@oneaddress/setup 1.3.4 → 1.4.1

package/dist/index.js

@@ -856,7 +856,7 @@ var _R = ["\u2588\u2588\u2588\u2588\u2588\u2588 ", "\u2588\u2588   \u2588\u2588"
 var _S = [" \u2588\u2588\u2588\u2588\u2588\u2588", "\u2588\u2588     ", "\u2588\u2588     ", " \u2588\u2588\u2588\u2588\u2588 ", "     \u2588\u2588", "     \u2588\u2588", "\u2588\u2588\u2588\u2588\u2588\u2588 "];
 var ONE_ROWS = Array.from({ length: 7 }, (_3, i) => [_O[i], _N[i], _E[i]].join(" "));
 var ADDR_ROWS = Array.from({ length: 7 }, (_3, i) => [_A[i], _D2[i], _D2[i], _R[i], _E[i], _S[i], _S[i]].join(" "));
-var WIZARD_VERSION = true ? "1.3.4" : "?";
+var WIZARD_VERSION = true ? "1.4.1" : "?";
 function printCompactHeader() {
   const INNER = 42;
   const TOP = fn("\u250C") + dm("\u2500".repeat(INNER)) + fn("\u2510");
@@ -1204,6 +1204,7 @@ if (nodeMajor < 22 || (nodeMajor === 22 && nodeMinor < 5)) {
 
 import 'dotenv/config';
 import express, { Request, Response } from 'express';
+import { createPrivateKey } from 'node:crypto';
 import {
   verifySignature,
   decryptAddress,
@@ -1229,10 +1230,39 @@ if (!WEBHOOK_SECRET || !PARTNER_PRIVATE_KEY || !PARTNER_ID) {
   process.exit(1);
 }
 
-// In-memory dedup cache \u2014 bounded so a partner running with the default
-// scaffold can't be DoS'd by an attacker who's already past HMAC verify
-// (i.e. has stolen the webhook secret) by sending unique dispatch IDs
-// until RAM is exhausted. For production use a distributed store (Redis).
+// Startup self-check. Two faults were historically INVISIBLE until a live
+// dispatch, and both read afterwards as "partner key mismatch" deep inside a
+// try/catch, which is a day of reading webhook logs. Assert them here so the
+// receiver refuses to start and names the fix instead.
+//   1. An @oneaddress/partner-sdk too old to export decryptSession. A missing
+//      CJS export is undefined, not a load error, so tsx never complains and it
+//      fails only when the first payload arrives.
+//   2. A private key that does not parse (empty, truncated, or header stripped).
+if (typeof decryptSession !== 'function') {
+  console.error('[startup] @oneaddress/partner-sdk does not export decryptSession. Your installed SDK is too old for D5 dispatches.');
+  console.error('[startup] Fix: npm install "@oneaddress/partner-sdk@^1.8.0", then restart.');
+  process.exit(1);
+}
+// Only PEM keys are parseable this way; a post-quantum key is a base64 secret,
+// so skip the check unless the value looks like a PEM.
+if (PARTNER_PRIVATE_KEY.includes('BEGIN')) {
+  try {
+    createPrivateKey(PARTNER_PRIVATE_KEY);
+  } catch {
+    console.error('[startup] PARTNER_PRIVATE_KEY_PEM does not parse as a private key.');
+    console.error('[startup] Paste the FULL PEM, including the -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- lines.');
+    process.exit(1);
+  }
+}
+
+// In-memory dedup cache. Records a dispatch id only once it has been fully
+// HANDLED, so a dispatch that failed to decrypt is NOT remembered and a later
+// retry re-runs it rather than being dismissed as a duplicate. Bounded so a
+// partner running with the default scaffold can't be DoS'd by an attacker
+// who's already past HMAC verify (i.e. has stolen the webhook secret) by
+// sending unique dispatch IDs until RAM is exhausted. For production use a
+// distributed store (Redis), and prefer the completion-claim model the other
+// language scaffolds use.
 const SEEN_DISPATCHES_MAX = 10_000;
 const seenDispatches = new Set<string>();
 function rememberDispatch(id: string): void {
@@ -1296,7 +1326,12 @@ app.post('/webhook', async (req: Request, res: Response) => {
   if (dispatch && seenDispatches.has(dispatch)) {
     return res.status(200).json({ ok: true, duplicate: true });
   }
-  if (dispatch) rememberDispatch(dispatch);
+  // A dispatch is remembered ONLY after it has been fully handled (see the
+  // success returns below), never here. Remembering before the work would mark
+  // a dispatch that then FAILS to decrypt (422 below) as "seen", so OneAddress's
+  // retry after you fix the key would be dismissed as a duplicate and the update
+  // lost. The connection-verification probe (address.test) is never remembered
+  // at all, so re-running go-live always re-tests instead of short-circuiting.
 
   const event = body.event as string;
 
@@ -1387,6 +1422,7 @@ app.post('/webhook', async (req: Request, res: Response) => {
   if (event === 'address.updated') {
     console.log(\`[webhook] address.updated for \${ctx.accountNumber || ctx.name}\`);
     await saveAddress(ctx, address);
+    if (dispatch) rememberDispatch(dispatch); // remember only after it is stored
     return res.status(200).json({ ok: true });
   }
 
@@ -1423,6 +1459,7 @@ app.post('/webhook', async (req: Request, res: Response) => {
         token:       callbackToken,
       }),
     });
+    if (dispatch) rememberDispatch(dispatch); // remember only after the callback posted
     return res.status(200).json({ ok: true });
   }
 
@@ -5372,7 +5409,7 @@ async function scaffold(platform, outputDir, partnerId, webhookSecret, webhookUr
 
 // src/register.ts
 var import_node_crypto = require("crypto");
-var PKG_VERSION = true ? "1.3.4" : "dev";
+var PKG_VERSION = true ? "1.4.1" : "dev";
 var REGISTER_URL = "https://partners.oneaddress.io/api/partner/installs";
 function hmacSha256(secret, message) {
   return (0, import_node_crypto.createHmac)("sha256", secret).update(message).digest("hex");
@@ -5499,6 +5536,67 @@ async function runConformance(webhookUrl, _partnerId, webhookSecret) {
     M2.warn(`Conformance: ${passed}/${tests.length} passed. Check your WEBHOOK_SECRET and timestamp enforcement.`);
   }
 }
+var VERIFY_DECRYPT_API = "https://partners.oneaddress.io/api/partner/verify-decrypt";
+async function runDecryptCheck(webhookSecret, partnerId) {
+  async function callOnce() {
+    try {
+      const ts = String(Math.floor(Date.now() / 1e3));
+      const sig = (0, import_node_crypto2.createHmac)("sha256", webhookSecret).update(`${ts}.`).digest("hex");
+      const res2 = await fetch(VERIFY_DECRYPT_API, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "X-OneAddress-Timestamp": ts,
+          "X-OneAddress-Signature": sig,
+          "X-OneAddress-Partner": partnerId
+        },
+        // The portal-to-receiver probe can take a few seconds; give it room.
+        signal: AbortSignal.timeout(2e4)
+      });
+      return { res: res2 };
+    } catch (err) {
+      return { netErr: err instanceof Error ? err.message : String(err) };
+    }
+  }
+  let { res, netErr } = await callOnce();
+  if (!res) {
+    await new Promise((r2) => setTimeout(r2, 1500));
+    ({ res, netErr } = await callOnce());
+  }
+  if (!res) {
+    M2.warn(`Decrypt check skipped: could not reach the portal (${netErr}). Re-run once you are back online.`);
+    return;
+  }
+  if (res.status === 404 || res.status === 405) {
+    M2.info("Decrypt check skipped (the portal does not offer it yet). Your go-live switch will run the same check.");
+    return;
+  }
+  if (res.status === 401 || res.status === 403) {
+    M2.warn("Decrypt check skipped: the portal rejected your signing secret. Copy it again from your profile.");
+    return;
+  }
+  if (!res.ok) {
+    M2.warn(`Decrypt check skipped: the portal returned HTTP ${res.status}.`);
+    return;
+  }
+  let data;
+  try {
+    data = await res.json();
+  } catch {
+    M2.warn("Decrypt check skipped: the portal returned an unexpected response.");
+    return;
+  }
+  if (data.decrypted === true) {
+    M2.success("Decrypt check passed \u2014 your receiver decrypted our encrypted test, so your key is correctly installed. Go-live will not surprise you.");
+    return;
+  }
+  if (data.code) {
+    M2.info(`Decrypt check not run yet: ${data.reason ?? "a setup step is still outstanding."}`);
+    return;
+  }
+  const reason = data.reason ?? "Your receiver answered but could not decrypt our encrypted test, which almost always means the private key in your receiver does not match your registered encryption key.";
+  M2.warn(`Decrypt check FAILED: ${reason}`);
+}
 
 // src/install.ts
 var import_node_child_process = require("child_process");
@@ -6375,6 +6473,7 @@ async function main() {
   let webhookReady = true;
   let tunnelBase = null;
   let existingUrlReason = "";
+  let keepExistingUrl = false;
   const existingUrlResult = await getExistingWebhookUrl(pid, secret, (r2) => {
     existingUrlReason = r2;
   });
@@ -6390,9 +6489,9 @@ Continuing will overwrite it.`
     });
     assertNotCancelled(continueAnyway);
     if (!continueAnyway) {
-      runCleanup();
-      Se("Setup cancelled \u2014 your existing webhook URL was not changed.");
-      process.exit(0);
+      keepExistingUrl = true;
+      webhookUrl = existingUrlResult;
+      M2.info(`Keeping your existing webhook URL: ${webhookUrl}`);
     }
   } else if (existingUrlResult === void 0) {
     M2.warn(
@@ -6409,70 +6508,72 @@ Continuing will overwrite it.`
       process.exit(0);
     }
   }
-  const hasPublicUrl = await ye({
-    message: "Do you have a public HTTPS URL where this server is reachable?",
-    initialValue: false
-  });
-  assertNotCancelled(hasPublicUrl);
-  if (hasPublicUrl) {
-    const providedUrl = await he({
-      message: "Your public HTTPS webhook URL",
-      placeholder: "https://my-api.example.com/webhook",
-      validate: (v2) => {
-        if (!v2.trim()) return "URL is required";
-        if (!v2.trim().startsWith("https://"))
-          return "Must start with https:// \u2014 OneAddress enforces HTTPS for outbound webhooks";
-      }
+  if (!keepExistingUrl) {
+    const hasPublicUrl = await ye({
+      message: "Do you have a public HTTPS URL where this server is reachable?",
+      initialValue: false
     });
-    assertNotCancelled(providedUrl);
-    webhookUrl = providedUrl.trim();
-  } else {
-    M2.info("\nSetting up a free HTTPS tunnel via Cloudflare Tunnel\u2026");
-    const s4 = Y2();
-    s4.start("Starting Cloudflare Tunnel");
-    onCleanup(stopTunnel);
-    try {
-      let tunnel = await startTunnel(3001);
-      webhookUrl = `${tunnel.url}/webhook`;
-      tunnelBase = tunnel.url;
-      s4.stop(`Tunnel active: ${tunnel.url}`);
-      M2.warn(
-        "IMPORTANT: This tunnel URL is temporary. It lives only while this wizard\nkeeps running, and every run gets a new address. Before going to production,\ndeploy to a permanent server and update the webhook URL in the portal."
-      );
-      const s4b = Y2();
-      s4b.start("Waiting for the tunnel to start routing");
-      webhookReady = await waitForTunnelReady(tunnel.url);
-      if (!webhookReady) {
-        s4b.stop("First tunnel is slow to route, trying a fresh one");
-        stopTunnel();
-        tunnel = await startTunnel(3001);
+    assertNotCancelled(hasPublicUrl);
+    if (hasPublicUrl) {
+      const providedUrl = await he({
+        message: "Your public HTTPS webhook URL",
+        placeholder: "https://my-api.example.com/webhook",
+        validate: (v2) => {
+          if (!v2.trim()) return "URL is required";
+          if (!v2.trim().startsWith("https://"))
+            return "Must start with https:// \u2014 OneAddress enforces HTTPS for outbound webhooks";
+        }
+      });
+      assertNotCancelled(providedUrl);
+      webhookUrl = providedUrl.trim();
+    } else {
+      M2.info("\nSetting up a free HTTPS tunnel via Cloudflare Tunnel\u2026");
+      const s4 = Y2();
+      s4.start("Starting Cloudflare Tunnel");
+      onCleanup(stopTunnel);
+      try {
+        let tunnel = await startTunnel(3001);
         webhookUrl = `${tunnel.url}/webhook`;
         tunnelBase = tunnel.url;
-        const s4c = Y2();
-        s4c.start(`Waiting for the new tunnel to route: ${tunnel.url}`);
-        webhookReady = await waitForTunnelReady(tunnel.url, { budgetMs: 45e3 });
-        s4c.stop(webhookReady ? "Tunnel is routing" : "Tunnel still not routing");
-      } else {
-        s4b.stop("Tunnel is routing");
-      }
-      if (!webhookReady) {
+        s4.stop(`Tunnel active: ${tunnel.url}`);
         M2.warn(
-          `The tunnel edge is still not routing after a retry. This is almost always
+          "IMPORTANT: This tunnel URL is temporary. It lives only while this wizard\nkeeps running, and every run gets a new address. Before going to production,\ndeploy to a permanent server and update the webhook URL in the portal."
+        );
+        const s4b = Y2();
+        s4b.start("Waiting for the tunnel to start routing");
+        webhookReady = await waitForTunnelReady(tunnel.url);
+        if (!webhookReady) {
+          s4b.stop("First tunnel is slow to route, trying a fresh one");
+          stopTunnel();
+          tunnel = await startTunnel(3001);
+          webhookUrl = `${tunnel.url}/webhook`;
+          tunnelBase = tunnel.url;
+          const s4c = Y2();
+          s4c.start(`Waiting for the new tunnel to route: ${tunnel.url}`);
+          webhookReady = await waitForTunnelReady(tunnel.url, { budgetMs: 45e3 });
+          s4c.stop(webhookReady ? "Tunnel is routing" : "Tunnel still not routing");
+        } else {
+          s4b.stop("Tunnel is routing");
+        }
+        if (!webhookReady) {
+          M2.warn(
+            `The tunnel edge is still not routing after a retry. This is almost always
 one of two things, and neither is your server (it is running on :3001):
   1. Open ${tunnel.url}/health in a browser. If it never loads, your network
      is blocking cloudflared and no wait will fix it, so try a different network.
   2. The tunnel only lives while this wizard runs, so keep this window open.`
+          );
+        }
+      } catch (err) {
+        s4.stop("Tunnel setup failed");
+        M2.warn(`Could not start tunnel: ${err instanceof Error ? err.message : String(err)}`);
+        M2.warn(
+          "To get a public URL manually, try: npx cloudflared tunnel --url http://localhost:3001\nOr deploy to any server and set the URL in partners.oneaddress.io \u2192 My Profile."
         );
       }
-    } catch (err) {
-      s4.stop("Tunnel setup failed");
-      M2.warn(`Could not start tunnel: ${err instanceof Error ? err.message : String(err)}`);
-      M2.warn(
-        "To get a public URL manually, try: npx cloudflared tunnel --url http://localhost:3001\nOr deploy to any server and set the URL in partners.oneaddress.io \u2192 My Profile."
-      );
     }
   }
-  if (webhookUrl) {
+  if (webhookUrl && !keepExistingUrl) {
     const s5 = Y2();
     s5.start("Registering webhook URL in the Partner Portal");
     const reg = await registerWebhookUrl(pid, secret, webhookUrl);
@@ -6516,6 +6617,7 @@ tunnel needing this wizard to stay open. Re-run once that URL loads in a browser
       await new Promise((r2) => setTimeout(r2, 200));
       s6.stop("Conformance checks:");
       await runConformance(webhookUrl, pid, secret);
+      await runDecryptCheck(secret, pid);
       if (verifiesAccountReference) {
         M2.info(
           "You have declared that your receiver matches the account reference itself.\nRun `npm test` to include check-14, which sends an account reference that matches\nnothing and fails a receiver that reports it as applied. The three checks above\ncover signing and replay only."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneaddress/setup",
-  "version": "1.3.4",
+  "version": "1.4.1",
   "description": "Interactive setup wizard for OneAddress partner webhook integrations",
   "main": "dist/index.js",
   "bin": {