@depup/stripe 21.0.0-depup.0

package/esm/StripeResource.js

@@ -0,0 +1,185 @@
+import { getDataFromArgs, getOptionsFromArgs, makeURLInterpolator, protoExtend, queryStringifyRequestData, } from './utils.js';
+import { stripeMethod } from './StripeMethod.js';
+import { coerceV2RequestData, coerceV2ResponseData } from './V2Coercion.js';
+// Provide extension mechanism for Stripe Resource Sub-Classes
+StripeResource.extend = protoExtend;
+// Expose method-creator
+StripeResource.method = stripeMethod;
+StripeResource.MAX_BUFFERED_REQUEST_METRICS = 100;
+/**
+ * Encapsulates request logic for a Stripe Resource
+ */
+function StripeResource(stripe, deprecatedUrlData) {
+    this._stripe = stripe;
+    if (deprecatedUrlData) {
+        throw new Error('Support for curried url params was dropped in stripe-node v7.0.0. Instead, pass two ids.');
+    }
+    this.basePath = makeURLInterpolator(
+    // @ts-ignore changing type of basePath
+    this.basePath || stripe.getApiField('basePath'));
+    // @ts-ignore changing type of path
+    this.resourcePath = this.path;
+    // @ts-ignore changing type of path
+    this.path = makeURLInterpolator(this.path);
+    this.initialize(...arguments);
+}
+StripeResource.prototype = {
+    _stripe: null,
+    // @ts-ignore the type of path changes in ctor
+    path: '',
+    resourcePath: '',
+    // Methods that don't use the API's default '/v1' path can override it with this setting.
+    basePath: null,
+    initialize() { },
+    // Function to override the default data processor. This allows full control
+    // over how a StripeResource's request data will get converted into an HTTP
+    // body. This is useful for non-standard HTTP requests. The function should
+    // take method name, data, and headers as arguments.
+    requestDataProcessor: null,
+    // Function to add a validation checks before sending the request, errors should
+    // be thrown, and they will be passed to the callback/promise.
+    validateRequest: null,
+    createFullPath(commandPath, urlData) {
+        const urlParts = [this.basePath(urlData), this.path(urlData)];
+        if (typeof commandPath === 'function') {
+            const computedCommandPath = commandPath(urlData);
+            // If we have no actual command path, we just omit it to avoid adding a
+            // trailing slash. This is important for top-level listing requests, which
+            // do not have a command path.
+            if (computedCommandPath) {
+                urlParts.push(computedCommandPath);
+            }
+        }
+        else {
+            urlParts.push(commandPath);
+        }
+        return this._joinUrlParts(urlParts);
+    },
+    // Creates a relative resource path with symbols left in (unlike
+    // createFullPath which takes some data to replace them with). For example it
+    // might produce: /invoices/{id}
+    createResourcePathWithSymbols(pathWithSymbols) {
+        // If there is no path beyond the resource path, we want to produce just
+        // /<resource path> rather than /<resource path>/.
+        if (pathWithSymbols) {
+            return `/${this._joinUrlParts([this.resourcePath, pathWithSymbols])}`;
+        }
+        else {
+            return `/${this.resourcePath}`;
+        }
+    },
+    _joinUrlParts(parts) {
+        // Replace any accidentally doubled up slashes. This previously used
+        // path.join, which would do this as well. Unfortunately we need to do this
+        // as the functions for creating paths are technically part of the public
+        // interface and so we need to preserve backwards compatibility.
+        return parts.join('/').replace(/\/{2,}/g, '/');
+    },
+    _getRequestOpts(requestArgs, spec, overrideData) {
+        // Extract spec values with defaults.
+        const requestMethod = (spec.method || 'GET').toUpperCase();
+        const usage = spec.usage || [];
+        const urlParams = spec.urlParams || [];
+        const encode = spec.encode || ((data) => data);
+        const isUsingFullPath = !!spec.fullPath;
+        const commandPath = makeURLInterpolator(isUsingFullPath ? spec.fullPath : spec.path || '');
+        // When using fullPath, we ignore the resource path as it should already be
+        // fully qualified.
+        const path = isUsingFullPath
+            ? spec.fullPath
+            : this.createResourcePathWithSymbols(spec.path);
+        // Don't mutate args externally.
+        const args = [].slice.call(requestArgs);
+        // Generate and validate url params.
+        const urlData = urlParams.reduce((urlData, param) => {
+            const arg = args.shift();
+            if (typeof arg !== 'string') {
+                throw new Error(`Stripe: Argument "${param}" must be a string, but got: ${arg} (on API request to \`${requestMethod} ${path}\`)`);
+            }
+            urlData[param] = arg;
+            return urlData;
+        }, {});
+        // Pull request data and options (headers, auth) from args.
+        const dataFromArgs = getDataFromArgs(args);
+        const data = encode(Object.assign({}, dataFromArgs, overrideData));
+        const options = getOptionsFromArgs(args);
+        const host = options.host || spec.host;
+        const streaming = !!spec.streaming || !!options.streaming;
+        // Validate that there are no more args.
+        if (args.filter((x) => x != null).length) {
+            throw new Error(`Stripe: Unknown arguments (${args}). Did you mean to pass an options object? See https://github.com/stripe/stripe-node/wiki/Passing-Options. (on API request to ${requestMethod} \`${path}\`)`);
+        }
+        // When using full path, we can just invoke the URL interpolator directly
+        // as we don't need to use the resource to create a full path.
+        const requestPath = isUsingFullPath
+            ? commandPath(urlData)
+            : this.createFullPath(commandPath, urlData);
+        const headers = Object.assign(options.headers, spec.headers);
+        if (spec.validator) {
+            spec.validator(data, { headers });
+        }
+        const dataInQuery = spec.method === 'GET' || spec.method === 'DELETE';
+        const bodyData = dataInQuery ? null : data;
+        const queryData = dataInQuery ? data : {};
+        return {
+            requestMethod,
+            requestPath,
+            bodyData,
+            queryData,
+            authenticator: options.authenticator ?? null,
+            headers,
+            host: host ?? null,
+            streaming,
+            settings: options.settings,
+            usage,
+        };
+    },
+    _makeRequest(requestArgs, spec, overrideData) {
+        return new Promise((resolve, reject) => {
+            let opts;
+            try {
+                opts = this._getRequestOpts(requestArgs, spec, overrideData);
+            }
+            catch (err) {
+                reject(err);
+                return;
+            }
+            // Coerce int64_string/decimal_string fields in request body: number/Decimal → string
+            if (spec.requestSchema && opts.bodyData) {
+                opts.bodyData = coerceV2RequestData(opts.bodyData, spec.requestSchema);
+            }
+            function requestCallback(err, response) {
+                if (err) {
+                    reject(err);
+                }
+                else {
+                    // Coerce int64_string/decimal_string fields in response: string → bigint/Decimal
+                    try {
+                        if (spec.responseSchema) {
+                            coerceV2ResponseData(response, spec.responseSchema);
+                        }
+                        resolve(spec.transformResponseData
+                            ? spec.transformResponseData(response)
+                            : response);
+                    }
+                    catch (e) {
+                        reject(e);
+                    }
+                }
+            }
+            const emptyQuery = Object.keys(opts.queryData).length === 0;
+            const path = [
+                opts.requestPath,
+                emptyQuery ? '' : '?',
+                queryStringifyRequestData(opts.queryData),
+            ].join('');
+            const { headers, settings } = opts;
+            this._stripe._requestSender._request(opts.requestMethod, opts.host, path, opts.bodyData, opts.authenticator, {
+                headers,
+                settings,
+                streaming: opts.streaming,
+            }, opts.usage, requestCallback, this.requestDataProcessor?.bind(this));
+        });
+    },
+};
+export { StripeResource };

package/esm/V2Coercion.js

@@ -0,0 +1,104 @@
+import { Decimal } from './Decimal.js';
+/**
+ * Coerces outbound V2 request data by converting bigint (or number)
+ * int64_string fields to strings, matching the wire format expected by the API.
+ *
+ * Walks the schema tree and only touches fields that are marked as
+ * int64_string. All other values are left unchanged.
+ */
+export const coerceV2RequestData = (data, schema) => {
+    if (data == null) {
+        return data;
+    }
+    switch (schema.kind) {
+        case 'int64_string':
+            return typeof data === 'bigint' || typeof data === 'number'
+                ? String(data)
+                : data;
+        case 'decimal_string':
+            // Duck-type check: Decimal instances have toFixed() and isZero() methods.
+            return typeof data.toFixed === 'function' &&
+                typeof data.isZero === 'function'
+                ? data.toString()
+                : data;
+        case 'object': {
+            if (typeof data !== 'object' || Array.isArray(data)) {
+                return data;
+            }
+            const obj = data;
+            const result = {};
+            for (const key of Object.keys(obj)) {
+                const fieldSchema = schema.fields[key];
+                result[key] = fieldSchema
+                    ? coerceV2RequestData(obj[key], fieldSchema)
+                    : obj[key];
+            }
+            return result;
+        }
+        case 'array': {
+            if (!Array.isArray(data)) {
+                return data;
+            }
+            return data.map((element) => coerceV2RequestData(element, schema.element));
+        }
+        case 'nullable':
+            return coerceV2RequestData(data, schema.inner);
+    }
+};
+/**
+ * Coerces inbound V2 response data by converting string int64_string fields
+ * to bigints, matching the SDK's public type contract.
+ *
+ * Walks the schema tree and only touches fields that are marked as
+ * int64_string. All other values are left unchanged.
+ */
+export const coerceV2ResponseData = (data, schema) => {
+    if (data == null) {
+        return data;
+    }
+    switch (schema.kind) {
+        case 'int64_string':
+            if (typeof data === 'string') {
+                try {
+                    return BigInt(data);
+                }
+                catch {
+                    throw new Error(`Failed to coerce int64_string value: expected an integer string, got '${data}'`);
+                }
+            }
+            return data;
+        case 'decimal_string':
+            if (typeof data === 'string') {
+                try {
+                    return Decimal.from(data);
+                }
+                catch {
+                    throw new Error(`Failed to coerce decimal_string value: expected a decimal string, got '${data}'`);
+                }
+            }
+            return data;
+        case 'object': {
+            if (typeof data !== 'object' || Array.isArray(data)) {
+                return data;
+            }
+            const obj = data;
+            for (const key of Object.keys(schema.fields)) {
+                if (key in obj) {
+                    obj[key] = coerceV2ResponseData(obj[key], schema.fields[key]);
+                }
+            }
+            return obj;
+        }
+        case 'array': {
+            if (!Array.isArray(data)) {
+                return data;
+            }
+            for (let i = 0; i < data.length; i++) {
+                data[i] = coerceV2ResponseData(data[i], schema.element);
+            }
+            return data;
+        }
+        case 'nullable':
+            return coerceV2ResponseData(data, schema.inner);
+    }
+};

package/esm/Webhooks.js

@@ -0,0 +1,221 @@
+import { StripeError, StripeSignatureVerificationError } from './Error.js';
+import { CryptoProviderOnlySupportsAsyncError, } from './crypto/CryptoProvider.js';
+export function createWebhooks(platformFunctions) {
+    const Webhook = {
+        DEFAULT_TOLERANCE: 300,
+        signature: null,
+        constructEvent(payload, header, secret, tolerance, cryptoProvider, receivedAt) {
+            try {
+                if (!this.signature) {
+                    throw new Error('ERR: missing signature helper, unable to verify');
+                }
+                this.signature.verifyHeader(payload, header, secret, tolerance || Webhook.DEFAULT_TOLERANCE, cryptoProvider, receivedAt);
+            }
+            catch (e) {
+                if (e instanceof CryptoProviderOnlySupportsAsyncError) {
+                    e.message +=
+                        '\nUse `await constructEventAsync(...)` instead of `constructEvent(...)`';
+                }
+                throw e;
+            }
+            const jsonPayload = payload instanceof Uint8Array
+                ? JSON.parse(new TextDecoder('utf8').decode(payload))
+                : JSON.parse(payload);
+            if (jsonPayload && jsonPayload.object === 'v2.core.event') {
+                throw new Error('You passed an event notification to stripe.webhooks.constructEvent, which expects a webhook payload. Use stripe.parseEventNotification instead.');
+            }
+            return jsonPayload;
+        },
+        async constructEventAsync(payload, header, secret, tolerance, cryptoProvider, receivedAt) {
+            if (!this.signature) {
+                throw new Error('ERR: missing signature helper, unable to verify');
+            }
+            await this.signature.verifyHeaderAsync(payload, header, secret, tolerance || Webhook.DEFAULT_TOLERANCE, cryptoProvider, receivedAt);
+            const jsonPayload = payload instanceof Uint8Array
+                ? JSON.parse(new TextDecoder('utf8').decode(payload))
+                : JSON.parse(payload);
+            if (jsonPayload && jsonPayload.object === 'v2.core.event') {
+                throw new Error('You passed an event notification to stripe.webhooks.constructEvent, which expects a webhook payload. Use stripe.parseEventNotification instead.');
+            }
+            return jsonPayload;
+        },
+        /**
+         * Generates a header to be used for webhook mocking
+         *
+         * @typedef {object} opts
+         * @property {number} timestamp - Timestamp of the header. Defaults to Date.now()
+         * @property {string} payload - JSON stringified payload object, containing the 'id' and 'object' parameters
+         * @property {string} secret - Stripe webhook secret 'whsec_...'
+         * @property {string} scheme - Version of API to hit. Defaults to 'v1'.
+         * @property {string} signature - Computed webhook signature
+         * @property {CryptoProvider} cryptoProvider - Crypto provider to use for computing the signature if none was provided. Defaults to NodeCryptoProvider.
+         */
+        generateTestHeaderString: function (opts) {
+            const preparedOpts = prepareOptions(opts);
+            const signature = preparedOpts.signature ||
+                preparedOpts.cryptoProvider.computeHMACSignature(preparedOpts.payloadString, preparedOpts.secret);
+            return preparedOpts.generateHeaderString(signature);
+        },
+        generateTestHeaderStringAsync: async function (opts) {
+            const preparedOpts = prepareOptions(opts);
+            const signature = preparedOpts.signature ||
+                (await preparedOpts.cryptoProvider.computeHMACSignatureAsync(preparedOpts.payloadString, preparedOpts.secret));
+            return preparedOpts.generateHeaderString(signature);
+        },
+    };
+    const signature = {
+        EXPECTED_SCHEME: 'v1',
+        verifyHeader(encodedPayload, encodedHeader, secret, tolerance, cryptoProvider, receivedAt) {
+            const { decodedHeader: header, decodedPayload: payload, details, suspectPayloadType, } = parseEventDetails(encodedPayload, encodedHeader, this.EXPECTED_SCHEME);
+            const secretContainsWhitespace = /\s/.test(secret);
+            cryptoProvider = cryptoProvider || getCryptoProvider();
+            const expectedSignature = cryptoProvider.computeHMACSignature(makeHMACContent(payload, details), secret);
+            validateComputedSignature(payload, header, details, expectedSignature, tolerance, suspectPayloadType, secretContainsWhitespace, receivedAt);
+            return true;
+        },
+        async verifyHeaderAsync(encodedPayload, encodedHeader, secret, tolerance, cryptoProvider, receivedAt) {
+            const { decodedHeader: header, decodedPayload: payload, details, suspectPayloadType, } = parseEventDetails(encodedPayload, encodedHeader, this.EXPECTED_SCHEME);
+            const secretContainsWhitespace = /\s/.test(secret);
+            cryptoProvider = cryptoProvider || getCryptoProvider();
+            const expectedSignature = await cryptoProvider.computeHMACSignatureAsync(makeHMACContent(payload, details), secret);
+            return validateComputedSignature(payload, header, details, expectedSignature, tolerance, suspectPayloadType, secretContainsWhitespace, receivedAt);
+        },
+    };
+    function makeHMACContent(payload, details) {
+        return `${details.timestamp}.${payload}`;
+    }
+    function parseEventDetails(encodedPayload, encodedHeader, expectedScheme) {
+        if (!encodedPayload) {
+            throw new StripeSignatureVerificationError(encodedHeader, encodedPayload, {
+                message: 'No webhook payload was provided.',
+            });
+        }
+        const suspectPayloadType = typeof encodedPayload != 'string' &&
+            !(encodedPayload instanceof Uint8Array);
+        const textDecoder = new TextDecoder('utf8');
+        const decodedPayload = encodedPayload instanceof Uint8Array
+            ? textDecoder.decode(encodedPayload)
+            : encodedPayload;
+        // Express's type for `Request#headers` is `string | []string`
+        // which is because the `set-cookie` header is an array,
+        // but no other headers are an array (docs: https://nodejs.org/api/http.html#http_message_headers)
+        // (Express's Request class is an extension of http.IncomingMessage, and doesn't appear to be relevantly modified: https://github.com/expressjs/express/blob/master/lib/request.js#L31)
+        if (Array.isArray(encodedHeader)) {
+            throw new Error('Unexpected: An array was passed as a header, which should not be possible for the stripe-signature header.');
+        }
+        if (encodedHeader == null || encodedHeader == '') {
+            throw new StripeSignatureVerificationError(encodedHeader, encodedPayload, {
+                message: 'No stripe-signature header value was provided.',
+            });
+        }
+        const decodedHeader = encodedHeader instanceof Uint8Array
+            ? textDecoder.decode(encodedHeader)
+            : encodedHeader;
+        const details = parseHeader(decodedHeader, expectedScheme);
+        if (!details || details.timestamp === -1) {
+            throw new StripeSignatureVerificationError(decodedHeader, decodedPayload, {
+                message: 'Unable to extract timestamp and signatures from header',
+            });
+        }
+        if (!details.signatures.length) {
+            throw new StripeSignatureVerificationError(decodedHeader, decodedPayload, {
+                message: 'No signatures found with expected scheme',
+            });
+        }
+        return {
+            decodedPayload,
+            decodedHeader,
+            details,
+            suspectPayloadType,
+        };
+    }
+    function validateComputedSignature(payload, header, details, expectedSignature, tolerance, suspectPayloadType, secretContainsWhitespace, receivedAt) {
+        const signatureFound = !!details.signatures.filter(platformFunctions.secureCompare.bind(platformFunctions, expectedSignature)).length;
+        const docsLocation = '\nLearn more about webhook signing and explore webhook integration examples for various frameworks at ' +
+            'https://docs.stripe.com/webhooks/signature';
+        const whitespaceMessage = secretContainsWhitespace
+            ? '\n\nNote: The provided signing secret contains whitespace. This often indicates an extra newline or space is in the value'
+            : '';
+        if (!signatureFound) {
+            if (suspectPayloadType) {
+                throw new StripeSignatureVerificationError(header, payload, {
+                    message: 'Webhook payload must be provided as a string or a Buffer (https://nodejs.org/api/buffer.html) instance representing the _raw_ request body.' +
+                        'Payload was provided as a parsed JavaScript object instead. \n' +
+                        'Signature verification is impossible without access to the original signed material. \n' +
+                        docsLocation +
+                        '\n' +
+                        whitespaceMessage,
+                });
+            }
+            throw new StripeSignatureVerificationError(header, payload, {
+                message: 'No signatures found matching the expected signature for payload.' +
+                    ' Are you passing the raw request body you received from Stripe? \n' +
+                    ' If a webhook request is being forwarded by a third-party tool,' +
+                    ' ensure that the exact request body, including JSON formatting and new line style, is preserved.\n' +
+                    docsLocation +
+                    '\n' +
+                    whitespaceMessage,
+            });
+        }
+        const timestampAge = Math.floor((typeof receivedAt === 'number' ? receivedAt : Date.now()) / 1000) - details.timestamp;
+        if (tolerance > 0 && timestampAge > tolerance) {
+            throw new StripeSignatureVerificationError(header, payload, {
+                message: 'Timestamp outside the tolerance zone',
+            });
+        }
+        return true;
+    }
+    function parseHeader(header, scheme) {
+        if (typeof header !== 'string') {
+            return null;
+        }
+        return header.split(',').reduce((accum, item) => {
+            const kv = item.split('=');
+            if (kv[0] === 't') {
+                accum.timestamp = parseInt(kv[1], 10);
+            }
+            if (kv[0] === scheme) {
+                accum.signatures.push(kv[1]);
+            }
+            return accum;
+        }, {
+            timestamp: -1,
+            signatures: [],
+        });
+    }
+    let webhooksCryptoProviderInstance = null;
+    /**
+     * Lazily instantiate a CryptoProvider instance. This is a stateless object
+     * so a singleton can be used here.
+     */
+    function getCryptoProvider() {
+        if (!webhooksCryptoProviderInstance) {
+            webhooksCryptoProviderInstance = platformFunctions.createDefaultCryptoProvider();
+        }
+        return webhooksCryptoProviderInstance;
+    }
+    function prepareOptions(opts) {
+        if (!opts) {
+            throw new StripeError({
+                message: 'Options are required',
+            });
+        }
+        const timestamp = Math.floor(opts.timestamp) || Math.floor(Date.now() / 1000);
+        const scheme = opts.scheme || signature.EXPECTED_SCHEME;
+        const cryptoProvider = opts.cryptoProvider || getCryptoProvider();
+        const payloadString = `${timestamp}.${opts.payload}`;
+        const generateHeaderString = (signature) => {
+            return `t=${timestamp},${scheme}=${signature}`;
+        };
+        return {
+            ...opts,
+            timestamp,
+            scheme,
+            cryptoProvider,
+            payloadString,
+            generateHeaderString,
+        };
+    }
+    Webhook.signature = signature;
+    return Webhook;
+}

package/esm/apiVersion.js

@@ -0,0 +1,3 @@
+// File generated from our OpenAPI spec
+export const ApiVersion = '2026-03-25.dahlia';
+export const ApiMajorVersion = 'dahlia';