hooklatch 0.0.0-stage → 1.0.0

package/dist/cjs/internal/crypto.cjs

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyHmac = verifyHmac;
+exports.verifyEd25519 = verifyEd25519;
+const errors_js_1 = require("../errors.cjs");
+function isUnsupported(error) {
+    return error !== null && typeof error === 'object' && 'name' in error && error.name === 'NotSupportedError';
+}
+async function verifyHmac(keys, signatures, content, policy = { kind: 'hmac', hash: 'SHA-256', signatureBytes: 32 }) {
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle)
+        throw new errors_js_1.HooklatchError('crypto-unavailable', 'Web Crypto is unavailable.');
+    try {
+        for (const bytes of keys) {
+            const key = await subtle.importKey('raw', new Uint8Array(bytes), { name: 'HMAC', hash: policy.hash }, false, ['verify']);
+            for (const signature of signatures) {
+                if (signature.byteLength !== policy.signatureBytes)
+                    continue;
+                if (await subtle.verify('HMAC', key, new Uint8Array(signature), new Uint8Array(content)))
+                    return true;
+            }
+        }
+        return false;
+    }
+    catch (error) {
+        if (isUnsupported(error))
+            throw new errors_js_1.HooklatchError('crypto-unavailable', 'Web Crypto is unavailable.');
+        throw new errors_js_1.HooklatchError('internal', 'Cryptographic verification failed.');
+    }
+}
+async function verifyEd25519(keys, signatures, content) {
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle)
+        throw new errors_js_1.HooklatchError('crypto-unavailable', 'Web Crypto is unavailable.');
+    try {
+        for (const bytes of keys) {
+            const key = await subtle.importKey('raw', new Uint8Array(bytes), 'Ed25519', false, ['verify']);
+            for (const signature of signatures) {
+                if (signature.byteLength !== 64)
+                    continue;
+                if (await subtle.verify('Ed25519', key, new Uint8Array(signature), new Uint8Array(content)))
+                    return true;
+            }
+        }
+        return false;
+    }
+    catch (error) {
+        if (isUnsupported(error))
+            throw new errors_js_1.HooklatchError('crypto-unavailable', 'Web Crypto is unavailable.');
+        throw new errors_js_1.HooklatchError('internal', 'Cryptographic verification failed.');
+    }
+}

package/dist/cjs/internal/crypto.d.cts

@@ -0,0 +1,3 @@
+import type { HmacPolicy } from './provider.cjs';
+export declare function verifyHmac(keys: readonly Uint8Array[], signatures: readonly Uint8Array[], content: Uint8Array, policy?: HmacPolicy): Promise<boolean>;
+export declare function verifyEd25519(keys: readonly Uint8Array[], signatures: readonly Uint8Array[], content: Uint8Array): Promise<boolean>;

package/dist/cjs/internal/headers.cjs

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeHeaders = normalizeHeaders;
+const errors_js_1 = require("../errors.cjs");
+function isHeaderName(name) {
+    return typeof name === 'string' && /^[!#$%&'*+.^_`|~\da-z-]+$/i.test(name);
+}
+function isHeaderValue(value, opaque) {
+    return typeof value === 'string' && (opaque || !/[\r\n\0]/.test(value));
+}
+function isHeaderRecord(input) {
+    return input !== null && typeof input === 'object';
+}
+function isHeaderValues(value) {
+    return Array.isArray(value);
+}
+/** Opaque values are used only by fal so its signed-field grammar owns rejection. */
+const FAL_HEADER_NAMES = new Set([
+    'x-fal-webhook-signature', 'x-fal-webhook-request-id',
+    'x-fal-webhook-user-id', 'x-fal-webhook-timestamp',
+]);
+function isFalHeaderName(name) {
+    return typeof name === 'string' && FAL_HEADER_NAMES.has(name.toLowerCase());
+}
+function normalizeHeaders(input, opaqueValues = false) {
+    const result = new Map();
+    const invalid = () => { throw new errors_js_1.HooklatchError('invalid-input', 'Invalid header input.'); };
+    const append = (name, value) => {
+        if (opaqueValues && !isFalHeaderName(name))
+            return;
+        if (!isHeaderName(name) || !isHeaderValue(value, opaqueValues))
+            invalid();
+        const key = name.toLowerCase();
+        const previous = result.get(key);
+        result.set(key, previous === undefined ? value : `${previous}, ${value}`);
+    };
+    if (input instanceof Headers) {
+        input.forEach((value, key) => append(key, value));
+    }
+    else if (Array.isArray(input)) {
+        for (const entry of input) {
+            if (!Array.isArray(entry) || entry.length !== 2)
+                invalid();
+            append(entry[0], entry[1]);
+        }
+    }
+    else if (isHeaderRecord(input)) {
+        const entries = [];
+        if (opaqueValues) {
+            for (const key of Object.keys(input)) {
+                if (isFalHeaderName(key))
+                    entries.push([key, input[key]]);
+            }
+        }
+        else
+            entries.push(...Object.entries(input));
+        for (const [key, value] of entries) {
+            if (value === undefined)
+                continue;
+            if (isHeaderValues(value)) {
+                for (const item of value)
+                    append(key, item);
+            }
+            else {
+                append(key, value);
+            }
+        }
+    }
+    else
+        invalid();
+    return result;
+}

package/dist/cjs/internal/headers.d.cts

@@ -0,0 +1,2 @@
+import type { HeaderInput } from '../types.cjs';
+export declare function normalizeHeaders(input: HeaderInput, opaqueValues?: boolean): Map<string, string>;

package/dist/cjs/internal/options.cjs

@@ -0,0 +1,130 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeOptions = normalizeOptions;
+const errors_js_1 = require("../errors.cjs");
+const index_js_1 = require("../providers/index.cjs");
+const provider_options_js_1 = require("./provider-options.cjs");
+function isOptionsObject(options) {
+    return options !== null && typeof options === 'object' && !Array.isArray(options);
+}
+function isNonEmptySecret(secret) {
+    return typeof secret === 'string' && secret.length > 0;
+}
+function isClock(now) {
+    return typeof now === 'function';
+}
+function invalidOptions() {
+    throw new errors_js_1.HooklatchError('invalid-options', 'Invalid verification options.');
+}
+function isUserId(value) {
+    return typeof value === 'string' && /^[\x21-\x2b\x2d-\x7e]{1,1024}$/.test(value);
+}
+/** Data descriptors avoid invoking credential accessors, including non-enumerable ones. */
+function ownData(options, name) {
+    const property = observe(() => Object.getOwnPropertyDescriptor(options, name));
+    if (!property || !Object.hasOwn(property, 'value'))
+        invalidOptions();
+    return property;
+}
+function isKeyArray(value) {
+    return Array.isArray(value);
+}
+function snapshotFal(options) {
+    for (const field of ['secrets', 'secret', 'providerOptions']) {
+        if (observe(() => Object.hasOwn(options, field)))
+            invalidOptions();
+    }
+    const input = ownData(options, 'publicKeys').value;
+    const expectedUserId = ownData(options, 'expectedUserId').value;
+    if (!isUserId(expectedUserId))
+        invalidOptions();
+    const values = observe(() => {
+        if (!isKeyArray(input))
+            invalidOptions();
+        return input;
+    });
+    const length = observe(() => values.length);
+    if (!Number.isSafeInteger(length) || length < 1 || length > 16)
+        invalidOptions();
+    const publicKeys = [];
+    for (let index = 0; index < length; index++) {
+        const key = ownData(values, String(index)).value;
+        publicKeys.push(observe(() => {
+            if (!(key instanceof Uint8Array))
+                invalidOptions();
+            const bytes = new Uint8Array(32);
+            let offset = 0;
+            // The intrinsic iterator reads real view bytes and rejects proxies/detached views.
+            // Stop at byte 33 so malformed configuration cannot allocate an oversized copy.
+            for (const byte of Uint8Array.prototype.values.call(key)) {
+                if (offset === 32)
+                    invalidOptions();
+                bytes[offset++] = byte;
+            }
+            if (offset !== 32)
+                invalidOptions();
+            return bytes;
+        }));
+    }
+    return { publicKeys, expectedUserId };
+}
+/** Only observations of caller-owned data are caught; authored errors retain their codes. */
+function observe(read) {
+    try {
+        return read();
+    }
+    catch {
+        return invalidOptions();
+    }
+}
+function normalizeOptions(options) {
+    if (!observe(() => isOptionsObject(options)))
+        invalidOptions();
+    const provider = observe(() => options.provider);
+    if (!index_js_1.SUPPORTED_PROVIDERS.includes(provider)) {
+        throw new errors_js_1.HooklatchError('unknown-provider', 'Unsupported webhook provider.');
+    }
+    const fal = provider === 'fal' ? snapshotFal(options) : undefined;
+    const secrets = provider === 'fal' ? [] : observe(() => options.secrets);
+    if (provider !== 'fal' && (!observe(() => Array.isArray(secrets)) || observe(() => secrets?.length) === 0)) {
+        throw new errors_js_1.HooklatchError('missing-secrets', 'At least one signing secret is required.');
+    }
+    const secretSnapshot = observe(() => [...(secrets ?? [])]);
+    if (secretSnapshot.some((secret) => !isNonEmptySecret(secret))) {
+        throw new errors_js_1.HooklatchError('invalid-secret', 'Invalid signing secret.');
+    }
+    const supplied = observe(() => Object.hasOwn(options, 'providerOptions'));
+    const configured = supplied ? observe(() => options.providerOptions) : undefined;
+    if (supplied && configured === undefined)
+        invalidOptions();
+    if (provider !== 'grafana' && provider !== 'polar' && supplied)
+        invalidOptions();
+    if (provider === 'vercel' && observe(() => Object.hasOwn(options, 'publicKeys') || Object.hasOwn(options, 'expectedUserId')))
+        invalidOptions();
+    const grafana = provider === 'grafana' ? observe(() => (0, provider_options_js_1.snapshotGrafanaOptions)(configured)) : undefined;
+    const polar = provider === 'polar' && supplied ? observe(() => (0, provider_options_js_1.snapshotPolarOptions)(configured)) : undefined;
+    const defaultTolerance = provider === 'paddle' ? 5 : provider === 'workos' ? 180 : 300;
+    const toleranceSeconds = observe(() => options.toleranceSeconds) ?? defaultTolerance;
+    const maxBodyBytes = observe(() => options.maxBodyBytes) ?? 1048576;
+    const now = observe(() => options.now);
+    if (!Number.isFinite(toleranceSeconds) || toleranceSeconds < 0
+        || !Number.isSafeInteger(maxBodyBytes) || maxBodyBytes <= 0
+        || (now !== undefined && !isClock(now)))
+        invalidOptions();
+    const common = { toleranceSeconds, maxBodyBytes,
+        now: now ?? (() => (provider === 'workos' || provider === 'sanity') ? Date.now() / 1000 : Math.floor(Date.now() / 1000)) };
+    if (provider === 'fal') {
+        if (fal === undefined)
+            invalidOptions();
+        return { ...common, provider, ...fal };
+    }
+    const hmac = { ...common, secrets: secretSnapshot };
+    if (provider === 'grafana') {
+        if (grafana === undefined)
+            invalidOptions();
+        return { ...hmac, provider, providerOptions: grafana };
+    }
+    if (provider === 'polar')
+        return { ...hmac, provider, ...(polar !== undefined && { providerOptions: polar }) };
+    return { ...hmac, provider };
+}

package/dist/cjs/internal/options.d.cts

@@ -0,0 +1,7 @@
+import type { VerifyOptions } from '../types.cjs';
+export type NormalizedOptions = VerifyOptions & {
+    readonly toleranceSeconds: number;
+    readonly maxBodyBytes: number;
+    readonly now: () => number;
+};
+export declare function normalizeOptions(options: VerifyOptions): NormalizedOptions;

package/dist/cjs/internal/prepare.cjs

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.prepareVerification = prepareVerification;
+const index_js_1 = require("../providers/index.cjs");
+const options_js_1 = require("./options.cjs");
+const verification_js_1 = require("./verification.cjs");
+/** Shared preparation validates and snapshots trusted options before any request body is read. */
+function prepareVerification(options) {
+    const normalized = (0, options_js_1.normalizeOptions)(options);
+    return (0, verification_js_1.prepareVerifier)(normalized, (0, index_js_1.getProviderDescriptor)(normalized.provider, normalized.providerOptions));
+}

package/dist/cjs/internal/prepare.d.cts

@@ -0,0 +1,4 @@
+import type { VerifyOptions } from '../types.cjs';
+import type { PreparedVerifier } from './verification.cjs';
+/** Shared preparation validates and snapshots trusted options before any request body is read. */
+export declare function prepareVerification(options: VerifyOptions): PreparedVerifier;

package/dist/cjs/internal/provider-options.cjs

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.snapshotGrafanaOptions = snapshotGrafanaOptions;
+exports.snapshotPolarOptions = snapshotPolarOptions;
+const errors_js_1 = require("../errors.cjs");
+const grafana_js_1 = require("../providers/grafana.cjs");
+function invalidOptions() {
+    throw new errors_js_1.HooklatchError('invalid-options', 'Invalid provider options.');
+}
+function isConfiguration(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function isString(value) {
+    return typeof value === 'string';
+}
+function rejectUnexpectedKeys(value, allowed) {
+    for (const key of Reflect.ownKeys(value)) {
+        if (Object.getOwnPropertyDescriptor(value, key)?.enumerable && !allowed.some((name) => name === key))
+            invalidOptions();
+    }
+}
+/** Read selected own properties exactly once, before validation or asynchronous work. */
+function snapshotGrafanaOptions(value) {
+    if (!isConfiguration(value))
+        invalidOptions();
+    rejectUnexpectedKeys(value, ['mode', 'signatureHeader', 'timestampHeader']);
+    if (!Object.hasOwn(value, 'mode') || !('mode' in value))
+        invalidOptions();
+    const mode = value.mode;
+    const hasSignature = Object.hasOwn(value, 'signatureHeader');
+    const signature = hasSignature && 'signatureHeader' in value ? value.signatureHeader : undefined;
+    if (hasSignature && !isString(signature))
+        invalidOptions();
+    const signatureOptions = signature !== undefined ? { signatureHeader: signature } : {};
+    let snapshot;
+    if (mode === 'body') {
+        if (Object.hasOwn(value, 'timestampHeader'))
+            invalidOptions();
+        snapshot = { mode, ...signatureOptions };
+    }
+    else if (mode === 'timestamped') {
+        if (!Object.hasOwn(value, 'timestampHeader') || !('timestampHeader' in value))
+            invalidOptions();
+        const timestamp = value.timestampHeader;
+        if (!isString(timestamp))
+            invalidOptions();
+        snapshot = { mode, ...signatureOptions, timestampHeader: timestamp };
+    }
+    else {
+        return invalidOptions();
+    }
+    // The pure factory remains the authority for RFC field names, reservations and collisions.
+    (0, grafana_js_1.createGrafanaDescriptor)(snapshot);
+    // Validate original code points first: Unicode case conversion can produce ASCII.
+    const normalizedSignature = signature !== undefined ? { signatureHeader: signature.toLowerCase() } : {};
+    return snapshot.mode === 'body'
+        ? { mode: snapshot.mode, ...normalizedSignature }
+        : { mode: snapshot.mode, ...normalizedSignature, timestampHeader: snapshot.timestampHeader.toLowerCase() };
+}
+function snapshotPolarOptions(value) {
+    if (!isConfiguration(value))
+        invalidOptions();
+    rejectUnexpectedKeys(value, ['secretMode']);
+    if (!Object.hasOwn(value, 'secretMode'))
+        return {};
+    if (!('secretMode' in value))
+        invalidOptions();
+    const secretMode = value.secretMode;
+    if (secretMode !== 'current' && secretMode !== 'legacy')
+        invalidOptions();
+    return { secretMode };
+}

package/dist/cjs/internal/provider-options.d.cts

@@ -0,0 +1,6 @@
+import type { GrafanaOptions, PolarOptions } from '../types.cjs';
+type Configuration = GrafanaOptions | PolarOptions;
+/** Read selected own properties exactly once, before validation or asynchronous work. */
+export declare function snapshotGrafanaOptions(value: Configuration | undefined): GrafanaOptions;
+export declare function snapshotPolarOptions(value: Configuration | undefined): PolarOptions;
+export {};

package/dist/cjs/internal/provider.cjs

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/internal/provider.d.cts

@@ -0,0 +1,39 @@
+import type { EventIdentity, FailureDetails, Provider } from '../types.cjs';
+export type NormalizedHeaders = ReadonlyMap<string, string>;
+export interface ParsedSignature {
+    readonly ok: true;
+    readonly signatures: readonly Uint8Array[];
+    readonly signedContent: Uint8Array;
+    /** Untrusted until core signature verification succeeds. */
+    readonly identity: EventIdentity;
+}
+export type ParseResult = ParsedSignature | FailureDetails;
+export type HmacPolicy = {
+    readonly kind: 'hmac';
+    readonly hash: 'SHA-1';
+    readonly signatureBytes: 20;
+} | {
+    readonly kind: 'hmac';
+    readonly hash: 'SHA-256';
+    readonly signatureBytes: 32;
+};
+export type FalParseResult = FailureDetails | (ParsedSignature & {
+    readonly recipient: string;
+});
+export interface FalProviderDescriptor {
+    readonly provider: 'fal';
+    readonly crypto: {
+        readonly kind: 'ed25519';
+        readonly signatureBytes: 64;
+    };
+    parse(headers: NormalizedHeaders, rawBody: Uint8Array): Promise<FalParseResult>;
+}
+export type AnyProviderDescriptor = ProviderDescriptor | FalProviderDescriptor;
+export interface ProviderDescriptor {
+    readonly provider: Exclude<Provider, 'fal'>;
+    readonly crypto?: HmacPolicy;
+    /** Throw HooklatchError('invalid-secret') on invalid configuration. */
+    decodeSecret(secret: string): Uint8Array;
+    /** Parse and format only. Freshness and HMAC checks belong to core. */
+    parse(headers: NormalizedHeaders, rawBody: Uint8Array): ParseResult;
+}

package/dist/cjs/internal/verification.cjs

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.prepareVerifier = prepareVerifier;
+exports.readClock = readClock;
+exports.failure = failure;
+exports.verifyPrepared = verifyPrepared;
+const errors_js_1 = require("../errors.cjs");
+const options_js_1 = require("./options.cjs");
+const headers_js_1 = require("./headers.cjs");
+const crypto_js_1 = require("./crypto.cjs");
+function prepareVerifier(options, descriptor) {
+    const normalized = (0, options_js_1.normalizeOptions)(options);
+    let keys;
+    if (normalized.provider === 'fal') {
+        if (descriptor.provider !== 'fal')
+            throw new errors_js_1.HooklatchError('internal', 'Invalid provider configuration.');
+        keys = normalized.publicKeys;
+    }
+    else {
+        if (descriptor.provider === 'fal')
+            throw new errors_js_1.HooklatchError('internal', 'Invalid provider configuration.');
+        keys = normalized.secrets.map((secret) => new Uint8Array(descriptor.decodeSecret(secret)));
+    }
+    if (keys.some((key) => key.byteLength === 0))
+        throw new errors_js_1.HooklatchError('invalid-secret', 'Invalid signing secret.');
+    return { options: normalized, descriptor, keys };
+}
+function readClock(prepared) {
+    let now;
+    try {
+        now = prepared.options.now();
+    }
+    catch {
+        throw new errors_js_1.HooklatchError('invalid-options', 'Invalid verification clock.');
+    }
+    if (!Number.isFinite(now) || now < 0 || now > Number.MAX_SAFE_INTEGER) {
+        throw new errors_js_1.HooklatchError('invalid-options', 'Invalid verification clock.');
+    }
+    return now;
+}
+function failure(prepared, reason, message) {
+    return { ok: false, provider: prepared.options.provider, reason, message };
+}
+async function verifyPrepared(request, prepared, receivedAt = readClock(prepared)) {
+    if (!request || !(request.rawBody instanceof Uint8Array))
+        throw new errors_js_1.HooklatchError('invalid-input', 'Raw body must be a Uint8Array.');
+    if (request.rawBody.byteLength > prepared.options.maxBodyBytes)
+        return failure(prepared, 'body-too-large', 'Request body exceeds the configured limit.');
+    const rawBody = new Uint8Array(request.rawBody);
+    const headers = (0, headers_js_1.normalizeHeaders)(request.headers, prepared.options.provider === 'fal');
+    const parsed = await prepared.descriptor.parse(headers, rawBody);
+    if (!parsed.ok)
+        return { ...parsed, provider: prepared.options.provider };
+    const valid = prepared.descriptor.provider === 'fal'
+        ? await (0, crypto_js_1.verifyEd25519)(prepared.keys, parsed.signatures, parsed.signedContent)
+        : await (0, crypto_js_1.verifyHmac)(prepared.keys, parsed.signatures, parsed.signedContent, prepared.descriptor.crypto);
+    if (!valid || (prepared.options.provider === 'fal'
+        && (!('recipient' in parsed) || parsed.recipient !== prepared.options.expectedUserId))) {
+        return failure(prepared, 'invalid-signature', 'Webhook signature is invalid.');
+    }
+    const timestamp = parsed.identity.timestamp;
+    if (timestamp !== null) {
+        const age = receivedAt - timestamp;
+        if (age > prepared.options.toleranceSeconds)
+            return failure(prepared, 'timestamp-expired', 'Webhook timestamp is outside the allowed past window.');
+        if (age < -prepared.options.toleranceSeconds)
+            return failure(prepared, 'timestamp-future', 'Webhook timestamp is outside the allowed future window.');
+    }
+    return { ok: true, provider: prepared.options.provider, rawBody,
+        identity: { ...parsed.identity, authenticatedFields: [...parsed.identity.authenticatedFields] } };
+}

package/dist/cjs/internal/verification.d.cts

@@ -0,0 +1,12 @@
+import type { FailureDetails, VerificationResult, VerifyOptions, WebhookRequest } from '../types.cjs';
+import type { AnyProviderDescriptor } from './provider.cjs';
+import type { NormalizedOptions } from './options.cjs';
+export interface PreparedVerifier {
+    readonly options: NormalizedOptions;
+    readonly descriptor: AnyProviderDescriptor;
+    readonly keys: readonly Uint8Array[];
+}
+export declare function prepareVerifier(options: VerifyOptions, descriptor: AnyProviderDescriptor): PreparedVerifier;
+export declare function readClock(prepared: PreparedVerifier): number;
+export declare function failure(prepared: PreparedVerifier, reason: FailureDetails['reason'], message: string): VerificationResult;
+export declare function verifyPrepared(request: WebhookRequest, prepared: PreparedVerifier, receivedAt?: number): Promise<VerificationResult>;

package/dist/cjs/providers/clerk.cjs

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clerkDescriptor = void 0;
+const standard_webhooks_protocol_js_1 = require("./standard-webhooks-protocol.cjs");
+/**
+ * Clerk delivers Standard Webhooks payloads through Svix and its official
+ * helper reads only the branded `svix-*` headers. Canonical `webhook-*`
+ * headers are deliberately ignored and never repair a missing or invalid
+ * branded field.
+ */
+exports.clerkDescriptor = (0, standard_webhooks_protocol_js_1.createStandardWebhooksProtocol)('clerk', 'Clerk', {
+    id: 'svix-id',
+    timestamp: 'svix-timestamp',
+    signature: 'svix-signature',
+});

package/dist/cjs/providers/clerk.d.cts

@@ -0,0 +1,9 @@
+/**
+ * Clerk delivers Standard Webhooks payloads through Svix and its official
+ * helper reads only the branded `svix-*` headers. Canonical `webhook-*`
+ * headers are deliberately ignored and never repair a missing or invalid
+ * branded field.
+ */
+export declare const clerkDescriptor: {
+    readonly provider: "clerk";
+} & Pick<import("../internal/provider.cjs").ProviderDescriptor, "decodeSecret" | "parse">;

package/dist/cjs/providers/dodo-payments.cjs

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dodoPaymentsDescriptor = void 0;
+const standard_webhooks_protocol_js_1 = require("./standard-webhooks-protocol.cjs");
+/**
+ * Dodo Payments delivers Standard Webhooks payloads with the canonical
+ * `webhook-id`, `webhook-timestamp` and `webhook-signature` headers. The
+ * secret is Base64-decoded (an optional `whsec_` prefix is stripped) and must
+ * decode to 24-64 bytes; the signature covers the exact
+ * `${webhook-id}.${webhook-timestamp}.` bytes followed by the raw body.
+ *
+ * These headers authenticate protocol bytes, not a unique Dodo identity: a
+ * signature minted by any other canonical alias verifies here when the same
+ * secret is configured. Use endpoint-specific secrets and route configuration
+ * to prevent cross-endpoint replay. No event payload is parsed and no
+ * resource id is inferred.
+ *
+ * No Dodo Payments-published signature vector is claimed; the direct tests use
+ * synthetic anchors. Source:
+ * https://docs.dodopayments.com/developer-resources/webhooks
+ */
+exports.dodoPaymentsDescriptor = (0, standard_webhooks_protocol_js_1.createStandardWebhooksProtocol)('dodo-payments', 'Dodo Payments', {
+    id: 'webhook-id',
+    timestamp: 'webhook-timestamp',
+    signature: 'webhook-signature',
+});

package/dist/cjs/providers/dodo-payments.d.cts

@@ -0,0 +1,20 @@
+/**
+ * Dodo Payments delivers Standard Webhooks payloads with the canonical
+ * `webhook-id`, `webhook-timestamp` and `webhook-signature` headers. The
+ * secret is Base64-decoded (an optional `whsec_` prefix is stripped) and must
+ * decode to 24-64 bytes; the signature covers the exact
+ * `${webhook-id}.${webhook-timestamp}.` bytes followed by the raw body.
+ *
+ * These headers authenticate protocol bytes, not a unique Dodo identity: a
+ * signature minted by any other canonical alias verifies here when the same
+ * secret is configured. Use endpoint-specific secrets and route configuration
+ * to prevent cross-endpoint replay. No event payload is parsed and no
+ * resource id is inferred.
+ *
+ * No Dodo Payments-published signature vector is claimed; the direct tests use
+ * synthetic anchors. Source:
+ * https://docs.dodopayments.com/developer-resources/webhooks
+ */
+export declare const dodoPaymentsDescriptor: {
+    readonly provider: "dodo-payments";
+} & Pick<import("../internal/provider.cjs").ProviderDescriptor, "decodeSecret" | "parse">;

package/dist/cjs/providers/doppler.cjs

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dopplerDescriptor = void 0;
+const shared_js_1 = require("./shared.cjs");
+const SIGNATURE_HEADER = 'x-doppler-signature';
+const SIGNATURE_SCHEME = 'sha256';
+/**
+ * Doppler `X-Doppler-Signature: sha256=<hex HMAC-SHA256(raw request body)>`.
+ *
+ * Doppler documents exactly one `<scheme>=<64 hex>` value; there is no list and
+ * no unknown-field tolerance. The complete value is validated before the scheme
+ * decision, so a well-formed digest under another scheme token (`sha1=<64 hex>`)
+ * fails as `unsupported-scheme`, while any nonconforming syntax — wrong length,
+ * non-hex, bare hex, commas, extra equals, empty digest, or outer whitespace —
+ * fails as `malformed-signature`. `sha256=` is case-sensitive; `SHA256=<64 hex>`
+ * is a different scheme and therefore unsupported.
+ *
+ * The secret is the literal, untrimmed UTF-8 text of the webhook `Secret`. It is
+ * never Base64-decoded and no `whsec_`-style prefix is inferred, so an empty
+ * secret is an invalid configuration rather than an encoded empty key.
+ *
+ * The HMAC covers the exact raw body only; no timestamp or identifier is
+ * included in the MAC, so every identity field is null and
+ * `authenticatedFields` is empty: this descriptor never establishes freshness and
+ * offers no replay protection. Signing is optional on the Doppler side, so a
+ * delivery without a configured secret carries no signature and cannot be
+ * verified; there is no Basic/Bearer or unsigned fallback path here.
+ *
+ * The Doppler docs' Node example re-serializes with `JSON.stringify(req.body)`.
+ * This descriptor authenticates the received bytes instead, so a caller that has
+ * already parsed the body cannot reliably reconstruct the signed content and
+ * should pass the original bytes.
+ *
+ * Source: https://docs.doppler.com/docs/webhooks
+ *
+ * No Doppler-published signature tuple was located; test anchors are synthetic.
+ */
+exports.dopplerDescriptor = {
+    provider: 'doppler',
+    decodeSecret(secret) {
+        return (0, shared_js_1.decodeLiteralSecret)(secret, 'Doppler');
+    },
+    parse(headers, rawBody) {
+        const raw = headers.get(SIGNATURE_HEADER);
+        if (raw === undefined || raw.trim() === '') {
+            return (0, shared_js_1.failure)('missing-signature', 'No Doppler signature header was provided.');
+        }
+        // Validate the whole value first: exactly one `=`, a nonempty scheme token,
+        // and a nonempty digest. `decodeHexSignature` accepts either hex case but
+        // requires exactly 64 hex characters (32 bytes).
+        const separator = raw.indexOf('=');
+        if (separator <= 0 || separator === raw.length - 1 || raw.indexOf('=', separator + 1) !== -1) {
+            return (0, shared_js_1.failure)('malformed-signature', 'The Doppler signature header is malformed.');
+        }
+        const scheme = raw.slice(0, separator);
+        const signature = (0, shared_js_1.decodeHexSignature)(raw.slice(separator + 1));
+        if (!(0, shared_js_1.isSchemeToken)(scheme) || signature === null) {
+            return (0, shared_js_1.failure)('malformed-signature', 'The Doppler signature header is malformed.');
+        }
+        if (scheme !== SIGNATURE_SCHEME) {
+            return (0, shared_js_1.failure)('unsupported-scheme', 'The Doppler signature scheme is not supported.');
+        }
+        const identity = {
+            deliveryId: null,
+            eventId: null,
+            timestamp: null,
+            authenticatedFields: [],
+        };
+        return { ok: true, signatures: [signature], signedContent: rawBody, identity };
+    },
+};