Add framework examples and tighten Express raw-body handling

[Prateek32177]

Motivation

• Provide four self-contained framework examples (Hono, Next.js App Router, Cloudflare Workers, Express) that demonstrate webhook verification against the local @hookflo/tern build to make onboarding and testing with the Stripe CLI straightforward.
• Fix the Express verification failure mode where global express.json() consumption of the body causes signature verification to fail silently.
• Expose a CLI-first quick-start flow so users can scaffold handlers with npx @hookflo/tern-cli and run local tests without external storage.

Description

• Add examples/ workspace and per-framework example packages with package.json, tsconfig.json, src/ handlers, and per-example README.md files for Hono, Next.js, Cloudflare Workers, and Express, and a top-level examples/README.md with quick starts and CLI guidance.
• Point each example's dependency on @hookflo/tern to the local repo via "@hookflo/tern": "../../" so examples use the local build.
• Update src/adapters/shared.ts to accept an optional rawBody on MinimalNodeRequest and add hasRawByteBody and hasUsableRawBody helpers and prefer rawBody when extracting bytes.
• Update the Express adapter (createWebhookMiddleware) to only return a strict-mode error when the request body was parsed (hasParsedBody) and no usable raw bytes are present (!hasUsableRawBody), preserving existing strict safety but allowing frameworks/middleware that provide raw bytes to work.

Testing

• npm run build at the repo root completed successfully.
• npm install inside each example directory was attempted but blocked by registry policy in this environment (returned 403 Forbidden).
• Running the local express test runner (node --loader tsx src/adapters/testExpress.ts) failed in this environment due to the tsx loader not being available.

---

Codex Task

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​15.5.14
	@​types/​react@​19.2.14
	tsx@​4.21.0
	react@​19.2.4
	express@​4.22.1
	wrangler@​4.78.0
	react-dom@​19.2.4
	@​hono/​node-server@​1.19.11
	hono@​4.12.9
	@​cloudflare/​workers-types@​4.20260329.1

View full report

To fix the problem, introduce an Express rate‑limiting middleware and apply it to the webhook route (and optionally to other routes) so that expensive verification work in createWebhookMiddleware cannot be abused by unbounded request rates. The fix should not alter the existing behavior of the route for legitimate traffic, just bound the number of requests per time window.

The best way to do this in this context is to use the widely‑used express-rate-limit package. In examples/express/src/index.ts, we will:

1. Import rateLimit from express-rate-limit.
2. Define a stripeWebhookLimiter configured with a reasonable windowMs and max requests.
3. Insert stripeWebhookLimiter as middleware in the app.post('/webhooks/stripe', ...) call, before createWebhookMiddleware(...), ensuring that abusive traffic is rejected before the verification work runs.
4. Leave the rest of the app structure unchanged, respecting the existing comment about the critical middleware order (webhook route before express.json()).

Concretely:

• Add a new import line after the existing express import.
• Add a small configuration block for the limiter after const app = express();.
• Modify the app.post('/webhooks/stripe', ...) definition to include the limiter as an additional argument between the route path and createWebhookMiddleware({ ... }).

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 41a636f8e2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Convert ArrayBuffer raw bodies before parsed-body fallback

hasUsableRawBody now treats ArrayBuffer as a valid raw payload, but extractRawBody does not have an ArrayBuffer branch, so requests with req.rawBody as ArrayBuffer fall through to the parsed-body warning path (or stream read) instead of using the raw bytes. In strict mode this can let the middleware proceed and then fail signature verification because the body is re-serialized/empty, which breaks the new raw-body compatibility this commit is trying to add.

Useful? React with 👍 / 👎.