@smthrs/triggers 1.0.0-rc.7 → 1.0.0-rc.8

package/README.md

@@ -15,14 +15,8 @@ started run gets exactly the authority a person starting it would get.
 
 ## Install
 
-`@smthrs/triggers` is not on npm at 1.0.0-rc.0. It ships as a member of the
-[smithers repository](https://github.com/smithersai/smithers) workspace, so
-using it today means working from a checkout:
-
 ```bash
-git clone https://github.com/smithersai/smithers.git
-cd smithers
-pnpm install
+npm install @smthrs/triggers@next effect
 ```
 
 It needs Node.js 26.4.0 or later and `effect` `^4.0.4`. The full

package/dist/cjs/Webhook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Webhook.d.ts","sourceRoot":"","sources":["../../src/Webhook.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,eAAe,MAAM,0BAA0B,CAAA;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAEhE,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAE/D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAEhD,OAAO,KAAK,KAAK,OAAO,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAAI,UAAU,UAAU,EAAE,UAAU,UAAU,KAAG,OAM9E,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,CACjB,IAAI,EAAE,UAAU,EAChB,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,KACzC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;CAC7C;AAcD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,qBAAqB,GAAI,QAAQ,eAAe,KAAG,OAAO,CAAC,MA2BvE,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,MAAM,CAAC,OAAO,EAAE,QAAQ,GAAG,KAAK,CAAE,SAAQ,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC;IACtG,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAA;CACtD;AAED;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAA;IACvE,QAAQ,CAAC,MAAM,EAAE,CACf,GAAG,EAAE,OAAO,CAAC,UAAU,KACpB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAA;CACnF;AA6DD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,IAAI,GAAI,OAAO,EAAE,QAAQ,GAAG,KAAK,EAC5C,QAAQ,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,KAChC,OAgCF,CAAA"}
+{"version":3,"file":"Webhook.d.ts","sourceRoot":"","sources":["../../src/Webhook.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,eAAe,MAAM,0BAA0B,CAAA;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAEhE,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAE/D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAEhD,OAAO,KAAK,KAAK,OAAO,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAAI,UAAU,UAAU,EAAE,UAAU,UAAU,KAAG,OAM9E,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,CACjB,IAAI,EAAE,UAAU,EAChB,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,KACzC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;CAC7C;AAmCD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,qBAAqB,GAAI,QAAQ,eAAe,KAAG,OAAO,CAAC,MA2BvE,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,MAAM,CAAC,OAAO,EAAE,QAAQ,GAAG,KAAK,CAAE,SAAQ,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC;IACtG,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAA;CACtD;AAED;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAA;IACvE,QAAQ,CAAC,MAAM,EAAE,CACf,GAAG,EAAE,OAAO,CAAC,UAAU,KACpB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAA;CACnF;AA6DD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,IAAI,GAAI,OAAO,EAAE,QAAQ,GAAG,KAAK,EAC5C,QAAQ,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,KAChC,OAgCF,CAAA"}

package/dist/cjs/Webhook.js

@@ -47,6 +47,15 @@ const constantTimeEqual = (expected, supplied) => {
   return difference === 0;
 };
 const ownedCopy = (body) => Uint8Array.from(body);
+const headerValue = (headers, name) => {
+  const lower = name.toLowerCase();
+  const direct = headers[lower] ?? headers[name];
+  if (direct !== void 0) return direct;
+  for (const [key, value] of Object.entries(headers)) {
+    if (value !== void 0 && key.toLowerCase() === lower) return value;
+  }
+  return void 0;
+};
 const makeSignatureVerifier = (config) => (raw, credential) => {
   const refuse = (cause) => Effect.fail(
     new import_TriggerError.TriggerError({
@@ -56,7 +65,7 @@ const makeSignatureVerifier = (config) => (raw, credential) => {
     })
   );
   return Effect.suspend(() => {
-    const supplied = raw.headers[config.header.toLowerCase()] ?? raw.headers[config.header];
+    const supplied = headerValue(raw.headers, config.header);
     if (supplied === void 0 || supplied.length === 0) {
       return refuse();
     }

package/dist/cjs/Webhook.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/Webhook.ts"],
-  "sourcesContent": ["/**\n * Verified webhook ingestion through the authoritative Control boundary.\n *\n * @see packages/smithers/agent/triggers/docs/api.md\n * @since 0.1.0\n */\n\nimport * as ControlChannels from \"@smthrs/control/Channels\"\nimport type { ControlError } from \"@smthrs/control/ControlError\"\nimport { InvalidInput, Unauthorized } from \"@smthrs/control/ControlError\"\nimport type { Receipt, RunSummary } from \"@smthrs/control/ControlSchema\"\nimport type { CredentialRef } from \"@smthrs/control/Credential\"\nimport * as ControlWebhook from \"@smthrs/control/WebhookChannel\"\nimport * as Effect from \"effect/Effect\"\nimport type * as Redacted from \"effect/Redacted\"\nimport * as Schema from \"effect/Schema\"\nimport type * as Channel from \"./Channel.ts\"\nimport { TriggerError } from \"./TriggerError.ts\"\n\n/**\n * Compares a supplied byte string against the expected one without returning\n * early on a mismatch.\n *\n * The loop runs exactly `expected.length` times, so its iteration count is\n * fixed by the secret side of the comparison and never by the caller's. Reading\n * the longer of the two instead let a caller lengthen its input until the work\n * stopped growing, which reports the expected signature's length. The length\n * difference is folded into the result, so inputs of unequal length always\n * disagree.\n *\n * @category verification\n * @since 0.1.0\n */\nexport const constantTimeEqual = (expected: Uint8Array, supplied: Uint8Array): boolean => {\n  let difference = expected.length ^ supplied.length\n  for (const [index, byte] of expected.entries()) {\n    difference |= byte ^ (supplied[index] ?? 0)\n  }\n  return difference === 0\n}\n\n/**\n * Configuration for a raw-byte signature verifier.\n *\n * `expected` receives a private copy of the request bytes and the redacted\n * credential reference the channel was declared with, and answers with the\n * signature bytes the request must carry in `header`. It returns an Effect so\n * the secret is resolved through the host's resolver per request rather than\n * captured in a closure at declaration time, and so a resolution or HMAC\n * failure arrives as a typed `verification_failed` instead of a defect that\n * kills the fiber.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface SignatureConfig {\n  readonly header: string\n  readonly expected: (\n    body: Uint8Array,\n    credential: Redacted.Redacted<CredentialRef>\n  ) => Effect.Effect<Uint8Array, TriggerError>\n}\n\n/**\n * Copies request bytes into memory nobody else holds.\n *\n * `body.slice()` is not enough: a Node `Buffer` is a `Uint8Array` whose\n * `slice` is an alias of `subarray` and answers with a view over the same\n * memory, so a caller that reused its `Buffer` after handing it over changed\n * what got verified, and a verifier that edited the bytes it was handed edited\n * the caller's. `Uint8Array.from` always allocates, and it copies only the\n * viewed range of an offset view and only a snapshot of a `SharedArrayBuffer`.\n */\nconst ownedCopy = (body: Uint8Array): Uint8Array => Uint8Array.from(body)\n\n/**\n * Builds a verifier that compares a signature header in constant time.\n *\n * An absent or empty header is refused before `expected` runs, and an\n * `expected` that answers with zero bytes is refused after it. Neither is a\n * comparison the constant-time equality can decide: it agrees on two empty\n * byte strings, so a request carrying no signature at all would have\n * authenticated against a secret that resolved to the empty string. A\n * zero-length expected signature is a misconfigured credential, never a valid\n * one, so the door stays closed instead of opening for everyone.\n *\n * Every refusal carries the same message, `webhook signature in <header> did\n * not verify`, whatever the reason. A failure raised by `expected` is kept in\n * `cause` only: its message names the credential reference or the resolver\n * that could not produce a secret, which is a host detail, and the refusal\n * that answers a bad signature answers a broken resolver the same way.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const makeSignatureVerifier = (config: SignatureConfig): Channel.Verify => (raw, credential) => {\n  const refuse = (cause?: TriggerError) =>\n    Effect.fail(\n      new TriggerError({\n        code: \"verification_failed\",\n        message: `webhook signature in ${config.header} did not verify`,\n        ...(cause === undefined ? {} : { cause })\n      })\n    )\n  return Effect.suspend(() => {\n    const supplied = raw.headers[config.header.toLowerCase()] ?? raw.headers[config.header]\n    if (supplied === undefined || supplied.length === 0) {\n      return refuse()\n    }\n    const actual = new TextEncoder().encode(supplied)\n    // The verifier gets its own copy: nothing it does to these bytes can reach\n    // the buffer that is about to be fingerprinted and decoded.\n    return config.expected(ownedCopy(raw.body), credential).pipe(\n      Effect.matchEffect({\n        onFailure: (error) => refuse(error),\n        onSuccess: (expected) =>\n          expected.length > 0 && constantTimeEqual(expected, actual)\n            ? Effect.void\n            : refuse()\n      })\n    )\n  })\n}\n\n/**\n * Webhook declaration configuration.\n *\n * `credential` is required. It used to default to a reference named after the\n * channel, so a webhook declared without one verified against whatever\n * credential happened to share its name instead of being refused, and two\n * declarations differing only in credential verified identically.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Config<Payload, Outbound = never> extends Channel.Config<Payload, RunSummary, Outbound> {\n  readonly credential: Redacted.Redacted<CredentialRef>\n}\n\n/**\n * A webhook door that can only ingest through `Channels` and `Control`.\n *\n * @category services\n * @since 0.1.0\n */\nexport interface Webhook {\n  readonly name: string\n  readonly register: Effect.Effect<void, never, ControlChannels.Channels>\n  readonly ingest: (\n    raw: Channel.RawInbound\n  ) => Effect.Effect<Receipt, ControlError | TriggerError, ControlChannels.Channels>\n}\n\nconst invalidInput = (issue: string): InvalidInput => new InvalidInput({ issue })\n\nconst toControlChannel = <Payload, Outbound>(\n  config: Config<Payload, Outbound>\n): ControlChannels.Channel<Payload> => {\n  const channel = ControlWebhook.make({\n    name: config.name,\n    schema: config.schema,\n    credential: config.credential,\n    // The message is fixed here rather than forwarded from the verifier: a\n    // custom `verify` may say why it refused, and that reason travels toward\n    // the unauthenticated sender on the same error that answers a bad\n    // signature. `Unauthorized` carries no cause, so nothing else survives\n    // the crossing.\n    verify: (raw, credential) =>\n      config.verify(raw, credential).pipe(\n        Effect.mapError(() => new Unauthorized({ message: `webhook ${config.name} did not verify the request` }))\n      ),\n    map: (payload) => {\n      const inbound = config.inbound(payload)\n      if (\"start\" in inbound) {\n        return Effect.succeed({\n          _tag: \"Start\" as const,\n          flowId: inbound.start.flowId,\n          input: inbound.start.input\n        })\n      }\n      return Schema.decodeUnknownEffect(Schema.Json)(inbound.signal.value).pipe(\n        Effect.map(\n          (value) => ({\n            _tag: \"Signal\" as const,\n            runId: inbound.signal.runId,\n            signal: {\n              name: inbound.signal.stepId,\n              payload: value\n            }\n          })\n        ),\n        Effect.mapError((error) => invalidInput(String(error)))\n      )\n    },\n    project: (run) => {\n      if (config.outbound === undefined) {\n        return {\n          cursor: String(run.updatedAt),\n          operation: \"noop\" as const,\n          message: null\n        }\n      }\n      return {\n        cursor: String(run.updatedAt),\n        operation: \"post\" as const,\n        message: config.outbound(run)\n      }\n    }\n  })\n  return channel\n}\n\n/**\n * Builds a webhook door whose only dispatch path is the Control channel\n * coordinator.\n *\n * Verification occurs inside `Channels.ingest` before the adapter's JSON or\n * schema decoder and before any Control operation.\n *\n * `ingest` does not register: a channel is registered once, deliberately,\n * through {@link Webhook.register}, so traffic to an unregistered channel is\n * reported as unavailable rather than silently self-registering the door it\n * arrived at.\n *\n * `ingest` also copies `body`, `headers`, and `idempotencyKey` before anything\n * reads them. Verification, delivery fingerprinting, and decoding then all see\n * one private snapshot, so a verifier that edits the bytes it was handed, or a\n * caller that mutates its own object between building this Effect and running\n * it, cannot authenticate one payload and have another decoded. A\n * `SharedArrayBuffer`-backed view is copied out of shared memory by the same\n * step.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const make = <Payload, Outbound = never>(\n  config: Config<Payload, Outbound>\n): Webhook => {\n  const channel = toControlChannel(config)\n  const register = Effect.flatMap(ControlChannels.Channels, (channels) => channels.register(channel))\n  return {\n    name: config.name,\n    register,\n    ingest: (raw) => {\n      // Copied here rather than inside the Effect: the copy has to happen when\n      // the caller hands the request over, not when the returned Effect\n      // eventually runs, or a caller that reuses its own buffer in between\n      // changes what gets authenticated.\n      const snapshot: Channel.RawInbound = {\n        body: ownedCopy(raw.body),\n        headers: { ...raw.headers },\n        idempotencyKey: raw.idempotencyKey\n      }\n      return Effect.gen(function*() {\n        const channels = yield* ControlChannels.Channels\n        return yield* channels.ingest({ channel: config.name, raw: snapshot })\n      }).pipe(\n        Effect.mapError((error) =>\n          error instanceof Unauthorized\n            ? new TriggerError({\n              code: \"verification_failed\",\n              message: `webhook ${config.name} did not verify the request`,\n              cause: error\n            })\n            : error\n        )\n      )\n    }\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,sBAAiC;AAEjC,0BAA2C;AAG3C,qBAAgC;AAChC,aAAwB;AAExB,aAAwB;AAExB,0BAA6B;AAgBtB,MAAM,oBAAoB,CAAC,UAAsB,aAAkC;AACxF,MAAI,aAAa,SAAS,SAAS,SAAS;AAC5C,aAAW,CAAC,OAAO,IAAI,KAAK,SAAS,QAAQ,GAAG;AAC9C,kBAAc,QAAQ,SAAS,KAAK,KAAK;AAAA,EAC3C;AACA,SAAO,eAAe;AACxB;AAkCA,MAAM,YAAY,CAAC,SAAiC,WAAW,KAAK,IAAI;AAsBjE,MAAM,wBAAwB,CAAC,WAA4C,CAAC,KAAK,eAAe;AACrG,QAAM,SAAS,CAAC,UACd,OAAO;AAAA,IACL,IAAI,iCAAa;AAAA,MACf,MAAM;AAAA,MACN,SAAS,wBAAwB,OAAO,MAAM;AAAA,MAC9C,GAAI,UAAU,SAAY,CAAC,IAAI,EAAE,MAAM;AAAA,IACzC,CAAC;AAAA,EACH;AACF,SAAO,OAAO,QAAQ,MAAM;AAC1B,UAAM,WAAW,IAAI,QAAQ,OAAO,OAAO,YAAY,CAAC,KAAK,IAAI,QAAQ,OAAO,MAAM;AACtF,QAAI,aAAa,UAAa,SAAS,WAAW,GAAG;AACnD,aAAO,OAAO;AAAA,IAChB;AACA,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,QAAQ;AAGhD,WAAO,OAAO,SAAS,UAAU,IAAI,IAAI,GAAG,UAAU,EAAE;AAAA,MACtD,OAAO,YAAY;AAAA,QACjB,WAAW,CAAC,UAAU,OAAO,KAAK;AAAA,QAClC,WAAW,CAAC,aACV,SAAS,SAAS,KAAK,kBAAkB,UAAU,MAAM,IACrD,OAAO,OACP,OAAO;AAAA,MACf,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AA+BA,MAAM,eAAe,CAAC,UAAgC,IAAI,iCAAa,EAAE,MAAM,CAAC;AAEhF,MAAM,mBAAmB,CACvB,WACqC;AACrC,QAAM,UAAU,eAAe,KAAK;AAAA,IAClC,MAAM,OAAO;AAAA,IACb,QAAQ,OAAO;AAAA,IACf,YAAY,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMnB,QAAQ,CAAC,KAAK,eACZ,OAAO,OAAO,KAAK,UAAU,EAAE;AAAA,MAC7B,OAAO,SAAS,MAAM,IAAI,iCAAa,EAAE,SAAS,WAAW,OAAO,IAAI,8BAA8B,CAAC,CAAC;AAAA,IAC1G;AAAA,IACF,KAAK,CAAC,YAAY;AAChB,YAAM,UAAU,OAAO,QAAQ,OAAO;AACtC,UAAI,WAAW,SAAS;AACtB,eAAO,OAAO,QAAQ;AAAA,UACpB,MAAM;AAAA,UACN,QAAQ,QAAQ,MAAM;AAAA,UACtB,OAAO,QAAQ,MAAM;AAAA,QACvB,CAAC;AAAA,MACH;AACA,aAAO,OAAO,oBAAoB,OAAO,IAAI,EAAE,QAAQ,OAAO,KAAK,EAAE;AAAA,QACnE,OAAO;AAAA,UACL,CAAC,WAAW;AAAA,YACV,MAAM;AAAA,YACN,OAAO,QAAQ,OAAO;AAAA,YACtB,QAAQ;AAAA,cACN,MAAM,QAAQ,OAAO;AAAA,cACrB,SAAS;AAAA,YACX;AAAA,UACF;AAAA,QACF;AAAA,QACA,OAAO,SAAS,CAAC,UAAU,aAAa,OAAO,KAAK,CAAC,CAAC;AAAA,MACxD;AAAA,IACF;AAAA,IACA,SAAS,CAAC,QAAQ;AAChB,UAAI,OAAO,aAAa,QAAW;AACjC,eAAO;AAAA,UACL,QAAQ,OAAO,IAAI,SAAS;AAAA,UAC5B,WAAW;AAAA,UACX,SAAS;AAAA,QACX;AAAA,MACF;AACA,aAAO;AAAA,QACL,QAAQ,OAAO,IAAI,SAAS;AAAA,QAC5B,WAAW;AAAA,QACX,SAAS,OAAO,SAAS,GAAG;AAAA,MAC9B;AAAA,IACF;AAAA,EACF,CAAC;AACD,SAAO;AACT;AAyBO,MAAM,OAAO,CAClB,WACY;AACZ,QAAM,UAAU,iBAAiB,MAAM;AACvC,QAAM,WAAW,OAAO,QAAQ,gBAAgB,UAAU,CAAC,aAAa,SAAS,SAAS,OAAO,CAAC;AAClG,SAAO;AAAA,IACL,MAAM,OAAO;AAAA,IACb;AAAA,IACA,QAAQ,CAAC,QAAQ;AAKf,YAAM,WAA+B;AAAA,QACnC,MAAM,UAAU,IAAI,IAAI;AAAA,QACxB,SAAS,EAAE,GAAG,IAAI,QAAQ;AAAA,QAC1B,gBAAgB,IAAI;AAAA,MACtB;AACA,aAAO,OAAO,IAAI,aAAY;AAC5B,cAAM,WAAW,OAAO,gBAAgB;AACxC,eAAO,OAAO,SAAS,OAAO,EAAE,SAAS,OAAO,MAAM,KAAK,SAAS,CAAC;AAAA,MACvE,CAAC,EAAE;AAAA,QACD,OAAO;AAAA,UAAS,CAAC,UACf,iBAAiB,mCACb,IAAI,iCAAa;AAAA,YACjB,MAAM;AAAA,YACN,SAAS,WAAW,OAAO,IAAI;AAAA,YAC/B,OAAO;AAAA,UACT,CAAC,IACC;AAAA,QACN;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Verified webhook ingestion through the authoritative Control boundary.\n *\n * @see packages/smithers/agent/triggers/docs/api.md\n * @since 0.1.0\n */\n\nimport * as ControlChannels from \"@smthrs/control/Channels\"\nimport type { ControlError } from \"@smthrs/control/ControlError\"\nimport { InvalidInput, Unauthorized } from \"@smthrs/control/ControlError\"\nimport type { Receipt, RunSummary } from \"@smthrs/control/ControlSchema\"\nimport type { CredentialRef } from \"@smthrs/control/Credential\"\nimport * as ControlWebhook from \"@smthrs/control/WebhookChannel\"\nimport * as Effect from \"effect/Effect\"\nimport type * as Redacted from \"effect/Redacted\"\nimport * as Schema from \"effect/Schema\"\nimport type * as Channel from \"./Channel.ts\"\nimport { TriggerError } from \"./TriggerError.ts\"\n\n/**\n * Compares a supplied byte string against the expected one without returning\n * early on a mismatch.\n *\n * The loop runs exactly `expected.length` times, so its iteration count is\n * fixed by the secret side of the comparison and never by the caller's. Reading\n * the longer of the two instead let a caller lengthen its input until the work\n * stopped growing, which reports the expected signature's length. The length\n * difference is folded into the result, so inputs of unequal length always\n * disagree.\n *\n * @category verification\n * @since 0.1.0\n */\nexport const constantTimeEqual = (expected: Uint8Array, supplied: Uint8Array): boolean => {\n  let difference = expected.length ^ supplied.length\n  for (const [index, byte] of expected.entries()) {\n    difference |= byte ^ (supplied[index] ?? 0)\n  }\n  return difference === 0\n}\n\n/**\n * Configuration for a raw-byte signature verifier.\n *\n * `expected` receives a private copy of the request bytes and the redacted\n * credential reference the channel was declared with, and answers with the\n * signature bytes the request must carry in `header`. It returns an Effect so\n * the secret is resolved through the host's resolver per request rather than\n * captured in a closure at declaration time, and so a resolution or HMAC\n * failure arrives as a typed `verification_failed` instead of a defect that\n * kills the fiber.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface SignatureConfig {\n  readonly header: string\n  readonly expected: (\n    body: Uint8Array,\n    credential: Redacted.Redacted<CredentialRef>\n  ) => Effect.Effect<Uint8Array, TriggerError>\n}\n\n/**\n * Copies request bytes into memory nobody else holds.\n *\n * `body.slice()` is not enough: a Node `Buffer` is a `Uint8Array` whose\n * `slice` is an alias of `subarray` and answers with a view over the same\n * memory, so a caller that reused its `Buffer` after handing it over changed\n * what got verified, and a verifier that edited the bytes it was handed edited\n * the caller's. `Uint8Array.from` always allocates, and it copies only the\n * viewed range of an offset view and only a snapshot of a `SharedArrayBuffer`.\n */\nconst ownedCopy = (body: Uint8Array): Uint8Array => Uint8Array.from(body)\n\n/**\n * Reads a header whose name may be spelled in any case.\n *\n * The lowercase form and the declared spelling are tried first, then every\n * other key whose lowercase form matches. HTTP header names are\n * case-insensitive, and a host that keeps the sender's capitalisation used to\n * fail a lowercase declaration.\n */\nconst headerValue = (\n  headers: Channel.RawInbound[\"headers\"],\n  name: string\n): string | undefined => {\n  const lower = name.toLowerCase()\n  const direct = headers[lower] ?? headers[name]\n  if (direct !== undefined) return direct\n  for (const [key, value] of Object.entries(headers)) {\n    if (value !== undefined && key.toLowerCase() === lower) return value\n  }\n  return undefined\n}\n\n/**\n * Builds a verifier that compares a signature header in constant time.\n *\n * An absent or empty header is refused before `expected` runs, and an\n * `expected` that answers with zero bytes is refused after it. Neither is a\n * comparison the constant-time equality can decide: it agrees on two empty\n * byte strings, so a request carrying no signature at all would have\n * authenticated against a secret that resolved to the empty string. A\n * zero-length expected signature is a misconfigured credential, never a valid\n * one, so the door stays closed instead of opening for everyone.\n *\n * Every refusal carries the same message, `webhook signature in <header> did\n * not verify`, whatever the reason. A failure raised by `expected` is kept in\n * `cause` only: its message names the credential reference or the resolver\n * that could not produce a secret, which is a host detail, and the refusal\n * that answers a bad signature answers a broken resolver the same way.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const makeSignatureVerifier = (config: SignatureConfig): Channel.Verify => (raw, credential) => {\n  const refuse = (cause?: TriggerError) =>\n    Effect.fail(\n      new TriggerError({\n        code: \"verification_failed\",\n        message: `webhook signature in ${config.header} did not verify`,\n        ...(cause === undefined ? {} : { cause })\n      })\n    )\n  return Effect.suspend(() => {\n    const supplied = headerValue(raw.headers, config.header)\n    if (supplied === undefined || supplied.length === 0) {\n      return refuse()\n    }\n    const actual = new TextEncoder().encode(supplied)\n    // The verifier gets its own copy: nothing it does to these bytes can reach\n    // the buffer that is about to be fingerprinted and decoded.\n    return config.expected(ownedCopy(raw.body), credential).pipe(\n      Effect.matchEffect({\n        onFailure: (error) => refuse(error),\n        onSuccess: (expected) =>\n          expected.length > 0 && constantTimeEqual(expected, actual)\n            ? Effect.void\n            : refuse()\n      })\n    )\n  })\n}\n\n/**\n * Webhook declaration configuration.\n *\n * `credential` is required. It used to default to a reference named after the\n * channel, so a webhook declared without one verified against whatever\n * credential happened to share its name instead of being refused, and two\n * declarations differing only in credential verified identically.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Config<Payload, Outbound = never> extends Channel.Config<Payload, RunSummary, Outbound> {\n  readonly credential: Redacted.Redacted<CredentialRef>\n}\n\n/**\n * A webhook door that can only ingest through `Channels` and `Control`.\n *\n * @category services\n * @since 0.1.0\n */\nexport interface Webhook {\n  readonly name: string\n  readonly register: Effect.Effect<void, never, ControlChannels.Channels>\n  readonly ingest: (\n    raw: Channel.RawInbound\n  ) => Effect.Effect<Receipt, ControlError | TriggerError, ControlChannels.Channels>\n}\n\nconst invalidInput = (issue: string): InvalidInput => new InvalidInput({ issue })\n\nconst toControlChannel = <Payload, Outbound>(\n  config: Config<Payload, Outbound>\n): ControlChannels.Channel<Payload> => {\n  const channel = ControlWebhook.make({\n    name: config.name,\n    schema: config.schema,\n    credential: config.credential,\n    // The message is fixed here rather than forwarded from the verifier: a\n    // custom `verify` may say why it refused, and that reason travels toward\n    // the unauthenticated sender on the same error that answers a bad\n    // signature. `Unauthorized` carries no cause, so nothing else survives\n    // the crossing.\n    verify: (raw, credential) =>\n      config.verify(raw, credential).pipe(\n        Effect.mapError(() => new Unauthorized({ message: `webhook ${config.name} did not verify the request` }))\n      ),\n    map: (payload) => {\n      const inbound = config.inbound(payload)\n      if (\"start\" in inbound) {\n        return Effect.succeed({\n          _tag: \"Start\" as const,\n          flowId: inbound.start.flowId,\n          input: inbound.start.input\n        })\n      }\n      return Schema.decodeUnknownEffect(Schema.Json)(inbound.signal.value).pipe(\n        Effect.map(\n          (value) => ({\n            _tag: \"Signal\" as const,\n            runId: inbound.signal.runId,\n            signal: {\n              name: inbound.signal.stepId,\n              payload: value\n            }\n          })\n        ),\n        Effect.mapError((error) => invalidInput(String(error)))\n      )\n    },\n    project: (run) => {\n      if (config.outbound === undefined) {\n        return {\n          cursor: String(run.updatedAt),\n          operation: \"noop\" as const,\n          message: null\n        }\n      }\n      return {\n        cursor: String(run.updatedAt),\n        operation: \"post\" as const,\n        message: config.outbound(run)\n      }\n    }\n  })\n  return channel\n}\n\n/**\n * Builds a webhook door whose only dispatch path is the Control channel\n * coordinator.\n *\n * Verification occurs inside `Channels.ingest` before the adapter's JSON or\n * schema decoder and before any Control operation.\n *\n * `ingest` does not register: a channel is registered once, deliberately,\n * through {@link Webhook.register}, so traffic to an unregistered channel is\n * reported as unavailable rather than silently self-registering the door it\n * arrived at.\n *\n * `ingest` also copies `body`, `headers`, and `idempotencyKey` before anything\n * reads them. Verification, delivery fingerprinting, and decoding then all see\n * one private snapshot, so a verifier that edits the bytes it was handed, or a\n * caller that mutates its own object between building this Effect and running\n * it, cannot authenticate one payload and have another decoded. A\n * `SharedArrayBuffer`-backed view is copied out of shared memory by the same\n * step.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const make = <Payload, Outbound = never>(\n  config: Config<Payload, Outbound>\n): Webhook => {\n  const channel = toControlChannel(config)\n  const register = Effect.flatMap(ControlChannels.Channels, (channels) => channels.register(channel))\n  return {\n    name: config.name,\n    register,\n    ingest: (raw) => {\n      // Copied here rather than inside the Effect: the copy has to happen when\n      // the caller hands the request over, not when the returned Effect\n      // eventually runs, or a caller that reuses its own buffer in between\n      // changes what gets authenticated.\n      const snapshot: Channel.RawInbound = {\n        body: ownedCopy(raw.body),\n        headers: { ...raw.headers },\n        idempotencyKey: raw.idempotencyKey\n      }\n      return Effect.gen(function*() {\n        const channels = yield* ControlChannels.Channels\n        return yield* channels.ingest({ channel: config.name, raw: snapshot })\n      }).pipe(\n        Effect.mapError((error) =>\n          error instanceof Unauthorized\n            ? new TriggerError({\n              code: \"verification_failed\",\n              message: `webhook ${config.name} did not verify the request`,\n              cause: error\n            })\n            : error\n        )\n      )\n    }\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,sBAAiC;AAEjC,0BAA2C;AAG3C,qBAAgC;AAChC,aAAwB;AAExB,aAAwB;AAExB,0BAA6B;AAgBtB,MAAM,oBAAoB,CAAC,UAAsB,aAAkC;AACxF,MAAI,aAAa,SAAS,SAAS,SAAS;AAC5C,aAAW,CAAC,OAAO,IAAI,KAAK,SAAS,QAAQ,GAAG;AAC9C,kBAAc,QAAQ,SAAS,KAAK,KAAK;AAAA,EAC3C;AACA,SAAO,eAAe;AACxB;AAkCA,MAAM,YAAY,CAAC,SAAiC,WAAW,KAAK,IAAI;AAUxE,MAAM,cAAc,CAClB,SACA,SACuB;AACvB,QAAM,QAAQ,KAAK,YAAY;AAC/B,QAAM,SAAS,QAAQ,KAAK,KAAK,QAAQ,IAAI;AAC7C,MAAI,WAAW,OAAW,QAAO;AACjC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,UAAU,UAAa,IAAI,YAAY,MAAM,MAAO,QAAO;AAAA,EACjE;AACA,SAAO;AACT;AAsBO,MAAM,wBAAwB,CAAC,WAA4C,CAAC,KAAK,eAAe;AACrG,QAAM,SAAS,CAAC,UACd,OAAO;AAAA,IACL,IAAI,iCAAa;AAAA,MACf,MAAM;AAAA,MACN,SAAS,wBAAwB,OAAO,MAAM;AAAA,MAC9C,GAAI,UAAU,SAAY,CAAC,IAAI,EAAE,MAAM;AAAA,IACzC,CAAC;AAAA,EACH;AACF,SAAO,OAAO,QAAQ,MAAM;AAC1B,UAAM,WAAW,YAAY,IAAI,SAAS,OAAO,MAAM;AACvD,QAAI,aAAa,UAAa,SAAS,WAAW,GAAG;AACnD,aAAO,OAAO;AAAA,IAChB;AACA,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,QAAQ;AAGhD,WAAO,OAAO,SAAS,UAAU,IAAI,IAAI,GAAG,UAAU,EAAE;AAAA,MACtD,OAAO,YAAY;AAAA,QACjB,WAAW,CAAC,UAAU,OAAO,KAAK;AAAA,QAClC,WAAW,CAAC,aACV,SAAS,SAAS,KAAK,kBAAkB,UAAU,MAAM,IACrD,OAAO,OACP,OAAO;AAAA,MACf,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AA+BA,MAAM,eAAe,CAAC,UAAgC,IAAI,iCAAa,EAAE,MAAM,CAAC;AAEhF,MAAM,mBAAmB,CACvB,WACqC;AACrC,QAAM,UAAU,eAAe,KAAK;AAAA,IAClC,MAAM,OAAO;AAAA,IACb,QAAQ,OAAO;AAAA,IACf,YAAY,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMnB,QAAQ,CAAC,KAAK,eACZ,OAAO,OAAO,KAAK,UAAU,EAAE;AAAA,MAC7B,OAAO,SAAS,MAAM,IAAI,iCAAa,EAAE,SAAS,WAAW,OAAO,IAAI,8BAA8B,CAAC,CAAC;AAAA,IAC1G;AAAA,IACF,KAAK,CAAC,YAAY;AAChB,YAAM,UAAU,OAAO,QAAQ,OAAO;AACtC,UAAI,WAAW,SAAS;AACtB,eAAO,OAAO,QAAQ;AAAA,UACpB,MAAM;AAAA,UACN,QAAQ,QAAQ,MAAM;AAAA,UACtB,OAAO,QAAQ,MAAM;AAAA,QACvB,CAAC;AAAA,MACH;AACA,aAAO,OAAO,oBAAoB,OAAO,IAAI,EAAE,QAAQ,OAAO,KAAK,EAAE;AAAA,QACnE,OAAO;AAAA,UACL,CAAC,WAAW;AAAA,YACV,MAAM;AAAA,YACN,OAAO,QAAQ,OAAO;AAAA,YACtB,QAAQ;AAAA,cACN,MAAM,QAAQ,OAAO;AAAA,cACrB,SAAS;AAAA,YACX;AAAA,UACF;AAAA,QACF;AAAA,QACA,OAAO,SAAS,CAAC,UAAU,aAAa,OAAO,KAAK,CAAC,CAAC;AAAA,MACxD;AAAA,IACF;AAAA,IACA,SAAS,CAAC,QAAQ;AAChB,UAAI,OAAO,aAAa,QAAW;AACjC,eAAO;AAAA,UACL,QAAQ,OAAO,IAAI,SAAS;AAAA,UAC5B,WAAW;AAAA,UACX,SAAS;AAAA,QACX;AAAA,MACF;AACA,aAAO;AAAA,QACL,QAAQ,OAAO,IAAI,SAAS;AAAA,QAC5B,WAAW;AAAA,QACX,SAAS,OAAO,SAAS,GAAG;AAAA,MAC9B;AAAA,IACF;AAAA,EACF,CAAC;AACD,SAAO;AACT;AAyBO,MAAM,OAAO,CAClB,WACY;AACZ,QAAM,UAAU,iBAAiB,MAAM;AACvC,QAAM,WAAW,OAAO,QAAQ,gBAAgB,UAAU,CAAC,aAAa,SAAS,SAAS,OAAO,CAAC;AAClG,SAAO;AAAA,IACL,MAAM,OAAO;AAAA,IACb;AAAA,IACA,QAAQ,CAAC,QAAQ;AAKf,YAAM,WAA+B;AAAA,QACnC,MAAM,UAAU,IAAI,IAAI;AAAA,QACxB,SAAS,EAAE,GAAG,IAAI,QAAQ;AAAA,QAC1B,gBAAgB,IAAI;AAAA,MACtB;AACA,aAAO,OAAO,IAAI,aAAY;AAC5B,cAAM,WAAW,OAAO,gBAAgB;AACxC,eAAO,OAAO,SAAS,OAAO,EAAE,SAAS,OAAO,MAAM,KAAK,SAAS,CAAC;AAAA,MACvE,CAAC,EAAE;AAAA,QACD,OAAO;AAAA,UAAS,CAAC,UACf,iBAAiB,mCACb,IAAI,iCAAa;AAAA,YACjB,MAAM;AAAA,YACN,SAAS,WAAW,OAAO,IAAI;AAAA,YAC/B,OAAO;AAAA,UACT,CAAC,IACC;AAAA,QACN;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/esm/Webhook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Webhook.d.ts","sourceRoot":"","sources":["../../src/Webhook.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,eAAe,MAAM,0BAA0B,CAAA;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAEhE,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAE/D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAEhD,OAAO,KAAK,KAAK,OAAO,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAAI,UAAU,UAAU,EAAE,UAAU,UAAU,KAAG,OAM9E,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,CACjB,IAAI,EAAE,UAAU,EAChB,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,KACzC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;CAC7C;AAcD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,qBAAqB,GAAI,QAAQ,eAAe,KAAG,OAAO,CAAC,MA2BvE,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,MAAM,CAAC,OAAO,EAAE,QAAQ,GAAG,KAAK,CAAE,SAAQ,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC;IACtG,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAA;CACtD;AAED;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAA;IACvE,QAAQ,CAAC,MAAM,EAAE,CACf,GAAG,EAAE,OAAO,CAAC,UAAU,KACpB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAA;CACnF;AA6DD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,IAAI,GAAI,OAAO,EAAE,QAAQ,GAAG,KAAK,EAC5C,QAAQ,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,KAChC,OAgCF,CAAA"}
+{"version":3,"file":"Webhook.d.ts","sourceRoot":"","sources":["../../src/Webhook.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,eAAe,MAAM,0BAA0B,CAAA;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAEhE,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAE/D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAEhD,OAAO,KAAK,KAAK,OAAO,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAAI,UAAU,UAAU,EAAE,UAAU,UAAU,KAAG,OAM9E,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,CACjB,IAAI,EAAE,UAAU,EAChB,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,KACzC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;CAC7C;AAmCD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,qBAAqB,GAAI,QAAQ,eAAe,KAAG,OAAO,CAAC,MA2BvE,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,MAAM,CAAC,OAAO,EAAE,QAAQ,GAAG,KAAK,CAAE,SAAQ,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC;IACtG,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAA;CACtD;AAED;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAA;IACvE,QAAQ,CAAC,MAAM,EAAE,CACf,GAAG,EAAE,OAAO,CAAC,UAAU,KACpB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAA;CACnF;AA6DD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,IAAI,GAAI,OAAO,EAAE,QAAQ,GAAG,KAAK,EAC5C,QAAQ,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,KAChC,OAgCF,CAAA"}

package/dist/esm/Webhook.js

@@ -42,6 +42,25 @@ export const constantTimeEqual = (expected, supplied) => {
  * viewed range of an offset view and only a snapshot of a `SharedArrayBuffer`.
  */
 const ownedCopy = (body) => Uint8Array.from(body);
+/**
+ * Reads a header whose name may be spelled in any case.
+ *
+ * The lowercase form and the declared spelling are tried first, then every
+ * other key whose lowercase form matches. HTTP header names are
+ * case-insensitive, and a host that keeps the sender's capitalisation used to
+ * fail a lowercase declaration.
+ */
+const headerValue = (headers, name) => {
+    const lower = name.toLowerCase();
+    const direct = headers[lower] ?? headers[name];
+    if (direct !== undefined)
+        return direct;
+    for (const [key, value] of Object.entries(headers)) {
+        if (value !== undefined && key.toLowerCase() === lower)
+            return value;
+    }
+    return undefined;
+};
 /**
  * Builds a verifier that compares a signature header in constant time.
  *
@@ -69,7 +88,7 @@ export const makeSignatureVerifier = (config) => (raw, credential) => {
         ...(cause === undefined ? {} : { cause })
     }));
     return Effect.suspend(() => {
-        const supplied = raw.headers[config.header.toLowerCase()] ?? raw.headers[config.header];
+        const supplied = headerValue(raw.headers, config.header);
         if (supplied === undefined || supplied.length === 0) {
             return refuse();
         }

package/dist/esm/Webhook.js.map

@@ -1 +1 @@
-{"version":3,"file":"Webhook.js","sourceRoot":"","sources":["../../src/Webhook.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,eAAe,MAAM,0BAA0B,CAAA;AAE3D,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAGzE,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAA;AAChE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAoB,EAAE,QAAoB,EAAW,EAAE;IACvF,IAAI,UAAU,GAAG,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;IAClD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,UAAU,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7C,CAAC;IACD,OAAO,UAAU,KAAK,CAAC,CAAA;AACzB,CAAC,CAAA;AAwBD;;;;;;;;;GASG;AACH,MAAM,SAAS,GAAG,CAAC,IAAgB,EAAc,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEzE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAuB,EAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE;IACpG,MAAM,MAAM,GAAG,CAAC,KAAoB,EAAE,EAAE,CACtC,MAAM,CAAC,IAAI,CACT,IAAI,YAAY,CAAC;QACf,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,wBAAwB,MAAM,CAAC,MAAM,iBAAiB;QAC/D,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;KAC1C,CAAC,CACH,CAAA;IACH,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;QACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACvF,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,MAAM,EAAE,CAAA;QACjB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QACjD,2EAA2E;QAC3E,4DAA4D;QAC5D,OAAO,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,CAC1D,MAAM,CAAC,WAAW,CAAC;YACjB,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;YACnC,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE,CACtB,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACxD,CAAC,CAAC,MAAM,CAAC,IAAI;gBACb,CAAC,CAAC,MAAM,EAAE;SACf,CAAC,CACH,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AA+BD,MAAM,YAAY,GAAG,CAAC,KAAa,EAAgB,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;AAEjF,MAAM,gBAAgB,GAAG,CACvB,MAAiC,EACC,EAAE;IACpC,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC;QAClC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,uEAAuE;QACvE,yEAAyE;QACzE,kEAAkE;QAClE,uEAAuE;QACvE,gBAAgB;QAChB,MAAM,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAC1B,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,IAAI,CACjC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,WAAW,MAAM,CAAC,IAAI,6BAA6B,EAAE,CAAC,CAAC,CAC1G;QACH,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE;YACf,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YACvC,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;gBACvB,OAAO,MAAM,CAAC,OAAO,CAAC;oBACpB,IAAI,EAAE,OAAgB;oBACtB,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;oBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;iBAC3B,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CACvE,MAAM,CAAC,GAAG,CACR,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACV,IAAI,EAAE,QAAiB;gBACvB,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK;gBAC3B,MAAM,EAAE;oBACN,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;oBAC3B,OAAO,EAAE,KAAK;iBACf;aACF,CAAC,CACH,EACD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CACxD,CAAA;QACH,CAAC;QACD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACf,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO;oBACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;oBAC7B,SAAS,EAAE,MAAe;oBAC1B,OAAO,EAAE,IAAI;iBACd,CAAA;YACH,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;gBAC7B,SAAS,EAAE,MAAe;gBAC1B,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;aAC9B,CAAA;QACH,CAAC;KACF,CAAC,CAAA;IACF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAClB,MAAiC,EACxB,EAAE;IACX,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAA;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;IACnG,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ;QACR,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE;YACd,yEAAyE;YACzE,kEAAkE;YAClE,qEAAqE;YACrE,mCAAmC;YACnC,MAAM,QAAQ,GAAuB;gBACnC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;gBACzB,OAAO,EAAE,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE;gBAC3B,cAAc,EAAE,GAAG,CAAC,cAAc;aACnC,CAAA;YACD,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAA;gBAChD,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAA;YACxE,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,KAAK,YAAY,YAAY;gBAC3B,CAAC,CAAC,IAAI,YAAY,CAAC;oBACjB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,WAAW,MAAM,CAAC,IAAI,6BAA6B;oBAC5D,KAAK,EAAE,KAAK;iBACb,CAAC;gBACF,CAAC,CAAC,KAAK,CACV,CACF,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC,CAAA","sourcesContent":["/**\n * Verified webhook ingestion through the authoritative Control boundary.\n *\n * @see packages/smithers/agent/triggers/docs/api.md\n * @since 0.1.0\n */\n\nimport * as ControlChannels from \"@smthrs/control/Channels\"\nimport type { ControlError } from \"@smthrs/control/ControlError\"\nimport { InvalidInput, Unauthorized } from \"@smthrs/control/ControlError\"\nimport type { Receipt, RunSummary } from \"@smthrs/control/ControlSchema\"\nimport type { CredentialRef } from \"@smthrs/control/Credential\"\nimport * as ControlWebhook from \"@smthrs/control/WebhookChannel\"\nimport * as Effect from \"effect/Effect\"\nimport type * as Redacted from \"effect/Redacted\"\nimport * as Schema from \"effect/Schema\"\nimport type * as Channel from \"./Channel.ts\"\nimport { TriggerError } from \"./TriggerError.ts\"\n\n/**\n * Compares a supplied byte string against the expected one without returning\n * early on a mismatch.\n *\n * The loop runs exactly `expected.length` times, so its iteration count is\n * fixed by the secret side of the comparison and never by the caller's. Reading\n * the longer of the two instead let a caller lengthen its input until the work\n * stopped growing, which reports the expected signature's length. The length\n * difference is folded into the result, so inputs of unequal length always\n * disagree.\n *\n * @category verification\n * @since 0.1.0\n */\nexport const constantTimeEqual = (expected: Uint8Array, supplied: Uint8Array): boolean => {\n  let difference = expected.length ^ supplied.length\n  for (const [index, byte] of expected.entries()) {\n    difference |= byte ^ (supplied[index] ?? 0)\n  }\n  return difference === 0\n}\n\n/**\n * Configuration for a raw-byte signature verifier.\n *\n * `expected` receives a private copy of the request bytes and the redacted\n * credential reference the channel was declared with, and answers with the\n * signature bytes the request must carry in `header`. It returns an Effect so\n * the secret is resolved through the host's resolver per request rather than\n * captured in a closure at declaration time, and so a resolution or HMAC\n * failure arrives as a typed `verification_failed` instead of a defect that\n * kills the fiber.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface SignatureConfig {\n  readonly header: string\n  readonly expected: (\n    body: Uint8Array,\n    credential: Redacted.Redacted<CredentialRef>\n  ) => Effect.Effect<Uint8Array, TriggerError>\n}\n\n/**\n * Copies request bytes into memory nobody else holds.\n *\n * `body.slice()` is not enough: a Node `Buffer` is a `Uint8Array` whose\n * `slice` is an alias of `subarray` and answers with a view over the same\n * memory, so a caller that reused its `Buffer` after handing it over changed\n * what got verified, and a verifier that edited the bytes it was handed edited\n * the caller's. `Uint8Array.from` always allocates, and it copies only the\n * viewed range of an offset view and only a snapshot of a `SharedArrayBuffer`.\n */\nconst ownedCopy = (body: Uint8Array): Uint8Array => Uint8Array.from(body)\n\n/**\n * Builds a verifier that compares a signature header in constant time.\n *\n * An absent or empty header is refused before `expected` runs, and an\n * `expected` that answers with zero bytes is refused after it. Neither is a\n * comparison the constant-time equality can decide: it agrees on two empty\n * byte strings, so a request carrying no signature at all would have\n * authenticated against a secret that resolved to the empty string. A\n * zero-length expected signature is a misconfigured credential, never a valid\n * one, so the door stays closed instead of opening for everyone.\n *\n * Every refusal carries the same message, `webhook signature in <header> did\n * not verify`, whatever the reason. A failure raised by `expected` is kept in\n * `cause` only: its message names the credential reference or the resolver\n * that could not produce a secret, which is a host detail, and the refusal\n * that answers a bad signature answers a broken resolver the same way.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const makeSignatureVerifier = (config: SignatureConfig): Channel.Verify => (raw, credential) => {\n  const refuse = (cause?: TriggerError) =>\n    Effect.fail(\n      new TriggerError({\n        code: \"verification_failed\",\n        message: `webhook signature in ${config.header} did not verify`,\n        ...(cause === undefined ? {} : { cause })\n      })\n    )\n  return Effect.suspend(() => {\n    const supplied = raw.headers[config.header.toLowerCase()] ?? raw.headers[config.header]\n    if (supplied === undefined || supplied.length === 0) {\n      return refuse()\n    }\n    const actual = new TextEncoder().encode(supplied)\n    // The verifier gets its own copy: nothing it does to these bytes can reach\n    // the buffer that is about to be fingerprinted and decoded.\n    return config.expected(ownedCopy(raw.body), credential).pipe(\n      Effect.matchEffect({\n        onFailure: (error) => refuse(error),\n        onSuccess: (expected) =>\n          expected.length > 0 && constantTimeEqual(expected, actual)\n            ? Effect.void\n            : refuse()\n      })\n    )\n  })\n}\n\n/**\n * Webhook declaration configuration.\n *\n * `credential` is required. It used to default to a reference named after the\n * channel, so a webhook declared without one verified against whatever\n * credential happened to share its name instead of being refused, and two\n * declarations differing only in credential verified identically.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Config<Payload, Outbound = never> extends Channel.Config<Payload, RunSummary, Outbound> {\n  readonly credential: Redacted.Redacted<CredentialRef>\n}\n\n/**\n * A webhook door that can only ingest through `Channels` and `Control`.\n *\n * @category services\n * @since 0.1.0\n */\nexport interface Webhook {\n  readonly name: string\n  readonly register: Effect.Effect<void, never, ControlChannels.Channels>\n  readonly ingest: (\n    raw: Channel.RawInbound\n  ) => Effect.Effect<Receipt, ControlError | TriggerError, ControlChannels.Channels>\n}\n\nconst invalidInput = (issue: string): InvalidInput => new InvalidInput({ issue })\n\nconst toControlChannel = <Payload, Outbound>(\n  config: Config<Payload, Outbound>\n): ControlChannels.Channel<Payload> => {\n  const channel = ControlWebhook.make({\n    name: config.name,\n    schema: config.schema,\n    credential: config.credential,\n    // The message is fixed here rather than forwarded from the verifier: a\n    // custom `verify` may say why it refused, and that reason travels toward\n    // the unauthenticated sender on the same error that answers a bad\n    // signature. `Unauthorized` carries no cause, so nothing else survives\n    // the crossing.\n    verify: (raw, credential) =>\n      config.verify(raw, credential).pipe(\n        Effect.mapError(() => new Unauthorized({ message: `webhook ${config.name} did not verify the request` }))\n      ),\n    map: (payload) => {\n      const inbound = config.inbound(payload)\n      if (\"start\" in inbound) {\n        return Effect.succeed({\n          _tag: \"Start\" as const,\n          flowId: inbound.start.flowId,\n          input: inbound.start.input\n        })\n      }\n      return Schema.decodeUnknownEffect(Schema.Json)(inbound.signal.value).pipe(\n        Effect.map(\n          (value) => ({\n            _tag: \"Signal\" as const,\n            runId: inbound.signal.runId,\n            signal: {\n              name: inbound.signal.stepId,\n              payload: value\n            }\n          })\n        ),\n        Effect.mapError((error) => invalidInput(String(error)))\n      )\n    },\n    project: (run) => {\n      if (config.outbound === undefined) {\n        return {\n          cursor: String(run.updatedAt),\n          operation: \"noop\" as const,\n          message: null\n        }\n      }\n      return {\n        cursor: String(run.updatedAt),\n        operation: \"post\" as const,\n        message: config.outbound(run)\n      }\n    }\n  })\n  return channel\n}\n\n/**\n * Builds a webhook door whose only dispatch path is the Control channel\n * coordinator.\n *\n * Verification occurs inside `Channels.ingest` before the adapter's JSON or\n * schema decoder and before any Control operation.\n *\n * `ingest` does not register: a channel is registered once, deliberately,\n * through {@link Webhook.register}, so traffic to an unregistered channel is\n * reported as unavailable rather than silently self-registering the door it\n * arrived at.\n *\n * `ingest` also copies `body`, `headers`, and `idempotencyKey` before anything\n * reads them. Verification, delivery fingerprinting, and decoding then all see\n * one private snapshot, so a verifier that edits the bytes it was handed, or a\n * caller that mutates its own object between building this Effect and running\n * it, cannot authenticate one payload and have another decoded. A\n * `SharedArrayBuffer`-backed view is copied out of shared memory by the same\n * step.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const make = <Payload, Outbound = never>(\n  config: Config<Payload, Outbound>\n): Webhook => {\n  const channel = toControlChannel(config)\n  const register = Effect.flatMap(ControlChannels.Channels, (channels) => channels.register(channel))\n  return {\n    name: config.name,\n    register,\n    ingest: (raw) => {\n      // Copied here rather than inside the Effect: the copy has to happen when\n      // the caller hands the request over, not when the returned Effect\n      // eventually runs, or a caller that reuses its own buffer in between\n      // changes what gets authenticated.\n      const snapshot: Channel.RawInbound = {\n        body: ownedCopy(raw.body),\n        headers: { ...raw.headers },\n        idempotencyKey: raw.idempotencyKey\n      }\n      return Effect.gen(function*() {\n        const channels = yield* ControlChannels.Channels\n        return yield* channels.ingest({ channel: config.name, raw: snapshot })\n      }).pipe(\n        Effect.mapError((error) =>\n          error instanceof Unauthorized\n            ? new TriggerError({\n              code: \"verification_failed\",\n              message: `webhook ${config.name} did not verify the request`,\n              cause: error\n            })\n            : error\n        )\n      )\n    }\n  }\n}\n"]}
+{"version":3,"file":"Webhook.js","sourceRoot":"","sources":["../../src/Webhook.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,eAAe,MAAM,0BAA0B,CAAA;AAE3D,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAGzE,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAA;AAChE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAoB,EAAE,QAAoB,EAAW,EAAE;IACvF,IAAI,UAAU,GAAG,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;IAClD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,UAAU,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7C,CAAC;IACD,OAAO,UAAU,KAAK,CAAC,CAAA;AACzB,CAAC,CAAA;AAwBD;;;;;;;;;GASG;AACH,MAAM,SAAS,GAAG,CAAC,IAAgB,EAAc,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEzE;;;;;;;GAOG;AACH,MAAM,WAAW,GAAG,CAClB,OAAsC,EACtC,IAAY,EACQ,EAAE;IACtB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAA;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,KAAK;YAAE,OAAO,KAAK,CAAA;IACtE,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAuB,EAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE;IACpG,MAAM,MAAM,GAAG,CAAC,KAAoB,EAAE,EAAE,CACtC,MAAM,CAAC,IAAI,CACT,IAAI,YAAY,CAAC;QACf,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,wBAAwB,MAAM,CAAC,MAAM,iBAAiB;QAC/D,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;KAC1C,CAAC,CACH,CAAA;IACH,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;QACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;QACxD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,MAAM,EAAE,CAAA;QACjB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QACjD,2EAA2E;QAC3E,4DAA4D;QAC5D,OAAO,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,CAC1D,MAAM,CAAC,WAAW,CAAC;YACjB,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;YACnC,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE,CACtB,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACxD,CAAC,CAAC,MAAM,CAAC,IAAI;gBACb,CAAC,CAAC,MAAM,EAAE;SACf,CAAC,CACH,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AA+BD,MAAM,YAAY,GAAG,CAAC,KAAa,EAAgB,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;AAEjF,MAAM,gBAAgB,GAAG,CACvB,MAAiC,EACC,EAAE;IACpC,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC;QAClC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,uEAAuE;QACvE,yEAAyE;QACzE,kEAAkE;QAClE,uEAAuE;QACvE,gBAAgB;QAChB,MAAM,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAC1B,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,IAAI,CACjC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,WAAW,MAAM,CAAC,IAAI,6BAA6B,EAAE,CAAC,CAAC,CAC1G;QACH,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE;YACf,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YACvC,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;gBACvB,OAAO,MAAM,CAAC,OAAO,CAAC;oBACpB,IAAI,EAAE,OAAgB;oBACtB,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;oBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;iBAC3B,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CACvE,MAAM,CAAC,GAAG,CACR,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACV,IAAI,EAAE,QAAiB;gBACvB,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK;gBAC3B,MAAM,EAAE;oBACN,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;oBAC3B,OAAO,EAAE,KAAK;iBACf;aACF,CAAC,CACH,EACD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CACxD,CAAA;QACH,CAAC;QACD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACf,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO;oBACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;oBAC7B,SAAS,EAAE,MAAe;oBAC1B,OAAO,EAAE,IAAI;iBACd,CAAA;YACH,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;gBAC7B,SAAS,EAAE,MAAe;gBAC1B,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;aAC9B,CAAA;QACH,CAAC;KACF,CAAC,CAAA;IACF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAClB,MAAiC,EACxB,EAAE;IACX,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAA;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;IACnG,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ;QACR,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE;YACd,yEAAyE;YACzE,kEAAkE;YAClE,qEAAqE;YACrE,mCAAmC;YACnC,MAAM,QAAQ,GAAuB;gBACnC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;gBACzB,OAAO,EAAE,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE;gBAC3B,cAAc,EAAE,GAAG,CAAC,cAAc;aACnC,CAAA;YACD,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAA;gBAChD,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAA;YACxE,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,KAAK,YAAY,YAAY;gBAC3B,CAAC,CAAC,IAAI,YAAY,CAAC;oBACjB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,WAAW,MAAM,CAAC,IAAI,6BAA6B;oBAC5D,KAAK,EAAE,KAAK;iBACb,CAAC;gBACF,CAAC,CAAC,KAAK,CACV,CACF,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC,CAAA","sourcesContent":["/**\n * Verified webhook ingestion through the authoritative Control boundary.\n *\n * @see packages/smithers/agent/triggers/docs/api.md\n * @since 0.1.0\n */\n\nimport * as ControlChannels from \"@smthrs/control/Channels\"\nimport type { ControlError } from \"@smthrs/control/ControlError\"\nimport { InvalidInput, Unauthorized } from \"@smthrs/control/ControlError\"\nimport type { Receipt, RunSummary } from \"@smthrs/control/ControlSchema\"\nimport type { CredentialRef } from \"@smthrs/control/Credential\"\nimport * as ControlWebhook from \"@smthrs/control/WebhookChannel\"\nimport * as Effect from \"effect/Effect\"\nimport type * as Redacted from \"effect/Redacted\"\nimport * as Schema from \"effect/Schema\"\nimport type * as Channel from \"./Channel.ts\"\nimport { TriggerError } from \"./TriggerError.ts\"\n\n/**\n * Compares a supplied byte string against the expected one without returning\n * early on a mismatch.\n *\n * The loop runs exactly `expected.length` times, so its iteration count is\n * fixed by the secret side of the comparison and never by the caller's. Reading\n * the longer of the two instead let a caller lengthen its input until the work\n * stopped growing, which reports the expected signature's length. The length\n * difference is folded into the result, so inputs of unequal length always\n * disagree.\n *\n * @category verification\n * @since 0.1.0\n */\nexport const constantTimeEqual = (expected: Uint8Array, supplied: Uint8Array): boolean => {\n  let difference = expected.length ^ supplied.length\n  for (const [index, byte] of expected.entries()) {\n    difference |= byte ^ (supplied[index] ?? 0)\n  }\n  return difference === 0\n}\n\n/**\n * Configuration for a raw-byte signature verifier.\n *\n * `expected` receives a private copy of the request bytes and the redacted\n * credential reference the channel was declared with, and answers with the\n * signature bytes the request must carry in `header`. It returns an Effect so\n * the secret is resolved through the host's resolver per request rather than\n * captured in a closure at declaration time, and so a resolution or HMAC\n * failure arrives as a typed `verification_failed` instead of a defect that\n * kills the fiber.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface SignatureConfig {\n  readonly header: string\n  readonly expected: (\n    body: Uint8Array,\n    credential: Redacted.Redacted<CredentialRef>\n  ) => Effect.Effect<Uint8Array, TriggerError>\n}\n\n/**\n * Copies request bytes into memory nobody else holds.\n *\n * `body.slice()` is not enough: a Node `Buffer` is a `Uint8Array` whose\n * `slice` is an alias of `subarray` and answers with a view over the same\n * memory, so a caller that reused its `Buffer` after handing it over changed\n * what got verified, and a verifier that edited the bytes it was handed edited\n * the caller's. `Uint8Array.from` always allocates, and it copies only the\n * viewed range of an offset view and only a snapshot of a `SharedArrayBuffer`.\n */\nconst ownedCopy = (body: Uint8Array): Uint8Array => Uint8Array.from(body)\n\n/**\n * Reads a header whose name may be spelled in any case.\n *\n * The lowercase form and the declared spelling are tried first, then every\n * other key whose lowercase form matches. HTTP header names are\n * case-insensitive, and a host that keeps the sender's capitalisation used to\n * fail a lowercase declaration.\n */\nconst headerValue = (\n  headers: Channel.RawInbound[\"headers\"],\n  name: string\n): string | undefined => {\n  const lower = name.toLowerCase()\n  const direct = headers[lower] ?? headers[name]\n  if (direct !== undefined) return direct\n  for (const [key, value] of Object.entries(headers)) {\n    if (value !== undefined && key.toLowerCase() === lower) return value\n  }\n  return undefined\n}\n\n/**\n * Builds a verifier that compares a signature header in constant time.\n *\n * An absent or empty header is refused before `expected` runs, and an\n * `expected` that answers with zero bytes is refused after it. Neither is a\n * comparison the constant-time equality can decide: it agrees on two empty\n * byte strings, so a request carrying no signature at all would have\n * authenticated against a secret that resolved to the empty string. A\n * zero-length expected signature is a misconfigured credential, never a valid\n * one, so the door stays closed instead of opening for everyone.\n *\n * Every refusal carries the same message, `webhook signature in <header> did\n * not verify`, whatever the reason. A failure raised by `expected` is kept in\n * `cause` only: its message names the credential reference or the resolver\n * that could not produce a secret, which is a host detail, and the refusal\n * that answers a bad signature answers a broken resolver the same way.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const makeSignatureVerifier = (config: SignatureConfig): Channel.Verify => (raw, credential) => {\n  const refuse = (cause?: TriggerError) =>\n    Effect.fail(\n      new TriggerError({\n        code: \"verification_failed\",\n        message: `webhook signature in ${config.header} did not verify`,\n        ...(cause === undefined ? {} : { cause })\n      })\n    )\n  return Effect.suspend(() => {\n    const supplied = headerValue(raw.headers, config.header)\n    if (supplied === undefined || supplied.length === 0) {\n      return refuse()\n    }\n    const actual = new TextEncoder().encode(supplied)\n    // The verifier gets its own copy: nothing it does to these bytes can reach\n    // the buffer that is about to be fingerprinted and decoded.\n    return config.expected(ownedCopy(raw.body), credential).pipe(\n      Effect.matchEffect({\n        onFailure: (error) => refuse(error),\n        onSuccess: (expected) =>\n          expected.length > 0 && constantTimeEqual(expected, actual)\n            ? Effect.void\n            : refuse()\n      })\n    )\n  })\n}\n\n/**\n * Webhook declaration configuration.\n *\n * `credential` is required. It used to default to a reference named after the\n * channel, so a webhook declared without one verified against whatever\n * credential happened to share its name instead of being refused, and two\n * declarations differing only in credential verified identically.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Config<Payload, Outbound = never> extends Channel.Config<Payload, RunSummary, Outbound> {\n  readonly credential: Redacted.Redacted<CredentialRef>\n}\n\n/**\n * A webhook door that can only ingest through `Channels` and `Control`.\n *\n * @category services\n * @since 0.1.0\n */\nexport interface Webhook {\n  readonly name: string\n  readonly register: Effect.Effect<void, never, ControlChannels.Channels>\n  readonly ingest: (\n    raw: Channel.RawInbound\n  ) => Effect.Effect<Receipt, ControlError | TriggerError, ControlChannels.Channels>\n}\n\nconst invalidInput = (issue: string): InvalidInput => new InvalidInput({ issue })\n\nconst toControlChannel = <Payload, Outbound>(\n  config: Config<Payload, Outbound>\n): ControlChannels.Channel<Payload> => {\n  const channel = ControlWebhook.make({\n    name: config.name,\n    schema: config.schema,\n    credential: config.credential,\n    // The message is fixed here rather than forwarded from the verifier: a\n    // custom `verify` may say why it refused, and that reason travels toward\n    // the unauthenticated sender on the same error that answers a bad\n    // signature. `Unauthorized` carries no cause, so nothing else survives\n    // the crossing.\n    verify: (raw, credential) =>\n      config.verify(raw, credential).pipe(\n        Effect.mapError(() => new Unauthorized({ message: `webhook ${config.name} did not verify the request` }))\n      ),\n    map: (payload) => {\n      const inbound = config.inbound(payload)\n      if (\"start\" in inbound) {\n        return Effect.succeed({\n          _tag: \"Start\" as const,\n          flowId: inbound.start.flowId,\n          input: inbound.start.input\n        })\n      }\n      return Schema.decodeUnknownEffect(Schema.Json)(inbound.signal.value).pipe(\n        Effect.map(\n          (value) => ({\n            _tag: \"Signal\" as const,\n            runId: inbound.signal.runId,\n            signal: {\n              name: inbound.signal.stepId,\n              payload: value\n            }\n          })\n        ),\n        Effect.mapError((error) => invalidInput(String(error)))\n      )\n    },\n    project: (run) => {\n      if (config.outbound === undefined) {\n        return {\n          cursor: String(run.updatedAt),\n          operation: \"noop\" as const,\n          message: null\n        }\n      }\n      return {\n        cursor: String(run.updatedAt),\n        operation: \"post\" as const,\n        message: config.outbound(run)\n      }\n    }\n  })\n  return channel\n}\n\n/**\n * Builds a webhook door whose only dispatch path is the Control channel\n * coordinator.\n *\n * Verification occurs inside `Channels.ingest` before the adapter's JSON or\n * schema decoder and before any Control operation.\n *\n * `ingest` does not register: a channel is registered once, deliberately,\n * through {@link Webhook.register}, so traffic to an unregistered channel is\n * reported as unavailable rather than silently self-registering the door it\n * arrived at.\n *\n * `ingest` also copies `body`, `headers`, and `idempotencyKey` before anything\n * reads them. Verification, delivery fingerprinting, and decoding then all see\n * one private snapshot, so a verifier that edits the bytes it was handed, or a\n * caller that mutates its own object between building this Effect and running\n * it, cannot authenticate one payload and have another decoded. A\n * `SharedArrayBuffer`-backed view is copied out of shared memory by the same\n * step.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const make = <Payload, Outbound = never>(\n  config: Config<Payload, Outbound>\n): Webhook => {\n  const channel = toControlChannel(config)\n  const register = Effect.flatMap(ControlChannels.Channels, (channels) => channels.register(channel))\n  return {\n    name: config.name,\n    register,\n    ingest: (raw) => {\n      // Copied here rather than inside the Effect: the copy has to happen when\n      // the caller hands the request over, not when the returned Effect\n      // eventually runs, or a caller that reuses its own buffer in between\n      // changes what gets authenticated.\n      const snapshot: Channel.RawInbound = {\n        body: ownedCopy(raw.body),\n        headers: { ...raw.headers },\n        idempotencyKey: raw.idempotencyKey\n      }\n      return Effect.gen(function*() {\n        const channels = yield* ControlChannels.Channels\n        return yield* channels.ingest({ channel: config.name, raw: snapshot })\n      }).pipe(\n        Effect.mapError((error) =>\n          error instanceof Unauthorized\n            ? new TriggerError({\n              code: \"verification_failed\",\n              message: `webhook ${config.name} did not verify the request`,\n              cause: error\n            })\n            : error\n        )\n      )\n    }\n  }\n}\n"]}

package/docs/README.md

@@ -47,10 +47,12 @@ at a flow by id, and the flow itself never learns that a clock started it.
 
 ## Install
 
-`@smthrs/triggers` is not on npm at 1.0.0-rc.0. Its source lives in the
-[smithers repository](https://github.com/smithersai/smithers), and
-[Installation](./installation.md) covers how to depend on it from a checkout,
-what it requires at runtime, and which packages a running host adds.
+```bash
+npm install @smthrs/triggers@next effect
+```
+
+[Installation](./installation.md) covers what it requires at runtime and which
+packages a running host adds.
 
 ## The smallest declaration
 

package/docs/api.md

@@ -20,8 +20,8 @@ Effect reads it from context. Launching goes through
 [`@smthrs/control`](/api/control), and persistence through the SQL client and
 durable writer of [`@smthrs/database`](/api/database).
 
-The package is not on npm at 1.0.0-rc.0. See [Installation](./installation.md)
-for how to get it.
+Install it with `npm install @smthrs/triggers@next effect`. See
+[Installation](./installation.md) for its requirements.
 
 ## Example
 

package/docs/guides/ingest-a-webhook.md

@@ -78,8 +78,9 @@ Three properties of that signature are the point of it.
   never by the caller's, so a caller cannot lengthen its input until the work
   stops growing and learn the expected signature's length.
 
-The verifier looks the header up first in lowercase and then exactly as written,
-so `x-hub-signature-256` and `X-Hub-Signature-256` both resolve. An absent or
+The verifier looks the header up first in lowercase, then exactly as written,
+then under any other casing, so `x-hub-signature-256` and `X-Hub-Signature-256`
+both resolve whichever spelling the declaration uses. An absent or
 empty header is refused before `expected` runs, and an `expected` that answers
 with zero bytes is refused after it, so a secret that resolves to the empty
 string closes the door instead of opening it for everyone.

package/docs/installation.md

@@ -1,24 +1,18 @@
 ---
 title: "Installation"
-description: "How to get @smthrs/triggers, what it requires at runtime, the import forms it publishes, and the packages a running host adds on top."
+description: "Install @smthrs/triggers from npm, what it requires at runtime, the import forms it publishes, and the packages a running host adds on top."
 sidebar:
   order: 1
 ---
 
 ## Get the package
 
-Not on npm yet; see [Installation](https://github.com/smithersai/smithers/blob/main/packages/smithers/flows/flow/docs/installation.md#use-the-libraries).
-
-The installed manifest resolves to the synchronized RC:
-
-```json
-{
-  "dependencies": {
-    "@smthrs/triggers": "1.0.0-rc.1"
-  }
-}
+```bash
+npm install @smthrs/triggers@next effect
 ```
 
+The `next` tag carries the 1.0 release candidates.
+
 ## Requirements
 
 - Node.js 26.4.0 or later.
@@ -29,7 +23,8 @@ The installed manifest resolves to the synchronized RC:
 - [`@smthrs/database`](/api/database), for the SQL client and the durable
   writer that `SqlTriggerStore` writes through.
 
-All three are ordinary dependencies of the package and install with it.
+`@smthrs/control` and `@smthrs/database` are ordinary dependencies and install
+with the package. `effect` is a peer dependency, so the install line names it.
 
 ## Import forms
 

package/docs/troubleshooting.md

@@ -144,8 +144,8 @@ than expecting it in the message a sender receives.
 **What to change.** Check three things in order.
 
 1. The header name in `SignatureConfig.header`. The verifier looks it up first
-   in lowercase and then exactly as written, so a casing mismatch is not the
-   cause, but a wrong name is.
+   in lowercase, then exactly as written, then under any other casing, so a
+   casing mismatch is not the cause, but a wrong name is.
 2. The bytes `SignatureConfig.expected` returns. They are compared against the
    UTF-8 encoding of the header value, so an implementation that returns raw
    HMAC bytes where the provider sends hex will never match. Return the encoded

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@smthrs/triggers",
   "type": "module",
-  "version": "1.0.0-rc.7",
+  "version": "1.0.0-rc.8",
   "license": "MIT",
   "smthrs": {
     "group": "agent"
@@ -206,8 +206,8 @@
     "tag": "next"
   },
   "dependencies": {
-    "@smthrs/control": "1.0.0-rc.7",
-    "@smthrs/database": "1.0.0-rc.7"
+    "@smthrs/control": "1.0.0-rc.8",
+    "@smthrs/database": "1.0.0-rc.8"
   },
   "peerDependencies": {
     "effect": "^4.0.4"

package/src/Webhook.ts

@@ -73,6 +73,27 @@ export interface SignatureConfig {
  */
 const ownedCopy = (body: Uint8Array): Uint8Array => Uint8Array.from(body)
 
+/**
+ * Reads a header whose name may be spelled in any case.
+ *
+ * The lowercase form and the declared spelling are tried first, then every
+ * other key whose lowercase form matches. HTTP header names are
+ * case-insensitive, and a host that keeps the sender's capitalisation used to
+ * fail a lowercase declaration.
+ */
+const headerValue = (
+  headers: Channel.RawInbound["headers"],
+  name: string
+): string | undefined => {
+  const lower = name.toLowerCase()
+  const direct = headers[lower] ?? headers[name]
+  if (direct !== undefined) return direct
+  for (const [key, value] of Object.entries(headers)) {
+    if (value !== undefined && key.toLowerCase() === lower) return value
+  }
+  return undefined
+}
+
 /**
  * Builds a verifier that compares a signature header in constant time.
  *
@@ -103,7 +124,7 @@ export const makeSignatureVerifier = (config: SignatureConfig): Channel.Verify =
       })
     )
   return Effect.suspend(() => {
-    const supplied = raw.headers[config.header.toLowerCase()] ?? raw.headers[config.header]
+    const supplied = headerValue(raw.headers, config.header)
     if (supplied === undefined || supplied.length === 0) {
       return refuse()
     }