@isnap/sdk 0.0.0-next.3

package/dist/webhooks/parse.js

@@ -0,0 +1,47 @@
+import { WebhookSignatureError } from '../errors.js';
+/**
+ * Parse a raw webhook delivery body into a typed envelope. Throws
+ * `WebhookSignatureError` if the body is not valid JSON or doesn't carry
+ * the §4.1 envelope shape (`event_id`, `event_type`, `data`). Use
+ * `verifyWebhook` for the full HMAC + replay-window verification — this
+ * is the parsing-only half for cases where verification happened
+ * out-of-band (e.g. behind a trusted gateway).
+ *
+ * **Consumers MUST dedupe by `event.event_id`** — webhook delivery is
+ * at-least-once, so retries replay the same envelope. Without dedup,
+ * processing the same event twice produces duplicate side-effects.
+ */
+export function parseWebhookEvent(rawBody) {
+    let parsed;
+    try {
+        parsed = JSON.parse(rawBody);
+    }
+    catch (err) {
+        throw new WebhookSignatureError(`Webhook body is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new WebhookSignatureError('Webhook body must be a JSON object');
+    }
+    const obj = parsed;
+    if (typeof obj.api_version !== 'string' || obj.api_version.length === 0) {
+        throw new WebhookSignatureError('Webhook envelope missing api_version');
+    }
+    if (typeof obj.event_id !== 'string' || obj.event_id.length === 0) {
+        throw new WebhookSignatureError('Webhook envelope missing event_id');
+    }
+    if (typeof obj.event_type !== 'string' || obj.event_type.length === 0) {
+        throw new WebhookSignatureError('Webhook envelope missing event_type');
+    }
+    if (typeof obj.created_at !== 'string' || obj.created_at.length === 0) {
+        throw new WebhookSignatureError('Webhook envelope missing created_at');
+    }
+    // `data` must be a plain object — arrays satisfy `typeof === 'object'`
+    // but the contract §4.1 envelope is `{ ...fields, data: { message: ... } }`,
+    // never an array. Rejecting at the boundary keeps the
+    // `Record<string, unknown>` declared type aligned with runtime.
+    if (typeof obj.data !== 'object' || obj.data === null || Array.isArray(obj.data)) {
+        throw new WebhookSignatureError('Webhook envelope missing data');
+    }
+    return obj;
+}
+//# sourceMappingURL=parse.js.map

package/dist/webhooks/parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.js","sourceRoot":"","sources":["../../src/webhooks/parse.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAGpD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,qBAAqB,CAC7B,mCAAmC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACtF,CAAA;IACH,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,qBAAqB,CAAC,oCAAoC,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAA;IAC7C,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,qBAAqB,CAAC,sCAAsC,CAAC,CAAA;IACzE,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,qBAAqB,CAAC,mCAAmC,CAAC,CAAA;IACtE,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,qBAAqB,CAAC,qCAAqC,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,qBAAqB,CAAC,qCAAqC,CAAC,CAAA;IACxE,CAAC;IACD,uEAAuE;IACvE,6EAA6E;IAC7E,sDAAsD;IACtD,gEAAgE;IAChE,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,qBAAqB,CAAC,+BAA+B,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,GAAkC,CAAA;AAC3C,CAAC"}

package/dist/webhooks/types.d.ts

@@ -0,0 +1,80 @@
+import type { Message, Reaction } from '../resources/messages.js';
+/**
+ * Common envelope for every webhook event. Per contract §4.1: every
+ * delivery body is shaped `{ api_version, event_id, event_type,
+ * created_at, trace_id?, data }`. `data` is a per-event-type payload —
+ * the type guards below narrow it to a typed shape.
+ */
+export interface WebhookEventBase {
+    api_version: string;
+    event_id: string;
+    event_type: string;
+    created_at: string;
+    trace_id?: string;
+    data: Record<string, unknown>;
+}
+export type MessageEventType = 'message.queued' | 'message.scheduled' | 'message.sent' | 'message.delivered' | 'message.failed' | 'message.received' | 'message.read' | 'message.cancelled';
+export interface MessageEvent extends WebhookEventBase {
+    event_type: `message.${string}`;
+    data: {
+        message: Message;
+    };
+}
+export type ReactionEventType = 'reaction.added' | 'reaction.removed';
+export interface ReactionEvent extends WebhookEventBase {
+    event_type: `reaction.${string}`;
+    data: {
+        reaction: Reaction;
+    };
+}
+export type LineEventType = 'line.connected' | 'line.offline' | 'line.degraded' | 'line.disconnected' | 'line.activated' | 'line.suspended' | 'line.apple_id_flagged' | 'line.quota_warning' | 'line.quota_exceeded' | 'line.permanently_blocked';
+/**
+ * `data` is intentionally typed as `Record<string, unknown>` until the
+ * contract pins per-event-type field shapes. Today's payloads vary by
+ * event (e.g. `line.apple_id_flagged` carries `flag_reason`,
+ * `line.quota_warning` carries `bucket` + `usage`), and surfacing a
+ * union with optional fields would let TypeScript autocomplete suggest
+ * keys that aren't present at runtime. Tighten when the contract is
+ * amended to specify the per-event shapes.
+ */
+export interface LineEvent extends WebhookEventBase {
+    event_type: `line.${string}`;
+    data: Record<string, unknown>;
+}
+export type TypingEventType = 'typing.started' | 'typing.stopped';
+/**
+ * `data` is intentionally `Record<string, unknown>` — the partner-facing
+ * shape is not yet documented in the contract. See `LineEvent` for the
+ * same rationale.
+ */
+export interface TypingEvent extends WebhookEventBase {
+    event_type: `typing.${string}`;
+    data: Record<string, unknown>;
+}
+export type TrialEventType = 'trial.linked' | 'trial.dormant' | 'trial.reactivated' | 'trial.converted';
+/** See `LineEvent` for why `data` is loose. */
+export interface TrialEvent extends WebhookEventBase {
+    event_type: `trial.${string}`;
+    data: Record<string, unknown>;
+}
+/**
+ * Discriminated union over the typed event families plus `WebhookEventBase`
+ * as the catch-all for event types not yet known to this SDK version.
+ * Use a type guard (`isMessageEvent`, `isReactionEvent`, ...) to narrow
+ * inside an event handler:
+ *
+ * ```ts
+ * function handle(event: WebhookEvent) {
+ *   if (isMessageEvent(event)) {
+ *     console.log(event.data.message.id)  // typed as Message
+ *   }
+ * }
+ * ```
+ */
+export type WebhookEvent = MessageEvent | ReactionEvent | LineEvent | TypingEvent | TrialEvent | WebhookEventBase;
+export declare function isMessageEvent(event: WebhookEventBase): event is MessageEvent;
+export declare function isReactionEvent(event: WebhookEventBase): event is ReactionEvent;
+export declare function isLineEvent(event: WebhookEventBase): event is LineEvent;
+export declare function isTypingEvent(event: WebhookEventBase): event is TypingEvent;
+export declare function isTrialEvent(event: WebhookEventBase): event is TrialEvent;
+//# sourceMappingURL=types.d.ts.map

package/dist/webhooks/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/webhooks/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAA;AAEjE;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B;AAeD,MAAM,MAAM,gBAAgB,GACxB,gBAAgB,GAChB,mBAAmB,GACnB,cAAc,GACd,mBAAmB,GACnB,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,mBAAmB,CAAA;AAEvB,MAAM,WAAW,YAAa,SAAQ,gBAAgB;IACpD,UAAU,EAAE,WAAW,MAAM,EAAE,CAAA;IAC/B,IAAI,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAA;CAC3B;AAID,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,GAAG,kBAAkB,CAAA;AAErE,MAAM,WAAW,aAAc,SAAQ,gBAAgB;IACrD,UAAU,EAAE,YAAY,MAAM,EAAE,CAAA;IAChC,IAAI,EAAE;QAAE,QAAQ,EAAE,QAAQ,CAAA;KAAE,CAAA;CAC7B;AAID,MAAM,MAAM,aAAa,GACrB,gBAAgB,GAChB,cAAc,GACd,eAAe,GACf,mBAAmB,GACnB,gBAAgB,GAChB,gBAAgB,GAChB,uBAAuB,GACvB,oBAAoB,GACpB,qBAAqB,GACrB,0BAA0B,CAAA;AAE9B;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAU,SAAQ,gBAAgB;IACjD,UAAU,EAAE,QAAQ,MAAM,EAAE,CAAA;IAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B;AAID,MAAM,MAAM,eAAe,GAAG,gBAAgB,GAAG,gBAAgB,CAAA;AAEjE;;;;GAIG;AACH,MAAM,WAAW,WAAY,SAAQ,gBAAgB;IACnD,UAAU,EAAE,UAAU,MAAM,EAAE,CAAA;IAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B;AAID,MAAM,MAAM,cAAc,GACtB,cAAc,GACd,eAAe,GACf,mBAAmB,GACnB,iBAAiB,CAAA;AAErB,+CAA+C;AAC/C,MAAM,WAAW,UAAW,SAAQ,gBAAgB;IAClD,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B;AAID;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,YAAY,GACpB,YAAY,GACZ,aAAa,GACb,SAAS,GACT,WAAW,GACX,UAAU,GACV,gBAAgB,CAAA;AAIpB,wBAAgB,cAAc,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,YAAY,CAE7E;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,aAAa,CAE/E;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,SAAS,CAEvE;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,WAAW,CAE3E;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,UAAU,CAEzE"}

package/dist/webhooks/types.js

@@ -0,0 +1,17 @@
+/* ─────────────────────────── Type guards ─────────────────────────────── */
+export function isMessageEvent(event) {
+    return event.event_type.startsWith('message.');
+}
+export function isReactionEvent(event) {
+    return event.event_type.startsWith('reaction.');
+}
+export function isLineEvent(event) {
+    return event.event_type.startsWith('line.');
+}
+export function isTypingEvent(event) {
+    return event.event_type.startsWith('typing.');
+}
+export function isTrialEvent(event) {
+    return event.event_type.startsWith('trial.');
+}
+//# sourceMappingURL=types.js.map

package/dist/webhooks/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/webhooks/types.ts"],"names":[],"mappings":"AAsIA,6EAA6E;AAE7E,MAAM,UAAU,cAAc,CAAC,KAAuB;IACpD,OAAO,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;AAChD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAuB;IACrD,OAAO,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;AACjD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAuB;IACjD,OAAO,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;AAC7C,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAuB;IACnD,OAAO,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;AAC/C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAuB;IAClD,OAAO,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;AAC9C,CAAC"}

package/dist/webhooks/verify.d.ts

@@ -0,0 +1,41 @@
+import type { WebhookEventBase } from './types.js';
+export interface VerifyWebhookOptions {
+    /**
+     * Maximum drift in seconds between the request timestamp and the
+     * verifier's clock. Defaults to 300 (5 minutes) per contract §4.4.
+     * Set higher only if your server is reverse-proxied through a queue
+     * that may stall messages.
+     */
+    tolerance?: number;
+    /**
+     * Override the "now" clock — exposed primarily so tests can pin a
+     * deterministic time. Returns unix seconds.
+     */
+    now?: () => number;
+}
+/**
+ * Verify an incoming webhook delivery using the iSnap signing scheme:
+ *
+ * - `X-iSnap-Signature` header carries the hex-encoded
+ *   `HMAC-SHA256(secret, "<timestamp>.<rawBody>")`
+ * - `X-iSnap-Timestamp` header carries the unix-second issuance time
+ *
+ * Throws `WebhookSignatureError` on missing headers, malformed
+ * timestamp, expired timestamp (outside `tolerance`), or signature
+ * mismatch. Returns the parsed event envelope on success.
+ *
+ * `secret` may be a single secret string OR an array — pass `[newSecret,
+ * oldSecret]` during the 5-minute rotate-secret grace window so both
+ * still validate. The verifier tries each in order and returns on the
+ * first match.
+ *
+ * Headers may be a `Record<string, string>` (e.g. Express's `req.headers`)
+ * or a `Headers` instance — both are read case-insensitively.
+ *
+ * **Consumers MUST dedupe by `event.event_id`** — retries replay the same
+ * envelope (same `event_id`, same body, same signature, refreshed
+ * timestamp). Without consumer-side dedup, an at-least-once delivery
+ * model produces duplicate side-effects on the partner system.
+ */
+export declare function verifyWebhook(rawBody: string, headers: Record<string, string | string[] | undefined> | Headers, secret: string | readonly string[], options?: VerifyWebhookOptions): WebhookEventBase;
+//# sourceMappingURL=verify.d.ts.map

package/dist/webhooks/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/webhooks/verify.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAIlD,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,OAAO,EAChE,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EAClC,OAAO,GAAE,oBAAyB,GACjC,gBAAgB,CA+DlB"}

package/dist/webhooks/verify.js

@@ -0,0 +1,110 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { WebhookSignatureError } from '../errors.js';
+import { parseWebhookEvent } from './parse.js';
+const DEFAULT_TOLERANCE_SECONDS = 300;
+/**
+ * Verify an incoming webhook delivery using the iSnap signing scheme:
+ *
+ * - `X-iSnap-Signature` header carries the hex-encoded
+ *   `HMAC-SHA256(secret, "<timestamp>.<rawBody>")`
+ * - `X-iSnap-Timestamp` header carries the unix-second issuance time
+ *
+ * Throws `WebhookSignatureError` on missing headers, malformed
+ * timestamp, expired timestamp (outside `tolerance`), or signature
+ * mismatch. Returns the parsed event envelope on success.
+ *
+ * `secret` may be a single secret string OR an array — pass `[newSecret,
+ * oldSecret]` during the 5-minute rotate-secret grace window so both
+ * still validate. The verifier tries each in order and returns on the
+ * first match.
+ *
+ * Headers may be a `Record<string, string>` (e.g. Express's `req.headers`)
+ * or a `Headers` instance — both are read case-insensitively.
+ *
+ * **Consumers MUST dedupe by `event.event_id`** — retries replay the same
+ * envelope (same `event_id`, same body, same signature, refreshed
+ * timestamp). Without consumer-side dedup, an at-least-once delivery
+ * model produces duplicate side-effects on the partner system.
+ */
+export function verifyWebhook(rawBody, headers, secret, options = {}) {
+    const sigHeader = getHeader(headers, 'x-isnap-signature');
+    if (!sigHeader) {
+        throw new WebhookSignatureError('Missing X-iSnap-Signature header');
+    }
+    const tsHeader = getHeader(headers, 'x-isnap-timestamp');
+    if (!tsHeader) {
+        throw new WebhookSignatureError('Missing X-iSnap-Timestamp header');
+    }
+    // Strict integer-only check — `Number.parseInt` would happily accept
+    // `"1714478400foo"` and silently truncate. The HMAC compare downstream
+    // catches the resulting payload mismatch, but rejecting earlier here
+    // surfaces a clearer error and avoids one unnecessary HMAC computation.
+    if (!/^\d+$/.test(tsHeader)) {
+        throw new WebhookSignatureError(`Malformed X-iSnap-Timestamp: ${tsHeader}`);
+    }
+    const timestamp = Number(tsHeader);
+    if (!Number.isFinite(timestamp) || timestamp <= 0) {
+        throw new WebhookSignatureError(`Malformed X-iSnap-Timestamp: ${tsHeader}`);
+    }
+    const tolerance = options.tolerance ?? DEFAULT_TOLERANCE_SECONDS;
+    // Validate before use — `Math.abs(...) > NaN` is always false (so the
+    // replay-window check would silently pass), `Math.abs(...) > -1` is
+    // always true (every timestamp rejected), and `Infinity` makes every
+    // timestamp pass. Reject the bad inputs explicitly so misuse fails
+    // loudly at the verify call site instead of hiding a security gap.
+    if (!Number.isFinite(tolerance) || tolerance < 0) {
+        throw new WebhookSignatureError(`tolerance must be a finite non-negative number (got ${String(tolerance)})`);
+    }
+    const nowSec = (options.now ?? defaultNow)();
+    if (Math.abs(nowSec - timestamp) > tolerance) {
+        throw new WebhookSignatureError(`Webhook timestamp is outside the ${tolerance}s tolerance window (drift: ${nowSec - timestamp}s)`);
+    }
+    const candidates = typeof secret === 'string' ? [secret] : secret;
+    if (candidates.length === 0) {
+        throw new WebhookSignatureError('No webhook secret(s) provided');
+    }
+    const provided = decodeHex(sigHeader);
+    if (!provided) {
+        throw new WebhookSignatureError('X-iSnap-Signature is not valid hex');
+    }
+    const signedPayload = `${timestamp}.${rawBody}`;
+    // Multi-secret loop returns early on first match — this is a minor
+    // timing side-channel during the rotate-secret grace window (an
+    // attacker who controls request timing could distinguish "matched first
+    // candidate" from "matched second"). Practical exploit value is near
+    // zero: knowing which secret matched does not help forge signatures
+    // for either secret. Worth revisiting if real partners run rotation
+    // through hostile networks.
+    for (const candidate of candidates) {
+        const expected = createHmac('sha256', candidate).update(signedPayload).digest();
+        if (provided.length === expected.length && timingSafeEqual(provided, expected)) {
+            return parseWebhookEvent(rawBody);
+        }
+    }
+    throw new WebhookSignatureError('Webhook signature did not match any provided secret');
+}
+function getHeader(headers, name) {
+    if (typeof Headers !== 'undefined' && headers instanceof Headers) {
+        return headers.get(name);
+    }
+    const lower = name.toLowerCase();
+    for (const [key, value] of Object.entries(headers)) {
+        if (key.toLowerCase() !== lower)
+            continue;
+        if (Array.isArray(value))
+            return value[0] ?? null;
+        if (typeof value === 'string')
+            return value;
+        return null;
+    }
+    return null;
+}
+function decodeHex(hex) {
+    if (!/^[0-9a-fA-F]+$/.test(hex) || hex.length % 2 !== 0)
+        return null;
+    return Buffer.from(hex, 'hex');
+}
+function defaultNow() {
+    return Math.floor(Date.now() / 1000);
+}
+//# sourceMappingURL=verify.js.map

package/dist/webhooks/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/webhooks/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAG9C,MAAM,yBAAyB,GAAG,GAAG,CAAA;AAiBrC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,OAAgE,EAChE,MAAkC,EAClC,UAAgC,EAAE;IAElC,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAA;IACzD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAA;IACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,CAAC,CAAA;IACrE,CAAC;IACD,qEAAqE;IACrE,uEAAuE;IACvE,qEAAqE;IACrE,wEAAwE;IACxE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,qBAAqB,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAA;IAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,qBAAqB,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAA;IAC7E,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,yBAAyB,CAAA;IAChE,sEAAsE;IACtE,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,mEAAmE;IACnE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,qBAAqB,CAC7B,uDAAuD,MAAM,CAAC,SAAS,CAAC,GAAG,CAC5E,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,EAAE,CAAA;IAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,qBAAqB,CAC7B,oCAAoC,SAAS,8BAA8B,MAAM,GAAG,SAAS,IAAI,CAClG,CAAA;IACH,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IACjE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,qBAAqB,CAAC,+BAA+B,CAAC,CAAA;IAClE,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,qBAAqB,CAAC,oCAAoC,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,aAAa,GAAG,GAAG,SAAS,IAAI,OAAO,EAAE,CAAA;IAC/C,mEAAmE;IACnE,gEAAgE;IAChE,wEAAwE;IACxE,qEAAqE;IACrE,oEAAoE;IACpE,oEAAoE;IACpE,4BAA4B;IAC5B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,EAAE,CAAA;QAC/E,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/E,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC;IACH,CAAC;IACD,MAAM,IAAI,qBAAqB,CAAC,qDAAqD,CAAC,CAAA;AACxF,CAAC;AAED,SAAS,SAAS,CAChB,OAAgE,EAChE,IAAY;IAEZ,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,YAAY,OAAO,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAChC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,KAAK;YAAE,SAAQ;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;QACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;QAC3C,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACpE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;AAChC,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;AACtC,CAAC"}

package/package.json

@@ -0,0 +1,65 @@
+{
+  "name": "@isnap/sdk",
+  "version": "0.0.0-next.3",
+  "description": "Official TypeScript SDK for the iSnap P2P telephony API",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "keywords": [
+    "isnap",
+    "imessage",
+    "sms",
+    "rcs",
+    "p2p",
+    "telephony",
+    "messaging",
+    "sdk",
+    "typescript"
+  ],
+  "homepage": "https://github.com/WhatSnap/iSnap-App/tree/main/packages/sdk#readme",
+  "bugs": {
+    "url": "https://github.com/WhatSnap/iSnap-App/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/WhatSnap/iSnap-App.git",
+    "directory": "packages/sdk"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && bun scripts/copy-generated.ts",
+    "lint": "eslint src/",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "generate": "openapi-typescript ../backend/openapi.json -o src/generated/openapi.d.ts",
+    "prepublishOnly": "bun run lint && bun run typecheck && bun run test && bun run build"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^22.0.0",
+    "eslint": "^9.0.0",
+    "openapi-typescript": "^7.13.0",
+    "typescript": "^5.7.0",
+    "typescript-eslint": "^8.57.1",
+    "vitest": "^3.0.0"
+  }
+}