@vonpay/checkout-cli 0.3.3 → 0.4.1

package/README.md

@@ -36,12 +36,15 @@ All commands are namespaced under `vonpay checkout`:
 | `vonpay checkout refunds create` | Refund a captured intent (full or partial) |
 | `vonpay checkout tokens create` | Create a payment-method token for saved-card / MIT flows |
 | `vonpay checkout capabilities` | Show what this merchant's binder supports |
-| `vonpay checkout trigger <event>` | Trigger a synthetic webhook event against your local endpoint (`session.succeeded`, `session.failed`, `session.expired`, `refund.created`) |
+| `vonpay checkout trigger <event>` | Trigger a synthetic webhook event against your local endpoint (`session.succeeded`, `session.failed`, `refund.created`) |
+| `vonpay checkout listen` | Stream live webhook delivery attempts; optionally re-forward each to a local URL with `--forward-to` |
 | `vonpay checkout health` | Check API health and latency |
 | `vonpay checkout doctor` | Diagnose runtime + env + live API probe |
 
 Run `vonpay checkout <command> --help` for full flag reference.
 
+> **`listen --forward-to` signs forwarded events with the v1 webhook scheme** — a single `x-vonpay-signature: t=<unix-seconds>,v1=<hex>` header, with the HMAC-SHA256 computed over `${t}.${rawBody}` and a fresh `t` stamped at forward time. There is no separate timestamp header. Verify them in your local handler with `vonpay.webhooks.constructEvent(rawBody, signatureHeader, secret)`. For this local forward loop the signing secret is your API key; production deliveries are keyed by your per-endpoint signing secret (`whsec_…`). This is a known limitation of local forwarding — the platform exposes no per-subscription signing secret on the listen stream, so the forwarder cannot reproduce the production secret.
+
 ### Common flags
 
 - `--json` on every read/write command for machine-readable output

package/dist/commands/checkout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checkout.d.ts","sourceRoot":"","sources":["../../src/commands/checkout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYpC,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAevD"}
+{"version":3,"file":"checkout.d.ts","sourceRoot":"","sources":["../../src/commands/checkout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAapC,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAgBvD"}

package/dist/commands/checkout.js

@@ -6,6 +6,7 @@ import { refundsCommand } from "./refunds.js";
 import { tokensCommand } from "./tokens.js";
 import { capabilitiesCommand } from "./capabilities.js";
 import { triggerCommand } from "./trigger.js";
+import { listenCommand } from "./listen.js";
 import { healthCommand } from "./health.js";
 import { doctorCommand } from "./doctor.js";
 export function registerCheckout(program) {
@@ -20,6 +21,7 @@ export function registerCheckout(program) {
     checkout.addCommand(tokensCommand());
     checkout.addCommand(capabilitiesCommand());
     checkout.addCommand(triggerCommand());
+    checkout.addCommand(listenCommand());
     checkout.addCommand(healthCommand());
     checkout.addCommand(doctorCommand());
 }

package/dist/commands/checkout.js.map

@@ -1 +1 @@
-{"version":3,"file":"checkout.js","sourceRoot":"","sources":["../../src/commands/checkout.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,MAAM,QAAQ,GAAG,OAAO;SACrB,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,4BAA4B,CAAC,CAAC;IAE7C,QAAQ,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;IACpC,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC7C,QAAQ,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;IACtC,QAAQ,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;IACtC,QAAQ,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;AACvC,CAAC"}
+{"version":3,"file":"checkout.js","sourceRoot":"","sources":["../../src/commands/checkout.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,MAAM,QAAQ,GAAG,OAAO;SACrB,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,4BAA4B,CAAC,CAAC;IAE7C,QAAQ,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;IACpC,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC7C,QAAQ,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;IACtC,QAAQ,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;IACtC,QAAQ,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;AACvC,CAAC"}

package/dist/commands/listen.d.ts

@@ -0,0 +1,19 @@
+import { Command } from "commander";
+/**
+ * `vonpay checkout listen` — long-lived SSE consumer for the merchant's
+ * webhook delivery attempts.
+ *
+ * Industry conventions followed: WHATWG SSE spec for parsing,
+ * Last-Event-ID for reconnect dedupe, exponential backoff, loopback-only
+ * forward-to (Stripe CLI posture), refuse-live gate (mirrors
+ * `vonpay checkout login --confirm-cli-exposure`), kubectl/gh-style
+ * default human output with `--json` opt-in for machine consumption.
+ *
+ * Output channels:
+ *   stdout — attempt events (one per delivery), formatted per --json
+ *   stderr — lifecycle (connecting, reconnecting, shutdown summary)
+ *
+ * Stdout stays parseable in JSON mode regardless of reconnects.
+ */
+export declare function listenCommand(): Command;
+//# sourceMappingURL=listen.d.ts.map

package/dist/commands/listen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"listen.d.ts","sourceRoot":"","sources":["../../src/commands/listen.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA4BpC;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAqOvC"}

package/dist/commands/listen.js

@@ -0,0 +1,236 @@
+import { Command } from "commander";
+import { VonPayCheckout } from "@vonpay/checkout-node";
+import { requireApiKey } from "../config.js";
+import { getBaseUrl } from "../client-factory.js";
+import { validateForwardTo } from "../utils/forward-to.js";
+import { consumeSse, SseAuthError, } from "../utils/sse-consumer.js";
+import { formatAttemptHuman, formatAttemptJson, formatLifecycleHuman, formatLifecycleJson, } from "../utils/listen-output.js";
+import { forwardPayload } from "../utils/listen-forward.js";
+/**
+ * `vonpay checkout listen` — long-lived SSE consumer for the merchant's
+ * webhook delivery attempts.
+ *
+ * Industry conventions followed: WHATWG SSE spec for parsing,
+ * Last-Event-ID for reconnect dedupe, exponential backoff, loopback-only
+ * forward-to (Stripe CLI posture), refuse-live gate (mirrors
+ * `vonpay checkout login --confirm-cli-exposure`), kubectl/gh-style
+ * default human output with `--json` opt-in for machine consumption.
+ *
+ * Output channels:
+ *   stdout — attempt events (one per delivery), formatted per --json
+ *   stderr — lifecycle (connecting, reconnecting, shutdown summary)
+ *
+ * Stdout stays parseable in JSON mode regardless of reconnects.
+ */
+export function listenCommand() {
+    return new Command("listen")
+        .description("Watch webhook delivery attempts in real time. Optionally re-forward each event to a local URL for development.")
+        .option("--forward-to <url>", "Local URL to receive a shadow copy of each delivered event (loopback only by default)")
+        .option("--forward-to-tunnel", "Allow non-loopback --forward-to URLs (for ngrok / Cloudflare Tunnel workflows)")
+        .option("--events <type>", "Only stream attempts for the given event type. Repeat the flag for multiple types.", (value, prev) => (prev ? [...prev, value] : [value]))
+        .option("--json", "Emit one JSON object per line on stdout instead of the colored transcript")
+        .option("--api-key <key>", "Override the API key from env / config")
+        .option("--confirm-live", "Acknowledge that the listen stream may surface production webhook attempts (required for vp_sk_live_* keys)")
+        .action(async (opts) => {
+        const apiKey = opts.apiKey ?? requireApiKey();
+        if (apiKey.startsWith("vp_sk_live_") && !opts.confirmLive) {
+            process.stderr.write(formatLifecycleHuman("Refusing to start listen with a live key (vp_sk_live_*). Re-run with --confirm-live to acknowledge that production webhook attempts will stream to this terminal.", "error") + "\n");
+            process.exit(1);
+        }
+        if (!apiKey.startsWith("vp_sk_test_") &&
+            !apiKey.startsWith("vp_sk_live_")) {
+            process.stderr.write(formatLifecycleHuman("Listen requires a secret key (vp_sk_*). Publishable keys are rejected by the server.", "error") + "\n");
+            process.exit(1);
+        }
+        let forwardUrl;
+        let forwardWarning;
+        if (opts.forwardTo) {
+            const verdict = validateForwardTo(opts.forwardTo, {
+                allowTunnel: opts.forwardToTunnel === true,
+            });
+            if (!verdict.ok) {
+                process.stderr.write(formatLifecycleHuman(verdict.reason, "error") + "\n");
+                process.exit(1);
+            }
+            forwardUrl = verdict.url;
+            forwardWarning = verdict.warning;
+        }
+        // Build the SSE URL from the SDK's resolved base URL — honors
+        // VONPAY_BASE_URL / config.json baseUrl overrides used by the rest
+        // of the CLI commands.
+        const baseUrl = (getBaseUrl() ?? "https://checkout.vonpay.com").replace(/\/+$/, "");
+        const sseUrl = new URL(`${baseUrl}/v1/webhook_listen`);
+        if (opts.events && opts.events.length > 0) {
+            sseUrl.searchParams.set("event_types", opts.events.join(","));
+        }
+        // SDK client for the per-attempt fetchEvent calls (only used when --forward-to is set)
+        const sdk = forwardUrl
+            ? new VonPayCheckout({ apiKey, baseUrl })
+            : null;
+        const controller = new AbortController();
+        let eventCount = 0;
+        const startedAt = Date.now();
+        const mode = opts.json === true ? "json" : "human";
+        const onSignal = (sig) => {
+            const elapsedSec = Math.round((Date.now() - startedAt) / 1000);
+            if (mode === "human") {
+                process.stderr.write("\n" +
+                    formatLifecycleHuman(`Shutting down (${sig}). Received ${eventCount} event${eventCount === 1 ? "" : "s"} in ${elapsedSec}s.`, "info") +
+                    "\n");
+            }
+            else {
+                process.stderr.write(formatLifecycleJson("shutdown", {
+                    signal: sig,
+                    event_count: eventCount,
+                    elapsed_seconds: elapsedSec,
+                }) + "\n");
+            }
+            controller.abort();
+        };
+        process.once("SIGINT", () => onSignal("SIGINT"));
+        process.once("SIGTERM", () => onSignal("SIGTERM"));
+        const onLifecycle = (event) => {
+            if (mode === "json") {
+                process.stderr.write(formatLifecycleJson(event.kind, lifecyclePayload(event)) + "\n");
+                return;
+            }
+            process.stderr.write(formatLifecycleHuman(lifecycleHumanMessage(event), lifecycleSeverity(event.kind)) + "\n");
+        };
+        // Pre-stream, emitted directly rather than through onLifecycle —
+        // "warning" is not a LifecycleEvent kind (it's a one-shot forward-target
+        // caveat, not a connection-lifecycle transition), so it intentionally
+        // bypasses the onLifecycle/lifecyclePayload path.
+        if (forwardWarning) {
+            process.stderr.write(mode === "human"
+                ? formatLifecycleHuman(forwardWarning, "warn") + "\n"
+                : formatLifecycleJson("warning", { message: forwardWarning }) + "\n");
+        }
+        if (mode === "human") {
+            const filterNote = opts.events?.length
+                ? ` (filtered to ${opts.events.join(", ")})`
+                : "";
+            const fwdNote = forwardUrl ? ` → forwarding to ${forwardUrl.toString()}` : "";
+            process.stderr.write(formatLifecycleHuman(`Ready! Listening for webhook delivery attempts${filterNote}${fwdNote}.`, "info") + "\n");
+        }
+        else {
+            process.stderr.write(formatLifecycleJson("ready", {
+                base_url: baseUrl,
+                filter: opts.events ?? null,
+                forward_to: forwardUrl?.toString() ?? null,
+            }) + "\n");
+        }
+        try {
+            for await (const sseEvent of consumeSse({
+                url: sseUrl.toString(),
+                headers: { Authorization: `Bearer ${apiKey}` },
+                signal: controller.signal,
+                onLifecycle,
+            })) {
+                if (sseEvent.type === "timeout") {
+                    // Server-ceiling. The consumer reconnects transparently —
+                    // surface as a lifecycle note, not a stream event.
+                    onLifecycle({
+                        kind: "disconnected",
+                        reason: "server-ceiling (1h cap; auto-reconnecting)",
+                        willRetryInMs: 0,
+                    });
+                    continue;
+                }
+                if (sseEvent.type !== "webhook.attempt") {
+                    // Future-compatible: skip unknown event types so an additive
+                    // server-side surface doesn't break older CLI versions.
+                    continue;
+                }
+                let payload;
+                try {
+                    payload = JSON.parse(sseEvent.data);
+                }
+                catch {
+                    continue; // malformed frame; skip
+                }
+                eventCount += 1;
+                let forwardOutcome = null;
+                if (forwardUrl && sdk) {
+                    try {
+                        const eventRecord = await sdk.webhookEvents.retrieve(payload.event_id);
+                        forwardOutcome = await forwardPayload(eventRecord.payload, {
+                            url: forwardUrl,
+                            signingSecret: apiKey,
+                            signal: controller.signal,
+                        });
+                    }
+                    catch (err) {
+                        const message = err instanceof Error ? err.message : String(err);
+                        forwardOutcome = {
+                            attempted: true,
+                            status: null,
+                            latencyMs: null,
+                            error: `fetch-event failed: ${message.slice(0, 200)}`,
+                        };
+                    }
+                }
+                if (mode === "human") {
+                    process.stdout.write(formatAttemptHuman(payload, forwardOutcome) + "\n");
+                }
+                else {
+                    process.stdout.write(formatAttemptJson(payload, forwardOutcome) + "\n");
+                }
+            }
+        }
+        catch (err) {
+            if (err instanceof SseAuthError) {
+                if (mode === "human") {
+                    process.stderr.write(formatLifecycleHuman(`Authentication failed (HTTP ${err.status}). Run \`vonpay checkout login\` with a valid secret key.`, "error") + "\n");
+                }
+                else {
+                    process.stderr.write(formatLifecycleJson("auth_failed", { status: err.status }) + "\n");
+                }
+                process.exit(1);
+            }
+            throw err;
+        }
+    });
+}
+function lifecyclePayload(event) {
+    switch (event.kind) {
+        case "connecting":
+            return { last_event_id: event.lastEventId ?? null };
+        case "connected":
+            return {};
+        case "disconnected":
+            return { reason: event.reason, will_retry_in_ms: event.willRetryInMs };
+        case "auth_failed":
+            return { status: event.status };
+        case "fatal":
+            return { error: event.error.message };
+    }
+}
+function lifecycleHumanMessage(event) {
+    switch (event.kind) {
+        case "connecting":
+            return event.lastEventId
+                ? `Reconnecting (resume from ${event.lastEventId})`
+                : "Connecting...";
+        case "connected":
+            return "Connected.";
+        case "disconnected":
+            return `Disconnected: ${event.reason}. Retrying in ${event.willRetryInMs}ms.`;
+        case "auth_failed":
+            return `Authentication failed (HTTP ${event.status}).`;
+        case "fatal":
+            return `Fatal: ${event.error.message}`;
+    }
+}
+function lifecycleSeverity(kind) {
+    switch (kind) {
+        case "connecting":
+        case "connected":
+            return "info";
+        case "disconnected":
+            return "warn";
+        case "auth_failed":
+        case "fatal":
+            return "error";
+    }
+}
+//# sourceMappingURL=listen.js.map

package/dist/commands/listen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listen.js","sourceRoot":"","sources":["../../src/commands/listen.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EACL,UAAU,EACV,YAAY,GAEb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,GAEpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAW5D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC;SACzB,WAAW,CACV,gHAAgH,CACjH;SACA,MAAM,CACL,oBAAoB,EACpB,uFAAuF,CACxF;SACA,MAAM,CACL,qBAAqB,EACrB,gFAAgF,CACjF;SACA,MAAM,CACL,iBAAiB,EACjB,oFAAoF,EACpF,CAAC,KAAa,EAAE,IAA0B,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CACnF;SACA,MAAM,CAAC,QAAQ,EAAE,2EAA2E,CAAC;SAC7F,MAAM,CAAC,iBAAiB,EAAE,wCAAwC,CAAC;SACnE,MAAM,CACL,gBAAgB,EAChB,6GAA6G,CAC9G;SACA,MAAM,CAAC,KAAK,EAAE,IAAmB,EAAE,EAAE;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;QAE9C,IAAI,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oBAAoB,CAClB,mKAAmK,EACnK,OAAO,CACR,GAAG,IAAI,CACT,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IACE,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC;YACjC,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,EACjC,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oBAAoB,CAClB,sFAAsF,EACtF,OAAO,CACR,GAAG,IAAI,CACT,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,UAA2B,CAAC;QAChC,IAAI,cAAkC,CAAC;QACvC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,EAAE;gBAChD,WAAW,EAAE,IAAI,CAAC,eAAe,KAAK,IAAI;aAC3C,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oBAAoB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CACrD,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC;YACzB,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;QACnC,CAAC;QAED,8DAA8D;QAC9D,mEAAmE;QACnE,uBAAuB;QACvB,MAAM,OAAO,GAAG,CAAC,UAAU,EAAE,IAAI,6BAA6B,CAAC,CAAC,OAAO,CACrE,MAAM,EACN,EAAE,CACH,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,OAAO,oBAAoB,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,CAAC;QAED,uFAAuF;QACvF,MAAM,GAAG,GAAG,UAAU;YACpB,CAAC,CAAC,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YACzC,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAqB,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAErE,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAQ,EAAE;YACrC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;YAC/D,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI;oBACF,oBAAoB,CAClB,kBAAkB,GAAG,eAAe,UAAU,SAAS,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,UAAU,IAAI,EACvG,MAAM,CACP;oBACD,IAAI,CACP,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mBAAmB,CAAC,UAAU,EAAE;oBAC9B,MAAM,EAAE,GAAG;oBACX,WAAW,EAAE,UAAU;oBACvB,eAAe,EAAE,UAAU;iBAC5B,CAAC,GAAG,IAAI,CACV,CAAC;YACJ,CAAC;YACD,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QAEnD,MAAM,WAAW,GAAG,CAAC,KAAqB,EAAQ,EAAE;YAClD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAChE,CAAC;gBACF,OAAO;YACT,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACjH,CAAC,CAAC;QAEF,iEAAiE;QACjE,yEAAyE;QACzE,sEAAsE;QACtE,kDAAkD;QAClD,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,KAAK,OAAO;gBACd,CAAC,CAAC,oBAAoB,CAAC,cAAc,EAAE,MAAM,CAAC,GAAG,IAAI;gBACrD,CAAC,CAAC,mBAAmB,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,GAAG,IAAI,CACvE,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM;gBACpC,CAAC,CAAC,iBAAiB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,oBAAoB,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oBAAoB,CAAC,iDAAiD,UAAU,GAAG,OAAO,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,CAC9G,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mBAAmB,CAAC,OAAO,EAAE;gBAC3B,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;gBAC3B,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,IAAI;aAC3C,CAAC,GAAG,IAAI,CACV,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,QAAQ,IAAI,UAAU,CAAC;gBACtC,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACtB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;gBAC9C,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,WAAW;aACZ,CAAC,EAAE,CAAC;gBACH,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBAChC,0DAA0D;oBAC1D,mDAAmD;oBACnD,WAAW,CAAC;wBACV,IAAI,EAAE,cAAc;wBACpB,MAAM,EAAE,4CAA4C;wBACpD,aAAa,EAAE,CAAC;qBACjB,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBACD,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBACxC,6DAA6D;oBAC7D,wDAAwD;oBACxD,SAAS;gBACX,CAAC;gBAED,IAAI,OAA8B,CAAC;gBACnC,IAAI,CAAC;oBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAA0B,CAAC;gBAC/D,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS,CAAC,wBAAwB;gBACpC,CAAC;gBAED,UAAU,IAAI,CAAC,CAAC;gBAChB,IAAI,cAAc,GAAG,IAAI,CAAC;gBAC1B,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;oBACtB,IAAI,CAAC;wBACH,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;wBACvE,cAAc,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,OAAO,EAAE;4BACzD,GAAG,EAAE,UAAU;4BACf,aAAa,EAAE,MAAM;4BACrB,MAAM,EAAE,UAAU,CAAC,MAAM;yBAC1B,CAAC,CAAC;oBACL,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBACjE,cAAc,GAAG;4BACf,SAAS,EAAE,IAAI;4BACf,MAAM,EAAE,IAAI;4BACZ,SAAS,EAAE,IAAI;4BACf,KAAK,EAAE,uBAAuB,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;yBACtD,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;oBACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO,EAAE,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC3E,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAO,EAAE,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,YAAY,EAAE,CAAC;gBAChC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;oBACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oBAAoB,CAClB,+BAA+B,GAAG,CAAC,MAAM,2DAA2D,EACpG,OAAO,CACR,GAAG,IAAI,CACT,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mBAAmB,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,CAClE,CAAC;gBACJ,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAqB;IAC7C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,YAAY;YACf,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;QACtD,KAAK,WAAW;YACd,OAAO,EAAE,CAAC;QACZ,KAAK,cAAc;YACjB,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;QACzE,KAAK,aAAa;YAChB,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAClC,KAAK,OAAO;YACV,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAqB;IAClD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,YAAY;YACf,OAAO,KAAK,CAAC,WAAW;gBACtB,CAAC,CAAC,6BAA6B,KAAK,CAAC,WAAW,GAAG;gBACnD,CAAC,CAAC,eAAe,CAAC;QACtB,KAAK,WAAW;YACd,OAAO,YAAY,CAAC;QACtB,KAAK,cAAc;YACjB,OAAO,iBAAiB,KAAK,CAAC,MAAM,iBAAiB,KAAK,CAAC,aAAa,KAAK,CAAC;QAChF,KAAK,aAAa;YAChB,OAAO,+BAA+B,KAAK,CAAC,MAAM,IAAI,CAAC;QACzD,KAAK,OAAO;YACV,OAAO,UAAU,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAA4B;IACrD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,YAAY,CAAC;QAClB,KAAK,WAAW;YACd,OAAO,MAAM,CAAC;QAChB,KAAK,cAAc;YACjB,OAAO,MAAM,CAAC;QAChB,KAAK,aAAa,CAAC;QACnB,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/commands/trigger.d.ts

@@ -1,3 +1,23 @@
 import { Command } from "commander";
+export declare const SUPPORTED_EVENTS: readonly ["session.succeeded", "session.failed", "payment_intent.succeeded", "payment_intent.failed", "payment_intent.cancelled", "refund.created"];
+type SupportedEvent = (typeof SUPPORTED_EVENTS)[number];
+interface TriggerPayload {
+    event: SupportedEvent;
+    sessionId: string;
+    merchantId: string;
+    amount: number;
+    currency: string;
+    status: string;
+    timestamp: string;
+    transactionId?: string;
+    refundId?: string;
+    paymentIntentId?: string;
+}
+export declare function buildPayload(event: SupportedEvent, opts: {
+    sessionId?: string;
+    amount?: number;
+    currency?: string;
+}): TriggerPayload;
 export declare function triggerCommand(): Command;
+export {};
 //# sourceMappingURL=trigger.d.ts.map

package/dist/commands/trigger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trigger.d.ts","sourceRoot":"","sources":["../../src/commands/trigger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0DpC,wBAAgB,cAAc,IAAI,OAAO,CA0ExC"}
+{"version":3,"file":"trigger.d.ts","sourceRoot":"","sources":["../../src/commands/trigger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,eAAO,MAAM,gBAAgB,qJAOnB,CAAC;AACX,KAAK,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAWxD,UAAU,cAAc;IACtB,KAAK,EAAE,cAAc,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,YAAY,CAC1B,KAAK,EAAE,cAAc,EACrB,IAAI,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D,cAAc,CA4BhB;AAED,wBAAgB,cAAc,IAAI,OAAO,CA+ExC"}

package/dist/commands/trigger.js

@@ -3,21 +3,30 @@ import { createHmac, randomUUID } from "node:crypto";
 import chalk from "chalk";
 import ora from "ora";
 import { requireApiKey } from "../config.js";
-const SUPPORTED_EVENTS = [
+export const SUPPORTED_EVENTS = [
     "session.succeeded",
     "session.failed",
-    "session.expired",
+    "payment_intent.succeeded",
+    "payment_intent.failed",
+    "payment_intent.cancelled",
     "refund.created",
 ];
 const STATUS_BY_EVENT = {
     "session.succeeded": "succeeded",
     "session.failed": "failed",
-    "session.expired": "expired",
+    "payment_intent.succeeded": "succeeded",
+    "payment_intent.failed": "failed",
+    "payment_intent.cancelled": "cancelled",
     "refund.created": "created",
 };
-function buildPayload(event, opts) {
-    const hasTransaction = event === "session.succeeded" || event === "refund.created";
+export function buildPayload(event, opts) {
+    const isPaymentIntent = event.startsWith("payment_intent.");
     const isRefund = event === "refund.created";
+    // A transaction row is written for any terminal success — a settled
+    // session, a captured payment intent, or a refund.
+    const hasTransaction = event === "session.succeeded" ||
+        event === "payment_intent.succeeded" ||
+        isRefund;
     const payload = {
         event,
         sessionId: opts.sessionId ?? `session_test_${randomUUID().slice(0, 8)}`,
@@ -33,6 +42,9 @@ function buildPayload(event, opts) {
     if (isRefund) {
         payload.refundId = `re_test_${randomUUID().slice(0, 8)}`;
     }
+    if (isPaymentIntent) {
+        payload.paymentIntentId = `vpi_test_${randomUUID().slice(0, 8)}`;
+    }
     return payload;
 }
 export function triggerCommand() {
@@ -51,18 +63,23 @@ export function triggerCommand() {
         const apiKey = requireApiKey();
         const payload = buildPayload(event, opts);
         const body = JSON.stringify(payload);
-        const signature = createHmac("sha256", apiKey)
-            .update(body)
+        // v1 webhook signature contract: ONE `x-vonpay-signature` header of
+        // shape `t=<unix-seconds>,v1=<hex>`, HMAC-SHA256 over `${t}.${body}`.
+        // There is no separate timestamp header. For this local trigger the
+        // signing secret is your API key (verify with
+        // `constructEvent(rawBody, signatureHeader, apiKey)`).
+        const t = Math.floor(Date.now() / 1000);
+        const v1 = createHmac("sha256", apiKey)
+            .update(`${t}.${body}`)
             .digest("hex");
-        const timestamp = new Date().toISOString();
+        const signatureHeader = `t=${t},v1=${v1}`;
         const spinner = ora(`Sending ${event} to ${opts.url}...`).start();
         try {
             const response = await fetch(opts.url, {
                 method: "POST",
                 headers: {
                     "Content-Type": "application/json",
-                    "X-VonPay-Signature": signature,
-                    "X-VonPay-Timestamp": timestamp,
+                    "x-vonpay-signature": signatureHeader,
                     "User-Agent": "VonPay-Webhook/1.0 (CLI trigger)",
                 },
                 body,
@@ -77,7 +94,7 @@ export function triggerCommand() {
             }
             console.log(chalk.dim(`  Session: ${payload.sessionId}`));
             console.log(chalk.dim(`  Amount:  ${payload.amount} ${payload.currency}`));
-            console.log(chalk.dim(`\n  Verify with: vonpay.webhooks.constructEvent(rawBody, sig, apiKey)`));
+            console.log(chalk.dim(`\n  Verify with: vonpay.webhooks.constructEvent(rawBody, signatureHeader, apiKey)`));
         }
         catch (err) {
             spinner.stop();

package/dist/commands/trigger.js.map

@@ -1 +1 @@
-{"version":3,"file":"trigger.js","sourceRoot":"","sources":["../../src/commands/trigger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,gBAAgB,GAAG;IACvB,mBAAmB;IACnB,gBAAgB;IAChB,iBAAiB;IACjB,gBAAgB;CACR,CAAC;AAGX,MAAM,eAAe,GAAmC;IACtD,mBAAmB,EAAE,WAAW;IAChC,gBAAgB,EAAE,QAAQ;IAC1B,iBAAiB,EAAE,SAAS;IAC5B,gBAAgB,EAAE,SAAS;CAC5B,CAAC;AAcF,SAAS,YAAY,CACnB,KAAqB,EACrB,IAAgE;IAEhE,MAAM,cAAc,GAClB,KAAK,KAAK,mBAAmB,IAAI,KAAK,KAAK,gBAAgB,CAAC;IAC9D,MAAM,QAAQ,GAAG,KAAK,KAAK,gBAAgB,CAAC;IAC5C,MAAM,OAAO,GAAmB;QAC9B,KAAK;QACL,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,gBAAgB,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QACvE,UAAU,EAAE,iBAAiB,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QACvD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;QAChC,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC;QAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,aAAa,GAAG,YAAY,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,QAAQ,GAAG,WAAW,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC;SAC1B,WAAW,CAAC,0CAA0C,CAAC;SACvD,QAAQ,CAAC,SAAS,EAAE,eAAe,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;SAClE,cAAc,CAAC,aAAa,EAAE,yDAAyD,CAAC;SACxF,MAAM,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;SAChD,MAAM,CAAC,kBAAkB,EAAE,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;SAC3E,MAAM,CAAC,mBAAmB,EAAE,eAAe,CAAC;SAC5C,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAAI,EAAE,EAAE;QACpC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAuB,CAAC,EAAE,CAAC;YACxD,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CACP,kBAAkB,KAAK,gBAAgB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrE,CACF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,YAAY,CAAC,KAAuB,EAAE,IAAI,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;aAC3C,MAAM,CAAC,IAAI,CAAC;aACZ,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE3C,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;QAElE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;gBACrC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,oBAAoB,EAAE,SAAS;oBAC/B,oBAAoB,EAAE,SAAS;oBAC/B,YAAY,EAAE,kCAAkC;iBACjD;gBACD,IAAI;gBACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;YAEH,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,gBAAgB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACxE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,KAAK,KAAK,sBAAsB,QAAQ,CAAC,MAAM,WAAW,CAC3D,CACF,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YAC1D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC3E,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,uEAAuE,CACxE,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,EAAE,CAAC;YACf,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACxD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,GAAG,6BAA6B,CAAC,CAAC,CAAC;YAC9E,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CACP,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CACjE,CACF,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"trigger.js","sourceRoot":"","sources":["../../src/commands/trigger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,mBAAmB;IACnB,gBAAgB;IAChB,0BAA0B;IAC1B,uBAAuB;IACvB,0BAA0B;IAC1B,gBAAgB;CACR,CAAC;AAGX,MAAM,eAAe,GAAmC;IACtD,mBAAmB,EAAE,WAAW;IAChC,gBAAgB,EAAE,QAAQ;IAC1B,0BAA0B,EAAE,WAAW;IACvC,uBAAuB,EAAE,QAAQ;IACjC,0BAA0B,EAAE,WAAW;IACvC,gBAAgB,EAAE,SAAS;CAC5B,CAAC;AAeF,MAAM,UAAU,YAAY,CAC1B,KAAqB,EACrB,IAAgE;IAEhE,MAAM,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,KAAK,KAAK,gBAAgB,CAAC;IAC5C,oEAAoE;IACpE,mDAAmD;IACnD,MAAM,cAAc,GAClB,KAAK,KAAK,mBAAmB;QAC7B,KAAK,KAAK,0BAA0B;QACpC,QAAQ,CAAC;IACX,MAAM,OAAO,GAAmB;QAC9B,KAAK;QACL,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,gBAAgB,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QACvE,UAAU,EAAE,iBAAiB,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QACvD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;QAChC,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC;QAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CAAC,aAAa,GAAG,YAAY,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,QAAQ,GAAG,WAAW,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,CAAC,eAAe,GAAG,YAAY,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC;SAC1B,WAAW,CAAC,0CAA0C,CAAC;SACvD,QAAQ,CAAC,SAAS,EAAE,eAAe,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;SAClE,cAAc,CAAC,aAAa,EAAE,yDAAyD,CAAC;SACxF,MAAM,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;SAChD,MAAM,CAAC,kBAAkB,EAAE,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;SAC3E,MAAM,CAAC,mBAAmB,EAAE,eAAe,CAAC;SAC5C,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAAI,EAAE,EAAE;QACpC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAuB,CAAC,EAAE,CAAC;YACxD,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CACP,kBAAkB,KAAK,gBAAgB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrE,CACF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,YAAY,CAAC,KAAuB,EAAE,IAAI,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,oEAAoE;QACpE,sEAAsE;QACtE,oEAAoE;QACpE,8CAA8C;QAC9C,uDAAuD;QACvD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACxC,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;aACpC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;aACtB,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAE1C,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;QAElE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;gBACrC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,oBAAoB,EAAE,eAAe;oBACrC,YAAY,EAAE,kCAAkC;iBACjD;gBACD,IAAI;gBACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;YAEH,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,gBAAgB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACxE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,KAAK,KAAK,sBAAsB,QAAQ,CAAC,MAAM,WAAW,CAC3D,CACF,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YAC1D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC3E,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,mFAAmF,CACpF,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,EAAE,CAAC;YACf,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACxD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,GAAG,6BAA6B,CAAC,CAAC,CAAC;YAC9E,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CACP,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CACjE,CACF,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/utils/forward-to.d.ts

@@ -0,0 +1,34 @@
+/**
+ * URL validation for `vonpay checkout listen --forward-to`.
+ *
+ * Default posture: loopback-only. Refuses any URL whose hostname is not
+ * one of the IPv4/IPv6 loopback aliases. This protects against the
+ * "I typed the prod URL by mistake" class of incident, where a dev
+ * starts forwarding production webhook attempts at their staging
+ * endpoint or a public colleague's URL.
+ *
+ * The opt-in --forward-to-tunnel flag allows non-loopback hosts for
+ * ngrok / Cloudflare Tunnel workflows. When set, only `https://` is
+ * additionally rejected for non-loopback — http on a public host is
+ * a stronger anti-pattern than tunneled https.
+ *
+ * Scheme: http and https accepted on loopback; non-loopback requires
+ * the tunnel flag.
+ */
+export type ForwardToVerdict = {
+    ok: true;
+    url: URL;
+    isLoopback: boolean;
+    warning?: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Pure validator. No I/O. Caller decides what to do with the verdict
+ * (the CLI surfaces `reason` to stderr and exits non-zero).
+ */
+export declare function validateForwardTo(raw: string, opts: {
+    allowTunnel: boolean;
+}): ForwardToVerdict;
+//# sourceMappingURL=forward-to.d.ts.map

package/dist/utils/forward-to.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward-to.d.ts","sourceRoot":"","sources":["../../src/utils/forward-to.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAmBH,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,WAAW,EAAE,OAAO,CAAA;CAAE,GAC7B,gBAAgB,CA6ClB"}

package/dist/utils/forward-to.js

@@ -0,0 +1,88 @@
+/**
+ * URL validation for `vonpay checkout listen --forward-to`.
+ *
+ * Default posture: loopback-only. Refuses any URL whose hostname is not
+ * one of the IPv4/IPv6 loopback aliases. This protects against the
+ * "I typed the prod URL by mistake" class of incident, where a dev
+ * starts forwarding production webhook attempts at their staging
+ * endpoint or a public colleague's URL.
+ *
+ * The opt-in --forward-to-tunnel flag allows non-loopback hosts for
+ * ngrok / Cloudflare Tunnel workflows. When set, only `https://` is
+ * additionally rejected for non-loopback — http on a public host is
+ * a stronger anti-pattern than tunneled https.
+ *
+ * Scheme: http and https accepted on loopback; non-loopback requires
+ * the tunnel flag.
+ */
+const LOOPBACK_HOSTS = new Set([
+    "localhost",
+    "127.0.0.1",
+    "0.0.0.0", // kernel-wildcard often routes to loopback on Linux / macOS dev hosts
+    "::1",
+    // URL.hostname surrounds IPv6 with brackets, but the bracket-stripping
+    // happens before this set is consulted (see normalizeHost). Both forms
+    // listed for defensiveness.
+    "[::1]",
+    // IPv6-mapped IPv4 loopback. Node's URL parser normalizes
+    // `[::ffff:127.0.0.1]` to either form depending on version — both
+    // are functionally loopback so we list every variant we have
+    // observed in the wild.
+    "::ffff:127.0.0.1",
+    "::ffff:7f00:1",
+]);
+/**
+ * Pure validator. No I/O. Caller decides what to do with the verdict
+ * (the CLI surfaces `reason` to stderr and exits non-zero).
+ */
+export function validateForwardTo(raw, opts) {
+    if (typeof raw !== "string" || raw.length === 0) {
+        return { ok: false, reason: "--forward-to URL is required" };
+    }
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return {
+            ok: false,
+            reason: `--forward-to is not a parseable URL: ${truncate(raw)}`,
+        };
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        return {
+            ok: false,
+            reason: `--forward-to scheme must be http or https; got ${url.protocol}`,
+        };
+    }
+    const host = normalizeHost(url.hostname);
+    const isLoopback = LOOPBACK_HOSTS.has(host);
+    if (!isLoopback && !opts.allowTunnel) {
+        return {
+            ok: false,
+            reason: `--forward-to refuses non-loopback hosts by default (got ${url.hostname}). ` +
+                `Re-run with --forward-to-tunnel if forwarding through ngrok / Cloudflare Tunnel / etc.`,
+        };
+    }
+    // `0.0.0.0` is treated as loopback for dev convenience, but it's a
+    // bind-wildcard, not a guaranteed destination — in some container /
+    // network configs an outbound connection to 0.0.0.0 routes off-host.
+    // Accept it (non-breaking) but warn so a dev who meant "localhost"
+    // isn't silently forwarding off-loopback.
+    const warning = host === "0.0.0.0"
+        ? "forwarding to 0.0.0.0 — that's a bind-wildcard, not a guaranteed loopback destination (it can route off-host in some container/network setups). Prefer 127.0.0.1 or localhost if you meant your local machine."
+        : undefined;
+    return { ok: true, url, isLoopback, warning };
+}
+function normalizeHost(hostname) {
+    // URL.hostname returns IPv6 addresses unwrapped (no brackets), but
+    // dual-coverage doesn't hurt.
+    if (hostname.startsWith("[") && hostname.endsWith("]")) {
+        return hostname.slice(1, -1);
+    }
+    return hostname.toLowerCase();
+}
+function truncate(s) {
+    return s.length <= 120 ? s : `${s.slice(0, 117)}...`;
+}
+//# sourceMappingURL=forward-to.js.map

package/dist/utils/forward-to.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forward-to.js","sourceRoot":"","sources":["../../src/utils/forward-to.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,WAAW;IACX,WAAW;IACX,SAAS,EAAE,sEAAsE;IACjF,KAAK;IACL,uEAAuE;IACvE,uEAAuE;IACvE,4BAA4B;IAC5B,OAAO;IACP,0DAA0D;IAC1D,kEAAkE;IAClE,6DAA6D;IAC7D,wBAAwB;IACxB,kBAAkB;IAClB,eAAe;CAChB,CAAC,CAAC;AAMH;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAW,EACX,IAA8B;IAE9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAC/D,CAAC;IAED,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,wCAAwC,QAAQ,CAAC,GAAG,CAAC,EAAE;SAChE,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,kDAAkD,GAAG,CAAC,QAAQ,EAAE;SACzE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAE5C,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACrC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,2DAA2D,GAAG,CAAC,QAAQ,KAAK;gBAC5E,wFAAwF;SAC3F,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,0CAA0C;IAC1C,MAAM,OAAO,GACX,IAAI,KAAK,SAAS;QAChB,CAAC,CAAC,gNAAgN;QAClN,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,mEAAmE;IACnE,8BAA8B;IAC9B,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC;AACvD,CAAC"}

package/dist/utils/listen-forward.d.ts

@@ -0,0 +1,49 @@
+import type { ForwardOutcome } from "./listen-output.js";
+/**
+ * Shadow-forward a webhook event to a local URL.
+ *
+ * The CLI receives a delivery-attempt TRANSCRIPT over SSE — not the
+ * payload itself. To replay the same delivery against a local URL,
+ * the CLI:
+ *
+ *   1. Fetches the full event record via GET /v1/webhook_events/:id
+ *      (the public webhook-event read endpoint)
+ *   2. Signs it with the v1 webhook contract — a single
+ *      `x-vonpay-signature: t=<unix-seconds>,v1=<hex>` header whose
+ *      HMAC-SHA256 is computed over `${t}.${body}` (the same shape the
+ *      SDK's `webhooks.constructEvent` verifies). For this local dev loop
+ *      the signing secret is your API key, so verify with
+ *      `webhooks.constructEvent(rawBody, signatureHeader, yourApiKey)`.
+ *   3. POSTs to the local URL with that single header, matching the live
+ *      delivery shape. The `t` is stamped HERE, at forward time — see the
+ *      `forwardPayload` body for the fresh-timestamp rationale.
+ *
+ * Bounded by a per-forward timeout (default 5s) and never retries —
+ * shadow-forward is best-effort; if the local URL is down, the
+ * transcript line shows the failure and the dev moves on.
+ *
+ * This re-delivers from the SSE delivery transcript, which differs from
+ * Stripe CLI's `stripe listen --forward-to` pre-empt model.
+ */
+interface ForwardOptions {
+    /** Local URL to POST the payload to. */
+    url: URL;
+    /** Secret used to key the v1 HMAC. The listen stream exposes no
+     *  per-endpoint signing secret, so for this local forward loop the API
+     *  key (vp_sk_*) is used as a stand-in — verify the forwarded delivery
+     *  with `constructEvent(rawBody, signatureHeader, sameKey)`. Production
+     *  deliveries are keyed by the per-endpoint signing secret (whsec_…). */
+    signingSecret: string;
+    /** Per-forward timeout. Default 5_000. */
+    timeoutMs?: number;
+    /** AbortSignal for graceful shutdown. */
+    signal: AbortSignal;
+}
+/**
+ * Sign + POST a JSON payload to the local URL. Returns an outcome
+ * shape that the output formatters render — never throws (errors
+ * surface via `outcome.error`).
+ */
+export declare function forwardPayload(payload: Record<string, unknown>, opts: ForwardOptions): Promise<ForwardOutcome>;
+export {};
+//# sourceMappingURL=listen-forward.d.ts.map