@hookflo/tern 4.0.2 → 4.0.3

package/dist/index.js

@@ -48,7 +48,7 @@ class WebhookVerificationService {
         // Ensure the platform is set correctly in the result
         if (result.isValid) {
             result.platform = config.platform;
-            result.eventId = this.resolveCanonicalEventId(config.platform, result.metadata, result.payload);
+            result.eventId = this.resolveCanonicalEventId(config.platform, result.metadata, result.payload) ?? undefined;
             if (config.normalize) {
                 result.payload = (0, simple_1.normalizePayload)(config.platform, result.payload, config.normalize);
             }
@@ -134,6 +134,8 @@ class WebhookVerificationService {
     }
     static resolveCanonicalEventId(platform, metadata, payload) {
         const rawId = this.resolveRawEventId(platform, metadata, payload);
+        if (!rawId)
+            return null;
         return `${platform}_${rawId}`;
     }
     static pickString(...candidates) {
@@ -149,56 +151,52 @@ class WebhookVerificationService {
         return undefined;
     }
     static resolveRawEventId(platform, metadata, payload) {
-        const candidate = (() => {
-            switch (platform) {
-                case 'stripe':
-                    return this.pickString(payload?.request?.idempotency_key, payload?.id, metadata?.id);
-                case 'github':
-                    return this.pickString(metadata?.delivery, metadata?.id, payload?.id);
-                case 'clerk':
-                    return this.pickString(metadata?.id, payload?.id);
-                case 'shopify':
-                    return this.pickString(metadata?.id, payload?.id);
-                case 'polar':
-                    return this.pickString(payload?.data?.id, payload?.id, metadata?.id);
-                case 'dodopayments':
-                    return this.pickString(payload?.data?.payment_id, payload?.data?.subscription_id, payload?.data?.id, metadata?.id);
-                case 'gitlab':
-                    return this.pickString(payload?.object_attributes?.id, payload?.project?.id, metadata?.id);
-                case 'paddle':
-                    return this.pickString(payload?.event_id, payload?.data?.id, metadata?.id);
-                case 'razorpay':
-                    return this.pickString(payload?.payload?.payment?.entity?.id, payload?.payload?.order?.entity?.id, payload?.payload?.subscription?.entity?.id, payload?.id, metadata?.id);
-                case 'lemonsqueezy': {
-                    const eventName = this.pickString(payload?.meta?.event_name);
-                    const dataId = this.pickString(payload?.data?.id, payload?.id);
-                    if (eventName && dataId) {
-                        return `${eventName}_${dataId}`;
-                    }
-                    return this.pickString(dataId, metadata?.id);
-                }
-                case 'workos':
-                case 'vercel':
-                case 'replicateai':
-                case 'sentry':
-                    return this.pickString(payload?.id, metadata?.id);
-                case 'woocommerce':
-                    return this.pickString(payload?.id, metadata?.id);
-                case 'falai':
-                    return this.pickString(payload?.request_id, metadata?.id);
-                case 'grafana':
-                    return this.pickString(payload?.groupKey, payload?.alerts?.[0]?.fingerprint, metadata?.id);
-                case 'doppler':
-                    return this.pickString(payload?.event?.id, metadata?.id);
-                case 'sanity':
-                    return this.pickString(payload?.transactionId, payload?._id, metadata?.id);
-                default:
-                    return this.pickString(payload?.idempotency_key, payload?.event_id, payload?.webhook_id, payload?.request_id, payload?.id, payload?.data?.id, metadata?.id, metadata?.delivery, metadata?.requestId);
+        switch (platform) {
+            case 'stripe':
+                return this.pickString(payload?.request?.idempotency_key, payload?.id) || null;
+            case 'github':
+                return this.pickString(metadata?.delivery) || null;
+            case 'clerk':
+                return this.pickString(metadata?.id) || null;
+            case 'shopify':
+                return this.pickString(metadata?.id, payload?.id) || null;
+            case 'paddle':
+                return this.pickString(payload?.event_id, payload?.data?.id) || null;
+            case 'polar':
+                return this.pickString(payload?.data?.id, payload?.id) || null;
+            case 'dodopayments':
+                return this.pickString(payload?.data?.payment_id, payload?.data?.subscription_id, payload?.data?.id) || null;
+            case 'falai':
+                return this.pickString(payload?.request_id) || null;
+            case 'replicateai':
+            case 'replicate':
+                return this.pickString(payload?.id) || null;
+            case 'workos':
+            case 'sentry':
+            case 'vercel':
+                return this.pickString(payload?.id) || null;
+            case 'doppler':
+                return this.pickString(payload?.event?.id, metadata?.id) || null;
+            case 'sanity':
+                return this.pickString(payload?.transactionId, payload?._id) || null;
+            case 'razorpay':
+                return this.pickString(payload?.payload?.payment?.entity?.id, payload?.payload?.order?.entity?.id, payload?.payload?.subscription?.entity?.id) || null;
+            case 'lemonsqueezy': {
+                const dataId = this.pickString(payload?.data?.id);
+                if (!dataId)
+                    return null;
+                const eventName = this.pickString(payload?.meta?.event_name);
+                return eventName ? `${eventName}_${dataId}` : null;
             }
-        })();
-        if (candidate)
-            return candidate;
-        return `generated-missing-${platform}`;
+            case 'gitlab':
+                return this.pickString(payload?.object_attributes?.id?.toString()) || null;
+            case 'grafana':
+                return this.pickString(payload?.groupKey, payload?.alerts?.[0]?.fingerprint) || null;
+            case 'woocommerce':
+                return this.pickString(payload?.id?.toString()) || null;
+            default:
+                return this.pickString(payload?.idempotency_key, payload?.event_id, payload?.webhook_id, payload?.id, metadata?.id, metadata?.delivery) || null;
+        }
     }
     static detectPlatform(request) {
         const headers = request.headers;

package/dist/upstash/queue.js

@@ -157,9 +157,7 @@ async function resolveDeduplicationId(request, verificationResult) {
         headers.get('x-github-delivery') ||
         headers.get('idempotency-key') ||
         headers.get('upstash-deduplication-id') ||
-        (verificationResult.eventId && !verificationResult.eventId.includes('generated-missing-')
-            ? verificationResult.eventId
-            : null) ||
+        verificationResult.eventId ||
         (typeof verificationResult.metadata?.id === 'string' ? verificationResult.metadata.id : null) ||
         payloadId ||
         payloadRequestId ||
@@ -185,7 +183,7 @@ async function handleReceive(request, platform, secret, queueConfig, toleranceIn
         metadata: verificationResult.metadata || {},
     };
     const deduplicationId = await resolveDeduplicationId(request, verificationResult);
-    if (process.env.NODE_ENV == 'production') {
+    if (process.env.NODE_ENV !== 'production') {
         console.log(`[tern] deduplication-id: ${deduplicationId} (platform: ${platform})`);
     }
     const publishPayload = {
@@ -199,11 +197,60 @@ async function handleReceive(request, platform, secret, queueConfig, toleranceIn
     if (queueConfig.retries !== undefined) {
         publishPayload.retries = queueConfig.retries;
     }
-    await client.publishJSON(publishPayload);
-    return new Response(JSON.stringify({ queued: true }), {
-        status: 200,
-        headers: { 'Content-Type': 'application/json' },
-    });
+    try {
+        await client.publishJSON(publishPayload);
+        return new Response(JSON.stringify({ queued: true }), {
+            status: 200,
+            headers: { 'Content-Type': 'application/json' },
+        });
+    }
+    catch (error) {
+        const status = error?.status ?? 0;
+        const errorBody = error?.body
+            ? (() => {
+                try {
+                    return JSON.parse(error.body);
+                }
+                catch {
+                    return {};
+                }
+            })()
+            : {};
+        console.error('[tern] QStash publish failed:', {
+            status,
+            message: String(error),
+        });
+        if (status === 400) {
+            return new Response(JSON.stringify({
+                error: 'Invalid payload — could not enqueue',
+                detail: errorBody?.error,
+            }), {
+                status: 489,
+                headers: {
+                    'Content-Type': 'application/json',
+                    'Upstash-NonRetryable-Error': 'true',
+                },
+            });
+        }
+        if (status === 401) {
+            return new Response(JSON.stringify({
+                error: '[tern] QStash token invalid — check QSTASH_TOKEN in env',
+            }), {
+                status: 503,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        if (status === 429) {
+            return new Response(JSON.stringify({ error: 'QStash rate limited — retry shortly' }), {
+                status: 503,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        return new Response(JSON.stringify({ error: 'Queue temporarily unavailable' }), {
+            status: 503,
+            headers: { 'Content-Type': 'application/json' },
+        });
+    }
 }
 async function handleProcess(request, handler, queueConfig) {
     const signature = request.headers.get('upstash-signature');
@@ -219,11 +266,22 @@ async function handleProcess(request, handler, queueConfig) {
             url: request.url,
         });
         if (verification === false) {
-            return new Response(JSON.stringify({ error: 'Unauthorized' }), { status: 401, headers: { 'Content-Type': 'application/json' } });
+            return nonRetryableResponse('Invalid QStash signature', 401);
         }
     }
-    catch {
-        return new Response(JSON.stringify({ error: 'Unauthorized' }), { status: 401, headers: { 'Content-Type': 'application/json' } });
+    catch (error) {
+        const message = String(error).toLowerCase();
+        if (message.includes('invalid signature') ||
+            message.includes('signature') ||
+            message.includes('unauthorized') ||
+            message.includes('forbidden')) {
+            return nonRetryableResponse('Invalid QStash signature', 401);
+        }
+        console.error('[tern] QStash signature verification error:', String(error));
+        return new Response(JSON.stringify({ error: 'Signature verification temporarily unavailable' }), {
+            status: 503,
+            headers: { 'Content-Type': 'application/json' },
+        });
     }
     if (!handler) {
         return nonRetryableResponse('Queue processing requires a handler function');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hookflo/tern",
-  "version": "4.0.2",
+  "version": "4.0.3",
   "description": "A robust, scalable webhook verification framework supporting multiple platforms and signature algorithms",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",