Havala publishes no client packages, so these are recipes rather than SDKs: a complete signed-request client in each language — create an invoice, verify a webhook — meant to be pasted into your codebase and owned by you.
Timestamp, method, path, body hash — and the idempotency line that only POST, PUT, PATCH and DELETE carry. Getting that line wrong is the most common reason a first request comes back SIGNATURE_INVALID.
There is no package to pin, audit or wait on for a release. The recipe is a few dozen lines you can read end to end and change when your stack does.
Most of these add nothing to your lockfile: node:crypto, hmac and hashlib, hash_hmac, crypto/hmac, javax.crypto.Mac. Only Python's recipe pulls a dependency, and only for the HTTP call.
Each recipe also verifies X-Webhook-Signature against the raw request body, before any parsing that would reorder it. That half of the integration is what actually protects you.