@gathertown/webhook-object-sdk

Typed client for emitting events to Gather webhook objects (Smart Objects). Handles the fiddly parts of the wire protocol (Standard Webhooks v1 signing, retries, rate limits, and error decoding) behind a fully type-safe send.

Event types and payload shapes come from @gathertown/webhook-object-types, generated from the same definitions the Gather server enforces. When new capabilities ship, this SDK picks them up via a types-package bump, no SDK release needed.

Usage

Each Smart Object is one (url, secret) pair, copied from the object's ⋮ menu in Gather. Secrets are per-object: a key for one object never authenticates another.

import { createWebhookObjectClient, secretFromEnv } from "@gathertown/webhook-object-sdk"

const counter = createWebhookObjectClient({
  url: process.env.GATHER_COUNTER_URL!,
  secret: secretFromEnv("GATHER_COUNTER_SECRET"), // whsec_…, read from the environment
})

await counter.send("counter.increment", { by: 2 }) // data type inferred from the event type
await counter.send("counter.reset") // empty-payload events take no data argument
await counter.ping() // verify url + secret; returns the object's declared capabilities

secret accepts the raw whsec_… string, so it plugs straight into whatever secret management you already have. The opaque handles are the recommended hardening on top: secretFromEnv(name) reads the variable itself, and a handle redacts itself if it ever reaches a log or JSON.stringify, a bare string can't. For values from elsewhere (a secret manager, a non-Node runtime), unsafeSecretLiteral(value) wraps them; the name makes hardcoded secrets easy to catch in review.

Every event is also available as capability-namespaced sugar with the same typing; snake_case wire names become camelCase methods:

await counter.counter.increment({ by: 2 })
await counter.counter.reset()
await lamp.switch.setState({ on: true }) // → switch.set_state

The fluent surface is derived from the generated event union and backed by a Proxy, so new capabilities appear via a types-package bump with zero SDK changes.

Object catalog

To keep several objects at hand (inboxes, lamps, counters, …), build a named catalog. An entry's optional preset narrows its send at compile time to the events that preset declares, so wiring the lamp's events to the inbox is a type error, not a runtime 404.

import { createWebhookObjectCatalog } from "@gathertown/webhook-object-sdk"

const office = createWebhookObjectCatalog({
  supportInbox: { url: INBOX_URL, secret: secretFromEnv("GATHER_INBOX_SECRET"), preset: "inbox" },
  buildLamp: { url: LAMP_URL, secret: secretFromEnv("GATHER_LAMP_SECRET"), preset: "switch" },
})

await office.supportInbox.send("activity.add", { id: "pr-142", text: "PR #142 merged" })
await office.buildLamp.send("switch.toggle")

Wire behavior

• Signs with the standardwebhooks reference library: HMAC-SHA256 over ${webhook-id}.${webhook-timestamp}.${body}, sent as the webhook-id / webhook-timestamp / webhook-signature headers. The exact serialized body is signed and sent unchanged.
• One webhook-id (UUID) per event, reused across retries; the server dedups the last 10 ids per object, so retries are idempotent. Each retry is re-signed with a fresh timestamp.
• Retries transient failures only (429, 5xx, network errors), honoring RateLimit-Reset / Retry-After, with exponential backoff + jitter otherwise. 4xx failures never retry.
• Cancelable via a signal (AbortSignal) in config: aborting cancels the in-flight request and any pending backoff, rejecting with an aborted error.
• Rejects payloads over the server's 4 KB body cap client-side, with a clear error instead of the receiver's uniform 404.
• Refuses non-https URLs at construction (signing authenticates but does not encrypt), with an http carve-out for localhost so local development keeps working.
• Never exposes the secret: error messages never contain it, and the opaque-handle form additionally redacts itself when logged or serialized.
• Failures throw WebhookObjectError with a code mirroring the server's error bodies (not_found, capability_not_declared, token_revoked, …) plus client-side codes (payload_too_large, invalid_secret, invalid_url, network_error, aborted, unexpected_response).

Uses global fetch and crypto.randomUUID by default (Node 19+, modern browsers, Deno, workers). Both are overridable via config. Inject fetch and/or newWebhookId for other runtimes, proxies, or deterministic tests.