@lacspace/webhooks
The webhook toolkit for both directions — sign & deliver outgoing webhooks with retries, and verify incoming ones (timing-safe, replay-protected) with Stripe / GitHub / Shopify presets. Plus event ids & idempotency. One internal dependency (@lacspace/crypto), isomorphic.
npm i @lacspace/webhooksUsage
import { verify } from "@lacspace/webhooks";
// in your route — use the RAW request body, not the parsed JSON
const rawBody = await request.text();
const r = await verify(rawBody, request.headers.get("webhook-signature"), {
secret: process.env.WEBHOOK_SECRET!,
toleranceSec: 300, // reject anything older than 5 min (replay protection)
});
if (!r.valid) return new Response(`rejected: ${r.reason}`, { status: 400 });
// r.reason ∈ "no-signature" | "bad-format" | "bad-signature" | "timestamp-out-of-tolerance"Exports 11
MemoryIdempotencyStoredeliverisDuplicateisValidnewIdsignsignHeadersverifyverifyGitHubverifyShopifyverifyStripeKeywords
More in Backend Kit
Make any operation exactly-once with an idempotency key — replay stored results on retries, safe under concurrency, with optional request fingerprinting. Framework-agnostic, pluggable store, zero-dependency, isomorphic.
@lacspace/pdfGenerate real PDFs — invoices, receipts & documents — with zero dependencies and no headless browser. Accurate text layout, auto page-breaks, batteries-included invoice() & receipt() generators. Isomorphic (Node, edge, browser).
@lacspace/signed-urlHMAC-signed, expiring URLs & tokens over Web Crypto — secure download links, magic-login links, unsubscribe links and one-time-action tokens. Tamper-proof, timing-safe, zero-config. Isomorphic (Node, edge, browser).