hooklatch 0.0.0-stage → 1.0.0

package/dist/providers/standard-webhooks-protocol.d.ts

@@ -0,0 +1,15 @@
+import type { ProviderDescriptor } from '../internal/provider.js';
+export interface StandardWebhooksHeaderNames {
+    readonly id: string;
+    readonly timestamp: string;
+    readonly signature: string;
+}
+/**
+ * Internal Standard Webhooks v1 protocol factory. `headerNames` selects the
+ * canonical or branded header family; callers own alias policy and must never
+ * mix names from two families in one configuration.
+ */
+export declare function createStandardWebhooksProtocol<P extends string>(provider: P, label: string, headerNames: StandardWebhooksHeaderNames): {
+    readonly provider: P;
+} & Pick<ProviderDescriptor, 'decodeSecret' | 'parse'>;
+//# sourceMappingURL=standard-webhooks-protocol.d.ts.map

package/dist/providers/standard-webhooks-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"standard-webhooks-protocol.d.ts","sourceRoot":"","sources":["../../src/providers/standard-webhooks-protocol.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAkC,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAelG,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,CAAC,SAAS,MAAM,EAC7D,QAAQ,EAAE,CAAC,EACX,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,2BAA2B,GACvC;IAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;CAAE,GAAG,IAAI,CAAC,kBAAkB,EAAE,cAAc,GAAG,OAAO,CAAC,CAuG/E"}

package/dist/providers/standard-webhooks-protocol.js

@@ -0,0 +1,95 @@
+import { HooklatchError } from '../errors.js';
+import { concatBytes, decodeBase64, utf8 } from '../internal/bytes.js';
+import { decodeBase64Signature, failure, isCanonicalTimestamp, isNonEmptySecret, isSchemeToken, } from './shared.js';
+const SCHEME = 'v1';
+const SECRET_PREFIX = 'whsec_';
+const MIN_KEY_BYTES = 24;
+const MAX_KEY_BYTES = 64;
+/**
+ * Internal Standard Webhooks v1 protocol factory. `headerNames` selects the
+ * canonical or branded header family; callers own alias policy and must never
+ * mix names from two families in one configuration.
+ */
+export function createStandardWebhooksProtocol(provider, label, headerNames) {
+    return {
+        provider,
+        decodeSecret(secret) {
+            if (!isNonEmptySecret(secret)) {
+                throw new HooklatchError('invalid-secret', `Invalid ${label} signing secret.`);
+            }
+            const encoded = secret.startsWith(SECRET_PREFIX)
+                ? secret.slice(SECRET_PREFIX.length)
+                : secret;
+            const bytes = decodeBase64(encoded);
+            if (bytes === null || bytes.byteLength < MIN_KEY_BYTES || bytes.byteLength > MAX_KEY_BYTES) {
+                throw new HooklatchError('invalid-secret', `Invalid ${label} signing secret.`);
+            }
+            return bytes;
+        },
+        parse(headers, rawBody) {
+            const signatureRaw = headers.get(headerNames.signature);
+            if (signatureRaw === undefined || signatureRaw.trim() === '') {
+                return failure('missing-signature', `No ${label} signature header was provided.`);
+            }
+            const signatures = [];
+            let unknownSchemes = 0;
+            for (const piece of signatureRaw.split(/\s+/)) {
+                if (piece === '')
+                    continue;
+                const separator = piece.indexOf(',');
+                if (separator <= 0 || separator === piece.length - 1) {
+                    return failure('malformed-signature', `The ${label} signature header is malformed.`);
+                }
+                const version = piece.slice(0, separator);
+                const value = piece.slice(separator + 1);
+                // HTTP comma-combined duplicate header values never form a valid token.
+                if (!isSchemeToken(version) || /[,\s]/.test(value)) {
+                    return failure('malformed-signature', `The ${label} signature header is malformed.`);
+                }
+                if (version === SCHEME) {
+                    const decoded = decodeBase64Signature(value);
+                    // A malformed `v1` fails closed even when another `v1` value is valid.
+                    if (decoded === null) {
+                        return failure('malformed-signature', `The ${label} signature header is malformed.`);
+                    }
+                    signatures.push(decoded);
+                }
+                else {
+                    unknownSchemes += 1;
+                }
+            }
+            if (signatures.length === 0) {
+                return unknownSchemes > 0
+                    ? failure('unsupported-scheme', `No supported ${label} signature scheme was provided.`)
+                    : failure('missing-signature', `No ${label} signature value was provided.`);
+            }
+            const id = headers.get(headerNames.id);
+            if (id === undefined || id === '') {
+                return failure('missing-identity', `No ${label} message id was provided.`);
+            }
+            if (id.includes('.') || id.includes(',')) {
+                return failure('malformed-signature', `The ${label} message id is malformed.`);
+            }
+            const timestampText = headers.get(headerNames.timestamp);
+            if (timestampText === undefined || timestampText === '') {
+                return failure('missing-timestamp', `No ${label} timestamp was provided.`);
+            }
+            if (!isCanonicalTimestamp(timestampText)) {
+                return failure('malformed-signature', `The ${label} timestamp is malformed.`);
+            }
+            const identity = {
+                deliveryId: null,
+                eventId: id,
+                timestamp: Number(timestampText),
+                authenticatedFields: ['eventId', 'timestamp'],
+            };
+            return {
+                ok: true,
+                signatures,
+                signedContent: concatBytes(utf8(`${id}.${timestampText}.`), rawBody),
+                identity,
+            };
+        },
+    };
+}
+//# sourceMappingURL=standard-webhooks-protocol.js.map

package/dist/providers/standard-webhooks-protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"standard-webhooks-protocol.js","sourceRoot":"","sources":["../../src/providers/standard-webhooks-protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAGvE,OAAO,EACL,qBAAqB,EACrB,OAAO,EACP,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,GACd,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,GAAG,IAAI,CAAC;AACpB,MAAM,aAAa,GAAG,QAAQ,CAAC;AAC/B,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,aAAa,GAAG,EAAE,CAAC;AAQzB;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,QAAW,EACX,KAAa,EACb,WAAwC;IAExC,OAAO;QACL,QAAQ;QAER,YAAY,CAAC,MAAc;YACzB,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,cAAc,CAAC,gBAAgB,EAAE,WAAW,KAAK,kBAAkB,CAAC,CAAC;YACjF,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC;gBAC9C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC;gBACpC,CAAC,CAAC,MAAM,CAAC;YAEX,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YAEpC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,GAAG,aAAa,IAAI,KAAK,CAAC,UAAU,GAAG,aAAa,EAAE,CAAC;gBAC3F,MAAM,IAAI,cAAc,CAAC,gBAAgB,EAAE,WAAW,KAAK,kBAAkB,CAAC,CAAC;YACjF,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,CAAC,OAA0B,EAAE,OAAmB;YACnD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YAExD,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC7D,OAAO,OAAO,CAAC,mBAAmB,EAAE,MAAM,KAAK,iCAAiC,CAAC,CAAC;YACpF,CAAC;YAED,MAAM,UAAU,GAAiB,EAAE,CAAC;YACpC,IAAI,cAAc,GAAG,CAAC,CAAC;YAEvB,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9C,IAAI,KAAK,KAAK,EAAE;oBAAE,SAAS;gBAC3B,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAErC,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrD,OAAO,OAAO,CAAC,qBAAqB,EAAE,OAAO,KAAK,iCAAiC,CAAC,CAAC;gBACvF,CAAC;gBAED,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;gBAEzC,wEAAwE;gBACxE,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBACnD,OAAO,OAAO,CAAC,qBAAqB,EAAE,OAAO,KAAK,iCAAiC,CAAC,CAAC;gBACvF,CAAC;gBAED,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;oBACvB,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;oBAE7C,uEAAuE;oBACvE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;wBACrB,OAAO,OAAO,CAAC,qBAAqB,EAAE,OAAO,KAAK,iCAAiC,CAAC,CAAC;oBACvF,CAAC;oBAED,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC3B,CAAC;qBAAM,CAAC;oBACN,cAAc,IAAI,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;YAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,cAAc,GAAG,CAAC;oBACvB,CAAC,CAAC,OAAO,CAAC,oBAAoB,EAAE,gBAAgB,KAAK,iCAAiC,CAAC;oBACvF,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,KAAK,gCAAgC,CAAC,CAAC;YAChF,CAAC;YAED,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAEvC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBAClC,OAAO,OAAO,CAAC,kBAAkB,EAAE,MAAM,KAAK,2BAA2B,CAAC,CAAC;YAC7E,CAAC;YAED,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzC,OAAO,OAAO,CAAC,qBAAqB,EAAE,OAAO,KAAK,2BAA2B,CAAC,CAAC;YACjF,CAAC;YAED,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YAEzD,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,EAAE,EAAE,CAAC;gBACxD,OAAO,OAAO,CAAC,mBAAmB,EAAE,MAAM,KAAK,0BAA0B,CAAC,CAAC;YAC7E,CAAC;YAED,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,EAAE,CAAC;gBACzC,OAAO,OAAO,CAAC,qBAAqB,EAAE,OAAO,KAAK,0BAA0B,CAAC,CAAC;YAChF,CAAC;YAED,MAAM,QAAQ,GAAkB;gBAC9B,UAAU,EAAE,IAAI;gBAChB,OAAO,EAAE,EAAE;gBACX,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC;gBAChC,mBAAmB,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC;aAC9C,CAAC;YAEF,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,UAAU;gBACV,aAAa,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,aAAa,GAAG,CAAC,EAAE,OAAO,CAAC;gBACpE,QAAQ;aACT,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/providers/standard-webhooks.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Standard Webhooks v1: `webhook-id`, `webhook-timestamp`, and a
+ * whitespace-separated `webhook-signature` list of `v1,<base64>` tokens.
+ * The signature covers `${id}.${timestamp}.<raw body>`. The Ed25519
+ * `v1a` scheme is recognized but unsupported in this release.
+ */
+export declare const standardWebhooksDescriptor: {
+    readonly provider: "standard-webhooks";
+} & Pick<import("../internal/provider.js").ProviderDescriptor, "decodeSecret" | "parse">;
+//# sourceMappingURL=standard-webhooks.d.ts.map

package/dist/providers/standard-webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"standard-webhooks.d.ts","sourceRoot":"","sources":["../../src/providers/standard-webhooks.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B;;wFAQtC,CAAC"}

package/dist/providers/standard-webhooks.js

@@ -0,0 +1,13 @@
+import { createStandardWebhooksProtocol } from './standard-webhooks-protocol.js';
+/**
+ * Standard Webhooks v1: `webhook-id`, `webhook-timestamp`, and a
+ * whitespace-separated `webhook-signature` list of `v1,<base64>` tokens.
+ * The signature covers `${id}.${timestamp}.<raw body>`. The Ed25519
+ * `v1a` scheme is recognized but unsupported in this release.
+ */
+export const standardWebhooksDescriptor = createStandardWebhooksProtocol('standard-webhooks', 'Standard Webhooks', {
+    id: 'webhook-id',
+    timestamp: 'webhook-timestamp',
+    signature: 'webhook-signature',
+});
+//# sourceMappingURL=standard-webhooks.js.map

package/dist/providers/standard-webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"standard-webhooks.js","sourceRoot":"","sources":["../../src/providers/standard-webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAEjF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,8BAA8B,CACtE,mBAAmB,EACnB,mBAAmB,EACnB;IACE,EAAE,EAAE,YAAY;IAChB,SAAS,EAAE,mBAAmB;IAC9B,SAAS,EAAE,mBAAmB;CAC/B,CACF,CAAC"}

package/dist/providers/stripe.d.ts

@@ -0,0 +1,8 @@
+import type { ProviderDescriptor } from '../internal/provider.js';
+/**
+ * Stripe `Stripe-Signature` header: `t=<timestamp>,v1=<hex>[,v1=<hex>][,v0=...]`.
+ * Whitespace is permitted around comma-separated items. `t` is a singleton and
+ * is signed; repeated `t` is rejected. The signature covers `${t}.<raw body>`.
+ */
+export declare const stripeDescriptor: ProviderDescriptor;
+//# sourceMappingURL=stripe.d.ts.map

package/dist/providers/stripe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stripe.d.ts","sourceRoot":"","sources":["../../src/providers/stripe.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAkC,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAclG;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,kBAgF9B,CAAC"}

package/dist/providers/stripe.js

@@ -0,0 +1,79 @@
+import { concatBytes, utf8 } from '../internal/bytes.js';
+import { decodeHexSignature, decodeLiteralSecret, failure, isCanonicalTimestamp, isSchemeToken, } from './shared.js';
+const HEADER = 'stripe-signature';
+const SCHEME = 'v1';
+const TIMESTAMP_KEY = 't';
+/**
+ * Stripe `Stripe-Signature` header: `t=<timestamp>,v1=<hex>[,v1=<hex>][,v0=...]`.
+ * Whitespace is permitted around comma-separated items. `t` is a singleton and
+ * is signed; repeated `t` is rejected. The signature covers `${t}.<raw body>`.
+ */
+export const stripeDescriptor = {
+    provider: 'stripe',
+    decodeSecret(secret) {
+        // Stripe keys the HMAC with the literal secret string, including `whsec_`.
+        return decodeLiteralSecret(secret, 'Stripe');
+    },
+    parse(headers, rawBody) {
+        const raw = headers.get(HEADER);
+        if (raw === undefined || raw.trim() === '') {
+            return failure('missing-signature', 'No Stripe signature header was provided.');
+        }
+        const signatures = [];
+        let timestampText;
+        let unknownSchemes = 0;
+        for (const rawItem of raw.split(',')) {
+            const item = rawItem.trim();
+            const separator = item.indexOf('=');
+            if (item === '' || separator <= 0 || separator === item.length - 1) {
+                return failure('malformed-signature', 'The Stripe signature header is malformed.');
+            }
+            const key = item.slice(0, separator);
+            const value = item.slice(separator + 1);
+            if (key === TIMESTAMP_KEY) {
+                if (timestampText !== undefined) {
+                    return failure('malformed-signature', 'The Stripe signature header is malformed.');
+                }
+                if (!isCanonicalTimestamp(value)) {
+                    return failure('malformed-signature', 'The Stripe signature header is malformed.');
+                }
+                timestampText = value;
+            }
+            else if (key === SCHEME) {
+                const decoded = decodeHexSignature(value);
+                // A malformed `v1` fails closed even when another `v1` value is valid.
+                if (decoded === null) {
+                    return failure('malformed-signature', 'The Stripe signature header is malformed.');
+                }
+                signatures.push(decoded);
+            }
+            else if (isSchemeToken(key)) {
+                unknownSchemes += 1;
+            }
+            else {
+                return failure('malformed-signature', 'The Stripe signature header is malformed.');
+            }
+        }
+        if (timestampText === undefined) {
+            return failure('missing-timestamp', 'No Stripe signature timestamp was provided.');
+        }
+        if (signatures.length === 0) {
+            return unknownSchemes > 0
+                ? failure('unsupported-scheme', 'No supported Stripe signature scheme was provided.')
+                : failure('missing-signature', 'No Stripe signature value was provided.');
+        }
+        const identity = {
+            deliveryId: null,
+            eventId: null,
+            timestamp: Number(timestampText),
+            authenticatedFields: ['timestamp'],
+        };
+        return {
+            ok: true,
+            signatures,
+            signedContent: concatBytes(utf8(`${timestampText}.`), rawBody),
+            identity,
+        };
+    },
+};
+//# sourceMappingURL=stripe.js.map

package/dist/providers/stripe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stripe.js","sourceRoot":"","sources":["../../src/providers/stripe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAGzD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,OAAO,EACP,oBAAoB,EACpB,aAAa,GACd,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,GAAG,kBAAkB,CAAC;AAClC,MAAM,MAAM,GAAG,IAAI,CAAC;AACpB,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAuB;IAClD,QAAQ,EAAE,QAAQ;IAElB,YAAY,CAAC,MAAc;QACzB,2EAA2E;QAC3E,OAAO,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,OAA0B,EAAE,OAAmB;QACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEhC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC3C,OAAO,OAAO,CAAC,mBAAmB,EAAE,0CAA0C,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,UAAU,GAAiB,EAAE,CAAC;QACpC,IAAI,aAAiC,CAAC;QACtC,IAAI,cAAc,GAAG,CAAC,CAAC;QAEvB,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAEpC,IAAI,IAAI,KAAK,EAAE,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnE,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;YACrF,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YAExC,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;gBAC1B,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;oBAChC,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;gBACrF,CAAC;gBAED,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjC,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;gBACrF,CAAC;gBAED,aAAa,GAAG,KAAK,CAAC;YACxB,CAAC;iBAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;gBAE1C,uEAAuE;gBACvE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACrB,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;gBACrF,CAAC;gBAED,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3B,CAAC;iBAAM,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9B,cAAc,IAAI,CAAC,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAED,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC,mBAAmB,EAAE,6CAA6C,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,cAAc,GAAG,CAAC;gBACvB,CAAC,CAAC,OAAO,CAAC,oBAAoB,EAAE,oDAAoD,CAAC;gBACrF,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,yCAAyC,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,QAAQ,GAAkB;YAC9B,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC;YAChC,mBAAmB,EAAE,CAAC,WAAW,CAAC;SACnC,CAAC;QAEF,OAAO;YACL,EAAE,EAAE,IAAI;YACR,UAAU;YACV,aAAa,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,aAAa,GAAG,CAAC,EAAE,OAAO,CAAC;YAC9D,QAAQ;SACT,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/providers/svix.d.ts

@@ -0,0 +1,10 @@
+import type { ProviderDescriptor } from '../internal/provider.js';
+/**
+ * Svix accepts the branded `svix-*` and canonical `webhook-*` Standard
+ * Webhooks header families. A single family is parsed with the existing
+ * signature -> identity -> timestamp ordering. When both families have any
+ * header present, both must be complete and value-identical; otherwise the
+ * request is malformed. A failed family is never rescued by the other one.
+ */
+export declare const svixDescriptor: ProviderDescriptor;
+//# sourceMappingURL=svix.d.ts.map

package/dist/providers/svix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"svix.d.ts","sourceRoot":"","sources":["../../src/providers/svix.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkC,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AA0ClG;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,EAAE,kBAyB5B,CAAC"}

package/dist/providers/svix.js

@@ -0,0 +1,61 @@
+import { failure } from './shared.js';
+import { createStandardWebhooksProtocol } from './standard-webhooks-protocol.js';
+const BRANDED_HEADERS = {
+    id: 'svix-id',
+    timestamp: 'svix-timestamp',
+    signature: 'svix-signature',
+};
+const CANONICAL_HEADERS = {
+    id: 'webhook-id',
+    timestamp: 'webhook-timestamp',
+    signature: 'webhook-signature',
+};
+const brandedDescriptor = createStandardWebhooksProtocol('svix', 'Svix', BRANDED_HEADERS);
+const canonicalDescriptor = createStandardWebhooksProtocol('svix', 'Svix', CANONICAL_HEADERS);
+function familyPresent(headers, names) {
+    return headers.has(names.id) || headers.has(names.timestamp) || headers.has(names.signature);
+}
+function familyComplete(headers, names) {
+    const id = headers.get(names.id);
+    const timestamp = headers.get(names.timestamp);
+    const signature = headers.get(names.signature);
+    return id !== undefined && id !== ''
+        && timestamp !== undefined && timestamp !== ''
+        && signature !== undefined && signature !== '';
+}
+function familiesEqual(headers) {
+    return familyComplete(headers, BRANDED_HEADERS)
+        && familyComplete(headers, CANONICAL_HEADERS)
+        && headers.get(BRANDED_HEADERS.id) === headers.get(CANONICAL_HEADERS.id)
+        && headers.get(BRANDED_HEADERS.timestamp) === headers.get(CANONICAL_HEADERS.timestamp)
+        && headers.get(BRANDED_HEADERS.signature) === headers.get(CANONICAL_HEADERS.signature);
+}
+/**
+ * Svix accepts the branded `svix-*` and canonical `webhook-*` Standard
+ * Webhooks header families. A single family is parsed with the existing
+ * signature -> identity -> timestamp ordering. When both families have any
+ * header present, both must be complete and value-identical; otherwise the
+ * request is malformed. A failed family is never rescued by the other one.
+ */
+export const svixDescriptor = {
+    provider: 'svix',
+    decodeSecret(secret) {
+        return brandedDescriptor.decodeSecret(secret);
+    },
+    parse(headers, rawBody) {
+        const brandedPresent = familyPresent(headers, BRANDED_HEADERS);
+        const canonicalPresent = familyPresent(headers, CANONICAL_HEADERS);
+        if (brandedPresent && canonicalPresent) {
+            if (!familiesEqual(headers)) {
+                return failure('malformed-signature', 'The Svix signature headers are malformed.');
+            }
+            return brandedDescriptor.parse(headers, rawBody);
+        }
+        if (canonicalPresent)
+            return canonicalDescriptor.parse(headers, rawBody);
+        if (brandedPresent)
+            return brandedDescriptor.parse(headers, rawBody);
+        return failure('missing-signature', 'No Svix signature header was provided.');
+    },
+};
+//# sourceMappingURL=svix.js.map

package/dist/providers/svix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"svix.js","sourceRoot":"","sources":["../../src/providers/svix.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAGjF,MAAM,eAAe,GAAgC;IACnD,EAAE,EAAE,SAAS;IACb,SAAS,EAAE,gBAAgB;IAC3B,SAAS,EAAE,gBAAgB;CAC5B,CAAC;AAEF,MAAM,iBAAiB,GAAgC;IACrD,EAAE,EAAE,YAAY;IAChB,SAAS,EAAE,mBAAmB;IAC9B,SAAS,EAAE,mBAAmB;CAC/B,CAAC;AAEF,MAAM,iBAAiB,GAAG,8BAA8B,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;AAC1F,MAAM,mBAAmB,GAAG,8BAA8B,CAAC,MAAM,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAE9F,SAAS,aAAa,CAAC,OAA0B,EAAE,KAAkC;IACnF,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,cAAc,CAAC,OAA0B,EAAE,KAAkC;IACpF,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAE/C,OAAO,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE;WAC/B,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE;WAC3C,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,aAAa,CAAC,OAA0B;IAC/C,OAAO,cAAc,CAAC,OAAO,EAAE,eAAe,CAAC;WAC1C,cAAc,CAAC,OAAO,EAAE,iBAAiB,CAAC;WAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;WACrE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC;WACnF,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAuB;IAChD,QAAQ,EAAE,MAAM;IAEhB,YAAY,CAAC,MAAc;QACzB,OAAO,iBAAiB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,OAA0B,EAAE,OAAmB;QACnD,MAAM,cAAc,GAAG,aAAa,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/D,MAAM,gBAAgB,GAAG,aAAa,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAEnE,IAAI,cAAc,IAAI,gBAAgB,EAAE,CAAC;YACvC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;YACrF,CAAC;YAED,OAAO,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,gBAAgB;YAAE,OAAO,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEzE,IAAI,cAAc;YAAE,OAAO,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAErE,OAAO,OAAO,CAAC,mBAAmB,EAAE,wCAAwC,CAAC,CAAC;IAChF,CAAC;CACF,CAAC"}

package/dist/providers/vercel.d.ts

@@ -0,0 +1,16 @@
+import type { NormalizedHeaders, ParseResult } from '../internal/provider.js';
+/** Scoped x-vercel-signature webhook recipe; exact bytes and literal UTF-8 keys.
+ * https://vercel.com/docs/webhooks/webhooks-api
+ * Either hex case is accepted as receiver policy. No freshness is inferred.
+ */
+export declare const vercelDescriptor: {
+    provider: "vercel";
+    crypto: {
+        kind: "hmac";
+        hash: "SHA-1";
+        signatureBytes: 20;
+    };
+    decodeSecret(secret: string): Uint8Array;
+    parse(headers: NormalizedHeaders, rawBody: Uint8Array): ParseResult;
+};
+//# sourceMappingURL=vercel.d.ts.map

package/dist/providers/vercel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel.d.ts","sourceRoot":"","sources":["../../src/providers/vercel.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAsB,MAAM,yBAAyB,CAAC;AAGlG;;;GAGG;AACH,eAAO,MAAM,gBAAgB;;;;;;;yBAIN,MAAM,GAAG,UAAU;mBAIzB,iBAAiB,WAAW,UAAU,GAAG,WAAW;CAkBvC,CAAC"}

package/dist/providers/vercel.js

@@ -0,0 +1,37 @@
+import { decodeLiteralSecret, failure } from './shared.js';
+/** Scoped x-vercel-signature webhook recipe; exact bytes and literal UTF-8 keys.
+ * https://vercel.com/docs/webhooks/webhooks-api
+ * Either hex case is accepted as receiver policy. No freshness is inferred.
+ */
+export const vercelDescriptor = {
+    provider: 'vercel',
+    crypto: { kind: 'hmac', hash: 'SHA-1', signatureBytes: 20 },
+    decodeSecret(secret) {
+        return decodeLiteralSecret(secret, 'Vercel');
+    },
+    parse(headers, rawBody) {
+        const raw = headers.get('x-vercel-signature');
+        if (raw === undefined || raw.trim() === '') {
+            return failure('missing-signature', 'No Vercel signature header was provided.');
+        }
+        const signature = decodeSignature(raw);
+        if (signature === null) {
+            return failure('malformed-signature', 'The Vercel signature header is malformed.');
+        }
+        return {
+            ok: true, signatures: [signature], signedContent: rawBody,
+            identity: { deliveryId: null, eventId: null, timestamp: null, authenticatedFields: [] },
+        };
+    },
+};
+/** Deliberately private: the existing shared SHA256 decoder stays 32 bytes. */
+function decodeSignature(value) {
+    if (!/^[a-fA-F0-9]{40}$/.test(value))
+        return null;
+    const bytes = new Uint8Array(20);
+    for (let index = 0; index < bytes.length; index++) {
+        bytes[index] = Number.parseInt(value.slice(index * 2, index * 2 + 2), 16);
+    }
+    return bytes;
+}
+//# sourceMappingURL=vercel.js.map

package/dist/providers/vercel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel.js","sourceRoot":"","sources":["../../src/providers/vercel.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3D;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,QAAQ,EAAE,QAAQ;IAClB,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE;IAE3D,YAAY,CAAC,MAAc;QACzB,OAAO,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,OAA0B,EAAE,OAAmB;QACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAE9C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC3C,OAAO,OAAO,CAAC,mBAAmB,EAAE,0CAA0C,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAEvC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;QACrF,CAAC;QAED,OAAO;YACL,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,OAAO;YACzD,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE;SACxF,CAAC;IACJ,CAAC;CAC2B,CAAC;AAE/B,+EAA+E;AAC/E,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAEjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/providers/workos.d.ts

@@ -0,0 +1,33 @@
+import type { NormalizedHeaders, ParseResult } from '../internal/provider.js';
+/**
+ * WorkOS: `WorkOS-Signature: t=<unix milliseconds>, v1=<64 hex>`.
+ *
+ * The comma-separated field list is validated as a whole before required-field
+ * checks. Segments are trimmed only at their outer edges, so whitespace around
+ * `=` is rejected; field names are case-sensitive. `t` must appear exactly once
+ * and be a canonical nonnegative safe decimal integer in milliseconds (zero is
+ * allowed, leading zeros are not). Every `v1` must be a 32-byte hex digest in
+ * either case; repeated `v1` values form a Hooklatch rotation accept-set, but a
+ * malformed `v1` poisons the header. Unknown field names are validated as
+ * opaque values and then ignored.
+ *
+ * The HMAC-SHA256 covers UTF8(original `t` text + ".") concatenated with the
+ * exact raw body. The secret is the literal, untrimmed UTF-8 text; it is never
+ * Base64-decoded. Invalid-UTF-8 body handling is a Hooklatch byte-preservation
+ * policy, not claimed parity with SDKs that decode the body to a string.
+ * Identity is `timestamp = Number(t) / 1000`; freshness is enforced by core and
+ * is never evaluated here.
+ *
+ * This strict grammar, repeated-v1 accept-set, and millisecond identity are
+ * documented receiver policies, not claims of exact WorkOS SDK parity. No
+ * WorkOS-published signature vector is claimed; tests use synthetic anchors.
+ * Sources:
+ * - https://workos.com/docs/events/data-syncing/webhooks
+ * - https://raw.githubusercontent.com/workos/workos-node/ad8bff226e9b37435f0c62390318d4819f76b3d1/src/common/crypto/signature-provider.ts
+ */
+export declare const workosDescriptor: {
+    provider: "workos";
+    decodeSecret(secret: string): Uint8Array;
+    parse(headers: NormalizedHeaders, rawBody: Uint8Array): ParseResult;
+};
+//# sourceMappingURL=workos.d.ts.map

package/dist/providers/workos.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos.d.ts","sourceRoot":"","sources":["../../src/providers/workos.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAsB,MAAM,yBAAyB,CAAC;AAqBlG;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,gBAAgB;;yBAGN,MAAM,GAAG,UAAU;mBAIzB,iBAAiB,WAAW,UAAU,GAAG,WAAW;CA+F2B,CAAC"}

package/dist/providers/workos.js

@@ -0,0 +1,118 @@
+import { concatBytes, utf8 } from '../internal/bytes.js';
+import { decodeHexSignature, decodeLiteralSecret, failure, isCanonicalTimestamp, isSchemeToken, } from './shared.js';
+const SIGNATURE_HEADER = 'workos-signature';
+const TIMESTAMP_KEY = 't';
+const SIGNATURE_KEY = 'v1';
+/**
+ * Opaque nonempty printable ASCII unknown-field value: no whitespace, commas,
+ * or additional equals signs. This is a bounded Hooklatch grammar, not a
+ * promise to support an unspecified future signature version.
+ */
+const OPAQUE_VALUE = /^[\x21-\x2b\x2d-\x3c\x3e-\x7e]+$/;
+/**
+ * WorkOS: `WorkOS-Signature: t=<unix milliseconds>, v1=<64 hex>`.
+ *
+ * The comma-separated field list is validated as a whole before required-field
+ * checks. Segments are trimmed only at their outer edges, so whitespace around
+ * `=` is rejected; field names are case-sensitive. `t` must appear exactly once
+ * and be a canonical nonnegative safe decimal integer in milliseconds (zero is
+ * allowed, leading zeros are not). Every `v1` must be a 32-byte hex digest in
+ * either case; repeated `v1` values form a Hooklatch rotation accept-set, but a
+ * malformed `v1` poisons the header. Unknown field names are validated as
+ * opaque values and then ignored.
+ *
+ * The HMAC-SHA256 covers UTF8(original `t` text + ".") concatenated with the
+ * exact raw body. The secret is the literal, untrimmed UTF-8 text; it is never
+ * Base64-decoded. Invalid-UTF-8 body handling is a Hooklatch byte-preservation
+ * policy, not claimed parity with SDKs that decode the body to a string.
+ * Identity is `timestamp = Number(t) / 1000`; freshness is enforced by core and
+ * is never evaluated here.
+ *
+ * This strict grammar, repeated-v1 accept-set, and millisecond identity are
+ * documented receiver policies, not claims of exact WorkOS SDK parity. No
+ * WorkOS-published signature vector is claimed; tests use synthetic anchors.
+ * Sources:
+ * - https://workos.com/docs/events/data-syncing/webhooks
+ * - https://raw.githubusercontent.com/workos/workos-node/ad8bff226e9b37435f0c62390318d4819f76b3d1/src/common/crypto/signature-provider.ts
+ */
+export const workosDescriptor = {
+    provider: 'workos',
+    decodeSecret(secret) {
+        return decodeLiteralSecret(secret, 'WorkOS');
+    },
+    parse(headers, rawBody) {
+        const raw = headers.get(SIGNATURE_HEADER);
+        if (raw === undefined || raw.trim() === '') {
+            return failure('missing-signature', 'No WorkOS signature header was provided.');
+        }
+        const signatures = [];
+        let timestampText;
+        let timestampCount = 0;
+        let unknownFields = 0;
+        // Validate the complete structure before any required-field decision.
+        for (const rawSegment of raw.split(',')) {
+            const segment = rawSegment.trim();
+            if (segment === '') {
+                return failure('malformed-signature', 'The WorkOS signature header is malformed.');
+            }
+            // Reject missing keys, empty values, and extra equals signs.
+            const separator = segment.indexOf('=');
+            if (separator <= 0 || separator === segment.length - 1 || segment.indexOf('=', separator + 1) !== -1) {
+                return failure('malformed-signature', 'The WorkOS signature header is malformed.');
+            }
+            const key = segment.slice(0, separator);
+            const value = segment.slice(separator + 1);
+            if (!isSchemeToken(key)) {
+                return failure('malformed-signature', 'The WorkOS signature header is malformed.');
+            }
+            if (key === TIMESTAMP_KEY) {
+                timestampCount += 1;
+                // Duplicate timestamps fail even when the values agree.
+                if (timestampCount > 1) {
+                    return failure('malformed-signature', 'The WorkOS signature header is malformed.');
+                }
+                if (!isCanonicalTimestamp(value)) {
+                    return failure('malformed-signature', 'The WorkOS signature header is malformed.');
+                }
+                timestampText = value;
+                continue;
+            }
+            if (key === SIGNATURE_KEY) {
+                const decoded = decodeHexSignature(value);
+                // One malformed v1 poisons the whole header, even beside a valid v1.
+                if (decoded === null) {
+                    return failure('malformed-signature', 'The WorkOS signature header is malformed.');
+                }
+                signatures.push(decoded);
+                continue;
+            }
+            // Unknown fields are structurally validated, then ignored.
+            if (!OPAQUE_VALUE.test(value)) {
+                return failure('malformed-signature', 'The WorkOS signature header is malformed.');
+            }
+            unknownFields += 1;
+        }
+        // Required-field checks run only after the whole structure validated.
+        if (signatures.length === 0) {
+            return unknownFields > 0
+                ? failure('unsupported-scheme', 'No supported WorkOS signature scheme was provided.')
+                : failure('missing-signature', 'No WorkOS signature value was provided.');
+        }
+        if (timestampText === undefined) {
+            return failure('missing-timestamp', 'No WorkOS timestamp was provided.');
+        }
+        const identity = {
+            deliveryId: null,
+            eventId: null,
+            timestamp: Number(timestampText) / 1000,
+            authenticatedFields: ['timestamp'],
+        };
+        return {
+            ok: true,
+            signatures,
+            signedContent: concatBytes(utf8(`${timestampText}.`), rawBody),
+            identity,
+        };
+    },
+};
+//# sourceMappingURL=workos.js.map

package/dist/providers/workos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos.js","sourceRoot":"","sources":["../../src/providers/workos.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAGzD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,OAAO,EACP,oBAAoB,EACpB,aAAa,GACd,MAAM,aAAa,CAAC;AAErB,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAC5C,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B;;;;GAIG;AACH,MAAM,YAAY,GAAG,kCAAkC,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,QAAQ,EAAE,QAAQ;IAElB,YAAY,CAAC,MAAc;QACzB,OAAO,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,OAA0B,EAAE,OAAmB;QACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAE1C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC3C,OAAO,OAAO,CAAC,mBAAmB,EAAE,0CAA0C,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,UAAU,GAAiB,EAAE,CAAC;QACpC,IAAI,aAAiC,CAAC;QACtC,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,aAAa,GAAG,CAAC,CAAC;QAEtB,sEAAsE;QACtE,KAAK,MAAM,UAAU,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;YAElC,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;gBACnB,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;YACrF,CAAC;YAED,6DAA6D;YAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAEvC,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACrG,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;YACrF,CAAC;YAED,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YAE3C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;YACrF,CAAC;YAED,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;gBAC1B,cAAc,IAAI,CAAC,CAAC;gBAEpB,wDAAwD;gBACxD,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;oBACvB,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;gBACrF,CAAC;gBAED,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjC,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;gBACrF,CAAC;gBAED,aAAa,GAAG,KAAK,CAAC;gBACtB,SAAS;YACX,CAAC;YAED,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;gBAE1C,qEAAqE;gBACrE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACrB,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;gBACrF,CAAC;gBAED,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACzB,SAAS;YACX,CAAC;YAED,2DAA2D;YAC3D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,OAAO,OAAO,CAAC,qBAAqB,EAAE,2CAA2C,CAAC,CAAC;YACrF,CAAC;YAED,aAAa,IAAI,CAAC,CAAC;QACrB,CAAC;QAED,sEAAsE;QACtE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,aAAa,GAAG,CAAC;gBACtB,CAAC,CAAC,OAAO,CAAC,oBAAoB,EAAE,oDAAoD,CAAC;gBACrF,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,yCAAyC,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,QAAQ,GAAkB;YAC9B,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI;YACvC,mBAAmB,EAAE,CAAC,WAAW,CAAC;SACnC,CAAC;QAEF,OAAO;YACL,EAAE,EAAE,IAAI;YACR,UAAU;YACV,aAAa,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,aAAa,GAAG,CAAC,EAAE,OAAO,CAAC;YAC9D,QAAQ;SACT,CAAC;IACJ,CAAC;CAC6F,CAAC"}