@evumi/berth 0.0.0-stage → 0.0.3

package/dist/esm/client.js

@@ -0,0 +1,159 @@
+import { BerthError, responseError } from './errors.js';
+import { decodeBody, encodeBody } from './body.js';
+import { env } from './util.js';
+function wireMessage(body, o) {
+    const out = encodeBody(body, o.contentType);
+    if (o.delaySeconds !== undefined)
+        out.delay_seconds = o.delaySeconds;
+    if (o.dedupId !== undefined)
+        out.dedup_id = o.dedupId;
+    return out;
+}
+/** Scheduled time from the wire: Unix ms, or an RFC 3339 string. */
+function toMs(v) {
+    if (typeof v === 'number')
+        return v;
+    const t = typeof v === 'string' ? Date.parse(v) : Number.NaN;
+    if (Number.isNaN(t))
+        throw new BerthError('invalid_response', 'scheduled_time is neither Unix ms nor RFC 3339');
+    return t;
+}
+const seg = (s) => encodeURIComponent(s);
+/** A client for queues and alarms. URL and token default to the environment, read lazily. */
+export function createClient(opts = {}) {
+    const timeoutMs = opts.timeoutMs ?? 10_000;
+    async function request(method, path, body) {
+        const url = opts.url ?? env('BERTH_CONFIG_URL');
+        const token = opts.token ?? env('BERTH_CONFIG_TOKEN');
+        if (!url || !token)
+            throw new BerthError('missing_env', 'BERTH_CONFIG_URL and BERTH_CONFIG_TOKEN are not set');
+        const base = url.replace(/\/+$/, '').replace(/\/v1$/, '') + '/v1';
+        const f = opts.fetch ?? globalThis.fetch;
+        if (!f)
+            throw new BerthError('network', 'no fetch available: pass one in createClient({ fetch })');
+        const headers = { authorization: `Bearer ${token}`, accept: 'application/json' };
+        if (body !== undefined)
+            headers['content-type'] = 'application/json';
+        const ctrl = new AbortController();
+        let timedOut = false;
+        const timer = setTimeout(() => ((timedOut = true), ctrl.abort()), timeoutMs);
+        timer.unref?.();
+        let status;
+        let text;
+        let retryAfter;
+        try {
+            const res = await f(base + path, { method, headers, body: body === undefined ? undefined : JSON.stringify(body), signal: ctrl.signal });
+            status = res.status;
+            retryAfter = res.headers.get('retry-after');
+            text = await res.text();
+        }
+        catch (e) {
+            if (timedOut)
+                throw new BerthError('timeout', `request timed out after ${timeoutMs} ms`);
+            throw new BerthError('network', `request failed: ${e?.message ?? e}`, { cause: e });
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (status < 200 || status > 299)
+            throw responseError(status, text, retryAfter);
+        if (status === 204 || text === '')
+            return undefined;
+        try {
+            return JSON.parse(text);
+        }
+        catch (e) {
+            throw new BerthError('invalid_response', 'response is not JSON', { status, cause: e });
+        }
+    }
+    function queue(name) {
+        const p = `/queues/${seg(name)}/messages`;
+        return {
+            name,
+            async send(body, o = {}) {
+                return request('POST', p, wireMessage(body, o));
+            },
+            async sendBatch(messages, o = {}) {
+                const req = {
+                    messages: messages.map((m) => {
+                        if (m === null || typeof m !== 'object' || !('body' in m))
+                            throw new BerthError('bad_request', 'a batch message is { body, contentType?, delaySeconds?, dedupId? }');
+                        return wireMessage(m.body, m);
+                    }),
+                };
+                if (o.delaySeconds !== undefined)
+                    req.delay_seconds = o.delaySeconds;
+                const r = await request('POST', `${p}/batch`, req);
+                const items = r?.items ?? [];
+                return { ids: items.map((i) => i.id), items };
+            },
+            async pull(o = {}) {
+                const req = {};
+                if (o.batchSize !== undefined)
+                    req.batch_size = o.batchSize;
+                if (o.visibilityTimeoutMs !== undefined)
+                    req.visibility_timeout_ms = o.visibilityTimeoutMs;
+                const r = await request('POST', `${p}/pull`, req);
+                return {
+                    messages: (r?.messages ?? []).map((m) => {
+                        const contentType = (m.content_type || 'json');
+                        return {
+                            id: String(m.id),
+                            leaseId: String(m.lease_id),
+                            body: decodeBody(m.body, contentType),
+                            contentType,
+                            attempts: Number(m.attempts ?? 0),
+                            timestamp: Number(m.timestamp_ms ?? 0),
+                        };
+                    }),
+                };
+            },
+            async ack(req) {
+                const body = {
+                    acks: (req.acks ?? []).map((lease_id) => ({ lease_id })),
+                    retries: (req.retries ?? []).map((r) => (r.delaySeconds === undefined ? { lease_id: r.leaseId } : { lease_id: r.leaseId, delay_seconds: r.delaySeconds })),
+                };
+                return request('POST', `${p}/ack`, body);
+            },
+        };
+    }
+    function alarm(key) {
+        const p = `/alarms/${seg(key)}`;
+        const get = async () => {
+            try {
+                const a = await request('GET', p);
+                return { key: a.key, scheduledTime: toMs(a.scheduled_time), data: a.data };
+            }
+            catch (e) {
+                if (e instanceof BerthError && e.status === 404 && e.code === 'not_found')
+                    return null;
+                throw e;
+            }
+        };
+        return {
+            key,
+            async setAlarm(scheduledTime, o = {}) {
+                const ms = scheduledTime instanceof Date ? scheduledTime.getTime() : scheduledTime;
+                if (typeof ms !== 'number' || !Number.isFinite(ms))
+                    throw new BerthError('bad_request', 'scheduledTime must be a Date or Unix milliseconds');
+                const body = { scheduled_time: Math.round(ms) };
+                if (o.data !== undefined)
+                    body.data = o.data;
+                await request('PUT', p, body);
+            },
+            async getAlarm() {
+                return (await get())?.scheduledTime ?? null;
+            },
+            get,
+            async deleteAlarm() {
+                await request('DELETE', p);
+            },
+        };
+    }
+    return { queue, alarm };
+}
+const defaultClient = createClient();
+/** A queue of this environment, using BERTH_CONFIG_URL / BERTH_CONFIG_TOKEN (read at each request). */
+export const queue = (name) => defaultClient.queue(name);
+/** A named alarm of this environment, using BERTH_CONFIG_URL / BERTH_CONFIG_TOKEN (read at each request). */
+export const alarm = (key) => defaultClient.alarm(key);

package/dist/esm/errors.d.ts

@@ -0,0 +1,19 @@
+/** Error codes. Server codes come from the response body; the last four are raised by the client. */
+export type ErrorCode = 'unauthorized' | 'capability_disabled' | 'not_found' | 'bad_request' | 'conflict' | 'too_large' | 'rate_limited' | 'quota_exceeded' | 'unavailable' | 'queue_full' | 'timeout' | 'network' | 'invalid_response' | 'missing_env' | (string & {});
+export declare class BerthError extends Error {
+    name: string;
+    readonly code: ErrorCode;
+    /** HTTP status, when the error came from a response. */
+    readonly status?: number;
+    /** Parsed Retry-After, for 429 responses. */
+    readonly retryAfterMs?: number;
+    constructor(code: ErrorCode, message: string, extra?: {
+        status?: number;
+        retryAfterMs?: number;
+        cause?: unknown;
+    });
+}
+/** Builds an error from a non-2xx response body of the form {"error":{"code","message"}}. */
+export declare function responseError(status: number, body: string, retryAfter: string | null): BerthError;
+/** Retry-After is either delta-seconds or an HTTP date. */
+export declare function parseRetryAfter(v: string | null): number | undefined;

package/dist/esm/errors.js

@@ -0,0 +1,50 @@
+export class BerthError extends Error {
+    name = 'BerthError';
+    code;
+    /** HTTP status, when the error came from a response. */
+    status;
+    /** Parsed Retry-After, for 429 responses. */
+    retryAfterMs;
+    constructor(code, message, extra = {}) {
+        super(message, extra.cause === undefined ? undefined : { cause: extra.cause });
+        this.code = code;
+        this.status = extra.status;
+        this.retryAfterMs = extra.retryAfterMs;
+    }
+}
+const statusCodes = {
+    400: 'bad_request',
+    401: 'unauthorized',
+    403: 'unauthorized',
+    404: 'not_found',
+    409: 'conflict',
+    413: 'too_large',
+    429: 'rate_limited',
+    507: 'queue_full',
+};
+/** Builds an error from a non-2xx response body of the form {"error":{"code","message"}}. */
+export function responseError(status, body, retryAfter) {
+    let code = statusCodes[status] ?? (status >= 500 ? 'unavailable' : 'bad_request');
+    let message = `request failed with HTTP ${status}`;
+    try {
+        const e = JSON.parse(body)?.error;
+        if (typeof e?.code === 'string' && e.code)
+            code = e.code;
+        if (typeof e?.message === 'string' && e.message)
+            message = e.message;
+    }
+    catch {
+        // Non-JSON error body (proxy page etc.): keep the generic message.
+    }
+    return new BerthError(code, message, { status, retryAfterMs: status === 429 ? parseRetryAfter(retryAfter) : undefined });
+}
+/** Retry-After is either delta-seconds or an HTTP date. */
+export function parseRetryAfter(v) {
+    if (!v)
+        return undefined;
+    const s = Number(v);
+    if (Number.isFinite(s))
+        return Math.max(0, s * 1000);
+    const t = Date.parse(v);
+    return Number.isNaN(t) ? undefined : Math.max(0, t - Date.now());
+}

package/dist/esm/handler.d.ts

@@ -0,0 +1,83 @@
+import { type ContentType } from './body.js';
+export type Env = Record<string, string | undefined>;
+/** One message of a pushed batch, like a Workers Queue Message. */
+export interface Message<T = unknown> {
+    readonly id: string;
+    /** Send time. */
+    readonly timestamp: Date;
+    /** JSON value (json), string (text) or Uint8Array (bytes). */
+    readonly body: T;
+    readonly contentType: ContentType;
+    /** Starts at 1. */
+    readonly attempts: number;
+    /** Acknowledge this message even if the batch is retried. */
+    ack(): void;
+    /** Retry this message (after delaySeconds, else with the backoff). */
+    retry(opts?: {
+        delaySeconds?: number;
+    }): void;
+}
+/** A pushed batch, like a Workers MessageBatch. Messages not acked or retried are acknowledged when the handler returns. */
+export interface MessageBatch<T = unknown> {
+    readonly queue: string;
+    readonly messages: readonly Message<T>[];
+    ackAll(): void;
+    retryAll(opts?: {
+        delaySeconds?: number;
+    }): void;
+}
+export interface AlarmInfo<T = unknown> {
+    key: string;
+    /** Unix milliseconds. */
+    scheduledTime: number;
+    data: T;
+    retryCount: number;
+    isRetry: boolean;
+}
+/** A Cron HTTP target call, like a Workers ScheduledController. */
+export interface ScheduledController {
+    cron: string;
+    /** Unix milliseconds. */
+    scheduledTime: number;
+    name: string;
+    /** Accepted for Workers compatibility; does nothing. */
+    noRetry(): void;
+}
+export interface ExecutionContext {
+    /** The response waits for these (failures are ignored). */
+    waitUntil(p: Promise<unknown>): void;
+}
+export interface Handlers {
+    queue?(batch: MessageBatch<any>, env: Env, ctx: ExecutionContext): unknown | Promise<unknown>;
+    alarm?(alarm: AlarmInfo<any>, env: Env, ctx: ExecutionContext): unknown | Promise<unknown>;
+    scheduled?(controller: ScheduledController, env: Env, ctx: ExecutionContext): unknown | Promise<unknown>;
+    /** Default: env BERTH_SIGNING_SECRET, read at each request. */
+    secret?: string;
+    /** Default 300. */
+    toleranceSeconds?: number;
+}
+export type FetchHandler = (request: Request) => Promise<Response>;
+/**
+ * A Fetch API handler for everything the platform pushes: queue batches, alarms and Cron HTTP
+ * targets, told apart by Berth-Source. It verifies Berth-Signature (401 when it fails), calls the
+ * matching handler and answers the platform: 200 with the batch settlement, 204 for an alarm or
+ * cron call, 500 when the handler throws (the platform retries), 404 when there is no handler.
+ */
+export declare function createHandler(handlers: Handlers): FetchHandler;
+/** The parts of node:http's IncomingMessage (or an Express request) toNodeHandler uses. */
+export interface NodeRequest extends AsyncIterable<unknown> {
+    method?: string;
+    url?: string;
+    headers: Record<string, string | string[] | undefined>;
+    /** Set by body parsers. A Buffer or string is used as the raw body; anything else is ignored. */
+    body?: unknown;
+    readableEnded?: boolean;
+}
+/** The parts of node:http's ServerResponse used. */
+export interface NodeResponse {
+    statusCode: number;
+    setHeader(name: string, value: string): unknown;
+    end(chunk?: Uint8Array | string): unknown;
+}
+/** Adapts a Fetch handler to node:http / Express: `app.post('/berth', toNodeHandler(handler))`. */
+export declare function toNodeHandler(handler: FetchHandler): (req: NodeRequest, res: NodeResponse) => Promise<void>;

package/dist/esm/handler.js

@@ -0,0 +1,164 @@
+import { decodeBody } from './body.js';
+import { checkSignature } from './signature.js';
+import { env as readEnv } from './util.js';
+function snapshotEnv() {
+    const g = globalThis;
+    return { ...(g.process?.env ?? {}) };
+}
+const json = (status, v) => new Response(JSON.stringify(v), { status, headers: { 'content-type': 'application/json' } });
+const text = (status, s) => new Response(s, { status, headers: { 'content-type': 'text/plain; charset=utf-8' } });
+function makeBatch(raw) {
+    const settle = { acks: [], retries: [] };
+    const decided = new Set();
+    const delay = (o) => (o?.delaySeconds === undefined ? {} : { delaySeconds: o.delaySeconds });
+    const list = Array.isArray(raw.messages) ? raw.messages : [];
+    const messages = list.map((m) => {
+        const id = String(m.id);
+        const contentType = (m.contentType || 'json');
+        return {
+            id,
+            timestamp: new Date(Number(m.timestamp)),
+            body: decodeBody(m.body, contentType),
+            contentType,
+            attempts: Number(m.attempts ?? 1),
+            // The first call on a message wins, as in Workers.
+            ack() {
+                if (decided.has(id))
+                    return;
+                decided.add(id);
+                settle.acks.push(id);
+            },
+            retry(o) {
+                if (decided.has(id))
+                    return;
+                decided.add(id);
+                settle.retries.push({ id, ...delay(o) });
+            },
+        };
+    });
+    const batch = {
+        queue: String(raw.queue ?? ''),
+        messages,
+        ackAll() {
+            settle.ackAll = true;
+            delete settle.retryAll;
+        },
+        retryAll(o) {
+            settle.retryAll = delay(o);
+            delete settle.ackAll;
+        },
+    };
+    return { batch, settle };
+}
+/**
+ * A Fetch API handler for everything the platform pushes: queue batches, alarms and Cron HTTP
+ * targets, told apart by Berth-Source. It verifies Berth-Signature (401 when it fails), calls the
+ * matching handler and answers the platform: 200 with the batch settlement, 204 for an alarm or
+ * cron call, 500 when the handler throws (the platform retries), 404 when there is no handler.
+ */
+export function createHandler(handlers) {
+    return async (request) => {
+        const secret = handlers.secret ?? readEnv('BERTH_SIGNING_SECRET') ?? '';
+        const raw = new Uint8Array(await request.arrayBuffer());
+        if (!secret)
+            return text(401, 'BERTH_SIGNING_SECRET is not set');
+        const bad = checkSignature(secret, request.headers.get('Berth-Signature'), raw, { toleranceSeconds: handlers.toleranceSeconds });
+        if (bad)
+            return text(401, `invalid signature: ${bad}`);
+        let payload;
+        try {
+            payload = JSON.parse(new TextDecoder().decode(raw)) ?? {};
+        }
+        catch {
+            return text(400, 'body is not JSON');
+        }
+        const env = snapshotEnv();
+        const pending = [];
+        const ctx = { waitUntil: (p) => void pending.push(Promise.resolve(p).catch(() => { })) };
+        const source = request.headers.get('Berth-Source');
+        try {
+            switch (source) {
+                case 'queue': {
+                    if (!handlers.queue)
+                        return text(404, 'no queue handler');
+                    const { batch, settle } = makeBatch(payload);
+                    await handlers.queue(batch, env, ctx);
+                    await Promise.all(pending);
+                    return json(200, settle);
+                }
+                case 'alarm': {
+                    if (!handlers.alarm)
+                        return text(404, 'no alarm handler');
+                    await handlers.alarm({
+                        key: String(payload.key ?? ''),
+                        scheduledTime: Number(payload.scheduledTime),
+                        data: payload.data,
+                        retryCount: Number(payload.retryCount ?? 0),
+                        isRetry: Boolean(payload.isRetry),
+                    }, env, ctx);
+                    break;
+                }
+                case 'cron': {
+                    if (!handlers.scheduled)
+                        return text(404, 'no scheduled handler');
+                    await handlers.scheduled({ cron: String(payload.cron ?? ''), scheduledTime: Number(payload.scheduledTime), name: String(payload.name ?? ''), noRetry() { } }, env, ctx);
+                    break;
+                }
+                default:
+                    return text(404, `unknown Berth-Source ${JSON.stringify(source)}`);
+            }
+            await Promise.all(pending);
+            return new Response(null, { status: 204 });
+        }
+        catch (e) {
+            await Promise.all(pending);
+            return text(500, `handler failed: ${e?.message ?? e}`);
+        }
+    };
+}
+async function readNodeBody(req) {
+    if (req.body instanceof Uint8Array)
+        return new Uint8Array(req.body); // Buffer, e.g. express.raw()
+    if (typeof req.body === 'string')
+        return new TextEncoder().encode(req.body);
+    if (req.readableEnded) {
+        throw new Error('the request body was already read by a parser; mount this handler before express.json() or use express.raw()');
+    }
+    const chunks = [];
+    for await (const c of req)
+        chunks.push(typeof c === 'string' ? new TextEncoder().encode(c) : c);
+    let len = 0;
+    for (const c of chunks)
+        len += c.length;
+    const out = new Uint8Array(len);
+    let off = 0;
+    for (const c of chunks) {
+        out.set(c, off);
+        off += c.length;
+    }
+    return out;
+}
+/** Adapts a Fetch handler to node:http / Express: `app.post('/berth', toNodeHandler(handler))`. */
+export function toNodeHandler(handler) {
+    return async (req, res) => {
+        let response;
+        try {
+            const body = await readNodeBody(req);
+            const headers = new Headers();
+            for (const [k, v] of Object.entries(req.headers)) {
+                if (v === undefined)
+                    continue;
+                headers.set(k, Array.isArray(v) ? v.join(', ') : v);
+            }
+            const host = headers.get('host') ?? 'localhost';
+            const method = req.method ?? 'POST';
+            response = await handler(new Request(new URL(req.url ?? '/', `http://${host}`), { method, headers, body: method === 'GET' || method === 'HEAD' ? undefined : body }));
+        }
+        catch (e) {
+            response = text(400, e?.message ?? String(e));
+        }
+        res.statusCode = response.status;
+        response.headers.forEach((v, k) => void res.setHeader(k, v));
+        res.end(new Uint8Array(await response.arrayBuffer()));
+    };
+}

package/dist/esm/index.d.ts

@@ -0,0 +1,4 @@
+export { BerthError, type ErrorCode } from './errors.js';
+export { type AckRequest, type AckResult, type Alarm, type BatchMessage, type Client, type ClientOptions, type ContentType, type FetchLike, type PulledMessage, type PullOptions, type Queue, type SendOptions, type SendResult, alarm, createClient, queue, } from './client.js';
+export { type AlarmInfo, type Env, type ExecutionContext, type FetchHandler, type Handlers, type Message, type MessageBatch, type NodeRequest, type NodeResponse, type ScheduledController, createHandler, toNodeHandler, } from './handler.js';
+export { type RawBody, type SignatureError, type VerifyOptions, checkSignature, verifySignature } from './signature.js';

package/dist/esm/index.js

@@ -0,0 +1,4 @@
+export { BerthError } from './errors.js';
+export { alarm, createClient, queue, } from './client.js';
+export { createHandler, toNodeHandler, } from './handler.js';
+export { checkSignature, verifySignature } from './signature.js';

package/dist/esm/sha256.d.ts

@@ -0,0 +1,5 @@
+/** SHA-256 of the concatenation of parts. */
+export declare function sha256(...parts: Uint8Array[]): Uint8Array;
+/** HMAC-SHA256(key, concatenation of parts). */
+export declare function hmacSha256(key: Uint8Array, ...parts: Uint8Array[]): Uint8Array;
+export declare function toHex(b: Uint8Array): string;

package/dist/esm/sha256.js

@@ -0,0 +1,93 @@
+// Synchronous HMAC-SHA256 in plain JS. verifySignature has to be synchronous and run in edge
+// runtimes too, where node:crypto is absent and WebCrypto is async only. Bodies are at most
+// 256 KiB, so speed does not matter much. Checked against node:crypto in the tests.
+const K = new Uint32Array([
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+    0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+    0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+    0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+/** SHA-256 of the concatenation of parts. */
+export function sha256(...parts) {
+    let len = 0;
+    for (const p of parts)
+        len += p.length;
+    // Message + 0x80 + zero padding + 64-bit big-endian bit length, a multiple of 64 bytes.
+    const total = Math.ceil((len + 9) / 64) * 64;
+    const buf = new Uint8Array(total);
+    let off = 0;
+    for (const p of parts) {
+        buf.set(p, off);
+        off += p.length;
+    }
+    buf[len] = 0x80;
+    const view = new DataView(buf.buffer);
+    const bits = len * 8;
+    view.setUint32(total - 8, Math.floor(bits / 0x100000000));
+    view.setUint32(total - 4, bits >>> 0);
+    const h = new Uint32Array([0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19]);
+    const w = new Uint32Array(64);
+    for (let i = 0; i < total; i += 64) {
+        for (let t = 0; t < 16; t++)
+            w[t] = view.getUint32(i + t * 4);
+        for (let t = 16; t < 64; t++) {
+            const a = w[t - 15];
+            const b = w[t - 2];
+            const s0 = ((a >>> 7) | (a << 25)) ^ ((a >>> 18) | (a << 14)) ^ (a >>> 3);
+            const s1 = ((b >>> 17) | (b << 15)) ^ ((b >>> 19) | (b << 13)) ^ (b >>> 10);
+            w[t] = (w[t - 16] + s0 + w[t - 7] + s1) | 0;
+        }
+        let a = h[0], b = h[1], c = h[2], d = h[3], e = h[4], f = h[5], g = h[6], hh = h[7];
+        for (let t = 0; t < 64; t++) {
+            const S1 = ((e >>> 6) | (e << 26)) ^ ((e >>> 11) | (e << 21)) ^ ((e >>> 25) | (e << 7));
+            const ch = (e & f) ^ (~e & g);
+            const t1 = (hh + S1 + ch + K[t] + w[t]) | 0;
+            const S0 = ((a >>> 2) | (a << 30)) ^ ((a >>> 13) | (a << 19)) ^ ((a >>> 22) | (a << 10));
+            const maj = (a & b) ^ (a & c) ^ (b & c);
+            const t2 = (S0 + maj) | 0;
+            hh = g;
+            g = f;
+            f = e;
+            e = (d + t1) | 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (t1 + t2) | 0;
+        }
+        h[0] = (h[0] + a) | 0;
+        h[1] = (h[1] + b) | 0;
+        h[2] = (h[2] + c) | 0;
+        h[3] = (h[3] + d) | 0;
+        h[4] = (h[4] + e) | 0;
+        h[5] = (h[5] + f) | 0;
+        h[6] = (h[6] + g) | 0;
+        h[7] = (h[7] + hh) | 0;
+    }
+    const out = new Uint8Array(32);
+    const ov = new DataView(out.buffer);
+    for (let i = 0; i < 8; i++)
+        ov.setUint32(i * 4, h[i]);
+    return out;
+}
+/** HMAC-SHA256(key, concatenation of parts). */
+export function hmacSha256(key, ...parts) {
+    const k = key.length > 64 ? sha256(key) : key;
+    const block = new Uint8Array(64);
+    block.set(k);
+    const ipad = new Uint8Array(64);
+    const opad = new Uint8Array(64);
+    for (let i = 0; i < 64; i++) {
+        ipad[i] = block[i] ^ 0x36;
+        opad[i] = block[i] ^ 0x5c;
+    }
+    return sha256(opad, sha256(ipad, ...parts));
+}
+const HEX = '0123456789abcdef';
+export function toHex(b) {
+    let s = '';
+    for (const x of b)
+        s += HEX[x >> 4] + HEX[x & 15];
+    return s;
+}

package/dist/esm/signature.d.ts

@@ -0,0 +1,20 @@
+/** Why a signature was rejected. */
+export type SignatureError = 'missing' | 'malformed' | 'expired' | 'mismatch';
+export interface VerifyOptions {
+    /** The receiver's clock: a Date or unix seconds. Default: now. */
+    now?: Date | number;
+    /** How far the signature's timestamp may be from now, both ways. Default 300. */
+    toleranceSeconds?: number;
+}
+export type RawBody = string | Uint8Array | ArrayBuffer;
+/**
+ * Checks a Berth-Signature header (`t=<unix>,v1=<hex>`) against the raw request body and says
+ * why it fails, or null when it is valid. Synchronous; never throws. Several v1 values are
+ * accepted (one must match), so the secret can be rotated; unknown keys are ignored.
+ */
+export declare function checkSignature(secret: string | Uint8Array, header: string | null | undefined, rawBody: RawBody, opts?: VerifyOptions): SignatureError | null;
+/**
+ * Whether a Berth-Signature header is valid for the raw request body. Verify the bytes as they
+ * arrived, before any JSON parsing. Synchronous; never throws.
+ */
+export declare function verifySignature(secret: string | Uint8Array, header: string | null | undefined, rawBody: RawBody, opts?: VerifyOptions): boolean;