@zap-studio/webhooks 0.3.0 → 0.4.0

package/dist/{types/index.d.mts → types.d.ts}

@@ -1,32 +1,27 @@
 import { StandardSchemaV1 } from "@zap-studio/validation";
-//#region src/types/index.d.ts
-/** Framework-agnostic request shape consumed by the webhook router. */
-interface NormalizedRequest {
-  /** The headers of the request (e.g. { "Authorization": "Bearer token" }) */
-  headers: Headers;
-  /** The parsed JSON body of the request if applicable */
-  json?: unknown;
-  /** The HTTP method of the request */
-  method: Request["method"];
-  /** The route parameters of the request */
-  params?: Record<string, string>;
-  /** The path of the request you registered in the router (e.g. "payment", "subscription") */
+//#region src/types.d.ts
+/**
+ * Context shared by hooks, verifiers, and handlers for a single webhook request.
+ *
+ * The router consumes the request body exactly once, so `request.body` is
+ * already used by the time hooks or handlers run — read `rawBody` instead.
+ */
+interface WebhookContext {
+  /** The matched route key registered on the router (e.g. "stripe") */
   path: string;
-  /** The query parameters of the request */
-  query?: Record<string, string | string[]>;
-  /** The raw body of the request (for signature) */
+  /** The exact request body bytes (for signature verification) */
   rawBody: Uint8Array;
-  /** The parsed text body of the request if applicable */
-  text?: string;
+  /** The incoming Web API request (body already consumed by the router) */
+  request: Request;
 }
-/** Framework-agnostic response shape returned by the webhook router. */
-interface NormalizedResponse<TBody = unknown> {
-  /** The body of the response */
-  body?: TBody;
-  /** The headers of the response */
-  headers?: Headers;
-  /** The HTTP status code of the response */
-  status: number;
+/**
+ * Handler context extending the shared webhook context with the validated payload.
+ *
+ * @template TPayload - Validated payload type for the matched route.
+ */
+interface HandlerContext<TPayload = unknown> extends WebhookContext {
+  /** The validated webhook payload */
+  payload: TPayload;
 }
 /** Route registration options for a webhook handler. */
 interface RegisterOptions<T> {
@@ -65,12 +60,13 @@ interface RouteLike {
  * @template TRoutes - Route dictionary keyed by webhook path.
  */
 type SchemaRoutes<TRoutes extends Record<string, RouteLike>> = { [P in keyof TRoutes]: SchemaRouteOptions<TRoutes[P]["schema"]>; };
-/** The webhook handler function, responsible for processing incoming webhook events. */
-type WebhookHandler<TPayload = unknown> = (ctx: {
-  req: NormalizedRequest;
-  payload: TPayload;
-  ack: (res?: Partial<NormalizedResponse>) => Promise<NormalizedResponse>;
-}) => Promise<NormalizedResponse | undefined> | NormalizedResponse | undefined;
+/**
+ * The webhook handler function, responsible for processing incoming webhook events.
+ *
+ * Return a `Response` to control the reply, or `undefined` to let the router
+ * respond with its default `200` acknowledgement.
+ */
+type WebhookHandler<TPayload = unknown> = (ctx: HandlerContext<TPayload>) => Promise<Response | undefined> | Response | undefined;
 /** Maps route keys to their payload-specific webhook handlers. */
 type HandlerMap<TMap extends Record<string, unknown>> = { [P in keyof TMap]: WebhookHandler<TMap[P]>; };
 /**
@@ -79,14 +75,19 @@ type HandlerMap<TMap extends Record<string, unknown>> = { [P in keyof TMap]: Web
  * @template TRoutes - Route dictionary keyed by webhook path.
  */
 type InferWebhookMapFromRoutes<TRoutes extends Record<string, RouteLike>> = { [P in keyof TRoutes]: InferSchemaOutput<TRoutes[P]["schema"]>; };
-/** Verification function for incoming requests */
-type VerifyFn = (req: NormalizedRequest) => Promise<void> | void;
+/** Verification function for incoming requests. Throws to reject the request. */
+type VerifyFn = (ctx: WebhookContext) => Promise<void> | void;
 /** Hook function that runs before request processing */
-type BeforeHook = (req: NormalizedRequest) => Promise<void> | void;
-/** Hook function that runs after successful request processing */
-type AfterHook = (req: NormalizedRequest, res: NormalizedResponse) => Promise<void> | void;
+type BeforeHook = (ctx: WebhookContext) => Promise<void> | void;
+/**
+ * Hook function that runs after successful request processing.
+ *
+ * The hook receives the outgoing response as-is; call `response.clone()`
+ * before reading its body to avoid consuming the stream sent to the client.
+ */
+type AfterHook = (ctx: WebhookContext, response: Response) => Promise<void> | void;
 /** Hook function that runs when an error occurs */
-type ErrorHook = (error: Error, req: NormalizedRequest) => Promise<NormalizedResponse | undefined> | NormalizedResponse | undefined;
+type ErrorHook = (error: Error, ctx: WebhookContext) => Promise<Response | undefined> | Response | undefined;
 //#endregion
-export { AfterHook, BeforeHook, ErrorHook, HandlerMap, InferSchemaOutput, InferWebhookMapFromRoutes, NormalizedRequest, NormalizedResponse, RegisterOptions, SchemaRouteOptions, SchemaRoutes, VerifyFn, WebhookHandler };
-//# sourceMappingURL=index.d.mts.map
+export { AfterHook, BeforeHook, ErrorHook, HandlerContext, HandlerMap, InferSchemaOutput, InferWebhookMapFromRoutes, RegisterOptions, SchemaRouteOptions, SchemaRoutes, VerifyFn, WebhookContext, WebhookHandler };
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","names":[],"sources":["../src/types.ts"],"mappings":";;;;;;;;UAciB;;EAEf;;EAEA,SAAS;;EAET,SAAS;;;;;;;UAQM,eAAe,4BAA4B;;EAE1D,SAAS;;;UAIM,gBAAgB;;EAE/B,QAAQ,YAAY;;EAEpB,SAAS,aAAa;;EAEtB,SAAS,eAAe;;EAExB,SAAS,0BAA0B;;;;;;;KAQzB,kBAAkB,WAC5B,gBAAgB,gCAAgC,WAAW;;;;;;KAOjD,mBACV,gBAAgB,sCACd,KAAK,gBAAgB,kBAAkB;EACzC,QAAQ;;UAGA;EACR,QAAQ,YAAY;EACpB,SAAS,aAAa;EACtB,SAAS;EACT,QAAQ;;;;;;;KAQE,aAAa,gBAAgB,eAAe,iBACrD,WAAW,UAAU,mBAAmB,QAAQ;;;;;;;KASvC,eAAe,uBACzB,KAAK,eAAe,cACjB,QAAQ,wBAAwB;;KAGzB,WAAW,aAAa,8BACjC,WAAW,OAAO,eAAe,KAAK;;;;;;KAQ7B,0BACV,gBAAgB,eAAe,iBAE9B,WAAW,UAAU,kBAAkB,QAAQ;;KAItC,YAAY,KAAK,mBAAmB;;KAGpC,cAAc,KAAK,mBAAmB;;;;;;;KAQtC,aACV,KAAK,gBACL,UAAU,aACP;;KAGO,aACV,OAAO,OACP,KAAK,mBACF,QAAQ,wBAAwB"}

package/dist/{utils/index.d.mts → utils.d.ts}

@@ -1,4 +1,4 @@
-//#region src/utils/index.d.ts
+//#region src/utils.d.ts
 /**
  * Utility helpers for webhook internals.
  *
@@ -15,4 +15,4 @@
 declare const constantTimeEquals: (a: string, b: string) => boolean;
 //#endregion
 export { constantTimeEquals };
-//# sourceMappingURL=index.d.mts.map
+//# sourceMappingURL=utils.d.ts.map

package/dist/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","names":[],"sources":["../src/utils.ts"],"mappings":";;;;;;;;;;;;;;cAca,qBAAsB,WAAW"}

package/dist/{utils/index.mjs → utils.js}

@@ -1,4 +1,4 @@
-//#region src/utils/index.ts
+//#region src/utils.ts
 /**
 * Utility helpers for webhook internals.
 *
@@ -21,4 +21,4 @@ const constantTimeEquals = (a, b) => {
 //#endregion
 export { constantTimeEquals };
 
-//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=utils.js.map

package/dist/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","names":[],"sources":["../src/utils.ts"],"sourcesContent":["/**\n * Utility helpers for webhook internals.\n *\n * @module @zap-studio/webhooks/utils\n */\n\n/**\n * Compares two strings in constant time to prevent timing attacks.\n *\n * @example\n * ```ts\n * const isEqual = constantTimeEquals(\"string1\", \"string2\"); // returns false\n * ```\n */\nexport const constantTimeEquals = (a: string, b: string): boolean => {\n  if (a.length !== b.length) {\n    return false;\n  }\n\n  let result = 0;\n  for (let i = 0; i < a.length; i += 1) {\n    // oxlint-disable-next-line no-bitwise, unicorn/prefer-code-point -- XOR is the constant-time compare trick; charCodeAt reads each char with the same cost, and inputs are plain ASCII hex.\n    result |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n\n  return result === 0;\n};\n"],"mappings":";;;;;;;;;;;;;;AAcA,MAAa,sBAAsB,GAAW,MAAuB;CACnE,IAAI,EAAE,WAAW,EAAE,QACjB,OAAO;CAGT,IAAI,SAAS;CACb,KAAK,IAAI,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK,GAEjC,UAAU,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;CAG5C,OAAO,WAAW;AACpB"}

package/dist/{verify.d.mts → verify.d.ts}

@@ -1,4 +1,4 @@
-import { VerifyFn } from "./types/index.mjs";
+import { VerifyFn } from "./types.js";
 //#region src/verify.d.ts
 declare const HMAC_HASH: {
   readonly sha1: "SHA-1";
@@ -11,7 +11,7 @@ type HmacAlgorithm = keyof typeof HMAC_HASH;
  * Creates a webhook verifier that validates an HMAC signature from a request header.
  *
  * The verifier imports the provided string secret once, computes an HMAC from
- * `req.rawBody`, normalizes the incoming header value, and compares both
+ * `ctx.rawBody`, normalizes the incoming header value, and compares both
  * signatures in constant time.
  *
  * Header values like `sha256=<hex>` are supported so common provider formats
@@ -46,4 +46,4 @@ declare const createHmacVerifier: ({ headerName, secret, algo }: {
 }) => VerifyFn;
 //#endregion
 export { createHmacVerifier };
-//# sourceMappingURL=verify.d.mts.map
+//# sourceMappingURL=verify.d.ts.map

package/dist/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","names":[],"sources":["../src/verify.ts"],"mappings":";;cAUM;WACJ;WACA;WACA;WACA;;KAGG,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA2CrB,uBACX,YACA,QACA;EAEA;EACA;EACA,OAAO;MACL"}

package/dist/{verify.mjs → verify.js}

@@ -1,5 +1,5 @@
-import { VerificationError } from "./errors.mjs";
-import { constantTimeEquals } from "./utils/index.mjs";
+import { VerificationError } from "./errors.js";
+import { constantTimeEquals } from "./utils.js";
 //#region src/verify.ts
 /**
 * Signature verification helpers for webhook requests.
@@ -18,7 +18,7 @@ const normalizeSignature = (signature) => signature.replace(/^[a-z0-9-]+=/iu, ""
 * Creates a webhook verifier that validates an HMAC signature from a request header.
 *
 * The verifier imports the provided string secret once, computes an HMAC from
-* `req.rawBody`, normalizes the incoming header value, and compares both
+* `ctx.rawBody`, normalizes the incoming header value, and compares both
 * signatures in constant time.
 *
 * Header values like `sha256=<hex>` are supported so common provider formats
@@ -55,15 +55,16 @@ const createHmacVerifier = ({ headerName, secret, algo = "sha256" }) => {
 		hash,
 		name: "HMAC"
 	}, false, ["sign"]);
-	return async (req) => {
-		const actual = req.headers.get(headerName);
+	return async (ctx) => {
+		const actual = ctx.request.headers.get(headerName);
 		if (actual === null || actual.length === 0) throw new VerificationError(`Missing signature header: ${headerName}`);
 		const key = await keyPromise;
-		const signature = await subtle.sign("HMAC", key, new Uint8Array(req.rawBody));
-		if (!constantTimeEquals(toHex(new Uint8Array(signature)), normalizeSignature(actual))) throw new VerificationError(`Invalid signature for header: ${headerName}`);
+		const signature = await subtle.sign("HMAC", key, new Uint8Array(ctx.rawBody));
+		const expected = toHex(new Uint8Array(signature));
+		if (!constantTimeEquals(expected, normalizeSignature(actual))) throw new VerificationError(`Invalid signature for header: ${headerName}`);
 	};
 };
 //#endregion
 export { createHmacVerifier };
 
-//# sourceMappingURL=verify.mjs.map
+//# sourceMappingURL=verify.js.map

package/dist/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","names":[],"sources":["../src/verify.ts"],"sourcesContent":["/**\n * Signature verification helpers for webhook requests.\n *\n * @module @zap-studio/webhooks/verify\n */\n\nimport { VerificationError } from \"./errors.js\";\nimport type { VerifyFn } from \"./types.js\";\nimport { constantTimeEquals } from \"./utils.js\";\n\nconst HMAC_HASH = {\n  sha1: \"SHA-1\",\n  sha256: \"SHA-256\",\n  sha384: \"SHA-384\",\n  sha512: \"SHA-512\",\n} as const;\n\ntype HmacAlgorithm = keyof typeof HMAC_HASH;\n\nconst toHex = (bytes: Uint8Array): string =>\n  Array.from(bytes, (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n\nconst normalizeSignature = (signature: string): string =>\n  signature\n    .replace(/^[a-z0-9-]+=/iu, \"\")\n    .trim()\n    .toLowerCase();\n\n/**\n * Creates a webhook verifier that validates an HMAC signature from a request header.\n *\n * The verifier imports the provided string secret once, computes an HMAC from\n * `ctx.rawBody`, normalizes the incoming header value, and compares both\n * signatures in constant time.\n *\n * Header values like `sha256=<hex>` are supported so common provider formats\n * such as GitHub work without extra parsing.\n *\n * @example\n * ```ts\n * import { createWebhookRouter } from \"@zap-studio/webhooks\";\n * import { createHmacVerifier } from \"@zap-studio/webhooks/verify\";\n *\n * const router = createWebhookRouter({\n *   verify: createHmacVerifier({\n *     headerName: \"x-hub-signature-256\",\n *     secret: process.env.GITHUB_WEBHOOK_SECRET!,\n *   }),\n * });\n * ```\n *\n * @param options - Verifier configuration.\n * @param options.headerName - Header containing the provider signature.\n * @param options.secret - Shared HMAC secret as a string.\n * @param options.algo - HMAC hash algorithm. Defaults to `\"sha256\"`.\n * @returns A router-compatible request verifier.\n *\n * @throws {VerificationError}\n * Thrown when verifier setup fails or request verification does not pass.\n */\nexport const createHmacVerifier = ({\n  headerName,\n  secret,\n  algo = \"sha256\",\n}: {\n  headerName: string;\n  secret: string;\n  algo?: HmacAlgorithm;\n}): VerifyFn => {\n  if (globalThis.crypto?.subtle === undefined) {\n    throw new VerificationError(\n      \"Web Crypto API is unavailable in this runtime\"\n    );\n  }\n\n  const { subtle } = globalThis.crypto;\n\n  const hash = HMAC_HASH[algo];\n  if (!hash) {\n    throw new VerificationError(`Unsupported HMAC algorithm: ${algo}`);\n  }\n\n  const keyPromise = subtle.importKey(\n    \"raw\",\n    new TextEncoder().encode(secret),\n    { hash, name: \"HMAC\" },\n    false,\n    [\"sign\"]\n  );\n\n  return async (ctx) => {\n    const actual = ctx.request.headers.get(headerName);\n    if (actual === null || actual.length === 0) {\n      throw new VerificationError(`Missing signature header: ${headerName}`);\n    }\n\n    const key = await keyPromise;\n    const signature = await subtle.sign(\n      \"HMAC\",\n      key,\n      new Uint8Array(ctx.rawBody)\n    );\n    const expected = toHex(new Uint8Array(signature));\n\n    if (!constantTimeEquals(expected, normalizeSignature(actual))) {\n      throw new VerificationError(\n        `Invalid signature for header: ${headerName}`\n      );\n    }\n  };\n};\n"],"mappings":";;;;;;;;AAUA,MAAM,YAAY;CAChB,MAAM;CACN,QAAQ;CACR,QAAQ;CACR,QAAQ;AACV;AAIA,MAAM,SAAS,UACb,MAAM,KAAK,QAAQ,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AAEzE,MAAM,sBAAsB,cAC1B,UACG,QAAQ,kBAAkB,EAAE,CAAC,CAC7B,KAAK,CAAC,CACN,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCjB,MAAa,sBAAsB,EACjC,YACA,QACA,OAAO,eAKO;CACd,IAAI,WAAW,QAAQ,WAAW,KAAA,GAChC,MAAM,IAAI,kBACR,+CACF;CAGF,MAAM,EAAE,WAAW,WAAW;CAE9B,MAAM,OAAO,UAAU;CACvB,IAAI,CAAC,MACH,MAAM,IAAI,kBAAkB,+BAA+B,MAAM;CAGnE,MAAM,aAAa,OAAO,UACxB,OACA,IAAI,YAAY,CAAC,CAAC,OAAO,MAAM,GAC/B;EAAE;EAAM,MAAM;CAAO,GACrB,OACA,CAAC,MAAM,CACT;CAEA,OAAO,OAAO,QAAQ;EACpB,MAAM,SAAS,IAAI,QAAQ,QAAQ,IAAI,UAAU;EACjD,IAAI,WAAW,QAAQ,OAAO,WAAW,GACvC,MAAM,IAAI,kBAAkB,6BAA6B,YAAY;EAGvE,MAAM,MAAM,MAAM;EAClB,MAAM,YAAY,MAAM,OAAO,KAC7B,QACA,KACA,IAAI,WAAW,IAAI,OAAO,CAC5B;EACA,MAAM,WAAW,MAAM,IAAI,WAAW,SAAS,CAAC;EAEhD,IAAI,CAAC,mBAAmB,UAAU,mBAAmB,MAAM,CAAC,GAC1D,MAAM,IAAI,kBACR,iCAAiC,YACnC;CAEJ;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zap-studio/webhooks",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "private": false,
   "description": "A lightweight, type-safe webhook router with Standard Schema validation, signature verification, and lifecycle hooks.",
   "keywords": [
@@ -33,33 +33,30 @@
   ],
   "type": "module",
   "sideEffects": false,
-  "types": "./dist/index.d.mts",
+  "types": "./dist/index.d.ts",
   "exports": {
-    ".": "./dist/index.mjs",
-    "./adapters/base": "./dist/adapters/base.mjs",
-    "./errors": "./dist/errors.mjs",
-    "./types": "./dist/types/index.mjs",
-    "./utils": "./dist/utils/index.mjs",
-    "./verify": "./dist/verify.mjs",
+    ".": "./dist/index.js",
+    "./errors": "./dist/errors.js",
+    "./router": "./dist/router.js",
+    "./types": "./dist/types.js",
+    "./utils": "./dist/utils.js",
+    "./verify": "./dist/verify.js",
     "./package.json": "./package.json"
   },
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
-    "@zap-studio/validation": "0.3.5"
+    "@zap-studio/validation": "workspace:*"
   },
   "devDependencies": {
-    "tsdown": "^0.22.4",
-    "typescript": "^7.0.2",
-    "vitest": "^4.1.10",
-    "zod": "^4.4.3",
-    "@zap-studio/typescript": "0.0.0"
+    "@zap-studio/typescript": "workspace:*",
+    "tsdown": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:",
+    "zod": "catalog:"
   },
   "engines": {
     "node": ">=18.0.0"
-  },
-  "scripts": {
-    "build": "tsdown --config ./tsdown.config.ts"
   }
-}
+}

package/dist/adapters/base.d.mts

@@ -1,59 +0,0 @@
-import { NormalizedRequest, NormalizedResponse } from "../types/index.mjs";
-//#region src/adapters/base.d.ts
-interface RouterHandler {
-  handle: (req: NormalizedRequest) => Promise<NormalizedResponse>;
-}
-/**
- * Minimal framework adapter contract.
- *
- * Implement this when integrating the webhook router with an HTTP framework.
- *
- * @template TReq - Framework-specific request type (e.g. `express.Request`).
- * @template TRes - Framework-specific response type (e.g. `express.Response`).
- */
-interface Adapter<TReq = unknown, TRes = unknown> {
-  /**
-   * Creates a framework handler that:
-   * 1. normalizes the incoming framework request
-   * 2. executes the webhook router
-   * 3. writes the normalized response back to the framework response
-   */
-  handleWebhook: (router: RouterHandler) => (req: TReq, res: TRes) => Promise<void>;
-  /**
-   * Maps a normalized router response to the framework response object.
-   *
-   * @param frameworkRes - Framework-specific response object (e.g. `res`)
-   * @param res - Normalized response returned by the webhook router
-   */
-  toFrameworkResponse: (frameworkRes: TRes, res: NormalizedResponse) => Promise<TRes>;
-  /**
-   * Maps a framework request into the normalized request contract.
-   *
-   * The returned object must include `rawBody` to support signature verification.
-   *
-   * @param req - Framework-specific request object
-   */
-  toNormalizedRequest: (req: TReq) => Promise<NormalizedRequest>;
-}
-/**
- * Base adapter helper.
- *
- * Extend this class in consumers to keep framework integration boilerplate
- * in one place while relying on the package router contract.
- */
-declare abstract class BaseAdapter<TReq = unknown, TRes = unknown> implements Adapter<TReq, TRes> {
-  /** @inheritdoc */
-  abstract toNormalizedRequest: (req: TReq) => Promise<NormalizedRequest>;
-  /** @inheritdoc */
-  abstract toFrameworkResponse: (frameworkRes: TRes, res: NormalizedResponse) => Promise<TRes>;
-  /**
-   * Shared adapter pipeline implementation.
-   *
-   * Most consumers only need to implement request/response mapping methods and
-   * can reuse this default orchestration.
-   */
-  handleWebhook: (router: RouterHandler) => ((req: TReq, res: TRes) => Promise<void>);
-}
-//#endregion
-export { Adapter, BaseAdapter };
-//# sourceMappingURL=base.d.mts.map

package/dist/adapters/base.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"base.d.mts","names":[],"sources":["../../src/adapters/base.ts"],"mappings":";;UAQU;EACR,SAAS,KAAK,sBAAsB,QAAQ;;;;;;;;;;UAW7B,QAAQ,gBAAgB;;;;;;;EAOvC,gBACE,QAAQ,mBACJ,KAAK,MAAM,KAAK,SAAS;;;;;;;EAQ/B,sBACE,cAAc,MACd,KAAK,uBACF,QAAQ;;;;;;;;EASb,sBAAsB,KAAK,SAAS,QAAQ;;;;;;;;uBASxB,YACpB,gBACA,2BACW,QAAQ,MAAM;;WAEhB,sBAAsB,KAAK,SAAS,QAAQ;;WAE5C,sBACP,cAAc,MACd,KAAK,uBACF,QAAQ;;;;;;;EAQb,gBACG,QAAQ,oBAAkB,KAAK,MAAM,KAAK,SAAS"}

package/dist/adapters/base.mjs

@@ -1,24 +0,0 @@
-//#region src/adapters/base.ts
-/**
-* Base adapter helper.
-*
-* Extend this class in consumers to keep framework integration boilerplate
-* in one place while relying on the package router contract.
-*/
-var BaseAdapter = class {
-	/**
-	* Shared adapter pipeline implementation.
-	*
-	* Most consumers only need to implement request/response mapping methods and
-	* can reuse this default orchestration.
-	*/
-	handleWebhook = (router) => async (req, res) => {
-		const normalizedReq = await this.toNormalizedRequest(req);
-		const normalizedRes = await router.handle(normalizedReq);
-		await this.toFrameworkResponse(res, normalizedRes);
-	};
-};
-//#endregion
-export { BaseAdapter };
-
-//# sourceMappingURL=base.mjs.map

package/dist/adapters/base.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"base.mjs","names":[],"sources":["../../src/adapters/base.ts"],"sourcesContent":["/**\n * Framework adapter contracts for webhook router integration.\n *\n * @module @zap-studio/webhooks/adapters/base\n */\n\nimport type { NormalizedRequest, NormalizedResponse } from \"../types/index.js\";\n\ninterface RouterHandler {\n  handle: (req: NormalizedRequest) => Promise<NormalizedResponse>;\n}\n\n/**\n * Minimal framework adapter contract.\n *\n * Implement this when integrating the webhook router with an HTTP framework.\n *\n * @template TReq - Framework-specific request type (e.g. `express.Request`).\n * @template TRes - Framework-specific response type (e.g. `express.Response`).\n */\nexport interface Adapter<TReq = unknown, TRes = unknown> {\n  /**\n   * Creates a framework handler that:\n   * 1. normalizes the incoming framework request\n   * 2. executes the webhook router\n   * 3. writes the normalized response back to the framework response\n   */\n  handleWebhook: (\n    router: RouterHandler\n  ) => (req: TReq, res: TRes) => Promise<void>;\n\n  /**\n   * Maps a normalized router response to the framework response object.\n   *\n   * @param frameworkRes - Framework-specific response object (e.g. `res`)\n   * @param res - Normalized response returned by the webhook router\n   */\n  toFrameworkResponse: (\n    frameworkRes: TRes,\n    res: NormalizedResponse\n  ) => Promise<TRes>;\n\n  /**\n   * Maps a framework request into the normalized request contract.\n   *\n   * The returned object must include `rawBody` to support signature verification.\n   *\n   * @param req - Framework-specific request object\n   */\n  toNormalizedRequest: (req: TReq) => Promise<NormalizedRequest>;\n}\n\n/**\n * Base adapter helper.\n *\n * Extend this class in consumers to keep framework integration boilerplate\n * in one place while relying on the package router contract.\n */\nexport abstract class BaseAdapter<\n  TReq = unknown,\n  TRes = unknown,\n> implements Adapter<TReq, TRes> {\n  /** @inheritdoc */\n  abstract toNormalizedRequest: (req: TReq) => Promise<NormalizedRequest>;\n  /** @inheritdoc */\n  abstract toFrameworkResponse: (\n    frameworkRes: TRes,\n    res: NormalizedResponse\n  ) => Promise<TRes>;\n\n  /**\n   * Shared adapter pipeline implementation.\n   *\n   * Most consumers only need to implement request/response mapping methods and\n   * can reuse this default orchestration.\n   */\n  handleWebhook =\n    (router: RouterHandler): ((req: TReq, res: TRes) => Promise<void>) =>\n    async (req, res) => {\n      const normalizedReq = await this.toNormalizedRequest(req);\n      const normalizedRes = await router.handle(normalizedReq);\n      await this.toFrameworkResponse(res, normalizedRes);\n    };\n}\n"],"mappings":";;;;;;;AA0DA,IAAsB,cAAtB,MAGiC;;;;;;;CAe/B,iBACG,WACD,OAAO,KAAK,QAAQ;EAClB,MAAM,gBAAgB,MAAM,KAAK,oBAAoB,GAAG;EACxD,MAAM,gBAAgB,MAAM,OAAO,OAAO,aAAa;EACvD,MAAM,KAAK,oBAAoB,KAAK,aAAa;CACnD;AACJ"}

package/dist/errors.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.d.mts","names":[],"sources":["../src/errors.ts"],"mappings":";;;;;;;;;;;;cAYa,0BAA0B;;;;;;EAMrC,YAAY"}

package/dist/errors.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.mjs","names":[],"sources":["../src/errors.ts"],"sourcesContent":["/**\n * Error primitives for webhook verification failures.\n *\n * @module @zap-studio/webhooks/errors\n */\n\n/**\n * Error thrown when webhook request verification fails.\n *\n * This error is used by verifier helpers such as `createHmacVerifier` so\n * callers can distinguish verification failures from other webhook errors.\n */\nexport class VerificationError extends Error {\n  /**\n   * Creates a verification error with a human-readable message.\n   *\n   * @param message - Error message describing the verification failure.\n   */\n  constructor(message: string) {\n    super(message);\n    this.name = \"VerificationError\";\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAYA,IAAa,oBAAb,cAAuC,MAAM;;;;;;CAM3C,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF"}

package/dist/index.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/index.ts"],"mappings":";;;UAmCiB;;EAEf,QAAQ,YAAY;;EAEpB,SAAS,aAAa;;EAEtB,UAAU;;EAEV;;EAEA,UAAU,KAAK,sBAAsB;;;;;;;cAgB1B,cAAc;mBACR;mBACA;mBAGA;mBACA;mBACA;mBACA;;;;;;EAOjB,YAAY,OAAM;;;;;;;;;;EAiBlB,SACE,qBACA,gBAAgB,oCAEhB,MAAM,MACN,kBAAkB,mBAAmB,WACpC,cAAc,OAAO,OAAO,MAAM,kBAAkB;EACvD,SAAS,qBAAqB,UAC5B,MAAM,MACN,kBAAkB,gBAAgB,YACjC,cAAc,OAAO,OAAO,MAAM;EACrC,SAAS,qBACP,MAAM,MACN,kBAAkB,iBACjB,cAAc,OAAO,OAAO;;;;;;;EAmB/B,OAAa,KAAK,oBAAoB,QAAQ;UA6CtC;iBA2Ba;UAUP;iBAMC;iBA0BM;iBAWN;iBAYA;iBASM;iBA+BA;iBA0BA;UAYP;UASA;;;;;;;;cA4BH,sBACX,OAAO,yBACN"}

package/dist/index.mjs

@@ -1,175 +0,0 @@
-import { standardValidate } from "@zap-studio/validation";
-//#region src/index.ts
-const toArray = (value) => {
-	if (value === void 0) return [];
-	return Array.isArray(value) ? value : [value];
-};
-/**
-* Main webhook router class.
-*
-* Register routes with typed schemas and call `handle` with a normalized request.
-*/
-var WebhookRouter = class WebhookRouter {
-	handlers = {};
-	verify;
-	globalBeforeHooks = [];
-	globalAfterHooks = [];
-	globalErrorHook;
-	prefix;
-	/**
-	* Creates a webhook router with optional global hooks and verification behavior.
-	*
-	* @param opts - Router-level options.
-	*/
-	constructor(opts = {}) {
-		this.prefix = opts.prefix ?? "/webhooks/";
-		this.verify = opts.verify;
-		this.globalBeforeHooks = toArray(opts.before);
-		this.globalAfterHooks = toArray(opts.after);
-		this.globalErrorHook = opts.onError;
-	}
-	register(path, handlerOrOptions) {
-		this.handlers[path] = typeof handlerOrOptions === "function" ? { handler: handlerOrOptions } : WebhookRouter.createHandlerEntry(handlerOrOptions);
-		return this;
-	}
-	/**
-	* Handles a normalized incoming webhook request.
-	*
-	* @param req - Normalized request object.
-	* @returns Normalized response for the adapter/framework layer.
-	*/
-	async handle(req) {
-		try {
-			const normalizedPath = this.normalizePath(req);
-			if (normalizedPath === null) return {
-				body: { error: "not found" },
-				status: 404
-			};
-			const handlerEntry = this.handlers[normalizedPath];
-			if (!handlerEntry) return {
-				body: { error: "not found" },
-				status: 404
-			};
-			await this.runGlobalBeforeHooks(req);
-			await WebhookRouter.runRouteBeforeHooks(req, handlerEntry.before);
-			if (this.verify) await this.verify(req);
-			const parsedJson = WebhookRouter.parseRequestBody(req);
-			const validationResult = await WebhookRouter.validatePayload(parsedJson, handlerEntry.schema);
-			if (WebhookRouter.isErrorResponse(validationResult)) return validationResult;
-			const response = await WebhookRouter.executeHandler(handlerEntry.handler, req, validationResult);
-			await WebhookRouter.runRouteAfterHooks(req, response, handlerEntry.after);
-			await this.runGlobalAfterHooks(req, response);
-			return response;
-		} catch (error) {
-			return await this.handleError(error, req);
-		}
-	}
-	normalizePath(req) {
-		let pathname = req.path;
-		try {
-			const url = new URL(req.path);
-			({pathname} = url);
-		} catch {}
-		pathname = pathname.startsWith(this.prefix) ? pathname.slice(this.prefix.length - 1) : "";
-		if (pathname.length === 0) return null;
-		req.path = pathname;
-		return pathname.startsWith("/") ? pathname.slice(1) : pathname;
-	}
-	static async runHooks(hooks, run) {
-		for (const hook of hooks) await run(hook);
-	}
-	async runGlobalBeforeHooks(req) {
-		await WebhookRouter.runHooks(this.globalBeforeHooks, async (hook) => {
-			await hook(req);
-		});
-	}
-	static createHandlerEntry(options) {
-		const entry = { handler: options.handler };
-		if (options.schema !== void 0) entry.schema = options.schema;
-		if (options.before !== void 0) entry.before = Array.isArray(options.before) ? options.before : [options.before];
-		if (options.after !== void 0) entry.after = Array.isArray(options.after) ? options.after : [options.after];
-		return entry;
-	}
-	static async runRouteBeforeHooks(req, before) {
-		if (before) await WebhookRouter.runHooks(before, async (hook) => {
-			await hook(req);
-		});
-	}
-	static parseRequestBody(req) {
-		try {
-			const parsed = JSON.parse(new TextDecoder().decode(req.rawBody));
-			req.json = parsed;
-			return parsed;
-		} catch {
-			return;
-		}
-	}
-	static isErrorResponse(value) {
-		return typeof value === "object" && value !== null && "status" in value && typeof value.status === "number";
-	}
-	static async validatePayload(parsedJson, schema) {
-		if (!schema) return parsedJson;
-		const result = await standardValidate(schema, parsedJson, { throwOnError: false });
-		if (result.issues) return {
-			body: {
-				error: "validation failed",
-				issues: result.issues.map((issue) => ({
-					message: issue.message,
-					path: issue.path?.map((p) => typeof p === "object" && "key" in p ? String(p.key) : String(p))
-				}))
-			},
-			status: 400
-		};
-		return result.value;
-	}
-	static async executeHandler(handler, req, validatedPayload) {
-		return await handler({
-			ack: async (r) => {
-				await Promise.resolve();
-				const response = {
-					body: r?.body ?? "ok",
-					status: r?.status ?? 200
-				};
-				if (r?.headers !== void 0) response.headers = r.headers;
-				return response;
-			},
-			payload: validatedPayload,
-			req
-		}) ?? {
-			body: "ok",
-			status: 200
-		};
-	}
-	static async runRouteAfterHooks(req, response, after) {
-		if (after) await WebhookRouter.runHooks(after, async (hook) => {
-			await hook(req, response);
-		});
-	}
-	async runGlobalAfterHooks(req, response) {
-		await WebhookRouter.runHooks(this.globalAfterHooks, async (hook) => {
-			await hook(req, response);
-		});
-	}
-	async handleError(error, req) {
-		if (this.globalErrorHook) {
-			const normalizedError = error instanceof Error ? error : /* @__PURE__ */ new Error("Internal server error");
-			const errorResponse = await this.globalErrorHook(normalizedError, req);
-			if (errorResponse) return errorResponse;
-		}
-		return {
-			body: { error: error instanceof Error ? error.message : "Internal server error" },
-			status: 500
-		};
-	}
-};
-/**
-* Factory helper for creating a webhook router instance.
-*
-* @param opts - Optional global router options.
-* @returns A new webhook router.
-*/
-const createWebhookRouter = (opts) => new WebhookRouter(opts);
-//#endregion
-export { WebhookRouter, createWebhookRouter };
-
-//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../src/index.ts"],"sourcesContent":["/**\n * Schema-first webhook router primitives.\n *\n * @module @zap-studio/webhooks\n */\n\nimport type { StandardSchemaV1 } from \"@zap-studio/validation\";\nimport { standardValidate } from \"@zap-studio/validation\";\n\nimport type {\n  AfterHook,\n  BeforeHook,\n  ErrorHook,\n  InferSchemaOutput,\n  NormalizedRequest,\n  NormalizedResponse,\n  RegisterOptions,\n  SchemaRouteOptions,\n  WebhookHandler,\n} from \"./types/index.js\";\n\n/**\n * Schema-first webhook router with path dispatching, validation, and optional verification.\n *\n * @template TMap - Internal route payload map built incrementally via `register`.\n */\ninterface HandlerEntry<TPayload = unknown> {\n  after?: AfterHook[];\n  before?: BeforeHook[];\n  handler: WebhookHandler<TPayload>;\n  schema?: StandardSchemaV1<unknown, TPayload>;\n}\n\ntype HandlerStore = Record<string, HandlerEntry>;\n\nexport interface WebhookRouterOptions {\n  /** Global hooks executed after successful route handler completion. */\n  after?: AfterHook | AfterHook[];\n  /** Global hooks executed before route-level hooks and verification. */\n  before?: BeforeHook | BeforeHook[];\n  /** Global error hook used to override the default `500` response. */\n  onError?: ErrorHook;\n  /** Required path prefix for all webhook routes. Defaults to `\"/webhooks/\"`. */\n  prefix?: string;\n  /** Optional request verification function (for signature checks, auth, etc.). */\n  verify?: (req: NormalizedRequest) => Promise<void> | void;\n}\n\nconst toArray = <T>(value: T | T[] | undefined): T[] => {\n  if (value === undefined) {\n    return [];\n  }\n\n  return Array.isArray(value) ? value : [value];\n};\n\n/**\n * Main webhook router class.\n *\n * Register routes with typed schemas and call `handle` with a normalized request.\n */\nexport class WebhookRouter<TMap = unknown> {\n  private readonly handlers: HandlerStore = {};\n  private readonly verify:\n    | ((req: NormalizedRequest) => Promise<void> | void)\n    | undefined;\n  private readonly globalBeforeHooks: BeforeHook[] = [];\n  private readonly globalAfterHooks: AfterHook[] = [];\n  private readonly globalErrorHook: ErrorHook | undefined;\n  private readonly prefix: string;\n\n  /**\n   * Creates a webhook router with optional global hooks and verification behavior.\n   *\n   * @param opts - Router-level options.\n   */\n  constructor(opts: WebhookRouterOptions = {}) {\n    this.prefix = opts.prefix ?? \"/webhooks/\";\n    this.verify = opts.verify;\n    this.globalBeforeHooks = toArray(opts.before);\n    this.globalAfterHooks = toArray(opts.after);\n    this.globalErrorHook = opts.onError;\n  }\n\n  /**\n   * Register a webhook handler for a specific path.\n   *\n   * When a schema is provided, `payload` is inferred from the schema output type.\n   *\n   * @param path - Route path relative to configured prefix.\n   * @param handlerOrOptions - Handler function or schema-based registration options.\n   * @returns The same router instance with an updated internal route type map.\n   */\n  register<\n    Path extends string,\n    TSchema extends StandardSchemaV1<unknown, unknown>,\n  >(\n    path: Path,\n    handlerOrOptions: SchemaRouteOptions<TSchema>\n  ): WebhookRouter<TMap & Record<Path, InferSchemaOutput<TSchema>>>;\n  register<Path extends string, TPayload>(\n    path: Path,\n    handlerOrOptions: RegisterOptions<TPayload>\n  ): WebhookRouter<TMap & Record<Path, TPayload>>;\n  register<Path extends string>(\n    path: Path,\n    handlerOrOptions: WebhookHandler\n  ): WebhookRouter<TMap & Record<Path, unknown>>;\n  register(\n    path: string,\n    handlerOrOptions: WebhookHandler | RegisterOptions<unknown>\n  ): this {\n    this.handlers[path] =\n      typeof handlerOrOptions === \"function\"\n        ? { handler: handlerOrOptions }\n        : WebhookRouter.createHandlerEntry(handlerOrOptions);\n\n    return this;\n  }\n\n  /**\n   * Handles a normalized incoming webhook request.\n   *\n   * @param req - Normalized request object.\n   * @returns Normalized response for the adapter/framework layer.\n   */\n  async handle(req: NormalizedRequest): Promise<NormalizedResponse> {\n    try {\n      const normalizedPath = this.normalizePath(req);\n\n      if (normalizedPath === null) {\n        return { body: { error: \"not found\" }, status: 404 };\n      }\n\n      const handlerEntry = this.handlers[normalizedPath];\n      if (!handlerEntry) {\n        return { body: { error: \"not found\" }, status: 404 };\n      }\n\n      await this.runGlobalBeforeHooks(req);\n      await WebhookRouter.runRouteBeforeHooks(req, handlerEntry.before);\n\n      if (this.verify) {\n        await this.verify(req);\n      }\n\n      const parsedJson = WebhookRouter.parseRequestBody(req);\n      const validationResult = await WebhookRouter.validatePayload(\n        parsedJson,\n        handlerEntry.schema\n      );\n\n      if (WebhookRouter.isErrorResponse(validationResult)) {\n        return validationResult;\n      }\n\n      const response = await WebhookRouter.executeHandler(\n        handlerEntry.handler,\n        req,\n        validationResult\n      );\n\n      await WebhookRouter.runRouteAfterHooks(req, response, handlerEntry.after);\n      await this.runGlobalAfterHooks(req, response);\n\n      return response;\n    } catch (error) {\n      return await this.handleError(error, req);\n    }\n  }\n\n  private normalizePath(req: NormalizedRequest): string | null {\n    let pathname = req.path;\n    try {\n      // Try to parse as URL (e.g. handles full URLs like https://example.com/webhooks/path -> /webhooks/path)\n      const url = new URL(req.path);\n      ({ pathname } = url);\n    } catch {\n      // Not a full URL, use the path as-is\n    }\n\n    // Require prefix (e.g. /webhooks/path -> /path)\n    pathname = pathname.startsWith(this.prefix)\n      ? pathname.slice(this.prefix.length - 1)\n      : \"\";\n    if (pathname.length === 0) {\n      return null;\n    }\n    req.path = pathname;\n\n    // Normalize path by removing leading slash for handler matching (e.g. /path -> path)\n    const normalizedPath = pathname.startsWith(\"/\")\n      ? pathname.slice(1)\n      : pathname;\n\n    return normalizedPath;\n  }\n\n  private static async runHooks<T>(\n    hooks: T[],\n    run: (hook: T) => void | Promise<void>\n  ): Promise<void> {\n    for (const hook of hooks) {\n      // oxlint-disable-next-line no-await-in-loop -- hooks run sequentially; order + short-circuit matter.\n      await run(hook);\n    }\n  }\n\n  private async runGlobalBeforeHooks(req: NormalizedRequest): Promise<void> {\n    await WebhookRouter.runHooks(this.globalBeforeHooks, async (hook) => {\n      await hook(req);\n    });\n  }\n\n  private static createHandlerEntry(\n    options: RegisterOptions<unknown>\n  ): HandlerEntry {\n    const entry: HandlerEntry = {\n      handler: options.handler,\n    };\n\n    if (options.schema !== undefined) {\n      entry.schema = options.schema;\n    }\n\n    if (options.before !== undefined) {\n      entry.before = Array.isArray(options.before)\n        ? options.before\n        : [options.before];\n    }\n\n    if (options.after !== undefined) {\n      entry.after = Array.isArray(options.after)\n        ? options.after\n        : [options.after];\n    }\n\n    return entry;\n  }\n\n  private static async runRouteBeforeHooks(\n    req: NormalizedRequest,\n    before?: BeforeHook[]\n  ): Promise<void> {\n    if (before) {\n      await WebhookRouter.runHooks(before, async (hook) => {\n        await hook(req);\n      });\n    }\n  }\n\n  private static parseRequestBody(req: NormalizedRequest): unknown {\n    try {\n      const parsed = JSON.parse(\n        new TextDecoder().decode(req.rawBody)\n      ) as unknown;\n      req.json = parsed;\n      return parsed;\n    } catch {\n      return undefined;\n    }\n  }\n\n  private static isErrorResponse(value: unknown): value is NormalizedResponse {\n    return (\n      typeof value === \"object\" &&\n      value !== null &&\n      \"status\" in value &&\n      typeof value.status === \"number\"\n    );\n  }\n\n  private static async validatePayload<TPayload>(\n    parsedJson: unknown,\n    schema?: StandardSchemaV1<unknown, TPayload>\n  ): Promise<TPayload | NormalizedResponse> {\n    if (!schema) {\n      // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- Without a schema, caller-declared payload type is the route contract.\n      return parsedJson as TPayload;\n    }\n\n    const result = await standardValidate(schema, parsedJson, {\n      throwOnError: false,\n    });\n\n    if (result.issues) {\n      return {\n        body: {\n          error: \"validation failed\",\n          issues: result.issues.map((issue) => ({\n            message: issue.message,\n            path: issue.path?.map((p) =>\n              typeof p === \"object\" && \"key\" in p ? String(p.key) : String(p)\n            ),\n          })),\n        },\n        status: 400,\n      };\n    }\n\n    return result.value;\n  }\n\n  private static async executeHandler<TPayload = unknown>(\n    handler: WebhookHandler<TPayload>,\n    req: NormalizedRequest,\n    validatedPayload: TPayload\n  ): Promise<NormalizedResponse> {\n    const responded = await handler({\n      ack: async (r?: Partial<NormalizedResponse>) => {\n        await Promise.resolve();\n        const response: NormalizedResponse = {\n          body: r?.body ?? \"ok\",\n          status: r?.status ?? 200,\n        };\n\n        if (r?.headers !== undefined) {\n          response.headers = r.headers;\n        }\n\n        return response;\n      },\n      payload: validatedPayload,\n      req,\n    });\n\n    return responded ?? { body: \"ok\", status: 200 };\n  }\n\n  private static async runRouteAfterHooks(\n    req: NormalizedRequest,\n    response: NormalizedResponse,\n    after?: AfterHook[]\n  ): Promise<void> {\n    if (after) {\n      await WebhookRouter.runHooks(after, async (hook) => {\n        await hook(req, response);\n      });\n    }\n  }\n\n  private async runGlobalAfterHooks(\n    req: NormalizedRequest,\n    response: NormalizedResponse\n  ): Promise<void> {\n    await WebhookRouter.runHooks(this.globalAfterHooks, async (hook) => {\n      await hook(req, response);\n    });\n  }\n\n  private async handleError(\n    error: unknown,\n    req: NormalizedRequest\n  ): Promise<NormalizedResponse> {\n    if (this.globalErrorHook) {\n      const normalizedError =\n        error instanceof Error ? error : new Error(\"Internal server error\");\n      const errorResponse = await this.globalErrorHook(normalizedError, req);\n      if (errorResponse) {\n        return errorResponse;\n      }\n    }\n\n    return {\n      body: {\n        error: error instanceof Error ? error.message : \"Internal server error\",\n      },\n      status: 500,\n    };\n  }\n}\n\n/**\n * Factory helper for creating a webhook router instance.\n *\n * @param opts - Optional global router options.\n * @returns A new webhook router.\n */\nexport const createWebhookRouter = (\n  opts?: WebhookRouterOptions\n): WebhookRouter => new WebhookRouter(opts);\n"],"mappings":";;AAgDA,MAAM,WAAc,UAAoC;CACtD,IAAI,UAAU,KAAA,GACZ,OAAO,CAAC;CAGV,OAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;AAC9C;;;;;;AAOA,IAAa,gBAAb,MAAa,cAA8B;CACzC,WAA0C,CAAC;CAC3C;CAGA,oBAAmD,CAAC;CACpD,mBAAiD,CAAC;CAClD;CACA;;;;;;CAOA,YAAY,OAA6B,CAAC,GAAG;EAC3C,KAAK,SAAS,KAAK,UAAU;EAC7B,KAAK,SAAS,KAAK;EACnB,KAAK,oBAAoB,QAAQ,KAAK,MAAM;EAC5C,KAAK,mBAAmB,QAAQ,KAAK,KAAK;EAC1C,KAAK,kBAAkB,KAAK;CAC9B;CA0BA,SACE,MACA,kBACM;EACN,KAAK,SAAS,QACZ,OAAO,qBAAqB,aACxB,EAAE,SAAS,iBAAiB,IAC5B,cAAc,mBAAmB,gBAAgB;EAEvD,OAAO;CACT;;;;;;;CAQA,MAAM,OAAO,KAAqD;EAChE,IAAI;GACF,MAAM,iBAAiB,KAAK,cAAc,GAAG;GAE7C,IAAI,mBAAmB,MACrB,OAAO;IAAE,MAAM,EAAE,OAAO,YAAY;IAAG,QAAQ;GAAI;GAGrD,MAAM,eAAe,KAAK,SAAS;GACnC,IAAI,CAAC,cACH,OAAO;IAAE,MAAM,EAAE,OAAO,YAAY;IAAG,QAAQ;GAAI;GAGrD,MAAM,KAAK,qBAAqB,GAAG;GACnC,MAAM,cAAc,oBAAoB,KAAK,aAAa,MAAM;GAEhE,IAAI,KAAK,QACP,MAAM,KAAK,OAAO,GAAG;GAGvB,MAAM,aAAa,cAAc,iBAAiB,GAAG;GACrD,MAAM,mBAAmB,MAAM,cAAc,gBAC3C,YACA,aAAa,MACf;GAEA,IAAI,cAAc,gBAAgB,gBAAgB,GAChD,OAAO;GAGT,MAAM,WAAW,MAAM,cAAc,eACnC,aAAa,SACb,KACA,gBACF;GAEA,MAAM,cAAc,mBAAmB,KAAK,UAAU,aAAa,KAAK;GACxE,MAAM,KAAK,oBAAoB,KAAK,QAAQ;GAE5C,OAAO;EACT,SAAS,OAAO;GACd,OAAO,MAAM,KAAK,YAAY,OAAO,GAAG;EAC1C;CACF;CAEA,cAAsB,KAAuC;EAC3D,IAAI,WAAW,IAAI;EACnB,IAAI;GAEF,MAAM,MAAM,IAAI,IAAI,IAAI,IAAI;GAC5B,CAAC,CAAE,YAAa;EAClB,QAAQ,CAER;EAGA,WAAW,SAAS,WAAW,KAAK,MAAM,IACtC,SAAS,MAAM,KAAK,OAAO,SAAS,CAAC,IACrC;EACJ,IAAI,SAAS,WAAW,GACtB,OAAO;EAET,IAAI,OAAO;EAOX,OAJuB,SAAS,WAAW,GAAG,IAC1C,SAAS,MAAM,CAAC,IAChB;CAGN;CAEA,aAAqB,SACnB,OACA,KACe;EACf,KAAK,MAAM,QAAQ,OAEjB,MAAM,IAAI,IAAI;CAElB;CAEA,MAAc,qBAAqB,KAAuC;EACxE,MAAM,cAAc,SAAS,KAAK,mBAAmB,OAAO,SAAS;GACnE,MAAM,KAAK,GAAG;EAChB,CAAC;CACH;CAEA,OAAe,mBACb,SACc;EACd,MAAM,QAAsB,EAC1B,SAAS,QAAQ,QACnB;EAEA,IAAI,QAAQ,WAAW,KAAA,GACrB,MAAM,SAAS,QAAQ;EAGzB,IAAI,QAAQ,WAAW,KAAA,GACrB,MAAM,SAAS,MAAM,QAAQ,QAAQ,MAAM,IACvC,QAAQ,SACR,CAAC,QAAQ,MAAM;EAGrB,IAAI,QAAQ,UAAU,KAAA,GACpB,MAAM,QAAQ,MAAM,QAAQ,QAAQ,KAAK,IACrC,QAAQ,QACR,CAAC,QAAQ,KAAK;EAGpB,OAAO;CACT;CAEA,aAAqB,oBACnB,KACA,QACe;EACf,IAAI,QACF,MAAM,cAAc,SAAS,QAAQ,OAAO,SAAS;GACnD,MAAM,KAAK,GAAG;EAChB,CAAC;CAEL;CAEA,OAAe,iBAAiB,KAAiC;EAC/D,IAAI;GACF,MAAM,SAAS,KAAK,MAClB,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI,OAAO,CACtC;GACA,IAAI,OAAO;GACX,OAAO;EACT,QAAQ;GACN;EACF;CACF;CAEA,OAAe,gBAAgB,OAA6C;EAC1E,OACE,OAAO,UAAU,YACjB,UAAU,QACV,YAAY,SACZ,OAAO,MAAM,WAAW;CAE5B;CAEA,aAAqB,gBACnB,YACA,QACwC;EACxC,IAAI,CAAC,QAEH,OAAO;EAGT,MAAM,SAAS,MAAM,iBAAiB,QAAQ,YAAY,EACxD,cAAc,MAChB,CAAC;EAED,IAAI,OAAO,QACT,OAAO;GACL,MAAM;IACJ,OAAO;IACP,QAAQ,OAAO,OAAO,KAAK,WAAW;KACpC,SAAS,MAAM;KACf,MAAM,MAAM,MAAM,KAAK,MACrB,OAAO,MAAM,YAAY,SAAS,IAAI,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,CAChE;IACF,EAAE;GACJ;GACA,QAAQ;EACV;EAGF,OAAO,OAAO;CAChB;CAEA,aAAqB,eACnB,SACA,KACA,kBAC6B;EAmB7B,OAAO,MAlBiB,QAAQ;GAC9B,KAAK,OAAO,MAAoC;IAC9C,MAAM,QAAQ,QAAQ;IACtB,MAAM,WAA+B;KACnC,MAAM,GAAG,QAAQ;KACjB,QAAQ,GAAG,UAAU;IACvB;IAEA,IAAI,GAAG,YAAY,KAAA,GACjB,SAAS,UAAU,EAAE;IAGvB,OAAO;GACT;GACA,SAAS;GACT;EACF,CAAC,KAEmB;GAAE,MAAM;GAAM,QAAQ;EAAI;CAChD;CAEA,aAAqB,mBACnB,KACA,UACA,OACe;EACf,IAAI,OACF,MAAM,cAAc,SAAS,OAAO,OAAO,SAAS;GAClD,MAAM,KAAK,KAAK,QAAQ;EAC1B,CAAC;CAEL;CAEA,MAAc,oBACZ,KACA,UACe;EACf,MAAM,cAAc,SAAS,KAAK,kBAAkB,OAAO,SAAS;GAClE,MAAM,KAAK,KAAK,QAAQ;EAC1B,CAAC;CACH;CAEA,MAAc,YACZ,OACA,KAC6B;EAC7B,IAAI,KAAK,iBAAiB;GACxB,MAAM,kBACJ,iBAAiB,QAAQ,wBAAQ,IAAI,MAAM,uBAAuB;GACpE,MAAM,gBAAgB,MAAM,KAAK,gBAAgB,iBAAiB,GAAG;GACrE,IAAI,eACF,OAAO;EAEX;EAEA,OAAO;GACL,MAAM,EACJ,OAAO,iBAAiB,QAAQ,MAAM,UAAU,wBAClD;GACA,QAAQ;EACV;CACF;AACF;;;;;;;AAQA,MAAa,uBACX,SACkB,IAAI,cAAc,IAAI"}

package/dist/types/index.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/types/index.ts"],"mappings":";;;UASiB;;EAEf,SAAS;;EAET;;EAEA,QAAQ;;EAER,SAAS;;EAET;;EAEA,QAAQ;;EAER,SAAS;;EAET;;;UAIe,mBAAmB;;EAElC,OAAO;;EAEP,UAAU;;EAEV;;;UAIe,gBAAgB;;EAE/B,QAAQ,YAAY;;EAEpB,SAAS,aAAa;;EAEtB,SAAS,eAAe;;EAExB,SAAS,0BAA0B;;;;;;;KAQzB,kBAAkB,WAC5B,gBAAgB,gCAAgC,WAAW;;;;;;KAOjD,mBACV,gBAAgB,sCACd,KAAK,gBAAgB,kBAAkB;EACzC,QAAQ;;UAGA;EACR,QAAQ,YAAY;EACpB,SAAS,aAAa;EACtB,SAAS;EACT,QAAQ;;;;;;;KAQE,aAAa,gBAAgB,eAAe,iBACrD,WAAW,UAAU,mBAAmB,QAAQ;;KAIvC,eAAe,uBAAuB;EAChD,KAAK;EACL,SAAS;EACT,MAAM,MAAM,QAAQ,wBAAwB,QAAQ;MAChD,QAAQ,kCAAkC;;KAGpC,WAAW,aAAa,8BACjC,WAAW,OAAO,eAAe,KAAK;;;;;;KAQ7B,0BACV,gBAAgB,eAAe,iBAE9B,WAAW,UAAU,kBAAkB,QAAQ;;KAItC,YAAY,KAAK,sBAAsB;;KAGvC,cAAc,KAAK,sBAAsB;;KAGzC,aACV,KAAK,mBACL,KAAK,uBACF;;KAGO,aACV,OAAO,OACP,KAAK,sBACF,QAAQ,kCAAkC"}

package/dist/types/index.mjs

@@ -1 +0,0 @@
-export {};

package/dist/utils/index.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/utils/index.ts"],"mappings":";;;;;;;;;;;;;;cAca,qBAAsB,WAAW"}

package/dist/utils/index.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/utils/index.ts"],"sourcesContent":["/**\n * Utility helpers for webhook internals.\n *\n * @module @zap-studio/webhooks/utils\n */\n\n/**\n * Compares two strings in constant time to prevent timing attacks.\n *\n * @example\n * ```ts\n * const isEqual = constantTimeEquals(\"string1\", \"string2\"); // returns false\n * ```\n */\nexport const constantTimeEquals = (a: string, b: string): boolean => {\n  if (a.length !== b.length) {\n    return false;\n  }\n\n  let result = 0;\n  for (let i = 0; i < a.length; i += 1) {\n    // oxlint-disable-next-line no-bitwise, unicorn/prefer-code-point -- XOR is the constant-time compare trick; charCodeAt reads each char with the same cost, and inputs are plain ASCII hex.\n    result |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n\n  return result === 0;\n};\n"],"mappings":";;;;;;;;;;;;;;AAcA,MAAa,sBAAsB,GAAW,MAAuB;CACnE,IAAI,EAAE,WAAW,EAAE,QACjB,OAAO;CAGT,IAAI,SAAS;CACb,KAAK,IAAI,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK,GAEjC,UAAU,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;CAG5C,OAAO,WAAW;AACpB"}

package/dist/verify.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"verify.d.mts","names":[],"sources":["../src/verify.ts"],"mappings":";;cAUM;WACJ;WACA;WACA;WACA;;KAGG,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA2CrB,uBACX,YACA,QACA;EAEA;EACA;EACA,OAAO;MACL"}

package/dist/verify.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"verify.mjs","names":[],"sources":["../src/verify.ts"],"sourcesContent":["/**\n * Signature verification helpers for webhook requests.\n *\n * @module @zap-studio/webhooks/verify\n */\n\nimport { VerificationError } from \"./errors.js\";\nimport type { VerifyFn } from \"./types/index.js\";\nimport { constantTimeEquals } from \"./utils/index.js\";\n\nconst HMAC_HASH = {\n  sha1: \"SHA-1\",\n  sha256: \"SHA-256\",\n  sha384: \"SHA-384\",\n  sha512: \"SHA-512\",\n} as const;\n\ntype HmacAlgorithm = keyof typeof HMAC_HASH;\n\nconst toHex = (bytes: Uint8Array): string =>\n  Array.from(bytes, (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n\nconst normalizeSignature = (signature: string): string =>\n  signature\n    .replace(/^[a-z0-9-]+=/iu, \"\")\n    .trim()\n    .toLowerCase();\n\n/**\n * Creates a webhook verifier that validates an HMAC signature from a request header.\n *\n * The verifier imports the provided string secret once, computes an HMAC from\n * `req.rawBody`, normalizes the incoming header value, and compares both\n * signatures in constant time.\n *\n * Header values like `sha256=<hex>` are supported so common provider formats\n * such as GitHub work without extra parsing.\n *\n * @example\n * ```ts\n * import { createWebhookRouter } from \"@zap-studio/webhooks\";\n * import { createHmacVerifier } from \"@zap-studio/webhooks/verify\";\n *\n * const router = createWebhookRouter({\n *   verify: createHmacVerifier({\n *     headerName: \"x-hub-signature-256\",\n *     secret: process.env.GITHUB_WEBHOOK_SECRET!,\n *   }),\n * });\n * ```\n *\n * @param options - Verifier configuration.\n * @param options.headerName - Header containing the provider signature.\n * @param options.secret - Shared HMAC secret as a string.\n * @param options.algo - HMAC hash algorithm. Defaults to `\"sha256\"`.\n * @returns A router-compatible request verifier.\n *\n * @throws {VerificationError}\n * Thrown when verifier setup fails or request verification does not pass.\n */\nexport const createHmacVerifier = ({\n  headerName,\n  secret,\n  algo = \"sha256\",\n}: {\n  headerName: string;\n  secret: string;\n  algo?: HmacAlgorithm;\n}): VerifyFn => {\n  if (globalThis.crypto?.subtle === undefined) {\n    throw new VerificationError(\n      \"Web Crypto API is unavailable in this runtime\"\n    );\n  }\n\n  const { subtle } = globalThis.crypto;\n\n  const hash = HMAC_HASH[algo];\n  if (!hash) {\n    throw new VerificationError(`Unsupported HMAC algorithm: ${algo}`);\n  }\n\n  const keyPromise = subtle.importKey(\n    \"raw\",\n    new TextEncoder().encode(secret),\n    { hash, name: \"HMAC\" },\n    false,\n    [\"sign\"]\n  );\n\n  return async (req) => {\n    const actual = req.headers.get(headerName);\n    if (actual === null || actual.length === 0) {\n      throw new VerificationError(`Missing signature header: ${headerName}`);\n    }\n\n    const key = await keyPromise;\n    const signature = await subtle.sign(\n      \"HMAC\",\n      key,\n      new Uint8Array(req.rawBody)\n    );\n    const expected = toHex(new Uint8Array(signature));\n\n    if (!constantTimeEquals(expected, normalizeSignature(actual))) {\n      throw new VerificationError(\n        `Invalid signature for header: ${headerName}`\n      );\n    }\n  };\n};\n"],"mappings":";;;;;;;;AAUA,MAAM,YAAY;CAChB,MAAM;CACN,QAAQ;CACR,QAAQ;CACR,QAAQ;AACV;AAIA,MAAM,SAAS,UACb,MAAM,KAAK,QAAQ,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AAEzE,MAAM,sBAAsB,cAC1B,UACG,QAAQ,kBAAkB,EAAE,CAAC,CAC7B,KAAK,CAAC,CACN,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCjB,MAAa,sBAAsB,EACjC,YACA,QACA,OAAO,eAKO;CACd,IAAI,WAAW,QAAQ,WAAW,KAAA,GAChC,MAAM,IAAI,kBACR,+CACF;CAGF,MAAM,EAAE,WAAW,WAAW;CAE9B,MAAM,OAAO,UAAU;CACvB,IAAI,CAAC,MACH,MAAM,IAAI,kBAAkB,+BAA+B,MAAM;CAGnE,MAAM,aAAa,OAAO,UACxB,OACA,IAAI,YAAY,CAAC,CAAC,OAAO,MAAM,GAC/B;EAAE;EAAM,MAAM;CAAO,GACrB,OACA,CAAC,MAAM,CACT;CAEA,OAAO,OAAO,QAAQ;EACpB,MAAM,SAAS,IAAI,QAAQ,IAAI,UAAU;EACzC,IAAI,WAAW,QAAQ,OAAO,WAAW,GACvC,MAAM,IAAI,kBAAkB,6BAA6B,YAAY;EAGvE,MAAM,MAAM,MAAM;EAClB,MAAM,YAAY,MAAM,OAAO,KAC7B,QACA,KACA,IAAI,WAAW,IAAI,OAAO,CAC5B;EAGA,IAAI,CAAC,mBAFY,MAAM,IAAI,WAAW,SAAS,CAEhB,GAAG,mBAAmB,MAAM,CAAC,GAC1D,MAAM,IAAI,kBACR,iCAAiC,YACnC;CAEJ;AACF"}