@visulima/notification 1.0.16 → 1.1.0

package/dist/providers/webhook/index.d.ts

@@ -14,5 +14,7 @@ interface WebhookConfig extends BaseConfig {
  * @param config Optional config.
  * @returns A webhook-channel provider.
  */
-declare const webhookProvider: (config?: WebhookConfig) => Provider<WebhookConfig, WebhookPayload>;
-export { type WebhookConfig, webhookProvider };
+declare const webhookProvider$1: (config?: WebhookConfig) => Provider<WebhookConfig, WebhookPayload>;
+/** @deprecated Renamed to `createWebhookProvider`; removed in the next major. */
+declare const webhookProvider: typeof webhookProvider$1;
+export { type WebhookConfig, webhookProvider$1 as createWebhookProvider, webhookProvider };

package/dist/providers/webhook/index.js

@@ -1 +1 @@
-import{webhookProvider as e}from"../../packem_shared/webhookProvider-C13EqjLL.js";export{e as webhookProvider};
+import{webhookProvider as o}from"../../packem_shared/createWebhookProvider-C13EqjLL.js";const e=o;export{o as createWebhookProvider,e as webhookProvider};

package/dist/webhooks/index.d.ts

@@ -1,4 +1,6 @@
-import { N as NotificationEvent } from "../packem_shared/types.d-C7l7qdMG.js";
+import { a as WebhookVerifier } from "../packem_shared/types.d-BXfGenMH.js";
+export { type W as WebhookHeaders, g as getHeader } from "../packem_shared/types.d-BXfGenMH.js";
+import "../packem_shared/types.d-C7l7qdMG.js";
 /**
  * Computes an HMAC over `message` and returns the lowercase hex digest.
  * @param key The shared secret (UTF-8 string) or raw key bytes.
@@ -25,38 +27,6 @@ declare const hmacBase64: (key: string | Uint8Array, message: string, hash: "SHA
  * @returns `true` when the strings are equal.
  */
 declare const timingSafeEqual: (a: string, b: string) => boolean;
-/**
- * Case-insensitive map of inbound request headers. Values may be a single string or
- * an array (mirroring `node:http` and `Headers`); verifiers normalise both forms.
- */
-type WebhookHeaders = Record<string, string | string[] | undefined>;
-/**
- * A provider inbound-webhook verifier: validates the request signature and normalises
- * the body into a {@link NotificationEvent}.
- */
-interface WebhookVerifier {
-  /**
-   * Normalises a verified webhook body into a {@link NotificationEvent}.
-   * @param body The raw request body (string).
-   * @returns The normalised event, or `undefined` when the body is not a delivery event.
-   */
-  parse: (body: string) => NotificationEvent | undefined;
-  /**
-   * Verifies the request signature against the shared secret.
-   * @param payload The raw request body (string).
-   * @param headers The inbound request headers.
-   * @param secret The provider signing secret / auth token.
-   * @returns `true` when the signature is valid.
-   */
-  verify: (payload: string, headers: WebhookHeaders, secret: string) => Promise<boolean>;
-}
-/**
- * Reads a header value case-insensitively, coercing array values to their first entry.
- * @param headers The inbound headers.
- * @param name The header name to read.
- * @returns The header value, or `undefined` when absent.
- */
-declare const getHeader: (headers: WebhookHeaders, name: string) => string | undefined;
 /**
  * Verifier + parser for Slack event/interaction webhooks.
  *
@@ -66,22 +36,40 @@ declare const getHeader: (headers: WebhookHeaders, name: string) => string | und
  * Web Crypto only.
  */
 declare const slackWebhook: WebhookVerifier;
+/**
+ * SNS message envelope (the relevant subset). SNS delivers every field as a string.
+ */
+interface SnsMessage {
+  [key: string]: unknown;
+  Message?: string;
+  MessageId?: string;
+  Signature?: string;
+  SignatureVersion?: string;
+  SigningCertURL?: string;
+  SubscribeURL?: string;
+  Timestamp?: string;
+  TopicArn?: string;
+  Type?: string;
+}
+/**
+ * Verifies an AWS SNS message signature (SignatureVersion 1 = RSA-SHA1, 2 = RSA-SHA256) against
+ * the certificate at its `SigningCertURL`. Validates the certificate host, rebuilds the
+ * canonical string-to-sign, fetches (and caches) the signing certificate, and checks the RSA
+ * signature with Web Crypto. Returns `false` on any malformed input, disallowed host, stale
+ * `Timestamp`, fetch failure or signature mismatch. Edge-safe — `fetch` + Web Crypto only.
+ * @param message The parsed SNS envelope.
+ * @returns `true` when the signature is valid.
+ */
+declare const verifySnsMessage: (message: SnsMessage) => Promise<boolean>;
 /**
  * Verifier + parser for AWS SNS HTTP/S subscription deliveries.
  *
- * NOTE: signature verification is NOT yet implemented. Real verification requires
- * fetching the X.509 certificate at `SigningCertURL`, validating its cert chain back to
- * an Amazon root, and checking the RSA-SHA1/RSA-SHA256 signature over the canonical
- * string-to-sign (SignatureVersion 1 and 2). Until that lands, {@link snsWebhook.verify}
- * fails closed and always returns `false` — accepting a payload purely on its structure
- * (a `Signature` field plus an `sns.*.amazonaws.com` `SigningCertURL`) is an auth bypass,
- * since both are attacker-controllable. `parse` remains available for callers that have
- * verified the message out-of-band. Callers handling `SubscriptionConfirmation` should
- * confirm the subscription by requesting the `SubscribeURL` from the parsed metadata.
- * Edge-safe — performs no `node:*` work.
- *
- * TODO: implement RSA-SHA1/RSA-SHA256 verification of the canonical string-to-sign
- * against the fetched signing certificate (SignatureVersion 1 and 2).
+ * `verify` implements SNS SignatureVersion 1 (RSA-SHA1) and 2 (RSA-SHA256): it validates the
+ * `SigningCertURL` host, rebuilds the canonical string-to-sign, fetches and caches the signing
+ * certificate, extracts its RSA public key and checks the signature — all with `fetch` + Web
+ * Crypto, so it runs on edge runtimes. `headers` and `secret` are unused (SNS is asymmetric).
+ * Callers handling `SubscriptionConfirmation` should confirm by requesting the `SubscribeURL`
+ * from the parsed metadata.
  */
 declare const snsWebhook: WebhookVerifier;
 /**
@@ -107,4 +95,4 @@ declare const standardWebhook: WebhookVerifier;
  * Edge-safe — uses Web Crypto only.
  */
 declare const twilioWebhook: WebhookVerifier;
-export { type WebhookHeaders, type WebhookVerifier, getHeader, hmacBase64, hmacHex, slackWebhook, snsWebhook, standardWebhook, timingSafeEqual, twilioWebhook };
+export { type WebhookVerifier, hmacBase64, hmacHex, slackWebhook, snsWebhook, standardWebhook, timingSafeEqual, twilioWebhook, verifySnsMessage };

package/dist/webhooks/index.js

@@ -1 +1 @@
-import{hmacBase64 as r,hmacHex as t,timingSafeEqual as a}from"../packem_shared/hmacBase64-Dtvoq4Ry.js";import{slackWebhook as f}from"../packem_shared/slackWebhook-CGbFBgpo.js";import{snsWebhook as h}from"../packem_shared/snsWebhook-eOX1eh23.js";import{standardWebhook as k}from"../packem_shared/standardWebhook-DV_fVNtX.js";import{twilioWebhook as b}from"../packem_shared/twilioWebhook-DScQeZta.js";import{getHeader as W}from"../packem_shared/getHeader-BF9s-Tgp.js";export{W as getHeader,r as hmacBase64,t as hmacHex,f as slackWebhook,h as snsWebhook,k as standardWebhook,a as timingSafeEqual,b as twilioWebhook};
+import{hmacBase64 as r,hmacHex as a,timingSafeEqual as t}from"../packem_shared/hmacBase64-ocSXhrdQ.js";import{slackWebhook as f}from"../packem_shared/slackWebhook-DILLGl3P.js";import{snsWebhook as x,verifySnsMessage as h}from"../packem_shared/snsWebhook-DTBQW5U5.js";import{standardWebhook as i}from"../packem_shared/standardWebhook-CPjtIEKe.js";import{twilioWebhook as b}from"../packem_shared/twilioWebhook-BjM8B0sB.js";import{getHeader as W}from"../packem_shared/getHeader-BF9s-Tgp.js";export{W as getHeader,r as hmacBase64,a as hmacHex,f as slackWebhook,x as snsWebhook,i as standardWebhook,t as timingSafeEqual,b as twilioWebhook,h as verifySnsMessage};

package/package.json

@@ -1,10 +1,14 @@
 {
   "name": "@visulima/notification",
-  "version": "1.0.16",
+  "version": "1.1.0",
   "description": "A reusable, ESM-only, edge-ready multi-channel notification library with SMS, push, chat, in-app and webhook providers",
   "keywords": [
+    "agent",
+    "ai",
     "apns",
     "aws-sns",
+    "chatbot",
+    "inbound",
     "chat",
     "discord",
     "expo",
@@ -188,6 +192,10 @@
       "types": "./dist/webhooks/index.d.ts",
       "default": "./dist/webhooks/index.js"
     },
+    "./inbound": {
+      "types": "./dist/inbound/index.d.ts",
+      "default": "./dist/inbound/index.js"
+    },
     "./template/string": {
       "types": "./dist/template-engines/string.d.ts",
       "default": "./dist/template-engines/string.js"
@@ -230,7 +238,7 @@
   "peerDependencies": {
     "@aws-sdk/client-sqs": "^3.0.0",
     "@opentelemetry/api": "^1.0.0 || ^2.0.0",
-    "@visulima/email": "3.0.2",
+    "@visulima/email": "3.0.4",
     "@visulima/workflow": "3.0.0",
     "bullmq": "^5.0.0",
     "croner": "^10.0.1",

package/dist/packem_shared/hmacBase64-Dtvoq4Ry.js

@@ -1 +0,0 @@
-import{t as s,h as o,a as i}from"./webcrypto-Cz40u9vp.js";const r=300,h=async(t,n,e)=>i(await o(t,n,e)),l=async(t,n,e)=>s(await o(t,n,e)),f=(t,n)=>{if(t.length!==n.length)return!1;let e=0;for(let a=0;a<t.length;a+=1)e|=(t.codePointAt(a)??0)^(n.codePointAt(a)??0);return e===0},m=(t,n)=>{if(t===void 0)return!1;const e=Number.parseInt(t,10);if(Number.isNaN(e))return!1;const a=Math.floor(Date.now()/1e3);return Math.abs(a-e)<=n};export{r as REPLAY_WINDOW_SECONDS,l as hmacBase64,h as hmacHex,m as isWithinReplayWindow,f as timingSafeEqual};

package/dist/packem_shared/snsWebhook-eOX1eh23.js

@@ -1 +0,0 @@
-import{tryParseObject as r}from"./getHeader-BF9s-Tgp.js";const o=s=>r(s),a={parse:s=>{const e=o(s);if(e?.Type===void 0)return;const i={type:e.Type};return e.Type==="SubscriptionConfirmation"||e.Type==="UnsubscribeConfirmation"?i.subscribeUrl=e.SubscribeURL:e.Message!==void 0&&(i.message=e.Message),{messageId:e.MessageId??"",metadata:i,provider:"sns",timestamp:e.Timestamp===void 0?new Date:new Date(e.Timestamp),type:"delivered"}},verify:()=>Promise.resolve(!1)};export{a as snsWebhook};