@vinaverse/server 0.0.0-stage → 0.1.0-alpha.2

package/dist/chunk-FEEJNQXV.js

@@ -0,0 +1,64 @@
+import { verifyWebhook, signingSecrets, checkTolerance } from './chunk-GTPMQKGX.js';
+
+// src/adapters/handler.ts
+var MAX_BODY_BYTES = 1024 * 1024;
+var RECEIVED = JSON.stringify({ received: true });
+function tooLarge() {
+  return {
+    status: 413,
+    body: JSON.stringify({ error: { code: "body_too_large" } })
+  };
+}
+function byteLength(body) {
+  return typeof body === "string" ? new TextEncoder().encode(body).length : body.byteLength;
+}
+async function handleWebhook(options, rawBody, header) {
+  if (byteLength(rawBody) > (options.maxBodyBytes ?? MAX_BODY_BYTES)) {
+    return tooLarge();
+  }
+  const result = await verifyWebhook({
+    rawBody,
+    header,
+    secret: options.secret,
+    ...options.now ? { now: options.now() } : {},
+    ...options.toleranceSeconds === void 0 ? {} : { toleranceSeconds: options.toleranceSeconds }
+  });
+  if (!result.ok) {
+    await options.onRejected?.(result.error);
+    return {
+      status: 400,
+      body: JSON.stringify({ error: { code: result.error.code } })
+    };
+  }
+  if (result.kind === "event") await options.onEvent(result.event);
+  else if (result.kind === "test") await options.onTest?.(result.envelope);
+  else await options.onUnrecognized?.(result.envelope);
+  return { status: 200, body: RECEIVED };
+}
+function headerValue(headers, name) {
+  if (!headers) return void 0;
+  const wanted = name.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() === wanted && value !== void 0) return value;
+  }
+  return void 0;
+}
+function checkHandlerOptions(options) {
+  signingSecrets(options.secret);
+  checkTolerance(options.toleranceSeconds);
+  if (typeof options.onEvent !== "function") {
+    throw new TypeError(
+      "onEvent is required: it receives every verified event"
+    );
+  }
+  const max = options.maxBodyBytes;
+  if (max !== void 0 && (!Number.isSafeInteger(max) || max <= 0)) {
+    throw new TypeError(
+      `maxBodyBytes must be a positive whole number of bytes, not ${max}`
+    );
+  }
+}
+
+export { MAX_BODY_BYTES, checkHandlerOptions, handleWebhook, headerValue, tooLarge };
+//# sourceMappingURL=chunk-FEEJNQXV.js.map
+//# sourceMappingURL=chunk-FEEJNQXV.js.map

package/dist/chunk-FEEJNQXV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/handler.ts"],"names":[],"mappings":";;;AA4CO,IAAM,iBAAiB,IAAA,GAAO;AACrC,IAAM,WAAW,IAAA,CAAK,SAAA,CAAU,EAAE,QAAA,EAAU,MAAM,CAAA;AAE3C,SAAS,QAAA,GAA4B;AAC1C,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,GAAA;AAAA,IACR,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,OAAO,EAAE,IAAA,EAAM,gBAAA,EAAiB,EAAG;AAAA,GAC5D;AACF;AAEO,SAAS,WAAW,IAAA,EAAiD;AAC1E,EAAA,OAAO,OAAO,IAAA,KAAS,QAAA,GACnB,IAAI,WAAA,GAAc,MAAA,CAAO,IAAI,CAAA,CAAE,MAAA,GAC/B,IAAA,CAAK,UAAA;AACX;AAEA,eAAsB,aAAA,CACpB,OAAA,EACA,OAAA,EACA,MAAA,EAC0B;AAC1B,EAAA,IAAI,UAAA,CAAW,OAAO,CAAA,IAAK,OAAA,CAAQ,gBAAgB,cAAA,CAAA,EAAiB;AAClE,IAAA,OAAO,QAAA,EAAS;AAAA,EAClB;AACA,EAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc;AAAA,IACjC,OAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,GAAI,QAAQ,GAAA,GAAM,EAAE,KAAK,OAAA,CAAQ,GAAA,EAAI,EAAE,GAAI,EAAC;AAAA,IAC5C,GAAI,QAAQ,gBAAA,KAAqB,MAAA,GAC7B,EAAC,GACD,EAAE,gBAAA,EAAkB,OAAA,CAAQ,gBAAA;AAAiB,GAClD,CAAA;AACD,EAAA,IAAI,CAAC,OAAO,EAAA,EAAI;AACd,IAAA,MAAM,OAAA,CAAQ,UAAA,GAAa,MAAA,CAAO,KAAK,CAAA;AACvC,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,GAAA;AAAA,MACR,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,EAAE,IAAA,EAAM,MAAA,CAAO,KAAA,CAAM,IAAA,EAAK,EAAG;AAAA,KAC7D;AAAA,EACF;AACA,EAAA,IAAI,OAAO,IAAA,KAAS,OAAA,QAAe,OAAA,CAAQ,OAAA,CAAQ,OAAO,KAAK,CAAA;AAAA,OAAA,IACtD,OAAO,IAAA,KAAS,MAAA,QAAc,OAAA,CAAQ,MAAA,GAAS,OAAO,QAAQ,CAAA;AAAA,OAClE,MAAM,OAAA,CAAQ,cAAA,GAAiB,MAAA,CAAO,QAAQ,CAAA;AACnD,EAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAM,QAAA,EAAS;AACvC;AAGO,SAAS,WAAA,CACd,SAIA,IAAA,EACwC;AACxC,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,MAAM,MAAA,GAAS,KAAK,WAAA,EAAY;AAChC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,IAAA,IAAI,IAAI,WAAA,EAAY,KAAM,MAAA,IAAU,KAAA,KAAU,QAAW,OAAO,KAAA;AAAA,EAClE;AACA,EAAA,OAAO,MAAA;AACT;AAMO,SAAS,oBAAoB,OAAA,EAAsC;AACxE,EAAA,cAAA,CAAe,QAAQ,MAAM,CAAA;AAC7B,EAAA,cAAA,CAAe,QAAQ,gBAAgB,CAAA;AACvC,EAAA,IAAI,OAAO,OAAA,CAAQ,OAAA,KAAY,UAAA,EAAY;AACzC,IAAA,MAAM,IAAI,SAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,MAAM,OAAA,CAAQ,YAAA;AACpB,EAAA,IAAI,GAAA,KAAQ,WAAc,CAAC,MAAA,CAAO,cAAc,GAAG,CAAA,IAAK,OAAO,CAAA,CAAA,EAAI;AACjE,IAAA,MAAM,IAAI,SAAA;AAAA,MACR,8DAA8D,GAAG,CAAA;AAAA,KACnE;AAAA,EACF;AACF","file":"chunk-FEEJNQXV.js","sourcesContent":["// What every adapter does with a delivery once it has the raw body and the\n// signature header: verify, call the tenant's handler for the result, and\n// answer. A refused delivery is answered 400 (Vinaverse retries, then gives\n// up); a handled one 200. A handler that throws is the adapter's to surface,\n// so the delivery fails and Vinaverse retries it.\nimport type { WebhookError } from '../webhooks/errors.js';\nimport type { WebhookEnvelope, WebhookEvent } from '../webhooks/events.js';\nimport {\n  checkTolerance,\n  signingSecrets,\n  verifyWebhook,\n} from '../webhooks/verify.js';\n\nexport interface WebhookHandlerOptions {\n  /** The endpoint's signing secret, or two while rolling a new one out. */\n  secret: string | readonly string[];\n  /**\n   * Called once per verified delivery of a known event. Answer quickly (the\n   * contract allows 5 seconds) and do the work afterwards; deliveries are at\n   * least once, so deduplicate on `event.id`.\n   */\n  onEvent(event: WebhookEvent): void | Promise<void>;\n  /** A test delivery from Studio; by default it is acknowledged and ignored. */\n  onTest?(envelope: WebhookEnvelope): void | Promise<void>;\n  /** A verified type newer than this package; by default acknowledged and ignored. */\n  onUnrecognized?(envelope: WebhookEnvelope): void | Promise<void>;\n  /** A refused delivery, for logging; it is answered 400 either way. */\n  onRejected?(error: WebhookError): void | Promise<void>;\n  /** How far from now a signature may be, in seconds; default 300. */\n  toleranceSeconds?: number;\n  /**\n   * The largest body accepted, in bytes; default 1 MiB (a conversation\n   * webhook is at most 64 KB). A larger one is answered 413 unread.\n   */\n  maxBodyBytes?: number;\n  /** The clock; default the system clock. */\n  now?: () => Date;\n}\n\nexport interface WebhookResponse {\n  readonly status: 200 | 400 | 413;\n  readonly body: string;\n}\n\nexport const MAX_BODY_BYTES = 1024 * 1024;\nconst RECEIVED = JSON.stringify({ received: true });\n\nexport function tooLarge(): WebhookResponse {\n  return {\n    status: 413,\n    body: JSON.stringify({ error: { code: 'body_too_large' } }),\n  };\n}\n\nexport function byteLength(body: string | Uint8Array | ArrayBuffer): number {\n  return typeof body === 'string'\n    ? new TextEncoder().encode(body).length\n    : body.byteLength;\n}\n\nexport async function handleWebhook(\n  options: WebhookHandlerOptions,\n  rawBody: string | Uint8Array | ArrayBuffer,\n  header: string | readonly string[] | null | undefined,\n): Promise<WebhookResponse> {\n  if (byteLength(rawBody) > (options.maxBodyBytes ?? MAX_BODY_BYTES)) {\n    return tooLarge();\n  }\n  const result = await verifyWebhook({\n    rawBody,\n    header,\n    secret: options.secret,\n    ...(options.now ? { now: options.now() } : {}),\n    ...(options.toleranceSeconds === undefined\n      ? {}\n      : { toleranceSeconds: options.toleranceSeconds }),\n  });\n  if (!result.ok) {\n    await options.onRejected?.(result.error);\n    return {\n      status: 400,\n      body: JSON.stringify({ error: { code: result.error.code } }),\n    };\n  }\n  if (result.kind === 'event') await options.onEvent(result.event);\n  else if (result.kind === 'test') await options.onTest?.(result.envelope);\n  else await options.onUnrecognized?.(result.envelope);\n  return { status: 200, body: RECEIVED };\n}\n\n/** A header's value from a record whose names may have any case. */\nexport function headerValue(\n  headers:\n    | Readonly<Record<string, string | readonly string[] | undefined>>\n    | null\n    | undefined,\n  name: string,\n): string | readonly string[] | undefined {\n  if (!headers) return undefined;\n  const wanted = name.toLowerCase();\n  for (const [key, value] of Object.entries(headers)) {\n    if (key.toLowerCase() === wanted && value !== undefined) return value;\n  }\n  return undefined;\n}\n\n/**\n * Checks a handler's options once, when the adapter is made, so a wrong value\n * fails at start-up instead of answering every delivery with an error.\n */\nexport function checkHandlerOptions(options: WebhookHandlerOptions): void {\n  signingSecrets(options.secret);\n  checkTolerance(options.toleranceSeconds);\n  if (typeof options.onEvent !== 'function') {\n    throw new TypeError(\n      'onEvent is required: it receives every verified event',\n    );\n  }\n  const max = options.maxBodyBytes;\n  if (max !== undefined && (!Number.isSafeInteger(max) || max <= 0)) {\n    throw new TypeError(\n      `maxBodyBytes must be a positive whole number of bytes, not ${max}`,\n    );\n  }\n}\n"]}

package/dist/chunk-GTPMQKGX.js

@@ -0,0 +1,277 @@
+// src/webhooks/crypto.ts
+var WebCryptoUnavailableError = class extends Error {
+  constructor() {
+    super(
+      "Web Crypto (crypto.subtle) is not available in this runtime; @vinaverse/server needs Node 18+, an edge runtime or another runtime with Web Crypto"
+    );
+    this.name = "WebCryptoUnavailableError";
+  }
+};
+var fromNode;
+function webCrypto() {
+  const global = globalThis.crypto;
+  if (global?.subtle) return Promise.resolve(global);
+  fromNode ??= nodeWebCrypto();
+  return fromNode;
+}
+async function subtleCrypto() {
+  return (await webCrypto()).subtle;
+}
+async function nodeWebCrypto() {
+  if (typeof globalThis.process?.versions?.node !== "string") {
+    throw new WebCryptoUnavailableError();
+  }
+  const specifier = ["node", "crypto"].join(":");
+  const mod = await import(
+    /* webpackIgnore: true */
+    /* @vite-ignore */
+    specifier
+  );
+  if (!mod.webcrypto?.subtle) throw new WebCryptoUnavailableError();
+  return mod.webcrypto;
+}
+
+// src/internal/bytes.ts
+var encoder = new TextEncoder();
+function utf8(text) {
+  return encoder.encode(text);
+}
+function toBytes(body) {
+  if (typeof body === "string") return utf8(body);
+  if (body instanceof Uint8Array) return body;
+  return new Uint8Array(body);
+}
+function hexToBytes(hex) {
+  const bytes = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < bytes.length; i++) {
+    bytes[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+}
+function bytesToHex(bytes) {
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function sha256Hex(data) {
+  const subtle = await subtleCrypto();
+  return bytesToHex(new Uint8Array(await subtle.digest("SHA-256", copy(data))));
+}
+async function hmacKey(secret, usage) {
+  const subtle = await subtleCrypto();
+  return subtle.importKey(
+    "raw",
+    utf8(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    [usage]
+  );
+}
+function copy(data) {
+  const out = new Uint8Array(data.length);
+  out.set(data);
+  return out;
+}
+function concat(...parts) {
+  const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+  let at = 0;
+  for (const p of parts) {
+    out.set(p, at);
+    at += p.length;
+  }
+  return out;
+}
+
+// src/webhooks/errors.ts
+function webhookError(code, message) {
+  return { code, message };
+}
+
+// src/webhooks/events.ts
+var WEBHOOK_EVENT_TYPES = [
+  "moderation.item.completed",
+  "moderation.job.completed",
+  "document_check.completed",
+  "session.completed",
+  "subject.erased",
+  "usage.threshold_reached",
+  "feature.state_changed",
+  "media.job.queued",
+  "media.job.progress",
+  "media.job.step.completed",
+  "media.job.completed",
+  "media.job.failed",
+  "media.job.cancelled",
+  "conversation.updated",
+  "conversation.completed",
+  "conversation.failed",
+  "conversation.expired"
+];
+var KNOWN = new Set(WEBHOOK_EVENT_TYPES);
+var CONVERSATION_STATUSES = {
+  "conversation.updated": ["in_progress", "failed"],
+  "conversation.completed": ["completed"],
+  "conversation.failed": ["failed"],
+  "conversation.expired": ["expired"]
+};
+var ENVIRONMENTS = /* @__PURE__ */ new Set(["mock", "development", "production"]);
+function isConversationEvent(event) {
+  return event.type.startsWith("conversation.");
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readBody(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return webhookError("invalid_body", "the body is not JSON");
+  }
+  if (!isObject(parsed) || typeof parsed.id !== "string" || typeof parsed.type !== "string" || typeof parsed.created_at !== "string" || typeof parsed.environment !== "string" || !ENVIRONMENTS.has(parsed.environment) || !isObject(parsed.data)) {
+    return webhookError(
+      "invalid_body",
+      "the body is not a webhook envelope (id, type, created_at, environment, data)"
+    );
+  }
+  const envelope = parsed;
+  if (parsed.data.test === true) return { kind: "test", envelope };
+  if (!KNOWN.has(parsed.type)) return { kind: "unrecognized", envelope };
+  const statuses = CONVERSATION_STATUSES[parsed.type];
+  if (statuses) {
+    const { conversation_id, sequence, status, flow } = parsed.data;
+    if (typeof conversation_id !== "string" || !Number.isSafeInteger(sequence) || sequence < 1 || typeof status !== "string" || !statuses.includes(status) || typeof flow !== "string") {
+      return webhookError(
+        "invalid_body",
+        `a ${parsed.type} event carries a guided flow's state: conversation_id, a positive integer sequence, a flow, and status ${statuses.join(" or ")}`
+      );
+    }
+  }
+  return { kind: "event", event: parsed };
+}
+
+// src/webhooks/signature.ts
+var SIGNATURE_HEADER = "Vinaverse-Signature";
+var TOLERANCE_SECONDS = 300;
+var DIGITS = /^[0-9]+$/;
+var V1 = /^[0-9a-f]{64}$/;
+function parseSignatureHeader(header) {
+  const parts = header.split(",").map((p) => p.trim()).filter((p) => p.includes("=")).map((p) => {
+    const at = p.indexOf("=");
+    return [p.slice(0, at), p.slice(at + 1)];
+  });
+  const timestamps = parts.filter(([k]) => k === "t").map(([, v]) => v);
+  const [t] = timestamps;
+  if (timestamps.length !== 1 || t === void 0 || !DIGITS.test(t)) {
+    return webhookError(
+      "malformed",
+      "the signature header needs exactly one timestamp, t=<unix seconds>"
+    );
+  }
+  const signatures = parts.filter(([k, v]) => k === "v1" && V1.test(v)).map(([, v]) => hexToBytes(v));
+  if (signatures.length === 0) {
+    return webhookError(
+      "malformed",
+      "the signature header has no v1 signature"
+    );
+  }
+  return { timestamp: BigInt(t), signatures };
+}
+async function checkSignature(options) {
+  const parsed = parseSignatureHeader(options.header);
+  if ("code" in parsed) return parsed;
+  const now = BigInt(Math.floor(options.now.getTime() / 1e3));
+  const skew = now > parsed.timestamp ? now - parsed.timestamp : parsed.timestamp - now;
+  if (skew > BigInt(options.toleranceSeconds)) {
+    return webhookError(
+      "stale",
+      `the signature is ${skew} seconds from now; at most ${options.toleranceSeconds} are accepted`
+    );
+  }
+  const message = concat(utf8(`${parsed.timestamp}.`), options.body);
+  const subtle = await subtleCrypto();
+  for (const secret of options.secrets) {
+    const key = await hmacKey(secret, "verify");
+    for (const signature of parsed.signatures) {
+      if (await subtle.verify(
+        "HMAC",
+        key,
+        signature,
+        message
+      ))
+        return null;
+    }
+  }
+  return webhookError(
+    "mismatch",
+    "no signature matches the body with the signing secret: check the secret, and verify the raw body exactly as received"
+  );
+}
+
+// src/webhooks/verify.ts
+async function verifyWebhook(options) {
+  const secrets = signingSecrets(options.secret);
+  const toleranceSeconds = checkTolerance(options.toleranceSeconds);
+  const header = singleHeader(options.header);
+  if (header === void 0) {
+    return {
+      ok: false,
+      error: webhookError("missing", "no Vinaverse-Signature header")
+    };
+  }
+  if (header === null) {
+    return {
+      ok: false,
+      error: webhookError(
+        "malformed",
+        "more than one Vinaverse-Signature header"
+      )
+    };
+  }
+  const body = toBytes(options.rawBody);
+  const refused = await checkSignature({
+    body,
+    header,
+    secrets,
+    now: options.now ?? /* @__PURE__ */ new Date(),
+    toleranceSeconds
+  });
+  if (refused) return { ok: false, error: refused };
+  let text;
+  try {
+    text = new TextDecoder("utf-8", { fatal: true }).decode(body);
+  } catch {
+    return {
+      ok: false,
+      error: webhookError("invalid_body", "the body is not UTF-8")
+    };
+  }
+  const read = readBody(text);
+  return "code" in read ? { ok: false, error: read } : { ok: true, ...read };
+}
+function singleHeader(header) {
+  if (header === null || header === void 0) return void 0;
+  if (typeof header === "string") return header === "" ? void 0 : header;
+  if (header.length === 0) return void 0;
+  return header.length === 1 ? header[0] : null;
+}
+function signingSecrets(secret) {
+  const list = typeof secret === "string" ? [secret] : Array.isArray(secret) ? [...secret] : [];
+  if (list.length === 0 || list.some((s) => typeof s !== "string" || s === "")) {
+    throw new TypeError(
+      "the webhook signing secret is required (vv_whsec_\u2026), and none was given"
+    );
+  }
+  return list;
+}
+function checkTolerance(seconds) {
+  if (seconds === void 0) return TOLERANCE_SECONDS;
+  if (!Number.isSafeInteger(seconds) || seconds < 0 || seconds > TOLERANCE_SECONDS) {
+    throw new TypeError(
+      `toleranceSeconds must be a whole number of seconds from 0 to ${TOLERANCE_SECONDS}, not ${seconds}`
+    );
+  }
+  return seconds;
+}
+
+export { SIGNATURE_HEADER, TOLERANCE_SECONDS, WEBHOOK_EVENT_TYPES, WebCryptoUnavailableError, bytesToHex, checkTolerance, concat, hexToBytes, hmacKey, isConversationEvent, parseSignatureHeader, sha256Hex, signingSecrets, subtleCrypto, toBytes, utf8, verifyWebhook, webCrypto };
+//# sourceMappingURL=chunk-GTPMQKGX.js.map
+//# sourceMappingURL=chunk-GTPMQKGX.js.map

package/dist/chunk-GTPMQKGX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/webhooks/crypto.ts","../src/internal/bytes.ts","../src/webhooks/errors.ts","../src/webhooks/events.ts","../src/webhooks/signature.ts","../src/webhooks/verify.ts"],"names":[],"mappings":";AAMO,IAAM,yBAAA,GAAN,cAAwC,KAAA,CAAM;AAAA,EACnD,WAAA,GAAc;AACZ,IAAA,KAAA;AAAA,MACE;AAAA,KACF;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,2BAAA;AAAA,EACd;AACF;AAIA,IAAI,QAAA;AAGG,SAAS,SAAA,GAA6B;AAC3C,EAAA,MAAM,SAAU,UAAA,CAAmC,MAAA;AACnD,EAAA,IAAI,MAAA,EAAQ,MAAA,EAAQ,OAAO,OAAA,CAAQ,QAAQ,MAAM,CAAA;AACjD,EAAA,QAAA,KAAa,aAAA,EAAc;AAC3B,EAAA,OAAO,QAAA;AACT;AAEA,eAAsB,YAAA,GAAsC;AAC1D,EAAA,OAAA,CAAQ,MAAM,WAAU,EAAG,MAAA;AAC7B;AAEA,eAAe,aAAA,GAAiC;AAC9C,EAAA,IAAI,OAAQ,UAAA,CAAyB,OAAA,EAAS,QAAA,EAAU,SAAS,QAAA,EAAU;AACzE,IAAA,MAAM,IAAI,yBAAA,EAA0B;AAAA,EACtC;AAGA,EAAA,MAAM,YAAY,CAAC,MAAA,EAAQ,QAAQ,CAAA,CAAE,KAAK,GAAG,CAAA;AAC7C,EAAA,MAAM,MAAO,MAAM;AAAA;AAAA;AAAA,IAC4B;AAAA,GAAA;AAE/C,EAAA,IAAI,CAAC,GAAA,CAAI,SAAA,EAAW,MAAA,EAAQ,MAAM,IAAI,yBAAA,EAA0B;AAChE,EAAA,OAAO,GAAA,CAAI,SAAA;AACb;;;ACxCA,IAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAEzB,SAAS,KAAK,IAAA,EAAuC;AAC1D,EAAA,OAAO,OAAA,CAAQ,OAAO,IAAI,CAAA;AAC5B;AAEO,SAAS,QAAQ,IAAA,EAAqD;AAC3E,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,EAAU,OAAO,KAAK,IAAI,CAAA;AAC9C,EAAA,IAAI,IAAA,YAAgB,YAAY,OAAO,IAAA;AACvC,EAAA,OAAO,IAAI,WAAW,IAAI,CAAA;AAC5B;AAEO,SAAS,WAAW,GAAA,EAAsC;AAC/D,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,GAAA,CAAI,SAAS,CAAC,CAAA;AAC3C,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAO,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,GAAI,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,EAC5D;AACA,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,WAAW,KAAA,EAA2B;AACpD,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,KAAA,EAAO,CAAC,MAAM,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AAC1E;AAEA,eAAsB,UAAU,IAAA,EAAmC;AACjE,EAAA,MAAM,MAAA,GAAS,MAAM,YAAA,EAAa;AAClC,EAAA,OAAO,UAAA,CAAW,IAAI,UAAA,CAAW,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAA,CAAK,IAAI,CAAC,CAAC,CAAC,CAAA;AAC9E;AAEA,eAAsB,OAAA,CACpB,QACA,KAAA,EACoB;AACpB,EAAA,MAAM,MAAA,GAAS,MAAM,YAAA,EAAa;AAClC,EAAA,OAAO,MAAA,CAAO,SAAA;AAAA,IACZ,KAAA;AAAA,IACA,KAAK,MAAM,CAAA;AAAA,IACX,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IAChC,KAAA;AAAA,IACA,CAAC,KAAK;AAAA,GACR;AACF;AAIO,SAAS,KAAK,IAAA,EAA2C;AAC9D,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA;AACtC,EAAA,GAAA,CAAI,IAAI,IAAI,CAAA;AACZ,EAAA,OAAO,GAAA;AACT;AAEO,SAAS,UAAU,KAAA,EAA8C;AACtE,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,GAAI,CAAA,CAAE,MAAA,EAAQ,CAAC,CAAC,CAAA;AAClE,EAAA,IAAI,EAAA,GAAK,CAAA;AACT,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,GAAA,CAAI,GAAA,CAAI,GAAG,EAAE,CAAA;AACb,IAAA,EAAA,IAAM,CAAA,CAAE,MAAA;AAAA,EACV;AACA,EAAA,OAAO,GAAA;AACT;;;AClCO,SAAS,YAAA,CACd,MACA,OAAA,EACc;AACd,EAAA,OAAO,EAAE,MAAM,OAAA,EAAQ;AACzB;;;ACYO,IAAM,mBAAA,GAAmD;AAAA,EAC9D,2BAAA;AAAA,EACA,0BAAA;AAAA,EACA,0BAAA;AAAA,EACA,mBAAA;AAAA,EACA,gBAAA;AAAA,EACA,yBAAA;AAAA,EACA,uBAAA;AAAA,EACA,kBAAA;AAAA,EACA,oBAAA;AAAA,EACA,0BAAA;AAAA,EACA,qBAAA;AAAA,EACA,kBAAA;AAAA,EACA,qBAAA;AAAA,EACA,sBAAA;AAAA,EACA,wBAAA;AAAA,EACA,qBAAA;AAAA,EACA;AACF;AAEA,IAAM,KAAA,GAAQ,IAAI,GAAA,CAAY,mBAAmB,CAAA;AAGjD,IAAM,qBAAA,GAAqE;AAAA,EACzE,sBAAA,EAAwB,CAAC,aAAA,EAAe,QAAQ,CAAA;AAAA,EAChD,wBAAA,EAA0B,CAAC,WAAW,CAAA;AAAA,EACtC,qBAAA,EAAuB,CAAC,QAAQ,CAAA;AAAA,EAChC,sBAAA,EAAwB,CAAC,SAAS;AACpC,CAAA;AACA,IAAM,+BAAe,IAAI,GAAA,CAAI,CAAC,MAAA,EAAQ,aAAA,EAAe,YAAY,CAAC,CAAA;AAE3D,SAAS,oBACd,KAAA,EAC4B;AAC5B,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,UAAA,CAAW,eAAe,CAAA;AAC9C;AAUA,SAAS,SAAS,KAAA,EAA+B;AAC/C,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAWO,SAAS,SAAS,IAAA,EAAuC;AAC9D,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,YAAA,CAAa,gBAAgB,sBAAsB,CAAA;AAAA,EAC5D;AACA,EAAA,IACE,CAAC,QAAA,CAAS,MAAM,CAAA,IAChB,OAAO,MAAA,CAAO,EAAA,KAAO,QAAA,IACrB,OAAO,MAAA,CAAO,IAAA,KAAS,QAAA,IACvB,OAAO,MAAA,CAAO,UAAA,KAAe,QAAA,IAC7B,OAAO,MAAA,CAAO,WAAA,KAAgB,QAAA,IAC9B,CAAC,YAAA,CAAa,GAAA,CAAI,MAAA,CAAO,WAAW,CAAA,IACpC,CAAC,QAAA,CAAS,MAAA,CAAO,IAAI,CAAA,EACrB;AACA,IAAA,OAAO,YAAA;AAAA,MACL,cAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,QAAA,GAAW,MAAA;AACjB,EAAA,IAAI,MAAA,CAAO,KAAK,IAAA,KAAS,IAAA,SAAa,EAAE,IAAA,EAAM,QAAQ,QAAA,EAAS;AAC/D,EAAA,IAAI,CAAC,KAAA,CAAM,GAAA,CAAI,MAAA,CAAO,IAAI,GAAG,OAAO,EAAE,IAAA,EAAM,cAAA,EAAgB,QAAA,EAAS;AACrE,EAAA,MAAM,QAAA,GAAW,qBAAA,CAAsB,MAAA,CAAO,IAAI,CAAA;AAClD,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,MAAM,EAAE,eAAA,EAAiB,QAAA,EAAU,MAAA,EAAQ,IAAA,KAAS,MAAA,CAAO,IAAA;AAC3D,IAAA,IACE,OAAO,oBAAoB,QAAA,IAC3B,CAAC,OAAO,aAAA,CAAc,QAAQ,KAC7B,QAAA,GAAsB,CAAA,IACvB,OAAO,MAAA,KAAW,QAAA,IAClB,CAAC,QAAA,CAAS,QAAA,CAAS,MAAM,CAAA,IACzB,OAAO,SAAS,QAAA,EAChB;AACA,MAAA,OAAO,YAAA;AAAA,QACL,cAAA;AAAA,QACA,KAAK,MAAA,CAAO,IAAI,0GAA0G,QAAA,CAAS,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,OACjJ;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,IAAA,EAAM,OAAA,EAAS,KAAA,EAAO,MAAA,EAAuB;AACxD;;;ACrIO,IAAM,gBAAA,GAAmB;AACzB,IAAM,iBAAA,GAAoB;AAEjC,IAAM,MAAA,GAAS,UAAA;AACf,IAAM,EAAA,GAAK,gBAAA;AAgBJ,SAAS,qBACd,MAAA,EACgC;AAChC,EAAA,MAAM,KAAA,GAAQ,OACX,KAAA,CAAM,GAAG,EACT,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,EACnB,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,QAAA,CAAS,GAAG,CAAC,CAAA,CAC7B,GAAA,CAAI,CAAC,CAAA,KAAM;AACV,IAAA,MAAM,EAAA,GAAK,CAAA,CAAE,OAAA,CAAQ,GAAG,CAAA;AACxB,IAAA,OAAO,CAAC,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,GAAG,CAAA,CAAE,KAAA,CAAM,EAAA,GAAK,CAAC,CAAC,CAAA;AAAA,EACzC,CAAC,CAAA;AACH,EAAA,MAAM,aAAa,KAAA,CAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA,KAAM,CAAA,KAAM,GAAG,CAAA,CAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;AACpE,EAAA,MAAM,CAAC,CAAC,CAAA,GAAI,UAAA;AACZ,EAAA,IAAI,UAAA,CAAW,WAAW,CAAA,IAAK,CAAA,KAAM,UAAa,CAAC,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,EAAG;AACjE,IAAA,OAAO,YAAA;AAAA,MACL,WAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,UAAA,GAAa,MAChB,MAAA,CAAO,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM,CAAA,KAAM,IAAA,IAAQ,EAAA,CAAG,KAAK,CAAC,CAAC,CAAA,CAC3C,GAAA,CAAI,CAAC,GAAG,CAAC,CAAA,KAAM,UAAA,CAAW,CAAC,CAAC,CAAA;AAC/B,EAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,IAAA,OAAO,YAAA;AAAA,MACL,WAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,SAAA,EAAW,MAAA,CAAO,CAAC,GAAG,UAAA,EAAW;AAC5C;AAQA,eAAsB,eAAe,OAAA,EAMJ;AAC/B,EAAA,MAAM,MAAA,GAAS,oBAAA,CAAqB,OAAA,CAAQ,MAAM,CAAA;AAClD,EAAA,IAAI,MAAA,IAAU,QAAQ,OAAO,MAAA;AAC7B,EAAA,MAAM,GAAA,GAAM,OAAO,IAAA,CAAK,KAAA,CAAM,QAAQ,GAAA,CAAI,OAAA,EAAQ,GAAI,GAAI,CAAC,CAAA;AAC3D,EAAA,MAAM,IAAA,GACJ,MAAM,MAAA,CAAO,SAAA,GAAY,MAAM,MAAA,CAAO,SAAA,GAAY,OAAO,SAAA,GAAY,GAAA;AACvE,EAAA,IAAI,IAAA,GAAO,MAAA,CAAO,OAAA,CAAQ,gBAAgB,CAAA,EAAG;AAC3C,IAAA,OAAO,YAAA;AAAA,MACL,OAAA;AAAA,MACA,CAAA,iBAAA,EAAoB,IAAI,CAAA,2BAAA,EAA8B,OAAA,CAAQ,gBAAgB,CAAA,aAAA;AAAA,KAChF;AAAA,EACF;AACA,EAAA,MAAM,OAAA,GAAU,OAAO,IAAA,CAAK,CAAA,EAAG,OAAO,SAAS,CAAA,CAAA,CAAG,CAAA,EAAG,OAAA,CAAQ,IAAI,CAAA;AACjE,EAAA,MAAM,MAAA,GAAS,MAAM,YAAA,EAAa;AAClC,EAAA,KAAA,MAAW,MAAA,IAAU,QAAQ,OAAA,EAAS;AACpC,IAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,MAAA,EAAQ,QAAQ,CAAA;AAC1C,IAAA,KAAA,MAAW,SAAA,IAAa,OAAO,UAAA,EAAY;AAEzC,MAAA,IACE,MAAM,MAAA,CAAO,MAAA;AAAA,QACX,MAAA;AAAA,QACA,GAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACF;AAEA,QAAA,OAAO,IAAA;AAAA,IACX;AAAA,EACF;AACA,EAAA,OAAO,YAAA;AAAA,IACL,UAAA;AAAA,IACA;AAAA,GACF;AACF;;;AChEA,eAAsB,cACpB,OAAA,EAC8B;AAC9B,EAAA,MAAM,OAAA,GAAU,cAAA,CAAe,OAAA,CAAQ,MAAM,CAAA;AAC7C,EAAA,MAAM,gBAAA,GAAmB,cAAA,CAAe,OAAA,CAAQ,gBAAgB,CAAA;AAChE,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,OAAA,CAAQ,MAAM,CAAA;AAC1C,EAAA,IAAI,WAAW,MAAA,EAAW;AACxB,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,KAAA,EAAO,YAAA,CAAa,SAAA,EAAW,+BAA+B;AAAA,KAChE;AAAA,EACF;AACA,EAAA,IAAI,WAAW,IAAA,EAAM;AACnB,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,KAAA,EAAO,YAAA;AAAA,QACL,WAAA;AAAA,QACA;AAAA;AACF,KACF;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA;AACpC,EAAA,MAAM,OAAA,GAAU,MAAM,cAAA,CAAe;AAAA,IACnC,IAAA;AAAA,IACA,MAAA;AAAA,IACA,OAAA;AAAA,IACA,GAAA,EAAK,OAAA,CAAQ,GAAA,oBAAO,IAAI,IAAA,EAAK;AAAA,IAC7B;AAAA,GACD,CAAA;AACD,EAAA,IAAI,SAAS,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,OAAO,OAAA,EAAQ;AAChD,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,IAAI,YAAY,OAAA,EAAS,EAAE,OAAO,IAAA,EAAM,CAAA,CAAE,MAAA,CAAO,IAAI,CAAA;AAAA,EAC9D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,KAAA,EAAO,YAAA,CAAa,cAAA,EAAgB,uBAAuB;AAAA,KAC7D;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,SAAS,IAAI,CAAA;AAC1B,EAAA,OAAO,MAAA,IAAU,IAAA,GAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,IAAA,EAAK,GAAI,EAAE,EAAA,EAAI,IAAA,EAAM,GAAG,IAAA,EAAK;AAC3E;AAGA,SAAS,aACP,MAAA,EAC2B;AAC3B,EAAA,IAAI,MAAA,KAAW,IAAA,IAAQ,MAAA,KAAW,MAAA,EAAW,OAAO,MAAA;AACpD,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,EAAU,OAAO,MAAA,KAAW,KAAK,MAAA,GAAY,MAAA;AACnE,EAAA,IAAI,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAChC,EAAA,OAAO,MAAA,CAAO,MAAA,KAAW,CAAA,GAAI,MAAA,CAAO,CAAC,CAAA,GAAI,IAAA;AAC3C;AAGO,SAAS,eAAe,MAAA,EAA2B;AACxD,EAAA,MAAM,IAAA,GACJ,OAAO,MAAA,KAAW,QAAA,GACd,CAAC,MAAM,CAAA,GACP,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,GAClB,CAAC,GAAG,MAAM,IACV,EAAC;AACT,EAAA,IACE,IAAA,CAAK,MAAA,KAAW,CAAA,IAChB,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,KAAM,EAAE,CAAA,EAClD;AACA,IAAA,MAAM,IAAI,SAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAMO,SAAS,eAAe,OAAA,EAAqC;AAClE,EAAA,IAAI,OAAA,KAAY,QAAW,OAAO,iBAAA;AAClC,EAAA,IACE,CAAC,OAAO,aAAA,CAAc,OAAO,KAC7B,OAAA,GAAU,CAAA,IACV,UAAU,iBAAA,EACV;AACA,IAAA,MAAM,IAAI,SAAA;AAAA,MACR,CAAA,6DAAA,EAAgE,iBAAiB,CAAA,MAAA,EAAS,OAAO,CAAA;AAAA,KACnG;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT","file":"chunk-GTPMQKGX.js","sourcesContent":["// Web Crypto wherever the package runs. Node 20+, AWS Lambda, edge runtimes\n// and React Native expose it as `globalThis.crypto`; Node 18 has the same API\n// but only as `webcrypto` in its crypto module, so on Node 18 it is loaded\n// from there, once.\n\n/** No Web Crypto in this runtime: the package cannot verify anything here. */\nexport class WebCryptoUnavailableError extends Error {\n  constructor() {\n    super(\n      'Web Crypto (crypto.subtle) is not available in this runtime; @vinaverse/server needs Node 18+, an edge runtime or another runtime with Web Crypto',\n    );\n    this.name = 'WebCryptoUnavailableError';\n  }\n}\n\ntype MaybeNode = { process?: { versions?: { node?: unknown } } };\n\nlet fromNode: Promise<Crypto> | undefined;\n\n/** The runtime's Web Crypto: `crypto.subtle` and `crypto.getRandomValues`. */\nexport function webCrypto(): Promise<Crypto> {\n  const global = (globalThis as { crypto?: Crypto }).crypto;\n  if (global?.subtle) return Promise.resolve(global);\n  fromNode ??= nodeWebCrypto();\n  return fromNode;\n}\n\nexport async function subtleCrypto(): Promise<SubtleCrypto> {\n  return (await webCrypto()).subtle;\n}\n\nasync function nodeWebCrypto(): Promise<Crypto> {\n  if (typeof (globalThis as MaybeNode).process?.versions?.node !== 'string') {\n    throw new WebCryptoUnavailableError();\n  }\n  // Built at run time on purpose: bundlers for edge runtimes and React Native,\n  // where this line never runs, must not try to resolve a Node module.\n  const specifier = ['node', 'crypto'].join(':');\n  const mod = (await import(\n    /* webpackIgnore: true */ /* @vite-ignore */ specifier\n  )) as { webcrypto?: Crypto };\n  if (!mod.webcrypto?.subtle) throw new WebCryptoUnavailableError();\n  return mod.webcrypto;\n}\n","// Byte helpers on Web APIs only (no Buffer), shared by the signature checks.\nimport { subtleCrypto } from '../webhooks/crypto.js';\n\nconst encoder = new TextEncoder();\n\nexport function utf8(text: string): Uint8Array<ArrayBuffer> {\n  return encoder.encode(text);\n}\n\nexport function toBytes(body: string | Uint8Array | ArrayBuffer): Uint8Array {\n  if (typeof body === 'string') return utf8(body);\n  if (body instanceof Uint8Array) return body;\n  return new Uint8Array(body);\n}\n\nexport function hexToBytes(hex: string): Uint8Array<ArrayBuffer> {\n  const bytes = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < bytes.length; i++) {\n    bytes[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n  }\n  return bytes;\n}\n\nexport function bytesToHex(bytes: Uint8Array): string {\n  return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');\n}\n\nexport async function sha256Hex(data: Uint8Array): Promise<string> {\n  const subtle = await subtleCrypto();\n  return bytesToHex(new Uint8Array(await subtle.digest('SHA-256', copy(data))));\n}\n\nexport async function hmacKey(\n  secret: string,\n  usage: 'sign' | 'verify',\n): Promise<CryptoKey> {\n  const subtle = await subtleCrypto();\n  return subtle.importKey(\n    'raw',\n    utf8(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    [usage],\n  );\n}\n\n// Web Crypto takes an ArrayBuffer-backed view; a Node Buffer may sit on a\n// shared pool, so a view is copied when it does not own its whole buffer.\nexport function copy(data: Uint8Array): Uint8Array<ArrayBuffer> {\n  const out = new Uint8Array(data.length);\n  out.set(data);\n  return out;\n}\n\nexport function concat(...parts: Uint8Array[]): Uint8Array<ArrayBuffer> {\n  const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));\n  let at = 0;\n  for (const p of parts) {\n    out.set(p, at);\n    at += p.length;\n  }\n  return out;\n}\n","/**\n * Why a delivery was refused, in the conformance vectors' words\n * (vinaverse-contracts `conformance/webhooks.json`). Every one is answered with\n * `400`, so Vinaverse retries it; none of them is ever a valid delivery.\n *\n * - `missing`: no `Vinaverse-Signature` header.\n * - `malformed`: the header is not `t=<unix seconds>,v1=<hex>[,v1=<hex>]`\n *   (no single timestamp, or no `v1` signature).\n * - `stale`: signed more than the tolerance (300 seconds) before or after now:\n *   a replay, or a clock far off.\n * - `mismatch`: no `v1` signature matches the body with any secret: a wrong\n *   secret (or the secret without its `vv_whsec_` prefix), a changed body, or a\n *   body parsed and serialized again.\n * - `invalid_body`: signed by Vinaverse, but not a webhook envelope this\n *   package can read.\n */\nexport type WebhookErrorCode =\n  | 'missing'\n  | 'malformed'\n  | 'stale'\n  | 'mismatch'\n  | 'invalid_body';\n\nexport interface WebhookError {\n  readonly code: WebhookErrorCode;\n  readonly message: string;\n}\n\nexport function webhookError(\n  code: WebhookErrorCode,\n  message: string,\n): WebhookError {\n  return { code, message };\n}\n","// The webhook events, typed from the pinned contract (vinaverse-v1.yaml,\n// `webhooks`), and the reading of a verified body into one of them.\nimport type { components, webhooks } from '../generated/vinaverse-v1.js';\nimport { type WebhookError, webhookError } from './errors.js';\n\ntype Schemas = components['schemas'];\n\n/** The envelope every webhook body has. `data` depends on `type`. */\nexport type WebhookEnvelope = Schemas['WebhookEnvelope'];\n\n/** Every event type the targeted contract defines. */\nexport type WebhookEventType = WebhookEnvelope['type'] & keyof webhooks;\n\ntype BodyOf<T extends WebhookEventType> = NonNullable<\n  webhooks[T]['post']['requestBody']\n>['content']['application/json'];\n\n/** One event of type `T`: the envelope, with `data` as the contract says. */\nexport type WebhookEventOf<T extends WebhookEventType> = Omit<\n  WebhookEnvelope,\n  'type' | 'data'\n> & {\n  type: T;\n  data: NonNullable<BodyOf<T>['data']>;\n};\n\n/** Any event this package version knows; narrow it on `type`. */\nexport type WebhookEvent = {\n  [T in WebhookEventType]: WebhookEventOf<T>;\n}[WebhookEventType];\n\nexport type ConversationEventType =\n  | 'conversation.updated'\n  | 'conversation.completed'\n  | 'conversation.failed'\n  | 'conversation.expired';\n\n/** A guided-flow conversation's state changed: `data` is its `ConversationState`. */\nexport type ConversationEvent = {\n  [T in ConversationEventType]: WebhookEventOf<T>;\n}[ConversationEventType];\n\nexport type ConversationState = Schemas['ConversationState'];\n\n// Kept in step with the contract by a test that reads the pinned YAML.\nexport const WEBHOOK_EVENT_TYPES: readonly WebhookEventType[] = [\n  'moderation.item.completed',\n  'moderation.job.completed',\n  'document_check.completed',\n  'session.completed',\n  'subject.erased',\n  'usage.threshold_reached',\n  'feature.state_changed',\n  'media.job.queued',\n  'media.job.progress',\n  'media.job.step.completed',\n  'media.job.completed',\n  'media.job.failed',\n  'media.job.cancelled',\n  'conversation.updated',\n  'conversation.completed',\n  'conversation.failed',\n  'conversation.expired',\n];\n\nconst KNOWN = new Set<string>(WEBHOOK_EVENT_TYPES);\n\n// The statuses each conversation event may carry (vinaverse-v1.yaml, webhooks).\nconst CONVERSATION_STATUSES: Readonly<Record<string, readonly string[]>> = {\n  'conversation.updated': ['in_progress', 'failed'],\n  'conversation.completed': ['completed'],\n  'conversation.failed': ['failed'],\n  'conversation.expired': ['expired'],\n};\nconst ENVIRONMENTS = new Set(['mock', 'development', 'production']);\n\nexport function isConversationEvent(\n  event: WebhookEvent,\n): event is ConversationEvent {\n  return event.type.startsWith('conversation.');\n}\n\n/** What a verified body is: a known event, a test delivery, or a type newer than this package. */\nexport type ReadBody =\n  | { kind: 'event'; event: WebhookEvent }\n  | { kind: 'test'; envelope: WebhookEnvelope }\n  | { kind: 'unrecognized'; envelope: WebhookEnvelope };\n\ntype Json = Record<string, unknown>;\n\nfunction isObject(value: unknown): value is Json {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\n/**\n * Reads a verified body: it must be the webhook envelope (`id`, `type`,\n * `created_at`, `environment`, `data`). A test delivery from Studio carries\n * `data: { test: true }` and no payload. A conversation event must carry a\n * guided flow's state with the status its type allows and the fields its\n * ordering depends on (`conversation_id`, `sequence`); other payloads are as\n * Vinaverse signed them. A type newer than this package is `unrecognized`,\n * never an error: answer it 2xx and upgrade.\n */\nexport function readBody(text: string): ReadBody | WebhookError {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(text);\n  } catch {\n    return webhookError('invalid_body', 'the body is not JSON');\n  }\n  if (\n    !isObject(parsed) ||\n    typeof parsed.id !== 'string' ||\n    typeof parsed.type !== 'string' ||\n    typeof parsed.created_at !== 'string' ||\n    typeof parsed.environment !== 'string' ||\n    !ENVIRONMENTS.has(parsed.environment) ||\n    !isObject(parsed.data)\n  ) {\n    return webhookError(\n      'invalid_body',\n      'the body is not a webhook envelope (id, type, created_at, environment, data)',\n    );\n  }\n  const envelope = parsed as WebhookEnvelope;\n  if (parsed.data.test === true) return { kind: 'test', envelope };\n  if (!KNOWN.has(parsed.type)) return { kind: 'unrecognized', envelope };\n  const statuses = CONVERSATION_STATUSES[parsed.type];\n  if (statuses) {\n    const { conversation_id, sequence, status, flow } = parsed.data;\n    if (\n      typeof conversation_id !== 'string' ||\n      !Number.isSafeInteger(sequence) ||\n      (sequence as number) < 1 ||\n      typeof status !== 'string' ||\n      !statuses.includes(status) ||\n      typeof flow !== 'string'\n    ) {\n      return webhookError(\n        'invalid_body',\n        `a ${parsed.type} event carries a guided flow's state: conversation_id, a positive integer sequence, a flow, and status ${statuses.join(' or ')}`,\n      );\n    }\n  }\n  return { kind: 'event', event: parsed as WebhookEvent };\n}\n","// The webhook signature, exactly as the Vinaverse API signs and checks it\n// (contract: docs/conversation-state.md §1, \"Delivery\"):\n//   Vinaverse-Signature: t=<unix seconds>,v1=<hex>[,v1=<hex>]\n// `v1` is the lowercase hex HMAC-SHA256, keyed with the endpoint's whole\n// signing secret as UTF-8 (the `vv_whsec_` prefix included, never decoded),\n// over `<t>.` followed by the raw request body. During a secret rotation the\n// header carries one `v1` per valid secret. A signature more than 300 seconds\n// from now, either way, is refused.\nimport { concat, hexToBytes, hmacKey, utf8 } from '../internal/bytes.js';\nimport { subtleCrypto } from './crypto.js';\nimport { type WebhookError, webhookError } from './errors.js';\n\nexport const SIGNATURE_HEADER = 'Vinaverse-Signature';\nexport const TOLERANCE_SECONDS = 300;\n\nconst DIGITS = /^[0-9]+$/;\nconst V1 = /^[0-9a-f]{64}$/;\n\nexport interface ParsedSignature {\n  /** The signed timestamp, in Unix seconds. */\n  readonly timestamp: bigint;\n  /** Each `v1` signature, decoded. */\n  readonly signatures: readonly Uint8Array[];\n}\n\n/**\n * Reads the header the way the API's own verifier does: comma-separated\n * `key=value` parts (a space around a part changes nothing), exactly one `t`\n * of digits, and the `v1` values. A `v1`\n * that is not 64 lowercase hex digits can never match, so it is left out; a\n * header left with no `v1` is malformed.\n */\nexport function parseSignatureHeader(\n  header: string,\n): ParsedSignature | WebhookError {\n  const parts = header\n    .split(',')\n    .map((p) => p.trim())\n    .filter((p) => p.includes('='))\n    .map((p) => {\n      const at = p.indexOf('=');\n      return [p.slice(0, at), p.slice(at + 1)] as const;\n    });\n  const timestamps = parts.filter(([k]) => k === 't').map(([, v]) => v);\n  const [t] = timestamps;\n  if (timestamps.length !== 1 || t === undefined || !DIGITS.test(t)) {\n    return webhookError(\n      'malformed',\n      'the signature header needs exactly one timestamp, t=<unix seconds>',\n    );\n  }\n  const signatures = parts\n    .filter(([k, v]) => k === 'v1' && V1.test(v))\n    .map(([, v]) => hexToBytes(v));\n  if (signatures.length === 0) {\n    return webhookError(\n      'malformed',\n      'the signature header has no v1 signature',\n    );\n  }\n  return { timestamp: BigInt(t), signatures };\n}\n\n/**\n * Checks a delivery's signature: the header's form, its timestamp against\n * `now`, then each `v1` against each secret, in constant time (Web Crypto's\n * `verify`). `secrets` is more than one while the receiver rolls a new secret\n * out. Returns null when the signature is valid.\n */\nexport async function checkSignature(options: {\n  body: Uint8Array;\n  header: string;\n  secrets: readonly string[];\n  now: Date;\n  toleranceSeconds: number;\n}): Promise<WebhookError | null> {\n  const parsed = parseSignatureHeader(options.header);\n  if ('code' in parsed) return parsed;\n  const now = BigInt(Math.floor(options.now.getTime() / 1000));\n  const skew =\n    now > parsed.timestamp ? now - parsed.timestamp : parsed.timestamp - now;\n  if (skew > BigInt(options.toleranceSeconds)) {\n    return webhookError(\n      'stale',\n      `the signature is ${skew} seconds from now; at most ${options.toleranceSeconds} are accepted`,\n    );\n  }\n  const message = concat(utf8(`${parsed.timestamp}.`), options.body);\n  const subtle = await subtleCrypto();\n  for (const secret of options.secrets) {\n    const key = await hmacKey(secret, 'verify');\n    for (const signature of parsed.signatures) {\n      // Every signature is decoded into its own ArrayBuffer (hexToBytes).\n      if (\n        await subtle.verify(\n          'HMAC',\n          key,\n          signature as Uint8Array<ArrayBuffer>,\n          message,\n        )\n      )\n        return null;\n    }\n  }\n  return webhookError(\n    'mismatch',\n    'no signature matches the body with the signing secret: check the secret, and verify the raw body exactly as received',\n  );\n}\n","import { toBytes } from '../internal/bytes.js';\nimport { type WebhookError, webhookError } from './errors.js';\nimport { type ReadBody, readBody } from './events.js';\nimport { checkSignature, TOLERANCE_SECONDS } from './signature.js';\n\nexport interface VerifyWebhookOptions {\n  /**\n   * The request body exactly as received, before any JSON parsing: a string,\n   * or bytes (`Uint8Array`, which a Node `Buffer` is, or `ArrayBuffer`). A\n   * body parsed and serialized again never verifies.\n   */\n  rawBody: string | Uint8Array | ArrayBuffer;\n  /** The `Vinaverse-Signature` header (a framework's string array is accepted). */\n  header: string | readonly string[] | null | undefined;\n  /**\n   * The endpoint's signing secret (`vv_whsec_…`), whole. Pass two while you\n   * roll a new one out: a delivery verifies if either matches.\n   */\n  secret: string | readonly string[];\n  /** The time to check the signature's timestamp against; default now. */\n  now?: Date;\n  /** How far from `now` a signature may be: whole seconds, 0 to 300 (the contract's window, the default). */\n  toleranceSeconds?: number;\n}\n\nexport type VerifyWebhookResult =\n  | ({ ok: true } & ReadBody)\n  | { ok: false; error: WebhookError };\n\n/**\n * Verifies a Vinaverse webhook delivery and reads it, in one call:\n *\n * - `{ ok: true, kind: 'event', event }`: a verified event; narrow it on `event.type`.\n * - `{ ok: true, kind: 'test', envelope }`: a test delivery from Studio; answer 2xx, do nothing.\n * - `{ ok: true, kind: 'unrecognized', envelope }`: verified, but a type newer than this\n *   package; answer 2xx, and upgrade to handle it.\n * - `{ ok: false, error }`: refused (`error.code` says why); answer 400.\n *\n * Deliveries are at least once: deduplicate on `event.id`, and order a\n * conversation's states with `sequenceVerdict` or `applyConversationState`.\n * It never throws for a bad delivery; it throws a `TypeError` for a missing\n * secret or a tolerance that is not a whole number of seconds from 0 to 300,\n * and `WebCryptoUnavailableError` in a runtime without Web Crypto.\n */\nexport async function verifyWebhook(\n  options: VerifyWebhookOptions,\n): Promise<VerifyWebhookResult> {\n  const secrets = signingSecrets(options.secret);\n  const toleranceSeconds = checkTolerance(options.toleranceSeconds);\n  const header = singleHeader(options.header);\n  if (header === undefined) {\n    return {\n      ok: false,\n      error: webhookError('missing', 'no Vinaverse-Signature header'),\n    };\n  }\n  if (header === null) {\n    return {\n      ok: false,\n      error: webhookError(\n        'malformed',\n        'more than one Vinaverse-Signature header',\n      ),\n    };\n  }\n  const body = toBytes(options.rawBody);\n  const refused = await checkSignature({\n    body,\n    header,\n    secrets,\n    now: options.now ?? new Date(),\n    toleranceSeconds,\n  });\n  if (refused) return { ok: false, error: refused };\n  let text: string;\n  try {\n    text = new TextDecoder('utf-8', { fatal: true }).decode(body);\n  } catch {\n    return {\n      ok: false,\n      error: webhookError('invalid_body', 'the body is not UTF-8'),\n    };\n  }\n  const read = readBody(text);\n  return 'code' in read ? { ok: false, error: read } : { ok: true, ...read };\n}\n\n// undefined: absent; null: more than one; otherwise the header.\nfunction singleHeader(\n  header: string | readonly string[] | null | undefined,\n): string | null | undefined {\n  if (header === null || header === undefined) return undefined;\n  if (typeof header === 'string') return header === '' ? undefined : header;\n  if (header.length === 0) return undefined;\n  return header.length === 1 ? header[0] : null;\n}\n\n/** The signing secrets, checked: a TypeError for none, an empty one, or an unset variable. */\nexport function signingSecrets(secret: unknown): string[] {\n  const list =\n    typeof secret === 'string'\n      ? [secret]\n      : Array.isArray(secret)\n        ? [...secret]\n        : [];\n  if (\n    list.length === 0 ||\n    list.some((s) => typeof s !== 'string' || s === '')\n  ) {\n    throw new TypeError(\n      'the webhook signing secret is required (vv_whsec_…), and none was given',\n    );\n  }\n  return list as string[];\n}\n\n/**\n * The tolerance, checked once: whole seconds from 0 to 300. A wider window is\n * a longer replay window than the contract allows.\n */\nexport function checkTolerance(seconds: number | undefined): number {\n  if (seconds === undefined) return TOLERANCE_SECONDS;\n  if (\n    !Number.isSafeInteger(seconds) ||\n    seconds < 0 ||\n    seconds > TOLERANCE_SECONDS\n  ) {\n    throw new TypeError(\n      `toleranceSeconds must be a whole number of seconds from 0 to ${TOLERANCE_SECONDS}, not ${seconds}`,\n    );\n  }\n  return seconds;\n}\n"]}

package/dist/chunk-NPXO6SMZ.js

@@ -0,0 +1,84 @@
+import { checkHandlerOptions, MAX_BODY_BYTES, tooLarge, handleWebhook } from './chunk-FEEJNQXV.js';
+
+// src/adapters/fetch.ts
+function createFetchWebhookHandler(options) {
+  checkHandlerOptions(options);
+  const max = options.maxBodyBytes ?? MAX_BODY_BYTES;
+  return async (request) => {
+    const body = await readCapped(request, max);
+    if (body === void 0) return toResponse(tooLarge());
+    return toResponse(
+      await handleWebhook(
+        options,
+        body,
+        request.headers.get("vinaverse-signature")
+      )
+    );
+  };
+}
+async function readCapped(request, max) {
+  const declared = Number(request.headers.get("content-length") ?? "0");
+  if (declared > max) return void 0;
+  if (!request.body) return new Uint8Array(0);
+  const reader = request.body.getReader();
+  const chunks = [];
+  let size = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.length;
+    if (size > max) {
+      await reader.cancel();
+      return void 0;
+    }
+    chunks.push(value);
+  }
+  const body = new Uint8Array(size);
+  let at = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, at);
+    at += chunk.length;
+  }
+  return body;
+}
+function toResponse(response) {
+  return new Response(response.body, {
+    status: response.status,
+    headers: { "content-type": "application/json" }
+  });
+}
+function createFetchToolHandler(provider, options = {}) {
+  const max = options.maxBodyBytes ?? MAX_BODY_BYTES;
+  return async (request) => {
+    const url = new URL(request.url);
+    const reads = request.method !== "GET" && request.method !== "HEAD";
+    const body = reads ? await readCapped(request, max) : null;
+    if (body === void 0) {
+      return new Response(
+        JSON.stringify({
+          status: 413,
+          code: "invalid_argument",
+          detail: "the request body is too large"
+        }),
+        {
+          status: 413,
+          headers: { "content-type": "application/problem+json" }
+        }
+      );
+    }
+    const response = await provider.handle({
+      method: request.method,
+      target: `${url.pathname}${url.search}`,
+      header: (name) => request.headers.get(name) ?? void 0,
+      body
+    });
+    return new Response(response.body, {
+      status: response.status,
+      headers: response.headers
+    });
+  };
+}
+
+export { createFetchToolHandler, createFetchWebhookHandler };
+//# sourceMappingURL=chunk-NPXO6SMZ.js.map
+//# sourceMappingURL=chunk-NPXO6SMZ.js.map

package/dist/chunk-NPXO6SMZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/fetch.ts"],"names":[],"mappings":";;;AAqBO,SAAS,0BACd,OAAA,EACyC;AACzC,EAAA,mBAAA,CAAoB,OAAO,CAAA;AAC3B,EAAA,MAAM,GAAA,GAAM,QAAQ,YAAA,IAAgB,cAAA;AACpC,EAAA,OAAO,OAAO,OAAA,KAAY;AACxB,IAAA,MAAM,IAAA,GAAO,MAAM,UAAA,CAAW,OAAA,EAAS,GAAG,CAAA;AAC1C,IAAA,IAAI,IAAA,KAAS,MAAA,EAAW,OAAO,UAAA,CAAW,UAAU,CAAA;AACpD,IAAA,OAAO,UAAA;AAAA,MACL,MAAM,aAAA;AAAA,QACJ,OAAA;AAAA,QACA,IAAA;AAAA,QACA,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,qBAAqB;AAAA;AAC3C,KACF;AAAA,EACF,CAAA;AACF;AAMA,eAAsB,UAAA,CACpB,SACA,GAAA,EACiC;AACjC,EAAA,MAAM,WAAW,MAAA,CAAO,OAAA,CAAQ,QAAQ,GAAA,CAAI,gBAAgB,KAAK,GAAG,CAAA;AACpE,EAAA,IAAI,QAAA,GAAW,KAAK,OAAO,MAAA;AAC3B,EAAA,IAAI,CAAC,OAAA,CAAQ,IAAA,EAAM,OAAO,IAAI,WAAW,CAAC,CAAA;AAC1C,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,IAAA,CAAK,SAAA,EAAU;AACtC,EAAA,MAAM,SAAuB,EAAC;AAC9B,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,WAAS;AACP,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,OAAO,IAAA,EAAK;AAC1C,IAAA,IAAI,IAAA,EAAM;AACV,IAAA,IAAA,IAAQ,KAAA,CAAM,MAAA;AACd,IAAA,IAAI,OAAO,GAAA,EAAK;AACd,MAAA,MAAM,OAAO,MAAA,EAAO;AACpB,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,EACnB;AACA,EAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW,IAAI,CAAA;AAChC,EAAA,IAAI,EAAA,GAAK,CAAA;AACT,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,IAAA,CAAK,GAAA,CAAI,OAAO,EAAE,CAAA;AAClB,IAAA,EAAA,IAAM,KAAA,CAAM,MAAA;AAAA,EACd;AACA,EAAA,OAAO,IAAA;AACT;AAEO,SAAS,WAAW,QAAA,EAAqC;AAC9D,EAAA,OAAO,IAAI,QAAA,CAAS,QAAA,CAAS,IAAA,EAAM;AAAA,IACjC,QAAQ,QAAA,CAAS,MAAA;AAAA,IACjB,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,GAC/C,CAAA;AACH;AASO,SAAS,sBAAA,CACd,QAAA,EACA,OAAA,GAAqC,EAAC,EACG;AACzC,EAAA,MAAM,GAAA,GAAM,QAAQ,YAAA,IAAgB,cAAA;AACpC,EAAA,OAAO,OAAO,OAAA,KAAY;AACxB,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAC/B,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,MAAA,KAAW,KAAA,IAAS,QAAQ,MAAA,KAAW,MAAA;AAC7D,IAAA,MAAM,OAAO,KAAA,GAAQ,MAAM,UAAA,CAAW,OAAA,EAAS,GAAG,CAAA,GAAI,IAAA;AACtD,IAAA,IAAI,SAAS,MAAA,EAAW;AACtB,MAAA,OAAO,IAAI,QAAA;AAAA,QACT,KAAK,SAAA,CAAU;AAAA,UACb,MAAA,EAAQ,GAAA;AAAA,UACR,IAAA,EAAM,kBAAA;AAAA,UACN,MAAA,EAAQ;AAAA,SACT,CAAA;AAAA,QACD;AAAA,UACE,MAAA,EAAQ,GAAA;AAAA,UACR,OAAA,EAAS,EAAE,cAAA,EAAgB,0BAAA;AAA2B;AACxD,OACF;AAAA,IACF;AACA,IAAA,MAAM,QAAA,GAAW,MAAM,QAAA,CAAS,MAAA,CAAO;AAAA,MACrC,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,QAAQ,CAAA,EAAG,GAAA,CAAI,QAAQ,CAAA,EAAG,IAAI,MAAM,CAAA,CAAA;AAAA,MACpC,QAAQ,CAAC,IAAA,KAAS,QAAQ,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA,IAAK,MAAA;AAAA,MAC/C;AAAA,KACD,CAAA;AACD,IAAA,OAAO,IAAI,QAAA,CAAS,QAAA,CAAS,IAAA,EAAM;AAAA,MACjC,QAAQ,QAAA,CAAS,MAAA;AAAA,MACjB,SAAS,QAAA,CAAS;AAAA,KACnB,CAAA;AAAA,EACH,CAAA;AACF","file":"chunk-NPXO6SMZ.js","sourcesContent":["// Web-standard handlers: anything that hands over a `Request` and takes a\n// `Response` (Hono, Next.js route handlers, Cloudflare Workers, Deno, Bun).\nimport {\n  checkHandlerOptions,\n  handleWebhook,\n  MAX_BODY_BYTES,\n  tooLarge,\n  type WebhookHandlerOptions,\n  type WebhookResponse,\n} from './handler.js';\n\nexport type { WebhookHandlerOptions } from './handler.js';\n\nimport type { ToolProvider } from '../tools/provider.js';\n\n/**\n * `(request) => Promise<Response>` for a Vinaverse webhook endpoint. It reads\n * the raw body itself, so mount it where nothing has parsed the body:\n *\n *   export const POST = createFetchWebhookHandler({ secret, onEvent });\n */\nexport function createFetchWebhookHandler(\n  options: WebhookHandlerOptions,\n): (request: Request) => Promise<Response> {\n  checkHandlerOptions(options);\n  const max = options.maxBodyBytes ?? MAX_BODY_BYTES;\n  return async (request) => {\n    const body = await readCapped(request, max);\n    if (body === undefined) return toResponse(tooLarge());\n    return toResponse(\n      await handleWebhook(\n        options,\n        body,\n        request.headers.get('vinaverse-signature'),\n      ),\n    );\n  };\n}\n\n/**\n * The body, read as a stream and stopped past `max` bytes (undefined then),\n * so neither a declared nor a chunked oversized body is held in memory.\n */\nexport async function readCapped(\n  request: Request,\n  max: number,\n): Promise<Uint8Array | undefined> {\n  const declared = Number(request.headers.get('content-length') ?? '0');\n  if (declared > max) return undefined;\n  if (!request.body) return new Uint8Array(0);\n  const reader = request.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let size = 0;\n  for (;;) {\n    const { done, value } = await reader.read();\n    if (done) break;\n    size += value.length;\n    if (size > max) {\n      await reader.cancel();\n      return undefined;\n    }\n    chunks.push(value);\n  }\n  const body = new Uint8Array(size);\n  let at = 0;\n  for (const chunk of chunks) {\n    body.set(chunk, at);\n    at += chunk.length;\n  }\n  return body;\n}\n\nexport function toResponse(response: WebhookResponse): Response {\n  return new Response(response.body, {\n    status: response.status,\n    headers: { 'content-type': 'application/json' },\n  });\n}\n\n/**\n * `(request) => Promise<Response>` serving a tenant's tools: every tool route\n * under the provider's `basePath`, with the contract enforced. The target is\n * the request URL's path and query as received.\n *\n *   const handle = createFetchToolHandler(createToolProvider({ … }));\n */\nexport function createFetchToolHandler(\n  provider: ToolProvider,\n  options: { maxBodyBytes?: number } = {},\n): (request: Request) => Promise<Response> {\n  const max = options.maxBodyBytes ?? MAX_BODY_BYTES;\n  return async (request) => {\n    const url = new URL(request.url);\n    const reads = request.method !== 'GET' && request.method !== 'HEAD';\n    const body = reads ? await readCapped(request, max) : null;\n    if (body === undefined) {\n      return new Response(\n        JSON.stringify({\n          status: 413,\n          code: 'invalid_argument',\n          detail: 'the request body is too large',\n        }),\n        {\n          status: 413,\n          headers: { 'content-type': 'application/problem+json' },\n        },\n      );\n    }\n    const response = await provider.handle({\n      method: request.method,\n      target: `${url.pathname}${url.search}`,\n      header: (name) => request.headers.get(name) ?? undefined,\n      body,\n    });\n    return new Response(response.body, {\n      status: response.status,\n      headers: response.headers,\n    });\n  };\n}\n"]}

package/dist/chunk-SDJFZPHJ.js

@@ -0,0 +1,141 @@
+import { sha256Hex, utf8, checkTolerance, subtleCrypto, hmacKey, hexToBytes } from './chunk-GTPMQKGX.js';
+
+// src/tools/nonces.ts
+var NONCE_KEEP_SECONDS = 360;
+var MemoryNonceStore = class {
+  #seen = /* @__PURE__ */ new Map();
+  #now;
+  #sweepEvery;
+  #claims = 0;
+  constructor(options = {}) {
+    this.#now = options.now ?? (() => Math.floor(Date.now() / 1e3));
+    this.#sweepEvery = Math.max(1, options.sweepEvery ?? 256);
+  }
+  async claim(nonce, keepUntil) {
+    const now = this.#now();
+    if (++this.#claims % this.#sweepEvery === 0) {
+      for (const [n, until2] of this.#seen) {
+        if (until2 < now) this.#seen.delete(n);
+      }
+    }
+    const until = this.#seen.get(nonce);
+    if (until !== void 0 && until >= now) return false;
+    this.#seen.set(nonce, keepUntil);
+    return true;
+  }
+  /** Nonces held, expired ones included until a sweep drops them. */
+  get size() {
+    return this.#seen.size;
+  }
+};
+
+// src/tools/signature.ts
+var TOOL_TOLERANCE_SECONDS = 300;
+var T = /^[0-9]{1,12}$/;
+var NONCE = /^[A-Za-z0-9_-]{16,64}$/;
+var MAC = /^[0-9a-f]{64}$/;
+function parseToolSignature(header) {
+  let t;
+  let n;
+  let seenT = 0;
+  let seenN = 0;
+  const v2 = [];
+  for (const part of header.split(",")) {
+    const trimmed = part.trim();
+    const at = trimmed.indexOf("=");
+    const key = at < 0 ? trimmed : trimmed.slice(0, at);
+    const value = at < 0 ? "" : trimmed.slice(at + 1);
+    if (key === "t") {
+      seenT++;
+      if (T.test(value)) t = Number(value);
+    } else if (key === "n") {
+      seenN++;
+      n = value;
+    } else if (key === "v2" && MAC.test(value)) {
+      v2.push(value);
+    }
+  }
+  return { t, n, v2, repeated: seenT > 1 || seenN > 1 };
+}
+async function toolSigningString(call) {
+  const bodyHash = call.body && call.body.length > 0 ? await sha256Hex(call.body) : "";
+  return utf8(
+    [
+      "v2",
+      String(call.t),
+      call.n,
+      call.method.toUpperCase(),
+      call.target,
+      await sha256Hex(utf8(call.token)),
+      bodyHash
+    ].join("\n")
+  );
+}
+async function verifyToolCall(call, options) {
+  if (!call.header) {
+    return refusal("missing", "no Vinaverse-Signature header");
+  }
+  const { t, n, v2, repeated } = parseToolSignature(call.header);
+  if (repeated) {
+    return refusal(
+      "malformed",
+      "the signature repeats t or n: an ambiguous header"
+    );
+  }
+  if (t === void 0) {
+    return refusal(
+      "malformed",
+      "the signature has no timestamp t=<unix seconds>"
+    );
+  }
+  const now = Math.floor(options.now.getTime() / 1e3);
+  const tolerance = options.toleranceSeconds === void 0 ? TOOL_TOLERANCE_SECONDS : checkTolerance(options.toleranceSeconds);
+  if (Math.abs(now - t) > tolerance) {
+    return refusal(
+      "stale",
+      `the signature is ${Math.abs(now - t)} seconds from now; at most ${tolerance} are accepted`
+    );
+  }
+  if (v2.length === 0) {
+    return refusal(
+      "v2_required",
+      "the signature has no v2 (a v1-only header binds neither the token nor a nonce)"
+    );
+  }
+  if (n === void 0 || !NONCE.test(n)) {
+    return refusal(
+      "malformed",
+      "the signature has no valid nonce n (16 to 64 of A-Z a-z 0-9 - _)"
+    );
+  }
+  const message = await toolSigningString({ ...call, t, n });
+  const subtle = await subtleCrypto();
+  let matched = false;
+  for (const secret of options.secrets) {
+    const key = await hmacKey(secret, "verify");
+    for (const mac of v2) {
+      if (await subtle.verify("HMAC", key, hexToBytes(mac), message)) {
+        matched = true;
+        break;
+      }
+    }
+    if (matched) break;
+  }
+  if (!matched) {
+    return refusal(
+      "mismatch",
+      "no v2 signature matches: check the tool signing secret, and verify the method, target, token and body exactly as received"
+    );
+  }
+  if (!await options.nonces.claim(n, Math.max(t, now) + NONCE_KEEP_SECONDS)) {
+    return refusal("replayed", "this nonce was already used: a replayed call");
+  }
+  return null;
+}
+function refusal(code, message) {
+  return { code, message };
+}
+
+export { MemoryNonceStore, NONCE_KEEP_SECONDS, toolSigningString, verifyToolCall };
+//# sourceMappingURL=chunk-SDJFZPHJ.js.map
+//# sourceMappingURL=chunk-SDJFZPHJ.js.map