@vonpay/checkout-cli 0.3.2 → 0.4.0

package/dist/commands/tokens.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare function tokensCommand(): Command;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/commands/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/commands/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0BpC,wBAAgB,aAAa,IAAI,OAAO,CAsFvC"}

package/dist/commands/tokens.js

@@ -0,0 +1,77 @@
+import { Command } from "commander";
+import chalk from "chalk";
+import ora from "ora";
+import { requireApiKey } from "../config.js";
+import { makeCheckoutClient } from "../client-factory.js";
+import { parseMetadata } from "../utils/metadata.js";
+import { handleError } from "../utils/errors.js";
+import { isLiveKey, warnLiveSecretFlag } from "../utils/live-key.js";
+function printToken(token) {
+    const statusColor = token.status === "active"
+        ? chalk.green
+        : token.status === "expired"
+            ? chalk.yellow
+            : chalk.red;
+    console.log(`  ID:        ${token.id}`);
+    console.log(`  Status:    ${statusColor(token.status)}`);
+    console.log(`  Card:      ${token.card.brand} •••• ${token.card.last4}`);
+    console.log(`  Expires:   ${String(token.card.expMonth).padStart(2, "0")}/${token.card.expYear}`);
+}
+export function tokensCommand() {
+    const tokens = new Command("tokens").description("Create payment-method tokens for saved-card / MIT flows");
+    tokens
+        .command("create")
+        .description("Create a payment-method token")
+        .option("--buyer-id <id>", "Buyer ID to attach the token to")
+        .option("--provider-reference <ref>", "Provider tokenization handle (required for live keys with iframe-vault providers)")
+        .option("--metadata <pair...>", "Metadata key=value (repeat flag for multiple pairs)")
+        .option("--idempotency-key <key>", "Idempotency key for safe retries")
+        .option("--json", "Output raw JSON")
+        .action(async (opts) => {
+        const apiKey = requireApiKey();
+        // Sandbox keys auto-mint a mock card when no provider reference is
+        // supplied. Live keys with iframe-vault providers require a
+        // browser-minted vault token; the server returns 422 otherwise.
+        if (!opts.buyerId && !opts.providerReference) {
+            if (isLiveKey(apiKey)) {
+                console.warn(chalk.yellow("Warning: no --buyer-id or --provider-reference supplied. Live keys with iframe-vault providers will fail with a 422 validation_error."));
+            }
+            else {
+                console.log(chalk.dim("No --provider-reference supplied; sandbox will auto-mint a mock card token."));
+            }
+        }
+        if (opts.providerReference !== undefined) {
+            warnLiveSecretFlag(apiKey, "--provider-reference");
+        }
+        const client = makeCheckoutClient();
+        const spinner = ora("Creating token...").start();
+        try {
+            const metadata = parseMetadata(opts.metadata);
+            const params = {};
+            if (opts.buyerId !== undefined)
+                params.buyerId = opts.buyerId;
+            if (opts.providerReference !== undefined) {
+                params.providerReference = opts.providerReference;
+            }
+            if (metadata !== undefined)
+                params.metadata = metadata;
+            const token = await client.tokens.create(params, opts.idempotencyKey
+                ? { idempotencyKey: opts.idempotencyKey }
+                : undefined);
+            spinner.stop();
+            if (opts.json) {
+                console.log(JSON.stringify(token, null, 2));
+            }
+            else {
+                console.log(chalk.green("✓ Token created"));
+                printToken(token);
+            }
+        }
+        catch (err) {
+            spinner.stop();
+            handleError(err);
+        }
+    });
+    return tokens;
+}
+//# sourceMappingURL=tokens.js.map

package/dist/commands/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/commands/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AAEtB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAErE,SAAS,UAAU,CAAC,KAAY;IAC9B,MAAM,WAAW,GACf,KAAK,CAAC,MAAM,KAAK,QAAQ;QACvB,CAAC,CAAC,KAAK,CAAC,KAAK;QACb,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS;YAC1B,CAAC,CAAC,KAAK,CAAC,MAAM;YACd,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;IAElB,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,gBAAgB,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CACT,gBAAgB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CACrF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAC9C,yDAAyD,CAC1D,CAAC;IAEF,MAAM;SACH,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,+BAA+B,CAAC;SAC5C,MAAM,CAAC,iBAAiB,EAAE,iCAAiC,CAAC;SAC5D,MAAM,CACL,4BAA4B,EAC5B,mFAAmF,CACpF;SACA,MAAM,CACL,sBAAsB,EACtB,qDAAqD,CACtD;SACA,MAAM,CAAC,yBAAyB,EAAE,kCAAkC,CAAC;SACrE,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC;SACnC,MAAM,CACL,KAAK,EAAE,IAMN,EAAE,EAAE;QACH,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;QAE/B,mEAAmE;QACnE,4DAA4D;QAC5D,gEAAgE;QAChE,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC7C,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtB,OAAO,CAAC,IAAI,CACV,KAAK,CAAC,MAAM,CACV,uIAAuI,CACxI,CACF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,6EAA6E,CAC9E,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACzC,kBAAkB,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC,KAAK,EAAE,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAsB,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;gBAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAC9D,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACzC,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACpD,CAAC;YACD,IAAI,QAAQ,KAAK,SAAS;gBAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAEvD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACtC,MAAM,EACN,IAAI,CAAC,cAAc;gBACjB,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;gBACzC,CAAC,CAAC,SAAS,CACd,CAAC;YACF,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBAC5C,UAAU,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,EAAE,CAAC;YACf,WAAW,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CACF,CAAC;IAEJ,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/commands/trigger.d.ts

@@ -1,3 +1,23 @@
 import { Command } from "commander";
+export declare const SUPPORTED_EVENTS: readonly ["session.succeeded", "session.failed", "payment_intent.succeeded", "payment_intent.failed", "payment_intent.cancelled", "refund.created"];
+type SupportedEvent = (typeof SUPPORTED_EVENTS)[number];
+interface TriggerPayload {
+    event: SupportedEvent;
+    sessionId: string;
+    merchantId: string;
+    amount: number;
+    currency: string;
+    status: string;
+    timestamp: string;
+    transactionId?: string;
+    refundId?: string;
+    paymentIntentId?: string;
+}
+export declare function buildPayload(event: SupportedEvent, opts: {
+    sessionId?: string;
+    amount?: number;
+    currency?: string;
+}): TriggerPayload;
 export declare function triggerCommand(): Command;
+export {};
 //# sourceMappingURL=trigger.d.ts.map

package/dist/commands/trigger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trigger.d.ts","sourceRoot":"","sources":["../../src/commands/trigger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0DpC,wBAAgB,cAAc,IAAI,OAAO,CA0ExC"}
+{"version":3,"file":"trigger.d.ts","sourceRoot":"","sources":["../../src/commands/trigger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,eAAO,MAAM,gBAAgB,qJAOnB,CAAC;AACX,KAAK,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAWxD,UAAU,cAAc;IACtB,KAAK,EAAE,cAAc,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,YAAY,CAC1B,KAAK,EAAE,cAAc,EACrB,IAAI,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D,cAAc,CA4BhB;AAED,wBAAgB,cAAc,IAAI,OAAO,CA0ExC"}

package/dist/commands/trigger.js

@@ -3,21 +3,30 @@ import { createHmac, randomUUID } from "node:crypto";
 import chalk from "chalk";
 import ora from "ora";
 import { requireApiKey } from "../config.js";
-const SUPPORTED_EVENTS = [
+export const SUPPORTED_EVENTS = [
     "session.succeeded",
     "session.failed",
-    "session.expired",
+    "payment_intent.succeeded",
+    "payment_intent.failed",
+    "payment_intent.cancelled",
     "refund.created",
 ];
 const STATUS_BY_EVENT = {
     "session.succeeded": "succeeded",
     "session.failed": "failed",
-    "session.expired": "expired",
+    "payment_intent.succeeded": "succeeded",
+    "payment_intent.failed": "failed",
+    "payment_intent.cancelled": "cancelled",
     "refund.created": "created",
 };
-function buildPayload(event, opts) {
-    const hasTransaction = event === "session.succeeded" || event === "refund.created";
+export function buildPayload(event, opts) {
+    const isPaymentIntent = event.startsWith("payment_intent.");
     const isRefund = event === "refund.created";
+    // A transaction row is written for any terminal success — a settled
+    // session, a captured payment intent, or a refund.
+    const hasTransaction = event === "session.succeeded" ||
+        event === "payment_intent.succeeded" ||
+        isRefund;
     const payload = {
         event,
         sessionId: opts.sessionId ?? `session_test_${randomUUID().slice(0, 8)}`,
@@ -33,6 +42,9 @@ function buildPayload(event, opts) {
     if (isRefund) {
         payload.refundId = `re_test_${randomUUID().slice(0, 8)}`;
     }
+    if (isPaymentIntent) {
+        payload.paymentIntentId = `vpi_test_${randomUUID().slice(0, 8)}`;
+    }
     return payload;
 }
 export function triggerCommand() {

package/dist/commands/trigger.js.map

@@ -1 +1 @@
-{"version":3,"file":"trigger.js","sourceRoot":"","sources":["../../src/commands/trigger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,gBAAgB,GAAG;IACvB,mBAAmB;IACnB,gBAAgB;IAChB,iBAAiB;IACjB,gBAAgB;CACR,CAAC;AAGX,MAAM,eAAe,GAAmC;IACtD,mBAAmB,EAAE,WAAW;IAChC,gBAAgB,EAAE,QAAQ;IAC1B,iBAAiB,EAAE,SAAS;IAC5B,gBAAgB,EAAE,SAAS;CAC5B,CAAC;AAcF,SAAS,YAAY,CACnB,KAAqB,EACrB,IAAgE;IAEhE,MAAM,cAAc,GAClB,KAAK,KAAK,mBAAmB,IAAI,KAAK,KAAK,gBAAgB,CAAC;IAC9D,MAAM,QAAQ,GAAG,KAAK,KAAK,gBAAgB,CAAC;IAC5C,MAAM,OAAO,GAAmB;QAC9B,KAAK;QACL,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,gBAAgB,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QACvE,UAAU,EAAE,iBAAiB,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QACvD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;QAChC,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC;QAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,aAAa,GAAG,YAAY,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,QAAQ,GAAG,WAAW,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC;SAC1B,WAAW,CAAC,0CAA0C,CAAC;SACvD,QAAQ,CAAC,SAAS,EAAE,eAAe,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;SAClE,cAAc,CAAC,aAAa,EAAE,yDAAyD,CAAC;SACxF,MAAM,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;SAChD,MAAM,CAAC,kBAAkB,EAAE,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;SAC3E,MAAM,CAAC,mBAAmB,EAAE,eAAe,CAAC;SAC5C,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAAI,EAAE,EAAE;QACpC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAuB,CAAC,EAAE,CAAC;YACxD,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CACP,kBAAkB,KAAK,gBAAgB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrE,CACF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,YAAY,CAAC,KAAuB,EAAE,IAAI,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;aAC3C,MAAM,CAAC,IAAI,CAAC;aACZ,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE3C,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;QAElE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;gBACrC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,oBAAoB,EAAE,SAAS;oBAC/B,oBAAoB,EAAE,SAAS;oBAC/B,YAAY,EAAE,kCAAkC;iBACjD;gBACD,IAAI;gBACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;YAEH,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,gBAAgB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACxE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,KAAK,KAAK,sBAAsB,QAAQ,CAAC,MAAM,WAAW,CAC3D,CACF,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YAC1D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC3E,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,uEAAuE,CACxE,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,EAAE,CAAC;YACf,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACxD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,GAAG,6BAA6B,CAAC,CAAC,CAAC;YAC9E,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CACP,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CACjE,CACF,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"trigger.js","sourceRoot":"","sources":["../../src/commands/trigger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,mBAAmB;IACnB,gBAAgB;IAChB,0BAA0B;IAC1B,uBAAuB;IACvB,0BAA0B;IAC1B,gBAAgB;CACR,CAAC;AAGX,MAAM,eAAe,GAAmC;IACtD,mBAAmB,EAAE,WAAW;IAChC,gBAAgB,EAAE,QAAQ;IAC1B,0BAA0B,EAAE,WAAW;IACvC,uBAAuB,EAAE,QAAQ;IACjC,0BAA0B,EAAE,WAAW;IACvC,gBAAgB,EAAE,SAAS;CAC5B,CAAC;AAeF,MAAM,UAAU,YAAY,CAC1B,KAAqB,EACrB,IAAgE;IAEhE,MAAM,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,KAAK,KAAK,gBAAgB,CAAC;IAC5C,oEAAoE;IACpE,mDAAmD;IACnD,MAAM,cAAc,GAClB,KAAK,KAAK,mBAAmB;QAC7B,KAAK,KAAK,0BAA0B;QACpC,QAAQ,CAAC;IACX,MAAM,OAAO,GAAmB;QAC9B,KAAK;QACL,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,gBAAgB,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QACvE,UAAU,EAAE,iBAAiB,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QACvD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;QAChC,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC;QAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,aAAa,GAAG,YAAY,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,QAAQ,GAAG,WAAW,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,CAAC,eAAe,GAAG,YAAY,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC;SAC1B,WAAW,CAAC,0CAA0C,CAAC;SACvD,QAAQ,CAAC,SAAS,EAAE,eAAe,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;SAClE,cAAc,CAAC,aAAa,EAAE,yDAAyD,CAAC;SACxF,MAAM,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;SAChD,MAAM,CAAC,kBAAkB,EAAE,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;SAC3E,MAAM,CAAC,mBAAmB,EAAE,eAAe,CAAC;SAC5C,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAAI,EAAE,EAAE;QACpC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAuB,CAAC,EAAE,CAAC;YACxD,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CACP,kBAAkB,KAAK,gBAAgB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrE,CACF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,YAAY,CAAC,KAAuB,EAAE,IAAI,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;aAC3C,MAAM,CAAC,IAAI,CAAC;aACZ,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE3C,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;QAElE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;gBACrC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,oBAAoB,EAAE,SAAS;oBAC/B,oBAAoB,EAAE,SAAS;oBAC/B,YAAY,EAAE,kCAAkC;iBACjD;gBACD,IAAI;gBACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;YAEH,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,gBAAgB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACxE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,KAAK,KAAK,sBAAsB,QAAQ,CAAC,MAAM,WAAW,CAC3D,CACF,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YAC1D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC3E,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,uEAAuE,CACxE,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,EAAE,CAAC;YACf,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACxD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,GAAG,6BAA6B,CAAC,CAAC,CAAC;YAC9E,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CACP,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CACjE,CACF,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/utils/errors.d.ts

@@ -0,0 +1,7 @@
+declare function scrubSecrets(s: string): string;
+export declare function handleError(err: unknown): never;
+export declare const __testing__: {
+    scrubSecrets: typeof scrubSecrets;
+};
+export {};
+//# sourceMappingURL=errors.d.ts.map

package/dist/utils/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/utils/errors.ts"],"names":[],"mappings":"AAKA,iBAAS,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEvC;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,KAAK,CAa/C;AAED,eAAO,MAAM,WAAW;;CAEvB,CAAC"}

package/dist/utils/errors.js

@@ -0,0 +1,24 @@
+import chalk from "chalk";
+import { VonPayError } from "@vonpay/checkout-node";
+const SECRET_KEY_PATTERN = /vp_sk_(test|live)_[A-Za-z0-9_-]+/g;
+function scrubSecrets(s) {
+    return s.replace(SECRET_KEY_PATTERN, "vp_sk_***");
+}
+export function handleError(err) {
+    if (err instanceof VonPayError) {
+        console.error(chalk.red(`Error: ${err.message}`));
+        console.error(chalk.dim(`  Code: ${err.code}`));
+        console.error(chalk.dim(`  Fix:  ${err.fix}`));
+        if (err.requestId) {
+            console.error(chalk.dim(`  Request ID: ${err.requestId}`));
+        }
+        process.exit(1);
+    }
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(chalk.red(`Error: ${scrubSecrets(message)}`));
+    process.exit(1);
+}
+export const __testing__ = {
+    scrubSecrets,
+};
+//# sourceMappingURL=errors.js.map

package/dist/utils/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/utils/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,MAAM,kBAAkB,GAAG,mCAAmC,CAAC;AAE/D,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAClD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAChD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC/C,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,YAAY;CACb,CAAC"}

package/dist/utils/forward-to.d.ts

@@ -0,0 +1,34 @@
+/**
+ * URL validation for `vonpay checkout listen --forward-to`.
+ *
+ * Default posture: loopback-only. Refuses any URL whose hostname is not
+ * one of the IPv4/IPv6 loopback aliases. This protects against the
+ * "I typed the prod URL by mistake" class of incident, where a dev
+ * starts forwarding production webhook attempts at their staging
+ * endpoint or a public colleague's URL.
+ *
+ * The opt-in --forward-to-tunnel flag allows non-loopback hosts for
+ * ngrok / Cloudflare Tunnel workflows. When set, only `https://` is
+ * additionally rejected for non-loopback — http on a public host is
+ * a stronger anti-pattern than tunneled https.
+ *
+ * Scheme: http and https accepted on loopback; non-loopback requires
+ * the tunnel flag.
+ */
+export type ForwardToVerdict = {
+    ok: true;
+    url: URL;
+    isLoopback: boolean;
+    warning?: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Pure validator. No I/O. Caller decides what to do with the verdict
+ * (the CLI surfaces `reason` to stderr and exits non-zero).
+ */
+export declare function validateForwardTo(raw: string, opts: {
+    allowTunnel: boolean;
+}): ForwardToVerdict;
+//# sourceMappingURL=forward-to.d.ts.map

package/dist/utils/forward-to.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward-to.d.ts","sourceRoot":"","sources":["../../src/utils/forward-to.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAmBH,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,WAAW,EAAE,OAAO,CAAA;CAAE,GAC7B,gBAAgB,CA6ClB"}

package/dist/utils/forward-to.js

@@ -0,0 +1,88 @@
+/**
+ * URL validation for `vonpay checkout listen --forward-to`.
+ *
+ * Default posture: loopback-only. Refuses any URL whose hostname is not
+ * one of the IPv4/IPv6 loopback aliases. This protects against the
+ * "I typed the prod URL by mistake" class of incident, where a dev
+ * starts forwarding production webhook attempts at their staging
+ * endpoint or a public colleague's URL.
+ *
+ * The opt-in --forward-to-tunnel flag allows non-loopback hosts for
+ * ngrok / Cloudflare Tunnel workflows. When set, only `https://` is
+ * additionally rejected for non-loopback — http on a public host is
+ * a stronger anti-pattern than tunneled https.
+ *
+ * Scheme: http and https accepted on loopback; non-loopback requires
+ * the tunnel flag.
+ */
+const LOOPBACK_HOSTS = new Set([
+    "localhost",
+    "127.0.0.1",
+    "0.0.0.0", // kernel-wildcard often routes to loopback on Linux / macOS dev hosts
+    "::1",
+    // URL.hostname surrounds IPv6 with brackets, but the bracket-stripping
+    // happens before this set is consulted (see normalizeHost). Both forms
+    // listed for defensiveness.
+    "[::1]",
+    // IPv6-mapped IPv4 loopback. Node's URL parser normalizes
+    // `[::ffff:127.0.0.1]` to either form depending on version — both
+    // are functionally loopback so we list every variant we have
+    // observed in the wild.
+    "::ffff:127.0.0.1",
+    "::ffff:7f00:1",
+]);
+/**
+ * Pure validator. No I/O. Caller decides what to do with the verdict
+ * (the CLI surfaces `reason` to stderr and exits non-zero).
+ */
+export function validateForwardTo(raw, opts) {
+    if (typeof raw !== "string" || raw.length === 0) {
+        return { ok: false, reason: "--forward-to URL is required" };
+    }
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return {
+            ok: false,
+            reason: `--forward-to is not a parseable URL: ${truncate(raw)}`,
+        };
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        return {
+            ok: false,
+            reason: `--forward-to scheme must be http or https; got ${url.protocol}`,
+        };
+    }
+    const host = normalizeHost(url.hostname);
+    const isLoopback = LOOPBACK_HOSTS.has(host);
+    if (!isLoopback && !opts.allowTunnel) {
+        return {
+            ok: false,
+            reason: `--forward-to refuses non-loopback hosts by default (got ${url.hostname}). ` +
+                `Re-run with --forward-to-tunnel if forwarding through ngrok / Cloudflare Tunnel / etc.`,
+        };
+    }
+    // `0.0.0.0` is treated as loopback for dev convenience, but it's a
+    // bind-wildcard, not a guaranteed destination — in some container /
+    // network configs an outbound connection to 0.0.0.0 routes off-host.
+    // Accept it (non-breaking) but warn so a dev who meant "localhost"
+    // isn't silently forwarding off-loopback.
+    const warning = host === "0.0.0.0"
+        ? "forwarding to 0.0.0.0 — that's a bind-wildcard, not a guaranteed loopback destination (it can route off-host in some container/network setups). Prefer 127.0.0.1 or localhost if you meant your local machine."
+        : undefined;
+    return { ok: true, url, isLoopback, warning };
+}
+function normalizeHost(hostname) {
+    // URL.hostname returns IPv6 addresses unwrapped (no brackets), but
+    // dual-coverage doesn't hurt.
+    if (hostname.startsWith("[") && hostname.endsWith("]")) {
+        return hostname.slice(1, -1);
+    }
+    return hostname.toLowerCase();
+}
+function truncate(s) {
+    return s.length <= 120 ? s : `${s.slice(0, 117)}...`;
+}
+//# sourceMappingURL=forward-to.js.map

package/dist/utils/forward-to.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward-to.js","sourceRoot":"","sources":["../../src/utils/forward-to.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,WAAW;IACX,WAAW;IACX,SAAS,EAAE,sEAAsE;IACjF,KAAK;IACL,uEAAuE;IACvE,uEAAuE;IACvE,4BAA4B;IAC5B,OAAO;IACP,0DAA0D;IAC1D,kEAAkE;IAClE,6DAA6D;IAC7D,wBAAwB;IACxB,kBAAkB;IAClB,eAAe;CAChB,CAAC,CAAC;AAMH;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAW,EACX,IAA8B;IAE9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAC/D,CAAC;IAED,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,wCAAwC,QAAQ,CAAC,GAAG,CAAC,EAAE;SAChE,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,kDAAkD,GAAG,CAAC,QAAQ,EAAE;SACzE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAE5C,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACrC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,2DAA2D,GAAG,CAAC,QAAQ,KAAK;gBAC5E,wFAAwF;SAC3F,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,0CAA0C;IAC1C,MAAM,OAAO,GACX,IAAI,KAAK,SAAS;QAChB,CAAC,CAAC,gNAAgN;QAClN,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,mEAAmE;IACnE,8BAA8B;IAC9B,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC;AACvD,CAAC"}

package/dist/utils/listen-forward.d.ts

@@ -0,0 +1,43 @@
+import type { ForwardOutcome } from "./listen-output.js";
+/**
+ * Shadow-forward a webhook event to a local URL.
+ *
+ * The CLI receives a delivery-attempt TRANSCRIPT over SSE — not the
+ * payload itself. To replay the same delivery against a local URL,
+ * the CLI:
+ *
+ *   1. Fetches the full event record via GET /v1/webhook_events/:id
+ *      (the public webhook-event read endpoint)
+ *   2. Computes an HMAC-SHA256 signature over the body using the
+ *      merchant's API key (same secret-equals-key convention the SDK's
+ *      `webhooks.constructEvent` verifies)
+ *   3. POSTs to the local URL with `X-VonPay-Signature` +
+ *      `X-VonPay-Timestamp` headers, matching the live delivery shape.
+ *      The timestamp is stamped HERE, at forward time — see the
+ *      `forwardPayload` body for the fresh-timestamp rationale.
+ *
+ * Bounded by a per-forward timeout (default 5s) and never retries —
+ * shadow-forward is best-effort; if the local URL is down, the
+ * transcript line shows the failure and the dev moves on.
+ *
+ * This re-delivers from the SSE delivery transcript, which differs from
+ * Stripe CLI's `stripe listen --forward-to` pre-empt model.
+ */
+interface ForwardOptions {
+    /** Local URL to POST the payload to. */
+    url: URL;
+    /** Merchant API key (vp_sk_*) — used as HMAC secret. */
+    signingSecret: string;
+    /** Per-forward timeout. Default 5_000. */
+    timeoutMs?: number;
+    /** AbortSignal for graceful shutdown. */
+    signal: AbortSignal;
+}
+/**
+ * Sign + POST a JSON payload to the local URL. Returns an outcome
+ * shape that the output formatters render — never throws (errors
+ * surface via `outcome.error`).
+ */
+export declare function forwardPayload(payload: Record<string, unknown>, opts: ForwardOptions): Promise<ForwardOutcome>;
+export {};
+//# sourceMappingURL=listen-forward.d.ts.map

package/dist/utils/listen-forward.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"listen-forward.d.ts","sourceRoot":"","sources":["../../src/utils/listen-forward.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,UAAU,cAAc;IACtB,wCAAwC;IACxC,GAAG,EAAE,GAAG,CAAC;IACT,wDAAwD;IACxD,aAAa,EAAE,MAAM,CAAC;IACtB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,cAAc,CAAC,CA8DzB"}

package/dist/utils/listen-forward.js

@@ -0,0 +1,106 @@
+import { createHmac } from "node:crypto";
+/**
+ * Sign + POST a JSON payload to the local URL. Returns an outcome
+ * shape that the output formatters render — never throws (errors
+ * surface via `outcome.error`).
+ */
+export async function forwardPayload(payload, opts) {
+    const body = JSON.stringify(payload);
+    // Stamp the moment we forward — NOT the server's original
+    // delivery-attempt time. The CLI is the *re-sender* for this local
+    // delivery: the dev's handler calls `webhooks.constructEvent`, which
+    // rejects any `X-VonPay-Timestamp` outside ±5 min of now. The server's
+    // original timestamp (carried on the SSE `webhook.attempt` frame) is
+    // routinely minutes old — retries, processing lag, a transcript the
+    // dev scrolled back through — so replaying it trips the freshness
+    // window and breaks local verification. A fresh timestamp here matches
+    // Stripe CLI's re-sign posture. The v1 signature covers the body only
+    // (constructEvent verifies the timestamp independently), so the fresh
+    // timestamp does NOT need to be folded into the HMAC.
+    const timestamp = new Date().toISOString();
+    const signature = createHmac("sha256", opts.signingSecret)
+        .update(body)
+        .digest("hex");
+    const timeoutMs = opts.timeoutMs ?? 5_000;
+    const localController = new AbortController();
+    const timeoutId = setTimeout(() => localController.abort(), timeoutMs);
+    const combinedSignal = anySignal([opts.signal, localController.signal]);
+    const start = Date.now();
+    try {
+        const res = await fetch(opts.url.toString(), {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "X-VonPay-Signature": signature,
+                "X-VonPay-Timestamp": timestamp,
+                "User-Agent": "vonpay-cli-listen",
+            },
+            body,
+            signal: combinedSignal,
+        });
+        // Drain response body so the connection can be reused — best practice
+        // for repeated POSTs to the same local endpoint.
+        try {
+            await res.arrayBuffer();
+        }
+        catch {
+            // ignore drain errors; not relevant to forward semantics
+        }
+        return {
+            attempted: true,
+            status: res.status,
+            latencyMs: Date.now() - start,
+            error: null,
+        };
+    }
+    catch (err) {
+        if (opts.signal.aborted) {
+            return { attempted: true, status: null, latencyMs: null, error: "aborted" };
+        }
+        if (localController.signal.aborted) {
+            return { attempted: true, status: null, latencyMs: null, error: `timeout after ${timeoutMs}ms` };
+        }
+        const message = err instanceof Error ? err.message : String(err);
+        return { attempted: true, status: null, latencyMs: null, error: message };
+    }
+    finally {
+        clearTimeout(timeoutId);
+    }
+}
+/**
+ * Combine multiple AbortSignals into one. The returned signal is
+ * aborted when any input signal aborts. Polyfill for `AbortSignal.any`
+ * which is Node 20.5+ only — guard for older 20.x deployments.
+ *
+ * The polyfill tracks every listener it registers and removes them all
+ * once any input fires — without this, the long-lived parent
+ * `opts.signal` accumulates one orphaned listener per forward call,
+ * which on a busy listen stream is a measurable leak.
+ */
+function anySignal(signals) {
+    if (typeof AbortSignal.any === "function") {
+        return AbortSignal.any(signals);
+    }
+    const controller = new AbortController();
+    const tracked = [];
+    const onAbort = () => {
+        for (const sig of tracked) {
+            sig.removeEventListener("abort", onAbort);
+        }
+        controller.abort();
+    };
+    for (const signal of signals) {
+        if (signal.aborted) {
+            controller.abort();
+            // Remove already-added listeners — none yet, but defensive.
+            for (const sig of tracked) {
+                sig.removeEventListener("abort", onAbort);
+            }
+            return controller.signal;
+        }
+        signal.addEventListener("abort", onAbort);
+        tracked.push(signal);
+    }
+    return controller.signal;
+}
+//# sourceMappingURL=listen-forward.js.map

package/dist/utils/listen-forward.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listen-forward.js","sourceRoot":"","sources":["../../src/utils/listen-forward.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAuCzC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgC,EAChC,IAAoB;IAEpB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAErC,0DAA0D;IAC1D,mEAAmE;IACnE,qEAAqE;IACrE,uEAAuE;IACvE,qEAAqE;IACrE,oEAAoE;IACpE,kEAAkE;IAClE,uEAAuE;IACvE,sEAAsE;IACtE,sEAAsE;IACtE,sDAAsD;IACtD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC;SACvD,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IACvE,MAAM,cAAc,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAExE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YAC3C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,oBAAoB,EAAE,SAAS;gBAC/B,oBAAoB,EAAE,SAAS;gBAC/B,YAAY,EAAE,mBAAmB;aAClC;YACD,IAAI;YACJ,MAAM,EAAE,cAAc;SACvB,CAAC,CAAC;QACH,sEAAsE;QACtE,iDAAiD;QACjD,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;QACD,OAAO;YACL,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC7B,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC9E,CAAC;QACD,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACnC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,iBAAiB,SAAS,IAAI,EAAE,CAAC;QACnG,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC5E,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,SAAS,CAAC,OAAsB;IACvC,IAAI,OAAQ,WAA4C,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC5E,OAAQ,WAAqE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,GAAG,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QACD,UAAU,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,4DAA4D;YAC5D,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC1B,GAAG,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,UAAU,CAAC,MAAM,CAAC;QAC3B,CAAC;QACD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,CAAC;AAC3B,CAAC"}

package/dist/utils/listen-output.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Output formatters for `vonpay checkout listen`.
+ *
+ * Two modes:
+ *   - "human" (default) — colored transcript, one line per attempt.
+ *     Optimized for the dev sitting at a terminal watching events
+ *     flow in real time.
+ *   - "json" — one JSON object per line on stdout. Optimized for
+ *     piping to `jq`, `grep`, or log aggregators.
+ *
+ * Lifecycle messages (connecting, reconnecting, etc.) ALWAYS go to
+ * stderr in human mode so stdout stays parseable in `--json` mode
+ * even when interleaved with reconnects.
+ */
+export type OutputMode = "human" | "json";
+/**
+ * Wire shape of the SSE `webhook.attempt` payload. Mirrors
+ * vonpay-checkout's WebhookListenAttempt (snake_case on the wire).
+ *
+ * Duplicated here rather than importing from @vonpay/checkout-node
+ * because the SDK does not currently export an SSE-event type — the
+ * listen surface is CLI-only. If the SDK adds a streaming consumer in
+ * a future minor, this type should move to the SDK and be re-imported.
+ */
+export interface WebhookAttemptPayload {
+    type: "webhook.attempt";
+    subscription_id: string;
+    event_id: string;
+    event_type: string;
+    attempt: number;
+    succeeded: boolean;
+    response_status: number | null;
+    latency_ms: number;
+    timestamp: string;
+    livemode: boolean;
+}
+export interface ForwardOutcome {
+    attempted: boolean;
+    /** Local-URL response status, or null when no attempt was made (no --forward-to). */
+    status: number | null;
+    /** Latency ms of the local-URL POST. */
+    latencyMs: number | null;
+    /** Error message if the forward attempt failed at the network layer. */
+    error: string | null;
+}
+export declare function formatAttemptHuman(payload: WebhookAttemptPayload, forward: ForwardOutcome | null): string;
+export declare function formatAttemptJson(payload: WebhookAttemptPayload, forward: ForwardOutcome | null): string;
+/** Lifecycle line for human mode (stderr). */
+export declare function formatLifecycleHuman(message: string, kind: "info" | "warn" | "error"): string;
+/** Lifecycle line for JSON mode (stderr). */
+export declare function formatLifecycleJson(kind: "connecting" | "connected" | "disconnected" | "auth_failed" | "fatal" | "ready" | "shutdown" | "warning", extra?: Record<string, unknown>): string;
+//# sourceMappingURL=listen-output.d.ts.map

package/dist/utils/listen-output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"listen-output.d.ts","sourceRoot":"","sources":["../../src/utils/listen-output.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC;AAE1C;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,iBAAiB,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,OAAO,CAAC;IACnB,qFAAqF;IACrF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,wCAAwC;IACxC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,wEAAwE;IACxE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GAAG,IAAI,GAC7B,MAAM,CAwBR;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GAAG,IAAI,GAC7B,MAAM,CAqBR;AAED,8CAA8C;AAC9C,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAQ7F;AAED,6CAA6C;AAC7C,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,YAAY,GAAG,WAAW,GAAG,cAAc,GAAG,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,EAC9G,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,MAAM,CAER"}