agentful 0.4.6 → 0.4.8

package/README.md

@@ -58,6 +58,11 @@ its own — and server-side logic still has a place:
   source per action and 10 concurrent calls per project. The 5 s are a budget,
   not a guaranteed stop: an action still waiting on a network call at that
   point is answered with `408`, and calls it already started may still finish.
+  **Incoming webhooks:** the platform checks the sender's signature for you —
+  `await ctx.webhooks.verifyStripe('server.<name>')`,
+  `ctx.webhooks.verifyGitHub(…)`, or `ctx.verifyHmac({…})` over `ctx.rawBody`
+  (the request body exactly as received) for other HMAC schemes. The signing
+  secret stays on the platform; your action gets a verdict.
 - **Your own API.** Connect an HTTPS endpoint you run yourself in the Backend
   tab; `/api/*` on your app's domain is forwarded to it. The platform adds no
   secret and authorizes nobody on the way — that is your endpoint's job.
@@ -69,12 +74,19 @@ What does **not** work:
 - Inside Server Actions: **no cron or background jobs** (there is no scheduler —
   an external scheduler can call an action with a token in a header), **no npm
   packages** and no `require`/`import`, no `crypto`, no timers, no WebSockets
-  or streaming, **no webhook signature verification** (no raw request body;
-  look the event up at the provider instead, or put a verifying receiver in
-  front), and no custom status codes, headers or HTML responses.
-- Build-time env vars or build secrets. `.env*` files never leave your machine,
-  and the `agentful push` build injects nothing; keep public values in an
-  ordinary source constant.
+  or streaming, and no custom status codes, headers or HTML responses. Webhook
+  signatures that are not an HMAC keyed with the stored secret as typed
+  (asymmetric signatures, Svix-style secrets) are not covered — look the event
+  up at the provider, or put a verifying receiver in front.
+- Build-time env vars or build secrets of your own. `.env*` files never leave
+  your machine. Every cloud build defines one fixed allowlist of public values
+  and nothing else: the project ID (`VITE_PROJECT_ID`, `PUBLIC_PROJECT_ID`) and,
+  while your own Supabase database is connected in the Backend tab, its URL and
+  publishable key (`VITE_`/`PUBLIC_`/`NEXT_PUBLIC_` + `SUPABASE_URL`,
+  `SUPABASE_ANON_KEY`). Reading one of those names while nothing defines it
+  fails the build instead of compiling to `undefined`; `agentful push` warns
+  about it before the upload. Keep public values of your own in an ordinary
+  source constant.
 
 Actions have **no staging**: they run from your project's source, so a push can
 change what the published app does immediately, while warm instances may serve