Changelog¶

0.3.2¶

Docs only. Production issuer is https://auth.last1.id. client_id accepts the Client ID UUID or the App ID slug.

CommonJS interop for Node backends that compile to require().

New dist/index.cjs artifact and "require" export condition so packages like last.vet-api (Express + tsc → CommonJS) can require("@last1id/sdk") without ERR_PACKAGE_PATH_NOT_EXPORTED.
Run node scripts/build-sdk-cjs.mjs before publish to regenerate the CJS bundle from the ESM dist.

Cross-app revoke webhook signature verification.

New verifyWebhookSignature(secretB64, header, rawBody, options?) helper — partners use this in their /api/webhooks/last1 handler to validate inbound consent.revoked / app_link.revoked events from last1.id. Validates the Stripe-style t=<unix>,v1=<hex> envelope, enforces a 5-minute replay window (configurable), and supports multi-v1= rotation windows.
New typed error Last1WebhookSignatureError with a discriminated .code field (missing_header | malformed_header | stale_timestamp | signature_mismatch | secret_invalid) so partners can distinguish hard config bugs from operational signal-loss.
Documented integration guide in docs/PARTNER_WEBHOOKS.md on the server repo, including raw-Node and Express reference handlers, idempotency notes, and the production-only HTTPS-required invariant.

Partner-facing read surface (Phase 1c) plus auto-refresh client.

New helpers — fetchUserinfo, listCredentials, getCredential, listTrustEvents, getAppLinkSelf. Each takes { issuerUrl, accessToken } and returns typed results.
New Last1Client class — wraps the helpers and transparently refreshes on a 401 invalid_token. Concurrent 401s coalesce into a single refresh so the single-use refresh-token chain is not burned by parallel requests. onTokensRefreshed hook lets callers persist the rotated pair.
New typed errors — Last1HttpError (any HTTP failure with .status + .code + .detail) and Last1AuthError (subclass thrown when the refresh chain is unrecoverable; partners should drop the user out to a re-link flow).
Existing helpers (exchangeCode, refreshToken) now throw the typed error classes instead of generic Error, so partners can catch (e) { if (e instanceof Last1AuthError) ... }.