# Changelog

> Source: https://cross-deck.com/docs/changelog/ · Crossdeck developer docs (generated from the published page).

Node
v1.15.0
minor
2026-07-28

**Outbound webhooks are live — receive and verify them with the Stripe-exact `webhooks.constructEvent()`.** Crossdeck now delivers signed, retried, at-least-once webhooks to endpoints you register (first event types: `trust.rule.added` / `trust.rule.removed`; more ride the same spine). This release ships the receiver side:

- **`webhooks.constructEvent(rawBody, signatureHeader, secret, options?)`** — the Stripe-shape API (`stripe.webhooks.constructEvent`). Verifies the signature and returns the typed `WebhookEvent` envelope (`id`, `type`, `api_version`, `created`, `livemode`, `data`, `reconcile`), or throws. Same constant-time HMAC, mandatory replay-tolerance window, and secret-rotation array as `verifyWebhookSignature()` — it just hands back the structured event instead of `unknown`.

- **Mounted on the client too:** `crossdeck.webhooks.constructEvent(...)` (pure functions, so it's the same object as the standalone `webhooks` export).

- **New exported types:** `WebhookEvent`, `WebhookEventType` (a union of the live types plus an open tail so a new server-side rider compiles without an SDK bump).

- **The nudge rule, documented:** the payload carries the changed key plus a `reconcile` pointer — verify, then `GET event.reconcile.url` for the authoritative state and enforce on that. An at-least-once, possibly-reordered delivery is harmless when you reconcile.

- `verifyWebhookSignature()` / `signWebhookPayload()` are unchanged and still exported. The `[ROADMAP]` disclaimer is gone — delivery ships.

npm install @cross-deck/node@latest

· npm · GitHub release