@vivoa/partner-sdk 0.1.0

package/dist/esm/testing.js

@@ -0,0 +1,11 @@
+/**
+ * `@vivoa/partner-sdk/testing` — test your integration without touching the
+ * platform: plug `FakeVivoa` in as the transport and a `ManualClock` so polling
+ * and backoff run instantly.
+ *
+ *   const clock = new ManualClock();
+ *   const vivoa = new FakeVivoa({ clock, operators: [{ apiKey: 'k', apiSecret: 's' }] });
+ *   const client = createPartnerClient({ apiKey: 'k', apiSecret: 's', transport: vivoa, clock });
+ */
+export { FakeVivoa } from "./adapters/in-memory/fake-vivoa.js";
+export { ManualClock } from "./adapters/manual-clock.js";

package/dist/esm/webhooks/verify-webhook.d.ts

@@ -0,0 +1,21 @@
+import type { CryptoProvider } from '../ports/crypto.port.ts';
+import type { WebhookEvent } from '../domain/webhook.ts';
+export interface VerifyWebhookParams {
+    /** The body EXACTLY as received — before any JSON parsing. */
+    rawBody: string | Uint8Array;
+    /** Value of the `X-Vivoa-Signature` header (`sha256=<hex>`). */
+    signatureHeader: string | null | undefined;
+    /** Signing secret returned by `webhooks.set()` / `webhooks.rotateSecret()`. */
+    signingSecret: string;
+    /**
+     * Reject events whose `sentAt` is older than this (replay window). Default
+     * 5 min; `0` disables the check.
+     */
+    toleranceMs?: number;
+    nowMs?: number;
+}
+/**
+ * Verifies and parses a Vivoa webhook. Throws `VivoaWebhookSignatureError` on
+ * any mismatch — respond 400/401 and do not process the event.
+ */
+export declare function verifyWebhook(crypto: CryptoProvider, params: VerifyWebhookParams): Promise<WebhookEvent>;

package/dist/esm/webhooks/verify-webhook.js

@@ -0,0 +1,33 @@
+import { VivoaWebhookSignatureError } from "../domain/errors.js";
+const DEFAULT_TOLERANCE_MS = 5 * 60_000;
+/**
+ * Verifies and parses a Vivoa webhook. Throws `VivoaWebhookSignatureError` on
+ * any mismatch — respond 400/401 and do not process the event.
+ */
+export async function verifyWebhook(crypto, params) {
+    const raw = typeof params.rawBody === 'string' ? params.rawBody : new TextDecoder().decode(params.rawBody);
+    const header = params.signatureHeader?.trim();
+    if (!header?.startsWith('sha256=')) {
+        throw new VivoaWebhookSignatureError('Missing or malformed X-Vivoa-Signature header');
+    }
+    const expected = await crypto.hmacSha256Hex(params.signingSecret, raw);
+    if (!(await crypto.timingSafeEqualHex(expected, header.slice('sha256='.length)))) {
+        throw new VivoaWebhookSignatureError('Invalid webhook signature');
+    }
+    let event;
+    try {
+        event = JSON.parse(raw);
+    }
+    catch {
+        throw new VivoaWebhookSignatureError('Signed body is not valid JSON');
+    }
+    const tolerance = params.toleranceMs ?? DEFAULT_TOLERANCE_MS;
+    if (tolerance > 0) {
+        const sentAt = Date.parse(event.sentAt);
+        const now = params.nowMs ?? Date.now();
+        if (!Number.isFinite(sentAt) || Math.abs(now - sentAt) > tolerance) {
+            throw new VivoaWebhookSignatureError('Webhook sentAt outside the tolerance window (possible replay)');
+        }
+    }
+    return event;
+}

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "@vivoa/partner-sdk",
+  "version": "0.1.0",
+  "description": "Official SDK for the Vivoa Partner API — create and operate stores for your merchants",
+  "license": "UNLICENSED",
+  "type": "module",
+  "packageManager": "pnpm@9.0.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/VivoaPlatform/partner-sdk.git"
+  },
+  "keywords": ["vivoa", "partner", "ecommerce", "sdk", "white-label"],
+  "main": "./dist/cjs/index.js",
+  "module": "./dist/esm/index.js",
+  "types": "./dist/esm/index.d.ts",
+  "exports": {
+    ".": {
+      "import": { "types": "./dist/esm/index.d.ts", "default": "./dist/esm/index.js" },
+      "require": { "types": "./dist/cjs/index.d.ts", "default": "./dist/cjs/index.js" }
+    },
+    "./testing": {
+      "import": { "types": "./dist/esm/testing.d.ts", "default": "./dist/esm/testing.js" },
+      "require": { "types": "./dist/cjs/testing.d.ts", "default": "./dist/cjs/testing.js" }
+    },
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "vivoa-partner": "./dist/esm/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=22.18"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.build.esm.json && tsc -p tsconfig.build.cjs.json && node scripts/mark-cjs.mjs",
+    "typecheck": "tsc -p tsconfig.test.json",
+    "test": "node --test \"test/**/*.test.ts\"",
+    "test:live": "VIVOA_LIVE=1 node --test test/contract/live.test.ts",
+    "test:dist": "node scripts/smoke-dist.mjs",
+    "cli": "node src/cli.ts",
+    "prepublishOnly": "pnpm run typecheck && pnpm run test && pnpm run build && pnpm run test:dist"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.7",
+    "typescript": "^5.8.3"
+  }
+}