@t4h.framework/webhook 0.0.0-experimental-20260908180423

package/.ai/skills/framework-webhook/SKILL.md

@@ -0,0 +1,118 @@
+---
+name: framework-webhook
+description: >-
+  Guides correct use of @t4h.framework/webhook in workflows: WebhookActivity,
+  the <<callbackUrl>> placeholder, callback auth (hmac/basic/header/bearer/jwt),
+  body schema, timeout, the partner's dispatch answer, and how hosts implement
+  the core GetActivityCallbackUrlClaim and the callbacks route. Use when a
+  workflow must wait for a third-party HTTP callback, when working in
+  packages/webhook, or when wiring a host (runtime or dev) for external advances.
+---
+
+# @t4h.framework/webhook
+
+Suspend a workflow until a third party calls back. Package path:
+`framework/packages/webhook`. Peer dependency: `@t4h.framework/core`.
+
+## Import surface
+
+```typescript
+import { webhook, WebhookActivity } from '@t4h.framework/webhook'
+import type { AsyncActivityCallbackAuth } from '@t4h.framework/core'
+```
+
+## Workflow usage
+
+```typescript
+const callback = await webhook({
+  request: {
+    url: 'https://partner.example.com/jobs',
+    body: { json: { notifyUrl: '<<callbackUrl>>' } },
+  },
+  auth: { type: 'hmac', secret: env.SECRET, header: 'x-signature' },
+  schema: Type.Object({ status: Type.String() }),
+  timeoutInMs: 86_400_000,
+})
+
+callback.dispatch?.body // the partner's answer to the request
+callback.body.status // the callback body, typed by schema
+```
+
+- `request` is optional (inbound only). Put `<<callbackUrl>>` anywhere in it.
+  It is sent during `bootstrap` through `HttpClientRequestClaim`; a network
+  error or status ≥ 400 rejects the activity at once.
+- `auth` is optional; the URL token alone is the credential without it.
+- `schema` is the schema of the callback **body**; the host validates it and
+  it types `callback.body`.
+- Rejections surface as errors from `await webhook()`: `WebhookDispatchError`
+  (`status?`, `message`) or `WebhookTimeoutError`. The stored output is
+  `{ reason: 'dispatch_failed', status?, message }` or `{ reason: 'timeout' }`.
+- `webhook(options, { wait: false })` sends the request and returns a
+  `WebhookHandle` instead of suspending; do other work, then
+  `await handle.wait()`.
+- The pending payload is only the partner's answer to the request. A workflow
+  that needs its own callback URL puts `<<callbackUrl>>` in the request body
+  and reads it back from `callback.dispatch`.
+- Secrets come from `env`, never literals.
+
+## Auth cheat sheet
+
+- GitHub: `{ type: 'hmac', header: 'x-hub-signature-256', signaturePrefix: 'sha256=' }`
+- Shopify: `{ type: 'hmac', header: 'x-shopify-hmac-sha256', signatureFormat: 'base64' }`
+- Slack: `{ type: 'hmac', header: 'x-slack-signature', signaturePrefix: 'v0=', timestampHeader: 'x-slack-request-timestamp', toleranceInSeconds: 300, signedPayload: 'v0:{timestamp}:{body}' }`
+- Fixed credentials: `basic`, `header`, `bearer`
+- Google Pub/Sub push style: `{ type: 'jwt', jwksUri, issuer, audience }`
+
+## How it fits the core
+
+Every pending async activity can be advanced from outside through
+`POST .../activities/:activityId/callbacks?token=…`. `WebhookActivity` only
+adds the outbound request: `bootstrap` reads the URL from the core
+`GetActivityCallbackUrlClaim`, sends `request` with `HttpClientRequestClaim`,
+and returns `pending({ payload: dispatch, schema, auth, timeoutAt })`.
+`advance` receives the parsed body as payload, the bootstrap pending (for
+`dispatch`) and `{ method, headers }` as the third argument
+(`AsyncActivityAdvanceContext`).
+
+## Host contract
+
+1. `GetActivityCallbackUrlClaim.getActivityCallbackUrl()`: absolute `http(s)`
+   URL of the current activity's callbacks route with
+   `?token=deriveCallbackToken(secret, activityId)`. Nothing stored.
+2. Callback route: `isCallbackTokenValid` **first** (404 if the token was
+   never minted) → activity/pending lookup (503 + `Retry-After` if the pending
+   is not visible yet: the partner called back before the tick committed) →
+   `verifyCallbackAuth(pending.auth, { method, headers, rawBody })`
+   (401) → advance with `parseCallbackBody(contentType, rawBody)` and
+   `{ method, headers: flattenHeaders(headers) }`. 410 when no longer pending,
+   202 otherwise (repeats included).
+3. Verification needs the **raw body**; parse JSON only after it.
+
+The dev server implements this in `packages/dev` (`DevGetActivityCallbackUrlClaim`,
+`CallbackTokenService`, `CreateWorkflowRunAsyncActivityPendingCallback`, route
+`POST /projects/:project/workflows/:workflow/runs/:run/activities/:activity/callbacks`).
+
+## Testing
+
+```typescript
+import { mockAsync, fulfilled } from '@t4h.framework/core/testing'
+
+mockAsync().on(
+  WebhookActivity,
+  fulfilled({ method: 'POST', headers: {}, body }),
+)
+```
+
+Unit-test the activity with fake claims under `Claim.run`:
+
+```typescript
+Claim.run(
+  [
+    { provide: HttpClientRequestClaim, value: fakeHttpClaim },
+    { provide: GetActivityCallbackUrlClaim, value: fakeCallbackUrlClaim },
+  ],
+  () => activity.bootstrap(input),
+)
+```
+
+See the **framework-workflow-testing** skill for the full harness API.

package/CHANGELOG.md

@@ -0,0 +1,49 @@
+# @t4h.framework/webhook
+
+## 0.0.0-experimental-20260908180423
+
+### Patch Changes
+
+- Updated dependencies [[`e8c5796`](https://github.com/tech4humans-brasil/framework/commit/e8c5796ed6f492d7504052f59cc38b96734d0ab2)]:
+  - @t4h.framework/core@0.0.0-experimental-20260908180423
+  - @t4h.framework/hmac@0.0.0-experimental-20260908180423
+  - @t4h.framework/http@0.0.0-experimental-20260908180423
+  - @t4h.framework/jwks@0.0.0-experimental-20260908180423
+
+## 0.1.0
+
+### Minor Changes
+
+- [#158](https://github.com/tech4humans-brasil/framework/pull/158) [`8e8ffb2`](https://github.com/tech4humans-brasil/framework/commit/8e8ffb2ac0739e2f2a1f0af2ed9ebeffe2964776) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Adds `@t4h.framework/webhook` and unifies the external advance of a pending
+  activity behind one callback route.
+
+  **webhook**: `webhook()` sends an outbound request (with `<<callbackUrl>>`
+  replaced by the activity callback URL, 60s timeout) through
+  `HttpClientRequestClaim` and suspends the workflow until the third party posts
+  to that URL. The partner's answer is kept as `callback.dispatch`; the callback
+  body is validated against `schema`; `{ wait: false }` returns a handle to wait
+  on later. Ships `deriveCallbackToken`/`isCallbackTokenValid` and
+  `verifyCallbackAuth` for hosts.
+
+  **core**: `AsyncActivityCallbackAuth` (hmac, basic, header, bearer, jwt),
+  `pending({ auth })`, `advance(payload, bootstrap, context?)` receiving the
+  callback method and headers, and the `GetActivityCallbackUrlClaim` hosts must
+  provide.
+
+  **http**: `timeoutInMs` on `HttpClientRequestClaimInput`.
+
+  **dev**: `POST /projects/:project/workflows/:workflow/runs/:run/activities/:activity/callbacks?token=…`
+  replaces the `PATCH …/activities/:id` advance route. Each delivery is stored
+  as a pending callback (method + request); the token is derived from the
+  activity id, the declared `auth` is verified before the workflow advances.
+
+  **vite-panel-plugin**: the Inbox advance route follows the new callbacks
+  endpoint, with the token in the curl.
+
+### Patch Changes
+
+- Updated dependencies [[`8e8ffb2`](https://github.com/tech4humans-brasil/framework/commit/8e8ffb2ac0739e2f2a1f0af2ed9ebeffe2964776)]:
+  - @t4h.framework/core@0.11.0
+  - @t4h.framework/http@0.6.0
+  - @t4h.framework/hmac@0.2.1
+  - @t4h.framework/jwks@0.5.1

package/README.md

@@ -0,0 +1,42 @@
+# @t4h.framework/webhook
+
+Suspend a workflow until a third party calls back over HTTP.
+
+## Usage
+
+```typescript
+import { webhook } from '@t4h.framework/webhook'
+import Type from 'typebox'
+
+const callback = await webhook({
+  request: {
+    url: 'https://partner.example.com/jobs',
+    body: { json: { callback: '<<callbackUrl>>' } },
+  },
+  auth: { type: 'hmac', secret: env.PARTNER_SECRET, header: 'x-signature' },
+  schema: Type.Object({ status: Type.String() }),
+  timeoutInMs: 24 * 60 * 60 * 1000,
+})
+
+callback.dispatch?.body // what the partner answered to the request
+callback.body.status // typed by the schema
+```
+
+Every pending activity already has a callback URL; `webhook()` sends
+`request` with the placeholder replaced by that URL and resumes the workflow
+when the partner posts to it. The callback must carry the token in the URL and
+pass the `auth` you declared; the body must match `schema`.
+
+A failed request throws `WebhookDispatchError` and a callback that never
+arrives before `timeoutInMs` throws `WebhookTimeoutError`, so the workflow
+never sees a callback that did not happen.
+
+Supported `auth`: `hmac` (GitHub, Shopify, Slack style), `basic`, `header`,
+`bearer` and `jwt` (JWKS).
+
+Pass `{ wait: false }` as the second argument to send the request without
+suspending; you get a handle and call `handle.wait()` later.
+
+Hosts implement the core `GetActivityCallbackUrlClaim` and the callbacks
+route; the outbound request goes through `HttpClientRequestClaim` from
+`@t4h.framework/http`. Peer dependency: `@t4h.framework/core`.

package/dist/activities/WebhookActivity.d.ts

@@ -0,0 +1,37 @@
+import { AsyncActivity, type AsyncActivityAdvanceContext, type AsyncActivityAwaitable, type AsyncActivityResultPending, type AsyncActivityCallbackAuth } from '@t4h.framework/core';
+import type Type from 'typebox';
+import type { WebhookCallback, WebhookCallbackOutput, WebhookDispatchResponse, WebhookRejectedOutput } from '../models/WebhookCallback.js';
+import type { WebhookRequest } from '../models/WebhookRequest.js';
+export type WebhookOptions<TSchema extends Type.TSchema = Type.TSchema> = {
+    request?: WebhookRequest;
+    auth?: AsyncActivityCallbackAuth;
+    schema?: TSchema;
+    timeoutInMs?: number;
+};
+export type WebhookActivityInput = {
+    request?: WebhookRequest;
+    auth?: AsyncActivityCallbackAuth;
+    schema?: Type.TSchema;
+    timeoutInMs?: number;
+};
+declare const WEBHOOK_ACTIVITY_CLAIMS: unique symbol;
+export declare const WEBHOOK_DISPATCH_TIMEOUT_IN_MS = 60000;
+export declare class WebhookActivity<TSchema extends Type.TSchema = Type.TSchema> extends AsyncActivity<readonly [options: WebhookOptions<TSchema>], WebhookActivityInput, WebhookCallbackOutput | WebhookRejectedOutput, WebhookCallback<Type.Static<TSchema>>, WebhookDispatchResponse | undefined, TSchema> {
+    private readonly [WEBHOOK_ACTIVITY_CLAIMS];
+    toInput(options: WebhookOptions<TSchema>): WebhookActivityInput;
+    bootstrap(input: WebhookActivityInput): Promise<AsyncActivityResultPending<WebhookDispatchResponse | undefined, TSchema> | import("@t4h.framework/core").AsyncActivityResultRejected<void | import("@t4h.framework/core").Serializable>>;
+    private dispatch;
+    advance(payload: Type.Static<TSchema>, bootstrap: AsyncActivityResultPending<WebhookDispatchResponse | undefined>, context?: AsyncActivityAdvanceContext): import("@t4h.framework/core").AsyncActivityResultFulfilled<WebhookRejectedOutput | WebhookCallbackOutput | undefined>;
+    toOutput(output: WebhookCallbackOutput | WebhookRejectedOutput): WebhookCallback<Type.Static<TSchema>>;
+}
+export type WebhookWaitOptions = {
+    wait?: boolean;
+};
+export type WebhookHandle<TSchema extends Type.TSchema = Type.TSchema> = AsyncActivityAwaitable<WebhookActivity<TSchema>>;
+export declare function webhook<TSchema extends Type.TSchema = Type.TUnknown>(options: WebhookOptions<TSchema>): Promise<WebhookCallback<Type.Static<TSchema>>>;
+export declare function webhook<TSchema extends Type.TSchema = Type.TUnknown>(options: WebhookOptions<TSchema>, wait: {
+    wait: false;
+}): Promise<WebhookHandle<TSchema>>;
+export declare function webhook<TSchema extends Type.TSchema = Type.TUnknown>(options: WebhookOptions<TSchema>, wait: WebhookWaitOptions): Promise<WebhookCallback<Type.Static<TSchema>> | WebhookHandle<TSchema>>;
+export {};
+//# sourceMappingURL=WebhookActivity.d.ts.map

package/dist/activities/WebhookActivity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebhookActivity.d.ts","sourceRoot":"","sources":["../../src/activities/WebhookActivity.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,aAAa,EAIb,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAE/B,MAAM,qBAAqB,CAAA;AAE5B,OAAO,KAAK,IAAI,MAAM,SAAS,CAAA;AAI/B,OAAO,KAAK,EACV,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACtB,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAe,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAK9E,MAAM,MAAM,cAAc,CAAC,OAAO,SAAS,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI;IACxE,OAAO,CAAC,EAAE,cAAc,CAAA;IACxB,IAAI,CAAC,EAAE,yBAAyB,CAAA;IAChC,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,CAAC,EAAE,cAAc,CAAA;IACxB,IAAI,CAAC,EAAE,yBAAyB,CAAA;IAChC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,QAAA,MAAM,uBAAuB,eAAoC,CAAA;AAEjE,eAAO,MAAM,8BAA8B,QAAS,CAAA;AA6BpD,qBAAa,eAAe,CAC1B,OAAO,SAAS,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAC3C,SAAQ,aAAa,CACrB,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,EAC3C,oBAAoB,EACpB,qBAAqB,GAAG,qBAAqB,EAC7C,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EACrC,uBAAuB,GAAG,SAAS,EACnC,OAAO,CACR;IACC,OAAO,CAAC,QAAQ,CAAC,CAAC,uBAAuB,CAAC,CAGxC;IAEK,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,oBAAoB;IASzD,SAAS,CAAC,KAAK,EAAE,oBAAoB;YA8BpC,QAAQ;IAsCf,OAAO,CACZ,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAC7B,SAAS,EAAE,0BAA0B,CAAC,uBAAuB,GAAG,SAAS,CAAC,EAC1E,OAAO,CAAC,EAAE,2BAA2B;IAUhC,QAAQ,CACb,MAAM,EAAE,qBAAqB,GAAG,qBAAqB,GACpD,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;CAUzC;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,CAAC,EAAE,OAAO,CAAA;CACf,CAAA;AAED,MAAM,MAAM,aAAa,CAAC,OAAO,SAAS,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IACnE,sBAAsB,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;AAElD,wBAAsB,OAAO,CAAC,OAAO,SAAS,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,EACxE,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,GAC/B,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AACjD,wBAAsB,OAAO,CAAC,OAAO,SAAS,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,EACxE,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,EAChC,IAAI,EAAE;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GACpB,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAA;AAClC,wBAAsB,OAAO,CAAC,OAAO,SAAS,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,EACxE,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,EAChC,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,CAAA"}

package/dist/activities/WebhookActivity.js

@@ -0,0 +1,112 @@
+import { text } from 'node:stream/consumers';
+import { AsyncActivity, Claim, GetActivityCallbackUrlClaim, History, } from '@t4h.framework/core';
+import { HttpClientRequestClaim } from '@t4h.framework/http';
+import { WebhookCallbackUrlError } from '../errors/WebhookCallbackUrlError.js';
+import { toWebhookRejectedError } from '../errors/WebhookRejectedError.js';
+import { buildWebhookDispatch } from '../tools/build-webhook-dispatch.js';
+import { flattenHeaders } from '../tools/get-header.js';
+import { parseCallbackBody } from '../tools/parse-callback-body.js';
+const WEBHOOK_ACTIVITY_CLAIMS = Symbol('webhook-activity-claims');
+export const WEBHOOK_DISPATCH_TIMEOUT_IN_MS = 60_000;
+function toCallbackUrl(callbackUrl) {
+    if (typeof callbackUrl !== 'string' || !callbackUrl.length)
+        throw new WebhookCallbackUrlError('GetActivityCallbackUrlClaim must return a callback URL', callbackUrl);
+    let url;
+    try {
+        url = new URL(callbackUrl);
+    }
+    catch {
+        throw new WebhookCallbackUrlError(`GetActivityCallbackUrlClaim returned an invalid callback URL: ${callbackUrl}`, callbackUrl);
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:')
+        throw new WebhookCallbackUrlError(`GetActivityCallbackUrlClaim must return an http(s) callback URL, got ${url.protocol}`, callbackUrl);
+    return url.href;
+}
+export class WebhookActivity extends AsyncActivity {
+    [WEBHOOK_ACTIVITY_CLAIMS] = new Claim({
+        http: HttpClientRequestClaim,
+        callback: GetActivityCallbackUrlClaim,
+    });
+    toInput(options) {
+        return {
+            request: options.request,
+            auth: options.auth,
+            schema: options.schema,
+            timeoutInMs: options.timeoutInMs,
+        };
+    }
+    async bootstrap(input) {
+        const callbackUrl = toCallbackUrl(this[WEBHOOK_ACTIVITY_CLAIMS].callback.getActivityCallbackUrl());
+        let dispatch;
+        if (input.request) {
+            const outcome = await this.dispatch(input.request, callbackUrl);
+            if ('reason' in outcome)
+                return this.rejected(outcome);
+            dispatch = outcome;
+        }
+        const options = {
+            payload: dispatch,
+            schema: input.schema,
+            auth: input.auth,
+        };
+        if (input.timeoutInMs)
+            options.timeoutAt = new Date(Date.now() + input.timeoutInMs);
+        return this.pending(options);
+    }
+    async dispatch(request, callbackUrl) {
+        const dispatch = buildWebhookDispatch(request, callbackUrl);
+        try {
+            const response = await this[WEBHOOK_ACTIVITY_CLAIMS].http.request({
+                url: new URL(dispatch.url),
+                method: dispatch.method,
+                body: dispatch.body === undefined ? undefined : Buffer.from(dispatch.body),
+                headers: dispatch.headers,
+                redirect: 'follow',
+                retry: true,
+                timeoutInMs: WEBHOOK_DISPATCH_TIMEOUT_IN_MS,
+            });
+            const headers = flattenHeaders(response.headers);
+            const rawBody = await text(response.body);
+            if (response.status >= 400)
+                return {
+                    reason: 'dispatch_failed',
+                    status: response.status,
+                    message: `Dispatch to ${dispatch.url} answered ${response.status}`,
+                };
+            return {
+                status: response.status,
+                headers,
+                body: parseCallbackBody(headers['content-type'], rawBody),
+            };
+        }
+        catch (error) {
+            return {
+                reason: 'dispatch_failed',
+                message: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
+    advance(payload, bootstrap, context) {
+        return this.done({
+            method: context?.method ?? 'POST',
+            headers: context?.headers ?? {},
+            body: payload,
+            dispatch: bootstrap.payload,
+        });
+    }
+    toOutput(output) {
+        if ('reason' in output)
+            throw toWebhookRejectedError(this.id, output);
+        return {
+            method: output.method,
+            headers: output.headers,
+            body: output.body,
+            dispatch: output.dispatch,
+        };
+    }
+}
+export async function webhook(options, { wait = true } = {}) {
+    const handle = await History.reconciler(WebhookActivity, options);
+    return wait ? handle.wait() : handle;
+}
+//# sourceMappingURL=WebhookActivity.js.map

package/dist/activities/WebhookActivity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebhookActivity.js","sourceRoot":"","sources":["../../src/activities/WebhookActivity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAE5C,OAAO,EACL,aAAa,EACb,KAAK,EACL,2BAA2B,EAC3B,OAAO,GAMR,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAG5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAA;AAC9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAQ1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAA;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AAgBnE,MAAM,uBAAuB,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAA;AAEjE,MAAM,CAAC,MAAM,8BAA8B,GAAG,MAAM,CAAA;AAEpD,SAAS,aAAa,CAAC,WAAoB;IACzC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,MAAM;QACxD,MAAM,IAAI,uBAAuB,CAC/B,wDAAwD,EACxD,WAAW,CACZ,CAAA;IAEH,IAAI,GAAQ,CAAA;IAEZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAC/B,iEAAiE,WAAW,EAAE,EAC9E,WAAW,CACZ,CAAA;IACH,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACvD,MAAM,IAAI,uBAAuB,CAC/B,wEAAwE,GAAG,CAAC,QAAQ,EAAE,EACtF,WAAW,CACZ,CAAA;IAEH,OAAO,GAAG,CAAC,IAAI,CAAA;AACjB,CAAC;AAED,MAAM,OAAO,eAEX,SAAQ,aAOT;IACkB,CAAC,uBAAuB,CAAC,GAAG,IAAI,KAAK,CAAC;QACrD,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,2BAA2B;KACtC,CAAC,CAAA;IAEK,OAAO,CAAC,OAAgC;QAC7C,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAA;IACH,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,KAA2B;QAChD,MAAM,WAAW,GAAG,aAAa,CAC/B,IAAI,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,sBAAsB,EAAE,CAChE,CAAA;QAED,IAAI,QAA6C,CAAA;QAEjD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;YAE/D,IAAI,QAAQ,IAAI,OAAO;gBAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YAEtD,QAAQ,GAAG,OAAO,CAAA;QACpB,CAAC;QAED,MAAM,OAAO,GAGT;YACF,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,KAAK,CAAC,MAA6B;YAC3C,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAA;QAED,IAAI,KAAK,CAAC,WAAW;YACnB,OAAO,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,CAAA;QAE9D,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAC9B,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,OAAuB,EAAE,WAAmB;QACjE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;QAE3D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;gBAChE,GAAG,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC1B,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,IAAI,EACF,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACtE,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,IAAI;gBACX,WAAW,EAAE,8BAA8B;aAC5C,CAAC,CAAA;YAEF,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;YAEzC,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;gBACxB,OAAO;oBACL,MAAM,EAAE,iBAA0B;oBAClC,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,OAAO,EAAE,eAAe,QAAQ,CAAC,GAAG,aAAa,QAAQ,CAAC,MAAM,EAAE;iBACnE,CAAA;YAEH,OAAO;gBACL,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,OAAO;gBACP,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;aAC1D,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,MAAM,EAAE,iBAA0B;gBAClC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAChE,CAAA;QACH,CAAC;IACH,CAAC;IAEM,OAAO,CACZ,OAA6B,EAC7B,SAA0E,EAC1E,OAAqC;QAErC,OAAO,IAAI,CAAC,IAAI,CAAC;YACf,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,MAAM;YACjC,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE;YAC/B,IAAI,EAAE,OAAkC;YACxC,QAAQ,EAAE,SAAS,CAAC,OAAO;SAC5B,CAAC,CAAA;IACJ,CAAC;IAEM,QAAQ,CACb,MAAqD;QAErD,IAAI,QAAQ,IAAI,MAAM;YAAE,MAAM,sBAAsB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QAErE,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI,EAAE,MAAM,CAAC,IAA4B;YACzC,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAA;IACH,CAAC;CACF;AAoBD,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,OAAgC,EAChC,EAAE,IAAI,GAAG,IAAI,KAAyB,EAAE;IAExC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CACrC,eAAqD,EACrD,OAAO,CACR,CAAA;IAED,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAA;AACtC,CAAC"}

package/dist/errors/WebhookCallbackUrlError.d.ts

@@ -0,0 +1,6 @@
+export declare class WebhookCallbackUrlError extends Error {
+    readonly callbackUrl: unknown;
+    readonly name = "WebhookCallbackUrlError";
+    constructor(message: string, callbackUrl: unknown);
+}
+//# sourceMappingURL=WebhookCallbackUrlError.d.ts.map

package/dist/errors/WebhookCallbackUrlError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebhookCallbackUrlError.d.ts","sourceRoot":"","sources":["../../src/errors/WebhookCallbackUrlError.ts"],"names":[],"mappings":"AAAA,qBAAa,uBAAwB,SAAQ,KAAK;aAK9B,WAAW,EAAE,OAAO;IAJtC,SAAyB,IAAI,6BAA4B;gBAGvD,OAAO,EAAE,MAAM,EACC,WAAW,EAAE,OAAO;CAIvC"}

package/dist/errors/WebhookCallbackUrlError.js

@@ -0,0 +1,9 @@
+export class WebhookCallbackUrlError extends Error {
+    callbackUrl;
+    name = 'WebhookCallbackUrlError';
+    constructor(message, callbackUrl) {
+        super(message);
+        this.callbackUrl = callbackUrl;
+    }
+}
+//# sourceMappingURL=WebhookCallbackUrlError.js.map

package/dist/errors/WebhookCallbackUrlError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebhookCallbackUrlError.js","sourceRoot":"","sources":["../../src/errors/WebhookCallbackUrlError.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAK9B;IAJO,IAAI,GAAG,yBAAyB,CAAA;IAEzD,YACE,OAAe,EACC,WAAoB;QAEpC,KAAK,CAAC,OAAO,CAAC,CAAA;QAFE,gBAAW,GAAX,WAAW,CAAS;IAGtC,CAAC;CACF"}

package/dist/errors/WebhookRejectedError.d.ts

@@ -0,0 +1,17 @@
+import type { WebhookDispatchFailed, WebhookRejectedOutput } from '../models/WebhookCallback.js';
+export declare class WebhookTimeoutError extends Error {
+    readonly activityId: string;
+    readonly name = "WebhookTimeoutError";
+    readonly reason = "timeout";
+    constructor(activityId: string);
+}
+export declare class WebhookDispatchError extends Error {
+    readonly activityId: string;
+    readonly name = "WebhookDispatchError";
+    readonly reason = "dispatch_failed";
+    readonly status: number | undefined;
+    constructor(activityId: string, failure: WebhookDispatchFailed);
+}
+export type WebhookRejectedError = WebhookTimeoutError | WebhookDispatchError;
+export declare function toWebhookRejectedError(activityId: string, output: WebhookRejectedOutput): WebhookRejectedError;
+//# sourceMappingURL=WebhookRejectedError.d.ts.map

package/dist/errors/WebhookRejectedError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebhookRejectedError.d.ts","sourceRoot":"","sources":["../../src/errors/WebhookRejectedError.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,8BAA8B,CAAA;AAErC,qBAAa,mBAAoB,SAAQ,KAAK;aAKhB,UAAU,EAAE,MAAM;IAJ9C,SAAyB,IAAI,yBAAwB;IAErD,SAAgB,MAAM,aAAY;gBAEN,UAAU,EAAE,MAAM;CAG/C;AAED,qBAAa,oBAAqB,SAAQ,KAAK;aAQ3B,UAAU,EAAE,MAAM;IAPpC,SAAyB,IAAI,0BAAyB;IAEtD,SAAgB,MAAM,qBAAoB;IAE1C,SAAgB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;gBAGxB,UAAU,EAAE,MAAM,EAClC,OAAO,EAAE,qBAAqB;CAMjC;AAED,MAAM,MAAM,oBAAoB,GAAG,mBAAmB,GAAG,oBAAoB,CAAA;AAE7E,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,qBAAqB,GAC5B,oBAAoB,CAItB"}

package/dist/errors/WebhookRejectedError.js

@@ -0,0 +1,26 @@
+export class WebhookTimeoutError extends Error {
+    activityId;
+    name = 'WebhookTimeoutError';
+    reason = 'timeout';
+    constructor(activityId) {
+        super(`Webhook ${activityId} timed out waiting for the callback`);
+        this.activityId = activityId;
+    }
+}
+export class WebhookDispatchError extends Error {
+    activityId;
+    name = 'WebhookDispatchError';
+    reason = 'dispatch_failed';
+    status;
+    constructor(activityId, failure) {
+        super(failure.message);
+        this.activityId = activityId;
+        this.status = failure.status;
+    }
+}
+export function toWebhookRejectedError(activityId, output) {
+    return output.reason === 'timeout'
+        ? new WebhookTimeoutError(activityId)
+        : new WebhookDispatchError(activityId, output);
+}
+//# sourceMappingURL=WebhookRejectedError.js.map

package/dist/errors/WebhookRejectedError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebhookRejectedError.js","sourceRoot":"","sources":["../../src/errors/WebhookRejectedError.ts"],"names":[],"mappings":"AAKA,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAKhB;IAJH,IAAI,GAAG,qBAAqB,CAAA;IAErC,MAAM,GAAG,SAAS,CAAA;IAElC,YAA4B,UAAkB;QAC5C,KAAK,CAAC,WAAW,UAAU,qCAAqC,CAAC,CAAA;QADvC,eAAU,GAAV,UAAU,CAAQ;IAE9C,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAQ3B;IAPO,IAAI,GAAG,sBAAsB,CAAA;IAEtC,MAAM,GAAG,iBAAiB,CAAA;IAE1B,MAAM,CAAoB;IAE1C,YACkB,UAAkB,EAClC,OAA8B;QAE9B,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAHN,eAAU,GAAV,UAAU,CAAQ;QAKlC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;IAC9B,CAAC;CACF;AAID,MAAM,UAAU,sBAAsB,CACpC,UAAkB,EAClB,MAA6B;IAE7B,OAAO,MAAM,CAAC,MAAM,KAAK,SAAS;QAChC,CAAC,CAAC,IAAI,mBAAmB,CAAC,UAAU,CAAC;QACrC,CAAC,CAAC,IAAI,oBAAoB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;AAClD,CAAC"}

package/dist/models/WebhookCallback.d.ts

@@ -0,0 +1,28 @@
+import type { WebhookJson } from './WebhookRequest.js';
+export type WebhookDispatchFailed = {
+    reason: 'dispatch_failed';
+    status?: number;
+    message: string;
+};
+export type WebhookTimedOut = {
+    reason: 'timeout';
+};
+export type WebhookRejectedOutput = WebhookDispatchFailed | WebhookTimedOut;
+export type WebhookDispatchResponse = {
+    status: number;
+    headers: Record<string, string>;
+    body?: WebhookJson;
+};
+export type WebhookCallbackOutput = {
+    method: string;
+    headers: Record<string, string>;
+    body?: WebhookJson;
+    dispatch?: WebhookDispatchResponse;
+};
+export interface WebhookCallback<TBody = unknown> {
+    method: string;
+    headers: Record<string, string>;
+    body: TBody;
+    dispatch?: WebhookDispatchResponse;
+}
+//# sourceMappingURL=WebhookCallback.d.ts.map

package/dist/models/WebhookCallback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebhookCallback.d.ts","sourceRoot":"","sources":["../../src/models/WebhookCallback.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAEtD,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,iBAAiB,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,SAAS,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG,qBAAqB,GAAG,eAAe,CAAA;AAE3E,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,IAAI,CAAC,EAAE,WAAW,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,IAAI,CAAC,EAAE,WAAW,CAAA;IAClB,QAAQ,CAAC,EAAE,uBAAuB,CAAA;CACnC,CAAA;AAED,MAAM,WAAW,eAAe,CAAC,KAAK,GAAG,OAAO;IAC9C,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,IAAI,EAAE,KAAK,CAAA;IACX,QAAQ,CAAC,EAAE,uBAAuB,CAAA;CACnC"}

package/dist/models/WebhookCallback.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=WebhookCallback.js.map

package/dist/models/WebhookCallback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebhookCallback.js","sourceRoot":"","sources":["../../src/models/WebhookCallback.ts"],"names":[],"mappings":""}

package/dist/models/WebhookRequest.d.ts

@@ -0,0 +1,25 @@
+export type WebhookJson = string | number | boolean | null | readonly WebhookJson[] | {
+    readonly [key: string]: WebhookJson | undefined;
+};
+export type WebhookRequestMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+export type WebhookRequestBody = {
+    json: WebhookJson;
+    text?: never;
+} | {
+    json?: never;
+    text: string;
+};
+/**
+ * The outbound HTTP request the host dispatches once the webhook is open.
+ * Any string inside `url`, `headers` or `body` may carry
+ * {@link WEBHOOK_CALLBACK_URL_PLACEHOLDER}; the host replaces it with the
+ * callback URL right before sending.
+ */
+export type WebhookRequest = {
+    url: string;
+    method?: WebhookRequestMethod;
+    headers?: Record<string, string>;
+    body?: WebhookRequestBody;
+};
+export declare const WEBHOOK_CALLBACK_URL_PLACEHOLDER = "<<callbackUrl>>";
+//# sourceMappingURL=WebhookRequest.d.ts.map

package/dist/models/WebhookRequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebhookRequest.d.ts","sourceRoot":"","sources":["../../src/models/WebhookRequest.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,SAAS,WAAW,EAAE,GACtB;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAAA;CAAE,CAAA;AAEvD,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAA;AAE9E,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,CAAC,EAAE,KAAK,CAAA;CAAE,GACnC;IAAE,IAAI,CAAC,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAElC;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,oBAAoB,CAAA;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,EAAE,kBAAkB,CAAA;CAC1B,CAAA;AAED,eAAO,MAAM,gCAAgC,oBAAoB,CAAA"}

package/dist/models/WebhookRequest.js

@@ -0,0 +1,2 @@
+export const WEBHOOK_CALLBACK_URL_PLACEHOLDER = '<<callbackUrl>>';
+//# sourceMappingURL=WebhookRequest.js.map

package/dist/models/WebhookRequest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebhookRequest.js","sourceRoot":"","sources":["../../src/models/WebhookRequest.ts"],"names":[],"mappings":"AA2BA,MAAM,CAAC,MAAM,gCAAgC,GAAG,iBAAiB,CAAA"}

package/dist/tools/build-webhook-dispatch.d.ts

@@ -0,0 +1,14 @@
+import { type WebhookRequest, type WebhookRequestMethod } from '../models/WebhookRequest.js';
+export interface WebhookDispatch {
+    url: string;
+    method: WebhookRequestMethod;
+    headers: Record<string, string>;
+    body?: string;
+}
+/**
+ * Resolves {@link WEBHOOK_CALLBACK_URL_PLACEHOLDER} everywhere in the request
+ * and encodes the body. Hosts call this right before the HTTP call so both
+ * hosts dispatch the same bytes for the same input.
+ */
+export declare function buildWebhookDispatch(request: WebhookRequest, callbackUrl: string): WebhookDispatch;
+//# sourceMappingURL=build-webhook-dispatch.d.ts.map

package/dist/tools/build-webhook-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-webhook-dispatch.d.ts","sourceRoot":"","sources":["../../src/tools/build-webhook-dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAA;AAEpC,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,oBAAoB,CAAA;IAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AA0BD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,cAAc,EACvB,WAAW,EAAE,MAAM,GAClB,eAAe,CAyBjB"}

package/dist/tools/build-webhook-dispatch.js

@@ -0,0 +1,44 @@
+import { WEBHOOK_CALLBACK_URL_PLACEHOLDER, } from '../models/WebhookRequest.js';
+function replacePlaceholder(value, callbackUrl) {
+    if (typeof value === 'string')
+        return value.replaceAll(WEBHOOK_CALLBACK_URL_PLACEHOLDER, callbackUrl);
+    if (Array.isArray(value))
+        return value.map(item => replacePlaceholder(item, callbackUrl));
+    if (value && typeof value === 'object')
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+            key,
+            replacePlaceholder(item, callbackUrl),
+        ]));
+    return value;
+}
+function hasHeader(headers, name) {
+    const wanted = name.toLowerCase();
+    return Object.keys(headers).some(key => key.toLowerCase() === wanted);
+}
+/**
+ * Resolves {@link WEBHOOK_CALLBACK_URL_PLACEHOLDER} everywhere in the request
+ * and encodes the body. Hosts call this right before the HTTP call so both
+ * hosts dispatch the same bytes for the same input.
+ */
+export function buildWebhookDispatch(request, callbackUrl) {
+    const resolved = replacePlaceholder(request, callbackUrl);
+    const headers = { ...resolved.headers };
+    let body;
+    if (resolved.body?.json !== undefined) {
+        body = JSON.stringify(resolved.body.json);
+        if (!hasHeader(headers, 'content-type'))
+            headers['content-type'] = 'application/json';
+    }
+    else if (resolved.body?.text !== undefined) {
+        body = resolved.body.text;
+        if (!hasHeader(headers, 'content-type'))
+            headers['content-type'] = 'text/plain';
+    }
+    return {
+        url: resolved.url,
+        method: resolved.method ?? 'POST',
+        headers,
+        body,
+    };
+}
+//# sourceMappingURL=build-webhook-dispatch.js.map

package/dist/tools/build-webhook-dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-webhook-dispatch.js","sourceRoot":"","sources":["../../src/tools/build-webhook-dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gCAAgC,GAGjC,MAAM,6BAA6B,CAAA;AASpC,SAAS,kBAAkB,CAAC,KAAc,EAAE,WAAmB;IAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAC3B,OAAO,KAAK,CAAC,UAAU,CAAC,gCAAgC,EAAE,WAAW,CAAC,CAAA;IAExE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAA;IAEjE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QACpC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YACzC,GAAG;YACH,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC;SACtC,CAAC,CACH,CAAA;IAEH,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,SAAS,CAAC,OAA+B,EAAE,IAAY;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAEjC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAA;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAuB,EACvB,WAAmB;IAEnB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAmB,CAAA;IAE3E,MAAM,OAAO,GAA2B,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;IAE/D,IAAI,IAAwB,CAAA;IAE5B,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;QACtC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEzC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC;YACrC,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAA;IAChD,CAAC;SAAM,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAA;QAEzB,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC;YACrC,OAAO,CAAC,cAAc,CAAC,GAAG,YAAY,CAAA;IAC1C,CAAC;IAED,OAAO;QACL,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,MAAM;QACjC,OAAO;QACP,IAAI;KACL,CAAA;AACH,CAAC"}

package/dist/tools/callback-token.d.ts

@@ -0,0 +1,3 @@
+export declare function deriveCallbackToken(secret: string, activityId: string): string;
+export declare function isCallbackTokenValid(secret: string, activityId: string, token: string): boolean;
+//# sourceMappingURL=callback-token.d.ts.map

package/dist/tools/callback-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-token.d.ts","sourceRoot":"","sources":["../../src/tools/callback-token.ts"],"names":[],"mappings":"AAEA,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,UAKrE;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,WASd"}

package/dist/tools/callback-token.js

@@ -0,0 +1,14 @@
+import crypto from 'node:crypto';
+export function deriveCallbackToken(secret, activityId) {
+    return crypto
+        .createHmac('sha256', secret)
+        .update(activityId)
+        .digest('base64url');
+}
+export function isCallbackTokenValid(secret, activityId, token) {
+    const expected = Buffer.from(deriveCallbackToken(secret, activityId));
+    const candidate = Buffer.from(token);
+    return (expected.length === candidate.length &&
+        crypto.timingSafeEqual(expected, candidate));
+}
+//# sourceMappingURL=callback-token.js.map

package/dist/tools/callback-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-token.js","sourceRoot":"","sources":["../../src/tools/callback-token.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAEhC,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,UAAkB;IACpE,OAAO,MAAM;SACV,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;SAC5B,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC,WAAW,CAAC,CAAA;AACxB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,UAAkB,EAClB,KAAa;IAEb,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAA;IACrE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAEpC,OAAO,CACL,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QACpC,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,CAC5C,CAAA;AACH,CAAC"}

package/dist/tools/get-header.d.ts

@@ -0,0 +1,4 @@
+export type CallbackHeaders = Record<string, string | string[] | undefined>;
+export declare function getHeader(headers: CallbackHeaders, name: string): string | undefined;
+export declare function flattenHeaders(headers: CallbackHeaders): Record<string, string>;
+//# sourceMappingURL=get-header.d.ts.map

package/dist/tools/get-header.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-header.d.ts","sourceRoot":"","sources":["../../src/tools/get-header.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAA;AAE3E,wBAAgB,SAAS,CACvB,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,SAAS,CAYpB;AAED,wBAAgB,cAAc,CAC5B,OAAO,EAAE,eAAe,GACvB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAUxB"}

package/dist/tools/get-header.js

@@ -0,0 +1,21 @@
+export function getHeader(headers, name) {
+    const wanted = name.toLowerCase();
+    for (const [key, value] of Object.entries(headers)) {
+        if (key.toLowerCase() !== wanted)
+            continue;
+        if (Array.isArray(value))
+            return value[0];
+        return value;
+    }
+    return undefined;
+}
+export function flattenHeaders(headers) {
+    const result = {};
+    for (const [name, value] of Object.entries(headers)) {
+        if (value === undefined)
+            continue;
+        result[name.toLowerCase()] = Array.isArray(value) ? value.join(', ') : value;
+    }
+    return result;
+}
+//# sourceMappingURL=get-header.js.map

package/dist/tools/get-header.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-header.js","sourceRoot":"","sources":["../../src/tools/get-header.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,SAAS,CACvB,OAAwB,EACxB,IAAY;IAEZ,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAEjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM;YAAE,SAAQ;QAE1C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAA;QAEzC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,OAAwB;IAExB,MAAM,MAAM,GAA2B,EAAE,CAAA;IAEzC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QAEjC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC9E,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/tools/parse-callback-body.d.ts

@@ -0,0 +1,3 @@
+import type { WebhookJson } from '../models/WebhookRequest.js';
+export declare function parseCallbackBody(contentType: string | undefined, rawBody: string): WebhookJson | undefined;
+//# sourceMappingURL=parse-callback-body.d.ts.map

package/dist/tools/parse-callback-body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-callback-body.d.ts","sourceRoot":"","sources":["../../src/tools/parse-callback-body.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAM9D,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,OAAO,EAAE,MAAM,GACd,WAAW,GAAG,SAAS,CA2BzB"}

package/dist/tools/parse-callback-body.js

@@ -0,0 +1,25 @@
+const JSON_CONTENT_TYPE = /^application\/([\w.-]+\+)?json$/i;
+const FORM_CONTENT_TYPE = 'application/x-www-form-urlencoded';
+export function parseCallbackBody(contentType, rawBody) {
+    if (!rawBody.length)
+        return undefined;
+    const type = contentType?.split(';')[0]?.trim().toLowerCase() ?? '';
+    if (JSON_CONTENT_TYPE.test(type))
+        try {
+            return JSON.parse(rawBody);
+        }
+        catch {
+            return rawBody;
+        }
+    if (type === FORM_CONTENT_TYPE) {
+        const params = new URLSearchParams(rawBody);
+        const result = {};
+        for (const key of new Set(params.keys())) {
+            const values = params.getAll(key);
+            result[key] = values.length === 1 ? values[0] : values;
+        }
+        return result;
+    }
+    return rawBody;
+}
+//# sourceMappingURL=parse-callback-body.js.map

package/dist/tools/parse-callback-body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-callback-body.js","sourceRoot":"","sources":["../../src/tools/parse-callback-body.ts"],"names":[],"mappings":"AAEA,MAAM,iBAAiB,GAAG,kCAAkC,CAAA;AAE5D,MAAM,iBAAiB,GAAG,mCAAmC,CAAA;AAE7D,MAAM,UAAU,iBAAiB,CAC/B,WAA+B,EAC/B,OAAe;IAEf,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAErC,MAAM,IAAI,GAAG,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAA;IAEnE,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgB,CAAA;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,CAAA;QAChB,CAAC;IAEH,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,CAAA;QAE3C,MAAM,MAAM,GAAgC,EAAE,CAAA;QAE9C,KAAK,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAEjC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,MAAM,CAAA;QACzD,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/tools/timing-safe-equal-string.d.ts

@@ -0,0 +1,2 @@
+export declare function timingSafeEqualString(expected: string, candidate: string): boolean;
+//# sourceMappingURL=timing-safe-equal-string.d.ts.map

package/dist/tools/timing-safe-equal-string.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timing-safe-equal-string.d.ts","sourceRoot":"","sources":["../../src/tools/timing-safe-equal-string.ts"],"names":[],"mappings":"AAEA,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,WAOxE"}

package/dist/tools/timing-safe-equal-string.js

@@ -0,0 +1,9 @@
+import crypto from 'node:crypto';
+export function timingSafeEqualString(expected, candidate) {
+    const a = Buffer.from(expected, 'utf8');
+    const b = Buffer.from(candidate, 'utf8');
+    if (a.length !== b.length)
+        return false;
+    return crypto.timingSafeEqual(a, b);
+}
+//# sourceMappingURL=timing-safe-equal-string.js.map

package/dist/tools/timing-safe-equal-string.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timing-safe-equal-string.js","sourceRoot":"","sources":["../../src/tools/timing-safe-equal-string.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAEhC,MAAM,UAAU,qBAAqB,CAAC,QAAgB,EAAE,SAAiB;IACvE,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IAExC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAEvC,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AACrC,CAAC"}

package/dist/tools/verify-callback-auth.d.ts

@@ -0,0 +1,9 @@
+import type { AsyncActivityCallbackAuth } from '@t4h.framework/core';
+import { type CallbackHeaders } from './get-header.js';
+export interface CallbackRequest {
+    method: string;
+    headers: CallbackHeaders;
+    rawBody: string;
+}
+export declare function verifyCallbackAuth(auth: AsyncActivityCallbackAuth | undefined, request: CallbackRequest): Promise<boolean>;
+//# sourceMappingURL=verify-callback-auth.d.ts.map

package/dist/tools/verify-callback-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-callback-auth.d.ts","sourceRoot":"","sources":["../../src/tools/verify-callback-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,yBAAyB,EAM1B,MAAM,qBAAqB,CAAA;AAI5B,OAAO,EAAa,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAGjE,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,eAAe,CAAA;IACxB,OAAO,EAAE,MAAM,CAAA;CAChB;AAuGD,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,yBAAyB,GAAG,SAAS,EAC3C,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,OAAO,CAAC,CAmBlB"}

package/dist/tools/verify-callback-auth.js

@@ -0,0 +1,89 @@
+import hmac from '@t4h.framework/hmac/authorize';
+import jwks from '@t4h.framework/jwks/authorize';
+import { getHeader } from './get-header.js';
+import { timingSafeEqualString } from './timing-safe-equal-string.js';
+const BEARER = /^Bearer\s+(.+)$/i;
+function getBearerToken(headers, name = 'authorization') {
+    const value = getHeader(headers, name);
+    if (!value)
+        return undefined;
+    return BEARER.exec(value)?.[1]?.trim();
+}
+function verifyHmac(auth, request) {
+    const signature = getHeader(request.headers, auth.header);
+    if (!signature)
+        return false;
+    const timestamp = auth.timestampHeader
+        ? getHeader(request.headers, auth.timestampHeader)
+        : undefined;
+    if (auth.timestampHeader && !timestamp)
+        return false;
+    const rawPayload = (auth.signedPayload ?? '{body}')
+        .replaceAll('{timestamp}', timestamp ?? '')
+        .replaceAll('{body}', request.rawBody);
+    return hmac({
+        secret: auth.secret,
+        signature,
+        rawPayload,
+        algorithm: auth.algorithm,
+        signatureFormat: auth.signatureFormat,
+        signaturePrefix: auth.signaturePrefix,
+        timestamp,
+        toleranceInSeconds: auth.toleranceInSeconds,
+    });
+}
+function verifyBasic(auth, request) {
+    const value = getHeader(request.headers, 'authorization');
+    if (!value)
+        return false;
+    const expected = `Basic ${Buffer.from(`${auth.username}:${auth.password}`).toString('base64')}`;
+    return timingSafeEqualString(expected, value);
+}
+function verifyHeader(auth, request) {
+    const value = getHeader(request.headers, auth.name);
+    if (!value)
+        return false;
+    return timingSafeEqualString(auth.value, value);
+}
+function verifyBearer(auth, request) {
+    const token = getBearerToken(request.headers);
+    if (!token)
+        return false;
+    return timingSafeEqualString(auth.token, token);
+}
+async function verifyJwt(auth, request) {
+    const token = getBearerToken(request.headers, auth.header);
+    if (!token)
+        return false;
+    try {
+        return await jwks({
+            url: auth.jwksUri,
+            signature: token,
+            rawPayload: '',
+            issuer: auth.issuer,
+            audience: auth.audience,
+        });
+    }
+    catch {
+        return false;
+    }
+}
+export async function verifyCallbackAuth(auth, request) {
+    if (!auth)
+        return true;
+    switch (auth.type) {
+        case 'hmac':
+            return verifyHmac(auth, request);
+        case 'basic':
+            return verifyBasic(auth, request);
+        case 'header':
+            return verifyHeader(auth, request);
+        case 'bearer':
+            return verifyBearer(auth, request);
+        case 'jwt':
+            return verifyJwt(auth, request);
+        default:
+            throw new TypeError(`Unsupported callback auth type: ${String(auth.type)}`);
+    }
+}
+//# sourceMappingURL=verify-callback-auth.js.map

package/dist/tools/verify-callback-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-callback-auth.js","sourceRoot":"","sources":["../../src/tools/verify-callback-auth.ts"],"names":[],"mappings":"AAQA,OAAO,IAAI,MAAM,+BAA+B,CAAA;AAChD,OAAO,IAAI,MAAM,+BAA+B,CAAA;AAEhD,OAAO,EAAE,SAAS,EAAwB,MAAM,iBAAiB,CAAA;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAQrE,MAAM,MAAM,GAAG,kBAAkB,CAAA;AAEjC,SAAS,cAAc,CACrB,OAAwB,EACxB,IAAI,GAAG,eAAe;IAEtB,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAEtC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAE5B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;AACxC,CAAC;AAED,SAAS,UAAU,CACjB,IAAmC,EACnC,OAAwB;IAExB,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAEzD,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAE5B,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe;QACpC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC;QAClD,CAAC,CAAC,SAAS,CAAA;IAEb,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAEpD,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC;SAChD,UAAU,CAAC,aAAa,EAAE,SAAS,IAAI,EAAE,CAAC;SAC1C,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IAExC,OAAO,IAAI,CAAC;QACV,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS;QACT,UAAU;QACV,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,SAAS;QACT,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;KAC5C,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,IAAoC,EACpC,OAAwB;IAExB,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAA;IAEzD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IAExB,MAAM,QAAQ,GAAG,SAAS,MAAM,CAAC,IAAI,CACnC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CACpC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;IAEtB,OAAO,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;AAC/C,CAAC;AAED,SAAS,YAAY,CACnB,IAAqC,EACrC,OAAwB;IAExB,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IAEnD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IAExB,OAAO,qBAAqB,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,YAAY,CACnB,IAAqC,EACrC,OAAwB;IAExB,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAE7C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IAExB,OAAO,qBAAqB,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;AACjD,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,IAAkC,EAClC,OAAwB;IAExB,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAE1D,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IAExB,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC;YAChB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,EAAE;YACd,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAA2C,EAC3C,OAAwB;IAExB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IAEtB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAClC,KAAK,OAAO;YACV,OAAO,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACnC,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACpC,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACpC,KAAK,KAAK;YACR,OAAO,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACjC;YACE,MAAM,IAAI,SAAS,CACjB,mCAAmC,MAAM,CAAE,IAA2B,CAAC,IAAI,CAAC,EAAE,CAC/E,CAAA;IACL,CAAC;AACH,CAAC"}

package/dist/webhook.d.ts

@@ -0,0 +1,11 @@
+export * from './activities/WebhookActivity.js';
+export * from './errors/WebhookCallbackUrlError.js';
+export * from './errors/WebhookRejectedError.js';
+export * from './models/WebhookCallback.js';
+export * from './models/WebhookRequest.js';
+export * from './tools/build-webhook-dispatch.js';
+export * from './tools/callback-token.js';
+export * from './tools/get-header.js';
+export * from './tools/parse-callback-body.js';
+export * from './tools/verify-callback-auth.js';
+//# sourceMappingURL=webhook.d.ts.map

package/dist/webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../src/webhook.ts"],"names":[],"mappings":"AAAA,cAAc,iCAAiC,CAAA;AAC/C,cAAc,qCAAqC,CAAA;AACnD,cAAc,kCAAkC,CAAA;AAChD,cAAc,6BAA6B,CAAA;AAC3C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,mCAAmC,CAAA;AACjD,cAAc,2BAA2B,CAAA;AACzC,cAAc,uBAAuB,CAAA;AACrC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,iCAAiC,CAAA"}

package/dist/webhook.js

@@ -0,0 +1,11 @@
+export * from './activities/WebhookActivity.js';
+export * from './errors/WebhookCallbackUrlError.js';
+export * from './errors/WebhookRejectedError.js';
+export * from './models/WebhookCallback.js';
+export * from './models/WebhookRequest.js';
+export * from './tools/build-webhook-dispatch.js';
+export * from './tools/callback-token.js';
+export * from './tools/get-header.js';
+export * from './tools/parse-callback-body.js';
+export * from './tools/verify-callback-auth.js';
+//# sourceMappingURL=webhook.js.map

package/dist/webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.js","sourceRoot":"","sources":["../src/webhook.ts"],"names":[],"mappings":"AAAA,cAAc,iCAAiC,CAAA;AAC/C,cAAc,qCAAqC,CAAA;AACnD,cAAc,kCAAkC,CAAA;AAChD,cAAc,6BAA6B,CAAA;AAC3C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,mCAAmC,CAAA;AACjD,cAAc,2BAA2B,CAAA;AACzC,cAAc,uBAAuB,CAAA;AACrC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,iCAAiC,CAAA"}

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@t4h.framework/webhook",
+  "version": "0.0.0-experimental-20260908180423",
+  "description": "Webhook module for the T4H Framework",
+  "homepage": "https://github.com/tech4humans-brasil/framework/tree/main/packages/webhook",
+  "bugs": "https://github.com/tech4humans-brasil/framework/issues",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/tech4humans-brasil/framework.git",
+    "directory": "packages/webhook"
+  },
+  "license": "MIT",
+  "author": "Tech4Humans <contact@tech4h.com.br> (https://tech4h.com.br)",
+  "type": "module",
+  "exports": {
+    "types": "./dist/webhook.d.ts",
+    "import": "./dist/webhook.js"
+  },
+  "module": "./dist/webhook.js",
+  "types": "./dist/webhook.d.ts",
+  "files": [
+    "dist",
+    "LICENSE",
+    ".ai"
+  ],
+  "scripts": {
+    "build": "tsc --project tsconfig.build.json",
+    "check-types": "tsc --noEmit",
+    "prepublishOnly": "yarn build",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "dependencies": {
+    "@t4h.framework/hmac": "^0.0.0-experimental-20260908180423",
+    "@t4h.framework/jwks": "^0.0.0-experimental-20260908180423",
+    "typebox": "^1.1.6"
+  },
+  "devDependencies": {
+    "@t4h.framework/core": "^0.0.0-experimental-20260908180423",
+    "@t4h.framework/http": "^0.0.0-experimental-20260908180423",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.18"
+  },
+  "peerDependencies": {
+    "@t4h.framework/core": "^0.0.0-experimental-20260908180423",
+    "@t4h.framework/http": "^0.0.0-experimental-20260908180423"
+  },
+  "packageManager": "yarn@4.12.0",
+  "engines": {
+    "node": ">=22"
+  }
+}