@sakeetech/viva-payments-core 0.2.1 → 0.2.3

package/dist/types/auth.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * Authentication types for the Viva Wallet ISV OAuth 2.0 and reseller
  * basic-auth flows.
@@ -8,5 +9,5 @@
  * @see references/viva-docs/md/oauth2-authentication.txt:179
  * @see references/viva-docs/md/isv-credentials.txt:107
  */
-export {};
+Object.defineProperty(exports, "__esModule", { value: true });
 //# sourceMappingURL=auth.js.map

package/dist/types/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/types/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/types/auth.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG"}

package/dist/types/card-types.js

@@ -1,3 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CARD_TYPE_BY_ID = void 0;
+exports.resolveCardType = resolveCardType;
 /**
  * Viva's numeric CardTypeId → string scheme name mapping.
  *
@@ -35,7 +39,7 @@
  * @see ../refunds/strategy.ts (FAST_REFUND_ELIGIBLE_SCHEMES)
  * @see docs/STATE-MACHINE.md §3.1
  */
-export const CARD_TYPE_BY_ID = Object.freeze({
+exports.CARD_TYPE_BY_ID = Object.freeze({
     0: 'Visa',
     1: 'MasterCard',
     2: 'Diners',
@@ -54,9 +58,9 @@ export const CARD_TYPE_BY_ID = Object.freeze({
  * Pure, no I/O. Safe to call from anywhere — including refund strategy
  * decisions and tests.
  */
-export function resolveCardType(cardTypeId) {
+function resolveCardType(cardTypeId) {
     if (cardTypeId == null)
         return undefined;
-    return CARD_TYPE_BY_ID[cardTypeId];
+    return exports.CARD_TYPE_BY_ID[cardTypeId];
 }
 //# sourceMappingURL=card-types.js.map

package/dist/types/card-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"card-types.js","sourceRoot":"","sources":["../../src/types/card-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,MAAM,eAAe,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC7E,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,YAAY;IACf,CAAC,EAAE,QAAQ;IACX,CAAC,EAAE,MAAM;IACT,gEAAgE;IAChE,gEAAgE;IAChE,CAAC,EAAE,SAAS;IACZ,CAAC,EAAE,UAAU;IACb,CAAC,EAAE,KAAK;CACT,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,UAAqC;IAErC,IAAI,UAAU,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,eAAe,CAAC,UAAU,CAAC,CAAC;AACrC,CAAC"}
+{"version":3,"file":"card-types.js","sourceRoot":"","sources":["../../src/types/card-types.ts"],"names":[],"mappings":";;;AAyDA,0CAKC;AA9DD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACU,QAAA,eAAe,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC7E,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,YAAY;IACf,CAAC,EAAE,QAAQ;IACX,CAAC,EAAE,MAAM;IACT,gEAAgE;IAChE,gEAAgE;IAChE,CAAC,EAAE,SAAS;IACZ,CAAC,EAAE,UAAU;IACb,CAAC,EAAE,KAAK;CACT,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,SAAgB,eAAe,CAC7B,UAAqC;IAErC,IAAI,UAAU,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,uBAAe,CAAC,UAAU,CAAC,CAAC;AACrC,CAAC"}

package/dist/types/common.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * Common primitives shared across the Viva Wallet ISV API surface.
  *
@@ -8,11 +9,14 @@
  * @see references/viva-docs/md/webhooks-for-payments.txt:383
  * @see references/viva-docs/md/oauth2-authentication.txt:145
  */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LEGACY_HOST = exports.ENVIRONMENT_URLS = exports.CURRENCY_CODES = void 0;
+exports.asCurrencyCode = asCurrencyCode;
 /**
  * Narrow cast helper — call when you have a validated ISO 4217 numeric string.
  * Runtime validation lives in the implementation layer (S2/S6).
  */
-export function asCurrencyCode(code) {
+function asCurrencyCode(code) {
     return code;
 }
 /**
@@ -22,7 +26,7 @@ export function asCurrencyCode(code) {
  *
  * @see references/viva-docs/md/wh-transaction-payment-created.txt:487
  */
-export const CURRENCY_CODES = {
+exports.CURRENCY_CODES = {
     EUR: asCurrencyCode('978'),
     GBP: asCurrencyCode('826'),
     USD: asCurrencyCode('840'),
@@ -40,7 +44,7 @@ export const CURRENCY_CODES = {
  *
  * @see references/viva-docs/md/oauth2-authentication.txt:145
  */
-export const ENVIRONMENT_URLS = {
+exports.ENVIRONMENT_URLS = {
     demo: {
         authBaseUrl: 'https://demo-accounts.vivapayments.com',
         apiBaseUrl: 'https://demo-api.vivapayments.com',
@@ -63,7 +67,7 @@ export const ENVIRONMENT_URLS = {
  *
  * @see references/viva-docs/md/tut-create-recurring-payment.txt:288
  */
-export const LEGACY_HOST = {
+exports.LEGACY_HOST = {
     demo: 'https://demo.vivapayments.com',
     production: 'https://www.vivapayments.com',
 };

package/dist/types/common.js.map

@@ -1 +1 @@
-{"version":3,"file":"common.js","sourceRoot":"","sources":["../../src/types/common.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAgBH;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAoB,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC;IAC1B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC;IAC1B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC;IAC1B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC;IAC1B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC;IAC1B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC;IAC1B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC;IAC1B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC;IAC1B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC;IAC1B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC;IAC1B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC;CACqB,CAAC;AAsFlD;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAiD;IAC5E,IAAI,EAAE;QACJ,WAAW,EAAE,wCAAwC;QACrD,UAAU,EAAE,mCAAmC;KAChD;IACD,UAAU,EAAE;QACV,WAAW,EAAE,mCAAmC;QAChD,UAAU,EAAE,8BAA8B;KAC3C;CACO,CAAC;AAEX;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,WAAW,GAAoC;IAC1D,IAAI,EAAE,+BAA+B;IACrC,UAAU,EAAE,8BAA8B;CAClC,CAAC"}
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../src/types/common.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAoBH,wCAEC;AAND;;;GAGG;AACH,SAAgB,cAAc,CAAC,IAAY;IACzC,OAAO,IAAoB,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACU,QAAA,cAAc,GAAG;IAC5B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC;IAC1B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC;IAC1B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC;IAC1B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC;IAC1B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC;IAC1B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC;IAC1B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC;IAC1B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC;IAC1B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC;IAC1B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC;IAC1B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC;CACqB,CAAC;AAsFlD;;;;GAIG;AACU,QAAA,gBAAgB,GAAiD;IAC5E,IAAI,EAAE;QACJ,WAAW,EAAE,wCAAwC;QACrD,UAAU,EAAE,mCAAmC;KAChD;IACD,UAAU,EAAE;QACV,WAAW,EAAE,mCAAmC;QAChD,UAAU,EAAE,8BAA8B;KAC3C;CACO,CAAC;AAEX;;;;;;;;;;;;GAYG;AACU,QAAA,WAAW,GAAoC;IAC1D,IAAI,EAAE,+BAA+B;IACrC,UAAU,EAAE,8BAA8B;CAClC,CAAC"}

package/dist/types/index.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * viva-payments-core/types — barrel re-export.
  *
@@ -9,13 +10,20 @@
  * Attribution: types hand-rolled fresh. Structure partially referenced from
  * @nkhind/vivawallet-sdk for API surface awareness — no code copied.
  */
-export { 
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFERRED_EVENT_TYPES = exports.EVENT_TYPES = exports.resolveCardType = exports.CARD_TYPE_BY_ID = exports.LEGACY_HOST = exports.ENVIRONMENT_URLS = exports.CURRENCY_CODES = exports.asCurrencyCode = void 0;
+var common_js_1 = require("./common.js");
 // common.ts — runtime values
-asCurrencyCode, CURRENCY_CODES, ENVIRONMENT_URLS, LEGACY_HOST, } from './common.js';
-export { 
+Object.defineProperty(exports, "asCurrencyCode", { enumerable: true, get: function () { return common_js_1.asCurrencyCode; } });
+Object.defineProperty(exports, "CURRENCY_CODES", { enumerable: true, get: function () { return common_js_1.CURRENCY_CODES; } });
+Object.defineProperty(exports, "ENVIRONMENT_URLS", { enumerable: true, get: function () { return common_js_1.ENVIRONMENT_URLS; } });
+Object.defineProperty(exports, "LEGACY_HOST", { enumerable: true, get: function () { return common_js_1.LEGACY_HOST; } });
+var card_types_js_1 = require("./card-types.js");
 // card-types.ts — runtime values
-CARD_TYPE_BY_ID, resolveCardType, } from './card-types.js';
-export { 
+Object.defineProperty(exports, "CARD_TYPE_BY_ID", { enumerable: true, get: function () { return card_types_js_1.CARD_TYPE_BY_ID; } });
+Object.defineProperty(exports, "resolveCardType", { enumerable: true, get: function () { return card_types_js_1.resolveCardType; } });
+var webhook_events_js_1 = require("./webhook-events.js");
 // webhook-events.ts — runtime values
-EVENT_TYPES, DEFERRED_EVENT_TYPES, } from './webhook-events.js';
+Object.defineProperty(exports, "EVENT_TYPES", { enumerable: true, get: function () { return webhook_events_js_1.EVENT_TYPES; } });
+Object.defineProperty(exports, "DEFERRED_EVENT_TYPES", { enumerable: true, get: function () { return webhook_events_js_1.DEFERRED_EVENT_TYPES; } });
 //# sourceMappingURL=index.js.map

package/dist/types/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiBH,OAAO;AACL,6BAA6B;AAC7B,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,WAAW,GACZ,MAAM,aAAa,CAAC;AAoBrB,OAAO;AACL,iCAAiC;AACjC,eAAe,EACf,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAsCzB,OAAO;AACL,qCAAqC;AACrC,WAAW,EACX,oBAAoB,GACrB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAiBH,yCAMqB;AALnB,6BAA6B;AAC7B,2GAAA,cAAc,OAAA;AACd,2GAAA,cAAc,OAAA;AACd,6GAAA,gBAAgB,OAAA;AAChB,wGAAA,WAAW,OAAA;AAqBb,iDAIyB;AAHvB,iCAAiC;AACjC,gHAAA,eAAe,OAAA;AACf,gHAAA,eAAe,OAAA;AAuCjB,yDAI6B;AAH3B,qCAAqC;AACrC,gHAAA,WAAW,OAAA;AACX,yHAAA,oBAAoB,OAAA"}

package/dist/types/isv-accounts.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * ISV Connected Account + Webhook Registration types.
  *
@@ -18,5 +19,5 @@
  *   - Update/Delete webhook  (not exposed; manage via banking UI)
  *   - Update connected account  (not exposed for ISV; merchant edits via UI)
  */
-export {};
+Object.defineProperty(exports, "__esModule", { value: true });
 //# sourceMappingURL=isv-accounts.js.map

package/dist/types/isv-accounts.js.map

@@ -1 +1 @@
-{"version":3,"file":"isv-accounts.js","sourceRoot":"","sources":["../../src/types/isv-accounts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG"}
+{"version":3,"file":"isv-accounts.js","sourceRoot":"","sources":["../../src/types/isv-accounts.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG"}

package/dist/types/isv-payments.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * ISV Payment API request and response types.
  *
@@ -15,5 +16,5 @@
  * @see references/viva-docs/md/wh-transaction-payment-created.txt:158
  * @see references/viva-docs/md/webhooks-for-payments.txt:248
  */
-export {};
+Object.defineProperty(exports, "__esModule", { value: true });
 //# sourceMappingURL=isv-payments.js.map

package/dist/types/isv-payments.js.map

@@ -1 +1 @@
-{"version":3,"file":"isv-payments.js","sourceRoot":"","sources":["../../src/types/isv-payments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG"}
+{"version":3,"file":"isv-payments.js","sourceRoot":"","sources":["../../src/types/isv-payments.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG"}

package/dist/types/status.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * Viva transaction status letter mapping and plugin status enum.
  *
@@ -15,5 +16,5 @@
  * @see references/viva-docs/md/wh-transaction-payment-created.txt:398
  * @see references/viva-docs/md/wh-sale-transactions.txt:210
  */
-export {};
+Object.defineProperty(exports, "__esModule", { value: true });
 //# sourceMappingURL=status.js.map

package/dist/types/status.js.map

@@ -1 +1 @@
-{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/types/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG"}
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/types/status.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG"}

package/dist/types/webhook-events.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * Webhook event types and payloads for the Viva Wallet ISV integration.
  *
@@ -19,6 +20,8 @@
  * @see references/viva-docs/md/wh-account-connected.txt:150
  * @see references/viva-docs/md/wh-account-verif-status-changed.txt:152
  */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFERRED_EVENT_TYPES = exports.EVENT_TYPES = void 0;
 // ---------------------------------------------------------------------------
 // EventTypeId const object (not a TypeScript enum)
 // ---------------------------------------------------------------------------
@@ -30,7 +33,7 @@
  *
  * @see references/viva-docs/md/webhooks-for-payments.txt:141
  */
-export const EVENT_TYPES = {
+exports.EVENT_TYPES = {
     /** A customer payment has been successful. */
     TRANSACTION_PAYMENT_CREATED: 1796,
     /** A customer refund has been successfully actioned. */
@@ -50,7 +53,7 @@ export const EVENT_TYPES = {
  *
  * @see references/viva-docs/md/webhooks-for-payments.txt:141
  */
-export const DEFERRED_EVENT_TYPES = {
+exports.DEFERRED_EVENT_TYPES = {
     /** Commission payment withdrawn by Viva. Post-v1. */
     TRANSACTION_PRICE_CALCULATED: 1799,
     /** ECR integration only. Post-v1. */

package/dist/types/webhook-events.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-events.js","sourceRoot":"","sources":["../../src/types/webhook-events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,8CAA8C;IAC9C,2BAA2B,EAAE,IAAI;IACjC,wDAAwD;IACxD,4BAA4B,EAAE,IAAI;IAClC,iCAAiC;IACjC,kBAAkB,EAAE,IAAI;IACxB,kEAAkE;IAClE,aAAa,EAAE,IAAI;IACnB,+DAA+D;IAC/D,iBAAiB,EAAE,IAAI;IACvB,0DAA0D;IAC1D,mCAAmC,EAAE,IAAI;CACjC,CAAC;AAOX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,qDAAqD;IACrD,4BAA4B,EAAE,IAAI;IAClC,qCAAqC;IACrC,mCAAmC,EAAE,IAAI;IACzC,qCAAqC;IACrC,kCAAkC,EAAE,IAAI;IACxC,8CAA8C;IAC9C,2BAA2B,EAAE,IAAI;IACjC,sCAAsC;IACtC,6BAA6B,EAAE,GAAG;IAClC,uCAAuC;IACvC,8BAA8B,EAAE,GAAG;IACnC;;;;;OAKG;IACH,iBAAiB,EAAE,IAAI;IACvB,2DAA2D;IAC3D,gBAAgB,EAAE,IAAI;CACd,CAAC"}
+{"version":3,"file":"webhook-events.js","sourceRoot":"","sources":["../../src/types/webhook-events.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;;AAIH,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E;;;;;;;GAOG;AACU,QAAA,WAAW,GAAG;IACzB,8CAA8C;IAC9C,2BAA2B,EAAE,IAAI;IACjC,wDAAwD;IACxD,4BAA4B,EAAE,IAAI;IAClC,iCAAiC;IACjC,kBAAkB,EAAE,IAAI;IACxB,kEAAkE;IAClE,aAAa,EAAE,IAAI;IACnB,+DAA+D;IAC/D,iBAAiB,EAAE,IAAI;IACvB,0DAA0D;IAC1D,mCAAmC,EAAE,IAAI;CACjC,CAAC;AAOX;;;;;GAKG;AACU,QAAA,oBAAoB,GAAG;IAClC,qDAAqD;IACrD,4BAA4B,EAAE,IAAI;IAClC,qCAAqC;IACrC,mCAAmC,EAAE,IAAI;IACzC,qCAAqC;IACrC,kCAAkC,EAAE,IAAI;IACxC,8CAA8C;IAC9C,2BAA2B,EAAE,IAAI;IACjC,sCAAsC;IACtC,6BAA6B,EAAE,GAAG;IAClC,uCAAuC;IACvC,8BAA8B,EAAE,GAAG;IACnC;;;;;OAKG;IACH,iBAAiB,EAAE,IAAI;IACvB,2DAA2D;IAC3D,gBAAgB,EAAE,IAAI;CACd,CAAC"}

package/dist/webhooks/challenge-response.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * Viva Wallet webhook challenge-response handler.
  *
@@ -6,7 +7,9 @@
  *
  * @see references/viva-docs/md/webhooks-for-payments.txt:311
  */
-import { VivaWebhookError } from '../errors/index.js';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildChallengeResponse = buildChallengeResponse;
+const index_js_1 = require("../errors/index.js");
 /**
  * Returns the GET-request response body for Viva's URL verification challenge.
  *
@@ -23,9 +26,9 @@ import { VivaWebhookError } from '../errors/index.js';
  *   return res.json(buildChallengeResponse(env.VIVA_WEBHOOK_KEY));
  * }
  */
-export function buildChallengeResponse(webhookVerificationKey) {
+function buildChallengeResponse(webhookVerificationKey) {
     if (!webhookVerificationKey || webhookVerificationKey.trim().length === 0) {
-        throw new VivaWebhookError({
+        throw new index_js_1.VivaWebhookError({
             message: 'webhookVerificationKey must be a non-empty string. ' +
                 'Obtain it from GET /api/messages/config/token and set VIVA_WEBHOOK_KEY.',
         });

package/dist/webhooks/challenge-response.js.map

@@ -1 +1 @@
-{"version":3,"file":"challenge-response.js","sourceRoot":"","sources":["../../src/webhooks/challenge-response.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CAAC,sBAA8B;IACnE,IAAI,CAAC,sBAAsB,IAAI,sBAAsB,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,gBAAgB,CAAC;YACzB,OAAO,EACL,qDAAqD;gBACrD,yEAAyE;SAC5E,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,sBAAsB,EAAE,CAAC;AACzC,CAAC"}
+{"version":3,"file":"challenge-response.js","sourceRoot":"","sources":["../../src/webhooks/challenge-response.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AAoBH,wDAUC;AA5BD,iDAAsD;AAEtD;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,sBAAsB,CAAC,sBAA8B;IACnE,IAAI,CAAC,sBAAsB,IAAI,sBAAsB,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,2BAAgB,CAAC;YACzB,OAAO,EACL,qDAAqD;gBACrD,yEAAyE;SAC5E,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,sBAAsB,EAAE,CAAC;AACzC,CAAC"}

package/dist/webhooks/event-types.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * Runtime helpers for Viva webhook event type IDs.
  *
@@ -6,7 +7,12 @@
  *
  * @see references/viva-docs/md/webhooks-for-payments.txt:141
  */
-export { EVENT_TYPES } from '../types/webhook-events.js';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.V1_EVENT_TYPE_IDS = exports.EVENT_TYPES = void 0;
+exports.isTransactionEvent = isTransactionEvent;
+exports.isOnboardingEvent = isOnboardingEvent;
+var webhook_events_js_1 = require("../types/webhook-events.js");
+Object.defineProperty(exports, "EVENT_TYPES", { enumerable: true, get: function () { return webhook_events_js_1.EVENT_TYPES; } });
 /**
  * Returns `true` for event types that carry a transaction payload and require
  * MerchantId-based tenant resolution.
@@ -20,7 +26,7 @@ export { EVENT_TYPES } from '../types/webhook-events.js';
  *
  * @see references/viva-docs/md/webhooks-for-payments.txt:141
  */
-export function isTransactionEvent(id) {
+function isTransactionEvent(id) {
     return id === 1796 || id === 1797 || id === 1798 || id === 4865 || id === 7936;
 }
 /**
@@ -33,7 +39,7 @@ export function isTransactionEvent(id) {
  *
  * @see references/viva-docs/md/webhooks-for-payments.txt:224
  */
-export function isOnboardingEvent(id) {
+function isOnboardingEvent(id) {
     return id === 8193 || id === 8194;
 }
 /**
@@ -44,7 +50,7 @@ export function isOnboardingEvent(id) {
  *
  * @see references/viva-docs/md/webhooks-for-payments.txt:141
  */
-export const V1_EVENT_TYPE_IDS = Object.freeze([
+exports.V1_EVENT_TYPE_IDS = Object.freeze([
     1796, 1797, 1798, 4865, 8193, 8194,
 ]);
 //# sourceMappingURL=event-types.js.map

package/dist/webhooks/event-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"event-types.js","sourceRoot":"","sources":["../../src/webhooks/event-types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAAwB,MAAM,4BAA4B,CAAC;AAE/E;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAU;IAC3C,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,CAAC;AACjF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAU;IAC1C,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAyD,MAAM,CAAC,MAAM,CAAC;IACnG,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CAC1B,CAAC,CAAC"}
+{"version":3,"file":"event-types.js","sourceRoot":"","sources":["../../src/webhooks/event-types.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAiBH,gDAEC;AAYD,8CAEC;AA/BD,gEAA+E;AAAtE,gHAAA,WAAW,OAAA;AAEpB;;;;;;;;;;;;GAYG;AACH,SAAgB,kBAAkB,CAAC,EAAU;IAC3C,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,CAAC;AACjF,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,iBAAiB,CAAC,EAAU;IAC1C,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACU,QAAA,iBAAiB,GAAyD,MAAM,CAAC,MAAM,CAAC;IACnG,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CAC1B,CAAC,CAAC"}

package/dist/webhooks/extract-client-ip.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * extract-client-ip.ts — Source IP extraction with explicit proxy-depth trust.
  *
@@ -18,6 +19,8 @@
  *
  * @see docs/TODO-CSO.md "Finding 2"
  */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractClientIp = extractClientIp;
 /**
  * Extract the trusted client IP from a request.
  *
@@ -25,7 +28,7 @@
  * whether to reject or fall back to a default). Strips IPv6 brackets if
  * present (e.g. `[2001:db8::1]:443` → `2001:db8::1`).
  */
-export function extractClientIp(req, trustedProxyDepth) {
+function extractClientIp(req, trustedProxyDepth) {
     const depth = Number.isInteger(trustedProxyDepth) && trustedProxyDepth >= 0
         ? trustedProxyDepth
         : 0;

package/dist/webhooks/extract-client-ip.js.map

@@ -1 +1 @@
-{"version":3,"file":"extract-client-ip.js","sourceRoot":"","sources":["../../src/webhooks/extract-client-ip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAaH;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAoB,EACpB,iBAAyB;IAEzB,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,IAAI,CAAC;QACzE,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,CAAC,CAAC;IAEN,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,OAAO,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAE9B,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;QACzB,uEAAuE;QACvE,wEAAwE;QACxE,0CAA0C;QAC1C,OAAO,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CACjB,GAAkC;IAElC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACxD,OAAO,MAAM;SACV,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,8CAA8C;IAC9C,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,uEAAuE;IACvE,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"extract-client-ip.js","sourceRoot":"","sources":["../../src/webhooks/extract-client-ip.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;AAoBH,0CAuBC;AA9BD;;;;;;GAMG;AACH,SAAgB,eAAe,CAC7B,GAAoB,EACpB,iBAAyB;IAEzB,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,IAAI,CAAC;QACzE,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,CAAC,CAAC;IAEN,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,OAAO,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAE9B,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;QACzB,uEAAuE;QACvE,wEAAwE;QACxE,0CAA0C;QAC1C,OAAO,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CACjB,GAAkC;IAElC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACxD,OAAO,MAAM;SACV,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,8CAA8C;IAC9C,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,uEAAuE;IACvE,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/webhooks/hmac-verify.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * HMAC-SHA256 signature verification for the Sale Transactions webhook (event 7936).
  *
@@ -14,8 +15,10 @@
  *
  * @see references/viva-docs/md/wh-sale-transactions.txt:149
  */
-import { createHmac, timingSafeEqual } from 'node:crypto';
-import { VivaWebhookError } from '../errors/index.js';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyHmacSignature = verifyHmacSignature;
+const node_crypto_1 = require("node:crypto");
+const index_js_1 = require("../errors/index.js");
 /**
  * Verify the `Viva-Signature-256` header for the Sale Transactions webhook
  * (event 7936 only).
@@ -36,10 +39,10 @@ import { VivaWebhookError } from '../errors/index.js';
  *
  * @see references/viva-docs/md/wh-sale-transactions.txt:149
  */
-export function verifyHmacSignature(rawBody, signature, secret) {
+function verifyHmacSignature(rawBody, signature, secret) {
     // --- 1. Guard: signature header must be present and non-empty ---
     if (signature == null || signature.length === 0) {
-        throw new VivaWebhookError({
+        throw new index_js_1.VivaWebhookError({
             message: 'Missing Viva-Signature-256 header. This header is required for event 7936 (Sale Transactions).',
         });
     }
@@ -49,7 +52,7 @@ export function verifyHmacSignature(rawBody, signature, secret) {
     const expectedByteLength = 32; // SHA-256 output is 32 bytes
     const hexRegex = /^[0-9a-f]+$/i;
     if (!hexRegex.test(signature)) {
-        throw new VivaWebhookError({
+        throw new index_js_1.VivaWebhookError({
             message: `Malformed Viva-Signature-256 header: not a valid hex string. Received: "${signature.slice(0, 20)}..."`,
         });
     }
@@ -58,12 +61,12 @@ export function verifyHmacSignature(rawBody, signature, secret) {
         candidateBuffer = Buffer.from(signature, 'hex');
     }
     catch {
-        throw new VivaWebhookError({
+        throw new index_js_1.VivaWebhookError({
             message: 'Malformed Viva-Signature-256 header: hex decode failed.',
         });
     }
     // --- 3. Compute expected HMAC-SHA256 ---
-    const hmac = createHmac('sha256', secret);
+    const hmac = (0, node_crypto_1.createHmac)('sha256', secret);
     hmac.update(rawBody);
     const expectedBuffer = hmac.digest(); // returns a Buffer (32 bytes)
     // --- 4. Constant-time comparison ---
@@ -76,15 +79,15 @@ export function verifyHmacSignature(rawBody, signature, secret) {
         // This runs in constant time relative to expectedByteLength.
         const zeros = Buffer.alloc(expectedByteLength, 0);
         // We deliberately ignore the result here — length mismatch is always a fail.
-        void timingSafeEqual(zeros, expectedBuffer);
-        throw new VivaWebhookError({
+        void (0, node_crypto_1.timingSafeEqual)(zeros, expectedBuffer);
+        throw new index_js_1.VivaWebhookError({
             message: `Viva-Signature-256 header length mismatch: expected ${expectedByteLength} bytes (${expectedByteLength * 2} hex chars), got ${candidateBuffer.length} bytes.`,
         });
     }
     // Both buffers are 32 bytes — safe to call timingSafeEqual.
-    const valid = timingSafeEqual(expectedBuffer, candidateBuffer);
+    const valid = (0, node_crypto_1.timingSafeEqual)(expectedBuffer, candidateBuffer);
     if (!valid) {
-        throw new VivaWebhookError({
+        throw new index_js_1.VivaWebhookError({
             message: 'Viva-Signature-256 signature mismatch. Request body may have been tampered with.',
         });
     }

package/dist/webhooks/hmac-verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"hmac-verify.js","sourceRoot":"","sources":["../../src/webhooks/hmac-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAA4B,EAC5B,SAAoC,EACpC,MAAc;IAEd,mEAAmE;IACnE,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,gBAAgB,CAAC;YACzB,OAAO,EAAE,gGAAgG;SAC1G,CAAC,CAAC;IACL,CAAC;IAED,kDAAkD;IAClD,qEAAqE;IACrE,uEAAuE;IACvE,MAAM,kBAAkB,GAAG,EAAE,CAAC,CAAC,6BAA6B;IAC5D,MAAM,QAAQ,GAAG,cAAc,CAAC;IAEhC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,gBAAgB,CAAC;YACzB,OAAO,EAAE,2EAA2E,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM;SACjH,CAAC,CAAC;IACL,CAAC;IAED,IAAI,eAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,gBAAgB,CAAC;YACzB,OAAO,EAAE,yDAAyD;SACnE,CAAC,CAAC;IACL,CAAC;IAED,0CAA0C;IAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,8BAA8B;IAEpE,sCAAsC;IACtC,iEAAiE;IACjE,kEAAkE;IAClE,0EAA0E;IAC1E,8BAA8B;IAC9B,IAAI,eAAe,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QAClD,kEAAkE;QAClE,6DAA6D;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;QAClD,6EAA6E;QAC7E,KAAK,eAAe,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QAC5C,MAAM,IAAI,gBAAgB,CAAC;YACzB,OAAO,EAAE,uDAAuD,kBAAkB,WAAW,kBAAkB,GAAG,CAAC,oBAAoB,eAAe,CAAC,MAAM,SAAS;SACvK,CAAC,CAAC;IACL,CAAC;IAED,4DAA4D;IAC5D,MAAM,KAAK,GAAG,eAAe,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IAE/D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,gBAAgB,CAAC;YACzB,OAAO,EAAE,kFAAkF;SAC5F,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}
+{"version":3,"file":"hmac-verify.js","sourceRoot":"","sources":["../../src/webhooks/hmac-verify.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;AAyBH,kDA8DC;AArFD,6CAA0D;AAC1D,iDAAsD;AAEtD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAgB,mBAAmB,CACjC,OAA4B,EAC5B,SAAoC,EACpC,MAAc;IAEd,mEAAmE;IACnE,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,2BAAgB,CAAC;YACzB,OAAO,EAAE,gGAAgG;SAC1G,CAAC,CAAC;IACL,CAAC;IAED,kDAAkD;IAClD,qEAAqE;IACrE,uEAAuE;IACvE,MAAM,kBAAkB,GAAG,EAAE,CAAC,CAAC,6BAA6B;IAC5D,MAAM,QAAQ,GAAG,cAAc,CAAC;IAEhC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,2BAAgB,CAAC;YACzB,OAAO,EAAE,2EAA2E,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM;SACjH,CAAC,CAAC;IACL,CAAC;IAED,IAAI,eAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,2BAAgB,CAAC;YACzB,OAAO,EAAE,yDAAyD;SACnE,CAAC,CAAC;IACL,CAAC;IAED,0CAA0C;IAC1C,MAAM,IAAI,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,8BAA8B;IAEpE,sCAAsC;IACtC,iEAAiE;IACjE,kEAAkE;IAClE,0EAA0E;IAC1E,8BAA8B;IAC9B,IAAI,eAAe,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QAClD,kEAAkE;QAClE,6DAA6D;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;QAClD,6EAA6E;QAC7E,KAAK,IAAA,6BAAe,EAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QAC5C,MAAM,IAAI,2BAAgB,CAAC;YACzB,OAAO,EAAE,uDAAuD,kBAAkB,WAAW,kBAAkB,GAAG,CAAC,oBAAoB,eAAe,CAAC,MAAM,SAAS;SACvK,CAAC,CAAC;IACL,CAAC;IAED,4DAA4D;IAC5D,MAAM,KAAK,GAAG,IAAA,6BAAe,EAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IAE/D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,2BAAgB,CAAC;YACzB,OAAO,EAAE,kFAAkF;SAC5F,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/webhooks/index.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * viva-payments-core/webhooks — barrel export.
  *
@@ -10,10 +11,25 @@
  *
  * @see references/viva-docs/md/webhooks-for-payments.txt:254
  */
-export { buildChallengeResponse } from './challenge-response.js';
-export { VIVA_DEMO_IPS, VIVA_PROD_IPS, isAllowedSourceIp, } from './ip-allowlist.js';
-export { extractClientIp, } from './extract-client-ip.js';
-export { verifyHmacSignature } from './hmac-verify.js';
-export { EVENT_TYPES, isTransactionEvent, isOnboardingEvent, V1_EVENT_TYPE_IDS, } from './event-types.js';
-export { mapStatusLetter, validateStatusTransition, applyStatusTransition, } from './status-lattice.js';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyStatusTransition = exports.validateStatusTransition = exports.mapStatusLetter = exports.V1_EVENT_TYPE_IDS = exports.isOnboardingEvent = exports.isTransactionEvent = exports.EVENT_TYPES = exports.verifyHmacSignature = exports.extractClientIp = exports.isAllowedSourceIp = exports.VIVA_PROD_IPS = exports.VIVA_DEMO_IPS = exports.buildChallengeResponse = void 0;
+var challenge_response_js_1 = require("./challenge-response.js");
+Object.defineProperty(exports, "buildChallengeResponse", { enumerable: true, get: function () { return challenge_response_js_1.buildChallengeResponse; } });
+var ip_allowlist_js_1 = require("./ip-allowlist.js");
+Object.defineProperty(exports, "VIVA_DEMO_IPS", { enumerable: true, get: function () { return ip_allowlist_js_1.VIVA_DEMO_IPS; } });
+Object.defineProperty(exports, "VIVA_PROD_IPS", { enumerable: true, get: function () { return ip_allowlist_js_1.VIVA_PROD_IPS; } });
+Object.defineProperty(exports, "isAllowedSourceIp", { enumerable: true, get: function () { return ip_allowlist_js_1.isAllowedSourceIp; } });
+var extract_client_ip_js_1 = require("./extract-client-ip.js");
+Object.defineProperty(exports, "extractClientIp", { enumerable: true, get: function () { return extract_client_ip_js_1.extractClientIp; } });
+var hmac_verify_js_1 = require("./hmac-verify.js");
+Object.defineProperty(exports, "verifyHmacSignature", { enumerable: true, get: function () { return hmac_verify_js_1.verifyHmacSignature; } });
+var event_types_js_1 = require("./event-types.js");
+Object.defineProperty(exports, "EVENT_TYPES", { enumerable: true, get: function () { return event_types_js_1.EVENT_TYPES; } });
+Object.defineProperty(exports, "isTransactionEvent", { enumerable: true, get: function () { return event_types_js_1.isTransactionEvent; } });
+Object.defineProperty(exports, "isOnboardingEvent", { enumerable: true, get: function () { return event_types_js_1.isOnboardingEvent; } });
+Object.defineProperty(exports, "V1_EVENT_TYPE_IDS", { enumerable: true, get: function () { return event_types_js_1.V1_EVENT_TYPE_IDS; } });
+var status_lattice_js_1 = require("./status-lattice.js");
+Object.defineProperty(exports, "mapStatusLetter", { enumerable: true, get: function () { return status_lattice_js_1.mapStatusLetter; } });
+Object.defineProperty(exports, "validateStatusTransition", { enumerable: true, get: function () { return status_lattice_js_1.validateStatusTransition; } });
+Object.defineProperty(exports, "applyStatusTransition", { enumerable: true, get: function () { return status_lattice_js_1.applyStatusTransition; } });
 //# sourceMappingURL=index.js.map

package/dist/webhooks/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/webhooks/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,OAAO,EACL,aAAa,EACb,aAAa,EACb,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,eAAe,GAEhB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EACL,WAAW,EAEX,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,qBAAqB,GAEtB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/webhooks/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAEH,iEAAiE;AAAxD,+HAAA,sBAAsB,OAAA;AAE/B,qDAI2B;AAHzB,gHAAA,aAAa,OAAA;AACb,gHAAA,aAAa,OAAA;AACb,oHAAA,iBAAiB,OAAA;AAGnB,+DAGgC;AAF9B,uHAAA,eAAe,OAAA;AAIjB,mDAAuD;AAA9C,qHAAA,mBAAmB,OAAA;AAE5B,mDAM0B;AALxB,6GAAA,WAAW,OAAA;AAEX,oHAAA,kBAAkB,OAAA;AAClB,mHAAA,iBAAiB,OAAA;AACjB,mHAAA,iBAAiB,OAAA;AAGnB,yDAK6B;AAJ3B,oHAAA,eAAe,OAAA;AACf,6HAAA,wBAAwB,OAAA;AACxB,0HAAA,qBAAqB,OAAA"}

package/dist/webhooks/ip-allowlist.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * Viva Wallet webhook source IP allowlist.
  *
@@ -26,7 +27,10 @@
  *
  * @see references/viva-docs/md/webhooks-for-payments.txt:270
  */
-import { BlockList } from 'node:net';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VIVA_PROD_IPS = exports.VIVA_DEMO_IPS = void 0;
+exports.isAllowedSourceIp = isAllowedSourceIp;
+const node_net_1 = require("node:net");
 // ---------------------------------------------------------------------------
 // Published IP lists
 // ---------------------------------------------------------------------------
@@ -36,7 +40,7 @@ import { BlockList } from 'node:net';
  *
  * @see references/viva-docs/md/webhooks-for-payments.txt:289
  */
-export const VIVA_DEMO_IPS = [
+exports.VIVA_DEMO_IPS = [
     '20.50.240.57',
     '40.74.20.78',
     '195.167.87.181',
@@ -49,7 +53,7 @@ export const VIVA_DEMO_IPS = [
  *
  * @see references/viva-docs/md/webhooks-for-payments.txt:276
  */
-export const VIVA_PROD_IPS = [
+exports.VIVA_PROD_IPS = [
     '51.138.37.238',
     '13.80.70.181',
     '13.80.71.223',
@@ -84,15 +88,15 @@ function addToBlockList(bl, entry) {
 }
 /** Build a BlockList from an array of IP/CIDR strings. */
 function buildBlockList(ips) {
-    const bl = new BlockList();
+    const bl = new node_net_1.BlockList();
     for (const entry of ips) {
         addToBlockList(bl, entry);
     }
     return bl;
 }
 // Cached BlockLists built once per process.
-const _demoList = buildBlockList(VIVA_DEMO_IPS);
-const _prodList = buildBlockList(VIVA_PROD_IPS);
+const _demoList = buildBlockList(exports.VIVA_DEMO_IPS);
+const _prodList = buildBlockList(exports.VIVA_PROD_IPS);
 // ---------------------------------------------------------------------------
 // Normaliser
 // ---------------------------------------------------------------------------
@@ -127,7 +131,7 @@ function normaliseIp(ip) {
  *
  * @see references/viva-docs/md/webhooks-for-payments.txt:270
  */
-export function isAllowedSourceIp(ip, env, extraAllowlist) {
+function isAllowedSourceIp(ip, env, extraAllowlist) {
     const normalised = normaliseIp(ip);
     const type = normalised.includes(':') ? 'ipv6' : 'ipv4';
     // Check the env-specific block list.

package/dist/webhooks/ip-allowlist.js.map

@@ -1 +1 @@
-{"version":3,"file":"ip-allowlist.js","sourceRoot":"","sources":["../../src/webhooks/ip-allowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAsB;IAC9C,cAAc;IACd,aAAa;IACb,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,eAAe;CACP,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAsB;IAC9C,eAAe;IACf,cAAc;IACd,cAAc;IACd,aAAa;IACb,mBAAmB;IACnB,mBAAmB;IACnB,aAAa;IACb,aAAa;IACb,gBAAgB;CACR,CAAC;AAEX,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,EAAa,EAAE,KAAa;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,mDAAmD;QACnD,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,SAAS,cAAc,CAAC,GAAsB;IAC5C,MAAM,EAAE,GAAG,IAAI,SAAS,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,4CAA4C;AAC5C,MAAM,SAAS,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;AAChD,MAAM,SAAS,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;AAEhD,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,WAAW,CAAC,EAAU;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAC/B,EAAU,EACV,GAA0B,EAC1B,cAAkC;IAElC,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IAExD,qCAAqC;IACrC,MAAM,IAAI,GAAG,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qCAAqC;IACrC,IAAI,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;QACjD,IAAI,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"ip-allowlist.js","sourceRoot":"","sources":["../../src/webhooks/ip-allowlist.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;;;AAiHH,8CAuBC;AAtID,uCAAqC;AAErC,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;GAKG;AACU,QAAA,aAAa,GAAsB;IAC9C,cAAc;IACd,aAAa;IACb,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,eAAe;CACP,CAAC;AAEX;;;;GAIG;AACU,QAAA,aAAa,GAAsB;IAC9C,eAAe;IACf,cAAc;IACd,cAAc;IACd,aAAa;IACb,mBAAmB;IACnB,mBAAmB;IACnB,aAAa;IACb,aAAa;IACb,gBAAgB;CACR,CAAC;AAEX,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,EAAa,EAAE,KAAa;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,mDAAmD;QACnD,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,SAAS,cAAc,CAAC,GAAsB;IAC5C,MAAM,EAAE,GAAG,IAAI,oBAAS,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,4CAA4C;AAC5C,MAAM,SAAS,GAAG,cAAc,CAAC,qBAAa,CAAC,CAAC;AAChD,MAAM,SAAS,GAAG,cAAc,CAAC,qBAAa,CAAC,CAAC;AAEhD,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,WAAW,CAAC,EAAU;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,iBAAiB,CAC/B,EAAU,EACV,GAA0B,EAC1B,cAAkC;IAElC,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IAExD,qCAAqC;IACrC,MAAM,IAAI,GAAG,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qCAAqC;IACrC,IAAI,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;QACjD,IAAI,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/webhooks/status-lattice.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * Viva transaction status mapping and monotonic status lattice.
  *
@@ -16,6 +17,10 @@
  * @see references/viva-docs/md/wh-sale-transactions.txt:210
  * @see references/viva-docs/md/wh-transaction-payment-created.txt:398
  */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mapStatusLetter = mapStatusLetter;
+exports.validateStatusTransition = validateStatusTransition;
+exports.applyStatusTransition = applyStatusTransition;
 /**
  * Pure mapping from Viva's `StatusId` letter to the plugin's canonical status.
  *
@@ -25,7 +30,7 @@
  * @see references/viva-docs/md/wh-sale-transactions.txt:210
  * @see references/viva-docs/md/wh-transaction-payment-created.txt:398
  */
-export function mapStatusLetter(letter) {
+function mapStatusLetter(letter) {
     switch (letter) {
         case 'F':
             return { status: 'captured', claimSubstate: null };
@@ -171,7 +176,7 @@ const _ANCESTORS = new Map(_ALL_STATUSES.map((s) => [s, computeAncestors(s)]));
  * @see Plan P17 (status lattice), Plan A9 (authorized → cancelled)
  * @see references/viva-docs/md/wh-transaction-payment-created.txt:398
  */
-export function validateStatusTransition(current, next) {
+function validateStatusTransition(current, next) {
     // Idempotent re-apply: same → same is always OK.
     if (current === next) {
         return { ok: true, next };
@@ -200,7 +205,7 @@ export function validateStatusTransition(current, next) {
  *
  * Not part of the core interface spec, provided for S8 convenience.
  */
-export function applyStatusTransition(current, incomingLetter) {
+function applyStatusTransition(current, incomingLetter) {
     const { status: next, claimSubstate } = mapStatusLetter(incomingLetter);
     const result = validateStatusTransition(current, next);
     return { ...result, claimSubstate };