@lucaapp/service-utils 5.8.0 → 5.9.0

package/dist/lib/kafka/events/payment.d.ts

@@ -1,28 +1,205 @@
-export type Payment = {
+import { SupportedCurrencies } from '../../money/supportedCurrencies';
+/**
+ * JSON-serialisable value tree.
+ *
+ * Used for opaque payloads carried across the wire. Anything stored here
+ * must round-trip through `JSON.stringify` / `JSON.parse` without loss.
+ */
+export type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+/** Legacy 3-letter terminal status code from the original payment provider integration. */
+export type RapydPaymentStatus = 'ACT' | 'CAN' | 'CLO' | 'ERR' | 'EXP' | 'NEW' | 'REV';
+/** Provider-neutral payment lifecycle status. */
+export type PaymentStatus = 'PAID' | 'NEW' | 'ACTIVE' | 'CANCELLED' | 'EXPIRED' | 'REFUNDED' | 'ERROR' | 'UNKNOWN';
+/**
+ * Lifecycle timestamps shared by all payment events.
+ *
+ * Each timestamp marks the first time the payment entered the corresponding
+ * state. A null value means the state was never reached.
+ */
+export type PaymentStatusTimings = {
+    /** Timestamp when the payment record was created (session start, NOT settlement). */
+    paymentCreatedAt: Date;
+    /** Payment record created; awaiting consumer action (e.g. order created, link sent, QR displayed). */
+    statusNewAt: Date | null;
+    /** Consumer engaged with the payment flow (e.g. opened a 3DS challenge, tapped a terminal, clicked the payment link). */
+    statusActiveAt: Date | null;
+    /** Provider authorised and captured the funds (online auth + capture or terminal sale complete). */
+    statusCompleteAt?: Date | null;
+    /** Cancelled by consumer or operator before completion. */
+    statusCanceledAt: Date | null;
+    /** Payment session expired before completion. */
+    statusExpiredAt: Date | null;
+    /** Provider returned an error or refused the payment. */
+    statusErrorAt: Date | null;
+    /** Authorised payment was reversed before settlement (e.g. chargeback pre-arbitration). */
+    statusReversedAt?: Date | null;
+    /** Projected or actual settlement date to the merchant balance. Null until the provider schedules settlement. */
+    settleAt?: Date | null;
+};
+/** Fields shared by both the legacy {@link Payment} event and the provider-neutral {@link PaymentEvent}. */
+export type PaymentBase = {
+    /** Stable payment id. Uniquely identifies the payment across all systems. */
     uuid: string;
+    /** Merchant location id (UUID). */
     locationId: string;
+    /** Human-readable location name. Null when not provided. */
     locationName: string | null;
+    /** Table or seat identifier from the POS. Null for non-dine-in payments. */
     table: string | null;
+    /** Pre-created payment-request id. Null for spontaneous payments. */
     paymentRequestId: string | null;
-    paymentCreatedAt: Date;
-    paidAt: Date | null;
+    /** Short verifier token used by consumer-facing flows to prove ownership of the payment session. */
     paymentVerifier: string;
-    totalAmount: number;
+    /** Net goods/services amount before tip, in the smallest currency subunit. */
     invoiceAmount: number;
+    /** Consumer-added gratuity, in the smallest currency subunit. Zero when no tip was given. */
     tipAmount: number;
+} & PaymentStatusTimings;
+/**
+ * Legacy payment event tied to the original provider integration.
+ *
+ * Kept for backward compatibility. New consumers should subscribe to
+ * {@link PaymentEvent}.
+ */
+export type Payment = PaymentBase & {
+    /** Total paid by the consumer (= `invoiceAmount + tipAmount`), in the smallest currency subunit. Kept for legacy consumers. */
+    totalAmount: number;
+    /** Timestamp when the payment was marked paid. */
+    paidAt: Date | null;
+    /** @deprecated Legacy terminal "CLO" state. Use `statusCompleteAt`. */
+    statusClosedAt: Date | null;
+    /** Fixed processing fee, in the smallest currency subunit. */
     fixedFee: number;
+    /** Variable fee (commission + markup), in the smallest currency subunit. */
     variableFee: number;
+    /** Legacy provider payment id. */
     rapydPaymentId: string | null;
+    /** Legacy provider error code on failure. */
     rapydErrorCode: string | null;
+    /** Legacy provider error message on failure. */
     rapydErrorMessage: string | null;
-    rapydPaymentStatus: 'ACT' | 'CAN' | 'CLO' | 'ERR' | 'EXP' | 'NEW' | 'REV';
+    /** Legacy 3-letter status code from the provider. */
+    rapydPaymentStatus: RapydPaymentStatus;
+    /** Legacy provider customer / saved-card alias. */
     rapydCustomerId: string | null;
+    /** Aggregated payout batch id. Null until the payment is included in a payout. */
     payoutId: string | null;
-    statusActiveAt: Date | null;
-    statusCanceledAt: Date | null;
-    statusClosedAt: Date | null;
-    statusErrorAt: Date | null;
-    statusExpiredAt: Date | null;
-    statusNewAt: Date | null;
-    statusReversedAt?: Date | null;
+};
+/**
+ * Provider-neutral payment lifecycle event.
+ *
+ * Carries the full domain context needed for fiscalisation, receipt
+ * rendering, and downstream reconciliation. Wire format is JSON: monetary
+ * fields are integers in the smallest currency subunit and `currency`
+ * declares the unit.
+ */
+export type PaymentEvent = PaymentBase & {
+    /** Checkout session id. Optional — some flows emit payment events without a checkout. */
+    checkoutId?: string;
+    /** Order id (e.g. POS / fiscalisation order reference). Absent for payments not tied to an order. */
+    orderId?: string;
+    /** Operator-added service charge / convenience fee, in the smallest currency subunit. Zero if none. */
+    surchargeAmount: number;
+    /** ISO 4217 code that applies to every monetary field on this event. Single-currency invariant. */
+    currency: SupportedCurrencies;
+    /** Lifecycle status at event-emission time. */
+    status: PaymentStatus;
+    /** Method identifier, e.g. `'CARD'`, `'CASH'`, `'WALLET'`. */
+    method: string;
+    /** True if `method` is a cash variant. Cash flows skip provider webhooks and short-circuit fiscalisation. */
+    isCash: boolean;
+    /** Origin service identifier (free-form short string). */
+    source: string;
+    /** Aggregated payout batch id. Null until included in a payout. */
+    payoutId?: string | null;
+    /** Provider-side identifiers, errors, and raw provider payload. Absent for cash. */
+    merchantDetails?: PaymentMerchantDetails;
+    /** Card-specific identifiers and terminal context. Absent for non-card methods. */
+    cardDetails?: PaymentCardDetails;
+    /** Per-item breakdown for fiscalisation and receipt rendering. */
+    lineItems?: PaymentEventLineItem[];
+};
+/** Amount the consumer actually pays = `invoiceAmount + tipAmount + surchargeAmount` (smallest currency subunit). */
+export declare const consumerPayAmount: (event: PaymentEvent) => number;
+/**
+ * Amount receivable by the operator before Luca / provider fees are
+ * deducted = `invoiceAmount + tipAmount` (smallest currency subunit).
+ *
+ * Surcharge is excluded — it covers the consumer-side fee, not operator
+ * revenue. Net payout to the operator is this minus the per-payment fees.
+ */
+export declare const operatorReceivableAmount: (event: PaymentEvent) => number;
+/**
+ * Provider-side metadata for a payment.
+ *
+ * All fields optional — populated by whichever provider handled the
+ * payment. Absent on cash and other non-provider flows.
+ */
+export type PaymentMerchantDetails = {
+    /** Payment-processor identifier (lowercase short string). Null when not yet routed to a provider. */
+    provider?: string | null;
+    /** Provider's payment id. Null until the provider authorises. */
+    providerIdentifier?: string | null;
+    /** Machine-readable error / decline code from the provider. Null on success. */
+    providerErrorCode?: string | null;
+    /** Human-readable provider error detail. Null on success. */
+    providerErrorMessage?: string | null;
+    /** Raw provider payload (notification or response body). Used for audits and chargeback evidence. */
+    providerData?: {
+        [key: string]: JsonValue;
+    } | null;
+    /** Provider-facing merchant reference used to reconcile internal records against the provider's records. */
+    externalReference?: string | null;
+};
+/**
+ * Card and terminal context.
+ *
+ * Card fields populated for card payments; terminal/consumer fields
+ * populated when applicable, regardless of card vs. wallet.
+ */
+export type PaymentCardDetails = {
+    /** Last 4 digits of the card. Null for non-card methods. */
+    last4?: string | null;
+    /** Provider authorisation code. Null until authorised. */
+    authCode?: string | null;
+    /** Saved-card alias for tokenised cards. Null for one-time payments. */
+    consumerAlias?: string | null;
+    /** Physical terminal id. Null for online / QR payments. */
+    terminalId?: string | null;
+    /** Consumer account id. Null for anonymous payments. */
+    consumerId?: string | null;
+};
+/**
+ * One billable line in the order, used for fiscalisation and receipt
+ * rendering.
+ *
+ * Sub-items represent components of a parent line (e.g. base drink + paid
+ * topping) and follow the same shape recursively. Amounts are integers in
+ * the smallest currency subunit.
+ */
+export type PaymentEventLineItem = {
+    /** Stable line-item id. Omitted on synthetic sub-items that have no own row. */
+    uuid?: string;
+    /** POS-system menu item / SKU id. Null when not synced from the POS menu. */
+    posItemId?: string | null;
+    /** Display name (e.g. `'Espresso'`). May be omitted when the consumer can resolve it from `posItemId`. */
+    name?: string;
+    /** Number of units, e.g. `2` for two coffees. */
+    quantity: number;
+    /** Price for one unit, in the smallest currency subunit. */
+    pricePerUnit: number;
+    /** `quantity × pricePerUnit + Σ subItems.totalPrice`, in the smallest currency subunit. */
+    totalPrice: number;
+    /**
+     * VAT / sales-tax rate as a percentage value (e.g. `19` for 19%, `7` for
+     * 7%). NOT a decimal fraction — `0.19` would mean 0.19%. Null if
+     * tax-exempt or unknown.
+     */
+    taxPercentage?: number | null;
+    /** Item currency. Typically equals the parent payment currency. */
+    currency: SupportedCurrencies;
+    /** Recursive components of this line. Each sub-item follows the same shape. */
+    subItems?: PaymentEventLineItem[];
 };

package/dist/lib/kafka/events/payment.js

@@ -1,2 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.operatorReceivableAmount = exports.consumerPayAmount = void 0;
+/** Amount the consumer actually pays = `invoiceAmount + tipAmount + surchargeAmount` (smallest currency subunit). */
+const consumerPayAmount = (event) => event.invoiceAmount + event.tipAmount + event.surchargeAmount;
+exports.consumerPayAmount = consumerPayAmount;
+/**
+ * Amount receivable by the operator before Luca / provider fees are
+ * deducted = `invoiceAmount + tipAmount` (smallest currency subunit).
+ *
+ * Surcharge is excluded — it covers the consumer-side fee, not operator
+ * revenue. Net payout to the operator is this minus the per-payment fees.
+ */
+const operatorReceivableAmount = (event) => event.invoiceAmount + event.tipAmount;
+exports.operatorReceivableAmount = operatorReceivableAmount;

package/dist/lib/kafka/events.d.ts

@@ -82,5 +82,6 @@ declare const MessageIssuer: {
     "wsevent_backend-pos": Service;
     tokenization_job_item: Service;
 };
-export { KafkaTopic, MessageIssuer };
+declare const MessageSignatureIssuers: Partial<Record<KafkaTopic, Service[]>>;
+export { KafkaTopic, MessageIssuer, MessageSignatureIssuers };
 export type { MessageFormats };

package/dist/lib/kafka/events.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MessageIssuer = exports.KafkaTopic = void 0;
+exports.MessageSignatureIssuers = exports.MessageIssuer = exports.KafkaTopic = void 0;
 const serviceIdentity_1 = require("../serviceIdentity");
 var KafkaTopic;
 (function (KafkaTopic) {
@@ -48,3 +48,7 @@ const MessageIssuer = {
     [KafkaTopic.TOKENIZATION_JOB_ITEM]: serviceIdentity_1.Service.BACKEND_PAY,
 };
 exports.MessageIssuer = MessageIssuer;
+const MessageSignatureIssuers = {
+    [KafkaTopic.PAYMENTS]: [serviceIdentity_1.Service.BACKEND_PAY, serviceIdentity_1.Service.BACKEND_TSE],
+};
+exports.MessageSignatureIssuers = MessageSignatureIssuers;

package/dist/lib/kafka/kafkaClient.js

@@ -15,13 +15,23 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.KafkaClient = void 0;
 const kafkajs_1 = require("kafkajs");
@@ -61,6 +71,18 @@ const messageAcknowledgedCounter = new metrics_1.metricsClient.Counter({
 const getIssuer = (kafkaTopic) => {
     return events_1.MessageIssuer[kafkaTopic].valueOf();
 };
+const getAllowedSignatureIssuers = (kafkaTopic) => {
+    return (events_1.MessageSignatureIssuers[kafkaTopic] ?? [events_1.MessageIssuer[kafkaTopic]]).map(issuer => issuer.valueOf());
+};
+const headerToString = (header) => {
+    if (Array.isArray(header)) {
+        return headerToString(header[0]);
+    }
+    if (Buffer.isBuffer(header)) {
+        return header.toString();
+    }
+    return header;
+};
 class KafkaClient {
     constructor(parentLogger, kafkaConfig, topicSecrets, serviceIdentity) {
         this.connect = async () => {
@@ -119,11 +141,15 @@ class KafkaClient {
                 this.logger.info('Skipping signature verification (encryption disabled)');
                 return;
             }
-            if (!headers || !headers.signature) {
+            const signature = headerToString(headers?.signature);
+            if (!signature) {
                 throw (0, utils_1.logAndGetError)(this.logger, 'Unable to verify signature. Expected header not present');
             }
-            const issuer = getIssuer(kafkaTopic);
-            const { signature } = headers;
+            const issuer = headerToString(headers?.signatureIssuer) ?? getIssuer(kafkaTopic);
+            const allowedIssuers = getAllowedSignatureIssuers(kafkaTopic);
+            if (!allowedIssuers.includes(issuer)) {
+                throw (0, utils_1.logAndGetError)(this.logger, `Unable to verify signature. Issuer ${issuer} is not allowed for topic=${kafkaTopic}`);
+            }
             const jwks = await this.serviceIdentity.getRemoteJWKS(issuer);
             if (!jwks) {
                 throw (0, utils_1.logAndGetError)(this.logger, `Unable to find jwks for issuer=${issuer}`);
@@ -230,7 +256,10 @@ class KafkaClient {
                         {
                             key,
                             value: encryptedValue,
-                            headers: { signature },
+                            headers: {
+                                signature,
+                                signatureIssuer: this.serviceIdentity.identityName,
+                            },
                         },
                     ],
                 };

package/dist/lib/metrics/metricsClient.js

@@ -15,13 +15,23 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.metricsClient = void 0;
 exports.metricsClient = __importStar(require("prom-client"));

package/dist/lib/pgBoss/metrics.js

@@ -15,13 +15,23 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };

package/dist/lib/phone/phone.js

@@ -15,13 +15,23 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.normalizePhoneNumber = exports.getPhoneType = exports.getPhoneCountry = exports.parsePhone = exports.formatPhoneNumber = exports.tryParsePhoneNumber = exports.getFormattedPhoneNumber = exports.isValidMobilePhoneNumber = exports.isValidPhoneNumber = exports.OutputFormat = void 0;
 const max_1 = __importStar(require("libphonenumber-js/max"));

package/dist/lib/serviceIdentity/service.d.ts

@@ -3,6 +3,7 @@ declare enum Service {
     BACKEND_PAY = "backend-pay",
     BACKEND_POS = "backend-pos",
     BACKEND_PUBSUB = "backend-pubsub",
+    BACKEND_TSE = "backend-tse",
     BACKEND_PYTHON = "backend-python",
     BACKEND_LINK = "backend-link",
     MASTRA = "mastra",

package/dist/lib/serviceIdentity/service.js

@@ -7,6 +7,7 @@ var Service;
     Service["BACKEND_PAY"] = "backend-pay";
     Service["BACKEND_POS"] = "backend-pos";
     Service["BACKEND_PUBSUB"] = "backend-pubsub";
+    Service["BACKEND_TSE"] = "backend-tse";
     Service["BACKEND_PYTHON"] = "backend-python";
     Service["BACKEND_LINK"] = "backend-link";
     Service["MASTRA"] = "mastra";

package/dist/lib/serviceIdentity/serviceIdentity.js

@@ -15,13 +15,23 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lucaapp/service-utils",
-  "version": "5.8.0",
+  "version": "5.9.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [
@@ -15,7 +15,7 @@
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
     "test:ci": "VITEST_JUNIT_SUITE_NAME=service-utils CI=true vitest run --coverage",
-    "audit": "sh ../../scripts/cached-audit.sh improved-yarn-audit --ignore-dev-deps"
+    "audit:osv": "yarn-osv-audit"
   },
   "dependencies": {
     "@apidevtools/swagger-parser": "10.0.3",
@@ -24,7 +24,7 @@
     "@aws-sdk/lib-storage": "^3.1035.0",
     "@hapi/boom": "^10.0.1",
     "@sentry/node": "^9.10.1",
-    "@tsconfig/node22": "22.0.0",
+    "@tsconfig/node24": "24.0.0",
     "@types/express": "4.17.23",
     "@types/express-serve-static-core": "^4.17.43",
     "@types/node": "22.13.11",
@@ -74,12 +74,12 @@
     "eslint": "8.57.0",
     "eslint-plugin-prettier": "4.2.1",
     "eslint-plugin-vitest": "0.4.1",
-    "improved-yarn-audit": "^3.0.4",
+    "yarn-osv-audit": "0.1.8",
     "prettier": "2.7.1",
     "semantic-release": "^25.0.3",
     "semantic-release-monorepo": "8.0.2",
-    "supertest": "^6.3.3",
-    "typescript": "5.5.3",
+    "supertest": "6.3.4",
+    "typescript": "6.0.2",
     "vite-tsconfig-paths": "4.3.2",
     "vitest": "4.1.1"
   },