vessels-sdk 0.3.0 → 0.4.0

package/dist/index.cjs

@@ -1,7 +1,5 @@
 'use strict';
 
-var crypto = require('crypto');
-
 // src/index.ts
 var AgentActivityTypes = {
   thinking: "thinking",
@@ -189,16 +187,27 @@ var Vessels = class {
   // body: raw request body string (before JSON.parse)
   // signature: X-Vessels-Signature header value
   // webhookSecret: the secret shown when you created the webhook endpoint in Settings
-  verifyWebhook(body, signature, webhookSecret) {
+  async verifyWebhook(body, signature, webhookSecret) {
     if (!signature.startsWith("sha256=")) return false;
-    const expected = crypto.createHmac("sha256", webhookSecret).update(body).digest("hex");
-    const received = signature.slice(7);
-    if (expected.length !== received.length) return false;
-    let diff = 0;
-    for (let i = 0; i < expected.length; i++) {
-      diff |= expected.charCodeAt(i) ^ received.charCodeAt(i);
+    try {
+      const enc = new TextEncoder();
+      const hexSig = signature.slice(7);
+      if (hexSig.length % 2 !== 0) return false;
+      const sigBytes = new Uint8Array(hexSig.length / 2);
+      for (let i = 0; i < sigBytes.length; i++) {
+        sigBytes[i] = parseInt(hexSig.slice(i * 2, i * 2 + 2), 16);
+      }
+      const key = await globalThis.crypto.subtle.importKey(
+        "raw",
+        enc.encode(webhookSecret),
+        { name: "HMAC", hash: "SHA-256" },
+        false,
+        ["verify"]
+      );
+      return await globalThis.crypto.subtle.verify("HMAC", key, sigBytes, enc.encode(body));
+    } catch {
+      return false;
     }
-    return diff === 0;
   }
 };
 

package/dist/index.d.cts

@@ -137,7 +137,7 @@ declare class Vessels {
         metadata?: Record<string, unknown>;
     }): _vessels_types.ConfirmPreviewInteraction;
     poll(options?: PollOptions): Promise<PollResponse>;
-    verifyWebhook(body: string, signature: string, webhookSecret: string): boolean;
+    verifyWebhook(body: string, signature: string, webhookSecret: string): Promise<boolean>;
 }
 
 export { AgentActivityTypes, type InteractionResponseEvent, type PollEvent, type PollOptions, type PollResponse, type PushManyResult, type PushResponse, type UserMessageEvent, type VesselContext, Vessels, VesselsAuthError, type VesselsConfig, VesselsRateLimitError, VesselsValidationError };

package/dist/index.d.ts

@@ -137,7 +137,7 @@ declare class Vessels {
         metadata?: Record<string, unknown>;
     }): _vessels_types.ConfirmPreviewInteraction;
     poll(options?: PollOptions): Promise<PollResponse>;
-    verifyWebhook(body: string, signature: string, webhookSecret: string): boolean;
+    verifyWebhook(body: string, signature: string, webhookSecret: string): Promise<boolean>;
 }
 
 export { AgentActivityTypes, type InteractionResponseEvent, type PollEvent, type PollOptions, type PollResponse, type PushManyResult, type PushResponse, type UserMessageEvent, type VesselContext, Vessels, VesselsAuthError, type VesselsConfig, VesselsRateLimitError, VesselsValidationError };

package/dist/index.js

@@ -1,5 +1,3 @@
-import { createHmac } from 'crypto';
-
 // src/index.ts
 var AgentActivityTypes = {
   thinking: "thinking",
@@ -187,16 +185,27 @@ var Vessels = class {
   // body: raw request body string (before JSON.parse)
   // signature: X-Vessels-Signature header value
   // webhookSecret: the secret shown when you created the webhook endpoint in Settings
-  verifyWebhook(body, signature, webhookSecret) {
+  async verifyWebhook(body, signature, webhookSecret) {
     if (!signature.startsWith("sha256=")) return false;
-    const expected = createHmac("sha256", webhookSecret).update(body).digest("hex");
-    const received = signature.slice(7);
-    if (expected.length !== received.length) return false;
-    let diff = 0;
-    for (let i = 0; i < expected.length; i++) {
-      diff |= expected.charCodeAt(i) ^ received.charCodeAt(i);
+    try {
+      const enc = new TextEncoder();
+      const hexSig = signature.slice(7);
+      if (hexSig.length % 2 !== 0) return false;
+      const sigBytes = new Uint8Array(hexSig.length / 2);
+      for (let i = 0; i < sigBytes.length; i++) {
+        sigBytes[i] = parseInt(hexSig.slice(i * 2, i * 2 + 2), 16);
+      }
+      const key = await globalThis.crypto.subtle.importKey(
+        "raw",
+        enc.encode(webhookSecret),
+        { name: "HMAC", hash: "SHA-256" },
+        false,
+        ["verify"]
+      );
+      return await globalThis.crypto.subtle.verify("HMAC", key, sigBytes, enc.encode(body));
+    } catch {
+      return false;
     }
-    return diff === 0;
   }
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "vessels-sdk",
-	"version": "0.3.0",
+	"version": "0.4.0",
 	"description": "Let your agent reach you. Official Vessels SDK.",
 	"type": "module",
 	"exports": {