@minipim/sdk 0.1.0 → 0.2.0

package/dist/paginate.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Generic pagination helper. Every MiniPim list endpoint returns
+ * `{ data, limit, offset, hasMore }`; this walks the pages so consumers
+ * don't hand-roll the `hasMore` loop. Yields one item at a time.
+ *
+ * Typed loosely on purpose — openapi-fetch's per-path generics don't
+ * compose into a single reusable signature without a lot of conditional-
+ * type machinery, and the envelope shape is uniform across list endpoints.
+ * The item type is yours to specify via the generic.
+ */
+import type { MinipimClient } from './client.js';
+export interface PaginateOptions {
+    /** Query params (filters, sort, withTotal, etc). `limit`/`offset` are managed for you. */
+    query?: Record<string, unknown>;
+    /** Page size. Default 200 (the API max). */
+    pageSize?: number;
+}
+/**
+ * Async-iterate every item across all pages of a MiniPim list endpoint.
+ *
+ * @example
+ * ```ts
+ * import { paginate } from '@minipim/sdk';
+ * for await (const product of paginate<Product>(pim, '/v1/products', {
+ *   query: { status: 'active' },
+ * })) {
+ *   await ingest(product);
+ * }
+ * ```
+ */
+export declare function paginate<T = unknown>(client: MinipimClient, path: string, opts?: PaginateOptions): AsyncGenerator<T, void, unknown>;
+/** Collect every page into an array. Convenience around {@link paginate}. */
+export declare function collectAll<T = unknown>(client: MinipimClient, path: string, opts?: PaginateOptions): Promise<T[]>;
+//# sourceMappingURL=paginate.d.ts.map

package/dist/paginate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paginate.d.ts","sourceRoot":"","sources":["../src/paginate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAUjD,MAAM,WAAW,eAAe;IAC9B,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAuB,QAAQ,CAAC,CAAC,GAAG,OAAO,EACzC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,eAAoB,GACzB,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAwBlC;AAED,6EAA6E;AAC7E,wBAAsB,UAAU,CAAC,CAAC,GAAG,OAAO,EAC1C,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,CAAC,EAAE,CAAC,CAId"}

package/dist/paginate.js

@@ -0,0 +1,43 @@
+/**
+ * Async-iterate every item across all pages of a MiniPim list endpoint.
+ *
+ * @example
+ * ```ts
+ * import { paginate } from '@minipim/sdk';
+ * for await (const product of paginate<Product>(pim, '/v1/products', {
+ *   query: { status: 'active' },
+ * })) {
+ *   await ingest(product);
+ * }
+ * ```
+ */
+export async function* paginate(client, path, opts = {}) {
+    const pageSize = opts.pageSize ?? 200;
+    let offset = 0;
+    for (;;) {
+        // openapi-fetch is typed per-path; this helper is path-generic, so we
+        // call through an untyped view. Callers get their item type via <T>.
+        const get = client.GET;
+        const { data, error, response } = await get(path, {
+            params: { query: { ...(opts.query ?? {}), limit: pageSize, offset } },
+        });
+        if (error || !data) {
+            throw new Error(`paginate ${path} failed at offset ${offset} (HTTP ${response?.status})`);
+        }
+        for (const item of data.data)
+            yield item;
+        // Prefer the server's hasMore; fall back to a short-page check.
+        const more = data.hasMore ?? data.data.length === pageSize;
+        if (!more || data.data.length === 0)
+            return;
+        offset += pageSize;
+    }
+}
+/** Collect every page into an array. Convenience around {@link paginate}. */
+export async function collectAll(client, path, opts = {}) {
+    const out = [];
+    for await (const item of paginate(client, path, opts))
+        out.push(item);
+    return out;
+}
+//# sourceMappingURL=paginate.js.map

package/dist/paginate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paginate.js","sourceRoot":"","sources":["../src/paginate.ts"],"names":[],"mappings":"AA2BA;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,QAAQ,CAC7B,MAAqB,EACrB,IAAY,EACZ,OAAwB,EAAE;IAE1B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC;IACtC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,SAAS,CAAC;QACR,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,GAAG,GAAG,MAAM,CAAC,GAG0D,CAAC;QAC9E,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE;YAChD,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;SACtE,CAAC,CAAC;QACH,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,qBAAqB,MAAM,UAAU,QAAQ,EAAE,MAAM,GAAG,CACzE,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,CAAC;QACzC,gEAAgE;QAChE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC;QAC3D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC5C,MAAM,IAAI,QAAQ,CAAC;IACrB,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAqB,EACrB,IAAY,EACZ,OAAwB,EAAE;IAE1B,MAAM,GAAG,GAAQ,EAAE,CAAC;IACpB,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,QAAQ,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/webhook-edge.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Edge / browser webhook signature verification, via WebCrypto. Use in
+ * Cloudflare Workers, Vercel Edge Runtime, Deno, or browsers. Async because
+ * `crypto.subtle` is async. For Node use `@minipim/sdk/webhook` (synchronous).
+ *
+ * This entry point imports no `node:` modules, so it's safe in any Edge
+ * bundle.
+ */
+import { type VerifyWebhookOptions } from './webhook-shared.js';
+export type { VerifyWebhookOptions } from './webhook-shared.js';
+/**
+ * Verify a MiniPim webhook signature in an Edge/WebCrypto runtime. Same
+ * contract as the Node `verifyMinipimWebhook` but async.
+ *
+ * @example
+ * ```ts
+ * import { verifyMinipimWebhookEdge } from '@minipim/sdk/webhook-edge';
+ *
+ * const ok = await verifyMinipimWebhookEdge({ rawBody, signature, secret });
+ * if (!ok) return new Response('invalid signature', { status: 401 });
+ * ```
+ */
+export declare function verifyMinipimWebhookEdge(opts: VerifyWebhookOptions): Promise<boolean>;
+//# sourceMappingURL=webhook-edge.d.ts.map

package/dist/webhook-edge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-edge.d.ts","sourceRoot":"","sources":["../src/webhook-edge.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE;;;;;;;;;;;GAWG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,OAAO,CAAC,CAgBlB"}

package/dist/webhook-edge.js

@@ -0,0 +1,32 @@
+/**
+ * Edge / browser webhook signature verification, via WebCrypto. Use in
+ * Cloudflare Workers, Vercel Edge Runtime, Deno, or browsers. Async because
+ * `crypto.subtle` is async. For Node use `@minipim/sdk/webhook` (synchronous).
+ *
+ * This entry point imports no `node:` modules, so it's safe in any Edge
+ * bundle.
+ */
+import { decodeHex, stripPrefix, timingSafeEqualBytes, } from './webhook-shared.js';
+/**
+ * Verify a MiniPim webhook signature in an Edge/WebCrypto runtime. Same
+ * contract as the Node `verifyMinipimWebhook` but async.
+ *
+ * @example
+ * ```ts
+ * import { verifyMinipimWebhookEdge } from '@minipim/sdk/webhook-edge';
+ *
+ * const ok = await verifyMinipimWebhookEdge({ rawBody, signature, secret });
+ * if (!ok) return new Response('invalid signature', { status: 401 });
+ * ```
+ */
+export async function verifyMinipimWebhookEdge(opts) {
+    const enc = new TextEncoder();
+    const keyData = enc.encode(opts.secret);
+    const bodyData = typeof opts.rawBody === 'string' ? enc.encode(opts.rawBody) : new Uint8Array(opts.rawBody);
+    const key = await crypto.subtle.importKey('raw', keyData, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const sigBuf = await crypto.subtle.sign('HMAC', key, bodyData);
+    const expected = new Uint8Array(sigBuf);
+    const got = decodeHex(stripPrefix(opts.signature));
+    return timingSafeEqualBytes(expected, got);
+}
+//# sourceMappingURL=webhook-edge.js.map

package/dist/webhook-edge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-edge.js","sourceRoot":"","sources":["../src/webhook-edge.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,SAAS,EACT,WAAW,EACX,oBAAoB,GAErB,MAAM,qBAAqB,CAAC;AAI7B;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAA0B;IAE1B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,QAAQ,GACZ,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7F,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,EACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACnD,OAAO,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC"}

package/dist/webhook-shared.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Pure helpers shared by the Node and Edge webhook verifiers. Deliberately
+ * free of `node:crypto` and WebCrypto so importing this file drags neither
+ * runtime's crypto into a bundle.
+ */
+export interface VerifyWebhookOptions {
+    /**
+     * The **raw** request body — bytes or a string. **Not** the parsed JSON.
+     * Re-stringifying the parsed body reorders keys / changes whitespace and
+     * the HMAC will not match.
+     *
+     * Next.js route handler: `const raw = await req.text()`.
+     * Express: `express.raw({ type: 'application/json' })`, then `req.body`.
+     */
+    rawBody: string | Uint8Array;
+    /**
+     * Value of the `X-MiniPim-Signature-256` header — `sha256=<hex>`. Pass it
+     * verbatim; the verifier strips the prefix.
+     */
+    signature: string;
+    /** The secret configured on the headless connector. */
+    secret: string;
+}
+export declare function decodeHex(s: string): Uint8Array;
+export declare function stripPrefix(sig: string): string;
+/** Constant-time byte compare — used by the Edge verifier (Node uses crypto.timingSafeEqual). */
+export declare function timingSafeEqualBytes(a: Uint8Array, b: Uint8Array): boolean;
+//# sourceMappingURL=webhook-shared.d.ts.map

package/dist/webhook-shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-shared.d.ts","sourceRoot":"","sources":["../src/webhook-shared.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,oBAAoB;IACnC;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAS/C;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,iGAAiG;AACjG,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAK1E"}

package/dist/webhook-shared.js

@@ -0,0 +1,30 @@
+/**
+ * Pure helpers shared by the Node and Edge webhook verifiers. Deliberately
+ * free of `node:crypto` and WebCrypto so importing this file drags neither
+ * runtime's crypto into a bundle.
+ */
+export function decodeHex(s) {
+    if (s.length % 2 !== 0)
+        return new Uint8Array(0);
+    const out = new Uint8Array(s.length / 2);
+    for (let i = 0; i < out.length; i++) {
+        const byte = parseInt(s.slice(i * 2, i * 2 + 2), 16);
+        if (Number.isNaN(byte))
+            return new Uint8Array(0);
+        out[i] = byte;
+    }
+    return out;
+}
+export function stripPrefix(sig) {
+    return sig.startsWith('sha256=') ? sig.slice(7) : sig;
+}
+/** Constant-time byte compare — used by the Edge verifier (Node uses crypto.timingSafeEqual). */
+export function timingSafeEqualBytes(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= (a[i] ?? 0) ^ (b[i] ?? 0);
+    return diff === 0;
+}
+//# sourceMappingURL=webhook-shared.js.map

package/dist/webhook-shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-shared.js","sourceRoot":"","sources":["../src/webhook-shared.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAqBH,MAAM,UAAU,SAAS,CAAC,CAAS;IACjC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;QACjD,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACxD,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,oBAAoB,CAAC,CAAa,EAAE,CAAa;IAC/D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}

package/dist/webhook.d.ts

@@ -1,44 +1,14 @@
+import { type VerifyWebhookOptions } from './webhook-shared.js';
+export type { VerifyWebhookOptions } from './webhook-shared.js';
 /**
- * Webhook signature verification helpers.
- *
- * MiniPim's headless connector POSTs events to a configured URL with an
- * `X-MiniPim-Signature-256` header containing `sha256=<hex>` — the HMAC of
- * the raw request body keyed by the connector's secret. Verifying it
- * correctly is the #1 thing webhook consumers get wrong, so the SDK ships a
- * reference implementation.
- *
- * Two variants exported:
- *  - `verifyMinipimWebhook`     — sync, Node `crypto`. Use in any Node
- *                                 server (Express, Fastify, Next App Router
- *                                 route handlers).
- *  - `verifyMinipimWebhookEdge` — async, WebCrypto subtle. For Cloudflare
- *                                 Workers, Vercel Edge, Deno, browsers.
- */
-export interface VerifyWebhookOptions {
-    /**
-     * The **raw** request body — bytes or a string. **Not** the parsed JSON.
-     * If you re-stringify the parsed body, whitespace and key ordering will
-     * differ from the original, and the HMAC will not match.
-     *
-     * In Next.js route handlers: `const rawBody = await req.text()`.
-     * In Express: register `express.raw({ type: 'application/json' })` and
-     * read `req.body` (it'll be a Buffer).
-     */
-    rawBody: string | Uint8Array;
-    /**
-     * Value of the `X-MiniPim-Signature-256` header. Format:
-     * `sha256=<hex>` — pass it verbatim. The function strips the prefix.
-     */
-    signature: string;
-    /** The secret you configured on the headless connector. */
-    secret: string;
-}
-/**
- * Verify a MiniPim webhook signature in a Node environment.
+ * Verify a MiniPim webhook signature in Node. Returns `true` only when the
+ * signature is valid; returns `false` on any problem (wrong signature,
+ * malformed header, length mismatch). Constant-time comparison.
  *
  * @example
  * ```ts
- * // Next.js App Router route handler
+ * import { verifyMinipimWebhook } from '@minipim/sdk/webhook';
+ *
  * export async function POST(req: Request) {
  *   const raw = await req.text();
  *   const sig = req.headers.get('x-minipim-signature-256') ?? '';
@@ -46,21 +16,10 @@ export interface VerifyWebhookOptions {
  *     return new Response('invalid signature', { status: 401 });
  *   }
  *   const event = JSON.parse(raw);
- *   // ... handle event
+ *   // ...handle event, respond 2xx
  *   return Response.json({ ok: true });
  * }
  * ```
- *
- * Returns `false` on any verification problem (wrong signature, malformed
- * header, length mismatch). Constant-time comparison — safe against timing
- * attacks. Throws only if `node:crypto` is unavailable; if you're on Edge,
- * use `verifyMinipimWebhookEdge` instead.
- */
-export declare function verifyMinipimWebhook(opts: VerifyWebhookOptions): Promise<boolean>;
-/**
- * Edge / browser variant using WebCrypto. Same shape as
- * {@link verifyMinipimWebhook}; use this in Cloudflare Workers, Vercel
- * Edge Runtime, Deno, or browsers.
  */
-export declare function verifyMinipimWebhookEdge(opts: VerifyWebhookOptions): Promise<boolean>;
+export declare function verifyMinipimWebhook(opts: VerifyWebhookOptions): boolean;
 //# sourceMappingURL=webhook.d.ts.map

package/dist/webhook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../src/webhook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;OAQG;IACH,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;CAChB;AAwBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,OAAO,CAAC,CAuBlB"}
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../src/webhook.ts"],"names":[],"mappings":"AAUA,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAKxE"}

package/dist/webhook.js

@@ -1,48 +1,23 @@
 /**
- * Webhook signature verification helpers.
- *
- * MiniPim's headless connector POSTs events to a configured URL with an
- * `X-MiniPim-Signature-256` header containing `sha256=<hex>` — the HMAC of
- * the raw request body keyed by the connector's secret. Verifying it
- * correctly is the #1 thing webhook consumers get wrong, so the SDK ships a
- * reference implementation.
- *
- * Two variants exported:
- *  - `verifyMinipimWebhook`     — sync, Node `crypto`. Use in any Node
- *                                 server (Express, Fastify, Next App Router
- *                                 route handlers).
- *  - `verifyMinipimWebhookEdge` — async, WebCrypto subtle. For Cloudflare
- *                                 Workers, Vercel Edge, Deno, browsers.
+ * Node webhook signature verification. **Synchronous** — Node's HMAC is
+ * synchronous, so there's no reason to return a Promise (and a Promise is
+ * always truthy, which made the obvious `if (!verify(...))` guard silently
+ * accept every request). For Edge/WebCrypto runtimes use
+ * `@minipim/sdk/webhook-edge` instead — this module imports `node:crypto`
+ * at the top, which Edge bundlers reject, so it's kept on its own entry
+ * point and never pulled into the client or the Edge verifier.
  */
-function decodeHex(s) {
-    if (s.length % 2 !== 0)
-        return new Uint8Array(0);
-    const out = new Uint8Array(s.length / 2);
-    for (let i = 0; i < out.length; i++) {
-        const byte = parseInt(s.slice(i * 2, i * 2 + 2), 16);
-        if (Number.isNaN(byte))
-            return new Uint8Array(0);
-        out[i] = byte;
-    }
-    return out;
-}
-function stripPrefix(sig) {
-    return sig.startsWith('sha256=') ? sig.slice(7) : sig;
-}
-function timingSafeEqualBytes(a, b) {
-    if (a.length !== b.length)
-        return false;
-    let diff = 0;
-    for (let i = 0; i < a.length; i++)
-        diff |= (a[i] ?? 0) ^ (b[i] ?? 0);
-    return diff === 0;
-}
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { decodeHex, stripPrefix, } from './webhook-shared.js';
 /**
- * Verify a MiniPim webhook signature in a Node environment.
+ * Verify a MiniPim webhook signature in Node. Returns `true` only when the
+ * signature is valid; returns `false` on any problem (wrong signature,
+ * malformed header, length mismatch). Constant-time comparison.
  *
  * @example
  * ```ts
- * // Next.js App Router route handler
+ * import { verifyMinipimWebhook } from '@minipim/sdk/webhook';
+ *
  * export async function POST(req: Request) {
  *   const raw = await req.text();
  *   const sig = req.headers.get('x-minipim-signature-256') ?? '';
@@ -50,45 +25,16 @@ function timingSafeEqualBytes(a, b) {
  *     return new Response('invalid signature', { status: 401 });
  *   }
  *   const event = JSON.parse(raw);
- *   // ... handle event
+ *   // ...handle event, respond 2xx
  *   return Response.json({ ok: true });
  * }
  * ```
- *
- * Returns `false` on any verification problem (wrong signature, malformed
- * header, length mismatch). Constant-time comparison — safe against timing
- * attacks. Throws only if `node:crypto` is unavailable; if you're on Edge,
- * use `verifyMinipimWebhookEdge` instead.
  */
-export async function verifyMinipimWebhook(opts) {
-    // Lazy-import so the runtime exception is only thrown when actually
-    // calling this on Edge. The async signature matches the Edge variant
-    // so consumers don't have to branch.
-    const { createHmac } = await import('node:crypto');
+export function verifyMinipimWebhook(opts) {
     const expected = createHmac('sha256', opts.secret).update(opts.rawBody).digest();
     const got = decodeHex(stripPrefix(opts.signature));
-    return timingSafeEqualBytes(new Uint8Array(expected), got);
-}
-/**
- * Edge / browser variant using WebCrypto. Same shape as
- * {@link verifyMinipimWebhook}; use this in Cloudflare Workers, Vercel
- * Edge Runtime, Deno, or browsers.
- */
-export async function verifyMinipimWebhookEdge(opts) {
-    const enc = new TextEncoder();
-    // Normalize both inputs to fresh Uint8Arrays — `new Uint8Array(view)`
-    // creates a new ArrayBuffer-backed copy, which is what WebCrypto's
-    // `subtle.sign` requires under TS 5.7's tightened typings. Without the
-    // re-wrap, a Buffer passed in from Node code can be `Uint8Array<ArrayBufferLike>`
-    // and trips the type checker (runtime is fine either way).
-    const keyData = enc.encode(opts.secret);
-    const bodyData = typeof opts.rawBody === 'string'
-        ? enc.encode(opts.rawBody)
-        : new Uint8Array(opts.rawBody);
-    const key = await crypto.subtle.importKey('raw', keyData, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
-    const sigBuf = await crypto.subtle.sign('HMAC', key, bodyData);
-    const expected = new Uint8Array(sigBuf);
-    const got = decodeHex(stripPrefix(opts.signature));
-    return timingSafeEqualBytes(expected, got);
+    if (got.length !== expected.length)
+        return false;
+    return timingSafeEqual(expected, got);
 }
 //# sourceMappingURL=webhook.js.map

package/dist/webhook.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook.js","sourceRoot":"","sources":["../src/webhook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAsBH,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;QACjD,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACxD,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAa,EAAE,CAAa;IACxD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAA0B;IAE1B,oEAAoE;IACpE,qEAAqE;IACrE,qCAAqC;IACrC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IACjF,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACnD,OAAO,oBAAoB,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAA0B;IAE1B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;IAC9B,sEAAsE;IACtE,mEAAmE;IACnE,uEAAuE;IACvE,kFAAkF;IAClF,2DAA2D;IAC3D,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,QAAQ,GACZ,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAC9B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAC1B,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,EACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACnD,OAAO,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"webhook.js","sourceRoot":"","sources":["../src/webhook.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EACL,SAAS,EACT,WAAW,GAEZ,MAAM,qBAAqB,CAAC;AAI7B;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAA0B;IAC7D,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IACjF,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACnD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACjD,OAAO,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@minipim/sdk",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Typed TypeScript client for the MiniPim API.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/Epic-Design-Labs/minipim",
@@ -22,6 +22,14 @@
       "import": "./dist/webhook.js",
       "types": "./dist/webhook.d.ts"
     },
+    "./webhook-edge": {
+      "import": "./dist/webhook-edge.js",
+      "types": "./dist/webhook-edge.d.ts"
+    },
+    "./attributes": {
+      "import": "./dist/attributes.js",
+      "types": "./dist/attributes.d.ts"
+    },
     "./openapi": {
       "import": "./dist/openapi.js",
       "types": "./dist/openapi.d.ts"
@@ -40,11 +48,6 @@
     "openapi",
     "typescript"
   ],
-  "scripts": {
-    "build": "tsc -b",
-    "typecheck": "tsc --noEmit",
-    "gen": "openapi-typescript https://api.minipim.com/docs/json -o src/openapi.ts"
-  },
   "dependencies": {
     "openapi-fetch": "^0.13.0"
   },
@@ -54,5 +57,10 @@
   },
   "publishConfig": {
     "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "typecheck": "tsc --noEmit",
+    "gen": "openapi-typescript https://api.minipim.com/docs/json -o src/openapi.ts"
   }
-}
+}