Product Kit · 1.0.0
Browser-local · no endpoint, delivery, verification, or execution
Webhook Normalization Kit
Normalize submitted webhook fixtures into one strict canonical event contract with explicit mappings, reviewable rejections, and handler artifacts.
Automation builders and integration teams replacing provider-specific webhook branches with a deterministic caller-owned canonical fixture contract.
Rejected-event diagnostics
[]
Complete normalization envelope
{
"ok": true,
"schema_version": "utilito.product-kit.v1",
"kit": {
"id": "webhook-normalization-kit",
"version": "1.0.0"
},
"result": {
"normalized_fixtures": [
{
"fixture_index": 0,
"label": "created",
"event": {
"data": {
"amount": 42,
"invoice_id": "inv-1"
},
"event_id": "evt-1",
"event_name": "invoice.created",
"occurred_at": "2026-07-18T12:00:00Z"
},
"diagnostics": []
},
{
"fixture_index": 1,
"label": "failed",
"event": {
"data": {
"amount": 44,
"invoice_id": "inv-2"
},
"event_id": "evt-2",
"event_name": "invoice.failed",
"occurred_at": "2026-07-18T12:01:00Z"
},
"diagnostics": []
}
],
"rejected_event_diagnostics": [],
"mapping_table": [
{
"canonical_path": "data.amount",
"caller_path": "object.total",
"explicit": true,
"transformation": "exact_copy"
},
{
"canonical_path": "data.invoice_id",
"caller_path": "object.invoice",
"explicit": true,
"transformation": "exact_copy"
},
{
"canonical_path": "event_id",
"caller_path": "id",
"explicit": true,
"transformation": "exact_copy"
},
{
"canonical_path": "event_name",
"caller_path": "type",
"explicit": true,
"transformation": "event_name_mapping"
},
{
"canonical_path": "occurred_at",
"caller_path": "created",
"explicit": true,
"transformation": "exact_copy"
}
],
"deterministic_handler_fixture": {
"runtime": "node",
"node_source": "// Deterministic fixture only. It does not receive, verify, deliver, or execute webhooks.\nexport function handleCanonicalEvent(event) {\n switch (event.event_name) {\n case \"invoice.created\": return {accepted:true,event_name:\"invoice.created\",event_id:event.event_id};\n case \"invoice.failed\": return {accepted:true,event_name:\"invoice.failed\",event_id:event.event_id};\n default: return {accepted:false,reason:'UNSUPPORTED_CANONICAL_EVENT'};\n }\n}\n",
"executes_events": false
},
"integration_report": {
"format": "markdown",
"contains_raw_payloads": false,
"content": "# Webhook normalization integration report\n\n- Submitted fixtures: 2\n- Normalized fixtures: 2\n- Rejected fixtures: 0\n- Duplicate event IDs: 0\n- Explicit mappings: 5\n- Event-name mappings: 2\n\nTimestamps and signature-test metadata are caller-submitted and untrusted. No signature was verified. No endpoint was created, no event was delivered or executed, and no secret was retained.\n"
},
"signature_test_metadata_receipt": {
"supplied": true,
"fields": [
"algorithm_label",
"fixture_label",
"signature_header_name",
"timestamp_header_name"
],
"values_retained": false,
"verified": false
},
"artifact_manifest": [
{
"name": "deterministic_handler_fixture",
"media_type": "text/javascript",
"bytes": 455
},
{
"name": "integration_report",
"media_type": "text/markdown",
"bytes": 381
},
{
"name": "mapping_table",
"media_type": "application/json",
"bytes": 679
},
{
"name": "normalized_fixtures",
"media_type": "application/json",
"bytes": 576
},
{
"name": "rejected_event_diagnostics",
"media_type": "application/json",
"bytes": 2
},
{
"name": "signature_test_metadata_receipt",
"media_type": "application/json",
"bytes": 191
}
],
"trust": {
"timestamps": "caller_submitted_untrusted",
"signatures": "caller_submitted_test_metadata_untrusted_not_verified"
},
"safety": {
"provider_guessing": false,
"receiving_endpoint": false,
"outbound_delivery": false,
"signature_verified": false,
"secret_retention": false,
"events_executed": false,
"network_used": false,
"model_used": false,
"storage_used": false,
"telemetry_used": false
}
},
"receipt": {
"input_bytes": 1221,
"output_bytes": 3691,
"operations": 3,
"omitted_items": 0,
"warnings": [],
"fixtures": 2,
"normalized_fixtures": 2,
"rejected_fixtures": 0,
"duplicate_event_ids": 0,
"mappings": 5,
"artifacts": 6
},
"provenance": {
"deterministic": true,
"model_used": false,
"network_used": false,
"storage_used": false,
"core_versions": {
"webhook_normalization_kit": "1.0.0",
"agent_payload_fixture": "agent-payload-fixture-core",
"structured_schema": "utilito.schema-contract.v1",
"json_repair": "1.0.0"
}
},
"error": null
}Free runnable capability
Normalize one bounded webhook fixture set locally and download the current review packet with no signup.
Builder capability
The existing Builder Pilot can coordinate higher bounded review volume; it does not add receiving, delivery, signature verification, provider guessing, storage, telemetry, or event execution.
See the existing Builder PilotPrivacy boundary
Browser generation runs locally. API and MCP requests are response-only; no endpoint, delivery, provider call, credential, signature verification, model, network, storage, telemetry, or event execution is accepted or used.
Limits and trust boundary
- All field and event-name mappings are explicit. There is no provider guessing, schema inference, endpoint, receiver, arbitrary URL, headers, authentication, outbound delivery, or event execution.
- Duplicate event IDs are reported but retained as reviewable normalized fixtures. Timestamps and optional signature-test metadata are caller-submitted untrusted metadata; no signature is verified and no secret value is retained.
- Known input and output records are strict and closed. Only submitted payload and normalized event values cross explicit inert JSON boundaries; dangerous keys, credential-shaped keys or values, proxies, accessors, cycles, custom or null prototypes, symbols, BigInt, and non-finite values fail closed.
- The complete hosted input and successful artifact envelope are capped at 262,144 UTF-8 bytes. Aggregate mapped-value and worst-case diagnostic budgets are checked before normalization assembly, and every downloadable artifact is byte-receipted.