deepline 0.3.87 → 0.3.88

package/dist/bundling-sources/shared_libs/monitors/provider-callback-verification.ts

@@ -1,1125 +0,0 @@
-import {
-  createHash,
-  createHmac,
-  randomBytes,
-  timingSafeEqual,
-} from 'node:crypto';
-import { unwrapTamradarPayload } from '@deepline/ingestion-v2/provider-native-monitor-writer';
-
-export const MONITOR_CALLBACK_SECRET_HEADER = 'x-deepline-monitor-secret';
-
-export type ProviderCallbackVerificationFailure = {
-  ok: false;
-  status: 401 | 409 | 422 | 500;
-  code: string;
-  message: string;
-  fields?: string[];
-};
-
-export type ProviderCallbackVerificationOk = {
-  ok: true;
-  mode:
-    | 'hmac_signature'
-    | 'shared_secret_body'
-    | 'secret_header'
-    | 'callback_token_only';
-  residualRisk?: 'unsigned_provider_webhook';
-};
-
-export type ProviderCallbackAuthenticityResult =
-  | ProviderCallbackVerificationOk
-  | ProviderCallbackVerificationFailure;
-
-export type ProviderCallbackEventContext = {
-  providerEventId: string;
-  idempotencyKey: string;
-  payload: Record<string, unknown>;
-  verification: {
-    mode: ProviderCallbackVerificationOk['mode'];
-    residual_risk?: ProviderCallbackVerificationOk['residualRisk'];
-    provider_event_id: string;
-    idempotency_key: string;
-    binding_fields: string[];
-  };
-};
-
-export type ProviderCallbackBindingResult =
-  | { ok: true; event: ProviderCallbackEventContext }
-  | ProviderCallbackVerificationFailure;
-
-const SIGNED_PROVIDERS = new Set(['attio', 'theirstack', 'snitcher']);
-const BODY_SECRET_PROVIDERS = new Set(['lemlist']);
-
-const SENSITIVE_HEADER_NAMES = new Set([
-  'authorization',
-  'cookie',
-  'set-cookie',
-  'attio-signature',
-  'x-attio-signature',
-  'x-theirstack-signature-256',
-  'signature',
-  'x-dev-bootstrap-secret',
-  MONITOR_CALLBACK_SECRET_HEADER,
-]);
-
-const PROVENANCE_HEADER_NAMES = new Set([
-  'content-type',
-  'user-agent',
-  'idempotency-key',
-  'x-request-id',
-  'x-webhook-level',
-]);
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return Boolean(value && typeof value === 'object' && !Array.isArray(value));
-}
-
-function readRecord(value: unknown): Record<string, unknown> {
-  return isRecord(value) ? value : {};
-}
-
-function readString(value: unknown) {
-  if (typeof value === 'number' && Number.isFinite(value)) return String(value);
-  if (typeof value !== 'string') return null;
-  const trimmed = value.trim();
-  return trimmed || null;
-}
-
-function readStringAtPath(record: Record<string, unknown>, path: string) {
-  const value = path.split('.').reduce<unknown>((current, part) => {
-    if (!isRecord(current)) return undefined;
-    return current[part];
-  }, record);
-  return readString(value);
-}
-
-function readArray(value: unknown): unknown[] {
-  return Array.isArray(value) ? value : [];
-}
-
-function readStringArray(value: unknown) {
-  return readArray(value)
-    .map((item) => readString(item))
-    .filter((item): item is string => Boolean(item));
-}
-
-function stableJsonStringify(value: unknown): string {
-  if (Array.isArray(value)) {
-    return `[${value.map(stableJsonStringify).join(',')}]`;
-  }
-  if (value && typeof value === 'object') {
-    return `{${Object.entries(value as Record<string, unknown>)
-      .sort(([left], [right]) => left.localeCompare(right))
-      .map(
-        ([key, entry]) =>
-          `${JSON.stringify(key)}:${stableJsonStringify(entry)}`,
-      )
-      .join(',')}}`;
-  }
-  return JSON.stringify(value);
-}
-
-function sha256(value: string) {
-  return createHash('sha256').update(value).digest('hex');
-}
-
-function timingSafeStringEqual(expected: string, actual: string) {
-  const expectedBuffer = Buffer.from(expected);
-  const actualBuffer = Buffer.from(actual);
-  if (expectedBuffer.length !== actualBuffer.length) return false;
-  return timingSafeEqual(expectedBuffer, actualBuffer);
-}
-
-function timingSafeHexEqual(expectedHex: string, actualHex: string) {
-  if (!/^[a-f0-9]+$/i.test(expectedHex) || !/^[a-f0-9]+$/i.test(actualHex)) {
-    return false;
-  }
-  const expected = Buffer.from(expectedHex, 'hex');
-  const actual = Buffer.from(actualHex, 'hex');
-  if (expected.length === 0 || expected.length !== actual.length) return false;
-  return timingSafeEqual(expected, actual);
-}
-
-function timingSafeBase64Equal(expectedBase64: string, actualBase64: string) {
-  const expected = Buffer.from(expectedBase64, 'base64');
-  const actual = Buffer.from(actualBase64, 'base64');
-  if (expected.length === 0 || expected.length !== actual.length) return false;
-  return timingSafeEqual(expected, actual);
-}
-
-// Exported for the GitHub webhook receiver: GitHub's x-hub-signature-256
-// (`sha256=<hex>`) parses under the same candidate grammar and constant-time
-// comparison used for provider-monitor callbacks.
-export function signatureCandidates(header: string) {
-  return header
-    .split(/[,\s]+/)
-    .map((part) => part.trim())
-    .filter(Boolean)
-    .map((part) => {
-      const [, value] =
-        /^(?:sha256|v1|sig|signature)=([A-Za-z0-9+/=_-]+)$/i.exec(part) ?? [];
-      return value ?? part;
-    });
-}
-
-export function verifyHmacSha256(input: {
-  secret: string;
-  rawBody: string;
-  signatureHeader: string | null;
-}) {
-  if (!input.signatureHeader) return false;
-  const expectedHex = createHmac('sha256', input.secret)
-    .update(input.rawBody)
-    .digest('hex');
-  const expectedBase64 = createHmac('sha256', input.secret)
-    .update(input.rawBody)
-    .digest('base64');
-  return signatureCandidates(input.signatureHeader).some(
-    (candidate) =>
-      timingSafeHexEqual(expectedHex, candidate) ||
-      timingSafeBase64Equal(expectedBase64, candidate),
-  );
-}
-
-function lowerCaseHeaders(headers: Headers) {
-  const entries = new Map<string, string>();
-  headers.forEach((value, key) => {
-    entries.set(key.toLowerCase(), value);
-  });
-  return entries;
-}
-
-function header(headers: Headers, name: string) {
-  return headers.get(name) ?? headers.get(name.toLowerCase());
-}
-
-function firstStringAtPaths(
-  record: Record<string, unknown>,
-  paths: readonly string[],
-) {
-  for (const path of paths) {
-    const value = readStringAtPath(record, path);
-    if (value) return value;
-  }
-  return null;
-}
-
-function providerBindingRecords(providerBinding: Record<string, unknown>) {
-  const runtimePayload = readRecord(providerBinding.runtime_payload);
-  const runtimeWebhook = readRecord(runtimePayload.webhook);
-  const upstreamResponse = readRecord(providerBinding.upstream_response);
-  const upstreamData = readRecord(upstreamResponse.data);
-  const upstreamWebhook = readRecord(upstreamResponse.webhook);
-  const upstreamResultData = readRecord(
-    readRecord(upstreamResponse.result).data,
-  );
-  return [
-    providerBinding,
-    runtimePayload,
-    runtimeWebhook,
-    upstreamResponse,
-    upstreamData,
-    upstreamWebhook,
-    upstreamResultData,
-  ];
-}
-
-function firstBindingSecret(
-  providerBinding: Record<string, unknown>,
-  names: readonly string[],
-) {
-  for (const record of providerBindingRecords(providerBinding)) {
-    for (const name of names) {
-      const value = readString(record[name]);
-      if (value) return value;
-    }
-  }
-  return null;
-}
-
-function runtimeHeaderSecret(providerBinding: Record<string, unknown>) {
-  const runtimePayload = readRecord(providerBinding.runtime_payload);
-  const headers = readRecord(runtimePayload.headers);
-  const webhookHeaders = readRecord(readRecord(runtimePayload.webhook).headers);
-  for (const record of [headers, webhookHeaders]) {
-    for (const [key, value] of Object.entries(record)) {
-      if (key.toLowerCase() === MONITOR_CALLBACK_SECRET_HEADER) {
-        return readString(value);
-      }
-    }
-  }
-  return firstBindingSecret(providerBinding, [
-    'deepline_callback_secret',
-    'callback_secret',
-  ]);
-}
-
-function signingSecret(
-  provider: string,
-  providerBinding: Record<string, unknown>,
-) {
-  switch (provider) {
-    case 'attio':
-      return firstBindingSecret(providerBinding, [
-        'attio_signing_secret',
-        'webhook_secret',
-        'signing_secret',
-        'secret',
-      ]);
-    case 'theirstack':
-      return firstBindingSecret(providerBinding, [
-        'theirstack_signing_secret',
-        'signing_secret',
-        'secret',
-      ]);
-    case 'snitcher':
-      return firstBindingSecret(providerBinding, ['webhook_secret', 'secret']);
-    default:
-      return null;
-  }
-}
-
-function missingSecret(provider: string): ProviderCallbackVerificationFailure {
-  return {
-    ok: false,
-    status: 500,
-    code: 'provider_callback_signing_secret_missing',
-    message: `Deepline monitor callback signing secret is not configured for ${provider}.`,
-  };
-}
-
-function missingSignature(
-  provider: string,
-): ProviderCallbackVerificationFailure {
-  return {
-    ok: false,
-    status: 401,
-    code: 'provider_callback_signature_missing',
-    message: `${provider} callback signature header is missing.`,
-  };
-}
-
-function invalidSignature(
-  provider: string,
-): ProviderCallbackVerificationFailure {
-  return {
-    ok: false,
-    status: 401,
-    code: 'provider_callback_signature_invalid',
-    message: `${provider} callback signature is invalid.`,
-  };
-}
-
-export function createProviderCallbackSecret(prefix = 'monsec') {
-  return `${prefix}_${randomBytes(32).toString('hex')}`;
-}
-
-export function providerCallbackVerificationRequiresParsedPayload(
-  provider: string,
-) {
-  return BODY_SECRET_PROVIDERS.has(provider);
-}
-
-export function parseProviderCallbackPayload(input: {
-  contentType: string | null;
-  rawBody: string;
-}): Record<string, unknown> {
-  const rawBody = input.rawBody.trim();
-  if (!rawBody) return {};
-  const contentType = input.contentType ?? '';
-  if (contentType.includes('application/json') || rawBody.startsWith('{')) {
-    try {
-      return readRecord(JSON.parse(rawBody) as unknown);
-    } catch {
-      return {};
-    }
-  }
-  try {
-    return readRecord(JSON.parse(rawBody) as unknown);
-  } catch {
-    return { raw_body: input.rawBody };
-  }
-}
-
-export function verifyProviderCallbackAuthenticity(input: {
-  provider: string;
-  headers: Headers;
-  rawBody: string;
-  providerBinding: Record<string, unknown>;
-  payload?: Record<string, unknown>;
-}): ProviderCallbackAuthenticityResult {
-  if (input.provider === 'attio') {
-    const secret = signingSecret(input.provider, input.providerBinding);
-    if (!secret) return missingSecret(input.provider);
-    const signature =
-      header(input.headers, 'attio-signature') ??
-      header(input.headers, 'x-attio-signature');
-    if (!signature) return missingSignature(input.provider);
-    return verifyHmacSha256({
-      secret,
-      rawBody: input.rawBody,
-      signatureHeader: signature,
-    })
-      ? { ok: true, mode: 'hmac_signature' }
-      : invalidSignature(input.provider);
-  }
-
-  if (input.provider === 'theirstack') {
-    const secret = signingSecret(input.provider, input.providerBinding);
-    if (!secret) return missingSecret(input.provider);
-    const signature = header(input.headers, 'x-theirstack-signature-256');
-    if (!signature) return missingSignature(input.provider);
-    return verifyHmacSha256({
-      secret,
-      rawBody: input.rawBody,
-      signatureHeader: signature,
-    })
-      ? { ok: true, mode: 'hmac_signature' }
-      : invalidSignature(input.provider);
-  }
-
-  if (input.provider === 'snitcher') {
-    const secret = signingSecret(input.provider, input.providerBinding);
-    if (!secret) return missingSecret(input.provider);
-    const signature = header(input.headers, 'signature');
-    if (!signature) return missingSignature(input.provider);
-    return verifyHmacSha256({
-      secret,
-      rawBody: input.rawBody,
-      signatureHeader: signature,
-    })
-      ? { ok: true, mode: 'hmac_signature' }
-      : invalidSignature(input.provider);
-  }
-
-  if (input.provider === 'lemlist') {
-    const expected = firstBindingSecret(input.providerBinding, [
-      'lemlist_secret',
-      'webhook_secret',
-      'secret',
-    ]);
-    if (!expected) return missingSecret(input.provider);
-    const actual = readString(input.payload?.secret);
-    if (!actual) {
-      return {
-        ok: false,
-        status: 401,
-        code: 'provider_callback_secret_missing',
-        message: 'Lemlist callback shared secret is missing.',
-      };
-    }
-    return timingSafeStringEqual(expected, actual)
-      ? { ok: true, mode: 'shared_secret_body' }
-      : {
-          ok: false,
-          status: 401,
-          code: 'provider_callback_secret_invalid',
-          message: 'Lemlist callback shared secret is invalid.',
-        };
-  }
-
-  const configuredHeaderSecret = runtimeHeaderSecret(input.providerBinding);
-  if (configuredHeaderSecret) {
-    const actual = header(input.headers, MONITOR_CALLBACK_SECRET_HEADER);
-    if (!actual) {
-      return {
-        ok: false,
-        status: 401,
-        code: 'provider_callback_secret_header_missing',
-        message: 'Deepline monitor callback secret header is missing.',
-      };
-    }
-    return timingSafeStringEqual(configuredHeaderSecret, actual)
-      ? { ok: true, mode: 'secret_header' }
-      : {
-          ok: false,
-          status: 401,
-          code: 'provider_callback_secret_header_invalid',
-          message: 'Deepline monitor callback secret header is invalid.',
-        };
-  }
-
-  return {
-    ok: true,
-    mode: 'callback_token_only',
-    residualRisk: 'unsigned_provider_webhook',
-  };
-}
-
-function sanitizedPayloadForProvider(
-  provider: string,
-  payload: Record<string, unknown>,
-) {
-  if (
-    provider !== 'lemlist' ||
-    !Object.prototype.hasOwnProperty.call(payload, 'secret')
-  ) {
-    return payload;
-  }
-  return {
-    ...payload,
-    secret: '[redacted]',
-  };
-}
-
-function addMismatch(
-  fields: string[],
-  input: { field: string; expected?: string | null; actual?: string | null },
-) {
-  if (!input.expected) return;
-  if (!input.actual) {
-    fields.push(input.field);
-    return;
-  }
-  if (input.expected !== input.actual) fields.push(input.field);
-}
-
-function addSetMismatch(
-  fields: string[],
-  input: {
-    field: string;
-    expected: readonly string[];
-    actual: readonly string[];
-    allowAll?: string;
-  },
-) {
-  if (!input.expected.length) return;
-  if (input.allowAll && input.expected.includes(input.allowAll)) return;
-  if (!input.actual.length) {
-    fields.push(input.field);
-    return;
-  }
-  const expected = new Set(input.expected.map((value) => value.toLowerCase()));
-  if (input.actual.some((value) => !expected.has(value.toLowerCase()))) {
-    fields.push(input.field);
-  }
-}
-
-function upstreamWebhookId(providerBinding: Record<string, unknown>) {
-  return (
-    readString(providerBinding.upstream_resource_id) ??
-    readString(providerBinding.upstream_monitor_id)
-  );
-}
-
-/**
- * TamRadar delivers its upstream resource identity inside the event envelope.
- * This is the identity Deepline persisted when the monitor was installed; the
- * callback URL/token is only an authentication route and can be shared across
- * updates. Never use payload filters or provider response metadata as a
- * substitute for this binding fence.
- */
-export function tamradarCallbackRadarId(payload: Record<string, unknown>) {
-  const unwrapped = unwrapTamradarPayload(payload);
-  return (
-    readStringAtPath(unwrapped, 'data.radar_id') ??
-    // Legacy provider payloads placed the id at the root. Keep that documented
-    // wire compatibility, but still require it to match the stored binding.
-    readString(unwrapped.radar_id)
-  );
-}
-
-function genericWebhookIds(payload: Record<string, unknown>) {
-  return [
-    'webhook_id',
-    'webhookId',
-    'hook_id',
-    'hookId',
-    'webhook.id',
-    'data.webhook_id',
-    'data.webhookId',
-  ]
-    .map((path) => readStringAtPath(payload, path))
-    .filter((value): value is string => Boolean(value));
-}
-
-function runtimePayload(providerBinding: Record<string, unknown>) {
-  return readRecord(providerBinding.runtime_payload);
-}
-
-function upstreamResponse(providerBinding: Record<string, unknown>) {
-  return readRecord(providerBinding.upstream_response);
-}
-
-function expectedRuntimeEventTypes(providerBinding: Record<string, unknown>) {
-  const runtime = runtimePayload(providerBinding);
-  const webhook = readRecord(runtime.webhook);
-  const subscriptions = readArray(runtime.subscriptions);
-  return [
-    readString(runtime.event_type),
-    readString(runtime.type),
-    ...readStringArray(runtime.event_types),
-    ...readStringArray(webhook.event_types),
-    ...subscriptions
-      .map((item) => readString(readRecord(item).event_type))
-      .filter((value): value is string => Boolean(value)),
-  ].filter((value): value is string => Boolean(value));
-}
-
-function attioEventTypes(payload: Record<string, unknown>) {
-  const events = Array.isArray(payload.events) ? payload.events : [payload];
-  return events
-    .map((item) => {
-      const event = readRecord(item);
-      return readString(event.event_type) ?? readString(event.eventType);
-    })
-    .filter((value): value is string => Boolean(value));
-}
-
-function instantlyProviderEventId(payload: Record<string, unknown>) {
-  return (
-    firstStringAtPaths(payload, [
-      'event_id',
-      'id',
-      'webhook_event_id',
-      'delivery_id',
-    ]) ??
-    `deterministic:${sha256(
-      stableJsonStringify({
-        event_type: readString(payload.event_type) ?? readString(payload.type),
-        workspace:
-          readString(payload.workspace) ?? readString(payload.workspace_id),
-        campaign_id: readString(payload.campaign_id),
-        lead_id: readString(payload.lead_id),
-        lead_email: readString(payload.lead_email),
-        email_id: readString(payload.email_id),
-        timestamp: readString(payload.timestamp),
-      }),
-    ).slice(0, 32)}`
-  );
-}
-
-function lemlistProviderEventId(payload: Record<string, unknown>) {
-  return (
-    readString(payload._id) ??
-    readString(payload.id) ??
-    readString(payload.activityId) ??
-    `deterministic:${sha256(stableJsonStringify(payload)).slice(0, 32)}`
-  );
-}
-
-function heyreachProviderEventId(payload: Record<string, unknown>) {
-  return (
-    firstStringAtPaths(payload, [
-      'delivery_id',
-      'event_id',
-      'id',
-      'webhook_event_id',
-    ]) ??
-    `deterministic:${sha256(
-      stableJsonStringify({
-        event_type:
-          readString(payload.event_type) ??
-          readString(payload.eventType) ??
-          readString(payload.type),
-        campaign_id: readString(payload.campaign_id),
-        profile_url:
-          readString(payload.profile_url) ?? readString(payload.linkedin_url),
-        message_id: readString(payload.message_id),
-        lead_id: readString(payload.lead_id),
-        payload,
-      }),
-    ).slice(0, 32)}`
-  );
-}
-
-function theirstackProviderEventId(payload: Record<string, unknown>) {
-  const id = readString(payload.id);
-  const type = readString(payload.type) ?? readString(payload.event_type);
-  if (id && type) return `${type}:${id}`;
-  return `deterministic:${sha256(stableJsonStringify(payload)).slice(0, 32)}`;
-}
-
-// Providers whose event id is guaranteed by their contract (Attio Idempotency-Key
-// header, TheirStack payload id+type). If we ever fall back to the sha256 hash for
-// one of these, that is a real bug in extraction (or a provider contract change),
-// so make it observable loudly rather than silently content-addressing.
-const GUARANTEED_EVENT_ID_PROVIDERS = new Set(['attio', 'theirstack']);
-
-function observeHashFallback(input: {
-  provider: string;
-  eventId: string;
-  payload: Record<string, unknown>;
-}) {
-  if (!input.eventId.startsWith('deterministic:')) return;
-  // Structured signal so we can measure real exposure of the no-upstream-id
-  // fallback per provider (audit query in scripts/check-signal-radar-hash-fallback).
-  const detail = {
-    provider: input.provider,
-    fallback: 'sha256_payload',
-    event_id: input.eventId,
-    guaranteed_provider: GUARANTEED_EVENT_ID_PROVIDERS.has(input.provider),
-  };
-  if (GUARANTEED_EVENT_ID_PROVIDERS.has(input.provider)) {
-    // Loud: a provider that is supposed to always supply an id did not.
-    console.error('[signal-radar.dedupe.hash_fallback]', detail);
-  } else {
-    console.warn('[signal-radar.dedupe.hash_fallback]', detail);
-  }
-}
-
-function providerEventId(input: {
-  provider: string;
-  headers: Headers;
-  payload: Record<string, unknown>;
-}) {
-  const eventId = providerEventIdInner(input);
-  observeHashFallback({
-    provider: input.provider,
-    eventId,
-    payload: input.payload,
-  });
-  return eventId;
-}
-
-function providerEventIdInner(input: {
-  provider: string;
-  headers: Headers;
-  payload: Record<string, unknown>;
-}) {
-  switch (input.provider) {
-    case 'attio':
-      return (
-        header(input.headers, 'idempotency-key') ??
-        firstStringAtPaths(input.payload, ['event_id', 'delivery_id', 'id']) ??
-        `deterministic:${sha256(stableJsonStringify(input.payload)).slice(0, 32)}`
-      );
-    case 'instantly':
-      return instantlyProviderEventId(input.payload);
-    case 'lemlist':
-      return lemlistProviderEventId(input.payload);
-    case 'smartlead':
-      return (
-        header(input.headers, 'x-request-id') ??
-        firstStringAtPaths(input.payload, [
-          'event_id',
-          'id',
-          'webhook_event_id',
-          'delivery_id',
-        ]) ??
-        `deterministic:${sha256(stableJsonStringify(input.payload)).slice(0, 32)}`
-      );
-    case 'heyreach':
-      return heyreachProviderEventId(input.payload);
-    case 'theirstack':
-      return theirstackProviderEventId(input.payload);
-    case 'deepline_native':
-      // Radar (deepline_native) finding-charge idempotency keys on the stable
-      // per-update id (design §1/§11), not a full-payload hash — a redelivery of
-      // the same update_id with any differing byte (timestamp/envelope) must
-      // dedupe. Unwrap first so this works for both the raw webhook body and the
-      // `{status,code,payload}` execute-envelope shape (matching refund + writer).
-      return (
-        firstStringAtPaths(unwrapTamradarPayload(input.payload), [
-          'update_id',
-          'event_id',
-        ]) ??
-        `deterministic:${sha256(stableJsonStringify(input.payload)).slice(0, 32)}`
-      );
-    default:
-      return `deterministic:${sha256(stableJsonStringify(input.payload)).slice(0, 32)}`;
-  }
-}
-
-export function monitorEventIdempotencyKey(input: {
-  provider: string;
-  monitorKey: string;
-  sourceCapability: string;
-  upstreamWebhookId?: string | null;
-  providerEventId: string;
-}) {
-  return [
-    'monitor_event',
-    input.provider,
-    input.monitorKey,
-    input.sourceCapability,
-    input.upstreamWebhookId ?? 'unbound',
-    input.providerEventId,
-  ]
-    .map(encodeURIComponent)
-    .join(':');
-}
-
-function validateAttio(input: {
-  payload: Record<string, unknown>;
-  providerBinding: Record<string, unknown>;
-  fields: string[];
-}) {
-  const expectedWebhookId = upstreamWebhookId(input.providerBinding);
-  for (const actual of genericWebhookIds(input.payload)) {
-    addMismatch(input.fields, {
-      field: 'webhook_id',
-      expected: expectedWebhookId,
-      actual,
-    });
-  }
-  addSetMismatch(input.fields, {
-    field: 'event_type',
-    expected: expectedRuntimeEventTypes(input.providerBinding),
-    actual: attioEventTypes(input.payload),
-  });
-}
-
-function validateInstantly(input: {
-  payload: Record<string, unknown>;
-  providerBinding: Record<string, unknown>;
-  fields: string[];
-}) {
-  const runtime = runtimePayload(input.providerBinding);
-  const upstream = upstreamResponse(input.providerBinding);
-  const expectedWebhookId = upstreamWebhookId(input.providerBinding);
-  for (const actual of genericWebhookIds(input.payload)) {
-    addMismatch(input.fields, {
-      field: 'webhook_id',
-      expected: expectedWebhookId,
-      actual,
-    });
-  }
-  addMismatch(input.fields, {
-    field: 'workspace',
-    expected:
-      readString(upstream.organization) ??
-      readString(runtime.organization) ??
-      readString(runtime.workspace),
-    actual:
-      readString(input.payload.workspace) ??
-      readString(input.payload.workspace_id),
-  });
-  addMismatch(input.fields, {
-    field: 'campaign_id',
-    expected: readString(runtime.campaign) ?? readString(upstream.campaign),
-    actual: readString(input.payload.campaign_id),
-  });
-  addSetMismatch(input.fields, {
-    field: 'event_type',
-    expected: expectedRuntimeEventTypes(input.providerBinding),
-    actual: [
-      readString(input.payload.event_type) ??
-        readString(input.payload.eventType) ??
-        readString(input.payload.type),
-    ].filter((value): value is string => Boolean(value)),
-    allowAll: 'all_events',
-  });
-}
-
-function validateLemlist(input: {
-  payload: Record<string, unknown>;
-  providerBinding: Record<string, unknown>;
-  fields: string[];
-}) {
-  const runtime = runtimePayload(input.providerBinding);
-  const upstream = upstreamResponse(input.providerBinding);
-  for (const actual of genericWebhookIds(input.payload)) {
-    addMismatch(input.fields, {
-      field: 'webhook_id',
-      expected: upstreamWebhookId(input.providerBinding),
-      actual,
-    });
-  }
-  addMismatch(input.fields, {
-    field: 'team_id',
-    expected: readString(upstream.teamId) ?? readString(upstream.team_id),
-    actual:
-      readString(input.payload.teamId) ?? readString(input.payload.team_id),
-  });
-  addMismatch(input.fields, {
-    field: 'event_type',
-    expected: readString(runtime.type) ?? readString(upstream.type),
-    actual:
-      readString(input.payload.type) ?? readString(input.payload.event_type),
-  });
-  addMismatch(input.fields, {
-    field: 'campaign_id',
-    expected:
-      readString(runtime.campaign_id) ?? readString(upstream.campaignId),
-    actual:
-      readString(input.payload.campaignId) ??
-      readString(input.payload.campaign_id) ??
-      readString(readRecord(input.payload.metadata).campaignId),
-  });
-}
-
-function validateSmartlead(input: {
-  headers: Headers;
-  payload: Record<string, unknown>;
-  providerBinding: Record<string, unknown>;
-  fields: string[];
-}) {
-  const runtime = runtimePayload(input.providerBinding);
-  const level = header(input.headers, 'x-webhook-level');
-  if (!level) input.fields.push('x-webhook-level');
-  addMismatch(input.fields, {
-    field: 'x-webhook-level',
-    expected: 'campaign',
-    actual: level?.toLowerCase() ?? null,
-  });
-  for (const actual of genericWebhookIds(input.payload)) {
-    addMismatch(input.fields, {
-      field: 'webhook_id',
-      expected: upstreamWebhookId(input.providerBinding),
-      actual,
-    });
-  }
-  addMismatch(input.fields, {
-    field: 'campaign_id',
-    expected: readString(runtime.campaign_id),
-    actual: readString(input.payload.campaign_id),
-  });
-  addSetMismatch(input.fields, {
-    field: 'event_type',
-    expected: readStringArray(readRecord(runtime.webhook).event_types),
-    actual: [
-      readString(input.payload.event_type) ?? readString(input.payload.event),
-    ].filter((value): value is string => Boolean(value)),
-  });
-}
-
-function validateHeyreach(input: {
-  payload: Record<string, unknown>;
-  providerBinding: Record<string, unknown>;
-  fields: string[];
-}) {
-  const runtime = runtimePayload(input.providerBinding);
-  for (const actual of genericWebhookIds(input.payload)) {
-    addMismatch(input.fields, {
-      field: 'webhook_id',
-      expected: upstreamWebhookId(input.providerBinding),
-      actual,
-    });
-  }
-  const expectedCampaigns = readStringArray(runtime.campaign_ids);
-  const campaignId = readString(input.payload.campaign_id);
-  addSetMismatch(input.fields, {
-    field: 'campaign_id',
-    expected: expectedCampaigns,
-    actual: campaignId ? [campaignId] : [],
-  });
-  addSetMismatch(input.fields, {
-    field: 'event_type',
-    expected: expectedRuntimeEventTypes(input.providerBinding),
-    actual: [
-      readString(input.payload.event_type) ??
-        readString(input.payload.eventType) ??
-        readString(input.payload.type),
-    ].filter((value): value is string => Boolean(value)),
-  });
-}
-
-function theirstackSavedSearchId(providerBinding: Record<string, unknown>) {
-  const upstream = upstreamResponse(providerBinding);
-  const savedSearch = readRecord(upstream.saved_search);
-  const webhook = readRecord(upstream.webhook);
-  return (
-    readString(savedSearch.id) ??
-    readString(readRecord(savedSearch.data).id) ??
-    readString(webhook.search_id) ??
-    readString(readRecord(webhook.data).search_id)
-  );
-}
-
-function validateTheirstack(input: {
-  payload: Record<string, unknown>;
-  providerBinding: Record<string, unknown>;
-  fields: string[];
-}) {
-  addMismatch(input.fields, {
-    field: 'webhook_id',
-    expected: upstreamWebhookId(input.providerBinding),
-    actual:
-      readString(input.payload.webhook_id) ??
-      readString(input.payload.webhookId),
-  });
-  addMismatch(input.fields, {
-    field: 'search_id',
-    expected: theirstackSavedSearchId(input.providerBinding),
-    actual:
-      readString(input.payload.search_id) ??
-      readString(input.payload.saved_search_id),
-  });
-  const expectedType = readStringAtPath(
-    runtimePayload(input.providerBinding),
-    'saved_search.type',
-  );
-  const actualEventType =
-    readString(input.payload.type) ?? readString(input.payload.event_type);
-  if (
-    expectedType === 'jobs' &&
-    actualEventType &&
-    !actualEventType.startsWith('job.')
-  ) {
-    input.fields.push('event_type');
-  }
-  if (
-    expectedType === 'companies' &&
-    actualEventType &&
-    actualEventType !== 'company.new'
-  ) {
-    input.fields.push('event_type');
-  }
-}
-
-function validateDeeplineNative(input: {
-  payload: Record<string, unknown>;
-  providerBinding: Record<string, unknown>;
-  fields: string[];
-}) {
-  const expected = upstreamWebhookId(input.providerBinding);
-  const actual = tamradarCallbackRadarId(input.payload);
-  // A callback without an attributable upstream radar is not safe to ingest.
-  // Fail closed before the raw receipt, billing, typed writer, or dispatch.
-  if (!expected || !actual || expected !== actual) {
-    input.fields.push('radar_id');
-  }
-}
-
-export function validateProviderCallbackBindingAndIdempotency(input: {
-  provider: string;
-  headers: Headers;
-  payload: Record<string, unknown>;
-  providerBinding: Record<string, unknown>;
-  monitorKey: string;
-  sourceCapability: string;
-  authenticity: ProviderCallbackVerificationOk;
-}): ProviderCallbackBindingResult {
-  const fields: string[] = [];
-  const payload = sanitizedPayloadForProvider(input.provider, input.payload);
-
-  switch (input.provider) {
-    case 'attio':
-      validateAttio({
-        payload,
-        providerBinding: input.providerBinding,
-        fields,
-      });
-      break;
-    case 'instantly':
-      validateInstantly({
-        payload,
-        providerBinding: input.providerBinding,
-        fields,
-      });
-      break;
-    case 'lemlist':
-      validateLemlist({
-        payload,
-        providerBinding: input.providerBinding,
-        fields,
-      });
-      break;
-    case 'smartlead':
-      validateSmartlead({
-        headers: input.headers,
-        payload,
-        providerBinding: input.providerBinding,
-        fields,
-      });
-      break;
-    case 'heyreach':
-      validateHeyreach({
-        payload,
-        providerBinding: input.providerBinding,
-        fields,
-      });
-      break;
-    case 'theirstack':
-      validateTheirstack({
-        payload,
-        providerBinding: input.providerBinding,
-        fields,
-      });
-      break;
-    case 'deepline_native':
-      validateDeeplineNative({
-        payload,
-        providerBinding: input.providerBinding,
-        fields,
-      });
-      break;
-  }
-
-  const uniqueFields = Array.from(new Set(fields));
-  if (uniqueFields.length > 0) {
-    return {
-      ok: false,
-      status: 409,
-      code: 'provider_callback_binding_mismatch',
-      message:
-        'Callback payload provider identifiers do not match the authenticated Deepline monitor binding.',
-      fields: uniqueFields,
-    };
-  }
-
-  const eventId = providerEventId({
-    provider: input.provider,
-    headers: input.headers,
-    payload,
-  });
-  const idempotencyKey = monitorEventIdempotencyKey({
-    provider: input.provider,
-    monitorKey: input.monitorKey,
-    sourceCapability: input.sourceCapability,
-    upstreamWebhookId: upstreamWebhookId(input.providerBinding),
-    providerEventId: eventId,
-  });
-
-  return {
-    ok: true,
-    event: {
-      providerEventId: eventId,
-      idempotencyKey,
-      payload,
-      verification: {
-        mode: input.authenticity.mode,
-        ...(input.authenticity.residualRisk
-          ? { residual_risk: input.authenticity.residualRisk }
-          : {}),
-        provider_event_id: eventId,
-        idempotency_key: idempotencyKey,
-        binding_fields: uniqueFields,
-      },
-    },
-  };
-}
-
-// Neon-free provider event id: derives a stable per-event id from ONLY what is on
-// the wire (headers + parsed payload). Used by the thin inbound receiver to
-// compute a publish idempotency key BEFORE any Neon binding lookup. Same
-// derivation the binding validator uses downstream, so the publish-side dedupe
-// grain matches the consumer-side dedupe grain exactly.
-export function providerCallbackWireEventId(input: {
-  provider: string;
-  headers: Headers;
-  payload: Record<string, unknown>;
-}): string {
-  return providerEventId(input);
-}
-
-export function redactedProviderCallbackHeaders(headers: Headers) {
-  const normalized = lowerCaseHeaders(headers);
-  const result: Record<string, string> = {};
-  for (const [key, value] of normalized) {
-    if (SENSITIVE_HEADER_NAMES.has(key)) continue;
-    if (!PROVENANCE_HEADER_NAMES.has(key)) continue;
-    result[key] = value;
-  }
-  return result;
-}
-
-export function providerCallbackProvenance(input: {
-  headers: Headers;
-  verification: ProviderCallbackEventContext['verification'];
-  monitorTool?: string | null;
-  runtimeAction?: string | null;
-}) {
-  return {
-    callback_route: 'provider_webhook_monitor_callback',
-    ...(input.monitorTool ? { monitor_tool: input.monitorTool } : {}),
-    ...(input.runtimeAction ? { runtime_action: input.runtimeAction } : {}),
-    verification: input.verification,
-    headers: redactedProviderCallbackHeaders(input.headers),
-  };
-}
-
-export function providerUsesRequiredSignature(provider: string) {
-  return SIGNED_PROVIDERS.has(provider);
-}