hooklatch 0.0.0-stage → 1.0.0

package/dist/cjs/diagnostics/catalog.cjs

@@ -0,0 +1,341 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getVerificationGuidance = getVerificationGuidance;
+exports.getSetupGuidance = getSetupGuidance;
+exports.getProviderDetail = getProviderDetail;
+exports.isVerificationCode = isVerificationCode;
+exports.isSetupCode = isSetupCode;
+const VERIFICATION_GUIDANCE = {
+    'missing-signature': {
+        summary: 'The provider signature header was not present in the request.',
+        possibleCauses: [
+            'A proxy, load balancer, or middleware stripped the signature header.',
+            'The request was not actually sent by the provider.',
+            'The request was modified in transit.',
+        ],
+        suggestions: [
+            'Check that no intermediary removes the signature header.',
+            'Verify the request originates from the provider documented IP ranges.',
+            'Compare expected header names with your middleware configuration.',
+        ],
+    },
+    'malformed-signature': {
+        summary: 'Required signing headers were malformed or conflicted.',
+        possibleCauses: [
+            'The header value was truncated or altered by an intermediary.',
+            'The provider changed its header format.',
+            'The request was not actually sent by the provider.',
+        ],
+        suggestions: [
+            'Compare the raw header value against the provider documentation.',
+            'Check for header-combining proxies that may merge or split values.',
+            'Use synthetic requests to compare header grammar without recording sensitive values.',
+        ],
+    },
+    'unsupported-scheme': {
+        summary: 'Only unsupported or legacy signature schemes were present.',
+        possibleCauses: [
+            'The provider sent a legacy signature format (e.g. SHA-1).',
+            'The signature scheme version is not supported by this release.',
+            'The request was not actually sent by the provider.',
+        ],
+        suggestions: [
+            'Check the provider documentation for supported signature schemes.',
+            'Ensure the provider is configured to send the current scheme version.',
+            'Update the SDK when a new scheme is required.',
+        ],
+    },
+    'invalid-signature': {
+        summary: 'The signature was well-formed but did not authenticate.',
+        possibleCauses: [
+            'The configured secret does not match the provider endpoint secret.',
+            'A secret rotation is in progress and the old secret is still active at the provider.',
+            'The body was modified in transit, compressed, or re-serialized.',
+            'The wrong provider was selected for this request.',
+            'The request was not actually sent by the provider.',
+        ],
+        suggestions: [
+            'Verify the configured secret matches the provider endpoint secret.',
+            'Check whether a secret rotation is in progress and include all active secrets.',
+            'Ensure the raw body is captured before any JSON parsing or re-serialization.',
+            'Confirm the correct provider is selected for this endpoint.',
+        ],
+    },
+    'missing-identity': {
+        summary: 'A required identity metadata header was absent.',
+        possibleCauses: [
+            'The request was not actually sent by the provider.',
+            'An intermediary stripped the header.',
+            'The provider changed its header format.',
+        ],
+        suggestions: [
+            'Compare the incoming headers with the provider documentation.',
+            'Check that no proxy or middleware removes the header.',
+            'Verify the request originates from the provider.',
+        ],
+    },
+    'missing-timestamp': {
+        summary: 'A required signed timestamp header was absent.',
+        possibleCauses: [
+            'The request was not actually sent by the provider.',
+            'An intermediary stripped the header.',
+            'The provider changed its header format.',
+        ],
+        suggestions: [
+            'Compare the incoming headers with the provider documentation.',
+            'Check that no proxy or middleware removes the header.',
+            'Verify the request originates from the provider.',
+        ],
+    },
+    'timestamp-expired': {
+        summary: 'The signed timestamp is older than the configured tolerance.',
+        possibleCauses: [
+            'The request is a replay of an older delivery.',
+            'Clock skew exists between the provider and this host.',
+            'The body was delayed by a queue or retry mechanism.',
+        ],
+        suggestions: [
+            'Check clock synchronization between provider and host.',
+            'Review provider delivery timing before changing the configured tolerance.',
+            'Investigate whether the request is a replay attack.',
+        ],
+    },
+    'timestamp-future': {
+        summary: 'The signed timestamp is newer than the configured tolerance.',
+        possibleCauses: [
+            'Clock skew exists between the provider and this host.',
+            'The provider clock is ahead of this host.',
+        ],
+        suggestions: [
+            'Check clock synchronization between provider and host.',
+            'Review provider clock behavior before changing the configured tolerance.',
+        ],
+    },
+    'body-too-large': {
+        summary: 'The request body exceeded the configured size limit.',
+        possibleCauses: [
+            'The legitimate payload exceeds the configured maxBodyBytes.',
+            'The body was inflated by compression middleware.',
+            'A malicious or malformed request sent an oversized body.',
+        ],
+        suggestions: [
+            'Increase maxBodyBytes if the provider legitimately sends larger payloads.',
+            'Check for compression middleware that may inflate the body.',
+            'Reject the request if the size is unexpected for this provider.',
+        ],
+    },
+};
+/** Static guidance for setup/runtime error codes. */
+const SETUP_GUIDANCE = {
+    'unknown-provider': {
+        summary: 'The specified provider is not supported.',
+        possibleCauses: [
+            'The provider name contains a typo.',
+            'The provider has not been added to the SDK yet.',
+        ],
+        suggestions: [
+            'Check the provider name against the supported list.',
+            'Update the SDK to a version that supports the provider.',
+        ],
+    },
+    'missing-secrets': {
+        summary: 'No signing secrets were configured.',
+        possibleCauses: [
+            'The secrets option was omitted.',
+            'The secrets array was empty.',
+        ],
+        suggestions: [
+            'Provide at least one active signing secret.',
+            'Load secrets from environment variables or a secrets manager.',
+        ],
+    },
+    'invalid-secret': {
+        summary: 'A configured secret failed validation.',
+        possibleCauses: [
+            'The secret is empty or contains only whitespace.',
+            'The secret format does not match the provider requirements.',
+            'The secret was copied incorrectly from the provider dashboard.',
+        ],
+        suggestions: [
+            'Verify the secret matches the provider documentation format.',
+            'Check for trailing whitespace or newline characters.',
+            'Regenerate the secret at the provider if necessary.',
+        ],
+    },
+    'invalid-options': {
+        summary: 'The verification options were malformed.',
+        possibleCauses: [
+            'toleranceSeconds is negative or non-finite.',
+            'maxBodyBytes is not a positive safe integer.',
+            'The now function is not callable.',
+        ],
+        suggestions: [
+            'Check toleranceSeconds is a non-negative finite number.',
+            'Check maxBodyBytes is a positive safe integer.',
+            'Check that now is a function returning epoch seconds.',
+        ],
+    },
+    'invalid-input': {
+        summary: 'The request or header input was malformed.',
+        possibleCauses: [
+            'The header input was not a Headers, tuple list, or record.',
+            'A header value contained illegal characters.',
+            'The input object was null or undefined.',
+        ],
+        suggestions: [
+            'Ensure headers are provided as a Headers, tuple list, or plain record.',
+            'Check for null or undefined header values.',
+            'Validate header input before calling verify.',
+        ],
+    },
+    'body-consumed': {
+        summary: 'The Request body was already read before verification.',
+        possibleCauses: [
+            'A middleware or handler read the body before calling verifyRequest.',
+            'The same Request object was processed twice.',
+        ],
+        suggestions: [
+            'Call verifyRequest before any other body reads.',
+            'Use createVerifier with captured raw bytes for multi-stage processing.',
+            'Clone the Request if multiple consumers need the body.',
+        ],
+    },
+    'body-read-failed': {
+        summary: 'The request body stream could not be read.',
+        possibleCauses: [
+            'The client disconnected mid-body.',
+            'A platform streaming error occurred.',
+            'The body was locked by another consumer.',
+        ],
+        suggestions: [
+            'Check client connection stability.',
+            'Retry the request if the failure is transient.',
+            'Inspect platform logs for streaming errors.',
+        ],
+    },
+    'crypto-unavailable': {
+        summary: 'Web Crypto is not available in this environment.',
+        possibleCauses: [
+            'The runtime does not provide globalThis.crypto.subtle.',
+            'The environment is not Node 22+ or a compatible Workers runtime.',
+        ],
+        suggestions: [
+            'Ensure the runtime is Node 22+ or a Workers-compatible environment.',
+            'Check that crypto.subtle is available at global scope.',
+            'Update the runtime if it is below the minimum supported version.',
+        ],
+    },
+    'internal': {
+        summary: 'An unexpected internal error occurred.',
+        possibleCauses: [
+            'An unhandled exception in the verification pipeline.',
+            'A platform-specific failure in cryptographic operations.',
+        ],
+        suggestions: [
+            'Report this issue with the SDK version and runtime details.',
+            'Retry the request if the failure may be transient.',
+            'Check for known issues in the SDK release notes.',
+        ],
+    },
+};
+const PROVIDER_DETAIL = {
+    vercel: {
+        expectedHeaders: ['x-vercel-signature'],
+        grammar: 'Exactly 40 hexadecimal digits encoding HMAC-SHA1 over exact raw body bytes; no timestamp or identity extraction.',
+    },
+    fal: {
+        expectedHeaders: ['x-fal-webhook-signature', 'x-fal-webhook-request-id', 'x-fal-webhook-user-id', 'x-fal-webhook-timestamp'],
+        grammar: 'Exactly 128 hexadecimal signature digits; visible ASCII request and user IDs excluding commas; canonical nonnegative integer seconds. Ed25519 authenticates request ID, user ID, timestamp and the lowercase SHA256 raw-body digest. Static trusted raw public keys and exact expected user ID are required.',
+    },
+    stripe: {
+        expectedHeaders: ['Stripe-Signature'],
+        grammar: 'Comma-separated key=value pairs: t=<unix-seconds>,v1=<hex-signature>[,v1=<hex-signature>]',
+    },
+    github: {
+        expectedHeaders: ['X-Hub-Signature-256'],
+        grammar: 'sha256=<64 hexadecimal digits; letter case is ignored>',
+    },
+    shopify: {
+        expectedHeaders: ['X-Shopify-Hmac-Sha256'],
+        grammar: 'Canonical Base64-encoded HMAC-SHA256 signature',
+    },
+    'standard-webhooks': {
+        expectedHeaders: ['webhook-id', 'webhook-timestamp', 'webhook-signature'],
+        grammar: 'Space-delimited list of v1,<base64-signature> tokens',
+    },
+    clerk: {
+        expectedHeaders: ['svix-id', 'svix-timestamp', 'svix-signature'],
+        grammar: 'Space-delimited list of v1,<base64-signature> tokens',
+    },
+    svix: {
+        expectedHeaders: ['svix-id', 'svix-timestamp', 'svix-signature', 'webhook-id', 'webhook-timestamp', 'webhook-signature'],
+        grammar: 'Space-delimited list of v1,<base64-signature> tokens (branded or canonical family)',
+    },
+    razorpay: {
+        expectedHeaders: ['X-Razorpay-Signature'],
+        grammar: 'A single 64-digit hexadecimal HMAC-SHA256 signature over the raw body',
+    },
+    paddle: {
+        expectedHeaders: ['Paddle-Signature'],
+        grammar: 'Semicolon-separated ts=<unix-seconds>;h1=<64 hexadecimal digits>, with repeated h1 allowed',
+    },
+    'lemon-squeezy': {
+        expectedHeaders: ['X-Signature'],
+        grammar: 'A single 64-digit hexadecimal HMAC-SHA256 signature over the raw body',
+    },
+    'dodo-payments': {
+        expectedHeaders: ['webhook-id', 'webhook-timestamp', 'webhook-signature'],
+        grammar: 'Space-delimited list of v1,<base64-signature> tokens over id.timestamp.body',
+    },
+    gitlab: {
+        expectedHeaders: ['webhook-id', 'webhook-timestamp', 'webhook-signature'],
+        grammar: 'Signing-token mode: space-delimited v1,<base64-signature> tokens; no X-Gitlab-Token fallback',
+    },
+    replicate: {
+        expectedHeaders: ['webhook-id', 'webhook-timestamp', 'webhook-signature'],
+        grammar: 'Space-delimited list of v1,<base64-signature> tokens over id.timestamp.body',
+    },
+    workos: {
+        expectedHeaders: ['WorkOS-Signature'],
+        grammar: 'Comma-separated t=<unix-milliseconds>,v1=<64 hexadecimal digits>; one t, repeated valid v1 allowed',
+    },
+    sentry: {
+        expectedHeaders: ['Sentry-Hook-Signature'],
+        grammar: 'Sentry App mode: a single bare 64-digit hexadecimal HMAC-SHA256 signature over the raw body',
+    },
+    doppler: {
+        expectedHeaders: ['X-Doppler-Signature'],
+        grammar: 'Signed mode: sha256=<64 hexadecimal digits> over the raw body; no Basic/Bearer fallback',
+    },
+    linear: {
+        expectedHeaders: ['Linear-Signature'],
+        grammar: 'A single bare 64-digit hexadecimal HMAC-SHA256 signature over exact raw body bytes. Signature authentication only: body claims are not extracted and unsigned header timestamps do not establish freshness.',
+    },
+    sanity: {
+        expectedHeaders: ['sanity-webhook-signature'],
+        grammar: 'Exactly t=<unix-milliseconds>,v1=<43 canonical unpadded Base64url characters>; one of each field, no whitespace',
+    },
+    grafana: {
+        expectedHeaders: [],
+        grammar: 'Configured signature header: 64 hexadecimal digits. Body mode signs raw bytes; timestamped mode also requires the configured timestamp header with canonical Unix seconds and signs timestamp:body.',
+    },
+    polar: {
+        expectedHeaders: ['webhook-id', 'webhook-timestamp', 'webhook-signature'],
+        grammar: 'Space-delimited v1,<base64-signature> tokens over id.timestamp.body; current or legacy secretMode is trusted application configuration, never detected from a request.',
+    },
+};
+function getVerificationGuidance(reason) {
+    return VERIFICATION_GUIDANCE[reason];
+}
+function getSetupGuidance(code) {
+    return SETUP_GUIDANCE[code];
+}
+function getProviderDetail(provider) {
+    return PROVIDER_DETAIL[provider];
+}
+function isVerificationCode(code) {
+    return typeof code === 'string' && Object.hasOwn(VERIFICATION_GUIDANCE, code);
+}
+function isSetupCode(code) {
+    return typeof code === 'string' && Object.hasOwn(SETUP_GUIDANCE, code);
+}

package/dist/cjs/diagnostics/catalog.d.cts

@@ -0,0 +1,19 @@
+import type { HooklatchErrorCode, Provider, VerificationFailureReason } from '../types.cjs';
+import type { DiagnosticCode } from './types.cjs';
+/** Static guidance for verification failure reasons. */
+interface Guidance {
+    readonly summary: string;
+    readonly possibleCauses: readonly string[];
+    readonly suggestions: readonly string[];
+}
+/** Provider-specific verbose detail: expected headers and grammar. */
+interface ProviderDetail {
+    readonly expectedHeaders: readonly string[];
+    readonly grammar: string;
+}
+export declare function getVerificationGuidance(reason: VerificationFailureReason): Guidance;
+export declare function getSetupGuidance(code: HooklatchErrorCode): Guidance;
+export declare function getProviderDetail(provider: Provider): ProviderDetail | undefined;
+export declare function isVerificationCode(code: DiagnosticCode): code is VerificationFailureReason;
+export declare function isSetupCode(code: DiagnosticCode): code is HooklatchErrorCode;
+export {};

package/dist/cjs/diagnostics/index.cjs

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.diagnose = diagnose;
+const errors_js_1 = require("../errors.cjs");
+const index_js_1 = require("../providers/index.cjs");
+const catalog_js_1 = require("./catalog.cjs");
+function isRecord(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === null || prototype === Object.prototype;
+}
+function isProvider(value) {
+    return typeof value === 'string' && index_js_1.SUPPORTED_PROVIDERS.some((provider) => provider === value);
+}
+function isBoolean(value) { return typeof value === 'boolean'; }
+function validateProvider(provider) {
+    if (provider === undefined)
+        return undefined;
+    if (isProvider(provider)) {
+        return provider;
+    }
+    throw new errors_js_1.HooklatchError('invalid-input', 'Invalid provider name.');
+}
+function normalizeOptions(options) {
+    if (!isRecord(options) || (options.verbose !== undefined && !isBoolean(options.verbose))) {
+        throw new errors_js_1.HooklatchError('invalid-input', 'Invalid diagnostic options.');
+    }
+    const provider = validateProvider(options.provider);
+    return provider !== undefined
+        ? { provider, verbose: options.verbose === true }
+        : { verbose: options.verbose === true };
+}
+function buildDiagnostic(code, kind, guidance, provider, detail) {
+    const result = {
+        code,
+        kind,
+        summary: guidance.summary,
+        possibleCauses: [...guidance.possibleCauses],
+        suggestions: [...guidance.suggestions],
+    };
+    if (provider !== undefined) {
+        Object.assign(result, { provider });
+    }
+    if (detail !== undefined) {
+        Object.assign(result, { detail: { expectedHeaders: [...detail.expectedHeaders], grammar: detail.grammar } });
+    }
+    return result;
+}
+function diagnoseValidated(input, options) {
+    if (input instanceof errors_js_1.HooklatchError) {
+        const code = input.code;
+        if (!(0, catalog_js_1.isSetupCode)(code))
+            throw new errors_js_1.HooklatchError('invalid-input', 'Invalid diagnostic input.');
+        const normalized = options !== undefined ? normalizeOptions(options) : undefined;
+        const provider = normalized?.provider;
+        const verbose = normalized?.verbose;
+        const guidance = (0, catalog_js_1.getSetupGuidance)(code);
+        if (guidance === undefined) {
+            throw new errors_js_1.HooklatchError('invalid-input', 'Invalid diagnostic input.');
+        }
+        const detail = provider !== undefined && verbose === true ? (0, catalog_js_1.getProviderDetail)(provider) : undefined;
+        return buildDiagnostic(code, 'setup', guidance, provider, detail);
+    }
+    if (!isRecord(input)) {
+        throw new errors_js_1.HooklatchError('invalid-input', 'Invalid diagnostic input.');
+    }
+    const { ok, reason: code, provider: failureProvider } = input;
+    if (ok !== false || !(0, catalog_js_1.isVerificationCode)(code) || !isProvider(failureProvider)) {
+        throw new errors_js_1.HooklatchError('invalid-input', 'Invalid diagnostic input.');
+    }
+    const normalized = options !== undefined ? normalizeOptions(options) : undefined;
+    if (normalized?.provider !== undefined && normalized.provider !== failureProvider) {
+        throw new errors_js_1.HooklatchError('invalid-input', 'Provider mismatch.');
+    }
+    const provider = failureProvider ?? normalized?.provider;
+    const verbose = normalized?.verbose;
+    const guidance = (0, catalog_js_1.getVerificationGuidance)(code);
+    const detail = provider !== undefined && verbose === true ? (0, catalog_js_1.getProviderDetail)(provider) : undefined;
+    return buildDiagnostic(code, 'verification', guidance, provider, detail);
+}
+function diagnose(input, options) {
+    try {
+        return diagnoseValidated(input, options);
+    }
+    catch {
+        // Untrusted accessors/proxies may throw; their messages must not escape.
+        throw new errors_js_1.HooklatchError('invalid-input', 'Invalid diagnostic input.');
+    }
+}

package/dist/cjs/diagnostics/index.d.cts

@@ -0,0 +1,5 @@
+import { HooklatchError } from '../errors.cjs';
+import type { VerificationFailure } from '../types.cjs';
+import type { Diagnostic, DiagnosticOptions } from './types.cjs';
+export declare function diagnose(input: VerificationFailure | HooklatchError, options?: DiagnosticOptions): Diagnostic;
+export type { Diagnostic, DiagnosticOptions, DiagnosticCode } from './types.cjs';

package/dist/cjs/diagnostics/types.cjs

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/diagnostics/types.d.cts

@@ -0,0 +1,20 @@
+import type { HooklatchErrorCode, Provider, VerificationFailureReason } from '../types.cjs';
+/** Stable diagnostic codes; guidance text is intended for people. */
+export type DiagnosticCode = VerificationFailureReason | HooklatchErrorCode;
+export interface DiagnosticOptions {
+    readonly provider?: Provider;
+    readonly verbose?: boolean;
+}
+/** Only allowlisted guidance and validated provider names enter this output. */
+export interface Diagnostic {
+    readonly code: DiagnosticCode;
+    readonly kind: 'verification' | 'setup';
+    readonly provider?: Provider;
+    readonly summary: string;
+    readonly possibleCauses: readonly string[];
+    readonly suggestions: readonly string[];
+    readonly detail?: {
+        readonly expectedHeaders: readonly string[];
+        readonly grammar: string;
+    };
+}

package/dist/cjs/errors.cjs

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HooklatchError = void 0;
+/** Operational error. Messages deliberately exclude request and credential data. */
+class HooklatchError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'HooklatchError';
+        this.code = code;
+    }
+}
+exports.HooklatchError = HooklatchError;

package/dist/cjs/errors.d.cts

@@ -0,0 +1,6 @@
+import type { HooklatchErrorCode } from './types.cjs';
+/** Operational error. Messages deliberately exclude request and credential data. */
+export declare class HooklatchError extends Error {
+    readonly code: HooklatchErrorCode;
+    constructor(code: HooklatchErrorCode, message: string);
+}

package/dist/cjs/index.cjs

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HooklatchError = exports.createVerifier = exports.verifyRequest = exports.verify = void 0;
+var core_js_1 = require("./core.cjs");
+Object.defineProperty(exports, "verify", { enumerable: true, get: function () { return core_js_1.verify; } });
+Object.defineProperty(exports, "verifyRequest", { enumerable: true, get: function () { return core_js_1.verifyRequest; } });
+Object.defineProperty(exports, "createVerifier", { enumerable: true, get: function () { return core_js_1.createVerifier; } });
+var errors_js_1 = require("./errors.cjs");
+Object.defineProperty(exports, "HooklatchError", { enumerable: true, get: function () { return errors_js_1.HooklatchError; } });

package/dist/cjs/index.d.cts

@@ -0,0 +1,3 @@
+export { verify, verifyRequest, createVerifier } from './core.cjs';
+export { HooklatchError } from './errors.cjs';
+export type { Provider, HeaderInput, WebhookRequest, VerifyOptions, FalVerifyOptions, GrafanaOptions, PolarOptions, IdentityField, EventIdentity, VerificationFailureReason, VerificationSuccess, VerificationFailure, VerificationResult, HooklatchErrorCode, FailureDetails, } from './types.cjs';

package/dist/cjs/internal/body.cjs

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readBody = readBody;
+const errors_js_1 = require("../errors.cjs");
+/** null means size limit exceeded. Reads actual chunks, not trusted length claims. */
+async function readBody(request, maxBodyBytes) {
+    if (request.bodyUsed || request.body?.locked)
+        throw new errors_js_1.HooklatchError('body-consumed', 'Request body has already been consumed.');
+    if (!request.body)
+        return new Uint8Array();
+    let reader;
+    try {
+        reader = request.body.getReader();
+    }
+    catch {
+        throw new errors_js_1.HooklatchError('body-read-failed', 'Unable to read request body.');
+    }
+    // Bound bookkeeping as well as byte storage: a chunk array can grow very
+    // large even for a tiny body, and spreading it exceeds JS argument limits.
+    let output = new Uint8Array(Math.min(maxBodyBytes, 8192));
+    let size = 0;
+    try {
+        while (true) {
+            const chunk = await reader.read();
+            if (chunk.done)
+                break;
+            if (!(chunk.value instanceof Uint8Array))
+                throw new Error('Invalid byte stream');
+            size += chunk.value.byteLength;
+            if (size > maxBodyBytes) {
+                // Cancellation must not hold the response hostage to a stalled producer.
+                void reader.cancel().catch(() => undefined);
+                return null;
+            }
+            if (size > output.byteLength) {
+                const grown = new Uint8Array(Math.min(maxBodyBytes, Math.max(size, output.byteLength * 2)));
+                grown.set(output);
+                output = grown;
+            }
+            output.set(chunk.value, size - chunk.value.byteLength);
+        }
+        return output.slice(0, size);
+    }
+    catch {
+        throw new errors_js_1.HooklatchError('body-read-failed', 'Unable to read request body.');
+    }
+    finally {
+        reader.releaseLock();
+    }
+}

package/dist/cjs/internal/body.d.cts

@@ -0,0 +1,2 @@
+/** null means size limit exceeded. Reads actual chunks, not trusted length claims. */
+export declare function readBody(request: Request, maxBodyBytes: number): Promise<Uint8Array | null>;

package/dist/cjs/internal/bytes.cjs

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.utf8 = utf8;
+exports.concatBytes = concatBytes;
+exports.decodeHex = decodeHex;
+exports.decodeBase64 = decodeBase64;
+function utf8(value) { return new TextEncoder().encode(value); }
+function concatBytes(...chunks) {
+    const output = new Uint8Array(chunks.reduce((sum, chunk) => sum + chunk.byteLength, 0));
+    let offset = 0;
+    for (const chunk of chunks) {
+        output.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return output;
+}
+function decodeHex(value) {
+    if (value.length % 2 !== 0 || !/^[\da-f]*$/i.test(value))
+        return null;
+    const output = new Uint8Array(value.length / 2);
+    for (let i = 0; i < output.length; i += 1)
+        output[i] = Number.parseInt(value.slice(i * 2, i * 2 + 2), 16);
+    return output;
+}
+function decodeBase64(value) {
+    if (!/^[A-Za-z0-9+/]*={0,2}$/.test(value))
+        return null;
+    const unpadded = value.replace(/=+$/, '');
+    if (unpadded.length % 4 === 1)
+        return null;
+    const padded = unpadded + '='.repeat((4 - unpadded.length % 4) % 4);
+    if (value.includes('=') && value !== padded)
+        return null;
+    try {
+        const binary = atob(padded);
+        if (btoa(binary) !== padded)
+            return null;
+        return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+    }
+    catch {
+        return null;
+    }
+}

package/dist/cjs/internal/bytes.d.cts

@@ -0,0 +1,4 @@
+export declare function utf8(value: string): Uint8Array;
+export declare function concatBytes(...chunks: Uint8Array[]): Uint8Array;
+export declare function decodeHex(value: string): Uint8Array | null;
+export declare function decodeBase64(value: string): Uint8Array | null;