@oneaddress/setup 1.4.0 → 1.4.1

package/dist/index.js

@@ -856,7 +856,7 @@ var _R = ["\u2588\u2588\u2588\u2588\u2588\u2588 ", "\u2588\u2588   \u2588\u2588"
 var _S = [" \u2588\u2588\u2588\u2588\u2588\u2588", "\u2588\u2588     ", "\u2588\u2588     ", " \u2588\u2588\u2588\u2588\u2588 ", "     \u2588\u2588", "     \u2588\u2588", "\u2588\u2588\u2588\u2588\u2588\u2588 "];
 var ONE_ROWS = Array.from({ length: 7 }, (_3, i) => [_O[i], _N[i], _E[i]].join(" "));
 var ADDR_ROWS = Array.from({ length: 7 }, (_3, i) => [_A[i], _D2[i], _D2[i], _R[i], _E[i], _S[i], _S[i]].join(" "));
-var WIZARD_VERSION = true ? "1.4.0" : "?";
+var WIZARD_VERSION = true ? "1.4.1" : "?";
 function printCompactHeader() {
   const INNER = 42;
   const TOP = fn("\u250C") + dm("\u2500".repeat(INNER)) + fn("\u2510");
@@ -5409,7 +5409,7 @@ async function scaffold(platform, outputDir, partnerId, webhookSecret, webhookUr
 
 // src/register.ts
 var import_node_crypto = require("crypto");
-var PKG_VERSION = true ? "1.4.0" : "dev";
+var PKG_VERSION = true ? "1.4.1" : "dev";
 var REGISTER_URL = "https://partners.oneaddress.io/api/partner/installs";
 function hmacSha256(secret, message) {
   return (0, import_node_crypto.createHmac)("sha256", secret).update(message).digest("hex");
@@ -5536,6 +5536,67 @@ async function runConformance(webhookUrl, _partnerId, webhookSecret) {
     M2.warn(`Conformance: ${passed}/${tests.length} passed. Check your WEBHOOK_SECRET and timestamp enforcement.`);
   }
 }
+var VERIFY_DECRYPT_API = "https://partners.oneaddress.io/api/partner/verify-decrypt";
+async function runDecryptCheck(webhookSecret, partnerId) {
+  async function callOnce() {
+    try {
+      const ts = String(Math.floor(Date.now() / 1e3));
+      const sig = (0, import_node_crypto2.createHmac)("sha256", webhookSecret).update(`${ts}.`).digest("hex");
+      const res2 = await fetch(VERIFY_DECRYPT_API, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "X-OneAddress-Timestamp": ts,
+          "X-OneAddress-Signature": sig,
+          "X-OneAddress-Partner": partnerId
+        },
+        // The portal-to-receiver probe can take a few seconds; give it room.
+        signal: AbortSignal.timeout(2e4)
+      });
+      return { res: res2 };
+    } catch (err) {
+      return { netErr: err instanceof Error ? err.message : String(err) };
+    }
+  }
+  let { res, netErr } = await callOnce();
+  if (!res) {
+    await new Promise((r2) => setTimeout(r2, 1500));
+    ({ res, netErr } = await callOnce());
+  }
+  if (!res) {
+    M2.warn(`Decrypt check skipped: could not reach the portal (${netErr}). Re-run once you are back online.`);
+    return;
+  }
+  if (res.status === 404 || res.status === 405) {
+    M2.info("Decrypt check skipped (the portal does not offer it yet). Your go-live switch will run the same check.");
+    return;
+  }
+  if (res.status === 401 || res.status === 403) {
+    M2.warn("Decrypt check skipped: the portal rejected your signing secret. Copy it again from your profile.");
+    return;
+  }
+  if (!res.ok) {
+    M2.warn(`Decrypt check skipped: the portal returned HTTP ${res.status}.`);
+    return;
+  }
+  let data;
+  try {
+    data = await res.json();
+  } catch {
+    M2.warn("Decrypt check skipped: the portal returned an unexpected response.");
+    return;
+  }
+  if (data.decrypted === true) {
+    M2.success("Decrypt check passed \u2014 your receiver decrypted our encrypted test, so your key is correctly installed. Go-live will not surprise you.");
+    return;
+  }
+  if (data.code) {
+    M2.info(`Decrypt check not run yet: ${data.reason ?? "a setup step is still outstanding."}`);
+    return;
+  }
+  const reason = data.reason ?? "Your receiver answered but could not decrypt our encrypted test, which almost always means the private key in your receiver does not match your registered encryption key.";
+  M2.warn(`Decrypt check FAILED: ${reason}`);
+}
 
 // src/install.ts
 var import_node_child_process = require("child_process");
@@ -6556,6 +6617,7 @@ tunnel needing this wizard to stay open. Re-run once that URL loads in a browser
       await new Promise((r2) => setTimeout(r2, 200));
       s6.stop("Conformance checks:");
       await runConformance(webhookUrl, pid, secret);
+      await runDecryptCheck(secret, pid);
       if (verifiesAccountReference) {
         M2.info(
           "You have declared that your receiver matches the account reference itself.\nRun `npm test` to include check-14, which sends an account reference that matches\nnothing and fails a receiver that reports it as applied. The three checks above\ncover signing and replay only."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneaddress/setup",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "description": "Interactive setup wizard for OneAddress partner webhook integrations",
   "main": "dist/index.js",
   "bin": {