@amirabaris/webhook-kit 0.1.1 → 0.1.2

package/dist/index.js

@@ -63,18 +63,78 @@ var ReplayAttackError = class extends WebhookKitError {
 		this.eventId = eventId;
 	}
 };
-// src/store.ts
+// src/utils/headers.ts
+/**
+* Extracts a header value from a plain headers record case-insensitively.
+*
+* @param record - Plain headers record object.
+* @param lowerTarget - Pre-lowercased target header name.
+* @returns Header value string or undefined.
+*/
+function extractFromRecord(record, lowerTarget) {
+	for (const key of Object.keys(record)) if (key.toLowerCase() === lowerTarget) {
+		const value = record[key];
+		return Array.isArray(value) ? value[0] : value;
+	}
+}
+/**
+* Case-insensitively extracts a header value from a `Headers` instance or plain record.
+*
+* @param headers - Web standard `Headers` instance or record.
+* @param targetName - Lowercase target header name.
+* @returns Header value string or undefined.
+*/
+function extractHeaderValue$1(headers, targetName) {
+	if (!headers || typeof headers !== "object") return;
+	if (typeof Headers !== "undefined" && headers instanceof Headers) return headers.get(targetName) ?? void 0;
+	return extractFromRecord(headers, targetName.toLowerCase());
+}
+// src/store/store.ts
 const DEFAULT_REPLAY_STORE_MAX_SIZE = 1e4;
 const DEFAULT_REPLAY_STORE_TTL_SECONDS = 300;
 const GENERIC_EVENT_ID_HEADERS = [
 	"x-webhook-id",
 	"webhook-id",
+	"svix-id",
 	"x-github-delivery",
 	"x-shopify-webhook-id",
 	"x-event-id",
 	"x-idempotency-key"
 ];
 /**
+* Tracks in-flight replay check promises per store instance to prevent TOCTOU race conditions
+* during concurrent duplicate deliveries across stores that only implement `has` and `set`.
+*/
+const inFlightPerStore = /* @__PURE__ */ new WeakMap();
+/**
+* Sanitizes and bounds the maximum capacity for `InMemoryReplayStore`.
+*
+* @param size - Candidate capacity option.
+* @returns Positive bounded integer capacity.
+*/
+function sanitizeCapacity(size) {
+	return typeof size === "number" && Number.isFinite(size) && size > 0 ? Math.floor(size) : DEFAULT_REPLAY_STORE_MAX_SIZE;
+}
+/**
+* Sanitizes and bounds the default TTL for `InMemoryReplayStore`.
+*
+* @param ttl - Candidate default TTL option.
+* @returns Positive finite TTL in seconds.
+*/
+function sanitizeTtl(ttl) {
+	return typeof ttl === "number" && Number.isFinite(ttl) && ttl > 0 ? ttl : 300;
+}
+/**
+* Resolves the effective TTL for a store insert from explicit TTL or default fallback.
+*
+* @param ttl - Explicit TTL in seconds.
+* @param defaultTtl - Default TTL fallback.
+* @returns Resolved finite TTL in seconds.
+*/
+function resolveInsertTtl(ttl, defaultTtl) {
+	return typeof ttl === "number" && Number.isFinite(ttl) ? ttl : defaultTtl;
+}
+/**
 * Default in-memory TTL replay store backed by a JavaScript `Map`.
 * Automatically evicts expired entries on lookup and enforces an upper capacity bound
 * with LRU (Least Recently Used) eviction.
@@ -84,9 +144,10 @@ var InMemoryReplayStore = class {
 	defaultTtlSeconds;
 	now;
 	entries = /* @__PURE__ */ new Map();
+	lastPruneMs = 0;
 	constructor(options = {}) {
-		this.maxSize = options.maxSize ?? DEFAULT_REPLAY_STORE_MAX_SIZE;
-		this.defaultTtlSeconds = options.defaultTtlSeconds ?? DEFAULT_REPLAY_STORE_TTL_SECONDS;
+		this.maxSize = sanitizeCapacity(options.maxSize);
+		this.defaultTtlSeconds = sanitizeTtl(options.defaultTtlSeconds);
 		this.now = options.now ?? Date.now;
 	}
 	/**
@@ -96,6 +157,7 @@ var InMemoryReplayStore = class {
 	* @returns `true` if `eventId` is present and unexpired, `false` otherwise.
 	*/
 	has(eventId) {
+		if (typeof eventId !== "string" || eventId.length === 0) return false;
 		const expiresAt = this.entries.get(eventId);
 		if (expiresAt === void 0) return false;
 		if (this.now() >= expiresAt) {
@@ -111,22 +173,35 @@ var InMemoryReplayStore = class {
 	* @param ttlSeconds - Time-to-live in seconds before expiration.
 	*/
 	set(eventId, ttlSeconds = this.defaultTtlSeconds) {
-		const effectiveTtl = Number.isFinite(ttlSeconds) ? ttlSeconds : this.defaultTtlSeconds;
+		if (typeof eventId !== "string" || eventId.length === 0) return;
+		const effectiveTtl = resolveInsertTtl(ttlSeconds, this.defaultTtlSeconds);
 		if (effectiveTtl <= 0) {
 			this.entries.delete(eventId);
 			return;
 		}
-		if (this.entries.has(eventId)) this.entries.delete(eventId);
-		else if (this.entries.size >= this.maxSize) this.evictExpiredOrOldest();
+		this.prepareInsertSlot(eventId);
 		this.entries.set(eventId, this.now() + effectiveTtl * 1e3);
 	}
 	/**
+	* Atomically records `eventId` with TTL if it does not already exist in the store (set-if-not-exists).
+	*
+	* @param eventId - Unique webhook event or delivery identifier.
+	* @param ttlSeconds - Time-to-live in seconds before expiration.
+	* @returns `true` if newly recorded, `false` if already present in the store.
+	*/
+	setNx(eventId, ttlSeconds = this.defaultTtlSeconds) {
+		if (this.has(eventId)) return false;
+		this.set(eventId, ttlSeconds);
+		return true;
+	}
+	/**
 	* Removes a specific `eventId` from the store.
 	*
 	* @param eventId - Unique webhook event or delivery identifier.
 	* @returns `true` if the entry existed and was removed.
 	*/
 	delete(eventId) {
+		if (typeof eventId !== "string" || eventId.length === 0) return false;
 		return this.entries.delete(eventId);
 	}
 	/**
@@ -161,8 +236,36 @@ var InMemoryReplayStore = class {
 	get capacity() {
 		return this.maxSize;
 	}
+	/**
+	* Prepares a map slot for insertion by evicting an existing key or pruning capacity.
+	*
+	* @param eventId - Candidate event ID key.
+	*/
+	prepareInsertSlot(eventId) {
+		if (this.entries.has(eventId)) {
+			this.entries.delete(eventId);
+			return;
+		}
+		if (this.entries.size >= this.maxSize) this.evictExpiredOrOldest();
+	}
+	/**
+	* Fast-path check from the head of the insertion-ordered Map to purge expired entries.
+	*
+	* @param currentMs - Current time in milliseconds.
+	*/
+	evictHeadExpired(currentMs) {
+		for (const [key, expiresAt] of this.entries) if (currentMs >= expiresAt) {
+			this.entries.delete(key);
+			if (this.entries.size < this.maxSize) return;
+		} else break;
+	}
 	evictExpiredOrOldest() {
-		this.prune();
+		const currentMs = this.now();
+		this.evictHeadExpired(currentMs);
+		if (this.entries.size >= this.maxSize && (currentMs - this.lastPruneMs >= 1e3 || currentMs < this.lastPruneMs)) {
+			this.lastPruneMs = currentMs;
+			this.prune();
+		}
 		if (this.entries.size < this.maxSize) return;
 		const oldestKey = this.entries.keys().next().value;
 		if (oldestKey !== void 0) this.entries.delete(oldestKey);
@@ -178,22 +281,6 @@ function createInMemoryReplayStore(options) {
 	return new InMemoryReplayStore(options);
 }
 /**
-* Case-insensitively extracts a single header value from a `Headers` instance or plain record.
-*
-* @param headers - Web standard `Headers` instance or record.
-* @param targetName - Lowercase target header name.
-* @returns Header value string or undefined.
-*/
-function getHeaderCaseInsensitive(headers, targetName) {
-	if (typeof Headers !== "undefined" && headers instanceof Headers) return headers.get(targetName) ?? void 0;
-	const record = headers;
-	const lowerTarget = targetName.toLowerCase();
-	for (const key of Object.keys(record)) if (key.toLowerCase() === lowerTarget) {
-		const value = record[key];
-		return Array.isArray(value) ? value[0] : value;
-	}
-}
-/**
 * Searches candidate header names in a `Headers` or record object for a non-empty value.
 *
 * @param headers - Headers source.
@@ -203,11 +290,46 @@ function getHeaderCaseInsensitive(headers, targetName) {
 function findHeaderValue(headers, candidateNames) {
 	if (!headers) return;
 	for (const name of candidateNames) {
-		const trimmed = getHeaderCaseInsensitive(headers, name)?.trim();
+		const trimmed = extractHeaderValue$1(headers, name)?.trim();
 		if (trimmed) return trimmed;
 	}
 }
 /**
+* Determines whether a candidate value is a non-null, non-array object record.
+*
+* @param value - Candidate value.
+* @returns `true` if value is a plain object record.
+*/
+function isPlainRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Parses a raw JSON string into a record object, ignoring non-object outputs.
+*
+* @param rawBody - Raw body text.
+* @returns Parsed object record or null.
+*/
+function parseJsonRecord(rawBody) {
+	if (typeof rawBody !== "string" || rawBody.length === 0) return null;
+	try {
+		const parsed = JSON.parse(rawBody);
+		return isPlainRecord(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Resolves a record object from either an already-parsed payload or a raw JSON string.
+*
+* @param payload - Parsed payload value.
+* @param rawBody - Raw body string.
+* @returns Object record or null.
+*/
+function resolvePayloadObject(payload, rawBody) {
+	if (isPlainRecord(payload)) return payload;
+	return parseJsonRecord(rawBody);
+}
+/**
 * Extracts a string or finite number `id` property from a parsed payload or raw JSON body.
 *
 * @param payload - Already parsed payload object if available.
@@ -222,23 +344,6 @@ function extractIdFromPayload(payload, rawBody) {
 	if (typeof idValue === "number" && Number.isFinite(idValue)) return String(idValue);
 }
 /**
-* Resolves a record object from either an already-parsed payload or a raw JSON string.
-*
-* @param payload - Parsed payload value.
-* @param rawBody - Raw body string.
-* @returns Object record or null.
-*/
-function resolvePayloadObject(payload, rawBody) {
-	if (typeof payload === "object" && payload !== null) return payload;
-	if (!rawBody) return null;
-	try {
-		const parsed = JSON.parse(rawBody);
-		return typeof parsed === "object" && parsed !== null ? parsed : null;
-	} catch {
-		return null;
-	}
-}
-/**
 * Extracts a matching header value from a Web Standard `Request` body if provided.
 *
 * @param body - Candidate raw body input.
@@ -249,6 +354,19 @@ function findHeaderInRequest(body, headerCandidates) {
 	if (typeof Request !== "undefined" && body instanceof Request) return findHeaderValue(body.headers, headerCandidates);
 }
 /**
+* Sanitizes an explicitly provided `eventId` option into a non-empty string.
+*
+* @param eventId - Candidate event ID.
+* @returns Trimmed event ID or undefined.
+*/
+function resolveExplicitEventId(eventId) {
+	if (typeof eventId === "string") {
+		const trimmed = eventId.trim();
+		return trimmed.length > 0 ? trimmed : void 0;
+	}
+	if (typeof eventId === "number" && Number.isFinite(eventId)) return String(eventId);
+}
+/**
 * Resolves the unique webhook event ID from explicit options, delivery headers, or payload `id`.
 *
 * @param options - Source options containing explicit `eventId`, `headers`, `body`, `payload`, and `rawBody`.
@@ -256,7 +374,7 @@ function findHeaderInRequest(body, headerCandidates) {
 * @returns Resolved non-empty event ID string or `undefined`.
 */
 function resolveWebhookEventId(options, headerCandidates = GENERIC_EVENT_ID_HEADERS) {
-	const explicitId = options.eventId?.trim();
+	const explicitId = resolveExplicitEventId(options.eventId);
 	if (explicitId) return explicitId;
 	const fromHeaders = findHeaderValue(options.headers, headerCandidates) ?? findHeaderInRequest(options.body, headerCandidates);
 	if (fromHeaders) return fromHeaders;
@@ -270,26 +388,78 @@ function resolveWebhookEventId(options, headerCandidates = GENERIC_EVENT_ID_HEAD
 * @returns Positive TTL in seconds (defaults to 300s).
 */
 function resolveEffectiveTtl(storeTtlSeconds, toleranceSeconds) {
-	if (storeTtlSeconds !== void 0 && storeTtlSeconds > 0) return storeTtlSeconds;
-	if (toleranceSeconds !== void 0 && toleranceSeconds > 0) return toleranceSeconds;
-	return DEFAULT_REPLAY_STORE_TTL_SECONDS;
+	if (typeof storeTtlSeconds === "number" && Number.isFinite(storeTtlSeconds) && storeTtlSeconds > 0) return storeTtlSeconds;
+	if (typeof toleranceSeconds === "number" && Number.isFinite(toleranceSeconds) && toleranceSeconds > 0) return toleranceSeconds;
+	return 300;
+}
+/**
+* Checks and records an event ID using a store's basic `has` and `set` primitives.
+*
+* @param store - Webhook replay store.
+* @param eventId - Resolved event identifier.
+* @param ttlSeconds - Time-to-live in seconds.
+* @returns `ReplayAttackError` if already seen, or `null` on success.
+*/
+async function executeStoreCheckAndRecord(store, eventId, ttlSeconds) {
+	if (await store.has(eventId)) return new ReplayAttackError(eventId);
+	await store.set(eventId, ttlSeconds);
+	return null;
+}
+/**
+* Synchronizes concurrent in-flight checks for the same `eventId` across stores lacking atomic operations.
+*
+* @param store - Webhook replay store.
+* @param eventId - Resolved event identifier.
+* @param ttlSeconds - Time-to-live in seconds.
+* @returns `ReplayAttackError` if duplicate or already tracked, or `null` on success.
+*/
+async function handleInFlightReplayCheck(store, eventId, ttlSeconds) {
+	let storeInFlight = inFlightPerStore.get(store);
+	if (!storeInFlight) {
+		storeInFlight = /* @__PURE__ */ new Map();
+		inFlightPerStore.set(store, storeInFlight);
+	}
+	const existing = storeInFlight.get(eventId);
+	if (existing) {
+		const result = await existing;
+		return result === null ? new ReplayAttackError(eventId) : result;
+	}
+	const checkPromise = executeStoreCheckAndRecord(store, eventId, ttlSeconds);
+	storeInFlight.set(eventId, checkPromise);
+	try {
+		return await checkPromise;
+	} finally {
+		storeInFlight.delete(eventId);
+	}
 }
 /**
 * Verifies that `eventId` has not already been seen in `store`, and records it with a TTL if unseen.
+* Automatically leverages atomic `setNx` when supported, or serializes in-flight checks to prevent
+* TOCTOU race conditions under high concurrency.
 *
 * @param options - Store instance, resolved `eventId`, and TTL configuration.
 * @returns `ReplayAttackError` if `eventId` is already present in `store`, or `null` if unseen / no store.
 */
 async function checkAndRecordReplay(options) {
-	const { store, eventId } = options;
-	if (!store || !eventId) return null;
-	if (await store.has(eventId)) return new ReplayAttackError(eventId);
+	const { store } = options;
+	if (!store) return null;
+	const resolvedId = resolveExplicitEventId(options.eventId);
+	if (!resolvedId) return null;
 	const ttlSeconds = resolveEffectiveTtl(options.storeTtlSeconds, options.toleranceSeconds);
-	await store.set(eventId, ttlSeconds);
-	return null;
+	if (typeof store.setNx === "function") return await store.setNx(resolvedId, ttlSeconds) ? null : new ReplayAttackError(resolvedId);
+	return handleInFlightReplayCheck(store, resolvedId, ttlSeconds);
 }
 // src/crypto/subtle.ts
 /**
+* Sanitizes and bounds the maximum capacity for `CryptoKeyLruCache`.
+*
+* @param size - Candidate capacity option.
+* @returns Positive bounded integer capacity.
+*/
+function sanitizeCacheCapacity(size) {
+	return typeof size === "number" && Number.isFinite(size) && size > 0 ? Math.floor(size) : 256;
+}
+/**
 * Lightweight LRU (Least Recently Used) cache backed by a JavaScript `Map`.
 * Reuses compiled WebCrypto keys across concurrent requests and evicts the
 * oldest entries when capacity is reached.
@@ -298,7 +468,7 @@ var CryptoKeyLruCache = class {
 	maxSize;
 	map = /* @__PURE__ */ new Map();
 	constructor(maxSize = 256) {
-		this.maxSize = maxSize;
+		this.maxSize = sanitizeCacheCapacity(maxSize);
 	}
 	get(key) {
 		const item = this.map.get(key);
@@ -385,7 +555,7 @@ function getOrCreateCryptoKey(subtle, normalizedHash, secretBytes, cache = defau
 	if (cachedPromise) return cachedPromise;
 	const keyPromise = importHmacKey(subtle, normalizedHash, secretBytes);
 	keyPromise.catch(() => {
-		cache.delete(cacheKey);
+		if (cache.get(cacheKey) === keyPromise) cache.delete(cacheKey);
 	});
 	cache.set(cacheKey, keyPromise);
 	return keyPromise;
@@ -514,6 +684,7 @@ function bytesToHex(bytes) {
 */
 function hexToBytes(hex) {
 	const cleanHex = hex.startsWith("0x") ? hex.slice(2) : hex;
+	if (!/^[0-9a-fA-F]*$/.test(cleanHex)) throw new TypeError("Invalid hexadecimal string: contains non-hexadecimal characters");
 	const normalizedHex = cleanHex.length % 2 === 1 ? `0${cleanHex}` : cleanHex;
 	const bytes = new Uint8Array(normalizedHex.length / 2);
 	for (let i = 0; i < normalizedHex.length; i += 2) bytes[i / 2] = parseInt(normalizedHex.slice(i, i + 2), 16);
@@ -547,6 +718,75 @@ function base64ToBytes(base64) {
 	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
 	return bytes;
 }
+// src/providers/common/assertions.ts
+/**
+* Asserts that a header value is a non-empty string.
+*
+* @param header - Candidate header value.
+* @param errorMessage - Error message to throw if header is invalid or missing.
+*/
+function assertNonEmptyHeader(header, errorMessage) {
+	if (typeof header !== "string" || !header.trim()) throw new InvalidSignatureHeaderError(errorMessage);
+}
+// src/providers/github/signature.ts
+const GITHUB_SIGNATURE_PREFIX = "sha256=";
+const GITHUB_SIGNATURE_HEX_REGEX = /^[0-9a-fA-F]{64}$/;
+const GITHUB_EVENT_ID_HEADERS = [
+	"x-github-delivery",
+	"x-webhook-id",
+	"webhook-id"
+];
+/**
+* Parses an `X-Hub-Signature-256` header, validating and extracting the hex signature.
+*
+* @param header - Raw `X-Hub-Signature-256` header string (e.g. `sha256=d57c68d1...`).
+* @returns Hexadecimal signature string after the `sha256=` prefix.
+* @throws {InvalidSignatureHeaderError} If header is missing, empty, or lacks a valid sha256= prefix.
+*/
+function parseGithubSignature(header) {
+	assertNonEmptyHeader(header, "Missing or empty X-Hub-Signature-256 header");
+	const trimmed = header.trim();
+	if (!trimmed.toLowerCase().startsWith("sha256=")) throw new InvalidSignatureHeaderError("Invalid X-Hub-Signature-256 header format: expected 'sha256=' prefix");
+	const signature = trimmed.slice(7).trim();
+	if (!signature || !GITHUB_SIGNATURE_HEX_REGEX.test(signature)) throw new InvalidSignatureHeaderError("Invalid X-Hub-Signature-256 header: missing or malformed 64-character hex signature after prefix");
+	return signature;
+}
+/**
+* Resolves the raw signature header string from options, headers record, or request.
+*
+* @param options - GitHub verification options.
+* @returns GitHub signature header string or undefined if not found.
+*/
+function resolveGithubSignatureHeader(options) {
+	if (options.signature) return options.signature;
+	if (options.headers) return extractHeaderValue$1(options.headers, "x-hub-signature-256");
+	if (typeof Request !== "undefined" && options.body instanceof Request) return options.body.headers.get("x-hub-signature-256") ?? void 0;
+}
+/**
+* Validates preconditions for GitHub webhook verification.
+*
+* @param options - GitHub verification options.
+* @param rawHeader - Resolved header string.
+* @returns Error if preconditions fail, null otherwise.
+*/
+function validateGithubPreconditions(options, rawHeader) {
+	if (!options.secret) return new SignatureVerificationError("Missing GitHub webhook signing secret");
+	if (!rawHeader) return new InvalidSignatureHeaderError("Missing X-Hub-Signature-256 header");
+	return null;
+}
+/**
+* Safely parses the raw signature header without uncaught exceptions.
+*
+* @param rawHeader - Raw header string.
+* @returns Extracted signature string or error object.
+*/
+function safeParseGithubHeader(rawHeader) {
+	try {
+		return { signature: parseGithubSignature(rawHeader) };
+	} catch (err) {
+		return { error: err instanceof WebhookKitError ? err : new InvalidSignatureHeaderError(String(err)) };
+	}
+}
 // src/utils/extract-body.ts
 /**
 * Checks whether an unknown value is a binary BufferSource (ArrayBuffer or ArrayBufferView).
@@ -642,101 +882,23 @@ async function extractRawBody(body) {
 	if (isReadableStream(body)) return readReadableStream(body);
 	throw new PayloadExtractionError("Unsupported body type. Expected string, Uint8Array, ArrayBuffer, ReadableStream, or Request.");
 }
-// src/providers/github.ts
-const GITHUB_SIGNATURE_PREFIX = "sha256=";
-const GITHUB_EVENT_ID_HEADERS = [
-	"x-github-delivery",
-	"x-webhook-id",
-	"webhook-id"
-];
-/**
-* Asserts that a header value is a non-empty string.
-*
-* @param header - Candidate header value.
-*/
-function assertNonEmptyHeader$2(header) {
-	if (typeof header !== "string" || !header.trim()) throw new InvalidSignatureHeaderError("Missing or empty X-Hub-Signature-256 header");
-}
-/**
-* Parses an `X-Hub-Signature-256` header, validating and extracting the hex signature.
-*
-* @param header - Raw `X-Hub-Signature-256` header string (e.g. `sha256=d57c68d1...`).
-* @returns Hexadecimal signature string after the `sha256=` prefix.
-* @throws {InvalidSignatureHeaderError} If header is missing, empty, or lacks a valid sha256= prefix.
-*/
-function parseGithubSignature(header) {
-	assertNonEmptyHeader$2(header);
-	const trimmed = header.trim();
-	if (!trimmed.toLowerCase().startsWith(GITHUB_SIGNATURE_PREFIX)) throw new InvalidSignatureHeaderError("Invalid X-Hub-Signature-256 header format: expected 'sha256=' prefix");
-	const signature = trimmed.slice(7).trim();
-	if (!signature) throw new InvalidSignatureHeaderError("Invalid X-Hub-Signature-256 header: missing signature hash after prefix");
-	return signature;
-}
-/**
-* Case-insensitively extracts a header value from a `Headers` instance or plain record.
-*
-* @param headers - Web standard `Headers` instance or record.
-* @param targetName - Lowercase target header name.
-* @returns Header value string or undefined.
-*/
-function extractHeaderValue$3(headers, targetName) {
-	if (typeof Headers !== "undefined" && headers instanceof Headers) return headers.get(targetName) ?? void 0;
-	const record = headers;
-	const lowerTarget = targetName.toLowerCase();
-	for (const key of Object.keys(record)) if (key.toLowerCase() === lowerTarget) {
-		const value = record[key];
-		return Array.isArray(value) ? value[0] : value;
-	}
-}
-/**
-* Resolves the raw signature header string from options, headers record, or request.
-*
-* @param options - GitHub verification options.
-* @returns GitHub signature header string or undefined if not found.
-*/
-function resolveSignatureHeader$2(options) {
-	if (options.signature) return options.signature;
-	if (options.headers) return extractHeaderValue$3(options.headers, "x-hub-signature-256");
-	if (typeof Request !== "undefined" && options.body instanceof Request) return options.body.headers.get("x-hub-signature-256") ?? void 0;
-}
-/**
-* Validates preconditions for GitHub webhook verification.
-*
-* @param options - GitHub verification options.
-* @param rawHeader - Resolved header string.
-* @returns Error if preconditions fail, null otherwise.
-*/
-function validatePreconditions$2(options, rawHeader) {
-	if (!options.secret) return new SignatureVerificationError("Missing GitHub webhook signing secret");
-	if (!rawHeader) return new InvalidSignatureHeaderError("Missing X-Hub-Signature-256 header");
-	return null;
-}
-/**
-* Safely parses the raw signature header without uncaught exceptions.
-*
-* @param rawHeader - Raw header string.
-* @returns Extracted signature string or error object.
-*/
-function safeParseHeader$2(rawHeader) {
-	try {
-		return { signature: parseGithubSignature(rawHeader) };
-	} catch (err) {
-		return { error: err instanceof WebhookKitError ? err : new InvalidSignatureHeaderError(String(err)) };
-	}
-}
+// src/providers/common/helpers.ts
 /**
 * Constructs a failed WebhookVerificationResult or throws if throwOnError is set.
 *
 * @param rawBody - Raw body string.
 * @param error - WebhookKitError instance.
 * @param throwOnError - Optional flag to throw immediately.
+* @param timestamp - Optional parsed timestamp.
+* @param eventId - Optional webhook event ID.
 * @returns Failed verification result.
 */
-function failVerification$3(rawBody, error, throwOnError, eventId) {
+function failVerification(rawBody, error, throwOnError, timestamp, eventId) {
 	if (throwOnError) throw error;
 	return {
 		valid: false,
 		rawBody,
+		timestamp,
 		eventId,
 		error
 	};
@@ -747,13 +909,14 @@ function failVerification$3(rawBody, error, throwOnError, eventId) {
 * @param rawBody - Raw body payload string.
 * @returns Parsed payload or undefined.
 */
-function tryParseJson$3(rawBody) {
+function tryParseJson(rawBody) {
 	try {
 		return JSON.parse(rawBody);
 	} catch {
 		return;
 	}
 }
+// src/providers/github/verify.ts
 /**
 * Verifies a GitHub webhook payload signature against `X-Hub-Signature-256`.
 *
@@ -764,13 +927,13 @@ function tryParseJson$3(rawBody) {
 */
 async function verifyGithubWebhook(options) {
 	const rawBody = await extractRawBody(options.body);
-	const rawHeader = resolveSignatureHeader$2(options);
-	const preconditionError = validatePreconditions$2(options, rawHeader);
-	if (preconditionError) return failVerification$3(rawBody, preconditionError, options.throwOnError);
-	const parsed = safeParseHeader$2(rawHeader);
-	if ("error" in parsed) return failVerification$3(rawBody, parsed.error, options.throwOnError);
-	if (!timingSafeEqual((await computeSubtleHmac("SHA-256", options.secret, rawBody, "hex")).toLowerCase(), parsed.signature.toLowerCase())) return failVerification$3(rawBody, new SignatureVerificationError("GitHub signature verification failed: signature does not match expected HMAC"), options.throwOnError);
-	const payload = options.parseJson !== false ? tryParseJson$3(rawBody) : void 0;
+	const rawHeader = resolveGithubSignatureHeader(options);
+	const preconditionError = validateGithubPreconditions(options, rawHeader);
+	if (preconditionError) return failVerification(rawBody, preconditionError, options.throwOnError);
+	const parsed = safeParseGithubHeader(rawHeader);
+	if ("error" in parsed) return failVerification(rawBody, parsed.error, options.throwOnError);
+	if (!timingSafeEqual((await computeSubtleHmac("SHA-256", options.secret, rawBody, "hex")).toLowerCase(), parsed.signature.toLowerCase())) return failVerification(rawBody, new SignatureVerificationError("GitHub signature verification failed: signature does not match expected HMAC"), options.throwOnError);
+	const payload = options.parseJson !== false ? tryParseJson(rawBody) : void 0;
 	const eventId = resolveWebhookEventId({
 		eventId: options.eventId,
 		headers: options.headers,
@@ -784,7 +947,7 @@ async function verifyGithubWebhook(options) {
 		storeTtlSeconds: options.storeTtlSeconds,
 		toleranceSeconds: options.toleranceSeconds
 	});
-	if (replayError) return failVerification$3(rawBody, replayError, options.throwOnError, eventId);
+	if (replayError) return failVerification(rawBody, replayError, options.throwOnError, void 0, eventId);
 	return {
 		valid: true,
 		rawBody,
@@ -813,7 +976,7 @@ const githubPlugin = {
 	name: "github",
 	verify: verifyGithubWebhook
 };
-// src/providers/shopify.ts
+// src/providers/shopify/signature.ts
 const BASE64_REGEX = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
 const SHOPIFY_EVENT_ID_HEADERS = [
 	"x-shopify-webhook-id",
@@ -821,14 +984,6 @@ const SHOPIFY_EVENT_ID_HEADERS = [
 	"webhook-id"
 ];
 /**
-* Asserts that a header value is a non-empty string.
-*
-* @param header - Candidate header value.
-*/
-function assertNonEmptyHeader$1(header) {
-	if (typeof header !== "string" || !header.trim()) throw new InvalidSignatureHeaderError("Missing or empty X-Shopify-Hmac-Sha256 header");
-}
-/**
 * Parses an `X-Shopify-Hmac-Sha256` header, validating and normalizing the Base64 signature.
 *
 * @param header - Raw `X-Shopify-Hmac-Sha256` Base64 header string.
@@ -836,36 +991,20 @@ function assertNonEmptyHeader$1(header) {
 * @throws {InvalidSignatureHeaderError} If header is missing, empty, or not valid Base64.
 */
 function parseShopifySignature(header) {
-	assertNonEmptyHeader$1(header);
+	assertNonEmptyHeader(header, "Missing or empty X-Shopify-Hmac-Sha256 header");
 	const trimmed = header.trim();
-	if (!BASE64_REGEX.test(trimmed)) throw new InvalidSignatureHeaderError("Invalid X-Shopify-Hmac-Sha256 header format: expected Base64-encoded string");
+	if (trimmed.length !== 44 || !BASE64_REGEX.test(trimmed)) throw new InvalidSignatureHeaderError("Invalid X-Shopify-Hmac-Sha256 header format: expected 44-character Base64-encoded SHA-256 digest");
 	return trimmed;
 }
 /**
-* Case-insensitively extracts a header value from a `Headers` instance or plain record.
-*
-* @param headers - Web standard `Headers` instance or record.
-* @param targetName - Lowercase target header name.
-* @returns Header value string or undefined.
-*/
-function extractHeaderValue$2(headers, targetName) {
-	if (typeof Headers !== "undefined" && headers instanceof Headers) return headers.get(targetName) ?? void 0;
-	const record = headers;
-	const lowerTarget = targetName.toLowerCase();
-	for (const key of Object.keys(record)) if (key.toLowerCase() === lowerTarget) {
-		const value = record[key];
-		return Array.isArray(value) ? value[0] : value;
-	}
-}
-/**
 * Resolves the raw signature header string from options, headers record, or request.
 *
 * @param options - Shopify verification options.
 * @returns Shopify signature header string or undefined if not found.
 */
-function resolveSignatureHeader$1(options) {
+function resolveShopifySignatureHeader(options) {
 	if (options.signature) return options.signature;
-	if (options.headers) return extractHeaderValue$2(options.headers, "x-shopify-hmac-sha256");
+	if (options.headers) return extractHeaderValue$1(options.headers, "x-shopify-hmac-sha256");
 	if (typeof Request !== "undefined" && options.body instanceof Request) return options.body.headers.get("x-shopify-hmac-sha256") ?? void 0;
 }
 /**
@@ -875,7 +1014,7 @@ function resolveSignatureHeader$1(options) {
 * @param rawHeader - Resolved header string.
 * @returns Error if preconditions fail, null otherwise.
 */
-function validatePreconditions$1(options, rawHeader) {
+function validateShopifyPreconditions(options, rawHeader) {
 	if (!options.secret) return new SignatureVerificationError("Missing Shopify webhook signing secret");
 	if (!rawHeader) return new InvalidSignatureHeaderError("Missing X-Shopify-Hmac-Sha256 header");
 	return null;
@@ -886,43 +1025,14 @@ function validatePreconditions$1(options, rawHeader) {
 * @param rawHeader - Raw header string.
 * @returns Extracted Base64 signature string or error object.
 */
-function safeParseHeader$1(rawHeader) {
+function safeParseShopifyHeader(rawHeader) {
 	try {
 		return { signature: parseShopifySignature(rawHeader) };
 	} catch (err) {
 		return { error: err instanceof WebhookKitError ? err : new InvalidSignatureHeaderError(String(err)) };
 	}
 }
-/**
-* Constructs a failed WebhookVerificationResult or throws if throwOnError is set.
-*
-* @param rawBody - Raw body string.
-* @param error - WebhookKitError instance.
-* @param throwOnError - Optional flag to throw immediately.
-* @returns Failed verification result.
-*/
-function failVerification$2(rawBody, error, throwOnError, eventId) {
-	if (throwOnError) throw error;
-	return {
-		valid: false,
-		rawBody,
-		eventId,
-		error
-	};
-}
-/**
-* Attempts to parse the raw body as JSON.
-*
-* @param rawBody - Raw body payload string.
-* @returns Parsed payload or undefined.
-*/
-function tryParseJson$2(rawBody) {
-	try {
-		return JSON.parse(rawBody);
-	} catch {
-		return;
-	}
-}
+// src/providers/shopify/verify.ts
 /**
 * Verifies a Shopify webhook payload signature against `X-Shopify-Hmac-Sha256`.
 *
@@ -933,13 +1043,13 @@ function tryParseJson$2(rawBody) {
 */
 async function verifyShopifyWebhook(options) {
 	const rawBody = await extractRawBody(options.body);
-	const rawHeader = resolveSignatureHeader$1(options);
-	const preconditionError = validatePreconditions$1(options, rawHeader);
-	if (preconditionError) return failVerification$2(rawBody, preconditionError, options.throwOnError);
-	const parsed = safeParseHeader$1(rawHeader);
-	if ("error" in parsed) return failVerification$2(rawBody, parsed.error, options.throwOnError);
-	if (!timingSafeEqual(await computeSubtleHmac("SHA-256", options.secret, rawBody, "base64"), parsed.signature)) return failVerification$2(rawBody, new SignatureVerificationError("Shopify signature verification failed: signature does not match expected HMAC"), options.throwOnError);
-	const payload = options.parseJson !== false ? tryParseJson$2(rawBody) : void 0;
+	const rawHeader = resolveShopifySignatureHeader(options);
+	const preconditionError = validateShopifyPreconditions(options, rawHeader);
+	if (preconditionError) return failVerification(rawBody, preconditionError, options.throwOnError);
+	const parsed = safeParseShopifyHeader(rawHeader);
+	if ("error" in parsed) return failVerification(rawBody, parsed.error, options.throwOnError);
+	if (!timingSafeEqual(await computeSubtleHmac("SHA-256", options.secret, rawBody, "base64"), parsed.signature)) return failVerification(rawBody, new SignatureVerificationError("Shopify signature verification failed: signature does not match expected HMAC"), options.throwOnError);
+	const payload = options.parseJson !== false ? tryParseJson(rawBody) : void 0;
 	const eventId = resolveWebhookEventId({
 		eventId: options.eventId,
 		headers: options.headers,
@@ -953,7 +1063,7 @@ async function verifyShopifyWebhook(options) {
 		storeTtlSeconds: options.storeTtlSeconds,
 		toleranceSeconds: options.toleranceSeconds
 	});
-	if (replayError) return failVerification$2(rawBody, replayError, options.throwOnError, eventId);
+	if (replayError) return failVerification(rawBody, replayError, options.throwOnError, void 0, eventId);
 	return {
 		valid: true,
 		rawBody,
@@ -982,40 +1092,13 @@ const shopifyPlugin = {
 	name: "shopify",
 	verify: verifyShopifyWebhook
 };
-// src/providers/stripe.ts
+// src/providers/stripe/signature.ts
 const STRIPE_EVENT_ID_HEADERS = [
 	"x-stripe-webhook-id",
 	"x-webhook-id",
 	"webhook-id"
 ];
 /**
-* Case-insensitively extracts a header value from a `Headers` instance or plain record.
-*
-* @param headers - Web standard `Headers` instance or record.
-* @param targetName - Lowercase target header name.
-* @returns Header value string or undefined.
-*/
-function extractHeaderValue$1(headers, targetName) {
-	if (typeof Headers !== "undefined" && headers instanceof Headers) return headers.get(targetName) ?? void 0;
-	const record = headers;
-	const lowerTarget = targetName.toLowerCase();
-	for (const key of Object.keys(record)) if (key.toLowerCase() === lowerTarget) {
-		const value = record[key];
-		return Array.isArray(value) ? value[0] : value;
-	}
-}
-/**
-* Resolves the raw signature header string from options, headers record, or request.
-*
-* @param options - Stripe verification options.
-* @returns Stripe signature header string or undefined if not found.
-*/
-function resolveSignatureHeader(options) {
-	if (options.signature) return options.signature;
-	if (options.headers) return extractHeaderValue$1(options.headers, "stripe-signature");
-	if (typeof Request !== "undefined" && options.body instanceof Request) return options.body.headers.get("stripe-signature") ?? void 0;
-}
-/**
 * Splits a header tag pair into key and value.
 *
 * @param item - Header entry (e.g. `t=1492774577` or `v1=...`).
@@ -1050,14 +1133,6 @@ function processHeaderTag(key, value, state) {
 	}
 }
 /**
-* Asserts that a header value is a non-empty string.
-*
-* @param header - Candidate header value.
-*/
-function assertNonEmptyHeader(header) {
-	if (typeof header !== "string" || !header.trim()) throw new InvalidSignatureHeaderError("Missing or empty Stripe-Signature header");
-}
-/**
 * Collects timestamp and signature schemes across comma-separated header entries.
 *
 * @param header - Non-empty header string.
@@ -1093,7 +1168,7 @@ function validateParsedState(timestamp, signaturesCount) {
 * @throws {InvalidSignatureHeaderError} If header format is invalid or missing required tags.
 */
 function parseStripeSignature(header) {
-	assertNonEmptyHeader(header);
+	assertNonEmptyHeader(header, "Missing or empty Stripe-Signature header");
 	const state = collectHeaderState(header);
 	validateParsedState(state.timestamp, state.signatures.length);
 	return {
@@ -1103,6 +1178,17 @@ function parseStripeSignature(header) {
 	};
 }
 /**
+* Asserts that a timestamp number is a positive finite number.
+*
+* @param val - Candidate timestamp value.
+* @param name - Descriptive parameter name for error messages.
+* @param eventTimestamp - Event timestamp for error attribution.
+* @param tolerance - Tolerance window for error attribution.
+*/
+function assertPositiveFiniteTimestamp(val, name, eventTimestamp, tolerance) {
+	if (val !== void 0 && (!Number.isFinite(val) || val <= 0)) throw new TimestampToleranceError(eventTimestamp, tolerance, `Invalid ${name}: expected a positive finite number`);
+}
+/**
 * Validates that a webhook timestamp falls within the allowed tolerance window.
 *
 * @param timestamp - Unix timestamp in seconds from the signature header.
@@ -1111,34 +1197,23 @@ function parseStripeSignature(header) {
 * @throws {TimestampToleranceError} If timestamp falls outside the tolerance window.
 */
 function validateTimestampTolerance(timestamp, toleranceSeconds = 300, currentTimestamp) {
+	if (!Number.isFinite(toleranceSeconds)) throw new TimestampToleranceError(timestamp, 0, "Invalid timestamp tolerance value: expected a finite number");
 	if (toleranceSeconds <= 0) return;
+	assertPositiveFiniteTimestamp(timestamp, "webhook timestamp", timestamp, toleranceSeconds);
+	assertPositiveFiniteTimestamp(currentTimestamp, "current timestamp", timestamp, toleranceSeconds);
 	const now = currentTimestamp ?? Math.floor(Date.now() / 1e3);
 	if (Math.abs(now - timestamp) > toleranceSeconds) throw new TimestampToleranceError(timestamp, toleranceSeconds);
 }
 /**
-* Compares an expected HMAC hex signature against candidate signatures in constant time.
-*
-* @param expectedSignature - Computed hex signature.
-* @param candidates - List of candidate hex signatures from the header.
-* @returns `true` if any candidate matches the expected signature.
-*/
-function matchesAnySignature(expectedSignature, candidates) {
-	let matched = false;
-	for (const candidate of candidates) if (timingSafeEqual(expectedSignature, candidate)) matched = true;
-	return matched;
-}
-/**
-* Attempts to parse the raw body as JSON.
+* Resolves the raw signature header string from options, headers record, or request.
 *
-* @param rawBody - Raw body payload string.
-* @returns Parsed payload or undefined.
+* @param options - Stripe verification options.
+* @returns Stripe signature header string or undefined if not found.
 */
-function tryParseJson$1(rawBody) {
-	try {
-		return JSON.parse(rawBody);
-	} catch {
-		return;
-	}
+function resolveStripeSignatureHeader(options) {
+	if (options.signature) return options.signature;
+	if (options.headers) return extractHeaderValue$1(options.headers, "stripe-signature");
+	if (typeof Request !== "undefined" && options.body instanceof Request) return options.body.headers.get("stripe-signature") ?? void 0;
 }
 /**
 * Validates preconditions for Stripe webhook verification.
@@ -1147,7 +1222,7 @@ function tryParseJson$1(rawBody) {
 * @param rawHeader - Resolved header string.
 * @returns Error if preconditions fail, null otherwise.
 */
-function validatePreconditions(options, rawHeader) {
+function validateStripePreconditions(options, rawHeader) {
 	if (!options.secret) return new SignatureVerificationError("Missing Stripe webhook signing secret");
 	if (!rawHeader) return new InvalidSignatureHeaderError("Missing Stripe-Signature header");
 	return null;
@@ -1158,7 +1233,7 @@ function validatePreconditions(options, rawHeader) {
 * @param rawHeader - Raw header string.
 * @returns Parsed header or error object.
 */
-function safeParseHeader(rawHeader) {
+function safeParseStripeHeader(rawHeader) {
 	try {
 		return parseStripeSignature(rawHeader);
 	} catch (err) {
@@ -1172,7 +1247,7 @@ function safeParseHeader(rawHeader) {
 * @param options - Stripe verification options.
 * @returns TimestampToleranceError if exceeded, null otherwise.
 */
-function checkTolerance(timestamp, options) {
+function checkStripeTolerance(timestamp, options) {
 	const tolerance = options.toleranceSeconds ?? 300;
 	try {
 		validateTimestampTolerance(timestamp, tolerance, options.currentTimestamp);
@@ -1182,24 +1257,19 @@ function checkTolerance(timestamp, options) {
 	}
 }
 /**
-* Constructs a failed WebhookVerificationResult or throws if throwOnError is set.
+* Compares an expected HMAC hex signature against candidate signatures in constant time.
 *
-* @param rawBody - Raw body string.
-* @param error - WebhookKitError instance.
-* @param throwOnError - Optional flag to throw immediately.
-* @param timestamp - Optional parsed timestamp.
-* @returns Failed verification result.
+* @param expectedSignature - Computed hex signature.
+* @param candidates - List of candidate hex signatures from the header.
+* @returns `true` if any candidate matches the expected signature.
 */
-function failVerification$1(rawBody, error, throwOnError, timestamp, eventId) {
-	if (throwOnError) throw error;
-	return {
-		valid: false,
-		rawBody,
-		timestamp,
-		eventId,
-		error
-	};
+function matchesAnyStripeSignature(expectedSignature, candidates) {
+	let matched = false;
+	const expectedLower = expectedSignature.trim().toLowerCase();
+	for (const candidate of candidates) if (timingSafeEqual(expectedLower, candidate.trim().toLowerCase())) matched = true;
+	return matched;
 }
+// src/providers/stripe/verify.ts
 /**
 * Verifies a Stripe webhook event signature.
 *
@@ -1211,17 +1281,17 @@ function failVerification$1(rawBody, error, throwOnError, timestamp, eventId) {
 */
 async function verifyStripeWebhook(options) {
 	const rawBody = await extractRawBody(options.body);
-	const rawHeader = resolveSignatureHeader(options);
-	const preconditionError = validatePreconditions(options, rawHeader);
-	if (preconditionError) return failVerification$1(rawBody, preconditionError, options.throwOnError);
-	const parsedHeader = safeParseHeader(rawHeader);
-	if ("error" in parsedHeader) return failVerification$1(rawBody, parsedHeader.error, options.throwOnError);
+	const rawHeader = resolveStripeSignatureHeader(options);
+	const preconditionError = validateStripePreconditions(options, rawHeader);
+	if (preconditionError) return failVerification(rawBody, preconditionError, options.throwOnError);
+	const parsedHeader = safeParseStripeHeader(rawHeader);
+	if ("error" in parsedHeader) return failVerification(rawBody, parsedHeader.error, options.throwOnError);
 	const { timestamp, signatures } = parsedHeader;
-	const toleranceError = checkTolerance(timestamp, options);
-	if (toleranceError) return failVerification$1(rawBody, toleranceError, options.throwOnError, timestamp);
+	const toleranceError = checkStripeTolerance(timestamp, options);
+	if (toleranceError) return failVerification(rawBody, toleranceError, options.throwOnError, timestamp);
 	const signedPayload = `${timestamp}.${rawBody}`;
-	if (!matchesAnySignature(await computeSubtleHmac("SHA-256", options.secret, signedPayload, "hex"), signatures)) return failVerification$1(rawBody, new SignatureVerificationError("Stripe signature verification failed: signature does not match expected HMAC"), options.throwOnError, timestamp);
-	const payload = options.parseJson !== false ? tryParseJson$1(rawBody) : void 0;
+	if (!matchesAnyStripeSignature(await computeSubtleHmac("SHA-256", options.secret, signedPayload, "hex"), signatures)) return failVerification(rawBody, new SignatureVerificationError("Stripe signature verification failed: signature does not match expected HMAC"), options.throwOnError, timestamp);
+	const payload = options.parseJson !== false ? tryParseJson(rawBody) : void 0;
 	const eventId = resolveWebhookEventId({
 		eventId: options.eventId,
 		headers: options.headers,
@@ -1235,7 +1305,7 @@ async function verifyStripeWebhook(options) {
 		storeTtlSeconds: options.storeTtlSeconds,
 		toleranceSeconds: options.toleranceSeconds
 	});
-	if (replayError) return failVerification$1(rawBody, replayError, options.throwOnError, timestamp, eventId);
+	if (replayError) return failVerification(rawBody, replayError, options.throwOnError, timestamp, eventId);
 	return {
 		valid: true,
 		rawBody,
@@ -1349,8 +1419,8 @@ function resolveRawTimestamp(options) {
 * @returns Positive integer timestamp or `null` if invalid.
 */
 function parseTimestampValue(rawTimestamp) {
-	const parsed = typeof rawTimestamp === "number" ? rawTimestamp : parseInt(String(rawTimestamp).trim(), 10);
-	if (!Number.isInteger(parsed) || parsed <= 0) return null;
+	const parsed = typeof rawTimestamp === "number" ? Math.floor(rawTimestamp) : parseInt(String(rawTimestamp).trim(), 10);
+	if (!Number.isFinite(parsed) || parsed <= 0) return null;
 	return parsed;
 }
 /**
@@ -1434,7 +1504,7 @@ async function matchesGenericHmac(options, rawBody, rawSignature, timestamp) {
 * @param timestamp - Optional parsed timestamp.
 * @returns Failed verification result.
 */
-function failVerification(rawBody, error, throwOnError, timestamp, eventId) {
+function failVerification$1(rawBody, error, throwOnError, timestamp, eventId) {
 	if (throwOnError) throw error;
 	return {
 		valid: false,
@@ -1450,7 +1520,7 @@ function failVerification(rawBody, error, throwOnError, timestamp, eventId) {
 * @param rawBody - Raw body string.
 * @returns Parsed JSON value or `undefined`.
 */
-function tryParseJson(rawBody) {
+function tryParseJson$1(rawBody) {
 	try {
 		return JSON.parse(rawBody);
 	} catch {
@@ -1485,7 +1555,7 @@ async function runPluginVerification(plugin, options, enforceStoreAfterPlugin =
 		storeTtlSeconds: options.storeTtlSeconds,
 		toleranceSeconds: options.toleranceSeconds
 	});
-	if (replayError) return failVerification(result.rawBody, replayError, options.throwOnError, result.timestamp, eventId);
+	if (replayError) return failVerification$1(result.rawBody, replayError, options.throwOnError, result.timestamp, eventId);
 	return {
 		...result,
 		eventId
@@ -1502,7 +1572,7 @@ async function delegateToProvider(options) {
 	if (typeof provider === "object") return runPluginVerification(provider, options, true);
 	const normalizedName = String(provider).toLowerCase().trim();
 	const builtin = PROVIDER_REGISTRY[normalizedName];
-	if (!builtin) return failVerification(await extractRawBody(options.body), new WebhookKitError(`Unsupported webhook provider: "${String(provider)}"`, "UNSUPPORTED_PROVIDER"), options.throwOnError);
+	if (!builtin) return failVerification$1(await extractRawBody(options.body), new WebhookKitError(`Unsupported webhook provider: "${String(provider)}"`, "UNSUPPORTED_PROVIDER"), options.throwOnError);
 	return runPluginVerification(builtin, options);
 }
 /**
@@ -1514,11 +1584,11 @@ async function delegateToProvider(options) {
 async function verifyGenericWebhook(options) {
 	const rawBody = await extractRawBody(options.body);
 	const rawSignature = resolveGenericSignature(options);
-	if (!hasSecret(options.secret) || !rawSignature) return failVerification(rawBody, new SignatureVerificationError("Missing signature or secret"), options.throwOnError);
+	if (!hasSecret(options.secret) || !rawSignature) return failVerification$1(rawBody, new SignatureVerificationError("Missing signature or secret"), options.throwOnError);
 	const tsResult = verifyGenericTimestamp(options);
-	if (tsResult.error) return failVerification(rawBody, tsResult.error, options.throwOnError);
-	if (!await matchesGenericHmac(options, rawBody, rawSignature, tsResult.timestamp)) return failVerification(rawBody, new SignatureVerificationError(), options.throwOnError, tsResult.timestamp);
-	const payload = options.parseJson !== false ? tryParseJson(rawBody) : void 0;
+	if (tsResult.error) return failVerification$1(rawBody, tsResult.error, options.throwOnError);
+	if (!await matchesGenericHmac(options, rawBody, rawSignature, tsResult.timestamp)) return failVerification$1(rawBody, new SignatureVerificationError(), options.throwOnError, tsResult.timestamp);
+	const payload = options.parseJson !== false ? tryParseJson$1(rawBody) : void 0;
 	const eventId = resolveWebhookEventId({
 		eventId: options.eventId,
 		headers: options.headers,
@@ -1532,7 +1602,7 @@ async function verifyGenericWebhook(options) {
 		storeTtlSeconds: options.storeTtlSeconds,
 		toleranceSeconds: options.toleranceSeconds
 	});
-	if (replayError) return failVerification(rawBody, replayError, options.throwOnError, tsResult.timestamp, eventId);
+	if (replayError) return failVerification$1(rawBody, replayError, options.throwOnError, tsResult.timestamp, eventId);
 	return {
 		valid: true,
 		rawBody,
@@ -1553,7 +1623,7 @@ async function assertWebhookSignature(options) {
 	if (!result.valid) throw result.error;
 	return result.payload;
 }
-// src/handler.ts
+// src/handler/handler.ts
 const JSON_CONTENT_TYPE = "application/json; charset=utf-8";
 const DEFAULT_SUCCESS_BODY = JSON.stringify({ received: true });
 /**
@@ -1734,16 +1804,26 @@ function createWebhookHandler(options) {
 		}));
 	};
 }
+exports.BASE64_REGEX = BASE64_REGEX;
 exports.CryptoKeyLruCache = CryptoKeyLruCache;
+exports.DEFAULT_REPLAY_STORE_MAX_SIZE = DEFAULT_REPLAY_STORE_MAX_SIZE;
+exports.DEFAULT_REPLAY_STORE_TTL_SECONDS = DEFAULT_REPLAY_STORE_TTL_SECONDS;
+exports.GENERIC_EVENT_ID_HEADERS = GENERIC_EVENT_ID_HEADERS;
+exports.GITHUB_EVENT_ID_HEADERS = GITHUB_EVENT_ID_HEADERS;
+exports.GITHUB_SIGNATURE_HEX_REGEX = GITHUB_SIGNATURE_HEX_REGEX;
+exports.GITHUB_SIGNATURE_PREFIX = GITHUB_SIGNATURE_PREFIX;
 exports.InMemoryReplayStore = InMemoryReplayStore;
 exports.InvalidSignatureHeaderError = InvalidSignatureHeaderError;
 exports.PROVIDER_REGISTRY = PROVIDER_REGISTRY;
 exports.PayloadExtractionError = PayloadExtractionError;
 exports.ReplayAttackError = ReplayAttackError;
+exports.SHOPIFY_EVENT_ID_HEADERS = SHOPIFY_EVENT_ID_HEADERS;
+exports.STRIPE_EVENT_ID_HEADERS = STRIPE_EVENT_ID_HEADERS;
 exports.SignatureVerificationError = SignatureVerificationError;
 exports.TimestampToleranceError = TimestampToleranceError;
 exports.WebhookKitError = WebhookKitError;
 exports.assertGithubWebhook = assertGithubWebhook;
+exports.assertNonEmptyHeader = assertNonEmptyHeader;
 exports.assertShopifyWebhook = assertShopifyWebhook;
 exports.assertStripeWebhook = assertStripeWebhook;
 exports.assertWebhookSignature = assertWebhookSignature;
@@ -1751,22 +1831,35 @@ exports.base64ToBytes = base64ToBytes;
 exports.bytesToBase64 = bytesToBase64;
 exports.bytesToHex = bytesToHex;
 exports.checkAndRecordReplay = checkAndRecordReplay;
+exports.checkStripeTolerance = checkStripeTolerance;
 exports.clearCryptoKeyCache = clearCryptoKeyCache;
 exports.computeSubtleHmac = computeSubtleHmac;
 exports.createInMemoryReplayStore = createInMemoryReplayStore;
 exports.createWebhookHandler = createWebhookHandler;
 exports.extractRawBody = extractRawBody;
+exports.failVerification = failVerification;
 exports.getCachedCryptoKey = getCachedCryptoKey;
 exports.getCryptoKeyCacheSize = getCryptoKeyCacheSize;
 exports.githubPlugin = githubPlugin;
 exports.hexToBytes = hexToBytes;
+exports.matchesAnyStripeSignature = matchesAnyStripeSignature;
 exports.parseGithubSignature = parseGithubSignature;
 exports.parseShopifySignature = parseShopifySignature;
 exports.parseStripeSignature = parseStripeSignature;
+exports.resolveGithubSignatureHeader = resolveGithubSignatureHeader;
+exports.resolveShopifySignatureHeader = resolveShopifySignatureHeader;
+exports.resolveStripeSignatureHeader = resolveStripeSignatureHeader;
 exports.resolveWebhookEventId = resolveWebhookEventId;
+exports.safeParseGithubHeader = safeParseGithubHeader;
+exports.safeParseShopifyHeader = safeParseShopifyHeader;
+exports.safeParseStripeHeader = safeParseStripeHeader;
 exports.shopifyPlugin = shopifyPlugin;
 exports.stripePlugin = stripePlugin;
 exports.timingSafeEqual = timingSafeEqual;
+exports.tryParseJson = tryParseJson;
+exports.validateGithubPreconditions = validateGithubPreconditions;
+exports.validateShopifyPreconditions = validateShopifyPreconditions;
+exports.validateStripePreconditions = validateStripePreconditions;
 exports.validateTimestampTolerance = validateTimestampTolerance;
 exports.verifyGithubWebhook = verifyGithubWebhook;
 exports.verifyShopifyWebhook = verifyShopifyWebhook;