@gurulu/node 0.1.1 → 1.0.0

package/dist/webhooks/custom.js

@@ -0,0 +1,123 @@
+// src/webhooks/custom.ts
+import { createHmac, timingSafeEqual } from "node:crypto";
+
+// src/errors.ts
+class GuruluSDKError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "GuruluSDKError";
+    this.code = code;
+  }
+}
+
+class NotInitializedError extends GuruluSDKError {
+  constructor() {
+    super("SDK_NOT_INITIALIZED", "Gurulu.init() must be called before track/identify");
+  }
+}
+
+class InvalidWorkspaceKeyError extends GuruluSDKError {
+  constructor(message) {
+    super("SDK_INVALID_WORKSPACE_KEY", message);
+  }
+}
+
+class WebhookSignatureError extends GuruluSDKError {
+  constructor(message) {
+    super("WEBHOOK_SIGNATURE_INVALID", message);
+  }
+}
+
+class WebhookMappingNotFoundError extends GuruluSDKError {
+  constructor(message) {
+    super("WEBHOOK_MAPPING_NOT_FOUND", message);
+  }
+}
+
+class TransportError extends GuruluSDKError {
+  status;
+  attempts;
+  constructor(message, attempts, status) {
+    super("SDK_TRANSPORT_ERROR", message);
+    this.attempts = attempts;
+    this.status = status;
+  }
+}
+
+class QueueOverflowError extends GuruluSDKError {
+  dropped;
+  constructor(dropped) {
+    super("SDK_QUEUE_OVERFLOW", `Queue overflow — dropped ${dropped} oldest events`);
+    this.dropped = dropped;
+  }
+}
+
+// src/webhooks/custom.ts
+function defaultVerify(rawBody, signature, secret) {
+  const expected = createHmac("sha256", secret).update(rawBody, "utf8").digest("hex");
+  const actualBuf = Buffer.from(signature, "hex");
+  const expectedBuf = Buffer.from(expected, "hex");
+  if (actualBuf.length !== expectedBuf.length)
+    return false;
+  return timingSafeEqual(actualBuf, expectedBuf);
+}
+function toOutgoing(result) {
+  if (!result.event_key) {
+    throw new WebhookMappingNotFoundError("Custom mapPayload returned no event_key");
+  }
+  const consent = {
+    analytics: true,
+    marketing: true,
+    functional: true,
+    personalization: false,
+    source: "webhook"
+  };
+  const event = {
+    anonymous_id: result.anonymous_id ?? `custom_anon_${result.event_id ?? Date.now()}`,
+    event_id: result.event_id,
+    event_key: result.event_key,
+    event_type: "outcome",
+    occurred_at: result.occurred_at ?? new Date().toISOString(),
+    producer: "webhook",
+    producer_version: "0.1.0",
+    properties: result.properties ?? {},
+    consent_state: consent
+  };
+  if (result.person_id)
+    event.person_id = result.person_id;
+  return event;
+}
+function createCustomWebhook(config, enqueue, options) {
+  const headerName = options.signatureHeader.toLowerCase();
+  const verifier = options.verifySignature ?? defaultVerify;
+  return {
+    verify(rawBody, signature) {
+      return verifier(rawBody, signature, options.secret);
+    },
+    async handle(req) {
+      const sigRaw = req.headers[headerName];
+      const sig = Array.isArray(sigRaw) ? sigRaw[0] : sigRaw;
+      if (!sig) {
+        throw new WebhookSignatureError(`Header '${options.signatureHeader}' missing`);
+      }
+      if (!verifier(req.body, sig, options.secret)) {
+        throw new WebhookSignatureError("Custom webhook signature mismatch");
+      }
+      const payload = JSON.parse(req.body);
+      const mapped = options.mapPayload(payload);
+      const results = Array.isArray(mapped) ? mapped : [mapped];
+      const events = results.map(toOutgoing);
+      for (const e of events)
+        enqueue(e);
+      return {
+        events_emitted: events.length,
+        vendor: "custom",
+        event_keys: events.map((e) => e.event_key)
+      };
+    }
+  };
+}
+export {
+  createCustomWebhook
+};

package/dist/webhooks/lemonsqueezy.d.ts

@@ -0,0 +1,30 @@
+import type { HandleResult, OutgoingEvent, ResolvedConfig } from '../types.ts';
+/** 6 default Lemon Squeezy event → Gurulu event_key mapping. */
+export declare const LEMONSQUEEZY_DEFAULT_MAPPING: Record<string, string>;
+export interface LemonSqueezyHandleReq {
+    body: string;
+    headers: Record<string, string | string[] | undefined>;
+}
+export interface LemonSqueezyHandleOptions {
+    customMapping?: Record<string, string>;
+}
+interface LemonSqueezyPayload {
+    meta?: {
+        event_name?: string;
+        custom_data?: Record<string, unknown>;
+    };
+    data?: {
+        id?: string;
+        type?: string;
+        attributes?: Record<string, unknown>;
+    };
+}
+export declare function verifyLemonSqueezy(rawBody: string, signatureHeader: string | undefined, secret: string): void;
+export declare function mapLemonSqueezyEvent(payload: LemonSqueezyPayload, options?: LemonSqueezyHandleOptions): OutgoingEvent;
+export declare function createLemonSqueezyHandler(config: ResolvedConfig, enqueue: (event: OutgoingEvent) => void): {
+    verify: typeof verifyLemonSqueezy;
+    map: typeof mapLemonSqueezyEvent;
+    handle: (req: LemonSqueezyHandleReq, secret: string, options?: LemonSqueezyHandleOptions) => Promise<HandleResult>;
+};
+export {};
+//# sourceMappingURL=lemonsqueezy.d.ts.map

package/dist/webhooks/lemonsqueezy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lemonsqueezy.d.ts","sourceRoot":"","sources":["../../src/webhooks/lemonsqueezy.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,cAAc,EAEf,MAAM,aAAa,CAAC;AAErB,gEAAgE;AAChE,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAO/D,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,UAAU,mBAAmB;IAC3B,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACtE,IAAI,CAAC,EAAE;QACL,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACtC,CAAC;CACH;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,MAAM,EAAE,MAAM,GACb,IAAI,CAQN;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,mBAAmB,EAC5B,OAAO,GAAE,yBAA8B,GACtC,aAAa,CAkDf;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GACtC;IACD,MAAM,EAAE,OAAO,kBAAkB,CAAC;IAClC,GAAG,EAAE,OAAO,oBAAoB,CAAC;IACjC,MAAM,EAAE,CACN,GAAG,EAAE,qBAAqB,EAC1B,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,yBAAyB,KAChC,OAAO,CAAC,YAAY,CAAC,CAAC;CAC5B,CAmBA"}

package/dist/webhooks/lemonsqueezy.js

@@ -0,0 +1,140 @@
+// src/webhooks/lemonsqueezy.ts
+import { createHmac, timingSafeEqual } from "node:crypto";
+
+// src/errors.ts
+class GuruluSDKError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "GuruluSDKError";
+    this.code = code;
+  }
+}
+
+class NotInitializedError extends GuruluSDKError {
+  constructor() {
+    super("SDK_NOT_INITIALIZED", "Gurulu.init() must be called before track/identify");
+  }
+}
+
+class InvalidWorkspaceKeyError extends GuruluSDKError {
+  constructor(message) {
+    super("SDK_INVALID_WORKSPACE_KEY", message);
+  }
+}
+
+class WebhookSignatureError extends GuruluSDKError {
+  constructor(message) {
+    super("WEBHOOK_SIGNATURE_INVALID", message);
+  }
+}
+
+class WebhookMappingNotFoundError extends GuruluSDKError {
+  constructor(message) {
+    super("WEBHOOK_MAPPING_NOT_FOUND", message);
+  }
+}
+
+class TransportError extends GuruluSDKError {
+  status;
+  attempts;
+  constructor(message, attempts, status) {
+    super("SDK_TRANSPORT_ERROR", message);
+    this.attempts = attempts;
+    this.status = status;
+  }
+}
+
+class QueueOverflowError extends GuruluSDKError {
+  dropped;
+  constructor(dropped) {
+    super("SDK_QUEUE_OVERFLOW", `Queue overflow — dropped ${dropped} oldest events`);
+    this.dropped = dropped;
+  }
+}
+
+// src/webhooks/lemonsqueezy.ts
+var LEMONSQUEEZY_DEFAULT_MAPPING = {
+  order_created: "purchase_completed",
+  order_refunded: "refund_processed",
+  subscription_created: "subscription_started",
+  subscription_updated: "subscription_updated",
+  subscription_cancelled: "subscription_cancelled",
+  subscription_payment_success: "payment_succeeded"
+};
+function verifyLemonSqueezy(rawBody, signatureHeader, secret) {
+  if (!signatureHeader)
+    throw new WebhookSignatureError("X-Signature header missing");
+  const expected = createHmac("sha256", secret).update(rawBody, "utf8").digest("hex");
+  const actualBuf = Buffer.from(signatureHeader, "hex");
+  const expectedBuf = Buffer.from(expected, "hex");
+  if (actualBuf.length !== expectedBuf.length || !timingSafeEqual(actualBuf, expectedBuf)) {
+    throw new WebhookSignatureError("Lemon Squeezy signature mismatch");
+  }
+}
+function mapLemonSqueezyEvent(payload, options = {}) {
+  const eventName = payload.meta?.event_name ?? "";
+  const mapping = { ...LEMONSQUEEZY_DEFAULT_MAPPING, ...options.customMapping ?? {} };
+  const eventKey = mapping[eventName];
+  if (!eventKey) {
+    throw new WebhookMappingNotFoundError(`Lemon Squeezy event_name '${eventName}' has no Gurulu mapping`);
+  }
+  const attr = payload.data?.attributes ?? {};
+  const objectId = payload.data?.id ?? "unknown";
+  const occurredAt = typeof attr.updated_at === "string" ? attr.updated_at : typeof attr.created_at === "string" ? attr.created_at : new Date().toISOString();
+  const customerId = typeof attr.customer_id === "string" || typeof attr.customer_id === "number" ? String(attr.customer_id) : undefined;
+  const props = {
+    lemonsqueezy_event_name: eventName,
+    lemonsqueezy_object_id: objectId,
+    lemonsqueezy_object_type: payload.data?.type
+  };
+  if (typeof attr.total === "number")
+    props.amount = attr.total / 100;
+  if (typeof attr.currency === "string")
+    props.currency = attr.currency;
+  if (typeof attr.status === "string")
+    props.status = attr.status;
+  const consent = {
+    analytics: true,
+    marketing: true,
+    functional: true,
+    personalization: false,
+    source: "webhook"
+  };
+  return {
+    anonymous_id: customerId ? `lemonsqueezy_${customerId}` : `lemonsqueezy_anon_${objectId}`,
+    event_id: `lemonsqueezy_${eventName}_${objectId}`,
+    event_key: eventKey,
+    event_type: "outcome",
+    occurred_at: occurredAt,
+    producer: "webhook",
+    producer_version: "0.1.0",
+    properties: props,
+    consent_state: consent
+  };
+}
+function createLemonSqueezyHandler(config, enqueue) {
+  return {
+    verify: verifyLemonSqueezy,
+    map: mapLemonSqueezyEvent,
+    async handle(req, secret, options) {
+      const sigHeader = req.headers["x-signature"];
+      const sig = Array.isArray(sigHeader) ? sigHeader[0] : sigHeader;
+      verifyLemonSqueezy(req.body, sig, secret);
+      const payload = JSON.parse(req.body);
+      const event = mapLemonSqueezyEvent(payload, options);
+      enqueue(event);
+      return {
+        events_emitted: 1,
+        vendor: "lemonsqueezy",
+        event_keys: [event.event_key]
+      };
+    }
+  };
+}
+export {
+  verifyLemonSqueezy,
+  mapLemonSqueezyEvent,
+  createLemonSqueezyHandler,
+  LEMONSQUEEZY_DEFAULT_MAPPING
+};

package/dist/webhooks/shopify.d.ts

@@ -0,0 +1,18 @@
+import type { HandleResult, OutgoingEvent, ResolvedConfig } from '../types.ts';
+/** 8 default Shopify topic → Gurulu event_key mapping. */
+export declare const SHOPIFY_DEFAULT_MAPPING: Record<string, string>;
+export interface ShopifyHandleReq {
+    body: string;
+    headers: Record<string, string | string[] | undefined>;
+}
+export interface ShopifyHandleOptions {
+    customMapping?: Record<string, string>;
+}
+export declare function verifyShopify(rawBody: string, signatureHeader: string | undefined, secret: string): void;
+export declare function mapShopifyEvent(topic: string | undefined, payload: Record<string, unknown>, options?: ShopifyHandleOptions): OutgoingEvent;
+export declare function createShopifyHandler(config: ResolvedConfig, enqueue: (event: OutgoingEvent) => void): {
+    verify: typeof verifyShopify;
+    map: typeof mapShopifyEvent;
+    handle: (req: ShopifyHandleReq, secret: string, options?: ShopifyHandleOptions) => Promise<HandleResult>;
+};
+//# sourceMappingURL=shopify.d.ts.map

package/dist/webhooks/shopify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shopify.d.ts","sourceRoot":"","sources":["../../src/webhooks/shopify.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,cAAc,EAEf,MAAM,aAAa,CAAC;AAErB,0DAA0D;AAC1D,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAS1D,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,MAAM,EAAE,MAAM,GACb,IAAI,CAQN;AAED,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,GAAE,oBAAyB,GACjC,aAAa,CA+Cf;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GACtC;IACD,MAAM,EAAE,OAAO,aAAa,CAAC;IAC7B,GAAG,EAAE,OAAO,eAAe,CAAC;IAC5B,MAAM,EAAE,CACN,GAAG,EAAE,gBAAgB,EACrB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,oBAAoB,KAC3B,OAAO,CAAC,YAAY,CAAC,CAAC;CAC5B,CAqBA"}

package/dist/webhooks/shopify.js

@@ -0,0 +1,142 @@
+// src/webhooks/shopify.ts
+import { createHmac, timingSafeEqual } from "node:crypto";
+
+// src/errors.ts
+class GuruluSDKError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "GuruluSDKError";
+    this.code = code;
+  }
+}
+
+class NotInitializedError extends GuruluSDKError {
+  constructor() {
+    super("SDK_NOT_INITIALIZED", "Gurulu.init() must be called before track/identify");
+  }
+}
+
+class InvalidWorkspaceKeyError extends GuruluSDKError {
+  constructor(message) {
+    super("SDK_INVALID_WORKSPACE_KEY", message);
+  }
+}
+
+class WebhookSignatureError extends GuruluSDKError {
+  constructor(message) {
+    super("WEBHOOK_SIGNATURE_INVALID", message);
+  }
+}
+
+class WebhookMappingNotFoundError extends GuruluSDKError {
+  constructor(message) {
+    super("WEBHOOK_MAPPING_NOT_FOUND", message);
+  }
+}
+
+class TransportError extends GuruluSDKError {
+  status;
+  attempts;
+  constructor(message, attempts, status) {
+    super("SDK_TRANSPORT_ERROR", message);
+    this.attempts = attempts;
+    this.status = status;
+  }
+}
+
+class QueueOverflowError extends GuruluSDKError {
+  dropped;
+  constructor(dropped) {
+    super("SDK_QUEUE_OVERFLOW", `Queue overflow — dropped ${dropped} oldest events`);
+    this.dropped = dropped;
+  }
+}
+
+// src/webhooks/shopify.ts
+var SHOPIFY_DEFAULT_MAPPING = {
+  "orders/create": "purchase_completed",
+  "orders/paid": "purchase_completed",
+  "orders/fulfilled": "order_fulfilled",
+  "orders/cancelled": "order_cancelled",
+  "customers/create": "signup_completed",
+  "carts/create": "cart_started",
+  "carts/update": "cart_updated",
+  "checkouts/create": "checkout_started"
+};
+function verifyShopify(rawBody, signatureHeader, secret) {
+  if (!signatureHeader)
+    throw new WebhookSignatureError("X-Shopify-Hmac-Sha256 header missing");
+  const expected = createHmac("sha256", secret).update(rawBody, "utf8").digest("base64");
+  const actualBuf = Buffer.from(signatureHeader, "base64");
+  const expectedBuf = Buffer.from(expected, "base64");
+  if (actualBuf.length !== expectedBuf.length || !timingSafeEqual(actualBuf, expectedBuf)) {
+    throw new WebhookSignatureError("Shopify HMAC mismatch");
+  }
+}
+function mapShopifyEvent(topic, payload, options = {}) {
+  if (!topic)
+    throw new WebhookMappingNotFoundError("X-Shopify-Topic header required");
+  const mapping = { ...SHOPIFY_DEFAULT_MAPPING, ...options.customMapping ?? {} };
+  const eventKey = mapping[topic];
+  if (!eventKey) {
+    throw new WebhookMappingNotFoundError(`Shopify topic '${topic}' has no Gurulu mapping`);
+  }
+  const occurredAt = typeof payload.updated_at === "string" ? payload.updated_at : typeof payload.created_at === "string" ? payload.created_at : new Date().toISOString();
+  const customer = typeof payload.customer === "object" && payload.customer !== null ? payload.customer.id : undefined;
+  const props = {
+    shopify_topic: topic,
+    shopify_object_id: payload.id
+  };
+  if (typeof payload.total_price === "string")
+    props.amount = Number(payload.total_price);
+  if (typeof payload.currency === "string")
+    props.currency = payload.currency;
+  if (typeof payload.financial_status === "string")
+    props.status = payload.financial_status;
+  const consent = {
+    analytics: true,
+    marketing: true,
+    functional: true,
+    personalization: false,
+    source: "webhook"
+  };
+  return {
+    anonymous_id: customer ? `shopify_${customer}` : `shopify_anon_${payload.id ?? "unknown"}`,
+    event_id: typeof payload.id === "string" || typeof payload.id === "number" ? `shopify_${topic.replace("/", "_")}_${payload.id}` : undefined,
+    event_key: eventKey,
+    event_type: "outcome",
+    occurred_at: occurredAt,
+    producer: "webhook",
+    producer_version: "0.1.0",
+    properties: props,
+    consent_state: consent
+  };
+}
+function createShopifyHandler(config, enqueue) {
+  return {
+    verify: verifyShopify,
+    map: mapShopifyEvent,
+    async handle(req, secret, options) {
+      const sigHeader = req.headers["x-shopify-hmac-sha256"];
+      const topicHeader = req.headers["x-shopify-topic"];
+      const sig = Array.isArray(sigHeader) ? sigHeader[0] : sigHeader;
+      const topic = Array.isArray(topicHeader) ? topicHeader[0] : topicHeader;
+      verifyShopify(req.body, sig, secret);
+      const payload = JSON.parse(req.body);
+      const event = mapShopifyEvent(topic, payload, options);
+      enqueue(event);
+      return {
+        events_emitted: 1,
+        vendor: "shopify",
+        event_keys: [event.event_key]
+      };
+    }
+  };
+}
+export {
+  verifyShopify,
+  mapShopifyEvent,
+  createShopifyHandler,
+  SHOPIFY_DEFAULT_MAPPING
+};

package/dist/webhooks/stripe.d.ts

@@ -0,0 +1,31 @@
+import type { HandleResult, OutgoingEvent, ResolvedConfig } from '../types.ts';
+export declare const STRIPE_REPLAY_TOLERANCE_SECONDS = 300;
+/** 9 default Stripe → Gurulu event_key mapping. */
+export declare const STRIPE_DEFAULT_MAPPING: Record<string, string>;
+export interface StripeHandleReq {
+    body: string;
+    headers: Record<string, string | string[] | undefined>;
+}
+export interface StripeHandleOptions {
+    customMapping?: Record<string, string>;
+    now?: () => Date;
+}
+export interface StripeEventPayload {
+    id?: string;
+    type?: string;
+    created?: number;
+    data?: {
+        object?: Record<string, unknown>;
+    };
+}
+/** Verify Stripe-Signature header. Throws WebhookSignatureError on mismatch. */
+export declare function verifyStripe(rawBody: string, signatureHeader: string | undefined, secret: string, now?: () => Date): void;
+/** Map verified Stripe event → Gurulu OutgoingEvent. */
+export declare function mapStripeEvent(payload: StripeEventPayload, options?: StripeHandleOptions): OutgoingEvent;
+/** Factory bound to a Gurulu instance enqueue callback. */
+export declare function createStripeHandler(config: ResolvedConfig, enqueue: (event: OutgoingEvent) => void): {
+    verify: (rawBody: string, sig: string | undefined, secret: string) => void;
+    map: (payload: StripeEventPayload, options?: StripeHandleOptions) => OutgoingEvent;
+    handle: (req: StripeHandleReq, secret: string, options?: StripeHandleOptions) => Promise<HandleResult>;
+};
+//# sourceMappingURL=stripe.d.ts.map

package/dist/webhooks/stripe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stripe.d.ts","sourceRoot":"","sources":["../../src/webhooks/stripe.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,cAAc,EAEf,MAAM,aAAa,CAAC;AAErB,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAEnD,mDAAmD;AACnD,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAUzD,CAAC;AAEF,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,mBAAmB;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;CAC7C;AAED,gFAAgF;AAChF,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,MAAM,IAAuB,GACjC,IAAI,CAmBN;AAED,wDAAwD;AACxD,wBAAgB,cAAc,CAC5B,OAAO,EAAE,kBAAkB,EAC3B,OAAO,GAAE,mBAAwB,GAChC,aAAa,CAyCf;AAED,2DAA2D;AAC3D,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GACtC;IACD,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3E,GAAG,EAAE,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,mBAAmB,KAAK,aAAa,CAAC;IACnF,MAAM,EAAE,CACN,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,mBAAmB,KAC1B,OAAO,CAAC,YAAY,CAAC,CAAC;CAC5B,CAmBA"}

package/dist/webhooks/stripe.js

@@ -0,0 +1,160 @@
+// src/webhooks/stripe.ts
+import { createHmac, timingSafeEqual } from "node:crypto";
+
+// src/errors.ts
+class GuruluSDKError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "GuruluSDKError";
+    this.code = code;
+  }
+}
+
+class NotInitializedError extends GuruluSDKError {
+  constructor() {
+    super("SDK_NOT_INITIALIZED", "Gurulu.init() must be called before track/identify");
+  }
+}
+
+class InvalidWorkspaceKeyError extends GuruluSDKError {
+  constructor(message) {
+    super("SDK_INVALID_WORKSPACE_KEY", message);
+  }
+}
+
+class WebhookSignatureError extends GuruluSDKError {
+  constructor(message) {
+    super("WEBHOOK_SIGNATURE_INVALID", message);
+  }
+}
+
+class WebhookMappingNotFoundError extends GuruluSDKError {
+  constructor(message) {
+    super("WEBHOOK_MAPPING_NOT_FOUND", message);
+  }
+}
+
+class TransportError extends GuruluSDKError {
+  status;
+  attempts;
+  constructor(message, attempts, status) {
+    super("SDK_TRANSPORT_ERROR", message);
+    this.attempts = attempts;
+    this.status = status;
+  }
+}
+
+class QueueOverflowError extends GuruluSDKError {
+  dropped;
+  constructor(dropped) {
+    super("SDK_QUEUE_OVERFLOW", `Queue overflow — dropped ${dropped} oldest events`);
+    this.dropped = dropped;
+  }
+}
+
+// src/webhooks/stripe.ts
+var STRIPE_REPLAY_TOLERANCE_SECONDS = 300;
+var STRIPE_DEFAULT_MAPPING = {
+  "charge.succeeded": "purchase_completed",
+  "charge.refunded": "refund_processed",
+  "payment_intent.succeeded": "payment_succeeded",
+  "invoice.paid": "payment_succeeded",
+  "invoice.payment_failed": "payment_failed",
+  "customer.subscription.created": "subscription_started",
+  "customer.subscription.updated": "subscription_updated",
+  "customer.subscription.deleted": "subscription_cancelled",
+  "checkout.session.completed": "checkout_completed"
+};
+function verifyStripe(rawBody, signatureHeader, secret, now = () => new Date) {
+  if (!signatureHeader)
+    throw new WebhookSignatureError("Stripe-Signature header missing");
+  let timestamp = null;
+  let v1 = null;
+  for (const part of signatureHeader.split(",").map((s) => s.trim())) {
+    const [k, v] = part.split("=", 2);
+    if (k === "t")
+      timestamp = Number(v);
+    if (k === "v1")
+      v1 = v ?? null;
+  }
+  if (!timestamp || !v1)
+    throw new WebhookSignatureError("Stripe-Signature missing t= or v1=");
+  if (Math.abs(now().getTime() / 1000 - timestamp) > STRIPE_REPLAY_TOLERANCE_SECONDS) {
+    throw new WebhookSignatureError("Stripe-Signature timestamp out of tolerance");
+  }
+  const expected = createHmac("sha256", secret).update(`${timestamp}.${rawBody}`).digest("hex");
+  const actualBuf = Buffer.from(v1, "hex");
+  const expectedBuf = Buffer.from(expected, "hex");
+  if (actualBuf.length !== expectedBuf.length || !timingSafeEqual(actualBuf, expectedBuf)) {
+    throw new WebhookSignatureError("Stripe-Signature mismatch");
+  }
+}
+function mapStripeEvent(payload, options = {}) {
+  const type = payload.type ?? "";
+  const mapping = { ...STRIPE_DEFAULT_MAPPING, ...options.customMapping ?? {} };
+  const eventKey = mapping[type];
+  if (!eventKey) {
+    throw new WebhookMappingNotFoundError(`Stripe event type '${type}' has no Gurulu mapping`);
+  }
+  const obj = payload.data?.object ?? {};
+  const customer = typeof obj.customer === "string" ? obj.customer : undefined;
+  const occurredAt = payload.created ? new Date(payload.created * 1000).toISOString() : new Date().toISOString();
+  const props = {
+    stripe_event_id: payload.id,
+    stripe_event_type: type
+  };
+  if (typeof obj.amount === "number")
+    props.amount = obj.amount / 100;
+  if (typeof obj.currency === "string")
+    props.currency = obj.currency.toUpperCase();
+  if (typeof obj.id === "string")
+    props.stripe_object_id = obj.id;
+  if (typeof obj.status === "string")
+    props.status = obj.status;
+  const consent = {
+    analytics: true,
+    marketing: true,
+    functional: true,
+    personalization: false,
+    source: "webhook"
+  };
+  const event = {
+    anonymous_id: customer ? `stripe_${customer}` : `stripe_anon_${payload.id ?? "unknown"}`,
+    event_id: payload.id,
+    event_key: eventKey,
+    event_type: "outcome",
+    occurred_at: occurredAt,
+    producer: "webhook",
+    producer_version: "0.1.0",
+    properties: props,
+    consent_state: consent
+  };
+  return event;
+}
+function createStripeHandler(config, enqueue) {
+  return {
+    verify: verifyStripe,
+    map: mapStripeEvent,
+    async handle(req, secret, options) {
+      const sigHeader = req.headers["stripe-signature"];
+      const sig = Array.isArray(sigHeader) ? sigHeader[0] : sigHeader;
+      verifyStripe(req.body, sig, secret, options?.now);
+      const payload = JSON.parse(req.body);
+      const event = mapStripeEvent(payload, options);
+      enqueue(event);
+      return {
+        events_emitted: 1,
+        vendor: "stripe",
+        event_keys: [event.event_key]
+      };
+    }
+  };
+}
+export {
+  verifyStripe,
+  mapStripeEvent,
+  createStripeHandler,
+  STRIPE_REPLAY_TOLERANCE_SECONDS,
+  STRIPE_DEFAULT_MAPPING
+};