Your supply network.
One Reach-X contract.

import { createHash, createHmac, randomUUID } from "node:crypto";

const {
  REACHX_API_BASE,
  REACHX_KEY_ID,
  REACHX_SECRET,
  REACHX_SUPPLIER_ID,
  REACHX_SUPPLIER_LINK_ID,
} = process.env;
if (!REACHX_API_BASE || !REACHX_KEY_ID || !REACHX_SECRET ||
    !REACHX_SUPPLIER_ID || !REACHX_SUPPLIER_LINK_ID) {
  throw new Error("Missing issued Reach-X environment credentials");
}

const payload = {
  resource_type: "product",
  source_system: "your_connector",
  external_id: "PRODUCT-1001",
  supplier_id: REACHX_SUPPLIER_ID,
  partner_supplier_link_id: REACHX_SUPPLIER_LINK_ID,
  source_sequence: 1,
  facts: { name: "Example product", category_reference: "your-category" },
};
const method = "PUT";
const path = "/partner/v1/catalogue/items";
const query = "";
const body = JSON.stringify(payload); // preserve these exact UTF-8 bytes
const bodyHash = createHash("sha256").update(body).digest("hex");
const idempotencyKey = randomUUID(); // retain for an unchanged retry
const timestamp = new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
const nonce = randomUUID().toLowerCase();

const canonical = [
  "reachx-partner-v1",
  method,
  path,
  query,
  bodyHash,
  idempotencyKey,
  REACHX_KEY_ID.toLowerCase(),
  timestamp,
  nonce,
].join("\n");

const signature = createHmac("sha256", REACHX_SECRET)
  .update(canonical)
  .digest("base64url");

const response = await fetch(`${REACHX_API_BASE}${path}`, {
  method,
  headers: {
    "Content-Type": "application/json",
    "Idempotency-Key": idempotencyKey,
    "X-ReachX-Key-Id": REACHX_KEY_ID,
    "X-ReachX-Timestamp": timestamp,
    "X-ReachX-Nonce": nonce,
    "X-ReachX-Content-SHA256": bodyHash,
    "X-ReachX-Signature": signature,
  },
  body,
});

import { createHash, createHmac, timingSafeEqual } from "node:crypto";

function requireHeader(headers, name) {
  const value = headers[name];
  if (typeof value !== "string" || value.includes(",,") || value.length > 512) {
    throw new Error(`Missing or malformed ${name}`);
  }
  return value;
}

const deliveryId = requireHeader(headers, "reachx-webhook-id");
const timestamp = requireHeader(headers, "reachx-webhook-timestamp");
const signatures = requireHeader(headers, "reachx-webhook-signature");
if (!/^\d{10}$/.test(timestamp) ||
    Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
  throw new Error("Reject stale webhook");
}
const bodyHash = createHash("sha256").update(rawBody).digest("hex");
const signed = `v1.${deliveryId}.${timestamp}.${bodyHash}`;
// Keep only the current secret and an unexpired rotation predecessor.
const expected = webhookSecrets.map((secret) =>
  createHmac("sha256", secret).update(signed).digest("hex")
);

const valid = signatures
  .split(",")
  .map((value) => value.trim())
  .filter((value) => value.startsWith("v1="))
  .some((value) => {
    const received = Buffer.from(value.slice(3), "hex");
    return expected.some((digest) => {
      const wanted = Buffer.from(digest, "hex");
      return received.length === wanted.length && timingSafeEqual(received, wanted);
    });
  });
if (!valid) throw new Error("Reject invalid webhook");

// Persist deliveryId before applying side effects; return 2xx for duplicates.