@stepflowjs/trigger-webhook 0.0.1

package/dist/index.d.ts

@@ -0,0 +1,146 @@
+import { Trigger, TriggerHandler } from '@stepflowjs/core';
+
+type SignatureAlgorithm = "sha256" | "sha1" | "sha512";
+interface WebhookTriggerConfig {
+    /** The webhook endpoint path */
+    path: string;
+    /** Secret for signature verification */
+    secret: string;
+    /** Header name containing the signature (default: 'x-webhook-signature') */
+    signatureHeader?: string;
+    /** Signing algorithm (default: 'sha256') */
+    algorithm?: SignatureAlgorithm;
+    /** Signature prefix like 'sha256=' (optional) */
+    signaturePrefix?: string;
+    /** Header name for timestamp (for replay attack prevention) */
+    timestampHeader?: string;
+    /** Maximum age in seconds for timestamp validation (default: 300) */
+    timestampTolerance?: number;
+}
+interface WebhookTriggerResponse {
+    success: boolean;
+    eventId: string;
+}
+/**
+ * Webhook trigger for Stepflow workflows with signature verification
+ *
+ * Supports multiple webhook provider patterns:
+ * - GitHub style: `sha256=<hex>`
+ * - Stripe style: `t=timestamp,v1=signature`
+ * - Generic HMAC
+ *
+ * Includes replay attack prevention via timestamp validation.
+ *
+ * @example
+ * ```typescript
+ * // GitHub webhook
+ * const githubTrigger = new WebhookTrigger({
+ *   path: '/webhooks/github',
+ *   secret: process.env.GITHUB_WEBHOOK_SECRET,
+ *   signatureHeader: 'x-hub-signature-256',
+ *   algorithm: 'sha256',
+ *   signaturePrefix: 'sha256=',
+ * });
+ *
+ * // Stripe webhook
+ * const stripeTrigger = new WebhookTrigger({
+ *   path: '/webhooks/stripe',
+ *   secret: process.env.STRIPE_WEBHOOK_SECRET,
+ *   signatureHeader: 'stripe-signature',
+ *   algorithm: 'sha256',
+ *   timestampHeader: 'stripe-signature',
+ *   timestampTolerance: 300,
+ * });
+ *
+ * await githubTrigger.start(async (event) => {
+ *   await stepflow.trigger('github-webhook', event.data);
+ * });
+ *
+ * // In your framework adapter:
+ * app.post('/webhooks/github', async (req) => {
+ *   const response = await githubTrigger.handleRequest(req);
+ *   return response;
+ * });
+ * ```
+ */
+declare class WebhookTrigger implements Trigger<WebhookTriggerConfig> {
+    readonly config: WebhookTriggerConfig;
+    readonly type = "webhook";
+    private handler?;
+    constructor(config: WebhookTriggerConfig);
+    /**
+     * Start the trigger with a handler function
+     * @param handler Function to call when webhook requests are received
+     */
+    start(handler: TriggerHandler): Promise<void>;
+    /**
+     * Stop the trigger
+     */
+    stop(): Promise<void>;
+    /**
+     * Health check - returns true if handler is registered
+     */
+    healthCheck(): Promise<boolean>;
+    /**
+     * Handle an incoming webhook request
+     *
+     * This method should be called by framework adapters to process webhook requests.
+     * It validates the signature, checks for replay attacks, creates a trigger event,
+     * and invokes the registered handler.
+     *
+     * @param request Web standard Request object
+     * @returns Web standard Response object
+     *
+     * @example
+     * ```typescript
+     * // Hono adapter
+     * app.post('/webhook', async (c) => {
+     *   const response = await trigger.handleRequest(c.req.raw);
+     *   return response;
+     * });
+     *
+     * // Express adapter
+     * app.post('/webhook', async (req, res) => {
+     *   const request = new Request(`http://localhost${req.url}`, {
+     *     method: req.method,
+     *     headers: req.headers,
+     *     body: JSON.stringify(req.body),
+     *   });
+     *   const response = await trigger.handleRequest(request);
+     *   res.status(response.status).json(await response.json());
+     * });
+     * ```
+     */
+    handleRequest(request: Request): Promise<Response>;
+    /**
+     * Validate webhook signature using Web Crypto API
+     * Supports multiple signature formats:
+     * - GitHub: sha256=<hex>
+     * - Stripe: t=timestamp,v1=signature
+     * - Generic: <hex>
+     * @private
+     */
+    private validateSignature;
+    /**
+     * Verify HMAC signature using Web Crypto API
+     * @private
+     */
+    private verifyHmac;
+    /**
+     * Map algorithm name to Web Crypto API hash algorithm
+     * @private
+     */
+    private getHashAlgorithm;
+    /**
+     * Constant-time string comparison to prevent timing attacks
+     * @private
+     */
+    private constantTimeCompare;
+    /**
+     * Validate timestamp to prevent replay attacks
+     * @private
+     */
+    private validateTimestamp;
+}
+
+export { type SignatureAlgorithm, WebhookTrigger, type WebhookTriggerConfig, type WebhookTriggerResponse };

package/dist/index.js

@@ -0,0 +1,271 @@
+// src/index.ts
+var WebhookTrigger = class {
+  constructor(config) {
+    this.config = config;
+    this.config.signatureHeader = config.signatureHeader || "x-webhook-signature";
+    this.config.algorithm = config.algorithm || "sha256";
+    this.config.timestampTolerance = config.timestampTolerance ?? 300;
+  }
+  type = "webhook";
+  handler;
+  /**
+   * Start the trigger with a handler function
+   * @param handler Function to call when webhook requests are received
+   */
+  async start(handler) {
+    this.handler = handler;
+  }
+  /**
+   * Stop the trigger
+   */
+  async stop() {
+    this.handler = void 0;
+  }
+  /**
+   * Health check - returns true if handler is registered
+   */
+  async healthCheck() {
+    return this.handler !== void 0;
+  }
+  /**
+   * Handle an incoming webhook request
+   *
+   * This method should be called by framework adapters to process webhook requests.
+   * It validates the signature, checks for replay attacks, creates a trigger event,
+   * and invokes the registered handler.
+   *
+   * @param request Web standard Request object
+   * @returns Web standard Response object
+   *
+   * @example
+   * ```typescript
+   * // Hono adapter
+   * app.post('/webhook', async (c) => {
+   *   const response = await trigger.handleRequest(c.req.raw);
+   *   return response;
+   * });
+   *
+   * // Express adapter
+   * app.post('/webhook', async (req, res) => {
+   *   const request = new Request(`http://localhost${req.url}`, {
+   *     method: req.method,
+   *     headers: req.headers,
+   *     body: JSON.stringify(req.body),
+   *   });
+   *   const response = await trigger.handleRequest(request);
+   *   res.status(response.status).json(await response.json());
+   * });
+   * ```
+   */
+  async handleRequest(request) {
+    if (!this.handler) {
+      return new Response(JSON.stringify({ error: "Trigger not started" }), {
+        status: 503,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    try {
+      const bodyText = await request.text();
+      let data;
+      const contentType = request.headers.get("content-type") || "";
+      if (contentType.includes("application/json")) {
+        data = JSON.parse(bodyText);
+      } else if (contentType.includes("application/x-www-form-urlencoded")) {
+        const params = new URLSearchParams(bodyText);
+        data = Object.fromEntries(params.entries());
+      } else {
+        data = bodyText;
+      }
+      const isValid = await this.validateSignature(request, bodyText);
+      if (!isValid) {
+        return new Response(JSON.stringify({ error: "Invalid signature" }), {
+          status: 401,
+          headers: { "Content-Type": "application/json" }
+        });
+      }
+      if (this.config.timestampHeader) {
+        const isTimestampValid = this.validateTimestamp(request);
+        if (!isTimestampValid) {
+          return new Response(
+            JSON.stringify({ error: "Request timestamp too old or invalid" }),
+            {
+              status: 401,
+              headers: { "Content-Type": "application/json" }
+            }
+          );
+        }
+      }
+      const eventId = crypto.randomUUID();
+      const event = {
+        id: eventId,
+        type: this.type,
+        source: `webhook ${this.config.path}`,
+        data,
+        metadata: {
+          path: this.config.path,
+          headers: Object.fromEntries(request.headers.entries())
+        },
+        timestamp: /* @__PURE__ */ new Date()
+      };
+      await this.handler(event);
+      const response = {
+        success: true,
+        eventId
+      };
+      return new Response(JSON.stringify(response), {
+        status: 200,
+        headers: { "Content-Type": "application/json" }
+      });
+    } catch (error) {
+      return new Response(
+        JSON.stringify({
+          error: "Internal server error",
+          message: error.message
+        }),
+        {
+          status: 500,
+          headers: { "Content-Type": "application/json" }
+        }
+      );
+    }
+  }
+  /**
+   * Validate webhook signature using Web Crypto API
+   * Supports multiple signature formats:
+   * - GitHub: sha256=<hex>
+   * - Stripe: t=timestamp,v1=signature
+   * - Generic: <hex>
+   * @private
+   */
+  async validateSignature(request, payload) {
+    const signatureHeader = request.headers.get(this.config.signatureHeader);
+    if (!signatureHeader) {
+      return false;
+    }
+    try {
+      let signature;
+      let timestamp;
+      if (signatureHeader.includes("t=") && signatureHeader.includes("v1=")) {
+        const parts = signatureHeader.split(",");
+        const tPart = parts.find((p) => p.startsWith("t="));
+        const v1Part = parts.find((p) => p.startsWith("v1="));
+        if (!tPart || !v1Part) {
+          return false;
+        }
+        timestamp = parseInt(tPart.split("=")[1], 10);
+        signature = v1Part.split("=")[1];
+        const signedPayload = `${timestamp}.${payload}`;
+        return await this.verifyHmac(signedPayload, signature);
+      }
+      if (this.config.signaturePrefix && signatureHeader.startsWith(this.config.signaturePrefix)) {
+        signature = signatureHeader.substring(
+          this.config.signaturePrefix.length
+        );
+      } else if (signatureHeader.includes("=")) {
+        signature = signatureHeader.split("=")[1];
+      } else {
+        signature = signatureHeader;
+      }
+      return await this.verifyHmac(payload, signature);
+    } catch (error) {
+      console.error("Signature validation error:", error);
+      return false;
+    }
+  }
+  /**
+   * Verify HMAC signature using Web Crypto API
+   * @private
+   */
+  async verifyHmac(payload, expectedSignature) {
+    const encoder = new TextEncoder();
+    const keyData = encoder.encode(this.config.secret);
+    const messageData = encoder.encode(payload);
+    const hashAlgorithm = this.getHashAlgorithm(this.config.algorithm);
+    const cryptoKey = await crypto.subtle.importKey(
+      "raw",
+      keyData,
+      {
+        name: "HMAC",
+        hash: hashAlgorithm
+      },
+      false,
+      ["sign"]
+    );
+    const signatureBuffer = await crypto.subtle.sign(
+      "HMAC",
+      cryptoKey,
+      messageData
+    );
+    const hashArray = Array.from(new Uint8Array(signatureBuffer));
+    const computedSignature = hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
+    return this.constantTimeCompare(computedSignature, expectedSignature);
+  }
+  /**
+   * Map algorithm name to Web Crypto API hash algorithm
+   * @private
+   */
+  getHashAlgorithm(algorithm) {
+    switch (algorithm) {
+      case "sha256":
+        return "SHA-256";
+      case "sha1":
+        return "SHA-1";
+      case "sha512":
+        return "SHA-512";
+      default:
+        return "SHA-256";
+    }
+  }
+  /**
+   * Constant-time string comparison to prevent timing attacks
+   * @private
+   */
+  constantTimeCompare(a, b) {
+    if (a.length !== b.length) {
+      return false;
+    }
+    let result = 0;
+    for (let i = 0; i < a.length; i++) {
+      result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return result === 0;
+  }
+  /**
+   * Validate timestamp to prevent replay attacks
+   * @private
+   */
+  validateTimestamp(request) {
+    if (!this.config.timestampHeader) {
+      return true;
+    }
+    const timestampHeader = request.headers.get(this.config.timestampHeader);
+    if (!timestampHeader) {
+      return false;
+    }
+    try {
+      let timestamp;
+      if (timestampHeader.includes("t=")) {
+        const tPart = timestampHeader.split(",").find((p) => p.startsWith("t="));
+        if (!tPart) {
+          return false;
+        }
+        timestamp = parseInt(tPart.split("=")[1], 10);
+      } else {
+        timestamp = parseInt(timestampHeader, 10);
+      }
+      if (isNaN(timestamp)) {
+        return false;
+      }
+      const now = Math.floor(Date.now() / 1e3);
+      const age = now - timestamp;
+      return age >= 0 && age <= this.config.timestampTolerance;
+    } catch (error) {
+      console.error("Timestamp validation error:", error);
+      return false;
+    }
+  }
+};
+export {
+  WebhookTrigger
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type { Trigger, TriggerHandler, TriggerEvent } from \"@stepflowjs/core\";\n\n// ============================================================================\n// Types\n// ============================================================================\n\nexport type SignatureAlgorithm = \"sha256\" | \"sha1\" | \"sha512\";\n\nexport interface WebhookTriggerConfig {\n  /** The webhook endpoint path */\n  path: string;\n  /** Secret for signature verification */\n  secret: string;\n  /** Header name containing the signature (default: 'x-webhook-signature') */\n  signatureHeader?: string;\n  /** Signing algorithm (default: 'sha256') */\n  algorithm?: SignatureAlgorithm;\n  /** Signature prefix like 'sha256=' (optional) */\n  signaturePrefix?: string;\n  /** Header name for timestamp (for replay attack prevention) */\n  timestampHeader?: string;\n  /** Maximum age in seconds for timestamp validation (default: 300) */\n  timestampTolerance?: number;\n}\n\nexport interface WebhookTriggerResponse {\n  success: boolean;\n  eventId: string;\n}\n\n// ============================================================================\n// WebhookTrigger Implementation\n// ============================================================================\n\n/**\n * Webhook trigger for Stepflow workflows with signature verification\n *\n * Supports multiple webhook provider patterns:\n * - GitHub style: `sha256=<hex>`\n * - Stripe style: `t=timestamp,v1=signature`\n * - Generic HMAC\n *\n * Includes replay attack prevention via timestamp validation.\n *\n * @example\n * ```typescript\n * // GitHub webhook\n * const githubTrigger = new WebhookTrigger({\n *   path: '/webhooks/github',\n *   secret: process.env.GITHUB_WEBHOOK_SECRET,\n *   signatureHeader: 'x-hub-signature-256',\n *   algorithm: 'sha256',\n *   signaturePrefix: 'sha256=',\n * });\n *\n * // Stripe webhook\n * const stripeTrigger = new WebhookTrigger({\n *   path: '/webhooks/stripe',\n *   secret: process.env.STRIPE_WEBHOOK_SECRET,\n *   signatureHeader: 'stripe-signature',\n *   algorithm: 'sha256',\n *   timestampHeader: 'stripe-signature',\n *   timestampTolerance: 300,\n * });\n *\n * await githubTrigger.start(async (event) => {\n *   await stepflow.trigger('github-webhook', event.data);\n * });\n *\n * // In your framework adapter:\n * app.post('/webhooks/github', async (req) => {\n *   const response = await githubTrigger.handleRequest(req);\n *   return response;\n * });\n * ```\n */\nexport class WebhookTrigger implements Trigger<WebhookTriggerConfig> {\n  readonly type = \"webhook\";\n  private handler?: TriggerHandler;\n\n  constructor(readonly config: WebhookTriggerConfig) {\n    // Set defaults\n    this.config.signatureHeader =\n      config.signatureHeader || \"x-webhook-signature\";\n    this.config.algorithm = config.algorithm || \"sha256\";\n    this.config.timestampTolerance = config.timestampTolerance ?? 300;\n  }\n\n  /**\n   * Start the trigger with a handler function\n   * @param handler Function to call when webhook requests are received\n   */\n  async start(handler: TriggerHandler): Promise<void> {\n    this.handler = handler;\n  }\n\n  /**\n   * Stop the trigger\n   */\n  async stop(): Promise<void> {\n    this.handler = undefined;\n  }\n\n  /**\n   * Health check - returns true if handler is registered\n   */\n  async healthCheck(): Promise<boolean> {\n    return this.handler !== undefined;\n  }\n\n  /**\n   * Handle an incoming webhook request\n   *\n   * This method should be called by framework adapters to process webhook requests.\n   * It validates the signature, checks for replay attacks, creates a trigger event,\n   * and invokes the registered handler.\n   *\n   * @param request Web standard Request object\n   * @returns Web standard Response object\n   *\n   * @example\n   * ```typescript\n   * // Hono adapter\n   * app.post('/webhook', async (c) => {\n   *   const response = await trigger.handleRequest(c.req.raw);\n   *   return response;\n   * });\n   *\n   * // Express adapter\n   * app.post('/webhook', async (req, res) => {\n   *   const request = new Request(`http://localhost${req.url}`, {\n   *     method: req.method,\n   *     headers: req.headers,\n   *     body: JSON.stringify(req.body),\n   *   });\n   *   const response = await trigger.handleRequest(request);\n   *   res.status(response.status).json(await response.json());\n   * });\n   * ```\n   */\n  async handleRequest(request: Request): Promise<Response> {\n    if (!this.handler) {\n      return new Response(JSON.stringify({ error: \"Trigger not started\" }), {\n        status: 503,\n        headers: { \"Content-Type\": \"application/json\" },\n      });\n    }\n\n    try {\n      // Read request body as text for signature verification\n      const bodyText = await request.text();\n      let data: unknown;\n\n      // Parse body based on content type\n      const contentType = request.headers.get(\"content-type\") || \"\";\n      if (contentType.includes(\"application/json\")) {\n        data = JSON.parse(bodyText);\n      } else if (contentType.includes(\"application/x-www-form-urlencoded\")) {\n        const params = new URLSearchParams(bodyText);\n        data = Object.fromEntries(params.entries());\n      } else {\n        data = bodyText;\n      }\n\n      // Validate signature\n      const isValid = await this.validateSignature(request, bodyText);\n      if (!isValid) {\n        return new Response(JSON.stringify({ error: \"Invalid signature\" }), {\n          status: 401,\n          headers: { \"Content-Type\": \"application/json\" },\n        });\n      }\n\n      // Validate timestamp (replay attack prevention)\n      if (this.config.timestampHeader) {\n        const isTimestampValid = this.validateTimestamp(request);\n        if (!isTimestampValid) {\n          return new Response(\n            JSON.stringify({ error: \"Request timestamp too old or invalid\" }),\n            {\n              status: 401,\n              headers: { \"Content-Type\": \"application/json\" },\n            },\n          );\n        }\n      }\n\n      // Create trigger event\n      const eventId = crypto.randomUUID();\n      const event: TriggerEvent = {\n        id: eventId,\n        type: this.type,\n        source: `webhook ${this.config.path}`,\n        data,\n        metadata: {\n          path: this.config.path,\n          headers: Object.fromEntries(request.headers.entries()),\n        },\n        timestamp: new Date(),\n      };\n\n      // Invoke handler\n      await this.handler(event);\n\n      // Return success response\n      const response: WebhookTriggerResponse = {\n        success: true,\n        eventId,\n      };\n\n      return new Response(JSON.stringify(response), {\n        status: 200,\n        headers: { \"Content-Type\": \"application/json\" },\n      });\n    } catch (error) {\n      return new Response(\n        JSON.stringify({\n          error: \"Internal server error\",\n          message: (error as Error).message,\n        }),\n        {\n          status: 500,\n          headers: { \"Content-Type\": \"application/json\" },\n        },\n      );\n    }\n  }\n\n  /**\n   * Validate webhook signature using Web Crypto API\n   * Supports multiple signature formats:\n   * - GitHub: sha256=<hex>\n   * - Stripe: t=timestamp,v1=signature\n   * - Generic: <hex>\n   * @private\n   */\n  private async validateSignature(\n    request: Request,\n    payload: string,\n  ): Promise<boolean> {\n    const signatureHeader = request.headers.get(this.config.signatureHeader!);\n\n    if (!signatureHeader) {\n      return false;\n    }\n\n    try {\n      // Parse signature based on format\n      let signature: string;\n      let timestamp: number | undefined;\n\n      // Stripe format: t=timestamp,v1=signature\n      if (signatureHeader.includes(\"t=\") && signatureHeader.includes(\"v1=\")) {\n        const parts = signatureHeader.split(\",\");\n        const tPart = parts.find((p) => p.startsWith(\"t=\"));\n        const v1Part = parts.find((p) => p.startsWith(\"v1=\"));\n\n        if (!tPart || !v1Part) {\n          return false;\n        }\n\n        timestamp = parseInt(tPart.split(\"=\")[1], 10);\n        signature = v1Part.split(\"=\")[1];\n\n        // For Stripe, payload includes timestamp\n        const signedPayload = `${timestamp}.${payload}`;\n        return await this.verifyHmac(signedPayload, signature);\n      }\n\n      // GitHub format: sha256=<hex> or algorithm prefix\n      if (\n        this.config.signaturePrefix &&\n        signatureHeader.startsWith(this.config.signaturePrefix)\n      ) {\n        signature = signatureHeader.substring(\n          this.config.signaturePrefix.length,\n        );\n      } else if (signatureHeader.includes(\"=\")) {\n        // Generic prefix format\n        signature = signatureHeader.split(\"=\")[1];\n      } else {\n        // No prefix\n        signature = signatureHeader;\n      }\n\n      return await this.verifyHmac(payload, signature);\n    } catch (error) {\n      console.error(\"Signature validation error:\", error);\n      return false;\n    }\n  }\n\n  /**\n   * Verify HMAC signature using Web Crypto API\n   * @private\n   */\n  private async verifyHmac(\n    payload: string,\n    expectedSignature: string,\n  ): Promise<boolean> {\n    const encoder = new TextEncoder();\n    const keyData = encoder.encode(this.config.secret);\n    const messageData = encoder.encode(payload);\n\n    // Map algorithm to Web Crypto API hash name\n    const hashAlgorithm = this.getHashAlgorithm(this.config.algorithm!);\n\n    // Import key for HMAC\n    const cryptoKey = await crypto.subtle.importKey(\n      \"raw\",\n      keyData,\n      {\n        name: \"HMAC\",\n        hash: hashAlgorithm,\n      },\n      false,\n      [\"sign\"],\n    );\n\n    // Generate signature\n    const signatureBuffer = await crypto.subtle.sign(\n      \"HMAC\",\n      cryptoKey,\n      messageData,\n    );\n\n    // Convert to hex string\n    const hashArray = Array.from(new Uint8Array(signatureBuffer));\n    const computedSignature = hashArray\n      .map((b) => b.toString(16).padStart(2, \"0\"))\n      .join(\"\");\n\n    // Constant-time comparison\n    return this.constantTimeCompare(computedSignature, expectedSignature);\n  }\n\n  /**\n   * Map algorithm name to Web Crypto API hash algorithm\n   * @private\n   */\n  private getHashAlgorithm(algorithm: SignatureAlgorithm): string {\n    switch (algorithm) {\n      case \"sha256\":\n        return \"SHA-256\";\n      case \"sha1\":\n        return \"SHA-1\";\n      case \"sha512\":\n        return \"SHA-512\";\n      default:\n        return \"SHA-256\";\n    }\n  }\n\n  /**\n   * Constant-time string comparison to prevent timing attacks\n   * @private\n   */\n  private constantTimeCompare(a: string, b: string): boolean {\n    if (a.length !== b.length) {\n      return false;\n    }\n\n    let result = 0;\n    for (let i = 0; i < a.length; i++) {\n      result |= a.charCodeAt(i) ^ b.charCodeAt(i);\n    }\n\n    return result === 0;\n  }\n\n  /**\n   * Validate timestamp to prevent replay attacks\n   * @private\n   */\n  private validateTimestamp(request: Request): boolean {\n    if (!this.config.timestampHeader) {\n      return true;\n    }\n\n    const timestampHeader = request.headers.get(this.config.timestampHeader);\n\n    if (!timestampHeader) {\n      return false;\n    }\n\n    try {\n      let timestamp: number;\n\n      // Stripe format: t=timestamp,v1=signature\n      if (timestampHeader.includes(\"t=\")) {\n        const tPart = timestampHeader\n          .split(\",\")\n          .find((p) => p.startsWith(\"t=\"));\n        if (!tPart) {\n          return false;\n        }\n        timestamp = parseInt(tPart.split(\"=\")[1], 10);\n      } else {\n        // Unix timestamp\n        timestamp = parseInt(timestampHeader, 10);\n      }\n\n      if (isNaN(timestamp)) {\n        return false;\n      }\n\n      const now = Math.floor(Date.now() / 1000);\n      const age = now - timestamp;\n\n      // Check if timestamp is within tolerance\n      return age >= 0 && age <= this.config.timestampTolerance!;\n    } catch (error) {\n      console.error(\"Timestamp validation error:\", error);\n      return false;\n    }\n  }\n}\n"],"mappings":";AA4EO,IAAM,iBAAN,MAA8D;AAAA,EAInE,YAAqB,QAA8B;AAA9B;AAEnB,SAAK,OAAO,kBACV,OAAO,mBAAmB;AAC5B,SAAK,OAAO,YAAY,OAAO,aAAa;AAC5C,SAAK,OAAO,qBAAqB,OAAO,sBAAsB;AAAA,EAChE;AAAA,EATS,OAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA,EAcR,MAAM,MAAM,SAAwC;AAClD,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAsB;AAC1B,SAAK,UAAU;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAgC;AACpC,WAAO,KAAK,YAAY;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgCA,MAAM,cAAc,SAAqC;AACvD,QAAI,CAAC,KAAK,SAAS;AACjB,aAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,sBAAsB,CAAC,GAAG;AAAA,QACpE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAChD,CAAC;AAAA,IACH;AAEA,QAAI;AAEF,YAAM,WAAW,MAAM,QAAQ,KAAK;AACpC,UAAI;AAGJ,YAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,KAAK;AAC3D,UAAI,YAAY,SAAS,kBAAkB,GAAG;AAC5C,eAAO,KAAK,MAAM,QAAQ;AAAA,MAC5B,WAAW,YAAY,SAAS,mCAAmC,GAAG;AACpE,cAAM,SAAS,IAAI,gBAAgB,QAAQ;AAC3C,eAAO,OAAO,YAAY,OAAO,QAAQ,CAAC;AAAA,MAC5C,OAAO;AACL,eAAO;AAAA,MACT;AAGA,YAAM,UAAU,MAAM,KAAK,kBAAkB,SAAS,QAAQ;AAC9D,UAAI,CAAC,SAAS;AACZ,eAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,oBAAoB,CAAC,GAAG;AAAA,UAClE,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAChD,CAAC;AAAA,MACH;AAGA,UAAI,KAAK,OAAO,iBAAiB;AAC/B,cAAM,mBAAmB,KAAK,kBAAkB,OAAO;AACvD,YAAI,CAAC,kBAAkB;AACrB,iBAAO,IAAI;AAAA,YACT,KAAK,UAAU,EAAE,OAAO,uCAAuC,CAAC;AAAA,YAChE;AAAA,cACE,QAAQ;AAAA,cACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,YAChD;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAGA,YAAM,UAAU,OAAO,WAAW;AAClC,YAAM,QAAsB;AAAA,QAC1B,IAAI;AAAA,QACJ,MAAM,KAAK;AAAA,QACX,QAAQ,WAAW,KAAK,OAAO,IAAI;AAAA,QACnC;AAAA,QACA,UAAU;AAAA,UACR,MAAM,KAAK,OAAO;AAAA,UAClB,SAAS,OAAO,YAAY,QAAQ,QAAQ,QAAQ,CAAC;AAAA,QACvD;AAAA,QACA,WAAW,oBAAI,KAAK;AAAA,MACtB;AAGA,YAAM,KAAK,QAAQ,KAAK;AAGxB,YAAM,WAAmC;AAAA,QACvC,SAAS;AAAA,QACT;AAAA,MACF;AAEA,aAAO,IAAI,SAAS,KAAK,UAAU,QAAQ,GAAG;AAAA,QAC5C,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAChD,CAAC;AAAA,IACH,SAAS,OAAO;AACd,aAAO,IAAI;AAAA,QACT,KAAK,UAAU;AAAA,UACb,OAAO;AAAA,UACP,SAAU,MAAgB;AAAA,QAC5B,CAAC;AAAA,QACD;AAAA,UACE,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAChD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAc,kBACZ,SACA,SACkB;AAClB,UAAM,kBAAkB,QAAQ,QAAQ,IAAI,KAAK,OAAO,eAAgB;AAExE,QAAI,CAAC,iBAAiB;AACpB,aAAO;AAAA,IACT;AAEA,QAAI;AAEF,UAAI;AACJ,UAAI;AAGJ,UAAI,gBAAgB,SAAS,IAAI,KAAK,gBAAgB,SAAS,KAAK,GAAG;AACrE,cAAM,QAAQ,gBAAgB,MAAM,GAAG;AACvC,cAAM,QAAQ,MAAM,KAAK,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC;AAClD,cAAM,SAAS,MAAM,KAAK,CAAC,MAAM,EAAE,WAAW,KAAK,CAAC;AAEpD,YAAI,CAAC,SAAS,CAAC,QAAQ;AACrB,iBAAO;AAAA,QACT;AAEA,oBAAY,SAAS,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,EAAE;AAC5C,oBAAY,OAAO,MAAM,GAAG,EAAE,CAAC;AAG/B,cAAM,gBAAgB,GAAG,SAAS,IAAI,OAAO;AAC7C,eAAO,MAAM,KAAK,WAAW,eAAe,SAAS;AAAA,MACvD;AAGA,UACE,KAAK,OAAO,mBACZ,gBAAgB,WAAW,KAAK,OAAO,eAAe,GACtD;AACA,oBAAY,gBAAgB;AAAA,UAC1B,KAAK,OAAO,gBAAgB;AAAA,QAC9B;AAAA,MACF,WAAW,gBAAgB,SAAS,GAAG,GAAG;AAExC,oBAAY,gBAAgB,MAAM,GAAG,EAAE,CAAC;AAAA,MAC1C,OAAO;AAEL,oBAAY;AAAA,MACd;AAEA,aAAO,MAAM,KAAK,WAAW,SAAS,SAAS;AAAA,IACjD,SAAS,OAAO;AACd,cAAQ,MAAM,+BAA+B,KAAK;AAClD,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,WACZ,SACA,mBACkB;AAClB,UAAM,UAAU,IAAI,YAAY;AAChC,UAAM,UAAU,QAAQ,OAAO,KAAK,OAAO,MAAM;AACjD,UAAM,cAAc,QAAQ,OAAO,OAAO;AAG1C,UAAM,gBAAgB,KAAK,iBAAiB,KAAK,OAAO,SAAU;AAGlE,UAAM,YAAY,MAAM,OAAO,OAAO;AAAA,MACpC;AAAA,MACA;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,MACA;AAAA,MACA,CAAC,MAAM;AAAA,IACT;AAGA,UAAM,kBAAkB,MAAM,OAAO,OAAO;AAAA,MAC1C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAGA,UAAM,YAAY,MAAM,KAAK,IAAI,WAAW,eAAe,CAAC;AAC5D,UAAM,oBAAoB,UACvB,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AAGV,WAAO,KAAK,oBAAoB,mBAAmB,iBAAiB;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,iBAAiB,WAAuC;AAC9D,YAAQ,WAAW;AAAA,MACjB,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT;AACE,eAAO;AAAA,IACX;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,oBAAoB,GAAW,GAAoB;AACzD,QAAI,EAAE,WAAW,EAAE,QAAQ;AACzB,aAAO;AAAA,IACT;AAEA,QAAI,SAAS;AACb,aAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,gBAAU,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;AAAA,IAC5C;AAEA,WAAO,WAAW;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,kBAAkB,SAA2B;AACnD,QAAI,CAAC,KAAK,OAAO,iBAAiB;AAChC,aAAO;AAAA,IACT;AAEA,UAAM,kBAAkB,QAAQ,QAAQ,IAAI,KAAK,OAAO,eAAe;AAEvE,QAAI,CAAC,iBAAiB;AACpB,aAAO;AAAA,IACT;AAEA,QAAI;AACF,UAAI;AAGJ,UAAI,gBAAgB,SAAS,IAAI,GAAG;AAClC,cAAM,QAAQ,gBACX,MAAM,GAAG,EACT,KAAK,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC;AACjC,YAAI,CAAC,OAAO;AACV,iBAAO;AAAA,QACT;AACA,oBAAY,SAAS,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,EAAE;AAAA,MAC9C,OAAO;AAEL,oBAAY,SAAS,iBAAiB,EAAE;AAAA,MAC1C;AAEA,UAAI,MAAM,SAAS,GAAG;AACpB,eAAO;AAAA,MACT;AAEA,YAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,YAAM,MAAM,MAAM;AAGlB,aAAO,OAAO,KAAK,OAAO,KAAK,OAAO;AAAA,IACxC,SAAS,OAAO;AACd,cAAQ,MAAM,+BAA+B,KAAK;AAClD,aAAO;AAAA,IACT;AAAA,EACF;AACF;","names":[]}

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "@stepflowjs/trigger-webhook",
+  "version": "0.0.1",
+  "description": "Webhook trigger for Stepflow with signature verification",
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@stepflowjs/core": "0.0.1"
+  },
+  "devDependencies": {
+    "tsup": "^8.5.1",
+    "vitest": "^4.0.17"
+  },
+  "peerDependencies": {
+    "typescript": "^5.0.0"
+  },
+  "license": "MIT",
+  "author": "Stepflow Contributors",
+  "repository": {
+    "type": "git",
+    "url": "https://stepflow-production.up.railway.app",
+    "directory": "packages/triggers/webhook"
+  },
+  "homepage": "https://stepflow-production.up.railway.app",
+  "bugs": {
+    "url": "https://stepflow-production.up.railway.app"
+  },
+  "keywords": [
+    "stepflow",
+    "trigger",
+    "webhook",
+    "signature",
+    "verification",
+    "workflow",
+    "orchestration"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest",
+    "clean": "rm -rf dist"
+  }
+}