@minipim/sdk 0.1.0 → 0.3.0

package/dist/webhook.js

@@ -1,94 +1,28 @@
-/**
- * Webhook signature verification helpers.
- *
- * MiniPim's headless connector POSTs events to a configured URL with an
- * `X-MiniPim-Signature-256` header containing `sha256=<hex>` — the HMAC of
- * the raw request body keyed by the connector's secret. Verifying it
- * correctly is the #1 thing webhook consumers get wrong, so the SDK ships a
- * reference implementation.
- *
- * Two variants exported:
- *  - `verifyMinipimWebhook`     — sync, Node `crypto`. Use in any Node
- *                                 server (Express, Fastify, Next App Router
- *                                 route handlers).
- *  - `verifyMinipimWebhookEdge` — async, WebCrypto subtle. For Cloudflare
- *                                 Workers, Vercel Edge, Deno, browsers.
- */
+// src/webhook.ts
+import { createHmac, timingSafeEqual } from "crypto";
+
+// src/webhook-shared.ts
 function decodeHex(s) {
-    if (s.length % 2 !== 0)
-        return new Uint8Array(0);
-    const out = new Uint8Array(s.length / 2);
-    for (let i = 0; i < out.length; i++) {
-        const byte = parseInt(s.slice(i * 2, i * 2 + 2), 16);
-        if (Number.isNaN(byte))
-            return new Uint8Array(0);
-        out[i] = byte;
-    }
-    return out;
+  if (s.length % 2 !== 0) return new Uint8Array(0);
+  const out = new Uint8Array(s.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    const byte = parseInt(s.slice(i * 2, i * 2 + 2), 16);
+    if (Number.isNaN(byte)) return new Uint8Array(0);
+    out[i] = byte;
+  }
+  return out;
 }
 function stripPrefix(sig) {
-    return sig.startsWith('sha256=') ? sig.slice(7) : sig;
+  return sig.startsWith("sha256=") ? sig.slice(7) : sig;
 }
-function timingSafeEqualBytes(a, b) {
-    if (a.length !== b.length)
-        return false;
-    let diff = 0;
-    for (let i = 0; i < a.length; i++)
-        diff |= (a[i] ?? 0) ^ (b[i] ?? 0);
-    return diff === 0;
+
+// src/webhook.ts
+function verifyMinipimWebhook(opts) {
+  const expected = createHmac("sha256", opts.secret).update(opts.rawBody).digest();
+  const got = decodeHex(stripPrefix(opts.signature));
+  if (got.length !== expected.length) return false;
+  return timingSafeEqual(expected, got);
 }
-/**
- * Verify a MiniPim webhook signature in a Node environment.
- *
- * @example
- * ```ts
- * // Next.js App Router route handler
- * export async function POST(req: Request) {
- *   const raw = await req.text();
- *   const sig = req.headers.get('x-minipim-signature-256') ?? '';
- *   if (!verifyMinipimWebhook({ rawBody: raw, signature: sig, secret })) {
- *     return new Response('invalid signature', { status: 401 });
- *   }
- *   const event = JSON.parse(raw);
- *   // ... handle event
- *   return Response.json({ ok: true });
- * }
- * ```
- *
- * Returns `false` on any verification problem (wrong signature, malformed
- * header, length mismatch). Constant-time comparison — safe against timing
- * attacks. Throws only if `node:crypto` is unavailable; if you're on Edge,
- * use `verifyMinipimWebhookEdge` instead.
- */
-export async function verifyMinipimWebhook(opts) {
-    // Lazy-import so the runtime exception is only thrown when actually
-    // calling this on Edge. The async signature matches the Edge variant
-    // so consumers don't have to branch.
-    const { createHmac } = await import('node:crypto');
-    const expected = createHmac('sha256', opts.secret).update(opts.rawBody).digest();
-    const got = decodeHex(stripPrefix(opts.signature));
-    return timingSafeEqualBytes(new Uint8Array(expected), got);
-}
-/**
- * Edge / browser variant using WebCrypto. Same shape as
- * {@link verifyMinipimWebhook}; use this in Cloudflare Workers, Vercel
- * Edge Runtime, Deno, or browsers.
- */
-export async function verifyMinipimWebhookEdge(opts) {
-    const enc = new TextEncoder();
-    // Normalize both inputs to fresh Uint8Arrays — `new Uint8Array(view)`
-    // creates a new ArrayBuffer-backed copy, which is what WebCrypto's
-    // `subtle.sign` requires under TS 5.7's tightened typings. Without the
-    // re-wrap, a Buffer passed in from Node code can be `Uint8Array<ArrayBufferLike>`
-    // and trips the type checker (runtime is fine either way).
-    const keyData = enc.encode(opts.secret);
-    const bodyData = typeof opts.rawBody === 'string'
-        ? enc.encode(opts.rawBody)
-        : new Uint8Array(opts.rawBody);
-    const key = await crypto.subtle.importKey('raw', keyData, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
-    const sigBuf = await crypto.subtle.sign('HMAC', key, bodyData);
-    const expected = new Uint8Array(sigBuf);
-    const got = decodeHex(stripPrefix(opts.signature));
-    return timingSafeEqualBytes(expected, got);
-}
-//# sourceMappingURL=webhook.js.map
+export {
+  verifyMinipimWebhook
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@minipim/sdk",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Typed TypeScript client for the MiniPim API.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/Epic-Design-Labs/minipim",
@@ -11,20 +11,58 @@
   },
   "bugs": "https://github.com/Epic-Design-Labs/minipim/issues",
   "type": "module",
-  "main": "./dist/index.js",
+  "main": "./dist/index.cjs",
   "types": "./dist/index.d.ts",
   "exports": {
     ".": {
-      "import": "./dist/index.js",
-      "types": "./dist/index.d.ts"
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
     },
     "./webhook": {
-      "import": "./dist/webhook.js",
-      "types": "./dist/webhook.d.ts"
+      "import": {
+        "types": "./dist/webhook.d.ts",
+        "default": "./dist/webhook.js"
+      },
+      "require": {
+        "types": "./dist/webhook.d.cts",
+        "default": "./dist/webhook.cjs"
+      }
+    },
+    "./webhook-edge": {
+      "import": {
+        "types": "./dist/webhook-edge.d.ts",
+        "default": "./dist/webhook-edge.js"
+      },
+      "require": {
+        "types": "./dist/webhook-edge.d.cts",
+        "default": "./dist/webhook-edge.cjs"
+      }
+    },
+    "./attributes": {
+      "import": {
+        "types": "./dist/attributes.d.ts",
+        "default": "./dist/attributes.js"
+      },
+      "require": {
+        "types": "./dist/attributes.d.cts",
+        "default": "./dist/attributes.cjs"
+      }
     },
     "./openapi": {
-      "import": "./dist/openapi.js",
-      "types": "./dist/openapi.d.ts"
+      "import": {
+        "types": "./dist/openapi.d.ts",
+        "default": "./dist/openapi.js"
+      },
+      "require": {
+        "types": "./dist/openapi.d.cts",
+        "default": "./dist/openapi.cjs"
+      }
     }
   },
   "files": [
@@ -40,19 +78,21 @@
     "openapi",
     "typescript"
   ],
-  "scripts": {
-    "build": "tsc -b",
-    "typecheck": "tsc --noEmit",
-    "gen": "openapi-typescript https://api.minipim.com/docs/json -o src/openapi.ts"
-  },
   "dependencies": {
     "openapi-fetch": "^0.13.0"
   },
   "devDependencies": {
     "openapi-typescript": "^7.5.0",
+    "tsup": "^8.5.1",
     "typescript": "^5.7.0"
   },
   "publishConfig": {
     "access": "public"
+  },
+  "module": "./dist/index.js",
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "gen": "openapi-typescript https://api.minipim.com/docs/json -o src/openapi.ts"
   }
-}
+}

package/dist/client.d.ts

@@ -1,66 +0,0 @@
-/**
- * Thin wrapper around `openapi-fetch` that pre-binds the tenancy header and
- * (optionally) an API key. Returns the standard openapi-fetch client, so all
- * its features (request interceptors, raw response access, etc.) work as
- * documented at https://openapi-ts.dev/openapi-fetch/.
- */
-import { type Client } from 'openapi-fetch';
-import type { paths } from './openapi.js';
-export interface CreateMinipimClientOptions {
-    /**
-     * Base URL of the MiniPim API, e.g. `https://api.minipim.com`. Required.
-     * Trailing slashes are normalized.
-     */
-    baseUrl: string;
-    /**
-     * Tenant the client speaks for. Required — every authenticated endpoint
-     * needs `x-organization-id`. API keys identify the principal, not the
-     * tenant.
-     */
-    organizationId: string;
-    /**
-     * Bearer API key (e.g. `pim_abc123…`). Issue one in the admin under
-     * /api-keys. If you're running in dev with `PIM_AUTH=header`, omit this
-     * and set `userId` instead.
-     */
-    apiKey?: string;
-    /**
-     * Dev-only header (`x-pim-user-id`). Only set when the deployment is in
-     * `header` auth mode. Ignored in `jwt` / `clerk` deployments.
-     */
-    userId?: string;
-    /**
-     * Extra headers merged onto every request — useful for tracing IDs,
-     * feature flags, etc. Don't put auth here; use `apiKey`/`userId` so the
-     * names stay consistent.
-     */
-    headers?: Record<string, string>;
-    /**
-     * Override `fetch` — pass a polyfill in Node <18 or a wrapped fetch that
-     * adds timeouts, retries, telemetry. Defaults to the global `fetch`.
-     */
-    fetch?: typeof fetch;
-}
-export type MinipimClient = Client<paths>;
-/**
- * Create a typed MiniPim client.
- *
- * @example
- * ```ts
- * import { createMinipimClient } from '@minipim/sdk';
- *
- * const pim = createMinipimClient({
- *   baseUrl: 'https://api.minipim.com',
- *   organizationId: '00000000-0000-0000-0000-000000000001',
- *   apiKey: process.env.MINIPIM_API_KEY!,
- * });
- *
- * const { data, error } = await pim.GET('/v1/products', {
- *   params: { query: { limit: 50, categoryId: '…' } },
- * });
- * if (error) throw new Error(error.error.message);
- * console.log(data.hasMore, data.data.length);
- * ```
- */
-export declare function createMinipimClient(opts: CreateMinipimClientOptions): MinipimClient;
-//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAqB,EAAE,KAAK,MAAM,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAE1C,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,0BAA0B,GAC/B,aAAa,CAaf"}

package/dist/client.js

@@ -1,43 +0,0 @@
-/**
- * Thin wrapper around `openapi-fetch` that pre-binds the tenancy header and
- * (optionally) an API key. Returns the standard openapi-fetch client, so all
- * its features (request interceptors, raw response access, etc.) work as
- * documented at https://openapi-ts.dev/openapi-fetch/.
- */
-import createClient from 'openapi-fetch';
-/**
- * Create a typed MiniPim client.
- *
- * @example
- * ```ts
- * import { createMinipimClient } from '@minipim/sdk';
- *
- * const pim = createMinipimClient({
- *   baseUrl: 'https://api.minipim.com',
- *   organizationId: '00000000-0000-0000-0000-000000000001',
- *   apiKey: process.env.MINIPIM_API_KEY!,
- * });
- *
- * const { data, error } = await pim.GET('/v1/products', {
- *   params: { query: { limit: 50, categoryId: '…' } },
- * });
- * if (error) throw new Error(error.error.message);
- * console.log(data.hasMore, data.data.length);
- * ```
- */
-export function createMinipimClient(opts) {
-    const headers = {
-        'x-organization-id': opts.organizationId,
-        ...(opts.headers ?? {}),
-    };
-    if (opts.apiKey)
-        headers['Authorization'] = `Bearer ${opts.apiKey}`;
-    if (opts.userId)
-        headers['x-pim-user-id'] = opts.userId;
-    return createClient({
-        baseUrl: opts.baseUrl.replace(/\/$/, ''),
-        fetch: opts.fetch,
-        headers,
-    });
-}
-//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,YAA6B,MAAM,eAAe,CAAC;AAyC1D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAgC;IAEhC,MAAM,OAAO,GAA2B;QACtC,mBAAmB,EAAE,IAAI,CAAC,cAAc;QACxC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;KACxB,CAAC;IACF,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;IACpE,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IAExD,OAAO,YAAY,CAAQ;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACxC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO;KACR,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AAItB,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,mBAAmB,GAGpB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,oBAAoB,EACpB,wBAAwB,GAEzB,MAAM,cAAc,CAAC"}