@zap-studio/webhooks 0.2.2 → 0.4.0

package/dist/types.d.ts

@@ -0,0 +1,93 @@
+import { StandardSchemaV1 } from "@zap-studio/validation";
+//#region src/types.d.ts
+/**
+ * Context shared by hooks, verifiers, and handlers for a single webhook request.
+ *
+ * The router consumes the request body exactly once, so `request.body` is
+ * already used by the time hooks or handlers run — read `rawBody` instead.
+ */
+interface WebhookContext {
+  /** The matched route key registered on the router (e.g. "stripe") */
+  path: string;
+  /** The exact request body bytes (for signature verification) */
+  rawBody: Uint8Array;
+  /** The incoming Web API request (body already consumed by the router) */
+  request: Request;
+}
+/**
+ * Handler context extending the shared webhook context with the validated payload.
+ *
+ * @template TPayload - Validated payload type for the matched route.
+ */
+interface HandlerContext<TPayload = unknown> extends WebhookContext {
+  /** The validated webhook payload */
+  payload: TPayload;
+}
+/** Route registration options for a webhook handler. */
+interface RegisterOptions<T> {
+  /** Hooks that run after successful processing (before global after hooks) */
+  after?: AfterHook | AfterHook[];
+  /** Hooks that run before request processing (after global before hooks) */
+  before?: BeforeHook | BeforeHook[];
+  /** The handler function to process the webhook */
+  handler: WebhookHandler<T>;
+  /** Optional Standard Schema validator to validate the webhook payload */
+  schema?: StandardSchemaV1<unknown, T>;
+}
+/**
+ * Infers the output type from a Standard Schema instance.
+ *
+ * @template TSchema - A Standard Schema type.
+ */
+type InferSchemaOutput<TSchema> = TSchema extends StandardSchemaV1<unknown, infer TOutput> ? TOutput : never;
+/**
+ * Route options where schema is required and handler payload is inferred.
+ *
+ * @template TSchema - Schema used to infer handler payload type.
+ */
+type SchemaRouteOptions<TSchema extends StandardSchemaV1<unknown, unknown>> = Omit<RegisterOptions<InferSchemaOutput<TSchema>>, "schema"> & {
+  schema: TSchema;
+};
+interface RouteLike {
+  after?: AfterHook | AfterHook[];
+  before?: BeforeHook | BeforeHook[];
+  handler: WebhookHandler;
+  schema: StandardSchemaV1<unknown, unknown>;
+}
+/**
+ * Applies schema-driven payload inference to each route entry.
+ *
+ * @template TRoutes - Route dictionary keyed by webhook path.
+ */
+type SchemaRoutes<TRoutes extends Record<string, RouteLike>> = { [P in keyof TRoutes]: SchemaRouteOptions<TRoutes[P]["schema"]>; };
+/**
+ * The webhook handler function, responsible for processing incoming webhook events.
+ *
+ * Return a `Response` to control the reply, or `undefined` to let the router
+ * respond with its default `200` acknowledgement.
+ */
+type WebhookHandler<TPayload = unknown> = (ctx: HandlerContext<TPayload>) => Promise<Response | undefined> | Response | undefined;
+/** Maps route keys to their payload-specific webhook handlers. */
+type HandlerMap<TMap extends Record<string, unknown>> = { [P in keyof TMap]: WebhookHandler<TMap[P]>; };
+/**
+ * Builds a webhook payload map from a schema-based route dictionary.
+ *
+ * @template TRoutes - Route dictionary keyed by webhook path.
+ */
+type InferWebhookMapFromRoutes<TRoutes extends Record<string, RouteLike>> = { [P in keyof TRoutes]: InferSchemaOutput<TRoutes[P]["schema"]>; };
+/** Verification function for incoming requests. Throws to reject the request. */
+type VerifyFn = (ctx: WebhookContext) => Promise<void> | void;
+/** Hook function that runs before request processing */
+type BeforeHook = (ctx: WebhookContext) => Promise<void> | void;
+/**
+ * Hook function that runs after successful request processing.
+ *
+ * The hook receives the outgoing response as-is; call `response.clone()`
+ * before reading its body to avoid consuming the stream sent to the client.
+ */
+type AfterHook = (ctx: WebhookContext, response: Response) => Promise<void> | void;
+/** Hook function that runs when an error occurs */
+type ErrorHook = (error: Error, ctx: WebhookContext) => Promise<Response | undefined> | Response | undefined;
+//#endregion
+export { AfterHook, BeforeHook, ErrorHook, HandlerContext, HandlerMap, InferSchemaOutput, InferWebhookMapFromRoutes, RegisterOptions, SchemaRouteOptions, SchemaRoutes, VerifyFn, WebhookContext, WebhookHandler };
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","names":[],"sources":["../src/types.ts"],"mappings":";;;;;;;;UAciB;;EAEf;;EAEA,SAAS;;EAET,SAAS;;;;;;;UAQM,eAAe,4BAA4B;;EAE1D,SAAS;;;UAIM,gBAAgB;;EAE/B,QAAQ,YAAY;;EAEpB,SAAS,aAAa;;EAEtB,SAAS,eAAe;;EAExB,SAAS,0BAA0B;;;;;;;KAQzB,kBAAkB,WAC5B,gBAAgB,gCAAgC,WAAW;;;;;;KAOjD,mBACV,gBAAgB,sCACd,KAAK,gBAAgB,kBAAkB;EACzC,QAAQ;;UAGA;EACR,QAAQ,YAAY;EACpB,SAAS,aAAa;EACtB,SAAS;EACT,QAAQ;;;;;;;KAQE,aAAa,gBAAgB,eAAe,iBACrD,WAAW,UAAU,mBAAmB,QAAQ;;;;;;;KASvC,eAAe,uBACzB,KAAK,eAAe,cACjB,QAAQ,wBAAwB;;KAGzB,WAAW,aAAa,8BACjC,WAAW,OAAO,eAAe,KAAK;;;;;;KAQ7B,0BACV,gBAAgB,eAAe,iBAE9B,WAAW,UAAU,kBAAkB,QAAQ;;KAItC,YAAY,KAAK,mBAAmB;;KAGpC,cAAc,KAAK,mBAAmB;;;;;;;KAQtC,aACV,KAAK,gBACL,UAAU,aACP;;KAGO,aACV,OAAO,OACP,KAAK,mBACF,QAAQ,wBAAwB"}

package/dist/utils.d.ts

@@ -0,0 +1,18 @@
+//#region src/utils.d.ts
+/**
+ * Utility helpers for webhook internals.
+ *
+ * @module @zap-studio/webhooks/utils
+ */
+/**
+ * Compares two strings in constant time to prevent timing attacks.
+ *
+ * @example
+ * ```ts
+ * const isEqual = constantTimeEquals("string1", "string2"); // returns false
+ * ```
+ */
+declare const constantTimeEquals: (a: string, b: string) => boolean;
+//#endregion
+export { constantTimeEquals };
+//# sourceMappingURL=utils.d.ts.map

package/dist/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","names":[],"sources":["../src/utils.ts"],"mappings":";;;;;;;;;;;;;;cAca,qBAAsB,WAAW"}

package/dist/{utils/index.mjs → utils.js}

@@ -1,4 +1,9 @@
-//#region src/utils/index.ts
+//#region src/utils.ts
+/**
+* Utility helpers for webhook internals.
+*
+* @module @zap-studio/webhooks/utils
+*/
 /**
 * Compares two strings in constant time to prevent timing attacks.
 *
@@ -7,13 +12,13 @@
 * const isEqual = constantTimeEquals("string1", "string2"); // returns false
 * ```
 */
-function constantTimeEquals(a, b) {
+const constantTimeEquals = (a, b) => {
 	if (a.length !== b.length) return false;
 	let result = 0;
 	for (let i = 0; i < a.length; i += 1) result |= a.charCodeAt(i) ^ b.charCodeAt(i);
 	return result === 0;
-}
+};
 //#endregion
 export { constantTimeEquals };
 
-//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=utils.js.map

package/dist/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","names":[],"sources":["../src/utils.ts"],"sourcesContent":["/**\n * Utility helpers for webhook internals.\n *\n * @module @zap-studio/webhooks/utils\n */\n\n/**\n * Compares two strings in constant time to prevent timing attacks.\n *\n * @example\n * ```ts\n * const isEqual = constantTimeEquals(\"string1\", \"string2\"); // returns false\n * ```\n */\nexport const constantTimeEquals = (a: string, b: string): boolean => {\n  if (a.length !== b.length) {\n    return false;\n  }\n\n  let result = 0;\n  for (let i = 0; i < a.length; i += 1) {\n    // oxlint-disable-next-line no-bitwise, unicorn/prefer-code-point -- XOR is the constant-time compare trick; charCodeAt reads each char with the same cost, and inputs are plain ASCII hex.\n    result |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n\n  return result === 0;\n};\n"],"mappings":";;;;;;;;;;;;;;AAcA,MAAa,sBAAsB,GAAW,MAAuB;CACnE,IAAI,EAAE,WAAW,EAAE,QACjB,OAAO;CAGT,IAAI,SAAS;CACb,KAAK,IAAI,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK,GAEjC,UAAU,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;CAG5C,OAAO,WAAW;AACpB"}

package/dist/verify.d.ts

@@ -0,0 +1,49 @@
+import { VerifyFn } from "./types.js";
+//#region src/verify.d.ts
+declare const HMAC_HASH: {
+  readonly sha1: "SHA-1";
+  readonly sha256: "SHA-256";
+  readonly sha384: "SHA-384";
+  readonly sha512: "SHA-512";
+};
+type HmacAlgorithm = keyof typeof HMAC_HASH;
+/**
+ * Creates a webhook verifier that validates an HMAC signature from a request header.
+ *
+ * The verifier imports the provided string secret once, computes an HMAC from
+ * `ctx.rawBody`, normalizes the incoming header value, and compares both
+ * signatures in constant time.
+ *
+ * Header values like `sha256=<hex>` are supported so common provider formats
+ * such as GitHub work without extra parsing.
+ *
+ * @example
+ * ```ts
+ * import { createWebhookRouter } from "@zap-studio/webhooks";
+ * import { createHmacVerifier } from "@zap-studio/webhooks/verify";
+ *
+ * const router = createWebhookRouter({
+ *   verify: createHmacVerifier({
+ *     headerName: "x-hub-signature-256",
+ *     secret: process.env.GITHUB_WEBHOOK_SECRET!,
+ *   }),
+ * });
+ * ```
+ *
+ * @param options - Verifier configuration.
+ * @param options.headerName - Header containing the provider signature.
+ * @param options.secret - Shared HMAC secret as a string.
+ * @param options.algo - HMAC hash algorithm. Defaults to `"sha256"`.
+ * @returns A router-compatible request verifier.
+ *
+ * @throws {VerificationError}
+ * Thrown when verifier setup fails or request verification does not pass.
+ */
+declare const createHmacVerifier: ({ headerName, secret, algo }: {
+  headerName: string;
+  secret: string;
+  algo?: HmacAlgorithm;
+}) => VerifyFn;
+//#endregion
+export { createHmacVerifier };
+//# sourceMappingURL=verify.d.ts.map

package/dist/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","names":[],"sources":["../src/verify.ts"],"mappings":";;cAUM;WACJ;WACA;WACA;WACA;;KAGG,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA2CrB,uBACX,YACA,QACA;EAEA;EACA;EACA,OAAO;MACL"}

package/dist/{verify.mjs → verify.js}

@@ -1,17 +1,24 @@
-import { VerificationError } from "./errors.mjs";
-import { constantTimeEquals } from "./utils/index.mjs";
+import { VerificationError } from "./errors.js";
+import { constantTimeEquals } from "./utils.js";
 //#region src/verify.ts
+/**
+* Signature verification helpers for webhook requests.
+*
+* @module @zap-studio/webhooks/verify
+*/
 const HMAC_HASH = {
 	sha1: "SHA-1",
 	sha256: "SHA-256",
 	sha384: "SHA-384",
 	sha512: "SHA-512"
 };
+const toHex = (bytes) => Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+const normalizeSignature = (signature) => signature.replace(/^[a-z0-9-]+=/iu, "").trim().toLowerCase();
 /**
 * Creates a webhook verifier that validates an HMAC signature from a request header.
 *
 * The verifier imports the provided string secret once, computes an HMAC from
-* `req.rawBody`, normalizes the incoming header value, and compares both
+* `ctx.rawBody`, normalizes the incoming header value, and compares both
 * signatures in constant time.
 *
 * Header values like `sha256=<hex>` are supported so common provider formats
@@ -39,30 +46,25 @@ const HMAC_HASH = {
 * @throws {VerificationError}
 * Thrown when verifier setup fails or request verification does not pass.
 */
-function createHmacVerifier({ headerName, secret, algo = "sha256" }) {
-	const subtle = globalThis.crypto?.subtle;
-	if (!subtle) throw new VerificationError("Web Crypto API is unavailable in this runtime");
+const createHmacVerifier = ({ headerName, secret, algo = "sha256" }) => {
+	if (globalThis.crypto?.subtle === void 0) throw new VerificationError("Web Crypto API is unavailable in this runtime");
+	const { subtle } = globalThis.crypto;
 	const hash = HMAC_HASH[algo];
 	if (!hash) throw new VerificationError(`Unsupported HMAC algorithm: ${algo}`);
 	const keyPromise = subtle.importKey("raw", new TextEncoder().encode(secret), {
-		name: "HMAC",
-		hash
+		hash,
+		name: "HMAC"
 	}, false, ["sign"]);
-	return async (req) => {
-		const actual = req.headers.get(headerName);
-		if (!actual) throw new VerificationError(`Missing signature header: ${headerName}`);
+	return async (ctx) => {
+		const actual = ctx.request.headers.get(headerName);
+		if (actual === null || actual.length === 0) throw new VerificationError(`Missing signature header: ${headerName}`);
 		const key = await keyPromise;
-		const signature = await subtle.sign("HMAC", key, req.rawBody);
-		if (!constantTimeEquals(toHex(new Uint8Array(signature)), normalizeSignature(actual))) throw new VerificationError(`Invalid signature for header: ${headerName}`);
+		const signature = await subtle.sign("HMAC", key, new Uint8Array(ctx.rawBody));
+		const expected = toHex(new Uint8Array(signature));
+		if (!constantTimeEquals(expected, normalizeSignature(actual))) throw new VerificationError(`Invalid signature for header: ${headerName}`);
 	};
-}
-function toHex(bytes) {
-	return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
-}
-function normalizeSignature(signature) {
-	return signature.replace(/^[a-z0-9-]+=/i, "").trim().toLowerCase();
-}
+};
 //#endregion
 export { createHmacVerifier };
 
-//# sourceMappingURL=verify.mjs.map
+//# sourceMappingURL=verify.js.map

package/dist/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","names":[],"sources":["../src/verify.ts"],"sourcesContent":["/**\n * Signature verification helpers for webhook requests.\n *\n * @module @zap-studio/webhooks/verify\n */\n\nimport { VerificationError } from \"./errors.js\";\nimport type { VerifyFn } from \"./types.js\";\nimport { constantTimeEquals } from \"./utils.js\";\n\nconst HMAC_HASH = {\n  sha1: \"SHA-1\",\n  sha256: \"SHA-256\",\n  sha384: \"SHA-384\",\n  sha512: \"SHA-512\",\n} as const;\n\ntype HmacAlgorithm = keyof typeof HMAC_HASH;\n\nconst toHex = (bytes: Uint8Array): string =>\n  Array.from(bytes, (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n\nconst normalizeSignature = (signature: string): string =>\n  signature\n    .replace(/^[a-z0-9-]+=/iu, \"\")\n    .trim()\n    .toLowerCase();\n\n/**\n * Creates a webhook verifier that validates an HMAC signature from a request header.\n *\n * The verifier imports the provided string secret once, computes an HMAC from\n * `ctx.rawBody`, normalizes the incoming header value, and compares both\n * signatures in constant time.\n *\n * Header values like `sha256=<hex>` are supported so common provider formats\n * such as GitHub work without extra parsing.\n *\n * @example\n * ```ts\n * import { createWebhookRouter } from \"@zap-studio/webhooks\";\n * import { createHmacVerifier } from \"@zap-studio/webhooks/verify\";\n *\n * const router = createWebhookRouter({\n *   verify: createHmacVerifier({\n *     headerName: \"x-hub-signature-256\",\n *     secret: process.env.GITHUB_WEBHOOK_SECRET!,\n *   }),\n * });\n * ```\n *\n * @param options - Verifier configuration.\n * @param options.headerName - Header containing the provider signature.\n * @param options.secret - Shared HMAC secret as a string.\n * @param options.algo - HMAC hash algorithm. Defaults to `\"sha256\"`.\n * @returns A router-compatible request verifier.\n *\n * @throws {VerificationError}\n * Thrown when verifier setup fails or request verification does not pass.\n */\nexport const createHmacVerifier = ({\n  headerName,\n  secret,\n  algo = \"sha256\",\n}: {\n  headerName: string;\n  secret: string;\n  algo?: HmacAlgorithm;\n}): VerifyFn => {\n  if (globalThis.crypto?.subtle === undefined) {\n    throw new VerificationError(\n      \"Web Crypto API is unavailable in this runtime\"\n    );\n  }\n\n  const { subtle } = globalThis.crypto;\n\n  const hash = HMAC_HASH[algo];\n  if (!hash) {\n    throw new VerificationError(`Unsupported HMAC algorithm: ${algo}`);\n  }\n\n  const keyPromise = subtle.importKey(\n    \"raw\",\n    new TextEncoder().encode(secret),\n    { hash, name: \"HMAC\" },\n    false,\n    [\"sign\"]\n  );\n\n  return async (ctx) => {\n    const actual = ctx.request.headers.get(headerName);\n    if (actual === null || actual.length === 0) {\n      throw new VerificationError(`Missing signature header: ${headerName}`);\n    }\n\n    const key = await keyPromise;\n    const signature = await subtle.sign(\n      \"HMAC\",\n      key,\n      new Uint8Array(ctx.rawBody)\n    );\n    const expected = toHex(new Uint8Array(signature));\n\n    if (!constantTimeEquals(expected, normalizeSignature(actual))) {\n      throw new VerificationError(\n        `Invalid signature for header: ${headerName}`\n      );\n    }\n  };\n};\n"],"mappings":";;;;;;;;AAUA,MAAM,YAAY;CAChB,MAAM;CACN,QAAQ;CACR,QAAQ;CACR,QAAQ;AACV;AAIA,MAAM,SAAS,UACb,MAAM,KAAK,QAAQ,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AAEzE,MAAM,sBAAsB,cAC1B,UACG,QAAQ,kBAAkB,EAAE,CAAC,CAC7B,KAAK,CAAC,CACN,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCjB,MAAa,sBAAsB,EACjC,YACA,QACA,OAAO,eAKO;CACd,IAAI,WAAW,QAAQ,WAAW,KAAA,GAChC,MAAM,IAAI,kBACR,+CACF;CAGF,MAAM,EAAE,WAAW,WAAW;CAE9B,MAAM,OAAO,UAAU;CACvB,IAAI,CAAC,MACH,MAAM,IAAI,kBAAkB,+BAA+B,MAAM;CAGnE,MAAM,aAAa,OAAO,UACxB,OACA,IAAI,YAAY,CAAC,CAAC,OAAO,MAAM,GAC/B;EAAE;EAAM,MAAM;CAAO,GACrB,OACA,CAAC,MAAM,CACT;CAEA,OAAO,OAAO,QAAQ;EACpB,MAAM,SAAS,IAAI,QAAQ,QAAQ,IAAI,UAAU;EACjD,IAAI,WAAW,QAAQ,OAAO,WAAW,GACvC,MAAM,IAAI,kBAAkB,6BAA6B,YAAY;EAGvE,MAAM,MAAM,MAAM;EAClB,MAAM,YAAY,MAAM,OAAO,KAC7B,QACA,KACA,IAAI,WAAW,IAAI,OAAO,CAC5B;EACA,MAAM,WAAW,MAAM,IAAI,WAAW,SAAS,CAAC;EAEhD,IAAI,CAAC,mBAAmB,UAAU,mBAAmB,MAAM,CAAC,GAC1D,MAAM,IAAI,kBACR,iCAAiC,YACnC;CAEJ;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zap-studio/webhooks",
-  "version": "0.2.2",
+  "version": "0.4.0",
   "private": false,
   "description": "A lightweight, type-safe webhook router with Standard Schema validation, signature verification, and lifecycle hooks.",
   "keywords": [
@@ -33,34 +33,30 @@
   ],
   "type": "module",
   "sideEffects": false,
-  "types": "./dist/index.d.mts",
+  "types": "./dist/index.d.ts",
   "exports": {
-    ".": "./dist/index.mjs",
-    "./adapters/base": "./dist/adapters/base.mjs",
-    "./errors": "./dist/errors.mjs",
-    "./types": "./dist/types/index.mjs",
-    "./utils": "./dist/utils/index.mjs",
-    "./verify": "./dist/verify.mjs",
+    ".": "./dist/index.js",
+    "./errors": "./dist/errors.js",
+    "./router": "./dist/router.js",
+    "./types": "./dist/types.js",
+    "./utils": "./dist/utils.js",
+    "./verify": "./dist/verify.js",
     "./package.json": "./package.json"
   },
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
-    "@zap-studio/validation": "0.3.4"
+    "@zap-studio/validation": "workspace:*"
   },
   "devDependencies": {
-    "typescript": "^6.0.3",
-    "vite-plus": "^0.1.19",
-    "zod": "^4.3.6",
-    "@zap-studio/typescript": "0.0.0"
+    "@zap-studio/typescript": "workspace:*",
+    "tsdown": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:",
+    "zod": "catalog:"
   },
   "engines": {
     "node": ">=18.0.0"
-  },
-  "scripts": {
-    "build": "vp pack",
-    "test": "vp test run",
-    "test:watch": "vp test watch"
   }
-}
+}

package/dist/adapters/base.d.mts

@@ -1,58 +0,0 @@
-import { NormalizedRequest, NormalizedResponse } from "../types/index.mjs";
-
-//#region src/adapters/base.d.ts
-/**
-* Minimal framework adapter contract.
-*
-* Implement this when integrating the webhook router with an HTTP framework.
-*/
-interface Adapter {
-  /**
-  * Creates a framework handler that:
-  * 1. normalizes the incoming framework request
-  * 2. executes the webhook router
-  * 3. writes the normalized response back to the framework response
-  */
-  handleWebhook<TFrameworkReq = unknown, TFrameworkRes = unknown>(router: {
-    handle(req: NormalizedRequest): Promise<NormalizedResponse>;
-  }): (req: TFrameworkReq, res: TFrameworkRes) => Promise<void>;
-  /**
-  * Maps a normalized router response to the framework response object.
-  *
-  * @param frameworkRes - Framework-specific response object (e.g. `res`)
-  * @param res - Normalized response returned by the webhook router
-  */
-  toFrameworkResponse<TFrameworkRes = unknown>(frameworkRes: TFrameworkRes, res: NormalizedResponse): Promise<TFrameworkRes>;
-  /**
-  * Maps a framework request into the normalized request contract.
-  *
-  * The returned object must include `rawBody` to support signature verification.
-  *
-  * @param req - Framework-specific request object
-  */
-  toNormalizedRequest<TReq = unknown>(req: TReq): Promise<NormalizedRequest>;
-}
-/**
-* Base adapter helper.
-*
-* Extend this class in consumers to keep framework integration boilerplate
-* in one place while relying on the package router contract.
-*/
-declare abstract class BaseAdapter implements Adapter {
-  /** @inheritdoc */
-  abstract toNormalizedRequest<TReq = unknown>(req: TReq): Promise<NormalizedRequest>;
-  /** @inheritdoc */
-  abstract toFrameworkResponse<TFrameworkRes = unknown>(frameworkRes: TFrameworkRes, res: NormalizedResponse): Promise<TFrameworkRes>;
-  /**
-  * Shared adapter pipeline implementation.
-  *
-  * Most consumers only need to implement request/response mapping methods and
-  * can reuse this default orchestration.
-  */
-  handleWebhook<TFrameworkReq = unknown, TFrameworkRes = unknown>(router: {
-    handle(req: NormalizedRequest): Promise<NormalizedResponse>;
-  }): (req: TFrameworkReq, res: TFrameworkRes) => Promise<void>;
-}
-//#endregion
-export { Adapter, BaseAdapter };
-//# sourceMappingURL=base.d.mts.map

package/dist/adapters/base.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"base.d.mts","names":[],"sources":["../../src/adapters/base.ts"],"mappings":";;;;;AAOA;;;UAAiB,OAAA;;;;;;;EAOf,aAAA,mDAAgE,MAAA;IAC9D,MAAA,CAAO,GAAA,EAAK,iBAAA,GAAoB,OAAA,CAAQ,kBAAA;EAAA,KACrC,GAAA,EAAK,aAAA,EAAe,GAAA,EAAK,aAAA,KAAkB,OAAA;;;;;;;EAQhD,mBAAA,0BACE,YAAA,EAAc,aAAA,EACd,GAAA,EAAK,kBAAA,GACJ,OAAA,CAAQ,aAAA;;;;;;;;EASX,mBAAA,iBAAoC,GAAA,EAAK,IAAA,GAAO,OAAA,CAAQ,iBAAA;AAAA;;;;;;;uBASpC,WAAA,YAAuB,OAAA;;WAElC,mBAAA,gBAAA,CAAoC,GAAA,EAAK,IAAA,GAAO,OAAA,CAAQ,iBAAA;;WAExD,mBAAA,yBAAA,CACP,YAAA,EAAc,aAAA,EACd,GAAA,EAAK,kBAAA,GACJ,OAAA,CAAQ,aAAA;;;;;;AAPb;EAeE,aAAA,kDAAA,CAAgE,MAAA;IAC9D,MAAA,CAAO,GAAA,EAAK,iBAAA,GAAoB,OAAA,CAAQ,kBAAA;EAAA,KACrC,GAAA,EAAK,aAAA,EAAe,GAAA,EAAK,aAAA,KAAkB,OAAA;AAAA"}

package/dist/adapters/base.mjs

@@ -1,26 +0,0 @@
-//#region src/adapters/base.ts
-/**
-* Base adapter helper.
-*
-* Extend this class in consumers to keep framework integration boilerplate
-* in one place while relying on the package router contract.
-*/
-var BaseAdapter = class {
-	/**
-	* Shared adapter pipeline implementation.
-	*
-	* Most consumers only need to implement request/response mapping methods and
-	* can reuse this default orchestration.
-	*/
-	handleWebhook(router) {
-		return async (req, res) => {
-			const normalizedReq = await this.toNormalizedRequest(req);
-			const normalizedRes = await router.handle(normalizedReq);
-			await this.toFrameworkResponse(res, normalizedRes);
-		};
-	}
-};
-//#endregion
-export { BaseAdapter };
-
-//# sourceMappingURL=base.mjs.map

package/dist/adapters/base.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"base.mjs","names":[],"sources":["../../src/adapters/base.ts"],"sourcesContent":["import type { NormalizedRequest, NormalizedResponse } from \"../types/index.js\";\n\n/**\n * Minimal framework adapter contract.\n *\n * Implement this when integrating the webhook router with an HTTP framework.\n */\nexport interface Adapter {\n  /**\n   * Creates a framework handler that:\n   * 1. normalizes the incoming framework request\n   * 2. executes the webhook router\n   * 3. writes the normalized response back to the framework response\n   */\n  handleWebhook<TFrameworkReq = unknown, TFrameworkRes = unknown>(router: {\n    handle(req: NormalizedRequest): Promise<NormalizedResponse>;\n  }): (req: TFrameworkReq, res: TFrameworkRes) => Promise<void>;\n\n  /**\n   * Maps a normalized router response to the framework response object.\n   *\n   * @param frameworkRes - Framework-specific response object (e.g. `res`)\n   * @param res - Normalized response returned by the webhook router\n   */\n  toFrameworkResponse<TFrameworkRes = unknown>(\n    frameworkRes: TFrameworkRes,\n    res: NormalizedResponse,\n  ): Promise<TFrameworkRes>;\n\n  /**\n   * Maps a framework request into the normalized request contract.\n   *\n   * The returned object must include `rawBody` to support signature verification.\n   *\n   * @param req - Framework-specific request object\n   */\n  toNormalizedRequest<TReq = unknown>(req: TReq): Promise<NormalizedRequest>;\n}\n\n/**\n * Base adapter helper.\n *\n * Extend this class in consumers to keep framework integration boilerplate\n * in one place while relying on the package router contract.\n */\nexport abstract class BaseAdapter implements Adapter {\n  /** @inheritdoc */\n  abstract toNormalizedRequest<TReq = unknown>(req: TReq): Promise<NormalizedRequest>;\n  /** @inheritdoc */\n  abstract toFrameworkResponse<TFrameworkRes = unknown>(\n    frameworkRes: TFrameworkRes,\n    res: NormalizedResponse,\n  ): Promise<TFrameworkRes>;\n\n  /**\n   * Shared adapter pipeline implementation.\n   *\n   * Most consumers only need to implement request/response mapping methods and\n   * can reuse this default orchestration.\n   */\n  handleWebhook<TFrameworkReq = unknown, TFrameworkRes = unknown>(router: {\n    handle(req: NormalizedRequest): Promise<NormalizedResponse>;\n  }): (req: TFrameworkReq, res: TFrameworkRes) => Promise<void> {\n    return async (req, res) => {\n      const normalizedReq = await this.toNormalizedRequest(req);\n      const normalizedRes = await router.handle(normalizedReq);\n      await this.toFrameworkResponse(res, normalizedRes);\n    };\n  }\n}\n"],"mappings":";;;;;;;AA6CA,IAAsB,cAAtB,MAAqD;;;;;;;CAenD,cAAgE,QAEF;AAC5D,SAAO,OAAO,KAAK,QAAQ;GACzB,MAAM,gBAAgB,MAAM,KAAK,oBAAoB,IAAI;GACzD,MAAM,gBAAgB,MAAM,OAAO,OAAO,cAAc;AACxD,SAAM,KAAK,oBAAoB,KAAK,cAAc"}

package/dist/errors.d.mts

@@ -1,13 +0,0 @@
-//#region src/errors.d.ts
-/**
-* Error thrown when webhook request verification fails.
-*
-* This error is used by verifier helpers such as `createHmacVerifier` so
-* callers can distinguish verification failures from other webhook errors.
-*/
-declare class VerificationError extends Error {
-  constructor(message: string);
-}
-//#endregion
-export { VerificationError };
-//# sourceMappingURL=errors.d.mts.map

package/dist/errors.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.d.mts","names":[],"sources":["../src/errors.ts"],"mappings":";;AAMA;;;;;cAAa,iBAAA,SAA0B,KAAA;EACrC,WAAA,CAAY,OAAA;AAAA"}

package/dist/errors.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.mjs","names":[],"sources":["../src/errors.ts"],"sourcesContent":["/**\n * Error thrown when webhook request verification fails.\n *\n * This error is used by verifier helpers such as `createHmacVerifier` so\n * callers can distinguish verification failures from other webhook errors.\n */\nexport class VerificationError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"VerificationError\";\n  }\n}\n"],"mappings":";;;;;;;AAMA,IAAa,oBAAb,cAAuC,MAAM;CAC3C,YAAY,SAAiB;AAC3B,QAAM,QAAQ;AACd,OAAK,OAAO"}

package/dist/index.d.mts

@@ -1,70 +0,0 @@
-import { AfterHook, BeforeHook, ErrorHook, InferSchemaOutput, NormalizedRequest, NormalizedResponse, RegisterOptions, SchemaRouteOptions, WebhookHandler } from "./types/index.mjs";
-import { StandardSchemaV1 } from "@zap-studio/validation";
-
-//#region src/index.d.ts
-interface WebhookRouterOptions {
-  /** Global hooks executed after successful route handler completion. */
-  after?: AfterHook | AfterHook[];
-  /** Global hooks executed before route-level hooks and verification. */
-  before?: BeforeHook | BeforeHook[];
-  /** Global error hook used to override the default `500` response. */
-  onError?: ErrorHook;
-  /** Required path prefix for all webhook routes. Defaults to `"/webhooks/"`. */
-  prefix?: string;
-  /** Optional request verification function (for signature checks, auth, etc.). */
-  verify?: (req: NormalizedRequest) => Promise<void> | void;
-}
-/**
-* Main webhook router class.
-*
-* Register routes with typed schemas and call `handle` with a normalized request.
-*/
-declare class WebhookRouter<TMap = unknown> {
-  private readonly handlers;
-  private readonly verify;
-  private readonly globalBeforeHooks;
-  private readonly globalAfterHooks;
-  private readonly globalErrorHook;
-  private readonly prefix;
-  constructor(opts?: WebhookRouterOptions);
-  /**
-  * Register a webhook handler for a specific path.
-  *
-  * When a schema is provided, `payload` is inferred from the schema output type.
-  *
-  * @param path - Route path relative to configured prefix.
-  * @param handlerOrOptions - Handler function or schema-based registration options.
-  * @returns The same router instance with an updated internal route type map.
-  */
-  register<Path extends string, TSchema extends StandardSchemaV1<unknown, unknown>>(path: Path, handlerOrOptions: SchemaRouteOptions<TSchema>): WebhookRouter<TMap & Record<Path, InferSchemaOutput<TSchema>>>;
-  register<Path extends string, TPayload>(path: Path, handlerOrOptions: RegisterOptions<TPayload>): WebhookRouter<TMap & Record<Path, TPayload>>;
-  register<Path extends string>(path: Path, handlerOrOptions: WebhookHandler<unknown>): WebhookRouter<TMap & Record<Path, unknown>>;
-  /**
-  * Handles a normalized incoming webhook request.
-  *
-  * @param req - Normalized request object.
-  * @returns Normalized response for the adapter/framework layer.
-  */
-  handle(req: NormalizedRequest): Promise<NormalizedResponse>;
-  private normalizePath;
-  private runGlobalBeforeHooks;
-  private createHandlerEntry;
-  private runRouteBeforeHooks;
-  private parseRequestBody;
-  private isErrorResponse;
-  private validatePayload;
-  private executeHandler;
-  private runRouteAfterHooks;
-  private runGlobalAfterHooks;
-  private handleError;
-}
-/**
-* Factory helper for creating a webhook router instance.
-*
-* @param opts - Optional global router options.
-* @returns A new webhook router.
-*/
-declare function createWebhookRouter(opts?: WebhookRouterOptions): WebhookRouter;
-//#endregion
-export { WebhookRouter, WebhookRouterOptions, createWebhookRouter };
-//# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/index.ts"],"mappings":";;;;UA6BiB,oBAAA;;EAEf,KAAA,GAAQ,SAAA,GAAY,SAAA;EAFL;EAIf,MAAA,GAAS,UAAA,GAAa,UAAA;;EAEtB,OAAA,GAAU,SAAA;;EAEV,MAAA;;EAEA,MAAA,IAAU,GAAA,EAAK,iBAAA,KAAsB,OAAA;AAAA;;;;;;cAgB1B,aAAA;EAAA,iBACM,QAAA;EAAA,iBACA,MAAA;EAAA,iBACA,iBAAA;EAAA,iBACA,gBAAA;EAAA,iBACA,eAAA;EAAA,iBACA,MAAA;EAEjB,WAAA,CAAY,IAAA,GAAM,oBAAA;;;;;AARpB;;;;;EAyBE,QAAA,sCAA8C,gBAAA,mBAAA,CAC5C,IAAA,EAAM,IAAA,EACN,gBAAA,EAAkB,kBAAA,CAAmB,OAAA,IACpC,aAAA,CAAc,IAAA,GAAO,MAAA,CAAO,IAAA,EAAM,iBAAA,CAAkB,OAAA;EACvD,QAAA,+BAAA,CACE,IAAA,EAAM,IAAA,EACN,gBAAA,EAAkB,eAAA,CAAgB,QAAA,IACjC,aAAA,CAAc,IAAA,GAAO,MAAA,CAAO,IAAA,EAAM,QAAA;EACrC,QAAA,qBAAA,CACE,IAAA,EAAM,IAAA,EACN,gBAAA,EAAkB,cAAA,YACjB,aAAA,CAAc,IAAA,GAAO,MAAA,CAAO,IAAA;;;;;;;EAoB/B,MAAA,CAAa,GAAA,EAAK,iBAAA,GAAoB,OAAA,CAAQ,kBAAA;EAAA,QAsCtC,aAAA;EAAA,QA0BM,oBAAA;EAAA,QAMN,kBAAA;EAAA,QAoBM,mBAAA;EAAA,QAQN,gBAAA;EAAA,QAUA,eAAA;EAAA,QASM,eAAA;EAAA,QA8BA,cAAA;EAAA,QAyBA,kBAAA;EAAA,QAYA,mBAAA;EAAA,QASA,WAAA;AAAA;;;;;;;iBA0BA,mBAAA,CAAoB,IAAA,GAAO,oBAAA,GAAuB,aAAA"}