hooklatch 0.0.0-stage → 1.0.0

package/dist/providers/grafana.js

@@ -0,0 +1,178 @@
+import { HooklatchError } from '../errors.js';
+import { concatBytes, utf8 } from '../internal/bytes.js';
+import { decodeHexSignature, decodeLiteralSecret, failure, isCanonicalTimestamp } from './shared.js';
+/** Grafana's own default signature header name. */
+const DEFAULT_SIGNATURE_HEADER = 'x-grafana-alerting-signature';
+/** RFC 9110 field-name token characters. */
+const FIELD_NAME_TOKEN = /^[!#$%&'*+.^_`|~\dA-Za-z-]+$/;
+/**
+ * Authentication and framing header names that a configured Grafana header
+ * must not replace. This is Hooklatch configuration policy, not a Grafana
+ * rule: Grafana itself does not restrict the configured header names.
+ */
+const RESERVED_HEADER_NAMES = new Set([
+    'host',
+    'content-length',
+    'transfer-encoding',
+    'connection',
+    'upgrade',
+    'trailer',
+    'te',
+    'proxy-authorization',
+    'proxy-authenticate',
+    'authorization',
+    'cookie',
+    'set-cookie',
+]);
+const ALLOWED_OPTION_KEYS = new Set([
+    'mode',
+    'signatureHeader',
+    'timestampHeader',
+]);
+const INVALID_OPTIONS_MESSAGE = 'Invalid Grafana provider options.';
+function invalidOptions() {
+    throw new HooklatchError('invalid-options', INVALID_OPTIONS_MESSAGE);
+}
+function isOptionsObject(options) {
+    return typeof options === 'object' && options !== null && !Array.isArray(options);
+}
+function isHeaderNameText(value) {
+    return typeof value === 'string';
+}
+function isConfiguredHeaderName(value) {
+    return FIELD_NAME_TOKEN.test(value) && !RESERVED_HEADER_NAMES.has(value.toLowerCase());
+}
+/** Only the three documented option keys are accepted; nothing is inherited. */
+function hasUnexpectedOptionKey(options) {
+    for (const key of Object.keys(options)) {
+        if (!ALLOWED_OPTION_KEYS.has(key))
+            return true;
+    }
+    for (const key of Object.getOwnPropertySymbols(options)) {
+        if (Object.prototype.propertyIsEnumerable.call(options, key))
+            return true;
+    }
+    return false;
+}
+function readSignatureHeader(options) {
+    if (!Object.hasOwn(options, 'signatureHeader'))
+        return DEFAULT_SIGNATURE_HEADER;
+    const value = options.signatureHeader;
+    if (!isHeaderNameText(value) || !isConfiguredHeaderName(value))
+        invalidOptions();
+    return value.toLowerCase();
+}
+function readTimestampHeader(options, mode, signatureHeader) {
+    const configured = Object.hasOwn(options, 'timestampHeader');
+    if (mode === 'body') {
+        // Body-only mode has no timestamp header, not even an explicit undefined.
+        if (configured)
+            invalidOptions();
+        return null;
+    }
+    if (!configured)
+        invalidOptions();
+    const value = options.timestampHeader;
+    if (!isHeaderNameText(value) || !isConfiguredHeaderName(value))
+        invalidOptions();
+    const normalized = value.toLowerCase();
+    // A collision would make the two headers unreadable, so it is rejected.
+    if (normalized === signatureHeader)
+        invalidOptions();
+    return normalized;
+}
+function buildConfiguration(options) {
+    if (!isOptionsObject(options))
+        invalidOptions();
+    if (hasUnexpectedOptionKey(options))
+        invalidOptions();
+    if (!Object.hasOwn(options, 'mode'))
+        invalidOptions();
+    const mode = options.mode;
+    if (mode !== 'body' && mode !== 'timestamped')
+        invalidOptions();
+    const signatureHeader = readSignatureHeader(options);
+    const timestampHeader = readTimestampHeader(options, mode, signatureHeader);
+    return { signatureHeader, timestampHeader };
+}
+/**
+ * Validate and snapshot the configuration. Any getter or proxy trap observed
+ * while reading the options is contained here and reported as one generic
+ * invalid-options error that never echoes the underlying exception.
+ */
+function snapshotConfiguration(options) {
+    try {
+        return buildConfiguration(options);
+    }
+    catch {
+        throw new HooklatchError('invalid-options', INVALID_OPTIONS_MESSAGE);
+    }
+}
+/**
+ * Parse the configured Grafana headers into the bytes Grafana signs.
+ *
+ * The signature header is always read first: its structure decides the
+ * failure before any timestamp is inspected. Freshness and the HMAC check
+ * belong to core, so this only reports the signature and the signed bytes.
+ */
+function parseGrafana(configuration, headers, rawBody) {
+    const signatureRaw = headers.get(configuration.signatureHeader);
+    if (signatureRaw === undefined || signatureRaw.trim() === '') {
+        return failure('missing-signature', 'No Grafana signature header was provided.');
+    }
+    const signature = decodeHexSignature(signatureRaw);
+    if (signature === null) {
+        return failure('malformed-signature', 'The Grafana signature header is malformed.');
+    }
+    const timestampHeader = configuration.timestampHeader;
+    if (timestampHeader === null) {
+        return {
+            ok: true,
+            signatures: [signature],
+            signedContent: rawBody,
+            identity: { deliveryId: null, eventId: null, timestamp: null, authenticatedFields: [] },
+        };
+    }
+    const timestampRaw = headers.get(timestampHeader);
+    if (timestampRaw === undefined || timestampRaw.trim() === '') {
+        return failure('missing-timestamp', 'No Grafana timestamp header was provided.');
+    }
+    if (!isCanonicalTimestamp(timestampRaw)) {
+        return failure('malformed-signature', 'The Grafana timestamp is malformed.');
+    }
+    return {
+        ok: true,
+        signatures: [signature],
+        signedContent: concatBytes(utf8(`${timestampRaw}:`), rawBody),
+        identity: {
+            deliveryId: null,
+            eventId: null,
+            timestamp: Number(timestampRaw),
+            authenticatedFields: ['timestamp'],
+        },
+    };
+}
+/**
+ * Create a Grafana descriptor for the given receiver configuration.
+ *
+ * The configuration is trusted application input, never derived from a
+ * request. Header names select which header is read; they are lookup
+ * configuration and are not part of the signed bytes, so the same secret,
+ * body and timestamp produce the same MAC under any configured header name.
+ *
+ * The returned descriptor is not registered with the public provider
+ * registry; the coordinator owns that integration.
+ */
+export function createGrafanaDescriptor(options) {
+    const configuration = snapshotConfiguration(options);
+    return {
+        provider: 'grafana',
+        decodeSecret(secret) {
+            return decodeLiteralSecret(secret, 'Grafana');
+        },
+        parse(headers, rawBody) {
+            return parseGrafana(configuration, headers, rawBody);
+        },
+    };
+}
+//# sourceMappingURL=grafana.js.map

package/dist/providers/grafana.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grafana.js","sourceRoot":"","sources":["../../src/providers/grafana.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AA4BrG,mDAAmD;AACnD,MAAM,wBAAwB,GAAG,8BAA8B,CAAC;AAEhE,4CAA4C;AAC5C,MAAM,gBAAgB,GAAG,8BAA8B,CAAC;AAExD;;;;GAIG;AACH,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IACzD,MAAM;IACN,gBAAgB;IAChB,mBAAmB;IACnB,YAAY;IACZ,SAAS;IACT,SAAS;IACT,IAAI;IACJ,qBAAqB;IACrB,oBAAoB;IACpB,eAAe;IACf,QAAQ;IACR,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IACvD,MAAM;IACN,iBAAiB;IACjB,iBAAiB;CAClB,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,mCAAmC,CAAC;AAEpE,SAAS,cAAc;IACrB,MAAM,IAAI,cAAc,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,eAAe,CAAC,OAAiC;IACxD,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB;IACjD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC;AACnC,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,gFAAgF;AAChF,SAAS,sBAAsB,CAAC,OAAiC;IAC/D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACjD,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,IAAI,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5E,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAiC;IAC5D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,iBAAiB,CAAC;QAAE,OAAO,wBAAwB,CAAC;IAEhF,MAAM,KAAK,GAAG,OAAO,CAAC,eAAe,CAAC;IAEtC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;QAAE,cAAc,EAAE,CAAC;IAEjF,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAiC,EACjC,IAAiB,EACjB,eAAuB;IAEvB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAE7D,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,0EAA0E;QAC1E,IAAI,UAAU;YAAE,cAAc,EAAE,CAAC;QAEjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,UAAU;QAAE,cAAc,EAAE,CAAC;IAElC,MAAM,KAAK,GAAG,OAAO,CAAC,eAAe,CAAC;IAEtC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;QAAE,cAAc,EAAE,CAAC;IAEjF,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAEvC,wEAAwE;IACxE,IAAI,UAAU,KAAK,eAAe;QAAE,cAAc,EAAE,CAAC;IAErD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAiC;IAC3D,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;QAAE,cAAc,EAAE,CAAC;IAEhD,IAAI,sBAAsB,CAAC,OAAO,CAAC;QAAE,cAAc,EAAE,CAAC;IAEtD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC;QAAE,cAAc,EAAE,CAAC;IAEtD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAE1B,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,aAAa;QAAE,cAAc,EAAE,CAAC;IAEhE,MAAM,eAAe,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;IAE5E,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,OAAiC;IAC9D,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,cAAc,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CACnB,aAAmC,EACnC,OAA0B,EAC1B,OAAmB;IAEnB,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;IAEhE,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7D,OAAO,OAAO,CAAC,mBAAmB,EAAE,2CAA2C,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAEnD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,OAAO,CAAC,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,eAAe,GAAG,aAAa,CAAC,eAAe,CAAC;IAEtD,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,IAAI;YACR,UAAU,EAAE,CAAC,SAAS,CAAC;YACvB,aAAa,EAAE,OAAO;YACtB,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE;SACxF,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAElD,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7D,OAAO,OAAO,CAAC,mBAAmB,EAAE,2CAA2C,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,qBAAqB,EAAE,qCAAqC,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,UAAU,EAAE,CAAC,SAAS,CAAC;QACvB,aAAa,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,YAAY,GAAG,CAAC,EAAE,OAAO,CAAC;QAC7D,QAAQ,EAAE;YACR,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;YAC/B,mBAAmB,EAAE,CAAC,WAAW,CAAC;SACnC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAiC;IACvE,MAAM,aAAa,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAErD,OAAO;QACL,QAAQ,EAAE,SAAS;QAEnB,YAAY,CAAC,MAAc;YACzB,OAAO,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC;QAED,KAAK,CAAC,OAA0B,EAAE,OAAmB;YACnD,OAAO,YAAY,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACvD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/providers/index.d.ts

@@ -0,0 +1,27 @@
+import type { AnyProviderDescriptor } from '../internal/provider.js';
+import type { Provider, GrafanaOptions, PolarOptions } from '../types.js';
+import { clerkDescriptor } from './clerk.js';
+import { githubDescriptor } from './github.js';
+import { shopifyDescriptor } from './shopify.js';
+import { standardWebhooksDescriptor } from './standard-webhooks.js';
+import { stripeDescriptor } from './stripe.js';
+import { svixDescriptor } from './svix.js';
+import { razorpayDescriptor } from './razorpay.js';
+import { paddleDescriptor } from './paddle.js';
+import { lemonSqueezyDescriptor } from './lemon-squeezy.js';
+import { dodoPaymentsDescriptor } from './dodo-payments.js';
+import { gitlabDescriptor } from './gitlab.js';
+import { replicateDescriptor } from './replicate.js';
+import { workosDescriptor } from './workos.js';
+import { sentryDescriptor } from './sentry.js';
+import { dopplerDescriptor } from './doppler.js';
+import { sanityDescriptor } from './sanity.js';
+import { linearDescriptor } from './linear.js';
+import { vercelDescriptor } from './vercel.js';
+import { falDescriptor } from './fal.js';
+/** Registry order is part of the internal contract; append new providers only. */
+export declare const SUPPORTED_PROVIDERS: readonly ["stripe", "github", "shopify", "standard-webhooks", "clerk", "svix", "razorpay", "paddle", "lemon-squeezy", "dodo-payments", "gitlab", "replicate", "workos", "sentry", "doppler", "sanity", "grafana", "polar", "linear", "vercel", "fal"];
+/** Resolve the pure descriptor for a supported provider. */
+export declare function getProviderDescriptor(provider: Provider, providerOptions?: GrafanaOptions | PolarOptions): AnyProviderDescriptor;
+export { clerkDescriptor, githubDescriptor, shopifyDescriptor, standardWebhooksDescriptor, stripeDescriptor, svixDescriptor, razorpayDescriptor, paddleDescriptor, lemonSqueezyDescriptor, dodoPaymentsDescriptor, gitlabDescriptor, replicateDescriptor, workosDescriptor, sentryDescriptor, dopplerDescriptor, sanityDescriptor, linearDescriptor, vercelDescriptor, falDescriptor, };
+//# sourceMappingURL=index.d.ts.map

package/dist/providers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG1E,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,uPAsBQ,CAAC;AAwBzC,4DAA4D;AAC5D,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,EAAE,eAAe,CAAC,EAAE,cAAc,GAAG,YAAY,GAAG,qBAAqB,CAwBhI;AAED,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,0BAA0B,EAC1B,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,GACd,CAAC"}

package/dist/providers/index.js

@@ -0,0 +1,89 @@
+import { HooklatchError } from '../errors.js';
+import { createGrafanaDescriptor } from './grafana.js';
+import { createPolarDescriptor } from './polar.js';
+import { clerkDescriptor } from './clerk.js';
+import { githubDescriptor } from './github.js';
+import { shopifyDescriptor } from './shopify.js';
+import { standardWebhooksDescriptor } from './standard-webhooks.js';
+import { stripeDescriptor } from './stripe.js';
+import { svixDescriptor } from './svix.js';
+import { razorpayDescriptor } from './razorpay.js';
+import { paddleDescriptor } from './paddle.js';
+import { lemonSqueezyDescriptor } from './lemon-squeezy.js';
+import { dodoPaymentsDescriptor } from './dodo-payments.js';
+import { gitlabDescriptor } from './gitlab.js';
+import { replicateDescriptor } from './replicate.js';
+import { workosDescriptor } from './workos.js';
+import { sentryDescriptor } from './sentry.js';
+import { dopplerDescriptor } from './doppler.js';
+import { sanityDescriptor } from './sanity.js';
+import { linearDescriptor } from './linear.js';
+import { vercelDescriptor } from './vercel.js';
+import { falDescriptor } from './fal.js';
+/** Registry order is part of the internal contract; append new providers only. */
+export const SUPPORTED_PROVIDERS = [
+    'stripe',
+    'github',
+    'shopify',
+    'standard-webhooks',
+    'clerk',
+    'svix',
+    'razorpay',
+    'paddle',
+    'lemon-squeezy',
+    'dodo-payments',
+    'gitlab',
+    'replicate',
+    'workos',
+    'sentry',
+    'doppler',
+    'sanity',
+    'grafana',
+    'polar',
+    'linear',
+    'vercel',
+    'fal',
+];
+const DESCRIPTORS = {
+    stripe: stripeDescriptor,
+    github: githubDescriptor,
+    shopify: shopifyDescriptor,
+    'standard-webhooks': standardWebhooksDescriptor,
+    clerk: clerkDescriptor,
+    svix: svixDescriptor,
+    razorpay: razorpayDescriptor,
+    paddle: paddleDescriptor,
+    'lemon-squeezy': lemonSqueezyDescriptor,
+    'dodo-payments': dodoPaymentsDescriptor,
+    gitlab: gitlabDescriptor,
+    replicate: replicateDescriptor,
+    workos: workosDescriptor,
+    sentry: sentryDescriptor,
+    doppler: dopplerDescriptor,
+    sanity: sanityDescriptor,
+    linear: linearDescriptor,
+    vercel: vercelDescriptor,
+    fal: falDescriptor,
+};
+/** Resolve the pure descriptor for a supported provider. */
+export function getProviderDescriptor(provider, providerOptions) {
+    if (provider === 'grafana') {
+        if (providerOptions === undefined || !('mode' in providerOptions)) {
+            throw new HooklatchError('invalid-options', 'Invalid provider options.');
+        }
+        return createGrafanaDescriptor(providerOptions);
+    }
+    if (provider === 'polar') {
+        if (providerOptions !== undefined && 'mode' in providerOptions) {
+            throw new HooklatchError('invalid-options', 'Invalid provider options.');
+        }
+        return createPolarDescriptor(providerOptions);
+    }
+    const descriptor = Object.hasOwn(DESCRIPTORS, provider) ? DESCRIPTORS[provider] : undefined;
+    if (descriptor === undefined) {
+        throw new HooklatchError('unknown-provider', 'Unsupported webhook provider.');
+    }
+    return descriptor;
+}
+export { clerkDescriptor, githubDescriptor, shopifyDescriptor, standardWebhooksDescriptor, stripeDescriptor, svixDescriptor, razorpayDescriptor, paddleDescriptor, lemonSqueezyDescriptor, dodoPaymentsDescriptor, gitlabDescriptor, replicateDescriptor, workosDescriptor, sentryDescriptor, dopplerDescriptor, sanityDescriptor, linearDescriptor, vercelDescriptor, falDescriptor, };
+//# sourceMappingURL=index.js.map

package/dist/providers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAG9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,kFAAkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,mBAAmB;IACnB,OAAO;IACP,MAAM;IACN,UAAU;IACV,QAAQ;IACR,eAAe;IACf,eAAe;IACf,QAAQ;IACR,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,SAAS;IACT,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,KAAK;CACiC,CAAC;AAEzC,MAAM,WAAW,GAAoF;IACnG,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,gBAAgB;IACxB,OAAO,EAAE,iBAAiB;IAC1B,mBAAmB,EAAE,0BAA0B;IAC/C,KAAK,EAAE,eAAe;IACtB,IAAI,EAAE,cAAc;IACpB,QAAQ,EAAE,kBAAkB;IAC5B,MAAM,EAAE,gBAAgB;IACxB,eAAe,EAAE,sBAAsB;IACvC,eAAe,EAAE,sBAAsB;IACvC,MAAM,EAAE,gBAAgB;IACxB,SAAS,EAAE,mBAAmB;IAC9B,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,gBAAgB;IACxB,OAAO,EAAE,iBAAiB;IAC1B,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,gBAAgB;IACxB,GAAG,EAAE,aAAa;CACnB,CAAC;AAEF,4DAA4D;AAC5D,MAAM,UAAU,qBAAqB,CAAC,QAAkB,EAAE,eAA+C;IACvG,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,eAAe,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,cAAc,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,uBAAuB,CAAC,eAAe,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,eAAe,KAAK,SAAS,IAAI,MAAM,IAAI,eAAe,EAAE,CAAC;YAC/D,MAAM,IAAI,cAAc,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,qBAAqB,CAAC,eAAe,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE5F,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,cAAc,CAAC,kBAAkB,EAAE,+BAA+B,CAAC,CAAC;IAChF,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,0BAA0B,EAC1B,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,GACd,CAAC"}

package/dist/providers/lemon-squeezy.d.ts

@@ -0,0 +1,16 @@
+import type { NormalizedHeaders, ParseResult } from '../internal/provider.js';
+/**
+ * Lemon Squeezy `X-Signature`: a single 64-character hex HMAC-SHA256 digest of
+ * the exact raw body, keyed with the literal webhook signing secret. The docs
+ * suggest 6-40 character secrets, but that UI guidance is not enforced as a
+ * cryptographic limit. No timestamp or event identifier is documented for
+ * verification, so identity stays null and unsigned (`X-Event-Name` is
+ * metadata and is not interpreted).
+ * Source: https://docs.lemonsqueezy.com/help/webhooks/signing-requests
+ */
+export declare const lemonSqueezyDescriptor: {
+    provider: "lemon-squeezy";
+    decodeSecret(secret: string): Uint8Array;
+    parse(headers: NormalizedHeaders, rawBody: Uint8Array): ParseResult;
+};
+//# sourceMappingURL=lemon-squeezy.d.ts.map

package/dist/providers/lemon-squeezy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lemon-squeezy.d.ts","sourceRoot":"","sources":["../../src/providers/lemon-squeezy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAsB,MAAM,yBAAyB,CAAC;AAKlG;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB;;yBAGZ,MAAM,GAAG,UAAU;mBAIzB,iBAAiB,WAAW,UAAU,GAAG,WAAW;CAoBkC,CAAC"}

package/dist/providers/lemon-squeezy.js

@@ -0,0 +1,34 @@
+import { decodeHexSignature, decodeLiteralSecret, failure } from './shared.js';
+const SIGNATURE_HEADER = 'x-signature';
+/**
+ * Lemon Squeezy `X-Signature`: a single 64-character hex HMAC-SHA256 digest of
+ * the exact raw body, keyed with the literal webhook signing secret. The docs
+ * suggest 6-40 character secrets, but that UI guidance is not enforced as a
+ * cryptographic limit. No timestamp or event identifier is documented for
+ * verification, so identity stays null and unsigned (`X-Event-Name` is
+ * metadata and is not interpreted).
+ * Source: https://docs.lemonsqueezy.com/help/webhooks/signing-requests
+ */
+export const lemonSqueezyDescriptor = {
+    provider: 'lemon-squeezy',
+    decodeSecret(secret) {
+        return decodeLiteralSecret(secret, 'Lemon Squeezy');
+    },
+    parse(headers, rawBody) {
+        const raw = headers.get(SIGNATURE_HEADER);
+        if (raw === undefined || raw.trim() === '') {
+            return failure('missing-signature', 'No Lemon Squeezy signature header was provided.');
+        }
+        const signature = decodeHexSignature(raw);
+        if (signature === null) {
+            return failure('malformed-signature', 'The Lemon Squeezy signature header is malformed.');
+        }
+        return {
+            ok: true,
+            signatures: [signature],
+            signedContent: rawBody,
+            identity: { deliveryId: null, eventId: null, timestamp: null, authenticatedFields: [] },
+        };
+    },
+};
+//# sourceMappingURL=lemon-squeezy.js.map

package/dist/providers/lemon-squeezy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lemon-squeezy.js","sourceRoot":"","sources":["../../src/providers/lemon-squeezy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE/E,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAEvC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,QAAQ,EAAE,eAAe;IAEzB,YAAY,CAAC,MAAc;QACzB,OAAO,mBAAmB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,OAA0B,EAAE,OAAmB;QACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAE1C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC3C,OAAO,OAAO,CAAC,mBAAmB,EAAE,iDAAiD,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAE1C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,OAAO,CAAC,qBAAqB,EAAE,kDAAkD,CAAC,CAAC;QAC5F,CAAC;QAED,OAAO;YACL,EAAE,EAAE,IAAI;YACR,UAAU,EAAE,CAAC,SAAS,CAAC;YACvB,aAAa,EAAE,OAAO;YACtB,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE;SACxF,CAAC;IACJ,CAAC;CACoG,CAAC"}

package/dist/providers/linear.d.ts

@@ -0,0 +1,37 @@
+import type { NormalizedHeaders, ParseResult } from '../internal/provider.js';
+/**
+ * Linear webhook signature authentication: `Linear-Signature` is a single
+ * 64-character hex HMAC-SHA256 over the exact visible raw request body, keyed
+ * with the literal, untrimmed UTF-8 webhook secret. Missing or trim-blank values
+ * are `missing-signature`; prefixes, outer whitespace, commas, lists, non-hex,
+ * wrong length and all other nonconforming values fail closed as
+ * `malformed-signature`. Either hex case is accepted as Hooklatch receiver
+ * policy, not as a claim of exact Linear SDK parity.
+ *
+ * `Linear-Delivery`, `Linear-Event`, `linear-timestamp` and all alien
+ * authentication headers are outside the MAC. They cannot establish freshness or
+ * trusted identity. Every identity field is null and `authenticatedFields` is
+ * empty: this descriptor intentionally performs body-only authentication, does
+ * not parse JSON, and never derives identity or time from body content. Old or
+ * future unsigned timestamps therefore cannot change authenticity, and this
+ * descriptor does not provide replay protection or business idempotency.
+ *
+ * The secret is literal UTF-8 with no prefix stripping, Base64 decoding,
+ * trimming or inferred length bound. Empty secrets are invalid configuration;
+ * whitespace-only and non-ASCII secrets remain literal keys. The exact raw body
+ * bytes are returned as signed content, so callers must retain the received
+ * bytes rather than reserialize parsed JSON.
+ *
+ * Sources:
+ * - https://linear.app/developers/webhooks
+ * - https://linear.app/developers/sdk-webhooks
+ * - https://github.com/linear/linear/blob/4d9cdbf0beb1d1da1824deb5ff3cd458c71380c9/packages/sdk/src/webhooks/client.ts
+ *
+ * No Linear-published signature tuple is claimed; test anchors are synthetic.
+ */
+export declare const linearDescriptor: {
+    provider: "linear";
+    decodeSecret(secret: string): Uint8Array;
+    parse(headers: NormalizedHeaders, rawBody: Uint8Array): ParseResult;
+};
+//# sourceMappingURL=linear.d.ts.map

package/dist/providers/linear.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linear.d.ts","sourceRoot":"","sources":["../../src/providers/linear.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAsB,MAAM,yBAAyB,CAAC;AAMlG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gBAAgB;;yBAGN,MAAM,GAAG,UAAU;mBAIzB,iBAAiB,WAAW,UAAU,GAAG,WAAW;CAsB2B,CAAC"}

package/dist/providers/linear.js

@@ -0,0 +1,56 @@
+import { decodeHexSignature, decodeLiteralSecret, failure } from './shared.js';
+const SIGNATURE_HEADER = 'linear-signature';
+/**
+ * Linear webhook signature authentication: `Linear-Signature` is a single
+ * 64-character hex HMAC-SHA256 over the exact visible raw request body, keyed
+ * with the literal, untrimmed UTF-8 webhook secret. Missing or trim-blank values
+ * are `missing-signature`; prefixes, outer whitespace, commas, lists, non-hex,
+ * wrong length and all other nonconforming values fail closed as
+ * `malformed-signature`. Either hex case is accepted as Hooklatch receiver
+ * policy, not as a claim of exact Linear SDK parity.
+ *
+ * `Linear-Delivery`, `Linear-Event`, `linear-timestamp` and all alien
+ * authentication headers are outside the MAC. They cannot establish freshness or
+ * trusted identity. Every identity field is null and `authenticatedFields` is
+ * empty: this descriptor intentionally performs body-only authentication, does
+ * not parse JSON, and never derives identity or time from body content. Old or
+ * future unsigned timestamps therefore cannot change authenticity, and this
+ * descriptor does not provide replay protection or business idempotency.
+ *
+ * The secret is literal UTF-8 with no prefix stripping, Base64 decoding,
+ * trimming or inferred length bound. Empty secrets are invalid configuration;
+ * whitespace-only and non-ASCII secrets remain literal keys. The exact raw body
+ * bytes are returned as signed content, so callers must retain the received
+ * bytes rather than reserialize parsed JSON.
+ *
+ * Sources:
+ * - https://linear.app/developers/webhooks
+ * - https://linear.app/developers/sdk-webhooks
+ * - https://github.com/linear/linear/blob/4d9cdbf0beb1d1da1824deb5ff3cd458c71380c9/packages/sdk/src/webhooks/client.ts
+ *
+ * No Linear-published signature tuple is claimed; test anchors are synthetic.
+ */
+export const linearDescriptor = {
+    provider: 'linear',
+    decodeSecret(secret) {
+        return decodeLiteralSecret(secret, 'Linear');
+    },
+    parse(headers, rawBody) {
+        const raw = headers.get(SIGNATURE_HEADER);
+        if (raw === undefined || raw.trim() === '') {
+            return failure('missing-signature', 'No Linear signature header was provided.');
+        }
+        const signature = decodeHexSignature(raw);
+        if (signature === null) {
+            return failure('malformed-signature', 'The Linear signature header is malformed.');
+        }
+        const identity = {
+            deliveryId: null,
+            eventId: null,
+            timestamp: null,
+            authenticatedFields: [],
+        };
+        return { ok: true, signatures: [signature], signedContent: rawBody, identity };
+    },
+};
+//# sourceMappingURL=linear.js.map

package/dist/providers/linear.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linear.js","sourceRoot":"","sources":["../../src/providers/linear.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE/E,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,QAAQ,EAAE,QAAQ;IAElB,YAAY,CAAC,MAAc;QACzB,OAAO,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,OAA0B,EAAE,OAAmB;QACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAE1C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC3C,OAAO,OAAO,CAAC,mBAAmB,EAAE,0CAA0C,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAE1C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,QAAQ,GAAkB;YAC9B,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,IAAI;YACf,mBAAmB,EAAE,EAAE;SACxB,CAAC;QAEF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IACjF,CAAC;CAC6F,CAAC"}

package/dist/providers/paddle.d.ts

@@ -0,0 +1,15 @@
+import type { NormalizedHeaders, ParseResult } from '../internal/provider.js';
+/**
+ * Paddle Billing: `Paddle-Signature: ts=<unix seconds>;h1=<64 hex>`.
+ * The signature covers the exact `ts` text, a colon, and the untouched raw
+ * body. Repeated `h1` values are a Hooklatch rotation accept-set; every `h1`
+ * must be valid. Unknown fields such as `h2` are validated then ignored.
+ * Freshness is enforced by core, never here.
+ * Source: https://developer.paddle.com/webhooks/about/signature-verification/
+ */
+export declare const paddleDescriptor: {
+    provider: "paddle";
+    decodeSecret(secret: string): Uint8Array;
+    parse(headers: NormalizedHeaders, rawBody: Uint8Array): ParseResult;
+};
+//# sourceMappingURL=paddle.d.ts.map

package/dist/providers/paddle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paddle.d.ts","sourceRoot":"","sources":["../../src/providers/paddle.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAsB,MAAM,yBAAyB,CAAC;AAqBlG;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB;;yBAGN,MAAM,GAAG,UAAU;mBAIzB,iBAAiB,WAAW,UAAU,GAAG,WAAW;CAmG2B,CAAC"}

package/dist/providers/paddle.js

@@ -0,0 +1,103 @@
+import { concatBytes, utf8 } from '../internal/bytes.js';
+import { decodeHexSignature, decodeLiteralSecret, failure, isCanonicalTimestamp, isSchemeToken, } from './shared.js';
+const SIGNATURE_HEADER = 'paddle-signature';
+const TIMESTAMP_KEY = 'ts';
+const SIGNATURE_KEY = 'h1';
+/**
+ * Opaque nonempty printable ASCII unknown-field value: no whitespace, commas,
+ * semicolons, or additional equals signs. This is a bounded Hooklatch grammar,
+ * not a promise to support an unspecified future signature version.
+ */
+const OPAQUE_VALUE = /^[\x21-\x2b\x2d-\x3a\x3c\x3e-\x7e]+$/;
+/**
+ * Paddle Billing: `Paddle-Signature: ts=<unix seconds>;h1=<64 hex>`.
+ * The signature covers the exact `ts` text, a colon, and the untouched raw
+ * body. Repeated `h1` values are a Hooklatch rotation accept-set; every `h1`
+ * must be valid. Unknown fields such as `h2` are validated then ignored.
+ * Freshness is enforced by core, never here.
+ * Source: https://developer.paddle.com/webhooks/about/signature-verification/
+ */
+export const paddleDescriptor = {
+    provider: 'paddle',
+    decodeSecret(secret) {
+        return decodeLiteralSecret(secret, 'Paddle');
+    },
+    parse(headers, rawBody) {
+        const raw = headers.get(SIGNATURE_HEADER);
+        if (raw === undefined || raw.trim() === '') {
+            return failure('missing-signature', 'No Paddle signature header was provided.');
+        }
+        // HTTP comma-combined duplicate header values never form a valid field list.
+        if (raw.includes(',')) {
+            return failure('malformed-signature', 'The Paddle signature header is malformed.');
+        }
+        const signatures = [];
+        let timestampText;
+        let timestampCount = 0;
+        let unknownSchemes = 0;
+        for (const rawSegment of raw.split(';')) {
+            // Trim outer segment whitespace only; keys and values stay exact.
+            const segment = rawSegment.trim();
+            if (segment === '') {
+                return failure('malformed-signature', 'The Paddle signature header is malformed.');
+            }
+            // Reject missing keys, empty values, and extra equals signs.
+            const separator = segment.indexOf('=');
+            if (separator <= 0 || separator === segment.length - 1 || segment.indexOf('=', separator + 1) !== -1) {
+                return failure('malformed-signature', 'The Paddle signature header is malformed.');
+            }
+            const key = segment.slice(0, separator);
+            const value = segment.slice(separator + 1);
+            if (!isSchemeToken(key)) {
+                return failure('malformed-signature', 'The Paddle signature header is malformed.');
+            }
+            if (key === TIMESTAMP_KEY) {
+                timestampCount += 1;
+                if (timestampCount > 1) {
+                    return failure('malformed-signature', 'The Paddle signature header is malformed.');
+                }
+                if (!isCanonicalTimestamp(value)) {
+                    return failure('malformed-signature', 'The Paddle signature header is malformed.');
+                }
+                timestampText = value;
+                continue;
+            }
+            if (key === SIGNATURE_KEY) {
+                const decoded = decodeHexSignature(value);
+                // One malformed h1 poisons the whole header, even beside a valid h1.
+                if (decoded === null) {
+                    return failure('malformed-signature', 'The Paddle signature header is malformed.');
+                }
+                signatures.push(decoded);
+                continue;
+            }
+            // Unknown fields are structurally validated, then ignored.
+            if (!OPAQUE_VALUE.test(value)) {
+                return failure('malformed-signature', 'The Paddle signature header is malformed.');
+            }
+            unknownSchemes += 1;
+        }
+        // Required-field checks run only after all structure/token validation.
+        if (signatures.length === 0) {
+            return unknownSchemes > 0
+                ? failure('unsupported-scheme', 'No supported Paddle signature scheme was provided.')
+                : failure('missing-signature', 'No Paddle signature value was provided.');
+        }
+        if (timestampText === undefined) {
+            return failure('missing-timestamp', 'No Paddle timestamp was provided.');
+        }
+        const identity = {
+            deliveryId: null,
+            eventId: null,
+            timestamp: Number(timestampText),
+            authenticatedFields: ['timestamp'],
+        };
+        return {
+            ok: true,
+            signatures,
+            signedContent: concatBytes(utf8(`${timestampText}:`), rawBody),
+            identity,
+        };
+    },
+};
+//# sourceMappingURL=paddle.js.map

package/dist/providers/paddle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paddle.js","sourceRoot":"","sources":["../../src/providers/paddle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAGzD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,OAAO,EACP,oBAAoB,EACpB,aAAa,GACd,MAAM,aAAa,CAAC;AAErB,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAC5C,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B;;;;GAIG;AACH,MAAM,YAAY,GAAG,sCAAsC,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,QAAQ,EAAE,QAAQ;IAElB,YAAY,CAAC,MAAc;QACzB,OAAO,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,OAA0B,EAAE,OAAmB;QACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAE1C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC3C,OAAO,OAAO,CAAC,mBAAmB,EAAE,0CAA0C,CAAC,CAAC;QAClF,CAAC;QAED,6EAA6E;QAC7E,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,UAAU,GAAiB,EAAE,CAAC;QACpC,IAAI,aAAiC,CAAC;QACtC,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,cAAc,GAAG,CAAC,CAAC;QAEvB,KAAK,MAAM,UAAU,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,kEAAkE;YAClE,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;YAElC,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;gBACnB,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;YACrF,CAAC;YAED,6DAA6D;YAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAEvC,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACrG,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;YACrF,CAAC;YAED,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YAE3C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;YACrF,CAAC;YAED,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;gBAC1B,cAAc,IAAI,CAAC,CAAC;gBAEpB,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;oBACvB,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;gBACrF,CAAC;gBAED,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjC,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;gBACrF,CAAC;gBAED,aAAa,GAAG,KAAK,CAAC;gBACtB,SAAS;YACX,CAAC;YAED,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;gBAE1C,qEAAqE;gBACrE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACrB,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;gBACrF,CAAC;gBAED,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACzB,SAAS;YACX,CAAC;YAED,2DAA2D;YAC3D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;YACrF,CAAC;YAED,cAAc,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,uEAAuE;QACvE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,cAAc,GAAG,CAAC;gBACvB,CAAC,CAAC,OAAO,CAAC,oBAAoB,EAAE,oDAAoD,CAAC;gBACrF,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,yCAAyC,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,QAAQ,GAAkB;YAC9B,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC;YAChC,mBAAmB,EAAE,CAAC,WAAW,CAAC;SACnC,CAAC;QAEF,OAAO;YACL,EAAE,EAAE,IAAI;YACR,UAAU;YACV,aAAa,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,aAAa,GAAG,CAAC,EAAE,OAAO,CAAC;YAC9D,QAAQ;SACT,CAAC;IACJ,CAAC;CAC6F,CAAC"}

package/dist/providers/polar.d.ts

@@ -0,0 +1,26 @@
+import type { ProviderDescriptor } from '../internal/provider.js';
+export interface PolarDescriptorOptions {
+    readonly secretMode?: 'current' | 'legacy';
+}
+type PolarDescriptor = {
+    readonly provider: 'polar';
+} & Pick<ProviderDescriptor, 'decodeSecret' | 'parse'>;
+/**
+ * Polar webhooks use the canonical Standard Webhooks headers and signed
+ * content: `${webhook-id}.${webhook-timestamp}.${rawBody}`.
+ *
+ * `current` (the default) keeps the shared Standard Webhooks decoder: an
+ * optional `whsec_` prefix is removed and the remainder must decode as
+ * canonical Base64 to 24..64 bytes. `legacy` treats the complete secret string
+ * as literal UTF-8 bytes, including any `whsec_` prefix, with only the shared
+ * nonempty policy. Exactly one mode applies to every secret configured for the
+ * descriptor; there is no prefix inference or cross-mode fallback.
+ *
+ * Polar's SDK tries both key interpretations and floors fractional timestamps.
+ * Hooklatch deliberately does neither, and does not decode opaque bodies as
+ * text. Source:
+ * https://raw.githubusercontent.com/polarsource/polar/89917ad4fe752b06ff84bd31c313d2a53a6085f1/sdk/typescript/src/webhooks.ts
+ */
+export declare function createPolarDescriptor(options?: PolarDescriptorOptions): PolarDescriptor;
+export {};
+//# sourceMappingURL=polar.d.ts.map

package/dist/providers/polar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"polar.d.ts","sourceRoot":"","sources":["../../src/providers/polar.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAIlE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;CAC5C;AAED,KAAK,eAAe,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAC1D,kBAAkB,EAClB,cAAc,GAAG,OAAO,CACzB,CAAC;AAqEF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,CAAC,EAAE,sBAAsB,GAAG,eAAe,CAEvF"}