@sakeetech/vendure-payment-viva 0.2.1

package/dist/api/shop-api.resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shop-api.resolver.js","sourceRoot":"","sources":["../../src/api/shop-api.resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;;;;;;;;;;;;;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EACL,GAAG,EACH,cAAc,EACd,YAAY,EACZ,cAAc,EACd,uBAAuB,EACvB,MAAM,GACP,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExE,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAExE,8EAA8E;AAC9E,6CAA6C;AAC7C,8EAA8E;AAE9E,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAEzG,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAE9E,SAAS,kBAAkB,CAAC,IAK3B;IACC,OAAO;QACL,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5F,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAGvE,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAEX;IACA;IACA;IACA;IAC6B;IALhD,YACmB,YAA0B,EAC1B,cAA8B,EAC9B,UAAmC,EACnC,YAAiC,EACJ,OAAiC;QAJ9D,iBAAY,GAAZ,YAAY,CAAc;QAC1B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,eAAU,GAAV,UAAU,CAAyB;QACnC,iBAAY,GAAZ,YAAY,CAAqB;QACJ,YAAO,GAAP,OAAO,CAA0B;IAC9E,CAAC;IAGE,AAAN,KAAK,CAAC,aAAa,CACE,SAAiB,EAC7B,GAAmB;QAE1B,4EAA4E;QAC5E,oDAAoD;QACpD,4EAA4E;QAC5E,IAAI,OAA4B,CAAC;QACjC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,GAAG,EAAE,SAAgB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;YACP,oBAAoB;QACtB,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,kBAAkB,CAAC;gBACxB,SAAS,EAAE,8BAA8B;gBACzC,OAAO,EAAE,oBAAoB;aAC9B,CAAC,CAAC;QACL,CAAC;QAED,4EAA4E;QAC5E,mEAAmE;QACnE,4EAA4E;QAC5E,MAAM,SAAS,GAAI,OAAe,CAAC,KAA0B,CAAC;QAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,kBAAkB,CAAC;gBACxB,SAAS,EAAE,8BAA8B;gBACzC,OAAO,EAAE,0CAA0C;aACpD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;QAChG,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,kBAAkB,CAAC;gBACxB,SAAS,EAAE,8BAA8B;gBACzC,OAAO,EAAE,kBAAkB;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,4EAA4E;QAC5E,4CAA4C;QAC5C,EAAE;QACF,mFAAmF;QACnF,qEAAqE;QACrE,wEAAwE;QACxE,4EAA4E;QAC5E,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,kBAAkB,CAAC;gBACxB,SAAS,EAAE,sBAAsB;gBACjC,OAAO,EAAE,wCAAwC;aAClD,CAAC,CAAC;QACL,CAAC;QAED,4EAA4E;QAC5E,oCAAoC;QACpC,4EAA4E;QAC5E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAE1F,4EAA4E;QAC5E,0CAA0C;QAC1C,4EAA4E;QAC5E,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YACvC,OAAO,kBAAkB,CAAC;gBACxB,SAAS,EAAE,8BAA8B;gBACzC,OAAO,EAAE,iEAAiE;aAC3E,CAAC,CAAC;QACL,CAAC;QAED,4EAA4E;QAC5E,yEAAyE;QACzE,4EAA4E;QAC5E,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,OAAO,kBAAkB,CAAC;gBACxB,SAAS,EAAE,8BAA8B;gBACzC,OAAO,EAAE,yCAAyC,OAAO,CAAC,MAAM,GAAG;aACpE,CAAC,CAAC;QACL,CAAC;QAED,4EAA4E;QAC5E,wEAAwE;QACxE,yDAAyD;QACzD,4EAA4E;QAC5E,IAAI,CAAC;YACH,iEAAiE;YACjE,MAAO,wBAAgC,CAAC,eAAe,CACrD,GAAG,EACH,KAAK,EACL,OAAO,EACP,EAAE,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;gBACnC,OAAO,kBAAkB,CAAC;oBACxB,SAAS,EAAE,GAAG,CAAC,IAAI;oBACnB,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChF,GAAG,CAAC,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1F,CAAC,CAAC;YACL,CAAC;YACD,yCAAyC;YACzC,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,CAAC,kDAAkD,SAAS,KAAK,GAAG,EAAE,EAAE,gBAAgB,CAAC,CAAC;YACtG,OAAO,kBAAkB,CAAC;gBACxB,SAAS,EAAE,qBAAqB;gBAChC,OAAO,EAAE,4DAA4D;aACtE,CAAC,CAAC;QACL,CAAC;QAED,4EAA4E;QAC5E,+CAA+C;QAC/C,4EAA4E;QAC5E,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QACtE,IAAI,cAAc,IAAI,cAAc,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;YAC7D,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,aAAoB,CAAC,CAAC;YACjF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,+EAA+E;gBAC/E,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,CAAC,IAAI,CACT,qEAAqE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,GAAG,IAAI;oBACjG,4DAA4D,EAC5D,gBAAgB,CACjB,CAAC;gBACF,yBAAyB;gBACzB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;gBACpE,IAAI,YAAY,IAAI,YAAY,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;oBACzD,OAAO,kBAAkB,CAAC;wBACxB,SAAS,EAAE,qBAAqB;wBAChC,OAAO,EAAE,8CAA8C,GAAG,EAAE;qBAC7D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,mCAAmC;QACnC,4EAA4E;QAC5E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,GAAG,CAAC,UAAU,IAAI,KAAK,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IAC3D,CAAC;IAED,8EAA8E;IAC9E,gCAAgC;IAChC,EAAE;IACF,mCAAmC;IACnC,0EAA0E;IAC1E,2EAA2E;IAC3E,4DAA4D;IAC5D,8EAA8E;IAEtE,KAAK,CAAC,aAAa,CAAC,GAAmB,EAAE,KAAY;QAC3D,iCAAiC;QACjC,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;YACrB,MAAM,mBAAmB,GAAI,KAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;YAC9D,IAAI,mBAAmB,KAAK,SAAS,IAAI,mBAAmB,KAAK,IAAI,EAAE,CAAC;gBACtE,OAAO,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAClE,CAAC;YACD,iFAAiF;QACnF,CAAC;QAED,gEAAgE;QAChE,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,EAAS,CAAC,CAAC;YACrG,IAAI,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC/D,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;QAED,yFAAyF;QACzF,MAAM,oBAAoB,GAAI,GAAW,CAAC,OAAO,EAAE,aAAa,CAAC;QACjE,IAAI,oBAAoB,KAAK,SAAS,IAAI,oBAAoB,KAAK,IAAI,EAAE,CAAC;YACxE,OAAO,MAAM,CAAC,oBAAoB,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAA;AApLO;IADL,QAAQ,EAAE;IAER,WAAA,IAAI,CAAC,WAAW,CAAC,CAAA;IACjB,WAAA,GAAG,EAAE,CAAA;;6CAAM,cAAc;;wDA2I3B;AAvJU,mBAAmB;IAD/B,QAAQ,EAAE;IAON,WAAA,MAAM,CAAC,mBAAmB,CAAC,CAAA;qCAJG,YAAY;QACV,cAAc;QAClB,uBAAuB;QACrB,mBAAmB;GALzC,mBAAmB,CA8L/B"}

package/dist/api/webhook.controller.d.ts

@@ -0,0 +1,58 @@
+/**
+ * api/webhook.controller.ts — Viva Wallet webhook receiver.
+ *
+ * Handles two routes:
+ *
+ *   GET  /viva/webhook  — URL-verification handshake (no auth gate).
+ *                         Returns {"key":"<webhookVerificationKey>"} to prove
+ *                         ownership to Viva at registration time.
+ *
+ *   POST /viva/webhook  — Receive Viva event.
+ *                         1. IP allowlist check.
+ *                         2. Parse + validate envelope.
+ *                         3. INSERT-OR-IGNORE into viva_webhook_event.
+ *                         4. Enqueue BullMQ job if newly inserted (dedup).
+ *                         5. Always return 200 {"ok":true}.
+ *
+ * Latency target: <100ms server-side — no Viva API call in this path.
+ *
+ * @see docs/plans/vendure-plugin-v0.md §"Webhook Design — Receive flow"
+ * @see docs/plans/vendure-plugin-v0.md §"Build Plan — V6"
+ * @see docs/VENDURE-CONTRACT.MD §4 "Webhook receiver"
+ */
+import type { OnModuleInit } from '@nestjs/common';
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { TransactionalConnection, JobQueueService } from '@vendure/core';
+import type { VivaPaymentPluginOptions } from '../types.js';
+export declare class WebhookController implements OnModuleInit {
+    private readonly options;
+    private readonly connection;
+    private readonly jobQueueService;
+    /**
+     * BullMQ job queue — created once in onModuleInit, reused per-request.
+     * The actual processing logic is implemented in V7's job handler.
+     */
+    private webhookQueue;
+    constructor(options: VivaPaymentPluginOptions, connection: TransactionalConnection, jobQueueService: JobQueueService);
+    onModuleInit(): Promise<void>;
+    /**
+     * Viva calls this endpoint anonymously during webhook registration to verify
+     * ownership of the URL. We return the verification key from plugin options.
+     *
+     * No auth gate — Viva calls this without credentials.
+     * @see docs/VENDURE-CONTRACT.MD §4 (URL-verification handshake)
+     */
+    handleVerification(res: ServerResponse): void;
+    /**
+     * Main receive path:
+     * 1. IP allowlist check → 403 if blocked.
+     * 2. Envelope parse → 400 if malformed.
+     * 3. INSERT-OR-IGNORE into viva_webhook_event.
+     * 4. Enqueue job if newly inserted; skip if replay.
+     * 5. Always 200 {"ok":true}.
+     */
+    handleEvent(req: IncomingMessage & {
+        body?: unknown;
+    }, res: ServerResponse): Promise<void>;
+}
+//# sourceMappingURL=webhook.controller.d.ts.map

package/dist/api/webhook.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.controller.d.ts","sourceRoot":"","sources":["../../src/api/webhook.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAUH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EACL,uBAAuB,EAEvB,eAAe,EAChB,MAAM,eAAe,CAAC;AAIvB,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAwB5D,qBACa,iBAAkB,YAAW,YAAY;IASlD,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAVlC;;;OAGG;IACH,OAAO,CAAC,YAAY,CAAuC;gBAIxC,OAAO,EAAE,wBAAwB,EACjC,UAAU,EAAE,uBAAuB,EACnC,eAAe,EAAE,eAAe;IAG7C,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAgBnC;;;;;;OAMG;IAEH,kBAAkB,CAAQ,GAAG,EAAE,cAAc,GAAG,IAAI;IAqBpD;;;;;;;OAOG;IAEG,WAAW,CACR,GAAG,EAAE,eAAe,GAAG;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,EACzC,GAAG,EAAE,cAAc,GACzB,OAAO,CAAC,IAAI,CAAC;CAsGjB"}

package/dist/api/webhook.controller.js

@@ -0,0 +1,204 @@
+/**
+ * api/webhook.controller.ts — Viva Wallet webhook receiver.
+ *
+ * Handles two routes:
+ *
+ *   GET  /viva/webhook  — URL-verification handshake (no auth gate).
+ *                         Returns {"key":"<webhookVerificationKey>"} to prove
+ *                         ownership to Viva at registration time.
+ *
+ *   POST /viva/webhook  — Receive Viva event.
+ *                         1. IP allowlist check.
+ *                         2. Parse + validate envelope.
+ *                         3. INSERT-OR-IGNORE into viva_webhook_event.
+ *                         4. Enqueue BullMQ job if newly inserted (dedup).
+ *                         5. Always return 200 {"ok":true}.
+ *
+ * Latency target: <100ms server-side — no Viva API call in this path.
+ *
+ * @see docs/plans/vendure-plugin-v0.md §"Webhook Design — Receive flow"
+ * @see docs/plans/vendure-plugin-v0.md §"Build Plan — V6"
+ * @see docs/VENDURE-CONTRACT.MD §4 "Webhook receiver"
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Controller, Get, Post, Req, Res, Inject, } from '@nestjs/common';
+import { TransactionalConnection, Logger, JobQueueService, } from '@vendure/core';
+import { VIVA_PLUGIN_OPTIONS, VIVA_LOG_CONTEXT } from '../constants.js';
+import { VivaWebhookEvent } from '../entities/viva-webhook-event.entity.js';
+import { isIpAllowed, getSourceIp } from '../util/ip-allowlist.js';
+import { VIVA_PROCESS_EVENT_JOB, VIVA_WEBHOOK_QUEUE } from '../jobs/queue-names.js';
+// ---------------------------------------------------------------------------
+// Controller
+// ---------------------------------------------------------------------------
+let WebhookController = class WebhookController {
+    options;
+    connection;
+    jobQueueService;
+    /**
+     * BullMQ job queue — created once in onModuleInit, reused per-request.
+     * The actual processing logic is implemented in V7's job handler.
+     */
+    webhookQueue;
+    constructor(options, connection, jobQueueService) {
+        this.options = options;
+        this.connection = connection;
+        this.jobQueueService = jobQueueService;
+    }
+    async onModuleInit() {
+        // Create the queue once at startup. V7 will register the process handler;
+        // here we provide a no-op so the queue can be used for add() calls.
+        this.webhookQueue = await this.jobQueueService.createQueue({
+            name: VIVA_WEBHOOK_QUEUE,
+            process: async (_job) => {
+                // V7 implements the actual handler (process-viva-webhook.handler.ts).
+                // This stub satisfies Vendure's queue registration requirement.
+            },
+        });
+    }
+    // -------------------------------------------------------------------------
+    // GET /viva/webhook — URL-verification handshake
+    // -------------------------------------------------------------------------
+    /**
+     * Viva calls this endpoint anonymously during webhook registration to verify
+     * ownership of the URL. We return the verification key from plugin options.
+     *
+     * No auth gate — Viva calls this without credentials.
+     * @see docs/VENDURE-CONTRACT.MD §4 (URL-verification handshake)
+     */
+    handleVerification(res) {
+        const key = this.options.webhookVerificationKey;
+        if (!key) {
+            Logger.warn('webhookVerificationKey is not configured — returning 503. Set VIVA_WEBHOOK_VERIFICATION_KEY.', VIVA_LOG_CONTEXT);
+            res.writeHead(503, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'webhook key not configured' }));
+            return;
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ key }));
+    }
+    // -------------------------------------------------------------------------
+    // POST /viva/webhook — Receive event
+    // -------------------------------------------------------------------------
+    /**
+     * Main receive path:
+     * 1. IP allowlist check → 403 if blocked.
+     * 2. Envelope parse → 400 if malformed.
+     * 3. INSERT-OR-IGNORE into viva_webhook_event.
+     * 4. Enqueue job if newly inserted; skip if replay.
+     * 5. Always 200 {"ok":true}.
+     */
+    async handleEvent(req, res) {
+        // ------------------------------------------------------------------
+        // 1. IP allowlist (CSO Finding #2)
+        // ------------------------------------------------------------------
+        // trustedProxyDepth tells the helper how many trailing X-Forwarded-For
+        // hops are set by operator-controlled proxies; the leftmost (attacker-
+        // controllable) entries are ignored.
+        const sourceIp = getSourceIp(req, this.options.trustedProxyDepth ?? 0);
+        const allowlist = this.options.webhookIpAllowlist;
+        if (!isIpAllowed(sourceIp, allowlist)) {
+            Logger.warn(`Webhook POST rejected: source IP ${sourceIp} not in allowlist.`, VIVA_LOG_CONTEXT);
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'forbidden' }));
+            return;
+        }
+        // ------------------------------------------------------------------
+        // 2. Parse envelope
+        // ------------------------------------------------------------------
+        const body = req.body;
+        if (!body || typeof body.MessageId !== 'string' || !body.MessageId) {
+            Logger.warn('Webhook POST: missing or invalid MessageId.', VIVA_LOG_CONTEXT);
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'malformed envelope' }));
+            return;
+        }
+        if (typeof body.EventTypeId !== 'number' || !body.EventTypeId) {
+            Logger.warn(`Webhook POST: missing or invalid EventTypeId for MessageId=${body.MessageId}.`, VIVA_LOG_CONTEXT);
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'malformed envelope' }));
+            return;
+        }
+        const messageId = body.MessageId;
+        const eventTypeId = body.EventTypeId;
+        const eventData = (body.EventData ?? {});
+        // ------------------------------------------------------------------
+        // 3. INSERT-OR-IGNORE into viva_webhook_event
+        // ------------------------------------------------------------------
+        const repo = this.connection.rawConnection.getRepository(VivaWebhookEvent);
+        const insertResult = await repo
+            .createQueryBuilder()
+            .insert()
+            .into(VivaWebhookEvent)
+            .values({
+            messageId,
+            eventTypeId,
+            merchantId: eventData['MerchantId'] ?? null,
+            transactionId: eventData['TransactionId'] ?? null,
+            accountId: eventData['AccountId'] ?? null,
+            correlationId: body.CorrelationId ?? null,
+            retryCount: body.RetryCount ?? 0,
+            // Cast to any: TypeORM's _QueryDeepPartialEntity doesn't accept
+            // plain objects for jsonb columns — the value is serialised correctly
+            // at the driver level.
+            payload: body,
+        })
+            .orIgnore()
+            .execute();
+        const rowsInserted = insertResult.identifiers.length;
+        // ------------------------------------------------------------------
+        // 4. Deduplicate — already processed replay
+        // ------------------------------------------------------------------
+        if (rowsInserted === 0) {
+            Logger.debug(`Webhook POST: duplicate MessageId=${messageId} (replay) — skipping enqueue.`, VIVA_LOG_CONTEXT);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ ok: true }));
+            return;
+        }
+        // ------------------------------------------------------------------
+        // 5. Enqueue BullMQ job (resilient — 200 even if enqueue fails)
+        // ------------------------------------------------------------------
+        try {
+            await this.webhookQueue.add({ messageId });
+        }
+        catch (err) {
+            // Row is persisted; V7's worker can pick it up via reprocess logic (A6).
+            Logger.warn(`Webhook POST: job enqueue failed for MessageId=${messageId}. Row persisted; worker will retry. Error: ${String(err)}`, VIVA_LOG_CONTEXT);
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: true }));
+    }
+};
+__decorate([
+    Get(),
+    __param(0, Res()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Function]),
+    __metadata("design:returntype", void 0)
+], WebhookController.prototype, "handleVerification", null);
+__decorate([
+    Post(),
+    __param(0, Req()),
+    __param(1, Res()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Function]),
+    __metadata("design:returntype", Promise)
+], WebhookController.prototype, "handleEvent", null);
+WebhookController = __decorate([
+    Controller('viva/webhook'),
+    __param(0, Inject(VIVA_PLUGIN_OPTIONS)),
+    __metadata("design:paramtypes", [Object, TransactionalConnection,
+        JobQueueService])
+], WebhookController);
+export { WebhookController };
+//# sourceMappingURL=webhook.controller.js.map

package/dist/api/webhook.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.controller.js","sourceRoot":"","sources":["../../src/api/webhook.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;;;;;;;;;;;;AAEH,OAAO,EACL,UAAU,EACV,GAAG,EACH,IAAI,EACJ,GAAG,EACH,GAAG,EACH,MAAM,GACP,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,uBAAuB,EACvB,MAAM,EACN,eAAe,GAChB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAiBpF,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAGvE,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAST;IACA;IACA;IAVnB;;;OAGG;IACK,YAAY,CAAuC;IAE3D,YAEmB,OAAiC,EACjC,UAAmC,EACnC,eAAgC;QAFhC,YAAO,GAAP,OAAO,CAA0B;QACjC,eAAU,GAAV,UAAU,CAAyB;QACnC,oBAAe,GAAf,eAAe,CAAiB;IAChD,CAAC;IAEJ,KAAK,CAAC,YAAY;QAChB,0EAA0E;QAC1E,oEAAoE;QACpE,IAAI,CAAC,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAA4B;YACpF,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACtB,sEAAsE;gBACtE,gEAAgE;YAClE,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,iDAAiD;IACjD,4EAA4E;IAE5E;;;;;;OAMG;IAEH,kBAAkB,CAAQ,GAAmB;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC;QAEhD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CACT,8FAA8F,EAC9F,gBAAgB,CACjB,CAAC;YACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,4EAA4E;IAC5E,qCAAqC;IACrC,4EAA4E;IAE5E;;;;;;;OAOG;IAEG,AAAN,KAAK,CAAC,WAAW,CACR,GAAyC,EACzC,GAAmB;QAE1B,qEAAqE;QACrE,mCAAmC;QACnC,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,qCAAqC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;QAElD,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CACT,oCAAoC,QAAQ,oBAAoB,EAChE,gBAAgB,CACjB,CAAC;YACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,qEAAqE;QACrE,oBAAoB;QACpB,qEAAqE;QACrE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAuC,CAAC;QAEzD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACnE,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE,gBAAgB,CAAC,CAAC;YAC7E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9D,MAAM,CAAC,IAAI,CACT,8DAA8D,IAAI,CAAC,SAAS,GAAG,EAC/E,gBAAgB,CACjB,CAAC;YACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAA4B,CAAC;QAEpE,qEAAqE;QACrE,8CAA8C;QAC9C,qEAAqE;QACrE,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAE3E,MAAM,YAAY,GAAG,MAAM,IAAI;aAC5B,kBAAkB,EAAE;aACpB,MAAM,EAAE;aACR,IAAI,CAAC,gBAAgB,CAAC;aACtB,MAAM,CAAC;YACN,SAAS;YACT,WAAW;YACX,UAAU,EAAG,SAAS,CAAC,YAAY,CAAwB,IAAI,IAAI;YACnE,aAAa,EAAG,SAAS,CAAC,eAAe,CAAwB,IAAI,IAAI;YACzE,SAAS,EAAG,SAAS,CAAC,WAAW,CAAwB,IAAI,IAAI;YACjE,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;YACzC,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC;YAChC,gEAAgE;YAChE,sEAAsE;YACtE,uBAAuB;YACvB,OAAO,EAAE,IAAW;SACrB,CAAC;aACD,QAAQ,EAAE;aACV,OAAO,EAAE,CAAC;QAEb,MAAM,YAAY,GAAG,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC;QAErD,qEAAqE;QACrE,4CAA4C;QAC5C,qEAAqE;QACrE,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,KAAK,CACV,qCAAqC,SAAS,+BAA+B,EAC7E,gBAAgB,CACjB,CAAC;YACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAED,qEAAqE;QACrE,gEAAgE;QAChE,qEAAqE;QACrE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,MAAM,CAAC,IAAI,CACT,kDAAkD,SAAS,8CAA8C,MAAM,CAAC,GAAG,CAAC,EAAE,EACtH,gBAAgB,CACjB,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;CACF,CAAA;AAvIC;IADC,GAAG,EAAE;IACc,WAAA,GAAG,EAAE,CAAA;;;;2DAexB;AAeK;IADL,IAAI,EAAE;IAEJ,WAAA,GAAG,EAAE,CAAA;IACL,WAAA,GAAG,EAAE,CAAA;;;;oDAsGP;AA5KU,iBAAiB;IAD7B,UAAU,CAAC,cAAc,CAAC;IAStB,WAAA,MAAM,CAAC,mBAAmB,CAAC,CAAA;6CAEC,uBAAuB;QAClB,eAAe;GAXxC,iBAAiB,CA6K7B"}

package/dist/cli/bin.d.ts

@@ -0,0 +1,28 @@
+#!/usr/bin/env tsx
+/**
+ * bin.ts — CLI entrypoint for vendure-viva-register-webhooks.
+ *
+ * Parses argv with node:util.parseArgs (zero additional npm dependencies).
+ * Loads plugin config from env vars and delegates to run() from register-webhooks.ts.
+ *
+ * Env vars:
+ *   VIVA_MODE                     merchant | isv (default: isv)
+ *   VIVA_CLIENT_ID                required (ISV mode) — alias VIVA_ISV_CLIENT_ID deprecated
+ *   VIVA_CLIENT_SECRET            required (ISV mode) — alias VIVA_ISV_CLIENT_SECRET deprecated
+ *   VIVA_MERCHANT_ID              required (merchant --apply)
+ *   VIVA_API_KEY                  required (merchant --apply)
+ *   VIVA_ENVIRONMENT              demo | production (default: demo)
+ *   VIVA_WEBHOOK_URL              required for registration (full URL)
+ *   VIVA_WEBHOOK_VERIFICATION_KEY optional in ISV mode; generated if absent
+ *
+ * Verification key note:
+ *   If VIVA_WEBHOOK_VERIFICATION_KEY is not set, the CLI generates a UUIDv4 and
+ *   prints it. You must set this value in your plugin options and env before Viva
+ *   can probe the GET /viva/webhook endpoint for URL verification.
+ *   The key is NOT posted to Viva — Viva fetches it from your endpoint.
+ *
+ * @see docs/plans/vendure-plugin-v0.md §"CLI vendure-viva-register-webhooks" (V10)
+ * @see src/api/webhook.controller.ts (handleVerification)
+ */
+export {};
+//# sourceMappingURL=bin.d.ts.map

package/dist/cli/bin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.d.ts","sourceRoot":"","sources":["../../src/cli/bin.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG"}

package/dist/cli/bin.js

@@ -0,0 +1,104 @@
+#!/usr/bin/env tsx
+/**
+ * bin.ts — CLI entrypoint for vendure-viva-register-webhooks.
+ *
+ * Parses argv with node:util.parseArgs (zero additional npm dependencies).
+ * Loads plugin config from env vars and delegates to run() from register-webhooks.ts.
+ *
+ * Env vars:
+ *   VIVA_MODE                     merchant | isv (default: isv)
+ *   VIVA_CLIENT_ID                required (ISV mode) — alias VIVA_ISV_CLIENT_ID deprecated
+ *   VIVA_CLIENT_SECRET            required (ISV mode) — alias VIVA_ISV_CLIENT_SECRET deprecated
+ *   VIVA_MERCHANT_ID              required (merchant --apply)
+ *   VIVA_API_KEY                  required (merchant --apply)
+ *   VIVA_ENVIRONMENT              demo | production (default: demo)
+ *   VIVA_WEBHOOK_URL              required for registration (full URL)
+ *   VIVA_WEBHOOK_VERIFICATION_KEY optional in ISV mode; generated if absent
+ *
+ * Verification key note:
+ *   If VIVA_WEBHOOK_VERIFICATION_KEY is not set, the CLI generates a UUIDv4 and
+ *   prints it. You must set this value in your plugin options and env before Viva
+ *   can probe the GET /viva/webhook endpoint for URL verification.
+ *   The key is NOT posted to Viva — Viva fetches it from your endpoint.
+ *
+ * @see docs/plans/vendure-plugin-v0.md §"CLI vendure-viva-register-webhooks" (V10)
+ * @see src/api/webhook.controller.ts (handleVerification)
+ */
+import { parseArgs } from 'node:util';
+import { run } from './register-webhooks.js';
+const { values } = parseArgs({
+    options: {
+        'dry-run': { type: 'boolean', default: false },
+        apply: { type: 'boolean', default: false },
+        'webhook-url': { type: 'string' },
+        'reconcile-drift': { type: 'boolean', default: false },
+        output: { type: 'string', default: 'text' },
+        help: { type: 'boolean', default: false, short: 'h' },
+    },
+    strict: true,
+});
+if (values.help) {
+    console.log(`
+vendure-viva-register-webhooks — Set up V1 webhook URLs for the configured Viva account.
+
+Mode is selected by VIVA_MODE (default: isv):
+  - ISV mode:      idempotently POSTs to /isv/v1/webhooks for every event type
+                   (1796, 1797, 1798, 4865, 8193, 8194).
+  - Merchant mode: prints the four transaction-event URLs (1796/1797/1798/4865)
+                   to register manually in Viva Self Care → Sales → API Access
+                   → Webhooks, plus the verification key fetched via
+                   GET /api/messages/config/token.
+
+Usage:
+  vendure-viva-register-webhooks --dry-run [--output json]
+  vendure-viva-register-webhooks --apply [--reconcile-drift]
+  vendure-viva-register-webhooks --apply --webhook-url https://api.example.com/viva/webhook
+
+Environment:
+  VIVA_MODE                     merchant | isv (default: isv)
+  VIVA_ENVIRONMENT              demo | production    (default: demo)
+  VIVA_CLIENT_ID                required for ISV mode (alias: VIVA_ISV_CLIENT_ID, deprecated)
+  VIVA_CLIENT_SECRET            required for ISV mode (alias: VIVA_ISV_CLIENT_SECRET, deprecated)
+  VIVA_MERCHANT_ID              required for merchant --apply (legacy Basic-auth)
+  VIVA_API_KEY                  required for merchant --apply (legacy Basic-auth)
+  VIVA_WEBHOOK_URL              required; full URL to receive webhook POSTs
+  VIVA_WEBHOOK_VERIFICATION_KEY optional in ISV mode; UUIDv4 generated if absent
+
+Notes:
+  --reconcile-drift is non-applicable in merchant mode (manual setup only).
+
+Verification key:
+  - ISV mode: the CLI generates a UUIDv4 if VIVA_WEBHOOK_VERIFICATION_KEY is
+    not set. Set the generated value in your VivaPaymentPlugin.init() options
+    AND in .env. Viva sends a GET probe to your webhook URL during
+    registration; the WebhookController returns {"key":"<that-uuid>"} to
+    prove URL ownership. The key is NOT posted to Viva.
+  - Merchant mode: the CLI fetches the key via GET /api/messages/config/token
+    on the legacy host. Paste the printed value into the same env var.
+
+Exit codes:
+  0  clean / applied successfully / merchant manual setup printed
+  1  plan has actions but --apply was not passed (CI gate use case — ISV mode)
+  2  apply failed (HTTP/Viva error)
+  3  fatal precondition (config invalid, ABORT_LIMIT_HIT)
+`);
+    process.exit(0);
+}
+if (!values['dry-run'] && !values.apply) {
+    console.error('Specify --dry-run or --apply (or --help).');
+    process.exit(3);
+}
+const outputValue = values.output;
+const output = outputValue === 'json' ? 'json' : 'text';
+const runOpts = {
+    dryRun: !!values['dry-run'],
+    apply: !!values.apply,
+    reconcileDrift: !!values['reconcile-drift'],
+    output,
+};
+if (values['webhook-url'] !== undefined) {
+    runOpts.webhookUrl = values['webhook-url'];
+}
+const exitCode = await run(runOpts);
+process.exit(exitCode);
+//# sourceMappingURL=bin.js.map

package/dist/cli/bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../../src/cli/bin.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,GAAG,EAAE,MAAM,wBAAwB,CAAC;AAG7C,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3B,OAAO,EAAE;QACP,SAAS,EAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;QACnD,KAAK,EAAW,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;QACnD,aAAa,EAAG,EAAE,IAAI,EAAE,QAAQ,EAAE;QAClC,iBAAiB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;QACtD,MAAM,EAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE;QACnD,IAAI,EAAY,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE;KAChE;IACD,MAAM,EAAE,IAAI;CACb,CAAC,CAAC;AAEH,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2Cb,CAAC,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACxC,OAAO,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,WAAW,GAAG,MAAM,CAAC,MAAgB,CAAC;AAC5C,MAAM,MAAM,GAAyB,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;AAE9E,MAAM,OAAO,GAAe;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK;IACrB,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC;IAC3C,MAAM;CACP,CAAC;AAEF,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,SAAS,EAAE,CAAC;IACxC,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC;AACpC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC"}

package/dist/cli/plan.d.ts

@@ -0,0 +1,41 @@
+/**
+ * cli/plan.ts — Pure, IO-free webhook plan computation.
+ *
+ * Computes the diff between desired webhook state (from config) and current
+ * registrations (from Viva API), returning a deterministic action list.
+ *
+ * Per Viva docs, max 10 webhook URLs per event type.
+ *
+ * Mirrors medusa-payment-viva/src/cli/plan.ts conventions exactly.
+ *
+ * @see packages/medusa-payment-viva/src/cli/plan.ts
+ * @see references/viva-docs/md/webhooks-for-payments.txt:134 (10-URL limit)
+ */
+import type { DesiredWebhook, PlanResult, WebhookRegistration } from './types.js';
+export interface ComputePlanInput {
+    desired: readonly DesiredWebhook[];
+    current: readonly WebhookRegistration[];
+    /** Per Viva: 10 URLs per event type. Default 10. */
+    perEventTypeLimit?: number;
+    /** Warn fraction. Default 0.8 → warn at 8. */
+    nearLimitFraction?: number;
+    /** Whether to deactivate URLs not in desired set. Default false. */
+    reconcileDrift?: boolean;
+    /** Hostname pattern for drift reconciliation (avoid touching foreign webhooks). */
+    ownedHostnamePattern?: RegExp;
+    /** Verification key generated or sourced from env. */
+    generatedVerificationKey?: string | undefined;
+}
+/**
+ * Deterministic diff between desired and current webhook registrations.
+ *
+ * Action ordering:
+ *   1. REGISTER (sorted by eventTypeId)
+ *   2. SKIP_ALREADY_REGISTERED (sorted by eventTypeId)
+ *   3. DEACTIVATE_DRIFT (sorted by eventTypeId)
+ *   4. WARN_LIMIT_NEAR (sorted by eventTypeId)
+ *   5. ABORT_LIMIT_HIT (sorted by eventTypeId)
+ */
+export declare function computePlan(input: ComputePlanInput): PlanResult;
+export declare function buildOwnedPattern(webhookUrl: string): RegExp;
+//# sourceMappingURL=plan.d.ts.map

package/dist/cli/plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../src/cli/plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACV,cAAc,EAEd,UAAU,EACV,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAMpB,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IACnC,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxC,oDAAoD;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,8CAA8C;IAC9C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oEAAoE;IACpE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,mFAAmF;IACnF,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,sDAAsD;IACtD,wBAAwB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/C;AAMD;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,UAAU,CAmG/D;AAMD,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAQ5D"}

package/dist/cli/plan.js

@@ -0,0 +1,115 @@
+/**
+ * cli/plan.ts — Pure, IO-free webhook plan computation.
+ *
+ * Computes the diff between desired webhook state (from config) and current
+ * registrations (from Viva API), returning a deterministic action list.
+ *
+ * Per Viva docs, max 10 webhook URLs per event type.
+ *
+ * Mirrors medusa-payment-viva/src/cli/plan.ts conventions exactly.
+ *
+ * @see packages/medusa-payment-viva/src/cli/plan.ts
+ * @see references/viva-docs/md/webhooks-for-payments.txt:134 (10-URL limit)
+ */
+// ---------------------------------------------------------------------------
+// computePlan
+// ---------------------------------------------------------------------------
+/**
+ * Deterministic diff between desired and current webhook registrations.
+ *
+ * Action ordering:
+ *   1. REGISTER (sorted by eventTypeId)
+ *   2. SKIP_ALREADY_REGISTERED (sorted by eventTypeId)
+ *   3. DEACTIVATE_DRIFT (sorted by eventTypeId)
+ *   4. WARN_LIMIT_NEAR (sorted by eventTypeId)
+ *   5. ABORT_LIMIT_HIT (sorted by eventTypeId)
+ */
+export function computePlan(input) {
+    const { desired, current, perEventTypeLimit = 10, nearLimitFraction = 0.8, reconcileDrift = false, ownedHostnamePattern, generatedVerificationKey, } = input;
+    const nearLimitThreshold = Math.floor(perEventTypeLimit * nearLimitFraction);
+    // Index: eventTypeId → url → WebhookRegistration
+    const currentByTypeAndUrl = new Map();
+    // Index: eventTypeId → all registrations (for limit counting)
+    const currentByType = new Map();
+    for (const reg of current) {
+        if (!currentByType.has(reg.eventTypeId)) {
+            currentByType.set(reg.eventTypeId, []);
+        }
+        currentByType.get(reg.eventTypeId).push(reg);
+        if (!currentByTypeAndUrl.has(reg.eventTypeId)) {
+            currentByTypeAndUrl.set(reg.eventTypeId, new Map());
+        }
+        currentByTypeAndUrl.get(reg.eventTypeId).set(reg.url, reg);
+    }
+    const registerActions = [];
+    const skipActions = [];
+    const warnActions = [];
+    const abortActions = [];
+    const sortedDesired = [...desired].sort((a, b) => a.eventTypeId - b.eventTypeId);
+    for (const d of sortedDesired) {
+        const urlIndex = currentByTypeAndUrl.get(d.eventTypeId);
+        const existingForType = currentByType.get(d.eventTypeId) ?? [];
+        const registeredCount = existingForType.length;
+        if (urlIndex?.has(d.url)) {
+            skipActions.push({ kind: 'SKIP_ALREADY_REGISTERED', existing: urlIndex.get(d.url) });
+            continue;
+        }
+        if (registeredCount >= perEventTypeLimit) {
+            abortActions.push({
+                kind: 'ABORT_LIMIT_HIT',
+                eventTypeId: d.eventTypeId,
+                current: registeredCount,
+                limit: perEventTypeLimit,
+            });
+            continue;
+        }
+        if (registeredCount >= nearLimitThreshold) {
+            warnActions.push({
+                kind: 'WARN_LIMIT_NEAR',
+                eventTypeId: d.eventTypeId,
+                current: registeredCount,
+                limit: perEventTypeLimit,
+            });
+        }
+        registerActions.push({ kind: 'REGISTER', desired: d });
+    }
+    // Drift reconciliation
+    const deactivateActions = [];
+    if (reconcileDrift) {
+        const desiredUrlSet = new Set(desired.map((d) => d.url));
+        const sortedCurrent = [...current].sort((a, b) => a.eventTypeId - b.eventTypeId);
+        for (const reg of sortedCurrent) {
+            const isOwned = ownedHostnamePattern ? ownedHostnamePattern.test(reg.url) : true;
+            if (!desiredUrlSet.has(reg.url) && isOwned) {
+                deactivateActions.push({
+                    kind: 'DEACTIVATE_DRIFT',
+                    existing: reg,
+                    reason: 'URL_NOT_IN_DESIRED',
+                });
+            }
+        }
+    }
+    const actions = [
+        ...registerActions,
+        ...skipActions,
+        ...deactivateActions,
+        ...warnActions,
+        ...abortActions,
+    ];
+    const hasFatalError = abortActions.length > 0;
+    return { actions, hasFatalError, generatedVerificationKey };
+}
+// ---------------------------------------------------------------------------
+// buildOwnedPattern helper (shared with register-webhooks)
+// ---------------------------------------------------------------------------
+export function buildOwnedPattern(webhookUrl) {
+    try {
+        const { hostname } = new URL(webhookUrl);
+        const escaped = hostname.replace(/\./g, '\\.');
+        return new RegExp(escaped);
+    }
+    catch {
+        return /.*/;
+    }
+}
+//# sourceMappingURL=plan.js.map

package/dist/cli/plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../src/cli/plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA4BH,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,KAAuB;IACjD,MAAM,EACJ,OAAO,EACP,OAAO,EACP,iBAAiB,GAAG,EAAE,EACtB,iBAAiB,GAAG,GAAG,EACvB,cAAc,GAAG,KAAK,EACtB,oBAAoB,EACpB,wBAAwB,GACzB,GAAG,KAAK,CAAC;IAEV,MAAM,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,GAAG,iBAAiB,CAAC,CAAC;IAE7E,iDAAiD;IACjD,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAA4C,CAAC;IAChF,8DAA8D;IAC9D,MAAM,aAAa,GAAG,IAAI,GAAG,EAAiC,CAAC;IAE/D,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACxC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE9C,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9C,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,eAAe,GAAwB,EAAE,CAAC;IAChD,MAAM,WAAW,GAAwB,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAwB,EAAE,CAAC;IAC5C,MAAM,YAAY,GAAwB,EAAE,CAAC;IAE7C,MAAM,aAAa,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;IAEjF,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACxD,MAAM,eAAe,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC/D,MAAM,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC;QAE/C,IAAI,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAE,EAAE,CAAC,CAAC;YACtF,SAAS;QACX,CAAC;QAED,IAAI,eAAe,IAAI,iBAAiB,EAAE,CAAC;YACzC,YAAY,CAAC,IAAI,CAAC;gBAChB,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,OAAO,EAAE,eAAe;gBACxB,KAAK,EAAE,iBAAiB;aACzB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,eAAe,IAAI,kBAAkB,EAAE,CAAC;YAC1C,WAAW,CAAC,IAAI,CAAC;gBACf,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,OAAO,EAAE,eAAe;gBACxB,KAAK,EAAE,iBAAiB;aACzB,CAAC,CAAC;QACL,CAAC;QAED,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,uBAAuB;IACvB,MAAM,iBAAiB,GAAwB,EAAE,CAAC;IAElD,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;QAEjF,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,oBAAoB,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACjF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;gBAC3C,iBAAiB,CAAC,IAAI,CAAC;oBACrB,IAAI,EAAE,kBAAkB;oBACxB,QAAQ,EAAE,GAAG;oBACb,MAAM,EAAE,oBAAoB;iBAC7B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAwB;QACnC,GAAG,eAAe;QAClB,GAAG,WAAW;QACd,GAAG,iBAAiB;QACpB,GAAG,WAAW;QACd,GAAG,YAAY;KAChB,CAAC;IAEF,MAAM,aAAa,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IAE9C,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,CAAC;AAC9D,CAAC;AAED,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E;AAE9E,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/C,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/cli/register-webhooks.d.ts

@@ -0,0 +1,45 @@
+/**
+ * cli/register-webhooks.ts — Main CLI logic for idempotent webhook registration.
+ *
+ * Mode-aware:
+ *   - ISV mode: builds the ISV webhook client and POSTs one /isv/v1/webhooks
+ *     registration per V1 event type (1796, 1797, 1798, 4865, 8193, 8194).
+ *     All merchants on the platform share the same webhook URL.
+ *   - Merchant mode: Viva offers no programmatic registration. The CLI fetches
+ *     the verification key from GET /api/messages/config/token (Basic auth,
+ *     merchant variant) and prints the URLs the operator must paste into Viva
+ *     Self Care → Sales → API Access → Webhooks. `--reconcile-drift` is
+ *     non-applicable in merchant mode.
+ *
+ * Verification key (ISV mode):
+ *   CLI generates a UUIDv4 if VIVA_WEBHOOK_VERIFICATION_KEY is not set.
+ *   The key is surfaced for the operator to paste into plugin options + Viva Self Care.
+ *   It is NOT posted to Viva — Viva sends a GET probe to /viva/webhook and the
+ *   WebhookController returns {"key":"<that-uuid>"} from plugin config.
+ *   @see src/api/webhook.controller.ts#handleVerification
+ *
+ * Exit codes:
+ *   0 — clean (no actions OR all applied successfully OR merchant manual setup printed)
+ *   1 — plan has actions but --apply was not passed (CI gate use case — ISV mode only)
+ *   2 — apply failed (HTTP/Viva error)
+ *   3 — fatal precondition (config invalid, ABORT_LIMIT_HIT)
+ *
+ * Mirrors medusa-payment-viva/src/cli/register-webhooks.ts conventions.
+ *
+ * @see docs/plans/vendure-plugin-v0.md §"CLI vendure-viva-register-webhooks" (V10)
+ * @see references/viva-docs/md/webhooks-for-payments.txt:134 (10-URL limit)
+ * @see docs/plans/multi-mode-v0.md §9.5 (CLI behaviour matrix)
+ */
+type Dispatcher = any;
+import type { RunOptions } from './types.js';
+export type { RunOptions };
+/**
+ * Programmatic entry — also called by bin.ts for the CLI.
+ * Reads VIVA_* env from the provided env object (defaults to process.env).
+ *
+ * @param opts       - CLI run options.
+ * @param env        - Optional env override (defaults to process.env). Used in tests.
+ * @param dispatcher - Optional undici Dispatcher override (MockAgent in tests).
+ */
+export declare function run(opts: RunOptions, env?: NodeJS.ProcessEnv, dispatcher?: Dispatcher): Promise<number>;
+//# sourceMappingURL=register-webhooks.d.ts.map