@nimbusnexus/webhooks-sdk 0.1.0 → 0.2.0

package/README.md

@@ -1,7 +1,8 @@
 # @nimbusnexus/webhooks-sdk (TypeScript)
 
-Official TypeScript SDK for **NimbusNexus Webhooks** — publish events, and verify the webhooks you
-receive. Zero runtime dependencies (uses the built-in `fetch` and `node:crypto`); Node ≥ 20.
+Official TypeScript SDK for **NimbusNexus Webhooks** — publish events, manage your endpoints / keys /
+deliveries, and verify the webhooks you receive. Zero runtime dependencies (uses the built-in `fetch`
+and `node:crypto`); Node ≥ 20.
 
 ```sh
 npm install @nimbusnexus/webhooks-sdk
@@ -43,6 +44,46 @@ try {
 Transient failures (network errors, `429`, `5xx`) are retried with backoff (a `429` honours
 `Retry-After`); other `4xx` throw `WebhookdApiError` carrying the `{error:{code,message}}` envelope.
 
+## Manage endpoints, keys & deliveries (operators)
+
+The same client wraps the control-plane API — register receivers, mint keys, and drain the
+dead-letter queue from code (needs an **admin**-scoped key). Management methods return the API's
+snake_case JSON through typed interfaces (`Endpoint`, `ApiKey`, `Delivery`, `Page<T>`); list methods
+return `{ items, next_offset }`; `deleteEndpoint` / `revokeApiKey` resolve to `void` (a `204`).
+
+```ts
+import { WebhookdClient } from "@nimbusnexus/webhooks-sdk";
+
+const wh = new WebhookdClient({ baseUrl: "https://webhooks.example.com", apiKey: "whsk_admin_…" });
+
+// --- Endpoints ---------------------------------------------------------------
+// Create a receiver — its signing secret is in the response exactly once, so persist it now.
+const ep = await wh.createEndpoint("https://your-app.example/webhooks", {
+  subscriptions: [{ match_kind: "prefix", pattern: "order." }],
+  description: "orders service",
+});
+const { id: endpointId, secret: signingSecret } = ep;
+
+await wh.listEndpoints({ environment: "prod" }); // { items, next_offset }
+await wh.getEndpoint(endpointId);
+
+// PATCH — send only the keys you want to change (omitted = unchanged, null = cleared):
+await wh.updateEndpoint(endpointId, { max_attempts: 10, status: "disabled" });
+
+await wh.rotateEndpointSecret(endpointId);       // returns the new secret, once
+await wh.enableEndpoint(endpointId);             // recover an auto-disabled endpoint
+await wh.deleteEndpoint(endpointId);             // -> void (204)
+
+// --- API keys ----------------------------------------------------------------
+const key = await wh.createApiKey({ name: "ci-publisher", scope: "publish", expiresInDays: 90 });
+console.log(key.key);                            // shown once
+await wh.revokeApiKey(key.id);                   // -> void (204)
+
+// --- Deliveries / dead-letter recovery ---------------------------------------
+const dead = await wh.listDeliveries({ status: "dead" });
+for (const d of dead.items) await wh.redeliver(d.id);
+```
+
 ## Develop
 
 ```sh

package/dist/index.cjs

@@ -54,8 +54,12 @@ function verify(secret, rawBody, signature, opts = {}) {
     if (Math.abs(current - ts) > toleranceSeconds) return false;
   }
   const expected = Buffer.from(sign(secret, rawBody, ts));
-  const candidate = Buffer.from(signature.startsWith(PREFIX) ? signature : `${PREFIX}${signature}`);
-  return expected.length === candidate.length && (0, import_node_crypto.timingSafeEqual)(expected, candidate);
+  for (const raw of signature.split(",")) {
+    const token = raw.trim();
+    const candidate = Buffer.from(token.startsWith(PREFIX) ? token : `${PREFIX}${token}`);
+    if (expected.length === candidate.length && (0, import_node_crypto.timingSafeEqual)(expected, candidate)) return true;
+  }
+  return false;
 }
 
 // src/errors.ts
@@ -99,12 +103,9 @@ var WebhookdClient = class {
       application: opts.application ?? "default"
     };
     if (opts.source !== void 0) body.source = opts.source;
-    const headers = {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${this.apiKey}`
-    };
+    const headers = {};
     if (opts.idempotencyKey !== void 0) headers["Idempotency-Key"] = opts.idempotencyKey;
-    const resp = await this.post("/v1/events", JSON.stringify(body), headers);
+    const resp = await this.request("POST", "/v1/events", { body, headers });
     const data = await resp.json();
     return {
       id: String(data.id),
@@ -116,14 +117,126 @@ var WebhookdClient = class {
       source: data.source ?? null
     };
   }
-  async post(path, body, headers) {
-    const url = `${this.baseUrl}${path}`;
+  // ── Endpoints ──────────────────────────────────────────────────────────────
+  /** Create an endpoint. The response includes the signing `secret` exactly once — persist it. */
+  async createEndpoint(url, opts = {}) {
+    const body = {
+      url,
+      environment: opts.environment ?? "prod",
+      application: opts.application ?? "default"
+    };
+    if (opts.subscriptions !== void 0) body.subscriptions = opts.subscriptions;
+    if (opts.secret !== void 0) body.secret = opts.secret;
+    if (opts.maxAttempts !== void 0) body.max_attempts = opts.maxAttempts;
+    if (opts.retrySchedule !== void 0) body.retry_schedule = opts.retrySchedule;
+    if (opts.description !== void 0) body.description = opts.description;
+    if (opts.customHeaders !== void 0) body.custom_headers = opts.customHeaders;
+    if (opts.deliveryTimeoutMs !== void 0) body.delivery_timeout_ms = opts.deliveryTimeoutMs;
+    return this.requestJson("POST", "/v1/endpoints", { body });
+  }
+  /** List endpoints for an environment (defaults to `prod`). */
+  async listEndpoints(opts = {}) {
+    const query = { environment: opts.environment ?? "prod" };
+    if (opts.offset !== void 0) query.offset = opts.offset;
+    if (opts.limit !== void 0) query.limit = opts.limit;
+    return this.requestJson("GET", "/v1/endpoints", { query });
+  }
+  /** Fetch a single endpoint by id. */
+  async getEndpoint(id) {
+    return this.requestJson("GET", `/v1/endpoints/${encodeURIComponent(id)}`);
+  }
+  /**
+   * Partially update an endpoint. `patch` is sent verbatim (snake_case keys): an omitted key is left
+   * unchanged, an explicit `null` clears the field. No defaults are injected.
+   */
+  async updateEndpoint(id, patch) {
+    return this.requestJson("PATCH", `/v1/endpoints/${encodeURIComponent(id)}`, {
+      body: patch
+    });
+  }
+  /** Delete an endpoint. Returns nothing (the server replies `204 No Content`). */
+  async deleteEndpoint(id) {
+    await this.request("DELETE", `/v1/endpoints/${encodeURIComponent(id)}`);
+  }
+  /** Rotate an endpoint's signing secret. The response includes the new `secret` exactly once. */
+  async rotateEndpointSecret(id) {
+    return this.requestJson("POST", `/v1/endpoints/${encodeURIComponent(id)}/rotate-secret`);
+  }
+  /** Re-enable an endpoint that webhookd auto-disabled after repeated delivery failures. */
+  async enableEndpoint(id) {
+    return this.requestJson("POST", `/v1/endpoints/${encodeURIComponent(id)}/enable`);
+  }
+  // ── API keys ───────────────────────────────────────────────────────────────
+  /** Create an API key. The response includes the raw `key` exactly once — persist it. */
+  async createApiKey(opts = {}) {
+    const body = {
+      name: opts.name ?? "",
+      scope: opts.scope ?? "admin"
+    };
+    if (opts.expiresInDays !== void 0) body.expires_in_days = opts.expiresInDays;
+    return this.requestJson("POST", "/v1/api-keys", { body });
+  }
+  /** Revoke an API key. Returns nothing (the server replies `204 No Content`). */
+  async revokeApiKey(id) {
+    await this.request("DELETE", `/v1/api-keys/${encodeURIComponent(id)}`);
+  }
+  // ── Deliveries ─────────────────────────────────────────────────────────────
+  /** List deliveries. Only the filters you provide are sent as query params. */
+  async listDeliveries(opts = {}) {
+    const query = {};
+    if (opts.status !== void 0) query.status = opts.status;
+    if (opts.endpointId !== void 0) query.endpoint_id = opts.endpointId;
+    if (opts.eventType !== void 0) query.event_type = opts.eventType;
+    if (opts.since !== void 0) query.since = opts.since;
+    if (opts.until !== void 0) query.until = opts.until;
+    if (opts.q !== void 0) query.q = opts.q;
+    if (opts.offset !== void 0) query.offset = opts.offset;
+    if (opts.limit !== void 0) query.limit = opts.limit;
+    return this.requestJson("GET", "/v1/deliveries", { query });
+  }
+  /** Re-queue a delivery for another attempt. */
+  async redeliver(deliveryId) {
+    return this.requestJson(
+      "POST",
+      `/v1/deliveries/${encodeURIComponent(deliveryId)}/redeliver`
+    );
+  }
+  // ── Internals ──────────────────────────────────────────────────────────────
+  /** Issue a request and parse the JSON response as `T`. Never use for 204s (there's no body). */
+  async requestJson(method, path, opts = {}) {
+    const resp = await this.request(method, path, opts);
+    return await resp.json();
+  }
+  /**
+   * The single request path used by every method: builds the URL (+ query), attaches auth, and runs
+   * the shared retry loop (connection errors + 429 honoring Retry-After + 5xx, capped exponential
+   * backoff), raising a typed {@link WebhookdApiError} on other 4xx/5xx. The caller reads the body.
+   */
+  async request(method, path, opts = {}) {
+    let url = `${this.baseUrl}${path}`;
+    if (opts.query) {
+      const qs = new URLSearchParams();
+      for (const [key, value] of Object.entries(opts.query)) {
+        if (value !== void 0 && value !== null) qs.append(key, String(value));
+      }
+      const suffix = qs.toString();
+      if (suffix) url += `?${suffix}`;
+    }
+    const headers = {
+      Authorization: `Bearer ${this.apiKey}`,
+      ...opts.headers
+    };
+    let body;
+    if (opts.body !== void 0) {
+      body = JSON.stringify(opts.body);
+      headers["Content-Type"] = "application/json";
+    }
     let lastErr;
     for (let attempt = 0; attempt <= this.maxRetries; attempt++) {
       let resp;
       try {
         resp = await this.fetchImpl(url, {
-          method: "POST",
+          method,
           headers,
           body,
           signal: AbortSignal.timeout(this.timeoutMs)
@@ -155,14 +268,14 @@ function retryAfterMs(resp) {
   return null;
 }
 async function apiError(resp) {
+  const text = await resp.text();
   let code = "error";
-  let message = "";
+  let message = text;
   try {
-    const data = await resp.json();
+    const data = JSON.parse(text);
     code = data.error?.code ?? code;
-    message = data.error?.message ?? "";
+    message = data.error?.message ?? message;
   } catch {
-    message = "";
   }
   return new WebhookdApiError(resp.status, code, message);
 }
@@ -171,7 +284,7 @@ function sleep(ms) {
 }
 
 // src/index.ts
-var VERSION = "0.1.0";
+var VERSION = "0.2.0";
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   DEFAULT_TOLERANCE_SECONDS,

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/signature.ts","../src/errors.ts","../src/client.ts"],"sourcesContent":["/**\n * @nimbusnexus/webhooks-sdk — the official TypeScript client for NimbusNexus Webhooks.\n *\n * - `verify` — verify an incoming webhook's HMAC signature (for subscribers).\n * - `WebhookdClient` — publish events to webhookd (for producers).\n */\nexport { DEFAULT_TOLERANCE_SECONDS, sign, verify } from \"./signature\";\nexport type { VerifyOptions } from \"./signature\";\nexport { WebhookdClient } from \"./client\";\nexport type { ClientOptions, PublishOptions, WebhookdEvent } from \"./client\";\nexport { WebhookdApiError, WebhookdError } from \"./errors\";\n\nexport const VERSION = \"0.1.0\";\n","/**\n * Verify webhookd webhook signatures.\n *\n * webhookd signs every delivery as `HMAC_SHA256(secret, \"<timestamp>.\" + rawBody)` (its default\n * timestamped mode) and sends `X-Webhook-Signature: sha256=<hex>` plus `X-Webhook-Timestamp`\n * (unix seconds). A subscriber MUST verify the signature to prove the request genuinely came from\n * webhookd and wasn't tampered with. Mirrors `delivery_core.webhook_outbox.{sign,verify}`.\n */\nimport { createHmac, timingSafeEqual } from \"node:crypto\";\n\nconst PREFIX = \"sha256=\";\nexport const DEFAULT_TOLERANCE_SECONDS = 300;\n\nfunction toBuffer(value: string | Buffer): Buffer {\n  return Buffer.isBuffer(value) ? value : Buffer.from(value, \"utf8\");\n}\n\nfunction signedBytes(rawBody: Buffer, timestamp: number | null): Buffer {\n  if (timestamp === null) return rawBody;\n  return Buffer.concat([Buffer.from(`${timestamp}.`, \"ascii\"), rawBody]);\n}\n\n/** The `sha256=<hex>` signature webhookd would send for `rawBody` (+ optional timestamp). */\nexport function sign(\n  secret: string | Buffer,\n  rawBody: string | Buffer,\n  timestamp: number | null = null,\n): string {\n  const digest = createHmac(\"sha256\", secret)\n    .update(signedBytes(toBuffer(rawBody), timestamp))\n    .digest(\"hex\");\n  return `${PREFIX}${digest}`;\n}\n\nexport interface VerifyOptions {\n  /** The `X-Webhook-Timestamp` header value. When given, the replay window is enforced — always pass it. */\n  timestamp?: number | string | null;\n  /** Replay window in seconds; webhookd's default is 300. */\n  toleranceSeconds?: number;\n  /** Override the current unix time (for tests). */\n  now?: number;\n}\n\n/**\n * Return `true` iff `signature` is a valid webhookd signature for `rawBody`.\n *\n * Pass the EXACT bytes you received as `rawBody` (a string or Buffer) — do not re-serialize the\n * JSON, or the signature won't match. Comparison is constant-time.\n */\nexport function verify(\n  secret: string | Buffer,\n  rawBody: string | Buffer,\n  signature: string,\n  opts: VerifyOptions = {},\n): boolean {\n  const { timestamp = null, toleranceSeconds = DEFAULT_TOLERANCE_SECONDS, now } = opts;\n  const ts = timestamp === null || timestamp === undefined ? null : Number(timestamp);\n  if (ts !== null) {\n    if (Number.isNaN(ts)) return false;\n    const current = now ?? Math.floor(Date.now() / 1000);\n    if (Math.abs(current - ts) > toleranceSeconds) return false;\n  }\n  const expected = Buffer.from(sign(secret, rawBody, ts));\n  const candidate = Buffer.from(signature.startsWith(PREFIX) ? signature : `${PREFIX}${signature}`);\n  // timingSafeEqual requires equal-length buffers; a length mismatch is already a non-match.\n  return expected.length === candidate.length && timingSafeEqual(expected, candidate);\n}\n","/** Base class for all webhookd SDK errors (network failures, etc.). */\nexport class WebhookdError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"WebhookdError\";\n  }\n}\n\n/**\n * A non-2xx response from the webhookd API. Carries the M5a error envelope: a stable machine\n * `code` (e.g. `\"rate_limited\"`, `\"not_found\"`, `\"validation_error\"`) and a human `message`,\n * plus the HTTP `statusCode`.\n */\nexport class WebhookdApiError extends WebhookdError {\n  readonly statusCode: number;\n  readonly code: string;\n\n  constructor(statusCode: number, code: string, message: string) {\n    super(`[${statusCode} ${code}] ${message}`);\n    this.name = \"WebhookdApiError\";\n    this.statusCode = statusCode;\n    this.code = code;\n  }\n}\n","/** Typed publish client for the webhookd API (zero runtime deps — uses the global `fetch`). */\nimport { WebhookdApiError, WebhookdError } from \"./errors\";\n\nconst RETRY_STATUSES = new Set([429, 500, 502, 503, 504]);\n\n/** The published event, as returned by `POST /v1/events` (webhookd's `EventOut`). */\nexport interface WebhookdEvent {\n  id: string;\n  eventUid: string;\n  eventType: string;\n  application: string;\n  environment: string;\n  deliveriesCreated: number;\n  source: string | null;\n}\n\nexport interface ClientOptions {\n  baseUrl: string;\n  /** A per-tenant API key (`whsk_…`) or a service token. */\n  apiKey: string;\n  timeoutMs?: number;\n  maxRetries?: number;\n  /** Inject a `fetch` implementation (defaults to the global `fetch`); used for tests. */\n  fetchImpl?: typeof fetch;\n}\n\nexport interface PublishOptions {\n  environment?: string;\n  application?: string;\n  source?: string;\n  /** Makes the publish safe to retry — a replay returns the original event without re-fanning-out. */\n  idempotencyKey?: string;\n}\n\nexport class WebhookdClient {\n  private readonly baseUrl: string;\n  private readonly apiKey: string;\n  private readonly timeoutMs: number;\n  private readonly maxRetries: number;\n  private readonly fetchImpl: typeof fetch;\n\n  constructor(opts: ClientOptions) {\n    this.baseUrl = opts.baseUrl.replace(/\\/+$/, \"\");\n    this.apiKey = opts.apiKey;\n    this.timeoutMs = opts.timeoutMs ?? 10_000;\n    this.maxRetries = opts.maxRetries ?? 2;\n    this.fetchImpl = opts.fetchImpl ?? fetch;\n  }\n\n  async publish(\n    eventType: string,\n    payload: Record<string, unknown>,\n    opts: PublishOptions = {},\n  ): Promise<WebhookdEvent> {\n    const body: Record<string, unknown> = {\n      event_type: eventType,\n      payload,\n      environment: opts.environment ?? \"prod\",\n      application: opts.application ?? \"default\",\n    };\n    if (opts.source !== undefined) body.source = opts.source;\n\n    const headers: Record<string, string> = {\n      \"Content-Type\": \"application/json\",\n      Authorization: `Bearer ${this.apiKey}`,\n    };\n    if (opts.idempotencyKey !== undefined) headers[\"Idempotency-Key\"] = opts.idempotencyKey;\n\n    const resp = await this.post(\"/v1/events\", JSON.stringify(body), headers);\n    const data = (await resp.json()) as Record<string, unknown>;\n    return {\n      id: String(data.id),\n      eventUid: String(data.event_uid),\n      eventType: String(data.event_type),\n      application: String(data.application ?? \"default\"),\n      environment: String(data.environment ?? \"prod\"),\n      deliveriesCreated: Number(data.deliveries_created ?? 0),\n      source: (data.source as string | null) ?? null,\n    };\n  }\n\n  private async post(\n    path: string,\n    body: string,\n    headers: Record<string, string>,\n  ): Promise<Response> {\n    const url = `${this.baseUrl}${path}`;\n    let lastErr: unknown;\n    for (let attempt = 0; attempt <= this.maxRetries; attempt++) {\n      let resp: Response;\n      try {\n        resp = await this.fetchImpl(url, {\n          method: \"POST\",\n          headers,\n          body,\n          signal: AbortSignal.timeout(this.timeoutMs),\n        });\n      } catch (err) {\n        lastErr = err;\n        if (attempt < this.maxRetries) {\n          await sleep(backoffMs(attempt));\n          continue;\n        }\n        throw new WebhookdError(`request failed: ${String(err)}`);\n      }\n\n      if (RETRY_STATUSES.has(resp.status) && attempt < this.maxRetries) {\n        await sleep(retryAfterMs(resp) ?? backoffMs(attempt));\n        continue;\n      }\n      if (resp.status >= 400) throw await apiError(resp);\n      return resp;\n    }\n    throw new WebhookdError(`request failed after retries: ${String(lastErr)}`);\n  }\n}\n\nfunction backoffMs(attempt: number): number {\n  return Math.min(2000, 200 * 2 ** attempt);\n}\n\nfunction retryAfterMs(resp: Response): number | null {\n  const raw = resp.headers.get(\"Retry-After\");\n  if (raw && /^\\d+$/.test(raw)) return Number(raw) * 1000;\n  return null;\n}\n\nasync function apiError(resp: Response): Promise<WebhookdApiError> {\n  let code = \"error\";\n  let message = \"\";\n  try {\n    const data = (await resp.json()) as { error?: { code?: string; message?: string } };\n    code = data.error?.code ?? code;\n    message = data.error?.message ?? \"\";\n  } catch {\n    message = \"\";\n  }\n  return new WebhookdApiError(resp.status, code, message);\n}\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACQA,yBAA4C;AAE5C,IAAM,SAAS;AACR,IAAM,4BAA4B;AAEzC,SAAS,SAAS,OAAgC;AAChD,SAAO,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,OAAO,MAAM;AACnE;AAEA,SAAS,YAAY,SAAiB,WAAkC;AACtE,MAAI,cAAc,KAAM,QAAO;AAC/B,SAAO,OAAO,OAAO,CAAC,OAAO,KAAK,GAAG,SAAS,KAAK,OAAO,GAAG,OAAO,CAAC;AACvE;AAGO,SAAS,KACd,QACA,SACA,YAA2B,MACnB;AACR,QAAM,aAAS,+BAAW,UAAU,MAAM,EACvC,OAAO,YAAY,SAAS,OAAO,GAAG,SAAS,CAAC,EAChD,OAAO,KAAK;AACf,SAAO,GAAG,MAAM,GAAG,MAAM;AAC3B;AAiBO,SAAS,OACd,QACA,SACA,WACA,OAAsB,CAAC,GACd;AACT,QAAM,EAAE,YAAY,MAAM,mBAAmB,2BAA2B,IAAI,IAAI;AAChF,QAAM,KAAK,cAAc,QAAQ,cAAc,SAAY,OAAO,OAAO,SAAS;AAClF,MAAI,OAAO,MAAM;AACf,QAAI,OAAO,MAAM,EAAE,EAAG,QAAO;AAC7B,UAAM,UAAU,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACnD,QAAI,KAAK,IAAI,UAAU,EAAE,IAAI,iBAAkB,QAAO;AAAA,EACxD;AACA,QAAM,WAAW,OAAO,KAAK,KAAK,QAAQ,SAAS,EAAE,CAAC;AACtD,QAAM,YAAY,OAAO,KAAK,UAAU,WAAW,MAAM,IAAI,YAAY,GAAG,MAAM,GAAG,SAAS,EAAE;AAEhG,SAAO,SAAS,WAAW,UAAU,cAAU,oCAAgB,UAAU,SAAS;AACpF;;;ACjEO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EACvC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAOO,IAAM,mBAAN,cAA+B,cAAc;AAAA,EACzC;AAAA,EACA;AAAA,EAET,YAAY,YAAoB,MAAc,SAAiB;AAC7D,UAAM,IAAI,UAAU,IAAI,IAAI,KAAK,OAAO,EAAE;AAC1C,SAAK,OAAO;AACZ,SAAK,aAAa;AAClB,SAAK,OAAO;AAAA,EACd;AACF;;;ACpBA,IAAM,iBAAiB,oBAAI,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AA+BjD,IAAM,iBAAN,MAAqB;AAAA,EACT;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,MAAqB;AAC/B,SAAK,UAAU,KAAK,QAAQ,QAAQ,QAAQ,EAAE;AAC9C,SAAK,SAAS,KAAK;AACnB,SAAK,YAAY,KAAK,aAAa;AACnC,SAAK,aAAa,KAAK,cAAc;AACrC,SAAK,YAAY,KAAK,aAAa;AAAA,EACrC;AAAA,EAEA,MAAM,QACJ,WACA,SACA,OAAuB,CAAC,GACA;AACxB,UAAM,OAAgC;AAAA,MACpC,YAAY;AAAA,MACZ;AAAA,MACA,aAAa,KAAK,eAAe;AAAA,MACjC,aAAa,KAAK,eAAe;AAAA,IACnC;AACA,QAAI,KAAK,WAAW,OAAW,MAAK,SAAS,KAAK;AAElD,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,eAAe,UAAU,KAAK,MAAM;AAAA,IACtC;AACA,QAAI,KAAK,mBAAmB,OAAW,SAAQ,iBAAiB,IAAI,KAAK;AAEzE,UAAM,OAAO,MAAM,KAAK,KAAK,cAAc,KAAK,UAAU,IAAI,GAAG,OAAO;AACxE,UAAM,OAAQ,MAAM,KAAK,KAAK;AAC9B,WAAO;AAAA,MACL,IAAI,OAAO,KAAK,EAAE;AAAA,MAClB,UAAU,OAAO,KAAK,SAAS;AAAA,MAC/B,WAAW,OAAO,KAAK,UAAU;AAAA,MACjC,aAAa,OAAO,KAAK,eAAe,SAAS;AAAA,MACjD,aAAa,OAAO,KAAK,eAAe,MAAM;AAAA,MAC9C,mBAAmB,OAAO,KAAK,sBAAsB,CAAC;AAAA,MACtD,QAAS,KAAK,UAA4B;AAAA,IAC5C;AAAA,EACF;AAAA,EAEA,MAAc,KACZ,MACA,MACA,SACmB;AACnB,UAAM,MAAM,GAAG,KAAK,OAAO,GAAG,IAAI;AAClC,QAAI;AACJ,aAAS,UAAU,GAAG,WAAW,KAAK,YAAY,WAAW;AAC3D,UAAI;AACJ,UAAI;AACF,eAAO,MAAM,KAAK,UAAU,KAAK;AAAA,UAC/B,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,UACA,QAAQ,YAAY,QAAQ,KAAK,SAAS;AAAA,QAC5C,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,kBAAU;AACV,YAAI,UAAU,KAAK,YAAY;AAC7B,gBAAM,MAAM,UAAU,OAAO,CAAC;AAC9B;AAAA,QACF;AACA,cAAM,IAAI,cAAc,mBAAmB,OAAO,GAAG,CAAC,EAAE;AAAA,MAC1D;AAEA,UAAI,eAAe,IAAI,KAAK,MAAM,KAAK,UAAU,KAAK,YAAY;AAChE,cAAM,MAAM,aAAa,IAAI,KAAK,UAAU,OAAO,CAAC;AACpD;AAAA,MACF;AACA,UAAI,KAAK,UAAU,IAAK,OAAM,MAAM,SAAS,IAAI;AACjD,aAAO;AAAA,IACT;AACA,UAAM,IAAI,cAAc,iCAAiC,OAAO,OAAO,CAAC,EAAE;AAAA,EAC5E;AACF;AAEA,SAAS,UAAU,SAAyB;AAC1C,SAAO,KAAK,IAAI,KAAM,MAAM,KAAK,OAAO;AAC1C;AAEA,SAAS,aAAa,MAA+B;AACnD,QAAM,MAAM,KAAK,QAAQ,IAAI,aAAa;AAC1C,MAAI,OAAO,QAAQ,KAAK,GAAG,EAAG,QAAO,OAAO,GAAG,IAAI;AACnD,SAAO;AACT;AAEA,eAAe,SAAS,MAA2C;AACjE,MAAI,OAAO;AACX,MAAI,UAAU;AACd,MAAI;AACF,UAAM,OAAQ,MAAM,KAAK,KAAK;AAC9B,WAAO,KAAK,OAAO,QAAQ;AAC3B,cAAU,KAAK,OAAO,WAAW;AAAA,EACnC,QAAQ;AACN,cAAU;AAAA,EACZ;AACA,SAAO,IAAI,iBAAiB,KAAK,QAAQ,MAAM,OAAO;AACxD;AAEA,SAAS,MAAM,IAA2B;AACxC,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AACzD;;;AHlIO,IAAM,UAAU;","names":[]}
+{"version":3,"sources":["../src/index.ts","../src/signature.ts","../src/errors.ts","../src/client.ts"],"sourcesContent":["/**\n * @nimbusnexus/webhooks-sdk — the official TypeScript client for NimbusNexus Webhooks.\n *\n * - `verify` — verify an incoming webhook's HMAC signature (for subscribers).\n * - `WebhookdClient` — publish events to webhookd (for producers).\n */\nexport { DEFAULT_TOLERANCE_SECONDS, sign, verify } from \"./signature\";\nexport type { VerifyOptions } from \"./signature\";\nexport { WebhookdClient } from \"./client\";\nexport type {\n  ClientOptions,\n  PublishOptions,\n  WebhookdEvent,\n  Subscription,\n  Endpoint,\n  ApiKey,\n  Delivery,\n  Page,\n  CreateEndpointOptions,\n  ListEndpointsOptions,\n  EndpointPatch,\n  CreateApiKeyOptions,\n  ListDeliveriesOptions,\n} from \"./client\";\nexport { WebhookdApiError, WebhookdError } from \"./errors\";\n\n// Keep in lockstep with package.json + the release tag (see publish.yml's bump checklist).\nexport const VERSION = \"0.2.0\";\n","/**\n * Verify webhookd webhook signatures.\n *\n * webhookd signs every delivery as `HMAC_SHA256(secret, \"<timestamp>.\" + rawBody)` (its default\n * timestamped mode) and sends `X-Webhook-Signature: sha256=<hex>` plus `X-Webhook-Timestamp`\n * (unix seconds). A subscriber MUST verify the signature to prove the request genuinely came from\n * webhookd and wasn't tampered with. Mirrors `delivery_core.webhook_outbox.{sign,verify}`.\n */\nimport { createHmac, timingSafeEqual } from \"node:crypto\";\n\nconst PREFIX = \"sha256=\";\nexport const DEFAULT_TOLERANCE_SECONDS = 300;\n\nfunction toBuffer(value: string | Buffer): Buffer {\n  return Buffer.isBuffer(value) ? value : Buffer.from(value, \"utf8\");\n}\n\nfunction signedBytes(rawBody: Buffer, timestamp: number | null): Buffer {\n  if (timestamp === null) return rawBody;\n  return Buffer.concat([Buffer.from(`${timestamp}.`, \"ascii\"), rawBody]);\n}\n\n/** The `sha256=<hex>` signature webhookd would send for `rawBody` (+ optional timestamp). */\nexport function sign(\n  secret: string | Buffer,\n  rawBody: string | Buffer,\n  timestamp: number | null = null,\n): string {\n  const digest = createHmac(\"sha256\", secret)\n    .update(signedBytes(toBuffer(rawBody), timestamp))\n    .digest(\"hex\");\n  return `${PREFIX}${digest}`;\n}\n\nexport interface VerifyOptions {\n  /** The `X-Webhook-Timestamp` header value. When given, the replay window is enforced — always pass it. */\n  timestamp?: number | string | null;\n  /** Replay window in seconds; webhookd's default is 300. */\n  toleranceSeconds?: number;\n  /** Override the current unix time (for tests). */\n  now?: number;\n}\n\n/**\n * Return `true` iff `signature` is a valid webhookd signature for `rawBody`.\n *\n * Pass the EXACT bytes you received as `rawBody` (a string or Buffer) — do not re-serialize the\n * JSON, or the signature won't match. Comparison is constant-time.\n */\nexport function verify(\n  secret: string | Buffer,\n  rawBody: string | Buffer,\n  signature: string,\n  opts: VerifyOptions = {},\n): boolean {\n  const { timestamp = null, toleranceSeconds = DEFAULT_TOLERANCE_SECONDS, now } = opts;\n  const ts = timestamp === null || timestamp === undefined ? null : Number(timestamp);\n  if (ts !== null) {\n    if (Number.isNaN(ts)) return false;\n    const current = now ?? Math.floor(Date.now() / 1000);\n    if (Math.abs(current - ts) > toleranceSeconds) return false;\n  }\n  const expected = Buffer.from(sign(secret, rawBody, ts));\n  // X-Webhook-Signature carries one token normally, or several comma-separated tokens during a\n  // signing-secret rotation (webhookd dual-sign overlap) — accept if ANY token verifies, so a\n  // subscriber configured with EITHER the current or the previous secret keeps working.\n  for (const raw of signature.split(\",\")) {\n    const token = raw.trim();\n    const candidate = Buffer.from(token.startsWith(PREFIX) ? token : `${PREFIX}${token}`);\n    // timingSafeEqual requires equal-length buffers; a length mismatch is already a non-match.\n    if (expected.length === candidate.length && timingSafeEqual(expected, candidate)) return true;\n  }\n  return false;\n}\n","/** Base class for all webhookd SDK errors (network failures, etc.). */\nexport class WebhookdError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"WebhookdError\";\n  }\n}\n\n/**\n * A non-2xx response from the webhookd API. Carries the M5a error envelope: a stable machine\n * `code` (e.g. `\"rate_limited\"`, `\"not_found\"`, `\"validation_error\"`) and a human `message`,\n * plus the HTTP `statusCode`.\n */\nexport class WebhookdApiError extends WebhookdError {\n  readonly statusCode: number;\n  readonly code: string;\n\n  constructor(statusCode: number, code: string, message: string) {\n    super(`[${statusCode} ${code}] ${message}`);\n    this.name = \"WebhookdApiError\";\n    this.statusCode = statusCode;\n    this.code = code;\n  }\n}\n","/** Typed publish + management client for the webhookd API (zero runtime deps — uses the global `fetch`). */\nimport { WebhookdApiError, WebhookdError } from \"./errors\";\n\nconst RETRY_STATUSES = new Set([429, 500, 502, 503, 504]);\n\n/** The published event, as returned by `POST /v1/events` (webhookd's `EventOut`). */\nexport interface WebhookdEvent {\n  id: string;\n  eventUid: string;\n  eventType: string;\n  application: string;\n  environment: string;\n  deliveriesCreated: number;\n  source: string | null;\n}\n\n/** A subscription filter attached to an endpoint. */\nexport interface Subscription {\n  match_kind: \"exact\" | \"prefix\" | \"suffix\" | \"all\";\n  pattern: string;\n}\n\n/**\n * An endpoint, as returned by the management endpoints (webhookd's `EndpointOut`).\n * Fields mirror the server's snake_case wire shape verbatim. `secret` is present ONLY on the\n * create + rotate-secret responses (returned exactly once).\n */\nexport interface Endpoint {\n  id: string;\n  url: string;\n  environment: string;\n  application: string;\n  status: string;\n  subscriptions: Subscription[];\n  /** The signing secret — returned ONCE, on create + rotate-secret only. */\n  secret?: string;\n  max_attempts?: number;\n  retry_schedule?: number[];\n  description?: string | null;\n  custom_headers?: Record<string, string> | null;\n  delivery_timeout_ms?: number | null;\n  created_at?: string;\n  updated_at?: string;\n}\n\n/**\n * An API key, as returned by `POST /v1/api-keys` (webhookd's `ApiKeyOut`). `key` is present ONLY on\n * the create response (returned exactly once).\n */\nexport interface ApiKey {\n  id: string;\n  name: string;\n  scope: string;\n  /** The raw key — returned ONCE, on create only. */\n  key?: string;\n  created_at?: string;\n  expires_at?: string | null;\n}\n\n/** A delivery attempt record, as returned by the deliveries endpoints (webhookd's `DeliveryOut`). */\nexport interface Delivery {\n  id: string;\n  endpoint_id: string;\n  event_id?: string;\n  event_type?: string;\n  status: string;\n  attempts?: number;\n  created_at?: string;\n  updated_at?: string;\n}\n\n/** A single page of a list endpoint — items plus the cursor for the next page (`null` at the end). */\nexport interface Page<T> {\n  items: T[];\n  next_offset: number | null;\n}\n\nexport interface ClientOptions {\n  baseUrl: string;\n  /** A per-tenant API key (`whsk_…`) or a service token. */\n  apiKey: string;\n  timeoutMs?: number;\n  maxRetries?: number;\n  /** Inject a `fetch` implementation (defaults to the global `fetch`); used for tests. */\n  fetchImpl?: typeof fetch;\n}\n\nexport interface PublishOptions {\n  environment?: string;\n  application?: string;\n  source?: string;\n  /** Makes the publish safe to retry — a replay returns the original event without re-fanning-out. */\n  idempotencyKey?: string;\n}\n\nexport interface CreateEndpointOptions {\n  environment?: string;\n  subscriptions?: Subscription[];\n  application?: string;\n  secret?: string;\n  maxAttempts?: number;\n  retrySchedule?: number[];\n  description?: string;\n  customHeaders?: Record<string, string>;\n  deliveryTimeoutMs?: number;\n}\n\nexport interface ListEndpointsOptions {\n  environment?: string;\n  offset?: number;\n  limit?: number;\n}\n\n/**\n * A raw PATCH mapping for `updateEndpoint`, keyed with the server's snake_case names. PATCH semantics:\n * an OMITTED key is left unchanged; an explicit `null` CLEARS the field. The object is sent verbatim.\n */\nexport interface EndpointPatch {\n  url?: string;\n  max_attempts?: number | null;\n  retry_schedule?: number[] | null;\n  status?: \"enabled\" | \"disabled\";\n  description?: string | null;\n  custom_headers?: Record<string, string> | null;\n  delivery_timeout_ms?: number | null;\n}\n\nexport interface CreateApiKeyOptions {\n  name?: string;\n  scope?: \"admin\" | \"publish\";\n  expiresInDays?: number;\n}\n\nexport interface ListDeliveriesOptions {\n  status?: \"queued\" | \"sending\" | \"sent\" | \"failed\" | \"dead\";\n  endpointId?: string;\n  eventType?: string;\n  since?: string | number;\n  until?: string | number;\n  q?: string;\n  offset?: number;\n  limit?: number;\n}\n\ninterface RequestOptions {\n  /** JSON body to send; omitted for GET/DELETE and bodyless POSTs (no `Content-Type` is set). */\n  body?: unknown;\n  /** Query params; `undefined`/`null` values are dropped so only provided params are sent. */\n  query?: Record<string, unknown>;\n  /** Extra request headers (e.g. `Idempotency-Key`). */\n  headers?: Record<string, string>;\n}\n\nexport class WebhookdClient {\n  private readonly baseUrl: string;\n  private readonly apiKey: string;\n  private readonly timeoutMs: number;\n  private readonly maxRetries: number;\n  private readonly fetchImpl: typeof fetch;\n\n  constructor(opts: ClientOptions) {\n    this.baseUrl = opts.baseUrl.replace(/\\/+$/, \"\");\n    this.apiKey = opts.apiKey;\n    this.timeoutMs = opts.timeoutMs ?? 10_000;\n    this.maxRetries = opts.maxRetries ?? 2;\n    this.fetchImpl = opts.fetchImpl ?? fetch;\n  }\n\n  async publish(\n    eventType: string,\n    payload: Record<string, unknown>,\n    opts: PublishOptions = {},\n  ): Promise<WebhookdEvent> {\n    const body: Record<string, unknown> = {\n      event_type: eventType,\n      payload,\n      environment: opts.environment ?? \"prod\",\n      application: opts.application ?? \"default\",\n    };\n    if (opts.source !== undefined) body.source = opts.source;\n\n    const headers: Record<string, string> = {};\n    if (opts.idempotencyKey !== undefined) headers[\"Idempotency-Key\"] = opts.idempotencyKey;\n\n    const resp = await this.request(\"POST\", \"/v1/events\", { body, headers });\n    const data = (await resp.json()) as Record<string, unknown>;\n    return {\n      id: String(data.id),\n      eventUid: String(data.event_uid),\n      eventType: String(data.event_type),\n      application: String(data.application ?? \"default\"),\n      environment: String(data.environment ?? \"prod\"),\n      deliveriesCreated: Number(data.deliveries_created ?? 0),\n      source: (data.source as string | null) ?? null,\n    };\n  }\n\n  // ── Endpoints ──────────────────────────────────────────────────────────────\n\n  /** Create an endpoint. The response includes the signing `secret` exactly once — persist it. */\n  async createEndpoint(url: string, opts: CreateEndpointOptions = {}): Promise<Endpoint> {\n    const body: Record<string, unknown> = {\n      url,\n      environment: opts.environment ?? \"prod\",\n      application: opts.application ?? \"default\",\n    };\n    if (opts.subscriptions !== undefined) body.subscriptions = opts.subscriptions;\n    if (opts.secret !== undefined) body.secret = opts.secret;\n    if (opts.maxAttempts !== undefined) body.max_attempts = opts.maxAttempts;\n    if (opts.retrySchedule !== undefined) body.retry_schedule = opts.retrySchedule;\n    if (opts.description !== undefined) body.description = opts.description;\n    if (opts.customHeaders !== undefined) body.custom_headers = opts.customHeaders;\n    if (opts.deliveryTimeoutMs !== undefined) body.delivery_timeout_ms = opts.deliveryTimeoutMs;\n    return this.requestJson<Endpoint>(\"POST\", \"/v1/endpoints\", { body });\n  }\n\n  /** List endpoints for an environment (defaults to `prod`). */\n  async listEndpoints(opts: ListEndpointsOptions = {}): Promise<Page<Endpoint>> {\n    const query: Record<string, unknown> = { environment: opts.environment ?? \"prod\" };\n    if (opts.offset !== undefined) query.offset = opts.offset;\n    if (opts.limit !== undefined) query.limit = opts.limit;\n    return this.requestJson<Page<Endpoint>>(\"GET\", \"/v1/endpoints\", { query });\n  }\n\n  /** Fetch a single endpoint by id. */\n  async getEndpoint(id: string): Promise<Endpoint> {\n    return this.requestJson<Endpoint>(\"GET\", `/v1/endpoints/${encodeURIComponent(id)}`);\n  }\n\n  /**\n   * Partially update an endpoint. `patch` is sent verbatim (snake_case keys): an omitted key is left\n   * unchanged, an explicit `null` clears the field. No defaults are injected.\n   */\n  async updateEndpoint(id: string, patch: EndpointPatch): Promise<Endpoint> {\n    return this.requestJson<Endpoint>(\"PATCH\", `/v1/endpoints/${encodeURIComponent(id)}`, {\n      body: patch,\n    });\n  }\n\n  /** Delete an endpoint. Returns nothing (the server replies `204 No Content`). */\n  async deleteEndpoint(id: string): Promise<void> {\n    await this.request(\"DELETE\", `/v1/endpoints/${encodeURIComponent(id)}`);\n  }\n\n  /** Rotate an endpoint's signing secret. The response includes the new `secret` exactly once. */\n  async rotateEndpointSecret(id: string): Promise<Endpoint> {\n    return this.requestJson<Endpoint>(\"POST\", `/v1/endpoints/${encodeURIComponent(id)}/rotate-secret`);\n  }\n\n  /** Re-enable an endpoint that webhookd auto-disabled after repeated delivery failures. */\n  async enableEndpoint(id: string): Promise<Endpoint> {\n    return this.requestJson<Endpoint>(\"POST\", `/v1/endpoints/${encodeURIComponent(id)}/enable`);\n  }\n\n  // ── API keys ───────────────────────────────────────────────────────────────\n\n  /** Create an API key. The response includes the raw `key` exactly once — persist it. */\n  async createApiKey(opts: CreateApiKeyOptions = {}): Promise<ApiKey> {\n    const body: Record<string, unknown> = {\n      name: opts.name ?? \"\",\n      scope: opts.scope ?? \"admin\",\n    };\n    if (opts.expiresInDays !== undefined) body.expires_in_days = opts.expiresInDays;\n    return this.requestJson<ApiKey>(\"POST\", \"/v1/api-keys\", { body });\n  }\n\n  /** Revoke an API key. Returns nothing (the server replies `204 No Content`). */\n  async revokeApiKey(id: string): Promise<void> {\n    await this.request(\"DELETE\", `/v1/api-keys/${encodeURIComponent(id)}`);\n  }\n\n  // ── Deliveries ─────────────────────────────────────────────────────────────\n\n  /** List deliveries. Only the filters you provide are sent as query params. */\n  async listDeliveries(opts: ListDeliveriesOptions = {}): Promise<Page<Delivery>> {\n    const query: Record<string, unknown> = {};\n    if (opts.status !== undefined) query.status = opts.status;\n    if (opts.endpointId !== undefined) query.endpoint_id = opts.endpointId;\n    if (opts.eventType !== undefined) query.event_type = opts.eventType;\n    if (opts.since !== undefined) query.since = opts.since;\n    if (opts.until !== undefined) query.until = opts.until;\n    if (opts.q !== undefined) query.q = opts.q;\n    if (opts.offset !== undefined) query.offset = opts.offset;\n    if (opts.limit !== undefined) query.limit = opts.limit;\n    return this.requestJson<Page<Delivery>>(\"GET\", \"/v1/deliveries\", { query });\n  }\n\n  /** Re-queue a delivery for another attempt. */\n  async redeliver(deliveryId: string): Promise<Delivery> {\n    return this.requestJson<Delivery>(\n      \"POST\",\n      `/v1/deliveries/${encodeURIComponent(deliveryId)}/redeliver`,\n    );\n  }\n\n  // ── Internals ──────────────────────────────────────────────────────────────\n\n  /** Issue a request and parse the JSON response as `T`. Never use for 204s (there's no body). */\n  private async requestJson<T>(\n    method: string,\n    path: string,\n    opts: RequestOptions = {},\n  ): Promise<T> {\n    const resp = await this.request(method, path, opts);\n    return (await resp.json()) as T;\n  }\n\n  /**\n   * The single request path used by every method: builds the URL (+ query), attaches auth, and runs\n   * the shared retry loop (connection errors + 429 honoring Retry-After + 5xx, capped exponential\n   * backoff), raising a typed {@link WebhookdApiError} on other 4xx/5xx. The caller reads the body.\n   */\n  private async request(\n    method: string,\n    path: string,\n    opts: RequestOptions = {},\n  ): Promise<Response> {\n    let url = `${this.baseUrl}${path}`;\n    if (opts.query) {\n      const qs = new URLSearchParams();\n      for (const [key, value] of Object.entries(opts.query)) {\n        if (value !== undefined && value !== null) qs.append(key, String(value));\n      }\n      const suffix = qs.toString();\n      if (suffix) url += `?${suffix}`;\n    }\n\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${this.apiKey}`,\n      ...opts.headers,\n    };\n    let body: string | undefined;\n    if (opts.body !== undefined) {\n      body = JSON.stringify(opts.body);\n      headers[\"Content-Type\"] = \"application/json\";\n    }\n\n    let lastErr: unknown;\n    for (let attempt = 0; attempt <= this.maxRetries; attempt++) {\n      let resp: Response;\n      try {\n        resp = await this.fetchImpl(url, {\n          method,\n          headers,\n          body,\n          signal: AbortSignal.timeout(this.timeoutMs),\n        });\n      } catch (err) {\n        lastErr = err;\n        if (attempt < this.maxRetries) {\n          await sleep(backoffMs(attempt));\n          continue;\n        }\n        throw new WebhookdError(`request failed: ${String(err)}`);\n      }\n\n      if (RETRY_STATUSES.has(resp.status) && attempt < this.maxRetries) {\n        await sleep(retryAfterMs(resp) ?? backoffMs(attempt));\n        continue;\n      }\n      if (resp.status >= 400) throw await apiError(resp);\n      return resp;\n    }\n    throw new WebhookdError(`request failed after retries: ${String(lastErr)}`);\n  }\n}\n\nfunction backoffMs(attempt: number): number {\n  return Math.min(2000, 200 * 2 ** attempt);\n}\n\nfunction retryAfterMs(resp: Response): number | null {\n  const raw = resp.headers.get(\"Retry-After\");\n  if (raw && /^\\d+$/.test(raw)) return Number(raw) * 1000;\n  return null;\n}\n\nasync function apiError(resp: Response): Promise<WebhookdApiError> {\n  // Read the body once; a non-envelope (or non-JSON) error body falls back to the raw text.\n  const text = await resp.text();\n  let code = \"error\";\n  let message = text;\n  try {\n    const data = JSON.parse(text) as { error?: { code?: string; message?: string } };\n    code = data.error?.code ?? code;\n    message = data.error?.message ?? message;\n  } catch {\n    // not JSON — keep the raw text as the message\n  }\n  return new WebhookdApiError(resp.status, code, message);\n}\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACQA,yBAA4C;AAE5C,IAAM,SAAS;AACR,IAAM,4BAA4B;AAEzC,SAAS,SAAS,OAAgC;AAChD,SAAO,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,OAAO,MAAM;AACnE;AAEA,SAAS,YAAY,SAAiB,WAAkC;AACtE,MAAI,cAAc,KAAM,QAAO;AAC/B,SAAO,OAAO,OAAO,CAAC,OAAO,KAAK,GAAG,SAAS,KAAK,OAAO,GAAG,OAAO,CAAC;AACvE;AAGO,SAAS,KACd,QACA,SACA,YAA2B,MACnB;AACR,QAAM,aAAS,+BAAW,UAAU,MAAM,EACvC,OAAO,YAAY,SAAS,OAAO,GAAG,SAAS,CAAC,EAChD,OAAO,KAAK;AACf,SAAO,GAAG,MAAM,GAAG,MAAM;AAC3B;AAiBO,SAAS,OACd,QACA,SACA,WACA,OAAsB,CAAC,GACd;AACT,QAAM,EAAE,YAAY,MAAM,mBAAmB,2BAA2B,IAAI,IAAI;AAChF,QAAM,KAAK,cAAc,QAAQ,cAAc,SAAY,OAAO,OAAO,SAAS;AAClF,MAAI,OAAO,MAAM;AACf,QAAI,OAAO,MAAM,EAAE,EAAG,QAAO;AAC7B,UAAM,UAAU,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACnD,QAAI,KAAK,IAAI,UAAU,EAAE,IAAI,iBAAkB,QAAO;AAAA,EACxD;AACA,QAAM,WAAW,OAAO,KAAK,KAAK,QAAQ,SAAS,EAAE,CAAC;AAItD,aAAW,OAAO,UAAU,MAAM,GAAG,GAAG;AACtC,UAAM,QAAQ,IAAI,KAAK;AACvB,UAAM,YAAY,OAAO,KAAK,MAAM,WAAW,MAAM,IAAI,QAAQ,GAAG,MAAM,GAAG,KAAK,EAAE;AAEpF,QAAI,SAAS,WAAW,UAAU,cAAU,oCAAgB,UAAU,SAAS,EAAG,QAAO;AAAA,EAC3F;AACA,SAAO;AACT;;;ACxEO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EACvC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAOO,IAAM,mBAAN,cAA+B,cAAc;AAAA,EACzC;AAAA,EACA;AAAA,EAET,YAAY,YAAoB,MAAc,SAAiB;AAC7D,UAAM,IAAI,UAAU,IAAI,IAAI,KAAK,OAAO,EAAE;AAC1C,SAAK,OAAO;AACZ,SAAK,aAAa;AAClB,SAAK,OAAO;AAAA,EACd;AACF;;;ACpBA,IAAM,iBAAiB,oBAAI,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AAsJjD,IAAM,iBAAN,MAAqB;AAAA,EACT;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,MAAqB;AAC/B,SAAK,UAAU,KAAK,QAAQ,QAAQ,QAAQ,EAAE;AAC9C,SAAK,SAAS,KAAK;AACnB,SAAK,YAAY,KAAK,aAAa;AACnC,SAAK,aAAa,KAAK,cAAc;AACrC,SAAK,YAAY,KAAK,aAAa;AAAA,EACrC;AAAA,EAEA,MAAM,QACJ,WACA,SACA,OAAuB,CAAC,GACA;AACxB,UAAM,OAAgC;AAAA,MACpC,YAAY;AAAA,MACZ;AAAA,MACA,aAAa,KAAK,eAAe;AAAA,MACjC,aAAa,KAAK,eAAe;AAAA,IACnC;AACA,QAAI,KAAK,WAAW,OAAW,MAAK,SAAS,KAAK;AAElD,UAAM,UAAkC,CAAC;AACzC,QAAI,KAAK,mBAAmB,OAAW,SAAQ,iBAAiB,IAAI,KAAK;AAEzE,UAAM,OAAO,MAAM,KAAK,QAAQ,QAAQ,cAAc,EAAE,MAAM,QAAQ,CAAC;AACvE,UAAM,OAAQ,MAAM,KAAK,KAAK;AAC9B,WAAO;AAAA,MACL,IAAI,OAAO,KAAK,EAAE;AAAA,MAClB,UAAU,OAAO,KAAK,SAAS;AAAA,MAC/B,WAAW,OAAO,KAAK,UAAU;AAAA,MACjC,aAAa,OAAO,KAAK,eAAe,SAAS;AAAA,MACjD,aAAa,OAAO,KAAK,eAAe,MAAM;AAAA,MAC9C,mBAAmB,OAAO,KAAK,sBAAsB,CAAC;AAAA,MACtD,QAAS,KAAK,UAA4B;AAAA,IAC5C;AAAA,EACF;AAAA;AAAA;AAAA,EAKA,MAAM,eAAe,KAAa,OAA8B,CAAC,GAAsB;AACrF,UAAM,OAAgC;AAAA,MACpC;AAAA,MACA,aAAa,KAAK,eAAe;AAAA,MACjC,aAAa,KAAK,eAAe;AAAA,IACnC;AACA,QAAI,KAAK,kBAAkB,OAAW,MAAK,gBAAgB,KAAK;AAChE,QAAI,KAAK,WAAW,OAAW,MAAK,SAAS,KAAK;AAClD,QAAI,KAAK,gBAAgB,OAAW,MAAK,eAAe,KAAK;AAC7D,QAAI,KAAK,kBAAkB,OAAW,MAAK,iBAAiB,KAAK;AACjE,QAAI,KAAK,gBAAgB,OAAW,MAAK,cAAc,KAAK;AAC5D,QAAI,KAAK,kBAAkB,OAAW,MAAK,iBAAiB,KAAK;AACjE,QAAI,KAAK,sBAAsB,OAAW,MAAK,sBAAsB,KAAK;AAC1E,WAAO,KAAK,YAAsB,QAAQ,iBAAiB,EAAE,KAAK,CAAC;AAAA,EACrE;AAAA;AAAA,EAGA,MAAM,cAAc,OAA6B,CAAC,GAA4B;AAC5E,UAAM,QAAiC,EAAE,aAAa,KAAK,eAAe,OAAO;AACjF,QAAI,KAAK,WAAW,OAAW,OAAM,SAAS,KAAK;AACnD,QAAI,KAAK,UAAU,OAAW,OAAM,QAAQ,KAAK;AACjD,WAAO,KAAK,YAA4B,OAAO,iBAAiB,EAAE,MAAM,CAAC;AAAA,EAC3E;AAAA;AAAA,EAGA,MAAM,YAAY,IAA+B;AAC/C,WAAO,KAAK,YAAsB,OAAO,iBAAiB,mBAAmB,EAAE,CAAC,EAAE;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,eAAe,IAAY,OAAyC;AACxE,WAAO,KAAK,YAAsB,SAAS,iBAAiB,mBAAmB,EAAE,CAAC,IAAI;AAAA,MACpF,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,eAAe,IAA2B;AAC9C,UAAM,KAAK,QAAQ,UAAU,iBAAiB,mBAAmB,EAAE,CAAC,EAAE;AAAA,EACxE;AAAA;AAAA,EAGA,MAAM,qBAAqB,IAA+B;AACxD,WAAO,KAAK,YAAsB,QAAQ,iBAAiB,mBAAmB,EAAE,CAAC,gBAAgB;AAAA,EACnG;AAAA;AAAA,EAGA,MAAM,eAAe,IAA+B;AAClD,WAAO,KAAK,YAAsB,QAAQ,iBAAiB,mBAAmB,EAAE,CAAC,SAAS;AAAA,EAC5F;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,OAA4B,CAAC,GAAoB;AAClE,UAAM,OAAgC;AAAA,MACpC,MAAM,KAAK,QAAQ;AAAA,MACnB,OAAO,KAAK,SAAS;AAAA,IACvB;AACA,QAAI,KAAK,kBAAkB,OAAW,MAAK,kBAAkB,KAAK;AAClE,WAAO,KAAK,YAAoB,QAAQ,gBAAgB,EAAE,KAAK,CAAC;AAAA,EAClE;AAAA;AAAA,EAGA,MAAM,aAAa,IAA2B;AAC5C,UAAM,KAAK,QAAQ,UAAU,gBAAgB,mBAAmB,EAAE,CAAC,EAAE;AAAA,EACvE;AAAA;AAAA;AAAA,EAKA,MAAM,eAAe,OAA8B,CAAC,GAA4B;AAC9E,UAAM,QAAiC,CAAC;AACxC,QAAI,KAAK,WAAW,OAAW,OAAM,SAAS,KAAK;AACnD,QAAI,KAAK,eAAe,OAAW,OAAM,cAAc,KAAK;AAC5D,QAAI,KAAK,cAAc,OAAW,OAAM,aAAa,KAAK;AAC1D,QAAI,KAAK,UAAU,OAAW,OAAM,QAAQ,KAAK;AACjD,QAAI,KAAK,UAAU,OAAW,OAAM,QAAQ,KAAK;AACjD,QAAI,KAAK,MAAM,OAAW,OAAM,IAAI,KAAK;AACzC,QAAI,KAAK,WAAW,OAAW,OAAM,SAAS,KAAK;AACnD,QAAI,KAAK,UAAU,OAAW,OAAM,QAAQ,KAAK;AACjD,WAAO,KAAK,YAA4B,OAAO,kBAAkB,EAAE,MAAM,CAAC;AAAA,EAC5E;AAAA;AAAA,EAGA,MAAM,UAAU,YAAuC;AACrD,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,UAAU,CAAC;AAAA,IAClD;AAAA,EACF;AAAA;AAAA;AAAA,EAKA,MAAc,YACZ,QACA,MACA,OAAuB,CAAC,GACZ;AACZ,UAAM,OAAO,MAAM,KAAK,QAAQ,QAAQ,MAAM,IAAI;AAClD,WAAQ,MAAM,KAAK,KAAK;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,QACZ,QACA,MACA,OAAuB,CAAC,GACL;AACnB,QAAI,MAAM,GAAG,KAAK,OAAO,GAAG,IAAI;AAChC,QAAI,KAAK,OAAO;AACd,YAAM,KAAK,IAAI,gBAAgB;AAC/B,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,KAAK,GAAG;AACrD,YAAI,UAAU,UAAa,UAAU,KAAM,IAAG,OAAO,KAAK,OAAO,KAAK,CAAC;AAAA,MACzE;AACA,YAAM,SAAS,GAAG,SAAS;AAC3B,UAAI,OAAQ,QAAO,IAAI,MAAM;AAAA,IAC/B;AAEA,UAAM,UAAkC;AAAA,MACtC,eAAe,UAAU,KAAK,MAAM;AAAA,MACpC,GAAG,KAAK;AAAA,IACV;AACA,QAAI;AACJ,QAAI,KAAK,SAAS,QAAW;AAC3B,aAAO,KAAK,UAAU,KAAK,IAAI;AAC/B,cAAQ,cAAc,IAAI;AAAA,IAC5B;AAEA,QAAI;AACJ,aAAS,UAAU,GAAG,WAAW,KAAK,YAAY,WAAW;AAC3D,UAAI;AACJ,UAAI;AACF,eAAO,MAAM,KAAK,UAAU,KAAK;AAAA,UAC/B;AAAA,UACA;AAAA,UACA;AAAA,UACA,QAAQ,YAAY,QAAQ,KAAK,SAAS;AAAA,QAC5C,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,kBAAU;AACV,YAAI,UAAU,KAAK,YAAY;AAC7B,gBAAM,MAAM,UAAU,OAAO,CAAC;AAC9B;AAAA,QACF;AACA,cAAM,IAAI,cAAc,mBAAmB,OAAO,GAAG,CAAC,EAAE;AAAA,MAC1D;AAEA,UAAI,eAAe,IAAI,KAAK,MAAM,KAAK,UAAU,KAAK,YAAY;AAChE,cAAM,MAAM,aAAa,IAAI,KAAK,UAAU,OAAO,CAAC;AACpD;AAAA,MACF;AACA,UAAI,KAAK,UAAU,IAAK,OAAM,MAAM,SAAS,IAAI;AACjD,aAAO;AAAA,IACT;AACA,UAAM,IAAI,cAAc,iCAAiC,OAAO,OAAO,CAAC,EAAE;AAAA,EAC5E;AACF;AAEA,SAAS,UAAU,SAAyB;AAC1C,SAAO,KAAK,IAAI,KAAM,MAAM,KAAK,OAAO;AAC1C;AAEA,SAAS,aAAa,MAA+B;AACnD,QAAM,MAAM,KAAK,QAAQ,IAAI,aAAa;AAC1C,MAAI,OAAO,QAAQ,KAAK,GAAG,EAAG,QAAO,OAAO,GAAG,IAAI;AACnD,SAAO;AACT;AAEA,eAAe,SAAS,MAA2C;AAEjE,QAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,MAAI,OAAO;AACX,MAAI,UAAU;AACd,MAAI;AACF,UAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,WAAO,KAAK,OAAO,QAAQ;AAC3B,cAAU,KAAK,OAAO,WAAW;AAAA,EACnC,QAAQ;AAAA,EAER;AACA,SAAO,IAAI,iBAAiB,KAAK,QAAQ,MAAM,OAAO;AACxD;AAEA,SAAS,MAAM,IAA2B;AACxC,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AACzD;;;AH/WO,IAAM,UAAU;","names":[]}

package/dist/index.d.cts

@@ -27,6 +27,62 @@ interface WebhookdEvent {
     deliveriesCreated: number;
     source: string | null;
 }
+/** A subscription filter attached to an endpoint. */
+interface Subscription {
+    match_kind: "exact" | "prefix" | "suffix" | "all";
+    pattern: string;
+}
+/**
+ * An endpoint, as returned by the management endpoints (webhookd's `EndpointOut`).
+ * Fields mirror the server's snake_case wire shape verbatim. `secret` is present ONLY on the
+ * create + rotate-secret responses (returned exactly once).
+ */
+interface Endpoint {
+    id: string;
+    url: string;
+    environment: string;
+    application: string;
+    status: string;
+    subscriptions: Subscription[];
+    /** The signing secret — returned ONCE, on create + rotate-secret only. */
+    secret?: string;
+    max_attempts?: number;
+    retry_schedule?: number[];
+    description?: string | null;
+    custom_headers?: Record<string, string> | null;
+    delivery_timeout_ms?: number | null;
+    created_at?: string;
+    updated_at?: string;
+}
+/**
+ * An API key, as returned by `POST /v1/api-keys` (webhookd's `ApiKeyOut`). `key` is present ONLY on
+ * the create response (returned exactly once).
+ */
+interface ApiKey {
+    id: string;
+    name: string;
+    scope: string;
+    /** The raw key — returned ONCE, on create only. */
+    key?: string;
+    created_at?: string;
+    expires_at?: string | null;
+}
+/** A delivery attempt record, as returned by the deliveries endpoints (webhookd's `DeliveryOut`). */
+interface Delivery {
+    id: string;
+    endpoint_id: string;
+    event_id?: string;
+    event_type?: string;
+    status: string;
+    attempts?: number;
+    created_at?: string;
+    updated_at?: string;
+}
+/** A single page of a list endpoint — items plus the cursor for the next page (`null` at the end). */
+interface Page<T> {
+    items: T[];
+    next_offset: number | null;
+}
 interface ClientOptions {
     baseUrl: string;
     /** A per-tenant API key (`whsk_…`) or a service token. */
@@ -43,6 +99,50 @@ interface PublishOptions {
     /** Makes the publish safe to retry — a replay returns the original event without re-fanning-out. */
     idempotencyKey?: string;
 }
+interface CreateEndpointOptions {
+    environment?: string;
+    subscriptions?: Subscription[];
+    application?: string;
+    secret?: string;
+    maxAttempts?: number;
+    retrySchedule?: number[];
+    description?: string;
+    customHeaders?: Record<string, string>;
+    deliveryTimeoutMs?: number;
+}
+interface ListEndpointsOptions {
+    environment?: string;
+    offset?: number;
+    limit?: number;
+}
+/**
+ * A raw PATCH mapping for `updateEndpoint`, keyed with the server's snake_case names. PATCH semantics:
+ * an OMITTED key is left unchanged; an explicit `null` CLEARS the field. The object is sent verbatim.
+ */
+interface EndpointPatch {
+    url?: string;
+    max_attempts?: number | null;
+    retry_schedule?: number[] | null;
+    status?: "enabled" | "disabled";
+    description?: string | null;
+    custom_headers?: Record<string, string> | null;
+    delivery_timeout_ms?: number | null;
+}
+interface CreateApiKeyOptions {
+    name?: string;
+    scope?: "admin" | "publish";
+    expiresInDays?: number;
+}
+interface ListDeliveriesOptions {
+    status?: "queued" | "sending" | "sent" | "failed" | "dead";
+    endpointId?: string;
+    eventType?: string;
+    since?: string | number;
+    until?: string | number;
+    q?: string;
+    offset?: number;
+    limit?: number;
+}
 declare class WebhookdClient {
     private readonly baseUrl;
     private readonly apiKey;
@@ -51,7 +151,39 @@ declare class WebhookdClient {
     private readonly fetchImpl;
     constructor(opts: ClientOptions);
     publish(eventType: string, payload: Record<string, unknown>, opts?: PublishOptions): Promise<WebhookdEvent>;
-    private post;
+    /** Create an endpoint. The response includes the signing `secret` exactly once — persist it. */
+    createEndpoint(url: string, opts?: CreateEndpointOptions): Promise<Endpoint>;
+    /** List endpoints for an environment (defaults to `prod`). */
+    listEndpoints(opts?: ListEndpointsOptions): Promise<Page<Endpoint>>;
+    /** Fetch a single endpoint by id. */
+    getEndpoint(id: string): Promise<Endpoint>;
+    /**
+     * Partially update an endpoint. `patch` is sent verbatim (snake_case keys): an omitted key is left
+     * unchanged, an explicit `null` clears the field. No defaults are injected.
+     */
+    updateEndpoint(id: string, patch: EndpointPatch): Promise<Endpoint>;
+    /** Delete an endpoint. Returns nothing (the server replies `204 No Content`). */
+    deleteEndpoint(id: string): Promise<void>;
+    /** Rotate an endpoint's signing secret. The response includes the new `secret` exactly once. */
+    rotateEndpointSecret(id: string): Promise<Endpoint>;
+    /** Re-enable an endpoint that webhookd auto-disabled after repeated delivery failures. */
+    enableEndpoint(id: string): Promise<Endpoint>;
+    /** Create an API key. The response includes the raw `key` exactly once — persist it. */
+    createApiKey(opts?: CreateApiKeyOptions): Promise<ApiKey>;
+    /** Revoke an API key. Returns nothing (the server replies `204 No Content`). */
+    revokeApiKey(id: string): Promise<void>;
+    /** List deliveries. Only the filters you provide are sent as query params. */
+    listDeliveries(opts?: ListDeliveriesOptions): Promise<Page<Delivery>>;
+    /** Re-queue a delivery for another attempt. */
+    redeliver(deliveryId: string): Promise<Delivery>;
+    /** Issue a request and parse the JSON response as `T`. Never use for 204s (there's no body). */
+    private requestJson;
+    /**
+     * The single request path used by every method: builds the URL (+ query), attaches auth, and runs
+     * the shared retry loop (connection errors + 429 honoring Retry-After + 5xx, capped exponential
+     * backoff), raising a typed {@link WebhookdApiError} on other 4xx/5xx. The caller reads the body.
+     */
+    private request;
 }
 
 /** Base class for all webhookd SDK errors (network failures, etc.). */
@@ -76,6 +208,6 @@ declare class WebhookdApiError extends WebhookdError {
  * - `WebhookdClient` — publish events to webhookd (for producers).
  */
 
-declare const VERSION = "0.1.0";
+declare const VERSION = "0.2.0";
 
-export { type ClientOptions, DEFAULT_TOLERANCE_SECONDS, type PublishOptions, VERSION, type VerifyOptions, WebhookdApiError, WebhookdClient, WebhookdError, type WebhookdEvent, sign, verify };
+export { type ApiKey, type ClientOptions, type CreateApiKeyOptions, type CreateEndpointOptions, DEFAULT_TOLERANCE_SECONDS, type Delivery, type Endpoint, type EndpointPatch, type ListDeliveriesOptions, type ListEndpointsOptions, type Page, type PublishOptions, type Subscription, VERSION, type VerifyOptions, WebhookdApiError, WebhookdClient, WebhookdError, type WebhookdEvent, sign, verify };

package/dist/index.d.ts

@@ -27,6 +27,62 @@ interface WebhookdEvent {
     deliveriesCreated: number;
     source: string | null;
 }
+/** A subscription filter attached to an endpoint. */
+interface Subscription {
+    match_kind: "exact" | "prefix" | "suffix" | "all";
+    pattern: string;
+}
+/**
+ * An endpoint, as returned by the management endpoints (webhookd's `EndpointOut`).
+ * Fields mirror the server's snake_case wire shape verbatim. `secret` is present ONLY on the
+ * create + rotate-secret responses (returned exactly once).
+ */
+interface Endpoint {
+    id: string;
+    url: string;
+    environment: string;
+    application: string;
+    status: string;
+    subscriptions: Subscription[];
+    /** The signing secret — returned ONCE, on create + rotate-secret only. */
+    secret?: string;
+    max_attempts?: number;
+    retry_schedule?: number[];
+    description?: string | null;
+    custom_headers?: Record<string, string> | null;
+    delivery_timeout_ms?: number | null;
+    created_at?: string;
+    updated_at?: string;
+}
+/**
+ * An API key, as returned by `POST /v1/api-keys` (webhookd's `ApiKeyOut`). `key` is present ONLY on
+ * the create response (returned exactly once).
+ */
+interface ApiKey {
+    id: string;
+    name: string;
+    scope: string;
+    /** The raw key — returned ONCE, on create only. */
+    key?: string;
+    created_at?: string;
+    expires_at?: string | null;
+}
+/** A delivery attempt record, as returned by the deliveries endpoints (webhookd's `DeliveryOut`). */
+interface Delivery {
+    id: string;
+    endpoint_id: string;
+    event_id?: string;
+    event_type?: string;
+    status: string;
+    attempts?: number;
+    created_at?: string;
+    updated_at?: string;
+}
+/** A single page of a list endpoint — items plus the cursor for the next page (`null` at the end). */
+interface Page<T> {
+    items: T[];
+    next_offset: number | null;
+}
 interface ClientOptions {
     baseUrl: string;
     /** A per-tenant API key (`whsk_…`) or a service token. */
@@ -43,6 +99,50 @@ interface PublishOptions {
     /** Makes the publish safe to retry — a replay returns the original event without re-fanning-out. */
     idempotencyKey?: string;
 }
+interface CreateEndpointOptions {
+    environment?: string;
+    subscriptions?: Subscription[];
+    application?: string;
+    secret?: string;
+    maxAttempts?: number;
+    retrySchedule?: number[];
+    description?: string;
+    customHeaders?: Record<string, string>;
+    deliveryTimeoutMs?: number;
+}
+interface ListEndpointsOptions {
+    environment?: string;
+    offset?: number;
+    limit?: number;
+}
+/**
+ * A raw PATCH mapping for `updateEndpoint`, keyed with the server's snake_case names. PATCH semantics:
+ * an OMITTED key is left unchanged; an explicit `null` CLEARS the field. The object is sent verbatim.
+ */
+interface EndpointPatch {
+    url?: string;
+    max_attempts?: number | null;
+    retry_schedule?: number[] | null;
+    status?: "enabled" | "disabled";
+    description?: string | null;
+    custom_headers?: Record<string, string> | null;
+    delivery_timeout_ms?: number | null;
+}
+interface CreateApiKeyOptions {
+    name?: string;
+    scope?: "admin" | "publish";
+    expiresInDays?: number;
+}
+interface ListDeliveriesOptions {
+    status?: "queued" | "sending" | "sent" | "failed" | "dead";
+    endpointId?: string;
+    eventType?: string;
+    since?: string | number;
+    until?: string | number;
+    q?: string;
+    offset?: number;
+    limit?: number;
+}
 declare class WebhookdClient {
     private readonly baseUrl;
     private readonly apiKey;
@@ -51,7 +151,39 @@ declare class WebhookdClient {
     private readonly fetchImpl;
     constructor(opts: ClientOptions);
     publish(eventType: string, payload: Record<string, unknown>, opts?: PublishOptions): Promise<WebhookdEvent>;
-    private post;
+    /** Create an endpoint. The response includes the signing `secret` exactly once — persist it. */
+    createEndpoint(url: string, opts?: CreateEndpointOptions): Promise<Endpoint>;
+    /** List endpoints for an environment (defaults to `prod`). */
+    listEndpoints(opts?: ListEndpointsOptions): Promise<Page<Endpoint>>;
+    /** Fetch a single endpoint by id. */
+    getEndpoint(id: string): Promise<Endpoint>;
+    /**
+     * Partially update an endpoint. `patch` is sent verbatim (snake_case keys): an omitted key is left
+     * unchanged, an explicit `null` clears the field. No defaults are injected.
+     */
+    updateEndpoint(id: string, patch: EndpointPatch): Promise<Endpoint>;
+    /** Delete an endpoint. Returns nothing (the server replies `204 No Content`). */
+    deleteEndpoint(id: string): Promise<void>;
+    /** Rotate an endpoint's signing secret. The response includes the new `secret` exactly once. */
+    rotateEndpointSecret(id: string): Promise<Endpoint>;
+    /** Re-enable an endpoint that webhookd auto-disabled after repeated delivery failures. */
+    enableEndpoint(id: string): Promise<Endpoint>;
+    /** Create an API key. The response includes the raw `key` exactly once — persist it. */
+    createApiKey(opts?: CreateApiKeyOptions): Promise<ApiKey>;
+    /** Revoke an API key. Returns nothing (the server replies `204 No Content`). */
+    revokeApiKey(id: string): Promise<void>;
+    /** List deliveries. Only the filters you provide are sent as query params. */
+    listDeliveries(opts?: ListDeliveriesOptions): Promise<Page<Delivery>>;
+    /** Re-queue a delivery for another attempt. */
+    redeliver(deliveryId: string): Promise<Delivery>;
+    /** Issue a request and parse the JSON response as `T`. Never use for 204s (there's no body). */
+    private requestJson;
+    /**
+     * The single request path used by every method: builds the URL (+ query), attaches auth, and runs
+     * the shared retry loop (connection errors + 429 honoring Retry-After + 5xx, capped exponential
+     * backoff), raising a typed {@link WebhookdApiError} on other 4xx/5xx. The caller reads the body.
+     */
+    private request;
 }
 
 /** Base class for all webhookd SDK errors (network failures, etc.). */
@@ -76,6 +208,6 @@ declare class WebhookdApiError extends WebhookdError {
  * - `WebhookdClient` — publish events to webhookd (for producers).
  */
 
-declare const VERSION = "0.1.0";
+declare const VERSION = "0.2.0";
 
-export { type ClientOptions, DEFAULT_TOLERANCE_SECONDS, type PublishOptions, VERSION, type VerifyOptions, WebhookdApiError, WebhookdClient, WebhookdError, type WebhookdEvent, sign, verify };
+export { type ApiKey, type ClientOptions, type CreateApiKeyOptions, type CreateEndpointOptions, DEFAULT_TOLERANCE_SECONDS, type Delivery, type Endpoint, type EndpointPatch, type ListDeliveriesOptions, type ListEndpointsOptions, type Page, type PublishOptions, type Subscription, VERSION, type VerifyOptions, WebhookdApiError, WebhookdClient, WebhookdError, type WebhookdEvent, sign, verify };

package/dist/index.js

@@ -22,8 +22,12 @@ function verify(secret, rawBody, signature, opts = {}) {
     if (Math.abs(current - ts) > toleranceSeconds) return false;
   }
   const expected = Buffer.from(sign(secret, rawBody, ts));
-  const candidate = Buffer.from(signature.startsWith(PREFIX) ? signature : `${PREFIX}${signature}`);
-  return expected.length === candidate.length && timingSafeEqual(expected, candidate);
+  for (const raw of signature.split(",")) {
+    const token = raw.trim();
+    const candidate = Buffer.from(token.startsWith(PREFIX) ? token : `${PREFIX}${token}`);
+    if (expected.length === candidate.length && timingSafeEqual(expected, candidate)) return true;
+  }
+  return false;
 }
 
 // src/errors.ts
@@ -67,12 +71,9 @@ var WebhookdClient = class {
       application: opts.application ?? "default"
     };
     if (opts.source !== void 0) body.source = opts.source;
-    const headers = {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${this.apiKey}`
-    };
+    const headers = {};
     if (opts.idempotencyKey !== void 0) headers["Idempotency-Key"] = opts.idempotencyKey;
-    const resp = await this.post("/v1/events", JSON.stringify(body), headers);
+    const resp = await this.request("POST", "/v1/events", { body, headers });
     const data = await resp.json();
     return {
       id: String(data.id),
@@ -84,14 +85,126 @@ var WebhookdClient = class {
       source: data.source ?? null
     };
   }
-  async post(path, body, headers) {
-    const url = `${this.baseUrl}${path}`;
+  // ── Endpoints ──────────────────────────────────────────────────────────────
+  /** Create an endpoint. The response includes the signing `secret` exactly once — persist it. */
+  async createEndpoint(url, opts = {}) {
+    const body = {
+      url,
+      environment: opts.environment ?? "prod",
+      application: opts.application ?? "default"
+    };
+    if (opts.subscriptions !== void 0) body.subscriptions = opts.subscriptions;
+    if (opts.secret !== void 0) body.secret = opts.secret;
+    if (opts.maxAttempts !== void 0) body.max_attempts = opts.maxAttempts;
+    if (opts.retrySchedule !== void 0) body.retry_schedule = opts.retrySchedule;
+    if (opts.description !== void 0) body.description = opts.description;
+    if (opts.customHeaders !== void 0) body.custom_headers = opts.customHeaders;
+    if (opts.deliveryTimeoutMs !== void 0) body.delivery_timeout_ms = opts.deliveryTimeoutMs;
+    return this.requestJson("POST", "/v1/endpoints", { body });
+  }
+  /** List endpoints for an environment (defaults to `prod`). */
+  async listEndpoints(opts = {}) {
+    const query = { environment: opts.environment ?? "prod" };
+    if (opts.offset !== void 0) query.offset = opts.offset;
+    if (opts.limit !== void 0) query.limit = opts.limit;
+    return this.requestJson("GET", "/v1/endpoints", { query });
+  }
+  /** Fetch a single endpoint by id. */
+  async getEndpoint(id) {
+    return this.requestJson("GET", `/v1/endpoints/${encodeURIComponent(id)}`);
+  }
+  /**
+   * Partially update an endpoint. `patch` is sent verbatim (snake_case keys): an omitted key is left
+   * unchanged, an explicit `null` clears the field. No defaults are injected.
+   */
+  async updateEndpoint(id, patch) {
+    return this.requestJson("PATCH", `/v1/endpoints/${encodeURIComponent(id)}`, {
+      body: patch
+    });
+  }
+  /** Delete an endpoint. Returns nothing (the server replies `204 No Content`). */
+  async deleteEndpoint(id) {
+    await this.request("DELETE", `/v1/endpoints/${encodeURIComponent(id)}`);
+  }
+  /** Rotate an endpoint's signing secret. The response includes the new `secret` exactly once. */
+  async rotateEndpointSecret(id) {
+    return this.requestJson("POST", `/v1/endpoints/${encodeURIComponent(id)}/rotate-secret`);
+  }
+  /** Re-enable an endpoint that webhookd auto-disabled after repeated delivery failures. */
+  async enableEndpoint(id) {
+    return this.requestJson("POST", `/v1/endpoints/${encodeURIComponent(id)}/enable`);
+  }
+  // ── API keys ───────────────────────────────────────────────────────────────
+  /** Create an API key. The response includes the raw `key` exactly once — persist it. */
+  async createApiKey(opts = {}) {
+    const body = {
+      name: opts.name ?? "",
+      scope: opts.scope ?? "admin"
+    };
+    if (opts.expiresInDays !== void 0) body.expires_in_days = opts.expiresInDays;
+    return this.requestJson("POST", "/v1/api-keys", { body });
+  }
+  /** Revoke an API key. Returns nothing (the server replies `204 No Content`). */
+  async revokeApiKey(id) {
+    await this.request("DELETE", `/v1/api-keys/${encodeURIComponent(id)}`);
+  }
+  // ── Deliveries ─────────────────────────────────────────────────────────────
+  /** List deliveries. Only the filters you provide are sent as query params. */
+  async listDeliveries(opts = {}) {
+    const query = {};
+    if (opts.status !== void 0) query.status = opts.status;
+    if (opts.endpointId !== void 0) query.endpoint_id = opts.endpointId;
+    if (opts.eventType !== void 0) query.event_type = opts.eventType;
+    if (opts.since !== void 0) query.since = opts.since;
+    if (opts.until !== void 0) query.until = opts.until;
+    if (opts.q !== void 0) query.q = opts.q;
+    if (opts.offset !== void 0) query.offset = opts.offset;
+    if (opts.limit !== void 0) query.limit = opts.limit;
+    return this.requestJson("GET", "/v1/deliveries", { query });
+  }
+  /** Re-queue a delivery for another attempt. */
+  async redeliver(deliveryId) {
+    return this.requestJson(
+      "POST",
+      `/v1/deliveries/${encodeURIComponent(deliveryId)}/redeliver`
+    );
+  }
+  // ── Internals ──────────────────────────────────────────────────────────────
+  /** Issue a request and parse the JSON response as `T`. Never use for 204s (there's no body). */
+  async requestJson(method, path, opts = {}) {
+    const resp = await this.request(method, path, opts);
+    return await resp.json();
+  }
+  /**
+   * The single request path used by every method: builds the URL (+ query), attaches auth, and runs
+   * the shared retry loop (connection errors + 429 honoring Retry-After + 5xx, capped exponential
+   * backoff), raising a typed {@link WebhookdApiError} on other 4xx/5xx. The caller reads the body.
+   */
+  async request(method, path, opts = {}) {
+    let url = `${this.baseUrl}${path}`;
+    if (opts.query) {
+      const qs = new URLSearchParams();
+      for (const [key, value] of Object.entries(opts.query)) {
+        if (value !== void 0 && value !== null) qs.append(key, String(value));
+      }
+      const suffix = qs.toString();
+      if (suffix) url += `?${suffix}`;
+    }
+    const headers = {
+      Authorization: `Bearer ${this.apiKey}`,
+      ...opts.headers
+    };
+    let body;
+    if (opts.body !== void 0) {
+      body = JSON.stringify(opts.body);
+      headers["Content-Type"] = "application/json";
+    }
     let lastErr;
     for (let attempt = 0; attempt <= this.maxRetries; attempt++) {
       let resp;
       try {
         resp = await this.fetchImpl(url, {
-          method: "POST",
+          method,
           headers,
           body,
           signal: AbortSignal.timeout(this.timeoutMs)
@@ -123,14 +236,14 @@ function retryAfterMs(resp) {
   return null;
 }
 async function apiError(resp) {
+  const text = await resp.text();
   let code = "error";
-  let message = "";
+  let message = text;
   try {
-    const data = await resp.json();
+    const data = JSON.parse(text);
     code = data.error?.code ?? code;
-    message = data.error?.message ?? "";
+    message = data.error?.message ?? message;
   } catch {
-    message = "";
   }
   return new WebhookdApiError(resp.status, code, message);
 }
@@ -139,7 +252,7 @@ function sleep(ms) {
 }
 
 // src/index.ts
-var VERSION = "0.1.0";
+var VERSION = "0.2.0";
 export {
   DEFAULT_TOLERANCE_SECONDS,
   VERSION,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/signature.ts","../src/errors.ts","../src/client.ts","../src/index.ts"],"sourcesContent":["/**\n * Verify webhookd webhook signatures.\n *\n * webhookd signs every delivery as `HMAC_SHA256(secret, \"<timestamp>.\" + rawBody)` (its default\n * timestamped mode) and sends `X-Webhook-Signature: sha256=<hex>` plus `X-Webhook-Timestamp`\n * (unix seconds). A subscriber MUST verify the signature to prove the request genuinely came from\n * webhookd and wasn't tampered with. Mirrors `delivery_core.webhook_outbox.{sign,verify}`.\n */\nimport { createHmac, timingSafeEqual } from \"node:crypto\";\n\nconst PREFIX = \"sha256=\";\nexport const DEFAULT_TOLERANCE_SECONDS = 300;\n\nfunction toBuffer(value: string | Buffer): Buffer {\n  return Buffer.isBuffer(value) ? value : Buffer.from(value, \"utf8\");\n}\n\nfunction signedBytes(rawBody: Buffer, timestamp: number | null): Buffer {\n  if (timestamp === null) return rawBody;\n  return Buffer.concat([Buffer.from(`${timestamp}.`, \"ascii\"), rawBody]);\n}\n\n/** The `sha256=<hex>` signature webhookd would send for `rawBody` (+ optional timestamp). */\nexport function sign(\n  secret: string | Buffer,\n  rawBody: string | Buffer,\n  timestamp: number | null = null,\n): string {\n  const digest = createHmac(\"sha256\", secret)\n    .update(signedBytes(toBuffer(rawBody), timestamp))\n    .digest(\"hex\");\n  return `${PREFIX}${digest}`;\n}\n\nexport interface VerifyOptions {\n  /** The `X-Webhook-Timestamp` header value. When given, the replay window is enforced — always pass it. */\n  timestamp?: number | string | null;\n  /** Replay window in seconds; webhookd's default is 300. */\n  toleranceSeconds?: number;\n  /** Override the current unix time (for tests). */\n  now?: number;\n}\n\n/**\n * Return `true` iff `signature` is a valid webhookd signature for `rawBody`.\n *\n * Pass the EXACT bytes you received as `rawBody` (a string or Buffer) — do not re-serialize the\n * JSON, or the signature won't match. Comparison is constant-time.\n */\nexport function verify(\n  secret: string | Buffer,\n  rawBody: string | Buffer,\n  signature: string,\n  opts: VerifyOptions = {},\n): boolean {\n  const { timestamp = null, toleranceSeconds = DEFAULT_TOLERANCE_SECONDS, now } = opts;\n  const ts = timestamp === null || timestamp === undefined ? null : Number(timestamp);\n  if (ts !== null) {\n    if (Number.isNaN(ts)) return false;\n    const current = now ?? Math.floor(Date.now() / 1000);\n    if (Math.abs(current - ts) > toleranceSeconds) return false;\n  }\n  const expected = Buffer.from(sign(secret, rawBody, ts));\n  const candidate = Buffer.from(signature.startsWith(PREFIX) ? signature : `${PREFIX}${signature}`);\n  // timingSafeEqual requires equal-length buffers; a length mismatch is already a non-match.\n  return expected.length === candidate.length && timingSafeEqual(expected, candidate);\n}\n","/** Base class for all webhookd SDK errors (network failures, etc.). */\nexport class WebhookdError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"WebhookdError\";\n  }\n}\n\n/**\n * A non-2xx response from the webhookd API. Carries the M5a error envelope: a stable machine\n * `code` (e.g. `\"rate_limited\"`, `\"not_found\"`, `\"validation_error\"`) and a human `message`,\n * plus the HTTP `statusCode`.\n */\nexport class WebhookdApiError extends WebhookdError {\n  readonly statusCode: number;\n  readonly code: string;\n\n  constructor(statusCode: number, code: string, message: string) {\n    super(`[${statusCode} ${code}] ${message}`);\n    this.name = \"WebhookdApiError\";\n    this.statusCode = statusCode;\n    this.code = code;\n  }\n}\n","/** Typed publish client for the webhookd API (zero runtime deps — uses the global `fetch`). */\nimport { WebhookdApiError, WebhookdError } from \"./errors\";\n\nconst RETRY_STATUSES = new Set([429, 500, 502, 503, 504]);\n\n/** The published event, as returned by `POST /v1/events` (webhookd's `EventOut`). */\nexport interface WebhookdEvent {\n  id: string;\n  eventUid: string;\n  eventType: string;\n  application: string;\n  environment: string;\n  deliveriesCreated: number;\n  source: string | null;\n}\n\nexport interface ClientOptions {\n  baseUrl: string;\n  /** A per-tenant API key (`whsk_…`) or a service token. */\n  apiKey: string;\n  timeoutMs?: number;\n  maxRetries?: number;\n  /** Inject a `fetch` implementation (defaults to the global `fetch`); used for tests. */\n  fetchImpl?: typeof fetch;\n}\n\nexport interface PublishOptions {\n  environment?: string;\n  application?: string;\n  source?: string;\n  /** Makes the publish safe to retry — a replay returns the original event without re-fanning-out. */\n  idempotencyKey?: string;\n}\n\nexport class WebhookdClient {\n  private readonly baseUrl: string;\n  private readonly apiKey: string;\n  private readonly timeoutMs: number;\n  private readonly maxRetries: number;\n  private readonly fetchImpl: typeof fetch;\n\n  constructor(opts: ClientOptions) {\n    this.baseUrl = opts.baseUrl.replace(/\\/+$/, \"\");\n    this.apiKey = opts.apiKey;\n    this.timeoutMs = opts.timeoutMs ?? 10_000;\n    this.maxRetries = opts.maxRetries ?? 2;\n    this.fetchImpl = opts.fetchImpl ?? fetch;\n  }\n\n  async publish(\n    eventType: string,\n    payload: Record<string, unknown>,\n    opts: PublishOptions = {},\n  ): Promise<WebhookdEvent> {\n    const body: Record<string, unknown> = {\n      event_type: eventType,\n      payload,\n      environment: opts.environment ?? \"prod\",\n      application: opts.application ?? \"default\",\n    };\n    if (opts.source !== undefined) body.source = opts.source;\n\n    const headers: Record<string, string> = {\n      \"Content-Type\": \"application/json\",\n      Authorization: `Bearer ${this.apiKey}`,\n    };\n    if (opts.idempotencyKey !== undefined) headers[\"Idempotency-Key\"] = opts.idempotencyKey;\n\n    const resp = await this.post(\"/v1/events\", JSON.stringify(body), headers);\n    const data = (await resp.json()) as Record<string, unknown>;\n    return {\n      id: String(data.id),\n      eventUid: String(data.event_uid),\n      eventType: String(data.event_type),\n      application: String(data.application ?? \"default\"),\n      environment: String(data.environment ?? \"prod\"),\n      deliveriesCreated: Number(data.deliveries_created ?? 0),\n      source: (data.source as string | null) ?? null,\n    };\n  }\n\n  private async post(\n    path: string,\n    body: string,\n    headers: Record<string, string>,\n  ): Promise<Response> {\n    const url = `${this.baseUrl}${path}`;\n    let lastErr: unknown;\n    for (let attempt = 0; attempt <= this.maxRetries; attempt++) {\n      let resp: Response;\n      try {\n        resp = await this.fetchImpl(url, {\n          method: \"POST\",\n          headers,\n          body,\n          signal: AbortSignal.timeout(this.timeoutMs),\n        });\n      } catch (err) {\n        lastErr = err;\n        if (attempt < this.maxRetries) {\n          await sleep(backoffMs(attempt));\n          continue;\n        }\n        throw new WebhookdError(`request failed: ${String(err)}`);\n      }\n\n      if (RETRY_STATUSES.has(resp.status) && attempt < this.maxRetries) {\n        await sleep(retryAfterMs(resp) ?? backoffMs(attempt));\n        continue;\n      }\n      if (resp.status >= 400) throw await apiError(resp);\n      return resp;\n    }\n    throw new WebhookdError(`request failed after retries: ${String(lastErr)}`);\n  }\n}\n\nfunction backoffMs(attempt: number): number {\n  return Math.min(2000, 200 * 2 ** attempt);\n}\n\nfunction retryAfterMs(resp: Response): number | null {\n  const raw = resp.headers.get(\"Retry-After\");\n  if (raw && /^\\d+$/.test(raw)) return Number(raw) * 1000;\n  return null;\n}\n\nasync function apiError(resp: Response): Promise<WebhookdApiError> {\n  let code = \"error\";\n  let message = \"\";\n  try {\n    const data = (await resp.json()) as { error?: { code?: string; message?: string } };\n    code = data.error?.code ?? code;\n    message = data.error?.message ?? \"\";\n  } catch {\n    message = \"\";\n  }\n  return new WebhookdApiError(resp.status, code, message);\n}\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n","/**\n * @nimbusnexus/webhooks-sdk — the official TypeScript client for NimbusNexus Webhooks.\n *\n * - `verify` — verify an incoming webhook's HMAC signature (for subscribers).\n * - `WebhookdClient` — publish events to webhookd (for producers).\n */\nexport { DEFAULT_TOLERANCE_SECONDS, sign, verify } from \"./signature\";\nexport type { VerifyOptions } from \"./signature\";\nexport { WebhookdClient } from \"./client\";\nexport type { ClientOptions, PublishOptions, WebhookdEvent } from \"./client\";\nexport { WebhookdApiError, WebhookdError } from \"./errors\";\n\nexport const VERSION = \"0.1.0\";\n"],"mappings":";AAQA,SAAS,YAAY,uBAAuB;AAE5C,IAAM,SAAS;AACR,IAAM,4BAA4B;AAEzC,SAAS,SAAS,OAAgC;AAChD,SAAO,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,OAAO,MAAM;AACnE;AAEA,SAAS,YAAY,SAAiB,WAAkC;AACtE,MAAI,cAAc,KAAM,QAAO;AAC/B,SAAO,OAAO,OAAO,CAAC,OAAO,KAAK,GAAG,SAAS,KAAK,OAAO,GAAG,OAAO,CAAC;AACvE;AAGO,SAAS,KACd,QACA,SACA,YAA2B,MACnB;AACR,QAAM,SAAS,WAAW,UAAU,MAAM,EACvC,OAAO,YAAY,SAAS,OAAO,GAAG,SAAS,CAAC,EAChD,OAAO,KAAK;AACf,SAAO,GAAG,MAAM,GAAG,MAAM;AAC3B;AAiBO,SAAS,OACd,QACA,SACA,WACA,OAAsB,CAAC,GACd;AACT,QAAM,EAAE,YAAY,MAAM,mBAAmB,2BAA2B,IAAI,IAAI;AAChF,QAAM,KAAK,cAAc,QAAQ,cAAc,SAAY,OAAO,OAAO,SAAS;AAClF,MAAI,OAAO,MAAM;AACf,QAAI,OAAO,MAAM,EAAE,EAAG,QAAO;AAC7B,UAAM,UAAU,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACnD,QAAI,KAAK,IAAI,UAAU,EAAE,IAAI,iBAAkB,QAAO;AAAA,EACxD;AACA,QAAM,WAAW,OAAO,KAAK,KAAK,QAAQ,SAAS,EAAE,CAAC;AACtD,QAAM,YAAY,OAAO,KAAK,UAAU,WAAW,MAAM,IAAI,YAAY,GAAG,MAAM,GAAG,SAAS,EAAE;AAEhG,SAAO,SAAS,WAAW,UAAU,UAAU,gBAAgB,UAAU,SAAS;AACpF;;;ACjEO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EACvC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAOO,IAAM,mBAAN,cAA+B,cAAc;AAAA,EACzC;AAAA,EACA;AAAA,EAET,YAAY,YAAoB,MAAc,SAAiB;AAC7D,UAAM,IAAI,UAAU,IAAI,IAAI,KAAK,OAAO,EAAE;AAC1C,SAAK,OAAO;AACZ,SAAK,aAAa;AAClB,SAAK,OAAO;AAAA,EACd;AACF;;;ACpBA,IAAM,iBAAiB,oBAAI,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AA+BjD,IAAM,iBAAN,MAAqB;AAAA,EACT;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,MAAqB;AAC/B,SAAK,UAAU,KAAK,QAAQ,QAAQ,QAAQ,EAAE;AAC9C,SAAK,SAAS,KAAK;AACnB,SAAK,YAAY,KAAK,aAAa;AACnC,SAAK,aAAa,KAAK,cAAc;AACrC,SAAK,YAAY,KAAK,aAAa;AAAA,EACrC;AAAA,EAEA,MAAM,QACJ,WACA,SACA,OAAuB,CAAC,GACA;AACxB,UAAM,OAAgC;AAAA,MACpC,YAAY;AAAA,MACZ;AAAA,MACA,aAAa,KAAK,eAAe;AAAA,MACjC,aAAa,KAAK,eAAe;AAAA,IACnC;AACA,QAAI,KAAK,WAAW,OAAW,MAAK,SAAS,KAAK;AAElD,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,eAAe,UAAU,KAAK,MAAM;AAAA,IACtC;AACA,QAAI,KAAK,mBAAmB,OAAW,SAAQ,iBAAiB,IAAI,KAAK;AAEzE,UAAM,OAAO,MAAM,KAAK,KAAK,cAAc,KAAK,UAAU,IAAI,GAAG,OAAO;AACxE,UAAM,OAAQ,MAAM,KAAK,KAAK;AAC9B,WAAO;AAAA,MACL,IAAI,OAAO,KAAK,EAAE;AAAA,MAClB,UAAU,OAAO,KAAK,SAAS;AAAA,MAC/B,WAAW,OAAO,KAAK,UAAU;AAAA,MACjC,aAAa,OAAO,KAAK,eAAe,SAAS;AAAA,MACjD,aAAa,OAAO,KAAK,eAAe,MAAM;AAAA,MAC9C,mBAAmB,OAAO,KAAK,sBAAsB,CAAC;AAAA,MACtD,QAAS,KAAK,UAA4B;AAAA,IAC5C;AAAA,EACF;AAAA,EAEA,MAAc,KACZ,MACA,MACA,SACmB;AACnB,UAAM,MAAM,GAAG,KAAK,OAAO,GAAG,IAAI;AAClC,QAAI;AACJ,aAAS,UAAU,GAAG,WAAW,KAAK,YAAY,WAAW;AAC3D,UAAI;AACJ,UAAI;AACF,eAAO,MAAM,KAAK,UAAU,KAAK;AAAA,UAC/B,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,UACA,QAAQ,YAAY,QAAQ,KAAK,SAAS;AAAA,QAC5C,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,kBAAU;AACV,YAAI,UAAU,KAAK,YAAY;AAC7B,gBAAM,MAAM,UAAU,OAAO,CAAC;AAC9B;AAAA,QACF;AACA,cAAM,IAAI,cAAc,mBAAmB,OAAO,GAAG,CAAC,EAAE;AAAA,MAC1D;AAEA,UAAI,eAAe,IAAI,KAAK,MAAM,KAAK,UAAU,KAAK,YAAY;AAChE,cAAM,MAAM,aAAa,IAAI,KAAK,UAAU,OAAO,CAAC;AACpD;AAAA,MACF;AACA,UAAI,KAAK,UAAU,IAAK,OAAM,MAAM,SAAS,IAAI;AACjD,aAAO;AAAA,IACT;AACA,UAAM,IAAI,cAAc,iCAAiC,OAAO,OAAO,CAAC,EAAE;AAAA,EAC5E;AACF;AAEA,SAAS,UAAU,SAAyB;AAC1C,SAAO,KAAK,IAAI,KAAM,MAAM,KAAK,OAAO;AAC1C;AAEA,SAAS,aAAa,MAA+B;AACnD,QAAM,MAAM,KAAK,QAAQ,IAAI,aAAa;AAC1C,MAAI,OAAO,QAAQ,KAAK,GAAG,EAAG,QAAO,OAAO,GAAG,IAAI;AACnD,SAAO;AACT;AAEA,eAAe,SAAS,MAA2C;AACjE,MAAI,OAAO;AACX,MAAI,UAAU;AACd,MAAI;AACF,UAAM,OAAQ,MAAM,KAAK,KAAK;AAC9B,WAAO,KAAK,OAAO,QAAQ;AAC3B,cAAU,KAAK,OAAO,WAAW;AAAA,EACnC,QAAQ;AACN,cAAU;AAAA,EACZ;AACA,SAAO,IAAI,iBAAiB,KAAK,QAAQ,MAAM,OAAO;AACxD;AAEA,SAAS,MAAM,IAA2B;AACxC,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AACzD;;;AClIO,IAAM,UAAU;","names":[]}
+{"version":3,"sources":["../src/signature.ts","../src/errors.ts","../src/client.ts","../src/index.ts"],"sourcesContent":["/**\n * Verify webhookd webhook signatures.\n *\n * webhookd signs every delivery as `HMAC_SHA256(secret, \"<timestamp>.\" + rawBody)` (its default\n * timestamped mode) and sends `X-Webhook-Signature: sha256=<hex>` plus `X-Webhook-Timestamp`\n * (unix seconds). A subscriber MUST verify the signature to prove the request genuinely came from\n * webhookd and wasn't tampered with. Mirrors `delivery_core.webhook_outbox.{sign,verify}`.\n */\nimport { createHmac, timingSafeEqual } from \"node:crypto\";\n\nconst PREFIX = \"sha256=\";\nexport const DEFAULT_TOLERANCE_SECONDS = 300;\n\nfunction toBuffer(value: string | Buffer): Buffer {\n  return Buffer.isBuffer(value) ? value : Buffer.from(value, \"utf8\");\n}\n\nfunction signedBytes(rawBody: Buffer, timestamp: number | null): Buffer {\n  if (timestamp === null) return rawBody;\n  return Buffer.concat([Buffer.from(`${timestamp}.`, \"ascii\"), rawBody]);\n}\n\n/** The `sha256=<hex>` signature webhookd would send for `rawBody` (+ optional timestamp). */\nexport function sign(\n  secret: string | Buffer,\n  rawBody: string | Buffer,\n  timestamp: number | null = null,\n): string {\n  const digest = createHmac(\"sha256\", secret)\n    .update(signedBytes(toBuffer(rawBody), timestamp))\n    .digest(\"hex\");\n  return `${PREFIX}${digest}`;\n}\n\nexport interface VerifyOptions {\n  /** The `X-Webhook-Timestamp` header value. When given, the replay window is enforced — always pass it. */\n  timestamp?: number | string | null;\n  /** Replay window in seconds; webhookd's default is 300. */\n  toleranceSeconds?: number;\n  /** Override the current unix time (for tests). */\n  now?: number;\n}\n\n/**\n * Return `true` iff `signature` is a valid webhookd signature for `rawBody`.\n *\n * Pass the EXACT bytes you received as `rawBody` (a string or Buffer) — do not re-serialize the\n * JSON, or the signature won't match. Comparison is constant-time.\n */\nexport function verify(\n  secret: string | Buffer,\n  rawBody: string | Buffer,\n  signature: string,\n  opts: VerifyOptions = {},\n): boolean {\n  const { timestamp = null, toleranceSeconds = DEFAULT_TOLERANCE_SECONDS, now } = opts;\n  const ts = timestamp === null || timestamp === undefined ? null : Number(timestamp);\n  if (ts !== null) {\n    if (Number.isNaN(ts)) return false;\n    const current = now ?? Math.floor(Date.now() / 1000);\n    if (Math.abs(current - ts) > toleranceSeconds) return false;\n  }\n  const expected = Buffer.from(sign(secret, rawBody, ts));\n  // X-Webhook-Signature carries one token normally, or several comma-separated tokens during a\n  // signing-secret rotation (webhookd dual-sign overlap) — accept if ANY token verifies, so a\n  // subscriber configured with EITHER the current or the previous secret keeps working.\n  for (const raw of signature.split(\",\")) {\n    const token = raw.trim();\n    const candidate = Buffer.from(token.startsWith(PREFIX) ? token : `${PREFIX}${token}`);\n    // timingSafeEqual requires equal-length buffers; a length mismatch is already a non-match.\n    if (expected.length === candidate.length && timingSafeEqual(expected, candidate)) return true;\n  }\n  return false;\n}\n","/** Base class for all webhookd SDK errors (network failures, etc.). */\nexport class WebhookdError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"WebhookdError\";\n  }\n}\n\n/**\n * A non-2xx response from the webhookd API. Carries the M5a error envelope: a stable machine\n * `code` (e.g. `\"rate_limited\"`, `\"not_found\"`, `\"validation_error\"`) and a human `message`,\n * plus the HTTP `statusCode`.\n */\nexport class WebhookdApiError extends WebhookdError {\n  readonly statusCode: number;\n  readonly code: string;\n\n  constructor(statusCode: number, code: string, message: string) {\n    super(`[${statusCode} ${code}] ${message}`);\n    this.name = \"WebhookdApiError\";\n    this.statusCode = statusCode;\n    this.code = code;\n  }\n}\n","/** Typed publish + management client for the webhookd API (zero runtime deps — uses the global `fetch`). */\nimport { WebhookdApiError, WebhookdError } from \"./errors\";\n\nconst RETRY_STATUSES = new Set([429, 500, 502, 503, 504]);\n\n/** The published event, as returned by `POST /v1/events` (webhookd's `EventOut`). */\nexport interface WebhookdEvent {\n  id: string;\n  eventUid: string;\n  eventType: string;\n  application: string;\n  environment: string;\n  deliveriesCreated: number;\n  source: string | null;\n}\n\n/** A subscription filter attached to an endpoint. */\nexport interface Subscription {\n  match_kind: \"exact\" | \"prefix\" | \"suffix\" | \"all\";\n  pattern: string;\n}\n\n/**\n * An endpoint, as returned by the management endpoints (webhookd's `EndpointOut`).\n * Fields mirror the server's snake_case wire shape verbatim. `secret` is present ONLY on the\n * create + rotate-secret responses (returned exactly once).\n */\nexport interface Endpoint {\n  id: string;\n  url: string;\n  environment: string;\n  application: string;\n  status: string;\n  subscriptions: Subscription[];\n  /** The signing secret — returned ONCE, on create + rotate-secret only. */\n  secret?: string;\n  max_attempts?: number;\n  retry_schedule?: number[];\n  description?: string | null;\n  custom_headers?: Record<string, string> | null;\n  delivery_timeout_ms?: number | null;\n  created_at?: string;\n  updated_at?: string;\n}\n\n/**\n * An API key, as returned by `POST /v1/api-keys` (webhookd's `ApiKeyOut`). `key` is present ONLY on\n * the create response (returned exactly once).\n */\nexport interface ApiKey {\n  id: string;\n  name: string;\n  scope: string;\n  /** The raw key — returned ONCE, on create only. */\n  key?: string;\n  created_at?: string;\n  expires_at?: string | null;\n}\n\n/** A delivery attempt record, as returned by the deliveries endpoints (webhookd's `DeliveryOut`). */\nexport interface Delivery {\n  id: string;\n  endpoint_id: string;\n  event_id?: string;\n  event_type?: string;\n  status: string;\n  attempts?: number;\n  created_at?: string;\n  updated_at?: string;\n}\n\n/** A single page of a list endpoint — items plus the cursor for the next page (`null` at the end). */\nexport interface Page<T> {\n  items: T[];\n  next_offset: number | null;\n}\n\nexport interface ClientOptions {\n  baseUrl: string;\n  /** A per-tenant API key (`whsk_…`) or a service token. */\n  apiKey: string;\n  timeoutMs?: number;\n  maxRetries?: number;\n  /** Inject a `fetch` implementation (defaults to the global `fetch`); used for tests. */\n  fetchImpl?: typeof fetch;\n}\n\nexport interface PublishOptions {\n  environment?: string;\n  application?: string;\n  source?: string;\n  /** Makes the publish safe to retry — a replay returns the original event without re-fanning-out. */\n  idempotencyKey?: string;\n}\n\nexport interface CreateEndpointOptions {\n  environment?: string;\n  subscriptions?: Subscription[];\n  application?: string;\n  secret?: string;\n  maxAttempts?: number;\n  retrySchedule?: number[];\n  description?: string;\n  customHeaders?: Record<string, string>;\n  deliveryTimeoutMs?: number;\n}\n\nexport interface ListEndpointsOptions {\n  environment?: string;\n  offset?: number;\n  limit?: number;\n}\n\n/**\n * A raw PATCH mapping for `updateEndpoint`, keyed with the server's snake_case names. PATCH semantics:\n * an OMITTED key is left unchanged; an explicit `null` CLEARS the field. The object is sent verbatim.\n */\nexport interface EndpointPatch {\n  url?: string;\n  max_attempts?: number | null;\n  retry_schedule?: number[] | null;\n  status?: \"enabled\" | \"disabled\";\n  description?: string | null;\n  custom_headers?: Record<string, string> | null;\n  delivery_timeout_ms?: number | null;\n}\n\nexport interface CreateApiKeyOptions {\n  name?: string;\n  scope?: \"admin\" | \"publish\";\n  expiresInDays?: number;\n}\n\nexport interface ListDeliveriesOptions {\n  status?: \"queued\" | \"sending\" | \"sent\" | \"failed\" | \"dead\";\n  endpointId?: string;\n  eventType?: string;\n  since?: string | number;\n  until?: string | number;\n  q?: string;\n  offset?: number;\n  limit?: number;\n}\n\ninterface RequestOptions {\n  /** JSON body to send; omitted for GET/DELETE and bodyless POSTs (no `Content-Type` is set). */\n  body?: unknown;\n  /** Query params; `undefined`/`null` values are dropped so only provided params are sent. */\n  query?: Record<string, unknown>;\n  /** Extra request headers (e.g. `Idempotency-Key`). */\n  headers?: Record<string, string>;\n}\n\nexport class WebhookdClient {\n  private readonly baseUrl: string;\n  private readonly apiKey: string;\n  private readonly timeoutMs: number;\n  private readonly maxRetries: number;\n  private readonly fetchImpl: typeof fetch;\n\n  constructor(opts: ClientOptions) {\n    this.baseUrl = opts.baseUrl.replace(/\\/+$/, \"\");\n    this.apiKey = opts.apiKey;\n    this.timeoutMs = opts.timeoutMs ?? 10_000;\n    this.maxRetries = opts.maxRetries ?? 2;\n    this.fetchImpl = opts.fetchImpl ?? fetch;\n  }\n\n  async publish(\n    eventType: string,\n    payload: Record<string, unknown>,\n    opts: PublishOptions = {},\n  ): Promise<WebhookdEvent> {\n    const body: Record<string, unknown> = {\n      event_type: eventType,\n      payload,\n      environment: opts.environment ?? \"prod\",\n      application: opts.application ?? \"default\",\n    };\n    if (opts.source !== undefined) body.source = opts.source;\n\n    const headers: Record<string, string> = {};\n    if (opts.idempotencyKey !== undefined) headers[\"Idempotency-Key\"] = opts.idempotencyKey;\n\n    const resp = await this.request(\"POST\", \"/v1/events\", { body, headers });\n    const data = (await resp.json()) as Record<string, unknown>;\n    return {\n      id: String(data.id),\n      eventUid: String(data.event_uid),\n      eventType: String(data.event_type),\n      application: String(data.application ?? \"default\"),\n      environment: String(data.environment ?? \"prod\"),\n      deliveriesCreated: Number(data.deliveries_created ?? 0),\n      source: (data.source as string | null) ?? null,\n    };\n  }\n\n  // ── Endpoints ──────────────────────────────────────────────────────────────\n\n  /** Create an endpoint. The response includes the signing `secret` exactly once — persist it. */\n  async createEndpoint(url: string, opts: CreateEndpointOptions = {}): Promise<Endpoint> {\n    const body: Record<string, unknown> = {\n      url,\n      environment: opts.environment ?? \"prod\",\n      application: opts.application ?? \"default\",\n    };\n    if (opts.subscriptions !== undefined) body.subscriptions = opts.subscriptions;\n    if (opts.secret !== undefined) body.secret = opts.secret;\n    if (opts.maxAttempts !== undefined) body.max_attempts = opts.maxAttempts;\n    if (opts.retrySchedule !== undefined) body.retry_schedule = opts.retrySchedule;\n    if (opts.description !== undefined) body.description = opts.description;\n    if (opts.customHeaders !== undefined) body.custom_headers = opts.customHeaders;\n    if (opts.deliveryTimeoutMs !== undefined) body.delivery_timeout_ms = opts.deliveryTimeoutMs;\n    return this.requestJson<Endpoint>(\"POST\", \"/v1/endpoints\", { body });\n  }\n\n  /** List endpoints for an environment (defaults to `prod`). */\n  async listEndpoints(opts: ListEndpointsOptions = {}): Promise<Page<Endpoint>> {\n    const query: Record<string, unknown> = { environment: opts.environment ?? \"prod\" };\n    if (opts.offset !== undefined) query.offset = opts.offset;\n    if (opts.limit !== undefined) query.limit = opts.limit;\n    return this.requestJson<Page<Endpoint>>(\"GET\", \"/v1/endpoints\", { query });\n  }\n\n  /** Fetch a single endpoint by id. */\n  async getEndpoint(id: string): Promise<Endpoint> {\n    return this.requestJson<Endpoint>(\"GET\", `/v1/endpoints/${encodeURIComponent(id)}`);\n  }\n\n  /**\n   * Partially update an endpoint. `patch` is sent verbatim (snake_case keys): an omitted key is left\n   * unchanged, an explicit `null` clears the field. No defaults are injected.\n   */\n  async updateEndpoint(id: string, patch: EndpointPatch): Promise<Endpoint> {\n    return this.requestJson<Endpoint>(\"PATCH\", `/v1/endpoints/${encodeURIComponent(id)}`, {\n      body: patch,\n    });\n  }\n\n  /** Delete an endpoint. Returns nothing (the server replies `204 No Content`). */\n  async deleteEndpoint(id: string): Promise<void> {\n    await this.request(\"DELETE\", `/v1/endpoints/${encodeURIComponent(id)}`);\n  }\n\n  /** Rotate an endpoint's signing secret. The response includes the new `secret` exactly once. */\n  async rotateEndpointSecret(id: string): Promise<Endpoint> {\n    return this.requestJson<Endpoint>(\"POST\", `/v1/endpoints/${encodeURIComponent(id)}/rotate-secret`);\n  }\n\n  /** Re-enable an endpoint that webhookd auto-disabled after repeated delivery failures. */\n  async enableEndpoint(id: string): Promise<Endpoint> {\n    return this.requestJson<Endpoint>(\"POST\", `/v1/endpoints/${encodeURIComponent(id)}/enable`);\n  }\n\n  // ── API keys ───────────────────────────────────────────────────────────────\n\n  /** Create an API key. The response includes the raw `key` exactly once — persist it. */\n  async createApiKey(opts: CreateApiKeyOptions = {}): Promise<ApiKey> {\n    const body: Record<string, unknown> = {\n      name: opts.name ?? \"\",\n      scope: opts.scope ?? \"admin\",\n    };\n    if (opts.expiresInDays !== undefined) body.expires_in_days = opts.expiresInDays;\n    return this.requestJson<ApiKey>(\"POST\", \"/v1/api-keys\", { body });\n  }\n\n  /** Revoke an API key. Returns nothing (the server replies `204 No Content`). */\n  async revokeApiKey(id: string): Promise<void> {\n    await this.request(\"DELETE\", `/v1/api-keys/${encodeURIComponent(id)}`);\n  }\n\n  // ── Deliveries ─────────────────────────────────────────────────────────────\n\n  /** List deliveries. Only the filters you provide are sent as query params. */\n  async listDeliveries(opts: ListDeliveriesOptions = {}): Promise<Page<Delivery>> {\n    const query: Record<string, unknown> = {};\n    if (opts.status !== undefined) query.status = opts.status;\n    if (opts.endpointId !== undefined) query.endpoint_id = opts.endpointId;\n    if (opts.eventType !== undefined) query.event_type = opts.eventType;\n    if (opts.since !== undefined) query.since = opts.since;\n    if (opts.until !== undefined) query.until = opts.until;\n    if (opts.q !== undefined) query.q = opts.q;\n    if (opts.offset !== undefined) query.offset = opts.offset;\n    if (opts.limit !== undefined) query.limit = opts.limit;\n    return this.requestJson<Page<Delivery>>(\"GET\", \"/v1/deliveries\", { query });\n  }\n\n  /** Re-queue a delivery for another attempt. */\n  async redeliver(deliveryId: string): Promise<Delivery> {\n    return this.requestJson<Delivery>(\n      \"POST\",\n      `/v1/deliveries/${encodeURIComponent(deliveryId)}/redeliver`,\n    );\n  }\n\n  // ── Internals ──────────────────────────────────────────────────────────────\n\n  /** Issue a request and parse the JSON response as `T`. Never use for 204s (there's no body). */\n  private async requestJson<T>(\n    method: string,\n    path: string,\n    opts: RequestOptions = {},\n  ): Promise<T> {\n    const resp = await this.request(method, path, opts);\n    return (await resp.json()) as T;\n  }\n\n  /**\n   * The single request path used by every method: builds the URL (+ query), attaches auth, and runs\n   * the shared retry loop (connection errors + 429 honoring Retry-After + 5xx, capped exponential\n   * backoff), raising a typed {@link WebhookdApiError} on other 4xx/5xx. The caller reads the body.\n   */\n  private async request(\n    method: string,\n    path: string,\n    opts: RequestOptions = {},\n  ): Promise<Response> {\n    let url = `${this.baseUrl}${path}`;\n    if (opts.query) {\n      const qs = new URLSearchParams();\n      for (const [key, value] of Object.entries(opts.query)) {\n        if (value !== undefined && value !== null) qs.append(key, String(value));\n      }\n      const suffix = qs.toString();\n      if (suffix) url += `?${suffix}`;\n    }\n\n    const headers: Record<string, string> = {\n      Authorization: `Bearer ${this.apiKey}`,\n      ...opts.headers,\n    };\n    let body: string | undefined;\n    if (opts.body !== undefined) {\n      body = JSON.stringify(opts.body);\n      headers[\"Content-Type\"] = \"application/json\";\n    }\n\n    let lastErr: unknown;\n    for (let attempt = 0; attempt <= this.maxRetries; attempt++) {\n      let resp: Response;\n      try {\n        resp = await this.fetchImpl(url, {\n          method,\n          headers,\n          body,\n          signal: AbortSignal.timeout(this.timeoutMs),\n        });\n      } catch (err) {\n        lastErr = err;\n        if (attempt < this.maxRetries) {\n          await sleep(backoffMs(attempt));\n          continue;\n        }\n        throw new WebhookdError(`request failed: ${String(err)}`);\n      }\n\n      if (RETRY_STATUSES.has(resp.status) && attempt < this.maxRetries) {\n        await sleep(retryAfterMs(resp) ?? backoffMs(attempt));\n        continue;\n      }\n      if (resp.status >= 400) throw await apiError(resp);\n      return resp;\n    }\n    throw new WebhookdError(`request failed after retries: ${String(lastErr)}`);\n  }\n}\n\nfunction backoffMs(attempt: number): number {\n  return Math.min(2000, 200 * 2 ** attempt);\n}\n\nfunction retryAfterMs(resp: Response): number | null {\n  const raw = resp.headers.get(\"Retry-After\");\n  if (raw && /^\\d+$/.test(raw)) return Number(raw) * 1000;\n  return null;\n}\n\nasync function apiError(resp: Response): Promise<WebhookdApiError> {\n  // Read the body once; a non-envelope (or non-JSON) error body falls back to the raw text.\n  const text = await resp.text();\n  let code = \"error\";\n  let message = text;\n  try {\n    const data = JSON.parse(text) as { error?: { code?: string; message?: string } };\n    code = data.error?.code ?? code;\n    message = data.error?.message ?? message;\n  } catch {\n    // not JSON — keep the raw text as the message\n  }\n  return new WebhookdApiError(resp.status, code, message);\n}\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n","/**\n * @nimbusnexus/webhooks-sdk — the official TypeScript client for NimbusNexus Webhooks.\n *\n * - `verify` — verify an incoming webhook's HMAC signature (for subscribers).\n * - `WebhookdClient` — publish events to webhookd (for producers).\n */\nexport { DEFAULT_TOLERANCE_SECONDS, sign, verify } from \"./signature\";\nexport type { VerifyOptions } from \"./signature\";\nexport { WebhookdClient } from \"./client\";\nexport type {\n  ClientOptions,\n  PublishOptions,\n  WebhookdEvent,\n  Subscription,\n  Endpoint,\n  ApiKey,\n  Delivery,\n  Page,\n  CreateEndpointOptions,\n  ListEndpointsOptions,\n  EndpointPatch,\n  CreateApiKeyOptions,\n  ListDeliveriesOptions,\n} from \"./client\";\nexport { WebhookdApiError, WebhookdError } from \"./errors\";\n\n// Keep in lockstep with package.json + the release tag (see publish.yml's bump checklist).\nexport const VERSION = \"0.2.0\";\n"],"mappings":";AAQA,SAAS,YAAY,uBAAuB;AAE5C,IAAM,SAAS;AACR,IAAM,4BAA4B;AAEzC,SAAS,SAAS,OAAgC;AAChD,SAAO,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,OAAO,MAAM;AACnE;AAEA,SAAS,YAAY,SAAiB,WAAkC;AACtE,MAAI,cAAc,KAAM,QAAO;AAC/B,SAAO,OAAO,OAAO,CAAC,OAAO,KAAK,GAAG,SAAS,KAAK,OAAO,GAAG,OAAO,CAAC;AACvE;AAGO,SAAS,KACd,QACA,SACA,YAA2B,MACnB;AACR,QAAM,SAAS,WAAW,UAAU,MAAM,EACvC,OAAO,YAAY,SAAS,OAAO,GAAG,SAAS,CAAC,EAChD,OAAO,KAAK;AACf,SAAO,GAAG,MAAM,GAAG,MAAM;AAC3B;AAiBO,SAAS,OACd,QACA,SACA,WACA,OAAsB,CAAC,GACd;AACT,QAAM,EAAE,YAAY,MAAM,mBAAmB,2BAA2B,IAAI,IAAI;AAChF,QAAM,KAAK,cAAc,QAAQ,cAAc,SAAY,OAAO,OAAO,SAAS;AAClF,MAAI,OAAO,MAAM;AACf,QAAI,OAAO,MAAM,EAAE,EAAG,QAAO;AAC7B,UAAM,UAAU,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACnD,QAAI,KAAK,IAAI,UAAU,EAAE,IAAI,iBAAkB,QAAO;AAAA,EACxD;AACA,QAAM,WAAW,OAAO,KAAK,KAAK,QAAQ,SAAS,EAAE,CAAC;AAItD,aAAW,OAAO,UAAU,MAAM,GAAG,GAAG;AACtC,UAAM,QAAQ,IAAI,KAAK;AACvB,UAAM,YAAY,OAAO,KAAK,MAAM,WAAW,MAAM,IAAI,QAAQ,GAAG,MAAM,GAAG,KAAK,EAAE;AAEpF,QAAI,SAAS,WAAW,UAAU,UAAU,gBAAgB,UAAU,SAAS,EAAG,QAAO;AAAA,EAC3F;AACA,SAAO;AACT;;;ACxEO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EACvC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAOO,IAAM,mBAAN,cAA+B,cAAc;AAAA,EACzC;AAAA,EACA;AAAA,EAET,YAAY,YAAoB,MAAc,SAAiB;AAC7D,UAAM,IAAI,UAAU,IAAI,IAAI,KAAK,OAAO,EAAE;AAC1C,SAAK,OAAO;AACZ,SAAK,aAAa;AAClB,SAAK,OAAO;AAAA,EACd;AACF;;;ACpBA,IAAM,iBAAiB,oBAAI,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AAsJjD,IAAM,iBAAN,MAAqB;AAAA,EACT;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,MAAqB;AAC/B,SAAK,UAAU,KAAK,QAAQ,QAAQ,QAAQ,EAAE;AAC9C,SAAK,SAAS,KAAK;AACnB,SAAK,YAAY,KAAK,aAAa;AACnC,SAAK,aAAa,KAAK,cAAc;AACrC,SAAK,YAAY,KAAK,aAAa;AAAA,EACrC;AAAA,EAEA,MAAM,QACJ,WACA,SACA,OAAuB,CAAC,GACA;AACxB,UAAM,OAAgC;AAAA,MACpC,YAAY;AAAA,MACZ;AAAA,MACA,aAAa,KAAK,eAAe;AAAA,MACjC,aAAa,KAAK,eAAe;AAAA,IACnC;AACA,QAAI,KAAK,WAAW,OAAW,MAAK,SAAS,KAAK;AAElD,UAAM,UAAkC,CAAC;AACzC,QAAI,KAAK,mBAAmB,OAAW,SAAQ,iBAAiB,IAAI,KAAK;AAEzE,UAAM,OAAO,MAAM,KAAK,QAAQ,QAAQ,cAAc,EAAE,MAAM,QAAQ,CAAC;AACvE,UAAM,OAAQ,MAAM,KAAK,KAAK;AAC9B,WAAO;AAAA,MACL,IAAI,OAAO,KAAK,EAAE;AAAA,MAClB,UAAU,OAAO,KAAK,SAAS;AAAA,MAC/B,WAAW,OAAO,KAAK,UAAU;AAAA,MACjC,aAAa,OAAO,KAAK,eAAe,SAAS;AAAA,MACjD,aAAa,OAAO,KAAK,eAAe,MAAM;AAAA,MAC9C,mBAAmB,OAAO,KAAK,sBAAsB,CAAC;AAAA,MACtD,QAAS,KAAK,UAA4B;AAAA,IAC5C;AAAA,EACF;AAAA;AAAA;AAAA,EAKA,MAAM,eAAe,KAAa,OAA8B,CAAC,GAAsB;AACrF,UAAM,OAAgC;AAAA,MACpC;AAAA,MACA,aAAa,KAAK,eAAe;AAAA,MACjC,aAAa,KAAK,eAAe;AAAA,IACnC;AACA,QAAI,KAAK,kBAAkB,OAAW,MAAK,gBAAgB,KAAK;AAChE,QAAI,KAAK,WAAW,OAAW,MAAK,SAAS,KAAK;AAClD,QAAI,KAAK,gBAAgB,OAAW,MAAK,eAAe,KAAK;AAC7D,QAAI,KAAK,kBAAkB,OAAW,MAAK,iBAAiB,KAAK;AACjE,QAAI,KAAK,gBAAgB,OAAW,MAAK,cAAc,KAAK;AAC5D,QAAI,KAAK,kBAAkB,OAAW,MAAK,iBAAiB,KAAK;AACjE,QAAI,KAAK,sBAAsB,OAAW,MAAK,sBAAsB,KAAK;AAC1E,WAAO,KAAK,YAAsB,QAAQ,iBAAiB,EAAE,KAAK,CAAC;AAAA,EACrE;AAAA;AAAA,EAGA,MAAM,cAAc,OAA6B,CAAC,GAA4B;AAC5E,UAAM,QAAiC,EAAE,aAAa,KAAK,eAAe,OAAO;AACjF,QAAI,KAAK,WAAW,OAAW,OAAM,SAAS,KAAK;AACnD,QAAI,KAAK,UAAU,OAAW,OAAM,QAAQ,KAAK;AACjD,WAAO,KAAK,YAA4B,OAAO,iBAAiB,EAAE,MAAM,CAAC;AAAA,EAC3E;AAAA;AAAA,EAGA,MAAM,YAAY,IAA+B;AAC/C,WAAO,KAAK,YAAsB,OAAO,iBAAiB,mBAAmB,EAAE,CAAC,EAAE;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,eAAe,IAAY,OAAyC;AACxE,WAAO,KAAK,YAAsB,SAAS,iBAAiB,mBAAmB,EAAE,CAAC,IAAI;AAAA,MACpF,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,eAAe,IAA2B;AAC9C,UAAM,KAAK,QAAQ,UAAU,iBAAiB,mBAAmB,EAAE,CAAC,EAAE;AAAA,EACxE;AAAA;AAAA,EAGA,MAAM,qBAAqB,IAA+B;AACxD,WAAO,KAAK,YAAsB,QAAQ,iBAAiB,mBAAmB,EAAE,CAAC,gBAAgB;AAAA,EACnG;AAAA;AAAA,EAGA,MAAM,eAAe,IAA+B;AAClD,WAAO,KAAK,YAAsB,QAAQ,iBAAiB,mBAAmB,EAAE,CAAC,SAAS;AAAA,EAC5F;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,OAA4B,CAAC,GAAoB;AAClE,UAAM,OAAgC;AAAA,MACpC,MAAM,KAAK,QAAQ;AAAA,MACnB,OAAO,KAAK,SAAS;AAAA,IACvB;AACA,QAAI,KAAK,kBAAkB,OAAW,MAAK,kBAAkB,KAAK;AAClE,WAAO,KAAK,YAAoB,QAAQ,gBAAgB,EAAE,KAAK,CAAC;AAAA,EAClE;AAAA;AAAA,EAGA,MAAM,aAAa,IAA2B;AAC5C,UAAM,KAAK,QAAQ,UAAU,gBAAgB,mBAAmB,EAAE,CAAC,EAAE;AAAA,EACvE;AAAA;AAAA;AAAA,EAKA,MAAM,eAAe,OAA8B,CAAC,GAA4B;AAC9E,UAAM,QAAiC,CAAC;AACxC,QAAI,KAAK,WAAW,OAAW,OAAM,SAAS,KAAK;AACnD,QAAI,KAAK,eAAe,OAAW,OAAM,cAAc,KAAK;AAC5D,QAAI,KAAK,cAAc,OAAW,OAAM,aAAa,KAAK;AAC1D,QAAI,KAAK,UAAU,OAAW,OAAM,QAAQ,KAAK;AACjD,QAAI,KAAK,UAAU,OAAW,OAAM,QAAQ,KAAK;AACjD,QAAI,KAAK,MAAM,OAAW,OAAM,IAAI,KAAK;AACzC,QAAI,KAAK,WAAW,OAAW,OAAM,SAAS,KAAK;AACnD,QAAI,KAAK,UAAU,OAAW,OAAM,QAAQ,KAAK;AACjD,WAAO,KAAK,YAA4B,OAAO,kBAAkB,EAAE,MAAM,CAAC;AAAA,EAC5E;AAAA;AAAA,EAGA,MAAM,UAAU,YAAuC;AACrD,WAAO,KAAK;AAAA,MACV;AAAA,MACA,kBAAkB,mBAAmB,UAAU,CAAC;AAAA,IAClD;AAAA,EACF;AAAA;AAAA;AAAA,EAKA,MAAc,YACZ,QACA,MACA,OAAuB,CAAC,GACZ;AACZ,UAAM,OAAO,MAAM,KAAK,QAAQ,QAAQ,MAAM,IAAI;AAClD,WAAQ,MAAM,KAAK,KAAK;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,QACZ,QACA,MACA,OAAuB,CAAC,GACL;AACnB,QAAI,MAAM,GAAG,KAAK,OAAO,GAAG,IAAI;AAChC,QAAI,KAAK,OAAO;AACd,YAAM,KAAK,IAAI,gBAAgB;AAC/B,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,KAAK,GAAG;AACrD,YAAI,UAAU,UAAa,UAAU,KAAM,IAAG,OAAO,KAAK,OAAO,KAAK,CAAC;AAAA,MACzE;AACA,YAAM,SAAS,GAAG,SAAS;AAC3B,UAAI,OAAQ,QAAO,IAAI,MAAM;AAAA,IAC/B;AAEA,UAAM,UAAkC;AAAA,MACtC,eAAe,UAAU,KAAK,MAAM;AAAA,MACpC,GAAG,KAAK;AAAA,IACV;AACA,QAAI;AACJ,QAAI,KAAK,SAAS,QAAW;AAC3B,aAAO,KAAK,UAAU,KAAK,IAAI;AAC/B,cAAQ,cAAc,IAAI;AAAA,IAC5B;AAEA,QAAI;AACJ,aAAS,UAAU,GAAG,WAAW,KAAK,YAAY,WAAW;AAC3D,UAAI;AACJ,UAAI;AACF,eAAO,MAAM,KAAK,UAAU,KAAK;AAAA,UAC/B;AAAA,UACA;AAAA,UACA;AAAA,UACA,QAAQ,YAAY,QAAQ,KAAK,SAAS;AAAA,QAC5C,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,kBAAU;AACV,YAAI,UAAU,KAAK,YAAY;AAC7B,gBAAM,MAAM,UAAU,OAAO,CAAC;AAC9B;AAAA,QACF;AACA,cAAM,IAAI,cAAc,mBAAmB,OAAO,GAAG,CAAC,EAAE;AAAA,MAC1D;AAEA,UAAI,eAAe,IAAI,KAAK,MAAM,KAAK,UAAU,KAAK,YAAY;AAChE,cAAM,MAAM,aAAa,IAAI,KAAK,UAAU,OAAO,CAAC;AACpD;AAAA,MACF;AACA,UAAI,KAAK,UAAU,IAAK,OAAM,MAAM,SAAS,IAAI;AACjD,aAAO;AAAA,IACT;AACA,UAAM,IAAI,cAAc,iCAAiC,OAAO,OAAO,CAAC,EAAE;AAAA,EAC5E;AACF;AAEA,SAAS,UAAU,SAAyB;AAC1C,SAAO,KAAK,IAAI,KAAM,MAAM,KAAK,OAAO;AAC1C;AAEA,SAAS,aAAa,MAA+B;AACnD,QAAM,MAAM,KAAK,QAAQ,IAAI,aAAa;AAC1C,MAAI,OAAO,QAAQ,KAAK,GAAG,EAAG,QAAO,OAAO,GAAG,IAAI;AACnD,SAAO;AACT;AAEA,eAAe,SAAS,MAA2C;AAEjE,QAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,MAAI,OAAO;AACX,MAAI,UAAU;AACd,MAAI;AACF,UAAM,OAAO,KAAK,MAAM,IAAI;AAC5B,WAAO,KAAK,OAAO,QAAQ;AAC3B,cAAU,KAAK,OAAO,WAAW;AAAA,EACnC,QAAQ;AAAA,EAER;AACA,SAAO,IAAI,iBAAiB,KAAK,QAAQ,MAAM,OAAO;AACxD;AAEA,SAAS,MAAM,IAA2B;AACxC,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AACzD;;;AC/WO,IAAM,UAAU;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nimbusnexus/webhooks-sdk",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "type": "module",
   "description": "Official TypeScript SDK for NimbusNexus Webhooks — publish events + verify webhook signatures.",
   "license": "MIT",