@kypacs/sdk 1.0.0

package/dist/webhook-verification.d.ts

@@ -0,0 +1,21 @@
+export interface VerifyWebhookSignatureParams {
+    /** Raw request body string. */
+    payload: string;
+    /** Value of the X-PaciKYC-Signature header. */
+    signature: string;
+    /** Value of the X-PaciKYC-Timestamp header (unix seconds). */
+    timestamp: string;
+    /** Webhook signing secret (whsec_xxx). */
+    secret: string;
+    /** Maximum allowed age of the webhook in seconds. Default: 300 (5 minutes). */
+    tolerance?: number;
+}
+/**
+ * Verify a PaciKYC webhook signature.
+ *
+ * Signs `${timestamp}.${payload}` with HMAC-SHA256 using the webhook secret,
+ * then constant-time compares against the provided signature. Also rejects
+ * payloads whose timestamp is older than `tolerance` seconds.
+ */
+export declare function verifyWebhookSignature(params: VerifyWebhookSignatureParams): boolean;
+//# sourceMappingURL=webhook-verification.d.ts.map

package/dist/webhook-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-verification.d.ts","sourceRoot":"","sources":["../src/webhook-verification.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,4BAA4B;IAC3C,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAID;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,4BAA4B,GAAG,OAAO,CAyBpF"}

package/dist/webhook-verification.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyWebhookSignature = verifyWebhookSignature;
+const node_crypto_1 = require("node:crypto");
+const DEFAULT_TOLERANCE_SECONDS = 300;
+/**
+ * Verify a PaciKYC webhook signature.
+ *
+ * Signs `${timestamp}.${payload}` with HMAC-SHA256 using the webhook secret,
+ * then constant-time compares against the provided signature. Also rejects
+ * payloads whose timestamp is older than `tolerance` seconds.
+ */
+function verifyWebhookSignature(params) {
+    const { payload, signature, timestamp, secret, tolerance = DEFAULT_TOLERANCE_SECONDS } = params;
+    const ts = parseInt(timestamp, 10);
+    if (isNaN(ts)) {
+        return false;
+    }
+    const now = Math.floor(Date.now() / 1000);
+    if (Math.abs(now - ts) > tolerance) {
+        return false;
+    }
+    const signedContent = `${timestamp}.${payload}`;
+    const expectedSignature = (0, node_crypto_1.createHmac)('sha256', secret).update(signedContent).digest('hex');
+    if (signature.length !== expectedSignature.length) {
+        return false;
+    }
+    try {
+        return (0, node_crypto_1.timingSafeEqual)(Buffer.from(signature, 'hex'), Buffer.from(expectedSignature, 'hex'));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=webhook-verification.js.map

package/dist/webhook-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-verification.js","sourceRoot":"","sources":["../src/webhook-verification.ts"],"names":[],"mappings":";;AAwBA,wDAyBC;AAjDD,6CAA0D;AAe1D,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAEtC;;;;;;GAMG;AACH,SAAgB,sBAAsB,CAAC,MAAoC;IACzE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,GAAG,yBAAyB,EAAE,GAAG,MAAM,CAAC;IAEhG,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;IAChD,MAAM,iBAAiB,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE3F,IAAI,SAAS,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAA,6BAAe,EAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@kypacs/sdk",
+  "version": "1.0.0",
+  "description": "TypeScript SDK for the KYPACS API — typed methods for KYC/KYB verification, AML screening, and compliance management",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc --build",
+    "type-check": "tsc --noEmit",
+    "lint": "eslint \"src/**/*.ts\" --ignore-pattern \"**/*.spec.ts\"",
+    "test": "vitest run",
+    "test:integration": "vitest run --config vitest.integration.config.ts",
+    "generate-sdk": "bash ../../infrastructure/scripts/generate-sdk.sh"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.5"
+  }
+}