{"_id":"@bpinternal/signature-verification","_rev":"6-550ddbad9b0352f362afff042c99e2f8","name":"@bpinternal/signature-verification","dist-tags":{"latest":"0.2.0"},"versions":{"0.1.0":{"name":"@bpinternal/signature-verification","version":"0.1.0","author":{"name":"Botpress Technologies, Inc."},"license":"0BSD","_id":"@bpinternal/signature-verification@0.1.0","maintainers":[{"name":"allardy","email":"yann.allard1@gmail.com"},{"name":"davidvitora","email":"david.vitora@gmail.com"},{"name":"michael.masson","email":"michael.masson@botpress.com"},{"name":"franklevasseur","email":"francois.levasseur@botpress.com"},{"name":"chsir17","email":"sirois.christophe@gmail.com"},{"name":"slvnperron","email":"slvn.perron@gmail.com"},{"name":"botpress-cloud-ops","email":"cloud-ops@botpress.com"}],"homepage":"https://github.com/botpress/packages#readme","bugs":{"url":"https://github.com/botpress/packages/issues"},"dist":{"shasum":"3c053aeea517cdf175c818d1ccd5c34da8b0737f","tarball":"https://registry.npmjs.org/@bpinternal/signature-verification/-/signature-verification-0.1.0.tgz","fileCount":3,"integrity":"sha512-5b0EbPD3Lb3h9e8pRj7kuwRZVPHYUqaBDBqJhrvA2pfTeoDMqPqMEa/DgjNqC0yrbTxdlrPaM7X5sC+hJINzvg==","signatures":[{"sig":"MEQCIEzrgJZmm2g3QHqm6SgSBxcnCtkmG9YoUZ/3Cpa4oOJkAiBKU+55Gu/Srf+5R5HSmiGfwTc3yIHJytxWwvo4YEZszA==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":5635},"main":"./dist/index.js","type":"module","_from":"file:bpinternal-signature-verification-0.1.0.tgz","types":"./dist/index.d.ts","source":"./src/index.ts","engines":{"node":">=19.0.0","pnpm":"10.28.2"},"exports":{".":{"import":"./dist/index.js","require":"./dist/index.cjs"}},"scripts":{"ci":"npm run check && npm run test","fix":"npm run fix:oxlint && npm run fix:format","test":"vitest run --bail 1","build":"tsup","check":"npm run check:oxlint && npm run check:type && npm run check:format","watch":"tsup --watch","check:knip":"knip","check:type":"tsc --noEmit","fix:format":"oxfmt --write .","fix:oxlint":"oxlint -c .oxlintrc.json --fix --fix-suggestions","test:watch":"vitest","check:format":"oxfmt --check .","check:oxlint":"oxlint -c .oxlintrc.json","check:coverage":"vitest run --coverage"},"_npmUser":{"name":"botpress-cloud-ops","email":"cloud-ops@botpress.com"},"_resolved":"/tmp/0e83565dfbb89090a3d3d1ccad870cdf/bpinternal-signature-verification-0.1.0.tgz","_integrity":"sha512-5b0EbPD3Lb3h9e8pRj7kuwRZVPHYUqaBDBqJhrvA2pfTeoDMqPqMEa/DgjNqC0yrbTxdlrPaM7X5sC+hJINzvg==","repository":{"url":"git+https://github.com/botpress/packages.git","type":"git"},"_npmVersion":"10.9.2","description":"Library to verify the signature of incoming webhook requests","directories":{},"_nodeVersion":"22.17.0","_hasShrinkwrap":false,"devDependencies":{"knip":"^5.82.1","tsup":"^8.5.1","oxfmt":"^0.28.0","oxlint":"^1.43.0","vitest":"^4.0.18","express":"^5.2.1","typescript":"^5.9.3","@types/node":"^22.17.0","@types/express":"^5.0.6","oxlint-tsgolint":"0.11.4","@vitest/coverage-v8":"^4.0.18"},"_npmOperationalInternal":{"tmp":"tmp/signature-verification_0.1.0_1770223519747_0.2454199174712135","host":"s3://npm-registry-packages-npm-production"}},"0.1.1":{"name":"@bpinternal/signature-verification","version":"0.1.1","author":{"name":"Botpress Technologies, Inc."},"license":"0BSD","_id":"@bpinternal/signature-verification@0.1.1","maintainers":[{"name":"allardy","email":"yann.allard1@gmail.com"},{"name":"davidvitora","email":"david.vitora@gmail.com"},{"name":"michael.masson","email":"michael.masson@botpress.com"},{"name":"franklevasseur","email":"francois.levasseur@botpress.com"},{"name":"chsir17","email":"sirois.christophe@gmail.com"},{"name":"slvnperron","email":"slvn.perron@gmail.com"},{"name":"botpress-cloud-ops","email":"cloud-ops@botpress.com"}],"homepage":"https://github.com/botpress/packages#readme","bugs":{"url":"https://github.com/botpress/packages/issues"},"dist":{"shasum":"b65e865cd53e194e0efd455ba1c8b65f2a74a5ea","tarball":"https://registry.npmjs.org/@bpinternal/signature-verification/-/signature-verification-0.1.1.tgz","fileCount":9,"integrity":"sha512-zMjSGAC/H5TqTivBFIxKvaM+og3LYJfWJr5uRJ54qkrjwHuS6GGM9SnLXia2KZT5KvXWCdH/ndrOV6vASNJPHg==","signatures":[{"sig":"MEQCIFQ89bIXuPm2Qy0A1/j0/XQtUWvcgOsBdlSwvBLZzkU7AiAGAhvIzlM1M9xCzR7yP/dBnKKOae8A8x2H3JrAvnunnA==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":93357},"main":"./dist/index.js","type":"module","_from":"file:bpinternal-signature-verification-0.1.1.tgz","types":"./dist/index.d.ts","source":"./src/index.ts","engines":{"node":">=19.0.0","pnpm":"10.28.2"},"exports":{".":{"import":"./dist/index.js","require":"./dist/index.cjs"}},"scripts":{"ci":"npm run check && npm run test","fix":"npm run fix:oxlint && npm run fix:format","test":"vitest run --bail 1","build":"tsup","check":"npm run check:oxlint && npm run check:type && npm run check:format","watch":"tsup --watch","check:knip":"knip","check:type":"tsc --noEmit","fix:format":"oxfmt --write .","fix:oxlint":"oxlint -c .oxlintrc.json --fix --fix-suggestions","test:watch":"vitest","check:format":"oxfmt --check .","check:oxlint":"oxlint -c .oxlintrc.json","check:coverage":"vitest run --coverage"},"_npmUser":{"name":"botpress-cloud-ops","email":"cloud-ops@botpress.com"},"_resolved":"/tmp/1fba58c1002378d0c5f9460189eafa65/bpinternal-signature-verification-0.1.1.tgz","_integrity":"sha512-zMjSGAC/H5TqTivBFIxKvaM+og3LYJfWJr5uRJ54qkrjwHuS6GGM9SnLXia2KZT5KvXWCdH/ndrOV6vASNJPHg==","repository":{"url":"git+https://github.com/botpress/packages.git","type":"git"},"_npmVersion":"10.9.2","description":"Library to verify the signature of incoming webhook requests","directories":{},"_nodeVersion":"22.17.0","_hasShrinkwrap":false,"devDependencies":{"knip":"^5.82.1","tsup":"^8.5.1","oxfmt":"^0.28.0","oxlint":"^1.43.0","vitest":"^4.0.18","express":"^5.2.1","typescript":"^5.9.3","@types/node":"^22.17.0","@types/express":"^5.0.6","oxlint-tsgolint":"0.11.4","@vitest/coverage-v8":"^4.0.18"},"_npmOperationalInternal":{"tmp":"tmp/signature-verification_0.1.1_1770235792317_0.44032596435811766","host":"s3://npm-registry-packages-npm-production"}},"0.2.0":{"name":"@bpinternal/signature-verification","version":"0.2.0","author":{"name":"Botpress Technologies, Inc."},"license":"0BSD","_id":"@bpinternal/signature-verification@0.2.0","maintainers":[{"name":"allardy","email":"yann.allard1@gmail.com"},{"name":"davidvitora","email":"david.vitora@gmail.com"},{"name":"michael.masson","email":"michael.masson@botpress.com"},{"name":"franklevasseur","email":"francois.levasseur@botpress.com"},{"name":"chsir17","email":"sirois.christophe@gmail.com"},{"name":"slvnperron","email":"slvn.perron@gmail.com"},{"name":"botpress-cloud-ops","email":"cloud-ops@botpress.com"}],"homepage":"https://github.com/botpress/packages#readme","bugs":{"url":"https://github.com/botpress/packages/issues"},"dist":{"shasum":"33221b48ca22e070d2819b996c72eb4984ac9840","tarball":"https://registry.npmjs.org/@bpinternal/signature-verification/-/signature-verification-0.2.0.tgz","fileCount":9,"integrity":"sha512-vv0djt1szcVunRpJ6AKlbdApyxQUDsx56kqYl+IBPbpiLkstYmmkGJLMTzrvRXAT68baZf8qlvRUCymDZ7w0YA==","signatures":[{"sig":"MEUCIGeKZN46XCyyFib40kydze3nWELIICLoo4CW6S8Vji3pAiEAx0Ycj79DfosDiO0BgL8CDQPaCEpgkna9J3OCLqN4WLo=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":54968},"main":"./dist/index.js","type":"module","_from":"file:bpinternal-signature-verification-0.2.0.tgz","types":"./dist/index.d.ts","source":"./src/index.ts","engines":{"node":">=19.0.0","pnpm":"10.28.2"},"exports":{".":{"import":"./dist/index.js","require":"./dist/index.cjs"}},"scripts":{"ci":"npm run check && npm run test","fix":"npm run fix:oxlint && npm run fix:format","test":"vitest run --bail 1","build":"tsup","check":"npm run check:oxlint && npm run check:type && npm run check:format","watch":"tsup --watch","check:knip":"knip","check:type":"tsc --noEmit","fix:format":"oxfmt --write .","fix:oxlint":"oxlint -c .oxlintrc.json --fix --fix-suggestions","test:watch":"vitest","check:format":"oxfmt --check .","check:oxlint":"oxlint -c .oxlintrc.json","check:coverage":"vitest run --coverage"},"_npmUser":{"name":"botpress-cloud-ops","email":"cloud-ops@botpress.com"},"_resolved":"/tmp/6e546ff45ac57f1b1db9c77fda1397c4/bpinternal-signature-verification-0.2.0.tgz","_integrity":"sha512-vv0djt1szcVunRpJ6AKlbdApyxQUDsx56kqYl+IBPbpiLkstYmmkGJLMTzrvRXAT68baZf8qlvRUCymDZ7w0YA==","repository":{"url":"git+https://github.com/botpress/packages.git","type":"git"},"_npmVersion":"10.9.2","description":"Library to verify the signature of incoming webhook requests","directories":{},"_nodeVersion":"22.17.0","_hasShrinkwrap":false,"devDependencies":{"knip":"^5.82.1","tsup":"^8.5.1","oxfmt":"^0.28.0","oxlint":"^1.43.0","vitest":"^4.0.18","express":"^5.2.1","typescript":"^5.9.3","@types/node":"^22.17.0","@types/express":"^5.0.6","oxlint-tsgolint":"0.11.4","@vitest/coverage-v8":"^4.0.18"},"_npmOperationalInternal":{"tmp":"tmp/signature-verification_0.2.0_1770305545541_0.31353233688090776","host":"s3://npm-registry-packages-npm-production"}}},"time":{"created":"2026-02-04T16:45:19.658Z","modified":"2026-09-02T19:11:34.227Z","0.1.0":"2026-02-04T16:45:19.898Z","0.1.1":"2026-02-04T20:09:52.452Z","0.2.0":"2026-02-05T15:32:25.715Z"},"bugs":{"url":"https://github.com/botpress/packages/issues"},"author":{"name":"Botpress Technologies, Inc."},"license":"0BSD","homepage":"https://github.com/botpress/packages#readme","repository":{"url":"git+https://github.com/botpress/packages.git","type":"git"},"description":"Library to verify the signature of incoming webhook requests","maintainers":[{"email":"yann.allard1@gmail.com","name":"allardy"},{"email":"michael.masson@botpress.com","name":"michael.masson"},{"email":"slvn.perron@gmail.com","name":"slvnperron"},{"email":"xavier.hamel.protic@gmail.com","name":"xavierhamel"},{"email":"cloud-ops@botpress.com","name":"botpress-cloud-ops"}],"readme":"# Botpress Webhook Authentication Library\n\nA TypeScript library for verifying Botpress webhook signatures. This should only be used for self-hosted integrations and bots, since Botpress Cloud handles signature verification automatically.\n\n## Disclaimer ⚠️\n\n> [!IMPORTANT]\n> This package is published under the `@bpinternal` organization and is primarily intended for internal use by the [Botpress](https://github.com/botpress/botpress) team. As such, it may have unstable APIs, breaking changes without notice, and limited documentation or support. That said, we've made it public because we love open source! Feel free to use or fork it, but we recommend pinning to specific versions.\n>\n> — The Botpress Engineering team\n\n## Features\n\n- **HMAC-SHA256 Signature Verification**: Validates signatures against shared secrets\n- **Timestamp Validation**: Rejects requests outside a ±5 minute time window\n- **Secret Rotation**: Supports multiple secrets for zero-downtime rotation\n- **Resource Management**: Automatic cleanup using `Disposable` interface\n\n## Installation\n\n```bash\nnpm install --save @bpinternal/signature-verification\n```\n\n## Quick Start\n\n```typescript\nimport { createSignatureVerifier } from '@bpinternal/signature-verification'\n\n// Create a verifier with your shared secret:\nusing verifier = createSignatureVerifier({\n  sharedSecrets: [process.env.WEBHOOK_SECRET],\n})\n\n// Verify a webhook request:\nconst isValid = await verifier.verify({\n  headers: req.headers,\n  rawBody: req.rawBody,\n  method: req.method,\n})\n\nif (!isValid) {\n  throw new Error('Invalid signature')\n}\n\n// Else, process the webhook...\n```\n\n## Usage\n\n### Secret Rotation (Zero-Downtime)\n\nSupport multiple secrets to enable gradual rotation:\n\n```typescript\nusing verifier = createSignatureVerifier({\n  sharedSecrets: [\n    process.env.OLD_SECRET, // Still accepting old signatures\n    process.env.NEW_SECRET, // Now also accepting new signatures\n  ],\n})\n```\n\nSecrets are tried in order until a match is found.\n\n### Express Middleware Example\n\n```typescript\nimport express from 'express'\nimport { createSignatureVerifier } from '@bpinternal/signature-verification'\n\nconst app = express()\n\n// IMPORTANT: Capture raw body before parsing\napp.use(\n  express.json({\n    verify: (req, res, buf) => {\n      req.rawBody = buf.toString('utf8')\n    },\n  })\n)\n\nusing requestVerifier = createSignatureVerifier({\n  sharedSecrets: [process.env.WEBHOOK_SECRET],\n})\n\n// Create a reusable middleware:\nconst verifySignature = async (req, res, next) => {\n  const isValid = await requestVerifier.verify({\n    headers: req.headers,\n    rawBody: req.rawBody,\n    method: req.method,\n  })\n\n  if (!isValid) {\n    return res.status(401).json({ error: 'Invalid signature' })\n  }\n\n  next()\n}\n\n// Use the middleware in your routes:\napp.post('/webhook', verifySignature, (req, res) => {\n  // Process webhook...\n  res.status(200).json({ message: 'Webhook received' })\n})\n```\n","readmeFilename":"README.md"}