@websitescreenshotworld/sdk 0.0.0-stage → 0.1.0

package/dist/esm/transport.d.ts

@@ -0,0 +1,55 @@
+/** Options every call accepts as its last argument. */
+export interface RequestOptions {
+    /**
+     * Milliseconds the call may take, retries and the waits between them included. Defaults to the
+     * client's `captureTimeout` for captures and `timeout` for everything else.
+     */
+    timeout?: number;
+    /**
+     * Stops the call, and any retry it would make, as soon as it aborts; the call then rejects with
+     * the signal's reason. Once a file has started to arrive, cancel its stream instead.
+     */
+    signal?: AbortSignal;
+}
+/** Options the capture calls accept as their last argument. */
+export interface CaptureRequestOptions extends RequestOptions {
+    /**
+     * Makes the capture safe to repeat within 24 hours. A random UUID is used when none is given;
+     * either way, every retry of this call sends the same key.
+     */
+    idempotencyKey?: string;
+}
+export interface TransportOptions {
+    /** Looked up on each request when left out, so a global fetch replaced later is used. */
+    fetch: typeof fetch | undefined;
+    maxRetries: number;
+    userAgent: string;
+}
+/** One API call, which may take several attempts. */
+export interface Call {
+    method: "GET" | "POST";
+    url: string;
+    /** Left out for the one endpoint that needs no key. */
+    apiKey?: string;
+    /** A JSON body; left out for calls without one. */
+    body?: unknown;
+    idempotencyKey?: string;
+    /** The answer is a file rather than JSON. */
+    file?: boolean;
+    timeout: number;
+    signal?: AbortSignal | undefined;
+}
+/** Sends calls with the shared headers, timeouts and retries. */
+export declare class Transport {
+    #private;
+    constructor(options: TransportOptions);
+    /** Makes the call and parses its JSON answer. */
+    json(call: Call): Promise<unknown>;
+    /** Makes the call and returns the answer as soon as its headers arrive, with the body unread. */
+    file(call: Call): Promise<Response>;
+}
+/**
+ * How long to wait before the next attempt: the API's hint when it gave one, capped at a minute,
+ * otherwise a short backoff with jitter so that clients refused together do not return together.
+ */
+export declare function retryDelay(retryAfterSeconds: number | null, attempt: number): number;

package/dist/esm/transport.js

@@ -0,0 +1,201 @@
+import { FALLBACK_CODE_BY_STATUS, FALLBACK_CODE_FOR_OTHER_STATUS, RETRYABLE_CODES, } from "./error-codes.js";
+import { ConnectionError, WebsiteScreenshotWorldError, errorFor, } from "./errors.js";
+const MAX_RETRY_AFTER_SECONDS = 60;
+const BACKOFF_MS = [500, 1000];
+const JITTER = 0.25;
+// setTimeout fires at once for anything longer, so such a timeout means "no timeout".
+const MAX_TIMER_MS = 2 ** 31 - 1;
+/** Sends calls with the shared headers, timeouts and retries. */
+export class Transport {
+    #options;
+    constructor(options) {
+        this.#options = options;
+    }
+    /** Makes the call and parses its JSON answer. */
+    json(call) {
+        return this.#send(call, async (response) => {
+            const text = await response.text();
+            try {
+                return JSON.parse(text);
+            }
+            catch (cause) {
+                throw new WebsiteScreenshotWorldError("The API answered with a body that is not JSON.", { httpStatus: response.status, rawBody: text, cause });
+            }
+        });
+    }
+    /** Makes the call and returns the answer as soon as its headers arrive, with the body unread. */
+    file(call) {
+        return this.#send(call, (response) => Promise.resolve(response));
+    }
+    async #send(call, read) {
+        const deadline = new Deadline(call.timeout, call.signal);
+        try {
+            const init = this.#requestInit(call, deadline.signal);
+            for (let attempt = 0;; attempt++) {
+                const outcome = await this.#attempt(call.url, init, read, deadline);
+                if (outcome.done)
+                    return outcome.value;
+                const delay = retryDelay(outcome.error.retryAfterSeconds, attempt);
+                const retry = outcome.retryable &&
+                    attempt < this.#options.maxRetries &&
+                    deadline.allows(delay);
+                if (!retry)
+                    throw outcome.error;
+                await deadline.sleep(delay);
+            }
+        }
+        finally {
+            deadline.end();
+        }
+    }
+    async #attempt(url, init, read, deadline) {
+        try {
+            const fetch = this.#options.fetch ?? globalThis.fetch;
+            const response = await fetch(url, init);
+            if (response.ok)
+                return { done: true, value: await read(response) };
+            const error = await refusalFrom(response);
+            return {
+                done: false,
+                error,
+                retryable: RETRYABLE_CODES.has(error.errorCode ?? ""),
+            };
+        }
+        catch (cause) {
+            deadline.throwIfStopped();
+            if (cause instanceof WebsiteScreenshotWorldError)
+                throw cause;
+            const error = new ConnectionError(`The request to ${new URL(url).origin} failed before an answer came back.`, { cause });
+            return { done: false, error, retryable: true };
+        }
+    }
+    #requestInit(call, signal) {
+        const headers = {
+            "User-Agent": this.#options.userAgent,
+        };
+        if (call.apiKey !== undefined)
+            headers["X-Api-Key"] = call.apiKey;
+        if (call.file !== true)
+            headers.Accept = "application/json";
+        if (call.body !== undefined)
+            headers["Content-Type"] = "application/json";
+        if (call.idempotencyKey !== undefined) {
+            headers["Idempotency-Key"] = call.idempotencyKey;
+        }
+        /* Redirects are never followed (code-review plan 7.4, 28 Oct 2026): fetch would send the
+           X-Api-Key to wherever a 3xx pointed. The API never redirects, and neither does the download
+           link, so a 3xx is answered as the refusal it is - "manual", not "error", which would surface
+           as a ConnectionError and be retried. */
+        const init = {
+            method: call.method,
+            headers,
+            signal,
+            redirect: "manual",
+        };
+        if (call.body !== undefined)
+            init.body = JSON.stringify(call.body);
+        return init;
+    }
+}
+/**
+ * How long to wait before the next attempt: the API's hint when it gave one, capped at a minute,
+ * otherwise a short backoff with jitter so that clients refused together do not return together.
+ */
+export function retryDelay(retryAfterSeconds, attempt) {
+    if (retryAfterSeconds !== null) {
+        return Math.min(retryAfterSeconds, MAX_RETRY_AFTER_SECONDS) * 1000;
+    }
+    const base = BACKOFF_MS[Math.min(attempt, BACKOFF_MS.length - 1)] ?? 1000;
+    return base * (1 + Math.random() * JITTER);
+}
+async function refusalFrom(response) {
+    const rawBody = await response.text();
+    const body = errorBodyFrom(rawBody);
+    const errorCode = body?.error_code ??
+        FALLBACK_CODE_BY_STATUS[response.status] ??
+        FALLBACK_CODE_FOR_OTHER_STATUS;
+    const message = typeof body?.error_message === "string"
+        ? body.error_message
+        : `The API answered with HTTP ${String(response.status)} and no error details.`;
+    const retryAfterSeconds = typeof body?.retry_after_seconds === "number"
+        ? body.retry_after_seconds
+        : retryAfterHeader(response.headers);
+    return errorFor(errorCode, message, {
+        httpStatus: response.status,
+        retryAfterSeconds,
+        rawBody,
+    });
+}
+function errorBodyFrom(text) {
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    const isErrorBody = typeof value === "object" &&
+        value !== null &&
+        typeof value.error_code === "string";
+    return isErrorBody ? value : null;
+}
+function retryAfterHeader(headers) {
+    const value = headers.get("retry-after")?.trim();
+    return value !== undefined && /^\d+$/.test(value) ? Number(value) : null;
+}
+/** Ends a call when its timeout passes or the caller's signal aborts, whichever comes first. */
+class Deadline {
+    #controller = new AbortController();
+    #expiresAt;
+    #timer;
+    #callerSignal;
+    #onCallerAbort = () => {
+        this.#controller.abort(this.#callerSignal?.reason);
+    };
+    constructor(timeout, callerSignal) {
+        callerSignal?.throwIfAborted();
+        this.#callerSignal = callerSignal;
+        this.#expiresAt = performance.now() + timeout;
+        callerSignal?.addEventListener("abort", this.#onCallerAbort, {
+            once: true,
+        });
+        if (timeout <= MAX_TIMER_MS) {
+            this.#timer = setTimeout(() => {
+                this.#controller.abort(new ConnectionError(`The call did not finish within ${String(timeout / 1000)} seconds.`));
+            }, timeout);
+        }
+    }
+    get signal() {
+        return this.#controller.signal;
+    }
+    /** Whether waiting `milliseconds` still leaves time for another attempt. */
+    allows(milliseconds) {
+        return performance.now() + milliseconds < this.#expiresAt;
+    }
+    /** Throws the reason the call was stopped, if it was. */
+    throwIfStopped() {
+        this.#controller.signal.throwIfAborted();
+    }
+    sleep(milliseconds) {
+        const signal = this.#controller.signal;
+        return new Promise((resolve, reject) => {
+            if (signal.aborted) {
+                reject(signal.reason);
+                return;
+            }
+            const onAbort = () => {
+                clearTimeout(timer);
+                reject(signal.reason);
+            };
+            const timer = setTimeout(() => {
+                signal.removeEventListener("abort", onAbort);
+                resolve();
+            }, milliseconds);
+            signal.addEventListener("abort", onAbort, { once: true });
+        });
+    }
+    end() {
+        clearTimeout(this.#timer);
+        this.#callerSignal?.removeEventListener("abort", this.#onCallerAbort);
+    }
+}

package/dist/esm/version.d.ts

@@ -0,0 +1,2 @@
+/** The version of this library. Kept equal to `version` in package.json. */
+export declare const VERSION = "0.1.0";

package/dist/esm/version.js

@@ -0,0 +1,2 @@
+/** The version of this library. Kept equal to `version` in package.json. */
+export const VERSION = "0.1.0";

package/dist/esm/webhooks/events.d.ts

@@ -0,0 +1,128 @@
+import type { CaptureFields, PageSource, S3Delivery } from "../models/capture.js";
+import type { CaptureFormat, MediaCategory, PageSourceFormat, Product } from "../models/tokens.js";
+/** The event types this version knows. */
+export declare const WebhookEventType: {
+    readonly CaptureSucceeded: "capture.succeeded";
+    readonly CaptureFailed: "capture.failed";
+    readonly DeliveryCompleted: "delivery.completed";
+    readonly CaptureChanged: "capture.changed";
+    readonly SchedulePaused: "schedule.paused";
+    readonly SitemapRunCompleted: "sitemap_run.completed";
+    readonly Ping: "ping";
+};
+export type WebhookEventType = (typeof WebhookEventType)[keyof typeof WebhookEventType];
+interface EventEnvelope<Type extends string, EventProduct, Data> {
+    /** The delivery id; the same on every retry of this delivery. */
+    id: string;
+    type: Type;
+    createdAt: Date;
+    product: EventProduct;
+    data: Data;
+}
+/** An Instant Snap capture as its webhook carries it: no download links or access key. */
+export interface InstantSnapCaptureData extends CaptureFields {
+    pageSource: Omit<PageSource, "downloadUrl"> | null;
+    s3Delivery: Omit<S3Delivery, "accessKeyId"> | null;
+}
+/** A scheduled web page's capture. */
+export interface ScheduledCapture {
+    id: string;
+    /** The web page's id; `autoSchedule.triggerNow` calls it `webPageId`. */
+    scheduleId: string;
+    scheduleName: string;
+    url: string;
+    status: string;
+    mediaCategory: MediaCategory;
+    format: CaptureFormat | null;
+    pageHttpStatus: number | null;
+    capturedAt: Date | null;
+    finalUrl: string | null;
+    mediaSha256: string | null;
+    pageSource: {
+        format: PageSourceFormat;
+        sha256: string | null;
+    } | null;
+    /** Set when the capture was part of a sitemap run. */
+    sitemapRunId: string | null;
+}
+/** One place a scheduled capture was delivered to. */
+export interface Destination {
+    slot: number;
+    name: string;
+    provider: string;
+    status: string;
+    completedAt: Date | null;
+}
+export interface DeliveryCompletedData extends ScheduledCapture {
+    destinations: Destination[];
+}
+export interface CaptureChangedData extends ScheduledCapture {
+    /** How much of the image changed since the capture it was compared with. */
+    changePercent: number | null;
+    comparedToCaptureId: string | null;
+    changeImageAvailable: boolean;
+}
+export interface SchedulePausedData {
+    scheduleId: string;
+    scheduleName: string;
+    url: string;
+    /** Why the schedule stopped, such as `quota_exhausted`. */
+    reason: string;
+    pausedAt: Date | null;
+}
+export interface SitemapRunCompletedData {
+    sitemapRunId: string;
+    scheduleId: string;
+    scheduleName: string;
+    sitemapUrl: string;
+    status: string;
+    runAt: Date | null;
+    completedAt: Date | null;
+    pagesListed: number | null;
+    pagesMatched: number | null;
+    pagesQueued: number | null;
+    pagesSucceeded: number | null;
+    pagesFailed: number | null;
+    pagesOverLimit: number | null;
+    pagesOverQuota: number | null;
+    message: string | null;
+}
+export interface PingData {
+    endpointId: string;
+    endpointName: string;
+    message: string;
+    sentAt: Date | null;
+}
+type CaptureOutcome = "capture.succeeded" | "capture.failed";
+/** An Instant Snap capture finished. */
+export type InstantSnapCaptureEvent = EventEnvelope<CaptureOutcome, "instant_snap", InstantSnapCaptureData>;
+/** A scheduled web page's capture finished. */
+export type AutoScheduleCaptureEvent = EventEnvelope<CaptureOutcome, "auto_schedule", ScheduledCapture>;
+/** A scheduled capture reached all of its destinations. */
+export type DeliveryCompletedEvent = EventEnvelope<"delivery.completed", "auto_schedule", DeliveryCompletedData>;
+/** A scheduled capture differs from the one before it. */
+export type CaptureChangedEvent = EventEnvelope<"capture.changed", "auto_schedule", CaptureChangedData>;
+/** A schedule stopped running. */
+export type SchedulePausedEvent = EventEnvelope<"schedule.paused", "auto_schedule", SchedulePausedData>;
+/** Every page of a sitemap run has been captured or skipped. */
+export type SitemapRunCompletedEvent = EventEnvelope<"sitemap_run.completed", "auto_schedule", SitemapRunCompletedData>;
+/** A test delivery sent from the dashboard, by either product. */
+export type PingEvent = EventEnvelope<"ping", Product, PingData>;
+/**
+ * An event type this version does not know yet, with its payload as sent in `rawData`.
+ *
+ * Its `data` is never set: that keeps `event.data` precisely typed after `switch (event.type)`
+ * narrows to a known type, since TypeScript cannot exclude one string from a `string` type.
+ */
+export interface UnknownWebhookEvent {
+    id: string;
+    type: string;
+    createdAt: Date;
+    product: string;
+    data: never;
+    /** The event's `data` exactly as sent, with snake_case keys. */
+    rawData: Record<string, unknown>;
+}
+/** Every event `Webhook.verify` returns, told apart by `type` and, for captures, `product`. */
+export type WebhookEvent = InstantSnapCaptureEvent | AutoScheduleCaptureEvent | DeliveryCompletedEvent | CaptureChangedEvent | SchedulePausedEvent | SitemapRunCompletedEvent | PingEvent | UnknownWebhookEvent;
+export {};

package/dist/esm/webhooks/events.js

@@ -0,0 +1,10 @@
+/** The event types this version knows. */
+export const WebhookEventType = {
+    CaptureSucceeded: "capture.succeeded",
+    CaptureFailed: "capture.failed",
+    DeliveryCompleted: "delivery.completed",
+    CaptureChanged: "capture.changed",
+    SchedulePaused: "schedule.paused",
+    SitemapRunCompleted: "sitemap_run.completed",
+    Ping: "ping",
+};

package/dist/esm/webhooks/parse-event.d.ts

@@ -0,0 +1,10 @@
+import type { WebhookEvent } from "./events.js";
+export interface WireEnvelope {
+    id: string;
+    type: string;
+    created_at: string;
+    product: string;
+    data: unknown;
+}
+/** Turns a verified webhook body into its typed event. */
+export declare function parseEvent(wire: WireEnvelope): WebhookEvent;

package/dist/esm/webhooks/parse-event.js

@@ -0,0 +1,146 @@
+import { parseCaptureFields, parsePageSourceFields, parseS3DeliveryFields, } from "../models/capture.js";
+import { parseDate } from "../wire.js";
+/** Turns a verified webhook body into its typed event. */
+export function parseEvent(wire) {
+    const { type, product, data } = wire;
+    const envelope = { id: wire.id, createdAt: parseDate(wire.created_at) };
+    if (type === "capture.succeeded" || type === "capture.failed") {
+        if (product === "instant_snap") {
+            const capture = instantSnapCapture(data);
+            return { ...envelope, type, product, data: capture };
+        }
+        if (product === "auto_schedule") {
+            const capture = scheduledCapture(data);
+            return { ...envelope, type, product, data: capture };
+        }
+    }
+    switch (type) {
+        case "delivery.completed":
+            return {
+                ...envelope,
+                type,
+                product: "auto_schedule",
+                data: deliveryCompleted(data),
+            };
+        case "capture.changed":
+            return {
+                ...envelope,
+                type,
+                product: "auto_schedule",
+                data: captureChanged(data),
+            };
+        case "schedule.paused":
+            return {
+                ...envelope,
+                type,
+                product: "auto_schedule",
+                data: schedulePaused(data),
+            };
+        case "sitemap_run.completed":
+            return {
+                ...envelope,
+                type,
+                product: "auto_schedule",
+                data: sitemapRunCompleted(data),
+            };
+        case "ping":
+            return { ...envelope, type, product, data: ping(data) };
+        default:
+            // Includes a known capture type from a product this version does not know.
+            return {
+                ...envelope,
+                type,
+                product,
+                rawData: data,
+            };
+    }
+}
+function instantSnapCapture(wire) {
+    return {
+        ...parseCaptureFields(wire),
+        pageSource: wire.page_source
+            ? parsePageSourceFields(wire.page_source)
+            : null,
+        s3Delivery: wire.s3_delivery
+            ? parseS3DeliveryFields(wire.s3_delivery)
+            : null,
+    };
+}
+function scheduledCapture(wire) {
+    return {
+        id: wire.id,
+        scheduleId: wire.schedule_id,
+        scheduleName: wire.schedule_name,
+        url: wire.url,
+        status: wire.status,
+        mediaCategory: wire.media_category,
+        format: wire.format ?? null,
+        pageHttpStatus: wire.page_http_status ?? null,
+        capturedAt: parseDate(wire.captured_at),
+        finalUrl: wire.final_url ?? null,
+        mediaSha256: wire.media_sha256 ?? null,
+        pageSource: wire.page_source
+            ? {
+                format: wire.page_source.format,
+                sha256: wire.page_source.sha256 ?? null,
+            }
+            : null,
+        sitemapRunId: wire.sitemap_run_id ?? null,
+    };
+}
+function deliveryCompleted(wire) {
+    return {
+        ...scheduledCapture(wire),
+        destinations: (wire.destinations ?? []).map((destination) => ({
+            slot: destination.slot,
+            name: destination.name,
+            provider: destination.provider,
+            status: destination.status,
+            completedAt: parseDate(destination.completed_at),
+        })),
+    };
+}
+function captureChanged(wire) {
+    return {
+        ...scheduledCapture(wire),
+        changePercent: wire.change_percent ?? null,
+        comparedToCaptureId: wire.compared_to_capture_id ?? null,
+        changeImageAvailable: wire.change_image_available ?? false,
+    };
+}
+function schedulePaused(wire) {
+    return {
+        scheduleId: wire.schedule_id,
+        scheduleName: wire.schedule_name,
+        url: wire.url,
+        reason: wire.reason,
+        pausedAt: parseDate(wire.paused_at),
+    };
+}
+function sitemapRunCompleted(wire) {
+    return {
+        sitemapRunId: wire.sitemap_run_id,
+        scheduleId: wire.schedule_id,
+        scheduleName: wire.schedule_name,
+        sitemapUrl: wire.sitemap_url,
+        status: wire.status,
+        runAt: parseDate(wire.run_at),
+        completedAt: parseDate(wire.completed_at),
+        pagesListed: wire.pages_listed ?? null,
+        pagesMatched: wire.pages_matched ?? null,
+        pagesQueued: wire.pages_queued ?? null,
+        pagesSucceeded: wire.pages_succeeded ?? null,
+        pagesFailed: wire.pages_failed ?? null,
+        pagesOverLimit: wire.pages_over_limit ?? null,
+        pagesOverQuota: wire.pages_over_quota ?? null,
+        message: wire.message ?? null,
+    };
+}
+function ping(wire) {
+    return {
+        endpointId: wire.endpoint_id,
+        endpointName: wire.endpoint_name,
+        message: wire.message,
+        sentAt: parseDate(wire.sent_at),
+    };
+}

package/dist/esm/webhooks/webhook.d.ts

@@ -0,0 +1,26 @@
+import type { WebhookEvent } from "./events.js";
+/** Options for {@link Webhook.verify}. */
+export interface VerifyOptions {
+    /** How far the signature's timestamp may be from now, in seconds. Default 300. */
+    tolerance?: number;
+    /** The time to check the timestamp against. Defaults to the current time. */
+    now?: Date;
+}
+/**
+ * Checks a webhook delivery's `X-WSW-Signature` header against its raw body and returns the event.
+ *
+ * Pass the body exactly as received. A framework that parses the JSON and serialises it again
+ * changes the bytes, and the signature no longer matches.
+ *
+ * @param payload - The raw request body.
+ * @param signatureHeader - The `X-WSW-Signature` header.
+ * @param secret - The endpoint's signing secret, starting `whsec_`.
+ * @throws {@link SignatureVerificationError} when the header is missing or malformed, the timestamp
+ * is outside the tolerance, or no signature matches.
+ */
+declare function verify(payload: string | Uint8Array, signatureHeader: string | readonly string[] | null | undefined, secret: string, options?: VerifyOptions): WebhookEvent;
+/** Verifies webhook deliveries from both products. */
+export declare const Webhook: {
+    readonly verify: typeof verify;
+};
+export {};

package/dist/esm/webhooks/webhook.js

@@ -0,0 +1,75 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { SignatureVerificationError, WebsiteScreenshotWorldError, } from "../errors.js";
+import { parseEvent } from "./parse-event.js";
+const DEFAULT_TOLERANCE_SECONDS = 300;
+const SIGNATURE_HEX = /^[0-9a-f]{64}$/;
+/**
+ * Checks a webhook delivery's `X-WSW-Signature` header against its raw body and returns the event.
+ *
+ * Pass the body exactly as received. A framework that parses the JSON and serialises it again
+ * changes the bytes, and the signature no longer matches.
+ *
+ * @param payload - The raw request body.
+ * @param signatureHeader - The `X-WSW-Signature` header.
+ * @param secret - The endpoint's signing secret, starting `whsec_`.
+ * @throws {@link SignatureVerificationError} when the header is missing or malformed, the timestamp
+ * is outside the tolerance, or no signature matches.
+ */
+function verify(payload, signatureHeader, secret, options = {}) {
+    const header = parseSignatureHeader(typeof signatureHeader === "string"
+        ? signatureHeader
+        : (signatureHeader ?? []).join(","));
+    if (header.timestamp === null) {
+        throw new SignatureVerificationError("The signature header has no valid timestamp.");
+    }
+    if (header.signatures.length === 0) {
+        throw new SignatureVerificationError("The signature header has no v1 signature.");
+    }
+    const tolerance = options.tolerance ?? DEFAULT_TOLERANCE_SECONDS;
+    const now = Math.floor((options.now ?? new Date()).getTime() / 1000);
+    if (Math.abs(now - header.timestamp) > tolerance) {
+        throw new SignatureVerificationError("The signature's timestamp is outside the tolerance.");
+    }
+    const body = typeof payload === "string" ? Buffer.from(payload, "utf8") : payload;
+    const expected = Buffer.from(createHmac("sha256", Buffer.from(secret, "utf8"))
+        .update(`${String(header.timestamp)}.`, "utf8")
+        .update(body)
+        .digest("hex"), "utf8");
+    const matches = header.signatures.some((signature) => timingSafeEqual(expected, Buffer.from(signature, "utf8")));
+    if (!matches) {
+        throw new SignatureVerificationError("No signature in the header matches the body.");
+    }
+    return parseEvent(parseBody(new TextDecoder().decode(body)));
+}
+function parseSignatureHeader(value) {
+    const header = { timestamp: null, signatures: [] };
+    let sawTimestamp = false;
+    for (const part of value.split(",")) {
+        const separator = part.indexOf("=");
+        if (separator === -1)
+            continue;
+        const name = part.slice(0, separator).trim();
+        const content = part.slice(separator + 1).trim();
+        if (name === "t" && !sawTimestamp) {
+            sawTimestamp = true;
+            header.timestamp = /^\d+$/.test(content) ? Number(content) : null;
+        }
+        else if (name === "v1") {
+            const signature = content.toLowerCase();
+            // A value that cannot be a digest is skipped so the comparison always sees equal lengths.
+            if (SIGNATURE_HEX.test(signature))
+                header.signatures.push(signature);
+        }
+    }
+    return header;
+}
+function parseBody(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch (cause) {
+        throw new WebsiteScreenshotWorldError("The webhook body is signed but is not JSON.", { cause });
+    }
+}
+/** Verifies webhook deliveries from both products. */
+export const Webhook = { verify };

package/dist/esm/wire.d.ts

@@ -0,0 +1,15 @@
+/** A JSON object as the API sends or receives it, with snake_case keys. */
+export type WireObject = Record<string, unknown>;
+/**
+ * Turns camelCase options into the API's snake_case body. Options left `undefined` or `null` are not
+ * sent; `false`, `0` and `""` are.
+ */
+export declare function toWire(options: object): WireObject;
+/** Re-cases the keys of an object the library does not model field by field. */
+export declare function camelCaseKeys(value: unknown): unknown;
+/**
+ * Parses an ISO 8601 date-time with any number of fraction digits and either `Z` or an offset.
+ * Returns `null` for `null` or a missing value.
+ */
+export declare function parseDate(value: string): Date;
+export declare function parseDate(value: string | null | undefined): Date | null;