@37signals/basecamp 0.2.0

package/dist/webhooks/events.js

@@ -0,0 +1,52 @@
+/**
+ * Parse "todo_created" → { type: "todo", action: "created" }.
+ * For compound types like "question_answer_created" → { type: "question_answer", action: "created" }.
+ * The action is always the last underscore-separated segment.
+ */
+export function parseEventKind(kind) {
+    const lastUnderscore = kind.lastIndexOf("_");
+    if (lastUnderscore === -1) {
+        return { type: kind, action: "" };
+    }
+    return {
+        type: kind.slice(0, lastUnderscore),
+        action: kind.slice(lastUnderscore + 1),
+    };
+}
+/** Known webhook event kind strings (convenience constants, not exhaustive). */
+export const WebhookEventKind = {
+    TodoCreated: "todo_created",
+    TodoCompleted: "todo_completed",
+    TodoUncompleted: "todo_uncompleted",
+    TodoChanged: "todo_changed",
+    TodolistCreated: "todolist_created",
+    TodolistChanged: "todolist_changed",
+    MessageCreated: "message_created",
+    MessageChanged: "message_changed",
+    CommentCreated: "comment_created",
+    CommentChanged: "comment_changed",
+    DocumentCreated: "document_created",
+    DocumentChanged: "document_changed",
+    UploadCreated: "upload_created",
+    UploadChanged: "upload_changed",
+    QuestionAnswerCreated: "question_answer_created",
+    QuestionAnswerChanged: "question_answer_changed",
+    ScheduleEntryCreated: "schedule_entry_created",
+    ScheduleEntryChanged: "schedule_entry_changed",
+    CloudFileCreated: "cloud_file_created",
+    VaultCreated: "vault_created",
+    InboxForwardCreated: "inbox_forward_created",
+    ForwardReplyCreated: "forward_reply_created",
+    ClientReplyCreated: "client_reply_created",
+    ClientApprovalCreated: "client_approval_created",
+    ClientApprovalChanged: "client_approval_changed",
+    TodoCopied: "todo_copied",
+    MessageCopied: "message_copied",
+    TodoArchived: "todo_archived",
+    TodoUnarchived: "todo_unarchived",
+    TodoTrashed: "todo_trashed",
+    MessageArchived: "message_archived",
+    MessageUnarchived: "message_unarchived",
+    MessageTrashed: "message_trashed",
+};
+//# sourceMappingURL=events.js.map

package/dist/webhooks/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../src/webhooks/events.ts"],"names":[],"mappings":"AASA;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,cAAc,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACpC,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC;QACnC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,WAAW,EAAE,cAAc;IAC3B,aAAa,EAAE,gBAAgB;IAC/B,eAAe,EAAE,kBAAkB;IACnC,WAAW,EAAE,cAAc;IAC3B,eAAe,EAAE,kBAAkB;IACnC,eAAe,EAAE,kBAAkB;IACnC,cAAc,EAAE,iBAAiB;IACjC,cAAc,EAAE,iBAAiB;IACjC,cAAc,EAAE,iBAAiB;IACjC,cAAc,EAAE,iBAAiB;IACjC,eAAe,EAAE,kBAAkB;IACnC,eAAe,EAAE,kBAAkB;IACnC,aAAa,EAAE,gBAAgB;IAC/B,aAAa,EAAE,gBAAgB;IAC/B,qBAAqB,EAAE,yBAAyB;IAChD,qBAAqB,EAAE,yBAAyB;IAChD,oBAAoB,EAAE,wBAAwB;IAC9C,oBAAoB,EAAE,wBAAwB;IAC9C,gBAAgB,EAAE,oBAAoB;IACtC,YAAY,EAAE,eAAe;IAC7B,mBAAmB,EAAE,uBAAuB;IAC5C,mBAAmB,EAAE,uBAAuB;IAC5C,kBAAkB,EAAE,sBAAsB;IAC1C,qBAAqB,EAAE,yBAAyB;IAChD,qBAAqB,EAAE,yBAAyB;IAChD,UAAU,EAAE,aAAa;IACzB,aAAa,EAAE,gBAAgB;IAC/B,YAAY,EAAE,eAAe;IAC7B,cAAc,EAAE,iBAAiB;IACjC,WAAW,EAAE,cAAc;IAC3B,eAAe,EAAE,kBAAkB;IACnC,iBAAiB,EAAE,oBAAoB;IACvC,cAAc,EAAE,iBAAiB;CACzB,CAAC"}

package/dist/webhooks/handler.d.ts

@@ -0,0 +1,62 @@
+import type { WebhookEvent } from "./events.js";
+/** Handler function for webhook events. */
+export type WebhookEventHandler = (event: WebhookEvent) => void | Promise<void>;
+/** Middleware function that wraps event processing. Call next() to continue the chain. */
+export type WebhookMiddleware = (event: WebhookEvent, next: () => Promise<void>) => Promise<void>;
+/** Header accessor: either a record of headers or a function that retrieves a header by name. */
+export type HeaderAccessor = Record<string, string | string[] | undefined> | ((name: string) => string | undefined);
+export interface WebhookReceiverOptions {
+    /** HMAC secret for signature verification. If unset, verification is skipped. */
+    secret?: string;
+    /** HTTP header containing the signature (default: "x-basecamp-signature"). */
+    signatureHeader?: string;
+    /** Number of recent event IDs to track for deduplication (default: 1000, 0 to disable). */
+    dedupWindowSize?: number;
+}
+/** Error thrown when webhook signature verification fails. */
+export declare class WebhookVerificationError extends Error {
+    constructor(message?: string);
+}
+/**
+ * Receives and routes webhook events from Basecamp.
+ *
+ * Framework-agnostic: works with raw body bytes and a header accessor.
+ * Use adapters (e.g., createNodeHandler) for framework-specific integration.
+ */
+export declare class WebhookReceiver {
+    private readonly secret?;
+    private readonly signatureHeader;
+    private readonly dedupWindowSize;
+    private readonly handlers;
+    private readonly anyHandlers;
+    private readonly middlewareChain;
+    private readonly dedupSeen;
+    private readonly dedupOrder;
+    private readonly dedupPending;
+    constructor(options?: WebhookReceiverOptions);
+    /**
+     * Register a handler for a specific event kind pattern.
+     * Supports exact match ("todo_created") and glob patterns ("todo_*", "*_created").
+     */
+    on(pattern: string, handler: WebhookEventHandler): this;
+    /** Register a handler that fires for all events. */
+    onAny(handler: WebhookEventHandler): this;
+    /** Add middleware to the processing chain. Middleware runs in registration order before handlers. */
+    use(middleware: WebhookMiddleware): this;
+    /**
+     * Process a raw webhook request.
+     * Returns the parsed WebhookEvent.
+     * Duplicate events (by ID) return the event but do not trigger handlers.
+     * @throws {WebhookVerificationError} if signature verification fails
+     */
+    handleRequest(rawBody: string | Buffer, headers: HeaderAccessor): Promise<WebhookEvent>;
+    private getHeader;
+    /** Returns true if the event was claimed (caller should process it). Returns false if already seen or in-flight. */
+    private claim;
+    /** Promote from pending to seen after successful handling. */
+    private commitSeen;
+    /** Release claim on handler error so retries can re-attempt. */
+    private releaseClaim;
+    private dispatchHandlers;
+}
+//# sourceMappingURL=handler.d.ts.map

package/dist/webhooks/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/webhooks/handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGhD,2CAA2C;AAC3C,MAAM,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAEhF,0FAA0F;AAC1F,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAElG,iGAAiG;AACjG,MAAM,MAAM,cAAc,GACtB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAC7C,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC,CAAC;AAE3C,MAAM,WAAW,sBAAsB;IACrC,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2FAA2F;IAC3F,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,8DAA8D;AAC9D,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,SAA8B;CAIlD;AAED;;;;;GAKG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4C;IACrE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA2B;IAC3D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgB;IAC3C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;gBAEtC,OAAO,CAAC,EAAE,sBAAsB;IAM5C;;;OAGG;IACH,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI;IAUvD,oDAAoD;IACpD,KAAK,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI;IAKzC,qGAAqG;IACrG,GAAG,CAAC,UAAU,EAAE,iBAAiB,GAAG,IAAI;IAKxC;;;;;OAKG;IACG,aAAa,CACjB,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,YAAY,CAAC;IA6CxB,OAAO,CAAC,SAAS;IASjB,oHAAoH;IACpH,OAAO,CAAC,KAAK;IAOb,8DAA8D;IAC9D,OAAO,CAAC,UAAU;IAclB,gEAAgE;IAChE,OAAO,CAAC,YAAY;YAIN,gBAAgB;CAe/B"}

package/dist/webhooks/handler.js

@@ -0,0 +1,226 @@
+import { verifyWebhookSignature } from "./verify.js";
+/** Error thrown when webhook signature verification fails. */
+export class WebhookVerificationError extends Error {
+    constructor(message = "invalid webhook signature") {
+        super(message);
+        this.name = "WebhookVerificationError";
+    }
+}
+/**
+ * Receives and routes webhook events from Basecamp.
+ *
+ * Framework-agnostic: works with raw body bytes and a header accessor.
+ * Use adapters (e.g., createNodeHandler) for framework-specific integration.
+ */
+export class WebhookReceiver {
+    secret;
+    signatureHeader;
+    dedupWindowSize;
+    handlers = new Map();
+    anyHandlers = [];
+    middlewareChain = [];
+    dedupSeen = new Set();
+    dedupOrder = [];
+    dedupPending = new Set();
+    constructor(options) {
+        this.secret = options?.secret;
+        this.signatureHeader = options?.signatureHeader ?? "x-basecamp-signature";
+        this.dedupWindowSize = options?.dedupWindowSize ?? 1000;
+    }
+    /**
+     * Register a handler for a specific event kind pattern.
+     * Supports exact match ("todo_created") and glob patterns ("todo_*", "*_created").
+     */
+    on(pattern, handler) {
+        const existing = this.handlers.get(pattern);
+        if (existing) {
+            existing.push(handler);
+        }
+        else {
+            this.handlers.set(pattern, [handler]);
+        }
+        return this;
+    }
+    /** Register a handler that fires for all events. */
+    onAny(handler) {
+        this.anyHandlers.push(handler);
+        return this;
+    }
+    /** Add middleware to the processing chain. Middleware runs in registration order before handlers. */
+    use(middleware) {
+        this.middlewareChain.push(middleware);
+        return this;
+    }
+    /**
+     * Process a raw webhook request.
+     * Returns the parsed WebhookEvent.
+     * Duplicate events (by ID) return the event but do not trigger handlers.
+     * @throws {WebhookVerificationError} if signature verification fails
+     */
+    async handleRequest(rawBody, headers) {
+        // Verify signature if secret is configured
+        if (this.secret) {
+            const sig = this.getHeader(headers, this.signatureHeader);
+            if (!sig || !verifyWebhookSignature(rawBody, sig, this.secret)) {
+                throw new WebhookVerificationError();
+            }
+        }
+        // Parse event — extract ID as string from raw JSON to avoid int64 precision loss
+        const bodyStr = typeof rawBody === "string" ? rawBody : rawBody.toString("utf8");
+        const eventIdStr = extractIdString(bodyStr);
+        const event = JSON.parse(bodyStr);
+        // Atomic dedup: check seen + pending, claim before handlers, commit on success, release on error
+        if (!this.claim(eventIdStr)) {
+            return event;
+        }
+        try {
+            // Build middleware chain → handlers
+            const runHandlers = async () => {
+                await this.dispatchHandlers(event);
+            };
+            let chain = runHandlers;
+            for (let i = this.middlewareChain.length - 1; i >= 0; i--) {
+                const mw = this.middlewareChain[i];
+                const next = chain;
+                chain = () => mw(event, next);
+            }
+            await chain();
+            // Promote from pending to seen on success
+            this.commitSeen(eventIdStr);
+        }
+        catch (err) {
+            // Release claim so retries can re-attempt
+            this.releaseClaim(eventIdStr);
+            throw err;
+        }
+        return event;
+    }
+    getHeader(headers, name) {
+        if (typeof headers === "function") {
+            return headers(name);
+        }
+        const val = headers[name] ?? headers[name.toLowerCase()];
+        if (Array.isArray(val))
+            return val[0];
+        return val;
+    }
+    /** Returns true if the event was claimed (caller should process it). Returns false if already seen or in-flight. */
+    claim(eventIdStr) {
+        if (this.dedupWindowSize <= 0 || !eventIdStr)
+            return true;
+        if (this.dedupSeen.has(eventIdStr) || this.dedupPending.has(eventIdStr))
+            return false;
+        this.dedupPending.add(eventIdStr);
+        return true;
+    }
+    /** Promote from pending to seen after successful handling. */
+    commitSeen(eventIdStr) {
+        if (this.dedupWindowSize <= 0 || !eventIdStr)
+            return;
+        this.dedupPending.delete(eventIdStr);
+        // Evict oldest if at capacity
+        if (this.dedupOrder.length >= this.dedupWindowSize) {
+            const oldest = this.dedupOrder.shift();
+            this.dedupSeen.delete(oldest);
+        }
+        this.dedupSeen.add(eventIdStr);
+        this.dedupOrder.push(eventIdStr);
+    }
+    /** Release claim on handler error so retries can re-attempt. */
+    releaseClaim(eventIdStr) {
+        if (eventIdStr)
+            this.dedupPending.delete(eventIdStr);
+    }
+    async dispatchHandlers(event) {
+        const matched = [];
+        for (const [pattern, handlers] of this.handlers) {
+            if (matchPattern(pattern, event.kind ?? "")) {
+                matched.push(...handlers);
+            }
+        }
+        matched.push(...this.anyHandlers);
+        for (const handler of matched) {
+            await handler(event);
+        }
+    }
+}
+/** Extract the top-level "id" field as a raw string from JSON, avoiding Number precision loss on int64.
+ *  Only matches "id" at brace depth 1 (top-level object), ignoring nested "id" fields.
+ *  Uses a full string-aware state machine so braces inside JSON strings don't corrupt depth tracking. */
+function extractIdString(json) {
+    let depth = 0;
+    let inString = false;
+    for (let i = 0; i < json.length; i++) {
+        const ch = json[i];
+        // String state machine — must be checked before anything else so braces
+        // inside strings never affect depth tracking.
+        if (inString) {
+            if (ch === "\\") {
+                i++;
+                continue;
+            } // skip escaped char
+            if (ch === '"') {
+                inString = false;
+            }
+            continue;
+        }
+        // Outside any string
+        if (ch === '"') {
+            // At depth 1, check if this starts the key "id"
+            if (depth === 1 && json[i + 1] === "i" && json[i + 2] === "d" && json[i + 3] === '"') {
+                // Skip past "id" and any whitespace/colon
+                let j = i + 4;
+                while (j < json.length && (json[j] === " " || json[j] === "\t" || json[j] === "\n" || json[j] === "\r" || json[j] === ":"))
+                    j++;
+                // Extract digits
+                const start = j;
+                while (j < json.length && json[j] >= "0" && json[j] <= "9")
+                    j++;
+                if (j > start)
+                    return json.slice(start, j);
+            }
+            inString = true;
+            continue;
+        }
+        if (ch === "{") {
+            depth++;
+            continue;
+        }
+        if (ch === "}") {
+            depth--;
+            continue;
+        }
+    }
+    return undefined;
+}
+/**
+ * Match a webhook event kind against a glob pattern.
+ * "*" matches any sequence of characters.
+ */
+function matchPattern(pattern, value) {
+    if (pattern === value)
+        return true;
+    const parts = pattern.split("*");
+    if (parts.length === 1)
+        return false; // No wildcards, exact match already checked
+    let remaining = value;
+    for (let i = 0; i < parts.length; i++) {
+        const part = parts[i];
+        if (part === "")
+            continue;
+        const idx = remaining.indexOf(part);
+        if (idx === -1)
+            return false;
+        // First part must be a prefix
+        if (i === 0 && idx !== 0)
+            return false;
+        remaining = remaining.slice(idx + part.length);
+    }
+    // Last part must be a suffix (if non-empty)
+    const lastPart = parts.at(-1);
+    if (lastPart !== "") {
+        return value.endsWith(lastPart);
+    }
+    return true;
+}
+//# sourceMappingURL=handler.js.map

package/dist/webhooks/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../src/webhooks/handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAsBrD,8DAA8D;AAC9D,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,GAAG,2BAA2B;QAC/C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IACT,MAAM,CAAU;IAChB,eAAe,CAAS;IACxB,eAAe,CAAS;IACxB,QAAQ,GAAG,IAAI,GAAG,EAAiC,CAAC;IACpD,WAAW,GAA0B,EAAE,CAAC;IACxC,eAAe,GAAwB,EAAE,CAAC;IAC1C,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,UAAU,GAAa,EAAE,CAAC;IAC1B,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IAElD,YAAY,OAAgC;QAC1C,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;QAC9B,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,eAAe,IAAI,sBAAsB,CAAC;QAC1E,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,eAAe,IAAI,IAAI,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACH,EAAE,CAAC,OAAe,EAAE,OAA4B;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,OAA4B;QAChC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qGAAqG;IACrG,GAAG,CAAC,UAA6B;QAC/B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CACjB,OAAwB,EACxB,OAAuB;QAEvB,2CAA2C;QAC3C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YAC1D,IAAI,CAAC,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,wBAAwB,EAAE,CAAC;YACvC,CAAC;QACH,CAAC;QAED,iFAAiF;QACjF,MAAM,OAAO,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjF,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAiB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEhD,iGAAiG;QACjG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,oCAAoC;YACpC,MAAM,WAAW,GAAG,KAAK,IAAI,EAAE;gBAC7B,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC,CAAC;YAEF,IAAI,KAAK,GAAG,WAAW,CAAC;YACxB,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1D,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAE,CAAC;gBACpC,MAAM,IAAI,GAAG,KAAK,CAAC;gBACnB,KAAK,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAChC,CAAC;YAED,MAAM,KAAK,EAAE,CAAC;YAEd,0CAA0C;YAC1C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0CAA0C;YAC1C,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;YAC9B,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,SAAS,CAAC,OAAuB,EAAE,IAAY;QACrD,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QACtC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,oHAAoH;IAC5G,KAAK,CAAC,UAA8B;QAC1C,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAC1D,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QACtF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8DAA8D;IACtD,UAAU,CAAC,UAA8B;QAC/C,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO;QACrD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAErC,8BAA8B;QAC9B,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,EAAG,CAAC;YACxC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnC,CAAC;IAED,gEAAgE;IACxD,YAAY,CAAC,UAA8B;QACjD,IAAI,UAAU;YAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACvD,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,KAAmB;QAChD,MAAM,OAAO,GAA0B,EAAE,CAAC;QAE1C,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChD,IAAI,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC5C,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QAElC,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;YAC9B,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;CACF;AAED;;yGAEyG;AACzG,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAEnB,wEAAwE;QACxE,8CAA8C;QAC9C,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAAC,CAAC,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC,CAAC,oBAAoB;YACxD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBAAC,QAAQ,GAAG,KAAK,CAAC;YAAC,CAAC;YACrC,SAAS;QACX,CAAC;QAED,qBAAqB;QACrB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,gDAAgD;YAChD,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACrF,0CAA0C;gBAC1C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;oBAAE,CAAC,EAAE,CAAC;gBAChI,iBAAiB;gBACjB,MAAM,KAAK,GAAG,CAAC,CAAC;gBAChB,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAE,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,CAAE,IAAI,GAAG;oBAAE,CAAC,EAAE,CAAC;gBAClE,IAAI,CAAC,GAAG,KAAK;oBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC7C,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC;YAChB,SAAS;QACX,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAAC,KAAK,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACtC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAAC,KAAK,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,OAAe,EAAE,KAAa;IAClD,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,4CAA4C;IAElF,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAE1B,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7B,8BAA8B;QAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,4CAA4C;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC;IAC/B,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/webhooks/index.d.ts

@@ -0,0 +1,5 @@
+export { parseEventKind, WebhookEventKind, type WebhookEvent, type WebhookDelivery, type WebhookDeliveryRequest, type WebhookDeliveryResponse, type WebhookCopy, } from "./events.js";
+export { verifyWebhookSignature, signWebhookPayload, } from "./verify.js";
+export { WebhookReceiver, WebhookVerificationError, type WebhookEventHandler, type WebhookMiddleware, type WebhookReceiverOptions, type HeaderAccessor, } from "./handler.js";
+export { createNodeHandler, type NodeHandlerOptions } from "./adapters/node-http.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/webhooks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/webhooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,GACpB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/webhooks/index.js

@@ -0,0 +1,5 @@
+export { parseEventKind, WebhookEventKind, } from "./events.js";
+export { verifyWebhookSignature, signWebhookPayload, } from "./verify.js";
+export { WebhookReceiver, WebhookVerificationError, } from "./handler.js";
+export { createNodeHandler } from "./adapters/node-http.js";
+//# sourceMappingURL=index.js.map

package/dist/webhooks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/webhooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,gBAAgB,GAMjB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,eAAe,EACf,wBAAwB,GAKzB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAA2B,MAAM,yBAAyB,CAAC"}

package/dist/webhooks/verify.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Verify an HMAC-SHA256 webhook signature.
+ * Returns false if secret or signature is empty.
+ */
+export declare function verifyWebhookSignature(payload: string | Buffer, signature: string, secret: string): boolean;
+/**
+ * Compute the HMAC-SHA256 signature for a webhook payload.
+ * Useful for testing webhook handlers.
+ */
+export declare function signWebhookPayload(payload: string | Buffer, secret: string): string;
+//# sourceMappingURL=verify.d.ts.map

package/dist/webhooks/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/webhooks/verify.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAUT;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,MAAM,EAAE,MAAM,GACb,MAAM,CAER"}

package/dist/webhooks/verify.js

@@ -0,0 +1,25 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+/**
+ * Verify an HMAC-SHA256 webhook signature.
+ * Returns false if secret or signature is empty.
+ */
+export function verifyWebhookSignature(payload, signature, secret) {
+    if (!secret || !signature)
+        return false;
+    const expected = signWebhookPayload(payload, secret);
+    try {
+        return timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
+    }
+    catch {
+        // Lengths differ
+        return false;
+    }
+}
+/**
+ * Compute the HMAC-SHA256 signature for a webhook payload.
+ * Useful for testing webhook handlers.
+ */
+export function signWebhookPayload(payload, secret) {
+    return createHmac("sha256", secret).update(payload).digest("hex");
+}
+//# sourceMappingURL=verify.js.map

package/dist/webhooks/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/webhooks/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAwB,EACxB,SAAiB,EACjB,MAAc;IAEd,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAExC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;QACjB,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAwB,EACxB,MAAc;IAEd,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC"}

package/package.json

@@ -0,0 +1,70 @@
+{
+  "name": "@37signals/basecamp",
+  "version": "0.2.0",
+  "description": "TypeScript SDK for the Basecamp 3 API",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    },
+    "./oauth": {
+      "import": "./dist/oauth/index.js",
+      "types": "./dist/oauth/index.d.ts"
+    }
+  },
+  "files": [
+    "dist",
+    "src/generated"
+  ],
+  "scripts": {
+    "generate": "tsx scripts/strip-account-id.ts ../spec/build/smithy/openapi/openapi/Basecamp.openapi.json src/generated/openapi-stripped.json && openapi-typescript src/generated/openapi-stripped.json -o src/generated/schema.d.ts && tsx scripts/extract-metadata.ts src/generated/openapi-stripped.json > src/generated/metadata.json && tsx scripts/generate-path-mapping.ts",
+    "build": "tsc && npm run postbuild",
+    "postbuild": "node -e \"fs=require('fs');fs.cpSync('src/generated','dist/generated',{recursive:true});\"",
+    "prepublishOnly": "npm run build",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "typecheck": "tsc --noEmit",
+    "lint": "oxlint src --ignore-pattern 'src/generated/**'"
+  },
+  "keywords": [
+    "basecamp",
+    "api",
+    "sdk",
+    "typescript"
+  ],
+  "author": "Basecamp",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/basecamp/basecamp-sdk.git",
+    "directory": "typescript"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "openapi-fetch": "^0.17.0"
+  },
+  "devDependencies": {
+    "@types/node": "^25.3.0",
+    "msw": "^2.12.10",
+    "openapi-typescript": "^7.13.0",
+    "oxlint": "^1.50.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.7.0",
+    "vitest": "^4.0.18"
+  },
+  "peerDependencies": {
+    "typescript": ">=5.0.0"
+  },
+  "overrides": {
+    "minimatch": ">=10.2.1"
+  }
+}