better-supabase 0.13.0 → 0.14.0

package/dist/signatures-GUBuhLOB.js

@@ -0,0 +1,145 @@
+import { n as dbError } from "./errors-03ysrOt4.js";
+import { c as optionalTemporal, s as nowInstant } from "./temporal-DLZlWbOi.js";
+import { n as temporalMissing } from "./temporal-required-B8qQHYbI.js";
+import { a as ok, r as err } from "./result-B3m7xtRY.js";
+import { i as toBase64, r as fromBase64 } from "./base64-B9Wlsdj7.js";
+import { r as timingSafeEqual, t as encoder } from "./hmac-B3CTTlfv.js";
+//#region src/core/signatures.ts
+/** Accepts `whsec_…`, `v1,whsec_…` (Supabase Auth hooks) or raw base64. */
+function secretBytes(secret) {
+	const raw = secret.replace(/^v1,/, "").replace(/^whsec_/, "");
+	try {
+		return fromBase64(raw);
+	} catch {
+		throw new TypeError("Webhook secret is not valid base64");
+	}
+}
+const keys = /* @__PURE__ */ new Map();
+function keyFor(secret) {
+	let key = keys.get(secret);
+	if (!key) {
+		key = crypto.subtle.importKey("raw", secretBytes(secret), {
+			name: "HMAC",
+			hash: "SHA-256"
+		}, false, ["sign", "verify"]);
+		if (keys.size < 16) {
+			keys.set(secret, key);
+			key.catch(() => keys.delete(secret));
+		}
+	}
+	return key;
+}
+/** The prefix of a Standard Webhooks Ed25519 public key (`v1a` signatures). */
+const PUBLIC_KEY_PREFIX = "whpk_";
+const publicKeys = /* @__PURE__ */ new Map();
+function publicKeyFor(key) {
+	let imported = publicKeys.get(key);
+	if (!imported) {
+		imported = crypto.subtle.importKey("raw", fromBase64(key.slice(5)), { name: "Ed25519" }, false, ["verify"]);
+		if (publicKeys.size < 16) {
+			publicKeys.set(key, imported);
+			imported.catch(() => publicKeys.delete(key));
+		}
+	}
+	return imported;
+}
+async function signature(secret, content) {
+	return toBase64(new Uint8Array(await crypto.subtle.sign("HMAC", await keyFor(secret), encoder.encode(content))));
+}
+function decodeSignature(value) {
+	try {
+		return fromBase64(value);
+	} catch {
+		return;
+	}
+}
+function header(headers, name) {
+	if (headers instanceof Headers) return headers.get(name);
+	return Object.entries(headers).find(([key]) => key.toLowerCase() === name)?.[1] ?? null;
+}
+const unauthorized = (code, message) => dbError("unauthorized", message, { code });
+/**
+* The error for a webhook id `options.seen` already recorded, or for a `seen`
+* that throws; `undefined` for a first delivery or without `seen`.
+*/
+async function replayed(options, id, until) {
+	if (!options.seen || id === "") return;
+	try {
+		if (!await options.seen(id, until)) return;
+	} catch {
+		return dbError("unexpected", "Could not check the webhook id for a replay", { code: "WEBHOOK_DEDUPE_FAILED" });
+	}
+	return dbError("conflict", "Webhook was already received", { code: "WEBHOOK_REPLAYED" });
+}
+/** Headers for a signed Standard Webhooks request. */
+async function signWebhook(secret, message) {
+	const timestamp = String(Math.floor((message.timestamp ?? nowInstant()).epochMilliseconds / 1e3));
+	return {
+		"webhook-id": message.id,
+		"webhook-timestamp": timestamp,
+		"webhook-signature": `v1,${await signature(secret, `${message.id}.${timestamp}.${message.body}`)}`
+	};
+}
+/**
+* Verifies a Standard Webhooks signature (`webhook-id`, `webhook-timestamp`,
+* `webhook-signature`, or the `svix-` names Svix-based senders use) and parses
+* the JSON body. Pass several secrets while rotating.
+*/
+async function verifyWebhook(input, secrets, options = {}) {
+	const headers = input.headers;
+	const prefix = header(headers, "webhook-id") === null ? "svix" : "webhook";
+	const id = header(headers, `${prefix}-id`);
+	const timestamp = header(headers, `${prefix}-timestamp`);
+	const signatures = header(headers, `${prefix}-signature`);
+	if (!id || !timestamp || !signatures) return err(unauthorized("WEBHOOK_MISSING_HEADERS", "Missing webhook signature headers"));
+	const seconds = Number(timestamp);
+	if (!/^\d+$/.test(timestamp)) return err(unauthorized("WEBHOOK_INVALID_TIMESTAMP", "Invalid webhook timestamp"));
+	const namespace = optionalTemporal();
+	if (namespace === void 0) return err(temporalMissing());
+	const now = (options.now?.() ?? namespace.Now.instant()).epochMilliseconds / 1e3;
+	const tolerance = options.tolerance ?? 300;
+	if (seconds < now - tolerance) return err(unauthorized("WEBHOOK_TIMESTAMP_TOO_OLD", "Webhook timestamp is too old"));
+	if (seconds > now + tolerance) return err(unauthorized("WEBHOOK_TIMESTAMP_TOO_NEW", "Webhook timestamp is in the future"));
+	const body = input instanceof Request ? await input.text() : input.body;
+	const content = encoder.encode(`${id}.${timestamp}.${body}`);
+	const entries = signatures.split(" ").map((entry) => entry.split(","));
+	const offered = (version) => entries.filter(([name, value]) => name === version && value).flatMap(([, value]) => decodeSignature(value) ?? []);
+	const symmetric = offered("v1");
+	const asymmetric = offered("v1a");
+	let valid = false;
+	let malformed = false;
+	for (const secret of typeof secrets === "string" ? [secrets] : secrets) {
+		const isPublic = secret.startsWith(PUBLIC_KEY_PREFIX);
+		let key;
+		try {
+			key = await (isPublic ? publicKeyFor(secret) : keyFor(secret));
+		} catch {
+			malformed = true;
+			continue;
+		}
+		for (const candidate of isPublic ? asymmetric : symmetric) if (await crypto.subtle.verify(isPublic ? "Ed25519" : "HMAC", key, candidate, content)) valid = true;
+	}
+	if (!valid && malformed) return err(dbError("unexpected", "Webhook secret is not whsec_ or whpk_ followed by base64", { code: "WEBHOOK_INVALID_SECRET" }));
+	if (!valid) return err(unauthorized("WEBHOOK_INVALID_SIGNATURE", "Invalid webhook signature"));
+	let payload;
+	try {
+		payload = JSON.parse(body);
+	} catch {
+		return err(dbError("invalid_request", "Webhook body is not JSON"));
+	}
+	const replay = await replayed(options, id, namespace.Instant.fromEpochMilliseconds((seconds + tolerance) * 1e3));
+	if (replay) return err(replay);
+	return ok({
+		id,
+		timestamp: namespace.Instant.fromEpochMilliseconds(seconds * 1e3),
+		payload,
+		body
+	});
+}
+/** Checks a shared-secret header (database webhooks), in constant time. */
+function verifySharedSecret(request, secret, headerName = "authorization") {
+	const token = (request.headers.get(headerName) ?? "").replace(/^Bearer\s+/i, "");
+	return timingSafeEqual(token, secret);
+}
+//#endregion
+export { unauthorized as a, signWebhook as i, header as n, verifySharedSecret as o, replayed as r, verifyWebhook as s, PUBLIC_KEY_PREFIX as t };

package/dist/signatures-zbu6KTNQ.d.ts

@@ -0,0 +1,43 @@
+/// <reference lib="esnext.temporal" />
+import { f as Result } from "./result-C6jDfedy.js";
+//#region src/core/signatures.d.ts
+interface VerifiedWebhook<T = unknown> {
+  readonly id: string;
+  readonly timestamp: Temporal.Instant;
+  readonly payload: T;
+  readonly body: string;
+}
+interface VerifyOptions {
+  /** Allowed clock skew in seconds. Defaults to 300. */
+  readonly tolerance?: number;
+  readonly now?: () => Temporal.Instant;
+  /**
+   * Records a verified `webhook-id` and answers whether it was already
+   * recorded, atomically (a unique insert, Redis `SET NX`). A seen id is
+   * refused as a replay (`WEBHOOK_REPLAYED`, 409). `until` is when the
+   * timestamp leaves the tolerance window, so the store may forget the id after
+   * it. Runs only after the signature checks out, and a throw refuses the
+   * request.
+   */
+  readonly seen?: (id: string, until: Temporal.Instant) => boolean | Promise<boolean>;
+}
+type WebhookInput = Request | {
+  readonly headers: Headers | Readonly<Record<string, string>>;
+  readonly body: string;
+};
+/** Headers for a signed Standard Webhooks request. */
+declare function signWebhook(secret: string, message: {
+  readonly id: string;
+  readonly body: string;
+  readonly timestamp?: Temporal.Instant;
+}): Promise<Record<string, string>>;
+/**
+ * Verifies a Standard Webhooks signature (`webhook-id`, `webhook-timestamp`,
+ * `webhook-signature`, or the `svix-` names Svix-based senders use) and parses
+ * the JSON body. Pass several secrets while rotating.
+ */
+declare function verifyWebhook<T = unknown>(input: WebhookInput, secrets: string | readonly string[], options?: VerifyOptions): Promise<Result<VerifiedWebhook<T>>>;
+/** Checks a shared-secret header (database webhooks), in constant time. */
+declare function verifySharedSecret(request: Request, secret: string, headerName?: string): boolean;
+//#endregion
+export { verifySharedSecret as a, signWebhook as i, VerifyOptions as n, verifyWebhook as o, WebhookInput as r, VerifiedWebhook as t };

package/dist/signers-D6ecZl22.d.ts

@@ -0,0 +1,390 @@
+/// <reference lib="esnext.temporal" />
+import { T as ErrorMapper, f as Result, t as AsyncResult } from "./result-C6jDfedy.js";
+import { n as Logger } from "./logger-DWVYUmwi.js";
+import { r as BlockTemporalOptions } from "./block-helpers-BaugZlJV.js";
+import { n as SqlClient } from "./executor-CsTaO3AT.js";
+import { t as BlockTransport } from "./block-transport-d53POsem.js";
+import { n as BlockHooks } from "./block-hooks-CmjPKqQ_.js";
+import { t as BlockProblemOptions } from "./problem-DpHB7tWl.js";
+//#region src/blocks/webhooks/incoming-types.d.ts
+/** How a delivery proves it came from the sender. */
+type IncomingVerify = "none" | "standard-webhooks" | "hmac-sha256" | "shared-secret";
+interface IncomingWebhooksOptions extends BlockProblemOptions, BlockTemporalOptions {
+  /**
+   * A service SQL connection (`postgres.admin`): `receive` looks endpoints up
+   * by token, counts the rate limit and stores deliveries with it.
+   */
+  readonly sql: SqlClient;
+  /**
+   * The caller's transport for `create`, `list`, `update` and the other
+   * management calls, so `webhooks.manage` is checked for them. Defaults to
+   * `sqlTransport(sql)`.
+   */
+  readonly transport?: BlockTransport;
+  readonly mappers?: readonly ErrorMapper[];
+  /** `withBlockHooks` hooks around the management methods. */
+  readonly hooks?: BlockHooks<IncomingWebhooks>;
+  /** Receives the errors `after` hooks throw. */
+  readonly logger?: Logger;
+  /** The schema of the `webhooks-in` module. Defaults to `better_supabase`. */
+  readonly schema?: string;
+  /**
+   * The webhook inbox source deliveries are stored under. Defaults to
+   * `webhook-in`.
+   */
+  readonly source?: string;
+  /**
+   * Deliveries per endpoint and period, counted with the `rate-limit` module's
+   * `hit_rate_limit`. Unset: no limit.
+   */
+  readonly rateLimit?: {
+    readonly max: number;
+    /** Seconds, or a Postgres interval such as `1 minute`. */
+    readonly period: number | string;
+  };
+  /** Request headers stored with each delivery. Defaults to none. */
+  readonly keepHeaders?: readonly string[];
+  /**
+   * Where verified deliveries go. Defaults to `inboxDestination(sql, { source
+   * })`, the webhook inbox; `jobsDestination(jobs, { queue })` sends them to a
+   * jobs queue. A destination can route on the endpoint's metadata.
+   */
+  readonly destination?: IncomingDestination;
+}
+/** A verified delivery, handed to the destination. */
+interface IncomingDelivery {
+  readonly endpoint: {
+    readonly id: string;
+    readonly tenant: string;
+    readonly metadata: Readonly<Record<string, unknown>>;
+  };
+  /** `options.source`. */
+  readonly source: string;
+  /**
+   * Unique per endpoint and delivery: the signed `webhook-id`, the HMAC, the
+   * `webhook-id` header or a random id. A repeated delivery repeats it.
+   */
+  readonly messageId: string;
+  /** The payload's `type` when it is a string. */
+  readonly type: string | null;
+  /** The parsed JSON body, or `{ body }` when it isn't JSON. */
+  readonly payload: unknown;
+  /** `options.keepHeaders` and the endpoint id header, lowercased. */
+  readonly headers: Readonly<Record<string, string>>;
+}
+interface IncomingDestinationResult {
+  readonly id: string | number;
+  /** True when the destination had the delivery already; `receive` answers 200. */
+  readonly duplicate: boolean;
+}
+/**
+ * Stores or forwards verified deliveries. It must detect a repeated
+ * `endpoint.id` and `messageId` and report it as a duplicate. Versioned:
+ * `apiVersion: 1`.
+ */
+interface IncomingDestination {
+  readonly apiVersion: 1;
+  readonly name: string;
+  deliver(delivery: IncomingDelivery): Promise<IncomingDestinationResult>;
+}
+interface CreateIncomingWebhookInput {
+  readonly tenant: string;
+  readonly name: string;
+  /** Defaults to `none`: the token in the URL is the only credential. */
+  readonly verify?: IncomingVerify;
+  readonly metadata?: Readonly<Record<string, unknown>>;
+  /**
+   * The header that carries the HMAC for `hmac-sha256`. Defaults to
+   * `x-signature`.
+   */
+  readonly signatureHeader?: string;
+  /** The record the endpoint belongs to, a type from `options.subjects`. */
+  readonly subject?: {
+    readonly type: string;
+    readonly id: string;
+  };
+}
+/** An endpoint as members see it: everything but the token and secret. */
+interface IncomingWebhook {
+  readonly id: string;
+  readonly tenant: string;
+  readonly name: string;
+  readonly verify: IncomingVerify;
+  readonly signatureHeader: string | null;
+  readonly enabled: boolean;
+  readonly maxBodyBytes: number;
+  readonly receiveCount: number;
+  readonly lastReceivedAt: string | null;
+  readonly lastStatus: number | null;
+  readonly metadata: Readonly<Record<string, unknown>>;
+  readonly subject: {
+    readonly type: string;
+    readonly id: string;
+  } | null;
+  readonly createdBy: string | null;
+  readonly createdAt: string;
+}
+/** A new endpoint: its token (for the URL) and secret are shown once. */
+interface CreatedIncomingWebhook {
+  readonly id: string;
+  readonly tenant: string;
+  readonly name: string;
+  readonly verify: IncomingVerify;
+  readonly token: string;
+  readonly secret: string | null;
+  readonly signatureHeader: string | null;
+  readonly subject: {
+    readonly type: string;
+    readonly id: string;
+  } | null;
+}
+interface UpdateIncomingWebhookInput {
+  readonly name?: string;
+  readonly metadata?: Readonly<Record<string, unknown>>;
+  readonly verify?: IncomingVerify;
+  readonly signatureHeader?: string;
+}
+interface UpdatedIncomingWebhook {
+  readonly id: string;
+  readonly tenant: string;
+  readonly name: string;
+  readonly verify: IncomingVerify;
+  readonly secret: string | null;
+  readonly signatureHeader: string | null;
+  readonly metadata: Readonly<Record<string, unknown>>;
+}
+interface RotatedIncomingSecret {
+  readonly secret: string;
+  readonly previousSecretExpiresAt: Temporal.Instant | null;
+}
+interface IncomingWebhooks {
+  /**
+   * The route for `/hooks/<token>`: finds the endpoint, checks the body size,
+   * the rate limit and the signature, stores the delivery in the webhook inbox
+   * with the endpoint's tenant and answers 202 (200 for a repeated delivery). A
+   * delivery repeats when its signed `webhook-id` does (`standard-webhooks`),
+   * when its body does (`hmac-sha256`, whose signature covers only the body),
+   * or when its `webhook-id` header does (`none`). Needs a service connection.
+   */
+  receive(request: Request, token: string): Promise<Response>;
+  /** Creates an endpoint for a tenant; the caller needs `webhooks.manage`. */
+  create(input: CreateIncomingWebhookInput): AsyncResult<CreatedIncomingWebhook>;
+  /** A new token, and with `rotateSecret` a new secret. */
+  rotate(id: string, options?: {
+    readonly rotateSecret?: boolean;
+  }): AsyncResult<{
+    readonly token: string;
+    readonly secret: string | null;
+  }>;
+  rotateSecret(id: string, options?: {
+    readonly grace?: Temporal.Duration | string;
+  }): AsyncResult<RotatedIncomingSecret>;
+  update(id: string, input: UpdateIncomingWebhookInput): AsyncResult<UpdatedIncomingWebhook>;
+  setEnabled(id: string, enabled: boolean): AsyncResult<boolean>;
+  remove(id: string): AsyncResult<boolean>;
+  /**
+   * A tenant's endpoints, or one subject's, as the caller sees them (the read
+   * policy hides endpoints whose subject they can't read).
+   */
+  list(tenant: string, subject?: {
+    readonly type: string;
+    readonly id?: string;
+  }): AsyncResult<readonly IncomingWebhook[]>;
+}
+//#endregion
+//#region src/blocks/webhooks/url-policy.d.ts
+/**
+ * Decides whether a webhook may be sent to `url`. Throwing means the check
+ * itself failed (a DNS lookup error): deliveries retry it, and `safeFetch`
+ * throws `UrlCheckError`.
+ */
+type AllowUrl = (url: URL) => boolean | Promise<boolean>;
+/** The addresses a host name resolves to. */
+type ResolveHost = (hostname: string) => Promise<readonly string[]>;
+interface PublicUrlOptions {
+  /**
+   * Resolves host names so each address can be checked. Defaults to `node:dns`
+   * where the runtime has it (Node, Bun, Deno); pass one on other runtimes, or
+   * `false` to check only the URL.
+   */
+  readonly resolve?: ResolveHost | false;
+  /** Allow `http:` URLs, e.g. for local development. */
+  readonly allowHttp?: boolean;
+  /** Host names that skip every check, e.g. an internal receiver you trust. */
+  readonly allowHosts?: readonly string[];
+}
+/**
+ * Whether an IP address is reachable on the public internet: not loopback,
+ * private, link-local (cloud metadata), carrier-grade NAT, multicast or
+ * reserved. Returns `false` for anything that isn't an IP address.
+ */
+declare function isPublicAddress(address: string): boolean;
+/**
+ * The default `allowUrl`: HTTPS only, no credentials in the URL, no local host
+ * names, and every address the host resolves to must be public. The delivery
+ * transport calls it again for each redirect.
+ *
+ * DNS can change between this check and the connection. Route webhooks through
+ * an egress proxy when that matters.
+ */
+declare function publicUrl(options?: PublicUrlOptions): AllowUrl;
+//#endregion
+//#region src/blocks/webhooks/http.d.ts
+interface WebhookRequest {
+  readonly url: string;
+  readonly headers: Readonly<Record<string, string>>;
+  readonly body: string;
+  readonly signal?: AbortSignal;
+}
+interface WebhookResponse {
+  readonly status: number;
+  readonly body: string;
+  /** Seconds from the `Retry-After` header, when the receiver sent one. */
+  readonly retryAfter?: number;
+}
+/**
+ * Sends one signed webhook request. Throw `WebhookPolicyError` when the request
+ * must never be retried (a blocked URL); any other error retries.
+ */
+interface WebhookTransport {
+  readonly apiVersion: 1;
+  readonly name: string;
+  send(request: WebhookRequest): Promise<WebhookResponse>;
+}
+/** A delivery that must not be retried, e.g. a URL `allowUrl` rejected. */
+declare class WebhookPolicyError extends Error {
+  override readonly name = "WebhookPolicyError";
+}
+interface FetchTransportOptions {
+  readonly fetch?: typeof fetch;
+  /** Checked before the first request and before each redirect. */
+  readonly allowUrl?: AllowUrl;
+  /**
+   * Defaults to 0: a redirect fails the delivery without a retry. Each hop you
+   * allow is checked with `allowUrl` first.
+   */
+  readonly maxRedirects?: number;
+  /** Per request. Defaults to 10 seconds. */
+  readonly timeoutMs?: number;
+  /** The response body bytes kept; the rest is not read. Defaults to 64 KiB. */
+  readonly maxResponseBytes?: number;
+}
+/** Sends webhooks with `fetch`, following redirects only to allowed URLs. */
+declare function fetchTransport(options?: FetchTransportOptions): WebhookTransport;
+//#endregion
+//#region src/blocks/webhooks/secrets.d.ts
+interface RotateSecretOptions {
+  /** How long older secrets keep signing, e.g. `'24 hours'` (the default). */
+  readonly overlap?: string;
+  /** Use this secret instead of a generated one, e.g. when migrating. */
+  readonly secret?: string;
+}
+/**
+ * Where endpoint signing secrets live. `sqlSecretStore` (Vault or a column, set
+ * in `blocks.webhooks-out.options.secretStorage`) is the default; implement it
+ * for a KMS or a secrets manager.
+ */
+interface WebhookSecretStore {
+  readonly apiVersion: 1;
+  /** The live secrets of an endpoint, newest first. */
+  secrets(endpointId: string): Promise<readonly string[]>;
+  /** Creates a new secret and returns it once. */
+  rotate?(endpointId: string, options?: RotateSecretOptions): Promise<string>;
+}
+/** The module's `webhook_secrets` and `rotate_webhook_secret` functions. */
+declare function sqlSecretStore(transport: BlockTransport, options?: {
+  readonly schema?: string;
+}): WebhookSecretStore;
+//#endregion
+//#region src/blocks/webhooks/signers.d.ts
+interface WebhookSignInput {
+  /** The delivery id, the same on every retry so receivers can deduplicate. */
+  readonly id: string;
+  readonly body: string;
+  readonly timestamp: Temporal.Instant;
+  /** The endpoint's live secrets, newest first. Sign with each while rotating. */
+  readonly secrets: readonly string[];
+}
+/**
+ * Adds the signature headers to an outgoing webhook. `standardWebhooks()` is
+ * the default; `hmacSigner()` covers custom header and payload formats.
+ */
+interface WebhookSigner {
+  readonly apiVersion: 1;
+  readonly name: string;
+  sign(input: WebhookSignInput): Readonly<Record<string, string>> | Promise<Readonly<Record<string, string>>>;
+}
+interface StandardWebhooksOptions {
+  /** Header names, for receivers that expect a prefix such as `svix-`. */
+  readonly headers?: {
+    readonly id?: string;
+    readonly timestamp?: string;
+    readonly signature?: string;
+  };
+}
+/**
+ * Signs with the [Standard Webhooks](https://www.standardwebhooks.com/) scheme:
+ * `webhook-id`, `webhook-timestamp` and one `v1,` signature per secret in
+ * `webhook-signature`. `verifyWebhook` checks it.
+ */
+declare function standardWebhooks(options?: StandardWebhooksOptions): WebhookSigner;
+/**
+ * Signs raw bytes with an Ed25519 key, such as
+ * `createSigningKeys(options).signer(owner)` from
+ * `better-supabase/blocks/signing-keys`.
+ */
+interface RawSigner {
+  sign(data: Uint8Array): PromiseLike<Result<{
+    readonly alg: string;
+    readonly signature: Uint8Array;
+  }>>;
+}
+interface AsymmetricWebhooksOptions extends StandardWebhooksOptions {
+  readonly signer: RawSigner;
+  /**
+   * Also sends a `v1,` HMAC signature per endpoint secret, for receivers that
+   * move from secrets to the public key. Default: false.
+   */
+  readonly hmac?: boolean;
+}
+/**
+ * Signs with the Standard Webhooks asymmetric scheme: one `v1a,` Ed25519
+ * signature over `id.timestamp.body` in `webhook-signature`. Receivers verify
+ * it with the `whpk_` key `webhookPublicKey` returns, through `verifyWebhook`.
+ * Endpoints opt in with `signing = 'v1a'`.
+ */
+declare function standardWebhooksAsymmetric(options: AsymmetricWebhooksOptions): WebhookSigner;
+/** The `whpk_` public key of an Ed25519 JWK, for receivers of `v1a` signatures. */
+declare function webhookPublicKey(jwk: {
+  readonly kty: string;
+  readonly crv?: string;
+  readonly x?: string;
+}): string;
+interface HmacSignerOptions {
+  readonly name?: string;
+  /** E.g. `x-acme-signature`. */
+  readonly signatureHeader: string;
+  /** Sends the epoch-seconds timestamp in this header. */
+  readonly timestampHeader?: string;
+  /** Sends the delivery id in this header. */
+  readonly idHeader?: string;
+  /** The signed text. Defaults to `${timestamp}.${body}`. */
+  readonly content?: (input: {
+    readonly id: string;
+    readonly timestamp: string;
+    readonly body: string;
+  }) => string;
+  /** Defaults to `hex`. */
+  readonly encoding?: "hex" | "base64";
+  /** Written before each signature. Defaults to `v1=`. */
+  readonly prefix?: string;
+  /** Joins the signatures of several secrets. Defaults to `,`. */
+  readonly separator?: string;
+}
+/**
+ * HMAC-SHA256 with the secret's UTF-8 bytes as the key, for receivers that
+ * verify an existing format, e.g. `v1=<hex>` over `timestamp.body`.
+ */
+declare function hmacSigner(options: HmacSignerOptions): WebhookSigner;
+//#endregion
+export { IncomingVerify as A, isPublicAddress as C, IncomingDelivery as D, CreatedIncomingWebhook as E, UpdateIncomingWebhookInput as F, UpdatedIncomingWebhook as I, IncomingWebhooks as M, IncomingWebhooksOptions as N, IncomingDestination as O, RotatedIncomingSecret as P, ResolveHost as S, CreateIncomingWebhookInput as T, WebhookResponse as _, WebhookSignInput as a, AllowUrl as b, standardWebhooks as c, RotateSecretOptions as d, WebhookSecretStore as f, WebhookRequest as g, WebhookPolicyError as h, StandardWebhooksOptions as i, IncomingWebhook as j, IncomingDestinationResult as k, standardWebhooksAsymmetric as l, FetchTransportOptions as m, HmacSignerOptions as n, WebhookSigner as o, sqlSecretStore as p, RawSigner as r, hmacSigner as s, AsymmetricWebhooksOptions as t, webhookPublicKey as u, WebhookTransport as v, publicUrl as w, PublicUrlOptions as x, fetchTransport as y };