feat: support app key signatures

.changeset/rich-bags-begin.md

@@ -0,0 +1,6 @@
+---
+"frames.js": patch
+"@frames.js/debugger": patch
+---
+
+feat: support for app key signatures

packages/frames.js/package.json

@@ -187,6 +187,16 @@
         "default": "./dist/farcaster-v2/types.cjs"
       }
     },
+    "./farcaster-v2/verify": {
+      "import": {
+        "types": "./dist/farcaster-v2/verify.d.ts",
+        "default": "./dist/farcaster-v2/verify.js"
+      },
+      "require": {
+        "types": "./dist/farcaster-v2/verify.d.cts",
+        "default": "./dist/farcaster-v2/verify.cjs"
+      }
+    },
     "./core": {
       "import": {
         "types": "./dist/core/index.d.ts",
@@ -420,12 +430,14 @@
   },
   "dependencies": {
     "@farcaster/frame-core": "^0.0.24",
-    "@farcaster/frame-node": "^0.0.13",
+    "@noble/ed25519": "^2.2.3",
+    "@noble/hashes": "^1.7.1",
     "@vercel/og": "^0.6.3",
     "cheerio": "^1.0.0-rc.12",
+    "ox": "^0.4.4",
     "protobufjs": "^7.2.6",
-    "viem": "^2.7.8",
     "type-fest": "^4.28.1",
+    "viem": "^2.7.8",
     "zod": "^3.24.1"
   }
 }

packages/frames.js/src/farcaster-v2/es25519.ts

@@ -0,0 +1,8 @@
+import { sha512 } from "@noble/hashes/sha512";
+import { etc, getPublicKey, sign, verify } from "@noble/ed25519";
+
+if (!etc.sha512Sync) {
+  etc.sha512Sync = (...m: Uint8Array[]) => sha512(etc.concatBytes(...m));
+}
+
+export { getPublicKey, sign, verify };

packages/frames.js/src/farcaster-v2/events.ts

@@ -3,11 +3,9 @@ import type {
   EncodedJsonFarcasterSignatureSchema,
 } from "@farcaster/frame-core";
 import { serverEventSchema } from "@farcaster/frame-core";
-import {
-  createJsonFarcasterSignature,
-  hexToBytes,
-} from "@farcaster/frame-node";
-import type { Hex } from "viem";
+import { bytesToHex, type Hex } from "viem";
+import { sign, signMessageWithAppKey } from "./json-signature";
+import { getPublicKey } from "./es25519";
 
 export class InvalidWebhookResponseError extends Error {
   constructor(
@@ -22,7 +20,7 @@ export type { FrameServerEvent };
 
 type SendEventOptions = {
   /**
-   * App private key
+   * Private app key (signer private key)
    */
   privateKey: Hex | Uint8Array;
   fid: number;
@@ -36,13 +34,16 @@ export async function sendEvent(
   event: FrameServerEvent,
   { privateKey, fid, webhookUrl }: SendEventOptions
 ): Promise<void> {
+  const appKey = bytesToHex(getPublicKey(privateKey));
   const payload = serverEventSchema.parse(event);
-  const signature = createJsonFarcasterSignature({
+  const signature = await sign({
     fid,
-    payload: Buffer.from(JSON.stringify(payload)),
-    privateKey:
-      typeof privateKey === "string" ? hexToBytes(privateKey) : privateKey,
-    type: "app_key",
+    payload,
+    signer: {
+      type: "app_key",
+      appKey,
+    },
+    signMessage: signMessageWithAppKey(privateKey),
   });
 
   const response = await fetch(webhookUrl, {
@@ -52,11 +53,11 @@ export async function sendEvent(
       "Content-Type": "application/json",
     },
     body: JSON.stringify(
-      signature satisfies EncodedJsonFarcasterSignatureSchema
+      signature.json satisfies EncodedJsonFarcasterSignatureSchema
     ),
   });
 
-  if (response.status >= 200 && response.status < 300) {
+  if (response.ok) {
     return;
   }