@hookflo/tern 4.0.0 → 4.0.3

package/dist/index.d.ts

@@ -8,6 +8,7 @@ export declare class WebhookVerificationService {
     static verifyWithPlatformConfig<TPayload = unknown>(request: Request, platform: WebhookPlatform, secret: string, toleranceInSeconds?: number, normalize?: boolean | NormalizeOptions): Promise<WebhookVerificationResult<TPayload>>;
     static verifyAny<TPayload = unknown>(request: Request, secrets: MultiPlatformSecrets, toleranceInSeconds?: number, normalize?: boolean | NormalizeOptions): Promise<WebhookVerificationResult<TPayload>>;
     private static resolveCanonicalEventId;
+    private static pickString;
     private static resolveRawEventId;
     static detectPlatform(request: Request): WebhookPlatform;
     static getPlatformsUsingAlgorithm(algorithm: string): WebhookPlatform[];

package/dist/index.js

@@ -48,7 +48,7 @@ class WebhookVerificationService {
         // Ensure the platform is set correctly in the result
         if (result.isValid) {
             result.platform = config.platform;
-            result.eventId = this.resolveCanonicalEventId(config.platform, result.metadata);
+            result.eventId = this.resolveCanonicalEventId(config.platform, result.metadata, result.payload) ?? undefined;
             if (config.normalize) {
                 result.payload = (0, simple_1.normalizePayload)(config.platform, result.payload, config.normalize);
             }
@@ -132,16 +132,71 @@ class WebhookVerificationService {
             },
         };
     }
-    static resolveCanonicalEventId(platform, metadata) {
-        const rawId = this.resolveRawEventId(platform, metadata);
+    static resolveCanonicalEventId(platform, metadata, payload) {
+        const rawId = this.resolveRawEventId(platform, metadata, payload);
+        if (!rawId)
+            return null;
         return `${platform}_${rawId}`;
     }
-    static resolveRawEventId(platform, metadata) {
-        const candidate = metadata?.id || metadata?.delivery || metadata?.requestId || metadata?.timestamp;
-        if (candidate !== undefined && candidate !== null && `${candidate}`.trim().length > 0) {
-            return `${candidate}`.trim();
+    static pickString(...candidates) {
+        for (const candidate of candidates) {
+            if (candidate === undefined || candidate === null) {
+                continue;
+            }
+            const normalized = `${candidate}`.trim();
+            if (normalized.length > 0 && normalized !== 'undefined' && normalized !== 'null') {
+                return normalized;
+            }
+        }
+        return undefined;
+    }
+    static resolveRawEventId(platform, metadata, payload) {
+        switch (platform) {
+            case 'stripe':
+                return this.pickString(payload?.request?.idempotency_key, payload?.id) || null;
+            case 'github':
+                return this.pickString(metadata?.delivery) || null;
+            case 'clerk':
+                return this.pickString(metadata?.id) || null;
+            case 'shopify':
+                return this.pickString(metadata?.id, payload?.id) || null;
+            case 'paddle':
+                return this.pickString(payload?.event_id, payload?.data?.id) || null;
+            case 'polar':
+                return this.pickString(payload?.data?.id, payload?.id) || null;
+            case 'dodopayments':
+                return this.pickString(payload?.data?.payment_id, payload?.data?.subscription_id, payload?.data?.id) || null;
+            case 'falai':
+                return this.pickString(payload?.request_id) || null;
+            case 'replicateai':
+            case 'replicate':
+                return this.pickString(payload?.id) || null;
+            case 'workos':
+            case 'sentry':
+            case 'vercel':
+                return this.pickString(payload?.id) || null;
+            case 'doppler':
+                return this.pickString(payload?.event?.id, metadata?.id) || null;
+            case 'sanity':
+                return this.pickString(payload?.transactionId, payload?._id) || null;
+            case 'razorpay':
+                return this.pickString(payload?.payload?.payment?.entity?.id, payload?.payload?.order?.entity?.id, payload?.payload?.subscription?.entity?.id) || null;
+            case 'lemonsqueezy': {
+                const dataId = this.pickString(payload?.data?.id);
+                if (!dataId)
+                    return null;
+                const eventName = this.pickString(payload?.meta?.event_name);
+                return eventName ? `${eventName}_${dataId}` : null;
+            }
+            case 'gitlab':
+                return this.pickString(payload?.object_attributes?.id?.toString()) || null;
+            case 'grafana':
+                return this.pickString(payload?.groupKey, payload?.alerts?.[0]?.fingerprint) || null;
+            case 'woocommerce':
+                return this.pickString(payload?.id?.toString()) || null;
+            default:
+                return this.pickString(payload?.idempotency_key, payload?.event_id, payload?.webhook_id, payload?.id, metadata?.id, metadata?.delivery) || null;
         }
-        return `generated-${Date.now().toString(36)}-${platform}`;
     }
     static detectPlatform(request) {
         const headers = request.headers;

package/dist/upstash/queue.js

@@ -183,7 +183,7 @@ async function handleReceive(request, platform, secret, queueConfig, toleranceIn
         metadata: verificationResult.metadata || {},
     };
     const deduplicationId = await resolveDeduplicationId(request, verificationResult);
-    if (process.env.NODE_ENV == 'production') {
+    if (process.env.NODE_ENV !== 'production') {
         console.log(`[tern] deduplication-id: ${deduplicationId} (platform: ${platform})`);
     }
     const publishPayload = {
@@ -197,11 +197,60 @@ async function handleReceive(request, platform, secret, queueConfig, toleranceIn
     if (queueConfig.retries !== undefined) {
         publishPayload.retries = queueConfig.retries;
     }
-    await client.publishJSON(publishPayload);
-    return new Response(JSON.stringify({ queued: true }), {
-        status: 200,
-        headers: { 'Content-Type': 'application/json' },
-    });
+    try {
+        await client.publishJSON(publishPayload);
+        return new Response(JSON.stringify({ queued: true }), {
+            status: 200,
+            headers: { 'Content-Type': 'application/json' },
+        });
+    }
+    catch (error) {
+        const status = error?.status ?? 0;
+        const errorBody = error?.body
+            ? (() => {
+                try {
+                    return JSON.parse(error.body);
+                }
+                catch {
+                    return {};
+                }
+            })()
+            : {};
+        console.error('[tern] QStash publish failed:', {
+            status,
+            message: String(error),
+        });
+        if (status === 400) {
+            return new Response(JSON.stringify({
+                error: 'Invalid payload — could not enqueue',
+                detail: errorBody?.error,
+            }), {
+                status: 489,
+                headers: {
+                    'Content-Type': 'application/json',
+                    'Upstash-NonRetryable-Error': 'true',
+                },
+            });
+        }
+        if (status === 401) {
+            return new Response(JSON.stringify({
+                error: '[tern] QStash token invalid — check QSTASH_TOKEN in env',
+            }), {
+                status: 503,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        if (status === 429) {
+            return new Response(JSON.stringify({ error: 'QStash rate limited — retry shortly' }), {
+                status: 503,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        return new Response(JSON.stringify({ error: 'Queue temporarily unavailable' }), {
+            status: 503,
+            headers: { 'Content-Type': 'application/json' },
+        });
+    }
 }
 async function handleProcess(request, handler, queueConfig) {
     const signature = request.headers.get('upstash-signature');
@@ -217,11 +266,22 @@ async function handleProcess(request, handler, queueConfig) {
             url: request.url,
         });
         if (verification === false) {
-            return new Response(JSON.stringify({ error: 'Unauthorized' }), { status: 401, headers: { 'Content-Type': 'application/json' } });
+            return nonRetryableResponse('Invalid QStash signature', 401);
         }
     }
-    catch {
-        return new Response(JSON.stringify({ error: 'Unauthorized' }), { status: 401, headers: { 'Content-Type': 'application/json' } });
+    catch (error) {
+        const message = String(error).toLowerCase();
+        if (message.includes('invalid signature') ||
+            message.includes('signature') ||
+            message.includes('unauthorized') ||
+            message.includes('forbidden')) {
+            return nonRetryableResponse('Invalid QStash signature', 401);
+        }
+        console.error('[tern] QStash signature verification error:', String(error));
+        return new Response(JSON.stringify({ error: 'Signature verification temporarily unavailable' }), {
+            status: 503,
+            headers: { 'Content-Type': 'application/json' },
+        });
     }
     if (!handler) {
         return nonRetryableResponse('Queue processing requires a handler function');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hookflo/tern",
-  "version": "4.0.0",
+  "version": "4.0.3",
   "description": "A robust, scalable webhook verification framework supporting multiple platforms and signature algorithms",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",