@yawlabs/lemonsqueezy-webhook-sink 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 YawLabs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,84 @@
+# @yawlabs/lemonsqueezy-webhook-sink
+
+Durable webhook receiver for [LemonSqueezy](https://lemonsqueezy.com). Verifies HMAC signatures, deduplicates repeat deliveries, and persists every event to SQLite so your downstream services can read from the sink on their own schedule and reconcile state even when their API calls succeed-but-the-response-is-lost.
+
+Designed to sit **in front of** your business logic — not to replace it.
+
+## Why this exists
+
+API writes against LemonSqueezy can succeed upstream and fail to deliver a response to you (timeouts, network partitions, crashes mid-ack). The canonical way to recover is to subscribe to webhooks and reconcile your local state against what LemonSqueezy actually observed. This service is the durable sink for that reconciliation loop.
+
+If you're running an agent or unattended automation against [@yawlabs/lemonsqueezy-mcp](https://github.com/YawLabs/lemonsqueezy-mcp), pair it with this sink.
+
+## Quick start
+
+```bash
+npx @yawlabs/lemonsqueezy-webhook-sink
+```
+
+Required environment:
+
+| Variable | Purpose |
+| --- | --- |
+| `LEMONSQUEEZY_SIGNING_SECRET` | The signing secret from your LemonSqueezy webhook config. Used to verify `X-Signature`. |
+
+Optional:
+
+| Variable | Default | Purpose |
+| --- | --- | --- |
+| `PORT` | `8787` | HTTP port to listen on. |
+| `WEBHOOK_SINK_DB` | `./events.db` | Path to the SQLite file. |
+| `WEBHOOK_SINK_ADMIN_TOKEN` | *(unset → admin disabled)* | Bearer token required to hit `/events`, `/events/:id/processed`, `/stats`. When unset, those endpoints return 404. |
+
+## Endpoints
+
+| Method | Path | Auth | Purpose |
+| --- | --- | --- | --- |
+| `POST` | `/webhook` | HMAC | Receive a LemonSqueezy webhook. Returns 200 for both new and duplicate events. |
+| `GET` | `/healthz` | none | Liveness check. |
+| `GET` | `/events?since=<ts>&type=<name>&limit=<n>` | `WEBHOOK_SINK_ADMIN_TOKEN` | Page events in order of `received_at`. Use `since=<last-seen-ts>` to checkpoint. |
+| `POST` | `/events/:id/processed` | `WEBHOOK_SINK_ADMIN_TOKEN` | Mark an event consumed. |
+| `GET` | `/stats` | `WEBHOOK_SINK_ADMIN_TOKEN` | Total events, unprocessed count, last-received timestamp. |
+
+## Deduplication
+
+Every event is stored under a stable `event_key`:
+
+1. If the sender supplies `meta.custom_data.event_id` (e.g. you set one on checkout), that wins.
+2. Otherwise, a SHA-256 of `event_name + data.type + data.id + data.attributes.created_at`. This is stable across LemonSqueezy's retries because the payload itself doesn't change between deliveries.
+
+Duplicate deliveries return `200 { ok: true, duplicate: true }` and are not inserted a second time.
+
+## Reconciliation pattern
+
+```
+# Your service pulls events and applies them.
+last_seen = load_checkpoint()
+while True:
+    events = GET /events?since=${last_seen}&limit=100
+    for e in events:
+        apply(e.payload)
+        POST /events/${e.id}/processed
+        last_seen = e.received_at
+    if len(events) < 100: sleep(5)
+```
+
+The sink doesn't push — consumers pull. This makes the sink stateless with respect to business logic and lets consumers retry/backfill freely.
+
+## Non-goals
+
+- **Business logic.** The sink persists and exposes; it does not decide.
+- **Multi-tenant event routing.** One sink per LemonSqueezy account.
+- **HA replication.** SQLite with WAL is fine for tens of events/sec. For higher volume or HA, point `WEBHOOK_SINK_DB` at an NFS mount or swap the store adapter (future work).
+
+## Development
+
+```bash
+npm install
+npm run lint
+npm test
+```
+
+## License
+
+MIT

package/dist/app.js

@@ -0,0 +1,49 @@
+import { Hono } from "hono";
+import { handleWebhook } from "./handler.js";
+export function createApp(config) {
+    const { store, signingSecret, adminToken } = config;
+    const app = new Hono();
+    app.get("/healthz", (c) => c.json({ ok: true }));
+    app.post("/webhook", async (c) => {
+        const rawBody = await c.req.text();
+        const signature = c.req.header("x-signature") ?? null;
+        const result = handleWebhook({ store, signingSecret }, { rawBody, signature });
+        return c.json(result.body, result.status);
+    });
+    function requireAdmin(c) {
+        if (!adminToken)
+            return c.json({ error: "admin endpoints disabled" }, 404);
+        const auth = c.req.header("authorization") ?? "";
+        if (auth !== `Bearer ${adminToken}`)
+            return c.json({ error: "unauthorized" }, 401);
+        return null;
+    }
+    app.get("/events", (c) => {
+        const unauthorized = requireAdmin(c);
+        if (unauthorized)
+            return unauthorized;
+        const since = Number(c.req.query("since") ?? 0);
+        const type = c.req.query("type") ?? undefined;
+        const limit = Number(c.req.query("limit") ?? 100);
+        const rows = store.list({ since, type, limit });
+        return c.json({ events: rows });
+    });
+    app.post("/events/:id/processed", (c) => {
+        const unauthorized = requireAdmin(c);
+        if (unauthorized)
+            return unauthorized;
+        const id = Number(c.req.param("id"));
+        if (!Number.isFinite(id))
+            return c.json({ error: "invalid id" }, 400);
+        store.markProcessed(id);
+        return c.json({ ok: true });
+    });
+    app.get("/stats", (c) => {
+        const unauthorized = requireAdmin(c);
+        if (unauthorized)
+            return unauthorized;
+        return c.json(store.stats());
+    });
+    return app;
+}
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAS7C,MAAM,UAAU,SAAS,CAAC,MAAiB;IACzC,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEjD,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;QACtD,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,SAAS,YAAY,CAAC,CAAU;QAC9B,IAAI,CAAC,UAAU;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,IAAI,KAAK,UAAU,UAAU,EAAE;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;QACvB,MAAM,YAAY,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE;QACtC,MAAM,YAAY,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;QACtC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC;QACtE,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACxB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,YAAY,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;QACtC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/app.test.js

@@ -0,0 +1,161 @@
+import assert from "node:assert/strict";
+import { createHmac } from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, it } from "node:test";
+import { createApp } from "./app.js";
+import { EventStore } from "./store.js";
+const SECRET = "whsec_test";
+const ADMIN = "admin_token_xyz";
+function sign(body) {
+    return createHmac("sha256", SECRET).update(body).digest("hex");
+}
+function payload(eventName = "order_created", id = "42") {
+    return JSON.stringify({
+        meta: { event_name: eventName },
+        data: { type: "orders", id, attributes: { created_at: "2026-01-01T00:00:00Z" } },
+    });
+}
+describe("HTTP app", () => {
+    let store;
+    let dbPath;
+    let app;
+    beforeEach(() => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), "ls-sink-http-"));
+        dbPath = path.join(dir, "events.db");
+        store = new EventStore(dbPath);
+        app = createApp({ store, signingSecret: SECRET, adminToken: ADMIN });
+    });
+    afterEach(() => {
+        store.close();
+        try {
+            fs.unlinkSync(dbPath);
+        }
+        catch { }
+    });
+    async function req(path, init = {}) {
+        return app.fetch(new Request(`http://test${path}`, init));
+    }
+    it("GET /healthz returns ok", async () => {
+        const r = await req("/healthz");
+        assert.equal(r.status, 200);
+        assert.deepEqual(await r.json(), { ok: true });
+    });
+    it("POST /webhook accepts a signed body", async () => {
+        const body = payload();
+        const r = await req("/webhook", {
+            method: "POST",
+            headers: { "x-signature": sign(body), "content-type": "application/json" },
+            body,
+        });
+        assert.equal(r.status, 200);
+        const j = (await r.json());
+        assert.equal(j.ok, true);
+        assert.equal(j.duplicate, false);
+        assert.ok(j.id > 0);
+    });
+    it("POST /webhook dedupes repeat deliveries", async () => {
+        const body = payload();
+        const sig = sign(body);
+        const headers = { "x-signature": sig, "content-type": "application/json" };
+        await req("/webhook", { method: "POST", headers, body });
+        const second = await req("/webhook", { method: "POST", headers, body });
+        assert.equal(second.status, 200);
+        const j = (await second.json());
+        assert.equal(j.duplicate, true);
+        assert.equal(store.stats().total, 1);
+    });
+    it("POST /webhook rejects bad signature with 401", async () => {
+        const body = payload();
+        const r = await req("/webhook", {
+            method: "POST",
+            headers: { "x-signature": "deadbeef" },
+            body,
+        });
+        assert.equal(r.status, 401);
+        assert.equal(store.stats().total, 0);
+    });
+    it("GET /events requires bearer token", async () => {
+        const r = await req("/events");
+        assert.equal(r.status, 401);
+    });
+    it("GET /events returns stored events when authorized", async () => {
+        const body = payload();
+        await req("/webhook", {
+            method: "POST",
+            headers: { "x-signature": sign(body) },
+            body,
+        });
+        const r = await req("/events", { headers: { authorization: `Bearer ${ADMIN}` } });
+        assert.equal(r.status, 200);
+        const data = (await r.json());
+        assert.equal(data.events.length, 1);
+        assert.equal(data.events[0]?.event_name, "order_created");
+    });
+    it("GET /events filters by since and type", async () => {
+        for (const [name, id, _at] of [
+            ["order_created", "1", 1],
+            ["subscription_updated", "2", 2],
+            ["order_created", "3", 3],
+        ]) {
+            const body = payload(name, id);
+            await req("/webhook", {
+                method: "POST",
+                headers: { "x-signature": sign(body) },
+                body,
+            });
+        }
+        const r = await req("/events?type=order_created", {
+            headers: { authorization: `Bearer ${ADMIN}` },
+        });
+        const data = (await r.json());
+        assert.equal(data.events.length, 2);
+    });
+    it("POST /events/:id/processed flips the flag", async () => {
+        const body = payload();
+        await req("/webhook", {
+            method: "POST",
+            headers: { "x-signature": sign(body) },
+            body,
+        });
+        const id = store.list({})[0]?.id;
+        assert.ok(id);
+        const r = await req(`/events/${id}/processed`, {
+            method: "POST",
+            headers: { authorization: `Bearer ${ADMIN}` },
+        });
+        assert.equal(r.status, 200);
+        assert.equal(store.stats().unprocessed, 0);
+    });
+    it("POST /events/:id/processed rejects non-numeric id with 400", async () => {
+        const r = await req("/events/not-a-number/processed", {
+            method: "POST",
+            headers: { authorization: `Bearer ${ADMIN}` },
+        });
+        assert.equal(r.status, 400);
+    });
+    it("GET /stats returns totals", async () => {
+        const body = payload();
+        await req("/webhook", {
+            method: "POST",
+            headers: { "x-signature": sign(body) },
+            body,
+        });
+        const r = await req("/stats", { headers: { authorization: `Bearer ${ADMIN}` } });
+        assert.equal(r.status, 200);
+        const s = (await r.json());
+        assert.equal(s.total, 1);
+        assert.equal(s.unprocessed, 1);
+    });
+    it("admin endpoints return 404 when token is unset", async () => {
+        const noAuthApp = createApp({ store, signingSecret: SECRET, adminToken: undefined });
+        const r = await noAuthApp.fetch(new Request("http://test/events", { headers: { authorization: "Bearer anything" } }));
+        assert.equal(r.status, 404);
+    });
+    it("admin endpoints reject wrong bearer token with 401", async () => {
+        const r = await req("/stats", { headers: { authorization: "Bearer wrong" } });
+        assert.equal(r.status, 401);
+    });
+});
+//# sourceMappingURL=app.test.js.map

package/dist/app.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.test.js","sourceRoot":"","sources":["../src/app.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AAEhE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,MAAM,MAAM,GAAG,YAAY,CAAC;AAC5B,MAAM,KAAK,GAAG,iBAAiB,CAAC;AAEhC,SAAS,IAAI,CAAC,IAAY;IACxB,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,OAAO,CAAC,SAAS,GAAG,eAAe,EAAE,EAAE,GAAG,IAAI;IACrD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;QAC/B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,sBAAsB,EAAE,EAAE;KACjF,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;IACxB,IAAI,KAAiB,CAAC;IACtB,IAAI,MAAc,CAAC;IACnB,IAAI,GAAS,CAAC;IAEd,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACrC,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/B,GAAG,GAAG,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,GAAG,CAAC,IAAY,EAAE,OAAoB,EAAE;QACrD,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,cAAc,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5B,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE;YAC9B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC1E,IAAI;SACL,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAiD,CAAC;QAC3E,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;QAC3E,MAAM,GAAG,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAqC,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE;YAC9B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE;YACtC,IAAI;SACL,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,GAAG,CAAC,UAAU,EAAE;YACpB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACtC,IAAI;SACL,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAClF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAA8C,CAAC;QAC3E,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI;YAC5B,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;YACzB,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;YAChC,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;SACjB,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC/B,MAAM,GAAG,CAAC,UAAU,EAAE;gBACpB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;gBACtC,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,4BAA4B,EAAE;YAChD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAA+C,CAAC;QAC5E,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,GAAG,CAAC,UAAU,EAAE;YACpB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACtC,IAAI;SACL,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACjC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACd,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE;YAC7C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,gCAAgC,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,MAAM,GAAG,CAAC,UAAU,EAAE;YACpB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACtC,IAAI;SACL,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QACjF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAA2C,CAAC;QACrE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,SAAS,GAAG,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;QACrF,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,KAAK,CAC7B,IAAI,OAAO,CAAC,oBAAoB,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,iBAAiB,EAAE,EAAE,CAAC,CACrF,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/handler.js

@@ -0,0 +1,46 @@
+import { createHash } from "node:crypto";
+import { verifySignature } from "./verify.js";
+/**
+ * Derive a stable dedupe key for a webhook payload.
+ *
+ * Preferred: `meta.custom_data.event_id` if the sender provides one (our own
+ * checkout-create flows can set this). Fallback: SHA-256 of
+ * `event_name + resource_type + resource_id + created_at`. This is stable
+ * across LemonSqueezy's "same event delivered twice" retries because those
+ * replay the identical payload.
+ */
+export function deriveEventKey(payload) {
+    const explicit = payload.meta?.custom_data?.event_id;
+    if (typeof explicit === "string" && explicit.length > 0)
+        return explicit;
+    const eventName = payload.meta?.event_name ?? "unknown";
+    const resourceType = payload.data?.type ?? "unknown";
+    const resourceId = payload.data?.id ?? "unknown";
+    const createdAt = payload.data?.attributes?.created_at ?? "";
+    return createHash("sha256").update(`${eventName}|${resourceType}|${resourceId}|${createdAt}`).digest("hex");
+}
+export function handleWebhook(deps, input) {
+    if (!verifySignature(input.rawBody, input.signature, deps.signingSecret)) {
+        return { status: 401, body: { ok: false, error: "invalid signature" } };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(input.rawBody);
+    }
+    catch {
+        return { status: 400, body: { ok: false, error: "invalid json" } };
+    }
+    const eventName = parsed.meta?.event_name;
+    if (!eventName) {
+        return { status: 400, body: { ok: false, error: "missing meta.event_name" } };
+    }
+    const result = deps.store.insert({
+        event_key: deriveEventKey(parsed),
+        event_name: eventName,
+        resource_id: parsed.data?.id !== undefined ? String(parsed.data.id) : null,
+        received_at: (deps.now ?? Date.now)(),
+        payload: input.rawBody,
+    });
+    return { status: 200, body: { ok: true, id: result.id, duplicate: result.duplicate } };
+}
+//# sourceMappingURL=handler.js.map

package/dist/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../src/handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAkB9C;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,OAA4B;IACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC;IACrD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEzE,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,IAAI,SAAS,CAAC;IACxD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,SAAS,CAAC;IACrD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,SAAS,CAAC;IACjD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,IAAI,EAAE,CAAC;IAC7D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,YAAY,IAAI,UAAU,IAAI,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9G,CAAC;AAkBD,MAAM,UAAU,aAAa,CAAC,IAAiB,EAAE,KAAmB;IAClE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,CAAC;IAC1E,CAAC;IAED,IAAI,MAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAwB,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC;IACrE,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAC/B,SAAS,EAAE,cAAc,CAAC,MAAM,CAAC;QACjC,UAAU,EAAE,SAAS;QACrB,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;QAC1E,WAAW,EAAE,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE;QACrC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC;AACzF,CAAC"}

package/dist/handler.test.js

@@ -0,0 +1,108 @@
+import assert from "node:assert/strict";
+import { createHmac } from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, it } from "node:test";
+import { deriveEventKey, handleWebhook } from "./handler.js";
+import { EventStore } from "./store.js";
+function sign(body, secret) {
+    return createHmac("sha256", secret).update(body).digest("hex");
+}
+describe("deriveEventKey", () => {
+    it("prefers meta.custom_data.event_id when present", () => {
+        const key = deriveEventKey({
+            meta: { event_name: "order_created", custom_data: { event_id: "evt_123" } },
+            data: { id: "1" },
+        });
+        assert.equal(key, "evt_123");
+    });
+    it("falls back to a stable hash when event_id is absent", () => {
+        const payload = {
+            meta: { event_name: "order_created" },
+            data: { id: "1", type: "orders", attributes: { created_at: "2026-01-01T00:00:00Z" } },
+        };
+        const a = deriveEventKey(payload);
+        const b = deriveEventKey(payload);
+        assert.equal(a, b);
+        assert.equal(a.length, 64);
+    });
+    it("produces different hashes for different resources", () => {
+        const base = {
+            meta: { event_name: "order_created" },
+            data: { type: "orders", attributes: { created_at: "2026-01-01T00:00:00Z" } },
+        };
+        const a = deriveEventKey({ ...base, data: { ...base.data, id: "1" } });
+        const b = deriveEventKey({ ...base, data: { ...base.data, id: "2" } });
+        assert.notEqual(a, b);
+    });
+});
+describe("handleWebhook", () => {
+    const secret = "whsec_test";
+    let store;
+    let dbPath;
+    beforeEach(() => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), "ls-sink-"));
+        dbPath = path.join(dir, "events.db");
+        store = new EventStore(dbPath);
+    });
+    afterEach(() => {
+        store.close();
+        try {
+            fs.unlinkSync(dbPath);
+        }
+        catch { }
+    });
+    function validBody(eventName = "order_created", id = "42") {
+        return JSON.stringify({
+            meta: { event_name: eventName },
+            data: { type: "orders", id, attributes: { created_at: "2026-01-01T00:00:00Z" } },
+        });
+    }
+    it("persists a valid webhook and returns 200", () => {
+        const body = validBody();
+        const result = handleWebhook({ store, signingSecret: secret }, { rawBody: body, signature: sign(body, secret) });
+        assert.equal(result.status, 200);
+        assert.equal(result.body.duplicate, false);
+    });
+    it("dedupes identical webhook deliveries", () => {
+        const body = validBody();
+        const sig = sign(body, secret);
+        const first = handleWebhook({ store, signingSecret: secret }, { rawBody: body, signature: sig });
+        const second = handleWebhook({ store, signingSecret: secret }, { rawBody: body, signature: sig });
+        assert.equal(first.status, 200);
+        assert.equal(second.status, 200);
+        assert.equal(second.body.duplicate, true);
+        assert.equal(store.stats().total, 1);
+    });
+    it("rejects invalid signature with 401", () => {
+        const body = validBody();
+        const result = handleWebhook({ store, signingSecret: secret }, { rawBody: body, signature: "deadbeef" });
+        assert.equal(result.status, 401);
+        assert.equal(store.stats().total, 0);
+    });
+    it("rejects missing signature with 401", () => {
+        const body = validBody();
+        const result = handleWebhook({ store, signingSecret: secret }, { rawBody: body, signature: null });
+        assert.equal(result.status, 401);
+    });
+    it("rejects malformed JSON with 400 after sig passes", () => {
+        const body = "not json";
+        const result = handleWebhook({ store, signingSecret: secret }, { rawBody: body, signature: sign(body, secret) });
+        assert.equal(result.status, 400);
+        assert.match(result.body.error, /invalid json/);
+    });
+    it("rejects payload missing meta.event_name with 400", () => {
+        const body = JSON.stringify({ data: { id: "1" } });
+        const result = handleWebhook({ store, signingSecret: secret }, { rawBody: body, signature: sign(body, secret) });
+        assert.equal(result.status, 400);
+        assert.match(result.body.error, /missing meta.event_name/);
+    });
+    it("stores raw body verbatim for re-verification", () => {
+        const body = validBody();
+        handleWebhook({ store, signingSecret: secret }, { rawBody: body, signature: sign(body, secret) });
+        const rows = store.list({ limit: 1 });
+        assert.equal(rows[0]?.payload, body);
+    });
+});
+//# sourceMappingURL=handler.test.js.map

package/dist/handler.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.test.js","sourceRoot":"","sources":["../src/handler.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,SAAS,IAAI,CAAC,IAAY,EAAE,MAAc;IACxC,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,GAAG,GAAG,cAAc,CAAC;YACzB,IAAI,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE;YAC3E,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,OAAO,GAAG;YACd,IAAI,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE;YACrC,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,sBAAsB,EAAE,EAAE;SACtF,CAAC;QACF,MAAM,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,IAAI,GAAG;YACX,IAAI,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE;YACrC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,sBAAsB,EAAE,EAAE;SAC7E,CAAC;QACF,MAAM,CAAC,GAAG,cAAc,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACvE,MAAM,CAAC,GAAG,cAAc,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACvE,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,MAAM,MAAM,GAAG,YAAY,CAAC;IAC5B,IAAI,KAAiB,CAAC;IACtB,IAAI,MAAc,CAAC;IAEnB,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;QAC/D,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACrC,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC,CAAC,CAAC;IAEH,SAAS,SAAS,CAAC,SAAS,GAAG,eAAe,EAAE,EAAE,GAAG,IAAI;QACvD,OAAO,IAAI,CAAC,SAAS,CAAC;YACpB,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;YAC/B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,sBAAsB,EAAE,EAAE;SACjF,CAAC,CAAC;IACL,CAAC;IAED,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACjH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAE,MAAM,CAAC,IAAyC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACjG,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QAClG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAE,MAAM,CAAC,IAAyC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAChF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;QACzG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,IAAI,GAAG,UAAU,CAAC;QACxB,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACjH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAE,MAAM,CAAC,IAA0B,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACjH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAE,MAAM,CAAC,IAA0B,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,aAAa,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAClG,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/index.js

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+import { serve } from "@hono/node-server";
+import { createApp } from "./app.js";
+import { EventStore } from "./store.js";
+function requireEnv(name) {
+    const v = process.env[name];
+    if (!v || v.trim() === "")
+        throw new Error(`${name} environment variable is required`);
+    return v;
+}
+const SIGNING_SECRET = requireEnv("LEMONSQUEEZY_SIGNING_SECRET");
+const DB_PATH = process.env.WEBHOOK_SINK_DB ?? "./events.db";
+const PORT = Number(process.env.PORT ?? 8787);
+const ADMIN_TOKEN = process.env.WEBHOOK_SINK_ADMIN_TOKEN;
+const store = new EventStore(DB_PATH);
+const app = createApp({ store, signingSecret: SIGNING_SECRET, adminToken: ADMIN_TOKEN });
+const server = serve({ fetch: app.fetch, port: PORT }, (info) => {
+    console.log(`lemonsqueezy-webhook-sink listening on :${info.port}`);
+});
+const shutdown = () => {
+    server.close(() => {
+        store.close();
+        process.exit(0);
+    });
+};
+process.on("SIGTERM", shutdown);
+process.on("SIGINT", shutdown);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,mCAAmC,CAAC,CAAC;IACvF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,cAAc,GAAG,UAAU,CAAC,6BAA6B,CAAC,CAAC;AACjE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,aAAa,CAAC;AAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;AAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;AAEzD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;AACtC,MAAM,GAAG,GAAG,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC;AAEzF,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;IAC9D,OAAO,CAAC,GAAG,CAAC,2CAA2C,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AACtE,CAAC,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,GAAG,EAAE;IACpB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;QAChB,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAChC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC"}

package/dist/store.js

@@ -0,0 +1,63 @@
+import { readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import Database from "better-sqlite3";
+const SCHEMA_PATH = resolve(dirname(fileURLToPath(import.meta.url)), "../schema.sql");
+export class EventStore {
+    db;
+    constructor(dbPath) {
+        this.db = new Database(dbPath);
+        this.db.pragma("journal_mode = WAL");
+        this.db.pragma("synchronous = NORMAL");
+        this.db.exec(readFileSync(SCHEMA_PATH, "utf8"));
+    }
+    /**
+     * Insert an event. Dedupes on event_key — if the key exists, returns the
+     * existing row's id and `duplicate: true` without touching the row.
+     */
+    insert(input) {
+        const existing = this.db
+            .prepare("SELECT id FROM events WHERE event_key = ?")
+            .get(input.event_key);
+        if (existing)
+            return { id: existing.id, duplicate: true };
+        const info = this.db
+            .prepare("INSERT INTO events (event_key, event_name, resource_id, received_at, payload) VALUES (?, ?, ?, ?, ?)")
+            .run(input.event_key, input.event_name, input.resource_id, input.received_at, input.payload);
+        return { id: info.lastInsertRowid, duplicate: false };
+    }
+    /**
+     * Read events for reconciliation. `since` is the minimum `received_at`
+     * (exclusive). `limit` caps the page size. Ordered by received_at ASC so
+     * consumers can checkpoint by the last-seen timestamp.
+     */
+    list(opts) {
+        const limit = Math.min(Math.max(opts.limit ?? 100, 1), 1000);
+        const since = opts.since ?? 0;
+        if (opts.type) {
+            return this.db
+                .prepare("SELECT * FROM events WHERE received_at > ? AND event_name = ? ORDER BY received_at ASC LIMIT ?")
+                .all(since, opts.type, limit);
+        }
+        return this.db
+            .prepare("SELECT * FROM events WHERE received_at > ? ORDER BY received_at ASC LIMIT ?")
+            .all(since, limit);
+    }
+    markProcessed(id) {
+        this.db.prepare("UPDATE events SET processed = 1 WHERE id = ?").run(id);
+    }
+    stats() {
+        const totalRow = this.db.prepare("SELECT COUNT(*) as c FROM events").get();
+        const unprocRow = this.db.prepare("SELECT COUNT(*) as c FROM events WHERE processed = 0").get();
+        const lastRow = this.db.prepare("SELECT MAX(received_at) as m FROM events").get();
+        return {
+            total: totalRow?.c ?? 0,
+            unprocessed: unprocRow?.c ?? 0,
+            lastReceivedAt: lastRow?.m ?? null,
+        };
+    }
+    close() {
+        this.db.close();
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAEtC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;AA0BtF,MAAM,OAAO,UAAU;IACb,EAAE,CAAoB;IAE9B,YAAY,MAAc;QACxB,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAkB;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE;aACrB,OAAO,CAA2B,2CAA2C,CAAC;aAC9E,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACxB,IAAI,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAE1D,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC,sGAAsG,CAAC;aAC/G,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/F,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,eAAyB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAClE,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,IAAuD;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,EAAE;iBACX,OAAO,CACN,gGAAgG,CACjG;iBACA,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,IAAI,CAAC,EAAE;aACX,OAAO,CACN,6EAA6E,CAC9E;aACA,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACvB,CAAC;IAED,aAAa,CAAC,EAAU;QACtB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAoB,kCAAkC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC9F,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAoB,sDAAsD,CAAC,CAAC,GAAG,EAAE,CAAC;QACnH,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAA2B,0CAA0C,CAAC,CAAC,GAAG,EAAE,CAAC;QAC5G,OAAO;YACL,KAAK,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC;YACvB,WAAW,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC;YAC9B,cAAc,EAAE,OAAO,EAAE,CAAC,IAAI,IAAI;SACnC,CAAC;IACJ,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;CACF"}

package/dist/store.test.js

@@ -0,0 +1,77 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, it } from "node:test";
+import { EventStore } from "./store.js";
+describe("EventStore", () => {
+    let store;
+    let dbPath;
+    beforeEach(() => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), "ls-sink-store-"));
+        dbPath = path.join(dir, "events.db");
+        store = new EventStore(dbPath);
+    });
+    afterEach(() => {
+        store.close();
+        try {
+            fs.unlinkSync(dbPath);
+        }
+        catch { }
+    });
+    function base(overrides = {}) {
+        return {
+            event_key: "evt_1",
+            event_name: "order_created",
+            resource_id: "42",
+            received_at: 1000,
+            payload: "{}",
+            ...overrides,
+        };
+    }
+    it("insert returns a new id and duplicate=false", () => {
+        const r = store.insert(base());
+        assert.ok(r.id > 0);
+        assert.equal(r.duplicate, false);
+    });
+    it("insert with existing event_key returns duplicate=true and same id", () => {
+        const r1 = store.insert(base());
+        const r2 = store.insert(base({ payload: '{"different":true}' }));
+        assert.equal(r2.id, r1.id);
+        assert.equal(r2.duplicate, true);
+        assert.equal(store.stats().total, 1);
+    });
+    it("list filters by received_at exclusively", () => {
+        store.insert(base({ event_key: "a", received_at: 100 }));
+        store.insert(base({ event_key: "b", received_at: 200 }));
+        store.insert(base({ event_key: "c", received_at: 300 }));
+        const rows = store.list({ since: 100 });
+        assert.equal(rows.length, 2);
+        assert.deepEqual(rows.map((r) => r.event_key), ["b", "c"]);
+    });
+    it("list filters by event_name", () => {
+        store.insert(base({ event_key: "a", event_name: "order_created", received_at: 1 }));
+        store.insert(base({ event_key: "b", event_name: "subscription_updated", received_at: 2 }));
+        const rows = store.list({ type: "subscription_updated" });
+        assert.equal(rows.length, 1);
+        assert.equal(rows[0]?.event_key, "b");
+    });
+    it("list limit is clamped between 1 and 1000", () => {
+        for (let i = 0; i < 5; i++)
+            store.insert(base({ event_key: `k${i}`, received_at: i + 1 }));
+        assert.equal(store.list({ limit: -5 }).length, 1);
+        assert.equal(store.list({ limit: 9999 }).length, 5);
+    });
+    it("markProcessed flips the flag", () => {
+        const { id } = store.insert(base());
+        assert.equal(store.stats().unprocessed, 1);
+        store.markProcessed(id);
+        assert.equal(store.stats().unprocessed, 0);
+    });
+    it("stats reports last received_at", () => {
+        store.insert(base({ event_key: "a", received_at: 500 }));
+        store.insert(base({ event_key: "b", received_at: 700 }));
+        assert.equal(store.stats().lastReceivedAt, 700);
+    });
+});
+//# sourceMappingURL=store.test.js.map

package/dist/store.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.test.js","sourceRoot":"","sources":["../src/store.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,IAAI,KAAiB,CAAC;IACtB,IAAI,MAAc,CAAC;IAEnB,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACrE,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACrC,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC,CAAC,CAAC;IAEH,SAAS,IAAI,CAAC,YAA0D,EAAE;QACxE,OAAO;YACL,SAAS,EAAE,OAAO;YAClB,UAAU,EAAE,eAAe;YAC3B,WAAW,EAAE,IAAI;YACjB,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,IAAI;YACb,GAAG,SAAS;SACb,CAAC;IACJ,CAAC;IAED,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;QACjE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACzD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACzD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,SAAS,CACd,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAC5B,CAAC,GAAG,EAAE,GAAG,CAAC,CACX,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACpF,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,sBAAsB,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3F,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3F,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC3C,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACzD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/verify.js

@@ -0,0 +1,25 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+/**
+ * Verify a LemonSqueezy webhook signature.
+ *
+ * LemonSqueezy signs the raw request body with HMAC-SHA256 using your signing
+ * secret and sends the hex digest in `X-Signature`. We recompute the HMAC over
+ * the exact bytes we received and timing-safe-compare.
+ *
+ * Callers MUST pass the raw body exactly as received — any JSON re-serialization
+ * will change the bytes and the signature will not match.
+ */
+export function verifySignature(rawBody, headerSignature, secret) {
+    if (!headerSignature)
+        return false;
+    if (!secret)
+        return false;
+    const bodyBuf = typeof rawBody === "string" ? Buffer.from(rawBody, "utf8") : rawBody;
+    const expected = createHmac("sha256", secret).update(bodyBuf).digest("hex");
+    const expectedBuf = Buffer.from(expected, "utf8");
+    const receivedBuf = Buffer.from(headerSignature, "utf8");
+    if (expectedBuf.length !== receivedBuf.length)
+        return false;
+    return timingSafeEqual(expectedBuf, receivedBuf);
+}
+//# sourceMappingURL=verify.js.map

package/dist/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,OAAwB,EAAE,eAA8B,EAAE,MAAc;IACtG,IAAI,CAAC,eAAe;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,MAAM,OAAO,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACrF,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE5E,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAEzD,IAAI,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5D,OAAO,eAAe,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AACnD,CAAC"}

package/dist/verify.test.js

@@ -0,0 +1,34 @@
+import assert from "node:assert/strict";
+import { createHmac } from "node:crypto";
+import { describe, it } from "node:test";
+import { verifySignature } from "./verify.js";
+function sign(body, secret) {
+    return createHmac("sha256", secret).update(body).digest("hex");
+}
+describe("verifySignature", () => {
+    const secret = "whsec_test";
+    const body = '{"meta":{"event_name":"order_created"}}';
+    it("accepts a valid signature", () => {
+        assert.equal(verifySignature(body, sign(body, secret), secret), true);
+    });
+    it("accepts a valid signature over Buffer body", () => {
+        assert.equal(verifySignature(Buffer.from(body), sign(body, secret), secret), true);
+    });
+    it("rejects tampered body", () => {
+        const sig = sign(body, secret);
+        assert.equal(verifySignature(`${body} `, sig, secret), false);
+    });
+    it("rejects wrong secret", () => {
+        assert.equal(verifySignature(body, sign(body, secret), "whsec_other"), false);
+    });
+    it("rejects missing header", () => {
+        assert.equal(verifySignature(body, null, secret), false);
+    });
+    it("rejects empty secret", () => {
+        assert.equal(verifySignature(body, sign(body, ""), ""), false);
+    });
+    it("rejects signature of different length without timing leak", () => {
+        assert.equal(verifySignature(body, "abc", secret), false);
+    });
+});
+//# sourceMappingURL=verify.test.js.map

package/dist/verify.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.test.js","sourceRoot":"","sources":["../src/verify.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,SAAS,IAAI,CAAC,IAAY,EAAE,MAAc;IACxC,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,MAAM,MAAM,GAAG,YAAY,CAAC;IAC5B,MAAM,IAAI,GAAG,yCAAyC,CAAC;IAEvD,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@yawlabs/lemonsqueezy-webhook-sink",
+  "version": "0.1.0",
+  "description": "Durable webhook receiver for LemonSqueezy — verifies signatures, deduplicates events, and persists them for replay and reconciliation",
+  "license": "MIT",
+  "author": "YawLabs <contact@yaw.sh>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/YawLabs/lemonsqueezy-webhook-sink.git"
+  },
+  "keywords": [
+    "lemonsqueezy",
+    "webhook",
+    "receiver",
+    "reconciliation",
+    "payments"
+  ],
+  "type": "module",
+  "main": "dist/index.js",
+  "bin": {
+    "lemonsqueezy-webhook-sink": "dist/index.js"
+  },
+  "files": [
+    "dist/",
+    "schema.sql"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "start": "node dist/index.js",
+    "test": "npm run build && node --test dist/*.test.js",
+    "test:ci": "npm run test",
+    "lint": "biome check src/",
+    "lint:fix": "biome check --write src/",
+    "prepublishOnly": "npm run build && node --test dist/*.test.js"
+  },
+  "dependencies": {
+    "better-sqlite3": "^11.3.0",
+    "hono": "^4.6.0",
+    "@hono/node-server": "^1.13.0"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^1.9.4",
+    "@types/better-sqlite3": "^7.6.11",
+    "@types/node": "^22.15.2",
+    "typescript": "^5.8.3"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}

package/schema.sql

@@ -0,0 +1,29 @@
+-- Webhook event store. One row per received webhook, deduplicated by LemonSqueezy's event_name + custom_data.event_id when present.
+-- The payload is stored as raw JSON so the HMAC signature can be re-verified
+-- against the original bytes if needed.
+
+CREATE TABLE IF NOT EXISTS events (
+  -- Surrogate primary key; external consumers should prefer `event_key`.
+  id          INTEGER PRIMARY KEY AUTOINCREMENT,
+
+  -- LemonSqueezy event identity. `event_key` is the dedupe key: either the
+  -- `meta.custom_data.event_id` if the sender provides one, or a hash of
+  -- (event_name + timestamp + resource_id) as a fallback. Unique so duplicate
+  -- deliveries become a no-op insert.
+  event_key   TEXT NOT NULL UNIQUE,
+  event_name  TEXT NOT NULL,
+  resource_id TEXT,
+
+  -- When the sink received the event. Not the LS `created_at`.
+  received_at INTEGER NOT NULL,
+
+  -- Raw JSON payload as sent by LemonSqueezy (verbatim, pre-parse).
+  payload     TEXT NOT NULL,
+
+  -- Consumer bookkeeping. Consumers mark events processed via an UPDATE.
+  processed   INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE INDEX IF NOT EXISTS idx_events_received_at ON events(received_at);
+CREATE INDEX IF NOT EXISTS idx_events_name        ON events(event_name);
+CREATE INDEX IF NOT EXISTS idx_events_processed   ON events(processed) WHERE processed = 0;