@astrasyncai/verification-gateway 5.18.1 → 5.20.0

package/dist/webhooks.d.mts

@@ -10,6 +10,13 @@
  *
  * This pattern mirrors Stripe's `Stripe-Signature` to ease adoption.
  *
+ * 5.19.0 — secret rotation: for 24 hours after you rotate the endpoint's
+ * webhook secret, AstraSync also signs with the PREVIOUS secret, sent as a
+ * `v1old` value: `t=<unix-ts>,v1=<hex>,v1old=<hex>`. A delivery verifies when
+ * ANY value matches ANY secret you pass, so pass both while you roll over:
+ * `verifyAstraSyncWebhook(raw, headers, [newSecret, oldSecret])`. Queued
+ * events signed before the rotation still verify on either side.
+ *
  * Usage:
  *   import { verifyAstraSyncWebhook } from '@astrasyncai/verification-gateway/webhooks';
  *
@@ -40,18 +47,24 @@ interface VerifyWebhookResult {
  * @param rawBody - The raw request body as a string (NOT the parsed JSON).
  *                  Use `express.raw({type:'application/json'})` to preserve bytes.
  * @param headers - Incoming request headers (case-insensitive).
- * @param secret  - The merchant's webhook secret from endpoint registration.
+ * @param secret  - The merchant's webhook secret from endpoint registration,
+ *                  or (5.19.0) several — e.g. `[current, previous]` during a
+ *                  rotation. Any secret matching any `v1` / `v1old` value passes.
  * @param options - Optional tolerance overrides.
  * @returns       - `{ok: true}` on success, `{ok: false, reason}` on failure.
  */
-declare function verifyAstraSyncWebhook(rawBody: string, headers: Record<string, string | string[] | undefined>, secret: string, options?: VerifyWebhookOptions): VerifyWebhookResult;
+declare function verifyAstraSyncWebhook(rawBody: string, headers: Record<string, string | string[] | undefined>, secret: string | readonly string[], options?: VerifyWebhookOptions): VerifyWebhookResult;
 /**
  * Server-side companion: produce an `X-AstraSync-Signature` header value for
  * an outbound webhook delivery. Exposed for completeness and for test
  * harnesses that want to verify the verifier; the AstraSync platform itself
  * uses an internal version of the same logic.
  */
-declare function signAstraSyncWebhook(rawBody: string, secret: string, nowMs?: number): {
+declare function signAstraSyncWebhook(rawBody: string, secret: string, nowMs?: number, 
+/** 5.19.0: also sign with the previous secret (rotation) as `v1old`. */
+options?: {
+    previousSecret?: string;
+}): {
     header: string;
     timestamp: number;
 };

package/dist/webhooks.d.ts

@@ -10,6 +10,13 @@
  *
  * This pattern mirrors Stripe's `Stripe-Signature` to ease adoption.
  *
+ * 5.19.0 — secret rotation: for 24 hours after you rotate the endpoint's
+ * webhook secret, AstraSync also signs with the PREVIOUS secret, sent as a
+ * `v1old` value: `t=<unix-ts>,v1=<hex>,v1old=<hex>`. A delivery verifies when
+ * ANY value matches ANY secret you pass, so pass both while you roll over:
+ * `verifyAstraSyncWebhook(raw, headers, [newSecret, oldSecret])`. Queued
+ * events signed before the rotation still verify on either side.
+ *
  * Usage:
  *   import { verifyAstraSyncWebhook } from '@astrasyncai/verification-gateway/webhooks';
  *
@@ -40,18 +47,24 @@ interface VerifyWebhookResult {
  * @param rawBody - The raw request body as a string (NOT the parsed JSON).
  *                  Use `express.raw({type:'application/json'})` to preserve bytes.
  * @param headers - Incoming request headers (case-insensitive).
- * @param secret  - The merchant's webhook secret from endpoint registration.
+ * @param secret  - The merchant's webhook secret from endpoint registration,
+ *                  or (5.19.0) several — e.g. `[current, previous]` during a
+ *                  rotation. Any secret matching any `v1` / `v1old` value passes.
  * @param options - Optional tolerance overrides.
  * @returns       - `{ok: true}` on success, `{ok: false, reason}` on failure.
  */
-declare function verifyAstraSyncWebhook(rawBody: string, headers: Record<string, string | string[] | undefined>, secret: string, options?: VerifyWebhookOptions): VerifyWebhookResult;
+declare function verifyAstraSyncWebhook(rawBody: string, headers: Record<string, string | string[] | undefined>, secret: string | readonly string[], options?: VerifyWebhookOptions): VerifyWebhookResult;
 /**
  * Server-side companion: produce an `X-AstraSync-Signature` header value for
  * an outbound webhook delivery. Exposed for completeness and for test
  * harnesses that want to verify the verifier; the AstraSync platform itself
  * uses an internal version of the same logic.
  */
-declare function signAstraSyncWebhook(rawBody: string, secret: string, nowMs?: number): {
+declare function signAstraSyncWebhook(rawBody: string, secret: string, nowMs?: number, 
+/** 5.19.0: also sign with the previous secret (rotation) as `v1old`. */
+options?: {
+    previousSecret?: string;
+}): {
     header: string;
     timestamp: number;
 };

package/dist/webhooks.js

@@ -27,12 +27,17 @@ module.exports = __toCommonJS(webhooks_exports);
 var import_crypto = require("crypto");
 var DEFAULT_TOLERANCE_SECONDS = 300;
 function parseSignatureHeader(header) {
-  const parts = {};
+  let t;
+  const signatures = [];
   for (const segment of header.split(",")) {
-    const [k, v] = segment.split("=");
-    if (k === "t" || k === "v1") parts[k] = v;
+    const eq = segment.indexOf("=");
+    if (eq < 0) continue;
+    const k = segment.slice(0, eq).trim();
+    const v = segment.slice(eq + 1).trim();
+    if (k === "t") t = v;
+    else if ((k === "v1" || k === "v1old") && v) signatures.push(v);
   }
-  return parts;
+  return { t, signatures };
 }
 function computeHmac(secret, signedPayload) {
   return (0, import_crypto.createHmac)("sha256", secret).update(signedPayload, "utf8").digest("hex");
@@ -44,12 +49,15 @@ function constantTimeEquals(a, b) {
   return (0, import_crypto.timingSafeEqual)(aBuf, bBuf);
 }
 function verifyAstraSyncWebhook(rawBody, headers, secret, options = {}) {
-  if (!secret) return { ok: false, reason: "no_secret_provided" };
+  const secrets = (Array.isArray(secret) ? secret : [secret]).filter(
+    (x) => typeof x === "string" && x.length > 0
+  );
+  if (!secrets.length) return { ok: false, reason: "no_secret_provided" };
   const rawHeader = headers["x-astrasync-signature"] ?? headers["X-Astrasync-Signature"] ?? headers["X-AstraSync-Signature"] ?? headers["X-ASTRASYNC-SIGNATURE"];
   if (!rawHeader) return { ok: false, reason: "missing_signature_header" };
   const headerValue = Array.isArray(rawHeader) ? rawHeader[0] : rawHeader;
-  const { t: timestamp, v1: receivedSignature } = parseSignatureHeader(headerValue);
-  if (!timestamp || !receivedSignature) {
+  const { t: timestamp, signatures } = parseSignatureHeader(headerValue);
+  if (!timestamp || !signatures.length) {
     return { ok: false, reason: "malformed_signature_header" };
   }
   const tolerance = options.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS;
@@ -62,16 +70,19 @@ function verifyAstraSyncWebhook(rawBody, headers, secret, options = {}) {
   if (ageSeconds > tolerance) {
     return { ok: false, reason: "timestamp_outside_tolerance" };
   }
-  const expectedSignature = computeHmac(secret, `${timestamp}.${rawBody}`);
-  if (!constantTimeEquals(expectedSignature, receivedSignature)) {
-    return { ok: false, reason: "signature_mismatch" };
+  for (const key of secrets) {
+    const expectedSignature = computeHmac(key, `${timestamp}.${rawBody}`);
+    if (signatures.some((received) => constantTimeEquals(expectedSignature, received))) {
+      return { ok: true };
+    }
   }
-  return { ok: true };
+  return { ok: false, reason: "signature_mismatch" };
 }
-function signAstraSyncWebhook(rawBody, secret, nowMs = Date.now()) {
+function signAstraSyncWebhook(rawBody, secret, nowMs = Date.now(), options = {}) {
   const timestamp = Math.floor(nowMs / 1e3);
   const v1 = computeHmac(secret, `${timestamp}.${rawBody}`);
-  return { header: `t=${timestamp},v1=${v1}`, timestamp };
+  const old = options.previousSecret ? `,v1old=${computeHmac(options.previousSecret, `${timestamp}.${rawBody}`)}` : "";
+  return { header: `t=${timestamp},v1=${v1}${old}`, timestamp };
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/webhooks.ts"],"sourcesContent":["/**\n * AstraSync webhook signature verification.\n *\n * AstraSync signs every webhook delivery with HMAC-SHA256 over\n * `${unix_timestamp}.${rawBody}` using the merchant's webhook secret\n * (returned ONCE at endpoint registration). The signature is sent in\n * the `X-AstraSync-Signature` header in the form:\n *\n *   X-AstraSync-Signature: t=<unix-ts>,v1=<hex-hmac>\n *\n * This pattern mirrors Stripe's `Stripe-Signature` to ease adoption.\n *\n * Usage:\n *   import { verifyAstraSyncWebhook } from '@astrasyncai/verification-gateway/webhooks';\n *\n *   app.post('/webhooks/astrasync', express.raw({type:'application/json'}), (req, res) => {\n *     const result = verifyAstraSyncWebhook(req.body.toString('utf8'), req.headers, secret);\n *     if (!result.ok) return res.status(401).json({error: result.reason});\n *     // ... process event\n *   });\n */\n\nimport { createHmac, timingSafeEqual } from 'crypto';\n\nexport interface VerifyWebhookOptions {\n  /**\n   * Maximum age (seconds) for the signature timestamp. Older deliveries\n   * are rejected as replays. Default 300 (5 minutes) — matches Stripe.\n   */\n  toleranceSeconds?: number;\n  /**\n   * Override \"now\" for tests. Defaults to Date.now().\n   */\n  nowMs?: number;\n}\n\nexport interface VerifyWebhookResult {\n  ok: boolean;\n  reason?: string;\n}\n\nconst DEFAULT_TOLERANCE_SECONDS = 300;\n\nfunction parseSignatureHeader(header: string): { t?: string; v1?: string } {\n  const parts: { t?: string; v1?: string } = {};\n  for (const segment of header.split(',')) {\n    const [k, v] = segment.split('=');\n    if (k === 't' || k === 'v1') parts[k] = v;\n  }\n  return parts;\n}\n\nfunction computeHmac(secret: string, signedPayload: string): string {\n  return createHmac('sha256', secret).update(signedPayload, 'utf8').digest('hex');\n}\n\nfunction constantTimeEquals(a: string, b: string): boolean {\n  const aBuf = Buffer.from(a, 'utf8');\n  const bBuf = Buffer.from(b, 'utf8');\n  if (aBuf.length !== bBuf.length) return false;\n  return timingSafeEqual(aBuf, bBuf);\n}\n\n/**\n * Verify an AstraSync-issued webhook delivery.\n *\n * @param rawBody - The raw request body as a string (NOT the parsed JSON).\n *                  Use `express.raw({type:'application/json'})` to preserve bytes.\n * @param headers - Incoming request headers (case-insensitive).\n * @param secret  - The merchant's webhook secret from endpoint registration.\n * @param options - Optional tolerance overrides.\n * @returns       - `{ok: true}` on success, `{ok: false, reason}` on failure.\n */\nexport function verifyAstraSyncWebhook(\n  rawBody: string,\n  headers: Record<string, string | string[] | undefined>,\n  secret: string,\n  options: VerifyWebhookOptions = {}\n): VerifyWebhookResult {\n  if (!secret) return { ok: false, reason: 'no_secret_provided' };\n\n  // Header lookup is case-insensitive — support common variants.\n  const rawHeader =\n    headers['x-astrasync-signature'] ??\n    headers['X-Astrasync-Signature'] ??\n    headers['X-AstraSync-Signature'] ??\n    headers['X-ASTRASYNC-SIGNATURE'];\n  if (!rawHeader) return { ok: false, reason: 'missing_signature_header' };\n\n  const headerValue = Array.isArray(rawHeader) ? rawHeader[0] : rawHeader;\n  const { t: timestamp, v1: receivedSignature } = parseSignatureHeader(headerValue);\n  if (!timestamp || !receivedSignature) {\n    return { ok: false, reason: 'malformed_signature_header' };\n  }\n\n  const tolerance = options.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS;\n  const now = options.nowMs ?? Date.now();\n  const tsSeconds = Number(timestamp);\n  if (!Number.isFinite(tsSeconds)) {\n    return { ok: false, reason: 'invalid_timestamp' };\n  }\n  const ageSeconds = Math.abs(now / 1000 - tsSeconds);\n  if (ageSeconds > tolerance) {\n    return { ok: false, reason: 'timestamp_outside_tolerance' };\n  }\n\n  const expectedSignature = computeHmac(secret, `${timestamp}.${rawBody}`);\n  if (!constantTimeEquals(expectedSignature, receivedSignature)) {\n    return { ok: false, reason: 'signature_mismatch' };\n  }\n\n  return { ok: true };\n}\n\n/**\n * Server-side companion: produce an `X-AstraSync-Signature` header value for\n * an outbound webhook delivery. Exposed for completeness and for test\n * harnesses that want to verify the verifier; the AstraSync platform itself\n * uses an internal version of the same logic.\n */\nexport function signAstraSyncWebhook(\n  rawBody: string,\n  secret: string,\n  nowMs: number = Date.now()\n): { header: string; timestamp: number } {\n  const timestamp = Math.floor(nowMs / 1000);\n  const v1 = computeHmac(secret, `${timestamp}.${rawBody}`);\n  return { header: `t=${timestamp},v1=${v1}`, timestamp };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAsBA,oBAA4C;AAmB5C,IAAM,4BAA4B;AAElC,SAAS,qBAAqB,QAA6C;AACzE,QAAM,QAAqC,CAAC;AAC5C,aAAW,WAAW,OAAO,MAAM,GAAG,GAAG;AACvC,UAAM,CAAC,GAAG,CAAC,IAAI,QAAQ,MAAM,GAAG;AAChC,QAAI,MAAM,OAAO,MAAM,KAAM,OAAM,CAAC,IAAI;AAAA,EAC1C;AACA,SAAO;AACT;AAEA,SAAS,YAAY,QAAgB,eAA+B;AAClE,aAAO,0BAAW,UAAU,MAAM,EAAE,OAAO,eAAe,MAAM,EAAE,OAAO,KAAK;AAChF;AAEA,SAAS,mBAAmB,GAAW,GAAoB;AACzD,QAAM,OAAO,OAAO,KAAK,GAAG,MAAM;AAClC,QAAM,OAAO,OAAO,KAAK,GAAG,MAAM;AAClC,MAAI,KAAK,WAAW,KAAK,OAAQ,QAAO;AACxC,aAAO,+BAAgB,MAAM,IAAI;AACnC;AAYO,SAAS,uBACd,SACA,SACA,QACA,UAAgC,CAAC,GACZ;AACrB,MAAI,CAAC,OAAQ,QAAO,EAAE,IAAI,OAAO,QAAQ,qBAAqB;AAG9D,QAAM,YACJ,QAAQ,uBAAuB,KAC/B,QAAQ,uBAAuB,KAC/B,QAAQ,uBAAuB,KAC/B,QAAQ,uBAAuB;AACjC,MAAI,CAAC,UAAW,QAAO,EAAE,IAAI,OAAO,QAAQ,2BAA2B;AAEvE,QAAM,cAAc,MAAM,QAAQ,SAAS,IAAI,UAAU,CAAC,IAAI;AAC9D,QAAM,EAAE,GAAG,WAAW,IAAI,kBAAkB,IAAI,qBAAqB,WAAW;AAChF,MAAI,CAAC,aAAa,CAAC,mBAAmB;AACpC,WAAO,EAAE,IAAI,OAAO,QAAQ,6BAA6B;AAAA,EAC3D;AAEA,QAAM,YAAY,QAAQ,oBAAoB;AAC9C,QAAM,MAAM,QAAQ,SAAS,KAAK,IAAI;AACtC,QAAM,YAAY,OAAO,SAAS;AAClC,MAAI,CAAC,OAAO,SAAS,SAAS,GAAG;AAC/B,WAAO,EAAE,IAAI,OAAO,QAAQ,oBAAoB;AAAA,EAClD;AACA,QAAM,aAAa,KAAK,IAAI,MAAM,MAAO,SAAS;AAClD,MAAI,aAAa,WAAW;AAC1B,WAAO,EAAE,IAAI,OAAO,QAAQ,8BAA8B;AAAA,EAC5D;AAEA,QAAM,oBAAoB,YAAY,QAAQ,GAAG,SAAS,IAAI,OAAO,EAAE;AACvE,MAAI,CAAC,mBAAmB,mBAAmB,iBAAiB,GAAG;AAC7D,WAAO,EAAE,IAAI,OAAO,QAAQ,qBAAqB;AAAA,EACnD;AAEA,SAAO,EAAE,IAAI,KAAK;AACpB;AAQO,SAAS,qBACd,SACA,QACA,QAAgB,KAAK,IAAI,GACc;AACvC,QAAM,YAAY,KAAK,MAAM,QAAQ,GAAI;AACzC,QAAM,KAAK,YAAY,QAAQ,GAAG,SAAS,IAAI,OAAO,EAAE;AACxD,SAAO,EAAE,QAAQ,KAAK,SAAS,OAAO,EAAE,IAAI,UAAU;AACxD;","names":[]}
+{"version":3,"sources":["../src/webhooks.ts"],"sourcesContent":["/**\n * AstraSync webhook signature verification.\n *\n * AstraSync signs every webhook delivery with HMAC-SHA256 over\n * `${unix_timestamp}.${rawBody}` using the merchant's webhook secret\n * (returned ONCE at endpoint registration). The signature is sent in\n * the `X-AstraSync-Signature` header in the form:\n *\n *   X-AstraSync-Signature: t=<unix-ts>,v1=<hex-hmac>\n *\n * This pattern mirrors Stripe's `Stripe-Signature` to ease adoption.\n *\n * 5.19.0 — secret rotation: for 24 hours after you rotate the endpoint's\n * webhook secret, AstraSync also signs with the PREVIOUS secret, sent as a\n * `v1old` value: `t=<unix-ts>,v1=<hex>,v1old=<hex>`. A delivery verifies when\n * ANY value matches ANY secret you pass, so pass both while you roll over:\n * `verifyAstraSyncWebhook(raw, headers, [newSecret, oldSecret])`. Queued\n * events signed before the rotation still verify on either side.\n *\n * Usage:\n *   import { verifyAstraSyncWebhook } from '@astrasyncai/verification-gateway/webhooks';\n *\n *   app.post('/webhooks/astrasync', express.raw({type:'application/json'}), (req, res) => {\n *     const result = verifyAstraSyncWebhook(req.body.toString('utf8'), req.headers, secret);\n *     if (!result.ok) return res.status(401).json({error: result.reason});\n *     // ... process event\n *   });\n */\n\nimport { createHmac, timingSafeEqual } from 'crypto';\n\nexport interface VerifyWebhookOptions {\n  /**\n   * Maximum age (seconds) for the signature timestamp. Older deliveries\n   * are rejected as replays. Default 300 (5 minutes) — matches Stripe.\n   */\n  toleranceSeconds?: number;\n  /**\n   * Override \"now\" for tests. Defaults to Date.now().\n   */\n  nowMs?: number;\n}\n\nexport interface VerifyWebhookResult {\n  ok: boolean;\n  reason?: string;\n}\n\nconst DEFAULT_TOLERANCE_SECONDS = 300;\n\nfunction parseSignatureHeader(header: string): { t?: string; signatures: string[] } {\n  let t: string | undefined;\n  const signatures: string[] = [];\n  for (const segment of header.split(',')) {\n    const eq = segment.indexOf('=');\n    if (eq < 0) continue;\n    const k = segment.slice(0, eq).trim();\n    const v = segment.slice(eq + 1).trim();\n    if (k === 't') t = v;\n    // 5.19.0: `v1old` = the same HMAC under the previous secret (rotation).\n    else if ((k === 'v1' || k === 'v1old') && v) signatures.push(v);\n  }\n  return { t, signatures };\n}\n\nfunction computeHmac(secret: string, signedPayload: string): string {\n  return createHmac('sha256', secret).update(signedPayload, 'utf8').digest('hex');\n}\n\nfunction constantTimeEquals(a: string, b: string): boolean {\n  const aBuf = Buffer.from(a, 'utf8');\n  const bBuf = Buffer.from(b, 'utf8');\n  if (aBuf.length !== bBuf.length) return false;\n  return timingSafeEqual(aBuf, bBuf);\n}\n\n/**\n * Verify an AstraSync-issued webhook delivery.\n *\n * @param rawBody - The raw request body as a string (NOT the parsed JSON).\n *                  Use `express.raw({type:'application/json'})` to preserve bytes.\n * @param headers - Incoming request headers (case-insensitive).\n * @param secret  - The merchant's webhook secret from endpoint registration,\n *                  or (5.19.0) several — e.g. `[current, previous]` during a\n *                  rotation. Any secret matching any `v1` / `v1old` value passes.\n * @param options - Optional tolerance overrides.\n * @returns       - `{ok: true}` on success, `{ok: false, reason}` on failure.\n */\nexport function verifyAstraSyncWebhook(\n  rawBody: string,\n  headers: Record<string, string | string[] | undefined>,\n  secret: string | readonly string[],\n  options: VerifyWebhookOptions = {}\n): VerifyWebhookResult {\n  const secrets = (Array.isArray(secret) ? secret : [secret]).filter(\n    (x): x is string => typeof x === 'string' && x.length > 0\n  );\n  if (!secrets.length) return { ok: false, reason: 'no_secret_provided' };\n\n  // Header lookup is case-insensitive — support common variants.\n  const rawHeader =\n    headers['x-astrasync-signature'] ??\n    headers['X-Astrasync-Signature'] ??\n    headers['X-AstraSync-Signature'] ??\n    headers['X-ASTRASYNC-SIGNATURE'];\n  if (!rawHeader) return { ok: false, reason: 'missing_signature_header' };\n\n  const headerValue = Array.isArray(rawHeader) ? rawHeader[0] : rawHeader;\n  const { t: timestamp, signatures } = parseSignatureHeader(headerValue);\n  if (!timestamp || !signatures.length) {\n    return { ok: false, reason: 'malformed_signature_header' };\n  }\n\n  const tolerance = options.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS;\n  const now = options.nowMs ?? Date.now();\n  const tsSeconds = Number(timestamp);\n  if (!Number.isFinite(tsSeconds)) {\n    return { ok: false, reason: 'invalid_timestamp' };\n  }\n  const ageSeconds = Math.abs(now / 1000 - tsSeconds);\n  if (ageSeconds > tolerance) {\n    return { ok: false, reason: 'timestamp_outside_tolerance' };\n  }\n\n  for (const key of secrets) {\n    const expectedSignature = computeHmac(key, `${timestamp}.${rawBody}`);\n    if (signatures.some((received) => constantTimeEquals(expectedSignature, received))) {\n      return { ok: true };\n    }\n  }\n  return { ok: false, reason: 'signature_mismatch' };\n}\n\n/**\n * Server-side companion: produce an `X-AstraSync-Signature` header value for\n * an outbound webhook delivery. Exposed for completeness and for test\n * harnesses that want to verify the verifier; the AstraSync platform itself\n * uses an internal version of the same logic.\n */\nexport function signAstraSyncWebhook(\n  rawBody: string,\n  secret: string,\n  nowMs: number = Date.now(),\n  /** 5.19.0: also sign with the previous secret (rotation) as `v1old`. */\n  options: { previousSecret?: string } = {}\n): { header: string; timestamp: number } {\n  const timestamp = Math.floor(nowMs / 1000);\n  const v1 = computeHmac(secret, `${timestamp}.${rawBody}`);\n  const old = options.previousSecret\n    ? `,v1old=${computeHmac(options.previousSecret, `${timestamp}.${rawBody}`)}`\n    : '';\n  return { header: `t=${timestamp},v1=${v1}${old}`, timestamp };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA6BA,oBAA4C;AAmB5C,IAAM,4BAA4B;AAElC,SAAS,qBAAqB,QAAsD;AAClF,MAAI;AACJ,QAAM,aAAuB,CAAC;AAC9B,aAAW,WAAW,OAAO,MAAM,GAAG,GAAG;AACvC,UAAM,KAAK,QAAQ,QAAQ,GAAG;AAC9B,QAAI,KAAK,EAAG;AACZ,UAAM,IAAI,QAAQ,MAAM,GAAG,EAAE,EAAE,KAAK;AACpC,UAAM,IAAI,QAAQ,MAAM,KAAK,CAAC,EAAE,KAAK;AACrC,QAAI,MAAM,IAAK,KAAI;AAAA,cAET,MAAM,QAAQ,MAAM,YAAY,EAAG,YAAW,KAAK,CAAC;AAAA,EAChE;AACA,SAAO,EAAE,GAAG,WAAW;AACzB;AAEA,SAAS,YAAY,QAAgB,eAA+B;AAClE,aAAO,0BAAW,UAAU,MAAM,EAAE,OAAO,eAAe,MAAM,EAAE,OAAO,KAAK;AAChF;AAEA,SAAS,mBAAmB,GAAW,GAAoB;AACzD,QAAM,OAAO,OAAO,KAAK,GAAG,MAAM;AAClC,QAAM,OAAO,OAAO,KAAK,GAAG,MAAM;AAClC,MAAI,KAAK,WAAW,KAAK,OAAQ,QAAO;AACxC,aAAO,+BAAgB,MAAM,IAAI;AACnC;AAcO,SAAS,uBACd,SACA,SACA,QACA,UAAgC,CAAC,GACZ;AACrB,QAAM,WAAW,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC,MAAM,GAAG;AAAA,IAC1D,CAAC,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS;AAAA,EAC1D;AACA,MAAI,CAAC,QAAQ,OAAQ,QAAO,EAAE,IAAI,OAAO,QAAQ,qBAAqB;AAGtE,QAAM,YACJ,QAAQ,uBAAuB,KAC/B,QAAQ,uBAAuB,KAC/B,QAAQ,uBAAuB,KAC/B,QAAQ,uBAAuB;AACjC,MAAI,CAAC,UAAW,QAAO,EAAE,IAAI,OAAO,QAAQ,2BAA2B;AAEvE,QAAM,cAAc,MAAM,QAAQ,SAAS,IAAI,UAAU,CAAC,IAAI;AAC9D,QAAM,EAAE,GAAG,WAAW,WAAW,IAAI,qBAAqB,WAAW;AACrE,MAAI,CAAC,aAAa,CAAC,WAAW,QAAQ;AACpC,WAAO,EAAE,IAAI,OAAO,QAAQ,6BAA6B;AAAA,EAC3D;AAEA,QAAM,YAAY,QAAQ,oBAAoB;AAC9C,QAAM,MAAM,QAAQ,SAAS,KAAK,IAAI;AACtC,QAAM,YAAY,OAAO,SAAS;AAClC,MAAI,CAAC,OAAO,SAAS,SAAS,GAAG;AAC/B,WAAO,EAAE,IAAI,OAAO,QAAQ,oBAAoB;AAAA,EAClD;AACA,QAAM,aAAa,KAAK,IAAI,MAAM,MAAO,SAAS;AAClD,MAAI,aAAa,WAAW;AAC1B,WAAO,EAAE,IAAI,OAAO,QAAQ,8BAA8B;AAAA,EAC5D;AAEA,aAAW,OAAO,SAAS;AACzB,UAAM,oBAAoB,YAAY,KAAK,GAAG,SAAS,IAAI,OAAO,EAAE;AACpE,QAAI,WAAW,KAAK,CAAC,aAAa,mBAAmB,mBAAmB,QAAQ,CAAC,GAAG;AAClF,aAAO,EAAE,IAAI,KAAK;AAAA,IACpB;AAAA,EACF;AACA,SAAO,EAAE,IAAI,OAAO,QAAQ,qBAAqB;AACnD;AAQO,SAAS,qBACd,SACA,QACA,QAAgB,KAAK,IAAI,GAEzB,UAAuC,CAAC,GACD;AACvC,QAAM,YAAY,KAAK,MAAM,QAAQ,GAAI;AACzC,QAAM,KAAK,YAAY,QAAQ,GAAG,SAAS,IAAI,OAAO,EAAE;AACxD,QAAM,MAAM,QAAQ,iBAChB,UAAU,YAAY,QAAQ,gBAAgB,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC,KACxE;AACJ,SAAO,EAAE,QAAQ,KAAK,SAAS,OAAO,EAAE,GAAG,GAAG,IAAI,UAAU;AAC9D;","names":[]}

package/dist/webhooks.mjs

@@ -2,12 +2,17 @@
 import { createHmac, timingSafeEqual } from "crypto";
 var DEFAULT_TOLERANCE_SECONDS = 300;
 function parseSignatureHeader(header) {
-  const parts = {};
+  let t;
+  const signatures = [];
   for (const segment of header.split(",")) {
-    const [k, v] = segment.split("=");
-    if (k === "t" || k === "v1") parts[k] = v;
+    const eq = segment.indexOf("=");
+    if (eq < 0) continue;
+    const k = segment.slice(0, eq).trim();
+    const v = segment.slice(eq + 1).trim();
+    if (k === "t") t = v;
+    else if ((k === "v1" || k === "v1old") && v) signatures.push(v);
   }
-  return parts;
+  return { t, signatures };
 }
 function computeHmac(secret, signedPayload) {
   return createHmac("sha256", secret).update(signedPayload, "utf8").digest("hex");
@@ -19,12 +24,15 @@ function constantTimeEquals(a, b) {
   return timingSafeEqual(aBuf, bBuf);
 }
 function verifyAstraSyncWebhook(rawBody, headers, secret, options = {}) {
-  if (!secret) return { ok: false, reason: "no_secret_provided" };
+  const secrets = (Array.isArray(secret) ? secret : [secret]).filter(
+    (x) => typeof x === "string" && x.length > 0
+  );
+  if (!secrets.length) return { ok: false, reason: "no_secret_provided" };
   const rawHeader = headers["x-astrasync-signature"] ?? headers["X-Astrasync-Signature"] ?? headers["X-AstraSync-Signature"] ?? headers["X-ASTRASYNC-SIGNATURE"];
   if (!rawHeader) return { ok: false, reason: "missing_signature_header" };
   const headerValue = Array.isArray(rawHeader) ? rawHeader[0] : rawHeader;
-  const { t: timestamp, v1: receivedSignature } = parseSignatureHeader(headerValue);
-  if (!timestamp || !receivedSignature) {
+  const { t: timestamp, signatures } = parseSignatureHeader(headerValue);
+  if (!timestamp || !signatures.length) {
     return { ok: false, reason: "malformed_signature_header" };
   }
   const tolerance = options.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS;
@@ -37,16 +45,19 @@ function verifyAstraSyncWebhook(rawBody, headers, secret, options = {}) {
   if (ageSeconds > tolerance) {
     return { ok: false, reason: "timestamp_outside_tolerance" };
   }
-  const expectedSignature = computeHmac(secret, `${timestamp}.${rawBody}`);
-  if (!constantTimeEquals(expectedSignature, receivedSignature)) {
-    return { ok: false, reason: "signature_mismatch" };
+  for (const key of secrets) {
+    const expectedSignature = computeHmac(key, `${timestamp}.${rawBody}`);
+    if (signatures.some((received) => constantTimeEquals(expectedSignature, received))) {
+      return { ok: true };
+    }
   }
-  return { ok: true };
+  return { ok: false, reason: "signature_mismatch" };
 }
-function signAstraSyncWebhook(rawBody, secret, nowMs = Date.now()) {
+function signAstraSyncWebhook(rawBody, secret, nowMs = Date.now(), options = {}) {
   const timestamp = Math.floor(nowMs / 1e3);
   const v1 = computeHmac(secret, `${timestamp}.${rawBody}`);
-  return { header: `t=${timestamp},v1=${v1}`, timestamp };
+  const old = options.previousSecret ? `,v1old=${computeHmac(options.previousSecret, `${timestamp}.${rawBody}`)}` : "";
+  return { header: `t=${timestamp},v1=${v1}${old}`, timestamp };
 }
 export {
   signAstraSyncWebhook,

package/dist/webhooks.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/webhooks.ts"],"sourcesContent":["/**\n * AstraSync webhook signature verification.\n *\n * AstraSync signs every webhook delivery with HMAC-SHA256 over\n * `${unix_timestamp}.${rawBody}` using the merchant's webhook secret\n * (returned ONCE at endpoint registration). The signature is sent in\n * the `X-AstraSync-Signature` header in the form:\n *\n *   X-AstraSync-Signature: t=<unix-ts>,v1=<hex-hmac>\n *\n * This pattern mirrors Stripe's `Stripe-Signature` to ease adoption.\n *\n * Usage:\n *   import { verifyAstraSyncWebhook } from '@astrasyncai/verification-gateway/webhooks';\n *\n *   app.post('/webhooks/astrasync', express.raw({type:'application/json'}), (req, res) => {\n *     const result = verifyAstraSyncWebhook(req.body.toString('utf8'), req.headers, secret);\n *     if (!result.ok) return res.status(401).json({error: result.reason});\n *     // ... process event\n *   });\n */\n\nimport { createHmac, timingSafeEqual } from 'crypto';\n\nexport interface VerifyWebhookOptions {\n  /**\n   * Maximum age (seconds) for the signature timestamp. Older deliveries\n   * are rejected as replays. Default 300 (5 minutes) — matches Stripe.\n   */\n  toleranceSeconds?: number;\n  /**\n   * Override \"now\" for tests. Defaults to Date.now().\n   */\n  nowMs?: number;\n}\n\nexport interface VerifyWebhookResult {\n  ok: boolean;\n  reason?: string;\n}\n\nconst DEFAULT_TOLERANCE_SECONDS = 300;\n\nfunction parseSignatureHeader(header: string): { t?: string; v1?: string } {\n  const parts: { t?: string; v1?: string } = {};\n  for (const segment of header.split(',')) {\n    const [k, v] = segment.split('=');\n    if (k === 't' || k === 'v1') parts[k] = v;\n  }\n  return parts;\n}\n\nfunction computeHmac(secret: string, signedPayload: string): string {\n  return createHmac('sha256', secret).update(signedPayload, 'utf8').digest('hex');\n}\n\nfunction constantTimeEquals(a: string, b: string): boolean {\n  const aBuf = Buffer.from(a, 'utf8');\n  const bBuf = Buffer.from(b, 'utf8');\n  if (aBuf.length !== bBuf.length) return false;\n  return timingSafeEqual(aBuf, bBuf);\n}\n\n/**\n * Verify an AstraSync-issued webhook delivery.\n *\n * @param rawBody - The raw request body as a string (NOT the parsed JSON).\n *                  Use `express.raw({type:'application/json'})` to preserve bytes.\n * @param headers - Incoming request headers (case-insensitive).\n * @param secret  - The merchant's webhook secret from endpoint registration.\n * @param options - Optional tolerance overrides.\n * @returns       - `{ok: true}` on success, `{ok: false, reason}` on failure.\n */\nexport function verifyAstraSyncWebhook(\n  rawBody: string,\n  headers: Record<string, string | string[] | undefined>,\n  secret: string,\n  options: VerifyWebhookOptions = {}\n): VerifyWebhookResult {\n  if (!secret) return { ok: false, reason: 'no_secret_provided' };\n\n  // Header lookup is case-insensitive — support common variants.\n  const rawHeader =\n    headers['x-astrasync-signature'] ??\n    headers['X-Astrasync-Signature'] ??\n    headers['X-AstraSync-Signature'] ??\n    headers['X-ASTRASYNC-SIGNATURE'];\n  if (!rawHeader) return { ok: false, reason: 'missing_signature_header' };\n\n  const headerValue = Array.isArray(rawHeader) ? rawHeader[0] : rawHeader;\n  const { t: timestamp, v1: receivedSignature } = parseSignatureHeader(headerValue);\n  if (!timestamp || !receivedSignature) {\n    return { ok: false, reason: 'malformed_signature_header' };\n  }\n\n  const tolerance = options.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS;\n  const now = options.nowMs ?? Date.now();\n  const tsSeconds = Number(timestamp);\n  if (!Number.isFinite(tsSeconds)) {\n    return { ok: false, reason: 'invalid_timestamp' };\n  }\n  const ageSeconds = Math.abs(now / 1000 - tsSeconds);\n  if (ageSeconds > tolerance) {\n    return { ok: false, reason: 'timestamp_outside_tolerance' };\n  }\n\n  const expectedSignature = computeHmac(secret, `${timestamp}.${rawBody}`);\n  if (!constantTimeEquals(expectedSignature, receivedSignature)) {\n    return { ok: false, reason: 'signature_mismatch' };\n  }\n\n  return { ok: true };\n}\n\n/**\n * Server-side companion: produce an `X-AstraSync-Signature` header value for\n * an outbound webhook delivery. Exposed for completeness and for test\n * harnesses that want to verify the verifier; the AstraSync platform itself\n * uses an internal version of the same logic.\n */\nexport function signAstraSyncWebhook(\n  rawBody: string,\n  secret: string,\n  nowMs: number = Date.now()\n): { header: string; timestamp: number } {\n  const timestamp = Math.floor(nowMs / 1000);\n  const v1 = computeHmac(secret, `${timestamp}.${rawBody}`);\n  return { header: `t=${timestamp},v1=${v1}`, timestamp };\n}\n"],"mappings":";AAsBA,SAAS,YAAY,uBAAuB;AAmB5C,IAAM,4BAA4B;AAElC,SAAS,qBAAqB,QAA6C;AACzE,QAAM,QAAqC,CAAC;AAC5C,aAAW,WAAW,OAAO,MAAM,GAAG,GAAG;AACvC,UAAM,CAAC,GAAG,CAAC,IAAI,QAAQ,MAAM,GAAG;AAChC,QAAI,MAAM,OAAO,MAAM,KAAM,OAAM,CAAC,IAAI;AAAA,EAC1C;AACA,SAAO;AACT;AAEA,SAAS,YAAY,QAAgB,eAA+B;AAClE,SAAO,WAAW,UAAU,MAAM,EAAE,OAAO,eAAe,MAAM,EAAE,OAAO,KAAK;AAChF;AAEA,SAAS,mBAAmB,GAAW,GAAoB;AACzD,QAAM,OAAO,OAAO,KAAK,GAAG,MAAM;AAClC,QAAM,OAAO,OAAO,KAAK,GAAG,MAAM;AAClC,MAAI,KAAK,WAAW,KAAK,OAAQ,QAAO;AACxC,SAAO,gBAAgB,MAAM,IAAI;AACnC;AAYO,SAAS,uBACd,SACA,SACA,QACA,UAAgC,CAAC,GACZ;AACrB,MAAI,CAAC,OAAQ,QAAO,EAAE,IAAI,OAAO,QAAQ,qBAAqB;AAG9D,QAAM,YACJ,QAAQ,uBAAuB,KAC/B,QAAQ,uBAAuB,KAC/B,QAAQ,uBAAuB,KAC/B,QAAQ,uBAAuB;AACjC,MAAI,CAAC,UAAW,QAAO,EAAE,IAAI,OAAO,QAAQ,2BAA2B;AAEvE,QAAM,cAAc,MAAM,QAAQ,SAAS,IAAI,UAAU,CAAC,IAAI;AAC9D,QAAM,EAAE,GAAG,WAAW,IAAI,kBAAkB,IAAI,qBAAqB,WAAW;AAChF,MAAI,CAAC,aAAa,CAAC,mBAAmB;AACpC,WAAO,EAAE,IAAI,OAAO,QAAQ,6BAA6B;AAAA,EAC3D;AAEA,QAAM,YAAY,QAAQ,oBAAoB;AAC9C,QAAM,MAAM,QAAQ,SAAS,KAAK,IAAI;AACtC,QAAM,YAAY,OAAO,SAAS;AAClC,MAAI,CAAC,OAAO,SAAS,SAAS,GAAG;AAC/B,WAAO,EAAE,IAAI,OAAO,QAAQ,oBAAoB;AAAA,EAClD;AACA,QAAM,aAAa,KAAK,IAAI,MAAM,MAAO,SAAS;AAClD,MAAI,aAAa,WAAW;AAC1B,WAAO,EAAE,IAAI,OAAO,QAAQ,8BAA8B;AAAA,EAC5D;AAEA,QAAM,oBAAoB,YAAY,QAAQ,GAAG,SAAS,IAAI,OAAO,EAAE;AACvE,MAAI,CAAC,mBAAmB,mBAAmB,iBAAiB,GAAG;AAC7D,WAAO,EAAE,IAAI,OAAO,QAAQ,qBAAqB;AAAA,EACnD;AAEA,SAAO,EAAE,IAAI,KAAK;AACpB;AAQO,SAAS,qBACd,SACA,QACA,QAAgB,KAAK,IAAI,GACc;AACvC,QAAM,YAAY,KAAK,MAAM,QAAQ,GAAI;AACzC,QAAM,KAAK,YAAY,QAAQ,GAAG,SAAS,IAAI,OAAO,EAAE;AACxD,SAAO,EAAE,QAAQ,KAAK,SAAS,OAAO,EAAE,IAAI,UAAU;AACxD;","names":[]}
+{"version":3,"sources":["../src/webhooks.ts"],"sourcesContent":["/**\n * AstraSync webhook signature verification.\n *\n * AstraSync signs every webhook delivery with HMAC-SHA256 over\n * `${unix_timestamp}.${rawBody}` using the merchant's webhook secret\n * (returned ONCE at endpoint registration). The signature is sent in\n * the `X-AstraSync-Signature` header in the form:\n *\n *   X-AstraSync-Signature: t=<unix-ts>,v1=<hex-hmac>\n *\n * This pattern mirrors Stripe's `Stripe-Signature` to ease adoption.\n *\n * 5.19.0 — secret rotation: for 24 hours after you rotate the endpoint's\n * webhook secret, AstraSync also signs with the PREVIOUS secret, sent as a\n * `v1old` value: `t=<unix-ts>,v1=<hex>,v1old=<hex>`. A delivery verifies when\n * ANY value matches ANY secret you pass, so pass both while you roll over:\n * `verifyAstraSyncWebhook(raw, headers, [newSecret, oldSecret])`. Queued\n * events signed before the rotation still verify on either side.\n *\n * Usage:\n *   import { verifyAstraSyncWebhook } from '@astrasyncai/verification-gateway/webhooks';\n *\n *   app.post('/webhooks/astrasync', express.raw({type:'application/json'}), (req, res) => {\n *     const result = verifyAstraSyncWebhook(req.body.toString('utf8'), req.headers, secret);\n *     if (!result.ok) return res.status(401).json({error: result.reason});\n *     // ... process event\n *   });\n */\n\nimport { createHmac, timingSafeEqual } from 'crypto';\n\nexport interface VerifyWebhookOptions {\n  /**\n   * Maximum age (seconds) for the signature timestamp. Older deliveries\n   * are rejected as replays. Default 300 (5 minutes) — matches Stripe.\n   */\n  toleranceSeconds?: number;\n  /**\n   * Override \"now\" for tests. Defaults to Date.now().\n   */\n  nowMs?: number;\n}\n\nexport interface VerifyWebhookResult {\n  ok: boolean;\n  reason?: string;\n}\n\nconst DEFAULT_TOLERANCE_SECONDS = 300;\n\nfunction parseSignatureHeader(header: string): { t?: string; signatures: string[] } {\n  let t: string | undefined;\n  const signatures: string[] = [];\n  for (const segment of header.split(',')) {\n    const eq = segment.indexOf('=');\n    if (eq < 0) continue;\n    const k = segment.slice(0, eq).trim();\n    const v = segment.slice(eq + 1).trim();\n    if (k === 't') t = v;\n    // 5.19.0: `v1old` = the same HMAC under the previous secret (rotation).\n    else if ((k === 'v1' || k === 'v1old') && v) signatures.push(v);\n  }\n  return { t, signatures };\n}\n\nfunction computeHmac(secret: string, signedPayload: string): string {\n  return createHmac('sha256', secret).update(signedPayload, 'utf8').digest('hex');\n}\n\nfunction constantTimeEquals(a: string, b: string): boolean {\n  const aBuf = Buffer.from(a, 'utf8');\n  const bBuf = Buffer.from(b, 'utf8');\n  if (aBuf.length !== bBuf.length) return false;\n  return timingSafeEqual(aBuf, bBuf);\n}\n\n/**\n * Verify an AstraSync-issued webhook delivery.\n *\n * @param rawBody - The raw request body as a string (NOT the parsed JSON).\n *                  Use `express.raw({type:'application/json'})` to preserve bytes.\n * @param headers - Incoming request headers (case-insensitive).\n * @param secret  - The merchant's webhook secret from endpoint registration,\n *                  or (5.19.0) several — e.g. `[current, previous]` during a\n *                  rotation. Any secret matching any `v1` / `v1old` value passes.\n * @param options - Optional tolerance overrides.\n * @returns       - `{ok: true}` on success, `{ok: false, reason}` on failure.\n */\nexport function verifyAstraSyncWebhook(\n  rawBody: string,\n  headers: Record<string, string | string[] | undefined>,\n  secret: string | readonly string[],\n  options: VerifyWebhookOptions = {}\n): VerifyWebhookResult {\n  const secrets = (Array.isArray(secret) ? secret : [secret]).filter(\n    (x): x is string => typeof x === 'string' && x.length > 0\n  );\n  if (!secrets.length) return { ok: false, reason: 'no_secret_provided' };\n\n  // Header lookup is case-insensitive — support common variants.\n  const rawHeader =\n    headers['x-astrasync-signature'] ??\n    headers['X-Astrasync-Signature'] ??\n    headers['X-AstraSync-Signature'] ??\n    headers['X-ASTRASYNC-SIGNATURE'];\n  if (!rawHeader) return { ok: false, reason: 'missing_signature_header' };\n\n  const headerValue = Array.isArray(rawHeader) ? rawHeader[0] : rawHeader;\n  const { t: timestamp, signatures } = parseSignatureHeader(headerValue);\n  if (!timestamp || !signatures.length) {\n    return { ok: false, reason: 'malformed_signature_header' };\n  }\n\n  const tolerance = options.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS;\n  const now = options.nowMs ?? Date.now();\n  const tsSeconds = Number(timestamp);\n  if (!Number.isFinite(tsSeconds)) {\n    return { ok: false, reason: 'invalid_timestamp' };\n  }\n  const ageSeconds = Math.abs(now / 1000 - tsSeconds);\n  if (ageSeconds > tolerance) {\n    return { ok: false, reason: 'timestamp_outside_tolerance' };\n  }\n\n  for (const key of secrets) {\n    const expectedSignature = computeHmac(key, `${timestamp}.${rawBody}`);\n    if (signatures.some((received) => constantTimeEquals(expectedSignature, received))) {\n      return { ok: true };\n    }\n  }\n  return { ok: false, reason: 'signature_mismatch' };\n}\n\n/**\n * Server-side companion: produce an `X-AstraSync-Signature` header value for\n * an outbound webhook delivery. Exposed for completeness and for test\n * harnesses that want to verify the verifier; the AstraSync platform itself\n * uses an internal version of the same logic.\n */\nexport function signAstraSyncWebhook(\n  rawBody: string,\n  secret: string,\n  nowMs: number = Date.now(),\n  /** 5.19.0: also sign with the previous secret (rotation) as `v1old`. */\n  options: { previousSecret?: string } = {}\n): { header: string; timestamp: number } {\n  const timestamp = Math.floor(nowMs / 1000);\n  const v1 = computeHmac(secret, `${timestamp}.${rawBody}`);\n  const old = options.previousSecret\n    ? `,v1old=${computeHmac(options.previousSecret, `${timestamp}.${rawBody}`)}`\n    : '';\n  return { header: `t=${timestamp},v1=${v1}${old}`, timestamp };\n}\n"],"mappings":";AA6BA,SAAS,YAAY,uBAAuB;AAmB5C,IAAM,4BAA4B;AAElC,SAAS,qBAAqB,QAAsD;AAClF,MAAI;AACJ,QAAM,aAAuB,CAAC;AAC9B,aAAW,WAAW,OAAO,MAAM,GAAG,GAAG;AACvC,UAAM,KAAK,QAAQ,QAAQ,GAAG;AAC9B,QAAI,KAAK,EAAG;AACZ,UAAM,IAAI,QAAQ,MAAM,GAAG,EAAE,EAAE,KAAK;AACpC,UAAM,IAAI,QAAQ,MAAM,KAAK,CAAC,EAAE,KAAK;AACrC,QAAI,MAAM,IAAK,KAAI;AAAA,cAET,MAAM,QAAQ,MAAM,YAAY,EAAG,YAAW,KAAK,CAAC;AAAA,EAChE;AACA,SAAO,EAAE,GAAG,WAAW;AACzB;AAEA,SAAS,YAAY,QAAgB,eAA+B;AAClE,SAAO,WAAW,UAAU,MAAM,EAAE,OAAO,eAAe,MAAM,EAAE,OAAO,KAAK;AAChF;AAEA,SAAS,mBAAmB,GAAW,GAAoB;AACzD,QAAM,OAAO,OAAO,KAAK,GAAG,MAAM;AAClC,QAAM,OAAO,OAAO,KAAK,GAAG,MAAM;AAClC,MAAI,KAAK,WAAW,KAAK,OAAQ,QAAO;AACxC,SAAO,gBAAgB,MAAM,IAAI;AACnC;AAcO,SAAS,uBACd,SACA,SACA,QACA,UAAgC,CAAC,GACZ;AACrB,QAAM,WAAW,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC,MAAM,GAAG;AAAA,IAC1D,CAAC,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS;AAAA,EAC1D;AACA,MAAI,CAAC,QAAQ,OAAQ,QAAO,EAAE,IAAI,OAAO,QAAQ,qBAAqB;AAGtE,QAAM,YACJ,QAAQ,uBAAuB,KAC/B,QAAQ,uBAAuB,KAC/B,QAAQ,uBAAuB,KAC/B,QAAQ,uBAAuB;AACjC,MAAI,CAAC,UAAW,QAAO,EAAE,IAAI,OAAO,QAAQ,2BAA2B;AAEvE,QAAM,cAAc,MAAM,QAAQ,SAAS,IAAI,UAAU,CAAC,IAAI;AAC9D,QAAM,EAAE,GAAG,WAAW,WAAW,IAAI,qBAAqB,WAAW;AACrE,MAAI,CAAC,aAAa,CAAC,WAAW,QAAQ;AACpC,WAAO,EAAE,IAAI,OAAO,QAAQ,6BAA6B;AAAA,EAC3D;AAEA,QAAM,YAAY,QAAQ,oBAAoB;AAC9C,QAAM,MAAM,QAAQ,SAAS,KAAK,IAAI;AACtC,QAAM,YAAY,OAAO,SAAS;AAClC,MAAI,CAAC,OAAO,SAAS,SAAS,GAAG;AAC/B,WAAO,EAAE,IAAI,OAAO,QAAQ,oBAAoB;AAAA,EAClD;AACA,QAAM,aAAa,KAAK,IAAI,MAAM,MAAO,SAAS;AAClD,MAAI,aAAa,WAAW;AAC1B,WAAO,EAAE,IAAI,OAAO,QAAQ,8BAA8B;AAAA,EAC5D;AAEA,aAAW,OAAO,SAAS;AACzB,UAAM,oBAAoB,YAAY,KAAK,GAAG,SAAS,IAAI,OAAO,EAAE;AACpE,QAAI,WAAW,KAAK,CAAC,aAAa,mBAAmB,mBAAmB,QAAQ,CAAC,GAAG;AAClF,aAAO,EAAE,IAAI,KAAK;AAAA,IACpB;AAAA,EACF;AACA,SAAO,EAAE,IAAI,OAAO,QAAQ,qBAAqB;AACnD;AAQO,SAAS,qBACd,SACA,QACA,QAAgB,KAAK,IAAI,GAEzB,UAAuC,CAAC,GACD;AACvC,QAAM,YAAY,KAAK,MAAM,QAAQ,GAAI;AACzC,QAAM,KAAK,YAAY,QAAQ,GAAG,SAAS,IAAI,OAAO,EAAE;AACxD,QAAM,MAAM,QAAQ,iBAChB,UAAU,YAAY,QAAQ,gBAAgB,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC,KACxE;AACJ,SAAO,EAAE,QAAQ,KAAK,SAAS,OAAO,EAAE,GAAG,GAAG,IAAI,UAAU;AAC9D;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrasyncai/verification-gateway",
-  "version": "5.18.1",
+  "version": "5.20.0",
   "description": "AstraSync KYA Platform SDK — counterparty verification gateway (verify incoming requests) + agent registration (register AI agents with the KYA backend).",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",