@hostwebhook/node 1.0.4 → 1.0.6

package/dist/index.d.mts

@@ -140,6 +140,18 @@ declare function createNestGuard(secret: string, options?: VerifyOptions): {
  */
 declare function fastifyHook(secret: string, options?: VerifyOptions): (req: ExpressRequest, reply: ExpressResponse, done: NextFn) => void;
 
+/** Static secret signature — sends the secret as-is in a header (no HMAC). */
+interface StaticSignature {
+    type: 'static';
+    /** The secret/token value to send. */
+    secret: string;
+    /**
+     * Header name to send the secret in.
+     * Default: `Authorization` with `Bearer <secret>` format.
+     * @example 'X-My-Custom-Key'
+     */
+    header?: string;
+}
 /** Configuration for the HostWebhook client. */
 interface HostWebhookConfig {
     /** Ingress token from your endpoint settings. */
@@ -147,12 +159,26 @@ interface HostWebhookConfig {
     /** Base URL of the HostWebhook API. Default: `https://api.hostwebhook.com` */
     baseUrl?: string;
     /**
-     * Signing secret for incoming signature verification.
-     * When provided, every request is signed with HMAC-SHA256 using the `custom`
-     * format (`X-Webhook-Signature: sha256=<hex>`), which HostWebhook verifies
-     * if the endpoint has `incomingSignatureType: 'custom'` configured.
+     * HMAC-SHA256 signing secret. When set, every request is signed with the
+     * HostWebhook signature format (`X-HostWebhook-Signature: t=<ts>,v1=<hmac>`).
+     * Pair with `incomingSignatureType: 'hostwebhook'` on the endpoint.
+     * @deprecated Prefer `signature` for new integrations.
      */
     signingSecret?: string;
+    /**
+     * Signature configuration for incoming webhook verification.
+     * Cannot be used together with `signingSecret`.
+     *
+     * @example Static with default header (Authorization: Bearer)
+     * ```ts
+     * { type: 'static', secret: 'my-secret' }
+     * ```
+     * @example Static with custom header
+     * ```ts
+     * { type: 'static', secret: 'my-secret', header: 'X-My-Custom-Key' }
+     * ```
+     */
+    signature?: StaticSignature;
     /** Custom headers to include in every request. */
     defaultHeaders?: Record<string, string>;
     /** Request timeout in milliseconds. Default: 10000 (10s). */
@@ -192,11 +218,7 @@ declare class SendError extends Error {
  * ```
  */
 declare class HostWebhook {
-    private readonly token;
-    private readonly baseUrl;
-    private readonly signingSecret?;
-    private readonly defaultHeaders;
-    private readonly timeoutMs;
+    #private;
     constructor(config: HostWebhookConfig);
     /**
      * Send a webhook payload through HostWebhook.
@@ -231,4 +253,4 @@ declare class HostWebhook {
  */
 declare function send(config: HostWebhookConfig, payload: Record<string, unknown>, options?: SendOptions): Promise<SendResult>;
 
-export { HostWebhook, type HostWebhookConfig, SendError, type SendOptions, type SendResult, VerificationError, type VerifyOptions, type WebhookHeaders, createNestGuard, expressMiddleware, fastifyHook, parseHeaders, send, verify };
+export { HostWebhook, type HostWebhookConfig, SendError, type SendOptions, type SendResult, type StaticSignature, VerificationError, type VerifyOptions, type WebhookHeaders, createNestGuard, expressMiddleware, fastifyHook, parseHeaders, send, verify };

package/dist/index.d.ts

@@ -140,6 +140,18 @@ declare function createNestGuard(secret: string, options?: VerifyOptions): {
  */
 declare function fastifyHook(secret: string, options?: VerifyOptions): (req: ExpressRequest, reply: ExpressResponse, done: NextFn) => void;
 
+/** Static secret signature — sends the secret as-is in a header (no HMAC). */
+interface StaticSignature {
+    type: 'static';
+    /** The secret/token value to send. */
+    secret: string;
+    /**
+     * Header name to send the secret in.
+     * Default: `Authorization` with `Bearer <secret>` format.
+     * @example 'X-My-Custom-Key'
+     */
+    header?: string;
+}
 /** Configuration for the HostWebhook client. */
 interface HostWebhookConfig {
     /** Ingress token from your endpoint settings. */
@@ -147,12 +159,26 @@ interface HostWebhookConfig {
     /** Base URL of the HostWebhook API. Default: `https://api.hostwebhook.com` */
     baseUrl?: string;
     /**
-     * Signing secret for incoming signature verification.
-     * When provided, every request is signed with HMAC-SHA256 using the `custom`
-     * format (`X-Webhook-Signature: sha256=<hex>`), which HostWebhook verifies
-     * if the endpoint has `incomingSignatureType: 'custom'` configured.
+     * HMAC-SHA256 signing secret. When set, every request is signed with the
+     * HostWebhook signature format (`X-HostWebhook-Signature: t=<ts>,v1=<hmac>`).
+     * Pair with `incomingSignatureType: 'hostwebhook'` on the endpoint.
+     * @deprecated Prefer `signature` for new integrations.
      */
     signingSecret?: string;
+    /**
+     * Signature configuration for incoming webhook verification.
+     * Cannot be used together with `signingSecret`.
+     *
+     * @example Static with default header (Authorization: Bearer)
+     * ```ts
+     * { type: 'static', secret: 'my-secret' }
+     * ```
+     * @example Static with custom header
+     * ```ts
+     * { type: 'static', secret: 'my-secret', header: 'X-My-Custom-Key' }
+     * ```
+     */
+    signature?: StaticSignature;
     /** Custom headers to include in every request. */
     defaultHeaders?: Record<string, string>;
     /** Request timeout in milliseconds. Default: 10000 (10s). */
@@ -192,11 +218,7 @@ declare class SendError extends Error {
  * ```
  */
 declare class HostWebhook {
-    private readonly token;
-    private readonly baseUrl;
-    private readonly signingSecret?;
-    private readonly defaultHeaders;
-    private readonly timeoutMs;
+    #private;
     constructor(config: HostWebhookConfig);
     /**
      * Send a webhook payload through HostWebhook.
@@ -231,4 +253,4 @@ declare class HostWebhook {
  */
 declare function send(config: HostWebhookConfig, payload: Record<string, unknown>, options?: SendOptions): Promise<SendResult>;
 
-export { HostWebhook, type HostWebhookConfig, SendError, type SendOptions, type SendResult, VerificationError, type VerifyOptions, type WebhookHeaders, createNestGuard, expressMiddleware, fastifyHook, parseHeaders, send, verify };
+export { HostWebhook, type HostWebhookConfig, SendError, type SendOptions, type SendResult, type StaticSignature, VerificationError, type VerifyOptions, type WebhookHeaders, createNestGuard, expressMiddleware, fastifyHook, parseHeaders, send, verify };

package/dist/index.js

@@ -3,6 +3,9 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -16,6 +19,10 @@ var __copyProps = (to, from, except, desc) => {
   return to;
 };
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
 
 // src/index.ts
 var index_exports = {};
@@ -199,16 +206,29 @@ var SendError = class extends Error {
 // src/client.ts
 var DEFAULT_BASE_URL = "https://api.hostwebhook.com";
 var DEFAULT_TIMEOUT = 1e4;
+var _token, _baseUrl, _signingSecret, _signature, _defaultHeaders, _timeoutMs;
 var HostWebhook = class {
   constructor(config) {
+    __privateAdd(this, _token);
+    __privateAdd(this, _baseUrl);
+    __privateAdd(this, _signingSecret);
+    __privateAdd(this, _signature);
+    __privateAdd(this, _defaultHeaders);
+    __privateAdd(this, _timeoutMs);
     if (!config.token) {
       throw new Error("HostWebhook: token is required");
     }
-    this.token = config.token;
-    this.baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
-    this.signingSecret = config.signingSecret;
-    this.defaultHeaders = config.defaultHeaders ?? {};
-    this.timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT;
+    if (config.signingSecret && config.signature) {
+      throw new Error(
+        "HostWebhook: use either signingSecret or signature, not both"
+      );
+    }
+    __privateSet(this, _token, config.token);
+    __privateSet(this, _baseUrl, (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, ""));
+    __privateSet(this, _signingSecret, config.signingSecret);
+    __privateSet(this, _signature, config.signature);
+    __privateSet(this, _defaultHeaders, config.defaultHeaders ?? {});
+    __privateSet(this, _timeoutMs, config.timeoutMs ?? DEFAULT_TIMEOUT);
   }
   /**
    * Send a webhook payload through HostWebhook.
@@ -224,20 +244,34 @@ var HostWebhook = class {
    */
   async send(payload, options) {
     const body = options?.rawBody !== void 0 ? typeof options.rawBody === "string" ? options.rawBody : options.rawBody.toString("utf8") : JSON.stringify(payload);
+    let tz = "";
+    try {
+      tz = Intl.DateTimeFormat().resolvedOptions().timeZone;
+    } catch {
+    }
     const headers = {
       "Content-Type": options?.contentType ?? "application/json",
-      "User-Agent": "HostWebhook-SDK/1.0",
-      ...this.defaultHeaders,
+      "User-Agent": `HostWebhook-SDK/${"1.0.5"}`,
+      "X-HostWebhook-Sent-At": (/* @__PURE__ */ new Date()).toISOString(),
+      ...tz ? { "X-HostWebhook-Timezone": tz } : {},
+      ...__privateGet(this, _defaultHeaders),
       ...options?.headers
     };
-    if (this.signingSecret) {
+    if (__privateGet(this, _signature)?.type === "static") {
+      const { secret, header } = __privateGet(this, _signature);
+      if (header) {
+        headers[header] = secret;
+      } else {
+        headers["Authorization"] = `Bearer ${secret}`;
+      }
+    } else if (__privateGet(this, _signingSecret)) {
       const timestamp = Math.floor(Date.now() / 1e3);
-      const sig = (0, import_crypto2.createHmac)("sha256", this.signingSecret).update(`${timestamp}.${body}`).digest("hex");
+      const sig = (0, import_crypto2.createHmac)("sha256", __privateGet(this, _signingSecret)).update(`${timestamp}.${body}`).digest("hex");
       headers["X-HostWebhook-Signature"] = `t=${timestamp},v1=${sig}`;
     }
-    const url = `${this.baseUrl}/api/in/${this.token}`;
+    const url = `${__privateGet(this, _baseUrl)}/api/in/${__privateGet(this, _token)}`;
     const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    const timer = setTimeout(() => controller.abort(), __privateGet(this, _timeoutMs));
     try {
       const res = await fetch(url, {
         method: "POST",
@@ -262,7 +296,7 @@ var HostWebhook = class {
       if (err instanceof SendError) throw err;
       if (err instanceof DOMException && err.name === "AbortError") {
         throw new SendError(
-          `HostWebhook request timed out after ${this.timeoutMs}ms`,
+          `HostWebhook request timed out after ${__privateGet(this, _timeoutMs)}ms`,
           0,
           ""
         );
@@ -283,6 +317,12 @@ var HostWebhook = class {
     return Promise.all(payloads.map((p) => this.send(p, options)));
   }
 };
+_token = new WeakMap();
+_baseUrl = new WeakMap();
+_signingSecret = new WeakMap();
+_signature = new WeakMap();
+_defaultHeaders = new WeakMap();
+_timeoutMs = new WeakMap();
 async function send(config, payload, options) {
   const client = new HostWebhook(config);
   return client.send(payload, options);

package/dist/index.mjs

@@ -1,3 +1,11 @@
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
+
 // src/verify.ts
 import { createHmac, timingSafeEqual } from "crypto";
 var VerificationError = class extends Error {
@@ -165,16 +173,29 @@ var SendError = class extends Error {
 // src/client.ts
 var DEFAULT_BASE_URL = "https://api.hostwebhook.com";
 var DEFAULT_TIMEOUT = 1e4;
+var _token, _baseUrl, _signingSecret, _signature, _defaultHeaders, _timeoutMs;
 var HostWebhook = class {
   constructor(config) {
+    __privateAdd(this, _token);
+    __privateAdd(this, _baseUrl);
+    __privateAdd(this, _signingSecret);
+    __privateAdd(this, _signature);
+    __privateAdd(this, _defaultHeaders);
+    __privateAdd(this, _timeoutMs);
     if (!config.token) {
       throw new Error("HostWebhook: token is required");
     }
-    this.token = config.token;
-    this.baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
-    this.signingSecret = config.signingSecret;
-    this.defaultHeaders = config.defaultHeaders ?? {};
-    this.timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT;
+    if (config.signingSecret && config.signature) {
+      throw new Error(
+        "HostWebhook: use either signingSecret or signature, not both"
+      );
+    }
+    __privateSet(this, _token, config.token);
+    __privateSet(this, _baseUrl, (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, ""));
+    __privateSet(this, _signingSecret, config.signingSecret);
+    __privateSet(this, _signature, config.signature);
+    __privateSet(this, _defaultHeaders, config.defaultHeaders ?? {});
+    __privateSet(this, _timeoutMs, config.timeoutMs ?? DEFAULT_TIMEOUT);
   }
   /**
    * Send a webhook payload through HostWebhook.
@@ -190,20 +211,34 @@ var HostWebhook = class {
    */
   async send(payload, options) {
     const body = options?.rawBody !== void 0 ? typeof options.rawBody === "string" ? options.rawBody : options.rawBody.toString("utf8") : JSON.stringify(payload);
+    let tz = "";
+    try {
+      tz = Intl.DateTimeFormat().resolvedOptions().timeZone;
+    } catch {
+    }
     const headers = {
       "Content-Type": options?.contentType ?? "application/json",
-      "User-Agent": "HostWebhook-SDK/1.0",
-      ...this.defaultHeaders,
+      "User-Agent": `HostWebhook-SDK/${"1.0.5"}`,
+      "X-HostWebhook-Sent-At": (/* @__PURE__ */ new Date()).toISOString(),
+      ...tz ? { "X-HostWebhook-Timezone": tz } : {},
+      ...__privateGet(this, _defaultHeaders),
       ...options?.headers
     };
-    if (this.signingSecret) {
+    if (__privateGet(this, _signature)?.type === "static") {
+      const { secret, header } = __privateGet(this, _signature);
+      if (header) {
+        headers[header] = secret;
+      } else {
+        headers["Authorization"] = `Bearer ${secret}`;
+      }
+    } else if (__privateGet(this, _signingSecret)) {
       const timestamp = Math.floor(Date.now() / 1e3);
-      const sig = createHmac2("sha256", this.signingSecret).update(`${timestamp}.${body}`).digest("hex");
+      const sig = createHmac2("sha256", __privateGet(this, _signingSecret)).update(`${timestamp}.${body}`).digest("hex");
       headers["X-HostWebhook-Signature"] = `t=${timestamp},v1=${sig}`;
     }
-    const url = `${this.baseUrl}/api/in/${this.token}`;
+    const url = `${__privateGet(this, _baseUrl)}/api/in/${__privateGet(this, _token)}`;
     const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    const timer = setTimeout(() => controller.abort(), __privateGet(this, _timeoutMs));
     try {
       const res = await fetch(url, {
         method: "POST",
@@ -228,7 +263,7 @@ var HostWebhook = class {
       if (err instanceof SendError) throw err;
       if (err instanceof DOMException && err.name === "AbortError") {
         throw new SendError(
-          `HostWebhook request timed out after ${this.timeoutMs}ms`,
+          `HostWebhook request timed out after ${__privateGet(this, _timeoutMs)}ms`,
           0,
           ""
         );
@@ -249,6 +284,12 @@ var HostWebhook = class {
     return Promise.all(payloads.map((p) => this.send(p, options)));
   }
 };
+_token = new WeakMap();
+_baseUrl = new WeakMap();
+_signingSecret = new WeakMap();
+_signature = new WeakMap();
+_defaultHeaders = new WeakMap();
+_timeoutMs = new WeakMap();
 async function send(config, payload, options) {
   const client = new HostWebhook(config);
   return client.send(payload, options);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hostwebhook/node",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "description": "Official HostWebhook SDK — verify signatures, parse headers, and send webhooks",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -18,7 +18,7 @@
     "llms.txt"
   ],
   "scripts": {
-    "build": "tsup src/index.ts --format cjs,esm --dts --clean",
+    "build": "tsup",
     "test": "node --test __tests__/sdk.test.mjs",
     "prepublishOnly": "npm run build"
   },