spectrum-ts 1.17.0 → 1.18.0

package/dist/authoring.js

@@ -1,23 +1,24 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   asGroup,
   asRichlink
-} from "./chunk-LJM5D2T5.js";
+} from "./chunk-JQN6CRSC.js";
 import {
   asVoice
-} from "./chunk-5QSNQ6YN.js";
+} from "./chunk-NNY6LMSC.js";
 import {
   asPoll,
   asPollOption
-} from "./chunk-KO67KDBD.js";
+} from "./chunk-2D27WW5B.js";
 import {
   asContact
-} from "./chunk-RNGEA4UW.js";
+} from "./chunk-QGJFZMD5.js";
 import {
   asAttachment,
   asCustom,
   asReaction,
   asText
-} from "./chunk-FTLJVVH7.js";
+} from "./chunk-2ILTJC35.js";
 export {
   asAttachment,
   asContact,

package/dist/{chunk-KO67KDBD.js → chunk-2D27WW5B.js}

@@ -1,3 +1,5 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
+
 // src/content/poll.ts
 import z from "zod";
 var pollChoiceSchema = z.object({

package/dist/{chunk-FTLJVVH7.js → chunk-2ILTJC35.js}

@@ -1,3 +1,4 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

package/dist/{chunk-Y4CZ5JFD.js → chunk-3OTECDNH.js}

@@ -1,18 +1,19 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   cloud,
   mergeStreams,
   stream
-} from "./chunk-KYEHKHXT.js";
+} from "./chunk-MC6ZKFSG.js";
 import {
   UnsupportedError,
   definePlatform
-} from "./chunk-32H3VVUE.js";
+} from "./chunk-IPOFBAIM.js";
 import {
   asAttachment,
   asCustom,
   asReaction,
   asText
-} from "./chunk-FTLJVVH7.js";
+} from "./chunk-2ILTJC35.js";
 
 // src/providers/slack/index.ts
 import { createClient as createClient2, staticTokens } from "@photon-ai/slack";

package/dist/{chunk-6NGVREPQ.js → chunk-5BKZJMZV.js}

@@ -1,20 +1,21 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   asVoice
-} from "./chunk-5QSNQ6YN.js";
+} from "./chunk-NNY6LMSC.js";
 import {
   asContact,
   fromVCard,
   toVCard
-} from "./chunk-RNGEA4UW.js";
+} from "./chunk-QGJFZMD5.js";
 import {
   UnsupportedError,
   definePlatform
-} from "./chunk-32H3VVUE.js";
+} from "./chunk-IPOFBAIM.js";
 import {
   asAttachment,
   asCustom,
   reactionSchema
-} from "./chunk-FTLJVVH7.js";
+} from "./chunk-2ILTJC35.js";
 
 // src/providers/terminal/index.ts
 import { spawn } from "child_process";

package/dist/{chunk-GHERTIUM.js → chunk-5TIF3FIE.js}

@@ -1,24 +1,25 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   asPollOption
-} from "./chunk-KO67KDBD.js";
+} from "./chunk-2D27WW5B.js";
 import {
   cloud,
   mergeStreams,
   stream
-} from "./chunk-KYEHKHXT.js";
+} from "./chunk-MC6ZKFSG.js";
 import {
   asContact
-} from "./chunk-RNGEA4UW.js";
+} from "./chunk-QGJFZMD5.js";
 import {
   UnsupportedError,
   definePlatform
-} from "./chunk-32H3VVUE.js";
+} from "./chunk-IPOFBAIM.js";
 import {
   asAttachment,
   asCustom,
   asReaction,
   asText
-} from "./chunk-FTLJVVH7.js";
+} from "./chunk-2ILTJC35.js";
 
 // src/providers/whatsapp-business/index.ts
 import { createClient as createClient2 } from "@photon-ai/whatsapp-business";

package/dist/{chunk-32H3VVUE.js → chunk-IPOFBAIM.js}

@@ -1,9 +1,10 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   fetchUrlBytes,
   reaction,
   readSchema,
   resolveContents
-} from "./chunk-FTLJVVH7.js";
+} from "./chunk-2ILTJC35.js";
 
 // src/content/avatar.ts
 import z2 from "zod";

package/dist/{chunk-LJM5D2T5.js → chunk-JQN6CRSC.js}

@@ -1,10 +1,11 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   bufferToStream,
   fetchUrlBytes,
   readSchema,
   resolveContents,
   streamSchema
-} from "./chunk-FTLJVVH7.js";
+} from "./chunk-2ILTJC35.js";
 
 // src/content/group.ts
 import z from "zod";

package/dist/{chunk-KYEHKHXT.js → chunk-MC6ZKFSG.js}

@@ -1,3 +1,5 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
+
 // src/utils/cloud.ts
 var SPECTRUM_CLOUD_URL = process.env.SPECTRUM_CLOUD_URL ?? "https://spectrum.photon.codes";
 var SpectrumCloudError = class extends Error {

package/dist/{chunk-5QSNQ6YN.js → chunk-NNY6LMSC.js}

@@ -1,9 +1,10 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   bufferToStream,
   fetchUrlBytes,
   readSchema,
   streamSchema
-} from "./chunk-FTLJVVH7.js";
+} from "./chunk-2ILTJC35.js";
 
 // src/content/voice.ts
 import { createReadStream } from "fs";

package/dist/{chunk-RNGEA4UW.js → chunk-QGJFZMD5.js}

@@ -1,6 +1,7 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   readSchema
-} from "./chunk-FTLJVVH7.js";
+} from "./chunk-2ILTJC35.js";
 
 // src/utils/vcard.ts
 import vCard from "vcf";

package/dist/{chunk-DK4P2SHC.js → chunk-YN6WOTBF.js}

@@ -1,28 +1,29 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   asGroup,
   asRichlink,
   groupSchema
-} from "./chunk-LJM5D2T5.js";
+} from "./chunk-JQN6CRSC.js";
 import {
   asPoll,
   asPollOption
-} from "./chunk-KO67KDBD.js";
+} from "./chunk-2D27WW5B.js";
 import {
   cloud,
   mergeStreams,
   stream
-} from "./chunk-KYEHKHXT.js";
+} from "./chunk-MC6ZKFSG.js";
 import {
   asContact,
   fromVCard,
   toVCard
-} from "./chunk-RNGEA4UW.js";
+} from "./chunk-QGJFZMD5.js";
 import {
   UnsupportedError,
   buildPhotoAction,
   definePlatform,
   photoActionSchema
-} from "./chunk-32H3VVUE.js";
+} from "./chunk-IPOFBAIM.js";
 import {
   asAttachment,
   asCustom,
@@ -31,7 +32,7 @@ import {
   reactionSchema,
   text,
   textSchema
-} from "./chunk-FTLJVVH7.js";
+} from "./chunk-2ILTJC35.js";
 
 // src/providers/imessage/index.ts
 import { createClient as createClient2, MessageEffect as MessageEffect2 } from "@photon-ai/advanced-imessage";
@@ -59,21 +60,79 @@ function background(input, options) {
   };
 }
 
+// src/providers/imessage/content/customized-mini-app.ts
+import z2 from "zod";
+var layoutSchema = z2.object({
+  caption: z2.string().nonempty().optional(),
+  subcaption: z2.string().nonempty().optional(),
+  trailingCaption: z2.string().nonempty().optional(),
+  trailingSubcaption: z2.string().nonempty().optional(),
+  image: z2.instanceof(Uint8Array).optional(),
+  imageTitle: z2.string().nonempty().optional(),
+  imageSubtitle: z2.string().nonempty().optional(),
+  summary: z2.string().nonempty().optional()
+}).refine(
+  (layout) => layout.caption !== void 0 || layout.subcaption !== void 0 || layout.trailingCaption !== void 0 || layout.trailingSubcaption !== void 0 || layout.image !== void 0,
+  {
+    message: "layout must set at least one of caption, subcaption, trailingCaption, trailingSubcaption, image"
+  }
+).refine(
+  (layout) => layout.image === void 0 === (layout.imageTitle === void 0),
+  {
+    message: "layout.image and layout.imageTitle must be set together",
+    path: ["imageTitle"]
+  }
+).refine(
+  (layout) => layout.imageSubtitle === void 0 || layout.image !== void 0,
+  {
+    message: "layout.imageSubtitle requires layout.image",
+    path: ["imageSubtitle"]
+  }
+);
+var customizedMiniAppSchema = z2.object({
+  type: z2.literal("customized-mini-app"),
+  __platform: z2.literal("iMessage"),
+  // Display name of the owning app, shown by Messages fallback UI.
+  appName: z2.string().nonempty(),
+  // Apple App Store numeric id of the owning app. Positive when set; omit to
+  // send a card whose extension is not published on the App Store.
+  appStoreId: z2.number().int().positive().optional(),
+  // Bundle identifier of the iMessage extension target.
+  extensionBundleId: z2.string().nonempty(),
+  // Visible card layout.
+  layout: layoutSchema,
+  // 10-character uppercase alphanumeric Apple Team ID.
+  teamId: z2.string(),
+  // Absolute URL delivered to the installed extension on tap.
+  url: z2.url()
+});
+var isCustomizedMiniApp = (v) => customizedMiniAppSchema.safeParse(v).success;
+var asCustomizedMiniApp = (input) => customizedMiniAppSchema.parse({
+  type: "customized-mini-app",
+  __platform: "iMessage",
+  ...input
+});
+function customizedMiniApp(input) {
+  return {
+    build: async () => asCustomizedMiniApp(input)
+  };
+}
+
 // src/providers/imessage/content/effect.ts
 import {
   MessageEffect
 } from "@photon-ai/advanced-imessage";
 
 // src/content/effect.ts
-import z2 from "zod";
-var effectInnerSchema = z2.discriminatedUnion("type", [
+import z3 from "zod";
+var effectInnerSchema = z3.discriminatedUnion("type", [
   textSchema,
   attachmentSchema
 ]);
-var messageEffectSchema = z2.object({
-  type: z2.literal("effect"),
+var messageEffectSchema = z3.object({
+  type: z3.literal("effect"),
   content: effectInnerSchema,
-  effect: z2.string().nonempty()
+  effect: z3.string().nonempty()
 });
 
 // src/providers/imessage/content/effect.ts
@@ -103,13 +162,13 @@ function effect(input, messageEffect) {
 }
 
 // src/providers/imessage/content/read.ts
-import z3 from "zod";
+import z4 from "zod";
 var isMessage = (v) => typeof v === "object" && v !== null && "id" in v && "content" in v;
-var readSchema = z3.object({
-  type: z3.literal("read"),
-  __platform: z3.literal("iMessage"),
-  __fireAndForget: z3.literal(true),
-  target: z3.custom(isMessage, {
+var readSchema = z4.object({
+  type: z4.literal("read"),
+  __platform: z4.literal("iMessage"),
+  __fireAndForget: z4.literal(true),
+  target: z4.custom(isMessage, {
     message: "read target must be a Message"
   })
 });
@@ -137,33 +196,33 @@ import { createClient } from "@photon-ai/advanced-imessage";
 
 // src/providers/imessage/types.ts
 import { IMessageSDK } from "@photon-ai/imessage-kit";
-import z4 from "zod";
+import z5 from "zod";
 var SHARED_PHONE = "shared";
 var isLocal = (client) => client instanceof IMessageSDK;
-var clientEntry = z4.object({
-  address: z4.string(),
-  token: z4.string(),
-  phone: z4.string()
+var clientEntry = z5.object({
+  address: z5.string(),
+  token: z5.string(),
+  phone: z5.string()
 });
-var configSchema = z4.union([
-  z4.object({ local: z4.literal(true) }),
-  z4.object({
-    local: z4.literal(false).optional().default(false),
-    clients: clientEntry.or(z4.array(clientEntry)).optional()
+var configSchema = z5.union([
+  z5.object({ local: z5.literal(true) }),
+  z5.object({
+    local: z5.literal(false).optional().default(false),
+    clients: clientEntry.or(z5.array(clientEntry)).optional()
   })
 ]);
-var userSchema = z4.object({});
-var spaceSchema = z4.object({
-  id: z4.string(),
-  type: z4.enum(["dm", "group"]),
-  phone: z4.string()
+var userSchema = z5.object({});
+var spaceSchema = z5.object({
+  id: z5.string(),
+  type: z5.enum(["dm", "group"]),
+  phone: z5.string()
 });
-var spaceParamsSchema = z4.object({
-  phone: z4.string().optional()
+var spaceParamsSchema = z5.object({
+  phone: z5.string().optional()
 });
-var messageSchema = z4.object({
-  partIndex: z4.number().int().nonnegative().optional(),
-  parentId: z4.string().optional()
+var messageSchema = z5.object({
+  partIndex: z5.number().int().nonnegative().optional(),
+  parentId: z5.string().optional()
 });
 
 // src/providers/imessage/auth.ts
@@ -548,6 +607,18 @@ var setBackground = async (remote, spaceId, content) => {
   );
 };
 
+// src/providers/imessage/remote/customized-mini-app.ts
+var sendCustomizedMiniApp = async (remote, spaceId, content) => {
+  const chat = toChatGuid(spaceId);
+  const message = await remote.messages.sendCustomizedMiniApp(chat, content);
+  return {
+    id: message.guid,
+    content,
+    space: { id: spaceId },
+    timestamp: message.dateCreated
+  };
+};
+
 // src/providers/imessage/remote/inbound.ts
 import {
   NotFoundError as NotFoundError2
@@ -909,7 +980,6 @@ var getMessage3 = async (remote, spaceId, msgId, phone) => {
   if (childRef) {
     try {
       const fetched = await remote.messages.get(
-        toChatGuid(spaceId),
         toMessageGuid(childRef.parentGuid)
       );
       const parent = await rebuildFromAppleMessage(
@@ -932,10 +1002,7 @@ var getMessage3 = async (remote, spaceId, msgId, phone) => {
     }
   }
   try {
-    const fetched = await remote.messages.get(
-      toChatGuid(spaceId),
-      toMessageGuid(msgId)
-    );
+    const fetched = await remote.messages.get(toMessageGuid(msgId));
     const rebuilt = await rebuildFromAppleMessage(
       remote,
       fetched,
@@ -974,10 +1041,7 @@ var resolveReactionTarget = async (client, cache, chat, targetGuid, partIndex, p
   let candidate = cache.get(targetGuid);
   if (!candidate) {
     try {
-      const fetched = await client.messages.get(
-        toChatGuid(chat),
-        toMessageGuid(targetGuid)
-      );
+      const fetched = await client.messages.get(toMessageGuid(targetGuid));
       candidate = await rebuildFromAppleMessage(client, fetched, phone, chat);
       cacheMessage(cache, candidate);
     } catch {
@@ -1986,6 +2050,7 @@ var stopTyping = async (remote, spaceId) => {
 // src/providers/imessage/remote/api.ts
 var messages4 = (clients, projectConfig) => messages3(clients, projectConfig);
 var setBackground2 = async (remote, spaceId, content) => setBackground(remote, spaceId, content);
+var sendCustomizedMiniApp2 = async (remote, spaceId, content) => sendCustomizedMiniApp(remote, spaceId, content);
 var setDisplayName2 = async (remote, spaceId, content) => setDisplayName(remote, spaceId, content);
 var setIcon2 = async (remote, spaceId, content) => setIcon(remote, spaceId, content);
 var markRead2 = async (remote, spaceId) => {
@@ -2066,6 +2131,17 @@ var handleBackground = async (client, space, content) => {
   const remote = clientForPhone(client, space.phone);
   await setBackground2(remote, space.id, content);
 };
+var handleCustomizedMiniApp = async (client, space, content) => {
+  if (isLocal(client)) {
+    throw UnsupportedError.action(
+      "customized-mini-app",
+      "iMessage (local mode)",
+      "mini app cards require remote iMessage"
+    );
+  }
+  const remote = clientForPhone(client, space.phone);
+  return await sendCustomizedMiniApp2(remote, space.id, content);
+};
 var handleRead = async (client, space) => {
   if (isLocal(client)) {
     throw UnsupportedError.action(
@@ -2290,6 +2366,9 @@ var imessage = definePlatform("iMessage", {
       await handleRead(client, space);
       return;
     }
+    if (isCustomizedMiniApp(content)) {
+      return await handleCustomizedMiniApp(client, space, content);
+    }
     if (isLocal(client)) {
       return await send2(client, space.id, content);
     }
@@ -2350,6 +2429,7 @@ var imessage = definePlatform("iMessage", {
 
 export {
   background,
+  customizedMiniApp,
   effect,
   read,
   imessage

package/dist/index.d.ts

@@ -373,8 +373,8 @@ declare function rename(displayName: string): ContentBuilder;
  * `message.reply(content)` is sugar that delegates here. Providers see
  * `reply` like any other content type and route to a threaded send.
  *
- * Reply cannot wrap `reply`, `edit`, `reaction`, `group`, `typing`, `rename`,
- * or `avatar` content.
+ * Reply cannot wrap `reply`, `edit`, `reaction`, `group`, `typing`,
+ * `rename`, or `avatar` content.
  */
 declare const replySchema: z__default.ZodObject<{
     type: z__default.ZodLiteral<"reply">;
@@ -2645,13 +2645,14 @@ type WebhookHandler = (space: Space, message: Message) => void | Promise<void>;
 /**
  * Raw webhook input for HTTP servers without Web `Request`/`Response` (Express,
  * raw Node). `body` MUST be the exact bytes fusor POSTed — never a re-encoded
- * JSON/text body — so the protobuf decode and the fusor-origin signature check
- * (HMAC over the raw bytes) work. `headers` carry the `X-Spectrum-*` signature
- * headers fusor sets on signed deliveries.
+ * JSON/text body — so the protobuf decode works. `headers` are accepted (so the
+ * natural `{ headers: req.headers, body: req.body }` shape keeps working) but are
+ * not read: inbound authenticity is established by the per-platform `verify()`,
+ * which reads the inner request reconstructed from the envelope.
  */
 interface WebhookRawRequest {
     body: Uint8Array | ArrayBuffer;
-    headers: Record<string, string>;
+    headers?: Record<string, string>;
 }
 /** Raw webhook result, written back by the caller as the HTTP response. */
 interface WebhookRawResult {
@@ -2802,7 +2803,6 @@ declare function Spectrum<const Providers extends PlatformProviderConfig[]>(opti
     providers: [...Providers];
     options?: SpectrumOptions;
     telemetry?: boolean;
-    webhookSecret?: string;
 }): Promise<SpectrumInstance<Providers> & {
     readonly config: ProjectData;
 }>;
@@ -2812,7 +2812,6 @@ declare function Spectrum<const Providers extends PlatformProviderConfig[]>(opti
     providers: [...Providers];
     options?: SpectrumOptions;
     telemetry?: boolean;
-    webhookSecret?: string;
 }): Promise<SpectrumInstance<Providers>>;
 
 type UnsupportedKind = "content" | "action";

package/dist/index.js

@@ -1,14 +1,15 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   group,
   richlink
-} from "./chunk-LJM5D2T5.js";
+} from "./chunk-JQN6CRSC.js";
 import {
   voice
-} from "./chunk-5QSNQ6YN.js";
+} from "./chunk-NNY6LMSC.js";
 import {
   option,
   poll
-} from "./chunk-KO67KDBD.js";
+} from "./chunk-2D27WW5B.js";
 import {
   SpectrumCloudError,
   broadcast,
@@ -16,12 +17,12 @@ import {
   createAsyncQueue,
   mergeStreams,
   stream
-} from "./chunk-KYEHKHXT.js";
+} from "./chunk-MC6ZKFSG.js";
 import {
   contact,
   fromVCard,
   toVCard
-} from "./chunk-RNGEA4UW.js";
+} from "./chunk-QGJFZMD5.js";
 import {
   UnsupportedError,
   avatar,
@@ -35,7 +36,7 @@ import {
   senderAttrs,
   typing,
   wrapProviderMessage
-} from "./chunk-32H3VVUE.js";
+} from "./chunk-IPOFBAIM.js";
 import {
   __commonJS,
   __esm,
@@ -48,7 +49,7 @@ import {
   reaction,
   resolveContents,
   text
-} from "./chunk-FTLJVVH7.js";
+} from "./chunk-2ILTJC35.js";
 
 // ../../node_modules/@grpc/grpc-js/build/src/constants.js
 var require_constants = __commonJS({
@@ -27500,33 +27501,6 @@ var FusorCore = class {
   }
 };
 
-// src/fusor/origin.ts
-import { createHmac, timingSafeEqual } from "crypto";
-var SIGNATURE_HEADER = "x-spectrum-signature";
-var TIMESTAMP_HEADER = "x-spectrum-timestamp";
-var SIGNATURE_PREFIX = "v0=";
-var stripPrefix = (value) => value.startsWith(SIGNATURE_PREFIX) ? value.slice(SIGNATURE_PREFIX.length) : value;
-var safeEqualHex = (a, b) => {
-  const left = Buffer.from(a, "hex");
-  const right = Buffer.from(b, "hex");
-  if (left.length === 0 || left.length !== right.length) {
-    return false;
-  }
-  return timingSafeEqual(left, right);
-};
-var verifyFusorSignature = (secret, headers, body) => {
-  const timestamp = headers[TIMESTAMP_HEADER];
-  const signature = headers[SIGNATURE_HEADER];
-  if (!(timestamp && signature)) {
-    throw new Error("fusor webhook is missing X-Spectrum-* signature headers");
-  }
-  const base = Buffer.concat([Buffer.from(`v0:${timestamp}:`, "utf8"), body]);
-  const expected = SIGNATURE_PREFIX + createHmac("sha256", secret).update(base).digest("hex");
-  if (!safeEqualHex(stripPrefix(expected), stripPrefix(signature))) {
-    throw new Error("fusor webhook signature mismatch");
-  }
-};
-
 // src/utils/store.ts
 var isRecordObject = (value) => {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
@@ -27595,16 +27569,14 @@ var spectrumConfigSchema = z.union([
     projectSecret: z.string().min(1),
     providers: z.array(z.custom()),
     options: spectrumOptionsSchema,
-    telemetry: z.boolean().optional(),
-    webhookSecret: z.string().min(1).optional()
+    telemetry: z.boolean().optional()
   }),
   z.object({
     projectId: z.undefined().optional(),
     projectSecret: z.undefined().optional(),
     providers: z.array(z.custom()),
     options: spectrumOptionsSchema,
-    telemetry: z.boolean().optional(),
-    webhookSecret: z.string().min(1).optional()
+    telemetry: z.boolean().optional()
   })
 ]);
 function bootstrapTelemetry(opts) {
@@ -27634,8 +27606,7 @@ async function Spectrum(options) {
     projectSecret,
     providers,
     options: runtimeOptions,
-    telemetry,
-    webhookSecret
+    telemetry
   } = options;
   const flattenGroups = runtimeOptions?.flattenGroups ?? false;
   const otelHandle = telemetry ? bootstrapTelemetry({ projectId, projectSecret }) : void 0;
@@ -28002,23 +27973,14 @@ async function Spectrum(options) {
   };
   const readWebhookInput = async (request) => {
     if (typeof Request !== "undefined" && request instanceof Request) {
-      const headers2 = {};
-      request.headers.forEach((value, key) => {
-        headers2[key.toLowerCase()] = value;
-      });
       return {
         asWeb: true,
-        bodyBytes: new Uint8Array(await request.arrayBuffer()),
-        headers: headers2
+        bodyBytes: new Uint8Array(await request.arrayBuffer())
       };
     }
     const raw = request;
     const bodyBytes = raw.body instanceof ArrayBuffer ? new Uint8Array(raw.body) : raw.body;
-    const headers = {};
-    for (const [key, value] of Object.entries(raw.headers ?? {})) {
-      headers[key.toLowerCase()] = value;
-    }
-    return { asWeb: false, bodyBytes, headers };
+    return { asWeb: false, bodyBytes };
   };
   const deliverWebhookMessages = async (collected, runtime, handler, event) => {
     for (const record of collected) {
@@ -28040,12 +28002,6 @@ async function Spectrum(options) {
       }
     }
   };
-  const assertFusorOrigin = (bodyBytes, headers) => {
-    if (!webhookSecret) {
-      return;
-    }
-    verifyFusorSignature(webhookSecret, headers, bodyBytes);
-  };
   const decodeWebhookEvent = (bodyBytes) => {
     try {
       return RawInboundEvent2.decode(bodyBytes);
@@ -28096,19 +28052,7 @@ async function Spectrum(options) {
         "spectrum.webhook() requires at least one fusor provider; none are configured"
       );
     }
-    const { asWeb, bodyBytes, headers } = await readWebhookInput(request);
-    try {
-      assertFusorOrigin(bodyBytes, headers);
-    } catch (error) {
-      lifecycleLog.warn("spectrum.webhook: fusor origin verification failed", {
-        error: error instanceof Error ? error.message : String(error)
-      });
-      return buildWebhookResult(asWeb, {
-        status: 401,
-        headers: {},
-        body: new Uint8Array(0)
-      });
-    }
+    const { asWeb, bodyBytes } = await readWebhookInput(request);
     const event = decodeWebhookEvent(bodyBytes);
     if (!event) {
       return buildWebhookResult(asWeb, {

package/dist/providers/imessage/index.d.ts

@@ -39,6 +39,78 @@ declare function background(input: string | Buffer | URL, options?: {
     mimeType?: string;
 }): ContentBuilder;
 
+/**
+ * Visible layout of a mini-app card. Mirrors Apple's
+ * `MSMessageTemplateLayout`. At least one of `caption`, `subcaption`,
+ * `trailingCaption`, `trailingSubcaption`, or `image` must be set so the
+ * bubble is not empty — `summary` is the fallback text shown on surfaces
+ * that cannot render the card (notifications, lock screen) and is not a
+ * visible slot on its own. `image` and `imageTitle` must be set together;
+ * `imageSubtitle` requires `image`.
+ */
+declare const layoutSchema: z__default.ZodObject<{
+    caption: z__default.ZodOptional<z__default.ZodString>;
+    subcaption: z__default.ZodOptional<z__default.ZodString>;
+    trailingCaption: z__default.ZodOptional<z__default.ZodString>;
+    trailingSubcaption: z__default.ZodOptional<z__default.ZodString>;
+    image: z__default.ZodOptional<z__default.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
+    imageTitle: z__default.ZodOptional<z__default.ZodString>;
+    imageSubtitle: z__default.ZodOptional<z__default.ZodString>;
+    summary: z__default.ZodOptional<z__default.ZodString>;
+}, z__default.core.$strip>;
+/**
+ * iMessage-only mini-app card content. Lives entirely under the iMessage
+ * provider — never enters the universal `Content` discriminated union. The
+ * framework recognizes it via the generic content-level platform contract:
+ *
+ * - `__platform: "iMessage"` — `findUnsupportedPlatformContent` reads this tag
+ *   and warns-and-skips when a different platform receives it.
+ *
+ * Unlike `background` / `read`, this content is **not** `__fireAndForget`: it
+ * produces a real outbound message, so the iMessage `send` handler narrows
+ * back to `CustomizedMiniApp` via the `isCustomizedMiniApp` guard and returns
+ * the resulting `ProviderMessageRecord` (rather than `void`).
+ */
+declare const customizedMiniAppSchema: z__default.ZodObject<{
+    type: z__default.ZodLiteral<"customized-mini-app">;
+    __platform: z__default.ZodLiteral<"iMessage">;
+    appName: z__default.ZodString;
+    appStoreId: z__default.ZodOptional<z__default.ZodNumber>;
+    extensionBundleId: z__default.ZodString;
+    layout: z__default.ZodObject<{
+        caption: z__default.ZodOptional<z__default.ZodString>;
+        subcaption: z__default.ZodOptional<z__default.ZodString>;
+        trailingCaption: z__default.ZodOptional<z__default.ZodString>;
+        trailingSubcaption: z__default.ZodOptional<z__default.ZodString>;
+        image: z__default.ZodOptional<z__default.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
+        imageTitle: z__default.ZodOptional<z__default.ZodString>;
+        imageSubtitle: z__default.ZodOptional<z__default.ZodString>;
+        summary: z__default.ZodOptional<z__default.ZodString>;
+    }, z__default.core.$strip>;
+    teamId: z__default.ZodString;
+    url: z__default.ZodURL;
+}, z__default.core.$strip>;
+type CustomizedMiniApp = z__default.infer<typeof customizedMiniAppSchema>;
+type CustomizedMiniAppLayout = z__default.infer<typeof layoutSchema>;
+type CustomizedMiniAppInput = Omit<CustomizedMiniApp, "type" | "__platform">;
+/**
+ * Construct a `customized-mini-app` content value. iMessage-only, remote-only.
+ *
+ * The layout is what recipients see in the bubble. `teamId` and
+ * `extensionBundleId` identify the iMessage extension that receives `url` when
+ * the recipient taps the card; the server constructs the matching
+ * `MSMessageExtensionBalloonPlugin` plugin id from these values. `appStoreId`
+ * is optional and only points recipients without the extension at its App
+ * Store entry.
+ *
+ * `space.send(customizedMiniApp(...))` is the canonical form.
+ *
+ * `CustomizedMiniApp` is intentionally not a member of the universal `Content`
+ * union — the `as unknown as Content` cast keeps the builder shape compatible
+ * with the framework's `ContentBuilder.build(): Promise<Content>` signature.
+ */
+declare function customizedMiniApp(input: CustomizedMiniAppInput): ContentBuilder;
+
 type IMessageMessageEffect = MessageEffect;
 declare function effect(input: ContentInput, messageEffect: IMessageMessageEffect): ContentBuilder;
 
@@ -176,4 +248,4 @@ declare const imessage: Platform<PlatformDef<"iMessage", z.ZodUnion<readonly [z.
     };
 }>;
 
-export { type BackgroundInput, type IMessageMessageEffect, background, effect, imessage, read };
+export { type BackgroundInput, type CustomizedMiniApp, type CustomizedMiniAppInput, type CustomizedMiniAppLayout, type IMessageMessageEffect, background, customizedMiniApp, effect, imessage, read };

package/dist/providers/imessage/index.js

@@ -1,17 +1,20 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   background,
+  customizedMiniApp,
   effect,
   imessage,
   read
-} from "../../chunk-DK4P2SHC.js";
-import "../../chunk-LJM5D2T5.js";
-import "../../chunk-KO67KDBD.js";
-import "../../chunk-KYEHKHXT.js";
-import "../../chunk-RNGEA4UW.js";
-import "../../chunk-32H3VVUE.js";
-import "../../chunk-FTLJVVH7.js";
+} from "../../chunk-YN6WOTBF.js";
+import "../../chunk-JQN6CRSC.js";
+import "../../chunk-2D27WW5B.js";
+import "../../chunk-MC6ZKFSG.js";
+import "../../chunk-QGJFZMD5.js";
+import "../../chunk-IPOFBAIM.js";
+import "../../chunk-2ILTJC35.js";
 export {
   background,
+  customizedMiniApp,
   effect,
   imessage,
   read

package/dist/providers/index.js

@@ -1,22 +1,23 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   imessage
-} from "../chunk-DK4P2SHC.js";
-import "../chunk-LJM5D2T5.js";
+} from "../chunk-YN6WOTBF.js";
+import "../chunk-JQN6CRSC.js";
 import {
   slack
-} from "../chunk-Y4CZ5JFD.js";
+} from "../chunk-3OTECDNH.js";
 import {
   terminal
-} from "../chunk-6NGVREPQ.js";
-import "../chunk-5QSNQ6YN.js";
+} from "../chunk-5BKZJMZV.js";
+import "../chunk-NNY6LMSC.js";
 import {
   whatsappBusiness
-} from "../chunk-GHERTIUM.js";
-import "../chunk-KO67KDBD.js";
-import "../chunk-KYEHKHXT.js";
-import "../chunk-RNGEA4UW.js";
-import "../chunk-32H3VVUE.js";
-import "../chunk-FTLJVVH7.js";
+} from "../chunk-5TIF3FIE.js";
+import "../chunk-2D27WW5B.js";
+import "../chunk-MC6ZKFSG.js";
+import "../chunk-QGJFZMD5.js";
+import "../chunk-IPOFBAIM.js";
+import "../chunk-2ILTJC35.js";
 export {
   imessage,
   slack,

package/dist/providers/slack/index.js

@@ -1,9 +1,10 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   slack
-} from "../../chunk-Y4CZ5JFD.js";
-import "../../chunk-KYEHKHXT.js";
-import "../../chunk-32H3VVUE.js";
-import "../../chunk-FTLJVVH7.js";
+} from "../../chunk-3OTECDNH.js";
+import "../../chunk-MC6ZKFSG.js";
+import "../../chunk-IPOFBAIM.js";
+import "../../chunk-2ILTJC35.js";
 export {
   slack
 };

package/dist/providers/terminal/index.js

@@ -1,10 +1,11 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   terminal
-} from "../../chunk-6NGVREPQ.js";
-import "../../chunk-5QSNQ6YN.js";
-import "../../chunk-RNGEA4UW.js";
-import "../../chunk-32H3VVUE.js";
-import "../../chunk-FTLJVVH7.js";
+} from "../../chunk-5BKZJMZV.js";
+import "../../chunk-NNY6LMSC.js";
+import "../../chunk-QGJFZMD5.js";
+import "../../chunk-IPOFBAIM.js";
+import "../../chunk-2ILTJC35.js";
 export {
   terminal
 };

package/dist/providers/whatsapp-business/index.js

@@ -1,11 +1,12 @@
+import { createRequire as __spectrumCreateRequire } from "node:module"; const require = __spectrumCreateRequire(import.meta.url);
 import {
   whatsappBusiness
-} from "../../chunk-GHERTIUM.js";
-import "../../chunk-KO67KDBD.js";
-import "../../chunk-KYEHKHXT.js";
-import "../../chunk-RNGEA4UW.js";
-import "../../chunk-32H3VVUE.js";
-import "../../chunk-FTLJVVH7.js";
+} from "../../chunk-5TIF3FIE.js";
+import "../../chunk-2D27WW5B.js";
+import "../../chunk-MC6ZKFSG.js";
+import "../../chunk-QGJFZMD5.js";
+import "../../chunk-IPOFBAIM.js";
+import "../../chunk-2ILTJC35.js";
 export {
   whatsappBusiness
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spectrum-ts",
-  "version": "1.17.0",
+  "version": "1.18.0",
   "description": "Bring agents to any interface — unified messaging SDK for TypeScript.",
   "repository": {
     "type": "git",
@@ -38,7 +38,7 @@
     "./manifest.json": "./dist/manifest.json"
   },
   "dependencies": {
-    "@photon-ai/advanced-imessage": "^0.10.0",
+    "@photon-ai/advanced-imessage": "^0.11.0",
     "@photon-ai/imessage-kit": "^3.0.0",
     "@photon-ai/otel": "^0.1.1",
     "@photon-ai/slack": "^0.2.0",