@nimbusnexus/webhooks-sdk 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 NimbusNexus
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,51 @@
+# @nimbusnexus/webhooks-sdk (TypeScript)
+
+Official TypeScript SDK for **NimbusNexus Webhooks** — publish events, and verify the webhooks you
+receive. Zero runtime dependencies (uses the built-in `fetch` and `node:crypto`); Node ≥ 20.
+
+```sh
+npm install @nimbusnexus/webhooks-sdk
+```
+
+## Verify an incoming webhook (subscribers)
+
+Always verify the signature before trusting a webhook — it proves the request really came from
+webhookd and wasn't tampered with or replayed. Pass the **raw** request body (do not re-serialize).
+
+```ts
+import { verify } from "@nimbusnexus/webhooks-sdk";
+
+const ok = verify(endpointSigningSecret, rawBody, req.headers["x-webhook-signature"], {
+  timestamp: req.headers["x-webhook-timestamp"],
+});
+if (!ok) return res.status(400).end(); // forged, tampered, or outside the 300s replay window
+```
+
+## Publish an event (producers)
+
+```ts
+import { WebhookdClient, WebhookdApiError } from "@nimbusnexus/webhooks-sdk";
+
+const wh = new WebhookdClient({ baseUrl: "https://webhooks.example.com", apiKey: "whsk_…" });
+
+try {
+  const event = await wh.publish(
+    "order.created",
+    { orderId: "ord_123", total: 4200 },
+    { idempotencyKey: "order-123" }, // makes the publish safe to retry
+  );
+  console.log(event.eventUid, event.deliveriesCreated);
+} catch (e) {
+  if (e instanceof WebhookdApiError) console.error(e.statusCode, e.code, e.message);
+}
+```
+
+Transient failures (network errors, `429`, `5xx`) are retried with backoff (a `429` honours
+`Retry-After`); other `4xx` throw `WebhookdApiError` carrying the `{error:{code,message}}` envelope.
+
+## Develop
+
+```sh
+npm install
+npm run typecheck && npm run lint && npm run test && npm run build
+```

package/dist/index.cjs

@@ -0,0 +1,185 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  DEFAULT_TOLERANCE_SECONDS: () => DEFAULT_TOLERANCE_SECONDS,
+  VERSION: () => VERSION,
+  WebhookdApiError: () => WebhookdApiError,
+  WebhookdClient: () => WebhookdClient,
+  WebhookdError: () => WebhookdError,
+  sign: () => sign,
+  verify: () => verify
+});
+module.exports = __toCommonJS(src_exports);
+
+// src/signature.ts
+var import_node_crypto = require("crypto");
+var PREFIX = "sha256=";
+var DEFAULT_TOLERANCE_SECONDS = 300;
+function toBuffer(value) {
+  return Buffer.isBuffer(value) ? value : Buffer.from(value, "utf8");
+}
+function signedBytes(rawBody, timestamp) {
+  if (timestamp === null) return rawBody;
+  return Buffer.concat([Buffer.from(`${timestamp}.`, "ascii"), rawBody]);
+}
+function sign(secret, rawBody, timestamp = null) {
+  const digest = (0, import_node_crypto.createHmac)("sha256", secret).update(signedBytes(toBuffer(rawBody), timestamp)).digest("hex");
+  return `${PREFIX}${digest}`;
+}
+function verify(secret, rawBody, signature, opts = {}) {
+  const { timestamp = null, toleranceSeconds = DEFAULT_TOLERANCE_SECONDS, now } = opts;
+  const ts = timestamp === null || timestamp === void 0 ? null : Number(timestamp);
+  if (ts !== null) {
+    if (Number.isNaN(ts)) return false;
+    const current = now ?? Math.floor(Date.now() / 1e3);
+    if (Math.abs(current - ts) > toleranceSeconds) return false;
+  }
+  const expected = Buffer.from(sign(secret, rawBody, ts));
+  const candidate = Buffer.from(signature.startsWith(PREFIX) ? signature : `${PREFIX}${signature}`);
+  return expected.length === candidate.length && (0, import_node_crypto.timingSafeEqual)(expected, candidate);
+}
+
+// src/errors.ts
+var WebhookdError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "WebhookdError";
+  }
+};
+var WebhookdApiError = class extends WebhookdError {
+  statusCode;
+  code;
+  constructor(statusCode, code, message) {
+    super(`[${statusCode} ${code}] ${message}`);
+    this.name = "WebhookdApiError";
+    this.statusCode = statusCode;
+    this.code = code;
+  }
+};
+
+// src/client.ts
+var RETRY_STATUSES = /* @__PURE__ */ new Set([429, 500, 502, 503, 504]);
+var WebhookdClient = class {
+  baseUrl;
+  apiKey;
+  timeoutMs;
+  maxRetries;
+  fetchImpl;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
+    this.apiKey = opts.apiKey;
+    this.timeoutMs = opts.timeoutMs ?? 1e4;
+    this.maxRetries = opts.maxRetries ?? 2;
+    this.fetchImpl = opts.fetchImpl ?? fetch;
+  }
+  async publish(eventType, payload, opts = {}) {
+    const body = {
+      event_type: eventType,
+      payload,
+      environment: opts.environment ?? "prod",
+      application: opts.application ?? "default"
+    };
+    if (opts.source !== void 0) body.source = opts.source;
+    const headers = {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${this.apiKey}`
+    };
+    if (opts.idempotencyKey !== void 0) headers["Idempotency-Key"] = opts.idempotencyKey;
+    const resp = await this.post("/v1/events", JSON.stringify(body), headers);
+    const data = await resp.json();
+    return {
+      id: String(data.id),
+      eventUid: String(data.event_uid),
+      eventType: String(data.event_type),
+      application: String(data.application ?? "default"),
+      environment: String(data.environment ?? "prod"),
+      deliveriesCreated: Number(data.deliveries_created ?? 0),
+      source: data.source ?? null
+    };
+  }
+  async post(path, body, headers) {
+    const url = `${this.baseUrl}${path}`;
+    let lastErr;
+    for (let attempt = 0; attempt <= this.maxRetries; attempt++) {
+      let resp;
+      try {
+        resp = await this.fetchImpl(url, {
+          method: "POST",
+          headers,
+          body,
+          signal: AbortSignal.timeout(this.timeoutMs)
+        });
+      } catch (err) {
+        lastErr = err;
+        if (attempt < this.maxRetries) {
+          await sleep(backoffMs(attempt));
+          continue;
+        }
+        throw new WebhookdError(`request failed: ${String(err)}`);
+      }
+      if (RETRY_STATUSES.has(resp.status) && attempt < this.maxRetries) {
+        await sleep(retryAfterMs(resp) ?? backoffMs(attempt));
+        continue;
+      }
+      if (resp.status >= 400) throw await apiError(resp);
+      return resp;
+    }
+    throw new WebhookdError(`request failed after retries: ${String(lastErr)}`);
+  }
+};
+function backoffMs(attempt) {
+  return Math.min(2e3, 200 * 2 ** attempt);
+}
+function retryAfterMs(resp) {
+  const raw = resp.headers.get("Retry-After");
+  if (raw && /^\d+$/.test(raw)) return Number(raw) * 1e3;
+  return null;
+}
+async function apiError(resp) {
+  let code = "error";
+  let message = "";
+  try {
+    const data = await resp.json();
+    code = data.error?.code ?? code;
+    message = data.error?.message ?? "";
+  } catch {
+    message = "";
+  }
+  return new WebhookdApiError(resp.status, code, message);
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/index.ts
+var VERSION = "0.1.0";
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DEFAULT_TOLERANCE_SECONDS,
+  VERSION,
+  WebhookdApiError,
+  WebhookdClient,
+  WebhookdError,
+  sign,
+  verify
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/signature.ts","../src/errors.ts","../src/client.ts"],"sourcesContent":["/**\n * @nimbusnexus/webhooks-sdk — the official TypeScript client for NimbusNexus Webhooks.\n *\n * - `verify` — verify an incoming webhook's HMAC signature (for subscribers).\n * - `WebhookdClient` — publish events to webhookd (for producers).\n */\nexport { DEFAULT_TOLERANCE_SECONDS, sign, verify } from \"./signature\";\nexport type { VerifyOptions } from \"./signature\";\nexport { WebhookdClient } from \"./client\";\nexport type { ClientOptions, PublishOptions, WebhookdEvent } from \"./client\";\nexport { WebhookdApiError, WebhookdError } from \"./errors\";\n\nexport const VERSION = \"0.1.0\";\n","/**\n * Verify webhookd webhook signatures.\n *\n * webhookd signs every delivery as `HMAC_SHA256(secret, \"<timestamp>.\" + rawBody)` (its default\n * timestamped mode) and sends `X-Webhook-Signature: sha256=<hex>` plus `X-Webhook-Timestamp`\n * (unix seconds). A subscriber MUST verify the signature to prove the request genuinely came from\n * webhookd and wasn't tampered with. Mirrors `delivery_core.webhook_outbox.{sign,verify}`.\n */\nimport { createHmac, timingSafeEqual } from \"node:crypto\";\n\nconst PREFIX = \"sha256=\";\nexport const DEFAULT_TOLERANCE_SECONDS = 300;\n\nfunction toBuffer(value: string | Buffer): Buffer {\n  return Buffer.isBuffer(value) ? value : Buffer.from(value, \"utf8\");\n}\n\nfunction signedBytes(rawBody: Buffer, timestamp: number | null): Buffer {\n  if (timestamp === null) return rawBody;\n  return Buffer.concat([Buffer.from(`${timestamp}.`, \"ascii\"), rawBody]);\n}\n\n/** The `sha256=<hex>` signature webhookd would send for `rawBody` (+ optional timestamp). */\nexport function sign(\n  secret: string | Buffer,\n  rawBody: string | Buffer,\n  timestamp: number | null = null,\n): string {\n  const digest = createHmac(\"sha256\", secret)\n    .update(signedBytes(toBuffer(rawBody), timestamp))\n    .digest(\"hex\");\n  return `${PREFIX}${digest}`;\n}\n\nexport interface VerifyOptions {\n  /** The `X-Webhook-Timestamp` header value. When given, the replay window is enforced — always pass it. */\n  timestamp?: number | string | null;\n  /** Replay window in seconds; webhookd's default is 300. */\n  toleranceSeconds?: number;\n  /** Override the current unix time (for tests). */\n  now?: number;\n}\n\n/**\n * Return `true` iff `signature` is a valid webhookd signature for `rawBody`.\n *\n * Pass the EXACT bytes you received as `rawBody` (a string or Buffer) — do not re-serialize the\n * JSON, or the signature won't match. Comparison is constant-time.\n */\nexport function verify(\n  secret: string | Buffer,\n  rawBody: string | Buffer,\n  signature: string,\n  opts: VerifyOptions = {},\n): boolean {\n  const { timestamp = null, toleranceSeconds = DEFAULT_TOLERANCE_SECONDS, now } = opts;\n  const ts = timestamp === null || timestamp === undefined ? null : Number(timestamp);\n  if (ts !== null) {\n    if (Number.isNaN(ts)) return false;\n    const current = now ?? Math.floor(Date.now() / 1000);\n    if (Math.abs(current - ts) > toleranceSeconds) return false;\n  }\n  const expected = Buffer.from(sign(secret, rawBody, ts));\n  const candidate = Buffer.from(signature.startsWith(PREFIX) ? signature : `${PREFIX}${signature}`);\n  // timingSafeEqual requires equal-length buffers; a length mismatch is already a non-match.\n  return expected.length === candidate.length && timingSafeEqual(expected, candidate);\n}\n","/** Base class for all webhookd SDK errors (network failures, etc.). */\nexport class WebhookdError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"WebhookdError\";\n  }\n}\n\n/**\n * A non-2xx response from the webhookd API. Carries the M5a error envelope: a stable machine\n * `code` (e.g. `\"rate_limited\"`, `\"not_found\"`, `\"validation_error\"`) and a human `message`,\n * plus the HTTP `statusCode`.\n */\nexport class WebhookdApiError extends WebhookdError {\n  readonly statusCode: number;\n  readonly code: string;\n\n  constructor(statusCode: number, code: string, message: string) {\n    super(`[${statusCode} ${code}] ${message}`);\n    this.name = \"WebhookdApiError\";\n    this.statusCode = statusCode;\n    this.code = code;\n  }\n}\n","/** Typed publish client for the webhookd API (zero runtime deps — uses the global `fetch`). */\nimport { WebhookdApiError, WebhookdError } from \"./errors\";\n\nconst RETRY_STATUSES = new Set([429, 500, 502, 503, 504]);\n\n/** The published event, as returned by `POST /v1/events` (webhookd's `EventOut`). */\nexport interface WebhookdEvent {\n  id: string;\n  eventUid: string;\n  eventType: string;\n  application: string;\n  environment: string;\n  deliveriesCreated: number;\n  source: string | null;\n}\n\nexport interface ClientOptions {\n  baseUrl: string;\n  /** A per-tenant API key (`whsk_…`) or a service token. */\n  apiKey: string;\n  timeoutMs?: number;\n  maxRetries?: number;\n  /** Inject a `fetch` implementation (defaults to the global `fetch`); used for tests. */\n  fetchImpl?: typeof fetch;\n}\n\nexport interface PublishOptions {\n  environment?: string;\n  application?: string;\n  source?: string;\n  /** Makes the publish safe to retry — a replay returns the original event without re-fanning-out. */\n  idempotencyKey?: string;\n}\n\nexport class WebhookdClient {\n  private readonly baseUrl: string;\n  private readonly apiKey: string;\n  private readonly timeoutMs: number;\n  private readonly maxRetries: number;\n  private readonly fetchImpl: typeof fetch;\n\n  constructor(opts: ClientOptions) {\n    this.baseUrl = opts.baseUrl.replace(/\\/+$/, \"\");\n    this.apiKey = opts.apiKey;\n    this.timeoutMs = opts.timeoutMs ?? 10_000;\n    this.maxRetries = opts.maxRetries ?? 2;\n    this.fetchImpl = opts.fetchImpl ?? fetch;\n  }\n\n  async publish(\n    eventType: string,\n    payload: Record<string, unknown>,\n    opts: PublishOptions = {},\n  ): Promise<WebhookdEvent> {\n    const body: Record<string, unknown> = {\n      event_type: eventType,\n      payload,\n      environment: opts.environment ?? \"prod\",\n      application: opts.application ?? \"default\",\n    };\n    if (opts.source !== undefined) body.source = opts.source;\n\n    const headers: Record<string, string> = {\n      \"Content-Type\": \"application/json\",\n      Authorization: `Bearer ${this.apiKey}`,\n    };\n    if (opts.idempotencyKey !== undefined) headers[\"Idempotency-Key\"] = opts.idempotencyKey;\n\n    const resp = await this.post(\"/v1/events\", JSON.stringify(body), headers);\n    const data = (await resp.json()) as Record<string, unknown>;\n    return {\n      id: String(data.id),\n      eventUid: String(data.event_uid),\n      eventType: String(data.event_type),\n      application: String(data.application ?? \"default\"),\n      environment: String(data.environment ?? \"prod\"),\n      deliveriesCreated: Number(data.deliveries_created ?? 0),\n      source: (data.source as string | null) ?? null,\n    };\n  }\n\n  private async post(\n    path: string,\n    body: string,\n    headers: Record<string, string>,\n  ): Promise<Response> {\n    const url = `${this.baseUrl}${path}`;\n    let lastErr: unknown;\n    for (let attempt = 0; attempt <= this.maxRetries; attempt++) {\n      let resp: Response;\n      try {\n        resp = await this.fetchImpl(url, {\n          method: \"POST\",\n          headers,\n          body,\n          signal: AbortSignal.timeout(this.timeoutMs),\n        });\n      } catch (err) {\n        lastErr = err;\n        if (attempt < this.maxRetries) {\n          await sleep(backoffMs(attempt));\n          continue;\n        }\n        throw new WebhookdError(`request failed: ${String(err)}`);\n      }\n\n      if (RETRY_STATUSES.has(resp.status) && attempt < this.maxRetries) {\n        await sleep(retryAfterMs(resp) ?? backoffMs(attempt));\n        continue;\n      }\n      if (resp.status >= 400) throw await apiError(resp);\n      return resp;\n    }\n    throw new WebhookdError(`request failed after retries: ${String(lastErr)}`);\n  }\n}\n\nfunction backoffMs(attempt: number): number {\n  return Math.min(2000, 200 * 2 ** attempt);\n}\n\nfunction retryAfterMs(resp: Response): number | null {\n  const raw = resp.headers.get(\"Retry-After\");\n  if (raw && /^\\d+$/.test(raw)) return Number(raw) * 1000;\n  return null;\n}\n\nasync function apiError(resp: Response): Promise<WebhookdApiError> {\n  let code = \"error\";\n  let message = \"\";\n  try {\n    const data = (await resp.json()) as { error?: { code?: string; message?: string } };\n    code = data.error?.code ?? code;\n    message = data.error?.message ?? \"\";\n  } catch {\n    message = \"\";\n  }\n  return new WebhookdApiError(resp.status, code, message);\n}\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACQA,yBAA4C;AAE5C,IAAM,SAAS;AACR,IAAM,4BAA4B;AAEzC,SAAS,SAAS,OAAgC;AAChD,SAAO,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,OAAO,MAAM;AACnE;AAEA,SAAS,YAAY,SAAiB,WAAkC;AACtE,MAAI,cAAc,KAAM,QAAO;AAC/B,SAAO,OAAO,OAAO,CAAC,OAAO,KAAK,GAAG,SAAS,KAAK,OAAO,GAAG,OAAO,CAAC;AACvE;AAGO,SAAS,KACd,QACA,SACA,YAA2B,MACnB;AACR,QAAM,aAAS,+BAAW,UAAU,MAAM,EACvC,OAAO,YAAY,SAAS,OAAO,GAAG,SAAS,CAAC,EAChD,OAAO,KAAK;AACf,SAAO,GAAG,MAAM,GAAG,MAAM;AAC3B;AAiBO,SAAS,OACd,QACA,SACA,WACA,OAAsB,CAAC,GACd;AACT,QAAM,EAAE,YAAY,MAAM,mBAAmB,2BAA2B,IAAI,IAAI;AAChF,QAAM,KAAK,cAAc,QAAQ,cAAc,SAAY,OAAO,OAAO,SAAS;AAClF,MAAI,OAAO,MAAM;AACf,QAAI,OAAO,MAAM,EAAE,EAAG,QAAO;AAC7B,UAAM,UAAU,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACnD,QAAI,KAAK,IAAI,UAAU,EAAE,IAAI,iBAAkB,QAAO;AAAA,EACxD;AACA,QAAM,WAAW,OAAO,KAAK,KAAK,QAAQ,SAAS,EAAE,CAAC;AACtD,QAAM,YAAY,OAAO,KAAK,UAAU,WAAW,MAAM,IAAI,YAAY,GAAG,MAAM,GAAG,SAAS,EAAE;AAEhG,SAAO,SAAS,WAAW,UAAU,cAAU,oCAAgB,UAAU,SAAS;AACpF;;;ACjEO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EACvC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAOO,IAAM,mBAAN,cAA+B,cAAc;AAAA,EACzC;AAAA,EACA;AAAA,EAET,YAAY,YAAoB,MAAc,SAAiB;AAC7D,UAAM,IAAI,UAAU,IAAI,IAAI,KAAK,OAAO,EAAE;AAC1C,SAAK,OAAO;AACZ,SAAK,aAAa;AAClB,SAAK,OAAO;AAAA,EACd;AACF;;;ACpBA,IAAM,iBAAiB,oBAAI,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AA+BjD,IAAM,iBAAN,MAAqB;AAAA,EACT;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,MAAqB;AAC/B,SAAK,UAAU,KAAK,QAAQ,QAAQ,QAAQ,EAAE;AAC9C,SAAK,SAAS,KAAK;AACnB,SAAK,YAAY,KAAK,aAAa;AACnC,SAAK,aAAa,KAAK,cAAc;AACrC,SAAK,YAAY,KAAK,aAAa;AAAA,EACrC;AAAA,EAEA,MAAM,QACJ,WACA,SACA,OAAuB,CAAC,GACA;AACxB,UAAM,OAAgC;AAAA,MACpC,YAAY;AAAA,MACZ;AAAA,MACA,aAAa,KAAK,eAAe;AAAA,MACjC,aAAa,KAAK,eAAe;AAAA,IACnC;AACA,QAAI,KAAK,WAAW,OAAW,MAAK,SAAS,KAAK;AAElD,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,eAAe,UAAU,KAAK,MAAM;AAAA,IACtC;AACA,QAAI,KAAK,mBAAmB,OAAW,SAAQ,iBAAiB,IAAI,KAAK;AAEzE,UAAM,OAAO,MAAM,KAAK,KAAK,cAAc,KAAK,UAAU,IAAI,GAAG,OAAO;AACxE,UAAM,OAAQ,MAAM,KAAK,KAAK;AAC9B,WAAO;AAAA,MACL,IAAI,OAAO,KAAK,EAAE;AAAA,MAClB,UAAU,OAAO,KAAK,SAAS;AAAA,MAC/B,WAAW,OAAO,KAAK,UAAU;AAAA,MACjC,aAAa,OAAO,KAAK,eAAe,SAAS;AAAA,MACjD,aAAa,OAAO,KAAK,eAAe,MAAM;AAAA,MAC9C,mBAAmB,OAAO,KAAK,sBAAsB,CAAC;AAAA,MACtD,QAAS,KAAK,UAA4B;AAAA,IAC5C;AAAA,EACF;AAAA,EAEA,MAAc,KACZ,MACA,MACA,SACmB;AACnB,UAAM,MAAM,GAAG,KAAK,OAAO,GAAG,IAAI;AAClC,QAAI;AACJ,aAAS,UAAU,GAAG,WAAW,KAAK,YAAY,WAAW;AAC3D,UAAI;AACJ,UAAI;AACF,eAAO,MAAM,KAAK,UAAU,KAAK;AAAA,UAC/B,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,UACA,QAAQ,YAAY,QAAQ,KAAK,SAAS;AAAA,QAC5C,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,kBAAU;AACV,YAAI,UAAU,KAAK,YAAY;AAC7B,gBAAM,MAAM,UAAU,OAAO,CAAC;AAC9B;AAAA,QACF;AACA,cAAM,IAAI,cAAc,mBAAmB,OAAO,GAAG,CAAC,EAAE;AAAA,MAC1D;AAEA,UAAI,eAAe,IAAI,KAAK,MAAM,KAAK,UAAU,KAAK,YAAY;AAChE,cAAM,MAAM,aAAa,IAAI,KAAK,UAAU,OAAO,CAAC;AACpD;AAAA,MACF;AACA,UAAI,KAAK,UAAU,IAAK,OAAM,MAAM,SAAS,IAAI;AACjD,aAAO;AAAA,IACT;AACA,UAAM,IAAI,cAAc,iCAAiC,OAAO,OAAO,CAAC,EAAE;AAAA,EAC5E;AACF;AAEA,SAAS,UAAU,SAAyB;AAC1C,SAAO,KAAK,IAAI,KAAM,MAAM,KAAK,OAAO;AAC1C;AAEA,SAAS,aAAa,MAA+B;AACnD,QAAM,MAAM,KAAK,QAAQ,IAAI,aAAa;AAC1C,MAAI,OAAO,QAAQ,KAAK,GAAG,EAAG,QAAO,OAAO,GAAG,IAAI;AACnD,SAAO;AACT;AAEA,eAAe,SAAS,MAA2C;AACjE,MAAI,OAAO;AACX,MAAI,UAAU;AACd,MAAI;AACF,UAAM,OAAQ,MAAM,KAAK,KAAK;AAC9B,WAAO,KAAK,OAAO,QAAQ;AAC3B,cAAU,KAAK,OAAO,WAAW;AAAA,EACnC,QAAQ;AACN,cAAU;AAAA,EACZ;AACA,SAAO,IAAI,iBAAiB,KAAK,QAAQ,MAAM,OAAO;AACxD;AAEA,SAAS,MAAM,IAA2B;AACxC,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AACzD;;;AHlIO,IAAM,UAAU;","names":[]}

package/dist/index.d.cts

@@ -0,0 +1,81 @@
+declare const DEFAULT_TOLERANCE_SECONDS = 300;
+/** The `sha256=<hex>` signature webhookd would send for `rawBody` (+ optional timestamp). */
+declare function sign(secret: string | Buffer, rawBody: string | Buffer, timestamp?: number | null): string;
+interface VerifyOptions {
+    /** The `X-Webhook-Timestamp` header value. When given, the replay window is enforced — always pass it. */
+    timestamp?: number | string | null;
+    /** Replay window in seconds; webhookd's default is 300. */
+    toleranceSeconds?: number;
+    /** Override the current unix time (for tests). */
+    now?: number;
+}
+/**
+ * Return `true` iff `signature` is a valid webhookd signature for `rawBody`.
+ *
+ * Pass the EXACT bytes you received as `rawBody` (a string or Buffer) — do not re-serialize the
+ * JSON, or the signature won't match. Comparison is constant-time.
+ */
+declare function verify(secret: string | Buffer, rawBody: string | Buffer, signature: string, opts?: VerifyOptions): boolean;
+
+/** The published event, as returned by `POST /v1/events` (webhookd's `EventOut`). */
+interface WebhookdEvent {
+    id: string;
+    eventUid: string;
+    eventType: string;
+    application: string;
+    environment: string;
+    deliveriesCreated: number;
+    source: string | null;
+}
+interface ClientOptions {
+    baseUrl: string;
+    /** A per-tenant API key (`whsk_…`) or a service token. */
+    apiKey: string;
+    timeoutMs?: number;
+    maxRetries?: number;
+    /** Inject a `fetch` implementation (defaults to the global `fetch`); used for tests. */
+    fetchImpl?: typeof fetch;
+}
+interface PublishOptions {
+    environment?: string;
+    application?: string;
+    source?: string;
+    /** Makes the publish safe to retry — a replay returns the original event without re-fanning-out. */
+    idempotencyKey?: string;
+}
+declare class WebhookdClient {
+    private readonly baseUrl;
+    private readonly apiKey;
+    private readonly timeoutMs;
+    private readonly maxRetries;
+    private readonly fetchImpl;
+    constructor(opts: ClientOptions);
+    publish(eventType: string, payload: Record<string, unknown>, opts?: PublishOptions): Promise<WebhookdEvent>;
+    private post;
+}
+
+/** Base class for all webhookd SDK errors (network failures, etc.). */
+declare class WebhookdError extends Error {
+    constructor(message: string);
+}
+/**
+ * A non-2xx response from the webhookd API. Carries the M5a error envelope: a stable machine
+ * `code` (e.g. `"rate_limited"`, `"not_found"`, `"validation_error"`) and a human `message`,
+ * plus the HTTP `statusCode`.
+ */
+declare class WebhookdApiError extends WebhookdError {
+    readonly statusCode: number;
+    readonly code: string;
+    constructor(statusCode: number, code: string, message: string);
+}
+
+/**
+ * @nimbusnexus/webhooks-sdk — the official TypeScript client for NimbusNexus Webhooks.
+ *
+ * - `verify` — verify an incoming webhook's HMAC signature (for subscribers).
+ * - `WebhookdClient` — publish events to webhookd (for producers).
+ */
+
+declare const VERSION = "0.1.0";
+
+export { type ClientOptions, DEFAULT_TOLERANCE_SECONDS, type PublishOptions, VERSION, type VerifyOptions, WebhookdApiError, WebhookdClient, WebhookdError, type WebhookdEvent, sign, verify };

package/dist/index.d.ts

@@ -0,0 +1,81 @@
+declare const DEFAULT_TOLERANCE_SECONDS = 300;
+/** The `sha256=<hex>` signature webhookd would send for `rawBody` (+ optional timestamp). */
+declare function sign(secret: string | Buffer, rawBody: string | Buffer, timestamp?: number | null): string;
+interface VerifyOptions {
+    /** The `X-Webhook-Timestamp` header value. When given, the replay window is enforced — always pass it. */
+    timestamp?: number | string | null;
+    /** Replay window in seconds; webhookd's default is 300. */
+    toleranceSeconds?: number;
+    /** Override the current unix time (for tests). */
+    now?: number;
+}
+/**
+ * Return `true` iff `signature` is a valid webhookd signature for `rawBody`.
+ *
+ * Pass the EXACT bytes you received as `rawBody` (a string or Buffer) — do not re-serialize the
+ * JSON, or the signature won't match. Comparison is constant-time.
+ */
+declare function verify(secret: string | Buffer, rawBody: string | Buffer, signature: string, opts?: VerifyOptions): boolean;
+
+/** The published event, as returned by `POST /v1/events` (webhookd's `EventOut`). */
+interface WebhookdEvent {
+    id: string;
+    eventUid: string;
+    eventType: string;
+    application: string;
+    environment: string;
+    deliveriesCreated: number;
+    source: string | null;
+}
+interface ClientOptions {
+    baseUrl: string;
+    /** A per-tenant API key (`whsk_…`) or a service token. */
+    apiKey: string;
+    timeoutMs?: number;
+    maxRetries?: number;
+    /** Inject a `fetch` implementation (defaults to the global `fetch`); used for tests. */
+    fetchImpl?: typeof fetch;
+}
+interface PublishOptions {
+    environment?: string;
+    application?: string;
+    source?: string;
+    /** Makes the publish safe to retry — a replay returns the original event without re-fanning-out. */
+    idempotencyKey?: string;
+}
+declare class WebhookdClient {
+    private readonly baseUrl;
+    private readonly apiKey;
+    private readonly timeoutMs;
+    private readonly maxRetries;
+    private readonly fetchImpl;
+    constructor(opts: ClientOptions);
+    publish(eventType: string, payload: Record<string, unknown>, opts?: PublishOptions): Promise<WebhookdEvent>;
+    private post;
+}
+
+/** Base class for all webhookd SDK errors (network failures, etc.). */
+declare class WebhookdError extends Error {
+    constructor(message: string);
+}
+/**
+ * A non-2xx response from the webhookd API. Carries the M5a error envelope: a stable machine
+ * `code` (e.g. `"rate_limited"`, `"not_found"`, `"validation_error"`) and a human `message`,
+ * plus the HTTP `statusCode`.
+ */
+declare class WebhookdApiError extends WebhookdError {
+    readonly statusCode: number;
+    readonly code: string;
+    constructor(statusCode: number, code: string, message: string);
+}
+
+/**
+ * @nimbusnexus/webhooks-sdk — the official TypeScript client for NimbusNexus Webhooks.
+ *
+ * - `verify` — verify an incoming webhook's HMAC signature (for subscribers).
+ * - `WebhookdClient` — publish events to webhookd (for producers).
+ */
+
+declare const VERSION = "0.1.0";
+
+export { type ClientOptions, DEFAULT_TOLERANCE_SECONDS, type PublishOptions, VERSION, type VerifyOptions, WebhookdApiError, WebhookdClient, WebhookdError, type WebhookdEvent, sign, verify };

package/dist/index.js

@@ -0,0 +1,152 @@
+// src/signature.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var PREFIX = "sha256=";
+var DEFAULT_TOLERANCE_SECONDS = 300;
+function toBuffer(value) {
+  return Buffer.isBuffer(value) ? value : Buffer.from(value, "utf8");
+}
+function signedBytes(rawBody, timestamp) {
+  if (timestamp === null) return rawBody;
+  return Buffer.concat([Buffer.from(`${timestamp}.`, "ascii"), rawBody]);
+}
+function sign(secret, rawBody, timestamp = null) {
+  const digest = createHmac("sha256", secret).update(signedBytes(toBuffer(rawBody), timestamp)).digest("hex");
+  return `${PREFIX}${digest}`;
+}
+function verify(secret, rawBody, signature, opts = {}) {
+  const { timestamp = null, toleranceSeconds = DEFAULT_TOLERANCE_SECONDS, now } = opts;
+  const ts = timestamp === null || timestamp === void 0 ? null : Number(timestamp);
+  if (ts !== null) {
+    if (Number.isNaN(ts)) return false;
+    const current = now ?? Math.floor(Date.now() / 1e3);
+    if (Math.abs(current - ts) > toleranceSeconds) return false;
+  }
+  const expected = Buffer.from(sign(secret, rawBody, ts));
+  const candidate = Buffer.from(signature.startsWith(PREFIX) ? signature : `${PREFIX}${signature}`);
+  return expected.length === candidate.length && timingSafeEqual(expected, candidate);
+}
+
+// src/errors.ts
+var WebhookdError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "WebhookdError";
+  }
+};
+var WebhookdApiError = class extends WebhookdError {
+  statusCode;
+  code;
+  constructor(statusCode, code, message) {
+    super(`[${statusCode} ${code}] ${message}`);
+    this.name = "WebhookdApiError";
+    this.statusCode = statusCode;
+    this.code = code;
+  }
+};
+
+// src/client.ts
+var RETRY_STATUSES = /* @__PURE__ */ new Set([429, 500, 502, 503, 504]);
+var WebhookdClient = class {
+  baseUrl;
+  apiKey;
+  timeoutMs;
+  maxRetries;
+  fetchImpl;
+  constructor(opts) {
+    this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
+    this.apiKey = opts.apiKey;
+    this.timeoutMs = opts.timeoutMs ?? 1e4;
+    this.maxRetries = opts.maxRetries ?? 2;
+    this.fetchImpl = opts.fetchImpl ?? fetch;
+  }
+  async publish(eventType, payload, opts = {}) {
+    const body = {
+      event_type: eventType,
+      payload,
+      environment: opts.environment ?? "prod",
+      application: opts.application ?? "default"
+    };
+    if (opts.source !== void 0) body.source = opts.source;
+    const headers = {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${this.apiKey}`
+    };
+    if (opts.idempotencyKey !== void 0) headers["Idempotency-Key"] = opts.idempotencyKey;
+    const resp = await this.post("/v1/events", JSON.stringify(body), headers);
+    const data = await resp.json();
+    return {
+      id: String(data.id),
+      eventUid: String(data.event_uid),
+      eventType: String(data.event_type),
+      application: String(data.application ?? "default"),
+      environment: String(data.environment ?? "prod"),
+      deliveriesCreated: Number(data.deliveries_created ?? 0),
+      source: data.source ?? null
+    };
+  }
+  async post(path, body, headers) {
+    const url = `${this.baseUrl}${path}`;
+    let lastErr;
+    for (let attempt = 0; attempt <= this.maxRetries; attempt++) {
+      let resp;
+      try {
+        resp = await this.fetchImpl(url, {
+          method: "POST",
+          headers,
+          body,
+          signal: AbortSignal.timeout(this.timeoutMs)
+        });
+      } catch (err) {
+        lastErr = err;
+        if (attempt < this.maxRetries) {
+          await sleep(backoffMs(attempt));
+          continue;
+        }
+        throw new WebhookdError(`request failed: ${String(err)}`);
+      }
+      if (RETRY_STATUSES.has(resp.status) && attempt < this.maxRetries) {
+        await sleep(retryAfterMs(resp) ?? backoffMs(attempt));
+        continue;
+      }
+      if (resp.status >= 400) throw await apiError(resp);
+      return resp;
+    }
+    throw new WebhookdError(`request failed after retries: ${String(lastErr)}`);
+  }
+};
+function backoffMs(attempt) {
+  return Math.min(2e3, 200 * 2 ** attempt);
+}
+function retryAfterMs(resp) {
+  const raw = resp.headers.get("Retry-After");
+  if (raw && /^\d+$/.test(raw)) return Number(raw) * 1e3;
+  return null;
+}
+async function apiError(resp) {
+  let code = "error";
+  let message = "";
+  try {
+    const data = await resp.json();
+    code = data.error?.code ?? code;
+    message = data.error?.message ?? "";
+  } catch {
+    message = "";
+  }
+  return new WebhookdApiError(resp.status, code, message);
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/index.ts
+var VERSION = "0.1.0";
+export {
+  DEFAULT_TOLERANCE_SECONDS,
+  VERSION,
+  WebhookdApiError,
+  WebhookdClient,
+  WebhookdError,
+  sign,
+  verify
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/signature.ts","../src/errors.ts","../src/client.ts","../src/index.ts"],"sourcesContent":["/**\n * Verify webhookd webhook signatures.\n *\n * webhookd signs every delivery as `HMAC_SHA256(secret, \"<timestamp>.\" + rawBody)` (its default\n * timestamped mode) and sends `X-Webhook-Signature: sha256=<hex>` plus `X-Webhook-Timestamp`\n * (unix seconds). A subscriber MUST verify the signature to prove the request genuinely came from\n * webhookd and wasn't tampered with. Mirrors `delivery_core.webhook_outbox.{sign,verify}`.\n */\nimport { createHmac, timingSafeEqual } from \"node:crypto\";\n\nconst PREFIX = \"sha256=\";\nexport const DEFAULT_TOLERANCE_SECONDS = 300;\n\nfunction toBuffer(value: string | Buffer): Buffer {\n  return Buffer.isBuffer(value) ? value : Buffer.from(value, \"utf8\");\n}\n\nfunction signedBytes(rawBody: Buffer, timestamp: number | null): Buffer {\n  if (timestamp === null) return rawBody;\n  return Buffer.concat([Buffer.from(`${timestamp}.`, \"ascii\"), rawBody]);\n}\n\n/** The `sha256=<hex>` signature webhookd would send for `rawBody` (+ optional timestamp). */\nexport function sign(\n  secret: string | Buffer,\n  rawBody: string | Buffer,\n  timestamp: number | null = null,\n): string {\n  const digest = createHmac(\"sha256\", secret)\n    .update(signedBytes(toBuffer(rawBody), timestamp))\n    .digest(\"hex\");\n  return `${PREFIX}${digest}`;\n}\n\nexport interface VerifyOptions {\n  /** The `X-Webhook-Timestamp` header value. When given, the replay window is enforced — always pass it. */\n  timestamp?: number | string | null;\n  /** Replay window in seconds; webhookd's default is 300. */\n  toleranceSeconds?: number;\n  /** Override the current unix time (for tests). */\n  now?: number;\n}\n\n/**\n * Return `true` iff `signature` is a valid webhookd signature for `rawBody`.\n *\n * Pass the EXACT bytes you received as `rawBody` (a string or Buffer) — do not re-serialize the\n * JSON, or the signature won't match. Comparison is constant-time.\n */\nexport function verify(\n  secret: string | Buffer,\n  rawBody: string | Buffer,\n  signature: string,\n  opts: VerifyOptions = {},\n): boolean {\n  const { timestamp = null, toleranceSeconds = DEFAULT_TOLERANCE_SECONDS, now } = opts;\n  const ts = timestamp === null || timestamp === undefined ? null : Number(timestamp);\n  if (ts !== null) {\n    if (Number.isNaN(ts)) return false;\n    const current = now ?? Math.floor(Date.now() / 1000);\n    if (Math.abs(current - ts) > toleranceSeconds) return false;\n  }\n  const expected = Buffer.from(sign(secret, rawBody, ts));\n  const candidate = Buffer.from(signature.startsWith(PREFIX) ? signature : `${PREFIX}${signature}`);\n  // timingSafeEqual requires equal-length buffers; a length mismatch is already a non-match.\n  return expected.length === candidate.length && timingSafeEqual(expected, candidate);\n}\n","/** Base class for all webhookd SDK errors (network failures, etc.). */\nexport class WebhookdError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"WebhookdError\";\n  }\n}\n\n/**\n * A non-2xx response from the webhookd API. Carries the M5a error envelope: a stable machine\n * `code` (e.g. `\"rate_limited\"`, `\"not_found\"`, `\"validation_error\"`) and a human `message`,\n * plus the HTTP `statusCode`.\n */\nexport class WebhookdApiError extends WebhookdError {\n  readonly statusCode: number;\n  readonly code: string;\n\n  constructor(statusCode: number, code: string, message: string) {\n    super(`[${statusCode} ${code}] ${message}`);\n    this.name = \"WebhookdApiError\";\n    this.statusCode = statusCode;\n    this.code = code;\n  }\n}\n","/** Typed publish client for the webhookd API (zero runtime deps — uses the global `fetch`). */\nimport { WebhookdApiError, WebhookdError } from \"./errors\";\n\nconst RETRY_STATUSES = new Set([429, 500, 502, 503, 504]);\n\n/** The published event, as returned by `POST /v1/events` (webhookd's `EventOut`). */\nexport interface WebhookdEvent {\n  id: string;\n  eventUid: string;\n  eventType: string;\n  application: string;\n  environment: string;\n  deliveriesCreated: number;\n  source: string | null;\n}\n\nexport interface ClientOptions {\n  baseUrl: string;\n  /** A per-tenant API key (`whsk_…`) or a service token. */\n  apiKey: string;\n  timeoutMs?: number;\n  maxRetries?: number;\n  /** Inject a `fetch` implementation (defaults to the global `fetch`); used for tests. */\n  fetchImpl?: typeof fetch;\n}\n\nexport interface PublishOptions {\n  environment?: string;\n  application?: string;\n  source?: string;\n  /** Makes the publish safe to retry — a replay returns the original event without re-fanning-out. */\n  idempotencyKey?: string;\n}\n\nexport class WebhookdClient {\n  private readonly baseUrl: string;\n  private readonly apiKey: string;\n  private readonly timeoutMs: number;\n  private readonly maxRetries: number;\n  private readonly fetchImpl: typeof fetch;\n\n  constructor(opts: ClientOptions) {\n    this.baseUrl = opts.baseUrl.replace(/\\/+$/, \"\");\n    this.apiKey = opts.apiKey;\n    this.timeoutMs = opts.timeoutMs ?? 10_000;\n    this.maxRetries = opts.maxRetries ?? 2;\n    this.fetchImpl = opts.fetchImpl ?? fetch;\n  }\n\n  async publish(\n    eventType: string,\n    payload: Record<string, unknown>,\n    opts: PublishOptions = {},\n  ): Promise<WebhookdEvent> {\n    const body: Record<string, unknown> = {\n      event_type: eventType,\n      payload,\n      environment: opts.environment ?? \"prod\",\n      application: opts.application ?? \"default\",\n    };\n    if (opts.source !== undefined) body.source = opts.source;\n\n    const headers: Record<string, string> = {\n      \"Content-Type\": \"application/json\",\n      Authorization: `Bearer ${this.apiKey}`,\n    };\n    if (opts.idempotencyKey !== undefined) headers[\"Idempotency-Key\"] = opts.idempotencyKey;\n\n    const resp = await this.post(\"/v1/events\", JSON.stringify(body), headers);\n    const data = (await resp.json()) as Record<string, unknown>;\n    return {\n      id: String(data.id),\n      eventUid: String(data.event_uid),\n      eventType: String(data.event_type),\n      application: String(data.application ?? \"default\"),\n      environment: String(data.environment ?? \"prod\"),\n      deliveriesCreated: Number(data.deliveries_created ?? 0),\n      source: (data.source as string | null) ?? null,\n    };\n  }\n\n  private async post(\n    path: string,\n    body: string,\n    headers: Record<string, string>,\n  ): Promise<Response> {\n    const url = `${this.baseUrl}${path}`;\n    let lastErr: unknown;\n    for (let attempt = 0; attempt <= this.maxRetries; attempt++) {\n      let resp: Response;\n      try {\n        resp = await this.fetchImpl(url, {\n          method: \"POST\",\n          headers,\n          body,\n          signal: AbortSignal.timeout(this.timeoutMs),\n        });\n      } catch (err) {\n        lastErr = err;\n        if (attempt < this.maxRetries) {\n          await sleep(backoffMs(attempt));\n          continue;\n        }\n        throw new WebhookdError(`request failed: ${String(err)}`);\n      }\n\n      if (RETRY_STATUSES.has(resp.status) && attempt < this.maxRetries) {\n        await sleep(retryAfterMs(resp) ?? backoffMs(attempt));\n        continue;\n      }\n      if (resp.status >= 400) throw await apiError(resp);\n      return resp;\n    }\n    throw new WebhookdError(`request failed after retries: ${String(lastErr)}`);\n  }\n}\n\nfunction backoffMs(attempt: number): number {\n  return Math.min(2000, 200 * 2 ** attempt);\n}\n\nfunction retryAfterMs(resp: Response): number | null {\n  const raw = resp.headers.get(\"Retry-After\");\n  if (raw && /^\\d+$/.test(raw)) return Number(raw) * 1000;\n  return null;\n}\n\nasync function apiError(resp: Response): Promise<WebhookdApiError> {\n  let code = \"error\";\n  let message = \"\";\n  try {\n    const data = (await resp.json()) as { error?: { code?: string; message?: string } };\n    code = data.error?.code ?? code;\n    message = data.error?.message ?? \"\";\n  } catch {\n    message = \"\";\n  }\n  return new WebhookdApiError(resp.status, code, message);\n}\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n","/**\n * @nimbusnexus/webhooks-sdk — the official TypeScript client for NimbusNexus Webhooks.\n *\n * - `verify` — verify an incoming webhook's HMAC signature (for subscribers).\n * - `WebhookdClient` — publish events to webhookd (for producers).\n */\nexport { DEFAULT_TOLERANCE_SECONDS, sign, verify } from \"./signature\";\nexport type { VerifyOptions } from \"./signature\";\nexport { WebhookdClient } from \"./client\";\nexport type { ClientOptions, PublishOptions, WebhookdEvent } from \"./client\";\nexport { WebhookdApiError, WebhookdError } from \"./errors\";\n\nexport const VERSION = \"0.1.0\";\n"],"mappings":";AAQA,SAAS,YAAY,uBAAuB;AAE5C,IAAM,SAAS;AACR,IAAM,4BAA4B;AAEzC,SAAS,SAAS,OAAgC;AAChD,SAAO,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,OAAO,MAAM;AACnE;AAEA,SAAS,YAAY,SAAiB,WAAkC;AACtE,MAAI,cAAc,KAAM,QAAO;AAC/B,SAAO,OAAO,OAAO,CAAC,OAAO,KAAK,GAAG,SAAS,KAAK,OAAO,GAAG,OAAO,CAAC;AACvE;AAGO,SAAS,KACd,QACA,SACA,YAA2B,MACnB;AACR,QAAM,SAAS,WAAW,UAAU,MAAM,EACvC,OAAO,YAAY,SAAS,OAAO,GAAG,SAAS,CAAC,EAChD,OAAO,KAAK;AACf,SAAO,GAAG,MAAM,GAAG,MAAM;AAC3B;AAiBO,SAAS,OACd,QACA,SACA,WACA,OAAsB,CAAC,GACd;AACT,QAAM,EAAE,YAAY,MAAM,mBAAmB,2BAA2B,IAAI,IAAI;AAChF,QAAM,KAAK,cAAc,QAAQ,cAAc,SAAY,OAAO,OAAO,SAAS;AAClF,MAAI,OAAO,MAAM;AACf,QAAI,OAAO,MAAM,EAAE,EAAG,QAAO;AAC7B,UAAM,UAAU,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACnD,QAAI,KAAK,IAAI,UAAU,EAAE,IAAI,iBAAkB,QAAO;AAAA,EACxD;AACA,QAAM,WAAW,OAAO,KAAK,KAAK,QAAQ,SAAS,EAAE,CAAC;AACtD,QAAM,YAAY,OAAO,KAAK,UAAU,WAAW,MAAM,IAAI,YAAY,GAAG,MAAM,GAAG,SAAS,EAAE;AAEhG,SAAO,SAAS,WAAW,UAAU,UAAU,gBAAgB,UAAU,SAAS;AACpF;;;ACjEO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EACvC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAOO,IAAM,mBAAN,cAA+B,cAAc;AAAA,EACzC;AAAA,EACA;AAAA,EAET,YAAY,YAAoB,MAAc,SAAiB;AAC7D,UAAM,IAAI,UAAU,IAAI,IAAI,KAAK,OAAO,EAAE;AAC1C,SAAK,OAAO;AACZ,SAAK,aAAa;AAClB,SAAK,OAAO;AAAA,EACd;AACF;;;ACpBA,IAAM,iBAAiB,oBAAI,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AA+BjD,IAAM,iBAAN,MAAqB;AAAA,EACT;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,MAAqB;AAC/B,SAAK,UAAU,KAAK,QAAQ,QAAQ,QAAQ,EAAE;AAC9C,SAAK,SAAS,KAAK;AACnB,SAAK,YAAY,KAAK,aAAa;AACnC,SAAK,aAAa,KAAK,cAAc;AACrC,SAAK,YAAY,KAAK,aAAa;AAAA,EACrC;AAAA,EAEA,MAAM,QACJ,WACA,SACA,OAAuB,CAAC,GACA;AACxB,UAAM,OAAgC;AAAA,MACpC,YAAY;AAAA,MACZ;AAAA,MACA,aAAa,KAAK,eAAe;AAAA,MACjC,aAAa,KAAK,eAAe;AAAA,IACnC;AACA,QAAI,KAAK,WAAW,OAAW,MAAK,SAAS,KAAK;AAElD,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,eAAe,UAAU,KAAK,MAAM;AAAA,IACtC;AACA,QAAI,KAAK,mBAAmB,OAAW,SAAQ,iBAAiB,IAAI,KAAK;AAEzE,UAAM,OAAO,MAAM,KAAK,KAAK,cAAc,KAAK,UAAU,IAAI,GAAG,OAAO;AACxE,UAAM,OAAQ,MAAM,KAAK,KAAK;AAC9B,WAAO;AAAA,MACL,IAAI,OAAO,KAAK,EAAE;AAAA,MAClB,UAAU,OAAO,KAAK,SAAS;AAAA,MAC/B,WAAW,OAAO,KAAK,UAAU;AAAA,MACjC,aAAa,OAAO,KAAK,eAAe,SAAS;AAAA,MACjD,aAAa,OAAO,KAAK,eAAe,MAAM;AAAA,MAC9C,mBAAmB,OAAO,KAAK,sBAAsB,CAAC;AAAA,MACtD,QAAS,KAAK,UAA4B;AAAA,IAC5C;AAAA,EACF;AAAA,EAEA,MAAc,KACZ,MACA,MACA,SACmB;AACnB,UAAM,MAAM,GAAG,KAAK,OAAO,GAAG,IAAI;AAClC,QAAI;AACJ,aAAS,UAAU,GAAG,WAAW,KAAK,YAAY,WAAW;AAC3D,UAAI;AACJ,UAAI;AACF,eAAO,MAAM,KAAK,UAAU,KAAK;AAAA,UAC/B,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,UACA,QAAQ,YAAY,QAAQ,KAAK,SAAS;AAAA,QAC5C,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,kBAAU;AACV,YAAI,UAAU,KAAK,YAAY;AAC7B,gBAAM,MAAM,UAAU,OAAO,CAAC;AAC9B;AAAA,QACF;AACA,cAAM,IAAI,cAAc,mBAAmB,OAAO,GAAG,CAAC,EAAE;AAAA,MAC1D;AAEA,UAAI,eAAe,IAAI,KAAK,MAAM,KAAK,UAAU,KAAK,YAAY;AAChE,cAAM,MAAM,aAAa,IAAI,KAAK,UAAU,OAAO,CAAC;AACpD;AAAA,MACF;AACA,UAAI,KAAK,UAAU,IAAK,OAAM,MAAM,SAAS,IAAI;AACjD,aAAO;AAAA,IACT;AACA,UAAM,IAAI,cAAc,iCAAiC,OAAO,OAAO,CAAC,EAAE;AAAA,EAC5E;AACF;AAEA,SAAS,UAAU,SAAyB;AAC1C,SAAO,KAAK,IAAI,KAAM,MAAM,KAAK,OAAO;AAC1C;AAEA,SAAS,aAAa,MAA+B;AACnD,QAAM,MAAM,KAAK,QAAQ,IAAI,aAAa;AAC1C,MAAI,OAAO,QAAQ,KAAK,GAAG,EAAG,QAAO,OAAO,GAAG,IAAI;AACnD,SAAO;AACT;AAEA,eAAe,SAAS,MAA2C;AACjE,MAAI,OAAO;AACX,MAAI,UAAU;AACd,MAAI;AACF,UAAM,OAAQ,MAAM,KAAK,KAAK;AAC9B,WAAO,KAAK,OAAO,QAAQ;AAC3B,cAAU,KAAK,OAAO,WAAW;AAAA,EACnC,QAAQ;AACN,cAAU;AAAA,EACZ;AACA,SAAO,IAAI,iBAAiB,KAAK,QAAQ,MAAM,OAAO;AACxD;AAEA,SAAS,MAAM,IAA2B;AACxC,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AACzD;;;AClIO,IAAM,UAAU;","names":[]}

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "@nimbusnexus/webhooks-sdk",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "Official TypeScript SDK for NimbusNexus Webhooks — publish events + verify webhook signatures.",
+  "license": "MIT",
+  "author": "NimbusNexus",
+  "homepage": "https://github.com/NimbusNexus/Webhooks-sdks/tree/develop/typescript#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/NimbusNexus/Webhooks-sdks.git",
+    "directory": "typescript"
+  },
+  "bugs": {
+    "url": "https://github.com/NimbusNexus/Webhooks-sdks/issues"
+  },
+  "keywords": ["webhook", "webhooks", "hmac", "signature", "verify", "nimbusnexus", "sdk"],
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "files": ["dist", "LICENSE", "README.md"],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "test": "vitest run",
+    "prepublishOnly": "npm run typecheck && npm run lint && npm run test && npm run build"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "devDependencies": {
+    "@eslint/js": "^9.18.0",
+    "@types/node": "^20.19.0",
+    "eslint": "^9.18.0",
+    "eslint-config-prettier": "^9.1.2",
+    "globals": "^15.14.0",
+    "prettier": "^3.4.2",
+    "tsup": "^8.3.5",
+    "typescript": "~5.7.3",
+    "typescript-eslint": "^8.20.0",
+    "vitest": "^2.1.8"
+  }
+}