@whatalo/plugin-sdk 1.2.0 → 1.2.1

package/dist/manifest/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/manifest/validate.ts"],"sourcesContent":["import type { AppManifest } from \"./types.js\";\n\n/** Error thrown when manifest validation fails */\nexport class ManifestValidationError extends Error {\n  readonly errors: Array<{ field: string; message: string }>;\n\n  constructor(errors: Array<{ field: string; message: string }>) {\n    const message = `Invalid app manifest: ${errors\n      .map((e) => `${e.field}: ${e.message}`)\n      .join(\"; \")}`;\n    super(message);\n    this.name = \"ManifestValidationError\";\n    this.errors = errors;\n  }\n}\n\nconst ID_REGEX = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;\nconst SEMVER_REGEX = /^\\d+\\.\\d+\\.\\d+$/;\nconst EMAIL_REGEX = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\n\nconst VALID_PERMISSIONS = new Set([\n  \"read:products\",\n  \"write:products\",\n  \"read:orders\",\n  \"write:orders\",\n  \"read:customers\",\n  \"write:customers\",\n  \"read:inventory\",\n  \"write:inventory\",\n  \"read:store\",\n  \"write:store\",\n  \"read:webhooks\",\n  \"write:webhooks\",\n  \"read:discounts\",\n  \"write:discounts\",\n  \"read:analytics\",\n]);\n\nconst VALID_CATEGORIES = new Set([\n  \"analytics\",\n  \"marketing\",\n  \"shipping\",\n  \"payments\",\n  \"payment\",\n  \"inventory\",\n  \"communication\",\n  \"productivity\",\n  \"accounting\",\n  \"developer\",\n  \"other\",\n]);\n\n/**\n * Validate and return a typed AppManifest.\n * Throws ManifestValidationError with detailed field-level errors.\n */\nexport function defineApp(manifest: AppManifest): AppManifest {\n  const errors: Array<{ field: string; message: string }> = [];\n\n  // id\n  if (!manifest.id || manifest.id.length < 3 || manifest.id.length > 50) {\n    errors.push({ field: \"id\", message: \"Must be 3-50 characters\" });\n  } else if (!ID_REGEX.test(manifest.id)) {\n    errors.push({\n      field: \"id\",\n      message: \"Must be lowercase alphanumeric with hyphens\",\n    });\n  }\n\n  // name\n  if (!manifest.name || manifest.name.length < 3 || manifest.name.length > 50) {\n    errors.push({ field: \"name\", message: \"Must be 3-50 characters\" });\n  }\n\n  // description\n  if (\n    !manifest.description ||\n    manifest.description.length < 10 ||\n    manifest.description.length > 200\n  ) {\n    errors.push({\n      field: \"description\",\n      message: \"Must be 10-200 characters\",\n    });\n  }\n\n  // version\n  if (!manifest.version || !SEMVER_REGEX.test(manifest.version)) {\n    errors.push({\n      field: \"version\",\n      message: \"Must be valid semver (e.g., 1.0.0)\",\n    });\n  }\n\n  // author\n  if (!manifest.author?.name) {\n    errors.push({ field: \"author.name\", message: \"Required\" });\n  }\n  if (!manifest.author?.email || !EMAIL_REGEX.test(manifest.author.email)) {\n    errors.push({\n      field: \"author.email\",\n      message: \"Must be a valid email address\",\n    });\n  }\n\n  // permissions\n  if (!manifest.permissions || manifest.permissions.length === 0) {\n    errors.push({\n      field: \"permissions\",\n      message: \"At least one permission is required\",\n    });\n  } else {\n    for (const perm of manifest.permissions) {\n      if (!VALID_PERMISSIONS.has(perm)) {\n        errors.push({\n          field: \"permissions\",\n          message: `Invalid permission: ${perm}`,\n        });\n      }\n    }\n  }\n\n  // appUrl\n  if (!manifest.appUrl) {\n    errors.push({ field: \"appUrl\", message: \"Required\" });\n  }\n\n  // pricing\n  if (manifest.pricing !== \"free\" && manifest.pricing !== \"paid\") {\n    errors.push({\n      field: \"pricing\",\n      message: 'Must be \"free\" or \"paid\"',\n    });\n  }\n\n  // category\n  if (!VALID_CATEGORIES.has(manifest.category)) {\n    errors.push({\n      field: \"category\",\n      message: `Invalid category: ${manifest.category}`,\n    });\n  }\n\n  if (errors.length > 0) {\n    throw new ManifestValidationError(errors);\n  }\n\n  return manifest;\n}\n"],"mappings":";AAGO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACxC;AAAA,EAET,YAAY,QAAmD;AAC7D,UAAM,UAAU,yBAAyB,OACtC,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,KAAK,EAAE,OAAO,EAAE,EACrC,KAAK,IAAI,CAAC;AACb,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAEA,IAAM,WAAW;AACjB,IAAM,eAAe;AACrB,IAAM,cAAc;AAEpB,IAAM,oBAAoB,oBAAI,IAAI;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,mBAAmB,oBAAI,IAAI;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMM,SAAS,UAAU,UAAoC;AAC5D,QAAM,SAAoD,CAAC;AAG3D,MAAI,CAAC,SAAS,MAAM,SAAS,GAAG,SAAS,KAAK,SAAS,GAAG,SAAS,IAAI;AACrE,WAAO,KAAK,EAAE,OAAO,MAAM,SAAS,0BAA0B,CAAC;AAAA,EACjE,WAAW,CAAC,SAAS,KAAK,SAAS,EAAE,GAAG;AACtC,WAAO,KAAK;AAAA,MACV,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAGA,MAAI,CAAC,SAAS,QAAQ,SAAS,KAAK,SAAS,KAAK,SAAS,KAAK,SAAS,IAAI;AAC3E,WAAO,KAAK,EAAE,OAAO,QAAQ,SAAS,0BAA0B,CAAC;AAAA,EACnE;AAGA,MACE,CAAC,SAAS,eACV,SAAS,YAAY,SAAS,MAC9B,SAAS,YAAY,SAAS,KAC9B;AACA,WAAO,KAAK;AAAA,MACV,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAGA,MAAI,CAAC,SAAS,WAAW,CAAC,aAAa,KAAK,SAAS,OAAO,GAAG;AAC7D,WAAO,KAAK;AAAA,MACV,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAGA,MAAI,CAAC,SAAS,QAAQ,MAAM;AAC1B,WAAO,KAAK,EAAE,OAAO,eAAe,SAAS,WAAW,CAAC;AAAA,EAC3D;AACA,MAAI,CAAC,SAAS,QAAQ,SAAS,CAAC,YAAY,KAAK,SAAS,OAAO,KAAK,GAAG;AACvE,WAAO,KAAK;AAAA,MACV,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAGA,MAAI,CAAC,SAAS,eAAe,SAAS,YAAY,WAAW,GAAG;AAC9D,WAAO,KAAK;AAAA,MACV,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH,OAAO;AACL,eAAW,QAAQ,SAAS,aAAa;AACvC,UAAI,CAAC,kBAAkB,IAAI,IAAI,GAAG;AAChC,eAAO,KAAK;AAAA,UACV,OAAO;AAAA,UACP,SAAS,uBAAuB,IAAI;AAAA,QACtC,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAGA,MAAI,CAAC,SAAS,QAAQ;AACpB,WAAO,KAAK,EAAE,OAAO,UAAU,SAAS,WAAW,CAAC;AAAA,EACtD;AAGA,MAAI,SAAS,YAAY,UAAU,SAAS,YAAY,QAAQ;AAC9D,WAAO,KAAK;AAAA,MACV,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAGA,MAAI,CAAC,iBAAiB,IAAI,SAAS,QAAQ,GAAG;AAC5C,WAAO,KAAK;AAAA,MACV,OAAO;AAAA,MACP,SAAS,qBAAqB,SAAS,QAAQ;AAAA,IACjD,CAAC;AAAA,EACH;AAEA,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,IAAI,wBAAwB,MAAM;AAAA,EAC1C;AAEA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/manifest/validate.ts"],"sourcesContent":["import { SCOPE_LIST } from \"@whatalo/protocol/scopes\";\nimport type { AppManifest } from \"./types.js\";\n\n/** Error thrown when manifest validation fails */\nexport class ManifestValidationError extends Error {\n  readonly errors: Array<{ field: string; message: string }>;\n\n  constructor(errors: Array<{ field: string; message: string }>) {\n    const message = `Invalid app manifest: ${errors\n      .map((e) => `${e.field}: ${e.message}`)\n      .join(\"; \")}`;\n    super(message);\n    this.name = \"ManifestValidationError\";\n    this.errors = errors;\n  }\n}\n\nconst ID_REGEX = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;\nconst SEMVER_REGEX = /^\\d+\\.\\d+\\.\\d+$/;\nconst EMAIL_REGEX = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\n\n/** Built from the central registry — no manual sync required. */\nconst VALID_PERMISSIONS = new Set(SCOPE_LIST.map((s) => s.token));\n\nconst VALID_CATEGORIES = new Set([\n  \"analytics\",\n  \"marketing\",\n  \"shipping\",\n  \"payments\",\n  \"payment\",\n  \"inventory\",\n  \"communication\",\n  \"productivity\",\n  \"accounting\",\n  \"developer\",\n  \"other\",\n]);\n\n/**\n * Validate and return a typed AppManifest.\n * Throws ManifestValidationError with detailed field-level errors.\n */\nexport function defineApp(manifest: AppManifest): AppManifest {\n  const errors: Array<{ field: string; message: string }> = [];\n\n  // id\n  if (!manifest.id || manifest.id.length < 3 || manifest.id.length > 50) {\n    errors.push({ field: \"id\", message: \"Must be 3-50 characters\" });\n  } else if (!ID_REGEX.test(manifest.id)) {\n    errors.push({\n      field: \"id\",\n      message: \"Must be lowercase alphanumeric with hyphens\",\n    });\n  }\n\n  // name\n  if (!manifest.name || manifest.name.length < 3 || manifest.name.length > 50) {\n    errors.push({ field: \"name\", message: \"Must be 3-50 characters\" });\n  }\n\n  // description\n  if (\n    !manifest.description ||\n    manifest.description.length < 10 ||\n    manifest.description.length > 200\n  ) {\n    errors.push({\n      field: \"description\",\n      message: \"Must be 10-200 characters\",\n    });\n  }\n\n  // version\n  if (!manifest.version || !SEMVER_REGEX.test(manifest.version)) {\n    errors.push({\n      field: \"version\",\n      message: \"Must be valid semver (e.g., 1.0.0)\",\n    });\n  }\n\n  // author\n  if (!manifest.author?.name) {\n    errors.push({ field: \"author.name\", message: \"Required\" });\n  }\n  if (!manifest.author?.email || !EMAIL_REGEX.test(manifest.author.email)) {\n    errors.push({\n      field: \"author.email\",\n      message: \"Must be a valid email address\",\n    });\n  }\n\n  // permissions\n  if (!manifest.permissions || manifest.permissions.length === 0) {\n    errors.push({\n      field: \"permissions\",\n      message: \"At least one permission is required\",\n    });\n  } else {\n    for (const perm of manifest.permissions) {\n      if (!VALID_PERMISSIONS.has(perm)) {\n        errors.push({\n          field: \"permissions\",\n          message: `Invalid permission: ${perm}`,\n        });\n      }\n    }\n  }\n\n  // appUrl\n  if (!manifest.appUrl) {\n    errors.push({ field: \"appUrl\", message: \"Required\" });\n  }\n\n  // pricing\n  if (manifest.pricing !== \"free\" && manifest.pricing !== \"paid\") {\n    errors.push({\n      field: \"pricing\",\n      message: 'Must be \"free\" or \"paid\"',\n    });\n  }\n\n  // category\n  if (!VALID_CATEGORIES.has(manifest.category)) {\n    errors.push({\n      field: \"category\",\n      message: `Invalid category: ${manifest.category}`,\n    });\n  }\n\n  if (errors.length > 0) {\n    throw new ManifestValidationError(errors);\n  }\n\n  return manifest;\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAIpB,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACxC;AAAA,EAET,YAAY,QAAmD;AAC7D,UAAM,UAAU,yBAAyB,OACtC,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,KAAK,EAAE,OAAO,EAAE,EACrC,KAAK,IAAI,CAAC;AACb,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAEA,IAAM,WAAW;AACjB,IAAM,eAAe;AACrB,IAAM,cAAc;AAGpB,IAAM,oBAAoB,IAAI,IAAI,WAAW,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;AAEhE,IAAM,mBAAmB,oBAAI,IAAI;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMM,SAAS,UAAU,UAAoC;AAC5D,QAAM,SAAoD,CAAC;AAG3D,MAAI,CAAC,SAAS,MAAM,SAAS,GAAG,SAAS,KAAK,SAAS,GAAG,SAAS,IAAI;AACrE,WAAO,KAAK,EAAE,OAAO,MAAM,SAAS,0BAA0B,CAAC;AAAA,EACjE,WAAW,CAAC,SAAS,KAAK,SAAS,EAAE,GAAG;AACtC,WAAO,KAAK;AAAA,MACV,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAGA,MAAI,CAAC,SAAS,QAAQ,SAAS,KAAK,SAAS,KAAK,SAAS,KAAK,SAAS,IAAI;AAC3E,WAAO,KAAK,EAAE,OAAO,QAAQ,SAAS,0BAA0B,CAAC;AAAA,EACnE;AAGA,MACE,CAAC,SAAS,eACV,SAAS,YAAY,SAAS,MAC9B,SAAS,YAAY,SAAS,KAC9B;AACA,WAAO,KAAK;AAAA,MACV,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAGA,MAAI,CAAC,SAAS,WAAW,CAAC,aAAa,KAAK,SAAS,OAAO,GAAG;AAC7D,WAAO,KAAK;AAAA,MACV,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAGA,MAAI,CAAC,SAAS,QAAQ,MAAM;AAC1B,WAAO,KAAK,EAAE,OAAO,eAAe,SAAS,WAAW,CAAC;AAAA,EAC3D;AACA,MAAI,CAAC,SAAS,QAAQ,SAAS,CAAC,YAAY,KAAK,SAAS,OAAO,KAAK,GAAG;AACvE,WAAO,KAAK;AAAA,MACV,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAGA,MAAI,CAAC,SAAS,eAAe,SAAS,YAAY,WAAW,GAAG;AAC9D,WAAO,KAAK;AAAA,MACV,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH,OAAO;AACL,eAAW,QAAQ,SAAS,aAAa;AACvC,UAAI,CAAC,kBAAkB,IAAI,IAAI,GAAG;AAChC,eAAO,KAAK;AAAA,UACV,OAAO;AAAA,UACP,SAAS,uBAAuB,IAAI;AAAA,QACtC,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAGA,MAAI,CAAC,SAAS,QAAQ;AACpB,WAAO,KAAK,EAAE,OAAO,UAAU,SAAS,WAAW,CAAC;AAAA,EACtD;AAGA,MAAI,SAAS,YAAY,UAAU,SAAS,YAAY,QAAQ;AAC9D,WAAO,KAAK;AAAA,MACV,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAGA,MAAI,CAAC,iBAAiB,IAAI,SAAS,QAAQ,GAAG;AAC5C,WAAO,KAAK;AAAA,MACV,OAAO;AAAA,MACP,SAAS,qBAAqB,SAAS,QAAQ;AAAA,IACjD,CAAC;AAAA,EACH;AAEA,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,IAAI,wBAAwB,MAAM;AAAA,EAC1C;AAEA,SAAO;AACT;","names":[]}

package/dist/{types-DcmArIC2.d.ts → types-B8BAV362.d.cts}

@@ -288,5 +288,28 @@ interface AdjustInventoryParams {
     quantity: number;
     reason: string;
 }
+/** Country from the geo reference data */
+interface GeoCountry {
+    iso2: string;
+    iso3: string;
+    name: string;
+    native_name: string | null;
+    phone_code: string;
+    currency_code: string;
+    emoji: string | null;
+    is_supported: boolean;
+}
+/** Province/state/department from the geo reference data */
+interface GeoProvince {
+    id: number;
+    country_iso2: string;
+    code: string;
+    name: string;
+}
+/** Params for listing countries */
+interface ListCountriesParams {
+    /** When true, returns all 250 countries instead of only supported ones */
+    all?: boolean;
+}
 
-export type { AdjustInventoryParams as A, CreateProductParams as C, Discount as D, InventoryItem as I, ListProductsParams as L, Order as O, PaginatedResponse as P, RateLimitInfo as R, SingleResponse as S, UpdateProductParams as U, Webhook as W, Product as a, ListOrdersParams as b, UpdateOrderStatusParams as c, UpdateOrderPaymentStatusParams as d, ListCustomersParams as e, Customer as f, ListCategoriesParams as g, Category as h, CreateCategoryParams as i, UpdateCategoryParams as j, ListDiscountsParams as k, CreateDiscountParams as l, UpdateDiscountParams as m, Store as n, UpsertWebhookParams as o, UpdateWebhookParams as p, WhataloClientOptions as q, OrderStatus as r, PaymentStatus as s };
+export type { AdjustInventoryParams as A, CreateProductParams as C, Discount as D, GeoCountry as G, InventoryItem as I, ListProductsParams as L, Order as O, PaginatedResponse as P, RateLimitInfo as R, SingleResponse as S, UpdateProductParams as U, Webhook as W, Product as a, ListOrdersParams as b, UpdateOrderStatusParams as c, UpdateOrderPaymentStatusParams as d, ListCustomersParams as e, Customer as f, ListCategoriesParams as g, Category as h, CreateCategoryParams as i, UpdateCategoryParams as j, ListDiscountsParams as k, CreateDiscountParams as l, UpdateDiscountParams as m, Store as n, UpsertWebhookParams as o, UpdateWebhookParams as p, ListCountriesParams as q, GeoProvince as r, WhataloClientOptions as s, OrderStatus as t, PaymentStatus as u };

package/dist/{types-DcmArIC2.d.cts → types-B8BAV362.d.ts}

@@ -288,5 +288,28 @@ interface AdjustInventoryParams {
     quantity: number;
     reason: string;
 }
+/** Country from the geo reference data */
+interface GeoCountry {
+    iso2: string;
+    iso3: string;
+    name: string;
+    native_name: string | null;
+    phone_code: string;
+    currency_code: string;
+    emoji: string | null;
+    is_supported: boolean;
+}
+/** Province/state/department from the geo reference data */
+interface GeoProvince {
+    id: number;
+    country_iso2: string;
+    code: string;
+    name: string;
+}
+/** Params for listing countries */
+interface ListCountriesParams {
+    /** When true, returns all 250 countries instead of only supported ones */
+    all?: boolean;
+}
 
-export type { AdjustInventoryParams as A, CreateProductParams as C, Discount as D, InventoryItem as I, ListProductsParams as L, Order as O, PaginatedResponse as P, RateLimitInfo as R, SingleResponse as S, UpdateProductParams as U, Webhook as W, Product as a, ListOrdersParams as b, UpdateOrderStatusParams as c, UpdateOrderPaymentStatusParams as d, ListCustomersParams as e, Customer as f, ListCategoriesParams as g, Category as h, CreateCategoryParams as i, UpdateCategoryParams as j, ListDiscountsParams as k, CreateDiscountParams as l, UpdateDiscountParams as m, Store as n, UpsertWebhookParams as o, UpdateWebhookParams as p, WhataloClientOptions as q, OrderStatus as r, PaymentStatus as s };
+export type { AdjustInventoryParams as A, CreateProductParams as C, Discount as D, GeoCountry as G, InventoryItem as I, ListProductsParams as L, Order as O, PaginatedResponse as P, RateLimitInfo as R, SingleResponse as S, UpdateProductParams as U, Webhook as W, Product as a, ListOrdersParams as b, UpdateOrderStatusParams as c, UpdateOrderPaymentStatusParams as d, ListCustomersParams as e, Customer as f, ListCategoriesParams as g, Category as h, CreateCategoryParams as i, UpdateCategoryParams as j, ListDiscountsParams as k, CreateDiscountParams as l, UpdateDiscountParams as m, Store as n, UpsertWebhookParams as o, UpdateWebhookParams as p, ListCountriesParams as q, GeoProvince as r, WhataloClientOptions as s, OrderStatus as t, PaymentStatus as u };

package/dist/types-BU71_xQm.d.cts

@@ -0,0 +1,25 @@
+import { W as WebhookEvent, R as RuntimeWebhookPayload } from './types-rA6kVlpV.cjs';
+
+/** Delivery metadata read from webhook headers. */
+interface WebhookHandlerContext<E extends WebhookEvent = WebhookEvent> {
+    deliveryId: string;
+    event: E;
+    timestamp: string;
+}
+/** Handler function for a specific webhook event */
+type WebhookEventHandler<E extends WebhookEvent> = (payload: RuntimeWebhookPayload<E>, context: WebhookHandlerContext<E>) => Promise<void> | void;
+/** Map of event names to handler functions */
+type WebhookHandlers = {
+    [E in WebhookEvent]?: WebhookEventHandler<E>;
+};
+/** Options for creating a webhook handler */
+interface WebhookHandlerOptions {
+    /** The webhook signing secret */
+    secret: string;
+    /** Event handler map */
+    handlers: WebhookHandlers;
+    /** Called when an event has no registered handler */
+    onUnhandledEvent?: (event: WebhookEvent, payload: RuntimeWebhookPayload, context: WebhookHandlerContext) => Promise<void> | void;
+}
+
+export type { WebhookHandlerOptions as W, WebhookEventHandler as a, WebhookHandlerContext as b, WebhookHandlers as c };

package/dist/types-BhtVJPgF.d.ts

@@ -0,0 +1,25 @@
+import { W as WebhookEvent, R as RuntimeWebhookPayload } from './types-Bo9GbqrM.js';
+
+/** Delivery metadata read from webhook headers. */
+interface WebhookHandlerContext<E extends WebhookEvent = WebhookEvent> {
+    deliveryId: string;
+    event: E;
+    timestamp: string;
+}
+/** Handler function for a specific webhook event */
+type WebhookEventHandler<E extends WebhookEvent> = (payload: RuntimeWebhookPayload<E>, context: WebhookHandlerContext<E>) => Promise<void> | void;
+/** Map of event names to handler functions */
+type WebhookHandlers = {
+    [E in WebhookEvent]?: WebhookEventHandler<E>;
+};
+/** Options for creating a webhook handler */
+interface WebhookHandlerOptions {
+    /** The webhook signing secret */
+    secret: string;
+    /** Event handler map */
+    handlers: WebhookHandlers;
+    /** Called when an event has no registered handler */
+    onUnhandledEvent?: (event: WebhookEvent, payload: RuntimeWebhookPayload, context: WebhookHandlerContext) => Promise<void> | void;
+}
+
+export type { WebhookHandlerOptions as W, WebhookEventHandler as a, WebhookHandlerContext as b, WebhookHandlers as c };

package/dist/types-Bo9GbqrM.d.ts

@@ -0,0 +1,133 @@
+import { PublicWebhookEvent } from '@whatalo/protocol/events';
+import { O as Order, a as Product, f as Customer } from './types-B8BAV362.js';
+
+declare const WEBHOOK_EVENTS: {
+    readonly ORDER_CREATED: "order.created";
+    readonly ORDER_UPDATED: "order.updated";
+    readonly ORDER_CANCELLED: "order.cancelled";
+    readonly ORDER_COMPLETED: "order.completed";
+    readonly PRODUCT_CREATED: "product.created";
+    readonly PRODUCT_UPDATED: "product.updated";
+    readonly PRODUCT_DELETED: "product.deleted";
+    readonly CUSTOMER_CREATED: "customer.created";
+    readonly CUSTOMER_UPDATED: "customer.updated";
+    readonly CHECKOUT_COMPLETED: "checkout.completed";
+};
+/** All supported webhook event types */
+type WebhookEvent = PublicWebhookEvent;
+/** Validate an event header against the public runtime webhook event set. */
+declare function isWebhookEvent(value: string): value is WebhookEvent;
+interface OrderCreatedWebhookData {
+    order: Order;
+}
+interface OrderUpdatedWebhookData {
+    order: Order;
+    changes: string[];
+}
+interface OrderCancelledWebhookData {
+    orderId: string;
+    reason?: string;
+}
+interface OrderCompletedWebhookData {
+    order: Order;
+}
+interface ProductCreatedWebhookData {
+    product: Product;
+}
+interface ProductUpdatedWebhookData {
+    product: Product;
+    changes: string[];
+}
+interface ProductDeletedWebhookProduct {
+    id: string;
+}
+interface ProductDeletedWebhookData {
+    product: ProductDeletedWebhookProduct;
+}
+interface CustomerCreatedWebhookData {
+    customer: Customer;
+}
+interface CustomerUpdatedWebhookData {
+    customer: Customer;
+    changes: string[];
+}
+interface CheckoutCompletedWebhookData {
+    order: RuntimeWebhookOrder;
+    customer: RuntimeWebhookCustomer;
+    store: RuntimeWebhookStore;
+}
+/** Map of webhook events to their payload data shapes */
+interface WebhookEventData {
+    "order.created": OrderCreatedWebhookData;
+    "order.updated": OrderUpdatedWebhookData;
+    "order.cancelled": OrderCancelledWebhookData;
+    "order.completed": OrderCompletedWebhookData;
+    "product.created": ProductCreatedWebhookData;
+    "product.updated": ProductUpdatedWebhookData;
+    "product.deleted": ProductDeletedWebhookData;
+    "customer.created": CustomerCreatedWebhookData;
+    "customer.updated": CustomerUpdatedWebhookData;
+    "checkout.completed": CheckoutCompletedWebhookData;
+}
+/** Legacy envelope payload. Runtime webhook deliveries do not include the event field in the body. */
+interface WebhookPayload<E extends WebhookEvent = WebhookEvent> {
+    event: E;
+    timestamp: string;
+    storeId: string;
+    data: WebhookEventData[E];
+}
+interface RuntimeWebhookStore {
+    id: string;
+    name?: string;
+    timezone: string;
+}
+interface RuntimeWebhookBasePayload {
+    event_id?: string;
+    occurred_at?: string;
+    store: RuntimeWebhookStore;
+}
+interface RuntimeWebhookOrder {
+    id: string;
+    [key: string]: unknown;
+}
+interface RuntimeWebhookProduct {
+    id: string;
+    [key: string]: unknown;
+}
+interface RuntimeWebhookCustomer {
+    id: string;
+    [key: string]: unknown;
+}
+interface RuntimeOrderWebhookPayload extends RuntimeWebhookBasePayload {
+    order: RuntimeWebhookOrder;
+    customer?: RuntimeWebhookCustomer;
+}
+interface RuntimeProductWebhookPayload extends RuntimeWebhookBasePayload {
+    product: RuntimeWebhookProduct;
+}
+interface RuntimeCustomerWebhookPayload extends RuntimeWebhookBasePayload {
+    customer: RuntimeWebhookCustomer;
+}
+interface RuntimeCheckoutCompletedWebhookPayload extends RuntimeWebhookBasePayload {
+    order: RuntimeWebhookOrder;
+    customer: RuntimeWebhookCustomer;
+    store: RuntimeWebhookStore;
+}
+interface RuntimeWebhookEventData {
+    "order.created": RuntimeOrderWebhookPayload;
+    "order.updated": RuntimeOrderWebhookPayload;
+    "order.cancelled": RuntimeOrderWebhookPayload;
+    "order.completed": RuntimeOrderWebhookPayload;
+    "product.created": RuntimeProductWebhookPayload;
+    "product.updated": RuntimeProductWebhookPayload;
+    "product.deleted": RuntimeProductWebhookPayload;
+    "customer.created": RuntimeCustomerWebhookPayload;
+    "customer.updated": RuntimeCustomerWebhookPayload;
+    "checkout.completed": RuntimeCheckoutCompletedWebhookPayload;
+}
+/** Runtime body delivered to subscriber endpoints. The event comes from X-Webhook-Event. */
+type RuntimeWebhookPayload<E extends WebhookEvent = WebhookEvent> = RuntimeWebhookEventData[E];
+/** Validate the minimum runtime payload shape before invoking typed handlers. */
+declare function isRuntimeWebhookPayload<E extends WebhookEvent>(value: unknown, event: E): value is RuntimeWebhookPayload<E>;
+
+export { type RuntimeWebhookPayload as R, type WebhookEvent as W, WEBHOOK_EVENTS as a, isWebhookEvent as b, type WebhookEventData as c, type WebhookPayload as d, type RuntimeWebhookBasePayload as e, type RuntimeWebhookEventData as f, type RuntimeWebhookStore as g, isRuntimeWebhookPayload as i };

package/dist/types-rA6kVlpV.d.cts

@@ -0,0 +1,133 @@
+import { PublicWebhookEvent } from '@whatalo/protocol/events';
+import { O as Order, a as Product, f as Customer } from './types-B8BAV362.cjs';
+
+declare const WEBHOOK_EVENTS: {
+    readonly ORDER_CREATED: "order.created";
+    readonly ORDER_UPDATED: "order.updated";
+    readonly ORDER_CANCELLED: "order.cancelled";
+    readonly ORDER_COMPLETED: "order.completed";
+    readonly PRODUCT_CREATED: "product.created";
+    readonly PRODUCT_UPDATED: "product.updated";
+    readonly PRODUCT_DELETED: "product.deleted";
+    readonly CUSTOMER_CREATED: "customer.created";
+    readonly CUSTOMER_UPDATED: "customer.updated";
+    readonly CHECKOUT_COMPLETED: "checkout.completed";
+};
+/** All supported webhook event types */
+type WebhookEvent = PublicWebhookEvent;
+/** Validate an event header against the public runtime webhook event set. */
+declare function isWebhookEvent(value: string): value is WebhookEvent;
+interface OrderCreatedWebhookData {
+    order: Order;
+}
+interface OrderUpdatedWebhookData {
+    order: Order;
+    changes: string[];
+}
+interface OrderCancelledWebhookData {
+    orderId: string;
+    reason?: string;
+}
+interface OrderCompletedWebhookData {
+    order: Order;
+}
+interface ProductCreatedWebhookData {
+    product: Product;
+}
+interface ProductUpdatedWebhookData {
+    product: Product;
+    changes: string[];
+}
+interface ProductDeletedWebhookProduct {
+    id: string;
+}
+interface ProductDeletedWebhookData {
+    product: ProductDeletedWebhookProduct;
+}
+interface CustomerCreatedWebhookData {
+    customer: Customer;
+}
+interface CustomerUpdatedWebhookData {
+    customer: Customer;
+    changes: string[];
+}
+interface CheckoutCompletedWebhookData {
+    order: RuntimeWebhookOrder;
+    customer: RuntimeWebhookCustomer;
+    store: RuntimeWebhookStore;
+}
+/** Map of webhook events to their payload data shapes */
+interface WebhookEventData {
+    "order.created": OrderCreatedWebhookData;
+    "order.updated": OrderUpdatedWebhookData;
+    "order.cancelled": OrderCancelledWebhookData;
+    "order.completed": OrderCompletedWebhookData;
+    "product.created": ProductCreatedWebhookData;
+    "product.updated": ProductUpdatedWebhookData;
+    "product.deleted": ProductDeletedWebhookData;
+    "customer.created": CustomerCreatedWebhookData;
+    "customer.updated": CustomerUpdatedWebhookData;
+    "checkout.completed": CheckoutCompletedWebhookData;
+}
+/** Legacy envelope payload. Runtime webhook deliveries do not include the event field in the body. */
+interface WebhookPayload<E extends WebhookEvent = WebhookEvent> {
+    event: E;
+    timestamp: string;
+    storeId: string;
+    data: WebhookEventData[E];
+}
+interface RuntimeWebhookStore {
+    id: string;
+    name?: string;
+    timezone: string;
+}
+interface RuntimeWebhookBasePayload {
+    event_id?: string;
+    occurred_at?: string;
+    store: RuntimeWebhookStore;
+}
+interface RuntimeWebhookOrder {
+    id: string;
+    [key: string]: unknown;
+}
+interface RuntimeWebhookProduct {
+    id: string;
+    [key: string]: unknown;
+}
+interface RuntimeWebhookCustomer {
+    id: string;
+    [key: string]: unknown;
+}
+interface RuntimeOrderWebhookPayload extends RuntimeWebhookBasePayload {
+    order: RuntimeWebhookOrder;
+    customer?: RuntimeWebhookCustomer;
+}
+interface RuntimeProductWebhookPayload extends RuntimeWebhookBasePayload {
+    product: RuntimeWebhookProduct;
+}
+interface RuntimeCustomerWebhookPayload extends RuntimeWebhookBasePayload {
+    customer: RuntimeWebhookCustomer;
+}
+interface RuntimeCheckoutCompletedWebhookPayload extends RuntimeWebhookBasePayload {
+    order: RuntimeWebhookOrder;
+    customer: RuntimeWebhookCustomer;
+    store: RuntimeWebhookStore;
+}
+interface RuntimeWebhookEventData {
+    "order.created": RuntimeOrderWebhookPayload;
+    "order.updated": RuntimeOrderWebhookPayload;
+    "order.cancelled": RuntimeOrderWebhookPayload;
+    "order.completed": RuntimeOrderWebhookPayload;
+    "product.created": RuntimeProductWebhookPayload;
+    "product.updated": RuntimeProductWebhookPayload;
+    "product.deleted": RuntimeProductWebhookPayload;
+    "customer.created": RuntimeCustomerWebhookPayload;
+    "customer.updated": RuntimeCustomerWebhookPayload;
+    "checkout.completed": RuntimeCheckoutCompletedWebhookPayload;
+}
+/** Runtime body delivered to subscriber endpoints. The event comes from X-Webhook-Event. */
+type RuntimeWebhookPayload<E extends WebhookEvent = WebhookEvent> = RuntimeWebhookEventData[E];
+/** Validate the minimum runtime payload shape before invoking typed handlers. */
+declare function isRuntimeWebhookPayload<E extends WebhookEvent>(value: unknown, event: E): value is RuntimeWebhookPayload<E>;
+
+export { type RuntimeWebhookPayload as R, type WebhookEvent as W, WEBHOOK_EVENTS as a, isWebhookEvent as b, type WebhookEventData as c, type WebhookPayload as d, type RuntimeWebhookBasePayload as e, type RuntimeWebhookEventData as f, type RuntimeWebhookStore as g, isRuntimeWebhookPayload as i };

package/dist/webhooks/index.cjs

@@ -20,20 +20,35 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/webhooks/index.ts
 var webhooks_exports = {};
 __export(webhooks_exports, {
+  WEBHOOK_EVENTS: () => WEBHOOK_EVENTS,
+  isRuntimeWebhookPayload: () => isRuntimeWebhookPayload,
+  isWebhookEvent: () => isWebhookEvent,
   verifyWebhook: () => verifyWebhook
 });
 module.exports = __toCommonJS(webhooks_exports);
 
 // src/webhooks/verify.ts
 var import_node_crypto = require("crypto");
+var DEFAULT_TOLERANCE_SECONDS = 300;
 function verifyWebhook({
   payload,
   signature,
-  secret
+  timestamp,
+  secret,
+  toleranceSeconds = DEFAULT_TOLERANCE_SECONDS,
+  currentTime = Math.floor(Date.now() / 1e3)
 }) {
-  if (!payload || !signature || !secret) return false;
-  const expected = (0, import_node_crypto.createHmac)("sha256", secret).update(payload, "utf8").digest("hex");
+  if (!payload || !signature || !secret || timestamp === "") return false;
+  const timestampString = String(timestamp);
+  const timestampValue = typeof timestamp === "number" ? timestamp : Number(timestamp);
+  if (!Number.isInteger(timestampValue)) return false;
+  if (!Number.isFinite(toleranceSeconds) || toleranceSeconds < 0) return false;
+  if (!Number.isFinite(currentTime)) return false;
+  const ageSeconds = Math.abs(currentTime - timestampValue);
+  if (ageSeconds > toleranceSeconds) return false;
+  const expected = (0, import_node_crypto.createHmac)("sha256", secret).update(`${timestampString}.${payload}`, "utf8").digest("hex");
   if (expected.length !== signature.length) return false;
+  if (!/^[a-f0-9]+$/i.test(signature)) return false;
   try {
     return (0, import_node_crypto.timingSafeEqual)(
       Buffer.from(expected, "hex"),
@@ -43,8 +58,68 @@ function verifyWebhook({
     return false;
   }
 }
+
+// src/webhooks/types.ts
+var import_events = require("@whatalo/protocol/events");
+var WEBHOOK_EVENTS = import_events.PUBLIC_WEBHOOK_EVENTS;
+function isWebhookEvent(value) {
+  return (0, import_events.isPublicWebhookEvent)(value);
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasStringId(value) {
+  return isRecord(value) && typeof value.id === "string";
+}
+function isOptionalString(value, key) {
+  return value[key] === void 0 || typeof value[key] === "string";
+}
+function isRuntimeWebhookStore(value) {
+  return isRecord(value) && typeof value.id === "string" && typeof value.timezone === "string" && (value.name === void 0 || typeof value.name === "string");
+}
+function hasValidBasePayloadFields(value) {
+  if (!isOptionalString(value, "event_id")) return false;
+  if (!isOptionalString(value, "occurred_at")) return false;
+  return isRuntimeWebhookStore(value.store);
+}
+function isRuntimeOrderWebhookPayload(value) {
+  return hasValidBasePayloadFields(value) && hasStringId(value.order) && (value.customer === void 0 || hasStringId(value.customer));
+}
+function isRuntimeProductWebhookPayload(value) {
+  return hasValidBasePayloadFields(value) && hasStringId(value.product);
+}
+function isRuntimeCustomerWebhookPayload(value) {
+  return hasValidBasePayloadFields(value) && hasStringId(value.customer);
+}
+function isRuntimeCheckoutCompletedWebhookPayload(value) {
+  return hasValidBasePayloadFields(value) && hasStringId(value.order) && hasStringId(value.customer) && isRuntimeWebhookStore(value.store);
+}
+function isRuntimeWebhookPayload(value, event) {
+  if (!isRecord(value)) return false;
+  switch (event) {
+    case WEBHOOK_EVENTS.ORDER_CREATED:
+    case WEBHOOK_EVENTS.ORDER_UPDATED:
+    case WEBHOOK_EVENTS.ORDER_CANCELLED:
+    case WEBHOOK_EVENTS.ORDER_COMPLETED:
+      return isRuntimeOrderWebhookPayload(value);
+    case WEBHOOK_EVENTS.PRODUCT_CREATED:
+    case WEBHOOK_EVENTS.PRODUCT_UPDATED:
+    case WEBHOOK_EVENTS.PRODUCT_DELETED:
+      return isRuntimeProductWebhookPayload(value);
+    case WEBHOOK_EVENTS.CUSTOMER_CREATED:
+    case WEBHOOK_EVENTS.CUSTOMER_UPDATED:
+      return isRuntimeCustomerWebhookPayload(value);
+    case WEBHOOK_EVENTS.CHECKOUT_COMPLETED:
+      return isRuntimeCheckoutCompletedWebhookPayload(value);
+    default:
+      return false;
+  }
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  WEBHOOK_EVENTS,
+  isRuntimeWebhookPayload,
+  isWebhookEvent,
   verifyWebhook
 });
 //# sourceMappingURL=index.cjs.map

package/dist/webhooks/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/webhooks/index.ts","../../src/webhooks/verify.ts"],"sourcesContent":["export { verifyWebhook } from \"./verify.js\";\nexport type { VerifyWebhookParams } from \"./verify.js\";\nexport type {\n  WebhookEvent,\n  WebhookEventData,\n  WebhookPayload,\n} from \"./types.js\";\n","import { createHmac, timingSafeEqual } from \"node:crypto\";\n\nexport interface VerifyWebhookParams {\n  /** Raw request body as a string (NOT parsed JSON) */\n  payload: string;\n  /** Value of the X-Webhook-Signature header */\n  signature: string;\n  /** App's webhook secret (provided during app installation) */\n  secret: string;\n}\n\n/**\n * Verify webhook signature using HMAC-SHA256.\n * Uses timing-safe comparison to prevent timing attacks.\n */\nexport function verifyWebhook({\n  payload,\n  signature,\n  secret,\n}: VerifyWebhookParams): boolean {\n  if (!payload || !signature || !secret) return false;\n\n  const expected = createHmac(\"sha256\", secret)\n    .update(payload, \"utf8\")\n    .digest(\"hex\");\n\n  if (expected.length !== signature.length) return false;\n\n  try {\n    return timingSafeEqual(\n      Buffer.from(expected, \"hex\"),\n      Buffer.from(signature, \"hex\")\n    );\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,yBAA4C;AAerC,SAAS,cAAc;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AACF,GAAiC;AAC/B,MAAI,CAAC,WAAW,CAAC,aAAa,CAAC,OAAQ,QAAO;AAE9C,QAAM,eAAW,+BAAW,UAAU,MAAM,EACzC,OAAO,SAAS,MAAM,EACtB,OAAO,KAAK;AAEf,MAAI,SAAS,WAAW,UAAU,OAAQ,QAAO;AAEjD,MAAI;AACF,eAAO;AAAA,MACL,OAAO,KAAK,UAAU,KAAK;AAAA,MAC3B,OAAO,KAAK,WAAW,KAAK;AAAA,IAC9B;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}
+{"version":3,"sources":["../../src/webhooks/index.ts","../../src/webhooks/verify.ts","../../src/webhooks/types.ts"],"sourcesContent":["export { verifyWebhook } from \"./verify.js\";\nexport { WEBHOOK_EVENTS, isRuntimeWebhookPayload, isWebhookEvent } from \"./types.js\";\nexport type { VerifyWebhookParams } from \"./verify.js\";\nexport type {\n  WebhookEvent,\n  WebhookEventData,\n  WebhookPayload,\n  RuntimeWebhookBasePayload,\n  RuntimeWebhookEventData,\n  RuntimeWebhookPayload,\n  RuntimeWebhookStore,\n} from \"./types.js\";\n","import { createHmac, timingSafeEqual } from \"node:crypto\";\n\nconst DEFAULT_TOLERANCE_SECONDS = 300;\n\nexport interface VerifyWebhookParams {\n  /** Raw request body as a string (NOT parsed JSON) */\n  payload: string;\n  /** Value of the X-Webhook-Signature header */\n  signature: string;\n  /** Value of the X-Webhook-Timestamp header (Unix epoch in seconds) */\n  timestamp: string | number;\n  /** App's webhook secret (provided during app installation) */\n  secret: string;\n  /** Maximum timestamp drift allowed in seconds. Defaults to 300 seconds. */\n  toleranceSeconds?: number;\n  /** Current Unix epoch time in seconds. Intended for tests. */\n  currentTime?: number;\n}\n\n/**\n * Verify webhook signature using HMAC-SHA256 over `${timestamp}.${payload}`.\n * Uses timing-safe comparison to prevent timing attacks.\n */\nexport function verifyWebhook({\n  payload,\n  signature,\n  timestamp,\n  secret,\n  toleranceSeconds = DEFAULT_TOLERANCE_SECONDS,\n  currentTime = Math.floor(Date.now() / 1000),\n}: VerifyWebhookParams): boolean {\n  if (!payload || !signature || !secret || timestamp === \"\") return false;\n\n  const timestampString = String(timestamp);\n  const timestampValue =\n    typeof timestamp === \"number\" ? timestamp : Number(timestamp);\n\n  if (!Number.isInteger(timestampValue)) return false;\n  if (!Number.isFinite(toleranceSeconds) || toleranceSeconds < 0) return false;\n  if (!Number.isFinite(currentTime)) return false;\n\n  const ageSeconds = Math.abs(currentTime - timestampValue);\n  if (ageSeconds > toleranceSeconds) return false;\n\n  const expected = createHmac(\"sha256\", secret)\n    .update(`${timestampString}.${payload}`, \"utf8\")\n    .digest(\"hex\");\n\n  if (expected.length !== signature.length) return false;\n  if (!/^[a-f0-9]+$/i.test(signature)) return false;\n\n  try {\n    return timingSafeEqual(\n      Buffer.from(expected, \"hex\"),\n      Buffer.from(signature, \"hex\")\n    );\n  } catch {\n    return false;\n  }\n}\n","import {\n  PUBLIC_WEBHOOK_EVENTS,\n  isPublicWebhookEvent,\n  type PublicWebhookEvent,\n} from \"@whatalo/protocol/events\";\nimport type { Product, Order, Customer } from \"../client/types.js\";\n\nexport const WEBHOOK_EVENTS = PUBLIC_WEBHOOK_EVENTS;\n\n/** All supported webhook event types */\nexport type WebhookEvent = PublicWebhookEvent;\n\n/** Validate an event header against the public runtime webhook event set. */\nexport function isWebhookEvent(value: string): value is WebhookEvent {\n  return isPublicWebhookEvent(value);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction hasStringId(value: unknown): value is { id: string } {\n  return isRecord(value) && typeof value.id === \"string\";\n}\n\nfunction isOptionalString(\n  value: Record<string, unknown>,\n  key: string\n): boolean {\n  return value[key] === undefined || typeof value[key] === \"string\";\n}\n\nfunction isRuntimeWebhookStore(value: unknown): value is RuntimeWebhookStore {\n  return (\n    isRecord(value) &&\n    typeof value.id === \"string\" &&\n    typeof value.timezone === \"string\" &&\n    (value.name === undefined || typeof value.name === \"string\")\n  );\n}\n\nfunction hasValidBasePayloadFields(value: Record<string, unknown>): boolean {\n  if (!isOptionalString(value, \"event_id\")) return false;\n  if (!isOptionalString(value, \"occurred_at\")) return false;\n\n  return isRuntimeWebhookStore(value.store);\n}\n\nfunction isRuntimeOrderWebhookPayload(value: Record<string, unknown>): boolean {\n  return (\n    hasValidBasePayloadFields(value) &&\n    hasStringId(value.order) &&\n    (value.customer === undefined || hasStringId(value.customer))\n  );\n}\n\nfunction isRuntimeProductWebhookPayload(value: Record<string, unknown>): boolean {\n  return hasValidBasePayloadFields(value) && hasStringId(value.product);\n}\n\nfunction isRuntimeCustomerWebhookPayload(value: Record<string, unknown>): boolean {\n  return hasValidBasePayloadFields(value) && hasStringId(value.customer);\n}\n\nfunction isRuntimeCheckoutCompletedWebhookPayload(\n  value: Record<string, unknown>\n): boolean {\n  return (\n    hasValidBasePayloadFields(value) &&\n    hasStringId(value.order) &&\n    hasStringId(value.customer) &&\n    isRuntimeWebhookStore(value.store)\n  );\n}\n\nexport interface OrderCreatedWebhookData {\n  order: Order;\n}\n\nexport interface OrderUpdatedWebhookData {\n  order: Order;\n  changes: string[];\n}\n\nexport interface OrderCancelledWebhookData {\n  orderId: string;\n  reason?: string;\n}\n\nexport interface OrderCompletedWebhookData {\n  order: Order;\n}\n\nexport interface ProductCreatedWebhookData {\n  product: Product;\n}\n\nexport interface ProductUpdatedWebhookData {\n  product: Product;\n  changes: string[];\n}\n\nexport interface ProductDeletedWebhookProduct {\n  id: string;\n}\n\nexport interface ProductDeletedWebhookData {\n  product: ProductDeletedWebhookProduct;\n}\n\nexport interface CustomerCreatedWebhookData {\n  customer: Customer;\n}\n\nexport interface CustomerUpdatedWebhookData {\n  customer: Customer;\n  changes: string[];\n}\n\nexport interface CheckoutCompletedWebhookData {\n  order: RuntimeWebhookOrder;\n  customer: RuntimeWebhookCustomer;\n  store: RuntimeWebhookStore;\n}\n\n/** Map of webhook events to their payload data shapes */\nexport interface WebhookEventData {\n  \"order.created\": OrderCreatedWebhookData;\n  \"order.updated\": OrderUpdatedWebhookData;\n  \"order.cancelled\": OrderCancelledWebhookData;\n  \"order.completed\": OrderCompletedWebhookData;\n  \"product.created\": ProductCreatedWebhookData;\n  \"product.updated\": ProductUpdatedWebhookData;\n  \"product.deleted\": ProductDeletedWebhookData;\n  \"customer.created\": CustomerCreatedWebhookData;\n  \"customer.updated\": CustomerUpdatedWebhookData;\n  \"checkout.completed\": CheckoutCompletedWebhookData;\n}\n\n/** Legacy envelope payload. Runtime webhook deliveries do not include the event field in the body. */\nexport interface WebhookPayload<E extends WebhookEvent = WebhookEvent> {\n  event: E;\n  timestamp: string;\n  storeId: string;\n  data: WebhookEventData[E];\n}\n\nexport interface RuntimeWebhookStore {\n  id: string;\n  name?: string;\n  timezone: string;\n}\n\nexport interface RuntimeWebhookBasePayload {\n  event_id?: string;\n  occurred_at?: string;\n  store: RuntimeWebhookStore;\n}\n\nexport interface RuntimeWebhookOrder {\n  id: string;\n  [key: string]: unknown;\n}\n\nexport interface RuntimeWebhookProduct {\n  id: string;\n  [key: string]: unknown;\n}\n\nexport interface RuntimeWebhookCustomer {\n  id: string;\n  [key: string]: unknown;\n}\n\nexport interface RuntimeOrderWebhookPayload extends RuntimeWebhookBasePayload {\n  order: RuntimeWebhookOrder;\n  customer?: RuntimeWebhookCustomer;\n}\n\nexport interface RuntimeProductWebhookPayload extends RuntimeWebhookBasePayload {\n  product: RuntimeWebhookProduct;\n}\n\nexport interface RuntimeCustomerWebhookPayload extends RuntimeWebhookBasePayload {\n  customer: RuntimeWebhookCustomer;\n}\n\nexport interface RuntimeCheckoutCompletedWebhookPayload\n  extends RuntimeWebhookBasePayload {\n  order: RuntimeWebhookOrder;\n  customer: RuntimeWebhookCustomer;\n  store: RuntimeWebhookStore;\n}\n\nexport interface RuntimeWebhookEventData {\n  \"order.created\": RuntimeOrderWebhookPayload;\n  \"order.updated\": RuntimeOrderWebhookPayload;\n  \"order.cancelled\": RuntimeOrderWebhookPayload;\n  \"order.completed\": RuntimeOrderWebhookPayload;\n  \"product.created\": RuntimeProductWebhookPayload;\n  \"product.updated\": RuntimeProductWebhookPayload;\n  \"product.deleted\": RuntimeProductWebhookPayload;\n  \"customer.created\": RuntimeCustomerWebhookPayload;\n  \"customer.updated\": RuntimeCustomerWebhookPayload;\n  \"checkout.completed\": RuntimeCheckoutCompletedWebhookPayload;\n}\n\n/** Runtime body delivered to subscriber endpoints. The event comes from X-Webhook-Event. */\nexport type RuntimeWebhookPayload<E extends WebhookEvent = WebhookEvent> =\n  RuntimeWebhookEventData[E];\n\n/** Validate the minimum runtime payload shape before invoking typed handlers. */\nexport function isRuntimeWebhookPayload<E extends WebhookEvent>(\n  value: unknown,\n  event: E\n): value is RuntimeWebhookPayload<E> {\n  if (!isRecord(value)) return false;\n\n  switch (event) {\n    case WEBHOOK_EVENTS.ORDER_CREATED:\n    case WEBHOOK_EVENTS.ORDER_UPDATED:\n    case WEBHOOK_EVENTS.ORDER_CANCELLED:\n    case WEBHOOK_EVENTS.ORDER_COMPLETED:\n      return isRuntimeOrderWebhookPayload(value);\n    case WEBHOOK_EVENTS.PRODUCT_CREATED:\n    case WEBHOOK_EVENTS.PRODUCT_UPDATED:\n    case WEBHOOK_EVENTS.PRODUCT_DELETED:\n      return isRuntimeProductWebhookPayload(value);\n    case WEBHOOK_EVENTS.CUSTOMER_CREATED:\n    case WEBHOOK_EVENTS.CUSTOMER_UPDATED:\n      return isRuntimeCustomerWebhookPayload(value);\n    case WEBHOOK_EVENTS.CHECKOUT_COMPLETED:\n      return isRuntimeCheckoutCompletedWebhookPayload(value);\n    default:\n      return false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,yBAA4C;AAE5C,IAAM,4BAA4B;AAqB3B,SAAS,cAAc;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,mBAAmB;AAAA,EACnB,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC5C,GAAiC;AAC/B,MAAI,CAAC,WAAW,CAAC,aAAa,CAAC,UAAU,cAAc,GAAI,QAAO;AAElE,QAAM,kBAAkB,OAAO,SAAS;AACxC,QAAM,iBACJ,OAAO,cAAc,WAAW,YAAY,OAAO,SAAS;AAE9D,MAAI,CAAC,OAAO,UAAU,cAAc,EAAG,QAAO;AAC9C,MAAI,CAAC,OAAO,SAAS,gBAAgB,KAAK,mBAAmB,EAAG,QAAO;AACvE,MAAI,CAAC,OAAO,SAAS,WAAW,EAAG,QAAO;AAE1C,QAAM,aAAa,KAAK,IAAI,cAAc,cAAc;AACxD,MAAI,aAAa,iBAAkB,QAAO;AAE1C,QAAM,eAAW,+BAAW,UAAU,MAAM,EACzC,OAAO,GAAG,eAAe,IAAI,OAAO,IAAI,MAAM,EAC9C,OAAO,KAAK;AAEf,MAAI,SAAS,WAAW,UAAU,OAAQ,QAAO;AACjD,MAAI,CAAC,eAAe,KAAK,SAAS,EAAG,QAAO;AAE5C,MAAI;AACF,eAAO;AAAA,MACL,OAAO,KAAK,UAAU,KAAK;AAAA,MAC3B,OAAO,KAAK,WAAW,KAAK;AAAA,IAC9B;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AC3DA,oBAIO;AAGA,IAAM,iBAAiB;AAMvB,SAAS,eAAe,OAAsC;AACnE,aAAO,oCAAqB,KAAK;AACnC;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,YAAY,OAAyC;AAC5D,SAAO,SAAS,KAAK,KAAK,OAAO,MAAM,OAAO;AAChD;AAEA,SAAS,iBACP,OACA,KACS;AACT,SAAO,MAAM,GAAG,MAAM,UAAa,OAAO,MAAM,GAAG,MAAM;AAC3D;AAEA,SAAS,sBAAsB,OAA8C;AAC3E,SACE,SAAS,KAAK,KACd,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,aAAa,aACzB,MAAM,SAAS,UAAa,OAAO,MAAM,SAAS;AAEvD;AAEA,SAAS,0BAA0B,OAAyC;AAC1E,MAAI,CAAC,iBAAiB,OAAO,UAAU,EAAG,QAAO;AACjD,MAAI,CAAC,iBAAiB,OAAO,aAAa,EAAG,QAAO;AAEpD,SAAO,sBAAsB,MAAM,KAAK;AAC1C;AAEA,SAAS,6BAA6B,OAAyC;AAC7E,SACE,0BAA0B,KAAK,KAC/B,YAAY,MAAM,KAAK,MACtB,MAAM,aAAa,UAAa,YAAY,MAAM,QAAQ;AAE/D;AAEA,SAAS,+BAA+B,OAAyC;AAC/E,SAAO,0BAA0B,KAAK,KAAK,YAAY,MAAM,OAAO;AACtE;AAEA,SAAS,gCAAgC,OAAyC;AAChF,SAAO,0BAA0B,KAAK,KAAK,YAAY,MAAM,QAAQ;AACvE;AAEA,SAAS,yCACP,OACS;AACT,SACE,0BAA0B,KAAK,KAC/B,YAAY,MAAM,KAAK,KACvB,YAAY,MAAM,QAAQ,KAC1B,sBAAsB,MAAM,KAAK;AAErC;AA2IO,SAAS,wBACd,OACA,OACmC;AACnC,MAAI,CAAC,SAAS,KAAK,EAAG,QAAO;AAE7B,UAAQ,OAAO;AAAA,IACb,KAAK,eAAe;AAAA,IACpB,KAAK,eAAe;AAAA,IACpB,KAAK,eAAe;AAAA,IACpB,KAAK,eAAe;AAClB,aAAO,6BAA6B,KAAK;AAAA,IAC3C,KAAK,eAAe;AAAA,IACpB,KAAK,eAAe;AAAA,IACpB,KAAK,eAAe;AAClB,aAAO,+BAA+B,KAAK;AAAA,IAC7C,KAAK,eAAe;AAAA,IACpB,KAAK,eAAe;AAClB,aAAO,gCAAgC,KAAK;AAAA,IAC9C,KAAK,eAAe;AAClB,aAAO,yCAAyC,KAAK;AAAA,IACvD;AACE,aAAO;AAAA,EACX;AACF;","names":[]}

package/dist/webhooks/index.d.cts

@@ -1,18 +1,25 @@
-export { W as WebhookEvent, b as WebhookEventData, a as WebhookPayload } from '../types-tHUO9u-c.cjs';
-import '../types-DcmArIC2.cjs';
+export { e as RuntimeWebhookBasePayload, f as RuntimeWebhookEventData, R as RuntimeWebhookPayload, g as RuntimeWebhookStore, a as WEBHOOK_EVENTS, W as WebhookEvent, c as WebhookEventData, d as WebhookPayload, i as isRuntimeWebhookPayload, b as isWebhookEvent } from '../types-rA6kVlpV.cjs';
+import '@whatalo/protocol/events';
+import '../types-B8BAV362.cjs';
 
 interface VerifyWebhookParams {
     /** Raw request body as a string (NOT parsed JSON) */
     payload: string;
     /** Value of the X-Webhook-Signature header */
     signature: string;
+    /** Value of the X-Webhook-Timestamp header (Unix epoch in seconds) */
+    timestamp: string | number;
     /** App's webhook secret (provided during app installation) */
     secret: string;
+    /** Maximum timestamp drift allowed in seconds. Defaults to 300 seconds. */
+    toleranceSeconds?: number;
+    /** Current Unix epoch time in seconds. Intended for tests. */
+    currentTime?: number;
 }
 /**
- * Verify webhook signature using HMAC-SHA256.
+ * Verify webhook signature using HMAC-SHA256 over `${timestamp}.${payload}`.
  * Uses timing-safe comparison to prevent timing attacks.
  */
-declare function verifyWebhook({ payload, signature, secret, }: VerifyWebhookParams): boolean;
+declare function verifyWebhook({ payload, signature, timestamp, secret, toleranceSeconds, currentTime, }: VerifyWebhookParams): boolean;
 
 export { type VerifyWebhookParams, verifyWebhook };

package/dist/webhooks/index.d.ts

@@ -1,18 +1,25 @@
-export { W as WebhookEvent, b as WebhookEventData, a as WebhookPayload } from '../types-DTjA3FHe.js';
-import '../types-DcmArIC2.js';
+export { e as RuntimeWebhookBasePayload, f as RuntimeWebhookEventData, R as RuntimeWebhookPayload, g as RuntimeWebhookStore, a as WEBHOOK_EVENTS, W as WebhookEvent, c as WebhookEventData, d as WebhookPayload, i as isRuntimeWebhookPayload, b as isWebhookEvent } from '../types-Bo9GbqrM.js';
+import '@whatalo/protocol/events';
+import '../types-B8BAV362.js';
 
 interface VerifyWebhookParams {
     /** Raw request body as a string (NOT parsed JSON) */
     payload: string;
     /** Value of the X-Webhook-Signature header */
     signature: string;
+    /** Value of the X-Webhook-Timestamp header (Unix epoch in seconds) */
+    timestamp: string | number;
     /** App's webhook secret (provided during app installation) */
     secret: string;
+    /** Maximum timestamp drift allowed in seconds. Defaults to 300 seconds. */
+    toleranceSeconds?: number;
+    /** Current Unix epoch time in seconds. Intended for tests. */
+    currentTime?: number;
 }
 /**
- * Verify webhook signature using HMAC-SHA256.
+ * Verify webhook signature using HMAC-SHA256 over `${timestamp}.${payload}`.
  * Uses timing-safe comparison to prevent timing attacks.
  */
-declare function verifyWebhook({ payload, signature, secret, }: VerifyWebhookParams): boolean;
+declare function verifyWebhook({ payload, signature, timestamp, secret, toleranceSeconds, currentTime, }: VerifyWebhookParams): boolean;
 
 export { type VerifyWebhookParams, verifyWebhook };