/** * Webhook verification utilities — SERVER-SIDE ONLY. * Uses node:crypto, do not import in browser bundles. * * Import from "@gamecore/sdk/server" instead of "@gamecore/sdk". */ import type { WebhookPayload } from "./types"; /** * Verify webhook signature (HMAC-SHA256) with timing-safe comparison. * Use on your server to validate incoming webhooks from GameCore. * * GameCore signs webhooks with one of two compatible schemes; this verifier * handles both, selected by whether you pass the `timestamp` argument: * * - **Storefront events** (order/payment notifications) — signature is * `sha256=hex(HMAC(secret, body))` and the timestamp lives inside the JSON * body. Call WITHOUT `timestamp`; freshness comes from `body.timestamp`. * - **B2B events** — signature is `sha256=hex(HMAC(secret, "."))` * and the timestamp is sent in the `X-Webhook-Timestamp` header (unix * seconds). Pass that header value as `timestamp`; freshness comes from it. * * Always pass the `X-Webhook-Timestamp` header value when the request carries * one — omitting it makes a B2B signature fail (the schemes don't collide), so * a tampered/downgraded request can't slip through. Pass the header value * verbatim; an empty/absent header is treated as "storefront event". * * Replay safety: the only built-in replay defense is the freshness window, so a * legitimate event re-POSTed within `maxAgeSeconds` still verifies. For true * idempotency, dedupe on the `X-Idempotency-Key` header (B2B) or the event id in * the body. `maxAgeSeconds = 0` disables the freshness window for BOTH schemes — * use it only if you dedupe events yourself. * * @param payload - Raw request body string * @param signature - Value of the `X-Webhook-Signature` header (`sha256=…`) * @param secret - Your webhook secret from site settings * @param maxAgeSeconds - Freshness window in seconds (default 300). `0` disables * the replay window for both schemes. * @param timestamp - Value of the `X-Webhook-Timestamp` header (unix seconds), * if present. Omit (or pass `undefined`/`""`) for storefront * events. */ export declare function verifyWebhookSignature(payload: string, signature: string, secret: string, maxAgeSeconds?: number, timestamp?: string | number): boolean; /** * Parse a webhook payload string into a typed object. */ export declare function parseWebhookPayload(body: string): WebhookPayload;