@doist/todoist-sdk 9.2.0 → 9.4.0

package/dist/types/utils/index.d.ts

@@ -3,3 +3,5 @@ export * from './sanitization.js';
 export { getTaskUrl, getProjectUrl, getSectionUrl } from './url-helpers.js';
 export { createCommand } from './sync-helpers.js';
 export * from './project-helpers.js';
+export { parseWebhookPayload, verifyWebhookSignature } from './webhook-parser.js';
+export type { VerifyWebhookSignatureArgs } from './webhook-parser.js';

package/dist/types/utils/validators.d.ts

@@ -1,4 +1,6 @@
+import { z } from 'zod';
 import { type SyncResponse } from '../types/sync/response.js';
+export declare const IdSchema: z.ZodString;
 export declare const validateTask: (input: unknown) => {
     isUncompletable: boolean;
     url: string;

package/dist/types/utils/webhook-parser.d.ts

@@ -0,0 +1,48 @@
+import { type WebhookPayload } from '../types/webhooks/types.js';
+/**
+ * Parses an incoming webhook request body into a typed payload.
+ *
+ * The backend sends snake_case keys (e.g. `event_name`, `user_id`, `added_at`);
+ * this converts them to camelCase and validates against
+ * {@link WebhookPayloadSchema}. Event-specific `eventData` is returned as
+ * `unknown` for events that are not yet narrowed per-resource.
+ *
+ * Pass the parsed JSON body (or any unknown value) — validation throws on
+ * unexpected shape.
+ */
+export declare function parseWebhookPayload(raw: unknown): WebhookPayload;
+/**
+ * Arguments for {@link verifyWebhookSignature}.
+ */
+export type VerifyWebhookSignatureArgs = {
+    /**
+     * The raw (unparsed) request body exactly as received. Parsing and
+     * re-serialising JSON before hashing will change whitespace and byte order
+     * and cause verification to fail.
+     */
+    rawBody: string | Uint8Array;
+    /**
+     * The value of the `X-Todoist-Hmac-SHA256` request header — a base64
+     * encoded HMAC-SHA256 digest.
+     */
+    signature: string;
+    /**
+     * The app's OAuth client secret, used as the HMAC key.
+     */
+    clientSecret: string;
+};
+/**
+ * Verifies a webhook request's HMAC signature.
+ *
+ * Todoist signs webhook deliveries with an HMAC-SHA256 of the raw request body
+ * using the app's `client_secret` as the key, base64-encoded in the
+ * `X-Todoist-Hmac-SHA256` header.
+ *
+ * Uses the Web Crypto API (`crypto.subtle`), which is available in Node ≥ 20,
+ * modern browsers, React Native (with polyfills), and edge runtimes. The
+ * comparison is constant-time.
+ *
+ * @returns `true` when the signature is valid, `false` otherwise. Never throws
+ * on malformed input.
+ */
+export declare function verifyWebhookSignature({ rawBody, signature, clientSecret, }: VerifyWebhookSignatureArgs): Promise<boolean>;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@doist/todoist-sdk",
-    "version": "9.2.0",
+    "version": "9.4.0",
     "description": "The official TypeScript SDK for the Todoist REST API.",
     "author": "Doist developers",
     "repository": "https://github.com/Doist/todoist-sdk-typescript",