@gethydra/sdk 0.1.0

package/dist/webhooks.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Webhook signature verification utility.
+ *
+ * Separate entry point (`@gethydra/sdk/webhooks`) — not bundled with the main
+ * client since it's only needed server-side in webhook handlers.
+ *
+ * Uses crypto.subtle.verify() for constant-time comparison across all runtimes
+ * (Node 18+, Deno, Bun, Cloudflare Workers, browsers).
+ */
+/**
+ * Verify a webhook signature against a payload and secret.
+ *
+ * @param payload - The raw request body string
+ * @param signature - The hex-encoded HMAC-SHA256 signature from the webhook header
+ * @param secret - The webhook signing secret
+ * @returns true if the signature is valid
+ *
+ * @example
+ * ```typescript
+ * import { verifyWebhookSignature } from '@gethydra/sdk/webhooks';
+ *
+ * const isValid = await verifyWebhookSignature(
+ *   rawBody,
+ *   request.headers.get('X-Hydra-Signature'),
+ *   webhookSecret,
+ * );
+ * ```
+ */
+declare function verifyWebhookSignature(payload: string, signature: string, secret: string): Promise<boolean>;
+
+export { verifyWebhookSignature };

package/dist/webhooks.js

@@ -0,0 +1,20 @@
+// src/webhooks.ts
+async function verifyWebhookSignature(payload, signature, secret) {
+  if (!signature || signature.length % 2 !== 0) return false;
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["verify"]
+  );
+  const sigBytes = new Uint8Array(signature.length / 2);
+  for (let i = 0; i < sigBytes.length; i++) {
+    sigBytes[i] = parseInt(signature.slice(i * 2, i * 2 + 2), 16);
+  }
+  return crypto.subtle.verify("HMAC", key, sigBytes, encoder.encode(payload));
+}
+export {
+  verifyWebhookSignature
+};

package/package.json

@@ -0,0 +1,52 @@
+{
+	"name": "@gethydra/sdk",
+	"version": "0.1.0",
+	"description": "Official TypeScript SDK for the Hydra Commerce API",
+	"license": "MIT",
+	"author": "Grant Capital Group",
+	"homepage": "https://hydrajs.dev/docs",
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/Hydra-headless-commerce/website.git",
+		"directory": "packages/sdk"
+	},
+	"keywords": [
+		"hydra",
+		"commerce",
+		"ecommerce",
+		"headless",
+		"api",
+		"sdk"
+	],
+	"type": "module",
+	"exports": {
+		".": {
+			"import": "./dist/index.js",
+			"types": "./dist/index.d.ts"
+		},
+		"./webhooks": {
+			"import": "./dist/webhooks.js",
+			"types": "./dist/webhooks.d.ts"
+		}
+	},
+	"files": [
+		"dist",
+		"LICENSE",
+		"README.md"
+	],
+	"engines": {
+		"node": ">=18"
+	},
+	"scripts": {
+		"generate": "bun run scripts/generate-types.ts",
+		"build": "tsup src/index.ts src/webhooks.ts --format esm --dts --clean",
+		"typecheck": "tsc --noEmit",
+		"test": "vitest run"
+	},
+	"devDependencies": {
+		"openapi-typescript": "^7.6.1",
+		"tsup": "^8.4.0",
+		"typescript": "^5.8.3",
+		"vitest": "^4.1.11"
+	}
+}