@siglo/crypto 0.0.0-stage → 1.0.1

package/dist/cipher/key-ring.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StaticKeyRing = void 0;
+exports.isKeyRing = isKeyRing;
+/**
+ * Type guard to check if an object satisfies the KeyRing interface.
+ */
+function isKeyRing(val) {
+    return (typeof val === 'object' &&
+        val !== null &&
+        typeof val.getActiveKey === 'function' &&
+        typeof val.getKey === 'function');
+}
+/**
+ * In-memory multi-key provider supporting active key generation and historical key retrieval.
+ */
+class StaticKeyRing {
+    activeKeyId;
+    keys = new Map();
+    constructor(activeKeyId, keys) {
+        this.activeKeyId = activeKeyId;
+        if (keys instanceof Map) {
+            this.keys = new Map(keys);
+        }
+        else {
+            for (const [kid, key] of Object.entries(keys)) {
+                this.keys.set(kid, key);
+            }
+        }
+        if (!this.keys.has(activeKeyId)) {
+            throw new Error(`Active key ID '${activeKeyId}' not found in provided keys`);
+        }
+    }
+    getActiveKey() {
+        const key = this.keys.get(this.activeKeyId);
+        if (!key) {
+            throw new Error(`Active key '${this.activeKeyId}' not found in KeyRing`);
+        }
+        return {
+            kid: this.activeKeyId,
+            key
+        };
+    }
+    getKey(kid) {
+        return this.keys.get(kid) ?? null;
+    }
+    /**
+     * Adds or rotates a key in the ring.
+     */
+    addKey(kid, key, makeActive = false) {
+        this.keys.set(kid, key);
+        if (makeActive) {
+            this.activeKeyId = kid;
+        }
+    }
+    /**
+     * Sets the active key ID for subsequent encryption operations.
+     */
+    setActiveKey(kid) {
+        if (!this.keys.has(kid)) {
+            throw new Error(`Cannot set active key to '${kid}': key not found in KeyRing`);
+        }
+        this.activeKeyId = kid;
+    }
+}
+exports.StaticKeyRing = StaticKeyRing;
+//# sourceMappingURL=key-ring.js.map

package/dist/cipher/key-ring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-ring.js","sourceRoot":"","sources":["../../src/cipher/key-ring.ts"],"names":[],"mappings":";;;AAKA,8BAOC;AAVD;;GAEG;AACH,SAAgB,SAAS,CAAC,GAAY;IACpC,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACZ,OAAQ,GAAW,CAAC,YAAY,KAAK,UAAU;QAC/C,OAAQ,GAAW,CAAC,MAAM,KAAK,UAAU,CAC1C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAa,aAAa;IAChB,WAAW,CAAS;IACpB,IAAI,GAAiC,IAAI,GAAG,EAAE,CAAC;IAEvD,YACE,WAAmB,EACnB,IAAoE;QAEpE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,IAAI,YAAY,GAAG,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,kBAAkB,WAAW,8BAA8B,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAED,YAAY;QACV,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,CAAC,WAAW,wBAAwB,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO;YACL,GAAG,EAAE,IAAI,CAAC,WAAW;YACrB,GAAG;SACJ,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,GAAW,EAAE,GAAoB,EAAE,aAAsB,KAAK;QACnE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;QACzB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,GAAW;QACtB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,6BAA6B,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;IACzB,CAAC;CACF;AAvDD,sCAuDC"}

package/dist/index.d.ts

@@ -0,0 +1,19 @@
+export * from './types';
+export * from './registry';
+export * from './webhooks/timing';
+export * from './webhooks/dedup';
+export * from './webhooks/verify-step';
+export * from './webhooks/protocols/base';
+export * from './webhooks/protocols/stripe';
+export * from './webhooks/protocols/github';
+export * from './webhooks/protocols/shopify';
+export * from './webhooks/protocols/slack';
+export * from './webhooks/protocols/svix';
+export * from './webhooks/protocols/generic-hmac';
+export * from './cipher/key-ring';
+export * from './cipher/aes-gcm';
+export * from './cipher/encrypt-step';
+export * from './cipher/decrypt-step';
+export * from './redaction/paths';
+export * from './redaction/mask-step';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,wBAAwB,CAAC;AACvC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mCAAmC,CAAC;AAClD,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC"}

package/dist/index.js

@@ -0,0 +1,35 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./types"), exports);
+__exportStar(require("./registry"), exports);
+__exportStar(require("./webhooks/timing"), exports);
+__exportStar(require("./webhooks/dedup"), exports);
+__exportStar(require("./webhooks/verify-step"), exports);
+__exportStar(require("./webhooks/protocols/base"), exports);
+__exportStar(require("./webhooks/protocols/stripe"), exports);
+__exportStar(require("./webhooks/protocols/github"), exports);
+__exportStar(require("./webhooks/protocols/shopify"), exports);
+__exportStar(require("./webhooks/protocols/slack"), exports);
+__exportStar(require("./webhooks/protocols/svix"), exports);
+__exportStar(require("./webhooks/protocols/generic-hmac"), exports);
+__exportStar(require("./cipher/key-ring"), exports);
+__exportStar(require("./cipher/aes-gcm"), exports);
+__exportStar(require("./cipher/encrypt-step"), exports);
+__exportStar(require("./cipher/decrypt-step"), exports);
+__exportStar(require("./redaction/paths"), exports);
+__exportStar(require("./redaction/mask-step"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,6CAA2B;AAC3B,oDAAkC;AAClC,mDAAiC;AACjC,yDAAuC;AACvC,4DAA0C;AAC1C,8DAA4C;AAC5C,8DAA4C;AAC5C,+DAA6C;AAC7C,6DAA2C;AAC3C,4DAA0C;AAC1C,oEAAkD;AAClD,oDAAkC;AAClC,mDAAiC;AACjC,wDAAsC;AACtC,wDAAsC;AACtC,oDAAkC;AAClC,wDAAsC"}

package/dist/redaction/mask-step.d.ts

@@ -0,0 +1,28 @@
+import { Step, ExecutionOptions } from '@siglo/core';
+import { MaskFieldsOptions } from '../types';
+/**
+ * Common masking pattern presets for PII sanitization.
+ */
+export declare const maskPatterns: {
+    /** Replaces entire value with [REDACTED] */
+    redact: (_value: unknown) => string;
+    /** Keeps the last 4 characters visible; masks earlier characters with asterisks */
+    last4: (value: unknown) => string;
+    /** Formats digits as masked credit card number: ****-****-****-1234 */
+    creditCard: (value: unknown) => string;
+    /** Formats digits as masked US Social Security Number: ***-**-1234 */
+    ssn: (value: unknown) => string;
+    /** Masks email local-part: j***@example.com */
+    email: (value: unknown) => string;
+};
+export declare class MaskFieldsStep<TInput = any, TName extends string = string> extends Step<TInput, TInput, TName> {
+    constructor(name: TName, options: MaskFieldsOptions<TInput>);
+    execute(param?: TInput, options?: ExecutionOptions): Promise<TInput>;
+    run(param?: TInput, options?: ExecutionOptions): Promise<TInput>;
+}
+/**
+ * Creates a step that masks sensitive context fields before DevTools/telemetry emission.
+ * Supports dot-notation paths, array wildcards, and structural sharing.
+ */
+export declare function maskFieldsStep<const TName extends string, TInput>(name: TName, options: MaskFieldsOptions<TInput>): MaskFieldsStep<TInput, TName>;
+//# sourceMappingURL=mask-step.d.ts.map

package/dist/redaction/mask-step.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mask-step.d.ts","sourceRoot":"","sources":["../../src/redaction/mask-step.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAgB7C;;GAEG;AACH,eAAO,MAAM,YAAY;IACvB,4CAA4C;qBAC3B,OAAO,KAAG,MAAM;IAEjC,mFAAmF;mBACpE,OAAO,KAAG,MAAM;IAQ/B,uEAAuE;wBACnD,OAAO,KAAG,MAAM;IAMpC,sEAAsE;iBACzD,OAAO,KAAG,MAAM;IAM7B,+CAA+C;mBAChC,OAAO,KAAG,MAAM;CAQhC,CAAC;AAEF,qBAAa,cAAc,CAAC,MAAM,GAAG,GAAG,EAAE,KAAK,SAAS,MAAM,GAAG,MAAM,CACrE,SAAQ,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC;gBAEvB,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC;IAiBlD,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;IAKpE,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;CAG1E;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,CAAC,KAAK,SAAS,MAAM,EAAE,MAAM,EAC/D,IAAI,EAAE,KAAK,EACX,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC,GACjC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAE/B"}

package/dist/redaction/mask-step.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MaskFieldsStep = exports.maskPatterns = void 0;
+exports.maskFieldsStep = maskFieldsStep;
+const core_1 = require("@siglo/core");
+const paths_1 = require("./paths");
+function sanitizeStepInput(param) {
+    if (!param || typeof param !== 'object' || Array.isArray(param)) {
+        return param;
+    }
+    const clean = {};
+    for (const [key, val] of Object.entries(param)) {
+        if (key !== '$steps' && key !== '$history' && key !== '$stackId') {
+            clean[key] = val;
+        }
+    }
+    return clean;
+}
+/**
+ * Common masking pattern presets for PII sanitization.
+ */
+exports.maskPatterns = {
+    /** Replaces entire value with [REDACTED] */
+    redact: (_value) => '[REDACTED]',
+    /** Keeps the last 4 characters visible; masks earlier characters with asterisks */
+    last4: (value) => {
+        const str = String(value ?? '');
+        if (str.length <= 4) {
+            return '*'.repeat(str.length || 4);
+        }
+        return '*'.repeat(str.length - 4) + str.slice(-4);
+    },
+    /** Formats digits as masked credit card number: ****-****-****-1234 */
+    creditCard: (value) => {
+        const digits = String(value ?? '').replace(/\D/g, '');
+        const last4 = digits.slice(-4) || '****';
+        return `****-****-****-${last4}`;
+    },
+    /** Formats digits as masked US Social Security Number: ***-**-1234 */
+    ssn: (value) => {
+        const digits = String(value ?? '').replace(/\D/g, '');
+        const last4 = digits.slice(-4) || '****';
+        return `***-**-${last4}`;
+    },
+    /** Masks email local-part: j***@example.com */
+    email: (value) => {
+        const str = String(value ?? '');
+        const atIdx = str.indexOf('@');
+        if (atIdx <= 1) {
+            return str.replace(/^./, '*') || '***';
+        }
+        return `${str[0]}***${str.slice(atIdx)}`;
+    }
+};
+class MaskFieldsStep extends core_1.Step {
+    constructor(name, options) {
+        const action = async (ctx) => {
+            const maskFn = options.maskPattern || exports.maskPatterns.last4;
+            const result = (0, paths_1.transformFields)(ctx, options.fields, (val) => {
+                if (val !== undefined && val !== null) {
+                    return maskFn(val);
+                }
+                return val;
+            });
+            return result;
+        };
+        super(name, action);
+    }
+    execute(param, options) {
+        const cleanParam = param ? sanitizeStepInput(param) : param;
+        return super.execute(cleanParam, { pojo: true, ...options });
+    }
+    run(param, options) {
+        return this.execute(param, options);
+    }
+}
+exports.MaskFieldsStep = MaskFieldsStep;
+/**
+ * Creates a step that masks sensitive context fields before DevTools/telemetry emission.
+ * Supports dot-notation paths, array wildcards, and structural sharing.
+ */
+function maskFieldsStep(name, options) {
+    return new MaskFieldsStep(name, options);
+}
+//# sourceMappingURL=mask-step.js.map

package/dist/redaction/mask-step.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mask-step.js","sourceRoot":"","sources":["../../src/redaction/mask-step.ts"],"names":[],"mappings":";;;AA4FA,wCAKC;AAjGD,sCAAqD;AAErD,mCAA0C;AAE1C,SAAS,iBAAiB,CAAI,KAAQ;IACpC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAwB,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACjE,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,KAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACU,QAAA,YAAY,GAAG;IAC1B,4CAA4C;IAC5C,MAAM,EAAE,CAAC,MAAe,EAAU,EAAE,CAAC,YAAY;IAEjD,mFAAmF;IACnF,KAAK,EAAE,CAAC,KAAc,EAAU,EAAE;QAChC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAChC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACpB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,uEAAuE;IACvE,UAAU,EAAE,CAAC,KAAc,EAAU,EAAE;QACrC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;QACzC,OAAO,kBAAkB,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,sEAAsE;IACtE,GAAG,EAAE,CAAC,KAAc,EAAU,EAAE;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;QACzC,OAAO,UAAU,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,+CAA+C;IAC/C,KAAK,EAAE,CAAC,KAAc,EAAU,EAAE;QAChC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC;QACzC,CAAC;QACD,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3C,CAAC;CACF,CAAC;AAEF,MAAa,cACX,SAAQ,WAA2B;IAEnC,YAAY,IAAW,EAAE,OAAkC;QACzD,MAAM,MAAM,GAAG,KAAK,EAAE,GAAW,EAAmB,EAAE;YACpD,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAY,CAAC,KAAK,CAAC;YAEzD,MAAM,MAAM,GAAG,IAAA,uBAAe,EAAC,GAAG,EAAE,OAAO,CAAC,MAAa,EAAE,CAAC,GAAG,EAAE,EAAE;gBACjE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;oBACtC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;gBACrB,CAAC;gBACD,OAAO,GAAG,CAAC;YACb,CAAC,CAAC,CAAC;YAEH,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QAEF,KAAK,CAAC,IAAI,EAAE,MAAa,CAAC,CAAC;IAC7B,CAAC;IAEQ,OAAO,CAAC,KAAc,EAAE,OAA0B;QACzD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5D,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC;IAEQ,GAAG,CAAC,KAAc,EAAE,OAA0B;QACrD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;CACF;AA5BD,wCA4BC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAC5B,IAAW,EACX,OAAkC;IAElC,OAAO,IAAI,cAAc,CAAgB,IAAI,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC"}

package/dist/redaction/paths.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Utilities for dot-notation path traversal, wildcards, and immutable structural sharing.
+ */
+export declare function splitPath(pattern: string): string[];
+/**
+ * Returns all concrete paths in `obj` that match the wildcard pattern.
+ * Supports '*' to match any object property or array index.
+ */
+export declare function getMatchingPaths(obj: unknown, pattern: string): (string | number)[][];
+/**
+ * Retrieves the value at a concrete path.
+ */
+export declare function getValueAtPath(obj: unknown, path: (string | number)[]): unknown;
+/**
+ * Immutably updates the value at a concrete path using structural sharing (copy-on-write).
+ * Only the ancestor nodes along the path are cloned; sibling branches remain untouched.
+ */
+export declare function setValueAtPath(obj: any, path: (string | number)[], transform: (currentVal: unknown) => unknown): any;
+/**
+ * Transforms all fields in `obj` matching the provided string/keyof patterns.
+ * Supports both top-level property keys and nested dot-notation/wildcard paths.
+ */
+export declare function transformFields(obj: any, patterns: (string | number | symbol)[], transform: (val: unknown, concretePath: (string | number)[]) => unknown): any;
+/**
+ * Deep freezes an object (used in dev mode to assert context immutability).
+ */
+export declare function deepFreeze<T>(obj: T): T;
+//# sourceMappingURL=paths.d.ts.map

package/dist/redaction/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/redaction/paths.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAEnD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,EAAE,CAwCrF;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,OAAO,CAS/E;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,EACzB,SAAS,EAAE,CAAC,UAAU,EAAE,OAAO,KAAK,OAAO,GAC1C,GAAG,CA6BL;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,CAAC,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC,EAAE,EACtC,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,KAAK,OAAO,GACtE,GAAG,CA+BL;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAYvC"}

package/dist/redaction/paths.js

@@ -0,0 +1,149 @@
+"use strict";
+/**
+ * Utilities for dot-notation path traversal, wildcards, and immutable structural sharing.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.splitPath = splitPath;
+exports.getMatchingPaths = getMatchingPaths;
+exports.getValueAtPath = getValueAtPath;
+exports.setValueAtPath = setValueAtPath;
+exports.transformFields = transformFields;
+exports.deepFreeze = deepFreeze;
+function splitPath(pattern) {
+    return pattern.split('.').filter(Boolean);
+}
+/**
+ * Returns all concrete paths in `obj` that match the wildcard pattern.
+ * Supports '*' to match any object property or array index.
+ */
+function getMatchingPaths(obj, pattern) {
+    const segments = splitPath(pattern);
+    const results = [];
+    function traverse(current, segmentIdx, currentPath) {
+        if (segmentIdx >= segments.length) {
+            results.push(currentPath);
+            return;
+        }
+        if (current === null || current === undefined || typeof current !== 'object') {
+            return;
+        }
+        const seg = segments[segmentIdx];
+        if (seg === '*') {
+            if (Array.isArray(current)) {
+                for (let i = 0; i < current.length; i++) {
+                    traverse(current[i], segmentIdx + 1, [...currentPath, i]);
+                }
+            }
+            else {
+                for (const key of Object.keys(current)) {
+                    traverse(current[key], segmentIdx + 1, [...currentPath, key]);
+                }
+            }
+        }
+        else {
+            if (Array.isArray(current)) {
+                const num = Number(seg);
+                if (!Number.isNaN(num) && num in current) {
+                    traverse(current[num], segmentIdx + 1, [...currentPath, num]);
+                }
+            }
+            else if (seg in current) {
+                traverse(current[seg], segmentIdx + 1, [...currentPath, seg]);
+            }
+        }
+    }
+    traverse(obj, 0, []);
+    return results;
+}
+/**
+ * Retrieves the value at a concrete path.
+ */
+function getValueAtPath(obj, path) {
+    let curr = obj;
+    for (const part of path) {
+        if (curr === null || curr === undefined) {
+            return undefined;
+        }
+        curr = curr[part];
+    }
+    return curr;
+}
+/**
+ * Immutably updates the value at a concrete path using structural sharing (copy-on-write).
+ * Only the ancestor nodes along the path are cloned; sibling branches remain untouched.
+ */
+function setValueAtPath(obj, path, transform) {
+    if (path.length === 0) {
+        return transform(obj);
+    }
+    const [head, ...tail] = path;
+    if (Array.isArray(obj)) {
+        const copy = [...obj];
+        const index = Number(head);
+        const existingChild = copy[index];
+        const childTarget = tail.length === 0
+            ? existingChild
+            : (existingChild !== undefined && existingChild !== null && typeof existingChild === 'object'
+                ? existingChild
+                : typeof tail[0] === 'number' ? [] : {});
+        copy[index] = setValueAtPath(childTarget, tail, transform);
+        return copy;
+    }
+    const copy = obj && typeof obj === 'object' ? { ...obj } : {};
+    const existingChild = copy[head];
+    const childTarget = tail.length === 0
+        ? existingChild
+        : (existingChild !== undefined && existingChild !== null && typeof existingChild === 'object'
+            ? existingChild
+            : typeof tail[0] === 'number' ? [] : {});
+    copy[head] = setValueAtPath(childTarget, tail, transform);
+    return copy;
+}
+/**
+ * Transforms all fields in `obj` matching the provided string/keyof patterns.
+ * Supports both top-level property keys and nested dot-notation/wildcard paths.
+ */
+function transformFields(obj, patterns, transform) {
+    if (!obj || typeof obj !== 'object') {
+        return obj;
+    }
+    let result = obj;
+    for (const pattern of patterns) {
+        const patternStr = String(pattern);
+        // If simple property key without dot or asterisk, fast-path with shallow clone
+        if (!patternStr.includes('.') && !patternStr.includes('*')) {
+            if (patternStr in result) {
+                const val = result[patternStr];
+                const transformed = transform(val, [patternStr]);
+                if (transformed !== val) {
+                    result = Array.isArray(result) ? [...result] : { ...result };
+                    result[patternStr] = transformed;
+                }
+            }
+            continue;
+        }
+        // Nested or wildcard pattern
+        const matchingPaths = getMatchingPaths(result, patternStr);
+        for (const concretePath of matchingPaths) {
+            result = setValueAtPath(result, concretePath, (curr) => transform(curr, concretePath));
+        }
+    }
+    return result;
+}
+/**
+ * Deep freezes an object (used in dev mode to assert context immutability).
+ */
+function deepFreeze(obj) {
+    if (!obj || typeof obj !== 'object' || Object.isFrozen(obj)) {
+        return obj;
+    }
+    Object.freeze(obj);
+    for (const key of Object.keys(obj)) {
+        const val = obj[key];
+        if (val && typeof val === 'object' && !Object.isFrozen(val)) {
+            deepFreeze(val);
+        }
+    }
+    return obj;
+}
+//# sourceMappingURL=paths.js.map

package/dist/redaction/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/redaction/paths.ts"],"names":[],"mappings":";AAAA;;GAEG;;AAEH,8BAEC;AAMD,4CAwCC;AAKD,wCASC;AAMD,wCAiCC;AAMD,0CAmCC;AAKD,gCAYC;AA/JD,SAAgB,SAAS,CAAC,OAAe;IACvC,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,GAAY,EAAE,OAAe;IAC5D,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,OAAO,GAA0B,EAAE,CAAC;IAE1C,SAAS,QAAQ,CAAC,OAAgB,EAAE,UAAkB,EAAE,WAAgC;QACtF,IAAI,UAAU,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC7E,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;QAEjC,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YAChB,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACxC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC5D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACvC,QAAQ,CAAE,OAAe,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;gBACzE,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,OAAO,EAAE,CAAC;oBACzC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;gBAChE,CAAC;YACH,CAAC;iBAAM,IAAI,GAAG,IAAK,OAAe,EAAE,CAAC;gBACnC,QAAQ,CAAE,OAAe,CAAC,GAAG,CAAC,EAAE,UAAU,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACrB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,GAAY,EAAE,IAAyB;IACpE,IAAI,IAAI,GAAQ,GAAG,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAC5B,GAAQ,EACR,IAAyB,EACzB,SAA2C;IAE3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAE7B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC;YACnC,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,CAAC,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI,IAAI,OAAO,aAAa,KAAK,QAAQ;gBACzF,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,GAAG,cAAc,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC;QACnC,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,CAAC,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI,IAAI,OAAO,aAAa,KAAK,QAAQ;YACzF,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAC7B,GAAQ,EACR,QAAsC,EACtC,SAAuE;IAEvE,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,MAAM,GAAG,GAAG,CAAC;IAEjB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAEnC,+EAA+E;QAC/E,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC/B,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;gBACjD,IAAI,WAAW,KAAK,GAAG,EAAE,CAAC;oBACxB,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;oBAC7D,MAAM,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC;gBACnC,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QAED,6BAA6B;QAC7B,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC3D,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;YACzC,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAgB,UAAU,CAAI,GAAM;IAClC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,GAAG,GAAI,GAAW,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,UAAU,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/registry.d.ts

@@ -0,0 +1,14 @@
+import { WebhookProtocol } from './types';
+/**
+ * Registers a global webhook protocol strategy.
+ */
+export declare function registerWebhookProtocol(name: string, protocol: WebhookProtocol): void;
+/**
+ * Retrieves a registered webhook protocol by name.
+ */
+export declare function getWebhookProtocol(name: string): WebhookProtocol | undefined;
+/**
+ * Clears custom registered protocols, resetting to built-ins (useful for test isolation).
+ */
+export declare function resetWebhookProtocols(): void;
+//# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAkB1C;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,IAAI,CAErF;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAE5E;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAQ5C"}

package/dist/registry.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerWebhookProtocol = registerWebhookProtocol;
+exports.getWebhookProtocol = getWebhookProtocol;
+exports.resetWebhookProtocols = resetWebhookProtocols;
+const stripe_1 = require("./webhooks/protocols/stripe");
+const github_1 = require("./webhooks/protocols/github");
+const shopify_1 = require("./webhooks/protocols/shopify");
+const slack_1 = require("./webhooks/protocols/slack");
+const svix_1 = require("./webhooks/protocols/svix");
+const generic_hmac_1 = require("./webhooks/protocols/generic-hmac");
+const protocolRegistry = new Map();
+// Register default built-in protocols
+protocolRegistry.set('stripe', stripe_1.stripeProtocol);
+protocolRegistry.set('github', github_1.gitHubProtocol);
+protocolRegistry.set('shopify', shopify_1.shopifyProtocol);
+protocolRegistry.set('slack', slack_1.slackProtocol);
+protocolRegistry.set('svix', svix_1.svixProtocol);
+protocolRegistry.set('generic-hmac', generic_hmac_1.genericHmacProtocol);
+/**
+ * Registers a global webhook protocol strategy.
+ */
+function registerWebhookProtocol(name, protocol) {
+    protocolRegistry.set(name.toLowerCase(), protocol);
+}
+/**
+ * Retrieves a registered webhook protocol by name.
+ */
+function getWebhookProtocol(name) {
+    return protocolRegistry.get(name.toLowerCase());
+}
+/**
+ * Clears custom registered protocols, resetting to built-ins (useful for test isolation).
+ */
+function resetWebhookProtocols() {
+    protocolRegistry.clear();
+    protocolRegistry.set('stripe', stripe_1.stripeProtocol);
+    protocolRegistry.set('github', github_1.gitHubProtocol);
+    protocolRegistry.set('shopify', shopify_1.shopifyProtocol);
+    protocolRegistry.set('slack', slack_1.slackProtocol);
+    protocolRegistry.set('svix', svix_1.svixProtocol);
+    protocolRegistry.set('generic-hmac', generic_hmac_1.genericHmacProtocol);
+}
+//# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":";;AAqBA,0DAEC;AAKD,gDAEC;AAKD,sDAQC;AA1CD,wDAA6D;AAC7D,wDAA6D;AAC7D,0DAA+D;AAC/D,sDAA2D;AAC3D,oDAAyD;AACzD,oEAAwE;AAExE,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAE5D,sCAAsC;AACtC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,uBAAc,CAAC,CAAC;AAC/C,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,uBAAc,CAAC,CAAC;AAC/C,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,yBAAe,CAAC,CAAC;AACjD,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,qBAAa,CAAC,CAAC;AAC7C,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,mBAAY,CAAC,CAAC;AAC3C,gBAAgB,CAAC,GAAG,CAAC,cAAc,EAAE,kCAAmB,CAAC,CAAC;AAE1D;;GAEG;AACH,SAAgB,uBAAuB,CAAC,IAAY,EAAE,QAAyB;IAC7E,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,OAAO,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,SAAgB,qBAAqB;IACnC,gBAAgB,CAAC,KAAK,EAAE,CAAC;IACzB,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,uBAAc,CAAC,CAAC;IAC/C,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,uBAAc,CAAC,CAAC;IAC/C,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,yBAAe,CAAC,CAAC;IACjD,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,qBAAa,CAAC,CAAC;IAC7C,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,mBAAY,CAAC,CAAC;IAC3C,gBAAgB,CAAC,GAAG,CAAC,cAAc,EAAE,kCAAmB,CAAC,CAAC;AAC5D,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,115 @@
+/** Built-in provider preset identifiers with open string autocomplete */
+export type BuiltInWebhookProvider = 'stripe' | 'github' | 'shopify' | 'slack' | 'svix' | 'generic-hmac';
+export type WebhookProviderName = BuiltInWebhookProvider | (string & {});
+export interface WebhookProtocolVerificationParams {
+    secret: string | Buffer;
+    rawPayload: string | Buffer;
+    headers: Record<string, string | string[] | undefined>;
+    signatureHeader: string;
+    toleranceSeconds?: number;
+    clock?: {
+        now(): number;
+    };
+    algorithm?: 'sha256' | 'sha512' | 'sha1';
+}
+export interface ParsedWebhookHeaders {
+    timestamp?: number;
+    signatures: string[];
+    version?: string;
+}
+export interface WebhookProtocol {
+    name: string;
+    /** Parses timestamps, signatures, and version identifiers from raw headers */
+    parseHeaders?(headers: Record<string, string | string[] | undefined>, signatureHeader: string): ParsedWebhookHeaders;
+    /** Formats the exact string or buffer to be signed (e.g. `${timestamp}.${rawBody}`) */
+    formatSignedPayload?(rawBody: string | Buffer, timestamp?: number): string | Buffer;
+    /** Custom verification logic (HMAC, asymmetric Ed25519, RSA, etc.) */
+    verify(params: WebhookProtocolVerificationParams): Promise<boolean> | boolean;
+}
+/** Nonce / signature deduplication store interface */
+export interface WebhookDedupStore {
+    claim(key: string, ttlSeconds: number): Promise<boolean> | boolean;
+}
+/** Reference to spooled or stream-verified payload */
+export interface WebhookPayloadRef {
+    storage: 'memory' | 'file';
+    path?: string;
+    bytes: number;
+}
+export interface WebhookVerifyOptions<TInput> {
+    /**
+     * Built-in provider name, registered protocol name, custom WebhookProtocol instance,
+     * or dynamic resolver function based on workflow context.
+     */
+    provider?: WebhookProviderName | WebhookProtocol | ((ctx: TInput) => WebhookProviderName | WebhookProtocol);
+    /** Webhook signing secret (or public key for asymmetric protocols) */
+    secret: string | Buffer | ((ctx: TInput) => string | Buffer);
+    /** Raw unparsed payload buffer, UTF-8 string, or Readable stream / AsyncIterable */
+    payload: (ctx: TInput) => string | Buffer | NodeJS.ReadableStream | AsyncIterable<Buffer>;
+    /** Signature header string or entire headers dictionary */
+    signature: (ctx: TInput) => string | Record<string, string | string[] | undefined>;
+    /** Optional headers extractor if signature returns only the signature string */
+    headers?: (ctx: TInput) => Record<string, string | string[] | undefined>;
+    /** Hash algorithm for generic HMAC (default: 'sha256') */
+    algorithm?: 'sha256' | 'sha512' | 'sha1';
+    /** Max allowed difference between current time and signature timestamp in seconds (default: 300) */
+    toleranceSeconds?: number;
+    /** Optional clock interface for deterministic time testing */
+    clock?: {
+        now(): number;
+    };
+    /** Deduplication store for intra-window replay protection */
+    dedupStore?: WebhookDedupStore;
+    /** Maximum allowed payload size in bytes before rejecting with 413 ValidationException (default: 10MB) */
+    maxBodyBytes?: number;
+    /** Byte threshold above which streaming payloads are spooled to ephemeral disk (default: 5MB) */
+    spoolThresholdBytes?: number;
+    /** Directory for ephemeral disk spooling (default: os.tmpdir()) */
+    spoolDir?: string;
+}
+export interface WebhookVerificationResult {
+    webhookVerified: true;
+    verifiedAt: number;
+    provider: string;
+    idempotencyKey?: string;
+    payloadRef?: WebhookPayloadRef;
+}
+export interface EncryptedEnvelope {
+    __sigloCipher: 'aes-256-gcm';
+    v?: number;
+    kid?: string;
+    iv: string;
+    tag: string;
+    data: string;
+    edek?: string;
+    kekId?: string;
+}
+export interface KeyRingKey {
+    kid: string;
+    key: string | Buffer;
+}
+export interface KeyRing {
+    getActiveKey(): Promise<KeyRingKey> | KeyRingKey;
+    getKey(kid: string): Promise<string | Buffer | null | undefined> | string | Buffer | null | undefined;
+}
+export interface FieldCipherOptions<TInput> {
+    /** Fields to encrypt/decrypt. Supports top-level keys or dot-notation paths (e.g. 'billing.card.number', 'items.*.token') */
+    fields: (keyof TInput | string)[];
+    /** Secret key string, Buffer, KeyRing instance, or dynamic resolver callback */
+    secretKey?: string | Buffer | KeyRing | ((ctx: TInput) => string | Buffer | KeyRing | Promise<string | Buffer | KeyRing>);
+    /** KeyRing instance for multi-key rotation and checkpoint archaeology */
+    keyRing?: KeyRing;
+    /** Optional Additional Authenticated Data (AAD) for tenant/context isolation */
+    aad?: string | Buffer | ((ctx: TInput) => string | Buffer | undefined);
+    /** Optional HKDF context info for deriving per-workflow/tenant subkeys */
+    deriveKeyContext?: string | Buffer | ((ctx: TInput) => string | Buffer | undefined);
+    /** Callback invoked when a decrypted envelope was encrypted with a retired/historical key */
+    onNeedsRekey?: (ctx: TInput, field: string, oldKid?: string, activeKid?: string) => void;
+}
+export interface MaskFieldsOptions<TInput> {
+    /** Fields to mask. Supports top-level keys or dot-notation paths (e.g. 'user.ssn', 'passengers.*.passport') */
+    fields: (keyof TInput | string)[];
+    /** Custom or preset mask function */
+    maskPattern?: (value: unknown) => string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,cAAc,CAAC;AACzG,MAAM,MAAM,mBAAmB,GAAG,sBAAsB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEzE,MAAM,WAAW,iCAAiC;IAChD,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAA;KAAE,CAAC;IAC1B,SAAS,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;CAC1C;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IAEb,8EAA8E;IAC9E,YAAY,CAAC,CACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EACtD,eAAe,EAAE,MAAM,GACtB,oBAAoB,CAAC;IAExB,uFAAuF;IACvF,mBAAmB,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAEpF,sEAAsE;IACtE,MAAM,CAAC,MAAM,EAAE,iCAAiC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CAC/E;AAED,sDAAsD;AACtD,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACpE;AAED,sDAAsD;AACtD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,oBAAoB,CAAC,MAAM;IAC1C;;;OAGG;IACH,QAAQ,CAAC,EAAE,mBAAmB,GAAG,eAAe,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,mBAAmB,GAAG,eAAe,CAAC,CAAC;IAE5G,sEAAsE;IACtE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,MAAM,CAAC,CAAC;IAE7D,oFAAoF;IACpF,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAE1F,2DAA2D;IAC3D,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IAEnF,gFAAgF;IAChF,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IAEzE,0DAA0D;IAC1D,SAAS,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IAEzC,oGAAoG;IACpG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,8DAA8D;IAC9D,KAAK,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAA;KAAE,CAAC;IAE1B,6DAA6D;IAC7D,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAE/B,0GAA0G;IAC1G,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,iGAAiG;IACjG,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,eAAe,EAAE,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,iBAAiB,CAAC;CAChC;AAMD,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,aAAa,CAAC;IAC7B,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,OAAO;IACtB,YAAY,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC;IACjD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACvG;AAED,MAAM,WAAW,kBAAkB,CAAC,MAAM;IACxC,6HAA6H;IAC7H,MAAM,EAAE,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IAElC,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAE1H,yEAAyE;IACzE,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IAEvE,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IAEpF,6FAA6F;IAC7F,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CAC1F;AAED,MAAM,WAAW,iBAAiB,CAAC,MAAM;IACvC,+GAA+G;IAC/G,MAAM,EAAE,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IAElC,qCAAqC;IACrC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;CAC1C"}