@polymorfa/nextjs 0.1.0-dev.20260922094209

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Polymorfa
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,224 @@
+# `@polymorfa/nextjs`
+
+Server-only helpers for Next.js App Router handlers. The package uses the Web
+`Request` and `Response` APIs, so it does not add Next.js as a runtime dependency.
+
+## Drop-in handler
+
+`createPolymorfaHandler` serves every drop-in route from one catch-all
+route, `app/api/polymorfa/[...route]/route.ts`:
+
+```ts
+import { MessagingClient, constructWebhookEvent } from "@polymorfa/sdk";
+import { createPolymorfaHandler } from "@polymorfa/nextjs";
+
+export const { GET, POST } = createPolymorfaHandler({
+  polymorfa: new MessagingClient({
+    credential: { type: "apiKey", value: process.env.POLYMORFA_API_KEY! },
+  }),
+  authenticate: (request) => currentUser(request), // your auth; null → 401
+  mint: (user) => ({
+    session: "support",
+    conversations: user.assignedConversationIds, // or "all"
+    allow: ["read_messages", "subscribe_events", "send_message"],
+    ttlSeconds: 600,
+  }),
+  webhooks: {
+    secret: process.env.POLYMORFA_WEBHOOK_SECRET!,
+    constructEvent: constructWebhookEvent,
+    onEvent: saveEvent,
+  },
+  history: { conversations: listConversations, messages: listMessages },
+  events: streamEvents,
+});
+```
+
+`mint` is required and is the only place permissions are chosen. It returns
+`null` to refuse (`403`). There is no default that grants everything: `allow`
+and `conversations` must be explicit. The handler calls `authenticate` and
+`mint` on every request, so revoked access takes effect on the next call. The
+browser never sends permissions, and the API key never leaves the server.
+
+| Route                                | Method | Needs                               | Purpose                                                   |
+| ------------------------------------ | ------ | ----------------------------------- | --------------------------------------------------------- |
+| `token`                              | POST   | signed-in user                      | Mints a client token and returns it with the grant        |
+| `webhooks`                           | POST   | signature                           | Verifies the raw body, then calls `onEvent`               |
+| `media/:id`                          | GET    | `read_messages` + `media.authorize` | Reuses `createMediaDownloadRoute` modes                   |
+| `history/conversations`              | GET    | `read_messages`                     | Your list, filtered to the grant                          |
+| `history/conversations/:id/messages` | GET    | `read_messages`                     | `404` outside the grant                                   |
+| `history/conversations/:id/contact`  | GET    | `read_contact`                      | Contact panel data                                        |
+| `events`                             | GET    | `subscribe_events`                  | Server-sent events, filtered by session and conversations |
+| `connect`                            | POST   | `connect_whatsapp`                  | Creates a QuickLink; the browser gets only the hosted URL |
+| `templates`                          | POST   | `manage_templates`                  | The template builder route plus `list`                    |
+
+Enforcement: the Polymorfa API enforces the client-token actions (`send_*`,
+`read_presence`, `subscribe_presence`, `read_contact`, `voip_*`). Session
+tokens carry the session's client rules; `allow` narrows them in the API only
+for Customer tokens (`customer`, beta), where the handler forwards the API
+actions in `allow`. The handler enforces `read_messages`,
+`subscribe_events`, `connect_whatsapp`, `manage_templates` and
+`conversations` on its own routes. A Customer grant with no API action is
+refused rather than minted with the session rules. For Customer grants your
+`events` source must return only that Customer's events.
+
+`createDevelopmentInboxStore()` keeps webhook events in memory and serves
+them as `history` and `events`, so `<Inbox/>` works before you build
+storage. It is lost on restart and not shared between instances; replace it
+with your database before production.
+
+### Express and Hono
+
+The handler uses Fetch `Request` and `Response`, so other servers need only an
+adapter:
+
+```ts
+import { toExpress } from "@polymorfa/nextjs/express";
+app.use("/api/polymorfa", toExpress(handler)); // before express.json()
+
+import { toHono } from "@polymorfa/nextjs/hono";
+app.all("/api/polymorfa/*", toHono(handler));
+```
+
+Mount `toExpress` before `express.json()`: webhook signatures are checked
+against the raw body.
+
+`createClientTokenRoute` requires an application-owned authorization callback.
+`createMessagingClientTokenMint` adapts the real server SDK response to the
+browser claim shape. Never send a server API key or messaging credential to the
+browser.
+
+```ts
+import { MessagingClient } from "@polymorfa/sdk";
+import {
+  createClientTokenRoute,
+  createMessagingClientTokenMint,
+} from "@polymorfa/nextjs";
+
+const messaging = new MessagingClient({
+  credential: { type: "apiKey", value: process.env.POLYMORFA_API_KEY! },
+});
+
+export const POST = createClientTokenRoute({
+  authorize: async (request) => authorizeApplicationUser(request),
+  mint: createMessagingClientTokenMint({
+    clientTokens: messaging.clientTokens,
+    resolve: async (subject) => ({
+      session: "support",
+      ephemeralId: subject.userId,
+      ttlSeconds: 600,
+    }),
+  }),
+});
+```
+
+Browser calls use this same route. `POST /platform/client-tokens` is the only
+way to mint a client token, so `@polymorfa/sdk/calls` and `@polymorfa/browser`
+receive the token from `messaging.clientTokens.mint`. The path the browser
+posts to is your own route; `createClientTokenProvider` defaults to
+`/api/polymorfa/token`. Grant the session's client rules the Calls actions
+the browser needs: `voip_place` to place calls and add participants,
+`voip_answer` to accept or decline, and `voip_signal` for signaling, ending a
+call, and the call lifecycle socket.
+
+The server key that mints tokens needs all client delegation scopes:
+`sessions:manage`, `messages:write`, `contacts:read`, `presence:read`,
+`presence:observe`, and `mcp`.
+
+To mint one token for the numbers a Customer owns (beta), return `customer`
+instead of `session` from `resolve`. The server key also needs
+`customers:read`. Resolve the Customer ID on your server from the signed-in
+user; never take it from the request body.
+
+```ts
+resolve: async (subject) => ({
+  customer: await customerIdForUser(subject.userId),
+  ephemeralId: subject.userId,
+  allow: ["send_message", "read_presence"],
+}),
+```
+
+The adapter throws before minting when both or neither of `session` and
+`customer` are set, or when `allow` is set without `customer`; the route then
+answers `500 token_mint_failed`.
+
+`createTemplateBuilderRoute` pairs the browser template transport with
+`MessagingClient.templates`. The application authorizes every request and
+resolves both project scope and the Cloud API submission session on the server.
+
+```ts
+import { MessagingClient } from "@polymorfa/sdk";
+import { createTemplateBuilderRoute } from "@polymorfa/nextjs";
+
+const messaging = new MessagingClient({
+  credential: { type: "apiKey", value: process.env.POLYMORFA_API_KEY! },
+});
+
+export const POST = createTemplateBuilderRoute({
+  templates: messaging.templates,
+  authorize: async (request) => authorizeApplicationUser(request),
+  resolveProjectSlug: async (subject) => projectSlugFor(subject.projectId),
+  resolveSubmissionSession: async (subject) =>
+    cloudSessionFor(subject.projectId),
+});
+```
+
+Browser request bodies cannot override either resolver. Responses are private,
+non-cacheable, and server failures are returned without credential or internal
+error details.
+
+`createMediaDownloadRoute` serves Messaging media to signed-in users. Its
+`authorize` callback is required, and the route denies with `403` when the
+callback returns `null`, throws, or returns an invalid grant. Look up the
+media in your own records inside `authorize` instead of trusting an ID from
+the URL.
+
+```ts
+import { MessagingClient } from "@polymorfa/sdk";
+import { createMediaDownloadRoute } from "@polymorfa/nextjs";
+
+const messaging = new MessagingClient({
+  credential: { type: "apiKey", value: process.env.POLYMORFA_API_KEY! },
+});
+
+export const GET = createMediaDownloadRoute({
+  client: messaging,
+  mode: "proxy", // or "redirect" | "whatsapp"
+  authorize: async (request) => {
+    const attachment = await attachmentForUser(request);
+    return attachment ? { mediaId: attachment.polymorfaMediaId } : null;
+  },
+});
+```
+
+| Mode       | Behavior                                                                                                                                                          |
+| ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `redirect` | Answers `302` with the short-lived signed storage URL. If the API streams that file instead, the route proxies it.                                                |
+| `proxy`    | Streams the bytes through your route.                                                                                                                             |
+| `whatsapp` | Downloads and decrypts the file from the WhatsApp CDN on the server. `authorize` returns `{ message: { type, media } }`, loaded from your stored webhook payload. |
+
+The route accepts only `GET`. Every response carries `Cache-Control: private,
+no-store`, `X-Content-Type-Options: nosniff` and `Referrer-Policy:
+no-referrer`. Proxied responses also carry `Content-Security-Policy: sandbox`.
+Common image, audio and video types (`INLINE_MEDIA_TYPES`, which excludes SVG)
+are served `inline` with their normalized MIME type. All other types are served
+as `application/octet-stream` with `Content-Disposition: attachment`. Filenames
+are sanitized and sent with an RFC 6266 `filename*` parameter. The route
+returns `404` when the media is missing and `502` for any other upstream
+failure, with no upstream details. Redirect mode hands the signed URL to the
+browser, so use it only when the user may hold that link until it expires.
+
+`readVerifiedWebhook` preserves the raw request body and delegates verification
+to `constructWebhookEvent` from `@polymorfa/sdk`.
+
+```ts
+import { constructWebhookEvent } from "@polymorfa/sdk";
+import { readVerifiedWebhook } from "@polymorfa/nextjs";
+
+export async function POST(request: Request) {
+  const event = await readVerifiedWebhook(request, {
+    constructEvent: constructWebhookEvent,
+    secret: process.env.POLYMORFA_WEBHOOK_SECRET!,
+  });
+  return Response.json({ received: event.id });
+}
+```

package/dist/development-store.d.ts

@@ -0,0 +1,35 @@
+import type { HistoryConversation, HistoryMessage, HistoryPage, PolymorfaRouteContext, RelayEvent } from "./handler.js";
+export interface DevelopmentInboxStoreOptions {
+    /** Conversations kept. Default 200. */
+    readonly maxConversations?: number;
+    /** Messages kept per conversation. Default 500. */
+    readonly maxMessages?: number;
+    /** Events kept for `Last-Event-ID` resume. Default 500. */
+    readonly replay?: number;
+}
+export interface DevelopmentInboxStore {
+    /** Pass as `webhooks.onEvent`: files verified webhook events. */
+    readonly record: (event: unknown) => void;
+    /** Pass as `history`. */
+    readonly history: {
+        conversations(context: PolymorfaRouteContext<unknown>, page: {
+            readonly cursor?: string;
+        }): Promise<HistoryPage<HistoryConversation>>;
+        messages(context: PolymorfaRouteContext<unknown>, conversationId: string, page: {
+            readonly cursor?: string;
+        }): Promise<HistoryPage<HistoryMessage>>;
+    };
+    /** Pass as `events`: live relay with `Last-Event-ID` resume. */
+    readonly events: (context: PolymorfaRouteContext<unknown> & {
+        readonly lastEventId?: string;
+    }) => AsyncIterable<RelayEvent>;
+}
+/**
+ * An in-memory inbox for local development and the quickstart: it files
+ * webhook events so `<Inbox/>` has history and live updates before you
+ * build your own storage. Data lives in this process only and is lost on
+ * restart; each server instance has its own copy. Replace it with your
+ * database before production.
+ */
+export declare function createDevelopmentInboxStore(options?: DevelopmentInboxStoreOptions): DevelopmentInboxStore;
+//# sourceMappingURL=development-store.d.ts.map

package/dist/development-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"development-store.d.ts","sourceRoot":"","sources":["../src/development-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,cAAc,EACd,WAAW,EACX,qBAAqB,EACrB,UAAU,EACX,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,4BAA4B;IAC3C,uCAAuC;IACvC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,mDAAmD;IACnD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,iEAAiE;IACjE,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAC1C,yBAAyB;IACzB,QAAQ,CAAC,OAAO,EAAE;QAChB,aAAa,CACX,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC,EACvC,IAAI,EAAE;YAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,GACjC,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC7C,QAAQ,CACN,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC,EACvC,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE;YAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,GACjC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC;KACzC,CAAC;IACF,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,CACf,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC,GAAG;QAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,KACxE,aAAa,CAAC,UAAU,CAAC,CAAC;CAChC;AASD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,4BAAiC,GACzC,qBAAqB,CAuJvB"}

package/dist/development-store.js

@@ -0,0 +1,186 @@
+const PAGE = 50;
+/**
+ * An in-memory inbox for local development and the quickstart: it files
+ * webhook events so `<Inbox/>` has history and live updates before you
+ * build your own storage. Data lives in this process only and is lost on
+ * restart; each server instance has its own copy. Replace it with your
+ * database before production.
+ */
+export function createDevelopmentInboxStore(options = {}) {
+    const maxConversations = options.maxConversations ?? 200;
+    const maxMessages = options.maxMessages ?? 500;
+    const replay = options.replay ?? 500;
+    const conversations = new Map();
+    const recent = [];
+    const listeners = new Set();
+    const record = (value) => {
+        const event = asEvent(value);
+        if (event === undefined)
+            return;
+        recent.push(event);
+        if (recent.length > replay)
+            recent.shift();
+        fileMessage(event);
+        for (const listener of [...listeners])
+            listener(event);
+    };
+    function fileMessage(event) {
+        if (event.event !== "message.received" && event.event !== "message.sent")
+            return;
+        const payload = event.payload;
+        const target = payload?.conversation;
+        if (typeof payload?.id !== "string" || typeof target?.id !== "string")
+            return;
+        const createdAt = time(payload.timestamp) ?? time(event.timestamp) ?? Date.now();
+        const direction = payload.fromMe === true || event.event === "message.sent"
+            ? "outbound"
+            : "inbound";
+        const text = typeof payload.text === "string"
+            ? payload.text
+            : typeof payload.caption === "string"
+                ? payload.caption
+                : "";
+        let conversation = conversations.get(target.id);
+        if (conversation === undefined) {
+            conversation = {
+                row: { id: target.id, lastActivity: 0, unreadCount: 0 },
+                messages: [],
+            };
+            conversations.set(target.id, conversation);
+            if (conversations.size > maxConversations) {
+                const oldest = [...conversations.values()].sort((a, b) => a.row.lastActivity - b.row.lastActivity)[0];
+                if (oldest !== undefined)
+                    conversations.delete(oldest.row.id);
+            }
+        }
+        const existing = conversation.messages.findIndex((message) => message.id === payload.id);
+        const message = {
+            id: payload.id,
+            text,
+            createdAt,
+            direction,
+            status: "sent",
+        };
+        if (existing >= 0)
+            conversation.messages[existing] = message;
+        else {
+            conversation.messages.push(message);
+            conversation.messages.sort((a, b) => a.createdAt - b.createdAt);
+            if (conversation.messages.length > maxMessages)
+                conversation.messages.shift();
+        }
+        const name = direction === "inbound" && typeof payload.pushName === "string"
+            ? payload.pushName
+            : conversation.row.name;
+        const phone = typeof target.phoneNumber === "string"
+            ? target.phoneNumber
+            : conversation.row.phoneNumber;
+        conversation.row = {
+            id: target.id,
+            session: event.session,
+            ...(name === undefined ? {} : { name }),
+            ...(phone === undefined ? {} : { phoneNumber: phone }),
+            lastMessage: { text, createdAt, direction },
+            lastActivity: Math.max(conversation.row.lastActivity, createdAt),
+            unreadCount: conversation.row.unreadCount +
+                (direction === "inbound" && existing < 0 ? 1 : 0),
+        };
+    }
+    return {
+        record,
+        history: {
+            async conversations(_context, page) {
+                const rows = [...conversations.values()]
+                    .map((conversation) => conversation.row)
+                    .sort((a, b) => b.lastActivity - a.lastActivity);
+                return slice(rows, page.cursor);
+            },
+            async messages(_context, conversationId, page) {
+                // Newest page first; the cursor walks back in time.
+                const messages = conversations.get(conversationId)?.messages ?? [];
+                const end = page.cursor === undefined ? messages.length : Number(page.cursor);
+                const start = Math.max(0, end - PAGE);
+                return {
+                    data: messages.slice(start, end),
+                    nextCursor: start > 0 ? String(start) : null,
+                };
+            },
+        },
+        events(context) {
+            return {
+                [Symbol.asyncIterator]() {
+                    const queue = [];
+                    let wake;
+                    let done = false;
+                    const resumeAt = context.lastEventId === undefined
+                        ? -1
+                        : recent.findIndex((event) => event.id === context.lastEventId);
+                    if (resumeAt >= 0)
+                        queue.push(...recent.slice(resumeAt + 1));
+                    const listener = (event) => {
+                        queue.push(event);
+                        wake?.();
+                    };
+                    listeners.add(listener);
+                    const finish = () => {
+                        done = true;
+                        listeners.delete(listener);
+                        wake?.();
+                    };
+                    context.signal.addEventListener("abort", finish, { once: true });
+                    return {
+                        async next() {
+                            while (queue.length === 0 && !done)
+                                await new Promise((resolve) => (wake = resolve));
+                            wake = undefined;
+                            const value = queue.shift();
+                            return value === undefined
+                                ? { done: true, value: undefined }
+                                : { done: false, value };
+                        },
+                        async return() {
+                            finish();
+                            return { done: true, value: undefined };
+                        },
+                    };
+                },
+            };
+        },
+    };
+}
+function slice(rows, cursor) {
+    const start = cursor === undefined ? 0 : Number(cursor) || 0;
+    const end = start + PAGE;
+    return {
+        data: rows.slice(start, end),
+        nextCursor: end < rows.length ? String(end) : null,
+    };
+}
+function time(value) {
+    if (typeof value === "number" && Number.isFinite(value))
+        // Webhook timestamps are Unix seconds.
+        return value < 1e12 ? value * 1000 : value;
+    if (typeof value === "string") {
+        const parsed = Date.parse(value);
+        return Number.isFinite(parsed) ? parsed : undefined;
+    }
+    return undefined;
+}
+function asEvent(value) {
+    if (typeof value !== "object" || value === null)
+        return undefined;
+    const event = value;
+    if (typeof event.id !== "string" ||
+        typeof event.event !== "string" ||
+        typeof event.session !== "string")
+        return undefined;
+    return {
+        id: event.id,
+        session: event.session,
+        event: event.event,
+        timestamp: typeof event.timestamp === "string"
+            ? event.timestamp
+            : new Date().toISOString(),
+        payload: event.payload,
+    };
+}

package/dist/express.d.ts

@@ -0,0 +1,21 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { PolymorfaHandler } from "./handler.js";
+type NodeRequest = IncomingMessage & {
+    /** Express sets this to the URL including the mount path. */
+    readonly originalUrl?: string;
+    /** Set by a body parser. Only a raw `Buffer` or string can be forwarded. */
+    readonly body?: unknown;
+};
+/**
+ * Serves a Polymorfa handler from Express or plain `node:http`:
+ *
+ * ```ts
+ * app.use("/api/polymorfa", toExpress(handler));
+ * ```
+ *
+ * Mount it before `express.json()`, or use `express.raw()` for this path:
+ * webhook signatures are checked against the raw body.
+ */
+export declare function toExpress(handler: PolymorfaHandler): (request: NodeRequest, response: ServerResponse, next?: (error?: unknown) => void) => Promise<void>;
+export {};
+//# sourceMappingURL=express.d.ts.map

package/dist/express.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAGjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,KAAK,WAAW,GAAG,eAAe,GAAG;IACnC,6DAA6D;IAC7D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CACvB,OAAO,EAAE,gBAAgB,GACxB,CACD,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,cAAc,EACxB,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,KAC7B,OAAO,CAAC,IAAI,CAAC,CAuCjB"}

package/dist/express.js

@@ -0,0 +1,92 @@
+import { Readable } from "node:stream";
+/**
+ * Serves a Polymorfa handler from Express or plain `node:http`:
+ *
+ * ```ts
+ * app.use("/api/polymorfa", toExpress(handler));
+ * ```
+ *
+ * Mount it before `express.json()`, or use `express.raw()` for this path:
+ * webhook signatures are checked against the raw body.
+ */
+export function toExpress(handler) {
+    return async (request, response, next) => {
+        const abort = new AbortController();
+        response.on("close", () => {
+            if (!response.writableFinished)
+                abort.abort();
+        });
+        try {
+            const webResponse = await handler.handle(toRequest(request, abort.signal));
+            response.statusCode = webResponse.status;
+            webResponse.headers.forEach((value, name) => {
+                response.setHeader(name, value);
+            });
+            if (webResponse.body === null) {
+                response.end();
+                return;
+            }
+            response.flushHeaders?.();
+            const reader = webResponse.body.getReader();
+            abort.signal.addEventListener("abort", () => {
+                void reader.cancel().catch(() => undefined);
+            });
+            for (;;) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                if (!response.write(value))
+                    await new Promise((resolve) => response.once("drain", resolve));
+            }
+            response.end();
+        }
+        catch (error) {
+            if (abort.signal.aborted)
+                return;
+            if (next !== undefined)
+                next(error);
+            else if (!response.headersSent) {
+                response.statusCode = 500;
+                response.end();
+            }
+            else
+                response.destroy();
+        }
+    };
+}
+function toRequest(request, signal) {
+    const host = request.headers.host ?? "localhost";
+    const encrypted = request.socket.encrypted;
+    const url = new URL(request.originalUrl ?? request.url ?? "/", `${encrypted === true ? "https" : "http"}://${host}`);
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(request.headers)) {
+        if (value === undefined)
+            continue;
+        if (Array.isArray(value))
+            for (const item of value)
+                headers.append(name, item);
+        else
+            headers.set(name, value);
+    }
+    const method = (request.method ?? "GET").toUpperCase();
+    if (method === "GET" || method === "HEAD")
+        return new Request(url, { method, headers, signal });
+    let body;
+    if (Buffer.isBuffer(request.body))
+        body = new Uint8Array(request.body);
+    else if (typeof request.body === "string")
+        body = request.body;
+    else if (request.readableEnded)
+        // A JSON body parser already ran. Re-encoding works for JSON routes;
+        // webhook signatures fail, so mount toExpress() before express.json().
+        body = request.body === undefined ? "" : JSON.stringify(request.body);
+    else
+        body = Readable.toWeb(request);
+    return new Request(url, {
+        method,
+        headers,
+        body,
+        signal,
+        duplex: "half",
+    });
+}