fix(listen): preserve webhook signatures when forwarding

package.json

@@ -30,6 +30,7 @@
 		"@polar-sh/sdk": "^0.47.0",
 		"effect": "^3.17.7",
 		"eventsource": "^4.1.0",
+		"lossless-json": "^4.3.0",
 		"open": "^10.2.0"
 	},
 	"devDependencies": {

src/commands/listen.test.ts

@@ -3,6 +3,7 @@ import { Effect, Fiber } from "effect";
 import {
   type CreateEventSource,
   type ListenEventSource,
+  signedWebhookBody,
   startListening,
 } from "./listen";
 
@@ -34,6 +35,11 @@ class FakeEventSource implements ListenEventSource {
   emit(data: unknown) {
     this.onmessage?.({ data: JSON.stringify(data) } as MessageEvent);
   }
+
+  /** Simulate the server pushing a message frame with exact raw bytes. */
+  emitRaw(data: string) {
+    this.onmessage?.({ data } as MessageEvent);
+  }
 }
 
 /** Returns the event source at `index`, asserting it exists. */
@@ -77,6 +83,32 @@ afterEach(async () => {
   FakeEventSource.instances = [];
 });
 
+describe("signedWebhookBody", () => {
+  test("rebuilds the compact body from a spaced frame, keeping number literals", () => {
+    const frame =
+      '{"key": "webhook.created", "payload": {"webhook_event_id": "whid_1", "payload": {"type": "customer.state_changed", "data": {"consumed_units": 0.0, "credited_units": 10.50, "balance": 1e3, "count": 42}}}}';
+
+    expect(signedWebhookBody(frame)).toBe(
+      '{"type":"customer.state_changed","data":{"consumed_units":0.0,"credited_units":10.50,"balance":1e3,"count":42}}',
+    );
+  });
+
+  test("preserves key order and nested structure", () => {
+    const frame =
+      '{"payload": {"payload": {"b": [1.0, {"z": 2.50}], "a": null, "ok": true}}}';
+
+    expect(signedWebhookBody(frame)).toBe(
+      '{"b":[1.0,{"z":2.50}],"a":null,"ok":true}',
+    );
+  });
+
+  test("returns undefined when the frame carries no body", () => {
+    expect(signedWebhookBody('{"key": "connected", "secret": "whsec"}')).toBeUndefined();
+    expect(signedWebhookBody('{"payload": {}}')).toBeUndefined();
+    expect(signedWebhookBody('"just a string"')).toBeUndefined();
+  });
+});
+
 describe("startListening", () => {
   test("opens a single event source for the listen url", () => {
     run();
@@ -140,6 +172,23 @@ describe("startListening", () => {
     );
   });
 
+  test("forwards the signed bytes for usage metering payloads", () => {
+    const forward = mock(okResponse) as unknown as typeof fetch;
+    run({ forward });
+
+    instanceAt(0).emitRaw(
+      '{"id": "evt_1", "key": "webhook", "payload": {"webhook_event_id": "whid_1", "payload": {"type": "customer.state_changed", "timestamp": "2026-01-01T00:00:00Z", "data": {"active_meters": [{"consumed_units": 0.0, "credited_units": 10.50, "balance": 1e3}]}}}, "headers": {"user-agent": "polar.sh webhooks", "content-type": "application/json", "webhook-id": "wh_1", "webhook-timestamp": "12345", "webhook-signature": "sig"}}',
+    );
+
+    expect(forward).toHaveBeenCalledWith(
+      "http://localhost:3000/webhook",
+      expect.objectContaining({
+        method: "POST",
+        body: '{"type":"customer.state_changed","timestamp":"2026-01-01T00:00:00Z","data":{"active_meters":[{"consumed_units":0.0,"credited_units":10.50,"balance":1e3}]}}',
+      }),
+    );
+  });
+
   test("reconnects when the server sends a reconnect event", () => {
     run();
 

src/commands/listen.ts

@@ -5,6 +5,7 @@ import {
   EventSource,
   type EventSourceInit,
 } from "eventsource";
+import { parse, stringify } from "lossless-json";
 import { environmentPrompt } from "../prompts/environment";
 import { organizationLoginPrompt } from "../prompts/organizations";
 import {
@@ -56,6 +57,23 @@ export interface StartListeningOptions {
 const defaultCreateEventSource: CreateEventSource = (listenUrl, init) =>
   new EventSource(listenUrl, init);
 
+const hasPayload = (value: unknown): value is { payload: unknown } =>
+  typeof value === "object" && value !== null && "payload" in value;
+
+/**
+ * Rebuilds the exact bytes Polar signed for the webhook body embedded in a
+ * listen stream frame, or `undefined` when the frame carries no body.
+ */
+export const signedWebhookBody = (frame: string): string | undefined => {
+  const parsed = parse(frame);
+
+  if (!hasPayload(parsed) || !hasPayload(parsed.payload)) {
+    return undefined;
+  }
+
+  return stringify(parsed.payload.payload);
+};
+
 /**
  * Opens the CLI listen stream and forwards incoming webhook events to the local
  * server. When the server emits a `reconnect` event the current connection is
@@ -130,16 +148,17 @@ export const startListening = ({
 
         const webhookEvent =
           Schema.decodeUnknownEither(ListenWebhookEvent)(json);
+        const body = signedWebhookBody(event.data);
 
-        if (Either.isLeft(webhookEvent)) {
+        if (Either.isLeft(webhookEvent) || body === undefined) {
           console.error(">> Failed to decode event");
           return;
         }
 
         forward(forwardUrl, {
           method: "POST",
           headers: webhookEvent.right.headers,
-          body: JSON.stringify(webhookEvent.right.payload.payload),
+          body,
         })
           .then((res) => {
             const cyan = "\x1b[36m";