@kirimdev/sdk 1.0.0

package/dist/resources/messages.js

@@ -0,0 +1,40 @@
+import { Paginator } from '../pagination.js';
+export class MessagesResource {
+    http;
+    constructor(http) {
+        this.http = http;
+    }
+    /** POST /messages — send a WhatsApp message (any supported type). */
+    send(params, options) {
+        return this.http.requestData({
+            method: 'POST',
+            path: '/messages',
+            body: params,
+            ...(options ? { options } : {}),
+        });
+    }
+    /** GET /messages — list messages; async-iterable + per-page. */
+    list(params, options) {
+        return new Paginator(this.http, { path: '/messages', ...(params ? { query: params } : {}) }, options);
+    }
+    /** GET /messages/{id} */
+    retrieve(id, options) {
+        return this.http.requestData({
+            method: 'GET',
+            path: `/messages/${encodeURIComponent(id)}`,
+            ...(options ? { options } : {}),
+        });
+    }
+    /**
+     * GET /messages/{id}/media — returns the signed URL the API redirects to
+     * (the SDK does NOT follow the redirect — you decide whether to stream).
+     */
+    media(id, options) {
+        return this.http.requestData({
+            method: 'GET',
+            path: `/messages/${encodeURIComponent(id)}/media`,
+            ...(options ? { options } : {}),
+        });
+    }
+}
+//# sourceMappingURL=messages.js.map

package/dist/resources/messages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.js","sourceRoot":"","sources":["../../src/resources/messages.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAS5C,MAAM,OAAO,gBAAgB;IACE;IAA7B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,qEAAqE;IACrE,IAAI,CAAC,MAAyB,EAAE,OAAwB;QACtD,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAU;YACpC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,MAAM;YACZ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC,CAAA;IACJ,CAAC;IAED,gEAAgE;IAChE,IAAI,CAAC,MAA2B,EAAE,OAAwB;QACxD,OAAO,IAAI,SAAS,CAClB,IAAI,CAAC,IAAI,EACT,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAsE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAC3H,OAAO,CACR,CAAA;IACH,CAAC;IAED,yBAAyB;IACzB,QAAQ,CAAC,EAAU,EAAE,OAAwB;QAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAU;YACpC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,aAAa,kBAAkB,CAAC,EAAE,CAAC,EAAE;YAC3C,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC,CAAA;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,EAAU,EAAE,OAAwB;QACxC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAuB;YACjD,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,aAAa,kBAAkB,CAAC,EAAE,CAAC,QAAQ;YACjD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC,CAAA;IACJ,CAAC;CACF"}

package/dist/resources/templates.d.ts

@@ -0,0 +1,10 @@
+import type { HttpClient, RequestOptions } from '../http.js';
+import { Paginator } from '../pagination.js';
+import type { ListTemplatesParams, RetrieveTemplateParams, Template, TemplateListItem } from '../types.js';
+export declare class TemplatesResource {
+    private readonly http;
+    constructor(http: HttpClient);
+    list(params?: ListTemplatesParams, options?: RequestOptions): Paginator<TemplateListItem>;
+    retrieve(name: string, params?: RetrieveTemplateParams, options?: RequestOptions): Promise<Template>;
+}
+//# sourceMappingURL=templates.d.ts.map

package/dist/resources/templates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/resources/templates.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5C,OAAO,KAAK,EACV,mBAAmB,EACnB,sBAAsB,EACtB,QAAQ,EACR,gBAAgB,EACjB,MAAM,aAAa,CAAA;AAEpB,qBAAa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C,IAAI,CAAC,MAAM,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC,gBAAgB,CAAC;IAQzF,QAAQ,CACN,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,sBAAsB,EAC/B,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,QAAQ,CAAC;CAQrB"}

package/dist/resources/templates.js

@@ -0,0 +1,19 @@
+import { Paginator } from '../pagination.js';
+export class TemplatesResource {
+    http;
+    constructor(http) {
+        this.http = http;
+    }
+    list(params, options) {
+        return new Paginator(this.http, { path: '/templates', ...(params ? { query: params } : {}) }, options);
+    }
+    retrieve(name, params, options) {
+        return this.http.requestData({
+            method: 'GET',
+            path: `/templates/${encodeURIComponent(name)}`,
+            ...(params ? { query: params } : {}),
+            ...(options ? { options } : {}),
+        });
+    }
+}
+//# sourceMappingURL=templates.js.map

package/dist/resources/templates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../src/resources/templates.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAQ5C,MAAM,OAAO,iBAAiB;IACC;IAA7B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,IAAI,CAAC,MAA4B,EAAE,OAAwB;QACzD,OAAO,IAAI,SAAS,CAClB,IAAI,CAAC,IAAI,EACT,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAsE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAC5H,OAAO,CACR,CAAA;IACH,CAAC;IAED,QAAQ,CACN,IAAY,EACZ,MAA+B,EAC/B,OAAwB;QAExB,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAW;YACrC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,cAAc,kBAAkB,CAAC,IAAI,CAAC,EAAE;YAC9C,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAsE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC,CAAA;IACJ,CAAC;CACF"}

package/dist/resources/webhook-deliveries.d.ts

@@ -0,0 +1,19 @@
+import type { HttpClient, RequestOptions } from '../http.js';
+import { Paginator } from '../pagination.js';
+import type { BulkReplayParams, BulkReplayResult, ListWebhookDeliveriesParams, WebhookDelivery, WebhookDeliveryListItem } from '../types.js';
+export declare class WebhookDeliveriesResource {
+    private readonly http;
+    constructor(http: HttpClient);
+    list(params?: ListWebhookDeliveriesParams, options?: RequestOptions): Paginator<WebhookDeliveryListItem>;
+    retrieve(id: string, options?: RequestOptions): Promise<WebhookDelivery>;
+    /** POST /webhook_deliveries/{id}/replay */
+    replay(id: string, options?: RequestOptions): Promise<{
+        id: string;
+        object: 'webhook_delivery';
+        replayed_from: string;
+        status: 'pending';
+    }>;
+    /** POST /webhook_deliveries/bulk_replay */
+    bulkReplay(params: BulkReplayParams, options?: RequestOptions): Promise<BulkReplayResult>;
+}
+//# sourceMappingURL=webhook-deliveries.d.ts.map

package/dist/resources/webhook-deliveries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-deliveries.d.ts","sourceRoot":"","sources":["../../src/resources/webhook-deliveries.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5C,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,2BAA2B,EAC3B,eAAe,EACf,uBAAuB,EACxB,MAAM,aAAa,CAAA;AAEpB,qBAAa,yBAAyB;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C,IAAI,CACF,MAAM,CAAC,EAAE,2BAA2B,EACpC,OAAO,CAAC,EAAE,cAAc,GACvB,SAAS,CAAC,uBAAuB,CAAC;IAQrC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;IAQxE,2CAA2C;IAC3C,MAAM,CACJ,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC;QACT,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,EAAE,kBAAkB,CAAA;QAC1B,aAAa,EAAE,MAAM,CAAA;QACrB,MAAM,EAAE,SAAS,CAAA;KAClB,CAAC;IAQF,2CAA2C;IAC3C,UAAU,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAQ1F"}

package/dist/resources/webhook-deliveries.js

@@ -0,0 +1,35 @@
+import { Paginator } from '../pagination.js';
+export class WebhookDeliveriesResource {
+    http;
+    constructor(http) {
+        this.http = http;
+    }
+    list(params, options) {
+        return new Paginator(this.http, { path: '/webhook_deliveries', ...(params ? { query: params } : {}) }, options);
+    }
+    retrieve(id, options) {
+        return this.http.requestData({
+            method: 'GET',
+            path: `/webhook_deliveries/${encodeURIComponent(id)}`,
+            ...(options ? { options } : {}),
+        });
+    }
+    /** POST /webhook_deliveries/{id}/replay */
+    replay(id, options) {
+        return this.http.requestData({
+            method: 'POST',
+            path: `/webhook_deliveries/${encodeURIComponent(id)}/replay`,
+            ...(options ? { options } : {}),
+        });
+    }
+    /** POST /webhook_deliveries/bulk_replay */
+    bulkReplay(params, options) {
+        return this.http.requestData({
+            method: 'POST',
+            path: '/webhook_deliveries/bulk_replay',
+            body: params,
+            ...(options ? { options } : {}),
+        });
+    }
+}
+//# sourceMappingURL=webhook-deliveries.js.map

package/dist/resources/webhook-deliveries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-deliveries.js","sourceRoot":"","sources":["../../src/resources/webhook-deliveries.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAS5C,MAAM,OAAO,yBAAyB;IACP;IAA7B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,IAAI,CACF,MAAoC,EACpC,OAAwB;QAExB,OAAO,IAAI,SAAS,CAClB,IAAI,CAAC,IAAI,EACT,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAsE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EACrI,OAAO,CACR,CAAA;IACH,CAAC;IAED,QAAQ,CAAC,EAAU,EAAE,OAAwB;QAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAkB;YAC5C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,uBAAuB,kBAAkB,CAAC,EAAE,CAAC,EAAE;YACrD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC,CAAA;IACJ,CAAC;IAED,2CAA2C;IAC3C,MAAM,CACJ,EAAU,EACV,OAAwB;QAOxB,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;YAC3B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,uBAAuB,kBAAkB,CAAC,EAAE,CAAC,SAAS;YAC5D,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC,CAAA;IACJ,CAAC;IAED,2CAA2C;IAC3C,UAAU,CAAC,MAAwB,EAAE,OAAwB;QAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAmB;YAC7C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,iCAAiC;YACvC,IAAI,EAAE,MAAM;YACZ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC,CAAA;IACJ,CAAC;CACF"}

package/dist/resources/webhook-subscriptions.d.ts

@@ -0,0 +1,26 @@
+import type { HttpClient, RequestOptions } from '../http.js';
+import { Paginator } from '../pagination.js';
+import type { AddWebhookSecret, CreateWebhookSubscriptionParams, UpdateWebhookSubscriptionParams, WebhookSubscription, WebhookSubscriptionListItem } from '../types.js';
+export declare class WebhookSubscriptionsResource {
+    private readonly http;
+    constructor(http: HttpClient);
+    create(params: CreateWebhookSubscriptionParams, options?: RequestOptions): Promise<WebhookSubscription>;
+    list(options?: RequestOptions): Paginator<WebhookSubscriptionListItem>;
+    retrieve(id: string, options?: RequestOptions): Promise<WebhookSubscription>;
+    update(id: string, params: UpdateWebhookSubscriptionParams, options?: RequestOptions): Promise<WebhookSubscription>;
+    del(id: string, options?: RequestOptions): Promise<{
+        id: string;
+        deleted: true;
+    }>;
+    /**
+     * POST /webhook_subscriptions/{id}/secrets — mint a new signing secret.
+     * The returned `secret` is shown ONCE. Store it.
+     */
+    addSecret(id: string, options?: RequestOptions): Promise<AddWebhookSecret>;
+    /** DELETE /webhook_subscriptions/{id}/secrets/{secret_id} */
+    revokeSecret(id: string, secretId: string, options?: RequestOptions): Promise<{
+        id: string;
+        deleted: true;
+    }>;
+}
+//# sourceMappingURL=webhook-subscriptions.d.ts.map

package/dist/resources/webhook-subscriptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-subscriptions.d.ts","sourceRoot":"","sources":["../../src/resources/webhook-subscriptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5C,OAAO,KAAK,EACV,gBAAgB,EAChB,+BAA+B,EAC/B,+BAA+B,EAC/B,mBAAmB,EACnB,2BAA2B,EAC5B,MAAM,aAAa,CAAA;AAEpB,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C,MAAM,CACJ,MAAM,EAAE,+BAA+B,EACvC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,mBAAmB,CAAC;IAS/B,IAAI,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC,2BAA2B,CAAC;IAQtE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAQ5E,MAAM,CACJ,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,+BAA+B,EACvC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,mBAAmB,CAAC;IAS/B,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAQjF;;;OAGG;IACH,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAQ1E,6DAA6D;IAC7D,YAAY,CACV,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;CAO1C"}

package/dist/resources/webhook-subscriptions.js

@@ -0,0 +1,60 @@
+import { Paginator } from '../pagination.js';
+export class WebhookSubscriptionsResource {
+    http;
+    constructor(http) {
+        this.http = http;
+    }
+    create(params, options) {
+        return this.http.requestData({
+            method: 'POST',
+            path: '/webhook_subscriptions',
+            body: params,
+            ...(options ? { options } : {}),
+        });
+    }
+    list(options) {
+        return new Paginator(this.http, { path: '/webhook_subscriptions' }, options);
+    }
+    retrieve(id, options) {
+        return this.http.requestData({
+            method: 'GET',
+            path: `/webhook_subscriptions/${encodeURIComponent(id)}`,
+            ...(options ? { options } : {}),
+        });
+    }
+    update(id, params, options) {
+        return this.http.requestData({
+            method: 'PATCH',
+            path: `/webhook_subscriptions/${encodeURIComponent(id)}`,
+            body: params,
+            ...(options ? { options } : {}),
+        });
+    }
+    del(id, options) {
+        return this.http.requestData({
+            method: 'DELETE',
+            path: `/webhook_subscriptions/${encodeURIComponent(id)}`,
+            ...(options ? { options } : {}),
+        });
+    }
+    /**
+     * POST /webhook_subscriptions/{id}/secrets — mint a new signing secret.
+     * The returned `secret` is shown ONCE. Store it.
+     */
+    addSecret(id, options) {
+        return this.http.requestData({
+            method: 'POST',
+            path: `/webhook_subscriptions/${encodeURIComponent(id)}/secrets`,
+            ...(options ? { options } : {}),
+        });
+    }
+    /** DELETE /webhook_subscriptions/{id}/secrets/{secret_id} */
+    revokeSecret(id, secretId, options) {
+        return this.http.requestData({
+            method: 'DELETE',
+            path: `/webhook_subscriptions/${encodeURIComponent(id)}/secrets/${encodeURIComponent(secretId)}`,
+            ...(options ? { options } : {}),
+        });
+    }
+}
+//# sourceMappingURL=webhook-subscriptions.js.map

package/dist/resources/webhook-subscriptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-subscriptions.js","sourceRoot":"","sources":["../../src/resources/webhook-subscriptions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAS5C,MAAM,OAAO,4BAA4B;IACV;IAA7B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,MAAM,CACJ,MAAuC,EACvC,OAAwB;QAExB,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAsB;YAChD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,MAAM;YACZ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,CAAC,OAAwB;QAC3B,OAAO,IAAI,SAAS,CAClB,IAAI,CAAC,IAAI,EACT,EAAE,IAAI,EAAE,wBAAwB,EAAE,EAClC,OAAO,CACR,CAAA;IACH,CAAC;IAED,QAAQ,CAAC,EAAU,EAAE,OAAwB;QAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAsB;YAChD,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,0BAA0B,kBAAkB,CAAC,EAAE,CAAC,EAAE;YACxD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,CACJ,EAAU,EACV,MAAuC,EACvC,OAAwB;QAExB,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAsB;YAChD,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,0BAA0B,kBAAkB,CAAC,EAAE,CAAC,EAAE;YACxD,IAAI,EAAE,MAAM;YACZ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC,CAAA;IACJ,CAAC;IAED,GAAG,CAAC,EAAU,EAAE,OAAwB;QACtC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;YAC3B,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,0BAA0B,kBAAkB,CAAC,EAAE,CAAC,EAAE;YACxD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC,CAAA;IACJ,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,EAAU,EAAE,OAAwB;QAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAmB;YAC7C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,0BAA0B,kBAAkB,CAAC,EAAE,CAAC,UAAU;YAChE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC,CAAA;IACJ,CAAC;IAED,6DAA6D;IAC7D,YAAY,CACV,EAAU,EACV,QAAgB,EAChB,OAAwB;QAExB,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;YAC3B,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,0BAA0B,kBAAkB,CAAC,EAAE,CAAC,YAAY,kBAAkB,CAAC,QAAQ,CAAC,EAAE;YAChG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC,CAAA;IACJ,CAAC;CACF"}

package/dist/types.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Re-export and alias types from the generated OpenAPI schema in a stable,
+ * user-facing namespace. Resource files import from here so a regeneration
+ * never breaks downstream import paths.
+ */
+import type { components, paths } from './generated/schema.js';
+export type Schemas = components['schemas'];
+type SingleData<T> = T extends {
+    data: infer D;
+} ? D : never;
+type ListData<T> = T extends {
+    data: Array<infer D>;
+} ? D : never;
+export type MeContext = SingleData<Schemas['MeResponse']>;
+export type Message = SingleData<Schemas['GetMessageResponse']>;
+export type MessageListItem = ListData<Schemas['ListMessagesResponse']>;
+export type SendMessageParams = NonNullable<paths['/messages']['post']['requestBody']>['content']['application/json'];
+export type ListMessagesParams = NonNullable<paths['/messages']['get']['parameters']['query']>;
+export type MessageMediaRedirect = {
+    url: string | null;
+    request_id: string | null;
+};
+export type Template = SingleData<Schemas['GetTemplateResponse']>;
+export type TemplateListItem = ListData<Schemas['ListTemplatesResponse']>;
+export type ListTemplatesParams = NonNullable<paths['/templates']['get']['parameters']['query']>;
+export type RetrieveTemplateParams = NonNullable<paths['/templates/{name}']['get']['parameters']['query']>;
+export type Conversation = SingleData<Schemas['GetConversationResponse']>;
+export type ConversationListItem = ListData<Schemas['ListConversationsResponse']>;
+export type ListConversationsParams = NonNullable<paths['/conversations']['get']['parameters']['query']>;
+export type UpdateConversationParams = NonNullable<paths['/conversations/{id}']['patch']['requestBody']>['content']['application/json'];
+export type AttachConversationLabelParams = NonNullable<paths['/conversations/{id}/labels']['post']['requestBody']>['content']['application/json'];
+export type Contact = SingleData<Schemas['GetContactResponse']>;
+export type ContactListItem = ListData<Schemas['ListContactsResponse']>;
+export type ListContactsParams = NonNullable<paths['/contacts']['get']['parameters']['query']>;
+export type CreateContactParams = NonNullable<paths['/contacts']['post']['requestBody']>['content']['application/json'];
+export type UpdateContactParams = NonNullable<paths['/contacts/{id}']['patch']['requestBody']>['content']['application/json'];
+export type AttachContactLabelParams = NonNullable<paths['/contacts/{id}/labels']['post']['requestBody']>['content']['application/json'];
+export type BulkLabelContactsParams = NonNullable<paths['/contacts/bulk_label']['post']['requestBody']>['content']['application/json'];
+export type Label = SingleData<Schemas['GetLabelResponse']>;
+export type LabelListItem = ListData<Schemas['ListLabelsResponse']>;
+export type ListLabelsParams = NonNullable<paths['/labels']['get']['parameters']['query']>;
+export type CreateLabelParams = NonNullable<paths['/labels']['post']['requestBody']>['content']['application/json'];
+export type UpdateLabelParams = NonNullable<paths['/labels/{id}']['patch']['requestBody']>['content']['application/json'];
+export type WebhookSubscription = SingleData<Schemas['GetWebhookSubscriptionResponse']>;
+export type WebhookSubscriptionListItem = ListData<Schemas['ListWebhookSubscriptionsResponse']>;
+export type CreateWebhookSubscriptionParams = NonNullable<paths['/webhook_subscriptions']['post']['requestBody']>['content']['application/json'];
+export type UpdateWebhookSubscriptionParams = NonNullable<paths['/webhook_subscriptions/{id}']['patch']['requestBody']>['content']['application/json'];
+export type AddWebhookSecret = SingleData<Schemas['AddWebhookSecretResponse']>;
+export type WebhookDelivery = SingleData<Schemas['GetWebhookDeliveryResponse']>;
+export type WebhookDeliveryListItem = ListData<Schemas['ListWebhookDeliveriesResponse']>;
+export type ListWebhookDeliveriesParams = NonNullable<paths['/webhook_deliveries']['get']['parameters']['query']>;
+export type BulkReplayParams = NonNullable<paths['/webhook_deliveries/bulk_replay']['post']['requestBody']>['content']['application/json'];
+export type BulkReplayResult = SingleData<Schemas['BulkReplayResponse']>;
+export {};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAA;AAE9D,MAAM,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,CAAA;AAG3C,KAAK,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,CAAC,GAAG,KAAK,CAAA;AAC5D,KAAK,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS;IAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;CAAE,GAAG,CAAC,GAAG,KAAK,CAAA;AAGjE,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAA;AAGzD,MAAM,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAA;AAC/D,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAA;AACvE,MAAM,MAAM,iBAAiB,GAAG,WAAW,CACzC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CAC1C,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAA;AAChC,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;AAC9F,MAAM,MAAM,oBAAoB,GAAG;IAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAA;AAGpF,MAAM,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAA;AACjE,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAA;AACzE,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;AAChG,MAAM,MAAM,sBAAsB,GAAG,WAAW,CAC9C,KAAK,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CACzD,CAAA;AAGD,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAA;AACzE,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC,CAAA;AACjF,MAAM,MAAM,uBAAuB,GAAG,WAAW,CAC/C,KAAK,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CACtD,CAAA;AACD,MAAM,MAAM,wBAAwB,GAAG,WAAW,CAChD,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CACrD,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAA;AAChC,MAAM,MAAM,6BAA6B,GAAG,WAAW,CACrD,KAAK,CAAC,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CAC3D,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAA;AAGhC,MAAM,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAA;AAC/D,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAA;AACvE,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;AAC9F,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAC3C,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CAC1C,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAA;AAChC,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAC3C,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAChD,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAA;AAChC,MAAM,MAAM,wBAAwB,GAAG,WAAW,CAChD,KAAK,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CACtD,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAA;AAChC,MAAM,MAAM,uBAAuB,GAAG,WAAW,CAC/C,KAAK,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CACrD,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAA;AAGhC,MAAM,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAA;AAC3D,MAAM,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAA;AACnE,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;AAC1F,MAAM,MAAM,iBAAiB,GAAG,WAAW,CACzC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CACxC,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAA;AAChC,MAAM,MAAM,iBAAiB,GAAG,WAAW,CACzC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAC9C,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAA;AAGhC,MAAM,MAAM,mBAAmB,GAAG,UAAU,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,CAAA;AACvF,MAAM,MAAM,2BAA2B,GAAG,QAAQ,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC,CAAA;AAC/F,MAAM,MAAM,+BAA+B,GAAG,WAAW,CACvD,KAAK,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CACvD,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAA;AAChC,MAAM,MAAM,+BAA+B,GAAG,WAAW,CACvD,KAAK,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAC7D,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAA;AAChC,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAA;AAG9E,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,CAAA;AAC/E,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC,CAAA;AACxF,MAAM,MAAM,2BAA2B,GAAG,WAAW,CACnD,KAAK,CAAC,qBAAqB,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAC3D,CAAA;AACD,MAAM,MAAM,gBAAgB,GAAG,WAAW,CACxC,KAAK,CAAC,iCAAiC,CAAC,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CAChE,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,CAAA;AAChC,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAA"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/webhooks.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Webhook HMAC verification + typed event payloads.
+ *
+ * The Kirim API signs outbound webhook deliveries with HMAC-SHA256 over the
+ * raw request body, encoded as `sha256=<hex>` in the `X-Kirim-Signature`
+ * header. This module exposes a constant-time verifier using Web Crypto
+ * (`crypto.subtle`) so it runs on Node 18+, Bun, Deno, and edge runtimes.
+ *
+ * The signing scheme mirrors `apps/api/src/lib/webhook-security.ts`.
+ *
+ * Usage:
+ *   import { verifyWebhookSignature } from '@kirimdev/sdk/webhooks'
+ *
+ *   const ok = await verifyWebhookSignature(
+ *     await req.text(),
+ *     req.headers.get('x-kirim-signature') ?? '',
+ *     process.env.KIRIM_WEBHOOK_SECRET!,
+ *   )
+ *   if (!ok) return new Response('bad signature', { status: 401 })
+ */
+/**
+ * Verify a Kirim webhook signature.
+ *
+ * MUST be called with the raw request body (the same bytes Kirim signed —
+ * re-serializing JSON will break the signature). Returns `false` (never
+ * throws) when the header is absent / malformed / mismatched. The caller
+ * MUST reject the request when this returns `false` (fail-closed).
+ */
+export declare function verifyWebhookSignature(body: string, signatureHeader: string | null | undefined, secret: string): Promise<boolean>;
+/**
+ * Discriminated union of all event types Kirim can deliver to a webhook
+ * subscription. The `type` literal is the discriminator.
+ *
+ * The list of events here MUST stay in sync with what the API actually
+ * emits (see the worker's webhook dispatch + `apps/api` event constants).
+ * Treat unknown event types as forward-compatible: callers should keep a
+ * `default` branch and ignore unknown payloads rather than throwing.
+ */
+export type KirimWebhookEvent = MessageCreatedEvent | MessageStatusUpdatedEvent | ConversationCreatedEvent | ConversationUpdatedEvent | ContactCreatedEvent | ContactUpdatedEvent;
+interface BaseEvent {
+    id: string;
+    created_at: string;
+    /** Subscription id that triggered the delivery. */
+    subscription_id: string;
+}
+export interface MessageCreatedEvent extends BaseEvent {
+    type: 'message.created';
+    data: {
+        id: string;
+        object: 'message';
+        conversation_id?: string;
+        to: string;
+        type: string;
+        status: string;
+        created_at: string;
+    };
+}
+export interface MessageStatusUpdatedEvent extends BaseEvent {
+    type: 'message.status_updated';
+    data: {
+        id: string;
+        object: 'message';
+        status: 'sent' | 'delivered' | 'read' | 'failed' | 'queued' | 'pending';
+        error?: {
+            code: string;
+            message: string;
+            provider_code: number | null;
+        };
+    };
+}
+export interface ConversationCreatedEvent extends BaseEvent {
+    type: 'conversation.created';
+    data: {
+        id: string;
+        object: 'conversation';
+    };
+}
+export interface ConversationUpdatedEvent extends BaseEvent {
+    type: 'conversation.updated';
+    data: {
+        id: string;
+        object: 'conversation';
+    };
+}
+export interface ContactCreatedEvent extends BaseEvent {
+    type: 'contact.created';
+    data: {
+        id: string;
+        object: 'contact';
+    };
+}
+export interface ContactUpdatedEvent extends BaseEvent {
+    type: 'contact.updated';
+    data: {
+        id: string;
+        object: 'contact';
+    };
+}
+export {};
+//# sourceMappingURL=webhooks.d.ts.map

package/dist/webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC1C,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAYlB;AAqCD;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GACzB,mBAAmB,GACnB,yBAAyB,GACzB,wBAAwB,GACxB,wBAAwB,GACxB,mBAAmB,GACnB,mBAAmB,CAAA;AAEvB,UAAU,SAAS;IACjB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,mDAAmD;IACnD,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,mBAAoB,SAAQ,SAAS;IACpD,IAAI,EAAE,iBAAiB,CAAA;IACvB,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,EAAE,SAAS,CAAA;QACjB,eAAe,CAAC,EAAE,MAAM,CAAA;QACxB,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;CACF;AAED,MAAM,WAAW,yBAA0B,SAAQ,SAAS;IAC1D,IAAI,EAAE,wBAAwB,CAAA;IAC9B,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,EAAE,SAAS,CAAA;QACjB,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAA;QACvE,KAAK,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAC;YAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAA;KACxE,CAAA;CACF;AAED,MAAM,WAAW,wBAAyB,SAAQ,SAAS;IACzD,IAAI,EAAE,sBAAsB,CAAA;IAC5B,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,cAAc,CAAA;KAAE,CAAA;CAC7C;AAED,MAAM,WAAW,wBAAyB,SAAQ,SAAS;IACzD,IAAI,EAAE,sBAAsB,CAAA;IAC5B,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,cAAc,CAAA;KAAE,CAAA;CAC7C;AAED,MAAM,WAAW,mBAAoB,SAAQ,SAAS;IACpD,IAAI,EAAE,iBAAiB,CAAA;IACvB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,CAAA;KAAE,CAAA;CACxC;AAED,MAAM,WAAW,mBAAoB,SAAQ,SAAS;IACpD,IAAI,EAAE,iBAAiB,CAAA;IACvB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,CAAA;KAAE,CAAA;CACxC"}

package/dist/webhooks.js

@@ -0,0 +1,65 @@
+/**
+ * Webhook HMAC verification + typed event payloads.
+ *
+ * The Kirim API signs outbound webhook deliveries with HMAC-SHA256 over the
+ * raw request body, encoded as `sha256=<hex>` in the `X-Kirim-Signature`
+ * header. This module exposes a constant-time verifier using Web Crypto
+ * (`crypto.subtle`) so it runs on Node 18+, Bun, Deno, and edge runtimes.
+ *
+ * The signing scheme mirrors `apps/api/src/lib/webhook-security.ts`.
+ *
+ * Usage:
+ *   import { verifyWebhookSignature } from '@kirimdev/sdk/webhooks'
+ *
+ *   const ok = await verifyWebhookSignature(
+ *     await req.text(),
+ *     req.headers.get('x-kirim-signature') ?? '',
+ *     process.env.KIRIM_WEBHOOK_SECRET!,
+ *   )
+ *   if (!ok) return new Response('bad signature', { status: 401 })
+ */
+/**
+ * Verify a Kirim webhook signature.
+ *
+ * MUST be called with the raw request body (the same bytes Kirim signed —
+ * re-serializing JSON will break the signature). Returns `false` (never
+ * throws) when the header is absent / malformed / mismatched. The caller
+ * MUST reject the request when this returns `false` (fail-closed).
+ */
+export async function verifyWebhookSignature(body, signatureHeader, secret) {
+    if (!signatureHeader || !secret)
+        return false;
+    const provided = signatureHeader.startsWith('sha256=')
+        ? signatureHeader.slice('sha256='.length)
+        : signatureHeader;
+    const expected = await hmacSha256Hex(secret, body);
+    // Length comparison short-circuits *before* the timing-safe step. That's
+    // safe because byte length is not a secret (HMAC-SHA256 hex is always 64
+    // chars); leaking it gives the attacker nothing.
+    if (expected.length !== provided.length)
+        return false;
+    return timingSafeEqualHex(expected, provided);
+}
+async function hmacSha256Hex(secret, body) {
+    const enc = new TextEncoder();
+    const key = await crypto.subtle.importKey('raw', enc.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const buf = await crypto.subtle.sign('HMAC', key, enc.encode(body));
+    return bufferToHex(new Uint8Array(buf));
+}
+function bufferToHex(buf) {
+    let out = '';
+    for (let i = 0; i < buf.length; i++) {
+        const byte = buf[i] ?? 0;
+        out += byte.toString(16).padStart(2, '0');
+    }
+    return out;
+}
+/** Constant-time string comparison. Inputs MUST be equal length. */
+function timingSafeEqualHex(a, b) {
+    let diff = 0;
+    for (let i = 0; i < a.length; i++) {
+        diff |= (a.charCodeAt(i) ^ b.charCodeAt(i));
+    }
+    return diff === 0;
+}
+//# sourceMappingURL=webhooks.js.map

package/dist/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAY,EACZ,eAA0C,EAC1C,MAAc;IAEd,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAC7C,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC;QACpD,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;QACzC,CAAC,CAAC,eAAe,CAAA;IAEnB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAClD,yEAAyE;IACzE,yEAAyE;IACzE,iDAAiD;IACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACrD,OAAO,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;AAC/C,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,IAAY;IACvD,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAA;IAC7B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAClB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;IACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACnE,OAAO,WAAW,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,GAAe;IAClC,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACxB,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC3C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,oEAAoE;AACpE,SAAS,kBAAkB,CAAC,CAAS,EAAE,CAAS;IAC9C,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAA;AACnB,CAAC"}