@sensigo/realm-cli 0.6.4 → 0.7.1

package/dist/lib/dedup-store.js

@@ -0,0 +1,122 @@
+// Dedup stores — at-least-once duplicate suppression for webhook events.
+// FileDedupStore survives process restarts; InMemoryDedupStore does not.
+import { createHash } from 'node:crypto';
+import { mkdirSync, openSync, closeSync, statSync, readdirSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+const ONE_HOUR_MS = 3_600_000;
+/**
+ * File-backed dedup store. Records are empty files whose mtime is the only data.
+ * Layout: <baseDir>/<workflowId>/<YYYYMMDDHH>/<sha256(key)[:32]>.
+ *
+ * Safe across concurrent `realm listen` processes via O_EXCL (openSync 'wx').
+ *
+ * Note: `check` requires `ttlMs` in practice — it scans floor(ttlMs/3_600_000)+2
+ * hour buckets. It is declared with a default of 0 only to satisfy the DedupStore
+ * interface (which types ttlMs as optional); real callers always pass the TTL.
+ */
+export class FileDedupStore {
+    dir;
+    lastCleanupErrorAt = 0;
+    constructor(baseDir, workflowId) {
+        this.dir = join(baseDir, workflowId);
+    }
+    hashKey(key) {
+        return createHash('sha256').update(key).digest('hex').slice(0, 32);
+    }
+    bucketName(ms) {
+        const d = new Date(ms);
+        const year = String(d.getUTCFullYear()).padStart(4, '0');
+        const month = String(d.getUTCMonth() + 1).padStart(2, '0');
+        const day = String(d.getUTCDate()).padStart(2, '0');
+        const hour = String(d.getUTCHours()).padStart(2, '0');
+        return `${year}${month}${day}${hour}`;
+    }
+    check(key, ttlMs = 0) {
+        const hash = this.hashKey(key);
+        const now = Date.now();
+        const buckets = Math.floor(ttlMs / ONE_HOUR_MS) + 2;
+        for (let i = 0; i < buckets; i++) {
+            const bucket = this.bucketName(now - i * ONE_HOUR_MS);
+            const filePath = join(this.dir, bucket, hash);
+            const stat = statSync(filePath, { throwIfNoEntry: false });
+            if (stat !== undefined && now - stat.mtime.getTime() < ttlMs) {
+                return true;
+            }
+        }
+        return false;
+    }
+    record(key, _ttlMs) {
+        const hash = this.hashKey(key);
+        const bucketDir = join(this.dir, this.bucketName(Date.now()));
+        const filePath = join(bucketDir, hash);
+        mkdirSync(bucketDir, { recursive: true });
+        try {
+            const fd = openSync(filePath, 'wx');
+            closeSync(fd);
+        }
+        catch (err) {
+            // Concurrent at-least-once delivery may race to create the same file.
+            if (err.code === 'EEXIST') {
+                return;
+            }
+            throw err;
+        }
+    }
+    cleanup(maxAgeMs) {
+        try {
+            const now = Date.now();
+            let entries;
+            try {
+                entries = readdirSync(this.dir);
+            }
+            catch (err) {
+                if (err.code === 'ENOENT') {
+                    return;
+                }
+                throw err;
+            }
+            for (const name of entries) {
+                if (!/^\d{10}$/.test(name)) {
+                    continue;
+                }
+                const year = parseInt(name.slice(0, 4), 10);
+                const month = parseInt(name.slice(4, 6), 10) - 1;
+                const day = parseInt(name.slice(6, 8), 10);
+                const hour = parseInt(name.slice(8, 10), 10);
+                const bucketEndMs = new Date(Date.UTC(year, month, day, hour + 1)).getTime();
+                if (bucketEndMs < now - maxAgeMs) {
+                    rmSync(join(this.dir, name), { recursive: true, force: true });
+                }
+            }
+        }
+        catch (err) {
+            const now = Date.now();
+            if (now - this.lastCleanupErrorAt >= 60_000) {
+                this.lastCleanupErrorAt = now;
+                console.error(`realm dedup cleanup error in ${this.dir}:`, err);
+            }
+        }
+    }
+}
+export class InMemoryDedupStore {
+    map = new Map(); // key → expiry timestamp
+    check(key) {
+        this.evictExpired();
+        const expiry = this.map.get(key);
+        return expiry !== undefined && Date.now() < expiry;
+    }
+    record(key, ttlMs) {
+        this.map.set(key, Date.now() + ttlMs);
+    }
+    cleanup(_maxAgeMs) {
+        this.evictExpired();
+    }
+    evictExpired() {
+        const now = Date.now();
+        for (const [k, expiry] of this.map) {
+            if (now >= expiry)
+                this.map.delete(k);
+        }
+    }
+}
+//# sourceMappingURL=dedup-store.js.map

package/dist/lib/dedup-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dedup-store.js","sourceRoot":"","sources":["../../src/lib/dedup-store.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,yEAAyE;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAgBjC,MAAM,WAAW,GAAG,SAAS,CAAC;AAE9B;;;;;;;;;GASG;AACH,MAAM,OAAO,cAAc;IACR,GAAG,CAAS;IACrB,kBAAkB,GAAG,CAAC,CAAC;IAE/B,YAAY,OAAe,EAAE,UAAkB;QAC7C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACvC,CAAC;IAEO,OAAO,CAAC,GAAW;QACzB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IAEO,UAAU,CAAC,EAAU;QAC3B,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO,GAAG,IAAI,GAAG,KAAK,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,GAAW,EAAE,KAAK,GAAG,CAAC;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC;YACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3D,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;gBAC7D,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,CAAC,GAAW,EAAE,MAAc;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACvC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACpC,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,OAAO,CAAC,QAAgB;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,OAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrD,OAAO;gBACT,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC3B,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;gBACjD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7C,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC7E,IAAI,WAAW,GAAG,GAAG,GAAG,QAAQ,EAAE,CAAC;oBACjC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,GAAG,GAAG,IAAI,CAAC,kBAAkB,IAAI,MAAM,EAAE,CAAC;gBAC5C,IAAI,CAAC,kBAAkB,GAAG,GAAG,CAAC;gBAC9B,OAAO,CAAC,KAAK,CAAC,gCAAgC,IAAI,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,kBAAkB;IACrB,GAAG,GAAwB,IAAI,GAAG,EAAE,CAAC,CAAC,yBAAyB;IAEvE,KAAK,CAAC,GAAW;QACf,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrD,CAAC;IAED,MAAM,CAAC,GAAW,EAAE,KAAa;QAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,CAAC,SAAiB;QACvB,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAEO,YAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACnC,IAAI,GAAG,IAAI,MAAM;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;CACF"}

package/dist/lib/webhook-params.d.ts

@@ -0,0 +1,34 @@
+import type { DedupConfig } from '@sensigo/realm';
+export interface WebhookPayload {
+    headers: Record<string, string>;
+    body: unknown;
+}
+/**
+ * Resolves a dot-notation path into an object.
+ * Numeric segments (all-digit strings) index into arrays (zero-based).
+ * Returns undefined on any resolution failure. Never throws.
+ *
+ * Rules:
+ *  - Empty path returns the root object.
+ *  - On an array, an all-digit in-bounds segment descends by index; any other
+ *    segment (non-numeric or out-of-bounds index) resolves to undefined.
+ *  - On a plain object, the segment is always a property key — even all-digit
+ *    segments are string keys, not array indices.
+ *  - On null/undefined/primitive, resolution stops with undefined.
+ */
+export declare function resolveDotPath(obj: unknown, path: string): unknown;
+/**
+ * Extracts run params from a webhook payload using params_map.
+ * Logs a warn via the injected logger for each undefined result.
+ * Returns a partial record — missing keys are absent, not null.
+ */
+export declare function extractParams(payload: WebhookPayload, paramsMap: Record<string, string>, logger: {
+    warn: (msg: string, data?: unknown) => void;
+}): Record<string, unknown>;
+/**
+ * Extracts the dedup ID from a webhook payload.
+ * Returns the value coerced to string, or undefined if absent/null.
+ * Numeric values are valid dedup IDs (stringified).
+ */
+export declare function extractDedupId(payload: WebhookPayload, dedupConfig: DedupConfig): string | undefined;
+//# sourceMappingURL=webhook-params.d.ts.map

package/dist/lib/webhook-params.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-params.d.ts","sourceRoot":"","sources":["../../src/lib/webhook-params.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAgClE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACjC,MAAM,EAAE;IAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAA;CAAE,GACtD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAczB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,cAAc,EACvB,WAAW,EAAE,WAAW,GACvB,MAAM,GAAG,SAAS,CAOpB"}

package/dist/lib/webhook-params.js

@@ -0,0 +1,74 @@
+/**
+ * Resolves a dot-notation path into an object.
+ * Numeric segments (all-digit strings) index into arrays (zero-based).
+ * Returns undefined on any resolution failure. Never throws.
+ *
+ * Rules:
+ *  - Empty path returns the root object.
+ *  - On an array, an all-digit in-bounds segment descends by index; any other
+ *    segment (non-numeric or out-of-bounds index) resolves to undefined.
+ *  - On a plain object, the segment is always a property key — even all-digit
+ *    segments are string keys, not array indices.
+ *  - On null/undefined/primitive, resolution stops with undefined.
+ */
+export function resolveDotPath(obj, path) {
+    if (path === '') {
+        return obj;
+    }
+    let current = obj;
+    for (const segment of path.split('.')) {
+        if (current === null || current === undefined) {
+            return undefined;
+        }
+        if (Array.isArray(current)) {
+            if (/^\d+$/.test(segment)) {
+                const index = Number(segment);
+                if (index >= 0 && index < current.length) {
+                    current = current[index];
+                    continue;
+                }
+            }
+            return undefined;
+        }
+        if (typeof current === 'object') {
+            current = current[segment];
+            continue;
+        }
+        // primitive — cannot descend further
+        return undefined;
+    }
+    return current;
+}
+/**
+ * Extracts run params from a webhook payload using params_map.
+ * Logs a warn via the injected logger for each undefined result.
+ * Returns a partial record — missing keys are absent, not null.
+ */
+export function extractParams(payload, paramsMap, logger) {
+    const root = { headers: payload.headers, body: payload.body };
+    const result = {};
+    for (const [paramName, dotPath] of Object.entries(paramsMap)) {
+        const value = resolveDotPath(root, dotPath);
+        if (value === undefined) {
+            logger.warn('webhook params: could not resolve path', { path: dotPath });
+        }
+        else {
+            result[paramName] = value;
+        }
+    }
+    return result;
+}
+/**
+ * Extracts the dedup ID from a webhook payload.
+ * Returns the value coerced to string, or undefined if absent/null.
+ * Numeric values are valid dedup IDs (stringified).
+ */
+export function extractDedupId(payload, dedupConfig) {
+    const root = { headers: payload.headers, body: payload.body };
+    const value = resolveDotPath(root, dedupConfig.id_from);
+    if (value === null || value === undefined) {
+        return undefined;
+    }
+    return String(value);
+}
+//# sourceMappingURL=webhook-params.js.map

package/dist/lib/webhook-params.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-params.js","sourceRoot":"","sources":["../../src/lib/webhook-params.ts"],"names":[],"mappings":"AASA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY,EAAE,IAAY;IACvD,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,OAAO,GAAY,GAAG,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC9B,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;oBACzC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;oBACzB,SAAS;gBACX,CAAC;YACH,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,GAAI,OAAmC,CAAC,OAAO,CAAC,CAAC;YACxD,SAAS;QACX,CAAC;QAED,qCAAqC;QACrC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAuB,EACvB,SAAiC,EACjC,MAAuD;IAEvD,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9D,MAAM,MAAM,GAA4B,EAAE,CAAC;IAE3C,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAuB,EACvB,WAAwB;IAExB,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9D,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC"}

package/dist/lib/webhook-verifiers.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Verifies a GitHub webhook signature.
+ * Header format: 'sha256=<hex-digest>'
+ */
+export declare function verifyGithub(rawBody: Buffer, header: string, secret: string): boolean;
+/**
+ * Verifies a shared-secret (header token) webhook — the primary model for sources that
+ * authenticate via a user-configured header (e.g. Gorgias: `Authorization: Bearer <token>`).
+ *
+ * `secret` is the EXACT expected header value the operator configured on the source integration
+ * (e.g. 'Bearer abc123' or just 'abc123'). No prefix stripping — an exact, timing-safe compare
+ * keeps it unambiguous. `headers` is the request header map (Node lowercases header names);
+ * `headerName` is matched case-insensitively. Pure, never throws, returns false on any malformed,
+ * missing, or mismatched input.
+ */
+export declare function verifySharedSecret(headers: Record<string, string>, headerName: string, secret: string): boolean;
+/**
+ * Verifies a Stripe webhook signature.
+ * Header format: 't=<timestamp>,v1=<hex-digest>[,v1=<hex-digest>...]'
+ * Signed payload: '<timestamp>.<rawBody>'
+ */
+export declare function verifyStripe(rawBody: Buffer, header: string, secret: string, maxAgeSeconds?: number): boolean;
+/**
+ * Verifies a generic HMAC webhook signature.
+ */
+export declare function verifyHmac(rawBody: Buffer, header: string, secret: string, opts: {
+    algorithm?: 'sha1' | 'sha256' | 'sha512';
+    encoding?: 'hex' | 'base64';
+    timestamp_header?: string;
+    max_age_seconds?: number;
+    headers: Record<string, string>;
+}): boolean;
+//# sourceMappingURL=webhook-verifiers.d.ts.map

package/dist/lib/webhook-verifiers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-verifiers.d.ts","sourceRoot":"","sources":["../../src/lib/webhook-verifiers.ts"],"names":[],"mappings":"AAiBA;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAcrF;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAsBT;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAwDT;AAED;;GAEG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IACJ,SAAS,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACzC,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC,GACA,OAAO,CA8BT"}

package/dist/lib/webhook-verifiers.js

@@ -0,0 +1,160 @@
+// Webhook signature verifiers — pure functions, no I/O, no logging.
+// Every comparison uses timingSafeEqual; every function returns false (never throws)
+// on any malformed, missing, or mismatched input.
+import { createHmac, timingSafeEqual } from 'node:crypto';
+/**
+ * Length-safe constant-time comparison of two buffers.
+ * timingSafeEqual throws when lengths differ, so guard the length first.
+ * The length of an attacker-supplied signature is not itself a secret.
+ */
+function safeEqual(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    return timingSafeEqual(a, b);
+}
+/**
+ * Verifies a GitHub webhook signature.
+ * Header format: 'sha256=<hex-digest>'
+ */
+export function verifyGithub(rawBody, header, secret) {
+    try {
+        if (typeof header !== 'string' || !header.startsWith('sha256=')) {
+            return false;
+        }
+        const provided = header.slice('sha256='.length);
+        if (provided === '') {
+            return false;
+        }
+        const computed = createHmac('sha256', secret).update(rawBody).digest('hex');
+        return safeEqual(Buffer.from(computed), Buffer.from(provided));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Verifies a shared-secret (header token) webhook — the primary model for sources that
+ * authenticate via a user-configured header (e.g. Gorgias: `Authorization: Bearer <token>`).
+ *
+ * `secret` is the EXACT expected header value the operator configured on the source integration
+ * (e.g. 'Bearer abc123' or just 'abc123'). No prefix stripping — an exact, timing-safe compare
+ * keeps it unambiguous. `headers` is the request header map (Node lowercases header names);
+ * `headerName` is matched case-insensitively. Pure, never throws, returns false on any malformed,
+ * missing, or mismatched input.
+ */
+export function verifySharedSecret(headers, headerName, secret) {
+    try {
+        if (typeof headerName !== 'string' || headerName === '') {
+            return false;
+        }
+        if (typeof secret !== 'string' || secret === '') {
+            return false;
+        }
+        if (typeof headers !== 'object' || headers === null) {
+            return false;
+        }
+        // Own-property lookup (defense-in-depth): a polluted Object.prototype[<header-name>]
+        // can never satisfy the compare, even if `headers` was not built with a null prototype.
+        const key = headerName.toLowerCase();
+        const provided = Object.hasOwn(headers, key) ? headers[key] : undefined;
+        if (typeof provided !== 'string' || provided === '') {
+            return false;
+        }
+        return safeEqual(Buffer.from(provided), Buffer.from(secret));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Verifies a Stripe webhook signature.
+ * Header format: 't=<timestamp>,v1=<hex-digest>[,v1=<hex-digest>...]'
+ * Signed payload: '<timestamp>.<rawBody>'
+ */
+export function verifyStripe(rawBody, header, secret, maxAgeSeconds) {
+    try {
+        if (typeof header !== 'string' || header === '') {
+            return false;
+        }
+        let timestamp;
+        const signatures = [];
+        for (const segment of header.split(',')) {
+            const eq = segment.indexOf('=');
+            if (eq === -1) {
+                continue;
+            }
+            const key = segment.slice(0, eq).trim();
+            const value = segment.slice(eq + 1).trim();
+            if (key === 't') {
+                timestamp = value;
+            }
+            else if (key === 'v1') {
+                signatures.push(value);
+            }
+        }
+        if (timestamp === undefined || timestamp === '' || signatures.length === 0) {
+            return false;
+        }
+        const signedPayload = Buffer.concat([Buffer.from(`${timestamp}.`), rawBody]);
+        const computed = createHmac('sha256', secret).update(signedPayload).digest('hex');
+        const computedBuf = Buffer.from(computed);
+        let matched = false;
+        for (const sig of signatures) {
+            if (safeEqual(computedBuf, Buffer.from(sig))) {
+                matched = true;
+                break;
+            }
+        }
+        if (!matched) {
+            return false;
+        }
+        // Age check happens AFTER signature verification.
+        if (maxAgeSeconds !== undefined) {
+            const ts = parseInt(timestamp, 10);
+            if (Number.isNaN(ts)) {
+                return false;
+            }
+            if (Math.floor(Date.now() / 1000) - ts > maxAgeSeconds) {
+                return false;
+            }
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Verifies a generic HMAC webhook signature.
+ */
+export function verifyHmac(rawBody, header, secret, opts) {
+    try {
+        if (typeof header !== 'string' || header === '') {
+            return false;
+        }
+        const algorithm = opts.algorithm ?? 'sha256';
+        const encoding = opts.encoding ?? 'hex';
+        const computed = createHmac(algorithm, secret).update(rawBody).digest(encoding);
+        if (opts.timestamp_header !== undefined) {
+            const tsValue = opts.headers[opts.timestamp_header];
+            if (tsValue === undefined) {
+                return false;
+            }
+            if (opts.max_age_seconds !== undefined) {
+                const ts = parseInt(tsValue, 10);
+                if (Number.isNaN(ts)) {
+                    return false;
+                }
+                if (Math.floor(Date.now() / 1000) - ts > opts.max_age_seconds) {
+                    return false;
+                }
+            }
+        }
+        return safeEqual(Buffer.from(computed), Buffer.from(header));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=webhook-verifiers.js.map

package/dist/lib/webhook-verifiers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-verifiers.js","sourceRoot":"","sources":["../../src/lib/webhook-verifiers.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,qFAAqF;AACrF,kDAAkD;AAClD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D;;;;GAIG;AACH,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,MAAc,EAAE,MAAc;IAC1E,IAAI,CAAC;QACH,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAChE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAA+B,EAC/B,UAAkB,EAClB,MAAc;IAEd,IAAI,CAAC;QACH,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAChD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,qFAAqF;QACrF,wFAAwF;QACxF,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,MAAc,EACd,MAAc,EACd,aAAsB;IAEtB,IAAI,CAAC;QACH,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAChD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,SAA6B,CAAC;QAClC,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBACd,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;gBAChB,SAAS,GAAG,KAAK,CAAC;YACpB,CAAC;iBAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACxB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7E,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE1C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,IAAI,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC7C,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC;QACf,CAAC;QAED,kDAAkD;QAClD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;gBACvD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CACxB,OAAe,EACf,MAAc,EACd,MAAc,EACd,IAMC;IAED,IAAI,CAAC;QACH,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAChD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;QACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEhF,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACpD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBACjC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;oBACrB,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;oBAC9D,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sensigo/realm-cli",
-  "version": "0.6.4",
+  "version": "0.7.1",
   "publishConfig": {
     "access": "public"
   },
@@ -61,14 +61,14 @@
     "vitest": "^4.1.0"
   },
   "dependencies": {
-    "@sensigo/realm": "^0.6.4",
-    "@sensigo/realm-mcp": "^0.6.4",
-    "@sensigo/realm-testing": "^0.6.4",
+    "@sensigo/realm": "^0.7.1",
+    "@sensigo/realm-mcp": "^0.7.1",
+    "@sensigo/realm-testing": "^0.7.1",
     "@modelcontextprotocol/sdk": "1.29.0",
     "chalk": "^5.0.0",
     "commander": "^14.0.3",
     "dotenv": "^17.4.0",
-    "js-yaml": "^4.1.1"
+    "js-yaml": "^4.2.0"
   },
   "bin": {
     "realm": "./dist/index.js"