@flintpay/node 5.0.0 → 6.0.0

package/README.md

@@ -14,18 +14,15 @@ Requires Node.js 22.3+, or Node.js 22.12+ to `require()` from CommonJS. TypeScri
 
 ## Quickstart
 
-Set `API_BASE_URL` and `API_KEY` ([authentication](RUNTIME.md#authentication)), then replace the sample values with your own. Choose your sandbox or local mock URL explicitly; the API declares https://api.withflintpay.com as its default server.
+Set `API_BASE_URL` ([authentication](RUNTIME.md#authentication)) and configure default credentials as described in the authentication guide, then replace the sample values with your own. Choose your sandbox or local mock URL explicitly; the API declares https://api.withflintpay.com as its default server.
 
 ```typescript
 import { Client, SdkError } from "@flintpay/node";
 const baseUrl = process.env.API_BASE_URL;
 if (!baseUrl) throw new Error("Set API_BASE_URL to your sandbox or local mock URL");
-const apiKey = process.env.API_KEY;
-if (!apiKey) throw new Error("Set API_KEY: this call requires a credential");
 const client = new Client({
   baseUrl,
   allowInsecureHttp: ["localhost", "127.0.0.1"].includes(new URL(baseUrl).hostname) && new URL(baseUrl).protocol === "http:",
-  apiKey,
 });
 
 // Persist this key with the action before sending; reuse it for every resubmission.
@@ -118,7 +115,7 @@ List operations such as `apiKeys.list` also have `listItems` and `listPages` met
 
 ## Webhooks
 
-Verify each delivery with `client.verifyWebhook(rawBody, headers, secrets)` on the original request bytes, never re-encoded JSON. Standalone `verifyWebhook` needs no client configuration. See [verifyWebhook examples and errors](RUNTIME.md#webhooks-and-recovery).
+Verify each delivery with `await client.verifyWebhookAsync(rawBody, headers, { endpointIds })` on the original request bytes, never re-encoded JSON. Standalone verification accepts a trusted base URL and endpoint IDs; see the runtime guide. See [verifyWebhook examples and errors](RUNTIME.md#webhooks-and-recovery).
 
 ## Documentation
 
@@ -129,8 +126,9 @@ Selected methods use positional path arguments; check their signatures. Request
 - [API reference](REFERENCE.md): resource index linking to operation files under reference/
 - [Models](MODELS.md): model index, fields and descriptions
 - [Runtime guide](RUNTIME.md): request options, errors, retries, pagination and webhooks
+- [default-credentials](guides/default-credentials.md)
 - [pagination-and-retries](guides/pagination-and-retries.md)
 - [Agent index](llms.txt): a small documentation entry point
 - `examples/`: a runnable script per operation. Run `node examples/RESOURCE-METHOD.mjs`; examples are checked with TypeScript checkJs.
 
-Package 5.0.0, generated for API 2026-09-07.
+Package 6.0.0, generated for API 2026-09-07.

package/REFERENCE.md

@@ -1,6 +1,6 @@
 # Flint Public API reference
 
-Package 5.0.0; API 2026-09-07.
+Package 6.0.0; API 2026-09-07.
 
 [Models](MODELS.md) · [Runtime guide](RUNTIME.md)
 
@@ -8,6 +8,8 @@ Selected operations use positional arguments; signatures list their order. Reque
 
 ## verifyWebhook
 
+verifyWebhookAsync(rawBody, headers, options) verifies JWT or HMAC deliveries asynchronously, returning VerifiedWebhook plus signingMethod. Supply receiving endpoint IDs for JWT; synchronous verifyWebhook remains HMAC-only. See the runtime guide for options and selection.
+
 Verify original request bytes with signing headers and one secret or a rotation array. Returns { known, event }; only matched declared envelopes are known. When known is false, reason is unknown_event for undeclared names or unmatched_envelope for declared names with no matching payload. Known deliveries have no reason. The return type is `VerifiedWebhook`: checking `known` exposes `KnownWebhookEvent`, the union of the `WebhookEvent<EventName>` types exported by the root and `webhooks` subpath. Unknown events remain `unknown`; check `reason` when `known` is false. See [signatures, framework examples, and errors](RUNTIME.md#webhooks-and-recovery).
 
 ## Resources

package/RUNTIME.md

@@ -1,6 +1,6 @@
 # Flint Public API runtime guide
 
-Package 5.0.0; API 2026-09-07.
+Package 6.0.0; API 2026-09-07.
 
 [Back to the quickstart](README.md) · [API index](REFERENCE.md) · [Models](MODELS.md)
 
@@ -103,7 +103,7 @@ Credentials accept strings or CredentialProvider objects. getCredential() return
 
 Providers resolve on every request attempt; the application owns caching and expiry. A replay-safe HTTP 401 invalidates providers implementing invalidate() and retries once, adding at most one attempt beyond the ordinary budget, even with maxAttempts: 1. The idempotency key is preserved. String credentials never trigger this refresh retry. Provider exceptions become authentication errors without retaining potentially sensitive causes.
 
-This SDK does not discover credentials from environment variables. The example scripts explicitly read API_BASE_URL and their named credential variables.
+Default credential discovery is lazy: explicit credentials, then configured API key/access token environment variables (both set is ambiguous_credentials), then configured workload identity. Set ambientCredentials: false to disable it. defaultCredentials() and workloadIdentityCredentials(options) return providers supporting token, token_file and github_actions sources and cached refresh.
 
 ## Responses and errors
 
@@ -190,11 +190,14 @@ Without a declared policy, GET/HEAD/OPTIONS allow three total attempts for trans
 
 Backoff waits uniformly between half and all of baseDelayMs * 2^(attempt - 1), capped by maxDelayMs when declared. Retry-After is a minimum wait. Nonnegative decimal seconds or canonical GMT HTTP dates are accepted; malformed values are ignored. If the next wait exceeds the deadline, the last error is returned unchanged.
 
+The response field `error.remediation.retry` controls body-driven retries for declared retry values: "same_request". A string signal overrides status and code rules; otherwise statuses apply.
+
 ### Idempotency
 
 | Policy | Header | Retention | Scope |
 | --- | --- | --- | --- |
-| 1 | `Idempotency-Key` | At least 24 hours for ordinary replay records; durable command identities follow their documented resource lifetime. Never reuse for a new business intent. | Authenticated context, environment, HTTP endpoint and caller key; the canonical request fingerprint includes target resource IDs and request parameters. |
+| 1 | `Idempotency-Key` | As long as the command's effects exist. The key is the command's durable identity: save it before the first attempt and reuse it to retry or recover. Never reuse it for a new business intent. | Authenticated context, environment, HTTP endpoint and caller key; the canonical request fingerprint includes target resource IDs and request parameters. |
+| 2 | `Idempotency-Key` | At least 24 hours. A retry with the same key and request within that window returns the original result instead of repeating it; afterwards the key may run as a new request. | Authenticated context, environment, HTTP endpoint and caller key; the canonical request fingerprint includes target resource IDs and request parameters. |
 
 Only operations declaring idempotency accept idempotencyKey. Persist a key with the original input before the first attempt and reuse it for the same action. When automatic keys are enabled, the SDK creates one per call and reuses it across attempts; automatic keys do not span separate calls. Resolved keys are exposed on errors and response metadata, including not_sent failures after key resolution.
 
@@ -209,12 +212,9 @@ Use this only after reconciling the previous outcome and confirming the provider
 import { Client } from "@flintpay/node";
 const baseUrl = process.env.API_BASE_URL;
 if (!baseUrl) throw new Error("Set API_BASE_URL to your sandbox or local mock URL");
-const apiKey = process.env.API_KEY;
-if (!apiKey) throw new Error("Set API_KEY: this call requires a credential");
 const client = new Client({
   baseUrl,
   allowInsecureHttp: ["localhost", "127.0.0.1"].includes(new URL(baseUrl).hostname) && new URL(baseUrl).protocol === "http:",
-  apiKey,
 });
 const idempotencyKey = process.env.API_IDEMPOTENCY_KEY;
 if (!idempotencyKey) throw new Error("Set API_IDEMPOTENCY_KEY to the key saved with this action");
@@ -251,6 +251,27 @@ Use AbortSignal for cancellation. Unconsumed default SSE sockets and timers do n
 
 ## Webhooks and recovery
 
+### JWT delivery verification
+
+Use verifyWebhookAsync from the package root or webhooks subpath, or client.verifyWebhookAsync with the original raw body and your receiving endpoint IDs. The result adds signingMethod: 'jwt' | 'hmac' to the existing verified result.
+
+This package expects authorization: Bearer with algorithm ES256, exact typ flint-webhook+jwt, issuer from the configured API base URL origin without a trailing slash, and a matching endpoint audience. It checks iat/exp with a maximum 300-second lifetime and 60-second leeway, requires a jti that is not blank, and compares body_sha256 to the SHA-256 of the exact body in constant time before JSON parsing. The protected header must contain only alg, kid and typ, so token-supplied keys and key URLs (jku, x5u, jwk, x5c) and crit headers are rejected. Duplicate JSON members, a sub claim, a non-string aud and non-integer iat or exp are rejected; other claims are ignored.
+
+```js
+import { verifyWebhookAsync } from '@flintpay/node/webhooks';
+const verified = await verifyWebhookAsync(rawBody, headers, {
+  endpointIds: ['whep_example'],
+  baseUrl: 'https://api.example.com',
+});
+// Or await client.verifyWebhookAsync(rawBody, headers, { endpointIds: ['whep_example'] });
+```
+
+Options: endpointIds (string or string[]), secrets (string or string[]), jwks ({ keys: object[] }), baseUrl, fetch, nowSeconds. The client defaults baseUrl and fetch from its configured base URL and transport. At least one of endpoint IDs or secrets is required. Standalone calls with issuer baseUrl require baseUrl. Time overrides use Unix seconds and are intended for tests.
+
+A bearer token plus endpoint IDs always selects JWT, with no HMAC fallback on failure. Otherwise, secrets and complete HMAC headers select HMAC. Missing signing headers produce webhook_missing_header. The synchronous verifyWebhook remains HMAC-only.
+
+Trusted keys come from the issuer plus /.well-known/jwks.json. Keys whose kid differs from the token's are ignored, whatever their type; the selected key must be an EC P-256 key with alg absent or ES256 and use absent or sig, else the token fails with webhook_invalid_token. A malformed fetched set or a repeated kid produces webhook_jwks_unavailable. Explicit jwks bypasses fetching entirely. The key cache shares in-flight requests per URL. Cache-Control max-age is clamped to 300..86400 seconds (900 when absent). Unknown kid refreshes are limited to once per minute per URL; failures can use the last successful set for up to 24 hours after fetching, retrying at most once a minute. Fetches have a 5-second timeout and a 256 KiB response cap. Respond with 5xx for webhook_jwks_unavailable so the provider retries.
+
 Import verifyWebhook from the webhooks subpath to verify without client options, a base URL, API credentials or operation descriptors. The package-root export remains available. Client.verifyWebhook delegates to the same verifier. Call verifyWebhook(rawBody, headers, secrets, nowSeconds?) with original request bytes and `webhook-signature`, `webhook-timestamp`, `webhook-id`. This package uses standard-webhooks HMAC-SHA256 signing and a 300-second timestamp tolerance. Secrets must use the whsec_ prefix and canonical base64 encoding of exactly 32 key bytes. Pass one secret string or an array of active secrets during rotation. nowSeconds is an optional Unix time override in seconds for deterministic tests; normally omit it. Millisecond-scale values raise an input error explaining the conversion. Node accepts original Buffer, Uint8Array or ArrayBuffer bytes. 
 
 ### Fetch
@@ -314,6 +335,12 @@ Import SdkError from this package. SdkError uses code for these stable reasons:
 | authentication | webhook_invalid_timestamp | Supply one integer timestamp in seconds. |
 | authentication | webhook_timestamp_out_of_tolerance | Check the clock and delivery age. |
 | authentication | webhook_invalid_signature | Check the secret and original bytes. |
+| authentication | webhook_invalid_token | Reject malformed JWTs, wrong algorithm/type/issuer, signatures, or a kid naming an unusable key. |
+| authentication | webhook_invalid_audience | Check receiving endpoint IDs. |
+| authentication | webhook_token_expired | Check token timestamps, lifetime, leeway and the server clock. |
+| authentication | webhook_body_mismatch | Preserve the exact original bytes. |
+| authentication | webhook_unknown_key | The trusted set has no matching key. |
+| transport | webhook_jwks_unavailable | Keys could not be fetched, or the fetched set is malformed or repeats the token's kid. Answer 5xx so the provider retries. |
 | protocol | webhook_invalid_json | The authenticated body is not valid UTF-8 JSON. |
 
 ```js
@@ -328,7 +355,7 @@ try {
 }
 ```
 
-Never verify JSON.stringify(parsedBody): verification authenticates the original bytes, including whitespace and numeric spelling. A mismatch cannot distinguish a wrong secret from altered bytes. Repeated signature values are supported; timestamp and ID headers must each contain a single value.
+Never verify JSON.stringify(parsedBody): verification authenticates the original bytes, including whitespace and numeric spelling. Preserve raw request bytes before parsing. For HMAC, repeated signature values are supported; timestamp and ID headers must each contain a single value.
 
 known is true only for a registered event name whose payload matches a declared envelope. Authenticated unknown names return known: false with reason: unknown_event; declared names with unmatched envelopes use reason: unmatched_envelope. Known deliveries have no reason; nested response types retain their documented uncertainty. Malformed declared payloads produce a protocol error.
 
@@ -344,12 +371,9 @@ PDF results are buffered bytes. Set API_DOWNLOAD_PATH to choose the file written
 import { Client } from "@flintpay/node";
 const baseUrl = process.env.API_BASE_URL;
 if (!baseUrl) throw new Error("Set API_BASE_URL to your sandbox or local mock URL");
-const apiKey = process.env.API_KEY;
-if (!apiKey) throw new Error("Set API_KEY: this call requires a credential");
 const client = new Client({
   baseUrl,
   allowInsecureHttp: ["localhost", "127.0.0.1"].includes(new URL(baseUrl).hostname) && new URL(baseUrl).protocol === "http:",
-  apiKey,
 });
 const result = await client.creditNotes.getPDF(
   "example"

package/contract.d.ts

@@ -162,7 +162,19 @@ export interface AuthenticationMode {
     })[];
     operations?: string[];
 }
-export interface Webhook {
+export interface WebhookJwt {
+    header: string;
+    scheme: 'Bearer';
+    algorithm: 'ES256';
+    typ: string;
+    issuer: string;
+    jwksPath: string;
+    bodyHashClaim: string;
+    bodyHashEncoding: 'base64url';
+    lifetimeSeconds: number;
+    leewaySeconds: number;
+}
+export interface WebhookHmac {
     algorithm: 'hmac-sha256';
     format?: 'hex' | 'standard-webhooks' | 'timestamped-hex';
     idHeader?: string;
@@ -170,9 +182,19 @@ export interface Webhook {
     timestampHeader?: string;
     separator: string;
     toleranceSeconds: number;
+}
+export type WebhookSigning = (WebhookHmac & {
+    jwt?: WebhookJwt;
+})
+    | ({
+    jwt: WebhookJwt;
+} & {
+    [K in keyof WebhookHmac]?: never;
+});
+export type Webhook = WebhookSigning & {
     events: Record<string, Schema>;
     typeField: string;
-}
+};
 type DefaultCapability = 'idempotency' | 'retry' | 'pagination';
 export type CapabilityOverride = Omit<Capability, DefaultCapability>
     & {

package/declarations/Client.d.ts

@@ -1,12 +1,16 @@
 import type { Result, InputValue, WebhookHeaders as _SdkWebhookHeaders } from '../runtime.js';
 import type { ClientOptions } from './types-4.js';
 import type { VerifiedWebhook } from './types-50.js';
-import type { verifyWebhook } from './types-73.js';
+import type { WebhookVerificationOptions } from './types-54.js';
+import type { verifyWebhook, verifyWebhookAsync } from './types-73.js';
 /** API client; see README.md and RUNTIME.md#clientoptions. */
 export declare class Client {
     constructor(options?: ClientOptions);
     close(): Promise<void>;
     verifyWebhook(rawBody: Uint8Array | ArrayBuffer, headers: _SdkWebhookHeaders, secrets: string | readonly string[], nowSeconds?: number): VerifiedWebhook;
+    verifyWebhookAsync(rawBody: Uint8Array | ArrayBuffer, headers: _SdkWebhookHeaders, options: WebhookVerificationOptions): Promise<VerifiedWebhook & {
+        signingMethod: 'jwt' | 'hmac';
+    }>;
     readonly analytics: import('../resources/analytics.js').AnalyticsResource;
     readonly apiKeys: import('../resources/apiKeys.js').ApiKeysResource;
     readonly balanceTransactions: import('../resources/balanceTransactions.js').BalanceTransactionsResource;

package/declarations/types-20.d.ts

@@ -83,6 +83,7 @@ import type {
 import type {
     Webhook_subscription_canceled_installed_merchants,
     Webhook_subscription_canceled_merchant,
+    Webhook_return_reopened_installed_merchants,
     Webhook_return_reopened_merchant,
     Webhook_subscription_trial_ending_installed_merchants,
     Webhook_subscription_trial_ending_merchant,
@@ -106,7 +107,6 @@ import type {
     Webhook_refund_partially_succeeded_merchant,
     Webhook_return_canceled_installed_merchants,
     Webhook_return_canceled_merchant,
-    Webhook_return_reopened_installed_merchants,
     Webhook_promotion_created_installed_merchants,
     Webhook_promotion_created_merchant,
     Webhook_refund_updated_installed_merchants,

package/declarations/types-21.d.ts

@@ -35,6 +35,7 @@ import type {
     Webhook_credit_note_created_merchant,
     Webhook_customer_deletion_request_rejected_installed_merchants,
     Webhook_customer_deletion_request_rejected_merchant,
+    Webhook_checkout_session_closed_merchant,
     Webhook_delivery_method_activated_installed_merchants,
     Webhook_delivery_method_activated_merchant,
     Webhook_customer_updated_installed_merchants,
@@ -43,7 +44,6 @@ import type {
 import type {
     Webhook_payout_destination_updated_merchant,
     Webhook_payout_destination_disabled_merchant,
-    Webhook_payout_settings_updated_merchant,
     Webhook_order_partially_refunded_installed_merchants,
     Webhook_order_partially_refunded_merchant,
     Webhook_payment_method_failed_installed_merchants,
@@ -54,27 +54,6 @@ import type {
 } from './types-59.js';
 import type {
     Webhook_gift_card_notification_updated_installed_merchants,
-    Webhook_dispute_created_merchant,
-    Webhook_delivery_profile_created_installed_merchants,
-    Webhook_delivery_profile_created_merchant,
-    Webhook_gift_card_created_installed_merchants,
-    Webhook_gift_card_created_merchant,
-    Webhook_gift_card_load_updated_installed_merchants,
-    Webhook_gift_card_load_updated_merchant,
-    Webhook_fulfillment_event_created_installed_merchants,
-    Webhook_fulfillment_event_created_merchant,
-    Webhook_fulfillment_completed_installed_merchants,
-    Webhook_fulfillment_completed_merchant,
-    Webhook_delivery_rate_callback_deactivated_installed_merchants,
-    Webhook_delivery_rate_callback_deactivated_merchant,
-    Webhook_delivery_rate_callback_updated_installed_merchants,
-    Webhook_delivery_rate_callback_updated_merchant,
-    Webhook_delivery_profile_deactivated_installed_merchants,
-    Webhook_delivery_profile_deactivated_merchant,
-    Webhook_delivery_rate_callback_activated_installed_merchants,
-    Webhook_delivery_rate_callback_activated_merchant
-} from './types-56.js';
-import type {
     Webhook_gift_card_notification_updated_merchant,
     Webhook_inventory_reservation_created_installed_merchants,
     Webhook_inventory_reservation_created_merchant,
@@ -114,9 +93,31 @@ import type {
     Webhook_modifier_group_created_installed_merchants,
     Webhook_modifier_group_created_merchant
 } from './types-58.js';
+import type {
+    Webhook_dispute_created_merchant,
+    Webhook_delivery_profile_created_installed_merchants,
+    Webhook_delivery_profile_created_merchant,
+    Webhook_gift_card_created_installed_merchants,
+    Webhook_gift_card_created_merchant,
+    Webhook_gift_card_load_updated_installed_merchants,
+    Webhook_gift_card_load_updated_merchant,
+    Webhook_fulfillment_event_created_installed_merchants,
+    Webhook_fulfillment_event_created_merchant,
+    Webhook_fulfillment_completed_installed_merchants,
+    Webhook_fulfillment_completed_merchant,
+    Webhook_delivery_rate_callback_deactivated_installed_merchants,
+    Webhook_delivery_rate_callback_deactivated_merchant,
+    Webhook_delivery_rate_callback_updated_installed_merchants,
+    Webhook_delivery_rate_callback_updated_merchant,
+    Webhook_delivery_profile_deactivated_installed_merchants,
+    Webhook_delivery_profile_deactivated_merchant,
+    Webhook_delivery_rate_callback_activated_installed_merchants,
+    Webhook_delivery_rate_callback_activated_merchant
+} from './types-56.js';
 import type {
     Webhook_product_variant_updated_installed_merchants,
     Webhook_product_variant_updated_merchant,
+    Webhook_payout_settings_updated_merchant,
     Webhook_return_created_installed_merchants,
     Webhook_return_created_merchant,
     Webhook_promotion_code_archived_installed_merchants,
@@ -130,7 +131,6 @@ import type {
 } from './types-60.js';
 import type {
     Webhook_checkout_session_closed_installed_merchants,
-    Webhook_checkout_session_closed_merchant,
     Webhook_category_updated_installed_merchants,
     Webhook_category_updated_merchant
 } from './types-54.js';

package/declarations/types-22.d.ts

@@ -74,6 +74,7 @@ import type {
     Webhook_order_refunded_merchant,
     Webhook_package_updated_installed_merchants,
     Webhook_package_updated_merchant,
+    Webhook_order_inventory_exception_resolved_merchant,
     Webhook_payment_method_archived_installed_merchants,
     Webhook_payment_method_archived_merchant,
     Webhook_payment_intent_created_installed_merchants,
@@ -96,7 +97,6 @@ import type {
     Webhook_invoice_updated_installed_merchants,
     Webhook_invoice_updated_merchant,
     Webhook_order_inventory_exception_resolved_installed_merchants,
-    Webhook_order_inventory_exception_resolved_merchant,
     Webhook_invoice_sent_installed_merchants,
     Webhook_invoice_sent_merchant,
     Webhook_invoice_manual_payment_created_installed_merchants,

package/declarations/types-23.d.ts

@@ -8,6 +8,7 @@ import type {
     Webhook_dispute_updated_merchant,
     Webhook_delivery_zone_archived_installed_merchants,
     Webhook_delivery_zone_archived_merchant,
+    Webhook_delivery_profile_archived_merchant,
     Webhook_delivery_zone_created_installed_merchants,
     Webhook_delivery_zone_created_merchant,
     Webhook_dispute_needs_response_merchant,
@@ -24,7 +25,6 @@ import type {
     Webhook_customer_deletion_request_failed_installed_merchants,
     Webhook_customer_deletion_request_failed_merchant,
     Webhook_delivery_profile_archived_installed_merchants,
-    Webhook_delivery_profile_archived_merchant,
     Webhook_customer_deletion_request_processing_installed_merchants,
     Webhook_customer_deletion_request_processing_merchant,
     Webhook_checkout_session_expired_installed_merchants,
@@ -65,6 +65,7 @@ import type {
 import type {
     Webhook_invoice_refunded_installed_merchants,
     Webhook_invoice_refunded_merchant,
+    Webhook_invoice_late_fee_due_installed_merchants,
     Webhook_invoice_late_fee_due_merchant,
     Webhook_invoice_manual_payment_reversed_installed_merchants,
     Webhook_invoice_manual_payment_reversed_merchant,
@@ -86,15 +87,6 @@ import type {
     Webhook_bundle_archived_installed_merchants,
     Webhook_bundle_archived_merchant
 } from './types-54.js';
-import type {
-    Webhook_invoice_late_fee_due_installed_merchants,
-    Webhook_inventory_reservation_closed_installed_merchants,
-    Webhook_inventory_reservation_closed_merchant,
-    Webhook_inventory_reservation_hold_expired_installed_merchants,
-    Webhook_inventory_reservation_hold_expired_merchant,
-    Webhook_invoice_delivery_attempt_failed_installed_merchants,
-    Webhook_invoice_delivery_attempt_failed_merchant
-} from './types-57.js';
 import type {
     Webhook_payment_review_opened_installed_merchants,
     Webhook_payment_review_opened_merchant,
@@ -122,6 +114,14 @@ import type {
     Webhook_subscription_paused_installed_merchants,
     Webhook_subscription_paused_merchant
 } from './types-61.js';
+import type {
+    Webhook_inventory_reservation_closed_installed_merchants,
+    Webhook_inventory_reservation_closed_merchant,
+    Webhook_inventory_reservation_hold_expired_installed_merchants,
+    Webhook_inventory_reservation_hold_expired_merchant,
+    Webhook_invoice_delivery_attempt_failed_installed_merchants,
+    Webhook_invoice_delivery_attempt_failed_merchant
+} from './types-57.js';
 import type { GiftCardFundingSource, GiftCardFundingSourceInput } from './types-18.js';
 import type { MoneyValue, MoneyValueInput, ModifierRequest, ModifierRequestInput } from './types-31.js';
 import type { TextModifierConfigRequest, TextModifierConfigRequestInput } from './types-47.js';

package/declarations/types-54.d.ts

@@ -5,7 +5,7 @@ import type { ReturnReceipt } from './types-41.js';
 import type { ReturnResource, ReturnResolution } from './types-42.js';
 import type { Shipment, Subscription } from './types-44.js';
 import type { SubscriptionDeliveryMigration, SubscriptionPaymentRetry } from './types-45.js';
-import type { InputValue, EventStream } from '../runtime.js';
+import type { InputValue, EventStream, WebhookVerificationOptions as _SdkWebhookVerificationOptions } from '../runtime.js';
 import type { BalanceTransaction, Balance, Bundle } from './types-0.js';
 import type { Category } from './types-3.js';
 import type { CheckoutSession } from './types-4.js';
@@ -2730,6 +2730,7 @@ export type WebhookStreamWithheld = {
     /** Shape $ (Value): string. */
     "webhook_event_id": string;
 };
+export type WebhookVerificationOptions = _SdkWebhookVerificationOptions;
 /**
  * Shape $ (Value): {@link Webhook_balance_transaction_created_merchant}. The
  * `balance_transaction.created` webhook payload for the `merchant` event source. Fields shared by
@@ -3159,23 +3160,3 @@ export type Webhook_checkout_session_closed_installed_merchants = (Exclude<Partn
         "type": "installed_merchants" | (string & {});
     });
 });
-/**
- * Shape $ (Value): {@link Webhook_checkout_session_closed_merchant}. The `checkout_session.closed`
- * webhook payload for the `merchant` event source. Fields shared by merchant webhook payloads.
- */
-export type Webhook_checkout_session_closed_merchant = (Exclude<MerchantWebhookEnvelope & object, readonly unknown[]>)
-    & ({
-    /**
-     * Shape $ (Value): object. Shape $.object (Required): {@link CheckoutSession}. A session in
-     * which a buyer completes an order's payment.
-     */
-    "data"?: {
-        /**
-         * Shape $ (Value): {@link CheckoutSession}. A session in which a buyer completes an
-         * order's payment.
-         */
-        "object": CheckoutSession;
-    };
-    /** Shape $ (Value): string.  Value enum: "checkout_session.closed". */
-    "event_type"?: "checkout_session.closed" | (string & {});
-});

package/declarations/types-55.d.ts

@@ -1,10 +1,30 @@
 import type { CheckoutSession } from './types-4.js';
-import type { PartnerWebhookEnvelope } from './types-35.js';
 import type { MerchantWebhookEnvelope } from './types-31.js';
+import type { PartnerWebhookEnvelope } from './types-35.js';
 import type { CreditNoteAllocation, CreditNote } from './types-9.js';
 import type { CustomDomain, Customer, CustomerDeletionRequest } from './types-10.js';
 import type { DeliveryLocationSet, DeliveryMethod } from './types-12.js';
 import type { DeliveryProfile } from './types-13.js';
+/**
+ * Shape $ (Value): {@link Webhook_checkout_session_closed_merchant}. The `checkout_session.closed`
+ * webhook payload for the `merchant` event source. Fields shared by merchant webhook payloads.
+ */
+export type Webhook_checkout_session_closed_merchant = (Exclude<MerchantWebhookEnvelope & object, readonly unknown[]>)
+    & ({
+    /**
+     * Shape $ (Value): object. Shape $.object (Required): {@link CheckoutSession}. A session in
+     * which a buyer completes an order's payment.
+     */
+    "data"?: {
+        /**
+         * Shape $ (Value): {@link CheckoutSession}. A session in which a buyer completes an
+         * order's payment.
+         */
+        "object": CheckoutSession;
+    };
+    /** Shape $ (Value): string.  Value enum: "checkout_session.closed". */
+    "event_type"?: "checkout_session.closed" | (string & {});
+});
 /**
  * Shape $ (Value): {@link Webhook_checkout_session_created_installed_merchants}. The
  * `checkout_session.created` webhook payload for the `installed_merchants` event source. Fields
@@ -1930,24 +1950,3 @@ export type Webhook_delivery_profile_archived_installed_merchants = (Exclude<Par
         "type": "installed_merchants" | (string & {});
     });
 });
-/**
- * Shape $ (Value): {@link Webhook_delivery_profile_archived_merchant}. The
- * `delivery_profile.archived` webhook payload for the `merchant` event source. Fields shared by
- * merchant webhook payloads.
- */
-export type Webhook_delivery_profile_archived_merchant = (Exclude<MerchantWebhookEnvelope & object, readonly unknown[]>)
-    & ({
-    /**
-     * Shape $ (Value): object. Shape $.object (Required): {@link DeliveryProfile}. Reusable
-     * delivery rules assigned to catalog items.
-     */
-    "data"?: {
-        /**
-         * Shape $ (Value): {@link DeliveryProfile}. Reusable delivery rules assigned to catalog
-         * items.
-         */
-        "object": DeliveryProfile;
-    };
-    /** Shape $ (Value): string.  Value enum: "delivery_profile.archived". */
-    "event_type"?: "delivery_profile.archived" | (string & {});
-});

package/declarations/types-56.d.ts

@@ -1,12 +1,33 @@
 import type { DeliveryProfile } from './types-13.js';
-import type { PartnerWebhookEnvelope, PartnerEnvironmentGrant } from './types-35.js';
 import type { MerchantWebhookEnvelope } from './types-31.js';
+import type { PartnerWebhookEnvelope, PartnerEnvironmentGrant } from './types-35.js';
 import type { DeliveryRateCallback, DeliveryRevocation } from './types-14.js';
 import type { DeliverySelection, DeliveryZone } from './types-15.js';
 import type { Dispute } from './types-16.js';
 import type { FraudWarning, Fulfillment, FulfillmentEvent } from './types-17.js';
 import type { GiftCard } from './types-18.js';
 import type { GiftCardLoad, GiftCardNotification } from './types-19.js';
+/**
+ * Shape $ (Value): {@link Webhook_delivery_profile_archived_merchant}. The
+ * `delivery_profile.archived` webhook payload for the `merchant` event source. Fields shared by
+ * merchant webhook payloads.
+ */
+export type Webhook_delivery_profile_archived_merchant = (Exclude<MerchantWebhookEnvelope & object, readonly unknown[]>)
+    & ({
+    /**
+     * Shape $ (Value): object. Shape $.object (Required): {@link DeliveryProfile}. Reusable
+     * delivery rules assigned to catalog items.
+     */
+    "data"?: {
+        /**
+         * Shape $ (Value): {@link DeliveryProfile}. Reusable delivery rules assigned to catalog
+         * items.
+         */
+        "object": DeliveryProfile;
+    };
+    /** Shape $ (Value): string.  Value enum: "delivery_profile.archived". */
+    "event_type"?: "delivery_profile.archived" | (string & {});
+});
 /**
  * Shape $ (Value): {@link Webhook_delivery_profile_created_installed_merchants}. The
  * `delivery_profile.created` webhook payload for the `installed_merchants` event source. Fields
@@ -1794,43 +1815,3 @@ export type Webhook_gift_card_notification_created_merchant = (Exclude<MerchantW
     /** Shape $ (Value): string.  Value enum: "gift_card_notification.created". */
     "event_type"?: "gift_card_notification.created" | (string & {});
 });
-/**
- * Shape $ (Value): {@link Webhook_gift_card_notification_updated_installed_merchants}. The
- * `gift_card_notification.updated` webhook payload for the `installed_merchants` event source.
- * Fields shared by partner webhook payloads.
- */
-export type Webhook_gift_card_notification_updated_installed_merchants = (Exclude<PartnerWebhookEnvelope & object, readonly unknown[]>)
-    & ({
-    /**
-     * Shape $ (Value): object. Shape $.object (Required): {@link GiftCardNotification}. A message
-     * sent to a gift card recipient.
-     */
-    "data"?: {
-        /**
-         * Shape $ (Value): {@link GiftCardNotification}. A message sent to a gift card recipient.
-         */
-        "object": GiftCardNotification;
-    };
-    /** Shape $ (Value): string.  Value enum: "gift_card_notification.updated". */
-    "event_type"?: "gift_card_notification.updated" | (string & {});
-    /**
-     * Shape $ (Value): object. Shape $.environment_grant_id (Required): string. Shape
-     * $.merchant_id (Required): string. Shape $.mode (Required): string. Value enum: "test",
-     * "live". Shape $.partner_app_install_id (Required): string. Shape $.sandbox_id (Optional):
-     * string. Shape $.type (Required): string. Value enum: "installed_merchants".
-     */
-    "source"?: ({
-        /** Shape $ (Value): string. */
-        "environment_grant_id": string;
-        /** Shape $ (Value): string. */
-        "merchant_id": string;
-        /** Shape $ (Value): string.  Value enum: "test", "live". */
-        "mode": "test" | "live" | (string & {});
-        /** Shape $ (Value): string. */
-        "partner_app_install_id": string;
-        /** Shape $ (Value): string. */
-        "sandbox_id"?: string;
-        /** Shape $ (Value): string.  Value enum: "installed_merchants". */
-        "type": "installed_merchants" | (string & {});
-    });
-});