hono-webhooks 0.2.0 → 0.3.0

package/README.md

@@ -179,10 +179,11 @@ Malformed JSON is a `400` with `issues: [{ message: 'Malformed JSON' }]`.
 
 ## Signature verification
 
-`verify` runs after the params, query and headers are validated but **before
-the body is parsed**, on the raw body. A request with a bad signature never
-reaches JSON parsing or the body schema, so signed webhooks can use `body`
-like any other webhook:
+`verify` runs on the raw body **right after routing, before anything is
+validated or parsed**. A request with a bad signature gets a 401 and never
+reaches the params, query, headers or body schemas, so unauthenticated
+callers never see a description of your schemas. Signed webhooks can use
+`headers` and `body` schemas like any other webhook:
 
 ```ts
 import { shopify } from 'hono-webhooks/signatures'
@@ -211,14 +212,15 @@ When `verify` returns `false`, the answer is
 | `github`                                | `x-hub-signature-256: sha256=<hex>`     | body                |
 | `shopify`                               | `x-shopify-hmac-sha256: <base64>`       | body                |
 | `stripe`                                | `stripe-signature: t=<unix>,v1=<hex>`   | `<t>.<body>`        |
+| `svix` (Resend, Clerk, Standard Webhooks) | `svix-id`, `svix-timestamp`, `svix-signature: v1,<base64> ...` (or `webhook-*`) | `<id>.<timestamp>.<body>`, key from `whsec_<base64>` |
 | `hmac({ header, encoding, prefix?, hash? })` | any header, hex or base64, SHA-1/256/512 | body          |
 
 - `scheme.verify(secret)` gives a `verify` function. `secret` is a string or
   `(c) => string | Promise<string>`, so it can come from `c.env`. An empty
   secret throws (a 500), instead of silently accepting or rejecting everything.
-- `stripe.verify(secret, { toleranceSeconds })` also rejects timestamps more
-  than 300 seconds away by default, and accepts any matching `v1` so secret
-  rotation works.
+- `stripe.verify(secret, { toleranceSeconds })` and `svix.verify(...)` also
+  reject timestamps more than 300 seconds away by default, and accept any
+  matching `v1` so secret rotation works.
 - `scheme.sign(rawBody, secret)` returns the headers the provider would send,
   for tests and the CLI.
 - Signatures are compared with `crypto.subtle.verify`, which runs in constant
@@ -386,7 +388,7 @@ summarizeEvent(event)
 //   ip: '203.0.113.9',               // x-forwarded-for, x-real-ip or cf-connecting-ip
 //   userAgent: 'Shopify-Captain-Hook',
 //   params: { id: '42' }, query: {}, body: null, response: null,
-//   error: null,                     // or { name, message, stack }
+//   error: null,                     // or { name, message, stack }; null when validation is set
 //   validation: {
 //     target: 'body',
 //     message: 'total: Expected number',
@@ -486,6 +488,27 @@ export const githubPush = defineWebhook(
 )
 ```
 
+### Resend (Svix) events
+
+```ts
+import { svix } from 'hono-webhooks/signatures'
+
+export const resendEvents = defineWebhook(
+	{
+		method: 'POST',
+		path: '/resend',
+		verify: svix.verify((c) => c.env.RESEND_WEBHOOK_SECRET), // whsec_...
+		body: z.object({
+			type: z.string(),
+			data: z.object({ email_id: z.string() })
+		})
+	},
+	({ body }) => {
+		if (body.type === 'email.bounced') markBounced(body.data.email_id)
+	}
+)
+```
+
 ### Twilio form posts
 
 ```ts
@@ -691,7 +714,7 @@ Options for test:
   -b, --body <text>         Request body (JSON sets content-type: application/json)
   -q, --query <params>      Query string, e.g. "a=1&b=2"
   -H, --header <k: v>       Request header, repeatable
-  -s, --sign <scheme>       Sign the body: github, shopify, stripe
+  -s, --sign <scheme>       Sign the body: github, shopify, stripe, svix
   -e, --secret-env <name>   Environment variable holding the signing secret
 ```
 
@@ -712,14 +735,19 @@ bunx hono-webhooks ./src/webhooks/index.ts test POST /shopify/orders -b '{"id":1
 - `test` sends a real request through the webhooks app (without the parent
   app's middleware) and exits with code 1 on a 4xx or 5xx response.
 - `--preload` imports modules in order, before the webhooks module. It takes
-  a file path or a package name, and works the same under Bun and Node.
+  a file path or a package name.
 - `--sign` signs the exact `--body` with the secret read from the environment
   variable named by `--secret-env`, after preloading, so a preloaded module
   can set it.
 - `schema` prints the JSON Schemas from
   [`describeWebhooks`](#describing-webhooks).
-- The CLI imports your TypeScript file. That works under Bun, and under Node
-  22.18+ which strips types natively.
+- The CLI imports your TypeScript file. `bunx hono-webhooks` starts the CLI
+  under Node (its shebang is `node`), and Node 22.18+ can load plain
+  TypeScript. It can't load everything Bun can, such as extensionless
+  imports (`import { x } from './x'`). When Node fails to load your module
+  and Bun is installed, the CLI reruns the same command under Bun
+  automatically. To skip the failed Node attempt in a Bun project, run
+  `bunx --bun hono-webhooks ...`.
 
 ## API reference
 
@@ -738,7 +766,8 @@ import {
 import {
 	github,
 	shopify,
-	stripe, // each: .verify(secret, options?) and .sign(rawBody, secret, options?)
+	stripe,
+	svix, // each: .verify(secret, options?) and .sign(rawBody, secret, options?)
 	hmac // (options) => a scheme like the ones above
 } from 'hono-webhooks/signatures'
 

package/dist/cli.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
+import { spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -126,9 +127,6 @@ function makeCreateWebhooks() {
     const ordered = [...webhooks].sort((a, b) => Number(isDynamic(a.config.path)) - Number(isDynamic(b.config.path)));
     for (const { config, handler } of ordered) {
       app.on(config.method, config.path, handle(config.path, async (c, event) => {
-        event.params = await parse(config.params, c.req.param(), "params");
-        event.query = await parse(config.query, c.req.query(), "query");
-        event.headers = await parse(config.headers, c.req.header(), "headers");
         event.rawBody = await c.req.text();
         if (config.verify && !await config.verify({
           c,
@@ -139,6 +137,9 @@ function makeCreateWebhooks() {
             { message: "Signature does not match" }
           ]);
         }
+        event.params = await parse(config.params, c.req.param(), "params");
+        event.query = await parse(config.query, c.req.query(), "query");
+        event.headers = await parse(config.headers, c.req.header(), "headers");
         event.body = await parse(config.body, parseBody(event.rawBody, config.bodyType ?? "auto", c.req.header("content-type")), "body");
         const result = await handler({
           c,
@@ -213,7 +214,7 @@ function summarizeEvent(event) {
     query: event.query ?? null,
     body: event.body ?? null,
     response: event.response ?? null,
-    error: error === undefined ? null : error instanceof Error ? {
+    error: error === undefined || error instanceof WebhookValidationError ? null : error instanceof Error ? {
       name: error.name,
       message: error.message,
       stack: error.stack ?? null
@@ -290,9 +291,10 @@ async function testWebhook(webhook, input = {}) {
 // src/signatures.ts
 var encoder = new TextEncoder;
 function hmacKey(secret, hash) {
-  if (!secret)
+  if (!secret.length) {
     throw new Error("hono-webhooks: the signing secret is empty");
-  return crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash }, false, ["sign", "verify"]);
+  }
+  return crypto.subtle.importKey("raw", typeof secret === "string" ? encoder.encode(secret) : secret, { name: "HMAC", hash }, false, ["sign", "verify"]);
 }
 async function hmacSign(secret, payload, hash = "SHA-256") {
   const key = await hmacKey(secret, hash);
@@ -372,12 +374,52 @@ var stripe = {
     return { "stripe-signature": `t=${t},v1=${toHex(signature)}` };
   }
 };
+function svixKey(secret) {
+  const key = fromBase64(secret.replace(/^whsec_/, ""));
+  if (!key?.length) {
+    throw new Error("hono-webhooks: the Svix secret must be whsec_<base64>");
+  }
+  return key;
+}
+var svix = {
+  verify: (secret, { toleranceSeconds = 300 } = {}) => async ({ c, rawBody, headers }) => {
+    const prefix = headers["svix-id"] ? "svix" : "webhook";
+    const id = headers[`${prefix}-id`];
+    const timestamp = headers[`${prefix}-timestamp`] ?? "";
+    const signatures = headers[`${prefix}-signature`];
+    if (!id || !signatures || !/^\d+$/.test(timestamp))
+      return false;
+    if (Math.abs(Date.now() / 1000 - Number(timestamp)) > toleranceSeconds) {
+      return false;
+    }
+    const key = svixKey(await resolveSecret(secret, c));
+    for (const entry of signatures.split(" ")) {
+      const [version, encoded] = entry.split(",");
+      const signature = version === "v1" && encoded ? fromBase64(encoded) : undefined;
+      if (signature && await hmacVerify(key, `${id}.${timestamp}.${rawBody}`, signature)) {
+        return true;
+      }
+    }
+    return false;
+  },
+  async sign(rawBody, secret, { id, timestamp } = {}) {
+    const msgId = id ?? `msg_${crypto.randomUUID().replaceAll("-", "")}`;
+    const t = timestamp ?? Math.floor(Date.now() / 1000);
+    const signature = await hmacSign(svixKey(secret), `${msgId}.${t}.${rawBody}`);
+    return {
+      "svix-id": msgId,
+      "svix-timestamp": String(t),
+      "svix-signature": `v1,${toBase64(signature)}`
+    };
+  }
+};
 
 // src/cli.ts
 var schemes = {
   github,
   shopify,
-  stripe
+  stripe,
+  svix
 };
 var HELP = `Usage: hono-webhooks <module> <command> [options]
 
@@ -441,6 +483,24 @@ async function loadApp(path) {
     return createWebhooks(webhooks);
   return fail(`${path} exports neither a createWebhooks() app nor an array of webhooks`);
 }
+var BUN_ONLY_ERRORS = new Set([
+  "ERR_MODULE_NOT_FOUND",
+  "ERR_UNKNOWN_FILE_EXTENSION",
+  "ERR_UNSUPPORTED_DIR_IMPORT",
+  "ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX",
+  "ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING"
+]);
+function rerunUnderBun(error) {
+  const code = error.code;
+  if (process.versions.bun || !code || !BUN_ONLY_ERRORS.has(code))
+    throw error;
+  console.error(`Node can't load the module (${code}), trying Bun`);
+  const run = spawnSync("bun", process.argv.slice(1), { stdio: "inherit" });
+  if (run.error) {
+    fail("Bun is not installed either. Run the CLI with a runtime that can load your code, e.g. bunx --bun hono-webhooks ...");
+  }
+  process.exit(run.status ?? 1);
+}
 async function signatureHeaders(rawBody) {
   if (!values.sign)
     return {};
@@ -454,9 +514,14 @@ async function main() {
     console.log(HELP);
     return;
   }
-  for (const preload of values.preload ?? [])
-    await importModule(preload);
-  const app = await loadApp(modulePath);
+  let app;
+  try {
+    for (const preload of values.preload ?? [])
+      await importModule(preload);
+    app = await loadApp(modulePath);
+  } catch (error) {
+    rerunUnderBun(error);
+  }
   if (command === "list") {
     for (const { config } of app.webhooks) {
       const validates = [

package/dist/index.d.ts

@@ -48,8 +48,8 @@ export interface WebhookConfig<P extends string = string, TParams extends Schema
     headers?: THeaders;
     body?: TBody;
     /**
-     * Checks the signature before the body is parsed or validated. Returning
-     * `false` answers `401 { error: 'Invalid signature' }`.
+     * Checks the signature right after routing, before anything is validated
+     * or parsed. Returning `false` answers `401 { error: 'Invalid signature' }`.
      *
      * @example verify: shopify.verify((c) => c.env.SHOPIFY_SECRET)
      */
@@ -215,6 +215,7 @@ export interface WebhookEventSummary {
     query: Record<string, unknown> | null;
     body: unknown;
     response: unknown;
+    /** `null` for validation failures, which `validation` describes. */
     error: {
         name: string;
         message: string;

package/dist/index.js

@@ -118,9 +118,6 @@ function makeCreateWebhooks() {
     const ordered = [...webhooks].sort((a, b) => Number(isDynamic(a.config.path)) - Number(isDynamic(b.config.path)));
     for (const { config, handler } of ordered) {
       app.on(config.method, config.path, handle(config.path, async (c, event) => {
-        event.params = await parse(config.params, c.req.param(), "params");
-        event.query = await parse(config.query, c.req.query(), "query");
-        event.headers = await parse(config.headers, c.req.header(), "headers");
         event.rawBody = await c.req.text();
         if (config.verify && !await config.verify({
           c,
@@ -131,6 +128,9 @@ function makeCreateWebhooks() {
             { message: "Signature does not match" }
           ]);
         }
+        event.params = await parse(config.params, c.req.param(), "params");
+        event.query = await parse(config.query, c.req.query(), "query");
+        event.headers = await parse(config.headers, c.req.header(), "headers");
         event.body = await parse(config.body, parseBody(event.rawBody, config.bodyType ?? "auto", c.req.header("content-type")), "body");
         const result = await handler({
           c,
@@ -205,7 +205,7 @@ function summarizeEvent(event) {
     query: event.query ?? null,
     body: event.body ?? null,
     response: event.response ?? null,
-    error: error === undefined ? null : error instanceof Error ? {
+    error: error === undefined || error instanceof WebhookValidationError ? null : error instanceof Error ? {
       name: error.name,
       message: error.message,
       stack: error.stack ?? null

package/dist/signatures.d.ts

@@ -38,3 +38,16 @@ export declare const stripe: SignatureScheme<{
 }, {
     timestamp?: number;
 }>;
+/**
+ * Svix and Standard Webhooks (Resend, Clerk, ...): `svix-id`,
+ * `svix-timestamp` and `svix-signature: v1,<base64> v1,<base64>`, signed over
+ * `<id>.<timestamp>.<body>` with the base64 key in a `whsec_` secret. The
+ * `webhook-*` header names of Standard Webhooks work too. Rejects timestamps
+ * more than `toleranceSeconds` (default 300) away.
+ */
+export declare const svix: SignatureScheme<{
+    toleranceSeconds?: number;
+}, {
+    id?: string;
+    timestamp?: number;
+}>;

package/dist/signatures.js

@@ -1,9 +1,10 @@
 // src/signatures.ts
 var encoder = new TextEncoder;
 function hmacKey(secret, hash) {
-  if (!secret)
+  if (!secret.length) {
     throw new Error("hono-webhooks: the signing secret is empty");
-  return crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash }, false, ["sign", "verify"]);
+  }
+  return crypto.subtle.importKey("raw", typeof secret === "string" ? encoder.encode(secret) : secret, { name: "HMAC", hash }, false, ["sign", "verify"]);
 }
 async function hmacSign(secret, payload, hash = "SHA-256") {
   const key = await hmacKey(secret, hash);
@@ -83,9 +84,49 @@ var stripe = {
     return { "stripe-signature": `t=${t},v1=${toHex(signature)}` };
   }
 };
+function svixKey(secret) {
+  const key = fromBase64(secret.replace(/^whsec_/, ""));
+  if (!key?.length) {
+    throw new Error("hono-webhooks: the Svix secret must be whsec_<base64>");
+  }
+  return key;
+}
+var svix = {
+  verify: (secret, { toleranceSeconds = 300 } = {}) => async ({ c, rawBody, headers }) => {
+    const prefix = headers["svix-id"] ? "svix" : "webhook";
+    const id = headers[`${prefix}-id`];
+    const timestamp = headers[`${prefix}-timestamp`] ?? "";
+    const signatures = headers[`${prefix}-signature`];
+    if (!id || !signatures || !/^\d+$/.test(timestamp))
+      return false;
+    if (Math.abs(Date.now() / 1000 - Number(timestamp)) > toleranceSeconds) {
+      return false;
+    }
+    const key = svixKey(await resolveSecret(secret, c));
+    for (const entry of signatures.split(" ")) {
+      const [version, encoded] = entry.split(",");
+      const signature = version === "v1" && encoded ? fromBase64(encoded) : undefined;
+      if (signature && await hmacVerify(key, `${id}.${timestamp}.${rawBody}`, signature)) {
+        return true;
+      }
+    }
+    return false;
+  },
+  async sign(rawBody, secret, { id, timestamp } = {}) {
+    const msgId = id ?? `msg_${crypto.randomUUID().replaceAll("-", "")}`;
+    const t = timestamp ?? Math.floor(Date.now() / 1000);
+    const signature = await hmacSign(svixKey(secret), `${msgId}.${t}.${rawBody}`);
+    return {
+      "svix-id": msgId,
+      "svix-timestamp": String(t),
+      "svix-signature": `v1,${toBase64(signature)}`
+    };
+  }
+};
 export {
   github,
   hmac,
   shopify,
-  stripe
+  stripe,
+  svix
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hono-webhooks",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Type-safe webhook routes for Hono, validated with any Standard Schema library (Zod, Valibot, ArkType)",
   "type": "module",
   "main": "./dist/index.js",

package/src/cli.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { spawnSync } from 'node:child_process'
 import { existsSync } from 'node:fs'
 import { resolve } from 'node:path'
 import { pathToFileURL } from 'node:url'
@@ -9,12 +10,19 @@ import {
 	type Webhook,
 	type WebhooksApp
 } from './index'
-import { github, type SignatureScheme, shopify, stripe } from './signatures'
+import {
+	github,
+	type SignatureScheme,
+	shopify,
+	stripe,
+	svix
+} from './signatures'
 
 const schemes: Record<string, SignatureScheme<any, any>> = {
 	github,
 	shopify,
-	stripe
+	stripe,
+	svix
 }
 
 const HELP = `Usage: hono-webhooks <module> <command> [options]
@@ -106,6 +114,32 @@ async function loadApp(path: string): Promise<WebhooksApp> {
 	)
 }
 
+/** Errors Node gives for TypeScript it can't load but Bun can. */
+const BUN_ONLY_ERRORS = new Set([
+	'ERR_MODULE_NOT_FOUND',
+	'ERR_UNKNOWN_FILE_EXTENSION',
+	'ERR_UNSUPPORTED_DIR_IMPORT',
+	'ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX',
+	'ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING'
+])
+
+/**
+ * Under Node, a Bun project's TypeScript (extensionless imports, for one)
+ * fails to load. Rerun the same command under Bun when it is installed.
+ */
+function rerunUnderBun(error: unknown): never {
+	const code = (error as { code?: string }).code
+	if (process.versions.bun || !code || !BUN_ONLY_ERRORS.has(code)) throw error
+	console.error(`Node can't load the module (${code}), trying Bun`)
+	const run = spawnSync('bun', process.argv.slice(1), { stdio: 'inherit' })
+	if (run.error) {
+		fail(
+			'Bun is not installed either. Run the CLI with a runtime that can load your code, e.g. bunx --bun hono-webhooks ...'
+		)
+	}
+	process.exit(run.status ?? 1)
+}
+
 async function signatureHeaders(rawBody: string) {
 	if (!values.sign) return {}
 	const scheme =
@@ -123,8 +157,13 @@ async function main() {
 		console.log(HELP)
 		return
 	}
-	for (const preload of values.preload ?? []) await importModule(preload)
-	const app = await loadApp(modulePath)
+	let app: WebhooksApp
+	try {
+		for (const preload of values.preload ?? []) await importModule(preload)
+		app = await loadApp(modulePath)
+	} catch (error) {
+		rerunUnderBun(error)
+	}
 
 	if (command === 'list') {
 		for (const { config } of app.webhooks) {

package/src/index.ts

@@ -92,8 +92,8 @@ export interface WebhookConfig<
 	headers?: THeaders
 	body?: TBody
 	/**
-	 * Checks the signature before the body is parsed or validated. Returning
-	 * `false` answers `401 { error: 'Invalid signature' }`.
+	 * Checks the signature right after routing, before anything is validated
+	 * or parsed. Returning `false` answers `401 { error: 'Invalid signature' }`.
 	 *
 	 * @example verify: shopify.verify((c) => c.env.SHOPIFY_SECRET)
 	 */
@@ -392,6 +392,21 @@ function makeCreateWebhooks<E extends Env>() {
 				config.method,
 				config.path,
 				handle(config.path, async (c, event) => {
+					// The signature is checked first, so unauthenticated callers only
+					// ever see 401, never a description of the schemas.
+					event.rawBody = await c.req.text()
+					if (
+						config.verify &&
+						!(await config.verify({
+							c,
+							rawBody: event.rawBody,
+							headers: c.req.header()
+						}))
+					) {
+						throw new WebhookValidationError('signature', [
+							{ message: 'Signature does not match' }
+						])
+					}
 					type Parts = Record<string, unknown>
 					event.params = (await parse(
 						config.params,
@@ -408,19 +423,6 @@ function makeCreateWebhooks<E extends Env>() {
 						c.req.header(),
 						'headers'
 					)) as Parts
-					event.rawBody = await c.req.text()
-					if (
-						config.verify &&
-						!(await config.verify({
-							c,
-							rawBody: event.rawBody,
-							headers: c.req.header()
-						}))
-					) {
-						throw new WebhookValidationError('signature', [
-							{ message: 'Signature does not match' }
-						])
-					}
 					event.body = await parse(
 						config.body,
 						parseBody(
@@ -555,6 +557,7 @@ export interface WebhookEventSummary {
 	query: Record<string, unknown> | null
 	body: unknown
 	response: unknown
+	/** `null` for validation failures, which `validation` describes. */
 	error: { name: string; message: string; stack: string | null } | null
 	validation: {
 		target: ValidationTarget
@@ -589,8 +592,10 @@ export function summarizeEvent(event: WebhookEvent): WebhookEventSummary {
 		query: event.query ?? null,
 		body: event.body ?? null,
 		response: event.response ?? null,
+		// A validation failure is described by `validation`; its error adds only
+		// a library stack trace.
 		error:
-			error === undefined
+			error === undefined || error instanceof WebhookValidationError
 				? null
 				: error instanceof Error
 					? {

package/src/signatures.ts

@@ -27,18 +27,27 @@ export interface HmacOptions {
 
 const encoder = new TextEncoder()
 
-function hmacKey(secret: string, hash: string) {
-	if (!secret) throw new Error('hono-webhooks: the signing secret is empty')
+/** A string secret is used as UTF-8; bytes are used as is. */
+function hmacKey(secret: string | Uint8Array, hash: string) {
+	if (!secret.length) {
+		throw new Error('hono-webhooks: the signing secret is empty')
+	}
 	return crypto.subtle.importKey(
 		'raw',
-		encoder.encode(secret),
+		(typeof secret === 'string'
+			? encoder.encode(secret)
+			: secret) as Uint8Array<ArrayBuffer>,
 		{ name: 'HMAC', hash },
 		false,
 		['sign', 'verify']
 	)
 }
 
-async function hmacSign(secret: string, payload: string, hash = 'SHA-256') {
+async function hmacSign(
+	secret: string | Uint8Array,
+	payload: string,
+	hash = 'SHA-256'
+) {
 	const key = await hmacKey(secret, hash)
 	return new Uint8Array(
 		await crypto.subtle.sign('HMAC', key, encoder.encode(payload))
@@ -47,7 +56,7 @@ async function hmacSign(secret: string, payload: string, hash = 'SHA-256') {
 
 /** `crypto.subtle.verify` compares in constant time. */
 async function hmacVerify(
-	secret: string,
+	secret: string | Uint8Array,
 	payload: string,
 	signature: Uint8Array,
 	hash = 'SHA-256'
@@ -169,3 +178,63 @@ export const stripe: SignatureScheme<
 		return { 'stripe-signature': `t=${t},v1=${toHex(signature)}` }
 	}
 }
+
+/** Svix secrets are `whsec_` followed by the base64 key. */
+function svixKey(secret: string) {
+	const key = fromBase64(secret.replace(/^whsec_/, ''))
+	if (!key?.length) {
+		throw new Error('hono-webhooks: the Svix secret must be whsec_<base64>')
+	}
+	return key
+}
+
+/**
+ * Svix and Standard Webhooks (Resend, Clerk, ...): `svix-id`,
+ * `svix-timestamp` and `svix-signature: v1,<base64> v1,<base64>`, signed over
+ * `<id>.<timestamp>.<body>` with the base64 key in a `whsec_` secret. The
+ * `webhook-*` header names of Standard Webhooks work too. Rejects timestamps
+ * more than `toleranceSeconds` (default 300) away.
+ */
+export const svix: SignatureScheme<
+	{ toleranceSeconds?: number },
+	{ id?: string; timestamp?: number }
+> = {
+	verify:
+		(secret, { toleranceSeconds = 300 } = {}) =>
+		async ({ c, rawBody, headers }) => {
+			const prefix = headers['svix-id'] ? 'svix' : 'webhook'
+			const id = headers[`${prefix}-id`]
+			const timestamp = headers[`${prefix}-timestamp`] ?? ''
+			const signatures = headers[`${prefix}-signature`]
+			if (!id || !signatures || !/^\d+$/.test(timestamp)) return false
+			if (Math.abs(Date.now() / 1000 - Number(timestamp)) > toleranceSeconds) {
+				return false
+			}
+			const key = svixKey(await resolveSecret(secret, c))
+			for (const entry of signatures.split(' ')) {
+				const [version, encoded] = entry.split(',')
+				const signature =
+					version === 'v1' && encoded ? fromBase64(encoded) : undefined
+				if (
+					signature &&
+					(await hmacVerify(key, `${id}.${timestamp}.${rawBody}`, signature))
+				) {
+					return true
+				}
+			}
+			return false
+		},
+	async sign(rawBody, secret, { id, timestamp } = {}) {
+		const msgId = id ?? `msg_${crypto.randomUUID().replaceAll('-', '')}`
+		const t = timestamp ?? Math.floor(Date.now() / 1000)
+		const signature = await hmacSign(
+			svixKey(secret),
+			`${msgId}.${t}.${rawBody}`
+		)
+		return {
+			'svix-id': msgId,
+			'svix-timestamp': String(t),
+			'svix-signature': `v1,${toBase64(signature)}`
+		}
+	}
+}