hooklatch 0.0.0-stage → 1.0.0

package/dist/providers/polar.js

@@ -0,0 +1,78 @@
+import { HooklatchError } from '../errors.js';
+import { decodeLiteralSecret } from './shared.js';
+import { createStandardWebhooksProtocol } from './standard-webhooks-protocol.js';
+const CANONICAL_HEADERS = {
+    id: 'webhook-id',
+    timestamp: 'webhook-timestamp',
+    signature: 'webhook-signature',
+};
+const currentDescriptor = createStandardWebhooksProtocol('polar', 'Polar', CANONICAL_HEADERS);
+const legacyDescriptor = {
+    provider: 'polar',
+    decodeSecret(secret) {
+        return decodeLiteralSecret(secret, 'Polar');
+    },
+    parse: currentDescriptor.parse,
+};
+function invalidOptions() {
+    throw new HooklatchError('invalid-options', 'Invalid Polar provider options.');
+}
+function isConfigObject(value) {
+    if (value === null || typeof value !== 'object')
+        return false;
+    try {
+        return !Array.isArray(value);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Read the selected mode as an own field and snapshot it before returning the
+ * descriptor. Inherited fields are not configuration; an own `secretMode:
+ * undefined` is invalid rather than an omitted optional field.
+ */
+function snapshotSecretMode(options) {
+    if (options === undefined)
+        return 'current';
+    if (!isConfigObject(options))
+        invalidOptions();
+    let keys = [];
+    let hasMode = false;
+    let mode = undefined;
+    try {
+        keys = Reflect.ownKeys(options).filter((key) => Object.getOwnPropertyDescriptor(options, key)?.enumerable);
+        hasMode = Object.hasOwn(options, 'secretMode');
+        mode = hasMode ? options.secretMode : undefined;
+    }
+    catch {
+        invalidOptions();
+    }
+    if (keys.some((key) => key !== 'secretMode'))
+        invalidOptions();
+    if (!hasMode)
+        return 'current';
+    if (mode !== 'current' && mode !== 'legacy')
+        invalidOptions();
+    return mode;
+}
+/**
+ * Polar webhooks use the canonical Standard Webhooks headers and signed
+ * content: `${webhook-id}.${webhook-timestamp}.${rawBody}`.
+ *
+ * `current` (the default) keeps the shared Standard Webhooks decoder: an
+ * optional `whsec_` prefix is removed and the remainder must decode as
+ * canonical Base64 to 24..64 bytes. `legacy` treats the complete secret string
+ * as literal UTF-8 bytes, including any `whsec_` prefix, with only the shared
+ * nonempty policy. Exactly one mode applies to every secret configured for the
+ * descriptor; there is no prefix inference or cross-mode fallback.
+ *
+ * Polar's SDK tries both key interpretations and floors fractional timestamps.
+ * Hooklatch deliberately does neither, and does not decode opaque bodies as
+ * text. Source:
+ * https://raw.githubusercontent.com/polarsource/polar/89917ad4fe752b06ff84bd31c313d2a53a6085f1/sdk/typescript/src/webhooks.ts
+ */
+export function createPolarDescriptor(options) {
+    return snapshotSecretMode(options) === 'current' ? currentDescriptor : legacyDescriptor;
+}
+//# sourceMappingURL=polar.js.map

package/dist/providers/polar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"polar.js","sourceRoot":"","sources":["../../src/providers/polar.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAWjF,MAAM,iBAAiB,GAAG;IACxB,EAAE,EAAE,YAAY;IAChB,SAAS,EAAE,mBAAmB;IAC9B,SAAS,EAAE,mBAAmB;CACtB,CAAC;AAEX,MAAM,iBAAiB,GAAG,8BAA8B,CAAC,OAAO,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;AAE9F,MAAM,gBAAgB,GAAoB;IACxC,QAAQ,EAAE,OAAO;IAEjB,YAAY,CAAC,MAAc;QACzB,OAAO,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,EAAE,iBAAiB,CAAC,KAAK;CAC/B,CAAC;AAEF,SAAS,cAAc;IACrB,MAAM,IAAI,cAAc,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,cAAc,CACrB,KAAgD;IAEhD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE9D,IAAI,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,OAA2C;IACrE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE5C,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;QAAE,cAAc,EAAE,CAAC;IAE/C,IAAI,IAAI,GAAiC,EAAE,CAAC;IAC5C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,IAAI,GAAyC,SAAS,CAAC;IAE3D,IAAI,CAAC;QACH,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CACpC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,UAAU,CACnE,CAAC;QACF,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC/C,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,cAAc,EAAE,CAAC;IACnB,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,YAAY,CAAC;QAAE,cAAc,EAAE,CAAC;IAE/D,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAE/B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ;QAAE,cAAc,EAAE,CAAC;IAE9D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgC;IACpE,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CAAC;AAC1F,CAAC"}

package/dist/providers/razorpay.d.ts

@@ -0,0 +1,20 @@
+import type { NormalizedHeaders, ParseResult } from '../internal/provider.js';
+/**
+ * Razorpay `X-Razorpay-Signature`: a single hex HMAC-SHA256 over the raw request
+ * body only, keyed with the literal dashboard webhook secret. A missing,
+ * blank, prefixed, non-hex, wrong-length or comma-combined value fails closed.
+ * The optional `x-razorpay-event-id` is unsigned metadata and never proves
+ * authenticity.
+ *
+ * Sources:
+ * - https://razorpay.com/docs/webhooks/validate-test/
+ * - https://github.com/razorpay/razorpay-node/blob/b9e8527225a7322ba2671a3bc0b848fd019d2d8c/lib/utils/razorpay-utils.js
+ *
+ * No Razorpay-published signature vector is claimed; test anchors are synthetic.
+ */
+export declare const razorpayDescriptor: {
+    provider: "razorpay";
+    decodeSecret(secret: string): Uint8Array;
+    parse(headers: NormalizedHeaders, rawBody: Uint8Array): ParseResult;
+};
+//# sourceMappingURL=razorpay.d.ts.map

package/dist/providers/razorpay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"razorpay.d.ts","sourceRoot":"","sources":["../../src/providers/razorpay.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAsB,MAAM,yBAAyB,CAAC;AAOlG;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB;;yBAGR,MAAM,GAAG,UAAU;mBAIzB,iBAAiB,WAAW,UAAU,GAAG,WAAW;CAwB6B,CAAC"}

package/dist/providers/razorpay.js

@@ -0,0 +1,41 @@
+import { decodeHexSignature, decodeLiteralSecret, failure } from './shared.js';
+const SIGNATURE_HEADER = 'x-razorpay-signature';
+const EVENT_ID_HEADER = 'x-razorpay-event-id';
+/**
+ * Razorpay `X-Razorpay-Signature`: a single hex HMAC-SHA256 over the raw request
+ * body only, keyed with the literal dashboard webhook secret. A missing,
+ * blank, prefixed, non-hex, wrong-length or comma-combined value fails closed.
+ * The optional `x-razorpay-event-id` is unsigned metadata and never proves
+ * authenticity.
+ *
+ * Sources:
+ * - https://razorpay.com/docs/webhooks/validate-test/
+ * - https://github.com/razorpay/razorpay-node/blob/b9e8527225a7322ba2671a3bc0b848fd019d2d8c/lib/utils/razorpay-utils.js
+ *
+ * No Razorpay-published signature vector is claimed; test anchors are synthetic.
+ */
+export const razorpayDescriptor = {
+    provider: 'razorpay',
+    decodeSecret(secret) {
+        return decodeLiteralSecret(secret, 'Razorpay');
+    },
+    parse(headers, rawBody) {
+        const raw = headers.get(SIGNATURE_HEADER);
+        if (raw === undefined || raw.trim() === '') {
+            return failure('missing-signature', 'No Razorpay signature header was provided.');
+        }
+        const signature = decodeHexSignature(raw);
+        if (signature === null) {
+            return failure('malformed-signature', 'The Razorpay signature header is malformed.');
+        }
+        const eventId = headers.get(EVENT_ID_HEADER);
+        const identity = {
+            deliveryId: null,
+            eventId: eventId === undefined || eventId.trim() === '' ? null : eventId,
+            timestamp: null,
+            authenticatedFields: [],
+        };
+        return { ok: true, signatures: [signature], signedContent: rawBody, identity };
+    },
+};
+//# sourceMappingURL=razorpay.js.map

package/dist/providers/razorpay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"razorpay.js","sourceRoot":"","sources":["../../src/providers/razorpay.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE/E,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAChD,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAE9C;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,QAAQ,EAAE,UAAU;IAEpB,YAAY,CAAC,MAAc;QACzB,OAAO,mBAAmB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,OAA0B,EAAE,OAAmB;QACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAE1C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC3C,OAAO,OAAO,CAAC,mBAAmB,EAAE,4CAA4C,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAE1C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,OAAO,CAAC,qBAAqB,EAAE,6CAA6C,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAE7C,MAAM,QAAQ,GAAkB;YAC9B,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;YACxE,SAAS,EAAE,IAAI;YACf,mBAAmB,EAAE,EAAE;SACxB,CAAC;QAEF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IACjF,CAAC;CAC+F,CAAC"}

package/dist/providers/replicate.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Replicate webhooks use the canonical Standard Webhooks `webhook-id`,
+ * `webhook-timestamp` and `webhook-signature` headers. The secret is
+ * Base64-decoded (an optional `whsec_` prefix is stripped) and must decode to
+ * 24-64 bytes; the signature covers the exact
+ * `${webhook-id}.${webhook-timestamp}.` bytes followed by the raw body.
+ *
+ * These headers authenticate protocol bytes, not a unique Replicate identity.
+ * A signature minted by another canonical alias verifies here when the same
+ * secret is configured, so use endpoint-specific secrets. No prediction or
+ * event payload is parsed and no resource id is inferred.
+ *
+ * No Replicate-published signature vector is claimed; the direct tests use
+ * synthetic anchors. Source:
+ * https://replicate.com/docs/topics/webhooks/verify-webhook
+ */
+export declare const replicateDescriptor: {
+    readonly provider: "replicate";
+} & Pick<import("../internal/provider.js").ProviderDescriptor, "decodeSecret" | "parse">;
+//# sourceMappingURL=replicate.d.ts.map

package/dist/providers/replicate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replicate.d.ts","sourceRoot":"","sources":["../../src/providers/replicate.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB;;wFAQ/B,CAAC"}

package/dist/providers/replicate.js

@@ -0,0 +1,23 @@
+import { createStandardWebhooksProtocol } from './standard-webhooks-protocol.js';
+/**
+ * Replicate webhooks use the canonical Standard Webhooks `webhook-id`,
+ * `webhook-timestamp` and `webhook-signature` headers. The secret is
+ * Base64-decoded (an optional `whsec_` prefix is stripped) and must decode to
+ * 24-64 bytes; the signature covers the exact
+ * `${webhook-id}.${webhook-timestamp}.` bytes followed by the raw body.
+ *
+ * These headers authenticate protocol bytes, not a unique Replicate identity.
+ * A signature minted by another canonical alias verifies here when the same
+ * secret is configured, so use endpoint-specific secrets. No prediction or
+ * event payload is parsed and no resource id is inferred.
+ *
+ * No Replicate-published signature vector is claimed; the direct tests use
+ * synthetic anchors. Source:
+ * https://replicate.com/docs/topics/webhooks/verify-webhook
+ */
+export const replicateDescriptor = createStandardWebhooksProtocol('replicate', 'Replicate', {
+    id: 'webhook-id',
+    timestamp: 'webhook-timestamp',
+    signature: 'webhook-signature',
+});
+//# sourceMappingURL=replicate.js.map

package/dist/providers/replicate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replicate.js","sourceRoot":"","sources":["../../src/providers/replicate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAEjF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,8BAA8B,CAC/D,WAAW,EACX,WAAW,EACX;IACE,EAAE,EAAE,YAAY;IAChB,SAAS,EAAE,mBAAmB;IAC9B,SAAS,EAAE,mBAAmB;CAC/B,CACF,CAAC"}

package/dist/providers/sanity.d.ts

@@ -0,0 +1,39 @@
+import type { NormalizedHeaders, ParseResult } from '../internal/provider.js';
+/**
+ * Sanity: `sanity-webhook-signature: t=<unix milliseconds>,v1=<base64url>`.
+ *
+ * The HMAC-SHA256 covers UTF8(the original `t` text + ".") concatenated with
+ * the exact raw body. The secret is the literal, untrimmed UTF-8 text; it is
+ * never Base64-decoded. The digest is canonical unpadded Base64url for exactly
+ * 32 bytes, decoded by a descriptor-local decoder so the shared standard
+ * Base64 handling stays unchanged.
+ *
+ * The accepted header is exactly `t=<ms>,v1=<digest>`: ordered fields, one
+ * each, no whitespace anywhere or outer trimming, no extra or duplicate
+ * fields, no semicolon separators, no padding, and no alternate versions. A
+ * missing or blank header is `missing-signature`; every other nonmatching
+ * structure is `malformed-signature`, with no alternate reason precedence.
+ *
+ * `t` must be a canonical nonnegative safe decimal integer of milliseconds
+ * with no leading zeros, at or after 2021-01-01T00:00:00.000Z. Identity is
+ * `timestamp = Number(t) / 1000` with no delivery or event id; freshness is
+ * enforced by core and is never evaluated here.
+ *
+ * The reference SDK verifies UTF-8 text and refuses to sign an empty payload.
+ * This descriptor accepts empty, NUL, invalid UTF-8, and non-JSON bodies as
+ * opaque bytes, so it extends rather than matches that behavior, and it does
+ * not claim exact SDK parity or live interoperability. The strict grammar
+ * is checked at parse time. The reference decoder regex accepts spaces and
+ * trimming, but full SDK verification compares the original header to canonical
+ * re-encoding and also rejects these noncanonical header variants.
+ *
+ * Sources:
+ * - https://www.sanity.io/docs/content-lake/webhook-best-practices
+ * - https://github.com/sanity-io/webhook-toolkit/blob/e0c211ed6cd80465a70829e335c9e219f37839ba/src/signature.ts
+ */
+export declare const sanityDescriptor: {
+    provider: "sanity";
+    decodeSecret(secret: string): Uint8Array;
+    parse(headers: NormalizedHeaders, rawBody: Uint8Array): ParseResult;
+};
+//# sourceMappingURL=sanity.d.ts.map

package/dist/providers/sanity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanity.d.ts","sourceRoot":"","sources":["../../src/providers/sanity.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAsB,MAAM,yBAAyB,CAAC;AA6GlG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,gBAAgB;;yBAGN,MAAM,GAAG,UAAU;mBAIzB,iBAAiB,WAAW,UAAU,GAAG,WAAW;CA2C2B,CAAC"}

package/dist/providers/sanity.js

@@ -0,0 +1,159 @@
+import { concatBytes, utf8 } from '../internal/bytes.js';
+import { decodeLiteralSecret, failure, isCanonicalTimestamp } from './shared.js';
+const SIGNATURE_HEADER = 'sanity-webhook-signature';
+const TIMESTAMP_FIELD = 't=';
+const SIGNATURE_FIELD = 'v1=';
+const DIGEST_CHARACTERS = 43;
+const BASE64URL_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+/**
+ * Sanity does not send signed payloads before 2021-01-01T00:00:00.000Z, so a
+ * millisecond timestamp below this bound is not a Sanity delivery. The bound
+ * mirrors the reference toolkit; the failure code is Hooklatch policy.
+ */
+const MINIMUM_TIMESTAMP_MS = 1609459200000;
+/**
+ * Split the exact accepted header grammar `t=<ms>,v1=<digest>`.
+ *
+ * The fields are ordered, appear exactly once, and carry no whitespace, extra
+ * fields, duplicate fields, semicolon separators, or alternate versions. Any
+ * other structure is rejected instead of being repaired.
+ */
+function splitHeader(raw) {
+    const separator = raw.indexOf(',');
+    if (separator < 0)
+        return null;
+    const timestampField = raw.slice(0, separator);
+    const signatureField = raw.slice(separator + 1);
+    if (!timestampField.startsWith(TIMESTAMP_FIELD))
+        return null;
+    if (!signatureField.startsWith(SIGNATURE_FIELD))
+        return null;
+    const timestampText = timestampField.slice(TIMESTAMP_FIELD.length);
+    const digest = signatureField.slice(SIGNATURE_FIELD.length);
+    if (timestampText.length === 0)
+        return null;
+    return { timestampText, digest };
+}
+/**
+ * Encode the 32 decoded digest bytes as canonical unpadded Base64url.
+ *
+ * 32 bytes are 256 bits: 42 characters carry 252 of them and the last four
+ * bits close the 43rd character.
+ */
+function encodeBase64Url(bytes) {
+    let output = '';
+    let buffer = 0;
+    let bits = 0;
+    for (const byte of bytes) {
+        buffer = (buffer << 8) | byte;
+        bits += 8;
+        while (bits >= 6) {
+            bits -= 6;
+            output += BASE64URL_ALPHABET.charAt((buffer >>> bits) & 0x3f);
+            buffer &= (1 << bits) - 1;
+        }
+    }
+    return output + BASE64URL_ALPHABET.charAt((buffer << (6 - bits)) & 0x3f);
+}
+/**
+ * Decode exactly 43 canonical unpadded Base64url characters into 32 bytes.
+ *
+ * The 43 characters carry 258 bits, so 32 bytes consume 256 of them and the
+ * two remaining low bits of the final character are pad bits. Re-encoding the
+ * decoded bytes must reproduce the input exactly, which rejects a digest whose
+ * pad bits are not zero.
+ */
+function decodeBase64UrlDigest(value) {
+    if (value.length !== DIGEST_CHARACTERS)
+        return null;
+    const bytes = new Uint8Array(32);
+    let buffer = 0;
+    let bits = 0;
+    let offset = 0;
+    for (let index = 0; index < value.length; index += 1) {
+        const digit = BASE64URL_ALPHABET.indexOf(value.charAt(index));
+        if (digit < 0)
+            return null;
+        buffer = (buffer << 6) | digit;
+        bits += 6;
+        if (bits < 8)
+            continue;
+        bits -= 8;
+        bytes[offset] = (buffer >>> bits) & 0xff;
+        offset += 1;
+        buffer &= (1 << bits) - 1;
+    }
+    return encodeBase64Url(bytes) === value ? bytes : null;
+}
+/**
+ * Sanity: `sanity-webhook-signature: t=<unix milliseconds>,v1=<base64url>`.
+ *
+ * The HMAC-SHA256 covers UTF8(the original `t` text + ".") concatenated with
+ * the exact raw body. The secret is the literal, untrimmed UTF-8 text; it is
+ * never Base64-decoded. The digest is canonical unpadded Base64url for exactly
+ * 32 bytes, decoded by a descriptor-local decoder so the shared standard
+ * Base64 handling stays unchanged.
+ *
+ * The accepted header is exactly `t=<ms>,v1=<digest>`: ordered fields, one
+ * each, no whitespace anywhere or outer trimming, no extra or duplicate
+ * fields, no semicolon separators, no padding, and no alternate versions. A
+ * missing or blank header is `missing-signature`; every other nonmatching
+ * structure is `malformed-signature`, with no alternate reason precedence.
+ *
+ * `t` must be a canonical nonnegative safe decimal integer of milliseconds
+ * with no leading zeros, at or after 2021-01-01T00:00:00.000Z. Identity is
+ * `timestamp = Number(t) / 1000` with no delivery or event id; freshness is
+ * enforced by core and is never evaluated here.
+ *
+ * The reference SDK verifies UTF-8 text and refuses to sign an empty payload.
+ * This descriptor accepts empty, NUL, invalid UTF-8, and non-JSON bodies as
+ * opaque bytes, so it extends rather than matches that behavior, and it does
+ * not claim exact SDK parity or live interoperability. The strict grammar
+ * is checked at parse time. The reference decoder regex accepts spaces and
+ * trimming, but full SDK verification compares the original header to canonical
+ * re-encoding and also rejects these noncanonical header variants.
+ *
+ * Sources:
+ * - https://www.sanity.io/docs/content-lake/webhook-best-practices
+ * - https://github.com/sanity-io/webhook-toolkit/blob/e0c211ed6cd80465a70829e335c9e219f37839ba/src/signature.ts
+ */
+export const sanityDescriptor = {
+    provider: 'sanity',
+    decodeSecret(secret) {
+        return decodeLiteralSecret(secret, 'Sanity');
+    },
+    parse(headers, rawBody) {
+        const raw = headers.get(SIGNATURE_HEADER);
+        if (raw === undefined || raw.trim() === '') {
+            return failure('missing-signature', 'No Sanity signature header was provided.');
+        }
+        const fields = splitHeader(raw);
+        if (fields === null) {
+            return failure('malformed-signature', 'The Sanity signature header is malformed.');
+        }
+        if (!isCanonicalTimestamp(fields.timestampText)) {
+            return failure('malformed-signature', 'The Sanity signature header is malformed.');
+        }
+        const timestamp = Number(fields.timestampText);
+        if (timestamp < MINIMUM_TIMESTAMP_MS) {
+            return failure('malformed-signature', 'The Sanity signature header is malformed.');
+        }
+        const digest = decodeBase64UrlDigest(fields.digest);
+        if (digest === null) {
+            return failure('malformed-signature', 'The Sanity signature header is malformed.');
+        }
+        const identity = {
+            deliveryId: null,
+            eventId: null,
+            timestamp: timestamp / 1000,
+            authenticatedFields: ['timestamp'],
+        };
+        return {
+            ok: true,
+            signatures: [digest],
+            signedContent: concatBytes(utf8(`${fields.timestampText}.`), rawBody),
+            identity,
+        };
+    },
+};
+//# sourceMappingURL=sanity.js.map

package/dist/providers/sanity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanity.js","sourceRoot":"","sources":["../../src/providers/sanity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAGzD,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEjF,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AACpD,MAAM,eAAe,GAAG,IAAI,CAAC;AAC7B,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,kBAAkB,GAAG,kEAAkE,CAAC;AAE9F;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,aAAa,CAAC;AAO3C;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEnC,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/B,MAAM,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAEhD,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7D,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7D,MAAM,aAAa,GAAG,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAE5D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,KAAiB;IACxC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,IAAI,GAAG,CAAC,CAAC;IAEb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC9B,IAAI,IAAI,CAAC,CAAC;QAEV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,IAAI,IAAI,CAAC,CAAC;YACV,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;YAC9D,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAEpD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAE9D,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAE3B,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC;QAC/B,IAAI,IAAI,CAAC,CAAC;QAEV,IAAI,IAAI,GAAG,CAAC;YAAE,SAAS;QAEvB,IAAI,IAAI,CAAC,CAAC;QACV,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;QACzC,MAAM,IAAI,CAAC,CAAC;QACZ,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,eAAe,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,QAAQ,EAAE,QAAQ;IAElB,YAAY,CAAC,MAAc;QACzB,OAAO,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,OAA0B,EAAE,OAAmB;QACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAE1C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC3C,OAAO,OAAO,CAAC,mBAAmB,EAAE,0CAA0C,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAEhC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;YAChD,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAE/C,IAAI,SAAS,GAAG,oBAAoB,EAAE,CAAC;YACrC,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAEpD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,QAAQ,GAAkB;YAC9B,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,SAAS,GAAG,IAAI;YAC3B,mBAAmB,EAAE,CAAC,WAAW,CAAC;SACnC,CAAC;QAEF,OAAO;YACL,EAAE,EAAE,IAAI;YACR,UAAU,EAAE,CAAC,MAAM,CAAC;YACpB,aAAa,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,aAAa,GAAG,CAAC,EAAE,OAAO,CAAC;YACrE,QAAQ;SACT,CAAC;IACJ,CAAC;CAC6F,CAAC"}

package/dist/providers/sentry.d.ts

@@ -0,0 +1,26 @@
+import type { NormalizedHeaders, ParseResult } from '../internal/provider.js';
+/**
+ * Sentry App integration-platform webhooks: `Sentry-Hook-Signature` is a single
+ * 64-character hex HMAC-SHA256 over the exact raw request body, keyed with the
+ * literal app client secret. Missing or trim-blank -> missing-signature; every
+ * other nonconforming value (prefixes, whitespace, comma-combined duplicates,
+ * lists, wrong length or non-hex) fails closed.
+ *
+ * `Request-Id`, `Sentry-Hook-Timestamp` and `Sentry-Hook-Resource` are outside
+ * the MAC: they cannot establish freshness or trusted identity. Sentry's docs
+ * examples re-serialize the parsed body, which can change the signed bytes; this
+ * descriptor always returns the untouched `rawBody` as signed content.
+ *
+ * Scope is Sentry App integration-platform webhooks only, not every Sentry
+ * webhook product. Sources:
+ * - https://docs.sentry.io/integrations/integration-platform/webhooks/
+ * - https://github.com/getsentry/sentry/blob/72757dae9b6d527e564c81d4921dec0d62d7beca/src/sentry/sentry_apps/api/serializers/app_platform_event.py
+ *
+ * No Sentry-published signature vector is claimed; test anchors are synthetic.
+ */
+export declare const sentryDescriptor: {
+    provider: "sentry";
+    decodeSecret(secret: string): Uint8Array;
+    parse(headers: NormalizedHeaders, rawBody: Uint8Array): ParseResult;
+};
+//# sourceMappingURL=sentry.d.ts.map

package/dist/providers/sentry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentry.d.ts","sourceRoot":"","sources":["../../src/providers/sentry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAsB,MAAM,yBAAyB,CAAC;AAMlG;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gBAAgB;;yBAGN,MAAM,GAAG,UAAU;mBAIzB,iBAAiB,WAAW,UAAU,GAAG,WAAW;CAsB2B,CAAC"}

package/dist/providers/sentry.js

@@ -0,0 +1,45 @@
+import { decodeHexSignature, decodeLiteralSecret, failure } from './shared.js';
+const SIGNATURE_HEADER = 'sentry-hook-signature';
+/**
+ * Sentry App integration-platform webhooks: `Sentry-Hook-Signature` is a single
+ * 64-character hex HMAC-SHA256 over the exact raw request body, keyed with the
+ * literal app client secret. Missing or trim-blank -> missing-signature; every
+ * other nonconforming value (prefixes, whitespace, comma-combined duplicates,
+ * lists, wrong length or non-hex) fails closed.
+ *
+ * `Request-Id`, `Sentry-Hook-Timestamp` and `Sentry-Hook-Resource` are outside
+ * the MAC: they cannot establish freshness or trusted identity. Sentry's docs
+ * examples re-serialize the parsed body, which can change the signed bytes; this
+ * descriptor always returns the untouched `rawBody` as signed content.
+ *
+ * Scope is Sentry App integration-platform webhooks only, not every Sentry
+ * webhook product. Sources:
+ * - https://docs.sentry.io/integrations/integration-platform/webhooks/
+ * - https://github.com/getsentry/sentry/blob/72757dae9b6d527e564c81d4921dec0d62d7beca/src/sentry/sentry_apps/api/serializers/app_platform_event.py
+ *
+ * No Sentry-published signature vector is claimed; test anchors are synthetic.
+ */
+export const sentryDescriptor = {
+    provider: 'sentry',
+    decodeSecret(secret) {
+        return decodeLiteralSecret(secret, 'Sentry App');
+    },
+    parse(headers, rawBody) {
+        const raw = headers.get(SIGNATURE_HEADER);
+        if (raw === undefined || raw.trim() === '') {
+            return failure('missing-signature', 'No Sentry App signature header was provided.');
+        }
+        const signature = decodeHexSignature(raw);
+        if (signature === null) {
+            return failure('malformed-signature', 'The Sentry App signature header is malformed.');
+        }
+        const identity = {
+            deliveryId: null,
+            eventId: null,
+            timestamp: null,
+            authenticatedFields: [],
+        };
+        return { ok: true, signatures: [signature], signedContent: rawBody, identity };
+    },
+};
+//# sourceMappingURL=sentry.js.map

package/dist/providers/sentry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentry.js","sourceRoot":"","sources":["../../src/providers/sentry.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE/E,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AAEjD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,QAAQ,EAAE,QAAQ;IAElB,YAAY,CAAC,MAAc;QACzB,OAAO,mBAAmB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,OAA0B,EAAE,OAAmB;QACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAE1C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC3C,OAAO,OAAO,CAAC,mBAAmB,EAAE,8CAA8C,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAE1C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,OAAO,CAAC,qBAAqB,EAAE,+CAA+C,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,QAAQ,GAAkB;YAC9B,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,IAAI;YACf,mBAAmB,EAAE,EAAE;SACxB,CAAC;QAEF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IACjF,CAAC;CAC6F,CAAC"}

package/dist/providers/shared.d.ts

@@ -0,0 +1,15 @@
+import type { FailureDetails, VerificationFailureReason } from '../types.js';
+/** HMAC-SHA256 signatures are always exactly 32 bytes. */
+export declare const SIGNATURE_BYTES = 32;
+export declare function failure(reason: VerificationFailureReason, message: string): FailureDetails;
+export declare function isSchemeToken(value: string): boolean;
+/** Canonical decimal integer: `0`, or a nonzero digit followed by digits. */
+export declare function isCanonicalTimestamp(value: string): boolean;
+/** Hex signature of exactly 32 bytes; accepts either hex case. */
+export declare function decodeHexSignature(value: string): Uint8Array | null;
+/** Canonical Base64 signature of exactly 32 bytes. */
+export declare function decodeBase64Signature(value: string): Uint8Array | null;
+export declare function isNonEmptySecret(secret: string): secret is string;
+/** Literal, untrimmed UTF-8 secret bytes for Stripe/GitHub/Shopify. */
+export declare function decodeLiteralSecret(secret: string, label: string): Uint8Array;
+//# sourceMappingURL=shared.d.ts.map

package/dist/providers/shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../src/providers/shared.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE7E,0DAA0D;AAC1D,eAAO,MAAM,eAAe,KAAK,CAAC;AAKlC,wBAAgB,OAAO,CACrB,MAAM,EAAE,yBAAyB,EACjC,OAAO,EAAE,MAAM,GACd,cAAc,CAEhB;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAK3D;AAED,kEAAkE;AAClE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAInE;AAED,sDAAsD;AACtD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAItE;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,MAAM,CAEjE;AAED,uEAAuE;AACvE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAM7E"}

package/dist/providers/shared.js

@@ -0,0 +1,40 @@
+import { HooklatchError } from '../errors.js';
+import { decodeBase64, decodeHex, utf8 } from '../internal/bytes.js';
+/** HMAC-SHA256 signatures are always exactly 32 bytes. */
+export const SIGNATURE_BYTES = 32;
+/** Scheme/key tokens accepted in provider signature headers (e.g. `v1`, `sha256`). */
+const TOKEN = /^[A-Za-z0-9_-]+$/;
+export function failure(reason, message) {
+    return { ok: false, reason, message };
+}
+export function isSchemeToken(value) {
+    return TOKEN.test(value);
+}
+/** Canonical decimal integer: `0`, or a nonzero digit followed by digits. */
+export function isCanonicalTimestamp(value) {
+    if (!/^(?:0|[1-9]\d*)$/.test(value))
+        return false;
+    const numeric = Number(value);
+    return Number.isSafeInteger(numeric) && numeric >= 0;
+}
+/** Hex signature of exactly 32 bytes; accepts either hex case. */
+export function decodeHexSignature(value) {
+    const bytes = decodeHex(value);
+    return bytes !== null && bytes.byteLength === SIGNATURE_BYTES ? bytes : null;
+}
+/** Canonical Base64 signature of exactly 32 bytes. */
+export function decodeBase64Signature(value) {
+    const bytes = decodeBase64(value);
+    return bytes !== null && bytes.byteLength === SIGNATURE_BYTES ? bytes : null;
+}
+export function isNonEmptySecret(secret) {
+    return typeof secret === 'string' && secret.length > 0;
+}
+/** Literal, untrimmed UTF-8 secret bytes for Stripe/GitHub/Shopify. */
+export function decodeLiteralSecret(secret, label) {
+    if (!isNonEmptySecret(secret)) {
+        throw new HooklatchError('invalid-secret', `Invalid ${label} signing secret.`);
+    }
+    return utf8(secret);
+}
+//# sourceMappingURL=shared.js.map

package/dist/providers/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../src/providers/shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAGrE,0DAA0D;AAC1D,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAElC,sFAAsF;AACtF,MAAM,KAAK,GAAG,kBAAkB,CAAC;AAEjC,MAAM,UAAU,OAAO,CACrB,MAAiC,EACjC,OAAe;IAEf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAE9B,OAAO,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAE/B,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAElC,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,KAAa;IAC/D,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,cAAc,CAAC,gBAAgB,EAAE,WAAW,KAAK,kBAAkB,CAAC,CAAC;IACjF,CAAC;IAED,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC"}

package/dist/providers/shopify.d.ts

@@ -0,0 +1,9 @@
+import type { ProviderDescriptor } from '../internal/provider.js';
+/**
+ * Shopify HTTPS `X-Shopify-Hmac-Sha256`: canonical Base64 HMAC-SHA256 over the
+ * raw body only, keyed with the app client secret. Delivery and event IDs are
+ * unsigned metadata. EventBridge/Pub/Sub deliveries carry no HMAC header and are
+ * therefore not verifiable by this descriptor.
+ */
+export declare const shopifyDescriptor: ProviderDescriptor;
+//# sourceMappingURL=shopify.d.ts.map

package/dist/providers/shopify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shopify.d.ts","sourceRoot":"","sources":["../../src/providers/shopify.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkC,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAclG;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,kBA6B/B,CAAC"}

package/dist/providers/shopify.js

@@ -0,0 +1,38 @@
+import { decodeBase64Signature, decodeLiteralSecret, failure } from './shared.js';
+const SIGNATURE_HEADER = 'x-shopify-hmac-sha256';
+const DELIVERY_HEADER = 'x-shopify-webhook-id';
+const EVENT_HEADER = 'x-shopify-event-id';
+function optionalHeader(headers, name) {
+    const value = headers.get(name);
+    return value === undefined || value === '' ? null : value;
+}
+/**
+ * Shopify HTTPS `X-Shopify-Hmac-Sha256`: canonical Base64 HMAC-SHA256 over the
+ * raw body only, keyed with the app client secret. Delivery and event IDs are
+ * unsigned metadata. EventBridge/Pub/Sub deliveries carry no HMAC header and are
+ * therefore not verifiable by this descriptor.
+ */
+export const shopifyDescriptor = {
+    provider: 'shopify',
+    decodeSecret(secret) {
+        return decodeLiteralSecret(secret, 'Shopify');
+    },
+    parse(headers, rawBody) {
+        const raw = headers.get(SIGNATURE_HEADER);
+        if (raw === undefined || raw.trim() === '') {
+            return failure('missing-signature', 'No Shopify signature header was provided.');
+        }
+        const signature = decodeBase64Signature(raw);
+        if (signature === null) {
+            return failure('malformed-signature', 'The Shopify signature header is malformed.');
+        }
+        const identity = {
+            deliveryId: optionalHeader(headers, DELIVERY_HEADER),
+            eventId: optionalHeader(headers, EVENT_HEADER),
+            timestamp: null,
+            authenticatedFields: [],
+        };
+        return { ok: true, signatures: [signature], signedContent: rawBody, identity };
+    },
+};
+//# sourceMappingURL=shopify.js.map

package/dist/providers/shopify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shopify.js","sourceRoot":"","sources":["../../src/providers/shopify.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAElF,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AACjD,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAC/C,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAE1C,SAAS,cAAc,CAAC,OAA0B,EAAE,IAAY;IAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEhC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAuB;IACnD,QAAQ,EAAE,SAAS;IAEnB,YAAY,CAAC,MAAc;QACzB,OAAO,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,OAA0B,EAAE,OAAmB;QACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAE1C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC3C,OAAO,OAAO,CAAC,mBAAmB,EAAE,2CAA2C,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAE7C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,OAAO,CAAC,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,QAAQ,GAAkB;YAC9B,UAAU,EAAE,cAAc,CAAC,OAAO,EAAE,eAAe,CAAC;YACpD,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC;YAC9C,SAAS,EAAE,IAAI;YACf,mBAAmB,EAAE,EAAE;SACxB,CAAC;QAEF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IACjF,CAAC;CACF,CAAC"}