hooklatch 0.0.0-stage → 1.0.0

package/dist/cjs/providers/doppler.d.cts

@@ -0,0 +1,37 @@
+import type { NormalizedHeaders, ParseResult } from '../internal/provider.cjs';
+/**
+ * Doppler `X-Doppler-Signature: sha256=<hex HMAC-SHA256(raw request body)>`.
+ *
+ * Doppler documents exactly one `<scheme>=<64 hex>` value; there is no list and
+ * no unknown-field tolerance. The complete value is validated before the scheme
+ * decision, so a well-formed digest under another scheme token (`sha1=<64 hex>`)
+ * fails as `unsupported-scheme`, while any nonconforming syntax — wrong length,
+ * non-hex, bare hex, commas, extra equals, empty digest, or outer whitespace —
+ * fails as `malformed-signature`. `sha256=` is case-sensitive; `SHA256=<64 hex>`
+ * is a different scheme and therefore unsupported.
+ *
+ * The secret is the literal, untrimmed UTF-8 text of the webhook `Secret`. It is
+ * never Base64-decoded and no `whsec_`-style prefix is inferred, so an empty
+ * secret is an invalid configuration rather than an encoded empty key.
+ *
+ * The HMAC covers the exact raw body only; no timestamp or identifier is
+ * included in the MAC, so every identity field is null and
+ * `authenticatedFields` is empty: this descriptor never establishes freshness and
+ * offers no replay protection. Signing is optional on the Doppler side, so a
+ * delivery without a configured secret carries no signature and cannot be
+ * verified; there is no Basic/Bearer or unsigned fallback path here.
+ *
+ * The Doppler docs' Node example re-serializes with `JSON.stringify(req.body)`.
+ * This descriptor authenticates the received bytes instead, so a caller that has
+ * already parsed the body cannot reliably reconstruct the signed content and
+ * should pass the original bytes.
+ *
+ * Source: https://docs.doppler.com/docs/webhooks
+ *
+ * No Doppler-published signature tuple was located; test anchors are synthetic.
+ */
+export declare const dopplerDescriptor: {
+    provider: "doppler";
+    decodeSecret(secret: string): Uint8Array;
+    parse(headers: NormalizedHeaders, rawBody: Uint8Array): ParseResult;
+};

package/dist/cjs/providers/fal.cjs

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.falDescriptor = void 0;
+const errors_js_1 = require("../errors.cjs");
+const bytes_js_1 = require("../internal/bytes.cjs");
+const shared_js_1 = require("./shared.cjs");
+/** Static-key fal webhook formatting only; key authentication belongs to core.
+ * https://fal.ai/docs/documentation/model-apis/inference/webhooks
+ * Strict ID and hex grammars are Hooklatch receiver policy, not vendor parity.
+ */
+exports.falDescriptor = {
+    provider: 'fal',
+    crypto: { kind: 'ed25519', signatureBytes: 64 },
+    async parse(headers, rawBody) {
+        const signatureRaw = headers.get('x-fal-webhook-signature');
+        const requestId = headers.get('x-fal-webhook-request-id');
+        const userId = headers.get('x-fal-webhook-user-id');
+        const timestamp = headers.get('x-fal-webhook-timestamp');
+        if (signatureRaw === undefined || signatureRaw.trim() === '') {
+            return (0, shared_js_1.failure)('missing-signature', 'No fal signature header was provided.');
+        }
+        const signature = decodeSignature(signatureRaw);
+        if (signature === null)
+            return malformed();
+        // Presence of both IDs takes precedence over grammar of either ID.
+        if (requestId === undefined || requestId.trim() === '') {
+            return (0, shared_js_1.failure)('missing-identity', 'No fal request identity was provided.');
+        }
+        if (userId === undefined || userId.trim() === '') {
+            return (0, shared_js_1.failure)('missing-identity', 'No fal user identity was provided.');
+        }
+        if (!isIdentity(requestId) || !isIdentity(userId))
+            return malformed();
+        if (timestamp === undefined || timestamp.trim() === '') {
+            return (0, shared_js_1.failure)('missing-timestamp', 'No fal timestamp was provided.');
+        }
+        if (!(0, shared_js_1.isCanonicalTimestamp)(timestamp))
+            return malformed();
+        const body = new Uint8Array(rawBody);
+        const subtle = globalThis.crypto?.subtle;
+        if (!subtle)
+            throw new errors_js_1.HooklatchError('crypto-unavailable', 'Web Crypto is unavailable.');
+        let digest;
+        try {
+            digest = await subtle.digest('SHA-256', body);
+        }
+        catch (error) {
+            if (isUnsupported(error)) {
+                throw new errors_js_1.HooklatchError('crypto-unavailable', 'Web Crypto is unavailable.');
+            }
+            throw new errors_js_1.HooklatchError('internal', 'Cryptographic verification failed.');
+        }
+        const hex = Array.from(new Uint8Array(digest), byte => byte.toString(16).padStart(2, '0')).join('');
+        return {
+            ok: true, signatures: [signature],
+            signedContent: (0, bytes_js_1.utf8)(`${requestId}\n${userId}\n${timestamp}\n${hex}`),
+            recipient: userId,
+            identity: { deliveryId: null, eventId: null, timestamp: Number(timestamp), authenticatedFields: ['timestamp'] },
+        };
+    },
+};
+function malformed() {
+    return (0, shared_js_1.failure)('malformed-signature', 'The fal signature headers are malformed.');
+}
+/** DOM exceptions may originate outside this realm. */
+function isUnsupported(error) {
+    return error !== null && typeof error === 'object' && 'name' in error && error.name === 'NotSupportedError';
+}
+function isIdentity(value) {
+    return /^[\x21-\x7e]{1,1024}$/.test(value) && !value.includes(',');
+}
+function decodeSignature(value) {
+    if (!/^[a-fA-F0-9]{128}$/.test(value))
+        return null;
+    const bytes = new Uint8Array(64);
+    for (let index = 0; index < bytes.length; index++) {
+        bytes[index] = Number.parseInt(value.slice(index * 2, index * 2 + 2), 16);
+    }
+    return bytes;
+}

package/dist/cjs/providers/fal.d.cts

@@ -0,0 +1,13 @@
+import type { FalParseResult, NormalizedHeaders } from '../internal/provider.cjs';
+/** Static-key fal webhook formatting only; key authentication belongs to core.
+ * https://fal.ai/docs/documentation/model-apis/inference/webhooks
+ * Strict ID and hex grammars are Hooklatch receiver policy, not vendor parity.
+ */
+export declare const falDescriptor: {
+    provider: "fal";
+    crypto: {
+        kind: "ed25519";
+        signatureBytes: 64;
+    };
+    parse(headers: NormalizedHeaders, rawBody: Uint8Array): Promise<FalParseResult>;
+};

package/dist/cjs/providers/github.cjs

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.githubDescriptor = void 0;
+const shared_js_1 = require("./shared.cjs");
+const SIGNATURE_HEADER = 'x-hub-signature-256';
+const LEGACY_SIGNATURE_HEADER = 'x-hub-signature';
+const SCHEME = 'sha256';
+const DELIVERY_HEADER = 'x-github-delivery';
+function optionalHeader(headers, name) {
+    const value = headers.get(name);
+    return value === undefined || value === '' ? null : value;
+}
+/**
+ * GitHub `X-Hub-Signature-256: sha256=<hex>` over the raw body only. The legacy
+ * `X-Hub-Signature: sha1=<hex>` is recognized but never treated as SHA-256.
+ * `X-GitHub-Delivery` is unsigned metadata and never proves authenticity.
+ */
+exports.githubDescriptor = {
+    provider: 'github',
+    decodeSecret(secret) {
+        return (0, shared_js_1.decodeLiteralSecret)(secret, 'GitHub');
+    },
+    parse(headers, rawBody) {
+        const raw = headers.get(SIGNATURE_HEADER);
+        if (raw === undefined || raw.trim() === '') {
+            const legacy = headers.get(LEGACY_SIGNATURE_HEADER);
+            if (legacy !== undefined && legacy.trim() !== '') {
+                return (0, shared_js_1.failure)('unsupported-scheme', 'Only the legacy SHA-1 GitHub signature was provided.');
+            }
+            return (0, shared_js_1.failure)('missing-signature', 'No GitHub signature header was provided.');
+        }
+        const separator = raw.indexOf('=');
+        if (separator <= 0 || separator === raw.length - 1) {
+            return (0, shared_js_1.failure)('malformed-signature', 'The GitHub signature header is malformed.');
+        }
+        const scheme = raw.slice(0, separator);
+        if (scheme.toLowerCase() !== SCHEME) {
+            return (0, shared_js_1.failure)('unsupported-scheme', 'No supported GitHub signature scheme was provided.');
+        }
+        const signature = (0, shared_js_1.decodeHexSignature)(raw.slice(separator + 1));
+        if (signature === null) {
+            return (0, shared_js_1.failure)('malformed-signature', 'The GitHub signature header is malformed.');
+        }
+        const identity = {
+            deliveryId: optionalHeader(headers, DELIVERY_HEADER),
+            eventId: null,
+            timestamp: null,
+            authenticatedFields: [],
+        };
+        return { ok: true, signatures: [signature], signedContent: rawBody, identity };
+    },
+};

package/dist/cjs/providers/github.d.cts

@@ -0,0 +1,7 @@
+import type { ProviderDescriptor } from '../internal/provider.cjs';
+/**
+ * GitHub `X-Hub-Signature-256: sha256=<hex>` over the raw body only. The legacy
+ * `X-Hub-Signature: sha1=<hex>` is recognized but never treated as SHA-256.
+ * `X-GitHub-Delivery` is unsigned metadata and never proves authenticity.
+ */
+export declare const githubDescriptor: ProviderDescriptor;

package/dist/cjs/providers/gitlab.cjs

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gitlabDescriptor = void 0;
+const standard_webhooks_protocol_js_1 = require("./standard-webhooks-protocol.cjs");
+/**
+ * GitLab signing-token mode (introduced in 19.0 behind a default-enabled flag
+ * and generally available in 19.1) sends the canonical Standard Webhooks
+ * `webhook-id`, `webhook-timestamp` and `webhook-signature` headers. The
+ * secret is Base64-decoded (an optional `whsec_` prefix is stripped) and must
+ * decode to 24-64 bytes; the signature covers the exact
+ * `${webhook-id}.${webhook-timestamp}.` bytes followed by the raw body.
+ *
+ * The legacy `X-Gitlab-Token` header is a shared string comparison, not an
+ * authenticated body signature. It is deliberately ignored: a legacy-token-only
+ * request fails closed, and adding that header can neither repair a canonical
+ * defect nor change which bytes were authenticated.
+ *
+ * No GitLab-published signing-token vector is claimed; the direct tests use
+ * synthetic anchors. Source:
+ * https://docs.gitlab.com/user/project/integrations/webhooks/#signing-tokens
+ */
+exports.gitlabDescriptor = (0, standard_webhooks_protocol_js_1.createStandardWebhooksProtocol)('gitlab', 'GitLab', {
+    id: 'webhook-id',
+    timestamp: 'webhook-timestamp',
+    signature: 'webhook-signature',
+});

package/dist/cjs/providers/gitlab.d.cts

@@ -0,0 +1,20 @@
+/**
+ * GitLab signing-token mode (introduced in 19.0 behind a default-enabled flag
+ * and generally available in 19.1) sends the canonical Standard Webhooks
+ * `webhook-id`, `webhook-timestamp` and `webhook-signature` headers. The
+ * secret is Base64-decoded (an optional `whsec_` prefix is stripped) and must
+ * decode to 24-64 bytes; the signature covers the exact
+ * `${webhook-id}.${webhook-timestamp}.` bytes followed by the raw body.
+ *
+ * The legacy `X-Gitlab-Token` header is a shared string comparison, not an
+ * authenticated body signature. It is deliberately ignored: a legacy-token-only
+ * request fails closed, and adding that header can neither repair a canonical
+ * defect nor change which bytes were authenticated.
+ *
+ * No GitLab-published signing-token vector is claimed; the direct tests use
+ * synthetic anchors. Source:
+ * https://docs.gitlab.com/user/project/integrations/webhooks/#signing-tokens
+ */
+export declare const gitlabDescriptor: {
+    readonly provider: "gitlab";
+} & Pick<import("../internal/provider.cjs").ProviderDescriptor, "decodeSecret" | "parse">;

package/dist/cjs/providers/grafana.cjs

@@ -0,0 +1,180 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createGrafanaDescriptor = createGrafanaDescriptor;
+const errors_js_1 = require("../errors.cjs");
+const bytes_js_1 = require("../internal/bytes.cjs");
+const shared_js_1 = require("./shared.cjs");
+/** Grafana's own default signature header name. */
+const DEFAULT_SIGNATURE_HEADER = 'x-grafana-alerting-signature';
+/** RFC 9110 field-name token characters. */
+const FIELD_NAME_TOKEN = /^[!#$%&'*+.^_`|~\dA-Za-z-]+$/;
+/**
+ * Authentication and framing header names that a configured Grafana header
+ * must not replace. This is Hooklatch configuration policy, not a Grafana
+ * rule: Grafana itself does not restrict the configured header names.
+ */
+const RESERVED_HEADER_NAMES = new Set([
+    'host',
+    'content-length',
+    'transfer-encoding',
+    'connection',
+    'upgrade',
+    'trailer',
+    'te',
+    'proxy-authorization',
+    'proxy-authenticate',
+    'authorization',
+    'cookie',
+    'set-cookie',
+]);
+const ALLOWED_OPTION_KEYS = new Set([
+    'mode',
+    'signatureHeader',
+    'timestampHeader',
+]);
+const INVALID_OPTIONS_MESSAGE = 'Invalid Grafana provider options.';
+function invalidOptions() {
+    throw new errors_js_1.HooklatchError('invalid-options', INVALID_OPTIONS_MESSAGE);
+}
+function isOptionsObject(options) {
+    return typeof options === 'object' && options !== null && !Array.isArray(options);
+}
+function isHeaderNameText(value) {
+    return typeof value === 'string';
+}
+function isConfiguredHeaderName(value) {
+    return FIELD_NAME_TOKEN.test(value) && !RESERVED_HEADER_NAMES.has(value.toLowerCase());
+}
+/** Only the three documented option keys are accepted; nothing is inherited. */
+function hasUnexpectedOptionKey(options) {
+    for (const key of Object.keys(options)) {
+        if (!ALLOWED_OPTION_KEYS.has(key))
+            return true;
+    }
+    for (const key of Object.getOwnPropertySymbols(options)) {
+        if (Object.prototype.propertyIsEnumerable.call(options, key))
+            return true;
+    }
+    return false;
+}
+function readSignatureHeader(options) {
+    if (!Object.hasOwn(options, 'signatureHeader'))
+        return DEFAULT_SIGNATURE_HEADER;
+    const value = options.signatureHeader;
+    if (!isHeaderNameText(value) || !isConfiguredHeaderName(value))
+        invalidOptions();
+    return value.toLowerCase();
+}
+function readTimestampHeader(options, mode, signatureHeader) {
+    const configured = Object.hasOwn(options, 'timestampHeader');
+    if (mode === 'body') {
+        // Body-only mode has no timestamp header, not even an explicit undefined.
+        if (configured)
+            invalidOptions();
+        return null;
+    }
+    if (!configured)
+        invalidOptions();
+    const value = options.timestampHeader;
+    if (!isHeaderNameText(value) || !isConfiguredHeaderName(value))
+        invalidOptions();
+    const normalized = value.toLowerCase();
+    // A collision would make the two headers unreadable, so it is rejected.
+    if (normalized === signatureHeader)
+        invalidOptions();
+    return normalized;
+}
+function buildConfiguration(options) {
+    if (!isOptionsObject(options))
+        invalidOptions();
+    if (hasUnexpectedOptionKey(options))
+        invalidOptions();
+    if (!Object.hasOwn(options, 'mode'))
+        invalidOptions();
+    const mode = options.mode;
+    if (mode !== 'body' && mode !== 'timestamped')
+        invalidOptions();
+    const signatureHeader = readSignatureHeader(options);
+    const timestampHeader = readTimestampHeader(options, mode, signatureHeader);
+    return { signatureHeader, timestampHeader };
+}
+/**
+ * Validate and snapshot the configuration. Any getter or proxy trap observed
+ * while reading the options is contained here and reported as one generic
+ * invalid-options error that never echoes the underlying exception.
+ */
+function snapshotConfiguration(options) {
+    try {
+        return buildConfiguration(options);
+    }
+    catch {
+        throw new errors_js_1.HooklatchError('invalid-options', INVALID_OPTIONS_MESSAGE);
+    }
+}
+/**
+ * Parse the configured Grafana headers into the bytes Grafana signs.
+ *
+ * The signature header is always read first: its structure decides the
+ * failure before any timestamp is inspected. Freshness and the HMAC check
+ * belong to core, so this only reports the signature and the signed bytes.
+ */
+function parseGrafana(configuration, headers, rawBody) {
+    const signatureRaw = headers.get(configuration.signatureHeader);
+    if (signatureRaw === undefined || signatureRaw.trim() === '') {
+        return (0, shared_js_1.failure)('missing-signature', 'No Grafana signature header was provided.');
+    }
+    const signature = (0, shared_js_1.decodeHexSignature)(signatureRaw);
+    if (signature === null) {
+        return (0, shared_js_1.failure)('malformed-signature', 'The Grafana signature header is malformed.');
+    }
+    const timestampHeader = configuration.timestampHeader;
+    if (timestampHeader === null) {
+        return {
+            ok: true,
+            signatures: [signature],
+            signedContent: rawBody,
+            identity: { deliveryId: null, eventId: null, timestamp: null, authenticatedFields: [] },
+        };
+    }
+    const timestampRaw = headers.get(timestampHeader);
+    if (timestampRaw === undefined || timestampRaw.trim() === '') {
+        return (0, shared_js_1.failure)('missing-timestamp', 'No Grafana timestamp header was provided.');
+    }
+    if (!(0, shared_js_1.isCanonicalTimestamp)(timestampRaw)) {
+        return (0, shared_js_1.failure)('malformed-signature', 'The Grafana timestamp is malformed.');
+    }
+    return {
+        ok: true,
+        signatures: [signature],
+        signedContent: (0, bytes_js_1.concatBytes)((0, bytes_js_1.utf8)(`${timestampRaw}:`), rawBody),
+        identity: {
+            deliveryId: null,
+            eventId: null,
+            timestamp: Number(timestampRaw),
+            authenticatedFields: ['timestamp'],
+        },
+    };
+}
+/**
+ * Create a Grafana descriptor for the given receiver configuration.
+ *
+ * The configuration is trusted application input, never derived from a
+ * request. Header names select which header is read; they are lookup
+ * configuration and are not part of the signed bytes, so the same secret,
+ * body and timestamp produce the same MAC under any configured header name.
+ *
+ * The returned descriptor is not registered with the public provider
+ * registry; the coordinator owns that integration.
+ */
+function createGrafanaDescriptor(options) {
+    const configuration = snapshotConfiguration(options);
+    return {
+        provider: 'grafana',
+        decodeSecret(secret) {
+            return (0, shared_js_1.decodeLiteralSecret)(secret, 'Grafana');
+        },
+        parse(headers, rawBody) {
+            return parseGrafana(configuration, headers, rawBody);
+        },
+    };
+}

package/dist/cjs/providers/grafana.d.cts

@@ -0,0 +1,35 @@
+import type { ProviderDescriptor } from '../internal/provider.cjs';
+/**
+ * Receiver configuration for the Grafana alerting webhook HMAC.
+ *
+ * `mode` selects the signed layout. `body` signs the exact raw body.
+ * `timestamped` signs `${timestamp}:` followed by the exact raw body, where
+ * the timestamp is read from the configured timestamp header. The mode is
+ * always explicit: nothing is inferred from the request, and a missing
+ * timestamp never downgrades to the body-only layout.
+ */
+export type GrafanaDescriptorOptions = {
+    readonly mode: 'body';
+    readonly signatureHeader?: string;
+    readonly timestampHeader?: never;
+} | {
+    readonly mode: 'timestamped';
+    readonly signatureHeader?: string;
+    readonly timestampHeader: string;
+};
+type GrafanaDescriptor = {
+    readonly provider: 'grafana';
+} & Pick<ProviderDescriptor, 'decodeSecret' | 'parse'>;
+/**
+ * Create a Grafana descriptor for the given receiver configuration.
+ *
+ * The configuration is trusted application input, never derived from a
+ * request. Header names select which header is read; they are lookup
+ * configuration and are not part of the signed bytes, so the same secret,
+ * body and timestamp produce the same MAC under any configured header name.
+ *
+ * The returned descriptor is not registered with the public provider
+ * registry; the coordinator owns that integration.
+ */
+export declare function createGrafanaDescriptor(options: GrafanaDescriptorOptions): GrafanaDescriptor;
+export {};

package/dist/cjs/providers/index.cjs

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.falDescriptor = exports.vercelDescriptor = exports.linearDescriptor = exports.sanityDescriptor = exports.dopplerDescriptor = exports.sentryDescriptor = exports.workosDescriptor = exports.replicateDescriptor = exports.gitlabDescriptor = exports.dodoPaymentsDescriptor = exports.lemonSqueezyDescriptor = exports.paddleDescriptor = exports.razorpayDescriptor = exports.svixDescriptor = exports.stripeDescriptor = exports.standardWebhooksDescriptor = exports.shopifyDescriptor = exports.githubDescriptor = exports.clerkDescriptor = exports.SUPPORTED_PROVIDERS = void 0;
+exports.getProviderDescriptor = getProviderDescriptor;
+const errors_js_1 = require("../errors.cjs");
+const grafana_js_1 = require("./grafana.cjs");
+const polar_js_1 = require("./polar.cjs");
+const clerk_js_1 = require("./clerk.cjs");
+Object.defineProperty(exports, "clerkDescriptor", { enumerable: true, get: function () { return clerk_js_1.clerkDescriptor; } });
+const github_js_1 = require("./github.cjs");
+Object.defineProperty(exports, "githubDescriptor", { enumerable: true, get: function () { return github_js_1.githubDescriptor; } });
+const shopify_js_1 = require("./shopify.cjs");
+Object.defineProperty(exports, "shopifyDescriptor", { enumerable: true, get: function () { return shopify_js_1.shopifyDescriptor; } });
+const standard_webhooks_js_1 = require("./standard-webhooks.cjs");
+Object.defineProperty(exports, "standardWebhooksDescriptor", { enumerable: true, get: function () { return standard_webhooks_js_1.standardWebhooksDescriptor; } });
+const stripe_js_1 = require("./stripe.cjs");
+Object.defineProperty(exports, "stripeDescriptor", { enumerable: true, get: function () { return stripe_js_1.stripeDescriptor; } });
+const svix_js_1 = require("./svix.cjs");
+Object.defineProperty(exports, "svixDescriptor", { enumerable: true, get: function () { return svix_js_1.svixDescriptor; } });
+const razorpay_js_1 = require("./razorpay.cjs");
+Object.defineProperty(exports, "razorpayDescriptor", { enumerable: true, get: function () { return razorpay_js_1.razorpayDescriptor; } });
+const paddle_js_1 = require("./paddle.cjs");
+Object.defineProperty(exports, "paddleDescriptor", { enumerable: true, get: function () { return paddle_js_1.paddleDescriptor; } });
+const lemon_squeezy_js_1 = require("./lemon-squeezy.cjs");
+Object.defineProperty(exports, "lemonSqueezyDescriptor", { enumerable: true, get: function () { return lemon_squeezy_js_1.lemonSqueezyDescriptor; } });
+const dodo_payments_js_1 = require("./dodo-payments.cjs");
+Object.defineProperty(exports, "dodoPaymentsDescriptor", { enumerable: true, get: function () { return dodo_payments_js_1.dodoPaymentsDescriptor; } });
+const gitlab_js_1 = require("./gitlab.cjs");
+Object.defineProperty(exports, "gitlabDescriptor", { enumerable: true, get: function () { return gitlab_js_1.gitlabDescriptor; } });
+const replicate_js_1 = require("./replicate.cjs");
+Object.defineProperty(exports, "replicateDescriptor", { enumerable: true, get: function () { return replicate_js_1.replicateDescriptor; } });
+const workos_js_1 = require("./workos.cjs");
+Object.defineProperty(exports, "workosDescriptor", { enumerable: true, get: function () { return workos_js_1.workosDescriptor; } });
+const sentry_js_1 = require("./sentry.cjs");
+Object.defineProperty(exports, "sentryDescriptor", { enumerable: true, get: function () { return sentry_js_1.sentryDescriptor; } });
+const doppler_js_1 = require("./doppler.cjs");
+Object.defineProperty(exports, "dopplerDescriptor", { enumerable: true, get: function () { return doppler_js_1.dopplerDescriptor; } });
+const sanity_js_1 = require("./sanity.cjs");
+Object.defineProperty(exports, "sanityDescriptor", { enumerable: true, get: function () { return sanity_js_1.sanityDescriptor; } });
+const linear_js_1 = require("./linear.cjs");
+Object.defineProperty(exports, "linearDescriptor", { enumerable: true, get: function () { return linear_js_1.linearDescriptor; } });
+const vercel_js_1 = require("./vercel.cjs");
+Object.defineProperty(exports, "vercelDescriptor", { enumerable: true, get: function () { return vercel_js_1.vercelDescriptor; } });
+const fal_js_1 = require("./fal.cjs");
+Object.defineProperty(exports, "falDescriptor", { enumerable: true, get: function () { return fal_js_1.falDescriptor; } });
+/** Registry order is part of the internal contract; append new providers only. */
+exports.SUPPORTED_PROVIDERS = [
+    'stripe',
+    'github',
+    'shopify',
+    'standard-webhooks',
+    'clerk',
+    'svix',
+    'razorpay',
+    'paddle',
+    'lemon-squeezy',
+    'dodo-payments',
+    'gitlab',
+    'replicate',
+    'workos',
+    'sentry',
+    'doppler',
+    'sanity',
+    'grafana',
+    'polar',
+    'linear',
+    'vercel',
+    'fal',
+];
+const DESCRIPTORS = {
+    stripe: stripe_js_1.stripeDescriptor,
+    github: github_js_1.githubDescriptor,
+    shopify: shopify_js_1.shopifyDescriptor,
+    'standard-webhooks': standard_webhooks_js_1.standardWebhooksDescriptor,
+    clerk: clerk_js_1.clerkDescriptor,
+    svix: svix_js_1.svixDescriptor,
+    razorpay: razorpay_js_1.razorpayDescriptor,
+    paddle: paddle_js_1.paddleDescriptor,
+    'lemon-squeezy': lemon_squeezy_js_1.lemonSqueezyDescriptor,
+    'dodo-payments': dodo_payments_js_1.dodoPaymentsDescriptor,
+    gitlab: gitlab_js_1.gitlabDescriptor,
+    replicate: replicate_js_1.replicateDescriptor,
+    workos: workos_js_1.workosDescriptor,
+    sentry: sentry_js_1.sentryDescriptor,
+    doppler: doppler_js_1.dopplerDescriptor,
+    sanity: sanity_js_1.sanityDescriptor,
+    linear: linear_js_1.linearDescriptor,
+    vercel: vercel_js_1.vercelDescriptor,
+    fal: fal_js_1.falDescriptor,
+};
+/** Resolve the pure descriptor for a supported provider. */
+function getProviderDescriptor(provider, providerOptions) {
+    if (provider === 'grafana') {
+        if (providerOptions === undefined || !('mode' in providerOptions)) {
+            throw new errors_js_1.HooklatchError('invalid-options', 'Invalid provider options.');
+        }
+        return (0, grafana_js_1.createGrafanaDescriptor)(providerOptions);
+    }
+    if (provider === 'polar') {
+        if (providerOptions !== undefined && 'mode' in providerOptions) {
+            throw new errors_js_1.HooklatchError('invalid-options', 'Invalid provider options.');
+        }
+        return (0, polar_js_1.createPolarDescriptor)(providerOptions);
+    }
+    const descriptor = Object.hasOwn(DESCRIPTORS, provider) ? DESCRIPTORS[provider] : undefined;
+    if (descriptor === undefined) {
+        throw new errors_js_1.HooklatchError('unknown-provider', 'Unsupported webhook provider.');
+    }
+    return descriptor;
+}

package/dist/cjs/providers/index.d.cts

@@ -0,0 +1,26 @@
+import type { AnyProviderDescriptor } from '../internal/provider.cjs';
+import type { Provider, GrafanaOptions, PolarOptions } from '../types.cjs';
+import { clerkDescriptor } from './clerk.cjs';
+import { githubDescriptor } from './github.cjs';
+import { shopifyDescriptor } from './shopify.cjs';
+import { standardWebhooksDescriptor } from './standard-webhooks.cjs';
+import { stripeDescriptor } from './stripe.cjs';
+import { svixDescriptor } from './svix.cjs';
+import { razorpayDescriptor } from './razorpay.cjs';
+import { paddleDescriptor } from './paddle.cjs';
+import { lemonSqueezyDescriptor } from './lemon-squeezy.cjs';
+import { dodoPaymentsDescriptor } from './dodo-payments.cjs';
+import { gitlabDescriptor } from './gitlab.cjs';
+import { replicateDescriptor } from './replicate.cjs';
+import { workosDescriptor } from './workos.cjs';
+import { sentryDescriptor } from './sentry.cjs';
+import { dopplerDescriptor } from './doppler.cjs';
+import { sanityDescriptor } from './sanity.cjs';
+import { linearDescriptor } from './linear.cjs';
+import { vercelDescriptor } from './vercel.cjs';
+import { falDescriptor } from './fal.cjs';
+/** Registry order is part of the internal contract; append new providers only. */
+export declare const SUPPORTED_PROVIDERS: readonly ["stripe", "github", "shopify", "standard-webhooks", "clerk", "svix", "razorpay", "paddle", "lemon-squeezy", "dodo-payments", "gitlab", "replicate", "workos", "sentry", "doppler", "sanity", "grafana", "polar", "linear", "vercel", "fal"];
+/** Resolve the pure descriptor for a supported provider. */
+export declare function getProviderDescriptor(provider: Provider, providerOptions?: GrafanaOptions | PolarOptions): AnyProviderDescriptor;
+export { clerkDescriptor, githubDescriptor, shopifyDescriptor, standardWebhooksDescriptor, stripeDescriptor, svixDescriptor, razorpayDescriptor, paddleDescriptor, lemonSqueezyDescriptor, dodoPaymentsDescriptor, gitlabDescriptor, replicateDescriptor, workosDescriptor, sentryDescriptor, dopplerDescriptor, sanityDescriptor, linearDescriptor, vercelDescriptor, falDescriptor, };

package/dist/cjs/providers/lemon-squeezy.cjs

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lemonSqueezyDescriptor = void 0;
+const shared_js_1 = require("./shared.cjs");
+const SIGNATURE_HEADER = 'x-signature';
+/**
+ * Lemon Squeezy `X-Signature`: a single 64-character hex HMAC-SHA256 digest of
+ * the exact raw body, keyed with the literal webhook signing secret. The docs
+ * suggest 6-40 character secrets, but that UI guidance is not enforced as a
+ * cryptographic limit. No timestamp or event identifier is documented for
+ * verification, so identity stays null and unsigned (`X-Event-Name` is
+ * metadata and is not interpreted).
+ * Source: https://docs.lemonsqueezy.com/help/webhooks/signing-requests
+ */
+exports.lemonSqueezyDescriptor = {
+    provider: 'lemon-squeezy',
+    decodeSecret(secret) {
+        return (0, shared_js_1.decodeLiteralSecret)(secret, 'Lemon Squeezy');
+    },
+    parse(headers, rawBody) {
+        const raw = headers.get(SIGNATURE_HEADER);
+        if (raw === undefined || raw.trim() === '') {
+            return (0, shared_js_1.failure)('missing-signature', 'No Lemon Squeezy signature header was provided.');
+        }
+        const signature = (0, shared_js_1.decodeHexSignature)(raw);
+        if (signature === null) {
+            return (0, shared_js_1.failure)('malformed-signature', 'The Lemon Squeezy signature header is malformed.');
+        }
+        return {
+            ok: true,
+            signatures: [signature],
+            signedContent: rawBody,
+            identity: { deliveryId: null, eventId: null, timestamp: null, authenticatedFields: [] },
+        };
+    },
+};

package/dist/cjs/providers/lemon-squeezy.d.cts

@@ -0,0 +1,15 @@
+import type { NormalizedHeaders, ParseResult } from '../internal/provider.cjs';
+/**
+ * Lemon Squeezy `X-Signature`: a single 64-character hex HMAC-SHA256 digest of
+ * the exact raw body, keyed with the literal webhook signing secret. The docs
+ * suggest 6-40 character secrets, but that UI guidance is not enforced as a
+ * cryptographic limit. No timestamp or event identifier is documented for
+ * verification, so identity stays null and unsigned (`X-Event-Name` is
+ * metadata and is not interpreted).
+ * Source: https://docs.lemonsqueezy.com/help/webhooks/signing-requests
+ */
+export declare const lemonSqueezyDescriptor: {
+    provider: "lemon-squeezy";
+    decodeSecret(secret: string): Uint8Array;
+    parse(headers: NormalizedHeaders, rawBody: Uint8Array): ParseResult;
+};