@hookflo/tern 4.0.2 → 4.1.0

package/dist/adapters/express.d.ts

@@ -16,5 +16,6 @@ export interface ExpressWebhookMiddlewareOptions {
     normalize?: boolean | NormalizeOptions;
     queue?: QueueOption;
     onError?: (error: Error) => void;
+    strictRawBody?: boolean;
 }
 export declare function createWebhookMiddleware(options: ExpressWebhookMiddlewareOptions): (req: ExpressLikeRequest, res: ExpressLikeResponse, next: ExpressLikeNext) => Promise<void>;

package/dist/adapters/express.js

@@ -7,6 +7,15 @@ const shared_1 = require("./shared");
 function createWebhookMiddleware(options) {
     return async (req, res, next) => {
         try {
+            const strictRawBody = options.strictRawBody ?? true;
+            if (strictRawBody && (0, shared_1.hasParsedBody)(req)) {
+                res.status(400).json({
+                    error: 'Webhook request body must be raw bytes. Configure express.raw({ type: "*/*" }) before this middleware.',
+                    errorCode: 'VERIFICATION_ERROR',
+                    platform: options.platform,
+                });
+                return;
+            }
             const webRequest = await (0, shared_1.toWebRequest)(req);
             if (options.queue) {
                 const queueConfig = (0, queue_1.resolveQueueConfig)(options.queue);
@@ -17,7 +26,7 @@ function createWebhookMiddleware(options) {
                     toleranceInSeconds: options.toleranceInSeconds ?? 300,
                 });
                 const bodyText = await queueResponse.text();
-                let body = undefined;
+                let body;
                 if (bodyText) {
                     try {
                         body = JSON.parse(bodyText);

package/dist/adapters/shared.d.ts

@@ -8,6 +8,7 @@ export interface MinimalNodeRequest {
     url?: string;
     on?: (event: string, cb: (chunk?: unknown) => void) => void;
 }
+export declare function hasParsedBody(request: MinimalNodeRequest): boolean;
 export declare function extractRawBody(request: MinimalNodeRequest): Promise<Uint8Array>;
 export declare function toHeadersInit(headers: Record<string, string | string[] | undefined>): HeadersInit;
 export declare function toWebRequest(request: MinimalNodeRequest): Promise<Request>;

package/dist/adapters/shared.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasParsedBody = hasParsedBody;
 exports.extractRawBody = extractRawBody;
 exports.toHeadersInit = toHeadersInit;
 exports.toWebRequest = toWebRequest;
@@ -10,6 +11,14 @@ function getHeaderValue(headers, name) {
     }
     return value;
 }
+function hasParsedBody(request) {
+    const { body } = request;
+    return body !== null
+        && body !== undefined
+        && typeof body === 'object'
+        && !(body instanceof Uint8Array)
+        && !(body instanceof ArrayBuffer);
+}
 async function readIncomingMessageBodyAsBuffer(request) {
     if (!request.on)
         return new Uint8Array(0);
@@ -52,7 +61,7 @@ async function extractRawBody(request) {
     if (typeof body === 'string') {
         return new TextEncoder().encode(body);
     }
-    if (body !== null && body !== undefined && typeof body === 'object') {
+    if (hasParsedBody(request)) {
         console.warn('[Tern] Warning: request body is already parsed as JSON. '
             + 'Signature verification may fail. '
             + 'Add express.raw({ type: "*/*" }) before Tern on webhook routes, '

package/dist/index.d.ts

@@ -8,6 +8,7 @@ export declare class WebhookVerificationService {
     static verifyWithPlatformConfig<TPayload = unknown>(request: Request, platform: WebhookPlatform, secret: string, toleranceInSeconds?: number, normalize?: boolean | NormalizeOptions): Promise<WebhookVerificationResult<TPayload>>;
     static verifyAny<TPayload = unknown>(request: Request, secrets: MultiPlatformSecrets, toleranceInSeconds?: number, normalize?: boolean | NormalizeOptions): Promise<WebhookVerificationResult<TPayload>>;
     private static resolveCanonicalEventId;
+    private static safeCompare;
     private static pickString;
     private static resolveRawEventId;
     static detectPlatform(request: Request): WebhookPlatform;

package/dist/index.js

@@ -37,6 +37,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getPlatformsByCategory = exports.getPlatformNormalizationCategory = exports.normalizePayload = exports.createCustomVerifier = exports.createAlgorithmVerifier = exports.validateSignatureConfig = exports.getPlatformsUsingAlgorithm = exports.platformUsesAlgorithm = exports.getPlatformAlgorithmConfig = exports.WebhookVerificationService = void 0;
+const crypto_1 = require("crypto");
 const algorithms_1 = require("./verifiers/algorithms");
 const custom_algorithms_1 = require("./verifiers/custom-algorithms");
 const algorithms_2 = require("./platforms/algorithms");
@@ -48,7 +49,7 @@ class WebhookVerificationService {
         // Ensure the platform is set correctly in the result
         if (result.isValid) {
             result.platform = config.platform;
-            result.eventId = this.resolveCanonicalEventId(config.platform, result.metadata, result.payload);
+            result.eventId = this.resolveCanonicalEventId(config.platform, result.metadata, result.payload) ?? undefined;
             if (config.normalize) {
                 result.payload = (0, simple_1.normalizePayload)(config.platform, result.payload, config.normalize);
             }
@@ -103,18 +104,25 @@ class WebhookVerificationService {
             return this.verifyWithPlatformConfig(requestClone, detectedPlatform, secrets[detectedPlatform], toleranceInSeconds, normalize);
         }
         const failedAttempts = [];
-        for (const [platform, secret] of Object.entries(secrets)) {
-            if (!secret) {
-                continue;
-            }
-            const result = await this.verifyWithPlatformConfig(requestClone, platform.toLowerCase(), secret, toleranceInSeconds, normalize);
-            if (result.isValid) {
-                return result;
-            }
+        const verificationResults = await Promise.all(Object.entries(secrets)
+            .filter(([, secret]) => Boolean(secret))
+            .map(async ([platform, secret]) => {
+            const normalizedPlatform = platform.toLowerCase();
+            const result = await this.verifyWithPlatformConfig(requestClone, normalizedPlatform, secret, toleranceInSeconds, normalize);
+            return {
+                platform: normalizedPlatform,
+                result,
+            };
+        }));
+        const firstValid = verificationResults.find((item) => item.result.isValid);
+        if (firstValid) {
+            return firstValid.result;
+        }
+        for (const item of verificationResults) {
             failedAttempts.push({
-                platform: platform.toLowerCase(),
-                error: result.error,
-                errorCode: result.errorCode,
+                platform: item.platform,
+                error: item.result.error,
+                errorCode: item.result.errorCode,
             });
         }
         const details = failedAttempts
@@ -134,8 +142,16 @@ class WebhookVerificationService {
     }
     static resolveCanonicalEventId(platform, metadata, payload) {
         const rawId = this.resolveRawEventId(platform, metadata, payload);
+        if (!rawId)
+            return null;
         return `${platform}_${rawId}`;
     }
+    static safeCompare(a, b) {
+        if (a.length !== b.length) {
+            return false;
+        }
+        return (0, crypto_1.timingSafeEqual)(new TextEncoder().encode(a), new TextEncoder().encode(b));
+    }
     static pickString(...candidates) {
         for (const candidate of candidates) {
             if (candidate === undefined || candidate === null) {
@@ -149,59 +165,55 @@ class WebhookVerificationService {
         return undefined;
     }
     static resolveRawEventId(platform, metadata, payload) {
-        const candidate = (() => {
-            switch (platform) {
-                case 'stripe':
-                    return this.pickString(payload?.request?.idempotency_key, payload?.id, metadata?.id);
-                case 'github':
-                    return this.pickString(metadata?.delivery, metadata?.id, payload?.id);
-                case 'clerk':
-                    return this.pickString(metadata?.id, payload?.id);
-                case 'shopify':
-                    return this.pickString(metadata?.id, payload?.id);
-                case 'polar':
-                    return this.pickString(payload?.data?.id, payload?.id, metadata?.id);
-                case 'dodopayments':
-                    return this.pickString(payload?.data?.payment_id, payload?.data?.subscription_id, payload?.data?.id, metadata?.id);
-                case 'gitlab':
-                    return this.pickString(payload?.object_attributes?.id, payload?.project?.id, metadata?.id);
-                case 'paddle':
-                    return this.pickString(payload?.event_id, payload?.data?.id, metadata?.id);
-                case 'razorpay':
-                    return this.pickString(payload?.payload?.payment?.entity?.id, payload?.payload?.order?.entity?.id, payload?.payload?.subscription?.entity?.id, payload?.id, metadata?.id);
-                case 'lemonsqueezy': {
-                    const eventName = this.pickString(payload?.meta?.event_name);
-                    const dataId = this.pickString(payload?.data?.id, payload?.id);
-                    if (eventName && dataId) {
-                        return `${eventName}_${dataId}`;
-                    }
-                    return this.pickString(dataId, metadata?.id);
-                }
-                case 'workos':
-                case 'vercel':
-                case 'replicateai':
-                case 'sentry':
-                    return this.pickString(payload?.id, metadata?.id);
-                case 'woocommerce':
-                    return this.pickString(payload?.id, metadata?.id);
-                case 'falai':
-                    return this.pickString(payload?.request_id, metadata?.id);
-                case 'grafana':
-                    return this.pickString(payload?.groupKey, payload?.alerts?.[0]?.fingerprint, metadata?.id);
-                case 'doppler':
-                    return this.pickString(payload?.event?.id, metadata?.id);
-                case 'sanity':
-                    return this.pickString(payload?.transactionId, payload?._id, metadata?.id);
-                default:
-                    return this.pickString(payload?.idempotency_key, payload?.event_id, payload?.webhook_id, payload?.request_id, payload?.id, payload?.data?.id, metadata?.id, metadata?.delivery, metadata?.requestId);
+        switch (platform) {
+            case 'stripe':
+                return this.pickString(payload?.request?.idempotency_key, payload?.id) || null;
+            case 'github':
+                return this.pickString(metadata?.delivery) || null;
+            case 'clerk':
+                return this.pickString(metadata?.id) || null;
+            case 'shopify':
+                return this.pickString(metadata?.id, payload?.id) || null;
+            case 'paddle':
+                return this.pickString(payload?.event_id, payload?.data?.id) || null;
+            case 'polar':
+                return this.pickString(payload?.data?.id, payload?.id) || null;
+            case 'dodopayments':
+                return this.pickString(payload?.data?.payment_id, payload?.data?.subscription_id, payload?.data?.id) || null;
+            case 'falai':
+                return this.pickString(payload?.request_id) || null;
+            case 'replicateai':
+            case 'replicate':
+                return this.pickString(payload?.id) || null;
+            case 'workos':
+            case 'sentry':
+            case 'vercel':
+                return this.pickString(payload?.id) || null;
+            case 'doppler':
+                return this.pickString(payload?.event?.id, metadata?.id) || null;
+            case 'sanity':
+                return this.pickString(payload?.transactionId, payload?.['_id']) || null;
+            case 'razorpay':
+                return this.pickString(payload?.payload?.payment?.entity?.id, payload?.payload?.order?.entity?.id, payload?.payload?.subscription?.entity?.id) || null;
+            case 'lemonsqueezy': {
+                const dataId = this.pickString(payload?.data?.id);
+                if (!dataId)
+                    return null;
+                const eventName = this.pickString(payload?.meta?.event_name);
+                return eventName ? `${eventName}_${dataId}` : null;
             }
-        })();
-        if (candidate)
-            return candidate;
-        return `generated-missing-${platform}`;
+            case 'gitlab':
+                return this.pickString(payload?.object_attributes?.id?.toString()) || null;
+            case 'grafana':
+                return this.pickString(payload?.groupKey, payload?.alerts?.[0]?.fingerprint) || null;
+            case 'woocommerce':
+                return this.pickString(payload?.id?.toString()) || null;
+            default:
+                return this.pickString(payload?.idempotency_key, payload?.event_id, payload?.webhook_id, payload?.id, metadata?.id, metadata?.delivery) || null;
+        }
     }
     static detectPlatform(request) {
-        const headers = request.headers;
+        const { headers } = request;
         if (headers.has('stripe-signature'))
             return 'stripe';
         if (headers.has('x-hub-signature-256'))
@@ -271,8 +283,8 @@ class WebhookVerificationService {
                     platform: 'custom',
                 };
             }
-            // Simple comparison - we don't actually verify, just check if tokens match
-            const isValid = idHeader === webhookId && tokenHeader === webhookToken;
+            const isValid = this.safeCompare(idHeader, webhookId)
+                && this.safeCompare(tokenHeader, webhookToken);
             if (!isValid) {
                 return {
                     isValid: false,
@@ -293,7 +305,7 @@ class WebhookVerificationService {
                 isValid: true,
                 platform: 'custom',
                 payload: payload,
-                eventId: `custom:${idHeader}`,
+                eventId: `custom_${idHeader}`,
                 metadata: {
                     id: idHeader,
                     algorithm: 'token-based',

package/dist/upstash/queue.js

@@ -39,16 +39,12 @@ exports.handleProcess = handleProcess;
 exports.handleQueuedRequest = handleQueuedRequest;
 const QStash = __importStar(require("@upstash/qstash"));
 const index_1 = require("../index");
-async function dynamicImport(modulePath) {
-    return new Function('modulePath', 'return import(modulePath);')(modulePath);
-}
 async function loadQStashModules() {
     const optionalImports = await Promise.allSettled([
-        dynamicImport('@upstash/qstash'),
-        dynamicImport('@upstash/qstash/nextjs'),
-        dynamicImport('@upstash/qstash/nuxt'),
-        dynamicImport('@upstash/qstash/sveltekit'),
-        dynamicImport('@upstash/qstash/cloudflare'),
+        Promise.resolve().then(() => __importStar(require('@upstash/qstash'))),
+        Promise.resolve().then(() => __importStar(require('@upstash/qstash/nextjs'))),
+        Promise.resolve().then(() => __importStar(require('@upstash/qstash/nuxt'))),
+        Promise.resolve().then(() => __importStar(require('@upstash/qstash/cloudflare'))),
     ]);
     return [
         QStash,
@@ -92,25 +88,24 @@ function resolveNestedConstructor(modules, key) {
 }
 async function createQStashReceiver(queueConfig) {
     const modules = await loadQStashModules();
-    const receiverExport = resolveModuleExport(modules, 'Receiver')
+    const ReceiverCtor = resolveModuleExport(modules, 'Receiver')
         ?? resolveNestedConstructor(modules, 'Receiver');
-    if (typeof receiverExport !== 'function') {
+    if (typeof ReceiverCtor !== 'function') {
         throw new Error('[tern] Incompatible @upstash/qstash version: Receiver export not found. Ensure @upstash/qstash is installed and up-to-date.');
     }
-    return new receiverExport({
+    return new ReceiverCtor({
         currentSigningKey: queueConfig.signingKey,
         nextSigningKey: queueConfig.nextSigningKey,
     });
 }
 async function createQStashClient(queueConfig) {
     const modules = await loadQStashModules();
-    const clientExport = resolveModuleExport(modules, 'Client');
-    const resolvedClientExport = clientExport
+    const ClientCtor = resolveModuleExport(modules, 'Client')
         ?? resolveNestedConstructor(modules, 'Client');
-    if (typeof resolvedClientExport !== 'function') {
+    if (typeof ClientCtor !== 'function') {
         throw new Error('[tern] Incompatible @upstash/qstash version: Client export not found. Ensure @upstash/qstash is installed and up-to-date.');
     }
-    return new resolvedClientExport({ token: queueConfig.token });
+    return new ClientCtor({ token: queueConfig.token });
 }
 function nonRetryableResponse(message, status = 489) {
     return new Response(JSON.stringify({ error: message }), {
@@ -147,7 +142,7 @@ function toStableJson(value) {
 }
 async function resolveDeduplicationId(request, verificationResult) {
     const payload = verificationResult.payload;
-    const headers = request.headers;
+    const { headers } = request;
     const payloadId = typeof payload?.id === 'string' ? payload.id : null;
     const payloadRequestId = typeof payload?.request_id === 'string' ? payload.request_id : null;
     const nestedPayloadId = payload?.data && typeof payload.data === 'object' && typeof payload.data.id === 'string'
@@ -157,9 +152,7 @@ async function resolveDeduplicationId(request, verificationResult) {
         headers.get('x-github-delivery') ||
         headers.get('idempotency-key') ||
         headers.get('upstash-deduplication-id') ||
-        (verificationResult.eventId && !verificationResult.eventId.includes('generated-missing-')
-            ? verificationResult.eventId
-            : null) ||
+        verificationResult.eventId ||
         (typeof verificationResult.metadata?.id === 'string' ? verificationResult.metadata.id : null) ||
         payloadId ||
         payloadRequestId ||
@@ -185,7 +178,7 @@ async function handleReceive(request, platform, secret, queueConfig, toleranceIn
         metadata: verificationResult.metadata || {},
     };
     const deduplicationId = await resolveDeduplicationId(request, verificationResult);
-    if (process.env.NODE_ENV == 'production') {
+    if (process.env.NODE_ENV !== 'production') {
         console.log(`[tern] deduplication-id: ${deduplicationId} (platform: ${platform})`);
     }
     const publishPayload = {
@@ -199,11 +192,60 @@ async function handleReceive(request, platform, secret, queueConfig, toleranceIn
     if (queueConfig.retries !== undefined) {
         publishPayload.retries = queueConfig.retries;
     }
-    await client.publishJSON(publishPayload);
-    return new Response(JSON.stringify({ queued: true }), {
-        status: 200,
-        headers: { 'Content-Type': 'application/json' },
-    });
+    try {
+        await client.publishJSON(publishPayload);
+        return new Response(JSON.stringify({ queued: true }), {
+            status: 200,
+            headers: { 'Content-Type': 'application/json' },
+        });
+    }
+    catch (error) {
+        const status = error?.status ?? 0;
+        const errorBody = error?.body
+            ? (() => {
+                try {
+                    return JSON.parse(error.body);
+                }
+                catch {
+                    return {};
+                }
+            })()
+            : {};
+        console.error('[tern] QStash publish failed:', {
+            status,
+            message: String(error),
+        });
+        if (status === 400) {
+            return new Response(JSON.stringify({
+                error: 'Invalid payload — could not enqueue',
+                detail: errorBody?.error,
+            }), {
+                status: 489,
+                headers: {
+                    'Content-Type': 'application/json',
+                    'Upstash-NonRetryable-Error': 'true',
+                },
+            });
+        }
+        if (status === 401) {
+            return new Response(JSON.stringify({
+                error: '[tern] QStash token invalid — check QSTASH_TOKEN in env',
+            }), {
+                status: 503,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        if (status === 429) {
+            return new Response(JSON.stringify({ error: 'QStash rate limited — retry shortly' }), {
+                status: 503,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        return new Response(JSON.stringify({ error: 'Queue temporarily unavailable' }), {
+            status: 503,
+            headers: { 'Content-Type': 'application/json' },
+        });
+    }
 }
 async function handleProcess(request, handler, queueConfig) {
     const signature = request.headers.get('upstash-signature');
@@ -219,11 +261,22 @@ async function handleProcess(request, handler, queueConfig) {
             url: request.url,
         });
         if (verification === false) {
-            return new Response(JSON.stringify({ error: 'Unauthorized' }), { status: 401, headers: { 'Content-Type': 'application/json' } });
+            return nonRetryableResponse('Invalid QStash signature', 401);
         }
     }
-    catch {
-        return new Response(JSON.stringify({ error: 'Unauthorized' }), { status: 401, headers: { 'Content-Type': 'application/json' } });
+    catch (error) {
+        const message = String(error).toLowerCase();
+        if (message.includes('invalid signature') ||
+            message.includes('signature') ||
+            message.includes('unauthorized') ||
+            message.includes('forbidden')) {
+            return nonRetryableResponse('Invalid QStash signature', 401);
+        }
+        console.error('[tern] QStash signature verification error:', String(error));
+        return new Response(JSON.stringify({ error: 'Signature verification temporarily unavailable' }), {
+            status: 503,
+            headers: { 'Content-Type': 'application/json' },
+        });
     }
     if (!handler) {
         return nonRetryableResponse('Queue processing requires a handler function');

package/dist/verifiers/algorithms.d.ts

@@ -9,6 +9,7 @@ export declare abstract class AlgorithmBasedVerifier extends WebhookVerifier {
     protected extractSignatures(request: Request): string[];
     protected extractTimestamp(request: Request): number | null;
     protected extractTimestampFromSignature(request: Request): number | null;
+    protected requiresTimestamp(): boolean;
     protected formatPayload(rawBody: string, request: Request): string;
     protected formatCustomPayload(rawBody: string, request: Request): string;
     protected verifyHMAC(payload: string, signature: string, algorithm?: string): boolean;

package/dist/verifiers/algorithms.js

@@ -102,6 +102,29 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
         const timestampKey = this.config.customConfig?.timestampKey || "t";
         return sigMap[timestampKey] ? parseInt(sigMap[timestampKey], 10) : null;
     }
+    requiresTimestamp() {
+        // fal.ai timestamp is part of the signed payload itself — always required
+        if (this.platform === 'falai')
+            return true;
+        // These platforms have timestampHeader in config but timestamp
+        // is optional in their spec — validate only if present, never mandate
+        const optionalTimestampPlatforms = ['vercel', 'sentry', 'grafana'];
+        if (optionalTimestampPlatforms.includes(this.platform))
+            return false;
+        // For all other platforms: infer from config
+        if (this.config.timestampHeader)
+            return true;
+        if (this.config.payloadFormat === 'timestamped')
+            return true;
+        if (this.config.payloadFormat === 'custom'
+            && this.config.customConfig?.payloadFormat
+            && `${this.config.customConfig.payloadFormat}`.includes('{timestamp}'))
+            return true;
+        if (this.config.headerFormat === 'comma-separated'
+            && this.config.customConfig?.timestampKey)
+            return true;
+        return false;
+    }
     formatPayload(rawBody, request) {
         switch (this.config.payloadFormat) {
             case "timestamped": {
@@ -273,6 +296,14 @@ class GenericHMACVerifier extends AlgorithmBasedVerifier {
             else {
                 timestamp = this.extractTimestamp(request);
             }
+            if (this.requiresTimestamp() && !timestamp) {
+                return {
+                    isValid: false,
+                    error: 'Missing required timestamp for webhook verification',
+                    errorCode: 'MISSING_SIGNATURE',
+                    platform: this.platform,
+                };
+            }
             if (timestamp && !this.isTimestampValid(timestamp)) {
                 return {
                     isValid: false,
@@ -357,7 +388,15 @@ class Ed25519Verifier extends AlgorithmBasedVerifier {
         if (cached && Date.now() < cached.expiresAt) {
             return cached.pems;
         }
-        const response = await fetch(jwksUrl);
+        const abortController = new AbortController();
+        const timeout = setTimeout(() => abortController.abort(), 3000);
+        let response;
+        try {
+            response = await fetch(jwksUrl, { signal: abortController.signal });
+        }
+        finally {
+            clearTimeout(timeout);
+        }
         if (!response.ok) {
             throw new Error(`Failed to fetch JWKS from ${jwksUrl}: ${response.status}`);
         }
@@ -396,7 +435,7 @@ class Ed25519Verifier extends AlgorithmBasedVerifier {
      *   2. Non-empty secret passed directly (user-provided PEM)
      *   3. JWKS URL in config (fal.ai — fetches all keys, tries each)
      */
-    async resolvePublicKeys(request) {
+    async resolvePublicKeys() {
         // 1. explicit public key in config
         const configPublicKey = this.config.customConfig?.publicKey;
         if (configPublicKey) {
@@ -449,16 +488,22 @@ class Ed25519Verifier extends AlgorithmBasedVerifier {
                 const timestampHeader = this.config.customConfig?.timestampHeader ||
                     "x-fal-webhook-timestamp";
                 const timestampStr = request.headers.get(timestampHeader);
-                if (timestampStr) {
-                    const timestamp = parseInt(timestampStr, 10);
-                    if (!this.isTimestampValid(timestamp)) {
-                        return {
-                            isValid: false,
-                            error: "Webhook timestamp expired",
-                            errorCode: "TIMESTAMP_EXPIRED",
-                            platform: this.platform,
-                        };
-                    }
+                if (!timestampStr) {
+                    return {
+                        isValid: false,
+                        error: 'Missing required timestamp for webhook verification',
+                        errorCode: 'MISSING_SIGNATURE',
+                        platform: this.platform,
+                    };
+                }
+                const timestamp = parseInt(timestampStr, 10);
+                if (!this.isTimestampValid(timestamp)) {
+                    return {
+                        isValid: false,
+                        error: "Webhook timestamp expired",
+                        errorCode: "TIMESTAMP_EXPIRED",
+                        platform: this.platform,
+                    };
                 }
             }
             const payload = this.platform === "falai"
@@ -467,7 +512,7 @@ class Ed25519Verifier extends AlgorithmBasedVerifier {
             // resolve all public keys
             let publicKeys;
             try {
-                publicKeys = await this.resolvePublicKeys(request);
+                publicKeys = await this.resolvePublicKeys();
             }
             catch (error) {
                 return {

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@hookflo/tern",
-  "version": "4.0.2",
+  "version": "4.1.0",
   "description": "A robust, scalable webhook verification framework supporting multiple platforms and signature algorithms",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "scripts": {
     "build": "tsc",
     "dev": "tsc --watch",
-    "test": "node dist/test.js",
+    "test": "ts-node src/test.ts",
     "lint": "eslint src/**/*.ts",
     "lint:fix": "eslint 'src/**/*.ts' --fix",
     "format": "prettier --write src/**/*.ts",

package/dist/adapters/testExpress.d.ts

@@ -1 +0,0 @@
-export {};