@boxline/sdk 1.1.0

package/dist/types.js

@@ -0,0 +1,5 @@
+/**
+ * The API's objects, as in docs/openapi.yaml (and docs/CONTRACT.md). Dates are ISO 8601 strings.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/version.d.ts

@@ -0,0 +1,2 @@
+/** The SDK's version, sent to the API as `Boxline-SDK: node/<version>`. Keep it equal to package.json. */
+export declare const VERSION = "1.1.0";

package/dist/version.js

@@ -0,0 +1,3 @@
+/** The SDK's version, sent to the API as `Boxline-SDK: node/<version>`. Keep it equal to package.json. */
+export const VERSION = "1.1.0";
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC"}

package/dist/webhooks.d.ts

@@ -0,0 +1,27 @@
+import type { WebhookEvent } from "./types.js";
+export declare const WEBHOOK_SIGNATURE_HEADER = "Boxline-Signature";
+/** How far a delivery's timestamp may be from the receiver's clock (seconds). */
+export declare const WEBHOOK_TOLERANCE_SECONDS = 300;
+export interface VerifyWebhookOptions {
+    /** How far the signature's timestamp may be from now, in seconds (default 300). */
+    toleranceSeconds?: number;
+    /** "Now" in milliseconds (default Date.now()), for tests. */
+    now?: number;
+}
+/**
+ * Checks a webhook delivery and returns its event (the parsed body); throws WebhookSignatureError otherwise.
+ *
+ * - `body`: the raw request body exactly as received (a Buffer, Uint8Array or string): re-serialised JSON will not
+ *   match.
+ * - `header`: the `Boxline-Signature` header.
+ * - `secret`: the endpoint's `whsec_…` secret, or several (e.g. `[newSecret, oldSecret]` while you switch after a
+ *   rotation): the delivery is accepted when any of them signed it.
+ *
+ * A delivery can arrive more than once: after verifying, drop an event `id` you have handled already.
+ */
+export declare function verifyWebhook<T = Record<string, unknown>>(body: string | Uint8Array | ArrayBuffer, header: string | null | undefined, secret: string | string[], opts?: VerifyWebhookOptions): WebhookEvent<T>;
+/**
+ * A `Boxline-Signature` value for `body`, as the API signs deliveries: for testing your own receiver. With several
+ * secrets it has one v1 per secret, the first one first (as during a rotation).
+ */
+export declare function webhookSignatureHeader(secret: string | string[], body: string | Uint8Array | ArrayBuffer, timestamp?: number): string;

package/dist/webhooks.js

@@ -0,0 +1,184 @@
+/**
+ * Verifying webhook deliveries (docs/CONTRACT.md "Webhooks", "Signatures"). Every delivery carries
+ *
+ *   Boxline-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<raw body>">[,v1=…]
+ *
+ * keyed with the endpoint's secret (the whole `whsec_…` string as UTF-8); for 24 hours after a rotation a second v1
+ * signed with the old secret follows. verifyWebhook accepts and refuses exactly what the API's reference
+ * (apps/api/src/webhooks/signing.ts) does; tests/unit/sdk-webhooks.test.ts checks it against vectors from that signer.
+ *
+ * HMAC-SHA256 is computed here without node:crypto or Web Crypto, so the check is synchronous and works the same in
+ * Node 18+, Deno, Bun, edge runtimes and browsers.
+ */
+import { WebhookSignatureError } from "./errors.js";
+export const WEBHOOK_SIGNATURE_HEADER = "Boxline-Signature";
+/** How far a delivery's timestamp may be from the receiver's clock (seconds). */
+export const WEBHOOK_TOLERANCE_SECONDS = 300;
+// ---------------------------------------------------------------- HMAC-SHA256 (FIPS 180-4, RFC 2104)
+const K = new Uint32Array([
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+    0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+    0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+    0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+const rotr = (x, n) => (x >>> n) | (x << (32 - n));
+function sha256(data) {
+    const H = new Uint32Array([0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19]);
+    const blocks = Math.ceil((data.length + 9) / 64);
+    const padded = new Uint8Array(blocks * 64);
+    padded.set(data);
+    padded[data.length] = 0x80;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 8, Math.floor(data.length / 0x20000000)); // bit length, high word
+    view.setUint32(padded.length - 4, (data.length * 8) >>> 0); // bit length, low word
+    const W = new Uint32Array(64);
+    for (let off = 0; off < padded.length; off += 64) {
+        for (let i = 0; i < 16; i++)
+            W[i] = view.getUint32(off + i * 4);
+        for (let i = 16; i < 64; i++) {
+            const s0 = rotr(W[i - 15], 7) ^ rotr(W[i - 15], 18) ^ (W[i - 15] >>> 3);
+            const s1 = rotr(W[i - 2], 17) ^ rotr(W[i - 2], 19) ^ (W[i - 2] >>> 10);
+            W[i] = (W[i - 16] + s0 + W[i - 7] + s1) >>> 0;
+        }
+        let [a, b, c, d, e, f, g, h] = H;
+        for (let i = 0; i < 64; i++) {
+            const t1 = (h + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + ((e & f) ^ (~e & g)) + K[i] + W[i]) >>> 0;
+            const t2 = ((rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + ((a & b) ^ (a & c) ^ (b & c))) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = (d + t1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (t1 + t2) >>> 0;
+        }
+        H[0] = (H[0] + a) >>> 0;
+        H[1] = (H[1] + b) >>> 0;
+        H[2] = (H[2] + c) >>> 0;
+        H[3] = (H[3] + d) >>> 0;
+        H[4] = (H[4] + e) >>> 0;
+        H[5] = (H[5] + f) >>> 0;
+        H[6] = (H[6] + g) >>> 0;
+        H[7] = (H[7] + h) >>> 0;
+    }
+    const out = new Uint8Array(32);
+    const outView = new DataView(out.buffer);
+    for (let i = 0; i < 8; i++)
+        outView.setUint32(i * 4, H[i]);
+    return out;
+}
+function concat(...parts) {
+    const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+    let at = 0;
+    for (const p of parts) {
+        out.set(p, at);
+        at += p.length;
+    }
+    return out;
+}
+function hmacSha256(key, message) {
+    const block = new Uint8Array(64);
+    block.set(key.length > 64 ? sha256(key) : key);
+    const inner = block.map((b) => b ^ 0x36);
+    const outer = block.map((b) => b ^ 0x5c);
+    return sha256(concat(outer, sha256(concat(inner, message))));
+}
+const utf8 = (s) => new TextEncoder().encode(s);
+const toHex = (bytes) => Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+/** Raw body bytes: a string is taken as UTF-8, like the API's signer does. */
+function bodyBytes(body) {
+    if (typeof body === "string")
+        return utf8(body);
+    return body instanceof Uint8Array ? body : new Uint8Array(body);
+}
+/** hex HMAC-SHA256 of `${timestamp}.${body}`, keyed with the secret string. */
+function signature(secret, timestamp, body) {
+    return toHex(hmacSha256(utf8(secret), concat(utf8(`${timestamp}.`), body)));
+}
+/** Compares two strings of equal length without stopping at the first difference. */
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+// ---------------------------------------------------------------- the header
+/** Reads `t=…,v1=…[,v1=…]` exactly as the API does; other keys are ignored. null when there is no usable t or v1. */
+function parseHeader(header) {
+    if (typeof header !== "string" || header.length > 4096)
+        return null;
+    let timestamp = null;
+    const v1 = [];
+    for (const part of header.split(",")) {
+        const i = part.indexOf("=");
+        if (i <= 0)
+            continue;
+        const key = part.slice(0, i).trim();
+        const value = part.slice(i + 1).trim();
+        if (key === "t" && /^\d{1,12}$/.test(value))
+            timestamp = Number(value);
+        else if (key === "v1" && /^[0-9a-f]{64}$/.test(value))
+            v1.push(value);
+    }
+    return timestamp !== null && v1.length ? { timestamp, v1 } : null;
+}
+function failure(reason, tolerance, several) {
+    const message = reason === "malformed"
+        ? `the ${WEBHOOK_SIGNATURE_HEADER} header is missing or malformed`
+        : reason === "timestamp_out_of_range"
+            ? `the ${WEBHOOK_SIGNATURE_HEADER} timestamp is more than ${tolerance % 60 === 0 ? `${tolerance / 60} minutes` : `${tolerance} seconds`} from now`
+            : `no signature matches ${several ? "these secrets" : "this secret"} (check the secret, and that the body is the raw bytes as received)`;
+    return new WebhookSignatureError(reason, message);
+}
+/**
+ * Checks a webhook delivery and returns its event (the parsed body); throws WebhookSignatureError otherwise.
+ *
+ * - `body`: the raw request body exactly as received (a Buffer, Uint8Array or string): re-serialised JSON will not
+ *   match.
+ * - `header`: the `Boxline-Signature` header.
+ * - `secret`: the endpoint's `whsec_…` secret, or several (e.g. `[newSecret, oldSecret]` while you switch after a
+ *   rotation): the delivery is accepted when any of them signed it.
+ *
+ * A delivery can arrive more than once: after verifying, drop an event `id` you have handled already.
+ */
+export function verifyWebhook(body, header, secret, opts = {}) {
+    const secrets = Array.isArray(secret) ? secret : [secret];
+    const tolerance = opts.toleranceSeconds ?? WEBHOOK_TOLERANCE_SECONDS;
+    const parsed = parseHeader(header);
+    if (!parsed)
+        throw failure("malformed", tolerance, secrets.length > 1);
+    const now = Math.floor((opts.now ?? Date.now()) / 1000);
+    if (Math.abs(now - parsed.timestamp) > tolerance)
+        throw failure("timestamp_out_of_range", tolerance, secrets.length > 1);
+    const bytes = bodyBytes(body);
+    let match = false;
+    for (const s of secrets) {
+        const want = signature(s, parsed.timestamp, bytes);
+        // Every signature is compared, so the time taken does not say which one (or how much of it) matched.
+        for (const got of parsed.v1)
+            if (constantTimeEqual(got, want))
+                match = true;
+    }
+    if (!match)
+        throw failure("no_matching_signature", tolerance, secrets.length > 1);
+    // Kept byte for byte like the API's reference: a leading byte-order mark stays (and JSON.parse refuses it).
+    const text = typeof body === "string" ? body : new TextDecoder("utf-8", { ignoreBOM: true }).decode(bytes);
+    return JSON.parse(text);
+}
+/**
+ * A `Boxline-Signature` value for `body`, as the API signs deliveries: for testing your own receiver. With several
+ * secrets it has one v1 per secret, the first one first (as during a rotation).
+ */
+export function webhookSignatureHeader(secret, body, timestamp = Math.floor(Date.now() / 1000)) {
+    const secrets = Array.isArray(secret) ? secret : [secret];
+    if (!secrets.length)
+        throw new Error("no signing secret");
+    const bytes = bodyBytes(body);
+    return [`t=${timestamp}`, ...secrets.map((s) => `v1=${signature(s, timestamp, bytes)}`)].join(",");
+}
+//# sourceMappingURL=webhooks.js.map

package/dist/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,qBAAqB,EAAgC,MAAM,aAAa,CAAC;AAGlF,MAAM,CAAC,MAAM,wBAAwB,GAAG,mBAAmB,CAAC;AAC5D,iFAAiF;AACjF,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAE7C,sGAAsG;AAEtG,MAAM,CAAC,GAAG,IAAI,WAAW,CAAC;IACxB,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IAC9I,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IAC9I,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IAC9I,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IAC9I,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IAC9I,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;CAC/C,CAAC,CAAC;AAEH,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAEnE,SAAS,MAAM,CAAC,IAAgB;IAC9B,MAAM,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;IAC5H,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,wBAAwB;IACjG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,uBAAuB;IACnF,MAAM,CAAC,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9B,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC;QACjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;YAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAE,KAAK,CAAC,CAAC,CAAC;YAC3E,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAE,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAE,KAAK,EAAE,CAAC,CAAC;YAC1E,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAwB,CAAC;QACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,EAAE,GAAG,CAAC,CAAE,GAAG,CAAC,IAAI,CAAC,CAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAE,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,GAAG,CAAE,CAAC,GAAG,CAAC,CAAC,CAAE,GAAG,CAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC;YAC/G,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAE,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,GAAG,CAAE,CAAC,GAAG,CAAC,CAAE,GAAG,CAAE,CAAC,GAAG,CAAC,CAAE,GAAG,CAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACrG,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,CAAE,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,CAAE,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,CAAE,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,CAAE,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,CAAE,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,CAAE,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,CAAE,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,CAAE,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAAE,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IAC5D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,MAAM,CAAC,GAAG,KAAmB;IACpC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACf,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,GAAe,EAAE,OAAmB;IACtD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACxD,MAAM,KAAK,GAAG,CAAC,KAAiB,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAExG,8EAA8E;AAC9E,SAAS,SAAS,CAAC,IAAuC;IACxD,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,IAAI,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAClE,CAAC;AAED,+EAA+E;AAC/E,SAAS,SAAS,CAAC,MAAc,EAAE,SAAiB,EAAE,IAAgB;IACpE,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,qFAAqF;AACrF,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,8EAA8E;AAE9E,qHAAqH;AACrH,SAAS,WAAW,CAAC,MAAe;IAClC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,MAAM,EAAE,GAAa,EAAE,CAAC;IACxB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,GAAG,KAAK,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;aAClE,IAAI,GAAG,KAAK,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,SAAS,KAAK,IAAI,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AASD,SAAS,OAAO,CAAC,MAA+B,EAAE,SAAiB,EAAE,OAAgB;IACnF,MAAM,OAAO,GACX,MAAM,KAAK,WAAW;QACpB,CAAC,CAAC,OAAO,wBAAwB,iCAAiC;QAClE,CAAC,CAAC,MAAM,KAAK,wBAAwB;YACnC,CAAC,CAAC,OAAO,wBAAwB,2BAA2B,SAAS,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,SAAS,UAAU,WAAW;YAClJ,CAAC,CAAC,wBAAwB,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,qEAAqE,CAAC;IAC/I,OAAO,IAAI,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAuC,EACvC,MAAiC,EACjC,MAAyB,EACzB,OAA6B,EAAE;IAE/B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,IAAI,yBAAyB,CAAC;IACrE,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,MAAM,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,SAAS;QAAE,MAAM,OAAO,CAAC,wBAAwB,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzH,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACnD,qGAAqG;QACrG,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE;YAAE,IAAI,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC;gBAAE,KAAK,GAAG,IAAI,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,MAAM,OAAO,CAAC,uBAAuB,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAClF,4GAA4G;IAC5G,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3G,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAyB,EAAE,IAAuC,EAAE,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAClJ,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,CAAC,KAAK,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrG,CAAC"}

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "@boxline/sdk",
+  "version": "1.1.0",
+  "description": "Node and TypeScript SDK for Boxline: cloud browsers and shell sandboxes for AI agents, with retries, cursor pages and typed errors.",
+  "keywords": [
+    "boxline",
+    "browser",
+    "headless",
+    "chrome",
+    "playwright",
+    "puppeteer",
+    "cdp",
+    "sandbox",
+    "ai-agents",
+    "automation"
+  ],
+  "license": "MIT",
+  "author": "Boxline",
+  "homepage": "https://docs.boxline.dev",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Boxline-dev/sdk-node.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Boxline-dev/sdk-node/issues"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p examples/tsconfig.json",
+    "prepublishOnly": "tsc -p tsconfig.json"
+  },
+  "devDependencies": {
+    "typescript": "~6.0.3",
+    "@types/node": "^22.15.0",
+    "playwright-core": "^1.63.0"
+  }
+}