@zadq/x402 0.0.0-stage → 0.1.0

package/dist/receipt.js

@@ -0,0 +1,193 @@
+// Issuer-signed attestation receipt — the `attestation-ref/v0` payload of the
+// X-PAYMENT-IDENTITY companion header (bIP-0002 §3A.3, cited by name).
+//
+// Vendor this file. Zero runtime dependencies; WebCrypto for the checks.
+//
+// What a receipt is, and is not: it is the issuer's signed statement that an
+// attestation was ISSUED binding this chain-qualified payTo and resource URL
+// to an accountable operator at a grade. It carries no standing: whether the
+// attestation is active today is read from the free verdict path (or a
+// verifier's proven standing read), never from the receipt. A receiver that
+// cannot verify a receipt handles the request exactly as without it.
+/** Format tag of the v0 seller-side proof. */
+export const ATTESTATION_RECEIPT_FORMAT = 'attestation-ref/v0';
+const HEX32 = /^[0-9a-f]{64}$/;
+const HEX64 = /^[0-9a-f]{128}$/;
+/** Sender side: the companion-header proof carrying this receipt. */
+export function attestationReceiptProof(receipt) {
+    return {
+        version: 1,
+        format: ATTESTATION_RECEIPT_FORMAT,
+        payload: base64UrlEncode(canonicalJson(receipt)),
+    };
+}
+/**
+ * Receiver side: decodes a receipt from a companion-header proof. Returns
+ * `undefined` for any other format or a malformed payload — a normal state;
+ * proceed as without the header.
+ */
+export function readAttestationReceipt(proof) {
+    if (proof === undefined || proof.version !== 1 || proof.format !== ATTESTATION_RECEIPT_FORMAT) {
+        return undefined;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(base64UrlDecode(proof.payload));
+    }
+    catch {
+        return undefined;
+    }
+    return isReceipt(parsed) ? parsed : undefined;
+}
+/** Structural check against the canonical payload schema (closed object). */
+export function isReceipt(value) {
+    if (typeof value !== 'object' || value === null) {
+        return false;
+    }
+    const r = value;
+    const keys = Object.keys(r).sort();
+    const expected = [
+        'assurance_grade',
+        'attestation_ref',
+        'chain',
+        'issued_at_unix',
+        'issuer_id',
+        'pay_to',
+        'resource_url',
+        'signature',
+    ];
+    if (keys.length !== expected.length || keys.some((k, i) => k !== expected[i])) {
+        return false;
+    }
+    return (typeof r['attestation_ref'] === 'string' &&
+        HEX32.test(r['attestation_ref']) &&
+        typeof r['issuer_id'] === 'string' &&
+        HEX32.test(r['issuer_id']) &&
+        typeof r['chain'] === 'string' &&
+        r['chain'].length > 0 &&
+        typeof r['pay_to'] === 'string' &&
+        r['pay_to'].length > 0 &&
+        typeof r['resource_url'] === 'string' &&
+        r['resource_url'].startsWith('https://') &&
+        Number.isInteger(r['assurance_grade']) &&
+        r['assurance_grade'] >= 1 &&
+        r['assurance_grade'] <= 4 &&
+        Number.isInteger(r['issued_at_unix']) &&
+        r['issued_at_unix'] >= 0 &&
+        typeof r['signature'] === 'string' &&
+        HEX64.test(r['signature']));
+}
+/**
+ * Verifies the issuer's signature locally: Ed25519 over
+ * `"mintid/seller-attestation/v0" || 0x00 || SHA-256(canonical JSON of the
+ * seven signed fields)` with the issuer's registered status signing key (raw
+ * 32 bytes, hex). The key is read from the substrate's issuer registry and
+ * pinned by the consumer — never hard-coded here, never taken from the
+ * receipt itself.
+ *
+ * `valid` proves issuance by that key. It says nothing about standing.
+ */
+export async function verifyAttestationReceipt(receipt, issuerPublicKeyHex) {
+    if (!isReceipt(receipt)) {
+        return 'invalid';
+    }
+    let publicKey;
+    let signature;
+    try {
+        publicKey = hexDecode(issuerPublicKeyHex, 32);
+        signature = hexDecode(receipt.signature, 64);
+    }
+    catch {
+        return 'invalid';
+    }
+    let message;
+    try {
+        message = await receiptSigningInput(receipt);
+    }
+    catch {
+        return 'unverifiable';
+    }
+    try {
+        const key = await crypto.subtle.importKey('raw', publicKey, { name: 'Ed25519' }, false, [
+            'verify',
+        ]);
+        const ok = await crypto.subtle.verify('Ed25519', key, signature, message);
+        return ok ? 'valid' : 'invalid';
+    }
+    catch {
+        // Runtime without Ed25519 WebCrypto support: the integration keeps
+        // working; the receipt is simply not locally checked.
+        return 'unverifiable';
+    }
+}
+const SIGNING_DOMAIN = 'mintid/seller-attestation/v0';
+/** The exact bytes the issuer signed (domain-separated digest of the canonical payload). */
+export async function receiptSigningInput(receipt) {
+    const payload = canonicalJson({
+        assurance_grade: receipt.assurance_grade,
+        attestation_ref: receipt.attestation_ref,
+        chain: receipt.chain,
+        issued_at_unix: receipt.issued_at_unix,
+        issuer_id: receipt.issuer_id,
+        pay_to: receipt.pay_to,
+        resource_url: receipt.resource_url,
+    });
+    const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(payload)));
+    const domain = new TextEncoder().encode(SIGNING_DOMAIN);
+    const out = new Uint8Array(new ArrayBuffer(domain.length + 1 + digest.length));
+    out.set(domain, 0);
+    out[domain.length] = 0x00;
+    out.set(digest, domain.length + 1);
+    return out;
+}
+/**
+ * Canonical JSON as the issuer produces it: keys sorted by code point, no
+ * whitespace, every non-ASCII code unit escaped as lowercase `\uXXXX`
+ * (the form Python's json.dumps emits with sort_keys and compact separators).
+ */
+export function canonicalJson(value) {
+    const keys = Object.keys(value).sort();
+    const parts = keys.map((k) => `${jsonString(k)}:${jsonScalar(value[k])}`);
+    return `{${parts.join(',')}}`;
+}
+function jsonScalar(v) {
+    if (typeof v === 'number') {
+        if (!Number.isInteger(v)) {
+            throw new Error('receipt fields are integers or strings');
+        }
+        return String(v);
+    }
+    return jsonString(v ?? '');
+}
+function jsonString(s) {
+    const escaped = JSON.stringify(s);
+    // JSON.stringify leaves non-ASCII as-is; the issuer escapes it.
+    return escaped.replace(/[\u0080-￿]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`);
+}
+function hexDecode(hex, length) {
+    if (!/^[0-9a-f]*$/.test(hex) || hex.length !== length * 2) {
+        throw new Error('bad hex');
+    }
+    const out = new Uint8Array(new ArrayBuffer(length));
+    for (let i = 0; i < length; i++) {
+        out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    }
+    return out;
+}
+function base64UrlEncode(value) {
+    const bytes = new TextEncoder().encode(value);
+    let binary = '';
+    for (const b of bytes) {
+        binary += String.fromCharCode(b);
+    }
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function base64UrlDecode(value) {
+    const base64 = value.replace(/-/g, '+').replace(/_/g, '/');
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return new TextDecoder().decode(bytes);
+}

package/dist/verdict.d.ts

@@ -0,0 +1,101 @@
+/**
+ * The payment rails the seller rail covers (Platform Decision 14): USDC on
+ * Base (`base`, an EVM address) or on Solana (`solana`). The contract is a
+ * closed enumeration — the service answers a 400 problem to any other value,
+ * and other EVM chains are not declared until a seller needs one — so the
+ * type is the same closed union, not a string.
+ */
+export type Chain = 'base' | 'solana';
+/** The declared rails, in the order the contract lists them. */
+export declare const CHAINS: readonly Chain[];
+/** Runtime guard for the `Chain` enumeration (input from a wire, an agent or an env var). */
+export declare function isChain(value: unknown): value is Chain;
+/** Verdict outcomes, mirroring the public API contract vocabulary. */
+export type VerdictOutcome = 'human_backed' | 'revoked' | 'stale' | 'no_signal';
+/**
+ * Why a verdict is not `human_backed`: the standing read's closed vocabulary
+ * (MintID's, restated — never a flag of the service's own), or `suspended`
+ * when the witnessed status is suspended. Never present on `human_backed`.
+ */
+export type VerdictReason = 'state_unavailable' | 'issuer_unknown' | 'issuer_not_active' | 'status_root_stale' | 'height_stale' | 'witness_unavailable' | 'witness_malformed' | 'witness_invalid' | 'witness_root_mismatch' | 'bond_insufficient' | 'suspended';
+/** The x402 endpoint a verdict speaks about: chain-qualified payTo + resource URL. */
+export type VerdictSubject = {
+    chain: Chain;
+    payTo: string;
+    resourceUrl: string;
+};
+/**
+ * The address as the service stores and echoes it. An EVM address (`base`)
+ * is case-insensitive — its checksum and lowercase spellings name the same
+ * account — and is kept lowercase; a Solana address is case-sensitive and
+ * kept as given. Use it wherever two spellings of one endpoint are compared
+ * (a cache key, a webhook match, a verdict echoed back). The service
+ * normalises its own side, so a lookup finds the seller under either
+ * spelling.
+ */
+export declare function canonicalPayTo(chain: Chain, payTo: string): string;
+/** The subject with its `payTo` in canonical form (see `canonicalPayTo`). */
+export declare function canonicalSubject(subject: VerdictSubject): VerdictSubject;
+/** Signed verdict as served by the free verification path. */
+export type Verdict = {
+    outcome: VerdictOutcome;
+    subject: VerdictSubject;
+    /** Assurance grade of the positive claim (e.g. "G"). Present on signed outcomes. */
+    assuranceLevel?: string;
+    /** RFC 3339 time of the last re-check. */
+    verifiedAt?: string;
+    /** The published cadence promise: the verdict is re-checked every N hours. */
+    recheckEveryHours: number;
+    /** Ed25519 over the canonical verdict payload, base64. Only positive claims are signed. */
+    signature?: string;
+    /** Identifies the verdict-signing key (first 8 bytes of the public key's SHA-256, hex). */
+    keyId?: string;
+    /** Present on every non-positive outcome, from the closed vocabulary; absent on `human_backed`. */
+    reason?: VerdictReason;
+};
+export declare const DEFAULT_TIMEOUT_MS = 3000;
+/**
+ * Fetches the current verdict for an endpoint from the free verification path.
+ *
+ * Degradation path: resolves to `undefined` — never rejects — on timeout,
+ * network failure or a non-OK response. Treat `undefined` exactly like a
+ * `no_signal` outcome: show "unknown" and carry on.
+ */
+export declare function fetchVerdict(baseUrl: string, subject: VerdictSubject, options?: {
+    timeoutMs?: number;
+}): Promise<Verdict | undefined>;
+/** Freshness against the cadence promise the verdict itself carries. */
+export type Freshness = 'fresh' | 'overdue' | 'unknown';
+/**
+ * Compares the verdict's age with its own `recheckEveryHours` promise. The
+ * service additionally resolves a verdict older than twice the promise as
+ * `stale` server-side; this local check lets a consumer flag lateness without
+ * any further round-trip.
+ */
+export declare function freshness(verdict: Verdict, now?: Date): Freshness;
+/**
+ * Renders the canonical signed statement byte-for-byte as the service signs
+ * it: fixed key order, RFC 3339 UTC at second precision, and Go-style JSON
+ * escaping of `<`, `>` and `&`. Returns `undefined` when the verdict lacks
+ * the fields a signed (positive) claim always carries.
+ */
+export declare function canonicalVerdictPayload(verdict: Verdict): Uint8Array<ArrayBuffer> | undefined;
+/** Outcome of a local signature check. */
+export type SignatureCheck = 'valid' | 'invalid' | 'unverifiable';
+/**
+ * Verifies the verdict's Ed25519 signature locally against a known public key
+ * (base64, 32 raw bytes) — no round-trip involved.
+ *
+ * Degradation path: `unverifiable` (missing signature, or no Ed25519 support
+ * in the runtime's WebCrypto) is not a negative finding — display the verdict
+ * as usual, or fall back to "unknown" if your policy prefers only locally
+ * checked claims. `invalid` means the bytes do not match the key: treat as
+ * "unknown".
+ */
+export declare function verifyVerdictSignature(verdict: Verdict, publicKeyBase64: string): Promise<SignatureCheck>;
+/**
+ * Computes the key id for a verification public key (base64): first 8 bytes
+ * of its SHA-256, hex — comparable with `Verdict.keyId`. Resolves to
+ * `undefined` where WebCrypto digests are unavailable.
+ */
+export declare function keyIdFor(publicKeyBase64: string): Promise<string | undefined>;

package/dist/verdict.js

@@ -0,0 +1,179 @@
+// Verdict snippet — types and helpers for the free verification path.
+//
+// Vendor this file. It is self-contained, has zero runtime dependencies and
+// matches the public OpenAPI contract of the seller-verification service
+// (GET /v0/verifications): the explorer-consumable signed verdict —
+// "human-backed at assurance >= G, verified at T, re-checked every N hours" —
+// or an explicit no-signal outcome. The free path is never charged for.
+//
+// Graceful degradation, by design: every helper treats an unreachable service
+// or an absent verdict as "no signal". Nothing here throws on network failure
+// and nothing blocks your payment flow — your integration keeps working
+// unchanged when no verification response is available.
+/** The declared rails, in the order the contract lists them. */
+export const CHAINS = ['base', 'solana'];
+/** Runtime guard for the `Chain` enumeration (input from a wire, an agent or an env var). */
+export function isChain(value) {
+    return typeof value === 'string' && CHAINS.includes(value);
+}
+/**
+ * The address as the service stores and echoes it. An EVM address (`base`)
+ * is case-insensitive — its checksum and lowercase spellings name the same
+ * account — and is kept lowercase; a Solana address is case-sensitive and
+ * kept as given. Use it wherever two spellings of one endpoint are compared
+ * (a cache key, a webhook match, a verdict echoed back). The service
+ * normalises its own side, so a lookup finds the seller under either
+ * spelling.
+ */
+export function canonicalPayTo(chain, payTo) {
+    const trimmed = payTo.trim();
+    return chain === 'base' ? trimmed.toLowerCase() : trimmed;
+}
+/** The subject with its `payTo` in canonical form (see `canonicalPayTo`). */
+export function canonicalSubject(subject) {
+    return { ...subject, payTo: canonicalPayTo(subject.chain, subject.payTo) };
+}
+export const DEFAULT_TIMEOUT_MS = 3000;
+/**
+ * Fetches the current verdict for an endpoint from the free verification path.
+ *
+ * Degradation path: resolves to `undefined` — never rejects — on timeout,
+ * network failure or a non-OK response. Treat `undefined` exactly like a
+ * `no_signal` outcome: show "unknown" and carry on.
+ */
+export async function fetchVerdict(baseUrl, subject, options) {
+    const url = new URL('/v0/verifications', baseUrl);
+    url.searchParams.set('chain', subject.chain);
+    url.searchParams.set('payTo', subject.payTo);
+    url.searchParams.set('resourceUrl', subject.resourceUrl);
+    try {
+        const res = await fetch(url, {
+            signal: AbortSignal.timeout(options?.timeoutMs ?? DEFAULT_TIMEOUT_MS),
+        });
+        if (!res.ok) {
+            return undefined;
+        }
+        return (await res.json());
+    }
+    catch {
+        // No signal is a normal state, never an error surface.
+        return undefined;
+    }
+}
+/**
+ * Compares the verdict's age with its own `recheckEveryHours` promise. The
+ * service additionally resolves a verdict older than twice the promise as
+ * `stale` server-side; this local check lets a consumer flag lateness without
+ * any further round-trip.
+ */
+export function freshness(verdict, now = new Date()) {
+    if (verdict.verifiedAt === undefined) {
+        return 'unknown';
+    }
+    const verified = Date.parse(verdict.verifiedAt);
+    if (Number.isNaN(verified)) {
+        return 'unknown';
+    }
+    const ageMs = now.getTime() - verified;
+    return ageMs <= verdict.recheckEveryHours * 3_600_000 ? 'fresh' : 'overdue';
+}
+/**
+ * Renders the canonical signed statement byte-for-byte as the service signs
+ * it: fixed key order, RFC 3339 UTC at second precision, and Go-style JSON
+ * escaping of `<`, `>` and `&`. Returns `undefined` when the verdict lacks
+ * the fields a signed (positive) claim always carries.
+ */
+export function canonicalVerdictPayload(verdict) {
+    if (verdict.assuranceLevel === undefined || verdict.verifiedAt === undefined) {
+        return undefined;
+    }
+    const parsed = Date.parse(verdict.verifiedAt);
+    if (Number.isNaN(parsed)) {
+        return undefined;
+    }
+    // Second precision: the canonical form drops any fractional seconds the
+    // transport representation may carry.
+    const verifiedAt = new Date(Math.floor(parsed / 1000) * 1000).toISOString().replace('.000Z', 'Z');
+    const json = `{"chain":${goJson(verdict.subject.chain)}` +
+        `,"payTo":${goJson(verdict.subject.payTo)}` +
+        `,"resourceUrl":${goJson(verdict.subject.resourceUrl)}` +
+        `,"outcome":${goJson(verdict.outcome)}` +
+        `,"assuranceLevel":${goJson(verdict.assuranceLevel)}` +
+        `,"verifiedAt":"${verifiedAt}"` +
+        `,"recheckEveryHours":${verdict.recheckEveryHours}}`;
+    // The cast pins the buffer type so the payload type-checks as a WebCrypto
+    // BufferSource under both DOM and Node typings.
+    return new TextEncoder().encode(json);
+}
+// Go's encoding/json escapes <, > and & (and U+2028/U+2029) inside strings;
+// these characters never appear in JSON syntax outside strings, so a global
+// replacement over the serialised value is safe.
+function goJson(value) {
+    return JSON.stringify(value).replace(/[<>&\u2028\u2029]/g, (c) => '\\u' + c.codePointAt(0).toString(16).padStart(4, '0'));
+}
+/**
+ * Verifies the verdict's Ed25519 signature locally against a known public key
+ * (base64, 32 raw bytes) — no round-trip involved.
+ *
+ * Degradation path: `unverifiable` (missing signature, or no Ed25519 support
+ * in the runtime's WebCrypto) is not a negative finding — display the verdict
+ * as usual, or fall back to "unknown" if your policy prefers only locally
+ * checked claims. `invalid` means the bytes do not match the key: treat as
+ * "unknown".
+ */
+export async function verifyVerdictSignature(verdict, publicKeyBase64) {
+    if (verdict.signature === undefined) {
+        return 'unverifiable';
+    }
+    const payload = canonicalVerdictPayload(verdict);
+    if (payload === undefined) {
+        return 'invalid';
+    }
+    let signature;
+    let publicKey;
+    try {
+        signature = base64Decode(verdict.signature);
+        publicKey = base64Decode(publicKeyBase64);
+    }
+    catch {
+        return 'invalid';
+    }
+    try {
+        const key = await crypto.subtle.importKey('raw', publicKey, { name: 'Ed25519' }, false, [
+            'verify',
+        ]);
+        const ok = await crypto.subtle.verify('Ed25519', key, signature, payload);
+        return ok ? 'valid' : 'invalid';
+    }
+    catch {
+        // Runtime without Ed25519 WebCrypto support: the integration keeps
+        // working; the claim is simply not locally checked.
+        return 'unverifiable';
+    }
+}
+/**
+ * Computes the key id for a verification public key (base64): first 8 bytes
+ * of its SHA-256, hex — comparable with `Verdict.keyId`. Resolves to
+ * `undefined` where WebCrypto digests are unavailable.
+ */
+export async function keyIdFor(publicKeyBase64) {
+    try {
+        const digest = await crypto.subtle.digest('SHA-256', base64Decode(publicKeyBase64));
+        return Array.from(new Uint8Array(digest).slice(0, 8))
+            .map((b) => b.toString(16).padStart(2, '0'))
+            .join('');
+    }
+    catch {
+        return undefined;
+    }
+}
+// Returned as ArrayBuffer so the bytes type-check as WebCrypto BufferSource
+// under both DOM and Node typings.
+function base64Decode(value) {
+    const binary = atob(value);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes.buffer;
+}

package/dist/webhook.d.ts

@@ -0,0 +1,29 @@
+import { type Verdict } from './verdict.js';
+/** Header names used by deliveries. */
+export declare const SIGNATURE_HEADER = "X-Signature";
+export declare const SIGNATURE_KEY_HEADER = "X-Signature-Key";
+export declare const WEBHOOK_VERSION_HEADER = "X-Webhook-Version";
+/** The payload schema version this module understands. */
+export declare const WEBHOOK_VERSION = "1";
+/** A `verdict.updated` delivery: the Verdict schema plus the event name. */
+export type VerdictEvent = Verdict & {
+    event: 'verdict.updated';
+};
+type HeaderSource = Headers | Record<string, string | string[] | undefined>;
+/**
+ * Computes the key id of a subscription secret (first 8 bytes of its
+ * SHA-256, hex) — comparable with the `X-Signature-Key` header.
+ */
+export declare function webhookKeyId(secretHex: string): Promise<string>;
+/**
+ * Verifies a delivery against the subscription secret: key id, schema
+ * version and HMAC over the raw body. Resolves to `false` on any mismatch or
+ * malformed input — never throws.
+ */
+export declare function verifyWebhookSignature(secretHex: string, rawBody: Uint8Array | string, headers: HeaderSource): Promise<boolean>;
+/**
+ * Parses a delivery body into a `VerdictEvent`. Returns `undefined` for
+ * anything that is not a well-formed `verdict.updated` event.
+ */
+export declare function parseVerdictEvent(rawBody: Uint8Array | string): VerdictEvent | undefined;
+export {};

package/dist/webhook.js

@@ -0,0 +1,96 @@
+// Webhook receiver helpers — verify a `verdict.updated` delivery and read its
+// payload. The service signs each delivery with HMAC-SHA256 over the raw body
+// using the per-subscription secret returned at registration:
+//   X-Signature: sha256=<hex>   X-Signature-Key: <key id>   X-Webhook-Version: 1
+//
+// Zero runtime dependencies (WebCrypto). Graceful degradation: a delivery
+// that does not verify is `false` — drop it and keep polling the free path;
+// nothing in your flow depends on webhooks arriving.
+import { isChain } from "./verdict.js";
+/** Header names used by deliveries. */
+export const SIGNATURE_HEADER = 'X-Signature';
+export const SIGNATURE_KEY_HEADER = 'X-Signature-Key';
+export const WEBHOOK_VERSION_HEADER = 'X-Webhook-Version';
+/** The payload schema version this module understands. */
+export const WEBHOOK_VERSION = '1';
+function header(headers, name) {
+    if (headers instanceof Headers) {
+        return headers.get(name) ?? undefined;
+    }
+    const key = Object.keys(headers).find((k) => k.toLowerCase() === name.toLowerCase());
+    const value = key === undefined ? undefined : headers[key];
+    return Array.isArray(value) ? value[0] : value;
+}
+/**
+ * Computes the key id of a subscription secret (first 8 bytes of its
+ * SHA-256, hex) — comparable with the `X-Signature-Key` header.
+ */
+export async function webhookKeyId(secretHex) {
+    const digest = await crypto.subtle.digest('SHA-256', hexDecode(secretHex));
+    return hex(new Uint8Array(digest).slice(0, 8));
+}
+/**
+ * Verifies a delivery against the subscription secret: key id, schema
+ * version and HMAC over the raw body. Resolves to `false` on any mismatch or
+ * malformed input — never throws.
+ */
+export async function verifyWebhookSignature(secretHex, rawBody, headers) {
+    try {
+        if (header(headers, WEBHOOK_VERSION_HEADER) !== WEBHOOK_VERSION) {
+            return false;
+        }
+        if (header(headers, SIGNATURE_KEY_HEADER) !== (await webhookKeyId(secretHex))) {
+            return false;
+        }
+        const signature = header(headers, SIGNATURE_HEADER) ?? '';
+        if (!signature.startsWith('sha256=')) {
+            return false;
+        }
+        const key = await crypto.subtle.importKey('raw', hexDecode(secretHex), { name: 'HMAC', hash: 'SHA-256' }, false, ['verify']);
+        const body = typeof rawBody === 'string' ? new TextEncoder().encode(rawBody) : rawBody;
+        return await crypto.subtle.verify('HMAC', key, hexDecode(signature.slice('sha256='.length)), body);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Parses a delivery body into a `VerdictEvent`. Returns `undefined` for
+ * anything that is not a well-formed `verdict.updated` event.
+ */
+export function parseVerdictEvent(rawBody) {
+    try {
+        const text = typeof rawBody === 'string' ? rawBody : new TextDecoder().decode(rawBody);
+        const value = JSON.parse(text);
+        const subject = value['subject'];
+        if (value['event'] !== 'verdict.updated' ||
+            typeof value['outcome'] !== 'string' ||
+            typeof value['recheckEveryHours'] !== 'number' ||
+            typeof subject !== 'object' ||
+            subject === null ||
+            !isChain(subject['chain']) ||
+            typeof subject['payTo'] !== 'string' ||
+            typeof subject['resourceUrl'] !== 'string') {
+            return undefined;
+        }
+        return value;
+    }
+    catch {
+        return undefined;
+    }
+}
+function hexDecode(value) {
+    if (value.length % 2 !== 0 || /[^0-9a-f]/i.test(value)) {
+        throw new Error('not hex');
+    }
+    const bytes = new Uint8Array(value.length / 2);
+    for (let i = 0; i < bytes.length; i++) {
+        bytes[i] = parseInt(value.slice(i * 2, i * 2 + 2), 16);
+    }
+    return bytes.buffer;
+}
+function hex(bytes) {
+    return Array.from(bytes)
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+}