hooklatch 0.0.0-stage → 1.0.0

package/dist/node/adapters/express.js

@@ -0,0 +1,3 @@
+import implementation from "../../cjs/adapters/express.cjs";
+
+export const createWebhookMiddleware = implementation.createWebhookMiddleware;

package/dist/node/adapters/hono.d.ts

@@ -0,0 +1 @@
+export * from "../../cjs/adapters/hono.cjs";

package/dist/node/adapters/hono.js

@@ -0,0 +1,3 @@
+import implementation from "../../cjs/adapters/hono.cjs";
+
+export const createWebhookMiddleware = implementation.createWebhookMiddleware;

package/dist/node/adapters/nextjs.d.ts

@@ -0,0 +1 @@
+export * from "../../cjs/adapters/nextjs.cjs";

package/dist/node/adapters/nextjs.js

@@ -0,0 +1,3 @@
+import implementation from "../../cjs/adapters/nextjs.cjs";
+
+export const createWebhookHandler = implementation.createWebhookHandler;

package/dist/node/diagnostics/index.d.ts

@@ -0,0 +1 @@
+export * from "../../cjs/diagnostics/index.cjs";

package/dist/node/diagnostics/index.js

@@ -0,0 +1,3 @@
+import implementation from "../../cjs/diagnostics/index.cjs";
+
+export const diagnose = implementation.diagnose;

package/dist/node/index.d.ts

@@ -0,0 +1 @@
+export * from "../cjs/index.cjs";

package/dist/node/index.js

@@ -0,0 +1,6 @@
+import implementation from "../cjs/index.cjs";
+
+export const HooklatchError = implementation.HooklatchError;
+export const createVerifier = implementation.createVerifier;
+export const verify = implementation.verify;
+export const verifyRequest = implementation.verifyRequest;

package/dist/providers/clerk.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Clerk delivers Standard Webhooks payloads through Svix and its official
+ * helper reads only the branded `svix-*` headers. Canonical `webhook-*`
+ * headers are deliberately ignored and never repair a missing or invalid
+ * branded field.
+ */
+export declare const clerkDescriptor: {
+    readonly provider: "clerk";
+} & Pick<import("../internal/provider.js").ProviderDescriptor, "decodeSecret" | "parse">;
+//# sourceMappingURL=clerk.d.ts.map

package/dist/providers/clerk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clerk.d.ts","sourceRoot":"","sources":["../../src/providers/clerk.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,eAAO,MAAM,eAAe;;wFAQ3B,CAAC"}

package/dist/providers/clerk.js

@@ -0,0 +1,13 @@
+import { createStandardWebhooksProtocol } from './standard-webhooks-protocol.js';
+/**
+ * Clerk delivers Standard Webhooks payloads through Svix and its official
+ * helper reads only the branded `svix-*` headers. Canonical `webhook-*`
+ * headers are deliberately ignored and never repair a missing or invalid
+ * branded field.
+ */
+export const clerkDescriptor = createStandardWebhooksProtocol('clerk', 'Clerk', {
+    id: 'svix-id',
+    timestamp: 'svix-timestamp',
+    signature: 'svix-signature',
+});
+//# sourceMappingURL=clerk.js.map

package/dist/providers/clerk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clerk.js","sourceRoot":"","sources":["../../src/providers/clerk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAEjF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,8BAA8B,CAC3D,OAAO,EACP,OAAO,EACP;IACE,EAAE,EAAE,SAAS;IACb,SAAS,EAAE,gBAAgB;IAC3B,SAAS,EAAE,gBAAgB;CAC5B,CACF,CAAC"}

package/dist/providers/dodo-payments.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Dodo Payments delivers Standard Webhooks payloads with the canonical
+ * `webhook-id`, `webhook-timestamp` and `webhook-signature` headers. The
+ * secret is Base64-decoded (an optional `whsec_` prefix is stripped) and must
+ * decode to 24-64 bytes; the signature covers the exact
+ * `${webhook-id}.${webhook-timestamp}.` bytes followed by the raw body.
+ *
+ * These headers authenticate protocol bytes, not a unique Dodo identity: a
+ * signature minted by any other canonical alias verifies here when the same
+ * secret is configured. Use endpoint-specific secrets and route configuration
+ * to prevent cross-endpoint replay. No event payload is parsed and no
+ * resource id is inferred.
+ *
+ * No Dodo Payments-published signature vector is claimed; the direct tests use
+ * synthetic anchors. Source:
+ * https://docs.dodopayments.com/developer-resources/webhooks
+ */
+export declare const dodoPaymentsDescriptor: {
+    readonly provider: "dodo-payments";
+} & Pick<import("../internal/provider.js").ProviderDescriptor, "decodeSecret" | "parse">;
+//# sourceMappingURL=dodo-payments.d.ts.map

package/dist/providers/dodo-payments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dodo-payments.d.ts","sourceRoot":"","sources":["../../src/providers/dodo-payments.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,sBAAsB;;wFAQlC,CAAC"}

package/dist/providers/dodo-payments.js

@@ -0,0 +1,24 @@
+import { createStandardWebhooksProtocol } from './standard-webhooks-protocol.js';
+/**
+ * Dodo Payments delivers Standard Webhooks payloads with the canonical
+ * `webhook-id`, `webhook-timestamp` and `webhook-signature` headers. The
+ * secret is Base64-decoded (an optional `whsec_` prefix is stripped) and must
+ * decode to 24-64 bytes; the signature covers the exact
+ * `${webhook-id}.${webhook-timestamp}.` bytes followed by the raw body.
+ *
+ * These headers authenticate protocol bytes, not a unique Dodo identity: a
+ * signature minted by any other canonical alias verifies here when the same
+ * secret is configured. Use endpoint-specific secrets and route configuration
+ * to prevent cross-endpoint replay. No event payload is parsed and no
+ * resource id is inferred.
+ *
+ * No Dodo Payments-published signature vector is claimed; the direct tests use
+ * synthetic anchors. Source:
+ * https://docs.dodopayments.com/developer-resources/webhooks
+ */
+export const dodoPaymentsDescriptor = createStandardWebhooksProtocol('dodo-payments', 'Dodo Payments', {
+    id: 'webhook-id',
+    timestamp: 'webhook-timestamp',
+    signature: 'webhook-signature',
+});
+//# sourceMappingURL=dodo-payments.js.map

package/dist/providers/dodo-payments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dodo-payments.js","sourceRoot":"","sources":["../../src/providers/dodo-payments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAEjF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,8BAA8B,CAClE,eAAe,EACf,eAAe,EACf;IACE,EAAE,EAAE,YAAY;IAChB,SAAS,EAAE,mBAAmB;IAC9B,SAAS,EAAE,mBAAmB;CAC/B,CACF,CAAC"}

package/dist/providers/doppler.d.ts

@@ -0,0 +1,38 @@
+import type { NormalizedHeaders, ParseResult } from '../internal/provider.js';
+/**
+ * Doppler `X-Doppler-Signature: sha256=<hex HMAC-SHA256(raw request body)>`.
+ *
+ * Doppler documents exactly one `<scheme>=<64 hex>` value; there is no list and
+ * no unknown-field tolerance. The complete value is validated before the scheme
+ * decision, so a well-formed digest under another scheme token (`sha1=<64 hex>`)
+ * fails as `unsupported-scheme`, while any nonconforming syntax — wrong length,
+ * non-hex, bare hex, commas, extra equals, empty digest, or outer whitespace —
+ * fails as `malformed-signature`. `sha256=` is case-sensitive; `SHA256=<64 hex>`
+ * is a different scheme and therefore unsupported.
+ *
+ * The secret is the literal, untrimmed UTF-8 text of the webhook `Secret`. It is
+ * never Base64-decoded and no `whsec_`-style prefix is inferred, so an empty
+ * secret is an invalid configuration rather than an encoded empty key.
+ *
+ * The HMAC covers the exact raw body only; no timestamp or identifier is
+ * included in the MAC, so every identity field is null and
+ * `authenticatedFields` is empty: this descriptor never establishes freshness and
+ * offers no replay protection. Signing is optional on the Doppler side, so a
+ * delivery without a configured secret carries no signature and cannot be
+ * verified; there is no Basic/Bearer or unsigned fallback path here.
+ *
+ * The Doppler docs' Node example re-serializes with `JSON.stringify(req.body)`.
+ * This descriptor authenticates the received bytes instead, so a caller that has
+ * already parsed the body cannot reliably reconstruct the signed content and
+ * should pass the original bytes.
+ *
+ * Source: https://docs.doppler.com/docs/webhooks
+ *
+ * No Doppler-published signature tuple was located; test anchors are synthetic.
+ */
+export declare const dopplerDescriptor: {
+    provider: "doppler";
+    decodeSecret(secret: string): Uint8Array;
+    parse(headers: NormalizedHeaders, rawBody: Uint8Array): ParseResult;
+};
+//# sourceMappingURL=doppler.d.ts.map

package/dist/providers/doppler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doppler.d.ts","sourceRoot":"","sources":["../../src/providers/doppler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAsB,MAAM,yBAAyB,CAAC;AAOlG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,iBAAiB;;yBAGP,MAAM,GAAG,UAAU;mBAIzB,iBAAiB,WAAW,UAAU,GAAG,WAAW;CAoC4B,CAAC"}

package/dist/providers/doppler.js

@@ -0,0 +1,69 @@
+import { decodeHexSignature, decodeLiteralSecret, failure, isSchemeToken } from './shared.js';
+const SIGNATURE_HEADER = 'x-doppler-signature';
+const SIGNATURE_SCHEME = 'sha256';
+/**
+ * Doppler `X-Doppler-Signature: sha256=<hex HMAC-SHA256(raw request body)>`.
+ *
+ * Doppler documents exactly one `<scheme>=<64 hex>` value; there is no list and
+ * no unknown-field tolerance. The complete value is validated before the scheme
+ * decision, so a well-formed digest under another scheme token (`sha1=<64 hex>`)
+ * fails as `unsupported-scheme`, while any nonconforming syntax — wrong length,
+ * non-hex, bare hex, commas, extra equals, empty digest, or outer whitespace —
+ * fails as `malformed-signature`. `sha256=` is case-sensitive; `SHA256=<64 hex>`
+ * is a different scheme and therefore unsupported.
+ *
+ * The secret is the literal, untrimmed UTF-8 text of the webhook `Secret`. It is
+ * never Base64-decoded and no `whsec_`-style prefix is inferred, so an empty
+ * secret is an invalid configuration rather than an encoded empty key.
+ *
+ * The HMAC covers the exact raw body only; no timestamp or identifier is
+ * included in the MAC, so every identity field is null and
+ * `authenticatedFields` is empty: this descriptor never establishes freshness and
+ * offers no replay protection. Signing is optional on the Doppler side, so a
+ * delivery without a configured secret carries no signature and cannot be
+ * verified; there is no Basic/Bearer or unsigned fallback path here.
+ *
+ * The Doppler docs' Node example re-serializes with `JSON.stringify(req.body)`.
+ * This descriptor authenticates the received bytes instead, so a caller that has
+ * already parsed the body cannot reliably reconstruct the signed content and
+ * should pass the original bytes.
+ *
+ * Source: https://docs.doppler.com/docs/webhooks
+ *
+ * No Doppler-published signature tuple was located; test anchors are synthetic.
+ */
+export const dopplerDescriptor = {
+    provider: 'doppler',
+    decodeSecret(secret) {
+        return decodeLiteralSecret(secret, 'Doppler');
+    },
+    parse(headers, rawBody) {
+        const raw = headers.get(SIGNATURE_HEADER);
+        if (raw === undefined || raw.trim() === '') {
+            return failure('missing-signature', 'No Doppler signature header was provided.');
+        }
+        // Validate the whole value first: exactly one `=`, a nonempty scheme token,
+        // and a nonempty digest. `decodeHexSignature` accepts either hex case but
+        // requires exactly 64 hex characters (32 bytes).
+        const separator = raw.indexOf('=');
+        if (separator <= 0 || separator === raw.length - 1 || raw.indexOf('=', separator + 1) !== -1) {
+            return failure('malformed-signature', 'The Doppler signature header is malformed.');
+        }
+        const scheme = raw.slice(0, separator);
+        const signature = decodeHexSignature(raw.slice(separator + 1));
+        if (!isSchemeToken(scheme) || signature === null) {
+            return failure('malformed-signature', 'The Doppler signature header is malformed.');
+        }
+        if (scheme !== SIGNATURE_SCHEME) {
+            return failure('unsupported-scheme', 'The Doppler signature scheme is not supported.');
+        }
+        const identity = {
+            deliveryId: null,
+            eventId: null,
+            timestamp: null,
+            authenticatedFields: [],
+        };
+        return { ok: true, signatures: [signature], signedContent: rawBody, identity };
+    },
+};
+//# sourceMappingURL=doppler.js.map

package/dist/providers/doppler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doppler.js","sourceRoot":"","sources":["../../src/providers/doppler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE9F,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAC/C,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAElC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,QAAQ,EAAE,SAAS;IAEnB,YAAY,CAAC,MAAc;QACzB,OAAO,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,OAA0B,EAAE,OAAmB;QACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAE1C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC3C,OAAO,OAAO,CAAC,mBAAmB,EAAE,2CAA2C,CAAC,CAAC;QACnF,CAAC;QAED,4EAA4E;QAC5E,0EAA0E;QAC1E,iDAAiD;QACjD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEnC,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC7F,OAAO,OAAO,CAAC,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC;QAE/D,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACjD,OAAO,OAAO,CAAC,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC,oBAAoB,EAAE,gDAAgD,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,QAAQ,GAAkB;YAC9B,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,IAAI;YACf,mBAAmB,EAAE,EAAE;SACxB,CAAC;QAEF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IACjF,CAAC;CAC8F,CAAC"}

package/dist/providers/fal.d.ts

@@ -0,0 +1,14 @@
+import type { FalParseResult, NormalizedHeaders } from '../internal/provider.js';
+/** Static-key fal webhook formatting only; key authentication belongs to core.
+ * https://fal.ai/docs/documentation/model-apis/inference/webhooks
+ * Strict ID and hex grammars are Hooklatch receiver policy, not vendor parity.
+ */
+export declare const falDescriptor: {
+    provider: "fal";
+    crypto: {
+        kind: "ed25519";
+        signatureBytes: 64;
+    };
+    parse(headers: NormalizedHeaders, rawBody: Uint8Array): Promise<FalParseResult>;
+};
+//# sourceMappingURL=fal.d.ts.map

package/dist/providers/fal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fal.d.ts","sourceRoot":"","sources":["../../src/providers/fal.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAyB,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAIxG;;;GAGG;AACH,eAAO,MAAM,aAAa;;;;;;mBAIH,iBAAiB,WAAW,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;CAwDtD,CAAC"}

package/dist/providers/fal.js

@@ -0,0 +1,78 @@
+import { HooklatchError } from '../errors.js';
+import { utf8 } from '../internal/bytes.js';
+import { failure, isCanonicalTimestamp } from './shared.js';
+/** Static-key fal webhook formatting only; key authentication belongs to core.
+ * https://fal.ai/docs/documentation/model-apis/inference/webhooks
+ * Strict ID and hex grammars are Hooklatch receiver policy, not vendor parity.
+ */
+export const falDescriptor = {
+    provider: 'fal',
+    crypto: { kind: 'ed25519', signatureBytes: 64 },
+    async parse(headers, rawBody) {
+        const signatureRaw = headers.get('x-fal-webhook-signature');
+        const requestId = headers.get('x-fal-webhook-request-id');
+        const userId = headers.get('x-fal-webhook-user-id');
+        const timestamp = headers.get('x-fal-webhook-timestamp');
+        if (signatureRaw === undefined || signatureRaw.trim() === '') {
+            return failure('missing-signature', 'No fal signature header was provided.');
+        }
+        const signature = decodeSignature(signatureRaw);
+        if (signature === null)
+            return malformed();
+        // Presence of both IDs takes precedence over grammar of either ID.
+        if (requestId === undefined || requestId.trim() === '') {
+            return failure('missing-identity', 'No fal request identity was provided.');
+        }
+        if (userId === undefined || userId.trim() === '') {
+            return failure('missing-identity', 'No fal user identity was provided.');
+        }
+        if (!isIdentity(requestId) || !isIdentity(userId))
+            return malformed();
+        if (timestamp === undefined || timestamp.trim() === '') {
+            return failure('missing-timestamp', 'No fal timestamp was provided.');
+        }
+        if (!isCanonicalTimestamp(timestamp))
+            return malformed();
+        const body = new Uint8Array(rawBody);
+        const subtle = globalThis.crypto?.subtle;
+        if (!subtle)
+            throw new HooklatchError('crypto-unavailable', 'Web Crypto is unavailable.');
+        let digest;
+        try {
+            digest = await subtle.digest('SHA-256', body);
+        }
+        catch (error) {
+            if (isUnsupported(error)) {
+                throw new HooklatchError('crypto-unavailable', 'Web Crypto is unavailable.');
+            }
+            throw new HooklatchError('internal', 'Cryptographic verification failed.');
+        }
+        const hex = Array.from(new Uint8Array(digest), byte => byte.toString(16).padStart(2, '0')).join('');
+        return {
+            ok: true, signatures: [signature],
+            signedContent: utf8(`${requestId}\n${userId}\n${timestamp}\n${hex}`),
+            recipient: userId,
+            identity: { deliveryId: null, eventId: null, timestamp: Number(timestamp), authenticatedFields: ['timestamp'] },
+        };
+    },
+};
+function malformed() {
+    return failure('malformed-signature', 'The fal signature headers are malformed.');
+}
+/** DOM exceptions may originate outside this realm. */
+function isUnsupported(error) {
+    return error !== null && typeof error === 'object' && 'name' in error && error.name === 'NotSupportedError';
+}
+function isIdentity(value) {
+    return /^[\x21-\x7e]{1,1024}$/.test(value) && !value.includes(',');
+}
+function decodeSignature(value) {
+    if (!/^[a-fA-F0-9]{128}$/.test(value))
+        return null;
+    const bytes = new Uint8Array(64);
+    for (let index = 0; index < bytes.length; index++) {
+        bytes[index] = Number.parseInt(value.slice(index * 2, index * 2 + 2), 16);
+    }
+    return bytes;
+}
+//# sourceMappingURL=fal.js.map

package/dist/providers/fal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fal.js","sourceRoot":"","sources":["../../src/providers/fal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAG5C,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,QAAQ,EAAE,KAAK;IACf,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE;IAE/C,KAAK,CAAC,KAAK,CAAC,OAA0B,EAAE,OAAmB;QACzD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAEzD,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7D,OAAO,OAAO,CAAC,mBAAmB,EAAE,uCAAuC,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,SAAS,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;QAEhD,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,SAAS,EAAE,CAAC;QAE3C,mEAAmE;QACnE,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACvD,OAAO,OAAO,CAAC,kBAAkB,EAAE,uCAAuC,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACjD,OAAO,OAAO,CAAC,kBAAkB,EAAE,oCAAoC,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,EAAE,CAAC;QAEtE,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACvD,OAAO,OAAO,CAAC,mBAAmB,EAAE,gCAAgC,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,EAAE,CAAC;QAEzD,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC;QAEzC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,cAAc,CAAC,oBAAoB,EAAE,4BAA4B,CAAC,CAAC;QAC1F,IAAI,MAAmB,CAAC;QAExB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,cAAc,CAAC,oBAAoB,EAAE,4BAA4B,CAAC,CAAC;YAC/E,CAAC;YAED,MAAM,IAAI,cAAc,CAAC,UAAU,EAAE,oCAAoC,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEpG,OAAO;YACL,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC;YACjC,aAAa,EAAE,IAAI,CAAC,GAAG,SAAS,KAAK,MAAM,KAAK,SAAS,KAAK,GAAG,EAAE,CAAC;YACpE,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,mBAAmB,EAAE,CAAC,WAAW,CAAC,EAAE;SAChH,CAAC;IACJ,CAAC;CAC8B,CAAC;AAElC,SAAS,SAAS;IAChB,OAAO,OAAO,CAAC,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;AACpF,CAAC;AAED,uDAAuD;AACvD,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,CAAC;AAC9G,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAEjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/providers/github.d.ts

@@ -0,0 +1,8 @@
+import type { ProviderDescriptor } from '../internal/provider.js';
+/**
+ * GitHub `X-Hub-Signature-256: sha256=<hex>` over the raw body only. The legacy
+ * `X-Hub-Signature: sha1=<hex>` is recognized but never treated as SHA-256.
+ * `X-GitHub-Delivery` is unsigned metadata and never proves authenticity.
+ */
+export declare const githubDescriptor: ProviderDescriptor;
+//# sourceMappingURL=github.d.ts.map

package/dist/providers/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../src/providers/github.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkC,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAelG;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,kBA+C9B,CAAC"}

package/dist/providers/github.js

@@ -0,0 +1,50 @@
+import { decodeHexSignature, decodeLiteralSecret, failure } from './shared.js';
+const SIGNATURE_HEADER = 'x-hub-signature-256';
+const LEGACY_SIGNATURE_HEADER = 'x-hub-signature';
+const SCHEME = 'sha256';
+const DELIVERY_HEADER = 'x-github-delivery';
+function optionalHeader(headers, name) {
+    const value = headers.get(name);
+    return value === undefined || value === '' ? null : value;
+}
+/**
+ * GitHub `X-Hub-Signature-256: sha256=<hex>` over the raw body only. The legacy
+ * `X-Hub-Signature: sha1=<hex>` is recognized but never treated as SHA-256.
+ * `X-GitHub-Delivery` is unsigned metadata and never proves authenticity.
+ */
+export const githubDescriptor = {
+    provider: 'github',
+    decodeSecret(secret) {
+        return decodeLiteralSecret(secret, 'GitHub');
+    },
+    parse(headers, rawBody) {
+        const raw = headers.get(SIGNATURE_HEADER);
+        if (raw === undefined || raw.trim() === '') {
+            const legacy = headers.get(LEGACY_SIGNATURE_HEADER);
+            if (legacy !== undefined && legacy.trim() !== '') {
+                return failure('unsupported-scheme', 'Only the legacy SHA-1 GitHub signature was provided.');
+            }
+            return failure('missing-signature', 'No GitHub signature header was provided.');
+        }
+        const separator = raw.indexOf('=');
+        if (separator <= 0 || separator === raw.length - 1) {
+            return failure('malformed-signature', 'The GitHub signature header is malformed.');
+        }
+        const scheme = raw.slice(0, separator);
+        if (scheme.toLowerCase() !== SCHEME) {
+            return failure('unsupported-scheme', 'No supported GitHub signature scheme was provided.');
+        }
+        const signature = decodeHexSignature(raw.slice(separator + 1));
+        if (signature === null) {
+            return failure('malformed-signature', 'The GitHub signature header is malformed.');
+        }
+        const identity = {
+            deliveryId: optionalHeader(headers, DELIVERY_HEADER),
+            eventId: null,
+            timestamp: null,
+            authenticatedFields: [],
+        };
+        return { ok: true, signatures: [signature], signedContent: rawBody, identity };
+    },
+};
+//# sourceMappingURL=github.js.map

package/dist/providers/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../src/providers/github.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE/E,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAC/C,MAAM,uBAAuB,GAAG,iBAAiB,CAAC;AAClD,MAAM,MAAM,GAAG,QAAQ,CAAC;AACxB,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAE5C,SAAS,cAAc,CAAC,OAA0B,EAAE,IAAY;IAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEhC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAuB;IAClD,QAAQ,EAAE,QAAQ;IAElB,YAAY,CAAC,MAAc;QACzB,OAAO,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,OAA0B,EAAE,OAAmB;QACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAE1C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YAEpD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjD,OAAO,OAAO,CAAC,oBAAoB,EAAE,sDAAsD,CAAC,CAAC;YAC/F,CAAC;YAED,OAAO,OAAO,CAAC,mBAAmB,EAAE,0CAA0C,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEnC,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnD,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAEvC,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;YACpC,OAAO,OAAO,CAAC,oBAAoB,EAAE,oDAAoD,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC;QAE/D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,QAAQ,GAAkB;YAC9B,UAAU,EAAE,cAAc,CAAC,OAAO,EAAE,eAAe,CAAC;YACpD,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,IAAI;YACf,mBAAmB,EAAE,EAAE;SACxB,CAAC;QAEF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IACjF,CAAC;CACF,CAAC"}

package/dist/providers/gitlab.d.ts

@@ -0,0 +1,21 @@
+/**
+ * GitLab signing-token mode (introduced in 19.0 behind a default-enabled flag
+ * and generally available in 19.1) sends the canonical Standard Webhooks
+ * `webhook-id`, `webhook-timestamp` and `webhook-signature` headers. The
+ * secret is Base64-decoded (an optional `whsec_` prefix is stripped) and must
+ * decode to 24-64 bytes; the signature covers the exact
+ * `${webhook-id}.${webhook-timestamp}.` bytes followed by the raw body.
+ *
+ * The legacy `X-Gitlab-Token` header is a shared string comparison, not an
+ * authenticated body signature. It is deliberately ignored: a legacy-token-only
+ * request fails closed, and adding that header can neither repair a canonical
+ * defect nor change which bytes were authenticated.
+ *
+ * No GitLab-published signing-token vector is claimed; the direct tests use
+ * synthetic anchors. Source:
+ * https://docs.gitlab.com/user/project/integrations/webhooks/#signing-tokens
+ */
+export declare const gitlabDescriptor: {
+    readonly provider: "gitlab";
+} & Pick<import("../internal/provider.js").ProviderDescriptor, "decodeSecret" | "parse">;
+//# sourceMappingURL=gitlab.d.ts.map

package/dist/providers/gitlab.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlab.d.ts","sourceRoot":"","sources":["../../src/providers/gitlab.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gBAAgB;;wFAQ5B,CAAC"}

package/dist/providers/gitlab.js

@@ -0,0 +1,24 @@
+import { createStandardWebhooksProtocol } from './standard-webhooks-protocol.js';
+/**
+ * GitLab signing-token mode (introduced in 19.0 behind a default-enabled flag
+ * and generally available in 19.1) sends the canonical Standard Webhooks
+ * `webhook-id`, `webhook-timestamp` and `webhook-signature` headers. The
+ * secret is Base64-decoded (an optional `whsec_` prefix is stripped) and must
+ * decode to 24-64 bytes; the signature covers the exact
+ * `${webhook-id}.${webhook-timestamp}.` bytes followed by the raw body.
+ *
+ * The legacy `X-Gitlab-Token` header is a shared string comparison, not an
+ * authenticated body signature. It is deliberately ignored: a legacy-token-only
+ * request fails closed, and adding that header can neither repair a canonical
+ * defect nor change which bytes were authenticated.
+ *
+ * No GitLab-published signing-token vector is claimed; the direct tests use
+ * synthetic anchors. Source:
+ * https://docs.gitlab.com/user/project/integrations/webhooks/#signing-tokens
+ */
+export const gitlabDescriptor = createStandardWebhooksProtocol('gitlab', 'GitLab', {
+    id: 'webhook-id',
+    timestamp: 'webhook-timestamp',
+    signature: 'webhook-signature',
+});
+//# sourceMappingURL=gitlab.js.map

package/dist/providers/gitlab.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlab.js","sourceRoot":"","sources":["../../src/providers/gitlab.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAEjF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,8BAA8B,CAC5D,QAAQ,EACR,QAAQ,EACR;IACE,EAAE,EAAE,YAAY;IAChB,SAAS,EAAE,mBAAmB;IAC9B,SAAS,EAAE,mBAAmB;CAC/B,CACF,CAAC"}

package/dist/providers/grafana.d.ts

@@ -0,0 +1,36 @@
+import type { ProviderDescriptor } from '../internal/provider.js';
+/**
+ * Receiver configuration for the Grafana alerting webhook HMAC.
+ *
+ * `mode` selects the signed layout. `body` signs the exact raw body.
+ * `timestamped` signs `${timestamp}:` followed by the exact raw body, where
+ * the timestamp is read from the configured timestamp header. The mode is
+ * always explicit: nothing is inferred from the request, and a missing
+ * timestamp never downgrades to the body-only layout.
+ */
+export type GrafanaDescriptorOptions = {
+    readonly mode: 'body';
+    readonly signatureHeader?: string;
+    readonly timestampHeader?: never;
+} | {
+    readonly mode: 'timestamped';
+    readonly signatureHeader?: string;
+    readonly timestampHeader: string;
+};
+type GrafanaDescriptor = {
+    readonly provider: 'grafana';
+} & Pick<ProviderDescriptor, 'decodeSecret' | 'parse'>;
+/**
+ * Create a Grafana descriptor for the given receiver configuration.
+ *
+ * The configuration is trusted application input, never derived from a
+ * request. Header names select which header is read; they are lookup
+ * configuration and are not part of the signed bytes, so the same secret,
+ * body and timestamp produce the same MAC under any configured header name.
+ *
+ * The returned descriptor is not registered with the public provider
+ * registry; the coordinator owns that integration.
+ */
+export declare function createGrafanaDescriptor(options: GrafanaDescriptorOptions): GrafanaDescriptor;
+export {};
+//# sourceMappingURL=grafana.d.ts.map

package/dist/providers/grafana.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grafana.d.ts","sourceRoot":"","sources":["../../src/providers/grafana.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAkC,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAGlG;;;;;;;;GAQG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,CAAA;CAAE,GAC9F;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1G,KAAK,iBAAiB,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAA;CAAE,GACrD,IAAI,CAAC,kBAAkB,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC;AAyMvD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,GAAG,iBAAiB,CAc5F"}