npm - @voltro/plugin-webhooks - Versions diffs - 0.32.0 → 0.34.0 - Mend

@voltro/plugin-webhooks 0.32.0 → 0.34.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (11) hide show

package/CHANGELOG.md +2006 -0
package/THIRD-PARTY-NOTICES.md +1 -29
package/dist/index.d.ts +355 -37
package/dist/index.js +398 -344
package/dist/mixin.d.ts +2 -2
package/dist/mixin.js +2 -0
package/dist/providers/index.d.ts +39 -6
package/dist/providers/index.js +16 -18
package/dist/signing-DeHObNv6.js +234 -0
package/package.json +9 -8
package/dist/signing-DUG4JWwk.js +0 -117

package/dist/mixin.d.ts CHANGED Viewed

@@ -32,7 +32,7 @@ export declare const _voltroWebhookDeliveriesTable: Table<"_voltro_webhook_deliv
     readonly eventId: ColumnBuilder<string | null, "text", boolean>;
     /** Attempt counter (1-indexed). */
     readonly attempt: ColumnBuilder<number, "integer", boolean>;
-    readonly status: ColumnBuilder<"failed" | "succeeded" | "inFlight" | "pending" | "retryScheduled", "text", boolean>;
+    readonly status: ColumnBuilder<"failed" | "pending" | "succeeded" | "inFlight" | "retryScheduled", "text", boolean>;
     /** Payload as sent over the wire. Stored verbatim — re-rendering
      *  from a referenced event row would lose the snapshot if the
      *  source event was deleted. */
@@ -384,7 +384,7 @@ export declare const webhookTables: () => readonly [ Table<"_voltro_webhook_targ
     readonly eventId: ColumnBuilder<string | null, "text", boolean>;
     /** Attempt counter (1-indexed). */
     readonly attempt: ColumnBuilder<number, "integer", boolean>;
-    readonly status: ColumnBuilder<"failed" | "succeeded" | "inFlight" | "pending" | "retryScheduled", "text", boolean>;
+    readonly status: ColumnBuilder<"failed" | "pending" | "succeeded" | "inFlight" | "retryScheduled", "text", boolean>;
     /** Payload as sent over the wire. Stored verbatim — re-rendering
      *  from a referenced event row would lose the snapshot if the
      *  source event was deleted. */

package/dist/mixin.js CHANGED Viewed

@@ -60,10 +60,12 @@ var u = o("_voltro_webhook_targets", {
 	createdAt: c(),
 	updatedAt: c()
 }), m = () => (i({
+	source: "plugin",
 	table: "_voltro_webhook_deliveries",
 	timeColumn: "createdAt",
 	ttlMs: a(process.env.VOLTRO_WEBHOOK_DELIVERIES_TTL_HOURS, 2160)
 }), i({
+	source: "plugin",
 	table: "_voltro_webhook_rate_windows",
 	timeColumn: "createdAt",
 	ttlMs: 24 * 36e5

package/dist/providers/index.d.ts CHANGED Viewed

@@ -5,7 +5,10 @@ declare interface CustomSignatureScheme {
     readonly _tag: 'custom';
     readonly header: string;
     readonly sign: (rawBody: Uint8Array, secret: string) => string;
-    readonly verify: (rawBody: Uint8Array, secret: string, signatureHeader: string) => boolean;
+    /** Verify against the request's FULL header map (lowercased keys) — a scheme
+     *  whose timestamp lives in a second header can read it here instead of
+     *  relying on a caller to splice the two values together. */
+    readonly verify: (rawBody: Uint8Array, secret: string, headers: Readonly<Record<string, string>>) => boolean;
 }
 export declare const genericProvider: (options?: {
@@ -74,11 +77,24 @@ declare interface IncomingWebhookDescriptor<Body> {
      *  integrations (`/integrations/stripe/v1`). */
     readonly path?: `/${string}`;
     /** Signature scheme used to authenticate inbound requests. Reject
-     *  on mismatch with a 401. `undefined` (the default) means NO
-     *  verification — only acceptable when behind a separate trust
-     *  boundary (gateway + IP allow-list). The dashboard surfaces a
-     *  warning for unsigned incoming webhooks. */
+     *  on mismatch with a 401. Usually filled in by `provider`. */
     readonly signature?: SignatureScheme;
+    /**
+     * How this endpoint authenticates its caller. An incoming webhook is a
+     * PUBLIC POST that runs your application code, so the framework will not
+     * mount one that has made no decision here: `mountIncomingWebhook` throws
+     * at boot when there is no effective `signature` (from this descriptor or
+     * from `provider`) AND no explicit value below.
+     *
+     *  - omitted → derived. `signature` / `provider` present → `'signature'`;
+     *    nothing present → boot refuses.
+     *  - `'provider'` → the handler verifies with the provider's own SDK
+     *    (Stripe's `constructEvent`, etc.). The framework's generic HMAC layer
+     *    is not the authority and does not require a framework-side secret.
+     *  - `'none'` → deliberately unverified, because a gateway + IP allow-list
+     *    owns the trust boundary. Logged as a warning at every boot, on purpose.
+     */
+    readonly verification?: 'signature' | 'provider' | 'none';
     /** Idempotency key extraction. Default `'Idempotency-Key'` header.
      *  Provider-templates override this to match the provider's wire
      *  format. */
@@ -130,10 +146,27 @@ declare interface IncomingWorkflowFacade {
     }>;
 }
-declare type SignatureScheme = HmacSignatureScheme | CustomSignatureScheme;
+declare type SignatureScheme = HmacSignatureScheme | CustomSignatureScheme | StandardWebhooksSignatureScheme;
 export declare const slackProvider: () => WebhookProviderDescriptor;
+/**
+ * The Standard Webhooks (v1.0.0) scheme — three `webhook-*` headers, a
+ * `msg_id.timestamp.payload` signed content, base64 `v1,` signatures, a
+ * `whsec_`-prefixed base64 key. Implemented in `./standardWebhooks`, which
+ * carries the spec quotations and the interop vector it is verified against.
+ */
+declare interface StandardWebhooksSignatureScheme {
+    readonly _tag: 'standardWebhooks';
+    /** Replay tolerance. The spec REQUIRES a tolerance and names no number; 300s
+     *  is ours. */
+    readonly toleranceSeconds?: number;
+    /** A second key accepted on verify AND signed alongside on send — the spec's
+     *  zero-downtime rotation, which is what the space-delimited signature list
+     *  exists for. */
+    readonly previousSecret?: string;
+}
 export declare const stripeProvider: (options?: {
     /** Override the replay window. Stripe's default is 5 min;
      *  callers running tests sometimes want a wider window. */

package/dist/providers/index.js CHANGED Viewed

@@ -1,12 +1,12 @@
-import { a as e, c as t, n, t as r } from "../signing-DUG4JWwk.js";
+import { T as e, n as t, r as n, s as r } from "../signing-DeHObNv6.js";
 import { createHmac as i, timingSafeEqual as a } from "node:crypto";
 //#region src/providers/stripe.ts
-var o = (n) => t({
+var o = (t) => e({
 	id: "stripe",
 	name: "Stripe",
 	signature: {
-		...e(),
-		...n?.replayWindowSeconds === void 0 ? {} : { replayWindowSeconds: n.replayWindowSeconds }
+		...r(),
+		...t?.replayWindowSeconds === void 0 ? {} : { replayWindowSeconds: t.replayWindowSeconds }
 	},
 	idempotency: {
 		from: (e, t) => {
@@ -25,7 +25,7 @@ var o = (n) => t({
 			return typeof t == "string" ? t : void 0;
 		}
 	}
-}), s = () => t({
+}), s = () => e({
 	id: "github",
 	name: "GitHub",
 	signature: n(),
@@ -43,16 +43,14 @@ var o = (n) => t({
 		return `v0=${i("sha256", t).update(n).digest("hex")}`;
 	},
 	verify: (e, t, n) => {
-		let r = n.indexOf("|");
-		if (r === -1) return !1;
-		let o = n.slice(0, r), s = n.slice(r + 1);
-		if (!/^\d+$/.test(o)) return !1;
-		let c = Math.floor(Date.now() / 1e3);
-		if (Math.abs(c - Number(o)) > 300) return !1;
-		let l = `v0:${o}:${new TextDecoder().decode(e)}`, u = `v0=${i("sha256", t).update(l).digest("hex")}`, d = Buffer.from(u, "utf8"), f = Buffer.from(s, "utf8");
-		return d.length === f.length ? a(d, f) : (a(d, Buffer.alloc(d.length)), !1);
+		let r = n["x-slack-signature"], o = n["x-slack-request-timestamp"];
+		if (!r || !o || !/^\d+$/.test(o)) return !1;
+		let s = Math.floor(Date.now() / 1e3);
+		if (Math.abs(s - Number(o)) > 300) return !1;
+		let c = `v0:${o}:${new TextDecoder().decode(e)}`, l = `v0=${i("sha256", t).update(c).digest("hex")}`, u = Buffer.from(l, "utf8"), d = Buffer.from(r, "utf8");
+		return u.length === d.length ? a(u, d) : (a(u, Buffer.alloc(u.length)), !1);
 	}
-}), l = () => t({
+}), l = () => e({
 	id: "slack",
 	name: "Slack",
 	signature: c(),
@@ -70,13 +68,13 @@ var o = (n) => t({
 			}
 		}
 	}
-}), u = (e) => t({
+}), u = (n) => e({
 	id: "generic",
 	name: "Generic",
 	signature: {
-		...r(),
-		...e?.signatureHeader === void 0 ? {} : { header: e.signatureHeader },
-		...e?.replayWindowSeconds === void 0 ? {} : { replayWindowSeconds: e.replayWindowSeconds }
+		...t(),
+		...n?.signatureHeader === void 0 ? {} : { header: n.signatureHeader },
+		...n?.replayWindowSeconds === void 0 ? {} : { replayWindowSeconds: n.replayWindowSeconds }
 	},
 	idempotency: {
 		from: "idempotency-key",

package/dist/signing-DeHObNv6.js ADDED Viewed

@@ -0,0 +1,234 @@
+import { createHmac as e, randomBytes as t, timingSafeEqual as n } from "node:crypto";
+//#region src/dsl.ts
+var r = (e) => ({
+	_tag: "incomingWebhook",
+	...e
+}), i = (e) => ({
+	_tag: "webhookProvider",
+	...e
+}), a = (e) => {
+	if (typeof e != "object" || !e) return !1;
+	let t = e._tag;
+	return t === "outgoingEvent" || t === "incomingWebhook" || t === "webhookProvider";
+}, o = "webhook-id", s = "webhook-timestamp", c = "webhook-signature", l = "v1", u = "whsec_", d = 24, f = 64, p = 300, m = () => `${u}${t(32).toString("base64")}`, h = (e) => {
+	if (!e.startsWith("whsec_")) throw Error(`standard-webhooks: the signing secret must be the spec's serialization — "${u}" + base64(24..64 random bytes). Mint one with generateStandardWebhooksSecret(). (A hex secret is also valid base64, so accepting it would sign with the wrong key bytes and every conformant consumer would reject the delivery.)`);
+	let t = Buffer.from(e.slice(6), "base64");
+	if (t.length < 24 || t.length > 64) throw Error(`standard-webhooks: the decoded key is ${t.length} bytes; the spec requires 24..64.`);
+	return t;
+}, g = (e) => e.startsWith(u), _ = (e, t) => {
+	if (t.includes(".")) throw Error(`standard-webhooks: the ${e} may not contain "." — it is the field delimiter of the signed content (id.timestamp.payload), and a "." in it makes one signed string readable two ways. Got ${JSON.stringify(t)}.`);
+	if (t.length === 0) throw Error(`standard-webhooks: the ${e} may not be empty`);
+}, v = (e, t, n) => {
+	_("webhook-id", e);
+	let r = String(t);
+	return _("webhook-timestamp", r), Buffer.concat([Buffer.from(`${e}.${r}.`, "utf8"), Buffer.from(n)]);
+}, y = (t, n, r, i) => {
+	let a = e("sha256", h(t));
+	return a.update(v(n, r, i)), `v1,${a.digest("base64")}`;
+}, b = (e) => {
+	if (e.secrets.length === 0) throw Error("standard-webhooks: at least one signing secret is required");
+	let t = e.secrets.map((t) => y(t, e.messageId, e.timestampSeconds, e.rawBody));
+	return {
+		[o]: e.messageId,
+		[s]: String(e.timestampSeconds),
+		[c]: t.join(" ")
+	};
+}, x = (e, t) => {
+	let r = Buffer.from(e, "utf8"), i = Buffer.from(t, "utf8");
+	return r.length === i.length ? n(r, i) : (n(r, Buffer.alloc(r.length)), !1);
+}, S = (e) => {
+	let t = e.headers, n = t[o], r = t[s], i = t[c];
+	if (!n) return {
+		ok: !1,
+		reason: `missing ${o}`
+	};
+	if (!r) return {
+		ok: !1,
+		reason: `missing ${s}`
+	};
+	if (!i) return {
+		ok: !1,
+		reason: `missing ${c}`
+	};
+	if (n.includes(".")) return {
+		ok: !1,
+		reason: "webhook-id contains the \".\" field delimiter"
+	};
+	let a = Number(r);
+	if (!Number.isInteger(a)) return {
+		ok: !1,
+		reason: `${s} is not an integer unix timestamp`
+	};
+	let l = e.toleranceSeconds ?? 300, u = e.nowSeconds ?? Math.floor(Date.now() / 1e3), d = Math.abs(u - a);
+	if (d > l) return {
+		ok: !1,
+		reason: `timestamp outside the ${l}s tolerance (off by ${d}s)`
+	};
+	let f = i.split(" ").map((e) => e.trim()).filter((e) => e.length > 0);
+	if (f.length === 0) return {
+		ok: !1,
+		reason: "no signature in webhook-signature"
+	};
+	if (f.every((e) => e.startsWith("v1a,"))) return {
+		ok: !1,
+		reason: "only asymmetric (v1a / ed25519) signatures were offered; this verifier implements the symmetric v1 scheme only"
+	};
+	for (let t of e.secrets) {
+		let r;
+		try {
+			r = y(t, n, a, e.rawBody);
+		} catch (e) {
+			return {
+				ok: !1,
+				reason: e.message
+			};
+		}
+		for (let e of f) if (e.startsWith("v1,") && x(r, e)) return {
+			ok: !0,
+			messageId: n,
+			timestampSeconds: a
+		};
+	}
+	return {
+		ok: !1,
+		reason: "signature mismatch"
+	};
+}, C = (e) => e === "hmacSha256" ? "sha256" : "sha1", w = (t, n, r, i = "hex") => {
+	let a = e(C(t), n);
+	return a.update(r), a.digest(i);
+};
+function T(e, t) {
+	if (e._tag !== "hmac" || typeof e.header != "string") throw Error(`webhook signing: cannot ${t} with this scheme — expected one of "standardWebhooks" | "hmac" | "custom" with a header, got ${JSON.stringify(e)}`);
+}
+var E = (e, t) => {
+	let n = t.timestampSeconds ?? Math.floor(Date.now() / 1e3);
+	if (e._tag === "standardWebhooks") return {
+		headers: b({
+			secrets: e.previousSecret === void 0 ? [t.secret] : [t.secret, e.previousSecret],
+			messageId: t.messageId,
+			timestampSeconds: n,
+			rawBody: t.rawBody
+		}),
+		timestamp: n
+	};
+	if (e._tag === "custom") return { headers: { [e.header.toLowerCase()]: e.sign(t.rawBody, t.secret) } };
+	T(e, "sign");
+	let r = e.encoding ?? "hex", i = e.versionPrefix ?? "";
+	if (e.includeTimestamp) {
+		let a = Buffer.concat([Buffer.from(`${n}.`, "utf8"), Buffer.from(t.rawBody)]), o = w(e.algorithm, t.secret, a, r);
+		return {
+			headers: { [e.header.toLowerCase()]: `t=${n},${i}${o}` },
+			timestamp: n
+		};
+	}
+	let a = w(e.algorithm, t.secret, t.rawBody, r);
+	return { headers: { [e.header.toLowerCase()]: `${i}${a}` } };
+}, D = (e, t) => {
+	if (e._tag === "standardWebhooks") {
+		let n = S({
+			secrets: e.previousSecret === void 0 ? [t.secret] : [t.secret, e.previousSecret],
+			rawBody: t.rawBody,
+			headers: t.headers,
+			toleranceSeconds: e.toleranceSeconds ?? 300,
+			...t.nowSeconds === void 0 ? {} : { nowSeconds: t.nowSeconds }
+		});
+		return n.ok ? { ok: !0 } : {
+			ok: !1,
+			reason: n.reason
+		};
+	}
+	if (e._tag === "custom") return e.verify(t.rawBody, t.secret, t.headers) ? { ok: !0 } : {
+		ok: !1,
+		reason: "custom verifier rejected"
+	};
+	T(e, "verify");
+	let n = t.headers[e.header.toLowerCase()];
+	if (!n) return {
+		ok: !1,
+		reason: "missing signature header"
+	};
+	let r = e.encoding ?? "hex", i = e.versionPrefix ?? "", a = (a) => {
+		if (e.includeTimestamp) {
+			let o = n.split(",").map((e) => e.trim()), s = o.find((e) => e.startsWith("t="));
+			if (!s) return {
+				ok: !1,
+				reason: "no timestamp in signature header"
+			};
+			let c = Number(s.slice(2));
+			if (!Number.isFinite(c)) return {
+				ok: !1,
+				reason: "invalid timestamp"
+			};
+			let l = e.replayWindowSeconds ?? 300, u = t.nowSeconds ?? Math.floor(Date.now() / 1e3);
+			if (Math.abs(u - c) > l) return {
+				ok: !1,
+				reason: `replay window exceeded (${Math.abs(u - c)}s > ${l}s)`
+			};
+			let d = i.length > 0 ? o.find((e) => e.startsWith(i))?.slice(i.length) : o.find((e) => !e.startsWith("t="));
+			if (!d) return {
+				ok: !1,
+				reason: "no signature in header"
+			};
+			let f = Buffer.concat([Buffer.from(`${c}.`, "utf8"), Buffer.from(t.rawBody)]);
+			return O(w(e.algorithm, a, f, r), d) ? { ok: !0 } : {
+				ok: !1,
+				reason: "signature mismatch"
+			};
+		}
+		let o = i.length > 0 && n.startsWith(i) ? n.slice(i.length) : n;
+		return O(w(e.algorithm, a, t.rawBody, r), o) ? { ok: !0 } : {
+			ok: !1,
+			reason: "signature mismatch"
+		};
+	}, o = a(t.secret);
+	if (o.ok) return o;
+	if (e.previousSecret !== void 0) {
+		let t = a(e.previousSecret);
+		if (t.ok) return t;
+	}
+	return o;
+}, O = (e, t) => {
+	let r = Buffer.from(e, "utf8"), i = Buffer.from(t, "utf8");
+	return r.length === i.length ? n(r, i) : (n(r, Buffer.alloc(r.length)), !1);
+}, k = (e = "Stripe-Signature") => ({
+	_tag: "hmac",
+	algorithm: "hmacSha256",
+	header: e,
+	includeTimestamp: !0,
+	replayWindowSeconds: 300,
+	encoding: "hex",
+	versionPrefix: "v1="
+}), A = () => ({
+	_tag: "hmac",
+	algorithm: "hmacSha256",
+	header: "X-Hub-Signature-256",
+	includeTimestamp: !1,
+	encoding: "hex",
+	versionPrefix: "sha256="
+}), j = (e = {}) => ({
+	_tag: "custom",
+	header: "X-Slack-Signature",
+	sign: (e, t) => `v0=${w("hmacSha256", t, `v0:${Math.floor(Date.now() / 1e3)}:${Buffer.from(e).toString("utf8")}`)}`,
+	verify: (t, n, r) => {
+		let i = r["x-slack-signature"], a = r["x-slack-request-timestamp"];
+		if (!i || !a) return !1;
+		let o = Number(a);
+		if (!Number.isFinite(o)) return !1;
+		let s = e.replayWindowSeconds ?? 300;
+		return Math.abs(Math.floor(Date.now() / 1e3) - o) > s ? !1 : O(`v0=${w("hmacSha256", n, `v0:${o}:${Buffer.from(t).toString("utf8")}`)}`, i);
+	}
+}), M = (e = {}) => ({
+	_tag: "standardWebhooks",
+	...e.toleranceSeconds === void 0 ? {} : { toleranceSeconds: e.toleranceSeconds },
+	...e.previousSecret === void 0 ? {} : { previousSecret: e.previousSecret }
+}), N = () => M(), P = () => ({
+	_tag: "hmac",
+	algorithm: "hmacSha256",
+	header: "X-Webhook-Signature",
+	includeTimestamp: !0,
+	replayWindowSeconds: 300,
+	encoding: "hex",
+	versionPrefix: "v1="
+});
+//#endregion
+export { S as C, a as E, v as S, i as T, m as _, j as a, h as b, D as c, f as d, d as f, l as g, s as h, E as i, p as l, c as m, P as n, M as o, u as p, A as r, k as s, N as t, o as u, g as v, r as w, y as x, b as y };

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-webhooks",
-  "version": "0.32.0",
+  "version": "0.34.0",
   "description": "Webhooks plugin — first-class outgoing (multi-target, durable-workflow delivery, HMAC signing, retry policies, rate limits) + incoming (signature verification, idempotency, provider templates for Stripe / GitHub / Slack / generic).",
   "keywords": [
     "voltro",
@@ -37,7 +37,8 @@
       "types": "./dist/errors.d.ts",
       "import": "./dist/errors.js",
       "default": "./dist/errors.js"
-    }
+    },
+    "./package.json": "./package.json"
   },
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -48,12 +49,12 @@
   },
   "dependencies": {
     "@effect/workflow": "^0.19.0",
-    "@voltro/database": "0.32.0",
-    "@voltro/integration-http": "0.32.0",
-    "@voltro/logger": "0.32.0",
-    "@voltro/plugin-multitenancy": "0.32.0",
-    "@voltro/protocol": "0.32.0",
-    "@voltro/runtime": "0.32.0"
+    "@voltro/database": "0.34.0",
+    "@voltro/integration-http": "0.34.0",
+    "@voltro/logger": "0.34.0",
+    "@voltro/plugin-multitenancy": "0.34.0",
+    "@voltro/protocol": "0.34.0",
+    "@voltro/runtime": "0.34.0"
   },
   "peerDependencies": {
     "effect": "^3.22.0"

package/dist/signing-DUG4JWwk.js DELETED Viewed

@@ -1,117 +0,0 @@
-import { createHmac as e, timingSafeEqual as t } from "node:crypto";
-//#region src/dsl.ts
-var n = (e) => ({
-	_tag: "incomingWebhook",
-	...e
-}), r = (e) => ({
-	_tag: "webhookProvider",
-	...e
-}), i = (e) => {
-	if (typeof e != "object" || !e) return !1;
-	let t = e._tag;
-	return t === "outgoingEvent" || t === "incomingWebhook" || t === "webhookProvider";
-}, a = (e) => e === "hmacSha256" ? "sha256" : "sha1", o = (t, n, r, i = "hex") => {
-	let o = e(a(t), n);
-	return o.update(r), o.digest(i);
-}, s = (e, t, n) => {
-	if (e._tag === "custom") return {
-		headerName: e.header,
-		headerValue: e.sign(t, n)
-	};
-	let r = e.encoding ?? "hex", i = e.versionPrefix ?? "";
-	if (e.includeTimestamp) {
-		let a = Math.floor(Date.now() / 1e3), s = Buffer.concat([Buffer.from(`${a}.`, "utf8"), Buffer.from(t)]), c = o(e.algorithm, n, s, r);
-		return {
-			headerName: e.header,
-			headerValue: `t=${a},${i}${c}`,
-			timestamp: a
-		};
-	}
-	let a = o(e.algorithm, n, t, r);
-	return {
-		headerName: e.header,
-		headerValue: `${i}${a}`
-	};
-}, c = (e, t, n, r) => {
-	if (!r) return {
-		ok: !1,
-		reason: "missing signature header"
-	};
-	if (e._tag === "custom") return e.verify(t, n, r) ? { ok: !0 } : {
-		ok: !1,
-		reason: "custom verifier rejected"
-	};
-	let i = e.encoding ?? "hex", a = e.versionPrefix ?? "", s = (n) => {
-		if (e.includeTimestamp) {
-			let s = r.split(",").map((e) => e.trim()), c = s.find((e) => e.startsWith("t="));
-			if (!c) return {
-				ok: !1,
-				reason: "no timestamp in signature header"
-			};
-			let u = Number(c.slice(2));
-			if (!Number.isFinite(u)) return {
-				ok: !1,
-				reason: "invalid timestamp"
-			};
-			let d = e.replayWindowSeconds ?? 300, f = Math.floor(Date.now() / 1e3);
-			if (Math.abs(f - u) > d) return {
-				ok: !1,
-				reason: `replay window exceeded (${Math.abs(f - u)}s > ${d}s)`
-			};
-			let p = a.length > 0 ? s.find((e) => e.startsWith(a))?.slice(a.length) : s.find((e) => !e.startsWith("t="));
-			if (!p) return {
-				ok: !1,
-				reason: "no signature in header"
-			};
-			let m = Buffer.concat([Buffer.from(`${u}.`, "utf8"), Buffer.from(t)]);
-			return l(o(e.algorithm, n, m, i), p) ? { ok: !0 } : {
-				ok: !1,
-				reason: "signature mismatch"
-			};
-		}
-		let s = a.length > 0 && r.startsWith(a) ? r.slice(a.length) : r;
-		return l(o(e.algorithm, n, t, i), s) ? { ok: !0 } : {
-			ok: !1,
-			reason: "signature mismatch"
-		};
-	}, c = s(n);
-	if (c.ok) return c;
-	if (e.previousSecret !== void 0) {
-		let t = s(e.previousSecret);
-		if (t.ok) return t;
-	}
-	return c;
-}, l = (e, n) => {
-	let r = Buffer.from(e, "utf8"), i = Buffer.from(n, "utf8");
-	return r.length === i.length ? t(r, i) : (t(r, Buffer.alloc(r.length)), !1);
-}, u = (e = "Stripe-Signature") => ({
-	_tag: "hmac",
-	algorithm: "hmacSha256",
-	header: e,
-	includeTimestamp: !0,
-	replayWindowSeconds: 300,
-	encoding: "hex",
-	versionPrefix: "v1="
-}), d = () => ({
-	_tag: "hmac",
-	algorithm: "hmacSha256",
-	header: "X-Hub-Signature-256",
-	includeTimestamp: !1,
-	encoding: "hex",
-	versionPrefix: "sha256="
-}), f = () => ({
-	_tag: "custom",
-	header: "X-Slack-Signature",
-	sign: (e, t) => `v0=${o("hmacSha256", t, `v0:${Math.floor(Date.now() / 1e3)}:${Buffer.from(e).toString("utf8")}`)}`,
-	verify: (e, t, n) => !1
-}), p = () => ({
-	_tag: "hmac",
-	algorithm: "hmacSha256",
-	header: "X-Webhook-Signature",
-	includeTimestamp: !0,
-	replayWindowSeconds: 300,
-	encoding: "hex",
-	versionPrefix: "v1="
-});
-//#endregion
-export { u as a, r as c, f as i, i as l, d as n, c as o, s as r, n as s, p as t };