@voltro/plugin-webhooks 0.84.0 → 0.86.0

package/dist/service.js

@@ -0,0 +1,491 @@
+import { asOutgoingEvent as e } from "./eventAudience.js";
+import { generateStandardWebhooksSecret as t, isStandardWebhooksSecret as n } from "./standardWebhooks.js";
+import { defaultOutgoingSignature as r } from "./signing.js";
+import { defaultRetryPolicy as i } from "./retry.js";
+import { WebhookDeliveryNotFound as a, WebhookPayloadInvalid as o, WebhookPayloadVersionInvalid as s, WebhookSubscribeInvalid as c, WebhookTargetNotFound as l } from "./errors.js";
+import { Context as u, Effect as d, Result as f, Schema as p } from "effect";
+import { randomBytes as m, randomUUID as h } from "node:crypto";
+import { and as g, eq as _ } from "@voltro/database";
+import { assertPublicUrl as v } from "@voltro/integration-http";
+//#region src/service.ts
+var y = class extends u.Service()("@voltro/webhooks/WebhooksService") {}, b = 32, x = 32, S = () => m(b).toString("hex"), C = (e) => e.events ?? (e.event === void 0 ? [] : [e.event]), w = (e, t) => {
+	if (e !== void 0 && t?._tag === "standardWebhooks" && !n(e)) throw new c({
+		field: "secret",
+		reason: "a standard-webhooks target needs the spec's secret serialization (\"whsec_\" + base64 of 24..64 random bytes) — mint one with generateStandardWebhooksSecret(), or omit `secret` and let subscribe mint it. If the incompatible key is inherited, rotate the endpoint secret and update the receiver before adding the event"
+	});
+}, T = (e) => {
+	let t;
+	try {
+		t = new URL(e.url);
+	} catch (e) {
+		throw new c({
+			field: "url",
+			reason: `invalid subscriber url: ${e.message}`
+		});
+	}
+	if (t.protocol !== "http:" && t.protocol !== "https:") throw new c({
+		field: "url",
+		reason: `url protocol must be http or https, got ${t.protocol}`
+	});
+	if (process.env.NODE_ENV === "production") try {
+		v(e.url);
+	} catch (e) {
+		throw new c({
+			field: "url",
+			reason: e.message
+		});
+	}
+	let n = C(e);
+	if (n.length === 0) throw new c({
+		field: "event",
+		reason: "event id required"
+	});
+	if (e.event !== void 0 && e.events !== void 0) throw new c({
+		field: "event",
+		reason: "pass `event` OR `events`, not both — the row set would be ambiguous"
+	});
+	if (n.some((e) => e.length === 0)) throw new c({
+		field: "events",
+		reason: "event id required"
+	});
+	if (new Set(n).size !== n.length) throw new c({
+		field: "events",
+		reason: "duplicate event — one row per event, so a repeat would deliver twice"
+	});
+	if (e.secret !== void 0 && e.secret.length < x) throw new c({
+		field: "secret",
+		reason: `secret must be at least ${x} chars`
+	});
+	if (w(e.secret, e.signing), e.retry !== void 0) {
+		if (e.retry.maxAttempts < 1) throw new c({
+			field: "retry",
+			reason: "retry.maxAttempts must be ≥ 1"
+		});
+		if (e.retry.maxAttempts > 1e3) throw new c({
+			field: "retry",
+			reason: "retry.maxAttempts must be ≤ 1000"
+		});
+	}
+	if (e.rateLimitPerMinute !== void 0 && e.rateLimitPerMinute < 1) throw new c({
+		field: "rateLimitPerMinute",
+		reason: "rateLimitPerMinute must be ≥ 1"
+	});
+	if (e.autoDisableAfter !== void 0 && (e.autoDisableAfter < 1 || !Number.isInteger(e.autoDisableAfter))) throw new c({
+		field: "autoDisableAfter",
+		reason: `autoDisableAfter must be a positive integer, got ${e.autoDisableAfter}`
+	});
+}, E = (e, n, a, o) => {
+	let s = e.signing ?? n?.defaultSigning ?? r(), c = s._tag === "standardWebhooks" ? t : S, l = o ?? e.secret ?? c();
+	return w(l, s), {
+		id: h(),
+		tenantId: e.tenantId ?? null,
+		event: a ?? e.event ?? "",
+		url: e.url,
+		secret: l,
+		signing: s,
+		retry: e.retry ?? n?.defaultRetry ?? i(),
+		filter: e.filter ?? null,
+		scope: e.scope ?? null,
+		headers: e.headers ?? null,
+		rateLimitPerMinute: e.rateLimitPerMinute ?? null,
+		active: !0,
+		format: e.format ?? "json",
+		autoDisableAfter: e.autoDisableAfter ?? null,
+		consecutiveFailures: 0,
+		autoDisabledAt: null,
+		autoDisableReason: null,
+		payloadVersion: e.payloadVersion ?? n?.version ?? 1,
+		description: e.description ?? null
+	};
+}, D = (e) => e instanceof Date ? e.getTime() : typeof e == "string" ? Date.parse(e) : 0, O = (e) => e instanceof Date ? e.toISOString() : typeof e == "string" ? e : null, k = (e) => {
+	if (typeof e != "string") return e;
+	try {
+		return JSON.parse(e);
+	} catch {
+		return e;
+	}
+}, A = (e) => ({
+	id: String(e.id),
+	deliveryId: String(e.deliveryId),
+	targetId: String(e.targetId),
+	event: String(e.event),
+	eventId: e.eventId ?? null,
+	attempt: Number(e.attempt ?? 0),
+	status: e.status,
+	responseStatus: e.responseStatus ?? null,
+	errorMessage: e.errorMessage ?? null,
+	latencyMs: e.latencyMs ?? null,
+	scheduledAt: O(e.scheduledAt),
+	nextAttemptAt: O(e.nextAttemptAt),
+	createdAt: O(e.createdAt)
+}), j = (e, t) => e === t ? "current" : e < t ? "behind" : "ahead", M = (e, t) => {
+	if (e === null) return !0;
+	let n = { payload: t };
+	for (let [t, r] of Object.entries(e)) if (!F(N(n, t), r)) return !1;
+	return !0;
+}, N = (e, t) => {
+	let n = t.split("."), r = e;
+	for (let e of n) {
+		if (typeof r != "object" || !r) return;
+		r = r[e];
+	}
+	return r;
+}, P = (e, t) => {
+	if (typeof e == "number" && typeof t == "number") return e - t;
+	if (typeof e == "string" && typeof t == "string") return e < t ? -1 : +(e > t);
+}, F = (e, t) => {
+	if (typeof t == "object" && t && !Array.isArray(t)) {
+		let n = t;
+		return "eq" in n && e !== n.eq || "in" in n && (!Array.isArray(n.in) || !n.in.includes(e)) || "gt" in n && !((P(e, n.gt) ?? 0) > 0) || "gte" in n && !((P(e, n.gte) ?? -1) >= 0) || "lt" in n && !((P(e, n.lt) ?? 0) < 0) || "lte" in n && !((P(e, n.lte) ?? 1) <= 0) ? !1 : [
+			"eq",
+			"in",
+			"gt",
+			"gte",
+			"lt",
+			"lte"
+		].some((e) => e in n);
+	}
+	return e === t;
+}, I = (e, t) => e !== null && Object.entries(t).every(([t, n]) => e[t] === n), L = 500, R = 200, z = async (e, t) => {
+	let n = [];
+	for (let r = 0; r < R; r += 1) {
+		let i = await e.store.query({
+			table: "_voltro_webhook_targets",
+			predicate: t,
+			order: [{
+				column: "id",
+				direction: "asc"
+			}],
+			take: L,
+			skip: r === 0 ? void 0 : r * L,
+			projection: void 0
+		});
+		if (n.push(...i), i.length < L) return n;
+	}
+	throw Error(`webhooks: more than ${R * L} rows in \`_voltro_webhook_targets\` — refusing to answer a scope lookup from a partial scan. A truncated scan mints a fresh secret for a live endpoint (breaking its signatures) or reports that a real scope matches nothing.`);
+}, B = async (e, t) => {
+	let n = (await z(e)).filter((e) => I(e.scope, t));
+	if (n.length === 0) return;
+	let r = new Set(n.map((e) => e.secret));
+	if (r.size > 1) throw Error(`webhooks.subscribe: the scope ${JSON.stringify(t)} matches ${n.length} targets with ${r.size} different secrets, so it is not one endpoint. Pass \`secret\` explicitly, or narrow the scope.`);
+	return [...r][0];
+}, V = async (e, t) => {
+	try {
+		let n = await e.store.query({
+			table: "_voltro_webhook_event_stats",
+			predicate: _("event", t),
+			order: [],
+			take: 1,
+			skip: void 0,
+			projection: void 0
+		}), r = /* @__PURE__ */ new Date(), i = n[0];
+		if (i === void 0) {
+			await e.store.insert("_voltro_webhook_event_stats", {
+				event: t,
+				emitCount: 1,
+				lastEmitAt: r,
+				createdAt: r,
+				updatedAt: r
+			});
+			return;
+		}
+		await e.store.update("_voltro_webhook_event_stats", i.id, {
+			emitCount: (i.emitCount ?? 0) + 1,
+			lastEmitAt: r,
+			updatedAt: r
+		});
+	} catch {}
+}, H = (n, r, i = {}) => {
+	let c = new Map((i.events ?? []).map((e) => [e.id, e])), u = {
+		subscribe: async (e) => {
+			T(e);
+			let r = C(e), i = e.secret === void 0 && e.scope !== void 0 ? await B(n, e.scope) : void 0, a = e.secret ?? i ?? t(), o = r.map((t) => E(e, c.get(t), t, a));
+			for (let e of o) await n.store.insert("_voltro_webhook_targets", {
+				...e,
+				createdAt: /* @__PURE__ */ new Date(),
+				updatedAt: /* @__PURE__ */ new Date()
+			});
+			let s = o[0];
+			return {
+				id: s.id,
+				event: s.event,
+				url: s.url,
+				secret: s.secret,
+				signing: s.signing,
+				retry: s.retry,
+				...o.length > 1 ? { targets: o.map((e) => ({
+					id: e.id,
+					event: e.event
+				})) } : {}
+			};
+		},
+		emit: async (t, i, a) => {
+			let s = typeof t == "object" && t.kind === "event" ? e(t) : void 0, l = typeof t == "string" ? c.get(t) : s ?? t, u = typeof t == "string" ? t : t.id ?? t.name;
+			if (l !== void 0) {
+				let e = p.decodeUnknownResult(l.payload)(i, { errors: "all" });
+				if (f.isFailure(e)) throw new o({
+					event: u,
+					issues: e.failure.message
+				});
+			}
+			let d = a?.eventId ?? h(), m = a?.tenantId, v = await z(n, m == null ? _("event", u) : g(_("event", u), _("tenantId", m)));
+			await V(n, u);
+			let y = v.filter((e) => M(e.filter, i)), b = [], x = JSON.stringify(i), S = async (e, t) => {
+				let i = h();
+				e.active ? (await r({
+					deliveryId: i,
+					targetId: e.id,
+					event: u,
+					eventId: d,
+					payloadJson: x
+				}), b[t] = {
+					targetId: e.id,
+					deliveryId: i,
+					status: "dispatched"
+				}) : (await n.store.insert("_voltro_webhook_deliveries", {
+					id: `${i}:1`,
+					deliveryId: i,
+					targetId: e.id,
+					tenantId: e.tenantId ?? null,
+					event: u,
+					eventId: d,
+					attempt: 1,
+					status: "pending",
+					payload: x,
+					scheduledAt: /* @__PURE__ */ new Date(),
+					createdAt: /* @__PURE__ */ new Date(),
+					updatedAt: /* @__PURE__ */ new Date()
+				}), b[t] = {
+					targetId: e.id,
+					deliveryId: i,
+					status: "queued"
+				});
+			}, C = 0, w = !1, T;
+			if (await Promise.all(Array.from({ length: Math.min(4, y.length) }, async () => {
+				for (; !w && C < y.length;) {
+					let e = C++;
+					try {
+						await S(y[e], e);
+					} catch (e) {
+						w || (w = !0, T = e);
+					}
+				}
+			})), w) throw T;
+			return {
+				eventId: d,
+				deliveries: b
+			};
+		},
+		replay: async (e) => {
+			let t = (await n.store.query({
+				table: "_voltro_webhook_deliveries",
+				predicate: _("deliveryId", e),
+				order: [{
+					column: "attempt",
+					direction: "asc"
+				}],
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			}))[0];
+			if (t === void 0) throw new a({ deliveryId: e });
+			await r({
+				deliveryId: t.deliveryId,
+				targetId: t.targetId,
+				event: t.event,
+				eventId: t.eventId ?? h(),
+				payloadJson: typeof t.payload == "string" ? t.payload : JSON.stringify(t.payload),
+				attemptEpoch: Date.now()
+			});
+		},
+		resolveTargets: async (e) => {
+			if (typeof e == "string") {
+				if ((await n.store.query({
+					table: "_voltro_webhook_targets",
+					predicate: _("id", e),
+					order: [],
+					take: 1,
+					skip: void 0,
+					projection: ["id"]
+				})).length === 0) throw new l({ targetId: e });
+				return [e];
+			}
+			let t = (await z(n)).filter((t) => I(t.scope, e.scope)).map((e) => e.id);
+			if (t.length === 0) throw Error(`webhooks: no target matches scope ${JSON.stringify(e.scope)} — the operation would have silently done nothing`);
+			return t;
+		},
+		pauseTarget: async (e) => {
+			for (let t of await u.resolveTargets(e)) await n.store.update("_voltro_webhook_targets", t, {
+				active: !1,
+				updatedAt: /* @__PURE__ */ new Date()
+			});
+		},
+		resumeTarget: async (e) => {
+			for (let t of await u.resolveTargets(e)) {
+				await n.store.update("_voltro_webhook_targets", t, {
+					active: !0,
+					consecutiveFailures: 0,
+					autoDisabledAt: null,
+					autoDisableReason: null,
+					updatedAt: /* @__PURE__ */ new Date()
+				});
+				let e = await n.store.query({
+					table: "_voltro_webhook_deliveries",
+					predicate: g(_("targetId", t), _("status", "pending")),
+					order: [{
+						column: "createdAt",
+						direction: "asc"
+					}],
+					take: 1e4,
+					skip: void 0,
+					projection: void 0
+				}), i = Date.now();
+				for (let n of e) await r({
+					deliveryId: n.deliveryId,
+					targetId: t,
+					event: n.event,
+					eventId: n.eventId ?? h(),
+					payloadJson: typeof n.payload == "string" ? n.payload : JSON.stringify(n.payload),
+					attemptEpoch: i
+				});
+			}
+		},
+		deleteTarget: async (e) => {
+			for (let t of await u.resolveTargets(e)) await n.store.delete("_voltro_webhook_targets", t), await n.store.deleteMany("_voltro_webhook_deliveries", { where: g(_("targetId", t), _("status", "pending")) });
+		},
+		rotateSecret: async (e) => {
+			let r = t();
+			for (let t of await u.resolveTargets(e)) await n.store.update("_voltro_webhook_targets", t, {
+				secret: r,
+				updatedAt: /* @__PURE__ */ new Date()
+			});
+			return { secret: r };
+		},
+		updateTarget: async (e, t) => {
+			if (t.url !== void 0 && T({
+				event: "x",
+				url: t.url
+			}), t.rateLimitPerMinute !== void 0 && t.rateLimitPerMinute !== null && (!Number.isInteger(t.rateLimitPerMinute) || t.rateLimitPerMinute < 1)) throw Error("updateTarget: rateLimitPerMinute must be a positive integer or null");
+			let r = { updatedAt: /* @__PURE__ */ new Date() };
+			for (let e of [
+				"url",
+				"description",
+				"filter",
+				"scope",
+				"headers",
+				"rateLimitPerMinute",
+				"autoDisableAfter",
+				"format"
+			]) t[e] !== void 0 && (r[e] = t[e]);
+			for (let t of await u.resolveTargets(e)) await n.store.update("_voltro_webhook_targets", t, r);
+		},
+		testTarget: async (e, t) => {
+			let i = (await n.store.query({
+				table: "_voltro_webhook_targets",
+				predicate: _("id", e),
+				order: [],
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			}))[0];
+			if (i === void 0) throw new l({ targetId: e });
+			let a = h(), o = JSON.stringify(t ?? {
+				test: !0,
+				targetId: e,
+				at: (/* @__PURE__ */ new Date()).toISOString()
+			});
+			return i.active ? await r({
+				deliveryId: a,
+				targetId: i.id,
+				event: i.event,
+				eventId: h(),
+				payloadJson: o
+			}) : await n.store.insert("_voltro_webhook_deliveries", {
+				id: `${a}:1`,
+				deliveryId: a,
+				targetId: i.id,
+				tenantId: i.tenantId ?? null,
+				event: i.event,
+				eventId: null,
+				attempt: 1,
+				status: "pending",
+				payload: o,
+				scheduledAt: /* @__PURE__ */ new Date(),
+				createdAt: /* @__PURE__ */ new Date(),
+				updatedAt: /* @__PURE__ */ new Date()
+			}), { deliveryId: a };
+		},
+		listDeliveries: async (e) => {
+			let t = e?.scope === void 0 ? void 0 : new Set(await u.resolveTargets({ scope: e.scope })), r = await n.store.query({
+				table: "_voltro_webhook_deliveries",
+				predicate: e?.targetId === void 0 ? void 0 : _("targetId", e.targetId),
+				order: [{
+					column: "createdAt",
+					direction: "desc"
+				}],
+				take: Math.min((e?.limit ?? 200) * (e?.status !== void 0 || e?.since !== void 0 ? 10 : 1), 5e3),
+				skip: void 0,
+				projection: void 0
+			}), i = e?.since?.getTime();
+			return r.filter((e) => t === void 0 || t.has(String(e.targetId))).filter((t) => e?.status === void 0 || t.status === e.status).filter((e) => i === void 0 || D(e.createdAt) >= i).slice(0, e?.limit ?? 200).map(A);
+		},
+		getDelivery: async (e) => {
+			let t = (await n.store.query({
+				table: "_voltro_webhook_deliveries",
+				predicate: _("id", e),
+				order: [],
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			}))[0];
+			return t === void 0 ? null : {
+				...A(t),
+				payload: k(t.payload),
+				responseBody: t.responseBody ?? null
+			};
+		},
+		updateTargetPayloadVersion: async (e, t) => {
+			if (t < 1 || !Number.isInteger(t)) throw new s({ version: t });
+			await u.resolveTargets(e), await n.store.update("_voltro_webhook_targets", e, {
+				payloadVersion: t,
+				updatedAt: /* @__PURE__ */ new Date()
+			});
+		},
+		listTargets: async (e, t) => {
+			let r = await n.store.query({
+				table: "_voltro_webhook_targets",
+				predicate: e === void 0 ? void 0 : _("event", e),
+				order: [{
+					column: "createdAt",
+					direction: "desc"
+				}],
+				take: 500,
+				skip: void 0,
+				projection: void 0
+			});
+			return (t === void 0 ? r : r.filter((e) => e.scope !== null && Object.entries(t).every(([t, n]) => e.scope?.[t] === n))).map((e) => ({
+				id: e.id,
+				event: e.event,
+				url: e.url,
+				active: e.active,
+				rateLimitPerMinute: e.rateLimitPerMinute,
+				description: e.description,
+				payloadVersion: e.payloadVersion,
+				autoDisableAfter: e.autoDisableAfter,
+				consecutiveFailures: e.consecutiveFailures ?? 0,
+				autoDisabledAt: e.autoDisabledAt === null || e.autoDisabledAt === void 0 ? null : e.autoDisabledAt instanceof Date ? e.autoDisabledAt.toISOString() : String(e.autoDisabledAt),
+				autoDisableReason: e.autoDisableReason,
+				scope: e.scope,
+				filter: e.filter ?? null
+			}));
+		}
+	};
+	return u;
+}, U = d.gen(function* () {
+	return yield* y;
+}), W = (e) => {
+	if (e.webhooks === void 0) throw Error("useWebhooks: `ctx.webhooks` is not set. Declare an outgoing event with a `webhook:` block in a *.event.ts file, or an incoming endpoint in a *.webhook.tsx file — the service is wired the moment the app has either.");
+	return e.webhooks;
+};
+//#endregion
+export { y as WebhooksService, H as buildWebhooksService, j as compareVersions, C as eventsOf, S as generateSecret, M as matchesFilter, E as resolveSubscribe, W as useWebhooks, U as useWebhooksEffect, T as validateSubscribe };

package/dist/signing.js

@@ -0,0 +1,145 @@
+import { standardWebhooksHeaders as e, verifyStandardWebhooks as t } from "./standardWebhooks.js";
+import { createHmac as n, timingSafeEqual as r } from "node:crypto";
+//#region src/signing.ts
+var i = (e) => e === "hmacSha256" ? "sha256" : "sha1", a = (e, t, r, a = "hex") => {
+	let o = n(i(e), t);
+	return o.update(r), o.digest(a);
+};
+function o(e, t) {
+	if (e._tag !== "hmac" || typeof e.header != "string") throw Error(`webhook signing: cannot ${t} with this scheme — expected one of "standardWebhooks" | "hmac" | "custom" with a header, got ${JSON.stringify(e)}`);
+}
+var s = (t, n) => {
+	let r = n.timestampSeconds ?? Math.floor(Date.now() / 1e3);
+	if (t._tag === "standardWebhooks") {
+		let i = t.previousSecret === void 0 ? [n.secret] : [n.secret, t.previousSecret];
+		return {
+			headers: e({
+				secrets: i,
+				messageId: n.messageId,
+				timestampSeconds: r,
+				rawBody: n.rawBody
+			}),
+			timestamp: r
+		};
+	}
+	if (t._tag === "custom") return { headers: { [t.header.toLowerCase()]: t.sign(n.rawBody, n.secret) } };
+	o(t, "sign");
+	let i = t.encoding ?? "hex", s = t.versionPrefix ?? "";
+	if (t.includeTimestamp) {
+		let e = Buffer.concat([Buffer.from(`${r}.`, "utf8"), Buffer.from(n.rawBody)]), o = a(t.algorithm, n.secret, e, i);
+		return {
+			headers: { [t.header.toLowerCase()]: `t=${r},${s}${o}` },
+			timestamp: r
+		};
+	}
+	let c = a(t.algorithm, n.secret, n.rawBody, i);
+	return { headers: { [t.header.toLowerCase()]: `${s}${c}` } };
+}, c = (e, n) => {
+	if (e._tag === "standardWebhooks") {
+		let r = e.previousSecret === void 0 ? [n.secret] : [n.secret, e.previousSecret], i = t({
+			secrets: r,
+			rawBody: n.rawBody,
+			headers: n.headers,
+			toleranceSeconds: e.toleranceSeconds ?? 300,
+			...n.nowSeconds === void 0 ? {} : { nowSeconds: n.nowSeconds }
+		});
+		return i.ok ? { ok: !0 } : {
+			ok: !1,
+			reason: i.reason
+		};
+	}
+	if (e._tag === "custom") return e.verify(n.rawBody, n.secret, n.headers) ? { ok: !0 } : {
+		ok: !1,
+		reason: "custom verifier rejected"
+	};
+	o(e, "verify");
+	let r = n.headers[e.header.toLowerCase()];
+	if (!r) return {
+		ok: !1,
+		reason: "missing signature header"
+	};
+	let i = e.encoding ?? "hex", s = e.versionPrefix ?? "", c = (t) => {
+		if (e.includeTimestamp) {
+			let o = r.split(",").map((e) => e.trim()), c = o.find((e) => e.startsWith("t="));
+			if (!c) return {
+				ok: !1,
+				reason: "no timestamp in signature header"
+			};
+			let u = Number(c.slice(2));
+			if (!Number.isFinite(u)) return {
+				ok: !1,
+				reason: "invalid timestamp"
+			};
+			let d = e.replayWindowSeconds ?? 300, f = n.nowSeconds ?? Math.floor(Date.now() / 1e3);
+			if (Math.abs(f - u) > d) return {
+				ok: !1,
+				reason: `replay window exceeded (${Math.abs(f - u)}s > ${d}s)`
+			};
+			let p = s.length > 0 ? o.find((e) => e.startsWith(s))?.slice(s.length) : o.find((e) => !e.startsWith("t="));
+			if (!p) return {
+				ok: !1,
+				reason: "no signature in header"
+			};
+			let m = Buffer.concat([Buffer.from(`${u}.`, "utf8"), Buffer.from(n.rawBody)]);
+			return l(a(e.algorithm, t, m, i), p) ? { ok: !0 } : {
+				ok: !1,
+				reason: "signature mismatch"
+			};
+		}
+		let o = s.length > 0 && r.startsWith(s) ? r.slice(s.length) : r;
+		return l(a(e.algorithm, t, n.rawBody, i), o) ? { ok: !0 } : {
+			ok: !1,
+			reason: "signature mismatch"
+		};
+	}, u = c(n.secret);
+	if (u.ok) return u;
+	if (e.previousSecret !== void 0) {
+		let t = c(e.previousSecret);
+		if (t.ok) return t;
+	}
+	return u;
+}, l = (e, t) => {
+	let n = Buffer.from(e, "utf8"), i = Buffer.from(t, "utf8");
+	return n.length === i.length ? r(n, i) : (r(n, Buffer.alloc(n.length)), !1);
+}, u = (e = "Stripe-Signature") => ({
+	_tag: "hmac",
+	algorithm: "hmacSha256",
+	header: e,
+	includeTimestamp: !0,
+	replayWindowSeconds: 300,
+	encoding: "hex",
+	versionPrefix: "v1="
+}), d = () => ({
+	_tag: "hmac",
+	algorithm: "hmacSha256",
+	header: "X-Hub-Signature-256",
+	includeTimestamp: !1,
+	encoding: "hex",
+	versionPrefix: "sha256="
+}), f = (e = {}) => ({
+	_tag: "custom",
+	header: "X-Slack-Signature",
+	sign: (e, t) => `v0=${a("hmacSha256", t, `v0:${Math.floor(Date.now() / 1e3)}:${Buffer.from(e).toString("utf8")}`)}`,
+	verify: (t, n, r) => {
+		let i = r["x-slack-signature"], o = r["x-slack-request-timestamp"];
+		if (!i || !o) return !1;
+		let s = Number(o);
+		if (!Number.isFinite(s)) return !1;
+		let c = e.replayWindowSeconds ?? 300;
+		return Math.abs(Math.floor(Date.now() / 1e3) - s) > c ? !1 : l(`v0=${a("hmacSha256", n, `v0:${s}:${Buffer.from(t).toString("utf8")}`)}`, i);
+	}
+}), p = (e = {}) => ({
+	_tag: "standardWebhooks",
+	...e.toleranceSeconds === void 0 ? {} : { toleranceSeconds: e.toleranceSeconds },
+	...e.previousSecret === void 0 ? {} : { previousSecret: e.previousSecret }
+}), m = () => p(), h = () => ({
+	_tag: "hmac",
+	algorithm: "hmacSha256",
+	header: "X-Webhook-Signature",
+	includeTimestamp: !0,
+	replayWindowSeconds: 300,
+	encoding: "hex",
+	versionPrefix: "v1="
+});
+//#endregion
+export { m as defaultOutgoingSignature, h as genericHmacSignature, d as githubSignature, s as signRequest, f as slackSignature, p as standardWebhooksSignature, u as stripeSignature, c as verifyRequest };