@oneaddress/setup 1.3.1 → 1.3.2

package/dist/index.js

@@ -856,7 +856,7 @@ var _R = ["\u2588\u2588\u2588\u2588\u2588\u2588 ", "\u2588\u2588   \u2588\u2588"
 var _S = [" \u2588\u2588\u2588\u2588\u2588\u2588", "\u2588\u2588     ", "\u2588\u2588     ", " \u2588\u2588\u2588\u2588\u2588 ", "     \u2588\u2588", "     \u2588\u2588", "\u2588\u2588\u2588\u2588\u2588\u2588 "];
 var ONE_ROWS = Array.from({ length: 7 }, (_3, i) => [_O[i], _N[i], _E[i]].join(" "));
 var ADDR_ROWS = Array.from({ length: 7 }, (_3, i) => [_A[i], _D2[i], _D2[i], _R[i], _E[i], _S[i], _S[i]].join(" "));
-var WIZARD_VERSION = true ? "1.3.1" : "?";
+var WIZARD_VERSION = true ? "1.3.2" : "?";
 function printCompactHeader() {
   const INNER = 42;
   const TOP = fn("\u250C") + dm("\u2500".repeat(INNER)) + fn("\u2510");
@@ -5224,7 +5224,7 @@ async function scaffold(platform, outputDir, partnerId, webhookSecret, webhookUr
 
 // src/register.ts
 var import_node_crypto = require("crypto");
-var PKG_VERSION = true ? "1.3.1" : "dev";
+var PKG_VERSION = true ? "1.3.2" : "dev";
 var REGISTER_URL = "https://partners.oneaddress.io/api/partner/installs";
 function hmacSha256(secret, message) {
   return (0, import_node_crypto.createHmac)("sha256", secret).update(message).digest("hex");
@@ -5648,7 +5648,7 @@ async function resolveBinary() {
   return downloadCloudflared();
 }
 async function waitForTunnelReady(url, opts = {}) {
-  const budgetMs = opts.budgetMs ?? 3e4;
+  const budgetMs = opts.budgetMs ?? 6e4;
   const intervalMs = opts.intervalMs ?? 1500;
   const attemptTimeoutMs = opts.attemptTimeoutMs ?? 4e3;
   const doFetch = opts.fetchImpl ?? fetch;
@@ -5766,6 +5766,26 @@ async function getVerifiesAccountReference(partnerId, webhookSecret, onError) {
     return void 0;
   }
 }
+async function verifyWebhookSecret(partnerId, webhookSecret) {
+  try {
+    const ts = String(Math.floor(Date.now() / 1e3));
+    const sig = (0, import_node_crypto4.createHmac)("sha256", webhookSecret).update(`${ts}.`).digest("hex");
+    const res = await fetch(PORTAL_API, {
+      method: "GET",
+      headers: {
+        "X-OneAddress-Timestamp": ts,
+        "X-OneAddress-Signature": sig,
+        "X-OneAddress-Partner": partnerId
+      },
+      signal: AbortSignal.timeout(8e3)
+    });
+    if (res.ok) return "ok";
+    if (res.status === 401 || res.status === 403) return "bad_secret";
+    return "unreachable";
+  } catch {
+    return "unreachable";
+  }
+}
 async function registerWebhookUrl(partnerId, webhookSecret, webhookUrl) {
   try {
     const body = JSON.stringify({ webhook_url: webhookUrl });
@@ -6033,14 +6053,42 @@ async function main() {
   M2.info("  2. Scaffold a working webhook server for your platform");
   M2.info("  3. Get it live with a passing conformance check \u2014 in under 5 minutes");
   M2.info("\nOpen partners.oneaddress.io \u2192 My Profile to find the two values below.\n");
-  const webhookSecret = await ge({
-    message: "Your Webhook signing secret  (min 20 chars)",
-    validate: (v2) => {
-      if (!v2.trim()) return "Webhook signing secret is required";
-      if (v2.length < 20) return "That looks too short \u2014 paste the full secret from My Profile";
+  let secret;
+  for (let attempt = 1; ; attempt++) {
+    const webhookSecret = await ge({
+      message: attempt === 1 ? "Your Webhook signing secret  (min 20 chars)" : `Your Webhook signing secret  (attempt ${attempt})`,
+      validate: (v2) => {
+        if (!v2.trim()) return "Webhook signing secret is required";
+        if (v2.length < 20) return "That looks too short \u2014 paste the full secret from My Profile";
+      }
+    });
+    assertNotCancelled(webhookSecret);
+    secret = webhookSecret.trim();
+    const sv = Y2();
+    sv.start("Checking your Webhook signing secret");
+    const check = await verifyWebhookSecret(pid, secret);
+    if (check === "ok") {
+      sv.stop("Webhook signing secret verified");
+      break;
     }
-  });
-  assertNotCancelled(webhookSecret);
+    if (check === "unreachable") {
+      sv.stop("Could not verify the secret against the portal, continuing");
+      M2.warn(
+        "Could not reach the portal to check your Webhook signing secret. Continuing.\nIf live dispatches later fail signature verification, re-check it at\npartners.oneaddress.io -> Webhook -> Webhook signing secret."
+      );
+      break;
+    }
+    sv.stop("That Webhook signing secret was rejected");
+    if (attempt >= 3) {
+      xe(
+        "The Webhook signing secret did not match after three tries.\nRegenerate it at partners.oneaddress.io -> Webhook -> Webhook signing secret\n(use Revoke and regenerate, not Rotate), then run the wizard again."
+      );
+      process.exit(1);
+    }
+    M2.error(
+      "The portal rejected that secret (HTTP 401): it does not match the one on your profile.\nRegenerate it at partners.oneaddress.io -> Webhook -> Webhook signing secret\n(use Revoke and regenerate, not Rotate), copy the value shown once, and paste it here."
+    );
+  }
   const privateKeyRaw = await he({
     message: "Your ECDH Private Key",
     placeholder: "Paste the base64 key body from My Profile, or enter a path to the .pem file",
@@ -6052,7 +6100,6 @@ async function main() {
     }
   });
   assertNotCancelled(privateKeyRaw);
-  const secret = webhookSecret.trim();
   const normalised = normalisePrivateKey(privateKeyRaw.trim());
   if (normalised.error) {
     xe(`Private key parse failed unexpectedly: ${normalised.error}`);
@@ -6177,6 +6224,8 @@ async function main() {
     if (start.output) M2.warn(start.output.slice(0, 600));
   }
   let webhookUrl = "";
+  let webhookReady = true;
+  let tunnelBase = null;
   let existingUrlReason = "";
   const existingUrlResult = await getExistingWebhookUrl(pid, secret, (r2) => {
     existingUrlReason = r2;
@@ -6237,6 +6286,7 @@ Continuing will overwrite it.`
     try {
       const tunnel = await startTunnel(3001);
       webhookUrl = `${tunnel.url}/webhook`;
+      tunnelBase = tunnel.url;
       s4.stop(`Tunnel active: ${tunnel.url}`);
       M2.warn(
         "IMPORTANT: This tunnel URL is temporary \u2014 it expires when this process stops.\nBefore going to production, deploy to a permanent server and update the webhook URL in the portal."
@@ -6244,10 +6294,11 @@ Continuing will overwrite it.`
       const s4b = Y2();
       s4b.start("Waiting for the tunnel to start routing");
       const ready = await waitForTunnelReady(tunnel.url);
-      s4b.stop(ready ? "Tunnel is routing" : "Tunnel is slow to come online \u2014 continuing anyway");
+      webhookReady = ready;
+      s4b.stop(ready ? "Tunnel is routing" : "Tunnel is slow to come online");
       if (!ready) {
         M2.warn(
-          "The tunnel edge has not answered yet. If the checks below time out it is almost\ncertainly still warming up, not your server \u2014 wait a few seconds and re-run the wizard."
+          "The tunnel edge has not answered yet. This is a Cloudflare warmup delay,\nnot your server, which is running on :3001. The wizard will wait once more\nbefore the conformance checks so a cold tunnel does not read as a failure."
         );
       }
     } catch (err) {
@@ -6282,16 +6333,28 @@ Continuing will overwrite it.`
     });
   }
   if (webhookUrl) {
-    M2.info("");
-    const s6 = Y2();
-    s6.start("Running conformance checks");
-    await new Promise((r2) => setTimeout(r2, 200));
-    s6.stop("Conformance checks:");
-    await runConformance(webhookUrl, pid, secret);
-    if (verifiesAccountReference) {
-      M2.info(
-        "You have declared that your receiver matches the account reference itself.\nRun `npm test` to include check-14, which sends an account reference that matches\nnothing and fails a receiver that reports it as applied. The three checks above\ncover signing and replay only."
+    if (!webhookReady && tunnelBase) {
+      const sr = Y2();
+      sr.start("Waiting for the tunnel to start routing");
+      webhookReady = await waitForTunnelReady(tunnelBase, { budgetMs: 2e4 });
+      sr.stop(webhookReady ? "Tunnel is routing" : "Tunnel still not routing");
+    }
+    if (!webhookReady) {
+      M2.warn(
+        "Skipping the conformance checks: the Cloudflare tunnel edge has not come online.\nThis is a tunnel warmup delay, not your server, which is running on :3001.\nRe-run the wizard, or run `npm test` once the tunnel URL responds in a browser."
       );
+    } else {
+      M2.info("");
+      const s6 = Y2();
+      s6.start("Running conformance checks");
+      await new Promise((r2) => setTimeout(r2, 200));
+      s6.stop("Conformance checks:");
+      await runConformance(webhookUrl, pid, secret);
+      if (verifiesAccountReference) {
+        M2.info(
+          "You have declared that your receiver matches the account reference itself.\nRun `npm test` to include check-14, which sends an account reference that matches\nnothing and fails a receiver that reports it as applied. The three checks above\ncover signing and replay only."
+        );
+      }
     }
   }
   const summary = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneaddress/setup",
-  "version": "1.3.1",
+  "version": "1.3.2",
   "description": "Interactive setup wizard for OneAddress partner webhook integrations",
   "main": "dist/index.js",
   "bin": {