@voxiness/n8n-nodes-voxisms 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 VoxiSMS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,87 @@
+# @voxiness/n8n-nodes-voxisms
+
+n8n community nodes for [VoxiSMS](https://voxisms.com): send SMS through the VoxiSMS ecosystem, and start workflows on inbound SMS.
+
+Two nodes:
+
+- **VoxiSMS** (action node): sends an SMS.
+- **VoxiSMS Trigger** (trigger node, "New Inbound SMS"): starts the workflow when your VoxiSMS number receives an inbound SMS.
+
+## Installation
+
+### n8n GUI (Community Nodes)
+
+**Settings → Community Nodes → Install**, then enter the package name:
+
+```
+@voxiness/n8n-nodes-voxisms
+```
+
+### Self-hosted (npm)
+
+```bash
+npm install @voxiness/n8n-nodes-voxisms
+```
+
+Restart n8n after installing.
+
+## Credentials
+
+Both nodes use the **VoxiSMS API** credential type: `Customer ID` + `Token`. Get both from the "Link your phone" page in your VoxiPlan dashboard: https://app.voxiplan.com/voxisms
+
+- **Customer ID**: the phone number you registered, without the leading `+` (e.g. `33639980000`). Listed under "Register your number".
+- **Token**: listed under "Activate your token". The same token you paste into the VoxiSMS Android app during setup.
+
+Use the credential's "Test" button to verify your setup. It performs a signed, read-only status check and does **not** send an SMS.
+
+## Nodes
+
+### VoxiSMS (Send SMS)
+
+| Field | Required | Description |
+|---|---|---|
+| Recipient | yes | Phone number in E.164 format (e.g. `+15551234567`) |
+| Message | yes | The SMS text content |
+| Message ID | no | Optional custom message id; a UUID is generated automatically if left empty |
+
+On success, the node outputs `{ messageId, sqsMessageId }`.
+
+### VoxiSMS Trigger (New Inbound SMS)
+
+Instant (webhook) trigger, no configurable parameters. Activating the workflow registers a webhook subscription with VoxiSMS using n8n's auto-generated webhook URL; deactivating the workflow removes it.
+
+Each verified delivery emits one item shaped as an `InboundMessageEvent`:
+
+```json
+{
+  "version": "1",
+  "event": "inbound_message.received",
+  "eventId": "evt_0f2f8f0e-924a-5b8b-8352-6fc04c31ddbd",
+  "messageId": "69d44359-1c82-4f84-a9a0-45c89bb4ce98",
+  "customerId": "33639980000",
+  "occurredAt": "2026-07-14T14:42:18.123Z",
+  "messageType": "sms",
+  "fromNumber": "+32470987654",
+  "toNumber": "+33639980000",
+  "content": "Yes, that works for me"
+}
+```
+
+Notes:
+
+- Every delivery is HMAC-verified (`X-VoxiSMS-Signature` / `X-VoxiSMS-Timestamp`) before the workflow fires. An unsigned request is dropped quietly; a present-but-invalid signature is rejected and never fires the workflow.
+- Deliveries are **at-least-once**: VoxiSMS may retry a delivery, and n8n does not de-duplicate incoming webhook payloads. Use `eventId` to de-duplicate downstream if your workflow needs exactly-once processing.
+
+## Building from source
+
+```bash
+npm install     # install dependencies
+npm run build   # compile TypeScript and copy node icons into dist/
+npm test        # run the unit tests
+```
+
+If your n8n instance restricts outbound network access, allow `api.voxisms.com`.
+
+## License
+
+MIT, see [LICENSE](LICENSE).

package/dist/credentials/VoxiSmsApi.credentials.d.ts

@@ -0,0 +1,7 @@
+import type { ICredentialType, INodeProperties } from 'n8n-workflow';
+export declare class VoxiSmsApi implements ICredentialType {
+    name: string;
+    displayName: string;
+    documentationUrl: string;
+    properties: INodeProperties[];
+}

package/dist/credentials/VoxiSmsApi.credentials.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VoxiSmsApi = void 0;
+// VoxiSMS credential definition.
+//
+// Auth is per-user HMAC (VoxiSMS v2): every request is signed with the user's secret
+// token — there is NO shared api-key, and neither `customerId` nor `secretKey` is ever
+// sent in the request body. The three signed headers (customer-id, timestamp, signature)
+// are built per-request by `buildSignedHeaders` in `nodes/shared/signing.ts`.
+//
+// We deliberately do NOT declare a generic `authenticate` block here. n8n's generic auth
+// can only inject static headers/query params; our signature depends on the HTTP method,
+// the base-path-stripped route, a fresh timestamp, AND the exact request-body bytes. That
+// is request-specific, so signing happens inside each node (the Send node and the
+// connection test) where those values are known — never as a one-size-fits-all header.
+class VoxiSmsApi {
+    constructor() {
+        this.name = 'voxiSmsApi';
+        this.displayName = 'VoxiSMS API';
+        // Points at the VoxiPlan dashboard page where users find both fields below.
+        this.documentationUrl = 'https://app.voxiplan.com/voxisms';
+        this.properties = [
+            {
+                // The customer identifier is the registered phone number. We normalize away a
+                // pasted leading "+" / spaces at sign time (normalizeCustomerId), but ask users
+                // to enter it without the "+" to match what they see in the dashboard.
+                displayName: 'Customer ID',
+                name: 'customerId',
+                type: 'string',
+                default: '',
+                required: true,
+                placeholder: '33639980000',
+                description: 'Enter the phone number you registered, without the leading "+" (e.g. 33639980000). You can find it under "Register your number" on the "Link your phone" page (https://app.voxiplan.com/voxisms) in your VoxiPlan dashboard.',
+            },
+            {
+                // Labeled "Token" (not "Secret Key") to match the wording in the VoxiPlan
+                // dashboard and the VoxiSMS Android app. Masked in the UI via password option.
+                displayName: 'Token',
+                name: 'secretKey',
+                type: 'string',
+                typeOptions: { password: true },
+                default: '',
+                required: true,
+                description: 'Copy the token shown under "Activate your token" on the "Link your phone" page (https://app.voxiplan.com/voxisms) in your VoxiPlan dashboard — it\'s the same token you paste from the VoxiSMS Android app during setup.',
+            },
+        ];
+    }
+}
+exports.VoxiSmsApi = VoxiSmsApi;

package/dist/nodes/VoxiSms/VoxiSms.node.d.ts

@@ -0,0 +1,10 @@
+import type { ICredentialTestFunctions, ICredentialsDecrypted, IExecuteFunctions, INodeCredentialTestResult, INodeExecutionData, INodeType, INodeTypeDescription } from 'n8n-workflow';
+export declare class VoxiSms implements INodeType {
+    description: INodeTypeDescription;
+    methods: {
+        credentialTest: {
+            voxiSmsApiTest(this: ICredentialTestFunctions, credential: ICredentialsDecrypted): Promise<INodeCredentialTestResult>;
+        };
+    };
+    execute(this: IExecuteFunctions): Promise<INodeExecutionData[][]>;
+}

package/dist/nodes/VoxiSms/VoxiSms.node.js

@@ -0,0 +1,256 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VoxiSms = void 0;
+const crypto_1 = require("crypto");
+const n8n_workflow_1 = require("n8n-workflow");
+const signing_1 = require("../shared/signing");
+// Full URLs (the `/v2` base path lives here, in the URL). The SIGNED path is the
+// base-path-stripped route constant (ENQUEUE_PATH / STATUS_PATH) — API Gateway strips
+// `/v2` before the Lambda signs, so the URL path and the signed path differ on purpose.
+const ENQUEUE_URL = 'https://api.voxisms.com/v2/enqueue-message';
+const STATUS_URL = 'https://api.voxisms.com/v2/user/status';
+// Default delivery-status callback baked into every send (matches the Zapier action).
+const WEBHOOK_URL = 'https://app.voxiplan.com/webhooks/sms/events';
+// Best-effort JSON parse of an HTTP response body. n8n's httpRequest usually parses a
+// JSON response into an object already, but a string can come back (e.g. non-JSON
+// content-type); handle both so the caller always gets a plain object.
+function toObject(body) {
+    if (body && typeof body === 'object') {
+        return body;
+    }
+    if (typeof body === 'string') {
+        try {
+            return JSON.parse(body);
+        }
+        catch {
+            return { response: body };
+        }
+    }
+    return {};
+}
+// Extract the server's `{ error }` message from a v2 error body, if present.
+function serverErrorMessage(body) {
+    const parsed = toObject(body);
+    return typeof parsed.error === 'string' ? parsed.error : undefined;
+}
+class VoxiSms {
+    constructor() {
+        this.description = {
+            displayName: 'VoxiSMS',
+            name: 'voxiSms',
+            icon: 'file:voxisms.svg',
+            group: ['output'],
+            version: 1,
+            description: 'Send an SMS via VoxiSMS',
+            defaults: {
+                name: 'VoxiSMS',
+            },
+            inputs: ['main'],
+            outputs: ['main'],
+            credentials: [
+                {
+                    name: 'voxiSmsApi',
+                    required: true,
+                    // Wires the "Test" button in the credential modal to voxiSmsApiTest below.
+                    testedBy: 'voxiSmsApiTest',
+                },
+            ],
+            // Flat, single-action node (like the Zapier "Send SMS" action) — no
+            // resource/operation dropdowns for a package that does exactly one thing.
+            properties: [
+                {
+                    displayName: 'Recipient',
+                    name: 'recipient',
+                    type: 'string',
+                    default: '',
+                    required: true,
+                    placeholder: '+15551234567',
+                    description: 'Phone number in E.164 format (e.g. +15551234567)',
+                },
+                {
+                    displayName: 'Message',
+                    name: 'message',
+                    type: 'string',
+                    typeOptions: { rows: 4 },
+                    default: '',
+                    required: true,
+                    description: 'The SMS message content',
+                },
+                {
+                    displayName: 'Message ID',
+                    name: 'id',
+                    type: 'string',
+                    default: '',
+                    description: 'Optional custom message ID. A UUID will be generated automatically if left empty.',
+                },
+            ],
+        };
+        this.methods = {
+            credentialTest: {
+                // Side-effect-free credential check: a signed GET to the read-only status
+                // endpoint (does NOT send an SMS). Success is HTTP 200; the endpoint returns
+                // distinct failure codes we map to the same friendly messages as the Zapier
+                // integration's authentication test.
+                async voxiSmsApiTest(credential) {
+                    var _a, _b, _c;
+                    const data = ((_a = credential.data) !== null && _a !== void 0 ? _a : {});
+                    // Normalize ONCE and reuse for both the signed canonical and the customer-id
+                    // header (buildSignedHeaders uses this same value for both, so they can't
+                    // disagree).
+                    const customerId = (0, signing_1.normalizeCustomerId)((_b = data.customerId) !== null && _b !== void 0 ? _b : '');
+                    const secretKey = (_c = data.secretKey) !== null && _c !== void 0 ? _c : '';
+                    // Body-less GET: bodyString defaults to '' inside buildSignedHeaders, so the
+                    // canonical ends in a trailing '\n' + empty segment, matching the server's
+                    // `body: b""`.
+                    const headers = (0, signing_1.buildSignedHeaders)({
+                        method: 'GET',
+                        path: signing_1.STATUS_PATH,
+                        customerId,
+                        secretKey,
+                    });
+                    let statusCode;
+                    try {
+                        // Legacy request helper (the only one exposed to credential tests). We
+                        // inspect the status ourselves — resolveWithFullResponse gives us the
+                        // status, simple:false stops it throwing on non-2xx.
+                        const response = await this.helpers.request({
+                            method: 'GET',
+                            uri: STATUS_URL,
+                            headers,
+                            resolveWithFullResponse: true,
+                            simple: false,
+                        });
+                        statusCode = response.statusCode;
+                    }
+                    catch (error) {
+                        // A transport-level failure (DNS, TLS, timeout) — not an HTTP status.
+                        return {
+                            status: 'Error',
+                            message: `Could not reach VoxiSMS: ${error.message}`,
+                        };
+                    }
+                    if (statusCode === 200) {
+                        return { status: 'OK', message: 'Connection successful!' };
+                    }
+                    if (statusCode === 403) {
+                        return {
+                            status: 'Error',
+                            message: 'Authentication failed. Check your Token, and make sure your system clock is accurate (requests must be within 5 minutes of server time).',
+                        };
+                    }
+                    if (statusCode === 404) {
+                        return {
+                            status: 'Error',
+                            message: 'Customer ID not found. Check the phone number you registered.',
+                        };
+                    }
+                    if (statusCode === 400) {
+                        return {
+                            status: 'Error',
+                            message: 'This account is not fully set up yet. Contact VoxiSMS support.',
+                        };
+                    }
+                    return {
+                        status: 'Error',
+                        message: 'Could not verify credentials. Check your Customer ID and Token.',
+                    };
+                },
+            },
+        };
+    }
+    async execute() {
+        var _a, _b;
+        const items = this.getInputData();
+        const returnData = [];
+        // Credentials are the same for every item; fetch and normalize ONCE.
+        const credentials = (await this.getCredentials('voxiSmsApi'));
+        const customerId = (0, signing_1.normalizeCustomerId)((_a = credentials.customerId) !== null && _a !== void 0 ? _a : '');
+        const secretKey = (_b = credentials.secretKey) !== null && _b !== void 0 ? _b : '';
+        for (let i = 0; i < items.length; i++) {
+            try {
+                const recipient = this.getNodeParameter('recipient', i);
+                const message = this.getNodeParameter('message', i);
+                const id = this.getNodeParameter('id', i, '');
+                // CRITICAL INVARIANT — sign-once / send-same-bytes:
+                // Serialize the body EXACTLY ONCE with JSON.stringify, sign THAT string, then
+                // send THAT string verbatim on the wire. Re-serializing (or letting the HTTP
+                // client re-encode an object) could reorder keys or change spacing and break
+                // the signature. That's why `body` below is the string, NOT an object, and we
+                // set Content-Type ourselves (json:true is intentionally NOT used).
+                const bodyString = JSON.stringify({
+                    id: id || (0, crypto_1.randomUUID)(),
+                    recipient,
+                    message,
+                    webhookUrl: WEBHOOK_URL,
+                    source: 'n8n',
+                });
+                const headers = {
+                    ...(0, signing_1.buildSignedHeaders)({
+                        method: 'POST',
+                        path: signing_1.ENQUEUE_PATH,
+                        customerId,
+                        secretKey,
+                        bodyString,
+                    }),
+                    'Content-Type': 'application/json',
+                };
+                // returnFullResponse: read the status ourselves for friendly errors.
+                // ignoreHttpStatusErrors: don't throw on non-2xx — we map them below.
+                // body is the already-serialized string; httpRequest sends it verbatim.
+                const response = await this.helpers.httpRequest({
+                    method: 'POST',
+                    url: ENQUEUE_URL,
+                    headers,
+                    body: bodyString,
+                    returnFullResponse: true,
+                    ignoreHttpStatusErrors: true,
+                });
+                const statusCode = response.statusCode;
+                const body = response.body;
+                if (statusCode >= 200 && statusCode < 300) {
+                    // Success body: { messageId, sqsMessageId }.
+                    returnData.push({ json: toObject(body), pairedItem: { item: i } });
+                    continue;
+                }
+                // Map the v2 API's real HTTP error statuses to friendly messages, mirroring
+                // the Zapier middleware. The v2 error body shape is { error }.
+                const serverError = serverErrorMessage(body);
+                let friendly;
+                if (statusCode === 401) {
+                    friendly =
+                        'Authentication failed. Check your Customer ID and Token, and make sure your system clock is accurate (within 5 minutes of server time).';
+                }
+                else if (statusCode === 400) {
+                    friendly = serverError || 'Bad request';
+                }
+                else if (statusCode === 405) {
+                    friendly = 'Method not allowed';
+                }
+                else if (statusCode >= 500) {
+                    friendly = serverError || 'Internal server error';
+                }
+                else {
+                    friendly = serverError || `Request failed with status code ${statusCode}`;
+                }
+                throw new n8n_workflow_1.NodeApiError(this.getNode(), toObject(body), {
+                    message: friendly,
+                    httpCode: String(statusCode),
+                    itemIndex: i,
+                });
+            }
+            catch (error) {
+                // Honor "Continue On Fail": emit the error on this item and keep going.
+                if (this.continueOnFail()) {
+                    returnData.push({
+                        json: { error: error.message },
+                        pairedItem: { item: i },
+                    });
+                    continue;
+                }
+                throw error;
+            }
+        }
+        return [returnData];
+    }
+}
+exports.VoxiSms = VoxiSms;

package/dist/nodes/VoxiSms/voxisms.svg

@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="60" height="60" viewBox="0 0 60 60" fill="none">
+  <path d="M12 6h36a8 8 0 0 1 8 8v22a8 8 0 0 1-8 8H26L14 54V44h-2a8 8 0 0 1-8-8V14a8 8 0 0 1 8-8Z" fill="#4F46E5"/>
+  <circle cx="20" cy="25" r="3.2" fill="#FFFFFF"/>
+  <circle cx="30" cy="25" r="3.2" fill="#FFFFFF"/>
+  <circle cx="40" cy="25" r="3.2" fill="#FFFFFF"/>
+</svg>

package/dist/nodes/VoxiSmsTrigger/VoxiSmsTrigger.node.d.ts

@@ -0,0 +1,12 @@
+import { type IHookFunctions, type INodeType, type INodeTypeDescription, type IWebhookFunctions, type IWebhookResponseData } from 'n8n-workflow';
+export declare class VoxiSmsTrigger implements INodeType {
+    description: INodeTypeDescription;
+    webhookMethods: {
+        default: {
+            checkExists(this: IHookFunctions): Promise<boolean>;
+            create(this: IHookFunctions): Promise<boolean>;
+            delete(this: IHookFunctions): Promise<boolean>;
+        };
+    };
+    webhook(this: IWebhookFunctions): Promise<IWebhookResponseData>;
+}

package/dist/nodes/VoxiSmsTrigger/VoxiSmsTrigger.node.js

@@ -0,0 +1,298 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VoxiSmsTrigger = void 0;
+const n8n_workflow_1 = require("n8n-workflow");
+const signing_1 = require("../shared/signing");
+const verifySignature_1 = require("../shared/verifySignature");
+// Full v2 URLs. The signed canonical uses the base-path-stripped path (SUBSCRIPTIONS_PATH,
+// no `/v2`) because API Gateway strips the `/v2` prefix before the Lambda sees it — the
+// wire URL and the signed path deliberately differ.
+const SUBSCRIPTIONS_URL = 'https://api.voxisms.com/v2/webhook-subscriptions';
+// The single event type this trigger subscribes to (see openapi SubscribeRequest).
+const EVENT_TYPE = 'inbound_message.received';
+// Reads a header case-INsensitively. Express lowercases incoming header names, but we do not
+// want to depend on that: read `x-voxisms-signature` / `x-voxisms-timestamp` defensively so a
+// differently-cased proxy in front of n8n cannot make every delivery look unsigned.
+function getHeaderCI(headers, name) {
+    const wanted = name.toLowerCase();
+    for (const key of Object.keys(headers)) {
+        if (key.toLowerCase() === wanted) {
+            return headers[key];
+        }
+    }
+    return undefined;
+}
+class VoxiSmsTrigger {
+    constructor() {
+        this.description = {
+            displayName: 'VoxiSMS Trigger',
+            name: 'voxiSmsTrigger',
+            icon: 'file:voxisms.svg',
+            group: ['trigger'],
+            version: 1,
+            description: 'Starts the workflow when your VoxiSMS number receives an inbound SMS.',
+            defaults: {
+                name: 'VoxiSMS Trigger',
+            },
+            // No user-configurable parameters: the subscription is driven entirely by the
+            // credential and the auto-generated webhook URL. Required by INodeTypeDescription.
+            properties: [],
+            // A trigger has no data inputs; it is fed by an incoming webhook, not an upstream node.
+            inputs: [],
+            outputs: ['main'],
+            credentials: [
+                {
+                    // Credential type owned by the parallel Send-SMS agent; referenced here by name.
+                    name: 'voxiSmsApi',
+                    required: true,
+                },
+            ],
+            webhooks: [
+                {
+                    name: 'default',
+                    httpMethod: 'POST',
+                    // We ACK the delivery ourselves from inside webhook() so we can control the HTTP
+                    // status (200 vs 401) per the signature outcome — see the response policy there.
+                    responseMode: 'onReceived',
+                    path: 'webhook',
+                },
+            ],
+        };
+        // Lifecycle hooks for the subscription REST-hook, run by n8n when the workflow is
+        // activated/deactivated. `this` is IHookFunctions here.
+        this.webhookMethods = {
+            default: {
+                // checkExists — n8n asks whether a live subscription already exists so it can skip a
+                // redundant create. We treat the presence of a persisted subscriptionId as truth.
+                async checkExists() {
+                    const staticData = this.getWorkflowStaticData('node');
+                    return staticData.subscriptionId !== undefined && staticData.subscriptionId !== null;
+                },
+                // create — called when the workflow is activated. Registers our webhook URL with the
+                // VoxiSMS API so future inbound SMS are POSTed to it, and stashes both the returned
+                // subscriptionId (to unsubscribe later) and signingSecret (to verify each delivery).
+                async create() {
+                    var _a;
+                    const webhookUrl = this.getNodeWebhookUrl('default');
+                    if (!webhookUrl) {
+                        throw new n8n_workflow_1.NodeOperationError(this.getNode(), 'Could not determine the webhook URL for this trigger.');
+                    }
+                    const credentials = await this.getCredentials('voxiSmsApi');
+                    // Normalize ONCE and reuse the same value for both the signed canonical and the
+                    // `customer-id` header, so they cannot disagree.
+                    const customerId = (0, signing_1.normalizeCustomerId)(credentials.customerId);
+                    const secretKey = credentials.secretKey;
+                    // CRITICAL INVARIANT: serialize the body ONCE, then sign and send that exact
+                    // string. Never let the HTTP helper re-serialize a parsed object — a re-serialize
+                    // can reorder keys or change whitespace and break the signature the server checks.
+                    const bodyString = JSON.stringify({
+                        targetUrl: webhookUrl,
+                        eventTypes: [EVENT_TYPE],
+                        // The API's SubscribeRequest.provider enum is currently only
+                        // ['zapier','make','generic'] — 'n8n' is rejected with a 400 "unknown provider".
+                        // Use 'generic' until the backend adds an 'n8n' value (then flip this).
+                        provider: 'generic',
+                    });
+                    const headers = {
+                        ...(0, signing_1.buildSignedHeaders)({
+                            method: 'POST',
+                            path: signing_1.SUBSCRIPTIONS_PATH,
+                            customerId,
+                            secretKey,
+                            bodyString,
+                        }),
+                        'Content-Type': 'application/json',
+                    };
+                    const options = {
+                        method: 'POST',
+                        url: SUBSCRIPTIONS_URL,
+                        headers,
+                        // Pass the pre-serialized string as the body and DO NOT set `json: true`; that
+                        // keeps the exact signed bytes on the wire (see the invariant above).
+                        body: bodyString,
+                        json: false,
+                        // Inspect the status ourselves so a non-2xx becomes a friendly, mapped error
+                        // instead of the raw axios-style throw. Mirrors the sibling integrations'
+                        // error mapping (Zapier middleware.js, Make attach.response.error).
+                        returnFullResponse: true,
+                        ignoreHttpStatusErrors: true,
+                    };
+                    const response = (await this.helpers.httpRequest(options));
+                    // The API returns a JSON string when json:false; the helper may still parse it, so
+                    // tolerate both an already-parsed object and a raw string.
+                    const parseBody = (raw) => {
+                        var _a;
+                        if (typeof raw === 'string') {
+                            try {
+                                return JSON.parse(raw);
+                            }
+                            catch {
+                                return {};
+                            }
+                        }
+                        return (_a = raw) !== null && _a !== void 0 ? _a : {};
+                    };
+                    const data = parseBody(response.body);
+                    // Non-2xx: map to the same friendly messages the sibling integrations surface, so
+                    // the user sees an actionable message rather than a raw HTTP error when they turn
+                    // the workflow on. The v2 error body shape is `{ error }`.
+                    if (response.statusCode < 200 || response.statusCode >= 300) {
+                        const serverError = typeof data.error === 'string' ? data.error : undefined;
+                        let message;
+                        if (response.statusCode === 403 || response.statusCode === 401) {
+                            message =
+                                'Authentication failed. Check your Token and make sure your system clock is accurate (requests must be within 5 minutes of server time).';
+                        }
+                        else if (response.statusCode === 404) {
+                            message = 'Customer ID not found. Check the phone number you registered.';
+                        }
+                        else if (response.statusCode === 400) {
+                            // Per the API spec, a subscribe 400 means: invalid JSON body, a non-HTTPS or
+                            // private/internal targetUrl, or an unknown eventTypes/provider value. By far
+                            // the most common cause in practice is a webhook URL VoxiSMS cannot accept —
+                            // e.g. a local n8n without a public HTTPS URL — so say that explicitly.
+                            message = `VoxiSMS rejected the webhook subscription${serverError ? ` (${serverError})` : ''}. The webhook URL was "${webhookUrl}" — it must be public HTTPS (not localhost/private). For local development start n8n with --tunnel or set WEBHOOK_URL to a public HTTPS tunnel.`;
+                        }
+                        else {
+                            message = `[${response.statusCode}] ${serverError !== null && serverError !== void 0 ? serverError : 'VoxiSMS request failed'}`;
+                        }
+                        throw new n8n_workflow_1.NodeApiError(this.getNode(), (_a = data) !== null && _a !== void 0 ? _a : {}, { message, httpCode: String(response.statusCode) });
+                    }
+                    if (!data.subscriptionId || !data.signingSecret) {
+                        throw new n8n_workflow_1.NodeOperationError(this.getNode(), 'VoxiSMS did not return a subscriptionId and signingSecret when creating the webhook subscription.');
+                    }
+                    const staticData = this.getWorkflowStaticData('node');
+                    staticData.subscriptionId = data.subscriptionId;
+                    // The signingSecret is what verifies every future delivery. Without it we cannot
+                    // authenticate deliveries, so it MUST be persisted alongside the subscriptionId.
+                    staticData.signingSecret = data.signingSecret;
+                    return true;
+                },
+                // delete — called when the workflow is deactivated. Removes the subscription so the
+                // API stops POSTing to a webhook URL that is no longer live, then clears static data.
+                async delete() {
+                    const staticData = this.getWorkflowStaticData('node');
+                    const subscriptionId = staticData.subscriptionId;
+                    // Nothing registered (or already cleared) — treat as success, nothing to undo.
+                    if (!subscriptionId) {
+                        return true;
+                    }
+                    const credentials = await this.getCredentials('voxiSmsApi');
+                    const customerId = (0, signing_1.normalizeCustomerId)(credentials.customerId);
+                    const secretKey = credentials.secretKey;
+                    // The DELETE route is dynamic and the id is part of the signed path
+                    // (base-path-stripped, no `/v2`). Body is empty, so the canonical ends in a
+                    // trailing '\n' (buildSignedHeaders default bodyString = '').
+                    const path = `${signing_1.SUBSCRIPTIONS_PATH}/${subscriptionId}`;
+                    const headers = (0, signing_1.buildSignedHeaders)({
+                        method: 'DELETE',
+                        path,
+                        customerId,
+                        secretKey,
+                    });
+                    const options = {
+                        method: 'DELETE',
+                        url: `${SUBSCRIPTIONS_URL}/${subscriptionId}`,
+                        headers,
+                        // A 404 means the subscription is already gone server-side — that is the desired
+                        // end state, so do not throw on it; ignore HTTP status errors and treat as done.
+                        ignoreHttpStatusErrors: true,
+                    };
+                    try {
+                        await this.helpers.httpRequest(options);
+                    }
+                    catch {
+                        // Network/other failure while unsubscribing: swallow it so deactivation still
+                        // clears local state. A stale server-side subscription will simply deliver to a
+                        // URL that now rejects, which is harmless (and re-activation re-creates one).
+                    }
+                    // Always clear both keys so a later checkExists reports "no subscription" and a
+                    // re-activation creates a fresh one with a fresh signing secret.
+                    delete staticData.subscriptionId;
+                    delete staticData.signingSecret;
+                    return true;
+                },
+            },
+        };
+    }
+    // webhook — runs for every delivery the API POSTs to our URL. n8n has NOT yet responded to
+    // the HTTP request, so this method both decides the HTTP status AND whether to fire the
+    // workflow. We mirror the Make webhook's response policy exactly (see communication.json):
+    //   - signing secret missing  → surface loudly (config broken; user must recreate trigger)
+    //   - reason 'missing'         → 200 {ok:false}, DO NOT fire (unsigned noise, drop quietly)
+    //   - reason invalid|skew|unverifiable → 401, DO NOT fire (present but bad → surface)
+    //   - ok                       → 200 {ok:true}, fire with the parsed event JSON (one item)
+    async webhook() {
+        const req = this.getRequestObject();
+        const res = this.getResponseObject();
+        // The signature is computed over the EXACT raw request bytes. n8n populates
+        // `req.rawBody` (a Buffer) for webhook requests via its raw-body reader middleware;
+        // the property is declared on http.IncomingMessage by n8n-workflow's type augmentation.
+        // We deliberately do NOT fall back to re-serializing the parsed body (getBodyData()) —
+        // a re-serialize reorders keys / changes whitespace and would break the digest by
+        // design. If the raw bytes are somehow absent, verifySignature returns 'unverifiable'
+        // (a present signature we cannot check) and we surface a 401 rather than trust it.
+        const rawBuffer = req.rawBody;
+        const rawBody = Buffer.isBuffer(rawBuffer) ? rawBuffer.toString('utf8') : undefined;
+        const headers = req.headers;
+        const signatureHeader = getHeaderCI(headers, 'x-voxisms-signature');
+        const timestampHeader = getHeaderCI(headers, 'x-voxisms-timestamp');
+        // Config-drift guard: without a signing secret we can verify nothing, and
+        // createHmac('sha256', undefined) would throw a bare TypeError. This means the
+        // subscription was created without persisting the secret (or static data was wiped) —
+        // surface it loudly so the user recreates the trigger. Do not ACK, do not fire.
+        const staticData = this.getWorkflowStaticData('node');
+        const signingSecret = staticData.signingSecret;
+        if (!signingSecret) {
+            throw new n8n_workflow_1.NodeOperationError(this.getNode(), "Cannot verify the inbound SMS delivery: the subscription's signing secret is missing. Please deactivate and reactivate this trigger to recreate the subscription.");
+        }
+        const result = (0, verifySignature_1.verifySignature)({
+            signingSecret,
+            rawBody,
+            signatureHeader,
+            timestampHeader,
+        });
+        if (!result.ok) {
+            if (result.reason === 'missing') {
+                // No usable signature header: unsigned noise (health checks, scanners, a stray
+                // POST). ACK with 200 {ok:false} so the sender does not retry, but DO NOT fire —
+                // returning noWebhookResponse hands the HTTP response to us, and no workflowData
+                // means no execution.
+                res.status(200).json({ ok: false });
+                return { noWebhookResponse: true };
+            }
+            // Present but invalid / skewed / unverifiable: almost always secret/config drift or a
+            // replay attempt. Reject with 401 and DO NOT fire — surfaced via the HTTP status so
+            // the caller (and VoxiSMS delivery logs) can see the rejection.
+            res.status(401).json({ ok: false, reason: result.reason });
+            return { noWebhookResponse: true };
+        }
+        // Verified. Parse the (now trusted) raw bytes into the InboundMessageEvent object. We
+        // parse rawBody ourselves rather than getBodyData() so the emitted item is exactly the
+        // bytes we authenticated — no chance of a divergent second parse.
+        //
+        // Can't-happen-unless-server-bug guard: the signature already verified, so the sender is
+        // authentic and the bytes are what VoxiSMS signed — a malformed JSON body here would mean
+        // a server-side bug. If we let JSON.parse throw, it would escape webhook(), n8n would 500
+        // the delivery, and VoxiSMS would retry the same poison delivery indefinitely. Instead we
+        // ACK with 400 {ok:false} (so the sender stops retrying) and DO NOT fire the workflow.
+        let event;
+        try {
+            event = JSON.parse(rawBody);
+        }
+        catch {
+            res.status(400).json({ ok: false, reason: 'malformed' });
+            return { noWebhookResponse: true };
+        }
+        // NOTE: webhook deliveries are AT-LEAST-ONCE and n8n does NOT de-duplicate them. A
+        // dispatcher retry carrying the same `eventId` WILL fire this workflow again. We expose
+        // `eventId` on the emitted item so downstream steps (or the user) can de-duplicate on it
+        // if they need exactly-once semantics.
+        res.status(200).json({ ok: true });
+        return {
+            noWebhookResponse: true,
+            workflowData: [this.helpers.returnJsonArray([event])],
+        };
+    }
+}
+exports.VoxiSmsTrigger = VoxiSmsTrigger;

package/dist/nodes/VoxiSmsTrigger/voxisms.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="60" height="60" viewBox="0 0 60 60" fill="none">
+  <rect x="6" y="10" width="48" height="34" rx="10" fill="#4F46E5"/>
+  <path d="M18 44l-2 8 10-6z" fill="#4F46E5"/>
+  <path d="M36 20l-9 9m0 0h6m-6 0v-6" stroke="#FFFFFF" stroke-width="3" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>

package/dist/nodes/shared/signing.d.ts

@@ -0,0 +1,13 @@
+export declare const ENQUEUE_PATH = "/enqueue-message";
+export declare const STATUS_PATH = "/user/status";
+export declare const SUBSCRIPTIONS_PATH = "/webhook-subscriptions";
+export interface SignedHeadersParams {
+    method: string;
+    path: string;
+    customerId: string;
+    secretKey: string;
+    bodyString?: string;
+    timestamp?: string;
+}
+export declare const buildSignedHeaders: ({ method, path, customerId, secretKey, bodyString, timestamp, }: SignedHeadersParams) => Record<string, string>;
+export declare const normalizeCustomerId: (customerId: string) => string;

package/dist/nodes/shared/signing.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeCustomerId = exports.buildSignedHeaders = exports.SUBSCRIPTIONS_PATH = exports.STATUS_PATH = exports.ENQUEUE_PATH = void 0;
+const crypto_1 = require("crypto");
+// Base-path-stripped route constants. API Gateway strips the `/v2` prefix, so these
+// are the exact paths the Lambda signs — NOT the full URL paths.
+exports.ENQUEUE_PATH = '/enqueue-message';
+exports.STATUS_PATH = '/user/status';
+// Webhook-subscription collection path. The DELETE route is dynamic
+// (`/webhook-subscriptions/{subscriptionId}`); build it inline from this constant.
+exports.SUBSCRIPTIONS_PATH = '/webhook-subscriptions';
+// Builds the VoxiSMS HMAC auth headers for a request.
+//
+// The canonical string signed by the server is:
+//   METHOD \n PATH \n TIMESTAMP \n CUSTOMER_ID \n BODY
+// keyed by the user's secretKey (raw UTF-8), HMAC-SHA256, lowercase hex.
+//
+// `bodyString` MUST be the exact bytes sent on the wire. For a body-less GET, leave it
+// empty ('') — the trailing '\n' + empty segment matches the server's `body: b""`.
+// `timestamp` is injectable for deterministic tests; it must be reused verbatim in both
+// the signed canonical and the `timestamp` header.
+//
+// Content-Type is intentionally NOT returned here (it is not part of the signature); the
+// caller adds it when sending a request body.
+const buildSignedHeaders = ({ method, path, customerId, secretKey, bodyString = '', timestamp = Math.floor(Date.now() / 1000).toString(), }) => {
+    const canonical = [method, path, timestamp, customerId, bodyString].join('\n');
+    const signature = (0, crypto_1.createHmac)('sha256', secretKey)
+        .update(canonical, 'utf8')
+        .digest('hex');
+    return {
+        'customer-id': customerId,
+        timestamp,
+        signature,
+    };
+};
+exports.buildSignedHeaders = buildSignedHeaders;
+// Customer ID is the registered phone number; tolerate a pasted "+" or spaces.
+// Normalize ONCE and reuse the same value for both the signed canonical and the
+// `customer-id` header, so they cannot disagree.
+const normalizeCustomerId = (customerId) => customerId.replace(/[\s+]/g, '');
+exports.normalizeCustomerId = normalizeCustomerId;

package/dist/nodes/shared/verifySignature.d.ts

@@ -0,0 +1,16 @@
+declare const MAX_SKEW_SECONDS = 300;
+export type VerifyResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: 'missing' | 'unverifiable' | 'invalid' | 'skew';
+};
+export interface VerifySignatureParams {
+    signingSecret: string;
+    rawBody: unknown;
+    signatureHeader: unknown;
+    timestampHeader: unknown;
+    now?: number;
+}
+export declare const verifySignature: ({ signingSecret, rawBody, signatureHeader, timestampHeader, now, }: VerifySignatureParams) => VerifyResult;
+export { MAX_SKEW_SECONDS };

package/dist/nodes/shared/verifySignature.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_SKEW_SECONDS = exports.verifySignature = void 0;
+const crypto_1 = require("crypto");
+// Max allowed clock skew (seconds) between the delivery's signed timestamp and our own
+// clock. Matches the server's replay window documented in the callback spec (±300s).
+const MAX_SKEW_SECONDS = 300;
+exports.MAX_SKEW_SECONDS = MAX_SKEW_SECONDS;
+// Pure, n8n-free verifier for an inbound event delivery — mirrors how `signing.ts` keeps
+// the crypto separate from the node plumbing so it can be unit-tested in isolation.
+//
+// Per the `inboundMessageReceived` callback contract, each delivery is signed as:
+//   expected = HMAC_SHA256(signingSecret, `${timestamp}.${rawBody}`)  (lowercase hex)
+// and delivered in the `X-VoxiSMS-Signature` header with a `sha256=` prefix, alongside the
+// signed `X-VoxiSMS-Timestamp` (Unix seconds). `rawBody` MUST be the exact raw request
+// bytes — never a re-serialized parse — or key reordering/whitespace breaks the digest.
+//
+// Returns a plain result object rather than throwing, so the caller decides how each
+// outcome maps onto the node's throw-vs-drop policy:
+//   { ok: true }                            — signature valid and timestamp fresh
+//   { ok: false, reason: 'missing' }        — no (usable) signature header / no timestamp
+//                                             (unsigned noise → caller drops)
+//   { ok: false, reason: 'unverifiable' }   — signature present but there are no raw bytes
+//                                             to check it against (→ caller surfaces)
+//   { ok: false, reason: 'invalid' }        — signature present but does not match
+//                                             (secret/config drift → caller surfaces)
+//   { ok: false, reason: 'skew' }           — signature valid but timestamp out of window
+//                                             (replay / clock drift → caller surfaces)
+const verifySignature = ({ signingSecret, rawBody, signatureHeader, timestampHeader, now = Math.floor(Date.now() / 1000), }) => {
+    // A non-string header (e.g. a multi-value array) is unusable — treat as unsigned noise,
+    // same as a fully absent header. Guarding here keeps the `.startsWith`/length ops below
+    // from throwing on a non-string.
+    if (typeof signatureHeader !== 'string' || !signatureHeader || !timestampHeader) {
+        return { ok: false, reason: 'missing' };
+    }
+    // Signature IS present but we have no raw bytes to verify it against. We can't clear it,
+    // and a present-but-unverifiable signature must not be silently dropped — surface it.
+    if (typeof rawBody !== 'string') {
+        return { ok: false, reason: 'unverifiable' };
+    }
+    // `timestampHeader` is truthy here, but may still be a non-string (e.g. array); coerce to
+    // a string so it is safe to interpolate into the canonical and to `Number()` below.
+    const timestampString = String(timestampHeader);
+    // Strip the `sha256=` prefix the header carries (tolerate its absence defensively) and
+    // lowercase it — the expected digest is lowercase hex, so an uppercase-but-correct digest
+    // should still compare equal.
+    const provided = (signatureHeader.startsWith('sha256=')
+        ? signatureHeader.slice('sha256='.length)
+        : signatureHeader).toLowerCase();
+    const expected = (0, crypto_1.createHmac)('sha256', signingSecret)
+        .update(`${timestampString}.${rawBody}`, 'utf8')
+        .digest('hex');
+    // Constant-time compare. timingSafeEqual throws on length mismatch, so guard lengths
+    // first — a wrong length is, itself, a non-match (present but invalid).
+    const providedBuf = Buffer.from(provided, 'utf8');
+    const expectedBuf = Buffer.from(expected, 'utf8');
+    if (providedBuf.length !== expectedBuf.length ||
+        !(0, crypto_1.timingSafeEqual)(providedBuf, expectedBuf)) {
+        return { ok: false, reason: 'invalid' };
+    }
+    // Signature is authentic; enforce the replay window on the (now trusted) timestamp.
+    const ts = Number(timestampString);
+    if (!Number.isFinite(ts) || Math.abs(now - ts) > MAX_SKEW_SECONDS) {
+        return { ok: false, reason: 'skew' };
+    }
+    return { ok: true };
+};
+exports.verifySignature = verifySignature;

package/index.js

@@ -0,0 +1,4 @@
+// Intentionally empty. n8n loads the nodes and credentials from the paths declared in
+// the package.json `n8n` block (dist/...), not from this entry point — it exists only so
+// the package's `main` field resolves.
+module.exports = {};

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "@voxiness/n8n-nodes-voxisms",
+  "version": "0.1.0",
+  "publishConfig": {
+    "access": "public"
+  },
+  "description": "n8n community nodes for VoxiSMS: send SMS and trigger on inbound SMS",
+  "keywords": [
+    "n8n-community-node-package",
+    "sms",
+    "voxisms"
+  ],
+  "license": "MIT",
+  "homepage": "https://voxisms.com",
+  "author": {
+    "name": "VoxiSMS"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/aboven/voxisms-automations.git",
+    "directory": "voxisms-n8n"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "main": "index.js",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc && node scripts/copy-icons.mjs",
+    "dev": "tsc --watch",
+    "lint": "tsc --noEmit",
+    "prepublishOnly": "npm run build && npm test",
+    "test": "jest"
+  },
+  "n8n": {
+    "n8nNodesApiVersion": 1,
+    "credentials": [
+      "dist/credentials/VoxiSmsApi.credentials.js"
+    ],
+    "nodes": [
+      "dist/nodes/VoxiSms/VoxiSms.node.js",
+      "dist/nodes/VoxiSmsTrigger/VoxiSmsTrigger.node.js"
+    ]
+  },
+  "devDependencies": {
+    "@types/jest": "^29.5.0",
+    "@types/node": "^20.0.0",
+    "jest": "^29.6.0",
+    "n8n-workflow": "*",
+    "ts-jest": "^29.1.0",
+    "typescript": "^5.4.0"
+  },
+  "peerDependencies": {
+    "n8n-workflow": "*"
+  }
+}