@capxul/sdk 0.2.0-alpha.3 → 0.2.0-alpha.5

package/dist/webhooks.cjs

@@ -1,118 +0,0 @@
-'use strict';
-
-// src/errors.ts
-var CapxulError = class extends Error {
-  code;
-  details;
-  operationId;
-  correlationId;
-  retryable;
-  constructor(init) {
-    super(
-      init.message,
-      init.cause !== void 0 ? { cause: init.cause } : void 0
-    );
-    this.name = "CapxulError";
-    this.code = init.code;
-    this.details = init.details;
-    this.operationId = init.operationId;
-    this.correlationId = init.correlationId;
-    this.retryable = init.retryable;
-  }
-};
-
-// ../config/src/timing.ts
-var WEBHOOK_FRESHNESS_WINDOW_MS = 5 * 60 * 1e3;
-
-// ../config/src/org-roles.ts
-function roleKeyFromLabel(label) {
-  const bytes = new TextEncoder().encode(label);
-  const hex = Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
-  return "0x" + hex.padEnd(64, "0");
-}
-roleKeyFromLabel("OWNER");
-roleKeyFromLabel("FINANCE_MANAGER");
-roleKeyFromLabel("PAYMENTS_OPERATOR");
-
-// src/webhooks.ts
-async function verifyWebhook(request, secret, options) {
-  if (!secret) {
-    throw new CapxulError({
-      code: "INVALID_INPUT",
-      message: "A webhook signing secret is required."
-    });
-  }
-  const timestamp = request.headers.get("x-capxul-timestamp");
-  const signature = request.headers.get("x-capxul-signature");
-  if (!timestamp || !signature) {
-    return { valid: false, reason: "invalid_signature" };
-  }
-  const timestampMs = Number(timestamp);
-  if (!Number.isFinite(timestampMs)) {
-    return { valid: false, reason: "malformed" };
-  }
-  const freshnessWindowMs = options?.freshnessWindowMs ?? WEBHOOK_FRESHNESS_WINDOW_MS;
-  if (Math.abs(Date.now() - timestampMs) > freshnessWindowMs) {
-    return { valid: false, reason: "replay" };
-  }
-  const body = await request.text();
-  const signatureHex = signature.startsWith("sha256=") ? signature.slice("sha256=".length) : signature;
-  if (!/^[a-f0-9]{64}$/i.test(signatureHex)) {
-    return { valid: false, reason: "invalid_signature" };
-  }
-  const validSignature = await verifyHmacSha256(
-    secret,
-    `${timestamp}.${body}`,
-    signatureHex
-  );
-  if (!validSignature) {
-    return { valid: false, reason: "invalid_signature" };
-  }
-  const parsed = parseWebhookEvent(body);
-  if (!parsed) {
-    return { valid: false, reason: "malformed" };
-  }
-  return { valid: true, event: parsed };
-}
-async function verifyHmacSha256(secret, message, signatureHex) {
-  const encoder = new TextEncoder();
-  const key = await crypto.subtle.importKey(
-    "raw",
-    encoder.encode(secret),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["verify"]
-  );
-  return await crypto.subtle.verify(
-    "HMAC",
-    key,
-    hexToArrayBuffer(signatureHex),
-    encoder.encode(message)
-  );
-}
-function hexToArrayBuffer(hex) {
-  const buffer = new ArrayBuffer(hex.length / 2);
-  const bytes = new Uint8Array(buffer);
-  for (let i = 0; i < bytes.length; i++) {
-    bytes[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
-  }
-  return buffer;
-}
-function parseWebhookEvent(body) {
-  try {
-    const parsed = JSON.parse(body);
-    if (!isWebhookEvent(parsed)) return null;
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-function isWebhookEvent(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    return false;
-  }
-  const candidate = value;
-  return typeof candidate.id === "string" && typeof candidate.type === "string" && typeof candidate.createdAt === "string" && (candidate.operationId === void 0 || typeof candidate.operationId === "string") && (candidate.correlationId === void 0 || typeof candidate.correlationId === "string") && !!candidate.data && typeof candidate.data === "object" && !Array.isArray(candidate.data);
-}
-
-exports.verifyWebhook = verifyWebhook;

package/dist/webhooks.d.cts

@@ -1,33 +0,0 @@
-import { a2 as WebhookEvent } from './types-Brucpq0Z.cjs';
-import './next-action-CTGl8wpy.cjs';
-
-/**
- * Webhook verification primitive per CANON.md §4.41 +
- * `.claude/rules/webhook-security.md`.
- *
- * Verifies HMAC-SHA256 over the raw request body using
- * `crypto.subtle.verify` (timing-safe by default), checks freshness
- * against a configurable window, and returns a tagged-union result.
- *
- * Framework adapters (`@capxul/sdk-next`, future `@capxul/sdk-hono`)
- * wrap this primitive with HTTP handler glue. This file is the one
- * canonical crypto entry point.
- */
-type WebhookVerificationResult = {
-    readonly valid: true;
-    readonly event: WebhookEvent;
-} | {
-    readonly valid: false;
-    readonly reason: "invalid_signature" | "replay" | "malformed";
-};
-type WebhookVerificationOptions = {
-    /**
-     * Maximum age of a payload (based on `createdAt`) before it is
-     * rejected as a replay. Defaults to 5 minutes
-     * (`WEBHOOK_FRESHNESS_WINDOW_MS` in `@repo/config`).
-     */
-    readonly freshnessWindowMs?: number;
-};
-declare function verifyWebhook(request: Request, secret: string, options?: WebhookVerificationOptions): Promise<WebhookVerificationResult>;
-
-export { type WebhookVerificationOptions, type WebhookVerificationResult, verifyWebhook };

package/dist/webhooks.d.ts

@@ -1,33 +0,0 @@
-import { a2 as WebhookEvent } from './types-V_D7qjxY.js';
-import './next-action-CTGl8wpy.js';
-
-/**
- * Webhook verification primitive per CANON.md §4.41 +
- * `.claude/rules/webhook-security.md`.
- *
- * Verifies HMAC-SHA256 over the raw request body using
- * `crypto.subtle.verify` (timing-safe by default), checks freshness
- * against a configurable window, and returns a tagged-union result.
- *
- * Framework adapters (`@capxul/sdk-next`, future `@capxul/sdk-hono`)
- * wrap this primitive with HTTP handler glue. This file is the one
- * canonical crypto entry point.
- */
-type WebhookVerificationResult = {
-    readonly valid: true;
-    readonly event: WebhookEvent;
-} | {
-    readonly valid: false;
-    readonly reason: "invalid_signature" | "replay" | "malformed";
-};
-type WebhookVerificationOptions = {
-    /**
-     * Maximum age of a payload (based on `createdAt`) before it is
-     * rejected as a replay. Defaults to 5 minutes
-     * (`WEBHOOK_FRESHNESS_WINDOW_MS` in `@repo/config`).
-     */
-    readonly freshnessWindowMs?: number;
-};
-declare function verifyWebhook(request: Request, secret: string, options?: WebhookVerificationOptions): Promise<WebhookVerificationResult>;
-
-export { type WebhookVerificationOptions, type WebhookVerificationResult, verifyWebhook };

package/dist/webhooks.js

@@ -1,116 +0,0 @@
-// src/errors.ts
-var CapxulError = class extends Error {
-  code;
-  details;
-  operationId;
-  correlationId;
-  retryable;
-  constructor(init) {
-    super(
-      init.message,
-      init.cause !== void 0 ? { cause: init.cause } : void 0
-    );
-    this.name = "CapxulError";
-    this.code = init.code;
-    this.details = init.details;
-    this.operationId = init.operationId;
-    this.correlationId = init.correlationId;
-    this.retryable = init.retryable;
-  }
-};
-
-// ../config/src/timing.ts
-var WEBHOOK_FRESHNESS_WINDOW_MS = 5 * 60 * 1e3;
-
-// ../config/src/org-roles.ts
-function roleKeyFromLabel(label) {
-  const bytes = new TextEncoder().encode(label);
-  const hex = Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
-  return "0x" + hex.padEnd(64, "0");
-}
-roleKeyFromLabel("OWNER");
-roleKeyFromLabel("FINANCE_MANAGER");
-roleKeyFromLabel("PAYMENTS_OPERATOR");
-
-// src/webhooks.ts
-async function verifyWebhook(request, secret, options) {
-  if (!secret) {
-    throw new CapxulError({
-      code: "INVALID_INPUT",
-      message: "A webhook signing secret is required."
-    });
-  }
-  const timestamp = request.headers.get("x-capxul-timestamp");
-  const signature = request.headers.get("x-capxul-signature");
-  if (!timestamp || !signature) {
-    return { valid: false, reason: "invalid_signature" };
-  }
-  const timestampMs = Number(timestamp);
-  if (!Number.isFinite(timestampMs)) {
-    return { valid: false, reason: "malformed" };
-  }
-  const freshnessWindowMs = options?.freshnessWindowMs ?? WEBHOOK_FRESHNESS_WINDOW_MS;
-  if (Math.abs(Date.now() - timestampMs) > freshnessWindowMs) {
-    return { valid: false, reason: "replay" };
-  }
-  const body = await request.text();
-  const signatureHex = signature.startsWith("sha256=") ? signature.slice("sha256=".length) : signature;
-  if (!/^[a-f0-9]{64}$/i.test(signatureHex)) {
-    return { valid: false, reason: "invalid_signature" };
-  }
-  const validSignature = await verifyHmacSha256(
-    secret,
-    `${timestamp}.${body}`,
-    signatureHex
-  );
-  if (!validSignature) {
-    return { valid: false, reason: "invalid_signature" };
-  }
-  const parsed = parseWebhookEvent(body);
-  if (!parsed) {
-    return { valid: false, reason: "malformed" };
-  }
-  return { valid: true, event: parsed };
-}
-async function verifyHmacSha256(secret, message, signatureHex) {
-  const encoder = new TextEncoder();
-  const key = await crypto.subtle.importKey(
-    "raw",
-    encoder.encode(secret),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["verify"]
-  );
-  return await crypto.subtle.verify(
-    "HMAC",
-    key,
-    hexToArrayBuffer(signatureHex),
-    encoder.encode(message)
-  );
-}
-function hexToArrayBuffer(hex) {
-  const buffer = new ArrayBuffer(hex.length / 2);
-  const bytes = new Uint8Array(buffer);
-  for (let i = 0; i < bytes.length; i++) {
-    bytes[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
-  }
-  return buffer;
-}
-function parseWebhookEvent(body) {
-  try {
-    const parsed = JSON.parse(body);
-    if (!isWebhookEvent(parsed)) return null;
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-function isWebhookEvent(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    return false;
-  }
-  const candidate = value;
-  return typeof candidate.id === "string" && typeof candidate.type === "string" && typeof candidate.createdAt === "string" && (candidate.operationId === void 0 || typeof candidate.operationId === "string") && (candidate.correlationId === void 0 || typeof candidate.correlationId === "string") && !!candidate.data && typeof candidate.data === "object" && !Array.isArray(candidate.data);
-}
-
-export { verifyWebhook };