@siglo/crypto 0.0.0-stage → 1.0.1

package/dist/webhooks/protocols/svix.js

@@ -0,0 +1,85 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.svixProtocol = exports.SvixWebhookProtocol = void 0;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const timing_1 = require("../timing");
+const base_1 = require("./base");
+class SvixWebhookProtocol {
+    name = 'svix';
+    parseHeaders(headers = {}, signatureHeader = '') {
+        const normalized = (0, base_1.normalizeHeaders)(headers);
+        const rawHeader = signatureHeader ||
+            normalized['svix-signature'] ||
+            normalized['webhook-signature'] ||
+            '';
+        const rawTimestamp = normalized['svix-timestamp'] || normalized['webhook-timestamp'];
+        const timestamp = rawTimestamp ? Number(rawTimestamp) : undefined;
+        const signatures = [];
+        const parts = rawHeader.trim().split(/\s+/);
+        for (const part of parts) {
+            if (part.startsWith('v1,')) {
+                signatures.push(part.slice(3));
+            }
+            else if (part.startsWith('v1=')) {
+                signatures.push(part.slice(3));
+            }
+            else if (part) {
+                signatures.push(part);
+            }
+        }
+        return {
+            timestamp: !Number.isNaN(timestamp) ? timestamp : undefined,
+            signatures,
+            version: 'v1'
+        };
+    }
+    formatSignedPayload(rawBody, timestamp, svixId) {
+        const bodyStr = (0, base_1.payloadToString)(rawBody);
+        return `${svixId || ''}.${timestamp !== undefined ? timestamp : ''}.${bodyStr}`;
+    }
+    verify({ secret, rawPayload, headers, signatureHeader, toleranceSeconds = 300, clock }) {
+        const normalized = (0, base_1.normalizeHeaders)(headers);
+        const parsed = this.parseHeaders(headers, signatureHeader);
+        if (parsed.timestamp === undefined || parsed.signatures.length === 0) {
+            return false;
+        }
+        const nowSec = clock ? Math.floor(clock.now() / 1000) : Math.floor(Date.now() / 1000);
+        if (!(0, base_1.isTimestampValid)(parsed.timestamp, toleranceSeconds, nowSec)) {
+            return false;
+        }
+        const svixId = normalized['svix-id'] || normalized['webhook-id'] || '';
+        const toSign = `${svixId}.${parsed.timestamp}.${(0, base_1.payloadToString)(rawPayload)}`;
+        // Asymmetric Public Key (Ed25519 or RSA) check
+        const secretStr = typeof secret === 'string' ? secret : '';
+        if (secretStr.includes('-----BEGIN PUBLIC KEY-----')) {
+            try {
+                const toSignBuf = Buffer.from(toSign, 'utf8');
+                return parsed.signatures.some(sig => {
+                    try {
+                        const sigBuf = Buffer.from(sig, 'base64');
+                        return node_crypto_1.default.verify(null, toSignBuf, secret, sigBuf);
+                    }
+                    catch {
+                        return false;
+                    }
+                });
+            }
+            catch {
+                return false;
+            }
+        }
+        // Symmetric HMAC verification
+        let secretKey = secret;
+        if (typeof secret === 'string' && secret.startsWith('whsec_')) {
+            secretKey = Buffer.from(secret.slice(6), 'base64');
+        }
+        const expected = node_crypto_1.default.createHmac('sha256', secretKey).update(toSign).digest('base64');
+        return parsed.signatures.some(sig => (0, timing_1.timingSafeCompare)(expected, sig, 'base64'));
+    }
+}
+exports.SvixWebhookProtocol = SvixWebhookProtocol;
+exports.svixProtocol = new SvixWebhookProtocol();
+//# sourceMappingURL=svix.js.map

package/dist/webhooks/protocols/svix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"svix.js","sourceRoot":"","sources":["../../../src/webhooks/protocols/svix.ts"],"names":[],"mappings":";;;;;;AAAA,8DAAiC;AAMjC,sCAA8C;AAC9C,iCAA6E;AAE7E,MAAa,mBAAmB;IACrB,IAAI,GAAG,MAAM,CAAC;IAEvB,YAAY,CACV,UAAyD,EAAE,EAC3D,kBAA0B,EAAE;QAE5B,MAAM,UAAU,GAAG,IAAA,uBAAgB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,eAAe;YAC/B,UAAU,CAAC,gBAAgB,CAAC;YAC5B,UAAU,CAAC,mBAAmB,CAAC;YAC/B,EAAE,CAAC;QAEL,MAAM,YAAY,GAAG,UAAU,CAAC,gBAAgB,CAAC,IAAI,UAAU,CAAC,mBAAmB,CAAC,CAAC;QACrF,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAElE,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACjC,CAAC;iBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACjC,CAAC;iBAAM,IAAI,IAAI,EAAE,CAAC;gBAChB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,OAAO;YACL,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YAC3D,UAAU;YACV,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,mBAAmB,CAAC,OAAwB,EAAE,SAAkB,EAAE,MAAe;QAC/E,MAAM,OAAO,GAAG,IAAA,sBAAe,EAAC,OAAO,CAAC,CAAC;QACzC,OAAO,GAAG,MAAM,IAAI,EAAE,IAAI,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,EAAE,CAAC;IAClF,CAAC;IAED,MAAM,CAAC,EACL,MAAM,EACN,UAAU,EACV,OAAO,EACP,eAAe,EACf,gBAAgB,GAAG,GAAG,EACtB,KAAK,EAC6B;QAClC,MAAM,UAAU,GAAG,IAAA,uBAAgB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAE3D,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACtF,IAAI,CAAC,IAAA,uBAAgB,EAAC,MAAM,CAAC,SAAS,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,CAAC;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,GAAG,MAAM,IAAI,MAAM,CAAC,SAAS,IAAI,IAAA,sBAAe,EAAC,UAAU,CAAC,EAAE,CAAC;QAE9E,+CAA+C;QAC/C,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,IAAI,SAAS,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC9C,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;oBAClC,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;wBAC1C,OAAO,qBAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;oBACxD,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,IAAI,SAAS,GAAoB,MAAM,CAAC;QACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9D,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,QAAQ,GAAG,qBAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxF,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAA,0BAAiB,EAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnF,CAAC;CACF;AA1FD,kDA0FC;AAEY,QAAA,YAAY,GAAG,IAAI,mBAAmB,EAAE,CAAC"}

package/dist/webhooks/timing.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Constant-time equality check to prevent side-channel timing attacks.
+ * Uses `crypto.timingSafeEqual` with strict buffer length checks.
+ */
+export declare function timingSafeCompare(computed: string | Buffer, provided: string | Buffer, encoding?: BufferEncoding): boolean;
+//# sourceMappingURL=timing.d.ts.map

package/dist/webhooks/timing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timing.d.ts","sourceRoot":"","sources":["../../src/webhooks/timing.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GAAG,MAAM,EACzB,QAAQ,EAAE,MAAM,GAAG,MAAM,EACzB,QAAQ,GAAE,cAAsB,GAC/B,OAAO,CAaT"}

package/dist/webhooks/timing.js

@@ -0,0 +1,25 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.timingSafeCompare = timingSafeCompare;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+/**
+ * Constant-time equality check to prevent side-channel timing attacks.
+ * Uses `crypto.timingSafeEqual` with strict buffer length checks.
+ */
+function timingSafeCompare(computed, provided, encoding = 'hex') {
+    try {
+        const bufA = Buffer.isBuffer(computed) ? computed : Buffer.from(computed, encoding);
+        const bufB = Buffer.isBuffer(provided) ? provided : Buffer.from(provided, encoding);
+        if (bufA.length === 0 || bufB.length === 0 || bufA.length !== bufB.length) {
+            return false;
+        }
+        return node_crypto_1.default.timingSafeEqual(bufA, bufB);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=timing.js.map

package/dist/webhooks/timing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timing.js","sourceRoot":"","sources":["../../src/webhooks/timing.ts"],"names":[],"mappings":";;;;;AAMA,8CAiBC;AAvBD,8DAAiC;AAEjC;;;GAGG;AACH,SAAgB,iBAAiB,CAC/B,QAAyB,EACzB,QAAyB,EACzB,WAA2B,KAAK;IAEhC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACpF,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAEpF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,qBAAM,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/webhooks/verify-step.d.ts

@@ -0,0 +1,25 @@
+import { Step, ExecutionOptions } from '@siglo/core';
+import { WebhookVerifyOptions, WebhookVerificationResult } from '../types';
+/**
+ * Checks if a value is a readable stream or async iterable of chunks.
+ */
+export declare function isStreamPayload(val: unknown): val is NodeJS.ReadableStream | AsyncIterable<Buffer>;
+/**
+ * Validates whether a value is a raw string, Buffer, Uint8Array, serialized Buffer object, or stream.
+ */
+export declare function isRawPayload(val: unknown): val is string | Buffer | NodeJS.ReadableStream | AsyncIterable<Buffer>;
+/**
+ * Normalizes synchronous raw payload into string or Buffer.
+ */
+export declare function normalizeRawPayload(val: unknown): string | Buffer;
+export declare class WebhookVerifyStep<TInput = any, TName extends string = string> extends Step<TInput, WebhookVerificationResult, TName> {
+    private verifyOptions;
+    constructor(name: TName, options: WebhookVerifyOptions<TInput>);
+    execute(param?: TInput, options?: ExecutionOptions): Promise<WebhookVerificationResult>;
+    run(param?: TInput, options?: ExecutionOptions): Promise<WebhookVerificationResult>;
+}
+/**
+ * Factory for generating typed webhook verification steps.
+ */
+export declare function verifyWebhookStep<const TName extends string, TInput>(name: TName, options: WebhookVerifyOptions<TInput>): WebhookVerifyStep<TInput, TName>;
+//# sourceMappingURL=verify-step.d.ts.map

package/dist/webhooks/verify-step.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-step.d.ts","sourceRoot":"","sources":["../../src/webhooks/verify-step.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAuB,gBAAgB,EAA2D,MAAM,aAAa,CAAC;AACnI,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EAG1B,MAAM,UAAU,CAAC;AAkBlB;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,MAAM,CAAC,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,CAMlG;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,CAWjH;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAcjE;AAkGD,qBAAa,iBAAiB,CAAC,MAAM,GAAG,GAAG,EAAE,KAAK,SAAS,MAAM,GAAG,MAAM,CACxE,SAAQ,IAAI,CAAC,MAAM,EAAE,yBAAyB,EAAE,KAAK,CAAC;IAEtD,OAAO,CAAC,aAAa,CAA+B;gBAExC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,MAAM,CAAC;IAkOrD,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAKvF,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,yBAAyB,CAAC;CAG7F;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,KAAK,SAAS,MAAM,EAAE,MAAM,EAClE,IAAI,EAAE,KAAK,EACX,OAAO,EAAE,oBAAoB,CAAC,MAAM,CAAC,GACpC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAElC"}

package/dist/webhooks/verify-step.js

@@ -0,0 +1,351 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebhookVerifyStep = void 0;
+exports.isStreamPayload = isStreamPayload;
+exports.isRawPayload = isRawPayload;
+exports.normalizeRawPayload = normalizeRawPayload;
+exports.verifyWebhookStep = verifyWebhookStep;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const core_1 = require("@siglo/core");
+const registry_1 = require("../registry");
+const base_1 = require("./protocols/base");
+const dedup_1 = require("./dedup");
+function sanitizeStepInput(param) {
+    if (!param || typeof param !== 'object' || Array.isArray(param)) {
+        return param;
+    }
+    const clean = {};
+    for (const [key, val] of Object.entries(param)) {
+        if (key !== '$steps' && key !== '$history' && key !== '$stackId') {
+            clean[key] = val;
+        }
+    }
+    return clean;
+}
+/**
+ * Checks if a value is a readable stream or async iterable of chunks.
+ */
+function isStreamPayload(val) {
+    return (typeof val === 'object' &&
+        val !== null &&
+        (typeof val[Symbol.asyncIterator] === 'function' || typeof val.pipe === 'function'));
+}
+/**
+ * Validates whether a value is a raw string, Buffer, Uint8Array, serialized Buffer object, or stream.
+ */
+function isRawPayload(val) {
+    if (typeof val === 'string' || Buffer.isBuffer(val) || val instanceof Uint8Array || isStreamPayload(val)) {
+        return true;
+    }
+    if (val && typeof val === 'object' && !Array.isArray(val)) {
+        const keys = Object.keys(val);
+        if (keys.length > 0 && keys.every((k, i) => k === String(i) && typeof val[k] === 'number')) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Normalizes synchronous raw payload into string or Buffer.
+ */
+function normalizeRawPayload(val) {
+    if (typeof val === 'string' || Buffer.isBuffer(val)) {
+        return val;
+    }
+    if (val instanceof Uint8Array) {
+        return Buffer.from(val.buffer, val.byteOffset, val.byteLength);
+    }
+    if (val && typeof val === 'object' && !Array.isArray(val)) {
+        const keys = Object.keys(val);
+        if (keys.length > 0 && keys.every((k, i) => k === String(i) && typeof val[k] === 'number')) {
+            return Buffer.from(Object.values(val));
+        }
+    }
+    return String(val ?? '');
+}
+/**
+ * Resolves raw payload and handles optional stream reading, size limits, and disk spooling.
+ */
+async function resolvePayloadData(val, options, stepName) {
+    const maxBytes = options.maxBodyBytes ?? 10 * 1024 * 1024; // 10MB default
+    const spoolThreshold = options.spoolThresholdBytes ?? 5 * 1024 * 1024; // 5MB default
+    if (isStreamPayload(val)) {
+        const chunks = [];
+        let totalBytes = 0;
+        let fileStream;
+        let filePath;
+        for await (const chunk of val) {
+            const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            totalBytes += buf.length;
+            if (maxBytes > 0 && totalBytes > maxBytes) {
+                if (fileStream) {
+                    fileStream.close();
+                    try {
+                        node_fs_1.default.unlinkSync(filePath);
+                    }
+                    catch { }
+                }
+                throw new core_1.ValidationException([{ field: 'payload', message: `Payload exceeds maximum allowed size of ${maxBytes} bytes` }], { stepName, phase: 'action', retryable: false });
+            }
+            if (totalBytes > spoolThreshold && !fileStream) {
+                const spoolDir = options.spoolDir || node_os_1.default.tmpdir();
+                filePath = node_path_1.default.join(spoolDir, `siglo-wh-${Date.now()}-${Math.random().toString(36).slice(2)}.bin`);
+                fileStream = node_fs_1.default.createWriteStream(filePath);
+                for (const prev of chunks) {
+                    fileStream.write(prev);
+                }
+                chunks.length = 0;
+            }
+            if (fileStream) {
+                fileStream.write(buf);
+            }
+            else {
+                chunks.push(buf);
+            }
+        }
+        if (fileStream) {
+            await new Promise((resolve, reject) => {
+                fileStream.end(resolve);
+                fileStream.on('error', reject);
+            });
+            const fileBuf = node_fs_1.default.readFileSync(filePath);
+            return {
+                rawPayload: fileBuf,
+                payloadRef: {
+                    storage: 'file',
+                    path: filePath,
+                    bytes: totalBytes
+                }
+            };
+        }
+        const rawPayload = Buffer.concat(chunks);
+        return {
+            rawPayload,
+            payloadRef: {
+                storage: 'memory',
+                bytes: totalBytes
+            }
+        };
+    }
+    const rawPayload = normalizeRawPayload(val);
+    const byteLen = Buffer.isBuffer(rawPayload) ? rawPayload.length : Buffer.byteLength(rawPayload);
+    if (maxBytes > 0 && byteLen > maxBytes) {
+        throw new core_1.ValidationException([{ field: 'payload', message: `Payload exceeds maximum allowed size of ${maxBytes} bytes` }], { stepName, phase: 'action', retryable: false });
+    }
+    return {
+        rawPayload,
+        payloadRef: {
+            storage: 'memory',
+            bytes: byteLen
+        }
+    };
+}
+class WebhookVerifyStep extends core_1.Step {
+    verifyOptions;
+    constructor(name, options) {
+        const diagnostic = () => ({ version: 1, kind: 'crypto', outcome: 'failure',
+            provider: typeof options.provider === 'string' && (0, registry_1.getWebhookProtocol)(options.provider) ? options.provider : undefined,
+            category: 'rejected', timestampCheck: 'unavailable', replayCheck: 'unavailable' });
+        const action = async (ctx, inspection) => {
+            // 1. Resolve raw payload (supports Buffers, strings, and streaming chunks)
+            const rawPayloadInput = options.payload(ctx);
+            if (!isRawPayload(rawPayloadInput)) {
+                inspection.category = 'invalid-payload';
+                throw new core_1.ValidationException([{ field: 'payload', message: 'Payload must be a Buffer or raw unparsed string to prevent JSON serialization skew' }], { stepName: name, phase: 'action', retryable: false });
+            }
+            const { rawPayload, payloadRef } = await resolvePayloadData(rawPayloadInput, options, name).catch(error => {
+                if (error instanceof core_1.ValidationException)
+                    inspection.category = 'payload-too-large';
+                throw error;
+            });
+            inspection.payloadBytes = payloadRef.bytes;
+            inspection.category = 'rejected';
+            // 2. Resolve secret
+            const secret = typeof options.secret === 'function' ? options.secret(ctx) : options.secret;
+            if (!secret) {
+                inspection.category = 'missing-secret';
+                throw new core_1.ValidationException([{ field: 'secret', message: 'Webhook secret is required' }], { stepName: name, phase: 'action', retryable: false });
+            }
+            // 3. Resolve protocol
+            let providerOrProtocol = options.provider;
+            if (typeof providerOrProtocol === 'function') {
+                providerOrProtocol = providerOrProtocol(ctx);
+            }
+            if (!providerOrProtocol) {
+                providerOrProtocol = 'generic-hmac';
+            }
+            let protocol;
+            if (typeof providerOrProtocol === 'string') {
+                protocol = (0, registry_1.getWebhookProtocol)(providerOrProtocol);
+                if (!protocol) {
+                    inspection.category = 'unknown-provider';
+                    throw new core_1.ValidationException([{ field: 'provider', message: `Unknown webhook provider '${providerOrProtocol}'` }], { stepName: name, phase: 'action', retryable: false });
+                }
+            }
+            else {
+                protocol = providerOrProtocol;
+            }
+            // 4. Resolve headers and signature header
+            inspection.provider = protocol.name;
+            const signatureOrHeaders = options.signature(ctx);
+            let headers = {};
+            let signatureHeader = '';
+            if (options.headers) {
+                headers = options.headers(ctx);
+            }
+            if (typeof signatureOrHeaders === 'string') {
+                signatureHeader = signatureOrHeaders;
+                if (Object.keys(headers).length === 0 && ctx?.headers && typeof ctx.headers === 'object') {
+                    headers = ctx.headers;
+                }
+            }
+            else if (typeof signatureOrHeaders === 'object' && signatureOrHeaders !== null) {
+                headers = signatureOrHeaders;
+            }
+            else if (ctx?.headers && typeof ctx.headers === 'object') {
+                headers = ctx.headers;
+            }
+            const normalized = (0, base_1.normalizeHeaders)(headers);
+            // If signatureHeader is empty, resolve from common header keys based on provider
+            if (!signatureHeader) {
+                if (protocol.name === 'stripe') {
+                    signatureHeader = normalized['stripe-signature'] || '';
+                }
+                else if (protocol.name === 'github') {
+                    signatureHeader = normalized['x-hub-signature-256'] || normalized['x-hub-signature'] || '';
+                }
+                else if (protocol.name === 'shopify') {
+                    signatureHeader = normalized['x-shopify-hmac-sha256'] || '';
+                }
+                else if (protocol.name === 'slack') {
+                    signatureHeader = normalized['x-slack-signature'] || '';
+                }
+                else if (protocol.name === 'svix') {
+                    signatureHeader = normalized['svix-signature'] || normalized['webhook-signature'] || '';
+                }
+                else {
+                    signatureHeader = normalized['signature'] || normalized['x-signature'] || normalized['x-hub-signature-256'] || '';
+                }
+            }
+            // 5. Parse headers & enforce replay attack tolerance
+            const toleranceSeconds = options.toleranceSeconds ?? 300;
+            let parsedTimestamp;
+            if (protocol.parseHeaders) {
+                const parsed = protocol.parseHeaders(headers, signatureHeader);
+                if (!signatureHeader && parsed.signatures.length === 0) {
+                    inspection.category = 'missing-signature';
+                    throw new core_1.ValidationException([{ field: 'signature', message: 'Webhook signature header is missing' }], { stepName: name, phase: 'action', retryable: false });
+                }
+                if (parsed.timestamp !== undefined) {
+                    parsedTimestamp = parsed.timestamp;
+                    const nowSec = options.clock ? Math.floor(options.clock.now() / 1000) : Math.floor(Date.now() / 1000);
+                    let tsSec = parsed.timestamp;
+                    if (tsSec > 1e11) {
+                        tsSec = Math.floor(tsSec / 1000);
+                    }
+                    if (toleranceSeconds > 0 && Math.abs(nowSec - tsSec) > toleranceSeconds) {
+                        inspection.category = 'timestamp-rejected';
+                        inspection.timestampCheck = 'failed';
+                        throw new core_1.ValidationException([{ field: 'timestamp', message: `Webhook timestamp '${parsed.timestamp}' outside tolerance window (${toleranceSeconds}s)` }], { stepName: name, phase: 'action', retryable: false });
+                    }
+                }
+                if (parsed.timestamp !== undefined && toleranceSeconds > 0)
+                    inspection.timestampCheck = 'passed';
+            }
+            else if (!signatureHeader) {
+                inspection.category = 'missing-signature';
+                throw new core_1.ValidationException([{ field: 'signature', message: 'Webhook signature header is missing' }], { stepName: name, phase: 'action', retryable: false });
+            }
+            // 6. Enforce intra-window replay defense via dedupStore
+            const dedupKey = (0, dedup_1.createDedupKey)(protocol.name, signatureHeader, parsedTimestamp);
+            if (options.dedupStore) {
+                const claimed = await options.dedupStore.claim(dedupKey, toleranceSeconds);
+                if (!claimed) {
+                    inspection.category = 'replay-detected';
+                    inspection.replayCheck = 'failed';
+                    throw new core_1.ValidationException([{ field: 'signature', message: `Replay detected: duplicate webhook signature within tolerance window (${toleranceSeconds}s)` }], { stepName: name, phase: 'action', retryable: false });
+                }
+            }
+            if (options.dedupStore)
+                inspection.replayCheck = 'passed';
+            // 7. Execute protocol verification
+            const isValid = await protocol.verify({
+                secret,
+                rawPayload,
+                headers,
+                signatureHeader,
+                toleranceSeconds,
+                clock: options.clock,
+                algorithm: options.algorithm
+            });
+            if (!isValid) {
+                inspection.category = 'invalid-signature';
+                throw new core_1.ValidationException([{ field: 'signature', message: `Webhook signature verification failed for provider '${protocol.name}'` }], { stepName: name, phase: 'action', retryable: false });
+            }
+            const verifiedAt = parsedTimestamp !== undefined
+                ? parsedTimestamp
+                : (options.clock ? Math.floor(options.clock.now() / 1000) : Math.floor(Date.now() / 1000));
+            return {
+                webhookVerified: true,
+                verifiedAt,
+                provider: protocol.name,
+                idempotencyKey: dedupKey,
+                payloadRef
+            };
+        };
+        super(name, ((ctx) => {
+            const inspection = diagnostic();
+            return (0, core_1.observeEcosystem)(inspection, () => action(ctx, inspection), result => ({
+                provider: result.provider, payloadBytes: result.payloadRef?.bytes, category: 'verified'
+            }));
+        }));
+        this.verifyOptions = options;
+        // 1. BEFORE Phase: Early assertions
+        this.onBefore(async (ctx) => {
+            const inspection = diagnostic();
+            try {
+                const payload = options.payload(ctx);
+                if (!isRawPayload(payload)) {
+                    inspection.category = 'invalid-payload';
+                    throw new core_1.ValidationException([{ field: 'payload', message: 'Payload must be a Buffer or raw unparsed string to prevent JSON serialization skew' }], { stepName: name, phase: 'before', retryable: false });
+                }
+                let provider = options.provider;
+                if (typeof provider === 'function') {
+                    provider = provider(ctx);
+                }
+                if (typeof provider === 'string') {
+                    const protocol = (0, registry_1.getWebhookProtocol)(provider);
+                    if (!protocol) {
+                        inspection.category = 'unknown-provider';
+                        throw new core_1.ValidationException([{ field: 'provider', message: `Unknown webhook provider '${provider}'` }], { stepName: name, phase: 'before', retryable: false });
+                    }
+                }
+                return true;
+            }
+            catch (error) {
+                (0, core_1.recordInspection)(inspection);
+                throw error;
+            }
+        });
+    }
+    execute(param, options) {
+        const cleanParam = param ? sanitizeStepInput(param) : param;
+        return super.execute(cleanParam, { pojo: true, ...options });
+    }
+    run(param, options) {
+        return this.execute(param, options);
+    }
+}
+exports.WebhookVerifyStep = WebhookVerifyStep;
+/**
+ * Factory for generating typed webhook verification steps.
+ */
+function verifyWebhookStep(name, options) {
+    return new WebhookVerifyStep(name, options);
+}
+//# sourceMappingURL=verify-step.js.map

package/dist/webhooks/verify-step.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-step.js","sourceRoot":"","sources":["../../src/webhooks/verify-step.ts"],"names":[],"mappings":";;;;;;AA8BA,0CAMC;AAKD,oCAWC;AAKD,kDAcC;AAsVD,8CAKC;AAlaD,sDAAyB;AACzB,sDAAyB;AACzB,0DAA6B;AAC7B,sCAAmI;AAOnI,0CAAiD;AACjD,2CAAoD;AACpD,mCAAyC;AAEzC,SAAS,iBAAiB,CAAI,KAAQ;IACpC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAwB,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACjE,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,KAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,GAAY;IAC1C,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACZ,CAAC,OAAQ,GAAW,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,UAAU,IAAI,OAAQ,GAAW,CAAC,IAAI,KAAK,UAAU,CAAC,CACtG,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,YAAY,CAAC,GAAY;IACvC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,YAAY,UAAU,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QACzG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,OAAQ,GAAW,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACpG,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,GAAY;IAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,OAAQ,GAAW,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACpG,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAa,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,kBAAkB,CAC/B,GAAY,EACZ,OAAkC,EAClC,QAAgB;IAEhB,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,eAAe;IAC1E,MAAM,cAAc,GAAG,OAAO,CAAC,mBAAmB,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,cAAc;IAErF,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,UAAsC,CAAC;QAC3C,IAAI,QAA4B,CAAC;QAEjC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAU,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChE,UAAU,IAAI,GAAG,CAAC,MAAM,CAAC;YAEzB,IAAI,QAAQ,GAAG,CAAC,IAAI,UAAU,GAAG,QAAQ,EAAE,CAAC;gBAC1C,IAAI,UAAU,EAAE,CAAC;oBACf,UAAU,CAAC,KAAK,EAAE,CAAC;oBACnB,IAAI,CAAC;wBACH,iBAAE,CAAC,UAAU,CAAC,QAAS,CAAC,CAAC;oBAC3B,CAAC;oBAAC,MAAM,CAAC,CAAA,CAAC;gBACZ,CAAC;gBACD,MAAM,IAAI,0BAAmB,CAC3B,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,2CAA2C,QAAQ,QAAQ,EAAE,CAAC,EAC5F,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CAChD,CAAC;YACJ,CAAC;YAED,IAAI,UAAU,GAAG,cAAc,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAE,CAAC,MAAM,EAAE,CAAC;gBACjD,QAAQ,GAAG,mBAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBACpG,UAAU,GAAG,iBAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;gBAC5C,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;oBAC1B,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzB,CAAC;gBACD,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;YACpB,CAAC;YAED,IAAI,UAAU,EAAE,CAAC;gBACf,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACpC,UAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACzB,UAAW,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,iBAAE,CAAC,YAAY,CAAC,QAAS,CAAC,CAAC;YAC3C,OAAO;gBACL,UAAU,EAAE,OAAO;gBACnB,UAAU,EAAE;oBACV,OAAO,EAAE,MAAM;oBACf,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,UAAU;iBAClB;aACF,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,OAAO;YACL,UAAU;YACV,UAAU,EAAE;gBACV,OAAO,EAAE,QAAQ;gBACjB,KAAK,EAAE,UAAU;aAClB;SACF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAEhG,IAAI,QAAQ,GAAG,CAAC,IAAI,OAAO,GAAG,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,0BAAmB,CAC3B,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,2CAA2C,QAAQ,QAAQ,EAAE,CAAC,EAC5F,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CAChD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,UAAU;QACV,UAAU,EAAE;YACV,OAAO,EAAE,QAAQ;YACjB,KAAK,EAAE,OAAO;SACf;KACF,CAAC;AACJ,CAAC;AAED,MAAa,iBACX,SAAQ,WAA8C;IAE9C,aAAa,CAA+B;IAEpD,YAAY,IAAW,EAAE,OAAqC;QAE5D,MAAM,UAAU,GAAG,GAAe,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS;YACpF,QAAQ,EAAE,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAA,6BAAkB,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YACrH,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,KAAK,EAAE,GAAW,EAAE,UAAsB,EAAsC,EAAE;YAC/F,2EAA2E;YAC3E,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7C,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,CAAC;gBACnC,UAAU,CAAC,QAAQ,GAAG,iBAAiB,CAAC;gBACxC,MAAM,IAAI,0BAAmB,CAC3B,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,oFAAoF,EAAE,CAAC,EACrH,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CACtD,CAAC;YACJ,CAAC;YAED,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,kBAAkB,CAAC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;gBACxG,IAAI,KAAK,YAAY,0BAAmB;oBAAE,UAAU,CAAC,QAAQ,GAAG,mBAAmB,CAAC;gBACpF,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,CAAC;YACH,UAAU,CAAC,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC;YAC3C,UAAU,CAAC,QAAQ,GAAG,UAAU,CAAC;YAEjC,oBAAoB;YACpB,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;YAC3F,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,UAAU,CAAC,QAAQ,GAAG,gBAAgB,CAAC;gBACvC,MAAM,IAAI,0BAAmB,CAC3B,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,EAC5D,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CACtD,CAAC;YACJ,CAAC;YAED,sBAAsB;YACtB,IAAI,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC;YAC1C,IAAI,OAAO,kBAAkB,KAAK,UAAU,EAAE,CAAC;gBAC7C,kBAAkB,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,kBAAkB,GAAG,cAAc,CAAC;YACtC,CAAC;YAED,IAAI,QAAqC,CAAC;YAC1C,IAAI,OAAO,kBAAkB,KAAK,QAAQ,EAAE,CAAC;gBAC3C,QAAQ,GAAG,IAAA,6BAAkB,EAAC,kBAAkB,CAAC,CAAC;gBAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,UAAU,CAAC,QAAQ,GAAG,kBAAkB,CAAC;oBACzC,MAAM,IAAI,0BAAmB,CAC3B,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,6BAA6B,kBAAkB,GAAG,EAAE,CAAC,EACpF,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CACtD,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,kBAAkB,CAAC;YAChC,CAAC;YAED,0CAA0C;YAC1C,UAAU,CAAC,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC;YACpC,MAAM,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAClD,IAAI,OAAO,GAAkD,EAAE,CAAC;YAChE,IAAI,eAAe,GAAG,EAAE,CAAC;YAEzB,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,CAAC;YAED,IAAI,OAAO,kBAAkB,KAAK,QAAQ,EAAE,CAAC;gBAC3C,eAAe,GAAG,kBAAkB,CAAC;gBACrC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,IAAK,GAAW,EAAE,OAAO,IAAI,OAAQ,GAAW,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAC3G,OAAO,GAAI,GAAW,CAAC,OAAO,CAAC;gBACjC,CAAC;YACH,CAAC;iBAAM,IAAI,OAAO,kBAAkB,KAAK,QAAQ,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;gBACjF,OAAO,GAAG,kBAAkB,CAAC;YAC/B,CAAC;iBAAM,IAAK,GAAW,EAAE,OAAO,IAAI,OAAQ,GAAW,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC7E,OAAO,GAAI,GAAW,CAAC,OAAO,CAAC;YACjC,CAAC;YAED,MAAM,UAAU,GAAG,IAAA,uBAAgB,EAAC,OAAO,CAAC,CAAC;YAE7C,iFAAiF;YACjF,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC/B,eAAe,GAAG,UAAU,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;gBACzD,CAAC;qBAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtC,eAAe,GAAG,UAAU,CAAC,qBAAqB,CAAC,IAAI,UAAU,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;gBAC7F,CAAC;qBAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvC,eAAe,GAAG,UAAU,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAC;gBAC9D,CAAC;qBAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACrC,eAAe,GAAG,UAAU,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC;gBAC1D,CAAC;qBAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBACpC,eAAe,GAAG,UAAU,CAAC,gBAAgB,CAAC,IAAI,UAAU,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC;gBAC1F,CAAC;qBAAM,CAAC;oBACN,eAAe,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,IAAI,UAAU,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC;gBACpH,CAAC;YACH,CAAC;YAED,qDAAqD;YACrD,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,GAAG,CAAC;YACzD,IAAI,eAAmC,CAAC;YAExC,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;gBAC1B,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;gBAC/D,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvD,UAAU,CAAC,QAAQ,GAAG,mBAAmB,CAAC;oBAC1C,MAAM,IAAI,0BAAmB,CAC3B,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,EACxE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CACtD,CAAC;gBACJ,CAAC;gBACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;oBACnC,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC;oBACnC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;oBACtG,IAAI,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC;oBAC7B,IAAI,KAAK,GAAG,IAAI,EAAE,CAAC;wBACjB,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;oBACnC,CAAC;oBACD,IAAI,gBAAgB,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,gBAAgB,EAAE,CAAC;wBACxE,UAAU,CAAC,QAAQ,GAAG,oBAAoB,CAAC;wBAC3C,UAAU,CAAC,cAAc,GAAG,QAAQ,CAAC;wBACrC,MAAM,IAAI,0BAAmB,CAC3B,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,MAAM,CAAC,SAAS,+BAA+B,gBAAgB,IAAI,EAAE,CAAC,EAC5H,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CACtD,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,gBAAgB,GAAG,CAAC;oBAAE,UAAU,CAAC,cAAc,GAAG,QAAQ,CAAC;YACnG,CAAC;iBAAM,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC5B,UAAU,CAAC,QAAQ,GAAG,mBAAmB,CAAC;gBAC1C,MAAM,IAAI,0BAAmB,CAC3B,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,EACxE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CACtD,CAAC;YACJ,CAAC;YAED,wDAAwD;YACxD,MAAM,QAAQ,GAAG,IAAA,sBAAc,EAAC,QAAQ,CAAC,IAAI,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;YACjF,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBACvB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;gBAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,UAAU,CAAC,QAAQ,GAAG,iBAAiB,CAAC;oBACxC,UAAU,CAAC,WAAW,GAAG,QAAQ,CAAC;oBAClC,MAAM,IAAI,0BAAmB,CAC3B,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,yEAAyE,gBAAgB,IAAI,EAAE,CAAC,EAChI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CACtD,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,OAAO,CAAC,UAAU;gBAAE,UAAU,CAAC,WAAW,GAAG,QAAQ,CAAC;YAE1D,mCAAmC;YACnC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;gBACpC,MAAM;gBACN,UAAU;gBACV,OAAO;gBACP,eAAe;gBACf,gBAAgB;gBAChB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CAAC;YAEH,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,UAAU,CAAC,QAAQ,GAAG,mBAAmB,CAAC;gBAC1C,MAAM,IAAI,0BAAmB,CAC3B,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,uDAAuD,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,EAC1G,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CACtD,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,GAAG,eAAe,KAAK,SAAS;gBAC9C,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;YAE7F,OAAO;gBACL,eAAe,EAAE,IAAa;gBAC9B,UAAU;gBACV,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,cAAc,EAAE,QAAQ;gBACxB,UAAU;aACX,CAAC;QACJ,CAAC,CAAC;QAEF,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,GAAW,EAAE,EAAE;YAC3B,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;YAChC,OAAO,IAAA,uBAAgB,EAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC5E,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAmB;aACjG,CAAC,CAAC,CAAC;QACN,CAAC,CAAQ,CAAC,CAAC;QACX,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC;QAE7B,oCAAoC;QACpC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;YAClC,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3B,UAAU,CAAC,QAAQ,GAAG,iBAAiB,CAAC;oBACxC,MAAM,IAAI,0BAAmB,CAC3B,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,oFAAoF,EAAE,CAAC,EACrH,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CACtD,CAAC;gBACJ,CAAC;gBAED,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;gBAChC,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;oBACnC,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC3B,CAAC;gBACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBACjC,MAAM,QAAQ,GAAG,IAAA,6BAAkB,EAAC,QAAQ,CAAC,CAAC;oBAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,UAAU,CAAC,QAAQ,GAAG,kBAAkB,CAAC;wBACzC,MAAM,IAAI,0BAAmB,CAC3B,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,6BAA6B,QAAQ,GAAG,EAAE,CAAC,EAC1E,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CACtD,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAA,uBAAgB,EAAC,UAAU,CAAC,CAAC;gBAC7B,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAEQ,OAAO,CAAC,KAAc,EAAE,OAA0B;QACzD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5D,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC;IAEQ,GAAG,CAAC,KAAc,EAAE,OAA0B;QACrD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;CACF;AA/OD,8CA+OC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAC/B,IAAW,EACX,OAAqC;IAErC,OAAO,IAAI,iBAAiB,CAAgB,IAAI,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC"}

package/package.json

@@ -1,6 +1,54 @@
 {
   "name": "@siglo/crypto",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.1",
+  "description": "Zero-dependency cryptographic step package for Siglo workflows: timing-safe webhook verification, AEAD envelope field encryption, and context redaction",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "prepublishOnly": "npm run build",
+    "test": "npm run build && mocha -r tsx 'test/**/*.test.ts' 'src/**/*.test.ts' --exit"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jsoftgem/siglo.git",
+    "directory": "packages/crypto"
+  },
+  "author": "Jerico de Guzman",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/jsoftgem/siglo/issues"
+  },
+  "homepage": "https://github.com/jsoftgem/siglo#readme",
+  "dependencies": {
+    "@siglo/core": "^1.0.0"
+  },
+  "devDependencies": {
+    "@siglo/testing": "^1.0.0",
+    "@types/chai": "^5.2.3",
+    "@types/mocha": "^10.0.10",
+    "@types/node": "^26.6.5",
+    "chai": "^3.5.0",
+    "mocha": "^12.0.3",
+    "tsx": "^4.23.15",
+    "typescript": "~5.7.0"
+  }
+}