hooklatch 0.0.0-stage → 1.0.0

package/dist/adapters/nextjs.js

@@ -0,0 +1,56 @@
+import { HooklatchError } from '../errors.js';
+import { verifyRequest } from '../index.js';
+export function createWebhookHandler(options) {
+    try {
+        // Observe credential descriptors before object-rest can invoke an accessor
+        // that replaces itself. Existing HMAC top-level getter snapshots stay intact.
+        const credentials = ['publicKeys', 'expectedUserId', 'secrets', 'secret'].map((name) => ({
+            name, property: Object.getOwnPropertyDescriptor(options, name),
+        }));
+        const { handler, ...verifyOptions } = options;
+        for (const { name, property } of credentials) {
+            const preserve = verifyOptions.provider === 'fal'
+                || (verifyOptions.provider === 'vercel' && (name === 'publicKeys' || name === 'expectedUserId'));
+            if (preserve && property !== undefined)
+                Object.defineProperty(verifyOptions, name, property);
+        }
+        // Object rest omits non-enumerable fields; own configuration presence is meaningful.
+        if (Object.hasOwn(options, 'providerOptions') && !Object.hasOwn(verifyOptions, 'providerOptions')) {
+            Object.defineProperty(verifyOptions, 'providerOptions', {
+                value: options.providerOptions, enumerable: true, configurable: true, writable: true,
+            });
+        }
+        return requestHandler(verifyOptions, handler);
+    }
+    catch {
+        // Contain caller-owned accessors without exposing their thrown values.
+        return async () => new Response('Internal Server Error', { status: 500 });
+    }
+}
+function requestHandler(verifyOptions, handler) {
+    return async (request) => {
+        const encoding = request.headers.get('content-encoding');
+        if (encoding && encoding.toLowerCase() !== 'identity') {
+            return new Response('Bad Request', { status: 400 });
+        }
+        let verification;
+        try {
+            const result = await verifyRequest(request, verifyOptions);
+            if (!result.ok) {
+                if (result.reason === 'body-too-large') {
+                    return new Response('Payload Too Large', { status: 413 });
+                }
+                return new Response('Bad Request', { status: 400 });
+            }
+            verification = result;
+        }
+        catch (err) {
+            if (err instanceof HooklatchError) {
+                return new Response('Internal Server Error', { status: 500 });
+            }
+            throw err;
+        }
+        return await handler(request, verification);
+    };
+}
+//# sourceMappingURL=nextjs.js.map

package/dist/adapters/nextjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nextjs.js","sourceRoot":"","sources":["../../src/adapters/nextjs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAO5C,MAAM,UAAU,oBAAoB,CAAC,OAAkC;IACrE,IAAI,CAAC;QACH,2EAA2E;QAC3E,8EAA8E;QAC9E,MAAM,WAAW,GAAG,CAAC,YAAY,EAAE,gBAAgB,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACvF,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC;SAC/D,CAAC,CAAC,CAAC;QAEJ,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAC;QAE9C,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,WAAW,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,KAAK,KAAK;mBAC5C,CAAC,aAAa,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC;YAEnG,IAAI,QAAQ,IAAI,QAAQ,KAAK,SAAS;gBAAE,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC/F,CAAC;QAED,qFAAqF;QACrF,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAClG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,iBAAiB,EAAE;gBACtD,KAAK,EAAE,OAAO,CAAC,eAAe,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI;aACrF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,cAAc,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,OAAO,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,aAA4B,EAAE,OAA6C;IAG3E,OAAO,KAAK,EAAE,OAAgB,EAAqB,EAAE;QACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAEzD,IAAI,QAAQ,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,UAAU,EAAE,CAAC;YACtD,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,YAAkC,CAAC;QAEvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YAE3D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;oBACvC,OAAO,IAAI,QAAQ,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC5D,CAAC;gBAED,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACtD,CAAC;YAED,YAAY,GAAG,MAAM,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;gBAClC,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,OAAO,MAAM,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC9C,CAAC,CAAC;AACJ,CAAC"}

package/dist/adapters/shared.d.ts

@@ -0,0 +1,8 @@
+/** Shared helpers for framework adapters. Node/Web runtime agnostic except where noted. */
+export declare class HttpError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+export declare function toUint8Array(value: Uint8Array | ArrayBuffer | string): Uint8Array;
+export declare function readNodeStream(stream: AsyncIterable<unknown>, maxBytes: number): Promise<Uint8Array>;
+//# sourceMappingURL=shared.d.ts.map

package/dist/adapters/shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../src/adapters/shared.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAE3F,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK5C;AAMD,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,GAAG,MAAM,GAAG,UAAU,CAOjF;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAgC1G"}

package/dist/adapters/shared.js

@@ -0,0 +1,53 @@
+/** Shared helpers for framework adapters. Node/Web runtime agnostic except where noted. */
+export class HttpError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.name = 'HttpError';
+        this.status = status;
+    }
+}
+function isText(value) {
+    return typeof value === 'string';
+}
+export function toUint8Array(value) {
+    if (value instanceof Uint8Array)
+        return new Uint8Array(value);
+    if (value instanceof ArrayBuffer)
+        return new Uint8Array(value);
+    if (isText(value))
+        return new TextEncoder().encode(value);
+    throw new HttpError(500, 'Internal Server Error');
+}
+export async function readNodeStream(stream, maxBytes) {
+    const chunks = [];
+    let size = 0;
+    try {
+        for await (const chunk of stream) {
+            const bytes = chunk instanceof Uint8Array
+                ? chunk
+                : chunk instanceof ArrayBuffer
+                    ? new Uint8Array(chunk)
+                    : null;
+            if (!bytes)
+                throw new HttpError(500, 'Internal Server Error');
+            size += bytes.byteLength;
+            if (size > maxBytes)
+                throw new HttpError(413, 'Payload Too Large');
+            chunks.push(new Uint8Array(bytes));
+        }
+    }
+    catch (err) {
+        if (err instanceof HttpError)
+            throw err;
+        throw new HttpError(500, 'Internal Server Error');
+    }
+    const output = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        output.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return output;
+}
+//# sourceMappingURL=shared.js.map

package/dist/adapters/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../src/adapters/shared.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAE3F,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,MAAM,CAAS;IACxB,YAAY,MAAc,EAAE,OAAe;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,SAAS,MAAM,CAAC,KAAwC;IACtD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAwC;IACnE,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAE9D,IAAI,KAAK,YAAY,WAAW;QAAE,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAE/D,IAAI,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAA8B,EAAE,QAAgB;IACnF,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IAEb,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,KAAK,YAAY,UAAU;gBACvC,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,KAAK,YAAY,WAAW;oBAC5B,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC;oBACvB,CAAC,CAAC,IAAI,CAAC;YAEX,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;YAC9D,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;YAEzB,IAAI,IAAI,GAAG,QAAQ;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACnE,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,SAAS;YAAE,MAAM,GAAG,CAAC;QACxC,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/cjs/adapters/cloudflare.cjs

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createWebhookHandler = createWebhookHandler;
+const index_js_1 = require("../index.cjs");
+function createWebhookHandler(options) {
+    return async (request, env, ctx) => {
+        const encoding = request.headers.get('content-encoding');
+        if (encoding && encoding.toLowerCase() !== 'identity') {
+            return new Response('Bad Request', { status: 400 });
+        }
+        let verification;
+        try {
+            const verifyOptions = options.options(env);
+            const result = await (0, index_js_1.verifyRequest)(request, verifyOptions);
+            if (!result.ok) {
+                if (result.reason === 'body-too-large') {
+                    return new Response('Payload Too Large', { status: 413 });
+                }
+                return new Response('Bad Request', { status: 400 });
+            }
+            verification = result;
+        }
+        catch {
+            // This boundary contains setup/verification only, never the user handler.
+            return new Response('Internal Server Error', { status: 500 });
+        }
+        return await options.handler(request, env, ctx, verification);
+    };
+}

package/dist/cjs/adapters/cloudflare.d.cts

@@ -0,0 +1,10 @@
+import type { VerificationSuccess, VerifyOptions } from '../types.cjs';
+export interface ExecutionContextLike {
+    waitUntil?(promise: Promise<unknown>): void;
+    passThroughOnException?(): void;
+}
+export interface WorkerWebhookHandlerOptions<Env = unknown> {
+    readonly options: (env: Env) => VerifyOptions;
+    readonly handler: (request: Request, env: Env, ctx: ExecutionContextLike, success: VerificationSuccess) => Response | Promise<Response>;
+}
+export declare function createWebhookHandler<Env = unknown>(options: WorkerWebhookHandlerOptions<Env>): (request: Request, env: Env, ctx: ExecutionContextLike) => Promise<Response>;

package/dist/cjs/adapters/express.cjs

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createWebhookMiddleware = createWebhookMiddleware;
+const shared_js_1 = require("./shared.cjs");
+const errors_js_1 = require("../errors.cjs");
+const prepare_js_1 = require("../internal/prepare.cjs");
+const verification_js_1 = require("../internal/verification.cjs");
+const headers_js_1 = require("../internal/headers.cjs");
+function createWebhookMiddleware(options) {
+    return async (req, res, next) => {
+        try {
+            const prepared = (0, prepare_js_1.prepareVerification)(options);
+            const normalized = prepared.options;
+            const receivedAt = (0, verification_js_1.readClock)(prepared);
+            const headers = [...(0, headers_js_1.normalizeHeaders)(req.headers)];
+            const maxBytes = normalized.maxBodyBytes;
+            const encodingHeader = req.headers['content-encoding'];
+            const encoding = Array.isArray(encodingHeader) ? encodingHeader.join(',') : encodingHeader;
+            if (encoding && encoding.toLowerCase() !== 'identity') {
+                res.status(400).send('Bad Request');
+                return;
+            }
+            const body = req.body;
+            let rawBody;
+            if (body instanceof Uint8Array) {
+                if (body.byteLength > maxBytes) {
+                    res.status(413).send('Payload Too Large');
+                    return;
+                }
+                rawBody = new Uint8Array(body);
+            }
+            else if (body !== undefined && body !== null) {
+                res.status(500).send('Internal Server Error');
+                return;
+            }
+            else {
+                if (req.readableEnded || req.readableDidRead || req.destroyed || req.readable === false) {
+                    res.status(500).send('Internal Server Error');
+                    return;
+                }
+                rawBody = await (0, shared_js_1.readNodeStream)(req, maxBytes);
+            }
+            const result = await (0, verification_js_1.verifyPrepared)({ rawBody, headers }, prepared, receivedAt);
+            if (!result.ok) {
+                const status = result.reason === 'body-too-large' ? 413 : 400;
+                res.status(status).send(status === 413 ? 'Payload Too Large' : 'Bad Request');
+                return;
+            }
+            req.webhook = result;
+        }
+        catch (err) {
+            if (err instanceof shared_js_1.HttpError) {
+                res.status(err.status).send(err.message);
+                return;
+            }
+            if (err instanceof errors_js_1.HooklatchError) {
+                res.status(500).send('Internal Server Error');
+                return;
+            }
+            next(err);
+            return;
+        }
+        next();
+    };
+}

package/dist/cjs/adapters/express.d.cts

@@ -0,0 +1,8 @@
+import type { RequestHandler } from 'express';
+import type { VerificationSuccess, VerifyOptions } from '../types.cjs';
+declare module 'express-serve-static-core' {
+    interface Request {
+        webhook?: VerificationSuccess;
+    }
+}
+export declare function createWebhookMiddleware(options: VerifyOptions): RequestHandler;

package/dist/cjs/adapters/hono.cjs

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createWebhookMiddleware = createWebhookMiddleware;
+const errors_js_1 = require("../errors.cjs");
+const index_js_1 = require("../index.cjs");
+function createWebhookMiddleware(options) {
+    return async (c, next) => {
+        try {
+            const encoding = c.req.raw.headers.get('content-encoding');
+            if (encoding && encoding.toLowerCase() !== 'identity') {
+                return c.text('Bad Request', 400);
+            }
+            const result = await (0, index_js_1.verifyRequest)(c.req.raw, options);
+            if (!result.ok) {
+                if (result.reason === 'body-too-large') {
+                    return c.text('Payload Too Large', 413);
+                }
+                return c.text('Bad Request', 400);
+            }
+            c.set('webhook', result);
+        }
+        catch (err) {
+            if (err instanceof errors_js_1.HooklatchError) {
+                return c.text('Internal Server Error', 500);
+            }
+            throw err;
+        }
+        await next();
+    };
+}

package/dist/cjs/adapters/hono.d.cts

@@ -0,0 +1,11 @@
+import type { MiddlewareHandler } from 'hono';
+import type { VerificationSuccess, VerifyOptions } from '../types.cjs';
+declare module 'hono' {
+    interface ContextVariableMap {
+        webhook?: VerificationSuccess;
+    }
+}
+export type WebhookVariables = {
+    webhook: VerificationSuccess;
+};
+export declare function createWebhookMiddleware(options: VerifyOptions): MiddlewareHandler;

package/dist/cjs/adapters/nextjs.cjs

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createWebhookHandler = createWebhookHandler;
+const errors_js_1 = require("../errors.cjs");
+const index_js_1 = require("../index.cjs");
+function createWebhookHandler(options) {
+    try {
+        // Observe credential descriptors before object-rest can invoke an accessor
+        // that replaces itself. Existing HMAC top-level getter snapshots stay intact.
+        const credentials = ['publicKeys', 'expectedUserId', 'secrets', 'secret'].map((name) => ({
+            name, property: Object.getOwnPropertyDescriptor(options, name),
+        }));
+        const { handler, ...verifyOptions } = options;
+        for (const { name, property } of credentials) {
+            const preserve = verifyOptions.provider === 'fal'
+                || (verifyOptions.provider === 'vercel' && (name === 'publicKeys' || name === 'expectedUserId'));
+            if (preserve && property !== undefined)
+                Object.defineProperty(verifyOptions, name, property);
+        }
+        // Object rest omits non-enumerable fields; own configuration presence is meaningful.
+        if (Object.hasOwn(options, 'providerOptions') && !Object.hasOwn(verifyOptions, 'providerOptions')) {
+            Object.defineProperty(verifyOptions, 'providerOptions', {
+                value: options.providerOptions, enumerable: true, configurable: true, writable: true,
+            });
+        }
+        return requestHandler(verifyOptions, handler);
+    }
+    catch {
+        // Contain caller-owned accessors without exposing their thrown values.
+        return async () => new Response('Internal Server Error', { status: 500 });
+    }
+}
+function requestHandler(verifyOptions, handler) {
+    return async (request) => {
+        const encoding = request.headers.get('content-encoding');
+        if (encoding && encoding.toLowerCase() !== 'identity') {
+            return new Response('Bad Request', { status: 400 });
+        }
+        let verification;
+        try {
+            const result = await (0, index_js_1.verifyRequest)(request, verifyOptions);
+            if (!result.ok) {
+                if (result.reason === 'body-too-large') {
+                    return new Response('Payload Too Large', { status: 413 });
+                }
+                return new Response('Bad Request', { status: 400 });
+            }
+            verification = result;
+        }
+        catch (err) {
+            if (err instanceof errors_js_1.HooklatchError) {
+                return new Response('Internal Server Error', { status: 500 });
+            }
+            throw err;
+        }
+        return await handler(request, verification);
+    };
+}

package/dist/cjs/adapters/nextjs.d.cts

@@ -0,0 +1,5 @@
+import type { VerificationSuccess, VerifyOptions } from '../types.cjs';
+export type NextWebhookHandlerOptions = VerifyOptions & {
+    readonly handler: (request: Request, success: VerificationSuccess) => Response | Promise<Response>;
+};
+export declare function createWebhookHandler(options: NextWebhookHandlerOptions): (request: Request) => Promise<Response>;

package/dist/cjs/adapters/shared.cjs

@@ -0,0 +1,58 @@
+"use strict";
+/** Shared helpers for framework adapters. Node/Web runtime agnostic except where noted. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpError = void 0;
+exports.toUint8Array = toUint8Array;
+exports.readNodeStream = readNodeStream;
+class HttpError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.name = 'HttpError';
+        this.status = status;
+    }
+}
+exports.HttpError = HttpError;
+function isText(value) {
+    return typeof value === 'string';
+}
+function toUint8Array(value) {
+    if (value instanceof Uint8Array)
+        return new Uint8Array(value);
+    if (value instanceof ArrayBuffer)
+        return new Uint8Array(value);
+    if (isText(value))
+        return new TextEncoder().encode(value);
+    throw new HttpError(500, 'Internal Server Error');
+}
+async function readNodeStream(stream, maxBytes) {
+    const chunks = [];
+    let size = 0;
+    try {
+        for await (const chunk of stream) {
+            const bytes = chunk instanceof Uint8Array
+                ? chunk
+                : chunk instanceof ArrayBuffer
+                    ? new Uint8Array(chunk)
+                    : null;
+            if (!bytes)
+                throw new HttpError(500, 'Internal Server Error');
+            size += bytes.byteLength;
+            if (size > maxBytes)
+                throw new HttpError(413, 'Payload Too Large');
+            chunks.push(new Uint8Array(bytes));
+        }
+    }
+    catch (err) {
+        if (err instanceof HttpError)
+            throw err;
+        throw new HttpError(500, 'Internal Server Error');
+    }
+    const output = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        output.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return output;
+}

package/dist/cjs/adapters/shared.d.cts

@@ -0,0 +1,7 @@
+/** Shared helpers for framework adapters. Node/Web runtime agnostic except where noted. */
+export declare class HttpError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+export declare function toUint8Array(value: Uint8Array | ArrayBuffer | string): Uint8Array;
+export declare function readNodeStream(stream: AsyncIterable<unknown>, maxBytes: number): Promise<Uint8Array>;

package/dist/cjs/core.cjs

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verify = verify;
+exports.createVerifier = createVerifier;
+exports.verifyRequest = verifyRequest;
+const errors_js_1 = require("./errors.cjs");
+const prepare_js_1 = require("./internal/prepare.cjs");
+const headers_js_1 = require("./internal/headers.cjs");
+const body_js_1 = require("./internal/body.cjs");
+const verification_js_1 = require("./internal/verification.cjs");
+async function verify(request, options) {
+    return (0, verification_js_1.verifyPrepared)(request, (0, prepare_js_1.prepareVerification)(options));
+}
+function createVerifier(options) {
+    const prepared = (0, prepare_js_1.prepareVerification)(options);
+    return (request) => (0, verification_js_1.verifyPrepared)(request, prepared);
+}
+/** Consumes the original Request once. Successful callers use result.rawBody. */
+async function verifyRequest(request, options) {
+    const prepared = (0, prepare_js_1.prepareVerification)(options);
+    const receivedAt = (0, verification_js_1.readClock)(prepared);
+    if (!(request instanceof Request))
+        throw new errors_js_1.HooklatchError('invalid-input', 'A Web Request is required.');
+    const headers = (0, headers_js_1.normalizeHeaders)(request.headers);
+    const rawBody = await (0, body_js_1.readBody)(request, prepared.options.maxBodyBytes);
+    if (rawBody === null)
+        return (0, verification_js_1.failure)(prepared, 'body-too-large', 'Request body exceeds the configured limit.');
+    // Normalize to tuples so byte and header snapshots share the raw-input path.
+    return (0, verification_js_1.verifyPrepared)({ rawBody, headers: [...headers] }, prepared, receivedAt);
+}

package/dist/cjs/core.d.cts

@@ -0,0 +1,5 @@
+import type { VerificationResult, VerifyOptions, WebhookRequest } from './types.cjs';
+export declare function verify(request: WebhookRequest, options: VerifyOptions): Promise<VerificationResult>;
+export declare function createVerifier(options: VerifyOptions): (request: WebhookRequest) => Promise<VerificationResult>;
+/** Consumes the original Request once. Successful callers use result.rawBody. */
+export declare function verifyRequest(request: Request, options: VerifyOptions): Promise<VerificationResult>;