@hookflo/tern 4.3.3-beta → 4.4.3

package/README.md

@@ -4,10 +4,10 @@
 
 [![npm version](https://img.shields.io/npm/v/@hookflo/tern)](https://www.npmjs.com/package/@hookflo/tern)
 [![TypeScript](https://img.shields.io/badge/TypeScript-Strict-blue)](https://www.typescriptlang.org/)
-[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+![npm installs](https://img.shields.io/npm/dt/@hookflo/tern?style=flat-square&logo=npm&label=installs&color=111827)
 [![Zero Dependencies](https://img.shields.io/badge/dependencies-0-brightgreen)](package.json)
 
-Stop writing webhook verification from scratch. **Tern** handles signature verification for Stripe, GitHub, Clerk, Shopify, and 15+ more platforms — with one consistent API.
+Stop writing webhook verification from scratch. **Tern** handles signature verification for Stripe, GitHub, Clerk, Shopify, and 15+ more platforms — with one consistent API. It also verifies **Standard Webhooks** (including Svix-style `svix-*` and canonical `webhook-*` headers) through a single `standardwebhooks` platform config.
 
 > Need reliable delivery too? Tern supports inbound webhook delivery via Upstash QStash — automatic retries, DLQ management, replay controls, and Slack/Discord alerting. Bring your own Upstash account (BYOK).
 
@@ -79,27 +79,6 @@ const result = await WebhookVerificationService.verifyAny(request, {
 console.log(`Verified ${result.platform} webhook`);
 ```
 
-### Twilio example
-
-```typescript
-import { WebhookVerificationService } from '@hookflo/tern';
-
-export async function POST(request: Request) {
-  const result = await WebhookVerificationService.verify(request, {
-    platform: 'twilio',
-    secret: process.env.TWILIO_AUTH_TOKEN!,
-    // Optional when behind proxies/CDNs if request.url differs from the public Twilio URL:
-    twilioBaseUrl: 'https://yourdomain.com/api/webhooks/twilio',
-  });
-
-  if (!result.isValid) {
-    return Response.json({ error: result.error }, { status: 400 });
-  }
-
-  return Response.json({ ok: true });
-}
-```
-
 ### Core SDK (runtime-agnostic)
 
 Use Tern without framework adapters in any runtime that supports the Web `Request` API.
@@ -213,10 +192,9 @@ app.post('/webhooks/stripe', createWebhookHandler({
 | **Grafana** | HMAC-SHA256 | ✅ Tested |
 | **Doppler** | HMAC-SHA256 | ✅ Tested |
 | **Sanity** | HMAC-SHA256 | ✅ Tested |
-| **Svix** | HMAC-SHA256 | ⚠️ Untested for now |
-| **Linear** | HMAC-SHA256 | ⚠️ Untested for now |
-| **PagerDuty** | HMAC-SHA256 | ⚠️ Untested for now |
-| **Twilio** | HMAC-SHA1 | ⚠️ Untested for now |
+| **Svix** | HMAC-SHA256 | ✅ Tested |
+| **Standard Webhooks** (`standardwebhooks`) | HMAC-SHA256 | ✅ Tested |
+| **Linear** | HMAC-SHA256 | ✅ Tested |
 | **Razorpay** | HMAC-SHA256 | 🔄 Pending |
 | **Vercel** | HMAC-SHA256 | 🔄 Pending |
 
@@ -224,7 +202,7 @@ app.post('/webhooks/stripe', createWebhookHandler({
 
 ### Platform signature notes
 
-- **Standard Webhooks style** platforms (Clerk, Dodo Payments, Polar, ReplicateAI) commonly use a secret that starts with `whsec_...`.
+- **Standard Webhooks style** providers are supported via the canonical `standardwebhooks` platform (with aliases for both `webhook-*` and `svix-*` headers). Clerk, Dodo Payments, Polar, and ReplicateAI all follow this pattern and commonly use a secret that starts with `whsec_...`.
 - **ReplicateAI**: copy the webhook signing secret from your Replicate webhook settings and pass it directly as `secret`.
 - **fal.ai**: supports JWKS key resolution out of the box — use `secret: ''` for auto key resolution, or pass a PEM public key explicitly.
 
@@ -365,25 +343,31 @@ const result = await WebhookVerificationService.verify(request, {
 });
 ```
 
-### Svix / Standard Webhooks format (Clerk, Dodo Payments, ReplicateAI, etc.)
+### Standard Webhooks config helpers (Svix-style and webhook-* headers)
 
 ```typescript
-const svixConfig = {
-  platform: 'my-svix-platform',
-  secret: 'whsec_abc123...',
+import {
+  createStandardWebhooksConfig,
+  STANDARD_WEBHOOKS_BASE,
+} from '@hookflo/tern';
+
+const signatureConfig = createStandardWebhooksConfig({
+  id: 'webhook-id',
+  timestamp: 'webhook-timestamp',
+  signature: 'webhook-signature',
+  idAliases: ['svix-id'],
+  timestampAliases: ['svix-timestamp'],
+  signatureAliases: ['svix-signature'],
+});
+
+const result = await WebhookVerificationService.verify(request, {
+  platform: 'standardwebhooks',
+  secret: process.env.STANDARD_WEBHOOKS_SECRET!,
   signatureConfig: {
-    algorithm: 'hmac-sha256',
-    headerName: 'webhook-signature',
-    headerFormat: 'raw',
-    timestampHeader: 'webhook-timestamp',
-    timestampFormat: 'unix',
-    payloadFormat: 'custom',
-    customConfig: {
-      payloadFormat: '{id}.{timestamp}.{body}',
-      idHeader: 'webhook-id',
-    },
+    ...STANDARD_WEBHOOKS_BASE,
+    ...signatureConfig,
   },
-};
+});
 ```
 
 See the [SignatureConfig type](https://tern.hookflo.com) for all options.
@@ -431,8 +415,6 @@ interface WebhookVerificationResult {
 
 ## Troubleshooting
 
-- **Twilio invalid signature behind proxies/CDNs**: if your runtime `request.url` differs from the public Twilio webhook URL, pass `twilioBaseUrl` in `WebhookVerificationService.verify(...)` for platform `twilio`.
-
 
 **`Module not found: Can't resolve "@hookflo/tern/nextjs"`**
 

package/dist/adapters/cloudflare.js

@@ -39,7 +39,11 @@ function createWebhookHandler(options) {
                 }
                 return response;
             }
-            const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(request, options.platform, secret, options.toleranceInSeconds);
+            const result = await index_1.WebhookVerificationService.verify(request, {
+                platform: options.platform,
+                secret,
+                toleranceInSeconds: options.toleranceInSeconds,
+            });
             if (!result.isValid) {
                 return Response.json({ error: result.error, errorCode: result.errorCode, platform: result.platform, metadata: result.metadata }, { status: 400 });
             }

package/dist/adapters/express.js

@@ -48,7 +48,11 @@ function createWebhookMiddleware(options) {
                 }
                 return;
             }
-            const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(webRequest, options.platform, options.secret, options.toleranceInSeconds);
+            const result = await index_1.WebhookVerificationService.verify(webRequest, {
+                platform: options.platform,
+                secret: options.secret,
+                toleranceInSeconds: options.toleranceInSeconds,
+            });
             if (!result.isValid) {
                 res.status(400).json({
                     error: result.error,

package/dist/adapters/hono.js

@@ -35,7 +35,11 @@ function createWebhookHandler(options) {
                 }
                 return response;
             }
-            const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(request, options.platform, options.secret, options.toleranceInSeconds);
+            const result = await index_1.WebhookVerificationService.verify(request, {
+                platform: options.platform,
+                secret: options.secret,
+                toleranceInSeconds: options.toleranceInSeconds,
+            });
             if (!result.isValid) {
                 return c.json({
                     error: result.error,

package/dist/adapters/nextjs.js

@@ -34,7 +34,11 @@ function createWebhookHandler(options) {
                 }
                 return response;
             }
-            const result = await index_1.WebhookVerificationService.verifyWithPlatformConfig(request, options.platform, options.secret, options.toleranceInSeconds);
+            const result = await index_1.WebhookVerificationService.verify(request, {
+                platform: options.platform,
+                secret: options.secret,
+                toleranceInSeconds: options.toleranceInSeconds,
+            });
             if (!result.isValid) {
                 return Response.json({ error: result.error, errorCode: result.errorCode, platform: result.platform, metadata: result.metadata }, { status: 400 });
             }

package/dist/index.d.ts

@@ -29,7 +29,7 @@ export declare class WebhookVerificationService {
     static verifyTokenBased<TPayload = unknown>(request: Request, webhookId: string, webhookToken: string): Promise<WebhookVerificationResult<TPayload>>;
 }
 export * from './types';
-export { getPlatformAlgorithmConfig, platformUsesAlgorithm, getPlatformsUsingAlgorithm, validateSignatureConfig, } from './platforms/algorithms';
+export { getPlatformAlgorithmConfig, platformUsesAlgorithm, getPlatformsUsingAlgorithm, validateSignatureConfig, STANDARD_WEBHOOKS_BASE, createStandardWebhooksConfig, } from './platforms/algorithms';
 export { createAlgorithmVerifier } from './verifiers/algorithms';
 export { createCustomVerifier } from './verifiers/custom-algorithms';
 export * from './adapters';

package/dist/index.js

@@ -36,7 +36,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createCustomVerifier = exports.createAlgorithmVerifier = exports.validateSignatureConfig = exports.getPlatformsUsingAlgorithm = exports.platformUsesAlgorithm = exports.getPlatformAlgorithmConfig = exports.WebhookVerificationService = void 0;
+exports.createCustomVerifier = exports.createAlgorithmVerifier = exports.createStandardWebhooksConfig = exports.STANDARD_WEBHOOKS_BASE = exports.validateSignatureConfig = exports.getPlatformsUsingAlgorithm = exports.platformUsesAlgorithm = exports.getPlatformAlgorithmConfig = exports.WebhookVerificationService = void 0;
 const crypto_1 = require("crypto");
 const algorithms_1 = require("./verifiers/algorithms");
 const custom_algorithms_1 = require("./verifiers/custom-algorithms");
@@ -70,9 +70,6 @@ class WebhookVerificationService {
             ...signatureConfig,
             customConfig: {
                 ...(signatureConfig.customConfig || {}),
-                ...(config.platform === 'twilio' && config.twilioBaseUrl
-                    ? { twilioBaseUrl: config.twilioBaseUrl }
-                    : {}),
             },
         };
         // Use custom verifiers for special cases (token-based, etc.)
@@ -194,9 +191,8 @@ class WebhookVerificationService {
             case 'sentry':
             case 'vercel':
             case 'linear':
-            case 'pagerduty':
-            case 'twilio':
             case 'svix':
+            case 'standardwebhooks':
                 return this.pickString(payload?.id) || null;
             case 'doppler':
                 return this.pickString(payload?.event?.id, metadata?.id) || null;
@@ -231,10 +227,6 @@ class WebhookVerificationService {
             return headers.has('svix-id') ? 'svix' : 'clerk';
         if (headers.has('linear-signature'))
             return 'linear';
-        if (headers.has('x-pagerduty-signature'))
-            return 'pagerduty';
-        if (headers.has('x-twilio-signature'))
-            return 'twilio';
         if (headers.has('workos-signature'))
             return 'workos';
         if (headers.has('webhook-signature')) {
@@ -375,6 +367,8 @@ Object.defineProperty(exports, "getPlatformAlgorithmConfig", { enumerable: true,
 Object.defineProperty(exports, "platformUsesAlgorithm", { enumerable: true, get: function () { return algorithms_3.platformUsesAlgorithm; } });
 Object.defineProperty(exports, "getPlatformsUsingAlgorithm", { enumerable: true, get: function () { return algorithms_3.getPlatformsUsingAlgorithm; } });
 Object.defineProperty(exports, "validateSignatureConfig", { enumerable: true, get: function () { return algorithms_3.validateSignatureConfig; } });
+Object.defineProperty(exports, "STANDARD_WEBHOOKS_BASE", { enumerable: true, get: function () { return algorithms_3.STANDARD_WEBHOOKS_BASE; } });
+Object.defineProperty(exports, "createStandardWebhooksConfig", { enumerable: true, get: function () { return algorithms_3.createStandardWebhooksConfig; } });
 var algorithms_4 = require("./verifiers/algorithms");
 Object.defineProperty(exports, "createAlgorithmVerifier", { enumerable: true, get: function () { return algorithms_4.createAlgorithmVerifier; } });
 var custom_algorithms_2 = require("./verifiers/custom-algorithms");

package/dist/platforms/algorithms.d.ts

@@ -1,4 +1,24 @@
 import { PlatformAlgorithmConfig, WebhookPlatform, SignatureConfig } from "../types";
+export declare const STANDARD_WEBHOOKS_BASE: {
+    algorithm: "hmac-sha256";
+    headerFormat: "raw";
+    timestampFormat: "unix";
+    payloadFormat: "custom";
+    customConfig: {
+        signatureFormat: string;
+        payloadFormat: string;
+        encoding: string;
+        secretEncoding: string;
+    };
+};
+export declare function createStandardWebhooksConfig(headers: {
+    id: string;
+    timestamp: string;
+    signature: string;
+    idAliases?: string[];
+    timestampAliases?: string[];
+    signatureAliases?: string[];
+}): SignatureConfig;
 export declare const platformAlgorithmConfigs: Record<WebhookPlatform, PlatformAlgorithmConfig>;
 export declare function getPlatformAlgorithmConfig(platform: WebhookPlatform): PlatformAlgorithmConfig;
 export declare function platformUsesAlgorithm(platform: WebhookPlatform, algorithm: string): boolean;

package/dist/platforms/algorithms.js

@@ -1,10 +1,41 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.platformAlgorithmConfigs = void 0;
+exports.platformAlgorithmConfigs = exports.STANDARD_WEBHOOKS_BASE = void 0;
+exports.createStandardWebhooksConfig = createStandardWebhooksConfig;
 exports.getPlatformAlgorithmConfig = getPlatformAlgorithmConfig;
 exports.platformUsesAlgorithm = platformUsesAlgorithm;
 exports.getPlatformsUsingAlgorithm = getPlatformsUsingAlgorithm;
 exports.validateSignatureConfig = validateSignatureConfig;
+exports.STANDARD_WEBHOOKS_BASE = {
+    algorithm: "hmac-sha256",
+    headerFormat: "raw",
+    timestampFormat: "unix",
+    payloadFormat: "custom",
+    customConfig: {
+        signatureFormat: "v1={signature}",
+        payloadFormat: "{id}.{timestamp}.{body}",
+        encoding: "base64",
+        secretEncoding: "base64",
+    },
+};
+function createStandardWebhooksConfig(headers) {
+    return {
+        ...exports.STANDARD_WEBHOOKS_BASE,
+        headerName: headers.signature,
+        timestampHeader: headers.timestamp,
+        customConfig: {
+            ...exports.STANDARD_WEBHOOKS_BASE.customConfig,
+            idHeader: headers.id,
+            ...(headers.idAliases && { idHeaderAliases: headers.idAliases }),
+            ...(headers.timestampAliases && {
+                timestampHeaderAliases: headers.timestampAliases,
+            }),
+            ...(headers.signatureAliases && {
+                signatureHeaderAliases: headers.signatureAliases,
+            }),
+        },
+    };
+}
 exports.platformAlgorithmConfigs = {
     github: {
         platform: "github",
@@ -51,27 +82,6 @@ exports.platformAlgorithmConfigs = {
         },
         description: "Clerk webhooks use HMAC-SHA256 with base64 encoding",
     },
-    svix: {
-        platform: 'svix',
-        signatureConfig: {
-            algorithm: 'hmac-sha256',
-            headerName: 'svix-signature',
-            headerFormat: 'raw',
-            timestampHeader: 'svix-timestamp',
-            timestampFormat: 'unix',
-            payloadFormat: 'custom',
-            customConfig: {
-                signatureFormat: 'v1={signature}',
-                payloadFormat: '{id}.{timestamp}.{body}',
-                encoding: 'base64',
-                secretEncoding: 'base64',
-                idHeader: 'svix-id',
-                idHeaderAliases: ['webhook-id'],
-                timestampHeaderAliases: ['webhook-timestamp'],
-            },
-        },
-        description: 'Svix webhooks use HMAC-SHA256 with Standard Webhooks format',
-    },
     dodopayments: {
         platform: "dodopayments",
         signatureConfig: {
@@ -309,48 +319,52 @@ exports.platformAlgorithmConfigs = {
         description: "Sanity webhooks use Stripe-compatible HMAC-SHA256 with base64 encoded signature and plain UTF-8 secret",
     },
     linear: {
-        platform: 'linear',
+        platform: "linear",
         signatureConfig: {
-            algorithm: 'hmac-sha256',
-            headerName: 'linear-signature',
-            headerFormat: 'raw',
-            payloadFormat: 'raw',
+            algorithm: "hmac-sha256",
+            headerName: "linear-signature",
+            headerFormat: "raw",
+            payloadFormat: "raw",
             customConfig: {
                 replayToleranceMs: 60000,
             },
         },
-        description: 'Linear webhooks use HMAC-SHA256 on the raw body with a 60s timestamp replay window',
+        description: "Linear webhooks use HMAC-SHA256 on the raw body with a 60s timestamp replay window",
     },
-    pagerduty: {
-        platform: 'pagerduty',
+    svix: {
+        platform: "svix",
         signatureConfig: {
-            algorithm: 'hmac-sha256',
-            headerName: 'x-pagerduty-signature',
-            headerFormat: 'raw',
-            payloadFormat: 'raw',
-            prefix: 'v1=',
+            algorithm: "hmac-sha256",
+            headerName: "svix-signature",
+            headerFormat: "raw",
+            timestampHeader: "svix-timestamp",
+            timestampFormat: "unix",
+            payloadFormat: "custom",
             customConfig: {
-                signatureFormat: 'v1={signature}',
-                comparePrefixed: true,
+                signatureFormat: "v1={signature}",
+                payloadFormat: "{id}.{timestamp}.{body}",
+                encoding: "base64",
+                secretEncoding: "base64",
+                idHeader: "svix-id",
+                idHeaderAliases: ["webhook-id"],
+                timestampHeaderAliases: ["webhook-timestamp"],
             },
         },
-        description: 'PagerDuty webhooks use HMAC-SHA256 with v1=<hex> signatures',
+        description: "Svix webhooks use HMAC-SHA256 with Standard Webhooks format",
     },
-    twilio: {
-        platform: 'twilio',
+    standardwebhooks: {
+        platform: "standardwebhooks",
         signatureConfig: {
-            algorithm: 'hmac-sha1',
-            headerName: 'x-twilio-signature',
-            headerFormat: 'raw',
-            payloadFormat: 'custom',
-            customConfig: {
-                payloadFormat: '{url}',
-                encoding: 'base64',
-                secretEncoding: 'utf8',
-                validateBodySHA256: true,
-            },
+            ...createStandardWebhooksConfig({
+                id: "webhook-id",
+                timestamp: "webhook-timestamp",
+                signature: "webhook-signature",
+                idAliases: ["svix-id"],
+                timestampAliases: ["svix-timestamp"],
+                signatureAliases: ["svix-signature"],
+            }),
         },
-        description: 'Twilio webhooks use HMAC-SHA1 with base64 signatures (URL canonicalization required)',
+        description: "Canonical Standard Webhooks implementation. Works for any platform using v1= HMAC-SHA256 signing regardless of header names.",
     },
     custom: {
         platform: "custom",

package/dist/types.d.ts

@@ -1,4 +1,4 @@
-export type WebhookPlatform = 'custom' | 'clerk' | 'svix' | 'github' | 'stripe' | 'shopify' | 'vercel' | 'polar' | 'dodopayments' | 'gitlab' | 'paddle' | 'razorpay' | 'lemonsqueezy' | 'workos' | 'woocommerce' | 'replicateai' | 'falai' | 'sentry' | 'grafana' | 'doppler' | 'sanity' | 'linear' | 'pagerduty' | 'twilio' | 'unknown';
+export type WebhookPlatform = "custom" | "clerk" | "svix" | "github" | "stripe" | "shopify" | "vercel" | "polar" | "dodopayments" | "gitlab" | "paddle" | "razorpay" | "lemonsqueezy" | "workos" | "woocommerce" | "replicateai" | "falai" | "sentry" | "grafana" | "doppler" | "sanity" | "linear" | "standardwebhooks" | "unknown";
 export declare enum WebhookPlatformKeys {
     GitHub = "github",
     Stripe = "stripe",
@@ -21,24 +21,23 @@ export declare enum WebhookPlatformKeys {
     Doppler = "doppler",
     Sanity = "sanity",
     Linear = "linear",
-    PagerDuty = "pagerduty",
-    Twilio = "twilio",
+    StandardWebhooks = "standardwebhooks",
     Custom = "custom",
     Unknown = "unknown"
 }
-export type SignatureAlgorithm = 'hmac-sha256' | 'hmac-sha1' | 'hmac-sha512' | 'rsa-sha256' | 'ed25519' | 'custom';
+export type SignatureAlgorithm = "hmac-sha256" | "hmac-sha1" | "hmac-sha512" | "rsa-sha256" | "ed25519" | "custom";
 export interface SignatureConfig {
     algorithm: SignatureAlgorithm;
     headerName: string;
-    headerFormat?: 'raw' | 'prefixed' | 'comma-separated';
+    headerFormat?: "raw" | "prefixed" | "comma-separated";
     prefix?: string;
     timestampHeader?: string;
-    timestampFormat?: 'unix' | 'iso' | 'custom';
-    payloadFormat?: 'raw' | 'timestamped' | 'json-stringified' | 'custom';
+    timestampFormat?: "unix" | "iso" | "custom";
+    payloadFormat?: "raw" | "timestamped" | "json-stringified" | "custom";
     idHeader?: string;
     customConfig?: Record<string, any>;
 }
-export type WebhookErrorCode = 'MISSING_SIGNATURE' | 'INVALID_SIGNATURE' | 'TIMESTAMP_EXPIRED' | 'MISSING_TOKEN' | 'INVALID_TOKEN' | 'PLATFORM_NOT_SUPPORTED' | 'NORMALIZATION_ERROR' | 'VERIFICATION_ERROR';
+export type WebhookErrorCode = "MISSING_SIGNATURE" | "INVALID_SIGNATURE" | "TIMESTAMP_EXPIRED" | "MISSING_TOKEN" | "INVALID_TOKEN" | "PLATFORM_NOT_SUPPORTED" | "NORMALIZATION_ERROR" | "VERIFICATION_ERROR";
 export interface WebhookVerificationResult<TPayload = unknown> {
     isValid: boolean;
     error?: string;
@@ -57,7 +56,6 @@ export interface WebhookConfig {
     secret: string;
     toleranceInSeconds?: number;
     signatureConfig?: SignatureConfig;
-    twilioBaseUrl?: string;
 }
 export interface MultiPlatformSecrets {
     [platform: string]: string | undefined;

package/dist/types.js

@@ -24,8 +24,7 @@ var WebhookPlatformKeys;
     WebhookPlatformKeys["Doppler"] = "doppler";
     WebhookPlatformKeys["Sanity"] = "sanity";
     WebhookPlatformKeys["Linear"] = "linear";
-    WebhookPlatformKeys["PagerDuty"] = "pagerduty";
-    WebhookPlatformKeys["Twilio"] = "twilio";
+    WebhookPlatformKeys["StandardWebhooks"] = "standardwebhooks";
     WebhookPlatformKeys["Custom"] = "custom";
     WebhookPlatformKeys["Unknown"] = "unknown";
 })(WebhookPlatformKeys || (exports.WebhookPlatformKeys = WebhookPlatformKeys = {}));

package/dist/verifiers/algorithms.d.ts

@@ -15,7 +15,6 @@ export declare abstract class AlgorithmBasedVerifier extends WebhookVerifier {
     protected extractTimestamp(request: Request): number | null;
     protected extractTimestampFromSignature(request: Request): number | null;
     protected requiresTimestamp(): boolean;
-    protected resolveTwilioSignatureUrl(request: Request): string;
     protected formatPayload(rawBody: string, request: Request): string;
     protected formatCustomPayload(rawBody: string, request: Request): string;
     protected verifyHMAC(payload: string, signature: string, algorithm?: string): boolean;
@@ -25,7 +24,6 @@ export declare abstract class AlgorithmBasedVerifier extends WebhookVerifier {
 }
 export declare class GenericHMACVerifier extends AlgorithmBasedVerifier {
     private validateLinearReplayWindow;
-    private validateTwilioBodyHash;
     private resolveSentryPayloadCandidates;
     verify(request: Request): Promise<WebhookVerificationResult>;
 }

package/dist/verifiers/algorithms.js

@@ -26,20 +26,17 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
     getInvalidSignatureMessage() {
         const genericHint = `Invalid signature for ${this.platform}. Confirm webhook secret, raw request body handling, and signature header formatting.`;
         switch (this.platform) {
-            case 'twilio':
-                return `${genericHint} Twilio also requires the exact public URL used for signing (including query params like bodySHA256). Use twilioBaseUrl if your runtime URL is rewritten behind a proxy.`;
             case 'stripe':
                 return `${genericHint} Stripe signatures require the exact raw body and Stripe-Signature timestamp/value pair.`;
             case 'github':
                 return `${genericHint} GitHub signatures must include the sha256= prefix from x-hub-signature-256.`;
             case 'svix':
+            case 'standardwebhooks':
             case 'clerk':
             case 'dodopayments':
             case 'replicateai':
             case 'polar':
                 return `${genericHint} Standard Webhooks payload must be signed as id.timestamp.body and secrets may need whsec_ base64 decoding.`;
-            case 'pagerduty':
-                return `${genericHint} PagerDuty expects v1=<hex> signature values from x-pagerduty-signature.`;
             default:
                 return genericHint;
         }
@@ -66,7 +63,9 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
         return values;
     }
     extractSignatures(request) {
-        const headerValue = request.headers.get(this.config.headerName);
+        const headerValue = request.headers.get(this.config.headerName)
+            || this.config.customConfig?.signatureHeaderAliases?.map((alias) => request.headers.get(alias)).find(Boolean)
+            || null;
         if (!headerValue)
             return [];
         switch (this.config.headerFormat) {
@@ -169,7 +168,7 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
             return true;
         // These platforms have timestampHeader in config but timestamp
         // is optional in their spec — validate only if present, never mandate
-        const optionalTimestampPlatforms = ['vercel', 'sentry', 'grafana', 'twilio'];
+        const optionalTimestampPlatforms = ['vercel', 'sentry', 'grafana'];
         if (optionalTimestampPlatforms.includes(this.platform))
             return false;
         // For all other platforms: infer from config
@@ -186,16 +185,6 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
             return true;
         return false;
     }
-    resolveTwilioSignatureUrl(request) {
-        const overrideBaseUrl = this.config.customConfig?.twilioBaseUrl;
-        if (!overrideBaseUrl) {
-            return request.url;
-        }
-        const requestUrl = new URL(request.url);
-        const baseUrl = new URL(overrideBaseUrl);
-        baseUrl.search = requestUrl.search;
-        return baseUrl.toString();
-    }
     formatPayload(rawBody, request) {
         switch (this.config.payloadFormat) {
             case "timestamped": {
@@ -226,7 +215,7 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
             const id = request.headers.get(this.config.customConfig.idHeader || "x-webhook-id") || this.config.customConfig?.idHeaderAliases?.map((alias) => request.headers.get(alias)).find(Boolean);
             const timestamp = request.headers.get(this.config.timestampHeader ||
                 this.config.customConfig?.timestampHeader ||
-                "x-webhook-timestamp");
+                "x-webhook-timestamp") || this.config.customConfig?.timestampHeaderAliases?.map((alias) => request.headers.get(alias)).find(Boolean);
             // if either is missing payload will be malformed — fail explicitly
             if (!id || !timestamp) {
                 throw new Error(`Missing required headers for payload construction: ${!id ? this.config.customConfig.idHeader || "x-webhook-id" : ""} ${!timestamp
@@ -240,7 +229,7 @@ class AlgorithmBasedVerifier extends base_1.WebhookVerifier {
         }
         if (customFormat.includes('{url}')) {
             return customFormat
-                .replace('{url}', this.platform === 'twilio' ? this.resolveTwilioSignatureUrl(request) : request.url)
+                .replace('{url}', request.url)
                 .replace('{body}', rawBody);
         }
         if (customFormat.includes("{timestamp}") &&
@@ -346,20 +335,6 @@ class GenericHMACVerifier extends AlgorithmBasedVerifier {
         }
         return null;
     }
-    validateTwilioBodyHash(rawBody, request) {
-        if (this.platform !== 'twilio' || !this.config.customConfig?.validateBodySHA256) {
-            return null;
-        }
-        const url = new URL(this.resolveTwilioSignatureUrl(request));
-        const bodySha = url.searchParams.get('bodySHA256');
-        if (!bodySha)
-            return null;
-        const computed = (0, crypto_1.createHash)('sha256').update(rawBody).digest('hex');
-        if (!this.safeCompare(computed, bodySha)) {
-            return 'Twilio bodySHA256 query param does not match payload hash';
-        }
-        return null;
-    }
     resolveSentryPayloadCandidates(rawBody, request) {
         const candidates = [
             this.formatPayload(rawBody, request),
@@ -408,15 +383,6 @@ class GenericHMACVerifier extends AlgorithmBasedVerifier {
                     platform: this.platform,
                 };
             }
-            const twilioBodyHashError = this.validateTwilioBodyHash(rawBody, request);
-            if (twilioBodyHashError) {
-                return {
-                    isValid: false,
-                    error: twilioBodyHashError,
-                    errorCode: 'INVALID_SIGNATURE',
-                    platform: this.platform,
-                };
-            }
             let timestamp = null;
             if (this.config.headerFormat === "comma-separated") {
                 timestamp = this.extractTimestampFromSignature(request);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hookflo/tern",
-  "version": "4.3.3-beta",
+  "version": "4.4.3",
   "description": "A robust, scalable webhook verification framework supporting multiple platforms and signature algorithms",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",