@aiacta-org/ai-citation-sdk 1.0.9 → 1.0.11

package/README.md

@@ -88,8 +88,8 @@ app.post('/webhooks/ai-citations', express.raw({ type: 'application/json' }), as
   try {
     const valid = verifyWebhookSignature(
       req.body,                                    // raw Buffer
-      req.headers['x-ai-webhook-timestamp'],       // UNIX seconds string
-      req.headers['x-ai-webhook-sig'],             // 'sha256=<hex>'
+      req.headers['x-aiacta-webhook-timestamp'],       // UNIX seconds string
+      req.headers['x-aiacta-webhook-signature'],             // 'sha256=<hex>'
       process.env.WEBHOOK_SECRET
     );
     if (!valid) return res.status(401).json({ error: 'Invalid signature' });
@@ -114,8 +114,8 @@ from aiacta import verify_webhook_signature
 @app.route('/webhooks/ai-citations', methods=['POST'])
 def citation_webhook():
     raw_body  = request.get_data()
-    timestamp = request.headers.get('X-AI-Webhook-Timestamp')
-    sig       = request.headers.get('X-AI-Webhook-Sig')
+    timestamp = request.headers.get('X-AIACTA-Webhook-Timestamp')
+    sig       = request.headers.get('X-AIACTA-Webhook-Signature')
     secret    = os.environ['WEBHOOK_SECRET']
 
     try:
@@ -138,8 +138,8 @@ import "github.com/aiacta-org/aiacta/ai-citation-sdk"
 
 func webhookHandler(w http.ResponseWriter, r *http.Request) {
     body, _ := io.ReadAll(r.Body)
-    timestamp := r.Header.Get("X-AI-Webhook-Timestamp")
-    sig       := r.Header.Get("X-AI-Webhook-Sig")
+    timestamp := r.Header.Get("X-AIACTA-Webhook-Timestamp")
+    sig       := r.Header.Get("X-AIACTA-Webhook-Signature")
     secret    := os.Getenv("WEBHOOK_SECRET")
 
     ok, err := aiacta.VerifyWebhookSignature(body, timestamp, sig, secret)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiacta-org/ai-citation-sdk",
-  "version": "1.0.9",
+  "version": "1.0.11",
   "description": "Webhook receiver SDK for AIACTA citation events. HMAC-SHA256 signature verification, idempotency, and Express middleware (AIACTA Proposal 2, §3.4)",
   "author": "Eric Michel",
   "license": "Apache-2.0",

package/src/go/aiacta.go

@@ -56,7 +56,7 @@ type Attribution struct {
 	UserInterface string `json:"user_interface"`
 }
 
-// VerifyWebhookSignature validates an X-AI-Webhook-Sig header.
+// VerifyWebhookSignature validates an X-AIACTA-Webhook-Signature header.
 //
 // The signature covers the string "${timestamp}.${rawBody}" using HMAC-SHA256
 // with the shared secret issued at enrollment (§3.4A).

package/src/node/middleware.js

@@ -10,8 +10,8 @@ const { processEvent }           = require('./processor');
 
 function createExpressMiddleware({ secret, store, onEvent }) {
   return async (req, res) => {
-    const timestamp = req.headers['x-ai-webhook-timestamp'];
-    const sig       = req.headers['x-ai-webhook-sig'];
+    const timestamp = req.headers['x-aiacta-webhook-timestamp'];
+    const sig       = req.headers['x-aiacta-webhook-signature'];
     // Body must be raw Buffer — use express.raw() before this middleware
     try {
       const valid = verifyWebhookSignature(req.body, timestamp, sig, secret);

package/src/node/signature.js

@@ -9,8 +9,8 @@ const TIMESTAMP_TOLERANCE_SECONDS = 300; // 5 minutes (§3.4)
 
 /**
  * @param {string|Buffer} payload  Raw request body
- * @param {string} timestamp       Value of X-AI-Webhook-Timestamp header
- * @param {string} sigHeader       Value of X-AI-Webhook-Sig header (sha256=<hex>)
+ * @param {string} timestamp       Value of X-AIACTA-Webhook-Timestamp header
+ * @param {string} sigHeader       Value of X-AIACTA-Webhook-Signature header (sha256=<hex>)
  * @param {string} secret          Shared HMAC secret issued at enrollment
  * @returns {boolean}
  * @throws {Error} if timestamp is outside tolerance window

package/src/node/timestamp.js

@@ -4,7 +4,7 @@
  * §3.2 specifies "minute precision only" for event timestamps to prevent
  * timing attacks that could re-identify users.
  *
- * Implementation note: the X-AI-Webhook-Timestamp header used for HMAC
+ * Implementation note: the X-AIACTA-Webhook-Timestamp header used for HMAC
  * signing (§3.4) remains at UNIX second precision — this is the
  * cryptographic nonce that prevents replay attacks. The event.timestamp
  * field inside the JSON payload is truncated to minute precision.

package/src/python/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name='ai-citation-sdk',
-    version='1.0.9',
+    version='1.0.11',
     description='AIACTA Citation Webhook SDK for Python — signature verification, idempotency, and retry handling (Proposal 2, §3.4)',
     long_description=open('../../README.md', encoding='utf-8').read() if __import__('os').path.exists('../../README.md') else '',
     long_description_content_type='text/markdown',