@whatalo/plugin-sdk 1.2.0 → 1.2.2

package/dist/adapters/express.cjs

@@ -26,14 +26,26 @@ module.exports = __toCommonJS(express_exports);
 
 // src/webhooks/verify.ts
 var import_node_crypto = require("crypto");
+var DEFAULT_TOLERANCE_SECONDS = 300;
 function verifyWebhook({
   payload,
   signature,
-  secret
+  timestamp,
+  secret,
+  toleranceSeconds = DEFAULT_TOLERANCE_SECONDS,
+  currentTime = Math.floor(Date.now() / 1e3)
 }) {
-  if (!payload || !signature || !secret) return false;
-  const expected = (0, import_node_crypto.createHmac)("sha256", secret).update(payload, "utf8").digest("hex");
+  if (!payload || !signature || !secret || timestamp === "") return false;
+  const timestampString = String(timestamp);
+  const timestampValue = typeof timestamp === "number" ? timestamp : Number(timestamp);
+  if (!Number.isInteger(timestampValue)) return false;
+  if (!Number.isFinite(toleranceSeconds) || toleranceSeconds < 0) return false;
+  if (!Number.isFinite(currentTime)) return false;
+  const ageSeconds = Math.abs(currentTime - timestampValue);
+  if (ageSeconds > toleranceSeconds) return false;
+  const expected = (0, import_node_crypto.createHmac)("sha256", secret).update(`${timestampString}.${payload}`, "utf8").digest("hex");
   if (expected.length !== signature.length) return false;
+  if (!/^[a-f0-9]+$/i.test(signature)) return false;
   try {
     return (0, import_node_crypto.timingSafeEqual)(
       Buffer.from(expected, "hex"),
@@ -44,9 +56,71 @@ function verifyWebhook({
   }
 }
 
+// src/webhooks/types.ts
+var import_events = require("@whatalo/protocol/events");
+var WEBHOOK_EVENTS = import_events.PUBLIC_WEBHOOK_EVENTS;
+function isWebhookEvent(value) {
+  return (0, import_events.isPublicWebhookEvent)(value);
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasStringId(value) {
+  return isRecord(value) && typeof value.id === "string";
+}
+function isOptionalString(value, key) {
+  return value[key] === void 0 || typeof value[key] === "string";
+}
+function isRuntimeWebhookStore(value) {
+  return isRecord(value) && typeof value.id === "string" && typeof value.timezone === "string" && (value.name === void 0 || typeof value.name === "string");
+}
+function hasValidBasePayloadFields(value) {
+  if (!isOptionalString(value, "event_id")) return false;
+  if (!isOptionalString(value, "occurred_at")) return false;
+  return isRuntimeWebhookStore(value.store);
+}
+function isRuntimeOrderWebhookPayload(value) {
+  return hasValidBasePayloadFields(value) && hasStringId(value.order) && (value.customer === void 0 || hasStringId(value.customer));
+}
+function isRuntimeProductWebhookPayload(value) {
+  return hasValidBasePayloadFields(value) && hasStringId(value.product);
+}
+function isRuntimeCustomerWebhookPayload(value) {
+  return hasValidBasePayloadFields(value) && hasStringId(value.customer);
+}
+function isRuntimeCheckoutCompletedWebhookPayload(value) {
+  return hasValidBasePayloadFields(value) && hasStringId(value.order) && hasStringId(value.customer) && isRuntimeWebhookStore(value.store);
+}
+function isRuntimeCheckoutAbandonedWebhookPayload(value) {
+  return hasValidBasePayloadFields(value) && hasStringId(value.checkout) && isRuntimeWebhookStore(value.store);
+}
+function isRuntimeWebhookPayload(value, event) {
+  if (!isRecord(value)) return false;
+  switch (event) {
+    case WEBHOOK_EVENTS.ORDER_CREATED:
+    case WEBHOOK_EVENTS.ORDER_UPDATED:
+    case WEBHOOK_EVENTS.ORDER_CANCELLED:
+    case WEBHOOK_EVENTS.ORDER_COMPLETED:
+      return isRuntimeOrderWebhookPayload(value);
+    case WEBHOOK_EVENTS.PRODUCT_CREATED:
+    case WEBHOOK_EVENTS.PRODUCT_UPDATED:
+    case WEBHOOK_EVENTS.PRODUCT_DELETED:
+      return isRuntimeProductWebhookPayload(value);
+    case WEBHOOK_EVENTS.CUSTOMER_CREATED:
+    case WEBHOOK_EVENTS.CUSTOMER_UPDATED:
+      return isRuntimeCustomerWebhookPayload(value);
+    case WEBHOOK_EVENTS.CHECKOUT_COMPLETED:
+      return isRuntimeCheckoutCompletedWebhookPayload(value);
+    case WEBHOOK_EVENTS.CHECKOUT_ABANDONED:
+      return isRuntimeCheckoutAbandonedWebhookPayload(value);
+    default:
+      return false;
+  }
+}
+
 // src/adapters/express.ts
-function getSignature(headers) {
-  const value = headers["x-webhook-signature"];
+function getHeader(name, headers) {
+  const value = headers[name];
   if (Array.isArray(value)) {
     return value[0] ?? "";
   }
@@ -56,23 +130,45 @@ function createWebhookHandler(options) {
   return async function webhookHandler(req, res) {
     try {
       const rawPayload = typeof req.body === "string" ? req.body : req.body.toString("utf8");
-      const signature = getSignature(req.headers);
+      const signature = getHeader("x-webhook-signature", req.headers);
+      const timestamp = getHeader("x-webhook-timestamp", req.headers);
+      const event = getHeader("x-webhook-event", req.headers);
+      const deliveryId = getHeader("x-webhook-id", req.headers);
       const isValid = verifyWebhook({
         payload: rawPayload,
         signature,
+        timestamp,
         secret: options.secret
       });
       if (!isValid) {
         res.status(401).json({ error: "Invalid signature" });
         return;
       }
-      const payload = JSON.parse(rawPayload);
-      const event = payload.event;
+      if (!event) {
+        res.status(400).json({ error: "Missing event header" });
+        return;
+      }
+      if (!isWebhookEvent(event)) {
+        res.status(400).json({ error: "Invalid event header" });
+        return;
+      }
+      let parsedPayload;
+      try {
+        parsedPayload = JSON.parse(rawPayload);
+      } catch {
+        res.status(400).json({ error: "Invalid JSON" });
+        return;
+      }
+      if (!isRuntimeWebhookPayload(parsedPayload, event)) {
+        res.status(400).json({ error: "Invalid payload" });
+        return;
+      }
+      const context = { deliveryId, event, timestamp };
       const handler = options.handlers[event];
       if (handler) {
-        await handler(payload);
+        await handler(parsedPayload, context);
       } else if (options.onUnhandledEvent) {
-        await options.onUnhandledEvent(event, payload);
+        await options.onUnhandledEvent(event, parsedPayload, context);
       }
       res.status(200).send("OK");
     } catch {

package/dist/adapters/express.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/adapters/express.ts","../../src/webhooks/verify.ts"],"sourcesContent":["import { verifyWebhook } from \"../webhooks/verify.js\";\nimport type { WebhookPayload } from \"../webhooks/types.js\";\nimport type { WebhookEventHandler, WebhookHandlerOptions } from \"./types.js\";\n\ntype ExpressLikeRequest = {\n  body: Buffer | string;\n  headers: Record<string, string | string[] | undefined>;\n};\n\ntype ExpressLikeResponse = {\n  status: (code: number) => {\n    json: (body: unknown) => void;\n    send: (body: string) => void;\n  };\n};\n\nfunction getSignature(\n  headers: Record<string, string | string[] | undefined>\n): string {\n  const value = headers[\"x-webhook-signature\"];\n\n  if (Array.isArray(value)) {\n    return value[0] ?? \"\";\n  }\n\n  return value ?? \"\";\n}\n\nexport function createWebhookHandler(\n  options: WebhookHandlerOptions\n): (req: ExpressLikeRequest, res: ExpressLikeResponse) => Promise<void> {\n  return async function webhookHandler(\n    req: ExpressLikeRequest,\n    res: ExpressLikeResponse\n  ): Promise<void> {\n    try {\n      const rawPayload =\n        typeof req.body === \"string\" ? req.body : req.body.toString(\"utf8\");\n      const signature = getSignature(req.headers);\n\n      const isValid = verifyWebhook({\n        payload: rawPayload,\n        signature,\n        secret: options.secret,\n      });\n\n      if (!isValid) {\n        res.status(401).json({ error: \"Invalid signature\" });\n        return;\n      }\n\n      const payload = JSON.parse(rawPayload) as WebhookPayload;\n      const event = payload.event;\n      const handler = options.handlers[event] as\n        | WebhookEventHandler<typeof event>\n        | undefined;\n\n      if (handler) {\n        await handler(payload);\n      } else if (options.onUnhandledEvent) {\n        await options.onUnhandledEvent(event, payload);\n      }\n\n      res.status(200).send(\"OK\");\n    } catch {\n      res.status(500).json({ error: \"Internal error\" });\n    }\n  };\n}\n","import { createHmac, timingSafeEqual } from \"node:crypto\";\n\nexport interface VerifyWebhookParams {\n  /** Raw request body as a string (NOT parsed JSON) */\n  payload: string;\n  /** Value of the X-Webhook-Signature header */\n  signature: string;\n  /** App's webhook secret (provided during app installation) */\n  secret: string;\n}\n\n/**\n * Verify webhook signature using HMAC-SHA256.\n * Uses timing-safe comparison to prevent timing attacks.\n */\nexport function verifyWebhook({\n  payload,\n  signature,\n  secret,\n}: VerifyWebhookParams): boolean {\n  if (!payload || !signature || !secret) return false;\n\n  const expected = createHmac(\"sha256\", secret)\n    .update(payload, \"utf8\")\n    .digest(\"hex\");\n\n  if (expected.length !== signature.length) return false;\n\n  try {\n    return timingSafeEqual(\n      Buffer.from(expected, \"hex\"),\n      Buffer.from(signature, \"hex\")\n    );\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,yBAA4C;AAerC,SAAS,cAAc;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AACF,GAAiC;AAC/B,MAAI,CAAC,WAAW,CAAC,aAAa,CAAC,OAAQ,QAAO;AAE9C,QAAM,eAAW,+BAAW,UAAU,MAAM,EACzC,OAAO,SAAS,MAAM,EACtB,OAAO,KAAK;AAEf,MAAI,SAAS,WAAW,UAAU,OAAQ,QAAO;AAEjD,MAAI;AACF,eAAO;AAAA,MACL,OAAO,KAAK,UAAU,KAAK;AAAA,MAC3B,OAAO,KAAK,WAAW,KAAK;AAAA,IAC9B;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ADpBA,SAAS,aACP,SACQ;AACR,QAAM,QAAQ,QAAQ,qBAAqB;AAE3C,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,CAAC,KAAK;AAAA,EACrB;AAEA,SAAO,SAAS;AAClB;AAEO,SAAS,qBACd,SACsE;AACtE,SAAO,eAAe,eACpB,KACA,KACe;AACf,QAAI;AACF,YAAM,aACJ,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO,IAAI,KAAK,SAAS,MAAM;AACpE,YAAM,YAAY,aAAa,IAAI,OAAO;AAE1C,YAAM,UAAU,cAAc;AAAA,QAC5B,SAAS;AAAA,QACT;AAAA,QACA,QAAQ,QAAQ;AAAA,MAClB,CAAC;AAED,UAAI,CAAC,SAAS;AACZ,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;AACnD;AAAA,MACF;AAEA,YAAM,UAAU,KAAK,MAAM,UAAU;AACrC,YAAM,QAAQ,QAAQ;AACtB,YAAM,UAAU,QAAQ,SAAS,KAAK;AAItC,UAAI,SAAS;AACX,cAAM,QAAQ,OAAO;AAAA,MACvB,WAAW,QAAQ,kBAAkB;AACnC,cAAM,QAAQ,iBAAiB,OAAO,OAAO;AAAA,MAC/C;AAEA,UAAI,OAAO,GAAG,EAAE,KAAK,IAAI;AAAA,IAC3B,QAAQ;AACN,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAAA,IAClD;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/adapters/express.ts","../../src/webhooks/verify.ts","../../src/webhooks/types.ts"],"sourcesContent":["import { verifyWebhook } from \"../webhooks/verify.js\";\nimport { isRuntimeWebhookPayload, isWebhookEvent } from \"../webhooks/types.js\";\nimport type { WebhookEventHandler, WebhookHandlerOptions } from \"./types.js\";\n\ntype ExpressLikeRequest = {\n  body: Buffer | string;\n  headers: Record<string, string | string[] | undefined>;\n};\n\ntype ExpressLikeStatusResponse = {\n  json: (body: unknown) => void;\n  send: (body: string) => void;\n};\n\ntype ExpressLikeResponse = {\n  status: (code: number) => ExpressLikeStatusResponse;\n};\n\nfunction getHeader(\n  name: string,\n  headers: Record<string, string | string[] | undefined>\n): string {\n  const value = headers[name];\n\n  if (Array.isArray(value)) {\n    return value[0] ?? \"\";\n  }\n\n  return value ?? \"\";\n}\n\nexport function createWebhookHandler(\n  options: WebhookHandlerOptions\n): (req: ExpressLikeRequest, res: ExpressLikeResponse) => Promise<void> {\n  return async function webhookHandler(\n    req: ExpressLikeRequest,\n    res: ExpressLikeResponse\n  ): Promise<void> {\n    try {\n      const rawPayload =\n        typeof req.body === \"string\" ? req.body : req.body.toString(\"utf8\");\n      const signature = getHeader(\"x-webhook-signature\", req.headers);\n      const timestamp = getHeader(\"x-webhook-timestamp\", req.headers);\n      const event = getHeader(\"x-webhook-event\", req.headers);\n      const deliveryId = getHeader(\"x-webhook-id\", req.headers);\n\n      const isValid = verifyWebhook({\n        payload: rawPayload,\n        signature,\n        timestamp,\n        secret: options.secret,\n      });\n\n      if (!isValid) {\n        res.status(401).json({ error: \"Invalid signature\" });\n        return;\n      }\n\n      if (!event) {\n        res.status(400).json({ error: \"Missing event header\" });\n        return;\n      }\n\n      if (!isWebhookEvent(event)) {\n        res.status(400).json({ error: \"Invalid event header\" });\n        return;\n      }\n\n      let parsedPayload: unknown;\n      try {\n        parsedPayload = JSON.parse(rawPayload) as unknown;\n      } catch {\n        res.status(400).json({ error: \"Invalid JSON\" });\n        return;\n      }\n\n      if (!isRuntimeWebhookPayload(parsedPayload, event)) {\n        res.status(400).json({ error: \"Invalid payload\" });\n        return;\n      }\n\n      const context = { deliveryId, event, timestamp };\n      const handler = options.handlers[event] as\n        | WebhookEventHandler<typeof event>\n        | undefined;\n\n      if (handler) {\n        await handler(parsedPayload, context);\n      } else if (options.onUnhandledEvent) {\n        await options.onUnhandledEvent(event, parsedPayload, context);\n      }\n\n      res.status(200).send(\"OK\");\n    } catch {\n      res.status(500).json({ error: \"Internal error\" });\n    }\n  };\n}\n","import { createHmac, timingSafeEqual } from \"node:crypto\";\n\nconst DEFAULT_TOLERANCE_SECONDS = 300;\n\nexport interface VerifyWebhookParams {\n  /** Raw request body as a string (NOT parsed JSON) */\n  payload: string;\n  /** Value of the X-Webhook-Signature header */\n  signature: string;\n  /** Value of the X-Webhook-Timestamp header (Unix epoch in seconds) */\n  timestamp: string | number;\n  /** App's webhook secret (provided during app installation) */\n  secret: string;\n  /** Maximum timestamp drift allowed in seconds. Defaults to 300 seconds. */\n  toleranceSeconds?: number;\n  /** Current Unix epoch time in seconds. Intended for tests. */\n  currentTime?: number;\n}\n\n/**\n * Verify webhook signature using HMAC-SHA256 over `${timestamp}.${payload}`.\n * Uses timing-safe comparison to prevent timing attacks.\n */\nexport function verifyWebhook({\n  payload,\n  signature,\n  timestamp,\n  secret,\n  toleranceSeconds = DEFAULT_TOLERANCE_SECONDS,\n  currentTime = Math.floor(Date.now() / 1000),\n}: VerifyWebhookParams): boolean {\n  if (!payload || !signature || !secret || timestamp === \"\") return false;\n\n  const timestampString = String(timestamp);\n  const timestampValue =\n    typeof timestamp === \"number\" ? timestamp : Number(timestamp);\n\n  if (!Number.isInteger(timestampValue)) return false;\n  if (!Number.isFinite(toleranceSeconds) || toleranceSeconds < 0) return false;\n  if (!Number.isFinite(currentTime)) return false;\n\n  const ageSeconds = Math.abs(currentTime - timestampValue);\n  if (ageSeconds > toleranceSeconds) return false;\n\n  const expected = createHmac(\"sha256\", secret)\n    .update(`${timestampString}.${payload}`, \"utf8\")\n    .digest(\"hex\");\n\n  if (expected.length !== signature.length) return false;\n  if (!/^[a-f0-9]+$/i.test(signature)) return false;\n\n  try {\n    return timingSafeEqual(\n      Buffer.from(expected, \"hex\"),\n      Buffer.from(signature, \"hex\")\n    );\n  } catch {\n    return false;\n  }\n}\n","import {\n  PUBLIC_WEBHOOK_EVENTS,\n  isPublicWebhookEvent,\n  type PublicWebhookEvent,\n} from \"@whatalo/protocol/events\";\nimport type { Product, Order, Customer } from \"../client/types.js\";\n\nexport const WEBHOOK_EVENTS = PUBLIC_WEBHOOK_EVENTS;\n\n/** All supported webhook event types */\nexport type WebhookEvent = PublicWebhookEvent;\n\n/** Validate an event header against the public runtime webhook event set. */\nexport function isWebhookEvent(value: string): value is WebhookEvent {\n  return isPublicWebhookEvent(value);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction hasStringId(value: unknown): value is { id: string } {\n  return isRecord(value) && typeof value.id === \"string\";\n}\n\nfunction isOptionalString(\n  value: Record<string, unknown>,\n  key: string\n): boolean {\n  return value[key] === undefined || typeof value[key] === \"string\";\n}\n\nfunction isRuntimeWebhookStore(value: unknown): value is RuntimeWebhookStore {\n  return (\n    isRecord(value) &&\n    typeof value.id === \"string\" &&\n    typeof value.timezone === \"string\" &&\n    (value.name === undefined || typeof value.name === \"string\")\n  );\n}\n\nfunction hasValidBasePayloadFields(value: Record<string, unknown>): boolean {\n  if (!isOptionalString(value, \"event_id\")) return false;\n  if (!isOptionalString(value, \"occurred_at\")) return false;\n\n  return isRuntimeWebhookStore(value.store);\n}\n\nfunction isRuntimeOrderWebhookPayload(value: Record<string, unknown>): boolean {\n  return (\n    hasValidBasePayloadFields(value) &&\n    hasStringId(value.order) &&\n    (value.customer === undefined || hasStringId(value.customer))\n  );\n}\n\nfunction isRuntimeProductWebhookPayload(value: Record<string, unknown>): boolean {\n  return hasValidBasePayloadFields(value) && hasStringId(value.product);\n}\n\nfunction isRuntimeCustomerWebhookPayload(value: Record<string, unknown>): boolean {\n  return hasValidBasePayloadFields(value) && hasStringId(value.customer);\n}\n\nfunction isRuntimeCheckoutCompletedWebhookPayload(\n  value: Record<string, unknown>\n): boolean {\n  return (\n    hasValidBasePayloadFields(value) &&\n    hasStringId(value.order) &&\n    hasStringId(value.customer) &&\n    isRuntimeWebhookStore(value.store)\n  );\n}\n\nfunction isRuntimeCheckoutAbandonedWebhookPayload(\n  value: Record<string, unknown>\n): boolean {\n  // An abandoned draft is pre-customer, so `customer` carries no `id` and is not required.\n  return (\n    hasValidBasePayloadFields(value) &&\n    hasStringId(value.checkout) &&\n    isRuntimeWebhookStore(value.store)\n  );\n}\n\nexport interface OrderCreatedWebhookData {\n  order: Order;\n}\n\nexport interface OrderUpdatedWebhookData {\n  order: Order;\n  changes: string[];\n}\n\nexport interface OrderCancelledWebhookData {\n  orderId: string;\n  reason?: string;\n}\n\nexport interface OrderCompletedWebhookData {\n  order: Order;\n}\n\nexport interface ProductCreatedWebhookData {\n  product: Product;\n}\n\nexport interface ProductUpdatedWebhookData {\n  product: Product;\n  changes: string[];\n}\n\nexport interface ProductDeletedWebhookProduct {\n  id: string;\n}\n\nexport interface ProductDeletedWebhookData {\n  product: ProductDeletedWebhookProduct;\n}\n\nexport interface CustomerCreatedWebhookData {\n  customer: Customer;\n}\n\nexport interface CustomerUpdatedWebhookData {\n  customer: Customer;\n  changes: string[];\n}\n\nexport interface CheckoutCompletedWebhookData {\n  order: RuntimeWebhookOrder;\n  customer: RuntimeWebhookCustomer;\n  store: RuntimeWebhookStore;\n}\n\n/** Contact captured on an abandoned draft. No `id` — the draft is pre-customer. */\nexport interface CheckoutAbandonedWebhookCustomer {\n  name: string | null;\n  email: string | null;\n  phone: string | null;\n}\n\nexport interface CheckoutAbandonedWebhookData {\n  checkout: RuntimeWebhookCheckout;\n  customer: CheckoutAbandonedWebhookCustomer;\n  store: RuntimeWebhookStore;\n}\n\n/** Map of webhook events to their payload data shapes */\nexport interface WebhookEventData {\n  \"order.created\": OrderCreatedWebhookData;\n  \"order.updated\": OrderUpdatedWebhookData;\n  \"order.cancelled\": OrderCancelledWebhookData;\n  \"order.completed\": OrderCompletedWebhookData;\n  \"product.created\": ProductCreatedWebhookData;\n  \"product.updated\": ProductUpdatedWebhookData;\n  \"product.deleted\": ProductDeletedWebhookData;\n  \"customer.created\": CustomerCreatedWebhookData;\n  \"customer.updated\": CustomerUpdatedWebhookData;\n  \"checkout.completed\": CheckoutCompletedWebhookData;\n  \"checkout.abandoned\": CheckoutAbandonedWebhookData;\n}\n\n/** Legacy envelope payload. Runtime webhook deliveries do not include the event field in the body. */\nexport interface WebhookPayload<E extends WebhookEvent = WebhookEvent> {\n  event: E;\n  timestamp: string;\n  storeId: string;\n  data: WebhookEventData[E];\n}\n\nexport interface RuntimeWebhookStore {\n  id: string;\n  name?: string;\n  timezone: string;\n}\n\nexport interface RuntimeWebhookBasePayload {\n  event_id?: string;\n  occurred_at?: string;\n  store: RuntimeWebhookStore;\n}\n\nexport interface RuntimeWebhookOrder {\n  id: string;\n  [key: string]: unknown;\n}\n\nexport interface RuntimeWebhookProduct {\n  id: string;\n  [key: string]: unknown;\n}\n\nexport interface RuntimeWebhookCustomer {\n  id: string;\n  [key: string]: unknown;\n}\n\nexport interface RuntimeWebhookCheckout {\n  id: string;\n  [key: string]: unknown;\n}\n\nexport interface RuntimeOrderWebhookPayload extends RuntimeWebhookBasePayload {\n  order: RuntimeWebhookOrder;\n  customer?: RuntimeWebhookCustomer;\n}\n\nexport interface RuntimeProductWebhookPayload extends RuntimeWebhookBasePayload {\n  product: RuntimeWebhookProduct;\n}\n\nexport interface RuntimeCustomerWebhookPayload extends RuntimeWebhookBasePayload {\n  customer: RuntimeWebhookCustomer;\n}\n\nexport interface RuntimeCheckoutCompletedWebhookPayload\n  extends RuntimeWebhookBasePayload {\n  order: RuntimeWebhookOrder;\n  customer: RuntimeWebhookCustomer;\n  store: RuntimeWebhookStore;\n}\n\nexport interface RuntimeCheckoutAbandonedWebhookPayload\n  extends RuntimeWebhookBasePayload {\n  checkout: RuntimeWebhookCheckout;\n  // Pre-customer draft: contact fields only, no customer id.\n  customer?: CheckoutAbandonedWebhookCustomer;\n}\n\nexport interface RuntimeWebhookEventData {\n  \"order.created\": RuntimeOrderWebhookPayload;\n  \"order.updated\": RuntimeOrderWebhookPayload;\n  \"order.cancelled\": RuntimeOrderWebhookPayload;\n  \"order.completed\": RuntimeOrderWebhookPayload;\n  \"product.created\": RuntimeProductWebhookPayload;\n  \"product.updated\": RuntimeProductWebhookPayload;\n  \"product.deleted\": RuntimeProductWebhookPayload;\n  \"customer.created\": RuntimeCustomerWebhookPayload;\n  \"customer.updated\": RuntimeCustomerWebhookPayload;\n  \"checkout.completed\": RuntimeCheckoutCompletedWebhookPayload;\n  \"checkout.abandoned\": RuntimeCheckoutAbandonedWebhookPayload;\n}\n\n/** Runtime body delivered to subscriber endpoints. The event comes from X-Webhook-Event. */\nexport type RuntimeWebhookPayload<E extends WebhookEvent = WebhookEvent> =\n  RuntimeWebhookEventData[E];\n\n/** Validate the minimum runtime payload shape before invoking typed handlers. */\nexport function isRuntimeWebhookPayload<E extends WebhookEvent>(\n  value: unknown,\n  event: E\n): value is RuntimeWebhookPayload<E> {\n  if (!isRecord(value)) return false;\n\n  switch (event) {\n    case WEBHOOK_EVENTS.ORDER_CREATED:\n    case WEBHOOK_EVENTS.ORDER_UPDATED:\n    case WEBHOOK_EVENTS.ORDER_CANCELLED:\n    case WEBHOOK_EVENTS.ORDER_COMPLETED:\n      return isRuntimeOrderWebhookPayload(value);\n    case WEBHOOK_EVENTS.PRODUCT_CREATED:\n    case WEBHOOK_EVENTS.PRODUCT_UPDATED:\n    case WEBHOOK_EVENTS.PRODUCT_DELETED:\n      return isRuntimeProductWebhookPayload(value);\n    case WEBHOOK_EVENTS.CUSTOMER_CREATED:\n    case WEBHOOK_EVENTS.CUSTOMER_UPDATED:\n      return isRuntimeCustomerWebhookPayload(value);\n    case WEBHOOK_EVENTS.CHECKOUT_COMPLETED:\n      return isRuntimeCheckoutCompletedWebhookPayload(value);\n    case WEBHOOK_EVENTS.CHECKOUT_ABANDONED:\n      return isRuntimeCheckoutAbandonedWebhookPayload(value);\n    default:\n      return false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,yBAA4C;AAE5C,IAAM,4BAA4B;AAqB3B,SAAS,cAAc;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,mBAAmB;AAAA,EACnB,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC5C,GAAiC;AAC/B,MAAI,CAAC,WAAW,CAAC,aAAa,CAAC,UAAU,cAAc,GAAI,QAAO;AAElE,QAAM,kBAAkB,OAAO,SAAS;AACxC,QAAM,iBACJ,OAAO,cAAc,WAAW,YAAY,OAAO,SAAS;AAE9D,MAAI,CAAC,OAAO,UAAU,cAAc,EAAG,QAAO;AAC9C,MAAI,CAAC,OAAO,SAAS,gBAAgB,KAAK,mBAAmB,EAAG,QAAO;AACvE,MAAI,CAAC,OAAO,SAAS,WAAW,EAAG,QAAO;AAE1C,QAAM,aAAa,KAAK,IAAI,cAAc,cAAc;AACxD,MAAI,aAAa,iBAAkB,QAAO;AAE1C,QAAM,eAAW,+BAAW,UAAU,MAAM,EACzC,OAAO,GAAG,eAAe,IAAI,OAAO,IAAI,MAAM,EAC9C,OAAO,KAAK;AAEf,MAAI,SAAS,WAAW,UAAU,OAAQ,QAAO;AACjD,MAAI,CAAC,eAAe,KAAK,SAAS,EAAG,QAAO;AAE5C,MAAI;AACF,eAAO;AAAA,MACL,OAAO,KAAK,UAAU,KAAK;AAAA,MAC3B,OAAO,KAAK,WAAW,KAAK;AAAA,IAC9B;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AC3DA,oBAIO;AAGA,IAAM,iBAAiB;AAMvB,SAAS,eAAe,OAAsC;AACnE,aAAO,oCAAqB,KAAK;AACnC;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,YAAY,OAAyC;AAC5D,SAAO,SAAS,KAAK,KAAK,OAAO,MAAM,OAAO;AAChD;AAEA,SAAS,iBACP,OACA,KACS;AACT,SAAO,MAAM,GAAG,MAAM,UAAa,OAAO,MAAM,GAAG,MAAM;AAC3D;AAEA,SAAS,sBAAsB,OAA8C;AAC3E,SACE,SAAS,KAAK,KACd,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,aAAa,aACzB,MAAM,SAAS,UAAa,OAAO,MAAM,SAAS;AAEvD;AAEA,SAAS,0BAA0B,OAAyC;AAC1E,MAAI,CAAC,iBAAiB,OAAO,UAAU,EAAG,QAAO;AACjD,MAAI,CAAC,iBAAiB,OAAO,aAAa,EAAG,QAAO;AAEpD,SAAO,sBAAsB,MAAM,KAAK;AAC1C;AAEA,SAAS,6BAA6B,OAAyC;AAC7E,SACE,0BAA0B,KAAK,KAC/B,YAAY,MAAM,KAAK,MACtB,MAAM,aAAa,UAAa,YAAY,MAAM,QAAQ;AAE/D;AAEA,SAAS,+BAA+B,OAAyC;AAC/E,SAAO,0BAA0B,KAAK,KAAK,YAAY,MAAM,OAAO;AACtE;AAEA,SAAS,gCAAgC,OAAyC;AAChF,SAAO,0BAA0B,KAAK,KAAK,YAAY,MAAM,QAAQ;AACvE;AAEA,SAAS,yCACP,OACS;AACT,SACE,0BAA0B,KAAK,KAC/B,YAAY,MAAM,KAAK,KACvB,YAAY,MAAM,QAAQ,KAC1B,sBAAsB,MAAM,KAAK;AAErC;AAEA,SAAS,yCACP,OACS;AAET,SACE,0BAA0B,KAAK,KAC/B,YAAY,MAAM,QAAQ,KAC1B,sBAAsB,MAAM,KAAK;AAErC;AAsKO,SAAS,wBACd,OACA,OACmC;AACnC,MAAI,CAAC,SAAS,KAAK,EAAG,QAAO;AAE7B,UAAQ,OAAO;AAAA,IACb,KAAK,eAAe;AAAA,IACpB,KAAK,eAAe;AAAA,IACpB,KAAK,eAAe;AAAA,IACpB,KAAK,eAAe;AAClB,aAAO,6BAA6B,KAAK;AAAA,IAC3C,KAAK,eAAe;AAAA,IACpB,KAAK,eAAe;AAAA,IACpB,KAAK,eAAe;AAClB,aAAO,+BAA+B,KAAK;AAAA,IAC7C,KAAK,eAAe;AAAA,IACpB,KAAK,eAAe;AAClB,aAAO,gCAAgC,KAAK;AAAA,IAC9C,KAAK,eAAe;AAClB,aAAO,yCAAyC,KAAK;AAAA,IACvD,KAAK,eAAe;AAClB,aAAO,yCAAyC,KAAK;AAAA,IACvD;AACE,aAAO;AAAA,EACX;AACF;;;AFlQA,SAAS,UACP,MACA,SACQ;AACR,QAAM,QAAQ,QAAQ,IAAI;AAE1B,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,CAAC,KAAK;AAAA,EACrB;AAEA,SAAO,SAAS;AAClB;AAEO,SAAS,qBACd,SACsE;AACtE,SAAO,eAAe,eACpB,KACA,KACe;AACf,QAAI;AACF,YAAM,aACJ,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO,IAAI,KAAK,SAAS,MAAM;AACpE,YAAM,YAAY,UAAU,uBAAuB,IAAI,OAAO;AAC9D,YAAM,YAAY,UAAU,uBAAuB,IAAI,OAAO;AAC9D,YAAM,QAAQ,UAAU,mBAAmB,IAAI,OAAO;AACtD,YAAM,aAAa,UAAU,gBAAgB,IAAI,OAAO;AAExD,YAAM,UAAU,cAAc;AAAA,QAC5B,SAAS;AAAA,QACT;AAAA,QACA;AAAA,QACA,QAAQ,QAAQ;AAAA,MAClB,CAAC;AAED,UAAI,CAAC,SAAS;AACZ,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;AACnD;AAAA,MACF;AAEA,UAAI,CAAC,OAAO;AACV,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,uBAAuB,CAAC;AACtD;AAAA,MACF;AAEA,UAAI,CAAC,eAAe,KAAK,GAAG;AAC1B,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,uBAAuB,CAAC;AACtD;AAAA,MACF;AAEA,UAAI;AACJ,UAAI;AACF,wBAAgB,KAAK,MAAM,UAAU;AAAA,MACvC,QAAQ;AACN,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,eAAe,CAAC;AAC9C;AAAA,MACF;AAEA,UAAI,CAAC,wBAAwB,eAAe,KAAK,GAAG;AAClD,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AACjD;AAAA,MACF;AAEA,YAAM,UAAU,EAAE,YAAY,OAAO,UAAU;AAC/C,YAAM,UAAU,QAAQ,SAAS,KAAK;AAItC,UAAI,SAAS;AACX,cAAM,QAAQ,eAAe,OAAO;AAAA,MACtC,WAAW,QAAQ,kBAAkB;AACnC,cAAM,QAAQ,iBAAiB,OAAO,eAAe,OAAO;AAAA,MAC9D;AAEA,UAAI,OAAO,GAAG,EAAE,KAAK,IAAI;AAAA,IAC3B,QAAQ;AACN,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAAA,IAClD;AAAA,EACF;AACF;","names":[]}

package/dist/adapters/express.d.cts

@@ -1,16 +1,18 @@
-import { W as WebhookHandlerOptions } from '../types-DMuHSL_a.cjs';
-import '../types-tHUO9u-c.cjs';
-import '../types-DcmArIC2.cjs';
+import { W as WebhookHandlerOptions } from '../types-CqyAhbXM.cjs';
+import '../types-CPnSzOfX.cjs';
+import '@whatalo/protocol/events';
+import '../types-B8BAV362.cjs';
 
 type ExpressLikeRequest = {
     body: Buffer | string;
     headers: Record<string, string | string[] | undefined>;
 };
+type ExpressLikeStatusResponse = {
+    json: (body: unknown) => void;
+    send: (body: string) => void;
+};
 type ExpressLikeResponse = {
-    status: (code: number) => {
-        json: (body: unknown) => void;
-        send: (body: string) => void;
-    };
+    status: (code: number) => ExpressLikeStatusResponse;
 };
 declare function createWebhookHandler(options: WebhookHandlerOptions): (req: ExpressLikeRequest, res: ExpressLikeResponse) => Promise<void>;
 

package/dist/adapters/express.d.ts

@@ -1,16 +1,18 @@
-import { W as WebhookHandlerOptions } from '../types-C9mg4aQg.js';
-import '../types-DTjA3FHe.js';
-import '../types-DcmArIC2.js';
+import { W as WebhookHandlerOptions } from '../types-Bzee9Hvr.js';
+import '../types-CDKGAQ3o.js';
+import '@whatalo/protocol/events';
+import '../types-B8BAV362.js';
 
 type ExpressLikeRequest = {
     body: Buffer | string;
     headers: Record<string, string | string[] | undefined>;
 };
+type ExpressLikeStatusResponse = {
+    json: (body: unknown) => void;
+    send: (body: string) => void;
+};
 type ExpressLikeResponse = {
-    status: (code: number) => {
-        json: (body: unknown) => void;
-        send: (body: string) => void;
-    };
+    status: (code: number) => ExpressLikeStatusResponse;
 };
 declare function createWebhookHandler(options: WebhookHandlerOptions): (req: ExpressLikeRequest, res: ExpressLikeResponse) => Promise<void>;
 

package/dist/adapters/express.mjs

@@ -1,13 +1,25 @@
 // src/webhooks/verify.ts
 import { createHmac, timingSafeEqual } from "crypto";
+var DEFAULT_TOLERANCE_SECONDS = 300;
 function verifyWebhook({
   payload,
   signature,
-  secret
+  timestamp,
+  secret,
+  toleranceSeconds = DEFAULT_TOLERANCE_SECONDS,
+  currentTime = Math.floor(Date.now() / 1e3)
 }) {
-  if (!payload || !signature || !secret) return false;
-  const expected = createHmac("sha256", secret).update(payload, "utf8").digest("hex");
+  if (!payload || !signature || !secret || timestamp === "") return false;
+  const timestampString = String(timestamp);
+  const timestampValue = typeof timestamp === "number" ? timestamp : Number(timestamp);
+  if (!Number.isInteger(timestampValue)) return false;
+  if (!Number.isFinite(toleranceSeconds) || toleranceSeconds < 0) return false;
+  if (!Number.isFinite(currentTime)) return false;
+  const ageSeconds = Math.abs(currentTime - timestampValue);
+  if (ageSeconds > toleranceSeconds) return false;
+  const expected = createHmac("sha256", secret).update(`${timestampString}.${payload}`, "utf8").digest("hex");
   if (expected.length !== signature.length) return false;
+  if (!/^[a-f0-9]+$/i.test(signature)) return false;
   try {
     return timingSafeEqual(
       Buffer.from(expected, "hex"),
@@ -18,9 +30,74 @@ function verifyWebhook({
   }
 }
 
+// src/webhooks/types.ts
+import {
+  PUBLIC_WEBHOOK_EVENTS,
+  isPublicWebhookEvent
+} from "@whatalo/protocol/events";
+var WEBHOOK_EVENTS = PUBLIC_WEBHOOK_EVENTS;
+function isWebhookEvent(value) {
+  return isPublicWebhookEvent(value);
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasStringId(value) {
+  return isRecord(value) && typeof value.id === "string";
+}
+function isOptionalString(value, key) {
+  return value[key] === void 0 || typeof value[key] === "string";
+}
+function isRuntimeWebhookStore(value) {
+  return isRecord(value) && typeof value.id === "string" && typeof value.timezone === "string" && (value.name === void 0 || typeof value.name === "string");
+}
+function hasValidBasePayloadFields(value) {
+  if (!isOptionalString(value, "event_id")) return false;
+  if (!isOptionalString(value, "occurred_at")) return false;
+  return isRuntimeWebhookStore(value.store);
+}
+function isRuntimeOrderWebhookPayload(value) {
+  return hasValidBasePayloadFields(value) && hasStringId(value.order) && (value.customer === void 0 || hasStringId(value.customer));
+}
+function isRuntimeProductWebhookPayload(value) {
+  return hasValidBasePayloadFields(value) && hasStringId(value.product);
+}
+function isRuntimeCustomerWebhookPayload(value) {
+  return hasValidBasePayloadFields(value) && hasStringId(value.customer);
+}
+function isRuntimeCheckoutCompletedWebhookPayload(value) {
+  return hasValidBasePayloadFields(value) && hasStringId(value.order) && hasStringId(value.customer) && isRuntimeWebhookStore(value.store);
+}
+function isRuntimeCheckoutAbandonedWebhookPayload(value) {
+  return hasValidBasePayloadFields(value) && hasStringId(value.checkout) && isRuntimeWebhookStore(value.store);
+}
+function isRuntimeWebhookPayload(value, event) {
+  if (!isRecord(value)) return false;
+  switch (event) {
+    case WEBHOOK_EVENTS.ORDER_CREATED:
+    case WEBHOOK_EVENTS.ORDER_UPDATED:
+    case WEBHOOK_EVENTS.ORDER_CANCELLED:
+    case WEBHOOK_EVENTS.ORDER_COMPLETED:
+      return isRuntimeOrderWebhookPayload(value);
+    case WEBHOOK_EVENTS.PRODUCT_CREATED:
+    case WEBHOOK_EVENTS.PRODUCT_UPDATED:
+    case WEBHOOK_EVENTS.PRODUCT_DELETED:
+      return isRuntimeProductWebhookPayload(value);
+    case WEBHOOK_EVENTS.CUSTOMER_CREATED:
+    case WEBHOOK_EVENTS.CUSTOMER_UPDATED:
+      return isRuntimeCustomerWebhookPayload(value);
+    case WEBHOOK_EVENTS.CHECKOUT_COMPLETED:
+      return isRuntimeCheckoutCompletedWebhookPayload(value);
+    case WEBHOOK_EVENTS.CHECKOUT_ABANDONED:
+      return isRuntimeCheckoutAbandonedWebhookPayload(value);
+    default:
+      return false;
+  }
+}
+
 // src/adapters/express.ts
-function getSignature(headers) {
-  const value = headers["x-webhook-signature"];
+function getHeader(name, headers) {
+  const value = headers[name];
   if (Array.isArray(value)) {
     return value[0] ?? "";
   }
@@ -30,23 +107,45 @@ function createWebhookHandler(options) {
   return async function webhookHandler(req, res) {
     try {
       const rawPayload = typeof req.body === "string" ? req.body : req.body.toString("utf8");
-      const signature = getSignature(req.headers);
+      const signature = getHeader("x-webhook-signature", req.headers);
+      const timestamp = getHeader("x-webhook-timestamp", req.headers);
+      const event = getHeader("x-webhook-event", req.headers);
+      const deliveryId = getHeader("x-webhook-id", req.headers);
       const isValid = verifyWebhook({
         payload: rawPayload,
         signature,
+        timestamp,
         secret: options.secret
       });
       if (!isValid) {
         res.status(401).json({ error: "Invalid signature" });
         return;
       }
-      const payload = JSON.parse(rawPayload);
-      const event = payload.event;
+      if (!event) {
+        res.status(400).json({ error: "Missing event header" });
+        return;
+      }
+      if (!isWebhookEvent(event)) {
+        res.status(400).json({ error: "Invalid event header" });
+        return;
+      }
+      let parsedPayload;
+      try {
+        parsedPayload = JSON.parse(rawPayload);
+      } catch {
+        res.status(400).json({ error: "Invalid JSON" });
+        return;
+      }
+      if (!isRuntimeWebhookPayload(parsedPayload, event)) {
+        res.status(400).json({ error: "Invalid payload" });
+        return;
+      }
+      const context = { deliveryId, event, timestamp };
       const handler = options.handlers[event];
       if (handler) {
-        await handler(payload);
+        await handler(parsedPayload, context);
       } else if (options.onUnhandledEvent) {
-        await options.onUnhandledEvent(event, payload);
+        await options.onUnhandledEvent(event, parsedPayload, context);
       }
       res.status(200).send("OK");
     } catch {

package/dist/adapters/express.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/webhooks/verify.ts","../../src/adapters/express.ts"],"sourcesContent":["import { createHmac, timingSafeEqual } from \"node:crypto\";\n\nexport interface VerifyWebhookParams {\n  /** Raw request body as a string (NOT parsed JSON) */\n  payload: string;\n  /** Value of the X-Webhook-Signature header */\n  signature: string;\n  /** App's webhook secret (provided during app installation) */\n  secret: string;\n}\n\n/**\n * Verify webhook signature using HMAC-SHA256.\n * Uses timing-safe comparison to prevent timing attacks.\n */\nexport function verifyWebhook({\n  payload,\n  signature,\n  secret,\n}: VerifyWebhookParams): boolean {\n  if (!payload || !signature || !secret) return false;\n\n  const expected = createHmac(\"sha256\", secret)\n    .update(payload, \"utf8\")\n    .digest(\"hex\");\n\n  if (expected.length !== signature.length) return false;\n\n  try {\n    return timingSafeEqual(\n      Buffer.from(expected, \"hex\"),\n      Buffer.from(signature, \"hex\")\n    );\n  } catch {\n    return false;\n  }\n}\n","import { verifyWebhook } from \"../webhooks/verify.js\";\nimport type { WebhookPayload } from \"../webhooks/types.js\";\nimport type { WebhookEventHandler, WebhookHandlerOptions } from \"./types.js\";\n\ntype ExpressLikeRequest = {\n  body: Buffer | string;\n  headers: Record<string, string | string[] | undefined>;\n};\n\ntype ExpressLikeResponse = {\n  status: (code: number) => {\n    json: (body: unknown) => void;\n    send: (body: string) => void;\n  };\n};\n\nfunction getSignature(\n  headers: Record<string, string | string[] | undefined>\n): string {\n  const value = headers[\"x-webhook-signature\"];\n\n  if (Array.isArray(value)) {\n    return value[0] ?? \"\";\n  }\n\n  return value ?? \"\";\n}\n\nexport function createWebhookHandler(\n  options: WebhookHandlerOptions\n): (req: ExpressLikeRequest, res: ExpressLikeResponse) => Promise<void> {\n  return async function webhookHandler(\n    req: ExpressLikeRequest,\n    res: ExpressLikeResponse\n  ): Promise<void> {\n    try {\n      const rawPayload =\n        typeof req.body === \"string\" ? req.body : req.body.toString(\"utf8\");\n      const signature = getSignature(req.headers);\n\n      const isValid = verifyWebhook({\n        payload: rawPayload,\n        signature,\n        secret: options.secret,\n      });\n\n      if (!isValid) {\n        res.status(401).json({ error: \"Invalid signature\" });\n        return;\n      }\n\n      const payload = JSON.parse(rawPayload) as WebhookPayload;\n      const event = payload.event;\n      const handler = options.handlers[event] as\n        | WebhookEventHandler<typeof event>\n        | undefined;\n\n      if (handler) {\n        await handler(payload);\n      } else if (options.onUnhandledEvent) {\n        await options.onUnhandledEvent(event, payload);\n      }\n\n      res.status(200).send(\"OK\");\n    } catch {\n      res.status(500).json({ error: \"Internal error\" });\n    }\n  };\n}\n"],"mappings":";AAAA,SAAS,YAAY,uBAAuB;AAerC,SAAS,cAAc;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AACF,GAAiC;AAC/B,MAAI,CAAC,WAAW,CAAC,aAAa,CAAC,OAAQ,QAAO;AAE9C,QAAM,WAAW,WAAW,UAAU,MAAM,EACzC,OAAO,SAAS,MAAM,EACtB,OAAO,KAAK;AAEf,MAAI,SAAS,WAAW,UAAU,OAAQ,QAAO;AAEjD,MAAI;AACF,WAAO;AAAA,MACL,OAAO,KAAK,UAAU,KAAK;AAAA,MAC3B,OAAO,KAAK,WAAW,KAAK;AAAA,IAC9B;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACpBA,SAAS,aACP,SACQ;AACR,QAAM,QAAQ,QAAQ,qBAAqB;AAE3C,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,CAAC,KAAK;AAAA,EACrB;AAEA,SAAO,SAAS;AAClB;AAEO,SAAS,qBACd,SACsE;AACtE,SAAO,eAAe,eACpB,KACA,KACe;AACf,QAAI;AACF,YAAM,aACJ,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO,IAAI,KAAK,SAAS,MAAM;AACpE,YAAM,YAAY,aAAa,IAAI,OAAO;AAE1C,YAAM,UAAU,cAAc;AAAA,QAC5B,SAAS;AAAA,QACT;AAAA,QACA,QAAQ,QAAQ;AAAA,MAClB,CAAC;AAED,UAAI,CAAC,SAAS;AACZ,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;AACnD;AAAA,MACF;AAEA,YAAM,UAAU,KAAK,MAAM,UAAU;AACrC,YAAM,QAAQ,QAAQ;AACtB,YAAM,UAAU,QAAQ,SAAS,KAAK;AAItC,UAAI,SAAS;AACX,cAAM,QAAQ,OAAO;AAAA,MACvB,WAAW,QAAQ,kBAAkB;AACnC,cAAM,QAAQ,iBAAiB,OAAO,OAAO;AAAA,MAC/C;AAEA,UAAI,OAAO,GAAG,EAAE,KAAK,IAAI;AAAA,IAC3B,QAAQ;AACN,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAAA,IAClD;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/webhooks/verify.ts","../../src/webhooks/types.ts","../../src/adapters/express.ts"],"sourcesContent":["import { createHmac, timingSafeEqual } from \"node:crypto\";\n\nconst DEFAULT_TOLERANCE_SECONDS = 300;\n\nexport interface VerifyWebhookParams {\n  /** Raw request body as a string (NOT parsed JSON) */\n  payload: string;\n  /** Value of the X-Webhook-Signature header */\n  signature: string;\n  /** Value of the X-Webhook-Timestamp header (Unix epoch in seconds) */\n  timestamp: string | number;\n  /** App's webhook secret (provided during app installation) */\n  secret: string;\n  /** Maximum timestamp drift allowed in seconds. Defaults to 300 seconds. */\n  toleranceSeconds?: number;\n  /** Current Unix epoch time in seconds. Intended for tests. */\n  currentTime?: number;\n}\n\n/**\n * Verify webhook signature using HMAC-SHA256 over `${timestamp}.${payload}`.\n * Uses timing-safe comparison to prevent timing attacks.\n */\nexport function verifyWebhook({\n  payload,\n  signature,\n  timestamp,\n  secret,\n  toleranceSeconds = DEFAULT_TOLERANCE_SECONDS,\n  currentTime = Math.floor(Date.now() / 1000),\n}: VerifyWebhookParams): boolean {\n  if (!payload || !signature || !secret || timestamp === \"\") return false;\n\n  const timestampString = String(timestamp);\n  const timestampValue =\n    typeof timestamp === \"number\" ? timestamp : Number(timestamp);\n\n  if (!Number.isInteger(timestampValue)) return false;\n  if (!Number.isFinite(toleranceSeconds) || toleranceSeconds < 0) return false;\n  if (!Number.isFinite(currentTime)) return false;\n\n  const ageSeconds = Math.abs(currentTime - timestampValue);\n  if (ageSeconds > toleranceSeconds) return false;\n\n  const expected = createHmac(\"sha256\", secret)\n    .update(`${timestampString}.${payload}`, \"utf8\")\n    .digest(\"hex\");\n\n  if (expected.length !== signature.length) return false;\n  if (!/^[a-f0-9]+$/i.test(signature)) return false;\n\n  try {\n    return timingSafeEqual(\n      Buffer.from(expected, \"hex\"),\n      Buffer.from(signature, \"hex\")\n    );\n  } catch {\n    return false;\n  }\n}\n","import {\n  PUBLIC_WEBHOOK_EVENTS,\n  isPublicWebhookEvent,\n  type PublicWebhookEvent,\n} from \"@whatalo/protocol/events\";\nimport type { Product, Order, Customer } from \"../client/types.js\";\n\nexport const WEBHOOK_EVENTS = PUBLIC_WEBHOOK_EVENTS;\n\n/** All supported webhook event types */\nexport type WebhookEvent = PublicWebhookEvent;\n\n/** Validate an event header against the public runtime webhook event set. */\nexport function isWebhookEvent(value: string): value is WebhookEvent {\n  return isPublicWebhookEvent(value);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction hasStringId(value: unknown): value is { id: string } {\n  return isRecord(value) && typeof value.id === \"string\";\n}\n\nfunction isOptionalString(\n  value: Record<string, unknown>,\n  key: string\n): boolean {\n  return value[key] === undefined || typeof value[key] === \"string\";\n}\n\nfunction isRuntimeWebhookStore(value: unknown): value is RuntimeWebhookStore {\n  return (\n    isRecord(value) &&\n    typeof value.id === \"string\" &&\n    typeof value.timezone === \"string\" &&\n    (value.name === undefined || typeof value.name === \"string\")\n  );\n}\n\nfunction hasValidBasePayloadFields(value: Record<string, unknown>): boolean {\n  if (!isOptionalString(value, \"event_id\")) return false;\n  if (!isOptionalString(value, \"occurred_at\")) return false;\n\n  return isRuntimeWebhookStore(value.store);\n}\n\nfunction isRuntimeOrderWebhookPayload(value: Record<string, unknown>): boolean {\n  return (\n    hasValidBasePayloadFields(value) &&\n    hasStringId(value.order) &&\n    (value.customer === undefined || hasStringId(value.customer))\n  );\n}\n\nfunction isRuntimeProductWebhookPayload(value: Record<string, unknown>): boolean {\n  return hasValidBasePayloadFields(value) && hasStringId(value.product);\n}\n\nfunction isRuntimeCustomerWebhookPayload(value: Record<string, unknown>): boolean {\n  return hasValidBasePayloadFields(value) && hasStringId(value.customer);\n}\n\nfunction isRuntimeCheckoutCompletedWebhookPayload(\n  value: Record<string, unknown>\n): boolean {\n  return (\n    hasValidBasePayloadFields(value) &&\n    hasStringId(value.order) &&\n    hasStringId(value.customer) &&\n    isRuntimeWebhookStore(value.store)\n  );\n}\n\nfunction isRuntimeCheckoutAbandonedWebhookPayload(\n  value: Record<string, unknown>\n): boolean {\n  // An abandoned draft is pre-customer, so `customer` carries no `id` and is not required.\n  return (\n    hasValidBasePayloadFields(value) &&\n    hasStringId(value.checkout) &&\n    isRuntimeWebhookStore(value.store)\n  );\n}\n\nexport interface OrderCreatedWebhookData {\n  order: Order;\n}\n\nexport interface OrderUpdatedWebhookData {\n  order: Order;\n  changes: string[];\n}\n\nexport interface OrderCancelledWebhookData {\n  orderId: string;\n  reason?: string;\n}\n\nexport interface OrderCompletedWebhookData {\n  order: Order;\n}\n\nexport interface ProductCreatedWebhookData {\n  product: Product;\n}\n\nexport interface ProductUpdatedWebhookData {\n  product: Product;\n  changes: string[];\n}\n\nexport interface ProductDeletedWebhookProduct {\n  id: string;\n}\n\nexport interface ProductDeletedWebhookData {\n  product: ProductDeletedWebhookProduct;\n}\n\nexport interface CustomerCreatedWebhookData {\n  customer: Customer;\n}\n\nexport interface CustomerUpdatedWebhookData {\n  customer: Customer;\n  changes: string[];\n}\n\nexport interface CheckoutCompletedWebhookData {\n  order: RuntimeWebhookOrder;\n  customer: RuntimeWebhookCustomer;\n  store: RuntimeWebhookStore;\n}\n\n/** Contact captured on an abandoned draft. No `id` — the draft is pre-customer. */\nexport interface CheckoutAbandonedWebhookCustomer {\n  name: string | null;\n  email: string | null;\n  phone: string | null;\n}\n\nexport interface CheckoutAbandonedWebhookData {\n  checkout: RuntimeWebhookCheckout;\n  customer: CheckoutAbandonedWebhookCustomer;\n  store: RuntimeWebhookStore;\n}\n\n/** Map of webhook events to their payload data shapes */\nexport interface WebhookEventData {\n  \"order.created\": OrderCreatedWebhookData;\n  \"order.updated\": OrderUpdatedWebhookData;\n  \"order.cancelled\": OrderCancelledWebhookData;\n  \"order.completed\": OrderCompletedWebhookData;\n  \"product.created\": ProductCreatedWebhookData;\n  \"product.updated\": ProductUpdatedWebhookData;\n  \"product.deleted\": ProductDeletedWebhookData;\n  \"customer.created\": CustomerCreatedWebhookData;\n  \"customer.updated\": CustomerUpdatedWebhookData;\n  \"checkout.completed\": CheckoutCompletedWebhookData;\n  \"checkout.abandoned\": CheckoutAbandonedWebhookData;\n}\n\n/** Legacy envelope payload. Runtime webhook deliveries do not include the event field in the body. */\nexport interface WebhookPayload<E extends WebhookEvent = WebhookEvent> {\n  event: E;\n  timestamp: string;\n  storeId: string;\n  data: WebhookEventData[E];\n}\n\nexport interface RuntimeWebhookStore {\n  id: string;\n  name?: string;\n  timezone: string;\n}\n\nexport interface RuntimeWebhookBasePayload {\n  event_id?: string;\n  occurred_at?: string;\n  store: RuntimeWebhookStore;\n}\n\nexport interface RuntimeWebhookOrder {\n  id: string;\n  [key: string]: unknown;\n}\n\nexport interface RuntimeWebhookProduct {\n  id: string;\n  [key: string]: unknown;\n}\n\nexport interface RuntimeWebhookCustomer {\n  id: string;\n  [key: string]: unknown;\n}\n\nexport interface RuntimeWebhookCheckout {\n  id: string;\n  [key: string]: unknown;\n}\n\nexport interface RuntimeOrderWebhookPayload extends RuntimeWebhookBasePayload {\n  order: RuntimeWebhookOrder;\n  customer?: RuntimeWebhookCustomer;\n}\n\nexport interface RuntimeProductWebhookPayload extends RuntimeWebhookBasePayload {\n  product: RuntimeWebhookProduct;\n}\n\nexport interface RuntimeCustomerWebhookPayload extends RuntimeWebhookBasePayload {\n  customer: RuntimeWebhookCustomer;\n}\n\nexport interface RuntimeCheckoutCompletedWebhookPayload\n  extends RuntimeWebhookBasePayload {\n  order: RuntimeWebhookOrder;\n  customer: RuntimeWebhookCustomer;\n  store: RuntimeWebhookStore;\n}\n\nexport interface RuntimeCheckoutAbandonedWebhookPayload\n  extends RuntimeWebhookBasePayload {\n  checkout: RuntimeWebhookCheckout;\n  // Pre-customer draft: contact fields only, no customer id.\n  customer?: CheckoutAbandonedWebhookCustomer;\n}\n\nexport interface RuntimeWebhookEventData {\n  \"order.created\": RuntimeOrderWebhookPayload;\n  \"order.updated\": RuntimeOrderWebhookPayload;\n  \"order.cancelled\": RuntimeOrderWebhookPayload;\n  \"order.completed\": RuntimeOrderWebhookPayload;\n  \"product.created\": RuntimeProductWebhookPayload;\n  \"product.updated\": RuntimeProductWebhookPayload;\n  \"product.deleted\": RuntimeProductWebhookPayload;\n  \"customer.created\": RuntimeCustomerWebhookPayload;\n  \"customer.updated\": RuntimeCustomerWebhookPayload;\n  \"checkout.completed\": RuntimeCheckoutCompletedWebhookPayload;\n  \"checkout.abandoned\": RuntimeCheckoutAbandonedWebhookPayload;\n}\n\n/** Runtime body delivered to subscriber endpoints. The event comes from X-Webhook-Event. */\nexport type RuntimeWebhookPayload<E extends WebhookEvent = WebhookEvent> =\n  RuntimeWebhookEventData[E];\n\n/** Validate the minimum runtime payload shape before invoking typed handlers. */\nexport function isRuntimeWebhookPayload<E extends WebhookEvent>(\n  value: unknown,\n  event: E\n): value is RuntimeWebhookPayload<E> {\n  if (!isRecord(value)) return false;\n\n  switch (event) {\n    case WEBHOOK_EVENTS.ORDER_CREATED:\n    case WEBHOOK_EVENTS.ORDER_UPDATED:\n    case WEBHOOK_EVENTS.ORDER_CANCELLED:\n    case WEBHOOK_EVENTS.ORDER_COMPLETED:\n      return isRuntimeOrderWebhookPayload(value);\n    case WEBHOOK_EVENTS.PRODUCT_CREATED:\n    case WEBHOOK_EVENTS.PRODUCT_UPDATED:\n    case WEBHOOK_EVENTS.PRODUCT_DELETED:\n      return isRuntimeProductWebhookPayload(value);\n    case WEBHOOK_EVENTS.CUSTOMER_CREATED:\n    case WEBHOOK_EVENTS.CUSTOMER_UPDATED:\n      return isRuntimeCustomerWebhookPayload(value);\n    case WEBHOOK_EVENTS.CHECKOUT_COMPLETED:\n      return isRuntimeCheckoutCompletedWebhookPayload(value);\n    case WEBHOOK_EVENTS.CHECKOUT_ABANDONED:\n      return isRuntimeCheckoutAbandonedWebhookPayload(value);\n    default:\n      return false;\n  }\n}\n","import { verifyWebhook } from \"../webhooks/verify.js\";\nimport { isRuntimeWebhookPayload, isWebhookEvent } from \"../webhooks/types.js\";\nimport type { WebhookEventHandler, WebhookHandlerOptions } from \"./types.js\";\n\ntype ExpressLikeRequest = {\n  body: Buffer | string;\n  headers: Record<string, string | string[] | undefined>;\n};\n\ntype ExpressLikeStatusResponse = {\n  json: (body: unknown) => void;\n  send: (body: string) => void;\n};\n\ntype ExpressLikeResponse = {\n  status: (code: number) => ExpressLikeStatusResponse;\n};\n\nfunction getHeader(\n  name: string,\n  headers: Record<string, string | string[] | undefined>\n): string {\n  const value = headers[name];\n\n  if (Array.isArray(value)) {\n    return value[0] ?? \"\";\n  }\n\n  return value ?? \"\";\n}\n\nexport function createWebhookHandler(\n  options: WebhookHandlerOptions\n): (req: ExpressLikeRequest, res: ExpressLikeResponse) => Promise<void> {\n  return async function webhookHandler(\n    req: ExpressLikeRequest,\n    res: ExpressLikeResponse\n  ): Promise<void> {\n    try {\n      const rawPayload =\n        typeof req.body === \"string\" ? req.body : req.body.toString(\"utf8\");\n      const signature = getHeader(\"x-webhook-signature\", req.headers);\n      const timestamp = getHeader(\"x-webhook-timestamp\", req.headers);\n      const event = getHeader(\"x-webhook-event\", req.headers);\n      const deliveryId = getHeader(\"x-webhook-id\", req.headers);\n\n      const isValid = verifyWebhook({\n        payload: rawPayload,\n        signature,\n        timestamp,\n        secret: options.secret,\n      });\n\n      if (!isValid) {\n        res.status(401).json({ error: \"Invalid signature\" });\n        return;\n      }\n\n      if (!event) {\n        res.status(400).json({ error: \"Missing event header\" });\n        return;\n      }\n\n      if (!isWebhookEvent(event)) {\n        res.status(400).json({ error: \"Invalid event header\" });\n        return;\n      }\n\n      let parsedPayload: unknown;\n      try {\n        parsedPayload = JSON.parse(rawPayload) as unknown;\n      } catch {\n        res.status(400).json({ error: \"Invalid JSON\" });\n        return;\n      }\n\n      if (!isRuntimeWebhookPayload(parsedPayload, event)) {\n        res.status(400).json({ error: \"Invalid payload\" });\n        return;\n      }\n\n      const context = { deliveryId, event, timestamp };\n      const handler = options.handlers[event] as\n        | WebhookEventHandler<typeof event>\n        | undefined;\n\n      if (handler) {\n        await handler(parsedPayload, context);\n      } else if (options.onUnhandledEvent) {\n        await options.onUnhandledEvent(event, parsedPayload, context);\n      }\n\n      res.status(200).send(\"OK\");\n    } catch {\n      res.status(500).json({ error: \"Internal error\" });\n    }\n  };\n}\n"],"mappings":";AAAA,SAAS,YAAY,uBAAuB;AAE5C,IAAM,4BAA4B;AAqB3B,SAAS,cAAc;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,mBAAmB;AAAA,EACnB,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC5C,GAAiC;AAC/B,MAAI,CAAC,WAAW,CAAC,aAAa,CAAC,UAAU,cAAc,GAAI,QAAO;AAElE,QAAM,kBAAkB,OAAO,SAAS;AACxC,QAAM,iBACJ,OAAO,cAAc,WAAW,YAAY,OAAO,SAAS;AAE9D,MAAI,CAAC,OAAO,UAAU,cAAc,EAAG,QAAO;AAC9C,MAAI,CAAC,OAAO,SAAS,gBAAgB,KAAK,mBAAmB,EAAG,QAAO;AACvE,MAAI,CAAC,OAAO,SAAS,WAAW,EAAG,QAAO;AAE1C,QAAM,aAAa,KAAK,IAAI,cAAc,cAAc;AACxD,MAAI,aAAa,iBAAkB,QAAO;AAE1C,QAAM,WAAW,WAAW,UAAU,MAAM,EACzC,OAAO,GAAG,eAAe,IAAI,OAAO,IAAI,MAAM,EAC9C,OAAO,KAAK;AAEf,MAAI,SAAS,WAAW,UAAU,OAAQ,QAAO;AACjD,MAAI,CAAC,eAAe,KAAK,SAAS,EAAG,QAAO;AAE5C,MAAI;AACF,WAAO;AAAA,MACL,OAAO,KAAK,UAAU,KAAK;AAAA,MAC3B,OAAO,KAAK,WAAW,KAAK;AAAA,IAC9B;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AC3DA;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAGA,IAAM,iBAAiB;AAMvB,SAAS,eAAe,OAAsC;AACnE,SAAO,qBAAqB,KAAK;AACnC;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,YAAY,OAAyC;AAC5D,SAAO,SAAS,KAAK,KAAK,OAAO,MAAM,OAAO;AAChD;AAEA,SAAS,iBACP,OACA,KACS;AACT,SAAO,MAAM,GAAG,MAAM,UAAa,OAAO,MAAM,GAAG,MAAM;AAC3D;AAEA,SAAS,sBAAsB,OAA8C;AAC3E,SACE,SAAS,KAAK,KACd,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,aAAa,aACzB,MAAM,SAAS,UAAa,OAAO,MAAM,SAAS;AAEvD;AAEA,SAAS,0BAA0B,OAAyC;AAC1E,MAAI,CAAC,iBAAiB,OAAO,UAAU,EAAG,QAAO;AACjD,MAAI,CAAC,iBAAiB,OAAO,aAAa,EAAG,QAAO;AAEpD,SAAO,sBAAsB,MAAM,KAAK;AAC1C;AAEA,SAAS,6BAA6B,OAAyC;AAC7E,SACE,0BAA0B,KAAK,KAC/B,YAAY,MAAM,KAAK,MACtB,MAAM,aAAa,UAAa,YAAY,MAAM,QAAQ;AAE/D;AAEA,SAAS,+BAA+B,OAAyC;AAC/E,SAAO,0BAA0B,KAAK,KAAK,YAAY,MAAM,OAAO;AACtE;AAEA,SAAS,gCAAgC,OAAyC;AAChF,SAAO,0BAA0B,KAAK,KAAK,YAAY,MAAM,QAAQ;AACvE;AAEA,SAAS,yCACP,OACS;AACT,SACE,0BAA0B,KAAK,KAC/B,YAAY,MAAM,KAAK,KACvB,YAAY,MAAM,QAAQ,KAC1B,sBAAsB,MAAM,KAAK;AAErC;AAEA,SAAS,yCACP,OACS;AAET,SACE,0BAA0B,KAAK,KAC/B,YAAY,MAAM,QAAQ,KAC1B,sBAAsB,MAAM,KAAK;AAErC;AAsKO,SAAS,wBACd,OACA,OACmC;AACnC,MAAI,CAAC,SAAS,KAAK,EAAG,QAAO;AAE7B,UAAQ,OAAO;AAAA,IACb,KAAK,eAAe;AAAA,IACpB,KAAK,eAAe;AAAA,IACpB,KAAK,eAAe;AAAA,IACpB,KAAK,eAAe;AAClB,aAAO,6BAA6B,KAAK;AAAA,IAC3C,KAAK,eAAe;AAAA,IACpB,KAAK,eAAe;AAAA,IACpB,KAAK,eAAe;AAClB,aAAO,+BAA+B,KAAK;AAAA,IAC7C,KAAK,eAAe;AAAA,IACpB,KAAK,eAAe;AAClB,aAAO,gCAAgC,KAAK;AAAA,IAC9C,KAAK,eAAe;AAClB,aAAO,yCAAyC,KAAK;AAAA,IACvD,KAAK,eAAe;AAClB,aAAO,yCAAyC,KAAK;AAAA,IACvD;AACE,aAAO;AAAA,EACX;AACF;;;AClQA,SAAS,UACP,MACA,SACQ;AACR,QAAM,QAAQ,QAAQ,IAAI;AAE1B,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,CAAC,KAAK;AAAA,EACrB;AAEA,SAAO,SAAS;AAClB;AAEO,SAAS,qBACd,SACsE;AACtE,SAAO,eAAe,eACpB,KACA,KACe;AACf,QAAI;AACF,YAAM,aACJ,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO,IAAI,KAAK,SAAS,MAAM;AACpE,YAAM,YAAY,UAAU,uBAAuB,IAAI,OAAO;AAC9D,YAAM,YAAY,UAAU,uBAAuB,IAAI,OAAO;AAC9D,YAAM,QAAQ,UAAU,mBAAmB,IAAI,OAAO;AACtD,YAAM,aAAa,UAAU,gBAAgB,IAAI,OAAO;AAExD,YAAM,UAAU,cAAc;AAAA,QAC5B,SAAS;AAAA,QACT;AAAA,QACA;AAAA,QACA,QAAQ,QAAQ;AAAA,MAClB,CAAC;AAED,UAAI,CAAC,SAAS;AACZ,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;AACnD;AAAA,MACF;AAEA,UAAI,CAAC,OAAO;AACV,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,uBAAuB,CAAC;AACtD;AAAA,MACF;AAEA,UAAI,CAAC,eAAe,KAAK,GAAG;AAC1B,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,uBAAuB,CAAC;AACtD;AAAA,MACF;AAEA,UAAI;AACJ,UAAI;AACF,wBAAgB,KAAK,MAAM,UAAU;AAAA,MACvC,QAAQ;AACN,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,eAAe,CAAC;AAC9C;AAAA,MACF;AAEA,UAAI,CAAC,wBAAwB,eAAe,KAAK,GAAG;AAClD,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AACjD;AAAA,MACF;AAEA,YAAM,UAAU,EAAE,YAAY,OAAO,UAAU;AAC/C,YAAM,UAAU,QAAQ,SAAS,KAAK;AAItC,UAAI,SAAS;AACX,cAAM,QAAQ,eAAe,OAAO;AAAA,MACtC,WAAW,QAAQ,kBAAkB;AACnC,cAAM,QAAQ,iBAAiB,OAAO,eAAe,OAAO;AAAA,MAC9D;AAEA,UAAI,OAAO,GAAG,EAAE,KAAK,IAAI;AAAA,IAC3B,QAAQ;AACN,UAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAAA,IAClD;AAAA,EACF;AACF;","names":[]}

package/dist/adapters/hono.cjs

@@ -26,14 +26,26 @@ module.exports = __toCommonJS(hono_exports);
 
 // src/webhooks/verify.ts
 var import_node_crypto = require("crypto");
+var DEFAULT_TOLERANCE_SECONDS = 300;
 function verifyWebhook({
   payload,
   signature,
-  secret
+  timestamp,
+  secret,
+  toleranceSeconds = DEFAULT_TOLERANCE_SECONDS,
+  currentTime = Math.floor(Date.now() / 1e3)
 }) {
-  if (!payload || !signature || !secret) return false;
-  const expected = (0, import_node_crypto.createHmac)("sha256", secret).update(payload, "utf8").digest("hex");
+  if (!payload || !signature || !secret || timestamp === "") return false;
+  const timestampString = String(timestamp);
+  const timestampValue = typeof timestamp === "number" ? timestamp : Number(timestamp);
+  if (!Number.isInteger(timestampValue)) return false;
+  if (!Number.isFinite(toleranceSeconds) || toleranceSeconds < 0) return false;
+  if (!Number.isFinite(currentTime)) return false;
+  const ageSeconds = Math.abs(currentTime - timestampValue);
+  if (ageSeconds > toleranceSeconds) return false;
+  const expected = (0, import_node_crypto.createHmac)("sha256", secret).update(`${timestampString}.${payload}`, "utf8").digest("hex");
   if (expected.length !== signature.length) return false;
+  if (!/^[a-f0-9]+$/i.test(signature)) return false;
   try {
     return (0, import_node_crypto.timingSafeEqual)(
       Buffer.from(expected, "hex"),
@@ -44,27 +56,107 @@ function verifyWebhook({
   }
 }
 
+// src/webhooks/types.ts
+var import_events = require("@whatalo/protocol/events");
+var WEBHOOK_EVENTS = import_events.PUBLIC_WEBHOOK_EVENTS;
+function isWebhookEvent(value) {
+  return (0, import_events.isPublicWebhookEvent)(value);
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasStringId(value) {
+  return isRecord(value) && typeof value.id === "string";
+}
+function isOptionalString(value, key) {
+  return value[key] === void 0 || typeof value[key] === "string";
+}
+function isRuntimeWebhookStore(value) {
+  return isRecord(value) && typeof value.id === "string" && typeof value.timezone === "string" && (value.name === void 0 || typeof value.name === "string");
+}
+function hasValidBasePayloadFields(value) {
+  if (!isOptionalString(value, "event_id")) return false;
+  if (!isOptionalString(value, "occurred_at")) return false;
+  return isRuntimeWebhookStore(value.store);
+}
+function isRuntimeOrderWebhookPayload(value) {
+  return hasValidBasePayloadFields(value) && hasStringId(value.order) && (value.customer === void 0 || hasStringId(value.customer));
+}
+function isRuntimeProductWebhookPayload(value) {
+  return hasValidBasePayloadFields(value) && hasStringId(value.product);
+}
+function isRuntimeCustomerWebhookPayload(value) {
+  return hasValidBasePayloadFields(value) && hasStringId(value.customer);
+}
+function isRuntimeCheckoutCompletedWebhookPayload(value) {
+  return hasValidBasePayloadFields(value) && hasStringId(value.order) && hasStringId(value.customer) && isRuntimeWebhookStore(value.store);
+}
+function isRuntimeCheckoutAbandonedWebhookPayload(value) {
+  return hasValidBasePayloadFields(value) && hasStringId(value.checkout) && isRuntimeWebhookStore(value.store);
+}
+function isRuntimeWebhookPayload(value, event) {
+  if (!isRecord(value)) return false;
+  switch (event) {
+    case WEBHOOK_EVENTS.ORDER_CREATED:
+    case WEBHOOK_EVENTS.ORDER_UPDATED:
+    case WEBHOOK_EVENTS.ORDER_CANCELLED:
+    case WEBHOOK_EVENTS.ORDER_COMPLETED:
+      return isRuntimeOrderWebhookPayload(value);
+    case WEBHOOK_EVENTS.PRODUCT_CREATED:
+    case WEBHOOK_EVENTS.PRODUCT_UPDATED:
+    case WEBHOOK_EVENTS.PRODUCT_DELETED:
+      return isRuntimeProductWebhookPayload(value);
+    case WEBHOOK_EVENTS.CUSTOMER_CREATED:
+    case WEBHOOK_EVENTS.CUSTOMER_UPDATED:
+      return isRuntimeCustomerWebhookPayload(value);
+    case WEBHOOK_EVENTS.CHECKOUT_COMPLETED:
+      return isRuntimeCheckoutCompletedWebhookPayload(value);
+    case WEBHOOK_EVENTS.CHECKOUT_ABANDONED:
+      return isRuntimeCheckoutAbandonedWebhookPayload(value);
+    default:
+      return false;
+  }
+}
+
 // src/adapters/hono.ts
 function createWebhookHandler(options) {
   return async function webhookHandler(c) {
     try {
       const rawPayload = await c.req.text();
       const signature = c.req.header("X-Webhook-Signature") ?? "";
+      const timestamp = c.req.header("X-Webhook-Timestamp") ?? "";
+      const event = c.req.header("X-Webhook-Event") ?? "";
+      const deliveryId = c.req.header("X-Webhook-Id") ?? "";
       const isValid = verifyWebhook({
         payload: rawPayload,
         signature,
+        timestamp,
         secret: options.secret
       });
       if (!isValid) {
         return c.json({ error: "Invalid signature" }, 401);
       }
-      const payload = JSON.parse(rawPayload);
-      const event = payload.event;
+      if (!event) {
+        return c.json({ error: "Missing event header" }, 400);
+      }
+      if (!isWebhookEvent(event)) {
+        return c.json({ error: "Invalid event header" }, 400);
+      }
+      let parsedPayload;
+      try {
+        parsedPayload = JSON.parse(rawPayload);
+      } catch {
+        return c.json({ error: "Invalid JSON" }, 400);
+      }
+      if (!isRuntimeWebhookPayload(parsedPayload, event)) {
+        return c.json({ error: "Invalid payload" }, 400);
+      }
+      const context = { deliveryId, event, timestamp };
       const handler = options.handlers[event];
       if (handler) {
-        await handler(payload);
+        await handler(parsedPayload, context);
       } else if (options.onUnhandledEvent) {
-        await options.onUnhandledEvent(event, payload);
+        await options.onUnhandledEvent(event, parsedPayload, context);
       }
       return c.text("OK", 200);
     } catch {