@crylabsorg/suward-sdk 0.0.20

package/dist/cjs/core/url/QueryStringBuilder.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.queryBuilder = queryBuilder;
+const qs_js_1 = require("./qs.js");
+/**
+ * Creates a fluent builder for constructing URL query strings.
+ *
+ * Each `.add()` call serializes its value immediately (like C#'s builder),
+ * so no format tracking is needed — the style is applied at add-time.
+ *
+ * Usage (generated code):
+ *
+ *     const qs = core.url.queryBuilder()
+ *         .add("limit", limit)
+ *         .add("tags", tags, { style: "comma" })   // explode: false
+ *         .mergeAdditional(requestOptions?.queryParams)
+ *         .build();
+ */
+function queryBuilder() {
+    return new QueryStringBuilder();
+}
+class QueryStringBuilder {
+    constructor() {
+        this.parts = new Map();
+    }
+    /**
+     * Adds a query parameter, serializing it immediately.
+     *
+     * By default arrays use "repeat" format (`key=a&key=b`).
+     * Pass `{ style: "comma" }` for OpenAPI `explode: false` parameters
+     * to get comma-separated values (`key=a,b,c`).
+     *
+     * Null / undefined values are silently skipped.
+     */
+    add(key, value, options) {
+        if (value === undefined || value === null) {
+            return this;
+        }
+        const serialized = (0, qs_js_1.toQueryString)({ [key]: value }, { arrayFormat: (options === null || options === void 0 ? void 0 : options.style) === "comma" ? "comma" : "repeat" });
+        if (serialized.length > 0) {
+            this.parts.set(key, serialized);
+        }
+        return this;
+    }
+    /**
+     * Adds multiple query parameters at once from a record.
+     * All parameters use the default "repeat" array format.
+     * Null / undefined values are silently skipped.
+     */
+    addMany(params) {
+        if (params != null) {
+            for (const [key, value] of Object.entries(params)) {
+                this.add(key, value);
+            }
+        }
+        return this;
+    }
+    /**
+     * Merges additional query parameters supplied at call-time via
+     * `requestOptions.queryParams`. Overrides existing keys (last-write-wins).
+     */
+    mergeAdditional(additionalParams) {
+        if (additionalParams != null) {
+            for (const [key, value] of Object.entries(additionalParams)) {
+                if (value === undefined || value === null) {
+                    continue;
+                }
+                const serialized = (0, qs_js_1.toQueryString)({ [key]: value }, { arrayFormat: "repeat" });
+                if (serialized.length > 0) {
+                    this.parts.set(key, serialized);
+                }
+            }
+        }
+        return this;
+    }
+    /**
+     * Returns the assembled query string (without the leading `?`).
+     * Returns an empty string when no parameters were added.
+     */
+    build() {
+        return [...this.parts.values()].join("&");
+    }
+}

package/dist/cjs/core/url/encodePathParam.d.ts

@@ -0,0 +1 @@
+export declare function encodePathParam(param: unknown): string;

package/dist/cjs/core/url/encodePathParam.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encodePathParam = encodePathParam;
+function encodePathParam(param) {
+    if (param === null) {
+        return "null";
+    }
+    const typeofParam = typeof param;
+    switch (typeofParam) {
+        case "undefined":
+            return "undefined";
+        case "string":
+        case "number":
+        case "boolean":
+            break;
+        default:
+            param = String(param);
+            break;
+    }
+    return encodeURIComponent(param);
+}

package/dist/cjs/core/url/index.d.ts

@@ -0,0 +1,4 @@
+export { encodePathParam } from "./encodePathParam.js";
+export { join } from "./join.js";
+export { queryBuilder } from "./QueryStringBuilder.js";
+export { toQueryString } from "./qs.js";

package/dist/cjs/core/url/index.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toQueryString = exports.queryBuilder = exports.join = exports.encodePathParam = void 0;
+var encodePathParam_js_1 = require("./encodePathParam.js");
+Object.defineProperty(exports, "encodePathParam", { enumerable: true, get: function () { return encodePathParam_js_1.encodePathParam; } });
+var join_js_1 = require("./join.js");
+Object.defineProperty(exports, "join", { enumerable: true, get: function () { return join_js_1.join; } });
+var QueryStringBuilder_js_1 = require("./QueryStringBuilder.js");
+Object.defineProperty(exports, "queryBuilder", { enumerable: true, get: function () { return QueryStringBuilder_js_1.queryBuilder; } });
+var qs_js_1 = require("./qs.js");
+Object.defineProperty(exports, "toQueryString", { enumerable: true, get: function () { return qs_js_1.toQueryString; } });

package/dist/cjs/core/url/join.d.ts

@@ -0,0 +1 @@
+export declare function join(base: string, ...segments: string[]): string;

package/dist/cjs/core/url/join.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.join = join;
+function join(base, ...segments) {
+    if (!base) {
+        return "";
+    }
+    if (segments.length === 0) {
+        return base;
+    }
+    if (base.includes("://")) {
+        let url;
+        try {
+            url = new URL(base);
+        }
+        catch (_a) {
+            return joinPath(base, ...segments);
+        }
+        const lastSegment = segments[segments.length - 1];
+        const shouldPreserveTrailingSlash = lastSegment === null || lastSegment === void 0 ? void 0 : lastSegment.endsWith("/");
+        for (const segment of segments) {
+            const cleanSegment = trimSlashes(segment);
+            if (cleanSegment) {
+                url.pathname = joinPathSegments(url.pathname, cleanSegment);
+            }
+        }
+        if (shouldPreserveTrailingSlash && !url.pathname.endsWith("/")) {
+            url.pathname += "/";
+        }
+        return url.toString();
+    }
+    return joinPath(base, ...segments);
+}
+function joinPath(base, ...segments) {
+    if (segments.length === 0) {
+        return base;
+    }
+    let result = base;
+    const lastSegment = segments[segments.length - 1];
+    const shouldPreserveTrailingSlash = lastSegment === null || lastSegment === void 0 ? void 0 : lastSegment.endsWith("/");
+    for (const segment of segments) {
+        const cleanSegment = trimSlashes(segment);
+        if (cleanSegment) {
+            result = joinPathSegments(result, cleanSegment);
+        }
+    }
+    if (shouldPreserveTrailingSlash && !result.endsWith("/")) {
+        result += "/";
+    }
+    return result;
+}
+function joinPathSegments(left, right) {
+    if (left.endsWith("/")) {
+        return left + right;
+    }
+    return `${left}/${right}`;
+}
+function trimSlashes(str) {
+    if (!str)
+        return str;
+    let start = 0;
+    let end = str.length;
+    if (str.startsWith("/"))
+        start = 1;
+    if (str.endsWith("/"))
+        end = str.length - 1;
+    return start === 0 && end === str.length ? str : str.slice(start, end);
+}

package/dist/cjs/core/url/qs.d.ts

@@ -0,0 +1,7 @@
+type ArrayFormat = "indices" | "repeat" | "comma";
+interface QueryStringOptions {
+    arrayFormat?: ArrayFormat;
+    encode?: boolean;
+}
+export declare function toQueryString(obj: unknown, options?: QueryStringOptions): string;
+export {};

package/dist/cjs/core/url/qs.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toQueryString = toQueryString;
+const defaultQsOptions = {
+    arrayFormat: "indices",
+    encode: true,
+};
+function encodeValue(value, shouldEncode) {
+    if (value === undefined) {
+        return "";
+    }
+    if (value === null) {
+        return "";
+    }
+    const stringValue = String(value);
+    return shouldEncode ? encodeURIComponent(stringValue) : stringValue;
+}
+function stringifyObject(obj, prefix = "", options) {
+    const parts = [];
+    for (const [key, value] of Object.entries(obj)) {
+        const fullKey = prefix ? `${prefix}[${key}]` : key;
+        if (value == null) {
+            continue;
+        }
+        if (Array.isArray(value)) {
+            if (value.length === 0) {
+                continue;
+            }
+            const effectiveFormat = options.arrayFormat;
+            if (effectiveFormat === "comma") {
+                const encodedKey = options.encode ? encodeURIComponent(fullKey) : fullKey;
+                const encodedValues = value
+                    .filter((item) => item !== undefined && item !== null)
+                    .map((item) => encodeValue(item, options.encode));
+                if (encodedValues.length > 0) {
+                    parts.push(`${encodedKey}=${encodedValues.join(",")}`);
+                }
+            }
+            else {
+                for (let i = 0; i < value.length; i++) {
+                    const item = value[i];
+                    if (item == null) {
+                        continue;
+                    }
+                    if (typeof item === "object" && !Array.isArray(item) && item !== null) {
+                        const arrayKey = effectiveFormat === "indices" ? `${fullKey}[${i}]` : fullKey;
+                        parts.push(...stringifyObject(item, arrayKey, options));
+                    }
+                    else {
+                        const arrayKey = effectiveFormat === "indices" ? `${fullKey}[${i}]` : fullKey;
+                        const encodedKey = options.encode ? encodeURIComponent(arrayKey) : arrayKey;
+                        parts.push(`${encodedKey}=${encodeValue(item, options.encode)}`);
+                    }
+                }
+            }
+        }
+        else if (typeof value === "object" && value !== null) {
+            if (Object.keys(value).length === 0) {
+                continue;
+            }
+            parts.push(...stringifyObject(value, fullKey, options));
+        }
+        else {
+            const encodedKey = options.encode ? encodeURIComponent(fullKey) : fullKey;
+            parts.push(`${encodedKey}=${encodeValue(value, options.encode)}`);
+        }
+    }
+    return parts;
+}
+function toQueryString(obj, options) {
+    if (obj == null || typeof obj !== "object") {
+        return "";
+    }
+    const parts = stringifyObject(obj, "", Object.assign(Object.assign({}, defaultQsOptions), options));
+    return parts.join("&");
+}

package/dist/cjs/core/webhooks/computeHmacSignature.d.ts

@@ -0,0 +1,9 @@
+import type { SignatureEncoding } from "./types.js";
+export type HmacAlgorithm = "sha256" | "sha1" | "sha384" | "sha512";
+export interface ComputeHmacSignatureArgs {
+    payload: string;
+    secret: string;
+    algorithm: HmacAlgorithm;
+    encoding: SignatureEncoding;
+}
+export declare function computeHmacSignature(args: ComputeHmacSignatureArgs): Promise<string>;

package/dist/cjs/core/webhooks/computeHmacSignature.js

@@ -0,0 +1,84 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeHmacSignature = computeHmacSignature;
+const index_js_1 = require("../runtime/index.js");
+function hmacAlgorithmToSubtleName(algorithm) {
+    switch (algorithm) {
+        case "sha1":
+            return "SHA-1";
+        case "sha256":
+            return "SHA-256";
+        case "sha384":
+            return "SHA-384";
+        case "sha512":
+            return "SHA-512";
+    }
+}
+function computeHmacSignature(args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (index_js_1.RUNTIME.type === "node") {
+            const crypto = yield Promise.resolve().then(() => __importStar(require("crypto")));
+            const hmac = crypto.createHmac(args.algorithm, args.secret);
+            hmac.update(args.payload);
+            return hmac.digest(args.encoding);
+        }
+        const subtle = globalThis.crypto.subtle;
+        const enc = new TextEncoder();
+        const keyMaterial = yield subtle.importKey("raw", enc.encode(args.secret), { name: "HMAC", hash: hmacAlgorithmToSubtleName(args.algorithm) }, false, ["sign"]);
+        const signatureBuffer = yield subtle.sign("HMAC", keyMaterial, enc.encode(args.payload));
+        const bytes = new Uint8Array(signatureBuffer);
+        if (args.encoding === "hex") {
+            return Array.from(bytes)
+                .map((b) => b.toString(16).padStart(2, "0"))
+                .join("");
+        }
+        // base64
+        let binary = "";
+        for (const byte of bytes) {
+            binary += String.fromCharCode(byte);
+        }
+        return btoa(binary);
+    });
+}

package/dist/cjs/core/webhooks/fetchJwks.d.ts

@@ -0,0 +1,15 @@
+export interface FetchJwksArgs {
+    url: string;
+    keyId?: string;
+}
+/**
+ * Fetches a public key from a JWKS endpoint and returns it as a PEM string.
+ *
+ * Only RSA keys (reconstructed from `n`/`e`) and keys with an `x5c` certificate chain are supported.
+ * EC (kty: "EC") and OKP (kty: "OKP") keys are **not** supported and will throw an error.
+ *
+ * @throws {Error} If the JWKS endpoint returns a non-OK response.
+ * @throws {Error} If no key matching `keyId` is found (after one cache-busting retry).
+ * @throws {Error} If the selected key has an unsupported type (e.g. EC or OKP).
+ */
+export declare function fetchJwks(args: FetchJwksArgs): Promise<string>;

package/dist/cjs/core/webhooks/fetchJwks.js

@@ -0,0 +1,156 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchJwks = fetchJwks;
+const CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+const CACHE_MAX_SIZE = 50;
+const cache = new Map();
+function base64UrlToBase64(base64url) {
+    let base64 = base64url.replace(/-/g, "+").replace(/_/g, "/");
+    while (base64.length % 4 !== 0) {
+        base64 += "=";
+    }
+    return base64;
+}
+function jwkToPem(jwk) {
+    if (jwk.x5c != null && jwk.x5c.length > 0) {
+        const cert = jwk.x5c[0];
+        return `-----BEGIN CERTIFICATE-----\n${cert}\n-----END CERTIFICATE-----`;
+    }
+    if (jwk.kty === "RSA" && jwk.n != null && jwk.e != null) {
+        return constructRsaPem(jwk.n, jwk.e);
+    }
+    throw new Error(`Unsupported JWK key type for PEM conversion: ${jwk.kty}`);
+}
+function base64UrlToBytes(base64url) {
+    const binary = atob(base64UrlToBase64(base64url));
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+function concatBytes(arrays) {
+    const total = arrays.reduce((sum, a) => sum + a.length, 0);
+    const result = new Uint8Array(total);
+    let offset = 0;
+    for (const array of arrays) {
+        result.set(array, offset);
+        offset += array.length;
+    }
+    return result;
+}
+function constructRsaPem(nBase64Url, eBase64Url) {
+    const nBytes = base64UrlToBytes(nBase64Url);
+    const eBytes = base64UrlToBytes(eBase64Url);
+    // ASN.1 DER encoding of RSA public key
+    const nEncoded = asn1Integer(nBytes);
+    const eEncoded = asn1Integer(eBytes);
+    const sequence = asn1Sequence(concatBytes([nEncoded, eEncoded]));
+    const bitString = asn1BitString(sequence);
+    const algorithmIdentifier = asn1Sequence(new Uint8Array([
+        // OID for rsaEncryption (1.2.840.113549.1.1.1)
+        0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01,
+        // NULL
+        0x05, 0x00,
+    ]));
+    const spki = asn1Sequence(concatBytes([algorithmIdentifier, bitString]));
+    let binary = "";
+    for (const byte of spki) {
+        binary += String.fromCharCode(byte);
+    }
+    const base64 = btoa(binary);
+    const lines = [];
+    for (let i = 0; i < base64.length; i += 64) {
+        lines.push(base64.substring(i, i + 64));
+    }
+    return `-----BEGIN PUBLIC KEY-----\n${lines.join("\n")}\n-----END PUBLIC KEY-----`;
+}
+function asn1Length(length) {
+    if (length < 0x80) {
+        return new Uint8Array([length]);
+    }
+    const bytes = [];
+    let temp = length;
+    while (temp > 0) {
+        bytes.unshift(temp & 0xff);
+        temp >>= 8;
+    }
+    return new Uint8Array([0x80 | bytes.length, ...bytes]);
+}
+function asn1Integer(bytes) {
+    // Add leading zero if high bit is set (to ensure positive integer)
+    const needsPadding = bytes[0] >= 0x80;
+    const content = needsPadding ? concatBytes([new Uint8Array([0x00]), bytes]) : bytes;
+    return concatBytes([new Uint8Array([0x02]), asn1Length(content.length), content]);
+}
+function asn1Sequence(content) {
+    return concatBytes([new Uint8Array([0x30]), asn1Length(content.length), content]);
+}
+function asn1BitString(content) {
+    // Prepend a zero byte for unused bits
+    return concatBytes([new Uint8Array([0x03]), asn1Length(content.length + 1), new Uint8Array([0x00]), content]);
+}
+function fetchKeys(url) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const cached = cache.get(url);
+        if (cached != null && Date.now() - cached.fetchedAt < CACHE_TTL_MS) {
+            return cached.keys;
+        }
+        const response = yield fetch(url);
+        if (!response.ok) {
+            throw new Error(`Failed to fetch JWKS from ${url}: ${response.status} ${response.statusText}`);
+        }
+        const jwks = (yield response.json());
+        if (cache.size >= CACHE_MAX_SIZE) {
+            for (const key of cache.keys()) {
+                cache.delete(key);
+                break;
+            }
+        }
+        cache.set(url, { keys: jwks.keys, fetchedAt: Date.now() });
+        return jwks.keys;
+    });
+}
+/**
+ * Fetches a public key from a JWKS endpoint and returns it as a PEM string.
+ *
+ * Only RSA keys (reconstructed from `n`/`e`) and keys with an `x5c` certificate chain are supported.
+ * EC (kty: "EC") and OKP (kty: "OKP") keys are **not** supported and will throw an error.
+ *
+ * @throws {Error} If the JWKS endpoint returns a non-OK response.
+ * @throws {Error} If no key matching `keyId` is found (after one cache-busting retry).
+ * @throws {Error} If the selected key has an unsupported type (e.g. EC or OKP).
+ */
+function fetchJwks(args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const keys = yield fetchKeys(args.url);
+        let selectedKey;
+        if (args.keyId != null) {
+            selectedKey = keys.find((k) => k.kid === args.keyId);
+            if (selectedKey == null) {
+                // Invalidate cache and retry once
+                cache.delete(args.url);
+                const refreshedKeys = yield fetchKeys(args.url);
+                selectedKey = refreshedKeys.find((k) => k.kid === args.keyId);
+            }
+        }
+        else {
+            selectedKey = keys[0];
+        }
+        if (selectedKey == null) {
+            throw new Error(args.keyId != null
+                ? `No key found with kid "${args.keyId}" in JWKS at ${args.url}`
+                : `No keys found in JWKS at ${args.url}`);
+        }
+        return jwkToPem(selectedKey);
+    });
+}

package/dist/cjs/core/webhooks/index.d.ts

@@ -0,0 +1,8 @@
+export type { ComputeHmacSignatureArgs, HmacAlgorithm } from "./computeHmacSignature.js";
+export { computeHmacSignature } from "./computeHmacSignature.js";
+export type { FetchJwksArgs } from "./fetchJwks.js";
+export { fetchJwks } from "./fetchJwks.js";
+export { timingSafeEqual } from "./timingSafeEqual.js";
+export type { SignatureEncoding } from "./types.js";
+export type { AsymmetricAlgorithm, VerifyAsymmetricSignatureArgs } from "./verifyAsymmetricSignature.js";
+export { verifyAsymmetricSignature } from "./verifyAsymmetricSignature.js";

package/dist/cjs/core/webhooks/index.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyAsymmetricSignature = exports.timingSafeEqual = exports.fetchJwks = exports.computeHmacSignature = void 0;
+var computeHmacSignature_js_1 = require("./computeHmacSignature.js");
+Object.defineProperty(exports, "computeHmacSignature", { enumerable: true, get: function () { return computeHmacSignature_js_1.computeHmacSignature; } });
+var fetchJwks_js_1 = require("./fetchJwks.js");
+Object.defineProperty(exports, "fetchJwks", { enumerable: true, get: function () { return fetchJwks_js_1.fetchJwks; } });
+var timingSafeEqual_js_1 = require("./timingSafeEqual.js");
+Object.defineProperty(exports, "timingSafeEqual", { enumerable: true, get: function () { return timingSafeEqual_js_1.timingSafeEqual; } });
+var verifyAsymmetricSignature_js_1 = require("./verifyAsymmetricSignature.js");
+Object.defineProperty(exports, "verifyAsymmetricSignature", { enumerable: true, get: function () { return verifyAsymmetricSignature_js_1.verifyAsymmetricSignature; } });

package/dist/cjs/core/webhooks/timingSafeEqual.d.ts

@@ -0,0 +1 @@
+export declare function timingSafeEqual(a: string, b: string): Promise<boolean>;

package/dist/cjs/core/webhooks/timingSafeEqual.js

@@ -0,0 +1,85 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.timingSafeEqual = timingSafeEqual;
+const index_js_1 = require("../runtime/index.js");
+function timingSafeEqual(a, b) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (index_js_1.RUNTIME.type === "node") {
+            const crypto = yield Promise.resolve().then(() => __importStar(require("crypto")));
+            const bufA = Buffer.from(a);
+            const bufB = Buffer.from(b);
+            if (bufA.length !== bufB.length) {
+                // Still perform comparison to avoid leaking length via timing
+                const dummy = Buffer.alloc(bufA.length);
+                crypto.timingSafeEqual(bufA, dummy);
+                return false;
+            }
+            return crypto.timingSafeEqual(bufA, bufB);
+        }
+        // Fallback: constant-time XOR comparison using Uint8Array
+        const enc = new TextEncoder();
+        const bytesA = enc.encode(a);
+        const bytesB = enc.encode(b);
+        if (bytesA.length !== bytesB.length) {
+            // XOR each byte of bytesA against bytesB[0] (a runtime value) so the
+            // loop cannot be trivially folded to a constant by the engine. This is
+            // best-effort timing-stability: JS has no guarantee, but we avoid an
+            // obvious early-exit that would trivially leak length via timing.
+            const pivot = (_a = bytesB[0]) !== null && _a !== void 0 ? _a : 0;
+            let sink = 0;
+            for (let i = 0; i < bytesA.length; i++) {
+                sink |= bytesA[i] ^ pivot;
+            }
+            void sink;
+            return false;
+        }
+        let result = 0;
+        for (let i = 0; i < bytesA.length; i++) {
+            result |= bytesA[i] ^ bytesB[i];
+        }
+        return result === 0;
+    });
+}

package/dist/cjs/core/webhooks/types.d.ts

@@ -0,0 +1 @@
+export type SignatureEncoding = "base64" | "hex";

package/dist/cjs/core/webhooks/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });