@yosle/tropipayjs 0.2.2 → 0.2.3

package/SECURITY.md

@@ -0,0 +1,43 @@
+# Supply Chain Security Plan
+
+## 1. Lockfile Integrity
+- Always commit `package-lock.json` — it pins exact sub-dependency versions
+- Verify integrity: `npm audit signatures` after install (requires npm 9+)
+
+## 2. Automated Scanning
+```yaml
+# CI steps
+- run: npm audit --audit-level=high    # fail on high/critical known CVEs
+- run: npx socket-cli scan             # detect protestware, typo-squatting, obfuscation
+```
+- [Socket.dev](https://socket.dev) — free tier detects behavioral risks (not just CVEs)
+- [Snyk](https://snyk.io) — broader CVE coverage, integrates with GitHub
+
+## 3. Dependency Updates
+- Enable **Dependabot** or **Renovate** — auto-create PRs for security patches
+- Review every new dependency before adding: check downloads, maintenance, publisher
+
+## 4. Overrides for Transitive Dependencies
+```json
+{
+  "overrides": {
+    "axios": "1.18.1",
+    "semver": "^7.6.0"
+  }
+}
+```
+Use `overrides` to force-patch transitive deps when upstream is slow to release.
+
+## 5. Minimal Surface Area
+- Fewer dependencies = fewer attack vectors
+- Regularly audit with `npm ls --depth=0` and remove unused packages
+
+## 6. SBOM Generation
+```bash
+npm sbom --sbom-format cyclonedx > sbom.json
+```
+Generate a Software Bill of Materials for compliance and tracking.
+
+## 7. Package Provenance
+- Prefer packages with [provenance attestations](https://docs.npmjs.com/generating-provenance-statements) (npm publish --provenance)
+- Check publisher reputation and maintainer count before adding

package/index.d.ts

@@ -494,4 +494,5 @@ declare class ServerSideUtils {
 
 declare const SERVER_MODE: ServerMode$1;
 
-export { AccountBalance, AccountDeposits, ClientSideUtils, Country, Deposit, HookEventType, HookTargetType, LoginError, LoginResponse, MAX_IMAGE_SIZE_MB, MediationPaymentCardConfig, PaymentLink, PaymentLinkPayload, RefundResponse, SERVER_MODE, ServerMode$1 as ServerMode, ServerSideUtils, Tropipay, TropipayConfig, TropipayCredentials, UserHook, UserHookSubscribed };
+export { ClientSideUtils, MAX_IMAGE_SIZE_MB, SERVER_MODE, ServerSideUtils, Tropipay };
+export type { AccountBalance, AccountDeposits, Country, Deposit, HookEventType, HookTargetType, LoginError, LoginResponse, MediationPaymentCardConfig, PaymentLink, PaymentLinkPayload, RefundResponse, ServerMode$1 as ServerMode, TropipayConfig, TropipayCredentials, UserHook, UserHookSubscribed };

package/index.js

@@ -1,15 +1,10 @@
 'use strict';
 
-Object.defineProperty(exports, '__esModule', { value: true });
-
 var axios = require('axios');
 var crypto = require('crypto');
 var fs = require('fs/promises');
 
-function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'default' in e ? e : { 'default': e }; }
-
-function _interopNamespace(e) {
-    if (e && e.__esModule) return e;
+function _interopNamespaceDefault(e) {
     var n = Object.create(null);
     if (e) {
         Object.keys(e).forEach(function (k) {
@@ -22,13 +17,11 @@ function _interopNamespace(e) {
             }
         });
     }
-    n["default"] = e;
+    n.default = e;
     return Object.freeze(n);
 }
 
-var axios__default = /*#__PURE__*/_interopDefaultLegacy(axios);
-var crypto__namespace = /*#__PURE__*/_interopNamespace(crypto);
-var fs__default = /*#__PURE__*/_interopDefaultLegacy(fs);
+var crypto__namespace = /*#__PURE__*/_interopNamespaceDefault(crypto);
 
 function handleExceptions(error) {
     if (error instanceof axios.AxiosError) {
@@ -520,7 +513,7 @@ class Tropipay {
         const tpp_env = this.serverMode === "Production"
             ? "https://www.tropipay.com"
             : "https://tropipay-dev.herokuapp.com";
-        this.request = axios__default["default"].create({
+        this.request = axios.create({
             baseURL: config.customTropipayUrl || tpp_env,
             headers: {
                 "Content-Type": "application/json",
@@ -885,7 +878,7 @@ class ServerSideUtils {
      * @return {Promise<string>} a Promise that resolves to the base64 representation of the file content
      */
     static async fileToBase64(filepath) {
-        const contents = await fs__default["default"].readFile(filepath);
+        const contents = await fs.readFile(filepath);
         let base64content = contents.toString("base64");
         const ext = filepath.split(".").pop();
         return `data:image/${ext};base64,` + base64content;
@@ -897,7 +890,7 @@ class ServerSideUtils {
      * @return {Promise<string>} the base64 representation of the file
      */
     static async getBase64FromFileUrl(url) {
-        const response = await axios__default["default"].get(url, {
+        const response = await axios.get(url, {
             responseType: "arraybuffer",
             maxRedirects: 5,
         });

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@yosle/tropipayjs",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Javascript / Typescript SDK for the Tropipay API",
   "main": "index.js",
   "scripts": {
     "test": "jest --passWithNoTests --updateSnapshot --coverage",
-    "_clear": "rimraf src/dist/*",
+    "_clear": "rimraf src/dist",
     "_tsc": "tsc",
     "_make-bundle": "rollup --config",
     "build": "npm run _clear && npm run _tsc && npm run _make-bundle"
@@ -28,22 +28,21 @@
   "author": "Yosleivy Baez Acosta <yosle007@gmail.com>",
   "license": "MIT",
   "dependencies": {
-    "axios": "^1.6.0",
-    "tslib": "^2.4.0"
+    "axios": "^1.18.1",
+    "tslib": "^2.8.1"
   },
   "devDependencies": {
-    "@rollup/plugin-typescript": "^8.5.0",
+    "@rollup/plugin-typescript": "^12.3.0",
     "@types/jest": "^29.5.12",
     "@types/node": "^20.12.7",
     "@types/tough-cookie": "^4.0.5",
     "babel-jest": "^29.7.0",
     "jest": "^29.7.0",
-    "rimraf": "^3.0.2",
-    "rollup": "^2.79.1",
-    "rollup-plugin-dts": "^4.2.2",
-    "run-s": "^0.0.0",
-    "ts-jest": "^29.1.2",
-    "typescript": "^5.4.5"
+    "rimraf": "^6.1.3",
+    "rollup": "^4.62.2",
+    "rollup-plugin-dts": "^6.4.1",
+    "ts-jest": "^29.4.11",
+    "typescript": "^6.0.3"
   },
   "funding": {
     "type": "individual",

package/rollup.config.js

@@ -1,6 +1,5 @@
-// Contents of the file /rollup.config.js
-import typescript from "@rollup/plugin-typescript";
-import dts from "rollup-plugin-dts";
+import { dts } from "rollup-plugin-dts";
+
 const config = [
   {
     input: "dist/index.js",
@@ -10,7 +9,6 @@ const config = [
       sourcemap: true,
     },
     external: ["axios", "crypto", "fs/promises"],
-    plugins: [typescript()],
   },
   {
     input: "dist/index.d.ts",
@@ -21,4 +19,5 @@ const config = [
     plugins: [dts()],
   },
 ];
+
 export default config;

package/tsconfig.json

@@ -24,12 +24,12 @@
     /* Modules */
     "module": "esnext" /* Specify what module code is generated. */,
     "rootDir": "./src" /* Specify the root folder within your source files. */,
-    "moduleResolution": "node" /* Specify how TypeScript looks up a file from a given module specifier. */,
+    "moduleResolution": "bundler" /* Specify how TypeScript looks up a file from a given module specifier. */,
     // "baseUrl": "./",                                  /* Specify the base directory to resolve non-relative module names. */
     // "paths": {},                                      /* Specify a set of entries that re-map imports to additional lookup locations. */
     // "rootDirs": [],                                   /* Allow multiple folders to be treated as one when resolving modules. */
     // "typeRoots": [],                                  /* Specify multiple folders that act like './node_modules/@types'. */
-    // "types": [],                                      /* Specify type package names to be included without being referenced in a source file. */
+    "types": ["node", "jest"],                            /* Specify type package names to be included without being referenced in a source file. */
     // "allowUmdGlobalAccess": true,                     /* Allow accessing UMD globals from modules. */
     // "moduleSuffixes": [],                             /* List of file name suffixes to search when resolving a module. */
     // "resolveJsonModule": true,                        /* Enable importing .json files. */