@siglo/crypto 0.0.0-stage → 1.0.1

package/dist/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/webhooks/dedup.d.ts

@@ -0,0 +1,24 @@
+import { WebhookDedupStore } from '../types';
+/**
+ * Computes a deterministic SHA-256 deduplication key for a webhook delivery attempt.
+ */
+export declare function createDedupKey(provider: string, signature: string, timestamp?: number): string;
+/**
+ * High-performance in-memory bucketed ring buffer for intra-window webhook deduplication.
+ * Eliminates per-key eviction sweeps by grouping keys into sliding time buckets with O(1) pruning.
+ */
+export declare class InMemoryNonceStore implements WebhookDedupStore {
+    private buckets;
+    private allKeys;
+    private bucketDurationMs;
+    constructor(bucketDurationSeconds?: number);
+    private pruneExpired;
+    /**
+     * Atomically checks and records a nonce/signature key.
+     * Returns true if successfully claimed (first time seen), or false if already seen within TTL.
+     */
+    claim(key: string, ttlSeconds: number): boolean;
+    clear(): void;
+    get size(): number;
+}
+//# sourceMappingURL=dedup.d.ts.map

package/dist/webhooks/dedup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dedup.d.ts","sourceRoot":"","sources":["../../src/webhooks/dedup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7C;;GAEG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAKR;AAOD;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,iBAAiB;IAC1D,OAAO,CAAC,OAAO,CAAgB;IAC/B,OAAO,CAAC,OAAO,CAA0B;IACzC,OAAO,CAAC,gBAAgB,CAAS;gBAErB,qBAAqB,GAAE,MAAW;IAI9C,OAAO,CAAC,YAAY;IASpB;;;OAGG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO;IAuB/C,KAAK,IAAI,IAAI;IAKb,IAAI,IAAI,IAAI,MAAM,CAGjB;CACF"}

package/dist/webhooks/dedup.js

@@ -0,0 +1,69 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InMemoryNonceStore = void 0;
+exports.createDedupKey = createDedupKey;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+/**
+ * Computes a deterministic SHA-256 deduplication key for a webhook delivery attempt.
+ */
+function createDedupKey(provider, signature, timestamp) {
+    return node_crypto_1.default
+        .createHash('sha256')
+        .update(`${provider}:${timestamp ?? ''}:${signature}`)
+        .digest('hex');
+}
+/**
+ * High-performance in-memory bucketed ring buffer for intra-window webhook deduplication.
+ * Eliminates per-key eviction sweeps by grouping keys into sliding time buckets with O(1) pruning.
+ */
+class InMemoryNonceStore {
+    buckets = [];
+    allKeys = new Set();
+    bucketDurationMs;
+    constructor(bucketDurationSeconds = 60) {
+        this.bucketDurationMs = bucketDurationSeconds * 1000;
+    }
+    pruneExpired(now) {
+        while (this.buckets.length > 0 && this.buckets[0].expiresAt <= now) {
+            const expired = this.buckets.shift();
+            for (const k of expired.keys) {
+                this.allKeys.delete(k);
+            }
+        }
+    }
+    /**
+     * Atomically checks and records a nonce/signature key.
+     * Returns true if successfully claimed (first time seen), or false if already seen within TTL.
+     */
+    claim(key, ttlSeconds) {
+        const now = Date.now();
+        this.pruneExpired(now);
+        if (this.allKeys.has(key)) {
+            return false; // Duplicate / replay within TTL
+        }
+        const expiresAt = now + ttlSeconds * 1000;
+        this.allKeys.add(key);
+        // Find bucket within duration window or insert a new one
+        let bucket = this.buckets.find(b => Math.abs(b.expiresAt - expiresAt) < this.bucketDurationMs);
+        if (!bucket) {
+            bucket = { expiresAt, keys: new Set() };
+            this.buckets.push(bucket);
+            this.buckets.sort((a, b) => a.expiresAt - b.expiresAt);
+        }
+        bucket.keys.add(key);
+        return true;
+    }
+    clear() {
+        this.buckets = [];
+        this.allKeys.clear();
+    }
+    get size() {
+        this.pruneExpired(Date.now());
+        return this.allKeys.size;
+    }
+}
+exports.InMemoryNonceStore = InMemoryNonceStore;
+//# sourceMappingURL=dedup.js.map

package/dist/webhooks/dedup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dedup.js","sourceRoot":"","sources":["../../src/webhooks/dedup.ts"],"names":[],"mappings":";;;;;;AAMA,wCASC;AAfD,8DAAiC;AAGjC;;GAEG;AACH,SAAgB,cAAc,CAC5B,QAAgB,EAChB,SAAiB,EACjB,SAAkB;IAElB,OAAO,qBAAM;SACV,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,GAAG,QAAQ,IAAI,SAAS,IAAI,EAAE,IAAI,SAAS,EAAE,CAAC;SACrD,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAOD;;;GAGG;AACH,MAAa,kBAAkB;IACrB,OAAO,GAAa,EAAE,CAAC;IACvB,OAAO,GAAgB,IAAI,GAAG,EAAE,CAAC;IACjC,gBAAgB,CAAS;IAEjC,YAAY,wBAAgC,EAAE;QAC5C,IAAI,CAAC,gBAAgB,GAAG,qBAAqB,GAAG,IAAI,CAAC;IACvD,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;YACnE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAG,CAAC;YACtC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAW,EAAE,UAAkB;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAEvB,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,CAAC,gCAAgC;QAChD,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,GAAG,UAAU,GAAG,IAAI,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEtB,yDAAyD;QACzD,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC/F,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAErB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,IAAI,IAAI;QACN,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;CACF;AAtDD,gDAsDC"}

package/dist/webhooks/protocols/base.d.ts

@@ -0,0 +1,15 @@
+import { WebhookProtocol, WebhookProtocolVerificationParams, ParsedWebhookHeaders } from '../../types';
+export { WebhookProtocol, WebhookProtocolVerificationParams, ParsedWebhookHeaders };
+/**
+ * Normalizes headers record by converting all keys to lowercase.
+ */
+export declare function normalizeHeaders(headers?: Record<string, string | string[] | undefined>): Record<string, string>;
+/**
+ * Asserts whether a timestamp is within the allowed clock drift tolerance.
+ */
+export declare function isTimestampValid(timestamp: number | undefined, toleranceSeconds?: number, nowSeconds?: number): boolean;
+/**
+ * Extracts payload as UTF-8 string.
+ */
+export declare function payloadToString(payload: string | Buffer): string;
+//# sourceMappingURL=base.d.ts.map

package/dist/webhooks/protocols/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../src/webhooks/protocols/base.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,iCAAiC,EACjC,oBAAoB,EACrB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,eAAe,EACf,iCAAiC,EACjC,oBAAoB,EACrB,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAM,GAC1D,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQxB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,gBAAgB,GAAE,MAAY,EAC9B,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAaT;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAKhE"}

package/dist/webhooks/protocols/base.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeHeaders = normalizeHeaders;
+exports.isTimestampValid = isTimestampValid;
+exports.payloadToString = payloadToString;
+/**
+ * Normalizes headers record by converting all keys to lowercase.
+ */
+function normalizeHeaders(headers = {}) {
+    const normalized = {};
+    for (const [key, val] of Object.entries(headers)) {
+        if (val !== undefined && val !== null) {
+            normalized[key.toLowerCase()] = Array.isArray(val) ? val.join(',') : String(val);
+        }
+    }
+    return normalized;
+}
+/**
+ * Asserts whether a timestamp is within the allowed clock drift tolerance.
+ */
+function isTimestampValid(timestamp, toleranceSeconds = 300, nowSeconds) {
+    if (timestamp === undefined || Number.isNaN(timestamp) || toleranceSeconds <= 0) {
+        return true;
+    }
+    // Normalize millisecond timestamp to seconds if needed
+    let ts = timestamp;
+    if (ts > 1e11) {
+        ts = Math.floor(ts / 1000);
+    }
+    const now = nowSeconds !== undefined ? nowSeconds : Math.floor(Date.now() / 1000);
+    return Math.abs(now - ts) <= toleranceSeconds;
+}
+/**
+ * Extracts payload as UTF-8 string.
+ */
+function payloadToString(payload) {
+    if (typeof payload === 'string') {
+        return payload;
+    }
+    return payload.toString('utf8');
+}
+//# sourceMappingURL=base.js.map

package/dist/webhooks/protocols/base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/webhooks/protocols/base.ts"],"names":[],"mappings":";;AAeA,4CAUC;AAKD,4CAiBC;AAKD,0CAKC;AA7CD;;GAEG;AACH,SAAgB,gBAAgB,CAC9B,UAAyD,EAAE;IAE3D,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACtC,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAC9B,SAA6B,EAC7B,mBAA2B,GAAG,EAC9B,UAAmB;IAEnB,IAAI,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uDAAuD;IACvD,IAAI,EAAE,GAAG,SAAS,CAAC;IACnB,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;QACd,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,gBAAgB,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,OAAwB;IACtD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC"}

package/dist/webhooks/protocols/generic-hmac.d.ts

@@ -0,0 +1,16 @@
+import { WebhookProtocol, WebhookProtocolVerificationParams, ParsedWebhookHeaders } from '../../types';
+export interface GenericHmacProtocolOptions {
+    algorithm?: 'sha256' | 'sha512' | 'sha1';
+    encoding?: 'hex' | 'base64';
+}
+export declare class GenericHmacWebhookProtocol implements WebhookProtocol {
+    readonly name = "generic-hmac";
+    private defaultAlgorithm;
+    private defaultEncoding?;
+    constructor(options?: GenericHmacProtocolOptions);
+    parseHeaders(headers?: Record<string, string | string[] | undefined>, signatureHeader?: string): ParsedWebhookHeaders;
+    formatSignedPayload(rawBody: string | Buffer, timestamp?: number): string | Buffer;
+    verify({ secret, rawPayload, headers, signatureHeader, toleranceSeconds, clock, algorithm: paramAlgorithm }: WebhookProtocolVerificationParams): boolean;
+}
+export declare const genericHmacProtocol: GenericHmacWebhookProtocol;
+//# sourceMappingURL=generic-hmac.d.ts.map

package/dist/webhooks/protocols/generic-hmac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic-hmac.d.ts","sourceRoot":"","sources":["../../../src/webhooks/protocols/generic-hmac.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,iCAAiC,EACjC,oBAAoB,EACrB,MAAM,aAAa,CAAC;AAIrB,MAAM,WAAW,0BAA0B;IACzC,SAAS,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IACzC,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;CAC7B;AAED,qBAAa,0BAA2B,YAAW,eAAe;IAChE,QAAQ,CAAC,IAAI,kBAAkB;IAC/B,OAAO,CAAC,gBAAgB,CAA+B;IACvD,OAAO,CAAC,eAAe,CAAC,CAAmB;gBAE/B,OAAO,GAAE,0BAA+B;IAKpD,YAAY,CACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAM,EAC3D,eAAe,GAAE,MAAW,GAC3B,oBAAoB;IAmBvB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM;IAOlF,MAAM,CAAC,EACL,MAAM,EACN,UAAU,EACV,OAAO,EACP,eAAe,EACf,gBAAsB,EACtB,KAAK,EACL,SAAS,EAAE,cAAc,EAC1B,EAAE,iCAAiC,GAAG,OAAO;CAkC/C;AAED,eAAO,MAAM,mBAAmB,4BAAmC,CAAC"}

package/dist/webhooks/protocols/generic-hmac.js

@@ -0,0 +1,68 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.genericHmacProtocol = exports.GenericHmacWebhookProtocol = void 0;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const timing_1 = require("../timing");
+const base_1 = require("./base");
+class GenericHmacWebhookProtocol {
+    name = 'generic-hmac';
+    defaultAlgorithm;
+    defaultEncoding;
+    constructor(options = {}) {
+        this.defaultAlgorithm = options.algorithm || 'sha256';
+        this.defaultEncoding = options.encoding;
+    }
+    parseHeaders(headers = {}, signatureHeader = '') {
+        const normalized = (0, base_1.normalizeHeaders)(headers);
+        const signature = (signatureHeader ||
+            normalized['x-signature'] ||
+            normalized['signature'] ||
+            normalized['x-hub-signature-256'] ||
+            '').trim();
+        const rawTimestamp = normalized['x-timestamp'] || normalized['timestamp'];
+        const timestamp = rawTimestamp ? Number(rawTimestamp) : undefined;
+        return {
+            timestamp: !Number.isNaN(timestamp) ? timestamp : undefined,
+            signatures: signature ? [signature] : []
+        };
+    }
+    formatSignedPayload(rawBody, timestamp) {
+        if (timestamp !== undefined) {
+            return `${timestamp}.${(0, base_1.payloadToString)(rawBody)}`;
+        }
+        return rawBody;
+    }
+    verify({ secret, rawPayload, headers, signatureHeader, toleranceSeconds = 300, clock, algorithm: paramAlgorithm }) {
+        const parsed = this.parseHeaders(headers, signatureHeader);
+        if (parsed.signatures.length === 0) {
+            return false;
+        }
+        if (parsed.timestamp !== undefined) {
+            const nowSec = clock ? Math.floor(clock.now() / 1000) : Math.floor(Date.now() / 1000);
+            if (!(0, base_1.isTimestampValid)(parsed.timestamp, toleranceSeconds, nowSec)) {
+                return false;
+            }
+        }
+        const algorithm = paramAlgorithm || headers?.$algorithm || this.defaultAlgorithm;
+        const signedPayload = this.formatSignedPayload(rawPayload, parsed.timestamp);
+        const expectedHex = node_crypto_1.default.createHmac(algorithm, secret).update(signedPayload).digest('hex');
+        const expectedBase64 = node_crypto_1.default.createHmac(algorithm, secret).update(signedPayload).digest('base64');
+        return parsed.signatures.some(sig => {
+            if (this.defaultEncoding === 'base64') {
+                return (0, timing_1.timingSafeCompare)(expectedBase64, sig, 'base64');
+            }
+            if (this.defaultEncoding === 'hex') {
+                return (0, timing_1.timingSafeCompare)(expectedHex, sig, 'hex');
+            }
+            // Auto-detect hex vs base64
+            return ((0, timing_1.timingSafeCompare)(expectedHex, sig, 'hex') ||
+                (0, timing_1.timingSafeCompare)(expectedBase64, sig, 'base64'));
+        });
+    }
+}
+exports.GenericHmacWebhookProtocol = GenericHmacWebhookProtocol;
+exports.genericHmacProtocol = new GenericHmacWebhookProtocol();
+//# sourceMappingURL=generic-hmac.js.map

package/dist/webhooks/protocols/generic-hmac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic-hmac.js","sourceRoot":"","sources":["../../../src/webhooks/protocols/generic-hmac.ts"],"names":[],"mappings":";;;;;;AAAA,8DAAiC;AAMjC,sCAA8C;AAC9C,iCAA6E;AAO7E,MAAa,0BAA0B;IAC5B,IAAI,GAAG,cAAc,CAAC;IACvB,gBAAgB,CAA+B;IAC/C,eAAe,CAAoB;IAE3C,YAAY,UAAsC,EAAE;QAClD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;QACtD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC1C,CAAC;IAED,YAAY,CACV,UAAyD,EAAE,EAC3D,kBAA0B,EAAE;QAE5B,MAAM,UAAU,GAAG,IAAA,uBAAgB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,CAChB,eAAe;YACf,UAAU,CAAC,aAAa,CAAC;YACzB,UAAU,CAAC,WAAW,CAAC;YACvB,UAAU,CAAC,qBAAqB,CAAC;YACjC,EAAE,CACH,CAAC,IAAI,EAAE,CAAC;QAET,MAAM,YAAY,GAAG,UAAU,CAAC,aAAa,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAElE,OAAO;YACL,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YAC3D,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE;SACzC,CAAC;IACJ,CAAC;IAED,mBAAmB,CAAC,OAAwB,EAAE,SAAkB;QAC9D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,GAAG,SAAS,IAAI,IAAA,sBAAe,EAAC,OAAO,CAAC,EAAE,CAAC;QACpD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,CAAC,EACL,MAAM,EACN,UAAU,EACV,OAAO,EACP,eAAe,EACf,gBAAgB,GAAG,GAAG,EACtB,KAAK,EACL,SAAS,EAAE,cAAc,EACS;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAE3D,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YACtF,IAAI,CAAC,IAAA,uBAAgB,EAAC,MAAM,CAAC,SAAS,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,CAAC;gBAClE,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,cAAc,IAAK,OAAe,EAAE,UAAU,IAAI,IAAI,CAAC,gBAAgB,CAAC;QAC1F,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAE7E,MAAM,WAAW,GAAG,qBAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7F,MAAM,cAAc,GAAG,qBAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEnG,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YAClC,IAAI,IAAI,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;gBACtC,OAAO,IAAA,0BAAiB,EAAC,cAAc,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,IAAI,CAAC,eAAe,KAAK,KAAK,EAAE,CAAC;gBACnC,OAAO,IAAA,0BAAiB,EAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACpD,CAAC;YACD,4BAA4B;YAC5B,OAAO,CACL,IAAA,0BAAiB,EAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC;gBAC1C,IAAA,0BAAiB,EAAC,cAAc,EAAE,GAAG,EAAE,QAAQ,CAAC,CACjD,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAjFD,gEAiFC;AAEY,QAAA,mBAAmB,GAAG,IAAI,0BAA0B,EAAE,CAAC"}

package/dist/webhooks/protocols/github.d.ts

@@ -0,0 +1,9 @@
+import { WebhookProtocol, WebhookProtocolVerificationParams, ParsedWebhookHeaders } from '../../types';
+export declare class GitHubWebhookProtocol implements WebhookProtocol {
+    readonly name = "github";
+    parseHeaders(headers?: Record<string, string | string[] | undefined>, signatureHeader?: string): ParsedWebhookHeaders;
+    formatSignedPayload(rawBody: string | Buffer): string | Buffer;
+    verify({ secret, rawPayload, headers, signatureHeader }: WebhookProtocolVerificationParams): boolean;
+}
+export declare const gitHubProtocol: GitHubWebhookProtocol;
+//# sourceMappingURL=github.d.ts.map

package/dist/webhooks/protocols/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../../src/webhooks/protocols/github.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,iCAAiC,EACjC,oBAAoB,EACrB,MAAM,aAAa,CAAC;AAIrB,qBAAa,qBAAsB,YAAW,eAAe;IAC3D,QAAQ,CAAC,IAAI,YAAY;IAEzB,YAAY,CACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAM,EAC3D,eAAe,GAAE,MAAW,GAC3B,oBAAoB;IAwBvB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM;IAI9D,MAAM,CAAC,EACL,MAAM,EACN,UAAU,EACV,OAAO,EACP,eAAe,EAChB,EAAE,iCAAiC,GAAG,OAAO;CAa/C;AAED,eAAO,MAAM,cAAc,uBAA8B,CAAC"}

package/dist/webhooks/protocols/github.js

@@ -0,0 +1,49 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gitHubProtocol = exports.GitHubWebhookProtocol = void 0;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const timing_1 = require("../timing");
+const base_1 = require("./base");
+class GitHubWebhookProtocol {
+    name = 'github';
+    parseHeaders(headers = {}, signatureHeader = '') {
+        const normalized = (0, base_1.normalizeHeaders)(headers);
+        const rawHeader = signatureHeader ||
+            normalized['x-hub-signature-256'] ||
+            normalized['x-hub-signature'] ||
+            '';
+        let version = 'sha256';
+        let signature = rawHeader.trim();
+        if (signature.startsWith('sha256=')) {
+            version = 'sha256';
+            signature = signature.slice(7);
+        }
+        else if (signature.startsWith('sha1=')) {
+            version = 'sha1';
+            signature = signature.slice(5);
+        }
+        return {
+            signatures: signature ? [signature] : [],
+            version
+        };
+    }
+    formatSignedPayload(rawBody) {
+        return rawBody;
+    }
+    verify({ secret, rawPayload, headers, signatureHeader }) {
+        const parsed = this.parseHeaders(headers, signatureHeader);
+        if (parsed.signatures.length === 0) {
+            return false;
+        }
+        const algorithm = parsed.version === 'sha1' ? 'sha1' : 'sha256';
+        const payload = this.formatSignedPayload(rawPayload);
+        const expected = node_crypto_1.default.createHmac(algorithm, secret).update(payload).digest('hex');
+        return parsed.signatures.some(sig => (0, timing_1.timingSafeCompare)(expected, sig, 'hex'));
+    }
+}
+exports.GitHubWebhookProtocol = GitHubWebhookProtocol;
+exports.gitHubProtocol = new GitHubWebhookProtocol();
+//# sourceMappingURL=github.js.map

package/dist/webhooks/protocols/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../src/webhooks/protocols/github.ts"],"names":[],"mappings":";;;;;;AAAA,8DAAiC;AAMjC,sCAA8C;AAC9C,iCAA0C;AAE1C,MAAa,qBAAqB;IACvB,IAAI,GAAG,QAAQ,CAAC;IAEzB,YAAY,CACV,UAAyD,EAAE,EAC3D,kBAA0B,EAAE;QAE5B,MAAM,UAAU,GAAG,IAAA,uBAAgB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,eAAe;YAC/B,UAAU,CAAC,qBAAqB,CAAC;YACjC,UAAU,CAAC,iBAAiB,CAAC;YAC7B,EAAE,CAAC;QAEL,IAAI,OAAO,GAAG,QAAQ,CAAC;QACvB,IAAI,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;QAEjC,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACpC,OAAO,GAAG,QAAQ,CAAC;YACnB,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,OAAO,GAAG,MAAM,CAAC;YACjB,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;QAED,OAAO;YACL,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE;YACxC,OAAO;SACR,CAAC;IACJ,CAAC;IAED,mBAAmB,CAAC,OAAwB;QAC1C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,CAAC,EACL,MAAM,EACN,UAAU,EACV,OAAO,EACP,eAAe,EACmB;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAE3D,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,qBAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEpF,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAA,0BAAiB,EAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAChF,CAAC;CACF;AApDD,sDAoDC;AAEY,QAAA,cAAc,GAAG,IAAI,qBAAqB,EAAE,CAAC"}

package/dist/webhooks/protocols/shopify.d.ts

@@ -0,0 +1,9 @@
+import { WebhookProtocol, WebhookProtocolVerificationParams, ParsedWebhookHeaders } from '../../types';
+export declare class ShopifyWebhookProtocol implements WebhookProtocol {
+    readonly name = "shopify";
+    parseHeaders(headers?: Record<string, string | string[] | undefined>, signatureHeader?: string): ParsedWebhookHeaders;
+    formatSignedPayload(rawBody: string | Buffer): string | Buffer;
+    verify({ secret, rawPayload, headers, signatureHeader }: WebhookProtocolVerificationParams): boolean;
+}
+export declare const shopifyProtocol: ShopifyWebhookProtocol;
+//# sourceMappingURL=shopify.d.ts.map

package/dist/webhooks/protocols/shopify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shopify.d.ts","sourceRoot":"","sources":["../../../src/webhooks/protocols/shopify.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,iCAAiC,EACjC,oBAAoB,EACrB,MAAM,aAAa,CAAC;AAIrB,qBAAa,sBAAuB,YAAW,eAAe;IAC5D,QAAQ,CAAC,IAAI,aAAa;IAE1B,YAAY,CACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAM,EAC3D,eAAe,GAAE,MAAW,GAC3B,oBAAoB;IAcvB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM;IAI9D,MAAM,CAAC,EACL,MAAM,EACN,UAAU,EACV,OAAO,EACP,eAAe,EAChB,EAAE,iCAAiC,GAAG,OAAO;CAY/C;AAED,eAAO,MAAM,eAAe,wBAA+B,CAAC"}

package/dist/webhooks/protocols/shopify.js

@@ -0,0 +1,37 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.shopifyProtocol = exports.ShopifyWebhookProtocol = void 0;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const timing_1 = require("../timing");
+const base_1 = require("./base");
+class ShopifyWebhookProtocol {
+    name = 'shopify';
+    parseHeaders(headers = {}, signatureHeader = '') {
+        const normalized = (0, base_1.normalizeHeaders)(headers);
+        const signature = (signatureHeader ||
+            normalized['x-shopify-hmac-sha256'] ||
+            '').trim();
+        return {
+            signatures: signature ? [signature] : [],
+            version: 'sha256'
+        };
+    }
+    formatSignedPayload(rawBody) {
+        return rawBody;
+    }
+    verify({ secret, rawPayload, headers, signatureHeader }) {
+        const parsed = this.parseHeaders(headers, signatureHeader);
+        if (parsed.signatures.length === 0) {
+            return false;
+        }
+        const payload = this.formatSignedPayload(rawPayload);
+        const expected = node_crypto_1.default.createHmac('sha256', secret).update(payload).digest('base64');
+        return parsed.signatures.some(sig => (0, timing_1.timingSafeCompare)(expected, sig, 'base64'));
+    }
+}
+exports.ShopifyWebhookProtocol = ShopifyWebhookProtocol;
+exports.shopifyProtocol = new ShopifyWebhookProtocol();
+//# sourceMappingURL=shopify.js.map

package/dist/webhooks/protocols/shopify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shopify.js","sourceRoot":"","sources":["../../../src/webhooks/protocols/shopify.ts"],"names":[],"mappings":";;;;;;AAAA,8DAAiC;AAMjC,sCAA8C;AAC9C,iCAA0C;AAE1C,MAAa,sBAAsB;IACxB,IAAI,GAAG,SAAS,CAAC;IAE1B,YAAY,CACV,UAAyD,EAAE,EAC3D,kBAA0B,EAAE;QAE5B,MAAM,UAAU,GAAG,IAAA,uBAAgB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,CAChB,eAAe;YACf,UAAU,CAAC,uBAAuB,CAAC;YACnC,EAAE,CACH,CAAC,IAAI,EAAE,CAAC;QAET,OAAO;YACL,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE;YACxC,OAAO,EAAE,QAAQ;SAClB,CAAC;IACJ,CAAC;IAED,mBAAmB,CAAC,OAAwB;QAC1C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,CAAC,EACL,MAAM,EACN,UAAU,EACV,OAAO,EACP,eAAe,EACmB;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAE3D,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,qBAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEtF,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAA,0BAAiB,EAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnF,CAAC;CACF;AAzCD,wDAyCC;AAEY,QAAA,eAAe,GAAG,IAAI,sBAAsB,EAAE,CAAC"}

package/dist/webhooks/protocols/slack.d.ts

@@ -0,0 +1,9 @@
+import { WebhookProtocol, WebhookProtocolVerificationParams, ParsedWebhookHeaders } from '../../types';
+export declare class SlackWebhookProtocol implements WebhookProtocol {
+    readonly name = "slack";
+    parseHeaders(headers?: Record<string, string | string[] | undefined>, signatureHeader?: string): ParsedWebhookHeaders;
+    formatSignedPayload(rawBody: string | Buffer, timestamp?: number): string;
+    verify({ secret, rawPayload, headers, signatureHeader, toleranceSeconds, clock }: WebhookProtocolVerificationParams): boolean;
+}
+export declare const slackProtocol: SlackWebhookProtocol;
+//# sourceMappingURL=slack.d.ts.map

package/dist/webhooks/protocols/slack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack.d.ts","sourceRoot":"","sources":["../../../src/webhooks/protocols/slack.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,iCAAiC,EACjC,oBAAoB,EACrB,MAAM,aAAa,CAAC;AAIrB,qBAAa,oBAAqB,YAAW,eAAe;IAC1D,QAAQ,CAAC,IAAI,WAAW;IAExB,YAAY,CACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAM,EAC3D,eAAe,GAAE,MAAW,GAC3B,oBAAoB;IAkBvB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM;IAKzE,MAAM,CAAC,EACL,MAAM,EACN,UAAU,EACV,OAAO,EACP,eAAe,EACf,gBAAsB,EACtB,KAAK,EACN,EAAE,iCAAiC,GAAG,OAAO;CAwB/C;AAED,eAAO,MAAM,aAAa,sBAA6B,CAAC"}

package/dist/webhooks/protocols/slack.js

@@ -0,0 +1,52 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.slackProtocol = exports.SlackWebhookProtocol = void 0;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const timing_1 = require("../timing");
+const base_1 = require("./base");
+class SlackWebhookProtocol {
+    name = 'slack';
+    parseHeaders(headers = {}, signatureHeader = '') {
+        const normalized = (0, base_1.normalizeHeaders)(headers);
+        const rawSignature = (signatureHeader ||
+            normalized['x-slack-signature'] ||
+            '').trim();
+        const rawTimestamp = normalized['x-slack-request-timestamp'];
+        const timestamp = rawTimestamp ? Number(rawTimestamp) : undefined;
+        return {
+            timestamp: !Number.isNaN(timestamp) ? timestamp : undefined,
+            signatures: rawSignature ? [rawSignature] : [],
+            version: 'v0'
+        };
+    }
+    formatSignedPayload(rawBody, timestamp) {
+        const bodyStr = (0, base_1.payloadToString)(rawBody);
+        return `v0:${timestamp !== undefined ? timestamp : ''}:${bodyStr}`;
+    }
+    verify({ secret, rawPayload, headers, signatureHeader, toleranceSeconds = 300, clock }) {
+        const parsed = this.parseHeaders(headers, signatureHeader);
+        if (parsed.timestamp === undefined || parsed.signatures.length === 0) {
+            return false;
+        }
+        const nowSec = clock ? Math.floor(clock.now() / 1000) : Math.floor(Date.now() / 1000);
+        if (!(0, base_1.isTimestampValid)(parsed.timestamp, toleranceSeconds, nowSec)) {
+            return false;
+        }
+        const signedPayload = this.formatSignedPayload(rawPayload, parsed.timestamp);
+        const hmacHex = node_crypto_1.default.createHmac('sha256', secret).update(signedPayload).digest('hex');
+        const expected = `v0=${hmacHex}`;
+        return parsed.signatures.some(sig => {
+            // Compare both with v0= prefix or without
+            if (sig.startsWith('v0=')) {
+                return (0, timing_1.timingSafeCompare)(expected, sig, 'utf8');
+            }
+            return (0, timing_1.timingSafeCompare)(hmacHex, sig, 'hex');
+        });
+    }
+}
+exports.SlackWebhookProtocol = SlackWebhookProtocol;
+exports.slackProtocol = new SlackWebhookProtocol();
+//# sourceMappingURL=slack.js.map

package/dist/webhooks/protocols/slack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack.js","sourceRoot":"","sources":["../../../src/webhooks/protocols/slack.ts"],"names":[],"mappings":";;;;;;AAAA,8DAAiC;AAMjC,sCAA8C;AAC9C,iCAA6E;AAE7E,MAAa,oBAAoB;IACtB,IAAI,GAAG,OAAO,CAAC;IAExB,YAAY,CACV,UAAyD,EAAE,EAC3D,kBAA0B,EAAE;QAE5B,MAAM,UAAU,GAAG,IAAA,uBAAgB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,YAAY,GAAG,CACnB,eAAe;YACf,UAAU,CAAC,mBAAmB,CAAC;YAC/B,EAAE,CACH,CAAC,IAAI,EAAE,CAAC;QAET,MAAM,YAAY,GAAG,UAAU,CAAC,2BAA2B,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAElE,OAAO;YACL,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YAC3D,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE;YAC9C,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,mBAAmB,CAAC,OAAwB,EAAE,SAAkB;QAC9D,MAAM,OAAO,GAAG,IAAA,sBAAe,EAAC,OAAO,CAAC,CAAC;QACzC,OAAO,MAAM,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,EAAE,CAAC;IACrE,CAAC;IAED,MAAM,CAAC,EACL,MAAM,EACN,UAAU,EACV,OAAO,EACP,eAAe,EACf,gBAAgB,GAAG,GAAG,EACtB,KAAK,EAC6B;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAE3D,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACtF,IAAI,CAAC,IAAA,uBAAgB,EAAC,MAAM,CAAC,SAAS,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,CAAC;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,qBAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxF,MAAM,QAAQ,GAAG,MAAM,OAAO,EAAE,CAAC;QAEjC,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YAClC,0CAA0C;YAC1C,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,IAAA,0BAAiB,EAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAClD,CAAC;YACD,OAAO,IAAA,0BAAiB,EAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AA5DD,oDA4DC;AAEY,QAAA,aAAa,GAAG,IAAI,oBAAoB,EAAE,CAAC"}

package/dist/webhooks/protocols/stripe.d.ts

@@ -0,0 +1,9 @@
+import { WebhookProtocol, WebhookProtocolVerificationParams, ParsedWebhookHeaders } from '../../types';
+export declare class StripeWebhookProtocol implements WebhookProtocol {
+    readonly name = "stripe";
+    parseHeaders(headers?: Record<string, string | string[] | undefined>, signatureHeader?: string): ParsedWebhookHeaders;
+    formatSignedPayload(rawBody: string | Buffer, timestamp?: number): string;
+    verify({ secret, rawPayload, headers, signatureHeader, toleranceSeconds, clock }: WebhookProtocolVerificationParams): boolean;
+}
+export declare const stripeProtocol: StripeWebhookProtocol;
+//# sourceMappingURL=stripe.d.ts.map

package/dist/webhooks/protocols/stripe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stripe.d.ts","sourceRoot":"","sources":["../../../src/webhooks/protocols/stripe.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,iCAAiC,EACjC,oBAAoB,EACrB,MAAM,aAAa,CAAC;AAIrB,qBAAa,qBAAsB,YAAW,eAAe;IAC3D,QAAQ,CAAC,IAAI,YAAY;IAEzB,YAAY,CACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAM,EAC3D,eAAe,GAAE,MAAW,GAC3B,oBAAoB;IA2BvB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM;IAKzE,MAAM,CAAC,EACL,MAAM,EACN,UAAU,EACV,OAAO,EACP,eAAe,EACf,gBAAsB,EACtB,KAAK,EACN,EAAE,iCAAiC,GAAG,OAAO;CAiB/C;AAED,eAAO,MAAM,cAAc,uBAA8B,CAAC"}

package/dist/webhooks/protocols/stripe.js

@@ -0,0 +1,56 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stripeProtocol = exports.StripeWebhookProtocol = void 0;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const timing_1 = require("../timing");
+const base_1 = require("./base");
+class StripeWebhookProtocol {
+    name = 'stripe';
+    parseHeaders(headers = {}, signatureHeader = '') {
+        const normalized = (0, base_1.normalizeHeaders)(headers);
+        const rawHeader = signatureHeader || normalized['stripe-signature'] || '';
+        let timestamp;
+        const signatures = [];
+        const elements = rawHeader.split(',');
+        for (const element of elements) {
+            const [key, value] = element.trim().split('=');
+            if (key === 't') {
+                const num = Number(value);
+                if (!Number.isNaN(num)) {
+                    timestamp = num;
+                }
+            }
+            else if (key === 'v1' && value) {
+                signatures.push(value);
+            }
+        }
+        return {
+            timestamp,
+            signatures,
+            version: 'v1'
+        };
+    }
+    formatSignedPayload(rawBody, timestamp) {
+        const bodyStr = (0, base_1.payloadToString)(rawBody);
+        return timestamp !== undefined ? `${timestamp}.${bodyStr}` : bodyStr;
+    }
+    verify({ secret, rawPayload, headers, signatureHeader, toleranceSeconds = 300, clock }) {
+        const parsed = this.parseHeaders(headers, signatureHeader);
+        if (parsed.timestamp === undefined || parsed.signatures.length === 0) {
+            return false;
+        }
+        const nowSec = clock ? Math.floor(clock.now() / 1000) : Math.floor(Date.now() / 1000);
+        if (!(0, base_1.isTimestampValid)(parsed.timestamp, toleranceSeconds, nowSec)) {
+            return false;
+        }
+        const signedPayload = this.formatSignedPayload(rawPayload, parsed.timestamp);
+        const expected = node_crypto_1.default.createHmac('sha256', secret).update(signedPayload).digest('hex');
+        return parsed.signatures.some(sig => (0, timing_1.timingSafeCompare)(expected, sig, 'hex'));
+    }
+}
+exports.StripeWebhookProtocol = StripeWebhookProtocol;
+exports.stripeProtocol = new StripeWebhookProtocol();
+//# sourceMappingURL=stripe.js.map

package/dist/webhooks/protocols/stripe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stripe.js","sourceRoot":"","sources":["../../../src/webhooks/protocols/stripe.ts"],"names":[],"mappings":";;;;;;AAAA,8DAAiC;AAMjC,sCAA8C;AAC9C,iCAA6E;AAE7E,MAAa,qBAAqB;IACvB,IAAI,GAAG,QAAQ,CAAC;IAEzB,YAAY,CACV,UAAyD,EAAE,EAC3D,kBAA0B,EAAE;QAE5B,MAAM,UAAU,GAAG,IAAA,uBAAgB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,eAAe,IAAI,UAAU,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAE1E,IAAI,SAA6B,CAAC;QAClC,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;gBAChB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;oBACvB,SAAS,GAAG,GAAG,CAAC;gBAClB,CAAC;YACH,CAAC;iBAAM,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,EAAE,CAAC;gBACjC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,OAAO;YACL,SAAS;YACT,UAAU;YACV,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,mBAAmB,CAAC,OAAwB,EAAE,SAAkB;QAC9D,MAAM,OAAO,GAAG,IAAA,sBAAe,EAAC,OAAO,CAAC,CAAC;QACzC,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACvE,CAAC;IAED,MAAM,CAAC,EACL,MAAM,EACN,UAAU,EACV,OAAO,EACP,eAAe,EACf,gBAAgB,GAAG,GAAG,EACtB,KAAK,EAC6B;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAE3D,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACtF,IAAI,CAAC,IAAA,uBAAgB,EAAC,MAAM,CAAC,SAAS,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,CAAC;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7E,MAAM,QAAQ,GAAG,qBAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEzF,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAA,0BAAiB,EAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAChF,CAAC;CACF;AA9DD,sDA8DC;AAEY,QAAA,cAAc,GAAG,IAAI,qBAAqB,EAAE,CAAC"}

package/dist/webhooks/protocols/svix.d.ts

@@ -0,0 +1,9 @@
+import { WebhookProtocol, WebhookProtocolVerificationParams, ParsedWebhookHeaders } from '../../types';
+export declare class SvixWebhookProtocol implements WebhookProtocol {
+    readonly name = "svix";
+    parseHeaders(headers?: Record<string, string | string[] | undefined>, signatureHeader?: string): ParsedWebhookHeaders;
+    formatSignedPayload(rawBody: string | Buffer, timestamp?: number, svixId?: string): string;
+    verify({ secret, rawPayload, headers, signatureHeader, toleranceSeconds, clock }: WebhookProtocolVerificationParams): boolean;
+}
+export declare const svixProtocol: SvixWebhookProtocol;
+//# sourceMappingURL=svix.d.ts.map

package/dist/webhooks/protocols/svix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"svix.d.ts","sourceRoot":"","sources":["../../../src/webhooks/protocols/svix.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,iCAAiC,EACjC,oBAAoB,EACrB,MAAM,aAAa,CAAC;AAIrB,qBAAa,mBAAoB,YAAW,eAAe;IACzD,QAAQ,CAAC,IAAI,UAAU;IAEvB,YAAY,CACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAM,EAC3D,eAAe,GAAE,MAAW,GAC3B,oBAAoB;IA6BvB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM;IAK1F,MAAM,CAAC,EACL,MAAM,EACN,UAAU,EACV,OAAO,EACP,eAAe,EACf,gBAAsB,EACtB,KAAK,EACN,EAAE,iCAAiC,GAAG,OAAO;CA2C/C;AAED,eAAO,MAAM,YAAY,qBAA4B,CAAC"}