@kindgi/types 0.1.6 → 0.1.7-rc.0

package/dist/index.d.ts

@@ -6,6 +6,7 @@ export type * from './refs.js';
 export type * from './result.js';
 export type * from './temporal.js';
 export type * from './version.js';
+export type * from './webhook.js';
 export { makeEnvName } from './ids.js';
 export { bearerValueProblem, headerValueProblem } from './header-value.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,mBAAmB,aAAa,CAAC;AACjC,mBAAmB,WAAW,CAAC;AAC/B,mBAAmB,UAAU,CAAC;AAC9B,mBAAmB,WAAW,CAAC;AAC/B,mBAAmB,WAAW,CAAC;AAC/B,mBAAmB,aAAa,CAAC;AACjC,mBAAmB,eAAe,CAAC;AACnC,mBAAmB,cAAc,CAAC;AAKlC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAIvC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,mBAAmB,aAAa,CAAC;AACjC,mBAAmB,WAAW,CAAC;AAC/B,mBAAmB,UAAU,CAAC;AAC9B,mBAAmB,WAAW,CAAC;AAC/B,mBAAmB,WAAW,CAAC;AAC/B,mBAAmB,aAAa,CAAC;AACjC,mBAAmB,eAAe,CAAC;AACnC,mBAAmB,cAAc,CAAC;AAClC,mBAAmB,cAAc,CAAC;AAKlC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAIvC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAWjC,uEAAuE;AACvE,qEAAqE;AACrE,+DAA+D;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvC,yEAAyE;AACzE,8DAA8D;AAC9D,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAYjC,uEAAuE;AACvE,qEAAqE;AACrE,+DAA+D;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvC,yEAAyE;AACzE,8DAA8D;AAC9D,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/webhook.d.ts

@@ -0,0 +1,28 @@
+/**
+ * How a sender signs the requests a webhook trigger receives.
+ *
+ * - `hmac-sha256`: HMAC-SHA256 of the raw request body under the shared
+ *   secret's UTF-8 bytes, in one header, `hex` or `base64`, after an
+ *   optional `prefix` (GitHub and Drupal's Webhooks module send
+ *   `X-Hub-Signature-256: sha256=<hex>`; WooCommerce sends
+ *   `X-WC-Webhook-Signature: <base64>`; Shopify `X-Shopify-Hmac-Sha256:
+ *   <base64>`). No timestamp is signed, so a replay is caught only by the
+ *   trigger's delivery-id dedupe.
+ * - `standard-webhooks`: the Standard Webhooks format
+ *   (https://www.standardwebhooks.com): `webhook-id`, `webhook-timestamp`
+ *   and `webhook-signature: v1,<base64>` over `{id}.{timestamp}.{body}`,
+ *   with a `whsec_` secret. A timestamp further than `toleranceSeconds`
+ *   from the receiver's clock is refused (default 300).
+ */
+export type WebhookSignatureScheme = {
+    readonly kind: 'hmac-sha256';
+    readonly encoding: 'hex' | 'base64';
+    /** The header that carries the signature; matched case-insensitively. */
+    readonly header: string;
+    /** Stripped from the header's value before decoding (e.g. `sha256=`). */
+    readonly prefix?: string;
+} | {
+    readonly kind: 'standard-webhooks';
+    readonly toleranceSeconds?: number;
+};
+//# sourceMappingURL=webhook.d.ts.map

package/dist/webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../src/webhook.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,sBAAsB,GAC9B;IACE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,QAAQ,CAAC;IACpC,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC,CAAC"}

package/dist/webhook.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export {};
+//# sourceMappingURL=webhook.js.map

package/dist/webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.js","sourceRoot":"","sources":["../src/webhook.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kindgi/types",
-  "version": "0.1.6",
+  "version": "0.1.7-rc.0",
   "description": "Foundational TypeScript types shared across Kindgi. Branded IDs, timestamps, hashes, refs, Result, list filter / page shapes. Zero runtime dependencies; the only runtime export is the makeEnvName validator.",
   "license": "Apache-2.0",
   "repository": {

package/src/index.ts

@@ -9,6 +9,7 @@ export type * from './refs.js';
 export type * from './result.js';
 export type * from './temporal.js';
 export type * from './version.js';
+export type * from './webhook.js';
 
 // Runtime factories on branded IDs (validated construction). Kept as a
 // separate value re-export so the `export type *` barrels above stay

package/src/webhook.ts

@@ -0,0 +1,32 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+
+/**
+ * How a sender signs the requests a webhook trigger receives.
+ *
+ * - `hmac-sha256`: HMAC-SHA256 of the raw request body under the shared
+ *   secret's UTF-8 bytes, in one header, `hex` or `base64`, after an
+ *   optional `prefix` (GitHub and Drupal's Webhooks module send
+ *   `X-Hub-Signature-256: sha256=<hex>`; WooCommerce sends
+ *   `X-WC-Webhook-Signature: <base64>`; Shopify `X-Shopify-Hmac-Sha256:
+ *   <base64>`). No timestamp is signed, so a replay is caught only by the
+ *   trigger's delivery-id dedupe.
+ * - `standard-webhooks`: the Standard Webhooks format
+ *   (https://www.standardwebhooks.com): `webhook-id`, `webhook-timestamp`
+ *   and `webhook-signature: v1,<base64>` over `{id}.{timestamp}.{body}`,
+ *   with a `whsec_` secret. A timestamp further than `toleranceSeconds`
+ *   from the receiver's clock is refused (default 300).
+ */
+export type WebhookSignatureScheme =
+  | {
+      readonly kind: 'hmac-sha256';
+      readonly encoding: 'hex' | 'base64';
+      /** The header that carries the signature; matched case-insensitively. */
+      readonly header: string;
+      /** Stripped from the header's value before decoding (e.g. `sha256=`). */
+      readonly prefix?: string;
+    }
+  | {
+      readonly kind: 'standard-webhooks';
+      readonly toleranceSeconds?: number;
+    };