@tbookdev/vault-node 0.1.0

package/dist/index.cjs

@@ -0,0 +1,198 @@
+'use strict';
+
+var crypto = require('crypto');
+
+// src/webhooks.ts
+var WebhookVerificationError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "WebhookVerificationError";
+    this.code = code;
+  }
+};
+var DEFAULT_TOLERANCE_SECONDS = 300;
+var WebhookVerifier = class {
+  secret;
+  toleranceSeconds;
+  constructor(secret, toleranceSeconds = DEFAULT_TOLERANCE_SECONDS) {
+    if (!secret) {
+      throw new Error("Webhook secret is required for verification");
+    }
+    this.secret = secret;
+    this.toleranceSeconds = toleranceSeconds;
+  }
+  /**
+   * Verify a webhook payload and return the parsed event.
+   *
+   * @param body - Raw request body (string or Buffer)
+   * @param signatureHeader - Value of the `X-TBook-Signature` header
+   * @returns The verified and parsed webhook event
+   *
+   * @throws {WebhookVerificationError} If verification fails
+   */
+  verify(body, signatureHeader) {
+    if (!signatureHeader) {
+      throw new WebhookVerificationError(
+        "MISSING_SIGNATURE",
+        "Missing X-TBook-Signature header"
+      );
+    }
+    const bodyStr = typeof body === "string" ? body : body.toString("utf-8");
+    const parts = signatureHeader.split(",");
+    const timestampStr = parts.find((p) => p.startsWith("t="))?.slice(2);
+    const signatureHex = parts.find((p) => p.startsWith("v1="))?.slice(3);
+    if (!timestampStr || !signatureHex) {
+      throw new WebhookVerificationError(
+        "INVALID_SIGNATURE_FORMAT",
+        "Invalid signature header format. Expected: t=timestamp,v1=hex_signature"
+      );
+    }
+    const timestamp = parseInt(timestampStr, 10);
+    if (isNaN(timestamp)) {
+      throw new WebhookVerificationError(
+        "INVALID_TIMESTAMP",
+        "Invalid timestamp in signature header"
+      );
+    }
+    const nowSeconds = Date.now() / 1e3;
+    const futureSkew = timestamp - nowSeconds;
+    if (futureSkew > this.toleranceSeconds) {
+      throw new WebhookVerificationError(
+        "TIMESTAMP_FUTURE",
+        `Webhook timestamp is ${Math.floor(futureSkew)}s in the future (max ${this.toleranceSeconds}s). This may indicate clock skew or a forged request.`
+      );
+    }
+    const age = Math.abs(nowSeconds - timestamp);
+    if (age > this.toleranceSeconds) {
+      throw new WebhookVerificationError(
+        "TIMESTAMP_EXPIRED",
+        `Webhook timestamp is ${Math.floor(age)}s old (max ${this.toleranceSeconds}s). This may indicate a replay attack or clock skew.`
+      );
+    }
+    const signedContent = `${timestamp}.${bodyStr}`;
+    const expectedHex = crypto.createHmac("sha256", this.secret).update(signedContent).digest("hex");
+    const expectedBuf = Buffer.from(expectedHex, "hex");
+    const actualBuf = Buffer.from(signatureHex, "hex");
+    if (expectedBuf.length !== actualBuf.length || !crypto.timingSafeEqual(expectedBuf, actualBuf)) {
+      throw new WebhookVerificationError(
+        "INVALID_SIGNATURE",
+        "Webhook signature verification failed. The payload may have been tampered with."
+      );
+    }
+    try {
+      return JSON.parse(bodyStr);
+    } catch {
+      throw new WebhookVerificationError(
+        "INVALID_PAYLOAD",
+        "Failed to parse webhook payload as JSON"
+      );
+    }
+  }
+};
+
+// src/client.ts
+var DEFAULT_API_BASE_URL = "https://rwa-api.tbook.com";
+var DEFAULT_VAULT_ID = "rcUSDP";
+var TBookVaultServer = class {
+  secretKey;
+  apiBaseUrl;
+  /** Webhook verification helper. */
+  webhooks;
+  constructor(options) {
+    if (!options.secretKey) {
+      throw new Error("secretKey is required for TBookVaultServer");
+    }
+    this.secretKey = options.secretKey;
+    this.apiBaseUrl = options.apiBaseUrl ?? DEFAULT_API_BASE_URL;
+    this.webhooks = new WebhookVerifier(options.webhookSecret ?? "");
+  }
+  // ── API Methods ──
+  /**
+   * Fetch vault state.
+   *
+   * @param vaultId - Vault identifier (defaults to rcUSDP)
+   */
+  async getVaultInfo(vaultId = DEFAULT_VAULT_ID) {
+    return this.get(`/v1/vaults/${vaultId}`);
+  }
+  /**
+   * Fetch a user's vault account.
+   *
+   * @param pubkey - Solana public key string
+   * @param vaultId - Vault identifier (defaults to rcUSDP)
+   */
+  async getUserAccount(pubkey, vaultId = DEFAULT_VAULT_ID) {
+    return this.get(`/v1/vaults/${vaultId}/users/${pubkey}`);
+  }
+  /** Fetch current share price and APY. */
+  async getSharePrice(vaultId = DEFAULT_VAULT_ID) {
+    return this.get(`/v1/vaults/${vaultId}/price`);
+  }
+  /** List all available vaults. */
+  async listVaults() {
+    return this.get("/v1/vaults");
+  }
+  // ── Webhook Management ──
+  /** Register a new webhook endpoint. */
+  async registerWebhook(url, events) {
+    return this.post("/v1/webhooks", { url, events });
+  }
+  /** List registered webhooks. */
+  async listWebhooks() {
+    return this.get("/v1/webhooks");
+  }
+  /** Remove a webhook. */
+  async removeWebhook(id) {
+    return this.delete(`/v1/webhooks/${id}`);
+  }
+  /** Poll events (alternative to push webhooks). */
+  async pollEvents(options) {
+    const params = new URLSearchParams();
+    if (options?.after) params.set("after", options.after);
+    if (options?.types) params.set("types", options.types.join(","));
+    if (options?.limit) params.set("limit", String(options.limit));
+    const qs = params.toString();
+    return this.get(`/v1/events${qs ? `?${qs}` : ""}`);
+  }
+  // ── HTTP Helpers ──
+  async get(path) {
+    const res = await fetch(`${this.apiBaseUrl}${path}`, {
+      headers: this.headers()
+    });
+    return this.handleResponse(res);
+  }
+  async post(path, body) {
+    const res = await fetch(`${this.apiBaseUrl}${path}`, {
+      method: "POST",
+      headers: { ...this.headers(), "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    return this.handleResponse(res);
+  }
+  async delete(path) {
+    const res = await fetch(`${this.apiBaseUrl}${path}`, {
+      method: "DELETE",
+      headers: this.headers()
+    });
+    return this.handleResponse(res);
+  }
+  headers() {
+    return { "x-api-key": this.secretKey };
+  }
+  async handleResponse(res) {
+    const data = await res.json();
+    if (!res.ok) {
+      throw new Error(
+        `TBook API error (${res.status}): ${data.error ?? JSON.stringify(data)}`
+      );
+    }
+    return data;
+  }
+};
+
+exports.TBookVaultServer = TBookVaultServer;
+exports.WebhookVerificationError = WebhookVerificationError;
+exports.WebhookVerifier = WebhookVerifier;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/webhooks.ts","../src/client.ts"],"names":["createHmac","timingSafeEqual"],"mappings":";;;;;AAgCO,IAAM,wBAAA,GAAN,cAAuC,KAAA,CAAM;AAAA,EACzC,IAAA;AAAA,EAET,WAAA,CAAY,MAAc,OAAA,EAAiB;AACzC,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,0BAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAGA,IAAM,yBAAA,GAA4B,GAAA;AAQ3B,IAAM,kBAAN,MAAsB;AAAA,EACV,MAAA;AAAA,EACA,gBAAA;AAAA,EAEjB,WAAA,CAAY,MAAA,EAAgB,gBAAA,GAAmB,yBAAA,EAA2B;AACxE,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAAA,IAC/D;AACA,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,gBAAA,GAAmB,gBAAA;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAA,CAAO,MAAuB,eAAA,EAAuC;AACnE,IAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,MAAA,MAAM,IAAI,wBAAA;AAAA,QACR,mBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,UAAU,OAAO,IAAA,KAAS,WAAW,IAAA,GAAO,IAAA,CAAK,SAAS,OAAO,CAAA;AAGvE,IAAA,MAAM,KAAA,GAAQ,eAAA,CAAgB,KAAA,CAAM,GAAG,CAAA;AACvC,IAAA,MAAM,YAAA,GAAe,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,IAAI,CAAC,CAAA,EAAG,KAAA,CAAM,CAAC,CAAA;AACnE,IAAA,MAAM,YAAA,GAAe,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,KAAK,CAAC,CAAA,EAAG,KAAA,CAAM,CAAC,CAAA;AAEpE,IAAA,IAAI,CAAC,YAAA,IAAgB,CAAC,YAAA,EAAc;AAClC,MAAA,MAAM,IAAI,wBAAA;AAAA,QACR,0BAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,SAAA,GAAY,QAAA,CAAS,YAAA,EAAc,EAAE,CAAA;AAC3C,IAAA,IAAI,KAAA,CAAM,SAAS,CAAA,EAAG;AACpB,MAAA,MAAM,IAAI,wBAAA;AAAA,QACR,mBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAGA,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA;AAChC,IAAA,MAAM,aAAa,SAAA,GAAY,UAAA;AAC/B,IAAA,IAAI,UAAA,GAAa,KAAK,gBAAA,EAAkB;AACtC,MAAA,MAAM,IAAI,wBAAA;AAAA,QACR,kBAAA;AAAA,QACA,wBAAwB,IAAA,CAAK,KAAA,CAAM,UAAU,CAAC,CAAA,qBAAA,EAAwB,KAAK,gBAAgB,CAAA,qDAAA;AAAA,OAE7F;AAAA,IACF;AAGA,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,CAAI,UAAA,GAAa,SAAS,CAAA;AAC3C,IAAA,IAAI,GAAA,GAAM,KAAK,gBAAA,EAAkB;AAC/B,MAAA,MAAM,IAAI,wBAAA;AAAA,QACR,mBAAA;AAAA,QACA,wBAAwB,IAAA,CAAK,KAAA,CAAM,GAAG,CAAC,CAAA,WAAA,EAAc,KAAK,gBAAgB,CAAA,oDAAA;AAAA,OAE5E;AAAA,IACF;AAGA,IAAA,MAAM,aAAA,GAAgB,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA;AAC7C,IAAA,MAAM,WAAA,GAAcA,iBAAA,CAAW,QAAA,EAAU,IAAA,CAAK,MAAM,EACjD,MAAA,CAAO,aAAa,CAAA,CACpB,MAAA,CAAO,KAAK,CAAA;AAGf,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,IAAA,CAAK,WAAA,EAAa,KAAK,CAAA;AAClD,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,IAAA,CAAK,YAAA,EAAc,KAAK,CAAA;AAEjD,IAAA,IAAI,WAAA,CAAY,WAAW,SAAA,CAAU,MAAA,IAAU,CAACC,sBAAA,CAAgB,WAAA,EAAa,SAAS,CAAA,EAAG;AACvF,MAAA,MAAM,IAAI,wBAAA;AAAA,QACR,mBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAGA,IAAA,IAAI;AACF,MAAA,OAAO,IAAA,CAAK,MAAM,OAAO,CAAA;AAAA,IAC3B,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,wBAAA;AAAA,QACR,iBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AACF;;;AC1IA,IAAM,oBAAA,GAAuB,2BAAA;AAC7B,IAAM,gBAAA,GAAmB,QAAA;AAoBlB,IAAM,mBAAN,MAAuB;AAAA,EACX,SAAA;AAAA,EACA,UAAA;AAAA;AAAA,EAGR,QAAA;AAAA,EAET,YAAY,OAAA,EAAkC;AAC5C,IAAA,IAAI,CAAC,QAAQ,SAAA,EAAW;AACtB,MAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,IAC9D;AACA,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,SAAA;AACzB,IAAA,IAAA,CAAK,UAAA,GAAa,QAAQ,UAAA,IAAc,oBAAA;AAGxC,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,eAAA,CAAgB,OAAA,CAAQ,iBAAiB,EAAE,CAAA;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,YAAA,CAAa,OAAA,GAAkB,gBAAA,EAAkB;AACrD,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAA,WAAA,EAAc,OAAO,CAAA,CAAE,CAAA;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,cAAA,CAAe,MAAA,EAAgB,OAAA,GAAkB,gBAAA,EAAkB;AACvE,IAAA,OAAO,KAAK,GAAA,CAAI,CAAA,WAAA,EAAc,OAAO,CAAA,OAAA,EAAU,MAAM,CAAA,CAAE,CAAA;AAAA,EACzD;AAAA;AAAA,EAGA,MAAM,aAAA,CAAc,OAAA,GAAkB,gBAAA,EAAkB;AACtD,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAA,WAAA,EAAc,OAAO,CAAA,MAAA,CAAQ,CAAA;AAAA,EAC/C;AAAA;AAAA,EAGA,MAAM,UAAA,GAAa;AACjB,IAAA,OAAO,IAAA,CAAK,IAAI,YAAY,CAAA;AAAA,EAC9B;AAAA;AAAA;AAAA,EAKA,MAAM,eAAA,CAAgB,GAAA,EAAa,MAAA,EAAkB;AACnD,IAAA,OAAO,KAAK,IAAA,CAAK,cAAA,EAAgB,EAAE,GAAA,EAAK,QAAQ,CAAA;AAAA,EAClD;AAAA;AAAA,EAGA,MAAM,YAAA,GAAe;AACnB,IAAA,OAAO,IAAA,CAAK,IAAI,cAAc,CAAA;AAAA,EAChC;AAAA;AAAA,EAGA,MAAM,cAAc,EAAA,EAAY;AAC9B,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,CAAA,aAAA,EAAgB,EAAE,CAAA,CAAE,CAAA;AAAA,EACzC;AAAA;AAAA,EAGA,MAAM,WAAW,OAAA,EAAgE;AAC/E,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,EAAgB;AACnC,IAAA,IAAI,SAAS,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,OAAA,EAAS,QAAQ,KAAK,CAAA;AACrD,IAAA,IAAI,OAAA,EAAS,OAAO,MAAA,CAAO,GAAA,CAAI,SAAS,OAAA,CAAQ,KAAA,CAAM,IAAA,CAAK,GAAG,CAAC,CAAA;AAC/D,IAAA,IAAI,OAAA,EAAS,OAAO,MAAA,CAAO,GAAA,CAAI,SAAS,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAC,CAAA;AAC7D,IAAA,MAAM,EAAA,GAAK,OAAO,QAAA,EAAS;AAC3B,IAAA,OAAO,IAAA,CAAK,IAAI,CAAA,UAAA,EAAa,EAAA,GAAK,IAAI,EAAE,CAAA,CAAA,GAAK,EAAE,CAAA,CAAE,CAAA;AAAA,EACnD;AAAA;AAAA,EAIA,MAAc,IAAI,IAAA,EAA4B;AAC5C,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,CAAA,EAAG,KAAK,UAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,MACnD,OAAA,EAAS,KAAK,OAAA;AAAQ,KACvB,CAAA;AACD,IAAA,OAAO,IAAA,CAAK,eAAe,GAAG,CAAA;AAAA,EAChC;AAAA,EAEA,MAAc,IAAA,CAAK,IAAA,EAAc,IAAA,EAAyB;AACxD,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,CAAA,EAAG,KAAK,UAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,MACnD,MAAA,EAAQ,MAAA;AAAA,MACR,SAAS,EAAE,GAAG,KAAK,OAAA,EAAQ,EAAG,gBAAgB,kBAAA,EAAmB;AAAA,MACjE,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAI;AAAA,KAC1B,CAAA;AACD,IAAA,OAAO,IAAA,CAAK,eAAe,GAAG,CAAA;AAAA,EAChC;AAAA,EAEA,MAAc,OAAO,IAAA,EAA4B;AAC/C,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,CAAA,EAAG,KAAK,UAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,MACnD,MAAA,EAAQ,QAAA;AAAA,MACR,OAAA,EAAS,KAAK,OAAA;AAAQ,KACvB,CAAA;AACD,IAAA,OAAO,IAAA,CAAK,eAAe,GAAG,CAAA;AAAA,EAChC;AAAA,EAEQ,OAAA,GAAkC;AACxC,IAAA,OAAO,EAAE,WAAA,EAAa,IAAA,CAAK,SAAA,EAAU;AAAA,EACvC;AAAA,EAEA,MAAc,eAAe,GAAA,EAA6B;AACxD,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,iBAAA,EAAoB,IAAI,MAAM,CAAA,GAAA,EAAM,KAAK,KAAA,IAAS,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AAAA,OACxE;AAAA,IACF;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACF","file":"index.cjs","sourcesContent":["/**\n * Webhook signature verification for inbound events.\n *\n * Verifies HMAC-SHA256 signatures to ensure events are genuinely\n * from the TBook API and haven't been tampered with.\n *\n * @module webhooks\n *\n * @example\n * ```typescript\n * import { TBookVaultServer } from \"@tbookdev/vault-node\";\n *\n * const tbook = new TBookVaultServer({\n *   secretKey: \"tbk_secret_...\",\n *   webhookSecret: \"whsec_...\",\n * });\n *\n * app.post(\"/webhook\", (req, res) => {\n *   const event = tbook.webhooks.verify(\n *     req.body,\n *     req.headers[\"x-tbook-signature\"],\n *   );\n *   console.log(event.type, event.data);\n *   res.json({ received: true });\n * });\n * ```\n */\n\nimport { createHmac, timingSafeEqual } from \"crypto\";\nimport type { WebhookEvent } from \"./types.js\";\n\n/** Error thrown when webhook verification fails. */\nexport class WebhookVerificationError extends Error {\n  readonly code: string;\n\n  constructor(code: string, message: string) {\n    super(message);\n    this.name = \"WebhookVerificationError\";\n    this.code = code;\n  }\n}\n\n/** Default tolerance for timestamp validation (5 minutes). */\nconst DEFAULT_TOLERANCE_SECONDS = 300;\n\n/**\n * Webhook verification helper.\n *\n * Create an instance with your webhook secret, then call `verify()`\n * on each incoming webhook request.\n */\nexport class WebhookVerifier {\n  private readonly secret: string;\n  private readonly toleranceSeconds: number;\n\n  constructor(secret: string, toleranceSeconds = DEFAULT_TOLERANCE_SECONDS) {\n    if (!secret) {\n      throw new Error(\"Webhook secret is required for verification\");\n    }\n    this.secret = secret;\n    this.toleranceSeconds = toleranceSeconds;\n  }\n\n  /**\n   * Verify a webhook payload and return the parsed event.\n   *\n   * @param body - Raw request body (string or Buffer)\n   * @param signatureHeader - Value of the `X-TBook-Signature` header\n   * @returns The verified and parsed webhook event\n   *\n   * @throws {WebhookVerificationError} If verification fails\n   */\n  verify(body: string | Buffer, signatureHeader: string): WebhookEvent {\n    if (!signatureHeader) {\n      throw new WebhookVerificationError(\n        \"MISSING_SIGNATURE\",\n        \"Missing X-TBook-Signature header\",\n      );\n    }\n\n    const bodyStr = typeof body === \"string\" ? body : body.toString(\"utf-8\");\n\n    // Parse signature header: \"t=timestamp,v1=hex_signature\"\n    const parts = signatureHeader.split(\",\");\n    const timestampStr = parts.find((p) => p.startsWith(\"t=\"))?.slice(2);\n    const signatureHex = parts.find((p) => p.startsWith(\"v1=\"))?.slice(3);\n\n    if (!timestampStr || !signatureHex) {\n      throw new WebhookVerificationError(\n        \"INVALID_SIGNATURE_FORMAT\",\n        \"Invalid signature header format. Expected: t=timestamp,v1=hex_signature\",\n      );\n    }\n\n    const timestamp = parseInt(timestampStr, 10);\n    if (isNaN(timestamp)) {\n      throw new WebhookVerificationError(\n        \"INVALID_TIMESTAMP\",\n        \"Invalid timestamp in signature header\",\n      );\n    }\n\n    // Reject timestamps too far in the future (> 5 minutes)\n    const nowSeconds = Date.now() / 1000;\n    const futureSkew = timestamp - nowSeconds;\n    if (futureSkew > this.toleranceSeconds) {\n      throw new WebhookVerificationError(\n        \"TIMESTAMP_FUTURE\",\n        `Webhook timestamp is ${Math.floor(futureSkew)}s in the future (max ${this.toleranceSeconds}s). ` +\n        \"This may indicate clock skew or a forged request.\",\n      );\n    }\n\n    // Check timestamp tolerance (prevent replay attacks)\n    const age = Math.abs(nowSeconds - timestamp);\n    if (age > this.toleranceSeconds) {\n      throw new WebhookVerificationError(\n        \"TIMESTAMP_EXPIRED\",\n        `Webhook timestamp is ${Math.floor(age)}s old (max ${this.toleranceSeconds}s). ` +\n        \"This may indicate a replay attack or clock skew.\",\n      );\n    }\n\n    // Compute expected signature\n    const signedContent = `${timestamp}.${bodyStr}`;\n    const expectedHex = createHmac(\"sha256\", this.secret)\n      .update(signedContent)\n      .digest(\"hex\");\n\n    // Timing-safe comparison to prevent timing attacks\n    const expectedBuf = Buffer.from(expectedHex, \"hex\");\n    const actualBuf = Buffer.from(signatureHex, \"hex\");\n\n    if (expectedBuf.length !== actualBuf.length || !timingSafeEqual(expectedBuf, actualBuf)) {\n      throw new WebhookVerificationError(\n        \"INVALID_SIGNATURE\",\n        \"Webhook signature verification failed. The payload may have been tampered with.\",\n      );\n    }\n\n    // Parse and return the event\n    try {\n      return JSON.parse(bodyStr) as WebhookEvent;\n    } catch {\n      throw new WebhookVerificationError(\n        \"INVALID_PAYLOAD\",\n        \"Failed to parse webhook payload as JSON\",\n      );\n    }\n  }\n}\n","/**\n * Server-side TBook Vault API client.\n *\n * Provides authenticated access to the TBook API for server-side\n * use cases: reading vault state, user accounts, and managing webhooks.\n *\n * @module client\n */\n\nimport { WebhookVerifier } from \"./webhooks.js\";\nimport type { TBookVaultServerOptions } from \"./types.js\";\n\nconst DEFAULT_API_BASE_URL = \"https://rwa-api.tbook.com\";\nconst DEFAULT_VAULT_ID = \"rcUSDP\";\n\n/**\n * Server SDK client for TBook Vault Gateway.\n *\n * ```typescript\n * import { TBookVaultServer } from \"@tbookdev/vault-node\";\n *\n * const vault = new TBookVaultServer({\n *   secretKey: \"tbk_secret_...\",\n *   webhookSecret: \"whsec_...\",\n * });\n *\n * // Server-side reads\n * const info = await vault.getVaultInfo();\n *\n * // Webhook verification\n * const event = vault.webhooks.verify(body, signature);\n * ```\n */\nexport class TBookVaultServer {\n  private readonly secretKey: string;\n  private readonly apiBaseUrl: string;\n\n  /** Webhook verification helper. */\n  readonly webhooks: WebhookVerifier;\n\n  constructor(options: TBookVaultServerOptions) {\n    if (!options.secretKey) {\n      throw new Error(\"secretKey is required for TBookVaultServer\");\n    }\n    this.secretKey = options.secretKey;\n    this.apiBaseUrl = options.apiBaseUrl ?? DEFAULT_API_BASE_URL;\n\n    // Initialize webhook verifier (will throw if secret is missing when used)\n    this.webhooks = new WebhookVerifier(options.webhookSecret ?? \"\");\n  }\n\n  // ── API Methods ──\n\n  /**\n   * Fetch vault state.\n   *\n   * @param vaultId - Vault identifier (defaults to rcUSDP)\n   */\n  async getVaultInfo(vaultId: string = DEFAULT_VAULT_ID) {\n    return this.get(`/v1/vaults/${vaultId}`);\n  }\n\n  /**\n   * Fetch a user's vault account.\n   *\n   * @param pubkey - Solana public key string\n   * @param vaultId - Vault identifier (defaults to rcUSDP)\n   */\n  async getUserAccount(pubkey: string, vaultId: string = DEFAULT_VAULT_ID) {\n    return this.get(`/v1/vaults/${vaultId}/users/${pubkey}`);\n  }\n\n  /** Fetch current share price and APY. */\n  async getSharePrice(vaultId: string = DEFAULT_VAULT_ID) {\n    return this.get(`/v1/vaults/${vaultId}/price`);\n  }\n\n  /** List all available vaults. */\n  async listVaults() {\n    return this.get(\"/v1/vaults\");\n  }\n\n  // ── Webhook Management ──\n\n  /** Register a new webhook endpoint. */\n  async registerWebhook(url: string, events: string[]) {\n    return this.post(\"/v1/webhooks\", { url, events });\n  }\n\n  /** List registered webhooks. */\n  async listWebhooks() {\n    return this.get(\"/v1/webhooks\");\n  }\n\n  /** Remove a webhook. */\n  async removeWebhook(id: string) {\n    return this.delete(`/v1/webhooks/${id}`);\n  }\n\n  /** Poll events (alternative to push webhooks). */\n  async pollEvents(options?: { after?: string; types?: string[]; limit?: number }) {\n    const params = new URLSearchParams();\n    if (options?.after) params.set(\"after\", options.after);\n    if (options?.types) params.set(\"types\", options.types.join(\",\"));\n    if (options?.limit) params.set(\"limit\", String(options.limit));\n    const qs = params.toString();\n    return this.get(`/v1/events${qs ? `?${qs}` : \"\"}`);\n  }\n\n  // ── HTTP Helpers ──\n\n  private async get(path: string): Promise<any> {\n    const res = await fetch(`${this.apiBaseUrl}${path}`, {\n      headers: this.headers(),\n    });\n    return this.handleResponse(res);\n  }\n\n  private async post(path: string, body: any): Promise<any> {\n    const res = await fetch(`${this.apiBaseUrl}${path}`, {\n      method: \"POST\",\n      headers: { ...this.headers(), \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(body),\n    });\n    return this.handleResponse(res);\n  }\n\n  private async delete(path: string): Promise<any> {\n    const res = await fetch(`${this.apiBaseUrl}${path}`, {\n      method: \"DELETE\",\n      headers: this.headers(),\n    });\n    return this.handleResponse(res);\n  }\n\n  private headers(): Record<string, string> {\n    return { \"x-api-key\": this.secretKey };\n  }\n\n  private async handleResponse(res: Response): Promise<any> {\n    const data = await res.json();\n    if (!res.ok) {\n      throw new Error(\n        `TBook API error (${res.status}): ${data.error ?? JSON.stringify(data)}`,\n      );\n    }\n    return data;\n  }\n}\n"]}

package/dist/index.d.cts

@@ -0,0 +1,174 @@
+/**
+ * Types for the TBook Vault server SDK.
+ *
+ * @module types
+ */
+/** Options for initializing the server SDK client. */
+interface TBookVaultServerOptions {
+    /** Secret API key (tbk_secret_*). Required for webhook management. */
+    secretKey: string;
+    /** Webhook signing secret (whsec_*). Required for verifying inbound events. */
+    webhookSecret?: string;
+    /** Base URL of the TBook API. Defaults to production. */
+    apiBaseUrl?: string;
+}
+/** A verified webhook event. */
+interface WebhookEvent<T = any> {
+    /** Unique event ID (evt_*). */
+    id: string;
+    /** Event type (e.g. "vault.deposit_epoch.settled"). */
+    type: WebhookEventType;
+    /** Event payload. */
+    data: T;
+    /** ISO timestamp of event creation. */
+    created: string;
+}
+/** Known webhook event types. */
+type WebhookEventType = "vault.deposit_epoch.frozen" | "vault.deposit_epoch.settled" | "vault.deposit_epoch.rolled_back" | "vault.redeem_epoch.frozen" | "vault.redeem_epoch.settled" | "vault.redeem_epoch.rolled_back" | "vault.price.updated" | "vault.paused" | "vault.unpaused" | string;
+/** Payload for deposit epoch settled events. */
+interface DepositEpochSettledPayload {
+    epoch: number;
+    totalDepositUsdc: string;
+    settledSharesMinted: string;
+    sharePrice: string;
+    userCount: number;
+}
+/** Payload for redeem epoch settled events. */
+interface RedeemEpochSettledPayload {
+    epoch: number;
+    totalRedeemShares: string;
+    settledUsdcForRedeems: string;
+    userCount: number;
+}
+/** Payload for price updated events. */
+interface PriceUpdatedPayload {
+    price: string;
+    apy: string;
+    date: string;
+}
+
+/**
+ * Webhook signature verification for inbound events.
+ *
+ * Verifies HMAC-SHA256 signatures to ensure events are genuinely
+ * from the TBook API and haven't been tampered with.
+ *
+ * @module webhooks
+ *
+ * @example
+ * ```typescript
+ * import { TBookVaultServer } from "@tbookdev/vault-node";
+ *
+ * const tbook = new TBookVaultServer({
+ *   secretKey: "tbk_secret_...",
+ *   webhookSecret: "whsec_...",
+ * });
+ *
+ * app.post("/webhook", (req, res) => {
+ *   const event = tbook.webhooks.verify(
+ *     req.body,
+ *     req.headers["x-tbook-signature"],
+ *   );
+ *   console.log(event.type, event.data);
+ *   res.json({ received: true });
+ * });
+ * ```
+ */
+
+/** Error thrown when webhook verification fails. */
+declare class WebhookVerificationError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/**
+ * Webhook verification helper.
+ *
+ * Create an instance with your webhook secret, then call `verify()`
+ * on each incoming webhook request.
+ */
+declare class WebhookVerifier {
+    private readonly secret;
+    private readonly toleranceSeconds;
+    constructor(secret: string, toleranceSeconds?: number);
+    /**
+     * Verify a webhook payload and return the parsed event.
+     *
+     * @param body - Raw request body (string or Buffer)
+     * @param signatureHeader - Value of the `X-TBook-Signature` header
+     * @returns The verified and parsed webhook event
+     *
+     * @throws {WebhookVerificationError} If verification fails
+     */
+    verify(body: string | Buffer, signatureHeader: string): WebhookEvent;
+}
+
+/**
+ * Server-side TBook Vault API client.
+ *
+ * Provides authenticated access to the TBook API for server-side
+ * use cases: reading vault state, user accounts, and managing webhooks.
+ *
+ * @module client
+ */
+
+/**
+ * Server SDK client for TBook Vault Gateway.
+ *
+ * ```typescript
+ * import { TBookVaultServer } from "@tbookdev/vault-node";
+ *
+ * const vault = new TBookVaultServer({
+ *   secretKey: "tbk_secret_...",
+ *   webhookSecret: "whsec_...",
+ * });
+ *
+ * // Server-side reads
+ * const info = await vault.getVaultInfo();
+ *
+ * // Webhook verification
+ * const event = vault.webhooks.verify(body, signature);
+ * ```
+ */
+declare class TBookVaultServer {
+    private readonly secretKey;
+    private readonly apiBaseUrl;
+    /** Webhook verification helper. */
+    readonly webhooks: WebhookVerifier;
+    constructor(options: TBookVaultServerOptions);
+    /**
+     * Fetch vault state.
+     *
+     * @param vaultId - Vault identifier (defaults to rcUSDP)
+     */
+    getVaultInfo(vaultId?: string): Promise<any>;
+    /**
+     * Fetch a user's vault account.
+     *
+     * @param pubkey - Solana public key string
+     * @param vaultId - Vault identifier (defaults to rcUSDP)
+     */
+    getUserAccount(pubkey: string, vaultId?: string): Promise<any>;
+    /** Fetch current share price and APY. */
+    getSharePrice(vaultId?: string): Promise<any>;
+    /** List all available vaults. */
+    listVaults(): Promise<any>;
+    /** Register a new webhook endpoint. */
+    registerWebhook(url: string, events: string[]): Promise<any>;
+    /** List registered webhooks. */
+    listWebhooks(): Promise<any>;
+    /** Remove a webhook. */
+    removeWebhook(id: string): Promise<any>;
+    /** Poll events (alternative to push webhooks). */
+    pollEvents(options?: {
+        after?: string;
+        types?: string[];
+        limit?: number;
+    }): Promise<any>;
+    private get;
+    private post;
+    private delete;
+    private headers;
+    private handleResponse;
+}
+
+export { type DepositEpochSettledPayload, type PriceUpdatedPayload, type RedeemEpochSettledPayload, TBookVaultServer, type TBookVaultServerOptions, type WebhookEvent, type WebhookEventType, WebhookVerificationError, WebhookVerifier };

package/dist/index.d.ts

@@ -0,0 +1,174 @@
+/**
+ * Types for the TBook Vault server SDK.
+ *
+ * @module types
+ */
+/** Options for initializing the server SDK client. */
+interface TBookVaultServerOptions {
+    /** Secret API key (tbk_secret_*). Required for webhook management. */
+    secretKey: string;
+    /** Webhook signing secret (whsec_*). Required for verifying inbound events. */
+    webhookSecret?: string;
+    /** Base URL of the TBook API. Defaults to production. */
+    apiBaseUrl?: string;
+}
+/** A verified webhook event. */
+interface WebhookEvent<T = any> {
+    /** Unique event ID (evt_*). */
+    id: string;
+    /** Event type (e.g. "vault.deposit_epoch.settled"). */
+    type: WebhookEventType;
+    /** Event payload. */
+    data: T;
+    /** ISO timestamp of event creation. */
+    created: string;
+}
+/** Known webhook event types. */
+type WebhookEventType = "vault.deposit_epoch.frozen" | "vault.deposit_epoch.settled" | "vault.deposit_epoch.rolled_back" | "vault.redeem_epoch.frozen" | "vault.redeem_epoch.settled" | "vault.redeem_epoch.rolled_back" | "vault.price.updated" | "vault.paused" | "vault.unpaused" | string;
+/** Payload for deposit epoch settled events. */
+interface DepositEpochSettledPayload {
+    epoch: number;
+    totalDepositUsdc: string;
+    settledSharesMinted: string;
+    sharePrice: string;
+    userCount: number;
+}
+/** Payload for redeem epoch settled events. */
+interface RedeemEpochSettledPayload {
+    epoch: number;
+    totalRedeemShares: string;
+    settledUsdcForRedeems: string;
+    userCount: number;
+}
+/** Payload for price updated events. */
+interface PriceUpdatedPayload {
+    price: string;
+    apy: string;
+    date: string;
+}
+
+/**
+ * Webhook signature verification for inbound events.
+ *
+ * Verifies HMAC-SHA256 signatures to ensure events are genuinely
+ * from the TBook API and haven't been tampered with.
+ *
+ * @module webhooks
+ *
+ * @example
+ * ```typescript
+ * import { TBookVaultServer } from "@tbookdev/vault-node";
+ *
+ * const tbook = new TBookVaultServer({
+ *   secretKey: "tbk_secret_...",
+ *   webhookSecret: "whsec_...",
+ * });
+ *
+ * app.post("/webhook", (req, res) => {
+ *   const event = tbook.webhooks.verify(
+ *     req.body,
+ *     req.headers["x-tbook-signature"],
+ *   );
+ *   console.log(event.type, event.data);
+ *   res.json({ received: true });
+ * });
+ * ```
+ */
+
+/** Error thrown when webhook verification fails. */
+declare class WebhookVerificationError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/**
+ * Webhook verification helper.
+ *
+ * Create an instance with your webhook secret, then call `verify()`
+ * on each incoming webhook request.
+ */
+declare class WebhookVerifier {
+    private readonly secret;
+    private readonly toleranceSeconds;
+    constructor(secret: string, toleranceSeconds?: number);
+    /**
+     * Verify a webhook payload and return the parsed event.
+     *
+     * @param body - Raw request body (string or Buffer)
+     * @param signatureHeader - Value of the `X-TBook-Signature` header
+     * @returns The verified and parsed webhook event
+     *
+     * @throws {WebhookVerificationError} If verification fails
+     */
+    verify(body: string | Buffer, signatureHeader: string): WebhookEvent;
+}
+
+/**
+ * Server-side TBook Vault API client.
+ *
+ * Provides authenticated access to the TBook API for server-side
+ * use cases: reading vault state, user accounts, and managing webhooks.
+ *
+ * @module client
+ */
+
+/**
+ * Server SDK client for TBook Vault Gateway.
+ *
+ * ```typescript
+ * import { TBookVaultServer } from "@tbookdev/vault-node";
+ *
+ * const vault = new TBookVaultServer({
+ *   secretKey: "tbk_secret_...",
+ *   webhookSecret: "whsec_...",
+ * });
+ *
+ * // Server-side reads
+ * const info = await vault.getVaultInfo();
+ *
+ * // Webhook verification
+ * const event = vault.webhooks.verify(body, signature);
+ * ```
+ */
+declare class TBookVaultServer {
+    private readonly secretKey;
+    private readonly apiBaseUrl;
+    /** Webhook verification helper. */
+    readonly webhooks: WebhookVerifier;
+    constructor(options: TBookVaultServerOptions);
+    /**
+     * Fetch vault state.
+     *
+     * @param vaultId - Vault identifier (defaults to rcUSDP)
+     */
+    getVaultInfo(vaultId?: string): Promise<any>;
+    /**
+     * Fetch a user's vault account.
+     *
+     * @param pubkey - Solana public key string
+     * @param vaultId - Vault identifier (defaults to rcUSDP)
+     */
+    getUserAccount(pubkey: string, vaultId?: string): Promise<any>;
+    /** Fetch current share price and APY. */
+    getSharePrice(vaultId?: string): Promise<any>;
+    /** List all available vaults. */
+    listVaults(): Promise<any>;
+    /** Register a new webhook endpoint. */
+    registerWebhook(url: string, events: string[]): Promise<any>;
+    /** List registered webhooks. */
+    listWebhooks(): Promise<any>;
+    /** Remove a webhook. */
+    removeWebhook(id: string): Promise<any>;
+    /** Poll events (alternative to push webhooks). */
+    pollEvents(options?: {
+        after?: string;
+        types?: string[];
+        limit?: number;
+    }): Promise<any>;
+    private get;
+    private post;
+    private delete;
+    private headers;
+    private handleResponse;
+}
+
+export { type DepositEpochSettledPayload, type PriceUpdatedPayload, type RedeemEpochSettledPayload, TBookVaultServer, type TBookVaultServerOptions, type WebhookEvent, type WebhookEventType, WebhookVerificationError, WebhookVerifier };

package/dist/index.js

@@ -0,0 +1,194 @@
+import { createHmac, timingSafeEqual } from 'crypto';
+
+// src/webhooks.ts
+var WebhookVerificationError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "WebhookVerificationError";
+    this.code = code;
+  }
+};
+var DEFAULT_TOLERANCE_SECONDS = 300;
+var WebhookVerifier = class {
+  secret;
+  toleranceSeconds;
+  constructor(secret, toleranceSeconds = DEFAULT_TOLERANCE_SECONDS) {
+    if (!secret) {
+      throw new Error("Webhook secret is required for verification");
+    }
+    this.secret = secret;
+    this.toleranceSeconds = toleranceSeconds;
+  }
+  /**
+   * Verify a webhook payload and return the parsed event.
+   *
+   * @param body - Raw request body (string or Buffer)
+   * @param signatureHeader - Value of the `X-TBook-Signature` header
+   * @returns The verified and parsed webhook event
+   *
+   * @throws {WebhookVerificationError} If verification fails
+   */
+  verify(body, signatureHeader) {
+    if (!signatureHeader) {
+      throw new WebhookVerificationError(
+        "MISSING_SIGNATURE",
+        "Missing X-TBook-Signature header"
+      );
+    }
+    const bodyStr = typeof body === "string" ? body : body.toString("utf-8");
+    const parts = signatureHeader.split(",");
+    const timestampStr = parts.find((p) => p.startsWith("t="))?.slice(2);
+    const signatureHex = parts.find((p) => p.startsWith("v1="))?.slice(3);
+    if (!timestampStr || !signatureHex) {
+      throw new WebhookVerificationError(
+        "INVALID_SIGNATURE_FORMAT",
+        "Invalid signature header format. Expected: t=timestamp,v1=hex_signature"
+      );
+    }
+    const timestamp = parseInt(timestampStr, 10);
+    if (isNaN(timestamp)) {
+      throw new WebhookVerificationError(
+        "INVALID_TIMESTAMP",
+        "Invalid timestamp in signature header"
+      );
+    }
+    const nowSeconds = Date.now() / 1e3;
+    const futureSkew = timestamp - nowSeconds;
+    if (futureSkew > this.toleranceSeconds) {
+      throw new WebhookVerificationError(
+        "TIMESTAMP_FUTURE",
+        `Webhook timestamp is ${Math.floor(futureSkew)}s in the future (max ${this.toleranceSeconds}s). This may indicate clock skew or a forged request.`
+      );
+    }
+    const age = Math.abs(nowSeconds - timestamp);
+    if (age > this.toleranceSeconds) {
+      throw new WebhookVerificationError(
+        "TIMESTAMP_EXPIRED",
+        `Webhook timestamp is ${Math.floor(age)}s old (max ${this.toleranceSeconds}s). This may indicate a replay attack or clock skew.`
+      );
+    }
+    const signedContent = `${timestamp}.${bodyStr}`;
+    const expectedHex = createHmac("sha256", this.secret).update(signedContent).digest("hex");
+    const expectedBuf = Buffer.from(expectedHex, "hex");
+    const actualBuf = Buffer.from(signatureHex, "hex");
+    if (expectedBuf.length !== actualBuf.length || !timingSafeEqual(expectedBuf, actualBuf)) {
+      throw new WebhookVerificationError(
+        "INVALID_SIGNATURE",
+        "Webhook signature verification failed. The payload may have been tampered with."
+      );
+    }
+    try {
+      return JSON.parse(bodyStr);
+    } catch {
+      throw new WebhookVerificationError(
+        "INVALID_PAYLOAD",
+        "Failed to parse webhook payload as JSON"
+      );
+    }
+  }
+};
+
+// src/client.ts
+var DEFAULT_API_BASE_URL = "https://rwa-api.tbook.com";
+var DEFAULT_VAULT_ID = "rcUSDP";
+var TBookVaultServer = class {
+  secretKey;
+  apiBaseUrl;
+  /** Webhook verification helper. */
+  webhooks;
+  constructor(options) {
+    if (!options.secretKey) {
+      throw new Error("secretKey is required for TBookVaultServer");
+    }
+    this.secretKey = options.secretKey;
+    this.apiBaseUrl = options.apiBaseUrl ?? DEFAULT_API_BASE_URL;
+    this.webhooks = new WebhookVerifier(options.webhookSecret ?? "");
+  }
+  // ── API Methods ──
+  /**
+   * Fetch vault state.
+   *
+   * @param vaultId - Vault identifier (defaults to rcUSDP)
+   */
+  async getVaultInfo(vaultId = DEFAULT_VAULT_ID) {
+    return this.get(`/v1/vaults/${vaultId}`);
+  }
+  /**
+   * Fetch a user's vault account.
+   *
+   * @param pubkey - Solana public key string
+   * @param vaultId - Vault identifier (defaults to rcUSDP)
+   */
+  async getUserAccount(pubkey, vaultId = DEFAULT_VAULT_ID) {
+    return this.get(`/v1/vaults/${vaultId}/users/${pubkey}`);
+  }
+  /** Fetch current share price and APY. */
+  async getSharePrice(vaultId = DEFAULT_VAULT_ID) {
+    return this.get(`/v1/vaults/${vaultId}/price`);
+  }
+  /** List all available vaults. */
+  async listVaults() {
+    return this.get("/v1/vaults");
+  }
+  // ── Webhook Management ──
+  /** Register a new webhook endpoint. */
+  async registerWebhook(url, events) {
+    return this.post("/v1/webhooks", { url, events });
+  }
+  /** List registered webhooks. */
+  async listWebhooks() {
+    return this.get("/v1/webhooks");
+  }
+  /** Remove a webhook. */
+  async removeWebhook(id) {
+    return this.delete(`/v1/webhooks/${id}`);
+  }
+  /** Poll events (alternative to push webhooks). */
+  async pollEvents(options) {
+    const params = new URLSearchParams();
+    if (options?.after) params.set("after", options.after);
+    if (options?.types) params.set("types", options.types.join(","));
+    if (options?.limit) params.set("limit", String(options.limit));
+    const qs = params.toString();
+    return this.get(`/v1/events${qs ? `?${qs}` : ""}`);
+  }
+  // ── HTTP Helpers ──
+  async get(path) {
+    const res = await fetch(`${this.apiBaseUrl}${path}`, {
+      headers: this.headers()
+    });
+    return this.handleResponse(res);
+  }
+  async post(path, body) {
+    const res = await fetch(`${this.apiBaseUrl}${path}`, {
+      method: "POST",
+      headers: { ...this.headers(), "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    return this.handleResponse(res);
+  }
+  async delete(path) {
+    const res = await fetch(`${this.apiBaseUrl}${path}`, {
+      method: "DELETE",
+      headers: this.headers()
+    });
+    return this.handleResponse(res);
+  }
+  headers() {
+    return { "x-api-key": this.secretKey };
+  }
+  async handleResponse(res) {
+    const data = await res.json();
+    if (!res.ok) {
+      throw new Error(
+        `TBook API error (${res.status}): ${data.error ?? JSON.stringify(data)}`
+      );
+    }
+    return data;
+  }
+};
+
+export { TBookVaultServer, WebhookVerificationError, WebhookVerifier };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/webhooks.ts","../src/client.ts"],"names":[],"mappings":";;;AAgCO,IAAM,wBAAA,GAAN,cAAuC,KAAA,CAAM;AAAA,EACzC,IAAA;AAAA,EAET,WAAA,CAAY,MAAc,OAAA,EAAiB;AACzC,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,0BAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAGA,IAAM,yBAAA,GAA4B,GAAA;AAQ3B,IAAM,kBAAN,MAAsB;AAAA,EACV,MAAA;AAAA,EACA,gBAAA;AAAA,EAEjB,WAAA,CAAY,MAAA,EAAgB,gBAAA,GAAmB,yBAAA,EAA2B;AACxE,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAAA,IAC/D;AACA,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,gBAAA,GAAmB,gBAAA;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAA,CAAO,MAAuB,eAAA,EAAuC;AACnE,IAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,MAAA,MAAM,IAAI,wBAAA;AAAA,QACR,mBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,UAAU,OAAO,IAAA,KAAS,WAAW,IAAA,GAAO,IAAA,CAAK,SAAS,OAAO,CAAA;AAGvE,IAAA,MAAM,KAAA,GAAQ,eAAA,CAAgB,KAAA,CAAM,GAAG,CAAA;AACvC,IAAA,MAAM,YAAA,GAAe,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,IAAI,CAAC,CAAA,EAAG,KAAA,CAAM,CAAC,CAAA;AACnE,IAAA,MAAM,YAAA,GAAe,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,KAAK,CAAC,CAAA,EAAG,KAAA,CAAM,CAAC,CAAA;AAEpE,IAAA,IAAI,CAAC,YAAA,IAAgB,CAAC,YAAA,EAAc;AAClC,MAAA,MAAM,IAAI,wBAAA;AAAA,QACR,0BAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,SAAA,GAAY,QAAA,CAAS,YAAA,EAAc,EAAE,CAAA;AAC3C,IAAA,IAAI,KAAA,CAAM,SAAS,CAAA,EAAG;AACpB,MAAA,MAAM,IAAI,wBAAA;AAAA,QACR,mBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAGA,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,GAAA,EAAI,GAAI,GAAA;AAChC,IAAA,MAAM,aAAa,SAAA,GAAY,UAAA;AAC/B,IAAA,IAAI,UAAA,GAAa,KAAK,gBAAA,EAAkB;AACtC,MAAA,MAAM,IAAI,wBAAA;AAAA,QACR,kBAAA;AAAA,QACA,wBAAwB,IAAA,CAAK,KAAA,CAAM,UAAU,CAAC,CAAA,qBAAA,EAAwB,KAAK,gBAAgB,CAAA,qDAAA;AAAA,OAE7F;AAAA,IACF;AAGA,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,CAAI,UAAA,GAAa,SAAS,CAAA;AAC3C,IAAA,IAAI,GAAA,GAAM,KAAK,gBAAA,EAAkB;AAC/B,MAAA,MAAM,IAAI,wBAAA;AAAA,QACR,mBAAA;AAAA,QACA,wBAAwB,IAAA,CAAK,KAAA,CAAM,GAAG,CAAC,CAAA,WAAA,EAAc,KAAK,gBAAgB,CAAA,oDAAA;AAAA,OAE5E;AAAA,IACF;AAGA,IAAA,MAAM,aAAA,GAAgB,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA;AAC7C,IAAA,MAAM,WAAA,GAAc,UAAA,CAAW,QAAA,EAAU,IAAA,CAAK,MAAM,EACjD,MAAA,CAAO,aAAa,CAAA,CACpB,MAAA,CAAO,KAAK,CAAA;AAGf,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,IAAA,CAAK,WAAA,EAAa,KAAK,CAAA;AAClD,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,IAAA,CAAK,YAAA,EAAc,KAAK,CAAA;AAEjD,IAAA,IAAI,WAAA,CAAY,WAAW,SAAA,CAAU,MAAA,IAAU,CAAC,eAAA,CAAgB,WAAA,EAAa,SAAS,CAAA,EAAG;AACvF,MAAA,MAAM,IAAI,wBAAA;AAAA,QACR,mBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAGA,IAAA,IAAI;AACF,MAAA,OAAO,IAAA,CAAK,MAAM,OAAO,CAAA;AAAA,IAC3B,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,wBAAA;AAAA,QACR,iBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AACF;;;AC1IA,IAAM,oBAAA,GAAuB,2BAAA;AAC7B,IAAM,gBAAA,GAAmB,QAAA;AAoBlB,IAAM,mBAAN,MAAuB;AAAA,EACX,SAAA;AAAA,EACA,UAAA;AAAA;AAAA,EAGR,QAAA;AAAA,EAET,YAAY,OAAA,EAAkC;AAC5C,IAAA,IAAI,CAAC,QAAQ,SAAA,EAAW;AACtB,MAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,IAC9D;AACA,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,SAAA;AACzB,IAAA,IAAA,CAAK,UAAA,GAAa,QAAQ,UAAA,IAAc,oBAAA;AAGxC,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,eAAA,CAAgB,OAAA,CAAQ,iBAAiB,EAAE,CAAA;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,YAAA,CAAa,OAAA,GAAkB,gBAAA,EAAkB;AACrD,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAA,WAAA,EAAc,OAAO,CAAA,CAAE,CAAA;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,cAAA,CAAe,MAAA,EAAgB,OAAA,GAAkB,gBAAA,EAAkB;AACvE,IAAA,OAAO,KAAK,GAAA,CAAI,CAAA,WAAA,EAAc,OAAO,CAAA,OAAA,EAAU,MAAM,CAAA,CAAE,CAAA;AAAA,EACzD;AAAA;AAAA,EAGA,MAAM,aAAA,CAAc,OAAA,GAAkB,gBAAA,EAAkB;AACtD,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAA,WAAA,EAAc,OAAO,CAAA,MAAA,CAAQ,CAAA;AAAA,EAC/C;AAAA;AAAA,EAGA,MAAM,UAAA,GAAa;AACjB,IAAA,OAAO,IAAA,CAAK,IAAI,YAAY,CAAA;AAAA,EAC9B;AAAA;AAAA;AAAA,EAKA,MAAM,eAAA,CAAgB,GAAA,EAAa,MAAA,EAAkB;AACnD,IAAA,OAAO,KAAK,IAAA,CAAK,cAAA,EAAgB,EAAE,GAAA,EAAK,QAAQ,CAAA;AAAA,EAClD;AAAA;AAAA,EAGA,MAAM,YAAA,GAAe;AACnB,IAAA,OAAO,IAAA,CAAK,IAAI,cAAc,CAAA;AAAA,EAChC;AAAA;AAAA,EAGA,MAAM,cAAc,EAAA,EAAY;AAC9B,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,CAAA,aAAA,EAAgB,EAAE,CAAA,CAAE,CAAA;AAAA,EACzC;AAAA;AAAA,EAGA,MAAM,WAAW,OAAA,EAAgE;AAC/E,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,EAAgB;AACnC,IAAA,IAAI,SAAS,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,OAAA,EAAS,QAAQ,KAAK,CAAA;AACrD,IAAA,IAAI,OAAA,EAAS,OAAO,MAAA,CAAO,GAAA,CAAI,SAAS,OAAA,CAAQ,KAAA,CAAM,IAAA,CAAK,GAAG,CAAC,CAAA;AAC/D,IAAA,IAAI,OAAA,EAAS,OAAO,MAAA,CAAO,GAAA,CAAI,SAAS,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAC,CAAA;AAC7D,IAAA,MAAM,EAAA,GAAK,OAAO,QAAA,EAAS;AAC3B,IAAA,OAAO,IAAA,CAAK,IAAI,CAAA,UAAA,EAAa,EAAA,GAAK,IAAI,EAAE,CAAA,CAAA,GAAK,EAAE,CAAA,CAAE,CAAA;AAAA,EACnD;AAAA;AAAA,EAIA,MAAc,IAAI,IAAA,EAA4B;AAC5C,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,CAAA,EAAG,KAAK,UAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,MACnD,OAAA,EAAS,KAAK,OAAA;AAAQ,KACvB,CAAA;AACD,IAAA,OAAO,IAAA,CAAK,eAAe,GAAG,CAAA;AAAA,EAChC;AAAA,EAEA,MAAc,IAAA,CAAK,IAAA,EAAc,IAAA,EAAyB;AACxD,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,CAAA,EAAG,KAAK,UAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,MACnD,MAAA,EAAQ,MAAA;AAAA,MACR,SAAS,EAAE,GAAG,KAAK,OAAA,EAAQ,EAAG,gBAAgB,kBAAA,EAAmB;AAAA,MACjE,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAI;AAAA,KAC1B,CAAA;AACD,IAAA,OAAO,IAAA,CAAK,eAAe,GAAG,CAAA;AAAA,EAChC;AAAA,EAEA,MAAc,OAAO,IAAA,EAA4B;AAC/C,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,CAAA,EAAG,KAAK,UAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,MACnD,MAAA,EAAQ,QAAA;AAAA,MACR,OAAA,EAAS,KAAK,OAAA;AAAQ,KACvB,CAAA;AACD,IAAA,OAAO,IAAA,CAAK,eAAe,GAAG,CAAA;AAAA,EAChC;AAAA,EAEQ,OAAA,GAAkC;AACxC,IAAA,OAAO,EAAE,WAAA,EAAa,IAAA,CAAK,SAAA,EAAU;AAAA,EACvC;AAAA,EAEA,MAAc,eAAe,GAAA,EAA6B;AACxD,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,iBAAA,EAAoB,IAAI,MAAM,CAAA,GAAA,EAAM,KAAK,KAAA,IAAS,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AAAA,OACxE;AAAA,IACF;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACF","file":"index.js","sourcesContent":["/**\n * Webhook signature verification for inbound events.\n *\n * Verifies HMAC-SHA256 signatures to ensure events are genuinely\n * from the TBook API and haven't been tampered with.\n *\n * @module webhooks\n *\n * @example\n * ```typescript\n * import { TBookVaultServer } from \"@tbookdev/vault-node\";\n *\n * const tbook = new TBookVaultServer({\n *   secretKey: \"tbk_secret_...\",\n *   webhookSecret: \"whsec_...\",\n * });\n *\n * app.post(\"/webhook\", (req, res) => {\n *   const event = tbook.webhooks.verify(\n *     req.body,\n *     req.headers[\"x-tbook-signature\"],\n *   );\n *   console.log(event.type, event.data);\n *   res.json({ received: true });\n * });\n * ```\n */\n\nimport { createHmac, timingSafeEqual } from \"crypto\";\nimport type { WebhookEvent } from \"./types.js\";\n\n/** Error thrown when webhook verification fails. */\nexport class WebhookVerificationError extends Error {\n  readonly code: string;\n\n  constructor(code: string, message: string) {\n    super(message);\n    this.name = \"WebhookVerificationError\";\n    this.code = code;\n  }\n}\n\n/** Default tolerance for timestamp validation (5 minutes). */\nconst DEFAULT_TOLERANCE_SECONDS = 300;\n\n/**\n * Webhook verification helper.\n *\n * Create an instance with your webhook secret, then call `verify()`\n * on each incoming webhook request.\n */\nexport class WebhookVerifier {\n  private readonly secret: string;\n  private readonly toleranceSeconds: number;\n\n  constructor(secret: string, toleranceSeconds = DEFAULT_TOLERANCE_SECONDS) {\n    if (!secret) {\n      throw new Error(\"Webhook secret is required for verification\");\n    }\n    this.secret = secret;\n    this.toleranceSeconds = toleranceSeconds;\n  }\n\n  /**\n   * Verify a webhook payload and return the parsed event.\n   *\n   * @param body - Raw request body (string or Buffer)\n   * @param signatureHeader - Value of the `X-TBook-Signature` header\n   * @returns The verified and parsed webhook event\n   *\n   * @throws {WebhookVerificationError} If verification fails\n   */\n  verify(body: string | Buffer, signatureHeader: string): WebhookEvent {\n    if (!signatureHeader) {\n      throw new WebhookVerificationError(\n        \"MISSING_SIGNATURE\",\n        \"Missing X-TBook-Signature header\",\n      );\n    }\n\n    const bodyStr = typeof body === \"string\" ? body : body.toString(\"utf-8\");\n\n    // Parse signature header: \"t=timestamp,v1=hex_signature\"\n    const parts = signatureHeader.split(\",\");\n    const timestampStr = parts.find((p) => p.startsWith(\"t=\"))?.slice(2);\n    const signatureHex = parts.find((p) => p.startsWith(\"v1=\"))?.slice(3);\n\n    if (!timestampStr || !signatureHex) {\n      throw new WebhookVerificationError(\n        \"INVALID_SIGNATURE_FORMAT\",\n        \"Invalid signature header format. Expected: t=timestamp,v1=hex_signature\",\n      );\n    }\n\n    const timestamp = parseInt(timestampStr, 10);\n    if (isNaN(timestamp)) {\n      throw new WebhookVerificationError(\n        \"INVALID_TIMESTAMP\",\n        \"Invalid timestamp in signature header\",\n      );\n    }\n\n    // Reject timestamps too far in the future (> 5 minutes)\n    const nowSeconds = Date.now() / 1000;\n    const futureSkew = timestamp - nowSeconds;\n    if (futureSkew > this.toleranceSeconds) {\n      throw new WebhookVerificationError(\n        \"TIMESTAMP_FUTURE\",\n        `Webhook timestamp is ${Math.floor(futureSkew)}s in the future (max ${this.toleranceSeconds}s). ` +\n        \"This may indicate clock skew or a forged request.\",\n      );\n    }\n\n    // Check timestamp tolerance (prevent replay attacks)\n    const age = Math.abs(nowSeconds - timestamp);\n    if (age > this.toleranceSeconds) {\n      throw new WebhookVerificationError(\n        \"TIMESTAMP_EXPIRED\",\n        `Webhook timestamp is ${Math.floor(age)}s old (max ${this.toleranceSeconds}s). ` +\n        \"This may indicate a replay attack or clock skew.\",\n      );\n    }\n\n    // Compute expected signature\n    const signedContent = `${timestamp}.${bodyStr}`;\n    const expectedHex = createHmac(\"sha256\", this.secret)\n      .update(signedContent)\n      .digest(\"hex\");\n\n    // Timing-safe comparison to prevent timing attacks\n    const expectedBuf = Buffer.from(expectedHex, \"hex\");\n    const actualBuf = Buffer.from(signatureHex, \"hex\");\n\n    if (expectedBuf.length !== actualBuf.length || !timingSafeEqual(expectedBuf, actualBuf)) {\n      throw new WebhookVerificationError(\n        \"INVALID_SIGNATURE\",\n        \"Webhook signature verification failed. The payload may have been tampered with.\",\n      );\n    }\n\n    // Parse and return the event\n    try {\n      return JSON.parse(bodyStr) as WebhookEvent;\n    } catch {\n      throw new WebhookVerificationError(\n        \"INVALID_PAYLOAD\",\n        \"Failed to parse webhook payload as JSON\",\n      );\n    }\n  }\n}\n","/**\n * Server-side TBook Vault API client.\n *\n * Provides authenticated access to the TBook API for server-side\n * use cases: reading vault state, user accounts, and managing webhooks.\n *\n * @module client\n */\n\nimport { WebhookVerifier } from \"./webhooks.js\";\nimport type { TBookVaultServerOptions } from \"./types.js\";\n\nconst DEFAULT_API_BASE_URL = \"https://rwa-api.tbook.com\";\nconst DEFAULT_VAULT_ID = \"rcUSDP\";\n\n/**\n * Server SDK client for TBook Vault Gateway.\n *\n * ```typescript\n * import { TBookVaultServer } from \"@tbookdev/vault-node\";\n *\n * const vault = new TBookVaultServer({\n *   secretKey: \"tbk_secret_...\",\n *   webhookSecret: \"whsec_...\",\n * });\n *\n * // Server-side reads\n * const info = await vault.getVaultInfo();\n *\n * // Webhook verification\n * const event = vault.webhooks.verify(body, signature);\n * ```\n */\nexport class TBookVaultServer {\n  private readonly secretKey: string;\n  private readonly apiBaseUrl: string;\n\n  /** Webhook verification helper. */\n  readonly webhooks: WebhookVerifier;\n\n  constructor(options: TBookVaultServerOptions) {\n    if (!options.secretKey) {\n      throw new Error(\"secretKey is required for TBookVaultServer\");\n    }\n    this.secretKey = options.secretKey;\n    this.apiBaseUrl = options.apiBaseUrl ?? DEFAULT_API_BASE_URL;\n\n    // Initialize webhook verifier (will throw if secret is missing when used)\n    this.webhooks = new WebhookVerifier(options.webhookSecret ?? \"\");\n  }\n\n  // ── API Methods ──\n\n  /**\n   * Fetch vault state.\n   *\n   * @param vaultId - Vault identifier (defaults to rcUSDP)\n   */\n  async getVaultInfo(vaultId: string = DEFAULT_VAULT_ID) {\n    return this.get(`/v1/vaults/${vaultId}`);\n  }\n\n  /**\n   * Fetch a user's vault account.\n   *\n   * @param pubkey - Solana public key string\n   * @param vaultId - Vault identifier (defaults to rcUSDP)\n   */\n  async getUserAccount(pubkey: string, vaultId: string = DEFAULT_VAULT_ID) {\n    return this.get(`/v1/vaults/${vaultId}/users/${pubkey}`);\n  }\n\n  /** Fetch current share price and APY. */\n  async getSharePrice(vaultId: string = DEFAULT_VAULT_ID) {\n    return this.get(`/v1/vaults/${vaultId}/price`);\n  }\n\n  /** List all available vaults. */\n  async listVaults() {\n    return this.get(\"/v1/vaults\");\n  }\n\n  // ── Webhook Management ──\n\n  /** Register a new webhook endpoint. */\n  async registerWebhook(url: string, events: string[]) {\n    return this.post(\"/v1/webhooks\", { url, events });\n  }\n\n  /** List registered webhooks. */\n  async listWebhooks() {\n    return this.get(\"/v1/webhooks\");\n  }\n\n  /** Remove a webhook. */\n  async removeWebhook(id: string) {\n    return this.delete(`/v1/webhooks/${id}`);\n  }\n\n  /** Poll events (alternative to push webhooks). */\n  async pollEvents(options?: { after?: string; types?: string[]; limit?: number }) {\n    const params = new URLSearchParams();\n    if (options?.after) params.set(\"after\", options.after);\n    if (options?.types) params.set(\"types\", options.types.join(\",\"));\n    if (options?.limit) params.set(\"limit\", String(options.limit));\n    const qs = params.toString();\n    return this.get(`/v1/events${qs ? `?${qs}` : \"\"}`);\n  }\n\n  // ── HTTP Helpers ──\n\n  private async get(path: string): Promise<any> {\n    const res = await fetch(`${this.apiBaseUrl}${path}`, {\n      headers: this.headers(),\n    });\n    return this.handleResponse(res);\n  }\n\n  private async post(path: string, body: any): Promise<any> {\n    const res = await fetch(`${this.apiBaseUrl}${path}`, {\n      method: \"POST\",\n      headers: { ...this.headers(), \"Content-Type\": \"application/json\" },\n      body: JSON.stringify(body),\n    });\n    return this.handleResponse(res);\n  }\n\n  private async delete(path: string): Promise<any> {\n    const res = await fetch(`${this.apiBaseUrl}${path}`, {\n      method: \"DELETE\",\n      headers: this.headers(),\n    });\n    return this.handleResponse(res);\n  }\n\n  private headers(): Record<string, string> {\n    return { \"x-api-key\": this.secretKey };\n  }\n\n  private async handleResponse(res: Response): Promise<any> {\n    const data = await res.json();\n    if (!res.ok) {\n      throw new Error(\n        `TBook API error (${res.status}): ${data.error ?? JSON.stringify(data)}`,\n      );\n    }\n    return data;\n  }\n}\n"]}

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@tbookdev/vault-node",
+  "version": "0.1.0",
+  "description": "TBook Vault server SDK — webhook verification, server-side API client for Node.js backends",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "devDependencies": {
+    "@types/node": "^20.14.0",
+    "tsup": "^8.3.0",
+    "typescript": "^5.7.0",
+    "vitest": "^2.1.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/tbook-dev/vault-gateway-sdk"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "lint": "tsc --noEmit",
+    "clean": "rm -rf dist"
+  }
+}