Webhooks

const source = await duraton.webhooks.sources.create({
  name: "Stripe",
  app: "shop",
  eventName: "payment.received",
});

console.log(source.receiveUrl); // https://webhooks.duraton.dev/9f3c8a2b... - give this to your provider
console.log(source.secret);     // shown once - store it now

# what your provider does, signed with the source's secret
curl -X POST "https://webhooks.duraton.dev/9f3c8a2b..." \
  -H 'content-type: application/json' \
  -H 'x-duraton-signature: t=1752400000&s=<hmacHex>' \
  -d '{ "amount": 4200, "currency": "usd" }'

const source = await duraton.webhooks.sources.create({
  name: "Stripe",
  app: "shop",
  eventName: "payment.received",
  scheme: "stripe",
  secret: process.env.STRIPE_WEBHOOK_SECRET, // Stripe's signing secret, not a generated one
});

{ "error": "signature verification failed", "reason": "timestamp_out_of_tolerance" }

const source = await duraton.webhooks.sources.create({
  name: "Stripe",
  app: "shop",
  eventName: "payment.received",
  scheme: "stripe",
  secret: process.env.STRIPE_WEBHOOK_SECRET,
  dedupeKey: "id", // Stripe's event id: `evt_...`
});

const { deliveries } = await duraton.webhooks.sourceDeliveries.list({ status: "unauthorized" });

const detail = await duraton.webhooks.sourceDeliveries.get(deliveries[0].id);
for (const a of detail.attempts) console.log(a.trigger, a.status, a.actor);

// re-ingest a previously verified delivery's stored body; the result reports what it produced
const result = await duraton.webhooks.sourceDeliveries.replay(detail.id);
console.log(result.status, result.eventId, result.runId); // "ingested" | "deduped"; eventId/runId set only when it ingested

const endpoint = await duraton.webhooks.endpoints.create({
  name: "Acme prod",
  app: "shop", // omit to subscribe to every app in the project
  url: "https://hooks.example.com/duraton",
  eventKinds: ["run.failed", "run.succeeded"],
});

console.log(endpoint.secret); // shown once - this is what signs the deliveries

import { workflow } from "@duraton/sdk";

export const orderShip = workflow({
  name: "order.ship",
  handler: async (ctx) => {
    await ctx.webhook.send("notify-partner", {
      url: "https://partner.example.com/shipments",
      data: { orderId: ctx.event.data.orderId, shipped: true },
    });
  },
});

import { createHmac, timingSafeEqual } from "node:crypto";

const MAX_SKEW_SECONDS = 300;

export function verify(rawBody: string, header: string, secret: string): boolean {
  const params = new URLSearchParams(header);           // t=<unix>&s=<hmacHex>
  const t = Number(params.get("t"));
  const sig = params.get("s") ?? "";
  if (Math.abs(Math.floor(Date.now() / 1000) - t) > MAX_SKEW_SECONDS) return false;

  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  return sig.length === expected.length && timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
}

const { deliveries } = await duraton.webhooks.deliveries.list({ status: "exhausted" });

const detail = await duraton.webhooks.deliveries.get(deliveries[0].id);
for (const a of detail.attempts) console.log(a.statusCode, a.durationMs, a.error);

await duraton.webhooks.deliveries.redeliver(detail.id); // re-queue it for another attempt