@tiempo/sdk 0.0.0-stage → 0.1.1

package/dist/esm/generated/types.d.ts

@@ -0,0 +1,134 @@
+import type { components, operations } from './openapi.js';
+import type { WithMetadataFilter } from '../shared.js';
+export type { components, operations };
+export type Account = components["schemas"]["Account"];
+export type Attendee = components["schemas"]["Attendee"];
+export type AvailabilityCalendarBlocked = components["schemas"]["AvailabilityCalendarBlocked"];
+export type AvailabilityCalendar = components["schemas"]["AvailabilityCalendarCalendar"];
+export type AvailabilityCalendarDay = components["schemas"]["AvailabilityCalendarDay"];
+export type AvailabilityCalendarDayReason = components["schemas"]["AvailabilityCalendarDayReason"];
+export type AvailabilityCalendarFree = components["schemas"]["AvailabilityCalendarFree"];
+export type AvailabilityCalendarResourceCalendar = components["schemas"]["AvailabilityCalendarResourceCalendar"];
+export type AvailabilityCalendarWorking = components["schemas"]["AvailabilityCalendarWorking"];
+export type Availability = components["schemas"]["AvailabilitySearchAvailability"];
+export type AvailabilitySegmentQuery = components["schemas"]["AvailabilitySearchSegmentQuery"];
+export type AvailabilitySlot = components["schemas"]["AvailabilitySearchSlot"];
+export type AvailabilitySlotSegment = components["schemas"]["AvailabilitySearchSlotSegment"];
+export type Block = components["schemas"]["Block"];
+export type Booking = components["schemas"]["Booking"];
+export type BookingSegment = components["schemas"]["BookingSegment"];
+export type BookingsImportedBooking = components["schemas"]["BookingsImportedBooking"];
+export type BookingsImportedSegment = components["schemas"]["BookingsImportedSegment"];
+export type BookingSegmentInput = components["schemas"]["BookingsSegmentInput"];
+export type CandidateConflict = components["schemas"]["CandidateConflict"];
+export type Conflict = components["schemas"]["Conflict"];
+export type ConflictPreview = components["schemas"]["ConflictPreview"];
+export type ConflictPreviewAffected = components["schemas"]["ConflictPreviewAffected"];
+export type DeletedObject = components["schemas"]["DeletedObject"];
+export type Location = components["schemas"]["Location"];
+export type Resource = components["schemas"]["Resource"];
+export type Schedule = components["schemas"]["Schedule"];
+export type ScheduleInterval = components["schemas"]["ScheduleInterval"];
+export type ScheduleIntervalInput = components["schemas"]["ScheduleIntervalInput"];
+export type ScheduleOverride = components["schemas"]["ScheduleOverride"];
+export type Series = components["schemas"]["Series"];
+export type SeriesTemplate = components["schemas"]["SeriesTemplate"];
+export type SeriesTemplateInput = components["schemas"]["SeriesTemplateInput"];
+export type SeriesTemplateSegment = components["schemas"]["SeriesTemplateSegment"];
+export type SeriesTemplateSegmentInput = components["schemas"]["SeriesTemplateSegmentInput"];
+export type SkippedOccurrence = components["schemas"]["SkippedOccurrence"];
+export type AccountUsage = components["schemas"]["UsageAccountUsage"];
+export type UsageStatement = components["schemas"]["UsageStatement"];
+export type UsageSummary = components["schemas"]["UsageSummary"];
+export type WebhookDelivery = components["schemas"]["WebhookDelivery"];
+export type WebhookDeliveryAttempt = components["schemas"]["WebhookDeliveryAttempt"];
+export type WebhookEndpoint = components["schemas"]["WebhookEndpoint"];
+export type WebhookEndpointResendResult = components["schemas"]["WebhookResendsEndpointResent"];
+/** Params for `list` on `accounts` (GET /v1/accounts). */
+export type AccountListParams = WithMetadataFilter<NonNullable<operations["accounts.list"]["parameters"]["query"]>>;
+/** Params for `create` on `accounts` (POST /v1/accounts). */
+export type AccountCreateParams = NonNullable<operations["accounts.create"]["requestBody"]>["content"]["application/json"];
+/** Params for `update` on `accounts` (POST /v1/accounts/{id}). */
+export type AccountUpdateParams = NonNullable<operations["accounts.update"]["requestBody"]>["content"]["application/json"];
+/** Params for `update` on `attendees` (POST /v1/attendees/{id}). */
+export type AttendeeUpdateParams = NonNullable<operations["attendees.updateAttendee"]["requestBody"]>["content"]["application/json"];
+/** Params for `cancel` on `attendees` (POST /v1/attendees/{id}/cancel). */
+export type AttendeeCancelParams = NonNullable<operations["attendees.cancelAttendee"]["requestBody"]>["content"]["application/json"];
+/** Params for `search` on `availability` (POST /v1/availability). */
+export type AvailabilitySearchParams = NonNullable<operations["availability.search"]["requestBody"]>["content"]["application/json"];
+/** Params for `calendar` on `availability` (GET /v1/availability/calendar). */
+export type AvailabilityCalendarParams = NonNullable<operations["availability.calendar"]["parameters"]["query"]>;
+/** Params for `list` on `blocks` (GET /v1/blocks). */
+export type BlockListParams = WithMetadataFilter<NonNullable<operations["blocks.list"]["parameters"]["query"]>>;
+/** Params for `create` on `blocks` (POST /v1/blocks). */
+export type BlockCreateParams = NonNullable<operations["blocks.create"]["requestBody"]>["content"]["application/json"];
+/** Params for `update` on `blocks` (POST /v1/blocks/{id}). */
+export type BlockUpdateParams = NonNullable<operations["blocks.update"]["requestBody"]>["content"]["application/json"];
+/** Params for `list` on `bookings` (GET /v1/bookings). */
+export type BookingListParams = WithMetadataFilter<NonNullable<operations["bookings.list"]["parameters"]["query"]>>;
+/** Params for `create` on `bookings` (POST /v1/bookings). */
+export type BookingCreateParams = NonNullable<operations["bookings.create"]["requestBody"]>["content"]["application/json"];
+/** Params for `import` on `bookings` (POST /v1/bookings/import). */
+export type BookingImportParams = NonNullable<operations["bookings.importBookings"]["requestBody"]>["content"]["application/json"];
+/** Params for `update` on `bookings` (POST /v1/bookings/{id}). */
+export type BookingUpdateParams = NonNullable<operations["bookings.update"]["requestBody"]>["content"]["application/json"];
+/** Params for `list` on `attendees` (GET /v1/bookings/{id}/attendees). */
+export type AttendeeListParams = WithMetadataFilter<NonNullable<operations["attendees.listAttendees"]["parameters"]["query"]>>;
+/** Params for `create` on `attendees` (POST /v1/bookings/{id}/attendees). */
+export type AttendeeCreateParams = NonNullable<operations["attendees.createAttendee"]["requestBody"]>["content"]["application/json"];
+/** Params for `cancel` on `bookings` (POST /v1/bookings/{id}/cancel). */
+export type BookingCancelParams = NonNullable<operations["bookings.cancel"]["requestBody"]>["content"]["application/json"];
+/** Params for `reschedule` on `bookings` (POST /v1/bookings/{id}/reschedule). */
+export type BookingRescheduleParams = NonNullable<operations["bookings.reschedule"]["requestBody"]>["content"]["application/json"];
+/** Params for `create` on `conflictPreviews` (POST /v1/conflict_previews). */
+export type ConflictPreviewCreateParams = NonNullable<operations["conflict_previews.create"]["requestBody"]>["content"]["application/json"];
+/** Params for `list` on `events` (GET /v1/events). */
+export type EventListParams = NonNullable<operations["events.list"]["parameters"]["query"]>;
+/** Params for `resend` on `events` (POST /v1/events/{id}/resend). */
+export type EventResendParams = NonNullable<operations["events.resend"]["requestBody"]>["content"]["application/json"];
+/** Params for `list` on `locations` (GET /v1/locations). */
+export type LocationListParams = WithMetadataFilter<NonNullable<operations["locations.list"]["parameters"]["query"]>>;
+/** Params for `create` on `locations` (POST /v1/locations). */
+export type LocationCreateParams = NonNullable<operations["locations.create"]["requestBody"]>["content"]["application/json"];
+/** Params for `update` on `locations` (POST /v1/locations/{id}). */
+export type LocationUpdateParams = NonNullable<operations["locations.update"]["requestBody"]>["content"]["application/json"];
+/** Params for `list` on `resources` (GET /v1/resources). */
+export type ResourceListParams = WithMetadataFilter<NonNullable<operations["resources.list"]["parameters"]["query"]>>;
+/** Params for `create` on `resources` (POST /v1/resources). */
+export type ResourceCreateParams = NonNullable<operations["resources.create"]["requestBody"]>["content"]["application/json"];
+/** Params for `update` on `resources` (POST /v1/resources/{id}). */
+export type ResourceUpdateParams = NonNullable<operations["resources.update"]["requestBody"]>["content"]["application/json"];
+/** Params for `list` on `scheduleOverrides` (GET /v1/schedule_overrides). */
+export type ScheduleOverrideListParams = WithMetadataFilter<NonNullable<operations["schedule_overrides.listOverrides"]["parameters"]["query"]>>;
+/** Params for `create` on `scheduleOverrides` (POST /v1/schedule_overrides). */
+export type ScheduleOverrideCreateParams = NonNullable<operations["schedule_overrides.createOverride"]["requestBody"]>["content"]["application/json"];
+/** Params for `update` on `scheduleOverrides` (POST /v1/schedule_overrides/{id}). */
+export type ScheduleOverrideUpdateParams = NonNullable<operations["schedule_overrides.updateOverride"]["requestBody"]>["content"]["application/json"];
+/** Params for `list` on `schedules` (GET /v1/schedules). */
+export type ScheduleListParams = WithMetadataFilter<NonNullable<operations["schedules.list"]["parameters"]["query"]>>;
+/** Params for `create` on `schedules` (POST /v1/schedules). */
+export type ScheduleCreateParams = NonNullable<operations["schedules.create"]["requestBody"]>["content"]["application/json"];
+/** Params for `update` on `schedules` (POST /v1/schedules/{id}). */
+export type ScheduleUpdateParams = NonNullable<operations["schedules.update"]["requestBody"]>["content"]["application/json"];
+/** Params for `list` on `series` (GET /v1/series). */
+export type SeriesListParams = WithMetadataFilter<NonNullable<operations["series.list"]["parameters"]["query"]>>;
+/** Params for `create` on `series` (POST /v1/series). */
+export type SeriesCreateParams = NonNullable<operations["series.create"]["requestBody"]>["content"]["application/json"];
+/** Params for `update` on `series` (POST /v1/series/{id}). */
+export type SeriesUpdateParams = NonNullable<operations["series.update"]["requestBody"]>["content"]["application/json"];
+/** Params for `cancel` on `series` (POST /v1/series/{id}/cancel). */
+export type SeriesCancelParams = NonNullable<operations["series.cancel"]["requestBody"]>["content"]["application/json"];
+/** Params for `split` on `series` (POST /v1/series/{id}/split). */
+export type SeriesSplitParams = NonNullable<operations["series.split"]["requestBody"]>["content"]["application/json"];
+/** Params for `get` on `usage` (GET /v1/usage). */
+export type UsageGetParams = NonNullable<operations["usage.get"]["parameters"]["query"]>;
+/** Params for `list` on `webhookEndpoints` (GET /v1/webhook_endpoints). */
+export type WebhookEndpointListParams = WithMetadataFilter<NonNullable<operations["webhook_endpoints.list"]["parameters"]["query"]>>;
+/** Params for `create` on `webhookEndpoints` (POST /v1/webhook_endpoints). */
+export type WebhookEndpointCreateParams = NonNullable<operations["webhook_endpoints.create"]["requestBody"]>["content"]["application/json"];
+/** Params for `update` on `webhookEndpoints` (POST /v1/webhook_endpoints/{id}). */
+export type WebhookEndpointUpdateParams = NonNullable<operations["webhook_endpoints.update"]["requestBody"]>["content"]["application/json"];
+/** Params for `deliveries` on `webhookEndpoints` (GET /v1/webhook_endpoints/{id}/deliveries). */
+export type WebhookEndpointDeliveriesParams = NonNullable<operations["webhook_endpoints.deliveries"]["parameters"]["query"]>;
+/** Params for `resend` on `webhookEndpoints` (POST /v1/webhook_endpoints/{id}/resend). */
+export type WebhookEndpointResendParams = NonNullable<operations["webhook_endpoints.resend"]["requestBody"]>["content"]["application/json"];

package/dist/esm/generated/types.js

@@ -0,0 +1,2 @@
+// Code generated by scripts/generate.mjs from openapi.json. DO NOT EDIT.
+export {};

package/dist/esm/index.d.ts

@@ -0,0 +1,16 @@
+export { Tiempo } from './client.js';
+export { Tiempo as default } from './client.js';
+export { DEFAULT_BASE_URL } from './core.js';
+export type { TiempoConfig, RequestOptions } from './core.js';
+export { ListPromise } from './list.js';
+export type { ListPage, PageParams } from './list.js';
+export { TiempoError, TiempoInvalidRequestError, TiempoAuthenticationError, TiempoPermissionError, TiempoConflictError, TiempoIdempotencyError, TiempoRateLimitError, TiempoAPIError, TiempoConnectionError, TiempoSignatureVerificationError, } from './errors.js';
+export type { TiempoErrorBody } from './errors.js';
+export { EVENT_TYPES, isKnownEventType } from './events.js';
+export type { TiempoEvent, TiempoEventOf, TiempoEventType, EventObject, EventObjectMap } from './events.js';
+export { constructEvent, generateTestHeader, Webhooks, SIGNATURE_HEADER } from './webhooks.js';
+export type { ConstructEventOptions, GenerateTestHeaderOptions } from './webhooks.js';
+export { API_VERSION, SDK_VERSION } from './generated/meta.js';
+export type { WithMetadataFilter } from './shared.js';
+export * from './generated/types.js';
+export * from './generated/resources.js';

package/dist/esm/index.js

@@ -0,0 +1,10 @@
+export { Tiempo } from './client.js';
+export { Tiempo as default } from './client.js';
+export { DEFAULT_BASE_URL } from './core.js';
+export { ListPromise } from './list.js';
+export { TiempoError, TiempoInvalidRequestError, TiempoAuthenticationError, TiempoPermissionError, TiempoConflictError, TiempoIdempotencyError, TiempoRateLimitError, TiempoAPIError, TiempoConnectionError, TiempoSignatureVerificationError, } from './errors.js';
+export { EVENT_TYPES, isKnownEventType } from './events.js';
+export { constructEvent, generateTestHeader, Webhooks, SIGNATURE_HEADER } from './webhooks.js';
+export { API_VERSION, SDK_VERSION } from './generated/meta.js';
+export * from './generated/types.js';
+export * from './generated/resources.js';

package/dist/esm/list.d.ts

@@ -0,0 +1,43 @@
+/** One page of a list endpoint. */
+export interface ListPage<T> {
+    object: 'list';
+    data: T[];
+    has_more: boolean;
+}
+/** Query params every paginating list accepts. */
+export interface PageParams {
+    limit?: number;
+    starting_after?: string;
+    ending_before?: string;
+    [key: string]: unknown;
+}
+type FetchPage<T> = (params: PageParams) => Promise<ListPage<T>>;
+/**
+ * What a list method returns. `await` it for one page; `for await` over it to
+ * walk every item across pages.
+ *
+ * Iteration moves forward with `starting_after` (the last item's id). If you
+ * passed `ending_before`, it moves backwards with `ending_before` (the first
+ * item's id) and yields each page's items last to first, so you walk away from
+ * your cursor.
+ *
+ * The first page is fetched once, on first use, and shared between `await` and
+ * iteration.
+ */
+export declare class ListPromise<T> implements PromiseLike<ListPage<T>>, AsyncIterable<T> {
+    private readonly fetchPage;
+    private readonly params;
+    private readonly paginates;
+    private first;
+    constructor(fetchPage: FetchPage<T>, params: PageParams, paginates?: boolean);
+    private firstPage;
+    then<R1 = ListPage<T>, R2 = never>(onfulfilled?: ((value: ListPage<T>) => R1 | PromiseLike<R1>) | null, onrejected?: ((reason: unknown) => R2 | PromiseLike<R2>) | null): Promise<R1 | R2>;
+    catch<R = never>(onrejected?: ((reason: unknown) => R | PromiseLike<R>) | null): Promise<ListPage<T> | R>;
+    finally(onfinally?: (() => void) | null): Promise<ListPage<T>>;
+    [Symbol.asyncIterator](): AsyncIterator<T>;
+    /** Collects items into an array, stopping after `limit` (required, to avoid surprises). */
+    toArray({ limit }: {
+        limit: number;
+    }): Promise<T[]>;
+}
+export {};

package/dist/esm/list.js

@@ -0,0 +1,74 @@
+function idOf(item) {
+    const id = item && typeof item === 'object' ? item.id : undefined;
+    if (typeof id !== 'string')
+        throw new TypeError('Cannot paginate: list item has no string `id`');
+    return id;
+}
+/**
+ * What a list method returns. `await` it for one page; `for await` over it to
+ * walk every item across pages.
+ *
+ * Iteration moves forward with `starting_after` (the last item's id). If you
+ * passed `ending_before`, it moves backwards with `ending_before` (the first
+ * item's id) and yields each page's items last to first, so you walk away from
+ * your cursor.
+ *
+ * The first page is fetched once, on first use, and shared between `await` and
+ * iteration.
+ */
+export class ListPromise {
+    fetchPage;
+    params;
+    paginates;
+    first;
+    constructor(fetchPage, params, paginates = true) {
+        this.fetchPage = fetchPage;
+        this.params = params;
+        this.paginates = paginates;
+    }
+    firstPage() {
+        this.first ??= this.fetchPage(this.params);
+        return this.first;
+    }
+    then(onfulfilled, onrejected) {
+        return this.firstPage().then(onfulfilled, onrejected);
+    }
+    catch(onrejected) {
+        return this.firstPage().catch(onrejected);
+    }
+    finally(onfinally) {
+        return this.firstPage().finally(onfinally);
+    }
+    async *[Symbol.asyncIterator]() {
+        const backwards = this.params.ending_before !== undefined && this.params.starting_after === undefined;
+        let page = await this.firstPage();
+        for (;;) {
+            const items = backwards ? [...page.data].reverse() : page.data;
+            for (const item of items)
+                yield item;
+            if (!this.paginates || !page.has_more || page.data.length === 0)
+                return;
+            const next = { ...this.params };
+            if (backwards) {
+                next.ending_before = idOf(page.data[0]);
+            }
+            else {
+                delete next.ending_before;
+                next.starting_after = idOf(page.data[page.data.length - 1]);
+            }
+            page = await this.fetchPage(next);
+        }
+    }
+    /** Collects items into an array, stopping after `limit` (required, to avoid surprises). */
+    async toArray({ limit }) {
+        const out = [];
+        if (limit <= 0)
+            return out;
+        for await (const item of this) {
+            out.push(item);
+            if (out.length >= limit)
+                break;
+        }
+        return out;
+    }
+}

package/dist/esm/package.json

@@ -0,0 +1 @@
+{"type":"module"}

package/dist/esm/query.d.ts

@@ -0,0 +1,8 @@
+/** Encodes a path segment. */
+export declare function encodePath(value: string): string;
+/**
+ * Encodes a query object: undefined and null are skipped, booleans become
+ * `true`/`false`, arrays repeat the key, and objects (like `metadata`) become
+ * `key[sub]=value`.
+ */
+export declare function encodeQuery(query: object | undefined): string;

package/dist/esm/query.js

@@ -0,0 +1,43 @@
+/** Encodes a path segment. */
+export function encodePath(value) {
+    if (typeof value !== 'string' || value === '') {
+        throw new TypeError(`Expected a non-empty id string, got ${JSON.stringify(value)}`);
+    }
+    return encodeURIComponent(value);
+}
+function scalar(value) {
+    if (value instanceof Date)
+        return value.toISOString();
+    if (typeof value === 'boolean')
+        return value ? 'true' : 'false';
+    return String(value);
+}
+function add(out, key, value) {
+    if (value === undefined || value === null)
+        return;
+    if (Array.isArray(value)) {
+        for (const v of value)
+            add(out, key, v);
+        return;
+    }
+    if (typeof value === 'object' && !(value instanceof Date)) {
+        for (const [k, v] of Object.entries(value))
+            add(out, `${key}[${k}]`, v);
+        return;
+    }
+    out.append(key, scalar(value));
+}
+/**
+ * Encodes a query object: undefined and null are skipped, booleans become
+ * `true`/`false`, arrays repeat the key, and objects (like `metadata`) become
+ * `key[sub]=value`.
+ */
+export function encodeQuery(query) {
+    if (!query)
+        return '';
+    const out = new URLSearchParams();
+    for (const [k, v] of Object.entries(query))
+        add(out, k, v);
+    const s = out.toString();
+    return s ? `?${s}` : '';
+}

package/dist/esm/shared.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Replaces the spec's single `metadata[key]` query param with a map. Each entry
+ * is sent as `metadata[k]=v`; several entries must all match.
+ */
+export type WithMetadataFilter<Q> = Omit<Q, 'metadata[key]'> & {
+    metadata?: Record<string, string>;
+};

package/dist/esm/shared.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/webhooks.d.ts

@@ -0,0 +1,34 @@
+import type { TiempoEvent } from './events.js';
+/** The header Tiempo signs webhook deliveries with. */
+export declare const SIGNATURE_HEADER = "Tiempo-Signature";
+export interface ConstructEventOptions {
+    /** Maximum age (and clock skew) of the signature timestamp, in seconds. Default 300. */
+    tolerance?: number;
+    /** The current time, as a `Date` or unix seconds. Default: now. */
+    now?: Date | number;
+}
+export interface GenerateTestHeaderOptions {
+    /** The exact body you will pass to `constructEvent`. */
+    payload: string | Uint8Array;
+    /** The endpoint's `tpw_…` secret. */
+    secret: string;
+    /** Unix seconds. Default: now. */
+    timestamp?: number;
+}
+/**
+ * Verifies a webhook delivery and returns its event.
+ *
+ * Pass the raw request body exactly as received (not re-serialised JSON), the
+ * `Tiempo-Signature` header, and the endpoint's `tpw_…` secret. Throws
+ * {@link TiempoSignatureVerificationError} if the signature doesn't match or
+ * the timestamp is outside `tolerance`.
+ */
+export declare function constructEvent(payload: string | Uint8Array, signatureHeader: string | null | undefined, secret: string, options?: ConstructEventOptions): Promise<TiempoEvent>;
+/** Builds a valid `Tiempo-Signature` header for a payload, for your own tests. */
+export declare function generateTestHeader({ payload, secret, timestamp }: GenerateTestHeaderOptions): Promise<string>;
+/** `tiempo.webhooks`: the same functions, on the client. */
+export declare class Webhooks {
+    readonly constructEvent: typeof constructEvent;
+    readonly generateTestHeader: typeof generateTestHeader;
+    readonly signatureHeader = "Tiempo-Signature";
+}

package/dist/esm/webhooks.js

@@ -0,0 +1,109 @@
+import { webCrypto } from './crypto.js';
+import { TiempoSignatureVerificationError } from './errors.js';
+/** The header Tiempo signs webhook deliveries with. */
+export const SIGNATURE_HEADER = 'Tiempo-Signature';
+const encoder = new TextEncoder();
+function fail(message) {
+    throw new TiempoSignatureVerificationError({ message });
+}
+function bytesOf(payload) {
+    return typeof payload === 'string' ? encoder.encode(payload) : payload;
+}
+function hex(buf) {
+    return Array.from(new Uint8Array(buf), (b) => b.toString(16).padStart(2, '0')).join('');
+}
+/** Constant-time string comparison (for equal-length hex digests). */
+function timingSafeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+async function sign(secret, timestamp, payload) {
+    const { subtle } = await webCrypto();
+    const key = await subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const prefix = encoder.encode(`${timestamp}.`);
+    const message = new Uint8Array(prefix.length + payload.length);
+    message.set(prefix, 0);
+    message.set(payload, prefix.length);
+    return hex(await subtle.sign('HMAC', key, message));
+}
+function parseHeader(header) {
+    let timestamp;
+    const signatures = [];
+    for (const part of header.split(',')) {
+        const eq = part.indexOf('=');
+        if (eq < 0)
+            continue;
+        const key = part.slice(0, eq).trim();
+        const value = part.slice(eq + 1).trim();
+        if (key === 't' && /^\d+$/.test(value))
+            timestamp = Number(value);
+        else if (key === 'v1' && value)
+            signatures.push(value.toLowerCase());
+    }
+    if (timestamp === undefined)
+        fail('Tiempo-Signature header has no timestamp (t=…)');
+    if (signatures.length === 0)
+        fail('Tiempo-Signature header has no v1 signature');
+    return { timestamp, signatures };
+}
+/**
+ * Verifies a webhook delivery and returns its event.
+ *
+ * Pass the raw request body exactly as received (not re-serialised JSON), the
+ * `Tiempo-Signature` header, and the endpoint's `tpw_…` secret. Throws
+ * {@link TiempoSignatureVerificationError} if the signature doesn't match or
+ * the timestamp is outside `tolerance`.
+ */
+export async function constructEvent(payload, signatureHeader, secret, options = {}) {
+    if (typeof payload !== 'string' && !(payload instanceof Uint8Array)) {
+        fail('Webhook payload must be the raw body as a string or bytes, not a parsed object (use express.raw()).');
+    }
+    if (typeof signatureHeader !== 'string' || signatureHeader === '')
+        fail('Missing Tiempo-Signature header');
+    if (typeof secret !== 'string' || secret === '')
+        fail('Missing webhook signing secret (tpw_…)');
+    const tolerance = options.tolerance ?? 300;
+    const nowSeconds = options.now instanceof Date
+        ? Math.floor(options.now.getTime() / 1000)
+        : options.now ?? Math.floor(Date.now() / 1000);
+    const { timestamp, signatures } = parseHeader(signatureHeader);
+    const bytes = bytesOf(payload);
+    const expected = await sign(secret, timestamp, bytes);
+    let matched = false;
+    for (const candidate of signatures) {
+        if (timingSafeEqual(candidate, expected))
+            matched = true;
+    }
+    if (!matched)
+        fail('No v1 signature in Tiempo-Signature matches the payload. Check the secret and that the body is unmodified.');
+    if (Math.abs(nowSeconds - timestamp) > tolerance) {
+        fail(`Tiempo-Signature timestamp ${timestamp} is outside the ${tolerance}s tolerance`);
+    }
+    const text = typeof payload === 'string' ? payload : new TextDecoder().decode(payload);
+    let event;
+    try {
+        event = JSON.parse(text);
+    }
+    catch {
+        fail('Webhook payload is not valid JSON');
+    }
+    if (!event || typeof event !== 'object' || event.object !== 'event') {
+        fail('Webhook payload is not a Tiempo event');
+    }
+    return event;
+}
+/** Builds a valid `Tiempo-Signature` header for a payload, for your own tests. */
+export async function generateTestHeader({ payload, secret, timestamp }) {
+    const t = timestamp ?? Math.floor(Date.now() / 1000);
+    return `t=${t},v1=${await sign(secret, t, bytesOf(payload))}`;
+}
+/** `tiempo.webhooks`: the same functions, on the client. */
+export class Webhooks {
+    constructEvent = constructEvent;
+    generateTestHeader = generateTestHeader;
+    signatureHeader = SIGNATURE_HEADER;
+}

package/package.json

@@ -1,6 +1,76 @@
 {
   "name": "@tiempo/sdk",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "TypeScript client for Tiempo, the scheduling API for booking platforms: availability search, holds and bookings that never double-book, classes, recurring series and signed webhooks.",
+  "keywords": [
+    "tiempo",
+    "scheduling",
+    "scheduling-api",
+    "booking",
+    "booking-api",
+    "booking-engine",
+    "appointments",
+    "availability",
+    "reservations",
+    "double-booking",
+    "calendar",
+    "classes",
+    "webhooks",
+    "api",
+    "sdk"
+  ],
+  "homepage": "https://tiempo.one/docs",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tiempo-one/tiempo-node.git"
+  },
+  "bugs": {
+    "url": "https://github.com/tiempo-one/tiempo-node/issues"
+  },
+  "license": "MIT",
+  "type": "module",
+  "engines": {
+    "node": ">=18"
+  },
+  "main": "./dist/cjs/index.js",
+  "module": "./dist/esm/index.js",
+  "types": "./dist/cjs/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/esm/index.d.ts",
+        "default": "./dist/esm/index.js"
+      },
+      "require": {
+        "types": "./dist/cjs/index.d.ts",
+        "default": "./dist/cjs/index.js"
+      }
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "generate": "node scripts/generate.mjs",
+    "build": "node scripts/build.mjs",
+    "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "smoke": "npm run build && node scripts/smoke.mjs",
+    "prepare": "npm run build",
+    "traffic": "npm run build && node scripts/traffic.mjs",
+    "prepublishOnly": "npm run typecheck && npm test"
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.5",
+    "openapi-typescript": "^7.13.0",
+    "typescript": "~5.9.3",
+    "vitest": "^4.1.11"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}