pesafy 0.0.2

package/CHANGELOG.md

@@ -0,0 +1,126 @@
+# pesafy
+
+## 0.0.2
+
+### Patch Changes
+
+- b8dd427: # pesafy 0.0.1 — first public release
+
+  First publish of the **pesafy** M-PESA Daraja SDK to npm.
+
+  ## Package foundation
+  - Official npm registry only (`.npmrc`, pinned lockfile, `zod` runtime
+    dependency)
+  - Version **0.0.1** with Changesets, `CHANGELOG.md`, and npm provenance
+  - Hardened `prepublishOnly`: lint, format, typecheck, coverage, build,
+    size-limit
+  - CI publish workflow: lint, format, coverage, build before release
+
+  ## Features
+  - **Mpesa client** — STK Push, C2B, B2C/B2B, account balance, transaction
+    status, reversal, tax remittance, dynamic QR, bill manager
+  - **Idempotency** — automatic `Idempotency-Key` on mutating POSTs,
+    `IdempotencyManager`, pluggable store, auto `OriginatorConversationID` for
+    B2C disbursement
+  - **Zod validation** — runtime schemas for STK Push, B2C Disbursement, B2B
+    Express Checkout, webhooks; exported from `pesafy`
+  - **Webhooks** — Safaricom IP allowlist, STK/callback helpers, opt-in HMAC
+    preview (`verifyWebhook`, `verifyWebhookHMAC`)
+  - **Framework adapters** — Express, Hono, Fastify, Next.js
+  - **CLI**, branded types, `Result<T>` safe methods, encryption, phone
+    utilities
+
+  ## Breaking note
+
+  Initial public API at 0.0.1; stricter Zod validation may reject payloads that
+  previously passed loose checks.
+
+- 0a01848: Security hardening and production safety fixes.
+
+  **Fixes**
+  - Idempotency: remove global HTTP context race; pass `idempotency` explicitly
+    via `DarajaHttpOptions` on every outbound call
+  - C2B simulate: require `billRefNumber` for `CustomerPayBillOnline`
+  - `KesAmountSchema`: reject amounts that round below 1 KES
+
+  **Breaking**
+  - `verifyWebhook` and `verifyWebhookHMAC` are now **async** (Web Crypto,
+    portable across Node/Bun/Deno/Workers)
+
+  **Features**
+  - Zod validation on all outbound Daraja APIs (request + response)
+  - Framework adapters: optional `webhookSecret`, `requireHMAC`,
+    `signatureHeader` with `verifyWebhook` + raw body
+  - `C2BBaseResponse` shared type for register/simulate responses
+
+  **Chore**
+  - `pnpm.overrides`: `fastify >= 5.8.5`
+  - Security docs: trusted proxies, multi-instance idempotency, HMAC opt-in
+
+## Unreleased
+
+### Security hardening (0.0.2)
+
+#### Fixes
+
+- **Idempotency concurrency** — removed module-level HTTP context;
+  `IdempotencyManager` is passed explicitly via `DarajaHttpOptions` /
+  `HttpRequestOptions.idempotency` (no cross-request key leakage under
+  concurrent `Mpesa` calls)
+- **C2B simulate** — `billRefNumber` required for `CustomerPayBillOnline`
+- **Amount validation** — `KesAmountSchema` rejects values that round below 1
+  KES
+
+#### Breaking
+
+- `verifyWebhook` and `verifyWebhookHMAC` are **async** (Web Crypto; works on
+  Node, Bun, Deno, Workers)
+
+#### Features
+
+- **Zod** on all outbound Daraja APIs (request + response parsing at HTTP
+  boundaries)
+- **Adapters** — optional HMAC webhook verification (`webhookSecret`,
+  `requireHMAC`, `signatureHeader`) using raw body + `verifyWebhook`
+- **`C2BBaseResponse`** — shared type for C2B register/simulate responses
+
+#### Chore
+
+- `pnpm.overrides`: `fastify >= 5.8.5`
+- Docs: trusted reverse proxies, multi-instance idempotency stores, HMAC preview
+  constraints
+
+## 0.0.1
+
+### First public release
+
+First publish of the **pesafy** M-PESA Daraja SDK to npm.
+
+#### Package foundation
+
+- Official npm registry only (`.npmrc`, pinned lockfile, `zod` runtime
+  dependency)
+- Version **0.0.1** with Changesets, npm provenance, and hardened publish gates
+- `prepublishOnly`: lint, format, typecheck, coverage, build, size-limit
+- CI publish workflow: lint, format, coverage, build before release
+
+#### Features
+
+- **Mpesa client** — STK Push, C2B, B2C/B2B, account balance, transaction
+  status, reversal, tax remittance, dynamic QR, bill manager
+- **Idempotency** — automatic `Idempotency-Key` on mutating POSTs,
+  `IdempotencyManager`, pluggable store, auto `OriginatorConversationID` for B2C
+  disbursement
+- **Zod validation** — runtime schemas for STK Push, B2C Disbursement, B2B
+  Express Checkout, webhooks; exported from `pesafy`
+- **Webhooks** — Safaricom IP allowlist, STK/callback helpers, opt-in HMAC
+  preview (`verifyWebhook`, `verifyWebhookHMAC`)
+- **Framework adapters** — Express, Hono, Fastify, Next.js
+- **CLI**, branded types, `Result<T>` safe methods, encryption, phone utilities
+
+#### Notes
+
+- Stricter Zod validation may reject payloads that previously passed loose
+  checks
+- HMAC verification is opt-in until Safaricom documents the official signing
+  spec

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Lewis Odero
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.