@todoist/automations-sdk 0.0.0 → 1.0.0

package/dist/request-error-DoLXUa2p.js

@@ -0,0 +1,34 @@
+//#region src/errors/request-error.ts
+var AutomationsNetworkError = class extends Error {
+	constructor(message, cause) {
+		super(message, { cause });
+		this.name = "AutomationsNetworkError";
+	}
+};
+var AutomationsRequestError = class extends Error {
+	httpStatusCode;
+	responseData;
+	authChallenge;
+	requiredScope;
+	requestId;
+	constructor(message, httpStatusCode, responseData, authChallenge, requestId) {
+		super(message);
+		this.name = "AutomationsRequestError";
+		this.httpStatusCode = httpStatusCode;
+		this.responseData = responseData;
+		this.authChallenge = authChallenge;
+		this.requiredScope = parseChallengeScope(authChallenge);
+		this.requestId = requestId;
+	}
+	isAuthError() {
+		return this.httpStatusCode === 401 || this.httpStatusCode === 403;
+	}
+};
+function parseChallengeScope(header) {
+	return header?.match(/scope="([^"]+)"/)?.[1];
+}
+function isInsufficientScopeChallenge(header) {
+	return header?.includes("error=\"insufficient_scope\"") ?? false;
+}
+//#endregion
+export { AutomationsRequestError as n, isInsufficientScopeChallenge as r, AutomationsNetworkError as t };

package/dist/webhook-event-subscription.constants-CBmz0huQ.js

@@ -0,0 +1,31 @@
+//#region ../core/dist/esm/constants/webhook-event-subscription.constants.js
+const WEBHOOK_EVENT_TYPES = [
+	"automation:run:started",
+	"automation:run:finished",
+	"automation:created",
+	"automation:updated",
+	"automation:deleted",
+	"automation:enabled",
+	"automation:disabled",
+	"connection:broken"
+];
+const ACCOUNT_SCOPED_WEBHOOK_EVENT_TYPES = ["connection:broken"];
+function getAccountScopedEventTypes(eventTypes) {
+	const accountScoped = new Set(ACCOUNT_SCOPED_WEBHOOK_EVENT_TYPES);
+	return eventTypes.filter((type) => accountScoped.has(type));
+}
+const WEBHOOK_EVENT_SUBSCRIPTION_STATUSES = ["active", "disabled"];
+const WEBHOOK_EVENT_SUBSCRIPTION_DISABLED_REASONS = ["consecutive_failures"];
+const WEBHOOK_EVENT_DELIVERY_STATUSES = [
+	"pending",
+	"succeeded",
+	"failed",
+	"exhausted",
+	"aborted"
+];
+const WEBHOOK_SECRET_PREFIX = "whsec_";
+const WEBHOOK_ID_HEADER = "webhook-id";
+const WEBHOOK_TIMESTAMP_HEADER = "webhook-timestamp";
+const WEBHOOK_SIGNATURE_HEADER = "webhook-signature";
+//#endregion
+export { WEBHOOK_ID_HEADER as a, WEBHOOK_TIMESTAMP_HEADER as c, WEBHOOK_EVENT_TYPES as i, getAccountScopedEventTypes as l, WEBHOOK_EVENT_SUBSCRIPTION_DISABLED_REASONS as n, WEBHOOK_SECRET_PREFIX as o, WEBHOOK_EVENT_SUBSCRIPTION_STATUSES as r, WEBHOOK_SIGNATURE_HEADER as s, WEBHOOK_EVENT_DELIVERY_STATUSES as t };

package/dist/webhooks.d.ts

@@ -0,0 +1,52 @@
+//#region ../core/dist/types/webhooks/signing.d.ts
+type WebhookVerificationResult = {
+  valid: true;
+} | {
+  valid: false;
+  reason: 'timestamp_invalid' | 'timestamp_expired' | 'signature_mismatch';
+};
+/**
+ * Verify an inbound delivery the way a receiver should: reject stale timestamps,
+ * recompute the expected signature, and constant-time compare against every
+ * entry in the header (any match passes — supports multi-sig rotation).
+ */
+export declare function verifyWebhook(params: {
+  /**
+   * The signing secret, or several to support dual-key overlap during secret
+   * rotation — the delivery validates if it matches any of them.
+   */
+  secret: string | readonly string[];
+  webhookId: string;
+  timestamp: number | string;
+  signatureHeader: string;
+  rawBody: string;
+  /** Unix seconds; defaults to now. Injectable for deterministic tests. */
+  nowSeconds?: number;
+  toleranceSeconds?: number;
+}): WebhookVerificationResult;
+//#endregion
+//#region src/webhooks/verify.d.ts
+export type HeaderSource = Headers | Record<string, string | string[] | undefined>;
+export type VerifyWebhookRequestParams = {
+  /**
+   * The subscription's signing secret (`whsec_…`), or several to support
+   * dual-key overlap during secret rotation — any match passes.
+   */
+  secret: string | readonly string[];
+  /** Inbound request headers — a `Headers` instance or a plain header map. */
+  headers: HeaderSource;
+  /** The exact raw request body bytes, as received (do not re-serialize). */
+  rawBody: string;
+  /** Unix seconds; defaults to now. Injectable for deterministic tests. */
+  nowSeconds?: number;
+  toleranceSeconds?: number;
+};
+/**
+ * Verify an inbound Standard Webhooks delivery from request headers + raw body.
+ * Pulls the `webhook-id` / `webhook-timestamp` / `webhook-signature` headers and
+ * delegates to the shared signing helper. A missing required header is reported
+ * as a signature mismatch.
+ */
+export declare function verifyWebhookRequest(params: VerifyWebhookRequestParams): WebhookVerificationResult;
+//#endregion
+export type { WebhookVerificationResult };

package/dist/webhooks.js

@@ -0,0 +1,83 @@
+import { a as WEBHOOK_ID_HEADER, c as WEBHOOK_TIMESTAMP_HEADER, o as WEBHOOK_SECRET_PREFIX, s as WEBHOOK_SIGNATURE_HEADER } from "./webhook-event-subscription.constants-CBmz0huQ.js";
+import { createHmac, timingSafeEqual } from "node:crypto";
+//#region ../core/dist/esm/webhooks/signing.js
+const SIGNATURE_VERSION = "v1";
+function decodeWebhookSecret(secret) {
+	const base64 = secret.startsWith("whsec_") ? secret.slice(WEBHOOK_SECRET_PREFIX.length) : secret;
+	return Buffer.from(base64, "base64");
+}
+function computeWebhookSignature(params) {
+	const { secret, webhookId, timestamp, rawBody } = params;
+	return createHmac("sha256", decodeWebhookSecret(secret)).update(`${webhookId}.${timestamp}.`, "utf8").update(rawBody, "utf8").digest("base64");
+}
+function constantTimeEquals(a, b) {
+	const aBuf = Buffer.from(a, "utf8");
+	const bBuf = Buffer.from(b, "utf8");
+	if (aBuf.length !== bBuf.length) return false;
+	return timingSafeEqual(aBuf, bBuf);
+}
+function verifyWebhook(params) {
+	const { secret, webhookId, timestamp, signatureHeader, rawBody, nowSeconds = Math.floor(Date.now() / 1e3), toleranceSeconds = 300 } = params;
+	const timestampSeconds = typeof timestamp === "string" ? Number(timestamp) : timestamp;
+	if (!Number.isFinite(timestampSeconds)) return {
+		valid: false,
+		reason: "timestamp_invalid"
+	};
+	if (Math.abs(nowSeconds - timestampSeconds) > toleranceSeconds) return {
+		valid: false,
+		reason: "timestamp_expired"
+	};
+	const secrets = typeof secret === "string" ? [secret] : secret;
+	let expectedSignatures;
+	return signatureHeader.split(" ").map((entry) => entry.split(",", 2)).filter(([version]) => version === SIGNATURE_VERSION).some(([, candidate]) => {
+		if (!candidate) return false;
+		expectedSignatures ??= secrets.map((candidateSecret) => computeWebhookSignature({
+			secret: candidateSecret,
+			webhookId,
+			timestamp,
+			rawBody
+		}));
+		return expectedSignatures.some((expected) => constantTimeEquals(candidate, expected));
+	}) ? { valid: true } : {
+		valid: false,
+		reason: "signature_mismatch"
+	};
+}
+//#endregion
+//#region src/webhooks/verify.ts
+function readWebhookHeaders(headers) {
+	if (headers instanceof Headers) return {
+		webhookId: headers.get(WEBHOOK_ID_HEADER),
+		timestamp: headers.get(WEBHOOK_TIMESTAMP_HEADER),
+		signatureHeader: headers.get(WEBHOOK_SIGNATURE_HEADER)
+	};
+	const normalized = {};
+	for (const [key, value] of Object.entries(headers)) {
+		if (value === void 0) continue;
+		normalized[key.toLowerCase()] = Array.isArray(value) ? value.join(", ") : value;
+	}
+	return {
+		webhookId: normalized["webhook-id"] ?? null,
+		timestamp: normalized["webhook-timestamp"] ?? null,
+		signatureHeader: normalized["webhook-signature"] ?? null
+	};
+}
+function verifyWebhookRequest(params) {
+	const { secret, headers, rawBody, nowSeconds, toleranceSeconds } = params;
+	const { webhookId, timestamp, signatureHeader } = readWebhookHeaders(headers);
+	if (!webhookId || !timestamp || !signatureHeader) return {
+		valid: false,
+		reason: "signature_mismatch"
+	};
+	return verifyWebhook({
+		secret,
+		webhookId,
+		timestamp,
+		signatureHeader,
+		rawBody,
+		nowSeconds,
+		toleranceSeconds
+	});
+}
+//#endregion
+export { verifyWebhook, verifyWebhookRequest };

package/package.json

@@ -1,10 +1,85 @@
 {
-  "name": "@todoist/automations-sdk",
-  "version": "0.0.0",
-  "description": "OIDC trusted publishing setup package for @todoist/automations-sdk",
-  "keywords": [
-    "oidc",
-    "trusted-publishing",
-    "setup"
-  ]
+    "name": "@todoist/automations-sdk",
+    "version": "1.0.0",
+    "description": "TypeScript SDK for the Todoist Automations API",
+    "license": "UNLICENSED",
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/todoist/automations.git",
+        "directory": "packages/sdk"
+    },
+    "homepage": "https://github.com/todoist/automations/tree/main/packages/sdk#readme",
+    "bugs": {
+        "url": "https://github.com/todoist/automations/issues"
+    },
+    "publishConfig": {
+        "access": "public"
+    },
+    "type": "module",
+    "main": "./dist/index.js",
+    "types": "./dist/index.d.ts",
+    "exports": {
+        ".": {
+            "types": "./dist/index.d.ts",
+            "default": "./dist/index.js"
+        },
+        "./base-client": {
+            "types": "./dist/base-client.d.ts",
+            "default": "./dist/base-client.js"
+        },
+        "./webhooks": {
+            "types": "./dist/webhooks.d.ts",
+            "default": "./dist/webhooks.js"
+        },
+        "./chat-turn": {
+            "types": "./dist/chat-turn.d.ts",
+            "default": "./dist/chat-turn.js"
+        },
+        "./authoring": {
+            "types": "./dist/authoring.d.ts",
+            "default": "./dist/authoring.js"
+        }
+    },
+    "files": [
+        "dist"
+    ],
+    "sideEffects": false,
+    "scripts": {
+        "build": "tsdown",
+        "prepack": "npm run build",
+        "check:publish": "publint . && attw --pack . --profile esm-only && node scripts/check-no-admin.mjs",
+        "release": "semantic-release",
+        "test": "vitest run",
+        "lint": "oxlint src",
+        "lint:fix": "oxlint src --fix",
+        "format": "oxfmt src --check",
+        "format:fix": "oxfmt src",
+        "check": "oxfmt src --check && oxlint src",
+        "check:fix": "oxfmt src && oxlint src --fix",
+        "type-check": "tsc -p tsconfig.typecheck.json --noEmit"
+    },
+    "dependencies": {
+        "@types/json-schema": "7.0.15",
+        "ai": "7.0.163",
+        "json-stable-stringify": "1.3.0"
+    },
+    "peerDependencies": {
+        "zod": "^4.6.0"
+    },
+    "devDependencies": {
+        "@arethetypeswrong/cli": "0.18.5",
+        "@todoist/automations-core": "*",
+        "@todoist/automations-sdk-test-utils": "*",
+        "@todoist/tsconfig": "2.0.2",
+        "conventional-changelog-conventionalcommits": "9.3.1",
+        "msw": "3.0.3",
+        "publint": "0.3.25",
+        "semantic-release": "25.0.9",
+        "tsdown": "0.23.1",
+        "typescript": "6.0.3",
+        "zod": "4.6.7"
+    },
+    "engines": {
+        "node": ">=24"
+    }
 }