@yaebal/web 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 neverlane
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,40 @@
+# @yaebal/web
+
+run your [yaebal](https://github.com/neverlane/yaebal) bot on edge/web runtimes —
+cloudflare workers, deno deploy, bun, vercel edge — via webhooks. `fetch`-first,
+zero `node:` imports.
+
+## install
+
+```sh
+pnpm add @yaebal/web
+```
+
+## usage
+
+```ts
+import { Bot } from "@yaebal/core";
+import { webhook, setWebhook } from "@yaebal/web";
+
+// cloudflare workers / deno deploy / vercel edge
+export default {
+  fetch(request: Request, env: { BOT_TOKEN: string; SECRET: string }) {
+    const bot = new Bot(env.BOT_TOKEN);
+
+    bot.command("start", (ctx) => ctx.reply("running on the edge ⚡"));
+
+    return webhook(bot, { secretToken: env.SECRET })(request);
+  },
+};
+
+// register once on deploy
+await setWebhook(bot, "https://my-worker.workers.dev/", { secretToken: SECRET });
+```
+
+`serve(bot, { port })` starts a native fetch server on bun or deno. on bode, use
+`nodeWebhookCallback` from `@yaebal/core`. the operator dashboard lives in
+[`@yaebal/panel`](https://github.com/neverlane/yaebal/tree/master/packages/panel).
+
+---
+
+part of [**yaebal**](https://github.com/neverlane/yaebal) — a type-safe, runtime-agnostic Telegram Bot API framework. MIT.

package/lib/index.d.ts

@@ -0,0 +1,51 @@
+import { type UpdateSink, type WebhookOptions } from "@yaebal/core";
+/**
+ * @yaebal/web — run your bot on edge/web runtimes (cloudflare workers, deno
+ * deploy, bun, vercel edge) via webhooks. the bot needs no long-polling: it just
+ * turns each incoming `Request` into an update.
+ *
+ *   // cloudflare workers / deno deploy / vercel edge
+ *   export default { fetch: webhook(bot, { secretToken: env.SECRET }) };
+ *
+ *   // bun / deno standalone
+ *   serve(bot, { port: 8080, secretToken: process.env.SECRET });
+ */
+export type { WebhookOptions, UpdateSink } from "@yaebal/core";
+/** minimal bot surface the lifecycle helpers need. */
+interface ApiBot {
+    api: {
+        call(method: string, params?: Record<string, unknown>): Promise<unknown>;
+    };
+}
+/**
+ * a fetch handler — `(Request) => Promise<Response>` — for any edge/web runtime.
+ * drop it into a worker's `fetch`, `Deno.serve`, `Bun.serve`, etc.
+ */
+export declare function webhook(bot: UpdateSink, options?: WebhookOptions): (request: Request) => Promise<Response>;
+export interface SetWebhookOptions {
+    /** secret token telegram echoes back in `X-Telegram-Bot-Api-Secret-Token` (pass the same to `webhook`). */
+    secretToken?: string;
+    /** restrict the update types telegram sends. */
+    allowedUpdates?: string[];
+    /** drop updates that piled up while the webhook was unset. */
+    dropPendingUpdates?: boolean;
+    /** max simultaneous HTTPS connections (1–100). */
+    maxConnections?: number;
+}
+/** register this bot's webhook with telegram — call once on deploy. */
+export declare function setWebhook(bot: ApiBot, url: string, options?: SetWebhookOptions): Promise<void>;
+/** remove this bot's webhook (e.g. to switch back to long-polling). */
+export declare function deleteWebhook(bot: ApiBot, dropPendingUpdates?: boolean): Promise<void>;
+export interface ServeOptions extends WebhookOptions {
+    /** listen port. defaults to 8080. */
+    port?: number;
+    /** listen hostname. */
+    hostname?: string;
+}
+/**
+ * start a standalone webhook server using the runtime's native fetch server
+ * (bun or deno). on node use `nodeWebhookCallback` from `@yaebal/core`; on edge,
+ * export `{ fetch: webhook(bot) }` instead.
+ */
+export declare function serve(bot: UpdateSink, options?: ServeOptions): void;
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,cAAc,EAAmB,MAAM,cAAc,CAAC;AAErF;;;;;;;;;;GAUG;AAEH,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/D,sDAAsD;AACtD,UAAU,MAAM;IACf,GAAG,EAAE;QAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;CAClF;AAED;;;GAGG;AACH,wBAAgB,OAAO,CACtB,GAAG,EAAE,UAAU,EACf,OAAO,CAAC,EAAE,cAAc,GACtB,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAEzC;AAED,MAAM,WAAW,iBAAiB;IACjC,2GAA2G;IAC3G,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,8DAA8D;IAC9D,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,kDAAkD;IAClD,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,uEAAuE;AACvE,wBAAsB,UAAU,CAC/B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,iBAAsB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,uEAAuE;AACvE,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,kBAAkB,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1F;AAED,MAAM,WAAW,YAAa,SAAQ,cAAc;IACnD,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uBAAuB;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAYD;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,GAAE,YAAiB,GAAG,IAAI,CAavE"}

package/lib/index.js

@@ -0,0 +1,41 @@
+import { webhookCallback } from "@yaebal/core";
+/**
+ * a fetch handler — `(Request) => Promise<Response>` — for any edge/web runtime.
+ * drop it into a worker's `fetch`, `Deno.serve`, `Bun.serve`, etc.
+ */
+export function webhook(bot, options) {
+    return webhookCallback(bot, options);
+}
+/** register this bot's webhook with telegram — call once on deploy. */
+export async function setWebhook(bot, url, options = {}) {
+    await bot.api.call("setWebhook", {
+        url,
+        secret_token: options.secretToken,
+        allowed_updates: options.allowedUpdates,
+        drop_pending_updates: options.dropPendingUpdates,
+        max_connections: options.maxConnections,
+    });
+}
+/** remove this bot's webhook (e.g. to switch back to long-polling). */
+export async function deleteWebhook(bot, dropPendingUpdates = false) {
+    await bot.api.call("deleteWebhook", { drop_pending_updates: dropPendingUpdates });
+}
+/**
+ * start a standalone webhook server using the runtime's native fetch server
+ * (bun or deno). on node use `nodeWebhookCallback` from `@yaebal/core`; on edge,
+ * export `{ fetch: webhook(bot) }` instead.
+ */
+export function serve(bot, options = {}) {
+    const handler = webhook(bot, options);
+    const runtime = globalThis;
+    if (runtime.Bun) {
+        runtime.Bun.serve({ port: options.port ?? 8080, hostname: options.hostname, fetch: handler });
+    }
+    else if (runtime.Deno) {
+        runtime.Deno.serve({ port: options.port ?? 8080, hostname: options.hostname }, handler);
+    }
+    else {
+        throw new Error("serve() requires bun or deno. on node use nodeWebhookCallback from @yaebal/core; on edge export { fetch: webhook(bot) }.");
+    }
+}
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwC,eAAe,EAAE,MAAM,cAAc,CAAC;AAqBrF;;;GAGG;AACH,MAAM,UAAU,OAAO,CACtB,GAAe,EACf,OAAwB;IAExB,OAAO,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC;AAaD,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,GAAW,EACX,GAAW,EACX,UAA6B,EAAE;IAE/B,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE;QAChC,GAAG;QACH,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,eAAe,EAAE,OAAO,CAAC,cAAc;QACvC,oBAAoB,EAAE,OAAO,CAAC,kBAAkB;QAChD,eAAe,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,kBAAkB,GAAG,KAAK;IAC1E,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,CAAC,CAAC;AACnF,CAAC;AAmBD;;;;GAIG;AACH,MAAM,UAAU,KAAK,CAAC,GAAe,EAAE,UAAwB,EAAE;IAChE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,UAAsD,CAAC;IAEvE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/F,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;IACzF,CAAC;SAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACd,0HAA0H,CAC1H,CAAC;IACH,CAAC;AACF,CAAC"}

package/lib/index.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.test.d.ts.map

package/lib/index.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.d.ts","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":""}

package/lib/index.test.js

@@ -0,0 +1,51 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { deleteWebhook, setWebhook, webhook } from "./index.js";
+const sink = () => {
+    const updates = [];
+    const bot = { handleUpdate: async (u) => void updates.push(u) };
+    return { bot, updates };
+};
+const post = (body, headers = {}) => new Request("https://example.dev/", { method: "POST", body: JSON.stringify(body), headers });
+test("webhook handler dispatches POSTed updates", async () => {
+    const { bot, updates } = sink();
+    const res = await webhook(bot)(post({ update_id: 1, message: { text: "hi" } }));
+    assert.equal(res.status, 200);
+    assert.equal(updates.length, 1);
+});
+test("webhook handler rejects non-POST and bad secret", async () => {
+    const { bot, updates } = sink();
+    const handler = webhook(bot, { secretToken: "s3cret" });
+    const get = await handler(new Request("https://example.dev/", { method: "GET" }));
+    assert.equal(get.status, 405);
+    const bad = await handler(post({ update_id: 1 }, { "x-telegram-bot-api-secret-token": "nope" }));
+    assert.equal(bad.status, 401);
+    const ok = await handler(post({ update_id: 1 }, { "x-telegram-bot-api-secret-token": "s3cret" }));
+    assert.equal(ok.status, 200);
+    assert.equal(updates.length, 1);
+});
+test("setWebhook / deleteWebhook call the Bot API", async () => {
+    const calls = [];
+    const bot = {
+        api: {
+            call: async (method, params) => {
+                calls.push({ method, params });
+                return true;
+            },
+        },
+    };
+    await setWebhook(bot, "https://example.dev/hook", {
+        secretToken: "s3cret",
+        allowedUpdates: ["message"],
+        dropPendingUpdates: true,
+    });
+    assert.equal(calls[0]?.method, "setWebhook");
+    assert.equal(calls[0]?.params?.url, "https://example.dev/hook");
+    assert.equal(calls[0]?.params?.secret_token, "s3cret");
+    assert.deepEqual(calls[0]?.params?.allowed_updates, ["message"]);
+    assert.equal(calls[0]?.params?.drop_pending_updates, true);
+    await deleteWebhook(bot, true);
+    assert.equal(calls[1]?.method, "deleteWebhook");
+    assert.equal(calls[1]?.params?.drop_pending_updates, true);
+});
+//# sourceMappingURL=index.test.js.map

package/lib/index.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.js","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAEhE,MAAM,IAAI,GAAG,GAAG,EAAE;IACjB,MAAM,OAAO,GAAc,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,CAAQ,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AACzB,CAAC,CAAC;AAEF,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,UAAkC,EAAE,EAAE,EAAE,CACpE,IAAI,OAAO,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;AAE9F,IAAI,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;IAC5D,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAEhC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAEhF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;IAClE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;IAExD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,OAAO,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAClF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE9B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,iCAAiC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACjG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE9B,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,iCAAiC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAClG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;IAC9D,MAAM,KAAK,GAA2D,EAAE,CAAC;IACzE,MAAM,GAAG,GAAG;QACX,GAAG,EAAE;YACJ,IAAI,EAAE,KAAK,EAAE,MAAc,EAAE,MAAgC,EAAE,EAAE;gBAChE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC/B,OAAO,IAAI,CAAC;YACb,CAAC;SACD;KACD,CAAC;IAEF,MAAM,UAAU,CAAC,GAAG,EAAE,0BAA0B,EAAE;QACjD,WAAW,EAAE,QAAQ;QACrB,cAAc,EAAE,CAAC,SAAS,CAAC;QAC3B,kBAAkB,EAAE,IAAI;KACxB,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACjE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAC;IAE3D,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IAChD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@yaebal/web",
+  "version": "0.0.1",
+  "description": "yaebal web — run your bot on edge/web runtimes (cloudflare workers, deno, bun) via webhooks.",
+  "type": "module",
+  "main": "./lib/index.js",
+  "types": "./lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "import": "./lib/index.js"
+    }
+  },
+  "files": [
+    "lib",
+    "src"
+  ],
+  "dependencies": {
+    "@yaebal/core": "0.0.1"
+  },
+  "devDependencies": {
+    "@types/node": "latest"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "telegram",
+    "telegram-bot",
+    "yaebal",
+    "webhook",
+    "edge",
+    "cloudflare-workers",
+    "deno",
+    "bun"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/neverlane/yaebal",
+    "directory": "packages/web"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "node --test lib"
+  }
+}

package/src/index.test.ts

@@ -0,0 +1,65 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { deleteWebhook, setWebhook, webhook } from "./index.js";
+
+const sink = () => {
+	const updates: unknown[] = [];
+	const bot = { handleUpdate: async (u: never) => void updates.push(u) };
+
+	return { bot, updates };
+};
+
+const post = (body: unknown, headers: Record<string, string> = {}) =>
+	new Request("https://example.dev/", { method: "POST", body: JSON.stringify(body), headers });
+
+test("webhook handler dispatches POSTed updates", async () => {
+	const { bot, updates } = sink();
+
+	const res = await webhook(bot)(post({ update_id: 1, message: { text: "hi" } }));
+
+	assert.equal(res.status, 200);
+	assert.equal(updates.length, 1);
+});
+
+test("webhook handler rejects non-POST and bad secret", async () => {
+	const { bot, updates } = sink();
+	const handler = webhook(bot, { secretToken: "s3cret" });
+
+	const get = await handler(new Request("https://example.dev/", { method: "GET" }));
+	assert.equal(get.status, 405);
+
+	const bad = await handler(post({ update_id: 1 }, { "x-telegram-bot-api-secret-token": "nope" }));
+	assert.equal(bad.status, 401);
+
+	const ok = await handler(post({ update_id: 1 }, { "x-telegram-bot-api-secret-token": "s3cret" }));
+	assert.equal(ok.status, 200);
+	assert.equal(updates.length, 1);
+});
+
+test("setWebhook / deleteWebhook call the Bot API", async () => {
+	const calls: { method: string; params?: Record<string, unknown> }[] = [];
+	const bot = {
+		api: {
+			call: async (method: string, params?: Record<string, unknown>) => {
+				calls.push({ method, params });
+				return true;
+			},
+		},
+	};
+
+	await setWebhook(bot, "https://example.dev/hook", {
+		secretToken: "s3cret",
+		allowedUpdates: ["message"],
+		dropPendingUpdates: true,
+	});
+
+	assert.equal(calls[0]?.method, "setWebhook");
+	assert.equal(calls[0]?.params?.url, "https://example.dev/hook");
+	assert.equal(calls[0]?.params?.secret_token, "s3cret");
+	assert.deepEqual(calls[0]?.params?.allowed_updates, ["message"]);
+	assert.equal(calls[0]?.params?.drop_pending_updates, true);
+
+	await deleteWebhook(bot, true);
+	assert.equal(calls[1]?.method, "deleteWebhook");
+	assert.equal(calls[1]?.params?.drop_pending_updates, true);
+});

package/src/index.ts

@@ -0,0 +1,99 @@
+import { type UpdateSink, type WebhookOptions, webhookCallback } from "@yaebal/core";
+
+/**
+ * @yaebal/web — run your bot on edge/web runtimes (cloudflare workers, deno
+ * deploy, bun, vercel edge) via webhooks. the bot needs no long-polling: it just
+ * turns each incoming `Request` into an update.
+ *
+ *   // cloudflare workers / deno deploy / vercel edge
+ *   export default { fetch: webhook(bot, { secretToken: env.SECRET }) };
+ *
+ *   // bun / deno standalone
+ *   serve(bot, { port: 8080, secretToken: process.env.SECRET });
+ */
+
+export type { WebhookOptions, UpdateSink } from "@yaebal/core";
+
+/** minimal bot surface the lifecycle helpers need. */
+interface ApiBot {
+	api: { call(method: string, params?: Record<string, unknown>): Promise<unknown> };
+}
+
+/**
+ * a fetch handler — `(Request) => Promise<Response>` — for any edge/web runtime.
+ * drop it into a worker's `fetch`, `Deno.serve`, `Bun.serve`, etc.
+ */
+export function webhook(
+	bot: UpdateSink,
+	options?: WebhookOptions,
+): (request: Request) => Promise<Response> {
+	return webhookCallback(bot, options);
+}
+
+export interface SetWebhookOptions {
+	/** secret token telegram echoes back in `X-Telegram-Bot-Api-Secret-Token` (pass the same to `webhook`). */
+	secretToken?: string;
+	/** restrict the update types telegram sends. */
+	allowedUpdates?: string[];
+	/** drop updates that piled up while the webhook was unset. */
+	dropPendingUpdates?: boolean;
+	/** max simultaneous HTTPS connections (1–100). */
+	maxConnections?: number;
+}
+
+/** register this bot's webhook with telegram — call once on deploy. */
+export async function setWebhook(
+	bot: ApiBot,
+	url: string,
+	options: SetWebhookOptions = {},
+): Promise<void> {
+	await bot.api.call("setWebhook", {
+		url,
+		secret_token: options.secretToken,
+		allowed_updates: options.allowedUpdates,
+		drop_pending_updates: options.dropPendingUpdates,
+		max_connections: options.maxConnections,
+	});
+}
+
+/** remove this bot's webhook (e.g. to switch back to long-polling). */
+export async function deleteWebhook(bot: ApiBot, dropPendingUpdates = false): Promise<void> {
+	await bot.api.call("deleteWebhook", { drop_pending_updates: dropPendingUpdates });
+}
+
+export interface ServeOptions extends WebhookOptions {
+	/** listen port. defaults to 8080. */
+	port?: number;
+	/** listen hostname. */
+	hostname?: string;
+}
+
+type FetchHandler = (request: Request) => Promise<Response>;
+
+interface BunRuntime {
+	serve(options: { port?: number; hostname?: string; fetch: FetchHandler }): unknown;
+}
+
+interface DenoRuntime {
+	serve(options: { port?: number; hostname?: string }, handler: FetchHandler): unknown;
+}
+
+/**
+ * start a standalone webhook server using the runtime's native fetch server
+ * (bun or deno). on node use `nodeWebhookCallback` from `@yaebal/core`; on edge,
+ * export `{ fetch: webhook(bot) }` instead.
+ */
+export function serve(bot: UpdateSink, options: ServeOptions = {}): void {
+	const handler = webhook(bot, options);
+	const runtime = globalThis as { Bun?: BunRuntime; Deno?: DenoRuntime };
+
+	if (runtime.Bun) {
+		runtime.Bun.serve({ port: options.port ?? 8080, hostname: options.hostname, fetch: handler });
+	} else if (runtime.Deno) {
+		runtime.Deno.serve({ port: options.port ?? 8080, hostname: options.hostname }, handler);
+	} else {
+		throw new Error(
+			"serve() requires bun or deno. on node use nodeWebhookCallback from @yaebal/core; on edge export { fetch: webhook(bot) }.",
+		);
+	}
+}