@peable.to/sdk 0.2.1 → 0.2.3-oxy-one.0

package/dist/cjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WEBHOOK_SIGNATURE_HEADER = exports.PeableSignatureVerificationError = exports.PeableApiError = exports.PeablePermissionError = exports.PeableInvalidRequestError = exports.PeableAuthenticationError = exports.PeableError = exports.DEFAULT_OXY_API_URL = exports.DEFAULT_GATEWAY_BASE_URL = exports.Peable = void 0;
+exports.WebhooksResource = exports.WEBHOOK_SIGNATURE_HEADER = exports.PeableSignatureVerificationError = exports.PeableApiError = exports.PeablePermissionError = exports.PeableInvalidRequestError = exports.PeableAuthenticationError = exports.PeableError = exports.DEFAULT_OXY_API_URL = exports.DEFAULT_GATEWAY_BASE_URL = exports.Peable = void 0;
 const billing_1 = require("./resources/billing");
 // Server entry (`@peable.to/sdk`) — the merchant-authed SDK. Configured with a
 // confidential `ApplicationCredential` (`{publicKey, secret}`); mints and
@@ -66,3 +66,4 @@ Object.defineProperty(exports, "PeableApiError", { enumerable: true, get: functi
 Object.defineProperty(exports, "PeableSignatureVerificationError", { enumerable: true, get: function () { return errors_1.PeableSignatureVerificationError; } });
 var webhooks_2 = require("./resources/webhooks");
 Object.defineProperty(exports, "WEBHOOK_SIGNATURE_HEADER", { enumerable: true, get: function () { return webhooks_2.WEBHOOK_SIGNATURE_HEADER; } });
+Object.defineProperty(exports, "WebhooksResource", { enumerable: true, get: function () { return webhooks_2.WebhooksResource; } });

package/dist/cjs/resources/billing.js

@@ -15,6 +15,9 @@ class BillingResource {
     createPortalSession(params, options) {
         return this.client.request('POST', '/v1/billing/portal_sessions', { body: params, idempotencyKey: options.idempotencyKey });
     }
+    retrieveCheckout(ref) { return this.client.request('GET', `/v1/billing/checkout_sessions/${encodeURIComponent(ref)}`); }
+    retrievePaidInvoice(subscriptionRef, invoiceRef) { return this.client.request('GET', `/v1/billing/subscriptions/${encodeURIComponent(subscriptionRef)}/paid_invoices/${encodeURIComponent(invoiceRef)}`); }
+    retrieveInvoiceState(subscriptionRef, invoiceRef) { return this.client.request('GET', `/v1/billing/subscriptions/${encodeURIComponent(subscriptionRef)}/invoice_states/${encodeURIComponent(invoiceRef)}`); }
     retrieveSubscription(ref) {
         return this.client.request('GET', `/v1/billing/subscriptions/${encodeURIComponent(ref)}`);
     }

package/dist/cjs/resources/webhooks.js

@@ -7,13 +7,22 @@ const errors_1 = require("../core/errors");
 exports.WEBHOOK_SIGNATURE_HEADER = 'Peable-Signature';
 /** Default replay-tolerance window, matching the backend's own tests/usage. */
 const DEFAULT_TOLERANCE_SEC = 300;
-const WEBHOOK_EVENT_TYPES = [
-    'payment_intent.confirming',
-    'payment_intent.settled',
-    'payment_intent.failed',
-    'payment_intent.rejected',
-    'payment_intent.expired',
-];
+// Exhaustive against the published union: adding a backend event makes this
+// fail compilation until the SDK accepts it. Own-key lookup excludes prototype
+// names supplied by an untrusted, even correctly signed, payload.
+const WEBHOOK_EVENT_TYPES = {
+    'payment_intent.confirming': true,
+    'payment_intent.settled': true,
+    'payment_intent.failed': true,
+    'payment_intent.rejected': true,
+    'payment_intent.expired': true,
+    'payment_intent.refunded': true,
+    'payment_intent.partially_refunded': true,
+    'payment_intent.disputed': true,
+    'payment_intent.dispute_closed': true,
+    'billing.observation.updated': true,
+    'connected_account.updated': true,
+};
 /**
  * Structural guard for the parsed payload — the signature already proves the
  * bytes were produced by `signWebhook` on the SAME secret, but a caller could
@@ -24,14 +33,24 @@ function isWebhookEventShape(value) {
     if (typeof value !== 'object' || value === null)
         return false;
     const candidate = value;
-    return (typeof candidate.id === 'string' &&
+    const valid = (typeof candidate.id === 'string' &&
         candidate.object === 'event' &&
         typeof candidate.type === 'string' &&
-        WEBHOOK_EVENT_TYPES.includes(candidate.type) &&
+        Object.prototype.hasOwnProperty.call(WEBHOOK_EVENT_TYPES, candidate.type) &&
         typeof candidate.created === 'string' &&
         typeof candidate.data === 'object' &&
         candidate.data !== null &&
         'object' in candidate.data);
+    if (!valid)
+        return false;
+    if (candidate.type === 'billing.observation.updated') {
+        const data = candidate.data?.object;
+        if (!data || typeof data !== 'object')
+            return false;
+        const v = data;
+        return v.object === 'billing_observation' && (v.resourceKind === 'subscription' || v.resourceKind === 'invoice') && typeof v.resourceId === 'string' && v.resourceId.length > 0 && typeof v.revision === 'number' && Number.isSafeInteger(v.revision) && v.revision > 0 && typeof v.observedAt === 'string' && Number.isFinite(Date.parse(v.observedAt)) && Object.keys(v).every(k => ['object', 'resourceKind', 'resourceId', 'revision', 'observedAt'].includes(k));
+    }
+    return true;
 }
 class WebhooksResource {
     /**

package/dist/esm/index.js

@@ -52,4 +52,4 @@ export class Peable {
 }
 export { DEFAULT_GATEWAY_BASE_URL, DEFAULT_OXY_API_URL } from './core/config.js';
 export { PeableError, PeableAuthenticationError, PeableInvalidRequestError, PeablePermissionError, PeableApiError, PeableSignatureVerificationError, } from './core/errors.js';
-export { WEBHOOK_SIGNATURE_HEADER } from './resources/webhooks.js';
+export { WEBHOOK_SIGNATURE_HEADER, WebhooksResource } from './resources/webhooks.js';

package/dist/esm/package.json

@@ -0,0 +1 @@
+{"type":"module"}

package/dist/esm/resources/billing.js

@@ -12,6 +12,9 @@ export class BillingResource {
     createPortalSession(params, options) {
         return this.client.request('POST', '/v1/billing/portal_sessions', { body: params, idempotencyKey: options.idempotencyKey });
     }
+    retrieveCheckout(ref) { return this.client.request('GET', `/v1/billing/checkout_sessions/${encodeURIComponent(ref)}`); }
+    retrievePaidInvoice(subscriptionRef, invoiceRef) { return this.client.request('GET', `/v1/billing/subscriptions/${encodeURIComponent(subscriptionRef)}/paid_invoices/${encodeURIComponent(invoiceRef)}`); }
+    retrieveInvoiceState(subscriptionRef, invoiceRef) { return this.client.request('GET', `/v1/billing/subscriptions/${encodeURIComponent(subscriptionRef)}/invoice_states/${encodeURIComponent(invoiceRef)}`); }
     retrieveSubscription(ref) {
         return this.client.request('GET', `/v1/billing/subscriptions/${encodeURIComponent(ref)}`);
     }

package/dist/esm/resources/webhooks.js

@@ -4,13 +4,22 @@ import { PeableSignatureVerificationError } from '../core/errors.js';
 export const WEBHOOK_SIGNATURE_HEADER = 'Peable-Signature';
 /** Default replay-tolerance window, matching the backend's own tests/usage. */
 const DEFAULT_TOLERANCE_SEC = 300;
-const WEBHOOK_EVENT_TYPES = [
-    'payment_intent.confirming',
-    'payment_intent.settled',
-    'payment_intent.failed',
-    'payment_intent.rejected',
-    'payment_intent.expired',
-];
+// Exhaustive against the published union: adding a backend event makes this
+// fail compilation until the SDK accepts it. Own-key lookup excludes prototype
+// names supplied by an untrusted, even correctly signed, payload.
+const WEBHOOK_EVENT_TYPES = {
+    'payment_intent.confirming': true,
+    'payment_intent.settled': true,
+    'payment_intent.failed': true,
+    'payment_intent.rejected': true,
+    'payment_intent.expired': true,
+    'payment_intent.refunded': true,
+    'payment_intent.partially_refunded': true,
+    'payment_intent.disputed': true,
+    'payment_intent.dispute_closed': true,
+    'billing.observation.updated': true,
+    'connected_account.updated': true,
+};
 /**
  * Structural guard for the parsed payload — the signature already proves the
  * bytes were produced by `signWebhook` on the SAME secret, but a caller could
@@ -21,14 +30,24 @@ function isWebhookEventShape(value) {
     if (typeof value !== 'object' || value === null)
         return false;
     const candidate = value;
-    return (typeof candidate.id === 'string' &&
+    const valid = (typeof candidate.id === 'string' &&
         candidate.object === 'event' &&
         typeof candidate.type === 'string' &&
-        WEBHOOK_EVENT_TYPES.includes(candidate.type) &&
+        Object.prototype.hasOwnProperty.call(WEBHOOK_EVENT_TYPES, candidate.type) &&
         typeof candidate.created === 'string' &&
         typeof candidate.data === 'object' &&
         candidate.data !== null &&
         'object' in candidate.data);
+    if (!valid)
+        return false;
+    if (candidate.type === 'billing.observation.updated') {
+        const data = candidate.data?.object;
+        if (!data || typeof data !== 'object')
+            return false;
+        const v = data;
+        return v.object === 'billing_observation' && (v.resourceKind === 'subscription' || v.resourceKind === 'invoice') && typeof v.resourceId === 'string' && v.resourceId.length > 0 && typeof v.revision === 'number' && Number.isSafeInteger(v.revision) && v.revision > 0 && typeof v.observedAt === 'string' && Number.isFinite(Date.parse(v.observedAt)) && Object.keys(v).every(k => ['object', 'resourceKind', 'resourceId', 'revision', 'observedAt'].includes(k));
+    }
+    return true;
 }
 export class WebhooksResource {
     /**

package/dist/types/index.d.ts

@@ -1,6 +1,6 @@
 import { BillingResource } from './resources/billing';
 export type { BillingRequestOptions } from './resources/billing';
-export type { BillingCustomer, BillingHostedSession, BillingSubscription, CreateBillingCheckoutParams, CreateBillingPortalParams, EnsureBillingCustomerParams } from '@peable.to/shared-types';
+export type { BillingObservation, BillingCustomer, BillingHostedSession, BillingCheckoutSession, BillingCheckoutObservation, BillingPaidInvoice, BillingInvoiceState, BillingSubscription, CreateBillingCheckoutParams, CreateBillingPortalParams, EnsureBillingCustomerParams } from '@peable.to/shared-types';
 import { type PeableConfig } from './core/config';
 import { PaymentIntentsResource } from './resources/paymentIntents';
 import { PaymentLinksResource } from './resources/paymentLinks';
@@ -57,5 +57,5 @@ export type { DisputeEvidenceParams, DisputeList, RegisterMerchantParams, Update
 export type { CreateRefundParams, RefundList } from './resources/refunds';
 export type { CreateTransferParams, ReverseTransferParams, TransferList, } from './resources/transfers';
 export type { PaymentLinkListParams, PaymentLinkList, UpdatePaymentLinkParams, } from './resources/paymentLinks';
-export { WEBHOOK_SIGNATURE_HEADER } from './resources/webhooks';
+export { WEBHOOK_SIGNATURE_HEADER, WebhooksResource } from './resources/webhooks';
 export type { ConstructEventOptions } from './resources/webhooks';

package/dist/types/resources/billing.d.ts

@@ -1,4 +1,4 @@
-import type { BillingCustomer, BillingHostedSession, BillingSubscription, CreateBillingCheckoutParams, CreateBillingPortalParams, EnsureBillingCustomerParams } from '@peable.to/shared-types';
+import type { BillingCustomer, BillingHostedSession, BillingCheckoutSession, BillingCheckoutObservation, BillingPaidInvoice, BillingInvoiceState, BillingSubscription, CreateBillingCheckoutParams, CreateBillingPortalParams, EnsureBillingCustomerParams } from '@peable.to/shared-types';
 import type { RestClient } from '../core/client';
 export interface BillingRequestOptions {
     idempotencyKey: string;
@@ -8,8 +8,11 @@ export declare class BillingResource {
     private readonly client;
     constructor(client: RestClient);
     ensureCustomer(params: EnsureBillingCustomerParams, options: BillingRequestOptions): Promise<BillingCustomer>;
-    createCheckoutSession(params: CreateBillingCheckoutParams, options: BillingRequestOptions): Promise<BillingHostedSession>;
+    createCheckoutSession(params: CreateBillingCheckoutParams, options: BillingRequestOptions): Promise<BillingCheckoutSession>;
     createPortalSession(params: CreateBillingPortalParams, options: BillingRequestOptions): Promise<BillingHostedSession>;
+    retrieveCheckout(ref: string): Promise<BillingCheckoutObservation>;
+    retrievePaidInvoice(subscriptionRef: string, invoiceRef: string): Promise<BillingPaidInvoice>;
+    retrieveInvoiceState(subscriptionRef: string, invoiceRef: string): Promise<BillingInvoiceState>;
     retrieveSubscription(ref: string): Promise<BillingSubscription>;
     cancelAtPeriodEnd(ref: string, options: BillingRequestOptions): Promise<BillingSubscription>;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peable.to/sdk",
-  "version": "0.2.1",
+  "version": "0.2.3-oxy-one.0",
   "description": "Peable SDK — a Stripe-ergonomics TypeScript client over the Peable Gateway REST + realtime contract. Server entry (`@peable.to/sdk`) mints Oxy service tokens from an ApplicationCredential and exposes paymentIntents/paymentLinks/checkout.sessions/webhooks; browser entry (`@peable.to/sdk/checkout`) is the anonymous payer-side client core.",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -8,7 +8,9 @@
   "source": "src/index.ts",
   "sideEffects": false,
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "registry": "https://registry.npmjs.org/",
+    "tag": "oxy-one"
   },
   "exports": {
     ".": {
@@ -71,7 +73,7 @@
     "prepublishOnly": "bun run clean && bun run build"
   },
   "dependencies": {
-    "@peable.to/shared-types": "^0.3.0",
+    "@peable.to/shared-types": "0.3.1-oxy-one.0",
     "qrcode-generator": "^2.0.4",
     "socket.io-client": "^4.8.3"
   },