@waffo/pancake-ts 0.1.5 → 0.1.9

package/dist/index.js

@@ -126,7 +126,7 @@ ${bodyHash}`;
 }
 
 // src/http-client.ts
-var DEFAULT_BASE_URL = "https://waffo-pancake-auth-service.vercel.app";
+var DEFAULT_BASE_URL = "https://api.waffo.ai";
 var HttpClient = class {
   merchantId;
   privateKey;
@@ -187,7 +187,7 @@ var AuthResource = class {
    *
    * @example
    * const { token, expiresAt } = await client.auth.issueSessionToken({
-   *   storeId: "store_xxx",
+   *   storeId: "STO_xxx",
    *   buyerIdentity: "customer@example.com",
    * });
    */
@@ -196,21 +196,107 @@ var AuthResource = class {
   }
 };
 
+// src/resources/checkout-anonymous.ts
+var CheckoutAnonymousResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /**
+   * Create an anonymous checkout session.
+   *
+   * @param params - Checkout parameters (no buyer identity required)
+   * @returns Session ID, checkout URL, and expiration
+   *
+   * @example
+   * const result = await client.checkout.anonymous.create({
+   *   storeId: "STO_xxx",
+   *   productId: "PROD_xxx",
+   *   productType: "onetime",
+   *   currency: "USD",
+   * });
+   * // Redirect to result.checkoutUrl
+   */
+  async create(params) {
+    return this.http.post(
+      "/v1/actions/checkout/create-session",
+      params
+    );
+  }
+};
+
+// src/resources/checkout-authenticated.ts
+var CheckoutAuthenticatedResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /**
+   * Create an authenticated checkout session.
+   *
+   * Behavior:
+   * - Issues a session token via `issue-session-token`
+   * - Creates a checkout session via `create-session`
+   * - Appends the token to the checkout URL as a URL fragment
+   * - Defaults `buyerEmail` to `buyerIdentity` when omitted
+   *
+   * @param params - Checkout parameters including buyer identity
+   * @returns Session details with token-appended checkout URL
+   *
+   * @example
+   * const result = await client.checkout.authenticated.create({
+   *   storeId: "STO_xxx",
+   *   productId: "PROD_xxx",
+   *   productType: "onetime",
+   *   currency: "USD",
+   *   buyerIdentity: "customer@example.com",
+   * });
+   * // Redirect to result.checkoutUrl (includes #token=...)
+   */
+  async create(params) {
+    const { buyerIdentity, buyerEmail, ...sessionFields } = params;
+    const [tokenResult, sessionResult] = await Promise.all([
+      this.http.post("/v1/actions/auth/issue-session-token", {
+        storeId: params.storeId,
+        buyerIdentity
+      }),
+      this.http.post("/v1/actions/checkout/create-session", {
+        ...sessionFields,
+        buyerEmail: buyerEmail ?? buyerIdentity
+      })
+    ]);
+    return {
+      sessionId: sessionResult.sessionId,
+      checkoutUrl: `${sessionResult.checkoutUrl}#token=${tokenResult.token}`,
+      expiresAt: sessionResult.expiresAt,
+      token: tokenResult.token,
+      tokenExpiresAt: tokenResult.expiresAt
+    };
+  }
+};
+
 // src/resources/checkout.ts
 var CheckoutResource = class {
   constructor(http) {
     this.http = http;
+    this.anonymous = new CheckoutAnonymousResource(http);
+    this.authenticated = new CheckoutAuthenticatedResource(http);
   }
+  /** Anonymous checkout — visitor enters without a session token. */
+  anonymous;
+  /** Authenticated checkout — merchant provides buyer identity. */
+  authenticated;
   /**
-   * Create a checkout session. Returns a URL to redirect the customer to.
+   * Create a checkout session (low-level). Returns a URL to redirect the customer to.
+   *
+   * For most use cases, prefer `checkout.anonymous.create()` or
+   * `checkout.authenticated.create()` which handle the full flow automatically.
    *
    * @param params - Checkout session parameters
    * @returns Session ID, checkout URL, and expiration
    *
    * @example
    * const session = await client.checkout.createSession({
-   *   storeId: "store_xxx",
-   *   productId: "prod_xxx",
+   *   storeId: "STO_xxx",
+   *   productId: "PROD_xxx",
    *   productType: "onetime",
    *   currency: "USD",
    *   buyerEmail: "customer@example.com",
@@ -242,7 +328,7 @@ var GraphQLResource = class {
    * @example
    * const result = await client.graphql.query({
    *   query: `query ($id: ID!) { onetimeProduct(id: $id) { id name prices } }`,
-   *   variables: { id: "prod_xxx" },
+   *   variables: { id: "PROD_xxx" },
    * });
    */
   async query(params) {
@@ -263,9 +349,9 @@ var OnetimeProductsResource = class {
    *
    * @example
    * const { product } = await client.onetimeProducts.create({
-   *   storeId: "store_xxx",
+   *   storeId: "STO_xxx",
    *   name: "E-Book",
-   *   prices: { USD: { amount: 2900, taxCategory: "digital_goods" } },
+   *   prices: { USD: { amount: "29.00", taxCategory: "digital_goods" } },
    * });
    */
   async create(params) {
@@ -279,9 +365,9 @@ var OnetimeProductsResource = class {
    *
    * @example
    * const { product } = await client.onetimeProducts.update({
-   *   id: "prod_xxx",
+   *   id: "PROD_xxx",
    *   name: "E-Book v2",
-   *   prices: { USD: { amount: 3900, taxCategory: "digital_goods" } },
+   *   prices: { USD: { amount: "39.00", taxCategory: "digital_goods" } },
    * });
    */
   async update(params) {
@@ -294,7 +380,7 @@ var OnetimeProductsResource = class {
    * @returns Published product detail
    *
    * @example
-   * const { product } = await client.onetimeProducts.publish({ id: "prod_xxx" });
+   * const { product } = await client.onetimeProducts.publish({ id: "PROD_xxx" });
    */
   async publish(params) {
     return this.http.post("/v1/actions/onetime-product/publish-product", params);
@@ -307,7 +393,7 @@ var OnetimeProductsResource = class {
    *
    * @example
    * const { product } = await client.onetimeProducts.updateStatus({
-   *   id: "prod_xxx",
+   *   id: "PROD_xxx",
    *   status: ProductVersionStatus.Inactive,
    * });
    */
@@ -332,7 +418,7 @@ var OrdersResource = class {
    *
    * @example
    * const { orderId, status } = await client.orders.cancelSubscription({
-   *   orderId: "order_xxx",
+   *   orderId: "ORD_xxx",
    * });
    * // status: "canceled" or "canceling"
    */
@@ -354,7 +440,7 @@ var StoreMerchantsResource = class {
    *
    * @example
    * const result = await client.storeMerchants.add({
-   *   storeId: "store_xxx",
+   *   storeId: "STO_xxx",
    *   email: "member@example.com",
    *   role: "admin",
    * });
@@ -370,8 +456,8 @@ var StoreMerchantsResource = class {
    *
    * @example
    * const result = await client.storeMerchants.remove({
-   *   storeId: "store_xxx",
-   *   merchantId: "merchant_xxx",
+   *   storeId: "STO_xxx",
+   *   merchantId: "MER_xxx",
    * });
    */
   async remove(params) {
@@ -385,8 +471,8 @@ var StoreMerchantsResource = class {
    *
    * @example
    * const result = await client.storeMerchants.updateRole({
-   *   storeId: "store_xxx",
-   *   merchantId: "merchant_xxx",
+   *   storeId: "STO_xxx",
+   *   merchantId: "MER_xxx",
    *   role: "member",
    * });
    */
@@ -420,7 +506,7 @@ var StoresResource = class {
    *
    * @example
    * const { store } = await client.stores.update({
-   *   id: "store_xxx",
+   *   id: "STO_xxx",
    *   name: "Updated Name",
    * });
    */
@@ -434,7 +520,7 @@ var StoresResource = class {
    * @returns Deleted store entity (with `deletedAt` set)
    *
    * @example
-   * const { store } = await client.stores.delete({ id: "store_xxx" });
+   * const { store } = await client.stores.delete({ id: "STO_xxx" });
    */
   async delete(params) {
     return this.http.post("/v1/actions/store/delete-store", params);
@@ -454,10 +540,10 @@ var SubscriptionProductGroupsResource = class {
    *
    * @example
    * const { group } = await client.subscriptionProductGroups.create({
-   *   storeId: "store_xxx",
+   *   storeId: "STO_xxx",
    *   name: "Pro Plans",
    *   rules: { sharedTrial: true },
-   *   productIds: ["prod_aaa", "prod_bbb"],
+   *   productIds: ["PROD_aaa", "PROD_bbb"],
    * });
    */
   async create(params) {
@@ -471,8 +557,8 @@ var SubscriptionProductGroupsResource = class {
    *
    * @example
    * const { group } = await client.subscriptionProductGroups.update({
-   *   id: "group_xxx",
-   *   productIds: ["prod_aaa", "prod_bbb", "prod_ccc"],
+   *   id: "GRP_xxx",
+   *   productIds: ["PROD_aaa", "PROD_bbb", "PROD_ccc"],
    * });
    */
   async update(params) {
@@ -485,7 +571,7 @@ var SubscriptionProductGroupsResource = class {
    * @returns Deleted group entity
    *
    * @example
-   * const { group } = await client.subscriptionProductGroups.delete({ id: "group_xxx" });
+   * const { group } = await client.subscriptionProductGroups.delete({ id: "GRP_xxx" });
    */
   async delete(params) {
     return this.http.post("/v1/actions/subscription-product-group/delete-group", params);
@@ -497,7 +583,7 @@ var SubscriptionProductGroupsResource = class {
    * @returns Published group entity
    *
    * @example
-   * const { group } = await client.subscriptionProductGroups.publish({ id: "group_xxx" });
+   * const { group } = await client.subscriptionProductGroups.publish({ id: "GRP_xxx" });
    */
   async publish(params) {
     return this.http.post("/v1/actions/subscription-product-group/publish-group", params);
@@ -517,10 +603,10 @@ var SubscriptionProductsResource = class {
    *
    * @example
    * const { product } = await client.subscriptionProducts.create({
-   *   storeId: "store_xxx",
+   *   storeId: "STO_xxx",
    *   name: "Pro Plan",
    *   billingPeriod: "monthly",
-   *   prices: { USD: { amount: 999, taxCategory: "saas" } },
+   *   prices: { USD: { amount: "9.99", taxCategory: "saas" } },
    * });
    */
   async create(params) {
@@ -534,10 +620,10 @@ var SubscriptionProductsResource = class {
    *
    * @example
    * const { product } = await client.subscriptionProducts.update({
-   *   id: "prod_xxx",
+   *   id: "PROD_xxx",
    *   name: "Pro Plan v2",
    *   billingPeriod: "monthly",
-   *   prices: { USD: { amount: 1499, taxCategory: "saas" } },
+   *   prices: { USD: { amount: "14.99", taxCategory: "saas" } },
    * });
    */
   async update(params) {
@@ -550,7 +636,7 @@ var SubscriptionProductsResource = class {
    * @returns Published product detail
    *
    * @example
-   * const { product } = await client.subscriptionProducts.publish({ id: "prod_xxx" });
+   * const { product } = await client.subscriptionProducts.publish({ id: "PROD_xxx" });
    */
   async publish(params) {
     return this.http.post("/v1/actions/subscription-product/publish-product", params);
@@ -563,7 +649,7 @@ var SubscriptionProductsResource = class {
    *
    * @example
    * const { product } = await client.subscriptionProducts.updateStatus({
-   *   id: "prod_xxx",
+   *   id: "PROD_xxx",
    *   status: ProductVersionStatus.Active,
    * });
    */
@@ -611,6 +697,23 @@ function rsaVerify(signatureInput, v1, publicKey) {
   verifier.update(signatureInput);
   return verifier.verify(publicKey, v1, "base64");
 }
+function resolveKeyForEnv(env, configKeys) {
+  if (typeof configKeys === "string") {
+    return normalizePublicKey(configKeys);
+  }
+  if (configKeys?.[env]) {
+    return normalizePublicKey(configKeys[env]);
+  }
+  const envSpecific = env === "test" ? process.env.WAFFO_WEBHOOK_TEST_PUBLIC_KEY : process.env.WAFFO_WEBHOOK_PROD_PUBLIC_KEY;
+  if (envSpecific) {
+    return normalizePublicKey(envSpecific);
+  }
+  const generic = process.env.WAFFO_WEBHOOK_PUBLIC_KEY;
+  if (generic) {
+    return normalizePublicKey(generic);
+  }
+  return env === "test" ? TEST_PUBLIC_KEY : PROD_PUBLIC_KEY;
+}
 function verifyWebhook(payload, signatureHeader, options) {
   if (!signatureHeader) {
     throw new Error("Missing X-Waffo-Signature header");
@@ -630,27 +733,25 @@ function verifyWebhook(payload, signatureHeader, options) {
     }
   }
   const signatureInput = `${t}.${payload}`;
-  const customKey = options?.publicKey;
-  if (customKey) {
-    const normalizedKey = normalizePublicKey(customKey);
+  const directKey = options?.publicKey;
+  if (directKey) {
+    const normalizedKey = normalizePublicKey(directKey);
     if (!rsaVerify(signatureInput, v1, normalizedKey)) {
       throw new Error("Invalid webhook signature (custom key)");
     }
   } else {
+    const configKeys = options?.publicKeys;
     const env = options?.environment;
-    if (env === "test") {
-      if (!rsaVerify(signatureInput, v1, TEST_PUBLIC_KEY)) {
-        throw new Error("Invalid webhook signature (test key)");
-      }
-    } else if (env === "prod") {
-      if (!rsaVerify(signatureInput, v1, PROD_PUBLIC_KEY)) {
-        throw new Error("Invalid webhook signature (prod key)");
+    if (env === "test" || env === "prod") {
+      const key = resolveKeyForEnv(env, configKeys);
+      if (!rsaVerify(signatureInput, v1, key)) {
+        throw new Error(`Invalid webhook signature (${env} key)`);
       }
     } else {
-      const prodValid = rsaVerify(signatureInput, v1, PROD_PUBLIC_KEY);
-      if (!prodValid) {
-        const testValid = rsaVerify(signatureInput, v1, TEST_PUBLIC_KEY);
-        if (!testValid) {
+      const prodKey = resolveKeyForEnv("prod", configKeys);
+      if (!rsaVerify(signatureInput, v1, prodKey)) {
+        const testKey = resolveKeyForEnv("test", configKeys);
+        if (!rsaVerify(signatureInput, v1, testKey)) {
           throw new Error("Invalid webhook signature (tried both prod and test keys)");
         }
       }
@@ -661,15 +762,19 @@ function verifyWebhook(payload, signatureHeader, options) {
 
 // src/resources/webhooks.ts
 var WebhooksResource = class {
-  /** @param publicKey - Optional custom RSA public key (PEM or raw base64) */
-  constructor(publicKey) {
-    this.publicKey = publicKey;
+  /** @param publicKeys - Optional config-level public key(s) from WaffoPancakeConfig */
+  constructor(publicKeys) {
+    this.publicKeys = publicKeys;
   }
   /**
    * Verify and parse an incoming webhook event.
    *
-   * When the client was created with a `webhookPublicKey`, that key is used
-   * automatically. You can still override per-call via `options.publicKey`.
+   * Key resolution order:
+   * 1. `options.publicKey` — per-call override (highest priority)
+   * 2. `config.webhookPublicKey[env]` or `config.webhookPublicKey` (string)
+   * 3. `WAFFO_WEBHOOK_{TEST|PROD}_PUBLIC_KEY` environment variable
+   * 4. `WAFFO_WEBHOOK_PUBLIC_KEY` environment variable
+   * 5. Built-in hardcoded key
    *
    * @param payload - Raw request body string (must be unparsed)
    * @param signatureHeader - Value of the `X-Waffo-Signature` header
@@ -681,13 +786,17 @@ var WebhooksResource = class {
    * const event = client.webhooks.verify(rawBody, signatureHeader);
    *
    * @example
-   * // Override tolerance per call
-   * const event = client.webhooks.verify(rawBody, sig, { toleranceMs: 0 });
+   * // Specify environment
+   * const event = client.webhooks.verify(rawBody, sig, { environment: "test" });
+   *
+   * @example
+   * // Per-call key override
+   * const event = client.webhooks.verify(rawBody, sig, { publicKey: oneOffKey });
    */
   verify(payload, signatureHeader, options) {
     const mergedOptions = {
       ...options,
-      publicKey: options?.publicKey ?? this.publicKey
+      publicKeys: options?.publicKeys ?? this.publicKeys
     };
     return verifyWebhook(payload, signatureHeader, mergedOptions);
   }
@@ -771,8 +880,9 @@ var SubscriptionOrderStatus = /* @__PURE__ */ ((SubscriptionOrderStatus2) => {
   SubscriptionOrderStatus2["Pending"] = "pending";
   SubscriptionOrderStatus2["Active"] = "active";
   SubscriptionOrderStatus2["Canceling"] = "canceling";
-  SubscriptionOrderStatus2["Canceled"] = "canceled";
   SubscriptionOrderStatus2["PastDue"] = "past_due";
+  SubscriptionOrderStatus2["Closed"] = "closed";
+  SubscriptionOrderStatus2["Canceled"] = "canceled";
   SubscriptionOrderStatus2["Expired"] = "expired";
   return SubscriptionOrderStatus2;
 })(SubscriptionOrderStatus || {});
@@ -813,6 +923,7 @@ var ErrorLayer = /* @__PURE__ */ ((ErrorLayer2) => {
   ErrorLayer2["Store"] = "store";
   ErrorLayer2["Product"] = "product";
   ErrorLayer2["Order"] = "order";
+  ErrorLayer2["Ticket"] = "ticket";
   ErrorLayer2["GraphQL"] = "graphql";
   ErrorLayer2["Resource"] = "resource";
   ErrorLayer2["Email"] = "email";