@hasna/events 0.1.2 → 0.1.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +14 -2
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -111,11 +111,15 @@ sha256=<hex digest>
|
|
|
111
111
|
Consumers can verify with:
|
|
112
112
|
|
|
113
113
|
```ts
|
|
114
|
-
import {
|
|
114
|
+
import { verifyWebhookSignature } from "@hasna/events/signing";
|
|
115
115
|
|
|
116
|
-
const ok =
|
|
116
|
+
const ok = verifyWebhookSignature(secret, timestamp, body, signature);
|
|
117
117
|
```
|
|
118
118
|
|
|
119
|
+
`verifyWebhookSignature` rejects timestamps outside a five-minute window by default.
|
|
120
|
+
Pass an explicit `toleranceMs` when a consumer needs a tighter or wider replay
|
|
121
|
+
window.
|
|
122
|
+
|
|
119
123
|
## Command Transport
|
|
120
124
|
|
|
121
125
|
Command channels run a local process and pass the event on stdin and environment variables.
|
|
@@ -150,6 +154,14 @@ The transport type union already reserves `email`, `sse`, and `mcp-relay` for la
|
|
|
150
154
|
|
|
151
155
|
## Redaction
|
|
152
156
|
|
|
157
|
+
Events scrub obvious sensitive keys such as `secret`, `token`, `password`,
|
|
158
|
+
`apiKey`, and `authorization` before local storage and delivery by default.
|
|
159
|
+
Callers that intentionally need raw local payloads can pass:
|
|
160
|
+
|
|
161
|
+
```ts
|
|
162
|
+
await events.emit(input, { redactSensitiveData: false });
|
|
163
|
+
```
|
|
164
|
+
|
|
153
165
|
Use channel-level paths for config-only redaction:
|
|
154
166
|
|
|
155
167
|
```ts
|