@atlasauth/backend 0.28.0 → 0.30.0

package/dist/webhooks-web.d.ts

@@ -0,0 +1,24 @@
+import { type WebhookVerifyOptions, type WebhookVerifyResult } from './webhook-common';
+export interface VerifyAtlasWebhookInput extends WebhookVerifyOptions {
+    /** The RAW request body: the string or bytes exactly as received, never a parsed object. */
+    body: string | Uint8Array | ArrayBuffer;
+}
+/**
+ * The Node `verifyWebhook` on Web Crypto only (no `Buffer`, no `node:crypto`), so
+ * it runs unchanged on Node 18+, Deno, Bun and Workers. Same signed material,
+ * same 5-minute window in both directions, same `v1` / `v2` handling, same
+ * result shape; never throws on a bad delivery.
+ *
+ * ```ts
+ * const { verified, event, deliveryId } = await verifyAtlasWebhook({
+ *   body: await request.text(), headers: request.headers, secret: env.ATLAS_WEBHOOK_SECRET,
+ * });
+ * ```
+ */
+export declare function verifyAtlasWebhook<T = unknown>(input: VerifyAtlasWebhookInput): Promise<WebhookVerifyResult<T>>;
+/**
+ * {@link verifyAtlasWebhook} straight from a Fetch `Request` (Hono, Workers,
+ * Deno, Bun, Next.js route handlers). Reads the body once, as text; do not
+ * read it before calling this.
+ */
+export declare function verifyAtlasWebhookRequest<T = unknown>(request: Request, options: Omit<VerifyAtlasWebhookInput, 'body' | 'headers'>): Promise<WebhookVerifyResult<T>>;

package/dist/webhooks-web.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyAtlasWebhook = verifyAtlasWebhook;
+exports.verifyAtlasWebhookRequest = verifyAtlasWebhookRequest;
+const webhook_common_1 = require("./webhook-common");
+/**
+ * The Node `verifyWebhook` on Web Crypto only (no `Buffer`, no `node:crypto`), so
+ * it runs unchanged on Node 18+, Deno, Bun and Workers. Same signed material,
+ * same 5-minute window in both directions, same `v1` / `v2` handling, same
+ * result shape; never throws on a bad delivery.
+ *
+ * ```ts
+ * const { verified, event, deliveryId } = await verifyAtlasWebhook({
+ *   body: await request.text(), headers: request.headers, secret: env.ATLAS_WEBHOOK_SECRET,
+ * });
+ * ```
+ */
+async function verifyAtlasWebhook(input) {
+    const raw = typeof input.body === 'string' ? input.body : new TextDecoder().decode(input.body);
+    const id = (0, webhook_common_1.readHeader)(input.headers, webhook_common_1.ATLAS_WEBHOOK_HEADERS.id);
+    const timestampRaw = (0, webhook_common_1.readHeader)(input.headers, webhook_common_1.ATLAS_WEBHOOK_HEADERS.timestamp);
+    const signature = (0, webhook_common_1.readHeader)(input.headers, webhook_common_1.ATLAS_WEBHOOK_HEADERS.signature);
+    if (!id || !timestampRaw || !signature)
+        return { verified: false, reason: 'missing_headers' };
+    if (typeof input.secret !== 'string' || input.secret === '')
+        return { verified: false, reason: 'signature_mismatch' };
+    const provided = input.requireV2 ? [] : (0, webhook_common_1.parseSignatures)(signature);
+    const providedV2 = input.url ? (0, webhook_common_1.parseSignatures)(signature, 'v2') : [];
+    if (provided.length === 0 && providedV2.length === 0)
+        return { verified: false, reason: 'malformed_signature' };
+    const timestamp = Number(timestampRaw);
+    const now = (input.now ?? new Date()).getTime();
+    if (!Number.isFinite(timestamp) || Math.abs(now - timestamp) > (input.toleranceMs ?? webhook_common_1.REPLAY_TOLERANCE_MS)) {
+        return { verified: false, reason: 'stale_timestamp' };
+    }
+    const key = await crypto.subtle.importKey('raw', new TextEncoder().encode(input.secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const mac = async (material) => toBase64(new Uint8Array(await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(material))));
+    let matched = false;
+    if (provided.length > 0) {
+        const expected = await mac(`${id}.${timestamp}.${raw}`);
+        for (const candidate of provided)
+            if (constantTimeEqual(candidate, expected))
+                matched = true;
+    }
+    if (providedV2.length > 0) {
+        const expected = await mac(`${id}.${timestamp}.${input.url}.${raw}`);
+        for (const candidate of providedV2)
+            if (constantTimeEqual(candidate, expected))
+                matched = true;
+    }
+    if (!matched)
+        return { verified: false, reason: 'signature_mismatch' };
+    try {
+        return { verified: true, event: JSON.parse(raw), deliveryId: id, timestamp };
+    }
+    catch {
+        return { verified: true, deliveryId: id, timestamp };
+    }
+}
+/**
+ * {@link verifyAtlasWebhook} straight from a Fetch `Request` (Hono, Workers,
+ * Deno, Bun, Next.js route handlers). Reads the body once, as text; do not
+ * read it before calling this.
+ */
+async function verifyAtlasWebhookRequest(request, options) {
+    return verifyAtlasWebhook({ ...options, body: await request.text(), headers: request.headers });
+}
+function toBase64(bytes) {
+    let bin = '';
+    for (const b of bytes)
+        bin += String.fromCharCode(b);
+    return btoa(bin);
+}
+/** Compares every byte whatever the lengths, so timing reveals neither where nor whether they differ early. */
+function constantTimeEqual(a, b) {
+    let diff = a.length ^ b.length;
+    const n = Math.max(a.length, b.length);
+    for (let i = 0; i < n; i++)
+        diff |= (a.charCodeAt(i) || 0) ^ (b.charCodeAt(i) || 0);
+    return diff === 0;
+}
+//# sourceMappingURL=webhooks-web.js.map

package/dist/webhooks-web.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks-web.js","sourceRoot":"","sources":["../src/webhooks-web.ts"],"names":[],"mappings":";;AA4BA,gDA0CC;AAOD,8DAKC;AAlFD,qDAO0B;AAS1B;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,kBAAkB,CAAc,KAA8B;IAClF,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/F,MAAM,EAAE,GAAG,IAAA,2BAAU,EAAC,KAAK,CAAC,OAAO,EAAE,sCAAqB,CAAC,EAAE,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,IAAA,2BAAU,EAAC,KAAK,CAAC,OAAO,EAAE,sCAAqB,CAAC,SAAS,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,IAAA,2BAAU,EAAC,KAAK,CAAC,OAAO,EAAE,sCAAqB,CAAC,SAAS,CAAC,CAAC;IAC7E,IAAI,CAAC,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC9F,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAEtH,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAA,gCAAe,EAAC,SAAS,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAA,gCAAe,EAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAEhH,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,oCAAmB,CAAC,EAAE,CAAC;QAC1G,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EACtC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,GAAG,GAAG,KAAK,EAAE,QAAgB,EAAE,EAAE,CACrC,QAAQ,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACtG,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC,CAAC;QACxD,KAAK,MAAM,SAAS,IAAI,QAAQ;YAAE,IAAI,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC;gBAAE,OAAO,GAAG,IAAI,CAAC;IAC/F,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,IAAI,SAAS,IAAI,KAAK,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;QACrE,KAAK,MAAM,SAAS,IAAI,UAAU;YAAE,IAAI,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC;gBAAE,OAAO,GAAG,IAAI,CAAC;IACjG,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACvE,IAAI,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,yBAAyB,CAC7C,OAAgB,EAChB,OAA0D;IAE1D,OAAO,kBAAkB,CAAI,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;AACrG,CAAC;AAED,SAAS,QAAQ,CAAC,KAAiB;IACjC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,+GAA+G;AAC/G,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpF,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}

package/dist/webhooks.d.ts

@@ -1,45 +1,28 @@
-/** Header names Atlas sends on every delivery (lower-case; match case-insensitively). */
-export declare const ATLAS_WEBHOOK_HEADERS: {
-    readonly id: "atlas-id";
-    readonly timestamp: "atlas-timestamp";
-    readonly signature: "atlas-signature";
-};
-export type WebhookVerifyFailure = 'missing_headers' | 'malformed_signature' | 'stale_timestamp' | 'signature_mismatch';
-export interface WebhookVerifyResult<T = unknown> {
-    /** True only when the signature and timestamp both check out. */
-    verified: boolean;
-    /** Why verification failed, when it did. */
-    reason?: WebhookVerifyFailure;
-    /** The parsed event envelope `{ id, type, timestamp, instance_id, data }` — present only when `verified`. */
-    event?: T;
-    /**
-     * The signed `atlas-id` header — present only when `verified`. It is the same
-     * on every retry of one event, so it is the key to deduplicate deliveries on.
-     */
-    deliveryId?: string;
-    /** The signed `atlas-timestamp` header (epoch ms) of this attempt — present only when `verified`. */
-    timestamp?: number;
-}
-type HeadersLike = Headers | Record<string, string | string[] | undefined>;
-export interface VerifyWebhookInput {
+import { type HeadersLike, type WebhookVerifyOptions, type WebhookVerifyResult } from './webhook-common';
+export { ATLAS_WEBHOOK_HEADERS } from './webhook-common';
+export type { WebhookVerifyFailure, WebhookVerifyOptions, WebhookVerifyResult } from './webhook-common';
+export { verifyAtlasWebhook, verifyAtlasWebhookRequest } from './webhooks-web';
+export type { VerifyAtlasWebhookInput } from './webhooks-web';
+/**
+ * §12.2 — verify an inbound Atlas webhook, for the CUSTOMER consuming events.
+ *
+ * Atlas signs every delivery: `atlas-signature: v1,<base64>` is HMAC-SHA256 over
+ * `<id>.<timestamp>.<rawBody>` keyed with the endpoint secret, with `atlas-id`
+ * and `atlas-timestamp` (epoch ms) headers. The timestamp is INSIDE the signed
+ * material — a header-only timestamp would let an attacker replay a captured
+ * body under a fresh timestamp — and a delivery older than 5 minutes is rejected
+ * so a captured request cannot be replayed later. The header may carry several
+ * space-separated `v1,<base64>` entries (one per secret while a secret rotates
+ * with an overlap); the delivery verifies when any one of them matches.
+ *
+ * The signing logic is identical to the server's (`@atlas/core` `verifyWebhook`),
+ * reimplemented here with zero dependencies so an integrator gets a first-party
+ * verifier without pulling in Atlas internals. Verify over the RAW request body,
+ * BEFORE any JSON parse — re-serializing reorders keys and breaks the MAC.
+ */
+export interface VerifyWebhookInput extends WebhookVerifyOptions {
     /** The RAW request body as received — a string or Buffer, NOT a parsed object. */
     body: string | Buffer;
-    /** The request headers (a plain object, Node `req.headers`, or a Fetch `Headers`). */
-    headers: HeadersLike;
-    /** The endpoint's signing secret (shown once when the endpoint was created/rotated). */
-    secret: string;
-    /** Override "now" (tests); defaults to the current time. */
-    now?: Date;
-    /** Override the ±replay tolerance (defaults to 5 minutes). */
-    toleranceMs?: number;
-    /**
-     * The exact URL Atlas POSTed to (your endpoint's `url`). When given, `v2`
-     * signature entries — which also cover the URL, for endpoints with
-     * `signature_versions` including `v2` — are checked too.
-     */
-    url?: string;
-    /** Accept only a `v2` entry (needs `url`): a delivery replayed to another URL then fails. */
-    requireV2?: boolean;
 }
 /**
  * Verify and parse an Atlas webhook. Returns `{ verified, reason?, event?,
@@ -92,4 +75,3 @@ export interface VerifyStandardWebhookInput {
  * ```
  */
 export declare function verifyStandardWebhook<T = unknown>(input: VerifyStandardWebhookInput): WebhookVerifyResult<T>;
-export {};

package/dist/webhooks.js

@@ -1,67 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.STANDARD_WEBHOOK_HEADERS = exports.ATLAS_WEBHOOK_HEADERS = void 0;
+exports.STANDARD_WEBHOOK_HEADERS = exports.verifyAtlasWebhookRequest = exports.verifyAtlasWebhook = exports.ATLAS_WEBHOOK_HEADERS = void 0;
 exports.verifyWebhook = verifyWebhook;
 exports.verifyStandardWebhook = verifyStandardWebhook;
 const edge_crypto_1 = require("./edge-crypto");
-/**
- * §12.2 — verify an inbound Atlas webhook, for the CUSTOMER consuming events.
- *
- * Atlas signs every delivery: `atlas-signature: v1,<base64>` is HMAC-SHA256 over
- * `<id>.<timestamp>.<rawBody>` keyed with the endpoint secret, with `atlas-id`
- * and `atlas-timestamp` (epoch ms) headers. The timestamp is INSIDE the signed
- * material — a header-only timestamp would let an attacker replay a captured
- * body under a fresh timestamp — and a delivery older than 5 minutes is rejected
- * so a captured request cannot be replayed later. The header may carry several
- * space-separated `v1,<base64>` entries (one per secret while a secret rotates
- * with an overlap); the delivery verifies when any one of them matches.
- *
- * The signing logic is identical to the server's (`@atlas/core` `verifyWebhook`),
- * reimplemented here with zero dependencies so an integrator gets a first-party
- * verifier without pulling in Atlas internals. Verify over the RAW request body,
- * BEFORE any JSON parse — re-serializing reorders keys and breaks the MAC.
- */
-const SIGNATURE_VERSION = 'v1';
-const REPLAY_TOLERANCE_MS = 5 * 60_000;
-/** Header names Atlas sends on every delivery (lower-case; match case-insensitively). */
-exports.ATLAS_WEBHOOK_HEADERS = {
-    id: 'atlas-id',
-    timestamp: 'atlas-timestamp',
-    signature: 'atlas-signature',
-};
-/** Read a header case-insensitively from a plain object or a Fetch `Headers`. */
-function readHeader(headers, name) {
-    if (typeof headers.get === 'function') {
-        return headers.get(name) ?? undefined;
-    }
-    const bag = headers;
-    const direct = bag[name] ?? bag[name.toLowerCase()];
-    const v = Array.isArray(direct) ? direct[0] : direct;
-    if (v !== undefined)
-        return v;
-    // Fall back to a case-insensitive scan (Node lower-cases, but be safe).
-    const hit = Object.keys(bag).find((k) => k.toLowerCase() === name);
-    const found = hit ? bag[hit] : undefined;
-    return Array.isArray(found) ? found[0] : found;
-}
-/**
- * The `v1` signatures in an `atlas-signature` header. The header carries one
- * `v1,<base64>` entry, or several separated by spaces (while an endpoint
- * secret rotates, Atlas signs with the old and the new secret). Entries of
- * another version are skipped, so a future scheme never breaks this verifier.
- */
-function parseSignatures(header, version = SIGNATURE_VERSION) {
-    const out = [];
-    for (const entry of header.trim().split(/\s+/)) {
-        const comma = entry.indexOf(',');
-        if (comma <= 0)
-            continue;
-        const value = entry.slice(comma + 1);
-        if (entry.slice(0, comma) === version && value)
-            out.push(value);
-    }
-    return out;
-}
+const webhook_common_1 = require("./webhook-common");
+var webhook_common_2 = require("./webhook-common");
+Object.defineProperty(exports, "ATLAS_WEBHOOK_HEADERS", { enumerable: true, get: function () { return webhook_common_2.ATLAS_WEBHOOK_HEADERS; } });
+// The Web-standards verifier lives in its own module (the rp entry loads only that one).
+var webhooks_web_1 = require("./webhooks-web");
+Object.defineProperty(exports, "verifyAtlasWebhook", { enumerable: true, get: function () { return webhooks_web_1.verifyAtlasWebhook; } });
+Object.defineProperty(exports, "verifyAtlasWebhookRequest", { enumerable: true, get: function () { return webhooks_web_1.verifyAtlasWebhookRequest; } });
 /**
  * Verify and parse an Atlas webhook. Returns `{ verified, reason?, event?,
  * deliveryId?, timestamp? }` — it never throws on a bad signature (a thrown
@@ -83,18 +32,18 @@ function parseSignatures(header, version = SIGNATURE_VERSION) {
  */
 function verifyWebhook(input) {
     const raw = typeof input.body === 'string' ? input.body : input.body.toString('utf8');
-    const id = readHeader(input.headers, exports.ATLAS_WEBHOOK_HEADERS.id);
-    const timestampRaw = readHeader(input.headers, exports.ATLAS_WEBHOOK_HEADERS.timestamp);
-    const signature = readHeader(input.headers, exports.ATLAS_WEBHOOK_HEADERS.signature);
+    const id = (0, webhook_common_1.readHeader)(input.headers, webhook_common_1.ATLAS_WEBHOOK_HEADERS.id);
+    const timestampRaw = (0, webhook_common_1.readHeader)(input.headers, webhook_common_1.ATLAS_WEBHOOK_HEADERS.timestamp);
+    const signature = (0, webhook_common_1.readHeader)(input.headers, webhook_common_1.ATLAS_WEBHOOK_HEADERS.signature);
     if (!id || !timestampRaw || !signature)
         return { verified: false, reason: 'missing_headers' };
-    const provided = input.requireV2 ? [] : parseSignatures(signature);
-    const providedV2 = input.url ? parseSignatures(signature, 'v2') : [];
+    const provided = input.requireV2 ? [] : (0, webhook_common_1.parseSignatures)(signature);
+    const providedV2 = input.url ? (0, webhook_common_1.parseSignatures)(signature, 'v2') : [];
     if (provided.length === 0 && providedV2.length === 0)
         return { verified: false, reason: 'malformed_signature' };
     const timestamp = Number(timestampRaw);
     const now = (input.now ?? new Date()).getTime();
-    const tolerance = input.toleranceMs ?? REPLAY_TOLERANCE_MS;
+    const tolerance = input.toleranceMs ?? webhook_common_1.REPLAY_TOLERANCE_MS;
     // Rejected in both directions: a far-future timestamp is as suspicious as a
     // stale one — accepting it would let an attacker mint a long-lived replay.
     if (!Number.isFinite(timestamp) || Math.abs(now - timestamp) > tolerance) {
@@ -148,17 +97,17 @@ exports.STANDARD_WEBHOOK_HEADERS = {
  */
 function verifyStandardWebhook(input) {
     const raw = typeof input.body === 'string' ? input.body : input.body.toString('utf8');
-    const id = readHeader(input.headers, exports.STANDARD_WEBHOOK_HEADERS.id);
-    const timestampRaw = readHeader(input.headers, exports.STANDARD_WEBHOOK_HEADERS.timestamp);
-    const signature = readHeader(input.headers, exports.STANDARD_WEBHOOK_HEADERS.signature);
+    const id = (0, webhook_common_1.readHeader)(input.headers, exports.STANDARD_WEBHOOK_HEADERS.id);
+    const timestampRaw = (0, webhook_common_1.readHeader)(input.headers, exports.STANDARD_WEBHOOK_HEADERS.timestamp);
+    const signature = (0, webhook_common_1.readHeader)(input.headers, exports.STANDARD_WEBHOOK_HEADERS.signature);
     if (!id || !timestampRaw || !signature)
         return { verified: false, reason: 'missing_headers' };
-    const provided = parseSignatures(signature);
+    const provided = (0, webhook_common_1.parseSignatures)(signature);
     if (provided.length === 0)
         return { verified: false, reason: 'malformed_signature' };
     const timestamp = /^\d+$/.test(timestampRaw) ? Number(timestampRaw) : NaN;
     const nowSec = Math.floor((input.now ?? new Date()).getTime() / 1000);
-    if (!Number.isFinite(timestamp) || Math.abs(nowSec - timestamp) > (input.toleranceSec ?? REPLAY_TOLERANCE_MS / 1000)) {
+    if (!Number.isFinite(timestamp) || Math.abs(nowSec - timestamp) > (input.toleranceSec ?? webhook_common_1.REPLAY_TOLERANCE_MS / 1000)) {
         return { verified: false, reason: 'stale_timestamp' };
     }
     const key = Buffer.from(input.secret.startsWith('whsec_') ? input.secret.slice('whsec_'.length) : input.secret, 'base64');

package/dist/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":";;;AA8HA,sCA8CC;AAkCD,sDA6BC;AA3OD,+CAA4D;AAE5D;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,mBAAmB,GAAG,CAAC,GAAG,MAAM,CAAC;AAEvC,yFAAyF;AAC5E,QAAA,qBAAqB,GAAG;IACnC,EAAE,EAAE,UAAU;IACd,SAAS,EAAE,iBAAiB;IAC5B,SAAS,EAAE,iBAAiB;CACpB,CAAC;AAwBX,iFAAiF;AACjF,SAAS,UAAU,CAAC,OAAoB,EAAE,IAAY;IACpD,IAAI,OAAQ,OAAmB,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QACnD,OAAQ,OAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IACrD,CAAC;IACD,MAAM,GAAG,GAAG,OAAwD,CAAC;IACrE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACrD,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,wEAAwE;IACxE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,MAAc,EAAE,UAAkB,iBAAiB;IAC1E,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,IAAI,CAAC;YAAE,SAAS;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,OAAO,IAAI,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAyBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,aAAa,CAAc,KAAyB;IAClE,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtF,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,6BAAqB,CAAC,EAAE,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,6BAAqB,CAAC,SAAS,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,6BAAqB,CAAC,SAAS,CAAC,CAAC;IAC7E,IAAI,CAAC,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAE9F,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAEhH,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,IAAI,mBAAmB,CAAC;IAC3D,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,SAAS,EAAE,CAAC;QACzE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAC1B,IAAA,wBAAU,EAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CACxF,CAAC;IACF,8DAA8D;IAC9D,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,CAAC,EAAE,QAAQ,CAAC;YAAE,OAAO,GAAG,IAAI,CAAC;IACnF,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAC5B,IAAA,wBAAU,EAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,SAAS,IAAI,KAAK,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CACrG,CAAC;QACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,CAAC,EAAE,UAAU,CAAC;gBAAE,OAAO,GAAG,IAAI,CAAC;QACvF,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAEvE,IAAI,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,qFAAqF;QACrF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED,sFAAsF;AACzE,QAAA,wBAAwB,GAAG;IACtC,EAAE,EAAE,YAAY;IAChB,SAAS,EAAE,mBAAmB;IAC9B,SAAS,EAAE,mBAAmB;CACtB,CAAC;AAaX;;;;;;;;;;;;;GAaG;AACH,SAAgB,qBAAqB,CAAc,KAAiC;IAClF,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtF,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,gCAAwB,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,gCAAwB,CAAC,SAAS,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,gCAAwB,CAAC,SAAS,CAAC,CAAC;IAChF,IAAI,CAAC,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAE9F,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAErF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,mBAAmB,GAAG,IAAI,CAAC,EAAE,CAAC;QACrH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC1H,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAA,wBAAU,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7G,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,CAAC,EAAE,QAAQ,CAAC;YAAE,OAAO,GAAG,IAAI,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACvE,IAAI,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IACvD,CAAC;AACH,CAAC"}
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":";;;AA2DA,sCA8CC;AAkCD,sDA6BC;AAxKD,+CAA4D;AAC5D,qDAQ0B;AAE1B,mDAAyD;AAAhD,uHAAA,qBAAqB,OAAA;AAE9B,yFAAyF;AACzF,+CAA+E;AAAtE,kHAAA,kBAAkB,OAAA;AAAE,yHAAA,yBAAyB,OAAA;AA0BtD;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,aAAa,CAAc,KAAyB;IAClE,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtF,MAAM,EAAE,GAAG,IAAA,2BAAU,EAAC,KAAK,CAAC,OAAO,EAAE,sCAAqB,CAAC,EAAE,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,IAAA,2BAAU,EAAC,KAAK,CAAC,OAAO,EAAE,sCAAqB,CAAC,SAAS,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,IAAA,2BAAU,EAAC,KAAK,CAAC,OAAO,EAAE,sCAAqB,CAAC,SAAS,CAAC,CAAC;IAC7E,IAAI,CAAC,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAE9F,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAA,gCAAe,EAAC,SAAS,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAA,gCAAe,EAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAEhH,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,IAAI,oCAAmB,CAAC;IAC3D,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,SAAS,EAAE,CAAC;QACzE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAC1B,IAAA,wBAAU,EAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CACxF,CAAC;IACF,8DAA8D;IAC9D,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,CAAC,EAAE,QAAQ,CAAC;YAAE,OAAO,GAAG,IAAI,CAAC;IACnF,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAC5B,IAAA,wBAAU,EAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,SAAS,IAAI,KAAK,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CACrG,CAAC;QACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,CAAC,EAAE,UAAU,CAAC;gBAAE,OAAO,GAAG,IAAI,CAAC;QACvF,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAEvE,IAAI,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,qFAAqF;QACrF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED,sFAAsF;AACzE,QAAA,wBAAwB,GAAG;IACtC,EAAE,EAAE,YAAY;IAChB,SAAS,EAAE,mBAAmB;IAC9B,SAAS,EAAE,mBAAmB;CACtB,CAAC;AAaX;;;;;;;;;;;;;GAaG;AACH,SAAgB,qBAAqB,CAAc,KAAiC;IAClF,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtF,MAAM,EAAE,GAAG,IAAA,2BAAU,EAAC,KAAK,CAAC,OAAO,EAAE,gCAAwB,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,IAAA,2BAAU,EAAC,KAAK,CAAC,OAAO,EAAE,gCAAwB,CAAC,SAAS,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,IAAA,2BAAU,EAAC,KAAK,CAAC,OAAO,EAAE,gCAAwB,CAAC,SAAS,CAAC,CAAC;IAChF,IAAI,CAAC,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAE9F,MAAM,QAAQ,GAAG,IAAA,gCAAe,EAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAErF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,oCAAmB,GAAG,IAAI,CAAC,EAAE,CAAC;QACrH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC1H,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAA,wBAAU,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7G,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,CAAC,EAAE,QAAQ,CAAC;YAAE,OAAO,GAAG,IAAI,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACvE,IAAI,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IACvD,CAAC;AACH,CAAC"}

package/package.json

@@ -1,8 +1,33 @@
 {
   "name": "@atlasauth/backend",
-  "version": "0.28.0",
+  "version": "0.30.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./rp": {
+      "types": "./dist/rp.d.ts",
+      "default": "./dist/rp.js"
+    },
+    "./testing": {
+      "types": "./dist/testing.d.ts",
+      "default": "./dist/testing.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "typesVersions": {
+    "*": {
+      "rp": [
+        "./dist/rp.d.ts"
+      ],
+      "testing": [
+        "./dist/testing.d.ts"
+      ]
+    }
+  },
   "dependencies": {
     "jose": "^5.9.6",
     "@noble/ciphers": "^1.3.0",