spaps-sdk 1.1.5 → 1.1.7

package/README.md

@@ -153,6 +153,7 @@ NEXT_PUBLIC_SPAPS_API_URL=https://api.sweetpotato.dev
 - **Auto-detects local mode** - No API key needed for localhost
 - **Auto-refreshes tokens** - Handles expired tokens automatically
 - **TypeScript support** - Full type definitions included
+- **Crypto payments ready** - Create invoices, poll status, verify webhooks, trigger reconciliation
 
 ### 🔐 Authentication Methods
 ```javascript

package/dist/index.d.mts

@@ -1,5 +1,6 @@
-import { CreateProductRequest, Product, UpdateProductRequest, CreatePriceRequest, Price, ProductSyncResult, AuthResponse, User as User$1, CheckoutSession, Subscription, UsageBalance } from 'spaps-types';
-export { AdminPermission, AdminRole, AdminUser, ApiResponse, AuthResponse, CheckoutSession, CreatePriceRequest, CreateProductRequest, Price, Product, ProductSyncResult, Subscription, TokenPair, UpdateProductRequest, UsageBalance, User, UserProfile, UserRole, UserWallet } from 'spaps-types';
+import * as spaps_types from 'spaps-types';
+import { CreateProductRequest, Product, UpdateProductRequest, CreatePriceRequest, Price, ProductSyncResult, CryptoReconcileRequest, AuthResponse, User as User$1, CreateCryptoInvoiceRequest, CryptoInvoiceStatusSnapshot, CheckoutSession, Subscription, UsageBalance, VerifyCryptoWebhookSignatureOptions } from 'spaps-types';
+export { AdminPermission, AdminRole, AdminUser, ApiResponse, AuthResponse, CheckoutSession, CreateCryptoInvoiceRequest, CreatePriceRequest, CreateProductRequest, CryptoInvoice, CryptoInvoiceResponse, CryptoInvoiceStatusSnapshot, CryptoReconcileRequest, Price, Product, ProductSyncResult, Subscription, TokenPair, UpdateProductRequest, UsageBalance, User, UserProfile, UserRole, UserWallet, VerifyCryptoWebhookSignatureOptions } from 'spaps-types';
 
 /**
  * Permission checking utilities for SPAPS SDK
@@ -84,11 +85,6 @@ declare class PermissionChecker {
 declare function createPermissionChecker(customAdmins?: (string | AdminConfig)[]): PermissionChecker;
 declare const defaultPermissionChecker: PermissionChecker;
 
-/**
- * @spaps/sdk - Sweet Potato Authentication & Payment Service SDK
- * Zero-config client for SPAPS authentication and payments
- */
-
 interface SPAPSConfig {
     apiUrl?: string;
     apiKey?: string;
@@ -102,6 +98,7 @@ declare class SPAPSClient {
     private accessToken?;
     private refreshToken?;
     private _isLocalMode;
+    private unwrapApiResponse;
     admin: {
         createProduct: (productData: CreateProductRequest) => Promise<{
             data: Product;
@@ -129,6 +126,11 @@ declare class SPAPSClient {
                 adminMetadata?: any;
             };
         }>;
+        triggerCryptoReconcile: (opts?: CryptoReconcileRequest) => Promise<{
+            job_id: string;
+            scheduled_at: string;
+            cursor?: Record<string, unknown>;
+        }>;
     };
     constructor(config?: SPAPSConfig);
     /** Raw API request helper that returns an ApiResponse-like shape */
@@ -250,6 +252,16 @@ declare class SPAPSClient {
         isAuthenticated: () => boolean;
     };
     payments: {
+        crypto: {
+            createInvoice: (payload: CreateCryptoInvoiceRequest) => Promise<spaps_types.CryptoInvoice>;
+            getInvoice: (invoiceId: string) => Promise<spaps_types.CryptoInvoice>;
+            getInvoiceStatus: (invoiceId: string) => Promise<CryptoInvoiceStatusSnapshot>;
+            reconcile: (options?: CryptoReconcileRequest) => Promise<{
+                job_id: string;
+                scheduled_at: string;
+                cursor?: Record<string, unknown>;
+            }>;
+        };
         createCheckoutSession: (payload: any) => Promise<CheckoutSession>;
         createPaymentCheckout: (params: {
             price_id: string;
@@ -397,6 +409,7 @@ declare class SPAPSClient {
         data: any;
     }>;
 }
+declare function verifyCryptoWebhookSignature(options: VerifyCryptoWebhookSignatureOptions): boolean;
 
 declare class TokenManager {
     private static readonly ACCESS_TOKEN_KEY;
@@ -416,4 +429,4 @@ declare class WalletUtils {
     static isValidAddress(address: string, chainType?: 'solana' | 'ethereum' | 'bitcoin' | 'base'): boolean;
 }
 
-export { type AdminConfig, DEFAULT_ADMIN_ACCOUNTS, type PermissionCheckResult, PermissionChecker, SPAPSClient as SPAPS, SPAPSClient, type SPAPSConfig, TokenManager, WalletUtils, canAccessAdmin, createPermissionChecker, SPAPSClient as default, defaultPermissionChecker, getRoleAwareErrorMessage, getUserDisplay, getUserRole, hasPermission, isAdminAccount };
+export { type AdminConfig, DEFAULT_ADMIN_ACCOUNTS, type PermissionCheckResult, PermissionChecker, SPAPSClient as SPAPS, SPAPSClient, type SPAPSConfig, TokenManager, WalletUtils, canAccessAdmin, createPermissionChecker, SPAPSClient as default, defaultPermissionChecker, getRoleAwareErrorMessage, getUserDisplay, getUserRole, hasPermission, isAdminAccount, verifyCryptoWebhookSignature };

package/dist/index.d.ts

@@ -1,5 +1,6 @@
-import { CreateProductRequest, Product, UpdateProductRequest, CreatePriceRequest, Price, ProductSyncResult, AuthResponse, User as User$1, CheckoutSession, Subscription, UsageBalance } from 'spaps-types';
-export { AdminPermission, AdminRole, AdminUser, ApiResponse, AuthResponse, CheckoutSession, CreatePriceRequest, CreateProductRequest, Price, Product, ProductSyncResult, Subscription, TokenPair, UpdateProductRequest, UsageBalance, User, UserProfile, UserRole, UserWallet } from 'spaps-types';
+import * as spaps_types from 'spaps-types';
+import { CreateProductRequest, Product, UpdateProductRequest, CreatePriceRequest, Price, ProductSyncResult, CryptoReconcileRequest, AuthResponse, User as User$1, CreateCryptoInvoiceRequest, CryptoInvoiceStatusSnapshot, CheckoutSession, Subscription, UsageBalance, VerifyCryptoWebhookSignatureOptions } from 'spaps-types';
+export { AdminPermission, AdminRole, AdminUser, ApiResponse, AuthResponse, CheckoutSession, CreateCryptoInvoiceRequest, CreatePriceRequest, CreateProductRequest, CryptoInvoice, CryptoInvoiceResponse, CryptoInvoiceStatusSnapshot, CryptoReconcileRequest, Price, Product, ProductSyncResult, Subscription, TokenPair, UpdateProductRequest, UsageBalance, User, UserProfile, UserRole, UserWallet, VerifyCryptoWebhookSignatureOptions } from 'spaps-types';
 
 /**
  * Permission checking utilities for SPAPS SDK
@@ -84,11 +85,6 @@ declare class PermissionChecker {
 declare function createPermissionChecker(customAdmins?: (string | AdminConfig)[]): PermissionChecker;
 declare const defaultPermissionChecker: PermissionChecker;
 
-/**
- * @spaps/sdk - Sweet Potato Authentication & Payment Service SDK
- * Zero-config client for SPAPS authentication and payments
- */
-
 interface SPAPSConfig {
     apiUrl?: string;
     apiKey?: string;
@@ -102,6 +98,7 @@ declare class SPAPSClient {
     private accessToken?;
     private refreshToken?;
     private _isLocalMode;
+    private unwrapApiResponse;
     admin: {
         createProduct: (productData: CreateProductRequest) => Promise<{
             data: Product;
@@ -129,6 +126,11 @@ declare class SPAPSClient {
                 adminMetadata?: any;
             };
         }>;
+        triggerCryptoReconcile: (opts?: CryptoReconcileRequest) => Promise<{
+            job_id: string;
+            scheduled_at: string;
+            cursor?: Record<string, unknown>;
+        }>;
     };
     constructor(config?: SPAPSConfig);
     /** Raw API request helper that returns an ApiResponse-like shape */
@@ -250,6 +252,16 @@ declare class SPAPSClient {
         isAuthenticated: () => boolean;
     };
     payments: {
+        crypto: {
+            createInvoice: (payload: CreateCryptoInvoiceRequest) => Promise<spaps_types.CryptoInvoice>;
+            getInvoice: (invoiceId: string) => Promise<spaps_types.CryptoInvoice>;
+            getInvoiceStatus: (invoiceId: string) => Promise<CryptoInvoiceStatusSnapshot>;
+            reconcile: (options?: CryptoReconcileRequest) => Promise<{
+                job_id: string;
+                scheduled_at: string;
+                cursor?: Record<string, unknown>;
+            }>;
+        };
         createCheckoutSession: (payload: any) => Promise<CheckoutSession>;
         createPaymentCheckout: (params: {
             price_id: string;
@@ -397,6 +409,7 @@ declare class SPAPSClient {
         data: any;
     }>;
 }
+declare function verifyCryptoWebhookSignature(options: VerifyCryptoWebhookSignatureOptions): boolean;
 
 declare class TokenManager {
     private static readonly ACCESS_TOKEN_KEY;
@@ -416,4 +429,4 @@ declare class WalletUtils {
     static isValidAddress(address: string, chainType?: 'solana' | 'ethereum' | 'bitcoin' | 'base'): boolean;
 }
 
-export { type AdminConfig, DEFAULT_ADMIN_ACCOUNTS, type PermissionCheckResult, PermissionChecker, SPAPSClient as SPAPS, SPAPSClient, type SPAPSConfig, TokenManager, WalletUtils, canAccessAdmin, createPermissionChecker, SPAPSClient as default, defaultPermissionChecker, getRoleAwareErrorMessage, getUserDisplay, getUserRole, hasPermission, isAdminAccount };
+export { type AdminConfig, DEFAULT_ADMIN_ACCOUNTS, type PermissionCheckResult, PermissionChecker, SPAPSClient as SPAPS, SPAPSClient, type SPAPSConfig, TokenManager, WalletUtils, canAccessAdmin, createPermissionChecker, SPAPSClient as default, defaultPermissionChecker, getRoleAwareErrorMessage, getUserDisplay, getUserRole, hasPermission, isAdminAccount, verifyCryptoWebhookSignature };

package/dist/index.js

@@ -208,9 +208,11 @@ __export(index_exports, {
   getUserDisplay: () => getUserDisplay,
   getUserRole: () => getUserRole,
   hasPermission: () => hasPermission,
-  isAdminAccount: () => isAdminAccount
+  isAdminAccount: () => isAdminAccount,
+  verifyCryptoWebhookSignature: () => verifyCryptoWebhookSignature
 });
 module.exports = __toCommonJS(index_exports);
+var import_crypto = __toESM(require("crypto"));
 var import_axios = __toESM(require("axios"));
 init_permissions();
 if (typeof globalThis.fetch === "undefined") {
@@ -222,6 +224,13 @@ var SPAPSClient = class {
   accessToken;
   refreshToken;
   _isLocalMode = false;
+  unwrapApiResponse(response, fallback) {
+    const body = response?.data ?? response;
+    if (body?.success === false) {
+      throw new Error(body?.error?.message || fallback);
+    }
+    return body?.data ?? body;
+  }
   // Admin namespace for cleaner API
   admin = {
     createProduct: (productData) => this.createProduct(productData),
@@ -229,7 +238,8 @@ var SPAPSClient = class {
     deleteProduct: (productId) => this.deleteProduct(productId),
     createPrice: (priceData) => this.createPrice(priceData),
     syncProducts: () => this.syncProducts(),
-    getProducts: () => this.getProducts()
+    getProducts: () => this.getProducts(),
+    triggerCryptoReconcile: (opts) => this.payments.crypto.reconcile(opts || {})
   };
   constructor(config = {}) {
     const apiUrl = config.apiUrl || process.env.SPAPS_API_URL || process.env.NEXT_PUBLIC_SPAPS_API_URL;
@@ -507,6 +517,48 @@ var SPAPSClient = class {
     isAuthenticated: () => !!this.accessToken
   };
   payments = {
+    crypto: {
+      createInvoice: async (payload) => {
+        const body = {
+          asset: payload.asset,
+          network: payload.network,
+          amount: payload.amount
+        };
+        if (typeof payload.expiresInSeconds === "number") {
+          body.expires_in_seconds = payload.expiresInSeconds;
+        }
+        if (payload.beneficiary) {
+          body.beneficiary = payload.beneficiary;
+        }
+        if (payload.metadata) {
+          body.metadata = payload.metadata;
+        }
+        const res = await this.client.post("/api/payments/crypto/invoices", body);
+        const data = this.unwrapApiResponse(res, "Failed to create crypto invoice");
+        return data.invoice;
+      },
+      getInvoice: async (invoiceId) => {
+        const res = await this.client.get(`/api/payments/crypto/invoices/${invoiceId}`);
+        const data = this.unwrapApiResponse(res, "Failed to fetch crypto invoice");
+        return data.invoice;
+      },
+      getInvoiceStatus: async (invoiceId) => {
+        const res = await this.client.get(`/api/payments/crypto/invoices/${invoiceId}/status`);
+        return this.unwrapApiResponse(res, "Failed to fetch crypto invoice status");
+      },
+      reconcile: async (options = {}) => {
+        const headers = {};
+        if (options.reconToken) {
+          headers["X-Recon-Token"] = options.reconToken;
+        }
+        const payload = {};
+        if (options.cursor) {
+          payload.cursor = options.cursor;
+        }
+        const res = await this.client.post("/api/payments/crypto/reconcile", payload, { headers });
+        return this.unwrapApiResponse(res, "Failed to trigger crypto reconciliation");
+      }
+    },
     createCheckoutSession: async (payload) => {
       const headers = {};
       if (this.accessToken) headers["Authorization"] = `Bearer ${this.accessToken}`;
@@ -802,6 +854,37 @@ var SPAPSClient = class {
     return this.client.get("/health");
   }
 };
+function verifyCryptoWebhookSignature(options) {
+  const { body, signature, secret, toleranceSeconds = 300 } = options;
+  if (!signature) {
+    throw new Error("Missing webhook signature");
+  }
+  const parts = signature.split(",").reduce((acc, part) => {
+    const [key, value] = part.split("=");
+    if (key && value) acc[key.trim()] = value.trim();
+    return acc;
+  }, {});
+  const timestamp = parts["t"];
+  const expected = parts["v1"];
+  if (!timestamp || !expected) {
+    throw new Error("Invalid webhook signature format");
+  }
+  const rawBody = typeof body === "string" ? body : body instanceof Uint8Array ? Buffer.from(body).toString("utf8") : JSON.stringify(body ?? {});
+  const computed = import_crypto.default.createHmac("sha256", secret).update(`${timestamp}.${rawBody}`).digest("hex");
+  const expectedBuffer = Buffer.from(expected, "hex");
+  const computedBuffer = Buffer.from(computed, "hex");
+  if (expectedBuffer.length !== computedBuffer.length || !import_crypto.default.timingSafeEqual(expectedBuffer, computedBuffer)) {
+    throw new Error("Invalid webhook signature");
+  }
+  const ts = Number(timestamp);
+  if (Number.isFinite(ts) && toleranceSeconds > 0) {
+    const ageSeconds = Math.abs(Date.now() / 1e3 - ts);
+    if (ageSeconds > toleranceSeconds) {
+      throw new Error("Webhook signature timestamp outside tolerance window");
+    }
+  }
+  return true;
+}
 var index_default = SPAPSClient;
 var TokenManager = class _TokenManager {
   static ACCESS_TOKEN_KEY = "sweet_potato_access_token";
@@ -911,5 +994,6 @@ var WalletUtils = class _WalletUtils {
   getUserDisplay,
   getUserRole,
   hasPermission,
-  isAdminAccount
+  isAdminAccount,
+  verifyCryptoWebhookSignature
 });

package/dist/index.mjs

@@ -188,6 +188,7 @@ var init_permissions = __esm({
 
 // src/index.ts
 init_permissions();
+import crypto from "crypto";
 import axios from "axios";
 if (typeof globalThis.fetch === "undefined") {
   __require("cross-fetch/polyfill");
@@ -198,6 +199,13 @@ var SPAPSClient = class {
   accessToken;
   refreshToken;
   _isLocalMode = false;
+  unwrapApiResponse(response, fallback) {
+    const body = response?.data ?? response;
+    if (body?.success === false) {
+      throw new Error(body?.error?.message || fallback);
+    }
+    return body?.data ?? body;
+  }
   // Admin namespace for cleaner API
   admin = {
     createProduct: (productData) => this.createProduct(productData),
@@ -205,7 +213,8 @@ var SPAPSClient = class {
     deleteProduct: (productId) => this.deleteProduct(productId),
     createPrice: (priceData) => this.createPrice(priceData),
     syncProducts: () => this.syncProducts(),
-    getProducts: () => this.getProducts()
+    getProducts: () => this.getProducts(),
+    triggerCryptoReconcile: (opts) => this.payments.crypto.reconcile(opts || {})
   };
   constructor(config = {}) {
     const apiUrl = config.apiUrl || process.env.SPAPS_API_URL || process.env.NEXT_PUBLIC_SPAPS_API_URL;
@@ -483,6 +492,48 @@ var SPAPSClient = class {
     isAuthenticated: () => !!this.accessToken
   };
   payments = {
+    crypto: {
+      createInvoice: async (payload) => {
+        const body = {
+          asset: payload.asset,
+          network: payload.network,
+          amount: payload.amount
+        };
+        if (typeof payload.expiresInSeconds === "number") {
+          body.expires_in_seconds = payload.expiresInSeconds;
+        }
+        if (payload.beneficiary) {
+          body.beneficiary = payload.beneficiary;
+        }
+        if (payload.metadata) {
+          body.metadata = payload.metadata;
+        }
+        const res = await this.client.post("/api/payments/crypto/invoices", body);
+        const data = this.unwrapApiResponse(res, "Failed to create crypto invoice");
+        return data.invoice;
+      },
+      getInvoice: async (invoiceId) => {
+        const res = await this.client.get(`/api/payments/crypto/invoices/${invoiceId}`);
+        const data = this.unwrapApiResponse(res, "Failed to fetch crypto invoice");
+        return data.invoice;
+      },
+      getInvoiceStatus: async (invoiceId) => {
+        const res = await this.client.get(`/api/payments/crypto/invoices/${invoiceId}/status`);
+        return this.unwrapApiResponse(res, "Failed to fetch crypto invoice status");
+      },
+      reconcile: async (options = {}) => {
+        const headers = {};
+        if (options.reconToken) {
+          headers["X-Recon-Token"] = options.reconToken;
+        }
+        const payload = {};
+        if (options.cursor) {
+          payload.cursor = options.cursor;
+        }
+        const res = await this.client.post("/api/payments/crypto/reconcile", payload, { headers });
+        return this.unwrapApiResponse(res, "Failed to trigger crypto reconciliation");
+      }
+    },
     createCheckoutSession: async (payload) => {
       const headers = {};
       if (this.accessToken) headers["Authorization"] = `Bearer ${this.accessToken}`;
@@ -778,6 +829,37 @@ var SPAPSClient = class {
     return this.client.get("/health");
   }
 };
+function verifyCryptoWebhookSignature(options) {
+  const { body, signature, secret, toleranceSeconds = 300 } = options;
+  if (!signature) {
+    throw new Error("Missing webhook signature");
+  }
+  const parts = signature.split(",").reduce((acc, part) => {
+    const [key, value] = part.split("=");
+    if (key && value) acc[key.trim()] = value.trim();
+    return acc;
+  }, {});
+  const timestamp = parts["t"];
+  const expected = parts["v1"];
+  if (!timestamp || !expected) {
+    throw new Error("Invalid webhook signature format");
+  }
+  const rawBody = typeof body === "string" ? body : body instanceof Uint8Array ? Buffer.from(body).toString("utf8") : JSON.stringify(body ?? {});
+  const computed = crypto.createHmac("sha256", secret).update(`${timestamp}.${rawBody}`).digest("hex");
+  const expectedBuffer = Buffer.from(expected, "hex");
+  const computedBuffer = Buffer.from(computed, "hex");
+  if (expectedBuffer.length !== computedBuffer.length || !crypto.timingSafeEqual(expectedBuffer, computedBuffer)) {
+    throw new Error("Invalid webhook signature");
+  }
+  const ts = Number(timestamp);
+  if (Number.isFinite(ts) && toleranceSeconds > 0) {
+    const ageSeconds = Math.abs(Date.now() / 1e3 - ts);
+    if (ageSeconds > toleranceSeconds) {
+      throw new Error("Webhook signature timestamp outside tolerance window");
+    }
+  }
+  return true;
+}
 var index_default = SPAPSClient;
 var TokenManager = class _TokenManager {
   static ACCESS_TOKEN_KEY = "sweet_potato_access_token";
@@ -887,5 +969,6 @@ export {
   getUserDisplay,
   getUserRole,
   hasPermission,
-  isAdminAccount
+  isAdminAccount,
+  verifyCryptoWebhookSignature
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spaps-sdk",
-  "version": "1.1.5",
+  "version": "1.1.7",
   "description": "Sweet Potato Authentication & Payment Service SDK - Zero-config client with built-in permission checking and role-based access control",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -44,7 +44,7 @@
     "email": "buildooor@gmail.com"
   },
   "dependencies": {
-    "spaps-types": "^1.0.10",
+    "spaps-types": "^1.0.12",
     "axios": "^1.6.0",
     "cross-fetch": "^4.0.0"
   },