@xtandard/webhooks 0.1.0

package/dist/signing.cjs

@@ -0,0 +1,162 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/signing.ts
+/** Prefix of every symmetric Standard Webhooks secret. */
+const SECRET_PREFIX = "whsec_";
+/** Prefix of every symmetric (v1) signature entry. */
+const SIGNATURE_VERSION = "v1";
+const MIN_SECRET_BYTES = 24;
+const MAX_SECRET_BYTES = 64;
+/** Thrown by {@link verify} / receiver helpers when a webhook fails verification. */
+var WebhookVerificationError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "WebhookVerificationError";
+	}
+};
+function base64Encode(bytes) {
+	let binary = "";
+	for (const b of bytes) binary += String.fromCharCode(b);
+	return btoa(binary);
+}
+function base64Decode(value) {
+	const binary = atob(value);
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return bytes;
+}
+/** Decode `whsec_…` into raw key bytes, enforcing the spec's 24–64 byte range. */
+function decodeSecret(secret) {
+	const body = secret.startsWith("whsec_") ? secret.slice(6) : secret;
+	let bytes;
+	try {
+		bytes = base64Decode(body);
+	} catch {
+		throw new WebhookVerificationError("Invalid secret: not base64");
+	}
+	if (bytes.length < MIN_SECRET_BYTES || bytes.length > MAX_SECRET_BYTES) throw new WebhookVerificationError(`Invalid secret: decoded length ${bytes.length} outside ${MIN_SECRET_BYTES}–${MAX_SECRET_BYTES} bytes`);
+	return bytes;
+}
+/**
+* Generate a new signing secret: `whsec_` + base64 of 24 crypto-random bytes.
+*
+* @example
+* ```ts
+* import { generateSecret } from "@xtandard/webhooks/signing";
+*
+* const secret = generateSecret(); // "whsec_…"
+* ```
+*/
+function generateSecret() {
+	const bytes = new Uint8Array(MIN_SECRET_BYTES);
+	crypto.getRandomValues(bytes);
+	return SECRET_PREFIX + base64Encode(bytes);
+}
+async function hmacSha256(keyBytes, content) {
+	const key = await crypto.subtle.importKey("raw", keyBytes, {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const digest = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(content));
+	return new Uint8Array(digest);
+}
+/**
+* Sign one delivery attempt with one secret: `v1,` + base64(HMAC-SHA256 over
+* `${id}.${timestamp}.${body}`). `timestamp` is unix **seconds**.
+*
+* @example
+* ```ts
+* import { sign } from "@xtandard/webhooks/signing";
+*
+* const signature = await sign(secret, "msg_…", 1720000000, body);
+* // "v1,K5oZ…"
+* ```
+*/
+async function sign(secret, id, timestamp, body) {
+	return `${SIGNATURE_VERSION},${base64Encode(await hmacSha256(decodeSecret(secret), `${id}.${timestamp}.${body}`))}`;
+}
+/**
+* Build the full `webhook-signature` header value: one signature per secret,
+* space-separated (multiple entries appear during secret rotation).
+*/
+async function signatureHeader(secrets, id, timestamp, body) {
+	return (await Promise.all(secrets.map((s) => sign(s, id, timestamp, body)))).join(" ");
+}
+/** Constant-time byte comparison (XOR accumulate — no early exit on content). */
+function timingSafeEqual(a, b) {
+	if (a.length !== b.length) return false;
+	let diff = 0;
+	for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+	return diff === 0;
+}
+/** Case-insensitive header lookup in a plain record. */
+function headerLookup(headers, name) {
+	const direct = headers[name];
+	if (direct !== void 0) return direct;
+	const lower = name.toLowerCase();
+	for (const [key, value] of Object.entries(headers)) if (key.toLowerCase() === lower) return value;
+}
+/**
+* Verify an incoming Standard Webhooks request (from **any** compliant sender,
+* not just this package). Checks the timestamp tolerance, then compares every
+* `v1,` signature in the header against every candidate secret in constant
+* time. Returns the parsed envelope on success; throws
+* {@link WebhookVerificationError} otherwise.
+*
+* @example
+* ```ts
+* import { verify } from "@xtandard/webhooks/signing";
+*
+* const envelope = await verify({
+*   payload: rawBody,
+*   headers: { "webhook-id": id, "webhook-timestamp": ts, "webhook-signature": sig },
+*   secret: "whsec_…",
+* });
+* ```
+*/
+async function verify(input) {
+	const id = headerLookup(input.headers, "webhook-id");
+	const timestampRaw = headerLookup(input.headers, "webhook-timestamp");
+	const signatureHeaderValue = headerLookup(input.headers, "webhook-signature");
+	if (!id) throw new WebhookVerificationError("Missing webhook-id header");
+	if (!timestampRaw) throw new WebhookVerificationError("Missing webhook-timestamp header");
+	if (!signatureHeaderValue) throw new WebhookVerificationError("Missing webhook-signature header");
+	const timestamp = Number(timestampRaw);
+	if (!Number.isFinite(timestamp) || !/^\d+$/.test(timestampRaw.trim())) throw new WebhookVerificationError(`Invalid webhook-timestamp "${timestampRaw}"`);
+	const tolerance = input.toleranceSeconds ?? 300;
+	const now = input.now ?? Math.floor(Date.now() / 1e3);
+	if (timestamp < now - tolerance) throw new WebhookVerificationError("webhook-timestamp is too old");
+	if (timestamp > now + tolerance) throw new WebhookVerificationError("webhook-timestamp is in the future");
+	const candidates = signatureHeaderValue.split(" ").map((entry) => entry.trim()).filter((entry) => entry.startsWith(`${SIGNATURE_VERSION},`)).map((entry) => entry.slice(3));
+	if (candidates.length === 0) throw new WebhookVerificationError("No v1 signature found in webhook-signature header");
+	const secrets = Array.isArray(input.secret) ? input.secret : [input.secret];
+	if (secrets.length === 0) throw new WebhookVerificationError("No secret provided");
+	const content = `${id}.${timestampRaw.trim()}.${input.payload}`;
+	let matched = false;
+	for (const secret of secrets) {
+		const expected = await hmacSha256(decodeSecret(secret), content);
+		for (const candidate of candidates) {
+			let candidateBytes;
+			try {
+				candidateBytes = base64Decode(candidate);
+			} catch {
+				continue;
+			}
+			if (timingSafeEqual(expected, candidateBytes)) matched = true;
+		}
+	}
+	if (!matched) throw new WebhookVerificationError("No matching signature");
+	try {
+		return JSON.parse(input.payload);
+	} catch {
+		throw new WebhookVerificationError("Payload is not valid JSON");
+	}
+}
+//#endregion
+exports.SECRET_PREFIX = SECRET_PREFIX;
+exports.WebhookVerificationError = WebhookVerificationError;
+exports.generateSecret = generateSecret;
+exports.sign = sign;
+exports.signatureHeader = signatureHeader;
+exports.verify = verify;
+
+//# sourceMappingURL=signing.cjs.map

package/dist/signing.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.cjs","names":[],"sources":["../src/signing.ts"],"sourcesContent":["/**\n * Standard Webhooks symmetric (v1) signing and verification.\n *\n * Pure and zero-dependency (Web Crypto only) — safe on the request path and in\n * any WinterCG runtime. Shared by the sender (the dispatcher signs outgoing\n * deliveries) and the receiver subpath (`@xtandard/webhooks/receiver`), and\n * compatible with any Standard Webhooks implementation, including Svix.\n *\n * The wire contract (https://www.standardwebhooks.com):\n *\n * - secrets are `whsec_` + base64-encoded key material (24–64 bytes decoded)\n * - the signed content is `${id}.${timestamp}.${body}`\n * - the signature is `v1,` + base64(HMAC-SHA256(key, signedContent))\n * - `webhook-signature` may carry several space-separated signatures (secret\n *   rotation); a receiver accepts if **any** matches\n * - `webhook-timestamp` (unix seconds) must be within tolerance, both ways\n *\n * @module\n */\n\nimport type { WebhookEnvelope } from \"./schema.ts\";\n\nexport type { WebhookEnvelope };\n\n/** Prefix of every symmetric Standard Webhooks secret. */\nexport const SECRET_PREFIX = \"whsec_\";\n\n/** Prefix of every symmetric (v1) signature entry. */\nconst SIGNATURE_VERSION = \"v1\";\n\nconst MIN_SECRET_BYTES = 24;\nconst MAX_SECRET_BYTES = 64;\n\n/** Thrown by {@link verify} / receiver helpers when a webhook fails verification. */\nexport class WebhookVerificationError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"WebhookVerificationError\";\n  }\n}\n\nfunction base64Encode(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const b of bytes) binary += String.fromCharCode(b);\n  return btoa(binary);\n}\n\nfunction base64Decode(value: string): Uint8Array {\n  const binary = atob(value);\n  const bytes = new Uint8Array(binary.length);\n  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);\n  return bytes;\n}\n\n/** Decode `whsec_…` into raw key bytes, enforcing the spec's 24–64 byte range. */\nfunction decodeSecret(secret: string): Uint8Array {\n  const body = secret.startsWith(SECRET_PREFIX) ? secret.slice(SECRET_PREFIX.length) : secret;\n  let bytes: Uint8Array;\n  try {\n    bytes = base64Decode(body);\n  } catch {\n    throw new WebhookVerificationError(\"Invalid secret: not base64\");\n  }\n  if (bytes.length < MIN_SECRET_BYTES || bytes.length > MAX_SECRET_BYTES) {\n    throw new WebhookVerificationError(\n      `Invalid secret: decoded length ${bytes.length} outside ${MIN_SECRET_BYTES}–${MAX_SECRET_BYTES} bytes`,\n    );\n  }\n  return bytes;\n}\n\n/**\n * Generate a new signing secret: `whsec_` + base64 of 24 crypto-random bytes.\n *\n * @example\n * ```ts\n * import { generateSecret } from \"@xtandard/webhooks/signing\";\n *\n * const secret = generateSecret(); // \"whsec_…\"\n * ```\n */\nexport function generateSecret(): string {\n  const bytes = new Uint8Array(MIN_SECRET_BYTES);\n  crypto.getRandomValues(bytes);\n  return SECRET_PREFIX + base64Encode(bytes);\n}\n\nasync function hmacSha256(keyBytes: Uint8Array, content: string): Promise<Uint8Array> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    keyBytes as BufferSource,\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  const digest = await crypto.subtle.sign(\"HMAC\", key, new TextEncoder().encode(content));\n  return new Uint8Array(digest);\n}\n\n/**\n * Sign one delivery attempt with one secret: `v1,` + base64(HMAC-SHA256 over\n * `${id}.${timestamp}.${body}`). `timestamp` is unix **seconds**.\n *\n * @example\n * ```ts\n * import { sign } from \"@xtandard/webhooks/signing\";\n *\n * const signature = await sign(secret, \"msg_…\", 1720000000, body);\n * // \"v1,K5oZ…\"\n * ```\n */\nexport async function sign(\n  secret: string,\n  id: string,\n  timestamp: number,\n  body: string,\n): Promise<string> {\n  const digest = await hmacSha256(decodeSecret(secret), `${id}.${timestamp}.${body}`);\n  return `${SIGNATURE_VERSION},${base64Encode(digest)}`;\n}\n\n/**\n * Build the full `webhook-signature` header value: one signature per secret,\n * space-separated (multiple entries appear during secret rotation).\n */\nexport async function signatureHeader(\n  secrets: string[],\n  id: string,\n  timestamp: number,\n  body: string,\n): Promise<string> {\n  const signatures = await Promise.all(secrets.map((s) => sign(s, id, timestamp, body)));\n  return signatures.join(\" \");\n}\n\n/** Constant-time byte comparison (XOR accumulate — no early exit on content). */\nfunction timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n  if (a.length !== b.length) return false;\n  let diff = 0;\n  for (let i = 0; i < a.length; i++) diff |= (a[i] as number) ^ (b[i] as number);\n  return diff === 0;\n}\n\n/** Case-insensitive header lookup in a plain record. */\nfunction headerLookup(headers: Record<string, string>, name: string): string | undefined {\n  const direct = headers[name];\n  if (direct !== undefined) return direct;\n  const lower = name.toLowerCase();\n  for (const [key, value] of Object.entries(headers)) {\n    if (key.toLowerCase() === lower) return value;\n  }\n  return undefined;\n}\n\n/** Input to {@link verify}. */\nexport interface VerifyInput {\n  /** The raw request body, **exactly** as received (no re-serialization). */\n  payload: string;\n  /** Request headers; name lookup is case-insensitive. */\n  headers: Record<string, string>;\n  /** Candidate secret(s) — pass several during rotation; any match passes. */\n  secret: string | string[];\n  /** Allowed clock skew in seconds, both past and future. Default `300`. */\n  toleranceSeconds?: number;\n  /** Current unix time in seconds — injectable for tests. */\n  now?: number;\n}\n\n/**\n * Verify an incoming Standard Webhooks request (from **any** compliant sender,\n * not just this package). Checks the timestamp tolerance, then compares every\n * `v1,` signature in the header against every candidate secret in constant\n * time. Returns the parsed envelope on success; throws\n * {@link WebhookVerificationError} otherwise.\n *\n * @example\n * ```ts\n * import { verify } from \"@xtandard/webhooks/signing\";\n *\n * const envelope = await verify({\n *   payload: rawBody,\n *   headers: { \"webhook-id\": id, \"webhook-timestamp\": ts, \"webhook-signature\": sig },\n *   secret: \"whsec_…\",\n * });\n * ```\n */\nexport async function verify(input: VerifyInput): Promise<WebhookEnvelope> {\n  const id = headerLookup(input.headers, \"webhook-id\");\n  const timestampRaw = headerLookup(input.headers, \"webhook-timestamp\");\n  const signatureHeaderValue = headerLookup(input.headers, \"webhook-signature\");\n  if (!id) throw new WebhookVerificationError(\"Missing webhook-id header\");\n  if (!timestampRaw) throw new WebhookVerificationError(\"Missing webhook-timestamp header\");\n  if (!signatureHeaderValue) throw new WebhookVerificationError(\"Missing webhook-signature header\");\n\n  const timestamp = Number(timestampRaw);\n  if (!Number.isFinite(timestamp) || !/^\\d+$/.test(timestampRaw.trim())) {\n    throw new WebhookVerificationError(`Invalid webhook-timestamp \"${timestampRaw}\"`);\n  }\n  const tolerance = input.toleranceSeconds ?? 300;\n  const now = input.now ?? Math.floor(Date.now() / 1000);\n  if (timestamp < now - tolerance) {\n    throw new WebhookVerificationError(\"webhook-timestamp is too old\");\n  }\n  if (timestamp > now + tolerance) {\n    throw new WebhookVerificationError(\"webhook-timestamp is in the future\");\n  }\n\n  // Only v1 (symmetric) entries participate; other versions are skipped.\n  const candidates = signatureHeaderValue\n    .split(\" \")\n    .map((entry) => entry.trim())\n    .filter((entry) => entry.startsWith(`${SIGNATURE_VERSION},`))\n    .map((entry) => entry.slice(SIGNATURE_VERSION.length + 1));\n  if (candidates.length === 0) {\n    throw new WebhookVerificationError(\"No v1 signature found in webhook-signature header\");\n  }\n\n  const secrets = Array.isArray(input.secret) ? input.secret : [input.secret];\n  if (secrets.length === 0) throw new WebhookVerificationError(\"No secret provided\");\n\n  // Sign over the timestamp EXACTLY as it arrived on the wire (already\n  // validated as digits above), not the JS-parsed number — re-stringifying\n  // through Number() can lose precision or reformat and would reject a\n  // legitimately-signed webhook whose value doesn't round-trip.\n  const content = `${id}.${timestampRaw.trim()}.${input.payload}`;\n  let matched = false;\n  for (const secret of secrets) {\n    const expected = await hmacSha256(decodeSecret(secret), content);\n    for (const candidate of candidates) {\n      let candidateBytes: Uint8Array;\n      try {\n        candidateBytes = base64Decode(candidate);\n      } catch {\n        continue; // malformed entry — try the rest\n      }\n      if (timingSafeEqual(expected, candidateBytes)) matched = true;\n    }\n  }\n  if (!matched) throw new WebhookVerificationError(\"No matching signature\");\n\n  try {\n    return JSON.parse(input.payload) as WebhookEnvelope;\n  } catch {\n    throw new WebhookVerificationError(\"Payload is not valid JSON\");\n  }\n}\n"],"mappings":";;;AAyBA,MAAa,gBAAgB;;AAG7B,MAAM,oBAAoB;AAE1B,MAAM,mBAAmB;AACzB,MAAM,mBAAmB;;AAGzB,IAAa,2BAAb,cAA8C,MAAM;CAClD,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;AAEA,SAAS,aAAa,OAA2B;CAC/C,IAAI,SAAS;CACb,KAAK,MAAM,KAAK,OAAO,UAAU,OAAO,aAAa,CAAC;CACtD,OAAO,KAAK,MAAM;AACpB;AAEA,SAAS,aAAa,OAA2B;CAC/C,MAAM,SAAS,KAAK,KAAK;CACzB,MAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;CAC1C,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK,MAAM,KAAK,OAAO,WAAW,CAAC;CACtE,OAAO;AACT;;AAGA,SAAS,aAAa,QAA4B;CAChD,MAAM,OAAO,OAAO,WAAA,QAAwB,IAAI,OAAO,MAAM,CAAoB,IAAI;CACrF,IAAI;CACJ,IAAI;EACF,QAAQ,aAAa,IAAI;CAC3B,QAAQ;EACN,MAAM,IAAI,yBAAyB,4BAA4B;CACjE;CACA,IAAI,MAAM,SAAS,oBAAoB,MAAM,SAAS,kBACpD,MAAM,IAAI,yBACR,kCAAkC,MAAM,OAAO,WAAW,iBAAiB,GAAG,iBAAiB,OACjG;CAEF,OAAO;AACT;;;;;;;;;;;AAYA,SAAgB,iBAAyB;CACvC,MAAM,QAAQ,IAAI,WAAW,gBAAgB;CAC7C,OAAO,gBAAgB,KAAK;CAC5B,OAAO,gBAAgB,aAAa,KAAK;AAC3C;AAEA,eAAe,WAAW,UAAsB,SAAsC;CACpF,MAAM,MAAM,MAAM,OAAO,OAAO,UAC9B,OACA,UACA;EAAE,MAAM;EAAQ,MAAM;CAAU,GAChC,OACA,CAAC,MAAM,CACT;CACA,MAAM,SAAS,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,IAAI,YAAY,EAAE,OAAO,OAAO,CAAC;CACtF,OAAO,IAAI,WAAW,MAAM;AAC9B;;;;;;;;;;;;;AAcA,eAAsB,KACpB,QACA,IACA,WACA,MACiB;CAEjB,OAAO,GAAG,kBAAkB,GAAG,aAAa,MADvB,WAAW,aAAa,MAAM,GAAG,GAAG,GAAG,GAAG,UAAU,GAAG,MAAM,CAChC;AACpD;;;;;AAMA,eAAsB,gBACpB,SACA,IACA,WACA,MACiB;CAEjB,QAAO,MADkB,QAAQ,IAAI,QAAQ,KAAK,MAAM,KAAK,GAAG,IAAI,WAAW,IAAI,CAAC,CAAC,GACnE,KAAK,GAAG;AAC5B;;AAGA,SAAS,gBAAgB,GAAe,GAAwB;CAC9D,IAAI,EAAE,WAAW,EAAE,QAAQ,OAAO;CAClC,IAAI,OAAO;CACX,KAAK,IAAI,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK,QAAS,EAAE,KAAiB,EAAE;CACjE,OAAO,SAAS;AAClB;;AAGA,SAAS,aAAa,SAAiC,MAAkC;CACvF,MAAM,SAAS,QAAQ;CACvB,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,MAAM,QAAQ,KAAK,YAAY;CAC/B,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAC/C,IAAI,IAAI,YAAY,MAAM,OAAO,OAAO;AAG5C;;;;;;;;;;;;;;;;;;;AAkCA,eAAsB,OAAO,OAA8C;CACzE,MAAM,KAAK,aAAa,MAAM,SAAS,YAAY;CACnD,MAAM,eAAe,aAAa,MAAM,SAAS,mBAAmB;CACpE,MAAM,uBAAuB,aAAa,MAAM,SAAS,mBAAmB;CAC5E,IAAI,CAAC,IAAI,MAAM,IAAI,yBAAyB,2BAA2B;CACvE,IAAI,CAAC,cAAc,MAAM,IAAI,yBAAyB,kCAAkC;CACxF,IAAI,CAAC,sBAAsB,MAAM,IAAI,yBAAyB,kCAAkC;CAEhG,MAAM,YAAY,OAAO,YAAY;CACrC,IAAI,CAAC,OAAO,SAAS,SAAS,KAAK,CAAC,QAAQ,KAAK,aAAa,KAAK,CAAC,GAClE,MAAM,IAAI,yBAAyB,8BAA8B,aAAa,EAAE;CAElF,MAAM,YAAY,MAAM,oBAAoB;CAC5C,MAAM,MAAM,MAAM,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CACrD,IAAI,YAAY,MAAM,WACpB,MAAM,IAAI,yBAAyB,8BAA8B;CAEnE,IAAI,YAAY,MAAM,WACpB,MAAM,IAAI,yBAAyB,oCAAoC;CAIzE,MAAM,aAAa,qBAChB,MAAM,GAAG,EACT,KAAK,UAAU,MAAM,KAAK,CAAC,EAC3B,QAAQ,UAAU,MAAM,WAAW,GAAG,kBAAkB,EAAE,CAAC,EAC3D,KAAK,UAAU,MAAM,MAAM,CAA4B,CAAC;CAC3D,IAAI,WAAW,WAAW,GACxB,MAAM,IAAI,yBAAyB,mDAAmD;CAGxF,MAAM,UAAU,MAAM,QAAQ,MAAM,MAAM,IAAI,MAAM,SAAS,CAAC,MAAM,MAAM;CAC1E,IAAI,QAAQ,WAAW,GAAG,MAAM,IAAI,yBAAyB,oBAAoB;CAMjF,MAAM,UAAU,GAAG,GAAG,GAAG,aAAa,KAAK,EAAE,GAAG,MAAM;CACtD,IAAI,UAAU;CACd,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,WAAW,MAAM,WAAW,aAAa,MAAM,GAAG,OAAO;EAC/D,KAAK,MAAM,aAAa,YAAY;GAClC,IAAI;GACJ,IAAI;IACF,iBAAiB,aAAa,SAAS;GACzC,QAAQ;IACN;GACF;GACA,IAAI,gBAAgB,UAAU,cAAc,GAAG,UAAU;EAC3D;CACF;CACA,IAAI,CAAC,SAAS,MAAM,IAAI,yBAAyB,uBAAuB;CAExE,IAAI;EACF,OAAO,KAAK,MAAM,MAAM,OAAO;CACjC,QAAQ;EACN,MAAM,IAAI,yBAAyB,2BAA2B;CAChE;AACF"}

package/dist/signing.d.cts

@@ -0,0 +1,73 @@
+import { _ as WebhookEnvelope } from "./schema-mo__wv4P.cjs";
+
+//#region src/signing.d.ts
+/** Prefix of every symmetric Standard Webhooks secret. */
+declare const SECRET_PREFIX = "whsec_";
+/** Thrown by {@link verify} / receiver helpers when a webhook fails verification. */
+declare class WebhookVerificationError extends Error {
+  constructor(message: string);
+}
+/**
+ * Generate a new signing secret: `whsec_` + base64 of 24 crypto-random bytes.
+ *
+ * @example
+ * ```ts
+ * import { generateSecret } from "@xtandard/webhooks/signing";
+ *
+ * const secret = generateSecret(); // "whsec_…"
+ * ```
+ */
+declare function generateSecret(): string;
+/**
+ * Sign one delivery attempt with one secret: `v1,` + base64(HMAC-SHA256 over
+ * `${id}.${timestamp}.${body}`). `timestamp` is unix **seconds**.
+ *
+ * @example
+ * ```ts
+ * import { sign } from "@xtandard/webhooks/signing";
+ *
+ * const signature = await sign(secret, "msg_…", 1720000000, body);
+ * // "v1,K5oZ…"
+ * ```
+ */
+declare function sign(secret: string, id: string, timestamp: number, body: string): Promise<string>;
+/**
+ * Build the full `webhook-signature` header value: one signature per secret,
+ * space-separated (multiple entries appear during secret rotation).
+ */
+declare function signatureHeader(secrets: string[], id: string, timestamp: number, body: string): Promise<string>;
+/** Input to {@link verify}. */
+interface VerifyInput {
+  /** The raw request body, **exactly** as received (no re-serialization). */
+  payload: string;
+  /** Request headers; name lookup is case-insensitive. */
+  headers: Record<string, string>;
+  /** Candidate secret(s) — pass several during rotation; any match passes. */
+  secret: string | string[];
+  /** Allowed clock skew in seconds, both past and future. Default `300`. */
+  toleranceSeconds?: number;
+  /** Current unix time in seconds — injectable for tests. */
+  now?: number;
+}
+/**
+ * Verify an incoming Standard Webhooks request (from **any** compliant sender,
+ * not just this package). Checks the timestamp tolerance, then compares every
+ * `v1,` signature in the header against every candidate secret in constant
+ * time. Returns the parsed envelope on success; throws
+ * {@link WebhookVerificationError} otherwise.
+ *
+ * @example
+ * ```ts
+ * import { verify } from "@xtandard/webhooks/signing";
+ *
+ * const envelope = await verify({
+ *   payload: rawBody,
+ *   headers: { "webhook-id": id, "webhook-timestamp": ts, "webhook-signature": sig },
+ *   secret: "whsec_…",
+ * });
+ * ```
+ */
+declare function verify(input: VerifyInput): Promise<WebhookEnvelope>;
+//#endregion
+export { SECRET_PREFIX, VerifyInput, type WebhookEnvelope, WebhookVerificationError, generateSecret, sign, signatureHeader, verify };
+//# sourceMappingURL=signing.d.cts.map

package/dist/signing.d.mts

@@ -0,0 +1,73 @@
+import { _ as WebhookEnvelope } from "./schema-mo__wv4P.mjs";
+
+//#region src/signing.d.ts
+/** Prefix of every symmetric Standard Webhooks secret. */
+declare const SECRET_PREFIX = "whsec_";
+/** Thrown by {@link verify} / receiver helpers when a webhook fails verification. */
+declare class WebhookVerificationError extends Error {
+  constructor(message: string);
+}
+/**
+ * Generate a new signing secret: `whsec_` + base64 of 24 crypto-random bytes.
+ *
+ * @example
+ * ```ts
+ * import { generateSecret } from "@xtandard/webhooks/signing";
+ *
+ * const secret = generateSecret(); // "whsec_…"
+ * ```
+ */
+declare function generateSecret(): string;
+/**
+ * Sign one delivery attempt with one secret: `v1,` + base64(HMAC-SHA256 over
+ * `${id}.${timestamp}.${body}`). `timestamp` is unix **seconds**.
+ *
+ * @example
+ * ```ts
+ * import { sign } from "@xtandard/webhooks/signing";
+ *
+ * const signature = await sign(secret, "msg_…", 1720000000, body);
+ * // "v1,K5oZ…"
+ * ```
+ */
+declare function sign(secret: string, id: string, timestamp: number, body: string): Promise<string>;
+/**
+ * Build the full `webhook-signature` header value: one signature per secret,
+ * space-separated (multiple entries appear during secret rotation).
+ */
+declare function signatureHeader(secrets: string[], id: string, timestamp: number, body: string): Promise<string>;
+/** Input to {@link verify}. */
+interface VerifyInput {
+  /** The raw request body, **exactly** as received (no re-serialization). */
+  payload: string;
+  /** Request headers; name lookup is case-insensitive. */
+  headers: Record<string, string>;
+  /** Candidate secret(s) — pass several during rotation; any match passes. */
+  secret: string | string[];
+  /** Allowed clock skew in seconds, both past and future. Default `300`. */
+  toleranceSeconds?: number;
+  /** Current unix time in seconds — injectable for tests. */
+  now?: number;
+}
+/**
+ * Verify an incoming Standard Webhooks request (from **any** compliant sender,
+ * not just this package). Checks the timestamp tolerance, then compares every
+ * `v1,` signature in the header against every candidate secret in constant
+ * time. Returns the parsed envelope on success; throws
+ * {@link WebhookVerificationError} otherwise.
+ *
+ * @example
+ * ```ts
+ * import { verify } from "@xtandard/webhooks/signing";
+ *
+ * const envelope = await verify({
+ *   payload: rawBody,
+ *   headers: { "webhook-id": id, "webhook-timestamp": ts, "webhook-signature": sig },
+ *   secret: "whsec_…",
+ * });
+ * ```
+ */
+declare function verify(input: VerifyInput): Promise<WebhookEnvelope>;
+//#endregion
+export { SECRET_PREFIX, VerifyInput, type WebhookEnvelope, WebhookVerificationError, generateSecret, sign, signatureHeader, verify };
+//# sourceMappingURL=signing.d.mts.map

package/dist/signing.mjs

@@ -0,0 +1,156 @@
+//#region src/signing.ts
+/** Prefix of every symmetric Standard Webhooks secret. */
+const SECRET_PREFIX = "whsec_";
+/** Prefix of every symmetric (v1) signature entry. */
+const SIGNATURE_VERSION = "v1";
+const MIN_SECRET_BYTES = 24;
+const MAX_SECRET_BYTES = 64;
+/** Thrown by {@link verify} / receiver helpers when a webhook fails verification. */
+var WebhookVerificationError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "WebhookVerificationError";
+	}
+};
+function base64Encode(bytes) {
+	let binary = "";
+	for (const b of bytes) binary += String.fromCharCode(b);
+	return btoa(binary);
+}
+function base64Decode(value) {
+	const binary = atob(value);
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return bytes;
+}
+/** Decode `whsec_…` into raw key bytes, enforcing the spec's 24–64 byte range. */
+function decodeSecret(secret) {
+	const body = secret.startsWith("whsec_") ? secret.slice(6) : secret;
+	let bytes;
+	try {
+		bytes = base64Decode(body);
+	} catch {
+		throw new WebhookVerificationError("Invalid secret: not base64");
+	}
+	if (bytes.length < MIN_SECRET_BYTES || bytes.length > MAX_SECRET_BYTES) throw new WebhookVerificationError(`Invalid secret: decoded length ${bytes.length} outside ${MIN_SECRET_BYTES}–${MAX_SECRET_BYTES} bytes`);
+	return bytes;
+}
+/**
+* Generate a new signing secret: `whsec_` + base64 of 24 crypto-random bytes.
+*
+* @example
+* ```ts
+* import { generateSecret } from "@xtandard/webhooks/signing";
+*
+* const secret = generateSecret(); // "whsec_…"
+* ```
+*/
+function generateSecret() {
+	const bytes = new Uint8Array(MIN_SECRET_BYTES);
+	crypto.getRandomValues(bytes);
+	return SECRET_PREFIX + base64Encode(bytes);
+}
+async function hmacSha256(keyBytes, content) {
+	const key = await crypto.subtle.importKey("raw", keyBytes, {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const digest = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(content));
+	return new Uint8Array(digest);
+}
+/**
+* Sign one delivery attempt with one secret: `v1,` + base64(HMAC-SHA256 over
+* `${id}.${timestamp}.${body}`). `timestamp` is unix **seconds**.
+*
+* @example
+* ```ts
+* import { sign } from "@xtandard/webhooks/signing";
+*
+* const signature = await sign(secret, "msg_…", 1720000000, body);
+* // "v1,K5oZ…"
+* ```
+*/
+async function sign(secret, id, timestamp, body) {
+	return `${SIGNATURE_VERSION},${base64Encode(await hmacSha256(decodeSecret(secret), `${id}.${timestamp}.${body}`))}`;
+}
+/**
+* Build the full `webhook-signature` header value: one signature per secret,
+* space-separated (multiple entries appear during secret rotation).
+*/
+async function signatureHeader(secrets, id, timestamp, body) {
+	return (await Promise.all(secrets.map((s) => sign(s, id, timestamp, body)))).join(" ");
+}
+/** Constant-time byte comparison (XOR accumulate — no early exit on content). */
+function timingSafeEqual(a, b) {
+	if (a.length !== b.length) return false;
+	let diff = 0;
+	for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+	return diff === 0;
+}
+/** Case-insensitive header lookup in a plain record. */
+function headerLookup(headers, name) {
+	const direct = headers[name];
+	if (direct !== void 0) return direct;
+	const lower = name.toLowerCase();
+	for (const [key, value] of Object.entries(headers)) if (key.toLowerCase() === lower) return value;
+}
+/**
+* Verify an incoming Standard Webhooks request (from **any** compliant sender,
+* not just this package). Checks the timestamp tolerance, then compares every
+* `v1,` signature in the header against every candidate secret in constant
+* time. Returns the parsed envelope on success; throws
+* {@link WebhookVerificationError} otherwise.
+*
+* @example
+* ```ts
+* import { verify } from "@xtandard/webhooks/signing";
+*
+* const envelope = await verify({
+*   payload: rawBody,
+*   headers: { "webhook-id": id, "webhook-timestamp": ts, "webhook-signature": sig },
+*   secret: "whsec_…",
+* });
+* ```
+*/
+async function verify(input) {
+	const id = headerLookup(input.headers, "webhook-id");
+	const timestampRaw = headerLookup(input.headers, "webhook-timestamp");
+	const signatureHeaderValue = headerLookup(input.headers, "webhook-signature");
+	if (!id) throw new WebhookVerificationError("Missing webhook-id header");
+	if (!timestampRaw) throw new WebhookVerificationError("Missing webhook-timestamp header");
+	if (!signatureHeaderValue) throw new WebhookVerificationError("Missing webhook-signature header");
+	const timestamp = Number(timestampRaw);
+	if (!Number.isFinite(timestamp) || !/^\d+$/.test(timestampRaw.trim())) throw new WebhookVerificationError(`Invalid webhook-timestamp "${timestampRaw}"`);
+	const tolerance = input.toleranceSeconds ?? 300;
+	const now = input.now ?? Math.floor(Date.now() / 1e3);
+	if (timestamp < now - tolerance) throw new WebhookVerificationError("webhook-timestamp is too old");
+	if (timestamp > now + tolerance) throw new WebhookVerificationError("webhook-timestamp is in the future");
+	const candidates = signatureHeaderValue.split(" ").map((entry) => entry.trim()).filter((entry) => entry.startsWith(`${SIGNATURE_VERSION},`)).map((entry) => entry.slice(3));
+	if (candidates.length === 0) throw new WebhookVerificationError("No v1 signature found in webhook-signature header");
+	const secrets = Array.isArray(input.secret) ? input.secret : [input.secret];
+	if (secrets.length === 0) throw new WebhookVerificationError("No secret provided");
+	const content = `${id}.${timestampRaw.trim()}.${input.payload}`;
+	let matched = false;
+	for (const secret of secrets) {
+		const expected = await hmacSha256(decodeSecret(secret), content);
+		for (const candidate of candidates) {
+			let candidateBytes;
+			try {
+				candidateBytes = base64Decode(candidate);
+			} catch {
+				continue;
+			}
+			if (timingSafeEqual(expected, candidateBytes)) matched = true;
+		}
+	}
+	if (!matched) throw new WebhookVerificationError("No matching signature");
+	try {
+		return JSON.parse(input.payload);
+	} catch {
+		throw new WebhookVerificationError("Payload is not valid JSON");
+	}
+}
+//#endregion
+export { SECRET_PREFIX, WebhookVerificationError, generateSecret, sign, signatureHeader, verify };
+
+//# sourceMappingURL=signing.mjs.map

package/dist/signing.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.mjs","names":[],"sources":["../src/signing.ts"],"sourcesContent":["/**\n * Standard Webhooks symmetric (v1) signing and verification.\n *\n * Pure and zero-dependency (Web Crypto only) — safe on the request path and in\n * any WinterCG runtime. Shared by the sender (the dispatcher signs outgoing\n * deliveries) and the receiver subpath (`@xtandard/webhooks/receiver`), and\n * compatible with any Standard Webhooks implementation, including Svix.\n *\n * The wire contract (https://www.standardwebhooks.com):\n *\n * - secrets are `whsec_` + base64-encoded key material (24–64 bytes decoded)\n * - the signed content is `${id}.${timestamp}.${body}`\n * - the signature is `v1,` + base64(HMAC-SHA256(key, signedContent))\n * - `webhook-signature` may carry several space-separated signatures (secret\n *   rotation); a receiver accepts if **any** matches\n * - `webhook-timestamp` (unix seconds) must be within tolerance, both ways\n *\n * @module\n */\n\nimport type { WebhookEnvelope } from \"./schema.ts\";\n\nexport type { WebhookEnvelope };\n\n/** Prefix of every symmetric Standard Webhooks secret. */\nexport const SECRET_PREFIX = \"whsec_\";\n\n/** Prefix of every symmetric (v1) signature entry. */\nconst SIGNATURE_VERSION = \"v1\";\n\nconst MIN_SECRET_BYTES = 24;\nconst MAX_SECRET_BYTES = 64;\n\n/** Thrown by {@link verify} / receiver helpers when a webhook fails verification. */\nexport class WebhookVerificationError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"WebhookVerificationError\";\n  }\n}\n\nfunction base64Encode(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const b of bytes) binary += String.fromCharCode(b);\n  return btoa(binary);\n}\n\nfunction base64Decode(value: string): Uint8Array {\n  const binary = atob(value);\n  const bytes = new Uint8Array(binary.length);\n  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);\n  return bytes;\n}\n\n/** Decode `whsec_…` into raw key bytes, enforcing the spec's 24–64 byte range. */\nfunction decodeSecret(secret: string): Uint8Array {\n  const body = secret.startsWith(SECRET_PREFIX) ? secret.slice(SECRET_PREFIX.length) : secret;\n  let bytes: Uint8Array;\n  try {\n    bytes = base64Decode(body);\n  } catch {\n    throw new WebhookVerificationError(\"Invalid secret: not base64\");\n  }\n  if (bytes.length < MIN_SECRET_BYTES || bytes.length > MAX_SECRET_BYTES) {\n    throw new WebhookVerificationError(\n      `Invalid secret: decoded length ${bytes.length} outside ${MIN_SECRET_BYTES}–${MAX_SECRET_BYTES} bytes`,\n    );\n  }\n  return bytes;\n}\n\n/**\n * Generate a new signing secret: `whsec_` + base64 of 24 crypto-random bytes.\n *\n * @example\n * ```ts\n * import { generateSecret } from \"@xtandard/webhooks/signing\";\n *\n * const secret = generateSecret(); // \"whsec_…\"\n * ```\n */\nexport function generateSecret(): string {\n  const bytes = new Uint8Array(MIN_SECRET_BYTES);\n  crypto.getRandomValues(bytes);\n  return SECRET_PREFIX + base64Encode(bytes);\n}\n\nasync function hmacSha256(keyBytes: Uint8Array, content: string): Promise<Uint8Array> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    keyBytes as BufferSource,\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  const digest = await crypto.subtle.sign(\"HMAC\", key, new TextEncoder().encode(content));\n  return new Uint8Array(digest);\n}\n\n/**\n * Sign one delivery attempt with one secret: `v1,` + base64(HMAC-SHA256 over\n * `${id}.${timestamp}.${body}`). `timestamp` is unix **seconds**.\n *\n * @example\n * ```ts\n * import { sign } from \"@xtandard/webhooks/signing\";\n *\n * const signature = await sign(secret, \"msg_…\", 1720000000, body);\n * // \"v1,K5oZ…\"\n * ```\n */\nexport async function sign(\n  secret: string,\n  id: string,\n  timestamp: number,\n  body: string,\n): Promise<string> {\n  const digest = await hmacSha256(decodeSecret(secret), `${id}.${timestamp}.${body}`);\n  return `${SIGNATURE_VERSION},${base64Encode(digest)}`;\n}\n\n/**\n * Build the full `webhook-signature` header value: one signature per secret,\n * space-separated (multiple entries appear during secret rotation).\n */\nexport async function signatureHeader(\n  secrets: string[],\n  id: string,\n  timestamp: number,\n  body: string,\n): Promise<string> {\n  const signatures = await Promise.all(secrets.map((s) => sign(s, id, timestamp, body)));\n  return signatures.join(\" \");\n}\n\n/** Constant-time byte comparison (XOR accumulate — no early exit on content). */\nfunction timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n  if (a.length !== b.length) return false;\n  let diff = 0;\n  for (let i = 0; i < a.length; i++) diff |= (a[i] as number) ^ (b[i] as number);\n  return diff === 0;\n}\n\n/** Case-insensitive header lookup in a plain record. */\nfunction headerLookup(headers: Record<string, string>, name: string): string | undefined {\n  const direct = headers[name];\n  if (direct !== undefined) return direct;\n  const lower = name.toLowerCase();\n  for (const [key, value] of Object.entries(headers)) {\n    if (key.toLowerCase() === lower) return value;\n  }\n  return undefined;\n}\n\n/** Input to {@link verify}. */\nexport interface VerifyInput {\n  /** The raw request body, **exactly** as received (no re-serialization). */\n  payload: string;\n  /** Request headers; name lookup is case-insensitive. */\n  headers: Record<string, string>;\n  /** Candidate secret(s) — pass several during rotation; any match passes. */\n  secret: string | string[];\n  /** Allowed clock skew in seconds, both past and future. Default `300`. */\n  toleranceSeconds?: number;\n  /** Current unix time in seconds — injectable for tests. */\n  now?: number;\n}\n\n/**\n * Verify an incoming Standard Webhooks request (from **any** compliant sender,\n * not just this package). Checks the timestamp tolerance, then compares every\n * `v1,` signature in the header against every candidate secret in constant\n * time. Returns the parsed envelope on success; throws\n * {@link WebhookVerificationError} otherwise.\n *\n * @example\n * ```ts\n * import { verify } from \"@xtandard/webhooks/signing\";\n *\n * const envelope = await verify({\n *   payload: rawBody,\n *   headers: { \"webhook-id\": id, \"webhook-timestamp\": ts, \"webhook-signature\": sig },\n *   secret: \"whsec_…\",\n * });\n * ```\n */\nexport async function verify(input: VerifyInput): Promise<WebhookEnvelope> {\n  const id = headerLookup(input.headers, \"webhook-id\");\n  const timestampRaw = headerLookup(input.headers, \"webhook-timestamp\");\n  const signatureHeaderValue = headerLookup(input.headers, \"webhook-signature\");\n  if (!id) throw new WebhookVerificationError(\"Missing webhook-id header\");\n  if (!timestampRaw) throw new WebhookVerificationError(\"Missing webhook-timestamp header\");\n  if (!signatureHeaderValue) throw new WebhookVerificationError(\"Missing webhook-signature header\");\n\n  const timestamp = Number(timestampRaw);\n  if (!Number.isFinite(timestamp) || !/^\\d+$/.test(timestampRaw.trim())) {\n    throw new WebhookVerificationError(`Invalid webhook-timestamp \"${timestampRaw}\"`);\n  }\n  const tolerance = input.toleranceSeconds ?? 300;\n  const now = input.now ?? Math.floor(Date.now() / 1000);\n  if (timestamp < now - tolerance) {\n    throw new WebhookVerificationError(\"webhook-timestamp is too old\");\n  }\n  if (timestamp > now + tolerance) {\n    throw new WebhookVerificationError(\"webhook-timestamp is in the future\");\n  }\n\n  // Only v1 (symmetric) entries participate; other versions are skipped.\n  const candidates = signatureHeaderValue\n    .split(\" \")\n    .map((entry) => entry.trim())\n    .filter((entry) => entry.startsWith(`${SIGNATURE_VERSION},`))\n    .map((entry) => entry.slice(SIGNATURE_VERSION.length + 1));\n  if (candidates.length === 0) {\n    throw new WebhookVerificationError(\"No v1 signature found in webhook-signature header\");\n  }\n\n  const secrets = Array.isArray(input.secret) ? input.secret : [input.secret];\n  if (secrets.length === 0) throw new WebhookVerificationError(\"No secret provided\");\n\n  // Sign over the timestamp EXACTLY as it arrived on the wire (already\n  // validated as digits above), not the JS-parsed number — re-stringifying\n  // through Number() can lose precision or reformat and would reject a\n  // legitimately-signed webhook whose value doesn't round-trip.\n  const content = `${id}.${timestampRaw.trim()}.${input.payload}`;\n  let matched = false;\n  for (const secret of secrets) {\n    const expected = await hmacSha256(decodeSecret(secret), content);\n    for (const candidate of candidates) {\n      let candidateBytes: Uint8Array;\n      try {\n        candidateBytes = base64Decode(candidate);\n      } catch {\n        continue; // malformed entry — try the rest\n      }\n      if (timingSafeEqual(expected, candidateBytes)) matched = true;\n    }\n  }\n  if (!matched) throw new WebhookVerificationError(\"No matching signature\");\n\n  try {\n    return JSON.parse(input.payload) as WebhookEnvelope;\n  } catch {\n    throw new WebhookVerificationError(\"Payload is not valid JSON\");\n  }\n}\n"],"mappings":";;AAyBA,MAAa,gBAAgB;;AAG7B,MAAM,oBAAoB;AAE1B,MAAM,mBAAmB;AACzB,MAAM,mBAAmB;;AAGzB,IAAa,2BAAb,cAA8C,MAAM;CAClD,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;AAEA,SAAS,aAAa,OAA2B;CAC/C,IAAI,SAAS;CACb,KAAK,MAAM,KAAK,OAAO,UAAU,OAAO,aAAa,CAAC;CACtD,OAAO,KAAK,MAAM;AACpB;AAEA,SAAS,aAAa,OAA2B;CAC/C,MAAM,SAAS,KAAK,KAAK;CACzB,MAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;CAC1C,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK,MAAM,KAAK,OAAO,WAAW,CAAC;CACtE,OAAO;AACT;;AAGA,SAAS,aAAa,QAA4B;CAChD,MAAM,OAAO,OAAO,WAAA,QAAwB,IAAI,OAAO,MAAM,CAAoB,IAAI;CACrF,IAAI;CACJ,IAAI;EACF,QAAQ,aAAa,IAAI;CAC3B,QAAQ;EACN,MAAM,IAAI,yBAAyB,4BAA4B;CACjE;CACA,IAAI,MAAM,SAAS,oBAAoB,MAAM,SAAS,kBACpD,MAAM,IAAI,yBACR,kCAAkC,MAAM,OAAO,WAAW,iBAAiB,GAAG,iBAAiB,OACjG;CAEF,OAAO;AACT;;;;;;;;;;;AAYA,SAAgB,iBAAyB;CACvC,MAAM,QAAQ,IAAI,WAAW,gBAAgB;CAC7C,OAAO,gBAAgB,KAAK;CAC5B,OAAO,gBAAgB,aAAa,KAAK;AAC3C;AAEA,eAAe,WAAW,UAAsB,SAAsC;CACpF,MAAM,MAAM,MAAM,OAAO,OAAO,UAC9B,OACA,UACA;EAAE,MAAM;EAAQ,MAAM;CAAU,GAChC,OACA,CAAC,MAAM,CACT;CACA,MAAM,SAAS,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,IAAI,YAAY,EAAE,OAAO,OAAO,CAAC;CACtF,OAAO,IAAI,WAAW,MAAM;AAC9B;;;;;;;;;;;;;AAcA,eAAsB,KACpB,QACA,IACA,WACA,MACiB;CAEjB,OAAO,GAAG,kBAAkB,GAAG,aAAa,MADvB,WAAW,aAAa,MAAM,GAAG,GAAG,GAAG,GAAG,UAAU,GAAG,MAAM,CAChC;AACpD;;;;;AAMA,eAAsB,gBACpB,SACA,IACA,WACA,MACiB;CAEjB,QAAO,MADkB,QAAQ,IAAI,QAAQ,KAAK,MAAM,KAAK,GAAG,IAAI,WAAW,IAAI,CAAC,CAAC,GACnE,KAAK,GAAG;AAC5B;;AAGA,SAAS,gBAAgB,GAAe,GAAwB;CAC9D,IAAI,EAAE,WAAW,EAAE,QAAQ,OAAO;CAClC,IAAI,OAAO;CACX,KAAK,IAAI,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK,QAAS,EAAE,KAAiB,EAAE;CACjE,OAAO,SAAS;AAClB;;AAGA,SAAS,aAAa,SAAiC,MAAkC;CACvF,MAAM,SAAS,QAAQ;CACvB,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,MAAM,QAAQ,KAAK,YAAY;CAC/B,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAC/C,IAAI,IAAI,YAAY,MAAM,OAAO,OAAO;AAG5C;;;;;;;;;;;;;;;;;;;AAkCA,eAAsB,OAAO,OAA8C;CACzE,MAAM,KAAK,aAAa,MAAM,SAAS,YAAY;CACnD,MAAM,eAAe,aAAa,MAAM,SAAS,mBAAmB;CACpE,MAAM,uBAAuB,aAAa,MAAM,SAAS,mBAAmB;CAC5E,IAAI,CAAC,IAAI,MAAM,IAAI,yBAAyB,2BAA2B;CACvE,IAAI,CAAC,cAAc,MAAM,IAAI,yBAAyB,kCAAkC;CACxF,IAAI,CAAC,sBAAsB,MAAM,IAAI,yBAAyB,kCAAkC;CAEhG,MAAM,YAAY,OAAO,YAAY;CACrC,IAAI,CAAC,OAAO,SAAS,SAAS,KAAK,CAAC,QAAQ,KAAK,aAAa,KAAK,CAAC,GAClE,MAAM,IAAI,yBAAyB,8BAA8B,aAAa,EAAE;CAElF,MAAM,YAAY,MAAM,oBAAoB;CAC5C,MAAM,MAAM,MAAM,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CACrD,IAAI,YAAY,MAAM,WACpB,MAAM,IAAI,yBAAyB,8BAA8B;CAEnE,IAAI,YAAY,MAAM,WACpB,MAAM,IAAI,yBAAyB,oCAAoC;CAIzE,MAAM,aAAa,qBAChB,MAAM,GAAG,EACT,KAAK,UAAU,MAAM,KAAK,CAAC,EAC3B,QAAQ,UAAU,MAAM,WAAW,GAAG,kBAAkB,EAAE,CAAC,EAC3D,KAAK,UAAU,MAAM,MAAM,CAA4B,CAAC;CAC3D,IAAI,WAAW,WAAW,GACxB,MAAM,IAAI,yBAAyB,mDAAmD;CAGxF,MAAM,UAAU,MAAM,QAAQ,MAAM,MAAM,IAAI,MAAM,SAAS,CAAC,MAAM,MAAM;CAC1E,IAAI,QAAQ,WAAW,GAAG,MAAM,IAAI,yBAAyB,oBAAoB;CAMjF,MAAM,UAAU,GAAG,GAAG,GAAG,aAAa,KAAK,EAAE,GAAG,MAAM;CACtD,IAAI,UAAU;CACd,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,WAAW,MAAM,WAAW,aAAa,MAAM,GAAG,OAAO;EAC/D,KAAK,MAAM,aAAa,YAAY;GAClC,IAAI;GACJ,IAAI;IACF,iBAAiB,aAAa,SAAS;GACzC,QAAQ;IACN;GACF;GACA,IAAI,gBAAgB,UAAU,cAAc,GAAG,UAAU;EAC3D;CACF;CACA,IAAI,CAAC,SAAS,MAAM,IAAI,yBAAyB,uBAAuB;CAExE,IAAI;EACF,OAAO,KAAK,MAAM,MAAM,OAAO;CACjC,QAAQ;EACN,MAAM,IAAI,yBAAyB,2BAA2B;CAChE;AACF"}

package/dist/sqlite-Cmqnrjes.mjs

@@ -0,0 +1,67 @@
+import { t as __exportAll } from "./chunk-D7D4PA-g.mjs";
+import { Database } from "bun:sqlite";
+//#region src/storage/sqlite.ts
+/**
+* SQLite storage adapter built on `bun:sqlite` — **Bun only**, zero npm deps.
+* Ideal for single-node deployments and local/dev persistence: durable, fast, and
+* file-backed (or in-memory). For multi-node runtimes prefer Redis/Postgres.
+*
+* `bun:sqlite` is marked external at build time, so this module only resolves
+* under the Bun runtime. Importing it under Node will throw — by design.
+*
+* ```ts
+* import { createSqliteStorage } from "@xtandard/webhooks/storage/sqlite";
+* const storage = createSqliteStorage({ path: "./webhooks.sqlite" });
+* ```
+*
+* @module
+*/
+var sqlite_exports = /* @__PURE__ */ __exportAll({ createSqliteStorage: () => createSqliteStorage });
+const escapeLike = (prefix) => prefix.replace(/[\\%_]/g, (c) => `\\${c}`);
+/**
+* Create a SQLite-backed storage. Requires the Bun runtime (`bun:sqlite`).
+*
+* @example
+* ```ts
+* import { createSqliteStorage } from "@xtandard/webhooks/storage/sqlite";
+*
+* // File-backed (persists across restarts):
+* const storage = createSqliteStorage({ path: "./webhooks.sqlite" });
+*
+* // In-memory (reset each run, useful for tests):
+* // const storage = createSqliteStorage({ path: ":memory:" });
+* ```
+*/
+function createSqliteStorage(options = {}) {
+	const table = options.table ?? "xtandard_webhooks";
+	if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(table)) throw new Error(`Invalid table name: ${JSON.stringify(table)}`);
+	const ownsDb = !options.database;
+	const db = options.database ?? new Database(options.path ?? ":memory:");
+	db.run(`CREATE TABLE IF NOT EXISTS ${table} (key TEXT PRIMARY KEY, value TEXT NOT NULL)`);
+	const selectStmt = db.query(`SELECT value FROM ${table} WHERE key = ?`);
+	const upsertStmt = db.query(`INSERT INTO ${table} (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value`);
+	const deleteStmt = db.query(`DELETE FROM ${table} WHERE key = ?`);
+	const keysStmt = db.query(`SELECT key FROM ${table} WHERE key LIKE ? ESCAPE '\\'`);
+	return {
+		async getItem(key) {
+			const row = selectStmt.get(key);
+			return row ? JSON.parse(row.value) : null;
+		},
+		async setItem(key, value) {
+			upsertStmt.run(key, JSON.stringify(value));
+		},
+		async removeItem(key) {
+			deleteStmt.run(key);
+		},
+		async getKeys(prefix) {
+			return keysStmt.all(`${escapeLike(prefix)}%`).map((r) => r.key);
+		},
+		close() {
+			if (ownsDb) db.close();
+		}
+	};
+}
+//#endregion
+export { sqlite_exports as n, createSqliteStorage as t };
+
+//# sourceMappingURL=sqlite-Cmqnrjes.mjs.map

package/dist/sqlite-Cmqnrjes.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-Cmqnrjes.mjs","names":[],"sources":["../src/storage/sqlite.ts"],"sourcesContent":["/**\n * SQLite storage adapter built on `bun:sqlite` — **Bun only**, zero npm deps.\n * Ideal for single-node deployments and local/dev persistence: durable, fast, and\n * file-backed (or in-memory). For multi-node runtimes prefer Redis/Postgres.\n *\n * `bun:sqlite` is marked external at build time, so this module only resolves\n * under the Bun runtime. Importing it under Node will throw — by design.\n *\n * ```ts\n * import { createSqliteStorage } from \"@xtandard/webhooks/storage/sqlite\";\n * const storage = createSqliteStorage({ path: \"./webhooks.sqlite\" });\n * ```\n *\n * @module\n */\n\nimport { Database } from \"bun:sqlite\";\nimport type { WebhooksStorage } from \"./contract.ts\";\n\n/** Options for {@link createSqliteStorage}. */\nexport interface SqliteStorageOptions {\n  /** File path for the database. Default `\":memory:\"`. Ignored when `database` is given. */\n  path?: string;\n  /** An existing `bun:sqlite` Database instance to use instead of opening one. */\n  database?: Database;\n  /** Table name (default `\"xtandard_webhooks\"`). Validated as a safe identifier. */\n  table?: string;\n}\n\n/** A {@link WebhooksStorage} backed by SQLite, plus `close()`. */\nexport interface SqliteWebhooksStorage extends WebhooksStorage {\n  /** Close the database if this adapter opened it; no-op for a borrowed instance. */\n  close(): void;\n}\n\nconst escapeLike = (prefix: string): string => prefix.replace(/[\\\\%_]/g, (c) => `\\\\${c}`);\n\n/**\n * Create a SQLite-backed storage. Requires the Bun runtime (`bun:sqlite`).\n *\n * @example\n * ```ts\n * import { createSqliteStorage } from \"@xtandard/webhooks/storage/sqlite\";\n *\n * // File-backed (persists across restarts):\n * const storage = createSqliteStorage({ path: \"./webhooks.sqlite\" });\n *\n * // In-memory (reset each run, useful for tests):\n * // const storage = createSqliteStorage({ path: \":memory:\" });\n * ```\n */\nexport function createSqliteStorage(options: SqliteStorageOptions = {}): SqliteWebhooksStorage {\n  const table = options.table ?? \"xtandard_webhooks\";\n  if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(table)) {\n    throw new Error(`Invalid table name: ${JSON.stringify(table)}`);\n  }\n\n  const ownsDb = !options.database;\n  const db = options.database ?? new Database(options.path ?? \":memory:\");\n  db.run(`CREATE TABLE IF NOT EXISTS ${table} (key TEXT PRIMARY KEY, value TEXT NOT NULL)`);\n\n  const selectStmt = db.query(`SELECT value FROM ${table} WHERE key = ?`);\n  const upsertStmt = db.query(\n    `INSERT INTO ${table} (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value`,\n  );\n  const deleteStmt = db.query(`DELETE FROM ${table} WHERE key = ?`);\n  const keysStmt = db.query(`SELECT key FROM ${table} WHERE key LIKE ? ESCAPE '\\\\'`);\n\n  return {\n    async getItem<T>(key: string): Promise<T | null> {\n      const row = selectStmt.get(key) as { value: string } | null;\n      return row ? (JSON.parse(row.value) as T) : null;\n    },\n    async setItem<T>(key: string, value: T): Promise<void> {\n      upsertStmt.run(key, JSON.stringify(value));\n    },\n    async removeItem(key: string): Promise<void> {\n      deleteStmt.run(key);\n    },\n    async getKeys(prefix: string): Promise<string[]> {\n      const rows = keysStmt.all(`${escapeLike(prefix)}%`) as Array<{ key: string }>;\n      return rows.map((r) => r.key);\n    },\n    close(): void {\n      if (ownsDb) db.close();\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAmCA,MAAM,cAAc,WAA2B,OAAO,QAAQ,YAAY,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;AAgBxF,SAAgB,oBAAoB,UAAgC,CAAC,GAA0B;CAC7F,MAAM,QAAQ,QAAQ,SAAS;CAC/B,IAAI,CAAC,2BAA2B,KAAK,KAAK,GACxC,MAAM,IAAI,MAAM,uBAAuB,KAAK,UAAU,KAAK,GAAG;CAGhE,MAAM,SAAS,CAAC,QAAQ;CACxB,MAAM,KAAK,QAAQ,YAAY,IAAI,SAAS,QAAQ,QAAQ,UAAU;CACtE,GAAG,IAAI,8BAA8B,MAAM,6CAA6C;CAExF,MAAM,aAAa,GAAG,MAAM,qBAAqB,MAAM,eAAe;CACtE,MAAM,aAAa,GAAG,MACpB,eAAe,MAAM,kFACvB;CACA,MAAM,aAAa,GAAG,MAAM,eAAe,MAAM,eAAe;CAChE,MAAM,WAAW,GAAG,MAAM,mBAAmB,MAAM,8BAA8B;CAEjF,OAAO;EACL,MAAM,QAAW,KAAgC;GAC/C,MAAM,MAAM,WAAW,IAAI,GAAG;GAC9B,OAAO,MAAO,KAAK,MAAM,IAAI,KAAK,IAAU;EAC9C;EACA,MAAM,QAAW,KAAa,OAAyB;GACrD,WAAW,IAAI,KAAK,KAAK,UAAU,KAAK,CAAC;EAC3C;EACA,MAAM,WAAW,KAA4B;GAC3C,WAAW,IAAI,GAAG;EACpB;EACA,MAAM,QAAQ,QAAmC;GAE/C,OADa,SAAS,IAAI,GAAG,WAAW,MAAM,EAAE,EACtC,EAAE,KAAK,MAAM,EAAE,GAAG;EAC9B;EACA,QAAc;GACZ,IAAI,QAAQ,GAAG,MAAM;EACvB;CACF;AACF"}