@gopaycz/gopay-js-sdk 1.6.6

package/dist/index.js

@@ -0,0 +1,1135 @@
+// ../internal/core/dist/index.js
+var GoPayErrorCodes = {
+  // Authentication errors
+  /** No access token in store — call authenticate() or setClientToken() */
+  AUTH_TOKEN_MISSING: "AUTH_TOKEN_MISSING",
+  /** Re-authentication (client_credentials grant) failed */
+  AUTH_REFRESH_FAILED: "AUTH_REFRESH_FAILED",
+  /** Token response from server is missing required fields */
+  AUTH_INVALID_RESPONSE: "AUTH_INVALID_RESPONSE",
+  /** No client credentials stored — call authenticate() first */
+  AUTH_CREDENTIALS_MISSING: "AUTH_CREDENTIALS_MISSING",
+  /** Access token JWT is malformed or missing the sub claim */
+  AUTH_INVALID_TOKEN: "AUTH_INVALID_TOKEN",
+  /** Request was unauthorized even after a successful token refresh */
+  AUTH_UNAUTHORIZED: "AUTH_UNAUTHORIZED",
+  // Network errors
+  /** Request timed out */
+  NETWORK_TIMEOUT: "NETWORK_TIMEOUT",
+  /** Network-level failure (no response received) */
+  NETWORK_ERROR: "NETWORK_ERROR",
+  // Card form errors
+  /** The GoPay card encryption iframe reported an error */
+  CARD_FORM_ERROR: "CARD_FORM_ERROR",
+  /** mountCardForm() was called while a session is already active — call unmount() first */
+  CARD_FORM_ALREADY_MOUNTED: "CARD_FORM_ALREADY_MOUNTED",
+  // Charge polling errors
+  /** Charge did not leave REQUESTED/PROCESSING within the initial timeout */
+  CHARGE_TIMEOUT: "CHARGE_TIMEOUT",
+  /** Charge reached terminal FAILED state */
+  CHARGE_FAILED: "CHARGE_FAILED",
+  // Browser SDK payment attachment
+  /** attachPayment() must be called before payment-scoped operations (charge, Apple/Google Pay, status) */
+  PAYMENT_NOT_ATTACHED: "PAYMENT_NOT_ATTACHED",
+  // Wallet button errors (mountApplePayButton / mountGooglePayButton)
+  /** The Apple Pay or Google Pay button encountered an error (unavailable, script load failure, charge error) */
+  WALLET_BUTTON_ERROR: "WALLET_BUTTON_ERROR",
+  // Usage errors
+  /** SDK configuration is invalid (e.g. malformed baseUrl, wrong runtime environment) */
+  INVALID_CONFIG: "INVALID_CONFIG",
+  /** A required argument is missing or invalid */
+  INVALID_ARGUMENT: "INVALID_ARGUMENT"
+};
+var GoPaySDKError = class extends Error {
+  constructor(message, options) {
+    super(message);
+    this.name = "GoPaySDKError";
+    if (options?.cause !== void 0) {
+      this.cause = options.cause;
+    }
+    this.errorCode = options?.errorCode;
+  }
+};
+var GoPayHTTPError = class extends Error {
+  constructor(status, body) {
+    super(`GoPay API error: HTTP ${status}`);
+    this.status = status;
+    this.body = body;
+    this.name = "GoPayHTTPError";
+  }
+};
+function awaitCharge(poll, options) {
+  const intervalMs = options?.intervalMs ?? 2e3;
+  const initialTimeoutMs = options?.initialTimeoutMs ?? 3e4;
+  if (options?.signal?.aborted) {
+    return Promise.reject(
+      new GoPaySDKError("[GoPaySDK] Charge polling aborted.", {
+        errorCode: GoPayErrorCodes.CHARGE_FAILED
+      })
+    );
+  }
+  return new Promise((resolve, reject) => {
+    let stopped = false;
+    let lastActionRequiredUrl = null;
+    const stop = (fn) => {
+      if (stopped) {
+        return;
+      }
+      stopped = true;
+      clearTimeout(initialTimer);
+      options?.signal?.removeEventListener("abort", onAbort);
+      fn();
+    };
+    let onAbort;
+    onAbort = () => {
+      stop(
+        () => reject(
+          new GoPaySDKError("[GoPaySDK] Charge polling aborted.", {
+            errorCode: GoPayErrorCodes.CHARGE_FAILED
+          })
+        )
+      );
+    };
+    options?.signal?.addEventListener("abort", onAbort, { once: true });
+    const initialTimer = setTimeout(() => {
+      stop(
+        () => reject(
+          new GoPaySDKError(
+            "[GoPaySDK] Charge did not progress within the initial timeout",
+            { errorCode: GoPayErrorCodes.CHARGE_TIMEOUT }
+          )
+        )
+      );
+    }, initialTimeoutMs);
+    const doPoll = () => {
+      if (stopped) {
+        return;
+      }
+      poll().then((state) => {
+        if (stopped) {
+          return;
+        }
+        options?.onStateChange?.(state);
+        if (state.state === "SUCCEEDED") {
+          stop(() => resolve(state));
+          return;
+        }
+        if (state.state === "FAILED") {
+          stop(
+            () => reject(
+              new GoPaySDKError("[GoPaySDK] Charge failed", {
+                errorCode: GoPayErrorCodes.CHARGE_FAILED
+              })
+            )
+          );
+          return;
+        }
+        if (state.state === "ACTION_REQUIRED") {
+          clearTimeout(initialTimer);
+          if (state.action?.redirect_url && state.action.redirect_url !== lastActionRequiredUrl) {
+            lastActionRequiredUrl = state.action.redirect_url;
+            options?.onActionRequired?.(
+              state.action.redirect_url
+            );
+          }
+        }
+        setTimeout(doPoll, intervalMs);
+      }).catch((err) => {
+        if (stopped) {
+          return;
+        }
+        stop(() => reject(err));
+      });
+    };
+    doPoll();
+  });
+}
+var BASE_URLS = {
+  sandbox: "https://api.sandbox.gopay.com/api/merchant/payments/4.0",
+  production: "https://api.gopay.com/api/merchant/payments/4.0"
+};
+function resolveBaseUrl(config) {
+  const rawBaseUrl = config.baseUrl ?? BASE_URLS[config.environment ?? "sandbox"];
+  if (config.baseUrl) {
+    let parsed;
+    try {
+      parsed = new URL(config.baseUrl);
+    } catch {
+      throw new GoPaySDKError(
+        `[GoPaySDK] config.baseUrl is not a valid URL: "${config.baseUrl}"`,
+        { errorCode: GoPayErrorCodes.INVALID_CONFIG }
+      );
+    }
+    const isLocalhost = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "::1";
+    const isInsecureAllowed = (config.environment ?? "sandbox") === "sandbox" && isLocalhost;
+    if (parsed.protocol !== "https:" && !isInsecureAllowed) {
+      throw new GoPaySDKError(
+        `[GoPaySDK] config.baseUrl must use HTTPS. Got "${config.baseUrl}". Plain HTTP is only permitted for localhost in the sandbox environment.`,
+        { errorCode: GoPayErrorCodes.INVALID_CONFIG }
+      );
+    }
+  }
+  return rawBaseUrl;
+}
+function buildUrl(baseUrl, path) {
+  const base = baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`;
+  const relative = path.startsWith("/") ? path.slice(1) : path;
+  return new URL(relative, base).toString();
+}
+var MAX_RETRIES = 2;
+var IDEMPOTENT_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS", "PUT", "DELETE"]);
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+async function fetchWithRetry(url, init, timeoutMs) {
+  const method = (init?.method ?? "GET").toUpperCase();
+  const isIdempotent = IDEMPOTENT_METHODS.has(method);
+  let lastResponse;
+  let lastError;
+  for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+    if (attempt > 0) {
+      await sleep(2 ** (attempt - 1) * 200);
+    }
+    try {
+      const response = await fetch(
+        new Request(url, {
+          ...init,
+          signal: AbortSignal.timeout(timeoutMs)
+        })
+      );
+      if (response.status < 500) {
+        return response;
+      }
+      if (!isIdempotent) {
+        return response;
+      }
+      lastResponse = response;
+    } catch (err) {
+      if (err instanceof Error && err.name === "TimeoutError") {
+        throw err;
+      }
+      if (!isIdempotent) {
+        throw err;
+      }
+      lastError = err;
+    }
+  }
+  if (lastResponse !== void 0) {
+    return lastResponse;
+  }
+  throw lastError;
+}
+async function parseBody(response) {
+  const text = await response.text();
+  const contentType = response.headers.get("content-type") ?? "";
+  if (!contentType.includes("application/json")) {
+    return text;
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+var AUTH_PATH = "/oauth2/token";
+function createAuthHandler(deps) {
+  const reAuth = deps.reAuthAction ?? "Call authenticate() again.";
+  let refreshPromise = null;
+  async function injectAuth(headers, url, options) {
+    if (options?.headers) {
+      for (const [k, v] of Object.entries(options.headers)) {
+        headers.set(k, v);
+      }
+    }
+    if (url.includes(AUTH_PATH)) {
+      return;
+    }
+    if (headers.has("Authorization")) {
+      return;
+    }
+    if (options?.accessToken) {
+      headers.set("Authorization", `Bearer ${options.accessToken}`);
+      return;
+    }
+    if (deps.store.isExpiringSoon()) {
+      await refresh();
+    }
+    const tokens = deps.store.get();
+    if (!tokens) {
+      const shareableKey = deps.getShareableKey?.();
+      if (shareableKey) {
+        const clientId = deps.getClientId?.();
+        const credentials = clientId ? globalThis.btoa(`${clientId}:${shareableKey}`) : globalThis.btoa(`:${shareableKey}`);
+        headers.set("Authorization", `Basic ${credentials}`);
+        return;
+      }
+      deps.emitError(
+        new GoPaySDKError(
+          `[GoPaySDK] No access token available. ${reAuth}`,
+          { errorCode: GoPayErrorCodes.AUTH_TOKEN_MISSING }
+        )
+      );
+    }
+    headers.set("Authorization", `Bearer ${tokens.access_token}`);
+  }
+  async function fetchAndHandle401(url, init) {
+    const { getTimeoutMs, debugLogResponse, store, emitError } = deps;
+    const timeoutMs = getTimeoutMs();
+    let response = await fetchWithRetry(url, init, timeoutMs);
+    debugLogResponse(response);
+    if (response.status !== 401 || url.includes(AUTH_PATH)) {
+      return response;
+    }
+    await refresh();
+    const fresh = store.get();
+    if (!fresh) {
+      return response;
+    }
+    const retryHeaders = new Headers(init.headers);
+    retryHeaders.set("Authorization", `Bearer ${fresh.access_token}`);
+    response = await fetch(
+      new Request(url, {
+        ...init,
+        headers: retryHeaders,
+        signal: AbortSignal.timeout(timeoutMs)
+      })
+    );
+    debugLogResponse(response);
+    if (response.status === 401) {
+      store.clear();
+      emitError(
+        new GoPaySDKError(
+          "[GoPaySDK] Request unauthorized after token refresh. Check OAuth2 scopes.",
+          { errorCode: GoPayErrorCodes.AUTH_UNAUTHORIZED }
+        )
+      );
+    }
+    return response;
+  }
+  async function refresh() {
+    if (refreshPromise) {
+      return refreshPromise;
+    }
+    refreshPromise = doRefresh().finally(() => {
+      refreshPromise = null;
+    });
+    return refreshPromise;
+  }
+  async function doRefresh() {
+    const { store, baseUrl, emitError, getTimeoutMs } = deps;
+    const clientId = store.getClientId();
+    const clientSecret = store.getClientSecret();
+    const storedScope = store.getScope();
+    if (!clientId || !clientSecret || !storedScope) {
+      store.clear();
+      return emitError(
+        new GoPaySDKError(
+          `[GoPaySDK] Access token expired and no client credentials available. ${reAuth}`,
+          { errorCode: GoPayErrorCodes.AUTH_CREDENTIALS_MISSING }
+        )
+      );
+    }
+    try {
+      const url = buildUrl(baseUrl, AUTH_PATH);
+      const form = {
+        grant_type: "client_credentials",
+        scope: storedScope
+      };
+      const credentials = globalThis.btoa(`${clientId}:${clientSecret}`);
+      const headers = new Headers({
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+        Authorization: `Basic ${credentials}`
+      });
+      const response = await fetch(
+        new Request(url, {
+          method: "POST",
+          headers,
+          body: new URLSearchParams(form).toString(),
+          signal: AbortSignal.timeout(getTimeoutMs())
+        })
+      );
+      if (!response.ok) {
+        throw new GoPayHTTPError(
+          response.status,
+          await parseBody(response)
+        );
+      }
+      const body = await response.json();
+      const { access_token, expires_in } = body;
+      if (typeof access_token !== "string" || !access_token || typeof expires_in !== "number") {
+        throw new GoPaySDKError(
+          "[GoPaySDK] Invalid token response: missing required fields.",
+          { errorCode: GoPayErrorCodes.AUTH_INVALID_RESPONSE }
+        );
+      }
+      store.set({
+        access_token,
+        expires_in,
+        token_type: "bearer"
+      });
+    } catch (cause) {
+      store.clear();
+      emitError(
+        new GoPaySDKError(
+          `[GoPaySDK] Token refresh failed. ${reAuth}`,
+          { cause, errorCode: GoPayErrorCodes.AUTH_REFRESH_FAILED }
+        )
+      );
+    }
+  }
+  return { injectAuth, fetchAndHandle401, refresh };
+}
+function createTokenStore() {
+  let tokens = null;
+  let clientId = null;
+  let clientSecret = null;
+  let scope = null;
+  return {
+    get() {
+      return tokens;
+    },
+    getClientId() {
+      return clientId;
+    },
+    getClientSecret() {
+      return clientSecret;
+    },
+    getScope() {
+      return scope;
+    },
+    setClientSecret(id, secret, tokenScope) {
+      clientId = id;
+      clientSecret = secret;
+      scope = tokenScope ?? null;
+      tokens = null;
+    },
+    setClientId(id) {
+      clientId = id;
+      clientSecret = null;
+      scope = null;
+      tokens = null;
+    },
+    set(pair) {
+      tokens = { ...pair, issued_at: Date.now() };
+    },
+    clear() {
+      tokens = null;
+      clientId = null;
+      clientSecret = null;
+      scope = null;
+    },
+    hasAccessToken() {
+      return tokens !== null;
+    },
+    isExpiringSoon(bufferSeconds = 30) {
+      if (!tokens) {
+        return false;
+      }
+      const expiresAt = tokens.issued_at + tokens.expires_in * 1e3;
+      return Date.now() >= expiresAt - bufferSeconds * 1e3;
+    }
+  };
+}
+function createHttpClient(config, reAuthAction) {
+  const baseUrl = resolveBaseUrl(config);
+  const tokenStore = createTokenStore();
+  let shareableKey = config.shareableKey;
+  const auth = createAuthHandler({
+    store: tokenStore,
+    baseUrl,
+    emitError: (e) => emitError(e),
+    getTimeoutMs: () => timeoutMs(),
+    debugLogResponse: (r) => debugLogResponse(r),
+    getShareableKey: () => shareableKey,
+    getClientId: () => tokenStore.getClientId(),
+    reAuthAction
+  });
+  function timeoutMs() {
+    return config.requestTimeoutMs ?? 1e4;
+  }
+  function debugLogRequest(method, url) {
+    if (config.debugLoggingEnabled) {
+      console.debug("[GoPaySDK] \u2192", method, url);
+    }
+  }
+  function debugLogResponse(response) {
+    if (config.debugLoggingEnabled) {
+      console.debug("[GoPaySDK] \u2190", response.status, response.url);
+    }
+  }
+  function emitError(error) {
+    config.onError?.(error);
+    throw error;
+  }
+  function handleError(err) {
+    if (err instanceof GoPaySDKError) {
+      throw err;
+    }
+    if (err instanceof GoPayHTTPError) {
+      throw err;
+    }
+    if (err instanceof Error && err.name === "TimeoutError") {
+      return emitError(
+        new GoPaySDKError("[GoPaySDK] Request timed out.", {
+          errorCode: GoPayErrorCodes.NETWORK_TIMEOUT
+        })
+      );
+    }
+    if (err instanceof Error) {
+      return emitError(
+        new GoPaySDKError(`[GoPaySDK] Network error: ${err.message}`, {
+          cause: err,
+          errorCode: GoPayErrorCodes.NETWORK_ERROR
+        })
+      );
+    }
+    throw err;
+  }
+  async function throwIfNotOk(response) {
+    if (response.ok) {
+      return;
+    }
+    const body = await parseBody(response);
+    emitError(new GoPayHTTPError(response.status, body));
+  }
+  return {
+    baseUrl,
+    tokenStore,
+    setToken(pair) {
+      tokenStore.set(pair);
+    },
+    setClientId(clientId) {
+      tokenStore.setClientId(clientId);
+    },
+    setClientCredentials(clientId, clientSecret, scope) {
+      tokenStore.setClientSecret(clientId, clientSecret, scope);
+    },
+    getClientId() {
+      return tokenStore.getClientId();
+    },
+    getShareableKey() {
+      return shareableKey;
+    },
+    setShareableKey(key) {
+      shareableKey = key;
+    },
+    getClientCredentials() {
+      const clientId = tokenStore.getClientId();
+      const clientSecret = tokenStore.getClientSecret();
+      if (!clientId || !clientSecret) {
+        return null;
+      }
+      return { clientId, clientSecret };
+    },
+    isAuthenticated() {
+      return tokenStore.hasAccessToken();
+    },
+    getTokens() {
+      return tokenStore.get();
+    },
+    getEnvironment() {
+      return config.environment ?? "sandbox";
+    },
+    clearTokens() {
+      tokenStore.clear();
+    },
+    emitError,
+    async get(path, options) {
+      try {
+        const url = buildUrl(baseUrl, path);
+        const headers = new Headers({ Accept: "application/json" });
+        await auth.injectAuth(headers, url, options);
+        debugLogRequest("GET", url);
+        const response = await auth.fetchAndHandle401(url, {
+          method: "GET",
+          headers
+        });
+        await throwIfNotOk(response);
+        return await response.json();
+      } catch (err) {
+        return handleError(err);
+      }
+    },
+    async post(path, body, options) {
+      try {
+        const url = buildUrl(baseUrl, path);
+        const headers = new Headers({
+          Accept: "application/json",
+          "Content-Type": "application/json"
+        });
+        await auth.injectAuth(headers, url, options);
+        debugLogRequest("POST", url);
+        const response = await auth.fetchAndHandle401(url, {
+          method: "POST",
+          headers,
+          body: JSON.stringify(body)
+        });
+        await throwIfNotOk(response);
+        return await response.json();
+      } catch (err) {
+        return handleError(err);
+      }
+    },
+    async delete(path, options) {
+      try {
+        const url = buildUrl(baseUrl, path);
+        const headers = new Headers();
+        await auth.injectAuth(headers, url, options);
+        debugLogRequest("DELETE", url);
+        const response = await auth.fetchAndHandle401(url, {
+          method: "DELETE",
+          headers
+        });
+        await throwIfNotOk(response);
+      } catch (err) {
+        return handleError(err);
+      }
+    },
+    async postForm(path, form, options) {
+      try {
+        const url = buildUrl(baseUrl, path);
+        const headers = new Headers({
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json"
+        });
+        if (options?.headers) {
+          for (const [k, v] of Object.entries(options.headers)) {
+            headers.set(k, v);
+          }
+        }
+        await auth.injectAuth(headers, url, options);
+        debugLogRequest("POST", url);
+        const bodyStr = new URLSearchParams(form).toString();
+        const response = await fetch(
+          new Request(url, {
+            method: "POST",
+            headers,
+            body: bodyStr,
+            signal: AbortSignal.timeout(timeoutMs())
+          })
+        );
+        debugLogResponse(response);
+        await throwIfNotOk(response);
+        return await response.json();
+      } catch (err) {
+        return handleError(err);
+      }
+    }
+  };
+}
+function requireNonEmptyString(value, field) {
+  if (typeof value !== "string" || !value.trim()) {
+    throw new GoPaySDKError(`[GoPaySDK] ${field} is required`, {
+      errorCode: GoPayErrorCodes.INVALID_ARGUMENT
+    });
+  }
+  return value.trim();
+}
+function assertHttpsOrigin(origin, errorPrefix) {
+  let parsed;
+  try {
+    parsed = new URL(origin);
+  } catch {
+    throw new GoPaySDKError(`${errorPrefix}: invalid origin "${origin}"`, {
+      errorCode: GoPayErrorCodes.INVALID_ARGUMENT
+    });
+  }
+  if (parsed.protocol !== "https:" || parsed.origin !== origin) {
+    throw new GoPaySDKError(
+      `${errorPrefix}: origin must be an https: origin. Got "${origin}"`,
+      { errorCode: GoPayErrorCodes.INVALID_ARGUMENT }
+    );
+  }
+}
+
+// src/modules/auth/auth.module.ts
+function createAuthApi(client) {
+  return {
+    /**
+     * Authenticate the server-side SDK instance using client credentials.
+     *
+     * Stores the resulting access token internally. All subsequent API calls
+     * will attach the Bearer token automatically.
+     *
+     * The token is intentionally **not** returned — tokens must remain
+     * server-side only and must never be exposed to callers or logged.
+     * Use `isAuthenticated()` to confirm the SDK is ready.
+     *
+     * POST /oauth2/token (`client_credentials` grant)
+     *
+     * @throws {@link GoPaySDKError} with `AUTH_INVALID_RESPONSE` if the token
+     *   response is missing required fields.
+     */
+    async authenticate(params) {
+      const form = {
+        grant_type: params.grant_type,
+        scope: params.scope
+      };
+      const raw = `${params.client_id}:${params.client_secret}`;
+      const headers = {
+        Authorization: `Basic ${globalThis.btoa(raw)}`
+      };
+      client.setClientCredentials(
+        params.client_id,
+        params.client_secret,
+        params.scope
+      );
+      const tokenPair = await client.postForm(
+        "/oauth2/token",
+        form,
+        { headers }
+      );
+      if (!tokenPair.access_token || tokenPair.expires_in === void 0) {
+        throw client.emitError(
+          new GoPaySDKError(
+            "[GoPaySDK] Invalid token response: missing required fields.",
+            { errorCode: GoPayErrorCodes.AUTH_INVALID_RESPONSE }
+          )
+        );
+      }
+      client.setToken({
+        access_token: tokenPair.access_token,
+        expires_in: tokenPair.expires_in,
+        token_type: "bearer"
+      });
+    },
+    /**
+     * Returns `true` if a token pair is currently stored (the SDK is
+     * authenticated). Does not check expiry — expired tokens are refreshed
+     * transparently on the next API call.
+     */
+    isAuthenticated() {
+      return client.isAuthenticated();
+    },
+    /**
+     * Clear all stored tokens and credentials.
+     * After calling this, all API calls will throw until the SDK is
+     * re-authenticated via `authenticate()`.
+     */
+    logout() {
+      client.clearTokens();
+    },
+    /**
+     * Store the shareable key on the SDK instance.
+     * Useful when the key is obtained separately from the SDK config
+     * (e.g. entered at runtime in a dev tool or fetched from an admin API).
+     */
+    setShareableKey(key) {
+      client.setShareableKey(key);
+    },
+    getBrowserKeys() {
+      const shareableKey = client.getShareableKey();
+      const clientId = client.getClientId();
+      if (!shareableKey || !clientId) {
+        throw client.emitError(
+          new GoPaySDKError(
+            "[GoPaySDK] getBrowserKeys() requires shareableKey in config and a prior authenticate() call.",
+            { errorCode: GoPayErrorCodes.AUTH_CREDENTIALS_MISSING }
+          )
+        );
+      }
+      return { shareable_key: shareableKey, client_id: clientId };
+    }
+  };
+}
+
+// src/modules/cards/cards.module.ts
+function createCardsApi(client) {
+  return {
+    /**
+     * Retrieve details of a stored permanent card token.
+     * Requires the `card:read` OAuth2 scope.
+     *
+     * GET /cards/tokens/{card_id}
+     *
+     * @param cardId - Unique identifier of the stored card token
+     */
+    async getCardDetails(cardId) {
+      const cid = requireNonEmptyString(cardId, "cardId");
+      return client.get(`/cards/tokens/${cid}`);
+    },
+    /**
+     * Delete a stored permanent card token.
+     *
+     * DELETE /cards/tokens/{card_id}
+     *
+     * @param cardId - Unique identifier of the stored card token
+     */
+    async deleteCard(cardId) {
+      const cid = requireNonEmptyString(cardId, "cardId");
+      return client.delete(`/cards/tokens/${cid}`);
+    },
+    /**
+     * Tokenize an encrypted card payload received from the browser
+     * (via `mountCardForm` flow: `'return-payload'`).
+     * Requires the `card:write` OAuth2 scope.
+     *
+     * The `payload` is a JWE compact serialization string produced by the
+     * GoPay-hosted card form iframe. It must be forwarded from the browser
+     * to your server without modification.
+     *
+     * POST /cards/tokens
+     *
+     * @param payload - JWE compact serialization string from the card form
+     */
+    async tokenizeEncryptedCard(payload) {
+      const validPayload = requireNonEmptyString(payload, "payload");
+      const body = { payload: validPayload };
+      return client.post("/cards/tokens", body);
+    }
+  };
+}
+
+// src/modules/links/links.module.ts
+function createLinksApi(client) {
+  return {
+    /**
+     * Create a payment link.
+     * Requires the `payment:write` OAuth2 scope.
+     *
+     * POST /eshops/{goid}/links
+     *
+     * @param goid   - Merchant's GoPay ID (eshop identifier)
+     * @param params - Link creation parameters including payment data, expiry, and reusability
+     */
+    async createPaymentLink(goid, params) {
+      return client.post(`/eshops/${goid}/links`, params);
+    },
+    /**
+     * Link status.
+     * Requires the `payment:read` OAuth2 scope.
+     *
+     * GET /links/{link_id}
+     *
+     * @param linkId - Link ID returned by {@link createPaymentLink}
+     */
+    async linkStatus(linkId) {
+      const lid = requireNonEmptyString(linkId, "linkId");
+      return client.get(`/links/${lid}`);
+    },
+    /**
+     * Disable a link.
+     * Requires the `payment:write` OAuth2 scope.
+     *
+     * DELETE /links/{link_id}
+     *
+     * @param linkId - Link ID returned by {@link createPaymentLink}
+     */
+    async disableLink(linkId) {
+      const lid = requireNonEmptyString(linkId, "linkId");
+      return client.delete(`/links/${lid}`);
+    }
+  };
+}
+
+// src/modules/payments/payments.module.ts
+function createPaymentsApi(client) {
+  return {
+    /**
+     * Retrieve the current status of an existing payment.
+     *
+     * GET /payments/{payment_id}
+     *
+     * @param paymentId - Payment session ID returned by {@link createPayment}
+     */
+    async getPaymentStatus(paymentId) {
+      const pid = requireNonEmptyString(paymentId, "paymentId");
+      return client.get(`/payments/${pid}`);
+    },
+    /**
+     * Create a new payment session.
+     *
+     * POST /eshops/{goid}/payments
+     *
+     * The response includes a `gw_url` field — **ignore it**. It exists only for
+     * backward compatibility with pre-SDK redirect-based integrations. This SDK's
+     * flow is always: create → charge (via card token, Apple Pay, or Google Pay).
+     *
+     * @param goid   - Merchant's GoPay ID (eshop identifier)
+     * @param params - Payment creation parameters
+     */
+    async createPayment(goid, params) {
+      return client.post(
+        `/eshops/${goid}/payments`,
+        params
+      );
+    },
+    /**
+     * Charge a payment using a payment instrument.
+     *
+     * POST /payments/{payment_id}/charge
+     *
+     * @param paymentId - Payment session ID returned by {@link createPayment}
+     * @param params    - Charge parameters including payment instrument details
+     */
+    async chargePayment(paymentId, params) {
+      const pid = requireNonEmptyString(paymentId, "paymentId");
+      return client.post(
+        `/payments/${pid}/charge`,
+        params
+      );
+    },
+    /**
+     * Retrieve the current state of a payment charge.
+     *
+     * GET /payments/{payment_id}/charge
+     *
+     * @param paymentId - Payment session ID returned by {@link createPayment}
+     */
+    async getChargeState(paymentId) {
+      const pid = requireNonEmptyString(paymentId, "paymentId");
+      return client.get(
+        `/payments/${pid}/charge`
+      );
+    },
+    /**
+     * Retrieve Google Pay configuration for this payment.
+     *
+     * GET /payments/{payment_id}/google-pay/info
+     *
+     * @param paymentId - Payment session ID
+     */
+    async getGooglePayInfo(paymentId) {
+      const pid = requireNonEmptyString(paymentId, "paymentId");
+      return client.get(
+        `/payments/${pid}/google-pay/info`
+      );
+    },
+    /**
+     * Retrieve Apple Pay configuration for this payment.
+     *
+     * GET /payments/{payment_id}/apple-pay/info
+     *
+     * @param paymentId - Payment session ID
+     */
+    async getApplePayInfo(paymentId) {
+      const pid = requireNonEmptyString(paymentId, "paymentId");
+      return client.get(
+        `/payments/${pid}/apple-pay/info`
+      );
+    },
+    /**
+     * Wire merchant validation onto an ApplePaySession and begin it.
+     * Handles the onvalidatemerchant callback via POST /payments/{payment_id}/apple-pay/validate.
+     *
+     * @param paymentId - Payment session ID
+     * @param session   - ApplePaySession instance
+     * @param origin    - Merchant origin (https:); defaults to current page origin
+     * @param callbacks - Optional lifecycle callbacks
+     */
+    startApplePaySession(paymentId, session, origin = globalThis.location?.origin ?? "", callbacks) {
+      const pid = requireNonEmptyString(paymentId, "paymentId");
+      if (origin) {
+        try {
+          assertHttpsOrigin(
+            origin,
+            "[GoPaySDK] startApplePaySession"
+          );
+        } catch (e) {
+          throw client.emitError(e);
+        }
+      }
+      session.onvalidatemerchant = (event) => {
+        const validationURL = event != null && typeof event === "object" && "validationURL" in event && typeof event.validationURL === "string" ? event.validationURL : void 0;
+        const headers = origin ? { Origin: origin } : {};
+        const body = validationURL ? { validationUrl: validationURL } : void 0;
+        client.post(
+          `/payments/${pid}/apple-pay/validate`,
+          body,
+          { headers }
+        ).then(
+          (merchantSession) => session.completeMerchantValidation(merchantSession)
+        ).catch(() => session.abort());
+      };
+      session.oncancel = (event) => {
+        callbacks?.oncancel?.(event);
+      };
+      session.begin();
+    },
+    /**
+     * Retrieve QR payment info for this payment.
+     * Returns recipient details and base64-encoded QR code image(s).
+     *
+     * GET /payments/{payment_id}/qr-payment/info
+     *
+     * @param paymentId - Payment session ID
+     * @param format    - Image format of the QR code: 'png' (default) or 'svg'
+     */
+    async getQRPaymentInfo(paymentId, format) {
+      const pid = requireNonEmptyString(paymentId, "paymentId");
+      const path = format ? `/payments/${pid}/qr-payment/info?format=${format}` : `/payments/${pid}/qr-payment/info`;
+      return client.get(path);
+    },
+    /**
+     * Poll the charge state until a terminal outcome.
+     *
+     * Resolves on `SUCCEEDED`. Rejects with `CHARGE_FAILED` on `FAILED`,
+     * or `CHARGE_TIMEOUT` if the charge does not leave `REQUESTED`/
+     * `PROCESSING` within `initialTimeoutMs` (default 30 s).
+     *
+     * Use `options.onActionRequired` to handle 3DS redirects
+     * (e.g. redirect the customer or open a popup).
+     *
+     * @param paymentId - Payment session ID
+     * @param options   - Polling configuration and callbacks
+     */
+    awaitChargeState(paymentId, options) {
+      const pid = requireNonEmptyString(paymentId, "paymentId");
+      return awaitCharge(
+        () => client.get(
+          `/payments/${pid}/charge`
+        ),
+        options
+      );
+    }
+  };
+}
+
+// src/modules/recurrences/recurrences.module.ts
+function createRecurrencesApi(client) {
+  return {
+    /**
+     * Create a recurrence.
+     * Requires the `payment:write` OAuth2 scope.
+     *
+     * POST /eshops/{goid}/recurrences
+     *
+     * @param goid   - Merchant's GoPay ID (eshop identifier)
+     * @param params - Recurrence creation parameters including type, schedule, and payment data
+     */
+    async createRecurrence(goid, params) {
+      return client.post(
+        `/eshops/${goid}/recurrences`,
+        params
+      );
+    },
+    /**
+     * Recurrence status.
+     * Requires the `payment:read` OAuth2 scope.
+     *
+     * GET /recurrences/{rec_id}
+     *
+     * @param recId - Recurrence ID returned by {@link createRecurrence}
+     */
+    async recurrenceStatus(recId) {
+      const rid = requireNonEmptyString(recId, "recId");
+      return client.get(`/recurrences/${rid}`);
+    },
+    /**
+     * Stop a recurrence.
+     * Requires the `payment:write` OAuth2 scope.
+     *
+     * DELETE /recurrences/{rec_id}
+     *
+     * @param recId - Recurrence ID returned by {@link createRecurrence}
+     */
+    async stopRecurrence(recId) {
+      const rid = requireNonEmptyString(recId, "recId");
+      return client.delete(`/recurrences/${rid}`);
+    },
+    /**
+     * Start a recurrence.
+     * Triggers the first charge of a recurrence that is in the `NEW` state.
+     * Requires the `payment:write` OAuth2 scope.
+     *
+     * POST /recurrences/{rec_id}/start
+     *
+     * @param recId  - Recurrence ID returned by {@link createRecurrence}
+     * @param params - Optional payment overrides (amount, order_number, callback, etc.)
+     */
+    async startRecurrence(recId, params) {
+      const rid = requireNonEmptyString(recId, "recId");
+      return client.post(
+        `/recurrences/${rid}/start`,
+        params
+      );
+    },
+    /**
+     * Create a next payment for a recurrence.
+     * Charges the next instalment for a recurrence that is already `STARTED`.
+     * Requires the `payment:write` OAuth2 scope.
+     *
+     * POST /recurrences/{rec_id}/next
+     *
+     * @param recId  - Recurrence ID returned by {@link createRecurrence}
+     * @param params - Optional payment overrides (amount, order_number, callback, etc.)
+     */
+    async recurrenceNext(recId, params) {
+      const rid = requireNonEmptyString(recId, "recId");
+      return client.post(
+        `/recurrences/${rid}/next`,
+        params
+      );
+    }
+  };
+}
+
+// src/modules/refunds/refunds.module.ts
+function createRefundsApi(client) {
+  return {
+    /**
+     * Refund a payment (fully or partially).
+     * Requires the `payment:write` OAuth2 scope.
+     *
+     * POST /payments/{payment_id}/refunds
+     *
+     * @param paymentId - Payment session ID returned by {@link createPayment}
+     * @param params    - Refund parameters, including the amount in cents
+     */
+    async refundPayment(paymentId, params) {
+      const pid = requireNonEmptyString(paymentId, "paymentId");
+      return client.post(
+        `/payments/${pid}/refunds`,
+        params
+      );
+    },
+    /**
+     * List all refunds for a payment.
+     * Requires the `payment:read` OAuth2 scope.
+     *
+     * GET /payments/{payment_id}/refunds
+     *
+     * @param paymentId - Payment session ID returned by {@link createPayment}
+     */
+    async listRefunds(paymentId) {
+      const pid = requireNonEmptyString(paymentId, "paymentId");
+      return client.get(`/payments/${pid}/refunds`);
+    },
+    /**
+     * Retrieve details of a single refund.
+     * Requires the `payment:read` OAuth2 scope.
+     *
+     * GET /refunds/{refund_id}
+     *
+     * @param refundId - Refund ID returned by {@link refundPayment}
+     */
+    async getRefund(refundId) {
+      const rid = requireNonEmptyString(refundId, "refundId");
+      return client.get(`/refunds/${rid}`);
+    }
+  };
+}
+
+// src/version.ts
+var SDK_VERSION = "1.6.6";
+
+// src/gopay-sdk.ts
+function createGoPaySDK(config = {}) {
+  const client = createHttpClient(config);
+  return {
+    version: SDK_VERSION,
+    ...createAuthApi(client),
+    ...createPaymentsApi(client),
+    ...createCardsApi(client),
+    ...createRecurrencesApi(client),
+    ...createRefundsApi(client),
+    ...createLinksApi(client)
+  };
+}
+export {
+  GoPayErrorCodes,
+  GoPayHTTPError,
+  GoPaySDKError,
+  SDK_VERSION,
+  createGoPaySDK
+};
+//# sourceMappingURL=index.js.map