@calmlens/sdk 0.10.1 → 0.12.0

package/cjs/CalmLensUtils-Dg3s4loH.js

@@ -0,0 +1,367 @@
+const require_CalmLensError = require("./CalmLensError-CKwMKV0S.js");
+const MAX_IMAGE_UPLOAD_BYTES = /* @__PURE__ */ (() => 20971520)();
+const MIN_MULTIPART_IMAGE_UPLOAD_BYTES = /* @__PURE__ */ (() => 10485760)();
+const REJECTED_UPLOAD_MIME_TYPE_SET = /* @__PURE__ */ new Set([
+	"application/octet-stream",
+	"multipart/form-data",
+	"multipart/mixed",
+	"multipart/alternative",
+	"multipart/related",
+	"multipart/signed",
+	"multipart/encrypted"
+]);
+const normalizeUploadMimeType = (mimeType) => mimeType.toLowerCase().split(";")[0]?.trim() || mimeType.toLowerCase().trim();
+const isRejectedUploadMimeType = (mimeType) => REJECTED_UPLOAD_MIME_TYPE_SET.has(normalizeUploadMimeType(mimeType));
+const getRejectedUploadMimeTypeError = (mimeType) => `${normalizeUploadMimeType(mimeType)} is not a valid upload file type. Uploads must use a concrete file MIME type that CalmLens can store and process, such as image/png, image/jpeg, application/pdf, or text/plain.`;
+const DOMAIN = "calmlens.com";
+//#endregion
+//#region ../shared/src/AssetPayload.ts
+const uint8ArrayInputToNumbers = (value) => {
+	if (Array.isArray(value)) return value;
+	return Array.from(value);
+};
+const bufferInputToBytes = (value) => {
+	if (value instanceof ArrayBuffer) return new Uint8Array(value);
+	return Uint8Array.from(value);
+};
+const BASE64_PART_BOUNDARY_ERROR = "Invalid base64 part. For multipart uploads, split the original bytes first, then base64-encode each part. Do not split one full base64 string into substrings.";
+const MULTIPART_PART_TOO_SMALL_ERROR = `Multipart upload parts must be at least 5MiB except the final part.`;
+const getRawBase64 = (value) => {
+	const markerIndex = value.indexOf(";base64,");
+	if (markerIndex === -1) return value;
+	return value.slice(markerIndex + 8);
+};
+const validateBase64PayloadString = (payload, options) => {
+	const raw = getRawBase64(payload.base64).replace(/\s/g, "");
+	if (options?.multipart && raw.length % 4 !== 0) return {
+		ok: false,
+		error: BASE64_PART_BOUNDARY_ERROR
+	};
+	return { ok: true };
+};
+const isReadableStream = (value) => typeof value === "object" && value !== null && "getReader" in value && typeof value.getReader === "function";
+const assetToData = (payload) => {
+	if ("plainText" in payload && payload.plainText !== void 0) return new TextEncoder().encode(payload.plainText);
+	if ("data" in payload && payload.data) return payload.data;
+	if ("buffer" in payload) {
+		if (payload.buffer instanceof ArrayBuffer) return payload.buffer;
+		return bufferInputToBytes(payload.buffer);
+	}
+	if (payload.uint8Array !== void 0) return Uint8Array.from(uint8ArrayInputToNumbers(payload.uint8Array));
+	if (payload.base64 === void 0) throw new Error("Invalid asset payload");
+	const raw = getRawBase64(payload.base64);
+	if (typeof Buffer !== "undefined") return Uint8Array.from(Buffer.from(raw, "base64"));
+	const binary = atob(raw);
+	return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+};
+const assetDataToUint8Array = async (data) => {
+	if (data instanceof Response) return new Uint8Array(await data.arrayBuffer());
+	if (isReadableStream(data)) return new Uint8Array(await new Response(data).arrayBuffer());
+	if (data instanceof Blob) return new Uint8Array(await data.arrayBuffer());
+	if (data instanceof ArrayBuffer) return new Uint8Array(data);
+	return data;
+};
+const getAssetPayloadByteLength = (payload) => {
+	if ("plainText" in payload && payload.plainText !== void 0) return new TextEncoder().encode(payload.plainText).byteLength;
+	if ("data" in payload && payload.data) {
+		if (payload.data instanceof Blob) return payload.data.size;
+		if (payload.data instanceof Response) {
+			const contentLength = payload.data.headers.get("content-length");
+			return contentLength ? Number(contentLength) : void 0;
+		}
+		return;
+	}
+	if ("buffer" in payload && payload.buffer) return payload.buffer.byteLength;
+	if (payload.uint8Array !== void 0) {
+		if (Array.isArray(payload.uint8Array)) return payload.uint8Array.length;
+		return payload.uint8Array.byteLength;
+	}
+	if (payload.base64 === void 0) return;
+	const raw = getRawBase64(payload.base64).replace(/\s/g, "");
+	const padding = raw.endsWith("==") ? 2 : raw.endsWith("=") ? 1 : 0;
+	return Math.max(0, Math.floor(raw.length * 3 / 4) - padding);
+};
+const validateAssetPayload = (payload, options) => {
+	if ("base64" in payload && payload.base64 !== void 0) {
+		const validation = validateBase64PayloadString(payload, options);
+		if (!validation.ok) return {
+			ok: false,
+			error: validation.error
+		};
+	}
+	const byteLength = getAssetPayloadByteLength(payload);
+	if (options?.multipart && !options.isFinal && byteLength !== void 0 && byteLength < 5242880) return {
+		ok: false,
+		error: MULTIPART_PART_TOO_SMALL_ERROR
+	};
+	return { ok: true };
+};
+//#endregion
+//#region src/client/CalmLensUtils.ts
+const assertHttpUrl = (name, value) => {
+	if (value === void 0) return;
+	let url;
+	try {
+		url = new URL(value);
+	} catch {}
+	if (!url || url.protocol !== "https:" && url.protocol !== "http:") throw require_CalmLensError.invalidConfig(`${name} must be an absolute http(s) URL`);
+};
+const assertInteger = (name, value, minimum) => {
+	if (value !== void 0 && (!Number.isSafeInteger(value) || value < minimum)) throw require_CalmLensError.invalidConfig(minimum === 0 ? `${name} must be a non-negative integer` : `${name} must be a positive integer`);
+};
+const configPathSegment = (value, name) => {
+	try {
+		encodePathSegment(value, name);
+	} catch (error) {
+		throw require_CalmLensError.invalidConfig(error.message.replace(/^\[calmlens\] /, ""));
+	}
+};
+/** Checks the options both clients share: where requests go and how they're sent. */
+const validateConnectionOptions = (options) => {
+	if ("requestBackend" in options) throw require_CalmLensError.invalidConfig("requestBackend is no longer supported; pass a fetch implementation as fetch");
+	validateRequestOptions(options);
+	assertInteger("maxResponseBytes", options.maxResponseBytes, 1);
+	for (const name of ["fetch", "uploadFetch"]) if (options[name] !== void 0 && typeof options[name] !== "function") throw require_CalmLensError.invalidConfig(`${name} must be a function`);
+	assertHttpUrl("baseUrl", options.baseUrl);
+};
+/**
+* Checks server client options before the client sets anything up. `CalmLensServerClient` and
+* `MockCalmLensServerClient` share it so both reject the same configuration.
+*/
+const validateServerClientOptions = (options) => {
+	if (!options || typeof options !== "object") throw require_CalmLensError.invalidConfig("Client options are required");
+	if (!options.apiKey || typeof options.apiKey !== "string") throw require_CalmLensError.invalidConfig("API key is required");
+	if (!options.projectId) throw require_CalmLensError.invalidConfig("Project ID is required");
+	configPathSegment(options.projectId, "Project ID");
+	validateConnectionOptions(options);
+	if (options.cdnFetch !== void 0 && typeof options.cdnFetch !== "function") throw require_CalmLensError.invalidConfig("cdnFetch must be a function");
+	assertHttpUrl("cdnBaseUrl", options.cdnBaseUrl);
+};
+/** Checks app client options before the client sets anything up. */
+const validateAppClientOptions = (options) => {
+	if (!options || typeof options !== "object") throw require_CalmLensError.invalidConfig("Client options are required");
+	if ("apiKey" in options && options.apiKey !== void 0) throw require_CalmLensError.invalidConfig("CalmLensAppClient never takes an API key, which anyone using the browser or app could read. Upload through uploadPresetId, and keep the API key in CalmLensServerClient on your server.");
+	if (!options.uploadPresetId) throw require_CalmLensError.invalidConfig("Upload preset ID is required");
+	configPathSegment(options.uploadPresetId, "Upload preset ID");
+	if (options.token !== void 0 && typeof options.token !== "string" && typeof options.token !== "function") throw require_CalmLensError.invalidConfig("token must be a string or a function that returns one");
+	validateConnectionOptions(options);
+};
+/** Checks the options `withRequestOptions` accepts. */
+const validateRequestOptions = (options) => {
+	assertInteger("timeoutMs", options.timeoutMs, 1);
+	assertInteger("uploadTimeoutMs", options.uploadTimeoutMs, 1);
+	assertInteger("maxRetries", options.maxRetries, 0);
+};
+const toTextAssetOptions = ({ text, name, ...options }) => {
+	if (typeof text !== "string" || !text.trim()) throw new require_CalmLensError.CalmLensError(require_CalmLensError.API_ERROR_CODES.INVALID_UPLOAD_PAYLOAD, { message: "Text to moderate must be a non-empty string" });
+	return {
+		...options,
+		name: name ?? "text",
+		content: {
+			plainText: text,
+			type: "text/plain"
+		}
+	};
+};
+/**
+* A random UUID v4. React Native has no `crypto` global, so this falls back to
+* `crypto.getRandomValues` and then to `Math.random`; the SDK only uses it for idempotency keys,
+* which need to be unique rather than secret.
+*/
+const randomUuid = () => {
+	const crypto = globalThis.crypto;
+	if (typeof crypto?.randomUUID === "function") return crypto.randomUUID();
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
+	if (typeof crypto?.getRandomValues === "function") crypto.getRandomValues(bytes);
+	else for (let index = 0; index < bytes.length; index++) bytes[index] = Math.random() * 256;
+	bytes[6] = bytes[6] & 15 | 64;
+	bytes[8] = bytes[8] & 63 | 128;
+	const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+};
+/**
+* Encodes an identifier as one URL path segment. `.` and `..` are rejected because URL
+* resolution would treat them as relative segments and send the request to another route.
+*/
+const encodePathSegment = (value, name) => {
+	if (typeof value !== "string" || !value) throw require_CalmLensError.invalidArgument(`${name} is required`);
+	if (value === "." || value === "..") throw require_CalmLensError.invalidArgument(`${name} cannot be "." or ".."`);
+	return encodeURIComponent(value);
+};
+const TRANSFORM_TYPE_PATTERN = /^[A-Za-z0-9_]+$/;
+/** Percent-encodes everything except RFC 3986 unreserved characters (`A-Z a-z 0-9 - . _ ~`). */
+const encodeTransformComponent = (value) => encodeURIComponent(value).replace(/[!'()*]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`);
+const isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const appendTransformOptions = (pairs, key, value) => {
+	if (value === void 0 || value === null) return;
+	if (isPlainObject(value)) {
+		for (const child of Object.keys(value).sort()) appendTransformOptions(pairs, `${key}[${child}]`, value[child]);
+		return;
+	}
+	let text;
+	if (typeof value === "string") text = value;
+	else if (typeof value === "boolean") text = String(value);
+	else if (typeof value === "number" && Number.isFinite(value)) text = String(value);
+	else throw require_CalmLensError.invalidArgument(`Transform option "${key}" must be a string, number, boolean or object`);
+	pairs.push(`${encodeTransformComponent(key)}=${encodeTransformComponent(text)}`);
+};
+/**
+* Serializes structured transforms as a CDN selector, such as
+* `imageTransform[format=png,width=1024]`. Option keys are sorted so equal transforms share a
+* URL; nested keys (`border[color]`) and values are percent-encoded.
+*/
+const serializeTransform = (transform) => {
+	const steps = Array.isArray(transform) ? transform : [transform];
+	if (steps.length === 0) throw require_CalmLensError.invalidArgument("Transform needs at least one step");
+	return steps.map((step) => {
+		if (!isPlainObject(step)) throw require_CalmLensError.invalidArgument("Transform steps must be objects");
+		if (typeof step.type !== "string" || !TRANSFORM_TYPE_PATTERN.test(step.type)) throw require_CalmLensError.invalidArgument("Transform type must contain only letters, digits and underscores");
+		if (step.options !== void 0 && step.options !== null && !isPlainObject(step.options)) throw require_CalmLensError.invalidArgument("Transform options must be an object");
+		const pairs = [];
+		for (const key of Object.keys(step.options ?? {}).sort()) appendTransformOptions(pairs, key, step.options[key]);
+		return `${step.type}[${pairs.join(",")}]`;
+	}).join(",");
+};
+/** Returns the selector string the API and CDN accept for a string or structured transform. */
+const transformSelector = (transform) => transform === void 0 || typeof transform === "string" ? transform : serializeTransform(transform);
+/** Appends a CDN lens (`/@name`) or direct transform selector to an asset URL. */
+const appendCdnSelector = (url, options) => {
+	if (options.lens && options.transform) throw require_CalmLensError.invalidArgument("Specify either a lens or a transform, not both");
+	if (options.lens) return `${url}/@${encodePathSegment(options.lens, "Lens")}`;
+	if (!options.transform) return url;
+	if (typeof options.transform !== "string") return `${url}/${serializeTransform(options.transform)}`;
+	const transform = options.transform.replace(/^\/+/, "");
+	if (transform.includes("..") || transform.includes("?") || transform.includes("#")) throw require_CalmLensError.invalidArgument("Transform cannot contain \"..\", \"?\" or \"#\"");
+	return `${url}/${encodeURI(transform).replace(/%5B/g, "[").replace(/%5D/g, "]")}`;
+};
+const appendQueryValue = (parts, key, value) => {
+	if (value === void 0 || value === null) return;
+	if (Array.isArray(value)) {
+		for (const [index, item] of value.entries()) appendQueryValue(parts, `${key}[${index}]`, item);
+		return;
+	}
+	if (typeof value === "object") {
+		for (const [field, item] of Object.entries(value)) appendQueryValue(parts, `${key}[${field}]`, item);
+		return;
+	}
+	parts.push(`${encodeURIComponent(key)}=${encodeURIComponent(String(value))}`);
+};
+/**
+* Serialises a query object the way the API parses it (qs bracket notation), for example
+* `ordering[0][field]=createdAt&ordering[0][direction]=DESC`. Every key and value is
+* percent-encoded and missing values are omitted.
+*/
+const stringifyQuery = (query) => {
+	const parts = [];
+	for (const [key, value] of Object.entries(query)) appendQueryValue(parts, key, value);
+	return parts.join("&");
+};
+//#endregion
+Object.defineProperty(exports, "DOMAIN", {
+	enumerable: true,
+	get: function() {
+		return DOMAIN;
+	}
+});
+Object.defineProperty(exports, "MAX_IMAGE_UPLOAD_BYTES", {
+	enumerable: true,
+	get: function() {
+		return MAX_IMAGE_UPLOAD_BYTES;
+	}
+});
+Object.defineProperty(exports, "MIN_MULTIPART_IMAGE_UPLOAD_BYTES", {
+	enumerable: true,
+	get: function() {
+		return MIN_MULTIPART_IMAGE_UPLOAD_BYTES;
+	}
+});
+Object.defineProperty(exports, "appendCdnSelector", {
+	enumerable: true,
+	get: function() {
+		return appendCdnSelector;
+	}
+});
+Object.defineProperty(exports, "assetDataToUint8Array", {
+	enumerable: true,
+	get: function() {
+		return assetDataToUint8Array;
+	}
+});
+Object.defineProperty(exports, "assetToData", {
+	enumerable: true,
+	get: function() {
+		return assetToData;
+	}
+});
+Object.defineProperty(exports, "encodePathSegment", {
+	enumerable: true,
+	get: function() {
+		return encodePathSegment;
+	}
+});
+Object.defineProperty(exports, "getAssetPayloadByteLength", {
+	enumerable: true,
+	get: function() {
+		return getAssetPayloadByteLength;
+	}
+});
+Object.defineProperty(exports, "getRejectedUploadMimeTypeError", {
+	enumerable: true,
+	get: function() {
+		return getRejectedUploadMimeTypeError;
+	}
+});
+Object.defineProperty(exports, "isRejectedUploadMimeType", {
+	enumerable: true,
+	get: function() {
+		return isRejectedUploadMimeType;
+	}
+});
+Object.defineProperty(exports, "randomUuid", {
+	enumerable: true,
+	get: function() {
+		return randomUuid;
+	}
+});
+Object.defineProperty(exports, "stringifyQuery", {
+	enumerable: true,
+	get: function() {
+		return stringifyQuery;
+	}
+});
+Object.defineProperty(exports, "toTextAssetOptions", {
+	enumerable: true,
+	get: function() {
+		return toTextAssetOptions;
+	}
+});
+Object.defineProperty(exports, "transformSelector", {
+	enumerable: true,
+	get: function() {
+		return transformSelector;
+	}
+});
+Object.defineProperty(exports, "validateAppClientOptions", {
+	enumerable: true,
+	get: function() {
+		return validateAppClientOptions;
+	}
+});
+Object.defineProperty(exports, "validateAssetPayload", {
+	enumerable: true,
+	get: function() {
+		return validateAssetPayload;
+	}
+});
+Object.defineProperty(exports, "validateRequestOptions", {
+	enumerable: true,
+	get: function() {
+		return validateRequestOptions;
+	}
+});
+Object.defineProperty(exports, "validateServerClientOptions", {
+	enumerable: true,
+	get: function() {
+		return validateServerClientOptions;
+	}
+});

package/cjs/CalmLensWebhooks-BTPxKvcD.js

@@ -0,0 +1,201 @@
+const require_CalmLensError = require("./CalmLensError-CKwMKV0S.js");
+const require_CalmLensUtils = require("./CalmLensUtils-Dg3s4loH.js");
+//#region ../shared/src/JsonUtils.ts
+const stringifyJsonCanonical = (value) => JSON.stringify(value, (_key, nestedValue) => {
+	if (!nestedValue || typeof nestedValue !== "object" || Array.isArray(nestedValue)) return nestedValue;
+	return Object.fromEntries(Object.keys(nestedValue).sort().map((key) => [key, nestedValue[key]]));
+});
+//#endregion
+//#region ../shared/src/CryptoUtils.ts
+const encoder = new TextEncoder();
+/** Lowercase hex of `bytes`, two characters per byte. */
+const bytesToHex = (bytes) => Array.from(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes), (byte) => byte.toString(16).padStart(2, "0")).join("");
+/** SHA-256 of the UTF-8 encoding of `value`, as lowercase hex. */
+const sha256Hex = async (value) => bytesToHex(await crypto.subtle.digest("SHA-256", encoder.encode(value)));
+/** HMAC-SHA256 of `message` keyed with `secret` (both UTF-8 encoded), as lowercase hex. */
+const hmacSha256Hex = async (secret, message) => {
+	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	return bytesToHex(await crypto.subtle.sign("HMAC", key, encoder.encode(message)));
+};
+/**
+* Compares two strings without leaking, through timing, where they first differ. Strings of
+* different lengths are unequal immediately (the length itself is not secret here).
+*/
+const timingSafeEqual = (a, b) => {
+	if (a.length !== b.length) return false;
+	let difference = 0;
+	for (let index = 0; index < a.length; index++) difference |= a.charCodeAt(index) ^ b.charCodeAt(index);
+	return difference === 0;
+};
+//#endregion
+//#region ../shared/src/UploadToken.ts
+const UPLOAD_TOKEN_PREFIX = "clut_";
+const UPLOAD_TOKEN_MAX_TTL_SECONDS = 3600;
+const SIGNING_CONTEXT = "calmlens-upload-token:v1:";
+const toBase64Url = (value) => btoa(String.fromCharCode(...new TextEncoder().encode(value))).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+/**
+* The part of an API key a token names so the backend can find the key's hash. The same rule as
+* the stored `keyPrefix`: the fixed `clsk_<region>_` part plus four random characters.
+*/
+const uploadTokenKeyPrefix = (apiKey) => apiKey.substring(0, apiKey.startsWith("clsk_") ? 13 : 8);
+/** The signing secret: the SHA-256 of the API key, which the backend stores instead of the key. */
+const signingSecret = (apiKey) => sha256Hex(apiKey);
+/** Signs `claims` with `apiKey` and returns the token. */
+const signUploadToken = async (claims, apiKey) => {
+	const body = toBase64Url(JSON.stringify(claims));
+	const signature = await hmacSha256Hex(await signingSecret(apiKey), SIGNING_CONTEXT + body);
+	return `${UPLOAD_TOKEN_PREFIX}${body}.${signature}`;
+};
+//#endregion
+//#region src/client/CalmLensUploadTokens.ts
+/**
+* Signs a single-use upload token with `apiKey`, locally. `CalmLensServerClient` and
+* `MockCalmLensServerClient` share it so both check options the same way.
+*/
+const signUploadTokenWithApiKey = async (apiKey, options, { now = Date.now(), nonce = crypto.randomUUID() } = {}) => {
+	if (!options || typeof options !== "object") throw require_CalmLensError.invalidArgument("Options are required");
+	const { uploadPresetId, externalId, expiresInSeconds = 600 } = options;
+	require_CalmLensUtils.encodePathSegment(uploadPresetId, "Upload preset ID");
+	if (!Number.isInteger(expiresInSeconds) || expiresInSeconds < 1 || expiresInSeconds > 3600) throw require_CalmLensError.invalidArgument(`expiresInSeconds must be a whole number from 1 to ${UPLOAD_TOKEN_MAX_TTL_SECONDS}`);
+	if (externalId !== void 0 && (typeof externalId !== "string" || !externalId)) throw require_CalmLensError.invalidArgument("externalId must be a non-empty string");
+	const expiresAt = now + expiresInSeconds * 1e3;
+	return {
+		token: await signUploadToken({
+			v: 1,
+			u: uploadPresetId,
+			k: uploadTokenKeyPrefix(apiKey),
+			e: expiresAt,
+			n: nonce,
+			...externalId === void 0 ? {} : { x: externalId }
+		}, apiKey),
+		expiresAt
+	};
+};
+//#endregion
+//#region src/client/CalmLensWebhooks.ts
+const WEBHOOK_DELIVERY_HEADER = "x-calmlens-delivery";
+const WEBHOOK_TIMESTAMP_HEADER = "x-calmlens-timestamp";
+const WEBHOOK_SIGNATURE_HEADER = "x-calmlens-signature";
+/** Deliveries whose timestamp is further than this from the receiver's clock are rejected. */
+const WEBHOOK_SIGNATURE_TOLERANCE_SECONDS = 300;
+const readHeader = (headers, name) => {
+	if (!headers) return void 0;
+	if (typeof headers.get === "function") return headers.get(name) ?? void 0;
+	const record = headers;
+	const key = Object.keys(record).find((candidate) => candidate.toLowerCase() === name);
+	const value = key === void 0 ? void 0 : record[key];
+	return Array.isArray(value) ? value.join(",") : value ?? void 0;
+};
+/** The raw body as text. Parsed objects are refused: re-serializing JSON changes the signed bytes. */
+const payloadToText = (payload) => {
+	if (typeof payload === "string") return payload;
+	if (payload instanceof ArrayBuffer || ArrayBuffer.isView(payload)) {
+		const view = ArrayBuffer.isView(payload) ? new Uint8Array(payload.buffer, payload.byteOffset, payload.byteLength) : new Uint8Array(payload);
+		return new TextDecoder("utf-8", { fatal: false }).decode(view);
+	}
+	throw require_CalmLensError.invalidArgument("Webhook payload must be the raw request body as a string, Uint8Array/Buffer or ArrayBuffer, not parsed JSON");
+};
+/**
+* Verifies a webhook delivery: `x-calmlens-signature` must contain a `v1=` HMAC-SHA256 of
+* `"<x-calmlens-timestamp>.<raw body>"`, and the timestamp must be within `toleranceSeconds`
+* (default 300) of now. Returns `false` for anything missing, malformed or stale, and throws
+* `sdk/invalid-argument` when `payload` is not a raw body (for example, parsed JSON).
+*/
+async function verifyWebhookSignature(options) {
+	const { payload, secret, toleranceSeconds = 300, now, headers } = options;
+	const body = payloadToText(payload);
+	const signature = options.signature ?? readHeader(headers, "x-calmlens-signature");
+	const timestamp = options.timestamp ?? readHeader(headers, "x-calmlens-timestamp");
+	if (!secret || !signature || timestamp === null || timestamp === void 0) return false;
+	const timestampText = String(timestamp).trim();
+	if (!/^\d+$/.test(timestampText)) return false;
+	const nowMs = now === void 0 ? Date.now() : now instanceof Date ? now.getTime() : now;
+	if (Math.abs(Math.floor(nowMs / 1e3) - Number(timestampText)) > toleranceSeconds) return false;
+	const candidates = signature.split(",").map((part) => part.trim()).filter((part) => part.startsWith("v1=")).map((part) => part.slice(3).toLowerCase());
+	if (candidates.length === 0) return false;
+	const expected = await hmacSha256Hex(secret, `${timestampText}.${body}`);
+	let matched = false;
+	for (const candidate of candidates) if (timingSafeEqual(expected, candidate)) matched = true;
+	return matched;
+}
+/**
+* Verifies a webhook delivery and parses its body. Throws `sdk/invalid-webhook-signature`
+* when the signature or timestamp does not verify, and `sdk/invalid-webhook-payload` when a
+* verified body is not a webhook event. Narrow the result on `type` for typed `data.facts`.
+*
+* Event types and fact keys added to CalmLens after this SDK version are returned as they are,
+* so keep a default branch when you switch on `type`.
+*/
+async function parseWebhookEvent(options) {
+	if (!await verifyWebhookSignature(options)) throw new require_CalmLensError.CalmLensError(require_CalmLensError.SDK_ERROR_CODES.INVALID_WEBHOOK_SIGNATURE, { message: "Webhook signature or timestamp did not verify" });
+	let event;
+	try {
+		event = JSON.parse(payloadToText(options.payload));
+	} catch (cause) {
+		throw new require_CalmLensError.CalmLensError(require_CalmLensError.SDK_ERROR_CODES.INVALID_WEBHOOK_PAYLOAD, {
+			message: "Webhook body is not JSON",
+			cause
+		});
+	}
+	const candidate = event;
+	if (!candidate || typeof candidate !== "object" || typeof candidate.id !== "string" || typeof candidate.type !== "string" || typeof candidate.projectId !== "string" || !candidate.data || typeof candidate.data !== "object") throw new require_CalmLensError.CalmLensError(require_CalmLensError.SDK_ERROR_CODES.INVALID_WEBHOOK_PAYLOAD, { message: "Webhook body is not a CalmLens event" });
+	return event;
+}
+//#endregion
+Object.defineProperty(exports, "WEBHOOK_DELIVERY_HEADER", {
+	enumerable: true,
+	get: function() {
+		return WEBHOOK_DELIVERY_HEADER;
+	}
+});
+Object.defineProperty(exports, "WEBHOOK_SIGNATURE_HEADER", {
+	enumerable: true,
+	get: function() {
+		return WEBHOOK_SIGNATURE_HEADER;
+	}
+});
+Object.defineProperty(exports, "WEBHOOK_SIGNATURE_TOLERANCE_SECONDS", {
+	enumerable: true,
+	get: function() {
+		return WEBHOOK_SIGNATURE_TOLERANCE_SECONDS;
+	}
+});
+Object.defineProperty(exports, "WEBHOOK_TIMESTAMP_HEADER", {
+	enumerable: true,
+	get: function() {
+		return WEBHOOK_TIMESTAMP_HEADER;
+	}
+});
+Object.defineProperty(exports, "hmacSha256Hex", {
+	enumerable: true,
+	get: function() {
+		return hmacSha256Hex;
+	}
+});
+Object.defineProperty(exports, "parseWebhookEvent", {
+	enumerable: true,
+	get: function() {
+		return parseWebhookEvent;
+	}
+});
+Object.defineProperty(exports, "signUploadTokenWithApiKey", {
+	enumerable: true,
+	get: function() {
+		return signUploadTokenWithApiKey;
+	}
+});
+Object.defineProperty(exports, "stringifyJsonCanonical", {
+	enumerable: true,
+	get: function() {
+		return stringifyJsonCanonical;
+	}
+});
+Object.defineProperty(exports, "verifyWebhookSignature", {
+	enumerable: true,
+	get: function() {
+		return verifyWebhookSignature;
+	}
+});