@hookflo/tern 3.0.17-beta → 4.0.2

package/dist/index.d.ts

@@ -8,6 +8,7 @@ export declare class WebhookVerificationService {
     static verifyWithPlatformConfig<TPayload = unknown>(request: Request, platform: WebhookPlatform, secret: string, toleranceInSeconds?: number, normalize?: boolean | NormalizeOptions): Promise<WebhookVerificationResult<TPayload>>;
     static verifyAny<TPayload = unknown>(request: Request, secrets: MultiPlatformSecrets, toleranceInSeconds?: number, normalize?: boolean | NormalizeOptions): Promise<WebhookVerificationResult<TPayload>>;
     private static resolveCanonicalEventId;
+    private static pickString;
     private static resolveRawEventId;
     static detectPlatform(request: Request): WebhookPlatform;
     static getPlatformsUsingAlgorithm(algorithm: string): WebhookPlatform[];

package/dist/index.js

@@ -48,7 +48,7 @@ class WebhookVerificationService {
         // Ensure the platform is set correctly in the result
         if (result.isValid) {
             result.platform = config.platform;
-            result.eventId = this.resolveCanonicalEventId(config.platform, result.metadata);
+            result.eventId = this.resolveCanonicalEventId(config.platform, result.metadata, result.payload);
             if (config.normalize) {
                 result.payload = (0, simple_1.normalizePayload)(config.platform, result.payload, config.normalize);
             }
@@ -132,16 +132,73 @@ class WebhookVerificationService {
             },
         };
     }
-    static resolveCanonicalEventId(platform, metadata) {
-        const rawId = this.resolveRawEventId(platform, metadata);
+    static resolveCanonicalEventId(platform, metadata, payload) {
+        const rawId = this.resolveRawEventId(platform, metadata, payload);
         return `${platform}_${rawId}`;
     }
-    static resolveRawEventId(platform, metadata) {
-        const candidate = metadata?.id || metadata?.delivery || metadata?.requestId || metadata?.timestamp;
-        if (candidate !== undefined && candidate !== null && `${candidate}`.trim().length > 0) {
-            return `${candidate}`.trim();
+    static pickString(...candidates) {
+        for (const candidate of candidates) {
+            if (candidate === undefined || candidate === null) {
+                continue;
+            }
+            const normalized = `${candidate}`.trim();
+            if (normalized.length > 0 && normalized !== 'undefined' && normalized !== 'null') {
+                return normalized;
+            }
         }
-        return `generated-${Date.now().toString(36)}-${platform}`;
+        return undefined;
+    }
+    static resolveRawEventId(platform, metadata, payload) {
+        const candidate = (() => {
+            switch (platform) {
+                case 'stripe':
+                    return this.pickString(payload?.request?.idempotency_key, payload?.id, metadata?.id);
+                case 'github':
+                    return this.pickString(metadata?.delivery, metadata?.id, payload?.id);
+                case 'clerk':
+                    return this.pickString(metadata?.id, payload?.id);
+                case 'shopify':
+                    return this.pickString(metadata?.id, payload?.id);
+                case 'polar':
+                    return this.pickString(payload?.data?.id, payload?.id, metadata?.id);
+                case 'dodopayments':
+                    return this.pickString(payload?.data?.payment_id, payload?.data?.subscription_id, payload?.data?.id, metadata?.id);
+                case 'gitlab':
+                    return this.pickString(payload?.object_attributes?.id, payload?.project?.id, metadata?.id);
+                case 'paddle':
+                    return this.pickString(payload?.event_id, payload?.data?.id, metadata?.id);
+                case 'razorpay':
+                    return this.pickString(payload?.payload?.payment?.entity?.id, payload?.payload?.order?.entity?.id, payload?.payload?.subscription?.entity?.id, payload?.id, metadata?.id);
+                case 'lemonsqueezy': {
+                    const eventName = this.pickString(payload?.meta?.event_name);
+                    const dataId = this.pickString(payload?.data?.id, payload?.id);
+                    if (eventName && dataId) {
+                        return `${eventName}_${dataId}`;
+                    }
+                    return this.pickString(dataId, metadata?.id);
+                }
+                case 'workos':
+                case 'vercel':
+                case 'replicateai':
+                case 'sentry':
+                    return this.pickString(payload?.id, metadata?.id);
+                case 'woocommerce':
+                    return this.pickString(payload?.id, metadata?.id);
+                case 'falai':
+                    return this.pickString(payload?.request_id, metadata?.id);
+                case 'grafana':
+                    return this.pickString(payload?.groupKey, payload?.alerts?.[0]?.fingerprint, metadata?.id);
+                case 'doppler':
+                    return this.pickString(payload?.event?.id, metadata?.id);
+                case 'sanity':
+                    return this.pickString(payload?.transactionId, payload?._id, metadata?.id);
+                default:
+                    return this.pickString(payload?.idempotency_key, payload?.event_id, payload?.webhook_id, payload?.request_id, payload?.id, payload?.data?.id, metadata?.id, metadata?.delivery, metadata?.requestId);
+            }
+        })();
+        if (candidate)
+            return candidate;
+        return `generated-missing-${platform}`;
     }
     static detectPlatform(request) {
         const headers = request.headers;

package/dist/upstash/queue.js

@@ -157,7 +157,9 @@ async function resolveDeduplicationId(request, verificationResult) {
         headers.get('x-github-delivery') ||
         headers.get('idempotency-key') ||
         headers.get('upstash-deduplication-id') ||
-        verificationResult.eventId ||
+        (verificationResult.eventId && !verificationResult.eventId.includes('generated-missing-')
+            ? verificationResult.eventId
+            : null) ||
         (typeof verificationResult.metadata?.id === 'string' ? verificationResult.metadata.id : null) ||
         payloadId ||
         payloadRequestId ||
@@ -183,7 +185,7 @@ async function handleReceive(request, platform, secret, queueConfig, toleranceIn
         metadata: verificationResult.metadata || {},
     };
     const deduplicationId = await resolveDeduplicationId(request, verificationResult);
-    if (process.env.NODE_ENV !== 'production') {
+    if (process.env.NODE_ENV == 'production') {
         console.log(`[tern] deduplication-id: ${deduplicationId} (platform: ${platform})`);
     }
     const publishPayload = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hookflo/tern",
-  "version": "3.0.17-beta",
+  "version": "4.0.2",
   "description": "A robust, scalable webhook verification framework supporting multiple platforms and signature algorithms",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",