@checkcourt/sdk 0.0.0-stage → 0.3.1

package/dist/oauth.d.ts

@@ -0,0 +1,96 @@
+export { AppTemporarilyUnavailableError, OAuthError, TokenRevokedError, } from "./errors.js";
+export declare const AUTHORIZE_PATH = "/api/oauth/authorize";
+export declare const TOKEN_PATH = "/api/oauth/token";
+export declare const REVOKE_PATH = "/api/oauth/revoke";
+export declare const INSTALLATION_TOKEN_PATH = "/api/oauth/installation-token";
+export type FetchLike = (input: Request) => Promise<Response>;
+export interface ClientCredentials {
+    /** `cca_app_…` */
+    clientId: string;
+    /** `ccas_…`, only ever on your server. */
+    clientSecret: string;
+    /** Defaults to https://app.checkcourt.de. */
+    baseUrl?: string;
+    fetch?: FetchLike;
+}
+export interface PkcePair {
+    /** Keep it in the member's session until the callback. */
+    verifier: string;
+    challenge: string;
+    method: "S256";
+}
+/** 32 random bytes as verifier (43 characters) and its S256 challenge. */
+export declare function createPkcePair(): Promise<PkcePair>;
+export declare function pkceChallenge(verifier: string): Promise<string>;
+/** A random `state` value for the authorize redirect. */
+export declare function createState(): string;
+export interface AuthorizeUrlOptions {
+    baseUrl?: string;
+    clientId: string;
+    /** Exactly one of the redirect URIs registered in the developer portal. */
+    redirectUri: string;
+    /** Comes back unchanged, at most 500 characters. */
+    state: string;
+    codeChallenge: string;
+    /** `consent` shows the consent screen even when the member already agreed. */
+    prompt?: "consent";
+    /** Club id to preselect in the consent screen. */
+    tenant?: string;
+}
+export declare function buildAuthorizeUrl(options: AuthorizeUrlOptions): string;
+/**
+ * Reads `code` from the redirect back to your app after checking `state`.
+ * Throws `OAuthError` (e.g. `access_denied`) when CheckCourt sent an error instead.
+ */
+export declare function parseAuthorizeCallback(callbackUrl: string | URL, expectedState: string): {
+    code: string;
+};
+export interface UserTokenSet {
+    /** `ccu_…`, valid for one hour. */
+    accessToken: string;
+    /** `ccr_…`, works exactly once; always store the newest. */
+    refreshToken: string;
+    /** Epoch milliseconds. */
+    expiresAt: number;
+    scope: string[];
+    /** Every running connection of the member with your app, i.e. the clubs this token works in. */
+    installations: {
+        installationId: string;
+        tenantId: string;
+    }[];
+}
+export interface InstallationToken {
+    /** `cca_…`, valid for one hour, only for this installation. */
+    accessToken: string;
+    /** Epoch milliseconds. */
+    expiresAt: number;
+    installationId: string;
+    scopes: string[];
+}
+/** POSTs a form to an OAuth endpoint and returns the parsed JSON, or throws the mapped `OAuthError`. */
+export declare function postOAuthForm(credentials: ClientCredentials, path: string, form: Record<string, string>): Promise<{
+    body: unknown;
+    response: Response;
+}>;
+/** Swaps the one-time code (valid 60 s) for member tokens. */
+export declare function exchangeCode(options: ClientCredentials & {
+    code: string;
+    redirectUri: string;
+    codeVerifier: string;
+}): Promise<UserTokenSet>;
+/**
+ * One refresh with rotation. Throws `TokenRevokedError` (`invalid_grant`) or
+ * `AppTemporarilyUnavailableError` (token not consumed, retry later with the same one).
+ * Never run two refreshes with the same token in parallel: reuse revokes the whole chain.
+ */
+export declare function refreshTokens(options: ClientCredentials & {
+    refreshToken: string;
+}): Promise<UserTokenSet>;
+/** RFC 7009. A refresh token takes its whole chain along; the member stays connected. */
+export declare function revokeToken(options: ClientCredentials & {
+    token: string;
+}): Promise<void>;
+/** Client credentials for one club installation. There is no refresh token: fetch a new one. */
+export declare function fetchInstallationToken(options: ClientCredentials & {
+    installationId: string;
+}): Promise<InstallationToken>;

package/dist/oauth.js

@@ -0,0 +1,140 @@
+import { CheckCourtError, OAuthError, oauthErrorFrom } from "./errors.js";
+import { base64UrlEncode, randomBytes, utf8 } from "./internal/encoding.js";
+import { sha256 } from "./internal/hmac.js";
+import { normalizeBaseUrl } from "./internal/base-url.js";
+export { AppTemporarilyUnavailableError, OAuthError, TokenRevokedError, } from "./errors.js";
+export const AUTHORIZE_PATH = "/api/oauth/authorize";
+export const TOKEN_PATH = "/api/oauth/token";
+export const REVOKE_PATH = "/api/oauth/revoke";
+export const INSTALLATION_TOKEN_PATH = "/api/oauth/installation-token";
+/** 32 random bytes as verifier (43 characters) and its S256 challenge. */
+export async function createPkcePair() {
+    const verifier = base64UrlEncode(randomBytes(32));
+    return { verifier, challenge: await pkceChallenge(verifier), method: "S256" };
+}
+export async function pkceChallenge(verifier) {
+    if (!/^[A-Za-z0-9\-._~]{43,128}$/.test(verifier)) {
+        throw new CheckCourtError("code_verifier must be 43 to 128 characters from A-Z a-z 0-9 - . _ ~");
+    }
+    return base64UrlEncode(await sha256(utf8(verifier)));
+}
+/** A random `state` value for the authorize redirect. */
+export function createState() {
+    return base64UrlEncode(randomBytes(16));
+}
+export function buildAuthorizeUrl(options) {
+    const url = new URL(AUTHORIZE_PATH, normalizeBaseUrl(options.baseUrl) + "/");
+    const params = {
+        response_type: "code",
+        client_id: options.clientId,
+        redirect_uri: options.redirectUri,
+        code_challenge: options.codeChallenge,
+        code_challenge_method: "S256",
+        state: options.state,
+        prompt: options.prompt,
+        tenant: options.tenant,
+    };
+    for (const [key, value] of Object.entries(params))
+        if (value !== undefined)
+            url.searchParams.set(key, value);
+    return url.toString();
+}
+/**
+ * Reads `code` from the redirect back to your app after checking `state`.
+ * Throws `OAuthError` (e.g. `access_denied`) when CheckCourt sent an error instead.
+ */
+export function parseAuthorizeCallback(callbackUrl, expectedState) {
+    const params = new URL(callbackUrl).searchParams;
+    if (params.get("state") !== expectedState) {
+        throw new OAuthError(400, "state_mismatch", "state does not match the value sent to authorize");
+    }
+    const error = params.get("error");
+    if (error)
+        throw new OAuthError(400, error, params.get("error_description") ?? error);
+    const code = params.get("code");
+    if (!code)
+        throw new OAuthError(400, "invalid_request", "Callback has neither code nor error");
+    return { code };
+}
+function basicAuth(clientId, clientSecret) {
+    const raw = `${encodeURIComponent(clientId)}:${encodeURIComponent(clientSecret)}`;
+    return `Basic ${btoa(String.fromCharCode(...utf8(raw)))}`;
+}
+/** POSTs a form to an OAuth endpoint and returns the parsed JSON, or throws the mapped `OAuthError`. */
+export async function postOAuthForm(credentials, path, form) {
+    const doFetch = credentials.fetch ?? ((req) => fetch(req));
+    const request = new Request(normalizeBaseUrl(credentials.baseUrl) + path, {
+        method: "POST",
+        headers: {
+            Authorization: basicAuth(credentials.clientId, credentials.clientSecret),
+            "Content-Type": "application/x-www-form-urlencoded",
+            Accept: "application/json",
+        },
+        body: new URLSearchParams(form).toString(),
+    });
+    const response = await doFetch(request);
+    const text = await response.text();
+    let body = null;
+    if (text) {
+        try {
+            body = JSON.parse(text);
+        }
+        catch {
+            body = null;
+        }
+    }
+    if (!response.ok)
+        throw oauthErrorFrom(response.status, body);
+    return { body, response };
+}
+function toUserTokenSet(raw, now) {
+    return {
+        accessToken: raw.access_token,
+        refreshToken: raw.refresh_token,
+        expiresAt: now + raw.expires_in * 1000,
+        scope: raw.scope ? raw.scope.split(" ").filter(Boolean) : [],
+        installations: (raw.installations ?? []).map((i) => ({
+            installationId: i.installation_id,
+            tenantId: i.tenant_id,
+        })),
+    };
+}
+/** Swaps the one-time code (valid 60 s) for member tokens. */
+export async function exchangeCode(options) {
+    const { body } = await postOAuthForm(options, TOKEN_PATH, {
+        grant_type: "authorization_code",
+        code: options.code,
+        redirect_uri: options.redirectUri,
+        code_verifier: options.codeVerifier,
+    });
+    return toUserTokenSet(body, Date.now());
+}
+/**
+ * One refresh with rotation. Throws `TokenRevokedError` (`invalid_grant`) or
+ * `AppTemporarilyUnavailableError` (token not consumed, retry later with the same one).
+ * Never run two refreshes with the same token in parallel: reuse revokes the whole chain.
+ */
+export async function refreshTokens(options) {
+    const { body } = await postOAuthForm(options, TOKEN_PATH, {
+        grant_type: "refresh_token",
+        refresh_token: options.refreshToken,
+    });
+    return toUserTokenSet(body, Date.now());
+}
+/** RFC 7009. A refresh token takes its whole chain along; the member stays connected. */
+export async function revokeToken(options) {
+    await postOAuthForm(options, REVOKE_PATH, { token: options.token });
+}
+/** Client credentials for one club installation. There is no refresh token: fetch a new one. */
+export async function fetchInstallationToken(options) {
+    const { body } = await postOAuthForm(options, INSTALLATION_TOKEN_PATH, {
+        installation_id: options.installationId,
+    });
+    const raw = body;
+    return {
+        accessToken: raw.access_token,
+        expiresAt: Date.now() + raw.expires_in * 1000,
+        installationId: raw.installation_id,
+        scopes: raw.scopes ?? [],
+    };
+}

package/dist/ui.d.ts

@@ -0,0 +1,183 @@
+export declare const UI_VERSION = "v1";
+export declare const MAX_UI_BLOCKS = 50;
+/** Top-level blocks sit at depth 1; a container's children one deeper. */
+export declare const MAX_UI_DEPTH = 3;
+export declare const BADGE_VARIANTS: readonly ["default", "secondary", "outline", "destructive"];
+export declare const BUTTON_VARIANTS: readonly ["default", "secondary", "outline", "destructive"];
+export type BadgeVariant = (typeof BADGE_VARIANTS)[number];
+export type ButtonVariant = (typeof BUTTON_VARIANTS)[number];
+export type UiTextBlock = {
+    type: "text";
+    text: string;
+    tone?: "muted";
+};
+export type UiHeadingBlock = {
+    type: "heading";
+    text: string;
+    level: 2 | 3;
+};
+export type UiStatBlock = {
+    type: "stat";
+    label: string;
+    value: string;
+    hint?: string;
+};
+export type UiBadgeBlock = {
+    type: "badge";
+    label: string;
+    variant?: BadgeVariant;
+};
+export type UiListItem = {
+    title: string;
+    description?: string;
+};
+export type UiListBlock = {
+    type: "list";
+    items: UiListItem[];
+};
+export type UiKeyValuePair = {
+    label: string;
+    value: string;
+};
+export type UiKeyValueBlock = {
+    type: "key_value";
+    pairs: UiKeyValuePair[];
+};
+export type UiLinkBlock = {
+    type: "link";
+    label: string;
+    url: string;
+};
+export type UiButtonBlock = {
+    type: "button";
+    label: string;
+    action_id: string;
+    variant?: ButtonVariant;
+};
+export type UiTextField = {
+    type: "text";
+    name: string;
+    label: string;
+    placeholder?: string;
+    default?: string;
+    required?: boolean;
+    max_length?: number;
+};
+export type UiNumberField = {
+    type: "number";
+    name: string;
+    label: string;
+    default?: number;
+    min?: number;
+    max?: number;
+    required?: boolean;
+};
+export type UiSelectField = {
+    type: "select";
+    name: string;
+    label: string;
+    options: {
+        value: string;
+        label: string;
+    }[];
+    default?: string;
+    required?: boolean;
+};
+export type UiSwitchField = {
+    type: "switch";
+    name: string;
+    label: string;
+    default?: boolean;
+};
+export type UiFormField = UiTextField | UiNumberField | UiSelectField | UiSwitchField;
+export type UiFormBlock = {
+    type: "form";
+    fields: UiFormField[];
+    submit_label: string;
+    action_id: string;
+};
+export type UiDividerBlock = {
+    type: "divider";
+};
+export type UiStackBlock = {
+    type: "stack";
+    children: UiBlock[];
+};
+export type UiRowBlock = {
+    type: "row";
+    children: UiBlock[];
+};
+export type UiBlock = UiTextBlock | UiHeadingBlock | UiStatBlock | UiBadgeBlock | UiListBlock | UiKeyValueBlock | UiLinkBlock | UiButtonBlock | UiFormBlock | UiDividerBlock | UiStackBlock | UiRowBlock;
+export type UiToast = {
+    kind: "success" | "error";
+    message: string;
+};
+/** The response of a declarative extension: `{ ui: "v1", blocks, toast? }`. */
+export interface UiDocument {
+    ui: typeof UI_VERSION;
+    blocks: UiBlock[];
+    toast?: UiToast;
+}
+/** Tells CheckCourt to show no card for this subject and viewer; on an action, removes the panel. */
+export interface UiHiddenDocument {
+    ui: typeof UI_VERSION;
+    hidden: true;
+    toast?: UiToast;
+}
+/** Anything a declarative extension may answer with. */
+export type UiResponse = UiDocument | UiHiddenDocument;
+/** Values a submitted form sends back, keyed by field name. Empty optional fields are omitted. */
+export type UiFormValues = Record<string, string | number | boolean>;
+type Opt<T> = {
+    [K in keyof T]?: T[K];
+};
+/**
+ * Builds `ui: "v1"` documents. Strings are plain text (no HTML, no Markdown); CheckCourt
+ * renders them with its own design system.
+ */
+export declare const ui: {
+    readonly doc: (blocks: UiBlock[], options?: {
+        toast?: UiToast;
+    }) => UiDocument;
+    /** Nothing relevant here: no card at all. Answering `204 No Content` does the same. */
+    readonly hidden: (options?: {
+        toast?: UiToast;
+    }) => UiHiddenDocument;
+    readonly text: (text: string, options?: {
+        tone?: "muted";
+    }) => UiTextBlock;
+    readonly heading: (text: string, level?: 2 | 3) => UiHeadingBlock;
+    readonly stat: (label: string, value: string, options?: {
+        hint?: string;
+    }) => UiStatBlock;
+    readonly badge: (label: string, variant?: BadgeVariant) => UiBadgeBlock;
+    readonly list: (items: UiListItem[]) => UiListBlock;
+    /** Pairs keep their order; a plain object is turned into pairs in key order. */
+    readonly keyValue: (pairs: UiKeyValuePair[] | Record<string, string>) => UiKeyValueBlock;
+    /** https only; opens in a new tab. */
+    readonly link: (label: string, url: string) => UiLinkBlock;
+    readonly button: (label: string, actionId: string, options?: {
+        variant?: ButtonVariant;
+    }) => UiButtonBlock;
+    readonly form: (options: {
+        actionId: string;
+        submitLabel: string;
+        fields: UiFormField[];
+    }) => UiFormBlock;
+    readonly field: {
+        text(name: string, label: string, options?: Opt<Omit<UiTextField, "type" | "name" | "label">>): UiTextField;
+        number(name: string, label: string, options?: Opt<Omit<UiNumberField, "type" | "name" | "label">>): UiNumberField;
+        select(name: string, label: string, options: UiSelectField["options"], extra?: Opt<Pick<UiSelectField, "default" | "required">>): UiSelectField;
+        switch(name: string, label: string, options?: Opt<Pick<UiSwitchField, "default">>): UiSwitchField;
+    };
+    readonly divider: () => UiDividerBlock;
+    readonly stack: (children: UiBlock[]) => UiStackBlock;
+    /** Horizontal, wraps on narrow screens. */
+    readonly row: (children: UiBlock[]) => UiRowBlock;
+};
+/** Toasts for `ui.doc(blocks, { toast })`, at most 200 characters. */
+export declare const toast: {
+    readonly success: (message: string) => UiToast;
+    readonly error: (message: string) => UiToast;
+};
+export {};

package/dist/ui.js

@@ -0,0 +1,91 @@
+export const UI_VERSION = "v1";
+export const MAX_UI_BLOCKS = 50;
+/** Top-level blocks sit at depth 1; a container's children one deeper. */
+export const MAX_UI_DEPTH = 3;
+export const BADGE_VARIANTS = ["default", "secondary", "outline", "destructive"];
+export const BUTTON_VARIANTS = ["default", "secondary", "outline", "destructive"];
+const field = {
+    text(name, label, options = {}) {
+        return { type: "text", name, label, ...options };
+    },
+    number(name, label, options = {}) {
+        return { type: "number", name, label, ...options };
+    },
+    select(name, label, options, extra = {}) {
+        return { type: "select", name, label, options, ...extra };
+    },
+    switch(name, label, options = {}) {
+        return { type: "switch", name, label, ...options };
+    },
+};
+function compact(value) {
+    return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== undefined));
+}
+/**
+ * Builds `ui: "v1"` documents. Strings are plain text (no HTML, no Markdown); CheckCourt
+ * renders them with its own design system.
+ */
+export const ui = {
+    doc(blocks, options = {}) {
+        return compact({ ui: UI_VERSION, blocks, toast: options.toast });
+    },
+    /** Nothing relevant here: no card at all. Answering `204 No Content` does the same. */
+    hidden(options = {}) {
+        return compact({ ui: UI_VERSION, hidden: true, toast: options.toast });
+    },
+    text(text, options = {}) {
+        return compact({ type: "text", text, tone: options.tone });
+    },
+    heading(text, level = 2) {
+        return { type: "heading", text, level };
+    },
+    stat(label, value, options = {}) {
+        return compact({ type: "stat", label, value, hint: options.hint });
+    },
+    badge(label, variant) {
+        return compact({ type: "badge", label, variant });
+    },
+    list(items) {
+        return { type: "list", items: items.map((item) => compact({ ...item })) };
+    },
+    /** Pairs keep their order; a plain object is turned into pairs in key order. */
+    keyValue(pairs) {
+        const list = Array.isArray(pairs) ? pairs : Object.entries(pairs).map(([label, value]) => ({ label, value }));
+        return { type: "key_value", pairs: list };
+    },
+    /** https only; opens in a new tab. */
+    link(label, url) {
+        return { type: "link", label, url };
+    },
+    button(label, actionId, options = {}) {
+        return compact({ type: "button", label, action_id: actionId, variant: options.variant });
+    },
+    form(options) {
+        return {
+            type: "form",
+            fields: options.fields.map((f) => compact({ ...f })),
+            submit_label: options.submitLabel,
+            action_id: options.actionId,
+        };
+    },
+    field,
+    divider() {
+        return { type: "divider" };
+    },
+    stack(children) {
+        return { type: "stack", children };
+    },
+    /** Horizontal, wraps on narrow screens. */
+    row(children) {
+        return { type: "row", children };
+    },
+};
+/** Toasts for `ui.doc(blocks, { toast })`, at most 200 characters. */
+export const toast = {
+    success(message) {
+        return { kind: "success", message };
+    },
+    error(message) {
+        return { kind: "error", message };
+    },
+};

package/dist/webhooks.d.ts

@@ -0,0 +1,34 @@
+import type { WebhookEvent } from "./events.js";
+export type { AppLifecycleEventData, BookingEventData, CourtLockEventData, EventDataMap, EventObjectType, EventType, MemberEventData, SubscribableEventType, AppLifecycleEventType, WebhookEvent, WebhookEventOf, } from "./events.js";
+export { APP_LIFECYCLE_EVENT_TYPES, EVENT_TYPES, SUBSCRIBABLE_EVENT_TYPES } from "./events.js";
+export { WebhookSignatureError, type WebhookSignatureFailure } from "./errors.js";
+export declare const SIGNATURE_HEADER = "CheckCourt-Signature";
+export declare const EVENT_ID_HEADER = "CheckCourt-Event-Id";
+export declare const EVENT_TYPE_HEADER = "CheckCourt-Event-Type";
+export declare const INSTALLATION_ID_HEADER = "CheckCourt-Installation-Id";
+export declare const DEFAULT_TOLERANCE_SECONDS = 300;
+export type RawBody = string | Uint8Array | ArrayBuffer;
+export interface VerifySignatureOptions {
+    /** The whole `whsec_…` string, prefix included. */
+    secret: string;
+    /** The body exactly as received, before any JSON parsing. */
+    rawBody: RawBody;
+    /** Value of the `CheckCourt-Signature` header. */
+    signatureHeader: string | null | undefined;
+    toleranceSeconds?: number;
+    /** Override the clock: a `Date` or unix seconds. */
+    now?: Date | number;
+}
+/** Checks `t=<unix>,v1=<hex>` over the raw body, as CheckCourt sends it for webhooks and extension requests. */
+export declare function verifySignature(options: VerifySignatureOptions): Promise<void>;
+/**
+ * Verifies a webhook delivery and returns the parsed event. Throws `WebhookSignatureError`.
+ * Answer 2xx quickly and deduplicate on `event.id`: retries carry the same id.
+ */
+export declare function verifyWebhook<E extends WebhookEvent = WebhookEvent>(options: VerifySignatureOptions): Promise<E>;
+/** Builds a valid `CheckCourt-Signature` value, for tests of your own receiver. */
+export declare function signWebhookPayload(secret: string, rawBody: RawBody, timestamp?: number): Promise<string>;
+/** Narrows an event by type, e.g. `if (isEventType(event, "booking.created")) event.data.booking_id`. */
+export declare function isEventType<T extends WebhookEvent["type"]>(event: WebhookEvent, type: T): event is Extract<WebhookEvent, {
+    type: T;
+}>;

package/dist/webhooks.js

@@ -0,0 +1,82 @@
+import { WebhookSignatureError } from "./errors.js";
+import { decodeUtf8, hexDecode, hexEncode, toBytes, utf8 } from "./internal/encoding.js";
+import { hmacSha256, hmacSha256Verify } from "./internal/hmac.js";
+export { APP_LIFECYCLE_EVENT_TYPES, EVENT_TYPES, SUBSCRIBABLE_EVENT_TYPES } from "./events.js";
+export { WebhookSignatureError } from "./errors.js";
+export const SIGNATURE_HEADER = "CheckCourt-Signature";
+export const EVENT_ID_HEADER = "CheckCourt-Event-Id";
+export const EVENT_TYPE_HEADER = "CheckCourt-Event-Type";
+export const INSTALLATION_ID_HEADER = "CheckCourt-Installation-Id";
+export const DEFAULT_TOLERANCE_SECONDS = 300;
+function unixSeconds(now) {
+    if (now === undefined)
+        return Math.floor(Date.now() / 1000);
+    return now instanceof Date ? Math.floor(now.getTime() / 1000) : Math.floor(now);
+}
+function signedBytes(timestamp, body) {
+    const prefix = utf8(`${timestamp}.`);
+    const out = new Uint8Array(prefix.length + body.length);
+    out.set(prefix);
+    out.set(body, prefix.length);
+    return out;
+}
+/** Checks `t=<unix>,v1=<hex>` over the raw body, as CheckCourt sends it for webhooks and extension requests. */
+export async function verifySignature(options) {
+    const { secret, signatureHeader } = options;
+    if (!signatureHeader)
+        throw new WebhookSignatureError("missing_header", `${SIGNATURE_HEADER} header missing`);
+    let timestamp = null;
+    const signatures = [];
+    for (const part of signatureHeader.split(",")) {
+        const [key, value] = part.trim().split("=", 2);
+        if (key === "t" && value && /^\d+$/.test(value))
+            timestamp = Number(value);
+        if (key === "v1" && value) {
+            const bytes = hexDecode(value);
+            if (bytes && bytes.length === 32)
+                signatures.push(bytes);
+        }
+    }
+    if (timestamp === null || signatures.length === 0) {
+        throw new WebhookSignatureError("malformed_header", `${SIGNATURE_HEADER} header has no t= or v1= part`);
+    }
+    const tolerance = options.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS;
+    if (Math.abs(unixSeconds(options.now) - timestamp) > tolerance) {
+        throw new WebhookSignatureError("timestamp_out_of_tolerance", "Signature timestamp is outside the tolerance");
+    }
+    const data = signedBytes(timestamp, toBytes(options.rawBody));
+    for (const signature of signatures) {
+        if (await hmacSha256Verify(secret, data, signature))
+            return;
+    }
+    throw new WebhookSignatureError("signature_mismatch", "Signature does not match the body");
+}
+/**
+ * Verifies a webhook delivery and returns the parsed event. Throws `WebhookSignatureError`.
+ * Answer 2xx quickly and deduplicate on `event.id`: retries carry the same id.
+ */
+export async function verifyWebhook(options) {
+    await verifySignature(options);
+    let parsed;
+    try {
+        const raw = options.rawBody;
+        parsed = JSON.parse(typeof raw === "string" ? raw : decodeUtf8(toBytes(raw)));
+    }
+    catch {
+        throw new WebhookSignatureError("invalid_payload", "Body is not valid JSON");
+    }
+    const event = parsed;
+    if (!event || typeof event !== "object" || typeof event.id !== "string" || typeof event.type !== "string") {
+        throw new WebhookSignatureError("invalid_payload", "Body is not a CheckCourt event");
+    }
+    return parsed;
+}
+/** Builds a valid `CheckCourt-Signature` value, for tests of your own receiver. */
+export async function signWebhookPayload(secret, rawBody, timestamp = Math.floor(Date.now() / 1000)) {
+    const mac = await hmacSha256(secret, signedBytes(timestamp, toBytes(rawBody)));
+    return `t=${timestamp},v1=${hexEncode(mac)}`;
+}
+/** Narrows an event by type, e.g. `if (isEventType(event, "booking.created")) event.data.booking_id`. */
+export function isEventType(event, type) {
+    return event.type === type;
+}