@trigger.dev/core 0.0.0-buffer-fix-20231206151546 → 0.0.0-bun-prerelease-20260909132648

package/dist/esm/v3/schemas/webhookConfig.js

@@ -0,0 +1,166 @@
+import { z } from "zod/v4";
+import { discriminatedUnion } from "../utils/zod.js";
+// Ingress webhook verification config. Kept in a LEAF module (imports only `z` and
+// the Zod compatibility helper) so it can be consumed by resources.ts / schemas.ts without dragging in the alert-webhook
+// `Webhook` union in webhooks.ts, which imports api.js (RunStatus). resources.ts is
+// imported by api.ts, so a resources -> webhooks -> api edge would be a module-init cycle.
+// Who supplies the signing secret / key, driving the dashboard Connect UI (NOT a provider-name
+// switch — it's data on the source). "provider": the provider generates it and you paste it in
+// (Stripe, Slack, Svix). "integrator": you choose it, so the dashboard can generate-and-reveal one
+// for you to paste into the provider (GitHub, GitLab). "either": offer both.
+export const WebhookSecretProvisioning = z.enum(["provider", "integrator", "either"]);
+// Q9: the provider delivery id can live in a header (GitHub x-github-delivery) or the body (Stripe id).
+export const WebhookIdempotencyField = z.object({
+    from: z.enum(["header", "body"]),
+    name: z.string(),
+});
+// ── Shared, data-only verification primitives (no per-provider code) ──
+// Where a scalar value comes from. Used for the timestamp and for signing-string template vars.
+// "signatureField" reads a field parsed out of the signature header (e.g. Stripe `t`).
+// "url" is the inbound request URL (e.g. Square signs `{url}{body}`). "constant" is a literal.
+export const WebhookValueSource = discriminatedUnion("from", [
+    z.object({ from: z.literal("header"), name: z.string() }),
+    z.object({ from: z.literal("signatureField"), field: z.string() }),
+    z.object({ from: z.literal("body"), path: z.string() }),
+    z.object({ from: z.literal("url") }),
+    z.object({ from: z.literal("constant"), value: z.string() }),
+]);
+// How to pull the signature value(s) out of one header. All fields optional → the whole
+// header value IS the signature (Shopify, Linear). With fieldSeparator+field we select
+// named element(s): GitHub `sha256=<hex>`, Stripe `t=…,v1=…`, Svix `v1,<b64> v1,<b64>`.
+// Field extraction is multi-valued (rotation / signature lists) → the verifier accepts ANY match.
+export const WebhookSignatureExtraction = z.object({
+    itemSeparator: z.string().optional(), // split header into elements: Stripe "," · Svix " "
+    fieldSeparator: z.string().optional(), // split element into name<sep>value: "=" · Svix ","
+    field: z.string().optional(), // element name carrying the signature: "v1" | "sha256" | "v0"
+    trim: z.boolean().optional(), // trim each element (WorkOS "t=…, v1=…")
+});
+// Replay protection + a `{timestamp}` template var. Source is a header, an in-signature field
+// (Stripe `t`), or a body field (Linear `webhookTimestamp`). Unit defaults to seconds.
+export const WebhookTimestampConfig = z.object({
+    source: WebhookValueSource,
+    unit: z.enum(["seconds", "milliseconds"]).optional(),
+    toleranceSeconds: z.number().optional(),
+});
+// The stored credential transform. Most providers use the secret as-is (utf8). Svix-family
+// secrets are `whsec_<base64>` and must be base64-decoded after stripping the prefix.
+export const WebhookSecretTransform = z.object({
+    encoding: z.enum(["utf8", "base64"]).optional(),
+    stripPrefix: z.string().optional(),
+});
+// The bytes that get signed. "raw" = the body verbatim. Otherwise a template with `{body}`,
+// `{timestamp}` (auto-bound) and any named `vars` (e.g. `{id}` for Svix, `{url}` for Square).
+export const WebhookSigningString = z.union([
+    z.literal("raw"),
+    z.object({
+        template: z.string(),
+        vars: z.record(z.string(), WebhookValueSource).optional(),
+    }),
+]);
+/**
+ * Body-parsing hint. Some providers send an event as JSON but a SECOND kind of callback (e.g. Slack
+ * interactivity) as `application/x-www-form-urlencoded` with the JSON in a single field (Slack: `payload`).
+ * When JSON parsing fails, the engine form-decodes and JSON-parses `field`'s value. The signature is over
+ * the raw body either way, so verification is unaffected. Generic (a field name), no provider code in the engine.
+ */
+export const WebhookFormPayload = z.object({
+    field: z.string(),
+});
+export const WebhookHmacConfig = z.object({
+    scheme: z.literal("hmac"),
+    algorithm: z.enum(["sha256", "sha1"]),
+    encoding: z.enum(["hex", "base64"]), // explicit, no auto-detect (design decision 3)
+    signatureHeader: z.string(),
+    signature: WebhookSignatureExtraction.optional(), // omit = bare whole-header value
+    timestamp: WebhookTimestampConfig.optional(),
+    signingString: WebhookSigningString,
+    secret: WebhookSecretTransform.optional(), // omit = utf8, no prefix strip
+    idempotencyField: WebhookIdempotencyField.optional(),
+    formPayload: WebhookFormPayload.optional(),
+});
+// Asymmetric (public-key) signatures: the provider signs with a private key, we verify with
+// their public key. Same parsing/template primitives as HMAC; only the final verify differs.
+// Covers Discord (ed25519), SendGrid (ecdsa-p256), RSA providers. Dynamic key fetch (PayPal
+// cert URL / JWKS) is out of scope → the custom-bundle escape hatch.
+export const WebhookAsymmetricConfig = z.object({
+    scheme: z.literal("asymmetric"),
+    algorithm: z.enum(["ed25519", "ecdsa-p256", "rsa-sha256"]),
+    encoding: z.enum(["hex", "base64"]), // how the signature value is encoded
+    signatureHeader: z.string(),
+    signature: WebhookSignatureExtraction.optional(),
+    timestamp: WebhookTimestampConfig.optional(),
+    signingString: WebhookSigningString,
+    // How the stored public key is encoded: a PEM string, base64 of DER SPKI (SendGrid),
+    // or raw key bytes (ed25519 raw, Discord). Defaults to "pem".
+    publicKeyEncoding: z.enum(["pem", "spki-der-base64", "raw-hex", "raw-base64"]).optional(),
+    idempotencyField: WebhookIdempotencyField.optional(),
+});
+export const WebhookSharedSecretConfig = z.object({
+    scheme: z.literal("shared-secret"),
+    placement: z.enum(["header", "bearer", "basic", "body"]),
+    fieldName: z.string().optional(),
+    idempotencyField: WebhookIdempotencyField.optional(),
+});
+export const WebhookUrlSecretConfig = z.object({
+    scheme: z.literal("url-secret"),
+    placement: z.enum(["query", "path"]),
+    paramName: z.string(),
+    idempotencyField: WebhookIdempotencyField.optional(),
+});
+export const WebhookVerifierConfig = discriminatedUnion("scheme", [
+    WebhookHmacConfig,
+    WebhookSharedSecretConfig,
+    WebhookUrlSecretConfig,
+    WebhookAsymmetricConfig,
+]);
+// ── Provider handshake: a signed request that must get a synchronous echo, not a recorded/routed
+// delivery (Slack url_verification, Discord PING). Generic + data-only: if the verified body's
+// `matchPath` equals `matchValue`, ingest responds 200 with the body's `respondPath` value. ──
+export const WebhookHandshakeConfig = z.object({
+    matchPath: z.string(), // dotted path into the body, e.g. "type"
+    matchValue: z.string(), // e.g. "url_verification"
+    respondPath: z.string(), // dotted path to echo, e.g. "challenge"
+});
+// ── Verifier artifact: data-only tagged union stored on WebhookEndpoint.verifierArtifact ──
+export const WebhookVerifierArtifact = discriminatedUnion("kind", [
+    z.object({
+        kind: z.literal("config"),
+        config: WebhookVerifierConfig,
+        handshake: WebhookHandshakeConfig.optional(),
+    }),
+    z.object({
+        kind: z.literal("preset"),
+        preset: z.string(),
+        config: WebhookVerifierConfig,
+        handshake: WebhookHandshakeConfig.optional(),
+    }),
+    z.object({ kind: z.literal("bundle"), bundleUrl: z.string(), hash: z.string() }), // P3 seam
+]);
+// ── Routing target: data-only tagged union stored on WebhookEndpoint.routingTarget ──
+// P1 implements only { type: "task" }. The session variant routes a delivery to a find-or-created
+// session: keyTemplate resolves the externalId, deliverAs selects the mode. "action" (chat.event)
+// carries actionType → the onAction envelope's action.type; "message" (channels) carries connectorId
+// → the run resolves the connector's inbound() mapper and runs a turn.
+export const WebhookRoutingTarget = discriminatedUnion("type", [
+    z.object({ type: z.literal("task"), taskId: z.string() }),
+    z.object({
+        type: z.literal("session"),
+        taskIdentifier: z.string(),
+        keyTemplate: z.string(),
+        deliverAs: z.enum(["action", "message"]),
+        actionType: z.string().optional(),
+        connectorId: z.string().optional(),
+        triggerConfigTemplate: z.record(z.string(), z.unknown()).optional(),
+        // Gate session CREATION: an event that already resolves to an existing session always resumes it,
+        // but a key with no session is only started when the event matches this filter. Absent => always start.
+        startOn: z.string().optional(),
+    }),
+]);
+// ── Data-only verdict the engine verifier returns (M5 consumes) ──
+export const WebhookVerifierResult = z.object({
+    ok: z.boolean(),
+    idempotencyKey: z.string(),
+    parsedEvent: z.unknown().optional(),
+    error: z.string().optional(),
+});
+//# sourceMappingURL=webhookConfig.js.map

package/dist/esm/v3/schemas/webhookConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhookConfig.js","sourceRoot":"","sources":["../../../../src/v3/schemas/webhookConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,mFAAmF;AACnF,yHAAyH;AACzH,oFAAoF;AACpF,2FAA2F;AAE3F,+FAA+F;AAC/F,+FAA+F;AAC/F,mGAAmG;AACnG,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGtF,wGAAwG;AACxG,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAGH,yEAAyE;AAEzE,gGAAgG;AAChG,uFAAuF;AACvF,+FAA+F;AAC/F,MAAM,CAAC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,MAAM,EAAE;IAC3D,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACzD,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAClE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACvD,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IACpC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CAC7D,CAAC,CAAC;AAGH,wFAAwF;AACxF,uFAAuF;AACvF,wFAAwF;AACxF,kGAAkG;AAClG,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,oDAAoD;IAC1F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,oDAAoD;IAC3F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,8DAA8D;IAC5F,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,yCAAyC;CACxE,CAAC,CAAC;AAGH,8FAA8F;AAC9F,uFAAuF;AACvF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,kBAAkB;IAC1B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAGH,2FAA2F;AAC3F,sFAAsF;AACtF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH,4FAA4F;AAC5F,8FAA8F;AAC9F,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC;IAC1C,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAChB,CAAC,CAAC,MAAM,CAAC;QACP,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE;KAC1D,CAAC;CACH,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,EAAE,+CAA+C;IACpF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE,EAAE,iCAAiC;IACnF,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC5C,aAAa,EAAE,oBAAoB;IACnC,MAAM,EAAE,sBAAsB,CAAC,QAAQ,EAAE,EAAE,+BAA+B;IAC1E,gBAAgB,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IACpD,WAAW,EAAE,kBAAkB,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAGH,4FAA4F;AAC5F,6FAA6F;AAC7F,4FAA4F;AAC5F,qEAAqE;AACrE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC/B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;IAC1D,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,EAAE,qCAAqC;IAC1E,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,SAAS,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAChD,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC5C,aAAa,EAAE,oBAAoB;IACnC,qFAAqF;IACrF,8DAA8D;IAC9D,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzF,gBAAgB,EAAE,uBAAuB,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAClC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACxD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,gBAAgB,EAAE,uBAAuB,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC/B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,gBAAgB,EAAE,uBAAuB,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC,QAAQ,EAAE;IAChE,iBAAiB;IACjB,yBAAyB;IACzB,sBAAsB;IACtB,uBAAuB;CACxB,CAAC,CAAC;AAGH,kGAAkG;AAClG,+FAA+F;AAC/F,+FAA+F;AAC/F,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,yCAAyC;IAChE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,0BAA0B;IAClD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,wCAAwC;CAClE,CAAC,CAAC;AAGH,6FAA6F;AAC7F,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAC,MAAM,EAAE;IAChE,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,MAAM,EAAE,qBAAqB;QAC7B,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE;KAC7C,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,MAAM,EAAE,qBAAqB;QAC7B,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE;KAC7C,CAAC;IACF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,UAAU;CAC7F,CAAC,CAAC;AAGH,uFAAuF;AACvF,kGAAkG;AAClG,kGAAkG;AAClG,qGAAqG;AACrG,uEAAuE;AACvE,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,MAAM,EAAE;IAC7D,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACzD,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACxC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;QACnE,kGAAkG;QAClG,wGAAwG;QACxG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC/B,CAAC;CACH,CAAC,CAAC;AAGH,oEAAoE;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;IACf,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC"}

package/dist/esm/v3/schemas/webhookFilter.d.ts

@@ -0,0 +1,95 @@
+import { z } from "zod/v4";
+export declare const FilterOp: z.ZodEnum<{
+    contains: "contains";
+    endsWith: "endsWith";
+    eq: "eq";
+    gt: "gt";
+    gte: "gte";
+    in: "in";
+    lt: "lt";
+    lte: "lte";
+    neq: "neq";
+    nin: "nin";
+    startsWith: "startsWith";
+}>;
+export type FilterOp = z.infer<typeof FilterOp>;
+export declare const FilterScalar: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>;
+export type FilterScalar = z.infer<typeof FilterScalar>;
+export declare const FilterValue: z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>, z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>]>;
+export type FilterValue = z.infer<typeof FilterValue>;
+export type FilterAst = {
+    kind: "and";
+    clauses: FilterAst[];
+} | {
+    kind: "or";
+    clauses: FilterAst[];
+} | {
+    kind: "clause";
+    path: string;
+    op: FilterOp;
+    value?: FilterValue;
+    valueRef?: string;
+} | {
+    kind: "quantifier";
+    mode: "any" | "all";
+    path: string;
+    clause: {
+        path: string;
+        op: FilterOp;
+        value: FilterValue;
+    };
+};
+export declare const FILTER_AST_VERSION = 1;
+export declare const FilterAst: z.ZodType<FilterAst>;
+export type WebhookFilterMeta = {
+    externalRef: string;
+    tenantId: string;
+    id: string;
+    source: string;
+    deliveryId: string;
+};
+type FilterError<M extends string> = `✖ ${M}`;
+type Invalid = {
+    readonly "~webhookFilterInvalid": true;
+};
+type PathValue<T, P extends string> = P extends `${infer H}.${infer R}` ? H extends keyof T ? PathValue<NonNullable<T[H]>, R> : Invalid : P extends keyof T ? NonNullable<T[P]> : Invalid;
+type ResolveFilterPath<TEvent, P extends string> = P extends `event.${infer R}` ? PathValue<TEvent, R> : P extends `header.${string}` ? string : P extends `webhook.${infer R}` ? PathValue<WebhookFilterMeta, R> : Invalid;
+type FilterLiteralType<Lit extends string> = Lit extends `'${infer S}'` ? S : Lit extends `${infer N extends number}` ? N : Lit extends "true" ? true : Lit extends "false" ? false : Lit extends "null" ? null : Invalid;
+type CheckValue<F, Lit extends string, P extends string> = [FilterLiteralType<Lit>] extends [
+    Invalid
+] ? FilterError<`cannot parse value: ${Lit}`> : [FilterLiteralType<Lit>] extends [F] ? true : FilterError<`value ${Lit} is not valid for ${P}`>;
+type CheckNum<F, Lit extends string, P extends string> = [F] extends [number] ? Lit extends `${number}` ? true : FilterError<`${P} needs a number`> : FilterError<`${P} is not numeric`>;
+type CheckStr<F, Lit extends string, P extends string> = [F] extends [string] ? Lit extends `'${string}'` ? true : FilterError<`${P} op needs a string literal`> : FilterError<`${P} is not a string`>;
+type CheckInItems<F, Items extends string, P extends string> = Items extends `${infer Head},${infer Tail}` ? CheckValue<F, Head, P> extends true ? CheckInItems<F, Tail, P> : CheckValue<F, Head, P> : CheckValue<F, Items, P>;
+type CheckIn<F, Lit extends string, P extends string> = Lit extends `[${infer Items}]` ? CheckInItems<F, Items, P> : FilterError<`${P} "in" expects a [list]`>;
+type CheckOp<F, Op extends string, Lit extends string, P extends string> = Op extends "==" | "!=" ? CheckValue<F, Lit, P> : Op extends ">" | "<" | ">=" | "<=" ? CheckNum<F, Lit, P> : Op extends "startsWith" | "endsWith" | "contains" ? CheckStr<F, Lit, P> : Op extends "in" ? CheckIn<F, Lit, P> : FilterError<`unknown operator: ${Op}`>;
+type IsFilterPath<S extends string> = S extends `event.${string}` | `header.${string}` | `webhook.${string}` ? true : false;
+type CheckFieldToField<TEvent, F, Op extends string, Rhs extends string, P extends string> = Op extends "==" | "!=" | ">" | "<" | ">=" | "<=" ? ResolveFilterPath<TEvent, Rhs> extends infer RF ? [RF] extends [Invalid] ? FilterError<`unknown field: ${Rhs}`> : [RF] extends [F] ? true : [F] extends [RF] ? true : FilterError<`${P} and ${Rhs} are not comparable`> : never : FilterError<`operator "${Op}" does not support a field reference`>;
+type LeafCheck<TEvent, P extends string, Op extends string, Lit extends string> = ResolveFilterPath<TEvent, P> extends infer F ? [F] extends [Invalid] ? FilterError<`unknown field: ${P}`> : IsFilterPath<Lit> extends true ? CheckFieldToField<TEvent, F, Op, Lit, P> : CheckOp<F, Op, Lit, P> : never;
+type ElementOf<T> = T extends readonly (infer E)[] ? E : never;
+type CheckQuantifier<TEvent, ArrP extends string, SubP extends string, Op extends string, Lit extends string> = ResolveFilterPath<TEvent, ArrP> extends infer Arr ? [Arr] extends [Invalid] ? FilterError<`unknown field: ${ArrP}`> : [ElementOf<Arr>] extends [never] ? FilterError<`${ArrP} is not an array`> : PathValue<ElementOf<Arr>, SubP> extends infer SF ? [SF] extends [Invalid] ? FilterError<`unknown field: ${SubP} (in ${ArrP})`> : CheckOp<SF, Op, Lit, SubP> : never : never;
+type Tokenize<S extends string, Acc extends string[] = []> = S extends `${infer H} ${infer R}` ? Tokenize<R, [...Acc, H]> : [...Acc, S];
+type Scan<TEvent, Tk extends string[], Depth extends 1[], Expect extends "operand" | "operator"> = Expect extends "operand" ? Tk extends ["(", ...infer Rest extends string[]] ? Scan<TEvent, Rest, [1, ...Depth], "operand"> : Tk extends [")" | "&&" | "||", ...string[]] ? FilterError<`unexpected "${Tk[0] & string}"`> : Tk extends [
+    infer ArrP extends string,
+    "any" | "all",
+    "(",
+    infer SubP extends string,
+    infer SubOp extends string,
+    infer SubLit extends string,
+    ")",
+    ...infer Rest extends string[]
+] ? CheckQuantifier<TEvent, ArrP, SubP, SubOp, SubLit> extends infer R ? R extends true ? Scan<TEvent, Rest, Depth, "operator"> : R : never : Tk extends [
+    infer P extends string,
+    "not",
+    "in",
+    infer Lit extends string,
+    ...infer Rest extends string[]
+] ? ResolveFilterPath<TEvent, P> extends infer F ? [F] extends [Invalid] ? FilterError<`unknown field: ${P}`> : CheckIn<F, Lit, P> extends infer R ? R extends true ? Scan<TEvent, Rest, Depth, "operator"> : R : never : never : Tk extends [
+    infer P extends string,
+    infer Op extends string,
+    infer Lit extends string,
+    ...infer Rest extends string[]
+] ? LeafCheck<TEvent, P, Op, Lit> extends infer R ? R extends true ? Scan<TEvent, Rest, Depth, "operator"> : R : never : FilterError<`incomplete clause`> : Tk extends [] ? Depth extends [] ? true : FilterError<`unbalanced parens (missing ")")`> : Tk extends ["&&" | "||", ...infer Rest extends string[]] ? Scan<TEvent, Rest, Depth, "operand"> : Tk extends [")", ...infer Rest extends string[]] ? Depth extends [1, ...infer D extends 1[]] ? Scan<TEvent, Rest, D, "operator"> : FilterError<`unmatched ")"`> : FilterError<`expected && or ||, got "${Tk[0] & string}"`>;
+type ScanFilter<TEvent, S extends string> = Scan<TEvent, Tokenize<S>, [], "operand">;
+export type ValidateWebhookFilter<TEvent, S extends string> = ScanFilter<TEvent, S> extends true ? S : ScanFilter<TEvent, S>;
+export {};

package/dist/esm/v3/schemas/webhookFilter.js

@@ -0,0 +1,38 @@
+import { z } from "zod/v4";
+// Webhook delivery filter: server-side predicate gating routing. LEAF module (imports only `z`).
+// ── Runtime AST (stored on WebhookEndpoint.filterAst; produced by the engine parser) ──
+export const FilterOp = z.enum([
+    "eq",
+    "neq",
+    "gt",
+    "lt",
+    "gte",
+    "lte",
+    "in",
+    "nin",
+    "startsWith",
+    "endsWith",
+    "contains",
+]);
+export const FilterScalar = z.union([z.string(), z.number(), z.boolean(), z.null()]);
+export const FilterValue = z.union([FilterScalar, z.array(FilterScalar)]);
+// Bump when the AST shape changes; a stored AST with a different version is re-parsed from `filter`.
+export const FILTER_AST_VERSION = 1;
+export const FilterAst = z.lazy(() => z.union([
+    z.object({ kind: z.literal("and"), clauses: z.array(FilterAst) }),
+    z.object({ kind: z.literal("or"), clauses: z.array(FilterAst) }),
+    z.object({
+        kind: z.literal("clause"),
+        path: z.string(),
+        op: FilterOp,
+        value: FilterValue.optional(),
+        valueRef: z.string().optional(),
+    }),
+    z.object({
+        kind: z.literal("quantifier"),
+        mode: z.enum(["any", "all"]),
+        path: z.string(),
+        clause: z.object({ path: z.string(), op: FilterOp, value: FilterValue }),
+    }),
+]));
+//# sourceMappingURL=webhookFilter.js.map

package/dist/esm/v3/schemas/webhookFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhookFilter.js","sourceRoot":"","sources":["../../../../src/v3/schemas/webhookFilter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B,iGAAiG;AAEjG,yFAAyF;AAEzF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC;IAC7B,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,KAAK;IACL,IAAI;IACJ,KAAK;IACL,YAAY;IACZ,UAAU;IACV,UAAU;CACX,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAGrF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AAgB1E,qGAAqG;AACrG,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAEpC,MAAM,CAAC,MAAM,SAAS,GAAyB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CACzD,CAAC,CAAC,KAAK,CAAC;IACN,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;IACjE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;IAChE,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;QAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;QAC7B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;KACzE,CAAC;CACH,CAAC,CACH,CAAC"}