@paykit-sdk/paystack 1.2.1 → 1.3.1

package/dist/index.js

@@ -4121,20 +4121,10 @@ var Checkout$inboundSchema = (init, transaction) => {
       type: core.billingModeSchema.optional()
     })
   );
-  if (paykitMeta && typeof paykitMeta === "string") {
-    const parsed = core.parseJSON(
-      paykitMeta,
-      core.Schema.object({
-        item_id: core.Schema.string().optional(),
-        quantity: core.Schema.number().optional(),
-        type: core.billingModeSchema.optional()
-      })
-    );
-    if (parsed) {
-      itemId = parsed.item_id ?? "";
-      quantity = parsed.quantity ?? 1;
-      type = parsed.type ?? null;
-    }
+  if (paykitMeta) {
+    itemId = paykitMeta.item_id ?? "";
+    quantity = paykitMeta.quantity ?? 1;
+    type = paykitMeta.type ?? null;
   }
   let customer = null;
   if (transaction.customer?.email) {
@@ -4145,7 +4135,7 @@ var Checkout$inboundSchema = (init, transaction) => {
   return {
     id: init.reference,
     customer,
-    payment_url: init.authorization_url,
+    payment_url: init.authorizationUrl,
     metadata: Object.keys(metadata).length > 0 ? metadata : null,
     session_type: type ?? "one_time",
     products: [{ id: itemId, quantity }],
@@ -4276,6 +4266,19 @@ var PaystackProvider = class extends core.AbstractPayKitProvider {
     }
     return this._toCamel(result.value.data);
   }
+  async initializeTransaction(params) {
+    const body = {
+      ...params.providerMetadata,
+      email: params.email,
+      amount: params.amount,
+      currency: params.currency.toUpperCase(),
+      reference: crypto.randomUUID(),
+      ...params.callbackUrl && { callback_url: params.callbackUrl },
+      metadata: core.stringifyMetadataValues(params.metadata)
+    };
+    const response = await this._client.post("/transaction/initialize", { body: JSON.stringify(body) });
+    return this.unwrap(response, "initializeTransaction");
+  }
   createCheckout = async (params) => {
     const { error, data } = core.createCheckoutSchema.safeParse(params);
     if (error) {
@@ -4293,7 +4296,11 @@ var PaystackProvider = class extends core.AbstractPayKitProvider {
         { provider: this.providerName, method: "createCheckout" }
       );
     }
-    const { amount, currency = "NGN" } = data.provider_metadata ?? {};
+    const { amount, currency = "NGN" } = core.validateRequiredKeys(
+      ["amount", "currency"],
+      data.provider_metadata ?? {},
+      "Missing required provider metadata: {keys}"
+    );
     const metadata = {
       ...core.stringifyMetadataValues(data.metadata ?? {}),
       [core.PAYKIT_METADATA_KEY]: JSON.stringify({
@@ -4302,21 +4309,20 @@ var PaystackProvider = class extends core.AbstractPayKitProvider {
         type: data.session_type
       })
     };
-    const body = {
+    const parsedAmount = parseInt(amount, 10);
+    const upperCurrency = currency.toUpperCase();
+    const initData = await this.initializeTransaction({
       email: data.customer.email,
-      amount: amount ?? 0,
-      currency,
-      reference: crypto.randomUUID(),
-      callback_url: data.success_url,
-      metadata: core.stringifyMetadataValues(metadata),
-      ...data.provider_metadata
-    };
-    const response = await this._client.post("/transaction/initialize", { body: JSON.stringify(body) });
-    const initData = await this.unwrap(response, "createCheckout");
+      amount: parsedAmount,
+      currency: upperCurrency,
+      metadata,
+      callbackUrl: data.success_url,
+      providerMetadata: data.provider_metadata
+    });
     const rawCustomer = await this._client.get(`/customer/${encodeURIComponent(data.customer.email)}`);
     return Checkout$inboundSchema(initData, {
-      amount: body.amount,
-      currency: body.currency,
+      amount: parsedAmount,
+      currency: upperCurrency,
       customer: await this.unwrap(rawCustomer, "createCheckout"),
       metadata: JSON.stringify(metadata)
     });
@@ -4327,7 +4333,7 @@ var PaystackProvider = class extends core.AbstractPayKitProvider {
     const txn = response.value.data;
     return Checkout$inboundSchema(
       {
-        authorization_url: "",
+        authorizationUrl: "",
         reference: txn.reference
       },
       txn
@@ -4523,23 +4529,19 @@ var PaystackProvider = class extends core.AbstractPayKitProvider {
         item_id: data.item_id
       })
     };
-    const reference = crypto.randomUUID();
-    const body = {
-      email,
-      amount: data.amount,
-      currency: data.currency,
-      reference,
-      metadata,
-      ...data.provider_metadata
-    };
     if (this.opts.debug) {
       console.info("[Paystack] Initializing transaction", {
         email,
         amount: data.amount
       });
     }
-    const response = await this._client.post("/transaction/initialize", { body: JSON.stringify(body) });
-    const initData = await this.unwrap(response, "createPayment");
+    const initData = await this.initializeTransaction({
+      email,
+      amount: data.amount,
+      currency: data.currency,
+      metadata,
+      providerMetadata: data.provider_metadata
+    });
     return {
       id: initData.reference,
       amount: data.amount,
@@ -4551,7 +4553,7 @@ var PaystackProvider = class extends core.AbstractPayKitProvider {
       ),
       item_id: data.item_id ?? null,
       requires_action: true,
-      payment_url: initData.authorization_url
+      payment_url: initData.authorizationUrl
     };
   };
   retrievePayment = async (id) => {
@@ -4617,7 +4619,9 @@ var PaystackProvider = class extends core.AbstractPayKitProvider {
       });
     }
     const expectedSignature = crypto$1.createHmac("sha512", webhookSecret).update(body).digest("hex");
-    if (expectedSignature !== signature) {
+    const expectedBuf = Buffer.from(expectedSignature, "hex");
+    const receivedBuf = Buffer.from(signature, "hex");
+    if (expectedBuf.length !== receivedBuf.length || !crypto$1.timingSafeEqual(expectedBuf, receivedBuf)) {
       throw new core.WebhookError("Invalid Paystack webhook signature", {
         provider: this.providerName
       });

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { schema, AbstractPayKitProvider, HTTPClient, OperationFailedError, createCheckoutSchema, ValidationError, isEmailCustomer, InvalidTypeError, PAYKIT_METADATA_KEY, stringifyMetadataValues, ProviderNotSupportedError, createCustomerSchema, parseCustomerName, isIdCustomer, ResourceNotFoundError, createPaymentSchema, createRefundSchema, WebhookError, paykitEvent$InboundSchema, validateRequiredKeys, parseJSON, Schema, omitInternalMetadata, billingModeSchema } from '@paykit-sdk/core';
-import { createHmac } from 'crypto';
+import { schema, AbstractPayKitProvider, HTTPClient, OperationFailedError, stringifyMetadataValues, createCheckoutSchema, ValidationError, isEmailCustomer, InvalidTypeError, validateRequiredKeys, PAYKIT_METADATA_KEY, ProviderNotSupportedError, createCustomerSchema, parseCustomerName, isIdCustomer, ResourceNotFoundError, createPaymentSchema, createRefundSchema, WebhookError, paykitEvent$InboundSchema, parseJSON, Schema, omitInternalMetadata, billingModeSchema } from '@paykit-sdk/core';
+import { createHmac, timingSafeEqual } from 'crypto';
 
 var __defProp = Object.defineProperty;
 var __export = (target, all) => {
@@ -4119,20 +4119,10 @@ var Checkout$inboundSchema = (init, transaction) => {
       type: billingModeSchema.optional()
     })
   );
-  if (paykitMeta && typeof paykitMeta === "string") {
-    const parsed = parseJSON(
-      paykitMeta,
-      Schema.object({
-        item_id: Schema.string().optional(),
-        quantity: Schema.number().optional(),
-        type: billingModeSchema.optional()
-      })
-    );
-    if (parsed) {
-      itemId = parsed.item_id ?? "";
-      quantity = parsed.quantity ?? 1;
-      type = parsed.type ?? null;
-    }
+  if (paykitMeta) {
+    itemId = paykitMeta.item_id ?? "";
+    quantity = paykitMeta.quantity ?? 1;
+    type = paykitMeta.type ?? null;
   }
   let customer = null;
   if (transaction.customer?.email) {
@@ -4143,7 +4133,7 @@ var Checkout$inboundSchema = (init, transaction) => {
   return {
     id: init.reference,
     customer,
-    payment_url: init.authorization_url,
+    payment_url: init.authorizationUrl,
     metadata: Object.keys(metadata).length > 0 ? metadata : null,
     session_type: type ?? "one_time",
     products: [{ id: itemId, quantity }],
@@ -4274,6 +4264,19 @@ var PaystackProvider = class extends AbstractPayKitProvider {
     }
     return this._toCamel(result.value.data);
   }
+  async initializeTransaction(params) {
+    const body = {
+      ...params.providerMetadata,
+      email: params.email,
+      amount: params.amount,
+      currency: params.currency.toUpperCase(),
+      reference: crypto.randomUUID(),
+      ...params.callbackUrl && { callback_url: params.callbackUrl },
+      metadata: stringifyMetadataValues(params.metadata)
+    };
+    const response = await this._client.post("/transaction/initialize", { body: JSON.stringify(body) });
+    return this.unwrap(response, "initializeTransaction");
+  }
   createCheckout = async (params) => {
     const { error, data } = createCheckoutSchema.safeParse(params);
     if (error) {
@@ -4291,7 +4294,11 @@ var PaystackProvider = class extends AbstractPayKitProvider {
         { provider: this.providerName, method: "createCheckout" }
       );
     }
-    const { amount, currency = "NGN" } = data.provider_metadata ?? {};
+    const { amount, currency = "NGN" } = validateRequiredKeys(
+      ["amount", "currency"],
+      data.provider_metadata ?? {},
+      "Missing required provider metadata: {keys}"
+    );
     const metadata = {
       ...stringifyMetadataValues(data.metadata ?? {}),
       [PAYKIT_METADATA_KEY]: JSON.stringify({
@@ -4300,21 +4307,20 @@ var PaystackProvider = class extends AbstractPayKitProvider {
         type: data.session_type
       })
     };
-    const body = {
+    const parsedAmount = parseInt(amount, 10);
+    const upperCurrency = currency.toUpperCase();
+    const initData = await this.initializeTransaction({
       email: data.customer.email,
-      amount: amount ?? 0,
-      currency,
-      reference: crypto.randomUUID(),
-      callback_url: data.success_url,
-      metadata: stringifyMetadataValues(metadata),
-      ...data.provider_metadata
-    };
-    const response = await this._client.post("/transaction/initialize", { body: JSON.stringify(body) });
-    const initData = await this.unwrap(response, "createCheckout");
+      amount: parsedAmount,
+      currency: upperCurrency,
+      metadata,
+      callbackUrl: data.success_url,
+      providerMetadata: data.provider_metadata
+    });
     const rawCustomer = await this._client.get(`/customer/${encodeURIComponent(data.customer.email)}`);
     return Checkout$inboundSchema(initData, {
-      amount: body.amount,
-      currency: body.currency,
+      amount: parsedAmount,
+      currency: upperCurrency,
       customer: await this.unwrap(rawCustomer, "createCheckout"),
       metadata: JSON.stringify(metadata)
     });
@@ -4325,7 +4331,7 @@ var PaystackProvider = class extends AbstractPayKitProvider {
     const txn = response.value.data;
     return Checkout$inboundSchema(
       {
-        authorization_url: "",
+        authorizationUrl: "",
         reference: txn.reference
       },
       txn
@@ -4521,23 +4527,19 @@ var PaystackProvider = class extends AbstractPayKitProvider {
         item_id: data.item_id
       })
     };
-    const reference = crypto.randomUUID();
-    const body = {
-      email,
-      amount: data.amount,
-      currency: data.currency,
-      reference,
-      metadata,
-      ...data.provider_metadata
-    };
     if (this.opts.debug) {
       console.info("[Paystack] Initializing transaction", {
         email,
         amount: data.amount
       });
     }
-    const response = await this._client.post("/transaction/initialize", { body: JSON.stringify(body) });
-    const initData = await this.unwrap(response, "createPayment");
+    const initData = await this.initializeTransaction({
+      email,
+      amount: data.amount,
+      currency: data.currency,
+      metadata,
+      providerMetadata: data.provider_metadata
+    });
     return {
       id: initData.reference,
       amount: data.amount,
@@ -4549,7 +4551,7 @@ var PaystackProvider = class extends AbstractPayKitProvider {
       ),
       item_id: data.item_id ?? null,
       requires_action: true,
-      payment_url: initData.authorization_url
+      payment_url: initData.authorizationUrl
     };
   };
   retrievePayment = async (id) => {
@@ -4615,7 +4617,9 @@ var PaystackProvider = class extends AbstractPayKitProvider {
       });
     }
     const expectedSignature = createHmac("sha512", webhookSecret).update(body).digest("hex");
-    if (expectedSignature !== signature) {
+    const expectedBuf = Buffer.from(expectedSignature, "hex");
+    const receivedBuf = Buffer.from(signature, "hex");
+    if (expectedBuf.length !== receivedBuf.length || !timingSafeEqual(expectedBuf, receivedBuf)) {
       throw new WebhookError("Invalid Paystack webhook signature", {
         provider: this.providerName
       });

package/dist/paystack-provider.d.mts

@@ -26,6 +26,7 @@ declare class PaystackProvider extends AbstractPayKitProvider implements PayKitP
     get _native(): null;
     private _toCamel;
     private unwrap;
+    private initializeTransaction;
     createCheckout: (params: CreateCheckoutSchema<PaystackMetadata["checkout"]>) => Promise<Checkout>;
     retrieveCheckout: (id: string) => Promise<Checkout | null>;
     updateCheckout: (_id: string, _params: UpdateCheckoutSchema<PaystackMetadata["checkout"]>) => Promise<Checkout>;

package/dist/paystack-provider.d.ts

@@ -26,6 +26,7 @@ declare class PaystackProvider extends AbstractPayKitProvider implements PayKitP
     get _native(): null;
     private _toCamel;
     private unwrap;
+    private initializeTransaction;
     createCheckout: (params: CreateCheckoutSchema<PaystackMetadata["checkout"]>) => Promise<Checkout>;
     retrieveCheckout: (id: string) => Promise<Checkout | null>;
     updateCheckout: (_id: string, _params: UpdateCheckoutSchema<PaystackMetadata["checkout"]>) => Promise<Checkout>;

package/dist/paystack-provider.js

@@ -4121,20 +4121,10 @@ var Checkout$inboundSchema = (init, transaction) => {
       type: core.billingModeSchema.optional()
     })
   );
-  if (paykitMeta && typeof paykitMeta === "string") {
-    const parsed = core.parseJSON(
-      paykitMeta,
-      core.Schema.object({
-        item_id: core.Schema.string().optional(),
-        quantity: core.Schema.number().optional(),
-        type: core.billingModeSchema.optional()
-      })
-    );
-    if (parsed) {
-      itemId = parsed.item_id ?? "";
-      quantity = parsed.quantity ?? 1;
-      type = parsed.type ?? null;
-    }
+  if (paykitMeta) {
+    itemId = paykitMeta.item_id ?? "";
+    quantity = paykitMeta.quantity ?? 1;
+    type = paykitMeta.type ?? null;
   }
   let customer = null;
   if (transaction.customer?.email) {
@@ -4145,7 +4135,7 @@ var Checkout$inboundSchema = (init, transaction) => {
   return {
     id: init.reference,
     customer,
-    payment_url: init.authorization_url,
+    payment_url: init.authorizationUrl,
     metadata: Object.keys(metadata).length > 0 ? metadata : null,
     session_type: type ?? "one_time",
     products: [{ id: itemId, quantity }],
@@ -4276,6 +4266,19 @@ var PaystackProvider = class extends core.AbstractPayKitProvider {
     }
     return this._toCamel(result.value.data);
   }
+  async initializeTransaction(params) {
+    const body = {
+      ...params.providerMetadata,
+      email: params.email,
+      amount: params.amount,
+      currency: params.currency.toUpperCase(),
+      reference: crypto.randomUUID(),
+      ...params.callbackUrl && { callback_url: params.callbackUrl },
+      metadata: core.stringifyMetadataValues(params.metadata)
+    };
+    const response = await this._client.post("/transaction/initialize", { body: JSON.stringify(body) });
+    return this.unwrap(response, "initializeTransaction");
+  }
   createCheckout = async (params) => {
     const { error, data } = core.createCheckoutSchema.safeParse(params);
     if (error) {
@@ -4293,7 +4296,11 @@ var PaystackProvider = class extends core.AbstractPayKitProvider {
         { provider: this.providerName, method: "createCheckout" }
       );
     }
-    const { amount, currency = "NGN" } = data.provider_metadata ?? {};
+    const { amount, currency = "NGN" } = core.validateRequiredKeys(
+      ["amount", "currency"],
+      data.provider_metadata ?? {},
+      "Missing required provider metadata: {keys}"
+    );
     const metadata = {
       ...core.stringifyMetadataValues(data.metadata ?? {}),
       [core.PAYKIT_METADATA_KEY]: JSON.stringify({
@@ -4302,21 +4309,20 @@ var PaystackProvider = class extends core.AbstractPayKitProvider {
         type: data.session_type
       })
     };
-    const body = {
+    const parsedAmount = parseInt(amount, 10);
+    const upperCurrency = currency.toUpperCase();
+    const initData = await this.initializeTransaction({
       email: data.customer.email,
-      amount: amount ?? 0,
-      currency,
-      reference: crypto.randomUUID(),
-      callback_url: data.success_url,
-      metadata: core.stringifyMetadataValues(metadata),
-      ...data.provider_metadata
-    };
-    const response = await this._client.post("/transaction/initialize", { body: JSON.stringify(body) });
-    const initData = await this.unwrap(response, "createCheckout");
+      amount: parsedAmount,
+      currency: upperCurrency,
+      metadata,
+      callbackUrl: data.success_url,
+      providerMetadata: data.provider_metadata
+    });
     const rawCustomer = await this._client.get(`/customer/${encodeURIComponent(data.customer.email)}`);
     return Checkout$inboundSchema(initData, {
-      amount: body.amount,
-      currency: body.currency,
+      amount: parsedAmount,
+      currency: upperCurrency,
       customer: await this.unwrap(rawCustomer, "createCheckout"),
       metadata: JSON.stringify(metadata)
     });
@@ -4327,7 +4333,7 @@ var PaystackProvider = class extends core.AbstractPayKitProvider {
     const txn = response.value.data;
     return Checkout$inboundSchema(
       {
-        authorization_url: "",
+        authorizationUrl: "",
         reference: txn.reference
       },
       txn
@@ -4523,23 +4529,19 @@ var PaystackProvider = class extends core.AbstractPayKitProvider {
         item_id: data.item_id
       })
     };
-    const reference = crypto.randomUUID();
-    const body = {
-      email,
-      amount: data.amount,
-      currency: data.currency,
-      reference,
-      metadata,
-      ...data.provider_metadata
-    };
     if (this.opts.debug) {
       console.info("[Paystack] Initializing transaction", {
         email,
         amount: data.amount
       });
     }
-    const response = await this._client.post("/transaction/initialize", { body: JSON.stringify(body) });
-    const initData = await this.unwrap(response, "createPayment");
+    const initData = await this.initializeTransaction({
+      email,
+      amount: data.amount,
+      currency: data.currency,
+      metadata,
+      providerMetadata: data.provider_metadata
+    });
     return {
       id: initData.reference,
       amount: data.amount,
@@ -4551,7 +4553,7 @@ var PaystackProvider = class extends core.AbstractPayKitProvider {
       ),
       item_id: data.item_id ?? null,
       requires_action: true,
-      payment_url: initData.authorization_url
+      payment_url: initData.authorizationUrl
     };
   };
   retrievePayment = async (id) => {
@@ -4617,7 +4619,9 @@ var PaystackProvider = class extends core.AbstractPayKitProvider {
       });
     }
     const expectedSignature = crypto$1.createHmac("sha512", webhookSecret).update(body).digest("hex");
-    if (expectedSignature !== signature) {
+    const expectedBuf = Buffer.from(expectedSignature, "hex");
+    const receivedBuf = Buffer.from(signature, "hex");
+    if (expectedBuf.length !== receivedBuf.length || !crypto$1.timingSafeEqual(expectedBuf, receivedBuf)) {
       throw new core.WebhookError("Invalid Paystack webhook signature", {
         provider: this.providerName
       });

package/dist/paystack-provider.mjs

@@ -1,5 +1,5 @@
-import { schema, AbstractPayKitProvider, HTTPClient, OperationFailedError, createCheckoutSchema, ValidationError, isEmailCustomer, InvalidTypeError, PAYKIT_METADATA_KEY, stringifyMetadataValues, ProviderNotSupportedError, createCustomerSchema, parseCustomerName, isIdCustomer, ResourceNotFoundError, createPaymentSchema, createRefundSchema, WebhookError, paykitEvent$InboundSchema, parseJSON, Schema, omitInternalMetadata, billingModeSchema } from '@paykit-sdk/core';
-import { createHmac } from 'crypto';
+import { schema, AbstractPayKitProvider, HTTPClient, OperationFailedError, stringifyMetadataValues, createCheckoutSchema, ValidationError, isEmailCustomer, InvalidTypeError, validateRequiredKeys, PAYKIT_METADATA_KEY, ProviderNotSupportedError, createCustomerSchema, parseCustomerName, isIdCustomer, ResourceNotFoundError, createPaymentSchema, createRefundSchema, WebhookError, paykitEvent$InboundSchema, parseJSON, Schema, omitInternalMetadata, billingModeSchema } from '@paykit-sdk/core';
+import { createHmac, timingSafeEqual } from 'crypto';
 
 var __defProp = Object.defineProperty;
 var __export = (target, all) => {
@@ -4119,20 +4119,10 @@ var Checkout$inboundSchema = (init, transaction) => {
       type: billingModeSchema.optional()
     })
   );
-  if (paykitMeta && typeof paykitMeta === "string") {
-    const parsed = parseJSON(
-      paykitMeta,
-      Schema.object({
-        item_id: Schema.string().optional(),
-        quantity: Schema.number().optional(),
-        type: billingModeSchema.optional()
-      })
-    );
-    if (parsed) {
-      itemId = parsed.item_id ?? "";
-      quantity = parsed.quantity ?? 1;
-      type = parsed.type ?? null;
-    }
+  if (paykitMeta) {
+    itemId = paykitMeta.item_id ?? "";
+    quantity = paykitMeta.quantity ?? 1;
+    type = paykitMeta.type ?? null;
   }
   let customer = null;
   if (transaction.customer?.email) {
@@ -4143,7 +4133,7 @@ var Checkout$inboundSchema = (init, transaction) => {
   return {
     id: init.reference,
     customer,
-    payment_url: init.authorization_url,
+    payment_url: init.authorizationUrl,
     metadata: Object.keys(metadata).length > 0 ? metadata : null,
     session_type: type ?? "one_time",
     products: [{ id: itemId, quantity }],
@@ -4274,6 +4264,19 @@ var PaystackProvider = class extends AbstractPayKitProvider {
     }
     return this._toCamel(result.value.data);
   }
+  async initializeTransaction(params) {
+    const body = {
+      ...params.providerMetadata,
+      email: params.email,
+      amount: params.amount,
+      currency: params.currency.toUpperCase(),
+      reference: crypto.randomUUID(),
+      ...params.callbackUrl && { callback_url: params.callbackUrl },
+      metadata: stringifyMetadataValues(params.metadata)
+    };
+    const response = await this._client.post("/transaction/initialize", { body: JSON.stringify(body) });
+    return this.unwrap(response, "initializeTransaction");
+  }
   createCheckout = async (params) => {
     const { error, data } = createCheckoutSchema.safeParse(params);
     if (error) {
@@ -4291,7 +4294,11 @@ var PaystackProvider = class extends AbstractPayKitProvider {
         { provider: this.providerName, method: "createCheckout" }
       );
     }
-    const { amount, currency = "NGN" } = data.provider_metadata ?? {};
+    const { amount, currency = "NGN" } = validateRequiredKeys(
+      ["amount", "currency"],
+      data.provider_metadata ?? {},
+      "Missing required provider metadata: {keys}"
+    );
     const metadata = {
       ...stringifyMetadataValues(data.metadata ?? {}),
       [PAYKIT_METADATA_KEY]: JSON.stringify({
@@ -4300,21 +4307,20 @@ var PaystackProvider = class extends AbstractPayKitProvider {
         type: data.session_type
       })
     };
-    const body = {
+    const parsedAmount = parseInt(amount, 10);
+    const upperCurrency = currency.toUpperCase();
+    const initData = await this.initializeTransaction({
       email: data.customer.email,
-      amount: amount ?? 0,
-      currency,
-      reference: crypto.randomUUID(),
-      callback_url: data.success_url,
-      metadata: stringifyMetadataValues(metadata),
-      ...data.provider_metadata
-    };
-    const response = await this._client.post("/transaction/initialize", { body: JSON.stringify(body) });
-    const initData = await this.unwrap(response, "createCheckout");
+      amount: parsedAmount,
+      currency: upperCurrency,
+      metadata,
+      callbackUrl: data.success_url,
+      providerMetadata: data.provider_metadata
+    });
     const rawCustomer = await this._client.get(`/customer/${encodeURIComponent(data.customer.email)}`);
     return Checkout$inboundSchema(initData, {
-      amount: body.amount,
-      currency: body.currency,
+      amount: parsedAmount,
+      currency: upperCurrency,
       customer: await this.unwrap(rawCustomer, "createCheckout"),
       metadata: JSON.stringify(metadata)
     });
@@ -4325,7 +4331,7 @@ var PaystackProvider = class extends AbstractPayKitProvider {
     const txn = response.value.data;
     return Checkout$inboundSchema(
       {
-        authorization_url: "",
+        authorizationUrl: "",
         reference: txn.reference
       },
       txn
@@ -4521,23 +4527,19 @@ var PaystackProvider = class extends AbstractPayKitProvider {
         item_id: data.item_id
       })
     };
-    const reference = crypto.randomUUID();
-    const body = {
-      email,
-      amount: data.amount,
-      currency: data.currency,
-      reference,
-      metadata,
-      ...data.provider_metadata
-    };
     if (this.opts.debug) {
       console.info("[Paystack] Initializing transaction", {
         email,
         amount: data.amount
       });
     }
-    const response = await this._client.post("/transaction/initialize", { body: JSON.stringify(body) });
-    const initData = await this.unwrap(response, "createPayment");
+    const initData = await this.initializeTransaction({
+      email,
+      amount: data.amount,
+      currency: data.currency,
+      metadata,
+      providerMetadata: data.provider_metadata
+    });
     return {
       id: initData.reference,
       amount: data.amount,
@@ -4549,7 +4551,7 @@ var PaystackProvider = class extends AbstractPayKitProvider {
       ),
       item_id: data.item_id ?? null,
       requires_action: true,
-      payment_url: initData.authorization_url
+      payment_url: initData.authorizationUrl
     };
   };
   retrievePayment = async (id) => {
@@ -4615,7 +4617,9 @@ var PaystackProvider = class extends AbstractPayKitProvider {
       });
     }
     const expectedSignature = createHmac("sha512", webhookSecret).update(body).digest("hex");
-    if (expectedSignature !== signature) {
+    const expectedBuf = Buffer.from(expectedSignature, "hex");
+    const receivedBuf = Buffer.from(signature, "hex");
+    if (expectedBuf.length !== receivedBuf.length || !timingSafeEqual(expectedBuf, receivedBuf)) {
       throw new WebhookError("Invalid Paystack webhook signature", {
         provider: this.providerName
       });

package/dist/schema.d.mts

@@ -202,15 +202,19 @@ interface PaystackTransaction {
      */
     subaccount?: Record<string, unknown> | null;
 }
+/**
+ * Shape as returned by `unwrap()`, i.e. *after* `_toCamel` has run on
+ * Paystack's raw (snake_case) `/transaction/initialize` response.
+ */
 interface PaystackInitializeResponse {
     /**
      * The authorization URL of the transaction
      */
-    authorization_url: string;
+    authorizationUrl: string;
     /**
      * The access code of the transaction
      */
-    access_code: string;
+    accessCode: string;
     /**
      * The reference of the transaction
      */

package/dist/schema.d.ts

@@ -202,15 +202,19 @@ interface PaystackTransaction {
      */
     subaccount?: Record<string, unknown> | null;
 }
+/**
+ * Shape as returned by `unwrap()`, i.e. *after* `_toCamel` has run on
+ * Paystack's raw (snake_case) `/transaction/initialize` response.
+ */
 interface PaystackInitializeResponse {
     /**
      * The authorization URL of the transaction
      */
-    authorization_url: string;
+    authorizationUrl: string;
     /**
      * The access code of the transaction
      */
-    access_code: string;
+    accessCode: string;
     /**
      * The reference of the transaction
      */

package/dist/utils/mapper.js

@@ -76,20 +76,10 @@ var Checkout$inboundSchema = (init, transaction) => {
       type: core.billingModeSchema.optional()
     })
   );
-  if (paykitMeta && typeof paykitMeta === "string") {
-    const parsed = core.parseJSON(
-      paykitMeta,
-      core.Schema.object({
-        item_id: core.Schema.string().optional(),
-        quantity: core.Schema.number().optional(),
-        type: core.billingModeSchema.optional()
-      })
-    );
-    if (parsed) {
-      itemId = parsed.item_id ?? "";
-      quantity = parsed.quantity ?? 1;
-      type = parsed.type ?? null;
-    }
+  if (paykitMeta) {
+    itemId = paykitMeta.item_id ?? "";
+    quantity = paykitMeta.quantity ?? 1;
+    type = paykitMeta.type ?? null;
   }
   let customer = null;
   if (transaction.customer?.email) {
@@ -100,7 +90,7 @@ var Checkout$inboundSchema = (init, transaction) => {
   return {
     id: init.reference,
     customer,
-    payment_url: init.authorization_url,
+    payment_url: init.authorizationUrl,
     metadata: Object.keys(metadata).length > 0 ? metadata : null,
     session_type: type ?? "one_time",
     products: [{ id: itemId, quantity }],

package/dist/utils/mapper.mjs

@@ -74,20 +74,10 @@ var Checkout$inboundSchema = (init, transaction) => {
       type: billingModeSchema.optional()
     })
   );
-  if (paykitMeta && typeof paykitMeta === "string") {
-    const parsed = parseJSON(
-      paykitMeta,
-      Schema.object({
-        item_id: Schema.string().optional(),
-        quantity: Schema.number().optional(),
-        type: billingModeSchema.optional()
-      })
-    );
-    if (parsed) {
-      itemId = parsed.item_id ?? "";
-      quantity = parsed.quantity ?? 1;
-      type = parsed.type ?? null;
-    }
+  if (paykitMeta) {
+    itemId = paykitMeta.item_id ?? "";
+    quantity = paykitMeta.quantity ?? 1;
+    type = paykitMeta.type ?? null;
   }
   let customer = null;
   if (transaction.customer?.email) {
@@ -98,7 +88,7 @@ var Checkout$inboundSchema = (init, transaction) => {
   return {
     id: init.reference,
     customer,
-    payment_url: init.authorization_url,
+    payment_url: init.authorizationUrl,
     metadata: Object.keys(metadata).length > 0 ? metadata : null,
     session_type: type ?? "one_time",
     products: [{ id: itemId, quantity }],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paykit-sdk/paystack",
-  "version": "1.2.1",
+  "version": "1.3.1",
   "description": "Paystack provider for PayKit",
   "main": "dist/index.js",
   "module": "dist/index.esm.js",
@@ -11,9 +11,6 @@
   "paykit": {
     "type": "provider"
   },
-  "scripts": {
-    "build": "tsup"
-  },
   "keywords": [
     "paystack",
     "paykit",
@@ -23,13 +20,13 @@
   "author": "Emmanuel Odii",
   "license": "ISC",
   "peerDependencies": {
-    "@paykit-sdk/core": ">=1.2.2"
+    "@paykit-sdk/core": "^1.2.3"
   },
   "devDependencies": {
-    "@paykit-sdk/core": "workspace:*",
     "tsup": "^8.5.0",
     "typescript": "^5.9.2",
-    "zod": "^3.24.2"
+    "zod": "^3.24.2",
+    "@paykit-sdk/core": "1.3.1"
   },
   "publishConfig": {
     "access": "public"
@@ -40,5 +37,10 @@
   },
   "bugs": {
     "url": "https://github.com/usepaykit/paykit-sdk/issues"
+  },
+  "scripts": {
+    "build": "tsup",
+    "test": "vitest run --config ../../vitest.config.ts packages/paystack/src",
+    "typecheck": "tsc --noEmit"
   }
-}
+}