@isnap/sdk 1.4.0-next.204 → 2.0.0-next.205

package/CHANGELOG.md

@@ -28,6 +28,9 @@ All notable changes to `@isnap/sdk` will be documented in this file. The format
 - `coverage.test.ts` guard: for every `/v1` operation in the published `openapi.json`, asserts an SDK wrapper exists (or is listed as deliberately un-wrapped, each with a reason). The expected set is derived from the spec, not hand-written, so a newly published endpoint reddens the suite until it is wrapped.
 - `verifyWebhook` verifies the **Standard Webhooks** headers (`webhook-id` / `webhook-timestamp` / `webhook-signature`, WHA-3648) whenever `webhook-signature` is present, and falls back to the `X-iSnap-Signature` / `X-iSnap-Timestamp` scheme otherwise (additive, MINOR — `1.4.0`). Every iSnap delivery now carries both header sets over the same body, so existing callers keep working unchanged; the same secret string (`whsec_…`, or a legacy `whs_…`) and the same `[newSecret, oldSecret]` rotation array work on both paths, and the tolerance applies to both. When the standard header is present it decides: a wrong standard signature is rejected even if the legacy one would pass. The Standard Webhooks key is the base64 decoding of the secret without its prefix, which is what every official Standard Webhooks library derives from the same `whsec_` string.
 
+### Removed
+- **`verifyWebhook` verifies the Standard Webhooks headers only** (`webhook-id` / `webhook-timestamp` / `webhook-signature`, WHA-3658) — breaking, MAJOR (`2.0.0`). The fallback to the `X-iSnap-Signature` / `X-iSnap-Timestamp` pair is removed, because iSnap no longer sends those headers: a request that carries only them is now rejected with `WebhookSignatureError` (`Missing webhook-id header`). The key derivation no longer strips a `whs_` prefix either; only `whsec_` secrets, the only kind iSnap mints, verify. Unchanged: the `[newSecret, oldSecret]` rotation array, the `tolerance` option and its 300 s default, case-insensitive header reads, and the return value. A caller that already receives iSnap deliveries needs no code change, since every delivery since `1.4.0` carries the standard headers.
+
 ### Changed
 - `src/generated/openapi.d.ts` is now generated from the **published** contract. `packages/backend/openapi.json` carries only the partner-facing `/v1/*` surface, so the internal operator routes (`/admin`, `/va`, `/farm-ops`, `/kam`, `/auth`, …) and the bridge-only `/v1/device/*` contract — plus every schema reachable only from them — are no longer emitted into the SDK types. Those routes are the dashboard, the ops back-office and the device bridge; none of them is part of the partner contract this SDK wraps, and no `ISnapClient` method referenced their types, so no documented method changes shape.
 - **`AppDownloadEntry.version` is now `string | null`** (API `1.15.0`, WHA-2538) — source-breaking for a consumer that renders `apps.manifest()`'s `version` without narrowing, which is the point. The field used to be a per-deployment configured string tied to no artifact: staging advertised `0.1.0-staging` for both platforms while the Mac ran `0.0.209` and the update channel published `0.0.x`, so the number could not be installed and the two platforms agreed only because both read one env value. It is now read from the release feed beside the artifact the download URL resolves to, and is `null` when that feed publishes nothing. Render the absence; do not substitute a number, and do not treat `null` as an error. It is also no longer the same string `byod.pair` returns as `bridge_version`.

package/dist/version.d.ts

@@ -1,3 +1,3 @@
-export declare const SDK_VERSION = "1.4.0";
+export declare const SDK_VERSION = "2.0.0";
 export declare const MIN_API_VERSION = "2.0.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -4,7 +4,7 @@
 // contract surface. Hand-maintained: no build or publish step derives this
 // from `package.json`, so it MUST be bumped in the same commit as the
 // `version` field there. `src/version.test.ts` fails CI when they disagree.
-export const SDK_VERSION = '1.4.0';
+export const SDK_VERSION = '2.0.0';
 // Minimum API version the SDK considers compatible. Reference-only
 // today: the client exposes `client.version()` to read `/v1/version` on
 // demand, but does NOT call it automatically at first request as a

package/dist/webhooks/verify.d.ts

@@ -15,21 +15,16 @@ export interface VerifyWebhookOptions {
 }
 type WebhookHeaders = Record<string, string | string[] | undefined> | Headers;
 /**
- * Verify an incoming webhook delivery. Every iSnap delivery carries two
- * signatures over the same body, and this checks one of them:
+ * Verify an incoming webhook delivery against its **Standard Webhooks**
+ * signature (https://www.standardwebhooks.com): `webhook-id`,
+ * `webhook-timestamp`, and `webhook-signature` carrying `v1,` + base64
+ * `HMAC-SHA256(key, "<webhook-id>.<webhook-timestamp>.<rawBody>")`, where
+ * the key is the base64 decoding of the secret without its `whsec_`
+ * prefix. Pass the secret string exactly as the dashboard shows it.
  *
- * - **Standard Webhooks** (https://www.standardwebhooks.com), checked
- *   whenever a `webhook-signature` header is present: `webhook-id`,
- *   `webhook-timestamp`, and `webhook-signature` carrying `v1,` + base64
- *   `HMAC-SHA256(key, "<webhook-id>.<webhook-timestamp>.<rawBody>")`,
- *   where the key is the base64 decoding of the secret without its
- *   `whsec_` (or legacy `whs_`) prefix.
- * - **The iSnap scheme**, the fallback when there is no
- *   `webhook-signature`: `X-iSnap-Signature` carries the hex-encoded
- *   `HMAC-SHA256(secret, "<timestamp>.<rawBody>")` and `X-iSnap-Timestamp`
- *   the unix-second issuance time.
- *
- * Both paths take the secret string exactly as the dashboard shows it.
+ * This is the only scheme iSnap signs with. The former `X-iSnap-Signature`
+ * / `X-iSnap-Timestamp` pair is no longer sent and no longer accepted: a
+ * request that carries only those headers is rejected.
  *
  * Throws `WebhookSignatureError` on missing headers, malformed
  * timestamp, expired timestamp (outside `tolerance`), or signature
@@ -45,7 +40,7 @@ type WebhookHeaders = Record<string, string | string[] | undefined> | Headers;
  *
  * **Consumers MUST dedupe by `event.event_id`** (also sent as `webhook-id`)
  * — retries replay the same envelope (same `event_id`, same body,
- * refreshed timestamp and signatures). Without consumer-side dedup, an
+ * refreshed timestamp and signature). Without consumer-side dedup, an
  * at-least-once delivery model produces duplicate side-effects on the
  * partner system.
  */

package/dist/webhooks/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/webhooks/verify.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAIlD,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED,KAAK,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,OAAO,CAAA;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EAClC,OAAO,GAAE,oBAAyB,GACjC,gBAAgB,CAKlB"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/webhooks/verify.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAIlD,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED,KAAK,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,OAAO,CAAA;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EAClC,OAAO,GAAE,oBAAyB,GACjC,gBAAgB,CA6ClB"}

package/dist/webhooks/verify.js

@@ -3,21 +3,16 @@ import { WebhookSignatureError } from '../errors.js';
 import { parseWebhookEvent } from './parse.js';
 const DEFAULT_TOLERANCE_SECONDS = 300;
 /**
- * Verify an incoming webhook delivery. Every iSnap delivery carries two
- * signatures over the same body, and this checks one of them:
+ * Verify an incoming webhook delivery against its **Standard Webhooks**
+ * signature (https://www.standardwebhooks.com): `webhook-id`,
+ * `webhook-timestamp`, and `webhook-signature` carrying `v1,` + base64
+ * `HMAC-SHA256(key, "<webhook-id>.<webhook-timestamp>.<rawBody>")`, where
+ * the key is the base64 decoding of the secret without its `whsec_`
+ * prefix. Pass the secret string exactly as the dashboard shows it.
  *
- * - **Standard Webhooks** (https://www.standardwebhooks.com), checked
- *   whenever a `webhook-signature` header is present: `webhook-id`,
- *   `webhook-timestamp`, and `webhook-signature` carrying `v1,` + base64
- *   `HMAC-SHA256(key, "<webhook-id>.<webhook-timestamp>.<rawBody>")`,
- *   where the key is the base64 decoding of the secret without its
- *   `whsec_` (or legacy `whs_`) prefix.
- * - **The iSnap scheme**, the fallback when there is no
- *   `webhook-signature`: `X-iSnap-Signature` carries the hex-encoded
- *   `HMAC-SHA256(secret, "<timestamp>.<rawBody>")` and `X-iSnap-Timestamp`
- *   the unix-second issuance time.
- *
- * Both paths take the secret string exactly as the dashboard shows it.
+ * This is the only scheme iSnap signs with. The former `X-iSnap-Signature`
+ * / `X-iSnap-Timestamp` pair is no longer sent and no longer accepted: a
+ * request that carries only those headers is rejected.
  *
  * Throws `WebhookSignatureError` on missing headers, malformed
  * timestamp, expired timestamp (outside `tolerance`), or signature
@@ -33,48 +28,11 @@ const DEFAULT_TOLERANCE_SECONDS = 300;
  *
  * **Consumers MUST dedupe by `event.event_id`** (also sent as `webhook-id`)
  * — retries replay the same envelope (same `event_id`, same body,
- * refreshed timestamp and signatures). Without consumer-side dedup, an
+ * refreshed timestamp and signature). Without consumer-side dedup, an
  * at-least-once delivery model produces duplicate side-effects on the
  * partner system.
  */
 export function verifyWebhook(rawBody, headers, secret, options = {}) {
-    if (getHeader(headers, 'webhook-signature') !== null) {
-        return verifyStandardWebhook(rawBody, headers, secret, options);
-    }
-    return verifyISnapWebhook(rawBody, headers, secret, options);
-}
-function verifyISnapWebhook(rawBody, headers, secret, options) {
-    const sigHeader = getHeader(headers, 'x-isnap-signature');
-    if (!sigHeader) {
-        throw new WebhookSignatureError('Missing X-iSnap-Signature header');
-    }
-    const tsHeader = getHeader(headers, 'x-isnap-timestamp');
-    if (!tsHeader) {
-        throw new WebhookSignatureError('Missing X-iSnap-Timestamp header');
-    }
-    const timestamp = checkTimestamp(tsHeader, 'X-iSnap-Timestamp', options);
-    const candidates = secretCandidates(secret);
-    const provided = decodeHex(sigHeader);
-    if (!provided) {
-        throw new WebhookSignatureError('X-iSnap-Signature is not valid hex');
-    }
-    const signedPayload = `${timestamp}.${rawBody}`;
-    // Multi-secret loop returns early on first match — this is a minor
-    // timing side-channel during the rotate-secret grace window (an
-    // attacker who controls request timing could distinguish "matched first
-    // candidate" from "matched second"). Practical exploit value is near
-    // zero: knowing which secret matched does not help forge signatures
-    // for either secret. Worth revisiting if real partners run rotation
-    // through hostile networks.
-    for (const candidate of candidates) {
-        const expected = createHmac('sha256', candidate).update(signedPayload).digest();
-        if (provided.length === expected.length && timingSafeEqual(provided, expected)) {
-            return parseWebhookEvent(rawBody);
-        }
-    }
-    throw new WebhookSignatureError('Webhook signature did not match any provided secret');
-}
-function verifyStandardWebhook(rawBody, headers, secret, options) {
     const msgId = getHeader(headers, 'webhook-id');
     if (!msgId) {
         throw new WebhookSignatureError('Missing webhook-id header');
@@ -83,12 +41,16 @@ function verifyStandardWebhook(rawBody, headers, secret, options) {
     if (!tsHeader) {
         throw new WebhookSignatureError('Missing webhook-timestamp header');
     }
+    const sigHeader = getHeader(headers, 'webhook-signature');
+    if (!sigHeader) {
+        throw new WebhookSignatureError('Missing webhook-signature header');
+    }
     const timestamp = checkTimestamp(tsHeader, 'webhook-timestamp', options);
     const candidates = secretCandidates(secret);
     // Space-delimited `<version>,<base64>` pairs; only `v1` (HMAC-SHA256)
     // exists today, and a version this SDK does not know is skipped rather
     // than rejected, so a sender adding a scheme does not break verification.
-    const provided = (getHeader(headers, 'webhook-signature') ?? '')
+    const provided = sigHeader
         .split(' ')
         .filter((entry) => entry.startsWith('v1,'))
         .map((entry) => Buffer.from(entry.slice(3), 'base64'));
@@ -96,7 +58,13 @@ function verifyStandardWebhook(rawBody, headers, secret, options) {
         throw new WebhookSignatureError('webhook-signature carries no v1 signature');
     }
     const signedPayload = `${msgId}.${timestamp}.${rawBody}`;
-    // Same early-return trade-off as the iSnap scheme above.
+    // Multi-secret loop returns early on first match — this is a minor
+    // timing side-channel during the rotate-secret grace window (an
+    // attacker who controls request timing could distinguish "matched first
+    // candidate" from "matched second"). Practical exploit value is near
+    // zero: knowing which secret matched does not help forge signatures
+    // for either secret. Worth revisiting if real partners run rotation
+    // through hostile networks.
     for (const candidate of candidates) {
         const expected = createHmac('sha256', standardWebhookKey(candidate))
             .update(signedPayload)
@@ -110,16 +78,12 @@ function verifyStandardWebhook(rawBody, headers, secret, options) {
     throw new WebhookSignatureError('Webhook signature did not match any provided secret');
 }
 // The Standard Webhooks key: the base64 decoding of the secret without its
-// prefix. iSnap secrets are `whsec_` (or, minted by an older rotation,
-// `whs_`) followed by hex, which is valid base64, so the dashboard string
-// works as-is here and in any official Standard Webhooks library (pass a
-// `whs_` secret to those as `whsec_` + the same hex).
+// `whsec_` prefix — what every official Standard Webhooks library derives
+// from the same string. iSnap secrets are `whsec_` followed by hex, which is
+// valid base64, so the dashboard string works as-is here and there.
 function standardWebhookKey(secret) {
-    for (const prefix of ['whsec_', 'whs_']) {
-        if (secret.startsWith(prefix))
-            return Buffer.from(secret.slice(prefix.length), 'base64');
-    }
-    return Buffer.from(secret, 'base64');
+    const encoded = secret.startsWith('whsec_') ? secret.slice('whsec_'.length) : secret;
+    return Buffer.from(encoded, 'base64');
 }
 function checkTimestamp(tsHeader, headerName, options) {
     // Strict integer-only check — `Number.parseInt` would happily accept
@@ -171,11 +135,6 @@ function getHeader(headers, name) {
     }
     return null;
 }
-function decodeHex(hex) {
-    if (!/^[0-9a-fA-F]+$/.test(hex) || hex.length % 2 !== 0)
-        return null;
-    return Buffer.from(hex, 'hex');
-}
 function defaultNow() {
     return Math.floor(Date.now() / 1000);
 }

package/dist/webhooks/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/webhooks/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAG9C,MAAM,yBAAyB,GAAG,GAAG,CAAA;AAmBrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,OAAuB,EACvB,MAAkC,EAClC,UAAgC,EAAE;IAElC,IAAI,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC,KAAK,IAAI,EAAE,CAAC;QACrD,OAAO,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;AAC9D,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAe,EACf,OAAuB,EACvB,MAAkC,EAClC,OAA6B;IAE7B,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAA;IACzD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAA;IACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAA;IACxE,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAA;IAE3C,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,qBAAqB,CAAC,oCAAoC,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,aAAa,GAAG,GAAG,SAAS,IAAI,OAAO,EAAE,CAAA;IAC/C,mEAAmE;IACnE,gEAAgE;IAChE,wEAAwE;IACxE,qEAAqE;IACrE,oEAAoE;IACpE,oEAAoE;IACpE,4BAA4B;IAC5B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,EAAE,CAAA;QAC/E,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/E,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC;IACH,CAAC;IACD,MAAM,IAAI,qBAAqB,CAAC,qDAAqD,CAAC,CAAA;AACxF,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAe,EACf,OAAuB,EACvB,MAAkC,EAClC,OAA6B;IAE7B,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;IAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,qBAAqB,CAAC,2BAA2B,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAA;IACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAA;IACxE,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAA;IAE3C,sEAAsE;IACtE,uEAAuE;IACvE,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC;SAC7D,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;SAC1C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;IACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,qBAAqB,CAAC,2CAA2C,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,aAAa,GAAG,GAAG,KAAK,IAAI,SAAS,IAAI,OAAO,EAAE,CAAA;IACxD,yDAAyD;IACzD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC;aACjE,MAAM,CAAC,aAAa,CAAC;aACrB,MAAM,EAAE,CAAA;QACX,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjC,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACjF,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAA;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,IAAI,qBAAqB,CAAC,qDAAqD,CAAC,CAAA;AACxF,CAAC;AAED,2EAA2E;AAC3E,uEAAuE;AACvE,0EAA0E;AAC1E,yEAAyE;AACzE,sDAAsD;AACtD,SAAS,kBAAkB,CAAC,MAAc;IACxC,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QACxC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAA;IAC1F,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;AACtC,CAAC;AAED,SAAS,cAAc,CACrB,QAAgB,EAChB,UAAkB,EAClB,OAA6B;IAE7B,qEAAqE;IACrE,uEAAuE;IACvE,qEAAqE;IACrE,wEAAwE;IACxE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,qBAAqB,CAAC,aAAa,UAAU,KAAK,QAAQ,EAAE,CAAC,CAAA;IACzE,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAA;IAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,qBAAqB,CAAC,aAAa,UAAU,KAAK,QAAQ,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,yBAAyB,CAAA;IAChE,sEAAsE;IACtE,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,mEAAmE;IACnE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,qBAAqB,CAC7B,uDAAuD,MAAM,CAAC,SAAS,CAAC,GAAG,CAC5E,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,EAAE,CAAA;IAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,qBAAqB,CAC7B,oCAAoC,SAAS,8BAA8B,MAAM,GAAG,SAAS,IAAI,CAClG,CAAA;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAkC;IAC1D,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IACjE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,qBAAqB,CAAC,+BAA+B,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,OAAuB,EAAE,IAAY;IACtD,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,YAAY,OAAO,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAChC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,KAAK;YAAE,SAAQ;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;QACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;QAC3C,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACpE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;AAChC,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;AACtC,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/webhooks/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAG9C,MAAM,yBAAyB,GAAG,GAAG,CAAA;AAmBrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,OAAuB,EACvB,MAAkC,EAClC,UAAgC,EAAE;IAElC,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;IAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,qBAAqB,CAAC,2BAA2B,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAA;IACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAA;IACzD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAA;IACxE,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAA;IAE3C,sEAAsE;IACtE,uEAAuE;IACvE,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,SAAS;SACvB,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;SAC1C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;IACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,qBAAqB,CAAC,2CAA2C,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,aAAa,GAAG,GAAG,KAAK,IAAI,SAAS,IAAI,OAAO,EAAE,CAAA;IACxD,mEAAmE;IACnE,gEAAgE;IAChE,wEAAwE;IACxE,qEAAqE;IACrE,oEAAoE;IACpE,oEAAoE;IACpE,4BAA4B;IAC5B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC;aACjE,MAAM,CAAC,aAAa,CAAC;aACrB,MAAM,EAAE,CAAA;QACX,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjC,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACjF,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAA;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,IAAI,qBAAqB,CAAC,qDAAqD,CAAC,CAAA;AACxF,CAAC;AAED,2EAA2E;AAC3E,0EAA0E;AAC1E,6EAA6E;AAC7E,oEAAoE;AACpE,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IACpF,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;AACvC,CAAC;AAED,SAAS,cAAc,CACrB,QAAgB,EAChB,UAAkB,EAClB,OAA6B;IAE7B,qEAAqE;IACrE,uEAAuE;IACvE,qEAAqE;IACrE,wEAAwE;IACxE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,qBAAqB,CAAC,aAAa,UAAU,KAAK,QAAQ,EAAE,CAAC,CAAA;IACzE,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAA;IAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,qBAAqB,CAAC,aAAa,UAAU,KAAK,QAAQ,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,yBAAyB,CAAA;IAChE,sEAAsE;IACtE,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,mEAAmE;IACnE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,qBAAqB,CAC7B,uDAAuD,MAAM,CAAC,SAAS,CAAC,GAAG,CAC5E,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,EAAE,CAAA;IAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,qBAAqB,CAC7B,oCAAoC,SAAS,8BAA8B,MAAM,GAAG,SAAS,IAAI,CAClG,CAAA;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAkC;IAC1D,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IACjE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,qBAAqB,CAAC,+BAA+B,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,OAAuB,EAAE,IAAY;IACtD,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,YAAY,OAAO,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAChC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,KAAK;YAAE,SAAQ;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;QACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;QAC3C,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;AACtC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isnap/sdk",
-  "version": "1.4.0-next.204",
+  "version": "2.0.0-next.205",
   "description": "Official TypeScript SDK for the iSnap P2P telephony API",
   "license": "MIT",
   "type": "module",