@getmandato/sdk 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Andrei Cotaga
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,80 @@
+# @getmandato/sdk
+
+Official Node.js SDK for the [Mandato](https://getmandato.dev) EU e-invoicing API.
+
+## Installation
+
+```bash
+npm install @getmandato/sdk
+```
+
+## Quick Start
+
+```typescript
+import { MandatoClient } from "@getmandato/sdk";
+
+const mandato = new MandatoClient({
+  apiKey: "sk_live_...",
+});
+
+// Create and submit an invoice
+const invoice = await mandato.invoices.create({
+  country: "RO",
+  supplier: {
+    vatNumber: "RO12345678",
+    name: "Acme SRL",
+    address: { street: "Str. Exemplu 1", city: "Bucharest", postalCode: "010101", country: "RO" },
+  },
+  customer: {
+    vatNumber: "RO87654321",
+    name: "Client SRL",
+  },
+  lines: [
+    { description: "Software license", quantity: 1, unitPrice: 500, vatRate: 19 },
+  ],
+});
+
+console.log(invoice.id);     // "inv_abc123"
+console.log(invoice.status); // "submitted"
+
+// Check status
+const status = await mandato.invoices.get(invoice.id);
+console.log(status.status);  // "accepted"
+console.log(status.govId);   // ANAF index number
+```
+
+## Features
+
+- Full TypeScript support with detailed types
+- Automatic retries on 429 and 5xx errors
+- Idempotency key generation
+- Webhook signature verification
+- Test and live environment support
+
+## Webhook Verification
+
+```typescript
+import { verifyWebhookSignature } from "@getmandato/sdk";
+
+app.post("/webhooks/mandato", (req) => {
+  const isValid = verifyWebhookSignature(
+    JSON.stringify(req.body),
+    req.headers["x-mandato-signature"],
+    process.env.WEBHOOK_SECRET,
+  );
+
+  if (!isValid) {
+    return res.status(401).send("Invalid signature");
+  }
+
+  // Handle the event
+});
+```
+
+## Documentation
+
+Full API documentation is available at [getmandato.dev/docs](https://getmandato.dev/docs).
+
+## License
+
+MIT

package/dist/index.cjs

@@ -0,0 +1,441 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  AuthenticationError: () => AuthenticationError,
+  ConflictError: () => ConflictError,
+  ForbiddenError: () => ForbiddenError,
+  MandatoClient: () => MandatoClient,
+  MandatoError: () => MandatoError,
+  MandatoHttpClient: () => MandatoHttpClient,
+  NotFoundError: () => NotFoundError,
+  RateLimitError: () => RateLimitError,
+  ServerError: () => ServerError,
+  ValidationError: () => ValidationError,
+  constructWebhookEvent: () => constructWebhookEvent,
+  verifyWebhookSignature: () => verifyWebhookSignature
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/config.ts
+var DEFAULTS = {
+  baseUrl: "https://api.getmandato.dev",
+  timeout: 3e4,
+  maxRetries: 3
+};
+
+// src/errors.ts
+var MandatoError = class extends Error {
+  /** HTTP status code */
+  status;
+  /** Error type from the API response */
+  type;
+  /** Request ID for support reference */
+  requestId;
+  constructor(message, status, type, requestId) {
+    super(message);
+    this.name = "MandatoError";
+    this.status = status;
+    this.type = type;
+    this.requestId = requestId;
+  }
+};
+var ValidationError = class extends MandatoError {
+  details;
+  constructor(message, details = [], requestId) {
+    super(message, 400, "validation_error", requestId);
+    this.name = "ValidationError";
+    this.details = details;
+  }
+};
+var AuthenticationError = class extends MandatoError {
+  constructor(message = "Invalid API key", requestId) {
+    super(message, 401, "authentication_error", requestId);
+    this.name = "AuthenticationError";
+  }
+};
+var ForbiddenError = class extends MandatoError {
+  constructor(message = "Forbidden", requestId) {
+    super(message, 403, "forbidden_error", requestId);
+    this.name = "ForbiddenError";
+  }
+};
+var NotFoundError = class extends MandatoError {
+  constructor(message = "Resource not found", requestId) {
+    super(message, 404, "not_found_error", requestId);
+    this.name = "NotFoundError";
+  }
+};
+var ConflictError = class extends MandatoError {
+  constructor(message = "Idempotency conflict", requestId) {
+    super(message, 409, "conflict_error", requestId);
+    this.name = "ConflictError";
+  }
+};
+var RateLimitError = class extends MandatoError {
+  /** Requests per minute allowed */
+  limit;
+  /** Seconds until the rate limit resets */
+  retryAfter;
+  constructor(message, limit, retryAfter, requestId) {
+    super(message, 429, "rate_limit_error", requestId);
+    this.name = "RateLimitError";
+    this.limit = limit;
+    this.retryAfter = retryAfter;
+  }
+};
+var ServerError = class extends MandatoError {
+  constructor(message = "Internal server error", status = 500, requestId) {
+    super(message, status, "server_error", requestId);
+    this.name = "ServerError";
+  }
+};
+
+// src/http.ts
+var MandatoHttpClient = class {
+  apiKey;
+  baseUrl;
+  timeout;
+  maxRetries;
+  constructor(config) {
+    this.apiKey = config.apiKey;
+    this.baseUrl = (config.baseUrl ?? DEFAULTS.baseUrl).replace(/\/+$/, "");
+    this.timeout = config.timeout ?? DEFAULTS.timeout;
+    this.maxRetries = config.maxRetries ?? DEFAULTS.maxRetries;
+  }
+  /** Make a GET request */
+  async get(path, params) {
+    const url = this.buildUrl(path, params);
+    return this.request("GET", url);
+  }
+  /** Make a POST request */
+  async post(path, body, headers) {
+    const url = this.buildUrl(path);
+    return this.request("POST", url, body, headers);
+  }
+  /** Make a PATCH request */
+  async patch(path, body) {
+    const url = this.buildUrl(path);
+    return this.request("PATCH", url, body);
+  }
+  /** Make a DELETE request */
+  async delete(path) {
+    const url = this.buildUrl(path);
+    return this.request("DELETE", url);
+  }
+  /** Build full URL with optional query params */
+  buildUrl(path, params) {
+    const url = new URL(`${this.baseUrl}${path}`);
+    if (params) {
+      for (const [key, value] of Object.entries(params)) {
+        if (value !== void 0) {
+          url.searchParams.set(key, String(value));
+        }
+      }
+    }
+    return url.toString();
+  }
+  /** Execute an HTTP request with retries and error mapping */
+  async request(method, url, body, extraHeaders) {
+    let lastError;
+    for (let attempt = 0; attempt <= this.maxRetries; attempt++) {
+      if (attempt > 0) {
+        const delay = Math.min(500 * 2 ** (attempt - 1), 1e4);
+        await sleep(delay);
+      }
+      try {
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), this.timeout);
+        const headers = {
+          Authorization: `Bearer ${this.apiKey}`,
+          "Content-Type": "application/json",
+          ...extraHeaders
+        };
+        const init = {
+          method,
+          headers,
+          signal: controller.signal
+        };
+        if (body !== void 0 && method !== "GET") {
+          init.body = JSON.stringify(body);
+        }
+        const response = await fetch(url, init);
+        clearTimeout(timeoutId);
+        if (response.ok) {
+          return await response.json();
+        }
+        const errorBody = await this.parseErrorBody(response);
+        const requestId = errorBody?.error?.requestId;
+        if (response.status === 400) {
+          throw new ValidationError(
+            errorBody?.error?.message ?? "Validation error",
+            errorBody?.error?.details,
+            requestId
+          );
+        }
+        if (response.status === 401) {
+          throw new AuthenticationError(errorBody?.error?.message, requestId);
+        }
+        if (response.status === 403) {
+          throw new ForbiddenError(errorBody?.error?.message, requestId);
+        }
+        if (response.status === 404) {
+          throw new NotFoundError(errorBody?.error?.message, requestId);
+        }
+        if (response.status === 409) {
+          throw new ConflictError(errorBody?.error?.message, requestId);
+        }
+        if (response.status === 429) {
+          const limitHeader = response.headers.get("X-RateLimit-Limit");
+          const retryAfter = response.headers.get("Retry-After");
+          lastError = new RateLimitError(
+            errorBody?.error?.message ?? "Rate limit exceeded",
+            limitHeader ? Number(limitHeader) : void 0,
+            retryAfter ? Number(retryAfter) : void 0,
+            requestId
+          );
+          continue;
+        }
+        if (response.status >= 500) {
+          lastError = new ServerError(
+            errorBody?.error?.message ?? "Server error",
+            response.status,
+            requestId
+          );
+          continue;
+        }
+        throw new MandatoError(
+          errorBody?.error?.message ?? `HTTP ${response.status}`,
+          response.status,
+          errorBody?.error?.type ?? "unknown_error",
+          requestId
+        );
+      } catch (error) {
+        if (error instanceof MandatoError && !(error instanceof RateLimitError) && !(error instanceof ServerError)) {
+          throw error;
+        }
+        if (error instanceof Error && error.name === "AbortError") {
+          lastError = new MandatoError("Request timeout", 0, "timeout_error");
+          continue;
+        }
+        if (error instanceof MandatoError) {
+          lastError = error;
+          continue;
+        }
+        lastError = error instanceof Error ? error : new Error(String(error));
+      }
+    }
+    throw lastError ?? new MandatoError("Request failed after retries", 0, "retry_exhausted");
+  }
+  /** Safely parse error response body */
+  async parseErrorBody(response) {
+    try {
+      return await response.json();
+    } catch {
+      return null;
+    }
+  }
+};
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/resources/api-keys.ts
+var ApiKeys = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /** List API keys (masked) */
+  async list() {
+    return this.http.get("/v1/api-keys");
+  }
+  /** Create a new API key (full key returned once) */
+  async create(data) {
+    return this.http.post("/v1/api-keys", data);
+  }
+  /** Revoke an API key */
+  async revoke(id) {
+    return this.http.delete(`/v1/api-keys/${id}`);
+  }
+};
+
+// src/resources/companies.ts
+var Companies = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /** Create a company */
+  async create(data) {
+    return this.http.post("/v1/companies", data);
+  }
+  /** List all companies */
+  async list() {
+    return this.http.get("/v1/companies");
+  }
+  /** Get a single company by ID */
+  async get(id) {
+    return this.http.get(`/v1/companies/${id}`);
+  }
+  /** Update a company */
+  async update(id, data) {
+    return this.http.patch(`/v1/companies/${id}`, data);
+  }
+  /** Delete a company */
+  async delete(id) {
+    return this.http.delete(`/v1/companies/${id}`);
+  }
+};
+
+// src/resources/connections.ts
+var Connections = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /** Initialize a government connection */
+  async create(data) {
+    return this.http.post("/v1/connections", data);
+  }
+  /** List all connections */
+  async list() {
+    return this.http.get("/v1/connections");
+  }
+  /** Get a single connection by ID */
+  async get(id) {
+    return this.http.get(`/v1/connections/${id}`);
+  }
+  /** Remove a connection */
+  async delete(id) {
+    return this.http.delete(`/v1/connections/${id}`);
+  }
+};
+
+// src/resources/invoices.ts
+var Invoices = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /** Create and submit an invoice */
+  async create(data, idempotencyKey) {
+    const headers = {};
+    if (idempotencyKey) {
+      headers["X-Idempotency-Key"] = idempotencyKey;
+    }
+    return this.http.post("/v1/invoices", data, headers);
+  }
+  /** List invoices with optional filters */
+  async list(params) {
+    return this.http.get(
+      "/v1/invoices",
+      params
+    );
+  }
+  /** Get a single invoice by ID */
+  async get(id) {
+    return this.http.get(`/v1/invoices/${id}`);
+  }
+  /** Dry-run validation without submission */
+  async validate(data) {
+    return this.http.post("/v1/invoices/validate", data);
+  }
+  /** Get invoice event timeline */
+  async getEvents(id) {
+    return this.http.get(`/v1/invoices/${id}/events`);
+  }
+};
+
+// src/resources/webhooks.ts
+var Webhooks = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /** Register a webhook URL */
+  async create(data) {
+    return this.http.post("/v1/webhooks", data);
+  }
+  /** Get current webhook configuration */
+  async get() {
+    return this.http.get("/v1/webhooks");
+  }
+  /** Remove webhook */
+  async delete() {
+    return this.http.delete("/v1/webhooks");
+  }
+};
+
+// src/client.ts
+var MandatoClient = class {
+  /** Invoice operations */
+  invoices;
+  /** Company operations */
+  companies;
+  /** Connection operations */
+  connections;
+  /** Webhook operations */
+  webhooks;
+  /** API key operations */
+  apiKeys;
+  http;
+  constructor(config) {
+    this.http = new MandatoHttpClient(config);
+    this.invoices = new Invoices(this.http);
+    this.companies = new Companies(this.http);
+    this.connections = new Connections(this.http);
+    this.webhooks = new Webhooks(this.http);
+    this.apiKeys = new ApiKeys(this.http);
+  }
+  /** Check API health */
+  async health() {
+    return this.http.get("/v1/health");
+  }
+};
+
+// src/webhooks.ts
+var import_node_crypto = require("crypto");
+function verifyWebhookSignature(payload, signature, secret) {
+  const expected = (0, import_node_crypto.createHmac)("sha256", secret).update(payload).digest("hex");
+  const sigBuffer = Buffer.from(signature, "utf-8");
+  const expectedBuffer = Buffer.from(expected, "utf-8");
+  if (sigBuffer.length !== expectedBuffer.length) {
+    return false;
+  }
+  return (0, import_node_crypto.timingSafeEqual)(sigBuffer, expectedBuffer);
+}
+function constructWebhookEvent(payload, signature, secret) {
+  if (!verifyWebhookSignature(payload, signature, secret)) {
+    throw new Error("Invalid webhook signature");
+  }
+  return JSON.parse(payload);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AuthenticationError,
+  ConflictError,
+  ForbiddenError,
+  MandatoClient,
+  MandatoError,
+  MandatoHttpClient,
+  NotFoundError,
+  RateLimitError,
+  ServerError,
+  ValidationError,
+  constructWebhookEvent,
+  verifyWebhookSignature
+});