@subscriptonarc/sdk 1.0.0 → 1.0.1

package/README.md

@@ -39,10 +39,13 @@ const status = await subscript.intents.retrieve(intent.id);
 ```ts
 import { SubScript } from "@subscriptonarc/sdk";
 
+const subscript = new SubScript({ secretKey: process.env.SUBSCRIPT_SECRET_KEY! });
+
 // In your webhook route (rawBody is the unparsed request body string):
+const signature = request.headers.get("x-subscript-signature") ?? "";
 const event = subscript.webhooks.constructEvent(
   rawBody,
-  request.headers["x-subscript-signature"],
+  signature,
   process.env.SUBSCRIPT_WEBHOOK_SECRET!,
 );
 // throws if the signature is invalid; otherwise returns the parsed event

package/dist/index.js

@@ -14,10 +14,16 @@ export class SubScriptError extends Error {
 /* ------------------------------- Amount helpers ------------------------------ */
 /** Convert a decimal USDC amount (e.g. 15 or "15.50") to canonical integer micro-USDC. */
 export function usdc(amount) {
-    const n = typeof amount === "number" ? amount : Number(amount);
-    if (!Number.isFinite(n) || n < 0)
+    // Parse the decimal string exactly — floating-point math (Number * 1e6) silently loses
+    // precision and rounds, which would change the amount before it reaches the API.
+    const raw = typeof amount === "number" ? amount.toString() : amount.trim();
+    const match = raw.match(/^(\d+)(?:\.(\d+))?$/);
+    if (!match)
         throw new Error(`Invalid USDC amount: ${amount}`);
-    return BigInt(Math.round(n * 1_000_000)).toString();
+    const [, whole, frac = ""] = match;
+    if (frac.length > 6)
+        throw new Error(`USDC supports at most 6 decimal places: ${amount}`);
+    return BigInt(`${whole}${frac.padEnd(6, "0")}`).toString();
 }
 /** Convert integer micro-USDC to a decimal USDC string. */
 export function fromMicros(micros) {
@@ -51,10 +57,16 @@ export function verifyWebhookSignature(rawBody, signatureHeader, secret, toleran
     return a.length === b.length && crypto.timingSafeEqual(a, b);
 }
 function stringifyMicros(params) {
-    if (params && params.amountUsdcMicros != null && typeof params.amountUsdcMicros !== "string") {
-        return { ...params, amountUsdcMicros: String(params.amountUsdcMicros) };
+    if (!params || params.amountUsdcMicros == null)
+        return params;
+    const micros = typeof params.amountUsdcMicros === "bigint"
+        ? params.amountUsdcMicros.toString()
+        : String(params.amountUsdcMicros).trim();
+    // Enforce the public contract: digits-only integer micro-USDC (reject "1.5", "1e21", etc.).
+    if (!/^\d+$/.test(micros)) {
+        throw new Error(`Invalid amountUsdcMicros: ${params.amountUsdcMicros}`);
     }
-    return params;
+    return { ...params, amountUsdcMicros: micros };
 }
 /* --------------------------------- Client ------------------------------------ */
 export class SubScript {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@subscriptonarc/sdk",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Typed SubScript API client — payment intents, subscriptions, usage reporting, and webhook verification for Arc USDC payments.",
   "license": "MIT",
   "type": "module",