@waffo/pancake-ts 0.4.0 → 0.4.2

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to `@waffo/pancake-ts` will be documented in this file.
 
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.2] - 2026-04-16
+
+### Fixed
+
+- **`merchantId` validated at construction** — `WaffoPancake` constructor now validates that `merchantId` matches `MER_{base62}` format (exactly 22 base62 characters after prefix). Previously, malformed values like `MER_1XdxrN8hqc5jBMAnWvVm1W1` (23 chars) or `merchant-123` were silently accepted, passed through to the gateway, and caused cryptic 500 errors from the database layer. Invalid formats now throw `WaffoPancakeError` (`status: 400`, `layer: "sdk"`) immediately.
+- **Short ID regex tightened** — All `validateShortId()` checks (affecting `storeId`, `productId`, `orderId`, `paymentId`, `ticketId`, `merchantId`) now enforce exactly 22 base62 characters after the prefix, matching the server-side format. The previous regex (`/[A-Za-z0-9]+/`) accepted any length.
+
+## [0.4.1] - 2026-04-15
+
+### Changed
+
+- **`RefundTicket.versionData` is now structured** — tightened from `Record<string, unknown> | null` to a new `RefundTicketVersionData | null` type matching the GraphQL `RefundTicketVersionData` shape: `{ reason: string; requestedAmount: RequestedAmount | null }`. Aligns with `waffo-pancake-graphql-service` v2026.04.15.1.
+
+### Added
+
+- **`RefundTicketVersionData`** — exported type. Reuses the existing `RequestedAmount` for the nested amount field.
+
 ## [0.4.0] - 2026-04-15
 
 ### Breaking Changes

package/README.md

@@ -508,6 +508,7 @@ src/
 ├── signing.ts             # RSA-SHA256 request signing
 ├── errors.ts              # WaffoPancakeError
 ├── webhooks.ts            # Webhook verification (embedded keys)
+├── validation.ts          # Client-side input validation
 ├── types.ts               # Type definitions & enums
 ├── __tests__/             # Test suite
 └── resources/             # API resource classes

package/dist/index.cjs

@@ -245,7 +245,7 @@ var HttpClient = class {
 };
 
 // src/validation.ts
-var SHORT_ID_REGEX = /^[A-Z]{2,4}_[A-Za-z0-9]+$/;
+var SHORT_ID_REGEX = /^[A-Z]{2,5}_[0-9A-Za-z]{22}$/;
 var CURRENCY_CODE_REGEX = /^[A-Z]{3}$/;
 var COUNTRY_CODE_REGEX = /^[A-Z]{2}$/;
 var AMOUNT_STRING_REGEX = /^\d+(\.\d+)?$/;
@@ -1187,6 +1187,7 @@ var WaffoPancake = class {
   graphql;
   webhooks;
   constructor(config) {
+    validateShortId("merchantId", config.merchantId, "MER");
     this.config = config;
     this.http = new HttpClient(config);
     this.auth = new AuthResource(this.http);