> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://fastpix.com/docs/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://fastpix.com/docs/_mcp/server.

# FastPix Node SDK: response-validation and security fixes, plus the move to fastpix.com

> The FastPix Node SDK fixes a zod response-validation break, stops logging the webhook signing secret, and defaults to the fastpix.com hosts.

The FastPix Node SDK (`@fastpix/fastpix-node`) fixes a response-validation break on newer zod versions, removes accidental logging of the webhook signing secret, and defaults to the `fastpix.com` hosts. Upgrading is recommended for all installs.

What's new:

* **Fixed response validation on zod 4.4.0 and later**: fresh installs could pull zod `4.4.x`, which made valid HTTP 200 responses that omit optional fields (such as `summary`, `chapters`, `namedEntities`, or `moderation`) throw a `ResponseValidationError`. Optional fields are now treated as optional on every zod version, and the `zod` range is capped to a known-good version. Upgrade to stop these errors.

* **Security: webhook signing secret no longer logged**: removed debug statements that printed the signing secret and the raw payload.

* **Default hosts moved to fastpix.com**: the default server URL is now `https://api.fastpix.com/v1/`. If you rely on the defaults, just upgrade and rebuild. If you pass an explicit `.io` `serverURL` override or reference `.io` playback, image, or dashboard URLs directly, update them to `.com` before the `.io` hosts are decommissioned.

* **SDK and API parity fixes**: several responses now match the API exactly, including `frameRate` on media-list tracks, preserved wire-format casing (`QoeScore`, `fpSdk` / `fpSdkVersion`), an added `errorId` on view entries, a nullable playback `data.resolution`, and the optional `data.message` on delete-signing-key responses.

* **Dependency cleanup**: the published package now declares only `zod` as a runtime dependency (removed a bogus `crypto` stub and an accidental self-dependency, and moved `dotenv` to `devDependencies`). Version bumped to `2.0.8`.