fix publish bug

Author: lyoshenka

AGENTS.md

@@ -18,7 +18,7 @@
 - The `pkgs/ui-elements` workspace package (`@farcaster/snap-ui-elements`) defines the json-render catalog; the emulator depends on it to render snaps.
 - Local dev ports: emulator on 3000, `snap-template` on 3003; example apps under `examples/` use ports 3010 and higher with a distinct port per app.
 - For snap HTTP GET, send `Accept: application/json+farcaster-snap`; example servers typically expose JSON on `/snap`, not on bare `/`.
-- Local `registerSnapHandler` skips JFS when `NODE_ENV` is not `production` (unsigned JSON POSTs, including from `apps/emulator`). Set `SKIP_JFS_VERIFICATION=no` to require JFS anyway, or `=yes` / `=1` to force bypass in production (dev-only).
+- Local `registerSnapHandler` skips JFS **signature** verification when `NODE_ENV` is not `production`, but POST bodies must still be JFS-shaped JSON (`header` / `payload` / `signature`), including from `apps/emulator`. Set `SKIP_JFS_VERIFICATION=no` to require verification anyway, or `=yes` / `=1` to force bypass in production (dev-only).
 - When using `FARCASTER_HUB_URL`, include the port (e.g. `https://rho.farcaster.xyz:3381`).
 - Set `SNAP_PUBLIC_BASE_URL` to the canonical HTTPS origin (no trailing slash) so `page.buttons[].target` URLs resolve correctly.
 - Snap hub verification uses the Hubble **HTTP** API only (no gRPC client). Hub URL helpers accept `http`/`https` with an explicit port or bare `host:port`; `grpc:`/`grpcs:` are invalid.

pkgs/hono/package.json

@@ -39,6 +39,7 @@
     "hono": ">=4.0.0"
   },
   "devDependencies": {
+    "@farcaster/jfs": "^0.2.2",
     "@types/node": "^25.5.0",
     "hono": "^4.0.0",
     "typescript": "^5.4.0",

pkgs/hono/src/index.ts

@@ -16,7 +16,7 @@ export type SnapHandlerOptions = {
   path?: string;
 
   /**
-   * When true, skip JFS verification of JSON POST bodies.
+   * When true, skip JFS signature verification only. POST bodies must still be JFS-shaped JSON.
    * When omitted, default to {@link envSkipJFSVerification}.
    */
   skipJFSVerification?: boolean;
@@ -32,8 +32,8 @@ export type SnapHandlerOptions = {
  * Register GET and POST snap handlers on `app` at `options.path` (default `/`).
  *
  * - GET  → calls `snapFn({ action: { type: "get" }, request })` and returns the response.
- * - POST → parses the request, verifies the JFS body via {@link verifyJFSRequestBody} (unless `skipJFSVerification` is true),
- *          calls `snapFn({ action, request })`, and returns the response.
+ * - POST → parses the JFS-shaped JSON body; verifies it via {@link verifyJFSRequestBody} unless
+ *          `skipJFSVerification` is true, then calls `snapFn({ action, request })` and returns the response.
  *
  * All parsing, schema validation, signature verification, and error responses
  * are handled automatically. `SnapContext.request` is the raw `Request` so handlers

pkgs/hono/tests/registerSnapHandler.test.ts

@@ -1,10 +1,12 @@
 import { describe, expect, it } from "vitest";
 import { Hono } from "hono";
 import { registerSnapHandler } from "../src/index";
+import { encodePayload } from "@farcaster/jfs";
 import {
   MEDIA_TYPE,
   DEFAULT_THEME_ACCENT,
   type SnapFunction,
+  type SnapPayload,
 } from "@farcaster/snap";
 
 const SNAP_CONTENT_TYPE = `${MEDIA_TYPE}; charset=utf-8`;
@@ -21,12 +23,17 @@ const minimalSnapFn: SnapFunction = async () => ({
   },
 });
 
-function postBody() {
-  return JSON.stringify({
+function jfsPostBody() {
+  const payload: SnapPayload = {
     fid: 1,
     inputs: {},
     button_index: 0,
     timestamp: Math.floor(Date.now() / 1000),
+  };
+  return JSON.stringify({
+    header: "dev",
+    payload: encodePayload(payload),
+    signature: "dev",
   });
 }
 
@@ -67,13 +74,34 @@ describe("registerSnapHandler content type", () => {
     const res = await app.request("/", {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: postBody(),
+      body: jfsPostBody(),
     });
 
     expect(res.status).toBe(200);
     expect(res.headers.get("Content-Type")).toBe(SNAP_CONTENT_TYPE);
   });
 
+  it("POST with bare JSON body returns 400 when skipping JFS verification", async () => {
+    const app = new Hono();
+    registerSnapHandler(app, minimalSnapFn, {
+      skipJFSVerification: true,
+    });
+
+    const res = await app.request("/", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        fid: 1,
+        inputs: {},
+        button_index: 0,
+        timestamp: Math.floor(Date.now() / 1000),
+      }),
+    });
+
+    expect(res.status).toBe(400);
+    expect(res.headers.get("Content-Type")).toMatch(/^application\/json/);
+  });
+
   it("POST with invalid body returns application/json (not snap type)", async () => {
     const app = new Hono();
     registerSnapHandler(app, minimalSnapFn, {

pkgs/snap/src/http.ts

@@ -37,9 +37,7 @@ export type ParseRequestError =
 
 export type ParseRequestOptions = {
   /**
-   * When true, skip JFS verification of JSON POST bodies.
-   * When false (default), the body must be JSON `{ header, payload, signature }` verified via
-   * {@link verifyJFSRequestBody}.
+   * When true, skip {@link verifyJFSRequestBody} (signature checks).
    */
   skipJFSVerification?: boolean;
 };
@@ -68,8 +66,7 @@ const requestBodySchema = z.object({
 /**
  * Parse and validate Farcaster snap requests:
  * - `GET` is allowed for first-page loads and returns `{ type: "get" }`.
- * - `POST`: by default the body is JSON JFS (`header` / `payload` / `signature`) verified with
- *   {@link verifyJFSRequestBody}; with `skipJFSVerification`, accepts plain action JSON (dev only).
+ * - `POST`: the body must be JSON in JFS form (`header` / `payload` / `signature`) even if JFS verification is skipped.
  */
 export async function parseRequest(
   request: Request,

pkgs/snap/tests/http.test.ts

@@ -31,7 +31,7 @@ describe("parseRequest", () => {
     expect(res).toEqual({ success: true, action: { type: "get" } });
   });
 
-  it("accepts plain JSON POST when skipJFSVerification is true", async () => {
+  it("accepts JFS-shaped POST even when skipJFSVerification is true", async () => {
     const body = postBody();
     const payload = decodePayload<SnapPayload>(body.payload);
     const res = await parseRequest(
@@ -54,6 +54,25 @@ describe("parseRequest", () => {
     });
   });
 
+  it("does not accept bare JSON POST payload even when skipJFSVerification is true", async () => {
+    const payload: SnapPayload = {
+      fid: 42,
+      inputs: { guess: "HELLO" },
+      button_index: 0,
+      timestamp: Math.floor(Date.now() / 1000),
+    };
+    const res = await parseRequest(
+      new Request("https://example.com/snap", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(payload),
+      }),
+      { skipJFSVerification: true },
+    );
+    expect(res.success).toBe(false);
+    if (!res.success) expect(res.error.type).toBe("invalid_json");
+  });
+
   it("fails when bypass JSON is invalid", async () => {
     const res = await parseRequest(
       new Request("https://example.com/snap", {

template/README.md

@@ -17,14 +17,14 @@ Then set dependencies in `package.json` to published versions of `@farcaster/sna
 
 - Hono app with `@farcaster/snap-hono` (`registerSnapHandler`) for GET/POST handling and validation
 - Vercel entrypoint at `api/index.ts`
-- `registerSnapHandler` uses JFS verification in production (`NODE_ENV=production`); locally it accepts the same unsigned JSON body the emulator sends (override with `SKIP_JFS_VERIFICATION=no` to force JFS, or `=yes` to force bypass)
+- `registerSnapHandler` verifies JFS signatures in production (`NODE_ENV=production`); locally it skips verification for the same JFS-shaped dev envelope the emulator sends (override with `SKIP_JFS_VERIFICATION=no` to require verification, or `=yes` to force bypass)
 - Vercel deployment via `vercel.json`
 
 ## Endpoints
 
 - `GET /` without `Accept: application/json+farcaster-snap` returns a short plain-text hint for browsers
 - `GET /` with the snap Accept header returns the first page (counter demo starting at 0)
-- `POST /` accepts a snap interaction payload (unsigned JSON in non-production; JFS in production) and returns the next page
+- `POST /` accepts a JFS-shaped snap interaction payload (signature verified in production only by default) and returns the next page
 - Response pages are kept within current spec limits (max 5 elements, text length constraints)
 
 ## Local development

turbo.json

@@ -7,6 +7,7 @@
       "outputs": ["dist/**", ".next/**"]
     },
     "test": {
+      "dependsOn": ["^build"],
       "outputs": []
     },
     "typecheck": {