@samva/webhooks 0.1.1

package/AGENTS.md

@@ -0,0 +1,11 @@
+# Samva webhooks consumer guide
+
+Use `verifyRequest` from `@samva/webhooks` in the server or edge handler that receives a Samva
+webhook. Verification requires the untouched request body and the endpoint signing secret; never
+expose that secret to browser code.
+
+Effect applications can import the typed adapter from `@samva/webhooks/effect` and install the
+optional exact peer `effect@4.0.0-beta.102`.
+
+Import only package subpaths declared in `package.json`. The delivery, queue, persistence, retry,
+and endpoint-management implementation is not part of this package.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Arya Labs, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,24 @@
+# `@samva/webhooks`
+
+Verify signed Samva webhook deliveries in Node.js, Bun, Cloudflare Workers, and other Web
+Crypto-compatible runtimes.
+
+```ts
+import { verifyRequest } from "@samva/webhooks";
+
+const event = await verifyRequest(request, process.env.SAMVA_WEBHOOK_SECRET!);
+```
+
+Verification reads the exact request body, validates the Standard Webhooks signature and replay
+window, and returns the verified event envelope. Preserve the raw request body and keep the signing
+secret on the server.
+
+Effect applications can use the optional Effect entrypoint:
+
+```ts
+import * as Webhooks from "@samva/webhooks/effect";
+
+const event = yield * Webhooks.verifyRequest(request, secret);
+```
+
+Install the exact optional peer `effect@4.0.0-beta.102` when using that entrypoint.

package/dist/effect.d.ts

@@ -0,0 +1,10 @@
+import { Effect } from "effect";
+import type { VerifyOptions } from "./promise.js";
+import { type AnyWebhookVerificationError } from "./protocol.js";
+export declare const verify: (options: VerifyOptions) => Effect.Effect<import("./protocol.js").VerifiedWebhook, AnyWebhookVerificationError, never>;
+export declare const verifyRequest: (request: Request, secret: string, options?: {
+    readonly toleranceSeconds?: number | undefined;
+} | undefined) => Effect.Effect<import("./protocol.js").VerifiedWebhook, AnyWebhookVerificationError, never>;
+export { DEFAULT_TOLERANCE_SECONDS, WEBHOOK_ID_HEADER, WEBHOOK_SIGNATURE_HEADER, WEBHOOK_TIMESTAMP_HEADER, generateWebhookSecret, signWebhook, } from "./protocol.js";
+export type { AnyWebhookVerificationError, SamvaWebhookEvent, VerifiedWebhook, } from "./protocol.js";
+export { InvalidWebhookHeadersError, InvalidWebhookSecretError, MalformedWebhookPayloadError, WebhookCryptoError, WebhookSignatureError, WebhookTimestampError, WebhookVerificationError, } from "./protocol.js";

package/dist/effect.js

@@ -0,0 +1,41 @@
+import { _ as WebhookTimestampError, c as signWebhook, f as InvalidWebhookHeadersError, g as WebhookSignatureError, h as WebhookCryptoError, i as WEBHOOK_TIMESTAMP_HEADER, l as verifyWebhookAt, m as MalformedWebhookPayloadError, n as WEBHOOK_ID_HEADER, o as generateWebhookSecret, p as InvalidWebhookSecretError, r as WEBHOOK_SIGNATURE_HEADER, s as readWebhookHeaders, t as DEFAULT_TOLERANCE_SECONDS, v as WebhookVerificationError } from "./protocol-M4mOvMtW.js";
+import { Clock, Effect } from "effect";
+//#region src/effect.ts
+const verify = Effect.fn("Webhooks.verify")(function* (options) {
+	const nowMilliseconds = yield* Clock.currentTimeMillis;
+	return yield* Effect.tryPromise({
+		try: () => verifyWebhookAt({
+			body: options.body,
+			headers: {
+				id: options.id,
+				timestamp: options.timestamp,
+				signature: options.signature
+			},
+			secret: options.secret,
+			toleranceSeconds: options.toleranceSeconds,
+			nowMilliseconds
+		}),
+		catch: (error) => error
+	});
+});
+const verifyRequest = Effect.fn("Webhooks.verifyRequest")(function* (request, secret, options) {
+	const nowMilliseconds = yield* Clock.currentTimeMillis;
+	const body = yield* Effect.tryPromise({
+		try: async () => new Uint8Array(await request.clone().arrayBuffer()),
+		catch: () => new WebhookCryptoError({ detail: "Unable to read webhook request body" })
+	});
+	return yield* Effect.tryPromise({
+		try: () => verifyWebhookAt({
+			body,
+			headers: readWebhookHeaders(request.headers),
+			secret,
+			toleranceSeconds: options?.toleranceSeconds,
+			nowMilliseconds
+		}),
+		catch: (error) => error
+	});
+});
+//#endregion
+export { DEFAULT_TOLERANCE_SECONDS, InvalidWebhookHeadersError, InvalidWebhookSecretError, MalformedWebhookPayloadError, WEBHOOK_ID_HEADER, WEBHOOK_SIGNATURE_HEADER, WEBHOOK_TIMESTAMP_HEADER, WebhookCryptoError, WebhookSignatureError, WebhookTimestampError, WebhookVerificationError, generateWebhookSecret, signWebhook, verify, verifyRequest };
+
+//# sourceMappingURL=effect.js.map

package/dist/errors.d.ts

@@ -0,0 +1,28 @@
+interface WebhookVerificationFailureOptions {
+    readonly detail: string;
+}
+export declare abstract class WebhookVerificationError<Tag extends string = string> extends Error {
+    readonly _tag: Tag;
+    readonly detail: string;
+    protected constructor(tag: Tag, options: WebhookVerificationFailureOptions);
+}
+export declare class InvalidWebhookSecretError extends WebhookVerificationError<"InvalidWebhookSecretError"> {
+    constructor(options: WebhookVerificationFailureOptions);
+}
+export declare class InvalidWebhookHeadersError extends WebhookVerificationError<"InvalidWebhookHeadersError"> {
+    constructor(options: WebhookVerificationFailureOptions);
+}
+export declare class WebhookTimestampError extends WebhookVerificationError<"WebhookTimestampError"> {
+    constructor(options: WebhookVerificationFailureOptions);
+}
+export declare class WebhookSignatureError extends WebhookVerificationError<"WebhookSignatureError"> {
+    constructor(options: WebhookVerificationFailureOptions);
+}
+export declare class MalformedWebhookPayloadError extends WebhookVerificationError<"MalformedWebhookPayloadError"> {
+    constructor(options: WebhookVerificationFailureOptions);
+}
+export declare class WebhookCryptoError extends WebhookVerificationError<"WebhookCryptoError"> {
+    constructor(options: WebhookVerificationFailureOptions);
+}
+export type AnyWebhookVerificationError = InvalidWebhookSecretError | InvalidWebhookHeadersError | WebhookTimestampError | WebhookSignatureError | MalformedWebhookPayloadError | WebhookCryptoError;
+export {};

package/dist/promise.d.ts

@@ -0,0 +1,23 @@
+import { type AnyWebhookVerificationError, type VerifiedWebhook } from "./protocol.js";
+export interface VerifyOptions {
+    readonly body: string | Uint8Array;
+    readonly id: string;
+    readonly timestamp: string;
+    readonly signature: string;
+    readonly secret: string;
+    readonly toleranceSeconds?: number | undefined;
+}
+export declare const verify: (options: VerifyOptions) => Promise<VerifiedWebhook>;
+export declare const verifyRequest: (request: Request, secret: string, options?: {
+    readonly toleranceSeconds?: number | undefined;
+}) => Promise<VerifiedWebhook>;
+export declare const safeVerify: (options: VerifyOptions) => Promise<{
+    readonly verified: true;
+    readonly value: VerifiedWebhook;
+} | {
+    readonly verified: false;
+    readonly error: AnyWebhookVerificationError;
+}>;
+export { DEFAULT_TOLERANCE_SECONDS, WEBHOOK_ID_HEADER, WEBHOOK_SIGNATURE_HEADER, WEBHOOK_TIMESTAMP_HEADER, generateWebhookSecret, signWebhook, } from "./protocol.js";
+export type { AnyWebhookVerificationError, SamvaWebhookEvent, VerifiedWebhook, } from "./protocol.js";
+export { InvalidWebhookHeadersError, InvalidWebhookSecretError, MalformedWebhookPayloadError, WebhookCryptoError, WebhookSignatureError, WebhookTimestampError, WebhookVerificationError, } from "./protocol.js";

package/dist/promise.js

@@ -0,0 +1,37 @@
+import { _ as WebhookTimestampError, c as signWebhook, f as InvalidWebhookHeadersError, g as WebhookSignatureError, h as WebhookCryptoError, i as WEBHOOK_TIMESTAMP_HEADER, l as verifyWebhookAt, m as MalformedWebhookPayloadError, n as WEBHOOK_ID_HEADER, o as generateWebhookSecret, p as InvalidWebhookSecretError, r as WEBHOOK_SIGNATURE_HEADER, s as readWebhookHeaders, t as DEFAULT_TOLERANCE_SECONDS, v as WebhookVerificationError } from "./protocol-M4mOvMtW.js";
+//#region src/promise.ts
+const verify = (options) => verifyWebhookAt({
+	body: options.body,
+	headers: {
+		id: options.id,
+		timestamp: options.timestamp,
+		signature: options.signature
+	},
+	secret: options.secret,
+	toleranceSeconds: options.toleranceSeconds,
+	nowMilliseconds: Date.now()
+});
+const verifyRequest = async (request, secret, options) => verifyWebhookAt({
+	body: new Uint8Array(await request.clone().arrayBuffer()),
+	headers: readWebhookHeaders(request.headers),
+	secret,
+	toleranceSeconds: options?.toleranceSeconds,
+	nowMilliseconds: Date.now()
+});
+const safeVerify = async (options) => {
+	try {
+		return {
+			verified: true,
+			value: await verify(options)
+		};
+	} catch (error) {
+		return {
+			verified: false,
+			error
+		};
+	}
+};
+//#endregion
+export { DEFAULT_TOLERANCE_SECONDS, InvalidWebhookHeadersError, InvalidWebhookSecretError, MalformedWebhookPayloadError, WEBHOOK_ID_HEADER, WEBHOOK_SIGNATURE_HEADER, WEBHOOK_TIMESTAMP_HEADER, WebhookCryptoError, WebhookSignatureError, WebhookTimestampError, WebhookVerificationError, generateWebhookSecret, safeVerify, signWebhook, verify, verifyRequest };
+
+//# sourceMappingURL=promise.js.map

package/dist/protocol-M4mOvMtW.js

@@ -0,0 +1,210 @@
+//#region src/errors.ts
+var WebhookVerificationError = class extends Error {
+	_tag;
+	detail;
+	constructor(tag, options) {
+		super(options.detail);
+		this.name = tag;
+		this._tag = tag;
+		this.detail = options.detail;
+	}
+};
+var InvalidWebhookSecretError = class extends WebhookVerificationError {
+	constructor(options) {
+		super("InvalidWebhookSecretError", options);
+	}
+};
+var InvalidWebhookHeadersError = class extends WebhookVerificationError {
+	constructor(options) {
+		super("InvalidWebhookHeadersError", options);
+	}
+};
+var WebhookTimestampError = class extends WebhookVerificationError {
+	constructor(options) {
+		super("WebhookTimestampError", options);
+	}
+};
+var WebhookSignatureError = class extends WebhookVerificationError {
+	constructor(options) {
+		super("WebhookSignatureError", options);
+	}
+};
+var MalformedWebhookPayloadError = class extends WebhookVerificationError {
+	constructor(options) {
+		super("MalformedWebhookPayloadError", options);
+	}
+};
+var WebhookCryptoError = class extends WebhookVerificationError {
+	constructor(options) {
+		super("WebhookCryptoError", options);
+	}
+};
+//#endregion
+//#region src/protocol.ts
+const WEBHOOK_ID_HEADER = "webhook-id";
+const WEBHOOK_TIMESTAMP_HEADER = "webhook-timestamp";
+const WEBHOOK_SIGNATURE_HEADER = "webhook-signature";
+const DEFAULT_TOLERANCE_SECONDS = 300;
+const SECRET_PREFIX = "whsec_";
+const ASYMMETRIC_ALGORITHM = {
+	name: "RSASSA-PKCS1-v1_5",
+	hash: "SHA-256"
+};
+const MINIMUM_SECRET_BYTES = 24;
+const MAXIMUM_SECRET_BYTES = 64;
+const GENERATED_SECRET_BYTES = 32;
+const encoder = new TextEncoder();
+const toBytes = (body) => typeof body === "string" ? encoder.encode(body) : body;
+const toCryptoBytes = (bytes) => new Uint8Array(bytes);
+const bytesToBase64 = (bytes) => {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary);
+};
+const base64ToBytes = (encoded) => {
+	const binary = atob(encoded);
+	return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+};
+const decodeSecret = (secret) => {
+	if (!secret.startsWith(SECRET_PREFIX)) throw new InvalidWebhookSecretError({ detail: "Webhook secret must start with whsec_" });
+	const decoded = (() => {
+		try {
+			return base64ToBytes(secret.slice(6));
+		} catch {
+			throw new InvalidWebhookSecretError({ detail: "Webhook secret is not valid Base64" });
+		}
+	})();
+	if (decoded.byteLength < MINIMUM_SECRET_BYTES || decoded.byteLength > MAXIMUM_SECRET_BYTES) throw new InvalidWebhookSecretError({ detail: `Webhook secret must decode to ${MINIMUM_SECRET_BYTES}-${MAXIMUM_SECRET_BYTES} bytes` });
+	return decoded;
+};
+const importHmacKey = async (secret) => {
+	const secretBytes = decodeSecret(secret);
+	try {
+		return await crypto.subtle.importKey("raw", toCryptoBytes(secretBytes), {
+			name: "HMAC",
+			hash: "SHA-256"
+		}, false, ["sign"]);
+	} catch (cause) {
+		throw new WebhookCryptoError({ detail: `Unable to import webhook signing key: ${cause instanceof Error ? cause.message : String(cause)}` });
+	}
+};
+const importVerificationKey = async (publicKey) => {
+	try {
+		return await crypto.subtle.importKey("spki", toCryptoBytes(base64ToBytes(publicKey.trim())), ASYMMETRIC_ALGORITHM, false, ["verify"]);
+	} catch {
+		return;
+	}
+};
+const signedBytes = (id, timestamp, body) => {
+	const prefix = encoder.encode(`${id}.${timestamp}.`);
+	const material = new Uint8Array(prefix.byteLength + body.byteLength);
+	material.set(prefix);
+	material.set(body, prefix.byteLength);
+	return material;
+};
+const hmac = async (secret, id, timestamp, body) => {
+	const key = await importHmacKey(secret);
+	try {
+		return new Uint8Array(await crypto.subtle.sign("HMAC", key, toCryptoBytes(signedBytes(id, timestamp, body))));
+	} catch (cause) {
+		throw new WebhookCryptoError({ detail: `Unable to sign webhook: ${cause instanceof Error ? cause.message : String(cause)}` });
+	}
+};
+const asymmetricMatch = async (key, candidate, content) => {
+	try {
+		return await crypto.subtle.verify(ASYMMETRIC_ALGORITHM, key, toCryptoBytes(candidate), content);
+	} catch {
+		return false;
+	}
+};
+const timingSafeEqual = (left, right) => {
+	if (left.byteLength !== right.byteLength) return false;
+	let difference = 0;
+	for (let index = 0; index < left.byteLength; index += 1) difference |= (left[index] ?? 0) ^ (right[index] ?? 0);
+	return difference === 0;
+};
+const signatureCandidates = (header, expected) => header.split(" ").map((candidate) => candidate.split(",", 2)).flatMap(([version, encoded]) => {
+	if (version !== expected || encoded === void 0) return [];
+	try {
+		return [base64ToBytes(encoded)];
+	} catch {
+		return [];
+	}
+});
+const parseEvent = (body) => {
+	try {
+		const parsed = JSON.parse(new TextDecoder("utf-8", {
+			fatal: true,
+			ignoreBOM: false
+		}).decode(body));
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new MalformedWebhookPayloadError({ detail: "Webhook event must be an object" });
+		const event = parsed;
+		const keys = Object.keys(event);
+		if (keys.length !== 3 || !keys.every((key) => key === "type" || key === "timestamp" || key === "data") || typeof event.type !== "string" || typeof event.timestamp !== "string" || !("data" in event)) throw new MalformedWebhookPayloadError({ detail: "Webhook event has an invalid envelope" });
+		return {
+			type: event.type,
+			timestamp: event.timestamp,
+			data: event.data
+		};
+	} catch {
+		throw new MalformedWebhookPayloadError({ detail: "Webhook body must be valid UTF-8 JSON containing type, timestamp, and data" });
+	}
+};
+const generateWebhookSecret = () => {
+	const bytes = crypto.getRandomValues(new Uint8Array(GENERATED_SECRET_BYTES));
+	return `${SECRET_PREFIX}${bytesToBase64(bytes)}`;
+};
+const webhookSignedContent = (input) => signedBytes(input.id, input.timestamp, toBytes(input.body));
+const encodeWebhookSignature = (version, signature) => `${version},${bytesToBase64(signature)}`;
+const signWebhook = async (input) => {
+	const timestamp = String(input.timestamp);
+	const signature = await hmac(input.secret, input.id, timestamp, toBytes(input.body));
+	return encodeWebhookSignature("v1", signature);
+};
+const freshHeaders = (input) => {
+	const { id, timestamp, signature } = input.headers;
+	if (id.length === 0 || timestamp.length === 0 || signature.length === 0) throw new InvalidWebhookHeadersError({ detail: "webhook-id, webhook-timestamp, and webhook-signature are required" });
+	const timestampSeconds = Number(timestamp);
+	if (!Number.isInteger(timestampSeconds)) throw new WebhookTimestampError({ detail: "webhook-timestamp must be Unix seconds" });
+	const toleranceSeconds = input.toleranceSeconds ?? 300;
+	if (!Number.isFinite(toleranceSeconds) || toleranceSeconds < 0) throw new WebhookTimestampError({ detail: "Webhook tolerance must be non-negative" });
+	if (Math.abs(input.nowMilliseconds / 1e3 - timestampSeconds) > toleranceSeconds) throw new WebhookTimestampError({ detail: "Webhook timestamp is outside the replay tolerance" });
+	return {
+		id,
+		timestamp,
+		signature
+	};
+};
+const verifyWebhookAt = async (input) => {
+	const { id, timestamp, signature } = freshHeaders(input);
+	const body = toBytes(input.body);
+	const expected = await hmac(input.secret, id, timestamp, body);
+	if (!signatureCandidates(signature, "v1").some((candidate) => timingSafeEqual(expected, candidate))) throw new WebhookSignatureError({ detail: "Webhook signature verification failed" });
+	return {
+		id,
+		event: parseEvent(body)
+	};
+};
+const verifyWebhookAtWithPublicKeys = async (input) => {
+	const { id, timestamp, signature } = freshHeaders(input);
+	if (input.publicKeys.length === 0) throw new WebhookSignatureError({ detail: "No webhook verification key is available" });
+	const keys = (await Promise.all(input.publicKeys.map(importVerificationKey))).filter((key) => key !== void 0);
+	if (keys.length === 0) throw new WebhookCryptoError({ detail: "Unable to import any webhook verification key: keys must be Base64 SPKI DER" });
+	const body = toBytes(input.body);
+	const content = toCryptoBytes(signedBytes(id, timestamp, body));
+	const candidates = signatureCandidates(signature, "v2");
+	if (!(await Promise.all(keys.flatMap((key) => candidates.map((candidate) => asymmetricMatch(key, candidate, content))))).includes(true)) throw new WebhookSignatureError({ detail: "Webhook signature verification failed" });
+	return {
+		id,
+		event: parseEvent(body)
+	};
+};
+const readWebhookHeaders = (headers) => ({
+	id: headers.get("webhook-id") ?? "",
+	timestamp: headers.get("webhook-timestamp") ?? "",
+	signature: headers.get("webhook-signature") ?? ""
+});
+//#endregion
+export { WebhookTimestampError as _, encodeWebhookSignature as a, signWebhook as c, webhookSignedContent as d, InvalidWebhookHeadersError as f, WebhookSignatureError as g, WebhookCryptoError as h, WEBHOOK_TIMESTAMP_HEADER as i, verifyWebhookAt as l, MalformedWebhookPayloadError as m, WEBHOOK_ID_HEADER as n, generateWebhookSecret as o, InvalidWebhookSecretError as p, WEBHOOK_SIGNATURE_HEADER as r, readWebhookHeaders as s, DEFAULT_TOLERANCE_SECONDS as t, verifyWebhookAtWithPublicKeys as u, WebhookVerificationError as v };
+
+//# sourceMappingURL=protocol-M4mOvMtW.js.map

package/dist/protocol.d.ts

@@ -0,0 +1,46 @@
+export declare const WEBHOOK_ID_HEADER = "webhook-id";
+export declare const WEBHOOK_TIMESTAMP_HEADER = "webhook-timestamp";
+export declare const WEBHOOK_SIGNATURE_HEADER = "webhook-signature";
+export declare const DEFAULT_TOLERANCE_SECONDS = 300;
+export interface SamvaWebhookEvent {
+    readonly type: string;
+    readonly timestamp: string;
+    readonly data: unknown;
+}
+export interface VerifiedWebhook {
+    readonly id: string;
+    readonly event: SamvaWebhookEvent;
+}
+export interface WebhookHeaders {
+    readonly id: string;
+    readonly timestamp: string;
+    readonly signature: string;
+}
+export interface VerifyWebhookInput {
+    readonly body: string | Uint8Array;
+    readonly headers: WebhookHeaders;
+    readonly secret: string;
+    readonly toleranceSeconds?: number | undefined;
+    readonly nowMilliseconds: number;
+}
+export type WebhookSignatureVersion = "v1" | "v2";
+export declare const generateWebhookSecret: () => string;
+export declare const webhookSignedContent: (input: {
+    readonly id: string;
+    readonly timestamp: string;
+    readonly body: string | Uint8Array;
+}) => Uint8Array;
+export declare const encodeWebhookSignature: (version: WebhookSignatureVersion, signature: Uint8Array) => string;
+export declare const signWebhook: (input: {
+    readonly body: string | Uint8Array;
+    readonly id: string;
+    readonly timestamp: string | number;
+    readonly secret: string;
+}) => Promise<string>;
+export declare const verifyWebhookAt: (input: VerifyWebhookInput) => Promise<VerifiedWebhook>;
+export declare const verifyWebhookAtWithPublicKeys: (input: Omit<VerifyWebhookInput, "secret"> & {
+    readonly publicKeys: ReadonlyArray<string>;
+}) => Promise<VerifiedWebhook>;
+export declare const readWebhookHeaders: (headers: Headers) => WebhookHeaders;
+export { InvalidWebhookHeadersError, InvalidWebhookSecretError, MalformedWebhookPayloadError, WebhookCryptoError, WebhookSignatureError, WebhookTimestampError, WebhookVerificationError, } from "./errors.js";
+export type { AnyWebhookVerificationError } from "./errors.js";

package/dist/protocol.js

@@ -0,0 +1,2 @@
+import { _ as WebhookTimestampError, a as encodeWebhookSignature, c as signWebhook, d as webhookSignedContent, f as InvalidWebhookHeadersError, g as WebhookSignatureError, h as WebhookCryptoError, i as WEBHOOK_TIMESTAMP_HEADER, l as verifyWebhookAt, m as MalformedWebhookPayloadError, n as WEBHOOK_ID_HEADER, o as generateWebhookSecret, p as InvalidWebhookSecretError, r as WEBHOOK_SIGNATURE_HEADER, s as readWebhookHeaders, t as DEFAULT_TOLERANCE_SECONDS, u as verifyWebhookAtWithPublicKeys, v as WebhookVerificationError } from "./protocol-M4mOvMtW.js";
+export { DEFAULT_TOLERANCE_SECONDS, InvalidWebhookHeadersError, InvalidWebhookSecretError, MalformedWebhookPayloadError, WEBHOOK_ID_HEADER, WEBHOOK_SIGNATURE_HEADER, WEBHOOK_TIMESTAMP_HEADER, WebhookCryptoError, WebhookSignatureError, WebhookTimestampError, WebhookVerificationError, encodeWebhookSignature, generateWebhookSecret, readWebhookHeaders, signWebhook, verifyWebhookAt, verifyWebhookAtWithPublicKeys, webhookSignedContent };

package/package.json

@@ -0,0 +1,78 @@
+{
+  "name": "@samva/webhooks",
+  "version": "0.1.1",
+  "description": "Runtime-neutral verification for Samva webhook deliveries",
+  "keywords": [
+    "samva",
+    "standard-webhooks",
+    "typescript",
+    "webcrypto",
+    "webhooks"
+  ],
+  "homepage": "https://samva.dev",
+  "bugs": {
+    "url": "https://github.com/AryaLabsHQ/samva/issues"
+  },
+  "license": "MIT",
+  "author": "Arya Labs, Inc.",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/AryaLabsHQ/samva.git",
+    "directory": "packages/webhooks"
+  },
+  "files": [
+    "dist",
+    "!dist/**/*.map",
+    "package.json",
+    "README.md",
+    "AGENTS.md",
+    "LICENSE"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/promise.d.ts",
+      "import": "./dist/promise.js"
+    },
+    "./promise": {
+      "types": "./dist/promise.d.ts",
+      "import": "./dist/promise.js"
+    },
+    "./effect": {
+      "types": "./dist/effect.d.ts",
+      "import": "./dist/effect.js"
+    },
+    "./protocol": {
+      "types": "./dist/protocol.d.ts",
+      "import": "./dist/protocol.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsdown && tsc --project tsconfig.build.json",
+    "prepack": "bun run build",
+    "test": "vitest run --root ../.. --project packages packages/webhooks/tests",
+    "typecheck": "tsgo --noEmit"
+  },
+  "devDependencies": {
+    "@effect/vitest": "4.0.0-beta.102",
+    "effect": "4.0.0-beta.102",
+    "tsdown": "^0.22.13",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.10"
+  },
+  "peerDependencies": {
+    "effect": "4.0.0-beta.102"
+  },
+  "peerDependenciesMeta": {
+    "effect": {
+      "optional": true
+    }
+  },
+  "engines": {
+    "node": ">=22"
+  }
+}