eslint-plugin-webhook-safety 0.0.0-stage → 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,9 @@
+# Changelog
+
+## 0.1.0 (2026-10-22)
+
+- Rules: `require-raw-body`, `require-signature-verification`, `require-idempotency`, `bullmq-require-job-id`.
+- Configs: `recommended`, `strict`, `legacy-recommended`, `legacy-strict`.
+- Tested on 8 open-source apps (Stripe/BullMQ users). False positives fixed before release:
+  - `require-signature-verification` ignores authenticated endpoints (e.g. CRUD APIs that manage webhook subscriptions).
+  - `require-idempotency` ignores verify-and-return wrappers that return the event to the caller.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Krrish Kumar
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,73 @@
-# Temporary Holding Version
+# eslint-plugin-webhook-safety
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[![CI](https://github.com/Krrishkumar125/eslint-plugin-webhook-safety/actions/workflows/ci.yml/badge.svg)](https://github.com/Krrishkumar125/eslint-plugin-webhook-safety/actions/workflows/ci.yml)
+
+ESLint rules that catch the Stripe webhook bugs that only show up in production:
+
+- the body was parsed before the signature check, so every event fails;
+- the signature is never checked;
+- duplicate deliveries are processed twice;
+- retries enqueue the same BullMQ job twice.
+
+The static half of [webhook-crash-lab](https://github.com/Krrishkumar125/webhook-crash-lab).
+This plugin finds the bug in your editor, and crash-lab proves the fix against a running server.
+
+## 60-second start
+
+```sh
+npm i -D eslint eslint-plugin-webhook-safety
+```
+
+```js
+// eslint.config.js
+import webhookSafety from 'eslint-plugin-webhook-safety';
+
+export default [
+  webhookSafety.configs.recommended, // or .strict
+];
+```
+
+```js
+// server.js
+app.use(express.json());
+app.post('/webhooks/stripe', async (req, res) => {
+  const event = stripe.webhooks.constructEvent(req.body, sig, secret);
+  await emailQueue.add('receipt', { to: event.data.object.customer_email });
+});
+```
+
+```text
+$ npx eslint server.js
+  3:1  error    `app.use(express.json())` on line 1 runs before this webhook route and parses the body ...  webhook-safety/require-raw-body
+  4:17 warning  Stripe retries and duplicates webhook deliveries, but this handler never uses `event.id` ...   webhook-safety/require-idempotency
+  5:9  warning  Webhook deliveries are retried, so this queue.add() will enqueue the same work twice ...      webhook-safety/bullmq-require-job-id
+```
+
+## Rules
+
+| Rule                                                                           | What it catches                                                            | recommended | strict | 💡  |
+| ------------------------------------------------------------------------------ | -------------------------------------------------------------------------- | ----------- | ------ | --- |
+| [require-raw-body](docs/rules/require-raw-body.md)                             | `express.json()` / `req.json()` / `JSON.stringify` before `constructEvent` | error       | error  | ✅  |
+| [require-signature-verification](docs/rules/require-signature-verification.md) | webhook route or Next.js `POST` with no signature check                    | error       | error  |     |
+| [require-idempotency](docs/rules/require-idempotency.md)                       | `constructEvent` result whose `event.id` is never used for dedupe          | warn        | error  |     |
+| [bullmq-require-job-id](docs/rules/bullmq-require-job-id.md)                   | `queue.add()` in a webhook handler without `jobId`                         | warn        | error  | ✅  |
+
+The rules are tuned for **low false positives**. When in doubt (custom middleware, the event passed to a
+helper, options passed as a variable) they stay quiet. Each rule doc lists exactly what triggers it.
+
+Supports Express, Hono, Fastify-style routers and the Next.js App Router, in JavaScript and TypeScript
+(use `typescript-eslint`'s parser as usual).
+
+### Legacy `.eslintrc` (ESLint 8)
+
+```json
+{ "extends": ["plugin:webhook-safety/legacy-recommended"] }
+```
+
+## Requirements
+
+ESLint ≥ 8.57 (flat config) and Node ≥ 20.
+
+## License
+
+MIT © Krrish Kumar

package/dist/index.cjs

@@ -0,0 +1,491 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }// src/utils.ts
+var REPO = "https://github.com/Krrishkumar125/eslint-plugin-webhook-safety";
+var docsUrl = (name) => `${REPO}/blob/main/docs/rules/${name}.md`;
+var WEBHOOK_PATH = /webhook|\/hooks?(?:\/|$)/i;
+var CONSTRUCT_EVENT = /* @__PURE__ */ new Set(["constructEvent", "constructEventAsync"]);
+var ROUTE_METHODS = /* @__PURE__ */ new Set(["post", "put", "all"]);
+function isFunction(node) {
+  return !!node && (node.type === "FunctionDeclaration" || node.type === "FunctionExpression" || node.type === "ArrowFunctionExpression");
+}
+function walk(root, visit) {
+  const stack = [root];
+  while (stack.length) {
+    const node = stack.pop();
+    visit(node);
+    for (const key of Object.keys(node)) {
+      if (key === "parent") continue;
+      const value = node[key];
+      const children = Array.isArray(value) ? value : [value];
+      for (const child of children) {
+        if (child && typeof child === "object" && typeof child.type === "string") {
+          stack.push(child);
+        }
+      }
+    }
+  }
+}
+function calleeName(node) {
+  const callee = node.callee;
+  if (callee.type === "Identifier") return callee.name;
+  if (callee.type === "MemberExpression" && !callee.computed && callee.property.type === "Identifier") {
+    return callee.property.name;
+  }
+  return void 0;
+}
+function memberCall(node) {
+  if (node.type !== "CallExpression") return void 0;
+  const callee = node.callee;
+  if (callee.type === "MemberExpression" && !callee.computed && callee.object.type === "Identifier" && callee.property.type === "Identifier") {
+    return [callee.object.name, callee.property.name];
+  }
+  return void 0;
+}
+var PARSER_OWNERS = /* @__PURE__ */ new Set(["express", "bodyParser", "bodyparser"]);
+function isJsonParser(node) {
+  const m = memberCall(node);
+  return !!m && PARSER_OWNERS.has(m[0]) && m[1] === "json";
+}
+function isRawParser(node) {
+  const m = memberCall(node);
+  return !!m && PARSER_OWNERS.has(m[0]) && (m[1] === "raw" || m[1] === "text");
+}
+function isBodyParser(node) {
+  const m = memberCall(node);
+  return !!m && PARSER_OWNERS.has(m[0]) && ["json", "raw", "text", "urlencoded"].includes(m[1]);
+}
+function isConstructEvent(node) {
+  if (node.type !== "CallExpression") return false;
+  const name = calleeName(node);
+  return !!name && CONSTRUCT_EVENT.has(name);
+}
+function findAll(root, test) {
+  const out = [];
+  walk(root, (n) => {
+    if (test(n)) out.push(n);
+  });
+  return out;
+}
+function enclosingFunction(node) {
+  let cur = node.parent;
+  while (cur) {
+    if (isFunction(cur)) return cur;
+    cur = cur.parent;
+  }
+  return void 0;
+}
+function literalString(node) {
+  if (!node) return void 0;
+  if (node.type === "Literal" && typeof node.value === "string") return node.value;
+  if (node.type === "TemplateLiteral" && node.expressions.length === 0) {
+    return _nullishCoalesce(_optionalChain([node, 'access', _ => _.quasis, 'access', _2 => _2[0], 'optionalAccess', _3 => _3.value, 'access', _4 => _4.cooked]), () => ( void 0));
+  }
+  return void 0;
+}
+function asRoute(node) {
+  if (node.type !== "CallExpression") return void 0;
+  const callee = node.callee;
+  if (callee.type !== "MemberExpression" || callee.computed || callee.property.type !== "Identifier") {
+    return void 0;
+  }
+  if (!ROUTE_METHODS.has(callee.property.name)) return void 0;
+  const args = node.arguments;
+  const path = literalString(args[0]);
+  const handler = args[args.length - 1];
+  if (path === void 0 || args.length < 2 || !isFunction(handler)) return void 0;
+  return {
+    call: node,
+    owner: callee.object.type === "Identifier" ? callee.object.name : void 0,
+    path,
+    middlewares: args.slice(1, -1),
+    handler
+  };
+}
+function isNextPostHandler(fn) {
+  const parent = fn.parent;
+  if (fn.type === "FunctionDeclaration") {
+    return _optionalChain([fn, 'access', _5 => _5.id, 'optionalAccess', _6 => _6.name]) === "POST" && _optionalChain([parent, 'optionalAccess', _7 => _7.type]) === "ExportNamedDeclaration";
+  }
+  if (_optionalChain([parent, 'optionalAccess', _8 => _8.type]) === "VariableDeclarator") {
+    return parent.id.type === "Identifier" && parent.id.name === "POST" && _optionalChain([parent, 'access', _9 => _9.parent, 'optionalAccess', _10 => _10.parent, 'optionalAccess', _11 => _11.type]) === "ExportNamedDeclaration";
+  }
+  return false;
+}
+function isWebhookFile(context) {
+  return WEBHOOK_PATH.test(context.filename.replace(/\\/g, "/"));
+}
+function eventBinding(call) {
+  let cur = call.parent;
+  if (_optionalChain([cur, 'optionalAccess', _12 => _12.type]) === "AwaitExpression") cur = cur.parent;
+  let target;
+  if (_optionalChain([cur, 'optionalAccess', _13 => _13.type]) === "VariableDeclarator") target = cur.id;
+  else if (_optionalChain([cur, 'optionalAccess', _14 => _14.type]) === "AssignmentExpression") target = cur.left;
+  if (!target) return void 0;
+  if (target.type === "Identifier") return { kind: "identifier", name: target.name };
+  if (target.type === "ObjectPattern") {
+    const hasId = target.properties.some(
+      (p) => p.type === "RestElement" || p.key.type === "Identifier" && p.key.name === "id" || p.key.type === "Literal" && p.key.value === "id"
+    );
+    return { kind: "pattern", hasId };
+  }
+  return void 0;
+}
+
+// src/rules/bullmq-require-job-id.ts
+var QUEUE_NAME = /queue$/i;
+var rule = {
+  meta: {
+    type: "problem",
+    hasSuggestions: true,
+    docs: {
+      description: "Require a jobId (or deduplication id) when a webhook handler adds a BullMQ job, so retried deliveries do not enqueue duplicates",
+      recommended: true,
+      url: docsUrl("bullmq-require-job-id")
+    },
+    schema: [],
+    messages: {
+      missing: "Webhook deliveries are retried, so this queue.add() will enqueue the same work twice. Pass a stable jobId such as the event id.",
+      addJobId: "Add { jobId: {{name}}.id }"
+    }
+  },
+  create(context) {
+    const webhookFile = isWebhookFile(context);
+    const queues = /* @__PURE__ */ new Set();
+    function isWebhookFunction(fn) {
+      const parent = fn.parent;
+      if (parent) {
+        const route = asRoute(parent);
+        if (route && route.handler === fn && WEBHOOK_PATH.test(route.path)) return true;
+      }
+      if (webhookFile && isNextPostHandler(fn)) return true;
+      return findAll(fn, isConstructEvent).some((c) => enclosingFunction(c) === fn);
+    }
+    function eventName(fn) {
+      for (const c of findAll(fn, isConstructEvent)) {
+        const b = eventBinding(c);
+        if (_optionalChain([b, 'optionalAccess', _15 => _15.kind]) === "identifier") return b.name;
+      }
+      return void 0;
+    }
+    function isQueue(obj) {
+      if (obj.type === "Identifier") return queues.has(obj.name) || QUEUE_NAME.test(obj.name);
+      return obj.type === "MemberExpression" && !obj.computed && obj.property.type === "Identifier" && QUEUE_NAME.test(obj.property.name);
+    }
+    return {
+      VariableDeclarator(node) {
+        if (node.id.type === "Identifier" && _optionalChain([node, 'access', _16 => _16.init, 'optionalAccess', _17 => _17.type]) === "NewExpression" && node.init.callee.type === "Identifier" && node.init.callee.name === "Queue") {
+          queues.add(node.id.name);
+        }
+      },
+      CallExpression(node) {
+        const callee = node.callee;
+        if (callee.type !== "MemberExpression" || callee.computed || callee.property.type !== "Identifier" || callee.property.name !== "add" || node.arguments.length < 2 || node.arguments.length > 3 || !isQueue(callee.object)) {
+          return;
+        }
+        const opts = node.arguments[2];
+        if (opts && opts.type !== "ObjectExpression") return;
+        if (_optionalChain([opts, 'optionalAccess', _18 => _18.type]) === "ObjectExpression" && opts.properties.some(
+          (p) => p.type === "SpreadElement" || p.key.type === "Identifier" && ["jobId", "deduplication"].includes(p.key.name)
+        )) {
+          return;
+        }
+        let fn = enclosingFunction(node);
+        let webhookFn;
+        while (fn) {
+          if (isWebhookFunction(fn)) {
+            webhookFn = fn;
+            break;
+          }
+          fn = enclosingFunction(fn);
+        }
+        if (!webhookFn) return;
+        const name = eventName(webhookFn);
+        const suggest = [];
+        if (name) {
+          const prop = `jobId: ${name}.id`;
+          suggest.push({
+            messageId: "addJobId",
+            data: { name },
+            fix: (fixer) => {
+              if (!opts)
+                return fixer.insertTextAfter(node.arguments[1], `, { ${prop} }`);
+              const obj = opts;
+              const last = obj.properties[obj.properties.length - 1];
+              return last ? fixer.insertTextAfter(last, `, ${prop}`) : fixer.replaceText(obj, `{ ${prop} }`);
+            }
+          });
+        }
+        context.report({ node, messageId: "missing", suggest });
+      }
+    };
+  }
+};
+var bullmq_require_job_id_default = rule;
+
+// src/rules/require-idempotency.ts
+var DEFAULT_HELPERS = /idempot|dedup|processed|alreadyHandled|seenEvent/i;
+var rule2 = {
+  meta: {
+    type: "suggestion",
+    docs: {
+      description: "Require a duplicate-event check (using event.id) before a webhook handler performs side effects",
+      recommended: true,
+      url: docsUrl("require-idempotency")
+    },
+    schema: [
+      {
+        type: "object",
+        properties: { idempotencyFunctions: { type: "array", items: { type: "string" } } },
+        additionalProperties: false
+      }
+    ],
+    messages: {
+      missing: "Stripe retries and duplicates webhook deliveries, but this handler never uses `{{name}}.id`. Record processed event ids (unique insert) and skip duplicates before side effects."
+    }
+  },
+  create(context) {
+    const helpers = new Set(
+      _nullishCoalesce(_optionalChain([context, 'access', _19 => _19.options, 'access', _20 => _20[0], 'optionalAccess', _21 => _21.idempotencyFunctions]), () => ( []))
+    );
+    return {
+      CallExpression(node) {
+        if (!isConstructEvent(node)) return;
+        const binding = eventBinding(node);
+        if (!binding) return;
+        if (binding.kind === "pattern") {
+          if (!binding.hasId)
+            context.report({ node, messageId: "missing", data: { name: "event" } });
+          return;
+        }
+        const fn = enclosingFunction(node);
+        if (!fn) return;
+        const name = binding.name;
+        let handled = false;
+        walk(fn, (n) => {
+          if (handled) return;
+          if (n.type === "MemberExpression" && n.object.type === "Identifier" && n.object.name === name && !n.computed && n.property.type === "Identifier" && n.property.name === "id") {
+            handled = true;
+          } else if (n.type === "ReturnStatement" && _optionalChain([n, 'access', _22 => _22.argument, 'optionalAccess', _23 => _23.type]) === "Identifier" && n.argument.name === name || n.type === "ArrowFunctionExpression" && n.body.type === "Identifier" && n.body.name === name) {
+            handled = true;
+          } else if (n.type === "CallExpression") {
+            const callee = calleeName(n);
+            if (callee && (helpers.has(callee) || DEFAULT_HELPERS.test(callee))) handled = true;
+            const isConsole = n.callee.type === "MemberExpression" && n.callee.object.type === "Identifier" && n.callee.object.name === "console";
+            if (!isConsole && n.arguments.some((a) => a.type === "Identifier" && a.name === name)) {
+              handled = true;
+            }
+          }
+        });
+        if (!handled) context.report({ node, messageId: "missing", data: { name } });
+      }
+    };
+  }
+};
+var require_idempotency_default = rule2;
+
+// src/rules/require-raw-body.ts
+var rule3 = {
+  meta: {
+    type: "problem",
+    hasSuggestions: true,
+    docs: {
+      description: "Require the raw request body for Stripe signature verification (no JSON parsing before constructEvent)",
+      recommended: true,
+      url: docsUrl("require-raw-body")
+    },
+    schema: [],
+    messages: {
+      jsonMiddleware: "express.json() parses the body before the Stripe signature check, so constructEvent will always fail. Use express.raw() on this route.",
+      globalJson: "`{{owner}}.use(express.json())` on line {{line}} runs before this webhook route and parses the body, so constructEvent will fail. Register the webhook route first or give it express.raw().",
+      parsedJson: "The body is parsed with .json() before the Stripe signature check. Read the raw body with .text() and pass it to constructEvent.",
+      stringified: "JSON.stringify() of a parsed body is not byte-identical to what Stripe signed. Pass the raw body string or Buffer.",
+      useRaw: "Replace with express.raw({ type: 'application/json' })",
+      useText: "Read the body with .text() instead"
+    }
+  },
+  create(context) {
+    const globalParsers = [];
+    function handlerVerifies(fn) {
+      return findAll(fn, isConstructEvent).length > 0;
+    }
+    return {
+      CallExpression(node) {
+        const n = node;
+        const callee = n.callee;
+        if (callee.type === "MemberExpression" && !callee.computed && callee.property.type === "Identifier" && callee.property.name === "use" && callee.object.type === "Identifier") {
+          const args = n.arguments;
+          const first = args[0];
+          const pathless = !(_optionalChain([first, 'optionalAccess', _24 => _24.type]) === "Literal" && first.value !== "/");
+          if (pathless && args.some(isJsonParser)) {
+            globalParsers.push({ owner: callee.object.name, node: n });
+          }
+        }
+        const route = asRoute(n);
+        if (route && handlerVerifies(route.handler)) {
+          const inlineJson = route.middlewares.filter(isJsonParser);
+          for (const mw of inlineJson) {
+            context.report({
+              node: mw,
+              messageId: "jsonMiddleware",
+              suggest: [
+                {
+                  messageId: "useRaw",
+                  fix: (fixer) => fixer.replaceText(mw, "express.raw({ type: 'application/json' })")
+                }
+              ]
+            });
+          }
+          if (!inlineJson.length && !route.middlewares.some(isRawParser)) {
+            const earlier = globalParsers.find(
+              (p) => p.owner === route.owner && (_nullishCoalesce(_optionalChain([p, 'access', _25 => _25.node, 'access', _26 => _26.range, 'optionalAccess', _27 => _27[0]]), () => ( 0))) < (_nullishCoalesce(_optionalChain([n, 'access', _28 => _28.range, 'optionalAccess', _29 => _29[0]]), () => ( 0)))
+            );
+            if (earlier) {
+              context.report({
+                node: n,
+                messageId: "globalJson",
+                data: { owner: earlier.owner, line: String(_optionalChain([earlier, 'access', _30 => _30.node, 'access', _31 => _31.loc, 'optionalAccess', _32 => _32.start, 'access', _33 => _33.line])) }
+              });
+            }
+          }
+        }
+        if (isConstructEvent(n)) {
+          const payload = n.arguments[0];
+          if (_optionalChain([payload, 'optionalAccess', _34 => _34.type]) === "CallExpression" && payload.callee.type === "MemberExpression" && payload.callee.object.type === "Identifier" && payload.callee.object.name === "JSON" && payload.callee.property.type === "Identifier" && payload.callee.property.name === "stringify") {
+            context.report({ node: payload, messageId: "stringified" });
+          }
+          const fn = enclosingFunction(n);
+          if (!fn) return;
+          const params = new Set(
+            fn.params.flatMap((p) => p.type === "Identifier" ? [p.name] : [])
+          );
+          const isRequest = (obj) => obj.type === "Identifier" && params.has(obj.name) || obj.type === "MemberExpression" && obj.object.type === "Identifier" && params.has(obj.object.name) && obj.property.type === "Identifier" && obj.property.name === "req";
+          walkSameFunction(fn, (c) => {
+            if (c.type === "CallExpression" && c.arguments.length === 0 && c.callee.type === "MemberExpression" && !c.callee.computed && c.callee.property.type === "Identifier" && c.callee.property.name === "json" && isRequest(c.callee.object) && (_nullishCoalesce(_optionalChain([c, 'access', _35 => _35.range, 'optionalAccess', _36 => _36[0]]), () => ( 0))) < (_nullishCoalesce(_optionalChain([n, 'access', _37 => _37.range, 'optionalAccess', _38 => _38[0]]), () => ( 0)))) {
+              const prop = c.callee.property;
+              context.report({
+                node: c,
+                messageId: "parsedJson",
+                suggest: [
+                  { messageId: "useText", fix: (fixer) => fixer.replaceText(prop, "text") }
+                ]
+              });
+            }
+          });
+        }
+      }
+    };
+  }
+};
+function walkSameFunction(fn, visit) {
+  const body = fn.body;
+  const stack = [body];
+  while (stack.length) {
+    const node = stack.pop();
+    visit(node);
+    for (const key of Object.keys(node)) {
+      if (key === "parent") continue;
+      const value = node[key];
+      for (const child of Array.isArray(value) ? value : [value]) {
+        if (child && typeof child === "object" && typeof child.type === "string") {
+          if (!isFunction(child)) stack.push(child);
+        }
+      }
+    }
+  }
+}
+var require_raw_body_default = rule3;
+
+// src/rules/require-signature-verification.ts
+var DEFAULT_VERIFY = /verif|signature|constructEvent|timingSafeEqual|unwrap/i;
+var AUTH_CALL = /auth|session|apiKey|permission|currentUser|requireUser/i;
+var rule4 = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Require webhook handlers to verify the request signature",
+      recommended: true,
+      url: docsUrl("require-signature-verification")
+    },
+    schema: [
+      {
+        type: "object",
+        properties: { verifyFunctions: { type: "array", items: { type: "string" } } },
+        additionalProperties: false
+      }
+    ],
+    messages: {
+      missing: "This webhook handler never verifies the request signature, so anyone can forge events. Call stripe.webhooks.constructEvent() (or your provider\u2019s verify function) before trusting the body."
+    }
+  },
+  create(context) {
+    const extra = new Set(
+      _nullishCoalesce(_optionalChain([context, 'access', _39 => _39.options, 'access', _40 => _40[0], 'optionalAccess', _41 => _41.verifyFunctions]), () => ( []))
+    );
+    const webhookFile = isWebhookFile(context);
+    function verifies(fn) {
+      let found = false;
+      walk(fn, (n) => {
+        if (found || n.type !== "CallExpression" && n.type !== "NewExpression") return;
+        const name = calleeName(n);
+        if (name && (extra.has(name) || DEFAULT_VERIFY.test(name) || AUTH_CALL.test(name)))
+          found = true;
+      });
+      return found;
+    }
+    function check(fn) {
+      if (!verifies(fn)) context.report({ node: fn, messageId: "missing" });
+    }
+    return {
+      CallExpression(node) {
+        const route = asRoute(node);
+        if (!route || !WEBHOOK_PATH.test(route.path)) return;
+        if (route.middlewares.some((m) => !isBodyParser(m))) return;
+        check(route.handler);
+      },
+      "FunctionDeclaration, FunctionExpression, ArrowFunctionExpression"(node) {
+        if (webhookFile && isNextPostHandler(node)) check(node);
+      }
+    };
+  }
+};
+var require_signature_verification_default = rule4;
+
+// src/index.ts
+var rules = {
+  "require-raw-body": require_raw_body_default,
+  "require-signature-verification": require_signature_verification_default,
+  "require-idempotency": require_idempotency_default,
+  "bullmq-require-job-id": bullmq_require_job_id_default
+};
+var recommendedRules = {
+  "webhook-safety/require-raw-body": "error",
+  "webhook-safety/require-signature-verification": "error",
+  "webhook-safety/require-idempotency": "warn",
+  "webhook-safety/bullmq-require-job-id": "warn"
+};
+var strictRules = Object.fromEntries(
+  Object.keys(recommendedRules).map((k) => [k, "error"])
+);
+var plugin = {
+  meta: { name: "eslint-plugin-webhook-safety", version: "0.1.0" },
+  rules,
+  configs: {}
+};
+plugin.configs.recommended = {
+  name: "webhook-safety/recommended",
+  plugins: { "webhook-safety": plugin },
+  rules: recommendedRules
+};
+plugin.configs.strict = {
+  name: "webhook-safety/strict",
+  plugins: { "webhook-safety": plugin },
+  rules: strictRules
+};
+plugin.configs["legacy-recommended"] = { plugins: ["webhook-safety"], rules: recommendedRules };
+plugin.configs["legacy-strict"] = { plugins: ["webhook-safety"], rules: strictRules };
+var index_default = plugin;
+
+
+exports.default = index_default;
+
+module.exports = exports.default;
+//# sourceMappingURL=index.cjs.map