@team-plain/webhooks 0.1.0 → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Not Just Tickets Ltd.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,77 @@
+# @team-plain/webhooks
+
+Webhook parsing and signature verification for [Plain](https://plain.com) webhooks. Standalone package — no dependency on `@team-plain/sdk`.
+
+## Installation
+
+```bash
+npm install @team-plain/webhooks
+```
+
+## Usage
+
+### Verify and parse (recommended)
+
+`verifyPlainWebhook` validates the HMAC-SHA256 signature, checks the timestamp to prevent replay attacks, and parses the payload against the webhook JSON schema.
+
+```ts
+import { verifyPlainWebhook } from "@team-plain/webhooks";
+
+const result = verifyPlainWebhook(
+  rawBody,                    // raw request body string
+  req.headers["plain-request-signature"], // signature header
+  process.env.PLAIN_WEBHOOK_SECRET,       // your webhook signing secret
+);
+
+if (result.error) {
+  console.error(result.error.message);
+} else {
+  const event = result.data;
+  console.log(event.eventType, event.payload);
+}
+```
+
+The optional fourth argument `tolerance` (default: `300` seconds) controls the maximum allowed age of the webhook timestamp.
+
+### Parse only (no signature verification)
+
+`parsePlainWebhook` validates the payload against the webhook JSON schema without checking the signature. Useful for development or when verification is handled elsewhere.
+
+```ts
+import { parsePlainWebhook } from "@team-plain/webhooks";
+
+const result = parsePlainWebhook(rawBody);
+
+if (result.error) {
+  console.error(result.error.message);
+} else {
+  const event = result.data;
+  console.log(event.eventType, event.payload);
+}
+```
+
+### Error types
+
+All functions return a `Result<T, Error>` — either `{ data: T }` or `{ error: Error }`.
+
+| Error class | When |
+|------------|------|
+| `PlainWebhookSignatureVerificationError` | Invalid signature, missing headers, or expired timestamp |
+| `PlainWebhookPayloadError` | Payload fails JSON schema validation |
+| `PlainWebhookVersionMismatchError` | Payload version doesn't match the schema version bundled in this package |
+
+### Typed event payloads
+
+All webhook payload types are exported for use in your handlers:
+
+```ts
+import type {
+  ThreadCreatedPublicEventPayload,
+  CustomerCreatedPublicEventPayload,
+  // ...
+} from "@team-plain/webhooks";
+```
+
+## License
+
+[MIT](../../LICENSE)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-plain/webhooks",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -16,10 +16,6 @@
   "files": [
     "dist"
   ],
-  "scripts": {
-    "build": "tsc",
-    "test": "vitest run"
-  },
   "dependencies": {
     "ajv": "^8.12.0",
     "ajv-formats": "^2.1.1"
@@ -27,5 +23,9 @@
   "devDependencies": {
     "@types/node": "^25.0.0",
     "typescript": "^5.7.0"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run"
   }
-}
+}