fix: add rolldown for tsdown for some reason

fix: update for cve

fix(webhooks): add timeout, prevent replay attacks, and improve reliability (#11)

chore: fix linting and disable noExplicitAny for tests

fix(sdk): align idempotency TTL with session TTL (24 hours)

fix(sdk): add consistent error handling to create handler

fix(sdk): add error handling for corrupted session JSON

fix(sdk): prevent FSM violation in update handler status transitions

fix(sdk): add proper type for complete handler response

fix(sdk): prevent double-execution in idempotency race conditions

fix(sdk): remove duplicate updated_at override in session storage

fix(sdk): remove redundant FSM check after payment capture

fix(demo): use correct status for webhook debug

fix(sdk): fix imports from lib move

chore(sdk): move non-core logic to lib folder