@waffo/pancake-ts 0.4.1 → 0.5.0

package/CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to `@waffo/pancake-ts` will be documented in this file.
 
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.0] - 2026-04-18
+
+### Added
+
+- **Enriched `WebhookEventData`** — webhook payloads now include full transaction chain data. New optional fields organized by section:
+  - **Order**: `orderStatus`, `merchantProvidedBuyerIdentity`, `billingDetail`, `orderMetadata`
+  - **Amount**: `taxRate`, `taxName`, `subtotal`, `total`
+  - **Product**: `productDescription`, `productMetadata`
+  - **Payment** (payment events only): `paymentId`, `paymentStatus`, `paymentMethod`, `paymentLast4`, `paymentFailureReason`, `paymentDate`
+  - **Subscription** (subscription events only): `billingPeriod`, `currentPeriodStart`, `currentPeriodEnd`, `canceledAt`
+  - **Refund** (refund events only): `refundStatus`, `refundReason`, `refundCreatedAt`
+- All new fields are optional — existing webhook handlers continue to work without changes.
+
+### Documentation
+
+- **Webhook guide** — updated `WebhookEventData` field reference with sectioned layout and conditional field documentation.
+- **README** — expanded webhook verification example showing new fields.
+
+## [0.4.2] - 2026-04-16
+
+### Fixed
+
+- **`merchantId` validated at construction** — `WaffoPancake` constructor now validates that `merchantId` matches `MER_{base62}` format (exactly 22 base62 characters after prefix). Previously, malformed values like `MER_1XdxrN8hqc5jBMAnWvVm1W1` (23 chars) or `merchant-123` were silently accepted, passed through to the gateway, and caused cryptic 500 errors from the database layer. Invalid formats now throw `WaffoPancakeError` (`status: 400`, `layer: "sdk"`) immediately.
+- **Short ID regex tightened** — All `validateShortId()` checks (affecting `storeId`, `productId`, `orderId`, `paymentId`, `ticketId`, `merchantId`) now enforce exactly 22 base62 characters after the prefix, matching the server-side format. The previous regex (`/[A-Za-z0-9]+/`) accepted any length.
+
 ## [0.4.1] - 2026-04-15
 
 ### Changed

package/README.md

@@ -158,7 +158,7 @@ See [API Reference — Checkout](docs/api-reference.md#checkout) for full parame
 
 ## Webhook Verification
 
-After a buyer completes payment, Waffo sends webhook events to your server. The SDK provides two ways to verify signatures:
+After a buyer completes payment, Waffo sends webhook events to your server with rich data including order details, amounts, product info, and event-specific fields (payment, subscription, or refund). The SDK provides two ways to verify signatures:
 
 ### Standalone Function (built-in keys)
 
@@ -175,10 +175,17 @@ app.post("/webhooks", express.raw({ type: "application/json" }), (req, res) => {
 
     switch (event.eventType) {
       case WebhookEventType.OrderCompleted:
-        console.log(`Order ${event.data.orderId} completed`);
+        // Rich data: order, amount, product, payment fields
+        console.log(`Order ${event.data.orderId} completed — ${event.data.total} ${event.data.currency}`);
+        console.log(`Product: ${event.data.productName}, Buyer: ${event.data.buyerEmail}`);
+        if (event.data.orderMetadata) console.log("Metadata:", event.data.orderMetadata);
         break;
       case WebhookEventType.SubscriptionActivated:
         console.log(`Subscription activated for ${event.data.buyerEmail}`);
+        console.log(`Period: ${event.data.billingPeriod}, ends ${event.data.currentPeriodEnd}`);
+        break;
+      case WebhookEventType.RefundSucceeded:
+        console.log(`Refund succeeded: ${event.data.refundReason}`);
         break;
     }
   } catch {
@@ -213,7 +220,7 @@ const client = new WaffoPancake({
 const event = client.webhooks.verify(rawBody, sig, { environment: "prod" });
 ```
 
-See [Webhook Guide](docs/webhook-guide.md) for event types, dual-environment key architecture, key resolution chain, retry mechanism, and best practices.
+See [Webhook Guide](docs/webhook-guide.md) for event types, `WebhookEventData` field reference, dual-environment key architecture, key resolution chain, retry mechanism, and best practices.
 
 ## Buyer Self-Service
 
@@ -446,12 +453,12 @@ try {
 
 ## Documentation
 
-| Document                               | Content                                                                      |
-| -------------------------------------- | ---------------------------------------------------------------------------- |
-| [API Reference](docs/api-reference.md) | Complete method reference — parameters, return types, `BillingDetail` fields |
-| [GraphQL Guide](docs/graphql-guide.md) | Queries, filters, analytics, introspection, delivery logs                    |
-| [Webhook Guide](docs/webhook-guide.md) | Signature verification, event types, key resolution, retry mechanism         |
-| [Changelog](CHANGELOG.md)              | Version history and migration guides                                         |
+| Document                               | Content                                                                                 |
+| -------------------------------------- | --------------------------------------------------------------------------------------- |
+| [API Reference](docs/api-reference.md) | Complete method reference — parameters, return types, `BillingDetail` fields            |
+| [GraphQL Guide](docs/graphql-guide.md) | Queries, filters, analytics, introspection, delivery logs                               |
+| [Webhook Guide](docs/webhook-guide.md) | Signature verification, event types, event data fields, key resolution, retry mechanism |
+| [Changelog](CHANGELOG.md)              | Version history and migration guides                                                    |
 
 ## Exports
 
@@ -485,7 +492,7 @@ try {
 
 ### Types
 
-Key types: `WaffoPancakeConfig`, `AuthenticatedCheckoutParams`, `AuthenticatedCheckoutResult`, `AnonymousCheckoutParams`, `CheckoutSessionResult`, `Store`, `OnetimeProductDetail`, `SubscriptionProductDetail`, `WebhookEvent<T>`, `GraphQLResponse<T>`, and 30+ more. See [API Reference](docs/api-reference.md#types) for the full list.
+Key types: `WaffoPancakeConfig`, `AuthenticatedCheckoutParams`, `AuthenticatedCheckoutResult`, `AnonymousCheckoutParams`, `CheckoutSessionResult`, `Store`, `OnetimeProductDetail`, `SubscriptionProductDetail`, `WebhookEvent<T>`, `WebhookEventData`, `GraphQLResponse<T>`, and 30+ more. `WebhookEventData` includes rich fields organized by section: order info, amounts, product, payment, subscription, and refund (conditional by event type). See [API Reference](docs/api-reference.md#types) for the full list.
 
 ## Development
 
@@ -508,6 +515,7 @@ src/
 ├── signing.ts             # RSA-SHA256 request signing
 ├── errors.ts              # WaffoPancakeError
 ├── webhooks.ts            # Webhook verification (embedded keys)
+├── validation.ts          # Client-side input validation
 ├── types.ts               # Type definitions & enums
 ├── __tests__/             # Test suite
 └── resources/             # API resource classes

package/dist/index.cjs

@@ -245,7 +245,7 @@ var HttpClient = class {
 };
 
 // src/validation.ts
-var SHORT_ID_REGEX = /^[A-Z]{2,4}_[A-Za-z0-9]+$/;
+var SHORT_ID_REGEX = /^[A-Z]{2,5}_[0-9A-Za-z]{22}$/;
 var CURRENCY_CODE_REGEX = /^[A-Z]{3}$/;
 var COUNTRY_CODE_REGEX = /^[A-Z]{2}$/;
 var AMOUNT_STRING_REGEX = /^\d+(\.\d+)?$/;
@@ -1187,6 +1187,7 @@ var WaffoPancake = class {
   graphql;
   webhooks;
   constructor(config) {
+    validateShortId("merchantId", config.merchantId, "MER");
     this.config = config;
     this.http = new HttpClient(config);
     this.auth = new AuthResource(this.http);