@oneaddress/setup 1.1.9 → 1.2.0

package/README.md

@@ -48,8 +48,8 @@ From the [Partner Portal](https://partners.oneaddress.io) → My Profile → Int
 ## Documentation
 
 - [Partner Portal](https://partners.oneaddress.io)
-- [Protocol Specification](https://github.com/oneaddress-io/oneaddress-app/blob/main/docs/integration/SPEC.md)
-- [Service Level Objectives](https://github.com/oneaddress-io/oneaddress-app/blob/main/docs/integration/SLOS.md)
+- [Protocol Specification](https://github.com/oneaddress-io/oneaddress-app/blob/main/docs/integrations/SPEC.md)
+- [Service Level Objectives](https://github.com/oneaddress-io/oneaddress-app/blob/main/docs/integrations/SLOS.md)
 
 ## Issues
 

package/dist/index.js

@@ -835,7 +835,7 @@ var _R = ["\u2588\u2588\u2588\u2588\u2588\u2588 ", "\u2588\u2588   \u2588\u2588"
 var _S = [" \u2588\u2588\u2588\u2588\u2588\u2588", "\u2588\u2588     ", "\u2588\u2588     ", " \u2588\u2588\u2588\u2588\u2588 ", "     \u2588\u2588", "     \u2588\u2588", "\u2588\u2588\u2588\u2588\u2588\u2588 "];
 var ONE_ROWS = Array.from({ length: 7 }, (_2, i) => [_O[i], _N[i], _E[i]].join(" "));
 var ADDR_ROWS = Array.from({ length: 7 }, (_2, i) => [_A[i], _D2[i], _D2[i], _R[i], _E[i], _S[i], _S[i]].join(" "));
-var WIZARD_VERSION = true ? "1.1.9" : "?";
+var WIZARD_VERSION = true ? "1.2.0" : "?";
 function printHeader() {
   const BAR_LEN = 85;
   const TOP_BAR = fn("\u250C") + dm("\u2500".repeat(BAR_LEN)) + fn("\u2510");
@@ -860,7 +860,7 @@ function printHeader() {
   console.log("");
 }
 function stripAnsi(s) {
-  return s.replace(/\x1b\[[0-9;]*m/g, "");
+  return s.replaceAll(/\x1b\[[0-9;]*m/g, "");
 }
 
 // src/scaffold.ts
@@ -1091,7 +1091,13 @@ if (nodeMajor < 22 || (nodeMajor === 22 && nodeMinor < 5)) {
 
 import 'dotenv/config';
 import express, { Request, Response } from 'express';
-import { verifySignature, decryptAddress, isFreshTimestamp } from '@oneaddress/partner-sdk';
+import {
+  verifySignature,
+  decryptAddress,
+  decryptSession,
+  isFreshTimestamp,
+  type SessionKeyShare,
+} from '@oneaddress/partner-sdk';
 import { saveAddress, verifyAddress } from './store.js';
 
 const WEBHOOK_SECRET      = process.env.WEBHOOK_SECRET          ?? '';
@@ -1137,23 +1143,43 @@ app.post('/webhook', async (req: Request, res: Response) => {
   }
   if (dispatch) seenDispatches.add(dispatch);
 
-  // 5. Decrypt address payload
-  const encPayload = body.address_encrypted as {
+  // 5. Decrypt address payload. Two shapes possible:
+  //   (a) D5 (new, 2026+): body.session_envelope + body.session_key_share.
+  //   (b) Legacy: body.address_encrypted.
+  // A webhook will carry exactly one shape. If you've registered multiple
+  // versioned keys (D5 supports key rotation with 90-day overlap), look up
+  // the right private key by session_key_share.key_id from your key store.
+  // This scaffold uses a single PARTNER_PRIVATE_KEY_PEM for simplicity \u2014
+  // production deployments should hold a Map<key_id, privateKeyPem>.
+  let address: Record<string, unknown>;
+
+  const sessionEnvelope = typeof body.session_envelope === 'string' ? body.session_envelope : null;
+  const sessionKeyShare = body.session_key_share as SessionKeyShare | undefined;
+  const legacyPayload   = body.address_encrypted as {
     ephemeralPublicKey: string; iv: string; ciphertext: string; hkdfSalt?: string;
   } | null;
 
-  if (!encPayload) {
+  if (sessionEnvelope && sessionKeyShare) {
+    // D5 \u2014 call decryptSession. Wrong key_id / wrong partner_id / tampered
+    // ciphertext all surface as an AES-GCM authentication-tag error.
+    try {
+      const data = await decryptSession(sessionKeyShare, sessionEnvelope, PARTNER_PRIVATE_KEY, PARTNER_ID);
+      address = data.new_address as unknown as Record<string, unknown>;
+    } catch (err) {
+      console.error('[webhook] D5 decryption failed \u2014 check PARTNER_PRIVATE_KEY_PEM matches key_id', sessionKeyShare.key_id, ':', err);
+      return res.status(200).json({ ok: true, note: 'Received \u2014 D5 decryption pending key setup' });
+    }
+  } else if (legacyPayload) {
+    try {
+      address = await decryptAddress(legacyPayload, PARTNER_PRIVATE_KEY, PARTNER_ID);
+    } catch (err) {
+      console.error('[webhook] Decryption failed \u2014 check PARTNER_PRIVATE_KEY_PEM in .env:', err);
+      return res.status(200).json({ ok: true, note: 'Received \u2014 decryption pending key setup' });
+    }
+  } else {
     return res.status(200).json({ ok: true, note: 'No encrypted payload' });
   }
 
-  let address: Record<string, unknown>;
-  try {
-    address = await decryptAddress(encPayload, PARTNER_PRIVATE_KEY, PARTNER_ID);
-  } catch (err) {
-    console.error('[webhook] Decryption failed \u2014 check PARTNER_PRIVATE_KEY_PEM in .env:', err);
-    return res.status(200).json({ ok: true, note: 'Received \u2014 decryption pending key setup' });
-  }
-
   const event    = body.event    as string;
   const customer = body.customer as { email?: string; name?: string } | undefined;
   const ctx      = { email: customer?.email ?? '', name: customer?.name ?? '' };
@@ -3393,7 +3419,7 @@ function normalisePrivateKey(raw) {
     if (!(0, import_node_fs4.existsSync)(abs)) return { pem: "", error: `File not found: ${abs}` };
     return normalisePrivateKey((0, import_node_fs4.readFileSync)(abs, "utf8"));
   }
-  const unescaped = trimmed.replace(/\\n/g, "\n");
+  const unescaped = trimmed.replaceAll(/\\n/g, "\n");
   if (unescaped.includes("-----BEGIN PRIVATE KEY-----")) {
     return { pem: unescaped };
   }
@@ -3413,7 +3439,7 @@ function normalisePrivateKey(raw) {
     if (b64Lines.length === 0) return { pem: "", error: "Could not extract key body from the OneAddress PEM file" };
     return wrapAsPkcs8(b64Lines.join(""));
   }
-  const b64clean = trimmed.replace(/\s+/g, "");
+  const b64clean = trimmed.replaceAll(/\s+/g, "");
   if (/^[A-Za-z0-9+/]+=*$/.test(b64clean) && b64clean.length >= 50) {
     return wrapAsPkcs8(b64clean);
   }
@@ -3650,7 +3676,7 @@ Continuing will overwrite it.`
     `Files in:     ${outDir}`
   ].join("\n");
   const nextSteps = [
-    "1. Trigger a live event: update your address at app.oneaddress.io\n   \u2192 src/store.ts will save it to data.db automatically",
+    "1. Trigger a live event: update your address at oneaddress.io\n   \u2192 src/store.ts will save it to data.db automatically",
     "2. View your database: open data.db with DB Browser for SQLite\n   (free download at sqlitebrowser.org)",
     "3. For production: swap src/store.ts for your real database (Postgres, MySQL, etc.)\n   then deploy and update the webhook URL in the portal",
     "4. Questions? partners.oneaddress.io  or  partners@oneaddress.io"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneaddress/setup",
-  "version": "1.1.9",
+  "version": "1.2.0",
   "description": "Interactive setup wizard for OneAddress partner webhook integrations",
   "main": "dist/index.js",
   "bin": {