@whatalo/plugin-sdk 1.1.0 → 1.2.1

package/dist/index.mjs

@@ -111,6 +111,8 @@ var WhataloClient = class {
   inventory;
   /** Webhook resource methods */
   webhooks;
+  /** Geo reference data methods */
+  geo;
   constructor(options) {
     if (typeof window !== "undefined" && typeof process === "undefined") {
       console.warn(
@@ -132,6 +134,7 @@ var WhataloClient = class {
     this.store = new StoreResource(this);
     this.inventory = new InventoryResource(this);
     this.webhooks = new WebhookResource(this);
+    this.geo = new GeoResource(this);
   }
   /**
    * Internal request method shared by all resource namespaces.
@@ -291,6 +294,9 @@ var OrderResource = class {
   async updateStatus(id, data) {
     return this.client.request("PATCH", `/orders/${id}`, { body: data });
   }
+  async updatePaymentStatus(id, data) {
+    return this.client.request("PATCH", `/orders/${id}`, { body: data });
+  }
   async count(status) {
     return this.client.request("GET", "/orders/count", {
       params: status ? { status } : void 0
@@ -370,10 +376,10 @@ var InventoryResource = class {
     this.client = client;
   }
   async get(productId) {
-    return this.client.request("GET", `/products/${productId}/inventory`);
+    return this.client.request("GET", `/inventory/products/${productId}`);
   }
   async adjust(productId, data) {
-    return this.client.request("PATCH", `/products/${productId}/inventory`, {
+    return this.client.request("PATCH", `/inventory/products/${productId}`, {
       body: data
     });
   }
@@ -395,17 +401,57 @@ var WebhookResource = class {
     return this.client.request("DELETE", `/webhooks/${id}`);
   }
 };
+var GeoResource = class {
+  constructor(client) {
+    this.client = client;
+  }
+  /**
+   * List countries.
+   * By default returns only supported countries (is_supported=true).
+   * Pass `{ all: true }` to retrieve all 250 countries.
+   */
+  async listCountries(params) {
+    return this.client.request("GET", "/geo/countries", {
+      params: params?.all !== void 0 ? { all: params.all } : void 0
+    });
+  }
+  /**
+   * Get a single country by ISO 3166-1 alpha-2 code.
+   */
+  async getCountry(iso2) {
+    return this.client.request("GET", `/geo/countries/${iso2.toUpperCase()}`);
+  }
+  /**
+   * List provinces (states, departments, regions) for a country.
+   * Returns an empty array for countries with no province data.
+   */
+  async listProvinces(countryIso2) {
+    return this.client.request("GET", `/geo/countries/${countryIso2.toUpperCase()}/provinces`);
+  }
+};
 
 // src/webhooks/verify.ts
 import { createHmac, timingSafeEqual } from "crypto";
+var DEFAULT_TOLERANCE_SECONDS = 300;
 function verifyWebhook({
   payload,
   signature,
-  secret
+  timestamp,
+  secret,
+  toleranceSeconds = DEFAULT_TOLERANCE_SECONDS,
+  currentTime = Math.floor(Date.now() / 1e3)
 }) {
-  if (!payload || !signature || !secret) return false;
-  const expected = createHmac("sha256", secret).update(payload, "utf8").digest("hex");
+  if (!payload || !signature || !secret || timestamp === "") return false;
+  const timestampString = String(timestamp);
+  const timestampValue = typeof timestamp === "number" ? timestamp : Number(timestamp);
+  if (!Number.isInteger(timestampValue)) return false;
+  if (!Number.isFinite(toleranceSeconds) || toleranceSeconds < 0) return false;
+  if (!Number.isFinite(currentTime)) return false;
+  const ageSeconds = Math.abs(currentTime - timestampValue);
+  if (ageSeconds > toleranceSeconds) return false;
+  const expected = createHmac("sha256", secret).update(`${timestampString}.${payload}`, "utf8").digest("hex");
   if (expected.length !== signature.length) return false;
+  if (!/^[a-f0-9]+$/i.test(signature)) return false;
   try {
     return timingSafeEqual(
       Buffer.from(expected, "hex"),
@@ -416,7 +462,68 @@ function verifyWebhook({
   }
 }
 
+// src/webhooks/types.ts
+import {
+  PUBLIC_WEBHOOK_EVENTS,
+  isPublicWebhookEvent
+} from "@whatalo/protocol/events";
+var WEBHOOK_EVENTS = PUBLIC_WEBHOOK_EVENTS;
+function isWebhookEvent(value) {
+  return isPublicWebhookEvent(value);
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasStringId(value) {
+  return isRecord(value) && typeof value.id === "string";
+}
+function isOptionalString(value, key) {
+  return value[key] === void 0 || typeof value[key] === "string";
+}
+function isRuntimeWebhookStore(value) {
+  return isRecord(value) && typeof value.id === "string" && typeof value.timezone === "string" && (value.name === void 0 || typeof value.name === "string");
+}
+function hasValidBasePayloadFields(value) {
+  if (!isOptionalString(value, "event_id")) return false;
+  if (!isOptionalString(value, "occurred_at")) return false;
+  return isRuntimeWebhookStore(value.store);
+}
+function isRuntimeOrderWebhookPayload(value) {
+  return hasValidBasePayloadFields(value) && hasStringId(value.order) && (value.customer === void 0 || hasStringId(value.customer));
+}
+function isRuntimeProductWebhookPayload(value) {
+  return hasValidBasePayloadFields(value) && hasStringId(value.product);
+}
+function isRuntimeCustomerWebhookPayload(value) {
+  return hasValidBasePayloadFields(value) && hasStringId(value.customer);
+}
+function isRuntimeCheckoutCompletedWebhookPayload(value) {
+  return hasValidBasePayloadFields(value) && hasStringId(value.order) && hasStringId(value.customer) && isRuntimeWebhookStore(value.store);
+}
+function isRuntimeWebhookPayload(value, event) {
+  if (!isRecord(value)) return false;
+  switch (event) {
+    case WEBHOOK_EVENTS.ORDER_CREATED:
+    case WEBHOOK_EVENTS.ORDER_UPDATED:
+    case WEBHOOK_EVENTS.ORDER_CANCELLED:
+    case WEBHOOK_EVENTS.ORDER_COMPLETED:
+      return isRuntimeOrderWebhookPayload(value);
+    case WEBHOOK_EVENTS.PRODUCT_CREATED:
+    case WEBHOOK_EVENTS.PRODUCT_UPDATED:
+    case WEBHOOK_EVENTS.PRODUCT_DELETED:
+      return isRuntimeProductWebhookPayload(value);
+    case WEBHOOK_EVENTS.CUSTOMER_CREATED:
+    case WEBHOOK_EVENTS.CUSTOMER_UPDATED:
+      return isRuntimeCustomerWebhookPayload(value);
+    case WEBHOOK_EVENTS.CHECKOUT_COMPLETED:
+      return isRuntimeCheckoutCompletedWebhookPayload(value);
+    default:
+      return false;
+  }
+}
+
 // src/manifest/validate.ts
+import { SCOPE_LIST } from "@whatalo/protocol/scopes";
 var ManifestValidationError = class extends Error {
   errors;
   constructor(errors) {
@@ -429,23 +536,7 @@ var ManifestValidationError = class extends Error {
 var ID_REGEX = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 var SEMVER_REGEX = /^\d+\.\d+\.\d+$/;
 var EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-var VALID_PERMISSIONS = /* @__PURE__ */ new Set([
-  "read:products",
-  "write:products",
-  "read:orders",
-  "write:orders",
-  "read:customers",
-  "write:customers",
-  "read:inventory",
-  "write:inventory",
-  "read:store",
-  "write:store",
-  "read:webhooks",
-  "write:webhooks",
-  "read:discounts",
-  "write:discounts",
-  "read:analytics"
-]);
+var VALID_PERMISSIONS = new Set(SCOPE_LIST.map((s) => s.token));
 var VALID_CATEGORIES = /* @__PURE__ */ new Set([
   "analytics",
   "marketing",
@@ -540,8 +631,11 @@ var DATA_RESOURCE_SCOPE = {
   products: "read:products",
   orders: "read:orders",
   customers: "read:customers",
-  categories: "read:products"
+  categories: "read:products",
   // categories share the products scope
+  store: "read:store",
+  geo: "read:store"
+  // geo is global reference data, scoped to read:store
 };
 var BILLING_OPERATION = {
   GET_PLANS: "getPlans",
@@ -953,16 +1047,44 @@ function useWhataloData() {
     },
     [fetchResource]
   );
+  const storeGet = useCallback3(async () => {
+    const ack = await fetchResource("store", "get");
+    return extractAckData(ack);
+  }, [fetchResource]);
+  const geoCountries = useCallback3(
+    async (params) => {
+      const ack = await fetchResource(
+        "geo",
+        "list",
+        { ...params, _sub: "countries" }
+      );
+      return extractAckData(ack);
+    },
+    [fetchResource]
+  );
+  const geoProvinces = useCallback3(
+    async (countryIso2) => {
+      const ack = await fetchResource(
+        "geo",
+        "list",
+        { _sub: "provinces", country: countryIso2 }
+      );
+      return extractAckData(ack);
+    },
+    [fetchResource]
+  );
   return {
     products: { list: productsList, get: productsGet },
     orders: { list: ordersList, get: ordersGet },
     customers: { list: customersList, get: customersGet },
-    categories: { list: categoriesList, get: categoriesGet }
+    categories: { list: categoriesList, get: categoriesGet },
+    store: { get: storeGet },
+    geo: { countries: geoCountries, provinces: geoProvinces }
   };
 }
 
 // src/index.ts
-var SDK_VERSION = "0.0.1";
+var SDK_VERSION = "1.2.0";
 export {
   AuthenticationError,
   AuthorizationError,
@@ -974,10 +1096,13 @@ export {
   RateLimitError,
   SDK_VERSION,
   ValidationError,
+  WEBHOOK_EVENTS,
   WhataloAPIError,
   WhataloClient,
   clearSessionTokenCache,
   defineApp,
+  isRuntimeWebhookPayload,
+  isWebhookEvent,
   sessionToken,
   useAppBridge,
   useWhataloAction,