v0.1.1

Security scan remediation (2026-07-29). Patch release; no exported signature or type changed.

• begin now bounds the provider-supplied event type instead of storing it verbatim (F-03). It is truncated to 256 characters — never mid-surrogate-pair — and a non-string value is recorded as null, each logged as a warn. Bounding rather than rejecting is deliberate: a throw from begin would leave no receipt at all, so attempts could never increment and quarantine could never engage. The warn runs after the insert, so a host logger that throws cannot stop the receipt from existing.
• Dev-dependency advisories cleared (F-01). Root overrides raise brace-expansion, uuid, and @opentelemetry/core to patched floors in the Azurite dev tree, taking npm audit from 12 vulnerabilities (5 high, 7 moderate) to 0. No production dependency changed.
• Supply-chain detection added (F-02). Dependabot for npm and GitHub Actions, plus a production-scoped npm audit --omit=dev gate in CI.
• Two Informational findings were reviewed and disputed as non-findings; reasoning is recorded in docs/securityscan.md.

@pegma/webhooks v0.1.0

What's Changed

• Scaffold the @pegma/webhooks package by @FlyOverCoderKY in #1
• Extract the webhook receipt ledger by @FlyOverCoderKY in #2
• Document Phase 2 first-consumer migration by @FlyOverCoderKY in #3
• Pin Webhooks to storage-core 0.4.0 by @FlyOverCoderKY in #4
• Prepare @pegma/webhooks 0.1.0 release by @FlyOverCoderKY in #5

New Contributors

• @FlyOverCoderKY made their first contribution in #1

Full Changelog: https://github.com/pegma-dev/webhooks/commits/v0.1.0