@cutoptim/engine 0.0.1 → 1.0.0

package/dist/types.gen.js

@@ -0,0 +1,3 @@
+// GENERATED by scripts/gen-sdks.ts from the CutOptim Engine API OpenAPI document — DO NOT EDIT.
+// contract 1 · spec sha256 d12a371f3242e7b21df0aa4ecf2df4b2f60f8670bbed7e47bbe3d4cbf08678fb · @cutoptim/engine 1.0.0
+export {};

package/dist/version.d.ts

@@ -0,0 +1 @@
+export declare const VERSION = "1.0.0";

package/dist/version.js

@@ -0,0 +1,2 @@
+// The package version — rewritten by scripts/gen-sdks.ts together with package.json (sent as the User-Agent).
+export const VERSION = '1.0.0';

package/dist/webhooks.d.ts

@@ -0,0 +1,13 @@
+export declare const SIGNATURE_HEADER = "CutOptim-Signature";
+export declare const DEFAULT_TOLERANCE_S = 300;
+export interface VerifyOptions {
+    /** Maximum clock difference in seconds (default 300). */
+    toleranceS?: number;
+    /** Override "now" (unix seconds) — for tests. */
+    nowS?: number;
+}
+/**
+ * True when `header` is a valid CutOptim signature of `rawBody` under one of `secrets`, inside the time window.
+ * `rawBody` must be the exact bytes received (string or Uint8Array).
+ */
+export declare function verifyWebhook(rawBody: string | Uint8Array, header: string | null | undefined, secrets: string | string[], opts?: VerifyOptions): Promise<boolean>;

package/dist/webhooks.js

@@ -0,0 +1,74 @@
+// Verify a CutOptim webhook delivery (the CutOptim-Signature header) — Web Crypto, so it runs on Node 18+, Deno, Bun,
+// Cloudflare Workers and in the browser alike.
+//
+//   CutOptim-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256(secret, "<t>.<raw body>")>[,v1=…]
+//
+// Pass the RAW request body (the exact bytes received) — a body that was parsed and serialised again does not match.
+// During a secret rotation the header carries two v1 values; either matching your secret is enough.
+export const SIGNATURE_HEADER = 'CutOptim-Signature';
+export const DEFAULT_TOLERANCE_S = 300;
+const enc = new TextEncoder();
+async function subtle() {
+    if (globalThis.crypto?.subtle)
+        return globalThis.crypto.subtle;
+    // Node 18 without the global: the same API from node:crypto.
+    const nodeCrypto = await import('node:crypto');
+    return nodeCrypto.webcrypto.subtle;
+}
+function hexToBytes(hex) {
+    const out = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < out.length; i++)
+        out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    return out;
+}
+function timingSafeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a[i] ^ b[i];
+    return diff === 0;
+}
+/**
+ * True when `header` is a valid CutOptim signature of `rawBody` under one of `secrets`, inside the time window.
+ * `rawBody` must be the exact bytes received (string or Uint8Array).
+ */
+export async function verifyWebhook(rawBody, header, secrets, opts = {}) {
+    if (typeof header !== 'string' || header.length > 4096)
+        return false;
+    let t = null;
+    const v1 = [];
+    for (const part of header.split(',')) {
+        const i = part.indexOf('=');
+        if (i <= 0)
+            return false;
+        const k = part.slice(0, i).trim(), v = part.slice(i + 1).trim();
+        if (k === 't') {
+            if (t !== null || !/^\d{1,12}$/.test(v))
+                return false;
+            t = Number(v);
+        }
+        else if (k === 'v1') {
+            if (!/^[0-9a-f]{64}$/.test(v))
+                return false;
+            v1.push(v);
+        }
+    }
+    if (t === null || !v1.length)
+        return false;
+    const now = opts.nowS ?? Math.floor(Date.now() / 1000);
+    if (Math.abs(now - t) > (opts.toleranceS ?? DEFAULT_TOLERANCE_S))
+        return false;
+    const body = typeof rawBody === 'string' ? enc.encode(rawBody) : rawBody;
+    const signed = new Uint8Array(enc.encode(`${t}.`).length + body.length);
+    signed.set(enc.encode(`${t}.`), 0);
+    signed.set(body, enc.encode(`${t}.`).length);
+    const s = await subtle();
+    for (const secret of Array.isArray(secrets) ? secrets : [secrets]) {
+        const key = await s.importKey('raw', enc.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+        const mac = new Uint8Array(await s.sign('HMAC', key, signed));
+        if (v1.some((h) => timingSafeEqual(mac, hexToBytes(h))))
+            return true;
+    }
+    return false;
+}

package/package.json

@@ -1,11 +1,52 @@
 {
   "name": "@cutoptim/engine",
-  "version": "0.0.1",
-  "description": "Placeholder — the official CutOptim Engine API client is released from github.com/cutoptim/engine-js (1.0.0 and later).",
+  "version": "1.0.0",
+  "description": "Official client for the CutOptim Engine API — cutting optimization (2D panels, 1D linear, timber, true-shape nesting) over HTTPS.",
   "license": "MIT",
   "author": "CutOptim <support@cutoptim.com>",
   "homepage": "https://cutoptim.com/engine/reference",
-  "repository": { "type": "git", "url": "git+https://github.com/cutoptim/engine-js.git" },
-  "files": ["README.md"],
-  "publishConfig": { "access": "public" }
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cutoptim/engine-js.git"
+  },
+  "bugs": {
+    "url": "https://github.com/cutoptim/engine-js/issues"
+  },
+  "keywords": [
+    "cutoptim",
+    "cutting optimization",
+    "cut list",
+    "nesting",
+    "panel saw",
+    "api client"
+  ],
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "prepublishOnly": "npm run build"
+  },
+  "devDependencies": {
+    "typescript": "^5.6.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  }
 }