hooklatch 0.0.0-stage → 1.0.0

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEvH,SAAS,IAAI;IACX,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAEhC,OAAO;IACT,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QAC5C,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAEnC,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACrE,IAAI,QAAQ,CAAC;IAEb,IAAI,CAAC;QACH,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAgC,CAAC;QAC7F,MAAM,QAAQ,GAAG,KAAK,YAAY,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAEhE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACrC,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAE5B,OAAO;IACT,CAAC;IAED,IAAI,eAAgC,CAAC;IAErC,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC/B,eAAe,GAAG,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe;YAC9F,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,eAAe,GAAG,OAAO,CAAC,eAAe,KAAK,SAAS;YACrD,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;YAChE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;IAC/G,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAErF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC,CAAC;QAE7D,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,uBAAuB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC9D,kBAAkB,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC;QAC3F,MAAM,QAAQ,GAAG,KAAK,YAAY,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAEhE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACrC,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAE5B,OAAO;IACT,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,QAAQ,CAAC,YAAY,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED,IAAI,CAAC;IACH,IAAI,EAAE,CAAC;AACT,CAAC;AAAC,MAAM,CAAC;IACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC5C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC"}

package/dist/cli/templates.d.ts

@@ -0,0 +1,13 @@
+import type { ProviderCliOptions } from './args.js';
+export type TemplateOptions = {
+    readonly secretEnv: string;
+    readonly bodyLimit: number;
+    readonly providerOptions?: ProviderCliOptions;
+} | {
+    readonly publicKeyEnv: string;
+    readonly expectedUserEnv: string;
+    readonly bodyLimit: number;
+    readonly providerOptions?: ProviderCliOptions;
+};
+export declare function renderTemplate(provider: string, framework: string, options: TemplateOptions): string;
+//# sourceMappingURL=templates.d.ts.map

package/dist/cli/templates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/cli/templates.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAEpD,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAA;CAAE,GACzG;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAEnJ,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,MAAM,CA4BpG"}

package/dist/cli/templates.js

@@ -0,0 +1,297 @@
+export function renderTemplate(provider, framework, options) {
+    const hasPublicKey = 'publicKeyEnv' in options;
+    const hasSecret = 'secretEnv' in options;
+    // Enforce credential correlation: fal must use public-key options, non-fal must use HMAC options.
+    if (provider === 'fal') {
+        if (!hasPublicKey || hasSecret) {
+            throw new Error('Fal templates require publicKeyEnv and expectedUserEnv, not secretEnv.');
+        }
+        return falTemplate(provider, framework, options.publicKeyEnv, options.expectedUserEnv, options.bodyLimit);
+    }
+    if (hasPublicKey) {
+        throw new Error('Non-fal providers must use secretEnv, not publicKeyEnv/expectedUserEnv.');
+    }
+    const { secretEnv, bodyLimit, providerOptions } = options;
+    if (framework === 'express')
+        return expressTemplate(provider, secretEnv, bodyLimit, providerOptions);
+    if (framework === 'nextjs')
+        return nextjsTemplate(provider, secretEnv, bodyLimit, providerOptions);
+    if (framework === 'hono')
+        return honoTemplate(provider, secretEnv, bodyLimit, providerOptions);
+    if (framework === 'cloudflare')
+        return cloudflareTemplate(provider, secretEnv, bodyLimit, providerOptions);
+    throw new Error('Unsupported framework.');
+}
+function expressTemplate(provider, secretEnv, bodyLimit, providerOptions) {
+    const identifier = provider.replaceAll('-', '_');
+    const providerOptionsLine = renderProviderOptionsLine(providerOptions, '  ');
+    return `import { createWebhookMiddleware } from 'hooklatch/express';
+import type { VerifyOptions } from 'hooklatch';
+
+// Synthetic placeholder: set ${secretEnv} in your environment before deployment.
+const options: VerifyOptions = {
+  provider: '${provider}',
+  secrets: [process.env.${secretEnv}!],
+  maxBodyBytes: ${bodyLimit},
+${providerOptionsLine}};
+
+// Mount this middleware before any body parser (express.json, urlencoded, etc.).
+export const ${identifier}ExpressWebhook = createWebhookMiddleware(options);
+
+// Example mounting:
+// app.post('/webhooks/${provider}', ${identifier}ExpressWebhook, (req, res) => {
+//   const verified = req.webhook;
+//   res.status(200).json({ received: true, bytes: verified?.rawBody.byteLength ?? 0 });
+// });
+`;
+}
+function nextjsTemplate(provider, secretEnv, bodyLimit, providerOptions) {
+    const providerOptionsLine = renderProviderOptionsLine(providerOptions, '  ');
+    return `import { createWebhookHandler } from 'hooklatch/nextjs';
+import type { VerifyOptions } from 'hooklatch';
+
+const options: VerifyOptions = {
+  provider: '${provider}',
+  secrets: [process.env.${secretEnv}!],
+  maxBodyBytes: ${bodyLimit},
+${providerOptionsLine}};
+
+export const POST = createWebhookHandler({
+  ...options,
+  handler: (_request, success) => {
+    // Verify first, then parse/validate success.rawBody in your own schema.
+    return Response.json({ received: true, bytes: success.rawBody.byteLength });
+  },
+});
+`;
+}
+function honoTemplate(provider, secretEnv, bodyLimit, providerOptions) {
+    const identifier = provider.replaceAll('-', '_');
+    const providerOptionsLine = renderProviderOptionsLine(providerOptions, '  ');
+    return `import { Hono } from 'hono';
+import { createWebhookMiddleware, type WebhookVariables } from 'hooklatch/hono';
+import type { VerifyOptions } from 'hooklatch';
+
+const options: VerifyOptions = {
+  provider: '${provider}',
+  secrets: [process.env.${secretEnv}!],
+  maxBodyBytes: ${bodyLimit},
+${providerOptionsLine}};
+
+export const ${identifier}HonoWebhook = createWebhookMiddleware(options);
+
+// Mount manually:
+// const app = new Hono<{ Variables: WebhookVariables }>();
+// app.post('/webhooks/${provider}', ${identifier}HonoWebhook, (c) => {
+//   const verified = c.get('webhook');
+//   return c.json({ received: true, bytes: verified.rawBody.byteLength });
+// });
+`;
+}
+function cloudflareTemplate(provider, secretEnv, bodyLimit, providerOptions) {
+    const providerOptionsLine = renderProviderOptionsLine(providerOptions, '    ');
+    return `import { createWebhookHandler } from 'hooklatch/cloudflare';
+import type { VerifyOptions } from 'hooklatch';
+
+interface Env {
+  ${secretEnv}: string;
+}
+
+export const fetch = createWebhookHandler<Env>({
+  options: (env) => ({
+    provider: '${provider}',
+    secrets: [env.${secretEnv}],
+    maxBodyBytes: ${bodyLimit},
+${providerOptionsLine}  }),
+  handler: (_request, _env, _ctx, success) => {
+    // Verify first, then parse/validate success.rawBody in your own schema.
+    return Response.json({ received: true, bytes: success.rawBody.byteLength });
+  },
+});
+
+export default { fetch };
+`;
+}
+function falDecoder() {
+    return `function decodePublicKeys(value: string | undefined): Uint8Array[] {
+  if (value === undefined || value.length === 0) throw new Error('Invalid public-key configuration.');
+
+  const entries = value.split(',');
+
+  if (entries.length > 16) throw new Error('Invalid public-key configuration.');
+
+  return entries.map((entry) => {
+    if (!/^[A-Za-z0-9_-]{43}$/.test(entry)) throw new Error('Invalid public-key configuration.');
+
+    const base64 = entry.replace(/-/g, '+').replace(/_/g, '/') + '=';
+    let binary: string;
+
+    try {
+      binary = atob(base64);
+    } catch {
+      throw new Error('Invalid public-key configuration.');
+    }
+
+    if (binary.length !== 32 || btoa(binary) !== base64) throw new Error('Invalid public-key configuration.');
+
+    const bytes = new Uint8Array(32);
+
+    for (let i = 0; i < bytes.length; i++) bytes[i] = binary.charCodeAt(i);
+
+    return bytes;
+  });
+}`;
+}
+function falTemplate(provider, framework, publicKeyEnv, expectedUserEnv, bodyLimit) {
+    const identifier = provider.replaceAll('-', '_');
+    if (framework === 'express') {
+        return `import { createWebhookMiddleware } from 'hooklatch/express';
+import type { VerifyOptions } from 'hooklatch';
+
+// Synthetic placeholder: set ${publicKeyEnv} and ${expectedUserEnv} in your
+// environment before deployment. Keys are comma-separated canonical Base64url
+// (no padding), each decoding to exactly 32 bytes, 1 to 16 entries.
+
+${falDecoder()}
+
+const options: VerifyOptions = {
+  provider: '${provider}',
+  publicKeys: decodePublicKeys(process.env.${publicKeyEnv}!),
+  expectedUserId: process.env.${expectedUserEnv}!,
+  maxBodyBytes: ${bodyLimit},
+};
+
+// Mount this middleware before any body parser (express.json, urlencoded, etc.).
+export const ${identifier}ExpressWebhook = createWebhookMiddleware(options);
+
+// Example mounting:
+// app.post('/webhooks/${provider}', ${identifier}ExpressWebhook, (req, res) => {
+//   const verified = req.webhook;
+//   res.status(200).json({ received: true, bytes: verified?.rawBody.byteLength ?? 0 });
+// });
+`;
+    }
+    if (framework === 'nextjs') {
+        return `import { createWebhookHandler } from 'hooklatch/nextjs';
+import type { VerifyOptions } from 'hooklatch';
+
+${falDecoder()}
+
+const options: VerifyOptions = {
+  provider: '${provider}',
+  publicKeys: decodePublicKeys(process.env.${publicKeyEnv}!),
+  expectedUserId: process.env.${expectedUserEnv}!,
+  maxBodyBytes: ${bodyLimit},
+};
+
+export const POST = createWebhookHandler({
+  ...options,
+  handler: (_request, success) => {
+    // Verify first, then parse/validate success.rawBody in your own schema.
+    return Response.json({ received: true, bytes: success.rawBody.byteLength });
+  },
+});
+`;
+    }
+    if (framework === 'hono') {
+        return `import { Hono } from 'hono';
+import { createWebhookMiddleware, type WebhookVariables } from 'hooklatch/hono';
+import type { VerifyOptions } from 'hooklatch';
+
+${falDecoder()}
+
+const options: VerifyOptions = {
+  provider: '${provider}',
+  publicKeys: decodePublicKeys(process.env.${publicKeyEnv}!),
+  expectedUserId: process.env.${expectedUserEnv}!,
+  maxBodyBytes: ${bodyLimit},
+};
+
+export const ${identifier}HonoWebhook = createWebhookMiddleware(options);
+
+// Mount manually:
+// const app = new Hono<{ Variables: WebhookVariables }>();
+// app.post('/webhooks/${provider}', ${identifier}HonoWebhook, (c) => {
+//   const verified = c.get('webhook');
+//   return c.json({ received: true, bytes: verified.rawBody.byteLength });
+// });
+`;
+    }
+    if (framework === 'cloudflare') {
+        return `import { createWebhookHandler } from 'hooklatch/cloudflare';
+import type { VerifyOptions } from 'hooklatch';
+
+interface Env {
+  ${publicKeyEnv}: string;
+  ${expectedUserEnv}: string;
+}
+
+${falDecoder()}
+
+export const fetch = createWebhookHandler<Env>({
+  options: (env) => ({
+    provider: '${provider}',
+    publicKeys: decodePublicKeys(env.${publicKeyEnv}),
+    expectedUserId: env.${expectedUserEnv},
+    maxBodyBytes: ${bodyLimit},
+  }),
+  handler: (_request, _env, _ctx, success) => {
+    // Verify first, then parse/validate success.rawBody in your own schema.
+    return Response.json({ received: true, bytes: success.rawBody.byteLength });
+  },
+});
+
+export default { fetch };
+`;
+    }
+    throw new Error('Unsupported framework.');
+}
+/**
+ * Render one `providerOptions` property line, or nothing for providers without
+ * typed configuration. Existing provider output stays byte-identical.
+ */
+function renderProviderOptionsLine(providerOptions, indent) {
+    if (providerOptions === undefined)
+        return '';
+    if (providerOptions.provider === 'grafana') {
+        const { mode, signatureHeader, timestampHeader } = providerOptions.options;
+        const entries = [`mode: ${quoteStringLiteral(mode)}`];
+        if (signatureHeader !== undefined)
+            entries.push(`signatureHeader: ${quoteStringLiteral(signatureHeader)}`);
+        if (timestampHeader !== undefined)
+            entries.push(`timestampHeader: ${quoteStringLiteral(timestampHeader)}`);
+        return `${indent}providerOptions: { ${entries.join(', ')} },\n`;
+    }
+    if (providerOptions.provider === 'polar') {
+        return `${indent}providerOptions: { secretMode: ${quoteStringLiteral(providerOptions.options.secretMode)} },\n`;
+    }
+    return '';
+}
+/**
+ * Serialize a configuration value as a double-quoted TypeScript string. Header
+ * names are RFC 9110 tokens, but escaping is still explicit so accepted values
+ * such as apostrophes and backticks cannot change generated syntax.
+ */
+function quoteStringLiteral(value) {
+    let literal = '"';
+    for (const character of value) {
+        const code = character.charCodeAt(0);
+        if (character === '\\')
+            literal += '\\\\';
+        else if (character === '"')
+            literal += '\\"';
+        else if (character === '\n')
+            literal += '\\n';
+        else if (character === '\r')
+            literal += '\\r';
+        else if (character === '\t')
+            literal += '\\t';
+        else if (code < 0x20 || code === 0x7f || character === '\u2028' || character === '\u2029') {
+            literal += `\\u${code.toString(16).padStart(4, '0')}`;
+        }
+        else
+            literal += character;
+    }
+    return `${literal}"`;
+}
+//# sourceMappingURL=templates.js.map

package/dist/cli/templates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../src/cli/templates.ts"],"names":[],"mappings":"AAMA,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,SAAiB,EAAE,OAAwB;IAC1F,MAAM,YAAY,GAAG,cAAc,IAAI,OAAO,CAAC;IAC/C,MAAM,SAAS,GAAG,WAAW,IAAI,OAAO,CAAC;IAEzC,kGAAkG;IAClG,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,YAAY,IAAI,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAC5F,CAAC;QAED,OAAO,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5G,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;IAE1D,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAErG,IAAI,SAAS,KAAK,QAAQ;QAAE,OAAO,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAEnG,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAE/F,IAAI,SAAS,KAAK,YAAY;QAAE,OAAO,kBAAkB,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAE3G,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,eAAe,CACtB,QAAgB,EAChB,SAAiB,EACjB,SAAiB,EACjB,eAA+C;IAE/C,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAEjD,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAE7E,OAAO;;;gCAGuB,SAAS;;eAE1B,QAAQ;0BACG,SAAS;kBACjB,SAAS;EACzB,mBAAmB;;;eAGN,UAAU;;;yBAGA,QAAQ,MAAM,UAAU;;;;CAIhD,CAAC;AACF,CAAC;AAED,SAAS,cAAc,CACrB,QAAgB,EAChB,SAAiB,EACjB,SAAiB,EACjB,eAA+C;IAE/C,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAE7E,OAAO;;;;eAIM,QAAQ;0BACG,SAAS;kBACjB,SAAS;EACzB,mBAAmB;;;;;;;;;CASpB,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CACnB,QAAgB,EAChB,SAAiB,EACjB,SAAiB,EACjB,eAA+C;IAE/C,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAEjD,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAE7E,OAAO;;;;;eAKM,QAAQ;0BACG,SAAS;kBACjB,SAAS;EACzB,mBAAmB;;eAEN,UAAU;;;;yBAIA,QAAQ,MAAM,UAAU;;;;CAIhD,CAAC;AACF,CAAC;AAED,SAAS,kBAAkB,CACzB,QAAgB,EAChB,SAAiB,EACjB,SAAiB,EACjB,eAA+C;IAE/C,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAE/E,OAAO;;;;IAIL,SAAS;;;;;iBAKI,QAAQ;oBACL,SAAS;oBACT,SAAS;EAC3B,mBAAmB;;;;;;;;CAQpB,CAAC;AACF,CAAC;AAED,SAAS,UAAU;IACjB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2BP,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,SAAiB,EAAE,YAAoB,EAAE,eAAuB,EAAE,SAAiB;IACxH,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAEjD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;;;gCAGqB,YAAY,QAAQ,eAAe;;;;EAIjE,UAAU,EAAE;;;eAGC,QAAQ;6CACsB,YAAY;gCACzB,eAAe;kBAC7B,SAAS;;;;eAIZ,UAAU;;;yBAGA,QAAQ,MAAM,UAAU;;;;CAIhD,CAAC;IACA,CAAC;IAED,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO;;;EAGT,UAAU,EAAE;;;eAGC,QAAQ;6CACsB,YAAY;gCACzB,eAAe;kBAC7B,SAAS;;;;;;;;;;CAU1B,CAAC;IACA,CAAC;IAED,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO;;;;EAIT,UAAU,EAAE;;;eAGC,QAAQ;6CACsB,YAAY;gCACzB,eAAe;kBAC7B,SAAS;;;eAGZ,UAAU;;;;yBAIA,QAAQ,MAAM,UAAU;;;;CAIhD,CAAC;IACA,CAAC;IAED,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,OAAO;;;;IAIP,YAAY;IACZ,eAAe;;;EAGjB,UAAU,EAAE;;;;iBAIG,QAAQ;uCACc,YAAY;0BACzB,eAAe;oBACrB,SAAS;;;;;;;;;CAS5B,CAAC;IACA,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAC5C,CAAC;AAGD;;;GAGG;AACH,SAAS,yBAAyB,CAAC,eAA+C,EAAE,MAAc;IAChG,IAAI,eAAe,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAE7C,IAAI,eAAe,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,eAAe,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC;QAC3E,MAAM,OAAO,GAAG,CAAC,SAAS,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEtD,IAAI,eAAe,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,kBAAkB,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAE3G,IAAI,eAAe,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,kBAAkB,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAE3G,OAAO,GAAG,MAAM,sBAAsB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;IAClE,CAAC;IAED,IAAI,eAAe,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzC,OAAO,GAAG,MAAM,kCAAkC,kBAAkB,CAAC,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IAClH,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,OAAO,GAAG,GAAG,CAAC;IAElB,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAErC,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,IAAI,MAAM,CAAC;aACrC,IAAI,SAAS,KAAK,GAAG;YAAE,OAAO,IAAI,KAAK,CAAC;aACxC,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,IAAI,KAAK,CAAC;aACzC,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,IAAI,KAAK,CAAC;aACzC,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,IAAI,KAAK,CAAC;aACzC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC1F,OAAO,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QACxD,CAAC;;YAAM,OAAO,IAAI,SAAS,CAAC;IAC9B,CAAC;IAED,OAAO,GAAG,OAAO,GAAG,CAAC;AACvB,CAAC"}

package/dist/core.d.ts

@@ -0,0 +1,6 @@
+import type { VerificationResult, VerifyOptions, WebhookRequest } from './types.js';
+export declare function verify(request: WebhookRequest, options: VerifyOptions): Promise<VerificationResult>;
+export declare function createVerifier(options: VerifyOptions): (request: WebhookRequest) => Promise<VerificationResult>;
+/** Consumes the original Request once. Successful callers use result.rawBody. */
+export declare function verifyRequest(request: Request, options: VerifyOptions): Promise<VerificationResult>;
+//# sourceMappingURL=core.d.ts.map

package/dist/core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAMpF,wBAAsB,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAEzG;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,aAAa,GAAG,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAI/G;AAED,iFAAiF;AACjF,wBAAsB,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAYzG"}

package/dist/core.js

@@ -0,0 +1,26 @@
+import { HooklatchError } from './errors.js';
+import { prepareVerification } from './internal/prepare.js';
+import { normalizeHeaders } from './internal/headers.js';
+import { readBody } from './internal/body.js';
+import { failure, readClock, verifyPrepared } from './internal/verification.js';
+export async function verify(request, options) {
+    return verifyPrepared(request, prepareVerification(options));
+}
+export function createVerifier(options) {
+    const prepared = prepareVerification(options);
+    return (request) => verifyPrepared(request, prepared);
+}
+/** Consumes the original Request once. Successful callers use result.rawBody. */
+export async function verifyRequest(request, options) {
+    const prepared = prepareVerification(options);
+    const receivedAt = readClock(prepared);
+    if (!(request instanceof Request))
+        throw new HooklatchError('invalid-input', 'A Web Request is required.');
+    const headers = normalizeHeaders(request.headers);
+    const rawBody = await readBody(request, prepared.options.maxBodyBytes);
+    if (rawBody === null)
+        return failure(prepared, 'body-too-large', 'Request body exceeds the configured limit.');
+    // Normalize to tuples so byte and header snapshots share the raw-input path.
+    return verifyPrepared({ rawBody, headers: [...headers] }, prepared, receivedAt);
+}
+//# sourceMappingURL=core.js.map

package/dist/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEhF,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAuB,EAAE,OAAsB;IAC1E,OAAO,cAAc,CAAC,OAAO,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAsB;IACnD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAE9C,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,OAAsB;IAC1E,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAEvC,IAAI,CAAC,CAAC,OAAO,YAAY,OAAO,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,4BAA4B,CAAC,CAAC;IAC3G,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAEvE,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,QAAQ,EAAE,gBAAgB,EAAE,4CAA4C,CAAC,CAAC;IAE/G,6EAA6E;IAC7E,OAAO,cAAc,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;AAClF,CAAC"}

package/dist/diagnostics/catalog.d.ts

@@ -0,0 +1,20 @@
+import type { HooklatchErrorCode, Provider, VerificationFailureReason } from '../types.js';
+import type { DiagnosticCode } from './types.js';
+/** Static guidance for verification failure reasons. */
+interface Guidance {
+    readonly summary: string;
+    readonly possibleCauses: readonly string[];
+    readonly suggestions: readonly string[];
+}
+/** Provider-specific verbose detail: expected headers and grammar. */
+interface ProviderDetail {
+    readonly expectedHeaders: readonly string[];
+    readonly grammar: string;
+}
+export declare function getVerificationGuidance(reason: VerificationFailureReason): Guidance;
+export declare function getSetupGuidance(code: HooklatchErrorCode): Guidance;
+export declare function getProviderDetail(provider: Provider): ProviderDetail | undefined;
+export declare function isVerificationCode(code: DiagnosticCode): code is VerificationFailureReason;
+export declare function isSetupCode(code: DiagnosticCode): code is HooklatchErrorCode;
+export {};
+//# sourceMappingURL=catalog.d.ts.map

package/dist/diagnostics/catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/diagnostics/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,wDAAwD;AACxD,UAAU,QAAQ;IAChB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AA6OD,sEAAsE;AACtE,UAAU,cAAc;IACtB,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAyFD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,yBAAyB,GAAG,QAAQ,CAEnF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,kBAAkB,GAAG,QAAQ,CAEnE;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,GAAG,SAAS,CAEhF;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,IAAI,yBAAyB,CAE1F;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,IAAI,kBAAkB,CAE5E"}