@lacspace/webhooks
The webhook toolkit for both directions — sign & deliver outgoing webhooks with retries/backoff, verify incoming ones (timing-safe, replay-protected) with Stripe / GitHub / Shopify presets, plus typed event envelopes, exactly-once idempotency and pure endpoint routing. One internal dependency (@lacspace/crypto), isomorphic.
npm i @lacspace/webhooksUsage
import { verify } from "@lacspace/webhooks";
// in your route — use the RAW request body, not the parsed JSON
const rawBody = await request.text();
const r = await verify(rawBody, request.headers.get("webhook-signature"), {
secret: process.env.WEBHOOK_SECRET!,
toleranceSec: 300, // reject anything older than 5 min (replay protection)
});
if (!r.valid) return new Response(`rejected: ${r.reason}`, { status: 400 });
// r.reason ∈ "no-signature" | "bad-format" | "bad-signature" | "timestamp-out-of-tolerance"Exports 11
MemoryIdempotencyStoredeliverisDuplicateisValidnewIdsignsignHeadersverifyverifyGitHubverifyShopifyverifyStripeKeywords
More in Backend Kit
Make any operation exactly-once with an idempotency key — fingerprint the request (reject key-reuse with a different body), replay the stored response on retries, lock in-flight duplicates, and sweep expired records. Framework-agnostic, pluggable store, zero-dependency, isomorphic.
@lacspace/pdfGenerate real PDFs — invoices, receipts & documents — with zero dependencies and no headless browser. Accurate text layout, auto page-breaks and batteries-included invoice() & receipt() generators, now with tables, JPEG/raw images, page sizes & landscape, Times/Courier fonts, page numbers, bookmarks and Info metadata. Isomorphic (Node, edge, browser).
@lacspace/signed-urlHMAC-signed, expiring URLs & tokens over Web Crypto — secure download links, magic-login links, unsubscribe and one-time-action tokens — now with key rotation, method/IP/path binding, single-use nonces, signed claims and clock tolerance. Tamper-proof, timing-safe. Isomorphic (Node, edge, browser).