@idriszade/source-webhook 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Idris Idriszade
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,30 @@
+# @idriszade/source-webhook
+
+Source adapter for receiving inbound webhooks via Hono — exposes a pre-wired Hono `app` and a raw web-standards `(req: Request) => Promise<Response>` handler. Verifies HMAC signatures via core's `verify()`.
+
+## Install
+
+```bash
+pnpm add @idriszade/source-webhook
+```
+
+`hono` and `@hono/zod-validator` are bundled as direct dependencies. Mount `app` (or `handler`) on Node, Bun, Cloudflare Workers, Vercel Edge, or Lambda.
+
+## Usage
+
+```typescript
+import { createWebhookSource } from '@idriszade/source-webhook';
+import { z } from 'zod';
+
+const webhook = createWebhookSource({
+  path: '/webhooks/orders',
+  secret: process.env.WEBHOOK_SECRET!,
+  schema: z.object({ orderId: z.string(), total: z.number() }),
+});
+
+// In your server: webhook.app  (Hono)  or  webhook.handler  (raw fetch)
+```
+
+## Reference
+
+Canonical API surface: [`docs/spec-adapters.md`](../../docs/spec-adapters.md). Core types: [`docs/spec-api-surface.md`](../../docs/spec-api-surface.md).

package/dist/async-queue.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Minimal async queue used as an internal buffer for incoming webhook atoms.
+ * Items pushed before iteration starts are held and yielded in order.
+ * If iteration is already running, the next item wakes the pending resolver.
+ */
+export declare class AsyncQueue<T> {
+    private items;
+    private resolvers;
+    private closed;
+    push(item: T): void;
+    close(): void;
+    /**
+     * Returns a snapshot of the current buffer and clears it.
+     * Used by fetch() for a non-blocking drain.
+     */
+    drain(): T[];
+    [Symbol.asyncIterator](signal?: AbortSignal): AsyncIterableIterator<T>;
+}
+//# sourceMappingURL=async-queue.d.ts.map

package/dist/async-queue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"async-queue.d.ts","sourceRoot":"","sources":["../src/async-queue.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,qBAAa,UAAU,CAAC,CAAC;IACvB,OAAO,CAAC,KAAK,CAAW;IACxB,OAAO,CAAC,SAAS,CAAiD;IAClE,OAAO,CAAC,MAAM,CAAS;IAEvB,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI;IAUnB,KAAK,IAAI,IAAI;IAQb;;;OAGG;IACH,KAAK,IAAI,CAAC,EAAE;IAML,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,qBAAqB,CAAC,CAAC,CAAC;CAkC9E"}

package/dist/async-queue.js

@@ -0,0 +1,70 @@
+/**
+ * Minimal async queue used as an internal buffer for incoming webhook atoms.
+ * Items pushed before iteration starts are held and yielded in order.
+ * If iteration is already running, the next item wakes the pending resolver.
+ */
+export class AsyncQueue {
+    items = [];
+    resolvers = [];
+    closed = false;
+    push(item) {
+        if (this.closed)
+            return;
+        const resolver = this.resolvers.shift();
+        if (resolver !== undefined) {
+            resolver({ value: item, done: false });
+        }
+        else {
+            this.items.push(item);
+        }
+    }
+    close() {
+        this.closed = true;
+        for (const resolver of this.resolvers) {
+            resolver({ value: undefined, done: true });
+        }
+        this.resolvers = [];
+    }
+    /**
+     * Returns a snapshot of the current buffer and clears it.
+     * Used by fetch() for a non-blocking drain.
+     */
+    drain() {
+        const snapshot = this.items.slice();
+        this.items = [];
+        return snapshot;
+    }
+    async *[Symbol.asyncIterator](signal) {
+        while (true) {
+            if (signal?.aborted)
+                return;
+            if (this.items.length > 0) {
+                yield this.items.shift();
+                continue;
+            }
+            if (this.closed)
+                return;
+            const next = await new Promise((resolve) => {
+                if (signal?.aborted) {
+                    resolve({ value: undefined, done: true });
+                    return;
+                }
+                const abortHandler = () => {
+                    const idx = this.resolvers.indexOf(resolve);
+                    if (idx !== -1)
+                        this.resolvers.splice(idx, 1);
+                    resolve({ value: undefined, done: true });
+                };
+                signal?.addEventListener('abort', abortHandler, { once: true });
+                this.resolvers.push((result) => {
+                    signal?.removeEventListener('abort', abortHandler);
+                    resolve(result);
+                });
+            });
+            if (next.done)
+                return;
+            yield next.value;
+        }
+    }
+}
+//# sourceMappingURL=async-queue.js.map

package/dist/async-queue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"async-queue.js","sourceRoot":"","sources":["../src/async-queue.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,OAAO,UAAU;IACb,KAAK,GAAQ,EAAE,CAAC;IAChB,SAAS,GAA8C,EAAE,CAAC;IAC1D,MAAM,GAAG,KAAK,CAAC;IAEvB,IAAI,CAAC,IAAO;QACV,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACxC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,QAAQ,CAAC,EAAE,KAAK,EAAE,SAAyB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAChB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAoB;QAChD,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,MAAM,EAAE,OAAO;gBAAE,OAAO;YAE5B,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAO,CAAC;gBAC9B,SAAS;YACX,CAAC;YAED,IAAI,IAAI,CAAC,MAAM;gBAAE,OAAO;YAExB,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAoB,CAAC,OAAO,EAAE,EAAE;gBAC5D,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;oBACpB,OAAO,CAAC,EAAE,KAAK,EAAE,SAAyB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC1D,OAAO;gBACT,CAAC;gBAED,MAAM,YAAY,GAAG,GAAS,EAAE;oBAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;oBAC5C,IAAI,GAAG,KAAK,CAAC,CAAC;wBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;oBAC9C,OAAO,CAAC,EAAE,KAAK,EAAE,SAAyB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC5D,CAAC,CAAC;gBAEF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;oBAC7B,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;oBACnD,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClB,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,IAAI,IAAI,CAAC,IAAI;gBAAE,OAAO;YACtB,MAAM,IAAI,CAAC,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;CACF"}

package/dist/handler.d.ts

@@ -0,0 +1,14 @@
+import type { ZodType } from 'zod';
+export interface RawHandlerConfig<O> {
+    secret: string;
+    schema: ZodType<O>;
+    onAtom: (data: O, idempotencyKey?: string) => void;
+    verify?: {
+        tolerance?: number;
+        acceptedAlgorithms?: ('v1' | 'v2')[];
+        headerName?: string;
+    };
+    idempotencyHeader?: string;
+}
+export declare function createRawHandler<O>(req: Request, cfg: RawHandlerConfig<O>): Promise<Response>;
+//# sourceMappingURL=handler.d.ts.map

package/dist/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../src/handler.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAKnC,MAAM,WAAW,gBAAgB,CAAC,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,cAAc,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACnD,MAAM,CAAC,EAAE;QACP,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,kBAAkB,CAAC,EAAE,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACrC,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AASD,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC,GACvB,OAAO,CAAC,QAAQ,CAAC,CA+CnB"}

package/dist/handler.js

@@ -0,0 +1,58 @@
+/**
+ * Raw web-standards handler that can be used without Hono.
+ * Validates HMAC, parses body with a Zod schema, and calls an onAtom callback.
+ *
+ * This is intentionally a thin function so callers that already have a
+ * web-standards Request/Response runtime (e.g. Cloudflare Workers, Deno Deploy)
+ * can use it directly without pulling in Hono.
+ */
+import { verify } from '@idriszade/core';
+const DEFAULT_HEADER_NAME = 'X-Pipeline-Kit-Signature';
+const DEFAULT_TOLERANCE_MS = 300_000;
+function jsonError(status, code, message) {
+    return new Response(JSON.stringify({ error: { code, message } }), {
+        status,
+        headers: { 'Content-Type': 'application/json' },
+    });
+}
+export async function createRawHandler(req, cfg) {
+    const headerName = cfg.verify?.headerName ?? DEFAULT_HEADER_NAME;
+    const tolerance = cfg.verify?.tolerance ?? DEFAULT_TOLERANCE_MS;
+    const acceptedAlgorithms = cfg.verify?.acceptedAlgorithms ?? ['v1'];
+    const sigHeader = req.headers.get(headerName);
+    if (!sigHeader) {
+        return jsonError(400, 'missing_signature', `Missing required header: ${headerName}`);
+    }
+    const rawBody = await req.text();
+    const verifyResult = verify(rawBody, sigHeader, cfg.secret, {
+        tolerance,
+        acceptedAlgorithms,
+    });
+    if (verifyResult.error !== null) {
+        const e = verifyResult.error;
+        if (e.type !== 'invalid_payload') {
+            return jsonError(400, e.code, e.message);
+        }
+    }
+    let rawParsed;
+    try {
+        rawParsed = JSON.parse(rawBody);
+    }
+    catch {
+        return jsonError(400, 'json_parse', 'Request body is not valid JSON');
+    }
+    const parsed = cfg.schema.safeParse(rawParsed);
+    if (!parsed.success) {
+        const message = parsed.error.issues.map((i) => i.message).join('; ');
+        return jsonError(400, 'schema_mismatch', message);
+    }
+    const idempotencyKey = cfg.idempotencyHeader
+        ? (req.headers.get(cfg.idempotencyHeader) ?? undefined)
+        : undefined;
+    cfg.onAtom(parsed.data, idempotencyKey);
+    return new Response(JSON.stringify({ ok: true }), {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' },
+    });
+}
+//# sourceMappingURL=handler.js.map

package/dist/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../src/handler.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAGzC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AACvD,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAcrC,SAAS,SAAS,CAAC,MAAc,EAAE,IAAY,EAAE,OAAe;IAC9D,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE;QAChE,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAY,EACZ,GAAwB;IAExB,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,IAAI,mBAAmB,CAAC;IACjE,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,IAAI,oBAAoB,CAAC;IAChE,MAAM,kBAAkB,GAAG,GAAG,CAAC,MAAM,EAAE,kBAAkB,IAAK,CAAC,IAAI,CAAW,CAAC;IAE/E,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,SAAS,CAAC,GAAG,EAAE,mBAAmB,EAAE,4BAA4B,UAAU,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAEjC,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE;QAC1D,SAAS;QACT,kBAAkB;KACnB,CAAC,CAAC;IAEH,IAAI,YAAY,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACjC,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,IAAI,SAAkB,CAAC;IACvB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,GAAG,EAAE,YAAY,EAAE,gCAAgC,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,OAAO,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,cAAc,GAAG,GAAG,CAAC,iBAAiB;QAC1C,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC;QACvD,CAAC,CAAC,SAAS,CAAC;IAEd,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAExC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;QAChD,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export type { RawHandlerConfig } from './handler.js';
+export { createRawHandler } from './handler.js';
+export type { WebhookHandler, WebhookSource, WebhookSourceConfig, WebhookVerifyConfig, } from './webhook-source.js';
+export { createWebhookSource } from './webhook-source.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,YAAY,EACV,cAAc,EACd,aAAa,EACb,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export { createRawHandler } from './handler.js';
+export { createWebhookSource } from './webhook-source.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAOhD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/webhook-source.d.ts

@@ -0,0 +1,33 @@
+import { type RetryPolicy, type Source } from '@idriszade/core';
+import { Hono } from 'hono';
+import type { ZodType } from 'zod';
+export type WebhookHandler = (req: Request) => Promise<Response>;
+export interface WebhookVerifyConfig {
+    /** Timestamp drift tolerance in ms. Default 300_000 (5 min). */
+    tolerance?: number;
+    /** HMAC algorithm variants to accept. Default ['v1']. */
+    acceptedAlgorithms?: ('v1' | 'v2')[];
+    /** Header to read the signature from. Default 'X-Pipeline-Kit-Signature'. */
+    headerName?: string;
+}
+export interface WebhookSourceConfig<O> {
+    id?: string;
+    /** HTTP path to register, e.g. '/webhooks/stripe'. */
+    path: string;
+    /** HMAC secret used to verify incoming requests. */
+    secret: string;
+    /** Zod schema to parse and validate the request body. */
+    schema: ZodType<O>;
+    verify?: WebhookVerifyConfig;
+    /** Header name whose value is used as idempotency key on buffered atoms. */
+    idempotencyHeader?: string;
+    retryPolicy?: Partial<RetryPolicy>;
+}
+export interface WebhookSource<O> extends Source<O> {
+    /** Pre-wired Hono app with the POST route registered. */
+    readonly app: Hono;
+    /** Raw web-standards handler — delegates to the Hono app. */
+    readonly handler: WebhookHandler;
+}
+export declare function createWebhookSource<O>(config: WebhookSourceConfig<O>): WebhookSource<O>;
+//# sourceMappingURL=webhook-source.d.ts.map

package/dist/webhook-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-source.d.ts","sourceRoot":"","sources":["../src/webhook-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,WAAW,EAChB,KAAK,MAAM,EAKZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAMnC,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEjE,MAAM,WAAW,mBAAmB;IAClC,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,kBAAkB,CAAC,EAAE,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;IACrC,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB,CAAC,CAAC;IACpC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,4EAA4E;IAC5E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,aAAa,CAAC,CAAC,CAAE,SAAQ,MAAM,CAAC,CAAC,CAAC;IACjD,yDAAyD;IACzD,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IACnB,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;CAClC;AASD,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CA4GvF"}

package/dist/webhook-source.js

@@ -0,0 +1,102 @@
+import { atom as atomId, ok, src as srcId, verify, } from '@idriszade/core';
+import { Hono } from 'hono';
+import { AsyncQueue } from './async-queue.js';
+const DEFAULT_HEADER_NAME = 'X-Pipeline-Kit-Signature';
+const DEFAULT_TOLERANCE_MS = 300_000;
+function jsonError(status, code, message) {
+    return new Response(JSON.stringify({ error: { code, message } }), {
+        status,
+        headers: { 'Content-Type': 'application/json' },
+    });
+}
+export function createWebhookSource(config) {
+    const resolvedId = config.id ?? srcId();
+    const headerName = config.verify?.headerName ?? DEFAULT_HEADER_NAME;
+    const tolerance = config.verify?.tolerance ?? DEFAULT_TOLERANCE_MS;
+    const acceptedAlgorithms = config.verify?.acceptedAlgorithms ?? ['v1'];
+    // Internal buffer shared between the HTTP handler and iter/fetch callers.
+    const queue = new AsyncQueue();
+    const app = new Hono();
+    app.post(config.path, async (c) => {
+        const sigHeader = c.req.header(headerName);
+        if (!sigHeader) {
+            return jsonError(400, 'missing_signature', `Missing required header: ${headerName}`);
+        }
+        const rawBody = await c.req.text();
+        // HMAC verification — we re-use core's verify but only for sig + timestamp.
+        // The schema parse below validates the actual payload shape, so we tolerate
+        // non-PipelineKitEvent bodies by calling the lower-level path.
+        // core's verify() also JSON.parses and type-checks for PipelineKitEvent.
+        // For arbitrary schemas we just need sig + timestamp check, then let Zod run.
+        const verifyResult = verify(rawBody, sigHeader, config.secret, {
+            tolerance,
+            acceptedAlgorithms,
+        });
+        if (verifyResult.error !== null) {
+            const e = verifyResult.error;
+            if (e.type === 'expired_timestamp') {
+                return jsonError(400, e.code, e.message);
+            }
+            if (e.type === 'missing_secret' || e.type === 'malformed_header') {
+                return jsonError(400, e.code, e.message);
+            }
+            if (e.type === 'invalid_signature') {
+                return jsonError(400, e.code, e.message);
+            }
+            // invalid_payload from JSON/event-type check is fine — we'll re-parse with Zod below.
+            if (e.type !== 'invalid_payload') {
+                return jsonError(400, e.code, e.message);
+            }
+        }
+        // Parse raw JSON for schema validation.
+        let rawParsed;
+        try {
+            rawParsed = JSON.parse(rawBody);
+        }
+        catch {
+            return jsonError(400, 'json_parse', 'Request body is not valid JSON');
+        }
+        const parsed = config.schema.safeParse(rawParsed);
+        if (!parsed.success) {
+            const message = parsed.error.issues.map((i) => i.message).join('; ');
+            return jsonError(400, 'schema_mismatch', message);
+        }
+        const idempotencyKey = config.idempotencyHeader
+            ? c.req.header(config.idempotencyHeader)
+            : undefined;
+        const atomItem = {
+            id: atomId(),
+            object: 'atom',
+            created_at: new Date().toISOString(),
+            metadata: idempotencyKey ? { idempotency_key: idempotencyKey } : {},
+            data: parsed.data,
+            source_id: resolvedId,
+        };
+        queue.push(atomItem);
+        return new Response(JSON.stringify({ id: atomItem.id, object: 'atom' }), {
+            status: 200,
+            headers: { 'Content-Type': 'application/json' },
+        });
+    });
+    async function* iterImpl(_query, ctx) {
+        for await (const item of queue[Symbol.asyncIterator](ctx.signal)) {
+            yield item;
+        }
+    }
+    async function fetchImpl(_query, _ctx) {
+        // Non-blocking snapshot drain — returns whatever is buffered and clears it.
+        const buffered = queue.drain();
+        return ok(buffered);
+    }
+    const handler = (req) => Promise.resolve(app.fetch(req));
+    return {
+        id: resolvedId,
+        schema: config.schema,
+        retryPolicy: config.retryPolicy,
+        app,
+        handler,
+        iter: iterImpl,
+        fetch: fetchImpl,
+    };
+}
+//# sourceMappingURL=webhook-source.js.map

package/dist/webhook-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-source.js","sourceRoot":"","sources":["../src/webhook-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,IAAI,IAAI,MAAM,EACd,EAAE,EAOF,GAAG,IAAI,KAAK,EACZ,MAAM,GACP,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AACvD,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAkCrC,SAAS,SAAS,CAAC,MAAc,EAAE,IAAY,EAAE,OAAe;IAC9D,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE;QAChE,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAI,MAA8B;IACnE,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,IAAI,KAAK,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,mBAAmB,CAAC;IACpE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,IAAI,oBAAoB,CAAC;IACnE,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,IAAK,CAAC,IAAI,CAAW,CAAC;IAElF,0EAA0E;IAC1E,MAAM,KAAK,GAAG,IAAI,UAAU,EAAW,CAAC;IAExC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,SAAS,CAAC,GAAG,EAAE,mBAAmB,EAAE,4BAA4B,UAAU,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAEnC,4EAA4E;QAC5E,4EAA4E;QAC5E,+DAA+D;QAC/D,yEAAyE;QACzE,8EAA8E;QAC9E,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE;YAC7D,SAAS;YACT,kBAAkB;SACnB,CAAC,CAAC;QAEH,IAAI,YAAY,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC;YAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBACnC,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YAC3C,CAAC;YACD,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACjE,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YAC3C,CAAC;YACD,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBACnC,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YAC3C,CAAC;YACD,sFAAsF;YACtF,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBACjC,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,IAAI,SAAkB,CAAC;QACvB,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,GAAG,EAAE,YAAY,EAAE,gCAAgC,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrE,OAAO,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,CAAC,iBAAiB;YAC7C,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC;YACxC,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,QAAQ,GAAY;YACxB,EAAE,EAAE,MAAM,EAAE;YACZ,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE;YACnE,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,UAAU;SACtB,CAAC;QAEF,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAErB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE;YACvE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,KAAK,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAmB,EAAE,GAAoB;QAChE,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC;QACb,CAAC;IACH,CAAC;IAED,KAAK,UAAU,SAAS,CACtB,MAAmB,EACnB,IAAqB;QAErB,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,OAAO,GAAmB,CAAC,GAAY,EAAqB,EAAE,CAClE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAElC,OAAO;QACL,EAAE,EAAE,UAAU;QACd,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG;QACH,OAAO;QACP,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,SAAS;KACjB,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@idriszade/source-webhook",
+  "version": "0.1.0",
+  "description": "Pipeline-kit Source adapter for receiving inbound webhooks via Hono",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "keywords": [
+    "pipeline-kit",
+    "source",
+    "automation"
+  ],
+  "dependencies": {
+    "@hono/zod-validator": "^0.7.6",
+    "hono": "^4.9.0",
+    "zod": "^4.4.3",
+    "@idriszade/core": "0.1.0"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit"
+  }
+}