@tangle-network/agent-integrations 0.46.0 → 0.48.0

package/dist/{chunk-CPZUNSKB.js → chunk-G3S6OGY6.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-IA5GCKM6.js";
 import {
   adapters_exports
-} from "./chunk-F6MF4YNI.js";
+} from "./chunk-EPDUDWOD.js";
 
 // src/activepieces-catalog.ts
 import { readFileSync } from "fs";
@@ -4334,4 +4334,4 @@ export {
   signCapability,
   verifyCapabilityToken
 };
-//# sourceMappingURL=chunk-CPZUNSKB.js.map
+//# sourceMappingURL=chunk-G3S6OGY6.js.map

package/dist/connectors/adapters/index.js

@@ -539,7 +539,7 @@ import {
   zohoDeskConnector,
   zoominfoConnector,
   zuoraConnector
-} from "../../chunk-F6MF4YNI.js";
+} from "../../chunk-EPDUDWOD.js";
 import "../../chunk-2TW2QKGZ.js";
 import {
   DEFAULT_TANGLE_PLATFORM_URL,

package/dist/connectors/index.js

@@ -546,7 +546,7 @@ import {
   zohoDeskConnector,
   zoominfoConnector,
   zuoraConnector
-} from "../chunk-F6MF4YNI.js";
+} from "../chunk-EPDUDWOD.js";
 import {
   DEFAULT_SIGNATURE_TOLERANCE_SECONDS,
   firstHeader,

package/dist/index.js

@@ -119,7 +119,7 @@ import {
   validateIntegrationManifest,
   validateProviderPassthroughRequest,
   verifyCapabilityToken
-} from "./chunk-CPZUNSKB.js";
+} from "./chunk-G3S6OGY6.js";
 import {
   InMemoryConnectStateStore,
   finishConnectFlow,
@@ -714,7 +714,7 @@ import {
   zohoDeskConnector,
   zoominfoConnector,
   zuoraConnector
-} from "./chunk-F6MF4YNI.js";
+} from "./chunk-EPDUDWOD.js";
 import {
   DEFAULT_SIGNATURE_TOLERANCE_SECONDS,
   firstHeader,

package/dist/mcp.js

@@ -2,7 +2,7 @@ import {
   IntegrationError,
   createCatalogExecutorProvider,
   importMcpConnector
-} from "./chunk-CPZUNSKB.js";
+} from "./chunk-G3S6OGY6.js";
 import "./chunk-S2BUASSV.js";
 import "./chunk-LA76XB7M.js";
 import "./chunk-H4XYLS7T.js";
@@ -10,7 +10,7 @@ import "./chunk-VLVSP7SP.js";
 import "./chunk-IA5GCKM6.js";
 import "./chunk-7P2LN4VT.js";
 import "./chunk-376UBTNB.js";
-import "./chunk-F6MF4YNI.js";
+import "./chunk-EPDUDWOD.js";
 import "./chunk-2TW2QKGZ.js";
 import "./chunk-UWF33ESC.js";
 import "./chunk-PZ5AY32C.js";

package/dist/registry.js

@@ -5,7 +5,7 @@ import {
   composeIntegrationRegistry,
   inferIntegrationSupportTier,
   summarizeIntegrationRegistry
-} from "./chunk-CPZUNSKB.js";
+} from "./chunk-G3S6OGY6.js";
 import "./chunk-S2BUASSV.js";
 import "./chunk-LA76XB7M.js";
 import "./chunk-H4XYLS7T.js";
@@ -13,7 +13,7 @@ import "./chunk-VLVSP7SP.js";
 import "./chunk-IA5GCKM6.js";
 import "./chunk-7P2LN4VT.js";
 import "./chunk-376UBTNB.js";
-import "./chunk-F6MF4YNI.js";
+import "./chunk-EPDUDWOD.js";
 import "./chunk-2TW2QKGZ.js";
 import "./chunk-UWF33ESC.js";
 import "./chunk-PZ5AY32C.js";

package/dist/{router-S0Dadv2x.d.ts → router-ddcgTV2y.d.ts}

@@ -61,6 +61,35 @@ type SignatureVerification = {
     valid: false;
     reason: string;
 };
+/** One declared triggerable event, in the runtime `eventType` namespace a
+ *  provider's `parse` emits. */
+interface TriggerEventDescriptor {
+    /** The `eventType` a workflow `provider_event` trigger matches on
+     *  (`slack.app_mention`, `charge.succeeded`). */
+    id: string;
+    /** Short human label for authoring surfaces; optional. */
+    title?: string;
+}
+/** The set of events a provider can deliver, for author-time validation of
+ *  workflow `provider_event` triggers. Co-located with the provider's `parse`
+ *  (the source of the runtime namespace) so the two cannot drift — see the
+ *  per-provider drift tests. Consumers validate an authored event with two
+ *  checks: it must carry `namespace` (a prefix-less event on a namespaced
+ *  provider can never be delivered), and — only when `closed` — be one of
+ *  `events` (an exhaustive set makes an unlisted event an authoring error). */
+interface TriggerEventCatalog {
+    /** Required prefix every `parse`-emitted `eventType` carries (`slack.`,
+     *  `telegram.`), or `null` when the provider emits raw event names (stripe). */
+    namespace: string | null;
+    /** Declared events. Exhaustive iff `closed`; otherwise authoring hints for an
+     *  open, provider-owned vocabulary. */
+    events: readonly TriggerEventDescriptor[];
+    /** True when `events` is the COMPLETE deliverable set, so an event outside it
+     *  is rejected. False when the provider owns an open-ended vocabulary it keeps
+     *  adding to (Stripe's ~250 types, Slack's Events API) and only `namespace`
+     *  can be authoritatively enforced. */
+    closed: boolean;
+}
 /** Per-provider plug-in. Stateless — the router calls `verifySignature`
  *  then `parse` on every request. The provider's HTTP-shape concerns
  *  (e.g., raw body required) are documented per provider. */
@@ -93,6 +122,10 @@ interface WebhookProvider {
         body: string;
         headers?: Record<string, string>;
     };
+    /** Declared triggerable-event catalog, for author-time validation of workflow
+     *  `provider_event` triggers. Optional: a provider without one is left
+     *  unvalidated by consumers (the trigger still installs). */
+    eventCatalog?: TriggerEventCatalog;
 }
 interface WebhookIdempotencyStore {
     /** Returns true if this providerEventId has been processed already.
@@ -156,4 +189,4 @@ declare class WebhookRouter {
     private deliverEach;
 }
 
-export { type SignatureVerification as S, type WebhookProvider as W, type WebhookEnvelope as a, type WebhookHeaders as b, type WebhookIdempotencyStore as c, WebhookRouter as d, type WebhookRouterOptions as e, type WebhookRouterRequest as f, type WebhookRouterResponse as g };
+export { type SignatureVerification as S, type TriggerEventCatalog as T, type WebhookProvider as W, type TriggerEventDescriptor as a, type WebhookEnvelope as b, type WebhookHeaders as c, type WebhookIdempotencyStore as d, WebhookRouter as e, type WebhookRouterOptions as f, type WebhookRouterRequest as g, type WebhookRouterResponse as h };

package/dist/runtime.js

@@ -2,7 +2,7 @@ import {
   InMemoryIntegrationGrantStore,
   IntegrationRuntime,
   createIntegrationRuntime
-} from "./chunk-CPZUNSKB.js";
+} from "./chunk-G3S6OGY6.js";
 import "./chunk-S2BUASSV.js";
 import "./chunk-LA76XB7M.js";
 import "./chunk-H4XYLS7T.js";
@@ -10,7 +10,7 @@ import "./chunk-VLVSP7SP.js";
 import "./chunk-IA5GCKM6.js";
 import "./chunk-7P2LN4VT.js";
 import "./chunk-376UBTNB.js";
-import "./chunk-F6MF4YNI.js";
+import "./chunk-EPDUDWOD.js";
 import "./chunk-2TW2QKGZ.js";
 import "./chunk-UWF33ESC.js";
 import "./chunk-PZ5AY32C.js";

package/dist/stripe/index.d.ts

@@ -1,5 +1,5 @@
 import { I as IntegrationRuntimeError, a as IntegrationUserAction } from '../errors-Bg3_rxnQ.js';
-import { a as WebhookEnvelope } from '../router-S0Dadv2x.js';
+import { b as WebhookEnvelope } from '../router-ddcgTV2y.js';
 
 /**
  * Subscription state machine.

package/dist/webhooks/index.d.ts

@@ -1,5 +1,5 @@
-import { W as WebhookProvider } from '../router-S0Dadv2x.js';
-export { S as SignatureVerification, a as WebhookEnvelope, b as WebhookHeaders, c as WebhookIdempotencyStore, d as WebhookRouter, e as WebhookRouterOptions, f as WebhookRouterRequest, g as WebhookRouterResponse } from '../router-S0Dadv2x.js';
+import { W as WebhookProvider } from '../router-ddcgTV2y.js';
+export { S as SignatureVerification, T as TriggerEventCatalog, a as TriggerEventDescriptor, b as WebhookEnvelope, c as WebhookHeaders, d as WebhookIdempotencyStore, e as WebhookRouter, f as WebhookRouterOptions, g as WebhookRouterRequest, h as WebhookRouterResponse } from '../router-ddcgTV2y.js';
 
 /**
  * Pre-built `WebhookProvider` implementations for the inbound surfaces

package/dist/webhooks/index.js

@@ -117,6 +117,26 @@ var stripeWebhookProvider = {
         headers: normalizeHeaders(headers)
       }
     ];
+  },
+  eventCatalog: {
+    // Stripe emits the raw event `type` (`charge.succeeded`) — no namespace, and
+    // an OPEN, versioned vocabulary (~250 types), so these are authoring hints,
+    // not a gate.
+    namespace: null,
+    closed: false,
+    events: [
+      { id: "checkout.session.completed" },
+      { id: "checkout.session.expired" },
+      { id: "customer.subscription.created" },
+      { id: "customer.subscription.updated" },
+      { id: "customer.subscription.deleted" },
+      { id: "invoice.paid" },
+      { id: "invoice.payment_failed" },
+      { id: "payment_intent.succeeded" },
+      { id: "payment_intent.payment_failed" },
+      { id: "charge.succeeded" },
+      { id: "charge.refunded" }
+    ]
   }
 };
 var slackWebhookProvider = {
@@ -148,6 +168,26 @@ var slackWebhookProvider = {
       payload: evt,
       headers: normalizeHeaders(headers)
     }];
+  },
+  eventCatalog: {
+    // Slack namespaces every event `slack.<events-api-type>`, so a prefix-less
+    // event is provably dead. The Events API vocabulary is open (Slack adds
+    // types), so `events` are hints, not a gate. `slack.url_verification` (the
+    // config handshake) is intentionally excluded — it carries no workflow
+    // meaning and is answered before dispatch.
+    namespace: "slack.",
+    closed: false,
+    events: [
+      { id: "slack.message" },
+      { id: "slack.app_mention" },
+      { id: "slack.reaction_added" },
+      { id: "slack.reaction_removed" },
+      { id: "slack.channel_created" },
+      { id: "slack.member_joined_channel" },
+      { id: "slack.team_join" },
+      { id: "slack.app_home_opened" },
+      { id: "slack.file_shared" }
+    ]
   }
 };
 var docusealWebhookProvider = {
@@ -172,6 +212,23 @@ var docusealWebhookProvider = {
       payload: evt,
       headers: normalizeHeaders(headers)
     }];
+  },
+  eventCatalog: {
+    // DocuSeal namespaces every event `docuseal.<event_type>`. The documented
+    // set is small but not derivable from `parse`, so it stays open (namespace
+    // is the authoritative gate) with the documented types as hints.
+    namespace: "docuseal.",
+    closed: false,
+    events: [
+      { id: "docuseal.form.viewed" },
+      { id: "docuseal.form.started" },
+      { id: "docuseal.form.completed" },
+      { id: "docuseal.form.declined" },
+      { id: "docuseal.submission.created" },
+      { id: "docuseal.submission.completed" },
+      { id: "docuseal.submission.expired" },
+      { id: "docuseal.submission.archived" }
+    ]
   }
 };
 var gmailWebhookProvider = {
@@ -288,6 +345,15 @@ var telegramWebhookProvider = {
       payload: evt,
       headers: normalizeHeaders(headers)
     }];
+  },
+  eventCatalog: {
+    // Derived from the SAME TELEGRAM_UPDATE_KEYS `parse` matches on, so the
+    // catalog is exhaustive and cannot drift — hence `closed`. (`telegram.unknown`,
+    // parse's fallback for an update with no recognized key, is intentionally
+    // excluded: it is not a triggerable event.)
+    namespace: "telegram.",
+    closed: true,
+    events: TELEGRAM_UPDATE_KEYS.map((k) => ({ id: `telegram.${k}` }))
   }
 };
 var hellosignWebhookProvider = {
@@ -325,6 +391,24 @@ var hellosignWebhookProvider = {
       payload: body,
       headers: normalizeHeaders(headers)
     }];
+  },
+  eventCatalog: {
+    // Dropbox Sign namespaces every event `hellosign.<event_type>`. Documented
+    // set as hints; namespace is the authoritative gate. `callback_test` (the
+    // app-config ping) is intentionally excluded — it is not a workflow event.
+    namespace: "hellosign.",
+    closed: false,
+    events: [
+      { id: "hellosign.signature_request_sent" },
+      { id: "hellosign.signature_request_viewed" },
+      { id: "hellosign.signature_request_signed" },
+      { id: "hellosign.signature_request_all_signed" },
+      { id: "hellosign.signature_request_declined" },
+      { id: "hellosign.signature_request_reassigned" },
+      { id: "hellosign.signature_request_remind" },
+      { id: "hellosign.signature_request_canceled" },
+      { id: "hellosign.signature_request_expired" }
+    ]
   }
 };
 var CLAY_EVENT_ID_KEYS = ["id", "rowId", "recordId", "clayRowId", "eventId"];

package/dist/webhooks/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/webhooks/router.ts","../../src/webhooks/providers.ts"],"sourcesContent":["/**\n * @stable Provider-agnostic inbound webhook router.\n *\n * Consumer hooks a single HTTP handler at `/webhook/:provider/:event`\n * (or whatever pathing they prefer) and forwards the request through\n * `WebhookRouter.handle()`. The router:\n *\n *   1. Resolves the registered provider entry.\n *   2. Calls the provider's `verifySignature(rawBody, headers, secrets)`.\n *      Failure → 401 fast, no downstream work.\n *   3. Calls the provider's `parse(rawBody, headers)` to extract zero or\n *      more normalized events.\n *   4. Enqueues each event for async processing via the consumer-supplied\n *      `deliver(event)` callback (best-effort fire-and-forget — the\n *      router does NOT block the HTTP response on the consumer's work).\n *   5. Returns 200 fast with `{received: events.length}`.\n *\n * Replay protection: providers that sign timestamps (Stripe, Slack)\n * already reject stale signatures inside `verifySignature`. For providers\n * that don't (DocuSeal, GDrive push), the router exposes a pluggable\n * `idempotency` hook: if `idempotency.seen(providerEventId)` returns\n * true, the router 200s without invoking `deliver()`. Consumers wire\n * this to a durable kv (D1 / Redis / Postgres unique-index).\n *\n * Why a router and not a per-provider express app: the runtime contract\n * a product cares about is \"an inbound event came in, here's the\n * normalized envelope\". Verification, parsing, and idempotency-dedup\n * are mechanical and provider-specific — the router owns them. The\n * consumer's `deliver()` is the only place product logic runs.\n *\n * Stability: `@stable` — additions to `WebhookEnvelope` must be\n * additive; the router's HTTP contract (paths, status codes) is frozen\n * at 200 (ok), 400 (bad request), 401 (bad signature), 404 (unknown\n * provider), 405 (provider has no inbound surface).\n */\n\nexport interface WebhookHeaders {\n  [name: string]: string | string[] | undefined\n}\n\n/** Normalized inbound event the router emits after parsing. */\nexport interface WebhookEnvelope<TPayload = unknown> {\n  /** Provider id (matches the `:provider` path segment). */\n  provider: string\n  /** Optional event class — e.g., 'customer.subscription.deleted'. The\n   *  provider's parser decides. Used for routing inside `deliver()`. */\n  eventType: string\n  /** Provider-emitted event id, when present. Used for the idempotency\n   *  short-circuit. */\n  providerEventId?: string\n  /** Wall-clock receive time. */\n  receivedAt: number\n  /** Provider payload, normalized to the provider's documented event\n   *  shape. The router does NOT reshape this — `parse()` is the contract. */\n  payload: TPayload\n  /** Headers passed through for downstream handlers that want them\n   *  (e.g., to extract custom routing metadata). Always lowercased keys. */\n  headers: Record<string, string>\n}\n\nexport type SignatureVerification =\n  | { valid: true }\n  | { valid: false; reason: string }\n\n/** Per-provider plug-in. Stateless — the router calls `verifySignature`\n *  then `parse` on every request. The provider's HTTP-shape concerns\n *  (e.g., raw body required) are documented per provider. */\nexport interface WebhookProvider {\n  /** Stable provider id (`stripe`, `docuseal`, `gdrive`, ...). */\n  id: string\n  /** Verify the inbound signature. Receives the EXACT raw body string —\n   *  consumers MUST preserve raw bytes through their HTTP server (do not\n   *  parse JSON before forwarding here). */\n  verifySignature(input: {\n    rawBody: string\n    headers: WebhookHeaders\n    secret: string\n  }): SignatureVerification\n  /** Parse the validated raw body into zero or more normalized events.\n   *  A single push payload may carry multiple events (e.g., Slack bulk\n   *  delivery). Return [] to ack the push as a no-op. */\n  parse(input: {\n    rawBody: string\n    headers: WebhookHeaders\n    now?: number\n  }): WebhookEnvelope[] | Promise<WebhookEnvelope[]>\n  /** Optional provider-specific 200 ACK the router returns on a verified\n   *  delivery, in place of the default `{ received, total }` JSON. Dropbox Sign\n   *  acknowledges a delivery only when the body is exactly\n   *  'Hello API Event Received' and retries otherwise; this lets such a\n   *  provider declare the body/headers it needs. The frozen status contract is\n   *  unchanged — only the 200 body/headers are customized. */\n  successResponse?: { body: string; headers?: Record<string, string> }\n}\n\nexport interface WebhookIdempotencyStore {\n  /** Returns true if this providerEventId has been processed already.\n   *  Implementations should be O(1) (Redis SETNX, D1 UNIQUE constraint). */\n  seen(providerEventId: string): Promise<boolean> | boolean\n  /** Marks a providerEventId as processed. Called AFTER `deliver()` has\n   *  been invoked. */\n  remember(providerEventId: string, ttlMs: number): Promise<void> | void\n}\n\nexport interface WebhookRouterOptions {\n  /** Provider registry. Pass any number of providers; routing is by id. */\n  providers: WebhookProvider[]\n  /** Async callback invoked with every accepted event. Fire-and-forget\n   *  from the router's perspective — the HTTP response is sent before\n   *  this resolves. Throws are caught and reported via `onError`. */\n  deliver(event: WebhookEnvelope): Promise<void> | void\n  /** Resolve the signing secret for a provider id at request time. The\n   *  router never holds secrets — the consumer's vault resolves them. */\n  resolveSecret(providerId: string, headers: WebhookHeaders): Promise<string | null> | string | null\n  /** Optional idempotency-dedup hook. Required for providers that don't\n   *  sign timestamps in their signature scheme (DocuSeal, Drive push). */\n  idempotency?: WebhookIdempotencyStore\n  /** TTL on idempotency entries. Default 7 days — long enough that a\n   *  provider's normal retry-window can't re-deliver. */\n  idempotencyTtlMs?: number\n  /** Surface delivery errors. Default: console.error. */\n  onError?(err: unknown, context: { provider: string; eventType?: string; providerEventId?: string }): void\n  /** Override `now()` for tests. */\n  now?(): number\n}\n\nexport interface WebhookRouterRequest {\n  providerId: string\n  rawBody: string\n  headers: WebhookHeaders\n}\n\nexport interface WebhookRouterResponse {\n  status: number\n  body: unknown\n  headers?: Record<string, string>\n}\n\n/**\n * Router instance. Stateless aside from the provider registry — safe to\n * share across requests; build once per process.\n */\nexport class WebhookRouter {\n  private readonly providers: Map<string, WebhookProvider>\n  private readonly deliver: WebhookRouterOptions['deliver']\n  private readonly resolveSecret: WebhookRouterOptions['resolveSecret']\n  private readonly idempotency?: WebhookIdempotencyStore\n  private readonly idempotencyTtlMs: number\n  private readonly onError: NonNullable<WebhookRouterOptions['onError']>\n  private readonly nowFn: () => number\n\n  constructor(opts: WebhookRouterOptions) {\n    this.providers = new Map(opts.providers.map((p) => [p.id, p]))\n    this.deliver = opts.deliver\n    this.resolveSecret = opts.resolveSecret\n    this.idempotency = opts.idempotency\n    this.idempotencyTtlMs = opts.idempotencyTtlMs ?? 7 * 24 * 60 * 60 * 1000\n    this.onError = opts.onError ?? defaultOnError\n    this.nowFn = opts.now ?? Date.now\n  }\n\n  /** Process one inbound webhook request. Pure with respect to side-\n   *  effects on the router instance — safe to call concurrently. */\n  async handle(request: WebhookRouterRequest): Promise<WebhookRouterResponse> {\n    const provider = this.providers.get(request.providerId)\n    if (!provider) {\n      return { status: 404, body: { error: 'unknown_provider', provider: request.providerId } }\n    }\n    const secret = await this.resolveSecret(provider.id, request.headers)\n    if (!secret) {\n      return { status: 401, body: { error: 'missing_secret', provider: provider.id } }\n    }\n    const verification = provider.verifySignature({\n      rawBody: request.rawBody,\n      headers: request.headers,\n      secret,\n    })\n    if (!verification.valid) {\n      return { status: 401, body: { error: 'invalid_signature', reason: verification.reason } }\n    }\n\n    let events: WebhookEnvelope[]\n    try {\n      events = await provider.parse({ rawBody: request.rawBody, headers: request.headers, now: this.nowFn() })\n    } catch (err) {\n      this.onError(err, { provider: provider.id })\n      return { status: 400, body: { error: 'parse_error', message: errMessage(err) } }\n    }\n\n    const accepted: WebhookEnvelope[] = []\n    for (const event of events) {\n      if (event.providerEventId && this.idempotency) {\n        const already = await this.idempotency.seen(event.providerEventId)\n        if (already) continue\n      }\n      accepted.push(event)\n    }\n\n    // Deliver async — do NOT block the HTTP response. Errors land in\n    // `onError`; the provider already got its 200 by then so it will\n    // not retry.\n    queueMicrotask(() => {\n      void this.deliverEach(accepted)\n    })\n\n    if (provider.successResponse) {\n      return {\n        status: 200,\n        body: provider.successResponse.body,\n        headers: provider.successResponse.headers,\n      }\n    }\n    return { status: 200, body: { received: accepted.length, total: events.length } }\n  }\n\n  private async deliverEach(events: WebhookEnvelope[]): Promise<void> {\n    for (const event of events) {\n      try {\n        await this.deliver(event)\n        if (event.providerEventId && this.idempotency) {\n          await this.idempotency.remember(event.providerEventId, this.idempotencyTtlMs)\n        }\n      } catch (err) {\n        this.onError(err, {\n          provider: event.provider,\n          eventType: event.eventType,\n          providerEventId: event.providerEventId,\n        })\n      }\n    }\n  }\n}\n\nfunction defaultOnError(err: unknown, context: { provider: string; eventType?: string; providerEventId?: string }): void {\n  // eslint-disable-next-line no-console\n  console.error('[WebhookRouter]', context, err)\n}\n\nfunction errMessage(err: unknown): string {\n  return err instanceof Error ? err.message : String(err)\n}\n","/**\n * Pre-built `WebhookProvider` implementations for the inbound surfaces\n * the substrate ships first-party verifiers for.\n *\n * Each provider implementation is intentionally thin: it delegates\n * signature verification to the corresponding pure function in\n * `connectors/webhooks.ts` and parses the body into one or more\n * normalized `WebhookEnvelope` rows. Anything provider-specific that\n * doesn't fit cleanly (Slack URL-verification handshake, etc.) is\n * surfaced via the envelope `eventType` so the consumer's `deliver()`\n * can branch.\n */\n\nimport {\n  firstHeader,\n  verifyHmacSignature,\n  verifySlackSignature,\n  verifyStripeSignature,\n} from '../connectors/webhooks.js'\nimport type { WebhookEnvelope, WebhookHeaders, WebhookProvider, SignatureVerification } from './router.js'\nimport { createHash, createHmac, timingSafeEqual } from 'node:crypto'\n\n/** Stripe webhook provider. Signature header `Stripe-Signature`. */\nexport const stripeWebhookProvider: WebhookProvider = {\n  id: 'stripe',\n  verifySignature({ rawBody, headers, secret }): SignatureVerification {\n    const sig = firstHeader(headers, 'stripe-signature')\n    if (!sig) return { valid: false, reason: 'missing_stripe_signature' }\n    return verifyStripeSignature(rawBody, sig, secret)\n      ? { valid: true }\n      : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const evt = safeJson(rawBody)\n    if (!evt || typeof evt !== 'object') return []\n    const e = evt as { id?: unknown; type?: unknown }\n    return [\n      {\n        provider: 'stripe',\n        eventType: typeof e.type === 'string' ? e.type : 'stripe.unknown',\n        providerEventId: typeof e.id === 'string' ? e.id : undefined,\n        receivedAt: now ?? Date.now(),\n        payload: evt,\n        headers: normalizeHeaders(headers),\n      },\n    ]\n  },\n}\n\n/** Slack Events API provider. Handles the `url_verification` handshake\n *  by emitting a synthetic event the consumer's `deliver()` can echo. */\nexport const slackWebhookProvider: WebhookProvider = {\n  id: 'slack',\n  verifySignature({ rawBody, headers, secret }): SignatureVerification {\n    const sig = firstHeader(headers, 'x-slack-signature')\n    const ts = firstHeader(headers, 'x-slack-request-timestamp')\n    if (!sig || !ts) return { valid: false, reason: 'missing_slack_signature_or_timestamp' }\n    return verifySlackSignature(rawBody, sig, ts, secret)\n      ? { valid: true }\n      : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const evt = safeJson(rawBody) as { type?: string; event_id?: string; event?: { type?: string } } | null\n    if (!evt || typeof evt !== 'object') return []\n    if (evt.type === 'url_verification') {\n      return [{\n        provider: 'slack',\n        eventType: 'slack.url_verification',\n        receivedAt: now ?? Date.now(),\n        payload: evt,\n        headers: normalizeHeaders(headers),\n      }]\n    }\n    const eventType = `slack.${evt.event?.type ?? evt.type ?? 'unknown'}`\n    return [{\n      provider: 'slack',\n      eventType,\n      providerEventId: typeof evt.event_id === 'string' ? evt.event_id : undefined,\n      receivedAt: now ?? Date.now(),\n      payload: evt,\n      headers: normalizeHeaders(headers),\n    }]\n  },\n}\n\n/** DocuSeal webhook provider. Signature header `X-Docuseal-Signature`. */\nexport const docusealWebhookProvider: WebhookProvider = {\n  id: 'docuseal',\n  verifySignature({ rawBody, headers, secret }): SignatureVerification {\n    const sig = firstHeader(headers, 'x-docuseal-signature')\n    if (!sig) return { valid: false, reason: 'missing_docuseal_signature' }\n    const expected = createHmac('sha256', secret).update(rawBody).digest('hex')\n    const a = Buffer.from(sig.toLowerCase(), 'utf-8')\n    const b = Buffer.from(expected, 'utf-8')\n    if (a.length !== b.length) return { valid: false, reason: 'invalid_signature' }\n    return timingSafeEqual(a, b) ? { valid: true } : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const evt = safeJson(rawBody) as { event_type?: string; event_id?: string } | null\n    if (!evt || typeof evt !== 'object') return []\n    return [{\n      provider: 'docuseal',\n      eventType: `docuseal.${evt.event_type ?? 'unknown'}`,\n      providerEventId: typeof evt.event_id === 'string' ? evt.event_id : undefined,\n      receivedAt: now ?? Date.now(),\n      payload: evt,\n      headers: normalizeHeaders(headers),\n    }]\n  },\n}\n\n/** Gmail push provider. Cloud Pub/Sub posts a JWT-signed envelope; the\n *  *payload* is base64 JSON describing the changed history range. The\n *  signature scheme here is the Pub/Sub JWT auth header — when supplied,\n *  consumers SHOULD verify the JWT against Google's well-known\n *  certificates. We accept the simpler \"Bearer <pubsub-shared-secret>\"\n *  variant by default (matching `verifyHmacSignature`). */\nexport const gmailWebhookProvider: WebhookProvider = {\n  id: 'gmail',\n  verifySignature({ headers, secret }): SignatureVerification {\n    const auth = firstHeader(headers, 'authorization')\n    if (!auth) return { valid: false, reason: 'missing_authorization' }\n    // Accept either \"Bearer <secret>\" or \"Token <secret>\" formats. This\n    // is the simple per-tenant shared-secret path; JWT verification is\n    // left to the consumer's `deliver()` when they need full Google JWT\n    // chain validation.\n    const m = /^(?:Bearer|Token)\\s+(.+)$/i.exec(auth)\n    if (!m) return { valid: false, reason: 'invalid_authorization_format' }\n    const a = Buffer.from(m[1]!, 'utf-8')\n    const b = Buffer.from(secret, 'utf-8')\n    if (a.length !== b.length) return { valid: false, reason: 'invalid_signature' }\n    return timingSafeEqual(a, b) ? { valid: true } : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const envelope = safeJson(rawBody) as { message?: { data?: string; messageId?: string; publishTime?: string } } | null\n    if (!envelope?.message?.data) return []\n    let payload: unknown\n    try {\n      payload = JSON.parse(Buffer.from(envelope.message.data, 'base64').toString('utf-8'))\n    } catch {\n      return []\n    }\n    const inner = payload as { historyId?: number | string; emailAddress?: string }\n    return [{\n      provider: 'gmail',\n      eventType: 'gmail.history_changed',\n      providerEventId: envelope.message.messageId,\n      receivedAt: now ?? Date.now(),\n      payload: { ...inner, publishTime: envelope.message.publishTime },\n      headers: normalizeHeaders(headers),\n    }]\n  },\n}\n\n/** Google Drive push provider. Drive does NOT sign the body — it uses\n *  the per-channel token (`X-Goog-Channel-Token`) as the shared secret.\n *  The router compares it constant-time against the resolved secret. */\nexport const gdriveWebhookProvider: WebhookProvider = {\n  id: 'gdrive',\n  verifySignature({ headers, secret }): SignatureVerification {\n    const token = firstHeader(headers, 'x-goog-channel-token')\n    if (!token) return { valid: false, reason: 'missing_channel_token' }\n    const a = Buffer.from(token, 'utf-8')\n    const b = Buffer.from(secret, 'utf-8')\n    if (a.length !== b.length) return { valid: false, reason: 'invalid_signature' }\n    return timingSafeEqual(a, b) ? { valid: true } : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ headers, now }): WebhookEnvelope[] {\n    const resourceId = firstHeader(headers, 'x-goog-resource-id')\n    const resourceState = firstHeader(headers, 'x-goog-resource-state') ?? 'unknown'\n    const channelId = firstHeader(headers, 'x-goog-channel-id')\n    const messageNumber = firstHeader(headers, 'x-goog-message-number')\n    if (resourceState === 'sync') {\n      return [{\n        provider: 'gdrive',\n        eventType: 'gdrive.channel.sync',\n        providerEventId: messageNumber ? `${channelId}-${messageNumber}` : undefined,\n        receivedAt: now ?? Date.now(),\n        payload: { channelId, resourceId, resourceState },\n        headers: normalizeHeaders(headers),\n      }]\n    }\n    return [{\n      provider: 'gdrive',\n      eventType: `gdrive.resource.${resourceState}`,\n      providerEventId: messageNumber ? `${channelId}-${messageNumber}` : undefined,\n      receivedAt: now ?? Date.now(),\n      payload: { channelId, resourceId, resourceState },\n      headers: normalizeHeaders(headers),\n    }]\n  },\n}\n\n/** The Telegram update keys, in resolution order — the first present key names\n *  the update kind (`telegram.message`, `telegram.callback_query`, …). */\nconst TELEGRAM_UPDATE_KEYS = [\n  'message',\n  'edited_message',\n  'channel_post',\n  'edited_channel_post',\n  'business_connection',\n  'business_message',\n  'edited_business_message',\n  'deleted_business_messages',\n  'message_reaction',\n  'message_reaction_count',\n  'inline_query',\n  'chosen_inline_result',\n  'callback_query',\n  'shipping_query',\n  'pre_checkout_query',\n  'purchased_paid_media',\n  'poll',\n  'poll_answer',\n  'my_chat_member',\n  'chat_member',\n  'chat_join_request',\n  'chat_boost',\n  'removed_chat_boost',\n] as const\n\n/** Telegram Bot API webhook provider. Telegram does NOT sign the body — it\n *  authenticates by echoing the `secret_token` set at `setWebhook` time in the\n *  `X-Telegram-Bot-Api-Secret-Token` header. We compare it constant-time to the\n *  per-connection secret. `update_id` is the idempotency anchor. */\nexport const telegramWebhookProvider: WebhookProvider = {\n  id: 'telegram',\n  verifySignature({ headers, secret }): SignatureVerification {\n    const token = firstHeader(headers, 'x-telegram-bot-api-secret-token')\n    if (!token) return { valid: false, reason: 'missing_telegram_secret_token' }\n    const a = Buffer.from(token, 'utf-8')\n    const b = Buffer.from(secret, 'utf-8')\n    if (a.length !== b.length) return { valid: false, reason: 'invalid_secret_token' }\n    return timingSafeEqual(a, b) ? { valid: true } : { valid: false, reason: 'invalid_secret_token' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const evt = safeJson(rawBody) as ({ update_id?: number } & Record<string, unknown>) | null\n    if (!evt || typeof evt !== 'object') return []\n    const kind = TELEGRAM_UPDATE_KEYS.find((k) => k in evt) ?? 'unknown'\n    return [{\n      provider: 'telegram',\n      eventType: `telegram.${kind}`,\n      providerEventId: typeof evt.update_id === 'number' ? String(evt.update_id) : undefined,\n      receivedAt: now ?? Date.now(),\n      payload: evt,\n      headers: normalizeHeaders(headers),\n    }]\n  },\n}\n\n/** Dropbox Sign (HelloSign) webhook provider. There is NO signature header:\n *  the body carries `event.event_hash = HMAC_SHA256(apiKey, event_time +\n *  event_type)` (hex), so the `secret` here is the account's API key (the\n *  caller resolves it from the connection credential). The body is JSON, or a\n *  `json=`/multipart `name=\"json\"` form field on older apps. */\nexport const hellosignWebhookProvider: WebhookProvider = {\n  id: 'hellosign',\n  // Dropbox Sign acknowledges a delivery only when the response body is exactly\n  // 'Hello API Event Received'; any other body makes it retry the event.\n  successResponse: { body: 'Hello API Event Received', headers: { 'content-type': 'text/plain' } },\n  verifySignature({ rawBody, secret }): SignatureVerification {\n    const body = parseHelloSignBody(rawBody)\n    const event = body?.event\n    if (\n      !event ||\n      typeof event.event_time !== 'string' ||\n      typeof event.event_type !== 'string' ||\n      typeof event.event_hash !== 'string'\n    ) {\n      return { valid: false, reason: 'missing_event_fields' }\n    }\n    const expected = createHmac('sha256', secret)\n      .update(`${event.event_time}${event.event_type}`)\n      .digest('hex')\n    const a = Buffer.from(event.event_hash.toLowerCase(), 'utf-8')\n    const b = Buffer.from(expected.toLowerCase(), 'utf-8')\n    if (a.length !== b.length) return { valid: false, reason: 'invalid_signature' }\n    return timingSafeEqual(a, b) ? { valid: true } : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const body = parseHelloSignBody(rawBody)\n    const event = body?.event\n    if (!event) return []\n    return [{\n      provider: 'hellosign',\n      eventType: `hellosign.${event.event_type ?? 'unknown'}`,\n      // Prefer Dropbox Sign's canonical `event.event_id` (stable across\n      // redeliveries, correlates with the provider). Fall back to a digest of\n      // the parsed body when it's absent: `event_hash` = HMAC(apiKey,\n      // event_time + event_type), so two distinct same-type events in the same\n      // second share it — the body digest stays distinct across differing\n      // events and identical across redeliveries of one event.\n      providerEventId:\n        typeof event.event_id === 'string' && event.event_id.length > 0\n          ? event.event_id\n          : createHash('sha256').update(JSON.stringify(body)).digest('hex'),\n      receivedAt: now ?? Date.now(),\n      payload: body,\n      headers: normalizeHeaders(headers),\n    }]\n  },\n}\n\n/** Keys Clay HTTP-API-action payloads commonly carry that can anchor\n *  idempotency, in resolution order. Clay bodies are operator-defined, so we\n *  fall back to a digest of the raw body when none is present. */\nconst CLAY_EVENT_ID_KEYS = ['id', 'rowId', 'recordId', 'clayRowId', 'eventId'] as const\n\n/** Clay webhook provider — receives rows Clay delivers via its outbound \"HTTP\n *  API\" action. Clay does NOT sign its requests and adds no proprietary\n *  headers (the `x-clay-signature: sha256=...` header seen in some third-party\n *  code is unverified inference, not in Clay's docs). Authentication is\n *  therefore a pre-shared secret the operator adds as a header on the Clay\n *  action; we compare it constant-time against the per-connection secret.\n *  Header: `x-clay-webhook-secret`. The body is whatever columns the operator\n *  mapped (free-form JSON with no canonical event id), so idempotency anchors\n *  on a common id field when present, else a sha256 of the raw body. */\nexport const clayWebhookProvider: WebhookProvider = {\n  id: 'clay',\n  verifySignature({ headers, secret }): SignatureVerification {\n    const token = firstHeader(headers, 'x-clay-webhook-secret')\n    if (!token) return { valid: false, reason: 'missing_clay_webhook_secret' }\n    const a = Buffer.from(token, 'utf-8')\n    const b = Buffer.from(secret, 'utf-8')\n    if (a.length !== b.length) return { valid: false, reason: 'invalid_signature' }\n    return timingSafeEqual(a, b) ? { valid: true } : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const evt = safeJson(rawBody)\n    if (!evt || typeof evt !== 'object') return []\n    const record = evt as Record<string, unknown>\n    const idKey = CLAY_EVENT_ID_KEYS.find(\n      (k) => typeof record[k] === 'string' || typeof record[k] === 'number',\n    )\n    const providerEventId = idKey\n      ? String(record[idKey])\n      : createHash('sha256').update(rawBody).digest('hex')\n    const eventType =\n      typeof record.event === 'string'\n        ? `clay.${record.event}`\n        : typeof record.type === 'string'\n          ? `clay.${record.type}`\n          : 'clay.row'\n    return [{\n      provider: 'clay',\n      eventType,\n      providerEventId,\n      receivedAt: now ?? Date.now(),\n      payload: evt,\n      headers: normalizeHeaders(headers),\n    }]\n  },\n}\n\ninterface HelloSignInboundBody {\n  event?: {\n    event_time?: string\n    event_type?: string\n    event_hash?: string\n    event_id?: string\n  }\n}\n\n/** Dropbox Sign posts JSON, a form-urlencoded `json=` field, or a\n *  multipart `name=\"json\"` part depending on app vintage. Mirrors the\n *  connector adapter's body extraction. */\nfunction parseHelloSignBody(rawBody: string): HelloSignInboundBody | null {\n  try {\n    const json = JSON.parse(rawBody) as HelloSignInboundBody\n    if (json && typeof json === 'object') return json\n  } catch {\n    // fall through to form-data extraction\n  }\n  // application/x-www-form-urlencoded `json=` field. URLSearchParams decodes\n  // `+` as a space (decodeURIComponent leaves it literal) and resolves\n  // percent-escapes, so space-bearing string fields aren't corrupted.\n  const formJson = new URLSearchParams(rawBody).get('json')\n  if (formJson) {\n    try {\n      return JSON.parse(formJson) as HelloSignInboundBody\n    } catch {\n      return null\n    }\n  }\n  // multipart/form-data with a `name=\"json\"` part. Extract linearly (indexOf +\n  // fixed-shape separator probes, no unbounded lazy regex) so a hostile body\n  // can't drive quadratic backtracking on this public ingress.\n  return extractMultipartJsonField(rawBody)\n}\n\n/** Pull the `json` part out of a multipart/form-data body without an\n *  unbounded backtracking regex. Returns null if the part isn't present or\n *  isn't valid JSON. The separator probes (`\\r?\\n\\r?\\n`, `\\r?\\n--`) are\n *  fixed-shape (no `*`/`+`), so each runs in a single linear scan. */\nfunction extractMultipartJsonField(rawBody: string): HelloSignInboundBody | null {\n  const nameIdx = rawBody.indexOf('name=\"json\"')\n  if (nameIdx === -1) return null\n  const afterName = rawBody.slice(nameIdx)\n  const sep = /\\r?\\n\\r?\\n/.exec(afterName)\n  if (!sep) return null\n  const partBody = afterName.slice(sep.index + sep[0].length)\n  const end = /\\r?\\n--/.exec(partBody)\n  if (!end) return null\n  try {\n    return JSON.parse(partBody.slice(0, end.index)) as HelloSignInboundBody\n  } catch {\n    return null\n  }\n}\n\n/** Generic HMAC provider — for the long-tail webhook source where the\n *  caller has standardised on a single sha256-of-body scheme. Header\n *  `X-Signature` by default; override at provider-build time if needed. */\nexport function genericHmacWebhookProvider(options: {\n  id: string\n  signatureHeader?: string\n  algorithm?: 'sha256' | 'sha1' | 'sha512'\n  signaturePrefix?: string\n  /** Parser to convert the raw body into envelopes. Defaults to\n   *  \"one event with eventType=<provider>.event and payload=JSON\". */\n  parse?: WebhookProvider['parse']\n}): WebhookProvider {\n  const header = options.signatureHeader ?? 'x-signature'\n  return {\n    id: options.id,\n    verifySignature({ rawBody, headers, secret }) {\n      const sig = firstHeader(headers, header)\n      if (!sig) return { valid: false, reason: `missing_${header}` }\n      return verifyHmacSignature(rawBody, sig, secret, {\n        algorithm: options.algorithm ?? 'sha256',\n        signaturePrefix: options.signaturePrefix,\n      })\n        ? { valid: true }\n        : { valid: false, reason: 'invalid_signature' }\n    },\n    parse:\n      options.parse ??\n      (({ rawBody, headers, now }) => {\n        const evt = safeJson(rawBody) ?? rawBody\n        return [{\n          provider: options.id,\n          eventType: `${options.id}.event`,\n          receivedAt: now ?? Date.now(),\n          payload: evt,\n          headers: normalizeHeaders(headers),\n        }]\n      }),\n  }\n}\n\nfunction safeJson(s: string): unknown {\n  try {\n    return JSON.parse(s)\n  } catch {\n    return null\n  }\n}\n\nfunction normalizeHeaders(headers: WebhookHeaders): Record<string, string> {\n  const out: Record<string, string> = {}\n  for (const [k, v] of Object.entries(headers)) {\n    if (v === undefined) continue\n    const value = Array.isArray(v) ? v[0] : v\n    if (typeof value === 'string') out[k.toLowerCase()] = value\n  }\n  return out\n}\n"],"mappings":";;;;;;;;;AA8IO,IAAM,gBAAN,MAAoB;AAAA,EACR;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,MAA4B;AACtC,SAAK,YAAY,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAC7D,SAAK,UAAU,KAAK;AACpB,SAAK,gBAAgB,KAAK;AAC1B,SAAK,cAAc,KAAK;AACxB,SAAK,mBAAmB,KAAK,oBAAoB,IAAI,KAAK,KAAK,KAAK;AACpE,SAAK,UAAU,KAAK,WAAW;AAC/B,SAAK,QAAQ,KAAK,OAAO,KAAK;AAAA,EAChC;AAAA;AAAA;AAAA,EAIA,MAAM,OAAO,SAA+D;AAC1E,UAAM,WAAW,KAAK,UAAU,IAAI,QAAQ,UAAU;AACtD,QAAI,CAAC,UAAU;AACb,aAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,oBAAoB,UAAU,QAAQ,WAAW,EAAE;AAAA,IAC1F;AACA,UAAM,SAAS,MAAM,KAAK,cAAc,SAAS,IAAI,QAAQ,OAAO;AACpE,QAAI,CAAC,QAAQ;AACX,aAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,kBAAkB,UAAU,SAAS,GAAG,EAAE;AAAA,IACjF;AACA,UAAM,eAAe,SAAS,gBAAgB;AAAA,MAC5C,SAAS,QAAQ;AAAA,MACjB,SAAS,QAAQ;AAAA,MACjB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,aAAa,OAAO;AACvB,aAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,qBAAqB,QAAQ,aAAa,OAAO,EAAE;AAAA,IAC1F;AAEA,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,SAAS,MAAM,EAAE,SAAS,QAAQ,SAAS,SAAS,QAAQ,SAAS,KAAK,KAAK,MAAM,EAAE,CAAC;AAAA,IACzG,SAAS,KAAK;AACZ,WAAK,QAAQ,KAAK,EAAE,UAAU,SAAS,GAAG,CAAC;AAC3C,aAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,eAAe,SAAS,WAAW,GAAG,EAAE,EAAE;AAAA,IACjF;AAEA,UAAM,WAA8B,CAAC;AACrC,eAAW,SAAS,QAAQ;AAC1B,UAAI,MAAM,mBAAmB,KAAK,aAAa;AAC7C,cAAM,UAAU,MAAM,KAAK,YAAY,KAAK,MAAM,eAAe;AACjE,YAAI,QAAS;AAAA,MACf;AACA,eAAS,KAAK,KAAK;AAAA,IACrB;AAKA,mBAAe,MAAM;AACnB,WAAK,KAAK,YAAY,QAAQ;AAAA,IAChC,CAAC;AAED,QAAI,SAAS,iBAAiB;AAC5B,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,MAAM,SAAS,gBAAgB;AAAA,QAC/B,SAAS,SAAS,gBAAgB;AAAA,MACpC;AAAA,IACF;AACA,WAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,UAAU,SAAS,QAAQ,OAAO,OAAO,OAAO,EAAE;AAAA,EAClF;AAAA,EAEA,MAAc,YAAY,QAA0C;AAClE,eAAW,SAAS,QAAQ;AAC1B,UAAI;AACF,cAAM,KAAK,QAAQ,KAAK;AACxB,YAAI,MAAM,mBAAmB,KAAK,aAAa;AAC7C,gBAAM,KAAK,YAAY,SAAS,MAAM,iBAAiB,KAAK,gBAAgB;AAAA,QAC9E;AAAA,MACF,SAAS,KAAK;AACZ,aAAK,QAAQ,KAAK;AAAA,UAChB,UAAU,MAAM;AAAA,UAChB,WAAW,MAAM;AAAA,UACjB,iBAAiB,MAAM;AAAA,QACzB,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,eAAe,KAAc,SAAmF;AAEvH,UAAQ,MAAM,mBAAmB,SAAS,GAAG;AAC/C;AAEA,SAAS,WAAW,KAAsB;AACxC,SAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AACxD;;;AC5NA,SAAS,YAAY,YAAY,uBAAuB;AAGjD,IAAM,wBAAyC;AAAA,EACpD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,SAAS,OAAO,GAA0B;AACnE,UAAM,MAAM,YAAY,SAAS,kBAAkB;AACnD,QAAI,CAAC,IAAK,QAAO,EAAE,OAAO,OAAO,QAAQ,2BAA2B;AACpE,WAAO,sBAAsB,SAAS,KAAK,MAAM,IAC7C,EAAE,OAAO,KAAK,IACd,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAClD;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,MAAM,SAAS,OAAO;AAC5B,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAC7C,UAAM,IAAI;AACV,WAAO;AAAA,MACL;AAAA,QACE,UAAU;AAAA,QACV,WAAW,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO;AAAA,QACjD,iBAAiB,OAAO,EAAE,OAAO,WAAW,EAAE,KAAK;AAAA,QACnD,YAAY,OAAO,KAAK,IAAI;AAAA,QAC5B,SAAS;AAAA,QACT,SAAS,iBAAiB,OAAO;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AACF;AAIO,IAAM,uBAAwC;AAAA,EACnD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,SAAS,OAAO,GAA0B;AACnE,UAAM,MAAM,YAAY,SAAS,mBAAmB;AACpD,UAAM,KAAK,YAAY,SAAS,2BAA2B;AAC3D,QAAI,CAAC,OAAO,CAAC,GAAI,QAAO,EAAE,OAAO,OAAO,QAAQ,uCAAuC;AACvF,WAAO,qBAAqB,SAAS,KAAK,IAAI,MAAM,IAChD,EAAE,OAAO,KAAK,IACd,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAClD;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,MAAM,SAAS,OAAO;AAC5B,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAC7C,QAAI,IAAI,SAAS,oBAAoB;AACnC,aAAO,CAAC;AAAA,QACN,UAAU;AAAA,QACV,WAAW;AAAA,QACX,YAAY,OAAO,KAAK,IAAI;AAAA,QAC5B,SAAS;AAAA,QACT,SAAS,iBAAiB,OAAO;AAAA,MACnC,CAAC;AAAA,IACH;AACA,UAAM,YAAY,SAAS,IAAI,OAAO,QAAQ,IAAI,QAAQ,SAAS;AACnE,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV;AAAA,MACA,iBAAiB,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;AAAA,MACnE,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS;AAAA,MACT,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AACF;AAGO,IAAM,0BAA2C;AAAA,EACtD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,SAAS,OAAO,GAA0B;AACnE,UAAM,MAAM,YAAY,SAAS,sBAAsB;AACvD,QAAI,CAAC,IAAK,QAAO,EAAE,OAAO,OAAO,QAAQ,6BAA6B;AACtE,UAAM,WAAW,WAAW,UAAU,MAAM,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK;AAC1E,UAAM,IAAI,OAAO,KAAK,IAAI,YAAY,GAAG,OAAO;AAChD,UAAM,IAAI,OAAO,KAAK,UAAU,OAAO;AACvC,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAC9E,WAAO,gBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAC/F;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,MAAM,SAAS,OAAO;AAC5B,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAC7C,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV,WAAW,YAAY,IAAI,cAAc,SAAS;AAAA,MAClD,iBAAiB,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;AAAA,MACnE,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS;AAAA,MACT,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AACF;AAQO,IAAM,uBAAwC;AAAA,EACnD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,OAAO,GAA0B;AAC1D,UAAM,OAAO,YAAY,SAAS,eAAe;AACjD,QAAI,CAAC,KAAM,QAAO,EAAE,OAAO,OAAO,QAAQ,wBAAwB;AAKlE,UAAM,IAAI,6BAA6B,KAAK,IAAI;AAChD,QAAI,CAAC,EAAG,QAAO,EAAE,OAAO,OAAO,QAAQ,+BAA+B;AACtE,UAAM,IAAI,OAAO,KAAK,EAAE,CAAC,GAAI,OAAO;AACpC,UAAM,IAAI,OAAO,KAAK,QAAQ,OAAO;AACrC,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAC9E,WAAO,gBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAC/F;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,WAAW,SAAS,OAAO;AACjC,QAAI,CAAC,UAAU,SAAS,KAAM,QAAO,CAAC;AACtC,QAAI;AACJ,QAAI;AACF,gBAAU,KAAK,MAAM,OAAO,KAAK,SAAS,QAAQ,MAAM,QAAQ,EAAE,SAAS,OAAO,CAAC;AAAA,IACrF,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AACA,UAAM,QAAQ;AACd,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV,WAAW;AAAA,MACX,iBAAiB,SAAS,QAAQ;AAAA,MAClC,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS,EAAE,GAAG,OAAO,aAAa,SAAS,QAAQ,YAAY;AAAA,MAC/D,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AACF;AAKO,IAAM,wBAAyC;AAAA,EACpD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,OAAO,GAA0B;AAC1D,UAAM,QAAQ,YAAY,SAAS,sBAAsB;AACzD,QAAI,CAAC,MAAO,QAAO,EAAE,OAAO,OAAO,QAAQ,wBAAwB;AACnE,UAAM,IAAI,OAAO,KAAK,OAAO,OAAO;AACpC,UAAM,IAAI,OAAO,KAAK,QAAQ,OAAO;AACrC,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAC9E,WAAO,gBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAC/F;AAAA,EACA,MAAM,EAAE,SAAS,IAAI,GAAsB;AACzC,UAAM,aAAa,YAAY,SAAS,oBAAoB;AAC5D,UAAM,gBAAgB,YAAY,SAAS,uBAAuB,KAAK;AACvE,UAAM,YAAY,YAAY,SAAS,mBAAmB;AAC1D,UAAM,gBAAgB,YAAY,SAAS,uBAAuB;AAClE,QAAI,kBAAkB,QAAQ;AAC5B,aAAO,CAAC;AAAA,QACN,UAAU;AAAA,QACV,WAAW;AAAA,QACX,iBAAiB,gBAAgB,GAAG,SAAS,IAAI,aAAa,KAAK;AAAA,QACnE,YAAY,OAAO,KAAK,IAAI;AAAA,QAC5B,SAAS,EAAE,WAAW,YAAY,cAAc;AAAA,QAChD,SAAS,iBAAiB,OAAO;AAAA,MACnC,CAAC;AAAA,IACH;AACA,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV,WAAW,mBAAmB,aAAa;AAAA,MAC3C,iBAAiB,gBAAgB,GAAG,SAAS,IAAI,aAAa,KAAK;AAAA,MACnE,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS,EAAE,WAAW,YAAY,cAAc;AAAA,MAChD,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AACF;AAIA,IAAM,uBAAuB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAMO,IAAM,0BAA2C;AAAA,EACtD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,OAAO,GAA0B;AAC1D,UAAM,QAAQ,YAAY,SAAS,iCAAiC;AACpE,QAAI,CAAC,MAAO,QAAO,EAAE,OAAO,OAAO,QAAQ,gCAAgC;AAC3E,UAAM,IAAI,OAAO,KAAK,OAAO,OAAO;AACpC,UAAM,IAAI,OAAO,KAAK,QAAQ,OAAO;AACrC,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,OAAO,OAAO,QAAQ,uBAAuB;AACjF,WAAO,gBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,OAAO,QAAQ,uBAAuB;AAAA,EAClG;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,MAAM,SAAS,OAAO;AAC5B,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAC7C,UAAM,OAAO,qBAAqB,KAAK,CAAC,MAAM,KAAK,GAAG,KAAK;AAC3D,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV,WAAW,YAAY,IAAI;AAAA,MAC3B,iBAAiB,OAAO,IAAI,cAAc,WAAW,OAAO,IAAI,SAAS,IAAI;AAAA,MAC7E,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS;AAAA,MACT,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AACF;AAOO,IAAM,2BAA4C;AAAA,EACvD,IAAI;AAAA;AAAA;AAAA,EAGJ,iBAAiB,EAAE,MAAM,4BAA4B,SAAS,EAAE,gBAAgB,aAAa,EAAE;AAAA,EAC/F,gBAAgB,EAAE,SAAS,OAAO,GAA0B;AAC1D,UAAM,OAAO,mBAAmB,OAAO;AACvC,UAAM,QAAQ,MAAM;AACpB,QACE,CAAC,SACD,OAAO,MAAM,eAAe,YAC5B,OAAO,MAAM,eAAe,YAC5B,OAAO,MAAM,eAAe,UAC5B;AACA,aAAO,EAAE,OAAO,OAAO,QAAQ,uBAAuB;AAAA,IACxD;AACA,UAAM,WAAW,WAAW,UAAU,MAAM,EACzC,OAAO,GAAG,MAAM,UAAU,GAAG,MAAM,UAAU,EAAE,EAC/C,OAAO,KAAK;AACf,UAAM,IAAI,OAAO,KAAK,MAAM,WAAW,YAAY,GAAG,OAAO;AAC7D,UAAM,IAAI,OAAO,KAAK,SAAS,YAAY,GAAG,OAAO;AACrD,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAC9E,WAAO,gBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAC/F;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,OAAO,mBAAmB,OAAO;AACvC,UAAM,QAAQ,MAAM;AACpB,QAAI,CAAC,MAAO,QAAO,CAAC;AACpB,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV,WAAW,aAAa,MAAM,cAAc,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOrD,iBACE,OAAO,MAAM,aAAa,YAAY,MAAM,SAAS,SAAS,IAC1D,MAAM,WACN,WAAW,QAAQ,EAAE,OAAO,KAAK,UAAU,IAAI,CAAC,EAAE,OAAO,KAAK;AAAA,MACpE,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS;AAAA,MACT,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AACF;AAKA,IAAM,qBAAqB,CAAC,MAAM,SAAS,YAAY,aAAa,SAAS;AAWtE,IAAM,sBAAuC;AAAA,EAClD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,OAAO,GAA0B;AAC1D,UAAM,QAAQ,YAAY,SAAS,uBAAuB;AAC1D,QAAI,CAAC,MAAO,QAAO,EAAE,OAAO,OAAO,QAAQ,8BAA8B;AACzE,UAAM,IAAI,OAAO,KAAK,OAAO,OAAO;AACpC,UAAM,IAAI,OAAO,KAAK,QAAQ,OAAO;AACrC,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAC9E,WAAO,gBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAC/F;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,MAAM,SAAS,OAAO;AAC5B,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAC7C,UAAM,SAAS;AACf,UAAM,QAAQ,mBAAmB;AAAA,MAC/B,CAAC,MAAM,OAAO,OAAO,CAAC,MAAM,YAAY,OAAO,OAAO,CAAC,MAAM;AAAA,IAC/D;AACA,UAAM,kBAAkB,QACpB,OAAO,OAAO,KAAK,CAAC,IACpB,WAAW,QAAQ,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK;AACrD,UAAM,YACJ,OAAO,OAAO,UAAU,WACpB,QAAQ,OAAO,KAAK,KACpB,OAAO,OAAO,SAAS,WACrB,QAAQ,OAAO,IAAI,KACnB;AACR,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS;AAAA,MACT,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AACF;AAcA,SAAS,mBAAmB,SAA8C;AACxE,MAAI;AACF,UAAM,OAAO,KAAK,MAAM,OAAO;AAC/B,QAAI,QAAQ,OAAO,SAAS,SAAU,QAAO;AAAA,EAC/C,QAAQ;AAAA,EAER;AAIA,QAAM,WAAW,IAAI,gBAAgB,OAAO,EAAE,IAAI,MAAM;AACxD,MAAI,UAAU;AACZ,QAAI;AACF,aAAO,KAAK,MAAM,QAAQ;AAAA,IAC5B,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAIA,SAAO,0BAA0B,OAAO;AAC1C;AAMA,SAAS,0BAA0B,SAA8C;AAC/E,QAAM,UAAU,QAAQ,QAAQ,aAAa;AAC7C,MAAI,YAAY,GAAI,QAAO;AAC3B,QAAM,YAAY,QAAQ,MAAM,OAAO;AACvC,QAAM,MAAM,aAAa,KAAK,SAAS;AACvC,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,WAAW,UAAU,MAAM,IAAI,QAAQ,IAAI,CAAC,EAAE,MAAM;AAC1D,QAAM,MAAM,UAAU,KAAK,QAAQ;AACnC,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,WAAO,KAAK,MAAM,SAAS,MAAM,GAAG,IAAI,KAAK,CAAC;AAAA,EAChD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKO,SAAS,2BAA2B,SAQvB;AAClB,QAAM,SAAS,QAAQ,mBAAmB;AAC1C,SAAO;AAAA,IACL,IAAI,QAAQ;AAAA,IACZ,gBAAgB,EAAE,SAAS,SAAS,OAAO,GAAG;AAC5C,YAAM,MAAM,YAAY,SAAS,MAAM;AACvC,UAAI,CAAC,IAAK,QAAO,EAAE,OAAO,OAAO,QAAQ,WAAW,MAAM,GAAG;AAC7D,aAAO,oBAAoB,SAAS,KAAK,QAAQ;AAAA,QAC/C,WAAW,QAAQ,aAAa;AAAA,QAChC,iBAAiB,QAAQ;AAAA,MAC3B,CAAC,IACG,EAAE,OAAO,KAAK,IACd,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,IAClD;AAAA,IACA,OACE,QAAQ,UACP,CAAC,EAAE,SAAS,SAAS,IAAI,MAAM;AAC9B,YAAM,MAAM,SAAS,OAAO,KAAK;AACjC,aAAO,CAAC;AAAA,QACN,UAAU,QAAQ;AAAA,QAClB,WAAW,GAAG,QAAQ,EAAE;AAAA,QACxB,YAAY,OAAO,KAAK,IAAI;AAAA,QAC5B,SAAS;AAAA,QACT,SAAS,iBAAiB,OAAO;AAAA,MACnC,CAAC;AAAA,IACH;AAAA,EACJ;AACF;AAEA,SAAS,SAAS,GAAoB;AACpC,MAAI;AACF,WAAO,KAAK,MAAM,CAAC;AAAA,EACrB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,iBAAiB,SAAiD;AACzE,QAAM,MAA8B,CAAC;AACrC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC5C,QAAI,MAAM,OAAW;AACrB,UAAM,QAAQ,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI;AACxC,QAAI,OAAO,UAAU,SAAU,KAAI,EAAE,YAAY,CAAC,IAAI;AAAA,EACxD;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/webhooks/router.ts","../../src/webhooks/providers.ts"],"sourcesContent":["/**\n * @stable Provider-agnostic inbound webhook router.\n *\n * Consumer hooks a single HTTP handler at `/webhook/:provider/:event`\n * (or whatever pathing they prefer) and forwards the request through\n * `WebhookRouter.handle()`. The router:\n *\n *   1. Resolves the registered provider entry.\n *   2. Calls the provider's `verifySignature(rawBody, headers, secrets)`.\n *      Failure → 401 fast, no downstream work.\n *   3. Calls the provider's `parse(rawBody, headers)` to extract zero or\n *      more normalized events.\n *   4. Enqueues each event for async processing via the consumer-supplied\n *      `deliver(event)` callback (best-effort fire-and-forget — the\n *      router does NOT block the HTTP response on the consumer's work).\n *   5. Returns 200 fast with `{received: events.length}`.\n *\n * Replay protection: providers that sign timestamps (Stripe, Slack)\n * already reject stale signatures inside `verifySignature`. For providers\n * that don't (DocuSeal, GDrive push), the router exposes a pluggable\n * `idempotency` hook: if `idempotency.seen(providerEventId)` returns\n * true, the router 200s without invoking `deliver()`. Consumers wire\n * this to a durable kv (D1 / Redis / Postgres unique-index).\n *\n * Why a router and not a per-provider express app: the runtime contract\n * a product cares about is \"an inbound event came in, here's the\n * normalized envelope\". Verification, parsing, and idempotency-dedup\n * are mechanical and provider-specific — the router owns them. The\n * consumer's `deliver()` is the only place product logic runs.\n *\n * Stability: `@stable` — additions to `WebhookEnvelope` must be\n * additive; the router's HTTP contract (paths, status codes) is frozen\n * at 200 (ok), 400 (bad request), 401 (bad signature), 404 (unknown\n * provider), 405 (provider has no inbound surface).\n */\n\nexport interface WebhookHeaders {\n  [name: string]: string | string[] | undefined\n}\n\n/** Normalized inbound event the router emits after parsing. */\nexport interface WebhookEnvelope<TPayload = unknown> {\n  /** Provider id (matches the `:provider` path segment). */\n  provider: string\n  /** Optional event class — e.g., 'customer.subscription.deleted'. The\n   *  provider's parser decides. Used for routing inside `deliver()`. */\n  eventType: string\n  /** Provider-emitted event id, when present. Used for the idempotency\n   *  short-circuit. */\n  providerEventId?: string\n  /** Wall-clock receive time. */\n  receivedAt: number\n  /** Provider payload, normalized to the provider's documented event\n   *  shape. The router does NOT reshape this — `parse()` is the contract. */\n  payload: TPayload\n  /** Headers passed through for downstream handlers that want them\n   *  (e.g., to extract custom routing metadata). Always lowercased keys. */\n  headers: Record<string, string>\n}\n\nexport type SignatureVerification =\n  | { valid: true }\n  | { valid: false; reason: string }\n\n/** One declared triggerable event, in the runtime `eventType` namespace a\n *  provider's `parse` emits. */\nexport interface TriggerEventDescriptor {\n  /** The `eventType` a workflow `provider_event` trigger matches on\n   *  (`slack.app_mention`, `charge.succeeded`). */\n  id: string\n  /** Short human label for authoring surfaces; optional. */\n  title?: string\n}\n\n/** The set of events a provider can deliver, for author-time validation of\n *  workflow `provider_event` triggers. Co-located with the provider's `parse`\n *  (the source of the runtime namespace) so the two cannot drift — see the\n *  per-provider drift tests. Consumers validate an authored event with two\n *  checks: it must carry `namespace` (a prefix-less event on a namespaced\n *  provider can never be delivered), and — only when `closed` — be one of\n *  `events` (an exhaustive set makes an unlisted event an authoring error). */\nexport interface TriggerEventCatalog {\n  /** Required prefix every `parse`-emitted `eventType` carries (`slack.`,\n   *  `telegram.`), or `null` when the provider emits raw event names (stripe). */\n  namespace: string | null\n  /** Declared events. Exhaustive iff `closed`; otherwise authoring hints for an\n   *  open, provider-owned vocabulary. */\n  events: readonly TriggerEventDescriptor[]\n  /** True when `events` is the COMPLETE deliverable set, so an event outside it\n   *  is rejected. False when the provider owns an open-ended vocabulary it keeps\n   *  adding to (Stripe's ~250 types, Slack's Events API) and only `namespace`\n   *  can be authoritatively enforced. */\n  closed: boolean\n}\n\n/** Per-provider plug-in. Stateless — the router calls `verifySignature`\n *  then `parse` on every request. The provider's HTTP-shape concerns\n *  (e.g., raw body required) are documented per provider. */\nexport interface WebhookProvider {\n  /** Stable provider id (`stripe`, `docuseal`, `gdrive`, ...). */\n  id: string\n  /** Verify the inbound signature. Receives the EXACT raw body string —\n   *  consumers MUST preserve raw bytes through their HTTP server (do not\n   *  parse JSON before forwarding here). */\n  verifySignature(input: {\n    rawBody: string\n    headers: WebhookHeaders\n    secret: string\n  }): SignatureVerification\n  /** Parse the validated raw body into zero or more normalized events.\n   *  A single push payload may carry multiple events (e.g., Slack bulk\n   *  delivery). Return [] to ack the push as a no-op. */\n  parse(input: {\n    rawBody: string\n    headers: WebhookHeaders\n    now?: number\n  }): WebhookEnvelope[] | Promise<WebhookEnvelope[]>\n  /** Optional provider-specific 200 ACK the router returns on a verified\n   *  delivery, in place of the default `{ received, total }` JSON. Dropbox Sign\n   *  acknowledges a delivery only when the body is exactly\n   *  'Hello API Event Received' and retries otherwise; this lets such a\n   *  provider declare the body/headers it needs. The frozen status contract is\n   *  unchanged — only the 200 body/headers are customized. */\n  successResponse?: { body: string; headers?: Record<string, string> }\n  /** Declared triggerable-event catalog, for author-time validation of workflow\n   *  `provider_event` triggers. Optional: a provider without one is left\n   *  unvalidated by consumers (the trigger still installs). */\n  eventCatalog?: TriggerEventCatalog\n}\n\nexport interface WebhookIdempotencyStore {\n  /** Returns true if this providerEventId has been processed already.\n   *  Implementations should be O(1) (Redis SETNX, D1 UNIQUE constraint). */\n  seen(providerEventId: string): Promise<boolean> | boolean\n  /** Marks a providerEventId as processed. Called AFTER `deliver()` has\n   *  been invoked. */\n  remember(providerEventId: string, ttlMs: number): Promise<void> | void\n}\n\nexport interface WebhookRouterOptions {\n  /** Provider registry. Pass any number of providers; routing is by id. */\n  providers: WebhookProvider[]\n  /** Async callback invoked with every accepted event. Fire-and-forget\n   *  from the router's perspective — the HTTP response is sent before\n   *  this resolves. Throws are caught and reported via `onError`. */\n  deliver(event: WebhookEnvelope): Promise<void> | void\n  /** Resolve the signing secret for a provider id at request time. The\n   *  router never holds secrets — the consumer's vault resolves them. */\n  resolveSecret(providerId: string, headers: WebhookHeaders): Promise<string | null> | string | null\n  /** Optional idempotency-dedup hook. Required for providers that don't\n   *  sign timestamps in their signature scheme (DocuSeal, Drive push). */\n  idempotency?: WebhookIdempotencyStore\n  /** TTL on idempotency entries. Default 7 days — long enough that a\n   *  provider's normal retry-window can't re-deliver. */\n  idempotencyTtlMs?: number\n  /** Surface delivery errors. Default: console.error. */\n  onError?(err: unknown, context: { provider: string; eventType?: string; providerEventId?: string }): void\n  /** Override `now()` for tests. */\n  now?(): number\n}\n\nexport interface WebhookRouterRequest {\n  providerId: string\n  rawBody: string\n  headers: WebhookHeaders\n}\n\nexport interface WebhookRouterResponse {\n  status: number\n  body: unknown\n  headers?: Record<string, string>\n}\n\n/**\n * Router instance. Stateless aside from the provider registry — safe to\n * share across requests; build once per process.\n */\nexport class WebhookRouter {\n  private readonly providers: Map<string, WebhookProvider>\n  private readonly deliver: WebhookRouterOptions['deliver']\n  private readonly resolveSecret: WebhookRouterOptions['resolveSecret']\n  private readonly idempotency?: WebhookIdempotencyStore\n  private readonly idempotencyTtlMs: number\n  private readonly onError: NonNullable<WebhookRouterOptions['onError']>\n  private readonly nowFn: () => number\n\n  constructor(opts: WebhookRouterOptions) {\n    this.providers = new Map(opts.providers.map((p) => [p.id, p]))\n    this.deliver = opts.deliver\n    this.resolveSecret = opts.resolveSecret\n    this.idempotency = opts.idempotency\n    this.idempotencyTtlMs = opts.idempotencyTtlMs ?? 7 * 24 * 60 * 60 * 1000\n    this.onError = opts.onError ?? defaultOnError\n    this.nowFn = opts.now ?? Date.now\n  }\n\n  /** Process one inbound webhook request. Pure with respect to side-\n   *  effects on the router instance — safe to call concurrently. */\n  async handle(request: WebhookRouterRequest): Promise<WebhookRouterResponse> {\n    const provider = this.providers.get(request.providerId)\n    if (!provider) {\n      return { status: 404, body: { error: 'unknown_provider', provider: request.providerId } }\n    }\n    const secret = await this.resolveSecret(provider.id, request.headers)\n    if (!secret) {\n      return { status: 401, body: { error: 'missing_secret', provider: provider.id } }\n    }\n    const verification = provider.verifySignature({\n      rawBody: request.rawBody,\n      headers: request.headers,\n      secret,\n    })\n    if (!verification.valid) {\n      return { status: 401, body: { error: 'invalid_signature', reason: verification.reason } }\n    }\n\n    let events: WebhookEnvelope[]\n    try {\n      events = await provider.parse({ rawBody: request.rawBody, headers: request.headers, now: this.nowFn() })\n    } catch (err) {\n      this.onError(err, { provider: provider.id })\n      return { status: 400, body: { error: 'parse_error', message: errMessage(err) } }\n    }\n\n    const accepted: WebhookEnvelope[] = []\n    for (const event of events) {\n      if (event.providerEventId && this.idempotency) {\n        const already = await this.idempotency.seen(event.providerEventId)\n        if (already) continue\n      }\n      accepted.push(event)\n    }\n\n    // Deliver async — do NOT block the HTTP response. Errors land in\n    // `onError`; the provider already got its 200 by then so it will\n    // not retry.\n    queueMicrotask(() => {\n      void this.deliverEach(accepted)\n    })\n\n    if (provider.successResponse) {\n      return {\n        status: 200,\n        body: provider.successResponse.body,\n        headers: provider.successResponse.headers,\n      }\n    }\n    return { status: 200, body: { received: accepted.length, total: events.length } }\n  }\n\n  private async deliverEach(events: WebhookEnvelope[]): Promise<void> {\n    for (const event of events) {\n      try {\n        await this.deliver(event)\n        if (event.providerEventId && this.idempotency) {\n          await this.idempotency.remember(event.providerEventId, this.idempotencyTtlMs)\n        }\n      } catch (err) {\n        this.onError(err, {\n          provider: event.provider,\n          eventType: event.eventType,\n          providerEventId: event.providerEventId,\n        })\n      }\n    }\n  }\n}\n\nfunction defaultOnError(err: unknown, context: { provider: string; eventType?: string; providerEventId?: string }): void {\n  // eslint-disable-next-line no-console\n  console.error('[WebhookRouter]', context, err)\n}\n\nfunction errMessage(err: unknown): string {\n  return err instanceof Error ? err.message : String(err)\n}\n","/**\n * Pre-built `WebhookProvider` implementations for the inbound surfaces\n * the substrate ships first-party verifiers for.\n *\n * Each provider implementation is intentionally thin: it delegates\n * signature verification to the corresponding pure function in\n * `connectors/webhooks.ts` and parses the body into one or more\n * normalized `WebhookEnvelope` rows. Anything provider-specific that\n * doesn't fit cleanly (Slack URL-verification handshake, etc.) is\n * surfaced via the envelope `eventType` so the consumer's `deliver()`\n * can branch.\n */\n\nimport {\n  firstHeader,\n  verifyHmacSignature,\n  verifySlackSignature,\n  verifyStripeSignature,\n} from '../connectors/webhooks.js'\nimport type { WebhookEnvelope, WebhookHeaders, WebhookProvider, SignatureVerification } from './router.js'\nimport { createHash, createHmac, timingSafeEqual } from 'node:crypto'\n\n/** Stripe webhook provider. Signature header `Stripe-Signature`. */\nexport const stripeWebhookProvider: WebhookProvider = {\n  id: 'stripe',\n  verifySignature({ rawBody, headers, secret }): SignatureVerification {\n    const sig = firstHeader(headers, 'stripe-signature')\n    if (!sig) return { valid: false, reason: 'missing_stripe_signature' }\n    return verifyStripeSignature(rawBody, sig, secret)\n      ? { valid: true }\n      : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const evt = safeJson(rawBody)\n    if (!evt || typeof evt !== 'object') return []\n    const e = evt as { id?: unknown; type?: unknown }\n    return [\n      {\n        provider: 'stripe',\n        eventType: typeof e.type === 'string' ? e.type : 'stripe.unknown',\n        providerEventId: typeof e.id === 'string' ? e.id : undefined,\n        receivedAt: now ?? Date.now(),\n        payload: evt,\n        headers: normalizeHeaders(headers),\n      },\n    ]\n  },\n  eventCatalog: {\n    // Stripe emits the raw event `type` (`charge.succeeded`) — no namespace, and\n    // an OPEN, versioned vocabulary (~250 types), so these are authoring hints,\n    // not a gate.\n    namespace: null,\n    closed: false,\n    events: [\n      { id: 'checkout.session.completed' },\n      { id: 'checkout.session.expired' },\n      { id: 'customer.subscription.created' },\n      { id: 'customer.subscription.updated' },\n      { id: 'customer.subscription.deleted' },\n      { id: 'invoice.paid' },\n      { id: 'invoice.payment_failed' },\n      { id: 'payment_intent.succeeded' },\n      { id: 'payment_intent.payment_failed' },\n      { id: 'charge.succeeded' },\n      { id: 'charge.refunded' },\n    ],\n  },\n}\n\n/** Slack Events API provider. Handles the `url_verification` handshake\n *  by emitting a synthetic event the consumer's `deliver()` can echo. */\nexport const slackWebhookProvider: WebhookProvider = {\n  id: 'slack',\n  verifySignature({ rawBody, headers, secret }): SignatureVerification {\n    const sig = firstHeader(headers, 'x-slack-signature')\n    const ts = firstHeader(headers, 'x-slack-request-timestamp')\n    if (!sig || !ts) return { valid: false, reason: 'missing_slack_signature_or_timestamp' }\n    return verifySlackSignature(rawBody, sig, ts, secret)\n      ? { valid: true }\n      : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const evt = safeJson(rawBody) as { type?: string; event_id?: string; event?: { type?: string } } | null\n    if (!evt || typeof evt !== 'object') return []\n    if (evt.type === 'url_verification') {\n      return [{\n        provider: 'slack',\n        eventType: 'slack.url_verification',\n        receivedAt: now ?? Date.now(),\n        payload: evt,\n        headers: normalizeHeaders(headers),\n      }]\n    }\n    const eventType = `slack.${evt.event?.type ?? evt.type ?? 'unknown'}`\n    return [{\n      provider: 'slack',\n      eventType,\n      providerEventId: typeof evt.event_id === 'string' ? evt.event_id : undefined,\n      receivedAt: now ?? Date.now(),\n      payload: evt,\n      headers: normalizeHeaders(headers),\n    }]\n  },\n  eventCatalog: {\n    // Slack namespaces every event `slack.<events-api-type>`, so a prefix-less\n    // event is provably dead. The Events API vocabulary is open (Slack adds\n    // types), so `events` are hints, not a gate. `slack.url_verification` (the\n    // config handshake) is intentionally excluded — it carries no workflow\n    // meaning and is answered before dispatch.\n    namespace: 'slack.',\n    closed: false,\n    events: [\n      { id: 'slack.message' },\n      { id: 'slack.app_mention' },\n      { id: 'slack.reaction_added' },\n      { id: 'slack.reaction_removed' },\n      { id: 'slack.channel_created' },\n      { id: 'slack.member_joined_channel' },\n      { id: 'slack.team_join' },\n      { id: 'slack.app_home_opened' },\n      { id: 'slack.file_shared' },\n    ],\n  },\n}\n\n/** DocuSeal webhook provider. Signature header `X-Docuseal-Signature`. */\nexport const docusealWebhookProvider: WebhookProvider = {\n  id: 'docuseal',\n  verifySignature({ rawBody, headers, secret }): SignatureVerification {\n    const sig = firstHeader(headers, 'x-docuseal-signature')\n    if (!sig) return { valid: false, reason: 'missing_docuseal_signature' }\n    const expected = createHmac('sha256', secret).update(rawBody).digest('hex')\n    const a = Buffer.from(sig.toLowerCase(), 'utf-8')\n    const b = Buffer.from(expected, 'utf-8')\n    if (a.length !== b.length) return { valid: false, reason: 'invalid_signature' }\n    return timingSafeEqual(a, b) ? { valid: true } : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const evt = safeJson(rawBody) as { event_type?: string; event_id?: string } | null\n    if (!evt || typeof evt !== 'object') return []\n    return [{\n      provider: 'docuseal',\n      eventType: `docuseal.${evt.event_type ?? 'unknown'}`,\n      providerEventId: typeof evt.event_id === 'string' ? evt.event_id : undefined,\n      receivedAt: now ?? Date.now(),\n      payload: evt,\n      headers: normalizeHeaders(headers),\n    }]\n  },\n  eventCatalog: {\n    // DocuSeal namespaces every event `docuseal.<event_type>`. The documented\n    // set is small but not derivable from `parse`, so it stays open (namespace\n    // is the authoritative gate) with the documented types as hints.\n    namespace: 'docuseal.',\n    closed: false,\n    events: [\n      { id: 'docuseal.form.viewed' },\n      { id: 'docuseal.form.started' },\n      { id: 'docuseal.form.completed' },\n      { id: 'docuseal.form.declined' },\n      { id: 'docuseal.submission.created' },\n      { id: 'docuseal.submission.completed' },\n      { id: 'docuseal.submission.expired' },\n      { id: 'docuseal.submission.archived' },\n    ],\n  },\n}\n\n/** Gmail push provider. Cloud Pub/Sub posts a JWT-signed envelope; the\n *  *payload* is base64 JSON describing the changed history range. The\n *  signature scheme here is the Pub/Sub JWT auth header — when supplied,\n *  consumers SHOULD verify the JWT against Google's well-known\n *  certificates. We accept the simpler \"Bearer <pubsub-shared-secret>\"\n *  variant by default (matching `verifyHmacSignature`). */\nexport const gmailWebhookProvider: WebhookProvider = {\n  id: 'gmail',\n  verifySignature({ headers, secret }): SignatureVerification {\n    const auth = firstHeader(headers, 'authorization')\n    if (!auth) return { valid: false, reason: 'missing_authorization' }\n    // Accept either \"Bearer <secret>\" or \"Token <secret>\" formats. This\n    // is the simple per-tenant shared-secret path; JWT verification is\n    // left to the consumer's `deliver()` when they need full Google JWT\n    // chain validation.\n    const m = /^(?:Bearer|Token)\\s+(.+)$/i.exec(auth)\n    if (!m) return { valid: false, reason: 'invalid_authorization_format' }\n    const a = Buffer.from(m[1]!, 'utf-8')\n    const b = Buffer.from(secret, 'utf-8')\n    if (a.length !== b.length) return { valid: false, reason: 'invalid_signature' }\n    return timingSafeEqual(a, b) ? { valid: true } : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const envelope = safeJson(rawBody) as { message?: { data?: string; messageId?: string; publishTime?: string } } | null\n    if (!envelope?.message?.data) return []\n    let payload: unknown\n    try {\n      payload = JSON.parse(Buffer.from(envelope.message.data, 'base64').toString('utf-8'))\n    } catch {\n      return []\n    }\n    const inner = payload as { historyId?: number | string; emailAddress?: string }\n    return [{\n      provider: 'gmail',\n      eventType: 'gmail.history_changed',\n      providerEventId: envelope.message.messageId,\n      receivedAt: now ?? Date.now(),\n      payload: { ...inner, publishTime: envelope.message.publishTime },\n      headers: normalizeHeaders(headers),\n    }]\n  },\n}\n\n/** Google Drive push provider. Drive does NOT sign the body — it uses\n *  the per-channel token (`X-Goog-Channel-Token`) as the shared secret.\n *  The router compares it constant-time against the resolved secret. */\nexport const gdriveWebhookProvider: WebhookProvider = {\n  id: 'gdrive',\n  verifySignature({ headers, secret }): SignatureVerification {\n    const token = firstHeader(headers, 'x-goog-channel-token')\n    if (!token) return { valid: false, reason: 'missing_channel_token' }\n    const a = Buffer.from(token, 'utf-8')\n    const b = Buffer.from(secret, 'utf-8')\n    if (a.length !== b.length) return { valid: false, reason: 'invalid_signature' }\n    return timingSafeEqual(a, b) ? { valid: true } : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ headers, now }): WebhookEnvelope[] {\n    const resourceId = firstHeader(headers, 'x-goog-resource-id')\n    const resourceState = firstHeader(headers, 'x-goog-resource-state') ?? 'unknown'\n    const channelId = firstHeader(headers, 'x-goog-channel-id')\n    const messageNumber = firstHeader(headers, 'x-goog-message-number')\n    if (resourceState === 'sync') {\n      return [{\n        provider: 'gdrive',\n        eventType: 'gdrive.channel.sync',\n        providerEventId: messageNumber ? `${channelId}-${messageNumber}` : undefined,\n        receivedAt: now ?? Date.now(),\n        payload: { channelId, resourceId, resourceState },\n        headers: normalizeHeaders(headers),\n      }]\n    }\n    return [{\n      provider: 'gdrive',\n      eventType: `gdrive.resource.${resourceState}`,\n      providerEventId: messageNumber ? `${channelId}-${messageNumber}` : undefined,\n      receivedAt: now ?? Date.now(),\n      payload: { channelId, resourceId, resourceState },\n      headers: normalizeHeaders(headers),\n    }]\n  },\n}\n\n/** The Telegram update keys, in resolution order — the first present key names\n *  the update kind (`telegram.message`, `telegram.callback_query`, …). */\nconst TELEGRAM_UPDATE_KEYS = [\n  'message',\n  'edited_message',\n  'channel_post',\n  'edited_channel_post',\n  'business_connection',\n  'business_message',\n  'edited_business_message',\n  'deleted_business_messages',\n  'message_reaction',\n  'message_reaction_count',\n  'inline_query',\n  'chosen_inline_result',\n  'callback_query',\n  'shipping_query',\n  'pre_checkout_query',\n  'purchased_paid_media',\n  'poll',\n  'poll_answer',\n  'my_chat_member',\n  'chat_member',\n  'chat_join_request',\n  'chat_boost',\n  'removed_chat_boost',\n] as const\n\n/** Telegram Bot API webhook provider. Telegram does NOT sign the body — it\n *  authenticates by echoing the `secret_token` set at `setWebhook` time in the\n *  `X-Telegram-Bot-Api-Secret-Token` header. We compare it constant-time to the\n *  per-connection secret. `update_id` is the idempotency anchor. */\nexport const telegramWebhookProvider: WebhookProvider = {\n  id: 'telegram',\n  verifySignature({ headers, secret }): SignatureVerification {\n    const token = firstHeader(headers, 'x-telegram-bot-api-secret-token')\n    if (!token) return { valid: false, reason: 'missing_telegram_secret_token' }\n    const a = Buffer.from(token, 'utf-8')\n    const b = Buffer.from(secret, 'utf-8')\n    if (a.length !== b.length) return { valid: false, reason: 'invalid_secret_token' }\n    return timingSafeEqual(a, b) ? { valid: true } : { valid: false, reason: 'invalid_secret_token' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const evt = safeJson(rawBody) as ({ update_id?: number } & Record<string, unknown>) | null\n    if (!evt || typeof evt !== 'object') return []\n    const kind = TELEGRAM_UPDATE_KEYS.find((k) => k in evt) ?? 'unknown'\n    return [{\n      provider: 'telegram',\n      eventType: `telegram.${kind}`,\n      providerEventId: typeof evt.update_id === 'number' ? String(evt.update_id) : undefined,\n      receivedAt: now ?? Date.now(),\n      payload: evt,\n      headers: normalizeHeaders(headers),\n    }]\n  },\n  eventCatalog: {\n    // Derived from the SAME TELEGRAM_UPDATE_KEYS `parse` matches on, so the\n    // catalog is exhaustive and cannot drift — hence `closed`. (`telegram.unknown`,\n    // parse's fallback for an update with no recognized key, is intentionally\n    // excluded: it is not a triggerable event.)\n    namespace: 'telegram.',\n    closed: true,\n    events: TELEGRAM_UPDATE_KEYS.map((k) => ({ id: `telegram.${k}` })),\n  },\n}\n\n/** Dropbox Sign (HelloSign) webhook provider. There is NO signature header:\n *  the body carries `event.event_hash = HMAC_SHA256(apiKey, event_time +\n *  event_type)` (hex), so the `secret` here is the account's API key (the\n *  caller resolves it from the connection credential). The body is JSON, or a\n *  `json=`/multipart `name=\"json\"` form field on older apps. */\nexport const hellosignWebhookProvider: WebhookProvider = {\n  id: 'hellosign',\n  // Dropbox Sign acknowledges a delivery only when the response body is exactly\n  // 'Hello API Event Received'; any other body makes it retry the event.\n  successResponse: { body: 'Hello API Event Received', headers: { 'content-type': 'text/plain' } },\n  verifySignature({ rawBody, secret }): SignatureVerification {\n    const body = parseHelloSignBody(rawBody)\n    const event = body?.event\n    if (\n      !event ||\n      typeof event.event_time !== 'string' ||\n      typeof event.event_type !== 'string' ||\n      typeof event.event_hash !== 'string'\n    ) {\n      return { valid: false, reason: 'missing_event_fields' }\n    }\n    const expected = createHmac('sha256', secret)\n      .update(`${event.event_time}${event.event_type}`)\n      .digest('hex')\n    const a = Buffer.from(event.event_hash.toLowerCase(), 'utf-8')\n    const b = Buffer.from(expected.toLowerCase(), 'utf-8')\n    if (a.length !== b.length) return { valid: false, reason: 'invalid_signature' }\n    return timingSafeEqual(a, b) ? { valid: true } : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const body = parseHelloSignBody(rawBody)\n    const event = body?.event\n    if (!event) return []\n    return [{\n      provider: 'hellosign',\n      eventType: `hellosign.${event.event_type ?? 'unknown'}`,\n      // Prefer Dropbox Sign's canonical `event.event_id` (stable across\n      // redeliveries, correlates with the provider). Fall back to a digest of\n      // the parsed body when it's absent: `event_hash` = HMAC(apiKey,\n      // event_time + event_type), so two distinct same-type events in the same\n      // second share it — the body digest stays distinct across differing\n      // events and identical across redeliveries of one event.\n      providerEventId:\n        typeof event.event_id === 'string' && event.event_id.length > 0\n          ? event.event_id\n          : createHash('sha256').update(JSON.stringify(body)).digest('hex'),\n      receivedAt: now ?? Date.now(),\n      payload: body,\n      headers: normalizeHeaders(headers),\n    }]\n  },\n  eventCatalog: {\n    // Dropbox Sign namespaces every event `hellosign.<event_type>`. Documented\n    // set as hints; namespace is the authoritative gate. `callback_test` (the\n    // app-config ping) is intentionally excluded — it is not a workflow event.\n    namespace: 'hellosign.',\n    closed: false,\n    events: [\n      { id: 'hellosign.signature_request_sent' },\n      { id: 'hellosign.signature_request_viewed' },\n      { id: 'hellosign.signature_request_signed' },\n      { id: 'hellosign.signature_request_all_signed' },\n      { id: 'hellosign.signature_request_declined' },\n      { id: 'hellosign.signature_request_reassigned' },\n      { id: 'hellosign.signature_request_remind' },\n      { id: 'hellosign.signature_request_canceled' },\n      { id: 'hellosign.signature_request_expired' },\n    ],\n  },\n}\n\n/** Keys Clay HTTP-API-action payloads commonly carry that can anchor\n *  idempotency, in resolution order. Clay bodies are operator-defined, so we\n *  fall back to a digest of the raw body when none is present. */\nconst CLAY_EVENT_ID_KEYS = ['id', 'rowId', 'recordId', 'clayRowId', 'eventId'] as const\n\n/** Clay webhook provider — receives rows Clay delivers via its outbound \"HTTP\n *  API\" action. Clay does NOT sign its requests and adds no proprietary\n *  headers (the `x-clay-signature: sha256=...` header seen in some third-party\n *  code is unverified inference, not in Clay's docs). Authentication is\n *  therefore a pre-shared secret the operator adds as a header on the Clay\n *  action; we compare it constant-time against the per-connection secret.\n *  Header: `x-clay-webhook-secret`. The body is whatever columns the operator\n *  mapped (free-form JSON with no canonical event id), so idempotency anchors\n *  on a common id field when present, else a sha256 of the raw body. */\nexport const clayWebhookProvider: WebhookProvider = {\n  id: 'clay',\n  verifySignature({ headers, secret }): SignatureVerification {\n    const token = firstHeader(headers, 'x-clay-webhook-secret')\n    if (!token) return { valid: false, reason: 'missing_clay_webhook_secret' }\n    const a = Buffer.from(token, 'utf-8')\n    const b = Buffer.from(secret, 'utf-8')\n    if (a.length !== b.length) return { valid: false, reason: 'invalid_signature' }\n    return timingSafeEqual(a, b) ? { valid: true } : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const evt = safeJson(rawBody)\n    if (!evt || typeof evt !== 'object') return []\n    const record = evt as Record<string, unknown>\n    const idKey = CLAY_EVENT_ID_KEYS.find(\n      (k) => typeof record[k] === 'string' || typeof record[k] === 'number',\n    )\n    const providerEventId = idKey\n      ? String(record[idKey])\n      : createHash('sha256').update(rawBody).digest('hex')\n    const eventType =\n      typeof record.event === 'string'\n        ? `clay.${record.event}`\n        : typeof record.type === 'string'\n          ? `clay.${record.type}`\n          : 'clay.row'\n    return [{\n      provider: 'clay',\n      eventType,\n      providerEventId,\n      receivedAt: now ?? Date.now(),\n      payload: evt,\n      headers: normalizeHeaders(headers),\n    }]\n  },\n}\n\ninterface HelloSignInboundBody {\n  event?: {\n    event_time?: string\n    event_type?: string\n    event_hash?: string\n    event_id?: string\n  }\n}\n\n/** Dropbox Sign posts JSON, a form-urlencoded `json=` field, or a\n *  multipart `name=\"json\"` part depending on app vintage. Mirrors the\n *  connector adapter's body extraction. */\nfunction parseHelloSignBody(rawBody: string): HelloSignInboundBody | null {\n  try {\n    const json = JSON.parse(rawBody) as HelloSignInboundBody\n    if (json && typeof json === 'object') return json\n  } catch {\n    // fall through to form-data extraction\n  }\n  // application/x-www-form-urlencoded `json=` field. URLSearchParams decodes\n  // `+` as a space (decodeURIComponent leaves it literal) and resolves\n  // percent-escapes, so space-bearing string fields aren't corrupted.\n  const formJson = new URLSearchParams(rawBody).get('json')\n  if (formJson) {\n    try {\n      return JSON.parse(formJson) as HelloSignInboundBody\n    } catch {\n      return null\n    }\n  }\n  // multipart/form-data with a `name=\"json\"` part. Extract linearly (indexOf +\n  // fixed-shape separator probes, no unbounded lazy regex) so a hostile body\n  // can't drive quadratic backtracking on this public ingress.\n  return extractMultipartJsonField(rawBody)\n}\n\n/** Pull the `json` part out of a multipart/form-data body without an\n *  unbounded backtracking regex. Returns null if the part isn't present or\n *  isn't valid JSON. The separator probes (`\\r?\\n\\r?\\n`, `\\r?\\n--`) are\n *  fixed-shape (no `*`/`+`), so each runs in a single linear scan. */\nfunction extractMultipartJsonField(rawBody: string): HelloSignInboundBody | null {\n  const nameIdx = rawBody.indexOf('name=\"json\"')\n  if (nameIdx === -1) return null\n  const afterName = rawBody.slice(nameIdx)\n  const sep = /\\r?\\n\\r?\\n/.exec(afterName)\n  if (!sep) return null\n  const partBody = afterName.slice(sep.index + sep[0].length)\n  const end = /\\r?\\n--/.exec(partBody)\n  if (!end) return null\n  try {\n    return JSON.parse(partBody.slice(0, end.index)) as HelloSignInboundBody\n  } catch {\n    return null\n  }\n}\n\n/** Generic HMAC provider — for the long-tail webhook source where the\n *  caller has standardised on a single sha256-of-body scheme. Header\n *  `X-Signature` by default; override at provider-build time if needed. */\nexport function genericHmacWebhookProvider(options: {\n  id: string\n  signatureHeader?: string\n  algorithm?: 'sha256' | 'sha1' | 'sha512'\n  signaturePrefix?: string\n  /** Parser to convert the raw body into envelopes. Defaults to\n   *  \"one event with eventType=<provider>.event and payload=JSON\". */\n  parse?: WebhookProvider['parse']\n}): WebhookProvider {\n  const header = options.signatureHeader ?? 'x-signature'\n  return {\n    id: options.id,\n    verifySignature({ rawBody, headers, secret }) {\n      const sig = firstHeader(headers, header)\n      if (!sig) return { valid: false, reason: `missing_${header}` }\n      return verifyHmacSignature(rawBody, sig, secret, {\n        algorithm: options.algorithm ?? 'sha256',\n        signaturePrefix: options.signaturePrefix,\n      })\n        ? { valid: true }\n        : { valid: false, reason: 'invalid_signature' }\n    },\n    parse:\n      options.parse ??\n      (({ rawBody, headers, now }) => {\n        const evt = safeJson(rawBody) ?? rawBody\n        return [{\n          provider: options.id,\n          eventType: `${options.id}.event`,\n          receivedAt: now ?? Date.now(),\n          payload: evt,\n          headers: normalizeHeaders(headers),\n        }]\n      }),\n  }\n}\n\nfunction safeJson(s: string): unknown {\n  try {\n    return JSON.parse(s)\n  } catch {\n    return null\n  }\n}\n\nfunction normalizeHeaders(headers: WebhookHeaders): Record<string, string> {\n  const out: Record<string, string> = {}\n  for (const [k, v] of Object.entries(headers)) {\n    if (v === undefined) continue\n    const value = Array.isArray(v) ? v[0] : v\n    if (typeof value === 'string') out[k.toLowerCase()] = value\n  }\n  return out\n}\n"],"mappings":";;;;;;;;;AAiLO,IAAM,gBAAN,MAAoB;AAAA,EACR;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,MAA4B;AACtC,SAAK,YAAY,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAC7D,SAAK,UAAU,KAAK;AACpB,SAAK,gBAAgB,KAAK;AAC1B,SAAK,cAAc,KAAK;AACxB,SAAK,mBAAmB,KAAK,oBAAoB,IAAI,KAAK,KAAK,KAAK;AACpE,SAAK,UAAU,KAAK,WAAW;AAC/B,SAAK,QAAQ,KAAK,OAAO,KAAK;AAAA,EAChC;AAAA;AAAA;AAAA,EAIA,MAAM,OAAO,SAA+D;AAC1E,UAAM,WAAW,KAAK,UAAU,IAAI,QAAQ,UAAU;AACtD,QAAI,CAAC,UAAU;AACb,aAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,oBAAoB,UAAU,QAAQ,WAAW,EAAE;AAAA,IAC1F;AACA,UAAM,SAAS,MAAM,KAAK,cAAc,SAAS,IAAI,QAAQ,OAAO;AACpE,QAAI,CAAC,QAAQ;AACX,aAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,kBAAkB,UAAU,SAAS,GAAG,EAAE;AAAA,IACjF;AACA,UAAM,eAAe,SAAS,gBAAgB;AAAA,MAC5C,SAAS,QAAQ;AAAA,MACjB,SAAS,QAAQ;AAAA,MACjB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,aAAa,OAAO;AACvB,aAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,qBAAqB,QAAQ,aAAa,OAAO,EAAE;AAAA,IAC1F;AAEA,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,SAAS,MAAM,EAAE,SAAS,QAAQ,SAAS,SAAS,QAAQ,SAAS,KAAK,KAAK,MAAM,EAAE,CAAC;AAAA,IACzG,SAAS,KAAK;AACZ,WAAK,QAAQ,KAAK,EAAE,UAAU,SAAS,GAAG,CAAC;AAC3C,aAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,eAAe,SAAS,WAAW,GAAG,EAAE,EAAE;AAAA,IACjF;AAEA,UAAM,WAA8B,CAAC;AACrC,eAAW,SAAS,QAAQ;AAC1B,UAAI,MAAM,mBAAmB,KAAK,aAAa;AAC7C,cAAM,UAAU,MAAM,KAAK,YAAY,KAAK,MAAM,eAAe;AACjE,YAAI,QAAS;AAAA,MACf;AACA,eAAS,KAAK,KAAK;AAAA,IACrB;AAKA,mBAAe,MAAM;AACnB,WAAK,KAAK,YAAY,QAAQ;AAAA,IAChC,CAAC;AAED,QAAI,SAAS,iBAAiB;AAC5B,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,MAAM,SAAS,gBAAgB;AAAA,QAC/B,SAAS,SAAS,gBAAgB;AAAA,MACpC;AAAA,IACF;AACA,WAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,UAAU,SAAS,QAAQ,OAAO,OAAO,OAAO,EAAE;AAAA,EAClF;AAAA,EAEA,MAAc,YAAY,QAA0C;AAClE,eAAW,SAAS,QAAQ;AAC1B,UAAI;AACF,cAAM,KAAK,QAAQ,KAAK;AACxB,YAAI,MAAM,mBAAmB,KAAK,aAAa;AAC7C,gBAAM,KAAK,YAAY,SAAS,MAAM,iBAAiB,KAAK,gBAAgB;AAAA,QAC9E;AAAA,MACF,SAAS,KAAK;AACZ,aAAK,QAAQ,KAAK;AAAA,UAChB,UAAU,MAAM;AAAA,UAChB,WAAW,MAAM;AAAA,UACjB,iBAAiB,MAAM;AAAA,QACzB,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,eAAe,KAAc,SAAmF;AAEvH,UAAQ,MAAM,mBAAmB,SAAS,GAAG;AAC/C;AAEA,SAAS,WAAW,KAAsB;AACxC,SAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AACxD;;;AC/PA,SAAS,YAAY,YAAY,uBAAuB;AAGjD,IAAM,wBAAyC;AAAA,EACpD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,SAAS,OAAO,GAA0B;AACnE,UAAM,MAAM,YAAY,SAAS,kBAAkB;AACnD,QAAI,CAAC,IAAK,QAAO,EAAE,OAAO,OAAO,QAAQ,2BAA2B;AACpE,WAAO,sBAAsB,SAAS,KAAK,MAAM,IAC7C,EAAE,OAAO,KAAK,IACd,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAClD;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,MAAM,SAAS,OAAO;AAC5B,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAC7C,UAAM,IAAI;AACV,WAAO;AAAA,MACL;AAAA,QACE,UAAU;AAAA,QACV,WAAW,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO;AAAA,QACjD,iBAAiB,OAAO,EAAE,OAAO,WAAW,EAAE,KAAK;AAAA,QACnD,YAAY,OAAO,KAAK,IAAI;AAAA,QAC5B,SAAS;AAAA,QACT,SAAS,iBAAiB,OAAO;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AAAA,EACA,cAAc;AAAA;AAAA;AAAA;AAAA,IAIZ,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,QAAQ;AAAA,MACN,EAAE,IAAI,6BAA6B;AAAA,MACnC,EAAE,IAAI,2BAA2B;AAAA,MACjC,EAAE,IAAI,gCAAgC;AAAA,MACtC,EAAE,IAAI,gCAAgC;AAAA,MACtC,EAAE,IAAI,gCAAgC;AAAA,MACtC,EAAE,IAAI,eAAe;AAAA,MACrB,EAAE,IAAI,yBAAyB;AAAA,MAC/B,EAAE,IAAI,2BAA2B;AAAA,MACjC,EAAE,IAAI,gCAAgC;AAAA,MACtC,EAAE,IAAI,mBAAmB;AAAA,MACzB,EAAE,IAAI,kBAAkB;AAAA,IAC1B;AAAA,EACF;AACF;AAIO,IAAM,uBAAwC;AAAA,EACnD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,SAAS,OAAO,GAA0B;AACnE,UAAM,MAAM,YAAY,SAAS,mBAAmB;AACpD,UAAM,KAAK,YAAY,SAAS,2BAA2B;AAC3D,QAAI,CAAC,OAAO,CAAC,GAAI,QAAO,EAAE,OAAO,OAAO,QAAQ,uCAAuC;AACvF,WAAO,qBAAqB,SAAS,KAAK,IAAI,MAAM,IAChD,EAAE,OAAO,KAAK,IACd,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAClD;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,MAAM,SAAS,OAAO;AAC5B,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAC7C,QAAI,IAAI,SAAS,oBAAoB;AACnC,aAAO,CAAC;AAAA,QACN,UAAU;AAAA,QACV,WAAW;AAAA,QACX,YAAY,OAAO,KAAK,IAAI;AAAA,QAC5B,SAAS;AAAA,QACT,SAAS,iBAAiB,OAAO;AAAA,MACnC,CAAC;AAAA,IACH;AACA,UAAM,YAAY,SAAS,IAAI,OAAO,QAAQ,IAAI,QAAQ,SAAS;AACnE,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV;AAAA,MACA,iBAAiB,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;AAAA,MACnE,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS;AAAA,MACT,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AAAA,EACA,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMZ,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,QAAQ;AAAA,MACN,EAAE,IAAI,gBAAgB;AAAA,MACtB,EAAE,IAAI,oBAAoB;AAAA,MAC1B,EAAE,IAAI,uBAAuB;AAAA,MAC7B,EAAE,IAAI,yBAAyB;AAAA,MAC/B,EAAE,IAAI,wBAAwB;AAAA,MAC9B,EAAE,IAAI,8BAA8B;AAAA,MACpC,EAAE,IAAI,kBAAkB;AAAA,MACxB,EAAE,IAAI,wBAAwB;AAAA,MAC9B,EAAE,IAAI,oBAAoB;AAAA,IAC5B;AAAA,EACF;AACF;AAGO,IAAM,0BAA2C;AAAA,EACtD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,SAAS,OAAO,GAA0B;AACnE,UAAM,MAAM,YAAY,SAAS,sBAAsB;AACvD,QAAI,CAAC,IAAK,QAAO,EAAE,OAAO,OAAO,QAAQ,6BAA6B;AACtE,UAAM,WAAW,WAAW,UAAU,MAAM,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK;AAC1E,UAAM,IAAI,OAAO,KAAK,IAAI,YAAY,GAAG,OAAO;AAChD,UAAM,IAAI,OAAO,KAAK,UAAU,OAAO;AACvC,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAC9E,WAAO,gBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAC/F;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,MAAM,SAAS,OAAO;AAC5B,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAC7C,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV,WAAW,YAAY,IAAI,cAAc,SAAS;AAAA,MAClD,iBAAiB,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;AAAA,MACnE,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS;AAAA,MACT,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AAAA,EACA,cAAc;AAAA;AAAA;AAAA;AAAA,IAIZ,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,QAAQ;AAAA,MACN,EAAE,IAAI,uBAAuB;AAAA,MAC7B,EAAE,IAAI,wBAAwB;AAAA,MAC9B,EAAE,IAAI,0BAA0B;AAAA,MAChC,EAAE,IAAI,yBAAyB;AAAA,MAC/B,EAAE,IAAI,8BAA8B;AAAA,MACpC,EAAE,IAAI,gCAAgC;AAAA,MACtC,EAAE,IAAI,8BAA8B;AAAA,MACpC,EAAE,IAAI,+BAA+B;AAAA,IACvC;AAAA,EACF;AACF;AAQO,IAAM,uBAAwC;AAAA,EACnD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,OAAO,GAA0B;AAC1D,UAAM,OAAO,YAAY,SAAS,eAAe;AACjD,QAAI,CAAC,KAAM,QAAO,EAAE,OAAO,OAAO,QAAQ,wBAAwB;AAKlE,UAAM,IAAI,6BAA6B,KAAK,IAAI;AAChD,QAAI,CAAC,EAAG,QAAO,EAAE,OAAO,OAAO,QAAQ,+BAA+B;AACtE,UAAM,IAAI,OAAO,KAAK,EAAE,CAAC,GAAI,OAAO;AACpC,UAAM,IAAI,OAAO,KAAK,QAAQ,OAAO;AACrC,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAC9E,WAAO,gBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAC/F;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,WAAW,SAAS,OAAO;AACjC,QAAI,CAAC,UAAU,SAAS,KAAM,QAAO,CAAC;AACtC,QAAI;AACJ,QAAI;AACF,gBAAU,KAAK,MAAM,OAAO,KAAK,SAAS,QAAQ,MAAM,QAAQ,EAAE,SAAS,OAAO,CAAC;AAAA,IACrF,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AACA,UAAM,QAAQ;AACd,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV,WAAW;AAAA,MACX,iBAAiB,SAAS,QAAQ;AAAA,MAClC,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS,EAAE,GAAG,OAAO,aAAa,SAAS,QAAQ,YAAY;AAAA,MAC/D,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AACF;AAKO,IAAM,wBAAyC;AAAA,EACpD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,OAAO,GAA0B;AAC1D,UAAM,QAAQ,YAAY,SAAS,sBAAsB;AACzD,QAAI,CAAC,MAAO,QAAO,EAAE,OAAO,OAAO,QAAQ,wBAAwB;AACnE,UAAM,IAAI,OAAO,KAAK,OAAO,OAAO;AACpC,UAAM,IAAI,OAAO,KAAK,QAAQ,OAAO;AACrC,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAC9E,WAAO,gBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAC/F;AAAA,EACA,MAAM,EAAE,SAAS,IAAI,GAAsB;AACzC,UAAM,aAAa,YAAY,SAAS,oBAAoB;AAC5D,UAAM,gBAAgB,YAAY,SAAS,uBAAuB,KAAK;AACvE,UAAM,YAAY,YAAY,SAAS,mBAAmB;AAC1D,UAAM,gBAAgB,YAAY,SAAS,uBAAuB;AAClE,QAAI,kBAAkB,QAAQ;AAC5B,aAAO,CAAC;AAAA,QACN,UAAU;AAAA,QACV,WAAW;AAAA,QACX,iBAAiB,gBAAgB,GAAG,SAAS,IAAI,aAAa,KAAK;AAAA,QACnE,YAAY,OAAO,KAAK,IAAI;AAAA,QAC5B,SAAS,EAAE,WAAW,YAAY,cAAc;AAAA,QAChD,SAAS,iBAAiB,OAAO;AAAA,MACnC,CAAC;AAAA,IACH;AACA,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV,WAAW,mBAAmB,aAAa;AAAA,MAC3C,iBAAiB,gBAAgB,GAAG,SAAS,IAAI,aAAa,KAAK;AAAA,MACnE,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS,EAAE,WAAW,YAAY,cAAc;AAAA,MAChD,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AACF;AAIA,IAAM,uBAAuB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAMO,IAAM,0BAA2C;AAAA,EACtD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,OAAO,GAA0B;AAC1D,UAAM,QAAQ,YAAY,SAAS,iCAAiC;AACpE,QAAI,CAAC,MAAO,QAAO,EAAE,OAAO,OAAO,QAAQ,gCAAgC;AAC3E,UAAM,IAAI,OAAO,KAAK,OAAO,OAAO;AACpC,UAAM,IAAI,OAAO,KAAK,QAAQ,OAAO;AACrC,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,OAAO,OAAO,QAAQ,uBAAuB;AACjF,WAAO,gBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,OAAO,QAAQ,uBAAuB;AAAA,EAClG;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,MAAM,SAAS,OAAO;AAC5B,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAC7C,UAAM,OAAO,qBAAqB,KAAK,CAAC,MAAM,KAAK,GAAG,KAAK;AAC3D,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV,WAAW,YAAY,IAAI;AAAA,MAC3B,iBAAiB,OAAO,IAAI,cAAc,WAAW,OAAO,IAAI,SAAS,IAAI;AAAA,MAC7E,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS;AAAA,MACT,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AAAA,EACA,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA,IAKZ,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,QAAQ,qBAAqB,IAAI,CAAC,OAAO,EAAE,IAAI,YAAY,CAAC,GAAG,EAAE;AAAA,EACnE;AACF;AAOO,IAAM,2BAA4C;AAAA,EACvD,IAAI;AAAA;AAAA;AAAA,EAGJ,iBAAiB,EAAE,MAAM,4BAA4B,SAAS,EAAE,gBAAgB,aAAa,EAAE;AAAA,EAC/F,gBAAgB,EAAE,SAAS,OAAO,GAA0B;AAC1D,UAAM,OAAO,mBAAmB,OAAO;AACvC,UAAM,QAAQ,MAAM;AACpB,QACE,CAAC,SACD,OAAO,MAAM,eAAe,YAC5B,OAAO,MAAM,eAAe,YAC5B,OAAO,MAAM,eAAe,UAC5B;AACA,aAAO,EAAE,OAAO,OAAO,QAAQ,uBAAuB;AAAA,IACxD;AACA,UAAM,WAAW,WAAW,UAAU,MAAM,EACzC,OAAO,GAAG,MAAM,UAAU,GAAG,MAAM,UAAU,EAAE,EAC/C,OAAO,KAAK;AACf,UAAM,IAAI,OAAO,KAAK,MAAM,WAAW,YAAY,GAAG,OAAO;AAC7D,UAAM,IAAI,OAAO,KAAK,SAAS,YAAY,GAAG,OAAO;AACrD,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAC9E,WAAO,gBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAC/F;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,OAAO,mBAAmB,OAAO;AACvC,UAAM,QAAQ,MAAM;AACpB,QAAI,CAAC,MAAO,QAAO,CAAC;AACpB,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV,WAAW,aAAa,MAAM,cAAc,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOrD,iBACE,OAAO,MAAM,aAAa,YAAY,MAAM,SAAS,SAAS,IAC1D,MAAM,WACN,WAAW,QAAQ,EAAE,OAAO,KAAK,UAAU,IAAI,CAAC,EAAE,OAAO,KAAK;AAAA,MACpE,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS;AAAA,MACT,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AAAA,EACA,cAAc;AAAA;AAAA;AAAA;AAAA,IAIZ,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,QAAQ;AAAA,MACN,EAAE,IAAI,mCAAmC;AAAA,MACzC,EAAE,IAAI,qCAAqC;AAAA,MAC3C,EAAE,IAAI,qCAAqC;AAAA,MAC3C,EAAE,IAAI,yCAAyC;AAAA,MAC/C,EAAE,IAAI,uCAAuC;AAAA,MAC7C,EAAE,IAAI,yCAAyC;AAAA,MAC/C,EAAE,IAAI,qCAAqC;AAAA,MAC3C,EAAE,IAAI,uCAAuC;AAAA,MAC7C,EAAE,IAAI,sCAAsC;AAAA,IAC9C;AAAA,EACF;AACF;AAKA,IAAM,qBAAqB,CAAC,MAAM,SAAS,YAAY,aAAa,SAAS;AAWtE,IAAM,sBAAuC;AAAA,EAClD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,OAAO,GAA0B;AAC1D,UAAM,QAAQ,YAAY,SAAS,uBAAuB;AAC1D,QAAI,CAAC,MAAO,QAAO,EAAE,OAAO,OAAO,QAAQ,8BAA8B;AACzE,UAAM,IAAI,OAAO,KAAK,OAAO,OAAO;AACpC,UAAM,IAAI,OAAO,KAAK,QAAQ,OAAO;AACrC,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAC9E,WAAO,gBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAC/F;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,MAAM,SAAS,OAAO;AAC5B,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAC7C,UAAM,SAAS;AACf,UAAM,QAAQ,mBAAmB;AAAA,MAC/B,CAAC,MAAM,OAAO,OAAO,CAAC,MAAM,YAAY,OAAO,OAAO,CAAC,MAAM;AAAA,IAC/D;AACA,UAAM,kBAAkB,QACpB,OAAO,OAAO,KAAK,CAAC,IACpB,WAAW,QAAQ,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK;AACrD,UAAM,YACJ,OAAO,OAAO,UAAU,WACpB,QAAQ,OAAO,KAAK,KACpB,OAAO,OAAO,SAAS,WACrB,QAAQ,OAAO,IAAI,KACnB;AACR,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS;AAAA,MACT,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AACF;AAcA,SAAS,mBAAmB,SAA8C;AACxE,MAAI;AACF,UAAM,OAAO,KAAK,MAAM,OAAO;AAC/B,QAAI,QAAQ,OAAO,SAAS,SAAU,QAAO;AAAA,EAC/C,QAAQ;AAAA,EAER;AAIA,QAAM,WAAW,IAAI,gBAAgB,OAAO,EAAE,IAAI,MAAM;AACxD,MAAI,UAAU;AACZ,QAAI;AACF,aAAO,KAAK,MAAM,QAAQ;AAAA,IAC5B,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAIA,SAAO,0BAA0B,OAAO;AAC1C;AAMA,SAAS,0BAA0B,SAA8C;AAC/E,QAAM,UAAU,QAAQ,QAAQ,aAAa;AAC7C,MAAI,YAAY,GAAI,QAAO;AAC3B,QAAM,YAAY,QAAQ,MAAM,OAAO;AACvC,QAAM,MAAM,aAAa,KAAK,SAAS;AACvC,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,WAAW,UAAU,MAAM,IAAI,QAAQ,IAAI,CAAC,EAAE,MAAM;AAC1D,QAAM,MAAM,UAAU,KAAK,QAAQ;AACnC,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,WAAO,KAAK,MAAM,SAAS,MAAM,GAAG,IAAI,KAAK,CAAC;AAAA,EAChD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKO,SAAS,2BAA2B,SAQvB;AAClB,QAAM,SAAS,QAAQ,mBAAmB;AAC1C,SAAO;AAAA,IACL,IAAI,QAAQ;AAAA,IACZ,gBAAgB,EAAE,SAAS,SAAS,OAAO,GAAG;AAC5C,YAAM,MAAM,YAAY,SAAS,MAAM;AACvC,UAAI,CAAC,IAAK,QAAO,EAAE,OAAO,OAAO,QAAQ,WAAW,MAAM,GAAG;AAC7D,aAAO,oBAAoB,SAAS,KAAK,QAAQ;AAAA,QAC/C,WAAW,QAAQ,aAAa;AAAA,QAChC,iBAAiB,QAAQ;AAAA,MAC3B,CAAC,IACG,EAAE,OAAO,KAAK,IACd,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,IAClD;AAAA,IACA,OACE,QAAQ,UACP,CAAC,EAAE,SAAS,SAAS,IAAI,MAAM;AAC9B,YAAM,MAAM,SAAS,OAAO,KAAK;AACjC,aAAO,CAAC;AAAA,QACN,UAAU,QAAQ;AAAA,QAClB,WAAW,GAAG,QAAQ,EAAE;AAAA,QACxB,YAAY,OAAO,KAAK,IAAI;AAAA,QAC5B,SAAS;AAAA,QACT,SAAS,iBAAiB,OAAO;AAAA,MACnC,CAAC;AAAA,IACH;AAAA,EACJ;AACF;AAEA,SAAS,SAAS,GAAoB;AACpC,MAAI;AACF,WAAO,KAAK,MAAM,CAAC;AAAA,EACrB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,iBAAiB,SAAiD;AACzE,QAAM,MAA8B,CAAC;AACrC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC5C,QAAI,MAAM,OAAW;AACrB,UAAM,QAAQ,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI;AACxC,QAAI,OAAO,UAAU,SAAU,KAAI,EAAE,YAAY,CAAC,IAAI;AAAA,EACxD;AACA,SAAO;AACT;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-integrations",
-  "version": "0.46.0",
+  "version": "0.48.0",
   "description": "Vendor-neutral integration contracts and runtime helpers for sandbox and agent apps.",
   "homepage": "https://github.com/tangle-network/agent-integrations#readme",
   "repository": {
@@ -104,7 +104,8 @@
     "@types/node": "^25.6.0",
     "tsup": "^8.0.0",
     "typescript": "^5.7.0",
-    "vitest": "^3.0.0"
+    "vite": "^8.1.2",
+    "vitest": "^4.1.9"
   },
   "engines": {
     "node": ">=20"