@tangle-network/agent-integrations 0.47.0 → 0.49.0

package/dist/catalog.js

@@ -7,7 +7,7 @@ import {
   parseIntegrationToolName,
   searchIntegrationTools,
   toMcpTools
-} from "./chunk-G3S6OGY6.js";
+} from "./chunk-XECSOZRL.js";
 import "./chunk-S2BUASSV.js";
 import "./chunk-LA76XB7M.js";
 import "./chunk-H4XYLS7T.js";
@@ -15,8 +15,8 @@ import "./chunk-VLVSP7SP.js";
 import "./chunk-IA5GCKM6.js";
 import "./chunk-7P2LN4VT.js";
 import "./chunk-376UBTNB.js";
-import "./chunk-EPDUDWOD.js";
-import "./chunk-2TW2QKGZ.js";
+import "./chunk-EV7PFUCM.js";
+import "./chunk-XC54EOUQ.js";
 import "./chunk-UWF33ESC.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/{chunk-EPDUDWOD.js → chunk-EV7PFUCM.js}

@@ -2,7 +2,7 @@ import {
   firstHeader,
   verifySlackSignature,
   verifyStripeSignature
-} from "./chunk-2TW2QKGZ.js";
+} from "./chunk-XC54EOUQ.js";
 import {
   CredentialsExpired,
   DEFAULT_TANGLE_PLATFORM_URL,
@@ -125506,4 +125506,4 @@ export {
   demandbaseConnector,
   adapters_exports
 };
-//# sourceMappingURL=chunk-EPDUDWOD.js.map
+//# sourceMappingURL=chunk-EV7PFUCM.js.map

package/dist/{chunk-2TW2QKGZ.js → chunk-XC54EOUQ.js}

@@ -76,6 +76,18 @@ function verifyTwilioSignature(input, options = {}) {
   if (expectedBuf.length !== sigBuf.length) return false;
   return timingSafeEqual(expectedBuf, sigBuf);
 }
+function verifyEmailSignature(rawBody, signatureHeader, timestampHeader, secret, options = {}) {
+  const ts = Number(timestampHeader);
+  if (!Number.isFinite(ts)) return false;
+  const tolerance = options.toleranceSeconds ?? DEFAULT_SIGNATURE_TOLERANCE_SECONDS;
+  const now = options.now ?? Math.floor(Date.now() / 1e3);
+  if (Math.abs(now - ts) > tolerance) return false;
+  const expected = createHmac("sha256", secret).update(`${ts}.${rawBody}`).digest("hex");
+  const expectedBuf = Buffer.from(expected, "utf8");
+  const sigBuf = Buffer.from(signatureHeader.toLowerCase(), "utf8");
+  if (sigBuf.length !== expectedBuf.length) return false;
+  return timingSafeEqual(sigBuf, expectedBuf);
+}
 function firstHeader(headers, name) {
   const v = headers[name] ?? headers[name.toLowerCase()] ?? Object.entries(headers).find(([key]) => key.toLowerCase() === name.toLowerCase())?.[1];
   if (Array.isArray(v)) return v[0];
@@ -89,6 +101,7 @@ export {
   verifySlackSignature,
   verifyHmacSignature,
   verifyTwilioSignature,
+  verifyEmailSignature,
   firstHeader
 };
-//# sourceMappingURL=chunk-2TW2QKGZ.js.map
+//# sourceMappingURL=chunk-XC54EOUQ.js.map

package/dist/{chunk-2TW2QKGZ.js.map → chunk-XC54EOUQ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/connectors/webhooks.ts"],"sourcesContent":["/**\n * Inbound webhook signature verifiers — provider-specific HMAC schemes.\n *\n * Each signature scheme is a pure function:\n *   (rawBody: string, headers, secret, now?) → boolean\n *\n * Constant-time comparison via `crypto.timingSafeEqual`. Timestamps are\n * checked against a configurable tolerance to bound replay risk; the default\n * mirrors the upstream provider's documented window (Stripe: 5 min, Slack: 5 min).\n *\n * These verifiers are the building blocks for any inbound-webhook receiver\n * (a route + a `verify` call + a per-event handler). They live in this\n * package so every consumer of the integration substrate gets correct\n * verification — not just one product reimplementing it.\n */\n\nimport { createHmac, timingSafeEqual } from 'node:crypto'\n\n/** Default replay-protection window. Providers commonly use 5 minutes. */\nexport const DEFAULT_SIGNATURE_TOLERANCE_SECONDS = 5 * 60\n\n// ─── Stripe ─────────────────────────────────────────────────────────────\n//\n// Stripe signs webhooks with a single header `Stripe-Signature` of the form\n//\n//   t=<timestamp>,v1=<sig1>,v1=<sig2>,...\n//\n// where `t` is the Unix timestamp the event was generated, and each `v1`\n// is `HMAC-SHA256(secret, \"<t>.<rawBody>\")`. Multiple `v1` entries appear\n// during secret rotation — any one matching is sufficient.\n//\n// https://stripe.com/docs/webhooks/signatures\n\nexport interface ParsedStripeSignatureHeader {\n  t: number\n  sigs: string[]\n}\n\nexport function parseStripeSignatureHeader(header: string): ParsedStripeSignatureHeader | null {\n  const acc: { ts?: number; sigs: string[] } = { sigs: [] }\n  for (const part of header.split(',')) {\n    const idx = part.indexOf('=')\n    if (idx < 0) continue\n    const key = part.slice(0, idx).trim()\n    const val = part.slice(idx + 1).trim()\n    if (key === 't') {\n      const n = Number(val)\n      if (Number.isFinite(n)) acc.ts = n\n    } else if (key === 'v1') {\n      acc.sigs.push(val)\n    }\n  }\n  if (acc.ts === undefined || acc.sigs.length === 0) return null\n  return { t: acc.ts, sigs: acc.sigs }\n}\n\nexport interface StripeVerifyOptions {\n  /** Replay-protection window in seconds. Default 300. */\n  toleranceSeconds?: number\n  /** Override `now()` for tests. UTC seconds. */\n  now?: number\n}\n\n/** Verify a Stripe webhook signature against the raw request body. */\nexport function verifyStripeSignature(\n  rawBody: string,\n  signatureHeader: string,\n  secret: string,\n  options: StripeVerifyOptions = {},\n): boolean {\n  const parsed = parseStripeSignatureHeader(signatureHeader)\n  if (!parsed) return false\n  const tolerance = options.toleranceSeconds ?? DEFAULT_SIGNATURE_TOLERANCE_SECONDS\n  const now = options.now ?? Math.floor(Date.now() / 1000)\n  if (Math.abs(now - parsed.t) > tolerance) return false\n  const expected = createHmac('sha256', secret).update(`${parsed.t}.${rawBody}`).digest('hex')\n  const expectedBuf = Buffer.from(expected, 'utf8')\n  for (const sig of parsed.sigs) {\n    const sigBuf = Buffer.from(sig, 'utf8')\n    if (sigBuf.length !== expectedBuf.length) continue\n    if (timingSafeEqual(sigBuf, expectedBuf)) return true\n  }\n  return false\n}\n\n// ─── Slack ──────────────────────────────────────────────────────────────\n//\n// Slack signs request bodies with two headers:\n//\n//   X-Slack-Signature:         v0=<HMAC-SHA256(secret, \"v0:<ts>:<body>\")>\n//   X-Slack-Request-Timestamp: <ts>\n//\n// https://api.slack.com/authentication/verifying-requests-from-slack\n\nexport interface SlackVerifyOptions {\n  toleranceSeconds?: number\n  now?: number\n}\n\nexport function verifySlackSignature(\n  rawBody: string,\n  signatureHeader: string,\n  timestampHeader: string,\n  secret: string,\n  options: SlackVerifyOptions = {},\n): boolean {\n  if (!signatureHeader.startsWith('v0=')) return false\n  const ts = Number(timestampHeader)\n  if (!Number.isFinite(ts)) return false\n  const tolerance = options.toleranceSeconds ?? DEFAULT_SIGNATURE_TOLERANCE_SECONDS\n  const now = options.now ?? Math.floor(Date.now() / 1000)\n  if (Math.abs(now - ts) > tolerance) return false\n  const expected = 'v0=' + createHmac('sha256', secret).update(`v0:${ts}:${rawBody}`).digest('hex')\n  const expectedBuf = Buffer.from(expected, 'utf8')\n  const sigBuf = Buffer.from(signatureHeader, 'utf8')\n  if (sigBuf.length !== expectedBuf.length) return false\n  return timingSafeEqual(sigBuf, expectedBuf)\n}\n\n// ─── Generic HMAC ───────────────────────────────────────────────────────\n//\n// For \"we shipped a webhook URL with a shared HMAC secret\" patterns —\n// covers any custom integration where the operator picks the message\n// format. The signed message is the literal `rawBody` (no timestamp\n// prefix); replay protection is the caller's responsibility (use a\n// nonce header + a small dedup cache).\n\nexport interface GenericHmacVerifyOptions {\n  /** sha256 (default) | sha1 | sha512 — matches the algorithm the receiver\n   *  computed at sign time. */\n  algorithm?: 'sha256' | 'sha1' | 'sha512'\n  /** Optional prefix the receiver prepends to the signature in the header\n   *  (e.g., `'sha256='`). Stripped before constant-time comparison. */\n  signaturePrefix?: string\n  /** Lowercase comparison (most providers emit hex-lowercase). Default true. */\n  lowercaseHex?: boolean\n}\n\nexport function verifyHmacSignature(\n  rawBody: string,\n  signatureHeader: string,\n  secret: string,\n  options: GenericHmacVerifyOptions = {},\n): boolean {\n  const algorithm = options.algorithm ?? 'sha256'\n  const prefix = options.signaturePrefix ?? ''\n  const lower = options.lowercaseHex ?? true\n  let candidate = signatureHeader\n  if (prefix) {\n    if (!candidate.startsWith(prefix)) return false\n    candidate = candidate.slice(prefix.length)\n  }\n  if (lower) candidate = candidate.toLowerCase()\n  const expected = createHmac(algorithm, secret).update(rawBody).digest('hex')\n  const expectedBuf = Buffer.from(expected, 'utf8')\n  const sigBuf = Buffer.from(candidate, 'utf8')\n  if (sigBuf.length !== expectedBuf.length) return false\n  return timingSafeEqual(sigBuf, expectedBuf)\n}\n\n// ─── Twilio ─────────────────────────────────────────────────────────────\n//\n// Twilio's webhook signature scheme is unlike Stripe/Slack — it doesn't\n// sign the raw body. It signs the concatenation of:\n//\n//     fullUrl + sortedConcatenatedParams\n//\n// where `fullUrl` is the public URL Twilio called (scheme + host + path\n// + query, exactly as Twilio constructed it from your console config),\n// and `sortedConcatenatedParams` is `key1+value1+key2+value2+...` over\n// the alphabetically-sorted keys of the POST body params (form-encoded).\n//\n// For JSON-bodied Twilio webhooks (Conversations API), the body is signed\n// as raw bytes — pass `{ bodyAsRaw: true, rawBody }` for that path.\n//\n// HMAC-SHA1, base64-encoded. Header: `X-Twilio-Signature`.\n//\n// https://www.twilio.com/docs/usage/webhooks/webhooks-security\n\nexport interface TwilioVerifyOptions {\n  /** Skip verification when the auth token isn't configured. Useful in\n   *  dev where the receiver wants to accept any payload. Default `false`\n   *  — production should always require a configured token. */\n  skipWhenAuthTokenMissing?: boolean\n  /** When true, sign the raw body instead of the URL-encoded sorted-params\n   *  reduction. Twilio uses raw-body signing for `application/json`\n   *  webhook bodies. Default `false`. */\n  bodyAsRaw?: boolean\n  /** When `bodyAsRaw` is true, the raw body to sign. Ignored otherwise. */\n  rawBody?: string\n}\n\n/** Verify a Twilio webhook signature. */\nexport function verifyTwilioSignature(\n  input: {\n    authToken: string | null | undefined\n    signatureHeader: string | string[] | undefined\n    fullUrl: string | null | undefined\n    params: Record<string, string> | undefined\n  },\n  options: TwilioVerifyOptions = {},\n): boolean {\n  if (!input.authToken) {\n    return options.skipWhenAuthTokenMissing === true\n  }\n  const signature = input.signatureHeader\n  if (!signature || Array.isArray(signature)) return false\n  if (!input.fullUrl) return false\n\n  const data = options.bodyAsRaw === true\n    ? input.fullUrl + (options.rawBody ?? '')\n    : Object.keys(input.params ?? {})\n        .sort()\n        .reduce((acc, key) => acc + key + (input.params![key] ?? ''), input.fullUrl)\n\n  const expected = createHmac('sha1', input.authToken).update(data).digest('base64')\n  const expectedBuf = Buffer.from(expected)\n  const sigBuf = Buffer.from(signature)\n  if (expectedBuf.length !== sigBuf.length) return false\n  return timingSafeEqual(expectedBuf, sigBuf)\n}\n\n// ─── Header helper ──────────────────────────────────────────────────────\n//\n// Most fastify/express adapters expose request headers as\n// `Record<string, string | string[] | undefined>`. This helper picks the\n// first canonical value for a given name (case-insensitive).\n\nexport function firstHeader(\n  headers: Record<string, string | string[] | undefined>,\n  name: string,\n): string | undefined {\n  const v = headers[name]\n    ?? headers[name.toLowerCase()]\n    ?? Object.entries(headers).find(([key]) => key.toLowerCase() === name.toLowerCase())?.[1]\n  if (Array.isArray(v)) return v[0]\n  return typeof v === 'string' ? v : undefined\n}\n"],"mappings":";AAgBA,SAAS,YAAY,uBAAuB;AAGrC,IAAM,sCAAsC,IAAI;AAmBhD,SAAS,2BAA2B,QAAoD;AAC7F,QAAM,MAAuC,EAAE,MAAM,CAAC,EAAE;AACxD,aAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AACpC,UAAM,MAAM,KAAK,QAAQ,GAAG;AAC5B,QAAI,MAAM,EAAG;AACb,UAAM,MAAM,KAAK,MAAM,GAAG,GAAG,EAAE,KAAK;AACpC,UAAM,MAAM,KAAK,MAAM,MAAM,CAAC,EAAE,KAAK;AACrC,QAAI,QAAQ,KAAK;AACf,YAAM,IAAI,OAAO,GAAG;AACpB,UAAI,OAAO,SAAS,CAAC,EAAG,KAAI,KAAK;AAAA,IACnC,WAAW,QAAQ,MAAM;AACvB,UAAI,KAAK,KAAK,GAAG;AAAA,IACnB;AAAA,EACF;AACA,MAAI,IAAI,OAAO,UAAa,IAAI,KAAK,WAAW,EAAG,QAAO;AAC1D,SAAO,EAAE,GAAG,IAAI,IAAI,MAAM,IAAI,KAAK;AACrC;AAUO,SAAS,sBACd,SACA,iBACA,QACA,UAA+B,CAAC,GACvB;AACT,QAAM,SAAS,2BAA2B,eAAe;AACzD,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,YAAY,QAAQ,oBAAoB;AAC9C,QAAM,MAAM,QAAQ,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACvD,MAAI,KAAK,IAAI,MAAM,OAAO,CAAC,IAAI,UAAW,QAAO;AACjD,QAAM,WAAW,WAAW,UAAU,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,OAAO,EAAE,EAAE,OAAO,KAAK;AAC3F,QAAM,cAAc,OAAO,KAAK,UAAU,MAAM;AAChD,aAAW,OAAO,OAAO,MAAM;AAC7B,UAAM,SAAS,OAAO,KAAK,KAAK,MAAM;AACtC,QAAI,OAAO,WAAW,YAAY,OAAQ;AAC1C,QAAI,gBAAgB,QAAQ,WAAW,EAAG,QAAO;AAAA,EACnD;AACA,SAAO;AACT;AAgBO,SAAS,qBACd,SACA,iBACA,iBACA,QACA,UAA8B,CAAC,GACtB;AACT,MAAI,CAAC,gBAAgB,WAAW,KAAK,EAAG,QAAO;AAC/C,QAAM,KAAK,OAAO,eAAe;AACjC,MAAI,CAAC,OAAO,SAAS,EAAE,EAAG,QAAO;AACjC,QAAM,YAAY,QAAQ,oBAAoB;AAC9C,QAAM,MAAM,QAAQ,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACvD,MAAI,KAAK,IAAI,MAAM,EAAE,IAAI,UAAW,QAAO;AAC3C,QAAM,WAAW,QAAQ,WAAW,UAAU,MAAM,EAAE,OAAO,MAAM,EAAE,IAAI,OAAO,EAAE,EAAE,OAAO,KAAK;AAChG,QAAM,cAAc,OAAO,KAAK,UAAU,MAAM;AAChD,QAAM,SAAS,OAAO,KAAK,iBAAiB,MAAM;AAClD,MAAI,OAAO,WAAW,YAAY,OAAQ,QAAO;AACjD,SAAO,gBAAgB,QAAQ,WAAW;AAC5C;AAqBO,SAAS,oBACd,SACA,iBACA,QACA,UAAoC,CAAC,GAC5B;AACT,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,SAAS,QAAQ,mBAAmB;AAC1C,QAAM,QAAQ,QAAQ,gBAAgB;AACtC,MAAI,YAAY;AAChB,MAAI,QAAQ;AACV,QAAI,CAAC,UAAU,WAAW,MAAM,EAAG,QAAO;AAC1C,gBAAY,UAAU,MAAM,OAAO,MAAM;AAAA,EAC3C;AACA,MAAI,MAAO,aAAY,UAAU,YAAY;AAC7C,QAAM,WAAW,WAAW,WAAW,MAAM,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK;AAC3E,QAAM,cAAc,OAAO,KAAK,UAAU,MAAM;AAChD,QAAM,SAAS,OAAO,KAAK,WAAW,MAAM;AAC5C,MAAI,OAAO,WAAW,YAAY,OAAQ,QAAO;AACjD,SAAO,gBAAgB,QAAQ,WAAW;AAC5C;AAmCO,SAAS,sBACd,OAMA,UAA+B,CAAC,GACvB;AACT,MAAI,CAAC,MAAM,WAAW;AACpB,WAAO,QAAQ,6BAA6B;AAAA,EAC9C;AACA,QAAM,YAAY,MAAM;AACxB,MAAI,CAAC,aAAa,MAAM,QAAQ,SAAS,EAAG,QAAO;AACnD,MAAI,CAAC,MAAM,QAAS,QAAO;AAE3B,QAAM,OAAO,QAAQ,cAAc,OAC/B,MAAM,WAAW,QAAQ,WAAW,MACpC,OAAO,KAAK,MAAM,UAAU,CAAC,CAAC,EAC3B,KAAK,EACL,OAAO,CAAC,KAAK,QAAQ,MAAM,OAAO,MAAM,OAAQ,GAAG,KAAK,KAAK,MAAM,OAAO;AAEjF,QAAM,WAAW,WAAW,QAAQ,MAAM,SAAS,EAAE,OAAO,IAAI,EAAE,OAAO,QAAQ;AACjF,QAAM,cAAc,OAAO,KAAK,QAAQ;AACxC,QAAM,SAAS,OAAO,KAAK,SAAS;AACpC,MAAI,YAAY,WAAW,OAAO,OAAQ,QAAO;AACjD,SAAO,gBAAgB,aAAa,MAAM;AAC5C;AAQO,SAAS,YACd,SACA,MACoB;AACpB,QAAM,IAAI,QAAQ,IAAI,KACjB,QAAQ,KAAK,YAAY,CAAC,KAC1B,OAAO,QAAQ,OAAO,EAAE,KAAK,CAAC,CAAC,GAAG,MAAM,IAAI,YAAY,MAAM,KAAK,YAAY,CAAC,IAAI,CAAC;AAC1F,MAAI,MAAM,QAAQ,CAAC,EAAG,QAAO,EAAE,CAAC;AAChC,SAAO,OAAO,MAAM,WAAW,IAAI;AACrC;","names":[]}
+{"version":3,"sources":["../src/connectors/webhooks.ts"],"sourcesContent":["/**\n * Inbound webhook signature verifiers — provider-specific HMAC schemes.\n *\n * Each signature scheme is a pure function:\n *   (rawBody: string, headers, secret, now?) → boolean\n *\n * Constant-time comparison via `crypto.timingSafeEqual`. Timestamps are\n * checked against a configurable tolerance to bound replay risk; the default\n * mirrors the upstream provider's documented window (Stripe: 5 min, Slack: 5 min).\n *\n * These verifiers are the building blocks for any inbound-webhook receiver\n * (a route + a `verify` call + a per-event handler). They live in this\n * package so every consumer of the integration substrate gets correct\n * verification — not just one product reimplementing it.\n */\n\nimport { createHmac, timingSafeEqual } from 'node:crypto'\n\n/** Default replay-protection window. Providers commonly use 5 minutes. */\nexport const DEFAULT_SIGNATURE_TOLERANCE_SECONDS = 5 * 60\n\n// ─── Stripe ─────────────────────────────────────────────────────────────\n//\n// Stripe signs webhooks with a single header `Stripe-Signature` of the form\n//\n//   t=<timestamp>,v1=<sig1>,v1=<sig2>,...\n//\n// where `t` is the Unix timestamp the event was generated, and each `v1`\n// is `HMAC-SHA256(secret, \"<t>.<rawBody>\")`. Multiple `v1` entries appear\n// during secret rotation — any one matching is sufficient.\n//\n// https://stripe.com/docs/webhooks/signatures\n\nexport interface ParsedStripeSignatureHeader {\n  t: number\n  sigs: string[]\n}\n\nexport function parseStripeSignatureHeader(header: string): ParsedStripeSignatureHeader | null {\n  const acc: { ts?: number; sigs: string[] } = { sigs: [] }\n  for (const part of header.split(',')) {\n    const idx = part.indexOf('=')\n    if (idx < 0) continue\n    const key = part.slice(0, idx).trim()\n    const val = part.slice(idx + 1).trim()\n    if (key === 't') {\n      const n = Number(val)\n      if (Number.isFinite(n)) acc.ts = n\n    } else if (key === 'v1') {\n      acc.sigs.push(val)\n    }\n  }\n  if (acc.ts === undefined || acc.sigs.length === 0) return null\n  return { t: acc.ts, sigs: acc.sigs }\n}\n\nexport interface StripeVerifyOptions {\n  /** Replay-protection window in seconds. Default 300. */\n  toleranceSeconds?: number\n  /** Override `now()` for tests. UTC seconds. */\n  now?: number\n}\n\n/** Verify a Stripe webhook signature against the raw request body. */\nexport function verifyStripeSignature(\n  rawBody: string,\n  signatureHeader: string,\n  secret: string,\n  options: StripeVerifyOptions = {},\n): boolean {\n  const parsed = parseStripeSignatureHeader(signatureHeader)\n  if (!parsed) return false\n  const tolerance = options.toleranceSeconds ?? DEFAULT_SIGNATURE_TOLERANCE_SECONDS\n  const now = options.now ?? Math.floor(Date.now() / 1000)\n  if (Math.abs(now - parsed.t) > tolerance) return false\n  const expected = createHmac('sha256', secret).update(`${parsed.t}.${rawBody}`).digest('hex')\n  const expectedBuf = Buffer.from(expected, 'utf8')\n  for (const sig of parsed.sigs) {\n    const sigBuf = Buffer.from(sig, 'utf8')\n    if (sigBuf.length !== expectedBuf.length) continue\n    if (timingSafeEqual(sigBuf, expectedBuf)) return true\n  }\n  return false\n}\n\n// ─── Slack ──────────────────────────────────────────────────────────────\n//\n// Slack signs request bodies with two headers:\n//\n//   X-Slack-Signature:         v0=<HMAC-SHA256(secret, \"v0:<ts>:<body>\")>\n//   X-Slack-Request-Timestamp: <ts>\n//\n// https://api.slack.com/authentication/verifying-requests-from-slack\n\nexport interface SlackVerifyOptions {\n  toleranceSeconds?: number\n  now?: number\n}\n\nexport function verifySlackSignature(\n  rawBody: string,\n  signatureHeader: string,\n  timestampHeader: string,\n  secret: string,\n  options: SlackVerifyOptions = {},\n): boolean {\n  if (!signatureHeader.startsWith('v0=')) return false\n  const ts = Number(timestampHeader)\n  if (!Number.isFinite(ts)) return false\n  const tolerance = options.toleranceSeconds ?? DEFAULT_SIGNATURE_TOLERANCE_SECONDS\n  const now = options.now ?? Math.floor(Date.now() / 1000)\n  if (Math.abs(now - ts) > tolerance) return false\n  const expected = 'v0=' + createHmac('sha256', secret).update(`v0:${ts}:${rawBody}`).digest('hex')\n  const expectedBuf = Buffer.from(expected, 'utf8')\n  const sigBuf = Buffer.from(signatureHeader, 'utf8')\n  if (sigBuf.length !== expectedBuf.length) return false\n  return timingSafeEqual(sigBuf, expectedBuf)\n}\n\n// ─── Generic HMAC ───────────────────────────────────────────────────────\n//\n// For \"we shipped a webhook URL with a shared HMAC secret\" patterns —\n// covers any custom integration where the operator picks the message\n// format. The signed message is the literal `rawBody` (no timestamp\n// prefix); replay protection is the caller's responsibility (use a\n// nonce header + a small dedup cache).\n\nexport interface GenericHmacVerifyOptions {\n  /** sha256 (default) | sha1 | sha512 — matches the algorithm the receiver\n   *  computed at sign time. */\n  algorithm?: 'sha256' | 'sha1' | 'sha512'\n  /** Optional prefix the receiver prepends to the signature in the header\n   *  (e.g., `'sha256='`). Stripped before constant-time comparison. */\n  signaturePrefix?: string\n  /** Lowercase comparison (most providers emit hex-lowercase). Default true. */\n  lowercaseHex?: boolean\n}\n\nexport function verifyHmacSignature(\n  rawBody: string,\n  signatureHeader: string,\n  secret: string,\n  options: GenericHmacVerifyOptions = {},\n): boolean {\n  const algorithm = options.algorithm ?? 'sha256'\n  const prefix = options.signaturePrefix ?? ''\n  const lower = options.lowercaseHex ?? true\n  let candidate = signatureHeader\n  if (prefix) {\n    if (!candidate.startsWith(prefix)) return false\n    candidate = candidate.slice(prefix.length)\n  }\n  if (lower) candidate = candidate.toLowerCase()\n  const expected = createHmac(algorithm, secret).update(rawBody).digest('hex')\n  const expectedBuf = Buffer.from(expected, 'utf8')\n  const sigBuf = Buffer.from(candidate, 'utf8')\n  if (sigBuf.length !== expectedBuf.length) return false\n  return timingSafeEqual(sigBuf, expectedBuf)\n}\n\n// ─── Twilio ─────────────────────────────────────────────────────────────\n//\n// Twilio's webhook signature scheme is unlike Stripe/Slack — it doesn't\n// sign the raw body. It signs the concatenation of:\n//\n//     fullUrl + sortedConcatenatedParams\n//\n// where `fullUrl` is the public URL Twilio called (scheme + host + path\n// + query, exactly as Twilio constructed it from your console config),\n// and `sortedConcatenatedParams` is `key1+value1+key2+value2+...` over\n// the alphabetically-sorted keys of the POST body params (form-encoded).\n//\n// For JSON-bodied Twilio webhooks (Conversations API), the body is signed\n// as raw bytes — pass `{ bodyAsRaw: true, rawBody }` for that path.\n//\n// HMAC-SHA1, base64-encoded. Header: `X-Twilio-Signature`.\n//\n// https://www.twilio.com/docs/usage/webhooks/webhooks-security\n\nexport interface TwilioVerifyOptions {\n  /** Skip verification when the auth token isn't configured. Useful in\n   *  dev where the receiver wants to accept any payload. Default `false`\n   *  — production should always require a configured token. */\n  skipWhenAuthTokenMissing?: boolean\n  /** When true, sign the raw body instead of the URL-encoded sorted-params\n   *  reduction. Twilio uses raw-body signing for `application/json`\n   *  webhook bodies. Default `false`. */\n  bodyAsRaw?: boolean\n  /** When `bodyAsRaw` is true, the raw body to sign. Ignored otherwise. */\n  rawBody?: string\n}\n\n/** Verify a Twilio webhook signature. */\nexport function verifyTwilioSignature(\n  input: {\n    authToken: string | null | undefined\n    signatureHeader: string | string[] | undefined\n    fullUrl: string | null | undefined\n    params: Record<string, string> | undefined\n  },\n  options: TwilioVerifyOptions = {},\n): boolean {\n  if (!input.authToken) {\n    return options.skipWhenAuthTokenMissing === true\n  }\n  const signature = input.signatureHeader\n  if (!signature || Array.isArray(signature)) return false\n  if (!input.fullUrl) return false\n\n  const data = options.bodyAsRaw === true\n    ? input.fullUrl + (options.rawBody ?? '')\n    : Object.keys(input.params ?? {})\n        .sort()\n        .reduce((acc, key) => acc + key + (input.params![key] ?? ''), input.fullUrl)\n\n  const expected = createHmac('sha1', input.authToken).update(data).digest('base64')\n  const expectedBuf = Buffer.from(expected)\n  const sigBuf = Buffer.from(signature)\n  if (expectedBuf.length !== sigBuf.length) return false\n  return timingSafeEqual(expectedBuf, sigBuf)\n}\n\n// ─── Inbound email ──────────────────────────────────────────────────────\n//\n// Tangle's own inbound-email edge (a Cloudflare Email Routing worker) receives\n// a message, serializes the parsed MIME to a JSON body, and signs it with the\n// connection's per-connection secret before POSTing it to the hub. There is no\n// upstream mail-vendor signature to trust — WE are both signer and verifier —\n// so the scheme is a timestamped HMAC (Slack/Stripe-style) to get replay\n// protection on the captured webhook:\n//\n//   X-Tangle-Email-Signature: <HMAC-SHA256(secret, \"<ts>.<rawBody>\") hex>\n//   X-Tangle-Email-Timestamp: <unix seconds>\n\nexport interface EmailVerifyOptions {\n  /** Replay-protection window in seconds. Default 300. */\n  toleranceSeconds?: number\n  /** Override `now()` for tests. UTC seconds. */\n  now?: number\n}\n\n/** Verify a Tangle inbound-email signature against the raw request body. */\nexport function verifyEmailSignature(\n  rawBody: string,\n  signatureHeader: string,\n  timestampHeader: string,\n  secret: string,\n  options: EmailVerifyOptions = {},\n): boolean {\n  const ts = Number(timestampHeader)\n  if (!Number.isFinite(ts)) return false\n  const tolerance = options.toleranceSeconds ?? DEFAULT_SIGNATURE_TOLERANCE_SECONDS\n  const now = options.now ?? Math.floor(Date.now() / 1000)\n  if (Math.abs(now - ts) > tolerance) return false\n  const expected = createHmac('sha256', secret).update(`${ts}.${rawBody}`).digest('hex')\n  const expectedBuf = Buffer.from(expected, 'utf8')\n  const sigBuf = Buffer.from(signatureHeader.toLowerCase(), 'utf8')\n  if (sigBuf.length !== expectedBuf.length) return false\n  return timingSafeEqual(sigBuf, expectedBuf)\n}\n\n// ─── Header helper ──────────────────────────────────────────────────────\n//\n// Most fastify/express adapters expose request headers as\n// `Record<string, string | string[] | undefined>`. This helper picks the\n// first canonical value for a given name (case-insensitive).\n\nexport function firstHeader(\n  headers: Record<string, string | string[] | undefined>,\n  name: string,\n): string | undefined {\n  const v = headers[name]\n    ?? headers[name.toLowerCase()]\n    ?? Object.entries(headers).find(([key]) => key.toLowerCase() === name.toLowerCase())?.[1]\n  if (Array.isArray(v)) return v[0]\n  return typeof v === 'string' ? v : undefined\n}\n"],"mappings":";AAgBA,SAAS,YAAY,uBAAuB;AAGrC,IAAM,sCAAsC,IAAI;AAmBhD,SAAS,2BAA2B,QAAoD;AAC7F,QAAM,MAAuC,EAAE,MAAM,CAAC,EAAE;AACxD,aAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AACpC,UAAM,MAAM,KAAK,QAAQ,GAAG;AAC5B,QAAI,MAAM,EAAG;AACb,UAAM,MAAM,KAAK,MAAM,GAAG,GAAG,EAAE,KAAK;AACpC,UAAM,MAAM,KAAK,MAAM,MAAM,CAAC,EAAE,KAAK;AACrC,QAAI,QAAQ,KAAK;AACf,YAAM,IAAI,OAAO,GAAG;AACpB,UAAI,OAAO,SAAS,CAAC,EAAG,KAAI,KAAK;AAAA,IACnC,WAAW,QAAQ,MAAM;AACvB,UAAI,KAAK,KAAK,GAAG;AAAA,IACnB;AAAA,EACF;AACA,MAAI,IAAI,OAAO,UAAa,IAAI,KAAK,WAAW,EAAG,QAAO;AAC1D,SAAO,EAAE,GAAG,IAAI,IAAI,MAAM,IAAI,KAAK;AACrC;AAUO,SAAS,sBACd,SACA,iBACA,QACA,UAA+B,CAAC,GACvB;AACT,QAAM,SAAS,2BAA2B,eAAe;AACzD,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,YAAY,QAAQ,oBAAoB;AAC9C,QAAM,MAAM,QAAQ,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACvD,MAAI,KAAK,IAAI,MAAM,OAAO,CAAC,IAAI,UAAW,QAAO;AACjD,QAAM,WAAW,WAAW,UAAU,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,OAAO,EAAE,EAAE,OAAO,KAAK;AAC3F,QAAM,cAAc,OAAO,KAAK,UAAU,MAAM;AAChD,aAAW,OAAO,OAAO,MAAM;AAC7B,UAAM,SAAS,OAAO,KAAK,KAAK,MAAM;AACtC,QAAI,OAAO,WAAW,YAAY,OAAQ;AAC1C,QAAI,gBAAgB,QAAQ,WAAW,EAAG,QAAO;AAAA,EACnD;AACA,SAAO;AACT;AAgBO,SAAS,qBACd,SACA,iBACA,iBACA,QACA,UAA8B,CAAC,GACtB;AACT,MAAI,CAAC,gBAAgB,WAAW,KAAK,EAAG,QAAO;AAC/C,QAAM,KAAK,OAAO,eAAe;AACjC,MAAI,CAAC,OAAO,SAAS,EAAE,EAAG,QAAO;AACjC,QAAM,YAAY,QAAQ,oBAAoB;AAC9C,QAAM,MAAM,QAAQ,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACvD,MAAI,KAAK,IAAI,MAAM,EAAE,IAAI,UAAW,QAAO;AAC3C,QAAM,WAAW,QAAQ,WAAW,UAAU,MAAM,EAAE,OAAO,MAAM,EAAE,IAAI,OAAO,EAAE,EAAE,OAAO,KAAK;AAChG,QAAM,cAAc,OAAO,KAAK,UAAU,MAAM;AAChD,QAAM,SAAS,OAAO,KAAK,iBAAiB,MAAM;AAClD,MAAI,OAAO,WAAW,YAAY,OAAQ,QAAO;AACjD,SAAO,gBAAgB,QAAQ,WAAW;AAC5C;AAqBO,SAAS,oBACd,SACA,iBACA,QACA,UAAoC,CAAC,GAC5B;AACT,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,SAAS,QAAQ,mBAAmB;AAC1C,QAAM,QAAQ,QAAQ,gBAAgB;AACtC,MAAI,YAAY;AAChB,MAAI,QAAQ;AACV,QAAI,CAAC,UAAU,WAAW,MAAM,EAAG,QAAO;AAC1C,gBAAY,UAAU,MAAM,OAAO,MAAM;AAAA,EAC3C;AACA,MAAI,MAAO,aAAY,UAAU,YAAY;AAC7C,QAAM,WAAW,WAAW,WAAW,MAAM,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK;AAC3E,QAAM,cAAc,OAAO,KAAK,UAAU,MAAM;AAChD,QAAM,SAAS,OAAO,KAAK,WAAW,MAAM;AAC5C,MAAI,OAAO,WAAW,YAAY,OAAQ,QAAO;AACjD,SAAO,gBAAgB,QAAQ,WAAW;AAC5C;AAmCO,SAAS,sBACd,OAMA,UAA+B,CAAC,GACvB;AACT,MAAI,CAAC,MAAM,WAAW;AACpB,WAAO,QAAQ,6BAA6B;AAAA,EAC9C;AACA,QAAM,YAAY,MAAM;AACxB,MAAI,CAAC,aAAa,MAAM,QAAQ,SAAS,EAAG,QAAO;AACnD,MAAI,CAAC,MAAM,QAAS,QAAO;AAE3B,QAAM,OAAO,QAAQ,cAAc,OAC/B,MAAM,WAAW,QAAQ,WAAW,MACpC,OAAO,KAAK,MAAM,UAAU,CAAC,CAAC,EAC3B,KAAK,EACL,OAAO,CAAC,KAAK,QAAQ,MAAM,OAAO,MAAM,OAAQ,GAAG,KAAK,KAAK,MAAM,OAAO;AAEjF,QAAM,WAAW,WAAW,QAAQ,MAAM,SAAS,EAAE,OAAO,IAAI,EAAE,OAAO,QAAQ;AACjF,QAAM,cAAc,OAAO,KAAK,QAAQ;AACxC,QAAM,SAAS,OAAO,KAAK,SAAS;AACpC,MAAI,YAAY,WAAW,OAAO,OAAQ,QAAO;AACjD,SAAO,gBAAgB,aAAa,MAAM;AAC5C;AAsBO,SAAS,qBACd,SACA,iBACA,iBACA,QACA,UAA8B,CAAC,GACtB;AACT,QAAM,KAAK,OAAO,eAAe;AACjC,MAAI,CAAC,OAAO,SAAS,EAAE,EAAG,QAAO;AACjC,QAAM,YAAY,QAAQ,oBAAoB;AAC9C,QAAM,MAAM,QAAQ,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACvD,MAAI,KAAK,IAAI,MAAM,EAAE,IAAI,UAAW,QAAO;AAC3C,QAAM,WAAW,WAAW,UAAU,MAAM,EAAE,OAAO,GAAG,EAAE,IAAI,OAAO,EAAE,EAAE,OAAO,KAAK;AACrF,QAAM,cAAc,OAAO,KAAK,UAAU,MAAM;AAChD,QAAM,SAAS,OAAO,KAAK,gBAAgB,YAAY,GAAG,MAAM;AAChE,MAAI,OAAO,WAAW,YAAY,OAAQ,QAAO;AACjD,SAAO,gBAAgB,QAAQ,WAAW;AAC5C;AAQO,SAAS,YACd,SACA,MACoB;AACpB,QAAM,IAAI,QAAQ,IAAI,KACjB,QAAQ,KAAK,YAAY,CAAC,KAC1B,OAAO,QAAQ,OAAO,EAAE,KAAK,CAAC,CAAC,GAAG,MAAM,IAAI,YAAY,MAAM,KAAK,YAAY,CAAC,IAAI,CAAC;AAC1F,MAAI,MAAM,QAAQ,CAAC,EAAG,QAAO,EAAE,CAAC;AAChC,SAAO,OAAO,MAAM,WAAW,IAAI;AACrC;","names":[]}

package/dist/{chunk-G3S6OGY6.js → chunk-XECSOZRL.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-IA5GCKM6.js";
 import {
   adapters_exports
-} from "./chunk-EPDUDWOD.js";
+} from "./chunk-EV7PFUCM.js";
 
 // src/activepieces-catalog.ts
 import { readFileSync } from "fs";
@@ -4334,4 +4334,4 @@ export {
   signCapability,
   verifyCapabilityToken
 };
-//# sourceMappingURL=chunk-G3S6OGY6.js.map
+//# sourceMappingURL=chunk-XECSOZRL.js.map

package/dist/connectors/adapters/index.js

@@ -539,8 +539,8 @@ import {
   zohoDeskConnector,
   zoominfoConnector,
   zuoraConnector
-} from "../../chunk-EPDUDWOD.js";
-import "../../chunk-2TW2QKGZ.js";
+} from "../../chunk-EV7PFUCM.js";
+import "../../chunk-XC54EOUQ.js";
 import {
   DEFAULT_TANGLE_PLATFORM_URL,
   TANGLE_API_KEY_PREFIX,

package/dist/connectors/index.d.ts

@@ -177,6 +177,14 @@ declare function verifyTwilioSignature(input: {
     fullUrl: string | null | undefined;
     params: Record<string, string> | undefined;
 }, options?: TwilioVerifyOptions): boolean;
+interface EmailVerifyOptions {
+    /** Replay-protection window in seconds. Default 300. */
+    toleranceSeconds?: number;
+    /** Override `now()` for tests. UTC seconds. */
+    now?: number;
+}
+/** Verify a Tangle inbound-email signature against the raw request body. */
+declare function verifyEmailSignature(rawBody: string, signatureHeader: string, timestampHeader: string, secret: string, options?: EmailVerifyOptions): boolean;
 declare function firstHeader(headers: Record<string, string | string[] | undefined>, name: string): string | undefined;
 
-export { DEFAULT_SIGNATURE_TOLERANCE_SECONDS, type ExchangeCodeInput, type GenericHmacVerifyOptions, InMemoryOAuthFlowStore, type OAuthFlowStore, type OAuthTokens, type ParsedStripeSignatureHeader, type PendingOAuthFlow, type RefreshInput, type SlackVerifyOptions, type StartOAuthInput, type StartOAuthOutput, type StripeVerifyOptions, type TwilioVerifyOptions, _resetPendingFlowsForTests, consumePendingFlow, exchangeAuthorizationCode, firstHeader, parseStripeSignatureHeader, refreshAccessToken, startOAuthFlow, verifyHmacSignature, verifySlackSignature, verifyStripeSignature, verifyTwilioSignature };
+export { DEFAULT_SIGNATURE_TOLERANCE_SECONDS, type EmailVerifyOptions, type ExchangeCodeInput, type GenericHmacVerifyOptions, InMemoryOAuthFlowStore, type OAuthFlowStore, type OAuthTokens, type ParsedStripeSignatureHeader, type PendingOAuthFlow, type RefreshInput, type SlackVerifyOptions, type StartOAuthInput, type StartOAuthOutput, type StripeVerifyOptions, type TwilioVerifyOptions, _resetPendingFlowsForTests, consumePendingFlow, exchangeAuthorizationCode, firstHeader, parseStripeSignatureHeader, refreshAccessToken, startOAuthFlow, verifyEmailSignature, verifyHmacSignature, verifySlackSignature, verifyStripeSignature, verifyTwilioSignature };

package/dist/connectors/index.js

@@ -546,16 +546,17 @@ import {
   zohoDeskConnector,
   zoominfoConnector,
   zuoraConnector
-} from "../chunk-EPDUDWOD.js";
+} from "../chunk-EV7PFUCM.js";
 import {
   DEFAULT_SIGNATURE_TOLERANCE_SECONDS,
   firstHeader,
   parseStripeSignatureHeader,
+  verifyEmailSignature,
   verifyHmacSignature,
   verifySlackSignature,
   verifyStripeSignature,
   verifyTwilioSignature
-} from "../chunk-2TW2QKGZ.js";
+} from "../chunk-XC54EOUQ.js";
 import {
   CredentialsExpired,
   DEFAULT_TANGLE_PLATFORM_URL,
@@ -1091,6 +1092,7 @@ export {
   vapiConnector,
   vboutConnector,
   vercelConnector,
+  verifyEmailSignature,
   verifyHmacSignature,
   verifySlackSignature,
   verifyStripeSignature,

package/dist/index.d.ts

@@ -11,7 +11,7 @@ export { A as AuthSpec, b as CASStrategy, c as Capability, d as CapabilityClass,
 export { b as IntegrationErrorCode, I as IntegrationRuntimeError, a as IntegrationUserAction, N as NormalizedIntegrationError, n as normalizeIntegrationError, s as statusForCode } from './errors-Bg3_rxnQ.js';
 export { ConnectFlowOptions, FinishConnectInput, FinishConnectOutput, InMemoryConnectStateStore, StartConnectInput, StartConnectOutput, finishConnectFlow, revokeConnectFlow, startConnectFlow } from './connect/index.js';
 export { ExpressLikeRequest, ExpressLikeResponse, HonoLikeContext, RequireTangleAuthOptions, TangleAuthContext, TangleAuthOutcome, TangleAuthReason, expressTangleAuthMiddleware, extractToken, honoTangleAuthMiddleware, requireTangleAuth } from './middleware/index.js';
-export { DEFAULT_SIGNATURE_TOLERANCE_SECONDS, ExchangeCodeInput, GenericHmacVerifyOptions, InMemoryOAuthFlowStore, OAuthFlowStore, OAuthTokens, ParsedStripeSignatureHeader, PendingOAuthFlow, RefreshInput, SlackVerifyOptions, StartOAuthInput, StartOAuthOutput, StripeVerifyOptions, TwilioVerifyOptions, _resetPendingFlowsForTests, consumePendingFlow, exchangeAuthorizationCode, firstHeader, parseStripeSignatureHeader, refreshAccessToken, startOAuthFlow, verifyHmacSignature, verifySlackSignature, verifyStripeSignature, verifyTwilioSignature } from './connectors/index.js';
+export { DEFAULT_SIGNATURE_TOLERANCE_SECONDS, EmailVerifyOptions, ExchangeCodeInput, GenericHmacVerifyOptions, InMemoryOAuthFlowStore, OAuthFlowStore, OAuthTokens, ParsedStripeSignatureHeader, PendingOAuthFlow, RefreshInput, SlackVerifyOptions, StartOAuthInput, StartOAuthOutput, StripeVerifyOptions, TwilioVerifyOptions, _resetPendingFlowsForTests, consumePendingFlow, exchangeAuthorizationCode, firstHeader, parseStripeSignatureHeader, refreshAccessToken, startOAuthFlow, verifyEmailSignature, verifyHmacSignature, verifySlackSignature, verifyStripeSignature, verifyTwilioSignature } from './connectors/index.js';
 export { DocuSealOptions, EtsyOptions, GmailOptions, GoogleCalendarOptions, GoogleDocsOptions, GoogleDriveOptions, GoogleErrorClass, GoogleFormsOptions, GoogleSheetsOptions, HelloSignOptions, HubSpotOptions, MicrosoftCalendarOptions, MicrosoftGraphOptions, MicrosoftTeamsOptions, NotionOptions, OneDriveOptions, OutlookMailOptions, PandaDocOptions, RestConnectorSpec, RestCredentialPlacement, RestOperationSpec, RestRequestSpec, SharePointOptions, SlackOptions, TELEGRAM_FILE_DOWNLOAD_ROOT, TwitterOptions, WhatsappBusinessOptions, activecampaignConnector, acumbamailConnector, adobeCreativeCloudConnector, adpConnector, afforaiConnector, agentxConnector, aidbaseConnector, aipriseConnector, airOpsConnector, aircallConnector, airtableConnector, airtopConnector, alaiConnector, altTextAiConnector, alttextifyConnector, amazonBedrockConnector, amazonSecretsManagerConnector, amazonSesConnector, amazonSnsConnector, amazonSqsConnector, amazonTextractConnector, aminosConnector, ampecoConnector, amplemarketConnector, anthropicConnector, apitableConnector, apitemplateIoConnector, apolloConnector, appfollowConnector, asanaConnector, ashbyConnector, asknewsConnector, assemblyaiConnector, attioConnector, auth0Connector, autoboundConnector, autocallsConnector, avianConnector, avomaConnector, azureAdConnector, azureCommunicationServicesConnector, azureOpenaiConnector, backblazeConnector, bamboohrConnector, barcodeLookupConnector, baremetricsConnector, basecampConnector, beamerConnector, bettercontactConnector, bettermodeConnector, bexioConnector, bigcommerceConnector, biginByZohoConnector, billplzConnector, bitlyConnector, blandAiConnector, blueskyConnector, bolnaConnector, bonjoroConnector, bookedinConnector, boxConnector, braveSearchConnector, brazeConnector, brightdataConnector, brilliantDirectoriesConnector, browseAiConnector, builtwithConnector, calComConnector, calendlyConnector, campaignMonitorConnector, cannyConnector, canvaConnector, capsuleCrmConnector, captainDataConnector, cashfreePaymentsConnector, certopusConnector, chainalysisApiConnector, chargebeeConnector, chargekeepConnector, chartlyConnector, chatDataConnector, chatbaseConnector, chatlingConnector, chatnodeConnector, chatwootConnector, checkoutConnector, circleConnector, classifyGoogleError, classifyGoogleReason, clayConnector, clearoutConnector, clicdataConnector, clickupConnector, clioConnector, clockifyConnector, clockodoConnector, closeConnector, cloudconvertConnector, cloudinaryConnector, cloutlyConnector, codaConnector, cognismConnector, cognitoFormsConnector, cohereConnector, cometapiConnector, comfyicuConnector, commonRoomConnector, confluenceConnector, constantContactConnector, contactoutConnector, contentfulConnector, convertkitConnector, copperConnector, copyAiConnector, crispConnector, crustdataConnector, cryptolensConnector, customerIoConnector, customgptConnector, dashworksConnector, datadogConnector, datafuelConnector, datocmsConnector, declarativeRestConnector, deepseekConnector, demandbaseConnector, denserAiConnector, descriptConnector, devinConnector, dialpadConnector, discordConnector, dittofeedConnector, doctlyConnector, documentproConnector, documergeConnector, docuseal, docusignConnector, dropboxConnector, dubConnector, dumplingAiConnector, dustConnector, easyPeasyAiConnector, ebayConnector, edenAiConnector, elasticEmailConnector, emailitConnector, emailoctopusConnector, enrichlayerConnector, esignaturesConnector, etsyConnector, exaConnector, facebookLeadsConnector, facebookPagesConnector, factorsAiConnector, fathomAnalyticsConnector, fathomConnector, figjamConnector, figmaConnector, filloutFormsConnector, findymailConnector, firebaseConnector, fireberryConnector, firecrawlConnector, firefliesAiConnector, flipandoConnector, flowiseConnector, flowluConnector, folkConnector, foreplayCoConnector, formbricksConnector, formstackConnector, fountainConnector, fragmentConnector, frameConnector, freeAgentConnector, freshsalesConnector, freshserviceConnector, frontConnector, fullenrichConnector, gameballConnector, geminiConnector, getresponseConnector, ghostcmsConnector, gistlyConnector, giteaConnector, githubConnector, gitlabConnector, glideConnector, gmail, gongConnector, googleAnalyticsConnector, googleApiError, googleBigqueryConnector, googleCalendar, googleCloudStorageConnector, googleContactsConnector, googleDocs, googleDrive, googleErrorReason, googleForms, googleGeminiConnector, googleMeetConnector, googleMyBusinessConnector, googleSearchConnector, googleSearchConsoleConnector, googleSheets, googleSlidesConnector, googleTasksConnector, googleTestFailureReason, googleVertexaiConnector, googlechatConnector, gorgiasConnector, gotifyConnector, gptzeroDetectAiConnector, granolaConnector, greenhouseConnector, greenptConnector, greipConnector, griptapeConnector, gristConnector, guideliteConnector, gustoConnector, harvestConnector, hashiCorpVaultConnector, hastewireConnector, heartbeatConnector, hedyConnector, hellosign, helpscoutConnector, heygenConnector, heymarketSmsConnector, heyreachConnector, hightouchConnector, housecallProConnector, hubspot, huggingFaceConnector, huggingfaceConnector, humeAiConnector, hunterConnector, hystructConnector, ibmCognoseConnector, imageRouterConnector, imapConnector, influencersClubConnector, insightlyConnector, insightoAiConnector, instaChartsConnector, instantlyAiConnector, instasentConnector, intercomConnector, invoiceninjaConnector, jinaAiConnector, jiraCloudConnector, jiraDataCenterConnector, joggAiConnector, jotformConnector, justInvoiceConnector, justcallConnector, kallabotAiConnector, kapsoConnector, kimaiConnector, kissflowConnector, kizeoFormsConnector, klaviyoConnector, klentyConnector, knackConnector, knockConnector, koFiConnector, kommoConnector, kudosityConnector, kustomerConnector, lagrowthmachineConnector, leadConnectorConnector, leadfeederConnector, leadmagicConnector, leapAiConnector, leexiConnector, lemlistConnector, lemonSqueezyConnector, letsCalendarConnector, lettaConnector, leverConnector, lightfunnelsConnector, linearConnector, linkaConnector, linkupConnector, llmrailsConnector, lobstermailConnector, localaiConnector, loftyConnector, logrocketConnector, logsnagConnector, lokaliseConnector, loopsConnector, lucidyaConnector, lushaConnector, luxuryPresenceConnector, magicalApiConnector, mailchainConnector, mailchimpConnector, mailerLiteConnector, mailercheckConnector, mailerooConnector, mailgunConnector, makeConnector, manychatConnector, marketoConnector, mastodonConnector, matomoConnector, matrixConnector, mattermostConnector, mauticConnector, medullarConnector, meetgeekAiConnector, memConnector, messagebirdConnector, metabaseConnector, microsoft365PeopleConnector, microsoft365PlannerConnector, microsoftCalendar, microsoftDynamics365BusinessCentralConnector, microsoftDynamicsCrmConnector, microsoftExcel365Connector, microsoftGraph, microsoftOnenoteConnector, microsoftPowerBiConnector, microsoftTeams, microsoftTodoConnector, millionverifierConnector, mindStudioConnector, mindeeConnector, miroConnector, missiveConnector, mixmaxConnector, mixpanelConnector, modjoConnector, mollieConnector, mondayConnector, mongodbConnector, n8nConnector, netlifyConnector, niftyConnector, ninjapipeConnector, nocodbConnector, nooksConnector, notion, notionConnector, ntfyConnector, oceanIoConnector, odooConnector, omniCoConnector, omnihrConnector, oneDrive, openPhoneConnector, openRouterConnector, openaiConnector, openmicAiConnector, opnformConnector, opportifyConnector, opsgenieConnector, oracleDatabaseConnector, orimonConnector, outlookMail, outreachConnector, paddleConnector, pagerdutyConnector, pandadoc, paperformConnector, parseurConnector, pastefyConnector, paychexConnector, paywhirlConnector, pdfmonkeyConnector, peekshotConnector, perplexityAiConnector, personalAiConnector, phantombusterConnector, phonyConnector, pinchPaymentsConnector, pineconeConnector, pipedreamConnector, pipedriveConnector, placidConnector, plausibleConnector, pocketbaseConnector, pollybotAiConnector, polytomicConnector, postgresConnector, posthogConnector, postizConnector, postmarkConnector, predictLeadsConnector, productboardConnector, proxycurlConnector, pushbulletConnector, pushoverConnector, qawafelConnector, qdrantConnector, quadernoConnector, quickbooksConnector, quickzuConnector, raiaAiConnector, rapidtextAiConnector, reachinboxConnector, recallAiConnector, redditConnector, reoonVerifierConnector, replyIoConnector, retableConnector, retellAiConnector, ringcentralConnector, ripplingConnector, robollyConnector, runwareConnector, saasticConnector, saleorConnector, salesforceConnector, saleshandyConnector, salesloftConnector, sanityConnector, sardisConnector, savvycalConnector, scrapegraphaiConnector, scrapelessConnector, seamlessAiConnector, seekTableConnector, semrushConnector, sendgridConnector, sendinblueConnector, sendpulseConnector, senjaConnector, sentryConnector, serperConnector, serpstatConnector, serviceNowConnector, sharepoint, shippoConnector, shopifyConnector, shortIoConnector, signNowConnector, signrequestConnector, signwellConnector, similarwebConnector, simplirouteConnector, simplybookmeConnector, skyprepConnector, slack, slackEventsConnector, smartleadConnector, smartsheetConnector, smartsuiteConnector, smooveConnector, smsmodeConnector, snovIoConnector, snowflakeConnector, socialkitConnector, squareConnector, stripeConnector, stripePackConnector, stripeWebhookReceiverConnector, supabaseConnector, supadataConnector, swarmnodeConnector, systemeIoConnector, tableauConnector, talkableConnector, tallyConnector, teableConnector, telegramConnector, telnyxConnector, tenzoConnector, textcortexAiConnector, theirstackConnector, ticktickConnector, timeOpsConnector, timelinesAiConnector, tlDvConnector, todoistConnector, togglTrackConnector, totalcmsConnector, trelloConnector, twentyConnector, twilioConnector, twilioSmsConnector, twinLabsConnector, twitter, twitterConnector, typeformConnector, typefullyConnector, umamiConnector, upgradechatConnector, uscreenConnector, usergemsConnector, validatedmailsConnector, vapiConnector, vboutConnector, vercelConnector, videoaskConnector, vidlab7Connector, vlmRunConnector, voucheryIoConnector, vtexConnector, vtigerConnector, wafeqConnector, warmlyConnector, weaviateConnector, webflowConnector, webhookConnector, webscrapingAiConnector, whatConvertsConnector, whatsappBusiness, whatsappConnector, whatsscaleConnector, wizaConnector, wonderchatConnector, woocommerceConnector, woodpeckerConnector, wootricConnector, wordpressConnector, workableConnector, workdayConnector, wrikeConnector, writesonicBulkConnector, wufooConnector, xeroConnector, youcanbookmeConnector, youtubeDataConnector, zagomailConnector, zapierConnector, zendeskConnector, zendeskSellConnector, zenrowsConnector, zeplinConnector, zerobounceConnector, zohoBookingsConnector, zohoCrmConnector, zohoDeskConnector, zoominfoConnector, zuoraConnector } from './connectors/adapters/index.js';
 export { D as DEFAULT_TANGLE_PLATFORM_URL, d as TANGLE_API_KEY_PREFIX, e as TANGLE_SERVICE_TOKEN_PREFIX, b as TangleIdentityClient, T as TangleIdentityOptions, f as TangleIdentityUnreachableError, c as TangleTokenVerifyFailure, g as TangleTokenVerifyResult, a as TangleUserSummary, h as TangleWorkspaceSummary, i as createTangleIdentityClient, t as tangleIdentity } from './tangle-id-_uZ3ywCF.js';
 export { IntegrationCatalogView, IntegrationToolDefinition, IntegrationToolSearchFilters, IntegrationToolSearchResult, McpToolDefinition, buildIntegrationCatalogView, buildIntegrationToolCatalog, describeIntegrationTool, flattenIntegrationToolDefinition, integrationToolName, parseIntegrationToolName, searchIntegrationTools, toMcpTools } from './catalog.js';

package/dist/index.js

@@ -119,7 +119,7 @@ import {
   validateIntegrationManifest,
   validateProviderPassthroughRequest,
   verifyCapabilityToken
-} from "./chunk-G3S6OGY6.js";
+} from "./chunk-XECSOZRL.js";
 import {
   InMemoryConnectStateStore,
   finishConnectFlow,
@@ -714,16 +714,17 @@ import {
   zohoDeskConnector,
   zoominfoConnector,
   zuoraConnector
-} from "./chunk-EPDUDWOD.js";
+} from "./chunk-EV7PFUCM.js";
 import {
   DEFAULT_SIGNATURE_TOLERANCE_SECONDS,
   firstHeader,
   parseStripeSignatureHeader,
+  verifyEmailSignature,
   verifyHmacSignature,
   verifySlackSignature,
   verifyStripeSignature,
   verifyTwilioSignature
-} from "./chunk-2TW2QKGZ.js";
+} from "./chunk-XC54EOUQ.js";
 import {
   CredentialsExpired,
   DEFAULT_TANGLE_PLATFORM_URL,
@@ -1413,6 +1414,7 @@ export {
   vboutConnector,
   vercelConnector,
   verifyCapabilityToken,
+  verifyEmailSignature,
   verifyHmacSignature,
   verifySlackSignature,
   verifyStripeSignature,

package/dist/mcp.js

@@ -2,7 +2,7 @@ import {
   IntegrationError,
   createCatalogExecutorProvider,
   importMcpConnector
-} from "./chunk-G3S6OGY6.js";
+} from "./chunk-XECSOZRL.js";
 import "./chunk-S2BUASSV.js";
 import "./chunk-LA76XB7M.js";
 import "./chunk-H4XYLS7T.js";
@@ -10,8 +10,8 @@ import "./chunk-VLVSP7SP.js";
 import "./chunk-IA5GCKM6.js";
 import "./chunk-7P2LN4VT.js";
 import "./chunk-376UBTNB.js";
-import "./chunk-EPDUDWOD.js";
-import "./chunk-2TW2QKGZ.js";
+import "./chunk-EV7PFUCM.js";
+import "./chunk-XC54EOUQ.js";
 import "./chunk-UWF33ESC.js";
 import "./chunk-PZ5AY32C.js";
 

package/dist/registry.js

@@ -5,7 +5,7 @@ import {
   composeIntegrationRegistry,
   inferIntegrationSupportTier,
   summarizeIntegrationRegistry
-} from "./chunk-G3S6OGY6.js";
+} from "./chunk-XECSOZRL.js";
 import "./chunk-S2BUASSV.js";
 import "./chunk-LA76XB7M.js";
 import "./chunk-H4XYLS7T.js";
@@ -13,8 +13,8 @@ import "./chunk-VLVSP7SP.js";
 import "./chunk-IA5GCKM6.js";
 import "./chunk-7P2LN4VT.js";
 import "./chunk-376UBTNB.js";
-import "./chunk-EPDUDWOD.js";
-import "./chunk-2TW2QKGZ.js";
+import "./chunk-EV7PFUCM.js";
+import "./chunk-XC54EOUQ.js";
 import "./chunk-UWF33ESC.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/{router-S0Dadv2x.d.ts → router-ddcgTV2y.d.ts}

@@ -61,6 +61,35 @@ type SignatureVerification = {
     valid: false;
     reason: string;
 };
+/** One declared triggerable event, in the runtime `eventType` namespace a
+ *  provider's `parse` emits. */
+interface TriggerEventDescriptor {
+    /** The `eventType` a workflow `provider_event` trigger matches on
+     *  (`slack.app_mention`, `charge.succeeded`). */
+    id: string;
+    /** Short human label for authoring surfaces; optional. */
+    title?: string;
+}
+/** The set of events a provider can deliver, for author-time validation of
+ *  workflow `provider_event` triggers. Co-located with the provider's `parse`
+ *  (the source of the runtime namespace) so the two cannot drift — see the
+ *  per-provider drift tests. Consumers validate an authored event with two
+ *  checks: it must carry `namespace` (a prefix-less event on a namespaced
+ *  provider can never be delivered), and — only when `closed` — be one of
+ *  `events` (an exhaustive set makes an unlisted event an authoring error). */
+interface TriggerEventCatalog {
+    /** Required prefix every `parse`-emitted `eventType` carries (`slack.`,
+     *  `telegram.`), or `null` when the provider emits raw event names (stripe). */
+    namespace: string | null;
+    /** Declared events. Exhaustive iff `closed`; otherwise authoring hints for an
+     *  open, provider-owned vocabulary. */
+    events: readonly TriggerEventDescriptor[];
+    /** True when `events` is the COMPLETE deliverable set, so an event outside it
+     *  is rejected. False when the provider owns an open-ended vocabulary it keeps
+     *  adding to (Stripe's ~250 types, Slack's Events API) and only `namespace`
+     *  can be authoritatively enforced. */
+    closed: boolean;
+}
 /** Per-provider plug-in. Stateless — the router calls `verifySignature`
  *  then `parse` on every request. The provider's HTTP-shape concerns
  *  (e.g., raw body required) are documented per provider. */
@@ -93,6 +122,10 @@ interface WebhookProvider {
         body: string;
         headers?: Record<string, string>;
     };
+    /** Declared triggerable-event catalog, for author-time validation of workflow
+     *  `provider_event` triggers. Optional: a provider without one is left
+     *  unvalidated by consumers (the trigger still installs). */
+    eventCatalog?: TriggerEventCatalog;
 }
 interface WebhookIdempotencyStore {
     /** Returns true if this providerEventId has been processed already.
@@ -156,4 +189,4 @@ declare class WebhookRouter {
     private deliverEach;
 }
 
-export { type SignatureVerification as S, type WebhookProvider as W, type WebhookEnvelope as a, type WebhookHeaders as b, type WebhookIdempotencyStore as c, WebhookRouter as d, type WebhookRouterOptions as e, type WebhookRouterRequest as f, type WebhookRouterResponse as g };
+export { type SignatureVerification as S, type TriggerEventCatalog as T, type WebhookProvider as W, type TriggerEventDescriptor as a, type WebhookEnvelope as b, type WebhookHeaders as c, type WebhookIdempotencyStore as d, WebhookRouter as e, type WebhookRouterOptions as f, type WebhookRouterRequest as g, type WebhookRouterResponse as h };

package/dist/runtime.js

@@ -2,7 +2,7 @@ import {
   InMemoryIntegrationGrantStore,
   IntegrationRuntime,
   createIntegrationRuntime
-} from "./chunk-G3S6OGY6.js";
+} from "./chunk-XECSOZRL.js";
 import "./chunk-S2BUASSV.js";
 import "./chunk-LA76XB7M.js";
 import "./chunk-H4XYLS7T.js";
@@ -10,8 +10,8 @@ import "./chunk-VLVSP7SP.js";
 import "./chunk-IA5GCKM6.js";
 import "./chunk-7P2LN4VT.js";
 import "./chunk-376UBTNB.js";
-import "./chunk-EPDUDWOD.js";
-import "./chunk-2TW2QKGZ.js";
+import "./chunk-EV7PFUCM.js";
+import "./chunk-XC54EOUQ.js";
 import "./chunk-UWF33ESC.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/stripe/index.d.ts

@@ -1,5 +1,5 @@
 import { I as IntegrationRuntimeError, a as IntegrationUserAction } from '../errors-Bg3_rxnQ.js';
-import { a as WebhookEnvelope } from '../router-S0Dadv2x.js';
+import { b as WebhookEnvelope } from '../router-ddcgTV2y.js';
 
 /**
  * Subscription state machine.

package/dist/webhooks/index.d.ts

@@ -1,5 +1,5 @@
-import { W as WebhookProvider } from '../router-S0Dadv2x.js';
-export { S as SignatureVerification, a as WebhookEnvelope, b as WebhookHeaders, c as WebhookIdempotencyStore, d as WebhookRouter, e as WebhookRouterOptions, f as WebhookRouterRequest, g as WebhookRouterResponse } from '../router-S0Dadv2x.js';
+import { W as WebhookProvider } from '../router-ddcgTV2y.js';
+export { S as SignatureVerification, T as TriggerEventCatalog, a as TriggerEventDescriptor, b as WebhookEnvelope, c as WebhookHeaders, d as WebhookIdempotencyStore, e as WebhookRouter, f as WebhookRouterOptions, g as WebhookRouterRequest, h as WebhookRouterResponse } from '../router-ddcgTV2y.js';
 
 /**
  * Pre-built `WebhookProvider` implementations for the inbound surfaces
@@ -21,6 +21,39 @@ declare const stripeWebhookProvider: WebhookProvider;
 declare const slackWebhookProvider: WebhookProvider;
 /** DocuSeal webhook provider. Signature header `X-Docuseal-Signature`. */
 declare const docusealWebhookProvider: WebhookProvider;
+/** The normalized inbound-email payload the Tangle email edge posts and this
+ *  provider surfaces on `WebhookEnvelope.payload`. `to` is the owner-resolution
+ *  key — the platform matches it to a connection's provisioned inbound address;
+ *  `messageId` is the idempotency key. */
+interface InboundEmailPayload {
+    /** RFC5322 Message-ID. */
+    messageId?: string;
+    /** Envelope sender — the firm/customer that emailed in. */
+    from: string;
+    /** The provisioned inbound address the message was delivered to (owner key). */
+    to: string;
+    subject?: string;
+    text?: string;
+    html?: string;
+    /** Selected headers the edge forwards (Reply-To, In-Reply-To, References…). */
+    headers?: Record<string, string>;
+    attachments?: Array<{
+        filename?: string;
+        contentType?: string;
+        /** Bytes as base64, OR a `url`/path the edge staged them at (large files). */
+        contentBase64?: string;
+        url?: string;
+        size?: number;
+    }>;
+    /** Epoch ms the edge received the message. */
+    receivedAt?: number;
+}
+/** Tangle inbound-email provider. Our own Cloudflare Email Routing worker parses
+ *  the MIME, JSON-serializes it, timestamped-HMAC signs it with the
+ *  per-connection secret, and POSTs it here — there is no upstream mail-vendor
+ *  signature, we are both signer and verifier. One inbound message → one
+ *  `email.received` envelope; `payload.to` carries the owner-resolution address. */
+declare const emailWebhookProvider: WebhookProvider;
 /** Gmail push provider. Cloud Pub/Sub posts a JWT-signed envelope; the
  *  *payload* is base64 JSON describing the changed history range. The
  *  signature scheme here is the Pub/Sub JWT auth header — when supplied,
@@ -66,4 +99,4 @@ declare function genericHmacWebhookProvider(options: {
     parse?: WebhookProvider['parse'];
 }): WebhookProvider;
 
-export { WebhookProvider, clayWebhookProvider, docusealWebhookProvider, gdriveWebhookProvider, genericHmacWebhookProvider, gmailWebhookProvider, hellosignWebhookProvider, slackWebhookProvider, stripeWebhookProvider, telegramWebhookProvider };
+export { type InboundEmailPayload, WebhookProvider, clayWebhookProvider, docusealWebhookProvider, emailWebhookProvider, gdriveWebhookProvider, genericHmacWebhookProvider, gmailWebhookProvider, hellosignWebhookProvider, slackWebhookProvider, stripeWebhookProvider, telegramWebhookProvider };

package/dist/webhooks/index.js

@@ -1,9 +1,10 @@
 import {
   firstHeader,
+  verifyEmailSignature,
   verifyHmacSignature,
   verifySlackSignature,
   verifyStripeSignature
-} from "../chunk-2TW2QKGZ.js";
+} from "../chunk-XC54EOUQ.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/webhooks/router.ts
@@ -117,6 +118,26 @@ var stripeWebhookProvider = {
         headers: normalizeHeaders(headers)
       }
     ];
+  },
+  eventCatalog: {
+    // Stripe emits the raw event `type` (`charge.succeeded`) — no namespace, and
+    // an OPEN, versioned vocabulary (~250 types), so these are authoring hints,
+    // not a gate.
+    namespace: null,
+    closed: false,
+    events: [
+      { id: "checkout.session.completed" },
+      { id: "checkout.session.expired" },
+      { id: "customer.subscription.created" },
+      { id: "customer.subscription.updated" },
+      { id: "customer.subscription.deleted" },
+      { id: "invoice.paid" },
+      { id: "invoice.payment_failed" },
+      { id: "payment_intent.succeeded" },
+      { id: "payment_intent.payment_failed" },
+      { id: "charge.succeeded" },
+      { id: "charge.refunded" }
+    ]
   }
 };
 var slackWebhookProvider = {
@@ -148,6 +169,26 @@ var slackWebhookProvider = {
       payload: evt,
       headers: normalizeHeaders(headers)
     }];
+  },
+  eventCatalog: {
+    // Slack namespaces every event `slack.<events-api-type>`, so a prefix-less
+    // event is provably dead. The Events API vocabulary is open (Slack adds
+    // types), so `events` are hints, not a gate. `slack.url_verification` (the
+    // config handshake) is intentionally excluded — it carries no workflow
+    // meaning and is answered before dispatch.
+    namespace: "slack.",
+    closed: false,
+    events: [
+      { id: "slack.message" },
+      { id: "slack.app_mention" },
+      { id: "slack.reaction_added" },
+      { id: "slack.reaction_removed" },
+      { id: "slack.channel_created" },
+      { id: "slack.member_joined_channel" },
+      { id: "slack.team_join" },
+      { id: "slack.app_home_opened" },
+      { id: "slack.file_shared" }
+    ]
   }
 };
 var docusealWebhookProvider = {
@@ -172,6 +213,52 @@ var docusealWebhookProvider = {
       payload: evt,
       headers: normalizeHeaders(headers)
     }];
+  },
+  eventCatalog: {
+    // DocuSeal namespaces every event `docuseal.<event_type>`. The documented
+    // set is small but not derivable from `parse`, so it stays open (namespace
+    // is the authoritative gate) with the documented types as hints.
+    namespace: "docuseal.",
+    closed: false,
+    events: [
+      { id: "docuseal.form.viewed" },
+      { id: "docuseal.form.started" },
+      { id: "docuseal.form.completed" },
+      { id: "docuseal.form.declined" },
+      { id: "docuseal.submission.created" },
+      { id: "docuseal.submission.completed" },
+      { id: "docuseal.submission.expired" },
+      { id: "docuseal.submission.archived" }
+    ]
+  }
+};
+var emailWebhookProvider = {
+  id: "email",
+  verifySignature({ rawBody, headers, secret }) {
+    const sig = firstHeader(headers, "x-tangle-email-signature");
+    if (!sig) return { valid: false, reason: "missing_email_signature" };
+    const ts = firstHeader(headers, "x-tangle-email-timestamp");
+    if (!ts) return { valid: false, reason: "missing_email_timestamp" };
+    return verifyEmailSignature(rawBody, sig, ts, secret) ? { valid: true } : { valid: false, reason: "invalid_signature" };
+  },
+  parse({ rawBody, headers, now }) {
+    const msg = safeJson(rawBody);
+    if (!msg || typeof msg !== "object") return [];
+    if (typeof msg.from !== "string" || typeof msg.to !== "string") return [];
+    return [{
+      provider: "email",
+      eventType: "email.received",
+      providerEventId: typeof msg.messageId === "string" ? msg.messageId : void 0,
+      receivedAt: now ?? Date.now(),
+      payload: msg,
+      headers: normalizeHeaders(headers)
+    }];
+  },
+  eventCatalog: {
+    // We own the edge, so the inbound surface is exactly one closed event.
+    namespace: "email.",
+    closed: true,
+    events: [{ id: "email.received" }]
   }
 };
 var gmailWebhookProvider = {
@@ -288,6 +375,15 @@ var telegramWebhookProvider = {
       payload: evt,
       headers: normalizeHeaders(headers)
     }];
+  },
+  eventCatalog: {
+    // Derived from the SAME TELEGRAM_UPDATE_KEYS `parse` matches on, so the
+    // catalog is exhaustive and cannot drift — hence `closed`. (`telegram.unknown`,
+    // parse's fallback for an update with no recognized key, is intentionally
+    // excluded: it is not a triggerable event.)
+    namespace: "telegram.",
+    closed: true,
+    events: TELEGRAM_UPDATE_KEYS.map((k) => ({ id: `telegram.${k}` }))
   }
 };
 var hellosignWebhookProvider = {
@@ -325,6 +421,24 @@ var hellosignWebhookProvider = {
       payload: body,
       headers: normalizeHeaders(headers)
     }];
+  },
+  eventCatalog: {
+    // Dropbox Sign namespaces every event `hellosign.<event_type>`. Documented
+    // set as hints; namespace is the authoritative gate. `callback_test` (the
+    // app-config ping) is intentionally excluded — it is not a workflow event.
+    namespace: "hellosign.",
+    closed: false,
+    events: [
+      { id: "hellosign.signature_request_sent" },
+      { id: "hellosign.signature_request_viewed" },
+      { id: "hellosign.signature_request_signed" },
+      { id: "hellosign.signature_request_all_signed" },
+      { id: "hellosign.signature_request_declined" },
+      { id: "hellosign.signature_request_reassigned" },
+      { id: "hellosign.signature_request_remind" },
+      { id: "hellosign.signature_request_canceled" },
+      { id: "hellosign.signature_request_expired" }
+    ]
   }
 };
 var CLAY_EVENT_ID_KEYS = ["id", "rowId", "recordId", "clayRowId", "eventId"];
@@ -432,6 +546,7 @@ export {
   WebhookRouter,
   clayWebhookProvider,
   docusealWebhookProvider,
+  emailWebhookProvider,
   gdriveWebhookProvider,
   genericHmacWebhookProvider,
   gmailWebhookProvider,

package/dist/webhooks/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/webhooks/router.ts","../../src/webhooks/providers.ts"],"sourcesContent":["/**\n * @stable Provider-agnostic inbound webhook router.\n *\n * Consumer hooks a single HTTP handler at `/webhook/:provider/:event`\n * (or whatever pathing they prefer) and forwards the request through\n * `WebhookRouter.handle()`. The router:\n *\n *   1. Resolves the registered provider entry.\n *   2. Calls the provider's `verifySignature(rawBody, headers, secrets)`.\n *      Failure → 401 fast, no downstream work.\n *   3. Calls the provider's `parse(rawBody, headers)` to extract zero or\n *      more normalized events.\n *   4. Enqueues each event for async processing via the consumer-supplied\n *      `deliver(event)` callback (best-effort fire-and-forget — the\n *      router does NOT block the HTTP response on the consumer's work).\n *   5. Returns 200 fast with `{received: events.length}`.\n *\n * Replay protection: providers that sign timestamps (Stripe, Slack)\n * already reject stale signatures inside `verifySignature`. For providers\n * that don't (DocuSeal, GDrive push), the router exposes a pluggable\n * `idempotency` hook: if `idempotency.seen(providerEventId)` returns\n * true, the router 200s without invoking `deliver()`. Consumers wire\n * this to a durable kv (D1 / Redis / Postgres unique-index).\n *\n * Why a router and not a per-provider express app: the runtime contract\n * a product cares about is \"an inbound event came in, here's the\n * normalized envelope\". Verification, parsing, and idempotency-dedup\n * are mechanical and provider-specific — the router owns them. The\n * consumer's `deliver()` is the only place product logic runs.\n *\n * Stability: `@stable` — additions to `WebhookEnvelope` must be\n * additive; the router's HTTP contract (paths, status codes) is frozen\n * at 200 (ok), 400 (bad request), 401 (bad signature), 404 (unknown\n * provider), 405 (provider has no inbound surface).\n */\n\nexport interface WebhookHeaders {\n  [name: string]: string | string[] | undefined\n}\n\n/** Normalized inbound event the router emits after parsing. */\nexport interface WebhookEnvelope<TPayload = unknown> {\n  /** Provider id (matches the `:provider` path segment). */\n  provider: string\n  /** Optional event class — e.g., 'customer.subscription.deleted'. The\n   *  provider's parser decides. Used for routing inside `deliver()`. */\n  eventType: string\n  /** Provider-emitted event id, when present. Used for the idempotency\n   *  short-circuit. */\n  providerEventId?: string\n  /** Wall-clock receive time. */\n  receivedAt: number\n  /** Provider payload, normalized to the provider's documented event\n   *  shape. The router does NOT reshape this — `parse()` is the contract. */\n  payload: TPayload\n  /** Headers passed through for downstream handlers that want them\n   *  (e.g., to extract custom routing metadata). Always lowercased keys. */\n  headers: Record<string, string>\n}\n\nexport type SignatureVerification =\n  | { valid: true }\n  | { valid: false; reason: string }\n\n/** Per-provider plug-in. Stateless — the router calls `verifySignature`\n *  then `parse` on every request. The provider's HTTP-shape concerns\n *  (e.g., raw body required) are documented per provider. */\nexport interface WebhookProvider {\n  /** Stable provider id (`stripe`, `docuseal`, `gdrive`, ...). */\n  id: string\n  /** Verify the inbound signature. Receives the EXACT raw body string —\n   *  consumers MUST preserve raw bytes through their HTTP server (do not\n   *  parse JSON before forwarding here). */\n  verifySignature(input: {\n    rawBody: string\n    headers: WebhookHeaders\n    secret: string\n  }): SignatureVerification\n  /** Parse the validated raw body into zero or more normalized events.\n   *  A single push payload may carry multiple events (e.g., Slack bulk\n   *  delivery). Return [] to ack the push as a no-op. */\n  parse(input: {\n    rawBody: string\n    headers: WebhookHeaders\n    now?: number\n  }): WebhookEnvelope[] | Promise<WebhookEnvelope[]>\n  /** Optional provider-specific 200 ACK the router returns on a verified\n   *  delivery, in place of the default `{ received, total }` JSON. Dropbox Sign\n   *  acknowledges a delivery only when the body is exactly\n   *  'Hello API Event Received' and retries otherwise; this lets such a\n   *  provider declare the body/headers it needs. The frozen status contract is\n   *  unchanged — only the 200 body/headers are customized. */\n  successResponse?: { body: string; headers?: Record<string, string> }\n}\n\nexport interface WebhookIdempotencyStore {\n  /** Returns true if this providerEventId has been processed already.\n   *  Implementations should be O(1) (Redis SETNX, D1 UNIQUE constraint). */\n  seen(providerEventId: string): Promise<boolean> | boolean\n  /** Marks a providerEventId as processed. Called AFTER `deliver()` has\n   *  been invoked. */\n  remember(providerEventId: string, ttlMs: number): Promise<void> | void\n}\n\nexport interface WebhookRouterOptions {\n  /** Provider registry. Pass any number of providers; routing is by id. */\n  providers: WebhookProvider[]\n  /** Async callback invoked with every accepted event. Fire-and-forget\n   *  from the router's perspective — the HTTP response is sent before\n   *  this resolves. Throws are caught and reported via `onError`. */\n  deliver(event: WebhookEnvelope): Promise<void> | void\n  /** Resolve the signing secret for a provider id at request time. The\n   *  router never holds secrets — the consumer's vault resolves them. */\n  resolveSecret(providerId: string, headers: WebhookHeaders): Promise<string | null> | string | null\n  /** Optional idempotency-dedup hook. Required for providers that don't\n   *  sign timestamps in their signature scheme (DocuSeal, Drive push). */\n  idempotency?: WebhookIdempotencyStore\n  /** TTL on idempotency entries. Default 7 days — long enough that a\n   *  provider's normal retry-window can't re-deliver. */\n  idempotencyTtlMs?: number\n  /** Surface delivery errors. Default: console.error. */\n  onError?(err: unknown, context: { provider: string; eventType?: string; providerEventId?: string }): void\n  /** Override `now()` for tests. */\n  now?(): number\n}\n\nexport interface WebhookRouterRequest {\n  providerId: string\n  rawBody: string\n  headers: WebhookHeaders\n}\n\nexport interface WebhookRouterResponse {\n  status: number\n  body: unknown\n  headers?: Record<string, string>\n}\n\n/**\n * Router instance. Stateless aside from the provider registry — safe to\n * share across requests; build once per process.\n */\nexport class WebhookRouter {\n  private readonly providers: Map<string, WebhookProvider>\n  private readonly deliver: WebhookRouterOptions['deliver']\n  private readonly resolveSecret: WebhookRouterOptions['resolveSecret']\n  private readonly idempotency?: WebhookIdempotencyStore\n  private readonly idempotencyTtlMs: number\n  private readonly onError: NonNullable<WebhookRouterOptions['onError']>\n  private readonly nowFn: () => number\n\n  constructor(opts: WebhookRouterOptions) {\n    this.providers = new Map(opts.providers.map((p) => [p.id, p]))\n    this.deliver = opts.deliver\n    this.resolveSecret = opts.resolveSecret\n    this.idempotency = opts.idempotency\n    this.idempotencyTtlMs = opts.idempotencyTtlMs ?? 7 * 24 * 60 * 60 * 1000\n    this.onError = opts.onError ?? defaultOnError\n    this.nowFn = opts.now ?? Date.now\n  }\n\n  /** Process one inbound webhook request. Pure with respect to side-\n   *  effects on the router instance — safe to call concurrently. */\n  async handle(request: WebhookRouterRequest): Promise<WebhookRouterResponse> {\n    const provider = this.providers.get(request.providerId)\n    if (!provider) {\n      return { status: 404, body: { error: 'unknown_provider', provider: request.providerId } }\n    }\n    const secret = await this.resolveSecret(provider.id, request.headers)\n    if (!secret) {\n      return { status: 401, body: { error: 'missing_secret', provider: provider.id } }\n    }\n    const verification = provider.verifySignature({\n      rawBody: request.rawBody,\n      headers: request.headers,\n      secret,\n    })\n    if (!verification.valid) {\n      return { status: 401, body: { error: 'invalid_signature', reason: verification.reason } }\n    }\n\n    let events: WebhookEnvelope[]\n    try {\n      events = await provider.parse({ rawBody: request.rawBody, headers: request.headers, now: this.nowFn() })\n    } catch (err) {\n      this.onError(err, { provider: provider.id })\n      return { status: 400, body: { error: 'parse_error', message: errMessage(err) } }\n    }\n\n    const accepted: WebhookEnvelope[] = []\n    for (const event of events) {\n      if (event.providerEventId && this.idempotency) {\n        const already = await this.idempotency.seen(event.providerEventId)\n        if (already) continue\n      }\n      accepted.push(event)\n    }\n\n    // Deliver async — do NOT block the HTTP response. Errors land in\n    // `onError`; the provider already got its 200 by then so it will\n    // not retry.\n    queueMicrotask(() => {\n      void this.deliverEach(accepted)\n    })\n\n    if (provider.successResponse) {\n      return {\n        status: 200,\n        body: provider.successResponse.body,\n        headers: provider.successResponse.headers,\n      }\n    }\n    return { status: 200, body: { received: accepted.length, total: events.length } }\n  }\n\n  private async deliverEach(events: WebhookEnvelope[]): Promise<void> {\n    for (const event of events) {\n      try {\n        await this.deliver(event)\n        if (event.providerEventId && this.idempotency) {\n          await this.idempotency.remember(event.providerEventId, this.idempotencyTtlMs)\n        }\n      } catch (err) {\n        this.onError(err, {\n          provider: event.provider,\n          eventType: event.eventType,\n          providerEventId: event.providerEventId,\n        })\n      }\n    }\n  }\n}\n\nfunction defaultOnError(err: unknown, context: { provider: string; eventType?: string; providerEventId?: string }): void {\n  // eslint-disable-next-line no-console\n  console.error('[WebhookRouter]', context, err)\n}\n\nfunction errMessage(err: unknown): string {\n  return err instanceof Error ? err.message : String(err)\n}\n","/**\n * Pre-built `WebhookProvider` implementations for the inbound surfaces\n * the substrate ships first-party verifiers for.\n *\n * Each provider implementation is intentionally thin: it delegates\n * signature verification to the corresponding pure function in\n * `connectors/webhooks.ts` and parses the body into one or more\n * normalized `WebhookEnvelope` rows. Anything provider-specific that\n * doesn't fit cleanly (Slack URL-verification handshake, etc.) is\n * surfaced via the envelope `eventType` so the consumer's `deliver()`\n * can branch.\n */\n\nimport {\n  firstHeader,\n  verifyHmacSignature,\n  verifySlackSignature,\n  verifyStripeSignature,\n} from '../connectors/webhooks.js'\nimport type { WebhookEnvelope, WebhookHeaders, WebhookProvider, SignatureVerification } from './router.js'\nimport { createHash, createHmac, timingSafeEqual } from 'node:crypto'\n\n/** Stripe webhook provider. Signature header `Stripe-Signature`. */\nexport const stripeWebhookProvider: WebhookProvider = {\n  id: 'stripe',\n  verifySignature({ rawBody, headers, secret }): SignatureVerification {\n    const sig = firstHeader(headers, 'stripe-signature')\n    if (!sig) return { valid: false, reason: 'missing_stripe_signature' }\n    return verifyStripeSignature(rawBody, sig, secret)\n      ? { valid: true }\n      : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const evt = safeJson(rawBody)\n    if (!evt || typeof evt !== 'object') return []\n    const e = evt as { id?: unknown; type?: unknown }\n    return [\n      {\n        provider: 'stripe',\n        eventType: typeof e.type === 'string' ? e.type : 'stripe.unknown',\n        providerEventId: typeof e.id === 'string' ? e.id : undefined,\n        receivedAt: now ?? Date.now(),\n        payload: evt,\n        headers: normalizeHeaders(headers),\n      },\n    ]\n  },\n}\n\n/** Slack Events API provider. Handles the `url_verification` handshake\n *  by emitting a synthetic event the consumer's `deliver()` can echo. */\nexport const slackWebhookProvider: WebhookProvider = {\n  id: 'slack',\n  verifySignature({ rawBody, headers, secret }): SignatureVerification {\n    const sig = firstHeader(headers, 'x-slack-signature')\n    const ts = firstHeader(headers, 'x-slack-request-timestamp')\n    if (!sig || !ts) return { valid: false, reason: 'missing_slack_signature_or_timestamp' }\n    return verifySlackSignature(rawBody, sig, ts, secret)\n      ? { valid: true }\n      : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const evt = safeJson(rawBody) as { type?: string; event_id?: string; event?: { type?: string } } | null\n    if (!evt || typeof evt !== 'object') return []\n    if (evt.type === 'url_verification') {\n      return [{\n        provider: 'slack',\n        eventType: 'slack.url_verification',\n        receivedAt: now ?? Date.now(),\n        payload: evt,\n        headers: normalizeHeaders(headers),\n      }]\n    }\n    const eventType = `slack.${evt.event?.type ?? evt.type ?? 'unknown'}`\n    return [{\n      provider: 'slack',\n      eventType,\n      providerEventId: typeof evt.event_id === 'string' ? evt.event_id : undefined,\n      receivedAt: now ?? Date.now(),\n      payload: evt,\n      headers: normalizeHeaders(headers),\n    }]\n  },\n}\n\n/** DocuSeal webhook provider. Signature header `X-Docuseal-Signature`. */\nexport const docusealWebhookProvider: WebhookProvider = {\n  id: 'docuseal',\n  verifySignature({ rawBody, headers, secret }): SignatureVerification {\n    const sig = firstHeader(headers, 'x-docuseal-signature')\n    if (!sig) return { valid: false, reason: 'missing_docuseal_signature' }\n    const expected = createHmac('sha256', secret).update(rawBody).digest('hex')\n    const a = Buffer.from(sig.toLowerCase(), 'utf-8')\n    const b = Buffer.from(expected, 'utf-8')\n    if (a.length !== b.length) return { valid: false, reason: 'invalid_signature' }\n    return timingSafeEqual(a, b) ? { valid: true } : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const evt = safeJson(rawBody) as { event_type?: string; event_id?: string } | null\n    if (!evt || typeof evt !== 'object') return []\n    return [{\n      provider: 'docuseal',\n      eventType: `docuseal.${evt.event_type ?? 'unknown'}`,\n      providerEventId: typeof evt.event_id === 'string' ? evt.event_id : undefined,\n      receivedAt: now ?? Date.now(),\n      payload: evt,\n      headers: normalizeHeaders(headers),\n    }]\n  },\n}\n\n/** Gmail push provider. Cloud Pub/Sub posts a JWT-signed envelope; the\n *  *payload* is base64 JSON describing the changed history range. The\n *  signature scheme here is the Pub/Sub JWT auth header — when supplied,\n *  consumers SHOULD verify the JWT against Google's well-known\n *  certificates. We accept the simpler \"Bearer <pubsub-shared-secret>\"\n *  variant by default (matching `verifyHmacSignature`). */\nexport const gmailWebhookProvider: WebhookProvider = {\n  id: 'gmail',\n  verifySignature({ headers, secret }): SignatureVerification {\n    const auth = firstHeader(headers, 'authorization')\n    if (!auth) return { valid: false, reason: 'missing_authorization' }\n    // Accept either \"Bearer <secret>\" or \"Token <secret>\" formats. This\n    // is the simple per-tenant shared-secret path; JWT verification is\n    // left to the consumer's `deliver()` when they need full Google JWT\n    // chain validation.\n    const m = /^(?:Bearer|Token)\\s+(.+)$/i.exec(auth)\n    if (!m) return { valid: false, reason: 'invalid_authorization_format' }\n    const a = Buffer.from(m[1]!, 'utf-8')\n    const b = Buffer.from(secret, 'utf-8')\n    if (a.length !== b.length) return { valid: false, reason: 'invalid_signature' }\n    return timingSafeEqual(a, b) ? { valid: true } : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const envelope = safeJson(rawBody) as { message?: { data?: string; messageId?: string; publishTime?: string } } | null\n    if (!envelope?.message?.data) return []\n    let payload: unknown\n    try {\n      payload = JSON.parse(Buffer.from(envelope.message.data, 'base64').toString('utf-8'))\n    } catch {\n      return []\n    }\n    const inner = payload as { historyId?: number | string; emailAddress?: string }\n    return [{\n      provider: 'gmail',\n      eventType: 'gmail.history_changed',\n      providerEventId: envelope.message.messageId,\n      receivedAt: now ?? Date.now(),\n      payload: { ...inner, publishTime: envelope.message.publishTime },\n      headers: normalizeHeaders(headers),\n    }]\n  },\n}\n\n/** Google Drive push provider. Drive does NOT sign the body — it uses\n *  the per-channel token (`X-Goog-Channel-Token`) as the shared secret.\n *  The router compares it constant-time against the resolved secret. */\nexport const gdriveWebhookProvider: WebhookProvider = {\n  id: 'gdrive',\n  verifySignature({ headers, secret }): SignatureVerification {\n    const token = firstHeader(headers, 'x-goog-channel-token')\n    if (!token) return { valid: false, reason: 'missing_channel_token' }\n    const a = Buffer.from(token, 'utf-8')\n    const b = Buffer.from(secret, 'utf-8')\n    if (a.length !== b.length) return { valid: false, reason: 'invalid_signature' }\n    return timingSafeEqual(a, b) ? { valid: true } : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ headers, now }): WebhookEnvelope[] {\n    const resourceId = firstHeader(headers, 'x-goog-resource-id')\n    const resourceState = firstHeader(headers, 'x-goog-resource-state') ?? 'unknown'\n    const channelId = firstHeader(headers, 'x-goog-channel-id')\n    const messageNumber = firstHeader(headers, 'x-goog-message-number')\n    if (resourceState === 'sync') {\n      return [{\n        provider: 'gdrive',\n        eventType: 'gdrive.channel.sync',\n        providerEventId: messageNumber ? `${channelId}-${messageNumber}` : undefined,\n        receivedAt: now ?? Date.now(),\n        payload: { channelId, resourceId, resourceState },\n        headers: normalizeHeaders(headers),\n      }]\n    }\n    return [{\n      provider: 'gdrive',\n      eventType: `gdrive.resource.${resourceState}`,\n      providerEventId: messageNumber ? `${channelId}-${messageNumber}` : undefined,\n      receivedAt: now ?? Date.now(),\n      payload: { channelId, resourceId, resourceState },\n      headers: normalizeHeaders(headers),\n    }]\n  },\n}\n\n/** The Telegram update keys, in resolution order — the first present key names\n *  the update kind (`telegram.message`, `telegram.callback_query`, …). */\nconst TELEGRAM_UPDATE_KEYS = [\n  'message',\n  'edited_message',\n  'channel_post',\n  'edited_channel_post',\n  'business_connection',\n  'business_message',\n  'edited_business_message',\n  'deleted_business_messages',\n  'message_reaction',\n  'message_reaction_count',\n  'inline_query',\n  'chosen_inline_result',\n  'callback_query',\n  'shipping_query',\n  'pre_checkout_query',\n  'purchased_paid_media',\n  'poll',\n  'poll_answer',\n  'my_chat_member',\n  'chat_member',\n  'chat_join_request',\n  'chat_boost',\n  'removed_chat_boost',\n] as const\n\n/** Telegram Bot API webhook provider. Telegram does NOT sign the body — it\n *  authenticates by echoing the `secret_token` set at `setWebhook` time in the\n *  `X-Telegram-Bot-Api-Secret-Token` header. We compare it constant-time to the\n *  per-connection secret. `update_id` is the idempotency anchor. */\nexport const telegramWebhookProvider: WebhookProvider = {\n  id: 'telegram',\n  verifySignature({ headers, secret }): SignatureVerification {\n    const token = firstHeader(headers, 'x-telegram-bot-api-secret-token')\n    if (!token) return { valid: false, reason: 'missing_telegram_secret_token' }\n    const a = Buffer.from(token, 'utf-8')\n    const b = Buffer.from(secret, 'utf-8')\n    if (a.length !== b.length) return { valid: false, reason: 'invalid_secret_token' }\n    return timingSafeEqual(a, b) ? { valid: true } : { valid: false, reason: 'invalid_secret_token' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const evt = safeJson(rawBody) as ({ update_id?: number } & Record<string, unknown>) | null\n    if (!evt || typeof evt !== 'object') return []\n    const kind = TELEGRAM_UPDATE_KEYS.find((k) => k in evt) ?? 'unknown'\n    return [{\n      provider: 'telegram',\n      eventType: `telegram.${kind}`,\n      providerEventId: typeof evt.update_id === 'number' ? String(evt.update_id) : undefined,\n      receivedAt: now ?? Date.now(),\n      payload: evt,\n      headers: normalizeHeaders(headers),\n    }]\n  },\n}\n\n/** Dropbox Sign (HelloSign) webhook provider. There is NO signature header:\n *  the body carries `event.event_hash = HMAC_SHA256(apiKey, event_time +\n *  event_type)` (hex), so the `secret` here is the account's API key (the\n *  caller resolves it from the connection credential). The body is JSON, or a\n *  `json=`/multipart `name=\"json\"` form field on older apps. */\nexport const hellosignWebhookProvider: WebhookProvider = {\n  id: 'hellosign',\n  // Dropbox Sign acknowledges a delivery only when the response body is exactly\n  // 'Hello API Event Received'; any other body makes it retry the event.\n  successResponse: { body: 'Hello API Event Received', headers: { 'content-type': 'text/plain' } },\n  verifySignature({ rawBody, secret }): SignatureVerification {\n    const body = parseHelloSignBody(rawBody)\n    const event = body?.event\n    if (\n      !event ||\n      typeof event.event_time !== 'string' ||\n      typeof event.event_type !== 'string' ||\n      typeof event.event_hash !== 'string'\n    ) {\n      return { valid: false, reason: 'missing_event_fields' }\n    }\n    const expected = createHmac('sha256', secret)\n      .update(`${event.event_time}${event.event_type}`)\n      .digest('hex')\n    const a = Buffer.from(event.event_hash.toLowerCase(), 'utf-8')\n    const b = Buffer.from(expected.toLowerCase(), 'utf-8')\n    if (a.length !== b.length) return { valid: false, reason: 'invalid_signature' }\n    return timingSafeEqual(a, b) ? { valid: true } : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const body = parseHelloSignBody(rawBody)\n    const event = body?.event\n    if (!event) return []\n    return [{\n      provider: 'hellosign',\n      eventType: `hellosign.${event.event_type ?? 'unknown'}`,\n      // Prefer Dropbox Sign's canonical `event.event_id` (stable across\n      // redeliveries, correlates with the provider). Fall back to a digest of\n      // the parsed body when it's absent: `event_hash` = HMAC(apiKey,\n      // event_time + event_type), so two distinct same-type events in the same\n      // second share it — the body digest stays distinct across differing\n      // events and identical across redeliveries of one event.\n      providerEventId:\n        typeof event.event_id === 'string' && event.event_id.length > 0\n          ? event.event_id\n          : createHash('sha256').update(JSON.stringify(body)).digest('hex'),\n      receivedAt: now ?? Date.now(),\n      payload: body,\n      headers: normalizeHeaders(headers),\n    }]\n  },\n}\n\n/** Keys Clay HTTP-API-action payloads commonly carry that can anchor\n *  idempotency, in resolution order. Clay bodies are operator-defined, so we\n *  fall back to a digest of the raw body when none is present. */\nconst CLAY_EVENT_ID_KEYS = ['id', 'rowId', 'recordId', 'clayRowId', 'eventId'] as const\n\n/** Clay webhook provider — receives rows Clay delivers via its outbound \"HTTP\n *  API\" action. Clay does NOT sign its requests and adds no proprietary\n *  headers (the `x-clay-signature: sha256=...` header seen in some third-party\n *  code is unverified inference, not in Clay's docs). Authentication is\n *  therefore a pre-shared secret the operator adds as a header on the Clay\n *  action; we compare it constant-time against the per-connection secret.\n *  Header: `x-clay-webhook-secret`. The body is whatever columns the operator\n *  mapped (free-form JSON with no canonical event id), so idempotency anchors\n *  on a common id field when present, else a sha256 of the raw body. */\nexport const clayWebhookProvider: WebhookProvider = {\n  id: 'clay',\n  verifySignature({ headers, secret }): SignatureVerification {\n    const token = firstHeader(headers, 'x-clay-webhook-secret')\n    if (!token) return { valid: false, reason: 'missing_clay_webhook_secret' }\n    const a = Buffer.from(token, 'utf-8')\n    const b = Buffer.from(secret, 'utf-8')\n    if (a.length !== b.length) return { valid: false, reason: 'invalid_signature' }\n    return timingSafeEqual(a, b) ? { valid: true } : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const evt = safeJson(rawBody)\n    if (!evt || typeof evt !== 'object') return []\n    const record = evt as Record<string, unknown>\n    const idKey = CLAY_EVENT_ID_KEYS.find(\n      (k) => typeof record[k] === 'string' || typeof record[k] === 'number',\n    )\n    const providerEventId = idKey\n      ? String(record[idKey])\n      : createHash('sha256').update(rawBody).digest('hex')\n    const eventType =\n      typeof record.event === 'string'\n        ? `clay.${record.event}`\n        : typeof record.type === 'string'\n          ? `clay.${record.type}`\n          : 'clay.row'\n    return [{\n      provider: 'clay',\n      eventType,\n      providerEventId,\n      receivedAt: now ?? Date.now(),\n      payload: evt,\n      headers: normalizeHeaders(headers),\n    }]\n  },\n}\n\ninterface HelloSignInboundBody {\n  event?: {\n    event_time?: string\n    event_type?: string\n    event_hash?: string\n    event_id?: string\n  }\n}\n\n/** Dropbox Sign posts JSON, a form-urlencoded `json=` field, or a\n *  multipart `name=\"json\"` part depending on app vintage. Mirrors the\n *  connector adapter's body extraction. */\nfunction parseHelloSignBody(rawBody: string): HelloSignInboundBody | null {\n  try {\n    const json = JSON.parse(rawBody) as HelloSignInboundBody\n    if (json && typeof json === 'object') return json\n  } catch {\n    // fall through to form-data extraction\n  }\n  // application/x-www-form-urlencoded `json=` field. URLSearchParams decodes\n  // `+` as a space (decodeURIComponent leaves it literal) and resolves\n  // percent-escapes, so space-bearing string fields aren't corrupted.\n  const formJson = new URLSearchParams(rawBody).get('json')\n  if (formJson) {\n    try {\n      return JSON.parse(formJson) as HelloSignInboundBody\n    } catch {\n      return null\n    }\n  }\n  // multipart/form-data with a `name=\"json\"` part. Extract linearly (indexOf +\n  // fixed-shape separator probes, no unbounded lazy regex) so a hostile body\n  // can't drive quadratic backtracking on this public ingress.\n  return extractMultipartJsonField(rawBody)\n}\n\n/** Pull the `json` part out of a multipart/form-data body without an\n *  unbounded backtracking regex. Returns null if the part isn't present or\n *  isn't valid JSON. The separator probes (`\\r?\\n\\r?\\n`, `\\r?\\n--`) are\n *  fixed-shape (no `*`/`+`), so each runs in a single linear scan. */\nfunction extractMultipartJsonField(rawBody: string): HelloSignInboundBody | null {\n  const nameIdx = rawBody.indexOf('name=\"json\"')\n  if (nameIdx === -1) return null\n  const afterName = rawBody.slice(nameIdx)\n  const sep = /\\r?\\n\\r?\\n/.exec(afterName)\n  if (!sep) return null\n  const partBody = afterName.slice(sep.index + sep[0].length)\n  const end = /\\r?\\n--/.exec(partBody)\n  if (!end) return null\n  try {\n    return JSON.parse(partBody.slice(0, end.index)) as HelloSignInboundBody\n  } catch {\n    return null\n  }\n}\n\n/** Generic HMAC provider — for the long-tail webhook source where the\n *  caller has standardised on a single sha256-of-body scheme. Header\n *  `X-Signature` by default; override at provider-build time if needed. */\nexport function genericHmacWebhookProvider(options: {\n  id: string\n  signatureHeader?: string\n  algorithm?: 'sha256' | 'sha1' | 'sha512'\n  signaturePrefix?: string\n  /** Parser to convert the raw body into envelopes. Defaults to\n   *  \"one event with eventType=<provider>.event and payload=JSON\". */\n  parse?: WebhookProvider['parse']\n}): WebhookProvider {\n  const header = options.signatureHeader ?? 'x-signature'\n  return {\n    id: options.id,\n    verifySignature({ rawBody, headers, secret }) {\n      const sig = firstHeader(headers, header)\n      if (!sig) return { valid: false, reason: `missing_${header}` }\n      return verifyHmacSignature(rawBody, sig, secret, {\n        algorithm: options.algorithm ?? 'sha256',\n        signaturePrefix: options.signaturePrefix,\n      })\n        ? { valid: true }\n        : { valid: false, reason: 'invalid_signature' }\n    },\n    parse:\n      options.parse ??\n      (({ rawBody, headers, now }) => {\n        const evt = safeJson(rawBody) ?? rawBody\n        return [{\n          provider: options.id,\n          eventType: `${options.id}.event`,\n          receivedAt: now ?? Date.now(),\n          payload: evt,\n          headers: normalizeHeaders(headers),\n        }]\n      }),\n  }\n}\n\nfunction safeJson(s: string): unknown {\n  try {\n    return JSON.parse(s)\n  } catch {\n    return null\n  }\n}\n\nfunction normalizeHeaders(headers: WebhookHeaders): Record<string, string> {\n  const out: Record<string, string> = {}\n  for (const [k, v] of Object.entries(headers)) {\n    if (v === undefined) continue\n    const value = Array.isArray(v) ? v[0] : v\n    if (typeof value === 'string') out[k.toLowerCase()] = value\n  }\n  return out\n}\n"],"mappings":";;;;;;;;;AA8IO,IAAM,gBAAN,MAAoB;AAAA,EACR;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,MAA4B;AACtC,SAAK,YAAY,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAC7D,SAAK,UAAU,KAAK;AACpB,SAAK,gBAAgB,KAAK;AAC1B,SAAK,cAAc,KAAK;AACxB,SAAK,mBAAmB,KAAK,oBAAoB,IAAI,KAAK,KAAK,KAAK;AACpE,SAAK,UAAU,KAAK,WAAW;AAC/B,SAAK,QAAQ,KAAK,OAAO,KAAK;AAAA,EAChC;AAAA;AAAA;AAAA,EAIA,MAAM,OAAO,SAA+D;AAC1E,UAAM,WAAW,KAAK,UAAU,IAAI,QAAQ,UAAU;AACtD,QAAI,CAAC,UAAU;AACb,aAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,oBAAoB,UAAU,QAAQ,WAAW,EAAE;AAAA,IAC1F;AACA,UAAM,SAAS,MAAM,KAAK,cAAc,SAAS,IAAI,QAAQ,OAAO;AACpE,QAAI,CAAC,QAAQ;AACX,aAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,kBAAkB,UAAU,SAAS,GAAG,EAAE;AAAA,IACjF;AACA,UAAM,eAAe,SAAS,gBAAgB;AAAA,MAC5C,SAAS,QAAQ;AAAA,MACjB,SAAS,QAAQ;AAAA,MACjB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,aAAa,OAAO;AACvB,aAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,qBAAqB,QAAQ,aAAa,OAAO,EAAE;AAAA,IAC1F;AAEA,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,SAAS,MAAM,EAAE,SAAS,QAAQ,SAAS,SAAS,QAAQ,SAAS,KAAK,KAAK,MAAM,EAAE,CAAC;AAAA,IACzG,SAAS,KAAK;AACZ,WAAK,QAAQ,KAAK,EAAE,UAAU,SAAS,GAAG,CAAC;AAC3C,aAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,eAAe,SAAS,WAAW,GAAG,EAAE,EAAE;AAAA,IACjF;AAEA,UAAM,WAA8B,CAAC;AACrC,eAAW,SAAS,QAAQ;AAC1B,UAAI,MAAM,mBAAmB,KAAK,aAAa;AAC7C,cAAM,UAAU,MAAM,KAAK,YAAY,KAAK,MAAM,eAAe;AACjE,YAAI,QAAS;AAAA,MACf;AACA,eAAS,KAAK,KAAK;AAAA,IACrB;AAKA,mBAAe,MAAM;AACnB,WAAK,KAAK,YAAY,QAAQ;AAAA,IAChC,CAAC;AAED,QAAI,SAAS,iBAAiB;AAC5B,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,MAAM,SAAS,gBAAgB;AAAA,QAC/B,SAAS,SAAS,gBAAgB;AAAA,MACpC;AAAA,IACF;AACA,WAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,UAAU,SAAS,QAAQ,OAAO,OAAO,OAAO,EAAE;AAAA,EAClF;AAAA,EAEA,MAAc,YAAY,QAA0C;AAClE,eAAW,SAAS,QAAQ;AAC1B,UAAI;AACF,cAAM,KAAK,QAAQ,KAAK;AACxB,YAAI,MAAM,mBAAmB,KAAK,aAAa;AAC7C,gBAAM,KAAK,YAAY,SAAS,MAAM,iBAAiB,KAAK,gBAAgB;AAAA,QAC9E;AAAA,MACF,SAAS,KAAK;AACZ,aAAK,QAAQ,KAAK;AAAA,UAChB,UAAU,MAAM;AAAA,UAChB,WAAW,MAAM;AAAA,UACjB,iBAAiB,MAAM;AAAA,QACzB,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,eAAe,KAAc,SAAmF;AAEvH,UAAQ,MAAM,mBAAmB,SAAS,GAAG;AAC/C;AAEA,SAAS,WAAW,KAAsB;AACxC,SAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AACxD;;;AC5NA,SAAS,YAAY,YAAY,uBAAuB;AAGjD,IAAM,wBAAyC;AAAA,EACpD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,SAAS,OAAO,GAA0B;AACnE,UAAM,MAAM,YAAY,SAAS,kBAAkB;AACnD,QAAI,CAAC,IAAK,QAAO,EAAE,OAAO,OAAO,QAAQ,2BAA2B;AACpE,WAAO,sBAAsB,SAAS,KAAK,MAAM,IAC7C,EAAE,OAAO,KAAK,IACd,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAClD;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,MAAM,SAAS,OAAO;AAC5B,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAC7C,UAAM,IAAI;AACV,WAAO;AAAA,MACL;AAAA,QACE,UAAU;AAAA,QACV,WAAW,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO;AAAA,QACjD,iBAAiB,OAAO,EAAE,OAAO,WAAW,EAAE,KAAK;AAAA,QACnD,YAAY,OAAO,KAAK,IAAI;AAAA,QAC5B,SAAS;AAAA,QACT,SAAS,iBAAiB,OAAO;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AACF;AAIO,IAAM,uBAAwC;AAAA,EACnD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,SAAS,OAAO,GAA0B;AACnE,UAAM,MAAM,YAAY,SAAS,mBAAmB;AACpD,UAAM,KAAK,YAAY,SAAS,2BAA2B;AAC3D,QAAI,CAAC,OAAO,CAAC,GAAI,QAAO,EAAE,OAAO,OAAO,QAAQ,uCAAuC;AACvF,WAAO,qBAAqB,SAAS,KAAK,IAAI,MAAM,IAChD,EAAE,OAAO,KAAK,IACd,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAClD;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,MAAM,SAAS,OAAO;AAC5B,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAC7C,QAAI,IAAI,SAAS,oBAAoB;AACnC,aAAO,CAAC;AAAA,QACN,UAAU;AAAA,QACV,WAAW;AAAA,QACX,YAAY,OAAO,KAAK,IAAI;AAAA,QAC5B,SAAS;AAAA,QACT,SAAS,iBAAiB,OAAO;AAAA,MACnC,CAAC;AAAA,IACH;AACA,UAAM,YAAY,SAAS,IAAI,OAAO,QAAQ,IAAI,QAAQ,SAAS;AACnE,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV;AAAA,MACA,iBAAiB,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;AAAA,MACnE,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS;AAAA,MACT,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AACF;AAGO,IAAM,0BAA2C;AAAA,EACtD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,SAAS,OAAO,GAA0B;AACnE,UAAM,MAAM,YAAY,SAAS,sBAAsB;AACvD,QAAI,CAAC,IAAK,QAAO,EAAE,OAAO,OAAO,QAAQ,6BAA6B;AACtE,UAAM,WAAW,WAAW,UAAU,MAAM,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK;AAC1E,UAAM,IAAI,OAAO,KAAK,IAAI,YAAY,GAAG,OAAO;AAChD,UAAM,IAAI,OAAO,KAAK,UAAU,OAAO;AACvC,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAC9E,WAAO,gBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAC/F;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,MAAM,SAAS,OAAO;AAC5B,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAC7C,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV,WAAW,YAAY,IAAI,cAAc,SAAS;AAAA,MAClD,iBAAiB,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;AAAA,MACnE,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS;AAAA,MACT,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AACF;AAQO,IAAM,uBAAwC;AAAA,EACnD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,OAAO,GAA0B;AAC1D,UAAM,OAAO,YAAY,SAAS,eAAe;AACjD,QAAI,CAAC,KAAM,QAAO,EAAE,OAAO,OAAO,QAAQ,wBAAwB;AAKlE,UAAM,IAAI,6BAA6B,KAAK,IAAI;AAChD,QAAI,CAAC,EAAG,QAAO,EAAE,OAAO,OAAO,QAAQ,+BAA+B;AACtE,UAAM,IAAI,OAAO,KAAK,EAAE,CAAC,GAAI,OAAO;AACpC,UAAM,IAAI,OAAO,KAAK,QAAQ,OAAO;AACrC,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAC9E,WAAO,gBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAC/F;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,WAAW,SAAS,OAAO;AACjC,QAAI,CAAC,UAAU,SAAS,KAAM,QAAO,CAAC;AACtC,QAAI;AACJ,QAAI;AACF,gBAAU,KAAK,MAAM,OAAO,KAAK,SAAS,QAAQ,MAAM,QAAQ,EAAE,SAAS,OAAO,CAAC;AAAA,IACrF,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AACA,UAAM,QAAQ;AACd,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV,WAAW;AAAA,MACX,iBAAiB,SAAS,QAAQ;AAAA,MAClC,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS,EAAE,GAAG,OAAO,aAAa,SAAS,QAAQ,YAAY;AAAA,MAC/D,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AACF;AAKO,IAAM,wBAAyC;AAAA,EACpD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,OAAO,GAA0B;AAC1D,UAAM,QAAQ,YAAY,SAAS,sBAAsB;AACzD,QAAI,CAAC,MAAO,QAAO,EAAE,OAAO,OAAO,QAAQ,wBAAwB;AACnE,UAAM,IAAI,OAAO,KAAK,OAAO,OAAO;AACpC,UAAM,IAAI,OAAO,KAAK,QAAQ,OAAO;AACrC,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAC9E,WAAO,gBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAC/F;AAAA,EACA,MAAM,EAAE,SAAS,IAAI,GAAsB;AACzC,UAAM,aAAa,YAAY,SAAS,oBAAoB;AAC5D,UAAM,gBAAgB,YAAY,SAAS,uBAAuB,KAAK;AACvE,UAAM,YAAY,YAAY,SAAS,mBAAmB;AAC1D,UAAM,gBAAgB,YAAY,SAAS,uBAAuB;AAClE,QAAI,kBAAkB,QAAQ;AAC5B,aAAO,CAAC;AAAA,QACN,UAAU;AAAA,QACV,WAAW;AAAA,QACX,iBAAiB,gBAAgB,GAAG,SAAS,IAAI,aAAa,KAAK;AAAA,QACnE,YAAY,OAAO,KAAK,IAAI;AAAA,QAC5B,SAAS,EAAE,WAAW,YAAY,cAAc;AAAA,QAChD,SAAS,iBAAiB,OAAO;AAAA,MACnC,CAAC;AAAA,IACH;AACA,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV,WAAW,mBAAmB,aAAa;AAAA,MAC3C,iBAAiB,gBAAgB,GAAG,SAAS,IAAI,aAAa,KAAK;AAAA,MACnE,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS,EAAE,WAAW,YAAY,cAAc;AAAA,MAChD,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AACF;AAIA,IAAM,uBAAuB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAMO,IAAM,0BAA2C;AAAA,EACtD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,OAAO,GAA0B;AAC1D,UAAM,QAAQ,YAAY,SAAS,iCAAiC;AACpE,QAAI,CAAC,MAAO,QAAO,EAAE,OAAO,OAAO,QAAQ,gCAAgC;AAC3E,UAAM,IAAI,OAAO,KAAK,OAAO,OAAO;AACpC,UAAM,IAAI,OAAO,KAAK,QAAQ,OAAO;AACrC,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,OAAO,OAAO,QAAQ,uBAAuB;AACjF,WAAO,gBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,OAAO,QAAQ,uBAAuB;AAAA,EAClG;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,MAAM,SAAS,OAAO;AAC5B,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAC7C,UAAM,OAAO,qBAAqB,KAAK,CAAC,MAAM,KAAK,GAAG,KAAK;AAC3D,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV,WAAW,YAAY,IAAI;AAAA,MAC3B,iBAAiB,OAAO,IAAI,cAAc,WAAW,OAAO,IAAI,SAAS,IAAI;AAAA,MAC7E,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS;AAAA,MACT,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AACF;AAOO,IAAM,2BAA4C;AAAA,EACvD,IAAI;AAAA;AAAA;AAAA,EAGJ,iBAAiB,EAAE,MAAM,4BAA4B,SAAS,EAAE,gBAAgB,aAAa,EAAE;AAAA,EAC/F,gBAAgB,EAAE,SAAS,OAAO,GAA0B;AAC1D,UAAM,OAAO,mBAAmB,OAAO;AACvC,UAAM,QAAQ,MAAM;AACpB,QACE,CAAC,SACD,OAAO,MAAM,eAAe,YAC5B,OAAO,MAAM,eAAe,YAC5B,OAAO,MAAM,eAAe,UAC5B;AACA,aAAO,EAAE,OAAO,OAAO,QAAQ,uBAAuB;AAAA,IACxD;AACA,UAAM,WAAW,WAAW,UAAU,MAAM,EACzC,OAAO,GAAG,MAAM,UAAU,GAAG,MAAM,UAAU,EAAE,EAC/C,OAAO,KAAK;AACf,UAAM,IAAI,OAAO,KAAK,MAAM,WAAW,YAAY,GAAG,OAAO;AAC7D,UAAM,IAAI,OAAO,KAAK,SAAS,YAAY,GAAG,OAAO;AACrD,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAC9E,WAAO,gBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAC/F;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,OAAO,mBAAmB,OAAO;AACvC,UAAM,QAAQ,MAAM;AACpB,QAAI,CAAC,MAAO,QAAO,CAAC;AACpB,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV,WAAW,aAAa,MAAM,cAAc,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOrD,iBACE,OAAO,MAAM,aAAa,YAAY,MAAM,SAAS,SAAS,IAC1D,MAAM,WACN,WAAW,QAAQ,EAAE,OAAO,KAAK,UAAU,IAAI,CAAC,EAAE,OAAO,KAAK;AAAA,MACpE,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS;AAAA,MACT,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AACF;AAKA,IAAM,qBAAqB,CAAC,MAAM,SAAS,YAAY,aAAa,SAAS;AAWtE,IAAM,sBAAuC;AAAA,EAClD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,OAAO,GAA0B;AAC1D,UAAM,QAAQ,YAAY,SAAS,uBAAuB;AAC1D,QAAI,CAAC,MAAO,QAAO,EAAE,OAAO,OAAO,QAAQ,8BAA8B;AACzE,UAAM,IAAI,OAAO,KAAK,OAAO,OAAO;AACpC,UAAM,IAAI,OAAO,KAAK,QAAQ,OAAO;AACrC,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAC9E,WAAO,gBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAC/F;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,MAAM,SAAS,OAAO;AAC5B,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAC7C,UAAM,SAAS;AACf,UAAM,QAAQ,mBAAmB;AAAA,MAC/B,CAAC,MAAM,OAAO,OAAO,CAAC,MAAM,YAAY,OAAO,OAAO,CAAC,MAAM;AAAA,IAC/D;AACA,UAAM,kBAAkB,QACpB,OAAO,OAAO,KAAK,CAAC,IACpB,WAAW,QAAQ,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK;AACrD,UAAM,YACJ,OAAO,OAAO,UAAU,WACpB,QAAQ,OAAO,KAAK,KACpB,OAAO,OAAO,SAAS,WACrB,QAAQ,OAAO,IAAI,KACnB;AACR,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS;AAAA,MACT,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AACF;AAcA,SAAS,mBAAmB,SAA8C;AACxE,MAAI;AACF,UAAM,OAAO,KAAK,MAAM,OAAO;AAC/B,QAAI,QAAQ,OAAO,SAAS,SAAU,QAAO;AAAA,EAC/C,QAAQ;AAAA,EAER;AAIA,QAAM,WAAW,IAAI,gBAAgB,OAAO,EAAE,IAAI,MAAM;AACxD,MAAI,UAAU;AACZ,QAAI;AACF,aAAO,KAAK,MAAM,QAAQ;AAAA,IAC5B,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAIA,SAAO,0BAA0B,OAAO;AAC1C;AAMA,SAAS,0BAA0B,SAA8C;AAC/E,QAAM,UAAU,QAAQ,QAAQ,aAAa;AAC7C,MAAI,YAAY,GAAI,QAAO;AAC3B,QAAM,YAAY,QAAQ,MAAM,OAAO;AACvC,QAAM,MAAM,aAAa,KAAK,SAAS;AACvC,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,WAAW,UAAU,MAAM,IAAI,QAAQ,IAAI,CAAC,EAAE,MAAM;AAC1D,QAAM,MAAM,UAAU,KAAK,QAAQ;AACnC,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,WAAO,KAAK,MAAM,SAAS,MAAM,GAAG,IAAI,KAAK,CAAC;AAAA,EAChD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKO,SAAS,2BAA2B,SAQvB;AAClB,QAAM,SAAS,QAAQ,mBAAmB;AAC1C,SAAO;AAAA,IACL,IAAI,QAAQ;AAAA,IACZ,gBAAgB,EAAE,SAAS,SAAS,OAAO,GAAG;AAC5C,YAAM,MAAM,YAAY,SAAS,MAAM;AACvC,UAAI,CAAC,IAAK,QAAO,EAAE,OAAO,OAAO,QAAQ,WAAW,MAAM,GAAG;AAC7D,aAAO,oBAAoB,SAAS,KAAK,QAAQ;AAAA,QAC/C,WAAW,QAAQ,aAAa;AAAA,QAChC,iBAAiB,QAAQ;AAAA,MAC3B,CAAC,IACG,EAAE,OAAO,KAAK,IACd,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,IAClD;AAAA,IACA,OACE,QAAQ,UACP,CAAC,EAAE,SAAS,SAAS,IAAI,MAAM;AAC9B,YAAM,MAAM,SAAS,OAAO,KAAK;AACjC,aAAO,CAAC;AAAA,QACN,UAAU,QAAQ;AAAA,QAClB,WAAW,GAAG,QAAQ,EAAE;AAAA,QACxB,YAAY,OAAO,KAAK,IAAI;AAAA,QAC5B,SAAS;AAAA,QACT,SAAS,iBAAiB,OAAO;AAAA,MACnC,CAAC;AAAA,IACH;AAAA,EACJ;AACF;AAEA,SAAS,SAAS,GAAoB;AACpC,MAAI;AACF,WAAO,KAAK,MAAM,CAAC;AAAA,EACrB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,iBAAiB,SAAiD;AACzE,QAAM,MAA8B,CAAC;AACrC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC5C,QAAI,MAAM,OAAW;AACrB,UAAM,QAAQ,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI;AACxC,QAAI,OAAO,UAAU,SAAU,KAAI,EAAE,YAAY,CAAC,IAAI;AAAA,EACxD;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/webhooks/router.ts","../../src/webhooks/providers.ts"],"sourcesContent":["/**\n * @stable Provider-agnostic inbound webhook router.\n *\n * Consumer hooks a single HTTP handler at `/webhook/:provider/:event`\n * (or whatever pathing they prefer) and forwards the request through\n * `WebhookRouter.handle()`. The router:\n *\n *   1. Resolves the registered provider entry.\n *   2. Calls the provider's `verifySignature(rawBody, headers, secrets)`.\n *      Failure → 401 fast, no downstream work.\n *   3. Calls the provider's `parse(rawBody, headers)` to extract zero or\n *      more normalized events.\n *   4. Enqueues each event for async processing via the consumer-supplied\n *      `deliver(event)` callback (best-effort fire-and-forget — the\n *      router does NOT block the HTTP response on the consumer's work).\n *   5. Returns 200 fast with `{received: events.length}`.\n *\n * Replay protection: providers that sign timestamps (Stripe, Slack)\n * already reject stale signatures inside `verifySignature`. For providers\n * that don't (DocuSeal, GDrive push), the router exposes a pluggable\n * `idempotency` hook: if `idempotency.seen(providerEventId)` returns\n * true, the router 200s without invoking `deliver()`. Consumers wire\n * this to a durable kv (D1 / Redis / Postgres unique-index).\n *\n * Why a router and not a per-provider express app: the runtime contract\n * a product cares about is \"an inbound event came in, here's the\n * normalized envelope\". Verification, parsing, and idempotency-dedup\n * are mechanical and provider-specific — the router owns them. The\n * consumer's `deliver()` is the only place product logic runs.\n *\n * Stability: `@stable` — additions to `WebhookEnvelope` must be\n * additive; the router's HTTP contract (paths, status codes) is frozen\n * at 200 (ok), 400 (bad request), 401 (bad signature), 404 (unknown\n * provider), 405 (provider has no inbound surface).\n */\n\nexport interface WebhookHeaders {\n  [name: string]: string | string[] | undefined\n}\n\n/** Normalized inbound event the router emits after parsing. */\nexport interface WebhookEnvelope<TPayload = unknown> {\n  /** Provider id (matches the `:provider` path segment). */\n  provider: string\n  /** Optional event class — e.g., 'customer.subscription.deleted'. The\n   *  provider's parser decides. Used for routing inside `deliver()`. */\n  eventType: string\n  /** Provider-emitted event id, when present. Used for the idempotency\n   *  short-circuit. */\n  providerEventId?: string\n  /** Wall-clock receive time. */\n  receivedAt: number\n  /** Provider payload, normalized to the provider's documented event\n   *  shape. The router does NOT reshape this — `parse()` is the contract. */\n  payload: TPayload\n  /** Headers passed through for downstream handlers that want them\n   *  (e.g., to extract custom routing metadata). Always lowercased keys. */\n  headers: Record<string, string>\n}\n\nexport type SignatureVerification =\n  | { valid: true }\n  | { valid: false; reason: string }\n\n/** One declared triggerable event, in the runtime `eventType` namespace a\n *  provider's `parse` emits. */\nexport interface TriggerEventDescriptor {\n  /** The `eventType` a workflow `provider_event` trigger matches on\n   *  (`slack.app_mention`, `charge.succeeded`). */\n  id: string\n  /** Short human label for authoring surfaces; optional. */\n  title?: string\n}\n\n/** The set of events a provider can deliver, for author-time validation of\n *  workflow `provider_event` triggers. Co-located with the provider's `parse`\n *  (the source of the runtime namespace) so the two cannot drift — see the\n *  per-provider drift tests. Consumers validate an authored event with two\n *  checks: it must carry `namespace` (a prefix-less event on a namespaced\n *  provider can never be delivered), and — only when `closed` — be one of\n *  `events` (an exhaustive set makes an unlisted event an authoring error). */\nexport interface TriggerEventCatalog {\n  /** Required prefix every `parse`-emitted `eventType` carries (`slack.`,\n   *  `telegram.`), or `null` when the provider emits raw event names (stripe). */\n  namespace: string | null\n  /** Declared events. Exhaustive iff `closed`; otherwise authoring hints for an\n   *  open, provider-owned vocabulary. */\n  events: readonly TriggerEventDescriptor[]\n  /** True when `events` is the COMPLETE deliverable set, so an event outside it\n   *  is rejected. False when the provider owns an open-ended vocabulary it keeps\n   *  adding to (Stripe's ~250 types, Slack's Events API) and only `namespace`\n   *  can be authoritatively enforced. */\n  closed: boolean\n}\n\n/** Per-provider plug-in. Stateless — the router calls `verifySignature`\n *  then `parse` on every request. The provider's HTTP-shape concerns\n *  (e.g., raw body required) are documented per provider. */\nexport interface WebhookProvider {\n  /** Stable provider id (`stripe`, `docuseal`, `gdrive`, ...). */\n  id: string\n  /** Verify the inbound signature. Receives the EXACT raw body string —\n   *  consumers MUST preserve raw bytes through their HTTP server (do not\n   *  parse JSON before forwarding here). */\n  verifySignature(input: {\n    rawBody: string\n    headers: WebhookHeaders\n    secret: string\n  }): SignatureVerification\n  /** Parse the validated raw body into zero or more normalized events.\n   *  A single push payload may carry multiple events (e.g., Slack bulk\n   *  delivery). Return [] to ack the push as a no-op. */\n  parse(input: {\n    rawBody: string\n    headers: WebhookHeaders\n    now?: number\n  }): WebhookEnvelope[] | Promise<WebhookEnvelope[]>\n  /** Optional provider-specific 200 ACK the router returns on a verified\n   *  delivery, in place of the default `{ received, total }` JSON. Dropbox Sign\n   *  acknowledges a delivery only when the body is exactly\n   *  'Hello API Event Received' and retries otherwise; this lets such a\n   *  provider declare the body/headers it needs. The frozen status contract is\n   *  unchanged — only the 200 body/headers are customized. */\n  successResponse?: { body: string; headers?: Record<string, string> }\n  /** Declared triggerable-event catalog, for author-time validation of workflow\n   *  `provider_event` triggers. Optional: a provider without one is left\n   *  unvalidated by consumers (the trigger still installs). */\n  eventCatalog?: TriggerEventCatalog\n}\n\nexport interface WebhookIdempotencyStore {\n  /** Returns true if this providerEventId has been processed already.\n   *  Implementations should be O(1) (Redis SETNX, D1 UNIQUE constraint). */\n  seen(providerEventId: string): Promise<boolean> | boolean\n  /** Marks a providerEventId as processed. Called AFTER `deliver()` has\n   *  been invoked. */\n  remember(providerEventId: string, ttlMs: number): Promise<void> | void\n}\n\nexport interface WebhookRouterOptions {\n  /** Provider registry. Pass any number of providers; routing is by id. */\n  providers: WebhookProvider[]\n  /** Async callback invoked with every accepted event. Fire-and-forget\n   *  from the router's perspective — the HTTP response is sent before\n   *  this resolves. Throws are caught and reported via `onError`. */\n  deliver(event: WebhookEnvelope): Promise<void> | void\n  /** Resolve the signing secret for a provider id at request time. The\n   *  router never holds secrets — the consumer's vault resolves them. */\n  resolveSecret(providerId: string, headers: WebhookHeaders): Promise<string | null> | string | null\n  /** Optional idempotency-dedup hook. Required for providers that don't\n   *  sign timestamps in their signature scheme (DocuSeal, Drive push). */\n  idempotency?: WebhookIdempotencyStore\n  /** TTL on idempotency entries. Default 7 days — long enough that a\n   *  provider's normal retry-window can't re-deliver. */\n  idempotencyTtlMs?: number\n  /** Surface delivery errors. Default: console.error. */\n  onError?(err: unknown, context: { provider: string; eventType?: string; providerEventId?: string }): void\n  /** Override `now()` for tests. */\n  now?(): number\n}\n\nexport interface WebhookRouterRequest {\n  providerId: string\n  rawBody: string\n  headers: WebhookHeaders\n}\n\nexport interface WebhookRouterResponse {\n  status: number\n  body: unknown\n  headers?: Record<string, string>\n}\n\n/**\n * Router instance. Stateless aside from the provider registry — safe to\n * share across requests; build once per process.\n */\nexport class WebhookRouter {\n  private readonly providers: Map<string, WebhookProvider>\n  private readonly deliver: WebhookRouterOptions['deliver']\n  private readonly resolveSecret: WebhookRouterOptions['resolveSecret']\n  private readonly idempotency?: WebhookIdempotencyStore\n  private readonly idempotencyTtlMs: number\n  private readonly onError: NonNullable<WebhookRouterOptions['onError']>\n  private readonly nowFn: () => number\n\n  constructor(opts: WebhookRouterOptions) {\n    this.providers = new Map(opts.providers.map((p) => [p.id, p]))\n    this.deliver = opts.deliver\n    this.resolveSecret = opts.resolveSecret\n    this.idempotency = opts.idempotency\n    this.idempotencyTtlMs = opts.idempotencyTtlMs ?? 7 * 24 * 60 * 60 * 1000\n    this.onError = opts.onError ?? defaultOnError\n    this.nowFn = opts.now ?? Date.now\n  }\n\n  /** Process one inbound webhook request. Pure with respect to side-\n   *  effects on the router instance — safe to call concurrently. */\n  async handle(request: WebhookRouterRequest): Promise<WebhookRouterResponse> {\n    const provider = this.providers.get(request.providerId)\n    if (!provider) {\n      return { status: 404, body: { error: 'unknown_provider', provider: request.providerId } }\n    }\n    const secret = await this.resolveSecret(provider.id, request.headers)\n    if (!secret) {\n      return { status: 401, body: { error: 'missing_secret', provider: provider.id } }\n    }\n    const verification = provider.verifySignature({\n      rawBody: request.rawBody,\n      headers: request.headers,\n      secret,\n    })\n    if (!verification.valid) {\n      return { status: 401, body: { error: 'invalid_signature', reason: verification.reason } }\n    }\n\n    let events: WebhookEnvelope[]\n    try {\n      events = await provider.parse({ rawBody: request.rawBody, headers: request.headers, now: this.nowFn() })\n    } catch (err) {\n      this.onError(err, { provider: provider.id })\n      return { status: 400, body: { error: 'parse_error', message: errMessage(err) } }\n    }\n\n    const accepted: WebhookEnvelope[] = []\n    for (const event of events) {\n      if (event.providerEventId && this.idempotency) {\n        const already = await this.idempotency.seen(event.providerEventId)\n        if (already) continue\n      }\n      accepted.push(event)\n    }\n\n    // Deliver async — do NOT block the HTTP response. Errors land in\n    // `onError`; the provider already got its 200 by then so it will\n    // not retry.\n    queueMicrotask(() => {\n      void this.deliverEach(accepted)\n    })\n\n    if (provider.successResponse) {\n      return {\n        status: 200,\n        body: provider.successResponse.body,\n        headers: provider.successResponse.headers,\n      }\n    }\n    return { status: 200, body: { received: accepted.length, total: events.length } }\n  }\n\n  private async deliverEach(events: WebhookEnvelope[]): Promise<void> {\n    for (const event of events) {\n      try {\n        await this.deliver(event)\n        if (event.providerEventId && this.idempotency) {\n          await this.idempotency.remember(event.providerEventId, this.idempotencyTtlMs)\n        }\n      } catch (err) {\n        this.onError(err, {\n          provider: event.provider,\n          eventType: event.eventType,\n          providerEventId: event.providerEventId,\n        })\n      }\n    }\n  }\n}\n\nfunction defaultOnError(err: unknown, context: { provider: string; eventType?: string; providerEventId?: string }): void {\n  // eslint-disable-next-line no-console\n  console.error('[WebhookRouter]', context, err)\n}\n\nfunction errMessage(err: unknown): string {\n  return err instanceof Error ? err.message : String(err)\n}\n","/**\n * Pre-built `WebhookProvider` implementations for the inbound surfaces\n * the substrate ships first-party verifiers for.\n *\n * Each provider implementation is intentionally thin: it delegates\n * signature verification to the corresponding pure function in\n * `connectors/webhooks.ts` and parses the body into one or more\n * normalized `WebhookEnvelope` rows. Anything provider-specific that\n * doesn't fit cleanly (Slack URL-verification handshake, etc.) is\n * surfaced via the envelope `eventType` so the consumer's `deliver()`\n * can branch.\n */\n\nimport {\n  firstHeader,\n  verifyEmailSignature,\n  verifyHmacSignature,\n  verifySlackSignature,\n  verifyStripeSignature,\n} from '../connectors/webhooks.js'\nimport type { WebhookEnvelope, WebhookHeaders, WebhookProvider, SignatureVerification } from './router.js'\nimport { createHash, createHmac, timingSafeEqual } from 'node:crypto'\n\n/** Stripe webhook provider. Signature header `Stripe-Signature`. */\nexport const stripeWebhookProvider: WebhookProvider = {\n  id: 'stripe',\n  verifySignature({ rawBody, headers, secret }): SignatureVerification {\n    const sig = firstHeader(headers, 'stripe-signature')\n    if (!sig) return { valid: false, reason: 'missing_stripe_signature' }\n    return verifyStripeSignature(rawBody, sig, secret)\n      ? { valid: true }\n      : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const evt = safeJson(rawBody)\n    if (!evt || typeof evt !== 'object') return []\n    const e = evt as { id?: unknown; type?: unknown }\n    return [\n      {\n        provider: 'stripe',\n        eventType: typeof e.type === 'string' ? e.type : 'stripe.unknown',\n        providerEventId: typeof e.id === 'string' ? e.id : undefined,\n        receivedAt: now ?? Date.now(),\n        payload: evt,\n        headers: normalizeHeaders(headers),\n      },\n    ]\n  },\n  eventCatalog: {\n    // Stripe emits the raw event `type` (`charge.succeeded`) — no namespace, and\n    // an OPEN, versioned vocabulary (~250 types), so these are authoring hints,\n    // not a gate.\n    namespace: null,\n    closed: false,\n    events: [\n      { id: 'checkout.session.completed' },\n      { id: 'checkout.session.expired' },\n      { id: 'customer.subscription.created' },\n      { id: 'customer.subscription.updated' },\n      { id: 'customer.subscription.deleted' },\n      { id: 'invoice.paid' },\n      { id: 'invoice.payment_failed' },\n      { id: 'payment_intent.succeeded' },\n      { id: 'payment_intent.payment_failed' },\n      { id: 'charge.succeeded' },\n      { id: 'charge.refunded' },\n    ],\n  },\n}\n\n/** Slack Events API provider. Handles the `url_verification` handshake\n *  by emitting a synthetic event the consumer's `deliver()` can echo. */\nexport const slackWebhookProvider: WebhookProvider = {\n  id: 'slack',\n  verifySignature({ rawBody, headers, secret }): SignatureVerification {\n    const sig = firstHeader(headers, 'x-slack-signature')\n    const ts = firstHeader(headers, 'x-slack-request-timestamp')\n    if (!sig || !ts) return { valid: false, reason: 'missing_slack_signature_or_timestamp' }\n    return verifySlackSignature(rawBody, sig, ts, secret)\n      ? { valid: true }\n      : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const evt = safeJson(rawBody) as { type?: string; event_id?: string; event?: { type?: string } } | null\n    if (!evt || typeof evt !== 'object') return []\n    if (evt.type === 'url_verification') {\n      return [{\n        provider: 'slack',\n        eventType: 'slack.url_verification',\n        receivedAt: now ?? Date.now(),\n        payload: evt,\n        headers: normalizeHeaders(headers),\n      }]\n    }\n    const eventType = `slack.${evt.event?.type ?? evt.type ?? 'unknown'}`\n    return [{\n      provider: 'slack',\n      eventType,\n      providerEventId: typeof evt.event_id === 'string' ? evt.event_id : undefined,\n      receivedAt: now ?? Date.now(),\n      payload: evt,\n      headers: normalizeHeaders(headers),\n    }]\n  },\n  eventCatalog: {\n    // Slack namespaces every event `slack.<events-api-type>`, so a prefix-less\n    // event is provably dead. The Events API vocabulary is open (Slack adds\n    // types), so `events` are hints, not a gate. `slack.url_verification` (the\n    // config handshake) is intentionally excluded — it carries no workflow\n    // meaning and is answered before dispatch.\n    namespace: 'slack.',\n    closed: false,\n    events: [\n      { id: 'slack.message' },\n      { id: 'slack.app_mention' },\n      { id: 'slack.reaction_added' },\n      { id: 'slack.reaction_removed' },\n      { id: 'slack.channel_created' },\n      { id: 'slack.member_joined_channel' },\n      { id: 'slack.team_join' },\n      { id: 'slack.app_home_opened' },\n      { id: 'slack.file_shared' },\n    ],\n  },\n}\n\n/** DocuSeal webhook provider. Signature header `X-Docuseal-Signature`. */\nexport const docusealWebhookProvider: WebhookProvider = {\n  id: 'docuseal',\n  verifySignature({ rawBody, headers, secret }): SignatureVerification {\n    const sig = firstHeader(headers, 'x-docuseal-signature')\n    if (!sig) return { valid: false, reason: 'missing_docuseal_signature' }\n    const expected = createHmac('sha256', secret).update(rawBody).digest('hex')\n    const a = Buffer.from(sig.toLowerCase(), 'utf-8')\n    const b = Buffer.from(expected, 'utf-8')\n    if (a.length !== b.length) return { valid: false, reason: 'invalid_signature' }\n    return timingSafeEqual(a, b) ? { valid: true } : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const evt = safeJson(rawBody) as { event_type?: string; event_id?: string } | null\n    if (!evt || typeof evt !== 'object') return []\n    return [{\n      provider: 'docuseal',\n      eventType: `docuseal.${evt.event_type ?? 'unknown'}`,\n      providerEventId: typeof evt.event_id === 'string' ? evt.event_id : undefined,\n      receivedAt: now ?? Date.now(),\n      payload: evt,\n      headers: normalizeHeaders(headers),\n    }]\n  },\n  eventCatalog: {\n    // DocuSeal namespaces every event `docuseal.<event_type>`. The documented\n    // set is small but not derivable from `parse`, so it stays open (namespace\n    // is the authoritative gate) with the documented types as hints.\n    namespace: 'docuseal.',\n    closed: false,\n    events: [\n      { id: 'docuseal.form.viewed' },\n      { id: 'docuseal.form.started' },\n      { id: 'docuseal.form.completed' },\n      { id: 'docuseal.form.declined' },\n      { id: 'docuseal.submission.created' },\n      { id: 'docuseal.submission.completed' },\n      { id: 'docuseal.submission.expired' },\n      { id: 'docuseal.submission.archived' },\n    ],\n  },\n}\n\n/** The normalized inbound-email payload the Tangle email edge posts and this\n *  provider surfaces on `WebhookEnvelope.payload`. `to` is the owner-resolution\n *  key — the platform matches it to a connection's provisioned inbound address;\n *  `messageId` is the idempotency key. */\nexport interface InboundEmailPayload {\n  /** RFC5322 Message-ID. */\n  messageId?: string\n  /** Envelope sender — the firm/customer that emailed in. */\n  from: string\n  /** The provisioned inbound address the message was delivered to (owner key). */\n  to: string\n  subject?: string\n  text?: string\n  html?: string\n  /** Selected headers the edge forwards (Reply-To, In-Reply-To, References…). */\n  headers?: Record<string, string>\n  attachments?: Array<{\n    filename?: string\n    contentType?: string\n    /** Bytes as base64, OR a `url`/path the edge staged them at (large files). */\n    contentBase64?: string\n    url?: string\n    size?: number\n  }>\n  /** Epoch ms the edge received the message. */\n  receivedAt?: number\n}\n\n/** Tangle inbound-email provider. Our own Cloudflare Email Routing worker parses\n *  the MIME, JSON-serializes it, timestamped-HMAC signs it with the\n *  per-connection secret, and POSTs it here — there is no upstream mail-vendor\n *  signature, we are both signer and verifier. One inbound message → one\n *  `email.received` envelope; `payload.to` carries the owner-resolution address. */\nexport const emailWebhookProvider: WebhookProvider = {\n  id: 'email',\n  verifySignature({ rawBody, headers, secret }): SignatureVerification {\n    const sig = firstHeader(headers, 'x-tangle-email-signature')\n    if (!sig) return { valid: false, reason: 'missing_email_signature' }\n    const ts = firstHeader(headers, 'x-tangle-email-timestamp')\n    if (!ts) return { valid: false, reason: 'missing_email_timestamp' }\n    return verifyEmailSignature(rawBody, sig, ts, secret)\n      ? { valid: true }\n      : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const msg = safeJson(rawBody) as Partial<InboundEmailPayload> | null\n    if (!msg || typeof msg !== 'object') return []\n    // `from` + `to` are load-bearing (owner resolution keys off `to`); a body\n    // missing either is a malformed edge post — ack as a no-op rather than\n    // dispatch an unroutable event.\n    if (typeof msg.from !== 'string' || typeof msg.to !== 'string') return []\n    return [{\n      provider: 'email',\n      eventType: 'email.received',\n      providerEventId: typeof msg.messageId === 'string' ? msg.messageId : undefined,\n      receivedAt: now ?? Date.now(),\n      payload: msg as InboundEmailPayload,\n      headers: normalizeHeaders(headers),\n    }]\n  },\n  eventCatalog: {\n    // We own the edge, so the inbound surface is exactly one closed event.\n    namespace: 'email.',\n    closed: true,\n    events: [{ id: 'email.received' }],\n  },\n}\n\n/** Gmail push provider. Cloud Pub/Sub posts a JWT-signed envelope; the\n *  *payload* is base64 JSON describing the changed history range. The\n *  signature scheme here is the Pub/Sub JWT auth header — when supplied,\n *  consumers SHOULD verify the JWT against Google's well-known\n *  certificates. We accept the simpler \"Bearer <pubsub-shared-secret>\"\n *  variant by default (matching `verifyHmacSignature`). */\nexport const gmailWebhookProvider: WebhookProvider = {\n  id: 'gmail',\n  verifySignature({ headers, secret }): SignatureVerification {\n    const auth = firstHeader(headers, 'authorization')\n    if (!auth) return { valid: false, reason: 'missing_authorization' }\n    // Accept either \"Bearer <secret>\" or \"Token <secret>\" formats. This\n    // is the simple per-tenant shared-secret path; JWT verification is\n    // left to the consumer's `deliver()` when they need full Google JWT\n    // chain validation.\n    const m = /^(?:Bearer|Token)\\s+(.+)$/i.exec(auth)\n    if (!m) return { valid: false, reason: 'invalid_authorization_format' }\n    const a = Buffer.from(m[1]!, 'utf-8')\n    const b = Buffer.from(secret, 'utf-8')\n    if (a.length !== b.length) return { valid: false, reason: 'invalid_signature' }\n    return timingSafeEqual(a, b) ? { valid: true } : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const envelope = safeJson(rawBody) as { message?: { data?: string; messageId?: string; publishTime?: string } } | null\n    if (!envelope?.message?.data) return []\n    let payload: unknown\n    try {\n      payload = JSON.parse(Buffer.from(envelope.message.data, 'base64').toString('utf-8'))\n    } catch {\n      return []\n    }\n    const inner = payload as { historyId?: number | string; emailAddress?: string }\n    return [{\n      provider: 'gmail',\n      eventType: 'gmail.history_changed',\n      providerEventId: envelope.message.messageId,\n      receivedAt: now ?? Date.now(),\n      payload: { ...inner, publishTime: envelope.message.publishTime },\n      headers: normalizeHeaders(headers),\n    }]\n  },\n}\n\n/** Google Drive push provider. Drive does NOT sign the body — it uses\n *  the per-channel token (`X-Goog-Channel-Token`) as the shared secret.\n *  The router compares it constant-time against the resolved secret. */\nexport const gdriveWebhookProvider: WebhookProvider = {\n  id: 'gdrive',\n  verifySignature({ headers, secret }): SignatureVerification {\n    const token = firstHeader(headers, 'x-goog-channel-token')\n    if (!token) return { valid: false, reason: 'missing_channel_token' }\n    const a = Buffer.from(token, 'utf-8')\n    const b = Buffer.from(secret, 'utf-8')\n    if (a.length !== b.length) return { valid: false, reason: 'invalid_signature' }\n    return timingSafeEqual(a, b) ? { valid: true } : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ headers, now }): WebhookEnvelope[] {\n    const resourceId = firstHeader(headers, 'x-goog-resource-id')\n    const resourceState = firstHeader(headers, 'x-goog-resource-state') ?? 'unknown'\n    const channelId = firstHeader(headers, 'x-goog-channel-id')\n    const messageNumber = firstHeader(headers, 'x-goog-message-number')\n    if (resourceState === 'sync') {\n      return [{\n        provider: 'gdrive',\n        eventType: 'gdrive.channel.sync',\n        providerEventId: messageNumber ? `${channelId}-${messageNumber}` : undefined,\n        receivedAt: now ?? Date.now(),\n        payload: { channelId, resourceId, resourceState },\n        headers: normalizeHeaders(headers),\n      }]\n    }\n    return [{\n      provider: 'gdrive',\n      eventType: `gdrive.resource.${resourceState}`,\n      providerEventId: messageNumber ? `${channelId}-${messageNumber}` : undefined,\n      receivedAt: now ?? Date.now(),\n      payload: { channelId, resourceId, resourceState },\n      headers: normalizeHeaders(headers),\n    }]\n  },\n}\n\n/** The Telegram update keys, in resolution order — the first present key names\n *  the update kind (`telegram.message`, `telegram.callback_query`, …). */\nconst TELEGRAM_UPDATE_KEYS = [\n  'message',\n  'edited_message',\n  'channel_post',\n  'edited_channel_post',\n  'business_connection',\n  'business_message',\n  'edited_business_message',\n  'deleted_business_messages',\n  'message_reaction',\n  'message_reaction_count',\n  'inline_query',\n  'chosen_inline_result',\n  'callback_query',\n  'shipping_query',\n  'pre_checkout_query',\n  'purchased_paid_media',\n  'poll',\n  'poll_answer',\n  'my_chat_member',\n  'chat_member',\n  'chat_join_request',\n  'chat_boost',\n  'removed_chat_boost',\n] as const\n\n/** Telegram Bot API webhook provider. Telegram does NOT sign the body — it\n *  authenticates by echoing the `secret_token` set at `setWebhook` time in the\n *  `X-Telegram-Bot-Api-Secret-Token` header. We compare it constant-time to the\n *  per-connection secret. `update_id` is the idempotency anchor. */\nexport const telegramWebhookProvider: WebhookProvider = {\n  id: 'telegram',\n  verifySignature({ headers, secret }): SignatureVerification {\n    const token = firstHeader(headers, 'x-telegram-bot-api-secret-token')\n    if (!token) return { valid: false, reason: 'missing_telegram_secret_token' }\n    const a = Buffer.from(token, 'utf-8')\n    const b = Buffer.from(secret, 'utf-8')\n    if (a.length !== b.length) return { valid: false, reason: 'invalid_secret_token' }\n    return timingSafeEqual(a, b) ? { valid: true } : { valid: false, reason: 'invalid_secret_token' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const evt = safeJson(rawBody) as ({ update_id?: number } & Record<string, unknown>) | null\n    if (!evt || typeof evt !== 'object') return []\n    const kind = TELEGRAM_UPDATE_KEYS.find((k) => k in evt) ?? 'unknown'\n    return [{\n      provider: 'telegram',\n      eventType: `telegram.${kind}`,\n      providerEventId: typeof evt.update_id === 'number' ? String(evt.update_id) : undefined,\n      receivedAt: now ?? Date.now(),\n      payload: evt,\n      headers: normalizeHeaders(headers),\n    }]\n  },\n  eventCatalog: {\n    // Derived from the SAME TELEGRAM_UPDATE_KEYS `parse` matches on, so the\n    // catalog is exhaustive and cannot drift — hence `closed`. (`telegram.unknown`,\n    // parse's fallback for an update with no recognized key, is intentionally\n    // excluded: it is not a triggerable event.)\n    namespace: 'telegram.',\n    closed: true,\n    events: TELEGRAM_UPDATE_KEYS.map((k) => ({ id: `telegram.${k}` })),\n  },\n}\n\n/** Dropbox Sign (HelloSign) webhook provider. There is NO signature header:\n *  the body carries `event.event_hash = HMAC_SHA256(apiKey, event_time +\n *  event_type)` (hex), so the `secret` here is the account's API key (the\n *  caller resolves it from the connection credential). The body is JSON, or a\n *  `json=`/multipart `name=\"json\"` form field on older apps. */\nexport const hellosignWebhookProvider: WebhookProvider = {\n  id: 'hellosign',\n  // Dropbox Sign acknowledges a delivery only when the response body is exactly\n  // 'Hello API Event Received'; any other body makes it retry the event.\n  successResponse: { body: 'Hello API Event Received', headers: { 'content-type': 'text/plain' } },\n  verifySignature({ rawBody, secret }): SignatureVerification {\n    const body = parseHelloSignBody(rawBody)\n    const event = body?.event\n    if (\n      !event ||\n      typeof event.event_time !== 'string' ||\n      typeof event.event_type !== 'string' ||\n      typeof event.event_hash !== 'string'\n    ) {\n      return { valid: false, reason: 'missing_event_fields' }\n    }\n    const expected = createHmac('sha256', secret)\n      .update(`${event.event_time}${event.event_type}`)\n      .digest('hex')\n    const a = Buffer.from(event.event_hash.toLowerCase(), 'utf-8')\n    const b = Buffer.from(expected.toLowerCase(), 'utf-8')\n    if (a.length !== b.length) return { valid: false, reason: 'invalid_signature' }\n    return timingSafeEqual(a, b) ? { valid: true } : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const body = parseHelloSignBody(rawBody)\n    const event = body?.event\n    if (!event) return []\n    return [{\n      provider: 'hellosign',\n      eventType: `hellosign.${event.event_type ?? 'unknown'}`,\n      // Prefer Dropbox Sign's canonical `event.event_id` (stable across\n      // redeliveries, correlates with the provider). Fall back to a digest of\n      // the parsed body when it's absent: `event_hash` = HMAC(apiKey,\n      // event_time + event_type), so two distinct same-type events in the same\n      // second share it — the body digest stays distinct across differing\n      // events and identical across redeliveries of one event.\n      providerEventId:\n        typeof event.event_id === 'string' && event.event_id.length > 0\n          ? event.event_id\n          : createHash('sha256').update(JSON.stringify(body)).digest('hex'),\n      receivedAt: now ?? Date.now(),\n      payload: body,\n      headers: normalizeHeaders(headers),\n    }]\n  },\n  eventCatalog: {\n    // Dropbox Sign namespaces every event `hellosign.<event_type>`. Documented\n    // set as hints; namespace is the authoritative gate. `callback_test` (the\n    // app-config ping) is intentionally excluded — it is not a workflow event.\n    namespace: 'hellosign.',\n    closed: false,\n    events: [\n      { id: 'hellosign.signature_request_sent' },\n      { id: 'hellosign.signature_request_viewed' },\n      { id: 'hellosign.signature_request_signed' },\n      { id: 'hellosign.signature_request_all_signed' },\n      { id: 'hellosign.signature_request_declined' },\n      { id: 'hellosign.signature_request_reassigned' },\n      { id: 'hellosign.signature_request_remind' },\n      { id: 'hellosign.signature_request_canceled' },\n      { id: 'hellosign.signature_request_expired' },\n    ],\n  },\n}\n\n/** Keys Clay HTTP-API-action payloads commonly carry that can anchor\n *  idempotency, in resolution order. Clay bodies are operator-defined, so we\n *  fall back to a digest of the raw body when none is present. */\nconst CLAY_EVENT_ID_KEYS = ['id', 'rowId', 'recordId', 'clayRowId', 'eventId'] as const\n\n/** Clay webhook provider — receives rows Clay delivers via its outbound \"HTTP\n *  API\" action. Clay does NOT sign its requests and adds no proprietary\n *  headers (the `x-clay-signature: sha256=...` header seen in some third-party\n *  code is unverified inference, not in Clay's docs). Authentication is\n *  therefore a pre-shared secret the operator adds as a header on the Clay\n *  action; we compare it constant-time against the per-connection secret.\n *  Header: `x-clay-webhook-secret`. The body is whatever columns the operator\n *  mapped (free-form JSON with no canonical event id), so idempotency anchors\n *  on a common id field when present, else a sha256 of the raw body. */\nexport const clayWebhookProvider: WebhookProvider = {\n  id: 'clay',\n  verifySignature({ headers, secret }): SignatureVerification {\n    const token = firstHeader(headers, 'x-clay-webhook-secret')\n    if (!token) return { valid: false, reason: 'missing_clay_webhook_secret' }\n    const a = Buffer.from(token, 'utf-8')\n    const b = Buffer.from(secret, 'utf-8')\n    if (a.length !== b.length) return { valid: false, reason: 'invalid_signature' }\n    return timingSafeEqual(a, b) ? { valid: true } : { valid: false, reason: 'invalid_signature' }\n  },\n  parse({ rawBody, headers, now }): WebhookEnvelope[] {\n    const evt = safeJson(rawBody)\n    if (!evt || typeof evt !== 'object') return []\n    const record = evt as Record<string, unknown>\n    const idKey = CLAY_EVENT_ID_KEYS.find(\n      (k) => typeof record[k] === 'string' || typeof record[k] === 'number',\n    )\n    const providerEventId = idKey\n      ? String(record[idKey])\n      : createHash('sha256').update(rawBody).digest('hex')\n    const eventType =\n      typeof record.event === 'string'\n        ? `clay.${record.event}`\n        : typeof record.type === 'string'\n          ? `clay.${record.type}`\n          : 'clay.row'\n    return [{\n      provider: 'clay',\n      eventType,\n      providerEventId,\n      receivedAt: now ?? Date.now(),\n      payload: evt,\n      headers: normalizeHeaders(headers),\n    }]\n  },\n}\n\ninterface HelloSignInboundBody {\n  event?: {\n    event_time?: string\n    event_type?: string\n    event_hash?: string\n    event_id?: string\n  }\n}\n\n/** Dropbox Sign posts JSON, a form-urlencoded `json=` field, or a\n *  multipart `name=\"json\"` part depending on app vintage. Mirrors the\n *  connector adapter's body extraction. */\nfunction parseHelloSignBody(rawBody: string): HelloSignInboundBody | null {\n  try {\n    const json = JSON.parse(rawBody) as HelloSignInboundBody\n    if (json && typeof json === 'object') return json\n  } catch {\n    // fall through to form-data extraction\n  }\n  // application/x-www-form-urlencoded `json=` field. URLSearchParams decodes\n  // `+` as a space (decodeURIComponent leaves it literal) and resolves\n  // percent-escapes, so space-bearing string fields aren't corrupted.\n  const formJson = new URLSearchParams(rawBody).get('json')\n  if (formJson) {\n    try {\n      return JSON.parse(formJson) as HelloSignInboundBody\n    } catch {\n      return null\n    }\n  }\n  // multipart/form-data with a `name=\"json\"` part. Extract linearly (indexOf +\n  // fixed-shape separator probes, no unbounded lazy regex) so a hostile body\n  // can't drive quadratic backtracking on this public ingress.\n  return extractMultipartJsonField(rawBody)\n}\n\n/** Pull the `json` part out of a multipart/form-data body without an\n *  unbounded backtracking regex. Returns null if the part isn't present or\n *  isn't valid JSON. The separator probes (`\\r?\\n\\r?\\n`, `\\r?\\n--`) are\n *  fixed-shape (no `*`/`+`), so each runs in a single linear scan. */\nfunction extractMultipartJsonField(rawBody: string): HelloSignInboundBody | null {\n  const nameIdx = rawBody.indexOf('name=\"json\"')\n  if (nameIdx === -1) return null\n  const afterName = rawBody.slice(nameIdx)\n  const sep = /\\r?\\n\\r?\\n/.exec(afterName)\n  if (!sep) return null\n  const partBody = afterName.slice(sep.index + sep[0].length)\n  const end = /\\r?\\n--/.exec(partBody)\n  if (!end) return null\n  try {\n    return JSON.parse(partBody.slice(0, end.index)) as HelloSignInboundBody\n  } catch {\n    return null\n  }\n}\n\n/** Generic HMAC provider — for the long-tail webhook source where the\n *  caller has standardised on a single sha256-of-body scheme. Header\n *  `X-Signature` by default; override at provider-build time if needed. */\nexport function genericHmacWebhookProvider(options: {\n  id: string\n  signatureHeader?: string\n  algorithm?: 'sha256' | 'sha1' | 'sha512'\n  signaturePrefix?: string\n  /** Parser to convert the raw body into envelopes. Defaults to\n   *  \"one event with eventType=<provider>.event and payload=JSON\". */\n  parse?: WebhookProvider['parse']\n}): WebhookProvider {\n  const header = options.signatureHeader ?? 'x-signature'\n  return {\n    id: options.id,\n    verifySignature({ rawBody, headers, secret }) {\n      const sig = firstHeader(headers, header)\n      if (!sig) return { valid: false, reason: `missing_${header}` }\n      return verifyHmacSignature(rawBody, sig, secret, {\n        algorithm: options.algorithm ?? 'sha256',\n        signaturePrefix: options.signaturePrefix,\n      })\n        ? { valid: true }\n        : { valid: false, reason: 'invalid_signature' }\n    },\n    parse:\n      options.parse ??\n      (({ rawBody, headers, now }) => {\n        const evt = safeJson(rawBody) ?? rawBody\n        return [{\n          provider: options.id,\n          eventType: `${options.id}.event`,\n          receivedAt: now ?? Date.now(),\n          payload: evt,\n          headers: normalizeHeaders(headers),\n        }]\n      }),\n  }\n}\n\nfunction safeJson(s: string): unknown {\n  try {\n    return JSON.parse(s)\n  } catch {\n    return null\n  }\n}\n\nfunction normalizeHeaders(headers: WebhookHeaders): Record<string, string> {\n  const out: Record<string, string> = {}\n  for (const [k, v] of Object.entries(headers)) {\n    if (v === undefined) continue\n    const value = Array.isArray(v) ? v[0] : v\n    if (typeof value === 'string') out[k.toLowerCase()] = value\n  }\n  return out\n}\n"],"mappings":";;;;;;;;;;AAiLO,IAAM,gBAAN,MAAoB;AAAA,EACR;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,MAA4B;AACtC,SAAK,YAAY,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAC7D,SAAK,UAAU,KAAK;AACpB,SAAK,gBAAgB,KAAK;AAC1B,SAAK,cAAc,KAAK;AACxB,SAAK,mBAAmB,KAAK,oBAAoB,IAAI,KAAK,KAAK,KAAK;AACpE,SAAK,UAAU,KAAK,WAAW;AAC/B,SAAK,QAAQ,KAAK,OAAO,KAAK;AAAA,EAChC;AAAA;AAAA;AAAA,EAIA,MAAM,OAAO,SAA+D;AAC1E,UAAM,WAAW,KAAK,UAAU,IAAI,QAAQ,UAAU;AACtD,QAAI,CAAC,UAAU;AACb,aAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,oBAAoB,UAAU,QAAQ,WAAW,EAAE;AAAA,IAC1F;AACA,UAAM,SAAS,MAAM,KAAK,cAAc,SAAS,IAAI,QAAQ,OAAO;AACpE,QAAI,CAAC,QAAQ;AACX,aAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,kBAAkB,UAAU,SAAS,GAAG,EAAE;AAAA,IACjF;AACA,UAAM,eAAe,SAAS,gBAAgB;AAAA,MAC5C,SAAS,QAAQ;AAAA,MACjB,SAAS,QAAQ;AAAA,MACjB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,aAAa,OAAO;AACvB,aAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,qBAAqB,QAAQ,aAAa,OAAO,EAAE;AAAA,IAC1F;AAEA,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,SAAS,MAAM,EAAE,SAAS,QAAQ,SAAS,SAAS,QAAQ,SAAS,KAAK,KAAK,MAAM,EAAE,CAAC;AAAA,IACzG,SAAS,KAAK;AACZ,WAAK,QAAQ,KAAK,EAAE,UAAU,SAAS,GAAG,CAAC;AAC3C,aAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,OAAO,eAAe,SAAS,WAAW,GAAG,EAAE,EAAE;AAAA,IACjF;AAEA,UAAM,WAA8B,CAAC;AACrC,eAAW,SAAS,QAAQ;AAC1B,UAAI,MAAM,mBAAmB,KAAK,aAAa;AAC7C,cAAM,UAAU,MAAM,KAAK,YAAY,KAAK,MAAM,eAAe;AACjE,YAAI,QAAS;AAAA,MACf;AACA,eAAS,KAAK,KAAK;AAAA,IACrB;AAKA,mBAAe,MAAM;AACnB,WAAK,KAAK,YAAY,QAAQ;AAAA,IAChC,CAAC;AAED,QAAI,SAAS,iBAAiB;AAC5B,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,MAAM,SAAS,gBAAgB;AAAA,QAC/B,SAAS,SAAS,gBAAgB;AAAA,MACpC;AAAA,IACF;AACA,WAAO,EAAE,QAAQ,KAAK,MAAM,EAAE,UAAU,SAAS,QAAQ,OAAO,OAAO,OAAO,EAAE;AAAA,EAClF;AAAA,EAEA,MAAc,YAAY,QAA0C;AAClE,eAAW,SAAS,QAAQ;AAC1B,UAAI;AACF,cAAM,KAAK,QAAQ,KAAK;AACxB,YAAI,MAAM,mBAAmB,KAAK,aAAa;AAC7C,gBAAM,KAAK,YAAY,SAAS,MAAM,iBAAiB,KAAK,gBAAgB;AAAA,QAC9E;AAAA,MACF,SAAS,KAAK;AACZ,aAAK,QAAQ,KAAK;AAAA,UAChB,UAAU,MAAM;AAAA,UAChB,WAAW,MAAM;AAAA,UACjB,iBAAiB,MAAM;AAAA,QACzB,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,eAAe,KAAc,SAAmF;AAEvH,UAAQ,MAAM,mBAAmB,SAAS,GAAG;AAC/C;AAEA,SAAS,WAAW,KAAsB;AACxC,SAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AACxD;;;AC9PA,SAAS,YAAY,YAAY,uBAAuB;AAGjD,IAAM,wBAAyC;AAAA,EACpD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,SAAS,OAAO,GAA0B;AACnE,UAAM,MAAM,YAAY,SAAS,kBAAkB;AACnD,QAAI,CAAC,IAAK,QAAO,EAAE,OAAO,OAAO,QAAQ,2BAA2B;AACpE,WAAO,sBAAsB,SAAS,KAAK,MAAM,IAC7C,EAAE,OAAO,KAAK,IACd,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAClD;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,MAAM,SAAS,OAAO;AAC5B,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAC7C,UAAM,IAAI;AACV,WAAO;AAAA,MACL;AAAA,QACE,UAAU;AAAA,QACV,WAAW,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO;AAAA,QACjD,iBAAiB,OAAO,EAAE,OAAO,WAAW,EAAE,KAAK;AAAA,QACnD,YAAY,OAAO,KAAK,IAAI;AAAA,QAC5B,SAAS;AAAA,QACT,SAAS,iBAAiB,OAAO;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AAAA,EACA,cAAc;AAAA;AAAA;AAAA;AAAA,IAIZ,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,QAAQ;AAAA,MACN,EAAE,IAAI,6BAA6B;AAAA,MACnC,EAAE,IAAI,2BAA2B;AAAA,MACjC,EAAE,IAAI,gCAAgC;AAAA,MACtC,EAAE,IAAI,gCAAgC;AAAA,MACtC,EAAE,IAAI,gCAAgC;AAAA,MACtC,EAAE,IAAI,eAAe;AAAA,MACrB,EAAE,IAAI,yBAAyB;AAAA,MAC/B,EAAE,IAAI,2BAA2B;AAAA,MACjC,EAAE,IAAI,gCAAgC;AAAA,MACtC,EAAE,IAAI,mBAAmB;AAAA,MACzB,EAAE,IAAI,kBAAkB;AAAA,IAC1B;AAAA,EACF;AACF;AAIO,IAAM,uBAAwC;AAAA,EACnD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,SAAS,OAAO,GAA0B;AACnE,UAAM,MAAM,YAAY,SAAS,mBAAmB;AACpD,UAAM,KAAK,YAAY,SAAS,2BAA2B;AAC3D,QAAI,CAAC,OAAO,CAAC,GAAI,QAAO,EAAE,OAAO,OAAO,QAAQ,uCAAuC;AACvF,WAAO,qBAAqB,SAAS,KAAK,IAAI,MAAM,IAChD,EAAE,OAAO,KAAK,IACd,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAClD;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,MAAM,SAAS,OAAO;AAC5B,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAC7C,QAAI,IAAI,SAAS,oBAAoB;AACnC,aAAO,CAAC;AAAA,QACN,UAAU;AAAA,QACV,WAAW;AAAA,QACX,YAAY,OAAO,KAAK,IAAI;AAAA,QAC5B,SAAS;AAAA,QACT,SAAS,iBAAiB,OAAO;AAAA,MACnC,CAAC;AAAA,IACH;AACA,UAAM,YAAY,SAAS,IAAI,OAAO,QAAQ,IAAI,QAAQ,SAAS;AACnE,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV;AAAA,MACA,iBAAiB,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;AAAA,MACnE,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS;AAAA,MACT,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AAAA,EACA,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMZ,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,QAAQ;AAAA,MACN,EAAE,IAAI,gBAAgB;AAAA,MACtB,EAAE,IAAI,oBAAoB;AAAA,MAC1B,EAAE,IAAI,uBAAuB;AAAA,MAC7B,EAAE,IAAI,yBAAyB;AAAA,MAC/B,EAAE,IAAI,wBAAwB;AAAA,MAC9B,EAAE,IAAI,8BAA8B;AAAA,MACpC,EAAE,IAAI,kBAAkB;AAAA,MACxB,EAAE,IAAI,wBAAwB;AAAA,MAC9B,EAAE,IAAI,oBAAoB;AAAA,IAC5B;AAAA,EACF;AACF;AAGO,IAAM,0BAA2C;AAAA,EACtD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,SAAS,OAAO,GAA0B;AACnE,UAAM,MAAM,YAAY,SAAS,sBAAsB;AACvD,QAAI,CAAC,IAAK,QAAO,EAAE,OAAO,OAAO,QAAQ,6BAA6B;AACtE,UAAM,WAAW,WAAW,UAAU,MAAM,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK;AAC1E,UAAM,IAAI,OAAO,KAAK,IAAI,YAAY,GAAG,OAAO;AAChD,UAAM,IAAI,OAAO,KAAK,UAAU,OAAO;AACvC,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAC9E,WAAO,gBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAC/F;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,MAAM,SAAS,OAAO;AAC5B,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAC7C,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV,WAAW,YAAY,IAAI,cAAc,SAAS;AAAA,MAClD,iBAAiB,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;AAAA,MACnE,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS;AAAA,MACT,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AAAA,EACA,cAAc;AAAA;AAAA;AAAA;AAAA,IAIZ,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,QAAQ;AAAA,MACN,EAAE,IAAI,uBAAuB;AAAA,MAC7B,EAAE,IAAI,wBAAwB;AAAA,MAC9B,EAAE,IAAI,0BAA0B;AAAA,MAChC,EAAE,IAAI,yBAAyB;AAAA,MAC/B,EAAE,IAAI,8BAA8B;AAAA,MACpC,EAAE,IAAI,gCAAgC;AAAA,MACtC,EAAE,IAAI,8BAA8B;AAAA,MACpC,EAAE,IAAI,+BAA+B;AAAA,IACvC;AAAA,EACF;AACF;AAmCO,IAAM,uBAAwC;AAAA,EACnD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,SAAS,OAAO,GAA0B;AACnE,UAAM,MAAM,YAAY,SAAS,0BAA0B;AAC3D,QAAI,CAAC,IAAK,QAAO,EAAE,OAAO,OAAO,QAAQ,0BAA0B;AACnE,UAAM,KAAK,YAAY,SAAS,0BAA0B;AAC1D,QAAI,CAAC,GAAI,QAAO,EAAE,OAAO,OAAO,QAAQ,0BAA0B;AAClE,WAAO,qBAAqB,SAAS,KAAK,IAAI,MAAM,IAChD,EAAE,OAAO,KAAK,IACd,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAClD;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,MAAM,SAAS,OAAO;AAC5B,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAI7C,QAAI,OAAO,IAAI,SAAS,YAAY,OAAO,IAAI,OAAO,SAAU,QAAO,CAAC;AACxE,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV,WAAW;AAAA,MACX,iBAAiB,OAAO,IAAI,cAAc,WAAW,IAAI,YAAY;AAAA,MACrE,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS;AAAA,MACT,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AAAA,EACA,cAAc;AAAA;AAAA,IAEZ,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,QAAQ,CAAC,EAAE,IAAI,iBAAiB,CAAC;AAAA,EACnC;AACF;AAQO,IAAM,uBAAwC;AAAA,EACnD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,OAAO,GAA0B;AAC1D,UAAM,OAAO,YAAY,SAAS,eAAe;AACjD,QAAI,CAAC,KAAM,QAAO,EAAE,OAAO,OAAO,QAAQ,wBAAwB;AAKlE,UAAM,IAAI,6BAA6B,KAAK,IAAI;AAChD,QAAI,CAAC,EAAG,QAAO,EAAE,OAAO,OAAO,QAAQ,+BAA+B;AACtE,UAAM,IAAI,OAAO,KAAK,EAAE,CAAC,GAAI,OAAO;AACpC,UAAM,IAAI,OAAO,KAAK,QAAQ,OAAO;AACrC,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAC9E,WAAO,gBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAC/F;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,WAAW,SAAS,OAAO;AACjC,QAAI,CAAC,UAAU,SAAS,KAAM,QAAO,CAAC;AACtC,QAAI;AACJ,QAAI;AACF,gBAAU,KAAK,MAAM,OAAO,KAAK,SAAS,QAAQ,MAAM,QAAQ,EAAE,SAAS,OAAO,CAAC;AAAA,IACrF,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AACA,UAAM,QAAQ;AACd,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV,WAAW;AAAA,MACX,iBAAiB,SAAS,QAAQ;AAAA,MAClC,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS,EAAE,GAAG,OAAO,aAAa,SAAS,QAAQ,YAAY;AAAA,MAC/D,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AACF;AAKO,IAAM,wBAAyC;AAAA,EACpD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,OAAO,GAA0B;AAC1D,UAAM,QAAQ,YAAY,SAAS,sBAAsB;AACzD,QAAI,CAAC,MAAO,QAAO,EAAE,OAAO,OAAO,QAAQ,wBAAwB;AACnE,UAAM,IAAI,OAAO,KAAK,OAAO,OAAO;AACpC,UAAM,IAAI,OAAO,KAAK,QAAQ,OAAO;AACrC,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAC9E,WAAO,gBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAC/F;AAAA,EACA,MAAM,EAAE,SAAS,IAAI,GAAsB;AACzC,UAAM,aAAa,YAAY,SAAS,oBAAoB;AAC5D,UAAM,gBAAgB,YAAY,SAAS,uBAAuB,KAAK;AACvE,UAAM,YAAY,YAAY,SAAS,mBAAmB;AAC1D,UAAM,gBAAgB,YAAY,SAAS,uBAAuB;AAClE,QAAI,kBAAkB,QAAQ;AAC5B,aAAO,CAAC;AAAA,QACN,UAAU;AAAA,QACV,WAAW;AAAA,QACX,iBAAiB,gBAAgB,GAAG,SAAS,IAAI,aAAa,KAAK;AAAA,QACnE,YAAY,OAAO,KAAK,IAAI;AAAA,QAC5B,SAAS,EAAE,WAAW,YAAY,cAAc;AAAA,QAChD,SAAS,iBAAiB,OAAO;AAAA,MACnC,CAAC;AAAA,IACH;AACA,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV,WAAW,mBAAmB,aAAa;AAAA,MAC3C,iBAAiB,gBAAgB,GAAG,SAAS,IAAI,aAAa,KAAK;AAAA,MACnE,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS,EAAE,WAAW,YAAY,cAAc;AAAA,MAChD,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AACF;AAIA,IAAM,uBAAuB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAMO,IAAM,0BAA2C;AAAA,EACtD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,OAAO,GAA0B;AAC1D,UAAM,QAAQ,YAAY,SAAS,iCAAiC;AACpE,QAAI,CAAC,MAAO,QAAO,EAAE,OAAO,OAAO,QAAQ,gCAAgC;AAC3E,UAAM,IAAI,OAAO,KAAK,OAAO,OAAO;AACpC,UAAM,IAAI,OAAO,KAAK,QAAQ,OAAO;AACrC,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,OAAO,OAAO,QAAQ,uBAAuB;AACjF,WAAO,gBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,OAAO,QAAQ,uBAAuB;AAAA,EAClG;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,MAAM,SAAS,OAAO;AAC5B,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAC7C,UAAM,OAAO,qBAAqB,KAAK,CAAC,MAAM,KAAK,GAAG,KAAK;AAC3D,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV,WAAW,YAAY,IAAI;AAAA,MAC3B,iBAAiB,OAAO,IAAI,cAAc,WAAW,OAAO,IAAI,SAAS,IAAI;AAAA,MAC7E,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS;AAAA,MACT,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AAAA,EACA,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA,IAKZ,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,QAAQ,qBAAqB,IAAI,CAAC,OAAO,EAAE,IAAI,YAAY,CAAC,GAAG,EAAE;AAAA,EACnE;AACF;AAOO,IAAM,2BAA4C;AAAA,EACvD,IAAI;AAAA;AAAA;AAAA,EAGJ,iBAAiB,EAAE,MAAM,4BAA4B,SAAS,EAAE,gBAAgB,aAAa,EAAE;AAAA,EAC/F,gBAAgB,EAAE,SAAS,OAAO,GAA0B;AAC1D,UAAM,OAAO,mBAAmB,OAAO;AACvC,UAAM,QAAQ,MAAM;AACpB,QACE,CAAC,SACD,OAAO,MAAM,eAAe,YAC5B,OAAO,MAAM,eAAe,YAC5B,OAAO,MAAM,eAAe,UAC5B;AACA,aAAO,EAAE,OAAO,OAAO,QAAQ,uBAAuB;AAAA,IACxD;AACA,UAAM,WAAW,WAAW,UAAU,MAAM,EACzC,OAAO,GAAG,MAAM,UAAU,GAAG,MAAM,UAAU,EAAE,EAC/C,OAAO,KAAK;AACf,UAAM,IAAI,OAAO,KAAK,MAAM,WAAW,YAAY,GAAG,OAAO;AAC7D,UAAM,IAAI,OAAO,KAAK,SAAS,YAAY,GAAG,OAAO;AACrD,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAC9E,WAAO,gBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAC/F;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,OAAO,mBAAmB,OAAO;AACvC,UAAM,QAAQ,MAAM;AACpB,QAAI,CAAC,MAAO,QAAO,CAAC;AACpB,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV,WAAW,aAAa,MAAM,cAAc,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOrD,iBACE,OAAO,MAAM,aAAa,YAAY,MAAM,SAAS,SAAS,IAC1D,MAAM,WACN,WAAW,QAAQ,EAAE,OAAO,KAAK,UAAU,IAAI,CAAC,EAAE,OAAO,KAAK;AAAA,MACpE,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS;AAAA,MACT,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AAAA,EACA,cAAc;AAAA;AAAA;AAAA;AAAA,IAIZ,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,QAAQ;AAAA,MACN,EAAE,IAAI,mCAAmC;AAAA,MACzC,EAAE,IAAI,qCAAqC;AAAA,MAC3C,EAAE,IAAI,qCAAqC;AAAA,MAC3C,EAAE,IAAI,yCAAyC;AAAA,MAC/C,EAAE,IAAI,uCAAuC;AAAA,MAC7C,EAAE,IAAI,yCAAyC;AAAA,MAC/C,EAAE,IAAI,qCAAqC;AAAA,MAC3C,EAAE,IAAI,uCAAuC;AAAA,MAC7C,EAAE,IAAI,sCAAsC;AAAA,IAC9C;AAAA,EACF;AACF;AAKA,IAAM,qBAAqB,CAAC,MAAM,SAAS,YAAY,aAAa,SAAS;AAWtE,IAAM,sBAAuC;AAAA,EAClD,IAAI;AAAA,EACJ,gBAAgB,EAAE,SAAS,OAAO,GAA0B;AAC1D,UAAM,QAAQ,YAAY,SAAS,uBAAuB;AAC1D,QAAI,CAAC,MAAO,QAAO,EAAE,OAAO,OAAO,QAAQ,8BAA8B;AACzE,UAAM,IAAI,OAAO,KAAK,OAAO,OAAO;AACpC,UAAM,IAAI,OAAO,KAAK,QAAQ,OAAO;AACrC,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAC9E,WAAO,gBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,EAC/F;AAAA,EACA,MAAM,EAAE,SAAS,SAAS,IAAI,GAAsB;AAClD,UAAM,MAAM,SAAS,OAAO;AAC5B,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC;AAC7C,UAAM,SAAS;AACf,UAAM,QAAQ,mBAAmB;AAAA,MAC/B,CAAC,MAAM,OAAO,OAAO,CAAC,MAAM,YAAY,OAAO,OAAO,CAAC,MAAM;AAAA,IAC/D;AACA,UAAM,kBAAkB,QACpB,OAAO,OAAO,KAAK,CAAC,IACpB,WAAW,QAAQ,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK;AACrD,UAAM,YACJ,OAAO,OAAO,UAAU,WACpB,QAAQ,OAAO,KAAK,KACpB,OAAO,OAAO,SAAS,WACrB,QAAQ,OAAO,IAAI,KACnB;AACR,WAAO,CAAC;AAAA,MACN,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA,YAAY,OAAO,KAAK,IAAI;AAAA,MAC5B,SAAS;AAAA,MACT,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AAAA,EACH;AACF;AAcA,SAAS,mBAAmB,SAA8C;AACxE,MAAI;AACF,UAAM,OAAO,KAAK,MAAM,OAAO;AAC/B,QAAI,QAAQ,OAAO,SAAS,SAAU,QAAO;AAAA,EAC/C,QAAQ;AAAA,EAER;AAIA,QAAM,WAAW,IAAI,gBAAgB,OAAO,EAAE,IAAI,MAAM;AACxD,MAAI,UAAU;AACZ,QAAI;AACF,aAAO,KAAK,MAAM,QAAQ;AAAA,IAC5B,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAIA,SAAO,0BAA0B,OAAO;AAC1C;AAMA,SAAS,0BAA0B,SAA8C;AAC/E,QAAM,UAAU,QAAQ,QAAQ,aAAa;AAC7C,MAAI,YAAY,GAAI,QAAO;AAC3B,QAAM,YAAY,QAAQ,MAAM,OAAO;AACvC,QAAM,MAAM,aAAa,KAAK,SAAS;AACvC,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,WAAW,UAAU,MAAM,IAAI,QAAQ,IAAI,CAAC,EAAE,MAAM;AAC1D,QAAM,MAAM,UAAU,KAAK,QAAQ;AACnC,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,WAAO,KAAK,MAAM,SAAS,MAAM,GAAG,IAAI,KAAK,CAAC;AAAA,EAChD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKO,SAAS,2BAA2B,SAQvB;AAClB,QAAM,SAAS,QAAQ,mBAAmB;AAC1C,SAAO;AAAA,IACL,IAAI,QAAQ;AAAA,IACZ,gBAAgB,EAAE,SAAS,SAAS,OAAO,GAAG;AAC5C,YAAM,MAAM,YAAY,SAAS,MAAM;AACvC,UAAI,CAAC,IAAK,QAAO,EAAE,OAAO,OAAO,QAAQ,WAAW,MAAM,GAAG;AAC7D,aAAO,oBAAoB,SAAS,KAAK,QAAQ;AAAA,QAC/C,WAAW,QAAQ,aAAa;AAAA,QAChC,iBAAiB,QAAQ;AAAA,MAC3B,CAAC,IACG,EAAE,OAAO,KAAK,IACd,EAAE,OAAO,OAAO,QAAQ,oBAAoB;AAAA,IAClD;AAAA,IACA,OACE,QAAQ,UACP,CAAC,EAAE,SAAS,SAAS,IAAI,MAAM;AAC9B,YAAM,MAAM,SAAS,OAAO,KAAK;AACjC,aAAO,CAAC;AAAA,QACN,UAAU,QAAQ;AAAA,QAClB,WAAW,GAAG,QAAQ,EAAE;AAAA,QACxB,YAAY,OAAO,KAAK,IAAI;AAAA,QAC5B,SAAS;AAAA,QACT,SAAS,iBAAiB,OAAO;AAAA,MACnC,CAAC;AAAA,IACH;AAAA,EACJ;AACF;AAEA,SAAS,SAAS,GAAoB;AACpC,MAAI;AACF,WAAO,KAAK,MAAM,CAAC;AAAA,EACrB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,iBAAiB,SAAiD;AACzE,QAAM,MAA8B,CAAC;AACrC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC5C,QAAI,MAAM,OAAW;AACrB,UAAM,QAAQ,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI;AACxC,QAAI,OAAO,UAAU,SAAU,KAAI,EAAE,YAAY,CAAC,IAAI;AAAA,EACxD;AACA,SAAO;AACT;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-integrations",
-  "version": "0.47.0",
+  "version": "0.49.0",
   "description": "Vendor-neutral integration contracts and runtime helpers for sandbox and agent apps.",
   "homepage": "https://github.com/tangle-network/agent-integrations#readme",
   "repository": {
@@ -104,7 +104,8 @@
     "@types/node": "^25.6.0",
     "tsup": "^8.0.0",
     "typescript": "^5.7.0",
-    "vitest": "^3.0.0"
+    "vite": "^8.1.2",
+    "vitest": "^4.1.9"
   },
   "engines": {
     "node": ">=20"