@atribu/node 0.1.0

package/dist/types-Dc6tIN_V.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Typed webhook event union. Mirrors `src/lib/webhooks/fan-out.ts` and the
+ * fan-out call sites in the WA + IG webhook processors.
+ *
+ * Wire format is snake_case to match the server. Consumers that prefer
+ * camelCase can convert in their handler.
+ */
+type WebhookProvider = "whatsapp" | "instagram";
+type WebhookEventType = "message.received" | "message.delivery" | "conversation.started";
+interface BaseEvent {
+    /** Stable event id for de-dup (also surfaced in `X-Atribu-Delivery-Id`). */
+    id: string;
+    /** ISO 8601 timestamp of the underlying provider event. */
+    occurred_at: string;
+    /** The consumer OAuth app id (`oauth_apps.id`). */
+    app_id: string;
+    /** The `data_connections.id` the event came from. */
+    connection_id: string;
+}
+interface WhatsAppMessageReceivedEvent extends BaseEvent {
+    type: "message.received";
+    provider: "whatsapp";
+    data: {
+        wa_message_id: string;
+        from: string;
+        to: string | null;
+        contact_name: string | null;
+        /** Meta's message type (text, image, video, audio, document, button, interactive, …). */
+        type: string;
+        text: string | null;
+        /** Full Meta message envelope. */
+        raw: Record<string, unknown>;
+    };
+}
+interface WhatsAppMessageDeliveryEvent extends BaseEvent {
+    type: "message.delivery";
+    provider: "whatsapp";
+    data: {
+        wa_message_id: string;
+        recipient_id: string;
+        status: "sent" | "delivered" | "read" | "failed" | (string & {});
+        raw: Record<string, unknown>;
+    };
+}
+interface InstagramFbLoginMessageData {
+    sender_id: string;
+    recipient_id: string;
+    mid: string;
+    text: string | null;
+    is_echo: boolean;
+    attachments: unknown[] | null;
+    referral: unknown | null;
+    raw: Record<string, unknown>;
+}
+interface InstagramFbLoginPostbackData {
+    sender_id: string;
+    recipient_id: string;
+    kind: "postback";
+    title: string | null;
+    payload: string | null;
+    raw: Record<string, unknown>;
+}
+interface InstagramIgLoginChangeData {
+    sender_id: string | null;
+    recipient_id: string | null;
+    from_username: string | null;
+    mid: string | null;
+    text: string | null;
+    raw: Record<string, unknown>;
+}
+/**
+ * IG `message.received` has three shapes (fb_login message, fb_login
+ * postback, ig_login change). Narrow on `"kind" in data` for postback,
+ * `"is_echo" in data` for fb_login message, otherwise it's an ig_login
+ * change.
+ */
+type InstagramMessageReceivedData = InstagramFbLoginMessageData | InstagramFbLoginPostbackData | InstagramIgLoginChangeData;
+interface InstagramMessageReceivedEvent extends BaseEvent {
+    type: "message.received";
+    provider: "instagram";
+    data: InstagramMessageReceivedData;
+}
+interface InstagramMessageDeliveryEvent extends BaseEvent {
+    type: "message.delivery";
+    provider: "instagram";
+    data: {
+        sender_id: string;
+        recipient_id: string;
+        mids: string[];
+        watermark: number;
+    };
+}
+/** Reserved — the server doesn't emit this today but the type is in the union. */
+interface ConversationStartedEvent extends BaseEvent {
+    type: "conversation.started";
+    provider: WebhookProvider;
+    data: Record<string, unknown>;
+}
+type AtribuWebhookEvent = WhatsAppMessageReceivedEvent | WhatsAppMessageDeliveryEvent | InstagramMessageReceivedEvent | InstagramMessageDeliveryEvent | ConversationStartedEvent;
+
+export type { AtribuWebhookEvent as A, ConversationStartedEvent as C, InstagramFbLoginMessageData as I, WebhookEventType as W, InstagramFbLoginPostbackData as a, InstagramIgLoginChangeData as b, InstagramMessageDeliveryEvent as c, InstagramMessageReceivedData as d, InstagramMessageReceivedEvent as e, WebhookProvider as f, WhatsAppMessageDeliveryEvent as g, WhatsAppMessageReceivedEvent as h };

package/dist/webhooks/index.cjs

@@ -0,0 +1,97 @@
+'use strict';
+
+// src/errors.ts
+var AtribuError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = new.target.name;
+  }
+};
+var AtribuWebhookError = class extends AtribuError {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+};
+
+// src/webhooks/verify.ts
+async function verifyWebhook(opts) {
+  if (!opts.signature) {
+    throw new AtribuWebhookError("missing_signature", "Missing X-Atribu-Signature header");
+  }
+  const parsed = parseHeader(opts.signature);
+  const bodyString = typeof opts.rawBody === "string" ? opts.rawBody : decodeUtf8(opts.rawBody);
+  const nowMs = (opts.now ?? Date.now)();
+  const tolerance = opts.tolerance ?? 300;
+  const ageSeconds = Math.abs(nowMs / 1e3 - parsed.t);
+  if (ageSeconds > tolerance) {
+    throw new AtribuWebhookError(
+      "expired_timestamp",
+      `Signed timestamp is ${Math.round(ageSeconds)}s old (tolerance ${tolerance}s)`
+    );
+  }
+  const signingInput = `${parsed.t}.${bodyString}`;
+  const matchesCurrent = await safeCompareHmac(opts.secret, signingInput, parsed.v1);
+  if (!matchesCurrent) {
+    const previous = opts.previousSecret;
+    if (!previous || !await safeCompareHmac(previous, signingInput, parsed.v1)) {
+      throw new AtribuWebhookError("invalid_signature", "Signature does not match");
+    }
+  }
+  return JSON.parse(bodyString);
+}
+function parseHeader(header) {
+  let t = null;
+  let v1 = null;
+  for (const part of header.split(",")) {
+    const eq = part.indexOf("=");
+    if (eq < 0) continue;
+    const key = part.slice(0, eq).trim();
+    const value = part.slice(eq + 1).trim();
+    if (key === "t") t = Number(value);
+    else if (key === "v1") v1 = value;
+  }
+  if (t === null || !Number.isFinite(t) || !v1) {
+    throw new AtribuWebhookError("malformed_header", `Malformed signature header: ${header}`);
+  }
+  return { t, v1 };
+}
+async function safeCompareHmac(secret, input, expectedHex) {
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const sig = await crypto.subtle.sign("HMAC", key, encoder.encode(input));
+  const computed = bufferToHex(sig);
+  return constantTimeEqualHex(computed, expectedHex);
+}
+function bufferToHex(buf) {
+  const bytes = new Uint8Array(buf);
+  let hex = "";
+  for (let i = 0; i < bytes.length; i++) {
+    const b = bytes[i];
+    hex += (b < 16 ? "0" : "") + b.toString(16);
+  }
+  return hex;
+}
+function constantTimeEqualHex(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) {
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return diff === 0;
+}
+function decodeUtf8(buf) {
+  return new TextDecoder("utf-8").decode(buf);
+}
+
+exports.AtribuWebhookError = AtribuWebhookError;
+exports.verifyWebhook = verifyWebhook;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/webhooks/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/errors.ts","../../src/webhooks/verify.ts"],"names":[],"mappings":";;;AAiCO,IAAM,WAAA,GAAN,cAA0B,KAAA,CAAM;AAAA,EACrC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AAAA,EACzB;AACF,CAAA;AAmFO,IAAM,kBAAA,GAAN,cAAiC,WAAA,CAAY;AAAA,EACzC,IAAA;AAAA,EACT,WAAA,CAAY,MAAwB,OAAA,EAAiB;AACnD,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;;;AC1FA,eAAsB,cAAc,IAAA,EAAyD;AAC3F,EAAA,IAAI,CAAC,KAAK,SAAA,EAAW;AACnB,IAAA,MAAM,IAAI,kBAAA,CAAmB,mBAAA,EAAqB,mCAAmC,CAAA;AAAA,EACvF;AAEA,EAAA,MAAM,MAAA,GAAS,WAAA,CAAY,IAAA,CAAK,SAAS,CAAA;AACzC,EAAA,MAAM,UAAA,GAAa,OAAO,IAAA,CAAK,OAAA,KAAY,WAAW,IAAA,CAAK,OAAA,GAAU,UAAA,CAAW,IAAA,CAAK,OAAO,CAAA;AAE5F,EAAA,MAAM,KAAA,GAAA,CAAS,IAAA,CAAK,GAAA,IAAO,IAAA,CAAK,GAAA,GAAK;AACrC,EAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,GAAA;AACpC,EAAA,MAAM,aAAa,IAAA,CAAK,GAAA,CAAI,KAAA,GAAQ,GAAA,GAAO,OAAO,CAAC,CAAA;AACnD,EAAA,IAAI,aAAa,SAAA,EAAW;AAC1B,IAAA,MAAM,IAAI,kBAAA;AAAA,MACR,mBAAA;AAAA,MACA,uBAAuB,IAAA,CAAK,KAAA,CAAM,UAAU,CAAC,oBAAoB,SAAS,CAAA,EAAA;AAAA,KAC5E;AAAA,EACF;AAEA,EAAA,MAAM,YAAA,GAAe,CAAA,EAAG,MAAA,CAAO,CAAC,IAAI,UAAU,CAAA,CAAA;AAC9C,EAAA,MAAM,iBAAiB,MAAM,eAAA,CAAgB,KAAK,MAAA,EAAQ,YAAA,EAAc,OAAO,EAAE,CAAA;AACjF,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,MAAM,WAAW,IAAA,CAAK,cAAA;AACtB,IAAA,IAAI,CAAC,YAAY,CAAE,MAAM,gBAAgB,QAAA,EAAU,YAAA,EAAc,MAAA,CAAO,EAAE,CAAA,EAAI;AAC5E,MAAA,MAAM,IAAI,kBAAA,CAAmB,mBAAA,EAAqB,0BAA0B,CAAA;AAAA,IAC9E;AAAA,EACF;AAEA,EAAA,OAAO,IAAA,CAAK,MAAM,UAAU,CAAA;AAC9B;AAEA,SAAS,YAAY,MAAA,EAA8B;AACjD,EAAA,IAAI,CAAA,GAAmB,IAAA;AACvB,EAAA,IAAI,EAAA,GAAoB,IAAA;AACxB,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAAG;AACpC,IAAA,MAAM,EAAA,GAAK,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC3B,IAAA,IAAI,KAAK,CAAA,EAAG;AACZ,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,EAAE,EAAE,IAAA,EAAK;AACnC,IAAA,MAAM,QAAQ,IAAA,CAAK,KAAA,CAAM,EAAA,GAAK,CAAC,EAAE,IAAA,EAAK;AACtC,IAAA,IAAI,GAAA,KAAQ,GAAA,EAAK,CAAA,GAAI,MAAA,CAAO,KAAK,CAAA;AAAA,SAAA,IACxB,GAAA,KAAQ,MAAM,EAAA,GAAK,KAAA;AAAA,EAC9B;AACA,EAAA,IAAI,CAAA,KAAM,QAAQ,CAAC,MAAA,CAAO,SAAS,CAAC,CAAA,IAAK,CAAC,EAAA,EAAI;AAC5C,IAAA,MAAM,IAAI,kBAAA,CAAmB,kBAAA,EAAoB,CAAA,4BAAA,EAA+B,MAAM,CAAA,CAAE,CAAA;AAAA,EAC1F;AACA,EAAA,OAAO,EAAE,GAAG,EAAA,EAAG;AACjB;AAEA,eAAe,eAAA,CAAgB,MAAA,EAAgB,KAAA,EAAe,WAAA,EAAuC;AACnG,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,IAC9B,KAAA;AAAA,IACA,OAAA,CAAQ,OAAO,MAAM,CAAA;AAAA,IACrB,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IAChC,KAAA;AAAA,IACA,CAAC,MAAM;AAAA,GACT;AACA,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,QAAQ,GAAA,EAAK,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAC,CAAA;AACvE,EAAA,MAAM,QAAA,GAAW,YAAY,GAAG,CAAA;AAChC,EAAA,OAAO,oBAAA,CAAqB,UAAU,WAAW,CAAA;AACnD;AAEA,SAAS,YAAY,GAAA,EAA0B;AAC7C,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,GAAG,CAAA;AAChC,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAM,CAAA,GAAI,MAAM,CAAC,CAAA;AACjB,IAAA,GAAA,IAAA,CAAQ,IAAI,EAAA,GAAK,GAAA,GAAM,EAAA,IAAM,CAAA,CAAE,SAAS,EAAE,CAAA;AAAA,EAC5C;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,oBAAA,CAAqB,GAAW,CAAA,EAAoB;AAC3D,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ,OAAO,KAAA;AAClC,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,IAAA,IAAQ,EAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAAA,EAC1C;AACA,EAAA,OAAO,IAAA,KAAS,CAAA;AAClB;AAEA,SAAS,WAAW,GAAA,EAAyB;AAC3C,EAAA,OAAO,IAAI,WAAA,CAAY,OAAO,CAAA,CAAE,OAAO,GAAG,CAAA;AAC5C","file":"index.cjs","sourcesContent":["/**\n * Atribu error class hierarchy.\n *\n * Why typed errors: consumers need to branch on auth-failure vs rate-limit vs\n * server-error vs validation-error to decide whether to retry, refresh\n * credentials, or surface to the user. A single `Error` with a status code\n * forces every consumer to write the same `if (err.status === 401)` ladder.\n *\n * Why no automatic retries: the SDK derives a `retry` hint from status +\n * Retry-After + error code, but consumers' queue/job systems decide whether\n * to act on it. Auto-retry inside the SDK hides backpressure signals and\n * makes error budgets opaque.\n */\n\nimport type { RetryHint } from \"./retry\";\n\nexport type ApiErrorCode =\n  | \"unauthorized\"\n  | \"forbidden\"\n  | \"insufficient_scope\"\n  | \"not_found\"\n  | \"invalid_parameter\"\n  | \"invalid_request\"\n  | \"validation_error\"\n  | \"invalid_content\"\n  | \"invalid_date_range\"\n  | \"rate_limit_exceeded\"\n  | \"connection_not_ready\"\n  | \"provider_error\"\n  | \"service_unavailable\"\n  | \"internal_error\"\n  | string;\n\nexport class AtribuError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = new.target.name;\n  }\n}\n\nexport class AtribuConfigError extends AtribuError {}\n\nexport class AtribuTransportError extends AtribuError {\n  readonly cause: unknown;\n  constructor(message: string, cause: unknown) {\n    super(message);\n    this.cause = cause;\n  }\n}\n\nexport interface ApiErrorBody {\n  code: ApiErrorCode;\n  message: string;\n  status: number;\n  request_id?: string;\n}\n\nexport class AtribuApiError extends AtribuError {\n  readonly code: ApiErrorCode;\n  readonly status: number;\n  readonly requestId: string | null;\n  readonly retry: RetryHint;\n  readonly responseBody: unknown;\n\n  constructor(args: {\n    code: ApiErrorCode;\n    message: string;\n    status: number;\n    requestId: string | null;\n    retry: RetryHint;\n    responseBody: unknown;\n  }) {\n    super(`[${args.code}] ${args.message}`);\n    this.code = args.code;\n    this.status = args.status;\n    this.requestId = args.requestId;\n    this.retry = args.retry;\n    this.responseBody = args.responseBody;\n  }\n\n  isRetryable(): boolean {\n    return this.retry.action === \"retry\" || this.retry.action === \"retry_after\";\n  }\n  isAuthFailure(): boolean {\n    return this.status === 401 || this.code === \"unauthorized\";\n  }\n  isRateLimit(): boolean {\n    return this.status === 429 || this.code === \"rate_limit_exceeded\";\n  }\n}\n\nexport type OauthErrorCode =\n  | \"invalid_request\"\n  | \"invalid_client\"\n  | \"invalid_grant\"\n  | \"unauthorized_client\"\n  | \"unsupported_grant_type\"\n  | \"invalid_scope\"\n  | \"server_error\"\n  | \"unsupported_token_type\"\n  | string;\n\nexport class AtribuOauthError extends AtribuError {\n  readonly code: OauthErrorCode;\n  readonly status: number;\n  readonly description: string | null;\n\n  constructor(args: { code: OauthErrorCode; description: string | null; status: number }) {\n    super(`[oauth/${args.code}] ${args.description ?? args.code}`);\n    this.code = args.code;\n    this.status = args.status;\n    this.description = args.description;\n  }\n}\n\nexport type WebhookErrorCode =\n  | \"missing_signature\"\n  | \"malformed_header\"\n  | \"expired_timestamp\"\n  | \"invalid_signature\";\n\nexport class AtribuWebhookError extends AtribuError {\n  readonly code: WebhookErrorCode;\n  constructor(code: WebhookErrorCode, message: string) {\n    super(message);\n    this.code = code;\n  }\n}\n","/**\n * Verify Atribu webhook signatures using Web Crypto.\n *\n * Why Web Crypto: works in Node 18+, Bun, Deno, Vercel Edge, Cloudflare\n * Workers. No `node:crypto` import keeps this subpath edge-safe.\n *\n * Header format (Stripe-style): `t=<unix_seconds>,v1=<hex_hmac_sha256>`\n * Signed string: `<t>.<rawBody>`\n *\n * Rotation: pass `previousSecret` during the grace window after rotating.\n * Atribu always signs with the current secret; the previous slot exists\n * only so subscribers can dual-verify during their own deploy.\n */\n\nimport { AtribuWebhookError } from \"../errors\";\nimport type { AtribuWebhookEvent } from \"./types\";\n\nexport interface VerifyWebhookOptions {\n  /** Raw, unparsed request body (string or Uint8Array). */\n  rawBody: string | Uint8Array;\n  /** Value of the `X-Atribu-Signature` header. */\n  signature: string | null | undefined;\n  /** Current HMAC secret. */\n  secret: string;\n  /** Previous secret during rotation grace. */\n  previousSecret?: string | null;\n  /** Max age of the signed timestamp in seconds. Default 300 (5 minutes). */\n  tolerance?: number;\n  /** Inject for tests; defaults to Date.now(). */\n  now?: () => number;\n}\n\ninterface ParsedHeader {\n  t: number;\n  v1: string;\n}\n\nexport async function verifyWebhook(opts: VerifyWebhookOptions): Promise<AtribuWebhookEvent> {\n  if (!opts.signature) {\n    throw new AtribuWebhookError(\"missing_signature\", \"Missing X-Atribu-Signature header\");\n  }\n\n  const parsed = parseHeader(opts.signature);\n  const bodyString = typeof opts.rawBody === \"string\" ? opts.rawBody : decodeUtf8(opts.rawBody);\n\n  const nowMs = (opts.now ?? Date.now)();\n  const tolerance = opts.tolerance ?? 300;\n  const ageSeconds = Math.abs(nowMs / 1000 - parsed.t);\n  if (ageSeconds > tolerance) {\n    throw new AtribuWebhookError(\n      \"expired_timestamp\",\n      `Signed timestamp is ${Math.round(ageSeconds)}s old (tolerance ${tolerance}s)`,\n    );\n  }\n\n  const signingInput = `${parsed.t}.${bodyString}`;\n  const matchesCurrent = await safeCompareHmac(opts.secret, signingInput, parsed.v1);\n  if (!matchesCurrent) {\n    const previous = opts.previousSecret;\n    if (!previous || !(await safeCompareHmac(previous, signingInput, parsed.v1))) {\n      throw new AtribuWebhookError(\"invalid_signature\", \"Signature does not match\");\n    }\n  }\n\n  return JSON.parse(bodyString) as AtribuWebhookEvent;\n}\n\nfunction parseHeader(header: string): ParsedHeader {\n  let t: number | null = null;\n  let v1: string | null = null;\n  for (const part of header.split(\",\")) {\n    const eq = part.indexOf(\"=\");\n    if (eq < 0) continue;\n    const key = part.slice(0, eq).trim();\n    const value = part.slice(eq + 1).trim();\n    if (key === \"t\") t = Number(value);\n    else if (key === \"v1\") v1 = value;\n  }\n  if (t === null || !Number.isFinite(t) || !v1) {\n    throw new AtribuWebhookError(\"malformed_header\", `Malformed signature header: ${header}`);\n  }\n  return { t, v1 };\n}\n\nasync function safeCompareHmac(secret: string, input: string, expectedHex: string): Promise<boolean> {\n  const encoder = new TextEncoder();\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    encoder.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  const sig = await crypto.subtle.sign(\"HMAC\", key, encoder.encode(input));\n  const computed = bufferToHex(sig);\n  return constantTimeEqualHex(computed, expectedHex);\n}\n\nfunction bufferToHex(buf: ArrayBuffer): string {\n  const bytes = new Uint8Array(buf);\n  let hex = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    const b = bytes[i]!;\n    hex += (b < 16 ? \"0\" : \"\") + b.toString(16);\n  }\n  return hex;\n}\n\nfunction constantTimeEqualHex(a: string, b: string): boolean {\n  if (a.length !== b.length) return false;\n  let diff = 0;\n  for (let i = 0; i < a.length; i++) {\n    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return diff === 0;\n}\n\nfunction decodeUtf8(buf: Uint8Array): string {\n  return new TextDecoder(\"utf-8\").decode(buf);\n}\n"]}

package/dist/webhooks/index.d.cts

@@ -0,0 +1,35 @@
+import { A as AtribuWebhookEvent } from '../types-Dc6tIN_V.cjs';
+export { C as ConversationStartedEvent, I as InstagramFbLoginMessageData, a as InstagramFbLoginPostbackData, b as InstagramIgLoginChangeData, c as InstagramMessageDeliveryEvent, d as InstagramMessageReceivedData, e as InstagramMessageReceivedEvent, W as WebhookEventType, f as WebhookProvider, g as WhatsAppMessageDeliveryEvent, h as WhatsAppMessageReceivedEvent } from '../types-Dc6tIN_V.cjs';
+export { g as AtribuWebhookError, W as WebhookErrorCode } from '../errors-D3ApBz8J.cjs';
+
+/**
+ * Verify Atribu webhook signatures using Web Crypto.
+ *
+ * Why Web Crypto: works in Node 18+, Bun, Deno, Vercel Edge, Cloudflare
+ * Workers. No `node:crypto` import keeps this subpath edge-safe.
+ *
+ * Header format (Stripe-style): `t=<unix_seconds>,v1=<hex_hmac_sha256>`
+ * Signed string: `<t>.<rawBody>`
+ *
+ * Rotation: pass `previousSecret` during the grace window after rotating.
+ * Atribu always signs with the current secret; the previous slot exists
+ * only so subscribers can dual-verify during their own deploy.
+ */
+
+interface VerifyWebhookOptions {
+    /** Raw, unparsed request body (string or Uint8Array). */
+    rawBody: string | Uint8Array;
+    /** Value of the `X-Atribu-Signature` header. */
+    signature: string | null | undefined;
+    /** Current HMAC secret. */
+    secret: string;
+    /** Previous secret during rotation grace. */
+    previousSecret?: string | null;
+    /** Max age of the signed timestamp in seconds. Default 300 (5 minutes). */
+    tolerance?: number;
+    /** Inject for tests; defaults to Date.now(). */
+    now?: () => number;
+}
+declare function verifyWebhook(opts: VerifyWebhookOptions): Promise<AtribuWebhookEvent>;
+
+export { AtribuWebhookEvent, type VerifyWebhookOptions, verifyWebhook };

package/dist/webhooks/index.d.ts

@@ -0,0 +1,35 @@
+import { A as AtribuWebhookEvent } from '../types-Dc6tIN_V.js';
+export { C as ConversationStartedEvent, I as InstagramFbLoginMessageData, a as InstagramFbLoginPostbackData, b as InstagramIgLoginChangeData, c as InstagramMessageDeliveryEvent, d as InstagramMessageReceivedData, e as InstagramMessageReceivedEvent, W as WebhookEventType, f as WebhookProvider, g as WhatsAppMessageDeliveryEvent, h as WhatsAppMessageReceivedEvent } from '../types-Dc6tIN_V.js';
+export { g as AtribuWebhookError, W as WebhookErrorCode } from '../errors-D3ApBz8J.js';
+
+/**
+ * Verify Atribu webhook signatures using Web Crypto.
+ *
+ * Why Web Crypto: works in Node 18+, Bun, Deno, Vercel Edge, Cloudflare
+ * Workers. No `node:crypto` import keeps this subpath edge-safe.
+ *
+ * Header format (Stripe-style): `t=<unix_seconds>,v1=<hex_hmac_sha256>`
+ * Signed string: `<t>.<rawBody>`
+ *
+ * Rotation: pass `previousSecret` during the grace window after rotating.
+ * Atribu always signs with the current secret; the previous slot exists
+ * only so subscribers can dual-verify during their own deploy.
+ */
+
+interface VerifyWebhookOptions {
+    /** Raw, unparsed request body (string or Uint8Array). */
+    rawBody: string | Uint8Array;
+    /** Value of the `X-Atribu-Signature` header. */
+    signature: string | null | undefined;
+    /** Current HMAC secret. */
+    secret: string;
+    /** Previous secret during rotation grace. */
+    previousSecret?: string | null;
+    /** Max age of the signed timestamp in seconds. Default 300 (5 minutes). */
+    tolerance?: number;
+    /** Inject for tests; defaults to Date.now(). */
+    now?: () => number;
+}
+declare function verifyWebhook(opts: VerifyWebhookOptions): Promise<AtribuWebhookEvent>;
+
+export { AtribuWebhookEvent, type VerifyWebhookOptions, verifyWebhook };

package/dist/webhooks/index.js

@@ -0,0 +1,94 @@
+// src/errors.ts
+var AtribuError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = new.target.name;
+  }
+};
+var AtribuWebhookError = class extends AtribuError {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+};
+
+// src/webhooks/verify.ts
+async function verifyWebhook(opts) {
+  if (!opts.signature) {
+    throw new AtribuWebhookError("missing_signature", "Missing X-Atribu-Signature header");
+  }
+  const parsed = parseHeader(opts.signature);
+  const bodyString = typeof opts.rawBody === "string" ? opts.rawBody : decodeUtf8(opts.rawBody);
+  const nowMs = (opts.now ?? Date.now)();
+  const tolerance = opts.tolerance ?? 300;
+  const ageSeconds = Math.abs(nowMs / 1e3 - parsed.t);
+  if (ageSeconds > tolerance) {
+    throw new AtribuWebhookError(
+      "expired_timestamp",
+      `Signed timestamp is ${Math.round(ageSeconds)}s old (tolerance ${tolerance}s)`
+    );
+  }
+  const signingInput = `${parsed.t}.${bodyString}`;
+  const matchesCurrent = await safeCompareHmac(opts.secret, signingInput, parsed.v1);
+  if (!matchesCurrent) {
+    const previous = opts.previousSecret;
+    if (!previous || !await safeCompareHmac(previous, signingInput, parsed.v1)) {
+      throw new AtribuWebhookError("invalid_signature", "Signature does not match");
+    }
+  }
+  return JSON.parse(bodyString);
+}
+function parseHeader(header) {
+  let t = null;
+  let v1 = null;
+  for (const part of header.split(",")) {
+    const eq = part.indexOf("=");
+    if (eq < 0) continue;
+    const key = part.slice(0, eq).trim();
+    const value = part.slice(eq + 1).trim();
+    if (key === "t") t = Number(value);
+    else if (key === "v1") v1 = value;
+  }
+  if (t === null || !Number.isFinite(t) || !v1) {
+    throw new AtribuWebhookError("malformed_header", `Malformed signature header: ${header}`);
+  }
+  return { t, v1 };
+}
+async function safeCompareHmac(secret, input, expectedHex) {
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const sig = await crypto.subtle.sign("HMAC", key, encoder.encode(input));
+  const computed = bufferToHex(sig);
+  return constantTimeEqualHex(computed, expectedHex);
+}
+function bufferToHex(buf) {
+  const bytes = new Uint8Array(buf);
+  let hex = "";
+  for (let i = 0; i < bytes.length; i++) {
+    const b = bytes[i];
+    hex += (b < 16 ? "0" : "") + b.toString(16);
+  }
+  return hex;
+}
+function constantTimeEqualHex(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) {
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return diff === 0;
+}
+function decodeUtf8(buf) {
+  return new TextDecoder("utf-8").decode(buf);
+}
+
+export { AtribuWebhookError, verifyWebhook };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/webhooks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/errors.ts","../../src/webhooks/verify.ts"],"names":[],"mappings":";AAiCO,IAAM,WAAA,GAAN,cAA0B,KAAA,CAAM;AAAA,EACrC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AAAA,EACzB;AACF,CAAA;AAmFO,IAAM,kBAAA,GAAN,cAAiC,WAAA,CAAY;AAAA,EACzC,IAAA;AAAA,EACT,WAAA,CAAY,MAAwB,OAAA,EAAiB;AACnD,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;;;AC1FA,eAAsB,cAAc,IAAA,EAAyD;AAC3F,EAAA,IAAI,CAAC,KAAK,SAAA,EAAW;AACnB,IAAA,MAAM,IAAI,kBAAA,CAAmB,mBAAA,EAAqB,mCAAmC,CAAA;AAAA,EACvF;AAEA,EAAA,MAAM,MAAA,GAAS,WAAA,CAAY,IAAA,CAAK,SAAS,CAAA;AACzC,EAAA,MAAM,UAAA,GAAa,OAAO,IAAA,CAAK,OAAA,KAAY,WAAW,IAAA,CAAK,OAAA,GAAU,UAAA,CAAW,IAAA,CAAK,OAAO,CAAA;AAE5F,EAAA,MAAM,KAAA,GAAA,CAAS,IAAA,CAAK,GAAA,IAAO,IAAA,CAAK,GAAA,GAAK;AACrC,EAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,GAAA;AACpC,EAAA,MAAM,aAAa,IAAA,CAAK,GAAA,CAAI,KAAA,GAAQ,GAAA,GAAO,OAAO,CAAC,CAAA;AACnD,EAAA,IAAI,aAAa,SAAA,EAAW;AAC1B,IAAA,MAAM,IAAI,kBAAA;AAAA,MACR,mBAAA;AAAA,MACA,uBAAuB,IAAA,CAAK,KAAA,CAAM,UAAU,CAAC,oBAAoB,SAAS,CAAA,EAAA;AAAA,KAC5E;AAAA,EACF;AAEA,EAAA,MAAM,YAAA,GAAe,CAAA,EAAG,MAAA,CAAO,CAAC,IAAI,UAAU,CAAA,CAAA;AAC9C,EAAA,MAAM,iBAAiB,MAAM,eAAA,CAAgB,KAAK,MAAA,EAAQ,YAAA,EAAc,OAAO,EAAE,CAAA;AACjF,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,MAAM,WAAW,IAAA,CAAK,cAAA;AACtB,IAAA,IAAI,CAAC,YAAY,CAAE,MAAM,gBAAgB,QAAA,EAAU,YAAA,EAAc,MAAA,CAAO,EAAE,CAAA,EAAI;AAC5E,MAAA,MAAM,IAAI,kBAAA,CAAmB,mBAAA,EAAqB,0BAA0B,CAAA;AAAA,IAC9E;AAAA,EACF;AAEA,EAAA,OAAO,IAAA,CAAK,MAAM,UAAU,CAAA;AAC9B;AAEA,SAAS,YAAY,MAAA,EAA8B;AACjD,EAAA,IAAI,CAAA,GAAmB,IAAA;AACvB,EAAA,IAAI,EAAA,GAAoB,IAAA;AACxB,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAAG;AACpC,IAAA,MAAM,EAAA,GAAK,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC3B,IAAA,IAAI,KAAK,CAAA,EAAG;AACZ,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,EAAE,EAAE,IAAA,EAAK;AACnC,IAAA,MAAM,QAAQ,IAAA,CAAK,KAAA,CAAM,EAAA,GAAK,CAAC,EAAE,IAAA,EAAK;AACtC,IAAA,IAAI,GAAA,KAAQ,GAAA,EAAK,CAAA,GAAI,MAAA,CAAO,KAAK,CAAA;AAAA,SAAA,IACxB,GAAA,KAAQ,MAAM,EAAA,GAAK,KAAA;AAAA,EAC9B;AACA,EAAA,IAAI,CAAA,KAAM,QAAQ,CAAC,MAAA,CAAO,SAAS,CAAC,CAAA,IAAK,CAAC,EAAA,EAAI;AAC5C,IAAA,MAAM,IAAI,kBAAA,CAAmB,kBAAA,EAAoB,CAAA,4BAAA,EAA+B,MAAM,CAAA,CAAE,CAAA;AAAA,EAC1F;AACA,EAAA,OAAO,EAAE,GAAG,EAAA,EAAG;AACjB;AAEA,eAAe,eAAA,CAAgB,MAAA,EAAgB,KAAA,EAAe,WAAA,EAAuC;AACnG,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,IAC9B,KAAA;AAAA,IACA,OAAA,CAAQ,OAAO,MAAM,CAAA;AAAA,IACrB,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IAChC,KAAA;AAAA,IACA,CAAC,MAAM;AAAA,GACT;AACA,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,QAAQ,GAAA,EAAK,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAC,CAAA;AACvE,EAAA,MAAM,QAAA,GAAW,YAAY,GAAG,CAAA;AAChC,EAAA,OAAO,oBAAA,CAAqB,UAAU,WAAW,CAAA;AACnD;AAEA,SAAS,YAAY,GAAA,EAA0B;AAC7C,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,GAAG,CAAA;AAChC,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAM,CAAA,GAAI,MAAM,CAAC,CAAA;AACjB,IAAA,GAAA,IAAA,CAAQ,IAAI,EAAA,GAAK,GAAA,GAAM,EAAA,IAAM,CAAA,CAAE,SAAS,EAAE,CAAA;AAAA,EAC5C;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,oBAAA,CAAqB,GAAW,CAAA,EAAoB;AAC3D,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ,OAAO,KAAA;AAClC,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,IAAA,IAAQ,EAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAAA,EAC1C;AACA,EAAA,OAAO,IAAA,KAAS,CAAA;AAClB;AAEA,SAAS,WAAW,GAAA,EAAyB;AAC3C,EAAA,OAAO,IAAI,WAAA,CAAY,OAAO,CAAA,CAAE,OAAO,GAAG,CAAA;AAC5C","file":"index.js","sourcesContent":["/**\n * Atribu error class hierarchy.\n *\n * Why typed errors: consumers need to branch on auth-failure vs rate-limit vs\n * server-error vs validation-error to decide whether to retry, refresh\n * credentials, or surface to the user. A single `Error` with a status code\n * forces every consumer to write the same `if (err.status === 401)` ladder.\n *\n * Why no automatic retries: the SDK derives a `retry` hint from status +\n * Retry-After + error code, but consumers' queue/job systems decide whether\n * to act on it. Auto-retry inside the SDK hides backpressure signals and\n * makes error budgets opaque.\n */\n\nimport type { RetryHint } from \"./retry\";\n\nexport type ApiErrorCode =\n  | \"unauthorized\"\n  | \"forbidden\"\n  | \"insufficient_scope\"\n  | \"not_found\"\n  | \"invalid_parameter\"\n  | \"invalid_request\"\n  | \"validation_error\"\n  | \"invalid_content\"\n  | \"invalid_date_range\"\n  | \"rate_limit_exceeded\"\n  | \"connection_not_ready\"\n  | \"provider_error\"\n  | \"service_unavailable\"\n  | \"internal_error\"\n  | string;\n\nexport class AtribuError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = new.target.name;\n  }\n}\n\nexport class AtribuConfigError extends AtribuError {}\n\nexport class AtribuTransportError extends AtribuError {\n  readonly cause: unknown;\n  constructor(message: string, cause: unknown) {\n    super(message);\n    this.cause = cause;\n  }\n}\n\nexport interface ApiErrorBody {\n  code: ApiErrorCode;\n  message: string;\n  status: number;\n  request_id?: string;\n}\n\nexport class AtribuApiError extends AtribuError {\n  readonly code: ApiErrorCode;\n  readonly status: number;\n  readonly requestId: string | null;\n  readonly retry: RetryHint;\n  readonly responseBody: unknown;\n\n  constructor(args: {\n    code: ApiErrorCode;\n    message: string;\n    status: number;\n    requestId: string | null;\n    retry: RetryHint;\n    responseBody: unknown;\n  }) {\n    super(`[${args.code}] ${args.message}`);\n    this.code = args.code;\n    this.status = args.status;\n    this.requestId = args.requestId;\n    this.retry = args.retry;\n    this.responseBody = args.responseBody;\n  }\n\n  isRetryable(): boolean {\n    return this.retry.action === \"retry\" || this.retry.action === \"retry_after\";\n  }\n  isAuthFailure(): boolean {\n    return this.status === 401 || this.code === \"unauthorized\";\n  }\n  isRateLimit(): boolean {\n    return this.status === 429 || this.code === \"rate_limit_exceeded\";\n  }\n}\n\nexport type OauthErrorCode =\n  | \"invalid_request\"\n  | \"invalid_client\"\n  | \"invalid_grant\"\n  | \"unauthorized_client\"\n  | \"unsupported_grant_type\"\n  | \"invalid_scope\"\n  | \"server_error\"\n  | \"unsupported_token_type\"\n  | string;\n\nexport class AtribuOauthError extends AtribuError {\n  readonly code: OauthErrorCode;\n  readonly status: number;\n  readonly description: string | null;\n\n  constructor(args: { code: OauthErrorCode; description: string | null; status: number }) {\n    super(`[oauth/${args.code}] ${args.description ?? args.code}`);\n    this.code = args.code;\n    this.status = args.status;\n    this.description = args.description;\n  }\n}\n\nexport type WebhookErrorCode =\n  | \"missing_signature\"\n  | \"malformed_header\"\n  | \"expired_timestamp\"\n  | \"invalid_signature\";\n\nexport class AtribuWebhookError extends AtribuError {\n  readonly code: WebhookErrorCode;\n  constructor(code: WebhookErrorCode, message: string) {\n    super(message);\n    this.code = code;\n  }\n}\n","/**\n * Verify Atribu webhook signatures using Web Crypto.\n *\n * Why Web Crypto: works in Node 18+, Bun, Deno, Vercel Edge, Cloudflare\n * Workers. No `node:crypto` import keeps this subpath edge-safe.\n *\n * Header format (Stripe-style): `t=<unix_seconds>,v1=<hex_hmac_sha256>`\n * Signed string: `<t>.<rawBody>`\n *\n * Rotation: pass `previousSecret` during the grace window after rotating.\n * Atribu always signs with the current secret; the previous slot exists\n * only so subscribers can dual-verify during their own deploy.\n */\n\nimport { AtribuWebhookError } from \"../errors\";\nimport type { AtribuWebhookEvent } from \"./types\";\n\nexport interface VerifyWebhookOptions {\n  /** Raw, unparsed request body (string or Uint8Array). */\n  rawBody: string | Uint8Array;\n  /** Value of the `X-Atribu-Signature` header. */\n  signature: string | null | undefined;\n  /** Current HMAC secret. */\n  secret: string;\n  /** Previous secret during rotation grace. */\n  previousSecret?: string | null;\n  /** Max age of the signed timestamp in seconds. Default 300 (5 minutes). */\n  tolerance?: number;\n  /** Inject for tests; defaults to Date.now(). */\n  now?: () => number;\n}\n\ninterface ParsedHeader {\n  t: number;\n  v1: string;\n}\n\nexport async function verifyWebhook(opts: VerifyWebhookOptions): Promise<AtribuWebhookEvent> {\n  if (!opts.signature) {\n    throw new AtribuWebhookError(\"missing_signature\", \"Missing X-Atribu-Signature header\");\n  }\n\n  const parsed = parseHeader(opts.signature);\n  const bodyString = typeof opts.rawBody === \"string\" ? opts.rawBody : decodeUtf8(opts.rawBody);\n\n  const nowMs = (opts.now ?? Date.now)();\n  const tolerance = opts.tolerance ?? 300;\n  const ageSeconds = Math.abs(nowMs / 1000 - parsed.t);\n  if (ageSeconds > tolerance) {\n    throw new AtribuWebhookError(\n      \"expired_timestamp\",\n      `Signed timestamp is ${Math.round(ageSeconds)}s old (tolerance ${tolerance}s)`,\n    );\n  }\n\n  const signingInput = `${parsed.t}.${bodyString}`;\n  const matchesCurrent = await safeCompareHmac(opts.secret, signingInput, parsed.v1);\n  if (!matchesCurrent) {\n    const previous = opts.previousSecret;\n    if (!previous || !(await safeCompareHmac(previous, signingInput, parsed.v1))) {\n      throw new AtribuWebhookError(\"invalid_signature\", \"Signature does not match\");\n    }\n  }\n\n  return JSON.parse(bodyString) as AtribuWebhookEvent;\n}\n\nfunction parseHeader(header: string): ParsedHeader {\n  let t: number | null = null;\n  let v1: string | null = null;\n  for (const part of header.split(\",\")) {\n    const eq = part.indexOf(\"=\");\n    if (eq < 0) continue;\n    const key = part.slice(0, eq).trim();\n    const value = part.slice(eq + 1).trim();\n    if (key === \"t\") t = Number(value);\n    else if (key === \"v1\") v1 = value;\n  }\n  if (t === null || !Number.isFinite(t) || !v1) {\n    throw new AtribuWebhookError(\"malformed_header\", `Malformed signature header: ${header}`);\n  }\n  return { t, v1 };\n}\n\nasync function safeCompareHmac(secret: string, input: string, expectedHex: string): Promise<boolean> {\n  const encoder = new TextEncoder();\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    encoder.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  const sig = await crypto.subtle.sign(\"HMAC\", key, encoder.encode(input));\n  const computed = bufferToHex(sig);\n  return constantTimeEqualHex(computed, expectedHex);\n}\n\nfunction bufferToHex(buf: ArrayBuffer): string {\n  const bytes = new Uint8Array(buf);\n  let hex = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    const b = bytes[i]!;\n    hex += (b < 16 ? \"0\" : \"\") + b.toString(16);\n  }\n  return hex;\n}\n\nfunction constantTimeEqualHex(a: string, b: string): boolean {\n  if (a.length !== b.length) return false;\n  let diff = 0;\n  for (let i = 0; i < a.length; i++) {\n    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return diff === 0;\n}\n\nfunction decodeUtf8(buf: Uint8Array): string {\n  return new TextDecoder(\"utf-8\").decode(buf);\n}\n"]}

package/package.json

@@ -0,0 +1,101 @@
+{
+  "name": "@atribu/node",
+  "version": "0.1.0",
+  "description": "Official Node.js SDK for the Atribu API — authorize users, send WhatsApp & Instagram messages, and verify signed webhook deliveries.",
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "engines": {
+    "node": ">=18"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    },
+    "./webhooks": {
+      "types": "./dist/webhooks/index.d.ts",
+      "import": "./dist/webhooks/index.js",
+      "require": "./dist/webhooks/index.cjs"
+    },
+    "./oauth": {
+      "types": "./dist/oauth/index.d.ts",
+      "import": "./dist/oauth/index.js",
+      "require": "./dist/oauth/index.cjs"
+    },
+    "./admin": {
+      "types": "./dist/admin/index.d.ts",
+      "import": "./dist/admin/index.js",
+      "require": "./dist/admin/index.cjs"
+    },
+    "./next": {
+      "types": "./dist/next/index.d.ts",
+      "import": "./dist/next/index.js",
+      "require": "./dist/next/index.cjs"
+    },
+    "./test": {
+      "types": "./dist/test/index.d.ts",
+      "import": "./dist/test/index.js",
+      "require": "./dist/test/index.cjs"
+    },
+    "./package.json": "./package.json"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "gen": "openapi-typescript ../../openapi.json -o src/__generated__/api.d.ts",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "peerDependencies": {
+    "jose": "^5.0.0 || ^6.0.0",
+    "msw": "^2.0.0"
+  },
+  "peerDependenciesMeta": {
+    "jose": {
+      "optional": true
+    },
+    "msw": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "msw": "^2.14.6",
+    "openapi-typescript": "^7.0.0",
+    "tsup": "^8.5.1",
+    "typescript": "^5.4.0",
+    "vitest": "^2.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/atribu/atribu-node.git"
+  },
+  "homepage": "https://atribu.app",
+  "bugs": {
+    "url": "https://github.com/atribu/atribu-node/issues"
+  },
+  "keywords": [
+    "atribu",
+    "oauth",
+    "webhooks",
+    "whatsapp",
+    "instagram",
+    "messaging",
+    "sdk"
+  ]
+}