hooklatch 0.0.0-stage → 1.0.0

package/dist/diagnostics/catalog.js

@@ -0,0 +1,335 @@
+const VERIFICATION_GUIDANCE = {
+    'missing-signature': {
+        summary: 'The provider signature header was not present in the request.',
+        possibleCauses: [
+            'A proxy, load balancer, or middleware stripped the signature header.',
+            'The request was not actually sent by the provider.',
+            'The request was modified in transit.',
+        ],
+        suggestions: [
+            'Check that no intermediary removes the signature header.',
+            'Verify the request originates from the provider documented IP ranges.',
+            'Compare expected header names with your middleware configuration.',
+        ],
+    },
+    'malformed-signature': {
+        summary: 'Required signing headers were malformed or conflicted.',
+        possibleCauses: [
+            'The header value was truncated or altered by an intermediary.',
+            'The provider changed its header format.',
+            'The request was not actually sent by the provider.',
+        ],
+        suggestions: [
+            'Compare the raw header value against the provider documentation.',
+            'Check for header-combining proxies that may merge or split values.',
+            'Use synthetic requests to compare header grammar without recording sensitive values.',
+        ],
+    },
+    'unsupported-scheme': {
+        summary: 'Only unsupported or legacy signature schemes were present.',
+        possibleCauses: [
+            'The provider sent a legacy signature format (e.g. SHA-1).',
+            'The signature scheme version is not supported by this release.',
+            'The request was not actually sent by the provider.',
+        ],
+        suggestions: [
+            'Check the provider documentation for supported signature schemes.',
+            'Ensure the provider is configured to send the current scheme version.',
+            'Update the SDK when a new scheme is required.',
+        ],
+    },
+    'invalid-signature': {
+        summary: 'The signature was well-formed but did not authenticate.',
+        possibleCauses: [
+            'The configured secret does not match the provider endpoint secret.',
+            'A secret rotation is in progress and the old secret is still active at the provider.',
+            'The body was modified in transit, compressed, or re-serialized.',
+            'The wrong provider was selected for this request.',
+            'The request was not actually sent by the provider.',
+        ],
+        suggestions: [
+            'Verify the configured secret matches the provider endpoint secret.',
+            'Check whether a secret rotation is in progress and include all active secrets.',
+            'Ensure the raw body is captured before any JSON parsing or re-serialization.',
+            'Confirm the correct provider is selected for this endpoint.',
+        ],
+    },
+    'missing-identity': {
+        summary: 'A required identity metadata header was absent.',
+        possibleCauses: [
+            'The request was not actually sent by the provider.',
+            'An intermediary stripped the header.',
+            'The provider changed its header format.',
+        ],
+        suggestions: [
+            'Compare the incoming headers with the provider documentation.',
+            'Check that no proxy or middleware removes the header.',
+            'Verify the request originates from the provider.',
+        ],
+    },
+    'missing-timestamp': {
+        summary: 'A required signed timestamp header was absent.',
+        possibleCauses: [
+            'The request was not actually sent by the provider.',
+            'An intermediary stripped the header.',
+            'The provider changed its header format.',
+        ],
+        suggestions: [
+            'Compare the incoming headers with the provider documentation.',
+            'Check that no proxy or middleware removes the header.',
+            'Verify the request originates from the provider.',
+        ],
+    },
+    'timestamp-expired': {
+        summary: 'The signed timestamp is older than the configured tolerance.',
+        possibleCauses: [
+            'The request is a replay of an older delivery.',
+            'Clock skew exists between the provider and this host.',
+            'The body was delayed by a queue or retry mechanism.',
+        ],
+        suggestions: [
+            'Check clock synchronization between provider and host.',
+            'Review provider delivery timing before changing the configured tolerance.',
+            'Investigate whether the request is a replay attack.',
+        ],
+    },
+    'timestamp-future': {
+        summary: 'The signed timestamp is newer than the configured tolerance.',
+        possibleCauses: [
+            'Clock skew exists between the provider and this host.',
+            'The provider clock is ahead of this host.',
+        ],
+        suggestions: [
+            'Check clock synchronization between provider and host.',
+            'Review provider clock behavior before changing the configured tolerance.',
+        ],
+    },
+    'body-too-large': {
+        summary: 'The request body exceeded the configured size limit.',
+        possibleCauses: [
+            'The legitimate payload exceeds the configured maxBodyBytes.',
+            'The body was inflated by compression middleware.',
+            'A malicious or malformed request sent an oversized body.',
+        ],
+        suggestions: [
+            'Increase maxBodyBytes if the provider legitimately sends larger payloads.',
+            'Check for compression middleware that may inflate the body.',
+            'Reject the request if the size is unexpected for this provider.',
+        ],
+    },
+};
+/** Static guidance for setup/runtime error codes. */
+const SETUP_GUIDANCE = {
+    'unknown-provider': {
+        summary: 'The specified provider is not supported.',
+        possibleCauses: [
+            'The provider name contains a typo.',
+            'The provider has not been added to the SDK yet.',
+        ],
+        suggestions: [
+            'Check the provider name against the supported list.',
+            'Update the SDK to a version that supports the provider.',
+        ],
+    },
+    'missing-secrets': {
+        summary: 'No signing secrets were configured.',
+        possibleCauses: [
+            'The secrets option was omitted.',
+            'The secrets array was empty.',
+        ],
+        suggestions: [
+            'Provide at least one active signing secret.',
+            'Load secrets from environment variables or a secrets manager.',
+        ],
+    },
+    'invalid-secret': {
+        summary: 'A configured secret failed validation.',
+        possibleCauses: [
+            'The secret is empty or contains only whitespace.',
+            'The secret format does not match the provider requirements.',
+            'The secret was copied incorrectly from the provider dashboard.',
+        ],
+        suggestions: [
+            'Verify the secret matches the provider documentation format.',
+            'Check for trailing whitespace or newline characters.',
+            'Regenerate the secret at the provider if necessary.',
+        ],
+    },
+    'invalid-options': {
+        summary: 'The verification options were malformed.',
+        possibleCauses: [
+            'toleranceSeconds is negative or non-finite.',
+            'maxBodyBytes is not a positive safe integer.',
+            'The now function is not callable.',
+        ],
+        suggestions: [
+            'Check toleranceSeconds is a non-negative finite number.',
+            'Check maxBodyBytes is a positive safe integer.',
+            'Check that now is a function returning epoch seconds.',
+        ],
+    },
+    'invalid-input': {
+        summary: 'The request or header input was malformed.',
+        possibleCauses: [
+            'The header input was not a Headers, tuple list, or record.',
+            'A header value contained illegal characters.',
+            'The input object was null or undefined.',
+        ],
+        suggestions: [
+            'Ensure headers are provided as a Headers, tuple list, or plain record.',
+            'Check for null or undefined header values.',
+            'Validate header input before calling verify.',
+        ],
+    },
+    'body-consumed': {
+        summary: 'The Request body was already read before verification.',
+        possibleCauses: [
+            'A middleware or handler read the body before calling verifyRequest.',
+            'The same Request object was processed twice.',
+        ],
+        suggestions: [
+            'Call verifyRequest before any other body reads.',
+            'Use createVerifier with captured raw bytes for multi-stage processing.',
+            'Clone the Request if multiple consumers need the body.',
+        ],
+    },
+    'body-read-failed': {
+        summary: 'The request body stream could not be read.',
+        possibleCauses: [
+            'The client disconnected mid-body.',
+            'A platform streaming error occurred.',
+            'The body was locked by another consumer.',
+        ],
+        suggestions: [
+            'Check client connection stability.',
+            'Retry the request if the failure is transient.',
+            'Inspect platform logs for streaming errors.',
+        ],
+    },
+    'crypto-unavailable': {
+        summary: 'Web Crypto is not available in this environment.',
+        possibleCauses: [
+            'The runtime does not provide globalThis.crypto.subtle.',
+            'The environment is not Node 22+ or a compatible Workers runtime.',
+        ],
+        suggestions: [
+            'Ensure the runtime is Node 22+ or a Workers-compatible environment.',
+            'Check that crypto.subtle is available at global scope.',
+            'Update the runtime if it is below the minimum supported version.',
+        ],
+    },
+    'internal': {
+        summary: 'An unexpected internal error occurred.',
+        possibleCauses: [
+            'An unhandled exception in the verification pipeline.',
+            'A platform-specific failure in cryptographic operations.',
+        ],
+        suggestions: [
+            'Report this issue with the SDK version and runtime details.',
+            'Retry the request if the failure may be transient.',
+            'Check for known issues in the SDK release notes.',
+        ],
+    },
+};
+const PROVIDER_DETAIL = {
+    vercel: {
+        expectedHeaders: ['x-vercel-signature'],
+        grammar: 'Exactly 40 hexadecimal digits encoding HMAC-SHA1 over exact raw body bytes; no timestamp or identity extraction.',
+    },
+    fal: {
+        expectedHeaders: ['x-fal-webhook-signature', 'x-fal-webhook-request-id', 'x-fal-webhook-user-id', 'x-fal-webhook-timestamp'],
+        grammar: 'Exactly 128 hexadecimal signature digits; visible ASCII request and user IDs excluding commas; canonical nonnegative integer seconds. Ed25519 authenticates request ID, user ID, timestamp and the lowercase SHA256 raw-body digest. Static trusted raw public keys and exact expected user ID are required.',
+    },
+    stripe: {
+        expectedHeaders: ['Stripe-Signature'],
+        grammar: 'Comma-separated key=value pairs: t=<unix-seconds>,v1=<hex-signature>[,v1=<hex-signature>]',
+    },
+    github: {
+        expectedHeaders: ['X-Hub-Signature-256'],
+        grammar: 'sha256=<64 hexadecimal digits; letter case is ignored>',
+    },
+    shopify: {
+        expectedHeaders: ['X-Shopify-Hmac-Sha256'],
+        grammar: 'Canonical Base64-encoded HMAC-SHA256 signature',
+    },
+    'standard-webhooks': {
+        expectedHeaders: ['webhook-id', 'webhook-timestamp', 'webhook-signature'],
+        grammar: 'Space-delimited list of v1,<base64-signature> tokens',
+    },
+    clerk: {
+        expectedHeaders: ['svix-id', 'svix-timestamp', 'svix-signature'],
+        grammar: 'Space-delimited list of v1,<base64-signature> tokens',
+    },
+    svix: {
+        expectedHeaders: ['svix-id', 'svix-timestamp', 'svix-signature', 'webhook-id', 'webhook-timestamp', 'webhook-signature'],
+        grammar: 'Space-delimited list of v1,<base64-signature> tokens (branded or canonical family)',
+    },
+    razorpay: {
+        expectedHeaders: ['X-Razorpay-Signature'],
+        grammar: 'A single 64-digit hexadecimal HMAC-SHA256 signature over the raw body',
+    },
+    paddle: {
+        expectedHeaders: ['Paddle-Signature'],
+        grammar: 'Semicolon-separated ts=<unix-seconds>;h1=<64 hexadecimal digits>, with repeated h1 allowed',
+    },
+    'lemon-squeezy': {
+        expectedHeaders: ['X-Signature'],
+        grammar: 'A single 64-digit hexadecimal HMAC-SHA256 signature over the raw body',
+    },
+    'dodo-payments': {
+        expectedHeaders: ['webhook-id', 'webhook-timestamp', 'webhook-signature'],
+        grammar: 'Space-delimited list of v1,<base64-signature> tokens over id.timestamp.body',
+    },
+    gitlab: {
+        expectedHeaders: ['webhook-id', 'webhook-timestamp', 'webhook-signature'],
+        grammar: 'Signing-token mode: space-delimited v1,<base64-signature> tokens; no X-Gitlab-Token fallback',
+    },
+    replicate: {
+        expectedHeaders: ['webhook-id', 'webhook-timestamp', 'webhook-signature'],
+        grammar: 'Space-delimited list of v1,<base64-signature> tokens over id.timestamp.body',
+    },
+    workos: {
+        expectedHeaders: ['WorkOS-Signature'],
+        grammar: 'Comma-separated t=<unix-milliseconds>,v1=<64 hexadecimal digits>; one t, repeated valid v1 allowed',
+    },
+    sentry: {
+        expectedHeaders: ['Sentry-Hook-Signature'],
+        grammar: 'Sentry App mode: a single bare 64-digit hexadecimal HMAC-SHA256 signature over the raw body',
+    },
+    doppler: {
+        expectedHeaders: ['X-Doppler-Signature'],
+        grammar: 'Signed mode: sha256=<64 hexadecimal digits> over the raw body; no Basic/Bearer fallback',
+    },
+    linear: {
+        expectedHeaders: ['Linear-Signature'],
+        grammar: 'A single bare 64-digit hexadecimal HMAC-SHA256 signature over exact raw body bytes. Signature authentication only: body claims are not extracted and unsigned header timestamps do not establish freshness.',
+    },
+    sanity: {
+        expectedHeaders: ['sanity-webhook-signature'],
+        grammar: 'Exactly t=<unix-milliseconds>,v1=<43 canonical unpadded Base64url characters>; one of each field, no whitespace',
+    },
+    grafana: {
+        expectedHeaders: [],
+        grammar: 'Configured signature header: 64 hexadecimal digits. Body mode signs raw bytes; timestamped mode also requires the configured timestamp header with canonical Unix seconds and signs timestamp:body.',
+    },
+    polar: {
+        expectedHeaders: ['webhook-id', 'webhook-timestamp', 'webhook-signature'],
+        grammar: 'Space-delimited v1,<base64-signature> tokens over id.timestamp.body; current or legacy secretMode is trusted application configuration, never detected from a request.',
+    },
+};
+export function getVerificationGuidance(reason) {
+    return VERIFICATION_GUIDANCE[reason];
+}
+export function getSetupGuidance(code) {
+    return SETUP_GUIDANCE[code];
+}
+export function getProviderDetail(provider) {
+    return PROVIDER_DETAIL[provider];
+}
+export function isVerificationCode(code) {
+    return typeof code === 'string' && Object.hasOwn(VERIFICATION_GUIDANCE, code);
+}
+export function isSetupCode(code) {
+    return typeof code === 'string' && Object.hasOwn(SETUP_GUIDANCE, code);
+}
+//# sourceMappingURL=catalog.js.map

package/dist/diagnostics/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/diagnostics/catalog.ts"],"names":[],"mappings":"AAUA,MAAM,qBAAqB,GAA0D;IACnF,mBAAmB,EAAE;QACnB,OAAO,EAAE,+DAA+D;QACxE,cAAc,EAAE;YACd,sEAAsE;YACtE,oDAAoD;YACpD,sCAAsC;SACvC;QACD,WAAW,EAAE;YACX,0DAA0D;YAC1D,uEAAuE;YACvE,mEAAmE;SACpE;KACF;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE,wDAAwD;QACjE,cAAc,EAAE;YACd,+DAA+D;YAC/D,yCAAyC;YACzC,oDAAoD;SACrD;QACD,WAAW,EAAE;YACX,kEAAkE;YAClE,oEAAoE;YACpE,sFAAsF;SACvF;KACF;IACD,oBAAoB,EAAE;QACpB,OAAO,EAAE,4DAA4D;QACrE,cAAc,EAAE;YACd,2DAA2D;YAC3D,gEAAgE;YAChE,oDAAoD;SACrD;QACD,WAAW,EAAE;YACX,mEAAmE;YACnE,uEAAuE;YACvE,+CAA+C;SAChD;KACF;IACD,mBAAmB,EAAE;QACnB,OAAO,EAAE,yDAAyD;QAClE,cAAc,EAAE;YACd,oEAAoE;YACpE,sFAAsF;YACtF,iEAAiE;YACjE,mDAAmD;YACnD,oDAAoD;SACrD;QACD,WAAW,EAAE;YACX,oEAAoE;YACpE,gFAAgF;YAChF,8EAA8E;YAC9E,6DAA6D;SAC9D;KACF;IACD,kBAAkB,EAAE;QAClB,OAAO,EAAE,iDAAiD;QAC1D,cAAc,EAAE;YACd,oDAAoD;YACpD,sCAAsC;YACtC,yCAAyC;SAC1C;QACD,WAAW,EAAE;YACX,+DAA+D;YAC/D,uDAAuD;YACvD,kDAAkD;SACnD;KACF;IACD,mBAAmB,EAAE;QACnB,OAAO,EAAE,gDAAgD;QACzD,cAAc,EAAE;YACd,oDAAoD;YACpD,sCAAsC;YACtC,yCAAyC;SAC1C;QACD,WAAW,EAAE;YACX,+DAA+D;YAC/D,uDAAuD;YACvD,kDAAkD;SACnD;KACF;IACD,mBAAmB,EAAE;QACnB,OAAO,EAAE,8DAA8D;QACvE,cAAc,EAAE;YACd,+CAA+C;YAC/C,uDAAuD;YACvD,qDAAqD;SACtD;QACD,WAAW,EAAE;YACX,wDAAwD;YACxD,2EAA2E;YAC3E,qDAAqD;SACtD;KACF;IACD,kBAAkB,EAAE;QAClB,OAAO,EAAE,8DAA8D;QACvE,cAAc,EAAE;YACd,uDAAuD;YACvD,2CAA2C;SAC5C;QACD,WAAW,EAAE;YACX,wDAAwD;YACxD,0EAA0E;SAC3E;KACF;IACD,gBAAgB,EAAE;QAChB,OAAO,EAAE,sDAAsD;QAC/D,cAAc,EAAE;YACd,6DAA6D;YAC7D,kDAAkD;YAClD,0DAA0D;SAC3D;QACD,WAAW,EAAE;YACX,2EAA2E;YAC3E,6DAA6D;YAC7D,iEAAiE;SAClE;KACF;CACF,CAAC;AAEF,qDAAqD;AACrD,MAAM,cAAc,GAAmD;IACrE,kBAAkB,EAAE;QAClB,OAAO,EAAE,0CAA0C;QACnD,cAAc,EAAE;YACd,oCAAoC;YACpC,iDAAiD;SAClD;QACD,WAAW,EAAE;YACX,qDAAqD;YACrD,yDAAyD;SAC1D;KACF;IACD,iBAAiB,EAAE;QACjB,OAAO,EAAE,qCAAqC;QAC9C,cAAc,EAAE;YACd,iCAAiC;YACjC,8BAA8B;SAC/B;QACD,WAAW,EAAE;YACX,6CAA6C;YAC7C,+DAA+D;SAChE;KACF;IACD,gBAAgB,EAAE;QAChB,OAAO,EAAE,wCAAwC;QACjD,cAAc,EAAE;YACd,kDAAkD;YAClD,6DAA6D;YAC7D,gEAAgE;SACjE;QACD,WAAW,EAAE;YACX,8DAA8D;YAC9D,sDAAsD;YACtD,qDAAqD;SACtD;KACF;IACD,iBAAiB,EAAE;QACjB,OAAO,EAAE,0CAA0C;QACnD,cAAc,EAAE;YACd,6CAA6C;YAC7C,8CAA8C;YAC9C,mCAAmC;SACpC;QACD,WAAW,EAAE;YACX,yDAAyD;YACzD,gDAAgD;YAChD,uDAAuD;SACxD;KACF;IACD,eAAe,EAAE;QACf,OAAO,EAAE,4CAA4C;QACrD,cAAc,EAAE;YACd,4DAA4D;YAC5D,8CAA8C;YAC9C,yCAAyC;SAC1C;QACD,WAAW,EAAE;YACX,wEAAwE;YACxE,4CAA4C;YAC5C,8CAA8C;SAC/C;KACF;IACD,eAAe,EAAE;QACf,OAAO,EAAE,wDAAwD;QACjE,cAAc,EAAE;YACd,qEAAqE;YACrE,8CAA8C;SAC/C;QACD,WAAW,EAAE;YACX,iDAAiD;YACjD,wEAAwE;YACxE,wDAAwD;SACzD;KACF;IACD,kBAAkB,EAAE;QAClB,OAAO,EAAE,4CAA4C;QACrD,cAAc,EAAE;YACd,mCAAmC;YACnC,sCAAsC;YACtC,0CAA0C;SAC3C;QACD,WAAW,EAAE;YACX,oCAAoC;YACpC,gDAAgD;YAChD,6CAA6C;SAC9C;KACF;IACD,oBAAoB,EAAE;QACpB,OAAO,EAAE,kDAAkD;QAC3D,cAAc,EAAE;YACd,wDAAwD;YACxD,kEAAkE;SACnE;QACD,WAAW,EAAE;YACX,qEAAqE;YACrE,wDAAwD;YACxD,kEAAkE;SACnE;KACF;IACD,UAAU,EAAE;QACV,OAAO,EAAE,wCAAwC;QACjD,cAAc,EAAE;YACd,sDAAsD;YACtD,0DAA0D;SAC3D;QACD,WAAW,EAAE;YACX,6DAA6D;YAC7D,oDAAoD;YACpD,kDAAkD;SACnD;KACF;CACF,CAAC;AAQF,MAAM,eAAe,GAA+C;IAClE,MAAM,EAAE;QACN,eAAe,EAAE,CAAC,oBAAoB,CAAC;QACvC,OAAO,EAAE,kHAAkH;KAC5H;IACD,GAAG,EAAE;QACH,eAAe,EAAE,CAAC,yBAAyB,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,yBAAyB,CAAC;QAC5H,OAAO,EAAE,8SAA8S;KACxT;IACD,MAAM,EAAE;QACN,eAAe,EAAE,CAAC,kBAAkB,CAAC;QACrC,OAAO,EAAE,2FAA2F;KACrG;IACD,MAAM,EAAE;QACN,eAAe,EAAE,CAAC,qBAAqB,CAAC;QACxC,OAAO,EAAE,wDAAwD;KAClE;IACD,OAAO,EAAE;QACP,eAAe,EAAE,CAAC,uBAAuB,CAAC;QAC1C,OAAO,EAAE,gDAAgD;KAC1D;IACD,mBAAmB,EAAE;QACnB,eAAe,EAAE,CAAC,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,CAAC;QACzE,OAAO,EAAE,sDAAsD;KAChE;IACD,KAAK,EAAE;QACL,eAAe,EAAE,CAAC,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC;QAChE,OAAO,EAAE,sDAAsD;KAChE;IACD,IAAI,EAAE;QACJ,eAAe,EAAE,CAAC,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,CAAC;QACxH,OAAO,EAAE,oFAAoF;KAC9F;IACD,QAAQ,EAAE;QACR,eAAe,EAAE,CAAC,sBAAsB,CAAC;QACzC,OAAO,EAAE,uEAAuE;KACjF;IACD,MAAM,EAAE;QACN,eAAe,EAAE,CAAC,kBAAkB,CAAC;QACrC,OAAO,EAAE,4FAA4F;KACtG;IACD,eAAe,EAAE;QACf,eAAe,EAAE,CAAC,aAAa,CAAC;QAChC,OAAO,EAAE,uEAAuE;KACjF;IACD,eAAe,EAAE;QACf,eAAe,EAAE,CAAC,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,CAAC;QACzE,OAAO,EAAE,6EAA6E;KACvF;IACD,MAAM,EAAE;QACN,eAAe,EAAE,CAAC,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,CAAC;QACzE,OAAO,EAAE,8FAA8F;KACxG;IACD,SAAS,EAAE;QACT,eAAe,EAAE,CAAC,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,CAAC;QACzE,OAAO,EAAE,6EAA6E;KACvF;IACD,MAAM,EAAE;QACN,eAAe,EAAE,CAAC,kBAAkB,CAAC;QACrC,OAAO,EAAE,oGAAoG;KAC9G;IACD,MAAM,EAAE;QACN,eAAe,EAAE,CAAC,uBAAuB,CAAC;QAC1C,OAAO,EAAE,6FAA6F;KACvG;IACD,OAAO,EAAE;QACP,eAAe,EAAE,CAAC,qBAAqB,CAAC;QACxC,OAAO,EAAE,yFAAyF;KACnG;IACD,MAAM,EAAE;QACN,eAAe,EAAE,CAAC,kBAAkB,CAAC;QACrC,OAAO,EAAE,6MAA6M;KACvN;IACD,MAAM,EAAE;QACN,eAAe,EAAE,CAAC,0BAA0B,CAAC;QAC7C,OAAO,EAAE,iHAAiH;KAC3H;IACD,OAAO,EAAE;QACP,eAAe,EAAE,EAAE;QACnB,OAAO,EAAE,qMAAqM;KAC/M;IACD,KAAK,EAAE;QACL,eAAe,EAAE,CAAC,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,CAAC;QACzE,OAAO,EAAE,wKAAwK;KAClL;CACF,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,MAAiC;IACvE,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAwB;IACvD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAkB;IAClD,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAoB;IACrD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAoB;IAC9C,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;AACzE,CAAC"}

package/dist/diagnostics/index.d.ts

@@ -0,0 +1,6 @@
+import { HooklatchError } from '../errors.js';
+import type { VerificationFailure } from '../types.js';
+import type { Diagnostic, DiagnosticOptions } from './types.js';
+export declare function diagnose(input: VerificationFailure | HooklatchError, options?: DiagnosticOptions): Diagnostic;
+export type { Diagnostic, DiagnosticOptions, DiagnosticCode } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/diagnostics/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/diagnostics/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,KAAK,EAAY,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAkB,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAsHhF,wBAAgB,QAAQ,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,UAAU,CAO7G;AAED,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC"}

package/dist/diagnostics/index.js

@@ -0,0 +1,88 @@
+import { HooklatchError } from '../errors.js';
+import { SUPPORTED_PROVIDERS } from '../providers/index.js';
+import { getProviderDetail, getSetupGuidance, getVerificationGuidance, isVerificationCode, isSetupCode, } from './catalog.js';
+function isRecord(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === null || prototype === Object.prototype;
+}
+function isProvider(value) {
+    return typeof value === 'string' && SUPPORTED_PROVIDERS.some((provider) => provider === value);
+}
+function isBoolean(value) { return typeof value === 'boolean'; }
+function validateProvider(provider) {
+    if (provider === undefined)
+        return undefined;
+    if (isProvider(provider)) {
+        return provider;
+    }
+    throw new HooklatchError('invalid-input', 'Invalid provider name.');
+}
+function normalizeOptions(options) {
+    if (!isRecord(options) || (options.verbose !== undefined && !isBoolean(options.verbose))) {
+        throw new HooklatchError('invalid-input', 'Invalid diagnostic options.');
+    }
+    const provider = validateProvider(options.provider);
+    return provider !== undefined
+        ? { provider, verbose: options.verbose === true }
+        : { verbose: options.verbose === true };
+}
+function buildDiagnostic(code, kind, guidance, provider, detail) {
+    const result = {
+        code,
+        kind,
+        summary: guidance.summary,
+        possibleCauses: [...guidance.possibleCauses],
+        suggestions: [...guidance.suggestions],
+    };
+    if (provider !== undefined) {
+        Object.assign(result, { provider });
+    }
+    if (detail !== undefined) {
+        Object.assign(result, { detail: { expectedHeaders: [...detail.expectedHeaders], grammar: detail.grammar } });
+    }
+    return result;
+}
+function diagnoseValidated(input, options) {
+    if (input instanceof HooklatchError) {
+        const code = input.code;
+        if (!isSetupCode(code))
+            throw new HooklatchError('invalid-input', 'Invalid diagnostic input.');
+        const normalized = options !== undefined ? normalizeOptions(options) : undefined;
+        const provider = normalized?.provider;
+        const verbose = normalized?.verbose;
+        const guidance = getSetupGuidance(code);
+        if (guidance === undefined) {
+            throw new HooklatchError('invalid-input', 'Invalid diagnostic input.');
+        }
+        const detail = provider !== undefined && verbose === true ? getProviderDetail(provider) : undefined;
+        return buildDiagnostic(code, 'setup', guidance, provider, detail);
+    }
+    if (!isRecord(input)) {
+        throw new HooklatchError('invalid-input', 'Invalid diagnostic input.');
+    }
+    const { ok, reason: code, provider: failureProvider } = input;
+    if (ok !== false || !isVerificationCode(code) || !isProvider(failureProvider)) {
+        throw new HooklatchError('invalid-input', 'Invalid diagnostic input.');
+    }
+    const normalized = options !== undefined ? normalizeOptions(options) : undefined;
+    if (normalized?.provider !== undefined && normalized.provider !== failureProvider) {
+        throw new HooklatchError('invalid-input', 'Provider mismatch.');
+    }
+    const provider = failureProvider ?? normalized?.provider;
+    const verbose = normalized?.verbose;
+    const guidance = getVerificationGuidance(code);
+    const detail = provider !== undefined && verbose === true ? getProviderDetail(provider) : undefined;
+    return buildDiagnostic(code, 'verification', guidance, provider, detail);
+}
+export function diagnose(input, options) {
+    try {
+        return diagnoseValidated(input, options);
+    }
+    catch {
+        // Untrusted accessors/proxies may throw; their messages must not escape.
+        throw new HooklatchError('invalid-input', 'Invalid diagnostic input.');
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/diagnostics/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/diagnostics/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAG5D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,uBAAuB,EACvB,kBAAkB,EAClB,WAAW,GACZ,MAAM,cAAc,CAAC;AAItB,SAAS,QAAQ,CAAC,KAAuB;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAE/C,OAAO,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,KAAe;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,IAAsB,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC;AAE3F,SAAS,gBAAgB,CAAC,QAA8B;IACtD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE7C,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,gBAAgB,CAAC,OAA0B;IAClD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEpD,OAAO,QAAQ,KAAK,SAAS;QAC3B,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE;QACjD,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,eAAe,CACtB,IAAoB,EACpB,IAA8B,EAC9B,QAA2H,EAC3H,QAA8B,EAC9B,MAA6F;IAE7F,MAAM,MAAM,GAAe;QACzB,IAAI;QACJ,IAAI;QACJ,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,cAAc,EAAE,CAAC,GAAG,QAAQ,CAAC,cAAc,CAAC;QAC5C,WAAW,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC;KACvC,CAAC;IAEF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC/G,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CACxB,KAA2C,EAC3C,OAA2B;IAE3B,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QAExB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;QAC/F,MAAM,UAAU,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,MAAM,QAAQ,GAAG,UAAU,EAAE,QAAQ,CAAC;QACtC,MAAM,OAAO,GAAG,UAAU,EAAE,OAAO,CAAC;QACpC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAExC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEpG,OAAO,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IAE9D,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjF,IAAI,UAAU,EAAE,QAAQ,KAAK,SAAS,IAAI,UAAU,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;QAClF,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,IAAI,UAAU,EAAE,QAAQ,CAAC;IACzD,MAAM,OAAO,GAAG,UAAU,EAAE,OAAO,CAAC;IACpC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpG,OAAO,eAAe,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAA2C,EAAE,OAA2B;IAC/F,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IACzE,CAAC;AACH,CAAC"}

package/dist/diagnostics/types.d.ts

@@ -0,0 +1,21 @@
+import type { HooklatchErrorCode, Provider, VerificationFailureReason } from '../types.js';
+/** Stable diagnostic codes; guidance text is intended for people. */
+export type DiagnosticCode = VerificationFailureReason | HooklatchErrorCode;
+export interface DiagnosticOptions {
+    readonly provider?: Provider;
+    readonly verbose?: boolean;
+}
+/** Only allowlisted guidance and validated provider names enter this output. */
+export interface Diagnostic {
+    readonly code: DiagnosticCode;
+    readonly kind: 'verification' | 'setup';
+    readonly provider?: Provider;
+    readonly summary: string;
+    readonly possibleCauses: readonly string[];
+    readonly suggestions: readonly string[];
+    readonly detail?: {
+        readonly expectedHeaders: readonly string[];
+        readonly grammar: string;
+    };
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/diagnostics/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/diagnostics/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE3F,qEAAqE;AACrE,MAAM,MAAM,cAAc,GAAG,yBAAyB,GAAG,kBAAkB,CAAC;AAE5E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,gFAAgF;AAChF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH"}

package/dist/diagnostics/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/diagnostics/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/diagnostics/types.ts"],"names":[],"mappings":""}

package/dist/errors.d.ts

@@ -0,0 +1,7 @@
+import type { HooklatchErrorCode } from './types.js';
+/** Operational error. Messages deliberately exclude request and credential data. */
+export declare class HooklatchError extends Error {
+    readonly code: HooklatchErrorCode;
+    constructor(code: HooklatchErrorCode, message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,oFAAoF;AACpF,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;gBACtB,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM;CAKtD"}

package/dist/errors.js

@@ -0,0 +1,10 @@
+/** Operational error. Messages deliberately exclude request and credential data. */
+export class HooklatchError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'HooklatchError';
+        this.code = code;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAEA,oFAAoF;AACpF,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,IAAI,CAAqB;IAClC,YAAY,IAAwB,EAAE,OAAe;QACnD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { verify, verifyRequest, createVerifier } from './core.js';
+export { HooklatchError } from './errors.js';
+export type { Provider, HeaderInput, WebhookRequest, VerifyOptions, FalVerifyOptions, GrafanaOptions, PolarOptions, IdentityField, EventIdentity, VerificationFailureReason, VerificationSuccess, VerificationFailure, VerificationResult, HooklatchErrorCode, FailureDetails, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,YAAY,EACV,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAClI,yBAAyB,EAAE,mBAAmB,EAAE,mBAAmB,EACnE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,GACvD,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export { verify, verifyRequest, createVerifier } from './core.js';
+export { HooklatchError } from './errors.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC"}

package/dist/internal/body.d.ts

@@ -0,0 +1,3 @@
+/** null means size limit exceeded. Reads actual chunks, not trusted length claims. */
+export declare function readBody(request: Request, maxBodyBytes: number): Promise<Uint8Array | null>;
+//# sourceMappingURL=body.d.ts.map

package/dist/internal/body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body.d.ts","sourceRoot":"","sources":["../../src/internal/body.ts"],"names":[],"mappings":"AAEA,sFAAsF;AACtF,wBAAsB,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA0CjG"}

package/dist/internal/body.js

@@ -0,0 +1,48 @@
+import { HooklatchError } from '../errors.js';
+/** null means size limit exceeded. Reads actual chunks, not trusted length claims. */
+export async function readBody(request, maxBodyBytes) {
+    if (request.bodyUsed || request.body?.locked)
+        throw new HooklatchError('body-consumed', 'Request body has already been consumed.');
+    if (!request.body)
+        return new Uint8Array();
+    let reader;
+    try {
+        reader = request.body.getReader();
+    }
+    catch {
+        throw new HooklatchError('body-read-failed', 'Unable to read request body.');
+    }
+    // Bound bookkeeping as well as byte storage: a chunk array can grow very
+    // large even for a tiny body, and spreading it exceeds JS argument limits.
+    let output = new Uint8Array(Math.min(maxBodyBytes, 8192));
+    let size = 0;
+    try {
+        while (true) {
+            const chunk = await reader.read();
+            if (chunk.done)
+                break;
+            if (!(chunk.value instanceof Uint8Array))
+                throw new Error('Invalid byte stream');
+            size += chunk.value.byteLength;
+            if (size > maxBodyBytes) {
+                // Cancellation must not hold the response hostage to a stalled producer.
+                void reader.cancel().catch(() => undefined);
+                return null;
+            }
+            if (size > output.byteLength) {
+                const grown = new Uint8Array(Math.min(maxBodyBytes, Math.max(size, output.byteLength * 2)));
+                grown.set(output);
+                output = grown;
+            }
+            output.set(chunk.value, size - chunk.value.byteLength);
+        }
+        return output.slice(0, size);
+    }
+    catch {
+        throw new HooklatchError('body-read-failed', 'Unable to read request body.');
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+//# sourceMappingURL=body.js.map

package/dist/internal/body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body.js","sourceRoot":"","sources":["../../src/internal/body.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAgB,EAAE,YAAoB;IACnE,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,MAAM;QAAE,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,yCAAyC,CAAC,CAAC;IAEnI,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,OAAO,IAAI,UAAU,EAAE,CAAC;IAC3C,IAAI,MAA+C,CAAC;IAEpD,IAAI,CAAC;QAAC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IAAC,CAAC;IAC1C,MAAM,CAAC;QAAC,MAAM,IAAI,cAAc,CAAC,kBAAkB,EAAE,8BAA8B,CAAC,CAAC;IAAC,CAAC;IAEvF,yEAAyE;IACzE,2EAA2E;IAC3E,IAAI,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1D,IAAI,IAAI,GAAG,CAAC,CAAC;IAEb,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAElC,IAAI,KAAK,CAAC,IAAI;gBAAE,MAAM;YAEtB,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY,UAAU,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACjF,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YAE/B,IAAI,IAAI,GAAG,YAAY,EAAE,CAAC;gBACxB,yEAAyE;gBACzE,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAE5C,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,IAAI,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5F,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAClB,MAAM,GAAG,KAAK,CAAC;YACjB,CAAC;YAED,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,cAAc,CAAC,kBAAkB,EAAE,8BAA8B,CAAC,CAAC;IAAC,CAAC;YACjF,CAAC;QAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAAC,CAAC;AACnC,CAAC"}

package/dist/internal/bytes.d.ts

@@ -0,0 +1,5 @@
+export declare function utf8(value: string): Uint8Array;
+export declare function concatBytes(...chunks: Uint8Array[]): Uint8Array;
+export declare function decodeHex(value: string): Uint8Array | null;
+export declare function decodeBase64(value: string): Uint8Array | null;
+//# sourceMappingURL=bytes.d.ts.map

package/dist/internal/bytes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bytes.d.ts","sourceRoot":"","sources":["../../src/internal/bytes.ts"],"names":[],"mappings":"AAAA,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAA4C;AAE3F,wBAAgB,WAAW,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,CAO/D;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAO1D;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAgB7D"}