@oneaddress/setup 1.3.2 → 1.3.3

package/dist/index.js

@@ -856,7 +856,7 @@ var _R = ["\u2588\u2588\u2588\u2588\u2588\u2588 ", "\u2588\u2588   \u2588\u2588"
 var _S = [" \u2588\u2588\u2588\u2588\u2588\u2588", "\u2588\u2588     ", "\u2588\u2588     ", " \u2588\u2588\u2588\u2588\u2588 ", "     \u2588\u2588", "     \u2588\u2588", "\u2588\u2588\u2588\u2588\u2588\u2588 "];
 var ONE_ROWS = Array.from({ length: 7 }, (_3, i) => [_O[i], _N[i], _E[i]].join(" "));
 var ADDR_ROWS = Array.from({ length: 7 }, (_3, i) => [_A[i], _D2[i], _D2[i], _R[i], _E[i], _S[i], _S[i]].join(" "));
-var WIZARD_VERSION = true ? "1.3.2" : "?";
+var WIZARD_VERSION = true ? "1.3.3" : "?";
 function printCompactHeader() {
   const INNER = 42;
   const TOP = fn("\u250C") + dm("\u2500".repeat(INNER)) + fn("\u2510");
@@ -1426,6 +1426,19 @@ app.post('/webhook', async (req: Request, res: Response) => {
     return res.status(200).json({ ok: true });
   }
 
+  // \u2500\u2500 address.test / address.test-dispatch: OneAddress connection-verification
+  // A fabricated test record wrapped to your key. Reaching this line proves
+  // PARTNER_PRIVATE_KEY_PEM decrypted it: a wrong key would have failed the D5
+  // decrypt above and returned 422, never here. Answer { verification: true },
+  // which is what the receiver-verification and go-live checks look for. Return
+  // anything else (including the forward-compat skip below) and the check reads
+  // as "answered but could not decrypt", which is not what happened.
+  if (event === 'address.test' || event === 'address.test-dispatch') {
+    const index = typeof body.index === 'number' ? body.index : undefined;
+    console.log(\`[webhook] \${event} verification probe decrypted OK\`);
+    return res.status(200).json({ verification: true, index });
+  }
+
   // Unknown event \u2014 acknowledge (forward compatibility)
   console.log(\`[webhook] Unknown event "\${event}" \u2014 acknowledged\`);
   return res.status(200).json({ ok: true, skipped: true });
@@ -1960,6 +1973,15 @@ async def webhook(request: Request) -> Response:
         except Exception as e:
             print(f"[webhook] Callback POST failed: {e}")
 
+    elif event in ("address.test", "address.test-dispatch"):
+        # OneAddress connection-verification probe. Reaching here means the D5
+        # decrypt above succeeded (a wrong key returned 422), which is exactly
+        # what the check proves, so answer verification=true. Anything else reads
+        # as "answered but could not decrypt", which is not what happened.
+        print(f"[webhook] {event} verification probe decrypted OK")
+        return Response(content=json.dumps({"verification": True, "index": body.get("index")}),
+                        media_type="application/json")
+
     else:
         print(f"[webhook] Unknown event '{event}' \u2014 acknowledged")
 
@@ -2517,6 +2539,14 @@ public class OneAddressWebhookController {
             } else if ("address.verify".equals(event)) {
                 handleAddressVerify(body, address, accountNumber, verifiedName, knownNames);
                 if (dispatchId != null && !dispatchId.isBlank()) store.markProcessed(dispatchId, "verify");
+            } else if ("address.test".equals(event) || "address.test-dispatch".equals(event)) {
+                // OneAddress connection-verification probe. Reaching here means the
+                // D5 decrypt above succeeded (a wrong key returned 422), which is
+                // what the check proves, so answer verification=true.
+                if (dispatchId != null && !dispatchId.isBlank()) store.markProcessed(dispatchId, "verification:ok");
+                Object idx = body.get("index");
+                log.info("[OneAddress] {} verification probe decrypted OK", event);
+                return ResponseEntity.ok("{\\"verification\\":true,\\"index\\":" + (idx == null ? "null" : idx.toString()) + "}");
             } else {
                 log.info("[OneAddress] skipping unknown event: {}", event);
                 if (dispatchId != null && !dispatchId.isBlank()) store.markProcessed(dispatchId, "ignored:unknown-event");
@@ -3285,7 +3315,11 @@ app.MapPost("/webhooks/oneaddress", async (HttpRequest request) =>
 
     var eventType = body.TryGetProperty("event", out var evtEl) ? evtEl.GetString() : null;
 
-    if (eventType != "address.updated" && eventType != "address.verify")
+    // address.test / address.test-dispatch (the connection-verification probe)
+    // must pass this guard so it reaches the decrypt below; a wrong key then
+    // returns 422 and only a real decrypt reaches the verification answer.
+    if (eventType != "address.updated" && eventType != "address.verify"
+        && eventType != "address.test" && eventType != "address.test-dispatch")
     {
         app.Logger.LogInformation("[OneAddress] skipping unknown event: {EventType}", eventType);
         return Results.Json(new { ok = true, skipped = true });
@@ -3366,6 +3400,17 @@ app.MapPost("/webhooks/oneaddress", async (HttpRequest request) =>
             app.Logger.LogWarning("[OneAddress] dispatch {DispatchId} received before but never completed \u2014 reprocessing", dispatchId);
     }
 
+    if (eventType == "address.test" || eventType == "address.test-dispatch")
+    {
+        // OneAddress connection-verification probe. Reaching here means the D5
+        // decrypt above succeeded (a wrong key returned 422), which is what the
+        // check proves, so answer verification=true.
+        int? index = body.TryGetProperty("index", out var idxEl) && idxEl.ValueKind == JsonValueKind.Number
+            ? idxEl.GetInt32() : (int?)null;
+        app.Logger.LogInformation("[OneAddress] {EventType} verification probe decrypted OK", eventType);
+        return Results.Json(new { verification = true, index });
+    }
+
     if (eventType == "address.updated")
     {
         // Work FIRST, respond after. Acknowledging before the write commits
@@ -4203,6 +4248,21 @@ func main() {
 				_ = store.MarkProcessed(dispatch, "verify:"+result)
 			}
 
+		case "address.test", "address.test-dispatch":
+			// OneAddress connection-verification probe. Reaching this case means the
+			// decrypt above succeeded (a wrong key returned 422), which is what the
+			// check proves, so answer verification=true rather than the ok:true below.
+			log.Printf("[webhook] %s verification probe decrypted OK", event)
+			if dispatch != "" {
+				_ = store.MarkProcessed(dispatch, "verification:ok")
+			}
+			var idx any = nil
+			if v, ok := parsed["index"]; ok {
+				idx = v
+			}
+			jsonResp(w, 200, map[string]any{"verification": true, "index": idx})
+			return
+
 		default:
 			log.Printf("[webhook] Unknown event %q \u2014 acknowledged", event)
 			if dispatch != "" {
@@ -4869,7 +4929,11 @@ Route::post('/webhook', function (Request $request): Response {
 
     $eventType = $body['event'] ?? '';
 
-    if ($eventType !== 'address.updated' && $eventType !== 'address.verify') {
+    // address.test / address.test-dispatch (the connection-verification probe)
+    // must pass this guard so it reaches the decrypt below; a wrong key then
+    // returns 422 and only a real decrypt reaches the verification answer.
+    if ($eventType !== 'address.updated' && $eventType !== 'address.verify'
+        && $eventType !== 'address.test' && $eventType !== 'address.test-dispatch') {
         return response()->json(['ok' => true, 'skipped' => true]);
     }
 
@@ -5038,6 +5102,14 @@ Route::post('/webhook', function (Request $request): Response {
         }
     }
 
+    if ($eventType === 'address.test' || $eventType === 'address.test-dispatch') {
+        // OneAddress connection-verification probe. Reaching here means the D5
+        // decrypt above succeeded (a wrong key returned 422), which is what the
+        // check proves, so answer verification=true.
+        \\Log::info('[OneAddress] verification probe decrypted OK', ['event' => $eventType]);
+        return response()->json(['verification' => true, 'index' => $body['index'] ?? null]);
+    }
+
     if ($eventType === 'address.updated') {
         // Work FIRST, respond after. Acknowledging before the write commits
         // marks the dispatch delivered on a failure that is never retried.
@@ -5224,7 +5296,7 @@ async function scaffold(platform, outputDir, partnerId, webhookSecret, webhookUr
 
 // src/register.ts
 var import_node_crypto = require("crypto");
-var PKG_VERSION = true ? "1.3.2" : "dev";
+var PKG_VERSION = true ? "1.3.3" : "dev";
 var REGISTER_URL = "https://partners.oneaddress.io/api/partner/installs";
 function hmacSha256(secret, message) {
   return (0, import_node_crypto.createHmac)("sha256", secret).update(message).digest("hex");
@@ -6284,21 +6356,36 @@ Continuing will overwrite it.`
     s4.start("Starting Cloudflare Tunnel");
     onCleanup(stopTunnel);
     try {
-      const tunnel = await startTunnel(3001);
+      let tunnel = await startTunnel(3001);
       webhookUrl = `${tunnel.url}/webhook`;
       tunnelBase = tunnel.url;
       s4.stop(`Tunnel active: ${tunnel.url}`);
       M2.warn(
-        "IMPORTANT: This tunnel URL is temporary \u2014 it expires when this process stops.\nBefore going to production, deploy to a permanent server and update the webhook URL in the portal."
+        "IMPORTANT: This tunnel URL is temporary. It lives only while this wizard\nkeeps running, and every run gets a new address. Before going to production,\ndeploy to a permanent server and update the webhook URL in the portal."
       );
       const s4b = Y2();
       s4b.start("Waiting for the tunnel to start routing");
-      const ready = await waitForTunnelReady(tunnel.url);
-      webhookReady = ready;
-      s4b.stop(ready ? "Tunnel is routing" : "Tunnel is slow to come online");
-      if (!ready) {
+      webhookReady = await waitForTunnelReady(tunnel.url);
+      if (!webhookReady) {
+        s4b.stop("First tunnel is slow to route, trying a fresh one");
+        stopTunnel();
+        tunnel = await startTunnel(3001);
+        webhookUrl = `${tunnel.url}/webhook`;
+        tunnelBase = tunnel.url;
+        const s4c = Y2();
+        s4c.start(`Waiting for the new tunnel to route: ${tunnel.url}`);
+        webhookReady = await waitForTunnelReady(tunnel.url, { budgetMs: 45e3 });
+        s4c.stop(webhookReady ? "Tunnel is routing" : "Tunnel still not routing");
+      } else {
+        s4b.stop("Tunnel is routing");
+      }
+      if (!webhookReady) {
         M2.warn(
-          "The tunnel edge has not answered yet. This is a Cloudflare warmup delay,\nnot your server, which is running on :3001. The wizard will wait once more\nbefore the conformance checks so a cold tunnel does not read as a failure."
+          `The tunnel edge is still not routing after a retry. This is almost always
+one of two things, and neither is your server (it is running on :3001):
+  1. Open ${tunnel.url}/health in a browser. If it never loads, your network
+     is blocking cloudflared and no wait will fix it, so try a different network.
+  2. The tunnel only lives while this wizard runs, so keep this window open.`
         );
       }
     } catch (err) {
@@ -6341,7 +6428,10 @@ Continuing will overwrite it.`
     }
     if (!webhookReady) {
       M2.warn(
-        "Skipping the conformance checks: the Cloudflare tunnel edge has not come online.\nThis is a tunnel warmup delay, not your server, which is running on :3001.\nRe-run the wizard, or run `npm test` once the tunnel URL responds in a browser."
+        `Skipping the conformance checks: the tunnel edge is not routing.
+Your server is fine, it is running on :3001. This is either your network
+blocking cloudflared (open ${tunnelBase}/health in a browser to check) or the
+tunnel needing this wizard to stay open. Re-run once that URL loads in a browser.`
       );
     } else {
       M2.info("");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneaddress/setup",
-  "version": "1.3.2",
+  "version": "1.3.3",
   "description": "Interactive setup wizard for OneAddress partner webhook integrations",
   "main": "dist/index.js",
   "bin": {