waba-toolkit 0.1.0 → 0.1.1

package/README.md

@@ -41,7 +41,6 @@ npm install waba-toolkit
 ```typescript
 import {
   WABAClient,
-  verifyWebhookSignature,
   classifyWebhook,
   classifyMessage,
   isMediaMessage,
@@ -51,16 +50,16 @@ import {
 // Initialize client
 const client = new WABAClient({
   accessToken: process.env.META_ACCESS_TOKEN,
+  appSecret: process.env.META_APP_SECRET,  // Required for webhook verification
 });
 
 // In your webhook handler
 app.post('/webhook', async (req, res) => {
   // 1. Verify signature
-  const isValid = verifyWebhookSignature({
-    signature: req.headers['x-hub-signature-256'],
-    rawBody: req.rawBody,
-    appSecret: process.env.META_APP_SECRET,
-  });
+  const isValid = client.verifyWebhook(
+    req.headers['x-hub-signature-256'],
+    req.rawBody
+  );
 
   if (!isValid) {
     return res.status(401).send('Invalid signature');
@@ -105,6 +104,7 @@ Client for downloading media from WhatsApp Business API.
 ```typescript
 const client = new WABAClient({
   accessToken: string,      // Required: Meta access token
+  appSecret?: string,       // Optional: Meta App Secret (required for verifyWebhook)
   apiVersion?: string,      // Optional: API version (default: 'v22.0')
   baseUrl?: string,         // Optional: Base URL (default: 'https://graph.facebook.com')
 });
@@ -114,10 +114,17 @@ const client = new WABAClient({
 
 | Method | Description |
 |--------|-------------|
+| `verifyWebhook(signature, rawBody)` | Verifies webhook signature (requires `appSecret`) |
 | `getMedia(mediaId)` | Downloads media, returns `ReadableStream` |
 | `getMedia(mediaId, { asBuffer: true })` | Downloads media, returns `ArrayBuffer` |
 
 ```typescript
+// Verify webhook signature
+const isValid = client.verifyWebhook(
+  req.headers['x-hub-signature-256'],
+  req.rawBody
+);
+
 // Stream (default)
 const { stream, mimeType, sha256, fileSize, url } = await client.getMedia(mediaId);
 
@@ -139,11 +146,26 @@ const { buffer, mimeType, sha256, fileSize, url } = await client.getMedia(mediaI
 
 #### verifyWebhookSignature
 
+Two options for verifying webhook signatures:
+
 ```typescript
+// Option 1: Via client method (recommended)
+const client = new WABAClient({
+  accessToken: '...',
+  appSecret: process.env.META_APP_SECRET,
+});
+const isValid = client.verifyWebhook(
+  req.headers['x-hub-signature-256'],
+  req.rawBody
+);
+
+// Option 2: Standalone function
+import { verifyWebhookSignature } from 'waba-toolkit';
+
 const isValid = verifyWebhookSignature({
   signature: req.headers['x-hub-signature-256'],  // X-Hub-Signature-256 header
   rawBody: req.rawBody,                            // Raw body as Buffer or string
-  appSecret: process.env.META_APP_SECRET,          // Meta App Secret
+  appSecret: process.env.META_APP_SECRET,          // Meta App Secret (required)
 });
 ```
 
@@ -196,7 +218,7 @@ switch (result.type) {
   case 'reaction':
     console.log(result.message.reaction.emoji);
     break;
-  // ... button, order, system, referral, unsupported
+  // Additional cases: button, order, system, referral, ...
 }
 ```
 

package/dist/index.d.ts

@@ -1,6 +1,8 @@
 interface WABAClientOptions {
     /** Meta access token with whatsapp_business_messaging permission */
     accessToken: string;
+    /** Meta App Secret for webhook signature verification */
+    appSecret?: string;
     /** API version (default: 'v22.0') */
     apiVersion?: string;
     /** Base URL (default: 'https://graph.facebook.com') */
@@ -37,9 +39,18 @@ interface MediaBufferResult extends MediaMetadata {
  */
 declare class WABAClient {
     private readonly accessToken;
+    private readonly appSecret?;
     private readonly apiVersion;
     private readonly baseUrl;
     constructor(options: WABAClientOptions);
+    /**
+     * Verifies webhook signature using HMAC-SHA256.
+     * Requires appSecret to be set in constructor options.
+     *
+     * @throws {WABASignatureError} If appSecret was not provided in constructor
+     * @returns true if signature is valid, false otherwise
+     */
+    verifyWebhook(signature: string | undefined, rawBody: Buffer | string): boolean;
     /**
      * Fetches media by ID from WhatsApp Business API.
      *
@@ -494,12 +505,13 @@ interface VerifyWebhookSignatureOptions {
     /** Raw request body (NOT parsed JSON) */
     rawBody: Buffer | string;
     /** Meta App Secret */
-    appSecret: string;
+    appSecret: string | undefined;
 }
 /**
  * Verifies webhook signature using HMAC-SHA256.
  * Uses timing-safe comparison to prevent timing attacks.
  *
+ * @throws {WABASignatureError} If appSecret is not provided
  * @returns true if signature is valid, false otherwise
  */
 declare function verifyWebhookSignature(options: VerifyWebhookSignatureOptions): boolean;

package/dist/index.js

@@ -33,18 +33,57 @@ var WABASignatureError = class extends WABAError {
   }
 };
 
+// src/verify.ts
+import { createHmac, timingSafeEqual } from "crypto";
+function verifyWebhookSignature(options) {
+  const { signature, rawBody, appSecret } = options;
+  if (!appSecret) {
+    throw new WABASignatureError("appSecret is required for webhook verification");
+  }
+  if (!signature) {
+    return false;
+  }
+  const signatureHash = signature.startsWith("sha256=") ? signature.slice(7) : signature;
+  const hmac = createHmac("sha256", appSecret);
+  const bodyBuffer = typeof rawBody === "string" ? Buffer.from(rawBody, "utf-8") : rawBody;
+  const expectedHash = hmac.update(bodyBuffer).digest("hex");
+  const signatureBuffer = Buffer.from(signatureHash, "utf-8");
+  const expectedBuffer = Buffer.from(expectedHash, "utf-8");
+  if (signatureBuffer.length !== expectedBuffer.length) {
+    return false;
+  }
+  return timingSafeEqual(signatureBuffer, expectedBuffer);
+}
+
 // src/client.ts
 var DEFAULT_API_VERSION = "v22.0";
 var DEFAULT_BASE_URL = "https://graph.facebook.com";
 var WABAClient = class {
   accessToken;
+  appSecret;
   apiVersion;
   baseUrl;
   constructor(options) {
     this.accessToken = options.accessToken;
+    this.appSecret = options.appSecret;
     this.apiVersion = options.apiVersion ?? DEFAULT_API_VERSION;
     this.baseUrl = options.baseUrl ?? DEFAULT_BASE_URL;
   }
+  /**
+   * Verifies webhook signature using HMAC-SHA256.
+   * Requires appSecret to be set in constructor options.
+   *
+   * @throws {WABASignatureError} If appSecret was not provided in constructor
+   * @returns true if signature is valid, false otherwise
+   */
+  verifyWebhook(signature, rawBody) {
+    if (!this.appSecret) {
+      throw new WABASignatureError(
+        "appSecret is required for webhook verification. Pass it in WABAClientOptions."
+      );
+    }
+    return verifyWebhookSignature({ signature, rawBody, appSecret: this.appSecret });
+  }
   async getMedia(mediaId, options) {
     const metadata = await this.fetchMediaMetadata(mediaId);
     const response = await this.downloadMedia(metadata.url, mediaId);
@@ -181,25 +220,6 @@ function classifyMessage(message) {
   }
 }
 
-// src/verify.ts
-import { createHmac, timingSafeEqual } from "crypto";
-function verifyWebhookSignature(options) {
-  const { signature, rawBody, appSecret } = options;
-  if (!signature) {
-    return false;
-  }
-  const signatureHash = signature.startsWith("sha256=") ? signature.slice(7) : signature;
-  const hmac = createHmac("sha256", appSecret);
-  const bodyBuffer = typeof rawBody === "string" ? Buffer.from(rawBody, "utf-8") : rawBody;
-  const expectedHash = hmac.update(bodyBuffer).digest("hex");
-  const signatureBuffer = Buffer.from(signatureHash, "utf-8");
-  const expectedBuffer = Buffer.from(expectedHash, "utf-8");
-  if (signatureBuffer.length !== expectedBuffer.length) {
-    return false;
-  }
-  return timingSafeEqual(signatureBuffer, expectedBuffer);
-}
-
 // src/helpers.ts
 var MEDIA_TYPES = /* @__PURE__ */ new Set(["image", "audio", "video", "document", "sticker"]);
 function isMediaMessage(message) {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/client.ts","../src/webhooks/classify.ts","../src/webhooks/messages.ts","../src/verify.ts","../src/helpers.ts"],"sourcesContent":["/** Base error class for all WABA errors */\nexport class WABAError extends Error {\n  constructor(\n    message: string,\n    public readonly code?: number,\n    public readonly details?: unknown\n  ) {\n    super(message);\n    this.name = 'WABAError';\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/** Error for media-related failures (404, access denied) */\nexport class WABAMediaError extends WABAError {\n  constructor(\n    message: string,\n    public readonly mediaId: string,\n    code?: number\n  ) {\n    super(message, code);\n    this.name = 'WABAMediaError';\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/** Error for network/connection failures */\nexport class WABANetworkError extends WABAError {\n  override readonly cause?: Error;\n\n  constructor(message: string, cause?: Error) {\n    super(message);\n    this.name = 'WABANetworkError';\n    this.cause = cause;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/** Error for invalid webhook signatures */\nexport class WABASignatureError extends WABAError {\n  constructor(message: string = 'Invalid webhook signature') {\n    super(message);\n    this.name = 'WABASignatureError';\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n","import type { WABAClientOptions, GetMediaOptions } from './types/client.js';\nimport type {\n  MediaMetadata,\n  MediaStreamResult,\n  MediaBufferResult,\n  RawMediaResponse,\n} from './types/media.js';\nimport { WABAMediaError, WABANetworkError } from './errors.js';\n\nconst DEFAULT_API_VERSION = 'v22.0';\nconst DEFAULT_BASE_URL = 'https://graph.facebook.com';\n\n/**\n * Client for WhatsApp Business API media operations.\n */\nexport class WABAClient {\n  private readonly accessToken: string;\n  private readonly apiVersion: string;\n  private readonly baseUrl: string;\n\n  constructor(options: WABAClientOptions) {\n    this.accessToken = options.accessToken;\n    this.apiVersion = options.apiVersion ?? DEFAULT_API_VERSION;\n    this.baseUrl = options.baseUrl ?? DEFAULT_BASE_URL;\n  }\n\n  /**\n   * Fetches media by ID from WhatsApp Business API.\n   *\n   * Step 1: GET /{apiVersion}/{mediaId} → retrieves temporary URL + metadata\n   * Step 2: GET {temporaryUrl} → downloads binary content\n   *\n   * @throws {WABAMediaError} - Media not found (404) or access denied\n   * @throws {WABANetworkError} - Network/connection failures\n   */\n  async getMedia(mediaId: string): Promise<MediaStreamResult>;\n  async getMedia(\n    mediaId: string,\n    options: { asBuffer: true }\n  ): Promise<MediaBufferResult>;\n  async getMedia(\n    mediaId: string,\n    options?: GetMediaOptions\n  ): Promise<MediaStreamResult | MediaBufferResult>;\n  async getMedia(\n    mediaId: string,\n    options?: GetMediaOptions\n  ): Promise<MediaStreamResult | MediaBufferResult> {\n    // Step 1: Get media metadata and temporary URL\n    const metadata = await this.fetchMediaMetadata(mediaId);\n\n    // Step 2: Download the actual media\n    const response = await this.downloadMedia(metadata.url, mediaId);\n\n    if (options?.asBuffer) {\n      const buffer = await response.arrayBuffer();\n      return {\n        ...metadata,\n        buffer,\n      };\n    }\n\n    if (!response.body) {\n      throw new WABAMediaError('Response body is null', mediaId);\n    }\n\n    return {\n      ...metadata,\n      stream: response.body,\n    };\n  }\n\n  private async fetchMediaMetadata(mediaId: string): Promise<MediaMetadata> {\n    const url = `${this.baseUrl}/${this.apiVersion}/${mediaId}`;\n\n    let response: Response;\n    try {\n      response = await fetch(url, {\n        method: 'GET',\n        headers: {\n          Authorization: `Bearer ${this.accessToken}`,\n        },\n      });\n    } catch (error) {\n      throw new WABANetworkError(\n        `Failed to fetch media metadata: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        error instanceof Error ? error : undefined\n      );\n    }\n\n    if (!response.ok) {\n      const errorBody = await response.text().catch(() => 'Unknown error');\n      throw new WABAMediaError(\n        `Failed to fetch media metadata: ${response.status} ${errorBody}`,\n        mediaId,\n        response.status\n      );\n    }\n\n    const data = (await response.json()) as RawMediaResponse;\n\n    // Normalize snake_case to camelCase\n    return {\n      id: data.id,\n      mimeType: data.mime_type,\n      sha256: data.sha256,\n      fileSize: parseInt(data.file_size, 10),\n      url: data.url,\n    };\n  }\n\n  private async downloadMedia(url: string, mediaId: string): Promise<Response> {\n    let response: Response;\n    try {\n      response = await fetch(url, {\n        method: 'GET',\n        headers: {\n          Authorization: `Bearer ${this.accessToken}`,\n        },\n      });\n    } catch (error) {\n      throw new WABANetworkError(\n        `Failed to download media: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        error instanceof Error ? error : undefined\n      );\n    }\n\n    if (!response.ok) {\n      throw new WABAMediaError(\n        `Failed to download media: ${response.status}`,\n        mediaId,\n        response.status\n      );\n    }\n\n    return response;\n  }\n}\n","import type {\n  WebhookPayload,\n  WebhookClassification,\n  MessageWebhookValue,\n  StatusWebhookValue,\n  CallWebhookValue,\n} from '../types/webhooks.js';\n\n/**\n * Classifies a webhook payload into its type.\n * Returns a discriminated union for type-safe handling.\n */\nexport function classifyWebhook(payload: WebhookPayload): WebhookClassification {\n  const entry = payload.entry?.[0];\n  const change = entry?.changes?.[0];\n  const value = change?.value;\n\n  if (!value) {\n    return { type: 'unknown', payload };\n  }\n\n  // Check for calls array (call webhooks)\n  if ('calls' in value && Array.isArray(value.calls)) {\n    return { type: 'call', payload: value as CallWebhookValue };\n  }\n\n  // Check for statuses array (status webhooks)\n  if ('statuses' in value && Array.isArray(value.statuses)) {\n    return { type: 'status', payload: value as StatusWebhookValue };\n  }\n\n  // Check for messages array (message webhooks)\n  if ('messages' in value && Array.isArray(value.messages)) {\n    return { type: 'message', payload: value as MessageWebhookValue };\n  }\n\n  // Check for errors without messages (error webhook)\n  if ('errors' in value && Array.isArray(value.errors)) {\n    return { type: 'message', payload: value as MessageWebhookValue };\n  }\n\n  return { type: 'unknown', payload };\n}\n","import type {\n  IncomingMessage,\n  MessageClassification,\n  TextMessage,\n  ImageMessage,\n  AudioMessage,\n  VideoMessage,\n  DocumentMessage,\n  StickerMessage,\n  LocationMessage,\n  ContactsMessage,\n  InteractiveMessage,\n  ReactionMessage,\n  ButtonMessage,\n  OrderMessage,\n  SystemMessage,\n  ReferralMessage,\n  UnsupportedMessage,\n} from '../types/messages.js';\n\n/**\n * Classifies an incoming message by its type.\n * Returns a discriminated union for type-safe handling.\n */\nexport function classifyMessage(message: IncomingMessage): MessageClassification {\n  switch (message.type) {\n    case 'text':\n      return { type: 'text', message: message as TextMessage };\n    case 'image':\n      return { type: 'image', message: message as ImageMessage };\n    case 'audio':\n      return { type: 'audio', message: message as AudioMessage };\n    case 'video':\n      return { type: 'video', message: message as VideoMessage };\n    case 'document':\n      return { type: 'document', message: message as DocumentMessage };\n    case 'sticker':\n      return { type: 'sticker', message: message as StickerMessage };\n    case 'location':\n      return { type: 'location', message: message as LocationMessage };\n    case 'contacts':\n      return { type: 'contacts', message: message as ContactsMessage };\n    case 'interactive':\n      return { type: 'interactive', message: message as InteractiveMessage };\n    case 'reaction':\n      return { type: 'reaction', message: message as ReactionMessage };\n    case 'button':\n      return { type: 'button', message: message as ButtonMessage };\n    case 'order':\n      return { type: 'order', message: message as OrderMessage };\n    case 'system':\n      return { type: 'system', message: message as SystemMessage };\n    case 'referral':\n      return { type: 'referral', message: message as ReferralMessage };\n    default:\n      return { type: 'unsupported', message: message as UnsupportedMessage };\n  }\n}\n","import { createHmac, timingSafeEqual } from 'node:crypto';\n\nexport interface VerifyWebhookSignatureOptions {\n  /** X-Hub-Signature-256 header value */\n  signature: string | undefined;\n  /** Raw request body (NOT parsed JSON) */\n  rawBody: Buffer | string;\n  /** Meta App Secret */\n  appSecret: string;\n}\n\n/**\n * Verifies webhook signature using HMAC-SHA256.\n * Uses timing-safe comparison to prevent timing attacks.\n *\n * @returns true if signature is valid, false otherwise\n */\nexport function verifyWebhookSignature(\n  options: VerifyWebhookSignatureOptions\n): boolean {\n  const { signature, rawBody, appSecret } = options;\n\n  if (!signature) {\n    return false;\n  }\n\n  // Remove 'sha256=' prefix if present\n  const signatureHash = signature.startsWith('sha256=')\n    ? signature.slice(7)\n    : signature;\n\n  // Compute expected signature\n  const hmac = createHmac('sha256', appSecret);\n  const bodyBuffer =\n    typeof rawBody === 'string' ? Buffer.from(rawBody, 'utf-8') : rawBody;\n  const expectedHash = hmac.update(bodyBuffer).digest('hex');\n\n  // Convert to buffers for timing-safe comparison\n  const signatureBuffer = Buffer.from(signatureHash, 'utf-8');\n  const expectedBuffer = Buffer.from(expectedHash, 'utf-8');\n\n  // Ensure same length before comparison\n  if (signatureBuffer.length !== expectedBuffer.length) {\n    return false;\n  }\n\n  return timingSafeEqual(signatureBuffer, expectedBuffer);\n}\n","import type {\n  IncomingMessage,\n  MediaMessage,\n  ImageMessage,\n  AudioMessage,\n  VideoMessage,\n  DocumentMessage,\n  StickerMessage,\n} from './types/messages.js';\nimport type { WebhookPayload } from './types/webhooks.js';\n\nconst MEDIA_TYPES = new Set(['image', 'audio', 'video', 'document', 'sticker']);\n\n/**\n * Type guard: returns true if message contains downloadable media.\n * Narrows type to messages with image/audio/video/document/sticker.\n */\nexport function isMediaMessage(message: IncomingMessage): message is MediaMessage {\n  return MEDIA_TYPES.has(message.type);\n}\n\n/**\n * Extracts media ID from any media message type.\n * Returns undefined if message has no media.\n */\nexport function extractMediaId(message: IncomingMessage): string | undefined {\n  if (!isMediaMessage(message)) {\n    return undefined;\n  }\n\n  switch (message.type) {\n    case 'image':\n      return (message as ImageMessage).image.id;\n    case 'audio':\n      return (message as AudioMessage).audio.id;\n    case 'video':\n      return (message as VideoMessage).video.id;\n    case 'document':\n      return (message as DocumentMessage).document.id;\n    case 'sticker':\n      return (message as StickerMessage).sticker.id;\n    default:\n      return undefined;\n  }\n}\n\nexport interface ContactInfo {\n  waId: string;\n  profileName: string | undefined;\n  phoneNumberId: string;\n}\n\n/**\n * Extracts sender info from webhook payload.\n * Returns undefined if the webhook doesn't contain message contact info.\n */\nexport function getContactInfo(webhook: WebhookPayload): ContactInfo | undefined {\n  const entry = webhook.entry?.[0];\n  const change = entry?.changes?.[0];\n  const value = change?.value;\n\n  if (!value || !('contacts' in value) || !value.contacts?.length) {\n    return undefined;\n  }\n\n  const contact = value.contacts[0];\n  const metadata = value.metadata;\n\n  return {\n    waId: contact.wa_id,\n    profileName: contact.profile?.name,\n    phoneNumberId: metadata.phone_number_id,\n  };\n}\n\n/**\n * Parses message timestamp to Date object.\n * WhatsApp timestamps are Unix epoch seconds as strings.\n */\nexport function getMessageTimestamp(message: IncomingMessage): Date {\n  const epochSeconds = parseInt(message.timestamp, 10);\n  return new Date(epochSeconds * 1000);\n}\n"],"mappings":";AACO,IAAM,YAAN,cAAwB,MAAM;AAAA,EACnC,YACE,SACgB,MACA,SAChB;AACA,UAAM,OAAO;AAHG;AACA;AAGhB,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,WAAW,SAAS;AAAA,EAClD;AACF;AAGO,IAAM,iBAAN,cAA6B,UAAU;AAAA,EAC5C,YACE,SACgB,SAChB,MACA;AACA,UAAM,SAAS,IAAI;AAHH;AAIhB,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,WAAW,SAAS;AAAA,EAClD;AACF;AAGO,IAAM,mBAAN,cAA+B,UAAU;AAAA,EAC5B;AAAA,EAElB,YAAY,SAAiB,OAAe;AAC1C,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,QAAQ;AACb,WAAO,eAAe,MAAM,WAAW,SAAS;AAAA,EAClD;AACF;AAGO,IAAM,qBAAN,cAAiC,UAAU;AAAA,EAChD,YAAY,UAAkB,6BAA6B;AACzD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,WAAW,SAAS;AAAA,EAClD;AACF;;;ACpCA,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAKlB,IAAM,aAAN,MAAiB;AAAA,EACL;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,SAA4B;AACtC,SAAK,cAAc,QAAQ;AAC3B,SAAK,aAAa,QAAQ,cAAc;AACxC,SAAK,UAAU,QAAQ,WAAW;AAAA,EACpC;AAAA,EAoBA,MAAM,SACJ,SACA,SACgD;AAEhD,UAAM,WAAW,MAAM,KAAK,mBAAmB,OAAO;AAGtD,UAAM,WAAW,MAAM,KAAK,cAAc,SAAS,KAAK,OAAO;AAE/D,QAAI,SAAS,UAAU;AACrB,YAAM,SAAS,MAAM,SAAS,YAAY;AAC1C,aAAO;AAAA,QACL,GAAG;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,MAAM;AAClB,YAAM,IAAI,eAAe,yBAAyB,OAAO;AAAA,IAC3D;AAEA,WAAO;AAAA,MACL,GAAG;AAAA,MACH,QAAQ,SAAS;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,MAAc,mBAAmB,SAAyC;AACxE,UAAM,MAAM,GAAG,KAAK,OAAO,IAAI,KAAK,UAAU,IAAI,OAAO;AAEzD,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,MAAM,KAAK;AAAA,QAC1B,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,eAAe,UAAU,KAAK,WAAW;AAAA,QAC3C;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR,mCAAmC,iBAAiB,QAAQ,MAAM,UAAU,eAAe;AAAA,QAC3F,iBAAiB,QAAQ,QAAQ;AAAA,MACnC;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAY,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,eAAe;AACnE,YAAM,IAAI;AAAA,QACR,mCAAmC,SAAS,MAAM,IAAI,SAAS;AAAA,QAC/D;AAAA,QACA,SAAS;AAAA,MACX;AAAA,IACF;AAEA,UAAM,OAAQ,MAAM,SAAS,KAAK;AAGlC,WAAO;AAAA,MACL,IAAI,KAAK;AAAA,MACT,UAAU,KAAK;AAAA,MACf,QAAQ,KAAK;AAAA,MACb,UAAU,SAAS,KAAK,WAAW,EAAE;AAAA,MACrC,KAAK,KAAK;AAAA,IACZ;AAAA,EACF;AAAA,EAEA,MAAc,cAAc,KAAa,SAAoC;AAC3E,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,MAAM,KAAK;AAAA,QAC1B,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,eAAe,UAAU,KAAK,WAAW;AAAA,QAC3C;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR,6BAA6B,iBAAiB,QAAQ,MAAM,UAAU,eAAe;AAAA,QACrF,iBAAiB,QAAQ,QAAQ;AAAA,MACnC;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,6BAA6B,SAAS,MAAM;AAAA,QAC5C;AAAA,QACA,SAAS;AAAA,MACX;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;;;AC7HO,SAAS,gBAAgB,SAAgD;AAC9E,QAAM,QAAQ,QAAQ,QAAQ,CAAC;AAC/B,QAAM,SAAS,OAAO,UAAU,CAAC;AACjC,QAAM,QAAQ,QAAQ;AAEtB,MAAI,CAAC,OAAO;AACV,WAAO,EAAE,MAAM,WAAW,QAAQ;AAAA,EACpC;AAGA,MAAI,WAAW,SAAS,MAAM,QAAQ,MAAM,KAAK,GAAG;AAClD,WAAO,EAAE,MAAM,QAAQ,SAAS,MAA0B;AAAA,EAC5D;AAGA,MAAI,cAAc,SAAS,MAAM,QAAQ,MAAM,QAAQ,GAAG;AACxD,WAAO,EAAE,MAAM,UAAU,SAAS,MAA4B;AAAA,EAChE;AAGA,MAAI,cAAc,SAAS,MAAM,QAAQ,MAAM,QAAQ,GAAG;AACxD,WAAO,EAAE,MAAM,WAAW,SAAS,MAA6B;AAAA,EAClE;AAGA,MAAI,YAAY,SAAS,MAAM,QAAQ,MAAM,MAAM,GAAG;AACpD,WAAO,EAAE,MAAM,WAAW,SAAS,MAA6B;AAAA,EAClE;AAEA,SAAO,EAAE,MAAM,WAAW,QAAQ;AACpC;;;AClBO,SAAS,gBAAgB,SAAiD;AAC/E,UAAQ,QAAQ,MAAM;AAAA,IACpB,KAAK;AACH,aAAO,EAAE,MAAM,QAAQ,QAAgC;AAAA,IACzD,KAAK;AACH,aAAO,EAAE,MAAM,SAAS,QAAiC;AAAA,IAC3D,KAAK;AACH,aAAO,EAAE,MAAM,SAAS,QAAiC;AAAA,IAC3D,KAAK;AACH,aAAO,EAAE,MAAM,SAAS,QAAiC;AAAA,IAC3D,KAAK;AACH,aAAO,EAAE,MAAM,YAAY,QAAoC;AAAA,IACjE,KAAK;AACH,aAAO,EAAE,MAAM,WAAW,QAAmC;AAAA,IAC/D,KAAK;AACH,aAAO,EAAE,MAAM,YAAY,QAAoC;AAAA,IACjE,KAAK;AACH,aAAO,EAAE,MAAM,YAAY,QAAoC;AAAA,IACjE,KAAK;AACH,aAAO,EAAE,MAAM,eAAe,QAAuC;AAAA,IACvE,KAAK;AACH,aAAO,EAAE,MAAM,YAAY,QAAoC;AAAA,IACjE,KAAK;AACH,aAAO,EAAE,MAAM,UAAU,QAAkC;AAAA,IAC7D,KAAK;AACH,aAAO,EAAE,MAAM,SAAS,QAAiC;AAAA,IAC3D,KAAK;AACH,aAAO,EAAE,MAAM,UAAU,QAAkC;AAAA,IAC7D,KAAK;AACH,aAAO,EAAE,MAAM,YAAY,QAAoC;AAAA,IACjE;AACE,aAAO,EAAE,MAAM,eAAe,QAAuC;AAAA,EACzE;AACF;;;ACzDA,SAAS,YAAY,uBAAuB;AAiBrC,SAAS,uBACd,SACS;AACT,QAAM,EAAE,WAAW,SAAS,UAAU,IAAI;AAE1C,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,EACT;AAGA,QAAM,gBAAgB,UAAU,WAAW,SAAS,IAChD,UAAU,MAAM,CAAC,IACjB;AAGJ,QAAM,OAAO,WAAW,UAAU,SAAS;AAC3C,QAAM,aACJ,OAAO,YAAY,WAAW,OAAO,KAAK,SAAS,OAAO,IAAI;AAChE,QAAM,eAAe,KAAK,OAAO,UAAU,EAAE,OAAO,KAAK;AAGzD,QAAM,kBAAkB,OAAO,KAAK,eAAe,OAAO;AAC1D,QAAM,iBAAiB,OAAO,KAAK,cAAc,OAAO;AAGxD,MAAI,gBAAgB,WAAW,eAAe,QAAQ;AACpD,WAAO;AAAA,EACT;AAEA,SAAO,gBAAgB,iBAAiB,cAAc;AACxD;;;ACpCA,IAAM,cAAc,oBAAI,IAAI,CAAC,SAAS,SAAS,SAAS,YAAY,SAAS,CAAC;AAMvE,SAAS,eAAe,SAAmD;AAChF,SAAO,YAAY,IAAI,QAAQ,IAAI;AACrC;AAMO,SAAS,eAAe,SAA8C;AAC3E,MAAI,CAAC,eAAe,OAAO,GAAG;AAC5B,WAAO;AAAA,EACT;AAEA,UAAQ,QAAQ,MAAM;AAAA,IACpB,KAAK;AACH,aAAQ,QAAyB,MAAM;AAAA,IACzC,KAAK;AACH,aAAQ,QAAyB,MAAM;AAAA,IACzC,KAAK;AACH,aAAQ,QAAyB,MAAM;AAAA,IACzC,KAAK;AACH,aAAQ,QAA4B,SAAS;AAAA,IAC/C,KAAK;AACH,aAAQ,QAA2B,QAAQ;AAAA,IAC7C;AACE,aAAO;AAAA,EACX;AACF;AAYO,SAAS,eAAe,SAAkD;AAC/E,QAAM,QAAQ,QAAQ,QAAQ,CAAC;AAC/B,QAAM,SAAS,OAAO,UAAU,CAAC;AACjC,QAAM,QAAQ,QAAQ;AAEtB,MAAI,CAAC,SAAS,EAAE,cAAc,UAAU,CAAC,MAAM,UAAU,QAAQ;AAC/D,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,MAAM,SAAS,CAAC;AAChC,QAAM,WAAW,MAAM;AAEvB,SAAO;AAAA,IACL,MAAM,QAAQ;AAAA,IACd,aAAa,QAAQ,SAAS;AAAA,IAC9B,eAAe,SAAS;AAAA,EAC1B;AACF;AAMO,SAAS,oBAAoB,SAAgC;AAClE,QAAM,eAAe,SAAS,QAAQ,WAAW,EAAE;AACnD,SAAO,IAAI,KAAK,eAAe,GAAI;AACrC;","names":[]}
+{"version":3,"sources":["../src/errors.ts","../src/verify.ts","../src/client.ts","../src/webhooks/classify.ts","../src/webhooks/messages.ts","../src/helpers.ts"],"sourcesContent":["/** Base error class for all WABA errors */\nexport class WABAError extends Error {\n  constructor(\n    message: string,\n    public readonly code?: number,\n    public readonly details?: unknown\n  ) {\n    super(message);\n    this.name = 'WABAError';\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/** Error for media-related failures (404, access denied) */\nexport class WABAMediaError extends WABAError {\n  constructor(\n    message: string,\n    public readonly mediaId: string,\n    code?: number\n  ) {\n    super(message, code);\n    this.name = 'WABAMediaError';\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/** Error for network/connection failures */\nexport class WABANetworkError extends WABAError {\n  override readonly cause?: Error;\n\n  constructor(message: string, cause?: Error) {\n    super(message);\n    this.name = 'WABANetworkError';\n    this.cause = cause;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/** Error for invalid webhook signatures */\nexport class WABASignatureError extends WABAError {\n  constructor(message: string = 'Invalid webhook signature') {\n    super(message);\n    this.name = 'WABASignatureError';\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n","import { createHmac, timingSafeEqual } from 'node:crypto';\nimport { WABASignatureError } from './errors.js';\n\nexport interface VerifyWebhookSignatureOptions {\n  /** X-Hub-Signature-256 header value */\n  signature: string | undefined;\n  /** Raw request body (NOT parsed JSON) */\n  rawBody: Buffer | string;\n  /** Meta App Secret */\n  appSecret: string | undefined;\n}\n\n/**\n * Verifies webhook signature using HMAC-SHA256.\n * Uses timing-safe comparison to prevent timing attacks.\n *\n * @throws {WABASignatureError} If appSecret is not provided\n * @returns true if signature is valid, false otherwise\n */\nexport function verifyWebhookSignature(\n  options: VerifyWebhookSignatureOptions\n): boolean {\n  const { signature, rawBody, appSecret } = options;\n\n  if (!appSecret) {\n    throw new WABASignatureError('appSecret is required for webhook verification');\n  }\n\n  if (!signature) {\n    return false;\n  }\n\n  // Remove 'sha256=' prefix if present\n  const signatureHash = signature.startsWith('sha256=')\n    ? signature.slice(7)\n    : signature;\n\n  // Compute expected signature\n  const hmac = createHmac('sha256', appSecret);\n  const bodyBuffer =\n    typeof rawBody === 'string' ? Buffer.from(rawBody, 'utf-8') : rawBody;\n  const expectedHash = hmac.update(bodyBuffer).digest('hex');\n\n  // Convert to buffers for timing-safe comparison\n  const signatureBuffer = Buffer.from(signatureHash, 'utf-8');\n  const expectedBuffer = Buffer.from(expectedHash, 'utf-8');\n\n  // Ensure same length before comparison\n  if (signatureBuffer.length !== expectedBuffer.length) {\n    return false;\n  }\n\n  return timingSafeEqual(signatureBuffer, expectedBuffer);\n}\n","import type { WABAClientOptions, GetMediaOptions } from './types/client.js';\nimport type {\n  MediaMetadata,\n  MediaStreamResult,\n  MediaBufferResult,\n  RawMediaResponse,\n} from './types/media.js';\nimport { WABAMediaError, WABANetworkError, WABASignatureError } from './errors.js';\nimport { verifyWebhookSignature } from './verify.js';\n\nconst DEFAULT_API_VERSION = 'v22.0';\nconst DEFAULT_BASE_URL = 'https://graph.facebook.com';\n\n/**\n * Client for WhatsApp Business API media operations.\n */\nexport class WABAClient {\n  private readonly accessToken: string;\n  private readonly appSecret?: string;\n  private readonly apiVersion: string;\n  private readonly baseUrl: string;\n\n  constructor(options: WABAClientOptions) {\n    this.accessToken = options.accessToken;\n    this.appSecret = options.appSecret;\n    this.apiVersion = options.apiVersion ?? DEFAULT_API_VERSION;\n    this.baseUrl = options.baseUrl ?? DEFAULT_BASE_URL;\n  }\n\n  /**\n   * Verifies webhook signature using HMAC-SHA256.\n   * Requires appSecret to be set in constructor options.\n   *\n   * @throws {WABASignatureError} If appSecret was not provided in constructor\n   * @returns true if signature is valid, false otherwise\n   */\n  verifyWebhook(signature: string | undefined, rawBody: Buffer | string): boolean {\n    if (!this.appSecret) {\n      throw new WABASignatureError(\n        'appSecret is required for webhook verification. Pass it in WABAClientOptions.'\n      );\n    }\n    return verifyWebhookSignature({ signature, rawBody, appSecret: this.appSecret });\n  }\n\n  /**\n   * Fetches media by ID from WhatsApp Business API.\n   *\n   * Step 1: GET /{apiVersion}/{mediaId} → retrieves temporary URL + metadata\n   * Step 2: GET {temporaryUrl} → downloads binary content\n   *\n   * @throws {WABAMediaError} - Media not found (404) or access denied\n   * @throws {WABANetworkError} - Network/connection failures\n   */\n  async getMedia(mediaId: string): Promise<MediaStreamResult>;\n  async getMedia(\n    mediaId: string,\n    options: { asBuffer: true }\n  ): Promise<MediaBufferResult>;\n  async getMedia(\n    mediaId: string,\n    options?: GetMediaOptions\n  ): Promise<MediaStreamResult | MediaBufferResult>;\n  async getMedia(\n    mediaId: string,\n    options?: GetMediaOptions\n  ): Promise<MediaStreamResult | MediaBufferResult> {\n    // Step 1: Get media metadata and temporary URL\n    const metadata = await this.fetchMediaMetadata(mediaId);\n\n    // Step 2: Download the actual media\n    const response = await this.downloadMedia(metadata.url, mediaId);\n\n    if (options?.asBuffer) {\n      const buffer = await response.arrayBuffer();\n      return {\n        ...metadata,\n        buffer,\n      };\n    }\n\n    if (!response.body) {\n      throw new WABAMediaError('Response body is null', mediaId);\n    }\n\n    return {\n      ...metadata,\n      stream: response.body,\n    };\n  }\n\n  private async fetchMediaMetadata(mediaId: string): Promise<MediaMetadata> {\n    const url = `${this.baseUrl}/${this.apiVersion}/${mediaId}`;\n\n    let response: Response;\n    try {\n      response = await fetch(url, {\n        method: 'GET',\n        headers: {\n          Authorization: `Bearer ${this.accessToken}`,\n        },\n      });\n    } catch (error) {\n      throw new WABANetworkError(\n        `Failed to fetch media metadata: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        error instanceof Error ? error : undefined\n      );\n    }\n\n    if (!response.ok) {\n      const errorBody = await response.text().catch(() => 'Unknown error');\n      throw new WABAMediaError(\n        `Failed to fetch media metadata: ${response.status} ${errorBody}`,\n        mediaId,\n        response.status\n      );\n    }\n\n    const data = (await response.json()) as RawMediaResponse;\n\n    // Normalize snake_case to camelCase\n    return {\n      id: data.id,\n      mimeType: data.mime_type,\n      sha256: data.sha256,\n      fileSize: parseInt(data.file_size, 10),\n      url: data.url,\n    };\n  }\n\n  private async downloadMedia(url: string, mediaId: string): Promise<Response> {\n    let response: Response;\n    try {\n      response = await fetch(url, {\n        method: 'GET',\n        headers: {\n          Authorization: `Bearer ${this.accessToken}`,\n        },\n      });\n    } catch (error) {\n      throw new WABANetworkError(\n        `Failed to download media: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        error instanceof Error ? error : undefined\n      );\n    }\n\n    if (!response.ok) {\n      throw new WABAMediaError(\n        `Failed to download media: ${response.status}`,\n        mediaId,\n        response.status\n      );\n    }\n\n    return response;\n  }\n}\n","import type {\n  WebhookPayload,\n  WebhookClassification,\n  MessageWebhookValue,\n  StatusWebhookValue,\n  CallWebhookValue,\n} from '../types/webhooks.js';\n\n/**\n * Classifies a webhook payload into its type.\n * Returns a discriminated union for type-safe handling.\n */\nexport function classifyWebhook(payload: WebhookPayload): WebhookClassification {\n  const entry = payload.entry?.[0];\n  const change = entry?.changes?.[0];\n  const value = change?.value;\n\n  if (!value) {\n    return { type: 'unknown', payload };\n  }\n\n  // Check for calls array (call webhooks)\n  if ('calls' in value && Array.isArray(value.calls)) {\n    return { type: 'call', payload: value as CallWebhookValue };\n  }\n\n  // Check for statuses array (status webhooks)\n  if ('statuses' in value && Array.isArray(value.statuses)) {\n    return { type: 'status', payload: value as StatusWebhookValue };\n  }\n\n  // Check for messages array (message webhooks)\n  if ('messages' in value && Array.isArray(value.messages)) {\n    return { type: 'message', payload: value as MessageWebhookValue };\n  }\n\n  // Check for errors without messages (error webhook)\n  if ('errors' in value && Array.isArray(value.errors)) {\n    return { type: 'message', payload: value as MessageWebhookValue };\n  }\n\n  return { type: 'unknown', payload };\n}\n","import type {\n  IncomingMessage,\n  MessageClassification,\n  TextMessage,\n  ImageMessage,\n  AudioMessage,\n  VideoMessage,\n  DocumentMessage,\n  StickerMessage,\n  LocationMessage,\n  ContactsMessage,\n  InteractiveMessage,\n  ReactionMessage,\n  ButtonMessage,\n  OrderMessage,\n  SystemMessage,\n  ReferralMessage,\n  UnsupportedMessage,\n} from '../types/messages.js';\n\n/**\n * Classifies an incoming message by its type.\n * Returns a discriminated union for type-safe handling.\n */\nexport function classifyMessage(message: IncomingMessage): MessageClassification {\n  switch (message.type) {\n    case 'text':\n      return { type: 'text', message: message as TextMessage };\n    case 'image':\n      return { type: 'image', message: message as ImageMessage };\n    case 'audio':\n      return { type: 'audio', message: message as AudioMessage };\n    case 'video':\n      return { type: 'video', message: message as VideoMessage };\n    case 'document':\n      return { type: 'document', message: message as DocumentMessage };\n    case 'sticker':\n      return { type: 'sticker', message: message as StickerMessage };\n    case 'location':\n      return { type: 'location', message: message as LocationMessage };\n    case 'contacts':\n      return { type: 'contacts', message: message as ContactsMessage };\n    case 'interactive':\n      return { type: 'interactive', message: message as InteractiveMessage };\n    case 'reaction':\n      return { type: 'reaction', message: message as ReactionMessage };\n    case 'button':\n      return { type: 'button', message: message as ButtonMessage };\n    case 'order':\n      return { type: 'order', message: message as OrderMessage };\n    case 'system':\n      return { type: 'system', message: message as SystemMessage };\n    case 'referral':\n      return { type: 'referral', message: message as ReferralMessage };\n    default:\n      return { type: 'unsupported', message: message as UnsupportedMessage };\n  }\n}\n","import type {\n  IncomingMessage,\n  MediaMessage,\n  ImageMessage,\n  AudioMessage,\n  VideoMessage,\n  DocumentMessage,\n  StickerMessage,\n} from './types/messages.js';\nimport type { WebhookPayload } from './types/webhooks.js';\n\nconst MEDIA_TYPES = new Set(['image', 'audio', 'video', 'document', 'sticker']);\n\n/**\n * Type guard: returns true if message contains downloadable media.\n * Narrows type to messages with image/audio/video/document/sticker.\n */\nexport function isMediaMessage(message: IncomingMessage): message is MediaMessage {\n  return MEDIA_TYPES.has(message.type);\n}\n\n/**\n * Extracts media ID from any media message type.\n * Returns undefined if message has no media.\n */\nexport function extractMediaId(message: IncomingMessage): string | undefined {\n  if (!isMediaMessage(message)) {\n    return undefined;\n  }\n\n  switch (message.type) {\n    case 'image':\n      return (message as ImageMessage).image.id;\n    case 'audio':\n      return (message as AudioMessage).audio.id;\n    case 'video':\n      return (message as VideoMessage).video.id;\n    case 'document':\n      return (message as DocumentMessage).document.id;\n    case 'sticker':\n      return (message as StickerMessage).sticker.id;\n    default:\n      return undefined;\n  }\n}\n\nexport interface ContactInfo {\n  waId: string;\n  profileName: string | undefined;\n  phoneNumberId: string;\n}\n\n/**\n * Extracts sender info from webhook payload.\n * Returns undefined if the webhook doesn't contain message contact info.\n */\nexport function getContactInfo(webhook: WebhookPayload): ContactInfo | undefined {\n  const entry = webhook.entry?.[0];\n  const change = entry?.changes?.[0];\n  const value = change?.value;\n\n  if (!value || !('contacts' in value) || !value.contacts?.length) {\n    return undefined;\n  }\n\n  const contact = value.contacts[0];\n  const metadata = value.metadata;\n\n  return {\n    waId: contact.wa_id,\n    profileName: contact.profile?.name,\n    phoneNumberId: metadata.phone_number_id,\n  };\n}\n\n/**\n * Parses message timestamp to Date object.\n * WhatsApp timestamps are Unix epoch seconds as strings.\n */\nexport function getMessageTimestamp(message: IncomingMessage): Date {\n  const epochSeconds = parseInt(message.timestamp, 10);\n  return new Date(epochSeconds * 1000);\n}\n"],"mappings":";AACO,IAAM,YAAN,cAAwB,MAAM;AAAA,EACnC,YACE,SACgB,MACA,SAChB;AACA,UAAM,OAAO;AAHG;AACA;AAGhB,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,WAAW,SAAS;AAAA,EAClD;AACF;AAGO,IAAM,iBAAN,cAA6B,UAAU;AAAA,EAC5C,YACE,SACgB,SAChB,MACA;AACA,UAAM,SAAS,IAAI;AAHH;AAIhB,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,WAAW,SAAS;AAAA,EAClD;AACF;AAGO,IAAM,mBAAN,cAA+B,UAAU;AAAA,EAC5B;AAAA,EAElB,YAAY,SAAiB,OAAe;AAC1C,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,QAAQ;AACb,WAAO,eAAe,MAAM,WAAW,SAAS;AAAA,EAClD;AACF;AAGO,IAAM,qBAAN,cAAiC,UAAU;AAAA,EAChD,YAAY,UAAkB,6BAA6B;AACzD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,WAAW,SAAS;AAAA,EAClD;AACF;;;AC7CA,SAAS,YAAY,uBAAuB;AAmBrC,SAAS,uBACd,SACS;AACT,QAAM,EAAE,WAAW,SAAS,UAAU,IAAI;AAE1C,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,mBAAmB,gDAAgD;AAAA,EAC/E;AAEA,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,EACT;AAGA,QAAM,gBAAgB,UAAU,WAAW,SAAS,IAChD,UAAU,MAAM,CAAC,IACjB;AAGJ,QAAM,OAAO,WAAW,UAAU,SAAS;AAC3C,QAAM,aACJ,OAAO,YAAY,WAAW,OAAO,KAAK,SAAS,OAAO,IAAI;AAChE,QAAM,eAAe,KAAK,OAAO,UAAU,EAAE,OAAO,KAAK;AAGzD,QAAM,kBAAkB,OAAO,KAAK,eAAe,OAAO;AAC1D,QAAM,iBAAiB,OAAO,KAAK,cAAc,OAAO;AAGxD,MAAI,gBAAgB,WAAW,eAAe,QAAQ;AACpD,WAAO;AAAA,EACT;AAEA,SAAO,gBAAgB,iBAAiB,cAAc;AACxD;;;AC3CA,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAKlB,IAAM,aAAN,MAAiB;AAAA,EACL;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,SAA4B;AACtC,SAAK,cAAc,QAAQ;AAC3B,SAAK,YAAY,QAAQ;AACzB,SAAK,aAAa,QAAQ,cAAc;AACxC,SAAK,UAAU,QAAQ,WAAW;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,cAAc,WAA+B,SAAmC;AAC9E,QAAI,CAAC,KAAK,WAAW;AACnB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,uBAAuB,EAAE,WAAW,SAAS,WAAW,KAAK,UAAU,CAAC;AAAA,EACjF;AAAA,EAoBA,MAAM,SACJ,SACA,SACgD;AAEhD,UAAM,WAAW,MAAM,KAAK,mBAAmB,OAAO;AAGtD,UAAM,WAAW,MAAM,KAAK,cAAc,SAAS,KAAK,OAAO;AAE/D,QAAI,SAAS,UAAU;AACrB,YAAM,SAAS,MAAM,SAAS,YAAY;AAC1C,aAAO;AAAA,QACL,GAAG;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,MAAM;AAClB,YAAM,IAAI,eAAe,yBAAyB,OAAO;AAAA,IAC3D;AAEA,WAAO;AAAA,MACL,GAAG;AAAA,MACH,QAAQ,SAAS;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,MAAc,mBAAmB,SAAyC;AACxE,UAAM,MAAM,GAAG,KAAK,OAAO,IAAI,KAAK,UAAU,IAAI,OAAO;AAEzD,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,MAAM,KAAK;AAAA,QAC1B,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,eAAe,UAAU,KAAK,WAAW;AAAA,QAC3C;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR,mCAAmC,iBAAiB,QAAQ,MAAM,UAAU,eAAe;AAAA,QAC3F,iBAAiB,QAAQ,QAAQ;AAAA,MACnC;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAAY,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,eAAe;AACnE,YAAM,IAAI;AAAA,QACR,mCAAmC,SAAS,MAAM,IAAI,SAAS;AAAA,QAC/D;AAAA,QACA,SAAS;AAAA,MACX;AAAA,IACF;AAEA,UAAM,OAAQ,MAAM,SAAS,KAAK;AAGlC,WAAO;AAAA,MACL,IAAI,KAAK;AAAA,MACT,UAAU,KAAK;AAAA,MACf,QAAQ,KAAK;AAAA,MACb,UAAU,SAAS,KAAK,WAAW,EAAE;AAAA,MACrC,KAAK,KAAK;AAAA,IACZ;AAAA,EACF;AAAA,EAEA,MAAc,cAAc,KAAa,SAAoC;AAC3E,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,MAAM,KAAK;AAAA,QAC1B,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,eAAe,UAAU,KAAK,WAAW;AAAA,QAC3C;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR,6BAA6B,iBAAiB,QAAQ,MAAM,UAAU,eAAe;AAAA,QACrF,iBAAiB,QAAQ,QAAQ;AAAA,MACnC;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,6BAA6B,SAAS,MAAM;AAAA,QAC5C;AAAA,QACA,SAAS;AAAA,MACX;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;;;AChJO,SAAS,gBAAgB,SAAgD;AAC9E,QAAM,QAAQ,QAAQ,QAAQ,CAAC;AAC/B,QAAM,SAAS,OAAO,UAAU,CAAC;AACjC,QAAM,QAAQ,QAAQ;AAEtB,MAAI,CAAC,OAAO;AACV,WAAO,EAAE,MAAM,WAAW,QAAQ;AAAA,EACpC;AAGA,MAAI,WAAW,SAAS,MAAM,QAAQ,MAAM,KAAK,GAAG;AAClD,WAAO,EAAE,MAAM,QAAQ,SAAS,MAA0B;AAAA,EAC5D;AAGA,MAAI,cAAc,SAAS,MAAM,QAAQ,MAAM,QAAQ,GAAG;AACxD,WAAO,EAAE,MAAM,UAAU,SAAS,MAA4B;AAAA,EAChE;AAGA,MAAI,cAAc,SAAS,MAAM,QAAQ,MAAM,QAAQ,GAAG;AACxD,WAAO,EAAE,MAAM,WAAW,SAAS,MAA6B;AAAA,EAClE;AAGA,MAAI,YAAY,SAAS,MAAM,QAAQ,MAAM,MAAM,GAAG;AACpD,WAAO,EAAE,MAAM,WAAW,SAAS,MAA6B;AAAA,EAClE;AAEA,SAAO,EAAE,MAAM,WAAW,QAAQ;AACpC;;;AClBO,SAAS,gBAAgB,SAAiD;AAC/E,UAAQ,QAAQ,MAAM;AAAA,IACpB,KAAK;AACH,aAAO,EAAE,MAAM,QAAQ,QAAgC;AAAA,IACzD,KAAK;AACH,aAAO,EAAE,MAAM,SAAS,QAAiC;AAAA,IAC3D,KAAK;AACH,aAAO,EAAE,MAAM,SAAS,QAAiC;AAAA,IAC3D,KAAK;AACH,aAAO,EAAE,MAAM,SAAS,QAAiC;AAAA,IAC3D,KAAK;AACH,aAAO,EAAE,MAAM,YAAY,QAAoC;AAAA,IACjE,KAAK;AACH,aAAO,EAAE,MAAM,WAAW,QAAmC;AAAA,IAC/D,KAAK;AACH,aAAO,EAAE,MAAM,YAAY,QAAoC;AAAA,IACjE,KAAK;AACH,aAAO,EAAE,MAAM,YAAY,QAAoC;AAAA,IACjE,KAAK;AACH,aAAO,EAAE,MAAM,eAAe,QAAuC;AAAA,IACvE,KAAK;AACH,aAAO,EAAE,MAAM,YAAY,QAAoC;AAAA,IACjE,KAAK;AACH,aAAO,EAAE,MAAM,UAAU,QAAkC;AAAA,IAC7D,KAAK;AACH,aAAO,EAAE,MAAM,SAAS,QAAiC;AAAA,IAC3D,KAAK;AACH,aAAO,EAAE,MAAM,UAAU,QAAkC;AAAA,IAC7D,KAAK;AACH,aAAO,EAAE,MAAM,YAAY,QAAoC;AAAA,IACjE;AACE,aAAO,EAAE,MAAM,eAAe,QAAuC;AAAA,EACzE;AACF;;;AC9CA,IAAM,cAAc,oBAAI,IAAI,CAAC,SAAS,SAAS,SAAS,YAAY,SAAS,CAAC;AAMvE,SAAS,eAAe,SAAmD;AAChF,SAAO,YAAY,IAAI,QAAQ,IAAI;AACrC;AAMO,SAAS,eAAe,SAA8C;AAC3E,MAAI,CAAC,eAAe,OAAO,GAAG;AAC5B,WAAO;AAAA,EACT;AAEA,UAAQ,QAAQ,MAAM;AAAA,IACpB,KAAK;AACH,aAAQ,QAAyB,MAAM;AAAA,IACzC,KAAK;AACH,aAAQ,QAAyB,MAAM;AAAA,IACzC,KAAK;AACH,aAAQ,QAAyB,MAAM;AAAA,IACzC,KAAK;AACH,aAAQ,QAA4B,SAAS;AAAA,IAC/C,KAAK;AACH,aAAQ,QAA2B,QAAQ;AAAA,IAC7C;AACE,aAAO;AAAA,EACX;AACF;AAYO,SAAS,eAAe,SAAkD;AAC/E,QAAM,QAAQ,QAAQ,QAAQ,CAAC;AAC/B,QAAM,SAAS,OAAO,UAAU,CAAC;AACjC,QAAM,QAAQ,QAAQ;AAEtB,MAAI,CAAC,SAAS,EAAE,cAAc,UAAU,CAAC,MAAM,UAAU,QAAQ;AAC/D,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,MAAM,SAAS,CAAC;AAChC,QAAM,WAAW,MAAM;AAEvB,SAAO;AAAA,IACL,MAAM,QAAQ;AAAA,IACd,aAAa,QAAQ,SAAS;AAAA,IAC9B,eAAe,SAAS;AAAA,EAC1B;AACF;AAMO,SAAS,oBAAoB,SAAgC;AAClE,QAAM,eAAe,SAAS,QAAQ,WAAW,EAAE;AACnD,SAAO,IAAI,KAAK,eAAe,GAAI;AACrC;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "waba-toolkit",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Minimal, type-safe toolkit for WhatsApp Business API webhook processing and media handling",
   "type": "module",
   "engines": {
@@ -18,6 +18,8 @@
   "scripts": {
     "build": "tsup",
     "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
     "prepublishOnly": "npm run build"
   },
   "keywords": [
@@ -31,6 +33,7 @@
   "devDependencies": {
     "@types/node": "^25.0.3",
     "tsup": "^8.0.0",
-    "typescript": "^5.0.0"
+    "typescript": "^5.0.0",
+    "vitest": "^4.0.16"
   }
 }