@hookflo/tern 3.0.3 → 3.0.5-beta

package/dist/adapters/cloudflare.d.ts

@@ -1,10 +1,12 @@
 import { WebhookPlatform, NormalizeOptions } from '../types';
+import { QueueOption } from '../upstash/types';
 export interface CloudflareWebhookHandlerOptions<TEnv = Record<string, unknown>, TPayload = any, TMetadata extends Record<string, unknown> = Record<string, unknown>, TResponse = unknown> {
     platform: WebhookPlatform;
     secret?: string;
     secretEnv?: string;
     toleranceInSeconds?: number;
     normalize?: boolean | NormalizeOptions;
+    queue?: QueueOption;
     onError?: (error: Error) => void;
     handler: (payload: TPayload, env: TEnv, metadata: TMetadata) => Promise<TResponse> | TResponse;
 }

package/dist/adapters/cloudflare.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createWebhookHandler = createWebhookHandler;
 const index_1 = require("../index");
+const queue_1 = require("../upstash/queue");
 function createWebhookHandler(options) {
     return async (request, env) => {
         try {
@@ -10,6 +11,16 @@ function createWebhookHandler(options) {
             if (!secret) {
                 return Response.json({ error: 'Webhook secret is not configured' }, { status: 500 });
             }
+            if (options.queue) {
+                const queueConfig = (0, queue_1.resolveQueueConfig)(options.queue);
+                return (0, queue_1.handleQueuedRequest)(request, {
+                    platform: options.platform,
+                    secret,
+                    queueConfig,
+                    handler: (payload, metadata) => options.handler(payload, env, metadata),
+                    toleranceInSeconds: options.toleranceInSeconds ?? 300,
+                });
+            }
             const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(request, options.platform, secret, options.toleranceInSeconds, options.normalize);
             if (!result.isValid) {
                 return Response.json({ error: result.error, errorCode: result.errorCode, platform: result.platform, metadata: result.metadata }, { status: 400 });

package/dist/adapters/express.d.ts

@@ -1,4 +1,5 @@
 import { WebhookPlatform, WebhookVerificationResult, NormalizeOptions } from '../types';
+import { QueueOption } from '../upstash/types';
 import { MinimalNodeRequest } from './shared';
 export interface ExpressLikeResponse {
     status: (code: number) => ExpressLikeResponse;
@@ -13,6 +14,7 @@ export interface ExpressWebhookMiddlewareOptions {
     secret: string;
     toleranceInSeconds?: number;
     normalize?: boolean | NormalizeOptions;
+    queue?: QueueOption;
     onError?: (error: Error) => void;
 }
 export declare function createWebhookMiddleware(options: ExpressWebhookMiddlewareOptions): (req: ExpressLikeRequest, res: ExpressLikeResponse, next: ExpressLikeNext) => Promise<void>;

package/dist/adapters/express.js

@@ -2,11 +2,33 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createWebhookMiddleware = createWebhookMiddleware;
 const index_1 = require("../index");
+const queue_1 = require("../upstash/queue");
 const shared_1 = require("./shared");
 function createWebhookMiddleware(options) {
     return async (req, res, next) => {
         try {
             const webRequest = await (0, shared_1.toWebRequest)(req);
+            if (options.queue) {
+                const queueConfig = (0, queue_1.resolveQueueConfig)(options.queue);
+                const queueResponse = await (0, queue_1.handleQueuedRequest)(webRequest, {
+                    platform: options.platform,
+                    secret: options.secret,
+                    queueConfig,
+                    toleranceInSeconds: options.toleranceInSeconds ?? 300,
+                });
+                const bodyText = await queueResponse.text();
+                let body = undefined;
+                if (bodyText) {
+                    try {
+                        body = JSON.parse(bodyText);
+                    }
+                    catch {
+                        body = { message: bodyText };
+                    }
+                }
+                res.status(queueResponse.status).json(body ?? {});
+                return;
+            }
             const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(webRequest, options.platform, options.secret, options.toleranceInSeconds, options.normalize);
             if (!result.isValid) {
                 res.status(400).json({

package/dist/adapters/nextjs.d.ts

@@ -1,9 +1,11 @@
 import { WebhookPlatform, NormalizeOptions } from '../types';
+import { QueueOption } from '../upstash/types';
 export interface NextWebhookHandlerOptions<TPayload = any, TMetadata extends Record<string, unknown> = Record<string, unknown>, TResponse = unknown> {
     platform: WebhookPlatform;
     secret: string;
     toleranceInSeconds?: number;
     normalize?: boolean | NormalizeOptions;
+    queue?: QueueOption;
     onError?: (error: Error) => void;
     handler: (payload: TPayload, metadata: TMetadata) => Promise<TResponse> | TResponse;
 }

package/dist/adapters/nextjs.js

@@ -2,9 +2,20 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createWebhookHandler = createWebhookHandler;
 const index_1 = require("../index");
+const queue_1 = require("../upstash/queue");
 function createWebhookHandler(options) {
     return async (request) => {
         try {
+            if (options.queue) {
+                const queueConfig = (0, queue_1.resolveQueueConfig)(options.queue);
+                return (0, queue_1.handleQueuedRequest)(request, {
+                    platform: options.platform,
+                    secret: options.secret,
+                    queueConfig,
+                    handler: options.handler,
+                    toleranceInSeconds: options.toleranceInSeconds ?? 300,
+                });
+            }
             const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(request, options.platform, options.secret, options.toleranceInSeconds, options.normalize);
             if (!result.isValid) {
                 return Response.json({ error: result.error, errorCode: result.errorCode, platform: result.platform, metadata: result.metadata }, { status: 400 });

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 import { WebhookConfig, WebhookVerificationResult, WebhookPlatform, SignatureConfig, MultiPlatformSecrets, NormalizeOptions } from './types';
+import type { QueueOption } from './upstash/types';
 export declare class WebhookVerificationService {
     static verify<TPayload = unknown>(request: Request, config: WebhookConfig): Promise<WebhookVerificationResult<TPayload>>;
     private static getVerifier;
@@ -13,6 +14,13 @@ export declare class WebhookVerificationService {
     static platformUsesAlgorithm(platform: WebhookPlatform, algorithm: string): boolean;
     static validateSignatureConfig(config: SignatureConfig): boolean;
     static verifyTokenAuth<TPayload = unknown>(request: Request, webhookId: string, webhookToken: string): Promise<WebhookVerificationResult<TPayload>>;
+    static handleWithQueue(request: Request, options: {
+        platform: WebhookPlatform;
+        secret: string;
+        queue: QueueOption;
+        handler: (payload: unknown, metadata: Record<string, unknown>) => Promise<unknown> | unknown;
+        toleranceInSeconds?: number;
+    }): Promise<Response>;
     static verifyTokenBased<TPayload = unknown>(request: Request, webhookId: string, webhookToken: string): Promise<WebhookVerificationResult<TPayload>>;
 }
 export * from './types';

package/dist/index.js

@@ -10,6 +10,28 @@ var __createBinding = (this && this.__createBinding) || (Object.create ? (functi
     if (k2 === undefined) k2 = k;
     o[k2] = m[k];
 }));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
@@ -230,6 +252,17 @@ class WebhookVerificationService {
             };
         }
     }
+    static async handleWithQueue(request, options) {
+        const { resolveQueueConfig, handleQueuedRequest } = await Promise.resolve().then(() => __importStar(require('./upstash/queue')));
+        const queueConfig = resolveQueueConfig(options.queue);
+        return handleQueuedRequest(request, {
+            platform: options.platform,
+            secret: options.secret,
+            queueConfig,
+            handler: options.handler,
+            toleranceInSeconds: options.toleranceInSeconds ?? 300,
+        });
+    }
     static async verifyTokenBased(request, webhookId, webhookToken) {
         return this.verifyTokenAuth(request, webhookId, webhookToken);
     }

package/dist/platforms/algorithms.d.ts

@@ -1,4 +1,4 @@
-import { PlatformAlgorithmConfig, WebhookPlatform, SignatureConfig } from '../types';
+import { PlatformAlgorithmConfig, WebhookPlatform, SignatureConfig } from "../types";
 export declare const platformAlgorithmConfigs: Record<WebhookPlatform, PlatformAlgorithmConfig>;
 export declare function getPlatformAlgorithmConfig(platform: WebhookPlatform): PlatformAlgorithmConfig;
 export declare function platformUsesAlgorithm(platform: WebhookPlatform, algorithm: string): boolean;

package/dist/platforms/algorithms.js

@@ -7,307 +7,309 @@ exports.getPlatformsUsingAlgorithm = getPlatformsUsingAlgorithm;
 exports.validateSignatureConfig = validateSignatureConfig;
 exports.platformAlgorithmConfigs = {
     github: {
-        platform: 'github',
+        platform: "github",
         signatureConfig: {
-            algorithm: 'hmac-sha256',
-            headerName: 'x-hub-signature-256',
-            headerFormat: 'prefixed',
-            prefix: 'sha256=',
+            algorithm: "hmac-sha256",
+            headerName: "x-hub-signature-256",
+            headerFormat: "prefixed",
+            prefix: "sha256=",
             timestampHeader: undefined,
-            payloadFormat: 'raw',
+            payloadFormat: "raw",
         },
-        description: 'GitHub webhooks use HMAC-SHA256 with sha256= prefix',
+        description: "GitHub webhooks use HMAC-SHA256 with sha256= prefix",
     },
     stripe: {
-        platform: 'stripe',
+        platform: "stripe",
         signatureConfig: {
-            algorithm: 'hmac-sha256',
-            headerName: 'stripe-signature',
-            headerFormat: 'comma-separated',
+            algorithm: "hmac-sha256",
+            headerName: "stripe-signature",
+            headerFormat: "comma-separated",
             timestampHeader: undefined,
-            payloadFormat: 'timestamped',
+            payloadFormat: "timestamped",
             customConfig: {
-                signatureFormat: 't={timestamp},v1={signature}',
+                signatureFormat: "t={timestamp},v1={signature}",
             },
         },
-        description: 'Stripe webhooks use HMAC-SHA256 with comma-separated format',
+        description: "Stripe webhooks use HMAC-SHA256 with comma-separated format",
     },
     clerk: {
-        platform: 'clerk',
+        platform: "clerk",
         signatureConfig: {
-            algorithm: 'hmac-sha256',
-            headerName: 'svix-signature',
-            headerFormat: 'raw',
-            timestampHeader: 'svix-timestamp',
-            timestampFormat: 'unix',
-            payloadFormat: 'custom',
+            algorithm: "hmac-sha256",
+            headerName: "svix-signature",
+            headerFormat: "raw",
+            timestampHeader: "svix-timestamp",
+            timestampFormat: "unix",
+            payloadFormat: "custom",
             customConfig: {
-                signatureFormat: 'v1={signature}',
-                payloadFormat: '{id}.{timestamp}.{body}',
-                encoding: 'base64',
-                secretEncoding: 'base64',
-                idHeader: 'svix-id',
+                signatureFormat: "v1={signature}",
+                payloadFormat: "{id}.{timestamp}.{body}",
+                encoding: "base64",
+                secretEncoding: "base64",
+                idHeader: "svix-id",
             },
         },
-        description: 'Clerk webhooks use HMAC-SHA256 with base64 encoding',
+        description: "Clerk webhooks use HMAC-SHA256 with base64 encoding",
     },
     dodopayments: {
-        platform: 'dodopayments',
+        platform: "dodopayments",
         signatureConfig: {
-            algorithm: 'hmac-sha256',
-            headerName: 'webhook-signature',
-            headerFormat: 'raw',
-            timestampHeader: 'webhook-timestamp',
-            timestampFormat: 'unix',
-            payloadFormat: 'custom',
+            algorithm: "hmac-sha256",
+            headerName: "webhook-signature",
+            headerFormat: "raw",
+            timestampHeader: "webhook-timestamp",
+            timestampFormat: "unix",
+            payloadFormat: "custom",
             customConfig: {
-                signatureFormat: 'v1={signature}',
-                payloadFormat: '{id}.{timestamp}.{body}',
-                encoding: 'base64',
-                secretEncoding: 'base64',
-                idHeader: 'webhook-id',
+                signatureFormat: "v1={signature}",
+                payloadFormat: "{id}.{timestamp}.{body}",
+                encoding: "base64",
+                secretEncoding: "base64",
+                idHeader: "webhook-id",
             },
         },
-        description: 'Dodo Payments webhooks use HMAC-SHA256 with svix-style format (Standard Webhooks)',
+        description: "Dodo Payments webhooks use HMAC-SHA256 with svix-style format (Standard Webhooks)",
     },
     shopify: {
-        platform: 'shopify',
+        platform: "shopify",
         signatureConfig: {
-            algorithm: 'hmac-sha256',
-            headerName: 'x-shopify-hmac-sha256',
-            headerFormat: 'raw',
-            payloadFormat: 'raw',
+            algorithm: "hmac-sha256",
+            headerName: "x-shopify-hmac-sha256",
+            headerFormat: "raw",
+            payloadFormat: "raw",
             customConfig: {
-                encoding: 'base64',
-                secretEncoding: 'utf8',
+                encoding: "base64",
+                secretEncoding: "utf8",
             },
         },
-        description: 'Shopify webhooks use HMAC-SHA256 with base64 encoded signature',
+        description: "Shopify webhooks use HMAC-SHA256 with base64 encoded signature",
     },
     vercel: {
-        platform: 'vercel',
+        platform: "vercel",
         signatureConfig: {
-            algorithm: 'hmac-sha256',
-            headerName: 'x-vercel-signature',
-            headerFormat: 'raw',
-            timestampHeader: 'x-vercel-timestamp',
-            timestampFormat: 'unix',
-            payloadFormat: 'raw',
+            algorithm: "hmac-sha256",
+            headerName: "x-vercel-signature",
+            headerFormat: "raw",
+            timestampHeader: "x-vercel-timestamp",
+            timestampFormat: "unix",
+            payloadFormat: "raw",
         },
-        description: 'Vercel webhooks use HMAC-SHA256',
+        description: "Vercel webhooks use HMAC-SHA256",
     },
     polar: {
-        platform: 'polar',
+        platform: "polar",
         signatureConfig: {
-            algorithm: 'hmac-sha256',
-            headerName: 'webhook-signature',
-            headerFormat: 'raw',
-            timestampHeader: 'webhook-timestamp',
-            timestampFormat: 'unix',
-            payloadFormat: 'custom',
+            algorithm: "hmac-sha256",
+            headerName: "webhook-signature",
+            headerFormat: "raw",
+            timestampHeader: "webhook-timestamp",
+            timestampFormat: "unix",
+            payloadFormat: "custom",
             customConfig: {
-                signatureFormat: 'v1={signature}',
-                payloadFormat: '{id}.{timestamp}.{body}',
-                encoding: 'base64',
-                secretEncoding: 'utf8',
-                idHeader: 'webhook-id',
+                signatureFormat: "v1={signature}",
+                payloadFormat: "{id}.{timestamp}.{body}",
+                encoding: "base64",
+                secretEncoding: "utf8",
+                idHeader: "webhook-id",
             },
         },
-        description: 'Polar webhooks use HMAC-SHA256 with Standard Webhooks format',
+        description: "Polar webhooks use HMAC-SHA256 with Standard Webhooks format",
     },
     gitlab: {
-        platform: 'gitlab',
+        platform: "gitlab",
         signatureConfig: {
-            algorithm: 'custom',
-            headerName: 'X-Gitlab-Token',
-            headerFormat: 'raw',
-            payloadFormat: 'raw',
+            algorithm: "custom",
+            headerName: "X-Gitlab-Token",
+            headerFormat: "raw",
+            payloadFormat: "raw",
             customConfig: {
-                type: 'token-based',
-                idHeader: 'X-Gitlab-Token',
+                type: "token-based",
+                idHeader: "X-Gitlab-Token",
             },
         },
-        description: 'GitLab webhooks use token-based authentication via X-Gitlab-Token header',
+        description: "GitLab webhooks use token-based authentication via X-Gitlab-Token header",
     },
     paddle: {
-        platform: 'paddle',
+        platform: "paddle",
         signatureConfig: {
-            algorithm: 'hmac-sha256',
-            headerName: 'paddle-signature',
-            headerFormat: 'comma-separated',
-            payloadFormat: 'custom',
+            algorithm: "hmac-sha256",
+            headerName: "paddle-signature",
+            headerFormat: "comma-separated",
+            payloadFormat: "custom",
             customConfig: {
-                timestampKey: 'ts',
-                signatureKey: 'h1',
-                payloadFormat: '{timestamp}:{body}',
+                timestampKey: "ts",
+                signatureKey: "h1",
+                payloadFormat: "{timestamp}:{body}",
             },
         },
-        description: 'Paddle webhooks use HMAC-SHA256 with Paddle-Signature (ts/h1) header format',
+        description: "Paddle webhooks use HMAC-SHA256 with Paddle-Signature (ts/h1) header format",
     },
     razorpay: {
-        platform: 'razorpay',
+        platform: "razorpay",
         signatureConfig: {
-            algorithm: 'hmac-sha256',
-            headerName: 'x-razorpay-signature',
-            headerFormat: 'raw',
-            payloadFormat: 'raw',
+            algorithm: "hmac-sha256",
+            headerName: "x-razorpay-signature",
+            headerFormat: "raw",
+            payloadFormat: "raw",
         },
-        description: 'Razorpay webhooks use HMAC-SHA256 with X-Razorpay-Signature header',
+        description: "Razorpay webhooks use HMAC-SHA256 with X-Razorpay-Signature header",
     },
     lemonsqueezy: {
-        platform: 'lemonsqueezy',
+        platform: "lemonsqueezy",
         signatureConfig: {
-            algorithm: 'hmac-sha256',
-            headerName: 'x-signature',
-            headerFormat: 'raw',
-            payloadFormat: 'raw',
+            algorithm: "hmac-sha256",
+            headerName: "x-signature",
+            headerFormat: "raw",
+            payloadFormat: "raw",
         },
-        description: 'Lemon Squeezy webhooks use HMAC-SHA256 with X-Signature header',
+        description: "Lemon Squeezy webhooks use HMAC-SHA256 with X-Signature header",
     },
     workos: {
-        platform: 'workos',
+        platform: "workos",
         signatureConfig: {
-            algorithm: 'hmac-sha256',
-            headerName: 'workos-signature',
-            headerFormat: 'comma-separated',
-            payloadFormat: 'custom',
+            algorithm: "hmac-sha256",
+            headerName: "workos-signature",
+            headerFormat: "comma-separated",
+            payloadFormat: "custom",
             customConfig: {
-                timestampKey: 't',
-                signatureKey: 'v1',
-                payloadFormat: '{timestamp}.{body}',
+                timestampKey: "t",
+                signatureKey: "v1",
+                payloadFormat: "{timestamp}.{body}",
             },
         },
-        description: 'WorkOS webhooks use HMAC-SHA256 with WorkOS-Signature (t/v1) format',
+        description: "WorkOS webhooks use HMAC-SHA256 with WorkOS-Signature (t/v1) format",
     },
     woocommerce: {
-        platform: 'woocommerce',
+        platform: "woocommerce",
         signatureConfig: {
-            algorithm: 'hmac-sha256',
-            headerName: 'x-wc-webhook-signature',
-            headerFormat: 'raw',
-            payloadFormat: 'raw',
+            algorithm: "hmac-sha256",
+            headerName: "x-wc-webhook-signature",
+            headerFormat: "raw",
+            payloadFormat: "raw",
             customConfig: {
-                encoding: 'base64',
-                secretEncoding: 'utf8',
+                encoding: "base64",
+                secretEncoding: "utf8",
             },
         },
-        description: 'WooCommerce webhooks use HMAC-SHA256 with base64 encoded signature',
+        description: "WooCommerce webhooks use HMAC-SHA256 with base64 encoded signature",
     },
     replicateai: {
-        platform: 'replicateai',
+        platform: "replicateai",
         signatureConfig: {
-            algorithm: 'hmac-sha256',
-            headerName: 'webhook-signature',
-            headerFormat: 'raw',
-            timestampHeader: 'webhook-timestamp',
-            timestampFormat: 'unix',
-            payloadFormat: 'custom',
+            algorithm: "hmac-sha256",
+            headerName: "webhook-signature",
+            headerFormat: "raw",
+            timestampHeader: "webhook-timestamp",
+            timestampFormat: "unix",
+            payloadFormat: "custom",
             customConfig: {
-                signatureFormat: 'v1={signature}',
-                payloadFormat: '{id}.{timestamp}.{body}',
-                encoding: 'base64',
-                secretEncoding: 'base64',
-                idHeader: 'webhook-id',
+                signatureFormat: "v1={signature}",
+                payloadFormat: "{id}.{timestamp}.{body}",
+                encoding: "base64",
+                secretEncoding: "base64",
+                idHeader: "webhook-id",
             },
         },
-        description: 'Replicate webhooks use HMAC-SHA256 with Standard Webhooks (svix-style) format',
+        description: "Replicate webhooks use HMAC-SHA256 with Standard Webhooks (svix-style) format",
     },
     falai: {
-        platform: 'falai',
+        platform: "falai",
         signatureConfig: {
-            algorithm: 'ed25519',
-            headerName: 'x-fal-webhook-signature',
-            headerFormat: 'raw',
-            payloadFormat: 'custom',
+            algorithm: "ed25519",
+            headerName: "x-fal-webhook-signature",
+            headerFormat: "raw",
+            payloadFormat: "custom",
             customConfig: {
-                requestIdHeader: 'x-fal-webhook-request-id',
-                userIdHeader: 'x-fal-webhook-user-id',
-                timestampHeader: 'x-fal-webhook-timestamp',
-                jwksUrl: 'https://rest.alpha.fal.ai/.well-known/jwks.json',
+                requestIdHeader: "x-fal-webhook-request-id",
+                userIdHeader: "x-fal-webhook-user-id",
+                timestampHeader: "x-fal-webhook-timestamp",
+                jwksUrl: "https://rest.alpha.fal.ai/.well-known/jwks.json",
             },
         },
-        description: 'fal.ai webhooks use ED25519 with JWKS key verification. No secret required — pass empty string.',
+        description: "fal.ai webhooks use ED25519 with JWKS key verification. No secret required — pass empty string.",
     },
     sentry: {
-        platform: 'sentry',
+        platform: "sentry",
         signatureConfig: {
-            algorithm: 'hmac-sha256',
-            headerName: 'sentry-hook-signature',
-            headerFormat: 'raw',
-            timestampHeader: 'sentry-hook-timestamp',
-            timestampFormat: 'unix',
-            payloadFormat: 'json-stringified',
-            idHeader: 'request-id',
+            algorithm: "hmac-sha256",
+            headerName: "sentry-hook-signature",
+            headerFormat: "raw",
+            timestampHeader: "sentry-hook-timestamp",
+            timestampFormat: "unix",
+            payloadFormat: "json-stringified",
+            idHeader: "request-id",
             customConfig: {
-                issueAlertPayloadPath: 'data.issue_alert',
+                issueAlertPayloadPath: "data.issue_alert",
             },
         },
-        description: 'Sentry webhooks use HMAC-SHA256 with JSON stringified body and Request-ID idempotency key',
+        description: "Sentry webhooks use HMAC-SHA256 with JSON stringified body and Request-ID idempotency key",
     },
     grafana: {
-        platform: 'grafana',
+        platform: "grafana",
         signatureConfig: {
-            algorithm: 'hmac-sha256',
-            headerName: 'x-grafana-alerting-signature',
-            headerFormat: 'raw',
-            timestampHeader: 'x-grafana-alerting-timestamp',
-            timestampFormat: 'unix',
-            payloadFormat: 'timestamped',
+            algorithm: "hmac-sha256",
+            headerName: "x-grafana-alerting-signature",
+            headerFormat: "raw",
+            timestampHeader: "x-grafana-alerting-timestamp",
+            timestampFormat: "unix",
+            payloadFormat: "timestamped",
         },
-        description: 'Grafana 12+ webhooks support HMAC-SHA256 with optional timestamped payload format',
+        description: "Grafana 12+ webhooks support HMAC-SHA256 with optional timestamped payload format",
     },
     doppler: {
-        platform: 'doppler',
+        platform: "doppler",
         signatureConfig: {
-            algorithm: 'hmac-sha256',
-            headerName: 'x-doppler-signature',
-            headerFormat: 'prefixed',
-            prefix: 'sha256=',
-            payloadFormat: 'raw',
+            algorithm: "hmac-sha256",
+            headerName: "x-doppler-signature",
+            headerFormat: "prefixed",
+            prefix: "sha256=",
+            payloadFormat: "raw",
             customConfig: {
-                dedupHashAlgorithm: 'sha256',
+                dedupHashAlgorithm: "sha256",
             },
         },
-        description: 'Doppler webhooks use HMAC-SHA256 with sha256= signature prefix and raw payload signing',
+        description: "Doppler webhooks use HMAC-SHA256 with sha256= signature prefix and raw payload signing",
     },
     sanity: {
-        platform: 'sanity',
+        platform: "sanity",
         signatureConfig: {
-            algorithm: 'hmac-sha256',
-            headerName: 'sanity-webhook-signature',
-            headerFormat: 'comma-separated',
-            payloadFormat: 'timestamped',
+            algorithm: "hmac-sha256",
+            headerName: "sanity-webhook-signature",
+            headerFormat: "comma-separated",
+            payloadFormat: "timestamped",
             customConfig: {
-                timestampKey: 't',
-                signatureKey: 'v1',
+                timestampKey: "t",
+                signatureKey: "v1",
+                encoding: "base64",
+                secretEncoding: "utf8",
             },
-            idHeader: 'idempotency-key',
+            idHeader: "idempotency-key",
         },
-        description: 'Sanity webhooks use Stripe-compatible signatures with timestamp/body payload and idempotency key header',
+        description: "Sanity webhooks use Stripe-compatible HMAC-SHA256 with base64 encoded signature and plain UTF-8 secret",
     },
     custom: {
-        platform: 'custom',
+        platform: "custom",
         signatureConfig: {
-            algorithm: 'hmac-sha256',
-            headerName: 'x-webhook-signature',
-            headerFormat: 'raw',
-            payloadFormat: 'raw',
+            algorithm: "hmac-sha256",
+            headerName: "x-webhook-signature",
+            headerFormat: "raw",
+            payloadFormat: "raw",
             customConfig: {
-                type: 'token-based',
-                idHeader: 'x-webhook-id',
+                type: "token-based",
+                idHeader: "x-webhook-id",
             },
         },
-        description: 'Custom webhook configuration (supports token-based overrides via customConfig)',
+        description: "Custom webhook configuration (supports token-based overrides via customConfig)",
     },
     unknown: {
-        platform: 'unknown',
+        platform: "unknown",
         signatureConfig: {
-            algorithm: 'hmac-sha256',
-            headerName: 'x-webhook-signature',
-            headerFormat: 'raw',
-            payloadFormat: 'raw',
+            algorithm: "hmac-sha256",
+            headerName: "x-webhook-signature",
+            headerFormat: "raw",
+            payloadFormat: "raw",
         },
-        description: 'Unknown platform - using default HMAC-SHA256',
+        description: "Unknown platform - using default HMAC-SHA256",
     },
 };
 function getPlatformAlgorithmConfig(platform) {
@@ -327,15 +329,15 @@ function validateSignatureConfig(config) {
         return false;
     }
     switch (config.algorithm) {
-        case 'hmac-sha256':
-        case 'hmac-sha1':
-        case 'hmac-sha512':
+        case "hmac-sha256":
+        case "hmac-sha1":
+        case "hmac-sha512":
             return true;
-        case 'rsa-sha256':
+        case "rsa-sha256":
             return !!config.customConfig?.publicKey;
-        case 'ed25519':
+        case "ed25519":
             return !!config.customConfig?.publicKey || !!config.customConfig?.jwksUrl;
-        case 'custom':
+        case "custom":
             return !!config.customConfig;
         default:
             return false;

package/dist/test.js

@@ -625,6 +625,41 @@ async function runTests() {
     catch (error) {
         console.log('   ❌ fal.ai test failed:', error);
     }
+    // Test 21: Core SDK queue entry point
+    console.log('\n21. Testing core SDK handleWithQueue...');
+    try {
+        const request = createMockRequest({
+            'content-type': 'application/json',
+        });
+        const originalToken = process.env.QSTASH_TOKEN;
+        const originalCurrent = process.env.QSTASH_CURRENT_SIGNING_KEY;
+        const originalNext = process.env.QSTASH_NEXT_SIGNING_KEY;
+        delete process.env.QSTASH_TOKEN;
+        delete process.env.QSTASH_CURRENT_SIGNING_KEY;
+        delete process.env.QSTASH_NEXT_SIGNING_KEY;
+        let threw = false;
+        try {
+            await index_1.WebhookVerificationService.handleWithQueue(request, {
+                platform: 'stripe',
+                secret: testSecret,
+                queue: true,
+                handler: async () => undefined,
+            });
+        }
+        catch (error) {
+            threw = error.message.includes('queue: true requires QSTASH_TOKEN');
+        }
+        if (originalToken !== undefined)
+            process.env.QSTASH_TOKEN = originalToken;
+        if (originalCurrent !== undefined)
+            process.env.QSTASH_CURRENT_SIGNING_KEY = originalCurrent;
+        if (originalNext !== undefined)
+            process.env.QSTASH_NEXT_SIGNING_KEY = originalNext;
+        console.log('   ✅ handleWithQueue:', threw ? 'PASSED' : 'FAILED');
+    }
+    catch (error) {
+        console.log('   ❌ handleWithQueue test failed:', error);
+    }
     console.log('\n🎉 All tests completed!');
 }
 // Run tests if this file is executed directly

package/dist/upstash/controls.d.ts

@@ -0,0 +1,6 @@
+import { DLQMessage, EventFilter, ReplayResult, TernControlsConfig, TernEvent } from './types';
+export declare function createTernControls(config: TernControlsConfig): {
+    dlq(): Promise<DLQMessage[]>;
+    replay(messageId: string): Promise<ReplayResult>;
+    events(filter?: EventFilter): Promise<TernEvent[]>;
+};

package/dist/upstash/controls.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTernControls = createTernControls;
+const QSTASH_API_BASE = 'https://qstash.upstash.io/v2';
+function createHeaders(token) {
+    return {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json',
+    };
+}
+function deriveStatus(value) {
+    const lowered = value.toLowerCase();
+    if (lowered.includes('deliver'))
+        return 'delivered';
+    if (lowered.includes('fail'))
+        return 'failed';
+    return 'retrying';
+}
+function createTernControls(config) {
+    return {
+        async dlq() {
+            const response = await fetch(`${QSTASH_API_BASE}/dlq`, {
+                headers: createHeaders(config.token),
+            });
+            if (!response.ok) {
+                throw new Error(`[tern] Failed to fetch DLQ messages: ${response.status} ${response.statusText}`);
+            }
+            const data = await response.json();
+            const messages = data.messages || [];
+            return messages.map((message) => ({
+                id: String(message.messageId || message.id || ''),
+                platform: String(message.body && typeof message.body === 'object' ? message.body.platform || 'unknown' : 'unknown'),
+                payload: message.body && typeof message.body === 'object' ? message.body.payload : undefined,
+                failedAt: String(message.updatedAt || message.createdAt || new Date().toISOString()),
+                attempts: Number(message.retried || message.attempts || 0),
+                error: typeof message.error === 'string' ? message.error : undefined,
+            }));
+        },
+        async replay(messageId) {
+            const response = await fetch(`${QSTASH_API_BASE}/dlq/${messageId}`, {
+                method: 'POST',
+                headers: createHeaders(config.token),
+            });
+            if (!response.ok) {
+                throw new Error(`[tern] Failed to replay DLQ message ${messageId}: ${response.status} ${response.statusText}`);
+            }
+            const data = await response.json();
+            return {
+                success: true,
+                messageId: String(data.messageId || messageId),
+                replayedAt: new Date().toISOString(),
+            };
+        },
+        async events(filter = {}) {
+            const response = await fetch(`${QSTASH_API_BASE}/messages`, {
+                headers: createHeaders(config.token),
+            });
+            if (!response.ok) {
+                throw new Error(`[tern] Failed to fetch events: ${response.status} ${response.statusText}`);
+            }
+            const data = await response.json();
+            const messages = data.messages || [];
+            const mapped = messages.map((message) => {
+                const status = deriveStatus(String(message.state || message.status || 'retrying'));
+                return {
+                    id: String(message.messageId || message.id || ''),
+                    platform: String(message.body && typeof message.body === 'object' ? message.body.platform || 'unknown' : 'unknown'),
+                    status,
+                    attempts: Number(message.retried || message.attempts || 0),
+                    createdAt: String(message.createdAt || new Date().toISOString()),
+                    deliveredAt: message.deliveredAt ? String(message.deliveredAt) : undefined,
+                };
+            });
+            const statusFiltered = filter.status
+                ? mapped.filter((event) => event.status === filter.status)
+                : mapped;
+            return statusFiltered.slice(0, filter.limit ?? 20);
+        },
+    };
+}

package/dist/upstash/index.d.ts

@@ -0,0 +1,3 @@
+export { createTernControls } from './controls';
+export { handleQueuedRequest, handleProcess, handleReceive, resolveQueueConfig, } from './queue';
+export type { DLQMessage, EventFilter, QueueOption, QueuedMessage, ReplayResult, ResolvedQueueConfig, TernControlsConfig, TernEvent, } from './types';

package/dist/upstash/index.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveQueueConfig = exports.handleReceive = exports.handleProcess = exports.handleQueuedRequest = exports.createTernControls = void 0;
+var controls_1 = require("./controls");
+Object.defineProperty(exports, "createTernControls", { enumerable: true, get: function () { return controls_1.createTernControls; } });
+var queue_1 = require("./queue");
+Object.defineProperty(exports, "handleQueuedRequest", { enumerable: true, get: function () { return queue_1.handleQueuedRequest; } });
+Object.defineProperty(exports, "handleProcess", { enumerable: true, get: function () { return queue_1.handleProcess; } });
+Object.defineProperty(exports, "handleReceive", { enumerable: true, get: function () { return queue_1.handleReceive; } });
+Object.defineProperty(exports, "resolveQueueConfig", { enumerable: true, get: function () { return queue_1.resolveQueueConfig; } });

package/dist/upstash/queue.d.ts

@@ -0,0 +1,13 @@
+import { WebhookPlatform } from '../types';
+import { QueueOption, ResolvedQueueConfig } from './types';
+export type HandlerFn = (payload: unknown, metadata: Record<string, unknown>) => Promise<unknown> | unknown;
+export declare function resolveQueueConfig(queue: QueueOption): ResolvedQueueConfig;
+export declare function handleReceive(request: Request, platform: WebhookPlatform, secret: string, queueConfig: ResolvedQueueConfig, toleranceInSeconds: number): Promise<Response>;
+export declare function handleProcess(request: Request, handler: HandlerFn | undefined, queueConfig: ResolvedQueueConfig): Promise<Response>;
+export declare function handleQueuedRequest(request: Request, options: {
+    platform: WebhookPlatform;
+    secret: string;
+    queueConfig: ResolvedQueueConfig;
+    handler?: HandlerFn;
+    toleranceInSeconds: number;
+}): Promise<Response>;

package/dist/upstash/queue.js

@@ -0,0 +1,138 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveQueueConfig = resolveQueueConfig;
+exports.handleReceive = handleReceive;
+exports.handleProcess = handleProcess;
+exports.handleQueuedRequest = handleQueuedRequest;
+const index_1 = require("../index");
+function loadQStashModule() {
+    try {
+        return require('@upstash/qstash');
+    }
+    catch {
+        throw new Error('[tern] Queue support requires optional peer dependency "@upstash/qstash". Please install it to use queue mode.');
+    }
+}
+function nonRetryableResponse(message, status = 489) {
+    return new Response(JSON.stringify({ error: message }), {
+        status,
+        headers: {
+            'Content-Type': 'application/json',
+            'Upstash-NonRetryable-Error': 'true',
+        },
+    });
+}
+function resolveQueueConfig(queue) {
+    if (queue === true) {
+        const token = process.env.QSTASH_TOKEN;
+        const signingKey = process.env.QSTASH_CURRENT_SIGNING_KEY;
+        const nextSigningKey = process.env.QSTASH_NEXT_SIGNING_KEY;
+        if (!token || !signingKey || !nextSigningKey) {
+            throw new Error('[tern] queue: true requires QSTASH_TOKEN, QSTASH_CURRENT_SIGNING_KEY and QSTASH_NEXT_SIGNING_KEY in env');
+        }
+        return {
+            token,
+            signingKey,
+            nextSigningKey,
+        };
+    }
+    return queue;
+}
+async function handleReceive(request, platform, secret, queueConfig, toleranceInSeconds) {
+    const verificationResult = await index_1.WebhookVerificationService.verifyWithPlatformConfig(request.clone(), platform, secret, toleranceInSeconds);
+    if (!verificationResult.isValid) {
+        return nonRetryableResponse(verificationResult.error || 'Webhook signature verification failed');
+    }
+    const { Client } = loadQStashModule();
+    const client = new Client({ token: queueConfig.token });
+    const queuedMessage = {
+        platform,
+        payload: verificationResult.payload,
+        metadata: verificationResult.metadata || {},
+    };
+    const idempotencyKey = request.headers.get('idempotency-key')
+        || request.headers.get('x-webhook-id')
+        || undefined;
+    const publishPayload = {
+        url: request.url,
+        body: queuedMessage,
+        deduplicationId: idempotencyKey,
+    };
+    if (queueConfig.retries !== undefined) {
+        publishPayload.retries = queueConfig.retries;
+    }
+    await client.publishJSON(publishPayload);
+    return new Response(JSON.stringify({ queued: true }), {
+        status: 200,
+        headers: {
+            'Content-Type': 'application/json',
+        },
+    });
+}
+async function handleProcess(request, handler, queueConfig) {
+    const signature = request.headers.get('upstash-signature');
+    if (!signature) {
+        return new Response(JSON.stringify({ error: 'Missing Upstash-Signature header' }), {
+            status: 401,
+            headers: { 'Content-Type': 'application/json' },
+        });
+    }
+    const rawBody = await request.text();
+    const { Receiver } = loadQStashModule();
+    const receiver = new Receiver({
+        currentSigningKey: queueConfig.signingKey,
+        nextSigningKey: queueConfig.nextSigningKey,
+    });
+    try {
+        const verification = await receiver.verify({
+            signature,
+            body: rawBody,
+            url: request.url,
+        });
+        if (verification === false) {
+            return new Response(JSON.stringify({ error: 'Unauthorized' }), {
+                status: 401,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+    }
+    catch {
+        return new Response(JSON.stringify({ error: 'Unauthorized' }), {
+            status: 401,
+            headers: { 'Content-Type': 'application/json' },
+        });
+    }
+    if (!handler) {
+        return nonRetryableResponse('Queue processing requires a handler function');
+    }
+    let parsedBody;
+    try {
+        parsedBody = JSON.parse(rawBody);
+    }
+    catch {
+        return nonRetryableResponse('Queued payload is not valid JSON');
+    }
+    try {
+        await handler(parsedBody.payload, parsedBody.metadata || {});
+        return new Response(JSON.stringify({ delivered: true }), {
+            status: 200,
+            headers: {
+                'Content-Type': 'application/json',
+            },
+        });
+    }
+    catch (error) {
+        return new Response(JSON.stringify({ error: error.message || 'Handler execution failed' }), {
+            status: 500,
+            headers: {
+                'Content-Type': 'application/json',
+            },
+        });
+    }
+}
+async function handleQueuedRequest(request, options) {
+    if (request.headers.has('upstash-signature')) {
+        return handleProcess(request, options.handler, options.queueConfig);
+    }
+    return handleReceive(request, options.platform, options.secret, options.queueConfig, options.toleranceInSeconds);
+}

package/dist/upstash/types.d.ts

@@ -0,0 +1,46 @@
+import { WebhookPlatform } from '../types';
+export type QueueOption = true | {
+    token: string;
+    signingKey: string;
+    nextSigningKey: string;
+    retries?: number;
+};
+export interface ResolvedQueueConfig {
+    token: string;
+    signingKey: string;
+    nextSigningKey: string;
+    retries?: number;
+}
+export interface TernControlsConfig {
+    token: string;
+}
+export interface DLQMessage {
+    id: string;
+    platform: string;
+    payload: unknown;
+    failedAt: string;
+    attempts: number;
+    error?: string;
+}
+export interface ReplayResult {
+    success: boolean;
+    messageId: string;
+    replayedAt: string;
+}
+export interface EventFilter {
+    status?: 'delivered' | 'failed' | 'retrying';
+    limit?: number;
+}
+export interface TernEvent {
+    id: string;
+    platform: string;
+    status: 'delivered' | 'failed' | 'retrying';
+    attempts: number;
+    createdAt: string;
+    deliveredAt?: string;
+}
+export interface QueuedMessage {
+    platform: WebhookPlatform;
+    payload: unknown;
+    metadata: Record<string, unknown>;
+}

package/dist/upstash/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hookflo/tern",
-  "version": "3.0.3",
+  "version": "3.0.5-beta",
   "description": "A robust, scalable webhook verification framework supporting multiple platforms and signature algorithms",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -96,7 +96,13 @@
       "import": "./dist/cloudflare.js",
       "default": "./dist/cloudflare.js"
     },
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./upstash": {
+      "types": "./dist/upstash/index.d.ts",
+      "require": "./dist/upstash/index.js",
+      "import": "./dist/upstash/index.js",
+      "default": "./dist/upstash/index.js"
+    }
   },
   "typesVersions": {
     "*": {
@@ -111,7 +117,18 @@
       ],
       "*": [
         "dist/index.d.ts"
+      ],
+      "upstash": [
+        "dist/upstash/index.d.ts"
       ]
     }
+  },
+  "peerDependencies": {
+    "@upstash/qstash": ">=2.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@upstash/qstash": {
+      "optional": true
+    }
   }
 }