@chatlychat/sdk-node 0.1.0 → 0.2.1

package/dist/transport.js

@@ -0,0 +1,178 @@
+import { randomUUID } from 'node:crypto';
+import { ChatlyApiError, ChatlyRateLimitError, ChatlyServerError, ChatlyTransportError, errorForResponse, parseRetryAfter, retryAfterHeader, } from './errors.js';
+/** Production. Never a dev or example host — see the note in {@link Transport}. */
+export const DEFAULT_API_URL = 'https://api.chatlychat.com';
+/** The package version, stamped into `User-Agent` so our logs can see SDK age. */
+export const SDK_VERSION = '0.2.1';
+export const DEFAULT_RETRY = { attempts: 3, baseDelayMs: 250, maxDelayMs: 4_000 };
+/**
+ * One HTTP concern, in one place: auth, idempotency, retry, error mapping.
+ *
+ * Resource namespaces hold no HTTP logic at all — they build a path and a
+ * body and hand both here. That is what makes the retry policy and the error
+ * model uniform across 55 routes instead of per-method.
+ */
+export class Transport {
+    base;
+    headers;
+    timeoutMs;
+    fetchFn;
+    retry;
+    sleepFn;
+    /**
+     * When set, every write uses this exact `Idempotency-Key` instead of a fresh
+     * UUID. Set by `ChatlyClient.withIdempotencyKey`, which returns a client
+     * sharing this transport's configuration with a pinned key.
+     */
+    pinnedIdempotencyKey;
+    constructor(opts, pinnedIdempotencyKey = null) {
+        if (typeof opts.apiKey !== 'string' || opts.apiKey.length === 0) {
+            throw new TypeError('ChatlyClient: apiKey is required and must be a non-empty string');
+        }
+        /*
+         * Production, not a dev hostname.
+         *
+         * This was `https://api.livechat.local`, which resolves nowhere — so a
+         * developer who followed the published docs and omitted `apiUrl` got an
+         * SDK whose every call failed, and the docs page carried a warning
+         * telling each reader to override it. Reported by a customer who
+         * integrated from the docs alone, not caught here, because every test in
+         * this package passes an explicit `apiUrl`. The same defect shipped in
+         * the Kotlin and Swift SDKs as `api.chatly.example`.
+         */
+        this.base = (opts.apiUrl ?? DEFAULT_API_URL).replace(/\/+$/, '');
+        this.headers = new Headers({
+            authorization: `Bearer ${opts.apiKey}`,
+            'content-type': 'application/json',
+            accept: 'application/json',
+            'user-agent': `chatly-sdk-node/${SDK_VERSION}`,
+        });
+        this.timeoutMs = opts.timeoutMs ?? 15_000;
+        this.fetchFn = opts.fetchFn ?? globalThis.fetch;
+        this.retry = { ...DEFAULT_RETRY, ...opts.retry };
+        this.sleepFn = opts.sleepFn ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+        this.pinnedIdempotencyKey = pinnedIdempotencyKey;
+    }
+    /** A copy of this transport with a pinned idempotency key. */
+    withPinnedKey(key) {
+        const clone = Object.create(Transport.prototype);
+        Object.assign(clone, this, { pinnedIdempotencyKey: key });
+        return clone;
+    }
+    async get(path, query = {}) {
+        return this.send('GET', path, query, undefined);
+    }
+    async post(path, body, query = {}) {
+        return this.send('POST', path, query, body);
+    }
+    async patch(path, body, query = {}) {
+        return this.send('PATCH', path, query, body);
+    }
+    async put(path, body, query = {}) {
+        return this.send('PUT', path, query, body);
+    }
+    async del(path, query = {}) {
+        return this.send('DELETE', path, query, undefined);
+    }
+    /**
+     * The escape hatch, and the one method every other method goes through.
+     *
+     * 85 of the 140 key-accessible routes have no typed method here. Without a
+     * public way in, reaching one means abandoning the SDK and hand-rolling
+     * HTTP with a bearer token — losing the retry policy, the error model and
+     * the idempotency contract in the process.
+     */
+    async send(method, path, query = {}, body) {
+        const url = new URL(`${this.base}${path}`);
+        for (const [key, value] of Object.entries(query)) {
+            if (value === undefined) {
+                continue;
+            }
+            if (Array.isArray(value)) {
+                // Repeated keys stay repeated: `kinds=kb&kinds=ticket`. Joining them
+                // with a comma produces one parameter whose value is not a member of
+                // the enum — which is what the MCP server's `search` tool did.
+                for (const item of value) {
+                    url.searchParams.append(key, item);
+                }
+            }
+            else {
+                url.searchParams.set(key, String(value));
+            }
+        }
+        const isWrite = method !== 'GET';
+        /*
+         * One key for the whole call, retries included.
+         *
+         * Minting a fresh key per ATTEMPT would defeat the header's only purpose:
+         * attempt 2 of a POST that actually succeeded upstream would be accepted
+         * as a new operation and double-write. Minting it per CALL means a retry
+         * is recognised as the same logical operation and replayed.
+         */
+        const idempotencyKey = isWrite ? (this.pinnedIdempotencyKey ?? randomUUID()) : null;
+        let lastError;
+        for (let attempt = 1; attempt <= this.retry.attempts; attempt++) {
+            try {
+                return await this.attempt(url, method, body, idempotencyKey);
+            }
+            catch (err) {
+                lastError = err;
+                const retryable = err instanceof ChatlyTransportError ||
+                    err instanceof ChatlyRateLimitError ||
+                    err instanceof ChatlyServerError;
+                if (!retryable || attempt === this.retry.attempts) {
+                    throw err;
+                }
+                const advised = err instanceof ChatlyApiError && err.retryAfter !== null ? err.retryAfter * 1000 : null;
+                const backoff = Math.min(this.retry.baseDelayMs * 2 ** (attempt - 1), this.retry.maxDelayMs);
+                // Jitter: a fleet of workers retrying in lockstep is a second outage.
+                const jittered = backoff * (0.5 + Math.random() / 2);
+                await this.sleepFn(advised ?? jittered);
+            }
+        }
+        throw lastError;
+    }
+    async attempt(url, method, body, idempotencyKey) {
+        const ctrl = new AbortController();
+        const timer = setTimeout(() => ctrl.abort(), this.timeoutMs);
+        try {
+            const headers = new Headers(this.headers);
+            if (idempotencyKey !== null) {
+                headers.set('idempotency-key', idempotencyKey);
+            }
+            let res;
+            try {
+                res = await this.fetchFn(url.toString(), {
+                    method,
+                    headers,
+                    signal: ctrl.signal,
+                    ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+                });
+            }
+            catch (cause) {
+                const why = ctrl.signal.aborted ? `timed out after ${String(this.timeoutMs)}ms` : 'failed';
+                throw new ChatlyTransportError(`Chatly request ${why}: ${method} ${url.pathname}`, cause);
+            }
+            if (!res.ok) {
+                throw errorForResponse({
+                    status: res.status,
+                    body: await res.text(),
+                    requestId: res.headers.get('x-request-id'),
+                    retryAfter: parseRetryAfter(retryAfterHeader(res.headers), Date.now()),
+                });
+            }
+            if (res.status === 204) {
+                return undefined;
+            }
+            const text = await res.text();
+            if (text.length === 0) {
+                return undefined;
+            }
+            return JSON.parse(text);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+}
+//# sourceMappingURL=transport.js.map

package/dist/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,mFAAmF;AACnF,MAAM,CAAC,MAAM,eAAe,GAAG,4BAA4B,CAAC;AAE5D,kFAAkF;AAClF,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC;AAWnC,MAAM,CAAC,MAAM,aAAa,GAAgB,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAc/F;;;;;;GAMG;AACH,MAAM,OAAO,SAAS;IACH,IAAI,CAAS;IACb,OAAO,CAAU;IACjB,SAAS,CAAS;IAClB,OAAO,CAAe;IACtB,KAAK,CAAc;IACnB,OAAO,CAAgC;IACxD;;;;OAIG;IACa,oBAAoB,CAAgB;IAEpD,YAAmB,IAAsB,EAAE,uBAAsC,IAAI;QACnF,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAC;QACzF,CAAC;QACD;;;;;;;;;;WAUG;QACH,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC;YACzB,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;YACtC,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;YAC1B,YAAY,EAAE,mBAAmB,WAAW,EAAE;SAC/C,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC;QAChD,IAAI,CAAC,KAAK,GAAG,EAAE,GAAG,aAAa,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACjD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;IACnD,CAAC;IAED,8DAA8D;IACvD,aAAa,CAAC,GAAW;QAC9B,MAAM,KAAK,GAAc,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IAEM,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,QAAe,EAAE;QACjD,OAAO,IAAI,CAAC,IAAI,CAAI,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC;IAEM,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAc,EAAE,QAAe,EAAE;QAClE,OAAO,IAAI,CAAC,IAAI,CAAI,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAEM,KAAK,CAAC,KAAK,CAAI,IAAY,EAAE,IAAc,EAAE,QAAe,EAAE;QACnE,OAAO,IAAI,CAAC,IAAI,CAAI,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IAEM,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,IAAc,EAAE,QAAe,EAAE;QACjE,OAAO,IAAI,CAAC,IAAI,CAAI,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAEM,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,QAAe,EAAE;QACjD,OAAO,IAAI,CAAC,IAAI,CAAI,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,IAAI,CACf,MAAmD,EACnD,IAAY,EACZ,QAAe,EAAE,EACjB,IAAc;QAEd,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,qEAAqE;gBACrE,qEAAqE;gBACrE,+DAA+D;gBAC/D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,KAAK,KAAK,CAAC;QACjC;;;;;;;WAOG;QACH,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEpF,IAAI,SAAkB,CAAC;QACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;YAChE,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;YAClE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,GAAG,CAAC;gBAChB,MAAM,SAAS,GACb,GAAG,YAAY,oBAAoB;oBACnC,GAAG,YAAY,oBAAoB;oBACnC,GAAG,YAAY,iBAAiB,CAAC;gBACnC,IAAI,CAAC,SAAS,IAAI,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;oBAClD,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,MAAM,OAAO,GACX,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC1F,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC7F,sEAAsE;gBACtE,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;gBACrD,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QACD,MAAM,SAAS,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,GAAQ,EACR,MAAc,EACd,IAAa,EACb,cAA6B;QAE7B,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;YACjD,CAAC;YACD,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;oBACvC,MAAM;oBACN,OAAO;oBACP,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAC3F,MAAM,IAAI,oBAAoB,CAAC,kBAAkB,GAAG,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;YAC5F,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,gBAAgB,CAAC;oBACrB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE;oBACtB,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;oBAC1C,UAAU,EAAE,eAAe,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;iBACvE,CAAC,CAAC;YACL,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,OAAO,SAAc,CAAC;YACxB,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO,SAAc,CAAC;YACxB,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;QAC/B,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;CACF"}

package/dist/webhooks.d.ts

@@ -0,0 +1,35 @@
+/** Freshness window for `t`, in seconds. Matches what the docs recommend. */
+export declare const WEBHOOK_SIGNATURE_TOLERANCE_SECONDS = 300;
+export interface VerifyWebhookSignatureInput {
+    /**
+     * The EXACT bytes we POSTed. Pass the raw body — re-serialising parsed JSON
+     * reorders keys and changes whitespace, and the digest will not match.
+     */
+    body: string | Uint8Array;
+    /** The `x-livechat-signature` header value: `t=<unix seconds>,v1=<hex>`. */
+    signatureHeader: string;
+    /** The endpoint's `whsec_…` signing secret.  */
+    secret: string;
+    /**
+     * How far `t` may be from now before the delivery is treated as a replay.
+     * Defaults to {@link WEBHOOK_SIGNATURE_TOLERANCE_SECONDS}; pass `Infinity`
+     * only when re-verifying an archived delivery.
+     */
+    toleranceSeconds?: number;
+    /** Escape hatch for tests. Unix seconds. */
+    nowSeconds?: number;
+}
+/**
+ * Verify the signature header on a webhook delivery from the platform.
+ *
+ * `v1` is HMAC-SHA256 over `` `${t}.${body}` `` — the timestamp is bound INTO
+ * the digest, which is what makes the replay window enforceable at all.
+ *
+ * This used to HMAC the body ALONE, so it rejected every genuine delivery the
+ * platform sent: the producer has always signed `${t}.${body}` and our own
+ * published documentation has always described that construction. Anyone
+ * following either the SDK or the docs got a hard "invalid signature" on 100%
+ * of real traffic. The wire format is unchanged — only this verifier was wrong.
+ */
+export declare function verifyWebhookSignature(input: VerifyWebhookSignatureInput): boolean;
+//# sourceMappingURL=webhooks.d.ts.map

package/dist/webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAEA,6EAA6E;AAC7E,eAAO,MAAM,mCAAmC,MAAM,CAAC;AAEvD,MAAM,WAAW,2BAA2B;IAC1C;;;OAGG;IACH,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;IAC1B,4EAA4E;IAC5E,eAAe,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAiClF"}

package/dist/webhooks.js

@@ -0,0 +1,47 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+/** Freshness window for `t`, in seconds. Matches what the docs recommend. */
+export const WEBHOOK_SIGNATURE_TOLERANCE_SECONDS = 300;
+/**
+ * Verify the signature header on a webhook delivery from the platform.
+ *
+ * `v1` is HMAC-SHA256 over `` `${t}.${body}` `` — the timestamp is bound INTO
+ * the digest, which is what makes the replay window enforceable at all.
+ *
+ * This used to HMAC the body ALONE, so it rejected every genuine delivery the
+ * platform sent: the producer has always signed `${t}.${body}` and our own
+ * published documentation has always described that construction. Anyone
+ * following either the SDK or the docs got a hard "invalid signature" on 100%
+ * of real traffic. The wire format is unchanged — only this verifier was wrong.
+ */
+export function verifyWebhookSignature(input) {
+    const parts = new Map();
+    for (const part of input.signatureHeader.split(',')) {
+        const eq = part.indexOf('=');
+        if (eq > 0) {
+            parts.set(part.slice(0, eq).trim(), part.slice(eq + 1).trim());
+        }
+    }
+    const rawTs = parts.get('t');
+    const tag = parts.get('v1');
+    if (rawTs === undefined || tag === undefined) {
+        return false;
+    }
+    const issuedAt = Number.parseInt(rawTs, 10);
+    if (!Number.isFinite(issuedAt)) {
+        return false;
+    }
+    const tolerance = input.toleranceSeconds ?? WEBHOOK_SIGNATURE_TOLERANCE_SECONDS;
+    const now = input.nowSeconds ?? Math.floor(Date.now() / 1000);
+    if (Math.abs(now - issuedAt) > tolerance) {
+        return false;
+    }
+    const hmac = createHmac('sha256', input.secret);
+    hmac.update(`${rawTs}.`);
+    hmac.update(typeof input.body === 'string' ? Buffer.from(input.body, 'utf8') : input.body);
+    const a = Buffer.from(tag, 'hex');
+    const b = Buffer.from(hmac.digest('hex'), 'hex');
+    // Length check first: timingSafeEqual throws on a length mismatch, and a
+    // thrown verifier is an accepted webhook in a handler that forgot try/catch.
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+//# sourceMappingURL=webhooks.js.map

package/dist/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,6EAA6E;AAC7E,MAAM,CAAC,MAAM,mCAAmC,GAAG,GAAG,CAAC;AAsBvD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAkC;IACvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,gBAAgB,IAAI,mCAAmC,CAAC;IAChF,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC9D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,QAAQ,CAAC,GAAG,SAAS,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3F,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACjD,yEAAyE;IACzE,6EAA6E;IAC7E,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC"}

package/package.json

@@ -1,17 +1,18 @@
 {
   "name": "@chatlychat/sdk-node",
-  "version": "0.1.0",
-  "description": "Server-side SDK for the LiveChat platform — REST client + webhook signature verification.",
+  "version": "0.2.1",
+  "description": "Official Node.js SDK for the Chatly API — typed REST client, webhook signature verification, and the widget identity hash.",
   "license": "MIT",
-  "homepage": "https://github.com/livechat/platform/tree/main/packages/sdk-node",
+  "homepage": "https://github.com/chatlychat/chatly-sdk-node#readme",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/livechat/platform.git",
-    "directory": "packages/sdk-node"
+    "url": "git+https://github.com/chatlychat/chatly-sdk-node.git"
+  },
+  "bugs": {
+    "url": "https://github.com/chatlychat/chatly-sdk-node/issues"
   },
-  "bugs": "https://github.com/livechat/platform/issues",
   "keywords": [
-    "livechat",
+    "chatly",
     "chat",
     "messaging",
     "support",
@@ -19,7 +20,7 @@
     "sdk",
     "server"
   ],
-  "author": "LiveChat Platform Engineering",
+  "author": "Chatly",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -38,13 +39,6 @@
     "CHANGELOG.md"
   ],
   "sideEffects": false,
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "prepublishOnly": "pnpm build",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
-    "lint": "eslint src --max-warnings=0",
-    "test": "vitest run"
-  },
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/",
@@ -54,11 +48,17 @@
     "node": ">=18"
   },
   "devDependencies": {
-    "@livechat/config": "workspace:*",
-    "@livechat/shared": "workspace:*",
-    "@types/node": "catalog:",
-    "typescript": "catalog:",
-    "vitest": "catalog:"
+    "@types/node": "20.14.10",
+    "typescript": "5.6.2",
+    "vitest": "2.1.2",
+    "@livechat/config": "0.1.0",
+    "@livechat/shared": "0.1.0"
   },
-  "dependencies": {}
-}
+  "dependencies": {},
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "lint": "eslint src --max-warnings=0",
+    "test": "vitest run"
+  }
+}

package/dist/index.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=index.spec.d.ts.map

package/dist/index.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.spec.d.ts","sourceRoot":"","sources":["../src/index.spec.ts"],"names":[],"mappings":""}