@hostwebhook/node 1.0.2 → 1.0.4

package/README.md

@@ -1,6 +1,8 @@
 # @hostwebhook/node
 
-Official Node.js SDK for [HostWebhook](https://hostwebhook.com) — verify webhook signatures and send webhooks through the platform.
+> **Early Access** — This SDK is in early access. The API may change between versions. We'd love your feedback — [report an issue](https://www.hostwebhook.com/#issues) if you run into anything.
+
+Official Node.js SDK for [HostWebhook](https://www.hostwebhook.com) — verify webhook signatures and send webhooks through the platform.
 
 ## Install
 
@@ -162,6 +164,18 @@ X-HostWebhook-Signature: t=<timestamp_ms>,v1=<hmac_hex>
 
 HMAC computed as: `HMAC-SHA256(secret, "${timestamp}.${rawBody}")`
 
+## Support
+
+Found a bug or have a feature request? [Report an issue](https://www.hostwebhook.com/#issues) on our website.
+
+## Privacy
+
+Your webhook data is yours. HostWebhook is built with privacy as a core principle:
+
+- **Your payloads stay between you and your endpoints** — we never sell, share, or use your data for training.
+- **Encryption in transit** — all traffic between the SDK, the platform, and your endpoints is sent over TLS.
+- **Minimal data retention** — event payloads are stored only for delivery and debugging, and are automatically purged based on your plan's retention window.
+
 ## License
 
 MIT

package/dist/index.js

@@ -231,8 +231,9 @@ var HostWebhook = class {
       ...options?.headers
     };
     if (this.signingSecret) {
-      const sig = (0, import_crypto2.createHmac)("sha256", this.signingSecret).update(body).digest("hex");
-      headers["X-Webhook-Signature"] = `sha256=${sig}`;
+      const timestamp = Math.floor(Date.now() / 1e3);
+      const sig = (0, import_crypto2.createHmac)("sha256", this.signingSecret).update(`${timestamp}.${body}`).digest("hex");
+      headers["X-HostWebhook-Signature"] = `t=${timestamp},v1=${sig}`;
     }
     const url = `${this.baseUrl}/api/in/${this.token}`;
     const controller = new AbortController();

package/dist/index.mjs

@@ -197,8 +197,9 @@ var HostWebhook = class {
       ...options?.headers
     };
     if (this.signingSecret) {
-      const sig = createHmac2("sha256", this.signingSecret).update(body).digest("hex");
-      headers["X-Webhook-Signature"] = `sha256=${sig}`;
+      const timestamp = Math.floor(Date.now() / 1e3);
+      const sig = createHmac2("sha256", this.signingSecret).update(`${timestamp}.${body}`).digest("hex");
+      headers["X-HostWebhook-Signature"] = `t=${timestamp},v1=${sig}`;
     }
     const url = `${this.baseUrl}/api/in/${this.token}`;
     const controller = new AbortController();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hostwebhook/node",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Official HostWebhook SDK — verify signatures, parse headers, and send webhooks",
   "main": "dist/index.js",
   "module": "dist/index.mjs",