@stable_sea/sdk 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { createStableSeaClient, type StableSeaClient, type StableSeaMutation, type StableSeaMutationOptions, } from "./client.js";
+export type { StableSeaClientOptions } from "./client.js";
+export type { components, operations, paths } from "./gen/schema.js";
+export { verifyWebhookSignature, type VerifyWebhookSignatureOptions, } from "./webhooks.js";

package/dist/index.js

@@ -0,0 +1,2 @@
+export { createStableSeaClient, } from "./client.js";
+export { verifyWebhookSignature, } from "./webhooks.js";

package/dist/webhooks.d.ts

@@ -0,0 +1,5 @@
+export interface VerifyWebhookSignatureOptions {
+    now?: number;
+    toleranceSeconds?: number;
+}
+export declare function verifyWebhookSignature(rawBody: string | Uint8Array, signatureHeader: string, signingSecret: string, options?: VerifyWebhookSignatureOptions): boolean;

package/dist/webhooks.js

@@ -0,0 +1,30 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+export function verifyWebhookSignature(rawBody, signatureHeader, signingSecret, options = {}) {
+    const tolerance = options.toleranceSeconds ?? 300;
+    if (!Number.isFinite(tolerance) || tolerance < 0) {
+        throw new RangeError("toleranceSeconds must be a non-negative number");
+    }
+    const fields = signatureHeader.split(",").map((field) => field.split("=", 2));
+    const timestampText = fields.find(([name]) => name === "t")?.[1];
+    const signatures = fields
+        .filter(([name, value]) => name === "v1" && /^[0-9a-f]{64}$/i.test(value ?? ""))
+        .map(([, value]) => value);
+    if (!timestampText || !/^\d+$/.test(timestampText) || signatures.length === 0)
+        return false;
+    const timestamp = Number(timestampText);
+    const now = options.now ?? Date.now() / 1000;
+    if (!signingSecret || !Number.isSafeInteger(timestamp) || !Number.isFinite(now))
+        return false;
+    if (Math.abs(now - timestamp) > tolerance)
+        return false;
+    const expected = createHmac("sha256", signingSecret)
+        .update(`${timestampText}.`)
+        .update(rawBody)
+        .digest();
+    for (const signature of signatures) {
+        const candidate = Buffer.from(signature, "hex");
+        if (candidate.length === expected.length && timingSafeEqual(candidate, expected))
+            return true;
+    }
+    return false;
+}

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@stable_sea/sdk",
+  "version": "0.1.0",
+  "type": "module",
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": "git+https://github.com/StableSea/monorepo.git",
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.build.json && mkdir -p dist/gen && cp -f src/gen/schema.d.ts dist/gen/schema.d.ts",
+    "generate": "bash scripts/generate.sh",
+    "prepack": "npm run build",
+    "test": "npm run build && npm run test:unit && npm run test:consumer",
+    "test:consumer": "bash scripts/test-consumer.sh",
+    "test:unit": "vitest run --dir test",
+    "typecheck": "npm run build && tsc -p tsconfig.json",
+    "validate": "npm test && tsc -p tsconfig.json"
+  },
+  "dependencies": {
+    "openapi-fetch": "0.17.0"
+  },
+  "devDependencies": {
+    "@types/node": "24.10.1",
+    "openapi-typescript": "7.13.0",
+    "typescript": "5.9.3",
+    "vitest": "4.1.11"
+  },
+  "overrides": {
+    "js-yaml": "^5.2.3",
+    "nanoid": "^3.3.17"
+  }
+}