@keystrokehq/ramp 0.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (107) hide show
  1. package/README.md +149 -0
  2. package/dist/_official/index.d.mts +3 -0
  3. package/dist/_official/index.mjs +3 -0
  4. package/dist/_runtime/index.d.mts +1 -0
  5. package/dist/_runtime/index.mjs +1 -0
  6. package/dist/accounting-fields.d.mts +116 -0
  7. package/dist/accounting-fields.mjs +108 -0
  8. package/dist/accounting-gl-accounts.d.mts +63 -0
  9. package/dist/accounting-gl-accounts.mjs +49 -0
  10. package/dist/accounting-i6txC-MI.mjs +116 -0
  11. package/dist/accounting-subsidiaries.d.mts +59 -0
  12. package/dist/accounting-subsidiaries.mjs +49 -0
  13. package/dist/accounting-sync.d.mts +57 -0
  14. package/dist/accounting-sync.mjs +51 -0
  15. package/dist/accounting-tracking-categories.d.mts +36 -0
  16. package/dist/accounting-tracking-categories.mjs +34 -0
  17. package/dist/accounting-vendors.d.mts +62 -0
  18. package/dist/accounting-vendors.mjs +49 -0
  19. package/dist/applications.d.mts +59 -0
  20. package/dist/applications.mjs +35 -0
  21. package/dist/bills-B8W9et3K.mjs +86 -0
  22. package/dist/bills.d.mts +381 -0
  23. package/dist/bills.mjs +134 -0
  24. package/dist/business-CztnWUvt.mjs +83 -0
  25. package/dist/business.d.mts +28 -0
  26. package/dist/business.mjs +20 -0
  27. package/dist/card-programs.d.mts +90 -0
  28. package/dist/card-programs.mjs +50 -0
  29. package/dist/cards-BfgPcR38.mjs +153 -0
  30. package/dist/cards.d.mts +287 -0
  31. package/dist/cards.mjs +166 -0
  32. package/dist/cashbacks.d.mts +46 -0
  33. package/dist/cashbacks.mjs +34 -0
  34. package/dist/client.d.mts +79 -0
  35. package/dist/client.mjs +248 -0
  36. package/dist/common-CUpmNYXw.mjs +64 -0
  37. package/dist/connection.d.mts +2 -0
  38. package/dist/connection.mjs +3 -0
  39. package/dist/departments.d.mts +63 -0
  40. package/dist/departments.mjs +79 -0
  41. package/dist/entities.d.mts +38 -0
  42. package/dist/entities.mjs +34 -0
  43. package/dist/errors-Sm92tugz.d.mts +42 -0
  44. package/dist/events.d.mts +30 -0
  45. package/dist/events.mjs +39 -0
  46. package/dist/factory-Da6YVHdL.mjs +15 -0
  47. package/dist/index.d.mts +1 -0
  48. package/dist/index.mjs +1 -0
  49. package/dist/integration-BGliAxAS.mjs +124 -0
  50. package/dist/integration-Dd6tOtSy.d.mts +47 -0
  51. package/dist/limits.d.mts +179 -0
  52. package/dist/limits.mjs +84 -0
  53. package/dist/locations.d.mts +69 -0
  54. package/dist/locations.mjs +80 -0
  55. package/dist/memos.d.mts +42 -0
  56. package/dist/memos.mjs +36 -0
  57. package/dist/messaging.d.mts +1 -0
  58. package/dist/messaging.mjs +1 -0
  59. package/dist/new-resources-BBJsJEjT.mjs +77 -0
  60. package/dist/organization-BSaEpvBn.mjs +103 -0
  61. package/dist/provider-app-JO525h-N.d.mts +45 -0
  62. package/dist/purchase-orders.d.mts +75 -0
  63. package/dist/purchase-orders.mjs +36 -0
  64. package/dist/receipt-integrations.d.mts +31 -0
  65. package/dist/receipt-integrations.mjs +38 -0
  66. package/dist/receipts-STq41c2M.mjs +53 -0
  67. package/dist/receipts.d.mts +62 -0
  68. package/dist/receipts.mjs +61 -0
  69. package/dist/reimbursements-OknrZUMF.mjs +37 -0
  70. package/dist/reimbursements.d.mts +89 -0
  71. package/dist/reimbursements.mjs +39 -0
  72. package/dist/schemas/index.d.mts +887 -0
  73. package/dist/schemas/index.mjs +56 -0
  74. package/dist/shared-CTTtP5gv.mjs +24 -0
  75. package/dist/spend-programs.d.mts +48 -0
  76. package/dist/spend-programs.mjs +34 -0
  77. package/dist/spend-requests.d.mts +95 -0
  78. package/dist/spend-requests.mjs +53 -0
  79. package/dist/statements.d.mts +41 -0
  80. package/dist/statements.mjs +37 -0
  81. package/dist/transactions-Djd0oIGK.mjs +53 -0
  82. package/dist/transactions.d.mts +181 -0
  83. package/dist/transactions.mjs +81 -0
  84. package/dist/transfers-WBQZVdGP.mjs +40 -0
  85. package/dist/transfers.d.mts +72 -0
  86. package/dist/transfers.mjs +36 -0
  87. package/dist/triggers/index.d.mts +81 -0
  88. package/dist/triggers/index.mjs +199 -0
  89. package/dist/unified-requests.d.mts +67 -0
  90. package/dist/unified-requests.mjs +37 -0
  91. package/dist/users-ufcXrfNK.mjs +74 -0
  92. package/dist/users.d.mts +204 -0
  93. package/dist/users.mjs +101 -0
  94. package/dist/vendor-bank-accounts.d.mts +110 -0
  95. package/dist/vendor-bank-accounts.mjs +83 -0
  96. package/dist/vendors-B7DQrlAn.d.mts +1116 -0
  97. package/dist/vendors-Bx1cgXwC.mjs +83 -0
  98. package/dist/vendors.d.mts +116 -0
  99. package/dist/vendors.mjs +84 -0
  100. package/dist/verification.d.mts +22 -0
  101. package/dist/verification.mjs +38 -0
  102. package/dist/webhook-CsbvcgrC.mjs +61 -0
  103. package/dist/webhook-sde3Ui2N.d.mts +68 -0
  104. package/dist/webhooks-mgmt-d1xgVpWx.mjs +35 -0
  105. package/dist/webhooks.d.mts +83 -0
  106. package/dist/webhooks.mjs +81 -0
  107. package/package.json +222 -0
@@ -0,0 +1,83 @@
1
+ import { a as rampListPaginationInputSchema, f as rampTimestampSchema, i as rampIdSchema, o as rampListResponseSchema } from "./common-CUpmNYXw.mjs";
2
+ import { z } from "zod";
3
+
4
+ //#region src/schemas/vendors.ts
5
+ const rampVendorSchema = z.object({
6
+ id: rampIdSchema,
7
+ name: z.string().optional(),
8
+ email: z.string().optional(),
9
+ phone: z.string().optional(),
10
+ description: z.string().optional(),
11
+ tax_id: z.string().optional(),
12
+ contact_name: z.string().optional(),
13
+ website: z.string().optional(),
14
+ address: z.record(z.string(), z.string()).optional(),
15
+ created_at: rampTimestampSchema.optional(),
16
+ updated_at: rampTimestampSchema.optional()
17
+ }).passthrough();
18
+ const rampVendorListInputSchema = z.object({
19
+ name: z.string().optional(),
20
+ email: z.string().optional()
21
+ }).merge(rampListPaginationInputSchema);
22
+ const rampVendorListSchema = rampListResponseSchema(rampVendorSchema);
23
+ const rampVendorGetInputSchema = z.object({ vendorId: rampIdSchema });
24
+ const rampVendorCreateInputSchema = z.object({
25
+ name: z.string().trim().min(1),
26
+ email: z.string().trim().min(1).optional(),
27
+ phone: z.string().optional(),
28
+ description: z.string().optional(),
29
+ tax_id: z.string().optional(),
30
+ contact_name: z.string().optional(),
31
+ website: z.string().optional(),
32
+ address: z.record(z.string(), z.string()).optional(),
33
+ idempotency_key: z.string().trim().min(1).optional()
34
+ });
35
+ const rampVendorUpdateInputSchema = z.object({
36
+ vendorId: rampIdSchema,
37
+ name: z.string().optional(),
38
+ email: z.string().optional(),
39
+ phone: z.string().optional(),
40
+ description: z.string().optional(),
41
+ tax_id: z.string().optional(),
42
+ contact_name: z.string().optional(),
43
+ website: z.string().optional(),
44
+ address: z.record(z.string(), z.string()).optional()
45
+ });
46
+ const rampVendorDeleteInputSchema = z.object({ vendorId: rampIdSchema });
47
+ const rampVendorBankAccountSchema = z.object({
48
+ id: rampIdSchema,
49
+ vendor_id: rampIdSchema.optional(),
50
+ account_name: z.string().optional(),
51
+ account_type: z.string().optional(),
52
+ country_code: z.string().optional(),
53
+ bank_name: z.string().optional(),
54
+ account_number_last_four: z.string().optional(),
55
+ routing_number_last_four: z.string().optional(),
56
+ currency_code: z.string().optional(),
57
+ is_default: z.boolean().optional(),
58
+ created_at: rampTimestampSchema.optional()
59
+ }).passthrough();
60
+ const rampVendorBankAccountListInputSchema = z.object({ vendor_id: rampIdSchema.optional() }).merge(rampListPaginationInputSchema);
61
+ const rampVendorBankAccountListSchema = rampListResponseSchema(rampVendorBankAccountSchema);
62
+ const rampVendorBankAccountGetInputSchema = z.object({ vendorBankAccountId: rampIdSchema });
63
+ const rampVendorBankAccountCreateInputSchema = z.object({
64
+ vendor_id: rampIdSchema,
65
+ account_name: z.string().trim().min(1),
66
+ account_type: z.string().trim().min(1),
67
+ country_code: z.string().trim().length(2).toUpperCase(),
68
+ bank_name: z.string().optional(),
69
+ account_number: z.string().trim().min(1),
70
+ routing_number: z.string().optional(),
71
+ currency_code: z.string().trim().length(3).optional(),
72
+ is_default: z.boolean().optional(),
73
+ idempotency_key: z.string().trim().min(1).optional()
74
+ });
75
+ const rampVendorBankAccountUpdateInputSchema = z.object({
76
+ vendorBankAccountId: rampIdSchema,
77
+ account_name: z.string().optional(),
78
+ is_default: z.boolean().optional()
79
+ });
80
+ const rampVendorBankAccountDeleteInputSchema = z.object({ vendorBankAccountId: rampIdSchema });
81
+
82
+ //#endregion
83
+ export { rampVendorBankAccountListSchema as a, rampVendorCreateInputSchema as c, rampVendorListInputSchema as d, rampVendorListSchema as f, rampVendorBankAccountListInputSchema as i, rampVendorDeleteInputSchema as l, rampVendorUpdateInputSchema as m, rampVendorBankAccountDeleteInputSchema as n, rampVendorBankAccountSchema as o, rampVendorSchema as p, rampVendorBankAccountGetInputSchema as r, rampVendorBankAccountUpdateInputSchema as s, rampVendorBankAccountCreateInputSchema as t, rampVendorGetInputSchema as u };
@@ -0,0 +1,116 @@
1
+ import { z } from "zod";
2
+ import * as _keystrokehq_core0 from "@keystrokehq/core";
3
+ import * as _keystrokehq_core_credential_set0 from "@keystrokehq/core/credential-set";
4
+
5
+ //#region src/vendors.d.ts
6
+ declare const listVendors: _keystrokehq_core0.Operation<z.ZodObject<{
7
+ name: z.ZodOptional<z.ZodString>;
8
+ email: z.ZodOptional<z.ZodString>;
9
+ pageSize: z.ZodOptional<z.ZodNumber>;
10
+ cursor: z.ZodOptional<z.ZodString>;
11
+ }, z.core.$strip>, z.ZodObject<{
12
+ data: z.ZodArray<z.ZodObject<{
13
+ id: z.ZodString;
14
+ name: z.ZodOptional<z.ZodString>;
15
+ email: z.ZodOptional<z.ZodString>;
16
+ phone: z.ZodOptional<z.ZodString>;
17
+ description: z.ZodOptional<z.ZodString>;
18
+ tax_id: z.ZodOptional<z.ZodString>;
19
+ contact_name: z.ZodOptional<z.ZodString>;
20
+ website: z.ZodOptional<z.ZodString>;
21
+ address: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
22
+ created_at: z.ZodOptional<z.ZodString>;
23
+ updated_at: z.ZodOptional<z.ZodString>;
24
+ }, z.core.$loose>>;
25
+ page: z.ZodOptional<z.ZodObject<{
26
+ next: z.ZodOptional<z.ZodString>;
27
+ }, z.core.$strip>>;
28
+ }, z.core.$strip>, readonly [_keystrokehq_core0.CredentialSet<"ramp", z.ZodObject<{
29
+ RAMP_ACCESS_TOKEN: z.ZodString;
30
+ }, z.core.$strip>, readonly _keystrokehq_core_credential_set0.CredentialConnection<z.ZodObject<{
31
+ RAMP_ACCESS_TOKEN: z.ZodString;
32
+ }, z.core.$strip>>[] | undefined>], undefined>;
33
+ declare const getVendor: _keystrokehq_core0.Operation<z.ZodObject<{
34
+ vendorId: z.ZodString;
35
+ }, z.core.$strip>, z.ZodObject<{
36
+ id: z.ZodString;
37
+ name: z.ZodOptional<z.ZodString>;
38
+ email: z.ZodOptional<z.ZodString>;
39
+ phone: z.ZodOptional<z.ZodString>;
40
+ description: z.ZodOptional<z.ZodString>;
41
+ tax_id: z.ZodOptional<z.ZodString>;
42
+ contact_name: z.ZodOptional<z.ZodString>;
43
+ website: z.ZodOptional<z.ZodString>;
44
+ address: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
45
+ created_at: z.ZodOptional<z.ZodString>;
46
+ updated_at: z.ZodOptional<z.ZodString>;
47
+ }, z.core.$loose>, readonly [_keystrokehq_core0.CredentialSet<"ramp", z.ZodObject<{
48
+ RAMP_ACCESS_TOKEN: z.ZodString;
49
+ }, z.core.$strip>, readonly _keystrokehq_core_credential_set0.CredentialConnection<z.ZodObject<{
50
+ RAMP_ACCESS_TOKEN: z.ZodString;
51
+ }, z.core.$strip>>[] | undefined>], undefined>;
52
+ declare const createVendor: _keystrokehq_core0.Operation<z.ZodObject<{
53
+ name: z.ZodString;
54
+ email: z.ZodOptional<z.ZodString>;
55
+ phone: z.ZodOptional<z.ZodString>;
56
+ description: z.ZodOptional<z.ZodString>;
57
+ tax_id: z.ZodOptional<z.ZodString>;
58
+ contact_name: z.ZodOptional<z.ZodString>;
59
+ website: z.ZodOptional<z.ZodString>;
60
+ address: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
61
+ idempotency_key: z.ZodOptional<z.ZodString>;
62
+ }, z.core.$strip>, z.ZodObject<{
63
+ id: z.ZodString;
64
+ name: z.ZodOptional<z.ZodString>;
65
+ email: z.ZodOptional<z.ZodString>;
66
+ phone: z.ZodOptional<z.ZodString>;
67
+ description: z.ZodOptional<z.ZodString>;
68
+ tax_id: z.ZodOptional<z.ZodString>;
69
+ contact_name: z.ZodOptional<z.ZodString>;
70
+ website: z.ZodOptional<z.ZodString>;
71
+ address: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
72
+ created_at: z.ZodOptional<z.ZodString>;
73
+ updated_at: z.ZodOptional<z.ZodString>;
74
+ }, z.core.$loose>, readonly [_keystrokehq_core0.CredentialSet<"ramp", z.ZodObject<{
75
+ RAMP_ACCESS_TOKEN: z.ZodString;
76
+ }, z.core.$strip>, readonly _keystrokehq_core_credential_set0.CredentialConnection<z.ZodObject<{
77
+ RAMP_ACCESS_TOKEN: z.ZodString;
78
+ }, z.core.$strip>>[] | undefined>], undefined>;
79
+ declare const updateVendor: _keystrokehq_core0.Operation<z.ZodObject<{
80
+ vendorId: z.ZodString;
81
+ name: z.ZodOptional<z.ZodString>;
82
+ email: z.ZodOptional<z.ZodString>;
83
+ phone: z.ZodOptional<z.ZodString>;
84
+ description: z.ZodOptional<z.ZodString>;
85
+ tax_id: z.ZodOptional<z.ZodString>;
86
+ contact_name: z.ZodOptional<z.ZodString>;
87
+ website: z.ZodOptional<z.ZodString>;
88
+ address: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
89
+ }, z.core.$strip>, z.ZodObject<{
90
+ id: z.ZodString;
91
+ name: z.ZodOptional<z.ZodString>;
92
+ email: z.ZodOptional<z.ZodString>;
93
+ phone: z.ZodOptional<z.ZodString>;
94
+ description: z.ZodOptional<z.ZodString>;
95
+ tax_id: z.ZodOptional<z.ZodString>;
96
+ contact_name: z.ZodOptional<z.ZodString>;
97
+ website: z.ZodOptional<z.ZodString>;
98
+ address: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
99
+ created_at: z.ZodOptional<z.ZodString>;
100
+ updated_at: z.ZodOptional<z.ZodString>;
101
+ }, z.core.$loose>, readonly [_keystrokehq_core0.CredentialSet<"ramp", z.ZodObject<{
102
+ RAMP_ACCESS_TOKEN: z.ZodString;
103
+ }, z.core.$strip>, readonly _keystrokehq_core_credential_set0.CredentialConnection<z.ZodObject<{
104
+ RAMP_ACCESS_TOKEN: z.ZodString;
105
+ }, z.core.$strip>>[] | undefined>], undefined>;
106
+ declare const deleteVendor: _keystrokehq_core0.Operation<z.ZodObject<{
107
+ vendorId: z.ZodString;
108
+ }, z.core.$strip>, z.ZodObject<{
109
+ success: z.ZodBoolean;
110
+ }, z.core.$strip>, readonly [_keystrokehq_core0.CredentialSet<"ramp", z.ZodObject<{
111
+ RAMP_ACCESS_TOKEN: z.ZodString;
112
+ }, z.core.$strip>, readonly _keystrokehq_core_credential_set0.CredentialConnection<z.ZodObject<{
113
+ RAMP_ACCESS_TOKEN: z.ZodString;
114
+ }, z.core.$strip>>[] | undefined>], undefined>;
115
+ //#endregion
116
+ export { createVendor, deleteVendor, getVendor, listVendors, updateVendor };
@@ -0,0 +1,84 @@
1
+ import { createRampClient } from "./client.mjs";
2
+ import { c as rampVendorCreateInputSchema, d as rampVendorListInputSchema, f as rampVendorListSchema, l as rampVendorDeleteInputSchema, m as rampVendorUpdateInputSchema, p as rampVendorSchema, u as rampVendorGetInputSchema } from "./vendors-Bx1cgXwC.mjs";
3
+ import { t as rampOperation } from "./factory-Da6YVHdL.mjs";
4
+ import { t as omitUndefined } from "./shared-CTTtP5gv.mjs";
5
+ import { z } from "zod";
6
+
7
+ //#region src/vendors.ts
8
+ const listVendors = rampOperation({
9
+ id: "list_vendors",
10
+ name: "List Vendors",
11
+ description: "List Ramp vendors, optionally filtered by name or email.",
12
+ input: rampVendorListInputSchema,
13
+ output: rampVendorListSchema,
14
+ run: async (input, credentials) => {
15
+ const client = createRampClient(credentials);
16
+ const query = omitUndefined({
17
+ name: input.name,
18
+ email: input.email,
19
+ page_size: input.pageSize,
20
+ start: input.cursor
21
+ });
22
+ return rampVendorListSchema.parse(await client.request("/vendors", { query }));
23
+ }
24
+ });
25
+ const getVendor = rampOperation({
26
+ id: "get_vendor",
27
+ name: "Get Vendor",
28
+ description: "Fetch a Ramp vendor by id.",
29
+ input: rampVendorGetInputSchema,
30
+ output: rampVendorSchema,
31
+ run: async (input, credentials) => {
32
+ const client = createRampClient(credentials);
33
+ return rampVendorSchema.parse(await client.request(`/vendors/${encodeURIComponent(input.vendorId)}`));
34
+ }
35
+ });
36
+ const createVendor = rampOperation({
37
+ id: "create_vendor",
38
+ name: "Create Vendor",
39
+ description: "Create a new Ramp vendor record.",
40
+ input: rampVendorCreateInputSchema,
41
+ output: rampVendorSchema,
42
+ needsApproval: true,
43
+ run: async (input, credentials) => {
44
+ const client = createRampClient(credentials);
45
+ const { idempotency_key, ...body } = input;
46
+ return rampVendorSchema.parse(await client.request("/vendors", {
47
+ method: "POST",
48
+ body,
49
+ ...idempotency_key !== void 0 ? { idempotencyKey: idempotency_key } : {}
50
+ }));
51
+ }
52
+ });
53
+ const updateVendor = rampOperation({
54
+ id: "update_vendor",
55
+ name: "Update Vendor",
56
+ description: "Update editable fields on an existing Ramp vendor.",
57
+ input: rampVendorUpdateInputSchema,
58
+ output: rampVendorSchema,
59
+ needsApproval: true,
60
+ run: async (input, credentials) => {
61
+ const client = createRampClient(credentials);
62
+ const { vendorId, ...body } = input;
63
+ await client.request(`/vendors/${encodeURIComponent(vendorId)}`, {
64
+ method: "PATCH",
65
+ body: omitUndefined(body)
66
+ });
67
+ return rampVendorSchema.parse(await client.request(`/vendors/${encodeURIComponent(vendorId)}`));
68
+ }
69
+ });
70
+ const deleteVendor = rampOperation({
71
+ id: "delete_vendor",
72
+ name: "Delete Vendor",
73
+ description: "Delete a Ramp vendor by id.",
74
+ input: rampVendorDeleteInputSchema,
75
+ output: z.object({ success: z.boolean() }),
76
+ needsApproval: true,
77
+ run: async (input, credentials) => {
78
+ await createRampClient(credentials).request(`/vendors/${encodeURIComponent(input.vendorId)}`, { method: "DELETE" });
79
+ return { success: true };
80
+ }
81
+ });
82
+
83
+ //#endregion
84
+ export { createVendor, deleteVendor, getVendor, listVendors, updateVendor };
@@ -0,0 +1,22 @@
1
+ import { WebhookRequest } from "@keystrokehq/core";
2
+
3
+ //#region src/verification.d.ts
4
+ /**
5
+ * Canonical Ramp webhook signature computation.
6
+ *
7
+ * Ramp signs the raw request body with HMAC-SHA256 using the webhook secret.
8
+ * The hex digest is sent in the `X-Ramp-Signature` header with no prefix.
9
+ * There is NO signed timestamp — each delivery is signed on body only.
10
+ */
11
+ declare function buildRampWebhookSignature(rawBody: string, webhookSecret: string): string;
12
+ declare function verifyRampWebhookRequest(request: Pick<WebhookRequest, 'headers' | 'rawBody'>, webhookSecret: string): boolean;
13
+ /**
14
+ * URL-validation handshake response builder. When Ramp POSTs a
15
+ * `{ "challenge": "<value>" }` payload to a newly-registered endpoint,
16
+ * handlers must echo the same field back so that Ramp can enable delivery.
17
+ */
18
+ declare function buildRampWebhookChallengeResponse(challenge: string): {
19
+ challenge: string;
20
+ };
21
+ //#endregion
22
+ export { buildRampWebhookChallengeResponse, buildRampWebhookSignature, verifyRampWebhookRequest };
@@ -0,0 +1,38 @@
1
+ import { n as RAMP_WEBHOOK_SIGNATURE_HEADER } from "./webhook-CsbvcgrC.mjs";
2
+ import { createHmac, timingSafeEqual } from "node:crypto";
3
+
4
+ //#region src/verification.ts
5
+ /**
6
+ * Canonical Ramp webhook signature computation.
7
+ *
8
+ * Ramp signs the raw request body with HMAC-SHA256 using the webhook secret.
9
+ * The hex digest is sent in the `X-Ramp-Signature` header with no prefix.
10
+ * There is NO signed timestamp — each delivery is signed on body only.
11
+ */
12
+ function buildRampWebhookSignature(rawBody, webhookSecret) {
13
+ return createHmac("sha256", webhookSecret).update(rawBody, "utf8").digest("hex");
14
+ }
15
+ function toBuffer(value) {
16
+ return Buffer.from(value, "utf8");
17
+ }
18
+ function verifyRampWebhookRequest(request, webhookSecret) {
19
+ const headers = request.headers ?? {};
20
+ const signature = headers[RAMP_WEBHOOK_SIGNATURE_HEADER] ?? headers[RAMP_WEBHOOK_SIGNATURE_HEADER.toUpperCase()] ?? headers["X-Ramp-Signature"];
21
+ if (!signature) return false;
22
+ const expected = buildRampWebhookSignature(request.rawBody ?? "", webhookSecret);
23
+ const providedBuffer = toBuffer(signature);
24
+ const expectedBuffer = toBuffer(expected);
25
+ if (providedBuffer.length !== expectedBuffer.length) return false;
26
+ return timingSafeEqual(providedBuffer, expectedBuffer);
27
+ }
28
+ /**
29
+ * URL-validation handshake response builder. When Ramp POSTs a
30
+ * `{ "challenge": "<value>" }` payload to a newly-registered endpoint,
31
+ * handlers must echo the same field back so that Ramp can enable delivery.
32
+ */
33
+ function buildRampWebhookChallengeResponse(challenge) {
34
+ return { challenge };
35
+ }
36
+
37
+ //#endregion
38
+ export { buildRampWebhookChallengeResponse, buildRampWebhookSignature, verifyRampWebhookRequest };
@@ -0,0 +1,61 @@
1
+ import { f as rampTimestampSchema, i as rampIdSchema } from "./common-CUpmNYXw.mjs";
2
+ import { z } from "zod";
3
+
4
+ //#region src/schemas/webhook.ts
5
+ /**
6
+ * Ramp webhook envelope (verified against current docs as of 2026-04-17).
7
+ *
8
+ * {
9
+ * "id": "<delivery id>",
10
+ * "type": "transactions.authorized",
11
+ * "created_at": "2024-01-01T00:00:00Z",
12
+ * "business_id": "<business id>",
13
+ * "object": { "id": "<resource id>" }
14
+ * }
15
+ *
16
+ * The `object` field only contains `{ id }` — downstream consumers must fetch
17
+ * the full resource themselves. This is intentional on Ramp's side and
18
+ * matches the pattern used by other finance providers (e.g. Stripe retrieves).
19
+ */
20
+ const rampWebhookObjectSchema = z.object({ id: rampIdSchema });
21
+ const rampWebhookEventEnvelopeSchema = z.object({
22
+ id: rampIdSchema,
23
+ type: z.string().trim().min(1),
24
+ created_at: rampTimestampSchema,
25
+ business_id: rampIdSchema,
26
+ object: rampWebhookObjectSchema
27
+ });
28
+ /**
29
+ * URL-validation handshake payload. Ramp POSTs this when you register a new
30
+ * endpoint; the subscriber must echo the challenge back as
31
+ * `{ "challenge": "<value>" }`.
32
+ */
33
+ const rampWebhookChallengeSchema = z.object({ challenge: z.string().trim().min(1) });
34
+ /**
35
+ * Documented webhook event catalog (verified 2026-04-17).
36
+ *
37
+ * Only list events that Ramp currently publishes in its developer docs.
38
+ * Operations/triggers MUST NOT add undocumented events to this list.
39
+ */
40
+ const RAMP_DOCUMENTED_WEBHOOK_EVENT_TYPES = [
41
+ "transactions.authorized",
42
+ "transactions.cleared",
43
+ "transactions.declined",
44
+ "transactions.updated",
45
+ "bills.approved",
46
+ "bills.paid",
47
+ "bills.created",
48
+ "bills.canceled",
49
+ "purchase_orders.created",
50
+ "purchase_orders.approved",
51
+ "purchase_orders.denied",
52
+ "spend_requests.comment_created",
53
+ "applications.approved",
54
+ "applications.denied",
55
+ "unified_requests.updated"
56
+ ];
57
+ const rampDocumentedWebhookEventTypeSchema = z.enum(RAMP_DOCUMENTED_WEBHOOK_EVENT_TYPES);
58
+ const RAMP_WEBHOOK_SIGNATURE_HEADER = "x-ramp-signature";
59
+
60
+ //#endregion
61
+ export { rampWebhookEventEnvelopeSchema as a, rampWebhookChallengeSchema as i, RAMP_WEBHOOK_SIGNATURE_HEADER as n, rampWebhookObjectSchema as o, rampDocumentedWebhookEventTypeSchema as r, RAMP_DOCUMENTED_WEBHOOK_EVENT_TYPES as t };
@@ -0,0 +1,68 @@
1
+ import { z } from "zod";
2
+
3
+ //#region src/schemas/webhook.d.ts
4
+ /**
5
+ * Ramp webhook envelope (verified against current docs as of 2026-04-17).
6
+ *
7
+ * {
8
+ * "id": "<delivery id>",
9
+ * "type": "transactions.authorized",
10
+ * "created_at": "2024-01-01T00:00:00Z",
11
+ * "business_id": "<business id>",
12
+ * "object": { "id": "<resource id>" }
13
+ * }
14
+ *
15
+ * The `object` field only contains `{ id }` — downstream consumers must fetch
16
+ * the full resource themselves. This is intentional on Ramp's side and
17
+ * matches the pattern used by other finance providers (e.g. Stripe retrieves).
18
+ */
19
+ declare const rampWebhookObjectSchema: z.ZodObject<{
20
+ id: z.ZodString;
21
+ }, z.core.$strip>;
22
+ declare const rampWebhookEventEnvelopeSchema: z.ZodObject<{
23
+ id: z.ZodString;
24
+ type: z.ZodString;
25
+ created_at: z.ZodString;
26
+ business_id: z.ZodString;
27
+ object: z.ZodObject<{
28
+ id: z.ZodString;
29
+ }, z.core.$strip>;
30
+ }, z.core.$strip>;
31
+ type RampWebhookEventEnvelope = z.infer<typeof rampWebhookEventEnvelopeSchema>;
32
+ /**
33
+ * URL-validation handshake payload. Ramp POSTs this when you register a new
34
+ * endpoint; the subscriber must echo the challenge back as
35
+ * `{ "challenge": "<value>" }`.
36
+ */
37
+ declare const rampWebhookChallengeSchema: z.ZodObject<{
38
+ challenge: z.ZodString;
39
+ }, z.core.$strip>;
40
+ type RampWebhookChallenge = z.infer<typeof rampWebhookChallengeSchema>;
41
+ /**
42
+ * Documented webhook event catalog (verified 2026-04-17).
43
+ *
44
+ * Only list events that Ramp currently publishes in its developer docs.
45
+ * Operations/triggers MUST NOT add undocumented events to this list.
46
+ */
47
+ declare const RAMP_DOCUMENTED_WEBHOOK_EVENT_TYPES: readonly ["transactions.authorized", "transactions.cleared", "transactions.declined", "transactions.updated", "bills.approved", "bills.paid", "bills.created", "bills.canceled", "purchase_orders.created", "purchase_orders.approved", "purchase_orders.denied", "spend_requests.comment_created", "applications.approved", "applications.denied", "unified_requests.updated"];
48
+ declare const rampDocumentedWebhookEventTypeSchema: z.ZodEnum<{
49
+ "transactions.authorized": "transactions.authorized";
50
+ "transactions.cleared": "transactions.cleared";
51
+ "transactions.declined": "transactions.declined";
52
+ "transactions.updated": "transactions.updated";
53
+ "bills.approved": "bills.approved";
54
+ "bills.paid": "bills.paid";
55
+ "bills.created": "bills.created";
56
+ "bills.canceled": "bills.canceled";
57
+ "purchase_orders.created": "purchase_orders.created";
58
+ "purchase_orders.approved": "purchase_orders.approved";
59
+ "purchase_orders.denied": "purchase_orders.denied";
60
+ "spend_requests.comment_created": "spend_requests.comment_created";
61
+ "applications.approved": "applications.approved";
62
+ "applications.denied": "applications.denied";
63
+ "unified_requests.updated": "unified_requests.updated";
64
+ }>;
65
+ type RampDocumentedWebhookEventType = z.infer<typeof rampDocumentedWebhookEventTypeSchema>;
66
+ declare const RAMP_WEBHOOK_SIGNATURE_HEADER = "x-ramp-signature";
67
+ //#endregion
68
+ export { RampWebhookEventEnvelope as a, rampWebhookEventEnvelopeSchema as c, RampWebhookChallenge as i, rampWebhookObjectSchema as l, RAMP_WEBHOOK_SIGNATURE_HEADER as n, rampDocumentedWebhookEventTypeSchema as o, RampDocumentedWebhookEventType as r, rampWebhookChallengeSchema as s, RAMP_DOCUMENTED_WEBHOOK_EVENT_TYPES as t };
@@ -0,0 +1,35 @@
1
+ import { a as rampListPaginationInputSchema, f as rampTimestampSchema, i as rampIdSchema, o as rampListResponseSchema } from "./common-CUpmNYXw.mjs";
2
+ import { z } from "zod";
3
+
4
+ //#region src/schemas/webhooks-mgmt.ts
5
+ /**
6
+ * Schemas for Ramp's webhook subscription management endpoints
7
+ * (`POST /developer/v1/webhooks`, etc.) — distinct from the webhook envelope
8
+ * schemas in `./webhook.ts`.
9
+ */
10
+ const rampWebhookSubscriptionSchema = z.object({
11
+ id: rampIdSchema,
12
+ url: z.string(),
13
+ is_active: z.boolean().optional(),
14
+ enabled_events: z.array(z.string()).optional(),
15
+ created_at: rampTimestampSchema.optional(),
16
+ updated_at: rampTimestampSchema.optional()
17
+ }).passthrough();
18
+ const rampWebhookSubscriptionListInputSchema = rampListPaginationInputSchema;
19
+ const rampWebhookSubscriptionListSchema = rampListResponseSchema(rampWebhookSubscriptionSchema);
20
+ const rampWebhookSubscriptionGetInputSchema = z.object({ webhookId: rampIdSchema });
21
+ const rampWebhookSubscriptionCreateInputSchema = z.object({
22
+ url: z.string().trim().min(1),
23
+ enabled_events: z.array(z.string()).min(1).optional(),
24
+ idempotency_key: z.string().trim().min(1).optional()
25
+ });
26
+ const rampWebhookSubscriptionUpdateInputSchema = z.object({
27
+ webhookId: rampIdSchema,
28
+ url: z.string().optional(),
29
+ is_active: z.boolean().optional(),
30
+ enabled_events: z.array(z.string()).optional()
31
+ });
32
+ const rampWebhookSubscriptionDeleteInputSchema = z.object({ webhookId: rampIdSchema });
33
+
34
+ //#endregion
35
+ export { rampWebhookSubscriptionListSchema as a, rampWebhookSubscriptionListInputSchema as i, rampWebhookSubscriptionDeleteInputSchema as n, rampWebhookSubscriptionSchema as o, rampWebhookSubscriptionGetInputSchema as r, rampWebhookSubscriptionUpdateInputSchema as s, rampWebhookSubscriptionCreateInputSchema as t };
@@ -0,0 +1,83 @@
1
+ import { z } from "zod";
2
+ import * as _keystrokehq_core0 from "@keystrokehq/core";
3
+ import * as _keystrokehq_core_credential_set0 from "@keystrokehq/core/credential-set";
4
+
5
+ //#region src/webhooks.d.ts
6
+ declare const listWebhookSubscriptions: _keystrokehq_core0.Operation<z.ZodObject<{
7
+ pageSize: z.ZodOptional<z.ZodNumber>;
8
+ cursor: z.ZodOptional<z.ZodString>;
9
+ }, z.core.$strip>, z.ZodObject<{
10
+ data: z.ZodArray<z.ZodObject<{
11
+ id: z.ZodString;
12
+ url: z.ZodString;
13
+ is_active: z.ZodOptional<z.ZodBoolean>;
14
+ enabled_events: z.ZodOptional<z.ZodArray<z.ZodString>>;
15
+ created_at: z.ZodOptional<z.ZodString>;
16
+ updated_at: z.ZodOptional<z.ZodString>;
17
+ }, z.core.$loose>>;
18
+ page: z.ZodOptional<z.ZodObject<{
19
+ next: z.ZodOptional<z.ZodString>;
20
+ }, z.core.$strip>>;
21
+ }, z.core.$strip>, readonly [_keystrokehq_core0.CredentialSet<"ramp", z.ZodObject<{
22
+ RAMP_ACCESS_TOKEN: z.ZodString;
23
+ }, z.core.$strip>, readonly _keystrokehq_core_credential_set0.CredentialConnection<z.ZodObject<{
24
+ RAMP_ACCESS_TOKEN: z.ZodString;
25
+ }, z.core.$strip>>[] | undefined>], undefined>;
26
+ declare const getWebhookSubscription: _keystrokehq_core0.Operation<z.ZodObject<{
27
+ webhookId: z.ZodString;
28
+ }, z.core.$strip>, z.ZodObject<{
29
+ id: z.ZodString;
30
+ url: z.ZodString;
31
+ is_active: z.ZodOptional<z.ZodBoolean>;
32
+ enabled_events: z.ZodOptional<z.ZodArray<z.ZodString>>;
33
+ created_at: z.ZodOptional<z.ZodString>;
34
+ updated_at: z.ZodOptional<z.ZodString>;
35
+ }, z.core.$loose>, readonly [_keystrokehq_core0.CredentialSet<"ramp", z.ZodObject<{
36
+ RAMP_ACCESS_TOKEN: z.ZodString;
37
+ }, z.core.$strip>, readonly _keystrokehq_core_credential_set0.CredentialConnection<z.ZodObject<{
38
+ RAMP_ACCESS_TOKEN: z.ZodString;
39
+ }, z.core.$strip>>[] | undefined>], undefined>;
40
+ declare const createWebhookSubscription: _keystrokehq_core0.Operation<z.ZodObject<{
41
+ url: z.ZodString;
42
+ enabled_events: z.ZodOptional<z.ZodArray<z.ZodString>>;
43
+ idempotency_key: z.ZodOptional<z.ZodString>;
44
+ }, z.core.$strip>, z.ZodObject<{
45
+ id: z.ZodString;
46
+ url: z.ZodString;
47
+ is_active: z.ZodOptional<z.ZodBoolean>;
48
+ enabled_events: z.ZodOptional<z.ZodArray<z.ZodString>>;
49
+ created_at: z.ZodOptional<z.ZodString>;
50
+ updated_at: z.ZodOptional<z.ZodString>;
51
+ }, z.core.$loose>, readonly [_keystrokehq_core0.CredentialSet<"ramp", z.ZodObject<{
52
+ RAMP_ACCESS_TOKEN: z.ZodString;
53
+ }, z.core.$strip>, readonly _keystrokehq_core_credential_set0.CredentialConnection<z.ZodObject<{
54
+ RAMP_ACCESS_TOKEN: z.ZodString;
55
+ }, z.core.$strip>>[] | undefined>], undefined>;
56
+ declare const updateWebhookSubscription: _keystrokehq_core0.Operation<z.ZodObject<{
57
+ webhookId: z.ZodString;
58
+ url: z.ZodOptional<z.ZodString>;
59
+ is_active: z.ZodOptional<z.ZodBoolean>;
60
+ enabled_events: z.ZodOptional<z.ZodArray<z.ZodString>>;
61
+ }, z.core.$strip>, z.ZodObject<{
62
+ id: z.ZodString;
63
+ url: z.ZodString;
64
+ is_active: z.ZodOptional<z.ZodBoolean>;
65
+ enabled_events: z.ZodOptional<z.ZodArray<z.ZodString>>;
66
+ created_at: z.ZodOptional<z.ZodString>;
67
+ updated_at: z.ZodOptional<z.ZodString>;
68
+ }, z.core.$loose>, readonly [_keystrokehq_core0.CredentialSet<"ramp", z.ZodObject<{
69
+ RAMP_ACCESS_TOKEN: z.ZodString;
70
+ }, z.core.$strip>, readonly _keystrokehq_core_credential_set0.CredentialConnection<z.ZodObject<{
71
+ RAMP_ACCESS_TOKEN: z.ZodString;
72
+ }, z.core.$strip>>[] | undefined>], undefined>;
73
+ declare const deleteWebhookSubscription: _keystrokehq_core0.Operation<z.ZodObject<{
74
+ webhookId: z.ZodString;
75
+ }, z.core.$strip>, z.ZodObject<{
76
+ success: z.ZodBoolean;
77
+ }, z.core.$strip>, readonly [_keystrokehq_core0.CredentialSet<"ramp", z.ZodObject<{
78
+ RAMP_ACCESS_TOKEN: z.ZodString;
79
+ }, z.core.$strip>, readonly _keystrokehq_core_credential_set0.CredentialConnection<z.ZodObject<{
80
+ RAMP_ACCESS_TOKEN: z.ZodString;
81
+ }, z.core.$strip>>[] | undefined>], undefined>;
82
+ //#endregion
83
+ export { createWebhookSubscription, deleteWebhookSubscription, getWebhookSubscription, listWebhookSubscriptions, updateWebhookSubscription };