lpsignal 0.1.0

package/dist/webhook.d.ts

@@ -0,0 +1,22 @@
+import type { WebhookEvent } from './types.js';
+export type WebhookFailure = 'missing_headers' | 'bad_timestamp' | 'expired' | 'bad_signature' | 'bad_body';
+export declare class WebhookVerificationError extends Error {
+    readonly reason: WebhookFailure;
+    constructor(reason: WebhookFailure);
+}
+/** A Fetch `Headers` object or a plain object such as Node's `req.headers` (any letter case). */
+export type HeadersLike = Headers | Record<string, string | string[] | undefined>;
+/**
+ * Verify a webhook delivery and return its parsed body.
+ *
+ * `x-lpsignal-signature` is `sha256=` + hex HMAC-SHA256 of `"<x-lpsignal-timestamp>.<raw body>"`, keyed with the
+ * secret returned when the webhook was set. Pass the raw request bytes, before any JSON parsing: re-serialised JSON
+ * does not match the signature. Deliveries older than `toleranceSec` (default 300) are rejected as replays; every
+ * retry is signed afresh, so a legitimate retry is never too old.
+ *
+ * Deliveries are at-least-once: skip `deliveryId`s you have already handled.
+ */
+export declare function verifyWebhook(rawBody: string | Uint8Array, headers: HeadersLike, secret: string, opts?: {
+    toleranceSec?: number;
+    nowSec?: number;
+}): WebhookEvent;

package/dist/webhook.js

@@ -0,0 +1,50 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+export class WebhookVerificationError extends Error {
+    reason;
+    constructor(reason) {
+        super(`LPSignal webhook rejected: ${reason}`);
+        this.reason = reason;
+        this.name = 'WebhookVerificationError';
+    }
+}
+function header(h, name) {
+    if (typeof h.get === 'function')
+        return h.get(name) ?? undefined;
+    for (const [k, v] of Object.entries(h)) {
+        if (k.toLowerCase() === name)
+            return Array.isArray(v) ? v[0] : v;
+    }
+    return undefined;
+}
+/**
+ * Verify a webhook delivery and return its parsed body.
+ *
+ * `x-lpsignal-signature` is `sha256=` + hex HMAC-SHA256 of `"<x-lpsignal-timestamp>.<raw body>"`, keyed with the
+ * secret returned when the webhook was set. Pass the raw request bytes, before any JSON parsing: re-serialised JSON
+ * does not match the signature. Deliveries older than `toleranceSec` (default 300) are rejected as replays; every
+ * retry is signed afresh, so a legitimate retry is never too old.
+ *
+ * Deliveries are at-least-once: skip `deliveryId`s you have already handled.
+ */
+export function verifyWebhook(rawBody, headers, secret, opts = {}) {
+    const ts = header(headers, 'x-lpsignal-timestamp');
+    const sig = header(headers, 'x-lpsignal-signature');
+    if (!ts || !sig || !secret)
+        throw new WebhookVerificationError('missing_headers');
+    if (!/^\d{1,12}$/.test(ts))
+        throw new WebhookVerificationError('bad_timestamp');
+    const now = opts.nowSec ?? Math.floor(Date.now() / 1000);
+    if (Math.abs(now - Number(ts)) > (opts.toleranceSec ?? 300))
+        throw new WebhookVerificationError('expired');
+    const want = Buffer.from('sha256=' + createHmac('sha256', secret).update(`${ts}.`).update(rawBody).digest('hex'));
+    const got = Buffer.from(sig);
+    if (got.length !== want.length || !timingSafeEqual(got, want))
+        throw new WebhookVerificationError('bad_signature');
+    try {
+        return JSON.parse(typeof rawBody === 'string' ? rawBody : Buffer.from(rawBody).toString('utf8'));
+    }
+    catch {
+        throw new WebhookVerificationError('bad_body');
+    }
+}
+//# sourceMappingURL=webhook.js.map

package/dist/webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.js","sourceRoot":"","sources":["../src/webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAK1D,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAC5B;IAArB,YAAqB,MAAsB;QACzC,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;QAD3B,WAAM,GAAN,MAAM,CAAgB;QAEzC,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAKD,SAAS,MAAM,CAAC,CAAc,EAAE,IAAY;IAC1C,IAAI,OAAQ,CAAa,CAAC,GAAG,KAAK,UAAU;QAAE,OAAQ,CAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IAC3F,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAkD,CAAC,EAAE,CAAC;QACxF,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,OAA4B,EAC5B,OAAoB,EACpB,MAAc,EACd,OAAmD,EAAE;IAErD,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,wBAAwB,CAAC,iBAAiB,CAAC,CAAC;IAClF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,wBAAwB,CAAC,eAAe,CAAC,CAAC;IAChF,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,GAAG,CAAC;QAAE,MAAM,IAAI,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAC3G,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAClH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC;QAAE,MAAM,IAAI,wBAAwB,CAAC,eAAe,CAAC,CAAC;IACnH,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB,CAAC;IACnH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACjD,CAAC;AACH,CAAC"}

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "lpsignal",
+  "version": "0.1.0",
+  "description": "Official LPSignal SDK: net-of-IL APR signals for concentrated-liquidity pools, a WebSocket stream that never misses a signal, webhook verification and the REST API.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "prepublishOnly": "npm run build",
+    "e2e": "node scripts/e2e.mjs"
+  },
+  "keywords": [
+    "lpsignal",
+    "defi",
+    "uniswap",
+    "concentrated-liquidity",
+    "liquidity-provider",
+    "impermanent-loss",
+    "apr",
+    "pancakeswap",
+    "aerodrome"
+  ],
+  "homepage": "https://github.com/Ligengxin96/lpsignal-sdk#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Ligengxin96/lpsignal-sdk.git",
+    "directory": "node"
+  },
+  "license": "MIT",
+  "dependencies": {
+    "ws": "^8.18.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "@types/ws": "^8.5.12",
+    "typescript": "^5.6.0",
+    "vitest": "^3.2.0"
+  }
+}