chore(deps): bump @waffo/pancake-ts from 0.11.0 to 0.18.0

[dependabot]

Bumps @waffo/pancake-ts from 0.11.0 to 0.18.0.

Release notes

Sourced from @​waffo/pancake-ts's releases.

v0.18.0

Customer sessions never reached the API, and webhook retries were rejected as replays.

Fixed

• Customer session requests now send X-Environment. A session token carries no environment of its own, so the gateway requires the header next to the Bearer credential and rejects the request with a 400 without it. The header was missing, which made every client.customer(...) method unusable: cancelSubscription, cancelOnetimeOrder, reactivateSubscription, createRefundTicket, resubmitRefundTicket, and graphql.query. API Key requests were never affected.
• Webhook verification no longer rejects legitimate retries. The signature timestamp is stamped once, before the first delivery attempt, and retries reuse the original header — so the last retry of a schedule arrives with a timestamp as old as the schedule itself (observed above 31 minutes). Against the old 5-minute window every late retry failed verification as a suspected replay. verifyWebhook now allows timestamps up to 45 minutes old.

Added

• WaffoPancakeConfig.environment — "test" or "prod", the environment customer sessions operate in.
• CustomerSessionOptions — second argument to client.customer(token, options).
• VerifyWebhookOptions.futureToleranceMs — default 60000 (1 minute).

Changed

• client.customer(token) requires an environment from either source and throws WaffoPancakeError (400, layer: "sdk") when neither supplies one. No working call changes behavior. Migration: add environment to your client config, or pass client.customer(token, { environment: "test" }).
• toleranceMs default raised to 2700000 and the window is now asymmetric, matching the gateway's API Key check. A captured request stays replayable longer — keep handlers idempotent on the event id.

v0.17.0

supportEmail and website were never applied by the update-store endpoint — passing them was silently ignored.

Removed

• BREAKING UpdateStoreParams.supportEmail and UpdateStoreParams.website — the endpoint never wrote these fields, so passing them had no effect. They are derived from ownership verification and are set only by the flows that prove it: email code binding, domain verification, or KYB approval. Both remain readable on Store.

  Migration: drop them from your stores.update() calls; a null you were passing to "clear" them was never clearing anything.

v0.16.1

Passing billingDetail couples the hosted cashier to the order's billing country: it then offers only that country's payment market and the customer cannot switch. The country that applies is the one on the finished order, not the one you sent; a country outside the payment markets we cover applies no restriction. If the coupled market offers none of your enabled payment methods the order cannot be paid. Omit billingDetail to leave the cashier unrestricted.

Types unchanged — no code migration.

v0.16.0

Per-transaction payment method selection on the hosted checkout page.

Added

• PaymentMethod — card / applepay / googlepay / wechat
• CreateCheckoutSessionParams.includePaymentMethods — whitelist: offer only these. Every value must be supported by the product type × currency pair, otherwise the request is rejected with a 400.
• CreateCheckoutSessionParams.excludePaymentMethods — blacklist: offer everything the currency supports except these. Values the currency does not offer are ignored, so one blacklist can be reused across currencies. Mutually exclusive with includePaymentMethods; omit both to offer every method the currency supports.

Changed

• Currencies outside the payment method matrix are now rejected at checkout session creation (400) instead of falling through to the provider. One-time supports USD / EUR / GBP / HKD / JPY / CNY; subscription supports USD / EUR / GBP / HKD / JPY.
• Both fields require API Key authentication. Store Slug (visitor) sessions ignore them and always offer every method the currency supports — payment method selection is a merchant-side commercial decision (channel fees, settlement terms).

v0.15.0

BREAKING: NotificationSettings drops notifyPayoutCompleted/notifyPayoutFailed (payout notifications are platform-managed, no toggle key); adds emailUpcomingCharge. MerchantWritableNotificationSettings shrinks accordingly.

... (truncated)

Changelog

Sourced from @​waffo/pancake-ts's changelog.

[0.18.0] - 2026-08-08

Customer sessions never reached the API, and webhook retries were rejected as replays.

Fixed

• Customer session requests now send X-Environment. A session token carries no environment of its own, so the gateway requires the header next to the Bearer credential and rejects the request with a 400 without it. The header was missing, which made every client.customer(...) method unusable: cancelSubscription, cancelOnetimeOrder, reactivateSubscription, createRefundTicket, resubmitRefundTicket, and graphql.query. API Key requests were never affected — the gateway derives their environment from the key.
• Webhook verification no longer rejects legitimate retries. The signature timestamp is stamped once, before the first delivery attempt, and retries reuse the original header — so the last retry of a schedule arrives with a timestamp as old as the schedule itself (observed above 31 minutes). Against the old 5-minute window every late retry failed verification as a suspected replay. verifyWebhook now allows timestamps up to 45 minutes old.

Added

• WaffoPancakeConfig.environment — "test" or "prod", the environment customer sessions operate in.
• CustomerSessionOptions — second argument to client.customer(token, options), overriding the config for a single session.
• VerifyWebhookOptions.futureToleranceMs — how far in the future a signature timestamp may be, default 60000 (1 minute). Raise it for a receiving server with known clock skew.

Changed

• client.customer(token) requires an environment from either the config or the per-session options, and throws WaffoPancakeError (400, layer: "sdk") when neither supplies one. There is no default — guessing would route the call to the other environment. This turns a request that always failed at the gateway into a local error; no working call changes behavior. Migration: add environment to your client config, or pass client.customer(token, { environment: "test" }).
• client.buyer(token, options) (deprecated) accepts and forwards the same options.
• VerifyWebhookOptions.toleranceMs default raised from 300000 to 2700000, and the window is now asymmetric — matching the gateway's API Key check, which pairs a wide past-facing window with a tight future-facing one. toleranceMs now means "how far in the past"; the future direction is futureToleranceMs. toleranceMs: 0 still disables the check entirely. A captured request stays replayable for longer under the wider window, so keep your handler idempotent on the event id — that, not the window, is the real defense.

[0.17.0] - 2026-08-03

supportEmail and website were never applied by the update-store endpoint — passing them was silently ignored.

Removed

• UpdateStoreParams.supportEmail and UpdateStoreParams.website — the endpoint never wrote these fields, so passing them had no effect. They are derived from ownership verification and are set only by the flows that prove it: email code binding, domain verification, or KYB approval. Both remain readable on Store. Migration: drop them from your stores.update() calls; a null you were passing to "clear" them was never clearing anything.

[0.16.1] - 2026-07-30

Pre-filling a billing country restricts which payment methods the hosted cashier offers.

Changed

• createCheckoutSession — passing billingDetail couples the hosted cashier to the order's billing country: it then offers only that country's payment market and the customer cannot switch. The country that applies is the one on the finished order, not the one you sent; a country outside the payment markets we cover applies no restriction. If the coupled market offers none of your enabled payment methods the order cannot be paid. Omit billingDetail to leave the cashier unrestricted. Types unchanged — no code migration.

[0.16.0] - 2026-07-28

Per-transaction payment method selection on the hosted checkout page.

Added

• PaymentMethod — payment methods offered on the checkout page: card / applepay / googlepay / wechat
• CreateCheckoutSessionParams.includePaymentMethods — whitelist: offer only these. Every value must be supported by the product type × currency pair, otherwise the request is rejected with a 400.
• CreateCheckoutSessionParams.excludePaymentMethods — blacklist: offer everything the currency supports except these. Values the currency does not offer are ignored, so one blacklist can be reused across currencies. Mutually exclusive with includePaymentMethods; omit both to offer every method the currency supports.

Changed

• Currencies outside the payment method matrix are now rejected at checkout session creation (400) instead of falling through to the provider. One-time supports USD / EUR / GBP / HKD / JPY / CNY; subscription supports USD / EUR / GBP / HKD / JPY. Affects one-time THB and subscription CNY, neither of which has ever produced a successful charge.

... (truncated)

Commits

• 2aa1904 Merge pull request #26 from waffo-com/fix/customer-session-environment-webhoo...
• 3b8ee2b fix: send X-Environment on customer sessions, widen webhook replay window
• afa0205 Merge pull request #25 from waffo-com/fix/update-store-params-readonly
• 477244c fix: drop supportEmail and website from UpdateStoreParams
• e78cf82 Merge pull request #24 from waffo-com/docs/billing-country-coupling
• 8190ea5 docs: state how a pre-filled billing country constrains the cashier
• 20ad0fe Merge pull request #23 from waffo-com/release/0.16.0
• e9e8502 feat: per-transaction payment method selection
• b079042 Merge pull request #22 from waffo-com/release/0.15.0
• 59b2ec8 feat!: notification settings contract for platform-managed payout notifications
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
murmur	Ready	Preview	Aug 16, 2026 7:10pm

[github-actions]

🔵 PR Size: size/XS

📊 Stats:

• 1 additions
• 1 deletions
• 2 total changes
• 1 files changed

This PR is tiny and quick to review.