pipework 0.7.12 → 0.7.17

package/dist/infra/idempotency/middleware.js

@@ -0,0 +1,56 @@
+import { createStore } from './store.js';
+const DEFAULTS = {
+    table: '__pipework_idempotency',
+    headerName: 'Idempotency-Key',
+    ttlSeconds: 86400,
+    lockTimeoutMs: 30_000,
+    methods: ['POST', 'PATCH', 'DELETE'],
+};
+export function createIdempotency(instance, config) {
+    const resolved = {
+        database: config.database,
+        table: config.table ?? DEFAULTS.table,
+        headerName: config.headerName ?? DEFAULTS.headerName,
+        ttlSeconds: config.ttlSeconds ?? DEFAULTS.ttlSeconds,
+        lockTimeoutMs: config.lockTimeoutMs ?? DEFAULTS.lockTimeoutMs,
+        methods: config.methods ?? [...DEFAULTS.methods],
+    };
+    const store = createStore(resolved.table);
+    return {
+        store,
+        config: resolved,
+        async check(db, tenantId, key, method, path) {
+            const existing = await store.find(db, tenantId, key);
+            if (existing === null) {
+                const locked = await store.lock(db, tenantId, key, method, path, resolved.lockTimeoutMs);
+                if (!locked) {
+                    return { status: 'locked' };
+                }
+                return { status: 'new' };
+            }
+            if (existing.statusCode !== null) {
+                return { status: 'completed', statusCode: existing.statusCode, body: existing.responseBody };
+            }
+            if (existing.lockedUntil !== null && existing.lockedUntil.getTime() > Date.now()) {
+                return { status: 'locked' };
+            }
+            // Lock expired — re-lock and retry
+            await store.remove(db, tenantId, key);
+            const locked = await store.lock(db, tenantId, key, method, path, resolved.lockTimeoutMs);
+            if (!locked) {
+                return { status: 'locked' };
+            }
+            return { status: 'new' };
+        },
+        async complete(db, tenantId, key, statusCode, body) {
+            await store.complete(db, tenantId, key, statusCode, body);
+        },
+        async fail(db, tenantId, key) {
+            await store.remove(db, tenantId, key);
+        },
+        async cleanup(db) {
+            return store.cleanup(db, resolved.ttlSeconds);
+        },
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/infra/idempotency/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/infra/idempotency/middleware.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAmBxC,MAAM,QAAQ,GAAG;IACf,KAAK,EAAE,wBAAwB;IAC/B,UAAU,EAAE,iBAAiB;IAC7B,UAAU,EAAE,KAAK;IACjB,aAAa,EAAE,MAAM;IACrB,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAU;CACrC,CAAA;AAEV,MAAM,UAAU,iBAAiB,CAAC,QAAkB,EAAE,MAAyB;IAC7E,MAAM,QAAQ,GAAgC;QAC5C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK;QACrC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU;QACpD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU;QACpD,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa;QAC7D,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC;KACjD,CAAA;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAEzC,OAAO;QACL,KAAK;QACL,MAAM,EAAE,QAAQ;QAEhB,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI;YACzC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAA;YAEpD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAA;gBACxF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;gBAC7B,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;YAC1B,CAAC;YAED,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBACjC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAA;YAC9F,CAAC;YAED,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI,IAAI,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACjF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;YAC7B,CAAC;YAED,mCAAmC;YACnC,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAA;YACrC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAA;YACxF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;YAC7B,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;QAC1B,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI;YAChD,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;QAC3D,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG;YAC1B,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAA;QACvC,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAE;YACd,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAA;QAC/C,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/infra/idempotency/store.d.ts

@@ -0,0 +1,3 @@
+import type { IdempotencyStore } from './types.js';
+export declare function createStore(table: string): IdempotencyStore;
+//# sourceMappingURL=store.d.ts.map

package/dist/infra/idempotency/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/infra/idempotency/store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAqB,MAAM,YAAY,CAAA;AAErE,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,CA2E3D"}

package/dist/infra/idempotency/store.js

@@ -0,0 +1,63 @@
+import { sql } from '../../data/db/sql.js';
+export function createStore(table) {
+    return {
+        async ensureTable(db) {
+            await db.execute(sql.raw(`
+        CREATE TABLE IF NOT EXISTS ${table} (
+          key TEXT NOT NULL,
+          tenant_id TEXT NOT NULL,
+          method TEXT NOT NULL,
+          path TEXT NOT NULL,
+          status_code INTEGER,
+          response_body JSONB,
+          locked_until TIMESTAMPTZ,
+          created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+          PRIMARY KEY (tenant_id, key)
+        )
+      `));
+        },
+        async find(db, tenantId, key) {
+            const rows = await db.execute(sql `SELECT key, tenant_id, method, path, status_code, response_body, locked_until, created_at
+            FROM ${sql.raw(table)}
+            WHERE tenant_id = ${tenantId} AND key = ${key}`);
+            const row = rows[0];
+            if (row === undefined)
+                return null;
+            return {
+                key: row['key'],
+                tenantId: row['tenant_id'],
+                method: row['method'],
+                path: row['path'],
+                statusCode: row['status_code'],
+                responseBody: row['response_body'],
+                lockedUntil: row['locked_until'] !== null ? new Date(row['locked_until']) : null,
+                createdAt: new Date(row['created_at']),
+            };
+        },
+        async lock(db, tenantId, key, method, path, lockMs) {
+            const lockUntil = new Date(Date.now() + lockMs);
+            const rows = await db.execute(sql `INSERT INTO ${sql.raw(table)} (key, tenant_id, method, path, locked_until)
+            VALUES (${key}, ${tenantId}, ${method}, ${path}, ${lockUntil.toISOString()})
+            ON CONFLICT (tenant_id, key) DO NOTHING
+            RETURNING key`);
+            return rows.length > 0;
+        },
+        async complete(db, tenantId, key, statusCode, responseBody) {
+            await db.execute(sql `UPDATE ${sql.raw(table)}
+            SET status_code = ${statusCode},
+                response_body = ${JSON.stringify(responseBody)},
+                locked_until = NULL
+            WHERE tenant_id = ${tenantId} AND key = ${key}`);
+        },
+        async remove(db, tenantId, key) {
+            await db.execute(sql `DELETE FROM ${sql.raw(table)} WHERE tenant_id = ${tenantId} AND key = ${key}`);
+        },
+        async cleanup(db, ttlSeconds) {
+            const rows = await db.execute(sql `DELETE FROM ${sql.raw(table)}
+            WHERE created_at < now() - ${ttlSeconds.toString() + ' seconds'}::interval
+            RETURNING key`);
+            return rows.length;
+        },
+    };
+}
+//# sourceMappingURL=store.js.map

package/dist/infra/idempotency/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/infra/idempotency/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAI1C,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,EAAM;YACtB,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;qCACM,KAAK;;;;;;;;;;;OAWnC,CAAC,CAAC,CAAA;QACL,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAM,EAAE,QAAgB,EAAE,GAAW;YAC9C,MAAM,IAAI,GAAc,MAAM,EAAE,CAAC,OAAO,CACtC,GAAG,CAAA;mBACQ,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;gCACD,QAAQ,cAAc,GAAG,EAAE,CACpD,CAAA;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAwC,CAAA;YAC1D,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAA;YAElC,OAAO;gBACL,GAAG,EAAE,GAAG,CAAC,KAAK,CAAW;gBACzB,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAW;gBACpC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAW;gBAC/B,IAAI,EAAE,GAAG,CAAC,MAAM,CAAW;gBAC3B,UAAU,EAAE,GAAG,CAAC,aAAa,CAAkB;gBAC/C,YAAY,EAAE,GAAG,CAAC,eAAe,CAAC;gBAClC,WAAW,EAAE,GAAG,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,cAAc,CAAW,CAAC,CAAC,CAAC,CAAC,IAAI;gBAC1F,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAW,CAAC;aACjD,CAAA;QACH,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAM,EAAE,QAAgB,EAAE,GAAW,EAAE,MAAc,EAAE,IAAY,EAAE,MAAc;YAC5F,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAA;YAC/C,MAAM,IAAI,GAAc,MAAM,EAAE,CAAC,OAAO,CACtC,GAAG,CAAA,eAAe,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;sBAClB,GAAG,KAAK,QAAQ,KAAK,MAAM,KAAK,IAAI,KAAK,SAAS,CAAC,WAAW,EAAE;;0BAE5D,CACnB,CAAA;YACD,OAAQ,IAAkB,CAAC,MAAM,GAAG,CAAC,CAAA;QACvC,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAM,EAAE,QAAgB,EAAE,GAAW,EAAE,UAAkB,EAAE,YAAqB;YAC7F,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA,UAAU,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;gCACH,UAAU;kCACR,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC;;gCAE9B,QAAQ,cAAc,GAAG,EAAE,CACpD,CAAA;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAM,EAAE,QAAgB,EAAE,GAAW;YAChD,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA,eAAe,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,sBAAsB,QAAQ,cAAc,GAAG,EAAE,CAClF,CAAA;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAM,EAAE,UAAkB;YACtC,MAAM,IAAI,GAAc,MAAM,EAAE,CAAC,OAAO,CACtC,GAAG,CAAA,eAAe,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;yCACC,UAAU,CAAC,QAAQ,EAAE,GAAG,UAAU;0BACjD,CACnB,CAAA;YACD,OAAQ,IAAkB,CAAC,MAAM,CAAA;QACnC,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/infra/idempotency/types.d.ts

@@ -0,0 +1,28 @@
+import type { DB } from '../../data/db/index.js';
+export interface IdempotencyConfig {
+    database: string;
+    table?: string;
+    headerName?: string;
+    ttlSeconds?: number;
+    lockTimeoutMs?: number;
+    methods?: ReadonlyArray<'POST' | 'PUT' | 'PATCH' | 'DELETE'>;
+}
+export interface IdempotencyRecord {
+    key: string;
+    tenantId: string;
+    method: string;
+    path: string;
+    statusCode: number | null;
+    responseBody: unknown;
+    lockedUntil: Date | null;
+    createdAt: Date;
+}
+export interface IdempotencyStore {
+    ensureTable(db: DB): Promise<void>;
+    find(db: DB, tenantId: string, key: string): Promise<IdempotencyRecord | null>;
+    lock(db: DB, tenantId: string, key: string, method: string, path: string, lockMs: number): Promise<boolean>;
+    complete(db: DB, tenantId: string, key: string, statusCode: number, responseBody: unknown): Promise<void>;
+    remove(db: DB, tenantId: string, key: string): Promise<void>;
+    cleanup(db: DB, ttlSeconds: number): Promise<number>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/infra/idempotency/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/infra/idempotency/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAEhD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,OAAO,CAAC,EAAE,aAAa,CAAC,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC,CAAA;CAC7D;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,YAAY,EAAE,OAAO,CAAA;IACrB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,IAAI,CAAA;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAA;IAC9E,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC3G,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzG,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5D,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACrD"}

package/dist/infra/idempotency/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/infra/idempotency/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/infra/idempotency/types.ts"],"names":[],"mappings":""}

package/dist/infra/webhook/inbound.d.ts

@@ -0,0 +1,16 @@
+import type { Handler, HttpMethod } from '../../request/di/types.js';
+import type { SignatureVerifier } from './verify.js';
+export interface InboundWebhookConfig<TPayload> {
+    path: string;
+    method?: HttpMethod;
+    verifier: SignatureVerifier;
+    parsePayload?: (rawBody: Buffer) => TPayload;
+    idempotencyKey?: (payload: TPayload) => string;
+}
+export interface InboundWebhookContext<TPayload> {
+    payload: TPayload;
+    rawBody: Buffer;
+    headers: Readonly<Record<string, string | undefined>>;
+}
+export declare function defineInboundWebhook<TPayload = unknown>(config: InboundWebhookConfig<TPayload>, handler: (ctx: InboundWebhookContext<TPayload>) => Promise<unknown>): Handler<Record<string, unknown>, unknown>;
+//# sourceMappingURL=inbound.d.ts.map

package/dist/infra/webhook/inbound.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbound.d.ts","sourceRoot":"","sources":["../../../src/infra/webhook/inbound.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAIpD,MAAM,WAAW,oBAAoB,CAAC,QAAQ;IAC5C,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,QAAQ,EAAE,iBAAiB,CAAA;IAC3B,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,QAAQ,CAAA;IAC5C,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,MAAM,CAAA;CAC/C;AAED,MAAM,WAAW,qBAAqB,CAAC,QAAQ;IAC7C,OAAO,EAAE,QAAQ,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;CACtD;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,GAAG,OAAO,EACrD,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EACtC,OAAO,EAAE,CAAC,GAAG,EAAE,qBAAqB,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,GAClE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAsB3C"}

package/dist/infra/webhook/inbound.js

@@ -0,0 +1,21 @@
+import { Builder } from '../../request/di/builder.js';
+import { UnauthorizedError } from '../../core/errors/index.js';
+export function defineInboundWebhook(config, handler) {
+    const method = config.method ?? 'POST';
+    const parse = config.parsePayload ?? ((raw) => JSON.parse(raw.toString('utf-8')));
+    return new Builder()
+        .public()
+        .rawBody()
+        .request()
+        .route(method, config.path)
+        .fit(async ({ rawBody, request }) => {
+        if (!config.verifier.verify(rawBody, request.headers)) {
+            throw new UnauthorizedError('Webhook signature verification failed.\n\n' +
+                '  The request signature does not match the expected value.\n' +
+                '  Check that the signing secret is correct and the raw body is unmodified.\n');
+        }
+        const payload = parse(rawBody);
+        return handler({ payload, rawBody, headers: request.headers });
+    });
+}
+//# sourceMappingURL=inbound.js.map

package/dist/infra/webhook/inbound.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbound.js","sourceRoot":"","sources":["../../../src/infra/webhook/inbound.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAgB9D,MAAM,UAAU,oBAAoB,CAClC,MAAsC,EACtC,OAAmE;IAEnE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAA;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAa,CAAC,CAAA;IAErG,OAAO,IAAI,OAAO,EAAE;SACjB,MAAM,EAAE;SACR,OAAO,EAAE;SACT,OAAO,EAAE;SACT,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;SAC1B,GAAG,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;QAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,iBAAiB,CACzB,4CAA4C;gBAC5C,8DAA8D;gBAC9D,8EAA8E,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAA;QAE9B,OAAO,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;AACN,CAAC"}

package/dist/infra/webhook/index.d.ts

@@ -0,0 +1,5 @@
+export { defineInboundWebhook, type InboundWebhookConfig, type InboundWebhookContext } from './inbound.js';
+export { hmacVerifier, stripeVerifier, githubVerifier, type SignatureVerifier } from './verify.js';
+export { signPayload, type SignedPayload, type WebhookSignatureOptions } from './sign.js';
+export { createOutboundWebhook, type OutboundWebhookConfig, type OutboundWebhook, type WebhookEndpoint, type DeliveryAttempt } from './outbound.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/infra/webhook/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/infra/webhook/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,KAAK,oBAAoB,EAAE,KAAK,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAC1G,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAClG,OAAO,EAAE,WAAW,EAAE,KAAK,aAAa,EAAE,KAAK,uBAAuB,EAAE,MAAM,WAAW,CAAA;AACzF,OAAO,EAAE,qBAAqB,EAAE,KAAK,qBAAqB,EAAE,KAAK,eAAe,EAC9E,KAAK,eAAe,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAA"}

package/dist/infra/webhook/index.js

@@ -0,0 +1,5 @@
+export { defineInboundWebhook } from './inbound.js';
+export { hmacVerifier, stripeVerifier, githubVerifier } from './verify.js';
+export { signPayload } from './sign.js';
+export { createOutboundWebhook } from './outbound.js';
+//# sourceMappingURL=index.js.map

package/dist/infra/webhook/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/infra/webhook/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAyD,MAAM,cAAc,CAAA;AAC1G,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAA0B,MAAM,aAAa,CAAA;AAClG,OAAO,EAAE,WAAW,EAAoD,MAAM,WAAW,CAAA;AACzF,OAAO,EAAE,qBAAqB,EACgB,MAAM,eAAe,CAAA"}

package/dist/infra/webhook/namespace.d.ts

@@ -0,0 +1,22 @@
+import { defineInboundWebhook } from './inbound.js';
+import { hmacVerifier, stripeVerifier, githubVerifier } from './verify.js';
+import { signPayload } from './sign.js';
+import { createOutboundWebhook } from './outbound.js';
+/** Webhook namespace — inbound verification, outbound delivery with retries, HMAC signing. */
+export declare const webhook: {
+    /** Defines an inbound webhook handler with signature verification and optional idempotency. */
+    readonly defineInbound: typeof defineInboundWebhook;
+    /** Creates an outbound webhook system — endpoint registration, payload signing, delivery with retries. */
+    readonly createOutbound: typeof createOutboundWebhook;
+    readonly verify: {
+        /** Creates an HMAC signature verifier for inbound webhooks. */
+        readonly hmac: typeof hmacVerifier;
+        /** Creates a Stripe-compatible signature verifier. */
+        readonly stripe: typeof stripeVerifier;
+        /** Creates a GitHub-compatible signature verifier. */
+        readonly github: typeof githubVerifier;
+    };
+    /** Signs a payload with HMAC for outbound delivery — returns body, signature, timestamp, messageId. */
+    readonly sign: typeof signPayload;
+};
+//# sourceMappingURL=namespace.d.ts.map

package/dist/infra/webhook/namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../../src/infra/webhook/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAErD,8FAA8F;AAC9F,eAAO,MAAM,OAAO;IAClB,+FAA+F;;IAE/F,0GAA0G;;;QAIxG,+DAA+D;;QAE/D,sDAAsD;;QAEtD,sDAAsD;;;IAIxD,uGAAuG;;CAE/F,CAAA"}

package/dist/infra/webhook/namespace.js

@@ -0,0 +1,22 @@
+import { defineInboundWebhook } from './inbound.js';
+import { hmacVerifier, stripeVerifier, githubVerifier } from './verify.js';
+import { signPayload } from './sign.js';
+import { createOutboundWebhook } from './outbound.js';
+/** Webhook namespace — inbound verification, outbound delivery with retries, HMAC signing. */
+export const webhook = {
+    /** Defines an inbound webhook handler with signature verification and optional idempotency. */
+    defineInbound: defineInboundWebhook,
+    /** Creates an outbound webhook system — endpoint registration, payload signing, delivery with retries. */
+    createOutbound: createOutboundWebhook,
+    verify: {
+        /** Creates an HMAC signature verifier for inbound webhooks. */
+        hmac: hmacVerifier,
+        /** Creates a Stripe-compatible signature verifier. */
+        stripe: stripeVerifier,
+        /** Creates a GitHub-compatible signature verifier. */
+        github: githubVerifier,
+    },
+    /** Signs a payload with HMAC for outbound delivery — returns body, signature, timestamp, messageId. */
+    sign: signPayload,
+};
+//# sourceMappingURL=namespace.js.map

package/dist/infra/webhook/namespace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../../src/infra/webhook/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAErD,8FAA8F;AAC9F,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,+FAA+F;IAC/F,aAAa,EAAE,oBAAoB;IACnC,0GAA0G;IAC1G,cAAc,EAAE,qBAAqB;IAErC,MAAM,EAAE;QACN,+DAA+D;QAC/D,IAAI,EAAE,YAAY;QAClB,sDAAsD;QACtD,MAAM,EAAE,cAAc;QACtB,sDAAsD;QACtD,MAAM,EAAE,cAAc;KACvB;IAED,uGAAuG;IACvG,IAAI,EAAE,WAAW;CACT,CAAA"}

package/dist/infra/webhook/outbound.d.ts

@@ -0,0 +1,48 @@
+import type { DB } from '../../data/db/index.js';
+import { type WebhookSignatureOptions } from './sign.js';
+export interface OutboundWebhookConfig {
+    table?: string;
+    deliveryTable?: string;
+    signing?: WebhookSignatureOptions;
+    retry?: {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    };
+    timeoutMs?: number;
+}
+export interface WebhookEndpoint {
+    id: string;
+    tenantId: string;
+    url: string;
+    secret: string;
+    events: string[];
+    active: boolean;
+}
+export interface DeliveryAttempt {
+    id: string;
+    endpointId: string;
+    tenantId: string;
+    eventType: string;
+    payload: unknown;
+    statusCode: number | null;
+    responseBody: string | null;
+    attempt: number;
+    maxAttempts: number;
+    nextRetryAt: Date | null;
+    createdAt: Date;
+}
+export interface OutboundWebhook {
+    ensureTables(db: DB): Promise<void>;
+    send(db: DB, tenantId: string, eventType: string, payload: unknown): Promise<string[]>;
+    deliver(db: DB, deliveryId: string): Promise<{
+        success: boolean;
+        statusCode: number | null;
+    }>;
+    processPending(db: DB): Promise<number>;
+    registerEndpoint(db: DB, endpoint: Omit<WebhookEndpoint, 'id'>): Promise<string>;
+    listEndpoints(db: DB, tenantId: string): Promise<WebhookEndpoint[]>;
+    removeEndpoint(db: DB, tenantId: string, endpointId: string): Promise<boolean>;
+}
+export declare function createOutboundWebhook(config?: OutboundWebhookConfig): OutboundWebhook;
+//# sourceMappingURL=outbound.d.ts.map

package/dist/infra/webhook/outbound.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound.d.ts","sourceRoot":"","sources":["../../../src/infra/webhook/outbound.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAChD,OAAO,EAAe,KAAK,uBAAuB,EAAE,MAAM,WAAW,CAAA;AAErE,MAAM,WAAW,qBAAqB;IACpC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,OAAO,CAAC,EAAE,uBAAuB,CAAA;IACjC,KAAK,CAAC,EAAE;QACN,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;IACD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,IAAI,CAAA;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IACtF,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAA;IAC7F,cAAc,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACvC,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAChF,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAA;IACnE,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC/E;AAWD,wBAAgB,qBAAqB,CAAC,MAAM,GAAE,qBAA0B,GAAG,eAAe,CAqLzF"}

package/dist/infra/webhook/outbound.js

@@ -0,0 +1,160 @@
+import { sql } from '../../data/db/sql.js';
+import { signPayload } from './sign.js';
+const DEFAULTS = {
+    table: '__pipework_webhook_endpoints',
+    deliveryTable: '__pipework_webhook_deliveries',
+    maxAttempts: 5,
+    initialDelayMs: 1000,
+    maxDelayMs: 3_600_000,
+    timeoutMs: 30_000,
+};
+export function createOutboundWebhook(config = {}) {
+    const endpointTable = config.table ?? DEFAULTS.table;
+    const deliveryTable = config.deliveryTable ?? DEFAULTS.deliveryTable;
+    const maxAttempts = config.retry?.maxAttempts ?? DEFAULTS.maxAttempts;
+    const initialDelayMs = config.retry?.initialDelayMs ?? DEFAULTS.initialDelayMs;
+    const maxDelayMs = config.retry?.maxDelayMs ?? DEFAULTS.maxDelayMs;
+    const timeoutMs = config.timeoutMs ?? DEFAULTS.timeoutMs;
+    const signingOptions = config.signing ?? {};
+    return {
+        async ensureTables(db) {
+            await db.execute(sql.raw(`
+        CREATE TABLE IF NOT EXISTS ${endpointTable} (
+          id TEXT NOT NULL PRIMARY KEY DEFAULT gen_random_uuid()::text,
+          tenant_id TEXT NOT NULL,
+          url TEXT NOT NULL,
+          secret TEXT NOT NULL,
+          events TEXT[] NOT NULL DEFAULT '{}',
+          active BOOLEAN NOT NULL DEFAULT true,
+          created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+        )
+      `));
+            await db.execute(sql.raw(`
+        CREATE TABLE IF NOT EXISTS ${deliveryTable} (
+          id TEXT NOT NULL PRIMARY KEY DEFAULT gen_random_uuid()::text,
+          endpoint_id TEXT NOT NULL,
+          tenant_id TEXT NOT NULL,
+          event_type TEXT NOT NULL,
+          payload JSONB NOT NULL,
+          status_code INTEGER,
+          response_body TEXT,
+          attempt INTEGER NOT NULL DEFAULT 0,
+          max_attempts INTEGER NOT NULL,
+          next_retry_at TIMESTAMPTZ,
+          completed_at TIMESTAMPTZ,
+          created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+        )
+      `));
+        },
+        async send(db, tenantId, eventType, payload) {
+            const endpoints = await db.execute(sql `SELECT id, url, secret FROM ${sql.raw(endpointTable)}
+            WHERE tenant_id = ${tenantId}
+              AND active = true
+              AND (events = '{}' OR ${eventType} = ANY(events))`);
+            const deliveryIds = [];
+            for (const row of endpoints) {
+                const result = await db.execute(sql `INSERT INTO ${sql.raw(deliveryTable)} (endpoint_id, tenant_id, event_type, payload, max_attempts, next_retry_at)
+              VALUES (${row.id}, ${tenantId}, ${eventType}, ${JSON.stringify(payload)}, ${maxAttempts}, now())
+              RETURNING id`);
+                const inserted = result[0];
+                if (inserted !== undefined)
+                    deliveryIds.push(inserted.id);
+            }
+            return deliveryIds;
+        },
+        async deliver(db, deliveryId) {
+            const rows = await db.execute(sql `SELECT d.id, d.endpoint_id, d.event_type, d.payload, d.attempt, d.max_attempts,
+                   e.url, e.secret
+            FROM ${sql.raw(deliveryTable)} d
+            JOIN ${sql.raw(endpointTable)} e ON e.id = d.endpoint_id
+            WHERE d.id = ${deliveryId} AND d.completed_at IS NULL`);
+            const delivery = rows[0];
+            if (delivery === undefined)
+                return { success: false, statusCode: null };
+            const attempt = delivery['attempt'] + 1;
+            const signed = signPayload(delivery['payload'], delivery['secret'], signingOptions);
+            let statusCode = null;
+            let responseBody = null;
+            let success = false;
+            try {
+                const controller = new AbortController();
+                const timer = setTimeout(() => controller.abort(), timeoutMs);
+                const response = await fetch(delivery['url'], {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json',
+                        'X-Webhook-Id': signed.messageId,
+                        'X-Webhook-Timestamp': signed.timestamp.toString(),
+                        'X-Webhook-Signature': signed.signature,
+                    },
+                    body: signed.body,
+                    signal: controller.signal,
+                });
+                clearTimeout(timer);
+                statusCode = response.status;
+                responseBody = await response.text().catch(() => null);
+                success = statusCode >= 200 && statusCode < 300;
+            }
+            catch {
+                statusCode = null;
+                responseBody = null;
+                success = false;
+            }
+            if (success || attempt >= delivery['max_attempts']) {
+                await db.execute(sql `UPDATE ${sql.raw(deliveryTable)}
+              SET attempt = ${attempt}, status_code = ${statusCode},
+                  response_body = ${responseBody}, completed_at = now(), next_retry_at = NULL
+              WHERE id = ${deliveryId}`);
+            }
+            else {
+                const delayMs = Math.min(initialDelayMs * Math.pow(2, attempt - 1), maxDelayMs);
+                const nextRetry = new Date(Date.now() + delayMs);
+                await db.execute(sql `UPDATE ${sql.raw(deliveryTable)}
+              SET attempt = ${attempt}, status_code = ${statusCode},
+                  response_body = ${responseBody}, next_retry_at = ${nextRetry.toISOString()}
+              WHERE id = ${deliveryId}`);
+            }
+            return { success, statusCode };
+        },
+        async processPending(db) {
+            const rows = await db.execute(sql `SELECT id FROM ${sql.raw(deliveryTable)}
+            WHERE completed_at IS NULL AND next_retry_at <= now()
+            ORDER BY next_retry_at ASC
+            LIMIT 100`);
+            let processed = 0;
+            for (const row of rows) {
+                await this.deliver(db, row.id);
+                processed++;
+            }
+            return processed;
+        },
+        async registerEndpoint(db, endpoint) {
+            const rows = await db.execute(sql `INSERT INTO ${sql.raw(endpointTable)} (tenant_id, url, secret, events, active)
+            VALUES (${endpoint.tenantId}, ${endpoint.url}, ${endpoint.secret},
+                    ${`{${endpoint.events.join(',')}}`}, ${endpoint.active})
+            RETURNING id`);
+            return (rows[0]).id;
+        },
+        async listEndpoints(db, tenantId) {
+            const rows = await db.execute(sql `SELECT id, tenant_id, url, secret, events, active
+            FROM ${sql.raw(endpointTable)}
+            WHERE tenant_id = ${tenantId}
+            ORDER BY created_at ASC`);
+            return rows.map(row => ({
+                id: row['id'],
+                tenantId: row['tenant_id'],
+                url: row['url'],
+                secret: row['secret'],
+                events: row['events'],
+                active: row['active'],
+            }));
+        },
+        async removeEndpoint(db, tenantId, endpointId) {
+            const rows = await db.execute(sql `DELETE FROM ${sql.raw(endpointTable)}
+            WHERE id = ${endpointId} AND tenant_id = ${tenantId}
+            RETURNING id`);
+            return rows.length > 0;
+        },
+    };
+}
+//# sourceMappingURL=outbound.js.map

package/dist/infra/webhook/outbound.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound.js","sourceRoot":"","sources":["../../../src/infra/webhook/outbound.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAE1C,OAAO,EAAE,WAAW,EAAgC,MAAM,WAAW,CAAA;AA+CrE,MAAM,QAAQ,GAAG;IACf,KAAK,EAAE,8BAA8B;IACrC,aAAa,EAAE,+BAA+B;IAC9C,WAAW,EAAE,CAAC;IACd,cAAc,EAAE,IAAI;IACpB,UAAU,EAAE,SAAS;IACrB,SAAS,EAAE,MAAM;CACT,CAAA;AAEV,MAAM,UAAU,qBAAqB,CAAC,SAAgC,EAAE;IACtE,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAA;IACpD,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAA;IACpE,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,EAAE,WAAW,IAAI,QAAQ,CAAC,WAAW,CAAA;IACrE,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,EAAE,cAAc,IAAI,QAAQ,CAAC,cAAc,CAAA;IAC9E,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,EAAE,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAA;IAClE,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAA;IACxD,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAA;IAE3C,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,EAAE;YACnB,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;qCACM,aAAa;;;;;;;;;OAS3C,CAAC,CAAC,CAAA;YAEH,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;qCACM,aAAa;;;;;;;;;;;;;;OAc3C,CAAC,CAAC,CAAA;QACL,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO;YACzC,MAAM,SAAS,GAAc,MAAM,EAAE,CAAC,OAAO,CAC3C,GAAG,CAAA,+BAA+B,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC;gCAChC,QAAQ;;sCAEF,SAAS,iBAAiB,CACzD,CAAA;YAED,MAAM,WAAW,GAAa,EAAE,CAAA;YAChC,KAAK,MAAM,GAAG,IAAI,SAA6B,EAAE,CAAC;gBAChD,MAAM,MAAM,GAAc,MAAM,EAAE,CAAC,OAAO,CACxC,GAAG,CAAA,eAAe,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC;wBAC1B,GAAG,CAAC,EAAE,KAAK,QAAQ,KAAK,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,WAAW;2BAC1E,CAClB,CAAA;gBACD,MAAM,QAAQ,GAAI,MAA2B,CAAC,CAAC,CAAC,CAAA;gBAChD,IAAI,QAAQ,KAAK,SAAS;oBAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;YAC3D,CAAC;YAED,OAAO,WAAW,CAAA;QACpB,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU;YAC1B,MAAM,IAAI,GAAc,MAAM,EAAE,CAAC,OAAO,CACtC,GAAG,CAAA;;mBAEQ,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC;mBACtB,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC;2BACd,UAAU,6BAA6B,CAC3D,CAAA;YAED,MAAM,QAAQ,GAAI,IAAkC,CAAC,CAAC,CAAC,CAAA;YACvD,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;YAEvE,MAAM,OAAO,GAAI,QAAQ,CAAC,SAAS,CAAY,GAAG,CAAC,CAAA;YACnD,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAW,EAAE,cAAc,CAAC,CAAA;YAE7F,IAAI,UAAU,GAAkB,IAAI,CAAA;YACpC,IAAI,YAAY,GAAkB,IAAI,CAAA;YACtC,IAAI,OAAO,GAAG,KAAK,CAAA;YAEnB,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;gBACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAA;gBAE7D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAW,EAAE;oBACtD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,cAAc,EAAE,MAAM,CAAC,SAAS;wBAChC,qBAAqB,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE;wBAClD,qBAAqB,EAAE,MAAM,CAAC,SAAS;qBACxC;oBACD,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAA;gBAEF,YAAY,CAAC,KAAK,CAAC,CAAA;gBACnB,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAA;gBAC5B,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;gBACtD,OAAO,GAAG,UAAU,IAAI,GAAG,IAAI,UAAU,GAAG,GAAG,CAAA;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU,GAAG,IAAI,CAAA;gBACjB,YAAY,GAAG,IAAI,CAAA;gBACnB,OAAO,GAAG,KAAK,CAAA;YACjB,CAAC;YAED,IAAI,OAAO,IAAI,OAAO,IAAK,QAAQ,CAAC,cAAc,CAAY,EAAE,CAAC;gBAC/D,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA,UAAU,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC;8BACf,OAAO,mBAAmB,UAAU;oCAC9B,YAAY;2BACrB,UAAU,EAAE,CAC9B,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;gBAC/E,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAA;gBAChD,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA,UAAU,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC;8BACf,OAAO,mBAAmB,UAAU;oCAC9B,YAAY,qBAAqB,SAAS,CAAC,WAAW,EAAE;2BACjE,UAAU,EAAE,CAC9B,CAAA;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;QAChC,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,EAAE;YACrB,MAAM,IAAI,GAAc,MAAM,EAAE,CAAC,OAAO,CACtC,GAAG,CAAA,kBAAkB,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC;;;sBAG7B,CACf,CAAA;YAED,IAAI,SAAS,GAAG,CAAC,CAAA;YACjB,KAAK,MAAM,GAAG,IAAI,IAAwB,EAAE,CAAC;gBAC3C,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;gBAC9B,SAAS,EAAE,CAAA;YACb,CAAC;YACD,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ;YACjC,MAAM,IAAI,GAAc,MAAM,EAAE,CAAC,OAAO,CACtC,GAAG,CAAA,eAAe,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC;sBAC1B,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM;sBACtD,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM;yBACjD,CAClB,CAAA;YACD,OAAO,CAAE,IAAyB,CAAC,CAAC,CAAC,CAAE,CAAC,EAAE,CAAA;QAC5C,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,QAAQ;YAC9B,MAAM,IAAI,GAAc,MAAM,EAAE,CAAC,OAAO,CACtC,GAAG,CAAA;mBACQ,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC;gCACT,QAAQ;oCACJ,CAC7B,CAAA;YACD,OAAQ,IAAkC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACrD,EAAE,EAAE,GAAG,CAAC,IAAI,CAAW;gBACvB,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAW;gBACpC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAW;gBACzB,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAW;gBAC/B,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAa;gBACjC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAY;aACjC,CAAC,CAAC,CAAA;QACL,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU;YAC3C,MAAM,IAAI,GAAc,MAAM,EAAE,CAAC,OAAO,CACtC,GAAG,CAAA,eAAe,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC;yBACvB,UAAU,oBAAoB,QAAQ;yBACtC,CAClB,CAAA;YACD,OAAQ,IAAkB,CAAC,MAAM,GAAG,CAAC,CAAA;QACvC,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/infra/webhook/sign.d.ts

@@ -0,0 +1,12 @@
+export interface WebhookSignatureOptions {
+    algorithm?: string;
+    encoding?: 'hex' | 'base64';
+}
+export interface SignedPayload {
+    body: string;
+    signature: string;
+    timestamp: number;
+    messageId: string;
+}
+export declare function signPayload(payload: unknown, secret: string, options?: WebhookSignatureOptions): SignedPayload;
+//# sourceMappingURL=sign.d.ts.map

package/dist/infra/webhook/sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../../src/infra/webhook/sign.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAA;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,wBAAgB,WAAW,CACzB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,uBAA4B,GACpC,aAAa,CAWf"}

package/dist/infra/webhook/sign.js

@@ -0,0 +1,12 @@
+import { createHmac, randomUUID } from 'node:crypto';
+export function signPayload(payload, secret, options = {}) {
+    const algorithm = options.algorithm ?? 'sha256';
+    const encoding = options.encoding ?? 'hex';
+    const messageId = randomUUID();
+    const timestamp = Math.floor(Date.now() / 1000);
+    const body = typeof payload === 'string' ? payload : JSON.stringify(payload);
+    const toSign = `${messageId}.${timestamp}.${body}`;
+    const signature = createHmac(algorithm, secret).update(toSign).digest(encoding);
+    return { body, signature, timestamp, messageId };
+}
+//# sourceMappingURL=sign.js.map

package/dist/infra/webhook/sign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../../src/infra/webhook/sign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAcpD,MAAM,UAAU,WAAW,CACzB,OAAgB,EAChB,MAAc,EACd,UAAmC,EAAE;IAErC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAA;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAA;IAE1C,MAAM,SAAS,GAAG,UAAU,EAAE,CAAA;IAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IAC5E,MAAM,MAAM,GAAG,GAAG,SAAS,IAAI,SAAS,IAAI,IAAI,EAAE,CAAA;IAClD,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAE/E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAA;AAClD,CAAC"}

package/dist/infra/webhook/verify.d.ts

@@ -0,0 +1,16 @@
+export interface SignatureVerifier {
+    verify(rawBody: Buffer, headers: Readonly<Record<string, string | undefined>>): boolean;
+}
+type LazySecret = string | (() => string);
+export declare function hmacVerifier(options: {
+    secret: LazySecret;
+    algorithm?: string;
+    header: string;
+    prefix?: string;
+    encoding?: 'hex' | 'base64';
+    computePayload?: (rawBody: Buffer, headers: Readonly<Record<string, string | undefined>>) => Buffer;
+}): SignatureVerifier;
+export declare function stripeVerifier(secret: LazySecret): SignatureVerifier;
+export declare function githubVerifier(secret: LazySecret): SignatureVerifier;
+export {};
+//# sourceMappingURL=verify.d.ts.map

package/dist/infra/webhook/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/infra/webhook/verify.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GAAG,OAAO,CAAA;CACxF;AAED,KAAK,UAAU,GAAG,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAA;AAMzC,wBAAgB,YAAY,CAAC,OAAO,EAAE;IACpC,MAAM,EAAE,UAAU,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAA;IAC3B,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,KAAK,MAAM,CAAA;CACpG,GAAG,iBAAiB,CAuBpB;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,iBAAiB,CA2BpE;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,iBAAiB,CAQpE"}