@hookflo/tern 4.3.1-beta → 4.3.3-beta

package/README.md

@@ -79,6 +79,27 @@ const result = await WebhookVerificationService.verifyAny(request, {
 console.log(`Verified ${result.platform} webhook`);
 ```
 
+### Twilio example
+
+```typescript
+import { WebhookVerificationService } from '@hookflo/tern';
+
+export async function POST(request: Request) {
+  const result = await WebhookVerificationService.verify(request, {
+    platform: 'twilio',
+    secret: process.env.TWILIO_AUTH_TOKEN!,
+    // Optional when behind proxies/CDNs if request.url differs from the public Twilio URL:
+    twilioBaseUrl: 'https://yourdomain.com/api/webhooks/twilio',
+  });
+
+  if (!result.isValid) {
+    return Response.json({ error: result.error }, { status: 400 });
+  }
+
+  return Response.json({ ok: true });
+}
+```
+
 ### Core SDK (runtime-agnostic)
 
 Use Tern without framework adapters in any runtime that supports the Web `Request` API.
@@ -171,6 +192,9 @@ app.post('/webhooks/stripe', createWebhookHandler({
 
 ## Supported Platforms
 
+> ⚠️ Normalization is no longer supported in Tern and has been removed from the public verification APIs.
+
+
 | Platform | Algorithm | Status |
 |---|---|---|
 | **Stripe** | HMAC-SHA256 | ✅ Tested |
@@ -407,6 +431,9 @@ interface WebhookVerificationResult {
 
 ## Troubleshooting
 
+- **Twilio invalid signature behind proxies/CDNs**: if your runtime `request.url` differs from the public Twilio webhook URL, pass `twilioBaseUrl` in `WebhookVerificationService.verify(...)` for platform `twilio`.
+
+
 **`Module not found: Can't resolve "@hookflo/tern/nextjs"`**
 
 ```bash

package/dist/adapters/cloudflare.d.ts

@@ -1,4 +1,4 @@
-import { WebhookPlatform, NormalizeOptions } from '../types';
+import { WebhookPlatform } from '../types';
 import { QueueOption } from '../upstash/types';
 import type { AlertConfig, SendAlertOptions } from '../notifications/types';
 export interface CloudflareWebhookHandlerOptions<TEnv = Record<string, unknown>, TPayload = any, TMetadata extends Record<string, unknown> = Record<string, unknown>, TResponse = unknown> {
@@ -6,7 +6,6 @@ export interface CloudflareWebhookHandlerOptions<TEnv = Record<string, unknown>,
     secret?: string;
     secretEnv?: string;
     toleranceInSeconds?: number;
-    normalize?: boolean | NormalizeOptions;
     queue?: QueueOption;
     alerts?: AlertConfig;
     alert?: Omit<SendAlertOptions, 'dlq' | 'dlqId' | 'source' | 'eventId'>;

package/dist/adapters/cloudflare.js

@@ -39,7 +39,7 @@ function createWebhookHandler(options) {
                 }
                 return response;
             }
-            const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(request, options.platform, secret, options.toleranceInSeconds, options.normalize);
+            const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(request, options.platform, secret, options.toleranceInSeconds);
             if (!result.isValid) {
                 return Response.json({ error: result.error, errorCode: result.errorCode, platform: result.platform, metadata: result.metadata }, { status: 400 });
             }

package/dist/adapters/express.d.ts

@@ -1,4 +1,4 @@
-import { WebhookPlatform, WebhookVerificationResult, NormalizeOptions } from '../types';
+import { WebhookPlatform, WebhookVerificationResult } from '../types';
 import { QueueOption } from '../upstash/types';
 import { MinimalNodeRequest } from './shared';
 import type { AlertConfig, SendAlertOptions } from '../notifications/types';
@@ -14,7 +14,6 @@ export interface ExpressWebhookMiddlewareOptions {
     platform: WebhookPlatform;
     secret: string;
     toleranceInSeconds?: number;
-    normalize?: boolean | NormalizeOptions;
     queue?: QueueOption;
     alerts?: AlertConfig;
     alert?: Omit<SendAlertOptions, 'dlq' | 'dlqId' | 'source' | 'eventId'>;

package/dist/adapters/express.js

@@ -48,7 +48,7 @@ function createWebhookMiddleware(options) {
                 }
                 return;
             }
-            const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(webRequest, options.platform, options.secret, options.toleranceInSeconds, options.normalize);
+            const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(webRequest, options.platform, options.secret, options.toleranceInSeconds);
             if (!result.isValid) {
                 res.status(400).json({
                     error: result.error,

package/dist/adapters/hono.d.ts

@@ -1,4 +1,4 @@
-import { WebhookPlatform, NormalizeOptions } from '../types';
+import { WebhookPlatform } from '../types';
 import { QueueOption } from '../upstash/types';
 import type { AlertConfig, SendAlertOptions } from '../notifications/types';
 export interface HonoContextLike {
@@ -11,7 +11,6 @@ export interface HonoWebhookHandlerOptions<TContext extends HonoContextLike = Ho
     platform: WebhookPlatform;
     secret: string;
     toleranceInSeconds?: number;
-    normalize?: boolean | NormalizeOptions;
     queue?: QueueOption;
     alerts?: AlertConfig;
     alert?: Omit<SendAlertOptions, 'dlq' | 'dlqId' | 'source' | 'eventId'>;

package/dist/adapters/hono.js

@@ -35,7 +35,7 @@ function createWebhookHandler(options) {
                 }
                 return response;
             }
-            const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(request, options.platform, options.secret, options.toleranceInSeconds, options.normalize);
+            const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(request, options.platform, options.secret, options.toleranceInSeconds);
             if (!result.isValid) {
                 return c.json({
                     error: result.error,

package/dist/adapters/nextjs.d.ts

@@ -1,11 +1,10 @@
-import { WebhookPlatform, NormalizeOptions } from '../types';
+import { WebhookPlatform } from '../types';
 import { QueueOption } from '../upstash/types';
 import type { AlertConfig, SendAlertOptions } from '../notifications/types';
 export interface NextWebhookHandlerOptions<TPayload = any, TMetadata extends Record<string, unknown> = Record<string, unknown>, TResponse = unknown> {
     platform: WebhookPlatform;
     secret: string;
     toleranceInSeconds?: number;
-    normalize?: boolean | NormalizeOptions;
     queue?: QueueOption;
     alerts?: AlertConfig;
     alert?: Omit<SendAlertOptions, 'dlq' | 'dlqId' | 'source' | 'eventId'>;

package/dist/adapters/nextjs.js

@@ -34,7 +34,7 @@ function createWebhookHandler(options) {
                 }
                 return response;
             }
-            const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(request, options.platform, options.secret, options.toleranceInSeconds, options.normalize);
+            const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(request, options.platform, options.secret, options.toleranceInSeconds);
             if (!result.isValid) {
                 return Response.json({ error: result.error, errorCode: result.errorCode, platform: result.platform, metadata: result.metadata }, { status: 400 });
             }

package/dist/adapters/shared.js

@@ -90,8 +90,11 @@ function toHeadersInit(headers) {
     return normalized;
 }
 async function toWebRequest(request) {
-    const protocol = request.protocol || 'https';
-    const host = request.get?.('host')
+    const forwardedProto = getHeaderValue(request.headers, 'x-forwarded-proto')?.split(',')[0]?.trim();
+    const protocol = forwardedProto || request.protocol || 'https';
+    const forwardedHost = getHeaderValue(request.headers, 'x-forwarded-host')?.split(',')[0]?.trim();
+    const host = forwardedHost
+        || request.get?.('host')
         || getHeaderValue(request.headers, 'host')
         || 'localhost';
     const path = request.originalUrl || request.url || '/';

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { WebhookConfig, WebhookVerificationResult, WebhookPlatform, SignatureConfig, MultiPlatformSecrets, NormalizeOptions } from './types';
+import { WebhookConfig, WebhookVerificationResult, WebhookPlatform, SignatureConfig, MultiPlatformSecrets } from './types';
 import type { QueueOption } from './upstash/types';
 import type { AlertConfig, SendAlertOptions } from './notifications/types';
 export declare class WebhookVerificationService {
@@ -6,8 +6,8 @@ export declare class WebhookVerificationService {
     private static getVerifier;
     private static createAlgorithmBasedVerifier;
     private static getLegacyVerifier;
-    static verifyWithPlatformConfig<TPayload = unknown>(request: Request, platform: WebhookPlatform, secret: string, toleranceInSeconds?: number, normalize?: boolean | NormalizeOptions): Promise<WebhookVerificationResult<TPayload>>;
-    static verifyAny<TPayload = unknown>(request: Request, secrets: MultiPlatformSecrets, toleranceInSeconds?: number, normalize?: boolean | NormalizeOptions): Promise<WebhookVerificationResult<TPayload>>;
+    static verifyWithPlatformConfig<TPayload = unknown>(request: Request, platform: WebhookPlatform, secret: string, toleranceInSeconds?: number): Promise<WebhookVerificationResult<TPayload>>;
+    static verifyAny<TPayload = unknown>(request: Request, secrets: MultiPlatformSecrets, toleranceInSeconds?: number): Promise<WebhookVerificationResult<TPayload>>;
     private static resolveCanonicalEventId;
     private static safeCompare;
     private static pickString;
@@ -32,7 +32,6 @@ export * from './types';
 export { getPlatformAlgorithmConfig, platformUsesAlgorithm, getPlatformsUsingAlgorithm, validateSignatureConfig, } from './platforms/algorithms';
 export { createAlgorithmVerifier } from './verifiers/algorithms';
 export { createCustomVerifier } from './verifiers/custom-algorithms';
-export { normalizePayload, getPlatformNormalizationCategory, getPlatformsByCategory, } from './normalization/simple';
 export * from './adapters';
 export * from './alerts';
 export default WebhookVerificationService;

package/dist/index.js

@@ -36,12 +36,11 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getPlatformsByCategory = exports.getPlatformNormalizationCategory = exports.normalizePayload = exports.createCustomVerifier = exports.createAlgorithmVerifier = exports.validateSignatureConfig = exports.getPlatformsUsingAlgorithm = exports.platformUsesAlgorithm = exports.getPlatformAlgorithmConfig = exports.WebhookVerificationService = void 0;
+exports.createCustomVerifier = exports.createAlgorithmVerifier = exports.validateSignatureConfig = exports.getPlatformsUsingAlgorithm = exports.platformUsesAlgorithm = exports.getPlatformAlgorithmConfig = exports.WebhookVerificationService = void 0;
 const crypto_1 = require("crypto");
 const algorithms_1 = require("./verifiers/algorithms");
 const custom_algorithms_1 = require("./verifiers/custom-algorithms");
 const algorithms_2 = require("./platforms/algorithms");
-const simple_1 = require("./normalization/simple");
 const dispatch_1 = require("./notifications/dispatch");
 class WebhookVerificationService {
     static async verify(request, config) {
@@ -51,9 +50,6 @@ class WebhookVerificationService {
         if (result.isValid) {
             result.platform = config.platform;
             result.eventId = this.resolveCanonicalEventId(config.platform, result.metadata, result.payload) ?? undefined;
-            if (config.normalize) {
-                result.payload = (0, simple_1.normalizePayload)(config.platform, result.payload, config.normalize);
-            }
         }
         return result;
     }
@@ -70,12 +66,21 @@ class WebhookVerificationService {
         if (!signatureConfig) {
             throw new Error('Signature config is required for algorithm-based verification');
         }
+        const effectiveSignatureConfig = {
+            ...signatureConfig,
+            customConfig: {
+                ...(signatureConfig.customConfig || {}),
+                ...(config.platform === 'twilio' && config.twilioBaseUrl
+                    ? { twilioBaseUrl: config.twilioBaseUrl }
+                    : {}),
+            },
+        };
         // Use custom verifiers for special cases (token-based, etc.)
-        if (signatureConfig.algorithm === 'custom') {
-            return (0, custom_algorithms_1.createCustomVerifier)(secret, signatureConfig, toleranceInSeconds);
+        if (effectiveSignatureConfig.algorithm === 'custom') {
+            return (0, custom_algorithms_1.createCustomVerifier)(secret, effectiveSignatureConfig, toleranceInSeconds);
         }
         // Use algorithm-based verifiers for standard algorithms
-        return (0, algorithms_1.createAlgorithmVerifier)(secret, signatureConfig, config.platform, toleranceInSeconds);
+        return (0, algorithms_1.createAlgorithmVerifier)(secret, effectiveSignatureConfig, config.platform, toleranceInSeconds);
     }
     static getLegacyVerifier(config) {
         // For legacy support, we'll use the algorithm-based approach
@@ -87,29 +92,28 @@ class WebhookVerificationService {
         return this.createAlgorithmBasedVerifier(configWithSignature);
     }
     // New method to create verifier using platform algorithm config
-    static async verifyWithPlatformConfig(request, platform, secret, toleranceInSeconds = 300, normalize = false) {
+    static async verifyWithPlatformConfig(request, platform, secret, toleranceInSeconds = 300) {
         const platformConfig = (0, algorithms_2.getPlatformAlgorithmConfig)(platform);
         const config = {
             platform,
             secret,
             toleranceInSeconds,
-            signatureConfig: platformConfig.signatureConfig,
-            normalize,
+            signatureConfig: platformConfig.signatureConfig
         };
         return this.verify(request, config);
     }
-    static async verifyAny(request, secrets, toleranceInSeconds = 300, normalize = false) {
+    static async verifyAny(request, secrets, toleranceInSeconds = 300) {
         const requestClone = request.clone();
         const detectedPlatform = this.detectPlatform(requestClone);
         if (detectedPlatform !== 'unknown' && secrets[detectedPlatform]) {
-            return this.verifyWithPlatformConfig(requestClone, detectedPlatform, secrets[detectedPlatform], toleranceInSeconds, normalize);
+            return this.verifyWithPlatformConfig(requestClone, detectedPlatform, secrets[detectedPlatform], toleranceInSeconds);
         }
         const failedAttempts = [];
         const verificationResults = await Promise.all(Object.entries(secrets)
             .filter(([, secret]) => Boolean(secret))
             .map(async ([platform, secret]) => {
             const normalizedPlatform = platform.toLowerCase();
-            const result = await this.verifyWithPlatformConfig(requestClone, normalizedPlatform, secret, toleranceInSeconds, normalize);
+            const result = await this.verifyWithPlatformConfig(requestClone, normalizedPlatform, secret, toleranceInSeconds);
             return {
                 platform: normalizedPlatform,
                 result,
@@ -375,10 +379,6 @@ var algorithms_4 = require("./verifiers/algorithms");
 Object.defineProperty(exports, "createAlgorithmVerifier", { enumerable: true, get: function () { return algorithms_4.createAlgorithmVerifier; } });
 var custom_algorithms_2 = require("./verifiers/custom-algorithms");
 Object.defineProperty(exports, "createCustomVerifier", { enumerable: true, get: function () { return custom_algorithms_2.createCustomVerifier; } });
-var simple_2 = require("./normalization/simple");
-Object.defineProperty(exports, "normalizePayload", { enumerable: true, get: function () { return simple_2.normalizePayload; } });
-Object.defineProperty(exports, "getPlatformNormalizationCategory", { enumerable: true, get: function () { return simple_2.getPlatformNormalizationCategory; } });
-Object.defineProperty(exports, "getPlatformsByCategory", { enumerable: true, get: function () { return simple_2.getPlatformsByCategory; } });
 __exportStar(require("./adapters"), exports);
 __exportStar(require("./alerts"), exports);
 exports.default = WebhookVerificationService;

package/dist/types.d.ts

@@ -39,69 +39,6 @@ export interface SignatureConfig {
     customConfig?: Record<string, any>;
 }
 export type WebhookErrorCode = 'MISSING_SIGNATURE' | 'INVALID_SIGNATURE' | 'TIMESTAMP_EXPIRED' | 'MISSING_TOKEN' | 'INVALID_TOKEN' | 'PLATFORM_NOT_SUPPORTED' | 'NORMALIZATION_ERROR' | 'VERIFICATION_ERROR';
-export type NormalizationCategory = 'payment' | 'auth' | 'ecommerce' | 'infrastructure';
-export interface BaseNormalizedWebhook {
-    category: NormalizationCategory;
-    event: string;
-    _platform: WebhookPlatform | string;
-    _raw: unknown;
-    occurred_at?: string;
-}
-export type PaymentWebhookEvent = 'payment.succeeded' | 'payment.failed' | 'payment.refunded' | 'subscription.created' | 'subscription.cancelled' | 'payment.unknown';
-export interface PaymentWebhookNormalized extends BaseNormalizedWebhook {
-    category: 'payment';
-    event: PaymentWebhookEvent;
-    amount?: number;
-    currency?: string;
-    customer_id?: string;
-    transaction_id?: string;
-    subscription_id?: string;
-    refund_amount?: number;
-    failure_reason?: string;
-    metadata?: Record<string, string>;
-}
-export type AuthWebhookEvent = 'user.created' | 'user.updated' | 'user.deleted' | 'session.started' | 'session.ended' | 'auth.unknown';
-export interface AuthWebhookNormalized extends BaseNormalizedWebhook {
-    category: 'auth';
-    event: AuthWebhookEvent;
-    user_id?: string;
-    email?: string;
-    phone?: string;
-    metadata?: Record<string, string>;
-}
-export interface EcommerceWebhookNormalized extends BaseNormalizedWebhook {
-    category: 'ecommerce';
-    event: string;
-    order_id?: string;
-    customer_id?: string;
-    amount?: number;
-    currency?: string;
-    metadata?: Record<string, string>;
-}
-export interface InfrastructureWebhookNormalized extends BaseNormalizedWebhook {
-    category: 'infrastructure';
-    event: string;
-    project_id?: string;
-    deployment_id?: string;
-    status?: 'queued' | 'building' | 'ready' | 'error' | 'unknown';
-    metadata?: Record<string, string>;
-}
-export interface UnknownNormalizedWebhook extends BaseNormalizedWebhook {
-    event: string;
-    warning?: string;
-}
-export type NormalizedPayloadByCategory = {
-    payment: PaymentWebhookNormalized;
-    auth: AuthWebhookNormalized;
-    ecommerce: EcommerceWebhookNormalized;
-    infrastructure: InfrastructureWebhookNormalized;
-};
-export type AnyNormalizedWebhook = PaymentWebhookNormalized | AuthWebhookNormalized | EcommerceWebhookNormalized | InfrastructureWebhookNormalized | UnknownNormalizedWebhook;
-export interface NormalizeOptions {
-    enabled?: boolean;
-    category?: NormalizationCategory;
-    includeRaw?: boolean;
-}
 export interface WebhookVerificationResult<TPayload = unknown> {
     isValid: boolean;
     error?: string;
@@ -120,7 +57,7 @@ export interface WebhookConfig {
     secret: string;
     toleranceInSeconds?: number;
     signatureConfig?: SignatureConfig;
-    normalize?: boolean | NormalizeOptions;
+    twilioBaseUrl?: string;
 }
 export interface MultiPlatformSecrets {
     [platform: string]: string | undefined;

package/dist/verifiers/algorithms.d.ts

@@ -5,11 +5,17 @@ export declare abstract class AlgorithmBasedVerifier extends WebhookVerifier {
     protected platform: WebhookPlatform;
     constructor(secret: string, config: SignatureConfig, platform: WebhookPlatform, toleranceInSeconds?: number);
     abstract verify(request: Request): Promise<WebhookVerificationResult>;
+    protected getMissingSignatureMessage(): string;
+    protected getMissingTimestampMessage(): string;
+    protected getTimestampExpiredMessage(): string;
+    protected getInvalidSignatureMessage(): string;
+    protected getVerificationErrorMessage(error: Error): string;
     protected parseDelimitedHeader(headerValue: string): Record<string, string>;
     protected extractSignatures(request: Request): string[];
     protected extractTimestamp(request: Request): number | null;
     protected extractTimestampFromSignature(request: Request): number | null;
     protected requiresTimestamp(): boolean;
+    protected resolveTwilioSignatureUrl(request: Request): string;
     protected formatPayload(rawBody: string, request: Request): string;
     protected formatCustomPayload(rawBody: string, request: Request): string;
     protected verifyHMAC(payload: string, signature: string, algorithm?: string): boolean;

package/dist/verifiers/algorithms.js

@@ -13,6 +13,40 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
         this.config = config;
         this.platform = platform;
     }
+    getMissingSignatureMessage() {
+        return `Missing signature header: ${this.config.headerName}. Ensure your webhook provider sends this header and your adapter forwards it unchanged.`;
+    }
+    getMissingTimestampMessage() {
+        const timestampHeader = this.config.timestampHeader || this.config.customConfig?.timestampHeader || 'timestamp';
+        return `Missing required timestamp for webhook verification. Verify header '${timestampHeader}' is present and passed through by your framework/proxy.`;
+    }
+    getTimestampExpiredMessage() {
+        return 'Webhook timestamp expired. Check server clock drift and increase tolerance only if your provider allows it.';
+    }
+    getInvalidSignatureMessage() {
+        const genericHint = `Invalid signature for ${this.platform}. Confirm webhook secret, raw request body handling, and signature header formatting.`;
+        switch (this.platform) {
+            case 'twilio':
+                return `${genericHint} Twilio also requires the exact public URL used for signing (including query params like bodySHA256). Use twilioBaseUrl if your runtime URL is rewritten behind a proxy.`;
+            case 'stripe':
+                return `${genericHint} Stripe signatures require the exact raw body and Stripe-Signature timestamp/value pair.`;
+            case 'github':
+                return `${genericHint} GitHub signatures must include the sha256= prefix from x-hub-signature-256.`;
+            case 'svix':
+            case 'clerk':
+            case 'dodopayments':
+            case 'replicateai':
+            case 'polar':
+                return `${genericHint} Standard Webhooks payload must be signed as id.timestamp.body and secrets may need whsec_ base64 decoding.`;
+            case 'pagerduty':
+                return `${genericHint} PagerDuty expects v1=<hex> signature values from x-pagerduty-signature.`;
+            default:
+                return genericHint;
+        }
+    }
+    getVerificationErrorMessage(error) {
+        return `${this.platform} verification error: ${error.message}. Check webhook secret configuration and ensure your framework preserves raw body + headers.`;
+    }
     parseDelimitedHeader(headerValue) {
         const parts = headerValue.split(/[;,]/);
         const values = {};
@@ -152,6 +186,16 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
             return true;
         return false;
     }
+    resolveTwilioSignatureUrl(request) {
+        const overrideBaseUrl = this.config.customConfig?.twilioBaseUrl;
+        if (!overrideBaseUrl) {
+            return request.url;
+        }
+        const requestUrl = new URL(request.url);
+        const baseUrl = new URL(overrideBaseUrl);
+        baseUrl.search = requestUrl.search;
+        return baseUrl.toString();
+    }
     formatPayload(rawBody, request) {
         switch (this.config.payloadFormat) {
             case "timestamped": {
@@ -196,7 +240,7 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
         }
         if (customFormat.includes('{url}')) {
             return customFormat
-                .replace('{url}', request.url)
+                .replace('{url}', this.platform === 'twilio' ? this.resolveTwilioSignatureUrl(request) : request.url)
                 .replace('{body}', rawBody);
         }
         if (customFormat.includes("{timestamp}") &&
@@ -306,7 +350,7 @@ class GenericHMACVerifier extends AlgorithmBasedVerifier {
         if (this.platform !== 'twilio' || !this.config.customConfig?.validateBodySHA256) {
             return null;
         }
-        const url = new URL(request.url);
+        const url = new URL(this.resolveTwilioSignatureUrl(request));
         const bodySha = url.searchParams.get('bodySHA256');
         if (!bodySha)
             return null;
@@ -349,7 +393,7 @@ class GenericHMACVerifier extends AlgorithmBasedVerifier {
             if (signatures.length === 0) {
                 return {
                     isValid: false,
-                    error: `Missing signature header: ${this.config.headerName}`,
+                    error: this.getMissingSignatureMessage(),
                     errorCode: "MISSING_SIGNATURE",
                     platform: this.platform,
                 };
@@ -383,7 +427,7 @@ class GenericHMACVerifier extends AlgorithmBasedVerifier {
             if (this.requiresTimestamp() && !timestamp) {
                 return {
                     isValid: false,
-                    error: 'Missing required timestamp for webhook verification',
+                    error: this.getMissingTimestampMessage(),
                     errorCode: 'MISSING_SIGNATURE',
                     platform: this.platform,
                 };
@@ -391,7 +435,7 @@ class GenericHMACVerifier extends AlgorithmBasedVerifier {
             if (timestamp && !this.isTimestampValid(timestamp)) {
                 return {
                     isValid: false,
-                    error: "Webhook timestamp expired",
+                    error: this.getTimestampExpiredMessage(),
                     errorCode: "TIMESTAMP_EXPIRED",
                     platform: this.platform,
                 };
@@ -423,7 +467,7 @@ class GenericHMACVerifier extends AlgorithmBasedVerifier {
             if (!isValid) {
                 return {
                     isValid: false,
-                    error: "Invalid signature",
+                    error: this.getInvalidSignatureMessage(),
                     errorCode: "INVALID_SIGNATURE",
                     platform: this.platform,
                 };
@@ -452,7 +496,7 @@ class GenericHMACVerifier extends AlgorithmBasedVerifier {
         catch (error) {
             return {
                 isValid: false,
-                error: `${this.platform} verification error: ${error.message}`,
+                error: this.getVerificationErrorMessage(error),
                 errorCode: "VERIFICATION_ERROR",
                 platform: this.platform,
             };
@@ -561,7 +605,7 @@ class Ed25519Verifier extends AlgorithmBasedVerifier {
             if (signatures.length === 0) {
                 return {
                     isValid: false,
-                    error: `Missing signature header: ${this.config.headerName}`,
+                    error: this.getMissingSignatureMessage(),
                     errorCode: "MISSING_SIGNATURE",
                     platform: this.platform,
                 };
@@ -575,7 +619,7 @@ class Ed25519Verifier extends AlgorithmBasedVerifier {
                 if (!timestampStr) {
                     return {
                         isValid: false,
-                        error: 'Missing required timestamp for webhook verification',
+                        error: this.getMissingTimestampMessage(),
                         errorCode: 'MISSING_SIGNATURE',
                         platform: this.platform,
                     };
@@ -584,7 +628,7 @@ class Ed25519Verifier extends AlgorithmBasedVerifier {
                 if (!this.isTimestampValid(timestamp)) {
                     return {
                         isValid: false,
-                        error: "Webhook timestamp expired",
+                        error: this.getTimestampExpiredMessage(),
                         errorCode: "TIMESTAMP_EXPIRED",
                         platform: this.platform,
                     };
@@ -644,7 +688,7 @@ class Ed25519Verifier extends AlgorithmBasedVerifier {
             if (!isValid) {
                 return {
                     isValid: false,
-                    error: "Invalid signature",
+                    error: this.getInvalidSignatureMessage(),
                     errorCode: "INVALID_SIGNATURE",
                     platform: this.platform,
                 };
@@ -673,7 +717,7 @@ class Ed25519Verifier extends AlgorithmBasedVerifier {
         catch (error) {
             return {
                 isValid: false,
-                error: `${this.platform} verification error: ${error.message}`,
+                error: this.getVerificationErrorMessage(error),
                 errorCode: "VERIFICATION_ERROR",
                 platform: this.platform,
             };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hookflo/tern",
-  "version": "4.3.1-beta",
+  "version": "4.3.3-beta",
   "description": "A robust, scalable webhook verification framework supporting multiple platforms and signature algorithms",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/dist/normalization/index.d.ts

@@ -1,20 +0,0 @@
-import { BaseTemplate, CreateSchemaInput, NormalizedResult, ProviderInfo, TemplateCategory, TransformParams, UpdateSchemaInput, UserSchema } from './types';
-import { StorageAdapter } from './storage/interface';
-export declare class Normalizer {
-    private readonly storage;
-    private engine;
-    constructor(storage?: StorageAdapter);
-    getBaseTemplates(): Promise<BaseTemplate[]>;
-    getProviders(category?: TemplateCategory): Promise<ProviderInfo[]>;
-    createSchema(input: CreateSchemaInput): Promise<UserSchema>;
-    updateSchema(schemaId: string, updates: UpdateSchemaInput): Promise<void>;
-    getSchema(id: string): Promise<UserSchema | null>;
-    transform(params: TransformParams): Promise<NormalizedResult>;
-    validateSchema(schema: UserSchema): Promise<{
-        valid: boolean;
-        errors: string[];
-    }>;
-}
-export * from './types';
-export * from './storage/interface';
-export { InMemoryStorageAdapter } from './storage/memory';

package/dist/normalization/index.js

@@ -1,78 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.InMemoryStorageAdapter = exports.Normalizer = void 0;
-const registry_1 = require("./providers/registry");
-const registry_2 = require("./templates/registry");
-const memory_1 = require("./storage/memory");
-const engine_1 = require("./transformer/engine");
-const validator_1 = require("./transformer/validator");
-class Normalizer {
-    constructor(storage = new memory_1.InMemoryStorageAdapter()) {
-        this.storage = storage;
-        this.engine = new engine_1.NormalizationEngine(storage, new validator_1.SchemaValidator());
-    }
-    async getBaseTemplates() {
-        return this.storage.listBaseTemplates();
-    }
-    async getProviders(category) {
-        return registry_1.providerRegistry.list(category);
-    }
-    async createSchema(input) {
-        const schema = {
-            id: generateId(),
-            userId: input.userId,
-            baseTemplateId: input.baseTemplateId,
-            category: input.category,
-            fields: input.fields,
-            providerMappings: input.providerMappings,
-            createdAt: new Date(),
-            updatedAt: new Date(),
-        };
-        await this.storage.saveSchema(schema);
-        return schema;
-    }
-    async updateSchema(schemaId, updates) {
-        await this.storage.updateSchema(schemaId, updates);
-    }
-    async getSchema(id) {
-        return this.storage.getSchema(id);
-    }
-    async transform(params) {
-        return this.engine.transform(params);
-    }
-    async validateSchema(schema) {
-        const base = (await this.storage.getBaseTemplate(schema.baseTemplateId))
-            ?? registry_2.templateRegistry.getById(schema.baseTemplateId);
-        if (!base) {
-            return {
-                valid: false,
-                errors: [`Base template not found: ${schema.baseTemplateId}`],
-            };
-        }
-        const validator = new validator_1.SchemaValidator();
-        return validator.validateSchema(schema, base);
-    }
-}
-exports.Normalizer = Normalizer;
-function generateId() {
-    // Simple non-crypto unique ID generator for framework default
-    return (`sch_${Math.random().toString(36).slice(2, 10)}${Date.now().toString(36)}`);
-}
-__exportStar(require("./types"), exports);
-__exportStar(require("./storage/interface"), exports);
-var memory_2 = require("./storage/memory");
-Object.defineProperty(exports, "InMemoryStorageAdapter", { enumerable: true, get: function () { return memory_2.InMemoryStorageAdapter; } });