@peable.to/sdk 0.2.1 → 0.2.2

package/dist/cjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WEBHOOK_SIGNATURE_HEADER = exports.PeableSignatureVerificationError = exports.PeableApiError = exports.PeablePermissionError = exports.PeableInvalidRequestError = exports.PeableAuthenticationError = exports.PeableError = exports.DEFAULT_OXY_API_URL = exports.DEFAULT_GATEWAY_BASE_URL = exports.Peable = void 0;
+exports.WebhooksResource = exports.WEBHOOK_SIGNATURE_HEADER = exports.PeableSignatureVerificationError = exports.PeableApiError = exports.PeablePermissionError = exports.PeableInvalidRequestError = exports.PeableAuthenticationError = exports.PeableError = exports.DEFAULT_OXY_API_URL = exports.DEFAULT_GATEWAY_BASE_URL = exports.Peable = void 0;
 const billing_1 = require("./resources/billing");
 // Server entry (`@peable.to/sdk`) — the merchant-authed SDK. Configured with a
 // confidential `ApplicationCredential` (`{publicKey, secret}`); mints and
@@ -66,3 +66,4 @@ Object.defineProperty(exports, "PeableApiError", { enumerable: true, get: functi
 Object.defineProperty(exports, "PeableSignatureVerificationError", { enumerable: true, get: function () { return errors_1.PeableSignatureVerificationError; } });
 var webhooks_2 = require("./resources/webhooks");
 Object.defineProperty(exports, "WEBHOOK_SIGNATURE_HEADER", { enumerable: true, get: function () { return webhooks_2.WEBHOOK_SIGNATURE_HEADER; } });
+Object.defineProperty(exports, "WebhooksResource", { enumerable: true, get: function () { return webhooks_2.WebhooksResource; } });

package/dist/cjs/resources/webhooks.js

@@ -7,13 +7,21 @@ const errors_1 = require("../core/errors");
 exports.WEBHOOK_SIGNATURE_HEADER = 'Peable-Signature';
 /** Default replay-tolerance window, matching the backend's own tests/usage. */
 const DEFAULT_TOLERANCE_SEC = 300;
-const WEBHOOK_EVENT_TYPES = [
-    'payment_intent.confirming',
-    'payment_intent.settled',
-    'payment_intent.failed',
-    'payment_intent.rejected',
-    'payment_intent.expired',
-];
+// Exhaustive against the published union: adding a backend event makes this
+// fail compilation until the SDK accepts it. Own-key lookup excludes prototype
+// names supplied by an untrusted, even correctly signed, payload.
+const WEBHOOK_EVENT_TYPES = {
+    'payment_intent.confirming': true,
+    'payment_intent.settled': true,
+    'payment_intent.failed': true,
+    'payment_intent.rejected': true,
+    'payment_intent.expired': true,
+    'payment_intent.refunded': true,
+    'payment_intent.partially_refunded': true,
+    'payment_intent.disputed': true,
+    'payment_intent.dispute_closed': true,
+    'connected_account.updated': true,
+};
 /**
  * Structural guard for the parsed payload — the signature already proves the
  * bytes were produced by `signWebhook` on the SAME secret, but a caller could
@@ -27,7 +35,7 @@ function isWebhookEventShape(value) {
     return (typeof candidate.id === 'string' &&
         candidate.object === 'event' &&
         typeof candidate.type === 'string' &&
-        WEBHOOK_EVENT_TYPES.includes(candidate.type) &&
+        Object.prototype.hasOwnProperty.call(WEBHOOK_EVENT_TYPES, candidate.type) &&
         typeof candidate.created === 'string' &&
         typeof candidate.data === 'object' &&
         candidate.data !== null &&

package/dist/esm/index.js

@@ -52,4 +52,4 @@ export class Peable {
 }
 export { DEFAULT_GATEWAY_BASE_URL, DEFAULT_OXY_API_URL } from './core/config.js';
 export { PeableError, PeableAuthenticationError, PeableInvalidRequestError, PeablePermissionError, PeableApiError, PeableSignatureVerificationError, } from './core/errors.js';
-export { WEBHOOK_SIGNATURE_HEADER } from './resources/webhooks.js';
+export { WEBHOOK_SIGNATURE_HEADER, WebhooksResource } from './resources/webhooks.js';

package/dist/esm/resources/webhooks.js

@@ -4,13 +4,21 @@ import { PeableSignatureVerificationError } from '../core/errors.js';
 export const WEBHOOK_SIGNATURE_HEADER = 'Peable-Signature';
 /** Default replay-tolerance window, matching the backend's own tests/usage. */
 const DEFAULT_TOLERANCE_SEC = 300;
-const WEBHOOK_EVENT_TYPES = [
-    'payment_intent.confirming',
-    'payment_intent.settled',
-    'payment_intent.failed',
-    'payment_intent.rejected',
-    'payment_intent.expired',
-];
+// Exhaustive against the published union: adding a backend event makes this
+// fail compilation until the SDK accepts it. Own-key lookup excludes prototype
+// names supplied by an untrusted, even correctly signed, payload.
+const WEBHOOK_EVENT_TYPES = {
+    'payment_intent.confirming': true,
+    'payment_intent.settled': true,
+    'payment_intent.failed': true,
+    'payment_intent.rejected': true,
+    'payment_intent.expired': true,
+    'payment_intent.refunded': true,
+    'payment_intent.partially_refunded': true,
+    'payment_intent.disputed': true,
+    'payment_intent.dispute_closed': true,
+    'connected_account.updated': true,
+};
 /**
  * Structural guard for the parsed payload — the signature already proves the
  * bytes were produced by `signWebhook` on the SAME secret, but a caller could
@@ -24,7 +32,7 @@ function isWebhookEventShape(value) {
     return (typeof candidate.id === 'string' &&
         candidate.object === 'event' &&
         typeof candidate.type === 'string' &&
-        WEBHOOK_EVENT_TYPES.includes(candidate.type) &&
+        Object.prototype.hasOwnProperty.call(WEBHOOK_EVENT_TYPES, candidate.type) &&
         typeof candidate.created === 'string' &&
         typeof candidate.data === 'object' &&
         candidate.data !== null &&

package/dist/types/index.d.ts

@@ -57,5 +57,5 @@ export type { DisputeEvidenceParams, DisputeList, RegisterMerchantParams, Update
 export type { CreateRefundParams, RefundList } from './resources/refunds';
 export type { CreateTransferParams, ReverseTransferParams, TransferList, } from './resources/transfers';
 export type { PaymentLinkListParams, PaymentLinkList, UpdatePaymentLinkParams, } from './resources/paymentLinks';
-export { WEBHOOK_SIGNATURE_HEADER } from './resources/webhooks';
+export { WEBHOOK_SIGNATURE_HEADER, WebhooksResource } from './resources/webhooks';
 export type { ConstructEventOptions } from './resources/webhooks';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peable.to/sdk",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Peable SDK — a Stripe-ergonomics TypeScript client over the Peable Gateway REST + realtime contract. Server entry (`@peable.to/sdk`) mints Oxy service tokens from an ApplicationCredential and exposes paymentIntents/paymentLinks/checkout.sessions/webhooks; browser entry (`@peable.to/sdk/checkout`) is the anonymous payer-side client core.",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",