@t4h.framework/webhook 0.2.0 → 0.2.2

package/.ai/skills/framework-webhook/SKILL.md

@@ -33,7 +33,14 @@ const callback = await webhook({
   schema: Type.Object({ status: Type.String() }),
   timeoutInMs: 86_400_000,
 })
+```
+
+`auth.secret` (and `password`, `token`, `value` of the other auth types) is a
+`Secret`: declare the env entry with `type: Secret` and pass it whole. The host
+reads the value when it verifies a callback; the pending activity records the
+name, never the value.
 
+```typescript
 callback.dispatch?.body // the partner's answer to the request
 callback.body.status // the callback body, typed by schema
 ```

package/CHANGELOG.md

@@ -1,5 +1,69 @@
 # @t4h.framework/webhook
 
+## 0.2.2
+
+### Patch Changes
+
+- [#181](https://github.com/tech4humans-brasil/framework/pull/181) [`9449e4e`](https://github.com/tech4humans-brasil/framework/commit/9449e4e9889f42dea1d52418140f47d25dff0535) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - A credential is a `Secret`, never a string. An env entry declared with
+  `type: Secret` hands the workflow the name of the variable; the host binds the
+  value where the activity runs, so no input, output or history record holds it.
+
+  **Breaking**: every field that carries a credential now accepts only a
+  `Secret`. Declare the entry with `type: Secret` in your `EnvDesign` and pass it
+  whole; `tsc` points at each remaining string.
+
+  **core**: `Secret` (a `SerializableClass` whose `toString`, `valueOf` and
+  `toJSON` throw), `Secret.resolve` and `Secret.read` for hosts, `Secret.FORMAT`
+  for the manifest. `EnvDesign` accepts `type: Secret`, refuses a `defaultValue`
+  on a secret entry and throws when a `String` entry receives a secret.
+  `AsyncActivityCallbackAuth` carries a `Secret` in `secret`, `password`, `token`
+  and `value`.
+
+  **http**: `auth` accepts `{ username, password }`, `{ bearer }` or
+  `{ header, value }` besides an `HttpAuth`, all with a `Secret`, and the
+  activity writes the header on the host. `clientSecret` and `password` of the
+  OAuth2 grants are a `Secret`.
+
+  **smtp**, **sftp**, **orm**: `connectionString` is a `Secret`. The
+  `SftpConnectionString` and `ORMConnectionString` aliases are gone.
+
+  **hmac**: the callback authorizer reads the secret through `Secret.read`.
+
+  **dev**: the codec writes a `Secret` by name and binds the env value only where
+  an activity runs, reading the input back from the database as the runtime does.
+  The SFTP and SMTP claims read the value on connect.
+
+  **webhook**: documents the `Secret` in `auth`.
+
+- Updated dependencies [[`9449e4e`](https://github.com/tech4humans-brasil/framework/commit/9449e4e9889f42dea1d52418140f47d25dff0535), [`9449e4e`](https://github.com/tech4humans-brasil/framework/commit/9449e4e9889f42dea1d52418140f47d25dff0535)]:
+  - @t4h.framework/core@0.15.0
+  - @t4h.framework/http@0.7.0
+
+## 0.2.1
+
+### Patch Changes
+
+- [#170](https://github.com/tech4humans-brasil/framework/pull/170) [`aa72268`](https://github.com/tech4humans-brasil/framework/commit/aa72268d040a743743cac31cc14e26b8620b0e3f) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Adds the `jwks` callback auth: a detached signature over the callback body,
+  verified with the public key the `kid` resolves to at a JWKS URL — the way Amber
+  signs its webhooks.
+
+  **core**: `AsyncActivityCallbackAuthJwks` joins `AsyncActivityCallbackAuth`
+  (`jwksUri`, `header`, `kid`/`kidHeader`, `algorithm`/`algorithmHeader`,
+  `signatureFormat`/`signatureFormatHeader`, `timestampHeader`,
+  `toleranceInSeconds`, `signedPayload` as a template over `{timestamp}` and
+  `{body}`).
+
+  **jwks**: `jwksCallback` (default of `@t4h.framework/jwks/callback`) now serves
+  both `jwt` and `jwks`. Hosts pass it as `{ jwt: jwksCallback, jwks: jwksCallback }`.
+
+  **dev**: loads `@t4h.framework/jwks` for the `jwks` type as well.
+
+  **webhook**: documents the new type.
+
+- Updated dependencies [[`aa72268`](https://github.com/tech4humans-brasil/framework/commit/aa72268d040a743743cac31cc14e26b8620b0e3f)]:
+  - @t4h.framework/core@0.14.0
+  - @t4h.framework/http@0.6.3
+
 ## 0.2.0
 
 ### Minor Changes

package/README.md

@@ -32,7 +32,8 @@ arrives before `timeoutInMs` throws `WebhookTimeoutError`, so the workflow
 never sees a callback that did not happen.
 
 Supported `auth`: `hmac` (GitHub, Shopify, Slack style), `basic`, `header`,
-`bearer` and `jwt` (JWKS).
+`bearer`, `jwt` (bearer JWT verified with a JWKS) and `jwks` (detached
+signature verified with a JWKS key).
 
 Pass `{ wait: false }` as the second argument to send the request without
 suspending; you get a handle and call `handle.wait()` later.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@t4h.framework/webhook",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Webhook module for the T4H Framework",
   "homepage": "https://github.com/tech4humans-brasil/framework/tree/main/packages/webhook",
   "bugs": "https://github.com/tech4humans-brasil/framework/issues",
@@ -34,14 +34,14 @@
     "typebox": "^1.1.6"
   },
   "devDependencies": {
-    "@t4h.framework/core": "^0.13.0",
-    "@t4h.framework/http": "^0.6.2",
+    "@t4h.framework/core": "^0.15.0",
+    "@t4h.framework/http": "^0.7.0",
     "typescript": "^5.9.3",
     "vitest": "^4.0.18"
   },
   "peerDependencies": {
-    "@t4h.framework/core": "^0.13.0",
-    "@t4h.framework/http": "^0.6.2"
+    "@t4h.framework/core": "^0.15.0",
+    "@t4h.framework/http": "^0.7.0"
   },
   "packageManager": "yarn@4.12.0",
   "engines": {