@37signals/fizzy 0.1.0

package/dist/webhooks/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/webhooks/handler.ts"],"names":[],"mappings":"AAEA,kDAAkD;AAClD,MAAM,WAAW,YAAY;IAC3B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,2CAA2C;AAC3C,MAAM,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAEhF,0FAA0F;AAC1F,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAElG,iGAAiG;AACjG,MAAM,MAAM,cAAc,GACtB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAC7C,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC,CAAC;AAE3C,MAAM,WAAW,sBAAsB;IACrC,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2FAA2F;IAC3F,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,8DAA8D;AAC9D,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,SAA8B;CAIlD;AAED;;;;GAIG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4C;IACrE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA2B;IAC3D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgB;IAC3C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;gBAEtC,OAAO,CAAC,EAAE,sBAAsB;IAM5C;;;OAGG;IACH,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI;IAUvD,oDAAoD;IACpD,KAAK,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI;IAKzC,8CAA8C;IAC9C,GAAG,CAAC,UAAU,EAAE,iBAAiB,GAAG,IAAI;IAKxC;;;;OAIG;IACG,aAAa,CACjB,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,YAAY,CAAC;IAsCxB,OAAO,CAAC,SAAS;IASjB,OAAO,CAAC,KAAK;IAOb,OAAO,CAAC,UAAU;IAalB,OAAO,CAAC,YAAY;YAIN,gBAAgB;CAe/B"}

package/dist/webhooks/handler.js

@@ -0,0 +1,204 @@
+import { verifyWebhookSignature } from "./verify.js";
+/** Error thrown when webhook signature verification fails. */
+export class WebhookVerificationError extends Error {
+    constructor(message = "invalid webhook signature") {
+        super(message);
+        this.name = "WebhookVerificationError";
+    }
+}
+/**
+ * Receives and routes webhook events from Fizzy.
+ *
+ * Framework-agnostic: works with raw body bytes and a header accessor.
+ */
+export class WebhookReceiver {
+    secret;
+    signatureHeader;
+    dedupWindowSize;
+    handlers = new Map();
+    anyHandlers = [];
+    middlewareChain = [];
+    dedupSeen = new Set();
+    dedupOrder = [];
+    dedupPending = new Set();
+    constructor(options) {
+        this.secret = options?.secret;
+        this.signatureHeader = options?.signatureHeader ?? "x-fizzy-signature";
+        this.dedupWindowSize = options?.dedupWindowSize ?? 1000;
+    }
+    /**
+     * Register a handler for a specific event kind pattern.
+     * Supports exact match ("card_created") and glob patterns ("card_*", "*_created").
+     */
+    on(pattern, handler) {
+        const existing = this.handlers.get(pattern);
+        if (existing) {
+            existing.push(handler);
+        }
+        else {
+            this.handlers.set(pattern, [handler]);
+        }
+        return this;
+    }
+    /** Register a handler that fires for all events. */
+    onAny(handler) {
+        this.anyHandlers.push(handler);
+        return this;
+    }
+    /** Add middleware to the processing chain. */
+    use(middleware) {
+        this.middlewareChain.push(middleware);
+        return this;
+    }
+    /**
+     * Process a raw webhook request.
+     * Returns the parsed WebhookEvent.
+     * @throws {WebhookVerificationError} if signature verification fails
+     */
+    async handleRequest(rawBody, headers) {
+        if (this.secret) {
+            const sig = this.getHeader(headers, this.signatureHeader);
+            if (!sig || !verifyWebhookSignature(rawBody, sig, this.secret)) {
+                throw new WebhookVerificationError();
+            }
+        }
+        const bodyStr = typeof rawBody === "string" ? rawBody : rawBody.toString("utf8");
+        const eventIdStr = extractIdString(bodyStr);
+        const event = JSON.parse(bodyStr);
+        if (!this.claim(eventIdStr)) {
+            return event;
+        }
+        try {
+            const runHandlers = async () => {
+                await this.dispatchHandlers(event);
+            };
+            let chain = runHandlers;
+            for (let i = this.middlewareChain.length - 1; i >= 0; i--) {
+                const mw = this.middlewareChain[i];
+                const next = chain;
+                chain = () => mw(event, next);
+            }
+            await chain();
+            this.commitSeen(eventIdStr);
+        }
+        catch (err) {
+            this.releaseClaim(eventIdStr);
+            throw err;
+        }
+        return event;
+    }
+    getHeader(headers, name) {
+        if (typeof headers === "function") {
+            return headers(name);
+        }
+        const val = headers[name] ?? headers[name.toLowerCase()];
+        if (Array.isArray(val))
+            return val[0];
+        return val;
+    }
+    claim(eventIdStr) {
+        if (this.dedupWindowSize <= 0 || !eventIdStr)
+            return true;
+        if (this.dedupSeen.has(eventIdStr) || this.dedupPending.has(eventIdStr))
+            return false;
+        this.dedupPending.add(eventIdStr);
+        return true;
+    }
+    commitSeen(eventIdStr) {
+        if (this.dedupWindowSize <= 0 || !eventIdStr)
+            return;
+        this.dedupPending.delete(eventIdStr);
+        if (this.dedupOrder.length >= this.dedupWindowSize) {
+            const oldest = this.dedupOrder.shift();
+            this.dedupSeen.delete(oldest);
+        }
+        this.dedupSeen.add(eventIdStr);
+        this.dedupOrder.push(eventIdStr);
+    }
+    releaseClaim(eventIdStr) {
+        if (eventIdStr)
+            this.dedupPending.delete(eventIdStr);
+    }
+    async dispatchHandlers(event) {
+        const matched = [];
+        for (const [pattern, handlers] of this.handlers) {
+            if (matchPattern(pattern, event.kind ?? "")) {
+                matched.push(...handlers);
+            }
+        }
+        matched.push(...this.anyHandlers);
+        for (const handler of matched) {
+            await handler(event);
+        }
+    }
+}
+/** Extract "id" as raw string from JSON to avoid int64 precision loss. */
+function extractIdString(json) {
+    let depth = 0;
+    let inString = false;
+    for (let i = 0; i < json.length; i++) {
+        const ch = json[i];
+        if (inString) {
+            if (ch === "\\") {
+                i++;
+                continue;
+            }
+            if (ch === '"') {
+                inString = false;
+            }
+            continue;
+        }
+        if (ch === '"') {
+            if (depth === 1 && json[i + 1] === "i" && json[i + 2] === "d" && json[i + 3] === '"') {
+                let j = i + 4;
+                while (j < json.length && (json[j] === " " || json[j] === "\t" || json[j] === "\n" || json[j] === "\r" || json[j] === ":"))
+                    j++;
+                const start = j;
+                while (j < json.length && json[j] >= "0" && json[j] <= "9")
+                    j++;
+                if (j > start)
+                    return json.slice(start, j);
+            }
+            inString = true;
+            continue;
+        }
+        if (ch === "{") {
+            depth++;
+            continue;
+        }
+        if (ch === "}") {
+            depth--;
+            continue;
+        }
+    }
+    return undefined;
+}
+/**
+ * Match a webhook event kind against a glob pattern.
+ * "*" matches any sequence of characters.
+ */
+function matchPattern(pattern, value) {
+    if (pattern === value)
+        return true;
+    const parts = pattern.split("*");
+    if (parts.length === 1)
+        return false;
+    let remaining = value;
+    for (let i = 0; i < parts.length; i++) {
+        const part = parts[i];
+        if (part === "")
+            continue;
+        const idx = remaining.indexOf(part);
+        if (idx === -1)
+            return false;
+        if (i === 0 && idx !== 0)
+            return false;
+        remaining = remaining.slice(idx + part.length);
+    }
+    const lastPart = parts.at(-1);
+    if (lastPart !== "") {
+        return value.endsWith(lastPart);
+    }
+    return true;
+}
+//# sourceMappingURL=handler.js.map

package/dist/webhooks/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../src/webhooks/handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AA6BrD,8DAA8D;AAC9D,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,GAAG,2BAA2B;QAC/C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,eAAe;IACT,MAAM,CAAU;IAChB,eAAe,CAAS;IACxB,eAAe,CAAS;IACxB,QAAQ,GAAG,IAAI,GAAG,EAAiC,CAAC;IACpD,WAAW,GAA0B,EAAE,CAAC;IACxC,eAAe,GAAwB,EAAE,CAAC;IAC1C,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,UAAU,GAAa,EAAE,CAAC;IAC1B,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IAElD,YAAY,OAAgC;QAC1C,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;QAC9B,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,eAAe,IAAI,mBAAmB,CAAC;QACvE,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,eAAe,IAAI,IAAI,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACH,EAAE,CAAC,OAAe,EAAE,OAA4B;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,OAA4B;QAChC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8CAA8C;IAC9C,GAAG,CAAC,UAA6B;QAC/B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CACjB,OAAwB,EACxB,OAAuB;QAEvB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YAC1D,IAAI,CAAC,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,wBAAwB,EAAE,CAAC;YACvC,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjF,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAiB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEhD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,KAAK,IAAI,EAAE;gBAC7B,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC,CAAC;YAEF,IAAI,KAAK,GAAG,WAAW,CAAC;YACxB,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1D,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAE,CAAC;gBACpC,MAAM,IAAI,GAAG,KAAK,CAAC;gBACnB,KAAK,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAChC,CAAC;YAED,MAAM,KAAK,EAAE,CAAC;YACd,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;YAC9B,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,SAAS,CAAC,OAAuB,EAAE,IAAY;QACrD,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QACtC,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,UAA8B;QAC1C,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAC1D,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QACtF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,UAAU,CAAC,UAA8B;QAC/C,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO;QACrD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAErC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,EAAG,CAAC;YACxC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnC,CAAC;IAEO,YAAY,CAAC,UAA8B;QACjD,IAAI,UAAU;YAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACvD,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,KAAmB;QAChD,MAAM,OAAO,GAA0B,EAAE,CAAC;QAE1C,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChD,IAAI,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC5C,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QAElC,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;YAC9B,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;CACF;AAED,0EAA0E;AAC1E,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAEnB,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAAC,CAAC,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC;YACnC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBAAC,QAAQ,GAAG,KAAK,CAAC;YAAC,CAAC;YACrC,SAAS;QACX,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACrF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;oBAAE,CAAC,EAAE,CAAC;gBAChI,MAAM,KAAK,GAAG,CAAC,CAAC;gBAChB,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAE,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,CAAE,IAAI,GAAG;oBAAE,CAAC,EAAE,CAAC;gBAClE,IAAI,CAAC,GAAG,KAAK;oBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC7C,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC;YAChB,SAAS;QACX,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAAC,KAAK,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACtC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAAC,KAAK,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,OAAe,EAAE,KAAa;IAClD,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAErC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAE1B,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC;IAC/B,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/webhooks/index.d.ts

@@ -0,0 +1,3 @@
+export { verifyWebhookSignature, signWebhookPayload, } from "./verify.js";
+export { WebhookReceiver, WebhookVerificationError, type WebhookEvent, type WebhookEventHandler, type WebhookMiddleware, type WebhookReceiverOptions, type HeaderAccessor, } from "./handler.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/webhooks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/webhooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,GACpB,MAAM,cAAc,CAAC"}

package/dist/webhooks/index.js

@@ -0,0 +1,3 @@
+export { verifyWebhookSignature, signWebhookPayload, } from "./verify.js";
+export { WebhookReceiver, WebhookVerificationError, } from "./handler.js";
+//# sourceMappingURL=index.js.map

package/dist/webhooks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/webhooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,eAAe,EACf,wBAAwB,GAMzB,MAAM,cAAc,CAAC"}

package/dist/webhooks/verify.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Verify an HMAC-SHA256 webhook signature.
+ * Returns false if secret or signature is empty.
+ */
+export declare function verifyWebhookSignature(payload: string | Buffer, signature: string, secret: string): boolean;
+/**
+ * Compute the HMAC-SHA256 signature for a webhook payload.
+ */
+export declare function signWebhookPayload(payload: string | Buffer, secret: string): string;
+//# sourceMappingURL=verify.d.ts.map

package/dist/webhooks/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/webhooks/verify.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAST;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,MAAM,EAAE,MAAM,GACb,MAAM,CAER"}

package/dist/webhooks/verify.js

@@ -0,0 +1,23 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+/**
+ * Verify an HMAC-SHA256 webhook signature.
+ * Returns false if secret or signature is empty.
+ */
+export function verifyWebhookSignature(payload, signature, secret) {
+    if (!secret || !signature)
+        return false;
+    const expected = signWebhookPayload(payload, secret);
+    try {
+        return timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Compute the HMAC-SHA256 signature for a webhook payload.
+ */
+export function signWebhookPayload(payload, secret) {
+    return createHmac("sha256", secret).update(payload).digest("hex");
+}
+//# sourceMappingURL=verify.js.map

package/dist/webhooks/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/webhooks/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAwB,EACxB,SAAiB,EACjB,MAAc;IAEd,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAExC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAwB,EACxB,MAAc;IAEd,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC"}

package/package.json

@@ -0,0 +1,67 @@
+{
+  "name": "@37signals/fizzy",
+  "version": "0.1.0",
+  "description": "TypeScript SDK for the Fizzy API",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist",
+    "src/generated"
+  ],
+  "scripts": {
+    "generate": "tsx scripts/strip-account-id.ts ../spec/build/smithy/openapi/openapi/Fizzy.openapi.json src/generated/openapi-stripped.json && openapi-typescript src/generated/openapi-stripped.json -o src/generated/schema.d.ts && tsx scripts/extract-metadata.ts src/generated/openapi-stripped.json > src/generated/metadata.json && tsx scripts/generate-path-mapping.ts",
+    "build": "tsc",
+    "postbuild": "node -e \"fs=require('fs');fs.cpSync('src/generated','dist/generated',{recursive:true});\"",
+    "prepublishOnly": "npm run build",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "typecheck": "tsc --noEmit",
+    "lint": "oxlint src --ignore-pattern 'src/generated/**'"
+  },
+  "keywords": [
+    "fizzy",
+    "api",
+    "sdk",
+    "typescript"
+  ],
+  "author": "Basecamp",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/basecamp/fizzy-sdk.git",
+    "directory": "typescript"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "openapi-fetch": "^0.17.0"
+  },
+  "devDependencies": {
+    "@types/node": "^25.3.2",
+    "@vitest/coverage-v8": "^4.0.18",
+    "msw": "^2.12.10",
+    "openapi-typescript": "^7.13.0",
+    "oxlint": "^1.50.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.7.0",
+    "vitest": "^4.0.18"
+  },
+  "peerDependencies": {
+    "typescript": ">=5.0.0"
+  },
+  "overrides": {
+    "minimatch": ">=10.2.1"
+  }
+}