redsys-easy 5.3.2 → 6.0.0

package/README.md

@@ -132,6 +132,20 @@ Redsys API uses expects amounts denominated in the smallest unit of a currency.
 
 However you are free to wrap these core functions with a custom formatter. Particularly, redsys-easy optional formatters expect the amount to be formatted as a decimal string currency unit. For euros, it would be '1.99'.
 
+### Which signature version is used?
+
+REST requests and redirect forms are signed with [`HMAC_SHA512_V2`](https://pagosonline.redsys.es/desarrolladores-inicio/documentacion-operativa/firmar-una-operacion/) by default. REST responses and JSON notifications allow also `HMAC_SHA512_V1` and `HMAC_SHA256_V1` signatures. To change this behavior, pass a list of allowed versions to `signatureVersions` in `createRedsysAPI` with the version to sign requests and forms as the first item. The same merchant key works for all signature versions.
+
+```ts
+createRedsysAPI({
+  secretKey: 'sq7HjrUOBfKmC576ILgskD5srU870gJ7',
+  urls: SANDBOX_URLS,
+  signatureVersions: ['HMAC_SHA512_V2', 'HMAC_SHA512_V1', 'HMAC_SHA256_V1']
+});
+```
+
+SOAP notifications and their responses still use `HMAC_SHA256_V1` only, and they are unaffected by the configuration above.
+
 ## Acknowledgments
 
 Based on previous work

package/lib/assets/signatures.d.ts

@@ -0,0 +1,2 @@
+import type { SignatureVersion } from '../types/api';
+export declare const signatureVersions: readonly SignatureVersion[];

package/lib/client.d.ts

@@ -1,5 +1,5 @@
 import type { fetch as Fetch } from 'undici';
-import type { ResponseJSONSuccess, RedirectForm } from './types/api';
+import type { ResponseJSONSuccess, RedirectForm, SignatureVersion } from './types/api';
 import type { RestIniciaPeticionInputParams, RestTrataPeticionInputParams, RedirectInputParams } from './types/input-params';
 import type { RestIniciaPeticionOutputParams, RestTrataPeticionOutputParams, RestNotificationOutputParams, SoapNotificationOutputParams } from './types/output-params';
 /**
@@ -33,6 +33,8 @@ export interface RedsysConfig {
     fetch?: typeof Fetch | undefined;
     secretKey: string;
     urls: UrlsConfig;
+    /** Allowed signature versions. The first item is used to sign requests and redirect forms. */
+    signatureVersions?: readonly SignatureVersion[] | undefined;
 }
 /**
  * Sends a iniciaPeticion request using REST interface

package/lib/crypto.d.ts

@@ -22,3 +22,25 @@ export declare const encrypt3DES: (key: string, message: string) => Buffer;
  * @params params - Payload to sign
  */
 export declare const sha256Sign: (merchantKey: string, order: string, params: string) => string;
+/**
+ * Encrypt a message using AES-128-CBC
+ *
+ * @params key - Key to encrypt message, used as text
+ * @params message - Message to be encrypted
+ */
+export declare const encryptAES: (key: string, message: string) => Buffer;
+/**
+ * Compute HMAC_SHA512_V2 signature
+ *
+ * @params merchantKey - Key to encrypt message
+ * @params order - Order number
+ * @params params - Payload to sign
+ */
+export declare const sha512Sign: (merchantKey: string, order: string, params: string) => string;
+/**
+ * Compare two signatures in constant time
+ *
+ * @params expected - Signature computed locally, base64 or base64url encoded
+ * @params received - Signature received from redsys, base64 or base64url encoded
+ */
+export declare const isSignatureEqual: (expected: string, received: string) => boolean;

package/lib/index.d.ts

@@ -10,7 +10,7 @@ export { getResponseCodeMessage, getSISErrorCodeMessage } from './utils/codes';
 export { RedsysError, ValidationError, ParseError, HTTPError, GatewayError, ResponseError } from './errors';
 export type { RedirectInputParams, RestIniciaPeticionInputParams, RestTrataPeticionInputParams } from './types/input-params';
 export type { RestIniciaPeticionOutputParams, RestTrataPeticionOutputParams, RestNotificationOutputParams, SoapNotificationOutputParams } from './types/output-params';
-export type { ResponseJSONSuccess, RedirectForm, ThreeDSv2MethodNotificationBody, ThreeDSv1ChallengeNotificationBody, ThreeDSv2ChallengeNotificationBody } from './types/api';
+export type { ResponseJSONSuccess, RedirectForm, SignatureVersion, ThreeDSv2MethodNotificationBody, ThreeDSv1ChallengeNotificationBody, ThreeDSv2ChallengeNotificationBody } from './types/api';
 export { serializeAndSignJSONRequest, deserializeAndVerifyJSONResponse, } from './rest/json';
 export { create3DSMethodForm, create3DSv1ChallengeForm, create3DSv2ChallengeForm, deserializeThreeDSMethodData, deserializeCres } from './rest/3ds';
 export type { ThreeDSBrowserClientInfo, ThreeDSMethodForm, ThreeDSv1ChallengeForm, ThreeDSv2ChallengeForm, ThreeDSMethodData, ThreeDSCres } from './types/3ds-params';

package/lib/index.esm.js

@@ -1,8 +1,6 @@
 import { fetch } from 'undici';
-import { STATUS_CODES } from 'http';
-import base64url from 'base64url';
-import crypto from 'crypto';
-import { randomInt } from 'node:crypto';
+import { STATUS_CODES } from 'node:http';
+import crypto, { randomInt } from 'node:crypto';
 import { XMLParser } from 'fast-xml-parser';
 import Decimal from 'decimal.js';
 import dayjs from 'dayjs';
@@ -3206,10 +3204,12 @@ const deserializeJSONMerchantParams = (strPayload) => {
     }
     return payload;
 };
-const serializeJSONMerchantParams = (requestParams) => 
+const serializeJSONMerchantParams = (requestParams, 
+// HMAC_SHA512_V2 requires base64url without padding, redsys answers SIS0430 otherwise
+encoding) => 
 // Official redsys docs escape "/" because they use php json_encode. I think
 // this is wrong and it also works without escaping.
-Buffer.from(JSON.stringify(requestParams), 'utf8').toString('base64');
+Buffer.from(JSON.stringify(requestParams), 'utf8').toString(encoding);
 
 /**
  * Adds padding to a buffer.
@@ -3232,6 +3232,7 @@ const zeroPad = (buf, blocksize) => {
 const encrypt3DES = (key, message) => {
     const keyBuf = Buffer.from(key, 'base64');
     const iv = Buffer.alloc(8, 0);
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-conversion
     const messageBuf = Buffer.from(message.toString(), 'utf8');
     // Align to blocksize by padding the message buffer
     const paddedMessageBuf = zeroPad(messageBuf, 8);
@@ -3259,6 +3260,49 @@ const sha256Sign = (merchantKey, order, params) => {
         .update(params)
         .digest('base64');
 };
+/**
+ * Encrypt a message using AES-128-CBC
+ *
+ * @params key - Key to encrypt message, used as text
+ * @params message - Message to be encrypted
+ */
+const encryptAES = (key, message) => {
+    // Redsys takes the first 16 characters of the key, right padded with zeros
+    const keyBuf = Buffer.from(key.slice(0, 16).padEnd(16, '0'), 'utf8');
+    const iv = Buffer.alloc(16, 0);
+    // PKCS#7 padding, the default
+    const cipher = crypto.createCipheriv('aes-128-cbc', keyBuf, iv);
+    return Buffer.concat([cipher.update(message, 'utf8'), cipher.final()]);
+};
+/**
+ * Compute HMAC_SHA512_V2 signature
+ *
+ * @params merchantKey - Key to encrypt message
+ * @params order - Order number
+ * @params params - Payload to sign
+ */
+const sha512Sign = (merchantKey, order, params) => {
+    // The HMAC key is the encrypted order as a base64 string, not its bytes
+    const orderKey = encryptAES(merchantKey, order).toString('base64');
+    return crypto
+        .createHmac('sha512', orderKey)
+        .update(params)
+        .digest('base64url');
+};
+/**
+ * Compare two signatures in constant time
+ *
+ * @params expected - Signature computed locally, base64 or base64url encoded
+ * @params received - Signature received from redsys, base64 or base64url encoded
+ */
+const isSignatureEqual = (expected, received) => {
+    // Comparing different base64 encodings is messy. Make it foolproof by comparing buffers.
+    // In node, the input encoding 'base64' accepts also base64url, with and without padding.
+    const expectedBuf = Buffer.from(expected, 'base64');
+    const receivedBuf = Buffer.from(received, 'base64');
+    return (expectedBuf.length === receivedBuf.length &&
+        crypto.timingSafeEqual(expectedBuf, receivedBuf));
+};
 
 /**
  * Discrete uniform distribution with domain (0 to *max*)
@@ -3276,6 +3320,7 @@ const randomTransactionId = () => {
     const numStr = num.toString().padStart(4, '0');
     // Random 8 letter alphanumeric sequence
     const alphanum = new Array(8);
+    // eslint-disable-next-line no-plusplus
     for (let idx = 0; idx < 8; idx++) {
         alphanum[idx] =
             alphanumeric[drawPositiveDiscreteUniform(alphanumeric.length - 1)];
@@ -3364,9 +3409,7 @@ const sha256VerifyJSONResponse = (merchantKey, response, responseParams) => {
     const signature = response.Ds_Signature;
     // Base64url with padding, only substitutes + and /
     const expSignature = sha256Sign(merchantKey, order, response.Ds_MerchantParameters);
-    // Comparing different base64 encodings is messy. Make it foolproof by comparing buffers.
-    if (!signature ||
-        !Buffer.from(expSignature, 'base64').equals(base64url.toBuffer(signature))) {
+    if (!signature || !isSignatureEqual(expSignature, signature)) {
         throw new ParseError('Invalid signature');
     }
 };
@@ -3380,14 +3423,97 @@ const sha256SignJSONRequest = (merchantKey, serializedParams, requestParams) =>
     };
 };
 
-const deserializeAndVerifyJSONResponse = (merchantKey, response) => {
+const sha512SignatureVersions = ['HMAC_SHA512_V2', 'HMAC_SHA512_V1'];
+const sha512VerifyJSONResponse = (merchantKey, response, responseParams) => {
+    if (!sha512SignatureVersions.includes(response.Ds_SignatureVersion)) {
+        throw new RedsysError(`Unknown signature version: ${response.Ds_SignatureVersion}`);
+    }
+    const order = extractAndAssertOrderFromResponseParams(responseParams);
+    const signature = response.Ds_Signature;
+    // Signs the merchant parameters as received
+    const expSignature = sha512Sign(merchantKey, order, response.Ds_MerchantParameters);
+    if (!signature || !isSignatureEqual(expSignature, signature)) {
+        throw new ParseError('Invalid signature');
+    }
+};
+const sha512V2SignJSONRequest = (merchantKey, serializedParams, requestParams) => {
+    const order = extractAndAssertOrderFromRequestParams(requestParams);
+    const signature = sha512Sign(merchantKey, order, serializedParams);
+    return {
+        Ds_SignatureVersion: 'HMAC_SHA512_V2',
+        Ds_MerchantParameters: serializedParams,
+        Ds_Signature: signature
+    };
+};
+const sha512V1SignJSONRequest = (merchantKey, serializedParams, requestParams) => {
+    const order = extractAndAssertOrderFromRequestParams(requestParams);
+    const signature = sha512Sign(merchantKey, order, serializedParams);
+    return {
+        Ds_SignatureVersion: 'HMAC_SHA512_V1',
+        Ds_MerchantParameters: serializedParams,
+        Ds_Signature: Buffer.from(signature, 'base64url').toString('base64').replace(/\+/g, '-').replace(/\//g, '_')
+    };
+};
+
+const signatureVersions = ['HMAC_SHA512_V2', 'HMAC_SHA512_V1', 'HMAC_SHA256_V1'];
+
+const assetIsSignatureVersion = (value) => {
+    if (!signatureVersions.includes(value)) {
+        throw new RedsysError(`Unknown signature version: ${String(value)}`);
+    }
+};
+const assetIsNonEmptyListOfSignatureVersions = (values) => {
+    if (values.length < 1) {
+        throw new RedsysError('List of signature versions is empty');
+    }
+    if (!values.every(sigItem => signatureVersions.includes(sigItem))) {
+        throw new RedsysError(`Unknown signature versions in: ${values.map(String).join(',')}`);
+    }
+};
+
+const deserializeAndVerifyJSONResponse = (merchantKey, response, signatureVersions) => {
     const params = deserializeJSONMerchantParams(response.Ds_MerchantParameters);
-    sha256VerifyJSONResponse(merchantKey, response, params);
-    return params;
+    assetIsSignatureVersion(response.Ds_SignatureVersion);
+    if (!signatureVersions.includes(response.Ds_SignatureVersion)) {
+        throw new RedsysError(`Signature version not allowed: ${response.Ds_SignatureVersion}`);
+    }
+    // Verify with the version declared by the response
+    switch (response.Ds_SignatureVersion) {
+        case 'HMAC_SHA512_V2': {
+            sha512VerifyJSONResponse(merchantKey, response, params);
+            return params;
+        }
+        case 'HMAC_SHA512_V1': {
+            sha512VerifyJSONResponse(merchantKey, response, params);
+            return params;
+        }
+        case 'HMAC_SHA256_V1': {
+            sha256VerifyJSONResponse(merchantKey, response, params);
+            return params;
+        }
+    }
+    throw new RedsysError(
+    // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
+    `Signature version not implemented: ${response.Ds_SignatureVersion}`);
 };
-const serializeAndSignJSONRequest = (merchantKey, requestParams) => {
-    const serializedParams = serializeJSONMerchantParams(requestParams);
-    return sha256SignJSONRequest(merchantKey, serializedParams, requestParams);
+const serializeAndSignJSONRequest = (merchantKey, requestParams, signatureVersion) => {
+    switch (signatureVersion) {
+        case 'HMAC_SHA512_V2': {
+            const serializedParams = serializeJSONMerchantParams(requestParams, 'base64url');
+            return sha512V2SignJSONRequest(merchantKey, serializedParams, requestParams);
+        }
+        case 'HMAC_SHA512_V1': {
+            const serializedParams = serializeJSONMerchantParams(requestParams, 'base64url');
+            return sha512V1SignJSONRequest(merchantKey, serializedParams, requestParams);
+        }
+        case 'HMAC_SHA256_V1': {
+            const serializedParams = serializeJSONMerchantParams(requestParams, 'base64');
+            return sha256SignJSONRequest(merchantKey, serializedParams, requestParams);
+        }
+    }
+    throw new RedsysError(
+    // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
+    `Signature version not implemented: ${signatureVersion}`);
 };
 
 /**
@@ -3431,7 +3557,7 @@ const verifySoapNotification = (merchantKey, xml, msg) => {
         throw new ParseError('Invalid notification response');
     }
     const expSignature = sha256Sign(merchantKey, order, signedStr);
-    if (!signature || signature !== expSignature) {
+    if (!signature || !isSignatureEqual(expSignature, signature)) {
         throw new ParseError('Invalid signature', signature, xml);
     }
 };
@@ -3451,8 +3577,8 @@ const deserializeAndVerifySoapNotification = (merchantKey, xml) => {
     return msg.Request;
 };
 
-const jsonRequest = async ({ fetch, url, merchantKey, rawRequestParams }) => {
-    const payload = serializeAndSignJSONRequest(merchantKey, rawRequestParams);
+const jsonRequest = async ({ fetch, url, merchantKey, rawRequestParams, signatureVersions }) => {
+    const payload = serializeAndSignJSONRequest(merchantKey, rawRequestParams, signatureVersions[0]);
     const response = await fetch(url, {
         method: 'POST',
         headers: {
@@ -3474,7 +3600,7 @@ const jsonRequest = async ({ fetch, url, merchantKey, rawRequestParams }) => {
             response: responseData
         });
     }
-    return deserializeAndVerifyJSONResponse(merchantKey, responseData);
+    return deserializeAndVerifyJSONResponse(merchantKey, responseData, signatureVersions);
 };
 
 /**
@@ -3506,7 +3632,7 @@ const SANDBOX_URLS = {
  * @public
  */
 const createRedsysAPI = (config) => {
-    var _a;
+    var _a, _b;
     const fetch$1 = (_a = config.fetch) !== null && _a !== void 0 ? _a : fetch;
     if (!config.secretKey || typeof config.secretKey !== 'string') {
         throw new RedsysError('A secretKey key must be provided');
@@ -3519,6 +3645,8 @@ const createRedsysAPI = (config) => {
         !config.urls.redirect) {
         throw new RedsysError('URLs must be provided');
     }
+    const signatureVersions = (_b = config.signatureVersions) !== null && _b !== void 0 ? _b : ['HMAC_SHA512_V2', 'HMAC_SHA512_V1', 'HMAC_SHA256_V1'];
+    assetIsNonEmptyListOfSignatureVersions(signatureVersions);
     /**
      * Sends a iniciaPeticion request using REST interface
      */
@@ -3526,7 +3654,8 @@ const createRedsysAPI = (config) => {
         fetch: fetch$1,
         url: config.urls.restIniciaPeticion,
         merchantKey: config.secretKey,
-        rawRequestParams: paramsInput
+        rawRequestParams: paramsInput,
+        signatureVersions
     });
     /**
      * Sends a trataPeticion request using REST interface
@@ -3536,7 +3665,8 @@ const createRedsysAPI = (config) => {
             fetch: fetch$1,
             url: config.urls.restTrataPeticion,
             merchantKey: config.secretKey,
-            rawRequestParams: paramsInput
+            rawRequestParams: paramsInput,
+            signatureVersions
         });
         return result;
     };
@@ -3544,7 +3674,7 @@ const createRedsysAPI = (config) => {
      * Creates the parameters needed for a redirect form
      */
     const createRedirectForm = (paramsInput) => {
-        const body = serializeAndSignJSONRequest(config.secretKey, paramsInput);
+        const body = serializeAndSignJSONRequest(config.secretKey, paramsInput, signatureVersions[0]);
         return {
             url: config.urls.redirect,
             body
@@ -3557,7 +3687,7 @@ const createRedsysAPI = (config) => {
     /** Body of JSON notification, as a POJO (Plain Old Javascript Object) */
     body) => {
         // A notification can't contain a gateway error, it didn't initiate the request
-        const params = deserializeAndVerifyJSONResponse(config.secretKey, body);
+        const params = deserializeAndVerifyJSONResponse(config.secretKey, body, signatureVersions);
         return decodeUrlEntries(params);
     };
     /**
@@ -3567,7 +3697,7 @@ const createRedsysAPI = (config) => {
     /** Body of JSON notification, as a POJO (Plain Old Javascript Object) */
     body) => 
     // A notification can't contain a gateway error, it didn't initiate the request
-    deserializeAndVerifyJSONResponse(config.secretKey, body);
+    deserializeAndVerifyJSONResponse(config.secretKey, body, signatureVersions);
     /**
      * Processes either a URLOK/URLKO query or a JSON REST notification
      *
@@ -3583,19 +3713,23 @@ const createRedsysAPI = (config) => {
     /** Body of JSON notification, as a POJO (Plain Old Javascript Object) */
     body) => {
         // A notification can't contain a gateway error, it didn't initiate the request
-        const params = deserializeAndVerifyJSONResponse(config.secretKey, body);
+        const params = deserializeAndVerifyJSONResponse(config.secretKey, body, signatureVersions);
         return typeof params.Ds_Date === 'string' && params.Ds_Date.includes('%2F')
             ? decodeUrlEntries(params)
             : params;
     };
     /**
      * Parses and verifies the body of a SOAP notification
+     *
+     * @deprecated
      */
     const processSoapNotification = (
     /** SOAP notification as a XML string */
     xml) => deserializeAndVerifySoapNotification(config.secretKey, xml);
     /**
      * Creates an answer for a SOAP notification, serializes and signs it
+     *
+     * @deprecated
      */
     const createSoapNotificationAnswer = (
     /** Order identifier */
@@ -3633,7 +3767,7 @@ const create3DSMethodForm = (emv3dsParams, notificationURL) => {
     return {
         url: emv3dsParams.threeDSMethodURL,
         body: {
-            threeDSMethodData: base64url.encode(JSON.stringify(methodData))
+            threeDSMethodData: Buffer.from(JSON.stringify(methodData), 'utf8').toString('base64url')
         }
     };
 };
@@ -3668,7 +3802,7 @@ const create3DSv2ChallengeForm = (emv3dsV2Challenge) => ({
  */
 const deserializeThreeDSMethodData = (threeDSMethodData) => 
 // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- assume it satisfies format
-JSON.parse(base64url.decode(threeDSMethodData));
+JSON.parse(Buffer.from(threeDSMethodData, 'base64url').toString('utf8'));
 /**
  * Deserialize `cres` field of a 3DS v2 challenge
  *
@@ -3679,7 +3813,9 @@ const deserializeCres = (cres) =>
 JSON.parse(Buffer.from(cres, 'base64').toString('utf8'));
 
 const unescapeXML = (str) => {
-    const xml = str.replace(/&(lt|#60|gt|#62|quot|#34|amp|#38|apos|#39);/g, (_match, p1) => {
+    const xml = str.replace(
+    // eslint-disable-next-line prefer-named-capture-group
+    /&(lt|#60|gt|#62|quot|#34|amp|#38|apos|#39);/g, (_match, p1) => {
         switch (p1) {
             case 'lt':
             case '#60':
@@ -3756,6 +3892,7 @@ const detectSoapVersion = (req) => {
  * @public
  */
 const mimicSoapNotificationReceiver = (xml) => {
+    // eslint-disable-next-line prefer-named-capture-group
     const regex = /<(?:\w+:)?XML(?: [^<>]+)?>([^<>]+)<\/(?:\w+:)?XML>/;
     const matchArray = regex.exec(xml);
     const xmlContent = matchArray ? matchArray[1] : undefined;

package/lib/index.js

@@ -1,10 +1,8 @@
 'use strict';
 
 var undici = require('undici');
-var http = require('http');
-var base64url = require('base64url');
-var crypto = require('crypto');
-var node_crypto = require('node:crypto');
+var node_http = require('node:http');
+var crypto = require('node:crypto');
 var fastXmlParser = require('fast-xml-parser');
 var Decimal = require('decimal.js');
 var dayjs = require('dayjs');
@@ -3026,7 +3024,7 @@ const getSISErrorCodeMessage = (code) => {
     }
     return SIS_ERROR_CODES[code.trim()];
 };
-const getHTTPErrorCodeMessage = (code) => http.STATUS_CODES[code];
+const getHTTPErrorCodeMessage = (code) => node_http.STATUS_CODES[code];
 
 /**
  * Error superclass for all redsys-easy specific errors
@@ -3208,10 +3206,12 @@ const deserializeJSONMerchantParams = (strPayload) => {
     }
     return payload;
 };
-const serializeJSONMerchantParams = (requestParams) => 
+const serializeJSONMerchantParams = (requestParams, 
+// HMAC_SHA512_V2 requires base64url without padding, redsys answers SIS0430 otherwise
+encoding) => 
 // Official redsys docs escape "/" because they use php json_encode. I think
 // this is wrong and it also works without escaping.
-Buffer.from(JSON.stringify(requestParams), 'utf8').toString('base64');
+Buffer.from(JSON.stringify(requestParams), 'utf8').toString(encoding);
 
 /**
  * Adds padding to a buffer.
@@ -3234,6 +3234,7 @@ const zeroPad = (buf, blocksize) => {
 const encrypt3DES = (key, message) => {
     const keyBuf = Buffer.from(key, 'base64');
     const iv = Buffer.alloc(8, 0);
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-conversion
     const messageBuf = Buffer.from(message.toString(), 'utf8');
     // Align to blocksize by padding the message buffer
     const paddedMessageBuf = zeroPad(messageBuf, 8);
@@ -3261,11 +3262,54 @@ const sha256Sign = (merchantKey, order, params) => {
         .update(params)
         .digest('base64');
 };
+/**
+ * Encrypt a message using AES-128-CBC
+ *
+ * @params key - Key to encrypt message, used as text
+ * @params message - Message to be encrypted
+ */
+const encryptAES = (key, message) => {
+    // Redsys takes the first 16 characters of the key, right padded with zeros
+    const keyBuf = Buffer.from(key.slice(0, 16).padEnd(16, '0'), 'utf8');
+    const iv = Buffer.alloc(16, 0);
+    // PKCS#7 padding, the default
+    const cipher = crypto.createCipheriv('aes-128-cbc', keyBuf, iv);
+    return Buffer.concat([cipher.update(message, 'utf8'), cipher.final()]);
+};
+/**
+ * Compute HMAC_SHA512_V2 signature
+ *
+ * @params merchantKey - Key to encrypt message
+ * @params order - Order number
+ * @params params - Payload to sign
+ */
+const sha512Sign = (merchantKey, order, params) => {
+    // The HMAC key is the encrypted order as a base64 string, not its bytes
+    const orderKey = encryptAES(merchantKey, order).toString('base64');
+    return crypto
+        .createHmac('sha512', orderKey)
+        .update(params)
+        .digest('base64url');
+};
+/**
+ * Compare two signatures in constant time
+ *
+ * @params expected - Signature computed locally, base64 or base64url encoded
+ * @params received - Signature received from redsys, base64 or base64url encoded
+ */
+const isSignatureEqual = (expected, received) => {
+    // Comparing different base64 encodings is messy. Make it foolproof by comparing buffers.
+    // In node, the input encoding 'base64' accepts also base64url, with and without padding.
+    const expectedBuf = Buffer.from(expected, 'base64');
+    const receivedBuf = Buffer.from(received, 'base64');
+    return (expectedBuf.length === receivedBuf.length &&
+        crypto.timingSafeEqual(expectedBuf, receivedBuf));
+};
 
 /**
  * Discrete uniform distribution with domain (0 to *max*)
  */
-const drawPositiveDiscreteUniform = (max) => node_crypto.randomInt(max + 1);
+const drawPositiveDiscreteUniform = (max) => crypto.randomInt(max + 1);
 const alphanumeric = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
 /**
  * Generates a random order ID following redsys requirements
@@ -3278,6 +3322,7 @@ const randomTransactionId = () => {
     const numStr = num.toString().padStart(4, '0');
     // Random 8 letter alphanumeric sequence
     const alphanum = new Array(8);
+    // eslint-disable-next-line no-plusplus
     for (let idx = 0; idx < 8; idx++) {
         alphanum[idx] =
             alphanumeric[drawPositiveDiscreteUniform(alphanumeric.length - 1)];
@@ -3366,9 +3411,7 @@ const sha256VerifyJSONResponse = (merchantKey, response, responseParams) => {
     const signature = response.Ds_Signature;
     // Base64url with padding, only substitutes + and /
     const expSignature = sha256Sign(merchantKey, order, response.Ds_MerchantParameters);
-    // Comparing different base64 encodings is messy. Make it foolproof by comparing buffers.
-    if (!signature ||
-        !Buffer.from(expSignature, 'base64').equals(base64url.toBuffer(signature))) {
+    if (!signature || !isSignatureEqual(expSignature, signature)) {
         throw new ParseError('Invalid signature');
     }
 };
@@ -3382,14 +3425,97 @@ const sha256SignJSONRequest = (merchantKey, serializedParams, requestParams) =>
     };
 };
 
-const deserializeAndVerifyJSONResponse = (merchantKey, response) => {
+const sha512SignatureVersions = ['HMAC_SHA512_V2', 'HMAC_SHA512_V1'];
+const sha512VerifyJSONResponse = (merchantKey, response, responseParams) => {
+    if (!sha512SignatureVersions.includes(response.Ds_SignatureVersion)) {
+        throw new RedsysError(`Unknown signature version: ${response.Ds_SignatureVersion}`);
+    }
+    const order = extractAndAssertOrderFromResponseParams(responseParams);
+    const signature = response.Ds_Signature;
+    // Signs the merchant parameters as received
+    const expSignature = sha512Sign(merchantKey, order, response.Ds_MerchantParameters);
+    if (!signature || !isSignatureEqual(expSignature, signature)) {
+        throw new ParseError('Invalid signature');
+    }
+};
+const sha512V2SignJSONRequest = (merchantKey, serializedParams, requestParams) => {
+    const order = extractAndAssertOrderFromRequestParams(requestParams);
+    const signature = sha512Sign(merchantKey, order, serializedParams);
+    return {
+        Ds_SignatureVersion: 'HMAC_SHA512_V2',
+        Ds_MerchantParameters: serializedParams,
+        Ds_Signature: signature
+    };
+};
+const sha512V1SignJSONRequest = (merchantKey, serializedParams, requestParams) => {
+    const order = extractAndAssertOrderFromRequestParams(requestParams);
+    const signature = sha512Sign(merchantKey, order, serializedParams);
+    return {
+        Ds_SignatureVersion: 'HMAC_SHA512_V1',
+        Ds_MerchantParameters: serializedParams,
+        Ds_Signature: Buffer.from(signature, 'base64url').toString('base64').replace(/\+/g, '-').replace(/\//g, '_')
+    };
+};
+
+const signatureVersions = ['HMAC_SHA512_V2', 'HMAC_SHA512_V1', 'HMAC_SHA256_V1'];
+
+const assetIsSignatureVersion = (value) => {
+    if (!signatureVersions.includes(value)) {
+        throw new RedsysError(`Unknown signature version: ${String(value)}`);
+    }
+};
+const assetIsNonEmptyListOfSignatureVersions = (values) => {
+    if (values.length < 1) {
+        throw new RedsysError('List of signature versions is empty');
+    }
+    if (!values.every(sigItem => signatureVersions.includes(sigItem))) {
+        throw new RedsysError(`Unknown signature versions in: ${values.map(String).join(',')}`);
+    }
+};
+
+const deserializeAndVerifyJSONResponse = (merchantKey, response, signatureVersions) => {
     const params = deserializeJSONMerchantParams(response.Ds_MerchantParameters);
-    sha256VerifyJSONResponse(merchantKey, response, params);
-    return params;
+    assetIsSignatureVersion(response.Ds_SignatureVersion);
+    if (!signatureVersions.includes(response.Ds_SignatureVersion)) {
+        throw new RedsysError(`Signature version not allowed: ${response.Ds_SignatureVersion}`);
+    }
+    // Verify with the version declared by the response
+    switch (response.Ds_SignatureVersion) {
+        case 'HMAC_SHA512_V2': {
+            sha512VerifyJSONResponse(merchantKey, response, params);
+            return params;
+        }
+        case 'HMAC_SHA512_V1': {
+            sha512VerifyJSONResponse(merchantKey, response, params);
+            return params;
+        }
+        case 'HMAC_SHA256_V1': {
+            sha256VerifyJSONResponse(merchantKey, response, params);
+            return params;
+        }
+    }
+    throw new RedsysError(
+    // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
+    `Signature version not implemented: ${response.Ds_SignatureVersion}`);
 };
-const serializeAndSignJSONRequest = (merchantKey, requestParams) => {
-    const serializedParams = serializeJSONMerchantParams(requestParams);
-    return sha256SignJSONRequest(merchantKey, serializedParams, requestParams);
+const serializeAndSignJSONRequest = (merchantKey, requestParams, signatureVersion) => {
+    switch (signatureVersion) {
+        case 'HMAC_SHA512_V2': {
+            const serializedParams = serializeJSONMerchantParams(requestParams, 'base64url');
+            return sha512V2SignJSONRequest(merchantKey, serializedParams, requestParams);
+        }
+        case 'HMAC_SHA512_V1': {
+            const serializedParams = serializeJSONMerchantParams(requestParams, 'base64url');
+            return sha512V1SignJSONRequest(merchantKey, serializedParams, requestParams);
+        }
+        case 'HMAC_SHA256_V1': {
+            const serializedParams = serializeJSONMerchantParams(requestParams, 'base64');
+            return sha256SignJSONRequest(merchantKey, serializedParams, requestParams);
+        }
+    }
+    throw new RedsysError(
+    // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
+    `Signature version not implemented: ${signatureVersion}`);
 };
 
 /**
@@ -3433,7 +3559,7 @@ const verifySoapNotification = (merchantKey, xml, msg) => {
         throw new ParseError('Invalid notification response');
     }
     const expSignature = sha256Sign(merchantKey, order, signedStr);
-    if (!signature || signature !== expSignature) {
+    if (!signature || !isSignatureEqual(expSignature, signature)) {
         throw new ParseError('Invalid signature', signature, xml);
     }
 };
@@ -3453,8 +3579,8 @@ const deserializeAndVerifySoapNotification = (merchantKey, xml) => {
     return msg.Request;
 };
 
-const jsonRequest = async ({ fetch, url, merchantKey, rawRequestParams }) => {
-    const payload = serializeAndSignJSONRequest(merchantKey, rawRequestParams);
+const jsonRequest = async ({ fetch, url, merchantKey, rawRequestParams, signatureVersions }) => {
+    const payload = serializeAndSignJSONRequest(merchantKey, rawRequestParams, signatureVersions[0]);
     const response = await fetch(url, {
         method: 'POST',
         headers: {
@@ -3476,7 +3602,7 @@ const jsonRequest = async ({ fetch, url, merchantKey, rawRequestParams }) => {
             response: responseData
         });
     }
-    return deserializeAndVerifyJSONResponse(merchantKey, responseData);
+    return deserializeAndVerifyJSONResponse(merchantKey, responseData, signatureVersions);
 };
 
 /**
@@ -3508,7 +3634,7 @@ const SANDBOX_URLS = {
  * @public
  */
 const createRedsysAPI = (config) => {
-    var _a;
+    var _a, _b;
     const fetch = (_a = config.fetch) !== null && _a !== void 0 ? _a : undici.fetch;
     if (!config.secretKey || typeof config.secretKey !== 'string') {
         throw new RedsysError('A secretKey key must be provided');
@@ -3521,6 +3647,8 @@ const createRedsysAPI = (config) => {
         !config.urls.redirect) {
         throw new RedsysError('URLs must be provided');
     }
+    const signatureVersions = (_b = config.signatureVersions) !== null && _b !== void 0 ? _b : ['HMAC_SHA512_V2', 'HMAC_SHA512_V1', 'HMAC_SHA256_V1'];
+    assetIsNonEmptyListOfSignatureVersions(signatureVersions);
     /**
      * Sends a iniciaPeticion request using REST interface
      */
@@ -3528,7 +3656,8 @@ const createRedsysAPI = (config) => {
         fetch,
         url: config.urls.restIniciaPeticion,
         merchantKey: config.secretKey,
-        rawRequestParams: paramsInput
+        rawRequestParams: paramsInput,
+        signatureVersions
     });
     /**
      * Sends a trataPeticion request using REST interface
@@ -3538,7 +3667,8 @@ const createRedsysAPI = (config) => {
             fetch,
             url: config.urls.restTrataPeticion,
             merchantKey: config.secretKey,
-            rawRequestParams: paramsInput
+            rawRequestParams: paramsInput,
+            signatureVersions
         });
         return result;
     };
@@ -3546,7 +3676,7 @@ const createRedsysAPI = (config) => {
      * Creates the parameters needed for a redirect form
      */
     const createRedirectForm = (paramsInput) => {
-        const body = serializeAndSignJSONRequest(config.secretKey, paramsInput);
+        const body = serializeAndSignJSONRequest(config.secretKey, paramsInput, signatureVersions[0]);
         return {
             url: config.urls.redirect,
             body
@@ -3559,7 +3689,7 @@ const createRedsysAPI = (config) => {
     /** Body of JSON notification, as a POJO (Plain Old Javascript Object) */
     body) => {
         // A notification can't contain a gateway error, it didn't initiate the request
-        const params = deserializeAndVerifyJSONResponse(config.secretKey, body);
+        const params = deserializeAndVerifyJSONResponse(config.secretKey, body, signatureVersions);
         return decodeUrlEntries(params);
     };
     /**
@@ -3569,7 +3699,7 @@ const createRedsysAPI = (config) => {
     /** Body of JSON notification, as a POJO (Plain Old Javascript Object) */
     body) => 
     // A notification can't contain a gateway error, it didn't initiate the request
-    deserializeAndVerifyJSONResponse(config.secretKey, body);
+    deserializeAndVerifyJSONResponse(config.secretKey, body, signatureVersions);
     /**
      * Processes either a URLOK/URLKO query or a JSON REST notification
      *
@@ -3585,19 +3715,23 @@ const createRedsysAPI = (config) => {
     /** Body of JSON notification, as a POJO (Plain Old Javascript Object) */
     body) => {
         // A notification can't contain a gateway error, it didn't initiate the request
-        const params = deserializeAndVerifyJSONResponse(config.secretKey, body);
+        const params = deserializeAndVerifyJSONResponse(config.secretKey, body, signatureVersions);
         return typeof params.Ds_Date === 'string' && params.Ds_Date.includes('%2F')
             ? decodeUrlEntries(params)
             : params;
     };
     /**
      * Parses and verifies the body of a SOAP notification
+     *
+     * @deprecated
      */
     const processSoapNotification = (
     /** SOAP notification as a XML string */
     xml) => deserializeAndVerifySoapNotification(config.secretKey, xml);
     /**
      * Creates an answer for a SOAP notification, serializes and signs it
+     *
+     * @deprecated
      */
     const createSoapNotificationAnswer = (
     /** Order identifier */
@@ -3635,7 +3769,7 @@ const create3DSMethodForm = (emv3dsParams, notificationURL) => {
     return {
         url: emv3dsParams.threeDSMethodURL,
         body: {
-            threeDSMethodData: base64url.encode(JSON.stringify(methodData))
+            threeDSMethodData: Buffer.from(JSON.stringify(methodData), 'utf8').toString('base64url')
         }
     };
 };
@@ -3670,7 +3804,7 @@ const create3DSv2ChallengeForm = (emv3dsV2Challenge) => ({
  */
 const deserializeThreeDSMethodData = (threeDSMethodData) => 
 // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- assume it satisfies format
-JSON.parse(base64url.decode(threeDSMethodData));
+JSON.parse(Buffer.from(threeDSMethodData, 'base64url').toString('utf8'));
 /**
  * Deserialize `cres` field of a 3DS v2 challenge
  *
@@ -3681,7 +3815,9 @@ const deserializeCres = (cres) =>
 JSON.parse(Buffer.from(cres, 'base64').toString('utf8'));
 
 const unescapeXML = (str) => {
-    const xml = str.replace(/&(lt|#60|gt|#62|quot|#34|amp|#38|apos|#39);/g, (_match, p1) => {
+    const xml = str.replace(
+    // eslint-disable-next-line prefer-named-capture-group
+    /&(lt|#60|gt|#62|quot|#34|amp|#38|apos|#39);/g, (_match, p1) => {
         switch (p1) {
             case 'lt':
             case '#60':
@@ -3758,6 +3894,7 @@ const detectSoapVersion = (req) => {
  * @public
  */
 const mimicSoapNotificationReceiver = (xml) => {
+    // eslint-disable-next-line prefer-named-capture-group
     const regex = /<(?:\w+:)?XML(?: [^<>]+)?>([^<>]+)<\/(?:\w+:)?XML>/;
     const matchArray = regex.exec(xml);
     const xmlContent = matchArray ? matchArray[1] : undefined;

package/lib/rest/json-serialization.d.ts

@@ -1,2 +1,2 @@
 export declare const deserializeJSONMerchantParams: <DeserializedResponseParams = unknown>(strPayload: string) => DeserializedResponseParams;
-export declare const serializeJSONMerchantParams: (requestParams: unknown) => string;
+export declare const serializeJSONMerchantParams: (requestParams: unknown, encoding: "base64" | "base64url") => string;

package/lib/rest/json-sha512-signature.d.ts

@@ -0,0 +1,4 @@
+import type { ResponseJSONSuccess, CommonRawRequestParams, CommonRawResponseParams, SHA512V1SignedJSONParameters, SHA512V2SignedJSONParameters } from '../types/api';
+export declare const sha512VerifyJSONResponse: (merchantKey: string, response: ResponseJSONSuccess, responseParams: CommonRawResponseParams) => void;
+export declare const sha512V2SignJSONRequest: (merchantKey: string, serializedParams: string, requestParams: CommonRawRequestParams) => SHA512V2SignedJSONParameters;
+export declare const sha512V1SignJSONRequest: (merchantKey: string, serializedParams: string, requestParams: CommonRawRequestParams) => SHA512V1SignedJSONParameters;

package/lib/rest/json.d.ts

@@ -1,3 +1,3 @@
-import type { ResponseJSONSuccess, CommonRawRequestParams, CommonRawResponseParams, SHA256SignedJSONParameters } from '../types/api';
-export declare const deserializeAndVerifyJSONResponse: <ResponseParams extends CommonRawResponseParams>(merchantKey: string, response: ResponseJSONSuccess) => ResponseParams;
-export declare const serializeAndSignJSONRequest: <RequestParams extends CommonRawRequestParams>(merchantKey: string, requestParams: RequestParams) => SHA256SignedJSONParameters;
+import type { ResponseJSONSuccess, CommonRawRequestParams, CommonRawResponseParams, SignedJSONParameters, SignatureVersion } from '../types/api';
+export declare const deserializeAndVerifyJSONResponse: <ResponseParams extends CommonRawResponseParams>(merchantKey: string, response: ResponseJSONSuccess, signatureVersions: readonly SignatureVersion[]) => ResponseParams;
+export declare const serializeAndSignJSONRequest: <RequestParams extends CommonRawRequestParams>(merchantKey: string, requestParams: RequestParams, signatureVersion: SignatureVersion) => SignedJSONParameters;

package/lib/rest/requests.d.ts

@@ -1,8 +1,9 @@
 import type { fetch as Fetch } from 'undici';
-import type { CommonRawRequestParams, CommonRawResponseParams } from '../types/api';
-export declare const jsonRequest: <RequestParams extends CommonRawRequestParams, ResponseParams extends CommonRawResponseParams>({ fetch, url, merchantKey, rawRequestParams }: {
+import type { CommonRawRequestParams, CommonRawResponseParams, SignatureVersion } from '../types/api';
+export declare const jsonRequest: <RequestParams extends CommonRawRequestParams, ResponseParams extends CommonRawResponseParams>({ fetch, url, merchantKey, rawRequestParams, signatureVersions }: {
     fetch: typeof Fetch;
     url: string;
     merchantKey: string;
     rawRequestParams: RequestParams;
+    signatureVersions: readonly [SignatureVersion, ...SignatureVersion[]];
 }) => Promise<ResponseParams>;

package/lib/types/api.d.ts

@@ -57,6 +57,12 @@ export interface ResponseJSONError {
  * Body of a redsys JSON HTTP response
  */
 export type ResponseJSON = ResponseJSONSuccess | ResponseJSONError;
+/**
+ * Signature versions supported by redsys-easy
+ *
+ * @public
+ */
+export type SignatureVersion = 'HMAC_SHA256_V1' | 'HMAC_SHA512_V1' | 'HMAC_SHA512_V2';
 /**
  * SHA256 signed JSON request parameters
  */
@@ -65,6 +71,26 @@ export interface SHA256SignedJSONParameters {
     Ds_MerchantParameters: string;
     Ds_Signature: string;
 }
+/**
+ * HMAC_SHA512_V1 signed JSON request parameters
+ */
+export interface SHA512V1SignedJSONParameters {
+    Ds_SignatureVersion: 'HMAC_SHA512_V1';
+    Ds_MerchantParameters: string;
+    Ds_Signature: string;
+}
+/**
+ * HMAC_SHA512_V2 signed JSON request parameters
+ */
+export interface SHA512V2SignedJSONParameters {
+    Ds_SignatureVersion: 'HMAC_SHA512_V2';
+    Ds_MerchantParameters: string;
+    Ds_Signature: string;
+}
+/**
+ * Signed JSON request parameters
+ */
+export type SignedJSONParameters = SHA256SignedJSONParameters | SHA512V1SignedJSONParameters | SHA512V2SignedJSONParameters;
 export interface SoapNotificationResponse {
     order: string;
     allow: boolean;
@@ -76,5 +102,5 @@ export interface SoapNotificationResponse {
  */
 export interface RedirectForm {
     url: string;
-    body: SHA256SignedJSONParameters;
+    body: SignedJSONParameters;
 }

package/lib/utils/signatures.d.ts

@@ -0,0 +1,3 @@
+import type { SignatureVersion } from '../types/api';
+export declare const assetIsSignatureVersion: (value: unknown) => asserts value is SignatureVersion;
+export declare const assetIsNonEmptyListOfSignatureVersions: (values: readonly unknown[]) => asserts values is readonly [SignatureVersion, ...SignatureVersion[]];

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "redsys-easy",
   "description": "Node JS interface for Redsys payment gateway",
-  "version": "5.3.2",
+  "version": "6.0.0",
   "author": "Javier Garcia <javiertury@gmail.com>",
   "license": "MIT",
   "keywords": [
@@ -40,80 +40,53 @@
     "commit-msg": "pnpm exec commitlint -e"
   },
   "dependencies": {
-    "base64url": "^3.0.1",
     "dayjs": "^1.11.9",
     "decimal.js": "^10.4.3",
     "fast-xml-parser": "^5.0.6",
     "tslib": "^2.6.1",
-    "undici": "^7.0.0"
+    "undici": "^8.0.1",
+    "vitest": "^5.1.0"
   },
   "devDependencies": {
-    "@commitlint/cli": "^17.6.7",
+    "@commitlint/cli": "^20.5.0",
     "@commitlint/config-conventional": "^17.6.7",
     "@koa/router": "^12.0.0",
-    "@microsoft/api-documenter": "^7.28.0",
-    "@microsoft/api-extractor": "^7.36.3",
+    "@microsoft/api-documenter": "^7.29.7",
+    "@microsoft/api-extractor": "^7.57.7",
     "@rollup/plugin-node-resolve": "^15.1.0",
     "@types/cheerio": "^0.22.31",
-    "@types/jest": "^30.0.0",
     "@types/koa": "^3.0.0",
     "@types/koa-bodyparser": "^4.3.10",
     "@types/koa__router": "^12.0.0",
     "cheerio": "1.0.0-rc.12",
-    "commit-and-tag-version": "^12.5.0",
-    "eslint": "^9.39.1",
-    "eslint-config-love": "^114.0.0",
-    "eslint-plugin-jest": "^28.14.0",
-    "jest": "^30.2.0",
+    "commit-and-tag-version": "^12.7.1",
+    "eslint": "^10.1.0",
+    "eslint-config-love": "^151.0.0",
     "koa": "^3.0.0",
     "koa-bodyparser": "^4.4.1",
     "lint-staged": "^15.3.0",
     "markdown-magic": "^4.0.4",
-    "rimraf": "^6.1.2",
+    "rimraf": "^6.1.3",
     "rollup": "^3.29.5",
-    "rollup-plugin-typescript2": "^0.35.0",
+    "rollup-plugin-typescript2": "^0.37.0",
     "simple-git-hooks": "^2.9.0",
     "ts-expect": "^1.3.0",
-    "ts-jest": "^29.4.5",
     "typescript": "^5.1.6"
   },
-  "jest": {
-    "preset": "ts-jest/presets/js-with-ts",
-    "testEnvironment": "node",
-    "testMatch": [
-      "<rootDir>/test/unit/**/*.test.ts",
-      "<rootDir>/test/integration/**/*.test.ts",
-      "<rootDir>/src/**/*.test.ts"
-    ],
-    "setupFilesAfterEnv": [
-      "./test/jest.setup.ts"
-    ],
-    "transform": {
-      "^.+\\.tsx?$": [
-        "ts-jest",
-        {
-          "tsconfig": "tsconfig.test.json"
-        }
-      ]
-    },
-    "moduleNameMapper": {
-      "redsys-easy": "<rootDir>/src"
-    }
-  },
   "scripts": {
     "lint": "eslint .",
     "build:clean": "rimraf lib",
     "build:code": "rollup -c rollup.config.mjs",
     "build:api": "api-extractor run --local",
     "build": "pnpm run build:clean && pnpm run lint && pnpm run build:code && pnpm run build:api",
-    "test:unit": "jest ./src/*.test.ts ./src/**/*.test.ts",
-    "test:integration": "jest ./test/integration/**/*.test.ts",
-    "test:code": "jest",
+    "test:unit": "vitest run ./src/*.test.ts ./src/**/*.test.ts",
+    "test:integration": "vitest run ./test/integration/**/*.test.ts",
+    "test:code": "vitest run",
     "test:readme": "tsc -p ./tsconfig.readme.json",
     "test": "pnpm run test:code && pnpm run test:readme",
     "docs:api": "api-documenter markdown --input-folder ./api/temp --output-folder ./docs",
     "docs:readme": "md-magic --files ./README.md",
     "docs": "pnpm run docs:api && pnpm run docs:readme",
-    "release": "pnpm run test && commit-and-tag-version --dry-run && pnpm run docs && git add docs CHANGELOG.md && commit-and-tag-version --commit-all"
+    "release": "pnpm run test:unit && commit-and-tag-version --dry-run && pnpm run docs && git add docs CHANGELOG.md && commit-and-tag-version --commit-all"
   }
 }