hooklatch 0.0.0-stage → 1.0.0

package/dist/cjs/providers/sentry.cjs

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sentryDescriptor = void 0;
+const shared_js_1 = require("./shared.cjs");
+const SIGNATURE_HEADER = 'sentry-hook-signature';
+/**
+ * Sentry App integration-platform webhooks: `Sentry-Hook-Signature` is a single
+ * 64-character hex HMAC-SHA256 over the exact raw request body, keyed with the
+ * literal app client secret. Missing or trim-blank -> missing-signature; every
+ * other nonconforming value (prefixes, whitespace, comma-combined duplicates,
+ * lists, wrong length or non-hex) fails closed.
+ *
+ * `Request-Id`, `Sentry-Hook-Timestamp` and `Sentry-Hook-Resource` are outside
+ * the MAC: they cannot establish freshness or trusted identity. Sentry's docs
+ * examples re-serialize the parsed body, which can change the signed bytes; this
+ * descriptor always returns the untouched `rawBody` as signed content.
+ *
+ * Scope is Sentry App integration-platform webhooks only, not every Sentry
+ * webhook product. Sources:
+ * - https://docs.sentry.io/integrations/integration-platform/webhooks/
+ * - https://github.com/getsentry/sentry/blob/72757dae9b6d527e564c81d4921dec0d62d7beca/src/sentry/sentry_apps/api/serializers/app_platform_event.py
+ *
+ * No Sentry-published signature vector is claimed; test anchors are synthetic.
+ */
+exports.sentryDescriptor = {
+    provider: 'sentry',
+    decodeSecret(secret) {
+        return (0, shared_js_1.decodeLiteralSecret)(secret, 'Sentry App');
+    },
+    parse(headers, rawBody) {
+        const raw = headers.get(SIGNATURE_HEADER);
+        if (raw === undefined || raw.trim() === '') {
+            return (0, shared_js_1.failure)('missing-signature', 'No Sentry App signature header was provided.');
+        }
+        const signature = (0, shared_js_1.decodeHexSignature)(raw);
+        if (signature === null) {
+            return (0, shared_js_1.failure)('malformed-signature', 'The Sentry App signature header is malformed.');
+        }
+        const identity = {
+            deliveryId: null,
+            eventId: null,
+            timestamp: null,
+            authenticatedFields: [],
+        };
+        return { ok: true, signatures: [signature], signedContent: rawBody, identity };
+    },
+};

package/dist/cjs/providers/sentry.d.cts

@@ -0,0 +1,25 @@
+import type { NormalizedHeaders, ParseResult } from '../internal/provider.cjs';
+/**
+ * Sentry App integration-platform webhooks: `Sentry-Hook-Signature` is a single
+ * 64-character hex HMAC-SHA256 over the exact raw request body, keyed with the
+ * literal app client secret. Missing or trim-blank -> missing-signature; every
+ * other nonconforming value (prefixes, whitespace, comma-combined duplicates,
+ * lists, wrong length or non-hex) fails closed.
+ *
+ * `Request-Id`, `Sentry-Hook-Timestamp` and `Sentry-Hook-Resource` are outside
+ * the MAC: they cannot establish freshness or trusted identity. Sentry's docs
+ * examples re-serialize the parsed body, which can change the signed bytes; this
+ * descriptor always returns the untouched `rawBody` as signed content.
+ *
+ * Scope is Sentry App integration-platform webhooks only, not every Sentry
+ * webhook product. Sources:
+ * - https://docs.sentry.io/integrations/integration-platform/webhooks/
+ * - https://github.com/getsentry/sentry/blob/72757dae9b6d527e564c81d4921dec0d62d7beca/src/sentry/sentry_apps/api/serializers/app_platform_event.py
+ *
+ * No Sentry-published signature vector is claimed; test anchors are synthetic.
+ */
+export declare const sentryDescriptor: {
+    provider: "sentry";
+    decodeSecret(secret: string): Uint8Array;
+    parse(headers: NormalizedHeaders, rawBody: Uint8Array): ParseResult;
+};

package/dist/cjs/providers/shared.cjs

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SIGNATURE_BYTES = void 0;
+exports.failure = failure;
+exports.isSchemeToken = isSchemeToken;
+exports.isCanonicalTimestamp = isCanonicalTimestamp;
+exports.decodeHexSignature = decodeHexSignature;
+exports.decodeBase64Signature = decodeBase64Signature;
+exports.isNonEmptySecret = isNonEmptySecret;
+exports.decodeLiteralSecret = decodeLiteralSecret;
+const errors_js_1 = require("../errors.cjs");
+const bytes_js_1 = require("../internal/bytes.cjs");
+/** HMAC-SHA256 signatures are always exactly 32 bytes. */
+exports.SIGNATURE_BYTES = 32;
+/** Scheme/key tokens accepted in provider signature headers (e.g. `v1`, `sha256`). */
+const TOKEN = /^[A-Za-z0-9_-]+$/;
+function failure(reason, message) {
+    return { ok: false, reason, message };
+}
+function isSchemeToken(value) {
+    return TOKEN.test(value);
+}
+/** Canonical decimal integer: `0`, or a nonzero digit followed by digits. */
+function isCanonicalTimestamp(value) {
+    if (!/^(?:0|[1-9]\d*)$/.test(value))
+        return false;
+    const numeric = Number(value);
+    return Number.isSafeInteger(numeric) && numeric >= 0;
+}
+/** Hex signature of exactly 32 bytes; accepts either hex case. */
+function decodeHexSignature(value) {
+    const bytes = (0, bytes_js_1.decodeHex)(value);
+    return bytes !== null && bytes.byteLength === exports.SIGNATURE_BYTES ? bytes : null;
+}
+/** Canonical Base64 signature of exactly 32 bytes. */
+function decodeBase64Signature(value) {
+    const bytes = (0, bytes_js_1.decodeBase64)(value);
+    return bytes !== null && bytes.byteLength === exports.SIGNATURE_BYTES ? bytes : null;
+}
+function isNonEmptySecret(secret) {
+    return typeof secret === 'string' && secret.length > 0;
+}
+/** Literal, untrimmed UTF-8 secret bytes for Stripe/GitHub/Shopify. */
+function decodeLiteralSecret(secret, label) {
+    if (!isNonEmptySecret(secret)) {
+        throw new errors_js_1.HooklatchError('invalid-secret', `Invalid ${label} signing secret.`);
+    }
+    return (0, bytes_js_1.utf8)(secret);
+}

package/dist/cjs/providers/shared.d.cts

@@ -0,0 +1,14 @@
+import type { FailureDetails, VerificationFailureReason } from '../types.cjs';
+/** HMAC-SHA256 signatures are always exactly 32 bytes. */
+export declare const SIGNATURE_BYTES = 32;
+export declare function failure(reason: VerificationFailureReason, message: string): FailureDetails;
+export declare function isSchemeToken(value: string): boolean;
+/** Canonical decimal integer: `0`, or a nonzero digit followed by digits. */
+export declare function isCanonicalTimestamp(value: string): boolean;
+/** Hex signature of exactly 32 bytes; accepts either hex case. */
+export declare function decodeHexSignature(value: string): Uint8Array | null;
+/** Canonical Base64 signature of exactly 32 bytes. */
+export declare function decodeBase64Signature(value: string): Uint8Array | null;
+export declare function isNonEmptySecret(secret: string): secret is string;
+/** Literal, untrimmed UTF-8 secret bytes for Stripe/GitHub/Shopify. */
+export declare function decodeLiteralSecret(secret: string, label: string): Uint8Array;

package/dist/cjs/providers/shopify.cjs

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.shopifyDescriptor = void 0;
+const shared_js_1 = require("./shared.cjs");
+const SIGNATURE_HEADER = 'x-shopify-hmac-sha256';
+const DELIVERY_HEADER = 'x-shopify-webhook-id';
+const EVENT_HEADER = 'x-shopify-event-id';
+function optionalHeader(headers, name) {
+    const value = headers.get(name);
+    return value === undefined || value === '' ? null : value;
+}
+/**
+ * Shopify HTTPS `X-Shopify-Hmac-Sha256`: canonical Base64 HMAC-SHA256 over the
+ * raw body only, keyed with the app client secret. Delivery and event IDs are
+ * unsigned metadata. EventBridge/Pub/Sub deliveries carry no HMAC header and are
+ * therefore not verifiable by this descriptor.
+ */
+exports.shopifyDescriptor = {
+    provider: 'shopify',
+    decodeSecret(secret) {
+        return (0, shared_js_1.decodeLiteralSecret)(secret, 'Shopify');
+    },
+    parse(headers, rawBody) {
+        const raw = headers.get(SIGNATURE_HEADER);
+        if (raw === undefined || raw.trim() === '') {
+            return (0, shared_js_1.failure)('missing-signature', 'No Shopify signature header was provided.');
+        }
+        const signature = (0, shared_js_1.decodeBase64Signature)(raw);
+        if (signature === null) {
+            return (0, shared_js_1.failure)('malformed-signature', 'The Shopify signature header is malformed.');
+        }
+        const identity = {
+            deliveryId: optionalHeader(headers, DELIVERY_HEADER),
+            eventId: optionalHeader(headers, EVENT_HEADER),
+            timestamp: null,
+            authenticatedFields: [],
+        };
+        return { ok: true, signatures: [signature], signedContent: rawBody, identity };
+    },
+};

package/dist/cjs/providers/shopify.d.cts

@@ -0,0 +1,8 @@
+import type { ProviderDescriptor } from '../internal/provider.cjs';
+/**
+ * Shopify HTTPS `X-Shopify-Hmac-Sha256`: canonical Base64 HMAC-SHA256 over the
+ * raw body only, keyed with the app client secret. Delivery and event IDs are
+ * unsigned metadata. EventBridge/Pub/Sub deliveries carry no HMAC header and are
+ * therefore not verifiable by this descriptor.
+ */
+export declare const shopifyDescriptor: ProviderDescriptor;

package/dist/cjs/providers/standard-webhooks-protocol.cjs

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createStandardWebhooksProtocol = createStandardWebhooksProtocol;
+const errors_js_1 = require("../errors.cjs");
+const bytes_js_1 = require("../internal/bytes.cjs");
+const shared_js_1 = require("./shared.cjs");
+const SCHEME = 'v1';
+const SECRET_PREFIX = 'whsec_';
+const MIN_KEY_BYTES = 24;
+const MAX_KEY_BYTES = 64;
+/**
+ * Internal Standard Webhooks v1 protocol factory. `headerNames` selects the
+ * canonical or branded header family; callers own alias policy and must never
+ * mix names from two families in one configuration.
+ */
+function createStandardWebhooksProtocol(provider, label, headerNames) {
+    return {
+        provider,
+        decodeSecret(secret) {
+            if (!(0, shared_js_1.isNonEmptySecret)(secret)) {
+                throw new errors_js_1.HooklatchError('invalid-secret', `Invalid ${label} signing secret.`);
+            }
+            const encoded = secret.startsWith(SECRET_PREFIX)
+                ? secret.slice(SECRET_PREFIX.length)
+                : secret;
+            const bytes = (0, bytes_js_1.decodeBase64)(encoded);
+            if (bytes === null || bytes.byteLength < MIN_KEY_BYTES || bytes.byteLength > MAX_KEY_BYTES) {
+                throw new errors_js_1.HooklatchError('invalid-secret', `Invalid ${label} signing secret.`);
+            }
+            return bytes;
+        },
+        parse(headers, rawBody) {
+            const signatureRaw = headers.get(headerNames.signature);
+            if (signatureRaw === undefined || signatureRaw.trim() === '') {
+                return (0, shared_js_1.failure)('missing-signature', `No ${label} signature header was provided.`);
+            }
+            const signatures = [];
+            let unknownSchemes = 0;
+            for (const piece of signatureRaw.split(/\s+/)) {
+                if (piece === '')
+                    continue;
+                const separator = piece.indexOf(',');
+                if (separator <= 0 || separator === piece.length - 1) {
+                    return (0, shared_js_1.failure)('malformed-signature', `The ${label} signature header is malformed.`);
+                }
+                const version = piece.slice(0, separator);
+                const value = piece.slice(separator + 1);
+                // HTTP comma-combined duplicate header values never form a valid token.
+                if (!(0, shared_js_1.isSchemeToken)(version) || /[,\s]/.test(value)) {
+                    return (0, shared_js_1.failure)('malformed-signature', `The ${label} signature header is malformed.`);
+                }
+                if (version === SCHEME) {
+                    const decoded = (0, shared_js_1.decodeBase64Signature)(value);
+                    // A malformed `v1` fails closed even when another `v1` value is valid.
+                    if (decoded === null) {
+                        return (0, shared_js_1.failure)('malformed-signature', `The ${label} signature header is malformed.`);
+                    }
+                    signatures.push(decoded);
+                }
+                else {
+                    unknownSchemes += 1;
+                }
+            }
+            if (signatures.length === 0) {
+                return unknownSchemes > 0
+                    ? (0, shared_js_1.failure)('unsupported-scheme', `No supported ${label} signature scheme was provided.`)
+                    : (0, shared_js_1.failure)('missing-signature', `No ${label} signature value was provided.`);
+            }
+            const id = headers.get(headerNames.id);
+            if (id === undefined || id === '') {
+                return (0, shared_js_1.failure)('missing-identity', `No ${label} message id was provided.`);
+            }
+            if (id.includes('.') || id.includes(',')) {
+                return (0, shared_js_1.failure)('malformed-signature', `The ${label} message id is malformed.`);
+            }
+            const timestampText = headers.get(headerNames.timestamp);
+            if (timestampText === undefined || timestampText === '') {
+                return (0, shared_js_1.failure)('missing-timestamp', `No ${label} timestamp was provided.`);
+            }
+            if (!(0, shared_js_1.isCanonicalTimestamp)(timestampText)) {
+                return (0, shared_js_1.failure)('malformed-signature', `The ${label} timestamp is malformed.`);
+            }
+            const identity = {
+                deliveryId: null,
+                eventId: id,
+                timestamp: Number(timestampText),
+                authenticatedFields: ['eventId', 'timestamp'],
+            };
+            return {
+                ok: true,
+                signatures,
+                signedContent: (0, bytes_js_1.concatBytes)((0, bytes_js_1.utf8)(`${id}.${timestampText}.`), rawBody),
+                identity,
+            };
+        },
+    };
+}

package/dist/cjs/providers/standard-webhooks-protocol.d.cts

@@ -0,0 +1,14 @@
+import type { ProviderDescriptor } from '../internal/provider.cjs';
+export interface StandardWebhooksHeaderNames {
+    readonly id: string;
+    readonly timestamp: string;
+    readonly signature: string;
+}
+/**
+ * Internal Standard Webhooks v1 protocol factory. `headerNames` selects the
+ * canonical or branded header family; callers own alias policy and must never
+ * mix names from two families in one configuration.
+ */
+export declare function createStandardWebhooksProtocol<P extends string>(provider: P, label: string, headerNames: StandardWebhooksHeaderNames): {
+    readonly provider: P;
+} & Pick<ProviderDescriptor, 'decodeSecret' | 'parse'>;

package/dist/cjs/providers/standard-webhooks.cjs

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.standardWebhooksDescriptor = void 0;
+const standard_webhooks_protocol_js_1 = require("./standard-webhooks-protocol.cjs");
+/**
+ * Standard Webhooks v1: `webhook-id`, `webhook-timestamp`, and a
+ * whitespace-separated `webhook-signature` list of `v1,<base64>` tokens.
+ * The signature covers `${id}.${timestamp}.<raw body>`. The Ed25519
+ * `v1a` scheme is recognized but unsupported in this release.
+ */
+exports.standardWebhooksDescriptor = (0, standard_webhooks_protocol_js_1.createStandardWebhooksProtocol)('standard-webhooks', 'Standard Webhooks', {
+    id: 'webhook-id',
+    timestamp: 'webhook-timestamp',
+    signature: 'webhook-signature',
+});

package/dist/cjs/providers/standard-webhooks.d.cts

@@ -0,0 +1,9 @@
+/**
+ * Standard Webhooks v1: `webhook-id`, `webhook-timestamp`, and a
+ * whitespace-separated `webhook-signature` list of `v1,<base64>` tokens.
+ * The signature covers `${id}.${timestamp}.<raw body>`. The Ed25519
+ * `v1a` scheme is recognized but unsupported in this release.
+ */
+export declare const standardWebhooksDescriptor: {
+    readonly provider: "standard-webhooks";
+} & Pick<import("../internal/provider.cjs").ProviderDescriptor, "decodeSecret" | "parse">;

package/dist/cjs/providers/stripe.cjs

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stripeDescriptor = void 0;
+const bytes_js_1 = require("../internal/bytes.cjs");
+const shared_js_1 = require("./shared.cjs");
+const HEADER = 'stripe-signature';
+const SCHEME = 'v1';
+const TIMESTAMP_KEY = 't';
+/**
+ * Stripe `Stripe-Signature` header: `t=<timestamp>,v1=<hex>[,v1=<hex>][,v0=...]`.
+ * Whitespace is permitted around comma-separated items. `t` is a singleton and
+ * is signed; repeated `t` is rejected. The signature covers `${t}.<raw body>`.
+ */
+exports.stripeDescriptor = {
+    provider: 'stripe',
+    decodeSecret(secret) {
+        // Stripe keys the HMAC with the literal secret string, including `whsec_`.
+        return (0, shared_js_1.decodeLiteralSecret)(secret, 'Stripe');
+    },
+    parse(headers, rawBody) {
+        const raw = headers.get(HEADER);
+        if (raw === undefined || raw.trim() === '') {
+            return (0, shared_js_1.failure)('missing-signature', 'No Stripe signature header was provided.');
+        }
+        const signatures = [];
+        let timestampText;
+        let unknownSchemes = 0;
+        for (const rawItem of raw.split(',')) {
+            const item = rawItem.trim();
+            const separator = item.indexOf('=');
+            if (item === '' || separator <= 0 || separator === item.length - 1) {
+                return (0, shared_js_1.failure)('malformed-signature', 'The Stripe signature header is malformed.');
+            }
+            const key = item.slice(0, separator);
+            const value = item.slice(separator + 1);
+            if (key === TIMESTAMP_KEY) {
+                if (timestampText !== undefined) {
+                    return (0, shared_js_1.failure)('malformed-signature', 'The Stripe signature header is malformed.');
+                }
+                if (!(0, shared_js_1.isCanonicalTimestamp)(value)) {
+                    return (0, shared_js_1.failure)('malformed-signature', 'The Stripe signature header is malformed.');
+                }
+                timestampText = value;
+            }
+            else if (key === SCHEME) {
+                const decoded = (0, shared_js_1.decodeHexSignature)(value);
+                // A malformed `v1` fails closed even when another `v1` value is valid.
+                if (decoded === null) {
+                    return (0, shared_js_1.failure)('malformed-signature', 'The Stripe signature header is malformed.');
+                }
+                signatures.push(decoded);
+            }
+            else if ((0, shared_js_1.isSchemeToken)(key)) {
+                unknownSchemes += 1;
+            }
+            else {
+                return (0, shared_js_1.failure)('malformed-signature', 'The Stripe signature header is malformed.');
+            }
+        }
+        if (timestampText === undefined) {
+            return (0, shared_js_1.failure)('missing-timestamp', 'No Stripe signature timestamp was provided.');
+        }
+        if (signatures.length === 0) {
+            return unknownSchemes > 0
+                ? (0, shared_js_1.failure)('unsupported-scheme', 'No supported Stripe signature scheme was provided.')
+                : (0, shared_js_1.failure)('missing-signature', 'No Stripe signature value was provided.');
+        }
+        const identity = {
+            deliveryId: null,
+            eventId: null,
+            timestamp: Number(timestampText),
+            authenticatedFields: ['timestamp'],
+        };
+        return {
+            ok: true,
+            signatures,
+            signedContent: (0, bytes_js_1.concatBytes)((0, bytes_js_1.utf8)(`${timestampText}.`), rawBody),
+            identity,
+        };
+    },
+};

package/dist/cjs/providers/stripe.d.cts

@@ -0,0 +1,7 @@
+import type { ProviderDescriptor } from '../internal/provider.cjs';
+/**
+ * Stripe `Stripe-Signature` header: `t=<timestamp>,v1=<hex>[,v1=<hex>][,v0=...]`.
+ * Whitespace is permitted around comma-separated items. `t` is a singleton and
+ * is signed; repeated `t` is rejected. The signature covers `${t}.<raw body>`.
+ */
+export declare const stripeDescriptor: ProviderDescriptor;

package/dist/cjs/providers/svix.cjs

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.svixDescriptor = void 0;
+const shared_js_1 = require("./shared.cjs");
+const standard_webhooks_protocol_js_1 = require("./standard-webhooks-protocol.cjs");
+const BRANDED_HEADERS = {
+    id: 'svix-id',
+    timestamp: 'svix-timestamp',
+    signature: 'svix-signature',
+};
+const CANONICAL_HEADERS = {
+    id: 'webhook-id',
+    timestamp: 'webhook-timestamp',
+    signature: 'webhook-signature',
+};
+const brandedDescriptor = (0, standard_webhooks_protocol_js_1.createStandardWebhooksProtocol)('svix', 'Svix', BRANDED_HEADERS);
+const canonicalDescriptor = (0, standard_webhooks_protocol_js_1.createStandardWebhooksProtocol)('svix', 'Svix', CANONICAL_HEADERS);
+function familyPresent(headers, names) {
+    return headers.has(names.id) || headers.has(names.timestamp) || headers.has(names.signature);
+}
+function familyComplete(headers, names) {
+    const id = headers.get(names.id);
+    const timestamp = headers.get(names.timestamp);
+    const signature = headers.get(names.signature);
+    return id !== undefined && id !== ''
+        && timestamp !== undefined && timestamp !== ''
+        && signature !== undefined && signature !== '';
+}
+function familiesEqual(headers) {
+    return familyComplete(headers, BRANDED_HEADERS)
+        && familyComplete(headers, CANONICAL_HEADERS)
+        && headers.get(BRANDED_HEADERS.id) === headers.get(CANONICAL_HEADERS.id)
+        && headers.get(BRANDED_HEADERS.timestamp) === headers.get(CANONICAL_HEADERS.timestamp)
+        && headers.get(BRANDED_HEADERS.signature) === headers.get(CANONICAL_HEADERS.signature);
+}
+/**
+ * Svix accepts the branded `svix-*` and canonical `webhook-*` Standard
+ * Webhooks header families. A single family is parsed with the existing
+ * signature -> identity -> timestamp ordering. When both families have any
+ * header present, both must be complete and value-identical; otherwise the
+ * request is malformed. A failed family is never rescued by the other one.
+ */
+exports.svixDescriptor = {
+    provider: 'svix',
+    decodeSecret(secret) {
+        return brandedDescriptor.decodeSecret(secret);
+    },
+    parse(headers, rawBody) {
+        const brandedPresent = familyPresent(headers, BRANDED_HEADERS);
+        const canonicalPresent = familyPresent(headers, CANONICAL_HEADERS);
+        if (brandedPresent && canonicalPresent) {
+            if (!familiesEqual(headers)) {
+                return (0, shared_js_1.failure)('malformed-signature', 'The Svix signature headers are malformed.');
+            }
+            return brandedDescriptor.parse(headers, rawBody);
+        }
+        if (canonicalPresent)
+            return canonicalDescriptor.parse(headers, rawBody);
+        if (brandedPresent)
+            return brandedDescriptor.parse(headers, rawBody);
+        return (0, shared_js_1.failure)('missing-signature', 'No Svix signature header was provided.');
+    },
+};

package/dist/cjs/providers/svix.d.cts

@@ -0,0 +1,9 @@
+import type { ProviderDescriptor } from '../internal/provider.cjs';
+/**
+ * Svix accepts the branded `svix-*` and canonical `webhook-*` Standard
+ * Webhooks header families. A single family is parsed with the existing
+ * signature -> identity -> timestamp ordering. When both families have any
+ * header present, both must be complete and value-identical; otherwise the
+ * request is malformed. A failed family is never rescued by the other one.
+ */
+export declare const svixDescriptor: ProviderDescriptor;

package/dist/cjs/providers/vercel.cjs

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.vercelDescriptor = void 0;
+const shared_js_1 = require("./shared.cjs");
+/** Scoped x-vercel-signature webhook recipe; exact bytes and literal UTF-8 keys.
+ * https://vercel.com/docs/webhooks/webhooks-api
+ * Either hex case is accepted as receiver policy. No freshness is inferred.
+ */
+exports.vercelDescriptor = {
+    provider: 'vercel',
+    crypto: { kind: 'hmac', hash: 'SHA-1', signatureBytes: 20 },
+    decodeSecret(secret) {
+        return (0, shared_js_1.decodeLiteralSecret)(secret, 'Vercel');
+    },
+    parse(headers, rawBody) {
+        const raw = headers.get('x-vercel-signature');
+        if (raw === undefined || raw.trim() === '') {
+            return (0, shared_js_1.failure)('missing-signature', 'No Vercel signature header was provided.');
+        }
+        const signature = decodeSignature(raw);
+        if (signature === null) {
+            return (0, shared_js_1.failure)('malformed-signature', 'The Vercel signature header is malformed.');
+        }
+        return {
+            ok: true, signatures: [signature], signedContent: rawBody,
+            identity: { deliveryId: null, eventId: null, timestamp: null, authenticatedFields: [] },
+        };
+    },
+};
+/** Deliberately private: the existing shared SHA256 decoder stays 32 bytes. */
+function decodeSignature(value) {
+    if (!/^[a-fA-F0-9]{40}$/.test(value))
+        return null;
+    const bytes = new Uint8Array(20);
+    for (let index = 0; index < bytes.length; index++) {
+        bytes[index] = Number.parseInt(value.slice(index * 2, index * 2 + 2), 16);
+    }
+    return bytes;
+}

package/dist/cjs/providers/vercel.d.cts

@@ -0,0 +1,15 @@
+import type { NormalizedHeaders, ParseResult } from '../internal/provider.cjs';
+/** Scoped x-vercel-signature webhook recipe; exact bytes and literal UTF-8 keys.
+ * https://vercel.com/docs/webhooks/webhooks-api
+ * Either hex case is accepted as receiver policy. No freshness is inferred.
+ */
+export declare const vercelDescriptor: {
+    provider: "vercel";
+    crypto: {
+        kind: "hmac";
+        hash: "SHA-1";
+        signatureBytes: 20;
+    };
+    decodeSecret(secret: string): Uint8Array;
+    parse(headers: NormalizedHeaders, rawBody: Uint8Array): ParseResult;
+};