Skip to content

chore: bump to v1.4.2#12

Merged
vvillait88 merged 1 commit intomainfrom
chore/bump-1.4.2
Apr 8, 2026
Merged

chore: bump to v1.4.2#12
vvillait88 merged 1 commit intomainfrom
chore/bump-1.4.2

Conversation

@vvillait88
Copy link
Copy Markdown
Contributor

Summary

  • Bump version 1.4.1 → 1.4.2
  • vitest 4.1.2 → 4.1.3

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@vvillait88 vvillait88 merged commit d1906da into main Apr 8, 2026
5 checks passed
@vvillait88 vvillait88 deleted the chore/bump-1.4.2 branch April 8, 2026 16:39
vvillait88 added a commit that referenced this pull request Apr 26, 2026
Closes audit item #12. Generic HMAC-SHA256 webhook signature verifier,
Stripe-pattern (`t=<unix>,v1=<hex>` header). Useful both when AgentScore
eventually ships outbound webhooks and as a generic helper for merchants
verifying any HMAC-signed webhook source (Stripe, GitHub, etc.).

Returns a structured result with `reason` set on failure
(no_signatures / no_timestamp / timestamp_too_old / timestamp_in_future /
signature_mismatch / malformed_header) so callers can differentiate
transient vs permanent failures.

Tolerance defaults to 300s (Stripe convention); set to 0 to disable
timestamp checking for raw HMAC use cases.

Also adds @types/node to devDependencies + tsconfig types: ["node"] —
needed for the Buffer + crypto imports the helper uses. Existing modules
were getting away without this because they didn't use Node-specific
types at the source level (they slipped through DTS generation).

10 new tests covering all paths + multi-signature header.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant