whisp-js 0.0.0-stage → 0.1.0

package/dist/cjs/types.d.ts

@@ -0,0 +1,516 @@
+/**
+ * The public API's shapes, written by hand (phase2-design 12.1): the SDK is
+ * published on its own and can't depend on the monorepo's packages. Each type
+ * here equals `Static<typeof X>` of its schema in `packages/schema/src/public`
+ * (packages/sdk/test/types.test.ts checks it at compile time, so `bun
+ * typecheck` fails on drift).
+ *
+ * The API only grows (4.1): a field can be added, never renamed, removed or
+ * retyped, and a new value of a union is announced in the changelog first.
+ * Times are ISO 8601 with milliseconds; phones are WhatsApp digits without
+ * `+` (`972501234567`).
+ */
+export type NumberStatus = 'pairing' | 'connecting' | 'connected' | 'disconnected';
+export type DisconnectReason = 'logged_out' | 'replaced' | 'bad_session' | 'locked' | 'temp_banned' | 'banned' | 'client_rejected' | 'unknown' | 'pairing_expired' | 'pairing_failed' | 'unlinked' | 'project_deleted';
+export type RiskLevel = 'healthy' | 'watch' | 'at_risk';
+/** What a risk reason is about: one of the seven signals, or one of WhatsApp's own warnings. */
+export type RiskSignal = 'volume' | 'to_new' | 'reply_rate' | 'failed' | 'newly_linked' | 'disconnects' | 'burst' | 'wa_reachout_timelock' | 'wa_message_cap';
+export type ChatKind = 'direct' | 'group';
+export type LabelColor = 'green' | 'blue' | 'purple' | 'amber' | 'red' | 'grey';
+export type MessageStatus = 'pending' | 'sent' | 'delivered' | 'read' | 'played' | 'failed';
+export type MediaState = 'pending' | 'ready' | 'too_large' | 'expired' | 'failed';
+export type MediaKind = 'image' | 'video' | 'audio' | 'voice' | 'document' | 'sticker';
+/**
+ * `auto`: the reply Whisp sends to a rejected call, when the number is set
+ * up to. `system`: an alert Whisp itself sends from an operations number.
+ */
+export type SentBy = 'phone' | 'member' | 'api' | 'auto' | 'system';
+export type PresenceState = 'available' | 'unavailable' | 'composing' | 'recording' | 'paused';
+export type ProjectEnvironment = 'production' | 'testing';
+export type UploadKind = 'image' | 'video' | 'document' | 'voice';
+/** How a pool picks its number; `healthiest` is the default. */
+export type SendStrategy = 'healthiest' | 'random' | 'round-robin';
+export type ChatChange = 'unread' | 'done' | 'pinned' | 'assignee' | 'labels' | 'title' | 'ephemeral';
+export type CursorRejection = 'cursor_unknown' | 'cursor_expired';
+/** Every message type but the inbox's own `waiting` stubs and `system` lines. */
+export type MessageType = 'text' | 'image' | 'video' | 'audio' | 'voice' | 'document' | 'sticker' | 'location' | 'contact' | 'poll' | 'unsupported';
+/** PLAN's twelve public event types (6.1). */
+export type PublicEventType = 'message.received' | 'message.sent' | 'message.status' | 'message.reaction' | 'message.deleted' | 'chat.updated' | 'presence.updated' | 'group.updated' | 'group.participants' | 'number.status' | 'number.risk' | 'call.received';
+/** Someone on WhatsApp. `phone` is null for a LID-only contact. */
+export type Actor = {
+    phone: string | null;
+    lid: string | null;
+    name: string | null;
+};
+/**
+ * One of the project's WhatsApp numbers. `risk` is null until the number was
+ * first linked. `healthScore`: 0 to 100, lower is healthier (the worst of its
+ * risk signals: under 50 healthy, 50 to 79 watch, 80 and up at risk), at
+ * least 30 until it sent 20 messages in the last 24 hours (new or idle), null
+ * until its first evaluation; `healthiest` pools prefer lower scores, in bands
+ * of 10. `paused`: sends from the API are refused with 409 NUMBER_PAUSED (a
+ * pool skips it). `capReached`: it sent its daily cap in the last 24 hours,
+ * so sends are refused with 429 DAILY_CAP_REACHED.
+ */
+export type WhatsAppNumber = {
+    id: string;
+    phone: string;
+    name: string;
+    status: NumberStatus;
+    disconnectReason: DisconnectReason | null;
+    disconnectedAt: string | null;
+    waName: string | null;
+    platform: string | null;
+    linkedAt: string | null;
+    risk: RiskLevel | null;
+    healthScore: number | null;
+    paused: boolean;
+    capReached: boolean;
+    last24h: {
+        sent: number;
+        received: number;
+    };
+};
+export type Label = {
+    id: string;
+    name: string;
+    color: LabelColor;
+};
+export type Assignee = {
+    id: string;
+    name: string;
+};
+/** A chat of one of the project's numbers. */
+export type Chat = {
+    id: string;
+    numberId: string;
+    /** The Whisp number's phone. */
+    number: string;
+    kind: ChatKind;
+    jid: string;
+    /** Null for groups and LID-only contacts. */
+    phone: string | null;
+    lid: string | null;
+    title: string;
+    unread: number;
+    done: boolean;
+    pinned: boolean;
+    assignee: Assignee | null;
+    labels: Label[];
+    participantCount: number | null;
+    lastMessageAt: string;
+};
+/** A message's file. Download it with `downloadMedia`, never from `url` with your token attached elsewhere. */
+export type MessageMedia = {
+    kind: MediaKind;
+    mime: string | null;
+    size: number | null;
+    fileName: string | null;
+    width: number | null;
+    height: number | null;
+    durationMs: number | null;
+    pages: number | null;
+    state: MediaState;
+    url: string;
+};
+/** What a reply points at; `text` cut to 1024 characters. */
+export type MessageQuoted = {
+    id: string | null;
+    waId: string;
+    fromMe: boolean;
+    type: string;
+    text: string | null;
+};
+export type MessageChat = {
+    kind: ChatKind;
+    jid: string;
+    phone: string | null;
+    title: string | null;
+};
+export type LocationContent = {
+    kind: 'location';
+    lat: number;
+    lng: number;
+    name: string | null;
+    address: string | null;
+};
+export type ContactCardContent = {
+    kind: 'contact';
+    name: string;
+    phones: string[];
+};
+export type PollContent = {
+    kind: 'poll';
+    question: string;
+    options: string[];
+    selectable: number;
+};
+export type MessageContent = LocationContent | ContactCardContent | PollContent;
+export type MessageError = {
+    code: string;
+    message: string;
+};
+/** One message, inbound or outbound. `from` is `sender.phone`; `to` is null in groups. */
+export type Message = {
+    id: string;
+    /** WhatsApp's id; null only while an outbound message waits to be sent. */
+    waId: string | null;
+    /** The Whisp number's phone. */
+    number: string;
+    numberId: string;
+    chatId: string;
+    chat: MessageChat;
+    fromMe: boolean;
+    from: string | null;
+    sender: Actor;
+    to: string | null;
+    type: MessageType;
+    /** The body or the caption. */
+    text: string | null;
+    media: MessageMedia | null;
+    quoted: MessageQuoted | null;
+    content: MessageContent | null;
+    status: MessageStatus;
+    error: MessageError | null;
+    /** Who sent an outbound message; null for inbound ones. */
+    sentBy: SentBy | null;
+    /** Your `reference` from the send. */
+    reference: string | null;
+    at: string;
+    editedAt: string | null;
+    deletedAt: string | null;
+};
+/** The number an event happened on. */
+export type EventNumber = {
+    id: string;
+    phone: string;
+};
+export type MessageStatusData = {
+    messageId: string;
+    waId: string | null;
+    chatId: string;
+    to: string | null;
+    status: 'delivered' | 'read' | 'played' | 'failed';
+    previousStatus: MessageStatus;
+    error: MessageError | null;
+    reference: string | null;
+    at: string;
+};
+export type MessageReactionData = {
+    messageId: string;
+    waId: string | null;
+    chatId: string;
+    emoji: string;
+    removed: boolean;
+    fromMe: boolean;
+    actor: Actor | null;
+    reference: string | null;
+    at: string;
+};
+export type MessageDeletedData = {
+    messageId: string;
+    waId: string | null;
+    chatId: string;
+    fromMe: boolean;
+    deletedBy: Actor | null;
+    reference: string | null;
+    at: string;
+};
+export type ChatUpdatedData = {
+    chat: Chat;
+    changes: ChatChange[];
+};
+export type PresenceUpdatedData = {
+    chatId: string;
+    chat: {
+        kind: ChatKind;
+        jid: string;
+        phone: string | null;
+    };
+    state: PresenceState;
+    participant: Actor | null;
+    at: string;
+};
+export type GroupUpdatedData = {
+    chatId: string;
+    jid: string;
+    changes: {
+        subject?: string;
+        description?: string | null;
+        announce?: boolean;
+        restrict?: boolean;
+        joinApprovalMode?: boolean;
+        memberAddMode?: boolean;
+        ephemeralDuration?: number | null;
+    };
+    by: Actor | null;
+    at: string;
+};
+export type GroupParticipantsData = {
+    chatId: string;
+    jid: string;
+    action: 'add' | 'remove' | 'promote' | 'demote' | 'modify';
+    participants: Actor[];
+    by: Actor | null;
+    at: string;
+};
+export type NumberStatusData = {
+    status: NumberStatus;
+    previousStatus: NumberStatus;
+    reason: DisconnectReason | null;
+    detail: {
+        code: number | null;
+        until: string | null;
+    } | null;
+    at: string;
+};
+/** One reason for a risk change: the signal, its level, its value and the English sentence. */
+export type RiskReason = {
+    signal: RiskSignal;
+    level: RiskLevel;
+    value: number | null;
+    text: string;
+};
+export type NumberRiskData = {
+    risk: RiskLevel;
+    previousRisk: RiskLevel;
+    /** The first reason's sentence. */
+    reason: string;
+    /** At most two. */
+    reasons: RiskReason[];
+    /** Sending is paused on the number after this change: route sends elsewhere. */
+    paused: boolean;
+    at: string;
+};
+export type CallReceivedData = {
+    callId: string;
+    from: Actor;
+    chatId: string | null;
+    video: boolean;
+    group: boolean;
+    /** Delivered after a reconnect; the call is already over. */
+    offline: boolean;
+    /** The number rejected it (its "Reject calls" setting). */
+    rejected: boolean;
+    at: string;
+};
+/** Each type's `data`. */
+export type EventData = {
+    'message.received': Message;
+    'message.sent': Message;
+    'message.status': MessageStatusData;
+    'message.reaction': MessageReactionData;
+    'message.deleted': MessageDeletedData;
+    'chat.updated': ChatUpdatedData;
+    'presence.updated': PresenceUpdatedData;
+    'group.updated': GroupUpdatedData;
+    'group.participants': GroupParticipantsData;
+    'number.status': NumberStatusData;
+    'number.risk': NumberRiskData;
+    'call.received': CallReceivedData;
+};
+/** The envelope: the SSE `data:`, an item of `GET /events` and a webhook body are this same object. */
+export type EventOf<T extends PublicEventType> = {
+    /** The event id: the dedupe key. Not the resume cursor. */
+    id: string;
+    type: T;
+    /** When the change committed. */
+    createdAt: string;
+    projectId: string;
+    number: EventNumber;
+    data: EventData[T];
+};
+/** One public event, narrowed by `type`. */
+export type PublicEvent = {
+    [T in PublicEventType]: EventOf<T>;
+}[PublicEventType];
+/** The test delivery's body: the envelope with `number: null`, sent only to webhooks. */
+export type WebhookTestEvent = {
+    id: string;
+    type: 'webhook.test';
+    createdAt: string;
+    projectId: string;
+    number: null;
+    data: {
+        webhookId: string;
+        message: string;
+    };
+};
+/** What a webhook receives; `verifyWebhook` returns it typed by `type`. */
+export type WebhookEvent = PublicEvent | WebhookTestEvent;
+/** The stream's first event: whether the resume asked for was honoured, and why not. */
+export type StreamReady = {
+    resumed: boolean;
+    reason?: CursorRejection;
+};
+/** The stream's last event before a deliberate close (`TOKEN_REVOKED`, `SHUTDOWN`). */
+export type StreamError = {
+    code: string;
+    message: string;
+};
+/** `GET /events`, ascending; `nextAfter` is the cursor to ask with next. */
+export type EventList = {
+    events: PublicEvent[];
+    nextAfter: string | null;
+};
+/** A file you uploaded (POST /uploads), or an https URL the server downloads. */
+export type MediaInput = {
+    uploadId: string;
+} | {
+    url: string;
+    fileName?: string;
+    mime?: string;
+};
+/** `POST /messages`: text, a file or a voice note, from a number, a pool or the whole project. */
+export type SendMessageBody = {
+    to: string;
+    replyTo?: string;
+    reference?: string;
+    wait?: boolean | number;
+    dailyCap?: number;
+    type?: 'text';
+    text: string;
+    from?: string | string[];
+    strategy?: SendStrategy;
+    sticky?: boolean;
+} | {
+    to: string;
+    replyTo?: string;
+    reference?: string;
+    wait?: boolean | number;
+    dailyCap?: number;
+    type: 'image' | 'video' | 'document';
+    media: MediaInput;
+    caption?: string;
+    from?: string | string[];
+    strategy?: SendStrategy;
+    sticky?: boolean;
+} | {
+    to: string;
+    replyTo?: string;
+    reference?: string;
+    wait?: boolean | number;
+    dailyCap?: number;
+    type: 'voice';
+    media: MediaInput;
+    from?: string | string[];
+    strategy?: SendStrategy;
+    sticky?: boolean;
+};
+/** `POST /numbers/:number/messages`: the same without the pool fields. */
+export type SendFromNumberBody = {
+    to: string;
+    replyTo?: string;
+    reference?: string;
+    wait?: boolean | number;
+    dailyCap?: number;
+    type?: 'text';
+    text: string;
+} | {
+    to: string;
+    replyTo?: string;
+    reference?: string;
+    wait?: boolean | number;
+    dailyCap?: number;
+    type: 'image' | 'video' | 'document';
+    media: MediaInput;
+    caption?: string;
+} | {
+    to: string;
+    replyTo?: string;
+    reference?: string;
+    wait?: boolean | number;
+    dailyCap?: number;
+    type: 'voice';
+    media: MediaInput;
+};
+/** `POST /numbers/:number/messages/media`: files and voice notes only. */
+export type SendMediaFromNumberBody = {
+    to: string;
+    replyTo?: string;
+    reference?: string;
+    wait?: boolean | number;
+    dailyCap?: number;
+    type: 'image' | 'video' | 'document';
+    media: MediaInput;
+    caption?: string;
+} | {
+    to: string;
+    replyTo?: string;
+    reference?: string;
+    wait?: boolean | number;
+    dailyCap?: number;
+    type: 'voice';
+    media: MediaInput;
+};
+/** `GET /project`: the token's project. */
+export type ProjectInfo = {
+    project: {
+        id: string;
+        slug: string;
+        name: string;
+        environment: ProjectEnvironment;
+        defaultNumberId: string | null;
+    };
+    token: {
+        last4: string;
+        createdAt: string;
+    };
+};
+export type NumberList = {
+    numbers: WhatsAppNumber[];
+};
+/** `GET /numbers/:number/check/:phone`: `jid` is the server's form when the phone exists. */
+export type PhoneCheck = {
+    phone: string;
+    exists: boolean;
+    jid: string | null;
+};
+export type MessageList = {
+    messages: Message[];
+};
+/** `GET /messages/:messageId/media?redirect=0`. */
+export type MediaLink = {
+    url: string;
+    expiresAt: string;
+};
+export type ChatListQuery = {
+    kind?: ChatKind;
+    unread?: boolean;
+    done?: boolean;
+    cursor?: string;
+    limit?: number;
+};
+export type ChatList = {
+    chats: Chat[];
+    nextCursor: string | null;
+};
+export type ChatMessagesQuery = {
+    before?: string;
+    after?: string;
+    limit?: number;
+};
+export type ChatMessageList = {
+    messages: Message[];
+    nextCursor: string | null;
+};
+/** `POST /uploads`. */
+export type UploadRequest = {
+    kind: UploadKind;
+    mime: string;
+    size: number;
+    name: string;
+};
+/** PUT the bytes to `url` with exactly `headers` before `expiresAt`, then send with `{ media: { uploadId } }`. */
+export type Upload = {
+    uploadId: string;
+    url: string;
+    headers: Record<string, string>;
+    expiresAt: string;
+};
+/** Every error the API answers. `code` is stable; `params` carries the values it names. */
+export type ApiError = {
+    code: string;
+    message: string;
+    params?: Record<string, string | number>;
+};

package/dist/cjs/types.js

@@ -0,0 +1,14 @@
+"use strict";
+/**
+ * The public API's shapes, written by hand (phase2-design 12.1): the SDK is
+ * published on its own and can't depend on the monorepo's packages. Each type
+ * here equals `Static<typeof X>` of its schema in `packages/schema/src/public`
+ * (packages/sdk/test/types.test.ts checks it at compile time, so `bun
+ * typecheck` fails on drift).
+ *
+ * The API only grows (4.1): a field can be added, never renamed, removed or
+ * retyped, and a new value of a union is announced in the changelog first.
+ * Times are ISO 8601 with milliseconds; phones are WhatsApp digits without
+ * `+` (`972501234567`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/version.d.ts

@@ -0,0 +1,2 @@
+/** The package's version: sent in the User-Agent. packages/sdk/test/constants.test.ts keeps it equal to package.json's. */
+export declare const SDK_VERSION = "0.1.0";

package/dist/cjs/version.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SDK_VERSION = void 0;
+/** The package's version: sent in the User-Agent. packages/sdk/test/constants.test.ts keeps it equal to package.json's. */
+exports.SDK_VERSION = '0.1.0';

package/dist/cjs/webhook.d.ts

@@ -0,0 +1,27 @@
+import type { WebhookEvent } from './types.js';
+export interface VerifyWebhookInput {
+    /** The raw request body, before any JSON parsing: `await request.text()`, or the Buffer of `express.raw()`. */
+    body: string | Uint8Array | ArrayBuffer;
+    /** The `X-Whisp-Signature` header (`request.headers.get('x-whisp-signature')`). */
+    signature: string | null | undefined;
+    /** The endpoint's signing secret (`wsp_whs_…`); several are tried in turn. */
+    secret: string | readonly string[] | null | undefined;
+    /** How far the signature's time may be from now, in seconds. Default 300. */
+    toleranceSeconds?: number;
+    /** "Now" in Unix milliseconds, for tests. Default `Date.now()`. */
+    now?: number;
+}
+interface ParsedHeader {
+    timestamp: number;
+    signatures: string[];
+}
+/** `t` and every `v1`; other keys (a later `v2`) are ignored. Null when malformed, or without `t` or `v1`. */
+export declare const parseSignatureHeader: (header: string) => ParsedHeader | null;
+/**
+ * The event the request carries, typed by `type` (`webhook.test` included),
+ * or throws WhispSignatureError with `reason` 'missing', 'malformed',
+ * 'timestamp' or 'mismatch'. A missing or mistyped secret throws a WhispError
+ * (SECRET_MISSING, SECRET_INVALID), which is a setup problem, not a bad request.
+ */
+export declare const verifyWebhook: (input: VerifyWebhookInput) => Promise<WebhookEvent>;
+export {};

package/dist/cjs/webhook.js

@@ -0,0 +1,128 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyWebhook = exports.parseSignatureHeader = void 0;
+/**
+ * `verifyWebhook` (phase2-design 7.3, 12.5): checks `X-Whisp-Signature` on a
+ * webhook request and returns the event.
+ *
+ * The header is `t=<unix seconds>,v1=<hex>[,v1=<hex>]`: one `v1` per secret
+ * the endpoint signs with (two during a rotation's 24 h grace, 7.7). Each `v1`
+ * is the lowercase hex HMAC-SHA256, keyed with the whole `wsp_whs_…` secret
+ * as UTF-8, over `<t>.<raw body>`. A request passes when the header parses,
+ * `|now - t|` is within the tolerance (300 s by default) and any `v1` matches.
+ *
+ * Web Crypto's `subtle.verify` compares in constant time. It is async, so
+ * this is. Core's synchronous `verifySignatureHeader` signs the same way for
+ * the server; packages/sdk/test/webhook.test.ts holds the two together.
+ */
+const constants_ts_1 = require("./constants.js");
+const errors_ts_1 = require("./errors.js");
+const encoder = new TextEncoder();
+const TIMESTAMP = /^\d{1,12}$/;
+const HEX_SIGNATURE = /^[0-9a-f]{64}$/;
+/** `t` and every `v1`; other keys (a later `v2`) are ignored. Null when malformed, or without `t` or `v1`. */
+const parseSignatureHeader = (header) => {
+    let timestamp = null;
+    const signatures = [];
+    for (const part of header.split(',')) {
+        const separator = part.indexOf('=');
+        if (separator < 1)
+            return null;
+        const key = part.slice(0, separator).trim();
+        const value = part.slice(separator + 1).trim();
+        if (key === 't') {
+            if (timestamp !== null || !TIMESTAMP.test(value))
+                return null;
+            timestamp = Number(value);
+        }
+        else if (key === 'v1') {
+            const lower = value.toLowerCase();
+            if (!HEX_SIGNATURE.test(lower))
+                return null;
+            signatures.push(lower);
+        }
+    }
+    return timestamp === null || signatures.length === 0 ? null : { timestamp, signatures };
+};
+exports.parseSignatureHeader = parseSignatureHeader;
+const hexToBytes = (hex) => {
+    const out = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < out.length; i++)
+        out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    return out;
+};
+const toBytes = (body) => typeof body === 'string' ? encoder.encode(body) : body instanceof Uint8Array ? body : new Uint8Array(body);
+const secretsOf = (secret) => {
+    const list = (typeof secret === 'string' ? [secret] : (secret ?? [])).map(value => typeof value === 'string' ? value.trim() : '');
+    if (list.length === 0 || list.every(value => value === '')) {
+        throw (0, errors_ts_1.localError)('SECRET_MISSING', "verifyWebhook needs the endpoint's signing secret (wsp_whs_…); is its environment variable set?");
+    }
+    for (const value of list) {
+        if (!constants_ts_1.WEBHOOK_SECRET_PATTERN.test(value)) {
+            throw (0, errors_ts_1.localError)('SECRET_INVALID', "The secret is not a webhook signing secret (wsp_whs_…). Copy it again from the project's Webhooks tab.");
+        }
+    }
+    return list;
+};
+/**
+ * The event the request carries, typed by `type` (`webhook.test` included),
+ * or throws WhispSignatureError with `reason` 'missing', 'malformed',
+ * 'timestamp' or 'mismatch'. A missing or mistyped secret throws a WhispError
+ * (SECRET_MISSING, SECRET_INVALID), which is a setup problem, not a bad request.
+ */
+const verifyWebhook = async (input) => {
+    const secrets = secretsOf(input.secret);
+    const tolerance = input.toleranceSeconds ?? constants_ts_1.SIGNATURE_TOLERANCE_SECONDS;
+    if (!Number.isFinite(tolerance) || tolerance < 0) {
+        throw (0, errors_ts_1.localError)('OPTIONS_INVALID', 'toleranceSeconds must be a number of seconds, 0 or more');
+    }
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle)
+        throw (0, errors_ts_1.localError)('CRYPTO_UNAVAILABLE', 'verifyWebhook needs Web Crypto (crypto.subtle)');
+    const header = typeof input.signature === 'string' ? input.signature : '';
+    if (header.trim() === '')
+        throw new errors_ts_1.WhispSignatureError('missing');
+    const parsed = (0, exports.parseSignatureHeader)(header);
+    if (!parsed)
+        throw new errors_ts_1.WhispSignatureError('malformed');
+    const nowSec = Math.floor((input.now ?? Date.now()) / 1_000);
+    if (Math.abs(nowSec - parsed.timestamp) > tolerance)
+        throw new errors_ts_1.WhispSignatureError('timestamp');
+    const body = toBytes(input.body);
+    const prefix = encoder.encode(`${parsed.timestamp}.`);
+    const message = new Uint8Array(prefix.length + body.length);
+    message.set(prefix);
+    message.set(body, prefix.length);
+    let matched = false;
+    for (const secret of secrets) {
+        const key = await subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, [
+            'verify',
+        ]);
+        for (const signature of parsed.signatures) {
+            if (await subtle.verify('HMAC', key, hexToBytes(signature), message)) {
+                matched = true;
+                break;
+            }
+        }
+        if (matched)
+            break;
+    }
+    if (!matched)
+        throw new errors_ts_1.WhispSignatureError('mismatch');
+    let event;
+    try {
+        event = JSON.parse(typeof input.body === 'string' ? input.body : new TextDecoder().decode(body));
+    }
+    catch {
+        event = undefined;
+    }
+    const record = event;
+    if (typeof record !== 'object' ||
+        record === null ||
+        typeof record.id !== 'string' ||
+        typeof record.type !== 'string') {
+        throw new errors_ts_1.WhispSignatureError('malformed', 'The body is signed but is not a Whisp event');
+    }
+    return event;
+};
+exports.verifyWebhook = verifyWebhook;