@boltclaw/referrals 0.0.0-stage → 0.4.0

package/dist/webhooks.js

@@ -0,0 +1,90 @@
+export class WebhookVerificationError extends Error {
+    reason;
+    constructor(reason) {
+        super(reason === "missing_header"
+            ? "The delivery has no X-BoltClaw-Timestamp or X-BoltClaw-Signature header."
+            : reason === "stale"
+                ? "The delivery's timestamp is outside the allowed window."
+                : reason === "bad_signature"
+                    ? "The delivery's signature does not match this secret."
+                    : "The delivery's body is not a JSON object.");
+        this.name = "WebhookVerificationError";
+        this.reason = reason;
+    }
+}
+export const WEBHOOK_TOLERANCE_SECONDS = 300;
+const encoder = new TextEncoder();
+function header(headers, name) {
+    if (typeof headers.get === "function") {
+        return headers.get(name);
+    }
+    const bag = headers;
+    const wanted = name.toLowerCase();
+    for (const key of Object.keys(bag)) {
+        if (key.toLowerCase() !== wanted)
+            continue;
+        const value = bag[key];
+        return Array.isArray(value) ? (value[0] ?? null) : (value ?? null);
+    }
+    return null;
+}
+function bodyBytes(raw) {
+    if (typeof raw === "string")
+        return encoder.encode(raw);
+    return raw instanceof Uint8Array ? raw : new Uint8Array(raw);
+}
+function sameHex(a, b) {
+    let diff = a.length ^ b.length;
+    for (let i = 0; i < Math.max(a.length, b.length); i++)
+        diff |= (a.charCodeAt(i) || 0) ^ (b.charCodeAt(i) || 0);
+    return diff === 0;
+}
+async function hmacHex(secret, data) {
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle)
+        throw new Error("Web Crypto is not available in this runtime.");
+    const key = await subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const copy = new Uint8Array(data.byteLength);
+    copy.set(data);
+    const mac = new Uint8Array(await subtle.sign("HMAC", key, copy));
+    let out = "";
+    for (const b of mac)
+        out += b.toString(16).padStart(2, "0");
+    return out;
+}
+export async function verifyWebhook(rawBody, headers, secret, options = {}) {
+    if (typeof secret !== "string" || secret.length === 0)
+        throw new TypeError("secret is the endpoint's signing secret.");
+    const timestamp = header(headers, "x-boltclaw-timestamp")?.trim() ?? "";
+    const signature = header(headers, "x-boltclaw-signature")?.trim() ?? "";
+    if (!timestamp || !signature)
+        throw new WebhookVerificationError("missing_header");
+    if (!/^\d{1,12}$/.test(timestamp))
+        throw new WebhookVerificationError("bad_signature");
+    const match = /^sha256=([0-9a-f]{64})$/.exec(signature);
+    if (!match)
+        throw new WebhookVerificationError("bad_signature");
+    const tolerance = options.toleranceSeconds ?? WEBHOOK_TOLERANCE_SECONDS;
+    const nowMs = options.now instanceof Date ? options.now.getTime() : typeof options.now === "number" ? options.now : Date.now();
+    if (Math.abs(Math.floor(nowMs / 1000) - Number(timestamp)) > tolerance)
+        throw new WebhookVerificationError("stale");
+    const body = bodyBytes(rawBody);
+    const prefix = encoder.encode(`${timestamp}.`);
+    const signed = new Uint8Array(prefix.byteLength + body.byteLength);
+    signed.set(prefix, 0);
+    signed.set(body, prefix.byteLength);
+    if (!sameHex(await hmacHex(secret, signed), match[1]))
+        throw new WebhookVerificationError("bad_signature");
+    let event;
+    try {
+        event = JSON.parse(new TextDecoder().decode(body));
+    }
+    catch {
+        throw new WebhookVerificationError("bad_body");
+    }
+    if (typeof event !== "object" || event === null || Array.isArray(event) || typeof event.event !== "string") {
+        throw new WebhookVerificationError("bad_body");
+    }
+    return event;
+}
+//# sourceMappingURL=webhooks.js.map

package/dist/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AA8BA,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,MAAM,CAA6B;IAE5C,YAAY,MAAkC;QAC5C,KAAK,CACH,MAAM,KAAK,gBAAgB;YACzB,CAAC,CAAC,0EAA0E;YAC5E,CAAC,CAAC,MAAM,KAAK,OAAO;gBAClB,CAAC,CAAC,yDAAyD;gBAC3D,CAAC,CAAC,MAAM,KAAK,eAAe;oBAC1B,CAAC,CAAC,sDAAsD;oBACxD,CAAC,CAAC,2CAA2C,CACpD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAcD,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAE7C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,SAAS,MAAM,CAAC,OAAqB,EAAE,IAAY;IACjD,IAAI,OAAQ,OAA6B,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC7D,OAAQ,OAAgD,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,GAAG,GAAG,OAAwD,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM;YAAE,SAAS;QAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,GAAsC;IACvD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxD,OAAO,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAC/D,CAAC;AAGD,SAAS,OAAO,CAAC,CAAS,EAAE,CAAS;IACnC,IAAI,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/G,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,IAAgB;IACrD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACtH,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACf,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACjE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,GAAG;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5D,OAAO,GAAG,CAAC;AACb,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAA0C,EAC1C,OAAqB,EACrB,MAAc,EACd,UAAgC,EAAE;IAElC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC;IACvH,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,sBAAsB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,sBAAsB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxE,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IACnF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,wBAAwB,CAAC,eAAe,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,wBAAwB,CAAC,eAAe,CAAC,CAAC;IAEhE,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,IAAI,yBAAyB,CAAC;IACxE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,YAAY,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/H,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,SAAS;QAAE,MAAM,IAAI,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAEpH,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IACnE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACtB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO,CAAC,MAAM,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC;QAAE,MAAM,IAAI,wBAAwB,CAAC,eAAe,CAAC,CAAC;IAE5G,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAQ,KAA6B,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACpI,MAAM,IAAI,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAqB,CAAC;AAC/B,CAAC"}

package/package.json

@@ -1,6 +1,97 @@
-{
-  "name": "@boltclaw/referrals",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+{
+  "name": "@boltclaw/referrals",
+  "version": "0.4.0",
+  "description": "Bolt Claw referrals for your product: a typed client generated from the API's spec, report signups with both dates right, sales and refunds from your server, keep the referral code through Safari with a proxy for Next.js and Express, verify webhooks, read a program's numbers, and drop in the invite-a-friend panel (script, React or web component).",
+  "keywords": [
+    "boltclaw",
+    "bolt claw",
+    "referral",
+    "referrals",
+    "referral program",
+    "affiliate",
+    "invite a friend",
+    "refer a friend",
+    "embed",
+    "widget",
+    "react",
+    "web component",
+    "sdk",
+    "conversion tracking",
+    "webhook",
+    "middleware",
+    "nextjs",
+    "express"
+  ],
+  "license": "MIT",
+  "author": "Bolt Claw",
+  "homepage": "https://boltclaw.ai/docs/api",
+  "bugs": {
+    "email": "support@boltclaw.ai"
+  },
+  "type": "module",
+  "sideEffects": [
+    "./dist/element.js"
+  ],
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./react": {
+      "types": "./dist/react.d.ts",
+      "default": "./dist/react.js"
+    },
+    "./element": {
+      "types": "./dist/element.d.ts",
+      "default": "./dist/element.js"
+    },
+    "./server": {
+      "types": "./dist/server-index.d.ts",
+      "default": "./dist/server-index.js"
+    },
+    "./api": {
+      "types": "./dist/generated/api.d.ts",
+      "default": "./dist/generated/api.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json",
+    "pretest": "tsc",
+    "test": "vitest run",
+    "smoke": "npm run build && node scripts/smoke.mjs",
+    "prepublishOnly": "npm run build && npm test && node scripts/smoke.mjs"
+  },
+  "peerDependencies": {
+    "react": ">=18"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/node": "20.19.33",
+    "@types/react": "19.2.7",
+    "@types/react-dom": "19.2.3",
+    "happy-dom": "20.0.11",
+    "react": "19.2.3",
+    "react-dom": "19.2.3",
+    "typescript": "5.9.3",
+    "vitest": "4.0.18"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}