@kovojs/core

function publicScopedKey(key: string): ScopedKey;

import { component } from '@kovojs/core';

type CounterState = { count: number };

export const Counter = component({
  state: (): CounterState => ({ count: 0 }),
  render: (_queries: Record<string, never>, state: CounterState) =>
    <button>{state.count}</button>,
});

function component<
  const State = undefined,
  const Mutations extends Record<string, { key: string }> = Record<never, never>,
  const Queries extends Readonly<Record<string, unknown>> = Record<never, never>,
  const RenderInput extends object = Record<never, never>,
>(definition: {
  /** Declared clock inputs for time-dependent rendered positions and derives (SPEC §4.8/§4.9). */
  clocks?: Record<string, unknown>;
  /** Co-located component CSS scoped by the compiler to this component's host. */
  css?: string;
  /** Force-off escape hatch for inferred server refresh targets (SPEC §4.1). */
  disableServerRefresh?: boolean;
  /** Removed: query-backed components infer refresh targets; use `disableServerRefresh`. */
  fragmentTarget?: never;
  /** Unexpected render-error fallback for full-page and live-target renders (SPEC §9.2). */
  errorBoundary?: ComponentErrorBoundary;
  /** Force the compiler to keep server and client render output equivalent. */
  isomorphic?: boolean;
  mutations?: Mutations;
  /** Static metadata used by generated live-target renderers to serialize component props. */
  props?: Record<
    string,
    | ArrayConstructor
    | BooleanConstructor
    | NumberConstructor
    | ObjectConstructor
    | StringConstructor
  >;
  queries?: Queries;
  render: (
    queries: RenderInput,
    state: State,
    slots: {
      children?: ComponentChild;
      [slot: string]: unknown;
    } & (keyof Mutations extends never
      ? {
          forms?: {
            [Name in keyof Mutations]: Mutations[Name] extends { key: string }
              ? {
                  failure: FormFailure<Mutations[Name]> | null;
                  submitted?: Partial<
                    Mutations[Name] extends {
                      input: { parse(input: unknown): infer Input };
                    }
                      ? Input extends Record<string, unknown>
                        ? Input
                        : Record<string, unknown>
                      : Mutations[Name] extends Form<string, infer Input, unknown>
                        ? Input
                        : Record<string, unknown>
                  >;
                }
              : never;
          };
        }
      : {
          forms: {
            [Name in keyof Mutations]: Mutations[Name] extends { key: string }
              ? {
                  failure: FormFailure<Mutations[Name]> | null;
                  submitted?: Partial<
                    Mutations[Name] extends {
                      input: { parse(input: unknown): infer Input };
                    }
                      ? Input extends Record<string, unknown>
                        ? Input
                        : Record<string, unknown>
                      : Mutations[Name] extends Form<string, infer Input, unknown>
                        ? Input
                        : Record<string, unknown>
                  >;
                }
              : never;
          };
        }),
  ) => ComponentRenderResult;
  state?: State extends Serializable<State> ? () => State : () => never;
}): Component<
  (0 extends 1 & RenderInput
    ? Record<never, never>
    : unknown extends RenderInput
      ? Record<never, never>
      : Omit<RenderInput, Extract<keyof Queries, string>>) & {
    [attribute: `aria-${string}`]: unknown;
    [attribute: `data-${string}`]: unknown;
    [attribute: `on${string}`]: unknown;
    checked?: unknown;
    class?: string;
    className?: string;
    disabled?: unknown;
    form?: unknown;
    hidden?: unknown;
    id?: unknown;
    'kovo-key'?: number | string;
    key?: number | string;
    name?: unknown;
    required?: unknown;
    role?: unknown;
    style?: unknown;
    styles?: unknown;
    tabIndex?: unknown;
    value?: unknown;
  }
>;

function ErrorBoundary(props: ErrorBoundaryProps): ComponentRenderResult;

import { href } from '@kovojs/core';

const url: string = href('/products/:id', { params: { id: 'p1' } });

function href<const Path extends string>(
  path: Path,
  ...args: PathParamNames<Path> extends never
    ? [
        options?: {
          params?: PathParams<Path>;
          search?: Record<string, RouteSearchValue>;
        },
      ]
    : [
        options: {
          params: PathParams<Path>;
          search?: Record<string, RouteSearchValue>;
        },
      ]
): string;

import { Link } from '@kovojs/core';

const link = <Link to="/products/:id" params={{ id: 'p1' }}>View</Link>;

function Link(_props: LinkProps): ComponentRenderResult;

import { redirect } from '@kovojs/core';

const toProduct = redirect('/products/:id', { params: { id: 'p1' } });
// toProduct.status === 303

function redirect<const Path extends string>(
  path: Path,
  ...args: PathParamNames<Path> extends never
    ? [
        options?: {
          params?: PathParams<Path>;
          search?: Record<string, RouteSearchValue>;
        },
      ]
    : [
        options: {
          params: PathParams<Path>;
          search?: Record<string, RouteSearchValue>;
        },
      ]
): Redirect;

import { form } from '@kovojs/core';
import { addToCart } from './mutations';

export const addToCartForm = form(addToCart);
export const search = form.get('/products');

const form = Object.assign(createMutationForm, {
  get: getRouteForm,
});

function FieldError<Failure = unknown>(props: FieldErrorProps<Failure>): string;

function FormError<
  Failure = unknown,
  const Code extends string | readonly string[] | undefined = undefined,
>(props: FormErrorProps<Failure, Code>): string;

type JsonValue =
  | null
  | boolean
  | number
  | string
  | JsonValue[]
  | { [key: string]: JsonValue };

interface Form<
  Key extends string,
  Input extends Record<string, JsonValue> = Record<string, JsonValue>,
  Failure = JsonValue,
> {
  failure?: Failure;
  input?: Input;
  key: Key;
}

type FormFailure<Definition> = Definition extends {
  input: { parse(input: unknown): unknown };
  errors?: infer Errors;
}
  ?
      | (NonNullable<Errors> extends Record<string, { parse(input: unknown): unknown }>
          ? {
              [Code in Extract<keyof NonNullable<Errors>, string>]: {
                code: Code;
                payload: NonNullable<Errors>[Code] extends {
                  parse(input: unknown): infer Payload;
                }
                  ? Payload
                  : never;
              };
            }[Extract<keyof NonNullable<Errors>, string>]
          : never)
      | FormValidationFailure
  : Definition extends Form<string, infer _Input, infer Failure>
    ? Failure | FormValidationFailure
    : FormValidationFailure;

interface FormValidationFailure {
  code: 'VALIDATION';
  fieldErrors: Record<string, string>;
}

interface ScopedKey {
  readonly [scopedKeyBrand]: 'kovo-scoped-key';
}

type ComponentRenderResult =
  | boolean
  | null
  | number
  | readonly ComponentRenderResult[]
  | undefined
  | object;

type ComponentTextResult = ComponentRenderResult | string;

type ComponentChild = ComponentRenderResult | string;

interface ErrorBoundaryProps {
  children?: ComponentRenderResult;
  fallback: ComponentRenderResult | ((error: unknown) => ComponentRenderResult);
  target?: string;
}

interface ComponentErrorBoundary {
  fallback: ComponentRenderResult | ((error: unknown) => ComponentRenderResult);
  target?: string;
}

interface Component<Props extends object = Record<string, never>> {
  <const Input extends Props>(
    ...args: {
      [Key in keyof Props]-?: {} extends Pick<Props, Key> ? never : Key;
    }[keyof Props] extends never
      ? [props?: Input & Record<Exclude<keyof Input, keyof Props>, never>]
      : [props: Input & Record<Exclude<keyof Input, keyof Props>, never>]
  ): ComponentRenderResult;
  readonly [componentHandleWitness]: typeof componentHandleWitness;
  name?: string;
}

type Serializable<T> = T extends JsonValue
  ? T
  : T extends (...args: never[]) => unknown
    ? never
    : T extends readonly (infer Item)[]
      ? readonly Serializable<Item>[]
      : T extends object
        ? { [Key in keyof T]: Serializable<T[Key]> }
        : never;

interface QueryRefreshSpec<Result> {
  at?: (value: Result) => unknown;
  every?: string;
  renderOnce?: true;
  until?: (value: Result) => unknown;
}

type QueryRefreshBinding<
  Key extends string,
  Result,
  Spec extends QueryRefreshSpec<Result>,
> = Query<Key, Result, never, never, Spec>;

interface Query<
  Key extends string,
  Result,
  Props extends Record<string, JsonValue> = never,
  Args = never,
  Spec extends QueryRefreshSpec<Result> | undefined = undefined,
> {
  args: [Props] extends [never]
    ? <NextProps extends Record<string, JsonValue>, NextArgs extends Record<string, JsonValue>>(
        mapper: (props: NextProps) => NextArgs,
      ) => Query<Key, Result, NextProps, NextArgs, Spec>
    : (props: Props) => Args;
  key: Key;
  /**
   * Declarative per-query opt-out from refetch-on-focus (SPEC §9.3/§9.4). Refetch-on-focus
   * is on by default; an app-owned query declaration may set `refetchOnFocus: false` to exclude
   * this query from the visible-return/bfcache typed-read refetch (§9.4). Only `false` is accepted:
   * `true` would be the default and a no-op field.
   */
  refetchOnFocus?: false;
  refresh<NextSpec extends QueryRefreshSpec<Result>>(
    spec: NextSpec,
  ): Query<Key, Result, Props, Args, NextSpec>;
  refreshSpec?: Spec;
  result?: Result;
}

type PathParamNames<Path extends string> = Path extends `${string}:${infer Rest}`
  ? Rest extends `${infer Param}/${infer Tail}`
    ? Param | PathParamNames<Tail>
    : Rest extends `${infer Param}?${string}`
      ? Param
      : Rest extends `${infer Param}#${string}`
        ? Param
        : Rest
  : never;

type PathParams<Path extends string> =
  PathParamNames<Path> extends never ? {} : Record<PathParamNames<Path>, string>;

type RouteSearchValue = JsonValue | undefined;

interface Route<
  Path extends string,
  Params extends Record<string, string> = PathParams<Path>,
  Search extends Record<string, RouteSearchValue> = Record<string, JsonValue>,
> {
  path: Path;
  params?: Params;
  prefetch?: 'conservative' | 'moderate' | false;
  search?: Search;
}

interface LinkProps {
  children?: ComponentChild;
  params?: Record<string, string>;
  search?: Record<string, RouteSearchValue>;
  to: string;
  [attribute: string]: unknown;
}

interface Redirect {
  location: string;
  status: 303;
}

interface FieldErrorProps<Failure = unknown> {
  children?: unknown;
  class?: string;
  code?: string | readonly string[];
  failure?: Failure | null;
  id?: string;
  message?: ComponentTextResult | ((failure: Failure) => ComponentTextResult);
  name: string;
  role?: string;
  [attribute: string]: unknown;
}

interface FormErrorProps<
  Failure = unknown,
  Code extends string | readonly string[] | undefined = string | readonly string[] | undefined,
> {
  children?: unknown;
  class?: string;
  code?: Code;
  failure?: Failure | null;
  id?: string;
  message?:
    | ComponentTextResult
    | ((
        failure: Code extends readonly (infer Item extends string)[]
          ? Extract<NoInfer<Failure>, { code: Item }>
          : Code extends string
            ? Extract<NoInfer<Failure>, { code: Code }>
            : NoInfer<Failure>,
      ) => ComponentTextResult);
  role?: string;
  [attribute: string]: unknown;
}

type FormInput<Definition> =
  Definition extends Form<string, infer Input, unknown> ? Input : never;

type DiagnosticCode =
  | 'KV201'
  | 'KV210'
  | 'KV211'
  | 'KV212'
  | 'KV220'
  | 'KV221'
  | 'KV222'
  | 'KV223'
  | 'KV224'
  | 'KV225'
  | 'KV226'
  | 'KV227'
  | 'KV228'
  | 'KV229'
  | 'KV230'
  | 'KV231'
  | 'KV232'
  | 'KV233'
  | 'KV234'
  | 'KV235'
  | 'KV236'
  | 'KV237'
  | 'KV238'
  | 'KV239'
  | 'KV240'
  | 'KV241'
  | 'KV242'
  | 'KV243'
  | 'KV244'
  | 'KV245'
  | 'KV246'
  | 'KV247'
  | 'KV301'
  | 'KV302'
  | 'KV303'
  | 'KV304'
  | 'KV310'
  | 'KV311'
  | 'KV312'
  | 'KV313'
  | 'KV314'
  | 'KV315'
  | 'KV316'
  | 'KV317'
  | 'KV318'
  | 'KV320'
  | 'KV330'
  | 'KV402'
  | 'KV403'
  | 'KV404'
  | 'KV405'
  | 'KV406'
  | 'KV407'
  | 'KV408'
  | 'KV409'
  | 'KV410'
  | 'KV411'
  | 'KV412'
  | 'KV413'
  | 'KV414'
  | 'KV415'
  | 'KV416'
  | 'KV417'
  | 'KV418'
  | 'KV419'
  | 'KV420'
  | 'KV421'
  | 'KV422'
  | 'KV423'
  | 'KV424'
  | 'KV425'
  | 'KV426'
  | 'KV428'
  | 'KV429'
  | 'KV430'
  | 'KV431'
  | 'KV432'
  | 'KV433'
  | 'KV434'
  | 'KV435'
  | 'KV436'
  | 'KV437'
  | 'KV438'
  | 'KV439'
  | 'KV445'
  | 'KV446'
  | 'KV447'
  | 'KV448'
  | 'KV449'
  | 'KV450'
  | 'KV451'
  | 'KV452';

type DiagnosticSeverity = 'error' | 'warn' | 'lint' | 'notice';

interface RegisteredDiagnostic<Code extends DiagnosticCode = DiagnosticCode> {
  /** Module-private nominal witness; runtime authority lives in registeredDiagnosticRegistry. */
  readonly [registeredDiagnosticBrand]: true;
  code: Code;
  help?: string;
  message: string;
  severity: (typeof diagnosticDefinitions)[Code]['severity'];
}

function declareOffWire(run: () => void, options: { justification: string }): void;

function isRedacted(value: unknown): value is RedactedValue<unknown>;

function isSecret(value: unknown): value is SecretValue<unknown>;

function isUntrusted(value: unknown): value is UntrustedValue<unknown>;

function publishToClient<T extends string | number | boolean | null>(
  value: T,
  options: { reason: string },
): T;

function redacted<T>(value: T, options: { mask?: string } = {}): RedactedValue<T>;

function revealRedacted<T>(value: Redacted<T>): T;

function revealSecret<T>(value: Secret<T>, policy: DeclassifyPolicy<'revealSecret'>): T;

function revealUntrusted<T>(
  value: Untrusted<T>,
  policy: DeclassifyPolicy<'revealUntrusted'>,
): T;

function secret<T>(value: T): SecretValue<T>;

function trustedReveal<T>(
  value: T,
  policy: DeclassifyPolicy<'trustedReveal'>,
): T extends Secret<infer Value> ? Value : T;

function untrusted<T>(value: T): UntrustedValue<T>;

class DeclassifyPolicy<
  Door extends
    | 'revealSecret'
    | 'revealUntrusted'
    | 'secret.reveal'
    | 'trustedReveal'
    | 'untrusted.reveal' =
    | 'revealSecret'
    | 'revealUntrusted'
    | 'secret.reveal'
    | 'trustedReveal'
    | 'untrusted.reveal',
> {
  readonly #kovoDeclassifyPolicy: Door;

  private constructor(
    token: typeof declassifyPolicyConstructorToken,
    door: Door,
    options: unknown,
    fixedPurpose?: 'public-projection' | 'request-validation',
  ) {
    if (token !== declassifyPolicyConstructorToken) {
      throw new TypeError(
        'DeclassifyPolicy must be created by its exact door-specific constructor.',
      );
    }
    const { ownerScope, purpose } = validateDeclassifyPolicyOptions(door, options, fixedPurpose);
    this.#kovoDeclassifyPolicy = door;
    if (this.#kovoDeclassifyPolicy !== door) {
      throw new TypeError('DeclassifyPolicy nominal initialization failed.');
    }
    securityWeakSetAdd(declassifyPolicies, this);
    securityWeakMapSet(
      declassifyPolicyRecords,
      this,
      freezeSecurityValue({ door, ownerScope, purpose }),
    );
    freezeSecurityValue(this);
  }

  /** Construct a policy accepted only by the standalone {@link revealSecret} door. */
  static forRevealSecret(options: {
    ownerScope: 'application' | 'current-principal' | 'current-tenant' | 'framework';
    purpose: 'credential-use' | 'server-computation';
  }): DeclassifyPolicy<'revealSecret'> {
    return new DeclassifyPolicy(declassifyPolicyConstructorToken, 'revealSecret', options);
  }

  /** Construct a policy accepted only by {@link SecretValue.reveal}. */
  static forSecretValue(options: {
    ownerScope: 'application' | 'current-principal' | 'current-tenant' | 'framework';
    purpose: 'credential-use' | 'server-computation';
  }): DeclassifyPolicy<'secret.reveal'> {
    return new DeclassifyPolicy(declassifyPolicyConstructorToken, 'secret.reveal', options);
  }

  /** Construct a policy accepted only by the audited {@link trustedReveal} projection door. */
  static forTrustedReveal(options: {
    ownerScope: 'application' | 'current-principal' | 'current-tenant' | 'framework';
  }): DeclassifyPolicy<'trustedReveal'> {
    return new DeclassifyPolicy(
      declassifyPolicyConstructorToken,
      'trustedReveal',
      options,
      'public-projection',
    );
  }

  /** Construct a policy accepted only by the standalone {@link revealUntrusted} door. */
  static forRevealUntrusted(options: {
    ownerScope: 'application' | 'current-principal' | 'current-tenant' | 'framework';
  }): DeclassifyPolicy<'revealUntrusted'> {
    return new DeclassifyPolicy(
      declassifyPolicyConstructorToken,
      'revealUntrusted',
      options,
      'request-validation',
    );
  }

  /** Construct a policy accepted only by {@link UntrustedValue.reveal}. */
  static forUntrustedValue(options: {
    ownerScope: 'application' | 'current-principal' | 'current-tenant' | 'framework';
  }): DeclassifyPolicy<'untrusted.reveal'> {
    return new DeclassifyPolicy(
      declassifyPolicyConstructorToken,
      'untrusted.reveal',
      options,
      'request-validation',
    );
  }
}

interface Redacted<T> {
  readonly [redactedBrand]: {
    readonly kind: 'redacted';
    readonly value: T;
  };
  /** Keeps `Redacted<T>` outside JsonValue; not a trust proof (SPEC §6.6). */
  readonly __kovoRedactedJsonBoundary?: undefined;
}

interface RedactedValue<T> extends Redacted<T> {
  /** Returns the real (unmasked) value — the explicit reveal at a DB/render sink. */
  reveal(): T;
  /** The safe-to-display masked representation (what every poisoned coercion yields). */
  readonly mask: string;
  /** Derives a new redacted value, preserving the mask, without un-poisoning. */
  map<U>(fn: (value: T) => U): RedactedValue<U>;
  /** Constant-time equality against another value or redacted/secret box. */
  equals(other: T | Redacted<T> | Secret<T>): boolean;
}

interface Secret<T> {
  readonly [secretBrand]: {
    readonly kind: 'secret';
    readonly value: T;
  };
  /** Keeps `Secret<T>` outside JsonValue; not a trust proof (SPEC §6.6). */
  readonly __kovoSecretJsonBoundary?: undefined;
}

interface SecretValue<T> extends Secret<T> {
  /**
   * Returns the wrapped value through an exact validated declassification policy. The returned
   * value is an ordinary primitive/object with no further runtime tag.
   */
  reveal(policy: DeclassifyPolicy<'secret.reveal'>): T;
  /**
   * Derives a new secret from this one _without_ un-poisoning. `apiKey.map(k =>
   * k.slice(0, 4))` yields a `SecretValue<string>` for the prefix, so the derived
   * value keeps its poison instead of decaying to a bare string.
   */
  map<U>(fn: (value: T) => U): SecretValue<U>;
  /**
   * Constant-time equality against another value or secret. Use this for token /
   * signature checks instead of `reveal() === other`, which both leaks via timing
   * and un-poisons the value. Strings and byte-like operands compare through a
   * fixed-width digest; other operands fall back to `Object.is`.
   */
  equals(other: T | Secret<T>): boolean;
}

interface Untrusted<T> {
  readonly [untrustedBrand]: {
    readonly kind: 'untrusted';
    readonly value: T;
  };
  /** Keeps `Untrusted<T>` outside JsonValue until it is validated or escaped. */
  readonly __kovoUntrustedJsonBoundary?: undefined;
}

interface UntrustedValue<T> extends Untrusted<T> {
  /** Returns the wrapped value through an exact request-validation policy. */
  reveal(policy: DeclassifyPolicy<'untrusted.reveal'>): T;
  /** Derives another untrusted value without losing provenance. */
  map<U>(fn: (value: T) => U): UntrustedValue<U>;
  /** Constant-time equality for string/byte-like values where possible. */
  equals(other: T | Untrusted<T>): boolean;
}

function createFileSystemStorage(options: FileSystemStorageOptions): StorageCapability;

function createMemoryStorage(options: MemoryStorageOptions = {}): StorageCapability;

function createS3CompatibleStorage(options: S3CompatibleStorageOptions): StorageCapability;

interface FileSystemStorageOptions {
  root: string;
}

interface MemoryStorageOptions {
  now?: () => Date;
}

type StorageBody = string | ArrayBuffer | ArrayBufferView | ReadableStream<Uint8Array>;

interface StorageCapability
  extends StorageDeleteCapability, StoragePutCapability, StorageReadCapability {}

interface StorageDeleteCapability {
  delete(key: ScopedKey): Promise<void>;
}

interface StorageGetResult extends StorageObjectInfo {
  body: Uint8Array;
}

interface StorageObjectInfo {
  contentType?: string;
  etag?: string;
  key: string;
  lastModified?: Date;
  metadata?: Readonly<Record<string, string>>;
  size?: number;
}

interface StoragePutCapability {
  put(key: ScopedKey, body: StorageBody, options?: StoragePutOptions): Promise<StoragePutResult>;
}

interface StoragePutOptions {
  contentType?: string;
  etag?: string;
  metadata?: Readonly<Record<string, string>>;
}

interface StoragePutResult extends StorageObjectInfo {}

interface StorageReadCapability {
  get(key: ScopedKey): Promise<StorageGetResult | undefined>;
  stat(key: ScopedKey): Promise<StorageObjectInfo | undefined>;
  stream(key: ScopedKey): Promise<StorageStreamResult | undefined>;
}

interface StorageStreamResult extends StorageObjectInfo {
  body: ReadableStream<Uint8Array>;
}

class S3CompatibleObjectClient {
  private constructor(token: typeof s3CompatibleClientConstructorToken) {
    if (token !== s3CompatibleClientConstructorToken) {
      throw new TypeError(
        'S3CompatibleObjectClient must be created by S3CompatibleObjectClient.create().',
      );
    }
    freezeSecurityValue(this);
  }

  /**
   * Validate and snapshot the five operations Kovo needs from an object SDK.
   *
   * The operation methods use positional bucket/key arguments and Kovo storage
   * results, so provider-specific request and metadata carriers stay local.
   */
  static create(operations: {
    delete(bucket: string, key: string): Promise<void>;
    get(bucket: string, key: string): Promise<StorageGetResult | StorageStreamResult | undefined>;
    list(
      bucket: string,
      prefix: string,
      cursor?: string,
    ): Promise<{ cursor?: string; keys: readonly string[] }>;
    put(
      bucket: string,
      key: string,
      body: StorageBody,
      options?: StoragePutOptions,
    ): Promise<StoragePutResult>;
    stat(bucket: string, key: string): Promise<StorageObjectInfo | undefined>;
  }): S3CompatibleObjectClient {
    const client = new S3CompatibleObjectClient(s3CompatibleClientConstructorToken);
    return registerS3CompatibleClient(client, operations);
  }
}

interface S3CompatibleStorageOptions {
  bucket: string;
  client: S3CompatibleObjectClient;
  prefix?: string;
}

import { customVerifier, type WebhookHeaders } from '@kovojs/core/webhooks';

function tokenFrom(headers: WebhookHeaders): string | undefined {
  if ('get' in headers && typeof headers.get === 'function') {
    const value = headers.get('x-token');
    return typeof value === 'string' ? value : undefined;
  }
  return undefined;
}

export const verifier = customVerifier(
  'static-token',
  (request) => tokenFrom(request.headers) === 'expected',
);

function customVerifier(
  name: string,
  verify: (request: WebhookVerificationRequest) => Promise<boolean> | boolean,
): CustomWebhookVerifier;

import { hmacSignature } from '@kovojs/core/webhooks';

const secret = process.env.PROVIDER_WEBHOOK_SECRET;
if (secret === undefined) throw new Error('Missing provider webhook signing material');

export const verifier = hmacSignature({
  encoding: 'hex',
  header: 'x-signature',
  payload: (request) => request.payload,
  secret,
});

function hmacSignature(options: {
  encoding: 'base64' | 'base64url' | 'hex';
  header: string;
  multiSig?: boolean | ((signatureHeader: string) => readonly string[]);
  name?: string;
  payload:
    | WebhookPayload
    | ((
        request: WebhookVerificationRequest,
        context: {
          header(name: string): string | undefined;
          signatureHeader: string;
        },
      ) => Promise<WebhookPayload> | WebhookPayload);
  scheme?: string;
  secret:
    | string
    | Uint8Array
    | {
        encoding?: 'base64' | 'base64url' | 'utf8';
        value: string | Uint8Array;
      }
    | readonly (
        | string
        | Uint8Array
        | {
            encoding?: 'base64' | 'base64url' | 'utf8';
            value: string | Uint8Array;
          }
      )[];
  tolerance?: {
    header?: string;
    seconds: number;
    timestamp?: (
      request: WebhookVerificationRequest,
      context: {
        header(name: string): string | undefined;
        signatureHeader: string;
      },
    ) => number | string | undefined;
  };
}): HmacSignatureVerifier;

import { standardWebhooks } from '@kovojs/core/webhooks';

const secret = process.env.STANDARD_WEBHOOK_SECRET;
if (secret === undefined) throw new Error('Missing Standard Webhooks signing material');

export const verifier = standardWebhooks({
  secret,
});

function standardWebhooks(options: {
  secret:
    | string
    | Uint8Array
    | {
        encoding?: 'base64' | 'base64url' | 'utf8';
        value: string | Uint8Array;
      }
    | readonly (
        | string
        | Uint8Array
        | {
            encoding?: 'base64' | 'base64url' | 'utf8';
            value: string | Uint8Array;
          }
      )[];
}): HmacSignatureVerifier;

interface CustomWebhookVerifier {
  kind: 'custom';
  name: string;
  scheme: string;
  verify(request: WebhookVerificationRequest): Promise<boolean>;
}

interface HmacSignatureVerifier {
  kind: 'hmac';
  name: string;
  scheme: string;
  verify(request: WebhookVerificationRequest): Promise<boolean>;
}

type WebhookHeaders =
  | Headers
  | Map<string, string>
  | Record<string, WebhookHeaderValue>
  | { get(name: string): WebhookHeaderValue };

type WebhookHeaderValue = null | string | readonly string[] | undefined;

type WebhookPayload = string | ArrayBuffer | ArrayBufferView;

interface WebhookVerificationRequest {
  headers: WebhookHeaders;
  now?: Date | number;
  payload: WebhookPayload;
}

type WebhookVerifier = HmacSignatureVerifier | CustomWebhookVerifier;