@capxul/sdk 0.1.0-alpha.0

package/dist/webhooks.js

@@ -0,0 +1,116 @@
+// src/errors.ts
+var CapxulError = class extends Error {
+  code;
+  details;
+  operationId;
+  correlationId;
+  retryable;
+  constructor(init) {
+    super(
+      init.message,
+      init.cause !== void 0 ? { cause: init.cause } : void 0
+    );
+    this.name = "CapxulError";
+    this.code = init.code;
+    this.details = init.details;
+    this.operationId = init.operationId;
+    this.correlationId = init.correlationId;
+    this.retryable = init.retryable;
+  }
+};
+
+// ../config/src/timing.ts
+var WEBHOOK_FRESHNESS_WINDOW_MS = 5 * 60 * 1e3;
+
+// ../config/src/org-roles.ts
+function roleKeyFromLabel(label) {
+  const bytes = new TextEncoder().encode(label);
+  const hex = Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+  return "0x" + hex.padEnd(64, "0");
+}
+roleKeyFromLabel("OWNER");
+roleKeyFromLabel("FINANCE_MANAGER");
+roleKeyFromLabel("TEAM_LEAD");
+
+// src/webhooks.ts
+async function verifyWebhook(request, secret, options) {
+  if (!secret) {
+    throw new CapxulError({
+      code: "INVALID_INPUT",
+      message: "A webhook signing secret is required."
+    });
+  }
+  const timestamp = request.headers.get("x-capxul-timestamp");
+  const signature = request.headers.get("x-capxul-signature");
+  if (!timestamp || !signature) {
+    return { valid: false, reason: "invalid_signature" };
+  }
+  const timestampMs = Number(timestamp);
+  if (!Number.isFinite(timestampMs)) {
+    return { valid: false, reason: "malformed" };
+  }
+  const freshnessWindowMs = options?.freshnessWindowMs ?? WEBHOOK_FRESHNESS_WINDOW_MS;
+  if (Math.abs(Date.now() - timestampMs) > freshnessWindowMs) {
+    return { valid: false, reason: "replay" };
+  }
+  const body = await request.text();
+  const signatureHex = signature.startsWith("sha256=") ? signature.slice("sha256=".length) : signature;
+  if (!/^[a-f0-9]{64}$/i.test(signatureHex)) {
+    return { valid: false, reason: "invalid_signature" };
+  }
+  const validSignature = await verifyHmacSha256(
+    secret,
+    `${timestamp}.${body}`,
+    signatureHex
+  );
+  if (!validSignature) {
+    return { valid: false, reason: "invalid_signature" };
+  }
+  const parsed = parseWebhookEvent(body);
+  if (!parsed) {
+    return { valid: false, reason: "malformed" };
+  }
+  return { valid: true, event: parsed };
+}
+async function verifyHmacSha256(secret, message, signatureHex) {
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["verify"]
+  );
+  return await crypto.subtle.verify(
+    "HMAC",
+    key,
+    hexToArrayBuffer(signatureHex),
+    encoder.encode(message)
+  );
+}
+function hexToArrayBuffer(hex) {
+  const buffer = new ArrayBuffer(hex.length / 2);
+  const bytes = new Uint8Array(buffer);
+  for (let i = 0; i < bytes.length; i++) {
+    bytes[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return buffer;
+}
+function parseWebhookEvent(body) {
+  try {
+    const parsed = JSON.parse(body);
+    if (!isWebhookEvent(parsed)) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function isWebhookEvent(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return false;
+  }
+  const candidate = value;
+  return typeof candidate.id === "string" && typeof candidate.type === "string" && typeof candidate.createdAt === "string" && (candidate.operationId === void 0 || typeof candidate.operationId === "string") && (candidate.correlationId === void 0 || typeof candidate.correlationId === "string") && !!candidate.data && typeof candidate.data === "object" && !Array.isArray(candidate.data);
+}
+
+export { verifyWebhook };

package/package.json

@@ -0,0 +1,89 @@
+{
+  "name": "@capxul/sdk",
+  "version": "0.1.0-alpha.0",
+  "description": "Headless TypeScript client for Capxul's /v1/* HTTP contract.",
+  "license": "UNLICENSED",
+  "private": false,
+  "type": "module",
+  "homepage": "https://capxul.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Xelmar-tech/Capxul.git",
+    "directory": "packages/sdk"
+  },
+  "bugs": {
+    "url": "https://github.com/Xelmar-tech/Capxul/issues"
+  },
+  "author": "Capxul (Xelmar Tech Ltd.)",
+  "keywords": [
+    "capxul",
+    "sdk",
+    "stablecoin",
+    "payments",
+    "smart-account",
+    "typescript"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    },
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "import": "./dist/client.js",
+      "require": "./dist/client.cjs"
+    },
+    "./errors": {
+      "types": "./dist/errors.d.ts",
+      "import": "./dist/errors.js",
+      "require": "./dist/errors.cjs"
+    },
+    "./webhooks": {
+      "types": "./dist/webhooks.d.ts",
+      "import": "./dist/webhooks.js",
+      "require": "./dist/webhooks.cjs"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "xstate": "^5",
+    "@repo/api-contract": "0.0.0",
+    "@repo/backend": "0.0.0",
+    "@repo/config": "0.0.0",
+    "@repo/observability": "0.0.0",
+    "@repo/platform-kernel": "0.0.0"
+  },
+  "peerDependencies": {
+    "permissionless": ">=0.3.4 <0.4.0",
+    "viem": ">=2.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.15.3",
+    "permissionless": "0.3.4",
+    "tsup": "^8.5.1",
+    "typescript": "5.9.2",
+    "viem": "2.47.10",
+    "vitest": "^4.1.2",
+    "zod": "^4.3.6",
+    "@repo/typescript-config": "0.0.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "check-types": "tsc --noEmit",
+    "snapshot:api": "tsx scripts/snapshot-convex-api.ts",
+    "test": "vitest run",
+    "test:types": "vitest run --typecheck"
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts"
+}