@noresponse/node 1.0.1 → 2.0.1

package/dist/commonjs/types/unrecognized.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startCountingUnrecognized = startCountingUnrecognized;
+exports.unrecognized = unrecognized;
+function unrecognized(value) {
+    globalCount++;
+    return value;
+}
+let globalCount = 0;
+let refCount = 0;
+function startCountingUnrecognized() {
+    refCount++;
+    const start = globalCount;
+    return {
+        /**
+         * Ends counting and returns the delta.
+         * @param delta - If provided, only this amount is added to the parent counter
+         *   (used for nested unions where we only want to record the winning option's count).
+         *   If not provided, records all counts since start().
+         */
+        end: (delta) => {
+            const count = globalCount - start;
+            // Reset globalCount back to start, then add only the specified delta
+            globalCount = start + (delta ?? count);
+            if (--refCount === 0)
+                globalCount = 0;
+            return count;
+        },
+    };
+}
+//# sourceMappingURL=unrecognized.js.map

package/dist/commonjs/types/unrecognized.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unrecognized.js","sourceRoot":"","sources":["../../../src/types/unrecognized.ts"],"names":[],"mappings":";;;QA8BS,YAAY;AA3BrB,SAAS,YAAY,CAAI,KAAQ,EAAmB;IAClD,WAAW,EAAE,CAAC;IACd,OAAO,KAAwB,CAAC;AAAA,CACjC;AAED,IAAI,WAAW,GAAG,CAAC,CAAC;AACpB,IAAI,QAAQ,GAAG,CAAC,CAAC;AACjB,qCAA4C;IAC1C,QAAQ,EAAE,CAAC;IACX,MAAM,KAAK,GAAG,WAAW,CAAC;IAC1B,OAAO;QACL;;;;;WAKG;QACH,GAAG,EAAE,CAAC,KAAc,EAAE,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,WAAW,GAAG,KAAK,CAAC;YAClC,qEAAqE;YACrE,WAAW,GAAG,KAAK,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC;YACvC,IAAI,EAAE,QAAQ,KAAK,CAAC;gBAAE,WAAW,GAAG,CAAC,CAAC;YACtC,OAAO,KAAK,CAAC;QAAA,CACd;KACF,CAAC;AAAA,CACH"}

package/dist/commonjs/wait.d.ts

@@ -0,0 +1,25 @@
+import type { Assessment } from "./models/assessment.js";
+import type { ResponseMode } from "./models/response-mode.js";
+import type { WithMeta } from "./meta.js";
+export declare const DEFAULT_WAIT_TIMEOUT_MS = 30000;
+/** The shortest interval between polls when the server sends no Retry-After. */
+export declare const MIN_POLL_INTERVAL_MS = 1000;
+export type WaitOptions = {
+    /** Give up after this long with an APITimeoutError. Default 30 000 ms. */
+    timeoutMs?: number;
+    responseMode?: ResponseMode;
+    /** Abort the wait early. */
+    signal?: AbortSignal;
+};
+export type Getter = (assessmentId: string, options: {
+    responseMode?: ResponseMode;
+    signal?: AbortSignal;
+    timeoutMs?: number;
+}) => Promise<WithMeta<Assessment>>;
+/**
+ * Poll `get` until the assessment is not pending. Each poll waits the
+ * server's Retry-After, with a 1 second floor, and the whole wait is bounded
+ * by `timeoutMs` (default 30 s), after which an APITimeoutError is thrown.
+ */
+export declare function waitForAssessment(get: Getter, assessmentId: string, options?: WaitOptions): Promise<WithMeta<Assessment>>;
+//# sourceMappingURL=wait.d.ts.map

package/dist/commonjs/wait.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wait.d.ts","sourceRoot":"","sources":["../../src/wait.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE1C,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAC9C,gFAAgF;AAChF,eAAO,MAAM,oBAAoB,OAAQ,CAAC;AAE1C,MAAM,MAAM,WAAW,GAAG;IACxB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,4BAA4B;IAC5B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG,CACnB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE;IAAE,YAAY,CAAC,EAAE,YAAY,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,KAC/E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;AAoBnC;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAyB/B"}

package/dist/commonjs/wait.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MIN_POLL_INTERVAL_MS = exports.DEFAULT_WAIT_TIMEOUT_MS = void 0;
+exports.waitForAssessment = waitForAssessment;
+/**
+ * Poll an assessment until it is no longer pending. Hand-written; not generated.
+ */
+const http_client_errors_js_1 = require("./models/errors/http-client-errors.js");
+exports.DEFAULT_WAIT_TIMEOUT_MS = 30000;
+/** The shortest interval between polls when the server sends no Retry-After. */
+exports.MIN_POLL_INTERVAL_MS = 1000;
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(signal.reason instanceof Error ? signal.reason : new Error("Wait aborted"));
+            return;
+        }
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        function onAbort() {
+            clearTimeout(timer);
+            reject(signal?.reason instanceof Error ? signal.reason : new Error("Wait aborted"));
+        }
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+}
+/**
+ * Poll `get` until the assessment is not pending. Each poll waits the
+ * server's Retry-After, with a 1 second floor, and the whole wait is bounded
+ * by `timeoutMs` (default 30 s), after which an APITimeoutError is thrown.
+ */
+async function waitForAssessment(get, assessmentId, options = {}) {
+    const timeoutMs = options.timeoutMs ?? exports.DEFAULT_WAIT_TIMEOUT_MS;
+    if (!Number.isInteger(timeoutMs) || timeoutMs <= 0) {
+        throw new TypeError("timeoutMs must be a positive integer");
+    }
+    const deadline = Date.now() + timeoutMs;
+    const getOptions = {};
+    if (options.responseMode !== undefined)
+        getOptions.responseMode = options.responseMode;
+    if (options.signal !== undefined)
+        getOptions.signal = options.signal;
+    for (;;) {
+        const requestRemaining = deadline - Date.now();
+        if (requestRemaining <= 0) {
+            throw new http_client_errors_js_1.RequestTimeoutError(`Timed out after ${timeoutMs} ms waiting for assessment ${assessmentId}`);
+        }
+        getOptions.timeoutMs = requestRemaining;
+        const assessment = await get(assessmentId, getOptions);
+        if (assessment.status !== "pending")
+            return assessment;
+        const remaining = deadline - Date.now();
+        if (remaining <= 0) {
+            throw new http_client_errors_js_1.RequestTimeoutError(`Timed out after ${timeoutMs} ms waiting for assessment ${assessmentId}`);
+        }
+        const retryAfter = assessment.meta.retryAfter;
+        const delay = Math.max(exports.MIN_POLL_INTERVAL_MS, (retryAfter ?? 0) * 1000);
+        await sleep(Math.min(delay, remaining), options.signal);
+    }
+}
+//# sourceMappingURL=wait.js.map

package/dist/commonjs/wait.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wait.js","sourceRoot":"","sources":["../../src/wait.ts"],"names":[],"mappings":";;;;AAAA;;GAEG;AACH,iFAA4E;AAK/D,QAAA,uBAAuB,GAAG,KAAM,CAAC;AAC9C,gFAAgF;AACnE,QAAA,oBAAoB,GAAG,IAAK,CAAC;AAe1C,SAAS,KAAK,CAAC,EAAU,EAAE,MAA+B,EAAiB;IACzE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;QACtC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,EAAE,CAAC;QAAA,CACX,EAAE,EAAE,CAAC,CAAC;QACP,SAAS,OAAO,GAAG;YACjB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,MAAM,EAAE,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QAAA,CACrF;QACD,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAAA,CAC5D,CAAC,CAAC;AAAA,CACJ;AAED;;;;GAIG;AACI,KAAK,4BACV,GAAW,EACX,YAAoB,EACpB,OAAO,GAAgB,EAAE,EACM;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAA,uBAAuB,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,MAAM,UAAU,GAA8E,EAAE,CAAC;IACjG,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;QAAE,UAAU,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IACvF,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IACrE,SAAS,CAAC;QACR,MAAM,gBAAgB,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/C,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,2CAAmB,CAAC,mBAAmB,SAAS,8BAA8B,YAAY,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,UAAU,CAAC,SAAS,GAAG,gBAAgB,CAAC;QACxC,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QACvD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC;QACvD,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,2CAAmB,CAAC,mBAAmB,SAAS,8BAA8B,YAAY,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAA,oBAAoB,EAAE,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,CAAC;AAAA,CACF"}

package/dist/commonjs/webhooks.d.ts

@@ -0,0 +1,69 @@
+import { type Assessment } from "./models/assessment.js";
+export declare const DEFAULT_TOLERANCE_SECONDS = 300;
+/** Any case-insensitive mapping of header name to value: Fetch Headers, Node IncomingHttpHeaders, a plain object or entries. */
+export type HeaderInput = Headers | Iterable<readonly [string, string]> | Readonly<Record<string, string | string[] | undefined>>;
+/** Webhook key id (whk_...) to its secret. Hold both during a rotation. */
+export type WebhookSecrets = Readonly<Record<string, string | Uint8Array>>;
+export type ConstructEventOptions = {
+    /** How far the NR-Webhook-Timestamp may be from now, in seconds. Default 300. */
+    toleranceSeconds?: number;
+    /** The receiver's clock in Unix seconds; defaults to now. */
+    now?: number;
+};
+/** The final event for an assessment: it has expired and GET now answers 404. */
+export type AssessmentExpired = {
+    assessmentId: string;
+    accountId: string;
+    /** The last served version; expiry is not a revision. */
+    assessmentVersion: number;
+    status: "expired";
+    changeReason: "expired";
+};
+export type EndpointVerification = {
+    endpointId: string;
+    challenge: string;
+};
+export type AssessmentUpdatedEvent = {
+    id: string;
+    type: "assessment.updated";
+    createdAt: string;
+    /** The assessment exactly as assessments.get returns it at this version. */
+    data: Assessment;
+};
+export type AssessmentExpiredEvent = {
+    id: string;
+    type: "assessment.updated";
+    createdAt: string;
+    data: AssessmentExpired;
+};
+export type EndpointVerificationEvent = {
+    id: string;
+    type: "endpoint.verification";
+    createdAt: string;
+    data: EndpointVerification;
+};
+export type WebhookEvent = AssessmentUpdatedEvent | AssessmentExpiredEvent | EndpointVerificationEvent;
+export type WebhookErrorCode = "missing_header" | "duplicate_header" | "invalid_timestamp" | "unknown_key" | "invalid_signature" | "invalid_payload";
+/** Thrown by constructEvent and verificationResponse. Answer 400 and do not process the delivery. */
+export declare class WebhookVerificationError extends Error {
+    readonly code: WebhookErrorCode;
+    constructor(code: WebhookErrorCode, message: string);
+}
+/**
+ * Verify a delivery and return the typed event.
+ *
+ * `payload` is the raw request body (bytes, or the exact text). `headers` is
+ * any case-insensitive header mapping; a repeated signature header, in any
+ * letter case, is refused. `secrets` maps each whk_ key id NoResponse gave you
+ * to its secret, so two can be held during a rotation. Deliveries older than
+ * `toleranceSeconds` (default 300) are refused; deduplicate on `event.id`
+ * and keep the highest `assessmentVersion` yourself.
+ */
+export declare function constructEvent(payload: Uint8Array | string, headers: HeaderInput, secrets: WebhookSecrets, options?: ConstructEventOptions): WebhookEvent;
+/** The body to answer an endpoint.verification event with, as JSON, status 200. */
+export declare function verificationResponse(event: WebhookEvent): {
+    challenge: string;
+};
+/** True for the terminal expiry event. Delete what you hold for the assessment and fetch nothing. */
+export declare function isExpiredEvent(event: WebhookEvent): event is AssessmentExpiredEvent;
+//# sourceMappingURL=webhooks.d.ts.map

package/dist/commonjs/webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../src/webhooks.ts"],"names":[],"mappings":"AAQA,OAAO,EAA4B,KAAK,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEnF,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAa7C,gIAAgI;AAChI,MAAM,MAAM,WAAW,GACnB,OAAO,GACP,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACnC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;AAE5D,2EAA2E;AAC3E,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC;AAE3E,MAAM,MAAM,qBAAqB,GAAG;IAClC,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,iFAAiF;AACjF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,SAAS,CAAC;IAClB,YAAY,EAAE,SAAS,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,oBAAoB,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,IAAI,EAAE,UAAU,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,oBAAoB,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,iBAAiB,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,uBAAuB,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,oBAAoB,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,sBAAsB,GAAG,sBAAsB,GAAG,yBAAyB,CAAC;AAEvG,MAAM,MAAM,gBAAgB,GACxB,gBAAgB,GAChB,kBAAkB,GAClB,mBAAmB,GACnB,aAAa,GACb,mBAAmB,GACnB,iBAAiB,CAAC;AAEtB,qGAAqG;AACrG,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,YAAY,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAIlD;CACF;AAqDD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,UAAU,GAAG,MAAM,EAC5B,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE,qBAA0B,GAClC,YAAY,CA8Cd;AAED,mFAAmF;AACnF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAK/E;AAED,qGAAqG;AACrG,wBAAgB,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,KAAK,IAAI,sBAAsB,CAEnF"}

package/dist/commonjs/webhooks.js

@@ -0,0 +1,191 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebhookVerificationError = exports.DEFAULT_TOLERANCE_SECONDS = void 0;
+exports.constructEvent = constructEvent;
+exports.verificationResponse = verificationResponse;
+exports.isExpiredEvent = isExpiredEvent;
+/**
+ * Webhook verification. Hand-written; not generated. Needs Node.js (node:crypto).
+ *
+ * Verify the exact bytes received: the signature is HMAC-SHA256 over
+ * "<timestamp>.<raw body>", so re-serialising parsed JSON breaks it.
+ */
+const node_crypto_1 = require("node:crypto");
+const z = __importStar(require("zod/v4-mini"));
+const assessment_js_1 = require("./models/assessment.js");
+exports.DEFAULT_TOLERANCE_SECONDS = 300;
+const REQUIRED = ["nr-webhook-id", "nr-webhook-timestamp", "nr-webhook-key-id", "nr-webhook-signature"];
+const KEY_ID = /^whk_[A-Za-z0-9]{8,64}$/;
+const SIGNATURE = /^v1=[0-9a-f]{64}$/;
+const TIMESTAMP = /^[0-9]{1,12}$/;
+const CHALLENGE = /^[A-Za-z0-9_-]{43}$/;
+const EVENT_ID = /^evt_[0-9A-HJKMNP-TV-Z]{26}$/;
+const ASSESSMENT_ID = /^asm_[0-9A-HJKMNP-TV-Z]{26}$/;
+const ACCOUNT_ID = /^[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}$/;
+const ENDPOINT_ID = /^whe_[0-9A-HJKMNP-TV-Z]{26}$/;
+const DATETIME = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
+/** Thrown by constructEvent and verificationResponse. Answer 400 and do not process the delivery. */
+class WebhookVerificationError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "WebhookVerificationError";
+        this.code = code;
+    }
+}
+exports.WebhookVerificationError = WebhookVerificationError;
+function fail(code, message) {
+    throw new WebhookVerificationError(code, message);
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function validDateTime(value) {
+    return DATETIME.test(value) && !Number.isNaN(Date.parse(value));
+}
+function entriesOf(headers) {
+    if (typeof Headers !== "undefined" && headers instanceof Headers)
+        return [...headers.entries()];
+    if (typeof headers[Symbol.iterator] === "function") {
+        return [...headers];
+    }
+    return Object.entries(headers);
+}
+function collect(headers) {
+    const found = new Map();
+    for (const [name, raw] of entriesOf(headers)) {
+        const key = name.toLowerCase();
+        if (!REQUIRED.includes(key))
+            continue;
+        if (Array.isArray(raw)) {
+            if (raw.length !== 1)
+                fail("duplicate_header", `Webhook header ${key} is repeated`);
+        }
+        const value = Array.isArray(raw) ? raw[0] : raw;
+        if (found.has(key))
+            fail("duplicate_header", `Webhook header ${key} is repeated`);
+        if (typeof value === "string")
+            found.set(key, value);
+    }
+    for (const name of REQUIRED) {
+        if (!found.get(name))
+            fail("missing_header", `Webhook header ${name} is missing`);
+    }
+    return found;
+}
+function expired(data) {
+    const { assessment_id, account_id, assessment_version, change_reason } = data;
+    if (typeof assessment_id !== "string" || !ASSESSMENT_ID.test(assessment_id) ||
+        typeof account_id !== "string" || !ACCOUNT_ID.test(account_id) ||
+        typeof assessment_version !== "number" || !Number.isInteger(assessment_version) || assessment_version < 1 ||
+        change_reason !== "expired") {
+        fail("invalid_payload", "Expired assessment event is malformed");
+    }
+    return { assessmentId: assessment_id, accountId: account_id, assessmentVersion: assessment_version, status: "expired", changeReason: "expired" };
+}
+/**
+ * Verify a delivery and return the typed event.
+ *
+ * `payload` is the raw request body (bytes, or the exact text). `headers` is
+ * any case-insensitive header mapping; a repeated signature header, in any
+ * letter case, is refused. `secrets` maps each whk_ key id NoResponse gave you
+ * to its secret, so two can be held during a rotation. Deliveries older than
+ * `toleranceSeconds` (default 300) are refused; deduplicate on `event.id`
+ * and keep the highest `assessmentVersion` yourself.
+ */
+function constructEvent(payload, headers, secrets, options = {}) {
+    const raw = typeof payload === "string" ? Buffer.from(payload, "utf8") : Buffer.from(payload.buffer, payload.byteOffset, payload.byteLength);
+    const tolerance = options.toleranceSeconds ?? exports.DEFAULT_TOLERANCE_SECONDS;
+    const now = options.now ?? Math.floor(Date.now() / 1000);
+    const found = collect(headers);
+    const timestamp = found.get("nr-webhook-timestamp");
+    if (!TIMESTAMP.test(timestamp) || Math.abs(now - Number(timestamp)) > tolerance) {
+        fail("invalid_timestamp", "Webhook timestamp is outside the replay window");
+    }
+    const keyId = found.get("nr-webhook-key-id");
+    if (!KEY_ID.test(keyId) || !Object.prototype.hasOwnProperty.call(secrets, keyId)) {
+        fail("unknown_key", "Webhook key id is not one this receiver holds");
+    }
+    const signature = found.get("nr-webhook-signature");
+    if (!SIGNATURE.test(signature))
+        fail("invalid_signature", "Webhook signature is malformed");
+    const expected = (0, node_crypto_1.createHmac)("sha256", secrets[keyId]).update(timestamp).update(".").update(raw).digest();
+    if (!(0, node_crypto_1.timingSafeEqual)(expected, Buffer.from(signature.slice(3), "hex"))) {
+        fail("invalid_signature", "Webhook signature does not match");
+    }
+    let body;
+    try {
+        body = JSON.parse(raw.toString("utf8"));
+    }
+    catch {
+        fail("invalid_payload", "Webhook body is not JSON");
+    }
+    if (!isRecord(body) || body["id"] !== found.get("nr-webhook-id")) {
+        fail("invalid_payload", "Webhook event id does not match NR-Webhook-Id");
+    }
+    const { id, type, created_at, data } = body;
+    if (typeof id !== "string" || !EVENT_ID.test(id) || typeof created_at !== "string" || !validDateTime(created_at) || !isRecord(data)) {
+        fail("invalid_payload", "Webhook event envelope is malformed");
+    }
+    if (type === "endpoint.verification") {
+        const { endpoint_id, challenge } = data;
+        if (typeof endpoint_id !== "string" || !ENDPOINT_ID.test(endpoint_id) || typeof challenge !== "string" || !CHALLENGE.test(challenge)) {
+            fail("invalid_payload", "Endpoint verification event is malformed");
+        }
+        return { id, type, createdAt: created_at, data: { endpointId: endpoint_id, challenge } };
+    }
+    if (type !== "assessment.updated")
+        fail("invalid_payload", "Unknown webhook event type");
+    if (data["status"] === "expired") {
+        return { id, type, createdAt: created_at, data: expired(data) };
+    }
+    const result = z.safeParse(assessment_js_1.Assessment$inboundSchema, data);
+    if (!result.success)
+        fail("invalid_payload", "Webhook data is not an assessment");
+    return { id, type, createdAt: created_at, data: result.data };
+}
+/** The body to answer an endpoint.verification event with, as JSON, status 200. */
+function verificationResponse(event) {
+    if (event.type !== "endpoint.verification") {
+        fail("invalid_payload", "Not an endpoint.verification event");
+    }
+    return { challenge: event.data.challenge };
+}
+/** True for the terminal expiry event. Delete what you hold for the assessment and fetch nothing. */
+function isExpiredEvent(event) {
+    return event.type === "assessment.updated" && event.data.status === "expired";
+}
+//# sourceMappingURL=webhooks.js.map

package/dist/commonjs/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/webhooks.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;GAKG;AACH,6CAA0D;AAC1D,MAAY,CAAC,wCAAoB;AACjC,0DAAmF;AAEtE,QAAA,yBAAyB,GAAG,GAAG,CAAC;AAE7C,MAAM,QAAQ,GAAG,CAAC,eAAe,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,sBAAsB,CAAU,CAAC;AACjH,MAAM,MAAM,GAAG,yBAAyB,CAAC;AACzC,MAAM,SAAS,GAAG,mBAAmB,CAAC;AACtC,MAAM,SAAS,GAAG,eAAe,CAAC;AAClC,MAAM,SAAS,GAAG,qBAAqB,CAAC;AACxC,MAAM,QAAQ,GAAG,8BAA8B,CAAC;AAChD,MAAM,aAAa,GAAG,8BAA8B,CAAC;AACrD,MAAM,UAAU,GAAG,sCAAsC,CAAC;AAC1D,MAAM,WAAW,GAAG,8BAA8B,CAAC;AACnD,MAAM,QAAQ,GAAG,sEAAsE,CAAC;AAiExF,qGAAqG;AACrG,8BAAsC,SAAQ,KAAK;IACxC,IAAI,CAAmB;IAChC,YAAY,IAAsB,EAAE,OAAe,EAAE;QACnD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAAA,CAClB;CACF;;AAED,SAAS,IAAI,CAAC,IAAsB,EAAE,OAAe,EAAS;IAC5D,MAAM,IAAI,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAAA,CACnD;AAED,SAAS,QAAQ,CAAC,KAAc,EAAoC;IAClE,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAAA,CAC7E;AAED,SAAS,aAAa,CAAC,KAAa,EAAW;IAC7C,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAAA,CACjE;AAED,SAAS,SAAS,CAAC,OAAoB,EAA2D;IAChG,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,YAAY,OAAO;QAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAChG,IAAI,OAAQ,OAA6B,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,UAAU,EAAE,CAAC;QAC1E,OAAO,CAAC,GAAI,OAA+C,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,OAAwD,CAAC,CAAC;AAAA,CACjF;AAED,SAAS,OAAO,CAAC,OAAoB,EAAuB;IAC1D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAE,QAA8B,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;gBAAE,IAAI,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,cAAc,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAChD,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,cAAc,CAAC,CAAC;QAClF,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,gBAAgB,EAAE,kBAAkB,IAAI,aAAa,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACd;AAED,SAAS,OAAO,CAAC,IAA6B,EAAqB;IACjE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,kBAAkB,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAC9E,IACE,OAAO,aAAa,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC;QACvE,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;QAC9D,OAAO,kBAAkB,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC,IAAI,kBAAkB,GAAG,CAAC;QACzG,aAAa,KAAK,SAAS,EAC3B,CAAC;QACD,IAAI,CAAC,iBAAiB,EAAE,uCAAuC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;AAAA,CAClJ;AAED;;;;;;;;;GASG;AACH,wBACE,OAA4B,EAC5B,OAAoB,EACpB,OAAuB,EACvB,OAAO,GAA0B,EAAE,EACrB;IACd,MAAM,GAAG,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7I,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,IAAI,QAAA,yBAAyB,CAAC;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAE,CAAC;IACrD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,SAAS,EAAE,CAAC;QAChF,IAAI,CAAC,mBAAmB,EAAE,gDAAgD,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAE,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;QACjF,IAAI,CAAC,aAAa,EAAE,+CAA+C,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAE,CAAC;IACrD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,IAAI,CAAC,mBAAmB,EAAE,gCAAgC,CAAC,CAAC;IAC5F,MAAM,QAAQ,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1G,IAAI,CAAC,IAAA,6BAAe,EAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IAC5C,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpI,IAAI,CAAC,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;QACrC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QACxC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACrI,IAAI,CAAC,iBAAiB,EAAE,0CAA0C,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,CAAC;IAC3F,CAAC;IACD,IAAI,IAAI,KAAK,oBAAoB;QAAE,IAAI,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;IACzF,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,wCAAwB,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,IAAI,CAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC;IAClF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAAA,CAC/D;AAED,mFAAmF;AACnF,8BAAqC,KAAmB,EAAyB;IAC/E,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;QAC3C,IAAI,CAAC,iBAAiB,EAAE,oCAAoC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;AAAA,CAC5C;AAED,qGAAqG;AACrG,wBAA+B,KAAmB,EAAmC;IACnF,OAAO,KAAK,CAAC,IAAI,KAAK,oBAAoB,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;AAAA,CAC/E"}

package/dist/esm/auth.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Auth context adapters. Hand-written; not generated.
+ *
+ * Each adapter maps claims your backend has already verified into the
+ * `authContext` of an assessment request. Pass verified claims, not a raw token.
+ */
+import type { AuthContext } from "./models/auth-context.js";
+export type VerifiedClaims = Record<string, unknown>;
+export type AuthContextOverrides = Partial<AuthContext>;
+/** Map verified WorkOS AuthKit claims plus verified user or session record overrides. */
+export declare function fromWorkOS(claims: VerifiedClaims, overrides?: AuthContextOverrides): AuthContext;
+/** Map verified Clerk session claims. Pass Session.createdAt as sessionCreatedAt. */
+export declare function fromClerk(claims: VerifiedClaims, overrides?: AuthContextOverrides): AuthContext;
+/** Map verified Auth0 ID token, userinfo or normalised session claims. Do not pass an opaque API access token. */
+export declare function fromAuth0(claims: VerifiedClaims, overrides?: AuthContextOverrides): AuthContext;
+/** Generic OIDC adapter for providers without a first-class helper. `provider` is a lowercase slug. */
+export declare function fromOIDC(provider: string, claims: VerifiedClaims, overrides?: AuthContextOverrides): AuthContext;
+//# sourceMappingURL=auth.d.ts.map

package/dist/esm/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACrD,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;AAwExD,yFAAyF;AACzF,wBAAgB,UAAU,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,GAAE,oBAAyB,GAAG,WAAW,CAQpG;AAED,qFAAqF;AACrF,wBAAgB,SAAS,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,GAAE,oBAAyB,GAAG,WAAW,CAkBnG;AAED,kHAAkH;AAClH,wBAAgB,SAAS,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,GAAE,oBAAyB,GAAG,WAAW,CAcnG;AAED,uGAAuG;AACvG,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,GAAE,oBAAyB,GAAG,WAAW,CAGpH"}

package/dist/esm/auth.js

@@ -0,0 +1,123 @@
+function text(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function iso(value) {
+    if (typeof value === "string")
+        return value;
+    // Whole UTC seconds (the fraction is truncated), as the Go and Python helpers write it.
+    if (typeof value === "number" && Number.isFinite(value)) {
+        return new Date(Math.trunc(value) * 1000).toISOString().replace(".000Z", "Z");
+    }
+    return undefined;
+}
+// Defaults are the contract's bounds for roles and scopes (32 items of at
+// most 64 characters); audiences are 8 x 256 and amr 8 x 32. The Go and
+// Python helpers apply the same caps. Over-long values are dropped, not truncated.
+function bounded(values, limit, maxLength) {
+    const kept = values
+        .filter((item) => typeof item === "string" && item.length > 0 && [...item].length <= maxLength)
+        .slice(0, limit);
+    return kept.length ? kept : undefined;
+}
+function strings(value, limit = 32, maxLength = 64) {
+    if (typeof value === "string")
+        return bounded(value.split(/\s+/), limit, maxLength);
+    return Array.isArray(value) ? bounded(value, limit, maxLength) : undefined;
+}
+function delimitedStrings(value, limit = 32, maxLength = 64) {
+    if (typeof value !== "string")
+        return strings(value, limit, maxLength);
+    return bounded(value.split(/[\s,]+/).map((item) => item.trim()), limit, maxLength);
+}
+function audiences(value) {
+    return strings(value, 8, 256);
+}
+function object(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+function actorPresent(value) {
+    const record = object(value);
+    return Boolean(record ? (text(record["sub"]) ?? text(record["email"])) : text(value));
+}
+function defined(value) {
+    return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== undefined));
+}
+function base(provider, claims, overrides = {}, options = {}) {
+    const issuer = text(overrides.issuer) ?? text(claims["iss"]);
+    const subject = text(overrides.subject) ?? text(claims["sub"]);
+    if (!issuer || !subject)
+        throw new TypeError("NoResponse auth context requires a verified issuer and subject");
+    const mergedAudiences = overrides.audiences ?? audiences(claims["aud"]);
+    const context = { provider, issuer, subject, verified: true, transport: "backend" };
+    if (mergedAudiences?.length) {
+        context.audiences = mergedAudiences;
+        context.audience = overrides.audience ?? mergedAudiences[0];
+    }
+    const issuedAt = iso(claims["iat"]);
+    if (options.includeIssuedAt !== false && issuedAt)
+        context.issuedAt = issuedAt;
+    const expiresAt = iso(claims["exp"]);
+    if (expiresAt)
+        context.expiresAt = expiresAt;
+    const authTime = iso(claims["auth_time"]);
+    if (authTime)
+        context.authTime = authTime;
+    const sessionId = text(claims["sid"]);
+    if (sessionId)
+        context.sessionId = sessionId;
+    const tokenId = text(claims["jti"]);
+    if (tokenId)
+        context.tokenId = tokenId;
+    return { ...context, ...defined(overrides) };
+}
+/** Map verified WorkOS AuthKit claims plus verified user or session record overrides. */
+export function fromWorkOS(claims, overrides = {}) {
+    const defaults = {
+        organizationId: text(claims["org_id"]),
+        roles: strings(claims["roles"] ?? claims["role"]),
+        scopes: strings(claims["permissions"]),
+        impersonated: actorPresent(claims["act"]),
+    };
+    return base("workos", claims, { ...defaults, ...overrides });
+}
+/** Map verified Clerk session claims. Pass Session.createdAt as sessionCreatedAt. */
+export function fromClerk(claims, overrides = {}) {
+    const org = object(claims["o"]);
+    const secondFactorAgeMinutes = Array.isArray(claims["fva"]) && typeof claims["fva"][1] === "number" && Number.isFinite(claims["fva"][1]) ? claims["fva"][1] : undefined;
+    const mfa = secondFactorAgeMinutes !== undefined && secondFactorAgeMinutes >= 0
+        ? { present: true, ageSeconds: Math.trunc(secondFactorAgeMinutes * 60) }
+        : undefined;
+    const defaults = {
+        organizationId: text(org?.["id"]) ?? text(claims["org_id"]),
+        // Clerk's role claim is one role slug, not a list.
+        roles: bounded([org?.["rol"]], 32, 64) ?? bounded([claims["org_role"]], 32, 64),
+        scopes: delimitedStrings(org?.["per"]) ?? delimitedStrings(claims["org_permissions"]),
+        impersonated: actorPresent(claims["act"]),
+        ...(mfa ? { mfa } : {}),
+    };
+    // iat is a 60-second token refresh clock, so it is not sent as issuedAt; session age is the sessionCreatedAt override.
+    return base("clerk", claims, { ...defaults, ...overrides }, { includeIssuedAt: false });
+}
+/** Map verified Auth0 ID token, userinfo or normalised session claims. Do not pass an opaque API access token. */
+export function fromAuth0(claims, overrides = {}) {
+    const amr = strings(claims["amr"], 8, 32);
+    const mfaMethods = amr?.filter((method) => method.toLowerCase() !== "pwd");
+    const defaults = {
+        organizationId: text(claims["org_id"]),
+        scopes: strings(claims["scope"]) ?? strings(claims["permissions"]),
+        emailVerified: typeof claims["email_verified"] === "boolean" ? claims["email_verified"] : undefined,
+        phoneVerified: typeof claims["phone_number_verified"] === "boolean" ? claims["phone_number_verified"] : undefined,
+        impersonated: actorPresent(claims["act"]),
+        ...(mfaMethods?.length
+            ? { mfa: { present: amr?.some((method) => method.toLowerCase() === "mfa") ?? false, methods: mfaMethods } }
+            : {}),
+    };
+    return base("auth0", claims, { ...defaults, ...overrides });
+}
+/** Generic OIDC adapter for providers without a first-class helper. `provider` is a lowercase slug. */
+export function fromOIDC(provider, claims, overrides = {}) {
+    if (!/^[a-z0-9][a-z0-9._-]{1,31}$/.test(provider))
+        throw new TypeError("provider must be a lowercase provider slug");
+    return base(provider, claims, overrides);
+}
+//# sourceMappingURL=auth.js.map

package/dist/esm/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth.ts"],"names":[],"mappings":"AAWA,SAAS,IAAI,CAAC,KAAc,EAAsB;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CAC1E;AACD,SAAS,GAAG,CAAC,KAAc,EAAsB;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,wFAAwF;IACxF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CAClB;AACD,0EAA0E;AAC1E,wEAAwE;AACxE,mFAAmF;AACnF,SAAS,OAAO,CAAC,MAAiB,EAAE,KAAa,EAAE,SAAiB,EAAwB;IAC1F,MAAM,IAAI,GAAG,MAAM;SAChB,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC;SAC9G,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACnB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CACvC;AACD,SAAS,OAAO,CAAC,KAAc,EAAE,KAAK,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAwB;IACjF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACpF,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CAC5E;AACD,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAK,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAwB;IAC1F,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AAAA,CACpF;AACD,SAAS,SAAS,CAAC,KAAc,EAAwB;IACvD,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;AAAA,CAC/B;AACD,SAAS,MAAM,CAAC,KAAc,EAAuC;IACnE,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CAC9H;AACD,SAAS,YAAY,CAAC,KAAc,EAAW;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAAA,CACvF;AACD,SAAS,OAAO,CAAmB,KAAQ,EAAK;IAC9C,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAM,CAAC;AAAA,CAC1F;AAED,SAAS,IAAI,CACX,QAAgB,EAChB,MAAsB,EACtB,SAAS,GAAyB,EAAE,EACpC,OAAO,GAAkC,EAAE,EAC9B;IACb,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,SAAS,CAAC,gEAAgE,CAAC,CAAC;IAC/G,MAAM,eAAe,GAAG,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,MAAM,OAAO,GAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACjG,IAAI,eAAe,EAAE,MAAM,EAAE,CAAC;QAC5B,OAAO,CAAC,SAAS,GAAG,eAAe,CAAC;QACpC,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,QAAQ,IAAI,eAAe,CAAC,CAAC,CAAE,CAAC;IAC/D,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,eAAe,KAAK,KAAK,IAAI,QAAQ;QAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC/E,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,IAAI,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1C,IAAI,QAAQ;QAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtC,IAAI,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACpC,IAAI,OAAO;QAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;IACvC,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;AAAA,CAC9C;AAED,yFAAyF;AACzF,MAAM,UAAU,UAAU,CAAC,MAAsB,EAAE,SAAS,GAAyB,EAAE,EAAe;IACpG,MAAM,QAAQ,GAAyB;QACrC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACtC,YAAY,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;KAC1C,CAAC;IACF,OAAO,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;AAAA,CAC9D;AAED,qFAAqF;AACrF,MAAM,UAAU,SAAS,CAAC,MAAsB,EAAE,SAAS,GAAyB,EAAE,EAAe;IACnG,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,MAAM,sBAAsB,GAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3I,MAAM,GAAG,GACP,sBAAsB,KAAK,SAAS,IAAI,sBAAsB,IAAI,CAAC;QACjE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,sBAAsB,GAAG,EAAE,CAAC,EAAE;QACxE,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,QAAQ,GAAyB;QACrC,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3D,mDAAmD;QACnD,KAAK,EAAE,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC;QAC/E,MAAM,EAAE,gBAAgB,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,gBAAgB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACrF,YAAY,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxB,CAAC;IACF,uHAAuH;IACvH,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,SAAS,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;AAAA,CACzF;AAED,kHAAkH;AAClH,MAAM,UAAU,SAAS,CAAC,MAAsB,EAAE,SAAS,GAAyB,EAAE,EAAe;IACnG,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAyB;QACrC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAClE,aAAa,EAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS;QACnG,aAAa,EAAE,OAAO,MAAM,CAAC,uBAAuB,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,SAAS;QACjH,YAAY,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,GAAG,CAAC,UAAU,EAAE,MAAM;YACpB,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,IAAI,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE;YAC3G,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;AAAA,CAC7D;AAED,uGAAuG;AACvG,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,MAAsB,EAAE,SAAS,GAAyB,EAAE,EAAe;IACpH,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IACrH,OAAO,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAAA,CAC1C"}