npm - @garuhq/node - Versions diffs - 0.1.0 → 0.1.1 - Mend

@garuhq/node 0.1.0 → 0.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/CHANGELOG.md CHANGED Viewed

@@ -3,6 +3,15 @@
 All notable changes to `@garuhq/node` are documented in this file. Format:
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Versioning: [SemVer](https://semver.org/).
+## [0.1.1] — 2026-04-08
+### Security
+- Upgrade dev dependencies to clear `npm audit` findings:
+  - `vitest` 1.5.0 → 4.1.3 (closes critical GHSA — vitest RCE in dev server)
+  - `tsup` 8.0.2 → 8.5.1 (closes moderate DOM clobbering advisory)
+- All upgrades are dev-only; no runtime-code changes in `@garuhq/node` itself.
 ## [0.1.0] — 2026-04-08
 ### Added

package/dist/index.cjs CHANGED Viewed

@@ -84,31 +84,24 @@ var GaruServerError = class extends GaruAPIError {
 };
 function mapApiError(status, body, requestId, retryAfterSec) {
   const message = extractMessage(body) ?? `Garu API returned HTTP ${status}`;
-  if (status === 401)
-    return new GaruAuthenticationError(message, status, requestId, body);
-  if (status === 403)
-    return new GaruPermissionError(message, status, requestId, body);
-  if (status === 404)
-    return new GaruNotFoundError(message, status, requestId, body);
+  if (status === 401) return new GaruAuthenticationError(message, status, requestId, body);
+  if (status === 403) return new GaruPermissionError(message, status, requestId, body);
+  if (status === 404) return new GaruNotFoundError(message, status, requestId, body);
   if (status === 400 || status === 422) {
     return new GaruValidationError(message, status, requestId, body);
   }
   if (status === 429) {
     return new GaruRateLimitError(message, status, requestId, body, retryAfterSec);
   }
-  if (status >= 500)
-    return new GaruServerError(message, status, requestId, body);
+  if (status >= 500) return new GaruServerError(message, status, requestId, body);
   return new GaruAPIError("api_error", message, status, requestId, body);
 }
 function extractMessage(body) {
-  if (typeof body === "string")
-    return body;
+  if (typeof body === "string") return body;
   if (body && typeof body === "object") {
     const m = body.message;
-    if (typeof m === "string")
-      return m;
-    if (Array.isArray(m) && m.every((x) => typeof x === "string"))
-      return m.join("; ");
+    if (typeof m === "string") return m;
+    if (Array.isArray(m) && m.every((x) => typeof x === "string")) return m.join("; ");
   }
   return null;
 }
@@ -130,8 +123,7 @@ var HttpClient = class {
       Accept: "application/json",
       "User-Agent": cfg.userAgent
     };
-    if (cfg.apiKey)
-      headers.Authorization = `Bearer ${cfg.apiKey}`;
+    if (cfg.apiKey) headers.Authorization = `Bearer ${cfg.apiKey}`;
     this.client = createClient__default.default({
       baseUrl: cfg.baseUrl.replace(/\/+$/, ""),
       fetch: fetchImpl,
@@ -166,12 +158,10 @@ var HttpClient = class {
         continue;
       } catch (err) {
         clearTimeout(timer);
-        if (isGaruApiError(err))
-          throw err;
+        if (isGaruApiError(err)) throw err;
         const connErr = err instanceof Error && err.name === "AbortError" ? new GaruConnectionError(`Request timed out after ${this.cfg.timeoutMs}ms`, err) : new GaruConnectionError(err instanceof Error ? err.message : "Network error", err);
         lastError = connErr;
-        if (attempt === this.cfg.maxRetries)
-          throw connErr;
+        if (attempt === this.cfg.maxRetries) throw connErr;
         await sleep(backoffDelay(attempt, null));
         continue;
       }
@@ -183,8 +173,7 @@ function isGaruApiError(err) {
   return err instanceof Error && err.name.startsWith("Garu") && err.name.endsWith("Error");
 }
 function parseRetryAfter(value) {
-  if (!value)
-    return null;
+  if (!value) return null;
   const n = Number(value);
   return Number.isFinite(n) && n >= 0 ? n : null;
 }
@@ -213,6 +202,7 @@ var Charges = class {
   constructor(http) {
     this.http = http;
   }
+  http;
   /**
    * Create a charge (PIX, credit card, or boleto).
    *
@@ -289,10 +279,8 @@ var Charges = class {
   async refund(id, params = {}) {
     const idempotencyKey = params.idempotencyKey ?? generateIdempotencyKey();
     const body = {};
-    if (params.amount !== void 0)
-      body.amount = params.amount;
-    if (params.reason !== void 0)
-      body.reason = params.reason;
+    if (params.amount !== void 0) body.amount = params.amount;
+    if (params.reason !== void 0) body.reason = params.reason;
     return this.http.call(
       (signal) => this.http.client.POST("/api/transactions/{id}/refund", {
         params: { path: { id } },
@@ -310,15 +298,12 @@ var Charges = class {
       link: params.link ?? null,
       affiliateId: params.affiliateId ?? null
     };
-    if (params.additionalInfo !== void 0)
-      body.additionalInfo = params.additionalInfo;
-    if (params.priceId !== void 0)
-      body.priceId = params.priceId;
+    if (params.additionalInfo !== void 0) body.additionalInfo = params.additionalInfo;
+    if (params.priceId !== void 0) body.priceId = params.priceId;
     if (params.checkoutSessionToken !== void 0) {
       body.checkoutSessionToken = params.checkoutSessionToken;
     }
-    if (params.cardInfo)
-      body.CardInfo = params.cardInfo;
+    if (params.cardInfo) body.CardInfo = params.cardInfo;
     return body;
   }
 };
@@ -328,6 +313,7 @@ var Meta = class {
   constructor(http) {
     this.http = http;
   }
+  http;
   /**
    * Fetch the API's current capability payload.
    *
@@ -383,21 +369,17 @@ function parseSignatureHeader(header) {
   const fields = {};
   for (const part of header.split(",")) {
     const idx = part.indexOf("=");
-    if (idx === -1)
-      return null;
+    if (idx === -1) return null;
     const key = part.slice(0, idx).trim();
     const value = part.slice(idx + 1).trim();
-    if (!key || !value)
-      return null;
+    if (!key || !value) return null;
     fields[key] = value;
   }
   const t = fields.t;
   const v1 = fields.v1;
-  if (!t || !v1)
-    return null;
+  if (!t || !v1) return null;
   const timestamp = Number(t);
-  if (!Number.isFinite(timestamp) || !/^[a-f0-9]+$/i.test(v1))
-    return null;
+  if (!Number.isFinite(timestamp) || !/^[a-f0-9]+$/i.test(v1)) return null;
   return { timestamp, v1 };
 }
@@ -441,5 +423,5 @@ exports.GaruServerError = GaruServerError;
 exports.GaruSignatureVerificationError = GaruSignatureVerificationError;
 exports.GaruValidationError = GaruValidationError;
 exports.webhooks = webhooks;
-//# sourceMappingURL=out.js.map
+//# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/http.ts","../src/errors.ts","../src/idempotency.ts","../src/types.ts","../src/resources/charges.ts","../src/resources/meta.ts","../src/webhooks.ts","../src/client.ts"],"names":[],"mappings":";AAAA,OAAO,kBAAkB;;;ACmBlB,IAAM,YAAN,cAAwB,MAAM;AAAA,EACnB;AAAA,EAEhB,YAAY,MAAqB,SAAiB;AAChD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,UAAU;AAAA,EACjC;AAAA,EAChB,YAAY,SAAiB,iBAA2B;AACtD,UAAM,oBAAoB,OAAO;AACjC,SAAK,OAAO;AACZ,SAAK,kBAAkB;AAAA,EACzB;AACF;AAEO,IAAM,iCAAN,cAA6C,UAAU;AAAA,EAC5D,YAAY,SAAiB;AAC3B,UAAM,iCAAiC,OAAO;AAC9C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,eAAN,cAA2B,UAAU;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EAEhB,YACE,MACA,SACA,QACA,WACA,MACA;AACA,UAAM,MAAM,OAAO;AACnB,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,YAAY;AACjB,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,0BAAN,cAAsC,aAAa;AAAA,EACxD,YAAY,SAAiB,QAAgB,WAA0B,MAAe;AACpF,UAAM,wBAAwB,SAAS,QAAQ,WAAW,IAAI;AAC9D,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,aAAa;AAAA,EACpD,YAAY,SAAiB,QAAgB,WAA0B,MAAe;AACpF,UAAM,oBAAoB,SAAS,QAAQ,WAAW,IAAI;AAC1D,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,oBAAN,cAAgC,aAAa;AAAA,EAClD,YAAY,SAAiB,QAAgB,WAA0B,MAAe;AACpF,UAAM,aAAa,SAAS,QAAQ,WAAW,IAAI;AACnD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,aAAa;AAAA,EACpD,YAAY,SAAiB,QAAgB,WAA0B,MAAe;AACpF,UAAM,oBAAoB,SAAS,QAAQ,WAAW,IAAI;AAC1D,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,cAAiC,aAAa;AAAA,EACnC;AAAA,EAChB,YACE,SACA,QACA,WACA,MACA,eACA;AACA,UAAM,gBAAgB,SAAS,QAAQ,WAAW,IAAI;AACtD,SAAK,OAAO;AACZ,SAAK,gBAAgB;AAAA,EACvB;AACF;AAEO,IAAM,kBAAN,cAA8B,aAAa;AAAA,EAChD,YAAY,SAAiB,QAAgB,WAA0B,MAAe;AACpF,UAAM,gBAAgB,SAAS,QAAQ,WAAW,IAAI;AACtD,SAAK,OAAO;AAAA,EACd;AACF;AAKO,SAAS,YACd,QACA,MACA,WACA,eACc;AACd,QAAM,UAAU,eAAe,IAAI,KAAK,0BAA0B,MAAM;AAExE,MAAI,WAAW;AAAK,WAAO,IAAI,wBAAwB,SAAS,QAAQ,WAAW,IAAI;AACvF,MAAI,WAAW;AAAK,WAAO,IAAI,oBAAoB,SAAS,QAAQ,WAAW,IAAI;AACnF,MAAI,WAAW;AAAK,WAAO,IAAI,kBAAkB,SAAS,QAAQ,WAAW,IAAI;AACjF,MAAI,WAAW,OAAO,WAAW,KAAK;AACpC,WAAO,IAAI,oBAAoB,SAAS,QAAQ,WAAW,IAAI;AAAA,EACjE;AACA,MAAI,WAAW,KAAK;AAClB,WAAO,IAAI,mBAAmB,SAAS,QAAQ,WAAW,MAAM,aAAa;AAAA,EAC/E;AACA,MAAI,UAAU;AAAK,WAAO,IAAI,gBAAgB,SAAS,QAAQ,WAAW,IAAI;AAC9E,SAAO,IAAI,aAAa,aAAa,SAAS,QAAQ,WAAW,IAAI;AACvE;AAEA,SAAS,eAAe,MAA8B;AACpD,MAAI,OAAO,SAAS;AAAU,WAAO;AACrC,MAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,UAAM,IAAK,KAA+B;AAC1C,QAAI,OAAO,MAAM;AAAU,aAAO;AAClC,QAAI,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,OAAO,MAAM,QAAQ;AAAG,aAAO,EAAE,KAAK,IAAI;AAAA,EACnF;AACA,SAAO;AACT;;;ADpIA,IAAM,qBAAqB,oBAAI,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AAuB1D,IAAM,aAAN,MAAiB;AAAA,EACN;AAAA,EACC;AAAA,EAEjB,YAAY,KAAuB;AACjC,SAAK,MAAM;AACX,UAAM,YAAY,IAAI,SAAS,WAAW;AAC1C,QAAI,CAAC,WAAW;AACd,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAAkC;AAAA,MACtC,QAAQ;AAAA,MACR,cAAc,IAAI;AAAA,IACpB;AACA,QAAI,IAAI;AAAQ,cAAQ,gBAAgB,UAAU,IAAI,MAAM;AAE5D,SAAK,SAAS,aAAoB;AAAA,MAChC,SAAS,IAAI,QAAQ,QAAQ,QAAQ,EAAE;AAAA,MACvC,OAAO;AAAA,MACP;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAQ,IAA+D;AAC3E,QAAI,YAAuD;AAE3D,aAAS,UAAU,GAAG,WAAW,KAAK,IAAI,YAAY,WAAW;AAC/D,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,IAAI,SAAS;AAErE,UAAI;AACF,cAAM,EAAE,MAAM,OAAO,SAAS,IAAI,MAAM,GAAG,WAAW,MAAM;AAC5D,qBAAa,KAAK;AAElB,YAAI,SAAS,IAAI;AACf,iBAAO;AAAA,QACT;AAEA,cAAM,YAAY,SAAS,QAAQ,IAAI,cAAc;AACrD,cAAM,gBAAgB,gBAAgB,SAAS,QAAQ,IAAI,aAAa,CAAC;AACzE,cAAM,WAAW,YAAY,SAAS,QAAQ,SAAS,MAAM,WAAW,aAAa;AACrF,oBAAY;AAEZ,YAAI,CAAC,mBAAmB,IAAI,SAAS,MAAM,KAAK,YAAY,KAAK,IAAI,YAAY;AAC/E,gBAAM;AAAA,QACR;AAEA,cAAM,MAAM,aAAa,SAAS,aAAa,CAAC;AAChD;AAAA,MACF,SAAS,KAAK;AACZ,qBAAa,KAAK;AAElB,YAAI,eAAe,GAAG;AAAG,gBAAM;AAE/B,cAAM,UACJ,eAAe,SAAS,IAAI,SAAS,eACjC,IAAI,oBAAoB,2BAA2B,KAAK,IAAI,SAAS,MAAM,GAAG,IAC9E,IAAI,oBAAoB,eAAe,QAAQ,IAAI,UAAU,iBAAiB,GAAG;AACvF,oBAAY;AAEZ,YAAI,YAAY,KAAK,IAAI;AAAY,gBAAM;AAC3C,cAAM,MAAM,aAAa,SAAS,IAAI,CAAC;AACvC;AAAA,MACF;AAAA,IACF;AAGA,UAAM,aAAa,IAAI,oBAAoB,uCAAuC;AAAA,EACpF;AACF;AAEA,SAAS,eAAe,KAAuB;AAC7C,SAAO,eAAe,SAAS,IAAI,KAAK,WAAW,MAAM,KAAK,IAAI,KAAK,SAAS,OAAO;AACzF;AAEA,SAAS,gBAAgB,OAAqC;AAC5D,MAAI,CAAC;AAAO,WAAO;AACnB,QAAM,IAAI,OAAO,KAAK;AACtB,SAAO,OAAO,SAAS,CAAC,KAAK,KAAK,IAAI,IAAI;AAC5C;AAMA,SAAS,aAAa,SAAiB,eAAsC;AAC3E,MAAI,kBAAkB,MAAM;AAC1B,WAAO,gBAAgB,MAAO,KAAK,OAAO,IAAI;AAAA,EAChD;AACA,QAAM,OAAO,MAAM,KAAK;AACxB,QAAM,MAAM;AACZ,SAAO,KAAK,IAAI,KAAK,IAAI,IAAI,KAAK,OAAO;AAC3C;AAEA,SAAS,MAAM,IAA2B;AACxC,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AACzD;;;AE9IA,SAAS,kBAAkB;AASpB,SAAS,yBAAiC;AAC/C,SAAO,WAAW;AACpB;;;AC8HO,SAAS,oBAAoB,IAAwC;AAC1E,SAAO,OAAO,gBAAgB,eAAe;AAC/C;;;ACvHO,IAAM,UAAN,MAAc;AAAA,EACnB,YAA6B,MAAkB;AAAlB;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsChD,MAAM,OAAO,QAA6C;AACxD,UAAM,iBAAiB,OAAO,kBAAkB,uBAAuB;AACvE,UAAM,OAAO,KAAK,gBAAgB,MAAM;AAExC,WAAO,KAAK,KAAK;AAAA,MACf,CAAC,WACC,KAAK,KAAK,OAAO,KAAK,qBAAqB;AAAA,QACzC;AAAA,QACA,SAAS,EAAE,qBAAqB,eAAe;AAAA,QAC/C;AAAA,MACF,CAAC;AAAA,IACL;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,IAAI,IAA6B;AACrC,WAAO,KAAK,KAAK;AAAA,MACf,CAAC,WACC,KAAK,KAAK,OAAO,IAAI,0BAA0B;AAAA,QAC7C,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE;AAAA,QACvB;AAAA,MACF,CAAC;AAAA,IACL;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,OAAO,IAAY,SAA6B,CAAC,GAAoB;AACzE,UAAM,iBAAiB,OAAO,kBAAkB,uBAAuB;AACvE,UAAM,OAAgC,CAAC;AACvC,QAAI,OAAO,WAAW;AAAW,WAAK,SAAS,OAAO;AACtD,QAAI,OAAO,WAAW;AAAW,WAAK,SAAS,OAAO;AAEtD,WAAO,KAAK,KAAK;AAAA,MACf,CAAC,WACC,KAAK,KAAK,OAAO,KAAK,iCAAiC;AAAA,QACrD,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE;AAAA,QACvB;AAAA,QACA,SAAS,EAAE,qBAAqB,eAAe;AAAA,QAC/C;AAAA,MACF,CAAC;AAAA,IACL;AAAA,EACF;AAAA,EAEQ,gBAAgB,QAAmD;AACzE,UAAM,OAAgC;AAAA,MACpC,UAAU,OAAO;AAAA,MACjB,WAAW,OAAO;AAAA,MAClB,iBAAiB,oBAAoB,OAAO,aAAa;AAAA,MACzD,MAAM,OAAO,QAAQ;AAAA,MACrB,aAAa,OAAO,eAAe;AAAA,IACrC;AACA,QAAI,OAAO,mBAAmB;AAAW,WAAK,iBAAiB,OAAO;AACtE,QAAI,OAAO,YAAY;AAAW,WAAK,UAAU,OAAO;AACxD,QAAI,OAAO,yBAAyB,QAAW;AAC7C,WAAK,uBAAuB,OAAO;AAAA,IACrC;AACA,QAAI,OAAO;AAAU,WAAK,WAAW,OAAO;AAC5C,WAAO;AAAA,EACT;AACF;;;AC5HO,IAAM,OAAN,MAAW;AAAA,EAChB,YAA6B,MAAkB;AAAlB;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUhD,MAAM,MAA6B;AACjC,WAAO,KAAK,KAAK;AAAA,MACf,CAAC,WACC,KAAK,KAAK,OAAO,IAAI,aAAa,EAAE,OAAO,CAAC;AAAA,IAKhD;AAAA,EACF;AACF;;;AC/BA,SAAS,YAAY,uBAAuB;AA+CrC,IAAM,WAAW;AAAA,EACtB,OAAO,QAA8C;AACnD,UAAM,EAAE,WAAW,QAAQ,QAAQ,IAAI;AACvC,UAAM,eAAe,OAAO,gBAAgB;AAC5C,UAAM,MAAM,OAAO,OAAO,KAAK;AAE/B,QAAI,CAAC,aAAa,OAAO,cAAc,UAAU;AAC/C,YAAM,IAAI,+BAA+B,8CAA8C;AAAA,IACzF;AAEA,UAAM,QAAQ,qBAAqB,SAAS;AAC5C,QAAI,UAAU,MAAM;AAClB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,aAAa,OAAO,YAAY,WAAW,UAAU,QAAQ,SAAS,MAAM;AAClF,UAAM,gBAAgB,GAAG,MAAM,SAAS,IAAI,UAAU;AACtD,UAAM,WAAW,WAAW,UAAU,MAAM,EAAE,OAAO,aAAa,EAAE,OAAO,KAAK;AAEhF,UAAM,cAAc,OAAO,KAAK,UAAU,KAAK;AAC/C,UAAM,cAAc,OAAO,KAAK,MAAM,IAAI,KAAK;AAC/C,QAAI,YAAY,WAAW,YAAY,UAAU,CAAC,gBAAgB,aAAa,WAAW,GAAG;AAC3F,YAAM,IAAI,+BAA+B,wCAAwC;AAAA,IACnF;AAEA,UAAM,SAAS,KAAK,MAAM,IAAI,IAAI,GAAI;AACtC,QAAI,KAAK,IAAI,SAAS,MAAM,SAAS,IAAI,cAAc;AACrD,YAAM,IAAI;AAAA,QACR,iDAAiD,YAAY;AAAA,MAC/D;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,cAAQ,KAAK,MAAM,UAAU;AAAA,IAC/B,QAAQ;AACN,YAAM,IAAI,+BAA+B,mCAAmC;AAAA,IAC9E;AAEA,WAAO,EAAE,WAAW,MAAM,WAAW,MAAM;AAAA,EAC7C;AACF;AAEA,SAAS,qBAAqB,QAA0D;AACtF,QAAM,SAAiC,CAAC;AACxC,aAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AACpC,UAAM,MAAM,KAAK,QAAQ,GAAG;AAC5B,QAAI,QAAQ;AAAI,aAAO;AACvB,UAAM,MAAM,KAAK,MAAM,GAAG,GAAG,EAAE,KAAK;AACpC,UAAM,QAAQ,KAAK,MAAM,MAAM,CAAC,EAAE,KAAK;AACvC,QAAI,CAAC,OAAO,CAAC;AAAO,aAAO;AAC3B,WAAO,GAAG,IAAI;AAAA,EAChB;AACA,QAAM,IAAI,OAAO;AACjB,QAAM,KAAK,OAAO;AAClB,MAAI,CAAC,KAAK,CAAC;AAAI,WAAO;AACtB,QAAM,YAAY,OAAO,CAAC;AAC1B,MAAI,CAAC,OAAO,SAAS,SAAS,KAAK,CAAC,eAAe,KAAK,EAAE;AAAG,WAAO;AACpE,SAAO,EAAE,WAAW,GAAG;AACzB;;;ACvFA,IAAM,mBAAmB;AACzB,IAAM,qBAAqB;AAC3B,IAAM,sBAAsB;AAC5B,IAAM,cAAc;AAqBb,IAAM,OAAN,MAAW;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhB,OAAuB,WAAW;AAAA,EAClB,WAAW;AAAA,EAE3B,YAAY,UAAuB,CAAC,GAAG;AACrC,UAAM,OAAO,IAAI,WAAW;AAAA,MAC1B,SAAS,QAAQ,WAAW;AAAA,MAC5B,QAAQ,QAAQ;AAAA,MAChB,WAAW,QAAQ,aAAa;AAAA,MAChC,YAAY,QAAQ,cAAc;AAAA,MAClC,WAAW,aAAa,WAAW;AAAA,MACnC,OAAO,QAAQ;AAAA,IACjB,CAAC;AACD,SAAK,UAAU,IAAI,QAAQ,IAAI;AAC/B,SAAK,OAAO,IAAI,KAAK,IAAI;AAAA,EAC3B;AACF","sourcesContent":["import createClient from 'openapi-fetch';\n\nimport { GaruConnectionError, mapApiError, type GaruAPIError } from './errors.js';\nimport type { paths } from './generated/schema.js';\n\nexport interface HttpClientConfig {\n baseUrl: string;\n apiKey?: string;\n timeoutMs: number;\n maxRetries: number;\n userAgent: string;\n /** Injectable for tests. Defaults to `globalThis.fetch`. /\n fetch?: typeof fetch;\n}\n\nconst RETRYABLE_STATUSES = new Set([408, 429, 500, 502, 503, 504]);\n\n/* Typed openapi-fetch client keyed to the backend's OpenAPI paths. /\nexport type GaruOpenapiClient = ReturnType<typeof createClient<paths>>;\n\n/* Arg type for `HttpClient.call` — a thunk that issues one openapi-fetch request. /\nexport type OpenapiCallResult<T> = Promise<{\n data?: T;\n error?: unknown;\n response: Response;\n}>;\n\n/\n HttpClient wraps the generated `openapi-fetch` client with:\n * - retries (exponential backoff, full jitter, honors `Retry-After`)\n * - typed error mapping (non-2xx → {@link GaruAPIError} subclass)\n * - connection error wrapping\n * - Authorization + User-Agent injection\n \n Resources call {@link call} with a thunk that returns an openapi-fetch\n * `{ data, error, response }` tuple; the wrapper either returns `data` or\n * throws the mapped error.\n /\nexport class HttpClient {\n public readonly client: GaruOpenapiClient;\n private readonly cfg: HttpClientConfig;\n\n constructor(cfg: HttpClientConfig) {\n this.cfg = cfg;\n const fetchImpl = cfg.fetch ?? globalThis.fetch;\n if (!fetchImpl) {\n throw new GaruConnectionError(\n 'No fetch implementation available. Node.js >= 18 is required.'\n );\n }\n const headers: Record<string, string> = {\n Accept: 'application/json',\n 'User-Agent': cfg.userAgent\n };\n if (cfg.apiKey) headers.Authorization = `Bearer ${cfg.apiKey}`;\n\n this.client = createClient<paths>({\n baseUrl: cfg.baseUrl.replace(/\\/+$/, ''),\n fetch: fetchImpl,\n headers\n });\n }\n\n /\n Issue one HTTP call against the typed client, with retries + error mapping.\n \n `fn` is invoked up to `maxRetries + 1` times. The timeout in `cfg.timeoutMs`\n * is enforced via `AbortController`.\n /\n async call<T>(fn: (signal: AbortSignal) => OpenapiCallResult<T>): Promise<T> {\n let lastError: GaruAPIError \| GaruConnectionError \| null = null;\n\n for (let attempt = 0; attempt <= this.cfg.maxRetries; attempt++) {\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), this.cfg.timeoutMs);\n\n try {\n const { data, error, response } = await fn(controller.signal);\n clearTimeout(timer);\n\n if (response.ok) {\n return data as T;\n }\n\n const requestId = response.headers.get('x-request-id');\n const retryAfterSec = parseRetryAfter(response.headers.get('retry-after'));\n const apiError = mapApiError(response.status, error ?? null, requestId, retryAfterSec);\n lastError = apiError;\n\n if (!RETRYABLE_STATUSES.has(response.status) \|\| attempt === this.cfg.maxRetries) {\n throw apiError;\n }\n\n await sleep(backoffDelay(attempt, retryAfterSec));\n continue;\n } catch (err) {\n clearTimeout(timer);\n\n if (isGaruApiError(err)) throw err;\n\n const connErr =\n err instanceof Error && err.name === 'AbortError'\n ? new GaruConnectionError(`Request timed out after ${this.cfg.timeoutMs}ms`, err)\n : new GaruConnectionError(err instanceof Error ? err.message : 'Network error', err);\n lastError = connErr;\n\n if (attempt === this.cfg.maxRetries) throw connErr;\n await sleep(backoffDelay(attempt, null));\n continue;\n }\n }\n\n // Unreachable — the loop always throws or returns on the final attempt.\n throw lastError ?? new GaruConnectionError('Request failed with no error captured');\n }\n}\n\nfunction isGaruApiError(err: unknown): boolean {\n return err instanceof Error && err.name.startsWith('Garu') && err.name.endsWith('Error');\n}\n\nfunction parseRetryAfter(value: string \| null): number \| null {\n if (!value) return null;\n const n = Number(value);\n return Number.isFinite(n) && n >= 0 ? n : null;\n}\n\n/\n Exponential backoff with full jitter. If the server returned `Retry-After`,\n * we honor it (with a small jitter).\n /\nfunction backoffDelay(attempt: number, retryAfterSec: number \| null): number {\n if (retryAfterSec !== null) {\n return retryAfterSec 1000 + Math.random() * 250;\n }\n const base = 500 * 2 ** attempt;\n const cap = 8000;\n return Math.min(cap, base) * Math.random();\n}\n\nfunction sleep(ms: number): Promise<void> {\n return new Promise((resolve) => setTimeout(resolve, ms));\n}\n","/*\n Error hierarchy for the Garu SDK.\n \n Every error has a stable `code` string so agents and typed clients can switch on it\n * without parsing messages. Non-2xx API responses are mapped to the most specific\n * subclass of `GaruAPIError` by {@link mapApiError}.\n /\n\nexport type GaruErrorCode =\n \| 'authentication_error'\n \| 'permission_error'\n \| 'not_found'\n \| 'validation_error'\n \| 'rate_limited'\n \| 'server_error'\n \| 'api_error'\n \| 'connection_error'\n \| 'signature_verification_failed';\n\nexport class GaruError extends Error {\n public readonly code: GaruErrorCode;\n\n constructor(code: GaruErrorCode, message: string) {\n super(message);\n this.name = 'GaruError';\n this.code = code;\n }\n}\n\nexport class GaruConnectionError extends GaruError {\n public readonly connectionCause: unknown;\n constructor(message: string, connectionCause?: unknown) {\n super('connection_error', message);\n this.name = 'GaruConnectionError';\n this.connectionCause = connectionCause;\n }\n}\n\nexport class GaruSignatureVerificationError extends GaruError {\n constructor(message: string) {\n super('signature_verification_failed', message);\n this.name = 'GaruSignatureVerificationError';\n }\n}\n\nexport class GaruAPIError extends GaruError {\n public readonly status: number;\n public readonly requestId: string \| null;\n public readonly body: unknown;\n\n constructor(\n code: GaruErrorCode,\n message: string,\n status: number,\n requestId: string \| null,\n body: unknown\n ) {\n super(code, message);\n this.name = 'GaruAPIError';\n this.status = status;\n this.requestId = requestId;\n this.body = body;\n }\n}\n\nexport class GaruAuthenticationError extends GaruAPIError {\n constructor(message: string, status: number, requestId: string \| null, body: unknown) {\n super('authentication_error', message, status, requestId, body);\n this.name = 'GaruAuthenticationError';\n }\n}\n\nexport class GaruPermissionError extends GaruAPIError {\n constructor(message: string, status: number, requestId: string \| null, body: unknown) {\n super('permission_error', message, status, requestId, body);\n this.name = 'GaruPermissionError';\n }\n}\n\nexport class GaruNotFoundError extends GaruAPIError {\n constructor(message: string, status: number, requestId: string \| null, body: unknown) {\n super('not_found', message, status, requestId, body);\n this.name = 'GaruNotFoundError';\n }\n}\n\nexport class GaruValidationError extends GaruAPIError {\n constructor(message: string, status: number, requestId: string \| null, body: unknown) {\n super('validation_error', message, status, requestId, body);\n this.name = 'GaruValidationError';\n }\n}\n\nexport class GaruRateLimitError extends GaruAPIError {\n public readonly retryAfterSec: number \| null;\n constructor(\n message: string,\n status: number,\n requestId: string \| null,\n body: unknown,\n retryAfterSec: number \| null\n ) {\n super('rate_limited', message, status, requestId, body);\n this.name = 'GaruRateLimitError';\n this.retryAfterSec = retryAfterSec;\n }\n}\n\nexport class GaruServerError extends GaruAPIError {\n constructor(message: string, status: number, requestId: string \| null, body: unknown) {\n super('server_error', message, status, requestId, body);\n this.name = 'GaruServerError';\n }\n}\n\n/\n Map a non-2xx HTTP response to the most specific {@link GaruAPIError} subclass.\n /\nexport function mapApiError(\n status: number,\n body: unknown,\n requestId: string \| null,\n retryAfterSec: number \| null\n): GaruAPIError {\n const message = extractMessage(body) ?? `Garu API returned HTTP ${status}`;\n\n if (status === 401) return new GaruAuthenticationError(message, status, requestId, body);\n if (status === 403) return new GaruPermissionError(message, status, requestId, body);\n if (status === 404) return new GaruNotFoundError(message, status, requestId, body);\n if (status === 400 \|\| status === 422) {\n return new GaruValidationError(message, status, requestId, body);\n }\n if (status === 429) {\n return new GaruRateLimitError(message, status, requestId, body, retryAfterSec);\n }\n if (status >= 500) return new GaruServerError(message, status, requestId, body);\n return new GaruAPIError('api_error', message, status, requestId, body);\n}\n\nfunction extractMessage(body: unknown): string \| null {\n if (typeof body === 'string') return body;\n if (body && typeof body === 'object') {\n const m = (body as { message?: unknown }).message;\n if (typeof m === 'string') return m;\n if (Array.isArray(m) && m.every((x) => typeof x === 'string')) return m.join('; ');\n }\n return null;\n}\n","import { randomUUID } from 'node:crypto';\n\n/\n Generate a UUIDv4 suitable for use as an `X-Idempotency-Key` header value.\n \n @example\n * const key = generateIdempotencyKey();\n * // '3b241101-e2bb-4255-8caf-4136c566a962'\n /\nexport function generateIdempotencyKey(): string {\n return randomUUID();\n}\n","/\n Public types for the Garu SDK.\n \n The wire-level types (`WireCreateTransactionRequest`, `WireMetaResponse`, ...)\n * are generated from the backend's OpenAPI spec and live in\n * `src/generated/schema.d.ts`. The friendly types in this file\n * (`CreateChargeParams`, `Customer`, `Charge`, ...) are hand-curated for\n * ergonomics — they rename `transactions` to `charges`, collapse wire enums\n * into readable unions, and mark only truly required fields as required.\n * The resource layer maps friendly → wire at the edge.\n /\n\nimport type { components } from './generated/schema.js';\n\nexport type WireCreateTransactionRequest = components['schemas']['CreateTransactionRequest'];\nexport type WireCustomerDto = components['schemas']['CustomerDto'];\nexport type WireCardInfoDto = components['schemas']['CardInfoDto'];\nexport type WireMetaResponse = components['schemas']['MetaResponse'];\n\nexport type PaymentMethod = 'pix' \| 'credit_card' \| 'boleto';\n\n/* Payment-method identifier as sent to the backend over the wire. /\nexport type WirePaymentMethodId = 'pix' \| 'creditcard' \| 'boleto';\n\nexport type ChargeStatus =\n \| 'pending'\n \| 'authorized'\n \| 'paid'\n \| 'failed'\n \| 'refunded'\n \| 'cancelled'\n \| 'expired';\n\nexport interface Customer {\n /* Full legal name. 3–255 chars. /\n name: string;\n email: string;\n /* CPF (11 digits) or CNPJ (14 digits), digits only. /\n document: string;\n /* 10 or 11 digits with area code, no formatting. /\n phone: string;\n /* 8 digits, no hyphen. Optional. /\n zipCode?: string;\n street?: string;\n number?: string;\n complement?: string;\n neighborhood?: string;\n city?: string;\n /* 2-letter uppercase state code, e.g. `SP`. /\n state?: string;\n}\n\nexport interface CardInfo {\n /* 13–19 digits, no spaces or hyphens. /\n cardNumber: string;\n /* 3 or 4 digits. /\n cvv: string;\n /* `YYYY-MM`. /\n expirationDate: string;\n /* As printed on the card. /\n holderName: string;\n /* 1–12. /\n installments: number;\n}\n\nexport interface CreateChargeParams {\n /* Customer buying the product. /\n customer: Customer;\n /* UUID of the product being charged. /\n productId: string;\n /* Payment method. /\n paymentMethod: PaymentMethod;\n /* Required when `paymentMethod` is `credit_card`. /\n cardInfo?: CardInfo;\n /* Free-form metadata attached to the charge. /\n additionalInfo?: string;\n /* Original checkout link, if any. /\n link?: string \| null;\n /* Associated affiliate ID, if any. /\n affiliateId?: number \| null;\n /* Subscription price ID (`price_`), for subscription charges only. /\n priceId?: string \| null;\n /** Optional pre-created checkout session token. /\n checkoutSessionToken?: string;\n /\n Idempotency key. If omitted, the SDK generates a UUIDv4.\n * Keys are valid for 24h on the backend.\n /\n idempotencyKey?: string;\n}\n\nexport interface Charge {\n id: number;\n status: ChargeStatus;\n amount: number;\n paymentMethodId: WirePaymentMethodId;\n /* ISO-8601. /\n date: string;\n /* ISO-8601. /\n deadline?: string;\n /* Product this charge belongs to. /\n product?: { id: number; uuid?: string; name?: string };\n [key: string]: unknown;\n}\n\nexport interface RefundChargeParams {\n /* Partial refund in centavos. Omit for full refund. /\n amount?: number;\n /* Free-form reason stored on the refund. /\n reason?: string;\n idempotencyKey?: string;\n}\n\nexport interface MetaFeatures {\n subscriptions: boolean;\n checkout_sessions: boolean;\n idempotency_keys: boolean;\n test_mode: boolean;\n webhooks: boolean;\n}\n\nexport interface MetaResponse {\n name: string;\n version: string;\n environment: 'production' \| 'staging' \| 'development' \| string;\n api_version: string;\n payment_methods: string[];\n currencies: string[];\n billing_intervals: string[];\n webhook_events: string[];\n features: MetaFeatures;\n docs_url: string;\n dashboard_url: string;\n support_email: string;\n}\n\n/* Map the SDK's friendly `PaymentMethod` to the backend's wire value. /\nexport function toWirePaymentMethod(pm: PaymentMethod): WirePaymentMethodId {\n return pm === 'credit_card' ? 'creditcard' : pm;\n}\n","import type { HttpClient } from '../http.js';\nimport type { components } from '../generated/schema.js';\nimport { generateIdempotencyKey } from '../idempotency.js';\nimport {\n toWirePaymentMethod,\n type Charge,\n type CreateChargeParams,\n type RefundChargeParams\n} from '../types.js';\n\ntype CreateTransactionBody = components['schemas']['CreateTransactionRequest'];\n\n/\n Charges — the core of the Garu API.\n \n A charge represents a single payment attempt against a product. The SDK\n * surfaces charges under `garu.charges` even though the backend route is\n * `/api/transactions` — this matches Stripe convention and is the name every\n * other Garu surface (MCP, CLI, docs) uses.\n /\nexport class Charges {\n constructor(private readonly http: HttpClient) {}\n\n /\n Create a charge (PIX, credit card, or boleto).\n \n Automatically attaches an `X-Idempotency-Key` header — if you don't pass\n * `idempotencyKey`, the SDK generates a UUIDv4. Safe to retry: the backend\n * caches the first response for 24h.\n \n @example\n * // PIX charge\n * const charge = await garu.charges.create({\n * productId: 'b3f2c1e8-6e4a-4b9f-9d1c-2a1f6c3d4e5f',\n * paymentMethod: 'pix',\n * customer: {\n * name: 'Maria Silva',\n * email: 'maria@exemplo.com.br',\n * document: '12345678909',\n * phone: '11987654321'\n * }\n * });\n * console.log(charge.id, charge.status);\n \n @example\n * // Credit card charge, 3 installments\n * const charge = await garu.charges.create({\n * productId: 'b3f2c1e8-6e4a-4b9f-9d1c-2a1f6c3d4e5f',\n * paymentMethod: 'credit_card',\n * customer: { name: 'Maria Silva', email: 'maria@exemplo.com.br', document: '12345678909', phone: '11987654321' },\n * cardInfo: {\n * cardNumber: '4111111111111111',\n * cvv: '123',\n * expirationDate: '2030-12',\n * holderName: 'MARIA SILVA',\n * installments: 3\n * }\n * });\n /\n async create(params: CreateChargeParams): Promise<Charge> {\n const idempotencyKey = params.idempotencyKey ?? generateIdempotencyKey();\n const body = this.buildCreateBody(params);\n\n return this.http.call<Charge>(\n (signal) =>\n this.http.client.POST('/api/transactions', {\n body,\n headers: { 'X-Idempotency-Key': idempotencyKey },\n signal\n }) as Promise<{ data?: Charge; error?: unknown; response: Response }>\n );\n }\n\n /\n Fetch a single charge by numeric ID.\n \n @example\n * const charge = await garu.charges.get(4472);\n * if (charge.status === 'paid') { ... }\n /\n async get(id: number): Promise<Charge> {\n return this.http.call<Charge>(\n (signal) =>\n this.http.client.GET('/api/transactions/{id}', {\n params: { path: { id } },\n signal\n }) as Promise<{ data?: Charge; error?: unknown; response: Response }>\n );\n }\n\n /\n Refund a charge — fully, or partially by passing `amount` in centavos.\n \n @example\n * // Full refund\n * await garu.charges.refund(4472);\n \n @example\n * // Partial refund of R$ 10,00\n * await garu.charges.refund(4472, { amount: 1000, reason: 'customer_request' });\n /\n async refund(id: number, params: RefundChargeParams = {}): Promise<Charge> {\n const idempotencyKey = params.idempotencyKey ?? generateIdempotencyKey();\n const body: Record<string, unknown> = {};\n if (params.amount !== undefined) body.amount = params.amount;\n if (params.reason !== undefined) body.reason = params.reason;\n\n return this.http.call<Charge>(\n (signal) =>\n this.http.client.POST('/api/transactions/{id}/refund', {\n params: { path: { id } },\n body: body as never,\n headers: { 'X-Idempotency-Key': idempotencyKey },\n signal\n }) as Promise<{ data?: Charge; error?: unknown; response: Response }>\n );\n }\n\n private buildCreateBody(params: CreateChargeParams): CreateTransactionBody {\n const body: Record<string, unknown> = {\n customer: params.customer,\n productId: params.productId,\n paymentMethodId: toWirePaymentMethod(params.paymentMethod),\n link: params.link ?? null,\n affiliateId: params.affiliateId ?? null\n };\n if (params.additionalInfo !== undefined) body.additionalInfo = params.additionalInfo;\n if (params.priceId !== undefined) body.priceId = params.priceId;\n if (params.checkoutSessionToken !== undefined) {\n body.checkoutSessionToken = params.checkoutSessionToken;\n }\n if (params.cardInfo) body.CardInfo = params.cardInfo;\n return body as unknown as CreateTransactionBody;\n }\n}\n","import type { HttpClient } from '../http.js';\nimport type { MetaResponse } from '../types.js';\n\n/\n Meta — capability introspection.\n \n Unauthenticated. Used by `garu doctor`, MCP tool `doctor`, and by SDK\n * consumers that want to know which payment methods and webhook events are\n * currently supported.\n /\nexport class Meta {\n constructor(private readonly http: HttpClient) {}\n\n /\n Fetch the API's current capability payload.\n \n @example\n * const meta = await garu.meta.get();\n * console.log(meta.version, meta.payment_methods);\n * if (meta.features.subscriptions) { ... }\n /\n async get(): Promise<MetaResponse> {\n return this.http.call<MetaResponse>(\n (signal) =>\n this.http.client.GET('/api/meta', { signal }) as Promise<{\n data?: MetaResponse;\n error?: unknown;\n response: Response;\n }>\n );\n }\n}\n","import { createHmac, timingSafeEqual } from 'node:crypto';\n\nimport { GaruSignatureVerificationError } from './errors.js';\n\nexport interface VerifyWebhookParams {\n /* Raw request body as received — do NOT re-serialize parsed JSON. /\n payload: string \| Buffer;\n /* Value of the `X-Garu-Signature` header. Format: `t=<ts>,v1=<hex>`. /\n signature: string;\n /* The webhook endpoint's signing secret. /\n secret: string;\n /* Reject signatures older than this many seconds. Default: 300 (5 min). /\n toleranceSec?: number;\n /* Injectable for tests. Defaults to `Date.now()`. /\n now?: () => number;\n}\n\nexport interface VerifiedWebhook {\n /* Timestamp from the signature header, in seconds since epoch. /\n timestamp: number;\n /* Parsed JSON body. Throws {@link GaruSignatureVerificationError} if invalid JSON. /\n event: unknown;\n}\n\n/\n Webhook helpers.\n \n Garu signs outgoing webhooks with HMAC-SHA256 over `${timestamp}.${payload}`\n * and delivers the signature in the `X-Garu-Signature` header as `t=<ts>,v1=<hex>`.\n * This matches the format in the backend's `webhook-delivery.service.ts`.\n \n @example\n * // Express example\n * app.post('/webhooks/garu', express.raw({ type: 'application/json' }), (req, res) => {\n * try {\n * const { event } = Garu.webhooks.verify({\n * payload: req.body,\n * signature: req.header('x-garu-signature') ?? '',\n * secret: process.env.GARU_WEBHOOK_SECRET!\n * });\n * // handle event\n * res.sendStatus(200);\n * } catch (err) {\n * res.sendStatus(400);\n * }\n * });\n /\nexport const webhooks = {\n verify(params: VerifyWebhookParams): VerifiedWebhook {\n const { signature, secret, payload } = params;\n const toleranceSec = params.toleranceSec ?? 300;\n const now = params.now ?? Date.now;\n\n if (!signature \|\| typeof signature !== 'string') {\n throw new GaruSignatureVerificationError('Missing or malformed X-Garu-Signature header');\n }\n\n const parts = parseSignatureHeader(signature);\n if (parts === null) {\n throw new GaruSignatureVerificationError(\n 'X-Garu-Signature header does not match expected format t=<ts>,v1=<hex>'\n );\n }\n\n const payloadStr = typeof payload === 'string' ? payload : payload.toString('utf8');\n const signedPayload = `${parts.timestamp}.${payloadStr}`;\n const expected = createHmac('sha256', secret).update(signedPayload).digest('hex');\n\n const expectedBuf = Buffer.from(expected, 'hex');\n const providedBuf = Buffer.from(parts.v1, 'hex');\n if (expectedBuf.length !== providedBuf.length \|\| !timingSafeEqual(expectedBuf, providedBuf)) {\n throw new GaruSignatureVerificationError('Signature does not match computed HMAC');\n }\n\n const nowSec = Math.floor(now() / 1000);\n if (Math.abs(nowSec - parts.timestamp) > toleranceSec) {\n throw new GaruSignatureVerificationError(\n `Signature timestamp outside tolerance window (${toleranceSec}s)`\n );\n }\n\n let event: unknown;\n try {\n event = JSON.parse(payloadStr);\n } catch {\n throw new GaruSignatureVerificationError('Webhook payload is not valid JSON');\n }\n\n return { timestamp: parts.timestamp, event };\n }\n};\n\nfunction parseSignatureHeader(header: string): { timestamp: number; v1: string } \| null {\n const fields: Record<string, string> = {};\n for (const part of header.split(',')) {\n const idx = part.indexOf('=');\n if (idx === -1) return null;\n const key = part.slice(0, idx).trim();\n const value = part.slice(idx + 1).trim();\n if (!key \|\| !value) return null;\n fields[key] = value;\n }\n const t = fields.t;\n const v1 = fields.v1;\n if (!t \|\| !v1) return null;\n const timestamp = Number(t);\n if (!Number.isFinite(timestamp) \|\| !/^[a-f0-9]+$/i.test(v1)) return null;\n return { timestamp, v1 };\n}\n","import { HttpClient } from './http.js';\nimport { Charges } from './resources/charges.js';\nimport { Meta } from './resources/meta.js';\nimport { webhooks } from './webhooks.js';\n\nexport interface GaruOptions {\n /\n Your Garu API key. `sk_live_…` for production, `sk_test_…` for test mode.\n * Optional — public endpoints (`meta.get`, public charge creation) work without one.\n /\n apiKey?: string;\n /* Override the API base URL. Default: `https://garu.com.br/api`. /\n baseUrl?: string;\n /* Per-request timeout in ms. Default: 30000. /\n timeoutMs?: number;\n /* Max retries on retryable errors (connection, 408, 429, 5xx). Default: 2. /\n maxRetries?: number;\n /* Injectable for tests. Defaults to `globalThis.fetch`. /\n fetch?: typeof fetch;\n}\n\nconst DEFAULT_BASE_URL = 'https://garu.com.br';\nconst DEFAULT_TIMEOUT_MS = 30_000;\nconst DEFAULT_MAX_RETRIES = 2;\nconst SDK_VERSION = '0.1.0';\n\n/\n The Garu SDK client.\n \n @example\n * import { Garu } from '@garuhq/node';\n \n const garu = new Garu({ apiKey: process.env.GARU_API_KEY });\n \n const charge = await garu.charges.create({\n * productId: 'b3f2c1e8-6e4a-4b9f-9d1c-2a1f6c3d4e5f',\n * paymentMethod: 'pix',\n * customer: {\n * name: 'Maria Silva',\n * email: 'maria@exemplo.com.br',\n * document: '12345678909',\n * phone: '11987654321'\n * }\n * });\n /\nexport class Garu {\n public readonly charges: Charges;\n public readonly meta: Meta;\n\n /\n Webhook helpers. Available both as an instance member and as a static —\n * `Garu.webhooks.verify(...)` works without constructing a client.\n */\n public static readonly webhooks = webhooks;\n public readonly webhooks = webhooks;\n\n constructor(options: GaruOptions = {}) {\n const http = new HttpClient({\n baseUrl: options.baseUrl ?? DEFAULT_BASE_URL,\n apiKey: options.apiKey,\n timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,\n maxRetries: options.maxRetries ?? DEFAULT_MAX_RETRIES,\n userAgent: `garu-node/${SDK_VERSION}`,\n fetch: options.fetch\n });\n this.charges = new Charges(http);\n this.meta = new Meta(http);\n }\n}\n"]}
1	+ {"version":3,"sources":["../src/errors.ts","../src/http.ts","../src/idempotency.ts","../src/types.ts","../src/resources/charges.ts","../src/resources/meta.ts","../src/webhooks.ts","../src/client.ts"],"names":["createClient","randomUUID","createHmac","timingSafeEqual"],"mappings":";;;;;;;;;;;;AAmBO,IAAM,SAAA,GAAN,cAAwB,KAAA,CAAM;AAAA,EACnB,IAAA;AAAA,EAEhB,WAAA,CAAY,MAAqB,OAAA,EAAiB;AAChD,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAEO,IAAM,mBAAA,GAAN,cAAkC,SAAA,CAAU;AAAA,EACjC,eAAA;AAAA,EAChB,WAAA,CAAY,SAAiB,eAAA,EAA2B;AACtD,IAAA,KAAA,CAAM,oBAAoB,OAAO,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AACZ,IAAA,IAAA,CAAK,eAAA,GAAkB,eAAA;AAAA,EACzB;AACF;AAEO,IAAM,8BAAA,GAAN,cAA6C,SAAA,CAAU;AAAA,EAC5D,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,iCAAiC,OAAO,CAAA;AAC9C,IAAA,IAAA,CAAK,IAAA,GAAO,gCAAA;AAAA,EACd;AACF;AAEO,IAAM,YAAA,GAAN,cAA2B,SAAA,CAAU;AAAA,EAC1B,MAAA;AAAA,EACA,SAAA;AAAA,EACA,IAAA;AAAA,EAEhB,WAAA,CACE,IAAA,EACA,OAAA,EACA,MAAA,EACA,WACA,IAAA,EACA;AACA,IAAA,KAAA,CAAM,MAAM,OAAO,CAAA;AACnB,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAEO,IAAM,uBAAA,GAAN,cAAsC,YAAA,CAAa;AAAA,EACxD,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAgB,SAAA,EAA0B,IAAA,EAAe;AACpF,IAAA,KAAA,CAAM,sBAAA,EAAwB,OAAA,EAAS,MAAA,EAAQ,SAAA,EAAW,IAAI,CAAA;AAC9D,IAAA,IAAA,CAAK,IAAA,GAAO,yBAAA;AAAA,EACd;AACF;AAEO,IAAM,mBAAA,GAAN,cAAkC,YAAA,CAAa;AAAA,EACpD,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAgB,SAAA,EAA0B,IAAA,EAAe;AACpF,IAAA,KAAA,CAAM,kBAAA,EAAoB,OAAA,EAAS,MAAA,EAAQ,SAAA,EAAW,IAAI,CAAA;AAC1D,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AAAA,EACd;AACF;AAEO,IAAM,iBAAA,GAAN,cAAgC,YAAA,CAAa;AAAA,EAClD,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAgB,SAAA,EAA0B,IAAA,EAAe;AACpF,IAAA,KAAA,CAAM,WAAA,EAAa,OAAA,EAAS,MAAA,EAAQ,SAAA,EAAW,IAAI,CAAA;AACnD,IAAA,IAAA,CAAK,IAAA,GAAO,mBAAA;AAAA,EACd;AACF;AAEO,IAAM,mBAAA,GAAN,cAAkC,YAAA,CAAa;AAAA,EACpD,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAgB,SAAA,EAA0B,IAAA,EAAe;AACpF,IAAA,KAAA,CAAM,kBAAA,EAAoB,OAAA,EAAS,MAAA,EAAQ,SAAA,EAAW,IAAI,CAAA;AAC1D,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AAAA,EACd;AACF;AAEO,IAAM,kBAAA,GAAN,cAAiC,YAAA,CAAa;AAAA,EACnC,aAAA;AAAA,EAChB,WAAA,CACE,OAAA,EACA,MAAA,EACA,SAAA,EACA,MACA,aAAA,EACA;AACA,IAAA,KAAA,CAAM,cAAA,EAAgB,OAAA,EAAS,MAAA,EAAQ,SAAA,EAAW,IAAI,CAAA;AACtD,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AACZ,IAAA,IAAA,CAAK,aAAA,GAAgB,aAAA;AAAA,EACvB;AACF;AAEO,IAAM,eAAA,GAAN,cAA8B,YAAA,CAAa;AAAA,EAChD,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAgB,SAAA,EAA0B,IAAA,EAAe;AACpF,IAAA,KAAA,CAAM,cAAA,EAAgB,OAAA,EAAS,MAAA,EAAQ,SAAA,EAAW,IAAI,CAAA;AACtD,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AAAA,EACd;AACF;AAKO,SAAS,WAAA,CACd,MAAA,EACA,IAAA,EACA,SAAA,EACA,aAAA,EACc;AACd,EAAA,MAAM,OAAA,GAAU,cAAA,CAAe,IAAI,CAAA,IAAK,0BAA0B,MAAM,CAAA,CAAA;AAExE,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,IAAI,wBAAwB,OAAA,EAAS,MAAA,EAAQ,WAAW,IAAI,CAAA;AACvF,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,IAAI,oBAAoB,OAAA,EAAS,MAAA,EAAQ,WAAW,IAAI,CAAA;AACnF,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,IAAI,kBAAkB,OAAA,EAAS,MAAA,EAAQ,WAAW,IAAI,CAAA;AACjF,EAAA,IAAI,MAAA,KAAW,GAAA,IAAO,MAAA,KAAW,GAAA,EAAK;AACpC,IAAA,OAAO,IAAI,mBAAA,CAAoB,OAAA,EAAS,MAAA,EAAQ,WAAW,IAAI,CAAA;AAAA,EACjE;AACA,EAAA,IAAI,WAAW,GAAA,EAAK;AAClB,IAAA,OAAO,IAAI,kBAAA,CAAmB,OAAA,EAAS,MAAA,EAAQ,SAAA,EAAW,MAAM,aAAa,CAAA;AAAA,EAC/E;AACA,EAAA,IAAI,MAAA,IAAU,KAAK,OAAO,IAAI,gBAAgB,OAAA,EAAS,MAAA,EAAQ,WAAW,IAAI,CAAA;AAC9E,EAAA,OAAO,IAAI,YAAA,CAAa,WAAA,EAAa,OAAA,EAAS,MAAA,EAAQ,WAAW,IAAI,CAAA;AACvE;AAEA,SAAS,eAAe,IAAA,EAA8B;AACpD,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,EAAU,OAAO,IAAA;AACrC,EAAA,IAAI,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AACpC,IAAA,MAAM,IAAK,IAAA,CAA+B,OAAA;AAC1C,IAAA,IAAI,OAAO,CAAA,KAAM,QAAA,EAAU,OAAO,CAAA;AAClC,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,IAAK,EAAE,KAAA,CAAM,CAAC,CAAA,KAAM,OAAO,MAAM,QAAQ,CAAA,EAAG,OAAO,CAAA,CAAE,KAAK,IAAI,CAAA;AAAA,EACnF;AACA,EAAA,OAAO,IAAA;AACT;;;ACpIA,IAAM,kBAAA,mBAAqB,IAAI,GAAA,CAAI,CAAC,GAAA,EAAK,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAuB1D,IAAM,aAAN,MAAiB;AAAA,EACN,MAAA;AAAA,EACC,GAAA;AAAA,EAEjB,YAAY,GAAA,EAAuB;AACjC,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AACX,IAAA,MAAM,SAAA,GAAY,GAAA,CAAI,KAAA,IAAS,UAAA,CAAW,KAAA;AAC1C,IAAA,IAAI,CAAC,SAAA,EAAW;AACd,MAAA,MAAM,IAAI,mBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,MAAA,EAAQ,kBAAA;AAAA,MACR,cAAc,GAAA,CAAI;AAAA,KACpB;AACA,IAAA,IAAI,IAAI,MAAA,EAAQ,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,IAAI,MAAM,CAAA,CAAA;AAE5D,IAAA,IAAA,CAAK,SAASA,6BAAA,CAAoB;AAAA,MAChC,OAAA,EAAS,GAAA,CAAI,OAAA,CAAQ,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAAA,MACvC,KAAA,EAAO,SAAA;AAAA,MACP;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAQ,EAAA,EAA+D;AAC3E,IAAA,IAAI,SAAA,GAAuD,IAAA;AAE3D,IAAA,KAAA,IAAS,UAAU,CAAA,EAAG,OAAA,IAAW,IAAA,CAAK,GAAA,CAAI,YAAY,OAAA,EAAA,EAAW;AAC/D,MAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,MAAA,MAAM,KAAA,GAAQ,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,CAAK,IAAI,SAAS,CAAA;AAErE,MAAA,IAAI;AACF,QAAA,MAAM,EAAE,MAAM,KAAA,EAAO,QAAA,KAAa,MAAM,EAAA,CAAG,WAAW,MAAM,CAAA;AAC5D,QAAA,YAAA,CAAa,KAAK,CAAA;AAElB,QAAA,IAAI,SAAS,EAAA,EAAI;AACf,UAAA,OAAO,IAAA;AAAA,QACT;AAEA,QAAA,MAAM,SAAA,GAAY,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AACrD,QAAA,MAAM,gBAAgB,eAAA,CAAgB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAC,CAAA;AACzE,QAAA,MAAM,WAAW,WAAA,CAAY,QAAA,CAAS,QAAQ,KAAA,IAAS,IAAA,EAAM,WAAW,aAAa,CAAA;AACrF,QAAA,SAAA,GAAY,QAAA;AAEZ,QAAA,IAAI,CAAC,mBAAmB,GAAA,CAAI,QAAA,CAAS,MAAM,CAAA,IAAK,OAAA,KAAY,IAAA,CAAK,GAAA,CAAI,UAAA,EAAY;AAC/E,UAAA,MAAM,QAAA;AAAA,QACR;AAEA,QAAA,MAAM,KAAA,CAAM,YAAA,CAAa,OAAA,EAAS,aAAa,CAAC,CAAA;AAChD,QAAA;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,YAAA,CAAa,KAAK,CAAA;AAElB,QAAA,IAAI,cAAA,CAAe,GAAG,CAAA,EAAG,MAAM,GAAA;AAE/B,QAAA,MAAM,OAAA,GACJ,eAAe,KAAA,IAAS,GAAA,CAAI,SAAS,YAAA,GACjC,IAAI,mBAAA,CAAoB,CAAA,wBAAA,EAA2B,IAAA,CAAK,GAAA,CAAI,SAAS,CAAA,EAAA,CAAA,EAAM,GAAG,IAC9E,IAAI,mBAAA,CAAoB,eAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,eAAA,EAAiB,GAAG,CAAA;AACvF,QAAA,SAAA,GAAY,OAAA;AAEZ,QAAA,IAAI,OAAA,KAAY,IAAA,CAAK,GAAA,CAAI,UAAA,EAAY,MAAM,OAAA;AAC3C,QAAA,MAAM,KAAA,CAAM,YAAA,CAAa,OAAA,EAAS,IAAI,CAAC,CAAA;AACvC,QAAA;AAAA,MACF;AAAA,IACF;AAGA,IAAA,MAAM,SAAA,IAAa,IAAI,mBAAA,CAAoB,uCAAuC,CAAA;AAAA,EACpF;AACF,CAAA;AAEA,SAAS,eAAe,GAAA,EAAuB;AAC7C,EAAA,OAAO,GAAA,YAAe,KAAA,IAAS,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,IAAK,GAAA,CAAI,IAAA,CAAK,QAAA,CAAS,OAAO,CAAA;AACzF;AAEA,SAAS,gBAAgB,KAAA,EAAqC;AAC5D,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,CAAA,GAAI,OAAO,KAAK,CAAA;AACtB,EAAA,OAAO,OAAO,QAAA,CAAS,CAAC,CAAA,IAAK,CAAA,IAAK,IAAI,CAAA,GAAI,IAAA;AAC5C;AAMA,SAAS,YAAA,CAAa,SAAiB,aAAA,EAAsC;AAC3E,EAAA,IAAI,kBAAkB,IAAA,EAAM;AAC1B,IAAA,OAAO,aAAA,GAAgB,GAAA,GAAO,IAAA,CAAK,MAAA,EAAO,GAAI,GAAA;AAAA,EAChD;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,CAAA,IAAK,OAAA;AACxB,EAAA,MAAM,GAAA,GAAM,GAAA;AACZ,EAAA,OAAO,KAAK,GAAA,CAAI,GAAA,EAAK,IAAI,CAAA,GAAI,KAAK,MAAA,EAAO;AAC3C;AAEA,SAAS,MAAM,EAAA,EAA2B;AACxC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AACzD;ACrIO,SAAS,sBAAA,GAAiC;AAC/C,EAAA,OAAOC,iBAAA,EAAW;AACpB;;;AC8HO,SAAS,oBAAoB,EAAA,EAAwC;AAC1E,EAAA,OAAO,EAAA,KAAO,gBAAgB,YAAA,GAAe,EAAA;AAC/C;;;ACvHO,IAAM,UAAN,MAAc;AAAA,EACnB,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA,EAAnB,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsC7B,MAAM,OAAO,MAAA,EAA6C;AACxD,IAAA,MAAM,cAAA,GAAiB,MAAA,CAAO,cAAA,IAAkB,sBAAA,EAAuB;AACvE,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,eAAA,CAAgB,MAAM,CAAA;AAExC,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA;AAAA,MACf,CAAC,MAAA,KACC,IAAA,CAAK,IAAA,CAAK,MAAA,CAAO,KAAK,mBAAA,EAAqB;AAAA,QACzC,IAAA;AAAA,QACA,OAAA,EAAS,EAAE,mBAAA,EAAqB,cAAA,EAAe;AAAA,QAC/C;AAAA,OACD;AAAA,KACL;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,IAAI,EAAA,EAA6B;AACrC,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA;AAAA,MACf,CAAC,MAAA,KACC,IAAA,CAAK,IAAA,CAAK,MAAA,CAAO,IAAI,wBAAA,EAA0B;AAAA,QAC7C,MAAA,EAAQ,EAAE,IAAA,EAAM,EAAE,IAAG,EAAE;AAAA,QACvB;AAAA,OACD;AAAA,KACL;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,MAAA,CAAO,EAAA,EAAY,MAAA,GAA6B,EAAC,EAAoB;AACzE,IAAA,MAAM,cAAA,GAAiB,MAAA,CAAO,cAAA,IAAkB,sBAAA,EAAuB;AACvE,IAAA,MAAM,OAAgC,EAAC;AACvC,IAAA,IAAI,MAAA,CAAO,MAAA,KAAW,MAAA,EAAW,IAAA,CAAK,SAAS,MAAA,CAAO,MAAA;AACtD,IAAA,IAAI,MAAA,CAAO,MAAA,KAAW,MAAA,EAAW,IAAA,CAAK,SAAS,MAAA,CAAO,MAAA;AAEtD,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA;AAAA,MACf,CAAC,MAAA,KACC,IAAA,CAAK,IAAA,CAAK,MAAA,CAAO,KAAK,+BAAA,EAAiC;AAAA,QACrD,MAAA,EAAQ,EAAE,IAAA,EAAM,EAAE,IAAG,EAAE;AAAA,QACvB,IAAA;AAAA,QACA,OAAA,EAAS,EAAE,mBAAA,EAAqB,cAAA,EAAe;AAAA,QAC/C;AAAA,OACD;AAAA,KACL;AAAA,EACF;AAAA,EAEQ,gBAAgB,MAAA,EAAmD;AACzE,IAAA,MAAM,IAAA,GAAgC;AAAA,MACpC,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,WAAW,MAAA,CAAO,SAAA;AAAA,MAClB,eAAA,EAAiB,mBAAA,CAAoB,MAAA,CAAO,aAAa,CAAA;AAAA,MACzD,IAAA,EAAM,OAAO,IAAA,IAAQ,IAAA;AAAA,MACrB,WAAA,EAAa,OAAO,WAAA,IAAe;AAAA,KACrC;AACA,IAAA,IAAI,MAAA,CAAO,cAAA,KAAmB,MAAA,EAAW,IAAA,CAAK,iBAAiB,MAAA,CAAO,cAAA;AACtE,IAAA,IAAI,MAAA,CAAO,OAAA,KAAY,MAAA,EAAW,IAAA,CAAK,UAAU,MAAA,CAAO,OAAA;AACxD,IAAA,IAAI,MAAA,CAAO,yBAAyB,MAAA,EAAW;AAC7C,MAAA,IAAA,CAAK,uBAAuB,MAAA,CAAO,oBAAA;AAAA,IACrC;AACA,IAAA,IAAI,MAAA,CAAO,QAAA,EAAU,IAAA,CAAK,QAAA,GAAW,MAAA,CAAO,QAAA;AAC5C,IAAA,OAAO,IAAA;AAAA,EACT;AACF,CAAA;;;AC5HO,IAAM,OAAN,MAAW;AAAA,EAChB,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA,EAAnB,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAU7B,MAAM,GAAA,GAA6B;AACjC,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA;AAAA,MACf,CAAC,WACC,IAAA,CAAK,IAAA,CAAK,OAAO,GAAA,CAAI,WAAA,EAAa,EAAE,MAAA,EAAQ;AAAA,KAKhD;AAAA,EACF;AACF,CAAA;ACgBO,IAAM,QAAA,GAAW;AAAA,EACtB,OAAO,MAAA,EAA8C;AACnD,IAAA,MAAM,EAAE,SAAA,EAAW,MAAA,EAAQ,OAAA,EAAQ,GAAI,MAAA;AACvC,IAAA,MAAM,YAAA,GAAe,OAAO,YAAA,IAAgB,GAAA;AAC5C,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,GAAA,IAAO,IAAA,CAAK,GAAA;AAE/B,IAAA,IAAI,CAAC,SAAA,IAAa,OAAO,SAAA,KAAc,QAAA,EAAU;AAC/C,MAAA,MAAM,IAAI,+BAA+B,8CAA8C,CAAA;AAAA,IACzF;AAEA,IAAA,MAAM,KAAA,GAAQ,qBAAqB,SAAS,CAAA;AAC5C,IAAA,IAAI,UAAU,IAAA,EAAM;AAClB,MAAA,MAAM,IAAI,8BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,aAAa,OAAO,OAAA,KAAY,WAAW,OAAA,GAAU,OAAA,CAAQ,SAAS,MAAM,CAAA;AAClF,IAAA,MAAM,aAAA,GAAgB,CAAA,EAAG,KAAA,CAAM,SAAS,IAAI,UAAU,CAAA,CAAA;AACtD,IAAA,MAAM,QAAA,GAAWC,kBAAW,QAAA,EAAU,MAAM,EAAE,MAAA,CAAO,aAAa,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AAEhF,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,IAAA,CAAK,QAAA,EAAU,KAAK,CAAA;AAC/C,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,IAAI,KAAK,CAAA;AAC/C,IAAA,IAAI,WAAA,CAAY,WAAW,WAAA,CAAY,MAAA,IAAU,CAACC,sBAAA,CAAgB,WAAA,EAAa,WAAW,CAAA,EAAG;AAC3F,MAAA,MAAM,IAAI,+BAA+B,wCAAwC,CAAA;AAAA,IACnF;AAEA,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAA,KAAQ,GAAI,CAAA;AACtC,IAAA,IAAI,KAAK,GAAA,CAAI,MAAA,GAAS,KAAA,CAAM,SAAS,IAAI,YAAA,EAAc;AACrD,MAAA,MAAM,IAAI,8BAAA;AAAA,QACR,iDAAiD,YAAY,CAAA,EAAA;AAAA,OAC/D;AAAA,IACF;AAEA,IAAA,IAAI,KAAA;AACJ,IAAA,IAAI;AACF,MAAA,KAAA,GAAQ,IAAA,CAAK,MAAM,UAAU,CAAA;AAAA,IAC/B,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,+BAA+B,mCAAmC,CAAA;AAAA,IAC9E;AAEA,IAAA,OAAO,EAAE,SAAA,EAAW,KAAA,CAAM,SAAA,EAAW,KAAA,EAAM;AAAA,EAC7C;AACF;AAEA,SAAS,qBAAqB,MAAA,EAA0D;AACtF,EAAA,MAAM,SAAiC,EAAC;AACxC,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAAG;AACpC,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC5B,IAAA,IAAI,GAAA,KAAQ,IAAI,OAAO,IAAA;AACvB,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,EAAE,IAAA,EAAK;AACpC,IAAA,MAAM,QAAQ,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AACvC,IAAA,IAAI,CAAC,GAAA,IAAO,CAAC,KAAA,EAAO,OAAO,IAAA;AAC3B,IAAA,MAAA,CAAO,GAAG,CAAA,GAAI,KAAA;AAAA,EAChB;AACA,EAAA,MAAM,IAAI,MAAA,CAAO,CAAA;AACjB,EAAA,MAAM,KAAK,MAAA,CAAO,EAAA;AAClB,EAAA,IAAI,CAAC,CAAA,IAAK,CAAC,EAAA,EAAI,OAAO,IAAA;AACtB,EAAA,MAAM,SAAA,GAAY,OAAO,CAAC,CAAA;AAC1B,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,IAAK,CAAC,cAAA,CAAe,IAAA,CAAK,EAAE,CAAA,EAAG,OAAO,IAAA;AACpE,EAAA,OAAO,EAAE,WAAW,EAAA,EAAG;AACzB;;;ACvFA,IAAM,gBAAA,GAAmB,qBAAA;AACzB,IAAM,kBAAA,GAAqB,GAAA;AAC3B,IAAM,mBAAA,GAAsB,CAAA;AAC5B,IAAM,WAAA,GAAc,OAAA;AAqBb,IAAM,OAAN,MAAW;AAAA,EACA,OAAA;AAAA,EACA,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhB,OAAuB,QAAA,GAAW,QAAA;AAAA,EAClB,QAAA,GAAW,QAAA;AAAA,EAE3B,WAAA,CAAY,OAAA,GAAuB,EAAC,EAAG;AACrC,IAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW;AAAA,MAC1B,OAAA,EAAS,QAAQ,OAAA,IAAW,gBAAA;AAAA,MAC5B,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,SAAA,EAAW,QAAQ,SAAA,IAAa,kBAAA;AAAA,MAChC,UAAA,EAAY,QAAQ,UAAA,IAAc,mBAAA;AAAA,MAClC,SAAA,EAAW,aAAa,WAAW,CAAA,CAAA;AAAA,MACnC,OAAO,OAAA,CAAQ;AAAA,KAChB,CAAA;AACD,IAAA,IAAA,CAAK,OAAA,GAAU,IAAI,OAAA,CAAQ,IAAI,CAAA;AAC/B,IAAA,IAAA,CAAK,IAAA,GAAO,IAAI,IAAA,CAAK,IAAI,CAAA;AAAA,EAC3B;AACF","file":"index.cjs","sourcesContent":["/*\n Error hierarchy for the Garu SDK.\n \n Every error has a stable `code` string so agents and typed clients can switch on it\n * without parsing messages. Non-2xx API responses are mapped to the most specific\n * subclass of `GaruAPIError` by {@link mapApiError}.\n /\n\nexport type GaruErrorCode =\n \| 'authentication_error'\n \| 'permission_error'\n \| 'not_found'\n \| 'validation_error'\n \| 'rate_limited'\n \| 'server_error'\n \| 'api_error'\n \| 'connection_error'\n \| 'signature_verification_failed';\n\nexport class GaruError extends Error {\n public readonly code: GaruErrorCode;\n\n constructor(code: GaruErrorCode, message: string) {\n super(message);\n this.name = 'GaruError';\n this.code = code;\n }\n}\n\nexport class GaruConnectionError extends GaruError {\n public readonly connectionCause: unknown;\n constructor(message: string, connectionCause?: unknown) {\n super('connection_error', message);\n this.name = 'GaruConnectionError';\n this.connectionCause = connectionCause;\n }\n}\n\nexport class GaruSignatureVerificationError extends GaruError {\n constructor(message: string) {\n super('signature_verification_failed', message);\n this.name = 'GaruSignatureVerificationError';\n }\n}\n\nexport class GaruAPIError extends GaruError {\n public readonly status: number;\n public readonly requestId: string \| null;\n public readonly body: unknown;\n\n constructor(\n code: GaruErrorCode,\n message: string,\n status: number,\n requestId: string \| null,\n body: unknown\n ) {\n super(code, message);\n this.name = 'GaruAPIError';\n this.status = status;\n this.requestId = requestId;\n this.body = body;\n }\n}\n\nexport class GaruAuthenticationError extends GaruAPIError {\n constructor(message: string, status: number, requestId: string \| null, body: unknown) {\n super('authentication_error', message, status, requestId, body);\n this.name = 'GaruAuthenticationError';\n }\n}\n\nexport class GaruPermissionError extends GaruAPIError {\n constructor(message: string, status: number, requestId: string \| null, body: unknown) {\n super('permission_error', message, status, requestId, body);\n this.name = 'GaruPermissionError';\n }\n}\n\nexport class GaruNotFoundError extends GaruAPIError {\n constructor(message: string, status: number, requestId: string \| null, body: unknown) {\n super('not_found', message, status, requestId, body);\n this.name = 'GaruNotFoundError';\n }\n}\n\nexport class GaruValidationError extends GaruAPIError {\n constructor(message: string, status: number, requestId: string \| null, body: unknown) {\n super('validation_error', message, status, requestId, body);\n this.name = 'GaruValidationError';\n }\n}\n\nexport class GaruRateLimitError extends GaruAPIError {\n public readonly retryAfterSec: number \| null;\n constructor(\n message: string,\n status: number,\n requestId: string \| null,\n body: unknown,\n retryAfterSec: number \| null\n ) {\n super('rate_limited', message, status, requestId, body);\n this.name = 'GaruRateLimitError';\n this.retryAfterSec = retryAfterSec;\n }\n}\n\nexport class GaruServerError extends GaruAPIError {\n constructor(message: string, status: number, requestId: string \| null, body: unknown) {\n super('server_error', message, status, requestId, body);\n this.name = 'GaruServerError';\n }\n}\n\n/\n Map a non-2xx HTTP response to the most specific {@link GaruAPIError} subclass.\n /\nexport function mapApiError(\n status: number,\n body: unknown,\n requestId: string \| null,\n retryAfterSec: number \| null\n): GaruAPIError {\n const message = extractMessage(body) ?? `Garu API returned HTTP ${status}`;\n\n if (status === 401) return new GaruAuthenticationError(message, status, requestId, body);\n if (status === 403) return new GaruPermissionError(message, status, requestId, body);\n if (status === 404) return new GaruNotFoundError(message, status, requestId, body);\n if (status === 400 \|\| status === 422) {\n return new GaruValidationError(message, status, requestId, body);\n }\n if (status === 429) {\n return new GaruRateLimitError(message, status, requestId, body, retryAfterSec);\n }\n if (status >= 500) return new GaruServerError(message, status, requestId, body);\n return new GaruAPIError('api_error', message, status, requestId, body);\n}\n\nfunction extractMessage(body: unknown): string \| null {\n if (typeof body === 'string') return body;\n if (body && typeof body === 'object') {\n const m = (body as { message?: unknown }).message;\n if (typeof m === 'string') return m;\n if (Array.isArray(m) && m.every((x) => typeof x === 'string')) return m.join('; ');\n }\n return null;\n}\n","import createClient from 'openapi-fetch';\n\nimport { GaruConnectionError, mapApiError, type GaruAPIError } from './errors.js';\nimport type { paths } from './generated/schema.js';\n\nexport interface HttpClientConfig {\n baseUrl: string;\n apiKey?: string;\n timeoutMs: number;\n maxRetries: number;\n userAgent: string;\n /* Injectable for tests. Defaults to `globalThis.fetch`. /\n fetch?: typeof fetch;\n}\n\nconst RETRYABLE_STATUSES = new Set([408, 429, 500, 502, 503, 504]);\n\n/* Typed openapi-fetch client keyed to the backend's OpenAPI paths. /\nexport type GaruOpenapiClient = ReturnType<typeof createClient<paths>>;\n\n/* Arg type for `HttpClient.call` — a thunk that issues one openapi-fetch request. /\nexport type OpenapiCallResult<T> = Promise<{\n data?: T;\n error?: unknown;\n response: Response;\n}>;\n\n/\n HttpClient wraps the generated `openapi-fetch` client with:\n * - retries (exponential backoff, full jitter, honors `Retry-After`)\n * - typed error mapping (non-2xx → {@link GaruAPIError} subclass)\n * - connection error wrapping\n * - Authorization + User-Agent injection\n \n Resources call {@link call} with a thunk that returns an openapi-fetch\n * `{ data, error, response }` tuple; the wrapper either returns `data` or\n * throws the mapped error.\n /\nexport class HttpClient {\n public readonly client: GaruOpenapiClient;\n private readonly cfg: HttpClientConfig;\n\n constructor(cfg: HttpClientConfig) {\n this.cfg = cfg;\n const fetchImpl = cfg.fetch ?? globalThis.fetch;\n if (!fetchImpl) {\n throw new GaruConnectionError(\n 'No fetch implementation available. Node.js >= 18 is required.'\n );\n }\n const headers: Record<string, string> = {\n Accept: 'application/json',\n 'User-Agent': cfg.userAgent\n };\n if (cfg.apiKey) headers.Authorization = `Bearer ${cfg.apiKey}`;\n\n this.client = createClient<paths>({\n baseUrl: cfg.baseUrl.replace(/\\/+$/, ''),\n fetch: fetchImpl,\n headers\n });\n }\n\n /\n Issue one HTTP call against the typed client, with retries + error mapping.\n \n `fn` is invoked up to `maxRetries + 1` times. The timeout in `cfg.timeoutMs`\n * is enforced via `AbortController`.\n /\n async call<T>(fn: (signal: AbortSignal) => OpenapiCallResult<T>): Promise<T> {\n let lastError: GaruAPIError \| GaruConnectionError \| null = null;\n\n for (let attempt = 0; attempt <= this.cfg.maxRetries; attempt++) {\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), this.cfg.timeoutMs);\n\n try {\n const { data, error, response } = await fn(controller.signal);\n clearTimeout(timer);\n\n if (response.ok) {\n return data as T;\n }\n\n const requestId = response.headers.get('x-request-id');\n const retryAfterSec = parseRetryAfter(response.headers.get('retry-after'));\n const apiError = mapApiError(response.status, error ?? null, requestId, retryAfterSec);\n lastError = apiError;\n\n if (!RETRYABLE_STATUSES.has(response.status) \|\| attempt === this.cfg.maxRetries) {\n throw apiError;\n }\n\n await sleep(backoffDelay(attempt, retryAfterSec));\n continue;\n } catch (err) {\n clearTimeout(timer);\n\n if (isGaruApiError(err)) throw err;\n\n const connErr =\n err instanceof Error && err.name === 'AbortError'\n ? new GaruConnectionError(`Request timed out after ${this.cfg.timeoutMs}ms`, err)\n : new GaruConnectionError(err instanceof Error ? err.message : 'Network error', err);\n lastError = connErr;\n\n if (attempt === this.cfg.maxRetries) throw connErr;\n await sleep(backoffDelay(attempt, null));\n continue;\n }\n }\n\n // Unreachable — the loop always throws or returns on the final attempt.\n throw lastError ?? new GaruConnectionError('Request failed with no error captured');\n }\n}\n\nfunction isGaruApiError(err: unknown): boolean {\n return err instanceof Error && err.name.startsWith('Garu') && err.name.endsWith('Error');\n}\n\nfunction parseRetryAfter(value: string \| null): number \| null {\n if (!value) return null;\n const n = Number(value);\n return Number.isFinite(n) && n >= 0 ? n : null;\n}\n\n/\n Exponential backoff with full jitter. If the server returned `Retry-After`,\n * we honor it (with a small jitter).\n /\nfunction backoffDelay(attempt: number, retryAfterSec: number \| null): number {\n if (retryAfterSec !== null) {\n return retryAfterSec 1000 + Math.random() * 250;\n }\n const base = 500 * 2 ** attempt;\n const cap = 8000;\n return Math.min(cap, base) * Math.random();\n}\n\nfunction sleep(ms: number): Promise<void> {\n return new Promise((resolve) => setTimeout(resolve, ms));\n}\n","import { randomUUID } from 'node:crypto';\n\n/*\n Generate a UUIDv4 suitable for use as an `X-Idempotency-Key` header value.\n \n @example\n * const key = generateIdempotencyKey();\n * // '3b241101-e2bb-4255-8caf-4136c566a962'\n /\nexport function generateIdempotencyKey(): string {\n return randomUUID();\n}\n","/\n Public types for the Garu SDK.\n \n The wire-level types (`WireCreateTransactionRequest`, `WireMetaResponse`, ...)\n * are generated from the backend's OpenAPI spec and live in\n * `src/generated/schema.d.ts`. The friendly types in this file\n * (`CreateChargeParams`, `Customer`, `Charge`, ...) are hand-curated for\n * ergonomics — they rename `transactions` to `charges`, collapse wire enums\n * into readable unions, and mark only truly required fields as required.\n * The resource layer maps friendly → wire at the edge.\n /\n\nimport type { components } from './generated/schema.js';\n\nexport type WireCreateTransactionRequest = components['schemas']['CreateTransactionRequest'];\nexport type WireCustomerDto = components['schemas']['CustomerDto'];\nexport type WireCardInfoDto = components['schemas']['CardInfoDto'];\nexport type WireMetaResponse = components['schemas']['MetaResponse'];\n\nexport type PaymentMethod = 'pix' \| 'credit_card' \| 'boleto';\n\n/* Payment-method identifier as sent to the backend over the wire. /\nexport type WirePaymentMethodId = 'pix' \| 'creditcard' \| 'boleto';\n\nexport type ChargeStatus =\n \| 'pending'\n \| 'authorized'\n \| 'paid'\n \| 'failed'\n \| 'refunded'\n \| 'cancelled'\n \| 'expired';\n\nexport interface Customer {\n /* Full legal name. 3–255 chars. /\n name: string;\n email: string;\n /* CPF (11 digits) or CNPJ (14 digits), digits only. /\n document: string;\n /* 10 or 11 digits with area code, no formatting. /\n phone: string;\n /* 8 digits, no hyphen. Optional. /\n zipCode?: string;\n street?: string;\n number?: string;\n complement?: string;\n neighborhood?: string;\n city?: string;\n /* 2-letter uppercase state code, e.g. `SP`. /\n state?: string;\n}\n\nexport interface CardInfo {\n /* 13–19 digits, no spaces or hyphens. /\n cardNumber: string;\n /* 3 or 4 digits. /\n cvv: string;\n /* `YYYY-MM`. /\n expirationDate: string;\n /* As printed on the card. /\n holderName: string;\n /* 1–12. /\n installments: number;\n}\n\nexport interface CreateChargeParams {\n /* Customer buying the product. /\n customer: Customer;\n /* UUID of the product being charged. /\n productId: string;\n /* Payment method. /\n paymentMethod: PaymentMethod;\n /* Required when `paymentMethod` is `credit_card`. /\n cardInfo?: CardInfo;\n /* Free-form metadata attached to the charge. /\n additionalInfo?: string;\n /* Original checkout link, if any. /\n link?: string \| null;\n /* Associated affiliate ID, if any. /\n affiliateId?: number \| null;\n /* Subscription price ID (`price_`), for subscription charges only. /\n priceId?: string \| null;\n /** Optional pre-created checkout session token. /\n checkoutSessionToken?: string;\n /\n Idempotency key. If omitted, the SDK generates a UUIDv4.\n * Keys are valid for 24h on the backend.\n /\n idempotencyKey?: string;\n}\n\nexport interface Charge {\n id: number;\n status: ChargeStatus;\n amount: number;\n paymentMethodId: WirePaymentMethodId;\n /* ISO-8601. /\n date: string;\n /* ISO-8601. /\n deadline?: string;\n /* Product this charge belongs to. /\n product?: { id: number; uuid?: string; name?: string };\n [key: string]: unknown;\n}\n\nexport interface RefundChargeParams {\n /* Partial refund in centavos. Omit for full refund. /\n amount?: number;\n /* Free-form reason stored on the refund. /\n reason?: string;\n idempotencyKey?: string;\n}\n\nexport interface MetaFeatures {\n subscriptions: boolean;\n checkout_sessions: boolean;\n idempotency_keys: boolean;\n test_mode: boolean;\n webhooks: boolean;\n}\n\nexport interface MetaResponse {\n name: string;\n version: string;\n environment: 'production' \| 'staging' \| 'development' \| string;\n api_version: string;\n payment_methods: string[];\n currencies: string[];\n billing_intervals: string[];\n webhook_events: string[];\n features: MetaFeatures;\n docs_url: string;\n dashboard_url: string;\n support_email: string;\n}\n\n/* Map the SDK's friendly `PaymentMethod` to the backend's wire value. /\nexport function toWirePaymentMethod(pm: PaymentMethod): WirePaymentMethodId {\n return pm === 'credit_card' ? 'creditcard' : pm;\n}\n","import type { HttpClient } from '../http.js';\nimport type { components } from '../generated/schema.js';\nimport { generateIdempotencyKey } from '../idempotency.js';\nimport {\n toWirePaymentMethod,\n type Charge,\n type CreateChargeParams,\n type RefundChargeParams\n} from '../types.js';\n\ntype CreateTransactionBody = components['schemas']['CreateTransactionRequest'];\n\n/\n Charges — the core of the Garu API.\n \n A charge represents a single payment attempt against a product. The SDK\n * surfaces charges under `garu.charges` even though the backend route is\n * `/api/transactions` — this matches Stripe convention and is the name every\n * other Garu surface (MCP, CLI, docs) uses.\n /\nexport class Charges {\n constructor(private readonly http: HttpClient) {}\n\n /\n Create a charge (PIX, credit card, or boleto).\n \n Automatically attaches an `X-Idempotency-Key` header — if you don't pass\n * `idempotencyKey`, the SDK generates a UUIDv4. Safe to retry: the backend\n * caches the first response for 24h.\n \n @example\n * // PIX charge\n * const charge = await garu.charges.create({\n * productId: 'b3f2c1e8-6e4a-4b9f-9d1c-2a1f6c3d4e5f',\n * paymentMethod: 'pix',\n * customer: {\n * name: 'Maria Silva',\n * email: 'maria@exemplo.com.br',\n * document: '12345678909',\n * phone: '11987654321'\n * }\n * });\n * console.log(charge.id, charge.status);\n \n @example\n * // Credit card charge, 3 installments\n * const charge = await garu.charges.create({\n * productId: 'b3f2c1e8-6e4a-4b9f-9d1c-2a1f6c3d4e5f',\n * paymentMethod: 'credit_card',\n * customer: { name: 'Maria Silva', email: 'maria@exemplo.com.br', document: '12345678909', phone: '11987654321' },\n * cardInfo: {\n * cardNumber: '4111111111111111',\n * cvv: '123',\n * expirationDate: '2030-12',\n * holderName: 'MARIA SILVA',\n * installments: 3\n * }\n * });\n /\n async create(params: CreateChargeParams): Promise<Charge> {\n const idempotencyKey = params.idempotencyKey ?? generateIdempotencyKey();\n const body = this.buildCreateBody(params);\n\n return this.http.call<Charge>(\n (signal) =>\n this.http.client.POST('/api/transactions', {\n body,\n headers: { 'X-Idempotency-Key': idempotencyKey },\n signal\n }) as Promise<{ data?: Charge; error?: unknown; response: Response }>\n );\n }\n\n /\n Fetch a single charge by numeric ID.\n \n @example\n * const charge = await garu.charges.get(4472);\n * if (charge.status === 'paid') { ... }\n /\n async get(id: number): Promise<Charge> {\n return this.http.call<Charge>(\n (signal) =>\n this.http.client.GET('/api/transactions/{id}', {\n params: { path: { id } },\n signal\n }) as Promise<{ data?: Charge; error?: unknown; response: Response }>\n );\n }\n\n /\n Refund a charge — fully, or partially by passing `amount` in centavos.\n \n @example\n * // Full refund\n * await garu.charges.refund(4472);\n \n @example\n * // Partial refund of R$ 10,00\n * await garu.charges.refund(4472, { amount: 1000, reason: 'customer_request' });\n /\n async refund(id: number, params: RefundChargeParams = {}): Promise<Charge> {\n const idempotencyKey = params.idempotencyKey ?? generateIdempotencyKey();\n const body: Record<string, unknown> = {};\n if (params.amount !== undefined) body.amount = params.amount;\n if (params.reason !== undefined) body.reason = params.reason;\n\n return this.http.call<Charge>(\n (signal) =>\n this.http.client.POST('/api/transactions/{id}/refund', {\n params: { path: { id } },\n body: body as never,\n headers: { 'X-Idempotency-Key': idempotencyKey },\n signal\n }) as Promise<{ data?: Charge; error?: unknown; response: Response }>\n );\n }\n\n private buildCreateBody(params: CreateChargeParams): CreateTransactionBody {\n const body: Record<string, unknown> = {\n customer: params.customer,\n productId: params.productId,\n paymentMethodId: toWirePaymentMethod(params.paymentMethod),\n link: params.link ?? null,\n affiliateId: params.affiliateId ?? null\n };\n if (params.additionalInfo !== undefined) body.additionalInfo = params.additionalInfo;\n if (params.priceId !== undefined) body.priceId = params.priceId;\n if (params.checkoutSessionToken !== undefined) {\n body.checkoutSessionToken = params.checkoutSessionToken;\n }\n if (params.cardInfo) body.CardInfo = params.cardInfo;\n return body as unknown as CreateTransactionBody;\n }\n}\n","import type { HttpClient } from '../http.js';\nimport type { MetaResponse } from '../types.js';\n\n/\n Meta — capability introspection.\n \n Unauthenticated. Used by `garu doctor`, MCP tool `doctor`, and by SDK\n * consumers that want to know which payment methods and webhook events are\n * currently supported.\n /\nexport class Meta {\n constructor(private readonly http: HttpClient) {}\n\n /\n Fetch the API's current capability payload.\n \n @example\n * const meta = await garu.meta.get();\n * console.log(meta.version, meta.payment_methods);\n * if (meta.features.subscriptions) { ... }\n /\n async get(): Promise<MetaResponse> {\n return this.http.call<MetaResponse>(\n (signal) =>\n this.http.client.GET('/api/meta', { signal }) as Promise<{\n data?: MetaResponse;\n error?: unknown;\n response: Response;\n }>\n );\n }\n}\n","import { createHmac, timingSafeEqual } from 'node:crypto';\n\nimport { GaruSignatureVerificationError } from './errors.js';\n\nexport interface VerifyWebhookParams {\n /* Raw request body as received — do NOT re-serialize parsed JSON. /\n payload: string \| Buffer;\n /* Value of the `X-Garu-Signature` header. Format: `t=<ts>,v1=<hex>`. /\n signature: string;\n /* The webhook endpoint's signing secret. /\n secret: string;\n /* Reject signatures older than this many seconds. Default: 300 (5 min). /\n toleranceSec?: number;\n /* Injectable for tests. Defaults to `Date.now()`. /\n now?: () => number;\n}\n\nexport interface VerifiedWebhook {\n /* Timestamp from the signature header, in seconds since epoch. /\n timestamp: number;\n /* Parsed JSON body. Throws {@link GaruSignatureVerificationError} if invalid JSON. /\n event: unknown;\n}\n\n/\n Webhook helpers.\n \n Garu signs outgoing webhooks with HMAC-SHA256 over `${timestamp}.${payload}`\n * and delivers the signature in the `X-Garu-Signature` header as `t=<ts>,v1=<hex>`.\n * This matches the format in the backend's `webhook-delivery.service.ts`.\n \n @example\n * // Express example\n * app.post('/webhooks/garu', express.raw({ type: 'application/json' }), (req, res) => {\n * try {\n * const { event } = Garu.webhooks.verify({\n * payload: req.body,\n * signature: req.header('x-garu-signature') ?? '',\n * secret: process.env.GARU_WEBHOOK_SECRET!\n * });\n * // handle event\n * res.sendStatus(200);\n * } catch (err) {\n * res.sendStatus(400);\n * }\n * });\n /\nexport const webhooks = {\n verify(params: VerifyWebhookParams): VerifiedWebhook {\n const { signature, secret, payload } = params;\n const toleranceSec = params.toleranceSec ?? 300;\n const now = params.now ?? Date.now;\n\n if (!signature \|\| typeof signature !== 'string') {\n throw new GaruSignatureVerificationError('Missing or malformed X-Garu-Signature header');\n }\n\n const parts = parseSignatureHeader(signature);\n if (parts === null) {\n throw new GaruSignatureVerificationError(\n 'X-Garu-Signature header does not match expected format t=<ts>,v1=<hex>'\n );\n }\n\n const payloadStr = typeof payload === 'string' ? payload : payload.toString('utf8');\n const signedPayload = `${parts.timestamp}.${payloadStr}`;\n const expected = createHmac('sha256', secret).update(signedPayload).digest('hex');\n\n const expectedBuf = Buffer.from(expected, 'hex');\n const providedBuf = Buffer.from(parts.v1, 'hex');\n if (expectedBuf.length !== providedBuf.length \|\| !timingSafeEqual(expectedBuf, providedBuf)) {\n throw new GaruSignatureVerificationError('Signature does not match computed HMAC');\n }\n\n const nowSec = Math.floor(now() / 1000);\n if (Math.abs(nowSec - parts.timestamp) > toleranceSec) {\n throw new GaruSignatureVerificationError(\n `Signature timestamp outside tolerance window (${toleranceSec}s)`\n );\n }\n\n let event: unknown;\n try {\n event = JSON.parse(payloadStr);\n } catch {\n throw new GaruSignatureVerificationError('Webhook payload is not valid JSON');\n }\n\n return { timestamp: parts.timestamp, event };\n }\n};\n\nfunction parseSignatureHeader(header: string): { timestamp: number; v1: string } \| null {\n const fields: Record<string, string> = {};\n for (const part of header.split(',')) {\n const idx = part.indexOf('=');\n if (idx === -1) return null;\n const key = part.slice(0, idx).trim();\n const value = part.slice(idx + 1).trim();\n if (!key \|\| !value) return null;\n fields[key] = value;\n }\n const t = fields.t;\n const v1 = fields.v1;\n if (!t \|\| !v1) return null;\n const timestamp = Number(t);\n if (!Number.isFinite(timestamp) \|\| !/^[a-f0-9]+$/i.test(v1)) return null;\n return { timestamp, v1 };\n}\n","import { HttpClient } from './http.js';\nimport { Charges } from './resources/charges.js';\nimport { Meta } from './resources/meta.js';\nimport { webhooks } from './webhooks.js';\n\nexport interface GaruOptions {\n /\n Your Garu API key. `sk_live_…` for production, `sk_test_…` for test mode.\n * Optional — public endpoints (`meta.get`, public charge creation) work without one.\n /\n apiKey?: string;\n /* Override the API base URL. Default: `https://garu.com.br/api`. /\n baseUrl?: string;\n /* Per-request timeout in ms. Default: 30000. /\n timeoutMs?: number;\n /* Max retries on retryable errors (connection, 408, 429, 5xx). Default: 2. /\n maxRetries?: number;\n /* Injectable for tests. Defaults to `globalThis.fetch`. /\n fetch?: typeof fetch;\n}\n\nconst DEFAULT_BASE_URL = 'https://garu.com.br';\nconst DEFAULT_TIMEOUT_MS = 30_000;\nconst DEFAULT_MAX_RETRIES = 2;\nconst SDK_VERSION = '0.1.0';\n\n/\n The Garu SDK client.\n \n @example\n * import { Garu } from '@garuhq/node';\n \n const garu = new Garu({ apiKey: process.env.GARU_API_KEY });\n \n const charge = await garu.charges.create({\n * productId: 'b3f2c1e8-6e4a-4b9f-9d1c-2a1f6c3d4e5f',\n * paymentMethod: 'pix',\n * customer: {\n * name: 'Maria Silva',\n * email: 'maria@exemplo.com.br',\n * document: '12345678909',\n * phone: '11987654321'\n * }\n * });\n /\nexport class Garu {\n public readonly charges: Charges;\n public readonly meta: Meta;\n\n /\n Webhook helpers. Available both as an instance member and as a static —\n * `Garu.webhooks.verify(...)` works without constructing a client.\n */\n public static readonly webhooks = webhooks;\n public readonly webhooks = webhooks;\n\n constructor(options: GaruOptions = {}) {\n const http = new HttpClient({\n baseUrl: options.baseUrl ?? DEFAULT_BASE_URL,\n apiKey: options.apiKey,\n timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,\n maxRetries: options.maxRetries ?? DEFAULT_MAX_RETRIES,\n userAgent: `garu-node/${SDK_VERSION}`,\n fetch: options.fetch\n });\n this.charges = new Charges(http);\n this.meta = new Meta(http);\n }\n}\n"]}

package/dist/index.js CHANGED Viewed

@@ -78,31 +78,24 @@ var GaruServerError = class extends GaruAPIError {
 };
 function mapApiError(status, body, requestId, retryAfterSec) {
   const message = extractMessage(body) ?? `Garu API returned HTTP ${status}`;
-  if (status === 401)
-    return new GaruAuthenticationError(message, status, requestId, body);
-  if (status === 403)
-    return new GaruPermissionError(message, status, requestId, body);
-  if (status === 404)
-    return new GaruNotFoundError(message, status, requestId, body);
+  if (status === 401) return new GaruAuthenticationError(message, status, requestId, body);
+  if (status === 403) return new GaruPermissionError(message, status, requestId, body);
+  if (status === 404) return new GaruNotFoundError(message, status, requestId, body);
   if (status === 400 || status === 422) {
     return new GaruValidationError(message, status, requestId, body);
   }
   if (status === 429) {
     return new GaruRateLimitError(message, status, requestId, body, retryAfterSec);
   }
-  if (status >= 500)
-    return new GaruServerError(message, status, requestId, body);
+  if (status >= 500) return new GaruServerError(message, status, requestId, body);
   return new GaruAPIError("api_error", message, status, requestId, body);
 }
 function extractMessage(body) {
-  if (typeof body === "string")
-    return body;
+  if (typeof body === "string") return body;
   if (body && typeof body === "object") {
     const m = body.message;
-    if (typeof m === "string")
-      return m;
-    if (Array.isArray(m) && m.every((x) => typeof x === "string"))
-      return m.join("; ");
+    if (typeof m === "string") return m;
+    if (Array.isArray(m) && m.every((x) => typeof x === "string")) return m.join("; ");
   }
   return null;
 }
@@ -124,8 +117,7 @@ var HttpClient = class {
       Accept: "application/json",
       "User-Agent": cfg.userAgent
     };
-    if (cfg.apiKey)
-      headers.Authorization = `Bearer ${cfg.apiKey}`;
+    if (cfg.apiKey) headers.Authorization = `Bearer ${cfg.apiKey}`;
     this.client = createClient({
       baseUrl: cfg.baseUrl.replace(/\/+$/, ""),
       fetch: fetchImpl,
@@ -160,12 +152,10 @@ var HttpClient = class {
         continue;
       } catch (err) {
         clearTimeout(timer);
-        if (isGaruApiError(err))
-          throw err;
+        if (isGaruApiError(err)) throw err;
         const connErr = err instanceof Error && err.name === "AbortError" ? new GaruConnectionError(`Request timed out after ${this.cfg.timeoutMs}ms`, err) : new GaruConnectionError(err instanceof Error ? err.message : "Network error", err);
         lastError = connErr;
-        if (attempt === this.cfg.maxRetries)
-          throw connErr;
+        if (attempt === this.cfg.maxRetries) throw connErr;
         await sleep(backoffDelay(attempt, null));
         continue;
       }
@@ -177,8 +167,7 @@ function isGaruApiError(err) {
   return err instanceof Error && err.name.startsWith("Garu") && err.name.endsWith("Error");
 }
 function parseRetryAfter(value) {
-  if (!value)
-    return null;
+  if (!value) return null;
   const n = Number(value);
   return Number.isFinite(n) && n >= 0 ? n : null;
 }
@@ -207,6 +196,7 @@ var Charges = class {
   constructor(http) {
     this.http = http;
   }
+  http;
   /**
    * Create a charge (PIX, credit card, or boleto).
    *
@@ -283,10 +273,8 @@ var Charges = class {
   async refund(id, params = {}) {
     const idempotencyKey = params.idempotencyKey ?? generateIdempotencyKey();
     const body = {};
-    if (params.amount !== void 0)
-      body.amount = params.amount;
-    if (params.reason !== void 0)
-      body.reason = params.reason;
+    if (params.amount !== void 0) body.amount = params.amount;
+    if (params.reason !== void 0) body.reason = params.reason;
     return this.http.call(
       (signal) => this.http.client.POST("/api/transactions/{id}/refund", {
         params: { path: { id } },
@@ -304,15 +292,12 @@ var Charges = class {
       link: params.link ?? null,
       affiliateId: params.affiliateId ?? null
     };
-    if (params.additionalInfo !== void 0)
-      body.additionalInfo = params.additionalInfo;
-    if (params.priceId !== void 0)
-      body.priceId = params.priceId;
+    if (params.additionalInfo !== void 0) body.additionalInfo = params.additionalInfo;
+    if (params.priceId !== void 0) body.priceId = params.priceId;
     if (params.checkoutSessionToken !== void 0) {
       body.checkoutSessionToken = params.checkoutSessionToken;
     }
-    if (params.cardInfo)
-      body.CardInfo = params.cardInfo;
+    if (params.cardInfo) body.CardInfo = params.cardInfo;
     return body;
   }
 };
@@ -322,6 +307,7 @@ var Meta = class {
   constructor(http) {
     this.http = http;
   }
+  http;
   /**
    * Fetch the API's current capability payload.
    *
@@ -377,21 +363,17 @@ function parseSignatureHeader(header) {
   const fields = {};
   for (const part of header.split(",")) {
     const idx = part.indexOf("=");
-    if (idx === -1)
-      return null;
+    if (idx === -1) return null;
     const key = part.slice(0, idx).trim();
     const value = part.slice(idx + 1).trim();
-    if (!key || !value)
-      return null;
+    if (!key || !value) return null;
     fields[key] = value;
   }
   const t = fields.t;
   const v1 = fields.v1;
-  if (!t || !v1)
-    return null;
+  if (!t || !v1) return null;
   const timestamp = Number(t);
-  if (!Number.isFinite(timestamp) || !/^[a-f0-9]+$/i.test(v1))
-    return null;
+  if (!Number.isFinite(timestamp) || !/^[a-f0-9]+$/i.test(v1)) return null;
   return { timestamp, v1 };
 }
@@ -424,5 +406,5 @@ var Garu = class {
 };
 export { Garu, GaruAPIError, GaruAuthenticationError, GaruConnectionError, GaruError, GaruNotFoundError, GaruPermissionError, GaruRateLimitError, GaruServerError, GaruSignatureVerificationError, GaruValidationError, webhooks };
-//# sourceMappingURL=out.js.map
+//# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/http.ts","../src/errors.ts","../src/idempotency.ts","../src/types.ts","../src/resources/charges.ts","../src/resources/meta.ts","../src/webhooks.ts","../src/client.ts"],"names":[],"mappings":";AAAA,OAAO,kBAAkB;;;ACmBlB,IAAM,YAAN,cAAwB,MAAM;AAAA,EACnB;AAAA,EAEhB,YAAY,MAAqB,SAAiB;AAChD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,UAAU;AAAA,EACjC;AAAA,EAChB,YAAY,SAAiB,iBAA2B;AACtD,UAAM,oBAAoB,OAAO;AACjC,SAAK,OAAO;AACZ,SAAK,kBAAkB;AAAA,EACzB;AACF;AAEO,IAAM,iCAAN,cAA6C,UAAU;AAAA,EAC5D,YAAY,SAAiB;AAC3B,UAAM,iCAAiC,OAAO;AAC9C,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,eAAN,cAA2B,UAAU;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EAEhB,YACE,MACA,SACA,QACA,WACA,MACA;AACA,UAAM,MAAM,OAAO;AACnB,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,YAAY;AACjB,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,0BAAN,cAAsC,aAAa;AAAA,EACxD,YAAY,SAAiB,QAAgB,WAA0B,MAAe;AACpF,UAAM,wBAAwB,SAAS,QAAQ,WAAW,IAAI;AAC9D,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,aAAa;AAAA,EACpD,YAAY,SAAiB,QAAgB,WAA0B,MAAe;AACpF,UAAM,oBAAoB,SAAS,QAAQ,WAAW,IAAI;AAC1D,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,oBAAN,cAAgC,aAAa;AAAA,EAClD,YAAY,SAAiB,QAAgB,WAA0B,MAAe;AACpF,UAAM,aAAa,SAAS,QAAQ,WAAW,IAAI;AACnD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,aAAa;AAAA,EACpD,YAAY,SAAiB,QAAgB,WAA0B,MAAe;AACpF,UAAM,oBAAoB,SAAS,QAAQ,WAAW,IAAI;AAC1D,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,cAAiC,aAAa;AAAA,EACnC;AAAA,EAChB,YACE,SACA,QACA,WACA,MACA,eACA;AACA,UAAM,gBAAgB,SAAS,QAAQ,WAAW,IAAI;AACtD,SAAK,OAAO;AACZ,SAAK,gBAAgB;AAAA,EACvB;AACF;AAEO,IAAM,kBAAN,cAA8B,aAAa;AAAA,EAChD,YAAY,SAAiB,QAAgB,WAA0B,MAAe;AACpF,UAAM,gBAAgB,SAAS,QAAQ,WAAW,IAAI;AACtD,SAAK,OAAO;AAAA,EACd;AACF;AAKO,SAAS,YACd,QACA,MACA,WACA,eACc;AACd,QAAM,UAAU,eAAe,IAAI,KAAK,0BAA0B,MAAM;AAExE,MAAI,WAAW;AAAK,WAAO,IAAI,wBAAwB,SAAS,QAAQ,WAAW,IAAI;AACvF,MAAI,WAAW;AAAK,WAAO,IAAI,oBAAoB,SAAS,QAAQ,WAAW,IAAI;AACnF,MAAI,WAAW;AAAK,WAAO,IAAI,kBAAkB,SAAS,QAAQ,WAAW,IAAI;AACjF,MAAI,WAAW,OAAO,WAAW,KAAK;AACpC,WAAO,IAAI,oBAAoB,SAAS,QAAQ,WAAW,IAAI;AAAA,EACjE;AACA,MAAI,WAAW,KAAK;AAClB,WAAO,IAAI,mBAAmB,SAAS,QAAQ,WAAW,MAAM,aAAa;AAAA,EAC/E;AACA,MAAI,UAAU;AAAK,WAAO,IAAI,gBAAgB,SAAS,QAAQ,WAAW,IAAI;AAC9E,SAAO,IAAI,aAAa,aAAa,SAAS,QAAQ,WAAW,IAAI;AACvE;AAEA,SAAS,eAAe,MAA8B;AACpD,MAAI,OAAO,SAAS;AAAU,WAAO;AACrC,MAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,UAAM,IAAK,KAA+B;AAC1C,QAAI,OAAO,MAAM;AAAU,aAAO;AAClC,QAAI,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,OAAO,MAAM,QAAQ;AAAG,aAAO,EAAE,KAAK,IAAI;AAAA,EACnF;AACA,SAAO;AACT;;;ADpIA,IAAM,qBAAqB,oBAAI,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AAuB1D,IAAM,aAAN,MAAiB;AAAA,EACN;AAAA,EACC;AAAA,EAEjB,YAAY,KAAuB;AACjC,SAAK,MAAM;AACX,UAAM,YAAY,IAAI,SAAS,WAAW;AAC1C,QAAI,CAAC,WAAW;AACd,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAAkC;AAAA,MACtC,QAAQ;AAAA,MACR,cAAc,IAAI;AAAA,IACpB;AACA,QAAI,IAAI;AAAQ,cAAQ,gBAAgB,UAAU,IAAI,MAAM;AAE5D,SAAK,SAAS,aAAoB;AAAA,MAChC,SAAS,IAAI,QAAQ,QAAQ,QAAQ,EAAE;AAAA,MACvC,OAAO;AAAA,MACP;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAQ,IAA+D;AAC3E,QAAI,YAAuD;AAE3D,aAAS,UAAU,GAAG,WAAW,KAAK,IAAI,YAAY,WAAW;AAC/D,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,IAAI,SAAS;AAErE,UAAI;AACF,cAAM,EAAE,MAAM,OAAO,SAAS,IAAI,MAAM,GAAG,WAAW,MAAM;AAC5D,qBAAa,KAAK;AAElB,YAAI,SAAS,IAAI;AACf,iBAAO;AAAA,QACT;AAEA,cAAM,YAAY,SAAS,QAAQ,IAAI,cAAc;AACrD,cAAM,gBAAgB,gBAAgB,SAAS,QAAQ,IAAI,aAAa,CAAC;AACzE,cAAM,WAAW,YAAY,SAAS,QAAQ,SAAS,MAAM,WAAW,aAAa;AACrF,oBAAY;AAEZ,YAAI,CAAC,mBAAmB,IAAI,SAAS,MAAM,KAAK,YAAY,KAAK,IAAI,YAAY;AAC/E,gBAAM;AAAA,QACR;AAEA,cAAM,MAAM,aAAa,SAAS,aAAa,CAAC;AAChD;AAAA,MACF,SAAS,KAAK;AACZ,qBAAa,KAAK;AAElB,YAAI,eAAe,GAAG;AAAG,gBAAM;AAE/B,cAAM,UACJ,eAAe,SAAS,IAAI,SAAS,eACjC,IAAI,oBAAoB,2BAA2B,KAAK,IAAI,SAAS,MAAM,GAAG,IAC9E,IAAI,oBAAoB,eAAe,QAAQ,IAAI,UAAU,iBAAiB,GAAG;AACvF,oBAAY;AAEZ,YAAI,YAAY,KAAK,IAAI;AAAY,gBAAM;AAC3C,cAAM,MAAM,aAAa,SAAS,IAAI,CAAC;AACvC;AAAA,MACF;AAAA,IACF;AAGA,UAAM,aAAa,IAAI,oBAAoB,uCAAuC;AAAA,EACpF;AACF;AAEA,SAAS,eAAe,KAAuB;AAC7C,SAAO,eAAe,SAAS,IAAI,KAAK,WAAW,MAAM,KAAK,IAAI,KAAK,SAAS,OAAO;AACzF;AAEA,SAAS,gBAAgB,OAAqC;AAC5D,MAAI,CAAC;AAAO,WAAO;AACnB,QAAM,IAAI,OAAO,KAAK;AACtB,SAAO,OAAO,SAAS,CAAC,KAAK,KAAK,IAAI,IAAI;AAC5C;AAMA,SAAS,aAAa,SAAiB,eAAsC;AAC3E,MAAI,kBAAkB,MAAM;AAC1B,WAAO,gBAAgB,MAAO,KAAK,OAAO,IAAI;AAAA,EAChD;AACA,QAAM,OAAO,MAAM,KAAK;AACxB,QAAM,MAAM;AACZ,SAAO,KAAK,IAAI,KAAK,IAAI,IAAI,KAAK,OAAO;AAC3C;AAEA,SAAS,MAAM,IAA2B;AACxC,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AACzD;;;AE9IA,SAAS,kBAAkB;AASpB,SAAS,yBAAiC;AAC/C,SAAO,WAAW;AACpB;;;AC8HO,SAAS,oBAAoB,IAAwC;AAC1E,SAAO,OAAO,gBAAgB,eAAe;AAC/C;;;ACvHO,IAAM,UAAN,MAAc;AAAA,EACnB,YAA6B,MAAkB;AAAlB;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsChD,MAAM,OAAO,QAA6C;AACxD,UAAM,iBAAiB,OAAO,kBAAkB,uBAAuB;AACvE,UAAM,OAAO,KAAK,gBAAgB,MAAM;AAExC,WAAO,KAAK,KAAK;AAAA,MACf,CAAC,WACC,KAAK,KAAK,OAAO,KAAK,qBAAqB;AAAA,QACzC;AAAA,QACA,SAAS,EAAE,qBAAqB,eAAe;AAAA,QAC/C;AAAA,MACF,CAAC;AAAA,IACL;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,IAAI,IAA6B;AACrC,WAAO,KAAK,KAAK;AAAA,MACf,CAAC,WACC,KAAK,KAAK,OAAO,IAAI,0BAA0B;AAAA,QAC7C,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE;AAAA,QACvB;AAAA,MACF,CAAC;AAAA,IACL;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,OAAO,IAAY,SAA6B,CAAC,GAAoB;AACzE,UAAM,iBAAiB,OAAO,kBAAkB,uBAAuB;AACvE,UAAM,OAAgC,CAAC;AACvC,QAAI,OAAO,WAAW;AAAW,WAAK,SAAS,OAAO;AACtD,QAAI,OAAO,WAAW;AAAW,WAAK,SAAS,OAAO;AAEtD,WAAO,KAAK,KAAK;AAAA,MACf,CAAC,WACC,KAAK,KAAK,OAAO,KAAK,iCAAiC;AAAA,QACrD,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE;AAAA,QACvB;AAAA,QACA,SAAS,EAAE,qBAAqB,eAAe;AAAA,QAC/C;AAAA,MACF,CAAC;AAAA,IACL;AAAA,EACF;AAAA,EAEQ,gBAAgB,QAAmD;AACzE,UAAM,OAAgC;AAAA,MACpC,UAAU,OAAO;AAAA,MACjB,WAAW,OAAO;AAAA,MAClB,iBAAiB,oBAAoB,OAAO,aAAa;AAAA,MACzD,MAAM,OAAO,QAAQ;AAAA,MACrB,aAAa,OAAO,eAAe;AAAA,IACrC;AACA,QAAI,OAAO,mBAAmB;AAAW,WAAK,iBAAiB,OAAO;AACtE,QAAI,OAAO,YAAY;AAAW,WAAK,UAAU,OAAO;AACxD,QAAI,OAAO,yBAAyB,QAAW;AAC7C,WAAK,uBAAuB,OAAO;AAAA,IACrC;AACA,QAAI,OAAO;AAAU,WAAK,WAAW,OAAO;AAC5C,WAAO;AAAA,EACT;AACF;;;AC5HO,IAAM,OAAN,MAAW;AAAA,EAChB,YAA6B,MAAkB;AAAlB;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUhD,MAAM,MAA6B;AACjC,WAAO,KAAK,KAAK;AAAA,MACf,CAAC,WACC,KAAK,KAAK,OAAO,IAAI,aAAa,EAAE,OAAO,CAAC;AAAA,IAKhD;AAAA,EACF;AACF;;;AC/BA,SAAS,YAAY,uBAAuB;AA+CrC,IAAM,WAAW;AAAA,EACtB,OAAO,QAA8C;AACnD,UAAM,EAAE,WAAW,QAAQ,QAAQ,IAAI;AACvC,UAAM,eAAe,OAAO,gBAAgB;AAC5C,UAAM,MAAM,OAAO,OAAO,KAAK;AAE/B,QAAI,CAAC,aAAa,OAAO,cAAc,UAAU;AAC/C,YAAM,IAAI,+BAA+B,8CAA8C;AAAA,IACzF;AAEA,UAAM,QAAQ,qBAAqB,SAAS;AAC5C,QAAI,UAAU,MAAM;AAClB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,aAAa,OAAO,YAAY,WAAW,UAAU,QAAQ,SAAS,MAAM;AAClF,UAAM,gBAAgB,GAAG,MAAM,SAAS,IAAI,UAAU;AACtD,UAAM,WAAW,WAAW,UAAU,MAAM,EAAE,OAAO,aAAa,EAAE,OAAO,KAAK;AAEhF,UAAM,cAAc,OAAO,KAAK,UAAU,KAAK;AAC/C,UAAM,cAAc,OAAO,KAAK,MAAM,IAAI,KAAK;AAC/C,QAAI,YAAY,WAAW,YAAY,UAAU,CAAC,gBAAgB,aAAa,WAAW,GAAG;AAC3F,YAAM,IAAI,+BAA+B,wCAAwC;AAAA,IACnF;AAEA,UAAM,SAAS,KAAK,MAAM,IAAI,IAAI,GAAI;AACtC,QAAI,KAAK,IAAI,SAAS,MAAM,SAAS,IAAI,cAAc;AACrD,YAAM,IAAI;AAAA,QACR,iDAAiD,YAAY;AAAA,MAC/D;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,cAAQ,KAAK,MAAM,UAAU;AAAA,IAC/B,QAAQ;AACN,YAAM,IAAI,+BAA+B,mCAAmC;AAAA,IAC9E;AAEA,WAAO,EAAE,WAAW,MAAM,WAAW,MAAM;AAAA,EAC7C;AACF;AAEA,SAAS,qBAAqB,QAA0D;AACtF,QAAM,SAAiC,CAAC;AACxC,aAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AACpC,UAAM,MAAM,KAAK,QAAQ,GAAG;AAC5B,QAAI,QAAQ;AAAI,aAAO;AACvB,UAAM,MAAM,KAAK,MAAM,GAAG,GAAG,EAAE,KAAK;AACpC,UAAM,QAAQ,KAAK,MAAM,MAAM,CAAC,EAAE,KAAK;AACvC,QAAI,CAAC,OAAO,CAAC;AAAO,aAAO;AAC3B,WAAO,GAAG,IAAI;AAAA,EAChB;AACA,QAAM,IAAI,OAAO;AACjB,QAAM,KAAK,OAAO;AAClB,MAAI,CAAC,KAAK,CAAC;AAAI,WAAO;AACtB,QAAM,YAAY,OAAO,CAAC;AAC1B,MAAI,CAAC,OAAO,SAAS,SAAS,KAAK,CAAC,eAAe,KAAK,EAAE;AAAG,WAAO;AACpE,SAAO,EAAE,WAAW,GAAG;AACzB;;;ACvFA,IAAM,mBAAmB;AACzB,IAAM,qBAAqB;AAC3B,IAAM,sBAAsB;AAC5B,IAAM,cAAc;AAqBb,IAAM,OAAN,MAAW;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhB,OAAuB,WAAW;AAAA,EAClB,WAAW;AAAA,EAE3B,YAAY,UAAuB,CAAC,GAAG;AACrC,UAAM,OAAO,IAAI,WAAW;AAAA,MAC1B,SAAS,QAAQ,WAAW;AAAA,MAC5B,QAAQ,QAAQ;AAAA,MAChB,WAAW,QAAQ,aAAa;AAAA,MAChC,YAAY,QAAQ,cAAc;AAAA,MAClC,WAAW,aAAa,WAAW;AAAA,MACnC,OAAO,QAAQ;AAAA,IACjB,CAAC;AACD,SAAK,UAAU,IAAI,QAAQ,IAAI;AAC/B,SAAK,OAAO,IAAI,KAAK,IAAI;AAAA,EAC3B;AACF","sourcesContent":["import createClient from 'openapi-fetch';\n\nimport { GaruConnectionError, mapApiError, type GaruAPIError } from './errors.js';\nimport type { paths } from './generated/schema.js';\n\nexport interface HttpClientConfig {\n baseUrl: string;\n apiKey?: string;\n timeoutMs: number;\n maxRetries: number;\n userAgent: string;\n /** Injectable for tests. Defaults to `globalThis.fetch`. /\n fetch?: typeof fetch;\n}\n\nconst RETRYABLE_STATUSES = new Set([408, 429, 500, 502, 503, 504]);\n\n/* Typed openapi-fetch client keyed to the backend's OpenAPI paths. /\nexport type GaruOpenapiClient = ReturnType<typeof createClient<paths>>;\n\n/* Arg type for `HttpClient.call` — a thunk that issues one openapi-fetch request. /\nexport type OpenapiCallResult<T> = Promise<{\n data?: T;\n error?: unknown;\n response: Response;\n}>;\n\n/\n HttpClient wraps the generated `openapi-fetch` client with:\n * - retries (exponential backoff, full jitter, honors `Retry-After`)\n * - typed error mapping (non-2xx → {@link GaruAPIError} subclass)\n * - connection error wrapping\n * - Authorization + User-Agent injection\n \n Resources call {@link call} with a thunk that returns an openapi-fetch\n * `{ data, error, response }` tuple; the wrapper either returns `data` or\n * throws the mapped error.\n /\nexport class HttpClient {\n public readonly client: GaruOpenapiClient;\n private readonly cfg: HttpClientConfig;\n\n constructor(cfg: HttpClientConfig) {\n this.cfg = cfg;\n const fetchImpl = cfg.fetch ?? globalThis.fetch;\n if (!fetchImpl) {\n throw new GaruConnectionError(\n 'No fetch implementation available. Node.js >= 18 is required.'\n );\n }\n const headers: Record<string, string> = {\n Accept: 'application/json',\n 'User-Agent': cfg.userAgent\n };\n if (cfg.apiKey) headers.Authorization = `Bearer ${cfg.apiKey}`;\n\n this.client = createClient<paths>({\n baseUrl: cfg.baseUrl.replace(/\\/+$/, ''),\n fetch: fetchImpl,\n headers\n });\n }\n\n /\n Issue one HTTP call against the typed client, with retries + error mapping.\n \n `fn` is invoked up to `maxRetries + 1` times. The timeout in `cfg.timeoutMs`\n * is enforced via `AbortController`.\n /\n async call<T>(fn: (signal: AbortSignal) => OpenapiCallResult<T>): Promise<T> {\n let lastError: GaruAPIError \| GaruConnectionError \| null = null;\n\n for (let attempt = 0; attempt <= this.cfg.maxRetries; attempt++) {\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), this.cfg.timeoutMs);\n\n try {\n const { data, error, response } = await fn(controller.signal);\n clearTimeout(timer);\n\n if (response.ok) {\n return data as T;\n }\n\n const requestId = response.headers.get('x-request-id');\n const retryAfterSec = parseRetryAfter(response.headers.get('retry-after'));\n const apiError = mapApiError(response.status, error ?? null, requestId, retryAfterSec);\n lastError = apiError;\n\n if (!RETRYABLE_STATUSES.has(response.status) \|\| attempt === this.cfg.maxRetries) {\n throw apiError;\n }\n\n await sleep(backoffDelay(attempt, retryAfterSec));\n continue;\n } catch (err) {\n clearTimeout(timer);\n\n if (isGaruApiError(err)) throw err;\n\n const connErr =\n err instanceof Error && err.name === 'AbortError'\n ? new GaruConnectionError(`Request timed out after ${this.cfg.timeoutMs}ms`, err)\n : new GaruConnectionError(err instanceof Error ? err.message : 'Network error', err);\n lastError = connErr;\n\n if (attempt === this.cfg.maxRetries) throw connErr;\n await sleep(backoffDelay(attempt, null));\n continue;\n }\n }\n\n // Unreachable — the loop always throws or returns on the final attempt.\n throw lastError ?? new GaruConnectionError('Request failed with no error captured');\n }\n}\n\nfunction isGaruApiError(err: unknown): boolean {\n return err instanceof Error && err.name.startsWith('Garu') && err.name.endsWith('Error');\n}\n\nfunction parseRetryAfter(value: string \| null): number \| null {\n if (!value) return null;\n const n = Number(value);\n return Number.isFinite(n) && n >= 0 ? n : null;\n}\n\n/\n Exponential backoff with full jitter. If the server returned `Retry-After`,\n * we honor it (with a small jitter).\n /\nfunction backoffDelay(attempt: number, retryAfterSec: number \| null): number {\n if (retryAfterSec !== null) {\n return retryAfterSec 1000 + Math.random() * 250;\n }\n const base = 500 * 2 ** attempt;\n const cap = 8000;\n return Math.min(cap, base) * Math.random();\n}\n\nfunction sleep(ms: number): Promise<void> {\n return new Promise((resolve) => setTimeout(resolve, ms));\n}\n","/*\n Error hierarchy for the Garu SDK.\n \n Every error has a stable `code` string so agents and typed clients can switch on it\n * without parsing messages. Non-2xx API responses are mapped to the most specific\n * subclass of `GaruAPIError` by {@link mapApiError}.\n /\n\nexport type GaruErrorCode =\n \| 'authentication_error'\n \| 'permission_error'\n \| 'not_found'\n \| 'validation_error'\n \| 'rate_limited'\n \| 'server_error'\n \| 'api_error'\n \| 'connection_error'\n \| 'signature_verification_failed';\n\nexport class GaruError extends Error {\n public readonly code: GaruErrorCode;\n\n constructor(code: GaruErrorCode, message: string) {\n super(message);\n this.name = 'GaruError';\n this.code = code;\n }\n}\n\nexport class GaruConnectionError extends GaruError {\n public readonly connectionCause: unknown;\n constructor(message: string, connectionCause?: unknown) {\n super('connection_error', message);\n this.name = 'GaruConnectionError';\n this.connectionCause = connectionCause;\n }\n}\n\nexport class GaruSignatureVerificationError extends GaruError {\n constructor(message: string) {\n super('signature_verification_failed', message);\n this.name = 'GaruSignatureVerificationError';\n }\n}\n\nexport class GaruAPIError extends GaruError {\n public readonly status: number;\n public readonly requestId: string \| null;\n public readonly body: unknown;\n\n constructor(\n code: GaruErrorCode,\n message: string,\n status: number,\n requestId: string \| null,\n body: unknown\n ) {\n super(code, message);\n this.name = 'GaruAPIError';\n this.status = status;\n this.requestId = requestId;\n this.body = body;\n }\n}\n\nexport class GaruAuthenticationError extends GaruAPIError {\n constructor(message: string, status: number, requestId: string \| null, body: unknown) {\n super('authentication_error', message, status, requestId, body);\n this.name = 'GaruAuthenticationError';\n }\n}\n\nexport class GaruPermissionError extends GaruAPIError {\n constructor(message: string, status: number, requestId: string \| null, body: unknown) {\n super('permission_error', message, status, requestId, body);\n this.name = 'GaruPermissionError';\n }\n}\n\nexport class GaruNotFoundError extends GaruAPIError {\n constructor(message: string, status: number, requestId: string \| null, body: unknown) {\n super('not_found', message, status, requestId, body);\n this.name = 'GaruNotFoundError';\n }\n}\n\nexport class GaruValidationError extends GaruAPIError {\n constructor(message: string, status: number, requestId: string \| null, body: unknown) {\n super('validation_error', message, status, requestId, body);\n this.name = 'GaruValidationError';\n }\n}\n\nexport class GaruRateLimitError extends GaruAPIError {\n public readonly retryAfterSec: number \| null;\n constructor(\n message: string,\n status: number,\n requestId: string \| null,\n body: unknown,\n retryAfterSec: number \| null\n ) {\n super('rate_limited', message, status, requestId, body);\n this.name = 'GaruRateLimitError';\n this.retryAfterSec = retryAfterSec;\n }\n}\n\nexport class GaruServerError extends GaruAPIError {\n constructor(message: string, status: number, requestId: string \| null, body: unknown) {\n super('server_error', message, status, requestId, body);\n this.name = 'GaruServerError';\n }\n}\n\n/\n Map a non-2xx HTTP response to the most specific {@link GaruAPIError} subclass.\n /\nexport function mapApiError(\n status: number,\n body: unknown,\n requestId: string \| null,\n retryAfterSec: number \| null\n): GaruAPIError {\n const message = extractMessage(body) ?? `Garu API returned HTTP ${status}`;\n\n if (status === 401) return new GaruAuthenticationError(message, status, requestId, body);\n if (status === 403) return new GaruPermissionError(message, status, requestId, body);\n if (status === 404) return new GaruNotFoundError(message, status, requestId, body);\n if (status === 400 \|\| status === 422) {\n return new GaruValidationError(message, status, requestId, body);\n }\n if (status === 429) {\n return new GaruRateLimitError(message, status, requestId, body, retryAfterSec);\n }\n if (status >= 500) return new GaruServerError(message, status, requestId, body);\n return new GaruAPIError('api_error', message, status, requestId, body);\n}\n\nfunction extractMessage(body: unknown): string \| null {\n if (typeof body === 'string') return body;\n if (body && typeof body === 'object') {\n const m = (body as { message?: unknown }).message;\n if (typeof m === 'string') return m;\n if (Array.isArray(m) && m.every((x) => typeof x === 'string')) return m.join('; ');\n }\n return null;\n}\n","import { randomUUID } from 'node:crypto';\n\n/\n Generate a UUIDv4 suitable for use as an `X-Idempotency-Key` header value.\n \n @example\n * const key = generateIdempotencyKey();\n * // '3b241101-e2bb-4255-8caf-4136c566a962'\n /\nexport function generateIdempotencyKey(): string {\n return randomUUID();\n}\n","/\n Public types for the Garu SDK.\n \n The wire-level types (`WireCreateTransactionRequest`, `WireMetaResponse`, ...)\n * are generated from the backend's OpenAPI spec and live in\n * `src/generated/schema.d.ts`. The friendly types in this file\n * (`CreateChargeParams`, `Customer`, `Charge`, ...) are hand-curated for\n * ergonomics — they rename `transactions` to `charges`, collapse wire enums\n * into readable unions, and mark only truly required fields as required.\n * The resource layer maps friendly → wire at the edge.\n /\n\nimport type { components } from './generated/schema.js';\n\nexport type WireCreateTransactionRequest = components['schemas']['CreateTransactionRequest'];\nexport type WireCustomerDto = components['schemas']['CustomerDto'];\nexport type WireCardInfoDto = components['schemas']['CardInfoDto'];\nexport type WireMetaResponse = components['schemas']['MetaResponse'];\n\nexport type PaymentMethod = 'pix' \| 'credit_card' \| 'boleto';\n\n/* Payment-method identifier as sent to the backend over the wire. /\nexport type WirePaymentMethodId = 'pix' \| 'creditcard' \| 'boleto';\n\nexport type ChargeStatus =\n \| 'pending'\n \| 'authorized'\n \| 'paid'\n \| 'failed'\n \| 'refunded'\n \| 'cancelled'\n \| 'expired';\n\nexport interface Customer {\n /* Full legal name. 3–255 chars. /\n name: string;\n email: string;\n /* CPF (11 digits) or CNPJ (14 digits), digits only. /\n document: string;\n /* 10 or 11 digits with area code, no formatting. /\n phone: string;\n /* 8 digits, no hyphen. Optional. /\n zipCode?: string;\n street?: string;\n number?: string;\n complement?: string;\n neighborhood?: string;\n city?: string;\n /* 2-letter uppercase state code, e.g. `SP`. /\n state?: string;\n}\n\nexport interface CardInfo {\n /* 13–19 digits, no spaces or hyphens. /\n cardNumber: string;\n /* 3 or 4 digits. /\n cvv: string;\n /* `YYYY-MM`. /\n expirationDate: string;\n /* As printed on the card. /\n holderName: string;\n /* 1–12. /\n installments: number;\n}\n\nexport interface CreateChargeParams {\n /* Customer buying the product. /\n customer: Customer;\n /* UUID of the product being charged. /\n productId: string;\n /* Payment method. /\n paymentMethod: PaymentMethod;\n /* Required when `paymentMethod` is `credit_card`. /\n cardInfo?: CardInfo;\n /* Free-form metadata attached to the charge. /\n additionalInfo?: string;\n /* Original checkout link, if any. /\n link?: string \| null;\n /* Associated affiliate ID, if any. /\n affiliateId?: number \| null;\n /* Subscription price ID (`price_`), for subscription charges only. /\n priceId?: string \| null;\n /** Optional pre-created checkout session token. /\n checkoutSessionToken?: string;\n /\n Idempotency key. If omitted, the SDK generates a UUIDv4.\n * Keys are valid for 24h on the backend.\n /\n idempotencyKey?: string;\n}\n\nexport interface Charge {\n id: number;\n status: ChargeStatus;\n amount: number;\n paymentMethodId: WirePaymentMethodId;\n /* ISO-8601. /\n date: string;\n /* ISO-8601. /\n deadline?: string;\n /* Product this charge belongs to. /\n product?: { id: number; uuid?: string; name?: string };\n [key: string]: unknown;\n}\n\nexport interface RefundChargeParams {\n /* Partial refund in centavos. Omit for full refund. /\n amount?: number;\n /* Free-form reason stored on the refund. /\n reason?: string;\n idempotencyKey?: string;\n}\n\nexport interface MetaFeatures {\n subscriptions: boolean;\n checkout_sessions: boolean;\n idempotency_keys: boolean;\n test_mode: boolean;\n webhooks: boolean;\n}\n\nexport interface MetaResponse {\n name: string;\n version: string;\n environment: 'production' \| 'staging' \| 'development' \| string;\n api_version: string;\n payment_methods: string[];\n currencies: string[];\n billing_intervals: string[];\n webhook_events: string[];\n features: MetaFeatures;\n docs_url: string;\n dashboard_url: string;\n support_email: string;\n}\n\n/* Map the SDK's friendly `PaymentMethod` to the backend's wire value. /\nexport function toWirePaymentMethod(pm: PaymentMethod): WirePaymentMethodId {\n return pm === 'credit_card' ? 'creditcard' : pm;\n}\n","import type { HttpClient } from '../http.js';\nimport type { components } from '../generated/schema.js';\nimport { generateIdempotencyKey } from '../idempotency.js';\nimport {\n toWirePaymentMethod,\n type Charge,\n type CreateChargeParams,\n type RefundChargeParams\n} from '../types.js';\n\ntype CreateTransactionBody = components['schemas']['CreateTransactionRequest'];\n\n/\n Charges — the core of the Garu API.\n \n A charge represents a single payment attempt against a product. The SDK\n * surfaces charges under `garu.charges` even though the backend route is\n * `/api/transactions` — this matches Stripe convention and is the name every\n * other Garu surface (MCP, CLI, docs) uses.\n /\nexport class Charges {\n constructor(private readonly http: HttpClient) {}\n\n /\n Create a charge (PIX, credit card, or boleto).\n \n Automatically attaches an `X-Idempotency-Key` header — if you don't pass\n * `idempotencyKey`, the SDK generates a UUIDv4. Safe to retry: the backend\n * caches the first response for 24h.\n \n @example\n * // PIX charge\n * const charge = await garu.charges.create({\n * productId: 'b3f2c1e8-6e4a-4b9f-9d1c-2a1f6c3d4e5f',\n * paymentMethod: 'pix',\n * customer: {\n * name: 'Maria Silva',\n * email: 'maria@exemplo.com.br',\n * document: '12345678909',\n * phone: '11987654321'\n * }\n * });\n * console.log(charge.id, charge.status);\n \n @example\n * // Credit card charge, 3 installments\n * const charge = await garu.charges.create({\n * productId: 'b3f2c1e8-6e4a-4b9f-9d1c-2a1f6c3d4e5f',\n * paymentMethod: 'credit_card',\n * customer: { name: 'Maria Silva', email: 'maria@exemplo.com.br', document: '12345678909', phone: '11987654321' },\n * cardInfo: {\n * cardNumber: '4111111111111111',\n * cvv: '123',\n * expirationDate: '2030-12',\n * holderName: 'MARIA SILVA',\n * installments: 3\n * }\n * });\n /\n async create(params: CreateChargeParams): Promise<Charge> {\n const idempotencyKey = params.idempotencyKey ?? generateIdempotencyKey();\n const body = this.buildCreateBody(params);\n\n return this.http.call<Charge>(\n (signal) =>\n this.http.client.POST('/api/transactions', {\n body,\n headers: { 'X-Idempotency-Key': idempotencyKey },\n signal\n }) as Promise<{ data?: Charge; error?: unknown; response: Response }>\n );\n }\n\n /\n Fetch a single charge by numeric ID.\n \n @example\n * const charge = await garu.charges.get(4472);\n * if (charge.status === 'paid') { ... }\n /\n async get(id: number): Promise<Charge> {\n return this.http.call<Charge>(\n (signal) =>\n this.http.client.GET('/api/transactions/{id}', {\n params: { path: { id } },\n signal\n }) as Promise<{ data?: Charge; error?: unknown; response: Response }>\n );\n }\n\n /\n Refund a charge — fully, or partially by passing `amount` in centavos.\n \n @example\n * // Full refund\n * await garu.charges.refund(4472);\n \n @example\n * // Partial refund of R$ 10,00\n * await garu.charges.refund(4472, { amount: 1000, reason: 'customer_request' });\n /\n async refund(id: number, params: RefundChargeParams = {}): Promise<Charge> {\n const idempotencyKey = params.idempotencyKey ?? generateIdempotencyKey();\n const body: Record<string, unknown> = {};\n if (params.amount !== undefined) body.amount = params.amount;\n if (params.reason !== undefined) body.reason = params.reason;\n\n return this.http.call<Charge>(\n (signal) =>\n this.http.client.POST('/api/transactions/{id}/refund', {\n params: { path: { id } },\n body: body as never,\n headers: { 'X-Idempotency-Key': idempotencyKey },\n signal\n }) as Promise<{ data?: Charge; error?: unknown; response: Response }>\n );\n }\n\n private buildCreateBody(params: CreateChargeParams): CreateTransactionBody {\n const body: Record<string, unknown> = {\n customer: params.customer,\n productId: params.productId,\n paymentMethodId: toWirePaymentMethod(params.paymentMethod),\n link: params.link ?? null,\n affiliateId: params.affiliateId ?? null\n };\n if (params.additionalInfo !== undefined) body.additionalInfo = params.additionalInfo;\n if (params.priceId !== undefined) body.priceId = params.priceId;\n if (params.checkoutSessionToken !== undefined) {\n body.checkoutSessionToken = params.checkoutSessionToken;\n }\n if (params.cardInfo) body.CardInfo = params.cardInfo;\n return body as unknown as CreateTransactionBody;\n }\n}\n","import type { HttpClient } from '../http.js';\nimport type { MetaResponse } from '../types.js';\n\n/\n Meta — capability introspection.\n \n Unauthenticated. Used by `garu doctor`, MCP tool `doctor`, and by SDK\n * consumers that want to know which payment methods and webhook events are\n * currently supported.\n /\nexport class Meta {\n constructor(private readonly http: HttpClient) {}\n\n /\n Fetch the API's current capability payload.\n \n @example\n * const meta = await garu.meta.get();\n * console.log(meta.version, meta.payment_methods);\n * if (meta.features.subscriptions) { ... }\n /\n async get(): Promise<MetaResponse> {\n return this.http.call<MetaResponse>(\n (signal) =>\n this.http.client.GET('/api/meta', { signal }) as Promise<{\n data?: MetaResponse;\n error?: unknown;\n response: Response;\n }>\n );\n }\n}\n","import { createHmac, timingSafeEqual } from 'node:crypto';\n\nimport { GaruSignatureVerificationError } from './errors.js';\n\nexport interface VerifyWebhookParams {\n /* Raw request body as received — do NOT re-serialize parsed JSON. /\n payload: string \| Buffer;\n /* Value of the `X-Garu-Signature` header. Format: `t=<ts>,v1=<hex>`. /\n signature: string;\n /* The webhook endpoint's signing secret. /\n secret: string;\n /* Reject signatures older than this many seconds. Default: 300 (5 min). /\n toleranceSec?: number;\n /* Injectable for tests. Defaults to `Date.now()`. /\n now?: () => number;\n}\n\nexport interface VerifiedWebhook {\n /* Timestamp from the signature header, in seconds since epoch. /\n timestamp: number;\n /* Parsed JSON body. Throws {@link GaruSignatureVerificationError} if invalid JSON. /\n event: unknown;\n}\n\n/\n Webhook helpers.\n \n Garu signs outgoing webhooks with HMAC-SHA256 over `${timestamp}.${payload}`\n * and delivers the signature in the `X-Garu-Signature` header as `t=<ts>,v1=<hex>`.\n * This matches the format in the backend's `webhook-delivery.service.ts`.\n \n @example\n * // Express example\n * app.post('/webhooks/garu', express.raw({ type: 'application/json' }), (req, res) => {\n * try {\n * const { event } = Garu.webhooks.verify({\n * payload: req.body,\n * signature: req.header('x-garu-signature') ?? '',\n * secret: process.env.GARU_WEBHOOK_SECRET!\n * });\n * // handle event\n * res.sendStatus(200);\n * } catch (err) {\n * res.sendStatus(400);\n * }\n * });\n /\nexport const webhooks = {\n verify(params: VerifyWebhookParams): VerifiedWebhook {\n const { signature, secret, payload } = params;\n const toleranceSec = params.toleranceSec ?? 300;\n const now = params.now ?? Date.now;\n\n if (!signature \|\| typeof signature !== 'string') {\n throw new GaruSignatureVerificationError('Missing or malformed X-Garu-Signature header');\n }\n\n const parts = parseSignatureHeader(signature);\n if (parts === null) {\n throw new GaruSignatureVerificationError(\n 'X-Garu-Signature header does not match expected format t=<ts>,v1=<hex>'\n );\n }\n\n const payloadStr = typeof payload === 'string' ? payload : payload.toString('utf8');\n const signedPayload = `${parts.timestamp}.${payloadStr}`;\n const expected = createHmac('sha256', secret).update(signedPayload).digest('hex');\n\n const expectedBuf = Buffer.from(expected, 'hex');\n const providedBuf = Buffer.from(parts.v1, 'hex');\n if (expectedBuf.length !== providedBuf.length \|\| !timingSafeEqual(expectedBuf, providedBuf)) {\n throw new GaruSignatureVerificationError('Signature does not match computed HMAC');\n }\n\n const nowSec = Math.floor(now() / 1000);\n if (Math.abs(nowSec - parts.timestamp) > toleranceSec) {\n throw new GaruSignatureVerificationError(\n `Signature timestamp outside tolerance window (${toleranceSec}s)`\n );\n }\n\n let event: unknown;\n try {\n event = JSON.parse(payloadStr);\n } catch {\n throw new GaruSignatureVerificationError('Webhook payload is not valid JSON');\n }\n\n return { timestamp: parts.timestamp, event };\n }\n};\n\nfunction parseSignatureHeader(header: string): { timestamp: number; v1: string } \| null {\n const fields: Record<string, string> = {};\n for (const part of header.split(',')) {\n const idx = part.indexOf('=');\n if (idx === -1) return null;\n const key = part.slice(0, idx).trim();\n const value = part.slice(idx + 1).trim();\n if (!key \|\| !value) return null;\n fields[key] = value;\n }\n const t = fields.t;\n const v1 = fields.v1;\n if (!t \|\| !v1) return null;\n const timestamp = Number(t);\n if (!Number.isFinite(timestamp) \|\| !/^[a-f0-9]+$/i.test(v1)) return null;\n return { timestamp, v1 };\n}\n","import { HttpClient } from './http.js';\nimport { Charges } from './resources/charges.js';\nimport { Meta } from './resources/meta.js';\nimport { webhooks } from './webhooks.js';\n\nexport interface GaruOptions {\n /\n Your Garu API key. `sk_live_…` for production, `sk_test_…` for test mode.\n * Optional — public endpoints (`meta.get`, public charge creation) work without one.\n /\n apiKey?: string;\n /* Override the API base URL. Default: `https://garu.com.br/api`. /\n baseUrl?: string;\n /* Per-request timeout in ms. Default: 30000. /\n timeoutMs?: number;\n /* Max retries on retryable errors (connection, 408, 429, 5xx). Default: 2. /\n maxRetries?: number;\n /* Injectable for tests. Defaults to `globalThis.fetch`. /\n fetch?: typeof fetch;\n}\n\nconst DEFAULT_BASE_URL = 'https://garu.com.br';\nconst DEFAULT_TIMEOUT_MS = 30_000;\nconst DEFAULT_MAX_RETRIES = 2;\nconst SDK_VERSION = '0.1.0';\n\n/\n The Garu SDK client.\n \n @example\n * import { Garu } from '@garuhq/node';\n \n const garu = new Garu({ apiKey: process.env.GARU_API_KEY });\n \n const charge = await garu.charges.create({\n * productId: 'b3f2c1e8-6e4a-4b9f-9d1c-2a1f6c3d4e5f',\n * paymentMethod: 'pix',\n * customer: {\n * name: 'Maria Silva',\n * email: 'maria@exemplo.com.br',\n * document: '12345678909',\n * phone: '11987654321'\n * }\n * });\n /\nexport class Garu {\n public readonly charges: Charges;\n public readonly meta: Meta;\n\n /\n Webhook helpers. Available both as an instance member and as a static —\n * `Garu.webhooks.verify(...)` works without constructing a client.\n */\n public static readonly webhooks = webhooks;\n public readonly webhooks = webhooks;\n\n constructor(options: GaruOptions = {}) {\n const http = new HttpClient({\n baseUrl: options.baseUrl ?? DEFAULT_BASE_URL,\n apiKey: options.apiKey,\n timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,\n maxRetries: options.maxRetries ?? DEFAULT_MAX_RETRIES,\n userAgent: `garu-node/${SDK_VERSION}`,\n fetch: options.fetch\n });\n this.charges = new Charges(http);\n this.meta = new Meta(http);\n }\n}\n"]}
1	+ {"version":3,"sources":["../src/errors.ts","../src/http.ts","../src/idempotency.ts","../src/types.ts","../src/resources/charges.ts","../src/resources/meta.ts","../src/webhooks.ts","../src/client.ts"],"names":[],"mappings":";;;;;;AAmBO,IAAM,SAAA,GAAN,cAAwB,KAAA,CAAM;AAAA,EACnB,IAAA;AAAA,EAEhB,WAAA,CAAY,MAAqB,OAAA,EAAiB;AAChD,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAEO,IAAM,mBAAA,GAAN,cAAkC,SAAA,CAAU;AAAA,EACjC,eAAA;AAAA,EAChB,WAAA,CAAY,SAAiB,eAAA,EAA2B;AACtD,IAAA,KAAA,CAAM,oBAAoB,OAAO,CAAA;AACjC,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AACZ,IAAA,IAAA,CAAK,eAAA,GAAkB,eAAA;AAAA,EACzB;AACF;AAEO,IAAM,8BAAA,GAAN,cAA6C,SAAA,CAAU;AAAA,EAC5D,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,iCAAiC,OAAO,CAAA;AAC9C,IAAA,IAAA,CAAK,IAAA,GAAO,gCAAA;AAAA,EACd;AACF;AAEO,IAAM,YAAA,GAAN,cAA2B,SAAA,CAAU;AAAA,EAC1B,MAAA;AAAA,EACA,SAAA;AAAA,EACA,IAAA;AAAA,EAEhB,WAAA,CACE,IAAA,EACA,OAAA,EACA,MAAA,EACA,WACA,IAAA,EACA;AACA,IAAA,KAAA,CAAM,MAAM,OAAO,CAAA;AACnB,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAEO,IAAM,uBAAA,GAAN,cAAsC,YAAA,CAAa;AAAA,EACxD,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAgB,SAAA,EAA0B,IAAA,EAAe;AACpF,IAAA,KAAA,CAAM,sBAAA,EAAwB,OAAA,EAAS,MAAA,EAAQ,SAAA,EAAW,IAAI,CAAA;AAC9D,IAAA,IAAA,CAAK,IAAA,GAAO,yBAAA;AAAA,EACd;AACF;AAEO,IAAM,mBAAA,GAAN,cAAkC,YAAA,CAAa;AAAA,EACpD,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAgB,SAAA,EAA0B,IAAA,EAAe;AACpF,IAAA,KAAA,CAAM,kBAAA,EAAoB,OAAA,EAAS,MAAA,EAAQ,SAAA,EAAW,IAAI,CAAA;AAC1D,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AAAA,EACd;AACF;AAEO,IAAM,iBAAA,GAAN,cAAgC,YAAA,CAAa;AAAA,EAClD,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAgB,SAAA,EAA0B,IAAA,EAAe;AACpF,IAAA,KAAA,CAAM,WAAA,EAAa,OAAA,EAAS,MAAA,EAAQ,SAAA,EAAW,IAAI,CAAA;AACnD,IAAA,IAAA,CAAK,IAAA,GAAO,mBAAA;AAAA,EACd;AACF;AAEO,IAAM,mBAAA,GAAN,cAAkC,YAAA,CAAa;AAAA,EACpD,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAgB,SAAA,EAA0B,IAAA,EAAe;AACpF,IAAA,KAAA,CAAM,kBAAA,EAAoB,OAAA,EAAS,MAAA,EAAQ,SAAA,EAAW,IAAI,CAAA;AAC1D,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AAAA,EACd;AACF;AAEO,IAAM,kBAAA,GAAN,cAAiC,YAAA,CAAa;AAAA,EACnC,aAAA;AAAA,EAChB,WAAA,CACE,OAAA,EACA,MAAA,EACA,SAAA,EACA,MACA,aAAA,EACA;AACA,IAAA,KAAA,CAAM,cAAA,EAAgB,OAAA,EAAS,MAAA,EAAQ,SAAA,EAAW,IAAI,CAAA;AACtD,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AACZ,IAAA,IAAA,CAAK,aAAA,GAAgB,aAAA;AAAA,EACvB;AACF;AAEO,IAAM,eAAA,GAAN,cAA8B,YAAA,CAAa;AAAA,EAChD,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAgB,SAAA,EAA0B,IAAA,EAAe;AACpF,IAAA,KAAA,CAAM,cAAA,EAAgB,OAAA,EAAS,MAAA,EAAQ,SAAA,EAAW,IAAI,CAAA;AACtD,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AAAA,EACd;AACF;AAKO,SAAS,WAAA,CACd,MAAA,EACA,IAAA,EACA,SAAA,EACA,aAAA,EACc;AACd,EAAA,MAAM,OAAA,GAAU,cAAA,CAAe,IAAI,CAAA,IAAK,0BAA0B,MAAM,CAAA,CAAA;AAExE,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,IAAI,wBAAwB,OAAA,EAAS,MAAA,EAAQ,WAAW,IAAI,CAAA;AACvF,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,IAAI,oBAAoB,OAAA,EAAS,MAAA,EAAQ,WAAW,IAAI,CAAA;AACnF,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,IAAI,kBAAkB,OAAA,EAAS,MAAA,EAAQ,WAAW,IAAI,CAAA;AACjF,EAAA,IAAI,MAAA,KAAW,GAAA,IAAO,MAAA,KAAW,GAAA,EAAK;AACpC,IAAA,OAAO,IAAI,mBAAA,CAAoB,OAAA,EAAS,MAAA,EAAQ,WAAW,IAAI,CAAA;AAAA,EACjE;AACA,EAAA,IAAI,WAAW,GAAA,EAAK;AAClB,IAAA,OAAO,IAAI,kBAAA,CAAmB,OAAA,EAAS,MAAA,EAAQ,SAAA,EAAW,MAAM,aAAa,CAAA;AAAA,EAC/E;AACA,EAAA,IAAI,MAAA,IAAU,KAAK,OAAO,IAAI,gBAAgB,OAAA,EAAS,MAAA,EAAQ,WAAW,IAAI,CAAA;AAC9E,EAAA,OAAO,IAAI,YAAA,CAAa,WAAA,EAAa,OAAA,EAAS,MAAA,EAAQ,WAAW,IAAI,CAAA;AACvE;AAEA,SAAS,eAAe,IAAA,EAA8B;AACpD,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,EAAU,OAAO,IAAA;AACrC,EAAA,IAAI,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AACpC,IAAA,MAAM,IAAK,IAAA,CAA+B,OAAA;AAC1C,IAAA,IAAI,OAAO,CAAA,KAAM,QAAA,EAAU,OAAO,CAAA;AAClC,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,IAAK,EAAE,KAAA,CAAM,CAAC,CAAA,KAAM,OAAO,MAAM,QAAQ,CAAA,EAAG,OAAO,CAAA,CAAE,KAAK,IAAI,CAAA;AAAA,EACnF;AACA,EAAA,OAAO,IAAA;AACT;;;ACpIA,IAAM,kBAAA,mBAAqB,IAAI,GAAA,CAAI,CAAC,GAAA,EAAK,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAuB1D,IAAM,aAAN,MAAiB;AAAA,EACN,MAAA;AAAA,EACC,GAAA;AAAA,EAEjB,YAAY,GAAA,EAAuB;AACjC,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AACX,IAAA,MAAM,SAAA,GAAY,GAAA,CAAI,KAAA,IAAS,UAAA,CAAW,KAAA;AAC1C,IAAA,IAAI,CAAC,SAAA,EAAW;AACd,MAAA,MAAM,IAAI,mBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,MAAA,EAAQ,kBAAA;AAAA,MACR,cAAc,GAAA,CAAI;AAAA,KACpB;AACA,IAAA,IAAI,IAAI,MAAA,EAAQ,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,IAAI,MAAM,CAAA,CAAA;AAE5D,IAAA,IAAA,CAAK,SAAS,YAAA,CAAoB;AAAA,MAChC,OAAA,EAAS,GAAA,CAAI,OAAA,CAAQ,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAAA,MACvC,KAAA,EAAO,SAAA;AAAA,MACP;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAQ,EAAA,EAA+D;AAC3E,IAAA,IAAI,SAAA,GAAuD,IAAA;AAE3D,IAAA,KAAA,IAAS,UAAU,CAAA,EAAG,OAAA,IAAW,IAAA,CAAK,GAAA,CAAI,YAAY,OAAA,EAAA,EAAW;AAC/D,MAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,MAAA,MAAM,KAAA,GAAQ,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,CAAK,IAAI,SAAS,CAAA;AAErE,MAAA,IAAI;AACF,QAAA,MAAM,EAAE,MAAM,KAAA,EAAO,QAAA,KAAa,MAAM,EAAA,CAAG,WAAW,MAAM,CAAA;AAC5D,QAAA,YAAA,CAAa,KAAK,CAAA;AAElB,QAAA,IAAI,SAAS,EAAA,EAAI;AACf,UAAA,OAAO,IAAA;AAAA,QACT;AAEA,QAAA,MAAM,SAAA,GAAY,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA;AACrD,QAAA,MAAM,gBAAgB,eAAA,CAAgB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAC,CAAA;AACzE,QAAA,MAAM,WAAW,WAAA,CAAY,QAAA,CAAS,QAAQ,KAAA,IAAS,IAAA,EAAM,WAAW,aAAa,CAAA;AACrF,QAAA,SAAA,GAAY,QAAA;AAEZ,QAAA,IAAI,CAAC,mBAAmB,GAAA,CAAI,QAAA,CAAS,MAAM,CAAA,IAAK,OAAA,KAAY,IAAA,CAAK,GAAA,CAAI,UAAA,EAAY;AAC/E,UAAA,MAAM,QAAA;AAAA,QACR;AAEA,QAAA,MAAM,KAAA,CAAM,YAAA,CAAa,OAAA,EAAS,aAAa,CAAC,CAAA;AAChD,QAAA;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,YAAA,CAAa,KAAK,CAAA;AAElB,QAAA,IAAI,cAAA,CAAe,GAAG,CAAA,EAAG,MAAM,GAAA;AAE/B,QAAA,MAAM,OAAA,GACJ,eAAe,KAAA,IAAS,GAAA,CAAI,SAAS,YAAA,GACjC,IAAI,mBAAA,CAAoB,CAAA,wBAAA,EAA2B,IAAA,CAAK,GAAA,CAAI,SAAS,CAAA,EAAA,CAAA,EAAM,GAAG,IAC9E,IAAI,mBAAA,CAAoB,eAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,eAAA,EAAiB,GAAG,CAAA;AACvF,QAAA,SAAA,GAAY,OAAA;AAEZ,QAAA,IAAI,OAAA,KAAY,IAAA,CAAK,GAAA,CAAI,UAAA,EAAY,MAAM,OAAA;AAC3C,QAAA,MAAM,KAAA,CAAM,YAAA,CAAa,OAAA,EAAS,IAAI,CAAC,CAAA;AACvC,QAAA;AAAA,MACF;AAAA,IACF;AAGA,IAAA,MAAM,SAAA,IAAa,IAAI,mBAAA,CAAoB,uCAAuC,CAAA;AAAA,EACpF;AACF,CAAA;AAEA,SAAS,eAAe,GAAA,EAAuB;AAC7C,EAAA,OAAO,GAAA,YAAe,KAAA,IAAS,GAAA,CAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,IAAK,GAAA,CAAI,IAAA,CAAK,QAAA,CAAS,OAAO,CAAA;AACzF;AAEA,SAAS,gBAAgB,KAAA,EAAqC;AAC5D,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,CAAA,GAAI,OAAO,KAAK,CAAA;AACtB,EAAA,OAAO,OAAO,QAAA,CAAS,CAAC,CAAA,IAAK,CAAA,IAAK,IAAI,CAAA,GAAI,IAAA;AAC5C;AAMA,SAAS,YAAA,CAAa,SAAiB,aAAA,EAAsC;AAC3E,EAAA,IAAI,kBAAkB,IAAA,EAAM;AAC1B,IAAA,OAAO,aAAA,GAAgB,GAAA,GAAO,IAAA,CAAK,MAAA,EAAO,GAAI,GAAA;AAAA,EAChD;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,CAAA,IAAK,OAAA;AACxB,EAAA,MAAM,GAAA,GAAM,GAAA;AACZ,EAAA,OAAO,KAAK,GAAA,CAAI,GAAA,EAAK,IAAI,CAAA,GAAI,KAAK,MAAA,EAAO;AAC3C;AAEA,SAAS,MAAM,EAAA,EAA2B;AACxC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AACzD;ACrIO,SAAS,sBAAA,GAAiC;AAC/C,EAAA,OAAO,UAAA,EAAW;AACpB;;;AC8HO,SAAS,oBAAoB,EAAA,EAAwC;AAC1E,EAAA,OAAO,EAAA,KAAO,gBAAgB,YAAA,GAAe,EAAA;AAC/C;;;ACvHO,IAAM,UAAN,MAAc;AAAA,EACnB,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA,EAAnB,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsC7B,MAAM,OAAO,MAAA,EAA6C;AACxD,IAAA,MAAM,cAAA,GAAiB,MAAA,CAAO,cAAA,IAAkB,sBAAA,EAAuB;AACvE,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,eAAA,CAAgB,MAAM,CAAA;AAExC,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA;AAAA,MACf,CAAC,MAAA,KACC,IAAA,CAAK,IAAA,CAAK,MAAA,CAAO,KAAK,mBAAA,EAAqB;AAAA,QACzC,IAAA;AAAA,QACA,OAAA,EAAS,EAAE,mBAAA,EAAqB,cAAA,EAAe;AAAA,QAC/C;AAAA,OACD;AAAA,KACL;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,IAAI,EAAA,EAA6B;AACrC,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA;AAAA,MACf,CAAC,MAAA,KACC,IAAA,CAAK,IAAA,CAAK,MAAA,CAAO,IAAI,wBAAA,EAA0B;AAAA,QAC7C,MAAA,EAAQ,EAAE,IAAA,EAAM,EAAE,IAAG,EAAE;AAAA,QACvB;AAAA,OACD;AAAA,KACL;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,MAAA,CAAO,EAAA,EAAY,MAAA,GAA6B,EAAC,EAAoB;AACzE,IAAA,MAAM,cAAA,GAAiB,MAAA,CAAO,cAAA,IAAkB,sBAAA,EAAuB;AACvE,IAAA,MAAM,OAAgC,EAAC;AACvC,IAAA,IAAI,MAAA,CAAO,MAAA,KAAW,MAAA,EAAW,IAAA,CAAK,SAAS,MAAA,CAAO,MAAA;AACtD,IAAA,IAAI,MAAA,CAAO,MAAA,KAAW,MAAA,EAAW,IAAA,CAAK,SAAS,MAAA,CAAO,MAAA;AAEtD,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA;AAAA,MACf,CAAC,MAAA,KACC,IAAA,CAAK,IAAA,CAAK,MAAA,CAAO,KAAK,+BAAA,EAAiC;AAAA,QACrD,MAAA,EAAQ,EAAE,IAAA,EAAM,EAAE,IAAG,EAAE;AAAA,QACvB,IAAA;AAAA,QACA,OAAA,EAAS,EAAE,mBAAA,EAAqB,cAAA,EAAe;AAAA,QAC/C;AAAA,OACD;AAAA,KACL;AAAA,EACF;AAAA,EAEQ,gBAAgB,MAAA,EAAmD;AACzE,IAAA,MAAM,IAAA,GAAgC;AAAA,MACpC,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,WAAW,MAAA,CAAO,SAAA;AAAA,MAClB,eAAA,EAAiB,mBAAA,CAAoB,MAAA,CAAO,aAAa,CAAA;AAAA,MACzD,IAAA,EAAM,OAAO,IAAA,IAAQ,IAAA;AAAA,MACrB,WAAA,EAAa,OAAO,WAAA,IAAe;AAAA,KACrC;AACA,IAAA,IAAI,MAAA,CAAO,cAAA,KAAmB,MAAA,EAAW,IAAA,CAAK,iBAAiB,MAAA,CAAO,cAAA;AACtE,IAAA,IAAI,MAAA,CAAO,OAAA,KAAY,MAAA,EAAW,IAAA,CAAK,UAAU,MAAA,CAAO,OAAA;AACxD,IAAA,IAAI,MAAA,CAAO,yBAAyB,MAAA,EAAW;AAC7C,MAAA,IAAA,CAAK,uBAAuB,MAAA,CAAO,oBAAA;AAAA,IACrC;AACA,IAAA,IAAI,MAAA,CAAO,QAAA,EAAU,IAAA,CAAK,QAAA,GAAW,MAAA,CAAO,QAAA;AAC5C,IAAA,OAAO,IAAA;AAAA,EACT;AACF,CAAA;;;AC5HO,IAAM,OAAN,MAAW;AAAA,EAChB,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA,EAAnB,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAU7B,MAAM,GAAA,GAA6B;AACjC,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA;AAAA,MACf,CAAC,WACC,IAAA,CAAK,IAAA,CAAK,OAAO,GAAA,CAAI,WAAA,EAAa,EAAE,MAAA,EAAQ;AAAA,KAKhD;AAAA,EACF;AACF,CAAA;ACgBO,IAAM,QAAA,GAAW;AAAA,EACtB,OAAO,MAAA,EAA8C;AACnD,IAAA,MAAM,EAAE,SAAA,EAAW,MAAA,EAAQ,OAAA,EAAQ,GAAI,MAAA;AACvC,IAAA,MAAM,YAAA,GAAe,OAAO,YAAA,IAAgB,GAAA;AAC5C,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,GAAA,IAAO,IAAA,CAAK,GAAA;AAE/B,IAAA,IAAI,CAAC,SAAA,IAAa,OAAO,SAAA,KAAc,QAAA,EAAU;AAC/C,MAAA,MAAM,IAAI,+BAA+B,8CAA8C,CAAA;AAAA,IACzF;AAEA,IAAA,MAAM,KAAA,GAAQ,qBAAqB,SAAS,CAAA;AAC5C,IAAA,IAAI,UAAU,IAAA,EAAM;AAClB,MAAA,MAAM,IAAI,8BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,aAAa,OAAO,OAAA,KAAY,WAAW,OAAA,GAAU,OAAA,CAAQ,SAAS,MAAM,CAAA;AAClF,IAAA,MAAM,aAAA,GAAgB,CAAA,EAAG,KAAA,CAAM,SAAS,IAAI,UAAU,CAAA,CAAA;AACtD,IAAA,MAAM,QAAA,GAAW,WAAW,QAAA,EAAU,MAAM,EAAE,MAAA,CAAO,aAAa,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AAEhF,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,IAAA,CAAK,QAAA,EAAU,KAAK,CAAA;AAC/C,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,IAAI,KAAK,CAAA;AAC/C,IAAA,IAAI,WAAA,CAAY,WAAW,WAAA,CAAY,MAAA,IAAU,CAAC,eAAA,CAAgB,WAAA,EAAa,WAAW,CAAA,EAAG;AAC3F,MAAA,MAAM,IAAI,+BAA+B,wCAAwC,CAAA;AAAA,IACnF;AAEA,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAA,KAAQ,GAAI,CAAA;AACtC,IAAA,IAAI,KAAK,GAAA,CAAI,MAAA,GAAS,KAAA,CAAM,SAAS,IAAI,YAAA,EAAc;AACrD,MAAA,MAAM,IAAI,8BAAA;AAAA,QACR,iDAAiD,YAAY,CAAA,EAAA;AAAA,OAC/D;AAAA,IACF;AAEA,IAAA,IAAI,KAAA;AACJ,IAAA,IAAI;AACF,MAAA,KAAA,GAAQ,IAAA,CAAK,MAAM,UAAU,CAAA;AAAA,IAC/B,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,+BAA+B,mCAAmC,CAAA;AAAA,IAC9E;AAEA,IAAA,OAAO,EAAE,SAAA,EAAW,KAAA,CAAM,SAAA,EAAW,KAAA,EAAM;AAAA,EAC7C;AACF;AAEA,SAAS,qBAAqB,MAAA,EAA0D;AACtF,EAAA,MAAM,SAAiC,EAAC;AACxC,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAAG;AACpC,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC5B,IAAA,IAAI,GAAA,KAAQ,IAAI,OAAO,IAAA;AACvB,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,EAAE,IAAA,EAAK;AACpC,IAAA,MAAM,QAAQ,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AACvC,IAAA,IAAI,CAAC,GAAA,IAAO,CAAC,KAAA,EAAO,OAAO,IAAA;AAC3B,IAAA,MAAA,CAAO,GAAG,CAAA,GAAI,KAAA;AAAA,EAChB;AACA,EAAA,MAAM,IAAI,MAAA,CAAO,CAAA;AACjB,EAAA,MAAM,KAAK,MAAA,CAAO,EAAA;AAClB,EAAA,IAAI,CAAC,CAAA,IAAK,CAAC,EAAA,EAAI,OAAO,IAAA;AACtB,EAAA,MAAM,SAAA,GAAY,OAAO,CAAC,CAAA;AAC1B,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,IAAK,CAAC,cAAA,CAAe,IAAA,CAAK,EAAE,CAAA,EAAG,OAAO,IAAA;AACpE,EAAA,OAAO,EAAE,WAAW,EAAA,EAAG;AACzB;;;ACvFA,IAAM,gBAAA,GAAmB,qBAAA;AACzB,IAAM,kBAAA,GAAqB,GAAA;AAC3B,IAAM,mBAAA,GAAsB,CAAA;AAC5B,IAAM,WAAA,GAAc,OAAA;AAqBb,IAAM,OAAN,MAAW;AAAA,EACA,OAAA;AAAA,EACA,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhB,OAAuB,QAAA,GAAW,QAAA;AAAA,EAClB,QAAA,GAAW,QAAA;AAAA,EAE3B,WAAA,CAAY,OAAA,GAAuB,EAAC,EAAG;AACrC,IAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW;AAAA,MAC1B,OAAA,EAAS,QAAQ,OAAA,IAAW,gBAAA;AAAA,MAC5B,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,SAAA,EAAW,QAAQ,SAAA,IAAa,kBAAA;AAAA,MAChC,UAAA,EAAY,QAAQ,UAAA,IAAc,mBAAA;AAAA,MAClC,SAAA,EAAW,aAAa,WAAW,CAAA,CAAA;AAAA,MACnC,OAAO,OAAA,CAAQ;AAAA,KAChB,CAAA;AACD,IAAA,IAAA,CAAK,OAAA,GAAU,IAAI,OAAA,CAAQ,IAAI,CAAA;AAC/B,IAAA,IAAA,CAAK,IAAA,GAAO,IAAI,IAAA,CAAK,IAAI,CAAA;AAAA,EAC3B;AACF","file":"index.js","sourcesContent":["/*\n Error hierarchy for the Garu SDK.\n \n Every error has a stable `code` string so agents and typed clients can switch on it\n * without parsing messages. Non-2xx API responses are mapped to the most specific\n * subclass of `GaruAPIError` by {@link mapApiError}.\n /\n\nexport type GaruErrorCode =\n \| 'authentication_error'\n \| 'permission_error'\n \| 'not_found'\n \| 'validation_error'\n \| 'rate_limited'\n \| 'server_error'\n \| 'api_error'\n \| 'connection_error'\n \| 'signature_verification_failed';\n\nexport class GaruError extends Error {\n public readonly code: GaruErrorCode;\n\n constructor(code: GaruErrorCode, message: string) {\n super(message);\n this.name = 'GaruError';\n this.code = code;\n }\n}\n\nexport class GaruConnectionError extends GaruError {\n public readonly connectionCause: unknown;\n constructor(message: string, connectionCause?: unknown) {\n super('connection_error', message);\n this.name = 'GaruConnectionError';\n this.connectionCause = connectionCause;\n }\n}\n\nexport class GaruSignatureVerificationError extends GaruError {\n constructor(message: string) {\n super('signature_verification_failed', message);\n this.name = 'GaruSignatureVerificationError';\n }\n}\n\nexport class GaruAPIError extends GaruError {\n public readonly status: number;\n public readonly requestId: string \| null;\n public readonly body: unknown;\n\n constructor(\n code: GaruErrorCode,\n message: string,\n status: number,\n requestId: string \| null,\n body: unknown\n ) {\n super(code, message);\n this.name = 'GaruAPIError';\n this.status = status;\n this.requestId = requestId;\n this.body = body;\n }\n}\n\nexport class GaruAuthenticationError extends GaruAPIError {\n constructor(message: string, status: number, requestId: string \| null, body: unknown) {\n super('authentication_error', message, status, requestId, body);\n this.name = 'GaruAuthenticationError';\n }\n}\n\nexport class GaruPermissionError extends GaruAPIError {\n constructor(message: string, status: number, requestId: string \| null, body: unknown) {\n super('permission_error', message, status, requestId, body);\n this.name = 'GaruPermissionError';\n }\n}\n\nexport class GaruNotFoundError extends GaruAPIError {\n constructor(message: string, status: number, requestId: string \| null, body: unknown) {\n super('not_found', message, status, requestId, body);\n this.name = 'GaruNotFoundError';\n }\n}\n\nexport class GaruValidationError extends GaruAPIError {\n constructor(message: string, status: number, requestId: string \| null, body: unknown) {\n super('validation_error', message, status, requestId, body);\n this.name = 'GaruValidationError';\n }\n}\n\nexport class GaruRateLimitError extends GaruAPIError {\n public readonly retryAfterSec: number \| null;\n constructor(\n message: string,\n status: number,\n requestId: string \| null,\n body: unknown,\n retryAfterSec: number \| null\n ) {\n super('rate_limited', message, status, requestId, body);\n this.name = 'GaruRateLimitError';\n this.retryAfterSec = retryAfterSec;\n }\n}\n\nexport class GaruServerError extends GaruAPIError {\n constructor(message: string, status: number, requestId: string \| null, body: unknown) {\n super('server_error', message, status, requestId, body);\n this.name = 'GaruServerError';\n }\n}\n\n/\n Map a non-2xx HTTP response to the most specific {@link GaruAPIError} subclass.\n /\nexport function mapApiError(\n status: number,\n body: unknown,\n requestId: string \| null,\n retryAfterSec: number \| null\n): GaruAPIError {\n const message = extractMessage(body) ?? `Garu API returned HTTP ${status}`;\n\n if (status === 401) return new GaruAuthenticationError(message, status, requestId, body);\n if (status === 403) return new GaruPermissionError(message, status, requestId, body);\n if (status === 404) return new GaruNotFoundError(message, status, requestId, body);\n if (status === 400 \|\| status === 422) {\n return new GaruValidationError(message, status, requestId, body);\n }\n if (status === 429) {\n return new GaruRateLimitError(message, status, requestId, body, retryAfterSec);\n }\n if (status >= 500) return new GaruServerError(message, status, requestId, body);\n return new GaruAPIError('api_error', message, status, requestId, body);\n}\n\nfunction extractMessage(body: unknown): string \| null {\n if (typeof body === 'string') return body;\n if (body && typeof body === 'object') {\n const m = (body as { message?: unknown }).message;\n if (typeof m === 'string') return m;\n if (Array.isArray(m) && m.every((x) => typeof x === 'string')) return m.join('; ');\n }\n return null;\n}\n","import createClient from 'openapi-fetch';\n\nimport { GaruConnectionError, mapApiError, type GaruAPIError } from './errors.js';\nimport type { paths } from './generated/schema.js';\n\nexport interface HttpClientConfig {\n baseUrl: string;\n apiKey?: string;\n timeoutMs: number;\n maxRetries: number;\n userAgent: string;\n /* Injectable for tests. Defaults to `globalThis.fetch`. /\n fetch?: typeof fetch;\n}\n\nconst RETRYABLE_STATUSES = new Set([408, 429, 500, 502, 503, 504]);\n\n/* Typed openapi-fetch client keyed to the backend's OpenAPI paths. /\nexport type GaruOpenapiClient = ReturnType<typeof createClient<paths>>;\n\n/* Arg type for `HttpClient.call` — a thunk that issues one openapi-fetch request. /\nexport type OpenapiCallResult<T> = Promise<{\n data?: T;\n error?: unknown;\n response: Response;\n}>;\n\n/\n HttpClient wraps the generated `openapi-fetch` client with:\n * - retries (exponential backoff, full jitter, honors `Retry-After`)\n * - typed error mapping (non-2xx → {@link GaruAPIError} subclass)\n * - connection error wrapping\n * - Authorization + User-Agent injection\n \n Resources call {@link call} with a thunk that returns an openapi-fetch\n * `{ data, error, response }` tuple; the wrapper either returns `data` or\n * throws the mapped error.\n /\nexport class HttpClient {\n public readonly client: GaruOpenapiClient;\n private readonly cfg: HttpClientConfig;\n\n constructor(cfg: HttpClientConfig) {\n this.cfg = cfg;\n const fetchImpl = cfg.fetch ?? globalThis.fetch;\n if (!fetchImpl) {\n throw new GaruConnectionError(\n 'No fetch implementation available. Node.js >= 18 is required.'\n );\n }\n const headers: Record<string, string> = {\n Accept: 'application/json',\n 'User-Agent': cfg.userAgent\n };\n if (cfg.apiKey) headers.Authorization = `Bearer ${cfg.apiKey}`;\n\n this.client = createClient<paths>({\n baseUrl: cfg.baseUrl.replace(/\\/+$/, ''),\n fetch: fetchImpl,\n headers\n });\n }\n\n /\n Issue one HTTP call against the typed client, with retries + error mapping.\n \n `fn` is invoked up to `maxRetries + 1` times. The timeout in `cfg.timeoutMs`\n * is enforced via `AbortController`.\n /\n async call<T>(fn: (signal: AbortSignal) => OpenapiCallResult<T>): Promise<T> {\n let lastError: GaruAPIError \| GaruConnectionError \| null = null;\n\n for (let attempt = 0; attempt <= this.cfg.maxRetries; attempt++) {\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), this.cfg.timeoutMs);\n\n try {\n const { data, error, response } = await fn(controller.signal);\n clearTimeout(timer);\n\n if (response.ok) {\n return data as T;\n }\n\n const requestId = response.headers.get('x-request-id');\n const retryAfterSec = parseRetryAfter(response.headers.get('retry-after'));\n const apiError = mapApiError(response.status, error ?? null, requestId, retryAfterSec);\n lastError = apiError;\n\n if (!RETRYABLE_STATUSES.has(response.status) \|\| attempt === this.cfg.maxRetries) {\n throw apiError;\n }\n\n await sleep(backoffDelay(attempt, retryAfterSec));\n continue;\n } catch (err) {\n clearTimeout(timer);\n\n if (isGaruApiError(err)) throw err;\n\n const connErr =\n err instanceof Error && err.name === 'AbortError'\n ? new GaruConnectionError(`Request timed out after ${this.cfg.timeoutMs}ms`, err)\n : new GaruConnectionError(err instanceof Error ? err.message : 'Network error', err);\n lastError = connErr;\n\n if (attempt === this.cfg.maxRetries) throw connErr;\n await sleep(backoffDelay(attempt, null));\n continue;\n }\n }\n\n // Unreachable — the loop always throws or returns on the final attempt.\n throw lastError ?? new GaruConnectionError('Request failed with no error captured');\n }\n}\n\nfunction isGaruApiError(err: unknown): boolean {\n return err instanceof Error && err.name.startsWith('Garu') && err.name.endsWith('Error');\n}\n\nfunction parseRetryAfter(value: string \| null): number \| null {\n if (!value) return null;\n const n = Number(value);\n return Number.isFinite(n) && n >= 0 ? n : null;\n}\n\n/\n Exponential backoff with full jitter. If the server returned `Retry-After`,\n * we honor it (with a small jitter).\n /\nfunction backoffDelay(attempt: number, retryAfterSec: number \| null): number {\n if (retryAfterSec !== null) {\n return retryAfterSec 1000 + Math.random() * 250;\n }\n const base = 500 * 2 ** attempt;\n const cap = 8000;\n return Math.min(cap, base) * Math.random();\n}\n\nfunction sleep(ms: number): Promise<void> {\n return new Promise((resolve) => setTimeout(resolve, ms));\n}\n","import { randomUUID } from 'node:crypto';\n\n/*\n Generate a UUIDv4 suitable for use as an `X-Idempotency-Key` header value.\n \n @example\n * const key = generateIdempotencyKey();\n * // '3b241101-e2bb-4255-8caf-4136c566a962'\n /\nexport function generateIdempotencyKey(): string {\n return randomUUID();\n}\n","/\n Public types for the Garu SDK.\n \n The wire-level types (`WireCreateTransactionRequest`, `WireMetaResponse`, ...)\n * are generated from the backend's OpenAPI spec and live in\n * `src/generated/schema.d.ts`. The friendly types in this file\n * (`CreateChargeParams`, `Customer`, `Charge`, ...) are hand-curated for\n * ergonomics — they rename `transactions` to `charges`, collapse wire enums\n * into readable unions, and mark only truly required fields as required.\n * The resource layer maps friendly → wire at the edge.\n /\n\nimport type { components } from './generated/schema.js';\n\nexport type WireCreateTransactionRequest = components['schemas']['CreateTransactionRequest'];\nexport type WireCustomerDto = components['schemas']['CustomerDto'];\nexport type WireCardInfoDto = components['schemas']['CardInfoDto'];\nexport type WireMetaResponse = components['schemas']['MetaResponse'];\n\nexport type PaymentMethod = 'pix' \| 'credit_card' \| 'boleto';\n\n/* Payment-method identifier as sent to the backend over the wire. /\nexport type WirePaymentMethodId = 'pix' \| 'creditcard' \| 'boleto';\n\nexport type ChargeStatus =\n \| 'pending'\n \| 'authorized'\n \| 'paid'\n \| 'failed'\n \| 'refunded'\n \| 'cancelled'\n \| 'expired';\n\nexport interface Customer {\n /* Full legal name. 3–255 chars. /\n name: string;\n email: string;\n /* CPF (11 digits) or CNPJ (14 digits), digits only. /\n document: string;\n /* 10 or 11 digits with area code, no formatting. /\n phone: string;\n /* 8 digits, no hyphen. Optional. /\n zipCode?: string;\n street?: string;\n number?: string;\n complement?: string;\n neighborhood?: string;\n city?: string;\n /* 2-letter uppercase state code, e.g. `SP`. /\n state?: string;\n}\n\nexport interface CardInfo {\n /* 13–19 digits, no spaces or hyphens. /\n cardNumber: string;\n /* 3 or 4 digits. /\n cvv: string;\n /* `YYYY-MM`. /\n expirationDate: string;\n /* As printed on the card. /\n holderName: string;\n /* 1–12. /\n installments: number;\n}\n\nexport interface CreateChargeParams {\n /* Customer buying the product. /\n customer: Customer;\n /* UUID of the product being charged. /\n productId: string;\n /* Payment method. /\n paymentMethod: PaymentMethod;\n /* Required when `paymentMethod` is `credit_card`. /\n cardInfo?: CardInfo;\n /* Free-form metadata attached to the charge. /\n additionalInfo?: string;\n /* Original checkout link, if any. /\n link?: string \| null;\n /* Associated affiliate ID, if any. /\n affiliateId?: number \| null;\n /* Subscription price ID (`price_`), for subscription charges only. /\n priceId?: string \| null;\n /** Optional pre-created checkout session token. /\n checkoutSessionToken?: string;\n /\n Idempotency key. If omitted, the SDK generates a UUIDv4.\n * Keys are valid for 24h on the backend.\n /\n idempotencyKey?: string;\n}\n\nexport interface Charge {\n id: number;\n status: ChargeStatus;\n amount: number;\n paymentMethodId: WirePaymentMethodId;\n /* ISO-8601. /\n date: string;\n /* ISO-8601. /\n deadline?: string;\n /* Product this charge belongs to. /\n product?: { id: number; uuid?: string; name?: string };\n [key: string]: unknown;\n}\n\nexport interface RefundChargeParams {\n /* Partial refund in centavos. Omit for full refund. /\n amount?: number;\n /* Free-form reason stored on the refund. /\n reason?: string;\n idempotencyKey?: string;\n}\n\nexport interface MetaFeatures {\n subscriptions: boolean;\n checkout_sessions: boolean;\n idempotency_keys: boolean;\n test_mode: boolean;\n webhooks: boolean;\n}\n\nexport interface MetaResponse {\n name: string;\n version: string;\n environment: 'production' \| 'staging' \| 'development' \| string;\n api_version: string;\n payment_methods: string[];\n currencies: string[];\n billing_intervals: string[];\n webhook_events: string[];\n features: MetaFeatures;\n docs_url: string;\n dashboard_url: string;\n support_email: string;\n}\n\n/* Map the SDK's friendly `PaymentMethod` to the backend's wire value. /\nexport function toWirePaymentMethod(pm: PaymentMethod): WirePaymentMethodId {\n return pm === 'credit_card' ? 'creditcard' : pm;\n}\n","import type { HttpClient } from '../http.js';\nimport type { components } from '../generated/schema.js';\nimport { generateIdempotencyKey } from '../idempotency.js';\nimport {\n toWirePaymentMethod,\n type Charge,\n type CreateChargeParams,\n type RefundChargeParams\n} from '../types.js';\n\ntype CreateTransactionBody = components['schemas']['CreateTransactionRequest'];\n\n/\n Charges — the core of the Garu API.\n \n A charge represents a single payment attempt against a product. The SDK\n * surfaces charges under `garu.charges` even though the backend route is\n * `/api/transactions` — this matches Stripe convention and is the name every\n * other Garu surface (MCP, CLI, docs) uses.\n /\nexport class Charges {\n constructor(private readonly http: HttpClient) {}\n\n /\n Create a charge (PIX, credit card, or boleto).\n \n Automatically attaches an `X-Idempotency-Key` header — if you don't pass\n * `idempotencyKey`, the SDK generates a UUIDv4. Safe to retry: the backend\n * caches the first response for 24h.\n \n @example\n * // PIX charge\n * const charge = await garu.charges.create({\n * productId: 'b3f2c1e8-6e4a-4b9f-9d1c-2a1f6c3d4e5f',\n * paymentMethod: 'pix',\n * customer: {\n * name: 'Maria Silva',\n * email: 'maria@exemplo.com.br',\n * document: '12345678909',\n * phone: '11987654321'\n * }\n * });\n * console.log(charge.id, charge.status);\n \n @example\n * // Credit card charge, 3 installments\n * const charge = await garu.charges.create({\n * productId: 'b3f2c1e8-6e4a-4b9f-9d1c-2a1f6c3d4e5f',\n * paymentMethod: 'credit_card',\n * customer: { name: 'Maria Silva', email: 'maria@exemplo.com.br', document: '12345678909', phone: '11987654321' },\n * cardInfo: {\n * cardNumber: '4111111111111111',\n * cvv: '123',\n * expirationDate: '2030-12',\n * holderName: 'MARIA SILVA',\n * installments: 3\n * }\n * });\n /\n async create(params: CreateChargeParams): Promise<Charge> {\n const idempotencyKey = params.idempotencyKey ?? generateIdempotencyKey();\n const body = this.buildCreateBody(params);\n\n return this.http.call<Charge>(\n (signal) =>\n this.http.client.POST('/api/transactions', {\n body,\n headers: { 'X-Idempotency-Key': idempotencyKey },\n signal\n }) as Promise<{ data?: Charge; error?: unknown; response: Response }>\n );\n }\n\n /\n Fetch a single charge by numeric ID.\n \n @example\n * const charge = await garu.charges.get(4472);\n * if (charge.status === 'paid') { ... }\n /\n async get(id: number): Promise<Charge> {\n return this.http.call<Charge>(\n (signal) =>\n this.http.client.GET('/api/transactions/{id}', {\n params: { path: { id } },\n signal\n }) as Promise<{ data?: Charge; error?: unknown; response: Response }>\n );\n }\n\n /\n Refund a charge — fully, or partially by passing `amount` in centavos.\n \n @example\n * // Full refund\n * await garu.charges.refund(4472);\n \n @example\n * // Partial refund of R$ 10,00\n * await garu.charges.refund(4472, { amount: 1000, reason: 'customer_request' });\n /\n async refund(id: number, params: RefundChargeParams = {}): Promise<Charge> {\n const idempotencyKey = params.idempotencyKey ?? generateIdempotencyKey();\n const body: Record<string, unknown> = {};\n if (params.amount !== undefined) body.amount = params.amount;\n if (params.reason !== undefined) body.reason = params.reason;\n\n return this.http.call<Charge>(\n (signal) =>\n this.http.client.POST('/api/transactions/{id}/refund', {\n params: { path: { id } },\n body: body as never,\n headers: { 'X-Idempotency-Key': idempotencyKey },\n signal\n }) as Promise<{ data?: Charge; error?: unknown; response: Response }>\n );\n }\n\n private buildCreateBody(params: CreateChargeParams): CreateTransactionBody {\n const body: Record<string, unknown> = {\n customer: params.customer,\n productId: params.productId,\n paymentMethodId: toWirePaymentMethod(params.paymentMethod),\n link: params.link ?? null,\n affiliateId: params.affiliateId ?? null\n };\n if (params.additionalInfo !== undefined) body.additionalInfo = params.additionalInfo;\n if (params.priceId !== undefined) body.priceId = params.priceId;\n if (params.checkoutSessionToken !== undefined) {\n body.checkoutSessionToken = params.checkoutSessionToken;\n }\n if (params.cardInfo) body.CardInfo = params.cardInfo;\n return body as unknown as CreateTransactionBody;\n }\n}\n","import type { HttpClient } from '../http.js';\nimport type { MetaResponse } from '../types.js';\n\n/\n Meta — capability introspection.\n \n Unauthenticated. Used by `garu doctor`, MCP tool `doctor`, and by SDK\n * consumers that want to know which payment methods and webhook events are\n * currently supported.\n /\nexport class Meta {\n constructor(private readonly http: HttpClient) {}\n\n /\n Fetch the API's current capability payload.\n \n @example\n * const meta = await garu.meta.get();\n * console.log(meta.version, meta.payment_methods);\n * if (meta.features.subscriptions) { ... }\n /\n async get(): Promise<MetaResponse> {\n return this.http.call<MetaResponse>(\n (signal) =>\n this.http.client.GET('/api/meta', { signal }) as Promise<{\n data?: MetaResponse;\n error?: unknown;\n response: Response;\n }>\n );\n }\n}\n","import { createHmac, timingSafeEqual } from 'node:crypto';\n\nimport { GaruSignatureVerificationError } from './errors.js';\n\nexport interface VerifyWebhookParams {\n /* Raw request body as received — do NOT re-serialize parsed JSON. /\n payload: string \| Buffer;\n /* Value of the `X-Garu-Signature` header. Format: `t=<ts>,v1=<hex>`. /\n signature: string;\n /* The webhook endpoint's signing secret. /\n secret: string;\n /* Reject signatures older than this many seconds. Default: 300 (5 min). /\n toleranceSec?: number;\n /* Injectable for tests. Defaults to `Date.now()`. /\n now?: () => number;\n}\n\nexport interface VerifiedWebhook {\n /* Timestamp from the signature header, in seconds since epoch. /\n timestamp: number;\n /* Parsed JSON body. Throws {@link GaruSignatureVerificationError} if invalid JSON. /\n event: unknown;\n}\n\n/\n Webhook helpers.\n \n Garu signs outgoing webhooks with HMAC-SHA256 over `${timestamp}.${payload}`\n * and delivers the signature in the `X-Garu-Signature` header as `t=<ts>,v1=<hex>`.\n * This matches the format in the backend's `webhook-delivery.service.ts`.\n \n @example\n * // Express example\n * app.post('/webhooks/garu', express.raw({ type: 'application/json' }), (req, res) => {\n * try {\n * const { event } = Garu.webhooks.verify({\n * payload: req.body,\n * signature: req.header('x-garu-signature') ?? '',\n * secret: process.env.GARU_WEBHOOK_SECRET!\n * });\n * // handle event\n * res.sendStatus(200);\n * } catch (err) {\n * res.sendStatus(400);\n * }\n * });\n /\nexport const webhooks = {\n verify(params: VerifyWebhookParams): VerifiedWebhook {\n const { signature, secret, payload } = params;\n const toleranceSec = params.toleranceSec ?? 300;\n const now = params.now ?? Date.now;\n\n if (!signature \|\| typeof signature !== 'string') {\n throw new GaruSignatureVerificationError('Missing or malformed X-Garu-Signature header');\n }\n\n const parts = parseSignatureHeader(signature);\n if (parts === null) {\n throw new GaruSignatureVerificationError(\n 'X-Garu-Signature header does not match expected format t=<ts>,v1=<hex>'\n );\n }\n\n const payloadStr = typeof payload === 'string' ? payload : payload.toString('utf8');\n const signedPayload = `${parts.timestamp}.${payloadStr}`;\n const expected = createHmac('sha256', secret).update(signedPayload).digest('hex');\n\n const expectedBuf = Buffer.from(expected, 'hex');\n const providedBuf = Buffer.from(parts.v1, 'hex');\n if (expectedBuf.length !== providedBuf.length \|\| !timingSafeEqual(expectedBuf, providedBuf)) {\n throw new GaruSignatureVerificationError('Signature does not match computed HMAC');\n }\n\n const nowSec = Math.floor(now() / 1000);\n if (Math.abs(nowSec - parts.timestamp) > toleranceSec) {\n throw new GaruSignatureVerificationError(\n `Signature timestamp outside tolerance window (${toleranceSec}s)`\n );\n }\n\n let event: unknown;\n try {\n event = JSON.parse(payloadStr);\n } catch {\n throw new GaruSignatureVerificationError('Webhook payload is not valid JSON');\n }\n\n return { timestamp: parts.timestamp, event };\n }\n};\n\nfunction parseSignatureHeader(header: string): { timestamp: number; v1: string } \| null {\n const fields: Record<string, string> = {};\n for (const part of header.split(',')) {\n const idx = part.indexOf('=');\n if (idx === -1) return null;\n const key = part.slice(0, idx).trim();\n const value = part.slice(idx + 1).trim();\n if (!key \|\| !value) return null;\n fields[key] = value;\n }\n const t = fields.t;\n const v1 = fields.v1;\n if (!t \|\| !v1) return null;\n const timestamp = Number(t);\n if (!Number.isFinite(timestamp) \|\| !/^[a-f0-9]+$/i.test(v1)) return null;\n return { timestamp, v1 };\n}\n","import { HttpClient } from './http.js';\nimport { Charges } from './resources/charges.js';\nimport { Meta } from './resources/meta.js';\nimport { webhooks } from './webhooks.js';\n\nexport interface GaruOptions {\n /\n Your Garu API key. `sk_live_…` for production, `sk_test_…` for test mode.\n * Optional — public endpoints (`meta.get`, public charge creation) work without one.\n /\n apiKey?: string;\n /* Override the API base URL. Default: `https://garu.com.br/api`. /\n baseUrl?: string;\n /* Per-request timeout in ms. Default: 30000. /\n timeoutMs?: number;\n /* Max retries on retryable errors (connection, 408, 429, 5xx). Default: 2. /\n maxRetries?: number;\n /* Injectable for tests. Defaults to `globalThis.fetch`. /\n fetch?: typeof fetch;\n}\n\nconst DEFAULT_BASE_URL = 'https://garu.com.br';\nconst DEFAULT_TIMEOUT_MS = 30_000;\nconst DEFAULT_MAX_RETRIES = 2;\nconst SDK_VERSION = '0.1.0';\n\n/\n The Garu SDK client.\n \n @example\n * import { Garu } from '@garuhq/node';\n \n const garu = new Garu({ apiKey: process.env.GARU_API_KEY });\n \n const charge = await garu.charges.create({\n * productId: 'b3f2c1e8-6e4a-4b9f-9d1c-2a1f6c3d4e5f',\n * paymentMethod: 'pix',\n * customer: {\n * name: 'Maria Silva',\n * email: 'maria@exemplo.com.br',\n * document: '12345678909',\n * phone: '11987654321'\n * }\n * });\n /\nexport class Garu {\n public readonly charges: Charges;\n public readonly meta: Meta;\n\n /\n Webhook helpers. Available both as an instance member and as a static —\n * `Garu.webhooks.verify(...)` works without constructing a client.\n */\n public static readonly webhooks = webhooks;\n public readonly webhooks = webhooks;\n\n constructor(options: GaruOptions = {}) {\n const http = new HttpClient({\n baseUrl: options.baseUrl ?? DEFAULT_BASE_URL,\n apiKey: options.apiKey,\n timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,\n maxRetries: options.maxRetries ?? DEFAULT_MAX_RETRIES,\n userAgent: `garu-node/${SDK_VERSION}`,\n fetch: options.fetch\n });\n this.charges = new Charges(http);\n this.meta = new Meta(http);\n }\n}\n"]}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@garuhq/node",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Official Node.js / TypeScript SDK for the Garu payment gateway.",
   "license": "MIT",
   "homepage": "https://garu.com.br",
@@ -52,9 +52,9 @@
   "devDependencies": {
     "@types/node": "20.12.7",
     "openapi-typescript": "7.4.2",
-    "tsup": "8.0.2",
+    "tsup": "8.5.1",
     "typescript": "5.4.5",
-    "vitest": "1.5.0"
+    "vitest": "3.2.4"
   },
   "dependencies": {
     "openapi-fetch": "0.9.7"