@postman/sdk-config 0.4.0 → 0.5.0

package/dist/sdk-config-ir/v1/index.d.cts

@@ -353,6 +353,64 @@ declare const apiConfigSchema: z.ZodObject<{
      * remain included, while every audience-tagged node is excluded.
      */
     audiences: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    /**
+     * How the API signs the webhooks it sends, enabling a generated verification helper. API-wide, and
+     * independent of whether any webhook is modeled — see {@link webhookSignatureSchema}.
+     */
+    webhookSignature: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"hmac">;
+        header: z.ZodString;
+        algorithm: z.ZodOptional<z.ZodEnum<{
+            sha1: "sha1";
+            sha256: "sha256";
+            sha384: "sha384";
+            sha512: "sha512";
+        }>>;
+        encoding: z.ZodOptional<z.ZodEnum<{
+            base64: "base64";
+            hex: "hex";
+        }>>;
+        signaturePrefix: z.ZodOptional<z.ZodString>;
+        payloadFormat: z.ZodOptional<z.ZodObject<{
+            components: z.ZodArray<z.ZodEnum<{
+                body: "body";
+                timestamp: "timestamp";
+                "notification-url": "notification-url";
+                "message-id": "message-id";
+            }>>;
+            delimiter: z.ZodOptional<z.ZodString>;
+            bodySort: z.ZodOptional<z.ZodLiteral<"alphabetical">>;
+        }, z.core.$strict>>;
+        timestamp: z.ZodOptional<z.ZodObject<{
+            header: z.ZodString;
+            format: z.ZodOptional<z.ZodEnum<{
+                "unix-seconds": "unix-seconds";
+                "unix-millis": "unix-millis";
+                iso8601: "iso8601";
+            }>>;
+            tolerance: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>>;
+        bodyHashBinding: z.ZodOptional<z.ZodObject<{
+            algorithm: z.ZodEnum<{
+                sha1: "sha1";
+                sha256: "sha256";
+                sha384: "sha384";
+                sha512: "sha512";
+            }>;
+            encoding: z.ZodOptional<z.ZodEnum<{
+                base64: "base64";
+                hex: "hex";
+            }>>;
+            location: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                type: z.ZodLiteral<"query-parameter">;
+                name: z.ZodString;
+            }, z.core.$strict>], "type">;
+        }, z.core.$strict>>;
+        urlNormalization: z.ZodOptional<z.ZodObject<{
+            portVariants: z.ZodOptional<z.ZodBoolean>;
+            legacyQueryEncoding: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>], "type">>;
 }, z.core.$strict>;
 type AuthScheme = z.infer<typeof authSchemeSchema>;
 type AuthConfig = z.infer<typeof authConfigSchema>;
@@ -2413,6 +2471,60 @@ declare const sdkConfigIrV1Schema: z.ZodObject<{
             environmentVariable: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>>;
         audiences: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        webhookSignature: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"hmac">;
+            header: z.ZodString;
+            algorithm: z.ZodOptional<z.ZodEnum<{
+                sha1: "sha1";
+                sha256: "sha256";
+                sha384: "sha384";
+                sha512: "sha512";
+            }>>;
+            encoding: z.ZodOptional<z.ZodEnum<{
+                base64: "base64";
+                hex: "hex";
+            }>>;
+            signaturePrefix: z.ZodOptional<z.ZodString>;
+            payloadFormat: z.ZodOptional<z.ZodObject<{
+                components: z.ZodArray<z.ZodEnum<{
+                    body: "body";
+                    timestamp: "timestamp";
+                    "notification-url": "notification-url";
+                    "message-id": "message-id";
+                }>>;
+                delimiter: z.ZodOptional<z.ZodString>;
+                bodySort: z.ZodOptional<z.ZodLiteral<"alphabetical">>;
+            }, z.core.$strict>>;
+            timestamp: z.ZodOptional<z.ZodObject<{
+                header: z.ZodString;
+                format: z.ZodOptional<z.ZodEnum<{
+                    "unix-seconds": "unix-seconds";
+                    "unix-millis": "unix-millis";
+                    iso8601: "iso8601";
+                }>>;
+                tolerance: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>>;
+            bodyHashBinding: z.ZodOptional<z.ZodObject<{
+                algorithm: z.ZodEnum<{
+                    sha1: "sha1";
+                    sha256: "sha256";
+                    sha384: "sha384";
+                    sha512: "sha512";
+                }>;
+                encoding: z.ZodOptional<z.ZodEnum<{
+                    base64: "base64";
+                    hex: "hex";
+                }>>;
+                location: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    type: z.ZodLiteral<"query-parameter">;
+                    name: z.ZodString;
+                }, z.core.$strict>], "type">;
+            }, z.core.$strict>>;
+            urlNormalization: z.ZodOptional<z.ZodObject<{
+                portVariants: z.ZodOptional<z.ZodBoolean>;
+                legacyQueryEncoding: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>], "type">>;
     }, z.core.$strict>;
     client: z.ZodObject<{
         retry: z.ZodPrefault<z.ZodObject<{
@@ -3753,4 +3865,70 @@ declare const targetConfigSchema: z.ZodObject<{
 type TargetLanguage = z.infer<typeof targetLanguageSchema>;
 type TargetConfig = z.infer<typeof targetConfigSchema>;
 
-export { type ApiConfig, type ApiConfigInput, type ApiImportSettings, type AuthConfig, type AuthScheme, type ClientConfig, type ClientConfigInput, type ClientConfigOverride, type CompatibilityConfig, type CredentialResolution, type DocsConfig, type GenerationConfig, JsonObject, type LanguageGenerationConfig, type LegacyInput, type OutputConfig, type PublishConfig, type PublishRegistry, type ReadmeCustomSection, type ReadmeEndpoint, type ReplayConfig, SDK_CONFIG_IR_V1_SCHEMA_VERSION, type SdkConfigIrV1, type SdkConfigIrV1Input, type SourceConfig, type SourceSpecConfig, type SourceSpecType, type TargetConfig, type TargetLanguage, type UnsupportedField, apiConfigSchema, apiImportSettingsSchema, authConfigSchema, authSchemeSchema, clientConfigOverrideSchema, clientConfigSchema, clientRetryOverrideSchema, compatibilityConfigSchema, docsConfigSchema, generationConfigSchema, languageGenerationConfigSchema, legacyInputSchema, outputConfigSchema, parseSdkConfigIrV1, publishConfigSchema, publishRegistrySchema, readmeCustomSectionSchema, readmeEndpointSchema, replayConfigSchema, sdkConfigIrV1Schema, sourceConfigSchema, sourceSpecConfigSchema, sourceSpecTypeSchema, targetConfigSchema, targetLanguageSchema, unsupportedFieldSchema };
+declare const webhookSignatureSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"hmac">;
+    /** Request header carrying the signature. */
+    header: z.ZodString;
+    algorithm: z.ZodOptional<z.ZodEnum<{
+        sha1: "sha1";
+        sha256: "sha256";
+        sha384: "sha384";
+        sha512: "sha512";
+    }>>;
+    encoding: z.ZodOptional<z.ZodEnum<{
+        base64: "base64";
+        hex: "hex";
+    }>>;
+    /** Stripped from the header value before comparison, e.g. `sha256=`. */
+    signaturePrefix: z.ZodOptional<z.ZodString>;
+    payloadFormat: z.ZodOptional<z.ZodObject<{
+        components: z.ZodArray<z.ZodEnum<{
+            body: "body";
+            timestamp: "timestamp";
+            "notification-url": "notification-url";
+            "message-id": "message-id";
+        }>>;
+        delimiter: z.ZodOptional<z.ZodString>;
+        /**
+         * Set when the body is a form-encoded parameter map that must be canonicalized before signing:
+         * keys sorted, each key's values deduped and sorted, concatenated as key-value pairs.
+         */
+        bodySort: z.ZodOptional<z.ZodLiteral<"alphabetical">>;
+    }, z.core.$strict>>;
+    timestamp: z.ZodOptional<z.ZodObject<{
+        header: z.ZodString;
+        format: z.ZodOptional<z.ZodEnum<{
+            "unix-seconds": "unix-seconds";
+            "unix-millis": "unix-millis";
+            iso8601: "iso8601";
+        }>>;
+        /** Replay window in seconds. */
+        tolerance: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    bodyHashBinding: z.ZodOptional<z.ZodObject<{
+        algorithm: z.ZodEnum<{
+            sha1: "sha1";
+            sha256: "sha256";
+            sha384: "sha384";
+            sha512: "sha512";
+        }>;
+        encoding: z.ZodOptional<z.ZodEnum<{
+            base64: "base64";
+            hex: "hex";
+        }>>;
+        location: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"query-parameter">;
+            name: z.ZodString;
+        }, z.core.$strict>], "type">;
+    }, z.core.$strict>>;
+    urlNormalization: z.ZodOptional<z.ZodObject<{
+        /** Try the URL with and without an explicit default port. */
+        portVariants: z.ZodOptional<z.ZodBoolean>;
+        /** Try the URL with the pre-RFC3986 query encoding (`+` for space, unescaped `*`). */
+        legacyQueryEncoding: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+}, z.core.$strict>], "type">;
+type WebhookSignatureInput = z.input<typeof webhookSignatureSchema>;
+type WebhookSignature = z.output<typeof webhookSignatureSchema>;
+
+export { type ApiConfig, type ApiConfigInput, type ApiImportSettings, type AuthConfig, type AuthScheme, type ClientConfig, type ClientConfigInput, type ClientConfigOverride, type CompatibilityConfig, type CredentialResolution, type DocsConfig, type GenerationConfig, JsonObject, type LanguageGenerationConfig, type LegacyInput, type OutputConfig, type PublishConfig, type PublishRegistry, type ReadmeCustomSection, type ReadmeEndpoint, type ReplayConfig, SDK_CONFIG_IR_V1_SCHEMA_VERSION, type SdkConfigIrV1, type SdkConfigIrV1Input, type SourceConfig, type SourceSpecConfig, type SourceSpecType, type TargetConfig, type TargetLanguage, type UnsupportedField, type WebhookSignature, type WebhookSignatureInput, apiConfigSchema, apiImportSettingsSchema, authConfigSchema, authSchemeSchema, clientConfigOverrideSchema, clientConfigSchema, clientRetryOverrideSchema, compatibilityConfigSchema, docsConfigSchema, generationConfigSchema, languageGenerationConfigSchema, legacyInputSchema, outputConfigSchema, parseSdkConfigIrV1, publishConfigSchema, publishRegistrySchema, readmeCustomSectionSchema, readmeEndpointSchema, replayConfigSchema, sdkConfigIrV1Schema, sourceConfigSchema, sourceSpecConfigSchema, sourceSpecTypeSchema, targetConfigSchema, targetLanguageSchema, unsupportedFieldSchema, webhookSignatureSchema };

package/dist/sdk-config-ir/v1/index.d.ts

@@ -353,6 +353,64 @@ declare const apiConfigSchema: z.ZodObject<{
      * remain included, while every audience-tagged node is excluded.
      */
     audiences: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    /**
+     * How the API signs the webhooks it sends, enabling a generated verification helper. API-wide, and
+     * independent of whether any webhook is modeled — see {@link webhookSignatureSchema}.
+     */
+    webhookSignature: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"hmac">;
+        header: z.ZodString;
+        algorithm: z.ZodOptional<z.ZodEnum<{
+            sha1: "sha1";
+            sha256: "sha256";
+            sha384: "sha384";
+            sha512: "sha512";
+        }>>;
+        encoding: z.ZodOptional<z.ZodEnum<{
+            base64: "base64";
+            hex: "hex";
+        }>>;
+        signaturePrefix: z.ZodOptional<z.ZodString>;
+        payloadFormat: z.ZodOptional<z.ZodObject<{
+            components: z.ZodArray<z.ZodEnum<{
+                body: "body";
+                timestamp: "timestamp";
+                "notification-url": "notification-url";
+                "message-id": "message-id";
+            }>>;
+            delimiter: z.ZodOptional<z.ZodString>;
+            bodySort: z.ZodOptional<z.ZodLiteral<"alphabetical">>;
+        }, z.core.$strict>>;
+        timestamp: z.ZodOptional<z.ZodObject<{
+            header: z.ZodString;
+            format: z.ZodOptional<z.ZodEnum<{
+                "unix-seconds": "unix-seconds";
+                "unix-millis": "unix-millis";
+                iso8601: "iso8601";
+            }>>;
+            tolerance: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>>;
+        bodyHashBinding: z.ZodOptional<z.ZodObject<{
+            algorithm: z.ZodEnum<{
+                sha1: "sha1";
+                sha256: "sha256";
+                sha384: "sha384";
+                sha512: "sha512";
+            }>;
+            encoding: z.ZodOptional<z.ZodEnum<{
+                base64: "base64";
+                hex: "hex";
+            }>>;
+            location: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                type: z.ZodLiteral<"query-parameter">;
+                name: z.ZodString;
+            }, z.core.$strict>], "type">;
+        }, z.core.$strict>>;
+        urlNormalization: z.ZodOptional<z.ZodObject<{
+            portVariants: z.ZodOptional<z.ZodBoolean>;
+            legacyQueryEncoding: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>], "type">>;
 }, z.core.$strict>;
 type AuthScheme = z.infer<typeof authSchemeSchema>;
 type AuthConfig = z.infer<typeof authConfigSchema>;
@@ -2413,6 +2471,60 @@ declare const sdkConfigIrV1Schema: z.ZodObject<{
             environmentVariable: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>>;
         audiences: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        webhookSignature: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"hmac">;
+            header: z.ZodString;
+            algorithm: z.ZodOptional<z.ZodEnum<{
+                sha1: "sha1";
+                sha256: "sha256";
+                sha384: "sha384";
+                sha512: "sha512";
+            }>>;
+            encoding: z.ZodOptional<z.ZodEnum<{
+                base64: "base64";
+                hex: "hex";
+            }>>;
+            signaturePrefix: z.ZodOptional<z.ZodString>;
+            payloadFormat: z.ZodOptional<z.ZodObject<{
+                components: z.ZodArray<z.ZodEnum<{
+                    body: "body";
+                    timestamp: "timestamp";
+                    "notification-url": "notification-url";
+                    "message-id": "message-id";
+                }>>;
+                delimiter: z.ZodOptional<z.ZodString>;
+                bodySort: z.ZodOptional<z.ZodLiteral<"alphabetical">>;
+            }, z.core.$strict>>;
+            timestamp: z.ZodOptional<z.ZodObject<{
+                header: z.ZodString;
+                format: z.ZodOptional<z.ZodEnum<{
+                    "unix-seconds": "unix-seconds";
+                    "unix-millis": "unix-millis";
+                    iso8601: "iso8601";
+                }>>;
+                tolerance: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>>;
+            bodyHashBinding: z.ZodOptional<z.ZodObject<{
+                algorithm: z.ZodEnum<{
+                    sha1: "sha1";
+                    sha256: "sha256";
+                    sha384: "sha384";
+                    sha512: "sha512";
+                }>;
+                encoding: z.ZodOptional<z.ZodEnum<{
+                    base64: "base64";
+                    hex: "hex";
+                }>>;
+                location: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    type: z.ZodLiteral<"query-parameter">;
+                    name: z.ZodString;
+                }, z.core.$strict>], "type">;
+            }, z.core.$strict>>;
+            urlNormalization: z.ZodOptional<z.ZodObject<{
+                portVariants: z.ZodOptional<z.ZodBoolean>;
+                legacyQueryEncoding: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>], "type">>;
     }, z.core.$strict>;
     client: z.ZodObject<{
         retry: z.ZodPrefault<z.ZodObject<{
@@ -3753,4 +3865,70 @@ declare const targetConfigSchema: z.ZodObject<{
 type TargetLanguage = z.infer<typeof targetLanguageSchema>;
 type TargetConfig = z.infer<typeof targetConfigSchema>;
 
-export { type ApiConfig, type ApiConfigInput, type ApiImportSettings, type AuthConfig, type AuthScheme, type ClientConfig, type ClientConfigInput, type ClientConfigOverride, type CompatibilityConfig, type CredentialResolution, type DocsConfig, type GenerationConfig, JsonObject, type LanguageGenerationConfig, type LegacyInput, type OutputConfig, type PublishConfig, type PublishRegistry, type ReadmeCustomSection, type ReadmeEndpoint, type ReplayConfig, SDK_CONFIG_IR_V1_SCHEMA_VERSION, type SdkConfigIrV1, type SdkConfigIrV1Input, type SourceConfig, type SourceSpecConfig, type SourceSpecType, type TargetConfig, type TargetLanguage, type UnsupportedField, apiConfigSchema, apiImportSettingsSchema, authConfigSchema, authSchemeSchema, clientConfigOverrideSchema, clientConfigSchema, clientRetryOverrideSchema, compatibilityConfigSchema, docsConfigSchema, generationConfigSchema, languageGenerationConfigSchema, legacyInputSchema, outputConfigSchema, parseSdkConfigIrV1, publishConfigSchema, publishRegistrySchema, readmeCustomSectionSchema, readmeEndpointSchema, replayConfigSchema, sdkConfigIrV1Schema, sourceConfigSchema, sourceSpecConfigSchema, sourceSpecTypeSchema, targetConfigSchema, targetLanguageSchema, unsupportedFieldSchema };
+declare const webhookSignatureSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"hmac">;
+    /** Request header carrying the signature. */
+    header: z.ZodString;
+    algorithm: z.ZodOptional<z.ZodEnum<{
+        sha1: "sha1";
+        sha256: "sha256";
+        sha384: "sha384";
+        sha512: "sha512";
+    }>>;
+    encoding: z.ZodOptional<z.ZodEnum<{
+        base64: "base64";
+        hex: "hex";
+    }>>;
+    /** Stripped from the header value before comparison, e.g. `sha256=`. */
+    signaturePrefix: z.ZodOptional<z.ZodString>;
+    payloadFormat: z.ZodOptional<z.ZodObject<{
+        components: z.ZodArray<z.ZodEnum<{
+            body: "body";
+            timestamp: "timestamp";
+            "notification-url": "notification-url";
+            "message-id": "message-id";
+        }>>;
+        delimiter: z.ZodOptional<z.ZodString>;
+        /**
+         * Set when the body is a form-encoded parameter map that must be canonicalized before signing:
+         * keys sorted, each key's values deduped and sorted, concatenated as key-value pairs.
+         */
+        bodySort: z.ZodOptional<z.ZodLiteral<"alphabetical">>;
+    }, z.core.$strict>>;
+    timestamp: z.ZodOptional<z.ZodObject<{
+        header: z.ZodString;
+        format: z.ZodOptional<z.ZodEnum<{
+            "unix-seconds": "unix-seconds";
+            "unix-millis": "unix-millis";
+            iso8601: "iso8601";
+        }>>;
+        /** Replay window in seconds. */
+        tolerance: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    bodyHashBinding: z.ZodOptional<z.ZodObject<{
+        algorithm: z.ZodEnum<{
+            sha1: "sha1";
+            sha256: "sha256";
+            sha384: "sha384";
+            sha512: "sha512";
+        }>;
+        encoding: z.ZodOptional<z.ZodEnum<{
+            base64: "base64";
+            hex: "hex";
+        }>>;
+        location: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"query-parameter">;
+            name: z.ZodString;
+        }, z.core.$strict>], "type">;
+    }, z.core.$strict>>;
+    urlNormalization: z.ZodOptional<z.ZodObject<{
+        /** Try the URL with and without an explicit default port. */
+        portVariants: z.ZodOptional<z.ZodBoolean>;
+        /** Try the URL with the pre-RFC3986 query encoding (`+` for space, unescaped `*`). */
+        legacyQueryEncoding: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+}, z.core.$strict>], "type">;
+type WebhookSignatureInput = z.input<typeof webhookSignatureSchema>;
+type WebhookSignature = z.output<typeof webhookSignatureSchema>;
+
+export { type ApiConfig, type ApiConfigInput, type ApiImportSettings, type AuthConfig, type AuthScheme, type ClientConfig, type ClientConfigInput, type ClientConfigOverride, type CompatibilityConfig, type CredentialResolution, type DocsConfig, type GenerationConfig, JsonObject, type LanguageGenerationConfig, type LegacyInput, type OutputConfig, type PublishConfig, type PublishRegistry, type ReadmeCustomSection, type ReadmeEndpoint, type ReplayConfig, SDK_CONFIG_IR_V1_SCHEMA_VERSION, type SdkConfigIrV1, type SdkConfigIrV1Input, type SourceConfig, type SourceSpecConfig, type SourceSpecType, type TargetConfig, type TargetLanguage, type UnsupportedField, type WebhookSignature, type WebhookSignatureInput, apiConfigSchema, apiImportSettingsSchema, authConfigSchema, authSchemeSchema, clientConfigOverrideSchema, clientConfigSchema, clientRetryOverrideSchema, compatibilityConfigSchema, docsConfigSchema, generationConfigSchema, languageGenerationConfigSchema, legacyInputSchema, outputConfigSchema, parseSdkConfigIrV1, publishConfigSchema, publishRegistrySchema, readmeCustomSectionSchema, readmeEndpointSchema, replayConfigSchema, sdkConfigIrV1Schema, sourceConfigSchema, sourceSpecConfigSchema, sourceSpecTypeSchema, targetConfigSchema, targetLanguageSchema, unsupportedFieldSchema, webhookSignatureSchema };

package/dist/sdk-config-ir/v1/index.js

@@ -28,6 +28,59 @@ var jsonValueSchema = z.lazy(
   ])
 );
 var jsonObjectSchema = z.record(z.string(), jsonValueSchema);
+var hashAlgorithmSchema = z.enum(["sha1", "sha256", "sha384", "sha512"]);
+var encodingSchema = z.enum(["base64", "hex"]);
+var payloadComponentSchema = z.enum(["body", "timestamp", "notification-url", "message-id"]);
+var payloadFormatSchema = z.strictObject({
+  components: z.array(payloadComponentSchema).min(1),
+  delimiter: z.string().optional(),
+  /**
+   * Set when the body is a form-encoded parameter map that must be canonicalized before signing:
+   * keys sorted, each key's values deduped and sorted, concatenated as key-value pairs.
+   */
+  bodySort: z.literal("alphabetical").optional()
+});
+var timestampSchema = z.strictObject({
+  header: nonEmptyStringSchema,
+  format: z.enum(["unix-seconds", "unix-millis", "iso8601"]).optional(),
+  /** Replay window in seconds. */
+  tolerance: z.number().positive().optional()
+});
+var bodyHashLocationSchema = z.discriminatedUnion("type", [
+  z.strictObject({
+    type: z.literal("query-parameter"),
+    name: nonEmptyStringSchema
+  })
+]);
+var bodyHashBindingSchema = z.strictObject({
+  algorithm: hashAlgorithmSchema,
+  encoding: encodingSchema.optional(),
+  location: bodyHashLocationSchema
+});
+var urlNormalizationSchema = z.strictObject({
+  /** Try the URL with and without an explicit default port. */
+  portVariants: z.boolean().optional(),
+  /** Try the URL with the pre-RFC3986 query encoding (`+` for space, unescaped `*`). */
+  legacyQueryEncoding: z.boolean().optional()
+}).refine(
+  ({ portVariants, legacyQueryEncoding }) => portVariants === true || legacyQueryEncoding === true,
+  { message: "url normalization must enable at least one variant" }
+);
+var webhookSignatureSchema = z.discriminatedUnion("type", [
+  z.strictObject({
+    type: z.literal("hmac"),
+    /** Request header carrying the signature. */
+    header: nonEmptyStringSchema,
+    algorithm: hashAlgorithmSchema.optional(),
+    encoding: encodingSchema.optional(),
+    /** Stripped from the header value before comparison, e.g. `sha256=`. */
+    signaturePrefix: z.string().optional(),
+    payloadFormat: payloadFormatSchema.optional(),
+    timestamp: timestampSchema.optional(),
+    bodyHashBinding: bodyHashBindingSchema.optional(),
+    urlNormalization: urlNormalizationSchema.optional()
+  })
+]);
 
 // src/sdk-config-domain/v1/api.ts
 var authVariableSchema = z.strictObject({
@@ -186,7 +239,12 @@ var apiConfigSchema = z.strictObject({
    * Absent means all audiences. A present empty array selects no tagged audience: untagged nodes
    * remain included, while every audience-tagged node is excluded.
    */
-  audiences: z.array(nonEmptyStringSchema).optional()
+  audiences: z.array(nonEmptyStringSchema).optional(),
+  /**
+   * How the API signs the webhooks it sends, enabling a generated verification helper. API-wide, and
+   * independent of whether any webhook is modeled — see {@link webhookSignatureSchema}.
+   */
+  webhookSignature: webhookSignatureSchema.optional()
 });
 var retryOverrideShape = {
   enabled: z.boolean().optional(),
@@ -1139,6 +1197,6 @@ function parseSdkConfigIrV1(value) {
   return sdkConfigIrV1Schema.parse(value);
 }
 
-export { SDK_CONFIG_IR_V1_SCHEMA_VERSION, apiConfigSchema, apiImportSettingsSchema, authConfigSchema, authSchemeSchema, cliGenerationConfigSchema, clientConfigOverrideSchema, clientConfigSchema, clientRetryOverrideSchema, compatibilityConfigSchema, composerPackageNameSchema, csharpGenerationConfigSchema, dependencySchema, docsConfigSchema, exactSemverSchema, generationConfigSchema, goGenerationConfigSchema, goModulePathSchema, javaGenerationConfigSchema, jsonObjectSchema, jsonValueSchema, kotlinGenerationConfigSchema, languageGenerationConfigSchema, legacyInputSchema, mcpAvailabilityStatuses, mcpGenerationConfigSchema, nonEmptyStringSchema, outputConfigSchema, packageConfigSchema, parseSdkConfigIrV1, phpGenerationConfigSchema, publishConfigSchema, publishRegistrySchema, pythonGenerationConfigSchema, readmeCustomSectionSchema, readmeEndpointSchema, relativePathSchema, replayConfigSchema, rubyGenerationConfigSchema, rustGenerationConfigSchema, sdkConfigIrV1Schema, sourceConfigSchema, sourceSpecConfigSchema, sourceSpecTypeSchema, swiftGenerationConfigSchema, targetConfigSchema, targetLanguageSchema, terraformGenerationConfigSchema, typescriptGenerationConfigSchema, unsupportedFieldSchema };
+export { SDK_CONFIG_IR_V1_SCHEMA_VERSION, apiConfigSchema, apiImportSettingsSchema, authConfigSchema, authSchemeSchema, cliGenerationConfigSchema, clientConfigOverrideSchema, clientConfigSchema, clientRetryOverrideSchema, compatibilityConfigSchema, composerPackageNameSchema, csharpGenerationConfigSchema, dependencySchema, docsConfigSchema, exactSemverSchema, generationConfigSchema, goGenerationConfigSchema, goModulePathSchema, javaGenerationConfigSchema, jsonObjectSchema, jsonValueSchema, kotlinGenerationConfigSchema, languageGenerationConfigSchema, legacyInputSchema, mcpAvailabilityStatuses, mcpGenerationConfigSchema, nonEmptyStringSchema, outputConfigSchema, packageConfigSchema, parseSdkConfigIrV1, phpGenerationConfigSchema, publishConfigSchema, publishRegistrySchema, pythonGenerationConfigSchema, readmeCustomSectionSchema, readmeEndpointSchema, relativePathSchema, replayConfigSchema, rubyGenerationConfigSchema, rustGenerationConfigSchema, sdkConfigIrV1Schema, sourceConfigSchema, sourceSpecConfigSchema, sourceSpecTypeSchema, swiftGenerationConfigSchema, targetConfigSchema, targetLanguageSchema, terraformGenerationConfigSchema, typescriptGenerationConfigSchema, unsupportedFieldSchema, webhookSignatureSchema };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map