@pisti-paypiller/backend 0.0.0-stage → 0.7.1

package/dist/types.d.ts

@@ -0,0 +1,170 @@
+/** The verified claims of a Pisti session token. */
+export interface SessionClaims {
+    /** The user's ID. */
+    sub: string;
+    /** The session's ID. */
+    sid: string;
+    iss: string;
+    aud: string | string[];
+    exp: number;
+    iat: number;
+    nbf?: number;
+    /** The origin the token was issued to. */
+    azp?: string;
+    instance_id: string;
+    /** The environment's Frontend API id. */
+    fid: string;
+    email?: string;
+    name?: string;
+    auth_time?: number;
+    mfa_authenticated_at?: number;
+    org_id?: string;
+    org_slug?: string;
+    org_role?: string;
+    org_permissions?: string[];
+    [claim: string]: unknown;
+}
+export type ReverificationLevel = "first_factor" | "second_factor" | "multi_factor";
+export interface CheckAuthorizationParams {
+    permission?: string | undefined;
+    role?: string | undefined;
+    /**
+     * Require a recent verification, like Clerk: "strict_mfa" (both factors within 10 minutes),
+     * "strict" (second factor, or the first for users without one, within 10 minutes), "moderate"
+     * (60 minutes), "lax" (a day), or `{ level, afterMinutes }`.
+     */
+    reverification?: "strict_mfa" | "strict" | "moderate" | "lax" | {
+        level: ReverificationLevel;
+        afterMinutes: number;
+    } | undefined;
+}
+interface AuthObjectBase {
+    tokenType: "session_token";
+    /** True when the active organization grants this permission or role, or the sign-in is recent enough. */
+    has(params: CheckAuthorizationParams): boolean;
+    /** The raw session token, for forwarding to another service. */
+    getToken(): Promise<string | null>;
+}
+export interface SignedInAuthObject extends AuthObjectBase {
+    isAuthenticated: true;
+    userId: string;
+    sessionId: string;
+    sessionStatus: "active";
+    sessionClaims: SessionClaims;
+    /** The active organization, or null for the user's personal account. */
+    orgId: string | null;
+    orgSlug: string | null;
+    orgRole: string | null;
+    orgPermissions: string[] | null;
+    /** Minutes since the first and second factor were verified; -1 when never in this session. */
+    factorVerificationAge: [number, number];
+}
+export interface SignedOutAuthObject extends AuthObjectBase {
+    isAuthenticated: false;
+    userId: null;
+    sessionId: null;
+    sessionStatus: null;
+    sessionClaims: null;
+    orgId: null;
+    orgSlug: null;
+    orgRole: null;
+    orgPermissions: null;
+    factorVerificationAge: null;
+}
+/** Who is making a request. Narrow it with `isAuthenticated`. */
+export type AuthObject = SignedInAuthObject | SignedOutAuthObject;
+/** The kinds of token a request can carry, like Clerk's `acceptsToken`. */
+export type TokenType = "session_token" | "api_key" | "m2m_token" | "oauth_token";
+export type AcceptsToken = TokenType | readonly TokenType[] | "any";
+/** An end user's API key, verified with the backend API (needs the secret key). */
+export interface AuthenticatedApiKey {
+    isAuthenticated: true;
+    tokenType: "api_key";
+    id: string;
+    name: string;
+    /** The user who owns the key. */
+    subject: string;
+    userId: string;
+    scopes: string[];
+    claims: Record<string, unknown> | null;
+    getToken(): Promise<string>;
+}
+/** A machine-to-machine token from a confidential OAuth application's client credentials. */
+export interface AuthenticatedM2MToken {
+    isAuthenticated: true;
+    tokenType: "m2m_token";
+    id: string | null;
+    /** The OAuth application's client ID. */
+    subject: string;
+    machineId: string;
+    scopes: string[];
+    claims: Record<string, unknown>;
+    getToken(): Promise<string>;
+}
+/** An OAuth access token Pisti issued to an OAuth application on a user's behalf. */
+export interface AuthenticatedOAuthToken {
+    isAuthenticated: true;
+    tokenType: "oauth_token";
+    id: string | null;
+    subject: string;
+    userId: string;
+    clientId: string | null;
+    scopes: string[];
+    claims: Record<string, unknown>;
+    getToken(): Promise<string>;
+}
+export interface UnauthenticatedMachineObject<T extends Exclude<TokenType, "session_token">> {
+    isAuthenticated: false;
+    tokenType: T;
+    id: null;
+    subject: null;
+    userId: null;
+    scopes: null;
+    claims: null;
+    getToken(): Promise<null>;
+}
+export type ApiKeyAuthObject = AuthenticatedApiKey | UnauthenticatedMachineObject<"api_key">;
+export type M2MAuthObject = AuthenticatedM2MToken | UnauthenticatedMachineObject<"m2m_token">;
+export type OAuthAuthObject = AuthenticatedOAuthToken | UnauthenticatedMachineObject<"oauth_token">;
+/** Any auth object; narrow it with `tokenType` and `isAuthenticated`. */
+export type AnyAuthObject = AuthObject | ApiKeyAuthObject | M2MAuthObject | OAuthAuthObject;
+type AuthObjectOf<T extends TokenType> = T extends "session_token" ? AuthObject : T extends "api_key" ? ApiKeyAuthObject : T extends "m2m_token" ? M2MAuthObject : OAuthAuthObject;
+/** The auth object a given `acceptsToken` can produce. */
+export type AuthObjectFor<T extends AcceptsToken> = T extends "any" ? AnyAuthObject : T extends readonly TokenType[] ? AuthObjectOf<T[number]> : T extends TokenType ? AuthObjectOf<T> : never;
+export interface RequestState<T extends AnyAuthObject = AnyAuthObject> {
+    isAuthenticated: boolean;
+    /**
+     * "handshake" means the session cookie expired on a page request: send the response described by
+     * `headers` (a redirect through Pisti that refreshes the cookie) instead of rendering.
+     */
+    status: "signed-in" | "signed-out" | "handshake";
+    /** Why the request is signed out or needs a handshake, for logging; null when signed in. */
+    reason: string | null;
+    message: string | null;
+    token: string | null;
+    tokenType: TokenType | null;
+    /** Headers to send: `Location` and `Set-Cookie` during a handshake. */
+    headers: Headers;
+    toAuth(): T;
+}
+export interface VerifyTokenOptions {
+    /** Defaults to `PISTI_PUBLISHABLE_KEY`. */
+    publishableKey?: string | undefined;
+    /** Origins allowed to have requested the token (`azp`). Defaults to `PISTI_AUTHORIZED_PARTIES` (comma-separated). */
+    authorizedParties?: string[] | undefined;
+    /**
+     * The PEM public key from the console (API keys → JWT public key) or `client.getInstance()`.
+     * Verifies tokens without fetching signing keys. Defaults to `PISTI_JWT_KEY`.
+     */
+    jwtKey?: string | undefined;
+}
+export interface AuthenticateRequestOptions extends VerifyTokenOptions {
+    /** Which tokens to accept. Defaults to "session_token". */
+    acceptsToken?: AcceptsToken | undefined;
+    /** Verifies API keys. Defaults to `PISTI_SECRET_KEY`. */
+    secretKey?: string | undefined;
+    /** Cookie the React SDK writes. Defaults to `__session`. */
+    cookieName?: string | undefined;
+}
+export {};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,MAAM,WAAW,aAAa;IAC1B,qBAAqB;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,wBAAwB;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC5B;AAED,MAAM,MAAM,mBAAmB,GAAG,cAAc,GAAG,eAAe,GAAG,cAAc,CAAC;AAEpF,MAAM,WAAW,wBAAwB;IACrC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B;;;;OAIG;IACH,cAAc,CAAC,EACT,YAAY,GACZ,QAAQ,GACR,UAAU,GACV,KAAK,GACL;QAAE,KAAK,EAAE,mBAAmB,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GACpD,SAAS,CAAC;CACnB;AAED,UAAU,cAAc;IACpB,SAAS,EAAE,eAAe,CAAC;IAC3B,yGAAyG;IACzG,GAAG,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC;IAC/C,gEAAgE;IAChE,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACtD,eAAe,EAAE,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,QAAQ,CAAC;IACxB,aAAa,EAAE,aAAa,CAAC;IAC7B,wEAAwE;IACxE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAChC,8FAA8F;IAC9F,qBAAqB,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,mBAAoB,SAAQ,cAAc;IACvD,eAAe,EAAE,KAAK,CAAC;IACvB,MAAM,EAAE,IAAI,CAAC;IACb,SAAS,EAAE,IAAI,CAAC;IAChB,aAAa,EAAE,IAAI,CAAC;IACpB,aAAa,EAAE,IAAI,CAAC;IACpB,KAAK,EAAE,IAAI,CAAC;IACZ,OAAO,EAAE,IAAI,CAAC;IACd,OAAO,EAAE,IAAI,CAAC;IACd,cAAc,EAAE,IAAI,CAAC;IACrB,qBAAqB,EAAE,IAAI,CAAC;CAC/B;AAED,iEAAiE;AACjE,MAAM,MAAM,UAAU,GAAG,kBAAkB,GAAG,mBAAmB,CAAC;AAElE,2EAA2E;AAC3E,MAAM,MAAM,SAAS,GAAG,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,aAAa,CAAC;AAClF,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,SAAS,SAAS,EAAE,GAAG,KAAK,CAAC;AAEpE,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAChC,eAAe,EAAE,IAAI,CAAC;IACtB,SAAS,EAAE,SAAS,CAAC;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACvC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED,6FAA6F;AAC7F,MAAM,WAAW,qBAAqB;IAClC,eAAe,EAAE,IAAI,CAAC;IACtB,SAAS,EAAE,WAAW,CAAC;IACvB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED,qFAAqF;AACrF,MAAM,WAAW,uBAAuB;IACpC,eAAe,EAAE,IAAI,CAAC;IACtB,SAAS,EAAE,aAAa,CAAC;IACzB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,4BAA4B,CAAC,CAAC,SAAS,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC;IACvF,eAAe,EAAE,KAAK,CAAC;IACvB,SAAS,EAAE,CAAC,CAAC;IACb,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,IAAI,CAAC;IACb,MAAM,EAAE,IAAI,CAAC;IACb,MAAM,EAAE,IAAI,CAAC;IACb,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAC;AAC7F,MAAM,MAAM,aAAa,GAAG,qBAAqB,GAAG,4BAA4B,CAAC,WAAW,CAAC,CAAC;AAC9F,MAAM,MAAM,eAAe,GAAG,uBAAuB,GAAG,4BAA4B,CAAC,aAAa,CAAC,CAAC;AACpG,yEAAyE;AACzE,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,gBAAgB,GAAG,aAAa,GAAG,eAAe,CAAC;AAE5F,KAAK,YAAY,CAAC,CAAC,SAAS,SAAS,IAAI,CAAC,SAAS,eAAe,GAC5D,UAAU,GACV,CAAC,SAAS,SAAS,GACjB,gBAAgB,GAChB,CAAC,SAAS,WAAW,GACnB,aAAa,GACb,eAAe,CAAC;AAE1B,0DAA0D;AAC1D,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,SAAS,KAAK,GAC7D,aAAa,GACb,CAAC,SAAS,SAAS,SAAS,EAAE,GAC5B,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GACvB,CAAC,SAAS,SAAS,GACjB,YAAY,CAAC,CAAC,CAAC,GACf,KAAK,CAAC;AAEhB,MAAM,WAAW,YAAY,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa;IACjE,eAAe,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,MAAM,EAAE,WAAW,GAAG,YAAY,GAAG,WAAW,CAAC;IACjD,4FAA4F;IAC5F,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;IAC5B,uEAAuE;IACvE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,IAAI,CAAC,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IAC/B,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,qHAAqH;IACrH,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACzC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,0BAA2B,SAAQ,kBAAkB;IAClE,2DAA2D;IAC3D,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACxC,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/webhooks.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Event data. Pisti sends thin events: the changed resource's id and how to find it. Read the
+ * current state with the backend API, for example `pistiClient.users.getUser(event.data.id)`.
+ */
+export interface UserEventData {
+    object: "user";
+    id: string;
+    deleted: boolean;
+}
+export interface SessionEventData {
+    object: "session";
+    id: string;
+    user_id: string;
+}
+export interface OrganizationEventData {
+    object: "organization";
+    id: string;
+    deleted: boolean;
+}
+export interface OrganizationMembershipEventData {
+    object: "organization_membership";
+    id: string;
+    organization_id: string;
+    user_id: string;
+}
+export interface OrganizationInvitationEventData {
+    object: "organization_invitation";
+    id: string;
+    organization_id: string;
+    status: string;
+}
+interface WebhookEventDataMap {
+    "user.created": UserEventData;
+    "user.updated": UserEventData;
+    "user.deleted": UserEventData;
+    "session.created": SessionEventData;
+    "session.ended": SessionEventData;
+    "organization.created": OrganizationEventData;
+    "organization.updated": OrganizationEventData;
+    "organization.deleted": OrganizationEventData;
+    "organizationMembership.created": OrganizationMembershipEventData;
+    "organizationMembership.updated": OrganizationMembershipEventData;
+    "organizationMembership.deleted": OrganizationMembershipEventData;
+    "organizationInvitation.created": OrganizationInvitationEventData;
+    "organizationInvitation.updated": OrganizationInvitationEventData;
+    "organizationInvitation.accepted": OrganizationInvitationEventData;
+    "organizationInvitation.revoked": OrganizationInvitationEventData;
+    "organizationInvitation.expired": OrganizationInvitationEventData;
+}
+/**
+ * A verified webhook event, like Clerk's `WebhookEvent`. Checking `event.type` narrows `event.data`:
+ *
+ * ```ts
+ * if (event.type === "organizationMembership.created") console.log(event.data.organization_id);
+ * ```
+ */
+export type PistiWebhookEvent = {
+    [K in keyof WebhookEventDataMap]: {
+        id: string;
+        object: "event";
+        type: K;
+        timestamp: number;
+        instance_id: string;
+        data: WebhookEventDataMap[K];
+    };
+}[keyof WebhookEventDataMap];
+export interface VerifyWebhookOptions {
+    /** Defaults to the `PISTI_WEBHOOK_SIGNING_SECRET` environment variable. Pass several while rotating. */
+    signingSecret?: string | readonly string[] | undefined;
+    /** Optionally require events from this environment (see `client.getInstance()`). */
+    expectedInstanceId?: string | undefined;
+    /** Clock tolerance for the signed delivery timestamp. Defaults to five minutes. */
+    toleranceSeconds?: number;
+}
+type WebhookHeaders = Headers | Readonly<Record<string, string | readonly string[] | undefined>>;
+export declare class PistiWebhookError extends Error {
+    readonly code: "invalid_headers" | "invalid_timestamp" | "invalid_signature" | "invalid_payload";
+    constructor(code: "invalid_headers" | "invalid_timestamp" | "invalid_signature" | "invalid_payload");
+}
+/** Verify the exact raw body before parsing JSON. Store event IDs to prevent duplicate processing. */
+interface NodeWebhookRequest {
+    body: unknown;
+    headers: WebhookHeaders;
+}
+/**
+ * Verifies a webhook delivery and returns the event, like Clerk's `verifyWebhook`. Pass a Fetch API
+ * `Request` (Next.js, Hono, Bun, Workers) or a Node request whose body is the raw bytes. The
+ * signing secret defaults to `PISTI_WEBHOOK_SIGNING_SECRET`.
+ */
+export declare function verifyWebhook(request: Request | NodeWebhookRequest, options?: VerifyWebhookOptions): Promise<PistiWebhookEvent>;
+/** Verifies a raw payload and its headers, for frameworks without a Fetch `Request`. */
+export declare function verifyWebhookPayload(payload: string | Uint8Array, headers: WebhookHeaders, options?: VerifyWebhookOptions): PistiWebhookEvent;
+export {};
+//# sourceMappingURL=webhooks.d.ts.map

package/dist/webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;CACpB;AACD,MAAM,WAAW,gBAAgB;IAC7B,MAAM,EAAE,SAAS,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;CACnB;AACD,MAAM,WAAW,qBAAqB;IAClC,MAAM,EAAE,cAAc,CAAC;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;CACpB;AACD,MAAM,WAAW,+BAA+B;IAC5C,MAAM,EAAE,yBAAyB,CAAC;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACnB;AACD,MAAM,WAAW,+BAA+B;IAC5C,MAAM,EAAE,yBAAyB,CAAC;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,mBAAmB;IACzB,cAAc,EAAE,aAAa,CAAC;IAC9B,cAAc,EAAE,aAAa,CAAC;IAC9B,cAAc,EAAE,aAAa,CAAC;IAC9B,iBAAiB,EAAE,gBAAgB,CAAC;IACpC,eAAe,EAAE,gBAAgB,CAAC;IAClC,sBAAsB,EAAE,qBAAqB,CAAC;IAC9C,sBAAsB,EAAE,qBAAqB,CAAC;IAC9C,sBAAsB,EAAE,qBAAqB,CAAC;IAC9C,gCAAgC,EAAE,+BAA+B,CAAC;IAClE,gCAAgC,EAAE,+BAA+B,CAAC;IAClE,gCAAgC,EAAE,+BAA+B,CAAC;IAClE,gCAAgC,EAAE,+BAA+B,CAAC;IAClE,gCAAgC,EAAE,+BAA+B,CAAC;IAClE,iCAAiC,EAAE,+BAA+B,CAAC;IACnE,gCAAgC,EAAE,+BAA+B,CAAC;IAClE,gCAAgC,EAAE,+BAA+B,CAAC;CACrE;AAED;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG;KAC3B,CAAC,IAAI,MAAM,mBAAmB,GAAG;QAC9B,EAAE,EAAE,MAAM,CAAC;QACX,MAAM,EAAE,OAAO,CAAC;QAChB,IAAI,EAAE,CAAC,CAAC;QACR,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC;KAChC;CACJ,CAAC,MAAM,mBAAmB,CAAC,CAAC;AAE7B,MAAM,WAAW,oBAAoB;IACjC,wGAAwG;IACxG,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACvD,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,mFAAmF;IACnF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,KAAK,cAAc,GACf,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;AAE/E,qBAAa,iBAAkB,SAAQ,KAAK;IAEpC,QAAQ,CAAC,IAAI,EACP,iBAAiB,GACjB,mBAAmB,GACnB,mBAAmB,GACnB,iBAAiB;IAL3B,YACa,IAAI,EACP,iBAAiB,GACjB,mBAAmB,GACnB,mBAAmB,GACnB,iBAAiB,EAI1B;CACJ;AAwBD,sGAAsG;AACtG,UAAU,kBAAkB;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,cAAc,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAC/B,OAAO,EAAE,OAAO,GAAG,kBAAkB,EACrC,OAAO,GAAE,oBAAyB,GACnC,OAAO,CAAC,iBAAiB,CAAC,CAS5B;AAED,wFAAwF;AACxF,wBAAgB,oBAAoB,CAChC,OAAO,EAAE,MAAM,GAAG,UAAU,EAC5B,OAAO,EAAE,cAAc,EACvB,OAAO,GAAE,oBAAyB,GACnC,iBAAiB,CAEnB"}

package/dist/webhooks.js

@@ -0,0 +1,117 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+export class PistiWebhookError extends Error {
+    code;
+    constructor(code) {
+        super("The webhook could not be verified.");
+        this.code = code;
+        this.name = "PistiWebhookError";
+    }
+}
+function header(headers, name, multiple = false) {
+    const input = typeof headers.get === "function"
+        ? headers.get(name)
+        : Object.entries(headers).find(([key]) => key.toLowerCase() === name)?.[1];
+    if (typeof input === "string" && input.length <= 4096)
+        return input;
+    if (multiple &&
+        Array.isArray(input) &&
+        input.length <= 16 &&
+        input.every((value) => typeof value === "string" && value.length <= 256))
+        return input.join(" ");
+    throw new PistiWebhookError("invalid_headers");
+}
+/**
+ * Verifies a webhook delivery and returns the event, like Clerk's `verifyWebhook`. Pass a Fetch API
+ * `Request` (Next.js, Hono, Bun, Workers) or a Node request whose body is the raw bytes. The
+ * signing secret defaults to `PISTI_WEBHOOK_SIGNING_SECRET`.
+ */
+export async function verifyWebhook(request, options = {}) {
+    if (typeof Request !== "undefined" && request instanceof Request)
+        return verifyWebhookPayload(new Uint8Array(await request.arrayBuffer()), request.headers, options);
+    const { body, headers } = request;
+    if (typeof body !== "string" && !(body instanceof Uint8Array))
+        throw new Error("The webhook body was already parsed. Read the raw body on this route, for example express.raw({ type: \"application/json\" }) before express.json().");
+    return verifyWebhookPayload(body, headers, options);
+}
+/** Verifies a raw payload and its headers, for frameworks without a Fetch `Request`. */
+export function verifyWebhookPayload(payload, headers, options = {}) {
+    return verifyPayload(payload, headers, options);
+}
+function verifyPayload(payload, headers, options) {
+    const length = typeof payload === "string"
+        ? Buffer.byteLength(payload, "utf8")
+        : payload.byteLength;
+    if (length === 0 || length > 262144)
+        throw new PistiWebhookError("invalid_payload");
+    const body = typeof payload === "string"
+        ? Buffer.from(payload, "utf8")
+        : Buffer.from(payload);
+    if (options.expectedInstanceId !== undefined && !/^[1-9]\d{0,9}$/.test(options.expectedInstanceId))
+        throw new Error("expectedInstanceId must be the environment's numeric ID.");
+    const tolerance = options.toleranceSeconds ?? 300;
+    if (!Number.isInteger(tolerance) || tolerance < 1 || tolerance > 600)
+        throw new Error("Use a webhook clock tolerance between 1 and 600 seconds.");
+    const configured = options.signingSecret ?? process.env.PISTI_WEBHOOK_SIGNING_SECRET;
+    if (!configured)
+        throw new Error("Missing webhook signing secret. Copy it from the endpoint under Webhooks in the Pisti console into PISTI_WEBHOOK_SIGNING_SECRET.");
+    const secrets = typeof configured === "string" ? [configured] : configured;
+    if (secrets.length === 0 || secrets.length > 5)
+        throw new Error("Provide between one and five webhook signing secrets.");
+    const keys = secrets.map((secret) => {
+        if (!/^whsec_[A-Za-z0-9+/]{43}=$/.test(secret))
+            throw new Error("Provide a Pisti webhook signing secret.");
+        return Buffer.from(secret.slice(6), "base64");
+    });
+    const id = header(headers, "webhook-id"), timestamp = header(headers, "webhook-timestamp");
+    if (!/^evt_[a-f0-9]{32}$/.test(id) || !/^\d{1,12}$/.test(timestamp))
+        throw new PistiWebhookError("invalid_headers");
+    const seconds = Number(timestamp);
+    if (Math.abs(Math.floor(Date.now() / 1000) - seconds) > tolerance)
+        throw new PistiWebhookError("invalid_timestamp");
+    const supplied = header(headers, "webhook-signature", true)
+        .split(/\s+/)
+        .filter(Boolean);
+    if (supplied.length === 0 || supplied.length > 16)
+        throw new PistiWebhookError("invalid_signature");
+    let verified = false;
+    for (const key of keys) {
+        const expected = createHmac("sha256", key)
+            .update(id + "." + timestamp + ".")
+            .update(body)
+            .digest();
+        for (const signature of supplied) {
+            if (!/^v1,[A-Za-z0-9+/]{43}=$/.test(signature))
+                continue;
+            const value = Buffer.from(signature.slice(3), "base64");
+            if (value.length === expected.length &&
+                timingSafeEqual(value, expected))
+                verified = true;
+        }
+    }
+    if (!verified)
+        throw new PistiWebhookError("invalid_signature");
+    let data;
+    try {
+        data = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(body));
+    }
+    catch {
+        throw new PistiWebhookError("invalid_payload");
+    }
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        throw new PistiWebhookError("invalid_payload");
+    const event = data;
+    if (event.id !== id ||
+        event.object !== "event" ||
+        (options.expectedInstanceId !== undefined && event.instance_id !== options.expectedInstanceId) ||
+        typeof event.type !== "string" ||
+        event.type.length === 0 ||
+        event.type.length > 100 ||
+        !Number.isSafeInteger(event.timestamp) ||
+        event.timestamp < 0 ||
+        !event.data ||
+        typeof event.data !== "object" ||
+        Array.isArray(event.data))
+        throw new PistiWebhookError("invalid_payload");
+    return event;
+}
+//# sourceMappingURL=webhooks.js.map

package/dist/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAmF1D,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAE3B,IAAI;IADjB,YACa,IAIc;QAEvB,KAAK,CAAC,oCAAoC,CAAC,CAAC;oBANnC,IAAI;QAOb,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IACpC,CAAC;CACJ;AAED,SAAS,MAAM,CACX,OAAuB,EACvB,IAAY,EACZ,QAAQ,GAAG,KAAK;IAEhB,MAAM,KAAK,GACP,OAAQ,OAAmB,CAAC,GAAG,KAAK,UAAU;QAC1C,CAAC,CAAE,OAAmB,CAAC,GAAG,CAAC,IAAI,CAAC;QAChC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CACxB,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,CACxC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IACpE,IACI,QAAQ;QACR,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,MAAM,IAAI,EAAE;QAClB,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC;QAExE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;AACnD,CAAC;AAQD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAC/B,OAAqC,EACrC,OAAO,GAAyB,EAAE;IAElC,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,YAAY,OAAO;QAC5D,OAAO,oBAAoB,CAAC,IAAI,UAAU,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvG,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAA6B,CAAC;IACxD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC;QACzD,MAAM,IAAI,KAAK,CACX,sJAAsJ,CACzJ,CAAC;IACN,OAAO,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACxD,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,oBAAoB,CAChC,OAA4B,EAC5B,OAAuB,EACvB,OAAO,GAAyB,EAAE;IAElC,OAAO,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,aAAa,CAClB,OAA4B,EAC5B,OAAuB,EACvB,OAA6B;IAE7B,MAAM,MAAM,GACR,OAAO,OAAO,KAAK,QAAQ;QACvB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC;QACpC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC7B,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,GAAG,MAAM;QAC/B,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACnD,MAAM,IAAI,GACN,OAAO,OAAO,KAAK,QAAQ;QACvB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;QAC9B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,IAAI,GAAG,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,GAAG;QAChE,MAAM,IAAI,KAAK,CACX,0DAA0D,CAC7D,CAAC;IACN,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IACrF,IAAI,CAAC,UAAU;QACX,MAAM,IAAI,KAAK,CACX,kIAAkI,CACrI,CAAC;IACN,MAAM,OAAO,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAC1C,MAAM,IAAI,KAAK,CACX,uDAAuD,CAC1D,CAAC;IACN,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAChC,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC/D,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,EACpC,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACrD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC;QAC/D,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,SAAS;QAC7D,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,EAAE,mBAAmB,EAAE,IAAI,CAAC;SACtD,KAAK,CAAC,KAAK,CAAC;SACZ,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE;QAC7C,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;IACrD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC;aACrC,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,SAAS,GAAG,GAAG,CAAC;aAClC,MAAM,CAAC,IAAI,CAAC;aACZ,MAAM,EAAE,CAAC;QACd,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,SAAS;YACzD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YACxD,IACI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;gBAChC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAEhC,QAAQ,GAAG,IAAI,CAAC;QACxB,CAAC;IACL,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;IAChE,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,KAAK,CACb,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CACzD,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QACxD,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,IAAyB,CAAC;IACxC,IACI,KAAK,CAAC,EAAE,KAAK,EAAE;QACf,KAAK,CAAC,MAAM,KAAK,OAAO;QACxB,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,kBAAkB,CAAC;QAC9F,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG;QACvB,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC;QACtC,KAAK,CAAC,SAAS,GAAG,CAAC;QACnB,CAAC,KAAK,CAAC,IAAI;QACX,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;QAEzB,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC;AACjB,CAAC"}

package/package.json

@@ -1,6 +1,45 @@
 {
   "name": "@pisti-paypiller/backend",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.7.1",
+  "description": "Pisti backend SDK: verify session tokens, authenticate Fetch API requests, the management API and webhooks. Framework-agnostic.",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pisti-paypiller/pisti-sdks.git",
+    "directory": "backend"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=22.12.0"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./webhooks": {
+      "types": "./dist/webhooks.d.ts",
+      "import": "./dist/webhooks.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "check": "tsc -p tsconfig.json --noEmit",
+    "prepack": "npm run build"
+  },
+  "dependencies": {
+    "jose": "6.2.13"
+  },
+  "devDependencies": {
+    "@types/node": "26.6.5",
+    "typescript": "7.0.2"
+  }
+}