Handle a webhook

import { LuaWebhook, Data } from 'lua-cli';
import { z } from 'zod';

// Read at compile time: a literal or a const, never env() or process.env.
const SIGNING_SECRET = 'whsec_9f2e6c1a2b7d4c039e88';

const settlement = z.object({
  eventId: z.string(),
  orderNumber: z.string(),
  amount: z.number(),
});

export default new LuaWebhook({
  name: 'payment-settled',
  description: 'Marks an order as paid when the billing system confirms settlement',
  secret: SIGNING_SECRET,
  bodySchema: settlement,
  async execute({ body }) {
    const parsed = settlement.safeParse(body);
    if (!parsed.success) return { received: false, error: 'Body does not match the schema' };
    const event = parsed.data;

    const seen = await Data.get('webhook-events', { eventId: { $eq: event.eventId } }, 1, 1);
    if (seen.data.length > 0) return { received: true, duplicate: true };
    await Data.create('webhook-events', { eventId: event.eventId, receivedAt: new Date().toISOString() });

    const page = await Data.get('orders', { orderNumber: { $eq: event.orderNumber } }, 1, 1);
    const order = page.data[0];
    if (!order) return { received: true, orderFound: false };
    await Data.update('orders', order.id, { status: 'paid', paidAmount: event.amount });
    return { received: true, orderFound: true };
  },
});

…
🚀 Executing webhook...
Query: {}
Headers: {}
Body: {
  "eventId": "evt_abc123",
  "orderNumber": "A-1001",
  "amount": 42
}

✅ Webhook execution successful!

Webhook returned: Object — fields: received, orderFound
Output:
{ received: true, orderFound: false }

============================================================
⚙️  Production Webhooks
============================================================

🪝 payment-settled
   Webhook ID: 1801aee9-5b6d-41e8-bbb8-dca0d11c3e5f
   Deployed ⭐
   Deployed: 12/09/2026, 13:49:45
…