@assinafy/sdk 2.1.1 → 2.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +99 -1
- package/README.md +601 -117
- package/SECURITY.md +4 -2
- package/dist/index.d.mts +697 -316
- package/dist/index.d.ts +697 -316
- package/dist/index.js +3102 -1938
- package/dist/index.mjs +3100 -1938
- package/docs/API_COVERAGE.md +28 -30
- package/docs/COMPATIBILITY.md +279 -179
- package/docs/RELEASING.md +42 -11
- package/package.json +10 -9
package/SECURITY.md
CHANGED
|
@@ -44,8 +44,10 @@ opportunity to upgrade.
|
|
|
44
44
|
authentication, and signer-access-code flows use an auth-free transport so
|
|
45
45
|
configured account credentials are not sent to public endpoints.
|
|
46
46
|
- Consumers must use HTTPS endpoints and protect all SDK configuration as
|
|
47
|
-
secrets.
|
|
48
|
-
|
|
47
|
+
secrets. The client enforces this: a `baseUrl` using plaintext `http` is
|
|
48
|
+
rejected unless its host is loopback, so a credential cannot be sent in the
|
|
49
|
+
clear to a remote host. Debug logging and error telemetry must be reviewed
|
|
50
|
+
for response data before being enabled in production.
|
|
49
51
|
- The webhook HMAC helper is an opt-in utility, not proof of an official
|
|
50
52
|
Assinafy signing contract. Confirm the header, algorithm, encoding, and secret
|
|
51
53
|
delivery mechanism with Assinafy before enforcing it. See
|