@notionhq/client 5.26.0 → 5.27.0

package/build/src/webhooks.js

@@ -2,19 +2,13 @@
 /**
  * Helpers for receiving and verifying Notion webhook deliveries.
  *
- * Notion signs each webhook request with HMAC-SHA256 over the raw HTTP
- * body using the subscription's verification token as the key, and sends
- * the resulting hex digest in the `X-Notion-Signature` header as
- * `sha256=<hex>`. To verify a delivery, callers must pass the body
- * **exactly as it arrived over the wire** — any JSON re-serialization
- * will change the bytes and invalidate the signature.
+ * Event signatures use HMAC-SHA256 with the subscription's verification
+ * token. The `X-Notion-Signature` header contains `sha256=<hex>`.
+ * Pass the raw body as received. Parsing and re-serializing JSON can change
+ * its bytes and invalidate the signature.
  *
- * The helpers prefer the Web Crypto API (`globalThis.crypto.subtle`)
- * when present (browsers, edge runtimes, Node.js >= 18.19) and
- * transparently fall back to `node:crypto`'s `webcrypto.subtle` on older
- * Node.js 18 builds where `globalThis.crypto` is not yet enabled by
- * default. They work without configuration in Node.js, Bun, Deno,
- * Vercel Edge Functions, Cloudflare Workers, and modern browsers.
+ * The helpers use `globalThis.crypto.subtle` when available, then fall
+ * back to the Web Crypto API in Node's crypto module.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.verifyWebhookSignature = verifyWebhookSignature;
@@ -25,29 +19,32 @@ const SHA256_HEX_LENGTH = 64;
  * Verify that a webhook delivery came from Notion and has not been
  * tampered with.
  *
- * Performs a constant-time comparison; returns `true` only if the
- * supplied `signature` matches HMAC-SHA256 of `body` keyed by
- * `verificationToken`. Returns `false` (rather than throwing) for any
- * malformed input so the caller can respond with a single 401/403 path.
+ * Returns `true` if the signature matches HMAC-SHA256 of the body using
+ * the verification token. Returns `false` for a missing or malformed
+ * signature. Crypto errors may throw.
  */
 async function verifyWebhookSignature(args) {
     const { body, signature, verificationToken } = args;
-    if (typeof signature !== "string")
+    if (typeof signature !== "string") {
         return false;
-    if (!signature.startsWith(SIGNATURE_PREFIX))
+    }
+    if (!signature.startsWith(SIGNATURE_PREFIX)) {
         return false;
+    }
     const providedHex = signature.slice(SIGNATURE_PREFIX.length).toLowerCase();
-    if (providedHex.length !== SHA256_HEX_LENGTH)
+    if (providedHex.length !== SHA256_HEX_LENGTH) {
         return false;
-    if (!/^[0-9a-f]+$/.test(providedHex))
+    }
+    if (!/^[0-9a-f]+$/.test(providedHex)) {
         return false;
+    }
     const computedHex = await computeHmacSha256Hex(verificationToken, body);
     return timingSafeEqualHex(providedHex, computedHex);
 }
 /**
  * Compute the value Notion would send in `X-Notion-Signature` for a
- * given body and verification token. Useful for unit-testing webhook
- * handlers without standing up a real subscription.
+ * given body and verification token. Use this to test webhook handlers
+ * without a live subscription.
  */
 async function signWebhookPayload(args) {
     const hex = await computeHmacSha256Hex(args.verificationToken, args.body);
@@ -68,23 +65,17 @@ async function computeHmacSha256Hex(key, body) {
 let cachedSubtle;
 async function getSubtle() {
     var _a, _b;
-    if (cachedSubtle)
+    if (cachedSubtle) {
         return cachedSubtle;
-    // Preferred path: every modern runtime exposes Web Crypto on the
-    // global object. This includes browsers, Vercel Edge, Cloudflare
-    // Workers, Deno, Bun, and Node.js >= 18.19 (which backported the
-    // change from Node.js 19).
+    }
     const fromGlobal = (_a = globalThis
         .crypto) === null || _a === void 0 ? void 0 : _a.subtle;
     if (fromGlobal) {
         cachedSubtle = fromGlobal;
         return cachedSubtle;
     }
-    // Fallback for Node.js 18.0–18.18, which ships Web Crypto via
-    // `node:crypto` but does not expose it on `globalThis` by default.
-    // Using `require` (rather than a static `import`) keeps the
-    // node:crypto reference off the dependency graph of browser bundlers
-    // that would otherwise fail to resolve it.
+    // Load Node's fallback only when needed so browser callers can use the
+    // global API without loading a Node module.
     try {
         /* eslint-disable @typescript-eslint/no-var-requires */
         const nodeCrypto = require("crypto");
@@ -104,8 +95,8 @@ async function getSubtle() {
 }
 function bytesToHex(bytes) {
     let hex = "";
-    for (let i = 0; i < bytes.length; i++) {
-        hex += bytes[i].toString(16).padStart(2, "0");
+    for (const byte of bytes) {
+        hex += byte.toString(16).padStart(2, "0");
     }
     return hex;
 }
@@ -113,8 +104,9 @@ function bytesToHex(bytes) {
 // the same length (callers enforce SHA256_HEX_LENGTH), so this purely
 // avoids early-exit on the first differing character.
 function timingSafeEqualHex(a, b) {
-    if (a.length !== b.length)
+    if (a.length !== b.length) {
         return false;
+    }
     let diff = 0;
     for (let i = 0; i < a.length; i++) {
         diff |= a.charCodeAt(i) ^ b.charCodeAt(i);

package/build/src/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/webhooks.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;AAkCH,wDAcC;AAOD,gDAMC;AA3DD,MAAM,gBAAgB,GAAG,SAAS,CAAA;AAClC,MAAM,iBAAiB,GAAG,EAAE,CAAA;AAsB5B;;;;;;;;GAQG;AACI,KAAK,UAAU,sBAAsB,CAC1C,IAAgC;IAEhC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAA;IAEnD,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC/C,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,KAAK,CAAA;IAEzD,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAA;IAC1E,IAAI,WAAW,CAAC,MAAM,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAA;IAC1D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAA;IAElD,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAA;IACvE,OAAO,kBAAkB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAA;AACrD,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,kBAAkB,CAAC,IAGxC;IACC,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IACzE,OAAO,GAAG,gBAAgB,GAAG,GAAG,EAAE,CAAA;AACpC,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,GAAW,EACX,IAAyB;IAEzB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAEhC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACpC,oEAAoE;IACpE,gEAAgE;IAChE,+DAA+D;IAC/D,MAAM,SAAS,GACb,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEzE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CACtC,KAAK,EACL,QAAQ,EACR,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;IACD,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;IACvE,OAAO,UAAU,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC,CAAA;AACpD,CAAC;AAED,IAAI,YAAsC,CAAA;AAE1C,KAAK,UAAU,SAAS;;IACtB,IAAI,YAAY;QAAE,OAAO,YAAY,CAAA;IAErC,iEAAiE;IACjE,iEAAiE;IACjE,iEAAiE;IACjE,2BAA2B;IAC3B,MAAM,UAAU,GAAG,MAAC,UAAqD;SACtE,MAAM,0CAAE,MAAM,CAAA;IACjB,IAAI,UAAU,EAAE,CAAC;QACf,YAAY,GAAG,UAAU,CAAA;QACzB,OAAO,YAAY,CAAA;IACrB,CAAC;IAED,8DAA8D;IAC9D,mEAAmE;IACnE,4DAA4D;IAC5D,qEAAqE;IACrE,2CAA2C;IAC3C,IAAI,CAAC;QACH,uDAAuD;QACvD,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAElC,CAAA;QACD,sDAAsD;QACtD,IAAI,MAAA,UAAU,CAAC,SAAS,0CAAE,MAAM,EAAE,CAAC;YACjC,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAA;YAC1C,OAAO,YAAY,CAAA;QACrB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,mCAAmC;IACrC,CAAC;IAED,MAAM,IAAI,KAAK,CACb,qDAAqD;QACnD,kEAAkE;QAClE,sCAAsC,CACzC,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,GAAG,IAAK,KAAK,CAAC,CAAC,CAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC3D,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,sEAAsE;AACtE,sEAAsE;AACtE,sDAAsD;AACtD,SAAS,kBAAkB,CAAC,CAAS,EAAE,CAAS;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACvC,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAC3C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAA;AACnB,CAAC","sourcesContent":["/**\n * Helpers for receiving and verifying Notion webhook deliveries.\n *\n * Notion signs each webhook request with HMAC-SHA256 over the raw HTTP\n * body using the subscription's verification token as the key, and sends\n * the resulting hex digest in the `X-Notion-Signature` header as\n * `sha256=<hex>`. To verify a delivery, callers must pass the body\n * **exactly as it arrived over the wire** — any JSON re-serialization\n * will change the bytes and invalidate the signature.\n *\n * The helpers prefer the Web Crypto API (`globalThis.crypto.subtle`)\n * when present (browsers, edge runtimes, Node.js >= 18.19) and\n * transparently fall back to `node:crypto`'s `webcrypto.subtle` on older\n * Node.js 18 builds where `globalThis.crypto` is not yet enabled by\n * default. They work without configuration in Node.js, Bun, Deno,\n * Vercel Edge Functions, Cloudflare Workers, and modern browsers.\n */\n\nconst SIGNATURE_PREFIX = \"sha256=\"\nconst SHA256_HEX_LENGTH = 64\n\nexport type VerifyWebhookSignatureArgs = {\n  /**\n   * The raw HTTP request body — exactly as received, before any parsing.\n   * Pass a string for text bodies or a Uint8Array/Buffer for binary-safe\n   * access. Re-serialized JSON will not verify.\n   */\n  body: string | Uint8Array\n  /**\n   * The value of the `X-Notion-Signature` request header. Verification\n   * fails (returns false) if this is missing or malformed.\n   */\n  signature: string | null | undefined\n  /**\n   * The verification token configured for this webhook subscription\n   * (returned by Notion when the subscription was created and surfaced\n   * during the initial handshake).\n   */\n  verificationToken: string\n}\n\n/**\n * Verify that a webhook delivery came from Notion and has not been\n * tampered with.\n *\n * Performs a constant-time comparison; returns `true` only if the\n * supplied `signature` matches HMAC-SHA256 of `body` keyed by\n * `verificationToken`. Returns `false` (rather than throwing) for any\n * malformed input so the caller can respond with a single 401/403 path.\n */\nexport async function verifyWebhookSignature(\n  args: VerifyWebhookSignatureArgs\n): Promise<boolean> {\n  const { body, signature, verificationToken } = args\n\n  if (typeof signature !== \"string\") return false\n  if (!signature.startsWith(SIGNATURE_PREFIX)) return false\n\n  const providedHex = signature.slice(SIGNATURE_PREFIX.length).toLowerCase()\n  if (providedHex.length !== SHA256_HEX_LENGTH) return false\n  if (!/^[0-9a-f]+$/.test(providedHex)) return false\n\n  const computedHex = await computeHmacSha256Hex(verificationToken, body)\n  return timingSafeEqualHex(providedHex, computedHex)\n}\n\n/**\n * Compute the value Notion would send in `X-Notion-Signature` for a\n * given body and verification token. Useful for unit-testing webhook\n * handlers without standing up a real subscription.\n */\nexport async function signWebhookPayload(args: {\n  body: string | Uint8Array\n  verificationToken: string\n}): Promise<string> {\n  const hex = await computeHmacSha256Hex(args.verificationToken, args.body)\n  return `${SIGNATURE_PREFIX}${hex}`\n}\n\nasync function computeHmacSha256Hex(\n  key: string,\n  body: string | Uint8Array\n): Promise<string> {\n  const subtle = await getSubtle()\n\n  const encoder = new TextEncoder()\n  const keyBytes = encoder.encode(key)\n  // Copy any Uint8Array input into a fresh ArrayBuffer-backed view so\n  // subtle.sign (which forbids SharedArrayBuffer-backed views) is\n  // satisfied regardless of where the caller's buffer came from.\n  const bodyBytes =\n    typeof body === \"string\" ? encoder.encode(body) : Uint8Array.from(body)\n\n  const cryptoKey = await subtle.importKey(\n    \"raw\",\n    keyBytes,\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"]\n  )\n  const signatureBuffer = await subtle.sign(\"HMAC\", cryptoKey, bodyBytes)\n  return bytesToHex(new Uint8Array(signatureBuffer))\n}\n\nlet cachedSubtle: SubtleCrypto | undefined\n\nasync function getSubtle(): Promise<SubtleCrypto> {\n  if (cachedSubtle) return cachedSubtle\n\n  // Preferred path: every modern runtime exposes Web Crypto on the\n  // global object. This includes browsers, Vercel Edge, Cloudflare\n  // Workers, Deno, Bun, and Node.js >= 18.19 (which backported the\n  // change from Node.js 19).\n  const fromGlobal = (globalThis as { crypto?: { subtle?: SubtleCrypto } })\n    .crypto?.subtle\n  if (fromGlobal) {\n    cachedSubtle = fromGlobal\n    return cachedSubtle\n  }\n\n  // Fallback for Node.js 18.0–18.18, which ships Web Crypto via\n  // `node:crypto` but does not expose it on `globalThis` by default.\n  // Using `require` (rather than a static `import`) keeps the\n  // node:crypto reference off the dependency graph of browser bundlers\n  // that would otherwise fail to resolve it.\n  try {\n    /* eslint-disable @typescript-eslint/no-var-requires */\n    const nodeCrypto = require(\"crypto\") as {\n      webcrypto?: { subtle?: SubtleCrypto }\n    }\n    /* eslint-enable @typescript-eslint/no-var-requires */\n    if (nodeCrypto.webcrypto?.subtle) {\n      cachedSubtle = nodeCrypto.webcrypto.subtle\n      return cachedSubtle\n    }\n  } catch {\n    // node:crypto unavailable (e.g. a browser bundle that stubbed it).\n    // Fall through to the error below.\n  }\n\n  throw new Error(\n    \"verifyWebhookSignature requires Web Crypto support \" +\n      \"(globalThis.crypto.subtle or node:crypto.webcrypto). Upgrade to \" +\n      \"a runtime that provides one of them.\"\n  )\n}\n\nfunction bytesToHex(bytes: Uint8Array): string {\n  let hex = \"\"\n  for (let i = 0; i < bytes.length; i++) {\n    hex += (bytes[i] as number).toString(16).padStart(2, \"0\")\n  }\n  return hex\n}\n\n// Constant-time string comparison. The inputs are already known to be\n// the same length (callers enforce SHA256_HEX_LENGTH), so this purely\n// avoids early-exit on the first differing character.\nfunction timingSafeEqualHex(a: string, b: string): boolean {\n  if (a.length !== b.length) return false\n  let diff = 0\n  for (let i = 0; i < a.length; i++) {\n    diff |= a.charCodeAt(i) ^ b.charCodeAt(i)\n  }\n  return diff === 0\n}\n"]}
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/webhooks.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AAiCH,wDAsBC;AAOD,gDAMC;AAlED,MAAM,gBAAgB,GAAG,SAAS,CAAA;AAClC,MAAM,iBAAiB,GAAG,EAAE,CAAA;AAsB5B;;;;;;;GAOG;AACI,KAAK,UAAU,sBAAsB,CAC1C,IAAgC;IAEhC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAA;IAEnD,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAA;IAC1E,IAAI,WAAW,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAA;IACvE,OAAO,kBAAkB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAA;AACrD,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,kBAAkB,CAAC,IAGxC;IACC,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IACzE,OAAO,GAAG,gBAAgB,GAAG,GAAG,EAAE,CAAA;AACpC,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,GAAW,EACX,IAAyB;IAEzB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAEhC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACpC,oEAAoE;IACpE,gEAAgE;IAChE,+DAA+D;IAC/D,MAAM,SAAS,GACb,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEzE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CACtC,KAAK,EACL,QAAQ,EACR,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;IACD,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;IACvE,OAAO,UAAU,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC,CAAA;AACpD,CAAC;AAED,IAAI,YAAsC,CAAA;AAE1C,KAAK,UAAU,SAAS;;IACtB,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,YAAY,CAAA;IACrB,CAAC;IAED,MAAM,UAAU,GAAG,MAAC,UAAqD;SACtE,MAAM,0CAAE,MAAM,CAAA;IACjB,IAAI,UAAU,EAAE,CAAC;QACf,YAAY,GAAG,UAAU,CAAA;QACzB,OAAO,YAAY,CAAA;IACrB,CAAC;IAED,uEAAuE;IACvE,4CAA4C;IAC5C,IAAI,CAAC;QACH,uDAAuD;QACvD,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAElC,CAAA;QACD,sDAAsD;QACtD,IAAI,MAAA,UAAU,CAAC,SAAS,0CAAE,MAAM,EAAE,CAAC;YACjC,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAA;YAC1C,OAAO,YAAY,CAAA;QACrB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,mCAAmC;IACrC,CAAC;IAED,MAAM,IAAI,KAAK,CACb,qDAAqD;QACnD,kEAAkE;QAClE,sCAAsC,CACzC,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC3C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,sEAAsE;AACtE,sEAAsE;AACtE,sDAAsD;AACtD,SAAS,kBAAkB,CAAC,CAAS,EAAE,CAAS;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAC3C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAA;AACnB,CAAC","sourcesContent":["/**\n * Helpers for receiving and verifying Notion webhook deliveries.\n *\n * Event signatures use HMAC-SHA256 with the subscription's verification\n * token. The `X-Notion-Signature` header contains `sha256=<hex>`.\n * Pass the raw body as received. Parsing and re-serializing JSON can change\n * its bytes and invalidate the signature.\n *\n * The helpers use `globalThis.crypto.subtle` when available, then fall\n * back to the Web Crypto API in Node's crypto module.\n */\n\nconst SIGNATURE_PREFIX = \"sha256=\"\nconst SHA256_HEX_LENGTH = 64\n\nexport type VerifyWebhookSignatureArgs = {\n  /**\n   * The raw HTTP request body, before any parsing.\n   * Pass a string for text bodies or a Uint8Array/Buffer for binary-safe\n   * access. Re-serialized JSON will not verify.\n   */\n  body: string | Uint8Array\n  /**\n   * The value of the `X-Notion-Signature` request header. Verification\n   * fails (returns false) if this is missing or malformed.\n   */\n  signature: string | null | undefined\n  /**\n   * The verification token configured for this webhook subscription\n   * (returned by Notion when the subscription was created and surfaced\n   * during the initial handshake).\n   */\n  verificationToken: string\n}\n\n/**\n * Verify that a webhook delivery came from Notion and has not been\n * tampered with.\n *\n * Returns `true` if the signature matches HMAC-SHA256 of the body using\n * the verification token. Returns `false` for a missing or malformed\n * signature. Crypto errors may throw.\n */\nexport async function verifyWebhookSignature(\n  args: VerifyWebhookSignatureArgs\n): Promise<boolean> {\n  const { body, signature, verificationToken } = args\n\n  if (typeof signature !== \"string\") {\n    return false\n  }\n  if (!signature.startsWith(SIGNATURE_PREFIX)) {\n    return false\n  }\n\n  const providedHex = signature.slice(SIGNATURE_PREFIX.length).toLowerCase()\n  if (providedHex.length !== SHA256_HEX_LENGTH) {\n    return false\n  }\n  if (!/^[0-9a-f]+$/.test(providedHex)) {\n    return false\n  }\n\n  const computedHex = await computeHmacSha256Hex(verificationToken, body)\n  return timingSafeEqualHex(providedHex, computedHex)\n}\n\n/**\n * Compute the value Notion would send in `X-Notion-Signature` for a\n * given body and verification token. Use this to test webhook handlers\n * without a live subscription.\n */\nexport async function signWebhookPayload(args: {\n  body: string | Uint8Array\n  verificationToken: string\n}): Promise<string> {\n  const hex = await computeHmacSha256Hex(args.verificationToken, args.body)\n  return `${SIGNATURE_PREFIX}${hex}`\n}\n\nasync function computeHmacSha256Hex(\n  key: string,\n  body: string | Uint8Array\n): Promise<string> {\n  const subtle = await getSubtle()\n\n  const encoder = new TextEncoder()\n  const keyBytes = encoder.encode(key)\n  // Copy any Uint8Array input into a fresh ArrayBuffer-backed view so\n  // subtle.sign (which forbids SharedArrayBuffer-backed views) is\n  // satisfied regardless of where the caller's buffer came from.\n  const bodyBytes =\n    typeof body === \"string\" ? encoder.encode(body) : Uint8Array.from(body)\n\n  const cryptoKey = await subtle.importKey(\n    \"raw\",\n    keyBytes,\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"]\n  )\n  const signatureBuffer = await subtle.sign(\"HMAC\", cryptoKey, bodyBytes)\n  return bytesToHex(new Uint8Array(signatureBuffer))\n}\n\nlet cachedSubtle: SubtleCrypto | undefined\n\nasync function getSubtle(): Promise<SubtleCrypto> {\n  if (cachedSubtle) {\n    return cachedSubtle\n  }\n\n  const fromGlobal = (globalThis as { crypto?: { subtle?: SubtleCrypto } })\n    .crypto?.subtle\n  if (fromGlobal) {\n    cachedSubtle = fromGlobal\n    return cachedSubtle\n  }\n\n  // Load Node's fallback only when needed so browser callers can use the\n  // global API without loading a Node module.\n  try {\n    /* eslint-disable @typescript-eslint/no-var-requires */\n    const nodeCrypto = require(\"crypto\") as {\n      webcrypto?: { subtle?: SubtleCrypto }\n    }\n    /* eslint-enable @typescript-eslint/no-var-requires */\n    if (nodeCrypto.webcrypto?.subtle) {\n      cachedSubtle = nodeCrypto.webcrypto.subtle\n      return cachedSubtle\n    }\n  } catch {\n    // node:crypto unavailable (e.g. a browser bundle that stubbed it).\n    // Fall through to the error below.\n  }\n\n  throw new Error(\n    \"verifyWebhookSignature requires Web Crypto support \" +\n      \"(globalThis.crypto.subtle or node:crypto.webcrypto). Upgrade to \" +\n      \"a runtime that provides one of them.\"\n  )\n}\n\nfunction bytesToHex(bytes: Uint8Array): string {\n  let hex = \"\"\n  for (const byte of bytes) {\n    hex += byte.toString(16).padStart(2, \"0\")\n  }\n  return hex\n}\n\n// Constant-time string comparison. The inputs are already known to be\n// the same length (callers enforce SHA256_HEX_LENGTH), so this purely\n// avoids early-exit on the first differing character.\nfunction timingSafeEqualHex(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false\n  }\n  let diff = 0\n  for (let i = 0; i < a.length; i++) {\n    diff |= a.charCodeAt(i) ^ b.charCodeAt(i)\n  }\n  return diff === 0\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@notionhq/client",
-  "version": "5.26.0",
+  "version": "5.27.0",
   "description": "A simple and easy to use client for the Notion API",
   "engines": {
     "node": ">=18"
@@ -26,8 +26,9 @@
     "prepublishOnly": "npm run checkLoggedIn && npm run lint && npm run test",
     "build": "tsc",
     "prettier": "prettier --write .",
-    "lint": "prettier --check . && eslint . --ext .ts && cspell '**/*' ",
+    "lint": "prettier --check . && eslint . --ext .ts,.js && cspell '**/*'",
     "test": "jest ./test",
+    "check:compatibility": "node build/test/checkCompatibility.js",
     "check-links": "git ls-files | grep md$ | xargs -n 1 markdown-link-check",
     "prebuild": "npm run clean",
     "clean": "rm -rf ./build",
@@ -35,7 +36,7 @@
   },
   "lint-staged": {
     "*.{ts,js,json,md}": "prettier --write",
-    "*.ts": "eslint --fix"
+    "*.{ts,js}": "eslint --fix"
   },
   "author": "",
   "license": "MIT",