@peable.to/sdk 0.2.3-oxy-one.0 → 0.2.4-oxy-one.0

package/dist/cjs/core/config.js

@@ -41,6 +41,8 @@ function resolveConfig(config) {
     }
     return {
         requestTimeoutMs: resolveRequestTimeout(config.requestTimeoutMs),
+        taxQuoteAuthorityKeys: config.taxQuoteAuthorityKeys ? Object.freeze({ ...config.taxQuoteAuthorityKeys }) : undefined,
+        invoiceAuthorityKeys: config.invoiceAuthorityKeys ? Object.freeze({ ...config.invoiceAuthorityKeys }) : undefined,
         publicKey: config.publicKey,
         secret: config.secret,
         baseURL: stripTrailingSlash(config.baseURL ?? exports.DEFAULT_GATEWAY_BASE_URL),

package/dist/cjs/index.js

@@ -41,7 +41,7 @@ class Peable {
         const resolved = (0, config_1.resolveConfig)(config);
         const tokenProvider = (0, serviceToken_1.createServiceTokenProvider)(config);
         const client = (0, client_1.createRestClient)({ baseURL: resolved.baseURL, requestTimeoutMs: resolved.requestTimeoutMs }, tokenProvider);
-        this.billing = new billing_1.BillingResource(client);
+        this.billing = new billing_1.BillingResource(client, resolved.invoiceAuthorityKeys, resolved.taxQuoteAuthorityKeys);
         this.paymentIntents = new paymentIntents_1.PaymentIntentsResource(client);
         this.paymentLinks = new paymentLinks_1.PaymentLinksResource(client);
         this.checkout = new checkoutSessions_1.CheckoutResource(client);

package/dist/cjs/resources/billing.js

@@ -1,10 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BillingResource = void 0;
+const node_crypto_1 = require("node:crypto");
+const shared_types_1 = require("@peable.to/shared-types");
 /** Recurring billing is separate from one-off checkout and marketplace transfers. */
 class BillingResource {
-    constructor(client) {
+    constructor(client, invoiceAuthorityKeys, taxQuoteAuthorityKeys) {
         this.client = client;
+        this.invoiceAuthorityKeys = invoiceAuthorityKeys;
+        this.taxQuoteAuthorityKeys = taxQuoteAuthorityKeys;
     }
     ensureCustomer(params, options) {
         return this.client.request('POST', '/v1/billing/customers', { body: params, idempotencyKey: options.idempotencyKey });
@@ -16,6 +20,55 @@ class BillingResource {
         return this.client.request('POST', '/v1/billing/portal_sessions', { body: params, idempotencyKey: options.idempotencyKey });
     }
     retrieveCheckout(ref) { return this.client.request('GET', `/v1/billing/checkout_sessions/${encodeURIComponent(ref)}`); }
+    async createTaxQuote(params) {
+        if (!this.taxQuoteAuthorityKeys || Object.keys(this.taxQuoteAuthorityKeys).length === 0)
+            throw new Error('Peable: tax quote authority verification is unconfigured');
+        const result = await this.client.request('POST', '/v1/billing/tax_quotes', { body: params });
+        try {
+            const pinned = this.taxQuoteAuthorityKeys[result.signature.keyId];
+            if (!pinned || result.schemaVersion !== 1 || result.signature.algorithm !== 'Ed25519' || !/^[A-Za-z0-9_-]{86}$/.test(result.signature.value)
+                || result.source.storeId !== params.storeId || result.source.planId !== params.planId || result.quote.customerLocationEvidenceId !== params.customerLocationEvidenceId
+                || !Number.isFinite(Date.parse(result.quote.quotedAt)) || Date.parse(result.quote.quotedAt) > Date.now()
+                || !Number.isFinite(Date.parse(result.quote.expiresAt)) || Date.parse(result.quote.expiresAt) <= Date.now())
+                throw new Error('Invalid quote');
+            const key = (0, node_crypto_1.createPublicKey)(pinned);
+            if (key.asymmetricKeyType !== 'ed25519' || !(0, node_crypto_1.verify)(null, Buffer.from((0, shared_types_1.canonicalBillingTaxQuote)(result)), key, Buffer.from(result.signature.value, 'base64url')))
+                throw new Error('Invalid signature');
+        }
+        catch {
+            throw new Error('Peable: tax quote authority verification failed');
+        }
+        return result;
+    }
+    async retrieveFinalInvoiceAuthority(subscriptionRef, invoiceRef) {
+        if (!this.invoiceAuthorityKeys || Object.keys(this.invoiceAuthorityKeys).length === 0)
+            throw new Error('Peable: invoice authority verification is unconfigured');
+        const authority = await this.client.request('GET', `/v1/billing/subscriptions/${encodeURIComponent(subscriptionRef)}/invoice_authorities/${encodeURIComponent(invoiceRef)}`);
+        try {
+            const pinnedKey = this.invoiceAuthorityKeys[authority.signature.keyId];
+            if (authority.schemaVersion !== 1 || !pinnedKey || authority.signature.algorithm !== 'Ed25519' || !/^[A-Za-z0-9_-]{86}$/.test(authority.signature.value)
+                || authority.source.invoiceId !== invoiceRef || authority.source.subscriptionId !== subscriptionRef
+                || authority.invoice.context.providerSubscriptionId !== subscriptionRef
+                || !['card', 'faircoin'].includes(authority.method)
+                || !Number.isFinite(Date.parse(authority.invoice.issuedAt)) || Date.parse(authority.invoice.issuedAt) > Date.now()
+                || !Number.isFinite(Date.parse(authority.invoice.expiresAt)) || Date.parse(authority.invoice.expiresAt) <= Date.now())
+                throw new Error('Invalid authority');
+            if (authority.method === 'faircoin') {
+                const quote = authority.invoice.faircoinQuote;
+                if (!quote || !/^[1-9][0-9]*$/.test(quote.amountBaseUnits) || !Number.isFinite(Date.parse(quote.quotedAt))
+                    || Date.parse(quote.quotedAt) > Date.now() || !Number.isFinite(Date.parse(quote.expiresAt))
+                    || Date.parse(quote.expiresAt) <= Date.now() || Date.parse(quote.expiresAt) > Date.parse(authority.invoice.expiresAt))
+                    throw new Error('Invalid quote');
+            }
+            const key = (0, node_crypto_1.createPublicKey)(pinnedKey);
+            if (key.asymmetricKeyType !== 'ed25519' || !(0, node_crypto_1.verify)(null, Buffer.from((0, shared_types_1.canonicalBillingAuthority)(authority), 'utf8'), key, Buffer.from(authority.signature.value, 'base64url')))
+                throw new Error('Invalid signature');
+        }
+        catch {
+            throw new Error('Peable: invoice authority verification failed');
+        }
+        return authority;
+    }
     retrievePaidInvoice(subscriptionRef, invoiceRef) { return this.client.request('GET', `/v1/billing/subscriptions/${encodeURIComponent(subscriptionRef)}/paid_invoices/${encodeURIComponent(invoiceRef)}`); }
     retrieveInvoiceState(subscriptionRef, invoiceRef) { return this.client.request('GET', `/v1/billing/subscriptions/${encodeURIComponent(subscriptionRef)}/invoice_states/${encodeURIComponent(invoiceRef)}`); }
     retrieveSubscription(ref) {

package/dist/esm/core/config.js

@@ -36,6 +36,8 @@ export function resolveConfig(config) {
     }
     return {
         requestTimeoutMs: resolveRequestTimeout(config.requestTimeoutMs),
+        taxQuoteAuthorityKeys: config.taxQuoteAuthorityKeys ? Object.freeze({ ...config.taxQuoteAuthorityKeys }) : undefined,
+        invoiceAuthorityKeys: config.invoiceAuthorityKeys ? Object.freeze({ ...config.invoiceAuthorityKeys }) : undefined,
         publicKey: config.publicKey,
         secret: config.secret,
         baseURL: stripTrailingSlash(config.baseURL ?? DEFAULT_GATEWAY_BASE_URL),

package/dist/esm/index.js

@@ -38,7 +38,7 @@ export class Peable {
         const resolved = resolveConfig(config);
         const tokenProvider = createServiceTokenProvider(config);
         const client = createRestClient({ baseURL: resolved.baseURL, requestTimeoutMs: resolved.requestTimeoutMs }, tokenProvider);
-        this.billing = new BillingResource(client);
+        this.billing = new BillingResource(client, resolved.invoiceAuthorityKeys, resolved.taxQuoteAuthorityKeys);
         this.paymentIntents = new PaymentIntentsResource(client);
         this.paymentLinks = new PaymentLinksResource(client);
         this.checkout = new CheckoutResource(client);

package/dist/esm/resources/billing.js

@@ -1,7 +1,11 @@
+import { createPublicKey, verify } from 'node:crypto';
+import { canonicalBillingAuthority, canonicalBillingTaxQuote } from '@peable.to/shared-types';
 /** Recurring billing is separate from one-off checkout and marketplace transfers. */
 export class BillingResource {
-    constructor(client) {
+    constructor(client, invoiceAuthorityKeys, taxQuoteAuthorityKeys) {
         this.client = client;
+        this.invoiceAuthorityKeys = invoiceAuthorityKeys;
+        this.taxQuoteAuthorityKeys = taxQuoteAuthorityKeys;
     }
     ensureCustomer(params, options) {
         return this.client.request('POST', '/v1/billing/customers', { body: params, idempotencyKey: options.idempotencyKey });
@@ -13,6 +17,55 @@ export class BillingResource {
         return this.client.request('POST', '/v1/billing/portal_sessions', { body: params, idempotencyKey: options.idempotencyKey });
     }
     retrieveCheckout(ref) { return this.client.request('GET', `/v1/billing/checkout_sessions/${encodeURIComponent(ref)}`); }
+    async createTaxQuote(params) {
+        if (!this.taxQuoteAuthorityKeys || Object.keys(this.taxQuoteAuthorityKeys).length === 0)
+            throw new Error('Peable: tax quote authority verification is unconfigured');
+        const result = await this.client.request('POST', '/v1/billing/tax_quotes', { body: params });
+        try {
+            const pinned = this.taxQuoteAuthorityKeys[result.signature.keyId];
+            if (!pinned || result.schemaVersion !== 1 || result.signature.algorithm !== 'Ed25519' || !/^[A-Za-z0-9_-]{86}$/.test(result.signature.value)
+                || result.source.storeId !== params.storeId || result.source.planId !== params.planId || result.quote.customerLocationEvidenceId !== params.customerLocationEvidenceId
+                || !Number.isFinite(Date.parse(result.quote.quotedAt)) || Date.parse(result.quote.quotedAt) > Date.now()
+                || !Number.isFinite(Date.parse(result.quote.expiresAt)) || Date.parse(result.quote.expiresAt) <= Date.now())
+                throw new Error('Invalid quote');
+            const key = createPublicKey(pinned);
+            if (key.asymmetricKeyType !== 'ed25519' || !verify(null, Buffer.from(canonicalBillingTaxQuote(result)), key, Buffer.from(result.signature.value, 'base64url')))
+                throw new Error('Invalid signature');
+        }
+        catch {
+            throw new Error('Peable: tax quote authority verification failed');
+        }
+        return result;
+    }
+    async retrieveFinalInvoiceAuthority(subscriptionRef, invoiceRef) {
+        if (!this.invoiceAuthorityKeys || Object.keys(this.invoiceAuthorityKeys).length === 0)
+            throw new Error('Peable: invoice authority verification is unconfigured');
+        const authority = await this.client.request('GET', `/v1/billing/subscriptions/${encodeURIComponent(subscriptionRef)}/invoice_authorities/${encodeURIComponent(invoiceRef)}`);
+        try {
+            const pinnedKey = this.invoiceAuthorityKeys[authority.signature.keyId];
+            if (authority.schemaVersion !== 1 || !pinnedKey || authority.signature.algorithm !== 'Ed25519' || !/^[A-Za-z0-9_-]{86}$/.test(authority.signature.value)
+                || authority.source.invoiceId !== invoiceRef || authority.source.subscriptionId !== subscriptionRef
+                || authority.invoice.context.providerSubscriptionId !== subscriptionRef
+                || !['card', 'faircoin'].includes(authority.method)
+                || !Number.isFinite(Date.parse(authority.invoice.issuedAt)) || Date.parse(authority.invoice.issuedAt) > Date.now()
+                || !Number.isFinite(Date.parse(authority.invoice.expiresAt)) || Date.parse(authority.invoice.expiresAt) <= Date.now())
+                throw new Error('Invalid authority');
+            if (authority.method === 'faircoin') {
+                const quote = authority.invoice.faircoinQuote;
+                if (!quote || !/^[1-9][0-9]*$/.test(quote.amountBaseUnits) || !Number.isFinite(Date.parse(quote.quotedAt))
+                    || Date.parse(quote.quotedAt) > Date.now() || !Number.isFinite(Date.parse(quote.expiresAt))
+                    || Date.parse(quote.expiresAt) <= Date.now() || Date.parse(quote.expiresAt) > Date.parse(authority.invoice.expiresAt))
+                    throw new Error('Invalid quote');
+            }
+            const key = createPublicKey(pinnedKey);
+            if (key.asymmetricKeyType !== 'ed25519' || !verify(null, Buffer.from(canonicalBillingAuthority(authority), 'utf8'), key, Buffer.from(authority.signature.value, 'base64url')))
+                throw new Error('Invalid signature');
+        }
+        catch {
+            throw new Error('Peable: invoice authority verification failed');
+        }
+        return authority;
+    }
     retrievePaidInvoice(subscriptionRef, invoiceRef) { return this.client.request('GET', `/v1/billing/subscriptions/${encodeURIComponent(subscriptionRef)}/paid_invoices/${encodeURIComponent(invoiceRef)}`); }
     retrieveInvoiceState(subscriptionRef, invoiceRef) { return this.client.request('GET', `/v1/billing/subscriptions/${encodeURIComponent(subscriptionRef)}/invoice_states/${encodeURIComponent(invoiceRef)}`); }
     retrieveSubscription(ref) {

package/dist/types/core/config.d.ts

@@ -15,6 +15,9 @@ export interface PeableConfig {
     oxyApiUrl?: string;
     /** Optional deadline per HTTP attempt, including body consumption. */
     requestTimeoutMs?: number;
+    /** Pinned Ed25519 authority keys, obtained from trusted deployment configuration. */
+    invoiceAuthorityKeys?: Readonly<Record<string, string>>;
+    taxQuoteAuthorityKeys?: Readonly<Record<string, string>>;
 }
 /** `PeableConfig` with every optional field defaulted and normalized. */
 export interface ResolvedPeableConfig {
@@ -23,6 +26,8 @@ export interface ResolvedPeableConfig {
     baseURL: string;
     oxyApiUrl: string;
     requestTimeoutMs?: number;
+    invoiceAuthorityKeys?: Readonly<Record<string, string>>;
+    taxQuoteAuthorityKeys?: Readonly<Record<string, string>>;
 }
 export declare function resolveRequestTimeout(value: number | undefined): number | undefined;
 /**

package/dist/types/index.d.ts

@@ -1,6 +1,6 @@
 import { BillingResource } from './resources/billing';
 export type { BillingRequestOptions } from './resources/billing';
-export type { BillingObservation, BillingCustomer, BillingHostedSession, BillingCheckoutSession, BillingCheckoutObservation, BillingPaidInvoice, BillingInvoiceState, BillingSubscription, CreateBillingCheckoutParams, CreateBillingPortalParams, EnsureBillingCustomerParams } from '@peable.to/shared-types';
+export type { CreateBillingTaxQuoteParams, BillingTaxQuote, BillingInvoiceAuthoritySource, BillingFinalInvoice, BillingFinalInvoiceAuthority, BillingFaircoinRenewalChoice, BillingFaircoinRenewalConsent, BillingFaircoinRenewalRevocation, BillingObservation, BillingCustomer, BillingHostedSession, BillingCheckoutSession, BillingCheckoutObservation, BillingPaidInvoice, BillingInvoiceState, BillingSubscription, CreateBillingCheckoutParams, CreateBillingPortalParams, EnsureBillingCustomerParams } from '@peable.to/shared-types';
 import { type PeableConfig } from './core/config';
 import { PaymentIntentsResource } from './resources/paymentIntents';
 import { PaymentLinksResource } from './resources/paymentLinks';

package/dist/types/resources/billing.d.ts

@@ -1,4 +1,4 @@
-import type { BillingCustomer, BillingHostedSession, BillingCheckoutSession, BillingCheckoutObservation, BillingPaidInvoice, BillingInvoiceState, BillingSubscription, CreateBillingCheckoutParams, CreateBillingPortalParams, EnsureBillingCustomerParams } from '@peable.to/shared-types';
+import type { BillingTaxQuote, CreateBillingTaxQuoteParams, BillingFinalInvoiceAuthority, BillingCustomer, BillingHostedSession, BillingCheckoutSession, BillingCheckoutObservation, BillingPaidInvoice, BillingInvoiceState, BillingSubscription, CreateBillingCheckoutParams, CreateBillingPortalParams, EnsureBillingCustomerParams } from '@peable.to/shared-types';
 import type { RestClient } from '../core/client';
 export interface BillingRequestOptions {
     idempotencyKey: string;
@@ -6,11 +6,15 @@ export interface BillingRequestOptions {
 /** Recurring billing is separate from one-off checkout and marketplace transfers. */
 export declare class BillingResource {
     private readonly client;
-    constructor(client: RestClient);
+    private readonly invoiceAuthorityKeys?;
+    private readonly taxQuoteAuthorityKeys?;
+    constructor(client: RestClient, invoiceAuthorityKeys?: Readonly<Record<string, string>> | undefined, taxQuoteAuthorityKeys?: Readonly<Record<string, string>> | undefined);
     ensureCustomer(params: EnsureBillingCustomerParams, options: BillingRequestOptions): Promise<BillingCustomer>;
     createCheckoutSession(params: CreateBillingCheckoutParams, options: BillingRequestOptions): Promise<BillingCheckoutSession>;
     createPortalSession(params: CreateBillingPortalParams, options: BillingRequestOptions): Promise<BillingHostedSession>;
     retrieveCheckout(ref: string): Promise<BillingCheckoutObservation>;
+    createTaxQuote(params: CreateBillingTaxQuoteParams): Promise<BillingTaxQuote>;
+    retrieveFinalInvoiceAuthority(subscriptionRef: string, invoiceRef: string): Promise<BillingFinalInvoiceAuthority>;
     retrievePaidInvoice(subscriptionRef: string, invoiceRef: string): Promise<BillingPaidInvoice>;
     retrieveInvoiceState(subscriptionRef: string, invoiceRef: string): Promise<BillingInvoiceState>;
     retrieveSubscription(ref: string): Promise<BillingSubscription>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peable.to/sdk",
-  "version": "0.2.3-oxy-one.0",
+  "version": "0.2.4-oxy-one.0",
   "description": "Peable SDK — a Stripe-ergonomics TypeScript client over the Peable Gateway REST + realtime contract. Server entry (`@peable.to/sdk`) mints Oxy service tokens from an ApplicationCredential and exposes paymentIntents/paymentLinks/checkout.sessions/webhooks; browser entry (`@peable.to/sdk/checkout`) is the anonymous payer-side client core.",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -73,7 +73,7 @@
     "prepublishOnly": "bun run clean && bun run build"
   },
   "dependencies": {
-    "@peable.to/shared-types": "0.3.1-oxy-one.0",
+    "@peable.to/shared-types": "0.3.2-oxy-one.0",
     "qrcode-generator": "^2.0.4",
     "socket.io-client": "^4.8.3"
   },