@nombaoss/nomba-node 0.0.0-stage → 0.1.0

package/dist/index.js

@@ -0,0 +1,1532 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+
+// src/errors.ts
+var NombaError = class extends Error {
+  /**
+   * Set on errors from money-moving calls (`transfers.toBank`, `transfers.toWallet`,
+   * `bills.*` purchases, `checkout.chargeSavedCard`). After a timeout or connection
+   * error, requery with this reference before retrying, and retry with the same one.
+   */
+  reference;
+  constructor(message, options) {
+    super(message, options);
+    this.name = new.target.name;
+    this.reference = void 0;
+  }
+};
+function attachErrorReference(err, reference) {
+  if (err instanceof NombaError) {
+    Object.defineProperty(err, "reference", {
+      value: Object.freeze({ ...reference }),
+      enumerable: true,
+      writable: false,
+      configurable: true
+    });
+  }
+}
+var ConfigurationError = class extends NombaError {
+};
+var WebhookVerificationError = class extends NombaError {
+};
+var ConnectionError = class extends NombaError {
+  /** HTTP method of the failed request. */
+  method;
+  /** Request path, without query string. */
+  path;
+  constructor(message, options = {}) {
+    super(message, { cause: options.cause });
+    this.method = options.method;
+    this.path = options.path;
+  }
+};
+var TimeoutError = class extends ConnectionError {
+};
+var ApiError = class _ApiError extends NombaError {
+  /** HTTP status of the response, or `null` when the error was raised before sending. */
+  httpStatus;
+  /** Nomba's `code` field from the response envelope, if present. */
+  code;
+  /** Nomba's `description` (human-readable message), if present. */
+  description;
+  /** Parsed response body. */
+  body;
+  /** HTTP method of the request. */
+  method;
+  /** Request path, without query string. */
+  path;
+  constructor(init, message) {
+    super(message ?? _ApiError.formatMessage(init));
+    this.httpStatus = init.httpStatus;
+    this.code = init.code;
+    this.description = init.description;
+    this.body = init.body;
+    this.method = init.method;
+    this.path = init.path;
+  }
+  /** `Nomba API error 400 (code "400"): <description> [POST /v2/transfers/bank]` */
+  static formatMessage(init) {
+    let msg = "Nomba API error";
+    if (init.httpStatus !== null) msg += ` ${init.httpStatus}`;
+    if (init.code !== void 0) msg += ` (code "${init.code}")`;
+    msg += `: ${init.description ?? "no description"}`;
+    if (init.method && init.path) msg += ` [${init.method} ${init.path}]`;
+    return msg;
+  }
+};
+var AuthenticationError = class extends ApiError {
+};
+var PermissionDeniedError = class extends ApiError {
+};
+var NotFoundError = class extends ApiError {
+};
+var ValidationError = class _ValidationError extends ApiError {
+  /** Client-side validation error: nothing was sent. */
+  static client(description) {
+    return new _ValidationError(
+      { httpStatus: null, description },
+      `Nomba validation error: ${description}`
+    );
+  }
+};
+var RateLimitError = class extends ApiError {
+  /** Seconds to wait, from the `Retry-After` header, if present. */
+  retryAfter;
+  /** `X-Rate-Limit-*` header values. */
+  rateLimit;
+  constructor(init) {
+    super(init);
+    this.retryAfter = init.retryAfter;
+    this.rateLimit = init.rateLimit ?? {};
+  }
+};
+var ServerError = class extends ApiError {
+};
+
+// src/auth.ts
+var InMemoryTokenStore = class {
+  #token = null;
+  get() {
+    return this.#token;
+  }
+  set(token) {
+    this.#token = token;
+  }
+  toJSON() {
+    return { tokenStore: "InMemoryTokenStore" };
+  }
+  [/* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom")]() {
+    return "InMemoryTokenStore {}";
+  }
+};
+var REFRESH_MARGIN_MS = 5 * 60 * 1e3;
+var FALLBACK_LIFETIME_MS = 30 * 60 * 1e3;
+var TokenManager = class {
+  #deps;
+  #inflight = null;
+  constructor(deps) {
+    this.#deps = deps;
+  }
+  #now() {
+    return this.#deps.now ? this.#deps.now() : Date.now();
+  }
+  /** Current access token, obtaining or refreshing one if needed. */
+  async getAccessToken() {
+    if (this.#inflight) return this.#inflight;
+    const cached = await this.#deps.store.get();
+    if (cached && this.#expiryMs(cached) - this.#now() > REFRESH_MARGIN_MS) {
+      return cached.accessToken;
+    }
+    if (this.#inflight) return this.#inflight;
+    this.#inflight = this.#obtain(cached).finally(() => {
+      this.#inflight = null;
+    });
+    return this.#inflight;
+  }
+  /** Drop the cached token, but only if it is still the one that failed. */
+  async invalidate(failedAccessToken) {
+    const cached = await this.#deps.store.get();
+    if (cached && cached.accessToken === failedAccessToken) {
+      await this.#deps.store.set(null);
+    }
+  }
+  async current() {
+    return this.#deps.store.get();
+  }
+  async clear() {
+    await this.#deps.store.set(null);
+  }
+  async #obtain(cached) {
+    if (cached?.refreshToken) {
+      try {
+        return await this.#save(await this.#deps.refresh(cached.refreshToken));
+      } catch (err) {
+        const status = err instanceof ApiError ? err.httpStatus : null;
+        const clientError = status !== null && status >= 400 && status < 500 && status !== 429;
+        const nonSuccessCode = err instanceof ApiError && status !== null && status < 300;
+        if (!clientError && !nonSuccessCode) {
+          if (this.#expiryMs(cached) > this.#now()) return cached.accessToken;
+          throw err;
+        }
+      }
+    }
+    return this.#save(await this.#deps.issue());
+  }
+  async #save(res) {
+    const accessToken = typeof res.access_token === "string" ? res.access_token : "";
+    if (!accessToken) {
+      throw new ApiError(
+        {
+          httpStatus: 200,
+          description: "token response did not include an access_token"
+        },
+        "Nomba API error: token response did not include an access_token"
+      );
+    }
+    let expiresAt = typeof res.expiresAt === "string" ? res.expiresAt : "";
+    if (Number.isNaN(Date.parse(expiresAt))) {
+      expiresAt = new Date(this.#now() + FALLBACK_LIFETIME_MS).toISOString();
+    }
+    await this.#deps.store.set({
+      accessToken,
+      refreshToken: typeof res.refresh_token === "string" ? res.refresh_token : "",
+      expiresAt
+    });
+    return accessToken;
+  }
+  #expiryMs(token) {
+    const t = Date.parse(token.expiresAt);
+    return Number.isNaN(t) ? 0 : t;
+  }
+};
+
+// src/constants.ts
+var TransactionStatus = {
+  /** Service delivered to the destination. Do not refund. */
+  SUCCESS: "SUCCESS",
+  /** Still processing. Wait for the webhook or requery. */
+  PENDING_BILLING: "PENDING_BILLING",
+  /** Still processing (v1 endpoints). Wait for the webhook or requery. */
+  PROCESSING: "PROCESSING",
+  /** Funds returned to your Nomba wallet. Refund your customer. */
+  REFUND: "REFUND",
+  /** The transaction will not proceed. Contact Nomba support. */
+  CANCELLED: "CANCELLED",
+  /** Debit failed; Nomba may retry. Wait for the webhook. */
+  PAYMENT_FAILED: "PAYMENT_FAILED",
+  /** Nomba may retry via another vendor. Wait for the webhook. */
+  REVERSED_BY_VENDOR: "REVERSED_BY_VENDOR"
+};
+var WebhookEventType = {
+  PAYMENT_SUCCESS: "payment_success",
+  PAYMENT_FAILED: "payment_failed",
+  PAYMENT_REVERSAL: "payment_reversal",
+  PAYOUT_SUCCESS: "payout_success",
+  PAYOUT_FAILED: "payout_failed",
+  PAYOUT_REFUND: "payout_refund"
+};
+var SUCCESS_CODES = ["00", "200", "201"];
+var BASE_URLS = {
+  sandbox: "https://sandbox.nomba.com",
+  production: "https://api.nomba.com"
+};
+
+// src/internal/utils.ts
+function encodePathSegment(value, name = "path parameter") {
+  if (typeof value !== "string" && typeof value !== "number") {
+    throw ValidationError.client(`${name} must be a non-empty string`);
+  }
+  const s = String(value);
+  if (s.trim() === "") throw ValidationError.client(`${name} must not be empty`);
+  if (s === "." || s === "..") throw ValidationError.client(`${name} must not be "${s}"`);
+  if (s.includes("/") || s.includes("\\")) {
+    throw ValidationError.client(`${name} must not contain "/" or "\\"`);
+  }
+  return encodeURIComponent(s);
+}
+function buildQuery(query) {
+  if (!query) return "";
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(query)) {
+    if (value === null || value === void 0) continue;
+    params.append(
+      key,
+      typeof value === "boolean" ? value ? "true" : "false" : String(value)
+    );
+  }
+  const s = params.toString();
+  return s ? `?${s}` : "";
+}
+function requireFields(obj, keys, context) {
+  for (const key of keys) {
+    const v = obj?.[key];
+    if (v === void 0 || v === null || v === "") {
+      throw ValidationError.client(`${context}: "${key}" is required`);
+    }
+  }
+}
+function requireExactlyOne(obj, keys, context) {
+  const set = keys.filter((k) => {
+    const v = obj?.[k];
+    return v !== void 0 && v !== null && v !== "";
+  });
+  if (set.length !== 1) {
+    throw ValidationError.client(
+      `${context}: pass exactly one of ${keys.map((k) => `"${k}"`).join(", ")}`
+    );
+  }
+}
+var MAX_PAGE_LIMIT = 50;
+function validateLimit(limit) {
+  if (limit === void 0 || limit === null) return;
+  if (typeof limit !== "number" || !Number.isInteger(limit) || limit < 1 || limit > MAX_PAGE_LIMIT) {
+    throw ValidationError.client(
+      `"limit" must be an integer between 1 and ${MAX_PAGE_LIMIT}`
+    );
+  }
+}
+async function randomUUID() {
+  const c = globalThis.crypto;
+  if (c && typeof c.randomUUID === "function") return c.randomUUID();
+  const nodeCrypto = await import('node:crypto');
+  return nodeCrypto.randomUUID();
+}
+var timing = {
+  sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+  }
+};
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function readEnv(name) {
+  const proc = globalThis.process;
+  const v = proc?.env?.[name];
+  return v === void 0 || v === "" ? void 0 : v;
+}
+function runtimeVersion() {
+  const proc = globalThis.process;
+  return proc?.version ? `node/${proc.version}` : "runtime/unknown";
+}
+
+// src/internal/http.ts
+var SUCCESS_CODES2 = new Set(SUCCESS_CODES);
+var MAX_BACKOFF_MS = 8e3;
+var INITIAL_BACKOFF_MS = 500;
+var MAX_RETRY_AFTER_MS = 6e4;
+function backoffMs(attempt, random = Math.random) {
+  const base = Math.min(MAX_BACKOFF_MS, INITIAL_BACKOFF_MS * 2 ** attempt);
+  return Math.round(base * (1 - 0.25 * random()));
+}
+function parseRetryAfter(value, now = Date.now()) {
+  if (value === null || value.trim() === "") return void 0;
+  const secs = Number(value);
+  if (Number.isFinite(secs)) return Math.max(0, secs);
+  const date = Date.parse(value);
+  if (Number.isNaN(date)) return void 0;
+  return Math.max(0, Math.ceil((date - now) / 1e3));
+}
+var HttpClient = class {
+  #config;
+  #tokens = null;
+  constructor(config) {
+    this.#config = config;
+  }
+  setTokenManager(tokens) {
+    this.#tokens = tokens;
+  }
+  /** Make a request and return the unwrapped `data` of a successful envelope. */
+  async request(opts) {
+    const { reference } = opts;
+    if (!reference) return await this.#authorized(opts);
+    try {
+      return withReference(await this.#authorized(opts), reference);
+    } catch (err) {
+      attachErrorReference(err, reference);
+      throw err;
+    }
+  }
+  async #authorized(opts) {
+    if (opts.token === "obtain" || !this.#tokens) {
+      return this.#send(opts, void 0);
+    }
+    const token = await this.#tokens.getAccessToken();
+    try {
+      return await this.#send(opts, token);
+    } catch (err) {
+      if (!(err instanceof AuthenticationError) || err.httpStatus !== 401) throw err;
+      await this.#tokens.invalidate(token);
+      const fresh = await this.#tokens.getAccessToken();
+      return this.#send(opts, fresh);
+    }
+  }
+  async #send(opts, token) {
+    const retryable = opts.method === "GET" || opts.token === "obtain";
+    const maxAttempts = retryable ? this.#config.maxRetries + 1 : 1;
+    const url = `${this.#config.baseUrl}${opts.path}${buildQuery(opts.query)}`;
+    const headers = {
+      Accept: "application/json",
+      "Content-Type": "application/json",
+      accountId: this.#config.accountId,
+      "User-Agent": this.#config.userAgent
+    };
+    if (token !== void 0) headers.Authorization = `Bearer ${token}`;
+    const body = opts.body === void 0 ? void 0 : JSON.stringify(opts.body);
+    for (let attempt = 0; ; attempt++) {
+      const isLast = attempt + 1 >= maxAttempts;
+      let res;
+      try {
+        res = await this.#fetchOnce(url, opts.method, headers, body);
+      } catch (err) {
+        const wrapped = err instanceof TimeoutError ? new TimeoutError(
+          `Nomba request timed out after ${this.#config.timeout} ms [${opts.method} ${opts.path}]`,
+          { method: opts.method, path: opts.path }
+        ) : new ConnectionError(
+          `Could not connect to Nomba [${opts.method} ${opts.path}]`,
+          { method: opts.method, path: opts.path, cause: err }
+        );
+        if (isLast) throw wrapped;
+        await timing.sleep(backoffMs(attempt));
+        continue;
+      }
+      if (!isLast && (res.status === 429 || res.status >= 500)) {
+        const retryAfter = res.status === 429 ? parseRetryAfter(res.headers.get("retry-after")) : void 0;
+        await timing.sleep(
+          retryAfter !== void 0 ? Math.min(retryAfter * 1e3, MAX_RETRY_AFTER_MS) : backoffMs(attempt)
+        );
+        continue;
+      }
+      return this.#unwrap(res, opts);
+    }
+  }
+  async #fetchOnce(url, method, headers, body) {
+    const controller = new AbortController();
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      controller.abort();
+    }, this.#config.timeout);
+    try {
+      const response = await this.#config.fetch(url, {
+        method,
+        headers,
+        body,
+        signal: controller.signal,
+        // Never follow redirects: the Authorization header must only go to Nomba.
+        redirect: "error"
+      });
+      const text = await response.text();
+      return {
+        status: response.status,
+        headers: response.headers,
+        body: parseJson(text)
+      };
+    } catch (err) {
+      if (timedOut) throw new TimeoutError("timeout");
+      throw err;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  #unwrap(res, opts) {
+    const envelope = isRecord(res.body) ? res.body : void 0;
+    const rawCode = envelope?.code;
+    const code = rawCode === void 0 || rawCode === null ? void 0 : String(rawCode);
+    const ok = res.status >= 200 && res.status < 300;
+    const notJson = typeof res.body === "string";
+    if (ok && !notJson && (code === void 0 || SUCCESS_CODES2.has(code))) {
+      if (envelope && "data" in envelope) return envelope.data;
+      return envelope ? null : res.body ?? null;
+    }
+    const descriptionField = notJson ? "response was not valid JSON" : envelope?.description ?? envelope?.message;
+    const init = {
+      httpStatus: res.status,
+      code,
+      description: typeof descriptionField === "string" && descriptionField !== "" ? descriptionField : void 0,
+      // Token endpoints: never keep a response body that might contain tokens.
+      body: opts.token ? redactTokenBody(res.body) : res.body,
+      method: opts.method,
+      path: opts.path
+    };
+    throw errorFor(init, res.headers, opts);
+  }
+};
+function errorFor(init, headers, opts) {
+  const status = init.httpStatus ?? 0;
+  if (status === 429) {
+    return new RateLimitError({
+      ...init,
+      retryAfter: parseRetryAfter(headers.get("retry-after")),
+      rateLimit: {
+        limit: headers.get("x-rate-limit-limit") ?? void 0,
+        remaining: headers.get("x-rate-limit-remaining") ?? void 0,
+        window: headers.get("x-rate-limit-window") ?? void 0
+      }
+    });
+  }
+  if (status >= 500) return new ServerError(init);
+  if (opts.token === "obtain") return new AuthenticationError(init);
+  if (status === 401) return new AuthenticationError(init);
+  if (status === 403) return new PermissionDeniedError(init);
+  if (status === 404) return new NotFoundError(init);
+  if (status === 400 || status === 422) return new ValidationError(init);
+  return new ApiError(init);
+}
+function parseJson(text) {
+  if (text === "") return void 0;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+function withReference(data, { field: field2, value }) {
+  if (data === null || data === void 0) return { [field2]: value };
+  if (isRecord(data) && (data[field2] === void 0 || data[field2] === null || data[field2] === "")) {
+    return { ...data, [field2]: value };
+  }
+  return data;
+}
+function redactTokenBody(body) {
+  if (!isRecord(body)) return body;
+  const { data: _data, ...rest } = body;
+  return rest;
+}
+
+// src/internal/pagination.ts
+async function* autoPage(fetchPage, startCursor) {
+  let cursor = startCursor;
+  const seen = /* @__PURE__ */ new Set();
+  for (; ; ) {
+    const page = await fetchPage(cursor);
+    const results = page?.results ?? [];
+    for (const item of results) yield item;
+    const next = page?.cursor;
+    if (!next || results.length === 0 || seen.has(next)) return;
+    seen.add(next);
+    cursor = next;
+  }
+}
+
+// src/resources/base.ts
+var Resource = class {
+  ctx;
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  request(opts) {
+    return this.ctx.http.request(opts);
+  }
+  /** `path` + `/{subAccountId}` (when given) + `suffix`. */
+  withSubAccount(path, subAccountId, suffix = "") {
+    const sub = subAccountId === void 0 ? "" : `/${encodePathSegment(subAccountId, "subAccountId")}`;
+    return `${path}${sub}${suffix}`;
+  }
+  /**
+   * Money-moving POST with a `merchantTxRef`: generate one if missing. The request
+   * layer returns it on the result and attaches it to any error.
+   */
+  async withMerchantTxRef(path, params, options = {}) {
+    const body = { ...params };
+    if (typeof body.merchantTxRef !== "string" || body.merchantTxRef === "") {
+      body.merchantTxRef = await randomUUID();
+    }
+    return this.request({
+      method: "POST",
+      path: this.withSubAccount(path, options.subAccountId),
+      body,
+      reference: { field: "merchantTxRef", value: body.merchantTxRef }
+    });
+  }
+};
+var seg = encodePathSegment;
+
+// src/resources/accounts.ts
+var Accounts = class extends Resource {
+  /** Parent account details. `GET /v1/accounts/parent` */
+  async getParent() {
+    return this.request({ method: "GET", path: "/v1/accounts/parent" });
+  }
+  /** Balance of the parent account, or of a sub account. */
+  async getBalance(params = {}) {
+    return this.request({
+      method: "GET",
+      path: this.withSubAccount("/v1/accounts", params.subAccountId, "/balance")
+    });
+  }
+  /** Sub account details by `accountId` or `accountRef` (exactly one). */
+  async getSubAccount(params) {
+    requireExactlyOne(
+      params,
+      ["accountId", "accountRef"],
+      "accounts.getSubAccount"
+    );
+    return this.request({
+      method: "GET",
+      path: "/v1/accounts/sub-account-details",
+      query: { accountId: params.accountId, accountRef: params.accountRef }
+    });
+  }
+  /** One page of terminals on the parent account or a sub account. */
+  async listTerminals(params = {}) {
+    const { subAccountId, ...query } = params;
+    validateLimit(query.limit);
+    return this.request({
+      method: "GET",
+      path: this.withSubAccount("/v1/accounts", subAccountId, "/terminals"),
+      query: { ...query }
+    });
+  }
+  /** Every terminal, across pages: `for await (const t of nomba.accounts.listAllTerminals())`. */
+  async *listAllTerminals(params = {}) {
+    validateLimit(params.limit);
+    yield* autoPage((cursor) => this.listTerminals({ ...params, cursor }));
+  }
+};
+
+// src/resources/auth.ts
+var AuthResource = class extends Resource {
+  #tokens;
+  #clientId;
+  constructor(ctx, tokens, clientId) {
+    super(ctx);
+    this.#tokens = tokens;
+    this.#clientId = clientId;
+  }
+  /**
+   * Revoke the cached access token (`POST /v1/auth/token/revoke`) and clear the
+   * token store. Does nothing and returns `null` when no token is cached.
+   */
+  async revoke() {
+    const token = await this.#tokens.current();
+    if (!token) return null;
+    try {
+      return await this.request({
+        method: "POST",
+        path: "/v1/auth/token/revoke",
+        body: { clientId: this.#clientId, access_token: token.accessToken },
+        token: "revoke"
+      });
+    } finally {
+      await this.#tokens.clear();
+    }
+  }
+};
+
+// src/resources/bills.ts
+var Bills = class extends Resource {
+  async buyAirtime(params, options = {}) {
+    requireFields(
+      params,
+      ["amount", "phoneNumber", "network"],
+      "bills.buyAirtime"
+    );
+    return this.withMerchantTxRef("/v2/bill/topup", params, options);
+  }
+  async buyData(params, options = {}) {
+    requireFields(
+      params,
+      ["productId", "phoneNumber", "network"],
+      "bills.buyData"
+    );
+    return this.withMerchantTxRef("/v2/bill/data", params, options);
+  }
+  /** Data plans for a telco (e.g. `mtn`). The telco is lowercased. */
+  async listDataPlans(telco) {
+    const t = typeof telco === "string" ? telco.toLowerCase() : telco;
+    return this.request({ method: "GET", path: `/v1/bill/data-plan/${seg(t, "telco")}` });
+  }
+  async buyElectricity(params, options = {}) {
+    return this.withMerchantTxRef("/v2/bill/electricity", params, options);
+  }
+  /** Electricity distribution companies (discos). */
+  async listElectricityProviders() {
+    return this.request({ method: "GET", path: "/v1/bill/electricity/discos" });
+  }
+  async lookupElectricityCustomer(params) {
+    requireFields(
+      params,
+      ["disco", "customerId"],
+      "bills.lookupElectricityCustomer"
+    );
+    return this.request({
+      method: "GET",
+      path: "/v2/bill/electricity/lookup",
+      query: { disco: params.disco, customerId: params.customerId }
+    });
+  }
+  async payCableTv(params, options = {}) {
+    return this.withMerchantTxRef("/v2/bill/cabletv", params, options);
+  }
+  async listCableTvPlans(cableTvType) {
+    requireFields({ cableTvType }, ["cableTvType"], "bills.listCableTvPlans");
+    return this.request({
+      method: "GET",
+      path: "/v1/bill/cableTvProduct",
+      query: { cableTvType }
+    });
+  }
+  /** Returns the customer's name. */
+  async lookupCableTvCustomer(params) {
+    requireFields(
+      params,
+      ["customerId", "cableTvType"],
+      "bills.lookupCableTvCustomer"
+    );
+    return this.request({
+      method: "GET",
+      path: "/v1/bill/cabletv/lookup",
+      query: { customerId: params.customerId, cableTvType: params.cableTvType }
+    });
+  }
+  async fundBetting(params, options = {}) {
+    return this.withMerchantTxRef("/v2/bill/betting", params, options);
+  }
+  async listBettingProviders() {
+    return this.request({ method: "GET", path: "/v1/bill/betting/providers" });
+  }
+  /** Returns the customer's name. */
+  async lookupBettingCustomer(params) {
+    requireFields(
+      params,
+      ["providerId", "customerId"],
+      "bills.lookupBettingCustomer"
+    );
+    return this.request({
+      method: "GET",
+      path: "/v1/bill/betting/lookup",
+      query: { providerId: params.providerId, customerId: params.customerId }
+    });
+  }
+};
+
+// src/resources/checkout.ts
+var Checkout = class extends Resource {
+  /** Create a hosted checkout order and get its `checkoutLink`. */
+  async createOrder(params) {
+    if (!isRecord(params?.order)) {
+      throw ValidationError.client('checkout.createOrder: "order" is required');
+    }
+    return this.request({ method: "POST", path: "/v1/checkout/order", body: params });
+  }
+  async getOrder(orderReference) {
+    return this.request({
+      method: "GET",
+      path: `/v1/checkout/order/${seg(orderReference, "orderReference")}`
+    });
+  }
+  async cancelOrder(params) {
+    requireFields(
+      params,
+      ["orderReference"],
+      "checkout.cancelOrder"
+    );
+    return this.request({
+      method: "POST",
+      path: "/v1/checkout/order/cancel",
+      body: params
+    });
+  }
+  /** A checkout transaction by order ID or order reference. */
+  async getTransaction(params) {
+    requireFields(
+      params,
+      ["idType", "id"],
+      "checkout.getTransaction"
+    );
+    return this.request({
+      method: "GET",
+      path: "/v1/checkout/transaction",
+      query: { idType: params.idType, id: params.id }
+    });
+  }
+  /** Refund a checkout transaction. Never retried automatically. */
+  async refund(params) {
+    requireFields(params, ["transactionId"], "checkout.refund");
+    return this.request({ method: "POST", path: "/v1/checkout/refund", body: params });
+  }
+  /**
+   * Charge a saved (tokenized) card. This endpoint has no `merchantTxRef`; its
+   * reference is `order.orderReference`. If you omit it the SDK generates one
+   * (UUID v4) and returns it as `orderReference`. Never retried automatically.
+   */
+  async chargeSavedCard(params) {
+    requireFields(params, ["tokenKey"], "checkout.chargeSavedCard");
+    const body = { ...params };
+    let reference;
+    if (isRecord(params.order)) {
+      const order = { ...params.order };
+      if (typeof order.orderReference !== "string" || order.orderReference === "") {
+        order.orderReference = await randomUUID();
+      }
+      reference = { field: "orderReference", value: order.orderReference };
+      body.order = order;
+    }
+    return this.request({
+      method: "POST",
+      path: "/v1/checkout/tokenized-card-payment",
+      body,
+      reference
+    });
+  }
+  /** Saved cards, filtered by customer email and/or date range (page-numbered). */
+  async listSavedCards(params = {}) {
+    return this.request({
+      method: "GET",
+      path: "/v1/checkout/tokenized-card-data",
+      query: { ...params }
+    });
+  }
+  async updateSavedCardEmail(params) {
+    requireFields(
+      params,
+      ["tokenKey", "currentEmailAddress", "newEmailAddress"],
+      "checkout.updateSavedCardEmail"
+    );
+    return this.request({
+      method: "POST",
+      path: "/v1/checkout/tokenized-card-data",
+      body: params
+    });
+  }
+  /** Delete a saved card. Sends a JSON body with DELETE. */
+  async deleteSavedCard(params) {
+    requireFields(params, ["tokenKey"], "checkout.deleteSavedCard");
+    return this.request({
+      method: "DELETE",
+      path: "/v1/checkout/tokenized-card-data",
+      body: params
+    });
+  }
+  /** The bank account a customer can transfer to for this order. */
+  async getTransferAccount(orderReference) {
+    return this.request({
+      method: "GET",
+      path: `/v1/checkout/get-checkout-kta/${seg(orderReference, "orderReference")}`
+    });
+  }
+  async submitCardDetails(params) {
+    return this.request({
+      method: "POST",
+      path: "/v1/checkout/checkout-card-detail",
+      body: params
+    });
+  }
+  async submitCardOtp(params) {
+    requireFields(
+      params,
+      ["otp", "orderReference", "transactionId"],
+      "checkout.submitCardOtp"
+    );
+    return this.request({
+      method: "POST",
+      path: "/v1/checkout/checkout-card-otp",
+      body: params
+    });
+  }
+  async resendOtp(params) {
+    requireFields(params, ["orderReference"], "checkout.resendOtp");
+    return this.request({
+      method: "POST",
+      path: "/v1/checkout/resend-otp",
+      body: params
+    });
+  }
+  async confirmTransactionReceipt(params) {
+    requireFields(
+      params,
+      ["orderReference"],
+      "checkout.confirmTransactionReceipt"
+    );
+    return this.request({
+      method: "POST",
+      path: "/v1/checkout/confirm-transaction-receipt",
+      body: params
+    });
+  }
+  async cancelTransaction(params) {
+    requireFields(
+      params,
+      ["transactionId", "forceCancel"],
+      "checkout.cancelTransaction"
+    );
+    return this.request({
+      method: "POST",
+      path: "/v1/checkout/transaction/cancel",
+      body: params
+    });
+  }
+  /** Send an OTP to a customer who wants to save their card. */
+  async requestSaveCardOtp(params) {
+    requireFields(
+      params,
+      ["orderReference", "phoneNumber"],
+      "checkout.requestSaveCardOtp"
+    );
+    return this.request({
+      method: "POST",
+      path: "/v1/checkout/user-card/auth",
+      body: params
+    });
+  }
+  /** Send an OTP to a customer who already has saved cards. */
+  async requestSavedCardsOtp(params) {
+    requireFields(
+      params,
+      ["orderReference"],
+      "checkout.requestSavedCardsOtp"
+    );
+    return this.request({
+      method: "POST",
+      path: "/v1/checkout/user-card/saved-card/auth",
+      body: params
+    });
+  }
+  async submitUserOtp(params) {
+    requireFields(
+      params,
+      ["orderReference", "phoneNumber", "otp"],
+      "checkout.submitUserOtp"
+    );
+    return this.request({ method: "POST", path: "/v1/checkout/user-card", body: params });
+  }
+  /** The customer's saved cards for this order, after OTP verification. */
+  async getSavedCards(orderReference, params) {
+    requireFields(params, ["otp"], "checkout.getSavedCards");
+    return this.request({
+      method: "GET",
+      path: `/v1/checkout/user-card/${seg(orderReference, "orderReference")}`,
+      query: { otp: params.otp }
+    });
+  }
+};
+
+// src/resources/directDebits.ts
+var DirectDebits = class extends Resource {
+  async createMandate(params) {
+    return this.request({ method: "POST", path: "/v1/direct-debits", body: params });
+  }
+  /** Debit a customer against an active mandate. Never retried automatically. */
+  async debitMandate(params) {
+    requireFields(
+      params,
+      ["mandateId", "amount"],
+      "directDebits.debitMandate"
+    );
+    return this.request({
+      method: "POST",
+      path: "/v1/direct-debits/debit-mandate",
+      body: params
+    });
+  }
+  async getMandateStatus(mandateId) {
+    requireFields({ mandateId }, ["mandateId"], "directDebits.getMandateStatus");
+    return this.request({
+      method: "GET",
+      path: "/v1/direct-debits/status",
+      query: { mandateId }
+    });
+  }
+  async listMandates(params = {}) {
+    return this.request({
+      method: "GET",
+      path: "/v1/direct-debits/mandates",
+      query: { ...params }
+    });
+  }
+  async updateMandateStatus(params) {
+    requireFields(
+      params,
+      ["mandateId", "status"],
+      "directDebits.updateMandateStatus"
+    );
+    return this.request({
+      method: "PUT",
+      path: "/v1/direct-debits/update-status",
+      body: params
+    });
+  }
+};
+
+// src/resources/globalCollection.ts
+var GlobalCollection = class extends Resource {
+  /** Mobile-money providers for DRC inflows. */
+  async listDrcProviders() {
+    return this.request({
+      method: "GET",
+      path: "/v1/global-collection/drc/inflow/providers"
+    });
+  }
+  /** Start a mobile-money inflow. Never retried automatically. */
+  async initiateInflow(params) {
+    return this.request({
+      method: "POST",
+      path: "/v1/global-collection/inflow/initiate",
+      body: params
+    });
+  }
+  async getTransaction(transactionId) {
+    return this.request({
+      method: "GET",
+      path: `/v1/global-collection/transactions/${seg(transactionId, "transactionId")}`
+    });
+  }
+};
+
+// src/resources/globalPayout.ts
+var GlobalPayout = class extends Resource {
+  #accountsPath() {
+    return this.ctx.environment === "sandbox" ? "/v1/sandbox/global-payout/accounts" : "/v1/global-payout/accounts";
+  }
+  async listAccounts() {
+    return this.request({ method: "GET", path: this.#accountsPath() });
+  }
+  async getAccount(accountId) {
+    return this.request({
+      method: "GET",
+      path: `${this.#accountsPath()}/${seg(accountId, "accountId")}`
+    });
+  }
+  async listBankProviders(params = {}) {
+    return this.request({
+      method: "GET",
+      path: "/v1/global-payout/bank/providers",
+      query: { ...params }
+    });
+  }
+  async getExchangeRates(params) {
+    requireFields(
+      params,
+      ["from", "to"],
+      "globalPayout.getExchangeRates"
+    );
+    return this.request({
+      method: "GET",
+      path: "/v1/global-payout/exchange-rates",
+      query: { ...params }
+    });
+  }
+  async listPaymentMethods(params = {}) {
+    return this.request({
+      method: "GET",
+      path: "/v1/global-payout/payment-methods",
+      query: { ...params }
+    });
+  }
+  async getTransaction(transactionId) {
+    return this.request({
+      method: "GET",
+      path: `/v1/global-payout/transactions/${seg(transactionId, "transactionId")}`
+    });
+  }
+  /** Never retried automatically; pass an `idempotencyKey` and reuse it when retrying. */
+  async authorizeExchange(params) {
+    return this.request({
+      method: "POST",
+      path: "/v1/global-payout/exchange/authorize",
+      body: params
+    });
+  }
+  async convertMoney(params) {
+    return this.request({
+      method: "POST",
+      path: "/v1/global-payout/money/convert",
+      body: params
+    });
+  }
+  /** Never retried automatically; pass an `idempotencyKey` and reuse it when retrying. */
+  async authorizeTransfer(params) {
+    return this.request({
+      method: "POST",
+      path: "/v1/global-payout/transfer/authorize",
+      body: params
+    });
+  }
+};
+
+// src/resources/terminals.ts
+var Terminals = class extends Resource {
+  /** Assign a terminal to the parent account or a sub account. */
+  async assign(params, options = {}) {
+    requireFields(
+      params,
+      ["serialNumber"],
+      "terminals.assign"
+    );
+    return this.request({
+      method: "POST",
+      path: this.withSubAccount("/v1/terminals/assign", options.subAccountId),
+      body: params
+    });
+  }
+  /** Un-assign a terminal from the parent account or a sub account. */
+  async unassign(params, options = {}) {
+    requireFields(
+      params,
+      ["serialNumber"],
+      "terminals.unassign"
+    );
+    return this.request({
+      method: "POST",
+      path: this.withSubAccount("/v1/terminals/unassign", options.subAccountId),
+      body: params
+    });
+  }
+  /** Push a payment request to a terminal. */
+  async sendPaymentRequest(terminalId, params) {
+    requireFields(
+      params,
+      ["merchantTxRef", "amount", "currency"],
+      "terminals.sendPaymentRequest"
+    );
+    return this.request({
+      method: "POST",
+      path: `/v1/terminals/payment-request/${seg(terminalId, "terminalId")}`,
+      body: params
+    });
+  }
+};
+
+// src/resources/transactions.ts
+var REFERENCE_KEYS = [
+  "transactionRef",
+  "merchantTxRef",
+  "orderReference",
+  "orderId"
+];
+var Transactions = class extends Resource {
+  #accountsPath(subAccountId, suffix = "") {
+    return this.withSubAccount("/v1/transactions/accounts", subAccountId, suffix);
+  }
+  /** One page of transactions on the parent account or a sub account. */
+  async list(params = {}) {
+    const { subAccountId, ...query } = params;
+    validateLimit(query.limit);
+    return this.request({
+      method: "GET",
+      path: this.#accountsPath(subAccountId),
+      query: { ...query }
+    });
+  }
+  /** Every transaction, across pages: `for await (const tx of nomba.transactions.listAll())`. */
+  async *listAll(params = {}) {
+    validateLimit(params.limit);
+    yield* autoPage((cursor) => this.list({ ...params, cursor }));
+  }
+  /** One page of transactions matching `filters`. */
+  async filter(filters = {}, params = {}) {
+    const { subAccountId, ...query } = params;
+    validateLimit(query.limit);
+    return this.request({
+      method: "POST",
+      path: this.#accountsPath(subAccountId),
+      query: { ...query },
+      body: filters
+    });
+  }
+  /** Every transaction matching `filters`, across pages. */
+  async *filterAll(filters = {}, params = {}) {
+    validateLimit(params.limit);
+    yield* autoPage((cursor) => this.filter(filters, { ...params, cursor }));
+  }
+  /** One transaction, by exactly one of `transactionRef`, `merchantTxRef`, `orderReference`, `orderId`. */
+  async get(params) {
+    requireExactlyOne(
+      params,
+      REFERENCE_KEYS,
+      "transactions.get"
+    );
+    const { subAccountId, ...query } = params;
+    return this.request({
+      method: "GET",
+      path: this.#accountsPath(subAccountId, "/single"),
+      query: { ...query }
+    });
+  }
+  /** One page of credits/debits on the parent account. */
+  async listBankTransactions(params = {}) {
+    validateLimit(params.limit);
+    return this.request({
+      method: "GET",
+      path: "/v1/transactions/bank",
+      query: { ...params }
+    });
+  }
+  /** Every credit/debit on the parent account, across pages. */
+  async *listAllBankTransactions(params = {}) {
+    validateLimit(params.limit);
+    yield* autoPage((cursor) => this.listBankTransactions({ ...params, cursor }));
+  }
+  /** Confirm a transaction's status by its NIP `sessionId`. */
+  async requery(sessionId) {
+    return this.request({
+      method: "GET",
+      path: `/v1/transactions/requery/${seg(sessionId, "sessionId")}`
+    });
+  }
+};
+
+// src/resources/transfers.ts
+var Transfers = class extends Resource {
+  /** Bank codes and names. */
+  async listBanks() {
+    return this.request({ method: "GET", path: "/v1/transfers/banks" });
+  }
+  /** Resolve the account name for an account number and bank code. */
+  async lookupAccount(params) {
+    requireFields(
+      params,
+      ["accountNumber", "bankCode"],
+      "transfers.lookupAccount"
+    );
+    return this.request({
+      method: "POST",
+      path: "/v1/transfers/bank/lookup",
+      body: { accountNumber: params.accountNumber, bankCode: params.bankCode }
+    });
+  }
+  /**
+   * Transfer to a bank account. Never retried automatically. Pass your own
+   * `merchantTxRef` (or keep the generated one from the result) to requery.
+   */
+  async toBank(params, options = {}) {
+    requireFields(
+      params,
+      ["amount", "accountNumber", "accountName", "bankCode"],
+      "transfers.toBank"
+    );
+    return this.withMerchantTxRef("/v2/transfers/bank", params, options);
+  }
+  /** Transfer to another Nomba wallet. Never retried automatically. */
+  async toWallet(params, options = {}) {
+    requireFields(
+      params,
+      ["amount", "receiverAccountId"],
+      "transfers.toWallet"
+    );
+    return this.withMerchantTxRef("/v2/transfers/wallet", params, options);
+  }
+};
+
+// src/resources/virtualAccounts.ts
+var VirtualAccounts = class extends Resource {
+  /** Create a virtual account on the parent account or a sub account. */
+  async create(params, options = {}) {
+    requireFields(
+      params,
+      ["accountRef", "accountName"],
+      "virtualAccounts.create"
+    );
+    return this.request({
+      method: "POST",
+      path: this.withSubAccount("/v1/accounts/virtual", options.subAccountId),
+      body: params
+    });
+  }
+  /** Fetch a virtual account by its account reference or number. */
+  async get(identifier) {
+    return this.request({
+      method: "GET",
+      path: `/v1/accounts/virtual/${seg(identifier, "identifier")}`
+    });
+  }
+  async update(identifier, params) {
+    return this.request({
+      method: "PUT",
+      path: `/v1/accounts/virtual/${seg(identifier, "identifier")}`,
+      body: params
+    });
+  }
+  /** Expire (close) a virtual account. */
+  async expire(identifier) {
+    return this.request({
+      method: "DELETE",
+      path: `/v1/accounts/virtual/${seg(identifier, "identifier")}`
+    });
+  }
+  /** One page of virtual accounts matching `filters`. */
+  async list(filters = {}, options = {}) {
+    validateLimit(options.limit);
+    return this.request({
+      method: "POST",
+      path: "/v1/accounts/virtual/list",
+      query: { limit: options.limit, cursor: options.cursor },
+      body: filters
+    });
+  }
+  /** Every virtual account matching `filters`, across pages. */
+  async *listAll(filters = {}, options = {}) {
+    validateLimit(options.limit);
+    yield* autoPage((cursor) => this.list(filters, { limit: options.limit, cursor }));
+  }
+};
+
+// src/version.ts
+var VERSION = "0.1.0";
+function header(headers, name) {
+  if (typeof headers.get === "function") {
+    const v = headers.get(name);
+    return v ?? void 0;
+  }
+  const record = headers;
+  for (const key of Object.keys(record)) {
+    if (key.toLowerCase() === name) {
+      const v = record[key];
+      return Array.isArray(v) ? v[0] : v;
+    }
+  }
+  return void 0;
+}
+function field(v) {
+  if (v === void 0 || v === null) return "";
+  return typeof v === "string" ? v : String(v);
+}
+var RFC3339 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$/;
+function signedResponseCode(event) {
+  const responseCode = field(event.data.transaction.responseCode);
+  return responseCode === "null" ? "" : responseCode;
+}
+function webhookSignedMessage(event, timestamp) {
+  const { merchant, transaction } = event.data;
+  return [
+    event.event_type,
+    event.requestId,
+    field(merchant.userId),
+    field(merchant.walletId),
+    field(transaction.transactionId),
+    field(transaction.type),
+    field(transaction.time),
+    signedResponseCode(event),
+    timestamp
+  ].join(":");
+}
+function computeWebhookSignature(event, timestamp, signingKey) {
+  return createHmac("sha256", signingKey).update(webhookSignedMessage(event, timestamp), "utf8").digest("base64");
+}
+function parseEvent(rawBody) {
+  if (typeof rawBody !== "string" && !(rawBody instanceof Uint8Array) && !(rawBody instanceof ArrayBuffer)) {
+    throw new WebhookVerificationError(
+      "Webhook body must be the raw request body as a string or bytes, not a parsed object"
+    );
+  }
+  const text = typeof rawBody === "string" ? rawBody : new TextDecoder("utf-8").decode(
+    rawBody instanceof ArrayBuffer ? new Uint8Array(rawBody) : rawBody
+  );
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new WebhookVerificationError("Webhook body is not valid JSON");
+  }
+  if (!isRecord(parsed) || typeof parsed.event_type !== "string" || typeof parsed.requestId !== "string" || !isRecord(parsed.data) || !isRecord(parsed.data.merchant) || !isRecord(parsed.data.transaction)) {
+    throw new WebhookVerificationError(
+      "Webhook body is missing event_type, requestId, data.merchant or data.transaction"
+    );
+  }
+  return parsed;
+}
+function verifyWebhook(rawBody, headers, signingKey, options = {}) {
+  if (typeof signingKey !== "string" || signingKey === "") {
+    throw new WebhookVerificationError("A webhook signing key is required");
+  }
+  if (!headers || typeof headers !== "object") {
+    throw new WebhookVerificationError("Webhook headers are required");
+  }
+  const signature = header(headers, "nomba-signature") ?? header(headers, "nomba-sig-value");
+  if (!signature) throw new WebhookVerificationError("Missing nomba-signature header");
+  const timestamp = header(headers, "nomba-timestamp");
+  if (!timestamp) throw new WebhookVerificationError("Missing nomba-timestamp header");
+  const algorithm = header(headers, "nomba-signature-algorithm");
+  if (algorithm !== void 0 && algorithm !== "HmacSHA256") {
+    throw new WebhookVerificationError(`Unsupported signature algorithm "${algorithm}"`);
+  }
+  if (!RFC3339.test(timestamp)) {
+    throw new WebhookVerificationError(
+      "Invalid nomba-timestamp header: expected RFC 3339"
+    );
+  }
+  const event = parseEvent(rawBody);
+  if (signedResponseCode(event).includes(":")) {
+    throw new WebhookVerificationError("Invalid data.transaction.responseCode");
+  }
+  if (options.toleranceSeconds !== void 0) {
+    const ts = Date.parse(timestamp);
+    if (Number.isNaN(ts))
+      throw new WebhookVerificationError("Invalid nomba-timestamp header");
+    const now = (options.now ?? /* @__PURE__ */ new Date()).getTime();
+    if (Math.abs(now - ts) > options.toleranceSeconds * 1e3) {
+      throw new WebhookVerificationError(
+        "Webhook timestamp is outside the tolerance window"
+      );
+    }
+  }
+  const expected = computeWebhookSignature(event, timestamp, signingKey);
+  const a = Buffer.from(expected, "utf8");
+  const b = Buffer.from(signature.trim(), "utf8");
+  if (a.length !== b.length || !timingSafeEqual(a, b)) {
+    throw new WebhookVerificationError("Webhook signature does not match");
+  }
+  return event;
+}
+var webhooks = {
+  verify: verifyWebhook,
+  computeSignature: computeWebhookSignature
+};
+
+// src/client.ts
+var DEFAULT_TIMEOUT_MS = 3e4;
+var DEFAULT_MAX_RETRIES = 2;
+var LOCAL_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+function required(value, option, env) {
+  if (value === void 0 || value === "") {
+    throw new ConfigurationError(
+      `Missing ${option}: pass the "${option}" option or set the ${env} environment variable`
+    );
+  }
+  return value;
+}
+function resolveEnvironment(value) {
+  const env = value ?? "sandbox";
+  if (env !== "sandbox" && env !== "production") {
+    throw new ConfigurationError(
+      `Invalid environment "${env}": use "sandbox" or "production"`
+    );
+  }
+  return env;
+}
+function resolveBaseUrl(value, environment) {
+  if (value === void 0) return BASE_URLS[environment];
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new ConfigurationError(`Invalid baseUrl: not a URL`);
+  }
+  const local = LOCAL_HOSTS.has(url.hostname);
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && local)) {
+    throw new ConfigurationError(
+      "baseUrl must use https:// (http:// is allowed only for localhost)"
+    );
+  }
+  if (url.search || url.hash || url.username || url.password) {
+    throw new ConfigurationError(
+      "baseUrl must not contain credentials, a query or a fragment"
+    );
+  }
+  return url.toString().replace(/\/+$/, "");
+}
+var Nomba = class {
+  /** Webhook verification without a client: `Nomba.webhooks.verify(rawBody, headers, key)`. */
+  static webhooks = webhooks;
+  static VERSION = VERSION;
+  environment;
+  baseUrl;
+  accountId;
+  auth;
+  accounts;
+  virtualAccounts;
+  checkout;
+  transfers;
+  transactions;
+  terminals;
+  directDebits;
+  bills;
+  globalPayout;
+  globalCollection;
+  webhooks = webhooks;
+  #clientId;
+  constructor(options = {}) {
+    const clientId = required(
+      options.clientId ?? readEnv("NOMBA_CLIENT_ID"),
+      "clientId",
+      "NOMBA_CLIENT_ID"
+    );
+    const clientSecret = required(
+      options.clientSecret ?? readEnv("NOMBA_CLIENT_SECRET"),
+      "clientSecret",
+      "NOMBA_CLIENT_SECRET"
+    );
+    this.accountId = required(
+      options.accountId ?? readEnv("NOMBA_ACCOUNT_ID"),
+      "accountId",
+      "NOMBA_ACCOUNT_ID"
+    );
+    this.environment = resolveEnvironment(
+      options.environment ?? readEnv("NOMBA_ENVIRONMENT")
+    );
+    this.baseUrl = resolveBaseUrl(options.baseUrl, this.environment);
+    this.#clientId = clientId;
+    const timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;
+    if (typeof timeout !== "number" || !Number.isFinite(timeout) || timeout <= 0) {
+      throw new ConfigurationError("timeout must be a positive number of milliseconds");
+    }
+    const maxRetries = options.maxRetries ?? DEFAULT_MAX_RETRIES;
+    if (!Number.isInteger(maxRetries) || maxRetries < 0) {
+      throw new ConfigurationError("maxRetries must be a non-negative integer");
+    }
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    if (typeof fetchImpl !== "function") {
+      throw new ConfigurationError(
+        "No fetch implementation: use Node 18+ or pass the fetch option"
+      );
+    }
+    const http = new HttpClient({
+      baseUrl: this.baseUrl,
+      accountId: this.accountId,
+      timeout,
+      maxRetries,
+      fetch: fetchImpl,
+      userAgent: `nomba-node/${VERSION} ${runtimeVersion()}`
+    });
+    const tokens = new TokenManager({
+      store: options.tokenStore ?? new InMemoryTokenStore(),
+      issue: () => http.request({
+        method: "POST",
+        path: "/v1/auth/token/issue",
+        body: {
+          grant_type: "client_credentials",
+          client_id: clientId,
+          client_secret: clientSecret
+        },
+        token: "obtain"
+      }),
+      refresh: (refreshToken) => http.request({
+        method: "POST",
+        path: "/v1/auth/token/refresh",
+        body: { grant_type: "refresh_token", refresh_token: refreshToken },
+        token: "obtain"
+      })
+    });
+    http.setTokenManager(tokens);
+    const ctx = { http, environment: this.environment };
+    this.auth = new AuthResource(ctx, tokens, clientId);
+    this.accounts = new Accounts(ctx);
+    this.virtualAccounts = new VirtualAccounts(ctx);
+    this.checkout = new Checkout(ctx);
+    this.transfers = new Transfers(ctx);
+    this.transactions = new Transactions(ctx);
+    this.terminals = new Terminals(ctx);
+    this.directDebits = new DirectDebits(ctx);
+    this.bills = new Bills(ctx);
+    this.globalPayout = new GlobalPayout(ctx);
+    this.globalCollection = new GlobalCollection(ctx);
+  }
+  /** Safe summary: never includes the client secret or tokens. */
+  toJSON() {
+    return {
+      clientId: this.#clientId,
+      accountId: this.accountId,
+      environment: this.environment,
+      baseUrl: this.baseUrl
+    };
+  }
+  [/* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom")]() {
+    return `Nomba ${JSON.stringify(this.toJSON())}`;
+  }
+};
+
+// src/index.ts
+var index_default = Nomba;
+
+export { ApiError, AuthenticationError, BASE_URLS, ConfigurationError, ConnectionError, InMemoryTokenStore, Nomba, NombaError, NotFoundError, PermissionDeniedError, RateLimitError, SUCCESS_CODES, ServerError, TimeoutError, TransactionStatus, VERSION, ValidationError, WebhookEventType, WebhookVerificationError, computeWebhookSignature, index_default as default, verifyWebhook };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map