,GAAG,CAAC;QACZ,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,WAAW,KAAK,UAAU;QACnC,IAAI,EAAE;YACJ,OAAO,EAAE,IAAI;YACb,KAAK;YACL,MAAM,EAAE,UAAU;SACnB;KACF,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAKD,IAAI,QAAQ,GAAmB,IAAI,CAAC;AAEpC;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAW;IAC3C,QAAQ,GAAG,EAAE,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAwB,EACxB,KAAa,EACb,OAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAE9C,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QACpE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE7D,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CACN,uBAAuB,KAAK,EAAE,EAC9B,wBAAwB,MAAM,IAAI,KAAK,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,uCAAuC,CAC9G,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACd,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClG,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/webhooks/handlers.d.ts

@@ -83,6 +83,16 @@ export declare function registerTwilioStyleProvider(opts: {
     name: string;
     process: (payload: unknown, ctx?: Record<string, unknown>) => Promise<WebhookResult>;
 }): WebhookProvider;
+/**
+ * Create a provider that uses Svix-style signature verification (without registering).
+ * Used by Resend and other Svix-powered webhook services.
+ * HMAC-SHA256 of "{svix-id}.{svix-timestamp}.{rawBody}" with base64-decoded secret.
+ */
+export declare function createSvixStyleProvider(opts: {
+    name: string;
+    process: (payload: unknown, ctx?: Record<string, unknown>) => Promise<WebhookResult>;
+    maxAgeSeconds?: number;
+}): WebhookProvider;
 export { withRetryHandler } from "./retry.js";
 /**
  * Log a webhook event and delegate to a handler.

package/dist/webhooks/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/webhooks/handlers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EACV,aAAa,EACb,eAAe,EAEf,YAAY,EAEb,MAAM,YAAY,CAAC;AAapB,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI/C;;;GAGG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,CACF,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,GAC1B,CACD,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,CAa1B;AAID,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAIhD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5B,4GAA4G;IAC5G,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,eAAe,CAYlB;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5B,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,eAAe,CAIlB;AAED;;GAEG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5B,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,eAAe,CAYlB;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,EAAE;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5B,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,eAAe,CAIlB;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,eAAe,CAclB;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,eAAe,CAIlB;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,CAAC;CAC7B,GAAG,eAAe,CAgBlB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,CAAC;CAC7B,GAAG,eAAe,CAIlB;AAID,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAI9C;;;GAGG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,CACF,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,GAC1B,CACD,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,CAkB1B;AAID;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAChC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,CAAC,EACV,IAAI,CAAC,EAAE;IACL,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC;IACjC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC;CAChC,GACA,YAAY,CAAC,CAAC,CAAC,CAKjB"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/webhooks/handlers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EACV,aAAa,EACb,eAAe,EAEf,YAAY,EAEb,MAAM,YAAY,CAAC;AAapB,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI/C;;;GAGG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,CACF,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,GAC1B,CACD,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,CAa1B;AAID,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAIhD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5B,4GAA4G;IAC5G,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,eAAe,CAYlB;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5B,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,eAAe,CAIlB;AAED;;GAEG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5B,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,eAAe,CAYlB;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,EAAE;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5B,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,eAAe,CAIlB;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,eAAe,CAclB;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,eAAe,CAIlB;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,CAAC;CAC7B,GAAG,eAAe,CAgBlB;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,CAAC;CAC7B,GAAG,eAAe,CAIlB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,eAAe,CAgDlB;AAID,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAI9C;;;GAGG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,CACF,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,GAC1B,CACD,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,CAkB1B;AAID;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAChC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,CAAC,EACV,IAAI,CAAC,EAAE;IACL,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC;IACjC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC;CAChC,GACA,YAAY,CAAC,CAAC,CAAC,CAKjB"}

package/dist/webhooks/handlers.js

@@ -3,6 +3,7 @@
  * Provides safe-execution wrappers, logging, provider factory helpers,
  * and reusable building blocks for processing webhook events.
  */
+import * as crypto from "node:crypto";
 import { logActivity } from "../activity/log.js";
 import { registerProvider } from "./registry.js";
 import { hmacSha256Hex, hmacSha256Base64, hmacSha1Base64, timingSafeCompare, isTimestampFresh, } from "./verify.js";
@@ -141,6 +142,58 @@ export function registerTwilioStyleProvider(opts) {
     registerProvider(provider);
     return provider;
 }
+/**
+ * Create a provider that uses Svix-style signature verification (without registering).
+ * Used by Resend and other Svix-powered webhook services.
+ * HMAC-SHA256 of "{svix-id}.{svix-timestamp}.{rawBody}" with base64-decoded secret.
+ */
+export function createSvixStyleProvider(opts) {
+    return {
+        name: opts.name,
+        verify(ctx) {
+            const svixId = ctx.headers?.["svix-id"] ?? "";
+            const svixTimestamp = ctx.headers?.["svix-timestamp"] ?? "";
+            const svixSignature = ctx.signature; // svix-signature header value
+            if (!svixId || !svixTimestamp || !svixSignature)
+                return false;
+            // Check timestamp freshness
+            const ts = parseInt(svixTimestamp, 10);
+            if (!isTimestampFresh(ts, opts.maxAgeSeconds ?? 300))
+                return false;
+            // Decode secret: strip "whsec_" prefix if present, then base64-decode
+            let secretKey;
+            try {
+                const rawSecret = ctx.secret.startsWith("whsec_")
+                    ? ctx.secret.slice(6)
+                    : ctx.secret;
+                secretKey = Buffer.from(rawSecret, "base64");
+            }
+            catch {
+                return false;
+            }
+            // Compute expected signature
+            const signPayload = `${svixId}.${svixTimestamp}.${ctx.rawBody}`;
+            const computed = crypto
+                .createHmac("sha256", secretKey)
+                .update(signPayload)
+                .digest("base64");
+            // Compare against each space-separated signature group ("v1,<base64>")
+            const sigGroups = svixSignature.split(" ");
+            for (const group of sigGroups) {
+                const commaIdx = group.indexOf(",");
+                if (commaIdx === -1)
+                    continue;
+                const version = group.slice(0, commaIdx);
+                const candidate = group.slice(commaIdx + 1);
+                if (version === "v1" && timingSafeCompare(candidate, computed)) {
+                    return true;
+                }
+            }
+            return false;
+        },
+        process: opts.process,
+    };
+}
 // ── Re-export from retry.ts for backward compatibility ───────────────────────
 export { withRetryHandler } from "./retry.js";
 // ── Logging helper ───────────────────────────────────────────────────────────

package/dist/webhooks/handlers.js.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../src/webhooks/handlers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAQjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAMjD,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,MAAc,EACd,EAG2B;IAK3B,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;QAC5B,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,WAAW,CAAC;gBACV,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,0BAA0B,MAAM,MAAM,GAAG,EAAE;aACrD,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,GAAG,EAAE,EAAE,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAQ3C;IACC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,CAAC,GAAkB;YACvB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW;gBAC1B,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;gBACvC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;YAClB,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACxD,OAAO,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAO7C;IACC,MAAM,QAAQ,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;IACnD,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,8BAA8B,CAAC,IAO9C;IACC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,CAAC,GAAkB;YACvB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW;gBAC1B,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;gBACvC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;YAClB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAC3D,OAAO,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAAC,IAOhD;IACC,MAAM,QAAQ,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC;IACtD,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAOxC;IACC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,CAAC,GAAkB;YACvB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,aAAa,IAAI,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAEnE,MAAM,UAAU,GAAG,MAAM,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,OAAO,iBAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAO1C;IACC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAChD,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAMzC;IACC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,CAAC,GAAkB;YACvB,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAE1C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC;YACnB,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,IAAI,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChC,CAAC;YACD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAClD,OAAO,iBAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAM3C;IACC,MAAM,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACjD,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAEhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,MAAc,EACd,EAG2B;IAK3B,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;QAC5B,WAAW,CAAC;YACV,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,qBAAqB,MAAM,EAAE;SACvC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAEtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,WAAW,CAAC;gBACV,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,wBAAwB,MAAM,MAAM,MAAM,CAAC,OAAO,EAAE;aAC9D,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,OAAU,EACV,IAGC;IAED,OAAO,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE;QACzC,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,OAAO,CAAC;QACzC,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC;KACzC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../src/webhooks/handlers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAQjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAMjD,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,MAAc,EACd,EAG2B;IAK3B,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;QAC5B,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,WAAW,CAAC;gBACV,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,0BAA0B,MAAM,MAAM,GAAG,EAAE;aACrD,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,GAAG,EAAE,EAAE,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAQ3C;IACC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,CAAC,GAAkB;YACvB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW;gBAC1B,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;gBACvC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;YAClB,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACxD,OAAO,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAO7C;IACC,MAAM,QAAQ,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;IACnD,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,8BAA8B,CAAC,IAO9C;IACC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,CAAC,GAAkB;YACvB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW;gBAC1B,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;gBACvC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;YAClB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAC3D,OAAO,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAAC,IAOhD;IACC,MAAM,QAAQ,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC;IACtD,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAOxC;IACC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,CAAC,GAAkB;YACvB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,aAAa,IAAI,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAEnE,MAAM,UAAU,GAAG,MAAM,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,OAAO,iBAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAO1C;IACC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAChD,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAMzC;IACC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,CAAC,GAAkB;YACvB,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAE1C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC;YACnB,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,IAAI,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChC,CAAC;YACD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAClD,OAAO,iBAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAM3C;IACC,MAAM,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACjD,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAOvC;IACC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,CAAC,GAAkB;YACvB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YAC9C,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;YAC5D,MAAM,aAAa,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,8BAA8B;YAEnE,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa;gBAAE,OAAO,KAAK,CAAC;YAE9D,4BAA4B;YAC5B,MAAM,EAAE,GAAG,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;YACvC,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,aAAa,IAAI,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAEnE,sEAAsE;YACtE,IAAI,SAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAC/C,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;oBACrB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;gBACf,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;YAED,6BAA6B;YAC7B,MAAM,WAAW,GAAG,GAAG,MAAM,IAAI,aAAa,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChE,MAAM,QAAQ,GAAG,MAAM;iBACpB,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC;iBAC/B,MAAM,CAAC,WAAW,CAAC;iBACnB,MAAM,CAAC,QAAQ,CAAC,CAAC;YAEpB,uEAAuE;YACvE,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3C,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,QAAQ,KAAK,CAAC,CAAC;oBAAE,SAAS;gBAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;gBACzC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;gBAC5C,IAAI,OAAO,KAAK,IAAI,IAAI,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;oBAC/D,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,MAAc,EACd,EAG2B;IAK3B,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;QAC5B,WAAW,CAAC;YACV,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,qBAAqB,MAAM,EAAE;SACvC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAEtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,WAAW,CAAC;gBACV,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,wBAAwB,MAAM,MAAM,MAAM,CAAC,OAAO,EAAE;aAC9D,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,OAAU,EACV,IAGC;IAED,OAAO,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE;QACzC,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,OAAO,CAAC;QACzC,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC;KACzC,CAAC,CAAC;AACL,CAAC"}

package/dist/webhooks/index.d.ts

@@ -12,12 +12,12 @@
  */
 export type { WebhookResult, VerifyContext, WebhookRetryOpts, WebhookProvider, WebhookEvent, WebhookRequestContext, WebhookMiddleware, ProviderStats, ProviderHealth, ProviderHealthSummary, DeduplicationOpts, EventHandler, SignatureAlgorithm, WebhookProviderConfig, WebhookSystemConfig, } from "./types.js";
 export { registerProvider, registerProviders, getProvider, listProviders, removeProvider, recordSuccess, recordFailure, getProviderStats, getAllProviderStats, resetProviderStats, getProviderHealth, getAllProviderHealth, } from "./registry.js";
-export { hmacSha256Hex, hmacSha256Base64, hmacSha1Base64, timingSafeCompare, isTimestampFresh, verifyHmacSha256Hex, verifyHmacSha256Base64, verifySlackV0, verifyTwilio, } from "./verify.js";
+export { hmacSha256Hex, hmacSha256Base64, hmacSha1Base64, timingSafeCompare, isTimestampFresh, verifyHmacSha256Hex, verifyHmacSha256Base64, verifySlackV0, verifySvix, verifyTwilio, } from "./verify.js";
 export { routeWebhook, routeWebhookRequest, composeMiddleware, validateRequest, deduplicateRequests, rateLimitRequests, createWebhookEvent, createEventRouter, normalizeToEvent, } from "./router.js";
 export { withWebhookRetry, classifyError, createWebhookError, DeadLetterQueue, withRetryHandler, } from "./retry.js";
 export type { WebhookErrorKind, WebhookError, DeadLetterEntry } from "./retry.js";
 export { getConfig, setConfig, getProviderConfig, setProviderConfig, setProviderConfigs, removeProviderConfig, listConfiguredProviders, resolveSecret, getProviderSecret, getProviderRetryOpts, isProviderEnabled, validateProviderConfig, validateConfig, loadConfigFromFile, saveConfigToFile, } from "./config.js";
-export { safeHandler, createHmacSha256HexProvider, createHmacSha256Base64Provider, createSlackStyleProvider, createTwilioStyleProvider, registerHmacSha256HexProvider, registerHmacSha256Base64Provider, registerSlackStyleProvider, registerTwilioStyleProvider, withLogging, } from "./handlers.js";
+export { safeHandler, createHmacSha256HexProvider, createHmacSha256Base64Provider, createSlackStyleProvider, createTwilioStyleProvider, createSvixStyleProvider, registerHmacSha256HexProvider, registerHmacSha256Base64Provider, registerSlackStyleProvider, registerTwilioStyleProvider, withLogging, } from "./handlers.js";
 export { WebhookHandler } from "./handler.js";
 export type { WebhookHandlerConfig } from "./handler.js";
 export { mountWebhookAdmin, createWebhookRoute, verifyWebhookRequest, processVerifiedWebhook, getDeadLetterQueue, } from "./mount.js";

package/dist/webhooks/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/webhooks/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,YAAY,EACV,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAIpB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,cAAc,EACd,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAIvB,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,EACtB,aAAa,EACb,YAAY,GACb,MAAM,aAAa,CAAC;AAIrB,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAIrB,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAIlF,OAAO,EACL,SAAS,EACT,SAAS,EACT,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EACvB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,EACtB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAIrB,OAAO,EACL,WAAW,EACX,2BAA2B,EAC3B,8BAA8B,EAC9B,wBAAwB,EACxB,yBAAyB,EACzB,6BAA6B,EAC7B,gCAAgC,EAChC,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,GACZ,MAAM,eAAe,CAAC;AAIvB,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAIzD,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAInD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAIpD,OAAO,EACL,eAAe,EACf,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,oBAAoB,EACpB,cAAc,EACd,eAAe,GAChB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/webhooks/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,YAAY,EACV,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAIpB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,cAAc,EACd,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAIvB,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,EACtB,aAAa,EACb,UAAU,EACV,YAAY,GACb,MAAM,aAAa,CAAC;AAIrB,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAIrB,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAIlF,OAAO,EACL,SAAS,EACT,SAAS,EACT,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EACvB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,EACtB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAIrB,OAAO,EACL,WAAW,EACX,2BAA2B,EAC3B,8BAA8B,EAC9B,wBAAwB,EACxB,yBAAyB,EACzB,uBAAuB,EACvB,6BAA6B,EAC7B,gCAAgC,EAChC,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,GACZ,MAAM,eAAe,CAAC;AAIvB,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAIzD,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAInD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAIpD,OAAO,EACL,eAAe,EACf,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,oBAAoB,EACpB,cAAc,EACd,eAAe,GAChB,MAAM,gBAAgB,CAAC"}

package/dist/webhooks/index.js

@@ -13,7 +13,7 @@
 // ── Registry ─────────────────────────────────────────────────────────────────
 export { registerProvider, registerProviders, getProvider, listProviders, removeProvider, recordSuccess, recordFailure, getProviderStats, getAllProviderStats, resetProviderStats, getProviderHealth, getAllProviderHealth, } from "./registry.js";
 // ── Signature verification ───────────────────────────────────────────────────
-export { hmacSha256Hex, hmacSha256Base64, hmacSha1Base64, timingSafeCompare, isTimestampFresh, verifyHmacSha256Hex, verifyHmacSha256Base64, verifySlackV0, verifyTwilio, } from "./verify.js";
+export { hmacSha256Hex, hmacSha256Base64, hmacSha1Base64, timingSafeCompare, isTimestampFresh, verifyHmacSha256Hex, verifyHmacSha256Base64, verifySlackV0, verifySvix, verifyTwilio, } from "./verify.js";
 // ── Routing & dispatching ────────────────────────────────────────────────────
 export { routeWebhook, routeWebhookRequest, composeMiddleware, validateRequest, deduplicateRequests, rateLimitRequests, createWebhookEvent, createEventRouter, normalizeToEvent, } from "./router.js";
 // ── Retry & error handling ───────────────────────────────────────────────────
@@ -21,7 +21,7 @@ export { withWebhookRetry, classifyError, createWebhookError, DeadLetterQueue, w
 // ── Configuration management ─────────────────────────────────────────────────
 export { getConfig, setConfig, getProviderConfig, setProviderConfig, setProviderConfigs, removeProviderConfig, listConfiguredProviders, resolveSecret, getProviderSecret, getProviderRetryOpts, isProviderEnabled, validateProviderConfig, validateConfig, loadConfigFromFile, saveConfigToFile, } from "./config.js";
 // ── Handler utilities ────────────────────────────────────────────────────────
-export { safeHandler, createHmacSha256HexProvider, createHmacSha256Base64Provider, createSlackStyleProvider, createTwilioStyleProvider, registerHmacSha256HexProvider, registerHmacSha256Base64Provider, registerSlackStyleProvider, registerTwilioStyleProvider, withLogging, } from "./handlers.js";
+export { safeHandler, createHmacSha256HexProvider, createHmacSha256Base64Provider, createSlackStyleProvider, createTwilioStyleProvider, createSvixStyleProvider, registerHmacSha256HexProvider, registerHmacSha256Base64Provider, registerSlackStyleProvider, registerTwilioStyleProvider, withLogging, } from "./handlers.js";
 // ── Base class ──────────────────────────────────────────────────────────────
 export { WebhookHandler } from "./handler.js";
 // ── Route mounting & admin ──────────────────────────────────────────────────