HMAC Webhook Signature Verifier

{
  "schemaVersion": "1.0",
  "capabilityId": "00000000-0000-4000-8000-00000000000f",
  "name": "HMAC Webhook Signature Verifier",
  "slug": "hmac-webhook-signature-verifier",
  "summary": "Verifies raw-body HMAC webhook signatures with constant-time comparison, timestamp tolerance, and rotation-safe key selection.",
  "granularity": "primitive",
  "purposes": [
    "webhook security",
    "signature verification",
    "hmac",
    "replay prevention"
  ],
  "features": [
    "constant-time comparison",
    "key rotation",
    "timestamp tolerance",
    "raw-body guard"
  ],
  "functionalDescription": "Verifies raw-body HMAC webhook signatures with constant-time comparison, timestamp tolerance, and rotation-safe key selection. The versioned contract documents deterministic behavior, failure modes, configuration, and integration boundaries for production teams.",
  "inputs": [
    {
      "name": "request",
      "contentType": "application/octet-stream",
      "description": "Validated application/octet-stream request payload",
      "required": true
    }
  ],
  "outputs": [
    {
      "name": "result",
      "contentType": "application/json",
      "description": "Typed application/json response with trace metadata",
      "required": true
    }
  ],
  "runtimes": [
    {
      "language": "TypeScript",
      "runtime": "node",
      "versions": [
        "20",
        "22"
      ]
    }
  ],
  "frameworks": [
    "Web Crypto",
    "Express",
    "Fastify"
  ],
  "deploymentTargets": [
    "node-service",
    "aws-lambda",
    "vercel"
  ],
  "dependencies": [
    {
      "name": "zod",
      "version": ">=2",
      "optional": false
    }
  ],
  "permissions": [
    {
      "resource": "temporary-storage",
      "access": "read-write",
      "reason": "Bounded request processing"
    }
  ],
  "dataClassifications": [
    "internal"
  ],
  "complianceClaims": [
    "SBOM available",
    "Dependency scan recorded"
  ],
  "testEvidence": {
    "coveragePercent": 99,
    "tests": 267,
    "lastRun": "2026-07-20T14:00:00.000Z",
    "status": "passing"
  },
  "securityEvidence": {
    "criticalFindings": 0,
    "highFindings": 0,
    "score": 99,
    "scannedAt": "2026-07-19T09:30:00.000Z",
    "scanner": "FixtureScan 1.4"
  },
  "benchmarks": [
    {
      "name": "p95 latency",
      "value": 210,
      "unit": "ms",
      "environment": "2 vCPU / 2 GB fixture runner"
    }
  ],
  "buildBenchmark": {
    "basis": "fixture-directional",
    "sampleSize": 0,
    "referenceTask": "Reimplement the declared hmac-webhook-signature-verifier contract in a compatible greenfield repository",
    "tokenEstimate": {
      "low": 19500,
      "high": 48500
    },
    "agentTimeMinutes": {
      "low": 14.5,
      "high": 41
    },
    "humanReviewHours": {
      "low": 0.3,
      "high": 0.9
    },
    "observedAt": null,
    "methodology": "Directional fixture derived from declared granularity and integration effort; no coding-agent replay was run.",
    "confidence": "low",
    "disclosure": "Prototype estimate only. It is not an empirical benchmark and must not be presented as measured savings."
  },
  "integration": {
    "estimatedHours": 0.5,
    "packageManager": "pnpm",
    "configurationNotes": [
      "Pin the immutable artifact digest",
      "Configure scoped service credentials"
    ]
  },
  "composition": {
    "composable": true,
    "interface": "middleware",
    "compatibleWith": [
      "webhook-retry-dead-letter-worker",
      "audit-log-event-pipeline"
    ],
    "requires": [],
    "contractStability": "stable",
    "evidence": "fixture-declared",
    "notes": [
      "Compatibility links are declared fixture metadata and have not been independently integration-tested"
    ]
  },
  "commercialModels": [
    "licensed-artifact",
    "source-license"
  ],
  "licenseOptions": [
    {
      "id": "evaluation",
      "name": "Private evaluation",
      "scope": "evaluation",
      "priceCents": 5,
      "unit": "evaluation",
      "rights": [
        "evaluation"
      ],
      "developerSeats": null,
      "restrictions": [
        "Non-production use only",
        "Results retained for 30 days"
      ]
    },
    {
      "id": "developer",
      "name": "Developer artifact",
      "scope": "individual",
      "priceCents": 900,
      "unit": "one-time",
      "rights": [
        "artifact-access",
        "commercial-use"
      ],
      "developerSeats": 1,
      "restrictions": [
        "No redistribution",
        "One named developer"
      ]
    },
    {
      "id": "commercial-source",
      "name": "Commercial source",
      "scope": "commercial-source",
      "priceCents": 3900,
      "unit": "one-time",
      "rights": [
        "artifact-access",
        "source-access",
        "modification",
        "commercial-use"
      ],
      "developerSeats": 10,
      "restrictions": [
        "No standalone redistribution",
        "One production application"
      ]
    }
  ],
  "artifactDigests": [
    {
      "algorithm": "sha256",
      "digest": "d109504cb30037fa3901131b4b014a84b56e74fa10d5409b69b7189233a39598",
      "artifactType": "source"
    }
  ],
  "provenance": {
    "builder": "FunctionFoundry demo build service",
    "sourceRevision": "fixture-hmac-webhook-signature-verifier-v1",
    "builtAt": "2026-07-18T12:00:00.000Z",
    "signed": true
  },
  "maintenanceStatus": "active",
  "version": "1.15.0",
  "seller": {
    "name": "Boundary Logic",
    "verified": true,
    "reputation": 5
  },
  "verificationBadges": [
    "Security reviewed",
    "High coverage",
    "Composition declared"
  ]
}