@fragno-dev/api-fragment 0.0.0-stage → 0.0.1

package/dist/node/api-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-types.d.ts","names":[],"sources":["../../src/api-types.ts"],"mappings":";;UAKiB;;EAEf,mBAAmB,KAAK;;EAExB,4BAA4B,KAAK;;EAEjC,eAAe;;cAKJ,kBAAgB,EAAA,uBAAA,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAiChB,yBAAuB,EAAA;cAOvB,gCAA8B,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAM9B,2BAAyB,EAAA;;;;;;;;;cAUzB,0BAAwB,EAAA;;;;;;;;;;;;;cAUxB,qBAAmB,EAAA,uBAAA,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAgBnB,uBAAqB,EAAA;;;;;;cASrB,sBAAoB,EAAA;;;;cAGpB;cAEA,wBAAsB,EAAA;cAKtB,uBAAqB,EAAA;;;;;cAWrB,sBAAoB,EAAA,uBAAA,EAAA;;;;;;;;;cAMpB,uBAAqB,EAAA;;;;;;;;;;;;;;;;;;;;;;cASrB,uBAAqB,EAAA,uBAAA,EAAA;;;;;;;;;;cAMrB,uBAAqB,EAAA;;;;;;;;;;;;;;;cAOrB,wBAAsB,EAAA,uBAAA,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAyBtB,+BAA6B,EAAA,uBAAA,EAAA;;;;;;;;;;cAS7B,gCAA8B,EAAA,uBAAA,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAqC9B,6BAA2B,EAAA;;;;;;cAG3B,4BAA0B,EAAA;;;;;;;;;;cAW1B,+BAA6B,EAAA;;;;;;;;;;;;;;;;cAe7B,6BAA2B,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAa3B,kCAAgC,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAQhC,kCAAgC,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAQjC,aAAa,EAAE,aAAa;KAC5B,qBAAqB,EAAE,aAAa;KACpC,gBAAgB,EAAE,aAAa;KAC/B,qBAAqB,EAAE,aAAa;KACpC,gBAAgB,EAAE,aAAa;KAC/B,kBAAkB,EAAE,aAAa;KACjC,iBAAiB,EAAE,aAAa;KAChC,kBAAkB,EAAE,aAAa;KACjC,kBAAkB,EAAE,aAAa;KACjC,kBAAkB,EAAE,aAAa;KACjC,mBAAmB,EAAE,aAAa;KAClC,0BAA0B,EAAE,aAAa;KACzC,2BAA2B,EAAE,aAAa;KAC1C,uBAAuB,EAAE,aAAa;KACtC,6BAA6B,EAAE,aAAa;KAC5C,kBAAkB,EAAE,aAAa;KACjC,uBAAuB,EAAE,aAAa;KACtC,0BAA0B,EAAE,aAAa"}

package/dist/node/api-types.js

@@ -0,0 +1,281 @@
+import { webhookAuthConfigSchema } from "./webhooks/auth.js";
+import { webhookVerificationConfigSchema } from "./webhooks/verification.js";
+import { z } from "zod";
+//#region src/api-types.ts
+const tokenEndpointAuthMethodSchema = z.enum([
+	"client_secret_basic",
+	"client_secret_post",
+	"none"
+]);
+const authConfigSchema = z.discriminatedUnion("type", [
+	z.object({ type: z.literal("none") }),
+	z.object({
+		type: z.literal("bearer"),
+		token: z.string().min(1)
+	}),
+	z.object({
+		type: z.literal("basic"),
+		username: z.string().min(1),
+		password: z.string().min(1)
+	}),
+	z.object({
+		type: z.literal("client_credentials"),
+		tokenEndpoint: z.url(),
+		clientId: z.string().min(1),
+		clientSecret: z.string().min(1),
+		scopes: z.array(z.string()).optional(),
+		audience: z.string().min(1).optional(),
+		tokenEndpointAuthMethod: z.enum(["client_secret_basic", "client_secret_post"]).default("client_secret_basic")
+	}),
+	z.object({
+		type: z.literal("oauth"),
+		authorizationEndpoint: z.url(),
+		tokenEndpoint: z.url(),
+		clientId: z.string().min(1),
+		clientSecret: z.string().min(1).optional(),
+		scopes: z.array(z.string()).optional(),
+		tokenEndpointAuthMethod: tokenEndpointAuthMethodSchema.default("client_secret_basic"),
+		extraAuthorizationParams: z.record(z.string(), z.string()).optional(),
+		extraTokenParams: z.record(z.string(), z.string()).optional()
+	})
+]);
+/** Slugs are URL path segments; whitespace and dot segments would make a connection unaddressable. */
+const apiConnectionSlugSchema = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, "API connection slugs start with a letter or digit and contain only letters, digits, '.', '_', or '-'.");
+const createApiConnectionInputSchema = z.object({
+	name: z.string().min(1).optional(),
+	baseUrl: z.url(),
+	auth: authConfigSchema.default({ type: "none" })
+});
+const apiConnectionOutputSchema = z.object({
+	slug: z.string(),
+	name: z.string().nullable().optional(),
+	baseUrl: z.string(),
+	authMode: z.string(),
+	status: z.string(),
+	createdAt: z.union([z.string(), z.date()]).optional(),
+	updatedAt: z.union([z.string(), z.date()]).optional()
+});
+const apiConnectionsPageSchema = z.object({
+	connections: z.array(apiConnectionOutputSchema),
+	cursor: z.string().nullable().describe("Null means every connection has been listed.")
+});
+const apiCredentialsPresenceSchema = z.enum(["present", "missing"]).describe("Whether credentials are stored, not whether the provider accepts them.");
+/** Sanitized auth state derived from stored configuration; it never proves live provider access. */
+const apiAuthStatusSchema = z.discriminatedUnion("mode", [
+	z.object({ mode: z.literal("none") }),
+	z.object({
+		mode: z.literal("bearer"),
+		credentials: apiCredentialsPresenceSchema
+	}),
+	z.object({
+		mode: z.literal("basic"),
+		credentials: apiCredentialsPresenceSchema
+	}),
+	z.object({
+		mode: z.literal("client_credentials"),
+		credentials: apiCredentialsPresenceSchema
+	}),
+	z.object({
+		mode: z.literal("oauth"),
+		state: z.enum([
+			"client-missing",
+			"consent-required",
+			"consent-pending",
+			"authorized",
+			"expired"
+		]).describe("Expired means the access token expired and no refresh token is stored; pending means an unexpired authorization link exists.")
+	})
+]);
+/** The pending link embeds the callback state, so reading it requires connection-create authority. */
+const apiOAuthPendingSchema = z.object({ pending: z.object({
+	authorizationUrl: z.url(),
+	expiresAt: z.union([z.string(), z.date()])
+}).nullable().describe("The newest unexpired, unconsumed authorization link; any pending link completes it.") });
+const tokenAuthInputSchema = z.object({ token: z.string().min(1) });
+/** Query parameter carrying the OAuth callback URI for an OAuth start request. */
+const API_OAUTH_REDIRECT_URI_QUERY_PARAMETER = "redirectUri";
+const oauthRedirectUriSchema = z.url().refine((value) => {
+	const protocol = new URL(value).protocol;
+	return protocol === "https:" || protocol === "http:";
+}, "OAuth redirect URI must use HTTP or HTTPS");
+const oauthStartInputSchema = z.object({
+	scopes: z.array(z.string()).optional(),
+	extraAuthorizationParams: z.record(z.string(), z.string()).optional(),
+	discardTokens: z.boolean().default(false).describe("Drop stored tokens so status reports pending consent until this new consent completes.")
+});
+const apiRequestBodySchema = z.discriminatedUnion("type", [
+	z.object({ type: z.literal("empty") }),
+	z.object({
+		type: z.literal("json"),
+		value: z.unknown()
+	}),
+	z.object({
+		type: z.literal("text"),
+		value: z.string()
+	})
+]);
+const apiRequestInputSchema = z.object({
+	method: z.enum([
+		"GET",
+		"POST",
+		"PUT",
+		"PATCH",
+		"DELETE"
+	]),
+	path: z.string().min(1),
+	query: z.record(z.string(), z.string()).optional(),
+	headers: z.record(z.string(), z.string()).optional(),
+	body: apiRequestBodySchema,
+	timeoutMs: z.number().int().positive().max(12e4).optional()
+});
+const apiResponseBodySchema = z.discriminatedUnion("type", [
+	z.object({
+		type: z.literal("json"),
+		value: z.unknown()
+	}),
+	z.object({
+		type: z.literal("text"),
+		value: z.string()
+	}),
+	z.object({
+		type: z.literal("empty"),
+		value: z.null()
+	})
+]);
+const apiHttpResponseSchema = z.object({
+	status: z.number().int(),
+	statusText: z.string(),
+	headers: z.record(z.string(), z.string()),
+	body: apiResponseBodySchema
+});
+const apiRequestOutputSchema = z.discriminatedUnion("ok", [z.object({
+	ok: z.literal(true),
+	response: apiHttpResponseSchema,
+	error: z.null()
+}), z.object({
+	ok: z.literal(false),
+	response: apiHttpResponseSchema.nullable(),
+	error: z.object({
+		code: z.enum([
+			"HTTP_ERROR",
+			"REQUEST_ERROR",
+			"RESPONSE_DECODING_ERROR",
+			"CONNECTION_NOT_FOUND",
+			"CONNECTION_DISABLED"
+		]),
+		message: z.string()
+	})
+})]);
+const webhookSecretRefSchema = z.string().trim().min(1);
+const webhookRequestValueNameSchema = z.string().trim().min(1);
+const webhookDeliveryIdentitySchema = z.discriminatedUnion("type", [
+	z.object({
+		type: z.literal("header"),
+		name: webhookRequestValueNameSchema
+	}),
+	z.object({
+		type: z.literal("query"),
+		name: webhookRequestValueNameSchema
+	}),
+	z.object({
+		type: z.literal("jsonBodyPath"),
+		path: z.array(z.string().trim().min(1)).min(1)
+	})
+]);
+const webhookEndpointAuthInputSchema = z.discriminatedUnion("type", [
+	z.object({ type: z.literal("none") }),
+	z.object({
+		type: z.literal("bearer"),
+		token: webhookSecretRefSchema
+	}),
+	z.object({
+		type: z.literal("apiKey"),
+		location: z.enum(["header", "query"]),
+		name: webhookRequestValueNameSchema,
+		secret: webhookSecretRefSchema
+	}),
+	z.object({
+		type: z.literal("basic"),
+		username: webhookSecretRefSchema,
+		password: webhookSecretRefSchema
+	}),
+	z.object({
+		type: z.literal("hmac"),
+		secret: webhookSecretRefSchema,
+		algorithm: z.enum([
+			"sha1",
+			"sha256",
+			"sha512"
+		]),
+		signature: z.object({
+			location: z.enum(["header", "query"]),
+			name: webhookRequestValueNameSchema,
+			encoding: z.enum([
+				"hex",
+				"base64",
+				"base64url"
+			]),
+			prefix: z.string().optional()
+		}),
+		signedPayload: z.discriminatedUnion("type", [z.object({ type: z.literal("rawBody") }), z.object({
+			type: z.literal("timestampedBody"),
+			prefix: z.string(),
+			timestampHeader: webhookRequestValueNameSchema,
+			delimiter: z.string(),
+			toleranceSeconds: z.number().int().positive()
+		})])
+	})
+]);
+const webhookEndpointStatusSchema = z.enum([
+	"draft",
+	"active",
+	"disabled"
+]);
+/** Why the receive routes refused a request for an existing endpoint. */
+const webhookRejectionCodeSchema = z.enum([
+	"WEBHOOK_ENDPOINT_DISABLED",
+	"WEBHOOK_ENDPOINT_DRAFT",
+	"WEBHOOK_AUTH_FAILED",
+	"WEBHOOK_VERIFICATION_NOT_MATCHED",
+	"WEBHOOK_VERIFICATION_RESPONSE_INVALID",
+	"WEBHOOK_BODY_INVALID",
+	"WEBHOOK_DELIVERY_ID_MISSING",
+	"WEBHOOK_DELIVERY_ID_INVALID"
+]);
+const webhookDeliveryEvidenceSchema = z.object({
+	lastAcceptedAt: z.string().nullable().describe("Last accepted delivery or answered verification challenge."),
+	lastRejection: z.object({
+		receivedAt: z.string(),
+		code: webhookRejectionCodeSchema
+	}).nullable().describe("Last refused request. Anyone with the URL can cause one, so it is diagnostic, not proof of a provider problem.")
+}).describe("Requests since the endpoint's configuration last changed.");
+const webhookEndpointOutputSchema = z.object({
+	id: z.string(),
+	name: z.string(),
+	status: webhookEndpointStatusSchema,
+	authConfig: webhookAuthConfigSchema,
+	verification: webhookVerificationConfigSchema,
+	deliveryIdentity: webhookDeliveryIdentitySchema,
+	secretRefs: z.array(z.string()),
+	deliveries: webhookDeliveryEvidenceSchema,
+	createdAt: z.union([z.string(), z.date()]).optional(),
+	updatedAt: z.union([z.string(), z.date()]).optional()
+});
+const createWebhookEndpointInputSchema = z.object({
+	name: z.string().min(1),
+	status: webhookEndpointStatusSchema.default("active"),
+	verification: webhookVerificationConfigSchema,
+	deliveryIdentity: webhookDeliveryIdentitySchema,
+	auth: webhookEndpointAuthInputSchema
+});
+const updateWebhookEndpointInputSchema = z.object({
+	name: z.string().min(1).optional(),
+	status: webhookEndpointStatusSchema.optional(),
+	verification: webhookVerificationConfigSchema.optional(),
+	deliveryIdentity: webhookDeliveryIdentitySchema.optional(),
+	auth: webhookEndpointAuthInputSchema.optional()
+});
+//#endregion
+export { API_OAUTH_REDIRECT_URI_QUERY_PARAMETER, apiAuthStatusSchema, apiConnectionOutputSchema, apiConnectionSlugSchema, apiConnectionsPageSchema, apiHttpResponseSchema, apiOAuthPendingSchema, apiRequestBodySchema, apiRequestInputSchema, apiRequestOutputSchema, apiResponseBodySchema, authConfigSchema, createApiConnectionInputSchema, createWebhookEndpointInputSchema, oauthRedirectUriSchema, oauthStartInputSchema, tokenAuthInputSchema, updateWebhookEndpointInputSchema, webhookDeliveryEvidenceSchema, webhookDeliveryIdentitySchema, webhookEndpointAuthInputSchema, webhookEndpointOutputSchema, webhookEndpointStatusSchema, webhookRejectionCodeSchema };
+
+//# sourceMappingURL=api-types.js.map

package/dist/node/api-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-types.js","names":[],"sources":["../../src/api-types.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport { webhookAuthConfigSchema } from \"./webhooks/auth\";\nimport { webhookVerificationConfigSchema } from \"./webhooks/verification\";\n\nexport interface ApiFragmentConfig {\n  /** Optional URL allow-list. If omitted, only http(s) URL syntax is checked. */\n  allowedBaseUrls?: (url: URL) => boolean;\n  /** Allows OAuth callback URLs. OAuth start is rejected when this policy is omitted. */\n  allowedOAuthRedirectUris?: (url: URL) => boolean;\n  /** Optional fetch implementation for tests/custom runtimes. */\n  fetch?: typeof fetch;\n}\n\nconst tokenEndpointAuthMethodSchema = z.enum([\"client_secret_basic\", \"client_secret_post\", \"none\"]);\n\nexport const authConfigSchema = z.discriminatedUnion(\"type\", [\n  z.object({ type: z.literal(\"none\") }),\n  z.object({ type: z.literal(\"bearer\"), token: z.string().min(1) }),\n  z.object({\n    type: z.literal(\"basic\"),\n    username: z.string().min(1),\n    password: z.string().min(1),\n  }),\n  z.object({\n    type: z.literal(\"client_credentials\"),\n    tokenEndpoint: z.url(),\n    clientId: z.string().min(1),\n    clientSecret: z.string().min(1),\n    scopes: z.array(z.string()).optional(),\n    audience: z.string().min(1).optional(),\n    tokenEndpointAuthMethod: z\n      .enum([\"client_secret_basic\", \"client_secret_post\"])\n      .default(\"client_secret_basic\"),\n  }),\n  z.object({\n    type: z.literal(\"oauth\"),\n    authorizationEndpoint: z.url(),\n    tokenEndpoint: z.url(),\n    clientId: z.string().min(1),\n    clientSecret: z.string().min(1).optional(),\n    scopes: z.array(z.string()).optional(),\n    tokenEndpointAuthMethod: tokenEndpointAuthMethodSchema.default(\"client_secret_basic\"),\n    extraAuthorizationParams: z.record(z.string(), z.string()).optional(),\n    extraTokenParams: z.record(z.string(), z.string()).optional(),\n  }),\n]);\n\n/** Slugs are URL path segments; whitespace and dot segments would make a connection unaddressable. */\nexport const apiConnectionSlugSchema = z\n  .string()\n  .regex(\n    /^[A-Za-z0-9][A-Za-z0-9._-]*$/,\n    \"API connection slugs start with a letter or digit and contain only letters, digits, '.', '_', or '-'.\",\n  );\n\nexport const createApiConnectionInputSchema = z.object({\n  name: z.string().min(1).optional(),\n  baseUrl: z.url(),\n  auth: authConfigSchema.default({ type: \"none\" }),\n});\n\nexport const apiConnectionOutputSchema = z.object({\n  slug: z.string(),\n  name: z.string().nullable().optional(),\n  baseUrl: z.string(),\n  authMode: z.string(),\n  status: z.string(),\n  createdAt: z.union([z.string(), z.date()]).optional(),\n  updatedAt: z.union([z.string(), z.date()]).optional(),\n});\n\nexport const apiConnectionsPageSchema = z.object({\n  connections: z.array(apiConnectionOutputSchema),\n  cursor: z.string().nullable().describe(\"Null means every connection has been listed.\"),\n});\n\nconst apiCredentialsPresenceSchema = z\n  .enum([\"present\", \"missing\"])\n  .describe(\"Whether credentials are stored, not whether the provider accepts them.\");\n\n/** Sanitized auth state derived from stored configuration; it never proves live provider access. */\nexport const apiAuthStatusSchema = z.discriminatedUnion(\"mode\", [\n  z.object({ mode: z.literal(\"none\") }),\n  z.object({ mode: z.literal(\"bearer\"), credentials: apiCredentialsPresenceSchema }),\n  z.object({ mode: z.literal(\"basic\"), credentials: apiCredentialsPresenceSchema }),\n  z.object({ mode: z.literal(\"client_credentials\"), credentials: apiCredentialsPresenceSchema }),\n  z.object({\n    mode: z.literal(\"oauth\"),\n    state: z\n      .enum([\"client-missing\", \"consent-required\", \"consent-pending\", \"authorized\", \"expired\"])\n      .describe(\n        \"Expired means the access token expired and no refresh token is stored; pending means an unexpired authorization link exists.\",\n      ),\n  }),\n]);\n\n/** The pending link embeds the callback state, so reading it requires connection-create authority. */\nexport const apiOAuthPendingSchema = z.object({\n  pending: z\n    .object({ authorizationUrl: z.url(), expiresAt: z.union([z.string(), z.date()]) })\n    .nullable()\n    .describe(\n      \"The newest unexpired, unconsumed authorization link; any pending link completes it.\",\n    ),\n});\n\nexport const tokenAuthInputSchema = z.object({ token: z.string().min(1) });\n\n/** Query parameter carrying the OAuth callback URI for an OAuth start request. */\nexport const API_OAUTH_REDIRECT_URI_QUERY_PARAMETER = \"redirectUri\";\n\nexport const oauthRedirectUriSchema = z.url().refine((value) => {\n  const protocol = new URL(value).protocol;\n  return protocol === \"https:\" || protocol === \"http:\";\n}, \"OAuth redirect URI must use HTTP or HTTPS\");\n\nexport const oauthStartInputSchema = z.object({\n  scopes: z.array(z.string()).optional(),\n  extraAuthorizationParams: z.record(z.string(), z.string()).optional(),\n  discardTokens: z\n    .boolean()\n    .default(false)\n    .describe(\n      \"Drop stored tokens so status reports pending consent until this new consent completes.\",\n    ),\n});\n\nexport const apiRequestBodySchema = z.discriminatedUnion(\"type\", [\n  z.object({ type: z.literal(\"empty\") }),\n  z.object({ type: z.literal(\"json\"), value: z.unknown() }),\n  z.object({ type: z.literal(\"text\"), value: z.string() }),\n]);\n\nexport const apiRequestInputSchema = z.object({\n  method: z.enum([\"GET\", \"POST\", \"PUT\", \"PATCH\", \"DELETE\"]),\n  path: z.string().min(1),\n  query: z.record(z.string(), z.string()).optional(),\n  headers: z.record(z.string(), z.string()).optional(),\n  body: apiRequestBodySchema,\n  timeoutMs: z.number().int().positive().max(120_000).optional(),\n});\n\nexport const apiResponseBodySchema = z.discriminatedUnion(\"type\", [\n  z.object({ type: z.literal(\"json\"), value: z.unknown() }),\n  z.object({ type: z.literal(\"text\"), value: z.string() }),\n  z.object({ type: z.literal(\"empty\"), value: z.null() }),\n]);\n\nexport const apiHttpResponseSchema = z.object({\n  status: z.number().int(),\n  statusText: z.string(),\n  headers: z.record(z.string(), z.string()),\n  body: apiResponseBodySchema,\n});\n\nexport const apiRequestOutputSchema = z.discriminatedUnion(\"ok\", [\n  z.object({\n    ok: z.literal(true),\n    response: apiHttpResponseSchema,\n    error: z.null(),\n  }),\n  z.object({\n    ok: z.literal(false),\n    response: apiHttpResponseSchema.nullable(),\n    error: z.object({\n      code: z.enum([\n        \"HTTP_ERROR\",\n        \"REQUEST_ERROR\",\n        \"RESPONSE_DECODING_ERROR\",\n        \"CONNECTION_NOT_FOUND\",\n        \"CONNECTION_DISABLED\",\n      ]),\n      message: z.string(),\n    }),\n  }),\n]);\n\nconst webhookSecretRefSchema = z.string().trim().min(1);\nconst webhookRequestValueNameSchema = z.string().trim().min(1);\n\nexport const webhookDeliveryIdentitySchema = z.discriminatedUnion(\"type\", [\n  z.object({ type: z.literal(\"header\"), name: webhookRequestValueNameSchema }),\n  z.object({ type: z.literal(\"query\"), name: webhookRequestValueNameSchema }),\n  z.object({\n    type: z.literal(\"jsonBodyPath\"),\n    path: z.array(z.string().trim().min(1)).min(1),\n  }),\n]);\n\nexport const webhookEndpointAuthInputSchema = z.discriminatedUnion(\"type\", [\n  z.object({ type: z.literal(\"none\") }),\n  z.object({ type: z.literal(\"bearer\"), token: webhookSecretRefSchema }),\n  z.object({\n    type: z.literal(\"apiKey\"),\n    location: z.enum([\"header\", \"query\"]),\n    name: webhookRequestValueNameSchema,\n    secret: webhookSecretRefSchema,\n  }),\n  z.object({\n    type: z.literal(\"basic\"),\n    username: webhookSecretRefSchema,\n    password: webhookSecretRefSchema,\n  }),\n  z.object({\n    type: z.literal(\"hmac\"),\n    secret: webhookSecretRefSchema,\n    algorithm: z.enum([\"sha1\", \"sha256\", \"sha512\"]),\n    signature: z.object({\n      location: z.enum([\"header\", \"query\"]),\n      name: webhookRequestValueNameSchema,\n      encoding: z.enum([\"hex\", \"base64\", \"base64url\"]),\n      prefix: z.string().optional(),\n    }),\n    signedPayload: z.discriminatedUnion(\"type\", [\n      z.object({ type: z.literal(\"rawBody\") }),\n      z.object({\n        type: z.literal(\"timestampedBody\"),\n        prefix: z.string(),\n        timestampHeader: webhookRequestValueNameSchema,\n        delimiter: z.string(),\n        toleranceSeconds: z.number().int().positive(),\n      }),\n    ]),\n  }),\n]);\n\nexport const webhookEndpointStatusSchema = z.enum([\"draft\", \"active\", \"disabled\"]);\n\n/** Why the receive routes refused a request for an existing endpoint. */\nexport const webhookRejectionCodeSchema = z.enum([\n  \"WEBHOOK_ENDPOINT_DISABLED\",\n  \"WEBHOOK_ENDPOINT_DRAFT\",\n  \"WEBHOOK_AUTH_FAILED\",\n  \"WEBHOOK_VERIFICATION_NOT_MATCHED\",\n  \"WEBHOOK_VERIFICATION_RESPONSE_INVALID\",\n  \"WEBHOOK_BODY_INVALID\",\n  \"WEBHOOK_DELIVERY_ID_MISSING\",\n  \"WEBHOOK_DELIVERY_ID_INVALID\",\n]);\n\nexport const webhookDeliveryEvidenceSchema = z\n  .object({\n    lastAcceptedAt: z\n      .string()\n      .nullable()\n      .describe(\"Last accepted delivery or answered verification challenge.\"),\n    lastRejection: z\n      .object({ receivedAt: z.string(), code: webhookRejectionCodeSchema })\n      .nullable()\n      .describe(\n        \"Last refused request. Anyone with the URL can cause one, so it is diagnostic, not proof of a provider problem.\",\n      ),\n  })\n  .describe(\"Requests since the endpoint's configuration last changed.\");\n\nexport const webhookEndpointOutputSchema = z.object({\n  id: z.string(),\n  name: z.string(),\n  status: webhookEndpointStatusSchema,\n  authConfig: webhookAuthConfigSchema,\n  verification: webhookVerificationConfigSchema,\n  deliveryIdentity: webhookDeliveryIdentitySchema,\n  secretRefs: z.array(z.string()),\n  deliveries: webhookDeliveryEvidenceSchema,\n  createdAt: z.union([z.string(), z.date()]).optional(),\n  updatedAt: z.union([z.string(), z.date()]).optional(),\n});\n\nexport const createWebhookEndpointInputSchema = z.object({\n  name: z.string().min(1),\n  status: webhookEndpointStatusSchema.default(\"active\"),\n  verification: webhookVerificationConfigSchema,\n  deliveryIdentity: webhookDeliveryIdentitySchema,\n  auth: webhookEndpointAuthInputSchema,\n});\n\nexport const updateWebhookEndpointInputSchema = z.object({\n  name: z.string().min(1).optional(),\n  status: webhookEndpointStatusSchema.optional(),\n  verification: webhookVerificationConfigSchema.optional(),\n  deliveryIdentity: webhookDeliveryIdentitySchema.optional(),\n  auth: webhookEndpointAuthInputSchema.optional(),\n});\n\nexport type AuthConfig = z.infer<typeof authConfigSchema>;\nexport type ApiConnectionInput = z.infer<typeof createApiConnectionInputSchema>;\nexport type ApiConnection = z.infer<typeof apiConnectionOutputSchema>;\nexport type ApiConnectionsPage = z.infer<typeof apiConnectionsPageSchema>;\nexport type ApiAuthStatus = z.infer<typeof apiAuthStatusSchema>;\nexport type ApiOAuthPending = z.infer<typeof apiOAuthPendingSchema>;\nexport type ApiRequestBody = z.infer<typeof apiRequestBodySchema>;\nexport type ApiRequestInput = z.infer<typeof apiRequestInputSchema>;\nexport type ApiResponseBody = z.infer<typeof apiResponseBodySchema>;\nexport type ApiHttpResponse = z.infer<typeof apiHttpResponseSchema>;\nexport type ApiRequestOutput = z.infer<typeof apiRequestOutputSchema>;\nexport type WebhookDeliveryIdentity = z.infer<typeof webhookDeliveryIdentitySchema>;\nexport type WebhookEndpointAuthInput = z.infer<typeof webhookEndpointAuthInputSchema>;\nexport type WebhookEndpointInput = z.infer<typeof createWebhookEndpointInputSchema>;\nexport type UpdateWebhookEndpointInput = z.infer<typeof updateWebhookEndpointInputSchema>;\nexport type WebhookEndpoint = z.infer<typeof webhookEndpointOutputSchema>;\nexport type WebhookRejectionCode = z.infer<typeof webhookRejectionCodeSchema>;\nexport type WebhookDeliveryEvidence = z.infer<typeof webhookDeliveryEvidenceSchema>;\n"],"mappings":";;;;AAcA,MAAM,gCAAgC,EAAE,KAAK;CAAC;CAAuB;CAAsB;AAAM,CAAC;AAElG,MAAa,mBAAmB,EAAE,mBAAmB,QAAQ;CAC3D,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,EAAE,CAAC;CACpC,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,QAAQ;EAAG,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAAE,CAAC;CAChE,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,OAAO;EACvB,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EAC1B,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC5B,CAAC;CACD,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,oBAAoB;EACpC,eAAe,EAAE,IAAI;EACrB,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EAC1B,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EAC9B,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;EACrC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;EACrC,yBAAyB,EACtB,KAAK,CAAC,uBAAuB,oBAAoB,CAAC,CAAC,CACnD,QAAQ,qBAAqB;CAClC,CAAC;CACD,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,OAAO;EACvB,uBAAuB,EAAE,IAAI;EAC7B,eAAe,EAAE,IAAI;EACrB,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EAC1B,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;EACzC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;EACrC,yBAAyB,8BAA8B,QAAQ,qBAAqB;EACpF,0BAA0B,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;EACpE,kBAAkB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CAC9D,CAAC;AACH,CAAC;;AAGD,MAAa,0BAA0B,EACpC,OAAO,CAAC,CACR,MACC,gCACA,uGACF;AAEF,MAAa,iCAAiC,EAAE,OAAO;CACrD,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACjC,SAAS,EAAE,IAAI;CACf,MAAM,iBAAiB,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjD,CAAC;AAED,MAAa,4BAA4B,EAAE,OAAO;CAChD,MAAM,EAAE,OAAO;CACf,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;CACrC,SAAS,EAAE,OAAO;CAClB,UAAU,EAAE,OAAO;CACnB,QAAQ,EAAE,OAAO;CACjB,WAAW,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;CACpD,WAAW,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;AACtD,CAAC;AAED,MAAa,2BAA2B,EAAE,OAAO;CAC/C,aAAa,EAAE,MAAM,yBAAyB;CAC9C,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,8CAA8C;AACvF,CAAC;AAED,MAAM,+BAA+B,EAClC,KAAK,CAAC,WAAW,SAAS,CAAC,CAAC,CAC5B,SAAS,wEAAwE;;AAGpF,MAAa,sBAAsB,EAAE,mBAAmB,QAAQ;CAC9D,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,EAAE,CAAC;CACpC,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,QAAQ;EAAG,aAAa;CAA6B,CAAC;CACjF,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,OAAO;EAAG,aAAa;CAA6B,CAAC;CAChF,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,oBAAoB;EAAG,aAAa;CAA6B,CAAC;CAC7F,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,OAAO;EACvB,OAAO,EACJ,KAAK;GAAC;GAAkB;GAAoB;GAAmB;GAAc;EAAS,CAAC,CAAC,CACxF,SACC,8HACF;CACJ,CAAC;AACH,CAAC;;AAGD,MAAa,wBAAwB,EAAE,OAAO,EAC5C,SAAS,EACN,OAAO;CAAE,kBAAkB,EAAE,IAAI;CAAG,WAAW,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,KAAK,CAAC,CAAC;AAAE,CAAC,CAAC,CACjF,SAAS,CAAC,CACV,SACC,qFACF,EACJ,CAAC;AAED,MAAa,uBAAuB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;;AAGzE,MAAa,yCAAyC;AAEtD,MAAa,yBAAyB,EAAE,IAAI,CAAC,CAAC,QAAQ,UAAU;CAC9D,MAAM,WAAW,IAAI,IAAI,KAAK,CAAC,CAAC;CAChC,OAAO,aAAa,YAAY,aAAa;AAC/C,GAAG,2CAA2C;AAE9C,MAAa,wBAAwB,EAAE,OAAO;CAC5C,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CACrC,0BAA0B,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CACpE,eAAe,EACZ,QAAQ,CAAC,CACT,QAAQ,KAAK,CAAC,CACd,SACC,wFACF;AACJ,CAAC;AAED,MAAa,uBAAuB,EAAE,mBAAmB,QAAQ;CAC/D,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,OAAO,EAAE,CAAC;CACrC,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,MAAM;EAAG,OAAO,EAAE,QAAQ;CAAE,CAAC;CACxD,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,MAAM;EAAG,OAAO,EAAE,OAAO;CAAE,CAAC;AACzD,CAAC;AAED,MAAa,wBAAwB,EAAE,OAAO;CAC5C,QAAQ,EAAE,KAAK;EAAC;EAAO;EAAQ;EAAO;EAAS;CAAQ,CAAC;CACxD,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACtB,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CACjD,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CACnD,MAAM;CACN,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,IAAO,CAAC,CAAC,SAAS;AAC/D,CAAC;AAED,MAAa,wBAAwB,EAAE,mBAAmB,QAAQ;CAChE,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,MAAM;EAAG,OAAO,EAAE,QAAQ;CAAE,CAAC;CACxD,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,MAAM;EAAG,OAAO,EAAE,OAAO;CAAE,CAAC;CACvD,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,OAAO;EAAG,OAAO,EAAE,KAAK;CAAE,CAAC;AACxD,CAAC;AAED,MAAa,wBAAwB,EAAE,OAAO;CAC5C,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI;CACvB,YAAY,EAAE,OAAO;CACrB,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC;CACxC,MAAM;AACR,CAAC;AAED,MAAa,yBAAyB,EAAE,mBAAmB,MAAM,CAC/D,EAAE,OAAO;CACP,IAAI,EAAE,QAAQ,IAAI;CAClB,UAAU;CACV,OAAO,EAAE,KAAK;AAChB,CAAC,GACD,EAAE,OAAO;CACP,IAAI,EAAE,QAAQ,KAAK;CACnB,UAAU,sBAAsB,SAAS;CACzC,OAAO,EAAE,OAAO;EACd,MAAM,EAAE,KAAK;GACX;GACA;GACA;GACA;GACA;EACF,CAAC;EACD,SAAS,EAAE,OAAO;CACpB,CAAC;AACH,CAAC,CACH,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;AACtD,MAAM,gCAAgC,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;AAE7D,MAAa,gCAAgC,EAAE,mBAAmB,QAAQ;CACxE,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,QAAQ;EAAG,MAAM;CAA8B,CAAC;CAC3E,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,OAAO;EAAG,MAAM;CAA8B,CAAC;CAC1E,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,cAAc;EAC9B,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;CAC/C,CAAC;AACH,CAAC;AAED,MAAa,iCAAiC,EAAE,mBAAmB,QAAQ;CACzE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,EAAE,CAAC;CACpC,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,QAAQ;EAAG,OAAO;CAAuB,CAAC;CACrE,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,QAAQ;EACxB,UAAU,EAAE,KAAK,CAAC,UAAU,OAAO,CAAC;EACpC,MAAM;EACN,QAAQ;CACV,CAAC;CACD,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,OAAO;EACvB,UAAU;EACV,UAAU;CACZ,CAAC;CACD,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,MAAM;EACtB,QAAQ;EACR,WAAW,EAAE,KAAK;GAAC;GAAQ;GAAU;EAAQ,CAAC;EAC9C,WAAW,EAAE,OAAO;GAClB,UAAU,EAAE,KAAK,CAAC,UAAU,OAAO,CAAC;GACpC,MAAM;GACN,UAAU,EAAE,KAAK;IAAC;IAAO;IAAU;GAAW,CAAC;GAC/C,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;EAC9B,CAAC;EACD,eAAe,EAAE,mBAAmB,QAAQ,CAC1C,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAS,EAAE,CAAC,GACvC,EAAE,OAAO;GACP,MAAM,EAAE,QAAQ,iBAAiB;GACjC,QAAQ,EAAE,OAAO;GACjB,iBAAiB;GACjB,WAAW,EAAE,OAAO;GACpB,kBAAkB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;EAC9C,CAAC,CACH,CAAC;CACH,CAAC;AACH,CAAC;AAED,MAAa,8BAA8B,EAAE,KAAK;CAAC;CAAS;CAAU;AAAU,CAAC;;AAGjF,MAAa,6BAA6B,EAAE,KAAK;CAC/C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAa,gCAAgC,EAC1C,OAAO;CACN,gBAAgB,EACb,OAAO,CAAC,CACR,SAAS,CAAC,CACV,SAAS,4DAA4D;CACxE,eAAe,EACZ,OAAO;EAAE,YAAY,EAAE,OAAO;EAAG,MAAM;CAA2B,CAAC,CAAC,CACpE,SAAS,CAAC,CACV,SACC,gHACF;AACJ,CAAC,CAAC,CACD,SAAS,2DAA2D;AAEvE,MAAa,8BAA8B,EAAE,OAAO;CAClD,IAAI,EAAE,OAAO;CACb,MAAM,EAAE,OAAO;CACf,QAAQ;CACR,YAAY;CACZ,cAAc;CACd,kBAAkB;CAClB,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC;CAC9B,YAAY;CACZ,WAAW,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;CACpD,WAAW,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;AACtD,CAAC;AAED,MAAa,mCAAmC,EAAE,OAAO;CACvD,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACtB,QAAQ,4BAA4B,QAAQ,QAAQ;CACpD,cAAc;CACd,kBAAkB;CAClB,MAAM;AACR,CAAC;AAED,MAAa,mCAAmC,EAAE,OAAO;CACvD,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACjC,QAAQ,4BAA4B,SAAS;CAC7C,cAAc,gCAAgC,SAAS;CACvD,kBAAkB,8BAA8B,SAAS;CACzD,MAAM,+BAA+B,SAAS;AAChD,CAAC"}

package/dist/node/crypto.d.ts

@@ -0,0 +1,6 @@
+//#region src/crypto.d.ts
+declare function timingSafeEqualText(first: string, second: string): Promise<boolean>;
+declare function timingSafeEqualBytes(first: Uint8Array, second: Uint8Array): Promise<boolean>;
+//#endregion
+export { timingSafeEqualBytes, timingSafeEqualText };
+//# sourceMappingURL=crypto.d.ts.map

package/dist/node/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","names":[],"sources":["../../src/crypto.ts"],"mappings":";iBA0KsB,oBAAoB,eAAe,iBAAc;iBAIjD,qBAAqB,OAAO,YAAY,QAAQ,aAAU"}

package/dist/node/crypto.js

@@ -0,0 +1,103 @@
+//#region src/crypto.ts
+const textEncoder = new TextEncoder();
+const textDecoder = new TextDecoder();
+const hmacHashName = (algorithm) => ({
+	sha1: "SHA-1",
+	sha256: "SHA-256",
+	sha512: "SHA-512"
+})[algorithm];
+function toArrayBuffer(bytes) {
+	const copy = new Uint8Array(bytes.byteLength);
+	copy.set(bytes);
+	return copy.buffer;
+}
+function utf8Bytes(value) {
+	return textEncoder.encode(value);
+}
+function assertAscii(value, label) {
+	for (let index = 0; index < value.length; index += 1) if (value.charCodeAt(index) > 127) throw new Error(`${label} must contain ASCII characters only`);
+}
+function asciiToBase64(value, label) {
+	assertAscii(value, label);
+	return btoa(value);
+}
+function bytesToBase64(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary);
+}
+function bytesToBase64Url(bytes) {
+	return bytesToBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function decodeHex(value) {
+	const normalized = value.trim();
+	if (normalized.length === 0 || normalized.length % 2 !== 0 || /[^0-9a-f]/i.test(normalized)) return null;
+	const bytes = new Uint8Array(normalized.length / 2);
+	for (let index = 0; index < normalized.length; index += 2) bytes[index / 2] = Number.parseInt(normalized.slice(index, index + 2), 16);
+	return bytes;
+}
+function decodeBase64(value, encoding) {
+	const normalized = normalizeBase64(value, encoding);
+	if (!normalized) return null;
+	try {
+		const binary = atob(normalized);
+		const bytes = new Uint8Array(binary.length);
+		for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
+		return bytes;
+	} catch {
+		return null;
+	}
+}
+function decodeBase64ToText(value, encoding) {
+	const bytes = decodeBase64(value, encoding);
+	if (!bytes) return null;
+	return textDecoder.decode(bytes);
+}
+function normalizeBase64(value, encoding) {
+	let normalized = value.trim();
+	if (!normalized) return null;
+	if (encoding === "base64url") normalized = normalized.replace(/-/g, "+").replace(/_/g, "/");
+	const paddingLength = (4 - normalized.length % 4) % 4;
+	return `${normalized}${"=".repeat(paddingLength)}`;
+}
+function randomBase64Url(bytes = 32) {
+	const data = new Uint8Array(bytes);
+	crypto.getRandomValues(data);
+	return bytesToBase64Url(data);
+}
+async function sha256Bytes(bytes) {
+	return new Uint8Array(await crypto.subtle.digest("SHA-256", toArrayBuffer(bytes)));
+}
+async function sha256Base64Url(value) {
+	return bytesToBase64Url(await sha256Bytes(utf8Bytes(value)));
+}
+async function importHmacKey(input) {
+	return await crypto.subtle.importKey("raw", toArrayBuffer(utf8Bytes(input.secret)), {
+		name: "HMAC",
+		hash: hmacHashName(input.algorithm)
+	}, false, ["sign", "verify"]);
+}
+async function verifyHmacSignature(input) {
+	const key = await importHmacKey(input);
+	return await crypto.subtle.verify("HMAC", key, toArrayBuffer(input.signature), toArrayBuffer(input.payload));
+}
+async function digestEqual(first, second) {
+	const [firstDigest, secondDigest] = await Promise.all([sha256Bytes(first), sha256Bytes(second)]);
+	return equalLengthBytes(firstDigest, secondDigest);
+}
+function equalLengthBytes(first, second) {
+	if (first.length !== second.length) return false;
+	let diff = 0;
+	for (let index = 0; index < first.length; index += 1) diff |= first[index] ^ second[index];
+	return diff === 0;
+}
+async function timingSafeEqualText(first, second) {
+	return await digestEqual(utf8Bytes(first), utf8Bytes(second));
+}
+async function timingSafeEqualBytes(first, second) {
+	return await digestEqual(first, second);
+}
+//#endregion
+export { asciiToBase64, assertAscii, bytesToBase64, bytesToBase64Url, decodeBase64, decodeBase64ToText, decodeHex, digestEqual, importHmacKey, normalizeBase64, randomBase64Url, sha256Base64Url, sha256Bytes, timingSafeEqualBytes, timingSafeEqualText, toArrayBuffer, utf8Bytes, verifyHmacSignature };
+
+//# sourceMappingURL=crypto.js.map

package/dist/node/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","names":[],"sources":["../../src/crypto.ts"],"sourcesContent":["const textEncoder = new TextEncoder();\nconst textDecoder = new TextDecoder();\n\nexport type HmacAlgorithm = \"sha1\" | \"sha256\" | \"sha512\";\n\nconst hmacHashName = (algorithm: HmacAlgorithm) =>\n  ({\n    sha1: \"SHA-1\",\n    sha256: \"SHA-256\",\n    sha512: \"SHA-512\",\n  })[algorithm];\n\nexport function toArrayBuffer(bytes: Uint8Array): ArrayBuffer {\n  const copy = new Uint8Array(bytes.byteLength);\n  copy.set(bytes);\n  return copy.buffer;\n}\n\nexport function utf8Bytes(value: string) {\n  return textEncoder.encode(value);\n}\n\nexport function assertAscii(value: string, label: string) {\n  for (let index = 0; index < value.length; index += 1) {\n    if (value.charCodeAt(index) > 0x7f) {\n      throw new Error(`${label} must contain ASCII characters only`);\n    }\n  }\n}\n\nexport function asciiToBase64(value: string, label: string) {\n  assertAscii(value, label);\n  return btoa(value);\n}\n\nexport function bytesToBase64(bytes: Uint8Array) {\n  let binary = \"\";\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary);\n}\n\nexport function bytesToBase64Url(bytes: Uint8Array) {\n  return bytesToBase64(bytes).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nexport function bytesToHex(bytes: Uint8Array) {\n  return [...bytes].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nexport function decodeHex(value: string) {\n  const normalized = value.trim();\n  if (normalized.length === 0 || normalized.length % 2 !== 0 || /[^0-9a-f]/i.test(normalized)) {\n    return null;\n  }\n\n  const bytes = new Uint8Array(normalized.length / 2);\n  for (let index = 0; index < normalized.length; index += 2) {\n    bytes[index / 2] = Number.parseInt(normalized.slice(index, index + 2), 16);\n  }\n  return bytes;\n}\n\nexport function decodeBase64(value: string, encoding: \"base64\" | \"base64url\") {\n  const normalized = normalizeBase64(value, encoding);\n  if (!normalized) {\n    return null;\n  }\n\n  try {\n    const binary = atob(normalized);\n    const bytes = new Uint8Array(binary.length);\n    for (let index = 0; index < binary.length; index += 1) {\n      bytes[index] = binary.charCodeAt(index);\n    }\n    return bytes;\n  } catch {\n    return null;\n  }\n}\n\nexport function decodeBase64ToText(value: string, encoding: \"base64\" | \"base64url\") {\n  const bytes = decodeBase64(value, encoding);\n  if (!bytes) {\n    return null;\n  }\n\n  return textDecoder.decode(bytes);\n}\n\nexport function normalizeBase64(value: string, encoding: \"base64\" | \"base64url\") {\n  let normalized = value.trim();\n  if (!normalized) {\n    return null;\n  }\n\n  if (encoding === \"base64url\") {\n    normalized = normalized.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  }\n\n  const paddingLength = (4 - (normalized.length % 4)) % 4;\n  return `${normalized}${\"=\".repeat(paddingLength)}`;\n}\n\nexport function randomBase64Url(bytes = 32) {\n  const data = new Uint8Array(bytes);\n  crypto.getRandomValues(data);\n  return bytesToBase64Url(data);\n}\n\nexport async function sha256Bytes(bytes: Uint8Array) {\n  return new Uint8Array(await crypto.subtle.digest(\"SHA-256\", toArrayBuffer(bytes)));\n}\n\nexport async function sha256Base64Url(value: string) {\n  return bytesToBase64Url(await sha256Bytes(utf8Bytes(value)));\n}\n\nexport async function importHmacKey(input: { algorithm: HmacAlgorithm; secret: string }) {\n  return await crypto.subtle.importKey(\n    \"raw\",\n    toArrayBuffer(utf8Bytes(input.secret)),\n    { name: \"HMAC\", hash: hmacHashName(input.algorithm) },\n    false,\n    [\"sign\", \"verify\"],\n  );\n}\n\nexport async function signHmacBytes(input: {\n  algorithm: HmacAlgorithm;\n  secret: string;\n  payload: Uint8Array;\n}) {\n  const key = await importHmacKey(input);\n  return new Uint8Array(await crypto.subtle.sign(\"HMAC\", key, toArrayBuffer(input.payload)));\n}\n\nexport async function verifyHmacSignature(input: {\n  algorithm: HmacAlgorithm;\n  secret: string;\n  payload: Uint8Array;\n  signature: Uint8Array;\n}) {\n  const key = await importHmacKey(input);\n  return await crypto.subtle.verify(\n    \"HMAC\",\n    key,\n    toArrayBuffer(input.signature),\n    toArrayBuffer(input.payload),\n  );\n}\n\nexport async function digestEqual(first: Uint8Array, second: Uint8Array) {\n  const [firstDigest, secondDigest] = await Promise.all([sha256Bytes(first), sha256Bytes(second)]);\n  return equalLengthBytes(firstDigest, secondDigest);\n}\n\nfunction equalLengthBytes(first: Uint8Array, second: Uint8Array) {\n  if (first.length !== second.length) {\n    return false;\n  }\n\n  let diff = 0;\n  for (let index = 0; index < first.length; index += 1) {\n    diff |= first[index] ^ second[index];\n  }\n  return diff === 0;\n}\n\nexport async function timingSafeEqualText(first: string, second: string) {\n  return await digestEqual(utf8Bytes(first), utf8Bytes(second));\n}\n\nexport async function timingSafeEqualBytes(first: Uint8Array, second: Uint8Array) {\n  return await digestEqual(first, second);\n}\n"],"mappings":";AAAA,MAAM,cAAc,IAAI,YAAY;AACpC,MAAM,cAAc,IAAI,YAAY;AAIpC,MAAM,gBAAgB,eACnB;CACC,MAAM;CACN,QAAQ;CACR,QAAQ;AACV,EAAA,CAAG;AAEL,SAAgB,cAAc,OAAgC;CAC5D,MAAM,OAAO,IAAI,WAAW,MAAM,UAAU;CAC5C,KAAK,IAAI,KAAK;CACd,OAAO,KAAK;AACd;AAEA,SAAgB,UAAU,OAAe;CACvC,OAAO,YAAY,OAAO,KAAK;AACjC;AAEA,SAAgB,YAAY,OAAe,OAAe;CACxD,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GACjD,IAAI,MAAM,WAAW,KAAK,IAAI,KAC5B,MAAM,IAAI,MAAM,GAAG,MAAM,oCAAoC;AAGnE;AAEA,SAAgB,cAAc,OAAe,OAAe;CAC1D,YAAY,OAAO,KAAK;CACxB,OAAO,KAAK,KAAK;AACnB;AAEA,SAAgB,cAAc,OAAmB;CAC/C,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OACjB,UAAU,OAAO,aAAa,IAAI;CAEpC,OAAO,KAAK,MAAM;AACpB;AAEA,SAAgB,iBAAiB,OAAmB;CAClD,OAAO,cAAc,KAAK,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;AACvF;AAMA,SAAgB,UAAU,OAAe;CACvC,MAAM,aAAa,MAAM,KAAK;CAC9B,IAAI,WAAW,WAAW,KAAK,WAAW,SAAS,MAAM,KAAK,aAAa,KAAK,UAAU,GACxF,OAAO;CAGT,MAAM,QAAQ,IAAI,WAAW,WAAW,SAAS,CAAC;CAClD,KAAK,IAAI,QAAQ,GAAG,QAAQ,WAAW,QAAQ,SAAS,GACtD,MAAM,QAAQ,KAAK,OAAO,SAAS,WAAW,MAAM,OAAO,QAAQ,CAAC,GAAG,EAAE;CAE3E,OAAO;AACT;AAEA,SAAgB,aAAa,OAAe,UAAkC;CAC5E,MAAM,aAAa,gBAAgB,OAAO,QAAQ;CAClD,IAAI,CAAC,YACH,OAAO;CAGT,IAAI;EACF,MAAM,SAAS,KAAK,UAAU;EAC9B,MAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;EAC1C,KAAK,IAAI,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS,GAClD,MAAM,SAAS,OAAO,WAAW,KAAK;EAExC,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAgB,mBAAmB,OAAe,UAAkC;CAClF,MAAM,QAAQ,aAAa,OAAO,QAAQ;CAC1C,IAAI,CAAC,OACH,OAAO;CAGT,OAAO,YAAY,OAAO,KAAK;AACjC;AAEA,SAAgB,gBAAgB,OAAe,UAAkC;CAC/E,IAAI,aAAa,MAAM,KAAK;CAC5B,IAAI,CAAC,YACH,OAAO;CAGT,IAAI,aAAa,aACf,aAAa,WAAW,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG;CAG9D,MAAM,iBAAiB,IAAK,WAAW,SAAS,KAAM;CACtD,OAAO,GAAG,aAAa,IAAI,OAAO,aAAa;AACjD;AAEA,SAAgB,gBAAgB,QAAQ,IAAI;CAC1C,MAAM,OAAO,IAAI,WAAW,KAAK;CACjC,OAAO,gBAAgB,IAAI;CAC3B,OAAO,iBAAiB,IAAI;AAC9B;AAEA,eAAsB,YAAY,OAAmB;CACnD,OAAO,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,cAAc,KAAK,CAAC,CAAC;AACnF;AAEA,eAAsB,gBAAgB,OAAe;CACnD,OAAO,iBAAiB,MAAM,YAAY,UAAU,KAAK,CAAC,CAAC;AAC7D;AAEA,eAAsB,cAAc,OAAqD;CACvF,OAAO,MAAM,OAAO,OAAO,UACzB,OACA,cAAc,UAAU,MAAM,MAAM,CAAC,GACrC;EAAE,MAAM;EAAQ,MAAM,aAAa,MAAM,SAAS;CAAE,GACpD,OACA,CAAC,QAAQ,QAAQ,CACnB;AACF;AAWA,eAAsB,oBAAoB,OAKvC;CACD,MAAM,MAAM,MAAM,cAAc,KAAK;CACrC,OAAO,MAAM,OAAO,OAAO,OACzB,QACA,KACA,cAAc,MAAM,SAAS,GAC7B,cAAc,MAAM,OAAO,CAC7B;AACF;AAEA,eAAsB,YAAY,OAAmB,QAAoB;CACvE,MAAM,CAAC,aAAa,gBAAgB,MAAM,QAAQ,IAAI,CAAC,YAAY,KAAK,GAAG,YAAY,MAAM,CAAC,CAAC;CAC/F,OAAO,iBAAiB,aAAa,YAAY;AACnD;AAEA,SAAS,iBAAiB,OAAmB,QAAoB;CAC/D,IAAI,MAAM,WAAW,OAAO,QAC1B,OAAO;CAGT,IAAI,OAAO;CACX,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GACjD,QAAQ,MAAM,SAAS,OAAO;CAEhC,OAAO,SAAS;AAClB;AAEA,eAAsB,oBAAoB,OAAe,QAAgB;CACvE,OAAO,MAAM,YAAY,UAAU,KAAK,GAAG,UAAU,MAAM,CAAC;AAC9D;AAEA,eAAsB,qBAAqB,OAAmB,QAAoB;CAChF,OAAO,MAAM,YAAY,OAAO,MAAM;AACxC"}