v0.8.16

Added

• Integration SDK v1 response contract for inbound routes. A route may now declare a host-side
  preflight (today: session-alive, returning 503 for a definitively-dead WhatsApp session) and a
  declarative ack (status/body/headers) returned synchronously to the provider. The plugin ALWAYS runs
  async (enqueued, full DLQ/retry); for routes declaring response, the ack is returned without awaiting
  enqueue so a queue-disabled deployment cannot block the provider's deadline. A dead session (no live
  engine or FAILED) on a concrete-scoped route now fails fast with 503 instead of being swallowed into
  202; recoverable statuses still 202+enqueue and let the worker fail fast. The inert mode: 'sync-reply'
  value is deprecated in favor of response (kept for SDK v1 additive-only compatibility). Routes with no
  response are byte-identical to today's default fast-ack.

• standard-webhooks ingress signature scheme. A route may now declare
  signature.scheme: "standard-webhooks" to verify Standard Webhooks
  payloads host-side (Supabase Auth's Send SMS hook, and any Svix-routed provider). The wire format is
  fixed by the spec, so only toleranceSec (default 300s) and dedupHeader apply. The operator pastes
  the provider's Svix secret (v1,whsec_<base64>) as the instance secret. This surfaces a bad signature
  as a synchronous 401 and — because the session-alive preflight runs after verify — makes that preflight
  safe to use (an unauthenticated caller can no longer probe liveness). Additive; existing
  hmac-sha256/shared-secret/none behavior is unchanged.