@hookflo/tern 4.3.0-beta.0 → 4.3.0-beta.2

package/README.md

@@ -7,7 +7,7 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 [![Zero Dependencies](https://img.shields.io/badge/dependencies-0-brightgreen)](package.json)
 
-Stop writing webhook verification from scratch. **Tern** handles signature verification for Stripe, GitHub, Clerk, Shopify, and 15+ more platforms — with one consistent API.
+Stop writing webhook verification from scratch. **Tern** handles signature verification for Stripe, GitHub, Clerk, Shopify, and 15+ more platforms — with one consistent API. It also verifies **Standard Webhooks** (including Svix-style `svix-*` and canonical `webhook-*` headers) through a single `standardwebhooks` platform config.
 
 > Need reliable delivery too? Tern supports inbound webhook delivery via Upstash QStash — automatic retries, DLQ management, replay controls, and Slack/Discord alerting. Bring your own Upstash account (BYOK).
 
@@ -171,6 +171,9 @@ app.post('/webhooks/stripe', createWebhookHandler({
 
 ## Supported Platforms
 
+> ⚠️ Normalization is no longer supported in Tern and has been removed from the public verification APIs.
+
+
 | Platform | Algorithm | Status |
 |---|---|---|
 | **Stripe** | HMAC-SHA256 | ✅ Tested |
@@ -189,6 +192,9 @@ app.post('/webhooks/stripe', createWebhookHandler({
 | **Grafana** | HMAC-SHA256 | ✅ Tested |
 | **Doppler** | HMAC-SHA256 | ✅ Tested |
 | **Sanity** | HMAC-SHA256 | ✅ Tested |
+| **Svix** | HMAC-SHA256 | ⚠️ Untested for now |
+| **Standard Webhooks** (`standardwebhooks`) | HMAC-SHA256 | ✅ Tested |
+| **Linear** | HMAC-SHA256 | ⚠️ Untested for now |
 | **Razorpay** | HMAC-SHA256 | 🔄 Pending |
 | **Vercel** | HMAC-SHA256 | 🔄 Pending |
 
@@ -196,7 +202,7 @@ app.post('/webhooks/stripe', createWebhookHandler({
 
 ### Platform signature notes
 
-- **Standard Webhooks style** platforms (Clerk, Dodo Payments, Polar, ReplicateAI) commonly use a secret that starts with `whsec_...`.
+- **Standard Webhooks style** providers are supported via the canonical `standardwebhooks` platform (with aliases for both `webhook-*` and `svix-*` headers). Clerk, Dodo Payments, Polar, and ReplicateAI all follow this pattern and commonly use a secret that starts with `whsec_...`.
 - **ReplicateAI**: copy the webhook signing secret from your Replicate webhook settings and pass it directly as `secret`.
 - **fal.ai**: supports JWKS key resolution out of the box — use `secret: ''` for auto key resolution, or pass a PEM public key explicitly.
 
@@ -337,25 +343,31 @@ const result = await WebhookVerificationService.verify(request, {
 });
 ```
 
-### Svix / Standard Webhooks format (Clerk, Dodo Payments, ReplicateAI, etc.)
+### Standard Webhooks config helpers (Svix-style and webhook-* headers)
 
 ```typescript
-const svixConfig = {
-  platform: 'my-svix-platform',
-  secret: 'whsec_abc123...',
+import {
+  createStandardWebhooksConfig,
+  STANDARD_WEBHOOKS_BASE,
+} from '@hookflo/tern';
+
+const signatureConfig = createStandardWebhooksConfig({
+  id: 'webhook-id',
+  timestamp: 'webhook-timestamp',
+  signature: 'webhook-signature',
+  idAliases: ['svix-id'],
+  timestampAliases: ['svix-timestamp'],
+  signatureAliases: ['svix-signature'],
+});
+
+const result = await WebhookVerificationService.verify(request, {
+  platform: 'standardwebhooks',
+  secret: process.env.STANDARD_WEBHOOKS_SECRET!,
   signatureConfig: {
-    algorithm: 'hmac-sha256',
-    headerName: 'webhook-signature',
-    headerFormat: 'raw',
-    timestampHeader: 'webhook-timestamp',
-    timestampFormat: 'unix',
-    payloadFormat: 'custom',
-    customConfig: {
-      payloadFormat: '{id}.{timestamp}.{body}',
-      idHeader: 'webhook-id',
-    },
+    ...STANDARD_WEBHOOKS_BASE,
+    ...signatureConfig,
   },
-};
+});
 ```
 
 See the [SignatureConfig type](https://tern.hookflo.com) for all options.
@@ -403,6 +415,7 @@ interface WebhookVerificationResult {
 
 ## Troubleshooting
 
+
 **`Module not found: Can't resolve "@hookflo/tern/nextjs"`**
 
 ```bash

package/dist/adapters/cloudflare.d.ts

@@ -1,4 +1,4 @@
-import { WebhookPlatform, NormalizeOptions } from '../types';
+import { WebhookPlatform } from '../types';
 import { QueueOption } from '../upstash/types';
 import type { AlertConfig, SendAlertOptions } from '../notifications/types';
 export interface CloudflareWebhookHandlerOptions<TEnv = Record<string, unknown>, TPayload = any, TMetadata extends Record<string, unknown> = Record<string, unknown>, TResponse = unknown> {
@@ -6,7 +6,6 @@ export interface CloudflareWebhookHandlerOptions<TEnv = Record<string, unknown>,
     secret?: string;
     secretEnv?: string;
     toleranceInSeconds?: number;
-    normalize?: boolean | NormalizeOptions;
     queue?: QueueOption;
     alerts?: AlertConfig;
     alert?: Omit<SendAlertOptions, 'dlq' | 'dlqId' | 'source' | 'eventId'>;

package/dist/adapters/cloudflare.js

@@ -39,7 +39,11 @@ function createWebhookHandler(options) {
                 }
                 return response;
             }
-            const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(request, options.platform, secret, options.toleranceInSeconds, options.normalize);
+            const result = await index_1.WebhookVerificationService.verify(request, {
+                platform: options.platform,
+                secret,
+                toleranceInSeconds: options.toleranceInSeconds,
+            });
             if (!result.isValid) {
                 return Response.json({ error: result.error, errorCode: result.errorCode, platform: result.platform, metadata: result.metadata }, { status: 400 });
             }

package/dist/adapters/express.d.ts

@@ -1,4 +1,4 @@
-import { WebhookPlatform, WebhookVerificationResult, NormalizeOptions } from '../types';
+import { WebhookPlatform, WebhookVerificationResult } from '../types';
 import { QueueOption } from '../upstash/types';
 import { MinimalNodeRequest } from './shared';
 import type { AlertConfig, SendAlertOptions } from '../notifications/types';
@@ -14,7 +14,6 @@ export interface ExpressWebhookMiddlewareOptions {
     platform: WebhookPlatform;
     secret: string;
     toleranceInSeconds?: number;
-    normalize?: boolean | NormalizeOptions;
     queue?: QueueOption;
     alerts?: AlertConfig;
     alert?: Omit<SendAlertOptions, 'dlq' | 'dlqId' | 'source' | 'eventId'>;

package/dist/adapters/express.js

@@ -48,7 +48,11 @@ function createWebhookMiddleware(options) {
                 }
                 return;
             }
-            const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(webRequest, options.platform, options.secret, options.toleranceInSeconds, options.normalize);
+            const result = await index_1.WebhookVerificationService.verify(webRequest, {
+                platform: options.platform,
+                secret: options.secret,
+                toleranceInSeconds: options.toleranceInSeconds,
+            });
             if (!result.isValid) {
                 res.status(400).json({
                     error: result.error,

package/dist/adapters/hono.d.ts

@@ -1,4 +1,4 @@
-import { WebhookPlatform, NormalizeOptions } from '../types';
+import { WebhookPlatform } from '../types';
 import { QueueOption } from '../upstash/types';
 import type { AlertConfig, SendAlertOptions } from '../notifications/types';
 export interface HonoContextLike {
@@ -11,7 +11,6 @@ export interface HonoWebhookHandlerOptions<TContext extends HonoContextLike = Ho
     platform: WebhookPlatform;
     secret: string;
     toleranceInSeconds?: number;
-    normalize?: boolean | NormalizeOptions;
     queue?: QueueOption;
     alerts?: AlertConfig;
     alert?: Omit<SendAlertOptions, 'dlq' | 'dlqId' | 'source' | 'eventId'>;

package/dist/adapters/hono.js

@@ -35,7 +35,11 @@ function createWebhookHandler(options) {
                 }
                 return response;
             }
-            const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(request, options.platform, options.secret, options.toleranceInSeconds, options.normalize);
+            const result = await index_1.WebhookVerificationService.verify(request, {
+                platform: options.platform,
+                secret: options.secret,
+                toleranceInSeconds: options.toleranceInSeconds,
+            });
             if (!result.isValid) {
                 return c.json({
                     error: result.error,

package/dist/adapters/nextjs.d.ts

@@ -1,11 +1,10 @@
-import { WebhookPlatform, NormalizeOptions } from '../types';
+import { WebhookPlatform } from '../types';
 import { QueueOption } from '../upstash/types';
 import type { AlertConfig, SendAlertOptions } from '../notifications/types';
 export interface NextWebhookHandlerOptions<TPayload = any, TMetadata extends Record<string, unknown> = Record<string, unknown>, TResponse = unknown> {
     platform: WebhookPlatform;
     secret: string;
     toleranceInSeconds?: number;
-    normalize?: boolean | NormalizeOptions;
     queue?: QueueOption;
     alerts?: AlertConfig;
     alert?: Omit<SendAlertOptions, 'dlq' | 'dlqId' | 'source' | 'eventId'>;

package/dist/adapters/nextjs.js

@@ -34,7 +34,11 @@ function createWebhookHandler(options) {
                 }
                 return response;
             }
-            const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(request, options.platform, options.secret, options.toleranceInSeconds, options.normalize);
+            const result = await index_1.WebhookVerificationService.verify(request, {
+                platform: options.platform,
+                secret: options.secret,
+                toleranceInSeconds: options.toleranceInSeconds,
+            });
             if (!result.isValid) {
                 return Response.json({ error: result.error, errorCode: result.errorCode, platform: result.platform, metadata: result.metadata }, { status: 400 });
             }

package/dist/adapters/shared.js

@@ -90,8 +90,11 @@ function toHeadersInit(headers) {
     return normalized;
 }
 async function toWebRequest(request) {
-    const protocol = request.protocol || 'https';
-    const host = request.get?.('host')
+    const forwardedProto = getHeaderValue(request.headers, 'x-forwarded-proto')?.split(',')[0]?.trim();
+    const protocol = forwardedProto || request.protocol || 'https';
+    const forwardedHost = getHeaderValue(request.headers, 'x-forwarded-host')?.split(',')[0]?.trim();
+    const host = forwardedHost
+        || request.get?.('host')
         || getHeaderValue(request.headers, 'host')
         || 'localhost';
     const path = request.originalUrl || request.url || '/';

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { WebhookConfig, WebhookVerificationResult, WebhookPlatform, SignatureConfig, MultiPlatformSecrets, NormalizeOptions } from './types';
+import { WebhookConfig, WebhookVerificationResult, WebhookPlatform, SignatureConfig, MultiPlatformSecrets } from './types';
 import type { QueueOption } from './upstash/types';
 import type { AlertConfig, SendAlertOptions } from './notifications/types';
 export declare class WebhookVerificationService {
@@ -6,8 +6,8 @@ export declare class WebhookVerificationService {
     private static getVerifier;
     private static createAlgorithmBasedVerifier;
     private static getLegacyVerifier;
-    static verifyWithPlatformConfig<TPayload = unknown>(request: Request, platform: WebhookPlatform, secret: string, toleranceInSeconds?: number, normalize?: boolean | NormalizeOptions): Promise<WebhookVerificationResult<TPayload>>;
-    static verifyAny<TPayload = unknown>(request: Request, secrets: MultiPlatformSecrets, toleranceInSeconds?: number, normalize?: boolean | NormalizeOptions): Promise<WebhookVerificationResult<TPayload>>;
+    static verifyWithPlatformConfig<TPayload = unknown>(request: Request, platform: WebhookPlatform, secret: string, toleranceInSeconds?: number): Promise<WebhookVerificationResult<TPayload>>;
+    static verifyAny<TPayload = unknown>(request: Request, secrets: MultiPlatformSecrets, toleranceInSeconds?: number): Promise<WebhookVerificationResult<TPayload>>;
     private static resolveCanonicalEventId;
     private static safeCompare;
     private static pickString;
@@ -29,10 +29,9 @@ export declare class WebhookVerificationService {
     static verifyTokenBased<TPayload = unknown>(request: Request, webhookId: string, webhookToken: string): Promise<WebhookVerificationResult<TPayload>>;
 }
 export * from './types';
-export { getPlatformAlgorithmConfig, platformUsesAlgorithm, getPlatformsUsingAlgorithm, validateSignatureConfig, } from './platforms/algorithms';
+export { getPlatformAlgorithmConfig, platformUsesAlgorithm, getPlatformsUsingAlgorithm, validateSignatureConfig, STANDARD_WEBHOOKS_BASE, createStandardWebhooksConfig, } from './platforms/algorithms';
 export { createAlgorithmVerifier } from './verifiers/algorithms';
 export { createCustomVerifier } from './verifiers/custom-algorithms';
-export { normalizePayload, getPlatformNormalizationCategory, getPlatformsByCategory, } from './normalization/simple';
 export * from './adapters';
 export * from './alerts';
 export default WebhookVerificationService;

package/dist/index.js

@@ -36,12 +36,11 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getPlatformsByCategory = exports.getPlatformNormalizationCategory = exports.normalizePayload = exports.createCustomVerifier = exports.createAlgorithmVerifier = exports.validateSignatureConfig = exports.getPlatformsUsingAlgorithm = exports.platformUsesAlgorithm = exports.getPlatformAlgorithmConfig = exports.WebhookVerificationService = void 0;
+exports.createCustomVerifier = exports.createAlgorithmVerifier = exports.createStandardWebhooksConfig = exports.STANDARD_WEBHOOKS_BASE = exports.validateSignatureConfig = exports.getPlatformsUsingAlgorithm = exports.platformUsesAlgorithm = exports.getPlatformAlgorithmConfig = exports.WebhookVerificationService = void 0;
 const crypto_1 = require("crypto");
 const algorithms_1 = require("./verifiers/algorithms");
 const custom_algorithms_1 = require("./verifiers/custom-algorithms");
 const algorithms_2 = require("./platforms/algorithms");
-const simple_1 = require("./normalization/simple");
 const dispatch_1 = require("./notifications/dispatch");
 class WebhookVerificationService {
     static async verify(request, config) {
@@ -51,9 +50,6 @@ class WebhookVerificationService {
         if (result.isValid) {
             result.platform = config.platform;
             result.eventId = this.resolveCanonicalEventId(config.platform, result.metadata, result.payload) ?? undefined;
-            if (config.normalize) {
-                result.payload = (0, simple_1.normalizePayload)(config.platform, result.payload, config.normalize);
-            }
         }
         return result;
     }
@@ -70,12 +66,18 @@ class WebhookVerificationService {
         if (!signatureConfig) {
             throw new Error('Signature config is required for algorithm-based verification');
         }
+        const effectiveSignatureConfig = {
+            ...signatureConfig,
+            customConfig: {
+                ...(signatureConfig.customConfig || {}),
+            },
+        };
         // Use custom verifiers for special cases (token-based, etc.)
-        if (signatureConfig.algorithm === 'custom') {
-            return (0, custom_algorithms_1.createCustomVerifier)(secret, signatureConfig, toleranceInSeconds);
+        if (effectiveSignatureConfig.algorithm === 'custom') {
+            return (0, custom_algorithms_1.createCustomVerifier)(secret, effectiveSignatureConfig, toleranceInSeconds);
         }
         // Use algorithm-based verifiers for standard algorithms
-        return (0, algorithms_1.createAlgorithmVerifier)(secret, signatureConfig, config.platform, toleranceInSeconds);
+        return (0, algorithms_1.createAlgorithmVerifier)(secret, effectiveSignatureConfig, config.platform, toleranceInSeconds);
     }
     static getLegacyVerifier(config) {
         // For legacy support, we'll use the algorithm-based approach
@@ -87,29 +89,28 @@ class WebhookVerificationService {
         return this.createAlgorithmBasedVerifier(configWithSignature);
     }
     // New method to create verifier using platform algorithm config
-    static async verifyWithPlatformConfig(request, platform, secret, toleranceInSeconds = 300, normalize = false) {
+    static async verifyWithPlatformConfig(request, platform, secret, toleranceInSeconds = 300) {
         const platformConfig = (0, algorithms_2.getPlatformAlgorithmConfig)(platform);
         const config = {
             platform,
             secret,
             toleranceInSeconds,
-            signatureConfig: platformConfig.signatureConfig,
-            normalize,
+            signatureConfig: platformConfig.signatureConfig
         };
         return this.verify(request, config);
     }
-    static async verifyAny(request, secrets, toleranceInSeconds = 300, normalize = false) {
+    static async verifyAny(request, secrets, toleranceInSeconds = 300) {
         const requestClone = request.clone();
         const detectedPlatform = this.detectPlatform(requestClone);
         if (detectedPlatform !== 'unknown' && secrets[detectedPlatform]) {
-            return this.verifyWithPlatformConfig(requestClone, detectedPlatform, secrets[detectedPlatform], toleranceInSeconds, normalize);
+            return this.verifyWithPlatformConfig(requestClone, detectedPlatform, secrets[detectedPlatform], toleranceInSeconds);
         }
         const failedAttempts = [];
         const verificationResults = await Promise.all(Object.entries(secrets)
             .filter(([, secret]) => Boolean(secret))
             .map(async ([platform, secret]) => {
             const normalizedPlatform = platform.toLowerCase();
-            const result = await this.verifyWithPlatformConfig(requestClone, normalizedPlatform, secret, toleranceInSeconds, normalize);
+            const result = await this.verifyWithPlatformConfig(requestClone, normalizedPlatform, secret, toleranceInSeconds);
             return {
                 platform: normalizedPlatform,
                 result,
@@ -189,6 +190,9 @@ class WebhookVerificationService {
             case 'workos':
             case 'sentry':
             case 'vercel':
+            case 'linear':
+            case 'svix':
+            case 'standardwebhooks':
                 return this.pickString(payload?.id) || null;
             case 'doppler':
                 return this.pickString(payload?.event?.id, metadata?.id) || null;
@@ -220,7 +224,9 @@ class WebhookVerificationService {
         if (headers.has('x-hub-signature-256'))
             return 'github';
         if (headers.has('svix-signature'))
-            return 'clerk';
+            return headers.has('svix-id') ? 'svix' : 'clerk';
+        if (headers.has('linear-signature'))
+            return 'linear';
         if (headers.has('workos-signature'))
             return 'workos';
         if (headers.has('webhook-signature')) {
@@ -361,14 +367,12 @@ Object.defineProperty(exports, "getPlatformAlgorithmConfig", { enumerable: true,
 Object.defineProperty(exports, "platformUsesAlgorithm", { enumerable: true, get: function () { return algorithms_3.platformUsesAlgorithm; } });
 Object.defineProperty(exports, "getPlatformsUsingAlgorithm", { enumerable: true, get: function () { return algorithms_3.getPlatformsUsingAlgorithm; } });
 Object.defineProperty(exports, "validateSignatureConfig", { enumerable: true, get: function () { return algorithms_3.validateSignatureConfig; } });
+Object.defineProperty(exports, "STANDARD_WEBHOOKS_BASE", { enumerable: true, get: function () { return algorithms_3.STANDARD_WEBHOOKS_BASE; } });
+Object.defineProperty(exports, "createStandardWebhooksConfig", { enumerable: true, get: function () { return algorithms_3.createStandardWebhooksConfig; } });
 var algorithms_4 = require("./verifiers/algorithms");
 Object.defineProperty(exports, "createAlgorithmVerifier", { enumerable: true, get: function () { return algorithms_4.createAlgorithmVerifier; } });
 var custom_algorithms_2 = require("./verifiers/custom-algorithms");
 Object.defineProperty(exports, "createCustomVerifier", { enumerable: true, get: function () { return custom_algorithms_2.createCustomVerifier; } });
-var simple_2 = require("./normalization/simple");
-Object.defineProperty(exports, "normalizePayload", { enumerable: true, get: function () { return simple_2.normalizePayload; } });
-Object.defineProperty(exports, "getPlatformNormalizationCategory", { enumerable: true, get: function () { return simple_2.getPlatformNormalizationCategory; } });
-Object.defineProperty(exports, "getPlatformsByCategory", { enumerable: true, get: function () { return simple_2.getPlatformsByCategory; } });
 __exportStar(require("./adapters"), exports);
 __exportStar(require("./alerts"), exports);
 exports.default = WebhookVerificationService;

package/dist/platforms/algorithms.d.ts

@@ -1,4 +1,24 @@
 import { PlatformAlgorithmConfig, WebhookPlatform, SignatureConfig } from "../types";
+export declare const STANDARD_WEBHOOKS_BASE: {
+    algorithm: "hmac-sha256";
+    headerFormat: "raw";
+    timestampFormat: "unix";
+    payloadFormat: "custom";
+    customConfig: {
+        signatureFormat: string;
+        payloadFormat: string;
+        encoding: string;
+        secretEncoding: string;
+    };
+};
+export declare function createStandardWebhooksConfig(headers: {
+    id: string;
+    timestamp: string;
+    signature: string;
+    idAliases?: string[];
+    timestampAliases?: string[];
+    signatureAliases?: string[];
+}): SignatureConfig;
 export declare const platformAlgorithmConfigs: Record<WebhookPlatform, PlatformAlgorithmConfig>;
 export declare function getPlatformAlgorithmConfig(platform: WebhookPlatform): PlatformAlgorithmConfig;
 export declare function platformUsesAlgorithm(platform: WebhookPlatform, algorithm: string): boolean;

package/dist/platforms/algorithms.js

@@ -1,10 +1,37 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.platformAlgorithmConfigs = void 0;
+exports.platformAlgorithmConfigs = exports.STANDARD_WEBHOOKS_BASE = void 0;
+exports.createStandardWebhooksConfig = createStandardWebhooksConfig;
 exports.getPlatformAlgorithmConfig = getPlatformAlgorithmConfig;
 exports.platformUsesAlgorithm = platformUsesAlgorithm;
 exports.getPlatformsUsingAlgorithm = getPlatformsUsingAlgorithm;
 exports.validateSignatureConfig = validateSignatureConfig;
+exports.STANDARD_WEBHOOKS_BASE = {
+    algorithm: "hmac-sha256",
+    headerFormat: "raw",
+    timestampFormat: "unix",
+    payloadFormat: "custom",
+    customConfig: {
+        signatureFormat: "v1={signature}",
+        payloadFormat: "{id}.{timestamp}.{body}",
+        encoding: "base64",
+        secretEncoding: "base64",
+    },
+};
+function createStandardWebhooksConfig(headers) {
+    return {
+        ...exports.STANDARD_WEBHOOKS_BASE,
+        headerName: headers.signature,
+        timestampHeader: headers.timestamp,
+        customConfig: {
+            ...exports.STANDARD_WEBHOOKS_BASE.customConfig,
+            idHeader: headers.id,
+            ...(headers.idAliases && { idHeaderAliases: headers.idAliases }),
+            ...(headers.timestampAliases && { timestampHeaderAliases: headers.timestampAliases }),
+            ...(headers.signatureAliases && { signatureHeaderAliases: headers.signatureAliases }),
+        },
+    };
+}
 exports.platformAlgorithmConfigs = {
     github: {
         platform: "github",
@@ -51,6 +78,27 @@ exports.platformAlgorithmConfigs = {
         },
         description: "Clerk webhooks use HMAC-SHA256 with base64 encoding",
     },
+    svix: {
+        platform: 'svix',
+        signatureConfig: {
+            algorithm: 'hmac-sha256',
+            headerName: 'svix-signature',
+            headerFormat: 'raw',
+            timestampHeader: 'svix-timestamp',
+            timestampFormat: 'unix',
+            payloadFormat: 'custom',
+            customConfig: {
+                signatureFormat: 'v1={signature}',
+                payloadFormat: '{id}.{timestamp}.{body}',
+                encoding: 'base64',
+                secretEncoding: 'base64',
+                idHeader: 'svix-id',
+                idHeaderAliases: ['webhook-id'],
+                timestampHeaderAliases: ['webhook-timestamp'],
+            },
+        },
+        description: 'Svix webhooks use HMAC-SHA256 with Standard Webhooks format',
+    },
     dodopayments: {
         platform: "dodopayments",
         signatureConfig: {
@@ -287,6 +335,33 @@ exports.platformAlgorithmConfigs = {
         },
         description: "Sanity webhooks use Stripe-compatible HMAC-SHA256 with base64 encoded signature and plain UTF-8 secret",
     },
+    linear: {
+        platform: 'linear',
+        signatureConfig: {
+            algorithm: 'hmac-sha256',
+            headerName: 'linear-signature',
+            headerFormat: 'raw',
+            payloadFormat: 'raw',
+            customConfig: {
+                replayToleranceMs: 60000,
+            },
+        },
+        description: 'Linear webhooks use HMAC-SHA256 on the raw body with a 60s timestamp replay window',
+    },
+    standardwebhooks: {
+        platform: 'standardwebhooks',
+        signatureConfig: {
+            ...createStandardWebhooksConfig({
+                id: 'webhook-id',
+                timestamp: 'webhook-timestamp',
+                signature: 'webhook-signature',
+                idAliases: ['svix-id'],
+                timestampAliases: ['svix-timestamp'],
+                signatureAliases: ['svix-signature'],
+            }),
+        },
+        description: 'Canonical Standard Webhooks implementation. Works for any platform using v1= HMAC-SHA256 signing regardless of header names.',
+    },
     custom: {
         platform: "custom",
         signatureConfig: {

package/dist/types.d.ts

@@ -1,8 +1,9 @@
-export type WebhookPlatform = 'custom' | 'clerk' | 'github' | 'stripe' | 'shopify' | 'vercel' | 'polar' | 'dodopayments' | 'gitlab' | 'paddle' | 'razorpay' | 'lemonsqueezy' | 'workos' | 'woocommerce' | 'replicateai' | 'falai' | 'sentry' | 'grafana' | 'doppler' | 'sanity' | 'unknown';
+export type WebhookPlatform = 'custom' | 'clerk' | 'svix' | 'github' | 'stripe' | 'shopify' | 'vercel' | 'polar' | 'dodopayments' | 'gitlab' | 'paddle' | 'razorpay' | 'lemonsqueezy' | 'workos' | 'woocommerce' | 'replicateai' | 'falai' | 'sentry' | 'grafana' | 'doppler' | 'sanity' | 'linear' | 'standardwebhooks' | 'unknown';
 export declare enum WebhookPlatformKeys {
     GitHub = "github",
     Stripe = "stripe",
     Clerk = "clerk",
+    Svix = "svix",
     DodoPayments = "dodopayments",
     Shopify = "shopify",
     Vercel = "vercel",
@@ -19,6 +20,8 @@ export declare enum WebhookPlatformKeys {
     Grafana = "grafana",
     Doppler = "doppler",
     Sanity = "sanity",
+    Linear = "linear",
+    StandardWebhooks = "standardwebhooks",
     Custom = "custom",
     Unknown = "unknown"
 }
@@ -35,69 +38,6 @@ export interface SignatureConfig {
     customConfig?: Record<string, any>;
 }
 export type WebhookErrorCode = 'MISSING_SIGNATURE' | 'INVALID_SIGNATURE' | 'TIMESTAMP_EXPIRED' | 'MISSING_TOKEN' | 'INVALID_TOKEN' | 'PLATFORM_NOT_SUPPORTED' | 'NORMALIZATION_ERROR' | 'VERIFICATION_ERROR';
-export type NormalizationCategory = 'payment' | 'auth' | 'ecommerce' | 'infrastructure';
-export interface BaseNormalizedWebhook {
-    category: NormalizationCategory;
-    event: string;
-    _platform: WebhookPlatform | string;
-    _raw: unknown;
-    occurred_at?: string;
-}
-export type PaymentWebhookEvent = 'payment.succeeded' | 'payment.failed' | 'payment.refunded' | 'subscription.created' | 'subscription.cancelled' | 'payment.unknown';
-export interface PaymentWebhookNormalized extends BaseNormalizedWebhook {
-    category: 'payment';
-    event: PaymentWebhookEvent;
-    amount?: number;
-    currency?: string;
-    customer_id?: string;
-    transaction_id?: string;
-    subscription_id?: string;
-    refund_amount?: number;
-    failure_reason?: string;
-    metadata?: Record<string, string>;
-}
-export type AuthWebhookEvent = 'user.created' | 'user.updated' | 'user.deleted' | 'session.started' | 'session.ended' | 'auth.unknown';
-export interface AuthWebhookNormalized extends BaseNormalizedWebhook {
-    category: 'auth';
-    event: AuthWebhookEvent;
-    user_id?: string;
-    email?: string;
-    phone?: string;
-    metadata?: Record<string, string>;
-}
-export interface EcommerceWebhookNormalized extends BaseNormalizedWebhook {
-    category: 'ecommerce';
-    event: string;
-    order_id?: string;
-    customer_id?: string;
-    amount?: number;
-    currency?: string;
-    metadata?: Record<string, string>;
-}
-export interface InfrastructureWebhookNormalized extends BaseNormalizedWebhook {
-    category: 'infrastructure';
-    event: string;
-    project_id?: string;
-    deployment_id?: string;
-    status?: 'queued' | 'building' | 'ready' | 'error' | 'unknown';
-    metadata?: Record<string, string>;
-}
-export interface UnknownNormalizedWebhook extends BaseNormalizedWebhook {
-    event: string;
-    warning?: string;
-}
-export type NormalizedPayloadByCategory = {
-    payment: PaymentWebhookNormalized;
-    auth: AuthWebhookNormalized;
-    ecommerce: EcommerceWebhookNormalized;
-    infrastructure: InfrastructureWebhookNormalized;
-};
-export type AnyNormalizedWebhook = PaymentWebhookNormalized | AuthWebhookNormalized | EcommerceWebhookNormalized | InfrastructureWebhookNormalized | UnknownNormalizedWebhook;
-export interface NormalizeOptions {
-    enabled?: boolean;
-    category?: NormalizationCategory;
-    includeRaw?: boolean;
-}
 export interface WebhookVerificationResult<TPayload = unknown> {
     isValid: boolean;
     error?: string;
@@ -116,7 +56,6 @@ export interface WebhookConfig {
     secret: string;
     toleranceInSeconds?: number;
     signatureConfig?: SignatureConfig;
-    normalize?: boolean | NormalizeOptions;
 }
 export interface MultiPlatformSecrets {
     [platform: string]: string | undefined;

package/dist/types.js

@@ -6,6 +6,7 @@ var WebhookPlatformKeys;
     WebhookPlatformKeys["GitHub"] = "github";
     WebhookPlatformKeys["Stripe"] = "stripe";
     WebhookPlatformKeys["Clerk"] = "clerk";
+    WebhookPlatformKeys["Svix"] = "svix";
     WebhookPlatformKeys["DodoPayments"] = "dodopayments";
     WebhookPlatformKeys["Shopify"] = "shopify";
     WebhookPlatformKeys["Vercel"] = "vercel";
@@ -22,6 +23,8 @@ var WebhookPlatformKeys;
     WebhookPlatformKeys["Grafana"] = "grafana";
     WebhookPlatformKeys["Doppler"] = "doppler";
     WebhookPlatformKeys["Sanity"] = "sanity";
+    WebhookPlatformKeys["Linear"] = "linear";
+    WebhookPlatformKeys["StandardWebhooks"] = "standardwebhooks";
     WebhookPlatformKeys["Custom"] = "custom";
     WebhookPlatformKeys["Unknown"] = "unknown";
 })(WebhookPlatformKeys || (exports.WebhookPlatformKeys = WebhookPlatformKeys = {}));

package/dist/verifiers/algorithms.d.ts

@@ -5,6 +5,11 @@ export declare abstract class AlgorithmBasedVerifier extends WebhookVerifier {
     protected platform: WebhookPlatform;
     constructor(secret: string, config: SignatureConfig, platform: WebhookPlatform, toleranceInSeconds?: number);
     abstract verify(request: Request): Promise<WebhookVerificationResult>;
+    protected getMissingSignatureMessage(): string;
+    protected getMissingTimestampMessage(): string;
+    protected getTimestampExpiredMessage(): string;
+    protected getInvalidSignatureMessage(): string;
+    protected getVerificationErrorMessage(error: Error): string;
     protected parseDelimitedHeader(headerValue: string): Record<string, string>;
     protected extractSignatures(request: Request): string[];
     protected extractTimestamp(request: Request): number | null;
@@ -18,6 +23,7 @@ export declare abstract class AlgorithmBasedVerifier extends WebhookVerifier {
     protected extractMetadata(request: Request): Record<string, any>;
 }
 export declare class GenericHMACVerifier extends AlgorithmBasedVerifier {
+    private validateLinearReplayWindow;
     private resolveSentryPayloadCandidates;
     verify(request: Request): Promise<WebhookVerificationResult>;
 }