@usequeek/app-sdk 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -2,6 +2,36 @@
 
 All notable changes to `@usequeek/app-sdk` are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [0.5.0] - 2026-09-29
+
+Framework-agnostic core: the install handoff and webhook receivers no longer require Hono.
+
+### Changed
+
+- **BREAKING:** `createInstallHandlers` and `createWebhookHandler` moved from the package root to
+  the `@usequeek/app-sdk/hono` subpath (thin wrappers over the new core — same options objects,
+  same behaviour, same errors/status codes). Migration:
+  `import { createInstallHandlers } from "@usequeek/app-sdk/hono"`. `hono` is now an optional
+  peer (`peerDependenciesMeta: { hono: { optional: true } }`), so non-Hono apps install zero
+  framework code. `./server` keeps working as today.
+- The root entry is framework-free in three thin layers, each a wrapper over the one below:
+  layer 1 `handleInstallDelivery(input, options)` / `handleWebhookDelivery(input, options)` take
+  untouched body bytes + headers (`Record` or `Headers`, case-insensitive, array-tolerant) plus
+  method/path where the install endpoints genuinely need them, and return plain
+  `{ status, body }` — zero request/response types, so whatever request object each framework
+  supports works; layer 2 `handleInstallRequest` / `handleWebhookRequest` adapt the Web-standard
+  `Request` → `Response` onto layer 1; layer 3 `@usequeek/app-sdk/hono` adapts Hono onto layer 2.
+
+### Added
+
+- `delivery.ts`: `CoreDelivery` / `InstallDelivery` / `DeliveryResult` / `CoreHeaders` plus
+  `readHeader`, `decodeBody`, `toResponse`.
+- `hono.ts` behind the `./hono` export: the Hono wrappers.
+- `scripts/verify-package.mjs` now proves the split in two sandboxes: the root entry plus
+  `./server` work with NO `hono` installed and NO framework at all (layer 1 is called directly
+  with a `Buffer` + plain headers; importing `/hono` there fails — the proof the root carries
+  zero framework imports), while `/hono` works with it.
+
 ## [0.2.0] - 2026-09-25
 
 GitHub-style app credentials (slice S1 of `app-credentials-and-databases`, built against the

package/README.md

@@ -1,26 +1,27 @@
 # @usequeek/app-sdk
 
-The SDK for building a Queek app on the public Merchant API and signed webhooks. Hono route helpers for the install handoff and topic webhooks, a typed Merchant API client (types generated from the live contract), GitHub-style app credentials (one asymmetric key per app, short-lived per-installation tokens minted on demand), resync recovery, and an encrypted installation store (SQLite for local/test, Postgres in production).
+The SDK for building a Queek app on the public Merchant API and signed webhooks. Framework-agnostic Web-standard handlers for the install handoff and topic webhooks (`Request` in, `Response` out — use them from Next.js route handlers, Express, or any runtime), a typed Merchant API client (types generated from the live contract), GitHub-style app credentials (one asymmetric key per app, short-lived per-installation tokens minted on demand), resync recovery, and an encrypted installation store (SQLite for local/test, Postgres in production). Optional Hono wrappers live under `@usequeek/app-sdk/hono`.
 
 ```sh
-npm i @usequeek/app-sdk hono pg
+npm i @usequeek/app-sdk pg
 ```
 
-Requires Node `>=22.14`. `hono` is a peer dependency so your app never carries two copies. `pg` is a regular dependency (the production store).
+Requires Node `>=22.14`. `pg` is a regular dependency (the production store). `hono` is an optional peer — install it (`npm i hono`) only if you use the Hono wrappers.
 
-## Example
+The shape follows [`@shopify/shopify-api`](https://github.com/Shopify/shopify-app-js/blob/main/packages/apps/shopify-api/README.md): the core "doesn't rely on any specific framework, so you can include it alongside your preferred stack" (runtime differences are covered by adapters such as `@shopify/shopify-api/adapters/node`), and framework integrations are separate packages in the [shopify-app-js monorepo](https://github.com/Shopify/shopify-app-js) (e.g. `@shopify/shopify-app-express` and `@shopify/shopify-app-remix` build on `@shopify/shopify-api`).
 
-A minimal app: health check, install/uninstall/settings handlers, and one webhook topic:
+## Example (any framework)
+
+A minimal app with plain Web-standard handlers — no framework import:
 
 ```ts
 import {
   createAppTokenProvider,
-  createInstallHandlers,
-  createWebhookHandler,
+  handleInstallRequest,
+  handleWebhookRequest,
   loadAppCredential,
   SqliteInstallationStore,
 } from "@usequeek/app-sdk";
-import { Hono } from "hono";
 
 const store = new SqliteInstallationStore({
   path: "./data/installations.db",
@@ -30,6 +31,118 @@ const tokens = createAppTokenProvider({
   credential: loadAppCredential({ appSlug: "hello" }), // APP_SLUG/APP_KEY_ID/APP_PRIVATE_KEY
   store,
 });
+const installOptions = { appSecret: process.env.QUEEK_APP_SECRET!, store };
+const webhookOptions = {
+  store,
+  handlers: {
+    "orders/updated": async (envelope, context) => {
+      console.log("order update:", context.installation.storePid, envelope.data);
+    },
+  },
+};
+```
+
+Next.js App Router — one route file per handoff path (`handleInstallRequest` routes on the request URL's trailing `install` / `uninstall` / `settings` segment, so one shared options object serves all three):
+
+```ts
+// app/api/install/route.ts (and uninstall/route.ts, settings/route.ts likewise)
+import { installOptions } from "./options";
+
+export async function POST(request: Request) {
+  return handleInstallRequest(request, installOptions);
+}
+
+// app/api/webhooks/route.ts
+import { webhookOptions } from "./options";
+
+export async function POST(request: Request) {
+  return handleWebhookRequest(request, webhookOptions);
+}
+```
+
+### Express (no new package)
+
+Express hands you whatever request object it supports — pass its raw body bytes and headers straight to the layer-1 core (no `Request` construction needed). Keep the untouched bytes Queek signed with the built-in `express.raw` parser:
+
+```ts
+import express from "express";
+import {
+  type DeliveryResult,
+  handleInstallDelivery,
+  handleWebhookDelivery,
+} from "@usequeek/app-sdk";
+
+const app = express();
+app.use("/api", express.raw({ type: "application/json" }));
+
+function reply(res: express.Response, result: DeliveryResult) {
+  res.status(result.status).json(result.body);
+}
+
+for (const route of ["install", "uninstall", "settings"]) {
+  app.post(`/api/${route}`, async (req, res) => {
+    reply(
+      res,
+      await handleInstallDelivery(
+        { rawBody: req.body as Buffer, headers: req.headers, method: req.method, path: req.path },
+        installOptions,
+      ),
+    );
+  });
+}
+app.post("/api/webhooks", async (req, res) => {
+  reply(
+    res,
+    await handleWebhookDelivery({ rawBody: req.body as Buffer, headers: req.headers }, webhookOptions),
+  );
+});
+```
+
+### Fastify (no new package)
+
+Same idea — keep the body raw with `addContentTypeParser`, then call the core directly:
+
+```ts
+import Fastify from "fastify";
+import { handleWebhookDelivery } from "@usequeek/app-sdk";
+
+const fastify = Fastify();
+fastify.addContentTypeParser("application/json", { parseAs: "buffer" }, (_req, body, done) => {
+  done(null, body);
+});
+
+fastify.post("/api/webhooks", async (req, reply) => {
+  const result = await handleWebhookDelivery(
+    { rawBody: req.body as Buffer, headers: req.headers },
+    webhookOptions,
+  );
+  return reply.status(result.status).send(result.body);
+});
+```
+
+### Why the raw body matters
+
+Signature verification covers the exact bytes Queek sent (`{id}.{timestamp}.{body}`), not the parsed JSON value — so the SDK takes the untouched body bytes at every layer. A parsed-then-restringified body has different bytes (spacing, key order) and will NOT verify. A string `rawBody` is used verbatim, so only pass a string when it is already the exact UTF-8 text — otherwise prefer `Buffer`/`Uint8Array` straight from `express.raw`, Fastify's `parseAs: "buffer"`, or `await request.arrayBuffer()`. This is Stripe's model (`stripe.webhooks.constructEvent(rawBody, sigHeader, secret)`): [their docs](https://docs.stripe.com/webhooks) put it bluntly — "Stripe requires the raw body of the request to perform signature verification… Any manipulation to the raw body of the request causes the verification to fail." In practice: Express needs `express.raw(...)` (never `express.json()`) on webhook routes, Fastify needs `addContentTypeParser` with `parseAs: "buffer"`, and in Next.js you read `await request.arrayBuffer()` (the SDK's layer 2 already does) rather than `await request.json()`.
+
+### Body-size posture
+
+The SDK itself imposes no maximum body size (`arrayBuffer` / `TextDecoder` / `JSON.parse` are unbounded, as in 0.4.0) — the cap belongs to the framework parser in front of it, which already rejects oversized bodies before the SDK ever sees them. Queek deliveries are small JSON payloads, so the framework defaults are plenty; if you set them explicitly, `express.raw({ type: "application/json", limit: "1mb" })` and Fastify's default `bodyLimit` of 1 MiB are the recommended ceilings. No SDK option is needed unless Queek ever ships large deliveries.
+
+(If you already run Hono on Node, `@hono/node-server`'s `getRequestListener` bridges serving for you — but the adapters above need no extra dependency.)
+
+### Hono
+
+Prefer Hono? The thin wrappers under `@usequeek/app-sdk/hono` (same options, same behaviour, same errors/status codes) mount the same core:
+
+```ts
+import { SqliteInstallationStore } from "@usequeek/app-sdk";
+import { createInstallHandlers, createWebhookHandler } from "@usequeek/app-sdk/hono";
+import { Hono } from "hono";
+
+const store = new SqliteInstallationStore({
+  path: "./data/installations.db",
+  storeKey: process.env.APP_ENCRYPTION_KEY!,
+});
 
 const app = new Hono();
 app.get("/health", (c) => c.json({ ok: true }));
@@ -49,6 +162,8 @@ app.route(
 export default app;
 ```
 
+> Migrating from 0.4.x: `import { createInstallHandlers } from "@usequeek/app-sdk/hono"` — the creators moved out of the root entry so non-Hono apps never install `hono`. The options objects are unchanged.
+
 Every Merchant API call goes through `createInstallationClient({ installationId, apiBase, tokens })`,
 which resolves the installation's token via `acquireToken()` and sends it as `X-Client-Key`.
 
@@ -148,9 +263,10 @@ retries (~4 h) are gone; resync cannot backfill them. Full runbook: `docs/deploy
   429 `resync_cooldown` → skip + record; other 429 → backoff + retry) → drop tokens →
   purge absent except known-pending. Connectivity scope only.
 - **verify** (`signatures.ts`): `verifyQueekSignature` — Standard Webhooks verification (`webhook-id`, `webhook-timestamp`, `webhook-signature` over `{id}.{timestamp}.{body}`, keyed by the decoded `whsec_…` bytes), with timestamp-skew enforcement.
-- **install handlers** (`install-handlers.ts`): `createInstallHandlers({ appSecret, store, onInstall?, onUninstall?, onSettings? })` — serves the signed install/uninstall/settings handoff. Defaults persist the installation (encrypted) in the store; a redelivered install for an existing installation merges idempotently (`saveResyncedInstallation`).
+- **delivery core** (`delivery.ts`): `CoreDelivery` (`rawBody` + `headers`) / `InstallDelivery` (+ `method`/`path`) / `DeliveryResult` (`{ status, body }`) / `CoreHeaders`, plus `readHeader` (case-insensitive, array-tolerant), `decodeBody`, and `toResponse`. Zero request/response types.
+- **install handlers** (`install-handlers.ts`): layer 1 `handleInstallDelivery(input, { appSecret, store, onInstall?, onUninstall?, onSettings? })` serves the signed install/uninstall/settings handoff from raw bytes + headers (routes on the path's trailing segment); layer 2 `handleInstallRequest(request, …)` adapts `Request` → `Response` onto it. Defaults persist the installation (encrypted) in the store; a redelivered install for an existing installation merges idempotently (`saveResyncedInstallation`). The Hono wrapper `createInstallHandlers` lives under `@usequeek/app-sdk/hono` (`hono.ts`).
 - **client** (`client.ts`): `createQueekClient({ apiBase, apiKey })` — the low-level typed fetch client over the Merchant API (`X-Client-Key`), with `Idempotency-Key` on writes, typed `QueekApiError`s, and 429 retry helpers. Types come from `openapi/merchant.json`, the committed snapshot of the live contract. Prefer `createInstallationClient` in apps.
-- **webhooks** (`webhooks.ts`): `createWebhookHandler({ store, handlers })` — verifies each delivery against the installation's endpoint secret, dedupes on `webhook-id`, and dispatches `topic → handler` at most once.
+- **webhooks** (`webhooks.ts`): layer 1 `handleWebhookDelivery(input, { store, handlers })` verifies each delivery against the installation's endpoint secret, dedupes on `webhook-id`, and dispatches `topic → handler` at most once; layer 2 `handleWebhookRequest(request, …)` adapts `Request` → `Response` onto it. The Hono wrapper `createWebhookHandler` lives under `@usequeek/app-sdk/hono` (`hono.ts`).
 - **store** (`store.ts`): `SqliteInstallationStore` (local/dev/test) and `PostgresInstallationStore`
   (`pg`, pool max 2, advisory-locked schema + `schema_version` row so two containers boot
   safely) — installations encrypted at rest (AES-GCM via `APP_ENCRYPTION_KEY`), plus the

package/dist/delivery.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Shared plumbing for the framework-free delivery core (layer 1).
+ *
+ * Layer 1 functions take plain data — untouched body bytes plus headers —
+ * and return plain `{ status, body }` results. They reference zero
+ * request/response types (no `Request`, no framework), so any framework
+ * that can hand over the raw body bytes can use them. Layer 2
+ * (`handleInstallRequest` / `handleWebhookRequest`) adapts the Web
+ * standard onto this core; `@usequeek/app-sdk/hono` adapts Hono onto
+ * layer 2.
+ *
+ * The raw-body rule (Stripe's model:
+ * `stripe.webhooks.constructEvent(rawBody, sigHeader, secret)` —
+ * https://docs.stripe.com/webhooks: "Stripe requires the raw body of the
+ * request to perform signature verification… Any manipulation to the raw
+ * body of the request causes the verification to fail"): `rawBody` must be
+ * the exact bytes Queek signed. Never pass a parsed-then-restringified
+ * body — JSON re-serialization changes bytes (spacing, key order) and the
+ * signature will not verify.
+ */
+/** Headers as any framework holds them: a `Headers` instance, or a plain object (Express-style: lowercased keys, array values allowed). */
+export type CoreHeaders = Record<string, string | string[] | undefined> | Headers;
+/** The framework-free delivery input both core handlers take. */
+export interface CoreDelivery {
+    /** The untouched body bytes Queek signed (string is used verbatim; binary is UTF-8-decoded). */
+    rawBody: Uint8Array | Buffer | string;
+    headers: CoreHeaders;
+}
+/** Layer-1 input for the install handoff, which genuinely needs routing. */
+export interface InstallDelivery extends CoreDelivery {
+    /** Defaults to `"POST"`. Anything else answers 405. */
+    method?: string;
+    /** Request path (`/install`, …) or full URL — routes on the trailing `install` / `uninstall` / `settings` segment. */
+    path?: string;
+}
+/** What the layer-1 core returns: an HTTP status plus a JSON-serializable body. */
+export interface DeliveryResult {
+    status: number;
+    body: unknown;
+    headers?: Record<string, string>;
+}
+/** Case-insensitive header lookup across `Headers` and plain (possibly lowercased, possibly array-valued) objects. */
+export declare function readHeader(headers: CoreHeaders, name: string): string | undefined;
+/** Decode untouched body bytes to the exact string Queek signed. */
+export declare function decodeBody(rawBody: Uint8Array | Buffer | string): string;
+/** Build the layer-2 `Response` from a layer-1 result. */
+export declare function toResponse(result: DeliveryResult): Response;
+//# sourceMappingURL=delivery.d.ts.map

package/dist/delivery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery.d.ts","sourceRoot":"","sources":["../src/delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,2IAA2I;AAC3I,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC;AAElF,iEAAiE;AACjE,MAAM,WAAW,YAAY;IAC3B,gGAAgG;IAChG,OAAO,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAAC;IACtC,OAAO,EAAE,WAAW,CAAC;CACtB;AAED,4EAA4E;AAC5E,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sHAAsH;IACtH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,sHAAsH;AACtH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAYjF;AAED,oEAAoE;AACpE,wBAAgB,UAAU,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAGxE;AAED,0DAA0D;AAC1D,wBAAgB,UAAU,CAAC,MAAM,EAAE,cAAc,GAAG,QAAQ,CAE3D"}

package/dist/delivery.js

@@ -0,0 +1,46 @@
+/**
+ * Shared plumbing for the framework-free delivery core (layer 1).
+ *
+ * Layer 1 functions take plain data — untouched body bytes plus headers —
+ * and return plain `{ status, body }` results. They reference zero
+ * request/response types (no `Request`, no framework), so any framework
+ * that can hand over the raw body bytes can use them. Layer 2
+ * (`handleInstallRequest` / `handleWebhookRequest`) adapts the Web
+ * standard onto this core; `@usequeek/app-sdk/hono` adapts Hono onto
+ * layer 2.
+ *
+ * The raw-body rule (Stripe's model:
+ * `stripe.webhooks.constructEvent(rawBody, sigHeader, secret)` —
+ * https://docs.stripe.com/webhooks: "Stripe requires the raw body of the
+ * request to perform signature verification… Any manipulation to the raw
+ * body of the request causes the verification to fail"): `rawBody` must be
+ * the exact bytes Queek signed. Never pass a parsed-then-restringified
+ * body — JSON re-serialization changes bytes (spacing, key order) and the
+ * signature will not verify.
+ */
+/** Case-insensitive header lookup across `Headers` and plain (possibly lowercased, possibly array-valued) objects. */
+export function readHeader(headers, name) {
+    if (headers instanceof Headers) {
+        return headers.get(name) ?? undefined;
+    }
+    const want = name.toLowerCase();
+    for (const [key, value] of Object.entries(headers)) {
+        if (key.toLowerCase() === want) {
+            if (value === undefined)
+                return undefined;
+            return Array.isArray(value) ? value[0] : value;
+        }
+    }
+    return undefined;
+}
+/** Decode untouched body bytes to the exact string Queek signed. */
+export function decodeBody(rawBody) {
+    if (typeof rawBody === "string")
+        return rawBody;
+    return new TextDecoder("utf-8").decode(rawBody);
+}
+/** Build the layer-2 `Response` from a layer-1 result. */
+export function toResponse(result) {
+    return Response.json(result.body, { status: result.status, headers: result.headers });
+}
+//# sourceMappingURL=delivery.js.map

package/dist/delivery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery.js","sourceRoot":"","sources":["../src/delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AA2BH,sHAAsH;AACtH,MAAM,UAAU,UAAU,CAAC,OAAoB,EAAE,IAAY;IAC3D,IAAI,OAAO,YAAY,OAAO,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IACxC,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;YAC/B,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,UAAU,CAAC,OAAqC;IAC9D,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,UAAU,CAAC,MAAsB;IAC/C,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;AACxF,CAAC"}

package/dist/hono.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Optional Hono integration for `@usequeek/app-sdk`.
+ *
+ * Import from `@usequeek/app-sdk/hono` (requires the optional `hono` peer):
+ * `createInstallHandlers` and `createWebhookHandler` are thin wrappers
+ * built ONLY on the layer-2 Web-standard handlers (`handleInstallRequest`
+ * / `handleWebhookRequest` in the root entry) — same options objects, same
+ * behaviour, same errors/status codes.
+ */
+import { Hono } from "hono";
+import { type InstallHandlerOptions } from "./install-handlers.js";
+import { type WebhookHandlerOptions } from "./webhooks.js";
+export type { InstallCallbacks, InstallHandlerOptions } from "./install-handlers.js";
+export type { QueekWebhookEnvelope, SecretResolution, WebhookHandlerContext, WebhookHandlerFn, WebhookHandlerOptions, } from "./webhooks.js";
+/** Mount the signed install/uninstall/settings handoff (`POST /install`, `POST /uninstall`, `POST /settings`). */
+export declare function createInstallHandlers(options: InstallHandlerOptions): Hono;
+/** Mount the signed topic-delivery receiver (`POST /`). */
+export declare function createWebhookHandler(options: WebhookHandlerOptions): Hono;
+//# sourceMappingURL=hono.d.ts.map

package/dist/hono.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono.d.ts","sourceRoot":"","sources":["../src/hono.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAwB,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACzF,OAAO,EAAwB,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAEjF,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACrF,YAAY,EACV,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AAEvB,kHAAkH;AAClH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAM1E;AAED,2DAA2D;AAC3D,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAIzE"}

package/dist/hono.js

@@ -0,0 +1,27 @@
+/**
+ * Optional Hono integration for `@usequeek/app-sdk`.
+ *
+ * Import from `@usequeek/app-sdk/hono` (requires the optional `hono` peer):
+ * `createInstallHandlers` and `createWebhookHandler` are thin wrappers
+ * built ONLY on the layer-2 Web-standard handlers (`handleInstallRequest`
+ * / `handleWebhookRequest` in the root entry) — same options objects, same
+ * behaviour, same errors/status codes.
+ */
+import { Hono } from "hono";
+import { handleInstallRequest } from "./install-handlers.js";
+import { handleWebhookRequest } from "./webhooks.js";
+/** Mount the signed install/uninstall/settings handoff (`POST /install`, `POST /uninstall`, `POST /settings`). */
+export function createInstallHandlers(options) {
+    const app = new Hono();
+    app.post("/install", (c) => handleInstallRequest(c.req.raw, options));
+    app.post("/uninstall", (c) => handleInstallRequest(c.req.raw, options));
+    app.post("/settings", (c) => handleInstallRequest(c.req.raw, options));
+    return app;
+}
+/** Mount the signed topic-delivery receiver (`POST /`). */
+export function createWebhookHandler(options) {
+    const app = new Hono();
+    app.post("/", (c) => handleWebhookRequest(c.req.raw, options));
+    return app;
+}
+//# sourceMappingURL=hono.js.map

package/dist/hono.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono.js","sourceRoot":"","sources":["../src/hono.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAA8B,MAAM,uBAAuB,CAAC;AACzF,OAAO,EAAE,oBAAoB,EAA8B,MAAM,eAAe,CAAC;AAWjF,kHAAkH;AAClH,MAAM,UAAU,qBAAqB,CAAC,OAA8B;IAClE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IACtE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IACxE,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IACvE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IACjE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/D,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/index.d.ts

@@ -13,13 +13,14 @@ export { backgroundTaskCount, type CatchupFailure, type CatchupInstallation, typ
 export { apiHostsFromEnv, createQueekClient, DEFAULT_API_HOSTS, devApiHostsFromEnv, InvalidApiBaseError, MERCHANT_API_PATH, type MerchantPaths, newIdempotencyKey, type OperationResponse, QueekApiError, type QueekClient, type QueekClientOptions, type QueekErrorDetails, queekApiErrorFromResponse, type RequestOptions, type RetryOptions, resolveApiBase, type StoreProfile, } from "./client.js";
 export { type AlertBody, type AlertSeverity, type CollectedDefinition, type CollectedDefinitionCreate, type CollectedDefinitionUpdate, type CollectedField, collectedDefinitions, createRecord, type MerchantAlert, type SetupNotice, type SetupNoticeBody, type SetupNoticeItem, type SetupNoticeStatus, type SuccessEnvelope, sendAlert, setSetupNotice, } from "./collected.js";
 export { decryptSecret, encryptSecret, parseStoreKey, storeKeyFingerprint, } from "./crypto.js";
+export { type CoreDelivery, type CoreHeaders, decodeBody, type DeliveryResult, type InstallDelivery, readHeader, } from "./delivery.js";
 export { APP_SOURCE, type AppInboundMessage, type AppOutboundMessage, DASHBOARD_SOURCE, type FrameBridgeOptions, listenToDashboard, sendReady, } from "./frame.js";
 export { type HandoffEnvelope, type HandoffEnvelopeAny, type HandoffInstallationRef, type HandoffStore, INSTALL_EVENT, type InstallData, type InstallEnvelope, RESYNC_EVENT, type ResyncEnvelope, SETTINGS_EVENT, type SettingsData, type SettingsEnvelope, UNINSTALL_EVENT, type UninstallData, type UninstallEnvelope, } from "./handoff.js";
-export { buildInstallationRecord, createInstallHandlers, type InstallCallbacks, type InstallHandlerOptions, saveResyncedInstallation, } from "./install-handlers.js";
+export { buildInstallationRecord, handleInstallDelivery, handleInstallRequest, type InstallCallbacks, type InstallHandlerOptions, saveResyncedInstallation, } from "./install-handlers.js";
 export { createLogger, type LogFields, type Logger, type LoggerOptions, type LogLevel, REDACTED, } from "./logger.js";
 export { type ResyncListItem, type ResyncOptions, type ResyncResult, resyncFromQueek, } from "./resync.js";
 export { MAX_TIMESTAMP_SKEW_SECONDS, SECRET_PREFIX, type SignatureFailure, type SignatureInput, secretKeyBytes, signQueekPayload, type VerifyOptions, verifyQueekSignature, verifyQueekSignatureDetailed, WEBHOOK_ID_HEADER, WEBHOOK_SIGNATURE_HEADER, WEBHOOK_TIMESTAMP_HEADER, } from "./signatures.js";
 export { createInstallationStore, createPostgresPool, INSTALLATION_SCHEMA_VERSION, type InstallationRecord, type InstallationStore, type InstallationStoreSelector, PostgresInstallationStore, type PostgresStoreOptions, SqliteInstallationStore, type SqliteStoreOptions, type WebhookSecretCandidate, } from "./store.js";
 export { APP_API_PATH, AppTokenProvider, type AppTokens, createAppTokenProvider, createInstallationClient, type InstallationClientOptions, mintPath, resolveAppApiBase, type TokenProviderOptions, } from "./tokens.js";
-export { createWebhookHandler, QUEEK_TOPIC_HEADER, type QueekWebhookEnvelope, type SecretResolution, type WebhookHandlerContext, type WebhookHandlerFn, type WebhookHandlerOptions, } from "./webhooks.js";
+export { handleWebhookDelivery, handleWebhookRequest, QUEEK_TOPIC_HEADER, type QueekWebhookEnvelope, type SecretResolution, type WebhookHandlerContext, type WebhookHandlerFn, type WebhookHandlerOptions, } from "./webhooks.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,6BAA6B,EAC7B,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,aAAa,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,yBAAyB,EACzB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,UAAU,EACV,2BAA2B,EAC3B,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,EACN,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,aAAa,EAClB,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,cAAc,EACd,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,cAAc,EACnB,oBAAoB,EACpB,YAAY,EACZ,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,SAAS,EACT,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,aAAa,EACb,aAAa,EACb,mBAAmB,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,UAAU,EACV,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,iBAAiB,EACjB,SAAS,GACV,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,YAAY,EACZ,KAAK,cAAc,EACnB,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,iBAAiB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,YAAY,EACZ,KAAK,SAAS,EACd,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,QAAQ,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,0BAA0B,EAC1B,aAAa,EACb,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,cAAc,EACd,gBAAgB,EAChB,KAAK,aAAa,EAClB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,2BAA2B,EAC3B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,yBAAyB,EACzB,KAAK,oBAAoB,EACzB,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,GAC5B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,KAAK,SAAS,EACd,sBAAsB,EACtB,wBAAwB,EACxB,KAAK,yBAAyB,EAC9B,QAAQ,EACR,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,GAC3B,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,6BAA6B,EAC7B,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,aAAa,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,yBAAyB,EACzB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,UAAU,EACV,2BAA2B,EAC3B,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,MAAM,EACN,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,aAAa,EAClB,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,cAAc,EACd,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,cAAc,EACnB,oBAAoB,EACpB,YAAY,EACZ,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,SAAS,EACT,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,aAAa,EACb,aAAa,EACb,mBAAmB,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,UAAU,GACX,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,UAAU,EACV,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,iBAAiB,EACjB,SAAS,GACV,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,YAAY,EACZ,KAAK,cAAc,EACnB,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,iBAAiB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,YAAY,EACZ,KAAK,SAAS,EACd,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,QAAQ,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,0BAA0B,EAC1B,aAAa,EACb,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,cAAc,EACd,gBAAgB,EAChB,KAAK,aAAa,EAClB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,2BAA2B,EAC3B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,yBAAyB,EACzB,KAAK,oBAAoB,EACzB,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,GAC5B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,KAAK,SAAS,EACd,sBAAsB,EACtB,wBAAwB,EACxB,KAAK,yBAAyB,EAC9B,QAAQ,EACR,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,GAC3B,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -13,13 +13,14 @@ export { backgroundTaskCount, detach, runInstallationCatchup, } from "./backgrou
 export { apiHostsFromEnv, createQueekClient, DEFAULT_API_HOSTS, devApiHostsFromEnv, InvalidApiBaseError, MERCHANT_API_PATH, newIdempotencyKey, QueekApiError, queekApiErrorFromResponse, resolveApiBase, } from "./client.js";
 export { collectedDefinitions, createRecord, sendAlert, setSetupNotice, } from "./collected.js";
 export { decryptSecret, encryptSecret, parseStoreKey, storeKeyFingerprint, } from "./crypto.js";
+export { decodeBody, readHeader, } from "./delivery.js";
 export { APP_SOURCE, DASHBOARD_SOURCE, listenToDashboard, sendReady, } from "./frame.js";
 export { INSTALL_EVENT, RESYNC_EVENT, SETTINGS_EVENT, UNINSTALL_EVENT, } from "./handoff.js";
-export { buildInstallationRecord, createInstallHandlers, saveResyncedInstallation, } from "./install-handlers.js";
+export { buildInstallationRecord, handleInstallDelivery, handleInstallRequest, saveResyncedInstallation, } from "./install-handlers.js";
 export { createLogger, REDACTED, } from "./logger.js";
 export { resyncFromQueek, } from "./resync.js";
 export { MAX_TIMESTAMP_SKEW_SECONDS, SECRET_PREFIX, secretKeyBytes, signQueekPayload, verifyQueekSignature, verifyQueekSignatureDetailed, WEBHOOK_ID_HEADER, WEBHOOK_SIGNATURE_HEADER, WEBHOOK_TIMESTAMP_HEADER, } from "./signatures.js";
 export { createInstallationStore, createPostgresPool, INSTALLATION_SCHEMA_VERSION, PostgresInstallationStore, SqliteInstallationStore, } from "./store.js";
 export { APP_API_PATH, AppTokenProvider, createAppTokenProvider, createInstallationClient, mintPath, resolveAppApiBase, } from "./tokens.js";
-export { createWebhookHandler, QUEEK_TOPIC_HEADER, } from "./webhooks.js";
+export { handleWebhookDelivery, handleWebhookRequest, QUEEK_TOPIC_HEADER, } from "./webhooks.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,6BAA6B,EAC7B,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EAEtB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,yBAAyB,EACzB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EAEnB,UAAU,EACV,2BAA2B,EAC3B,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,mBAAmB,EAMnB,MAAM,EACN,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EAEjB,iBAAiB,EAEjB,aAAa,EAIb,yBAAyB,EAGzB,cAAc,GAEf,MAAM,aAAa,CAAC;AACrB,OAAO,EAOL,oBAAoB,EACpB,YAAY,EAOZ,SAAS,EACT,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,aAAa,EACb,aAAa,EACb,mBAAmB,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,UAAU,EAGV,gBAAgB,EAEhB,iBAAiB,EACjB,SAAS,GACV,MAAM,YAAY,CAAC;AACpB,OAAO,EAKL,aAAa,EAGb,YAAY,EAEZ,cAAc,EAGd,eAAe,GAGhB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EAGrB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,YAAY,EAKZ,QAAQ,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EAIL,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,0BAA0B,EAC1B,aAAa,EAGb,cAAc,EACd,gBAAgB,EAEhB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,2BAA2B,EAI3B,yBAAyB,EAEzB,uBAAuB,GAGxB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAEhB,sBAAsB,EACtB,wBAAwB,EAExB,QAAQ,EACR,iBAAiB,GAElB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GAMnB,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,6BAA6B,EAC7B,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EAEtB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,yBAAyB,EACzB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EAEnB,UAAU,EACV,2BAA2B,EAC3B,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,mBAAmB,EAMnB,MAAM,EACN,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EAEjB,iBAAiB,EAEjB,aAAa,EAIb,yBAAyB,EAGzB,cAAc,GAEf,MAAM,aAAa,CAAC;AACrB,OAAO,EAOL,oBAAoB,EACpB,YAAY,EAOZ,SAAS,EACT,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,aAAa,EACb,aAAa,EACb,mBAAmB,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAGL,UAAU,EAGV,UAAU,GACX,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,UAAU,EAGV,gBAAgB,EAEhB,iBAAiB,EACjB,SAAS,GACV,MAAM,YAAY,CAAC;AACpB,OAAO,EAKL,aAAa,EAGb,YAAY,EAEZ,cAAc,EAGd,eAAe,GAGhB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EAGpB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,YAAY,EAKZ,QAAQ,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EAIL,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,0BAA0B,EAC1B,aAAa,EAGb,cAAc,EACd,gBAAgB,EAEhB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,2BAA2B,EAI3B,yBAAyB,EAEzB,uBAAuB,GAGxB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAEhB,sBAAsB,EACtB,wBAAwB,EAExB,QAAQ,EACR,iBAAiB,GAElB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,GAMnB,MAAM,eAAe,CAAC"}

package/dist/install-handlers.d.ts

@@ -1,9 +1,15 @@
-import { Hono } from "hono";
 import { type InstallData, type InstallEnvelope, type SettingsEnvelope, type UninstallEnvelope } from "./handoff.js";
+import { type DeliveryResult, type InstallDelivery } from "./delivery.js";
 import type { InstallationRecord, InstallationStore } from "./store.js";
 /**
- * Hono handlers for Queek's signed server-to-server handoff
- * (`AppInstallService::deliver()` in queek_backend).
+ * Framework-agnostic handlers for Queek's signed server-to-server handoff
+ * (`AppInstallService::deliver()` in queek_backend) in three thin layers:
+ * layer 1 `handleInstallDelivery(input, options)` takes plain data
+ * (untouched body bytes + headers, plus method/path for routing) and
+ * returns a plain `{ status, body }` result — zero request/response types,
+ * so whatever request object each framework supports works; layer 2
+ * `handleInstallRequest(request, options)` adapts the Web standard onto
+ * layer 1; layer 3 (`@usequeek/app-sdk/hono`) adapts Hono onto layer 2.
  *
  * Every handoff — install, uninstall, settings, resync — carries the
  * Standard Webhooks headers signed with the APP signing secret (`whsec_…`,
@@ -15,7 +21,7 @@ import type { InstallationRecord, InstallationStore } from "./store.js";
  * `AppInstallService::resyncPayload()`) redelivers the install-shaped data
  * — rotated `webhook_secret`, non-secret settings, and recovery copies of
  * `proxy_secret` / `embed_secret` / `app_id` — to the app's `settings_url`,
- * falling back to `install_url`. Both `/install` and `/settings` accept it
+ * falling back to `install_url`. Both `install` and `settings` accept it
  * with the same signature/verification rules and apply it via the resync
  * merge (`saveResyncedInstallation`: refreshes secrets/settings/scopes,
  * keeps `installedAt` + the cached token, keeps stored values the resync
@@ -58,5 +64,17 @@ export declare function buildInstallationRecord(data: InstallData, nowIso?: stri
  * tokens explicitly when it wants fresh ones).
  */
 export declare function saveResyncedInstallation(existing: InstallationRecord, data: InstallData, nowIso?: string): InstallationRecord;
-export declare function createInstallHandlers(options: InstallHandlerOptions): Hono;
+/**
+ * Layer 1: handle one signed install-handoff delivery (`install`,
+ * `uninstall`, or `settings`, taken from the input path's last segment)
+ * from plain data — no `Request`, no framework. Same options, same
+ * behaviour, same errors/status codes at every layer.
+ */
+export declare function handleInstallDelivery(input: InstallDelivery, options: InstallHandlerOptions): Promise<DeliveryResult>;
+/**
+ * Layer 2: the Web-standard wrapper, built ONLY on layer 1 — reads
+ * `await request.arrayBuffer()` + headers, calls the core, builds the
+ * `Response`.
+ */
+export declare function handleInstallRequest(request: Request, options: InstallHandlerOptions): Promise<Response>;
 //# sourceMappingURL=install-handlers.d.ts.map

package/dist/install-handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install-handlers.d.ts","sourceRoot":"","sources":["../src/install-handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,eAAe,EAIpB,KAAK,gBAAgB,EAErB,KAAK,iBAAiB,EACvB,MAAM,cAAc,CAAC;AAQtB,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,sEAAsE;IACtE,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,0DAA0D;IAC1D,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,yEAAyE;IACzE,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,iBAAiB,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,WAAW,EACjB,MAAM,GAAE,MAAiC,GACxC,kBAAkB,CAEpB;AAiCD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE,WAAW,EACjB,MAAM,GAAE,MAAiC,GACxC,kBAAkB,CAYpB;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAyM1E"}
+{"version":3,"file":"install-handlers.d.ts","sourceRoot":"","sources":["../src/install-handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,eAAe,EAIpB,KAAK,gBAAgB,EAErB,KAAK,iBAAiB,EACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,eAAe,EAGrB,MAAM,eAAe,CAAC;AAQvB,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,sEAAsE;IACtE,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,0DAA0D;IAC1D,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,yEAAyE;IACzE,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,iBAAiB,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,WAAW,EACjB,MAAM,GAAE,MAAiC,GACxC,kBAAkB,CAEpB;AAiCD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE,WAAW,EACjB,MAAM,GAAE,MAAiC,GACxC,kBAAkB,CAYpB;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,cAAc,CAAC,CAUzB;AAUD;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,QAAQ,CAAC,CAYnB"}