fix: replace svix with standardwebhooks to reduce install size (#969)

[dielduarte]

Problem

#969 reports that the installed package size grew dramatically. Measured on a clean install:

Version	Total node_modules
resend@6.1.2	136 KB
resend@6.12.3 (before this PR)	5.0 MB (~37×)

The overwhelming majority is svix (4.2 MB, 84% of the install), which is pulled in only for webhook signature verification in src/webhooks/webhooks.ts.

Why svix is so heavy (and why tree-shaking doesn't help)

• The Webhook class resend uses is a 28-line wrapper that just maps svix-* headers to webhook-* and delegates to standardwebhooks (~13 KB).
• The rest of svix is the full Svix platform API client — 216 OpenAPI-generated model files (dist/models alone is 2.7 MB) plus 23 API resource clients — none of which resend uses.
• svix is "type": "commonjs" with no module/exports/sideEffects, and its barrel index.js eagerly require()s the entire API client, so it cannot be tree-shaken. (And tree-shaking never affects on-disk install size anyway — npm install always downloads the whole tarball.)

Change

Depend on standardwebhooks directly instead of svix:

• package.json: svix@1.92.2 → standardwebhooks@1.0.0
• src/webhooks/webhooks.ts: import Webhook from standardwebhooks; pass webhook-id / webhook-timestamp / webhook-signature (the standard header names svix mapped to internally).

standardwebhooks is the same pure-JS HMAC-SHA256 implementation svix delegates to (keeps Cloudflare Workers / non-Node support) and produces identical signatures.

No public API change

Webhooks.verify(...) and VerifyWebhookOptions (headers.{ id, timestamp, signature }) are unchanged.

Result

Install size 5.0 MB → 788 KB (~84% smaller), verified via npm pack + clean install:

node_modules/postal-mime     352K
node_modules/resend          244K
node_modules/@stablelib       96K
node_modules/standardwebhooks 44K
node_modules/fast-sha256      44K
-------------------------------------
total                        788K

Tests

• Updated webhooks.spec.ts to mock standardwebhooks and assert the webhook-* header names.
• Added webhooks-verify.spec.ts: a real, non-mocked round-trip test that signs a payload with the genuine library and asserts verify() returns the parsed event (and rejects a bad signature). The prior tests fully mocked verification, so the real crypto path was untested.
• pnpm test ✅ 358 passed · pnpm run build ✅ · pnpm run lint ✅

Closes #969

---

Summary by cubic

Replace svix with standardwebhooks for webhook signature verification to shrink install size from ~5.0 MB to ~788 KB (~84%) with no behavior or API changes. Addresses DEV-848 and #969; verification now uses webhook-* headers internally, and tests are consolidated into webhooks.spec.ts using a real sign+verify round trip plus a bad‑signature case (no mocks).

^{Written for commit 014ee22. Summary will update on new commits. Review in cubic}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/resend@970

commit: 014ee22

[cubic-dev-ai]

cubic analysis

No issues found across 5 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

Linked issue analysis

Linked issue: DEV-848: Package size much bigger

Status	Acceptance criteria	Notes
✅	Replace svix dependency with standardwebhooks in package.json	package.json now depends on standardwebhooks (1.0.0) instead of svix (1.92.2).
✅	Remove svix from lockfile / dependency graph	pnpm-lock.yaml no longer includes svix entries and lists standardwebhooks instead, showing svix was removed from the lockfile.
✅	Import and use standardwebhooks in code and map to standard webhook header names	webhooks.ts imports Webhook from standardwebhooks and passes 'webhook-id', 'webhook-timestamp', 'webhook-signature' to verify instead of the svix header names.
✅	Maintain public API (no signature change to Webhooks.verify / VerifyWebhookOptions)	The verify method signature remains verify(payload: VerifyWebhookOptions): WebhookEventPayload; changes are internal to the verification implementation and header names mapping is internal.
✅	Add/adjust tests to cover new implementation and real signature verification	Existing webhooks tests were updated to mock standardwebhooks and header names; a new real round‑trip test was added to verify actual signature generation/verification using the real library.
✅	Reduce on-disk install size compared to previous release	PR includes measured install-size results showing a reduction from ~5.0 MB to ~788 KB, and the dependency changes (removing svix) explain the size drop.

<sub>Auto-approved: This change swaps the heavy svix dependency for its internal standardwebhooks library with identical behavior, reducing install size by over 80%, and the updated tests plus a new end-to-end verification confirm no functional regression.

Re-trigger cubic</sub>

[dielduarte]

Open in StackBlitz

npm i https://pkg.pr.new/resend@970

commit: 254b263

verified locally using this version, and it works as expected! no public API changes and no regressions. cc @gabrielmfern

[cubic-dev-ai]

0 issues found across 2 files (changes from recent commits).

<sub>Auto-approved: This PR replaces the heavy svix dependency (4.2 MB) with its own lightweight internal delegate standardwebhooks (44 KB), shrinking install size by ~84% while preserving the exact same public API and verification behavior, and the updated tests include a real cryptographic round-trip to ensure...

Re-trigger cubic</sub>

[lucasfcosta]

LGTM! Good catch using the same library Svix does :)