@ravileal/event-hub 1.1.1

package/README.md

@@ -0,0 +1,78 @@
+# @ravileal/event-hub
+
+TypeScript client for [event-hub](https://github.com/ravileal/event-hub) — the webhook
+fan-out hub (topics → subscribers → events → retries/deliveries).
+
+- **Zero runtime dependencies** — native `fetch` (Node >= 18) and `node:crypto` only.
+- **ESM + CJS + type declarations**.
+- **Timing-safe HMAC delivery-signature verification**.
+
+The package version matches the hub/image version (`ghcr.io/ravileal/event-hub`).
+Because versions move together, the client sends the English `X-Idempotency`
+header that hubs since 1.1.0 read; a hub older than 1.1.0 ignores it.
+
+## Install
+
+```bash
+npm install @ravileal/event-hub
+```
+
+## Publish an event
+
+```ts
+import { EventHubClient } from '@ravileal/event-hub';
+
+const hub = new EventHubClient({ baseUrl: 'http://127.0.0.1:18295' });
+
+await hub.createTopic('orders');
+await hub.createSubscriber('orders', {
+  name: 'billing',
+  url: 'http://billing.internal/hooks/orders',
+  secret: process.env.HUB_SECRET, // signs deliveries hub -> you
+  kind: 'webhook',
+});
+
+// 202 for a fresh event, 200 when the idempotency key was already used.
+const { status, data } = await hub.publishEvent('orders', { id: 1 }, { idempotencyKey: 'order-1' });
+console.log(status, data.duplicado);
+```
+
+Use `signPayload(secret, rawBody)` if you need to sign the exact bytes you send
+(the hub's `X-Signature` on publish, or a delivery you replay).
+
+## Verify an incoming delivery
+
+Pass the **raw** body exactly as received; re-serializing parsed JSON changes the
+bytes and fails verification.
+
+```ts
+import { verifyDeliverySignature, HEADERS } from '@ravileal/event-hub';
+
+// Express-style; the raw bytes matter, so use express.raw({ type: '*/*' }).
+app.post('/hooks/orders', express.raw({ type: '*/*' }), (req, res) => {
+  const ok = verifyDeliverySignature(
+    process.env.HUB_SECRET!,
+    req.body,                            // Buffer = raw bytes
+    req.get(HEADERS.deliverySignature),  // X-Event-Hub-Signature
+  );
+  if (!ok) return res.sendStatus(401);
+  res.sendStatus(200);
+});
+```
+
+`verifyDeliverySignature` returns `false` (never throws) for a missing header, a
+wrong `sha256=` prefix, malformed hex or a length mismatch, and compares in
+constant time.
+
+## Notes
+
+- The hub reads the idempotency header **`X-Idempotency`** (English) since 1.1.0 and
+  falls back to the legacy **`X-Idempotencia`**. `HEADERS.idempotency` and
+  `{ idempotencyKey }` send the English name; `HEADERS.legacyIdempotency` exposes the
+  alias the hub still accepts for old producers.
+- Deliveries carry `X-Event-Hub-Event`, `X-Event-Hub-Attempt` and
+  `X-Event-Hub-Signature` (`sha256=<hex>` = HMAC-SHA256(raw body, subscriber secret)).
+
+## License
+
+MIT

package/dist/cjs/client.d.ts

@@ -0,0 +1,64 @@
+import type { Delivery, DeliveryFilter, Health, IngestOptions, IngestResult, Metrics, PublishOptions, PublishResult, Subscriber, SubscriberSpec, Topic, TopicWithSubscribers } from './types.js';
+/** Thrown for any non-2xx response from the hub. */
+export declare class EventHubError extends Error {
+    readonly status: number;
+    readonly body: unknown;
+    constructor(status: number, body: unknown, message?: string);
+}
+/** Options for {@link EventHubClient}. `fetch` can be injected for testing. */
+export interface EventHubClientOptions {
+    /** Base URL of the hub, e.g. `http://localhost:18295`. Trailing slashes trimmed. */
+    baseUrl?: string;
+    /** Custom fetch implementation; defaults to the global `fetch` (Node >= 18). */
+    fetch?: typeof fetch;
+    /** Headers merged into every request. */
+    defaultHeaders?: Record<string, string>;
+}
+/** Request body accepted by `publishEvent`: a JSON-able value or a raw string. */
+export type EventPayload = unknown;
+/**
+ * Typed, dependency-free client for the event-hub HTTP API.
+ *
+ * ```ts
+ * const hub = new EventHubClient({ baseUrl: 'http://localhost:18295' });
+ * const { status, data } = await hub.publishEvent('orders', { id: 1 }, { idempotencyKey: 'k1' });
+ * ```
+ */
+export declare class EventHubClient {
+    readonly baseUrl: string;
+    private readonly fetchImpl;
+    private readonly defaultHeaders;
+    constructor(options?: EventHubClientOptions);
+    private request;
+    /** `GET /health` */
+    health(): Promise<Health>;
+    /** `GET /metrics` */
+    metrics(): Promise<Metrics>;
+    /** `POST /topics` -> 201 Topic. */
+    createTopic(name: string, description?: string | null): Promise<Topic>;
+    /** `GET /topics` -> Topic[] with subscribers nested. */
+    listTopics(): Promise<TopicWithSubscribers[]>;
+    /** `POST /topics/{topic}/subscribers` -> 201 Subscriber. */
+    createSubscriber(topic: string, spec: SubscriberSpec): Promise<Subscriber>;
+    /**
+     * `POST /events/{topic}` -> 202 (fresh) or 200 (duplicate).
+     *
+     * A string payload is sent verbatim (so a pre-computed signature keeps
+     * matching); anything else is `JSON.stringify`-ed. When `signature` is
+     * provided it must sign the exact bytes that end up on the wire.
+     */
+    publishEvent(topic: string, payload: EventPayload, options?: PublishOptions): Promise<PublishResult>;
+    /**
+     * `POST /ingest?origem=<name>` -> 202.
+     *
+     * Requires the hub to be running with `--routes`/`--config`; otherwise the
+     * hub answers 404 `{"error":"routing disabled..."}`.
+     */
+    ingest(rawPayload: string, options?: IngestOptions): Promise<IngestResult>;
+    /** `GET /deliveries?status=&topic=&limite=` -> Delivery[]. */
+    listDeliveries(filter?: DeliveryFilter): Promise<Delivery[]>;
+    /** `POST /deliveries/{id}/retry` -> reschedules one delivery. */
+    retryDelivery(id: number): Promise<unknown>;
+    /** `POST /deliveries/retry-falhas` -> bulk retry of failed deliveries. */
+    retryFailedDeliveries(): Promise<unknown>;
+}

package/dist/cjs/client.js

@@ -0,0 +1,143 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EventHubClient = exports.EventHubError = void 0;
+const headers_js_1 = require("./headers.js");
+/** Thrown for any non-2xx response from the hub. */
+class EventHubError extends Error {
+    status;
+    body;
+    constructor(status, body, message) {
+        super(message ?? `event-hub request failed with HTTP ${status}`);
+        this.name = 'EventHubError';
+        this.status = status;
+        this.body = body;
+    }
+}
+exports.EventHubError = EventHubError;
+const DEFAULT_BASE_URL = 'http://localhost:18295';
+/**
+ * Typed, dependency-free client for the event-hub HTTP API.
+ *
+ * ```ts
+ * const hub = new EventHubClient({ baseUrl: 'http://localhost:18295' });
+ * const { status, data } = await hub.publishEvent('orders', { id: 1 }, { idempotencyKey: 'k1' });
+ * ```
+ */
+class EventHubClient {
+    baseUrl;
+    fetchImpl;
+    defaultHeaders;
+    constructor(options = {}) {
+        this.baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, '');
+        const f = options.fetch ?? globalThis.fetch;
+        if (typeof f !== 'function') {
+            throw new Error('EventHubClient: global fetch is unavailable; pass options.fetch (Node >= 18 required)');
+        }
+        this.fetchImpl = f;
+        this.defaultHeaders = options.defaultHeaders ?? {};
+    }
+    // ---------------------------------------------------------------- internal
+    async request(method, path, body, headers = {}) {
+        const init = {
+            method,
+            headers: { ...this.defaultHeaders, ...headers },
+        };
+        if (body !== undefined)
+            init.body = body;
+        const res = await this.fetchImpl(this.baseUrl + path, init);
+        const text = await res.text();
+        let parsed = null;
+        if (text.length > 0) {
+            try {
+                parsed = JSON.parse(text);
+            }
+            catch {
+                parsed = text;
+            }
+        }
+        if (!res.ok) {
+            throw new EventHubError(res.status, parsed, errorMessage(res.status, parsed));
+        }
+        return { status: res.status, data: parsed };
+    }
+    // ------------------------------------------------------------- public API
+    /** `GET /health` */
+    async health() {
+        return (await this.request('GET', '/health')).data;
+    }
+    /** `GET /metrics` */
+    async metrics() {
+        return (await this.request('GET', '/metrics')).data;
+    }
+    /** `POST /topics` -> 201 Topic. */
+    async createTopic(name, description) {
+        const body = JSON.stringify({ name, description: description ?? null });
+        return (await this.request('POST', '/topics', body, { 'Content-Type': 'application/json' })).data;
+    }
+    /** `GET /topics` -> Topic[] with subscribers nested. */
+    async listTopics() {
+        return (await this.request('GET', '/topics')).data;
+    }
+    /** `POST /topics/{topic}/subscribers` -> 201 Subscriber. */
+    async createSubscriber(topic, spec) {
+        const body = JSON.stringify({ kind: 'webhook', ...spec });
+        return (await this.request('POST', `/topics/${encodeURIComponent(topic)}/subscribers`, body, { 'Content-Type': 'application/json' })).data;
+    }
+    /**
+     * `POST /events/{topic}` -> 202 (fresh) or 200 (duplicate).
+     *
+     * A string payload is sent verbatim (so a pre-computed signature keeps
+     * matching); anything else is `JSON.stringify`-ed. When `signature` is
+     * provided it must sign the exact bytes that end up on the wire.
+     */
+    async publishEvent(topic, payload, options = {}) {
+        const body = typeof payload === 'string' ? payload : JSON.stringify(payload);
+        const headers = { 'Content-Type': 'application/json' };
+        if (options.idempotencyKey !== undefined)
+            headers[headers_js_1.HEADERS.idempotency] = options.idempotencyKey;
+        if (options.signature !== undefined)
+            headers[headers_js_1.HEADERS.signature] = options.signature;
+        Object.assign(headers, options.headers ?? {});
+        const { status, data } = await this.request('POST', `/events/${encodeURIComponent(topic)}`, body, headers);
+        return { status, data };
+    }
+    /**
+     * `POST /ingest?origem=<name>` -> 202.
+     *
+     * Requires the hub to be running with `--routes`/`--config`; otherwise the
+     * hub answers 404 `{"error":"routing disabled..."}`.
+     */
+    async ingest(rawPayload, options = {}) {
+        const qs = options.origem !== undefined ? `?origem=${encodeURIComponent(options.origem)}` : '';
+        return (await this.request('POST', `/ingest${qs}`, rawPayload, {
+            'Content-Type': 'application/json',
+        })).data;
+    }
+    /** `GET /deliveries?status=&topic=&limite=` -> Delivery[]. */
+    async listDeliveries(filter = {}) {
+        const params = new URLSearchParams();
+        if (filter.status !== undefined)
+            params.set('status', filter.status);
+        if (filter.topic !== undefined)
+            params.set('topic', filter.topic);
+        if (filter.limite !== undefined)
+            params.set('limite', String(filter.limite));
+        const qs = params.toString();
+        return (await this.request('GET', `/deliveries${qs ? `?${qs}` : ''}`)).data;
+    }
+    /** `POST /deliveries/{id}/retry` -> reschedules one delivery. */
+    async retryDelivery(id) {
+        return (await this.request('POST', `/deliveries/${id}/retry`)).data;
+    }
+    /** `POST /deliveries/retry-falhas` -> bulk retry of failed deliveries. */
+    async retryFailedDeliveries() {
+        return (await this.request('POST', '/deliveries/retry-falhas')).data;
+    }
+}
+exports.EventHubClient = EventHubClient;
+function errorMessage(status, body) {
+    if (body && typeof body === 'object' && 'error' in body && typeof body.error === 'string') {
+        return `event-hub HTTP ${status}: ${body.error}`;
+    }
+    return `event-hub request failed with HTTP ${status}`;
+}

package/dist/cjs/headers.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Canonical HTTP header names used by event-hub.
+ *
+ * Since hub 1.1.0 (src/api.rs) the inbound idempotency header is the English
+ * `X-Idempotency`. The hub still falls back to the legacy Portuguese
+ * `X-Idempotencia` for old producers, but new code should always send the
+ * English name.
+ */
+export declare const HEADERS: {
+    /** Inbound: idempotency key read by the hub (English, since hub 1.1.0). */
+    readonly idempotency: "X-Idempotency";
+    /**
+     * Inbound: legacy Portuguese alias, still accepted by the hub for old
+     * producers; do not send it from new code.
+     */
+    readonly legacyIdempotency: "X-Idempotencia";
+    /** Inbound: `sha256=<hex>`, only checked when the hub has --hmac-secret. */
+    readonly signature: "X-Signature";
+    /** Delivery (hub -> consumer): event id. */
+    readonly deliveryEvent: "X-Event-Hub-Event";
+    /** Delivery: attempt number, 1-based. */
+    readonly deliveryAttempt: "X-Event-Hub-Attempt";
+    /** Delivery: `sha256=<hex>` HMAC-SHA256 of the raw body with the subscriber secret. */
+    readonly deliverySignature: "X-Event-Hub-Signature";
+};
+/** Prefix every signature emitted/consumed by event-hub carries. */
+export declare const SIGNATURE_PREFIX = "sha256=";
+export type HeaderName = (typeof HEADERS)[keyof typeof HEADERS];

package/dist/cjs/headers.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SIGNATURE_PREFIX = exports.HEADERS = void 0;
+/**
+ * Canonical HTTP header names used by event-hub.
+ *
+ * Since hub 1.1.0 (src/api.rs) the inbound idempotency header is the English
+ * `X-Idempotency`. The hub still falls back to the legacy Portuguese
+ * `X-Idempotencia` for old producers, but new code should always send the
+ * English name.
+ */
+exports.HEADERS = {
+    /** Inbound: idempotency key read by the hub (English, since hub 1.1.0). */
+    idempotency: 'X-Idempotency',
+    /**
+     * Inbound: legacy Portuguese alias, still accepted by the hub for old
+     * producers; do not send it from new code.
+     */
+    legacyIdempotency: 'X-Idempotencia',
+    /** Inbound: `sha256=<hex>`, only checked when the hub has --hmac-secret. */
+    signature: 'X-Signature',
+    /** Delivery (hub -> consumer): event id. */
+    deliveryEvent: 'X-Event-Hub-Event',
+    /** Delivery: attempt number, 1-based. */
+    deliveryAttempt: 'X-Event-Hub-Attempt',
+    /** Delivery: `sha256=<hex>` HMAC-SHA256 of the raw body with the subscriber secret. */
+    deliverySignature: 'X-Event-Hub-Signature',
+};
+/** Prefix every signature emitted/consumed by event-hub carries. */
+exports.SIGNATURE_PREFIX = 'sha256=';

package/dist/cjs/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @ravileal/event-hub — TypeScript client for the event-hub webhook fan-out hub.
+ *
+ * Zero runtime dependencies: native `fetch` (Node >= 18) and `node:crypto`.
+ */
+export { EventHubClient, EventHubError } from './client.js';
+export type { EventHubClientOptions, EventPayload } from './client.js';
+export { verifyDeliverySignature, signPayload, computeDeliverySignature } from './signature.js';
+export { HEADERS, SIGNATURE_PREFIX } from './headers.js';
+export type { HeaderName } from './headers.js';
+export type { AcceptedEvent, Delivery, DeliveryFilter, Health, IngestOptions, IngestResult, Metrics, PublishOptions, PublishResult, Subscriber, SubscriberSpec, SubscriberSummary, Topic, TopicWithSubscribers, } from './types.js';

package/dist/cjs/index.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SIGNATURE_PREFIX = exports.HEADERS = exports.computeDeliverySignature = exports.signPayload = exports.verifyDeliverySignature = exports.EventHubError = exports.EventHubClient = void 0;
+/**
+ * @ravileal/event-hub — TypeScript client for the event-hub webhook fan-out hub.
+ *
+ * Zero runtime dependencies: native `fetch` (Node >= 18) and `node:crypto`.
+ */
+var client_js_1 = require("./client.js");
+Object.defineProperty(exports, "EventHubClient", { enumerable: true, get: function () { return client_js_1.EventHubClient; } });
+Object.defineProperty(exports, "EventHubError", { enumerable: true, get: function () { return client_js_1.EventHubError; } });
+var signature_js_1 = require("./signature.js");
+Object.defineProperty(exports, "verifyDeliverySignature", { enumerable: true, get: function () { return signature_js_1.verifyDeliverySignature; } });
+Object.defineProperty(exports, "signPayload", { enumerable: true, get: function () { return signature_js_1.signPayload; } });
+Object.defineProperty(exports, "computeDeliverySignature", { enumerable: true, get: function () { return signature_js_1.computeDeliverySignature; } });
+var headers_js_1 = require("./headers.js");
+Object.defineProperty(exports, "HEADERS", { enumerable: true, get: function () { return headers_js_1.HEADERS; } });
+Object.defineProperty(exports, "SIGNATURE_PREFIX", { enumerable: true, get: function () { return headers_js_1.SIGNATURE_PREFIX; } });

package/dist/cjs/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/dist/cjs/signature.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Computes the signature event-hub would put on a delivery for `rawBody` with
+ * `secret`: HMAC-SHA256 over the EXACT raw bytes, hex-encoded, prefixed with
+ * `sha256=`. Mirrors `sign()` in src/signature.rs.
+ *
+ * Useful for producers that sign inbound events (`X-Signature` on publish) and
+ * for consumers that want to verify a delivery by recomputing it. Accepts
+ * `string | Uint8Array` (a Node `Buffer` is a `Uint8Array`) so the emitted .d.ts
+ * does not require consumers to have @types/node.
+ */
+export declare function signPayload(secret: string | Uint8Array, rawBody: string | Uint8Array): string;
+/**
+ * Alias of {@link signPayload} kept for the delivery-oriented call sites.
+ *
+ * @deprecated Use {@link signPayload}; this is the same function.
+ */
+export declare const computeDeliverySignature: typeof signPayload;
+/**
+ * Verifies the `X-Event-Hub-Signature` header of a delivery against the raw
+ * request body and the subscriber secret, in constant time.
+ *
+ * Pass the RAW body exactly as received (string or bytes) — re-serializing
+ * parsed JSON will change the bytes and fail verification.
+ *
+ * Returns false (never throws) for a missing header, a wrong prefix, a
+ * malformed hex digest, or a length mismatch, so it is safe to call directly
+ * on untrusted input.
+ */
+export declare function verifyDeliverySignature(secret: string | Uint8Array, rawBody: string | Uint8Array, header: string | null | undefined): boolean;

package/dist/cjs/signature.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeDeliverySignature = void 0;
+exports.signPayload = signPayload;
+exports.verifyDeliverySignature = verifyDeliverySignature;
+const node_crypto_1 = require("node:crypto");
+const headers_js_1 = require("./headers.js");
+/**
+ * Computes the signature event-hub would put on a delivery for `rawBody` with
+ * `secret`: HMAC-SHA256 over the EXACT raw bytes, hex-encoded, prefixed with
+ * `sha256=`. Mirrors `sign()` in src/signature.rs.
+ *
+ * Useful for producers that sign inbound events (`X-Signature` on publish) and
+ * for consumers that want to verify a delivery by recomputing it. Accepts
+ * `string | Uint8Array` (a Node `Buffer` is a `Uint8Array`) so the emitted .d.ts
+ * does not require consumers to have @types/node.
+ */
+function signPayload(secret, rawBody) {
+    const mac = (0, node_crypto_1.createHmac)('sha256', secret);
+    mac.update(rawBody);
+    return headers_js_1.SIGNATURE_PREFIX + mac.digest('hex');
+}
+/**
+ * Alias of {@link signPayload} kept for the delivery-oriented call sites.
+ *
+ * @deprecated Use {@link signPayload}; this is the same function.
+ */
+exports.computeDeliverySignature = signPayload;
+const HEX_64 = /^[0-9a-f]{64}$/i;
+/**
+ * Verifies the `X-Event-Hub-Signature` header of a delivery against the raw
+ * request body and the subscriber secret, in constant time.
+ *
+ * Pass the RAW body exactly as received (string or bytes) — re-serializing
+ * parsed JSON will change the bytes and fail verification.
+ *
+ * Returns false (never throws) for a missing header, a wrong prefix, a
+ * malformed hex digest, or a length mismatch, so it is safe to call directly
+ * on untrusted input.
+ */
+function verifyDeliverySignature(secret, rawBody, header) {
+    if (typeof header !== 'string' || header.length === 0)
+        return false;
+    if (!header.startsWith(headers_js_1.SIGNATURE_PREFIX))
+        return false;
+    const hex = header.slice(headers_js_1.SIGNATURE_PREFIX.length);
+    if (!HEX_64.test(hex))
+        return false;
+    const expected = (0, node_crypto_1.createHmac)('sha256', secret).update(rawBody).digest();
+    const received = Buffer.from(hex, 'hex');
+    if (expected.length !== received.length)
+        return false;
+    return (0, node_crypto_1.timingSafeEqual)(expected, received);
+}

package/dist/cjs/types.d.ts

@@ -0,0 +1,129 @@
+/**
+ * Wire types mirroring the event-hub HTTP API (api.rs / models.rs).
+ * Field names are snake_case exactly as the hub serializes them.
+ */
+/** `POST /topics` -> 201 Topic */
+export interface Topic {
+    id: number;
+    name: string;
+    description: string | null;
+    created_at: string;
+}
+/** Subscriber as nested inside `GET /topics` (SubscriberSummary in Rust). */
+export interface SubscriberSummary {
+    id: number;
+    name: string;
+    url: string | null;
+    active: number;
+    max_attempts: number;
+    backoff_ms: number;
+    kind: string;
+    command: string | null;
+    timeout_ms: number | null;
+}
+/** `GET /topics` item: a Topic with its subscribers nested. */
+export interface TopicWithSubscribers extends Topic {
+    subscribers: SubscriberSummary[];
+}
+/** `POST /topics/{topic}/subscribers` -> 201 (note: no `secret` echoed back). */
+export interface Subscriber {
+    id: number;
+    topic_id: number;
+    name: string;
+    url: string | null;
+    active: number;
+    max_attempts: number;
+    backoff_ms: number;
+    kind: string;
+    command: string | null;
+    timeout_ms: number | null;
+}
+/** Body accepted by `POST /topics/{topic}/subscribers`. */
+export interface SubscriberSpec {
+    name: string;
+    /** Required when kind === 'webhook'. */
+    url?: string;
+    /** HMAC secret used to sign deliveries hub -> consumer (X-Event-Hub-Signature). */
+    secret?: string;
+    max_attempts?: number;
+    backoff_ms?: number;
+    /** Defaults to 'webhook' on the hub. */
+    kind?: 'webhook' | 'command';
+    /** Required when kind === 'command'. */
+    command?: string;
+    timeout_ms?: number;
+}
+/** `POST /events/{topic}` response body (AcceptedEvent in Rust). */
+export interface AcceptedEvent {
+    id: number;
+    deliveries_created: number;
+    duplicado: boolean;
+}
+/** Result of publishEvent: the HTTP status plus the parsed body. */
+export interface PublishResult {
+    /** 202 for a fresh event, 200 when the idempotency key was already used. */
+    status: number;
+    data: AcceptedEvent;
+}
+/** `POST /ingest?origem=` response body. */
+export interface IngestResult {
+    event_ids: number[];
+    topics: string[];
+}
+/** `GET /deliveries` item (DeliveryResumo in Rust). */
+export interface Delivery {
+    id: number;
+    status: string;
+    attempts: number;
+    next_attempt_at: string | null;
+    last_error: string | null;
+    event_id: number;
+    topic: string;
+    subscriber: string;
+    url: string | null;
+    kind: string;
+    exit_code: number | null;
+    output: string | null;
+}
+/** `GET /deliveries` query filters. */
+export interface DeliveryFilter {
+    status?: string;
+    topic?: string;
+    /** Clamped by the hub to 1..1000, default 50. */
+    limite?: number;
+}
+/** `GET /health` */
+export interface Health {
+    ok: boolean;
+    version: string;
+}
+/** `GET /metrics` */
+export interface Metrics {
+    events_total: number;
+    deliveries: Record<string, number>;
+    attempts_total: number;
+    topics: number;
+    subscribers: number;
+    proxied_total: number;
+    proxied: Record<string, number>;
+}
+/** Options for `publishEvent`. */
+export interface PublishOptions {
+    /**
+     * Sets `X-Idempotency` (the header the hub reads since 1.1.0). The legacy
+     * `X-Idempotencia` spelling is still accepted by the hub for old producers,
+     * but do not send it from new code.
+     */
+    idempotencyKey?: string;
+    /**
+     * Sets `X-Signature` (e.g. `sha256=<hex>`). Only enforced when the hub was
+     * started with an `--hmac-secret`; harmless otherwise.
+     */
+    signature?: string;
+    /** Extra raw headers, merged last. */
+    headers?: Record<string, string>;
+}
+/** Options for `ingest`. */
+export interface IngestOptions {
+    origem?: string;
+}

package/dist/cjs/types.js

@@ -0,0 +1,6 @@
+"use strict";
+/**
+ * Wire types mirroring the event-hub HTTP API (api.rs / models.rs).
+ * Field names are snake_case exactly as the hub serializes them.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/esm/client.d.ts

@@ -0,0 +1,64 @@
+import type { Delivery, DeliveryFilter, Health, IngestOptions, IngestResult, Metrics, PublishOptions, PublishResult, Subscriber, SubscriberSpec, Topic, TopicWithSubscribers } from './types.js';
+/** Thrown for any non-2xx response from the hub. */
+export declare class EventHubError extends Error {
+    readonly status: number;
+    readonly body: unknown;
+    constructor(status: number, body: unknown, message?: string);
+}
+/** Options for {@link EventHubClient}. `fetch` can be injected for testing. */
+export interface EventHubClientOptions {
+    /** Base URL of the hub, e.g. `http://localhost:18295`. Trailing slashes trimmed. */
+    baseUrl?: string;
+    /** Custom fetch implementation; defaults to the global `fetch` (Node >= 18). */
+    fetch?: typeof fetch;
+    /** Headers merged into every request. */
+    defaultHeaders?: Record<string, string>;
+}
+/** Request body accepted by `publishEvent`: a JSON-able value or a raw string. */
+export type EventPayload = unknown;
+/**
+ * Typed, dependency-free client for the event-hub HTTP API.
+ *
+ * ```ts
+ * const hub = new EventHubClient({ baseUrl: 'http://localhost:18295' });
+ * const { status, data } = await hub.publishEvent('orders', { id: 1 }, { idempotencyKey: 'k1' });
+ * ```
+ */
+export declare class EventHubClient {
+    readonly baseUrl: string;
+    private readonly fetchImpl;
+    private readonly defaultHeaders;
+    constructor(options?: EventHubClientOptions);
+    private request;
+    /** `GET /health` */
+    health(): Promise<Health>;
+    /** `GET /metrics` */
+    metrics(): Promise<Metrics>;
+    /** `POST /topics` -> 201 Topic. */
+    createTopic(name: string, description?: string | null): Promise<Topic>;
+    /** `GET /topics` -> Topic[] with subscribers nested. */
+    listTopics(): Promise<TopicWithSubscribers[]>;
+    /** `POST /topics/{topic}/subscribers` -> 201 Subscriber. */
+    createSubscriber(topic: string, spec: SubscriberSpec): Promise<Subscriber>;
+    /**
+     * `POST /events/{topic}` -> 202 (fresh) or 200 (duplicate).
+     *
+     * A string payload is sent verbatim (so a pre-computed signature keeps
+     * matching); anything else is `JSON.stringify`-ed. When `signature` is
+     * provided it must sign the exact bytes that end up on the wire.
+     */
+    publishEvent(topic: string, payload: EventPayload, options?: PublishOptions): Promise<PublishResult>;
+    /**
+     * `POST /ingest?origem=<name>` -> 202.
+     *
+     * Requires the hub to be running with `--routes`/`--config`; otherwise the
+     * hub answers 404 `{"error":"routing disabled..."}`.
+     */
+    ingest(rawPayload: string, options?: IngestOptions): Promise<IngestResult>;
+    /** `GET /deliveries?status=&topic=&limite=` -> Delivery[]. */
+    listDeliveries(filter?: DeliveryFilter): Promise<Delivery[]>;
+    /** `POST /deliveries/{id}/retry` -> reschedules one delivery. */
+    retryDelivery(id: number): Promise<unknown>;
+    /** `POST /deliveries/retry-falhas` -> bulk retry of failed deliveries. */
+    retryFailedDeliveries(): Promise<unknown>;
+}

package/dist/esm/client.js

@@ -0,0 +1,138 @@
+import { HEADERS } from './headers.js';
+/** Thrown for any non-2xx response from the hub. */
+export class EventHubError extends Error {
+    status;
+    body;
+    constructor(status, body, message) {
+        super(message ?? `event-hub request failed with HTTP ${status}`);
+        this.name = 'EventHubError';
+        this.status = status;
+        this.body = body;
+    }
+}
+const DEFAULT_BASE_URL = 'http://localhost:18295';
+/**
+ * Typed, dependency-free client for the event-hub HTTP API.
+ *
+ * ```ts
+ * const hub = new EventHubClient({ baseUrl: 'http://localhost:18295' });
+ * const { status, data } = await hub.publishEvent('orders', { id: 1 }, { idempotencyKey: 'k1' });
+ * ```
+ */
+export class EventHubClient {
+    baseUrl;
+    fetchImpl;
+    defaultHeaders;
+    constructor(options = {}) {
+        this.baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, '');
+        const f = options.fetch ?? globalThis.fetch;
+        if (typeof f !== 'function') {
+            throw new Error('EventHubClient: global fetch is unavailable; pass options.fetch (Node >= 18 required)');
+        }
+        this.fetchImpl = f;
+        this.defaultHeaders = options.defaultHeaders ?? {};
+    }
+    // ---------------------------------------------------------------- internal
+    async request(method, path, body, headers = {}) {
+        const init = {
+            method,
+            headers: { ...this.defaultHeaders, ...headers },
+        };
+        if (body !== undefined)
+            init.body = body;
+        const res = await this.fetchImpl(this.baseUrl + path, init);
+        const text = await res.text();
+        let parsed = null;
+        if (text.length > 0) {
+            try {
+                parsed = JSON.parse(text);
+            }
+            catch {
+                parsed = text;
+            }
+        }
+        if (!res.ok) {
+            throw new EventHubError(res.status, parsed, errorMessage(res.status, parsed));
+        }
+        return { status: res.status, data: parsed };
+    }
+    // ------------------------------------------------------------- public API
+    /** `GET /health` */
+    async health() {
+        return (await this.request('GET', '/health')).data;
+    }
+    /** `GET /metrics` */
+    async metrics() {
+        return (await this.request('GET', '/metrics')).data;
+    }
+    /** `POST /topics` -> 201 Topic. */
+    async createTopic(name, description) {
+        const body = JSON.stringify({ name, description: description ?? null });
+        return (await this.request('POST', '/topics', body, { 'Content-Type': 'application/json' })).data;
+    }
+    /** `GET /topics` -> Topic[] with subscribers nested. */
+    async listTopics() {
+        return (await this.request('GET', '/topics')).data;
+    }
+    /** `POST /topics/{topic}/subscribers` -> 201 Subscriber. */
+    async createSubscriber(topic, spec) {
+        const body = JSON.stringify({ kind: 'webhook', ...spec });
+        return (await this.request('POST', `/topics/${encodeURIComponent(topic)}/subscribers`, body, { 'Content-Type': 'application/json' })).data;
+    }
+    /**
+     * `POST /events/{topic}` -> 202 (fresh) or 200 (duplicate).
+     *
+     * A string payload is sent verbatim (so a pre-computed signature keeps
+     * matching); anything else is `JSON.stringify`-ed. When `signature` is
+     * provided it must sign the exact bytes that end up on the wire.
+     */
+    async publishEvent(topic, payload, options = {}) {
+        const body = typeof payload === 'string' ? payload : JSON.stringify(payload);
+        const headers = { 'Content-Type': 'application/json' };
+        if (options.idempotencyKey !== undefined)
+            headers[HEADERS.idempotency] = options.idempotencyKey;
+        if (options.signature !== undefined)
+            headers[HEADERS.signature] = options.signature;
+        Object.assign(headers, options.headers ?? {});
+        const { status, data } = await this.request('POST', `/events/${encodeURIComponent(topic)}`, body, headers);
+        return { status, data };
+    }
+    /**
+     * `POST /ingest?origem=<name>` -> 202.
+     *
+     * Requires the hub to be running with `--routes`/`--config`; otherwise the
+     * hub answers 404 `{"error":"routing disabled..."}`.
+     */
+    async ingest(rawPayload, options = {}) {
+        const qs = options.origem !== undefined ? `?origem=${encodeURIComponent(options.origem)}` : '';
+        return (await this.request('POST', `/ingest${qs}`, rawPayload, {
+            'Content-Type': 'application/json',
+        })).data;
+    }
+    /** `GET /deliveries?status=&topic=&limite=` -> Delivery[]. */
+    async listDeliveries(filter = {}) {
+        const params = new URLSearchParams();
+        if (filter.status !== undefined)
+            params.set('status', filter.status);
+        if (filter.topic !== undefined)
+            params.set('topic', filter.topic);
+        if (filter.limite !== undefined)
+            params.set('limite', String(filter.limite));
+        const qs = params.toString();
+        return (await this.request('GET', `/deliveries${qs ? `?${qs}` : ''}`)).data;
+    }
+    /** `POST /deliveries/{id}/retry` -> reschedules one delivery. */
+    async retryDelivery(id) {
+        return (await this.request('POST', `/deliveries/${id}/retry`)).data;
+    }
+    /** `POST /deliveries/retry-falhas` -> bulk retry of failed deliveries. */
+    async retryFailedDeliveries() {
+        return (await this.request('POST', '/deliveries/retry-falhas')).data;
+    }
+}
+function errorMessage(status, body) {
+    if (body && typeof body === 'object' && 'error' in body && typeof body.error === 'string') {
+        return `event-hub HTTP ${status}: ${body.error}`;
+    }
+    return `event-hub request failed with HTTP ${status}`;
+}

package/dist/esm/headers.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Canonical HTTP header names used by event-hub.
+ *
+ * Since hub 1.1.0 (src/api.rs) the inbound idempotency header is the English
+ * `X-Idempotency`. The hub still falls back to the legacy Portuguese
+ * `X-Idempotencia` for old producers, but new code should always send the
+ * English name.
+ */
+export declare const HEADERS: {
+    /** Inbound: idempotency key read by the hub (English, since hub 1.1.0). */
+    readonly idempotency: "X-Idempotency";
+    /**
+     * Inbound: legacy Portuguese alias, still accepted by the hub for old
+     * producers; do not send it from new code.
+     */
+    readonly legacyIdempotency: "X-Idempotencia";
+    /** Inbound: `sha256=<hex>`, only checked when the hub has --hmac-secret. */
+    readonly signature: "X-Signature";
+    /** Delivery (hub -> consumer): event id. */
+    readonly deliveryEvent: "X-Event-Hub-Event";
+    /** Delivery: attempt number, 1-based. */
+    readonly deliveryAttempt: "X-Event-Hub-Attempt";
+    /** Delivery: `sha256=<hex>` HMAC-SHA256 of the raw body with the subscriber secret. */
+    readonly deliverySignature: "X-Event-Hub-Signature";
+};
+/** Prefix every signature emitted/consumed by event-hub carries. */
+export declare const SIGNATURE_PREFIX = "sha256=";
+export type HeaderName = (typeof HEADERS)[keyof typeof HEADERS];

package/dist/esm/headers.js

@@ -0,0 +1,27 @@
+/**
+ * Canonical HTTP header names used by event-hub.
+ *
+ * Since hub 1.1.0 (src/api.rs) the inbound idempotency header is the English
+ * `X-Idempotency`. The hub still falls back to the legacy Portuguese
+ * `X-Idempotencia` for old producers, but new code should always send the
+ * English name.
+ */
+export const HEADERS = {
+    /** Inbound: idempotency key read by the hub (English, since hub 1.1.0). */
+    idempotency: 'X-Idempotency',
+    /**
+     * Inbound: legacy Portuguese alias, still accepted by the hub for old
+     * producers; do not send it from new code.
+     */
+    legacyIdempotency: 'X-Idempotencia',
+    /** Inbound: `sha256=<hex>`, only checked when the hub has --hmac-secret. */
+    signature: 'X-Signature',
+    /** Delivery (hub -> consumer): event id. */
+    deliveryEvent: 'X-Event-Hub-Event',
+    /** Delivery: attempt number, 1-based. */
+    deliveryAttempt: 'X-Event-Hub-Attempt',
+    /** Delivery: `sha256=<hex>` HMAC-SHA256 of the raw body with the subscriber secret. */
+    deliverySignature: 'X-Event-Hub-Signature',
+};
+/** Prefix every signature emitted/consumed by event-hub carries. */
+export const SIGNATURE_PREFIX = 'sha256=';

package/dist/esm/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @ravileal/event-hub — TypeScript client for the event-hub webhook fan-out hub.
+ *
+ * Zero runtime dependencies: native `fetch` (Node >= 18) and `node:crypto`.
+ */
+export { EventHubClient, EventHubError } from './client.js';
+export type { EventHubClientOptions, EventPayload } from './client.js';
+export { verifyDeliverySignature, signPayload, computeDeliverySignature } from './signature.js';
+export { HEADERS, SIGNATURE_PREFIX } from './headers.js';
+export type { HeaderName } from './headers.js';
+export type { AcceptedEvent, Delivery, DeliveryFilter, Health, IngestOptions, IngestResult, Metrics, PublishOptions, PublishResult, Subscriber, SubscriberSpec, SubscriberSummary, Topic, TopicWithSubscribers, } from './types.js';

package/dist/esm/index.js

@@ -0,0 +1,8 @@
+/**
+ * @ravileal/event-hub — TypeScript client for the event-hub webhook fan-out hub.
+ *
+ * Zero runtime dependencies: native `fetch` (Node >= 18) and `node:crypto`.
+ */
+export { EventHubClient, EventHubError } from './client.js';
+export { verifyDeliverySignature, signPayload, computeDeliverySignature } from './signature.js';
+export { HEADERS, SIGNATURE_PREFIX } from './headers.js';

package/dist/esm/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

package/dist/esm/signature.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Computes the signature event-hub would put on a delivery for `rawBody` with
+ * `secret`: HMAC-SHA256 over the EXACT raw bytes, hex-encoded, prefixed with
+ * `sha256=`. Mirrors `sign()` in src/signature.rs.
+ *
+ * Useful for producers that sign inbound events (`X-Signature` on publish) and
+ * for consumers that want to verify a delivery by recomputing it. Accepts
+ * `string | Uint8Array` (a Node `Buffer` is a `Uint8Array`) so the emitted .d.ts
+ * does not require consumers to have @types/node.
+ */
+export declare function signPayload(secret: string | Uint8Array, rawBody: string | Uint8Array): string;
+/**
+ * Alias of {@link signPayload} kept for the delivery-oriented call sites.
+ *
+ * @deprecated Use {@link signPayload}; this is the same function.
+ */
+export declare const computeDeliverySignature: typeof signPayload;
+/**
+ * Verifies the `X-Event-Hub-Signature` header of a delivery against the raw
+ * request body and the subscriber secret, in constant time.
+ *
+ * Pass the RAW body exactly as received (string or bytes) — re-serializing
+ * parsed JSON will change the bytes and fail verification.
+ *
+ * Returns false (never throws) for a missing header, a wrong prefix, a
+ * malformed hex digest, or a length mismatch, so it is safe to call directly
+ * on untrusted input.
+ */
+export declare function verifyDeliverySignature(secret: string | Uint8Array, rawBody: string | Uint8Array, header: string | null | undefined): boolean;

package/dist/esm/signature.js

@@ -0,0 +1,49 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { SIGNATURE_PREFIX } from './headers.js';
+/**
+ * Computes the signature event-hub would put on a delivery for `rawBody` with
+ * `secret`: HMAC-SHA256 over the EXACT raw bytes, hex-encoded, prefixed with
+ * `sha256=`. Mirrors `sign()` in src/signature.rs.
+ *
+ * Useful for producers that sign inbound events (`X-Signature` on publish) and
+ * for consumers that want to verify a delivery by recomputing it. Accepts
+ * `string | Uint8Array` (a Node `Buffer` is a `Uint8Array`) so the emitted .d.ts
+ * does not require consumers to have @types/node.
+ */
+export function signPayload(secret, rawBody) {
+    const mac = createHmac('sha256', secret);
+    mac.update(rawBody);
+    return SIGNATURE_PREFIX + mac.digest('hex');
+}
+/**
+ * Alias of {@link signPayload} kept for the delivery-oriented call sites.
+ *
+ * @deprecated Use {@link signPayload}; this is the same function.
+ */
+export const computeDeliverySignature = signPayload;
+const HEX_64 = /^[0-9a-f]{64}$/i;
+/**
+ * Verifies the `X-Event-Hub-Signature` header of a delivery against the raw
+ * request body and the subscriber secret, in constant time.
+ *
+ * Pass the RAW body exactly as received (string or bytes) — re-serializing
+ * parsed JSON will change the bytes and fail verification.
+ *
+ * Returns false (never throws) for a missing header, a wrong prefix, a
+ * malformed hex digest, or a length mismatch, so it is safe to call directly
+ * on untrusted input.
+ */
+export function verifyDeliverySignature(secret, rawBody, header) {
+    if (typeof header !== 'string' || header.length === 0)
+        return false;
+    if (!header.startsWith(SIGNATURE_PREFIX))
+        return false;
+    const hex = header.slice(SIGNATURE_PREFIX.length);
+    if (!HEX_64.test(hex))
+        return false;
+    const expected = createHmac('sha256', secret).update(rawBody).digest();
+    const received = Buffer.from(hex, 'hex');
+    if (expected.length !== received.length)
+        return false;
+    return timingSafeEqual(expected, received);
+}

package/dist/esm/types.d.ts

@@ -0,0 +1,129 @@
+/**
+ * Wire types mirroring the event-hub HTTP API (api.rs / models.rs).
+ * Field names are snake_case exactly as the hub serializes them.
+ */
+/** `POST /topics` -> 201 Topic */
+export interface Topic {
+    id: number;
+    name: string;
+    description: string | null;
+    created_at: string;
+}
+/** Subscriber as nested inside `GET /topics` (SubscriberSummary in Rust). */
+export interface SubscriberSummary {
+    id: number;
+    name: string;
+    url: string | null;
+    active: number;
+    max_attempts: number;
+    backoff_ms: number;
+    kind: string;
+    command: string | null;
+    timeout_ms: number | null;
+}
+/** `GET /topics` item: a Topic with its subscribers nested. */
+export interface TopicWithSubscribers extends Topic {
+    subscribers: SubscriberSummary[];
+}
+/** `POST /topics/{topic}/subscribers` -> 201 (note: no `secret` echoed back). */
+export interface Subscriber {
+    id: number;
+    topic_id: number;
+    name: string;
+    url: string | null;
+    active: number;
+    max_attempts: number;
+    backoff_ms: number;
+    kind: string;
+    command: string | null;
+    timeout_ms: number | null;
+}
+/** Body accepted by `POST /topics/{topic}/subscribers`. */
+export interface SubscriberSpec {
+    name: string;
+    /** Required when kind === 'webhook'. */
+    url?: string;
+    /** HMAC secret used to sign deliveries hub -> consumer (X-Event-Hub-Signature). */
+    secret?: string;
+    max_attempts?: number;
+    backoff_ms?: number;
+    /** Defaults to 'webhook' on the hub. */
+    kind?: 'webhook' | 'command';
+    /** Required when kind === 'command'. */
+    command?: string;
+    timeout_ms?: number;
+}
+/** `POST /events/{topic}` response body (AcceptedEvent in Rust). */
+export interface AcceptedEvent {
+    id: number;
+    deliveries_created: number;
+    duplicado: boolean;
+}
+/** Result of publishEvent: the HTTP status plus the parsed body. */
+export interface PublishResult {
+    /** 202 for a fresh event, 200 when the idempotency key was already used. */
+    status: number;
+    data: AcceptedEvent;
+}
+/** `POST /ingest?origem=` response body. */
+export interface IngestResult {
+    event_ids: number[];
+    topics: string[];
+}
+/** `GET /deliveries` item (DeliveryResumo in Rust). */
+export interface Delivery {
+    id: number;
+    status: string;
+    attempts: number;
+    next_attempt_at: string | null;
+    last_error: string | null;
+    event_id: number;
+    topic: string;
+    subscriber: string;
+    url: string | null;
+    kind: string;
+    exit_code: number | null;
+    output: string | null;
+}
+/** `GET /deliveries` query filters. */
+export interface DeliveryFilter {
+    status?: string;
+    topic?: string;
+    /** Clamped by the hub to 1..1000, default 50. */
+    limite?: number;
+}
+/** `GET /health` */
+export interface Health {
+    ok: boolean;
+    version: string;
+}
+/** `GET /metrics` */
+export interface Metrics {
+    events_total: number;
+    deliveries: Record<string, number>;
+    attempts_total: number;
+    topics: number;
+    subscribers: number;
+    proxied_total: number;
+    proxied: Record<string, number>;
+}
+/** Options for `publishEvent`. */
+export interface PublishOptions {
+    /**
+     * Sets `X-Idempotency` (the header the hub reads since 1.1.0). The legacy
+     * `X-Idempotencia` spelling is still accepted by the hub for old producers,
+     * but do not send it from new code.
+     */
+    idempotencyKey?: string;
+    /**
+     * Sets `X-Signature` (e.g. `sha256=<hex>`). Only enforced when the hub was
+     * started with an `--hmac-secret`; harmless otherwise.
+     */
+    signature?: string;
+    /** Extra raw headers, merged last. */
+    headers?: Record<string, string>;
+}
+/** Options for `ingest`. */
+export interface IngestOptions {
+    origem?: string;
+}

package/dist/esm/types.js

@@ -0,0 +1,5 @@
+/**
+ * Wire types mirroring the event-hub HTTP API (api.rs / models.rs).
+ * Field names are snake_case exactly as the hub serializes them.
+ */
+export {};

package/package.json

@@ -0,0 +1,64 @@
+{
+  "name": "@ravileal/event-hub",
+  "version": "1.1.1",
+  "description": "TypeScript client for the event-hub webhook fan-out hub: topics, subscribers, events, deliveries, ingest and timing-safe HMAC delivery-signature verification. Zero runtime dependencies (native fetch + node:crypto).",
+  "license": "MIT",
+  "keywords": [
+    "event-hub",
+    "webhook",
+    "fan-out",
+    "events",
+    "hmac",
+    "sdk"
+  ],
+  "type": "module",
+  "engines": {
+    "node": ">=18"
+  },
+  "main": "./dist/cjs/index.js",
+  "module": "./dist/esm/index.js",
+  "types": "./dist/cjs/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/esm/index.d.ts",
+        "default": "./dist/esm/index.js"
+      },
+      "require": {
+        "types": "./dist/cjs/index.d.ts",
+        "default": "./dist/cjs/index.js"
+      },
+      "default": "./dist/esm/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
+    "build": "node scripts/build.mjs",
+    "test:unit": "node --test test/signature.test.mjs",
+    "test:e2e": "node --test test/e2e.test.mjs",
+    "prepack": "npm run build"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ravileal/event-hub.git",
+    "directory": "packages/npm"
+  },
+  "bugs": {
+    "url": "https://github.com/ravileal/event-hub/issues"
+  },
+  "homepage": "https://github.com/ravileal/event-hub/tree/main/packages/npm",
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.2",
+    "typescript": "^5.7.2"
+  }
+}