@zap-studio/webhooks 1.1.0 → 1.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +6 -0
- package/README.md +10 -0
- package/package.json +11 -3
package/CHANGELOG.md
CHANGED
|
@@ -4,6 +4,12 @@ All notable changes to this project will be documented in this file.
|
|
|
4
4
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
6
6
|
|
|
7
|
+
## [1.1.1]
|
|
8
|
+
|
|
9
|
+
### Changed
|
|
10
|
+
|
|
11
|
+
`@zap-studio/logger` is now an optional peer dependency instead of a regular dependency. Every import from it is type-only (`import type { Logger }`), so it was never pulled in at runtime — pass any object matching the `Logger` shape (including `pino`) with no install required. Existing consumers of `logger?: Logger` are unaffected.
|
|
12
|
+
|
|
7
13
|
## [1.1.0]
|
|
8
14
|
|
|
9
15
|
### Added
|
package/README.md
CHANGED
|
@@ -4,6 +4,16 @@ Schema-first, type-safe webhook routing built on the standard Web API [`Request`
|
|
|
4
4
|
|
|
5
5
|
Full documentation: [zapstudio.dev/webhooks](https://www.zapstudio.dev/webhooks)
|
|
6
6
|
|
|
7
|
+
## Motivation
|
|
8
|
+
|
|
9
|
+
Webhook endpoints are usually built by hand, per provider, and this tends to repeat the same two mistakes. First, signature checks often use Node's `crypto` module, which does not exist on Cloudflare Workers, Deno, or Bun's edge runtimes — so the same code cannot run everywhere the webhook needs to be received.
|
|
10
|
+
|
|
11
|
+
Second, signatures are often compared with `===`, which leaks timing information and opens a timing-attack risk that most teams do not know they have.
|
|
12
|
+
|
|
13
|
+
`@zap-studio/webhooks` fixes both. It is built on the standard `Request`/`Response` objects, so the same router works on Bun, Deno, Cloudflare Workers, or any framework that accepts a `Request`.
|
|
14
|
+
|
|
15
|
+
Signature verification is opt-in through the `verify` option, and the built-in HMAC verifier uses the Web Crypto API (`globalThis.crypto.subtle`) with a constant-time comparison, so once you turn it on, you get the safe comparison without writing it yourself. Payloads are validated and typed straight from your Standard Schema — no `any` from `JSON.parse`, no manual casts.
|
|
16
|
+
|
|
7
17
|
## Installation
|
|
8
18
|
|
|
9
19
|
```bash
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@zap-studio/webhooks",
|
|
3
|
-
"version": "1.1.
|
|
3
|
+
"version": "1.1.1",
|
|
4
4
|
"private": false,
|
|
5
5
|
"description": "A lightweight, type-safe, tree-shakeable webhook router with Standard Schema validation, signature verification, and lifecycle hooks.",
|
|
6
6
|
"keywords": [
|
|
@@ -46,7 +46,6 @@
|
|
|
46
46
|
"access": "public"
|
|
47
47
|
},
|
|
48
48
|
"dependencies": {
|
|
49
|
-
"@zap-studio/logger": "1.0.0",
|
|
50
49
|
"@zap-studio/validation": "1.0.0"
|
|
51
50
|
},
|
|
52
51
|
"devDependencies": {
|
|
@@ -54,7 +53,16 @@
|
|
|
54
53
|
"typescript": "^7.0.2",
|
|
55
54
|
"vitest": "^4.1.10",
|
|
56
55
|
"zod": "^4.4.3",
|
|
57
|
-
"@zap-studio/typescript": "0.0.0"
|
|
56
|
+
"@zap-studio/typescript": "0.0.0",
|
|
57
|
+
"@zap-studio/logger": "1.0.0"
|
|
58
|
+
},
|
|
59
|
+
"peerDependencies": {
|
|
60
|
+
"@zap-studio/logger": "1.0.0"
|
|
61
|
+
},
|
|
62
|
+
"peerDependenciesMeta": {
|
|
63
|
+
"@zap-studio/logger": {
|
|
64
|
+
"optional": true
|
|
65
|
+
}
|
|
58
66
|
},
|
|
59
67
|
"engines": {
|
|
60
68
|
"node": ">=18.0.0"
|