@hookflo/tern 2.2.10 → 3.0.1

package/dist/platforms/algorithms.js

@@ -7,274 +7,307 @@ exports.getPlatformsUsingAlgorithm = getPlatformsUsingAlgorithm;
 exports.validateSignatureConfig = validateSignatureConfig;
 exports.platformAlgorithmConfigs = {
     github: {
-        platform: "github",
+        platform: 'github',
         signatureConfig: {
-            algorithm: "hmac-sha256",
-            headerName: "x-hub-signature-256",
-            headerFormat: "prefixed",
-            prefix: "sha256=",
+            algorithm: 'hmac-sha256',
+            headerName: 'x-hub-signature-256',
+            headerFormat: 'prefixed',
+            prefix: 'sha256=',
             timestampHeader: undefined,
-            payloadFormat: "raw",
+            payloadFormat: 'raw',
         },
-        description: "GitHub webhooks use HMAC-SHA256 with sha256= prefix",
+        description: 'GitHub webhooks use HMAC-SHA256 with sha256= prefix',
     },
     stripe: {
-        platform: "stripe",
+        platform: 'stripe',
         signatureConfig: {
-            algorithm: "hmac-sha256",
-            headerName: "stripe-signature",
-            headerFormat: "comma-separated",
+            algorithm: 'hmac-sha256',
+            headerName: 'stripe-signature',
+            headerFormat: 'comma-separated',
             timestampHeader: undefined,
-            payloadFormat: "timestamped",
+            payloadFormat: 'timestamped',
             customConfig: {
-                signatureFormat: "t={timestamp},v1={signature}",
+                signatureFormat: 't={timestamp},v1={signature}',
             },
         },
-        description: "Stripe webhooks use HMAC-SHA256 with comma-separated format",
+        description: 'Stripe webhooks use HMAC-SHA256 with comma-separated format',
     },
     clerk: {
-        platform: "clerk",
+        platform: 'clerk',
         signatureConfig: {
-            algorithm: "hmac-sha256",
-            headerName: "svix-signature",
-            headerFormat: "raw",
-            timestampHeader: "svix-timestamp",
-            timestampFormat: "unix",
-            payloadFormat: "custom",
+            algorithm: 'hmac-sha256',
+            headerName: 'svix-signature',
+            headerFormat: 'raw',
+            timestampHeader: 'svix-timestamp',
+            timestampFormat: 'unix',
+            payloadFormat: 'custom',
             customConfig: {
-                signatureFormat: "v1={signature}",
-                payloadFormat: "{id}.{timestamp}.{body}",
-                encoding: "base64",
-                secretEncoding: "base64",
-                idHeader: "svix-id",
+                signatureFormat: 'v1={signature}',
+                payloadFormat: '{id}.{timestamp}.{body}',
+                encoding: 'base64',
+                secretEncoding: 'base64',
+                idHeader: 'svix-id',
             },
         },
-        description: "Clerk webhooks use HMAC-SHA256 with base64 encoding",
+        description: 'Clerk webhooks use HMAC-SHA256 with base64 encoding',
     },
     dodopayments: {
-        platform: "dodopayments",
+        platform: 'dodopayments',
         signatureConfig: {
-            algorithm: "hmac-sha256",
-            headerName: "webhook-signature",
-            headerFormat: "raw",
-            timestampHeader: "webhook-timestamp",
-            timestampFormat: "unix",
-            payloadFormat: "custom",
+            algorithm: 'hmac-sha256',
+            headerName: 'webhook-signature',
+            headerFormat: 'raw',
+            timestampHeader: 'webhook-timestamp',
+            timestampFormat: 'unix',
+            payloadFormat: 'custom',
             customConfig: {
-                signatureFormat: "v1={signature}",
-                payloadFormat: "{id}.{timestamp}.{body}",
-                encoding: "base64",
-                secretEncoding: "base64",
-                idHeader: "webhook-id",
+                signatureFormat: 'v1={signature}',
+                payloadFormat: '{id}.{timestamp}.{body}',
+                encoding: 'base64',
+                secretEncoding: 'base64',
+                idHeader: 'webhook-id',
             },
         },
-        description: "Dodo Payments webhooks use HMAC-SHA256 with svix-style format (Standard Webhooks)",
+        description: 'Dodo Payments webhooks use HMAC-SHA256 with svix-style format (Standard Webhooks)',
     },
     shopify: {
-        platform: "shopify",
+        platform: 'shopify',
         signatureConfig: {
-            algorithm: "hmac-sha256",
-            headerName: "x-shopify-hmac-sha256",
-            headerFormat: "raw",
-            payloadFormat: "raw",
+            algorithm: 'hmac-sha256',
+            headerName: 'x-shopify-hmac-sha256',
+            headerFormat: 'raw',
+            payloadFormat: 'raw',
             customConfig: {
-                encoding: "base64",
-                secretEncoding: "utf8",
+                encoding: 'base64',
+                secretEncoding: 'utf8',
             },
         },
-        description: "Shopify webhooks use HMAC-SHA256 with base64 encoded signature",
+        description: 'Shopify webhooks use HMAC-SHA256 with base64 encoded signature',
     },
     vercel: {
-        platform: "vercel",
+        platform: 'vercel',
         signatureConfig: {
-            algorithm: "hmac-sha256",
-            headerName: "x-vercel-signature",
-            headerFormat: "raw",
-            timestampHeader: "x-vercel-timestamp",
-            timestampFormat: "unix",
-            payloadFormat: "raw",
+            algorithm: 'hmac-sha256',
+            headerName: 'x-vercel-signature',
+            headerFormat: 'raw',
+            timestampHeader: 'x-vercel-timestamp',
+            timestampFormat: 'unix',
+            payloadFormat: 'raw',
         },
-        description: "Vercel webhooks use HMAC-SHA256",
+        description: 'Vercel webhooks use HMAC-SHA256',
     },
     polar: {
-        platform: "polar",
+        platform: 'polar',
         signatureConfig: {
-            algorithm: "hmac-sha256",
-            headerName: "webhook-signature",
-            headerFormat: "raw",
-            timestampHeader: "webhook-timestamp",
-            timestampFormat: "unix",
-            payloadFormat: "custom",
+            algorithm: 'hmac-sha256',
+            headerName: 'webhook-signature',
+            headerFormat: 'raw',
+            timestampHeader: 'webhook-timestamp',
+            timestampFormat: 'unix',
+            payloadFormat: 'custom',
             customConfig: {
-                signatureFormat: "v1={signature}",
-                payloadFormat: "{id}.{timestamp}.{body}",
-                encoding: "base64",
-                secretEncoding: "utf8",
-                idHeader: "webhook-id",
+                signatureFormat: 'v1={signature}',
+                payloadFormat: '{id}.{timestamp}.{body}',
+                encoding: 'base64',
+                secretEncoding: 'base64',
+                idHeader: 'webhook-id',
             },
         },
-        description: "Polar webhooks use HMAC-SHA256 with Standard Webhooks format",
-    },
-    supabase: {
-        platform: "supabase",
-        signatureConfig: {
-            algorithm: "custom",
-            headerName: "x-supabase-token",
-            headerFormat: "raw",
-            payloadFormat: "raw",
-            customConfig: {
-                type: "token-based",
-                idHeader: "x-supabase-token",
-            },
-        },
-        description: "Supabase webhooks use token-based authentication",
+        description: 'Polar webhooks use HMAC-SHA256 with Standard Webhooks format',
     },
     gitlab: {
-        platform: "gitlab",
+        platform: 'gitlab',
         signatureConfig: {
-            algorithm: "custom",
-            headerName: "X-Gitlab-Token",
-            headerFormat: "raw",
-            payloadFormat: "raw",
+            algorithm: 'custom',
+            headerName: 'X-Gitlab-Token',
+            headerFormat: 'raw',
+            payloadFormat: 'raw',
             customConfig: {
-                type: "token-based",
-                idHeader: "X-Gitlab-Token",
+                type: 'token-based',
+                idHeader: 'X-Gitlab-Token',
             },
         },
-        description: "GitLab webhooks use HMAC-SHA256 with X-Gitlab-Token header",
+        description: 'GitLab webhooks use token-based authentication via X-Gitlab-Token header',
     },
     paddle: {
-        platform: "paddle",
+        platform: 'paddle',
         signatureConfig: {
-            algorithm: "hmac-sha256",
-            headerName: "paddle-signature",
-            headerFormat: "comma-separated",
-            payloadFormat: "custom",
+            algorithm: 'hmac-sha256',
+            headerName: 'paddle-signature',
+            headerFormat: 'comma-separated',
+            payloadFormat: 'custom',
             customConfig: {
-                timestampKey: "ts",
-                signatureKey: "h1",
-                payloadFormat: "{timestamp}:{body}",
+                timestampKey: 'ts',
+                signatureKey: 'h1',
+                payloadFormat: '{timestamp}:{body}',
             },
         },
-        description: "Paddle webhooks use HMAC-SHA256 with Paddle-Signature (ts/h1) header format",
+        description: 'Paddle webhooks use HMAC-SHA256 with Paddle-Signature (ts/h1) header format',
     },
     razorpay: {
-        platform: "razorpay",
+        platform: 'razorpay',
         signatureConfig: {
-            algorithm: "hmac-sha256",
-            headerName: "x-razorpay-signature",
-            headerFormat: "raw",
-            payloadFormat: "raw",
+            algorithm: 'hmac-sha256',
+            headerName: 'x-razorpay-signature',
+            headerFormat: 'raw',
+            payloadFormat: 'raw',
         },
-        description: "Razorpay webhooks use HMAC-SHA256 with X-Razorpay-Signature header",
+        description: 'Razorpay webhooks use HMAC-SHA256 with X-Razorpay-Signature header',
     },
     lemonsqueezy: {
-        platform: "lemonsqueezy",
+        platform: 'lemonsqueezy',
         signatureConfig: {
-            algorithm: "hmac-sha256",
-            headerName: "x-signature",
-            headerFormat: "raw",
-            payloadFormat: "raw",
+            algorithm: 'hmac-sha256',
+            headerName: 'x-signature',
+            headerFormat: 'raw',
+            payloadFormat: 'raw',
         },
-        description: "Lemon Squeezy webhooks use HMAC-SHA256 with X-Signature header",
-    },
-    auth0: {
-        platform: "auth0",
-        signatureConfig: {
-            algorithm: "hmac-sha256",
-            headerName: "x-auth0-signature",
-            headerFormat: "raw",
-            payloadFormat: "raw",
-        },
-        description: "Auth0 webhooks use HMAC-SHA256 with X-Auth0-Signature header",
+        description: 'Lemon Squeezy webhooks use HMAC-SHA256 with X-Signature header',
     },
     workos: {
-        platform: "workos",
+        platform: 'workos',
         signatureConfig: {
-            algorithm: "hmac-sha256",
-            headerName: "workos-signature",
-            headerFormat: "comma-separated",
-            payloadFormat: "custom",
+            algorithm: 'hmac-sha256',
+            headerName: 'workos-signature',
+            headerFormat: 'comma-separated',
+            payloadFormat: 'custom',
             customConfig: {
-                timestampKey: "t",
-                signatureKey: "v1",
-                payloadFormat: "{timestamp}.{body}",
+                timestampKey: 't',
+                signatureKey: 'v1',
+                payloadFormat: '{timestamp}.{body}',
             },
         },
-        description: "WorkOS webhooks use HMAC-SHA256 with WorkOS-Signature (t/v1) format",
+        description: 'WorkOS webhooks use HMAC-SHA256 with WorkOS-Signature (t/v1) format',
     },
     woocommerce: {
-        platform: "woocommerce",
+        platform: 'woocommerce',
         signatureConfig: {
-            algorithm: "hmac-sha256",
-            headerName: "x-wc-webhook-signature",
-            headerFormat: "raw",
-            payloadFormat: "raw",
+            algorithm: 'hmac-sha256',
+            headerName: 'x-wc-webhook-signature',
+            headerFormat: 'raw',
+            payloadFormat: 'raw',
             customConfig: {
-                encoding: "base64",
-                secretEncoding: "utf8",
+                encoding: 'base64',
+                secretEncoding: 'utf8',
             },
         },
-        description: "WooCommerce webhooks use HMAC-SHA256 with base64 encoded signature",
+        description: 'WooCommerce webhooks use HMAC-SHA256 with base64 encoded signature',
     },
     replicateai: {
-        platform: "replicateai",
+        platform: 'replicateai',
         signatureConfig: {
-            algorithm: "hmac-sha256",
-            headerName: "webhook-signature",
-            headerFormat: "raw",
-            timestampHeader: "webhook-timestamp",
-            timestampFormat: "unix",
-            payloadFormat: "custom",
+            algorithm: 'hmac-sha256',
+            headerName: 'webhook-signature',
+            headerFormat: 'raw',
+            timestampHeader: 'webhook-timestamp',
+            timestampFormat: 'unix',
+            payloadFormat: 'custom',
             customConfig: {
-                signatureFormat: "v1={signature}",
-                payloadFormat: "{id}.{timestamp}.{body}",
-                encoding: "base64",
-                secretEncoding: "base64",
-                idHeader: "webhook-id",
+                signatureFormat: 'v1={signature}',
+                payloadFormat: '{id}.{timestamp}.{body}',
+                encoding: 'base64',
+                secretEncoding: 'base64',
+                idHeader: 'webhook-id',
             },
         },
-        description: "Replicate webhooks use HMAC-SHA256 with Standard Webhooks (svix-style) format",
+        description: 'Replicate webhooks use HMAC-SHA256 with Standard Webhooks (svix-style) format',
     },
     falai: {
-        platform: "falai",
+        platform: 'falai',
+        signatureConfig: {
+            algorithm: 'ed25519',
+            headerName: 'x-fal-webhook-signature',
+            headerFormat: 'raw',
+            payloadFormat: 'custom',
+            customConfig: {
+                requestIdHeader: 'x-fal-webhook-request-id',
+                userIdHeader: 'x-fal-webhook-user-id',
+                timestampHeader: 'x-fal-webhook-timestamp',
+                jwksUrl: 'https://rest.alpha.fal.ai/.well-known/jwks.json',
+            },
+        },
+        description: 'fal.ai webhooks use ED25519 with JWKS key verification. No secret required — pass empty string.',
+    },
+    sentry: {
+        platform: 'sentry',
+        signatureConfig: {
+            algorithm: 'hmac-sha256',
+            headerName: 'sentry-hook-signature',
+            headerFormat: 'raw',
+            timestampHeader: 'sentry-hook-timestamp',
+            timestampFormat: 'unix',
+            payloadFormat: 'json-stringified',
+            idHeader: 'request-id',
+            customConfig: {
+                issueAlertPayloadPath: 'data.issue_alert',
+            },
+        },
+        description: 'Sentry webhooks use HMAC-SHA256 with JSON stringified body and Request-ID idempotency key',
+    },
+    grafana: {
+        platform: 'grafana',
+        signatureConfig: {
+            algorithm: 'hmac-sha256',
+            headerName: 'x-grafana-alerting-signature',
+            headerFormat: 'raw',
+            timestampHeader: 'x-grafana-alerting-timestamp',
+            timestampFormat: 'unix',
+            payloadFormat: 'timestamped',
+        },
+        description: 'Grafana 12+ webhooks support HMAC-SHA256 with optional timestamped payload format',
+    },
+    doppler: {
+        platform: 'doppler',
+        signatureConfig: {
+            algorithm: 'hmac-sha256',
+            headerName: 'x-doppler-signature',
+            headerFormat: 'prefixed',
+            prefix: 'sha256=',
+            payloadFormat: 'raw',
+            customConfig: {
+                dedupHashAlgorithm: 'sha256',
+            },
+        },
+        description: 'Doppler webhooks use HMAC-SHA256 with sha256= signature prefix and raw payload signing',
+    },
+    sanity: {
+        platform: 'sanity',
         signatureConfig: {
-            algorithm: "ed25519",
-            headerName: "x-fal-webhook-signature",
-            headerFormat: "raw",
-            payloadFormat: "custom",
+            algorithm: 'hmac-sha256',
+            headerName: 'sanity-webhook-signature',
+            headerFormat: 'comma-separated',
+            payloadFormat: 'timestamped',
             customConfig: {
-                requestIdHeader: "x-fal-webhook-request-id",
-                userIdHeader: "x-fal-webhook-user-id",
-                timestampHeader: "x-fal-webhook-timestamp",
-                jwksUrl: "https://rest.alpha.fal.ai/.well-known/jwks.json",
+                timestampKey: 't',
+                signatureKey: 'v1',
             },
+            idHeader: 'idempotency-key',
         },
-        description: "fal.ai webhooks use ED25519 with JWKS key verification. No secret required — pass empty string.",
+        description: 'Sanity webhooks use Stripe-compatible signatures with timestamp/body payload and idempotency key header',
     },
     custom: {
-        platform: "custom",
+        platform: 'custom',
         signatureConfig: {
-            algorithm: "hmac-sha256",
-            headerName: "x-webhook-token",
-            headerFormat: "raw",
-            payloadFormat: "raw",
+            algorithm: 'hmac-sha256',
+            headerName: 'x-webhook-signature',
+            headerFormat: 'raw',
+            payloadFormat: 'raw',
             customConfig: {
-                type: "token-based",
-                idHeader: "x-webhook-id",
+                type: 'token-based',
+                idHeader: 'x-webhook-id',
             },
         },
-        description: "Custom webhook configuration",
+        description: 'Custom webhook configuration (supports token-based overrides via customConfig)',
     },
     unknown: {
-        platform: "unknown",
+        platform: 'unknown',
         signatureConfig: {
-            algorithm: "hmac-sha256",
-            headerName: "x-webhook-signature",
-            headerFormat: "raw",
-            payloadFormat: "raw",
+            algorithm: 'hmac-sha256',
+            headerName: 'x-webhook-signature',
+            headerFormat: 'raw',
+            payloadFormat: 'raw',
         },
-        description: "Unknown platform - using default HMAC-SHA256",
+        description: 'Unknown platform - using default HMAC-SHA256',
     },
 };
 function getPlatformAlgorithmConfig(platform) {
@@ -286,23 +319,23 @@ function platformUsesAlgorithm(platform, algorithm) {
 }
 function getPlatformsUsingAlgorithm(algorithm) {
     return Object.entries(exports.platformAlgorithmConfigs)
-        .filter(([_, config]) => config.signatureConfig.algorithm === algorithm)
-        .map(([platform, _]) => platform);
+        .filter(([, config]) => config.signatureConfig.algorithm === algorithm)
+        .map(([platform]) => platform);
 }
 function validateSignatureConfig(config) {
     if (!config.algorithm || !config.headerName) {
         return false;
     }
     switch (config.algorithm) {
-        case "hmac-sha256":
-        case "hmac-sha1":
-        case "hmac-sha512":
+        case 'hmac-sha256':
+        case 'hmac-sha1':
+        case 'hmac-sha512':
             return true;
-        case "rsa-sha256":
+        case 'rsa-sha256':
             return !!config.customConfig?.publicKey;
-        case "ed25519":
+        case 'ed25519':
             return !!config.customConfig?.publicKey || !!config.customConfig?.jwksUrl;
-        case "custom":
+        case 'custom':
             return !!config.customConfig;
         default:
             return false;