better-ship 0.18.0 → 0.19.0

package/src/infrastructure/resend/resend-webhook.ts

@@ -1,11 +1,7 @@
 import type { Resend } from 'resend'
 import { z } from 'zod'
 
-import {
-  WebhookVerificationError,
-  type WebhookVerification,
-  type WebhookVerifier,
-} from '../http/webhook-verification.ts'
+import { WebhookVerificationError, type WebhookVerifier } from '../http/webhook-verification.ts'
 import { parseEmailEvent, type EmailEvent } from './email-event.ts'
 
 // Separate standardwebhooks versions have different prototypes; its error name remains the same.
@@ -35,13 +31,12 @@ export class ResendWebhook implements WebhookVerifier<EmailEvent> {
     private readonly verifier: () => Promise<ResendWebhookClient>,
   ) {}
 
-  /** Verify the raw body and Svix headers. Invalid requests return rejected; configuration and SDK defects propagate. */
-  async verify(body: string, headers: Headers): Promise<WebhookVerification<EmailEvent>> {
+  /** Verify the raw body and Svix headers. Invalid requests throw typed errors; other failures propagate. */
+  async verify(body: string, headers: Headers): Promise<EmailEvent | null> {
     const id = headers.get('svix-id')
     const timestamp = headers.get('svix-timestamp')
     const signature = headers.get('svix-signature')
-    if (!id || !timestamp || !signature)
-      return { outcome: 'rejected', error: new WebhookVerificationError('missing_headers') }
+    if (!id || !timestamp || !signature) throw new WebhookVerificationError('missing_headers')
     const client = await (this.client ??= this.verifier())
     let payload: ReturnType<ResendWebhookClient['verify']>
     try {
@@ -51,20 +46,15 @@ export class ResendWebhook implements WebhookVerifier<EmailEvent> {
         webhookSecret: this.webhookSecret,
       })
     } catch (cause) {
-      if (cause instanceof SyntaxError)
-        return {
-          outcome: 'rejected',
-          error: new WebhookVerificationError('invalid_payload', cause),
-        }
+      if (cause instanceof SyntaxError) throw new WebhookVerificationError('invalid_payload', cause)
       if (!SignatureErrorSchema.safeParse(cause).success) throw cause
-      return {
-        outcome: 'rejected',
-        error: new WebhookVerificationError('invalid_signature', cause),
-      }
+      throw new WebhookVerificationError('invalid_signature', cause)
+    }
+    try {
+      return parseEmailEvent(payload, id)
+    } catch (cause) {
+      if (cause instanceof z.ZodError) throw new WebhookVerificationError('invalid_payload', cause)
+      throw cause
     }
-    const result = parseEmailEvent(payload, id)
-    if (result.outcome === 'invalid')
-      return { outcome: 'rejected', error: new WebhookVerificationError('invalid_payload') }
-    return result
   }
 }

package/src/infrastructure/stripe/payment-webhook.ts

@@ -1,10 +1,6 @@
 import Stripe from 'stripe'
 
-import {
-  WebhookVerificationError,
-  type WebhookVerification,
-  type WebhookVerifier,
-} from '../http/webhook-verification.ts'
+import { WebhookVerificationError, type WebhookVerifier } from '../http/webhook-verification.ts'
 
 /**
  * Authenticate raw Stripe webhook bodies with the SDK's timestamp tolerance and Web Crypto.
@@ -18,31 +14,22 @@ export class StripeWebhookVerifier implements WebhookVerifier<Stripe.Event> {
     private readonly tolerance?: number,
   ) {}
 
-  /** Reject signature and JSON failures. Operational failures propagate without logging. */
-  async verify(body: string, headers: Headers): Promise<WebhookVerification<Stripe.Event>> {
+  /** Throw typed signature and JSON failures. Operational failures propagate without logging. */
+  async verify(body: string, headers: Headers): Promise<Stripe.Event> {
     const signature = headers.get('stripe-signature')
-    if (!signature)
-      return { outcome: 'rejected', error: new WebhookVerificationError('missing_headers') }
+    if (!signature) throw new WebhookVerificationError('missing_headers')
     try {
-      const event = await this.stripe.webhooks.constructEventAsync(
+      return await this.stripe.webhooks.constructEventAsync(
         body,
         signature,
         this.signingSecret,
         this.tolerance,
         Stripe.createSubtleCryptoProvider(),
       )
-      return { outcome: 'event', event }
     } catch (cause) {
       if (cause instanceof Stripe.errors.StripeSignatureVerificationError)
-        return {
-          outcome: 'rejected',
-          error: new WebhookVerificationError('invalid_signature', cause),
-        }
-      if (cause instanceof SyntaxError)
-        return {
-          outcome: 'rejected',
-          error: new WebhookVerificationError('invalid_payload', cause),
-        }
+        throw new WebhookVerificationError('invalid_signature', cause)
+      if (cause instanceof SyntaxError) throw new WebhookVerificationError('invalid_payload', cause)
       throw cause
     }
   }

package/dist/webhook-verification-BBmjkHgI.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"webhook-verification-BBmjkHgI.js","names":[],"sources":["../src/infrastructure/http/webhook-verification.ts"],"sourcesContent":["import { AppError } from '@/core'\n\n/** A webhook cannot be trusted or parsed. The HTTP handler logs the rejection once. */\nexport class WebhookVerificationError extends AppError {\n  readonly _tag = 'WebhookVerificationError'\n  readonly classification = 'terminal'\n\n  /** Keep secrets and payload details out of the public message. */\n  constructor(\n    readonly reason: 'missing_headers' | 'invalid_signature' | 'invalid_payload',\n    cause?: unknown,\n  ) {\n    super(`Webhook rejected: ${reason}`, { cause })\n  }\n}\n\n/** A verified event, an ignored event, or an invalid request. */\nexport type WebhookVerification<Event> =\n  | { readonly outcome: 'event'; readonly event: Event }\n  | { readonly outcome: 'ignored'; readonly type: string }\n  | { readonly outcome: 'rejected'; readonly error: WebhookVerificationError }\n\n/** The provider owns signature verification, timestamp tolerance, and payload parsing. */\nexport interface WebhookVerifier<Event> {\n  /** Verify the exact body before parsing it. Return invalid requests; throw operational failures. */\n  verify(body: string, headers: Headers): Promise<WebhookVerification<Event>>\n}\n"],"mappings":";;;;AAGA,IAAa,2BAAb,cAA8C,SAAS;CAM1C;CALX,AAAS,OAAO;CAChB,AAAS,iBAAiB;;CAG1B,YACE,AAAS,QACT,OACA;EACA,MAAM,qBAAqB,UAAU,EAAE,MAAM,CAAC;EAHrC;CAIX;AACF"}

package/dist/webhook-verification-BuxPzdr4.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"webhook-verification-BuxPzdr4.d.ts","names":[],"sources":["../src/infrastructure/http/webhook-verification.ts"],"mappings":";;;cAGa,iCAAiC;WAMjC;WALF;WACA;;EAGT,YACW,qEACT;;;KAOQ,oBAAoB;WACjB;WAA2B,OAAO;;WAClC;WAA6B;;WAC7B;WAA8B,OAAO;;;UAGnC,gBAAgB;;EAE/B,OAAO,cAAc,SAAS,UAAU,QAAQ,oBAAoB"}