@vesk/vesk-cli 0.2.50-canary.5 → 0.2.50-canary.6

package/dist/cli.js

@@ -22862,18 +22862,20 @@ function webhook(options) {
     secret,
     handler,
     headerName = "x-webhook-signature",
-    signaturePrefix = "sha256="
+    signaturePrefix = "sha256=",
+    algorithm = "SHA-256",
+    signedPayload
   } = options;
   if (!secret) throw new Error("webhook() requires a secret");
   if (!handler) throw new Error("webhook() requires a handler function");
-  async function computeSignature(body) {
+  async function computeSignature(payload) {
     const key = typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
-    const data2 = typeof body === "string" ? new TextEncoder().encode(body) : body;
+    const data2 = new TextEncoder().encode(payload);
     const crypto2 = globalThis.crypto;
     if (!crypto2?.subtle) {
       throw new Error("Web Crypto API not available (required for webhook signature verification)");
     }
-    return crypto2.subtle.importKey("raw", key, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]).then((k) => crypto2.subtle.sign("HMAC", k, data2)).then((sig) => {
+    return crypto2.subtle.importKey("raw", key, { name: "HMAC", hash: algorithm }, false, ["sign"]).then((k) => crypto2.subtle.sign("HMAC", k, data2)).then((sig) => {
       const hex = Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
       return hex;
     });
@@ -22893,7 +22895,25 @@ function webhook(options) {
       });
     }
     const body = await request.text();
-    const expectedSig = await computeSignature(body);
+    let parsed;
+    try {
+      parsed = JSON.parse(body);
+    } catch {
+      parsed = body;
+    }
+    const event = parsed;
+    let payload = body;
+    if (signedPayload) {
+      try {
+        payload = signedPayload(event);
+      } catch {
+        return new Response(JSON.stringify({ error: "Invalid signature" }), {
+          status: 401,
+          headers: { "Content-Type": "application/json" }
+        });
+      }
+    }
+    const expectedSig = await computeSignature(payload);
     const prefixLen = signaturePrefix.length;
     const providedSig = signature.startsWith(signaturePrefix) ? signature.slice(prefixLen) : signature;
     if (providedSig.length !== expectedSig.length) {
@@ -22912,12 +22932,6 @@ function webhook(options) {
         headers: { "Content-Type": "application/json" }
       });
     }
-    let event;
-    try {
-      event = JSON.parse(body);
-    } catch {
-      event = body;
-    }
     return handler(event, request);
   }
   return webhookHandler;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vesk/vesk-cli",
-  "version": "0.2.50-canary.5",
+  "version": "0.2.50-canary.6",
   "type": "module",
   "description": "Vesk — compiler-first framework for the post-VDOM web. vesk dev, vesk build.",
   "bin": {
@@ -8,10 +8,10 @@
   },
   "main": "./dist/cli.js",
   "dependencies": {
-    "@vesk/adapter": "^0.2.50-canary.5",
-    "@vesk/compiler": "^0.2.50-canary.5",
-    "@vesk/plugin-tailwind": "^0.2.50-canary.5",
-    "@vesk/runtime": "^0.2.50-canary.5",
+    "@vesk/adapter": "^0.2.50-canary.6",
+    "@vesk/compiler": "^0.2.50-canary.6",
+    "@vesk/plugin-tailwind": "^0.2.50-canary.6",
+    "@vesk/runtime": "^0.2.50-canary.6",
     "esrap": "^2.3.0",
     "typescript": "^5.8.0",
     "ws": "^8.18.0",