@slates/provider 1.0.0-rc.32 → 1.0.0-rc.34

package/src/action/triggerGroup.ts

@@ -8,6 +8,8 @@ export let SlateDefaultPollingIntervalSeconds = 60 * 10;
 
 export type SlateTriggerRoutingMatcher = Record<string, any>;
 
+export type SlateTriggerGroupSelection = Record<string, any>;
+
 export type SlateWebhookTargetOwnership = 'single_user' | 'multi_user';
 
 export interface SlateWebhookTarget {
@@ -25,7 +27,11 @@ export type SlateTriggerGroupRoutingMatchersHandler<
 > = (context: SlateContext<ConfigType, AuthType, {}>) => Promise<SlateTriggerRoutingMatcher[]>;
 
 export type SlateTriggerGroupPollHandler<ConfigType extends {}, AuthType extends {}> = (
-  context: SlateContext<ConfigType, AuthType, { state: any | null }>
+  context: SlateContext<
+    ConfigType,
+    AuthType,
+    { state: any | null; selection?: SlateTriggerGroupSelection }
+  >
 ) => Promise<{
   events: { payload: any; idempotencyKey?: string }[];
   updatedState?: any;
@@ -65,7 +71,11 @@ export type SlateTriggerGroupGatewayReceiveHandler<
 }>;
 
 export type SlateWebhookTargetListHandler<ConfigType extends {}, AuthType extends {}> = (
-  context: SlateContext<ConfigType, AuthType, { pageToken: any | null }>
+  context: SlateContext<
+    ConfigType,
+    AuthType,
+    { pageToken: any | null; selection?: SlateTriggerGroupSelection }
+  >
 ) => Promise<{
   targets: SlateWebhookTarget[];
   nextPageToken: any | null;
@@ -81,11 +91,54 @@ export type SlateWebhookRegisterHandler<ConfigType extends {}, AuthType extends
       webhookTargetIdentifier: string;
       webhookTargetPayload: any;
       webhookUrl: string;
+      operationId?: string;
+      selection?: SlateTriggerGroupSelection;
+      deliveryConfig?: unknown;
     }
   >
-) => Promise<{
+) => Promise<SlateWebhookRegistrationResult>;
+
+export interface SlateWebhookRegistrationResult {
   webhookRegistrationIdentifier: string;
   webhookRegistrationPayload: any;
+  expiresAt?: string | null;
+  renewAfter?: string | null;
+  /** Identities of this registration on a delivery channel shared with other registrations. */
+  routingKeys?: string[];
+}
+
+export type SlateWebhookRenewHandler<ConfigType extends {}, AuthType extends {}> = (
+  context: SlateContext<
+    ConfigType,
+    AuthType,
+    {
+      webhookRegistrationIdentifier: string;
+      webhookRegistrationPayload: any;
+      webhookUrl: string;
+      webhookTargetIdentifier: string;
+      webhookTargetPayload: any;
+      operationId: string;
+      selection?: SlateTriggerGroupSelection;
+      deliveryConfig?: unknown;
+    }
+  >
+) => Promise<SlateWebhookRegistrationResult>;
+
+export type SlateWebhookExpandHandler<ConfigType extends {}, AuthType extends {}> = (
+  context: SlateContext<
+    ConfigType,
+    AuthType,
+    {
+      payload: unknown | null;
+      state: any | null;
+      selection?: SlateTriggerGroupSelection;
+      deliveryId: string;
+      webhookRegistrationPayload: any;
+    }
+  >
+) => Promise<{
+  events: { payload: any; idempotencyKey?: string }[];
+  updatedState?: any;
 }>;
 
 export type SlateWebhookUnregisterHandler<ConfigType extends {}, AuthType extends {}> = (
@@ -146,6 +199,18 @@ export interface SlateWebhookSkipped {
   reason: string;
 }
 
+/**
+ * Routing keys name the registrations a request addresses; an empty list acknowledges it
+ * without handing it to any. A rejection answers the sender with its status.
+ */
+export type SlateWebhookDeliveryAuthentication =
+  | { routingKeys: string[]; rejected?: undefined }
+  | { rejected: { status: number }; routingKeys?: undefined };
+
+export type SlateWebhookDeliveryAuthenticateHandler = (
+  context: SlateContext<{}, {}, { request: Request; deliveryConfig: unknown }>
+) => Promise<SlateWebhookDeliveryAuthentication>;
+
 export interface SlateTriggerGroupPollingParameters<
   ConfigType extends {},
   AuthType extends {}
@@ -168,6 +233,7 @@ export interface SlateTriggerGroupWebhookAutoRegistrationParameters<
 > {
   webhookTargetList: SlateWebhookTargetListHandler<ConfigType, AuthType>;
   webhookRegister: SlateWebhookRegisterHandler<ConfigType, AuthType>;
+  webhookRenew?: SlateWebhookRenewHandler<ConfigType, AuthType>;
   webhookUnregister: SlateWebhookUnregisterHandler<ConfigType, AuthType>;
 }
 
@@ -181,13 +247,28 @@ export interface SlateTriggerGroupWebhookManualRegistrationParameters<
   finish?: SlateWebhookManualFinishHandler<UserConfigSchema, FullConfigSchema>;
 }
 
+/** A delivery setup a person completes once for an automatically registered group. */
+export type SlateTriggerGroupWebhookDeliveryConfigParameters<
+  UserConfigSchema extends z.ZodType<any> = z.ZodType<any>,
+  FullConfigSchema extends z.ZodType<any> = z.ZodType<any>
+> = SlateTriggerGroupWebhookManualRegistrationParameters<
+  UserConfigSchema,
+  FullConfigSchema
+> & {
+  finish: SlateWebhookManualFinishHandler<UserConfigSchema, FullConfigSchema>;
+  authenticate: SlateWebhookDeliveryAuthenticateHandler;
+};
+
 export interface SlateTriggerGroupWebhookParameters<
   ConfigType extends {},
   AuthType extends {}
 > {
   autoRegistration?: SlateTriggerGroupWebhookAutoRegistrationParameters<ConfigType, AuthType>;
   manualRegistration?: SlateTriggerGroupWebhookManualRegistrationParameters<any, any>;
+  deliveryConfig?: SlateTriggerGroupWebhookDeliveryConfigParameters<any, any>;
   process: SlateWebhookProcessHandler;
+  expandWebhook?: SlateWebhookExpandHandler<ConfigType, AuthType>;
+  reconcileIntervalSeconds?: number;
 }
 
 export interface SlateTriggerGroupCreateParameters<
@@ -198,6 +279,7 @@ export interface SlateTriggerGroupCreateParameters<
   description?: string;
   metadata?: Record<string, any>;
   eventSchema?: z.ZodType<InputType>;
+  selectionSchema?: z.ZodType<SlateTriggerGroupSelection>;
 }
 
 export interface SlateTriggerGroupParameters<
@@ -261,6 +343,10 @@ export class SlateTriggerGroup<
     return this._params.source;
   }
 
+  get selectionSchema() {
+    return this._params.selectionSchema;
+  }
+
   get polling() {
     return this._params.polling;
   }
@@ -327,7 +413,13 @@ export class SlateTriggerGroupBuilder<
       UserConfigSchema,
       FullConfigSchema
     >;
+    deliveryConfig?: SlateTriggerGroupWebhookDeliveryConfigParameters<
+      UserConfigSchema,
+      FullConfigSchema
+    >;
     process: SlateWebhookProcessHandler;
+    expandWebhook?: SlateWebhookExpandHandler<ConfigType, AuthType>;
+    reconcileIntervalSeconds?: number;
   }): SlateTriggerGroupBuilder<ConfigType, AuthType, InputType> {
     if (this.#source) {
       throw new SlateDeclarationError('Trigger group invocation is already defined');
@@ -339,11 +431,46 @@ export class SlateTriggerGroupBuilder<
       );
     }
 
+    if (props.deliveryConfig !== undefined) {
+      if (!props.autoRegistration) {
+        throw new SlateDeclarationError(
+          'A webhook delivery config requires automatic webhook registration'
+        );
+      }
+      if (!props.deliveryConfig.finish) {
+        throw new SlateDeclarationError('A webhook delivery config requires a finish handler');
+      }
+      if (!props.deliveryConfig.authenticate) {
+        throw new SlateDeclarationError(
+          'A webhook delivery config requires an authenticate handler'
+        );
+      }
+    }
+
+    if (props.reconcileIntervalSeconds !== undefined) {
+      if (
+        !Number.isSafeInteger(props.reconcileIntervalSeconds) ||
+        props.reconcileIntervalSeconds < 900
+      ) {
+        throw new SlateDeclarationError(
+          'Webhook reconciliation interval must be an integer of at least 900 seconds'
+        );
+      }
+      if (!props.expandWebhook) {
+        throw new SlateDeclarationError(
+          'Webhook reconciliation requires an expandWebhook handler'
+        );
+      }
+    }
+
     this.#source = 'webhook';
     this.#webhook = {
       autoRegistration: props.autoRegistration,
       manualRegistration: props.manualRegistration,
-      process: props.process
+      deliveryConfig: props.deliveryConfig,
+      process: props.process,
+      expandWebhook: props.expandWebhook,
+      reconcileIntervalSeconds: props.reconcileIntervalSeconds
     };
 
     return this;

package/src/context/context.ts

@@ -12,6 +12,20 @@ import { PQueue } from './pQueue';
 
 export type { SlateLiveInvocationInfo };
 
+export interface SlateRuntimeInfo {
+  metorial?: {
+    apiUrl: string;
+    region?: string | null;
+    environment?: string | null;
+  };
+}
+
+let freezeRuntimeInfo = (runtimeInfo: SlateRuntimeInfo): Readonly<SlateRuntimeInfo> =>
+  Object.freeze({
+    ...runtimeInfo,
+    ...(runtimeInfo.metorial ? { metorial: Object.freeze({ ...runtimeInfo.metorial }) } : {})
+  });
+
 export type SlateAddAttachmentContent =
   | Buffer
   | Uint8Array
@@ -80,6 +94,7 @@ export class SlatePublicContext<InputType extends {}> {
   #httpTraces: SlateHttpTrace[] = [];
 
   #liveInvocation: SlateLiveInvocationInfo | null;
+  #runtimeInfo: Readonly<SlateRuntimeInfo> | null;
   #attachmentsDisabled = false;
   #attachments: SlateAttachment[] = [];
   #pendingUploads: Promise<void>[] = [];
@@ -96,10 +111,16 @@ export class SlatePublicContext<InputType extends {}> {
     input: InputType,
     private readonly spec: SlateSpecification<any, any>,
     private readonly logger: SlateLogger,
-    liveInvocation: SlateLiveInvocationInfo | null = null
+    liveInvocation: SlateLiveInvocationInfo | null = null,
+    runtimeInfo: SlateRuntimeInfo | null = null
   ) {
     this.#input = input;
     this.#liveInvocation = liveInvocation;
+    this.#runtimeInfo = runtimeInfo && freezeRuntimeInfo(runtimeInfo);
+  }
+
+  get runtimeInfo() {
+    return this.#runtimeInfo;
   }
 
   get specification() {
@@ -294,9 +315,10 @@ export class SlateContext<
     auth: AuthType,
     spec: SlateSpecification<ConfigType, AuthType>,
     logger: SlateLogger,
-    liveInvocation: SlateLiveInvocationInfo | null = null
+    liveInvocation: SlateLiveInvocationInfo | null = null,
+    runtimeInfo: SlateRuntimeInfo | null = null
   ) {
-    super(input, spec, logger, liveInvocation);
+    super(input, spec, logger, liveInvocation, runtimeInfo);
     this.#config = config;
     this.#auth = auth;
   }

package/src/context/hook.ts

@@ -30,3 +30,5 @@ export let getCurrentContext = <
   }
   return context as SlateContext<ConfigType, AuthType, InputType>;
 };
+
+export let getRuntimeInfo = () => asyncLocalStorage.getStore()?.runtimeInfo ?? null;

package/src/crypto/hmac.test.ts

@@ -1,5 +1,21 @@
 import { describe, expect, it } from 'vitest';
-import { createHmacSignature, verifyHmacSignature } from './hmac';
+import { createHmacSignature, timingSafeStringEqual, verifyHmacSignature } from './hmac';
+
+describe('timingSafeStringEqual', () => {
+  it('matches only the identical string', () => {
+    expect(timingSafeStringEqual('secret', 'secret')).toBe(true);
+    expect(timingSafeStringEqual('secret', 'secreT')).toBe(false);
+    expect(timingSafeStringEqual('secret', 'secret-longer')).toBe(false);
+    expect(timingSafeStringEqual('secret', '')).toBe(false);
+  });
+
+  it('rejects a missing value and never matches an empty expectation', () => {
+    expect(timingSafeStringEqual('secret', null)).toBe(false);
+    expect(timingSafeStringEqual('', undefined)).toBe(false);
+    expect(timingSafeStringEqual('', null)).toBe(false);
+    expect(timingSafeStringEqual('', '')).toBe(false);
+  });
+});
 
 describe('createHmacSignature', () => {
   it('creates prefixed hexadecimal HMAC signatures', () => {

package/src/crypto/hmac.ts

@@ -21,12 +21,17 @@ export let createHmacSignature = ({
 }: CreateHmacSignatureOptions) =>
   `${prefix}${createHmac(algorithm, secret).update(payload).digest(digest)}`;
 
-export let verifyHmacSignature = (options: VerifyHmacSignatureOptions) => {
-  let expected = createHmacSignature(options);
+/** Constant-time secret comparison; an empty expected secret matches nothing. */
+export let timingSafeStringEqual = (expected: string, received: string | null | undefined) => {
   let expectedBytes = Buffer.from(expected);
-  let signatureBytes = Buffer.from(options.signature);
-  let lengthsMatch = signatureBytes.length === expectedBytes.length;
-  let comparableSignature = lengthsMatch ? signatureBytes : Buffer.alloc(expectedBytes.length);
+  let receivedBytes = Buffer.from(received ?? '');
+  let lengthsMatch = receivedBytes.length === expectedBytes.length;
+  let comparable = lengthsMatch ? receivedBytes : Buffer.alloc(expectedBytes.length);
 
-  return timingSafeEqual(comparableSignature, expectedBytes) && lengthsMatch;
+  return (
+    timingSafeEqual(comparable, expectedBytes) && lengthsMatch && expectedBytes.length > 0
+  );
 };
+
+export let verifyHmacSignature = (options: VerifyHmacSignatureOptions) =>
+  timingSafeStringEqual(createHmacSignature(options), options.signature);

package/src/dedup/index.test.ts

@@ -0,0 +1,47 @@
+import { describe, expect, it, vi } from 'vitest';
+import { pruneSeenEntries, seenEntryKey, seenEntrySchema } from './index';
+
+describe('seen entries', () => {
+  it('derives a short stable key', () => {
+    let key = seenEntryKey('["account","event",1]');
+    expect(key).toMatch(/^[A-Za-z0-9_-]{16}$/);
+    expect(seenEntryKey('["account","event",1]')).toBe(key);
+    expect(seenEntryKey('["account","event",2]')).not.toBe(key);
+    expect(seenEntrySchema.safeParse({ key, at: 1 }).success).toBe(true);
+    expect(seenEntrySchema.safeParse({ key, at: Number.NaN }).success).toBe(false);
+  });
+
+  it('drops entries before the cutoff unless retained, newest first', () => {
+    expect(
+      pruneSeenEntries(
+        [
+          { key: 'old', at: 1 },
+          { key: 'kept', at: 1, retain: true },
+          { key: 'b', at: 5 },
+          { key: 'a', at: 5 },
+          { key: 'new', at: 9 }
+        ],
+        { cutoff: 5, maxEntries: 10 }
+      )
+    ).toEqual([
+      { key: 'new', at: 9 },
+      { key: 'a', at: 5 },
+      { key: 'b', at: 5 },
+      { key: 'kept', at: 1 }
+    ]);
+  });
+
+  it('keeps the newest entries and reports the overflow', () => {
+    let onOverflow = vi.fn();
+    expect(
+      pruneSeenEntries(
+        [1, 2, 3, 4].map(at => ({ key: `k${at}`, at })),
+        { cutoff: 0, maxEntries: 2, onOverflow }
+      )
+    ).toEqual([
+      { key: 'k4', at: 4 },
+      { key: 'k3', at: 3 }
+    ]);
+    expect(onOverflow).toHaveBeenCalledWith(2);
+  });
+});

package/src/dedup/index.ts

@@ -0,0 +1,25 @@
+import { createHash } from 'crypto';
+import { z } from 'zod';
+
+/** An event a poller already reported, saved so an overlapping read can skip it. */
+export let seenEntrySchema = z.object({ key: z.string().min(1), at: z.number().finite() });
+export type SeenEntry = z.infer<typeof seenEntrySchema>;
+
+/** A short stable key for an idempotency key, so remembered events cost little state. */
+export let seenEntryKey = (idempotencyKey: string) =>
+  createHash('sha256').update(idempotencyKey).digest('base64url').slice(0, 16);
+
+/** Keeps entries at or after `cutoff` (or `retain`), newest first, at most `maxEntries`. */
+export let pruneSeenEntries = (
+  entries: Iterable<SeenEntry & { retain?: boolean }>,
+  options: { cutoff: number; maxEntries: number; onOverflow?: (dropped: number) => void }
+): SeenEntry[] => {
+  let kept: SeenEntry[] = [];
+  for (let { key, at, retain } of entries) {
+    if (retain || at >= options.cutoff) kept.push({ key, at });
+  }
+  kept.sort((a, b) => b.at - a.at || (a.key < b.key ? -1 : 1));
+  if (kept.length <= options.maxEntries) return kept;
+  options.onOverflow?.(kept.length - options.maxEntries);
+  return kept.slice(0, options.maxEntries);
+};

package/src/error/api.test.ts

@@ -7,6 +7,7 @@ import {
   createApiServiceError,
   decodeApiErrorBody,
   getApiErrorResponseWithBody,
+  getUpstreamErrorStatus,
   looksLikeHtmlErrorBody,
   pushBoundedApiErrorDetail,
   readApiErrorText,
@@ -97,6 +98,27 @@ describe('API service error helpers', () => {
     );
   });
 
+  it('reads the upstream status from client errors and normalized ServiceErrors', () => {
+    expect(getUpstreamErrorStatus(axiosFailure(404, {}))).toBe(404);
+    expect(
+      getUpstreamErrorStatus(
+        new SlateError({ code: 'gone', message: 'Gone.', upstream: { status: 410 } })
+      )
+    ).toBe(410);
+    expect(
+      getUpstreamErrorStatus(createApiServiceError('Conflict', { upstreamStatus: 409 }))
+    ).toBe(409);
+    expect(
+      getUpstreamErrorStatus(createApiServiceError('Limited', { upstreamStatus: '429' }))
+    ).toBe(429);
+    expect(getUpstreamErrorStatus(createApiServiceError('No status'))).toBeUndefined();
+    expect(
+      getUpstreamErrorStatus(createApiServiceError('Bad', { upstreamStatus: 'ECONNRESET' }))
+    ).toBeUndefined();
+    expect(getUpstreamErrorStatus(new Error('ETIMEDOUT'))).toBeUndefined();
+    expect(getUpstreamErrorStatus(null)).toBeUndefined();
+  });
+
   it('allows provider-specific status and message extraction', () => {
     let error = buildApiServiceError(
       {

package/src/error/api.ts

@@ -149,6 +149,14 @@ export let getApiErrorResponse = (error: unknown): ApiErrorResponse | undefined
 export let getApiErrorStatus = (error: unknown): ApiErrorStatus | undefined =>
   getApiErrorResponse(error)?.status;
 
+/** Upstream HTTP status of an HTTP client error or a ServiceError with `upstreamStatus`. */
+export let getUpstreamErrorStatus = (error: unknown): number | undefined => {
+  let value =
+    error instanceof ServiceError ? error.data.upstreamStatus : getApiErrorStatus(error);
+  let status = Number(value);
+  return Number.isInteger(status) && status >= 100 && status <= 599 ? status : undefined;
+};
+
 // Like getApiErrorResponse, but also recovers the upstream response body from
 // interceptor-normalized SlateErrors. createAxios stores the body (sanitized by
 // sanitizeForBaggage) at SlateError.data.baggage.response, so provider-specific

package/src/error/index.ts

@@ -2,5 +2,6 @@ export * from './api';
 export * from './axios';
 export * from './base';
 export * from './declaration';
+export * from './parse';
 export * from './service';
 export * from './types';

package/src/error/parse.test.ts

@@ -0,0 +1,29 @@
+import { ServiceError } from '@lowerdeck/error';
+import { describe, expect, it } from 'vitest';
+import { z } from 'zod';
+import { parseWithServiceError } from './parse';
+
+describe('parseWithServiceError', () => {
+  let schema = z.object({ id: z.string().min(1), tags: z.array(z.string()).default([]) });
+
+  it('returns the parsed output, including defaults', () => {
+    expect(parseWithServiceError(schema, { id: 'a' }, 'Invalid value.')).toEqual({
+      id: 'a',
+      tags: []
+    });
+  });
+
+  it('throws a ServiceError with the message and reason', () => {
+    let error: unknown;
+    try {
+      parseWithServiceError(schema, { id: '' }, 'The saved value is invalid.', {
+        reason: 'saved_value_invalid'
+      });
+    } catch (caught) {
+      error = caught;
+    }
+    expect(error).toBeInstanceOf(ServiceError);
+    expect((error as ServiceError<any>).data.message).toBe('The saved value is invalid.');
+    expect((error as ServiceError<any>).data.reason).toBe('saved_value_invalid');
+  });
+});

package/src/error/parse.ts

@@ -0,0 +1,14 @@
+import type { z } from 'zod';
+import { createApiServiceError } from './api';
+
+/** Parses a saved or received value, throwing a user-facing `ServiceError` on mismatch. */
+export let parseWithServiceError = <T extends z.ZodType>(
+  schema: T,
+  value: unknown,
+  message: string,
+  options: { reason?: string } = {}
+): z.output<T> => {
+  let result = schema.safeParse(value);
+  if (!result.success) throw createApiServiceError(message, options);
+  return result.data;
+};

package/src/index.ts

@@ -7,10 +7,12 @@ export * from './axios';
 export * from './config';
 export * from './context';
 export * from './crypto';
+export * from './dedup';
 export * from './docs';
 export * from './error';
 export * from './file';
 export * from './logger';
 export * from './object';
+export * from './pagination';
 export * from './specification';
 export * from './webhook';

package/src/pagination/index.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, it } from 'vitest';
+import { assertNewPageToken, rememberPageToken } from './index';
+
+describe('page token guards', () => {
+  it('remembers each token once', () => {
+    let seen = new Set<string>();
+    expect(rememberPageToken(seen, 'a')).toBe(true);
+    expect(rememberPageToken(seen, 'b')).toBe(true);
+    expect(rememberPageToken(seen, 'a')).toBe(false);
+  });
+
+  it('throws the caller error only for a repeated token', () => {
+    let seen = new Set<string>(['start']);
+    let repeated = () => new Error('repeated');
+    expect(() => assertNewPageToken(seen, undefined, repeated)).not.toThrow();
+    expect(() => assertNewPageToken(seen, '', repeated)).not.toThrow();
+    expect(() => assertNewPageToken(seen, 'next', repeated)).not.toThrow();
+    expect(() => assertNewPageToken(seen, 'next', repeated)).toThrow('repeated');
+    expect(() => assertNewPageToken(seen, 'start', repeated)).toThrow('repeated');
+  });
+});

package/src/pagination/index.ts

@@ -0,0 +1,15 @@
+/** Records a page token in `seen`; `false` means it repeated and following it would loop. */
+export let rememberPageToken = (seen: Set<string>, token: string) => {
+  if (seen.has(token)) return false;
+  seen.add(token);
+  return true;
+};
+
+/** Throws `repeated()` when a listing returns a page token it already returned. */
+export let assertNewPageToken = (
+  seen: Set<string>,
+  token: string | null | undefined,
+  repeated: () => unknown
+) => {
+  if (token && !rememberPageToken(seen, token)) throw repeated();
+};

package/src/specification/slate.test.ts

@@ -37,12 +37,28 @@ let createManualWebhookTriggerGroup = (spec: ReturnType<typeof createTestSpec>,
     .routingMatchers(async () => [])
     .build();
 
-let createAutoWebhookTriggerGroup = (spec: ReturnType<typeof createTestSpec>, key: string) =>
+let createAutoWebhookTriggerGroup = (
+  spec: ReturnType<typeof createTestSpec>,
+  key: string,
+  options: { deliveryConfig?: boolean } = {}
+) =>
   SlateTriggerGroup.create(spec, {
     key,
     name: key
   })
     .webhook({
+      deliveryConfig: options.deliveryConfig
+        ? {
+            userConfigSchema: z.object({}),
+            fullConfigSchema: z.object({}),
+            setup: async () => ({
+              webhookSetupDocument: '',
+              partialWebhookRegistrationPayload: {}
+            }),
+            finish: async () => ({ webhookRegistrationPayload: {} }),
+            authenticate: async () => ({ routingKeys: [] })
+          }
+        : undefined,
       autoRegistration: {
         webhookTargetList: async () => ({ targets: [], nextPageToken: null }),
         webhookRegister: async () => ({
@@ -70,10 +86,45 @@ describe('Slate.create', () => {
         triggerGroups: [first, second]
       })
     ).toThrow(
-      'Only one trigger group may use manual webhook registration, but found: manual_one, manual_two'
+      'Only one trigger group may use manual webhook registration or a delivery config, but found: manual_one, manual_two'
     );
   });
 
+  it('rejects more than one trigger group with a manual registration or delivery config', () => {
+    let spec = createTestSpec();
+    let manual = createManualWebhookTriggerGroup(spec, 'manual_group');
+    let first = createAutoWebhookTriggerGroup(spec, 'config_one', { deliveryConfig: true });
+    let second = createAutoWebhookTriggerGroup(spec, 'config_two', { deliveryConfig: true });
+    let create = (triggerGroups: (typeof manual)[]) =>
+      Slate.create({ spec, tools: [], triggers: [], triggerGroups });
+
+    expect(() => create([first, second])).toThrow(
+      'Only one trigger group may use manual webhook registration or a delivery config, but found: config_one, config_two'
+    );
+    expect(() => create([manual, first])).toThrow('but found: manual_group, config_one');
+  });
+
+  it('allows a single delivery config alongside plain automatic trigger groups', () => {
+    let spec = createTestSpec();
+    let configured = createAutoWebhookTriggerGroup(spec, 'config_group', {
+      deliveryConfig: true
+    });
+    let auto = createAutoWebhookTriggerGroup(spec, 'auto_group');
+
+    let slate = Slate.create({
+      spec,
+      tools: [],
+      triggers: [],
+      triggerGroups: [auto, configured, createAutoWebhookTriggerGroup(spec, 'other_auto')]
+    });
+
+    expect(slate.triggerGroups.map(group => group.key)).toEqual([
+      'auto_group',
+      'config_group',
+      'other_auto'
+    ]);
+  });
+
   it('allows a single manual webhook trigger group alongside other trigger groups', () => {
     let spec = createTestSpec();
     let manual = createManualWebhookTriggerGroup(spec, 'manual_group');

package/src/specification/slate.ts

@@ -63,12 +63,14 @@ export class Slate<ConfigType extends {}, AuthType extends {}> {
       seenTriggerGroupKeys.add(group.key);
     }
 
-    let manualWebhookTriggerGroups = triggerGroups.filter(
-      group => group.source === 'webhook' && group.webhook?.manualRegistration
+    let configuredWebhookTriggerGroups = triggerGroups.filter(
+      group =>
+        group.source === 'webhook' &&
+        (group.webhook?.manualRegistration || group.webhook?.deliveryConfig)
     );
-    if (manualWebhookTriggerGroups.length > 1) {
+    if (configuredWebhookTriggerGroups.length > 1) {
       throw new SlateDeclarationError(
-        `Only one trigger group may use manual webhook registration, but found: ${manualWebhookTriggerGroups
+        `Only one trigger group may use manual webhook registration or a delivery config, but found: ${configuredWebhookTriggerGroups
           .map(group => group.key)
           .join(', ')}`
       );