@isnap/sdk 1.3.0 → 1.4.0-next.203

package/dist/webhooks/verify.js

@@ -3,11 +3,21 @@ import { WebhookSignatureError } from '../errors.js';
 import { parseWebhookEvent } from './parse.js';
 const DEFAULT_TOLERANCE_SECONDS = 300;
 /**
- * Verify an incoming webhook delivery using the iSnap signing scheme:
+ * Verify an incoming webhook delivery. Every iSnap delivery carries two
+ * signatures over the same body, and this checks one of them:
  *
- * - `X-iSnap-Signature` header carries the hex-encoded
- *   `HMAC-SHA256(secret, "<timestamp>.<rawBody>")`
- * - `X-iSnap-Timestamp` header carries the unix-second issuance time
+ * - **Standard Webhooks** (https://www.standardwebhooks.com), checked
+ *   whenever a `webhook-signature` header is present: `webhook-id`,
+ *   `webhook-timestamp`, and `webhook-signature` carrying `v1,` + base64
+ *   `HMAC-SHA256(key, "<webhook-id>.<webhook-timestamp>.<rawBody>")`,
+ *   where the key is the base64 decoding of the secret without its
+ *   `whsec_` (or legacy `whs_`) prefix.
+ * - **The iSnap scheme**, the fallback when there is no
+ *   `webhook-signature`: `X-iSnap-Signature` carries the hex-encoded
+ *   `HMAC-SHA256(secret, "<timestamp>.<rawBody>")` and `X-iSnap-Timestamp`
+ *   the unix-second issuance time.
+ *
+ * Both paths take the secret string exactly as the dashboard shows it.
  *
  * Throws `WebhookSignatureError` on missing headers, malformed
  * timestamp, expired timestamp (outside `tolerance`), or signature
@@ -21,12 +31,19 @@ const DEFAULT_TOLERANCE_SECONDS = 300;
  * Headers may be a `Record<string, string>` (e.g. Express's `req.headers`)
  * or a `Headers` instance — both are read case-insensitively.
  *
- * **Consumers MUST dedupe by `event.event_id`** — retries replay the same
- * envelope (same `event_id`, same body, same signature, refreshed
- * timestamp). Without consumer-side dedup, an at-least-once delivery
- * model produces duplicate side-effects on the partner system.
+ * **Consumers MUST dedupe by `event.event_id`** (also sent as `webhook-id`)
+ * — retries replay the same envelope (same `event_id`, same body,
+ * refreshed timestamp and signatures). Without consumer-side dedup, an
+ * at-least-once delivery model produces duplicate side-effects on the
+ * partner system.
  */
 export function verifyWebhook(rawBody, headers, secret, options = {}) {
+    if (getHeader(headers, 'webhook-signature') !== null) {
+        return verifyStandardWebhook(rawBody, headers, secret, options);
+    }
+    return verifyISnapWebhook(rawBody, headers, secret, options);
+}
+function verifyISnapWebhook(rawBody, headers, secret, options) {
     const sigHeader = getHeader(headers, 'x-isnap-signature');
     if (!sigHeader) {
         throw new WebhookSignatureError('Missing X-iSnap-Signature header');
@@ -35,16 +52,86 @@ export function verifyWebhook(rawBody, headers, secret, options = {}) {
     if (!tsHeader) {
         throw new WebhookSignatureError('Missing X-iSnap-Timestamp header');
     }
+    const timestamp = checkTimestamp(tsHeader, 'X-iSnap-Timestamp', options);
+    const candidates = secretCandidates(secret);
+    const provided = decodeHex(sigHeader);
+    if (!provided) {
+        throw new WebhookSignatureError('X-iSnap-Signature is not valid hex');
+    }
+    const signedPayload = `${timestamp}.${rawBody}`;
+    // Multi-secret loop returns early on first match — this is a minor
+    // timing side-channel during the rotate-secret grace window (an
+    // attacker who controls request timing could distinguish "matched first
+    // candidate" from "matched second"). Practical exploit value is near
+    // zero: knowing which secret matched does not help forge signatures
+    // for either secret. Worth revisiting if real partners run rotation
+    // through hostile networks.
+    for (const candidate of candidates) {
+        const expected = createHmac('sha256', candidate).update(signedPayload).digest();
+        if (provided.length === expected.length && timingSafeEqual(provided, expected)) {
+            return parseWebhookEvent(rawBody);
+        }
+    }
+    throw new WebhookSignatureError('Webhook signature did not match any provided secret');
+}
+function verifyStandardWebhook(rawBody, headers, secret, options) {
+    const msgId = getHeader(headers, 'webhook-id');
+    if (!msgId) {
+        throw new WebhookSignatureError('Missing webhook-id header');
+    }
+    const tsHeader = getHeader(headers, 'webhook-timestamp');
+    if (!tsHeader) {
+        throw new WebhookSignatureError('Missing webhook-timestamp header');
+    }
+    const timestamp = checkTimestamp(tsHeader, 'webhook-timestamp', options);
+    const candidates = secretCandidates(secret);
+    // Space-delimited `<version>,<base64>` pairs; only `v1` (HMAC-SHA256)
+    // exists today, and a version this SDK does not know is skipped rather
+    // than rejected, so a sender adding a scheme does not break verification.
+    const provided = (getHeader(headers, 'webhook-signature') ?? '')
+        .split(' ')
+        .filter((entry) => entry.startsWith('v1,'))
+        .map((entry) => Buffer.from(entry.slice(3), 'base64'));
+    if (provided.length === 0) {
+        throw new WebhookSignatureError('webhook-signature carries no v1 signature');
+    }
+    const signedPayload = `${msgId}.${timestamp}.${rawBody}`;
+    // Same early-return trade-off as the iSnap scheme above.
+    for (const candidate of candidates) {
+        const expected = createHmac('sha256', standardWebhookKey(candidate))
+            .update(signedPayload)
+            .digest();
+        for (const signature of provided) {
+            if (signature.length === expected.length && timingSafeEqual(signature, expected)) {
+                return parseWebhookEvent(rawBody);
+            }
+        }
+    }
+    throw new WebhookSignatureError('Webhook signature did not match any provided secret');
+}
+// The Standard Webhooks key: the base64 decoding of the secret without its
+// prefix. iSnap secrets are `whsec_` (or, minted by an older rotation,
+// `whs_`) followed by hex, which is valid base64, so the dashboard string
+// works as-is here and in any official Standard Webhooks library (pass a
+// `whs_` secret to those as `whsec_` + the same hex).
+function standardWebhookKey(secret) {
+    for (const prefix of ['whsec_', 'whs_']) {
+        if (secret.startsWith(prefix))
+            return Buffer.from(secret.slice(prefix.length), 'base64');
+    }
+    return Buffer.from(secret, 'base64');
+}
+function checkTimestamp(tsHeader, headerName, options) {
     // Strict integer-only check — `Number.parseInt` would happily accept
     // `"1714478400foo"` and silently truncate. The HMAC compare downstream
     // catches the resulting payload mismatch, but rejecting earlier here
     // surfaces a clearer error and avoids one unnecessary HMAC computation.
     if (!/^\d+$/.test(tsHeader)) {
-        throw new WebhookSignatureError(`Malformed X-iSnap-Timestamp: ${tsHeader}`);
+        throw new WebhookSignatureError(`Malformed ${headerName}: ${tsHeader}`);
     }
     const timestamp = Number(tsHeader);
     if (!Number.isFinite(timestamp) || timestamp <= 0) {
-        throw new WebhookSignatureError(`Malformed X-iSnap-Timestamp: ${tsHeader}`);
+        throw new WebhookSignatureError(`Malformed ${headerName}: ${tsHeader}`);
     }
     const tolerance = options.tolerance ?? DEFAULT_TOLERANCE_SECONDS;
     // Validate before use — `Math.abs(...) > NaN` is always false (so the
@@ -59,29 +146,14 @@ export function verifyWebhook(rawBody, headers, secret, options = {}) {
     if (Math.abs(nowSec - timestamp) > tolerance) {
         throw new WebhookSignatureError(`Webhook timestamp is outside the ${tolerance}s tolerance window (drift: ${nowSec - timestamp}s)`);
     }
+    return timestamp;
+}
+function secretCandidates(secret) {
     const candidates = typeof secret === 'string' ? [secret] : secret;
     if (candidates.length === 0) {
         throw new WebhookSignatureError('No webhook secret(s) provided');
     }
-    const provided = decodeHex(sigHeader);
-    if (!provided) {
-        throw new WebhookSignatureError('X-iSnap-Signature is not valid hex');
-    }
-    const signedPayload = `${timestamp}.${rawBody}`;
-    // Multi-secret loop returns early on first match — this is a minor
-    // timing side-channel during the rotate-secret grace window (an
-    // attacker who controls request timing could distinguish "matched first
-    // candidate" from "matched second"). Practical exploit value is near
-    // zero: knowing which secret matched does not help forge signatures
-    // for either secret. Worth revisiting if real partners run rotation
-    // through hostile networks.
-    for (const candidate of candidates) {
-        const expected = createHmac('sha256', candidate).update(signedPayload).digest();
-        if (provided.length === expected.length && timingSafeEqual(provided, expected)) {
-            return parseWebhookEvent(rawBody);
-        }
-    }
-    throw new WebhookSignatureError('Webhook signature did not match any provided secret');
+    return candidates;
 }
 function getHeader(headers, name) {
     if (typeof Headers !== 'undefined' && headers instanceof Headers) {

package/dist/webhooks/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/webhooks/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAG9C,MAAM,yBAAyB,GAAG,GAAG,CAAA;AAiBrC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,OAAgE,EAChE,MAAkC,EAClC,UAAgC,EAAE;IAElC,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAA;IACzD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAA;IACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,CAAC,CAAA;IACrE,CAAC;IACD,qEAAqE;IACrE,uEAAuE;IACvE,qEAAqE;IACrE,wEAAwE;IACxE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,qBAAqB,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAA;IAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,qBAAqB,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAA;IAC7E,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,yBAAyB,CAAA;IAChE,sEAAsE;IACtE,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,mEAAmE;IACnE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,qBAAqB,CAC7B,uDAAuD,MAAM,CAAC,SAAS,CAAC,GAAG,CAC5E,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,EAAE,CAAA;IAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,qBAAqB,CAC7B,oCAAoC,SAAS,8BAA8B,MAAM,GAAG,SAAS,IAAI,CAClG,CAAA;IACH,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IACjE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,qBAAqB,CAAC,+BAA+B,CAAC,CAAA;IAClE,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,qBAAqB,CAAC,oCAAoC,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,aAAa,GAAG,GAAG,SAAS,IAAI,OAAO,EAAE,CAAA;IAC/C,mEAAmE;IACnE,gEAAgE;IAChE,wEAAwE;IACxE,qEAAqE;IACrE,oEAAoE;IACpE,oEAAoE;IACpE,4BAA4B;IAC5B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,EAAE,CAAA;QAC/E,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/E,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC;IACH,CAAC;IACD,MAAM,IAAI,qBAAqB,CAAC,qDAAqD,CAAC,CAAA;AACxF,CAAC;AAED,SAAS,SAAS,CAChB,OAAgE,EAChE,IAAY;IAEZ,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,YAAY,OAAO,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAChC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,KAAK;YAAE,SAAQ;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;QACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;QAC3C,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACpE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;AAChC,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;AACtC,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/webhooks/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAG9C,MAAM,yBAAyB,GAAG,GAAG,CAAA;AAmBrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,OAAuB,EACvB,MAAkC,EAClC,UAAgC,EAAE;IAElC,IAAI,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC,KAAK,IAAI,EAAE,CAAC;QACrD,OAAO,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;AAC9D,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAe,EACf,OAAuB,EACvB,MAAkC,EAClC,OAA6B;IAE7B,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAA;IACzD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAA;IACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAA;IACxE,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAA;IAE3C,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,qBAAqB,CAAC,oCAAoC,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,aAAa,GAAG,GAAG,SAAS,IAAI,OAAO,EAAE,CAAA;IAC/C,mEAAmE;IACnE,gEAAgE;IAChE,wEAAwE;IACxE,qEAAqE;IACrE,oEAAoE;IACpE,oEAAoE;IACpE,4BAA4B;IAC5B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,EAAE,CAAA;QAC/E,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/E,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC;IACH,CAAC;IACD,MAAM,IAAI,qBAAqB,CAAC,qDAAqD,CAAC,CAAA;AACxF,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAe,EACf,OAAuB,EACvB,MAAkC,EAClC,OAA6B;IAE7B,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;IAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,qBAAqB,CAAC,2BAA2B,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAA;IACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAA;IACxE,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAA;IAE3C,sEAAsE;IACtE,uEAAuE;IACvE,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC;SAC7D,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;SAC1C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;IACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,qBAAqB,CAAC,2CAA2C,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,aAAa,GAAG,GAAG,KAAK,IAAI,SAAS,IAAI,OAAO,EAAE,CAAA;IACxD,yDAAyD;IACzD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC;aACjE,MAAM,CAAC,aAAa,CAAC;aACrB,MAAM,EAAE,CAAA;QACX,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjC,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACjF,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAA;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,IAAI,qBAAqB,CAAC,qDAAqD,CAAC,CAAA;AACxF,CAAC;AAED,2EAA2E;AAC3E,uEAAuE;AACvE,0EAA0E;AAC1E,yEAAyE;AACzE,sDAAsD;AACtD,SAAS,kBAAkB,CAAC,MAAc;IACxC,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QACxC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAA;IAC1F,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;AACtC,CAAC;AAED,SAAS,cAAc,CACrB,QAAgB,EAChB,UAAkB,EAClB,OAA6B;IAE7B,qEAAqE;IACrE,uEAAuE;IACvE,qEAAqE;IACrE,wEAAwE;IACxE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,qBAAqB,CAAC,aAAa,UAAU,KAAK,QAAQ,EAAE,CAAC,CAAA;IACzE,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAA;IAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,qBAAqB,CAAC,aAAa,UAAU,KAAK,QAAQ,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,yBAAyB,CAAA;IAChE,sEAAsE;IACtE,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,mEAAmE;IACnE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,qBAAqB,CAC7B,uDAAuD,MAAM,CAAC,SAAS,CAAC,GAAG,CAC5E,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,EAAE,CAAA;IAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,qBAAqB,CAC7B,oCAAoC,SAAS,8BAA8B,MAAM,GAAG,SAAS,IAAI,CAClG,CAAA;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAkC;IAC1D,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IACjE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,qBAAqB,CAAC,+BAA+B,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,OAAuB,EAAE,IAAY;IACtD,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,YAAY,OAAO,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAChC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,KAAK;YAAE,SAAQ;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;QACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;QAC3C,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACpE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;AAChC,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;AACtC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isnap/sdk",
-  "version": "1.3.0",
+  "version": "1.4.0-next.203",
   "description": "Official TypeScript SDK for the iSnap P2P telephony API",
   "license": "MIT",
   "type": "module",