@oneaddress/setup 1.6.0 → 1.6.1

package/dist/index.js

@@ -856,7 +856,7 @@ var _R = ["\u2588\u2588\u2588\u2588\u2588\u2588 ", "\u2588\u2588   \u2588\u2588"
 var _S = [" \u2588\u2588\u2588\u2588\u2588\u2588", "\u2588\u2588     ", "\u2588\u2588     ", " \u2588\u2588\u2588\u2588\u2588 ", "     \u2588\u2588", "     \u2588\u2588", "\u2588\u2588\u2588\u2588\u2588\u2588 "];
 var ONE_ROWS = Array.from({ length: 7 }, (_3, i) => [_O[i], _N[i], _E[i]].join(" "));
 var ADDR_ROWS = Array.from({ length: 7 }, (_3, i) => [_A[i], _D2[i], _D2[i], _R[i], _E[i], _S[i], _S[i]].join(" "));
-var WIZARD_VERSION = true ? "1.6.0" : "?";
+var WIZARD_VERSION = true ? "1.6.1" : "?";
 function printCompactHeader() {
   const INNER = 42;
   const TOP = fn("\u250C") + dm("\u2500".repeat(INNER)) + fn("\u2510");
@@ -1667,6 +1667,18 @@ app.post('/webhook', webhookLimiter, async (req: Request, res: Response) => {
     return res.status(200).json({ status });
   }
 
+  // A valid signed request that carries no address payload \u2014 a conformance ping,
+  // or any event added after this receiver was generated \u2014 has already passed
+  // timestamp + signature above, which is exactly what such a probe tests.
+  // Acknowledge it here; only the real dispatch events below require decryption.
+  // A real address.updated that arrives WITHOUT a payload still falls through to
+  // the 422 below, because it IS a dispatch event.
+  const DISPATCH_EVENTS = ['address.updated', 'address.verify', 'address.test', 'address.test-dispatch'];
+  if (!DISPATCH_EVENTS.includes(event)) {
+    console.log(\`[webhook] "\${event}" acknowledged (no address payload to decrypt)\`);
+    return res.status(200).json({ ok: true, skipped: true });
+  }
+
   // 5. Decrypt the address payload. Two shapes possible, exactly one per event:
   //   (a) D5 (2026+): body.session_envelope + body.session_key_share. Under D5,
   //       address.updated no longer carries a cleartext \`customer\` block \u2014
@@ -2316,6 +2328,15 @@ async def webhook(request: Request) -> Response:
     if dispatch:
         seen_dispatches.add(dispatch)
 
+    # A valid signed request that carries no address payload \u2014 a conformance
+    # ping, or any event added after this receiver was generated \u2014 has already
+    # passed timestamp + signature above, which is exactly what such a probe
+    # tests. Acknowledge it here; only the real dispatch events below require
+    # decryption. A real address.updated with no payload still 422s below.
+    if event not in ("address.updated", "address.verify", "address.test", "address.test-dispatch"):
+        print(f"[webhook] '{event}' acknowledged (no address payload to decrypt)")
+        return Response(content='{"ok":true,"skipped":true}', media_type="application/json")
+
     # Two possible payload shapes:
     #   (a) D5  \u2014 body.session_envelope (str) + body.session_key_share (dict)
     #   (b) Legacy \u2014 body.address_encrypted (dict)
@@ -4582,6 +4603,19 @@ func main() {
 
 		event, _ := parsed["event"].(string)
 
+		// A valid signed request that carries no address payload \u2014 a conformance
+		// ping, or any event added after this receiver was generated \u2014 has already
+		// passed timestamp + signature above, which is exactly what such a probe
+		// tests. Acknowledge it here; only the real dispatch events below require
+		// decryption. A real address.updated with no payload still 422s below.
+		switch event {
+		case "address.updated", "address.verify", "address.test", "address.test-dispatch":
+		default:
+			log.Printf("[webhook] %q acknowledged (no address payload to decrypt)", event)
+			jsonResp(w, 200, map[string]any{"ok": true, "skipped": true})
+			return
+		}
+
 		// Two possible payload shapes \u2014 D5 takes precedence when both fields
 		// are present. Production deployments holding multiple key rotations
 		// should look up the right private key by session_key_share.key_id;
@@ -5782,7 +5816,7 @@ async function scaffold(platform, outputDir, partnerId, webhookSecret, webhookUr
 
 // src/register.ts
 var import_node_crypto = require("crypto");
-var PKG_VERSION = true ? "1.6.0" : "dev";
+var PKG_VERSION = true ? "1.6.1" : "dev";
 var REGISTER_URL = "https://partners.oneaddress.io/api/partner/installs";
 function hmacSha256(secret, message) {
   return (0, import_node_crypto.createHmac)("sha256", secret).update(message).digest("hex");
@@ -6741,26 +6775,23 @@ async function main() {
     ]
   });
   assertNotCancelled(platform);
-  const outputDir = await he({
-    message: "Where to write the files?",
-    placeholder: "./oneaddress-webhook",
-    defaultValue: "./oneaddress-webhook"
-  });
-  assertNotCancelled(outputDir);
-  const outDir = outputDir.trim() || "./oneaddress-webhook";
-  if ((0, import_node_fs5.existsSync)(outDir)) {
-    const entries = (0, import_node_fs5.readdirSync)(outDir);
-    if (entries.length > 0) {
-      const overwrite = await ye({
-        message: `${outDir} already has files \u2014 overwrite?`,
-        initialValue: false
-      });
-      assertNotCancelled(overwrite);
-      if (!overwrite) {
-        xe("Choose a different output directory and run again.");
-        process.exit(0);
-      }
-    }
+  let outDir;
+  for (; ; ) {
+    const outputDir = await he({
+      message: "Where to write the files?",
+      placeholder: "./oneaddress-webhook",
+      defaultValue: "./oneaddress-webhook"
+    });
+    assertNotCancelled(outputDir);
+    outDir = outputDir.trim() || "./oneaddress-webhook";
+    if (!(0, import_node_fs5.existsSync)(outDir) || (0, import_node_fs5.readdirSync)(outDir).length === 0) break;
+    const overwrite = await ye({
+      message: `${outDir} already has files \u2014 overwrite?`,
+      initialValue: false
+    });
+    assertNotCancelled(overwrite);
+    if (overwrite) break;
+    M2.info(`Keeping the files in ${outDir}. Enter a different directory to write into.`);
   }
   let accountRefReason = "";
   const accountRefDeclaration = await getVerifiesAccountReference(pid, secret, (r2) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneaddress/setup",
-  "version": "1.6.0",
+  "version": "1.6.1",
   "description": "Interactive setup wizard for OneAddress partner webhook integrations",
   "main": "dist/index.js",
   "bin": {