@gathertown/webhook-object-sdk 0.1.1 → 0.2.0

package/dist/src/catalog.js

@@ -1,31 +1,40 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createWebhookObjectCatalog = void 0;
-const client_1 = require("./client");
-/**
- * Build a named catalog of webhook-object clients so multiple Smart Objects (inboxes,
- * lamps, counters, …) stay at hand behind one value. Each entry is just its (url, secret)
- * pair, each secret authenticates only its own object.
- *
- * Entries with a `preset` get a compile-time-narrowed `send`: an `inbox` client only
- * accepts inbox event types, so wiring the lamp's events to the inbox is a type error.
- *
- * ```ts
- * const office = createWebhookObjectCatalog({
- *   supportInbox: { url: INBOX_URL, secret: secretFromEnv("GATHER_INBOX_SECRET"), preset: "inbox" },
- *   buildLamp: { url: LAMP_URL, secret: secretFromEnv("GATHER_LAMP_SECRET"), preset: "switch" },
- * })
- * await office.supportInbox.send("activity.add", { id: "pr-142", text: "PR #142 merged" })
- * await office.buildLamp.send("switch.toggle")
- * ```
- */
-const createWebhookObjectCatalog = (entries, options = {}) => 
-// fromEntries can't see the per-entry preset literals, so it needs the double assertion to
-// reach the mapped catalog type; per-name correctness is covered by compile-time tests.
-// eslint-disable-next-line @typescript-eslint/consistent-type-assertions
-Object.fromEntries(Object.entries(entries).map(([name, entry]) => [
-    name,
-    (0, client_1.createWebhookObjectClient)({ ...entry, ...options }),
-]));
-exports.createWebhookObjectCatalog = createWebhookObjectCatalog;
-//# sourceMappingURL=catalog.js.map
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var catalog_exports = {};
+__export(catalog_exports, {
+  createWebhookObjectCatalog: () => createWebhookObjectCatalog
+});
+module.exports = __toCommonJS(catalog_exports);
+var import_client = require("./client");
+const createWebhookObjectCatalog = (entries, options = {}) => (
+  // fromEntries can't see the per-entry preset literals, so it needs the double assertion to
+  // reach the mapped catalog type; per-name correctness is covered by compile-time tests.
+  // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
+  Object.fromEntries(
+    Object.entries(entries).map(([name, entry]) => [
+      name,
+      (0, import_client.createWebhookObjectClient)({ ...entry, ...options })
+    ])
+  )
+);
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createWebhookObjectCatalog
+});
+//# sourceMappingURL=catalog.js.map

package/dist/src/catalog.js.map

@@ -1 +1,7 @@
-{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/catalog.ts"],"names":[],"mappings":";;;AACA,qCAAoG;AA0BpG;;;;;;;;;;;;;;;;GAgBG;AACI,MAAM,0BAA0B,GAAG,CAGxC,OAAgB,EAChB,UAAuC,EAAE,EACV,EAAE;AACjC,2FAA2F;AAC3F,wFAAwF;AACxF,yEAAyE;AACzE,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC7C,IAAI;IACJ,IAAA,kCAAyB,EAAC,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;CACpD,CAAC,CACyC,CAAA;AAdlC,QAAA,0BAA0B,8BAcQ"}
+{
+  "version": 3,
+  "sources": ["../../src/catalog.ts"],
+  "sourcesContent": ["import type { WebhookObjectPreset } from \"@gathertown/webhook-object-types\"\nimport { createWebhookObjectClient, WebhookObjectClient, WebhookObjectClientConfig } from \"./client\"\n\n/** Runtime options that apply to every client in the catalog rather than a single object. */\ntype SharedClientOption = \"maxAttempts\" | \"fetch\" | \"newWebhookId\"\n\n/** Per-object entry: the (url, secret) pair plus optional compile-time preset scoping. */\nexport type WebhookObjectCatalogEntry = Omit<WebhookObjectClientConfig, SharedClientOption>\n\n/** Options shared by every client in the catalog. */\nexport type WebhookObjectCatalogOptions = Pick<WebhookObjectClientConfig, SharedClientOption>\n\n/** The preset literal declared on an entry, or `undefined` when the entry has none. */\ntype PresetOf<Entry extends WebhookObjectCatalogEntry> = Entry extends {\n  preset: infer Preset extends WebhookObjectPreset\n}\n  ? Preset\n  : undefined\n\n/**\n * The value returned by `createWebhookObjectCatalog`: each entry name maps to a client whose\n * `send` is narrowed to that entry's declared preset (or unconstrained when it has none).\n */\nexport type WebhookObjectCatalog<Entries extends Record<string, WebhookObjectCatalogEntry>> = {\n  [Name in keyof Entries]: WebhookObjectClient<PresetOf<Entries[Name]>>\n}\n\n/**\n * Build a named catalog of webhook-object clients so multiple Smart Objects (inboxes,\n * lamps, counters, \u2026) stay at hand behind one value. Each entry is just its (url, secret)\n * pair, each secret authenticates only its own object.\n *\n * Entries with a `preset` get a compile-time-narrowed `send`: an `inbox` client only\n * accepts inbox event types, so wiring the lamp's events to the inbox is a type error.\n *\n * ```ts\n * const office = createWebhookObjectCatalog({\n *   supportInbox: { url: INBOX_URL, secret: secretFromEnv(\"GATHER_INBOX_SECRET\"), preset: \"inbox\" },\n *   buildLamp: { url: LAMP_URL, secret: secretFromEnv(\"GATHER_LAMP_SECRET\"), preset: \"switch\" },\n * })\n * await office.supportInbox.send(\"activity.add\", { id: \"pr-142\", text: \"PR #142 merged\" })\n * await office.buildLamp.send(\"switch.toggle\")\n * ```\n */\nexport const createWebhookObjectCatalog = <\n  const Entries extends Record<string, WebhookObjectCatalogEntry>,\n>(\n  entries: Entries,\n  options: WebhookObjectCatalogOptions = {},\n): WebhookObjectCatalog<Entries> =>\n  // fromEntries can't see the per-entry preset literals, so it needs the double assertion to\n  // reach the mapped catalog type; per-name correctness is covered by compile-time tests.\n  // eslint-disable-next-line @typescript-eslint/consistent-type-assertions\n  Object.fromEntries(\n    Object.entries(entries).map(([name, entry]) => [\n      name,\n      createWebhookObjectClient({ ...entry, ...options }),\n    ]),\n  ) as unknown as WebhookObjectCatalog<Entries>\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,oBAA0F;AA2CnF,MAAM,6BAA6B,CAGxC,SACA,UAAuC,CAAC;AAAA;AAAA;AAAA;AAAA,EAKxC,OAAO;AAAA,IACL,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;AAAA,MAC7C;AAAA,UACA,yCAA0B,EAAE,GAAG,OAAO,GAAG,QAAQ,CAAC;AAAA,IACpD,CAAC;AAAA,EACH;AAAA;",
+  "names": []
+}

package/dist/src/client.js

@@ -1,118 +1,110 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createWebhookObjectClient = void 0;
-const standardwebhooks_1 = require("standardwebhooks");
-const deliver_1 = require("./deliver");
-const errors_1 = require("./errors");
-const secret_1 = require("./secret");
-/** Hosts allowed to receive cleartext http, so local development keeps working. */
-const LOCAL_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]"]);
-/**
- * Signing authenticates but does not encrypt: over plain http the payload, headers, and
- * signature travel in cleartext. Refuse everything but https, except toward localhost.
- */
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var client_exports = {};
+__export(client_exports, {
+  createWebhookObjectClient: () => createWebhookObjectClient
+});
+module.exports = __toCommonJS(client_exports);
+var import_standardwebhooks = require("standardwebhooks");
+var import_deliver = require("./deliver");
+var import_errors = require("./errors");
+var import_secret = require("./secret");
+const LOCAL_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
 const assertValidUrl = (url) => {
-    let parsed;
-    try {
-        parsed = new URL(url);
-    }
-    catch (cause) {
-        throw new errors_1.WebhookObjectError("invalid_url", `webhook object URL is not a valid URL: ${url}`, {
-            cause,
-        });
-    }
-    if (parsed.protocol === "https:")
-        return;
-    if (parsed.protocol === "http:" && LOCAL_HOSTNAMES.has(parsed.hostname))
-        return;
-    throw new errors_1.WebhookObjectError("invalid_url", `webhook object URL must use https (got ${parsed.protocol}//); http is allowed only for localhost`);
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch (cause) {
+    throw new import_errors.WebhookObjectError("invalid_url", `webhook object URL is not a valid URL: ${url}`, {
+      cause
+    });
+  }
+  if (parsed.protocol === "https:") return;
+  if (parsed.protocol === "http:" && LOCAL_HOSTNAMES.has(parsed.hostname)) return;
+  throw new import_errors.WebhookObjectError(
+    "invalid_url",
+    `webhook object URL must use https (got ${parsed.protocol}//); http is allowed only for localhost`
+  );
 };
-/** Fluent method → wire method segment: `setState` → `set_state`. */
 const wireMethodName = (method) => method.replace(/[A-Z]/g, (char) => `_${char.toLowerCase()}`);
-/**
- * Properties runtimes probe on arbitrary objects (`await` checks `then`, serializers check
- * `toJSON`). The capability proxy must not answer these, or `await client.counter` would hang.
- */
-const PROBED_PROPS = new Set(["then", "toJSON"]);
-/** Both "accepted" statuses; extra body fields (if the receiver ever adds any) pass through. */
+const PROBED_PROPS = /* @__PURE__ */ new Set(["then", "toJSON"]);
 const isSendResult = (body) => body.status === "dispatched" || body.status === "space_idle";
-/** The pong snapshot, checked field by field: the wire is untrusted, so the shape is proven. */
-const isPingResult = (body) => body.status === "pong" &&
-    typeof body.objectId === "string" &&
-    typeof body.spaceId === "string" &&
-    (body.preset === null || typeof body.preset === "string") &&
-    typeof body.capabilities === "object" &&
-    body.capabilities !== null;
+const isPingResult = (body) => body.status === "pong" && typeof body.objectId === "string" && typeof body.spaceId === "string" && (body.preset === null || typeof body.preset === "string") && typeof body.capabilities === "object" && body.capabilities !== null;
 const serializeEnvelope = (type, data) => {
-    const body = JSON.stringify({ type, timestamp: new Date().toISOString(), data });
-    const byteLength = new TextEncoder().encode(body).length;
-    if (byteLength > deliver_1.MAX_BODY_BYTES)
-        throw new errors_1.WebhookObjectError("payload_too_large", `webhook object payload is ${byteLength} bytes; the server caps bodies at ${deliver_1.MAX_BODY_BYTES} bytes`);
-    return body;
+  const body = JSON.stringify({ type, timestamp: (/* @__PURE__ */ new Date()).toISOString(), data });
+  const byteLength = new TextEncoder().encode(body).length;
+  if (byteLength > import_deliver.MAX_BODY_BYTES)
+    throw new import_errors.WebhookObjectError(
+      "payload_too_large",
+      `webhook object payload is ${byteLength} bytes; the server caps bodies at ${import_deliver.MAX_BODY_BYTES} bytes`
+    );
+  return body;
 };
-/**
- * Create a client for one webhook object. Signing follows Standard Webhooks v1: HMAC over
- * `${id}.${timestamp}.${body}` via the `standardwebhooks` reference library, sent as the
- * `webhook-id` / `webhook-timestamp` / `webhook-signature` headers. The exact serialized
- * body is signed and sent unchanged, so the two can never drift.
- */
 const createWebhookObjectClient = (config) => {
-    assertValidUrl(config.url);
-    // Revealed once here and captured only by the standardwebhooks signer; the returned
-    // client never holds the raw value on an enumerable property.
-    const webhook = new standardwebhooks_1.Webhook((0, secret_1.revealSecret)(config.secret));
-    const fetchImpl = config.fetch ?? fetch;
-    const newWebhookId = config.newWebhookId ?? (() => crypto.randomUUID());
-    const maxAttempts = config.maxAttempts ?? deliver_1.DEFAULT_MAX_ATTEMPTS;
-    /**
-     * Sign, deliver, and narrow the response to the caller's expected shape. The caller controls
-     * the result type, but through a runtime guard rather than a cast: the wire is untrusted, so
-     * an off-contract 200 body throws `unexpected_response` instead of lying about its shape.
-     */
-    const dispatch = async (type, data, isExpectedBody) => {
-        const body = serializeEnvelope(type, data);
-        // One id per event, reused across retries: the server dedups the last 10 ids per
-        // object, so a retry can never double-apply.
-        const webhookId = newWebhookId();
-        const responseBody = await (0, deliver_1.deliver)({
-            url: config.url,
-            body,
-            webhookId,
-            sign: (timestampSeconds) => webhook.sign(webhookId, new Date(timestampSeconds * 1000), body),
-            fetchImpl,
-            maxAttempts,
-            signal: config.signal,
-        });
-        if (!isExpectedBody(responseBody))
-            throw new errors_1.WebhookObjectError("unexpected_response", `webhook object ${type} succeeded but returned an unrecognized body (status: ${String(responseBody.status)})`);
-        return responseBody;
-    };
-    const sendEvent = (type, data) => dispatch(type, data, isSendResult);
-    const base = {
-        send: (type, ...args) => sendEvent(type, args[0] ?? {}),
-        ping: () => dispatch("webhook.ping", {}, isPingResult),
-    };
-    /** `client.counter` → namespace whose method calls become `sendEvent("counter.<method>")`. */
-    const capabilityNamespace = (capability) => new Proxy({}, {
-        get: (_target, method) => {
-            if (typeof method !== "string" || PROBED_PROPS.has(method))
-                return undefined;
-            return (data) => sendEvent(`${capability}.${wireMethodName(method)}`, data ?? {});
-        },
-    });
-    // The fluent surface is type-driven (CapabilityNamespaces); the proxy only assembles wire
-    // names, so new capabilities work via a types-package bump with zero SDK changes.
-    // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
-    return new Proxy(base, {
-        get: (target, prop, receiver) => {
-            // Real members (send/ping) win over capability namespaces, as do symbol lookups.
-            if (prop in target || typeof prop !== "string")
-                return Reflect.get(target, prop, receiver);
-            if (PROBED_PROPS.has(prop))
-                return undefined;
-            return capabilityNamespace(prop);
-        },
+  assertValidUrl(config.url);
+  const webhook = new import_standardwebhooks.Webhook((0, import_secret.revealSecret)(config.secret));
+  const fetchImpl = config.fetch ?? fetch;
+  const newWebhookId = config.newWebhookId ?? (() => crypto.randomUUID());
+  const maxAttempts = config.maxAttempts ?? import_deliver.DEFAULT_MAX_ATTEMPTS;
+  const dispatch = async (type, data, isExpectedBody) => {
+    const body = serializeEnvelope(type, data);
+    const webhookId = newWebhookId();
+    const responseBody = await (0, import_deliver.deliver)({
+      url: config.url,
+      body,
+      webhookId,
+      sign: (timestampSeconds) => webhook.sign(webhookId, new Date(timestampSeconds * 1e3), body),
+      fetchImpl,
+      maxAttempts,
+      signal: config.signal
     });
+    if (!isExpectedBody(responseBody))
+      throw new import_errors.WebhookObjectError(
+        "unexpected_response",
+        `webhook object ${type} succeeded but returned an unrecognized body (status: ${String(responseBody.status)})`
+      );
+    return responseBody;
+  };
+  const sendEvent = (type, data) => dispatch(type, data, isSendResult);
+  const base = {
+    send: (type, ...args) => sendEvent(type, args[0] ?? {}),
+    ping: () => dispatch("webhook.ping", {}, isPingResult)
+  };
+  const capabilityNamespace = (capability) => new Proxy(
+    {},
+    {
+      get: (_target, method) => {
+        if (typeof method !== "string" || PROBED_PROPS.has(method)) return void 0;
+        return (data) => sendEvent(`${capability}.${wireMethodName(method)}`, data ?? {});
+      }
+    }
+  );
+  return new Proxy(base, {
+    get: (target, prop, receiver) => {
+      if (prop in target || typeof prop !== "string") return Reflect.get(target, prop, receiver);
+      if (PROBED_PROPS.has(prop)) return void 0;
+      return capabilityNamespace(prop);
+    }
+  });
 };
-exports.createWebhookObjectClient = createWebhookObjectClient;
-//# sourceMappingURL=client.js.map
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createWebhookObjectClient
+});
+//# sourceMappingURL=client.js.map

package/dist/src/client.js.map

@@ -1 +1,7 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":";;;AAAA,uDAA0C;AAS1C,uCAAyE;AACzE,qCAA6C;AAC7C,qCAA4D;AAkG5D,mFAAmF;AACnF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAA;AAEpE;;;GAGG;AACH,MAAM,cAAc,GAAG,CAAC,GAAW,EAAQ,EAAE;IAC3C,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,2BAAkB,CAAC,aAAa,EAAE,0CAA0C,GAAG,EAAE,EAAE;YAC3F,KAAK;SACN,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAM;IACxC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAM;IAC/E,MAAM,IAAI,2BAAkB,CAC1B,aAAa,EACb,0CAA0C,MAAM,CAAC,QAAQ,yCAAyC,CACnG,CAAA;AACH,CAAC,CAAA;AAED,qEAAqE;AACrE,MAAM,cAAc,GAAG,CAAC,MAAc,EAAU,EAAE,CAChD,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;AAE9D;;;GAGG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;AAEhD,gGAAgG;AAChG,MAAM,YAAY,GAAG,CAAC,IAA6B,EAAsB,EAAE,CACzE,IAAI,CAAC,MAAM,KAAK,YAAY,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,CAAA;AAE9D,gGAAgG;AAChG,MAAM,YAAY,GAAG,CAAC,IAA6B,EAAsB,EAAE,CACzE,IAAI,CAAC,MAAM,KAAK,MAAM;IACtB,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;IACjC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;IAChC,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC;IACzD,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;IACrC,IAAI,CAAC,YAAY,KAAK,IAAI,CAAA;AAE5B,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAE,IAAa,EAAU,EAAE;IAChE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAChF,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAA;IACxD,IAAI,UAAU,GAAG,wBAAc;QAC7B,MAAM,IAAI,2BAAkB,CAC1B,mBAAmB,EACnB,6BAA6B,UAAU,qCAAqC,wBAAc,QAAQ,CACnG,CAAA;IACH,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED;;;;;GAKG;AACI,MAAM,yBAAyB,GAAG,CACvC,MAAkD,EAC1B,EAAE;IAC1B,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC1B,oFAAoF;IACpF,8DAA8D;IAC9D,MAAM,OAAO,GAAG,IAAI,0BAAO,CAAC,IAAA,qBAAY,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IACxD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAA;IACvC,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAA;IACvE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,8BAAoB,CAAA;IAE9D;;;;OAIG;IACH,MAAM,QAAQ,GAAG,KAAK,EACpB,IAAY,EACZ,IAAa,EACb,cAA4D,EAChD,EAAE;QACd,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAC1C,iFAAiF;QACjF,6CAA6C;QAC7C,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;QAChC,MAAM,YAAY,GAAG,MAAM,IAAA,iBAAO,EAAC;YACjC,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,IAAI;YACJ,SAAS;YACT,IAAI,EAAE,CAAC,gBAAgB,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC;YAC5F,SAAS;YACT,WAAW;YACX,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAA;QACF,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC;YAC/B,MAAM,IAAI,2BAAkB,CAC1B,qBAAqB,EACrB,kBAAkB,IAAI,yDAAyD,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAC9G,CAAA;QACH,OAAO,YAAY,CAAA;IACrB,CAAC,CAAA;IAED,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,IAAa,EAAuB,EAAE,CACrE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,CAAA;IAEpC,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,CAAgC,IAAO,EAAE,GAAG,IAAiB,EAAuB,EAAE,CAC1F,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,EAAE,GAAwB,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,EAAE,YAAY,CAAC;KAC5E,CAAA;IAED,8FAA8F;IAC9F,MAAM,mBAAmB,GAAG,CAAC,UAAkB,EAAE,EAAE,CACjD,IAAI,KAAK,CACP,EAAE,EACF;QACE,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACvB,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAA;YAC5E,OAAO,CAAC,IAAc,EAAE,EAAE,CACxB,SAAS,CAAC,GAAG,UAAU,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;QACpE,CAAC;KACF,CACF,CAAA;IAEH,0FAA0F;IAC1F,kFAAkF;IAClF,yEAAyE;IACzE,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE;QACrB,GAAG,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;YAC9B,iFAAiF;YACjF,IAAI,IAAI,IAAI,MAAM,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;YAC1F,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAA;YAC5C,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAA;QAClC,CAAC;KACF,CAA2B,CAAA;AAC9B,CAAC,CAAA;AA3EY,QAAA,yBAAyB,6BA2ErC"}
+{
+  "version": 3,
+  "sources": ["../../src/client.ts"],
+  "sourcesContent": ["import { Webhook } from \"standardwebhooks\"\n\nimport type {\n  DataFor,\n  EventTypeForPreset,\n  ReservedEventType,\n  WebhookEventType,\n  WebhookObjectPreset,\n} from \"@gathertown/webhook-object-types\"\nimport { DEFAULT_MAX_ATTEMPTS, deliver, MAX_BODY_BYTES } from \"./deliver\"\nimport { WebhookObjectError } from \"./errors\"\nimport { revealSecret, WebhookObjectSecret } from \"./secret\"\n\nexport type WebhookObjectClientConfig = {\n  /** The object's full webhook URL (copied from the object's \u22EE menu in Gather). */\n  url: string\n  /**\n   * The object's signing secret (per-object; never shared between objects). Either the raw\n   * `whsec_\u2026` string, or (recommended) an opaque handle from `secretFromEnv()` /\n   * `unsafeSecretLiteral()`, which redacts itself if the config is ever logged or serialized.\n   */\n  secret: WebhookObjectSecret | string\n  /**\n   * Compile-time narrowing only: when set, `send` accepts only event types this preset\n   * declares (plus reserved `webhook.*`). The server enforces the same thing at runtime.\n   */\n  preset?: WebhookObjectPreset\n  /** Total delivery attempts per event (initial + retries on 429/5xx/network). Default 3. */\n  maxAttempts?: number\n  /** Custom fetch implementation (tests, proxies). Defaults to the global fetch (Node 18+). */\n  fetch?: typeof fetch\n  /**\n   * Override the per-event `webhook-id` generator. Defaults to the global `crypto.randomUUID`;\n   * inject your own for runtimes without global `crypto`, or for deterministic tests. Must return\n   * a unique value per event (the server dedups by id, so reused ids would drop distinct events).\n   */\n  newWebhookId?: () => string\n  /**\n   * Cancels an in-flight `send`/`ping`, including any pending retry backoff, when aborted.\n   * The call rejects with a `WebhookObjectError` whose `code` is `aborted`.\n   */\n  signal?: AbortSignal\n}\n\n/**\n * Event types a client scoped to preset `P` may send. Intersected with `WebhookEventType`\n * so `DataFor<T>` stays applicable while `P` is still generic.\n */\nexport type AllowedEventType<P extends WebhookObjectPreset | undefined> =\n  (P extends WebhookObjectPreset ? EventTypeForPreset<P> : WebhookEventType) & WebhookEventType\n\n/** Empty-payload events take no `data` argument; everything else requires one. */\ntype DataArgs<T extends WebhookEventType> =\n  DataFor<T> extends Record<string, never> ? [] : [data: DataFor<T>]\n\n/** Both statuses mean \"accepted\": `space_idle` means the space wasn't live, and the event was persisted for it. */\nexport type SendResult = { status: \"dispatched\" | \"space_idle\" }\n\n/** The `webhook.ping` snapshot: what this object is and what it currently accepts. */\nexport type PingResult = {\n  status: \"pong\"\n  objectId: string\n  spaceId: string\n  preset: WebhookObjectPreset | null\n  capabilities: Record<string, unknown>\n}\n\n/** `set_state` \u2192 `setState`: fluent method names are idiomatic camelCase versions of wire names. */\ntype SnakeToCamel<S extends string> = S extends `${infer Head}_${infer Tail}`\n  ? `${Head}${Capitalize<SnakeToCamel<Tail>>}`\n  : S\n\n/** The capability segment of an event type: `\"counter.reset\"` \u2192 `\"counter\"`. */\ntype CapabilityNameOf<E extends string> = E extends `${infer Capability}.${string}`\n  ? Capability\n  : never\n\n/**\n * Capability-namespaced sugar over `send`: `client.counter.reset()`,\n * `client.switch.setState({ on: true })`. Derived entirely from the generated event union, so\n * new capabilities appear via a types-package bump; reserved `webhook.*` events are excluded\n * (`ping()` is first-class). Backed by a `Proxy` at runtime: no codegen, no runtime catalog.\n */\nexport type CapabilityNamespaces<Events extends WebhookEventType> = {\n  [Capability in CapabilityNameOf<Exclude<Events, ReservedEventType>>]: {\n    [Event in Extract<\n      Events,\n      `${Capability}.${string}`\n    > as Event extends `${Capability}.${infer Method}` ? SnakeToCamel<Method> : never]: (\n      ...args: DataArgs<Event>\n    ) => Promise<SendResult>\n  }\n}\n\n/**\n * A client bound to one webhook object. Exposes `send`/`ping` plus the capability-namespaced\n * fluent sugar (`client.counter.increment(...)`). The optional preset `P` narrows every surface\n * to the event types that preset declares.\n */\nexport type WebhookObjectClient<P extends WebhookObjectPreset | undefined = undefined> = {\n  /**\n   * Sign and POST one event. `data` is inferred from the event type and omitted entirely\n   * for empty-payload events (e.g. `send(\"counter.reset\")`).\n   */\n  send<T extends AllowedEventType<P>>(type: T, ...args: DataArgs<T>): Promise<SendResult>\n  /** Verify the URL + secret and fetch the object's declared capability state. */\n  ping(): Promise<PingResult>\n} & CapabilityNamespaces<AllowedEventType<P>>\n\n/** Hosts allowed to receive cleartext http, so local development keeps working. */\nconst LOCAL_HOSTNAMES = new Set([\"localhost\", \"127.0.0.1\", \"[::1]\"])\n\n/**\n * Signing authenticates but does not encrypt: over plain http the payload, headers, and\n * signature travel in cleartext. Refuse everything but https, except toward localhost.\n */\nconst assertValidUrl = (url: string): void => {\n  let parsed: URL\n  try {\n    parsed = new URL(url)\n  } catch (cause) {\n    throw new WebhookObjectError(\"invalid_url\", `webhook object URL is not a valid URL: ${url}`, {\n      cause,\n    })\n  }\n  if (parsed.protocol === \"https:\") return\n  if (parsed.protocol === \"http:\" && LOCAL_HOSTNAMES.has(parsed.hostname)) return\n  throw new WebhookObjectError(\n    \"invalid_url\",\n    `webhook object URL must use https (got ${parsed.protocol}//); http is allowed only for localhost`,\n  )\n}\n\n/** Fluent method \u2192 wire method segment: `setState` \u2192 `set_state`. */\nconst wireMethodName = (method: string): string =>\n  method.replace(/[A-Z]/g, (char) => `_${char.toLowerCase()}`)\n\n/**\n * Properties runtimes probe on arbitrary objects (`await` checks `then`, serializers check\n * `toJSON`). The capability proxy must not answer these, or `await client.counter` would hang.\n */\nconst PROBED_PROPS = new Set([\"then\", \"toJSON\"])\n\n/** Both \"accepted\" statuses; extra body fields (if the receiver ever adds any) pass through. */\nconst isSendResult = (body: Record<string, unknown>): body is SendResult =>\n  body.status === \"dispatched\" || body.status === \"space_idle\"\n\n/** The pong snapshot, checked field by field: the wire is untrusted, so the shape is proven. */\nconst isPingResult = (body: Record<string, unknown>): body is PingResult =>\n  body.status === \"pong\" &&\n  typeof body.objectId === \"string\" &&\n  typeof body.spaceId === \"string\" &&\n  (body.preset === null || typeof body.preset === \"string\") &&\n  typeof body.capabilities === \"object\" &&\n  body.capabilities !== null\n\nconst serializeEnvelope = (type: string, data: unknown): string => {\n  const body = JSON.stringify({ type, timestamp: new Date().toISOString(), data })\n  const byteLength = new TextEncoder().encode(body).length\n  if (byteLength > MAX_BODY_BYTES)\n    throw new WebhookObjectError(\n      \"payload_too_large\",\n      `webhook object payload is ${byteLength} bytes; the server caps bodies at ${MAX_BODY_BYTES} bytes`,\n    )\n  return body\n}\n\n/**\n * Create a client for one webhook object. Signing follows Standard Webhooks v1: HMAC over\n * `${id}.${timestamp}.${body}` via the `standardwebhooks` reference library, sent as the\n * `webhook-id` / `webhook-timestamp` / `webhook-signature` headers. The exact serialized\n * body is signed and sent unchanged, so the two can never drift.\n */\nexport const createWebhookObjectClient = <P extends WebhookObjectPreset | undefined = undefined>(\n  config: WebhookObjectClientConfig & { preset?: P },\n): WebhookObjectClient<P> => {\n  assertValidUrl(config.url)\n  // Revealed once here and captured only by the standardwebhooks signer; the returned\n  // client never holds the raw value on an enumerable property.\n  const webhook = new Webhook(revealSecret(config.secret))\n  const fetchImpl = config.fetch ?? fetch\n  const newWebhookId = config.newWebhookId ?? (() => crypto.randomUUID())\n  const maxAttempts = config.maxAttempts ?? DEFAULT_MAX_ATTEMPTS\n\n  /**\n   * Sign, deliver, and narrow the response to the caller's expected shape. The caller controls\n   * the result type, but through a runtime guard rather than a cast: the wire is untrusted, so\n   * an off-contract 200 body throws `unexpected_response` instead of lying about its shape.\n   */\n  const dispatch = async <R extends Record<string, unknown>>(\n    type: string,\n    data: unknown,\n    isExpectedBody: (body: Record<string, unknown>) => body is R,\n  ): Promise<R> => {\n    const body = serializeEnvelope(type, data)\n    // One id per event, reused across retries: the server dedups the last 10 ids per\n    // object, so a retry can never double-apply.\n    const webhookId = newWebhookId()\n    const responseBody = await deliver({\n      url: config.url,\n      body,\n      webhookId,\n      sign: (timestampSeconds) => webhook.sign(webhookId, new Date(timestampSeconds * 1000), body),\n      fetchImpl,\n      maxAttempts,\n      signal: config.signal,\n    })\n    if (!isExpectedBody(responseBody))\n      throw new WebhookObjectError(\n        \"unexpected_response\",\n        `webhook object ${type} succeeded but returned an unrecognized body (status: ${String(responseBody.status)})`,\n      )\n    return responseBody\n  }\n\n  const sendEvent = (type: string, data: unknown): Promise<SendResult> =>\n    dispatch(type, data, isSendResult)\n\n  const base = {\n    send: <T extends AllowedEventType<P>>(type: T, ...args: DataArgs<T>): Promise<SendResult> =>\n      sendEvent(type, args[0] ?? {}),\n    ping: (): Promise<PingResult> => dispatch(\"webhook.ping\", {}, isPingResult),\n  }\n\n  /** `client.counter` \u2192 namespace whose method calls become `sendEvent(\"counter.<method>\")`. */\n  const capabilityNamespace = (capability: string) =>\n    new Proxy(\n      {},\n      {\n        get: (_target, method) => {\n          if (typeof method !== \"string\" || PROBED_PROPS.has(method)) return undefined\n          return (data?: unknown) =>\n            sendEvent(`${capability}.${wireMethodName(method)}`, data ?? {})\n        },\n      },\n    )\n\n  // The fluent surface is type-driven (CapabilityNamespaces); the proxy only assembles wire\n  // names, so new capabilities work via a types-package bump with zero SDK changes.\n  // eslint-disable-next-line @typescript-eslint/consistent-type-assertions\n  return new Proxy(base, {\n    get: (target, prop, receiver) => {\n      // Real members (send/ping) win over capability namespaces, as do symbol lookups.\n      if (prop in target || typeof prop !== \"string\") return Reflect.get(target, prop, receiver)\n      if (PROBED_PROPS.has(prop)) return undefined\n      return capabilityNamespace(prop)\n    },\n  }) as WebhookObjectClient<P>\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,8BAAwB;AASxB,qBAA8D;AAC9D,oBAAmC;AACnC,oBAAkD;AAmGlD,MAAM,kBAAkB,oBAAI,IAAI,CAAC,aAAa,aAAa,OAAO,CAAC;AAMnE,MAAM,iBAAiB,CAAC,QAAsB;AAC5C,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,GAAG;AAAA,EACtB,SAAS,OAAO;AACd,UAAM,IAAI,iCAAmB,eAAe,0CAA0C,GAAG,IAAI;AAAA,MAC3F;AAAA,IACF,CAAC;AAAA,EACH;AACA,MAAI,OAAO,aAAa,SAAU;AAClC,MAAI,OAAO,aAAa,WAAW,gBAAgB,IAAI,OAAO,QAAQ,EAAG;AACzE,QAAM,IAAI;AAAA,IACR;AAAA,IACA,0CAA0C,OAAO,QAAQ;AAAA,EAC3D;AACF;AAGA,MAAM,iBAAiB,CAAC,WACtB,OAAO,QAAQ,UAAU,CAAC,SAAS,IAAI,KAAK,YAAY,CAAC,EAAE;AAM7D,MAAM,eAAe,oBAAI,IAAI,CAAC,QAAQ,QAAQ,CAAC;AAG/C,MAAM,eAAe,CAAC,SACpB,KAAK,WAAW,gBAAgB,KAAK,WAAW;AAGlD,MAAM,eAAe,CAAC,SACpB,KAAK,WAAW,UAChB,OAAO,KAAK,aAAa,YACzB,OAAO,KAAK,YAAY,aACvB,KAAK,WAAW,QAAQ,OAAO,KAAK,WAAW,aAChD,OAAO,KAAK,iBAAiB,YAC7B,KAAK,iBAAiB;AAExB,MAAM,oBAAoB,CAAC,MAAc,SAA0B;AACjE,QAAM,OAAO,KAAK,UAAU,EAAE,MAAM,YAAW,oBAAI,KAAK,GAAE,YAAY,GAAG,KAAK,CAAC;AAC/E,QAAM,aAAa,IAAI,YAAY,EAAE,OAAO,IAAI,EAAE;AAClD,MAAI,aAAa;AACf,UAAM,IAAI;AAAA,MACR;AAAA,MACA,6BAA6B,UAAU,qCAAqC,6BAAc;AAAA,IAC5F;AACF,SAAO;AACT;AAQO,MAAM,4BAA4B,CACvC,WAC2B;AAC3B,iBAAe,OAAO,GAAG;AAGzB,QAAM,UAAU,IAAI,oCAAQ,4BAAa,OAAO,MAAM,CAAC;AACvD,QAAM,YAAY,OAAO,SAAS;AAClC,QAAM,eAAe,OAAO,iBAAiB,MAAM,OAAO,WAAW;AACrE,QAAM,cAAc,OAAO,eAAe;AAO1C,QAAM,WAAW,OACf,MACA,MACA,mBACe;AACf,UAAM,OAAO,kBAAkB,MAAM,IAAI;AAGzC,UAAM,YAAY,aAAa;AAC/B,UAAM,eAAe,UAAM,wBAAQ;AAAA,MACjC,KAAK,OAAO;AAAA,MACZ;AAAA,MACA;AAAA,MACA,MAAM,CAAC,qBAAqB,QAAQ,KAAK,WAAW,IAAI,KAAK,mBAAmB,GAAI,GAAG,IAAI;AAAA,MAC3F;AAAA,MACA;AAAA,MACA,QAAQ,OAAO;AAAA,IACjB,CAAC;AACD,QAAI,CAAC,eAAe,YAAY;AAC9B,YAAM,IAAI;AAAA,QACR;AAAA,QACA,kBAAkB,IAAI,yDAAyD,OAAO,aAAa,MAAM,CAAC;AAAA,MAC5G;AACF,WAAO;AAAA,EACT;AAEA,QAAM,YAAY,CAAC,MAAc,SAC/B,SAAS,MAAM,MAAM,YAAY;AAEnC,QAAM,OAAO;AAAA,IACX,MAAM,CAAgC,SAAY,SAChD,UAAU,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;AAAA,IAC/B,MAAM,MAA2B,SAAS,gBAAgB,CAAC,GAAG,YAAY;AAAA,EAC5E;AAGA,QAAM,sBAAsB,CAAC,eAC3B,IAAI;AAAA,IACF,CAAC;AAAA,IACD;AAAA,MACE,KAAK,CAAC,SAAS,WAAW;AACxB,YAAI,OAAO,WAAW,YAAY,aAAa,IAAI,MAAM,EAAG,QAAO;AACnE,eAAO,CAAC,SACN,UAAU,GAAG,UAAU,IAAI,eAAe,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAC;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AAKF,SAAO,IAAI,MAAM,MAAM;AAAA,IACrB,KAAK,CAAC,QAAQ,MAAM,aAAa;AAE/B,UAAI,QAAQ,UAAU,OAAO,SAAS,SAAU,QAAO,QAAQ,IAAI,QAAQ,MAAM,QAAQ;AACzF,UAAI,aAAa,IAAI,IAAI,EAAG,QAAO;AACnC,aAAO,oBAAoB,IAAI;AAAA,IACjC;AAAA,EACF,CAAC;AACH;",
+  "names": []
+}

package/dist/src/deliver.js

@@ -1,150 +1,154 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.deliver = exports.WIRE_ERROR_CODES = exports.DEFAULT_MAX_ATTEMPTS = exports.MAX_BODY_BYTES = void 0;
-const errors_1 = require("./errors");
-/** The receiver caps request bodies at 4 KB; oversized bodies get the uniform 404. */
-exports.MAX_BODY_BYTES = 4 * 1024;
-exports.DEFAULT_MAX_ATTEMPTS = 3;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var deliver_exports = {};
+__export(deliver_exports, {
+  DEFAULT_MAX_ATTEMPTS: () => DEFAULT_MAX_ATTEMPTS,
+  MAX_BODY_BYTES: () => MAX_BODY_BYTES,
+  WIRE_ERROR_CODES: () => WIRE_ERROR_CODES,
+  deliver: () => deliver
+});
+module.exports = __toCommonJS(deliver_exports);
+var import_errors = require("./errors");
+const MAX_BODY_BYTES = 4 * 1024;
+const DEFAULT_MAX_ATTEMPTS = 3;
 const BACKOFF_BASE_MS = 500;
-const BACKOFF_CAP_MS = 30_000;
-/** Small buffer past `RateLimit-Reset` so the retry lands after the window actually rolls. */
+const BACKOFF_CAP_MS = 3e4;
 const RATE_LIMIT_GRACE_MS = 250;
-/**
- * Runtime mirror of the generated `WebhookWireErrorCode` union (the types package is
- * deliberately zero-runtime, so the value list lives here). `satisfies` rejects unknown
- * codes; a compile-time exhaustiveness test catches missing ones. Either way, receiver
- * drift fails the build instead of shipping.
- */
-exports.WIRE_ERROR_CODES = [
-    "invalid_request",
-    "invalid_args",
-    "not_found",
-    "capability_not_found",
-    "capability_not_declared",
-    "method_not_found",
-    "token_revoked",
-    "unsupported_media_type",
-    "internal_error",
-    "service_unavailable",
+const WIRE_ERROR_CODES = [
+  "invalid_request",
+  "invalid_args",
+  "not_found",
+  "capability_not_found",
+  "capability_not_declared",
+  "method_not_found",
+  "token_revoked",
+  "unsupported_media_type",
+  "internal_error",
+  "service_unavailable"
 ];
-const SERVER_ERROR_CODES = new Set(exports.WIRE_ERROR_CODES);
+const SERVER_ERROR_CODES = new Set(WIRE_ERROR_CODES);
 const ERROR_HINTS = {
-    not_found: "uniform pre-auth failure: check the URL, the secret, clock skew (±5 min), and that the body was not re-serialized after signing",
-    capability_not_declared: "this object's preset doesn't accept that event type, run ping() to see what it accepts",
-    token_revoked: "the API key was regenerated, copy the new one from the object's ⋮ menu",
-    rate_limited: "rate limited (per space or per IP) and retries were exhausted",
+  not_found: "uniform pre-auth failure: check the URL, the secret, clock skew (\xB15 min), and that the body was not re-serialized after signing",
+  capability_not_declared: "this object's preset doesn't accept that event type, run ping() to see what it accepts",
+  token_revoked: "the API key was regenerated, copy the new one from the object's \u22EE menu",
+  rate_limited: "rate limited (per space or per IP) and retries were exhausted"
 };
-const abortError = (signal) => new errors_1.WebhookObjectError("aborted", "webhook object delivery aborted", { cause: signal.reason });
-/** Sleep `ms`, but reject early (and clean up its listener) if `signal` aborts mid-wait. */
+const abortError = (signal) => new import_errors.WebhookObjectError("aborted", "webhook object delivery aborted", { cause: signal.reason });
 const sleep = (ms, signal) => new Promise((resolve, reject) => {
-    if (signal?.aborted) {
-        reject(abortError(signal));
-        return;
-    }
-    if (!signal) {
-        setTimeout(resolve, ms);
-        return;
-    }
-    const onAbort = () => {
-        clearTimeout(timer);
-        reject(abortError(signal));
-    };
-    const timer = setTimeout(() => {
-        signal.removeEventListener("abort", onAbort);
-        resolve();
-    }, ms);
-    signal.addEventListener("abort", onAbort, { once: true });
+  if (signal?.aborted) {
+    reject(abortError(signal));
+    return;
+  }
+  if (!signal) {
+    setTimeout(resolve, ms);
+    return;
+  }
+  const onAbort = () => {
+    clearTimeout(timer);
+    reject(abortError(signal));
+  };
+  const timer = setTimeout(() => {
+    signal.removeEventListener("abort", onAbort);
+    resolve();
+  }, ms);
+  signal.addEventListener("abort", onAbort, { once: true });
 });
 const backoffDelayMs = (attempt) => Math.min(BACKOFF_BASE_MS * 2 ** attempt, BACKOFF_CAP_MS) * (0.5 + Math.random() * 0.5);
 const retryDelayMs = (response, attempt) => {
-    if (response.status === 429) {
-        // The receiver uses `express-rate-limit` with `standardHeaders: true` (IETF draft-6), which
-        // sets `RateLimit-Reset` to the number of SECONDS remaining until the window resets.
-        const resetHeader = response.headers.get("RateLimit-Reset");
-        const resetSeconds = resetHeader === null ? NaN : Number(resetHeader);
-        if (Number.isFinite(resetSeconds) && resetSeconds >= 0)
-            return resetSeconds * 1000 + RATE_LIMIT_GRACE_MS;
-    }
-    const retryAfterSeconds = Number(response.headers.get("Retry-After"));
-    if (Number.isFinite(retryAfterSeconds) && retryAfterSeconds > 0)
-        return retryAfterSeconds * 1000;
-    return backoffDelayMs(attempt);
+  if (response.status === 429) {
+    const resetHeader = response.headers.get("RateLimit-Reset");
+    const resetSeconds = resetHeader === null ? NaN : Number(resetHeader);
+    if (Number.isFinite(resetSeconds) && resetSeconds >= 0)
+      return resetSeconds * 1e3 + RATE_LIMIT_GRACE_MS;
+  }
+  const retryAfterSeconds = Number(response.headers.get("Retry-After"));
+  if (Number.isFinite(retryAfterSeconds) && retryAfterSeconds > 0) return retryAfterSeconds * 1e3;
+  return backoffDelayMs(attempt);
 };
-/** Retry only what the receiver documents as transient: 429 and 5xx. 4xx means "fix the request". */
 const isRetryableStatus = (status) => status === 429 || status >= 500;
 const parseBody = async (response) => {
-    try {
-        // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
-        return (await response.json());
-    }
-    catch {
-        return undefined;
-    }
+  try {
+    return await response.json();
+  } catch {
+    return void 0;
+  }
 };
 const isWireErrorCode = (code) => SERVER_ERROR_CODES.has(code);
 const errorFromResponse = (status, body) => {
-    const code = (() => {
-        if (status === 429)
-            return "rate_limited";
-        const bodyCode = body?.error;
-        if (typeof bodyCode === "string" && isWireErrorCode(bodyCode))
-            return bodyCode;
-        return "unexpected_response";
-    })();
-    const hint = ERROR_HINTS[code];
-    return new errors_1.WebhookObjectError(code, `webhook object delivery failed (${status}): ${code}${hint ? ` (${hint})` : ""}`, { status, body });
+  const code = (() => {
+    if (status === 429) return "rate_limited";
+    const bodyCode = body?.error;
+    if (typeof bodyCode === "string" && isWireErrorCode(bodyCode)) return bodyCode;
+    return "unexpected_response";
+  })();
+  const hint = ERROR_HINTS[code];
+  return new import_errors.WebhookObjectError(
+    code,
+    `webhook object delivery failed (${status}): ${code}${hint ? ` (${hint})` : ""}`,
+    { status, body }
+  );
 };
-/**
- * POST the signed event, retrying transient failures (429 honoring `RateLimit-Reset`,
- * 5xx honoring `Retry-After`, network errors) with exponential backoff + jitter.
- * Resolves with the parsed 200 body; throws `WebhookObjectError` otherwise. An aborted
- * `signal` cancels the in-flight fetch and any pending backoff, throwing `aborted` at once.
- */
 const deliver = async (args) => {
-    // Terminates because `attemptOnce` always throws on the last attempt.
-    for (let attempt = 0;; attempt++) {
-        const response = await attemptOnce(args, attempt);
-        if (response !== undefined)
-            return response;
-    }
+  for (let attempt = 0; ; attempt++) {
+    const response = await attemptOnce(args, attempt);
+    if (response !== void 0) return response;
+  }
 };
-exports.deliver = deliver;
-/** One attempt: returns the parsed success body, or undefined after sleeping off a transient failure. */
 const attemptOnce = async (args, attempt) => {
-    const isLastAttempt = attempt >= args.maxAttempts - 1;
-    const timestampSeconds = Math.floor(Date.now() / 1000);
-    if (args.signal?.aborted)
-        throw abortError(args.signal);
-    let response;
-    try {
-        response = await args.fetchImpl(args.url, {
-            method: "POST",
-            headers: {
-                "content-type": "application/json",
-                "webhook-id": args.webhookId,
-                "webhook-timestamp": String(timestampSeconds),
-                "webhook-signature": args.sign(timestampSeconds),
-            },
-            body: args.body,
-            signal: args.signal,
-        });
-    }
-    catch (cause) {
-        // An abort surfaces here as a fetch rejection; report it as `aborted` and never retry it.
-        if (args.signal?.aborted)
-            throw abortError(args.signal);
-        const error = new errors_1.WebhookObjectError("network_error", "webhook object delivery failed: network error", { cause });
-        if (isLastAttempt)
-            throw error;
-        await sleep(backoffDelayMs(attempt), args.signal);
-        return undefined;
-    }
-    if (response.ok)
-        return (await parseBody(response)) ?? {};
-    const error = errorFromResponse(response.status, await parseBody(response));
-    if (!isRetryableStatus(response.status) || isLastAttempt)
-        throw error;
-    await sleep(retryDelayMs(response, attempt), args.signal);
-    return undefined;
+  const isLastAttempt = attempt >= args.maxAttempts - 1;
+  const timestampSeconds = Math.floor(Date.now() / 1e3);
+  if (args.signal?.aborted) throw abortError(args.signal);
+  let response;
+  try {
+    response = await args.fetchImpl(args.url, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "webhook-id": args.webhookId,
+        "webhook-timestamp": String(timestampSeconds),
+        "webhook-signature": args.sign(timestampSeconds)
+      },
+      body: args.body,
+      signal: args.signal
+    });
+  } catch (cause) {
+    if (args.signal?.aborted) throw abortError(args.signal);
+    const error2 = new import_errors.WebhookObjectError(
+      "network_error",
+      "webhook object delivery failed: network error",
+      { cause }
+    );
+    if (isLastAttempt) throw error2;
+    await sleep(backoffDelayMs(attempt), args.signal);
+    return void 0;
+  }
+  if (response.ok) return await parseBody(response) ?? {};
+  const error = errorFromResponse(response.status, await parseBody(response));
+  if (!isRetryableStatus(response.status) || isLastAttempt) throw error;
+  await sleep(retryDelayMs(response, attempt), args.signal);
+  return void 0;
 };
-//# sourceMappingURL=deliver.js.map
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DEFAULT_MAX_ATTEMPTS,
+  MAX_BODY_BYTES,
+  WIRE_ERROR_CODES,
+  deliver
+});
+//# sourceMappingURL=deliver.js.map

package/dist/src/deliver.js.map

@@ -1 +1,7 @@
-{"version":3,"file":"deliver.js","sourceRoot":"","sources":["../../src/deliver.ts"],"names":[],"mappings":";;;AACA,qCAAqE;AAErE,sFAAsF;AACzE,QAAA,cAAc,GAAG,CAAC,GAAG,IAAI,CAAA;AAEzB,QAAA,oBAAoB,GAAG,CAAC,CAAA;AAErC,MAAM,eAAe,GAAG,GAAG,CAAA;AAC3B,MAAM,cAAc,GAAG,MAAM,CAAA;AAC7B,8FAA8F;AAC9F,MAAM,mBAAmB,GAAG,GAAG,CAAA;AAE/B;;;;;GAKG;AACU,QAAA,gBAAgB,GAAG;IAC9B,iBAAiB;IACjB,cAAc;IACd,WAAW;IACX,sBAAsB;IACtB,yBAAyB;IACzB,kBAAkB;IAClB,eAAe;IACf,wBAAwB;IACxB,gBAAgB;IAChB,qBAAqB;CAC6B,CAAA;AAEpD,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC,wBAAgB,CAAC,CAAA;AAEzE,MAAM,WAAW,GAAoD;IACnE,SAAS,EACP,iIAAiI;IACnI,uBAAuB,EACrB,wFAAwF;IAC1F,aAAa,EAAE,wEAAwE;IACvF,YAAY,EAAE,+DAA+D;CAC9E,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,MAAmB,EAAsB,EAAE,CAC7D,IAAI,2BAAkB,CAAC,SAAS,EAAE,iCAAiC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;AAEhG,4FAA4F;AAC5F,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,MAAoB,EAAiB,EAAE,CAChE,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;QAC1B,OAAM;IACR,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QACvB,OAAM;IACR,CAAC;IACD,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,YAAY,CAAC,KAAK,CAAC,CAAA;QACnB,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;IAC5B,CAAC,CAAA;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC5C,OAAO,EAAE,CAAA;IACX,CAAC,EAAE,EAAE,CAAC,CAAA;IACN,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;AAC3D,CAAC,CAAC,CAAA;AAEJ,MAAM,cAAc,GAAG,CAAC,OAAe,EAAU,EAAE,CACjD,IAAI,CAAC,GAAG,CAAC,eAAe,GAAG,CAAC,IAAI,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAA;AAExF,MAAM,YAAY,GAAG,CAAC,QAAkB,EAAE,OAAe,EAAU,EAAE;IACnE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,4FAA4F;QAC5F,qFAAqF;QACrF,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;QAC3D,MAAM,YAAY,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QACrE,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC;YACpD,OAAO,YAAY,GAAG,IAAI,GAAG,mBAAmB,CAAA;IACpD,CAAC;IACD,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAA;IACrE,IAAI,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,GAAG,CAAC;QAAE,OAAO,iBAAiB,GAAG,IAAI,CAAA;IAChG,OAAO,cAAc,CAAC,OAAO,CAAC,CAAA;AAChC,CAAC,CAAA;AAED,qGAAqG;AACrG,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAW,EAAE,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,IAAI,GAAG,CAAA;AAEtF,MAAM,SAAS,GAAG,KAAK,EACrB,QAAkB,EACM,EAAE;IAC1B,IAAI,CAAC;QACH,yEAAyE;QACzE,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAA;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,IAAY,EAAgC,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AAEpG,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,IAAyC,EAAE,EAAE;IACtF,MAAM,IAAI,GAAG,CAAC,GAA2B,EAAE;QACzC,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,cAAc,CAAA;QACzC,MAAM,QAAQ,GAAG,IAAI,EAAE,KAAK,CAAA;QAC5B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAA;QAC9E,OAAO,qBAAqB,CAAA;IAC9B,CAAC,CAAC,EAAE,CAAA;IACJ,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;IAC9B,OAAO,IAAI,2BAAkB,CAC3B,IAAI,EACJ,mCAAmC,MAAM,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAChF,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAA;AACH,CAAC,CAAA;AAgBD;;;;;GAKG;AACI,MAAM,OAAO,GAAG,KAAK,EAAE,IAAiB,EAAoC,EAAE;IACnF,sEAAsE;IACtE,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACjD,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAA;IAC7C,CAAC;AACH,CAAC,CAAA;AANY,QAAA,OAAO,WAMnB;AAED,yGAAyG;AACzG,MAAM,WAAW,GAAG,KAAK,EACvB,IAAiB,EACjB,OAAe,EAC+B,EAAE;IAChD,MAAM,aAAa,GAAG,OAAO,IAAI,IAAI,CAAC,WAAW,GAAG,CAAC,CAAA;IACrD,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAEtD,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;QAAE,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAEvD,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE;YACxC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,IAAI,CAAC,SAAS;gBAC5B,mBAAmB,EAAE,MAAM,CAAC,gBAAgB,CAAC;gBAC7C,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;aACjD;YACD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0FAA0F;QAC1F,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACvD,MAAM,KAAK,GAAG,IAAI,2BAAkB,CAClC,eAAe,EACf,+CAA+C,EAC/C,EAAE,KAAK,EAAE,CACV,CAAA;QACD,IAAI,aAAa;YAAE,MAAM,KAAK,CAAA;QAC9B,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QACjD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAI,QAAQ,CAAC,EAAE;QAAE,OAAO,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAA;IAEzD,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC3E,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,aAAa;QAAE,MAAM,KAAK,CAAA;IACrE,MAAM,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IACzD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA"}
+{
+  "version": 3,
+  "sources": ["../../src/deliver.ts"],
+  "sourcesContent": ["import type { WebhookWireErrorCode } from \"@gathertown/webhook-object-types\"\nimport { WebhookObjectError, WebhookObjectErrorCode } from \"./errors\"\n\n/** The receiver caps request bodies at 4 KB; oversized bodies get the uniform 404. */\nexport const MAX_BODY_BYTES = 4 * 1024\n\nexport const DEFAULT_MAX_ATTEMPTS = 3\n\nconst BACKOFF_BASE_MS = 500\nconst BACKOFF_CAP_MS = 30_000\n/** Small buffer past `RateLimit-Reset` so the retry lands after the window actually rolls. */\nconst RATE_LIMIT_GRACE_MS = 250\n\n/**\n * Runtime mirror of the generated `WebhookWireErrorCode` union (the types package is\n * deliberately zero-runtime, so the value list lives here). `satisfies` rejects unknown\n * codes; a compile-time exhaustiveness test catches missing ones. Either way, receiver\n * drift fails the build instead of shipping.\n */\nexport const WIRE_ERROR_CODES = [\n  \"invalid_request\",\n  \"invalid_args\",\n  \"not_found\",\n  \"capability_not_found\",\n  \"capability_not_declared\",\n  \"method_not_found\",\n  \"token_revoked\",\n  \"unsupported_media_type\",\n  \"internal_error\",\n  \"service_unavailable\",\n] as const satisfies readonly WebhookWireErrorCode[]\n\nconst SERVER_ERROR_CODES: ReadonlySet<string> = new Set(WIRE_ERROR_CODES)\n\nconst ERROR_HINTS: Partial<Record<WebhookObjectErrorCode, string>> = {\n  not_found:\n    \"uniform pre-auth failure: check the URL, the secret, clock skew (\u00B15 min), and that the body was not re-serialized after signing\",\n  capability_not_declared:\n    \"this object's preset doesn't accept that event type, run ping() to see what it accepts\",\n  token_revoked: \"the API key was regenerated, copy the new one from the object's \u22EE menu\",\n  rate_limited: \"rate limited (per space or per IP) and retries were exhausted\",\n}\n\nconst abortError = (signal: AbortSignal): WebhookObjectError =>\n  new WebhookObjectError(\"aborted\", \"webhook object delivery aborted\", { cause: signal.reason })\n\n/** Sleep `ms`, but reject early (and clean up its listener) if `signal` aborts mid-wait. */\nconst sleep = (ms: number, signal?: AbortSignal): Promise<void> =>\n  new Promise((resolve, reject) => {\n    if (signal?.aborted) {\n      reject(abortError(signal))\n      return\n    }\n    if (!signal) {\n      setTimeout(resolve, ms)\n      return\n    }\n    const onAbort = (): void => {\n      clearTimeout(timer)\n      reject(abortError(signal))\n    }\n    const timer = setTimeout(() => {\n      signal.removeEventListener(\"abort\", onAbort)\n      resolve()\n    }, ms)\n    signal.addEventListener(\"abort\", onAbort, { once: true })\n  })\n\nconst backoffDelayMs = (attempt: number): number =>\n  Math.min(BACKOFF_BASE_MS * 2 ** attempt, BACKOFF_CAP_MS) * (0.5 + Math.random() * 0.5)\n\nconst retryDelayMs = (response: Response, attempt: number): number => {\n  if (response.status === 429) {\n    // The receiver uses `express-rate-limit` with `standardHeaders: true` (IETF draft-6), which\n    // sets `RateLimit-Reset` to the number of SECONDS remaining until the window resets.\n    const resetHeader = response.headers.get(\"RateLimit-Reset\")\n    const resetSeconds = resetHeader === null ? NaN : Number(resetHeader)\n    if (Number.isFinite(resetSeconds) && resetSeconds >= 0)\n      return resetSeconds * 1000 + RATE_LIMIT_GRACE_MS\n  }\n  const retryAfterSeconds = Number(response.headers.get(\"Retry-After\"))\n  if (Number.isFinite(retryAfterSeconds) && retryAfterSeconds > 0) return retryAfterSeconds * 1000\n  return backoffDelayMs(attempt)\n}\n\n/** Retry only what the receiver documents as transient: 429 and 5xx. 4xx means \"fix the request\". */\nconst isRetryableStatus = (status: number): boolean => status === 429 || status >= 500\n\nconst parseBody = async <T = Record<string, unknown>>(\n  response: Response,\n): Promise<T | undefined> => {\n  try {\n    // eslint-disable-next-line @typescript-eslint/consistent-type-assertions\n    return (await response.json()) as T\n  } catch {\n    return undefined\n  }\n}\n\nconst isWireErrorCode = (code: string): code is WebhookWireErrorCode => SERVER_ERROR_CODES.has(code)\n\nconst errorFromResponse = (status: number, body: Record<string, unknown> | undefined) => {\n  const code = ((): WebhookObjectErrorCode => {\n    if (status === 429) return \"rate_limited\"\n    const bodyCode = body?.error\n    if (typeof bodyCode === \"string\" && isWireErrorCode(bodyCode)) return bodyCode\n    return \"unexpected_response\"\n  })()\n  const hint = ERROR_HINTS[code]\n  return new WebhookObjectError(\n    code,\n    `webhook object delivery failed (${status}): ${code}${hint ? ` (${hint})` : \"\"}`,\n    { status, body },\n  )\n}\n\nexport type DeliverArgs = {\n  url: string\n  /** The exact serialized body, signed per attempt and sent unchanged. */\n  body: string\n  /** Stable across retries: the server dedups the last 10 ids per object, making retries idempotent. */\n  webhookId: string\n  /** Signs `webhookId`/timestamp/body; called per attempt so retries carry a fresh timestamp. */\n  sign: (timestampSeconds: number) => string\n  fetchImpl: typeof fetch\n  maxAttempts: number\n  /** Aborts the in-flight fetch and any pending backoff sleep; surfaces as an `aborted` error. */\n  signal?: AbortSignal\n}\n\n/**\n * POST the signed event, retrying transient failures (429 honoring `RateLimit-Reset`,\n * 5xx honoring `Retry-After`, network errors) with exponential backoff + jitter.\n * Resolves with the parsed 200 body; throws `WebhookObjectError` otherwise. An aborted\n * `signal` cancels the in-flight fetch and any pending backoff, throwing `aborted` at once.\n */\nexport const deliver = async (args: DeliverArgs): Promise<Record<string, unknown>> => {\n  // Terminates because `attemptOnce` always throws on the last attempt.\n  for (let attempt = 0; ; attempt++) {\n    const response = await attemptOnce(args, attempt)\n    if (response !== undefined) return response\n  }\n}\n\n/** One attempt: returns the parsed success body, or undefined after sleeping off a transient failure. */\nconst attemptOnce = async (\n  args: DeliverArgs,\n  attempt: number,\n): Promise<Record<string, unknown> | undefined> => {\n  const isLastAttempt = attempt >= args.maxAttempts - 1\n  const timestampSeconds = Math.floor(Date.now() / 1000)\n\n  if (args.signal?.aborted) throw abortError(args.signal)\n\n  let response: Response\n  try {\n    response = await args.fetchImpl(args.url, {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/json\",\n        \"webhook-id\": args.webhookId,\n        \"webhook-timestamp\": String(timestampSeconds),\n        \"webhook-signature\": args.sign(timestampSeconds),\n      },\n      body: args.body,\n      signal: args.signal,\n    })\n  } catch (cause) {\n    // An abort surfaces here as a fetch rejection; report it as `aborted` and never retry it.\n    if (args.signal?.aborted) throw abortError(args.signal)\n    const error = new WebhookObjectError(\n      \"network_error\",\n      \"webhook object delivery failed: network error\",\n      { cause },\n    )\n    if (isLastAttempt) throw error\n    await sleep(backoffDelayMs(attempt), args.signal)\n    return undefined\n  }\n\n  if (response.ok) return (await parseBody(response)) ?? {}\n\n  const error = errorFromResponse(response.status, await parseBody(response))\n  if (!isRetryableStatus(response.status) || isLastAttempt) throw error\n  await sleep(retryDelayMs(response, attempt), args.signal)\n  return undefined\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,oBAA2D;AAGpD,MAAM,iBAAiB,IAAI;AAE3B,MAAM,uBAAuB;AAEpC,MAAM,kBAAkB;AACxB,MAAM,iBAAiB;AAEvB,MAAM,sBAAsB;AAQrB,MAAM,mBAAmB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,qBAA0C,IAAI,IAAI,gBAAgB;AAExE,MAAM,cAA+D;AAAA,EACnE,WACE;AAAA,EACF,yBACE;AAAA,EACF,eAAe;AAAA,EACf,cAAc;AAChB;AAEA,MAAM,aAAa,CAAC,WAClB,IAAI,iCAAmB,WAAW,mCAAmC,EAAE,OAAO,OAAO,OAAO,CAAC;AAG/F,MAAM,QAAQ,CAAC,IAAY,WACzB,IAAI,QAAQ,CAAC,SAAS,WAAW;AAC/B,MAAI,QAAQ,SAAS;AACnB,WAAO,WAAW,MAAM,CAAC;AACzB;AAAA,EACF;AACA,MAAI,CAAC,QAAQ;AACX,eAAW,SAAS,EAAE;AACtB;AAAA,EACF;AACA,QAAM,UAAU,MAAY;AAC1B,iBAAa,KAAK;AAClB,WAAO,WAAW,MAAM,CAAC;AAAA,EAC3B;AACA,QAAM,QAAQ,WAAW,MAAM;AAC7B,WAAO,oBAAoB,SAAS,OAAO;AAC3C,YAAQ;AAAA,EACV,GAAG,EAAE;AACL,SAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAC1D,CAAC;AAEH,MAAM,iBAAiB,CAAC,YACtB,KAAK,IAAI,kBAAkB,KAAK,SAAS,cAAc,KAAK,MAAM,KAAK,OAAO,IAAI;AAEpF,MAAM,eAAe,CAAC,UAAoB,YAA4B;AACpE,MAAI,SAAS,WAAW,KAAK;AAG3B,UAAM,cAAc,SAAS,QAAQ,IAAI,iBAAiB;AAC1D,UAAM,eAAe,gBAAgB,OAAO,MAAM,OAAO,WAAW;AACpE,QAAI,OAAO,SAAS,YAAY,KAAK,gBAAgB;AACnD,aAAO,eAAe,MAAO;AAAA,EACjC;AACA,QAAM,oBAAoB,OAAO,SAAS,QAAQ,IAAI,aAAa,CAAC;AACpE,MAAI,OAAO,SAAS,iBAAiB,KAAK,oBAAoB,EAAG,QAAO,oBAAoB;AAC5F,SAAO,eAAe,OAAO;AAC/B;AAGA,MAAM,oBAAoB,CAAC,WAA4B,WAAW,OAAO,UAAU;AAEnF,MAAM,YAAY,OAChB,aAC2B;AAC3B,MAAI;AAEF,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,MAAM,kBAAkB,CAAC,SAA+C,mBAAmB,IAAI,IAAI;AAEnG,MAAM,oBAAoB,CAAC,QAAgB,SAA8C;AACvF,QAAM,QAAQ,MAA8B;AAC1C,QAAI,WAAW,IAAK,QAAO;AAC3B,UAAM,WAAW,MAAM;AACvB,QAAI,OAAO,aAAa,YAAY,gBAAgB,QAAQ,EAAG,QAAO;AACtE,WAAO;AAAA,EACT,GAAG;AACH,QAAM,OAAO,YAAY,IAAI;AAC7B,SAAO,IAAI;AAAA,IACT;AAAA,IACA,mCAAmC,MAAM,MAAM,IAAI,GAAG,OAAO,KAAK,IAAI,MAAM,EAAE;AAAA,IAC9E,EAAE,QAAQ,KAAK;AAAA,EACjB;AACF;AAsBO,MAAM,UAAU,OAAO,SAAwD;AAEpF,WAAS,UAAU,KAAK,WAAW;AACjC,UAAM,WAAW,MAAM,YAAY,MAAM,OAAO;AAChD,QAAI,aAAa,OAAW,QAAO;AAAA,EACrC;AACF;AAGA,MAAM,cAAc,OAClB,MACA,YACiD;AACjD,QAAM,gBAAgB,WAAW,KAAK,cAAc;AACpD,QAAM,mBAAmB,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAErD,MAAI,KAAK,QAAQ,QAAS,OAAM,WAAW,KAAK,MAAM;AAEtD,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,KAAK,UAAU,KAAK,KAAK;AAAA,MACxC,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,cAAc,KAAK;AAAA,QACnB,qBAAqB,OAAO,gBAAgB;AAAA,QAC5C,qBAAqB,KAAK,KAAK,gBAAgB;AAAA,MACjD;AAAA,MACA,MAAM,KAAK;AAAA,MACX,QAAQ,KAAK;AAAA,IACf,CAAC;AAAA,EACH,SAAS,OAAO;AAEd,QAAI,KAAK,QAAQ,QAAS,OAAM,WAAW,KAAK,MAAM;AACtD,UAAMA,SAAQ,IAAI;AAAA,MAChB;AAAA,MACA;AAAA,MACA,EAAE,MAAM;AAAA,IACV;AACA,QAAI,cAAe,OAAMA;AACzB,UAAM,MAAM,eAAe,OAAO,GAAG,KAAK,MAAM;AAChD,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,GAAI,QAAQ,MAAM,UAAU,QAAQ,KAAM,CAAC;AAExD,QAAM,QAAQ,kBAAkB,SAAS,QAAQ,MAAM,UAAU,QAAQ,CAAC;AAC1E,MAAI,CAAC,kBAAkB,SAAS,MAAM,KAAK,cAAe,OAAM;AAChE,QAAM,MAAM,aAAa,UAAU,OAAO,GAAG,KAAK,MAAM;AACxD,SAAO;AACT;",
+  "names": ["error"]
+}

package/dist/src/errors.js

@@ -1,27 +1,44 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.WebhookObjectError = void 0;
-/**
- * The single error type the SDK throws. `code` classifies the failure (see
- * {@link WebhookObjectErrorCode}) and `status` carries the HTTP status when the error
- * originated from a response.
- */
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var errors_exports = {};
+__export(errors_exports, {
+  WebhookObjectError: () => WebhookObjectError
+});
+module.exports = __toCommonJS(errors_exports);
 class WebhookObjectError extends Error {
-    code;
-    name = "WebhookObjectError";
-    constructor(code, message, options) {
-        super(message, options?.cause === undefined ? undefined : { cause: options.cause });
-        this.code = code;
-        this.status = options?.status;
-        this.body = options?.body;
-    }
-    status;
-    /**
-     * The parsed response body for errors that came from an HTTP response (e.g. `{ error: "…" }`),
-     * or `undefined` for client-side errors and unparseable bodies. Lets integrators read any
-     * extra fields the receiver returns beyond `code`/`status`.
-     */
-    body;
+  constructor(code, message, options) {
+    super(message, options?.cause === void 0 ? void 0 : { cause: options.cause });
+    this.code = code;
+    this.status = options?.status;
+    this.body = options?.body;
+  }
+  name = "WebhookObjectError";
+  status;
+  /**
+   * The parsed response body for errors that came from an HTTP response (e.g. `{ error: "…" }`),
+   * or `undefined` for client-side errors and unparseable bodies. Lets integrators read any
+   * extra fields the receiver returns beyond `code`/`status`.
+   */
+  body;
 }
-exports.WebhookObjectError = WebhookObjectError;
-//# sourceMappingURL=errors.js.map
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  WebhookObjectError
+});
+//# sourceMappingURL=errors.js.map

package/dist/src/errors.js.map

@@ -1 +1,7 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":";;;AA0BA;;;;GAIG;AACH,MAAa,kBAAmB,SAAQ,KAAK;IAIhC;IAHO,IAAI,GAAG,oBAAoB,CAAA;IAE7C,YACW,IAA4B,EACrC,OAAe,EACf,OAMC;QAED,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;QAV1E,SAAI,GAAJ,IAAI,CAAwB;QAWrC,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,CAAA;QAC7B,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,CAAA;IAC3B,CAAC;IAEQ,MAAM,CAAoB;IAEnC;;;;OAIG;IACM,IAAI,CAAS;CACvB;AA3BD,gDA2BC"}
+{
+  "version": 3,
+  "sources": ["../../src/errors.ts"],
+  "sourcesContent": ["import type { WebhookWireErrorCode } from \"@gathertown/webhook-object-types\"\n\n/**\n * Error codes surfaced by `WebhookObjectError.code`.\n *\n * Wire codes come verbatim from the generated `WebhookWireErrorCode` (the receiver's error\n * bodies); the rest are client-side conditions the SDK detects before/around the HTTP exchange.\n */\nexport type WebhookObjectErrorCode =\n  | WebhookWireErrorCode\n  // 429: rate limited and retries were exhausted (either per space, or per IP);\n  // the receiver sends no body code for these, so it's SDK-assigned\n  | \"rate_limited\"\n  // Client-side: serialized body exceeds the receiver's 4 KB cap (would be a uniform 404)\n  | \"payload_too_large\"\n  // Client-side: the secret is missing or not a `whsec_\u2026` key\n  | \"invalid_secret\"\n  // Client-side: the URL is unparseable or not https (http is allowed only for localhost)\n  | \"invalid_url\"\n  // Client-side: fetch itself failed (DNS, connection) and retries were exhausted\n  | \"network_error\"\n  // Client-side: the caller's AbortSignal fired during the request or a backoff sleep\n  | \"aborted\"\n  // Client-side: the server responded with a status/body this SDK doesn't recognize\n  | \"unexpected_response\"\n\n/**\n * The single error type the SDK throws. `code` classifies the failure (see\n * {@link WebhookObjectErrorCode}) and `status` carries the HTTP status when the error\n * originated from a response.\n */\nexport class WebhookObjectError extends Error {\n  override readonly name = \"WebhookObjectError\"\n\n  constructor(\n    readonly code: WebhookObjectErrorCode,\n    message: string,\n    options?: {\n      /** HTTP status of the response, when the error came from one. */\n      status?: number\n      /** Parsed response body, when the error came from one, for reading server-provided fields. */\n      body?: unknown\n      cause?: unknown\n    },\n  ) {\n    super(message, options?.cause === undefined ? undefined : { cause: options.cause })\n    this.status = options?.status\n    this.body = options?.body\n  }\n\n  readonly status: number | undefined\n\n  /**\n   * The parsed response body for errors that came from an HTTP response (e.g. `{ error: \"\u2026\" }`),\n   * or `undefined` for client-side errors and unparseable bodies. Lets integrators read any\n   * extra fields the receiver returns beyond `code`/`status`.\n   */\n  readonly body: unknown\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AA+BO,MAAM,2BAA2B,MAAM;AAAA,EAG5C,YACW,MACT,SACA,SAOA;AACA,UAAM,SAAS,SAAS,UAAU,SAAY,SAAY,EAAE,OAAO,QAAQ,MAAM,CAAC;AAVzE;AAWT,SAAK,SAAS,SAAS;AACvB,SAAK,OAAO,SAAS;AAAA,EACvB;AAAA,EAhBkB,OAAO;AAAA,EAkBhB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA;AACX;",
+  "names": []
+}

package/dist/src/index.js

@@ -1,13 +1,40 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.unsafeSecretLiteral = exports.secretFromEnv = exports.WebhookObjectError = exports.createWebhookObjectClient = exports.createWebhookObjectCatalog = void 0;
-var catalog_1 = require("./catalog");
-Object.defineProperty(exports, "createWebhookObjectCatalog", { enumerable: true, get: function () { return catalog_1.createWebhookObjectCatalog; } });
-var client_1 = require("./client");
-Object.defineProperty(exports, "createWebhookObjectClient", { enumerable: true, get: function () { return client_1.createWebhookObjectClient; } });
-var errors_1 = require("./errors");
-Object.defineProperty(exports, "WebhookObjectError", { enumerable: true, get: function () { return errors_1.WebhookObjectError; } });
-var secret_1 = require("./secret");
-Object.defineProperty(exports, "secretFromEnv", { enumerable: true, get: function () { return secret_1.secretFromEnv; } });
-Object.defineProperty(exports, "unsafeSecretLiteral", { enumerable: true, get: function () { return secret_1.unsafeSecretLiteral; } });
-//# sourceMappingURL=index.js.map
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var src_exports = {};
+__export(src_exports, {
+  WebhookObjectError: () => import_errors.WebhookObjectError,
+  createWebhookObjectCatalog: () => import_catalog.createWebhookObjectCatalog,
+  createWebhookObjectClient: () => import_client.createWebhookObjectClient,
+  secretFromEnv: () => import_secret.secretFromEnv,
+  unsafeSecretLiteral: () => import_secret.unsafeSecretLiteral
+});
+module.exports = __toCommonJS(src_exports);
+var import_catalog = require("./catalog");
+var import_client = require("./client");
+var import_errors = require("./errors");
+var import_secret = require("./secret");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  WebhookObjectError,
+  createWebhookObjectCatalog,
+  createWebhookObjectClient,
+  secretFromEnv,
+  unsafeSecretLiteral
+});
+//# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -1 +1,7 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,qCAKkB;AAJhB,qHAAA,0BAA0B,OAAA;AAK5B,mCAQiB;AALf,mHAAA,yBAAyB,OAAA;AAM3B,mCAA0E;AAAjE,4GAAA,kBAAkB,OAAA;AAC3B,mCAAuF;AAA9E,uGAAA,aAAa,OAAA;AAAE,6GAAA,mBAAmB,OAAA"}
+{
+  "version": 3,
+  "sources": ["../../src/index.ts"],
+  "sourcesContent": ["export {\n  createWebhookObjectCatalog,\n  type WebhookObjectCatalog,\n  type WebhookObjectCatalogEntry,\n  type WebhookObjectCatalogOptions,\n} from \"./catalog\"\nexport {\n  type AllowedEventType,\n  type CapabilityNamespaces,\n  createWebhookObjectClient,\n  type PingResult,\n  type SendResult,\n  type WebhookObjectClient,\n  type WebhookObjectClientConfig,\n} from \"./client\"\nexport { WebhookObjectError, type WebhookObjectErrorCode } from \"./errors\"\nexport { secretFromEnv, unsafeSecretLiteral, type WebhookObjectSecret } from \"./secret\"\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAKO;AACP,oBAQO;AACP,oBAAgE;AAChE,oBAA6E;",
+  "names": []
+}

package/dist/src/secret.js

@@ -1,55 +1,70 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.revealSecret = exports.unsafeSecretLiteral = exports.secretFromEnv = void 0;
-const errors_1 = require("./errors");
-/** Fail fast on malformed secrets: `whsec_` + at least 20 chars of key material. */
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var secret_exports = {};
+__export(secret_exports, {
+  revealSecret: () => revealSecret,
+  secretFromEnv: () => secretFromEnv,
+  unsafeSecretLiteral: () => unsafeSecretLiteral
+});
+module.exports = __toCommonJS(secret_exports);
+var import_errors = require("./errors");
 const SECRET_PATTERN = /^whsec_.{20,}/;
-/** Secret values live here, keyed by handle identity, so no property on the handle exposes them. */
-const secretValues = new WeakMap();
+const secretValues = /* @__PURE__ */ new WeakMap();
 const REDACTED = "[redacted webhook object secret]";
 const brandSecret = (value, source) => {
-    if (!SECRET_PATTERN.test(value))
-        throw new errors_1.WebhookObjectError("invalid_secret", `webhook object secret from ${source} is missing or malformed, expected a whsec_… key`);
-    const handle = {
-        toString: () => REDACTED,
-        toJSON: () => REDACTED,
-        [Symbol.for("nodejs.util.inspect.custom")]: () => REDACTED,
-    };
-    // The brand symbol exists only at the type level; the WeakMap entry is the runtime brand.
-    // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
-    const secret = handle;
-    secretValues.set(secret, value);
-    return secret;
+  if (!SECRET_PATTERN.test(value))
+    throw new import_errors.WebhookObjectError(
+      "invalid_secret",
+      `webhook object secret from ${source} is missing or malformed, expected a whsec_\u2026 key`
+    );
+  const handle = {
+    toString: () => REDACTED,
+    toJSON: () => REDACTED,
+    [Symbol.for("nodejs.util.inspect.custom")]: () => REDACTED
+  };
+  const secret = handle;
+  secretValues.set(secret, value);
+  return secret;
 };
-/**
- * Read a `whsec_…` secret from the named environment variable. The recommended way to
- * provide a secret: the value never appears in your source, and a missing or malformed
- * variable fails fast with the variable's name (never its value).
- */
 const secretFromEnv = (name) => brandSecret(process.env[name] ?? "", `env var ${name}`);
-exports.secretFromEnv = secretFromEnv;
-/**
- * Wrap a secret you already hold as a string (secret managers, non-Node runtimes without
- * `process.env`). Named `unsafe` so hardcoded `whsec_…` literals are easy to grep for in
- * review; never commit a literal secret to source control.
- */
 const unsafeSecretLiteral = (value) => brandSecret(value, "a string literal");
-exports.unsafeSecretLiteral = unsafeSecretLiteral;
-/**
- * Internal: recover the raw secret for signing. Not re-exported from the package entry
- * point. Bare strings are validated in place; anything else must be a handle minted by
- * this module (an object that isn't one fails the WeakMap lookup and throws).
- */
 const revealSecret = (secret) => {
-    if (typeof secret === "string") {
-        if (!SECRET_PATTERN.test(secret))
-            throw new errors_1.WebhookObjectError("invalid_secret", "webhook object secret is malformed, expected a whsec_… key");
-        return secret;
-    }
-    const value = secretValues.get(secret);
-    if (value === undefined)
-        throw new errors_1.WebhookObjectError("invalid_secret", "webhook object secret must be a whsec_… string or created with secretFromEnv() / unsafeSecretLiteral()");
-    return value;
+  if (typeof secret === "string") {
+    if (!SECRET_PATTERN.test(secret))
+      throw new import_errors.WebhookObjectError(
+        "invalid_secret",
+        "webhook object secret is malformed, expected a whsec_\u2026 key"
+      );
+    return secret;
+  }
+  const value = secretValues.get(secret);
+  if (value === void 0)
+    throw new import_errors.WebhookObjectError(
+      "invalid_secret",
+      "webhook object secret must be a whsec_\u2026 string or created with secretFromEnv() / unsafeSecretLiteral()"
+    );
+  return value;
 };
-exports.revealSecret = revealSecret;
-//# sourceMappingURL=secret.js.map
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  revealSecret,
+  secretFromEnv,
+  unsafeSecretLiteral
+});
+//# sourceMappingURL=secret.js.map

package/dist/src/secret.js.map

@@ -1 +1,7 @@
-{"version":3,"file":"secret.js","sourceRoot":"","sources":["../../src/secret.ts"],"names":[],"mappings":";;;AAAA,qCAA6C;AAE7C,oFAAoF;AACpF,MAAM,cAAc,GAAG,eAAe,CAAA;AAYtC,oGAAoG;AACpG,MAAM,YAAY,GAAG,IAAI,OAAO,EAA+B,CAAA;AAE/D,MAAM,QAAQ,GAAG,kCAAkC,CAAA;AAEnD,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,MAAc,EAAuB,EAAE;IACzE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAC7B,MAAM,IAAI,2BAAkB,CAC1B,gBAAgB,EAChB,8BAA8B,MAAM,kDAAkD,CACvF,CAAA;IACH,MAAM,MAAM,GAAG;QACb,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ;QACxB,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ;QACtB,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,QAAQ;KAC3D,CAAA;IACD,0FAA0F;IAC1F,yEAAyE;IACzE,MAAM,MAAM,GAAG,MAAwC,CAAA;IACvD,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAC/B,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED;;;;GAIG;AACI,MAAM,aAAa,GAAG,CAAC,IAAY,EAAuB,EAAE,CACjE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,WAAW,IAAI,EAAE,CAAC,CAAA;AAD5C,QAAA,aAAa,iBAC+B;AAEzD;;;;GAIG;AACI,MAAM,mBAAmB,GAAG,CAAC,KAAa,EAAuB,EAAE,CACxE,WAAW,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAA;AAD3B,QAAA,mBAAmB,uBACQ;AAExC;;;;GAIG;AACI,MAAM,YAAY,GAAG,CAAC,MAAoC,EAAU,EAAE;IAC3E,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;YAC9B,MAAM,IAAI,2BAAkB,CAC1B,gBAAgB,EAChB,4DAA4D,CAC7D,CAAA;QACH,OAAO,MAAM,CAAA;IACf,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACtC,IAAI,KAAK,KAAK,SAAS;QACrB,MAAM,IAAI,2BAAkB,CAC1B,gBAAgB,EAChB,wGAAwG,CACzG,CAAA;IACH,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAhBY,QAAA,YAAY,gBAgBxB"}
+{
+  "version": 3,
+  "sources": ["../../src/secret.ts"],
+  "sourcesContent": ["import { WebhookObjectError } from \"./errors\"\n\n/** Fail fast on malformed secrets: `whsec_` + at least 20 chars of key material. */\nconst SECRET_PATTERN = /^whsec_.{20,}/\n\ndeclare const webhookObjectSecretBrand: unique symbol\n\n/**\n * An opaque handle to a `whsec_\u2026` signing secret, obtained via {@link secretFromEnv} or\n * {@link unsafeSecretLiteral}. Unlike a bare string (which the client also accepts), the\n * handle redacts itself when logged or serialized, so it can't leak through console output,\n * error reporters, or `JSON.stringify` of a config object.\n */\nexport type WebhookObjectSecret = { readonly [webhookObjectSecretBrand]: true }\n\n/** Secret values live here, keyed by handle identity, so no property on the handle exposes them. */\nconst secretValues = new WeakMap<WebhookObjectSecret, string>()\n\nconst REDACTED = \"[redacted webhook object secret]\"\n\nconst brandSecret = (value: string, source: string): WebhookObjectSecret => {\n  if (!SECRET_PATTERN.test(value))\n    throw new WebhookObjectError(\n      \"invalid_secret\",\n      `webhook object secret from ${source} is missing or malformed, expected a whsec_\u2026 key`,\n    )\n  const handle = {\n    toString: () => REDACTED,\n    toJSON: () => REDACTED,\n    [Symbol.for(\"nodejs.util.inspect.custom\")]: () => REDACTED,\n  }\n  // The brand symbol exists only at the type level; the WeakMap entry is the runtime brand.\n  // eslint-disable-next-line @typescript-eslint/consistent-type-assertions\n  const secret = handle as unknown as WebhookObjectSecret\n  secretValues.set(secret, value)\n  return secret\n}\n\n/**\n * Read a `whsec_\u2026` secret from the named environment variable. The recommended way to\n * provide a secret: the value never appears in your source, and a missing or malformed\n * variable fails fast with the variable's name (never its value).\n */\nexport const secretFromEnv = (name: string): WebhookObjectSecret =>\n  brandSecret(process.env[name] ?? \"\", `env var ${name}`)\n\n/**\n * Wrap a secret you already hold as a string (secret managers, non-Node runtimes without\n * `process.env`). Named `unsafe` so hardcoded `whsec_\u2026` literals are easy to grep for in\n * review; never commit a literal secret to source control.\n */\nexport const unsafeSecretLiteral = (value: string): WebhookObjectSecret =>\n  brandSecret(value, \"a string literal\")\n\n/**\n * Internal: recover the raw secret for signing. Not re-exported from the package entry\n * point. Bare strings are validated in place; anything else must be a handle minted by\n * this module (an object that isn't one fails the WeakMap lookup and throws).\n */\nexport const revealSecret = (secret: WebhookObjectSecret | string): string => {\n  if (typeof secret === \"string\") {\n    if (!SECRET_PATTERN.test(secret))\n      throw new WebhookObjectError(\n        \"invalid_secret\",\n        \"webhook object secret is malformed, expected a whsec_\u2026 key\",\n      )\n    return secret\n  }\n  const value = secretValues.get(secret)\n  if (value === undefined)\n    throw new WebhookObjectError(\n      \"invalid_secret\",\n      \"webhook object secret must be a whsec_\u2026 string or created with secretFromEnv() / unsafeSecretLiteral()\",\n    )\n  return value\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAmC;AAGnC,MAAM,iBAAiB;AAavB,MAAM,eAAe,oBAAI,QAAqC;AAE9D,MAAM,WAAW;AAEjB,MAAM,cAAc,CAAC,OAAe,WAAwC;AAC1E,MAAI,CAAC,eAAe,KAAK,KAAK;AAC5B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,8BAA8B,MAAM;AAAA,IACtC;AACF,QAAM,SAAS;AAAA,IACb,UAAU,MAAM;AAAA,IAChB,QAAQ,MAAM;AAAA,IACd,CAAC,OAAO,IAAI,4BAA4B,CAAC,GAAG,MAAM;AAAA,EACpD;AAGA,QAAM,SAAS;AACf,eAAa,IAAI,QAAQ,KAAK;AAC9B,SAAO;AACT;AAOO,MAAM,gBAAgB,CAAC,SAC5B,YAAY,QAAQ,IAAI,IAAI,KAAK,IAAI,WAAW,IAAI,EAAE;AAOjD,MAAM,sBAAsB,CAAC,UAClC,YAAY,OAAO,kBAAkB;AAOhC,MAAM,eAAe,CAAC,WAAiD;AAC5E,MAAI,OAAO,WAAW,UAAU;AAC9B,QAAI,CAAC,eAAe,KAAK,MAAM;AAC7B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AACF,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,aAAa,IAAI,MAAM;AACrC,MAAI,UAAU;AACZ,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AACF,SAAO;AACT;",
+  "names": []
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gathertown/webhook-object-sdk",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Typed client for emitting events to Gather webhook objects (Smart Objects): Standard Webhooks signing, retries, and a fully-inferred send API.",
   "main": "dist/src/index.js",
   "types": "dist/src/index.d.ts",
@@ -8,6 +8,7 @@
   "files": [
     "dist/src/**",
     "!dist/src/__tests__/**",
+    "!dist/src/**/*.d.ts.map",
     "README.md",
     "LICENSE-MIT",
     "LICENSE-APACHE"
@@ -20,12 +21,12 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=24"
   },
   "author": "Gather Presence, Inc.",
   "license": "MIT OR Apache-2.0",
   "dependencies": {
-    "@gathertown/webhook-object-types": "^0.1.1",
+    "@gathertown/webhook-object-types": "^0.2.0",
     "standardwebhooks": "~1.0.0"
   },
   "devDependencies": {

package/dist/src/catalog.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AAC3E,OAAO,EAA6B,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AAEpG,6FAA6F;AAC7F,KAAK,kBAAkB,GAAG,aAAa,GAAG,OAAO,GAAG,cAAc,CAAA;AAElE,0FAA0F;AAC1F,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAAC,yBAAyB,EAAE,kBAAkB,CAAC,CAAA;AAE3F,qDAAqD;AACrD,MAAM,MAAM,2BAA2B,GAAG,IAAI,CAAC,yBAAyB,EAAE,kBAAkB,CAAC,CAAA;AAE7F,uFAAuF;AACvF,KAAK,QAAQ,CAAC,KAAK,SAAS,yBAAyB,IAAI,KAAK,SAAS;IACrE,MAAM,EAAE,MAAM,MAAM,SAAS,mBAAmB,CAAA;CACjD,GACG,MAAM,GACN,SAAS,CAAA;AAEb;;;GAGG;AACH,MAAM,MAAM,oBAAoB,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,IAAI;KAC3F,IAAI,IAAI,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;CACtE,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,0BAA0B,GACrC,KAAK,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,EAE/D,SAAS,OAAO,EAChB,UAAS,2BAAgC,KACxC,oBAAoB,CAAC,OAAO,CASgB,CAAA"}

package/dist/src/client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,OAAO,EACP,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,kCAAkC,CAAA;AAGzC,OAAO,EAAgB,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAE5D,MAAM,MAAM,yBAAyB,GAAG;IACtC,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAA;IACX;;;;OAIG;IACH,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAAA;IACpC;;;OAGG;IACH,MAAM,CAAC,EAAE,mBAAmB,CAAA;IAC5B,2FAA2F;IAC3F,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,6FAA6F;IAC7F,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IACpB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,MAAM,CAAA;IAC3B;;;OAGG;IACH,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,mBAAmB,GAAG,SAAS,IACpE,CAAC,CAAC,SAAS,mBAAmB,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;AAE/F,kFAAkF;AAClF,KAAK,QAAQ,CAAC,CAAC,SAAS,gBAAgB,IACtC,OAAO,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;AAEpE,mHAAmH;AACnH,MAAM,MAAM,UAAU,GAAG;IAAE,MAAM,EAAE,YAAY,GAAG,YAAY,CAAA;CAAE,CAAA;AAEhE,sFAAsF;AACtF,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAClC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACtC,CAAA;AAED,oGAAoG;AACpG,KAAK,YAAY,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,IAAI,MAAM,IAAI,EAAE,GACzE,GAAG,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,GAC1C,CAAC,CAAA;AAEL,gFAAgF;AAChF,KAAK,gBAAgB,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,GAAG,MAAM,UAAU,IAAI,MAAM,EAAE,GAC/E,UAAU,GACV,KAAK,CAAA;AAET;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,CAAC,MAAM,SAAS,gBAAgB,IAAI;KACjE,UAAU,IAAI,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,GAAG;SACnE,KAAK,IAAI,OAAO,CACf,MAAM,EACN,GAAG,UAAU,IAAI,MAAM,EAAE,CAC1B,IAAI,KAAK,SAAS,GAAG,UAAU,IAAI,MAAM,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,KAAK,GAAG,CAClF,GAAG,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,KACrB,OAAO,CAAC,UAAU,CAAC;KACzB;CACF,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,mBAAmB,GAAG,SAAS,GAAG,SAAS,IAAI;IACvF;;;OAGG;IACH,IAAI,CAAC,CAAC,SAAS,gBAAgB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACvF,gFAAgF;IAChF,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,CAAA;CAC5B,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAA;AA4D7C;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,GAAI,CAAC,SAAS,mBAAmB,GAAG,SAAS,GAAG,SAAS,EAC7F,QAAQ,yBAAyB,GAAG;IAAE,MAAM,CAAC,EAAE,CAAC,CAAA;CAAE,KACjD,mBAAmB,CAAC,CAAC,CAyEvB,CAAA"}

package/dist/src/deliver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"deliver.d.ts","sourceRoot":"","sources":["../../src/deliver.ts"],"names":[],"mappings":"AAGA,sFAAsF;AACtF,eAAO,MAAM,cAAc,QAAW,CAAA;AAEtC,eAAO,MAAM,oBAAoB,IAAI,CAAA;AAOrC;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,sNAWuB,CAAA;AAsFpD,MAAM,MAAM,WAAW,GAAG;IACxB,GAAG,EAAE,MAAM,CAAA;IACX,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAA;IACZ,sGAAsG;IACtG,SAAS,EAAE,MAAM,CAAA;IACjB,+FAA+F;IAC/F,IAAI,EAAE,CAAC,gBAAgB,EAAE,MAAM,KAAK,MAAM,CAAA;IAC1C,SAAS,EAAE,OAAO,KAAK,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,gGAAgG;IAChG,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,OAAO,GAAU,MAAM,WAAW,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMhF,CAAA"}

package/dist/src/errors.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAA;AAE5E;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAC9B,oBAAoB,GAGpB,cAAc,GAEd,mBAAmB,GAEnB,gBAAgB,GAEhB,aAAa,GAEb,eAAe,GAEf,SAAS,GAET,qBAAqB,CAAA;AAEzB;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAIzC,QAAQ,CAAC,IAAI,EAAE,sBAAsB;IAHvC,SAAkB,IAAI,wBAAuB;gBAGlC,IAAI,EAAE,sBAAsB,EACrC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QACR,iEAAiE;QACjE,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,8FAA8F;QAC9F,IAAI,CAAC,EAAE,OAAO,CAAA;QACd,KAAK,CAAC,EAAE,OAAO,CAAA;KAChB;IAOH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;IAEnC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CACvB"}

package/dist/src/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,GACjC,MAAM,WAAW,CAAA;AAClB,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,yBAAyB,EACzB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,GAC/B,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,kBAAkB,EAAE,KAAK,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAC1E,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,KAAK,mBAAmB,EAAE,MAAM,UAAU,CAAA"}

package/dist/src/secret.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"secret.d.ts","sourceRoot":"","sources":["../../src/secret.ts"],"names":[],"mappings":"AAKA,OAAO,CAAC,MAAM,wBAAwB,EAAE,OAAO,MAAM,CAAA;AAErD;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAAE,QAAQ,CAAC,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAA;CAAE,CAAA;AAyB/E;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,mBACY,CAAA;AAEzD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAI,OAAO,MAAM,KAAG,mBACZ,CAAA;AAExC;;;;GAIG;AACH,eAAO,MAAM,YAAY,GAAI,QAAQ,mBAAmB,GAAG,MAAM,KAAG,MAgBnE,CAAA"}