@chatlychat/sdk-node 0.0.0-stage → 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,9 @@
+# @chatlychat/sdk-node — changelog
+
+## 0.1.0 — 2026-05-25
+
+- Initial public release.
+- `ChatlyClient` with `contacts`, `conversations`, `tickets`, `cdp`, `webhooks`,
+  `audit` modules.
+- `verifyWebhook()` helper with constant-time signature compare and replay-window
+  enforcement.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Chatly Engineering
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,108 @@
-# Temporary Holding Version
+# @chatlychat/sdk-node
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Server-side client for the Chatly API. Authenticates with an API key, so it is
+for your backend — not a browser, where the key would be readable.
+
+```bash
+pnpm add @chatlychat/sdk-node
+```
+
+## Quick start
+
+```ts
+import { ChatlyClient } from '@chatlychat/sdk-node';
+
+const chatly = new ChatlyClient({
+  apiKey: process.env.CHATLY_API_KEY!, // ck_live_…
+  apiUrl: 'https://api.chatlychat.com', // optional
+});
+
+const contacts = await chatly.contacts.list({ limit: 20 });
+```
+
+Create a key under **Workspace → Developer → API keys**. The token is shown
+once and stored only as a hash — if you lose it, revoke and mint another.
+
+Make `whoami()` your first call. It returns the workspace the key belongs to
+and the scopes it actually holds, so a mis-scoped key fails loudly at
+integration time instead of surfacing as a puzzling 403 from an unrelated
+endpoint in production:
+
+```ts
+const { workspaceId, scopes } = await chatly.whoami();
+```
+
+It is the only api-keys route a key may call: minting or listing keys with a
+key would let a leaked read-only key escalate itself.
+
+## What the client can do
+
+Every method below maps to an endpoint that accepts key authentication. Scope
+the key to only what your integration needs; a key can never do more than the
+scopes ticked when it was created.
+
+| Call                                                   | Scope required       |
+| ------------------------------------------------------ | -------------------- |
+| `chatly.whoami()`                                      | `workspace:read`     |
+| `chatly.contacts.list({ cursor?, limit? })`            | `contacts:read`      |
+| `chatly.contacts.upsert({ email, name, … })`           | `contacts:write`     |
+| `chatly.conversations.list({ cursor?, limit? })`       | `conversations:read` |
+| `chatly.conversations.messages(conversationId)`        | `conversations:read` |
+| `chatly.conversations.send({ conversationId, body })`  | `messages:write`     |
+| `chatly.search.query('refund', { … })`                 | `search:read`        |
+| `chatly.search.kb('refund')`                           | `search:read`        |
+| `chatly.events.track({ contactId, name, properties })` | `contacts:write`     |
+
+Messages you send with a key are recorded as sent by an integration, not by
+the person who created the key — a key outlives whoever issued it, so
+attributing its writes to them would be wrong the moment they leave.
+
+## Not included, and why
+
+Reactions and channel/widget configuration are absent on purpose. A reaction
+records _who_ reacted and a key is not a person, so those endpoints require a
+signed-in user. Channel configuration needs a scope no key can hold. Both used
+to be here and both returned 403 to every caller.
+
+## Idempotency
+
+Writes accept an idempotency key so a retry after a network failure does not
+duplicate work:
+
+```ts
+await chatly.withIdempotencyKey('order-4471-refund').contacts.upsert({ … });
+```
+
+## Verifying webhooks
+
+```ts
+import { verifyWebhookSignature } from '@chatlychat/sdk-node';
+
+const ok = verifyWebhookSignature({
+  body: rawBody, // the EXACT bytes, before JSON.parse
+  signatureHeader: req.headers['x-livechat-signature'] as string,
+  secret: process.env.CHATLY_WEBHOOK_SECRET!,
+});
+```
+
+Pass the raw body — re-serialising parsed JSON reorders keys and changes
+whitespace, so the digest will not match.
+
+The scheme is `t=<unix seconds>,v1=<hex>`, where `v1` is HMAC-SHA256 over
+`` `${t}.${body}` ``. The timestamp is inside the signed string, so a captured
+delivery stops verifying once it falls outside `toleranceSeconds`.
+
+> **This example was wrong until 2026-10-12, in three ways** — it said
+> `payload` (the field is `body`), `signature` (it is `signatureHeader`) and
+> `x-chatly-signature` (webhooks use **`x-livechat-signature`**). In
+> TypeScript the old snippet was a compile error; in plain JavaScript it was
+> worse than returning `false`, because the verifier splits
+> `input.signatureHeader` first and an absent one throws a `TypeError` out of
+> your webhook handler.
+>
+> The header name is the trap worth knowing: **`x-chatly-signature` is real,
+> but it belongs to four other surfaces** — external-agent deliveries, custom
+> AI tool calls, customer cards and the workflow `fire_webhook` action — and
+> each of those constructs its base string differently. Outbound event
+> webhooks are the one surface using `x-livechat-signature`. Do not share one
+> verifier across them without checking the construction.

package/dist/index.d.ts

@@ -0,0 +1,225 @@
+export interface ClientOptions {
+    apiKey: string;
+    apiUrl?: string;
+    timeoutMs?: number;
+    fetchFn?: typeof fetch;
+}
+export interface PageQuery {
+    cursor?: string;
+    limit?: number;
+}
+export interface Page<T> {
+    items: ReadonlyArray<T>;
+    nextCursor: string | null;
+}
+/** Query for {@link ChatlyClient.events}.list — a page, optionally one contact's. */
+export interface EventListQuery extends PageQuery {
+    /** Restrict the stream to one contact. Omit for the whole workspace. */
+    contactId?: string;
+}
+export interface ContactInput {
+    externalId?: string;
+    email?: string;
+    phone?: string;
+    name?: string;
+    attributes?: Record<string, unknown>;
+}
+export interface MessageInput {
+    conversationId: string;
+    body: string;
+    kind?: 'text' | 'rich' | 'note' | 'system_event';
+}
+/**
+ * Reaction payload.
+ *
+ * Declared here rather than imported from `@livechat/shared`: this package is
+ * published to consumers who must not have to install monorepo internals, so
+ * it stays dependency-free by design. The shape mirrors
+ * `@livechat/shared/reactions` and is covered by the API's own contract tests.
+ */
+export interface MessageReactions {
+    readonly messageId: string;
+    readonly entries: ReadonlyArray<{
+        emoji: string;
+        count: number;
+        reacted: boolean;
+    }>;
+}
+/**
+ * Widget behaviour config. Structural, for the same reason as above — pass a
+ * plain object; the API validates it against the authoritative zod schema and
+ * rejects anything malformed.
+ */
+export type WidgetFeatureConfig = Record<string, unknown>;
+export declare class ChatlyClient {
+    private readonly base;
+    private readonly baseHeaders;
+    private readonly timeoutMs;
+    private readonly fetchFn;
+    /**
+     * When set, every write made through this client instance uses this
+     * exact `Idempotency-Key` instead of minting a fresh UUID per call.
+     * Created via {@link withIdempotencyKey}; the original client is left
+     * untouched (the method returns a derived view, not a mutation).
+     */
+    private readonly pinnedIdempotencyKey;
+    constructor(opts: ClientOptions);
+    /**
+     * Private clone constructor — used by {@link withIdempotencyKey} so we
+     * can return a derived client without mutating the original (and
+     * without re-running the public ctor's defaulting logic).
+     */
+    private static derive;
+    /**
+     * Pin a specific `Idempotency-Key` for one or more upcoming writes.
+     *
+     * Returns a derived client (the original is unchanged). Use this when
+     * you want to retry the *same* logical operation: the API treats two
+     * writes with the same key + same body as a single accepted operation
+     * and replays the cached response. Two writes with the same key but a
+     * different body return HTTP 409.
+     *
+     *   ```ts
+     *   const key = crypto.randomUUID();
+     *   for (let attempt = 0; attempt < 3; attempt++) {
+     *     try {
+     *       return await chatly.withIdempotencyKey(key).contacts.upsert(body);
+     *     } catch (err) { ...backoff }
+     *   }
+     *   ```
+     */
+    withIdempotencyKey(key: string): ChatlyClient;
+    /**
+     * Describe the credential this client is using: which workspace it belongs
+     * to and which scopes it was granted.
+     *
+     * `GET /v1/api-keys/whoami` is deliberately the ONLY route on the api-keys
+     * controller that accepts an API key (managing keys with a key is a
+     * privilege-escalation shape). It is the call to make first: it turns a
+     * mis-scoped key into an obvious error at integration time rather than a
+     * 403 from an unrelated endpoint later.
+     *
+     * It was reachable over raw HTTP but appeared in no SDK and no doc, so
+     * there was no way for an integrator to discover it.
+     */
+    whoami(): Promise<{
+        workspaceId: string;
+        scopes: readonly string[];
+    }>;
+    contacts: {
+        list: (q?: PageQuery) => Promise<Page<unknown>>;
+        upsert: (body: ContactInput) => Promise<unknown>;
+    };
+    conversations: {
+        list: (q?: PageQuery) => Promise<Page<unknown>>;
+        /**
+         * Read a thread before replying to it.
+         *
+         * The MCP server has exposed this as `get_messages` since it shipped and
+         * the SDK did not, so an integrator writing "read the conversation, then
+         * decide" against the SDK had to hand-roll the request while the same
+         * capability sat behind a tool call.
+         */
+        messages: (conversationId: string, q?: PageQuery) => Promise<Page<unknown>>;
+        send: (body: MessageInput) => Promise<unknown>;
+    };
+    /**
+     * Reactions and channel configuration are deliberately absent.
+     *
+     * Both were here and neither worked: a reaction records *who* reacted, and
+     * a key is not a person, so those routes require a signed-in user and
+     * return 403 to any key. Channel configuration needs `channels:write`,
+     * which no key-accessible route grants. Shipping methods that always fail
+     * is worse than not shipping them — the failure arrives at runtime, in
+     * production, in someone else's integration.
+     */
+    /** Full-text search across contacts, conversations, messages, tickets, KB. */
+    search: {
+        query: (q: string, opts?: Record<string, unknown>) => Promise<unknown>;
+        /**
+         * Help-centre articles only.
+         *
+         * The same `/v1/search` route narrowed to `kinds[]=kb`, which is exactly
+         * what the MCP server's `search_kb` tool does. Worth its own method
+         * because "find the article that answers this" is the common case and
+         * getting there otherwise means knowing the `kinds[]` parameter exists.
+         */
+        kb: (q: string, opts?: Record<string, unknown>) => Promise<unknown>;
+    };
+    events: {
+        track: (input: {
+            contactId: string;
+            name: string;
+            properties?: Record<string, unknown>;
+        }) => Promise<unknown>;
+        /**
+         * Read back what was tracked — the same `/v1/cdp/events` collection
+         * {@link track} writes to, cursor-paginated newest-first.
+         *
+         * The SDK could write events and never read them, so "did my tracking
+         * call actually land?" had no answer outside the dashboard. Pass
+         * `contactId` to scope the stream to one person.
+         */
+        list: (q?: EventListQuery) => Promise<Page<unknown>>;
+    };
+    private get;
+    private post;
+    /** PATCH. Same idempotency contract as `post` — it is a write. */
+    private patch;
+    private dispatch;
+}
+/** Freshness window for `t`, in seconds. Matches what the docs recommend. */
+export declare const WEBHOOK_SIGNATURE_TOLERANCE_SECONDS = 300;
+export interface VerifyWebhookSignatureInput {
+    /**
+     * The EXACT bytes we POSTed. Pass the raw body — re-serialising parsed JSON
+     * reorders keys and changes whitespace, and the digest will not match.
+     */
+    body: string | Uint8Array;
+    /** The `x-livechat-signature` header value: `t=<unix seconds>,v1=<hex>`. */
+    signatureHeader: string;
+    /** The endpoint's `whsec_…` signing secret.  */
+    secret: string;
+    /**
+     * How far `t` may be from now before the delivery is treated as a replay.
+     * Defaults to {@link WEBHOOK_SIGNATURE_TOLERANCE_SECONDS}; pass `Infinity`
+     * only when re-verifying an archived delivery.
+     */
+    toleranceSeconds?: number;
+    /** Escape hatch for tests. Unix seconds. */
+    nowSeconds?: number;
+}
+/**
+ * Verify the signature header on a webhook delivery from the platform.
+ *
+ * `v1` is HMAC-SHA256 over `` `${t}.${body}` `` — the timestamp is bound INTO
+ * the digest, which is what makes the replay window enforceable at all.
+ *
+ * This used to HMAC the body ALONE, so it rejected every genuine delivery the
+ * platform sent: the producer has always signed `${t}.${body}` and our own
+ * published documentation has always described that construction. Anyone
+ * following either the SDK or the docs got a hard "invalid signature" on 100%
+ * of real traffic. The wire format is unchanged — only this verifier was wrong.
+ */
+export declare function verifyWebhookSignature(input: VerifyWebhookSignatureInput): boolean;
+/**
+ * Compute the `userHash` the widget needs for identity verification.
+ *
+ * When a workspace turns identity verification on, the widget must prove the
+ * `externalId` it claims was issued by the customer's backend rather than
+ * typed into a browser console -- otherwise anyone can open a chat as anyone
+ * else's account. This is the backend half of that handshake:
+ *
+ *   const userHash = chatlyIdentityHash(process.env.CHATLY_IDV_SECRET, user.id);
+ *   // then render:
+ *   // Chatly('identify', { externalId: user.id, userHash, email: user.email })
+ *
+ * It lived in the API's own source as a comment-only snippet, where the
+ * people who need it -- customers integrating their backend -- could never
+ * import it.
+ *
+ * The secret is the workspace's identity-verification secret. It must never
+ * reach the browser; only the digest does.
+ */
+export declare function chatlyIdentityHash(secret: string, externalId: string): string;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,IAAI,CAAC,CAAC;IACrB,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,qFAAqF;AACrF,MAAM,WAAW,cAAe,SAAQ,SAAS;IAC/C,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,cAAc,CAAC;CAClD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACrF;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1D,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAU;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAgB;gBAElC,IAAI,EAAE,aAAa;IA0BtC;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,MAAM;IA4CrB;;;;;;;;;;;;;;;;;OAiBG;IACI,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY;IAOpD;;;;;;;;;;;;OAYG;IACU,MAAM,IAAI,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IAI3E,QAAQ;mBACH,SAAS;uBACJ,YAAY;MAC3B;IAEK,aAAa;mBACR,SAAS;QACnB;;;;;;;WAOG;mCACwB,MAAM,MAAK,SAAS;qBAElC,YAAY;MAEzB;IAEF;;;;;;;;;OASG;IAEH,8EAA8E;IACvE,MAAM;mBACA,MAAM,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QAEhD;;;;;;;WAOG;gBACK,MAAM,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;MAE7C;IAEK,MAAM;uBACI;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE;QAExF;;;;;;;WAOG;mBACO,cAAc;MACxB;YAEY,GAAG;YAUH,IAAI;IAclB,kEAAkE;YACpD,KAAK;YASL,QAAQ;CA+BvB;AAED,6EAA6E;AAC7E,eAAO,MAAM,mCAAmC,MAAM,CAAC;AAEvD,MAAM,WAAW,2BAA2B;IAC1C;;;OAGG;IACH,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;IAC1B,4EAA4E;IAC5E,eAAe,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAiClF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAQ7E"}

package/dist/index.js

@@ -0,0 +1,315 @@
+import { createHmac, randomUUID, timingSafeEqual } from 'node:crypto';
+/** Node 14.17+ has `crypto.randomUUID`; the SDK targets Node 20+ so it's safe. */
+function nodeRandomUuid() {
+    return randomUUID();
+}
+export class ChatlyClient {
+    base;
+    baseHeaders;
+    timeoutMs;
+    fetchFn;
+    /**
+     * When set, every write made through this client instance uses this
+     * exact `Idempotency-Key` instead of minting a fresh UUID per call.
+     * Created via {@link withIdempotencyKey}; the original client is left
+     * untouched (the method returns a derived view, not a mutation).
+     */
+    pinnedIdempotencyKey;
+    constructor(opts) {
+        /*
+         * Production, not a dev hostname.
+         *
+         * This was `https://api.livechat.local`, which resolves nowhere — so a
+         * developer who followed the published docs and omitted `apiUrl` got an
+         * SDK whose every call failed, and the docs page carried a warning
+         * telling each reader to override it. Reported by a customer who
+         * integrated from the docs alone, not caught here, because every test in
+         * this package passes an explicit `apiUrl`.
+         *
+         * A self-hosted install still overrides it; that is the only caller that
+         * ever should.
+         */
+        this.base = opts.apiUrl ?? 'https://api.chatlychat.com';
+        this.baseHeaders = new Headers({
+            authorization: `Bearer ${opts.apiKey}`,
+            'content-type': 'application/json',
+            accept: 'application/json',
+            'user-agent': '@chatlychat/sdk-node/0.1.0',
+        });
+        this.timeoutMs = opts.timeoutMs ?? 15_000;
+        this.fetchFn = opts.fetchFn ?? globalThis.fetch;
+        this.pinnedIdempotencyKey = null;
+    }
+    /**
+     * Private clone constructor — used by {@link withIdempotencyKey} so we
+     * can return a derived client without mutating the original (and
+     * without re-running the public ctor's defaulting logic).
+     */
+    static derive(parent, pinnedIdempotencyKey) {
+        const child = Object.create(ChatlyClient.prototype);
+        Object.assign(child, {
+            base: parent.base,
+            baseHeaders: parent.baseHeaders,
+            timeoutMs: parent.timeoutMs,
+            fetchFn: parent.fetchFn,
+            pinnedIdempotencyKey,
+        });
+        // The route bags are field-initialized below the class body via the
+        // arrow-property pattern; re-bind them so they target the derived
+        // instance and call the child's `post`/`get`.
+        child.contacts = {
+            list: (q = {}) => child.get('/v1/contacts', { ...q }),
+            upsert: (body) => child.post('/v1/contacts', body),
+        };
+        child.conversations = {
+            list: (q = {}) => child.get('/v1/conversations', { ...q }),
+            messages: (conversationId, q = {}) => child.get(`/v1/conversations/${conversationId}/messages`, { ...q }),
+            send: (body) => child.post(`/v1/conversations/${body.conversationId}/messages`, body),
+        };
+        child.events = {
+            track: (input) => child.post('/v1/cdp/events', input),
+            list: (q = {}) => child.get('/v1/cdp/events', { ...q }),
+        };
+        // `search` was never rebound here, so a derived client's search methods
+        // still called the PARENT's `get`. Harmless today because both are reads
+        // against the same base URL, and a live bug the moment anything on
+        // `search` becomes a write or the derived client differs by more than a
+        // pinned key. `derivedSurfaceMatches` in the spec fails if any namespace
+        // is forgotten again — TypeScript only caught `messages` because that
+        // namespace was already rebound.
+        child.search = {
+            query: (q, opts = {}) => child.get('/v1/search', { q, ...opts }),
+            kb: (q, opts = {}) => child.get('/v1/search', { q, 'kinds[]': 'kb', ...opts }),
+        };
+        return child;
+    }
+    /**
+     * Pin a specific `Idempotency-Key` for one or more upcoming writes.
+     *
+     * Returns a derived client (the original is unchanged). Use this when
+     * you want to retry the *same* logical operation: the API treats two
+     * writes with the same key + same body as a single accepted operation
+     * and replays the cached response. Two writes with the same key but a
+     * different body return HTTP 409.
+     *
+     *   ```ts
+     *   const key = crypto.randomUUID();
+     *   for (let attempt = 0; attempt < 3; attempt++) {
+     *     try {
+     *       return await chatly.withIdempotencyKey(key).contacts.upsert(body);
+     *     } catch (err) { ...backoff }
+     *   }
+     *   ```
+     */
+    withIdempotencyKey(key) {
+        if (typeof key !== 'string' || key.length === 0) {
+            throw new TypeError('withIdempotencyKey: key must be a non-empty string');
+        }
+        return ChatlyClient.derive(this, key);
+    }
+    /**
+     * Describe the credential this client is using: which workspace it belongs
+     * to and which scopes it was granted.
+     *
+     * `GET /v1/api-keys/whoami` is deliberately the ONLY route on the api-keys
+     * controller that accepts an API key (managing keys with a key is a
+     * privilege-escalation shape). It is the call to make first: it turns a
+     * mis-scoped key into an obvious error at integration time rather than a
+     * 403 from an unrelated endpoint later.
+     *
+     * It was reachable over raw HTTP but appeared in no SDK and no doc, so
+     * there was no way for an integrator to discover it.
+     */
+    async whoami() {
+        return this.get('/v1/api-keys/whoami', {});
+    }
+    contacts = {
+        list: (q = {}) => this.get('/v1/contacts', { ...q }),
+        upsert: (body) => this.post('/v1/contacts', body),
+    };
+    conversations = {
+        list: (q = {}) => this.get('/v1/conversations', { ...q }),
+        /**
+         * Read a thread before replying to it.
+         *
+         * The MCP server has exposed this as `get_messages` since it shipped and
+         * the SDK did not, so an integrator writing "read the conversation, then
+         * decide" against the SDK had to hand-roll the request while the same
+         * capability sat behind a tool call.
+         */
+        messages: (conversationId, q = {}) => this.get(`/v1/conversations/${conversationId}/messages`, { ...q }),
+        send: (body) => this.post(`/v1/conversations/${body.conversationId}/messages`, body),
+    };
+    /**
+     * Reactions and channel configuration are deliberately absent.
+     *
+     * Both were here and neither worked: a reaction records *who* reacted, and
+     * a key is not a person, so those routes require a signed-in user and
+     * return 403 to any key. Channel configuration needs `channels:write`,
+     * which no key-accessible route grants. Shipping methods that always fail
+     * is worse than not shipping them — the failure arrives at runtime, in
+     * production, in someone else's integration.
+     */
+    /** Full-text search across contacts, conversations, messages, tickets, KB. */
+    search = {
+        query: (q, opts = {}) => this.get('/v1/search', { q, ...opts }),
+        /**
+         * Help-centre articles only.
+         *
+         * The same `/v1/search` route narrowed to `kinds[]=kb`, which is exactly
+         * what the MCP server's `search_kb` tool does. Worth its own method
+         * because "find the article that answers this" is the common case and
+         * getting there otherwise means knowing the `kinds[]` parameter exists.
+         */
+        kb: (q, opts = {}) => this.get('/v1/search', { q, 'kinds[]': 'kb', ...opts }),
+    };
+    events = {
+        track: (input) => this.post('/v1/cdp/events', input),
+        /**
+         * Read back what was tracked — the same `/v1/cdp/events` collection
+         * {@link track} writes to, cursor-paginated newest-first.
+         *
+         * The SDK could write events and never read them, so "did my tracking
+         * call actually land?" had no answer outside the dashboard. Pass
+         * `contactId` to scope the stream to one person.
+         */
+        list: (q = {}) => this.get('/v1/cdp/events', { ...q }),
+    };
+    async get(path, q) {
+        const url = new URL(`${this.base}${path}`);
+        for (const [k, v] of Object.entries(q)) {
+            if (v !== undefined) {
+                url.searchParams.set(k, String(v));
+            }
+        }
+        return this.dispatch(url, { method: 'GET' });
+    }
+    async post(path, body) {
+        // Production API requires Idempotency-Key on every write. The
+        // `pinnedIdempotencyKey` path is the supported way to retry the
+        // SAME logical operation (set via `withIdempotencyKey(key)`); when
+        // unset we mint a fresh UUID per call so a fetch-level network
+        // retry inside this SDK still won't double-write upstream.
+        const idempotencyKey = this.pinnedIdempotencyKey ?? nodeRandomUuid();
+        return this.dispatch(new URL(`${this.base}${path}`), {
+            method: 'POST',
+            body: JSON.stringify(body),
+            headers: { 'idempotency-key': idempotencyKey },
+        });
+    }
+    /** PATCH. Same idempotency contract as `post` — it is a write. */
+    async patch(path, body) {
+        const idempotencyKey = this.pinnedIdempotencyKey ?? nodeRandomUuid();
+        return this.dispatch(new URL(`${this.base}${path}`), {
+            method: 'PATCH',
+            body: JSON.stringify(body),
+            headers: { 'idempotency-key': idempotencyKey },
+        });
+    }
+    async dispatch(url, init) {
+        const ctrl = new AbortController();
+        const timer = setTimeout(() => ctrl.abort(), this.timeoutMs);
+        try {
+            // Merge base auth/content headers with any per-call overrides
+            // (e.g. `idempotency-key` from `post`). Previously this dropped
+            // per-call headers because it reassigned `headers` wholesale —
+            // which silently broke the idempotency contract on every write.
+            const headers = new Headers(this.baseHeaders);
+            if (init.headers !== undefined) {
+                new Headers(init.headers).forEach((value, name) => {
+                    headers.set(name, value);
+                });
+            }
+            const res = await this.fetchFn(url.toString(), {
+                ...init,
+                signal: ctrl.signal,
+                headers,
+            });
+            if (!res.ok) {
+                const text = await res.text();
+                throw new Error(`livechat ${res.status}: ${text}`);
+            }
+            if (res.status === 204) {
+                return undefined;
+            }
+            return (await res.json());
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+}
+/** Freshness window for `t`, in seconds. Matches what the docs recommend. */
+export const WEBHOOK_SIGNATURE_TOLERANCE_SECONDS = 300;
+/**
+ * Verify the signature header on a webhook delivery from the platform.
+ *
+ * `v1` is HMAC-SHA256 over `` `${t}.${body}` `` — the timestamp is bound INTO
+ * the digest, which is what makes the replay window enforceable at all.
+ *
+ * This used to HMAC the body ALONE, so it rejected every genuine delivery the
+ * platform sent: the producer has always signed `${t}.${body}` and our own
+ * published documentation has always described that construction. Anyone
+ * following either the SDK or the docs got a hard "invalid signature" on 100%
+ * of real traffic. The wire format is unchanged — only this verifier was wrong.
+ */
+export function verifyWebhookSignature(input) {
+    const parts = new Map();
+    for (const part of input.signatureHeader.split(',')) {
+        const eq = part.indexOf('=');
+        if (eq > 0) {
+            parts.set(part.slice(0, eq).trim(), part.slice(eq + 1).trim());
+        }
+    }
+    const rawTs = parts.get('t');
+    const tag = parts.get('v1');
+    if (rawTs === undefined || tag === undefined) {
+        return false;
+    }
+    const issuedAt = Number.parseInt(rawTs, 10);
+    if (!Number.isFinite(issuedAt)) {
+        return false;
+    }
+    const tolerance = input.toleranceSeconds ?? WEBHOOK_SIGNATURE_TOLERANCE_SECONDS;
+    const now = input.nowSeconds ?? Math.floor(Date.now() / 1000);
+    if (Math.abs(now - issuedAt) > tolerance) {
+        return false;
+    }
+    const hmac = createHmac('sha256', input.secret);
+    hmac.update(`${rawTs}.`);
+    hmac.update(typeof input.body === 'string' ? Buffer.from(input.body, 'utf8') : input.body);
+    const a = Buffer.from(tag, 'hex');
+    const b = Buffer.from(hmac.digest('hex'), 'hex');
+    // Length check first: timingSafeEqual throws on a length mismatch, and a
+    // thrown verifier is an accepted webhook in a handler that forgot try/catch.
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+/**
+ * Compute the `userHash` the widget needs for identity verification.
+ *
+ * When a workspace turns identity verification on, the widget must prove the
+ * `externalId` it claims was issued by the customer's backend rather than
+ * typed into a browser console -- otherwise anyone can open a chat as anyone
+ * else's account. This is the backend half of that handshake:
+ *
+ *   const userHash = chatlyIdentityHash(process.env.CHATLY_IDV_SECRET, user.id);
+ *   // then render:
+ *   // Chatly('identify', { externalId: user.id, userHash, email: user.email })
+ *
+ * It lived in the API's own source as a comment-only snippet, where the
+ * people who need it -- customers integrating their backend -- could never
+ * import it.
+ *
+ * The secret is the workspace's identity-verification secret. It must never
+ * reach the browser; only the digest does.
+ */
+export function chatlyIdentityHash(secret, externalId) {
+    if (secret.length === 0) {
+        throw new Error('chatlyIdentityHash: secret is empty');
+    }
+    if (externalId.length === 0) {
+        throw new Error('chatlyIdentityHash: externalId is empty');
+    }
+    return createHmac('sha256', secret).update(externalId).digest('hex');
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEtE,kFAAkF;AAClF,SAAS,cAAc;IACrB,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC;AA2DD,MAAM,OAAO,YAAY;IACN,IAAI,CAAS;IACb,WAAW,CAAU;IACrB,SAAS,CAAS;IAClB,OAAO,CAAe;IACvC;;;;;OAKG;IACc,oBAAoB,CAAgB;IAErD,YAAmB,IAAmB;QACpC;;;;;;;;;;;;WAYG;QACH,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,4BAA4B,CAAC;QACxD,IAAI,CAAC,WAAW,GAAG,IAAI,OAAO,CAAC;YAC7B,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;YACtC,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;YAC1B,YAAY,EAAE,4BAA4B;SAC3C,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC;QAChD,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,MAAM,CAAC,MAAoB,EAAE,oBAAmC;QAC7E,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAiB,CAAC;QACpE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,oBAAoB;SACrB,CAAC,CAAC;QACH,oEAAoE;QACpE,kEAAkE;QAClE,8CAA8C;QAC7C,KAA8C,CAAC,QAAQ,GAAG;YACzD,IAAI,EAAE,CAAC,IAAe,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAgB,cAAc,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;YAC/E,MAAM,EAAE,CAAC,IAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAU,cAAc,EAAE,IAAI,CAAC;SAC1E,CAAC;QACD,KAAwD,CAAC,aAAa,GAAG;YACxE,IAAI,EAAE,CAAC,IAAe,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAgB,mBAAmB,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;YACpF,QAAQ,EAAE,CAAC,cAAsB,EAAE,IAAe,EAAE,EAAE,EAAE,CACtD,KAAK,CAAC,GAAG,CAAgB,qBAAqB,cAAc,WAAW,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;YACpF,IAAI,EAAE,CAAC,IAAkB,EAAE,EAAE,CAC3B,KAAK,CAAC,IAAI,CAAU,qBAAqB,IAAI,CAAC,cAAc,WAAW,EAAE,IAAI,CAAC;SACjF,CAAC;QACD,KAA0C,CAAC,MAAM,GAAG;YACnD,KAAK,EAAE,CAAC,KAAgF,EAAE,EAAE,CAC1F,KAAK,CAAC,IAAI,CAAU,gBAAgB,EAAE,KAAK,CAAC;YAC9C,IAAI,EAAE,CAAC,IAAoB,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAgB,gBAAgB,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;SACvF,CAAC;QACF,wEAAwE;QACxE,yEAAyE;QACzE,mEAAmE;QACnE,wEAAwE;QACxE,yEAAyE;QACzE,sEAAsE;QACtE,iCAAiC;QAChC,KAA0C,CAAC,MAAM,GAAG;YACnD,KAAK,EAAE,CAAC,CAAS,EAAE,OAAgC,EAAE,EAAE,EAAE,CACvD,KAAK,CAAC,GAAG,CAAU,YAAY,EAAE,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;YAClD,EAAE,EAAE,CAAC,CAAS,EAAE,OAAgC,EAAE,EAAE,EAAE,CACpD,KAAK,CAAC,GAAG,CAAU,YAAY,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;SACpE,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACI,kBAAkB,CAAC,GAAW;QACnC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,MAAM;QACjB,OAAO,IAAI,CAAC,GAAG,CAAqD,qBAAqB,EAAE,EAAE,CAAC,CAAC;IACjG,CAAC;IAEM,QAAQ,GAAG;QAChB,IAAI,EAAE,CAAC,IAAe,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAgB,cAAc,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QAC9E,MAAM,EAAE,CAAC,IAAkB,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAU,cAAc,EAAE,IAAI,CAAC;KACzE,CAAC;IAEK,aAAa,GAAG;QACrB,IAAI,EAAE,CAAC,IAAe,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAgB,mBAAmB,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QACnF;;;;;;;WAOG;QACH,QAAQ,EAAE,CAAC,cAAsB,EAAE,IAAe,EAAE,EAAE,EAAE,CACtD,IAAI,CAAC,GAAG,CAAgB,qBAAqB,cAAc,WAAW,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QACnF,IAAI,EAAE,CAAC,IAAkB,EAAE,EAAE,CAC3B,IAAI,CAAC,IAAI,CAAU,qBAAqB,IAAI,CAAC,cAAc,WAAW,EAAE,IAAI,CAAC;KAChF,CAAC;IAEF;;;;;;;;;OASG;IAEH,8EAA8E;IACvE,MAAM,GAAG;QACd,KAAK,EAAE,CAAC,CAAS,EAAE,OAAgC,EAAE,EAAE,EAAE,CACvD,IAAI,CAAC,GAAG,CAAU,YAAY,EAAE,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;QACjD;;;;;;;WAOG;QACH,EAAE,EAAE,CAAC,CAAS,EAAE,OAAgC,EAAE,EAAE,EAAE,CACpD,IAAI,CAAC,GAAG,CAAU,YAAY,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;KACnE,CAAC;IAEK,MAAM,GAAG;QACd,KAAK,EAAE,CAAC,KAAgF,EAAE,EAAE,CAC1F,IAAI,CAAC,IAAI,CAAU,gBAAgB,EAAE,KAAK,CAAC;QAC7C;;;;;;;WAOG;QACH,IAAI,EAAE,CAAC,IAAoB,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAgB,gBAAgB,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;KACtF,CAAC;IAEM,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,CAA0B;QAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;QAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAI,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAa;QAC/C,8DAA8D;QAC9D,gEAAgE;QAChE,mEAAmE;QACnE,+DAA+D;QAC/D,2DAA2D;QAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,oBAAoB,IAAI,cAAc,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC,QAAQ,CAAI,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,OAAO,EAAE,EAAE,iBAAiB,EAAE,cAAc,EAAE;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,kEAAkE;IAC1D,KAAK,CAAC,KAAK,CAAI,IAAY,EAAE,IAAa;QAChD,MAAM,cAAc,GAAG,IAAI,CAAC,oBAAoB,IAAI,cAAc,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC,QAAQ,CAAI,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC,EAAE;YACtD,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,OAAO,EAAE,EAAE,iBAAiB,EAAE,cAAc,EAAE;SAC/C,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAI,GAAQ,EAAE,IAAiB;QACnD,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,8DAA8D;YAC9D,gEAAgE;YAChE,+DAA+D;YAC/D,gEAAgE;YAChE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC9C,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC/B,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;oBAChD,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC3B,CAAC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAC7C,GAAG,IAAI;gBACP,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO;aACR,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,YAAY,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,OAAO,SAAc,CAAC;YACxB,CAAC;YACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;QACjC,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;CACF;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,mCAAmC,GAAG,GAAG,CAAC;AAsBvD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAkC;IACvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,gBAAgB,IAAI,mCAAmC,CAAC;IAChF,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC9D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,QAAQ,CAAC,GAAG,SAAS,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3F,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACjD,yEAAyE;IACzE,6EAA6E;IAC7E,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,UAAkB;IACnE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC"}

package/dist/index.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.spec.d.ts.map

package/dist/index.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.spec.d.ts","sourceRoot":"","sources":["../src/index.spec.ts"],"names":[],"mappings":""}

package/dist/index.spec.js

@@ -0,0 +1,315 @@
+/**
+ * Behaviour tests for the public SDK surface that the dashboard /
+ * partner integrators depend on. Focused on the bits that are easy to
+ * regress and load-bearing for correctness:
+ *
+ *   - every write sends an `Idempotency-Key` (no header drop on dispatch)
+ *   - `withIdempotencyKey(key)` pins the key across multiple writes
+ *   - `withIdempotencyKey` returns a derived client, not a mutated one
+ *   - webhook signature verification (timing-safe, malformed inputs ok)
+ *
+ * `fetch` is injected via `ClientOptions.fetchFn`, so we don't touch the
+ * network — the spec asserts on the request shape the SDK builds.
+ */
+import { createHmac } from 'node:crypto';
+import { at } from '@livechat/shared/narrow';
+import { describe, expect, it } from 'vitest';
+import { ChatlyClient, verifyWebhookSignature, chatlyIdentityHash, WEBHOOK_SIGNATURE_TOLERANCE_SECONDS, } from './index.js';
+function recordingFetch() {
+    const calls = [];
+    const fn = async (url, init) => {
+        calls.push({ url: String(url), init: init ?? {} });
+        return new Response(JSON.stringify({ ok: true }), {
+            status: 200,
+            headers: { 'content-type': 'application/json' },
+        });
+    };
+    return { calls, fn: fn };
+}
+describe('ChatlyClient — Idempotency-Key on writes', () => {
+    it('attaches a fresh idempotency-key to every POST when no key is pinned', async () => {
+        const rec = recordingFetch();
+        const client = new ChatlyClient({
+            apiKey: 'k',
+            apiUrl: 'https://api.test',
+            fetchFn: rec.fn,
+        });
+        await client.events.track({ contactId: 'c1', name: 'signup' });
+        await client.events.track({ contactId: 'c2', name: 'signup' });
+        expect(rec.calls).toHaveLength(2);
+        const k1 = new Headers(at(rec.calls, 0, 'recorded requests').init.headers).get('idempotency-key');
+        const k2 = new Headers(at(rec.calls, 1, 'recorded requests').init.headers).get('idempotency-key');
+        expect(k1).toBeTruthy();
+        expect(k2).toBeTruthy();
+        expect(k1).not.toEqual(k2);
+    });
+    it('preserves the base auth headers on the dispatch path', async () => {
+        const rec = recordingFetch();
+        const client = new ChatlyClient({
+            apiKey: 'secret-token',
+            apiUrl: 'https://api.test',
+            fetchFn: rec.fn,
+        });
+        await client.contacts.upsert({ email: 'a@b.c' });
+        const h = new Headers(at(rec.calls, 0, 'recorded requests').init.headers);
+        expect(h.get('authorization')).toBe('Bearer secret-token');
+        expect(h.get('content-type')).toBe('application/json');
+        expect(h.get('idempotency-key')).toBeTruthy();
+    });
+});
+describe('ChatlyClient — withIdempotencyKey', () => {
+    it('pins a stable key across multiple writes on the derived client', async () => {
+        const rec = recordingFetch();
+        const client = new ChatlyClient({
+            apiKey: 'k',
+            apiUrl: 'https://api.test',
+            fetchFn: rec.fn,
+        });
+        const pinned = client.withIdempotencyKey('fixed-key-123');
+        await pinned.events.track({ contactId: 'c1', name: 'a' });
+        await pinned.events.track({ contactId: 'c2', name: 'b' });
+        expect(rec.calls).toHaveLength(2);
+        for (const call of rec.calls) {
+            const h = new Headers(call.init.headers);
+            expect(h.get('idempotency-key')).toBe('fixed-key-123');
+        }
+    });
+    it('does not mutate the original client', async () => {
+        const rec = recordingFetch();
+        const client = new ChatlyClient({
+            apiKey: 'k',
+            apiUrl: 'https://api.test',
+            fetchFn: rec.fn,
+        });
+        client.withIdempotencyKey('pinned'); // intentionally unused
+        await client.events.track({ contactId: 'c1', name: 'x' });
+        const h = new Headers(at(rec.calls, 0, 'recorded requests').init.headers);
+        expect(h.get('idempotency-key')).not.toBe('pinned');
+    });
+    it('rejects empty / non-string keys with a TypeError (cheap mistake guard)', () => {
+        const client = new ChatlyClient({ apiKey: 'k' });
+        expect(() => client.withIdempotencyKey('')).toThrow(TypeError);
+        // @ts-expect-error — intentional misuse
+        expect(() => client.withIdempotencyKey(undefined)).toThrow(TypeError);
+    });
+});
+describe('ChatlyClient — withIdempotencyKey keeps the full surface', () => {
+    /**
+     * `derive` rebuilds every route namespace by hand so the closures target
+     * the derived instance. That is easy to forget: `search` was never rebound
+     * at all, and `messages` was caught only by the compiler because its
+     * namespace happened to already be listed.
+     *
+     * This compares the shape of a derived client against its parent, so a new
+     * method on any namespace fails here rather than silently calling the
+     * parent's request methods.
+     */
+    it('exposes exactly the same namespaces and methods as the parent', () => {
+        const rec = recordingFetch();
+        const parent = new ChatlyClient({ apiKey: 'k', apiUrl: 'https://api.test', fetchFn: rec.fn });
+        const child = parent.withIdempotencyKey('order-1');
+        const surface = (c) => {
+            const bags = ['contacts', 'conversations', 'events', 'search'];
+            return bags
+                .flatMap((bag) => Object.keys(c[bag] ?? {}).map((k) => `${bag}.${k}`))
+                .sort();
+        };
+        expect(surface(child)).toEqual(surface(parent));
+    });
+    it('routes a derived namespace through the derived client', async () => {
+        const rec = recordingFetch();
+        const parent = new ChatlyClient({ apiKey: 'k', apiUrl: 'https://api.test', fetchFn: rec.fn });
+        await parent.withIdempotencyKey('order-1').contacts.upsert({ email: 'a@b.c' });
+        const headers = new Headers(rec.calls[0]?.init.headers);
+        expect(headers.get('idempotency-key')).toBe('order-1');
+    });
+});
+describe('ChatlyClient — parity with the MCP tools', () => {
+    /**
+     * The MCP server exposed `get_messages` and `search_kb` while the SDK did
+     * not, so the same capability was reachable from a tool call and not from
+     * the published client. These pin the request shapes against the routes the
+     * MCP tools use.
+     */
+    it('reads a thread by conversation id', async () => {
+        const rec = recordingFetch();
+        const client = new ChatlyClient({ apiKey: 'k', apiUrl: 'https://api.test', fetchFn: rec.fn });
+        await client.conversations.messages('c-1', { limit: 50 });
+        expect(rec.calls[0]?.url).toBe('https://api.test/v1/conversations/c-1/messages?limit=50');
+    });
+    it('narrows KB search with the kinds[] parameter the API expects', async () => {
+        // The bracket in `kinds[]` is the whole point: `kinds=kb` is silently
+        // ignored by the list-filter parser and returns everything.
+        const rec = recordingFetch();
+        const client = new ChatlyClient({ apiKey: 'k', apiUrl: 'https://api.test', fetchFn: rec.fn });
+        await client.search.kb('refund');
+        const url = new URL(rec.calls[0]?.url ?? '');
+        expect(url.pathname).toBe('/v1/search');
+        expect(url.searchParams.get('q')).toBe('refund');
+        expect(url.searchParams.get('kinds[]')).toBe('kb');
+    });
+});
+describe('ChatlyClient — events.list', () => {
+    /**
+     * The SDK could POST an event and never read one back: `/v1/cdp/events`
+     * was referenced only under POST, so the read half of the CDP integration
+     * had no shipped caller at all. These pin the exact request.
+     */
+    it('GETs the same collection track() posts to', async () => {
+        const rec = recordingFetch();
+        const client = new ChatlyClient({ apiKey: 'k', apiUrl: 'https://api.test', fetchFn: rec.fn });
+        await client.events.list();
+        expect(rec.calls).toHaveLength(1);
+        expect(new URL(at(rec.calls, 0, 'recorded requests').url).pathname).toBe('/v1/cdp/events');
+        expect(at(rec.calls, 0, 'recorded requests').init.method).toBe('GET');
+    });
+    it('scopes the stream to one contact and passes the page cursor through', async () => {
+        const rec = recordingFetch();
+        const client = new ChatlyClient({ apiKey: 'k', apiUrl: 'https://api.test', fetchFn: rec.fn });
+        await client.events.list({ contactId: 'ct-1', limit: 25, cursor: 'abc' });
+        const url = new URL(at(rec.calls, 0, 'recorded requests').url);
+        expect(url.pathname).toBe('/v1/cdp/events');
+        expect(url.searchParams.get('contactId')).toBe('ct-1');
+        expect(url.searchParams.get('limit')).toBe('25');
+        expect(url.searchParams.get('cursor')).toBe('abc');
+    });
+    it('is a read, so it sends no idempotency key', async () => {
+        const rec = recordingFetch();
+        const client = new ChatlyClient({ apiKey: 'k', apiUrl: 'https://api.test', fetchFn: rec.fn });
+        await client.events.list();
+        const headers = new Headers(at(rec.calls, 0, 'recorded requests').init.headers);
+        expect(headers.get('idempotency-key')).toBeNull();
+    });
+});
+describe('ChatlyClient — whoami', () => {
+    it('GETs the one api-keys route a key is allowed to call', async () => {
+        const rec = recordingFetch();
+        const client = new ChatlyClient({
+            apiKey: 'k',
+            apiUrl: 'https://api.test',
+            fetchFn: rec.fn,
+        });
+        await client.whoami();
+        expect(rec.calls).toHaveLength(1);
+        expect(rec.calls[0]?.url).toBe('https://api.test/v1/api-keys/whoami');
+        expect(rec.calls[0]?.init.method).toBe('GET');
+    });
+    it('is a read, so it sends no idempotency key', async () => {
+        const rec = recordingFetch();
+        const client = new ChatlyClient({
+            apiKey: 'k',
+            apiUrl: 'https://api.test',
+            fetchFn: rec.fn,
+        });
+        await client.whoami();
+        const headers = new Headers(rec.calls[0]?.init.headers);
+        expect(headers.get('idempotency-key')).toBeNull();
+    });
+});
+describe('verifyWebhookSignature', () => {
+    const secret = 'shh';
+    const body = '{"type":"message.created","payload":{"id":"m1"}}';
+    const t = 1_714_060_800;
+    // The construction the producer uses and the docs describe: HMAC over
+    // `${t}.${body}`, never the body alone. Computed here rather than
+    // hard-coded so the spec doesn't rot, but note that the round-trip
+    // assertion lives in the worker
+    // (`apps/worker/src/__tests__/webhook-sig.spec.ts`) — this file can only
+    // ever prove the verifier agrees with ITSELF.
+    const header = (ts, payload = body, key = secret) => `t=${String(ts)},v1=${createHmac('sha256', key)
+        .update(`${String(ts)}.${payload}`)
+        .digest('hex')}`;
+    it('returns true for a signature over `t.body`', () => {
+        expect(verifyWebhookSignature({ body, signatureHeader: header(t), secret, nowSeconds: t })).toBe(true);
+    });
+    it('accepts the raw body as bytes', () => {
+        expect(verifyWebhookSignature({
+            body: Buffer.from(body, 'utf8'),
+            signatureHeader: header(t),
+            secret,
+            nowSeconds: t,
+        })).toBe(true);
+    });
+    it('rejects a signature over the body alone', () => {
+        // This is what this verifier used to COMPUTE. If it ever passes again,
+        // every genuine delivery is being rejected in the field.
+        const bodyOnly = `t=${String(t)},v1=${createHmac('sha256', secret).update(body).digest('hex')}`;
+        expect(verifyWebhookSignature({ body, signatureHeader: bodyOnly, secret, nowSeconds: t })).toBe(false);
+    });
+    it('returns false for a tampered body', () => {
+        expect(verifyWebhookSignature({
+            body: '{"type":"message.created","payload":{"id":"m2"}}',
+            signatureHeader: header(t),
+            secret,
+            nowSeconds: t,
+        })).toBe(false);
+    });
+    it('returns false for a wrong secret', () => {
+        expect(verifyWebhookSignature({
+            body,
+            signatureHeader: header(t, body, 'evil'),
+            secret,
+            nowSeconds: t,
+        })).toBe(false);
+    });
+    it('returns false when the header is missing the v1= scheme', () => {
+        expect(verifyWebhookSignature({ body, signatureHeader: `t=${String(t)}`, secret, nowSeconds: t })).toBe(false);
+    });
+    it('returns false when the header is missing t=', () => {
+        // Without `t` there is no replay window to enforce, so a header that
+        // omits it is not verifiable — not merely unfresh.
+        const sig = createHmac('sha256', secret)
+            .update(`${String(t)}.${body}`)
+            .digest('hex');
+        expect(verifyWebhookSignature({ body, signatureHeader: `v1=${sig}`, secret, nowSeconds: t })).toBe(false);
+    });
+    it('rejects a replayed delivery outside the tolerance window', () => {
+        expect(verifyWebhookSignature({
+            body,
+            signatureHeader: header(t),
+            secret,
+            nowSeconds: t + WEBHOOK_SIGNATURE_TOLERANCE_SECONDS + 1,
+        })).toBe(false);
+        expect(verifyWebhookSignature({
+            body,
+            signatureHeader: header(t),
+            secret,
+            nowSeconds: t + WEBHOOK_SIGNATURE_TOLERANCE_SECONDS,
+        })).toBe(true);
+    });
+    it('rejects a delivery timestamped in the future beyond tolerance', () => {
+        // Clock skew cuts both ways; an attacker post-dating `t` to buy a longer
+        // replay window is the case that matters.
+        expect(verifyWebhookSignature({
+            body,
+            signatureHeader: header(t),
+            secret,
+            nowSeconds: t - WEBHOOK_SIGNATURE_TOLERANCE_SECONDS - 1,
+        })).toBe(false);
+    });
+});
+describe('chatlyIdentityHash', () => {
+    it('matches the digest the API verifies against', () => {
+        // The API computes HMAC-SHA256(secret, externalId) and compares with
+        // timingSafeEqual. If these two ever disagree, identity verification
+        // rejects every legitimate visitor -- and the failure looks like a
+        // widget bug rather than a hashing mismatch.
+        const expected = createHmac('sha256', 'shh').update('user-42').digest('hex');
+        expect(chatlyIdentityHash('shh', 'user-42')).toBe(expected);
+    });
+    it('differs per user, which is the entire point', () => {
+        expect(chatlyIdentityHash('shh', 'user-1')).not.toBe(chatlyIdentityHash('shh', 'user-2'));
+    });
+    it('differs per workspace secret', () => {
+        expect(chatlyIdentityHash('a', 'user-1')).not.toBe(chatlyIdentityHash('b', 'user-1'));
+    });
+    it.each([
+        ['an empty secret', '', 'user-1'],
+        ['an empty externalId', 'shh', ''],
+    ])('refuses %s rather than returning a hash of nothing', (_label, secret, externalId) => {
+        // An empty secret produces a perfectly valid-looking digest that any
+        // attacker can also compute.
+        expect(() => chatlyIdentityHash(secret, externalId)).toThrow();
+    });
+});
+//# sourceMappingURL=index.spec.js.map

package/dist/index.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.spec.js","sourceRoot":"","sources":["../src/index.spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,EAAE,EAAE,MAAM,yBAAyB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,mCAAmC,GACpC,MAAM,YAAY,CAAC;AAEpB,SAAS,cAAc;IACrB,MAAM,KAAK,GAA8C,EAAE,CAAC;IAC5D,MAAM,EAAE,GAAG,KAAK,EAAE,GAA2B,EAAE,IAAkB,EAAE,EAAE;QACnE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QACnD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;YAChD,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAA6B,EAAE,CAAC;AACtD,CAAC;AAED,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACxD,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;YAC9B,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE,GAAG,CAAC,EAAE;SAChB,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/D,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,EAAE,GAAG,IAAI,OAAO,CACpB,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,OAAiC,CAC7E,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACzB,MAAM,EAAE,GAAG,IAAI,OAAO,CACpB,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,OAAiC,CAC7E,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACzB,MAAM,CAAC,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,CAAC,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;YAC9B,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE,GAAG,CAAC,EAAE;SAChB,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,IAAI,OAAO,CACnB,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,OAAiC,CAC7E,CAAC;QACF,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC3D,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACvD,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;YAC9B,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE,GAAG,CAAC,EAAE;SAChB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAC1D,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAiC,CAAC,CAAC;YACnE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;YAC9B,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE,GAAG,CAAC,EAAE;SAChB,CAAC,CAAC;QACH,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,uBAAuB;QAC5D,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,IAAI,OAAO,CACnB,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,OAAiC,CAC7E,CAAC;QACF,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/D,wCAAwC;QACxC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0DAA0D,EAAE,GAAG,EAAE;IACxE;;;;;;;;;OASG;IACH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9F,MAAM,KAAK,GAAG,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAEnD,MAAM,OAAO,GAAG,CAAC,CAAe,EAAY,EAAE;YAC5C,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;YACxE,OAAO,IAAI;iBACR,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CACf,MAAM,CAAC,IAAI,CAAE,CAAuC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAClE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CACrB,CACF;iBACA,IAAI,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9F,MAAM,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/E,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACxD;;;;;OAKG;IACH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9F,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,sEAAsE;QACtE,4DAA4D;QAC5D,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9F,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C;;;;OAIG;IACH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9F,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC3F,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9F,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9F,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;YAC9B,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE,GAAG,CAAC,EAAE;SAChB,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACtE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;YAC9B,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE,GAAG,CAAC,EAAE;SAChB,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,MAAM,MAAM,GAAG,KAAK,CAAC;IACrB,MAAM,IAAI,GAAG,kDAAkD,CAAC;IAChE,MAAM,CAAC,GAAG,aAAa,CAAC;IACxB,sEAAsE;IACtE,kEAAkE;IAClE,mEAAmE;IACnE,gCAAgC;IAChC,yEAAyE;IACzE,8CAA8C;IAC9C,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,OAAO,GAAG,IAAI,EAAE,GAAG,GAAG,MAAM,EAAU,EAAE,CAClE,KAAK,MAAM,CAAC,EAAE,CAAC,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC;SAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,IAAI,OAAO,EAAE,CAAC;SAClC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAErB,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CACJ,sBAAsB,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CACpF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CACJ,sBAAsB,CAAC;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;YAC/B,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1B,MAAM;YACN,UAAU,EAAE,CAAC;SACd,CAAC,CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,uEAAuE;QACvE,yDAAyD;QACzD,MAAM,QAAQ,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAChG,MAAM,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAC7F,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CACJ,sBAAsB,CAAC;YACrB,IAAI,EAAE,kDAAkD;YACxD,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1B,MAAM;YACN,UAAU,EAAE,CAAC;SACd,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CACJ,sBAAsB,CAAC;YACrB,IAAI;YACJ,eAAe,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC;YACxC,MAAM;YACN,UAAU,EAAE,CAAC;SACd,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CACJ,sBAAsB,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAC3F,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,qEAAqE;QACrE,mDAAmD;QACnD,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;aACrC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;aAC9B,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,MAAM,CACJ,sBAAsB,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CACtF,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CACJ,sBAAsB,CAAC;YACrB,IAAI;YACJ,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1B,MAAM;YACN,UAAU,EAAE,CAAC,GAAG,mCAAmC,GAAG,CAAC;SACxD,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,MAAM,CACJ,sBAAsB,CAAC;YACrB,IAAI;YACJ,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1B,MAAM;YACN,UAAU,EAAE,CAAC,GAAG,mCAAmC;SACpD,CAAC,CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,yEAAyE;QACzE,0CAA0C;QAC1C,MAAM,CACJ,sBAAsB,CAAC;YACrB,IAAI;YACJ,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1B,MAAM;YACN,UAAU,EAAE,CAAC,GAAG,mCAAmC,GAAG,CAAC;SACxD,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,qEAAqE;QACrE,qEAAqE;QACrE,mEAAmE;QACnE,6CAA6C;QAC7C,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7E,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,iBAAiB,EAAE,EAAE,EAAE,QAAQ,CAAC;QACjC,CAAC,qBAAqB,EAAE,KAAK,EAAE,EAAE,CAAC;KACnC,CAAC,CAAC,oDAAoD,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE;QACtF,qEAAqE;QACrE,6BAA6B;QAC7B,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,64 @@
 {
   "name": "@chatlychat/sdk-node",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Server-side SDK for the LiveChat platform — REST client + webhook signature verification.",
+  "license": "MIT",
+  "homepage": "https://github.com/livechat/platform/tree/main/packages/sdk-node",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/livechat/platform.git",
+    "directory": "packages/sdk-node"
+  },
+  "bugs": "https://github.com/livechat/platform/issues",
+  "keywords": [
+    "livechat",
+    "chat",
+    "messaging",
+    "support",
+    "webhooks",
+    "sdk",
+    "server"
+  ],
+  "author": "LiveChat Platform Engineering",
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "prepublishOnly": "pnpm build",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "lint": "eslint src --max-warnings=0",
+    "test": "vitest run"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/",
+    "provenance": true
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "devDependencies": {
+    "@livechat/config": "workspace:*",
+    "@livechat/shared": "workspace:*",
+    "@types/node": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
+  },
+  "dependencies": {}
+}