• Improved pub.flutter-io.cn discovery with a search-focused description, five relevant topics, an integration-architecture thumbnail, current install commands, and clearer webhook trust and capability signals in the package README.
• Added tag-based GitHub OIDC publishing support; no long-lived pub token is required after the package admin enables trusted publishing.

• Fixed LICENSE: it had the standard MIT text plus a custom disclaimer appended after it, which broke automated license recognition (pub.flutter-io.cn scored it 0/10 for "Use an OSI-approved license"). LICENSE is now pure MIT text; the disclaimer's content was already covered by this README's License section and the root repo's SECURITY.md.

First stable release. The public API is now under a stability commitment (breaking changes will bump the major version).

• Test suite expanded to 65 tests covering 99.67% of lib/ (304/305 lines); the 1 remaining line is the default arm of an internal switch (method) that every public method reaches only with a hardcoded HTTP verb, unreachable through the public API.
• Webhook management now validates HTTPS callback URLs, identifiers, event lists, statuses, timeout configuration, and update payloads locally.
• Required fields in event-type, webhook, and delivery payloads now produce typed parse exceptions instead of silently creating empty identifiers.
• Network failures from webhook mutations explicitly describe the remote outcome as unknown and direct callers to verify state before retrying.
• verifyWebhookSignature(): HMAC-SHA512 verification of the X-ANET-Signature header, which should always be checked before trusting a webhook body. Matches an independently-computed (Python hmac) reference vector: see webhook_signature_test.dart. Hex-decoding the portal's 128-character Signature Key follows Authorize.Net's published key-format guidance; a live delivery is still needed to validate an integrator's raw-body handling.
• parseWebhookEvent() / WebhookEvent: parses a verified webhook body, with notificationId (for idempotent handling of Authorize.Net's at-least-once delivery) and entityId (the transaction/subscription id to look up via authnet_core). Throws WebhookParseException (consistently, never a bare TypeError) for any body that isn't a JSON object.
• WebhookClient: full webhook CRUD (listWebhooks, createWebhook, getWebhook, updateWebhook, deleteWebhook, listEventTypes) over the Webhooks REST API (HTTP Basic auth, a separate service from authnet_core's Transaction/JSON API). listWebhooks()/listEventTypes() were tested against a live sandbox account; see the README for what createWebhook() and its dependents weren't, and why. Every failure mode (a non-200 response, a non-JSON body, or a JSON body in an unexpected shape) surfaces as a typed WebhookApiException, never a bare TypeError/FormatException; error-message extraction now also recognizes the {"reason":...,"message":...} shape that a real validation failure actually returns.
• Webhook management now supports the optional webhook name, testing an inactive webhook with pingWebhook(), listing notification history with documented date/status/pagination filters, and retrieving a notification's retry log and event payload. Resource identifiers are path-safe and malformed list entries are rejected rather than silently discarded.
• WebhookConfig: credentials for the Webhooks REST API, with a WebhookConfig.fromAuthNetConfig() convenience constructor.
• WebhookStatus: an unrecognized status string from Authorize.Net parses to WebhookStatus.unknown rather than being silently reported as inactive.
• WebhookEventTypes: expanded from 6 to all 23 constants: every payment, customer profile, and subscription event type Authorize.Net actually returns, matching a live listEventTypes() call exactly. Also resolves the open question of eCheck-specific event names: there are none; eCheck transactions fire the same payment events as card transactions.
• New WebhookConfig.eventTypesUrl getter, replacing a regex that reconstructed the event-types URL by stripping /webhooks off baseUrl; that worked, but was fragile against baseUrl ever changing shape.