@tryfinch/finch-api 5.0.0 → 5.1.0

package/resources/webhooks.js

@@ -0,0 +1,118 @@
+'use strict';
+// File generated from our OpenAPI spec by Stainless.
+Object.defineProperty(exports, '__esModule', { value: true });
+exports.Webhooks = void 0;
+const resource_1 = require('@tryfinch/finch-api/resource');
+const crypto_1 = require('crypto');
+const core_1 = require('@tryfinch/finch-api/core');
+class Webhooks extends resource_1.APIResource {
+  /**
+   * Validates that the given payload was sent by Finch and parses the payload.
+   */
+  unwrap(payload, headers, secret = this.client.webhookSecret) {
+    this.verifySignature(payload, headers, secret);
+    return JSON.parse(payload);
+  }
+  parseSecret(secret) {
+    if (!secret) {
+      throw new Error(
+        "The webhook secret must either be set using the env var, FINCH_WEBHOOK_SECRET, on the client class, Finch({ webhook_secret: '123' }), or passed to this function",
+      );
+    }
+    const buf = Buffer.from(secret, 'base64');
+    if (buf.toString('base64') !== secret) {
+      throw new Error(`Given secret is not valid`);
+    }
+    return new Uint8Array(buf);
+  }
+  signPayload(payload, { eventId, timestamp, secret }) {
+    const encoder = new TextEncoder();
+    const toSign = encoder.encode(`${eventId}.${timestamp.getTime() / 1000}.${payload}`);
+    const hmac = (0, crypto_1.createHmac)('sha256', secret);
+    hmac.update(toSign);
+    return `v1,${hmac.digest('base64')}`;
+  }
+  /** Make an assertion, if not `true`, then throw. */
+  assert(expr, msg = '') {
+    if (!expr) {
+      throw new Error(msg);
+    }
+  }
+  /** Compare to array buffers or data views in a way that timing based attacks
+   * cannot gain information about the platform. */
+  timingSafeEqual(a, b) {
+    if (a.byteLength !== b.byteLength) {
+      return false;
+    }
+    if (!(a instanceof DataView)) {
+      a = new DataView(ArrayBuffer.isView(a) ? a.buffer : a);
+    }
+    if (!(b instanceof DataView)) {
+      b = new DataView(ArrayBuffer.isView(b) ? b.buffer : b);
+    }
+    this.assert(a instanceof DataView);
+    this.assert(b instanceof DataView);
+    const length = a.byteLength;
+    let out = 0;
+    let i = -1;
+    while (++i < length) {
+      out |= a.getUint8(i) ^ b.getUint8(i);
+    }
+    return out === 0;
+  }
+  /**
+   * Validates whether or not the webhook payload was sent by Finch.
+   *
+   * An error will be raised if the webhook payload was not sent by Finch.
+   */
+  verifySignature(body, headers, secret = this.client.webhookSecret) {
+    const parsedSecret = this.parseSecret(secret);
+    const eventId = (0, core_1.getHeader)(headers, 'finch-event-id');
+    if (!eventId) {
+      throw new Error('Could not find finch-event-id header');
+    }
+    const msgTimestamp = (0, core_1.getHeader)(headers, 'finch-timestamp');
+    if (!msgTimestamp) {
+      throw new Error('Could not find finch-timestamp header');
+    }
+    const msgSignature = (0, core_1.getHeader)(headers, 'finch-signature');
+    if (!msgSignature) {
+      throw new Error('Could not find finch-signature header');
+    }
+    const now = Math.floor(Date.now() / 1000);
+    const timestampSeconds = parseInt(msgTimestamp, 10);
+    if (isNaN(timestampSeconds)) {
+      throw new Error(`Invalid timestamp header: ${msgTimestamp}`);
+    }
+    if (typeof body !== 'string') {
+      throw new Error(
+        'Webhook body must be passed as the raw JSON string sent from the server (do not parse it first).',
+      );
+    }
+    const webhook_tolerance_in_seconds = 5 * 60; // 5 minutes
+    if (now - timestampSeconds > webhook_tolerance_in_seconds) {
+      throw new Error('Webhook timestamp is too old');
+    }
+    if (timestampSeconds > now + webhook_tolerance_in_seconds) {
+      throw new Error('Webhook timestamp is too new');
+    }
+    const timestamp = new Date(timestampSeconds * 1000);
+    const computedSignature = this.signPayload(body, { eventId, timestamp, secret: parsedSecret });
+    const expectedSignature = computedSignature.split(',')[1];
+    const passedSignatures = msgSignature.split(' ');
+    const encoder = new globalThis.TextEncoder();
+    for (const versionedSignature of passedSignatures) {
+      const [version, signature] = versionedSignature.split(',');
+      if (version !== 'v1') {
+        continue;
+      }
+      if (this.timingSafeEqual(encoder.encode(signature), encoder.encode(expectedSignature))) {
+        // valid!
+        return;
+      }
+    }
+    throw new Error('None of the given webhook signatures match the expected signature');
+  }
+}
+exports.Webhooks = Webhooks;
+//# sourceMappingURL=webhooks.js.map

package/resources/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../src/resources/webhooks.ts"],"names":[],"mappings":";AAAA,qDAAqD;;;AAErD,2DAA2D;AAC3D,mCAAoC;AACpC,mDAAkE;AAElE,MAAa,QAAS,SAAQ,sBAAW;IACvC;;OAEG;IACH,MAAM,CACJ,OAAe,EACf,OAAoB,EACpB,SAAoC,IAAI,CAAC,MAAM,CAAC,aAAa;QAE7D,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAEO,WAAW,CAAC,MAAiC;QACnD,IAAI,CAAC,MAAM,EAAE;YACX,MAAM,IAAI,KAAK,CACb,kKAAkK,CACnK,CAAC;SACH;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1C,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,MAAM,EAAE;YACrC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;SAC9C;QAED,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAEO,WAAW,CACjB,OAAe,EACf,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAA4D;QAExF,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;QAErF,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAEpB,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvC,CAAC;IAED,oDAAoD;IAC5C,MAAM,CAAC,IAAa,EAAE,GAAG,GAAG,EAAE;QACpC,IAAI,CAAC,IAAI,EAAE;YACT,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;SACtB;IACH,CAAC;IAED;qDACiD;IACzC,eAAe,CACrB,CAA+C,EAC/C,CAA+C;QAE/C,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU,EAAE;YACjC,OAAO,KAAK,CAAC;SACd;QACD,IAAI,CAAC,CAAC,CAAC,YAAY,QAAQ,CAAC,EAAE;YAC5B,CAAC,GAAG,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACxD;QACD,IAAI,CAAC,CAAC,CAAC,YAAY,QAAQ,CAAC,EAAE;YAC5B,CAAC,GAAG,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACxD;QACD,IAAI,CAAC,MAAM,CAAC,CAAC,YAAY,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,CAAC,YAAY,QAAQ,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC;QAC5B,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACX,OAAO,EAAE,CAAC,GAAG,MAAM,EAAE;YACnB,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;SACtC;QACD,OAAO,GAAG,KAAK,CAAC,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,eAAe,CACb,IAAY,EACZ,OAAoB,EACpB,SAAoC,IAAI,CAAC,MAAM,CAAC,aAAa;QAE7D,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAE9C,MAAM,OAAO,GAAG,IAAA,gBAAS,EAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,EAAE;YACZ,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;SACzD;QAED,MAAM,YAAY,GAAG,IAAA,gBAAS,EAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAC3D,IAAI,CAAC,YAAY,EAAE;YACjB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;SAC1D;QAED,MAAM,YAAY,GAAG,IAAA,gBAAS,EAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAC3D,IAAI,CAAC,YAAY,EAAE;YACjB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;SAC1D;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,KAAK,CAAC,gBAAgB,CAAC,EAAE;YAC3B,MAAM,IAAI,KAAK,CAAC,6BAA6B,YAAY,EAAE,CAAC,CAAC;SAC9D;QAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;YAC5B,MAAM,IAAI,KAAK,CACb,kGAAkG,CACnG,CAAC;SACH;QAED,MAAM,4BAA4B,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY;QACzD,IAAI,GAAG,GAAG,gBAAgB,GAAG,4BAA4B,EAAE;YACzD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;SACjD;QAED,IAAI,gBAAgB,GAAG,GAAG,GAAG,4BAA4B,EAAE;YACzD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;SACjD;QAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;QAEpD,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAC/F,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1D,MAAM,gBAAgB,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QAC7C,KAAK,MAAM,kBAAkB,IAAI,gBAAgB,EAAE;YACjD,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3D,IAAI,OAAO,KAAK,IAAI,EAAE;gBACpB,SAAS;aACV;YAED,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,EAAE;gBACtF,SAAS;gBACT,OAAO;aACR;SACF;QAED,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;CACF;AAhJD,4BAgJC"}

package/resources/webhooks.mjs

@@ -0,0 +1,114 @@
+// File generated from our OpenAPI spec by Stainless.
+import { APIResource } from '@tryfinch/finch-api/resource';
+import { createHmac } from 'crypto';
+import { getHeader } from '@tryfinch/finch-api/core';
+export class Webhooks extends APIResource {
+  /**
+   * Validates that the given payload was sent by Finch and parses the payload.
+   */
+  unwrap(payload, headers, secret = this.client.webhookSecret) {
+    this.verifySignature(payload, headers, secret);
+    return JSON.parse(payload);
+  }
+  parseSecret(secret) {
+    if (!secret) {
+      throw new Error(
+        "The webhook secret must either be set using the env var, FINCH_WEBHOOK_SECRET, on the client class, Finch({ webhook_secret: '123' }), or passed to this function",
+      );
+    }
+    const buf = Buffer.from(secret, 'base64');
+    if (buf.toString('base64') !== secret) {
+      throw new Error(`Given secret is not valid`);
+    }
+    return new Uint8Array(buf);
+  }
+  signPayload(payload, { eventId, timestamp, secret }) {
+    const encoder = new TextEncoder();
+    const toSign = encoder.encode(`${eventId}.${timestamp.getTime() / 1000}.${payload}`);
+    const hmac = createHmac('sha256', secret);
+    hmac.update(toSign);
+    return `v1,${hmac.digest('base64')}`;
+  }
+  /** Make an assertion, if not `true`, then throw. */
+  assert(expr, msg = '') {
+    if (!expr) {
+      throw new Error(msg);
+    }
+  }
+  /** Compare to array buffers or data views in a way that timing based attacks
+   * cannot gain information about the platform. */
+  timingSafeEqual(a, b) {
+    if (a.byteLength !== b.byteLength) {
+      return false;
+    }
+    if (!(a instanceof DataView)) {
+      a = new DataView(ArrayBuffer.isView(a) ? a.buffer : a);
+    }
+    if (!(b instanceof DataView)) {
+      b = new DataView(ArrayBuffer.isView(b) ? b.buffer : b);
+    }
+    this.assert(a instanceof DataView);
+    this.assert(b instanceof DataView);
+    const length = a.byteLength;
+    let out = 0;
+    let i = -1;
+    while (++i < length) {
+      out |= a.getUint8(i) ^ b.getUint8(i);
+    }
+    return out === 0;
+  }
+  /**
+   * Validates whether or not the webhook payload was sent by Finch.
+   *
+   * An error will be raised if the webhook payload was not sent by Finch.
+   */
+  verifySignature(body, headers, secret = this.client.webhookSecret) {
+    const parsedSecret = this.parseSecret(secret);
+    const eventId = getHeader(headers, 'finch-event-id');
+    if (!eventId) {
+      throw new Error('Could not find finch-event-id header');
+    }
+    const msgTimestamp = getHeader(headers, 'finch-timestamp');
+    if (!msgTimestamp) {
+      throw new Error('Could not find finch-timestamp header');
+    }
+    const msgSignature = getHeader(headers, 'finch-signature');
+    if (!msgSignature) {
+      throw new Error('Could not find finch-signature header');
+    }
+    const now = Math.floor(Date.now() / 1000);
+    const timestampSeconds = parseInt(msgTimestamp, 10);
+    if (isNaN(timestampSeconds)) {
+      throw new Error(`Invalid timestamp header: ${msgTimestamp}`);
+    }
+    if (typeof body !== 'string') {
+      throw new Error(
+        'Webhook body must be passed as the raw JSON string sent from the server (do not parse it first).',
+      );
+    }
+    const webhook_tolerance_in_seconds = 5 * 60; // 5 minutes
+    if (now - timestampSeconds > webhook_tolerance_in_seconds) {
+      throw new Error('Webhook timestamp is too old');
+    }
+    if (timestampSeconds > now + webhook_tolerance_in_seconds) {
+      throw new Error('Webhook timestamp is too new');
+    }
+    const timestamp = new Date(timestampSeconds * 1000);
+    const computedSignature = this.signPayload(body, { eventId, timestamp, secret: parsedSecret });
+    const expectedSignature = computedSignature.split(',')[1];
+    const passedSignatures = msgSignature.split(' ');
+    const encoder = new globalThis.TextEncoder();
+    for (const versionedSignature of passedSignatures) {
+      const [version, signature] = versionedSignature.split(',');
+      if (version !== 'v1') {
+        continue;
+      }
+      if (this.timingSafeEqual(encoder.encode(signature), encoder.encode(expectedSignature))) {
+        // valid!
+        return;
+      }
+    }
+    throw new Error('None of the given webhook signatures match the expected signature');
+  }
+}
+//# sourceMappingURL=webhooks.mjs.map

package/resources/webhooks.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.mjs","sourceRoot":"","sources":["../src/resources/webhooks.ts"],"names":[],"mappings":"AAAA,qDAAqD;OAE9C,EAAE,WAAW,EAAE,MAAM,8BAA8B;OACnD,EAAE,UAAU,EAAE,MAAM,QAAQ;OAC5B,EAAE,SAAS,EAAe,MAAM,0BAA0B;AAEjE,MAAM,OAAO,QAAS,SAAQ,WAAW;IACvC;;OAEG;IACH,MAAM,CACJ,OAAe,EACf,OAAoB,EACpB,SAAoC,IAAI,CAAC,MAAM,CAAC,aAAa;QAE7D,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAEO,WAAW,CAAC,MAAiC;QACnD,IAAI,CAAC,MAAM,EAAE;YACX,MAAM,IAAI,KAAK,CACb,kKAAkK,CACnK,CAAC;SACH;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1C,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,MAAM,EAAE;YACrC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;SAC9C;QAED,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAEO,WAAW,CACjB,OAAe,EACf,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAA4D;QAExF,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;QAErF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAEpB,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvC,CAAC;IAED,oDAAoD;IAC5C,MAAM,CAAC,IAAa,EAAE,GAAG,GAAG,EAAE;QACpC,IAAI,CAAC,IAAI,EAAE;YACT,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;SACtB;IACH,CAAC;IAED;qDACiD;IACzC,eAAe,CACrB,CAA+C,EAC/C,CAA+C;QAE/C,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU,EAAE;YACjC,OAAO,KAAK,CAAC;SACd;QACD,IAAI,CAAC,CAAC,CAAC,YAAY,QAAQ,CAAC,EAAE;YAC5B,CAAC,GAAG,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACxD;QACD,IAAI,CAAC,CAAC,CAAC,YAAY,QAAQ,CAAC,EAAE;YAC5B,CAAC,GAAG,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACxD;QACD,IAAI,CAAC,MAAM,CAAC,CAAC,YAAY,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,CAAC,YAAY,QAAQ,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC;QAC5B,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACX,OAAO,EAAE,CAAC,GAAG,MAAM,EAAE;YACnB,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;SACtC;QACD,OAAO,GAAG,KAAK,CAAC,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,eAAe,CACb,IAAY,EACZ,OAAoB,EACpB,SAAoC,IAAI,CAAC,MAAM,CAAC,aAAa;QAE7D,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAE9C,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,EAAE;YACZ,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;SACzD;QAED,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAC3D,IAAI,CAAC,YAAY,EAAE;YACjB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;SAC1D;QAED,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAC3D,IAAI,CAAC,YAAY,EAAE;YACjB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;SAC1D;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,KAAK,CAAC,gBAAgB,CAAC,EAAE;YAC3B,MAAM,IAAI,KAAK,CAAC,6BAA6B,YAAY,EAAE,CAAC,CAAC;SAC9D;QAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;YAC5B,MAAM,IAAI,KAAK,CACb,kGAAkG,CACnG,CAAC;SACH;QAED,MAAM,4BAA4B,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY;QACzD,IAAI,GAAG,GAAG,gBAAgB,GAAG,4BAA4B,EAAE;YACzD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;SACjD;QAED,IAAI,gBAAgB,GAAG,GAAG,GAAG,4BAA4B,EAAE;YACzD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;SACjD;QAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;QAEpD,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAC/F,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1D,MAAM,gBAAgB,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QAC7C,KAAK,MAAM,kBAAkB,IAAI,gBAAgB,EAAE;YACjD,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3D,IAAI,OAAO,KAAK,IAAI,EAAE;gBACpB,SAAS;aACV;YAED,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,EAAE;gBACtF,SAAS;gBACT,OAAO;aACR;SACF;QAED,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;CACF"}

package/src/_shims/ReadableStream.d.ts

@@ -11,7 +11,7 @@
  */
 
 // @ts-ignore
-type _ReadableStream<R = any> = unknown extends ReadableStream ? never : ReadableStream<R>;
+type _ReadableStream<R = any> = ReadableStream<R>;
 declare const _ReadableStream: {
   prototype: _ReadableStream;
   new (
@@ -26,13 +26,13 @@ declare const _ReadableStream: {
 };
 
 // @ts-ignore
-type _UnderlyingSource<R = any> = unknown extends UnderlyingSource ? never : UnderlyingSource<R>;
+type _UnderlyingSource<R = any> = UnderlyingSource<R>;
 // @ts-ignore
-type _UnderlyingByteSource = unknown extends UnderlyingByteSource ? never : UnderlyingByteSource;
+type _UnderlyingByteSource = UnderlyingByteSource;
 type _UnderlyingDefaultSource<R = any> =
   // @ts-ignore
-  unknown extends UnderlyingDefaultSource ? never : UnderlyingDefaultSource<R>;
+  UnderlyingDefaultSource<R>;
 // @ts-ignore
-type _QueuingStrategy<R = any> = unknown extends QueuingStrategy ? never : QueuingStrategy<R>;
+type _QueuingStrategy<R = any> = QueuingStrategy<R>;
 
 export { _ReadableStream as ReadableStream };

package/src/_shims/agent.ts

@@ -2,7 +2,7 @@
  * Disclaimer: modules in _shims aren't intended to be imported by SDK users.
  *
  * This is a stub for non-node environments.
- * In node environments, it gets replaced agent.node.ts by the package export map
+ * In node environments, it gets replaced agent-node.ts by the package export map
  */
 
 export type Agent = any;

package/src/_shims/{fetch.node.d.ts → fetch-node.d.ts}

@@ -17,26 +17,26 @@ import * as nf from 'node-fetch';
 // @ts-ignore
 type _fetch = unknown extends typeof fetch ? typeof nf.default : typeof fetch;
 // @ts-ignore
-type _Request = unknown extends Request ? nf.Request : Request;
+type _Request = Request;
 // @ts-ignore
-type _RequestInfo = unknown extends RequestInfo ? nf.RequestInfo : RequestInfo;
+type _RequestInfo = RequestInfo;
 // @ts-ignore
-type _RequestInit = unknown extends RequestInit ? nf.RequestInit : RequestInit;
+type _RequestInit = RequestInit;
 // @ts-ignore
-type _Response = unknown extends Response ? nf.Response : Response;
+type _Response = Response;
 // @ts-ignore
-type _ResponseInit = unknown extends ResponseInit ? nf.ResponseInit : ResponseInit;
+type _ResponseInit = ResponseInit;
 type _ResponseType =
   // @ts-ignore
   unknown extends ResponseType ? 'basic' | 'cors' | 'default' | 'error' | 'opaque' | 'opaqueredirect'
   : // @ts-ignore
     ResponseType;
 // @ts-ignore
-type _BodyInit = unknown extends BodyInit ? nf.BodyInit : BodyInit;
+type _BodyInit = BodyInit;
 // @ts-ignore
-type _Headers = unknown extends Headers ? nf.Headers : Headers;
+type _Headers = Headers;
 // @ts-ignore
-type _HeadersInit = unknown extends HeadersInit ? nf.HeadersInit : HeadersInit;
+type _HeadersInit = HeadersInit;
 
 declare const _fetch: _fetch;
 declare const _Request: {

package/src/_shims/fetch.d.ts

@@ -14,25 +14,25 @@
  */
 
 // @ts-ignore
-type _fetch = unknown extends typeof fetch ? never : typeof fetch;
+type _fetch = typeof fetch;
 // @ts-ignore
-type _Request = unknown extends Request ? never : Request;
+type _Request = Request;
 // @ts-ignore
-type _RequestInfo = unknown extends RequestInfo ? never : RequestInfo;
+type _RequestInfo = RequestInfo;
 // @ts-ignore
-type _RequestInit = unknown extends RequestInit ? never : RequestInit;
+type _RequestInit = RequestInit;
 // @ts-ignore
-type _Response = unknown extends Response ? never : Response;
+type _Response = Response;
 // @ts-ignore
-type _ResponseInit = unknown extends ResponseInit ? never : ResponseInit;
+type _ResponseInit = ResponseInit;
 // @ts-ignore
-type _ResponseType = unknown extends ResponseType ? never : ResponseType;
+type _ResponseType = ResponseType;
 // @ts-ignore
-type _BodyInit = unknown extends BodyInit ? never : BodyInit;
+type _BodyInit = BodyInit;
 // @ts-ignore
-type _Headers = unknown extends Headers ? never : Headers;
+type _Headers = Headers;
 // @ts-ignore
-type _HeadersInit = unknown extends HeadersInit ? never : HeadersInit;
+type _HeadersInit = HeadersInit;
 
 declare const _fetch: _fetch;
 declare const _Request: {

package/src/_shims/{fileFromPath.node.ts → fileFromPath-node.ts}

@@ -3,7 +3,7 @@
  */
 
 import { fileFromPath as _fileFromPath } from 'formdata-node/file-from-path';
-import type { File, FilePropertyBag } from './formdata.node.js';
+import type { File, FilePropertyBag } from './form-data-node.js';
 
 export type FileFromPathOptions = Omit<FilePropertyBag, 'lastModified'>;
 

package/src/_shims/fileFromPath.ts

@@ -1,11 +1,11 @@
 /**
  * Disclaimer: modules in _shims aren't intended to be imported by SDK users.
  *
- * This is a stub that gets replaced by fileFromPath.node.js for node environments
+ * This is a stub that gets replaced by fileFromPath-node.js for node environments
  * in the package export map
  */
 
-import type { FilePropertyBag, File } from './formdata.js';
+import type { FilePropertyBag, File } from './form-data.js';
 
 export type FileFromPathOptions = Omit<FilePropertyBag, 'lastModified'>;
 

package/src/_shims/{formdata.node.d.ts → form-data-node.d.ts}

@@ -4,7 +4,7 @@
 
 import * as fd from 'formdata-node';
 
-import type { BlobPart } from '../uploads';
+import type { BlobPart } from '../uploads.js';
 
 type EndingType = 'native' | 'transparent';
 
@@ -21,11 +21,11 @@ export interface FilePropertyBag extends BlobPropertyBag {
 // Use builtin web types if present; else formdata-node types
 
 // @ts-ignore
-type _FormData = unknown extends FormData ? fd.FormData : FormData;
+type _FormData = FormData;
 // @ts-ignore
-type _File = unknown extends File ? fd.File : File;
+type _File = File;
 // @ts-ignore
-type _Blob = unknown extends Blob ? fd.Blob : Blob;
+type _Blob = Blob;
 
 declare const _FormData: {
   new (form?: any): _FormData;

package/src/_shims/{formdata.d.ts → form-data.d.ts}

@@ -2,7 +2,7 @@
  * Disclaimer: modules in _shims aren't intended to be imported by SDK users.
  */
 
-import type { BlobPart } from '../uploads';
+import type { BlobPart } from '../uploads.js';
 
 type EndingType = 'native' | 'transparent';
 
@@ -19,11 +19,11 @@ export interface FilePropertyBag extends BlobPropertyBag {
 // add appropriate lib or types to tsconfig)
 
 // @ts-ignore
-type _FormData = unknown extends FormData ? never : FormData;
+type _FormData = FormData;
 // @ts-ignore
-type _File = unknown extends File ? never : File;
+type _File = File;
 // @ts-ignore
-type _Blob = unknown extends Blob ? never : Blob;
+type _Blob = Blob;
 
 declare const _FormData: {
   new (form?: any): _FormData;

package/src/_shims/{getMultipartRequestOptions.node.ts → getMultipartRequestOptions-node.ts}

@@ -2,11 +2,11 @@
  * Disclaimer: modules in _shims aren't intended to be imported by SDK users.
  */
 
-import { FormData } from './formdata.node.js';
-import type { RequestOptions } from '../core';
+import { FormData } from './form-data-node.js';
+import type { RequestOptions } from '../core.js';
 import { Readable } from 'node:stream';
 import { FormDataEncoder } from 'form-data-encoder';
-import { MultipartBody } from '../uploads';
+import { MultipartBody } from '../uploads.js';
 
 export async function getMultipartRequestOptions<T extends {} = Record<string, unknown>>(
   form: FormData,

package/src/_shims/getMultipartRequestOptions.ts

@@ -2,9 +2,9 @@
  * Disclaimer: modules in _shims aren't intended to be imported by SDK users.
  */
 
-import { FormData } from './formdata.js';
-import type { RequestOptions } from '../core';
-import { MultipartBody } from '../uploads';
+import { FormData } from './form-data.js';
+import type { RequestOptions } from '../core.js';
+import { MultipartBody } from '../uploads.js';
 
 export async function getMultipartRequestOptions<T extends {} = Record<string, unknown>>(
   form: FormData,

package/src/core.ts

@@ -1,7 +1,7 @@
-import { VERSION } from './version';
-import { APIError, APIConnectionError, APIConnectionTimeoutError, APIUserAbortError } from './error';
-import type { Readable } from './_shims/node-readable';
-import { getDefaultAgent, type Agent } from './_shims/agent';
+import { VERSION } from './version.js';
+import { APIError, APIConnectionError, APIConnectionTimeoutError, APIUserAbortError } from './error.js';
+import type { Readable } from './_shims/node-readable.js';
+import { getDefaultAgent, type Agent } from './_shims/agent.js';
 import {
   fetch,
   isPolyfilled as fetchIsPolyfilled,
@@ -11,13 +11,13 @@ import {
   type HeadersInit,
 } from './_shims/fetch.js';
 export { type Response };
-import { isMultipartBody } from './uploads';
+import { isMultipartBody } from './uploads.js';
 export {
   maybeMultipartFormRequestOptions,
   multipartFormRequestOptions,
   createForm,
   type Uploadable,
-} from './uploads';
+} from './uploads.js';
 
 const MAX_RETRIES = 2;
 
@@ -45,7 +45,7 @@ async function defaultParseResponse<T>(props: APIResponseProps): Promise<T> {
   // TODO handle blob, arraybuffer, other content types, etc.
   const text = await response.text();
   debug('response', response.status, response.url, response.headers, text);
-  return text as T;
+  return text as any as T;
 }
 
 /**
@@ -306,7 +306,8 @@ export abstract class APIClient {
   protected parseHeaders(headers: HeadersInit | null | undefined): Record<string, string> {
     return (
       !headers ? {}
-      : Symbol.iterator in headers ? Object.fromEntries(Array.from(headers).map((header) => [...header]))
+      : Symbol.iterator in headers ?
+        Object.fromEntries(Array.from(headers as Iterable<string[]>).map((header) => [...header]))
       : { ...headers }
     );
   }
@@ -390,7 +391,7 @@ export abstract class APIClient {
     return new PagePromise<PageClass, Item>(this, request, Page);
   }
 
-  buildURL<Req>(path: string, query: Req | undefined): string {
+  buildURL<Req extends Record<string, unknown>>(path: string, query: Req | null | undefined): string {
     const url =
       isAbsoluteURL(path) ?
         new URL(path)
@@ -893,7 +894,7 @@ const isAbsoluteURL = (url: string): boolean => {
   return startsWithSchemeRegexp.test(url);
 };
 
-const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
+export const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
 
 const validatePositiveInteger = (name: string, n: unknown): number => {
   if (typeof n !== 'number' || !Number.isInteger(n)) {

package/src/error.ts

@@ -1,6 +1,6 @@
 // File generated from our OpenAPI spec by Stainless.
 
-import { castToError, Headers } from './core';
+import { castToError, Headers } from './core.js';
 
 export class APIError extends Error {
   readonly status: number | undefined;
@@ -97,8 +97,8 @@ export class APIConnectionError extends APIError {
 }
 
 export class APIConnectionTimeoutError extends APIConnectionError {
-  constructor() {
-    super({ message: 'Request timed out.' });
+  constructor({ message }: { message?: string } = {}) {
+    super({ message: message ?? 'Request timed out.' });
   }
 }
 

package/src/index.ts

@@ -1,11 +1,11 @@
 // File generated from our OpenAPI spec by Stainless.
 
-import * as Core from './core';
-import * as Pagination from './pagination';
-import * as API from './resources/index';
-import * as Errors from './error';
-import type { Agent } from './_shims/agent';
-import * as Uploads from './uploads';
+import * as Core from './core.js';
+import * as Pagination from './pagination.js';
+import * as API from './resources/index.js';
+import * as Errors from './error.js';
+import type { Agent } from './_shims/agent.js';
+import * as Uploads from './uploads.js';
 
 export interface ClientOptions {
   /**
@@ -70,6 +70,8 @@ export interface ClientOptions {
   clientId?: string | null;
 
   clientSecret?: string | null;
+
+  webhookSecret?: string | null;
 }
 
 /** API Client for interfacing with the Finch API. */
@@ -77,6 +79,7 @@ export class Finch extends Core.APIClient {
   accessToken: string | null;
   clientId?: string | null;
   clientSecret?: string | null;
+  webhookSecret?: string | null;
 
   private _options: ClientOptions;
 
@@ -93,19 +96,22 @@ export class Finch extends Core.APIClient {
    * @param {Core.DefaultQuery} opts.defaultQuery - Default query parameters to include with every request to the API.
    * @param {string | null} [opts.clientId]
    * @param {string | null} [opts.clientSecret]
+   * @param {string | null} [opts.webhookSecret]
    */
   constructor({
     accessToken = null,
     clientId = Core.readEnv('FINCH_CLIENT_ID') ?? null,
     clientSecret = Core.readEnv('FINCH_CLIENT_SECRET') ?? null,
+    webhookSecret = Core.readEnv('FINCH_WEBHOOK_SECRET') ?? null,
     ...opts
   }: ClientOptions = {}) {
     const options: ClientOptions = {
       accessToken,
       clientId,
       clientSecret,
-      baseURL: `https://api.tryfinch.com`,
+      webhookSecret,
       ...opts,
+      baseURL: opts.baseURL ?? `https://api.tryfinch.com`,
     };
 
     super({
@@ -120,12 +126,14 @@ export class Finch extends Core.APIClient {
     this.accessToken = accessToken;
     this.clientId = clientId;
     this.clientSecret = clientSecret;
+    this.webhookSecret = webhookSecret;
   }
 
   hris: API.HRIS = new API.HRIS(this);
   ats: API.ATS = new API.ATS(this);
   providers: API.Providers = new API.Providers(this);
   account: API.Account = new API.Account(this);
+  webhooks: API.Webhooks = new API.Webhooks(this);
 
   /**
    * Returns an access token for the Finch API given an authorization code. An
@@ -293,6 +301,8 @@ export namespace Finch {
   export import Account = API.Account;
   export import DisconnectResponse = API.DisconnectResponse;
   export import Introspection = API.Introspection;
+
+  export import Webhooks = API.Webhooks;
 }
 
 export default Finch;

package/src/pagination.ts

@@ -1,8 +1,8 @@
 // File generated from our OpenAPI spec by Stainless.
 
-import { AbstractPage, Response, APIClient, FinalRequestOptions, PageInfo } from './core';
-import * as HRIS from './resources/hris/index';
-import * as ATS from './resources/ats/index';
+import { AbstractPage, Response, APIClient, FinalRequestOptions, PageInfo } from './core.js';
+import * as HRIS from './resources/hris/index.js';
+import * as ATS from './resources/ats/index.js';
 
 export type SinglePageResponse<Item> = Item[];
 

package/src/resource.ts

@@ -1,6 +1,6 @@
 // File generated from our OpenAPI spec by Stainless.
 
-import type { Finch } from './index';
+import type { Finch } from './index.js';
 
 export class APIResource {
   protected client: Finch;