@oneaddress/setup 1.3.0 → 1.3.2

package/dist/index.js

@@ -856,8 +856,31 @@ var _R = ["\u2588\u2588\u2588\u2588\u2588\u2588 ", "\u2588\u2588   \u2588\u2588"
 var _S = [" \u2588\u2588\u2588\u2588\u2588\u2588", "\u2588\u2588     ", "\u2588\u2588     ", " \u2588\u2588\u2588\u2588\u2588 ", "     \u2588\u2588", "     \u2588\u2588", "\u2588\u2588\u2588\u2588\u2588\u2588 "];
 var ONE_ROWS = Array.from({ length: 7 }, (_3, i) => [_O[i], _N[i], _E[i]].join(" "));
 var ADDR_ROWS = Array.from({ length: 7 }, (_3, i) => [_A[i], _D2[i], _D2[i], _R[i], _E[i], _S[i], _S[i]].join(" "));
-var WIZARD_VERSION = true ? "1.3.0" : "?";
+var WIZARD_VERSION = true ? "1.3.2" : "?";
+function printCompactHeader() {
+  const INNER = 42;
+  const TOP = fn("\u250C") + dm("\u2500".repeat(INNER)) + fn("\u2510");
+  const BOT = fn("\u2514") + dm("\u2500".repeat(INNER)) + fn("\u2518");
+  const S3 = dm("\u2502");
+  const blank = ` ${S3}${" ".repeat(INNER)}${S3}`;
+  const row = (content, visibleLen) => ` ${S3}  ${content}${" ".repeat(Math.max(0, INNER - 2 - visibleLen))}${S3}`;
+  const ver = `v${WIZARD_VERSION}  \xB7  partners.oneaddress.io`;
+  console.log("");
+  console.log(" " + TOP);
+  console.log(blank);
+  console.log(row(wb("One ") + ab("Address"), "One Address".length));
+  console.log(row(mi("Partner Setup Wizard"), "Partner Setup Wizard".length));
+  console.log(row(fn(ver), ver.length));
+  console.log(blank);
+  console.log(" " + BOT);
+  console.log("");
+}
 function printHeader() {
+  const cols = typeof process !== "undefined" && process.stdout && process.stdout.columns ? process.stdout.columns : 80;
+  if (cols < 88) {
+    printCompactHeader();
+    return;
+  }
   const BAR_LEN = 85;
   const TOP_BAR = fn("\u250C") + dm("\u2500".repeat(BAR_LEN)) + fn("\u2510");
   const BOT_BAR = fn("\u2514") + dm("\u2500".repeat(BAR_LEN)) + fn("\u2518");
@@ -5201,7 +5224,7 @@ async function scaffold(platform, outputDir, partnerId, webhookSecret, webhookUr
 
 // src/register.ts
 var import_node_crypto = require("crypto");
-var PKG_VERSION = true ? "1.3.0" : "dev";
+var PKG_VERSION = true ? "1.3.2" : "dev";
 var REGISTER_URL = "https://partners.oneaddress.io/api/partner/installs";
 function hmacSha256(secret, message) {
   return (0, import_node_crypto.createHmac)("sha256", secret).update(message).digest("hex");
@@ -5625,7 +5648,7 @@ async function resolveBinary() {
   return downloadCloudflared();
 }
 async function waitForTunnelReady(url, opts = {}) {
-  const budgetMs = opts.budgetMs ?? 3e4;
+  const budgetMs = opts.budgetMs ?? 6e4;
   const intervalMs = opts.intervalMs ?? 1500;
   const attemptTimeoutMs = opts.attemptTimeoutMs ?? 4e3;
   const doFetch = opts.fetchImpl ?? fetch;
@@ -5686,7 +5709,13 @@ async function startTunnel(port) {
 // src/register-url.ts
 var import_node_crypto4 = require("crypto");
 var PORTAL_API = "https://partners.oneaddress.io/api/partner/webhook-url";
-async function getExistingWebhookUrl(partnerId, webhookSecret) {
+function describeReadFailure(status) {
+  if (status === 401) return "the portal rejected the signature (HTTP 401), which means your Webhook signing secret does not match the one on your profile. Copy it again from partners.oneaddress.io \u2192 Webhook \u2192 Webhook signing secret.";
+  if (status === 404) return "the portal has no active partner for this account (HTTP 404), which usually means it is not approved yet.";
+  if (status === 400) return "the portal rejected the request (HTTP 400).";
+  return `the portal returned HTTP ${status}.`;
+}
+async function getExistingWebhookUrl(partnerId, webhookSecret, onError) {
   try {
     const ts = String(Math.floor(Date.now() / 1e3));
     const sig = (0, import_node_crypto4.createHmac)("sha256", webhookSecret).update(`${ts}.`).digest("hex");
@@ -5699,14 +5728,18 @@ async function getExistingWebhookUrl(partnerId, webhookSecret) {
       },
       signal: AbortSignal.timeout(8e3)
     });
-    if (!res.ok) return void 0;
+    if (!res.ok) {
+      onError?.(describeReadFailure(res.status));
+      return void 0;
+    }
     const data = await res.json();
     return data.webhook_url ?? null;
-  } catch {
+  } catch (err) {
+    onError?.(`could not reach the portal (${err instanceof Error ? err.message : "network error"})`);
     return void 0;
   }
 }
-async function getVerifiesAccountReference(partnerId, webhookSecret) {
+async function getVerifiesAccountReference(partnerId, webhookSecret, onError) {
   try {
     const ts = String(Math.floor(Date.now() / 1e3));
     const sig = (0, import_node_crypto4.createHmac)("sha256", webhookSecret).update(`${ts}.`).digest("hex");
@@ -5719,16 +5752,40 @@ async function getVerifiesAccountReference(partnerId, webhookSecret) {
       },
       signal: AbortSignal.timeout(8e3)
     });
-    if (!res.ok) return void 0;
+    if (!res.ok) {
+      onError?.(describeReadFailure(res.status));
+      return void 0;
+    }
     const data = await res.json();
     const v2 = data.verifies_account_reference;
     if (v2 === true || v2 === false) return v2;
     if (v2 === null) return null;
     return void 0;
-  } catch {
+  } catch (err) {
+    onError?.(`could not reach the portal (${err instanceof Error ? err.message : "network error"})`);
     return void 0;
   }
 }
+async function verifyWebhookSecret(partnerId, webhookSecret) {
+  try {
+    const ts = String(Math.floor(Date.now() / 1e3));
+    const sig = (0, import_node_crypto4.createHmac)("sha256", webhookSecret).update(`${ts}.`).digest("hex");
+    const res = await fetch(PORTAL_API, {
+      method: "GET",
+      headers: {
+        "X-OneAddress-Timestamp": ts,
+        "X-OneAddress-Signature": sig,
+        "X-OneAddress-Partner": partnerId
+      },
+      signal: AbortSignal.timeout(8e3)
+    });
+    if (res.ok) return "ok";
+    if (res.status === 401 || res.status === 403) return "bad_secret";
+    return "unreachable";
+  } catch {
+    return "unreachable";
+  }
+}
 async function registerWebhookUrl(partnerId, webhookSecret, webhookUrl) {
   try {
     const body = JSON.stringify({ webhook_url: webhookUrl });
@@ -5996,14 +6053,42 @@ async function main() {
   M2.info("  2. Scaffold a working webhook server for your platform");
   M2.info("  3. Get it live with a passing conformance check \u2014 in under 5 minutes");
   M2.info("\nOpen partners.oneaddress.io \u2192 My Profile to find the two values below.\n");
-  const webhookSecret = await ge({
-    message: "Your Webhook Secret  (min 20 chars)",
-    validate: (v2) => {
-      if (!v2.trim()) return "Webhook Secret is required";
-      if (v2.length < 20) return "That looks too short \u2014 paste the full secret from My Profile";
+  let secret;
+  for (let attempt = 1; ; attempt++) {
+    const webhookSecret = await ge({
+      message: attempt === 1 ? "Your Webhook signing secret  (min 20 chars)" : `Your Webhook signing secret  (attempt ${attempt})`,
+      validate: (v2) => {
+        if (!v2.trim()) return "Webhook signing secret is required";
+        if (v2.length < 20) return "That looks too short \u2014 paste the full secret from My Profile";
+      }
+    });
+    assertNotCancelled(webhookSecret);
+    secret = webhookSecret.trim();
+    const sv = Y2();
+    sv.start("Checking your Webhook signing secret");
+    const check = await verifyWebhookSecret(pid, secret);
+    if (check === "ok") {
+      sv.stop("Webhook signing secret verified");
+      break;
     }
-  });
-  assertNotCancelled(webhookSecret);
+    if (check === "unreachable") {
+      sv.stop("Could not verify the secret against the portal, continuing");
+      M2.warn(
+        "Could not reach the portal to check your Webhook signing secret. Continuing.\nIf live dispatches later fail signature verification, re-check it at\npartners.oneaddress.io -> Webhook -> Webhook signing secret."
+      );
+      break;
+    }
+    sv.stop("That Webhook signing secret was rejected");
+    if (attempt >= 3) {
+      xe(
+        "The Webhook signing secret did not match after three tries.\nRegenerate it at partners.oneaddress.io -> Webhook -> Webhook signing secret\n(use Revoke and regenerate, not Rotate), then run the wizard again."
+      );
+      process.exit(1);
+    }
+    M2.error(
+      "The portal rejected that secret (HTTP 401): it does not match the one on your profile.\nRegenerate it at partners.oneaddress.io -> Webhook -> Webhook signing secret\n(use Revoke and regenerate, not Rotate), copy the value shown once, and paste it here."
+    );
+  }
   const privateKeyRaw = await he({
     message: "Your ECDH Private Key",
     placeholder: "Paste the base64 key body from My Profile, or enter a path to the .pem file",
@@ -6015,7 +6100,6 @@ async function main() {
     }
   });
   assertNotCancelled(privateKeyRaw);
-  const secret = webhookSecret.trim();
   const normalised = normalisePrivateKey(privateKeyRaw.trim());
   if (normalised.error) {
     xe(`Private key parse failed unexpectedly: ${normalised.error}`);
@@ -6059,11 +6143,14 @@ async function main() {
       }
     }
   }
-  const accountRefDeclaration = await getVerifiesAccountReference(pid, secret);
+  let accountRefReason = "";
+  const accountRefDeclaration = await getVerifiesAccountReference(pid, secret, (r2) => {
+    accountRefReason = r2;
+  });
   const verifiesAccountReference = accountRefDeclaration === true;
   if (accountRefDeclaration === void 0) {
     M2.warn(
-      "Could not read your account-reference declaration from the portal.\nConformance check-14 has been left out of the generated `npm test`, so a\npassing run does NOT mean your receiver matches account references correctly.\nSet it at partners.oneaddress.io \u2192 My Profile, then re-run this wizard."
+      "Could not read your account-reference declaration from the portal.\n" + (accountRefReason ? "Reason: " + accountRefReason + "\n" : "") + "Conformance check-14 has been left out of the generated `npm test`, so a\npassing run does NOT mean your receiver matches account references correctly.\nSet it at partners.oneaddress.io \u2192 My Profile, then re-run this wizard."
     );
   }
   const s1 = Y2();
@@ -6137,7 +6224,12 @@ async function main() {
     if (start.output) M2.warn(start.output.slice(0, 600));
   }
   let webhookUrl = "";
-  const existingUrlResult = await getExistingWebhookUrl(pid, secret);
+  let webhookReady = true;
+  let tunnelBase = null;
+  let existingUrlReason = "";
+  const existingUrlResult = await getExistingWebhookUrl(pid, secret, (r2) => {
+    existingUrlReason = r2;
+  });
   if (typeof existingUrlResult === "string") {
     M2.warn(
       `A webhook URL is already registered for this partner:
@@ -6156,7 +6248,7 @@ Continuing will overwrite it.`
     }
   } else if (existingUrlResult === void 0) {
     M2.warn(
-      "Could not check whether a webhook URL is already registered (portal API unreachable). Any URL you register now will overwrite an existing one without warning."
+      "Could not check whether a webhook URL is already registered" + (existingUrlReason ? ": " + existingUrlReason : " (portal API unreachable).") + "\nAny URL you register now will overwrite an existing one without warning."
     );
     const continueAnyway = await ye({
       message: "Continue anyway?",
@@ -6194,6 +6286,7 @@ Continuing will overwrite it.`
     try {
       const tunnel = await startTunnel(3001);
       webhookUrl = `${tunnel.url}/webhook`;
+      tunnelBase = tunnel.url;
       s4.stop(`Tunnel active: ${tunnel.url}`);
       M2.warn(
         "IMPORTANT: This tunnel URL is temporary \u2014 it expires when this process stops.\nBefore going to production, deploy to a permanent server and update the webhook URL in the portal."
@@ -6201,10 +6294,11 @@ Continuing will overwrite it.`
       const s4b = Y2();
       s4b.start("Waiting for the tunnel to start routing");
       const ready = await waitForTunnelReady(tunnel.url);
-      s4b.stop(ready ? "Tunnel is routing" : "Tunnel is slow to come online \u2014 continuing anyway");
+      webhookReady = ready;
+      s4b.stop(ready ? "Tunnel is routing" : "Tunnel is slow to come online");
       if (!ready) {
         M2.warn(
-          "The tunnel edge has not answered yet. If the checks below time out it is almost\ncertainly still warming up, not your server \u2014 wait a few seconds and re-run the wizard."
+          "The tunnel edge has not answered yet. This is a Cloudflare warmup delay,\nnot your server, which is running on :3001. The wizard will wait once more\nbefore the conformance checks so a cold tunnel does not read as a failure."
         );
       }
     } catch (err) {
@@ -6239,16 +6333,28 @@ Continuing will overwrite it.`
     });
   }
   if (webhookUrl) {
-    M2.info("");
-    const s6 = Y2();
-    s6.start("Running conformance checks");
-    await new Promise((r2) => setTimeout(r2, 200));
-    s6.stop("Conformance checks:");
-    await runConformance(webhookUrl, pid, secret);
-    if (verifiesAccountReference) {
-      M2.info(
-        "You have declared that your receiver matches the account reference itself.\nRun `npm test` to include check-14, which sends an account reference that matches\nnothing and fails a receiver that reports it as applied. The three checks above\ncover signing and replay only."
+    if (!webhookReady && tunnelBase) {
+      const sr = Y2();
+      sr.start("Waiting for the tunnel to start routing");
+      webhookReady = await waitForTunnelReady(tunnelBase, { budgetMs: 2e4 });
+      sr.stop(webhookReady ? "Tunnel is routing" : "Tunnel still not routing");
+    }
+    if (!webhookReady) {
+      M2.warn(
+        "Skipping the conformance checks: the Cloudflare tunnel edge has not come online.\nThis is a tunnel warmup delay, not your server, which is running on :3001.\nRe-run the wizard, or run `npm test` once the tunnel URL responds in a browser."
       );
+    } else {
+      M2.info("");
+      const s6 = Y2();
+      s6.start("Running conformance checks");
+      await new Promise((r2) => setTimeout(r2, 200));
+      s6.stop("Conformance checks:");
+      await runConformance(webhookUrl, pid, secret);
+      if (verifiesAccountReference) {
+        M2.info(
+          "You have declared that your receiver matches the account reference itself.\nRun `npm test` to include check-14, which sends an account reference that matches\nnothing and fails a receiver that reports it as applied. The three checks above\ncover signing and replay only."
+        );
+      }
     }
   }
   const summary = [

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "@oneaddress/setup",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "description": "Interactive setup wizard for OneAddress partner webhook integrations",
   "main": "dist/index.js",
   "bin": {
     "oneaddress-setup": "dist/index.js"
   },
   "files": [
-    "LICENSE", "dist",
+    "LICENSE",
+    "dist",
     "README.md"
   ],
   "scripts": {