@voiflow/sdk 0.0.0-stage → 0.1.0

package/dist/webhooks.js

@@ -0,0 +1,40 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+export const SIGNATURE_HEADER = "VoiFlow-Signature";
+export class WebhookSignatureError extends Error {
+}
+/**
+ * Verifies `VoiFlow-Signature: t=<unix_seconds>,v1=<hex_hmac_sha256>` against the raw request
+ * body bytes. Signed payload is the UTF-8 timestamp, a literal period, then the raw bytes.
+ */
+export function verifyWebhookSignature(rawBody, signatureHeader, secret, options = {}) {
+    const tolerance = options.toleranceSeconds ?? 300;
+    const now = options.now ?? (() => Date.now() / 1000);
+    const parts = Object.fromEntries(signatureHeader.split(",").map((part) => {
+        const [key, value] = part.split("=", 2);
+        return [key, value];
+    }));
+    const timestamp = parts["t"];
+    const signature = parts["v1"];
+    if (!timestamp || !signature) {
+        throw new WebhookSignatureError("Malformed VoiFlow-Signature header.");
+    }
+    const timestampSeconds = Number(timestamp);
+    if (!Number.isFinite(timestampSeconds) || Math.abs(now() - timestampSeconds) > tolerance) {
+        throw new WebhookSignatureError("Webhook timestamp is outside the allowed tolerance.");
+    }
+    const signedPayload = Buffer.concat([
+        Buffer.from(timestamp, "utf8"),
+        Buffer.from(".", "utf8"),
+        Buffer.from(rawBody),
+    ]);
+    const expected = createHmac("sha256", secret).update(signedPayload).digest("hex");
+    const expectedBuf = Buffer.from(expected, "utf8");
+    const actualBuf = Buffer.from(signature, "utf8");
+    if (expectedBuf.length !== actualBuf.length || !timingSafeEqual(expectedBuf, actualBuf)) {
+        throw new WebhookSignatureError("Webhook signature does not match.");
+    }
+}
+/** Parses the verified webhook body. Call verifyWebhookSignature first. */
+export function parseWebhookEvent(rawBody) {
+    return JSON.parse(Buffer.from(rawBody).toString("utf8"));
+}

package/package.json

@@ -1,6 +1,47 @@
 {
   "name": "@voiflow/sdk",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "VoiFlow 4.0 server-side SDK for the public /v1 API: businesses, agents, journeys, calls, conversations, campaigns, AI work, webhooks.",
+  "license": "MIT",
+  "homepage": "https://voiflow.ai",
+  "keywords": [
+    "voiflow",
+    "voice",
+    "ai",
+    "phone",
+    "calls",
+    "sdk",
+    "api"
+  ],
+  "type": "module",
+  "main": "./dist/cjs/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/cjs/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.json && tsc -p tsconfig.cjs.json && echo '{\"type\":\"commonjs\"}' > dist/cjs/package.json",
+    "check": "node --test test/*.test.mjs",
+    "prepack": "npm run build"
+  },
+  "devDependencies": {
+    "typescript": "^5.6.0",
+    "@types/node": "^20.0.0"
+  }
+}