spectrum-ts 1.17.0 → 1.17.1

package/dist/authoring.js

@@ -1,23 +1,24 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   asGroup,
   asRichlink
-} from "./chunk-LJM5D2T5.js";
+} from "./chunk-JQN6CRSC.js";
 import {
   asVoice
-} from "./chunk-5QSNQ6YN.js";
+} from "./chunk-NNY6LMSC.js";
 import {
   asPoll,
   asPollOption
-} from "./chunk-KO67KDBD.js";
+} from "./chunk-2D27WW5B.js";
 import {
   asContact
-} from "./chunk-RNGEA4UW.js";
+} from "./chunk-QGJFZMD5.js";
 import {
   asAttachment,
   asCustom,
   asReaction,
   asText
-} from "./chunk-FTLJVVH7.js";
+} from "./chunk-2ILTJC35.js";
 export {
   asAttachment,
   asContact,

package/dist/{chunk-KO67KDBD.js → chunk-2D27WW5B.js}

@@ -1,3 +1,5 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
+
 // src/content/poll.ts
 import z from "zod";
 var pollChoiceSchema = z.object({

package/dist/{chunk-FTLJVVH7.js → chunk-2ILTJC35.js}

@@ -1,3 +1,4 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

package/dist/{chunk-Y4CZ5JFD.js → chunk-3OTECDNH.js}

@@ -1,18 +1,19 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   cloud,
   mergeStreams,
   stream
-} from "./chunk-KYEHKHXT.js";
+} from "./chunk-MC6ZKFSG.js";
 import {
   UnsupportedError,
   definePlatform
-} from "./chunk-32H3VVUE.js";
+} from "./chunk-IPOFBAIM.js";
 import {
   asAttachment,
   asCustom,
   asReaction,
   asText
-} from "./chunk-FTLJVVH7.js";
+} from "./chunk-2ILTJC35.js";
 
 // src/providers/slack/index.ts
 import { createClient as createClient2, staticTokens } from "@photon-ai/slack";

package/dist/{chunk-6NGVREPQ.js → chunk-5BKZJMZV.js}

@@ -1,20 +1,21 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   asVoice
-} from "./chunk-5QSNQ6YN.js";
+} from "./chunk-NNY6LMSC.js";
 import {
   asContact,
   fromVCard,
   toVCard
-} from "./chunk-RNGEA4UW.js";
+} from "./chunk-QGJFZMD5.js";
 import {
   UnsupportedError,
   definePlatform
-} from "./chunk-32H3VVUE.js";
+} from "./chunk-IPOFBAIM.js";
 import {
   asAttachment,
   asCustom,
   reactionSchema
-} from "./chunk-FTLJVVH7.js";
+} from "./chunk-2ILTJC35.js";
 
 // src/providers/terminal/index.ts
 import { spawn } from "child_process";

package/dist/{chunk-GHERTIUM.js → chunk-5TIF3FIE.js}

@@ -1,24 +1,25 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   asPollOption
-} from "./chunk-KO67KDBD.js";
+} from "./chunk-2D27WW5B.js";
 import {
   cloud,
   mergeStreams,
   stream
-} from "./chunk-KYEHKHXT.js";
+} from "./chunk-MC6ZKFSG.js";
 import {
   asContact
-} from "./chunk-RNGEA4UW.js";
+} from "./chunk-QGJFZMD5.js";
 import {
   UnsupportedError,
   definePlatform
-} from "./chunk-32H3VVUE.js";
+} from "./chunk-IPOFBAIM.js";
 import {
   asAttachment,
   asCustom,
   asReaction,
   asText
-} from "./chunk-FTLJVVH7.js";
+} from "./chunk-2ILTJC35.js";
 
 // src/providers/whatsapp-business/index.ts
 import { createClient as createClient2 } from "@photon-ai/whatsapp-business";

package/dist/{chunk-32H3VVUE.js → chunk-IPOFBAIM.js}

@@ -1,9 +1,10 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   fetchUrlBytes,
   reaction,
   readSchema,
   resolveContents
-} from "./chunk-FTLJVVH7.js";
+} from "./chunk-2ILTJC35.js";
 
 // src/content/avatar.ts
 import z2 from "zod";

package/dist/{chunk-LJM5D2T5.js → chunk-JQN6CRSC.js}

@@ -1,10 +1,11 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   bufferToStream,
   fetchUrlBytes,
   readSchema,
   resolveContents,
   streamSchema
-} from "./chunk-FTLJVVH7.js";
+} from "./chunk-2ILTJC35.js";
 
 // src/content/group.ts
 import z from "zod";

package/dist/{chunk-KYEHKHXT.js → chunk-MC6ZKFSG.js}

@@ -1,3 +1,5 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
+
 // src/utils/cloud.ts
 var SPECTRUM_CLOUD_URL = process.env.SPECTRUM_CLOUD_URL ?? "https://spectrum.photon.codes";
 var SpectrumCloudError = class extends Error {

package/dist/{chunk-5QSNQ6YN.js → chunk-NNY6LMSC.js}

@@ -1,9 +1,10 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   bufferToStream,
   fetchUrlBytes,
   readSchema,
   streamSchema
-} from "./chunk-FTLJVVH7.js";
+} from "./chunk-2ILTJC35.js";
 
 // src/content/voice.ts
 import { createReadStream } from "fs";

package/dist/{chunk-RNGEA4UW.js → chunk-QGJFZMD5.js}

@@ -1,6 +1,7 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   readSchema
-} from "./chunk-FTLJVVH7.js";
+} from "./chunk-2ILTJC35.js";
 
 // src/utils/vcard.ts
 import vCard from "vcf";

package/dist/{chunk-DK4P2SHC.js → chunk-YJMPSD3S.js}

@@ -1,28 +1,29 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   asGroup,
   asRichlink,
   groupSchema
-} from "./chunk-LJM5D2T5.js";
+} from "./chunk-JQN6CRSC.js";
 import {
   asPoll,
   asPollOption
-} from "./chunk-KO67KDBD.js";
+} from "./chunk-2D27WW5B.js";
 import {
   cloud,
   mergeStreams,
   stream
-} from "./chunk-KYEHKHXT.js";
+} from "./chunk-MC6ZKFSG.js";
 import {
   asContact,
   fromVCard,
   toVCard
-} from "./chunk-RNGEA4UW.js";
+} from "./chunk-QGJFZMD5.js";
 import {
   UnsupportedError,
   buildPhotoAction,
   definePlatform,
   photoActionSchema
-} from "./chunk-32H3VVUE.js";
+} from "./chunk-IPOFBAIM.js";
 import {
   asAttachment,
   asCustom,
@@ -31,7 +32,7 @@ import {
   reactionSchema,
   text,
   textSchema
-} from "./chunk-FTLJVVH7.js";
+} from "./chunk-2ILTJC35.js";
 
 // src/providers/imessage/index.ts
 import { createClient as createClient2, MessageEffect as MessageEffect2 } from "@photon-ai/advanced-imessage";

package/dist/index.d.ts

@@ -2645,13 +2645,14 @@ type WebhookHandler = (space: Space, message: Message) => void | Promise<void>;
 /**
  * Raw webhook input for HTTP servers without Web `Request`/`Response` (Express,
  * raw Node). `body` MUST be the exact bytes fusor POSTed — never a re-encoded
- * JSON/text body — so the protobuf decode and the fusor-origin signature check
- * (HMAC over the raw bytes) work. `headers` carry the `X-Spectrum-*` signature
- * headers fusor sets on signed deliveries.
+ * JSON/text body — so the protobuf decode works. `headers` are accepted (so the
+ * natural `{ headers: req.headers, body: req.body }` shape keeps working) but are
+ * not read: inbound authenticity is established by the per-platform `verify()`,
+ * which reads the inner request reconstructed from the envelope.
  */
 interface WebhookRawRequest {
     body: Uint8Array | ArrayBuffer;
-    headers: Record<string, string>;
+    headers?: Record<string, string>;
 }
 /** Raw webhook result, written back by the caller as the HTTP response. */
 interface WebhookRawResult {
@@ -2802,7 +2803,6 @@ declare function Spectrum<const Providers extends PlatformProviderConfig[]>(opti
     providers: [...Providers];
     options?: SpectrumOptions;
     telemetry?: boolean;
-    webhookSecret?: string;
 }): Promise<SpectrumInstance<Providers> & {
     readonly config: ProjectData;
 }>;
@@ -2812,7 +2812,6 @@ declare function Spectrum<const Providers extends PlatformProviderConfig[]>(opti
     providers: [...Providers];
     options?: SpectrumOptions;
     telemetry?: boolean;
-    webhookSecret?: string;
 }): Promise<SpectrumInstance<Providers>>;
 
 type UnsupportedKind = "content" | "action";

package/dist/index.js

@@ -1,14 +1,15 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   group,
   richlink
-} from "./chunk-LJM5D2T5.js";
+} from "./chunk-JQN6CRSC.js";
 import {
   voice
-} from "./chunk-5QSNQ6YN.js";
+} from "./chunk-NNY6LMSC.js";
 import {
   option,
   poll
-} from "./chunk-KO67KDBD.js";
+} from "./chunk-2D27WW5B.js";
 import {
   SpectrumCloudError,
   broadcast,
@@ -16,12 +17,12 @@ import {
   createAsyncQueue,
   mergeStreams,
   stream
-} from "./chunk-KYEHKHXT.js";
+} from "./chunk-MC6ZKFSG.js";
 import {
   contact,
   fromVCard,
   toVCard
-} from "./chunk-RNGEA4UW.js";
+} from "./chunk-QGJFZMD5.js";
 import {
   UnsupportedError,
   avatar,
@@ -35,7 +36,7 @@ import {
   senderAttrs,
   typing,
   wrapProviderMessage
-} from "./chunk-32H3VVUE.js";
+} from "./chunk-IPOFBAIM.js";
 import {
   __commonJS,
   __esm,
@@ -48,7 +49,7 @@ import {
   reaction,
   resolveContents,
   text
-} from "./chunk-FTLJVVH7.js";
+} from "./chunk-2ILTJC35.js";
 
 // ../../node_modules/@grpc/grpc-js/build/src/constants.js
 var require_constants = __commonJS({
@@ -27500,33 +27501,6 @@ var FusorCore = class {
   }
 };
 
-// src/fusor/origin.ts
-import { createHmac, timingSafeEqual } from "crypto";
-var SIGNATURE_HEADER = "x-spectrum-signature";
-var TIMESTAMP_HEADER = "x-spectrum-timestamp";
-var SIGNATURE_PREFIX = "v0=";
-var stripPrefix = (value) => value.startsWith(SIGNATURE_PREFIX) ? value.slice(SIGNATURE_PREFIX.length) : value;
-var safeEqualHex = (a, b) => {
-  const left = Buffer.from(a, "hex");
-  const right = Buffer.from(b, "hex");
-  if (left.length === 0 || left.length !== right.length) {
-    return false;
-  }
-  return timingSafeEqual(left, right);
-};
-var verifyFusorSignature = (secret, headers, body) => {
-  const timestamp = headers[TIMESTAMP_HEADER];
-  const signature = headers[SIGNATURE_HEADER];
-  if (!(timestamp && signature)) {
-    throw new Error("fusor webhook is missing X-Spectrum-* signature headers");
-  }
-  const base = Buffer.concat([Buffer.from(`v0:${timestamp}:`, "utf8"), body]);
-  const expected = SIGNATURE_PREFIX + createHmac("sha256", secret).update(base).digest("hex");
-  if (!safeEqualHex(stripPrefix(expected), stripPrefix(signature))) {
-    throw new Error("fusor webhook signature mismatch");
-  }
-};
-
 // src/utils/store.ts
 var isRecordObject = (value) => {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
@@ -27595,16 +27569,14 @@ var spectrumConfigSchema = z.union([
     projectSecret: z.string().min(1),
     providers: z.array(z.custom()),
     options: spectrumOptionsSchema,
-    telemetry: z.boolean().optional(),
-    webhookSecret: z.string().min(1).optional()
+    telemetry: z.boolean().optional()
   }),
   z.object({
     projectId: z.undefined().optional(),
     projectSecret: z.undefined().optional(),
     providers: z.array(z.custom()),
     options: spectrumOptionsSchema,
-    telemetry: z.boolean().optional(),
-    webhookSecret: z.string().min(1).optional()
+    telemetry: z.boolean().optional()
   })
 ]);
 function bootstrapTelemetry(opts) {
@@ -27634,8 +27606,7 @@ async function Spectrum(options) {
     projectSecret,
     providers,
     options: runtimeOptions,
-    telemetry,
-    webhookSecret
+    telemetry
   } = options;
   const flattenGroups = runtimeOptions?.flattenGroups ?? false;
   const otelHandle = telemetry ? bootstrapTelemetry({ projectId, projectSecret }) : void 0;
@@ -28002,23 +27973,14 @@ async function Spectrum(options) {
   };
   const readWebhookInput = async (request) => {
     if (typeof Request !== "undefined" && request instanceof Request) {
-      const headers2 = {};
-      request.headers.forEach((value, key) => {
-        headers2[key.toLowerCase()] = value;
-      });
       return {
         asWeb: true,
-        bodyBytes: new Uint8Array(await request.arrayBuffer()),
-        headers: headers2
+        bodyBytes: new Uint8Array(await request.arrayBuffer())
       };
     }
     const raw = request;
     const bodyBytes = raw.body instanceof ArrayBuffer ? new Uint8Array(raw.body) : raw.body;
-    const headers = {};
-    for (const [key, value] of Object.entries(raw.headers ?? {})) {
-      headers[key.toLowerCase()] = value;
-    }
-    return { asWeb: false, bodyBytes, headers };
+    return { asWeb: false, bodyBytes };
   };
   const deliverWebhookMessages = async (collected, runtime, handler, event) => {
     for (const record of collected) {
@@ -28040,12 +28002,6 @@ async function Spectrum(options) {
       }
     }
   };
-  const assertFusorOrigin = (bodyBytes, headers) => {
-    if (!webhookSecret) {
-      return;
-    }
-    verifyFusorSignature(webhookSecret, headers, bodyBytes);
-  };
   const decodeWebhookEvent = (bodyBytes) => {
     try {
       return RawInboundEvent2.decode(bodyBytes);
@@ -28096,19 +28052,7 @@ async function Spectrum(options) {
         "spectrum.webhook() requires at least one fusor provider; none are configured"
       );
     }
-    const { asWeb, bodyBytes, headers } = await readWebhookInput(request);
-    try {
-      assertFusorOrigin(bodyBytes, headers);
-    } catch (error) {
-      lifecycleLog.warn("spectrum.webhook: fusor origin verification failed", {
-        error: error instanceof Error ? error.message : String(error)
-      });
-      return buildWebhookResult(asWeb, {
-        status: 401,
-        headers: {},
-        body: new Uint8Array(0)
-      });
-    }
+    const { asWeb, bodyBytes } = await readWebhookInput(request);
     const event = decodeWebhookEvent(bodyBytes);
     if (!event) {
       return buildWebhookResult(asWeb, {

package/dist/providers/imessage/index.js

@@ -1,15 +1,16 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   background,
   effect,
   imessage,
   read
-} from "../../chunk-DK4P2SHC.js";
-import "../../chunk-LJM5D2T5.js";
-import "../../chunk-KO67KDBD.js";
-import "../../chunk-KYEHKHXT.js";
-import "../../chunk-RNGEA4UW.js";
-import "../../chunk-32H3VVUE.js";
-import "../../chunk-FTLJVVH7.js";
+} from "../../chunk-YJMPSD3S.js";
+import "../../chunk-JQN6CRSC.js";
+import "../../chunk-2D27WW5B.js";
+import "../../chunk-MC6ZKFSG.js";
+import "../../chunk-QGJFZMD5.js";
+import "../../chunk-IPOFBAIM.js";
+import "../../chunk-2ILTJC35.js";
 export {
   background,
   effect,

package/dist/providers/index.js

@@ -1,22 +1,23 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   imessage
-} from "../chunk-DK4P2SHC.js";
-import "../chunk-LJM5D2T5.js";
+} from "../chunk-YJMPSD3S.js";
+import "../chunk-JQN6CRSC.js";
 import {
   slack
-} from "../chunk-Y4CZ5JFD.js";
+} from "../chunk-3OTECDNH.js";
 import {
   terminal
-} from "../chunk-6NGVREPQ.js";
-import "../chunk-5QSNQ6YN.js";
+} from "../chunk-5BKZJMZV.js";
+import "../chunk-NNY6LMSC.js";
 import {
   whatsappBusiness
-} from "../chunk-GHERTIUM.js";
-import "../chunk-KO67KDBD.js";
-import "../chunk-KYEHKHXT.js";
-import "../chunk-RNGEA4UW.js";
-import "../chunk-32H3VVUE.js";
-import "../chunk-FTLJVVH7.js";
+} from "../chunk-5TIF3FIE.js";
+import "../chunk-2D27WW5B.js";
+import "../chunk-MC6ZKFSG.js";
+import "../chunk-QGJFZMD5.js";
+import "../chunk-IPOFBAIM.js";
+import "../chunk-2ILTJC35.js";
 export {
   imessage,
   slack,

package/dist/providers/slack/index.js

@@ -1,9 +1,10 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   slack
-} from "../../chunk-Y4CZ5JFD.js";
-import "../../chunk-KYEHKHXT.js";
-import "../../chunk-32H3VVUE.js";
-import "../../chunk-FTLJVVH7.js";
+} from "../../chunk-3OTECDNH.js";
+import "../../chunk-MC6ZKFSG.js";
+import "../../chunk-IPOFBAIM.js";
+import "../../chunk-2ILTJC35.js";
 export {
   slack
 };

package/dist/providers/terminal/index.js

@@ -1,10 +1,11 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   terminal
-} from "../../chunk-6NGVREPQ.js";
-import "../../chunk-5QSNQ6YN.js";
-import "../../chunk-RNGEA4UW.js";
-import "../../chunk-32H3VVUE.js";
-import "../../chunk-FTLJVVH7.js";
+} from "../../chunk-5BKZJMZV.js";
+import "../../chunk-NNY6LMSC.js";
+import "../../chunk-QGJFZMD5.js";
+import "../../chunk-IPOFBAIM.js";
+import "../../chunk-2ILTJC35.js";
 export {
   terminal
 };

package/dist/providers/whatsapp-business/index.js

@@ -1,11 +1,12 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   whatsappBusiness
-} from "../../chunk-GHERTIUM.js";
-import "../../chunk-KO67KDBD.js";
-import "../../chunk-KYEHKHXT.js";
-import "../../chunk-RNGEA4UW.js";
-import "../../chunk-32H3VVUE.js";
-import "../../chunk-FTLJVVH7.js";
+} from "../../chunk-5TIF3FIE.js";
+import "../../chunk-2D27WW5B.js";
+import "../../chunk-MC6ZKFSG.js";
+import "../../chunk-QGJFZMD5.js";
+import "../../chunk-IPOFBAIM.js";
+import "../../chunk-2ILTJC35.js";
 export {
   whatsappBusiness
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spectrum-ts",
-  "version": "1.17.0",
+  "version": "1.17.1",
   "description": "Bring agents to any interface — unified messaging SDK for TypeScript.",
   "repository": {
     "type": "git",