CLI tool for generating and verifying test vectors

[JosephDoUrden]

Summary

Create a CLI tool that generates HMAC signatures and verifies payloads, useful for testing and debugging webhook integrations.

Context

From PRD.md Future Enhancements: "CLI for generating test vectors"

Scope

Commands

# Generate a signature
webhook-hmac sign --secret whsec_xxx --payload '{"event":"test"}' --timestamp 1700000000 --nonce abc123

# Verify a signature
webhook-hmac verify --secret whsec_xxx --payload '{"event":"test"}' --signature <hex> --timestamp 1700000000 --nonce abc123

# Generate test vector table (markdown)
webhook-hmac vectors --secret whsec_xxx --format markdown

Features

• Sign arbitrary payloads from stdin or --payload flag
• Verify signatures with detailed error output
• Generate test vector tables for documentation
• JSON and markdown output formats
• Read payload from file (--payload-file)

Implementation Notes

• Add a bin field to package.json
• Use a lightweight CLI parser (e.g. commander or built-in parseArgs)
• Keep as part of the main package (no separate install needed)

Acceptance Criteria

• npx webhook-hmac-kit sign generates valid signatures
• npx webhook-hmac-kit verify validates signatures
• npx webhook-hmac-kit vectors generates test vector tables
• --help shows usage information
• Works with piped stdin input