@whooshbang/sdk 1.0.0-rc.14

package/dist/machine.js

@@ -0,0 +1,29 @@
+import { createMachineCredentialMaterial, validateRegisterMachineCredentialRequest, } from "@whooshbang/contracts";
+import { WhooshBangValidationError } from "./errors.js";
+/**
+ * Generates C0-03 machine credential material with secure randomness.
+ *
+ * The secret is 256 random bits from Web Crypto and the registration carries
+ * only its SHA-256 digest, so registering a credential discloses nothing that
+ * could authenticate as it. Hand `bearerToken` straight to a
+ * `WhooshBangClient` as its `credential` and keep it out of logs, files, and
+ * error messages.
+ */
+export async function createMachineCredential(crypto) {
+    const material = await createMachineCredentialMaterial(crypto);
+    const registration = {
+        credential_id: material.registration.credential_id,
+        secret_sha256: material.registration.secret_sha256,
+    };
+    if (!validateRegisterMachineCredentialRequest(registration)) {
+        throw new WhooshBangValidationError("createMachineCredential", [
+            { code: "contract_mismatch", path: "registration" },
+        ]);
+    }
+    return {
+        bearerToken: material.bearerToken,
+        credentialId: material.credentialId,
+        registration,
+    };
+}
+//# sourceMappingURL=machine.js.map

package/dist/machine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine.js","sourceRoot":"","sources":["../src/machine.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,wCAAwC,GACzC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AA0BxD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAgC;IAEhC,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG;QACnB,aAAa,EAAE,QAAQ,CAAC,YAAY,CAAC,aAAa;QAClD,aAAa,EAAE,QAAQ,CAAC,YAAY,CAAC,aAAa;KACnD,CAAC;IACF,IAAI,CAAC,wCAAwC,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,yBAAyB,CAAC,yBAAyB,EAAE;YAC7D,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/webhooks.d.ts

@@ -0,0 +1,29 @@
+import { verifyWebhookSignature } from "@whooshbang/contracts";
+import type { VerifyWebhookSignatureOptions, WebhookVerificationFailureReason, WhooshBangEventV1ContractDocument } from "@whooshbang/contracts";
+export interface VerifiedWhooshBangEvent {
+    readonly attempt: number;
+    readonly event: WhooshBangEventV1ContractDocument;
+    readonly eventId: string;
+    readonly timestamp: number;
+    readonly verified: true;
+}
+export interface RejectedWhooshBangEvent {
+    readonly reason: WebhookVerificationFailureReason | "event_contract_mismatch" | "event_id_mismatch";
+    readonly verified: false;
+}
+export type WhooshBangEventVerification = RejectedWhooshBangEvent | VerifiedWhooshBangEvent;
+/**
+ * Verifies a signed customer event and returns its typed body.
+ *
+ * `rawBody` must be the exact bytes the receiver read from the wire. Framework
+ * re-serialization changes the signed input and is the usual cause of a
+ * spurious `signature_mismatch`.
+ *
+ * The body is only parsed after the signature, replay window, and version
+ * checks pass, so unsigned or stale bytes are never decoded. Supplying both
+ * the previous and the current secret verifies through a rotation-overlap
+ * window without a gap.
+ */
+export declare function verifyWhooshBangEvent(options: VerifyWebhookSignatureOptions): Promise<WhooshBangEventVerification>;
+/** Signature-only verification over the exact raw request bytes. */
+export declare function verifyWhooshBangWebhook(options: VerifyWebhookSignatureOptions): ReturnType<typeof verifyWebhookSignature>;

package/dist/webhooks.js

@@ -0,0 +1,47 @@
+import { validateWhooshBangEvent, verifyWebhookSignature, } from "@whooshbang/contracts";
+/**
+ * Verifies a signed customer event and returns its typed body.
+ *
+ * `rawBody` must be the exact bytes the receiver read from the wire. Framework
+ * re-serialization changes the signed input and is the usual cause of a
+ * spurious `signature_mismatch`.
+ *
+ * The body is only parsed after the signature, replay window, and version
+ * checks pass, so unsigned or stale bytes are never decoded. Supplying both
+ * the previous and the current secret verifies through a rotation-overlap
+ * window without a gap.
+ */
+export async function verifyWhooshBangEvent(options) {
+    const verification = await verifyWebhookSignature(options);
+    if (!verification.verified) {
+        return { reason: verification.reason, verified: false };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(options.rawBody));
+    }
+    catch {
+        return { reason: "event_contract_mismatch", verified: false };
+    }
+    if (!validateWhooshBangEvent(parsed)) {
+        return { reason: "event_contract_mismatch", verified: false };
+    }
+    // The signed `webhook-id` and the body's own identifier must agree, or a
+    // receiver that dedupes on one and stores the other keys the same delivery
+    // twice.
+    if (parsed.id !== verification.eventId) {
+        return { reason: "event_id_mismatch", verified: false };
+    }
+    return {
+        attempt: verification.attempt,
+        event: parsed,
+        eventId: verification.eventId,
+        timestamp: verification.timestamp,
+        verified: true,
+    };
+}
+/** Signature-only verification over the exact raw request bytes. */
+export async function verifyWhooshBangWebhook(options) {
+    return verifyWebhookSignature(options);
+}
+//# sourceMappingURL=webhooks.js.map

package/dist/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AA2B/B;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAsC;IAEtC,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CACjB,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAClE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,yBAAyB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,MAAM,EAAE,yBAAyB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAChE,CAAC;IACD,yEAAyE;IACzE,2EAA2E;IAC3E,SAAS;IACT,IAAI,MAAM,CAAC,EAAE,KAAK,YAAY,CAAC,OAAO,EAAE,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO;QACL,OAAO,EAAE,YAAY,CAAC,OAAO;QAC7B,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,YAAY,CAAC,OAAO;QAC7B,SAAS,EAAE,YAAY,CAAC,SAAS;QACjC,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAsC;IAEtC,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC"}

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "@whooshbang/sdk",
+  "version": "1.0.0-rc.14",
+  "description": "Fetch-injected JavaScript client for WhooshBang V1",
+  "private": false,
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "homepage": "https://whooshbang.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/flowxo/whooshbang.git",
+    "directory": "packages/sdk-js"
+  },
+  "keywords": [
+    "whooshbang",
+    "notifications",
+    "telegram",
+    "sdk"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "tag": "next"
+  },
+  "files": [
+    "LICENSE",
+    "README.md",
+    "dist"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "scripts": {
+    "build": "node ../../scripts/clean-dist.mjs && tsc -p tsconfig.build.json",
+    "lint": "eslint examples scripts src test --max-warnings=0",
+    "test": "vitest run --no-file-parallelism",
+    "type-check": "tsc --noEmit -p tsconfig.json"
+  },
+  "dependencies": {
+    "@whooshbang/contracts": "1.0.0-rc.13"
+  },
+  "engines": {
+    "node": ">=22.13.0 <23"
+  }
+}