@playmos/sdk 0.1.4 → 0.1.6

package/dist/server.d.cts

@@ -0,0 +1,26 @@
+import { k as PlaymosError, W as WebhookEvent } from './errors-B-85VYMv.cjs';
+
+/**
+ * Webhook signature verification (spec §6.2) — server-side only.
+ *
+ * Signature scheme (mirrors the Playmos service byte-for-byte):
+ *   header `X-Playmos-Signature: t=<unixSeconds>,v1=<hex>`
+ *   where <hex> = HMAC_SHA256(secret, `${t}.${rawBody}`)
+ *
+ * Verify BEFORE trusting an event. Uses node:crypto (constant-time compare) and
+ * rejects stale timestamps to blunt replay. Throws on any mismatch.
+ */
+
+declare class WebhookSignatureError extends PlaymosError {
+    constructor(message: string);
+}
+/**
+ * Verify a webhook and return the parsed event. `rawBody` MUST be the exact raw
+ * request bytes (use express.raw / fastify rawBody) — a re-serialized JSON body
+ * will not match the signature.
+ */
+declare function verifyWebhook(rawBody: string | Buffer, signatureHeader: string | string[] | undefined, secret: string, opts?: {
+    toleranceSeconds?: number;
+}): WebhookEvent;
+
+export { WebhookSignatureError, verifyWebhook };

package/dist/server.d.ts

@@ -0,0 +1,26 @@
+import { k as PlaymosError, W as WebhookEvent } from './errors-B-85VYMv.js';
+
+/**
+ * Webhook signature verification (spec §6.2) — server-side only.
+ *
+ * Signature scheme (mirrors the Playmos service byte-for-byte):
+ *   header `X-Playmos-Signature: t=<unixSeconds>,v1=<hex>`
+ *   where <hex> = HMAC_SHA256(secret, `${t}.${rawBody}`)
+ *
+ * Verify BEFORE trusting an event. Uses node:crypto (constant-time compare) and
+ * rejects stale timestamps to blunt replay. Throws on any mismatch.
+ */
+
+declare class WebhookSignatureError extends PlaymosError {
+    constructor(message: string);
+}
+/**
+ * Verify a webhook and return the parsed event. `rawBody` MUST be the exact raw
+ * request bytes (use express.raw / fastify rawBody) — a re-serialized JSON body
+ * will not match the signature.
+ */
+declare function verifyWebhook(rawBody: string | Buffer, signatureHeader: string | string[] | undefined, secret: string, opts?: {
+    toleranceSeconds?: number;
+}): WebhookEvent;
+
+export { WebhookSignatureError, verifyWebhook };

package/dist/server.js

@@ -0,0 +1,47 @@
+import { PlaymosError } from './chunk-B7SHFZYY.js';
+import { timingSafeEqual, createHmac } from 'crypto';
+
+var WebhookSignatureError = class extends PlaymosError {
+  constructor(message) {
+    super("api_error", `Webhook signature verification failed: ${message}`);
+  }
+};
+function parseHeader(header) {
+  const parts = Object.fromEntries(
+    header.split(",").map((kv) => {
+      const [k, v] = kv.split("=");
+      return [k?.trim(), v?.trim()];
+    })
+  );
+  const t = Number(parts["t"]);
+  const v1 = parts["v1"];
+  if (!Number.isFinite(t) || !v1) throw new WebhookSignatureError("malformed signature header");
+  return { t, v1 };
+}
+function computeSignature(secret, t, rawBody) {
+  return createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
+}
+function verifyWebhook(rawBody, signatureHeader, secret, opts = {}) {
+  if (!signatureHeader || Array.isArray(signatureHeader)) {
+    throw new WebhookSignatureError("missing signature header");
+  }
+  if (!secret) throw new WebhookSignatureError("missing signing secret");
+  const body = typeof rawBody === "string" ? rawBody : rawBody.toString("utf8");
+  const { t, v1 } = parseHeader(signatureHeader);
+  const tolerance = opts.toleranceSeconds ?? 300;
+  const nowSec = Math.floor(Date.now() / 1e3);
+  if (Math.abs(nowSec - t) > tolerance) {
+    throw new WebhookSignatureError(`timestamp outside tolerance (${tolerance}s)`);
+  }
+  const expected = computeSignature(secret, t, body);
+  const a = Buffer.from(expected, "hex");
+  const b = Buffer.from(v1, "hex");
+  if (a.length !== b.length || !timingSafeEqual(a, b)) {
+    throw new WebhookSignatureError("signature mismatch");
+  }
+  return JSON.parse(body);
+}
+
+export { WebhookSignatureError, verifyWebhook };
+//# sourceMappingURL=server.js.map
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/webhooks.ts"],"names":[],"mappings":";;;AAeO,IAAM,qBAAA,GAAN,cAAoC,YAAA,CAAa;AAAA,EACtD,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,WAAA,EAAa,CAAA,uCAAA,EAA0C,OAAO,CAAA,CAAE,CAAA;AAAA,EACxE;AACF;AAEA,SAAS,YAAY,MAAA,EAA2C;AAC9D,EAAA,MAAM,QAAQ,MAAA,CAAO,WAAA;AAAA,IACnB,OAAO,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,EAAA,KAAO;AAC5B,MAAA,MAAM,CAAC,CAAA,EAAG,CAAC,CAAA,GAAI,EAAA,CAAG,MAAM,GAAG,CAAA;AAC3B,MAAA,OAAO,CAAC,CAAA,EAAG,IAAA,EAAK,EAAG,CAAA,EAAG,MAAM,CAAA;AAAA,IAC9B,CAAC;AAAA,GACH;AACA,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,GAAG,CAAC,CAAA;AAC3B,EAAA,MAAM,EAAA,GAAK,MAAM,IAAI,CAAA;AACrB,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,IAAK,CAAC,EAAA,EAAI,MAAM,IAAI,qBAAA,CAAsB,4BAA4B,CAAA;AAC5F,EAAA,OAAO,EAAE,GAAG,EAAA,EAAG;AACjB;AAEA,SAAS,gBAAA,CAAiB,MAAA,EAAgB,CAAA,EAAW,OAAA,EAAyB;AAC5E,EAAA,OAAO,UAAA,CAAW,QAAA,EAAU,MAAM,CAAA,CAAE,MAAA,CAAO,CAAA,EAAG,CAAC,CAAA,CAAA,EAAI,OAAO,CAAA,CAAE,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AAC5E;AAOO,SAAS,cACd,OAAA,EACA,eAAA,EACA,MAAA,EACA,IAAA,GAAsC,EAAC,EACzB;AACd,EAAA,IAAI,CAAC,eAAA,IAAmB,KAAA,CAAM,OAAA,CAAQ,eAAe,CAAA,EAAG;AACtD,IAAA,MAAM,IAAI,sBAAsB,0BAA0B,CAAA;AAAA,EAC5D;AACA,EAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,sBAAsB,wBAAwB,CAAA;AAErE,EAAA,MAAM,OAAO,OAAO,OAAA,KAAY,WAAW,OAAA,GAAU,OAAA,CAAQ,SAAS,MAAM,CAAA;AAC5E,EAAA,MAAM,EAAE,CAAA,EAAG,EAAA,EAAG,GAAI,YAAY,eAAe,CAAA;AAE7C,EAAA,MAAM,SAAA,GAAY,KAAK,gBAAA,IAAoB,GAAA;AAC3C,EAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,GAAA,CAAI,MAAA,GAAS,CAAC,IAAI,SAAA,EAAW;AACpC,IAAA,MAAM,IAAI,qBAAA,CAAsB,CAAA,6BAAA,EAAgC,SAAS,CAAA,EAAA,CAAI,CAAA;AAAA,EAC/E;AAEA,EAAA,MAAM,QAAA,GAAW,gBAAA,CAAiB,MAAA,EAAQ,CAAA,EAAG,IAAI,CAAA;AACjD,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,IAAA,CAAK,QAAA,EAAU,KAAK,CAAA;AACrC,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,IAAA,CAAK,EAAA,EAAI,KAAK,CAAA;AAC/B,EAAA,IAAI,CAAA,CAAE,WAAW,CAAA,CAAE,MAAA,IAAU,CAAC,eAAA,CAAgB,CAAA,EAAG,CAAC,CAAA,EAAG;AACnD,IAAA,MAAM,IAAI,sBAAsB,oBAAoB,CAAA;AAAA,EACtD;AAEA,EAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AACxB","file":"server.js","sourcesContent":["/**\n * Webhook signature verification (spec §6.2) — server-side only.\n *\n * Signature scheme (mirrors the Playmos service byte-for-byte):\n *   header `X-Playmos-Signature: t=<unixSeconds>,v1=<hex>`\n *   where <hex> = HMAC_SHA256(secret, `${t}.${rawBody}`)\n *\n * Verify BEFORE trusting an event. Uses node:crypto (constant-time compare) and\n * rejects stale timestamps to blunt replay. Throws on any mismatch.\n */\n\nimport { createHmac, timingSafeEqual } from \"node:crypto\";\nimport { PlaymosError } from \"./errors.js\";\nimport type { WebhookEvent } from \"./types.js\";\n\nexport class WebhookSignatureError extends PlaymosError {\n  constructor(message: string) {\n    super(\"api_error\", `Webhook signature verification failed: ${message}`);\n  }\n}\n\nfunction parseHeader(header: string): { t: number; v1: string } {\n  const parts = Object.fromEntries(\n    header.split(\",\").map((kv) => {\n      const [k, v] = kv.split(\"=\");\n      return [k?.trim(), v?.trim()];\n    }),\n  );\n  const t = Number(parts[\"t\"]);\n  const v1 = parts[\"v1\"];\n  if (!Number.isFinite(t) || !v1) throw new WebhookSignatureError(\"malformed signature header\");\n  return { t, v1 };\n}\n\nfunction computeSignature(secret: string, t: number, rawBody: string): string {\n  return createHmac(\"sha256\", secret).update(`${t}.${rawBody}`).digest(\"hex\");\n}\n\n/**\n * Verify a webhook and return the parsed event. `rawBody` MUST be the exact raw\n * request bytes (use express.raw / fastify rawBody) — a re-serialized JSON body\n * will not match the signature.\n */\nexport function verifyWebhook(\n  rawBody: string | Buffer,\n  signatureHeader: string | string[] | undefined,\n  secret: string,\n  opts: { toleranceSeconds?: number } = {},\n): WebhookEvent {\n  if (!signatureHeader || Array.isArray(signatureHeader)) {\n    throw new WebhookSignatureError(\"missing signature header\");\n  }\n  if (!secret) throw new WebhookSignatureError(\"missing signing secret\");\n\n  const body = typeof rawBody === \"string\" ? rawBody : rawBody.toString(\"utf8\");\n  const { t, v1 } = parseHeader(signatureHeader);\n\n  const tolerance = opts.toleranceSeconds ?? 300;\n  const nowSec = Math.floor(Date.now() / 1000);\n  if (Math.abs(nowSec - t) > tolerance) {\n    throw new WebhookSignatureError(`timestamp outside tolerance (${tolerance}s)`);\n  }\n\n  const expected = computeSignature(secret, t, body);\n  const a = Buffer.from(expected, \"hex\");\n  const b = Buffer.from(v1, \"hex\");\n  if (a.length !== b.length || !timingSafeEqual(a, b)) {\n    throw new WebhookSignatureError(\"signature mismatch\");\n  }\n\n  return JSON.parse(body) as WebhookEvent;\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@playmos/sdk",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Playmos SDK — stablecoin payments for games on Base. One SDK for IAP (1%), skill-game prize-pool entries (10%, 60/30/10), and agent economies. USD in, USDC on-chain, no crypto UX for players.",
   "license": "UNLICENSED",
   "private": false,
@@ -14,6 +14,11 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
       "require": "./dist/index.cjs"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js",
+      "require": "./dist/server.cjs"
     }
   },
   "files": [