@awell-health/awell-extensions 2.1.205 → 2.1.206

package/dist/extensions/bland/actions/index.d.ts

@@ -332,6 +332,13 @@ export declare const actions: {
             description: string;
             required: true;
         };
+        signingSecret: {
+            key: string;
+            label: string;
+            obfuscated: true;
+            description: string;
+            required: false;
+        };
     }, "call_id">;
     sendCall: import("@awell-health/extensions-core").Action<{
         phoneNumber: {
@@ -659,6 +666,13 @@ export declare const actions: {
             description: string;
             required: true;
         };
+        signingSecret: {
+            key: string;
+            label: string;
+            obfuscated: true;
+            description: string;
+            required: false;
+        };
     }, "call_id">;
     getCallDetails: import("@awell-health/extensions-core").Action<{
         callId: {
@@ -676,6 +690,13 @@ export declare const actions: {
             description: string;
             required: true;
         };
+        signingSecret: {
+            key: string;
+            label: string;
+            obfuscated: true;
+            description: string;
+            required: false;
+        };
     }, "metadata" | "status" | "completed" | "from" | "to" | "summary" | "analysis" | "transcripts" | "analysisSchema" | "callData" | "callLength" | "startedAt" | "endAt" | "concatenatedTranscript" | "answeredBy" | "errorMessage">;
     stopActiveCall: import("@awell-health/extensions-core").Action<{
         callId: {
@@ -693,6 +714,13 @@ export declare const actions: {
             description: string;
             required: true;
         };
+        signingSecret: {
+            key: string;
+            label: string;
+            obfuscated: true;
+            description: string;
+            required: false;
+        };
     }, "message" | "status">;
     sendSms: import("@awell-health/extensions-core").Action<{
         userNumber: {
@@ -796,6 +824,13 @@ export declare const actions: {
             description: string;
             required: true;
         };
+        signingSecret: {
+            key: string;
+            label: string;
+            obfuscated: true;
+            description: string;
+            required: false;
+        };
     }, "conversationId" | "smsResponse">;
     createSmsConversation: import("@awell-health/extensions-core").Action<{
         userNumber: {
@@ -883,5 +918,12 @@ export declare const actions: {
             description: string;
             required: true;
         };
+        signingSecret: {
+            key: string;
+            label: string;
+            obfuscated: true;
+            description: string;
+            required: false;
+        };
     }, "conversationId" | "createResponse">;
 };

package/dist/extensions/bland/settings.d.ts

@@ -7,7 +7,15 @@ export declare const settings: {
         description: string;
         required: true;
     };
+    signingSecret: {
+        key: string;
+        label: string;
+        obfuscated: true;
+        description: string;
+        required: false;
+    };
 };
 export declare const SettingsValidationSchema: z.ZodObject<{
     apiKey: z.ZodString;
+    signingSecret: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;

package/dist/extensions/bland/settings.js

@@ -10,8 +10,16 @@ exports.settings = {
         description: '',
         required: true,
     },
+    signingSecret: {
+        key: 'signingSecret',
+        label: 'Webhook signing secret',
+        obfuscated: true,
+        description: 'The webhook signing secret from the Bland dev portal (Account Settings, Keys tab, "Replace Secret"). Bland signs each webhook with an HMAC-SHA256 of the body using it, sent in the `X-Webhook-Signature` header. When set, webhooks that are not signed with it are rejected. When left empty, incoming webhooks are not verified.',
+        required: false,
+    },
 };
 exports.SettingsValidationSchema = zod_1.z.object({
     apiKey: zod_1.z.string().min(1),
+    signingSecret: zod_1.z.string().optional(),
 });
 //# sourceMappingURL=settings.js.map

package/dist/extensions/bland/settings.js.map

@@ -1 +1 @@
-{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../../extensions/bland/settings.ts"],"names":[],"mappings":";;;AACA,6BAAqC;AAExB,QAAA,QAAQ,GAAG;IACtB,MAAM,EAAE;QACN,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,eAAe;QACtB,UAAU,EAAE,IAAI;QAChB,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,IAAI;KACf;CACgC,CAAA;AAEtB,QAAA,wBAAwB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACuB,CAAC,CAAA"}
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../../extensions/bland/settings.ts"],"names":[],"mappings":";;;AACA,6BAAqC;AAExB,QAAA,QAAQ,GAAG;IACtB,MAAM,EAAE;QACN,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,eAAe;QACtB,UAAU,EAAE,IAAI;QAChB,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,IAAI;KACf;IACD,aAAa,EAAE;QACb,GAAG,EAAE,eAAe;QACpB,KAAK,EAAE,wBAAwB;QAC/B,UAAU,EAAE,IAAI;QAChB,WAAW,EACT,qUAAqU;QACvU,QAAQ,EAAE,KAAK;KAChB;CACgC,CAAA;AAEtB,QAAA,wBAAwB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACY,CAAC,CAAA"}

package/dist/extensions/bland/webhooks/CallCompleted/callCompleted.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.callCompleted = void 0;
 const lodash_1 = require("lodash");
+const verifyWebhookSignature_1 = require("../verifyWebhookSignature");
 const dataPoints = {
     callId: {
         key: 'callId',
@@ -33,15 +34,30 @@ exports.callCompleted = {
     dataPoints,
     onEvent: async ({ payload: { payload, rawBody, headers, settings }, onSuccess, onError, }) => {
         var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+        if (!(0, verifyWebhookSignature_1.isWebhookRequestAuthorized)({
+            signingSecret: settings.signingSecret,
+            rawBody,
+            payload,
+            headers,
+        })) {
+            await onError({
+                response: {
+                    statusCode: 401,
+                    message: 'Invalid or missing X-Webhook-Signature header',
+                },
+            });
+            return;
+        }
         const callId = payload === null || payload === void 0 ? void 0 : payload.call_id;
         const awellPatientId = (_c = (_b = (_a = payload === null || payload === void 0 ? void 0 : payload.variables) === null || _a === void 0 ? void 0 : _a.metadata) === null || _b === void 0 ? void 0 : _b.awell_patient_id) !== null && _c !== void 0 ? _c : (_d = payload === null || payload === void 0 ? void 0 : payload.metadata) === null || _d === void 0 ? void 0 : _d.awell_patient_id;
         if ((0, lodash_1.isNil)(callId)) {
-            return await onError({
+            await onError({
                 response: {
                     statusCode: 400,
                     message: 'Missing call_id in payload',
                 },
             });
+            return;
         }
         await onSuccess({
             data_points: {

package/dist/extensions/bland/webhooks/CallCompleted/callCompleted.js.map

@@ -1 +1 @@
-{"version":3,"file":"callCompleted.js","sourceRoot":"","sources":["../../../../../extensions/bland/webhooks/CallCompleted/callCompleted.ts"],"names":[],"mappings":";;;AAAA,mCAA8B;AAQ9B,MAAM,UAAU,GAAG;IACjB,MAAM,EAAE;QACN,GAAG,EAAE,QAAQ;QACb,SAAS,EAAE,QAAQ;KACpB;IACD,SAAS,EAAE;QACT,GAAG,EAAE,WAAW;QAChB,SAAS,EAAE,SAAS;KACrB;IACD,MAAM,EAAE;QACN,GAAG,EAAE,QAAQ;QACb,SAAS,EAAE,QAAQ;KACpB;IACD,UAAU,EAAE;QACV,GAAG,EAAE,YAAY;QACjB,SAAS,EAAE,QAAQ;KACpB;IACD,YAAY,EAAE;QACZ,GAAG,EAAE,cAAc;QACnB,SAAS,EAAE,QAAQ;KACpB;IACD,UAAU,EAAE;QACV,GAAG,EAAE,YAAY;QACjB,SAAS,EAAE,MAAM;KAClB;CAC4C,CAAA;AAElC,QAAA,aAAa,GAItB;IACF,GAAG,EAAE,eAAe;IACpB,UAAU;IACV,OAAO,EAAE,KAAK,EAAE,EACd,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAChD,SAAS,EACT,OAAO,GACR,EAAE,EAAE;;QACH,MAAM,MAAM,GAAG,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAA;QAC/B,MAAM,cAAc,GAClB,MAAA,MAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,0CAAE,QAAQ,0CAAE,gBAAgB,mCAC9C,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,0CAAE,gBAAgB,CAAA;QAErC,IAAI,IAAA,cAAK,EAAC,MAAM,CAAC,EAAE,CAAC;YAClB,OAAO,MAAM,OAAO,CAAC;gBACnB,QAAQ,EAAE;oBACR,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE,4BAA4B;iBACtC;aACF,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,SAAS,CAAC;YACd,WAAW,EAAE;gBACX,MAAM;gBACN,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBACnC;;;mBAGG;gBACH,SAAS,EAAE,MAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,0CAAE,QAAQ,EAAE,mCAAI,EAAE;gBAC/C;;;;;;;;mBAQG;gBACH,MAAM,EAAE,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,mCAAI,EAAE;gBAC7B;;;;;;mBAMG;gBACH,UAAU,EAAE,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW,mCAAI,EAAE;gBACtC;;mBAEG;gBACH,YAAY,EAAE,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,mCAAI,EAAE;aAC3C;YACD,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;SACpE,CAAC,CAAA;IACJ,CAAC;CACF,CAAA"}
+{"version":3,"file":"callCompleted.js","sourceRoot":"","sources":["../../../../../extensions/bland/webhooks/CallCompleted/callCompleted.ts"],"names":[],"mappings":";;;AAAA,mCAA8B;AAM9B,sEAAsE;AAGtE,MAAM,UAAU,GAAG;IACjB,MAAM,EAAE;QACN,GAAG,EAAE,QAAQ;QACb,SAAS,EAAE,QAAQ;KACpB;IACD,SAAS,EAAE;QACT,GAAG,EAAE,WAAW;QAChB,SAAS,EAAE,SAAS;KACrB;IACD,MAAM,EAAE;QACN,GAAG,EAAE,QAAQ;QACb,SAAS,EAAE,QAAQ;KACpB;IACD,UAAU,EAAE;QACV,GAAG,EAAE,YAAY;QACjB,SAAS,EAAE,QAAQ;KACpB;IACD,YAAY,EAAE;QACZ,GAAG,EAAE,cAAc;QACnB,SAAS,EAAE,QAAQ;KACpB;IACD,UAAU,EAAE;QACV,GAAG,EAAE,YAAY;QACjB,SAAS,EAAE,MAAM;KAClB;CAC4C,CAAA;AAElC,QAAA,aAAa,GAItB;IACF,GAAG,EAAE,eAAe;IACpB,UAAU;IACV,OAAO,EAAE,KAAK,EAAE,EACd,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAChD,SAAS,EACT,OAAO,GACR,EAAE,EAAE;;QACH,IACE,CAAC,IAAA,mDAA0B,EAAC;YAC1B,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,OAAO;YACP,OAAO;YACP,OAAO;SACR,CAAC,EACF,CAAC;YACD,MAAM,OAAO,CAAC;gBACZ,QAAQ,EAAE;oBACR,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE,+CAA+C;iBACzD;aACF,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAA;QAC/B,MAAM,cAAc,GAClB,MAAA,MAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,0CAAE,QAAQ,0CAAE,gBAAgB,mCAC9C,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,0CAAE,gBAAgB,CAAA;QAErC,IAAI,IAAA,cAAK,EAAC,MAAM,CAAC,EAAE,CAAC;YAClB,MAAM,OAAO,CAAC;gBACZ,QAAQ,EAAE;oBACR,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE,4BAA4B;iBACtC;aACF,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,MAAM,SAAS,CAAC;YACd,WAAW,EAAE;gBACX,MAAM;gBACN,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBACnC;;;mBAGG;gBACH,SAAS,EAAE,MAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,0CAAE,QAAQ,EAAE,mCAAI,EAAE;gBAC/C;;;;;;;;mBAQG;gBACH,MAAM,EAAE,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,mCAAI,EAAE;gBAC7B;;;;;;mBAMG;gBACH,UAAU,EAAE,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW,mCAAI,EAAE;gBACtC;;mBAEG;gBACH,YAAY,EAAE,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,mCAAI,EAAE;aAC3C;YACD,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;SACpE,CAAC,CAAA;IACJ,CAAC;CACF,CAAA"}

package/dist/extensions/bland/webhooks/CompletedBlandText/completedBlandText.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.completedBlandText = void 0;
 const lodash_1 = require("lodash");
+const verifyWebhookSignature_1 = require("../verifyWebhookSignature");
 const dataPoints = {
     conversationId: {
         key: 'conversationId',
@@ -48,8 +49,22 @@ exports.completedBlandText = {
     key: 'completedBlandText',
     description: 'Triggered when a Bland SMS conversation ends (status webhook with channel "sms").',
     dataPoints,
-    onEvent: async ({ payload: { payload }, onSuccess, onError }) => {
+    onEvent: async ({ payload: { payload, rawBody, headers, settings }, onSuccess, onError, }) => {
         var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m;
+        if (!(0, verifyWebhookSignature_1.isWebhookRequestAuthorized)({
+            signingSecret: settings.signingSecret,
+            rawBody,
+            payload,
+            headers,
+        })) {
+            await onError({
+                response: {
+                    statusCode: 401,
+                    message: 'Invalid or missing X-Webhook-Signature header',
+                },
+            });
+            return;
+        }
         const conversationId = payload === null || payload === void 0 ? void 0 : payload.conversation_id;
         const awellPatientId = (_b = (_a = payload === null || payload === void 0 ? void 0 : payload.metadata) === null || _a === void 0 ? void 0 : _a.awell_patient_id) !== null && _b !== void 0 ? _b : (_d = (_c = payload === null || payload === void 0 ? void 0 : payload.variables) === null || _c === void 0 ? void 0 : _c.metadata) === null || _d === void 0 ? void 0 : _d.awell_patient_id;
         if ((0, lodash_1.isNil)(conversationId)) {

package/dist/extensions/bland/webhooks/CompletedBlandText/completedBlandText.js.map

@@ -1 +1 @@
-{"version":3,"file":"completedBlandText.js","sourceRoot":"","sources":["../../../../../extensions/bland/webhooks/CompletedBlandText/completedBlandText.ts"],"names":[],"mappings":";;;AAAA,mCAA8B;AAQ9B,MAAM,UAAU,GAAG;IACjB,cAAc,EAAE;QACd,GAAG,EAAE,gBAAgB;QACrB,SAAS,EAAE,QAAQ;KACpB;IACD,MAAM,EAAE;QACN,GAAG,EAAE,QAAQ;QACb,SAAS,EAAE,QAAQ;KACpB;IACD,MAAM,EAAE;QACN,GAAG,EAAE,QAAQ;QACb,SAAS,EAAE,QAAQ;KACpB;IACD,UAAU,EAAE;QACV,GAAG,EAAE,YAAY;QACjB,SAAS,EAAE,QAAQ;KACpB;IACD,WAAW,EAAE;QACX,GAAG,EAAE,aAAa;QAClB,SAAS,EAAE,QAAQ;KACpB;IACD,SAAS,EAAE;QACT,GAAG,EAAE,WAAW;QAChB,SAAS,EAAE,QAAQ;KACpB;IACD,YAAY,EAAE;QACZ,GAAG,EAAE,cAAc;QACnB,SAAS,EAAE,QAAQ;KACpB;IACD,UAAU,EAAE;QACV,GAAG,EAAE,YAAY;QACjB,SAAS,EAAE,QAAQ;KACpB;IACD,SAAS,EAAE;QACT,GAAG,EAAE,WAAW;QAChB,SAAS,EAAE,MAAM;KAClB;IACD,kBAAkB,EAAE;QAClB,GAAG,EAAE,oBAAoB;QACzB,SAAS,EAAE,MAAM;KAClB;CAC4C,CAAA;AAElC,QAAA,kBAAkB,GAI3B;IACF,GAAG,EAAE,oBAAoB;IACzB,WAAW,EACT,mFAAmF;IACrF,UAAU;IACV,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;;QAC9D,MAAM,cAAc,GAAG,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,eAAe,CAAA;QAC/C,MAAM,cAAc,GAClB,MAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,0CAAE,gBAAgB,mCACnC,MAAC,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,0CAAE,QAA+C,0CAChE,gBAAgB,CAAA;QAEtB,IAAI,IAAA,cAAK,EAAC,cAAc,CAAC,EAAE,CAAC;YAC1B,MAAM,OAAO,CAAC;gBACZ,QAAQ,EAAE;oBACR,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE,oCAAoC;iBAC9C;aACF,CAAC,CAAC;YAAC,OAAO;QACb,CAAC;QAED,MAAM,SAAS,CAAC;YACd,WAAW,EAAE;gBACX,cAAc;gBACd;;mBAEG;gBACH,MAAM,EAAE,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,mCAAI,EAAE;gBAC7B;;;mBAGG;gBACH,MAAM,EAAE,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,mCAAI,EAAE;gBAC7B,UAAU,EAAE,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,YAAY,mCAAI,EAAE;gBACvC,WAAW,EAAE,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,YAAY,mCAAI,EAAE;gBACxC,SAAS,EAAE,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,UAAU,mCAAI,EAAE;gBACpC,YAAY,EAAE,MAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,0CAAE,QAAQ,EAAE,mCAAI,EAAE;gBACtD;;;mBAGG;gBACH,UAAU,EAAE,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,uBAAuB,mCAAI,EAAE;gBAClD;;;mBAGG;gBACH,SAAS,EAAE,IAAA,cAAK,EAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,CAAC;oBAClC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC;gBACrC,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;aAC5C;YACD,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;SACpE,CAAC,CAAA;IACJ,CAAC;CACF,CAAA"}
+{"version":3,"file":"completedBlandText.js","sourceRoot":"","sources":["../../../../../extensions/bland/webhooks/CompletedBlandText/completedBlandText.ts"],"names":[],"mappings":";;;AAAA,mCAA8B;AAM9B,sEAAsE;AAGtE,MAAM,UAAU,GAAG;IACjB,cAAc,EAAE;QACd,GAAG,EAAE,gBAAgB;QACrB,SAAS,EAAE,QAAQ;KACpB;IACD,MAAM,EAAE;QACN,GAAG,EAAE,QAAQ;QACb,SAAS,EAAE,QAAQ;KACpB;IACD,MAAM,EAAE;QACN,GAAG,EAAE,QAAQ;QACb,SAAS,EAAE,QAAQ;KACpB;IACD,UAAU,EAAE;QACV,GAAG,EAAE,YAAY;QACjB,SAAS,EAAE,QAAQ;KACpB;IACD,WAAW,EAAE;QACX,GAAG,EAAE,aAAa;QAClB,SAAS,EAAE,QAAQ;KACpB;IACD,SAAS,EAAE;QACT,GAAG,EAAE,WAAW;QAChB,SAAS,EAAE,QAAQ;KACpB;IACD,YAAY,EAAE;QACZ,GAAG,EAAE,cAAc;QACnB,SAAS,EAAE,QAAQ;KACpB;IACD,UAAU,EAAE;QACV,GAAG,EAAE,YAAY;QACjB,SAAS,EAAE,QAAQ;KACpB;IACD,SAAS,EAAE;QACT,GAAG,EAAE,WAAW;QAChB,SAAS,EAAE,MAAM;KAClB;IACD,kBAAkB,EAAE;QAClB,GAAG,EAAE,oBAAoB;QACzB,SAAS,EAAE,MAAM;KAClB;CAC4C,CAAA;AAElC,QAAA,kBAAkB,GAI3B;IACF,GAAG,EAAE,oBAAoB;IACzB,WAAW,EACT,mFAAmF;IACrF,UAAU;IACV,OAAO,EAAE,KAAK,EAAE,EACd,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAChD,SAAS,EACT,OAAO,GACR,EAAE,EAAE;;QACH,IACE,CAAC,IAAA,mDAA0B,EAAC;YAC1B,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,OAAO;YACP,OAAO;YACP,OAAO;SACR,CAAC,EACF,CAAC;YACD,MAAM,OAAO,CAAC;gBACZ,QAAQ,EAAE;oBACR,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE,+CAA+C;iBACzD;aACF,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,MAAM,cAAc,GAAG,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,eAAe,CAAA;QAC/C,MAAM,cAAc,GAClB,MAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,0CAAE,gBAAgB,mCACnC,MAAC,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,0CAAE,QAA+C,0CAChE,gBAAgB,CAAA;QAEtB,IAAI,IAAA,cAAK,EAAC,cAAc,CAAC,EAAE,CAAC;YAC1B,MAAM,OAAO,CAAC;gBACZ,QAAQ,EAAE;oBACR,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE,oCAAoC;iBAC9C;aACF,CAAC,CAAC;YAAC,OAAO;QACb,CAAC;QAED,MAAM,SAAS,CAAC;YACd,WAAW,EAAE;gBACX,cAAc;gBACd;;mBAEG;gBACH,MAAM,EAAE,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,mCAAI,EAAE;gBAC7B;;;mBAGG;gBACH,MAAM,EAAE,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,mCAAI,EAAE;gBAC7B,UAAU,EAAE,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,YAAY,mCAAI,EAAE;gBACvC,WAAW,EAAE,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,YAAY,mCAAI,EAAE;gBACxC,SAAS,EAAE,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,UAAU,mCAAI,EAAE;gBACpC,YAAY,EAAE,MAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,0CAAE,QAAQ,EAAE,mCAAI,EAAE;gBACtD;;;mBAGG;gBACH,UAAU,EAAE,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,uBAAuB,mCAAI,EAAE;gBAClD;;;mBAGG;gBACH,SAAS,EAAE,IAAA,cAAK,EAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,CAAC;oBAClC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC;gBACrC,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;aAC5C;YACD,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;SACpE,CAAC,CAAA;IACJ,CAAC;CACF,CAAA"}

package/dist/extensions/bland/webhooks/index.d.ts

@@ -6,6 +6,13 @@ export declare const webhooks: (import("@awell-health/extensions-core").Webhook<
         description: string;
         required: true;
     };
+    signingSecret: {
+        key: string;
+        label: string;
+        obfuscated: true;
+        description: string;
+        required: false;
+    };
 }> | import("@awell-health/extensions-core").Webhook<"status" | "reason" | "pathwayId" | "variables" | "userNumber" | "agentNumber" | "conversationId" | "messageCount" | "transcript" | "conversationObject", import("./CompletedBlandText/types").CompletedBlandTextWebhookPayload, {
     apiKey: {
         key: string;
@@ -14,4 +21,11 @@ export declare const webhooks: (import("@awell-health/extensions-core").Webhook<
         description: string;
         required: true;
     };
+    signingSecret: {
+        key: string;
+        label: string;
+        obfuscated: true;
+        description: string;
+        required: false;
+    };
 }>)[];

package/dist/extensions/bland/webhooks/verifyWebhookSignature.d.ts

@@ -0,0 +1,26 @@
+import { type IncomingHttpHeaders } from 'http';
+/**
+ * The header Bland delivers the webhook signature in.
+ * https://docs.bland.ai/tutorials/webhook-signing
+ */
+export declare const BLAND_SIGNATURE_HEADER = "x-webhook-signature";
+/**
+ * Verifies a Bland webhook request.
+ *
+ * Bland signs each webhook with an HMAC-SHA256 of the body using the account's
+ * webhook secret, hex-encoded in `X-Webhook-Signature`. Bland's own example
+ * verifies against `JSON.stringify(req.body)`, the re-serialized body, so a
+ * signature over either the raw bytes or that re-serialization is accepted:
+ * both need the secret to produce. The docs describe no timestamp, so a
+ * captured request can be replayed; the signature proves who sent it, not when.
+ * https://docs.bland.ai/tutorials/webhook-signing
+ *
+ * @returns `true` if the request is authorized: either no signing secret is
+ * configured (verification disabled) or the signature is present and valid.
+ */
+export declare const isWebhookRequestAuthorized: ({ signingSecret, rawBody, payload, headers, }: {
+    signingSecret: string | undefined;
+    rawBody: Buffer;
+    payload: unknown;
+    headers: IncomingHttpHeaders;
+}) => boolean;

package/dist/extensions/bland/webhooks/verifyWebhookSignature.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isWebhookRequestAuthorized = exports.BLAND_SIGNATURE_HEADER = void 0;
+const crypto_1 = require("crypto");
+const lodash_1 = require("lodash");
+/**
+ * The header Bland delivers the webhook signature in.
+ * https://docs.bland.ai/tutorials/webhook-signing
+ */
+exports.BLAND_SIGNATURE_HEADER = 'x-webhook-signature';
+const hmacHex = (secret, data) => (0, crypto_1.createHmac)('sha256', secret).update(data).digest('hex');
+/** Constant-time comparison; `timingSafeEqual` throws on different lengths. */
+const sameHex = (expected, received) => {
+    const a = Buffer.from(expected.toLowerCase());
+    const b = Buffer.from(received.trim().toLowerCase());
+    return a.length === b.length && (0, crypto_1.timingSafeEqual)(a, b);
+};
+/**
+ * Verifies a Bland webhook request.
+ *
+ * Bland signs each webhook with an HMAC-SHA256 of the body using the account's
+ * webhook secret, hex-encoded in `X-Webhook-Signature`. Bland's own example
+ * verifies against `JSON.stringify(req.body)`, the re-serialized body, so a
+ * signature over either the raw bytes or that re-serialization is accepted:
+ * both need the secret to produce. The docs describe no timestamp, so a
+ * captured request can be replayed; the signature proves who sent it, not when.
+ * https://docs.bland.ai/tutorials/webhook-signing
+ *
+ * @returns `true` if the request is authorized: either no signing secret is
+ * configured (verification disabled) or the signature is present and valid.
+ */
+const isWebhookRequestAuthorized = ({ signingSecret, rawBody, payload, headers, }) => {
+    const secret = signingSecret === null || signingSecret === void 0 ? void 0 : signingSecret.trim();
+    // When no signing secret is configured, signature verification is disabled.
+    if ((0, lodash_1.isNil)(secret) || secret.length === 0) {
+        return true;
+    }
+    const header = headers[exports.BLAND_SIGNATURE_HEADER];
+    const signature = Array.isArray(header) ? header[0] : header;
+    if ((0, lodash_1.isNil)(signature) || signature.length === 0) {
+        return false;
+    }
+    if (sameHex(hmacHex(secret, rawBody), signature)) {
+        return true;
+    }
+    return (payload !== undefined &&
+        sameHex(hmacHex(secret, JSON.stringify(payload)), signature));
+};
+exports.isWebhookRequestAuthorized = isWebhookRequestAuthorized;
+//# sourceMappingURL=verifyWebhookSignature.js.map

package/dist/extensions/bland/webhooks/verifyWebhookSignature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyWebhookSignature.js","sourceRoot":"","sources":["../../../../extensions/bland/webhooks/verifyWebhookSignature.ts"],"names":[],"mappings":";;;AAAA,mCAAoD;AAEpD,mCAA8B;AAE9B;;;GAGG;AACU,QAAA,sBAAsB,GAAG,qBAAqB,CAAA;AAE3D,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,IAAqB,EAAU,EAAE,CAChE,IAAA,mBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAEzD,+EAA+E;AAC/E,MAAM,OAAO,GAAG,CAAC,QAAgB,EAAE,QAAgB,EAAW,EAAE;IAC9D,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAA;IAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;IACpD,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,IAAA,wBAAe,EAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AACvD,CAAC,CAAA;AAED;;;;;;;;;;;;;GAaG;AACI,MAAM,0BAA0B,GAAG,CAAC,EACzC,aAAa,EACb,OAAO,EACP,OAAO,EACP,OAAO,GAMR,EAAW,EAAE;IACZ,MAAM,MAAM,GAAG,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,IAAI,EAAE,CAAA;IACpC,4EAA4E;IAC5E,IAAI,IAAA,cAAK,EAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,8BAAsB,CAAC,CAAA;IAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IAC5D,IAAI,IAAA,cAAK,EAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;QACjD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,CACL,OAAO,KAAK,SAAS;QACrB,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,CAC7D,CAAA;AACH,CAAC,CAAA;AA9BY,QAAA,0BAA0B,8BA8BtC"}

package/dist/extensions/markdown.json

@@ -20,8 +20,8 @@
     "changelog": "# CHANGELOG"
   },
   "bland": {
-    "readme": "---\ntitle: Bland.ai\ndescription: To do\n---\n\n# Bland.ai\n\nWith Bland.ai you can build, test, and deploy AI phone calling agents. \n\n## Extension settings\n\nTo set up this extension, you will need to provide an API key for Bland.\n\n## Actions\n\n### Send call (with Pathway)\n\nInitiates an AI phone call using a simple prompt or a conversational pathway agent built on the Bland platform. This action is asynchronous—it triggers a call request in Bland, which queues the call. Note that the action only confirms that Bland has received the request; it does not wait for the call to complete or handle any callbacks from Bland.\n\nAwell lets you specify both the data you want to send to Bland and the structured data you’d like to receive in return. This is achieved by defining the request data for outgoing information and an analysis schema for the structured data you’ll get back.\n\n#### Request data\n\nAny JSON you put in here will be visible to the AI agent during the call - and can also be referenced with Prompt Variables.\n\nFor example, let’s say in the action you want to programmatically set the name of the person you’re calling. You could set request data to:\n\n```json\n{\n    \"name\": \"John Doe\",\n}\n```\n\n[Also see Bland documentation.](https://docs.bland.ai/api-v1/post/calls)\n\n#### Analysis schema\n\nDefine a JSON schema for how you want to get information about the call - information like email addresses, names, appointment times or any other type of custom data.\n\nFor example, if you wanted to retrieve this information from the call:\n\n```json\n{\n    \"email_address\": \"email\",\n    \"first_name\": \"string\",\n    \"last_name\": \"string\",\n    \"wants_to_book_appointment\": \"boolean\",\n    \"appointment_time\": \"YYYY-MM-DD HH:MM:SS\"\n}\n```\n\nWhen retrieving the call details, Bland will return data about the call in the following format:\n\n```json\n{\n  \"analysis\": {\n    \"email_address\": \"johndoe@gmail.com\",\n    \"first_name\": \"John\",\n    \"last_name\": \"Doe\",\n    \"wants_to_book_appointment\": true,\n    \"appointment_time\": \"2024-01-01 12:00:00\"\n  }\n}\n```\n\n[Also see Bland documentation.](https://docs.bland.ai/api-v1/post/calls)\n\n### Get call details\n\nRetrieve the details of a call based on the provider call ID.",
-    "changelog": "# CHANGELOG\n\n## Unreleased\n\n- Added `sendSms` action: send an SMS immediately via Bland `POST /v1/sms/send`. The agent message is optional; when omitted, the pathway configured on the agent number generates the message.\n- Added `createSmsConversation` action: seed an SMS conversation positioned at pathway state via Bland `POST /v1/sms/create` without sending a message.\n- Added optional timeout fields to `sendSms` (`time_out`, `timeout_message`, `warning_time`, `warning_message`): per-conversation overrides for Bland's silence-timeout flow.\n- Added `completedBlandText` webhook: triggered when a Bland SMS conversation ends. Maps conversation data (status, reason, transcript, pathway variables) to data points and resolves the patient via the `awell_patient_id` echoed back in metadata.\n"
+    "readme": "---\ntitle: Bland.ai\ndescription: To do\n---\n\n# Bland.ai\n\nWith Bland.ai you can build, test, and deploy AI phone calling agents. \n\n## Extension settings\n\nTo set up this extension, you will need to provide an API key for Bland.\n\nOptionally, add the **Webhook signing secret** to have Awell verify that webhooks really come from Bland. Create it in the Bland dev portal under Account Settings, Keys tab, \"Replace Secret\" (it is shown only once). Bland then signs each webhook with an HMAC-SHA256 of the body using the secret and sends the hex digest in the `X-Webhook-Signature` header. Awell recomputes it and rejects a webhook with no signature or a wrong one with a `401`. When the setting is empty, webhooks are not verified.\n\nThe signature proves who sent a webhook, not when: Bland's documentation describes no timestamp, so a captured request could be sent again. See [Bland's webhook signing guide](https://docs.bland.ai/tutorials/webhook-signing).\n\n## Actions\n\n### Send call (with Pathway)\n\nInitiates an AI phone call using a simple prompt or a conversational pathway agent built on the Bland platform. This action is asynchronous—it triggers a call request in Bland, which queues the call. Note that the action only confirms that Bland has received the request; it does not wait for the call to complete or handle any callbacks from Bland.\n\nAwell lets you specify both the data you want to send to Bland and the structured data you’d like to receive in return. This is achieved by defining the request data for outgoing information and an analysis schema for the structured data you’ll get back.\n\n#### Request data\n\nAny JSON you put in here will be visible to the AI agent during the call - and can also be referenced with Prompt Variables.\n\nFor example, let’s say in the action you want to programmatically set the name of the person you’re calling. You could set request data to:\n\n```json\n{\n    \"name\": \"John Doe\",\n}\n```\n\n[Also see Bland documentation.](https://docs.bland.ai/api-v1/post/calls)\n\n#### Analysis schema\n\nDefine a JSON schema for how you want to get information about the call - information like email addresses, names, appointment times or any other type of custom data.\n\nFor example, if you wanted to retrieve this information from the call:\n\n```json\n{\n    \"email_address\": \"email\",\n    \"first_name\": \"string\",\n    \"last_name\": \"string\",\n    \"wants_to_book_appointment\": \"boolean\",\n    \"appointment_time\": \"YYYY-MM-DD HH:MM:SS\"\n}\n```\n\nWhen retrieving the call details, Bland will return data about the call in the following format:\n\n```json\n{\n  \"analysis\": {\n    \"email_address\": \"johndoe@gmail.com\",\n    \"first_name\": \"John\",\n    \"last_name\": \"Doe\",\n    \"wants_to_book_appointment\": true,\n    \"appointment_time\": \"2024-01-01 12:00:00\"\n  }\n}\n```\n\n[Also see Bland documentation.](https://docs.bland.ai/api-v1/post/calls)\n\n### Get call details\n\nRetrieve the details of a call based on the provider call ID.",
+    "changelog": "# CHANGELOG\n\n## Unreleased\n\n- Added the optional **Webhook signing secret** setting. When set, the `callCompleted` and `completedBlandText` webhooks verify Bland's `X-Webhook-Signature` header (an HMAC-SHA256 of the body, hex-encoded) and reject a request with no signature or a wrong one with a `401`. When empty, nothing changes: webhooks are not verified, as before.\n- Added `sendSms` action: send an SMS immediately via Bland `POST /v1/sms/send`. The agent message is optional; when omitted, the pathway configured on the agent number generates the message.\n- Added `createSmsConversation` action: seed an SMS conversation positioned at pathway state via Bland `POST /v1/sms/create` without sending a message.\n- Added optional timeout fields to `sendSms` (`time_out`, `timeout_message`, `warning_time`, `warning_message`): per-conversation overrides for Bland's silence-timeout flow.\n- Added `completedBlandText` webhook: triggered when a Bland SMS conversation ends. Maps conversation data (status, reason, transcript, pathway variables) to data points and resolves the patient via the `awell_patient_id` echoed back in metadata.\n"
   },
   "braze": {
     "readme": "---\ntitle: Braze\ndescription: Braze is a customer engagement platform that helps you communicate with your patients.\n---\n\n# Braze\n\nBraze is a comprehensive customer engagement platform that specializes in helping businesses connect with their users through personalized messaging channels.\n\n## Extension settings\n\nAn api key and the REST Endpoint URL are needed to be provided in order for the extension to authenticate with Braze's API. \n\nAn app ID can also be specified via the extension settings or the action field. Actions requiring an app ID to be provided will throw an error if no app ID is provided via the extension settings or the action field. If both are provided, the app ID from the action field will be used.\n\nList of URLs can be found [here](https://www.braze.com/docs/api/basics/#endpoints) - make sure it's the REST Endpoint URL. Documentation on API keys can be found [here](https://www.braze.com/docs/api/basics/#about-rest-api-keys).\n\n## Supported Actins\n\n### Send SMS\n\nSend an immediate SMS message to a specified user\n\nRequired permissions: `messages.send`\n\n### Schedule SMS\n\nSchedule an SMS message to be sent at a specific time\n\nRequired permissions: `messages.schedule.create`\n\n### Send Email\n\nSend an immediate email to a specified user\n\nRequired permissions: `messages.send`\n\n### Schedule Email\n\nSchedule an email to be sent at a specific time\n\nRequired permissions: `messages.schedule.create`\n\n### Send Email Using Template\n\nSend an email using a pre-defined Braze template\n\nRequired permissions: `messages.send`\n\n### Send campaign\n\nSend a campaign message.\n\nRequired permissions: `campaigns.trigger.send`\n",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awell-health/awell-extensions",
-  "version": "2.1.205",
+  "version": "2.1.206",
   "packageManager": "yarn@4.5.3",
   "main": "dist/src/index.js",
   "repository": {