@hookflo/tern 2.2.10 → 3.0.0

package/README.md

@@ -17,6 +17,8 @@ npm install @hookflo/tern
 
 Tern is a zero-dependency TypeScript framework for robust webhook verification across multiple platforms and algorithms.
 
+**Runtime requirements:** Node.js 18+ (or any runtime with Web Crypto + Fetch APIs, such as Deno and Cloudflare Workers).
+
 <img width="1396" height="470" style="border-radius: 10px" alt="tern bird nature" src="https://github.com/user-attachments/assets/5f0da3e6-1aba-4f88-a9d7-9d8698845c39" />
 
 ## Features
@@ -24,7 +26,7 @@ Tern is a zero-dependency TypeScript framework for robust webhook verification a
 - **Algorithm Agnostic**: Decouples platform logic from signature verification — verify based on cryptographic algorithm, not hardcoded platform rules.
 Supports HMAC-SHA256, HMAC-SHA1, HMAC-SHA512, and custom algorithms
 
-- **Platform Specific**: Accurate implementations for **Stripe, GitHub, Supabase, Clerk**, and other platforms
+- **Platform Specific**: Accurate implementations for **Stripe, GitHub, Clerk**, and other platforms
 - **Flexible Configuration**: Custom signature configurations for any webhook format
 - **Type Safe**: Full TypeScript support with comprehensive type definitions
 - **Framework Agnostic**: Works with Express.js, Next.js, Cloudflare Workers, and more
@@ -56,20 +58,16 @@ npm install @hookflo/tern
 ### Basic Usage
 
 ```typescript
-import { WebhookVerificationService, platformManager } from '@hookflo/tern';
-
-// Method 1: Using the service (recommended)
-const result = await WebhookVerificationService.verifyWithPlatformConfig(
-  request,
-  'stripe',
-  'whsec_your_stripe_webhook_secret'
-);
+import { WebhookVerificationService } from '@hookflo/tern';
 
-// Method 2: Using platform manager (for platform-specific operations)
-const stripeResult = await platformManager.verify(request, 'stripe', 'whsec_your_secret');
+const result = await WebhookVerificationService.verify(request, {
+  platform: 'stripe',
+  secret: 'whsec_your_stripe_webhook_secret',
+  toleranceInSeconds: 300,
+});
 
 if (result.isValid) {
-  console.log('Webhook verified!', result.payload);
+  console.log('Webhook verified!', result.eventId, result.payload);
 } else {
   console.log('Verification failed:', result.error);
 }
@@ -147,21 +145,6 @@ console.log(result.payload);
 // }
 ```
 
-### Platform-Specific Usage
-
-```typescript
-import { platformManager } from '@hookflo/tern';
-
-// Run tests for a specific platform
-const testsPassed = await platformManager.runPlatformTests('stripe');
-
-// Get platform configuration
-const config = platformManager.getConfig('stripe');
-
-// Get platform documentation
-const docs = platformManager.getDocumentation('stripe');
-```
-
 ### Platform-Specific Configurations
 
 ```typescript
@@ -213,20 +196,22 @@ const result = await WebhookVerificationService.verify(request, stripeConfig);
 - **Paddle**: HMAC-SHA256 OK Tested
 - **Razorpay**: HMAC-SHA256 Pending
 - **Lemon Squeezy**: HMAC-SHA256 OK Tested
-- **Auth0**: HMAC-SHA256 Pending
 - **WorkOS**: HMAC-SHA256 (`workos-signature`, `t/v1`) OK Tested
 - **WooCommerce**: HMAC-SHA256 (base64 signature) Pending
 - **ReplicateAI**: HMAC-SHA256 (Standard Webhooks style) OK Tested
+- **Sentry**: HMAC-SHA256 (`sentry-hook-signature`) with JSON-stringified payload + issue-alert fallback
+- **Grafana (v12+)**: HMAC-SHA256 (`x-grafana-alerting-signature`) with optional timestamped payload
+- **Doppler**: HMAC-SHA256 (`x-doppler-signature`, `sha256=` prefix)
+- **Sanity**: Stripe-compatible HMAC-SHA256 (`sanity-webhook-signature`, `t=/v1=`)
 - **fal.ai**: ED25519 (`x-fal-webhook-signature`)
 - **Shopify**: HMAC-SHA256 (base64 signature) OK Tested
 - **Vercel**: HMAC-SHA256 Pending
 - **Polar**: HMAC-SHA256 OK Tested
-- **Supabase**: Token-based authentication Pending
 - **GitLab**: Token-based authentication OK Tested
 
 ## Custom Platform Configuration
 
-This framework is fully configuration-driven. You can verify webhooks from any provider—even if it is not built-in—by supplying a custom configuration object. This allows you to support new or proprietary platforms instantly, without waiting for a library update.
+This framework is fully configuration-driven. `timestampHeader` is optional and only needed for providers that send timestamp separately from the signature. You can verify webhooks from any provider—even if it is not built-in—by supplying a custom configuration object. This allows you to support new or proprietary platforms instantly, without waiting for a library update.
 
 ### Example: Standard HMAC-SHA256 Webhook
 
@@ -240,6 +225,7 @@ const acmeConfig = {
     algorithm: 'hmac-sha256',
     headerName: 'x-acme-signature',
     headerFormat: 'raw',
+    // Optional: only include when provider sends timestamp in a separate header
     timestampHeader: 'x-acme-timestamp',
     timestampFormat: 'unix',
     payloadFormat: 'timestamped', // signs as {timestamp}.{body}
@@ -275,14 +261,22 @@ const result = await WebhookVerificationService.verify(request, svixConfig);
 
 You can configure any combination of algorithm, header, payload, and encoding. See the `SignatureConfig` type for all options.
 
-## Webhook Verification OK Tested Platforms
+For `platform: 'custom'`, default config remains compatible with token-style providers through `signatureConfig.customConfig` (`type: 'token-based'`, `idHeader: 'x-webhook-id'`), and you can override it per provider.
+
+## Verified Platforms (continuously tested)
 - **Stripe**
-- **Supabase**
-- **Github**
+- **GitHub**
 - **Clerk**
 - **Dodo Payments**
+- **GitLab**
+- **WorkOS**
+- **Lemon Squeezy**
+- **Paddle**
+- **Shopify**
+- **Polar**
+- **ReplicateAI**
 
-- **Other Platforms** : Yet to verify....
+Other listed platforms are supported but may have lighter coverage depending on release cycle.
 
 
 ## Custom Configurations
@@ -445,9 +439,11 @@ Simplified verification using platform-specific configurations with optional pay
 
 Auto-detects platform from headers and verifies against one or more provider secrets.
 
-#### `verifyTokenBased(request: Request, webhookId: string, webhookToken: string): Promise<WebhookVerificationResult>`
+#### `verifyTokenAuth(request: Request, webhookId: string, webhookToken: string): Promise<WebhookVerificationResult>`
+
+Verifies token-based webhooks.
 
-Verifies token-based webhooks (like Supabase).
+> `verifyTokenBased(...)` remains available as a backward-compatible alias and still works for existing integrations.
 
 #### `getPlatformsByCategory(category: 'payment' | 'auth' | 'ecommerce' | 'infrastructure'): WebhookPlatform[]`
 
@@ -464,9 +460,10 @@ interface WebhookVerificationResult {
   errorCode?: WebhookErrorCode;
   platform: WebhookPlatform;
   payload?: any;
+  eventId?: string; // canonical ID, e.g. 'stripe:evt_123'
   metadata?: {
     timestamp?: string;
-    id?: string | null;
+    id?: string | null; // raw provider ID (legacy)
     [key: string]: any;
   };
 }

package/dist/adapters/cloudflare.d.ts

@@ -1,11 +1,11 @@
 import { WebhookPlatform, NormalizeOptions } from '../types';
-export interface CloudflareWebhookHandlerOptions<TEnv = Record<string, unknown>, TResponse = unknown> {
+export interface CloudflareWebhookHandlerOptions<TEnv = Record<string, unknown>, TPayload = any, TMetadata extends Record<string, unknown> = Record<string, unknown>, TResponse = unknown> {
     platform: WebhookPlatform;
     secret?: string;
     secretEnv?: string;
     toleranceInSeconds?: number;
     normalize?: boolean | NormalizeOptions;
     onError?: (error: Error) => void;
-    handler: (payload: any, env: TEnv, metadata: Record<string, any>) => Promise<TResponse> | TResponse;
+    handler: (payload: TPayload, env: TEnv, metadata: TMetadata) => Promise<TResponse> | TResponse;
 }
-export declare function createWebhookHandler<TEnv = Record<string, unknown>, TResponse = unknown>(options: CloudflareWebhookHandlerOptions<TEnv, TResponse>): (request: Request, env: TEnv) => Promise<Response>;
+export declare function createWebhookHandler<TEnv = Record<string, unknown>, TPayload = any, TMetadata extends Record<string, unknown> = Record<string, unknown>, TResponse = unknown>(options: CloudflareWebhookHandlerOptions<TEnv, TPayload, TMetadata, TResponse>): (request: Request, env: TEnv) => Promise<Response>;

package/dist/adapters/cloudflare.js

@@ -14,7 +14,7 @@ function createWebhookHandler(options) {
             if (!result.isValid) {
                 return Response.json({ error: result.error, errorCode: result.errorCode, platform: result.platform, metadata: result.metadata }, { status: 400 });
             }
-            const data = await options.handler(result.payload, env, result.metadata || {});
+            const data = await options.handler(result.payload, env, (result.metadata || {}));
             return Response.json(data);
         }
         catch (error) {

package/dist/adapters/express.d.ts

@@ -1,5 +1,5 @@
-import { WebhookPlatform, WebhookVerificationResult, NormalizeOptions } from "../types";
-import { MinimalNodeRequest } from "./shared";
+import { WebhookPlatform, WebhookVerificationResult, NormalizeOptions } from '../types';
+import { MinimalNodeRequest } from './shared';
 export interface ExpressLikeResponse {
     status: (code: number) => ExpressLikeResponse;
     json: (payload: unknown) => unknown;

package/dist/adapters/nextjs.d.ts

@@ -1,10 +1,10 @@
 import { WebhookPlatform, NormalizeOptions } from '../types';
-export interface NextWebhookHandlerOptions<TResponse = unknown> {
+export interface NextWebhookHandlerOptions<TPayload = any, TMetadata extends Record<string, unknown> = Record<string, unknown>, TResponse = unknown> {
     platform: WebhookPlatform;
     secret: string;
     toleranceInSeconds?: number;
     normalize?: boolean | NormalizeOptions;
     onError?: (error: Error) => void;
-    handler: (payload: any, metadata: Record<string, any>) => Promise<TResponse> | TResponse;
+    handler: (payload: TPayload, metadata: TMetadata) => Promise<TResponse> | TResponse;
 }
-export declare function createWebhookHandler<TResponse = unknown>(options: NextWebhookHandlerOptions<TResponse>): (request: Request) => Promise<Response>;
+export declare function createWebhookHandler<TPayload = any, TMetadata extends Record<string, unknown> = Record<string, unknown>, TResponse = unknown>(options: NextWebhookHandlerOptions<TPayload, TMetadata, TResponse>): (request: Request) => Promise<Response>;

package/dist/adapters/nextjs.js

@@ -9,7 +9,7 @@ function createWebhookHandler(options) {
             if (!result.isValid) {
                 return Response.json({ error: result.error, errorCode: result.errorCode, platform: result.platform, metadata: result.metadata }, { status: 400 });
             }
-            const data = await options.handler(result.payload, result.metadata || {});
+            const data = await options.handler(result.payload, (result.metadata || {}));
             return Response.json(data);
         }
         catch (error) {

package/dist/adapters/shared.js

@@ -6,7 +6,7 @@ exports.toWebRequest = toWebRequest;
 function getHeaderValue(headers, name) {
     const value = headers[name.toLowerCase()] ?? headers[name];
     if (Array.isArray(value)) {
-        return value.join(",");
+        return value.join(',');
     }
     return value;
 }
@@ -15,11 +15,11 @@ async function readIncomingMessageBodyAsBuffer(request) {
         return new Uint8Array(0);
     const chunks = [];
     return new Promise((resolve, reject) => {
-        request.on?.("data", (chunk) => {
+        request.on?.('data', (chunk) => {
             if (chunk instanceof Uint8Array) {
                 chunks.push(chunk);
             }
-            else if (typeof chunk === "string") {
+            else if (typeof chunk === 'string') {
                 chunks.push(new TextEncoder().encode(chunk));
             }
             else if (chunk != null) {
@@ -31,7 +31,7 @@ async function readIncomingMessageBodyAsBuffer(request) {
                 }
             }
         });
-        request.on?.("end", () => {
+        request.on?.('end', () => {
             const totalLength = chunks.reduce((sum, c) => sum + c.byteLength, 0);
             const result = new Uint8Array(totalLength);
             let offset = 0;
@@ -41,22 +41,22 @@ async function readIncomingMessageBodyAsBuffer(request) {
             }
             resolve(result);
         });
-        request.on?.("error", (err) => reject(err));
+        request.on?.('error', (err) => reject(err));
     });
 }
 async function extractRawBody(request) {
-    const body = request.body;
+    const { body } = request;
     if (body instanceof Uint8Array) {
         return body;
     }
-    if (typeof body === "string") {
+    if (typeof body === 'string') {
         return new TextEncoder().encode(body);
     }
-    if (body !== null && body !== undefined && typeof body === "object") {
-        console.warn("[Tern] Warning: request body is already parsed as JSON. " +
-            "Signature verification may fail. " +
-            'Add express.raw({ type: "*/*" }) before Tern on webhook routes, ' +
-            "or register webhook routes before app.use(express.json()).");
+    if (body !== null && body !== undefined && typeof body === 'object') {
+        console.warn('[Tern] Warning: request body is already parsed as JSON. '
+            + 'Signature verification may fail. '
+            + 'Add express.raw({ type: "*/*" }) before Tern on webhook routes, '
+            + 'or register webhook routes before app.use(express.json()).');
         return new TextEncoder().encode(JSON.stringify(body));
     }
     // nothing ran — read raw stream directly
@@ -73,7 +73,7 @@ function toHeadersInit(headers) {
             continue;
         }
         if (Array.isArray(value)) {
-            normalized.set(key, value.join(","));
+            normalized.set(key, value.join(','));
             continue;
         }
         normalized.set(key, value);
@@ -81,17 +81,17 @@ function toHeadersInit(headers) {
     return normalized;
 }
 async function toWebRequest(request) {
-    const protocol = request.protocol || "https";
-    const host = request.get?.("host") ||
-        getHeaderValue(request.headers, "host") ||
-        "localhost";
-    const path = request.originalUrl || request.url || "/";
+    const protocol = request.protocol || 'https';
+    const host = request.get?.('host')
+        || getHeaderValue(request.headers, 'host')
+        || 'localhost';
+    const path = request.originalUrl || request.url || '/';
     const rawBody = await extractRawBody(request);
     const init = {
-        method: request.method || "POST",
+        method: request.method || 'POST',
         headers: toHeadersInit(request.headers),
         body: toArrayBuffer(rawBody),
-        duplex: "half",
+        duplex: 'half',
     };
     return new Request(`${protocol}://${host}${path}`, init);
 }

package/dist/adapters/testExpress.js

@@ -6,79 +6,78 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const crypto_1 = __importDefault(require("crypto"));
 const shared_1 = require("./shared");
 const __1 = __importDefault(require(".."));
-const secret = "whsec_test_secret";
-const payload = JSON.stringify({ type: "payment_intent.succeeded", data: { amount: 2000 } }) +
-    "\n";
+const secret = 'whsec_test_secret';
+const payload = `${JSON.stringify({ type: 'payment_intent.succeeded', data: { amount: 2000 } })}\n`;
 function buildStripeSignature(body, secret) {
     const timestamp = Math.floor(Date.now() / 1000);
     const signed = `${timestamp}.${body}`;
     const hmac = crypto_1.default
-        .createHmac("sha256", secret.replace("whsec_", ""))
+        .createHmac('sha256', secret.replace('whsec_', ''))
         .update(signed)
-        .digest("hex");
+        .digest('hex');
     return `t=${timestamp},v1=${hmac}`;
 }
 // ── Test 1: raw stream — no middleware ran ───────────────────
 async function testRawStream() {
     const sig = buildStripeSignature(payload, secret); // ✓ fixed: was missing secret arg
-    const chunks = [Buffer.from(payload, "utf8")];
+    const chunks = [Buffer.from(payload, 'utf8')];
     const req = {
-        method: "POST",
+        method: 'POST',
         headers: {
-            "stripe-signature": sig,
-            "content-type": "application/json",
+            'stripe-signature': sig,
+            'content-type': 'application/json',
         },
         body: undefined,
         on: (event, cb) => {
-            if (event === "data") {
+            if (event === 'data') {
                 for (const chunk of chunks)
                     cb(chunk);
             }
-            if (event === "end") {
+            if (event === 'end') {
                 cb();
             }
         },
     };
     const webReq = await (0, shared_1.toWebRequest)(req);
-    const result = await __1.default.verifyWithPlatformConfig(webReq, "stripe", secret);
-    console.log("Test 1 Raw stream (no middleware):", result.isValid ? "✓ PASS" : `✗ FAIL — ${result.error}`);
+    const result = await __1.default.verifyWithPlatformConfig(webReq, 'stripe', secret);
+    console.log('Test 1 Raw stream (no middleware):', result.isValid ? '✓ PASS' : `✗ FAIL — ${result.error}`);
 }
 // ── Test 2: Buffer body — express.raw() ran ──────────────────
 async function testBufferBody() {
     const sig = buildStripeSignature(payload, secret);
     const req = {
-        method: "POST",
+        method: 'POST',
         headers: {
-            "content-type": "application/json",
-            "stripe-signature": sig,
+            'content-type': 'application/json',
+            'stripe-signature': sig,
         },
-        body: Buffer.from(payload, "utf8"),
+        body: Buffer.from(payload, 'utf8'),
     };
     const webReq = await (0, shared_1.toWebRequest)(req);
-    const result = await __1.default.verifyWithPlatformConfig(webReq, "stripe", secret);
-    console.log("Test 2 Buffer body (express.raw):", result.isValid ? "✓ PASS" : `✗ FAIL — ${result.error}`);
+    const result = await __1.default.verifyWithPlatformConfig(webReq, 'stripe', secret);
+    console.log('Test 2 Buffer body (express.raw):', result.isValid ? '✓ PASS' : `✗ FAIL — ${result.error}`);
 }
 // ── Test 3: parsed object — express.json() ran ───────────────
 async function testParsedObject() {
     // signature computed against raw payload including \n
     const sig = buildStripeSignature(payload, secret);
     const req = {
-        method: "POST",
+        method: 'POST',
         headers: {
-            "content-type": "application/json",
-            "stripe-signature": sig,
+            'content-type': 'application/json',
+            'stripe-signature': sig,
         },
         body: JSON.parse(payload), // \n gone, bytes lost
     };
     const webReq = await (0, shared_1.toWebRequest)(req);
-    const result = await __1.default.verifyWithPlatformConfig(webReq, "stripe", secret);
+    const result = await __1.default.verifyWithPlatformConfig(webReq, 'stripe', secret);
     // should FAIL — \n was in original signature but lost after JSON.parse
-    console.log("Test 3 Parsed object (express.json):", !result.isValid ? "✓ FAILS AS EXPECTED" : "✗ SHOULD HAVE FAILED");
+    console.log('Test 3 Parsed object (express.json):', !result.isValid ? '✓ FAILS AS EXPECTED' : '✗ SHOULD HAVE FAILED');
 }
 async function run() {
     await testRawStream(); // no middleware      → should PASS
     await testBufferBody(); // express.raw()      → should PASS
     await testParsedObject(); // express.json()     → should FAIL as expected
-    console.log("\nDone. Test 3 failing is correct behavior.");
+    console.log('\nDone. Test 3 failing is correct behavior.');
 }
 run();

package/dist/examples.js

@@ -113,7 +113,7 @@ async function exampleSimplifiedPlatform() {
         console.error('Error:', error);
     }
 }
-// Example 4: Token-based authentication (Supabase style)
+// Example 4: Token-based authentication helper
 async function exampleTokenBased() {
     console.log('\n🔧 Example 4: Token-Based Authentication\n');
     const request = new Request('https://your-app.com/webhook', {
@@ -126,7 +126,7 @@ async function exampleTokenBased() {
         body: JSON.stringify({ event: 'database.insert' }),
     });
     try {
-        const result = await index_1.WebhookVerificationService.verifyTokenBased(request, 'webhook_123', 'token_456');
+        const result = await index_1.WebhookVerificationService.verifyTokenAuth(request, 'webhook_123', 'token_456');
         if (result.isValid) {
             console.log('✅ Token-based webhook verified!');
             console.log('Webhook ID:', result.metadata?.id);

package/dist/index.d.ts

@@ -6,10 +6,13 @@ export declare class WebhookVerificationService {
     private static getLegacyVerifier;
     static verifyWithPlatformConfig<TPayload = unknown>(request: Request, platform: WebhookPlatform, secret: string, toleranceInSeconds?: number, normalize?: boolean | NormalizeOptions): Promise<WebhookVerificationResult<TPayload>>;
     static verifyAny<TPayload = unknown>(request: Request, secrets: MultiPlatformSecrets, toleranceInSeconds?: number, normalize?: boolean | NormalizeOptions): Promise<WebhookVerificationResult<TPayload>>;
+    private static resolveCanonicalEventId;
+    private static resolveRawEventId;
     static detectPlatform(request: Request): WebhookPlatform;
     static getPlatformsUsingAlgorithm(algorithm: string): WebhookPlatform[];
     static platformUsesAlgorithm(platform: WebhookPlatform, algorithm: string): boolean;
     static validateSignatureConfig(config: SignatureConfig): boolean;
+    static verifyTokenAuth<TPayload = unknown>(request: Request, webhookId: string, webhookToken: string): Promise<WebhookVerificationResult<TPayload>>;
     static verifyTokenBased<TPayload = unknown>(request: Request, webhookId: string, webhookToken: string): Promise<WebhookVerificationResult<TPayload>>;
 }
 export * from './types';

package/dist/index.js

@@ -26,6 +26,7 @@ class WebhookVerificationService {
         // Ensure the platform is set correctly in the result
         if (result.isValid) {
             result.platform = config.platform;
+            result.eventId = this.resolveCanonicalEventId(config.platform, result.metadata);
             if (config.normalize) {
                 result.payload = (0, simple_1.normalizePayload)(config.platform, result.payload, config.normalize);
             }
@@ -109,6 +110,17 @@ class WebhookVerificationService {
             },
         };
     }
+    static resolveCanonicalEventId(platform, metadata) {
+        const rawId = this.resolveRawEventId(platform, metadata);
+        return `${platform}:${rawId}`;
+    }
+    static resolveRawEventId(platform, metadata) {
+        const candidate = metadata?.id || metadata?.delivery || metadata?.requestId || metadata?.timestamp;
+        if (candidate !== undefined && candidate !== null && `${candidate}`.trim().length > 0) {
+            return `${candidate}`.trim();
+        }
+        return `generated-${Date.now().toString(36)}-${platform}`;
+    }
     static detectPlatform(request) {
         const headers = request.headers;
         if (headers.has('stripe-signature'))
@@ -137,18 +149,22 @@ class WebhookVerificationService {
             return 'razorpay';
         if (headers.has('x-signature'))
             return 'lemonsqueezy';
-        if (headers.has('x-auth0-signature'))
-            return 'auth0';
         if (headers.has('x-wc-webhook-signature'))
             return 'woocommerce';
         if (headers.has('x-fal-signature') || headers.has('x-fal-webhook-signature'))
             return 'falai';
+        if (headers.has('sentry-hook-signature'))
+            return 'sentry';
+        if (headers.has('x-grafana-alerting-signature'))
+            return 'grafana';
+        if (headers.has('x-doppler-signature'))
+            return 'doppler';
+        if (headers.has('sanity-webhook-signature'))
+            return 'sanity';
         if (headers.has('x-shopify-hmac-sha256'))
             return 'shopify';
         if (headers.has('x-vercel-signature'))
             return 'vercel';
-        if (headers.has('x-webhook-token') && headers.has('x-webhook-id'))
-            return 'supabase';
         return 'unknown';
     }
     // Helper method to get all platforms using a specific algorithm
@@ -163,8 +179,8 @@ class WebhookVerificationService {
     static validateSignatureConfig(config) {
         return (0, algorithms_2.validateSignatureConfig)(config);
     }
-    // Simple token-based verification for platforms like Supabase
-    static async verifyTokenBased(request, webhookId, webhookToken) {
+    // Simple token-based verification helper for token-auth providers
+    static async verifyTokenAuth(request, webhookId, webhookToken) {
         try {
             const idHeader = request.headers.get('x-webhook-id');
             const tokenHeader = request.headers.get('x-webhook-token');
@@ -198,6 +214,7 @@ class WebhookVerificationService {
                 isValid: true,
                 platform: 'custom',
                 payload: payload,
+                eventId: `custom:${idHeader}`,
                 metadata: {
                     id: idHeader,
                     algorithm: 'token-based',
@@ -213,6 +230,9 @@ class WebhookVerificationService {
             };
         }
     }
+    static async verifyTokenBased(request, webhookId, webhookToken) {
+        return this.verifyTokenAuth(request, webhookId, webhookToken);
+    }
 }
 exports.WebhookVerificationService = WebhookVerificationService;
 __exportStar(require("./types"), exports);

package/dist/normalization/providers/registry.js

@@ -6,8 +6,6 @@ const providers = [
     { id: 'razorpay', name: 'Razorpay', category: 'payment' },
     { id: 'paypal', name: 'PayPal', category: 'payment' },
     { id: 'clerk', name: 'Clerk', category: 'auth' },
-    { id: 'auth0', name: 'Auth0', category: 'auth' },
-    { id: 'supabase', name: 'Supabase', category: 'auth' },
     { id: 'shopify', name: 'Shopify', category: 'ecommerce' },
     { id: 'woocommerce', name: 'WooCommerce', category: 'ecommerce' },
 ];

package/dist/normalization/simple.js

@@ -57,18 +57,6 @@ const platformNormalizers = {
             occurred_at: new Date().toISOString(),
         }),
     },
-    supabase: {
-        platform: 'supabase',
-        category: 'auth',
-        normalize: (payload) => ({
-            category: 'auth',
-            event: readPath(payload, 'type') || readPath(payload, 'event') || 'auth.unknown',
-            user_id: readPath(payload, 'record.id') || readPath(payload, 'id'),
-            email: readPath(payload, 'record.email') || readPath(payload, 'email'),
-            metadata: {},
-            occurred_at: new Date().toISOString(),
-        }),
-    },
     vercel: {
         platform: 'vercel',
         category: 'infrastructure',

package/dist/platforms/algorithms.d.ts

@@ -1,4 +1,4 @@
-import { PlatformAlgorithmConfig, WebhookPlatform, SignatureConfig } from "../types";
+import { PlatformAlgorithmConfig, WebhookPlatform, SignatureConfig } from '../types';
 export declare const platformAlgorithmConfigs: Record<WebhookPlatform, PlatformAlgorithmConfig>;
 export declare function getPlatformAlgorithmConfig(platform: WebhookPlatform): PlatformAlgorithmConfig;
 export declare function platformUsesAlgorithm(platform: WebhookPlatform, algorithm: string): boolean;