/** * Flags webhook PARSE handlers that have no signature-verification import. * Webhook payloads are provider-controlled untrusted strings; the default * generated shape is "parse the body, return impactedItems" which silently * drops the verifier step. * * Scope (any of): * - filename matches /webhookParse\.ts$/i, /parseWebhooks?\.ts$/i, * /webhooksParse\.ts$/i * - any file that imports `ParseWebhooksHandler` from `@unito/integration-sdk` * or `@unito/integration-api` * * `AcknowledgeWebhooksHandler` exports are out of scope (handshake response, * not payload parser). * * Opt-out: JSDoc `/** @webhook-no-signature: *\/` above the export. * * Detection limitation (v1): only matches `ImportSpecifier` named imports for * SDK verifiers (`import { verifyWebhookSignature } from ...`). Default or * namespace imports are NOT detected; if the SDK exposes the verifier those * ways, use the JSDoc opt-out and document the reason. */ import type { Rule } from 'eslint'; declare const rule: Rule.RuleModule; export default rule;