@hostwebhook/node 1.0.3 → 1.0.5

package/dist/index.d.mts

@@ -140,6 +140,18 @@ declare function createNestGuard(secret: string, options?: VerifyOptions): {
  */
 declare function fastifyHook(secret: string, options?: VerifyOptions): (req: ExpressRequest, reply: ExpressResponse, done: NextFn) => void;
 
+/** Static secret signature — sends the secret as-is in a header (no HMAC). */
+interface StaticSignature {
+    type: 'static';
+    /** The secret/token value to send. */
+    secret: string;
+    /**
+     * Header name to send the secret in.
+     * Default: `Authorization` with `Bearer <secret>` format.
+     * @example 'X-My-Custom-Key'
+     */
+    header?: string;
+}
 /** Configuration for the HostWebhook client. */
 interface HostWebhookConfig {
     /** Ingress token from your endpoint settings. */
@@ -147,12 +159,26 @@ interface HostWebhookConfig {
     /** Base URL of the HostWebhook API. Default: `https://api.hostwebhook.com` */
     baseUrl?: string;
     /**
-     * Signing secret for incoming signature verification.
-     * When provided, every request is signed with HMAC-SHA256 using the `custom`
-     * format (`X-Webhook-Signature: sha256=<hex>`), which HostWebhook verifies
-     * if the endpoint has `incomingSignatureType: 'custom'` configured.
+     * HMAC-SHA256 signing secret. When set, every request is signed with the
+     * HostWebhook signature format (`X-HostWebhook-Signature: t=<ts>,v1=<hmac>`).
+     * Pair with `incomingSignatureType: 'hostwebhook'` on the endpoint.
+     * @deprecated Prefer `signature` for new integrations.
      */
     signingSecret?: string;
+    /**
+     * Signature configuration for incoming webhook verification.
+     * Cannot be used together with `signingSecret`.
+     *
+     * @example Static with default header (Authorization: Bearer)
+     * ```ts
+     * { type: 'static', secret: 'my-secret' }
+     * ```
+     * @example Static with custom header
+     * ```ts
+     * { type: 'static', secret: 'my-secret', header: 'X-My-Custom-Key' }
+     * ```
+     */
+    signature?: StaticSignature;
     /** Custom headers to include in every request. */
     defaultHeaders?: Record<string, string>;
     /** Request timeout in milliseconds. Default: 10000 (10s). */
@@ -195,6 +221,7 @@ declare class HostWebhook {
     private readonly token;
     private readonly baseUrl;
     private readonly signingSecret?;
+    private readonly signature?;
     private readonly defaultHeaders;
     private readonly timeoutMs;
     constructor(config: HostWebhookConfig);
@@ -231,4 +258,4 @@ declare class HostWebhook {
  */
 declare function send(config: HostWebhookConfig, payload: Record<string, unknown>, options?: SendOptions): Promise<SendResult>;
 
-export { HostWebhook, type HostWebhookConfig, SendError, type SendOptions, type SendResult, VerificationError, type VerifyOptions, type WebhookHeaders, createNestGuard, expressMiddleware, fastifyHook, parseHeaders, send, verify };
+export { HostWebhook, type HostWebhookConfig, SendError, type SendOptions, type SendResult, type StaticSignature, VerificationError, type VerifyOptions, type WebhookHeaders, createNestGuard, expressMiddleware, fastifyHook, parseHeaders, send, verify };

package/dist/index.d.ts

@@ -140,6 +140,18 @@ declare function createNestGuard(secret: string, options?: VerifyOptions): {
  */
 declare function fastifyHook(secret: string, options?: VerifyOptions): (req: ExpressRequest, reply: ExpressResponse, done: NextFn) => void;
 
+/** Static secret signature — sends the secret as-is in a header (no HMAC). */
+interface StaticSignature {
+    type: 'static';
+    /** The secret/token value to send. */
+    secret: string;
+    /**
+     * Header name to send the secret in.
+     * Default: `Authorization` with `Bearer <secret>` format.
+     * @example 'X-My-Custom-Key'
+     */
+    header?: string;
+}
 /** Configuration for the HostWebhook client. */
 interface HostWebhookConfig {
     /** Ingress token from your endpoint settings. */
@@ -147,12 +159,26 @@ interface HostWebhookConfig {
     /** Base URL of the HostWebhook API. Default: `https://api.hostwebhook.com` */
     baseUrl?: string;
     /**
-     * Signing secret for incoming signature verification.
-     * When provided, every request is signed with HMAC-SHA256 using the `custom`
-     * format (`X-Webhook-Signature: sha256=<hex>`), which HostWebhook verifies
-     * if the endpoint has `incomingSignatureType: 'custom'` configured.
+     * HMAC-SHA256 signing secret. When set, every request is signed with the
+     * HostWebhook signature format (`X-HostWebhook-Signature: t=<ts>,v1=<hmac>`).
+     * Pair with `incomingSignatureType: 'hostwebhook'` on the endpoint.
+     * @deprecated Prefer `signature` for new integrations.
      */
     signingSecret?: string;
+    /**
+     * Signature configuration for incoming webhook verification.
+     * Cannot be used together with `signingSecret`.
+     *
+     * @example Static with default header (Authorization: Bearer)
+     * ```ts
+     * { type: 'static', secret: 'my-secret' }
+     * ```
+     * @example Static with custom header
+     * ```ts
+     * { type: 'static', secret: 'my-secret', header: 'X-My-Custom-Key' }
+     * ```
+     */
+    signature?: StaticSignature;
     /** Custom headers to include in every request. */
     defaultHeaders?: Record<string, string>;
     /** Request timeout in milliseconds. Default: 10000 (10s). */
@@ -195,6 +221,7 @@ declare class HostWebhook {
     private readonly token;
     private readonly baseUrl;
     private readonly signingSecret?;
+    private readonly signature?;
     private readonly defaultHeaders;
     private readonly timeoutMs;
     constructor(config: HostWebhookConfig);
@@ -231,4 +258,4 @@ declare class HostWebhook {
  */
 declare function send(config: HostWebhookConfig, payload: Record<string, unknown>, options?: SendOptions): Promise<SendResult>;
 
-export { HostWebhook, type HostWebhookConfig, SendError, type SendOptions, type SendResult, VerificationError, type VerifyOptions, type WebhookHeaders, createNestGuard, expressMiddleware, fastifyHook, parseHeaders, send, verify };
+export { HostWebhook, type HostWebhookConfig, SendError, type SendOptions, type SendResult, type StaticSignature, VerificationError, type VerifyOptions, type WebhookHeaders, createNestGuard, expressMiddleware, fastifyHook, parseHeaders, send, verify };

package/dist/index.js

@@ -204,9 +204,15 @@ var HostWebhook = class {
     if (!config.token) {
       throw new Error("HostWebhook: token is required");
     }
+    if (config.signingSecret && config.signature) {
+      throw new Error(
+        "HostWebhook: use either signingSecret or signature, not both"
+      );
+    }
     this.token = config.token;
     this.baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
     this.signingSecret = config.signingSecret;
+    this.signature = config.signature;
     this.defaultHeaders = config.defaultHeaders ?? {};
     this.timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT;
   }
@@ -230,9 +236,17 @@ var HostWebhook = class {
       ...this.defaultHeaders,
       ...options?.headers
     };
-    if (this.signingSecret) {
-      const sig = (0, import_crypto2.createHmac)("sha256", this.signingSecret).update(body).digest("hex");
-      headers["X-Webhook-Signature"] = `sha256=${sig}`;
+    if (this.signature?.type === "static") {
+      const { secret, header } = this.signature;
+      if (header) {
+        headers[header] = secret;
+      } else {
+        headers["Authorization"] = `Bearer ${secret}`;
+      }
+    } else if (this.signingSecret) {
+      const timestamp = Math.floor(Date.now() / 1e3);
+      const sig = (0, import_crypto2.createHmac)("sha256", this.signingSecret).update(`${timestamp}.${body}`).digest("hex");
+      headers["X-HostWebhook-Signature"] = `t=${timestamp},v1=${sig}`;
     }
     const url = `${this.baseUrl}/api/in/${this.token}`;
     const controller = new AbortController();

package/dist/index.mjs

@@ -170,9 +170,15 @@ var HostWebhook = class {
     if (!config.token) {
       throw new Error("HostWebhook: token is required");
     }
+    if (config.signingSecret && config.signature) {
+      throw new Error(
+        "HostWebhook: use either signingSecret or signature, not both"
+      );
+    }
     this.token = config.token;
     this.baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
     this.signingSecret = config.signingSecret;
+    this.signature = config.signature;
     this.defaultHeaders = config.defaultHeaders ?? {};
     this.timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT;
   }
@@ -196,9 +202,17 @@ var HostWebhook = class {
       ...this.defaultHeaders,
       ...options?.headers
     };
-    if (this.signingSecret) {
-      const sig = createHmac2("sha256", this.signingSecret).update(body).digest("hex");
-      headers["X-Webhook-Signature"] = `sha256=${sig}`;
+    if (this.signature?.type === "static") {
+      const { secret, header } = this.signature;
+      if (header) {
+        headers[header] = secret;
+      } else {
+        headers["Authorization"] = `Bearer ${secret}`;
+      }
+    } else if (this.signingSecret) {
+      const timestamp = Math.floor(Date.now() / 1e3);
+      const sig = createHmac2("sha256", this.signingSecret).update(`${timestamp}.${body}`).digest("hex");
+      headers["X-HostWebhook-Signature"] = `t=${timestamp},v1=${sig}`;
     }
     const url = `${this.baseUrl}/api/in/${this.token}`;
     const controller = new AbortController();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hostwebhook/node",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "Official HostWebhook SDK — verify signatures, parse headers, and send webhooks",
   "main": "dist/index.js",
   "module": "dist/index.mjs",