@paybetaby/node-sdk 0.1.1

package/dist/index.js

@@ -0,0 +1,313 @@
+'use strict';
+
+var crypto = require('crypto');
+
+// src/errors.ts
+var PaybetaError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PaybetaError";
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var PaybetaApiError = class extends PaybetaError {
+  constructor(status, code, message, traceId, timestamp) {
+    super(message);
+    this.name = "PaybetaApiError";
+    this.status = status;
+    this.code = code;
+    this.traceId = traceId;
+    this.timestamp = timestamp;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+
+// src/http.ts
+var HttpClient = class {
+  constructor(config) {
+    this.config = config;
+  }
+  async request(method, path, options) {
+    const url = new URL(`/v1${path}`, this.config.baseUrl);
+    if (options?.query) {
+      for (const [key, value] of Object.entries(options.query)) {
+        if (value !== void 0 && value !== null) {
+          url.searchParams.set(key, String(value));
+        }
+      }
+    }
+    const headers = {
+      "X-API-Key": this.config.apiKey,
+      Accept: "application/json"
+    };
+    let body;
+    if (options?.body !== void 0) {
+      headers["Content-Type"] = "application/json";
+      body = JSON.stringify(options.body);
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.config.timeout);
+    let response;
+    try {
+      response = await fetch(url.toString(), {
+        method,
+        headers,
+        body,
+        signal: controller.signal
+      });
+    } catch (err) {
+      if (err instanceof Error && err.name === "AbortError") {
+        throw new PaybetaError(`Request timed out after ${this.config.timeout}ms`);
+      }
+      throw err;
+    } finally {
+      clearTimeout(timer);
+    }
+    let payload;
+    const contentType = response.headers.get("content-type") ?? "";
+    if (contentType.includes("application/json")) {
+      payload = await response.json().catch(() => null);
+    } else {
+      payload = await response.text().catch(() => null);
+    }
+    if (!response.ok) {
+      const errBody = payload ?? {};
+      const errDetail = errBody.error ?? {};
+      throw new PaybetaApiError(
+        response.status,
+        errDetail.code ?? String(response.status),
+        errDetail.message ?? errBody.message ?? "Request failed",
+        errDetail.traceId ?? "",
+        errDetail.timestamp ?? (/* @__PURE__ */ new Date()).toISOString()
+      );
+    }
+    return payload;
+  }
+  get(path, query) {
+    return this.request("GET", path, { query });
+  }
+  post(path, body) {
+    return this.request("POST", path, { body });
+  }
+  patch(path, body) {
+    return this.request("PATCH", path, { body });
+  }
+  delete(path) {
+    return this.request("DELETE", path);
+  }
+};
+
+// src/resources/transactions.ts
+var TransactionsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  create(params, opts) {
+    const body = opts?.idempotencyKey ? { ...params, idempotencyKey: opts.idempotencyKey } : params;
+    return this.http.post("/transactions", body);
+  }
+  /**
+   * Lists transactions. The bare `/transactions` endpoint is platform-role
+   * only — an API-key (merchant) caller gets a 403 there — so passing
+   * `merchantId` routes to `/transactions/merchant/:merchantId` instead.
+   */
+  list(params) {
+    const { merchantId, ...rest } = params ?? {};
+    const path = merchantId ? `/transactions/merchant/${merchantId}` : "/transactions";
+    return this.http.get(path, rest);
+  }
+  retrieve(id) {
+    return this.http.get(`/transactions/${id}`);
+  }
+  listHistory(id) {
+    return this.http.get(`/transactions/${id}/history`);
+  }
+};
+
+// src/resources/payments.ts
+var PaymentsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  initiate(params) {
+    const { idempotencyKey, ...rest } = params;
+    const body = idempotencyKey ? { ...rest, idempotencyKey } : rest;
+    return this.http.post("/payments", body);
+  }
+  /**
+   * Lists payments. The bare `/payments` endpoint is platform-role only —
+   * an API-key (merchant) caller gets a 403 there — so passing `merchantId`
+   * (which every merchant API key call needs) routes to
+   * `/payments/merchant/:merchantId` instead, matching what the API
+   * actually allows a merchant credential to call.
+   */
+  list(params) {
+    const { merchantId, ...rest } = params ?? {};
+    const path = merchantId ? `/payments/merchant/${merchantId}` : "/payments";
+    return this.http.get(path, rest);
+  }
+  retrieve(id) {
+    return this.http.get(`/payments/${id}`);
+  }
+  verify(id) {
+    return this.http.post(`/payments/${id}/verify`);
+  }
+  retry(id) {
+    return this.http.post(`/payments/${id}/retry`);
+  }
+  listAttempts(id) {
+    return this.http.get(`/payments/${id}/attempts`);
+  }
+};
+
+// src/resources/escrows.ts
+var EscrowsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  create(params, opts) {
+    const body = opts?.idempotencyKey ? { ...params, idempotencyKey: opts.idempotencyKey } : params;
+    return this.http.post("/escrows", body);
+  }
+  /**
+   * Lists escrows. The bare `/escrows` endpoint is platform-role only — an
+   * API-key (merchant) caller gets a 403 there — so passing `merchantId`
+   * routes to `/escrows/merchant/:merchantId` instead. Unlike
+   * payments/transactions/disputes, this returns a `{ escrows, total,
+   * limit, offset }` envelope rather than a bare array.
+   */
+  list(params) {
+    const { merchantId, ...rest } = params ?? {};
+    const path = merchantId ? `/escrows/merchant/${merchantId}` : "/escrows";
+    return this.http.get(path, rest);
+  }
+  retrieve(id) {
+    return this.http.get(`/escrows/${id}`);
+  }
+  retrieveBalance(id) {
+    return this.http.get(`/escrows/${id}/balance`);
+  }
+  retrieveConditions(id) {
+    return this.http.get(`/escrows/${id}/conditions`);
+  }
+  release(id, params) {
+    return this.http.post(`/escrows/${id}/release`, params);
+  }
+  refund(id) {
+    return this.http.post(`/escrows/${id}/refund`);
+  }
+  dispute(id) {
+    return this.http.post(`/escrows/${id}/dispute`);
+  }
+  cancel(id) {
+    return this.http.post(`/escrows/${id}/cancel`);
+  }
+  confirmDelivery(id, params) {
+    return this.http.post(`/escrows/${id}/confirm-delivery`, params);
+  }
+  confirmBuyer(id, params) {
+    return this.http.post(`/escrows/${id}/confirm-buyer`, params);
+  }
+};
+
+// src/resources/disputes.ts
+var DisputesResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  open(params) {
+    return this.http.post("/disputes", params);
+  }
+  /**
+   * Lists disputes. The bare `/disputes` endpoint is platform-role only —
+   * an API-key (merchant) caller gets a 403 there — so passing
+   * `merchantId` routes to `/disputes/merchant/:merchantId` instead.
+   */
+  list(params) {
+    const { merchantId, ...rest } = params ?? {};
+    const path = merchantId ? `/disputes/merchant/${merchantId}` : "/disputes";
+    return this.http.get(path, rest);
+  }
+  retrieve(id) {
+    return this.http.get(`/disputes/${id}`);
+  }
+  listEvidence(id) {
+    return this.http.get(`/disputes/${id}/evidence`);
+  }
+  uploadEvidence(id, params) {
+    return this.http.post(`/disputes/${id}/evidence`, params);
+  }
+  resolve(id, params) {
+    return this.http.post(`/disputes/${id}/resolve`, params);
+  }
+  cancel(id, params) {
+    return this.http.post(`/disputes/${id}/cancel`, params);
+  }
+};
+var WebhooksResource = class {
+  constructor(secret) {
+    this.secret = secret;
+  }
+  /**
+   * Verifies the signature on an incoming webhook and parses the payload.
+   *
+   * PayBeta signs the concatenation of the delivery timestamp and the raw
+   * request body — `HMAC-SHA256(secret, "${timestamp}.${rawBody}")` — and
+   * sends the result hex-encoded, prefixed with `sha256=`, in the
+   * `X-PayBeta-Signature` header (see OutboundWebhookService). The
+   * timestamp itself arrives separately in `X-PayBeta-Timestamp`, so both
+   * headers are required here, not just the signature.
+   *
+   * Pass the raw request body (before JSON parsing), the value of the
+   * `X-PayBeta-Signature` header, and the value of the `X-PayBeta-Timestamp`
+   * header. Throws `PaybetaError` if the signature is invalid or the
+   * secret was not configured.
+   */
+  constructEvent(rawBody, signature, timestamp) {
+    if (!this.secret) {
+      throw new PaybetaError(
+        "webhookSecret must be set on PaybetaClient to verify webhook signatures"
+      );
+    }
+    const body = typeof rawBody === "string" ? rawBody : rawBody.toString("utf8");
+    const hexSignature = signature.startsWith("sha256=") ? signature.slice("sha256=".length) : signature;
+    const expected = crypto.createHmac("sha256", this.secret).update(`${timestamp}.${body}`).digest("hex");
+    let actual;
+    let expectedBuf;
+    try {
+      actual = Buffer.from(hexSignature, "hex");
+      expectedBuf = Buffer.from(expected, "hex");
+    } catch {
+      throw new PaybetaError("Invalid signature format");
+    }
+    if (expectedBuf.length !== actual.length || !crypto.timingSafeEqual(expectedBuf, actual)) {
+      throw new PaybetaError("Webhook signature verification failed");
+    }
+    return JSON.parse(body);
+  }
+};
+
+// src/client.ts
+var PaybetaClient = class {
+  constructor(config) {
+    if (!config.apiKey) {
+      throw new Error("PaybetaClient: apiKey is required");
+    }
+    const http = new HttpClient({
+      apiKey: config.apiKey,
+      baseUrl: config.baseUrl ?? "https://api.usepaybeta.com",
+      timeout: config.timeout ?? 3e4
+    });
+    this.transactions = new TransactionsResource(http);
+    this.payments = new PaymentsResource(http);
+    this.escrows = new EscrowsResource(http);
+    this.disputes = new DisputesResource(http);
+    this.webhooks = new WebhooksResource(config.webhookSecret ?? "");
+  }
+};
+
+exports.PaybetaApiError = PaybetaApiError;
+exports.PaybetaClient = PaybetaClient;
+exports.PaybetaError = PaybetaError;
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts","../src/http.ts","../src/resources/transactions.ts","../src/resources/payments.ts","../src/resources/escrows.ts","../src/resources/disputes.ts","../src/resources/webhooks.ts","../src/client.ts"],"names":["createHmac","timingSafeEqual"],"mappings":";;;;;AAAO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EACtC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AACF;AAEO,IAAM,eAAA,GAAN,cAA8B,YAAA,CAAa;AAAA,EAMhD,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,OAAA,EAAiB,SAAiB,SAAA,EAAmB;AAC7F,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AACF;;;ACLO,IAAM,aAAN,MAAiB;AAAA,EACtB,YAA6B,MAAA,EAA0B;AAA1B,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAA2B;AAAA,EAExD,MAAM,OAAA,CACJ,MAAA,EACA,IAAA,EACA,OAAA,EAIY;AAKZ,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,GAAA,EAAM,IAAI,CAAA,CAAA,EAAI,IAAA,CAAK,OAAO,OAAO,CAAA;AAErD,IAAA,IAAI,SAAS,KAAA,EAAO;AAClB,MAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxD,QAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAAM;AACzC,UAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,GAAA,EAAK,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,QACzC;AAAA,MACF;AAAA,IACF;AAEA,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,WAAA,EAAa,KAAK,MAAA,CAAO,MAAA;AAAA,MACzB,MAAA,EAAQ;AAAA,KACV;AAEA,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI,OAAA,EAAS,SAAS,MAAA,EAAW;AAC/B,MAAA,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AAC1B,MAAA,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,IAAI,CAAA;AAAA,IACpC;AAEA,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,CAAK,OAAO,OAAO,CAAA;AAEtE,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,CAAI,QAAA,EAAS,EAAG;AAAA,QACrC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA;AAAA,QACA,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAe,KAAA,IAAS,GAAA,CAAI,IAAA,KAAS,YAAA,EAAc;AACrD,QAAA,MAAM,IAAI,YAAA,CAAa,CAAA,wBAAA,EAA2B,IAAA,CAAK,MAAA,CAAO,OAAO,CAAA,EAAA,CAAI,CAAA;AAAA,MAC3E;AACA,MAAA,MAAM,GAAA;AAAA,IACR,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAEA,IAAA,IAAI,OAAA;AACJ,IAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AAC5D,IAAA,IAAI,WAAA,CAAY,QAAA,CAAS,kBAAkB,CAAA,EAAG;AAC5C,MAAA,OAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAAA,IAClD,CAAA,MAAO;AACL,MAAA,OAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAAA,IAClD;AAEA,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,OAAA,GAAW,WAAW,EAAC;AAC7B,MAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,KAAA,IAAS,EAAC;AACpC,MAAA,MAAM,IAAI,eAAA;AAAA,QACR,QAAA,CAAS,MAAA;AAAA,QACT,SAAA,CAAU,IAAA,IAAQ,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA;AAAA,QACxC,SAAA,CAAU,OAAA,IAAW,OAAA,CAAQ,OAAA,IAAW,gBAAA;AAAA,QACxC,UAAU,OAAA,IAAW,EAAA;AAAA,QACrB,SAAA,CAAU,SAAA,IAAA,iBAAa,IAAI,IAAA,IAAO,WAAA;AAAY,OAChD;AAAA,IACF;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,GAAA,CAAO,MAAc,KAAA,EAAkF;AACrG,IAAA,OAAO,KAAK,OAAA,CAAW,KAAA,EAAO,IAAA,EAAM,EAAE,OAAO,CAAA;AAAA,EAC/C;AAAA,EAEA,IAAA,CAAQ,MAAc,IAAA,EAA4B;AAChD,IAAA,OAAO,KAAK,OAAA,CAAW,MAAA,EAAQ,IAAA,EAAM,EAAE,MAAM,CAAA;AAAA,EAC/C;AAAA,EAEA,KAAA,CAAS,MAAc,IAAA,EAA4B;AACjD,IAAA,OAAO,KAAK,OAAA,CAAW,OAAA,EAAS,IAAA,EAAM,EAAE,MAAM,CAAA;AAAA,EAChD;AAAA,EAEA,OAAU,IAAA,EAA0B;AAClC,IAAA,OAAO,IAAA,CAAK,OAAA,CAAW,QAAA,EAAU,IAAI,CAAA;AAAA,EACvC;AACF,CAAA;;;ACvGO,IAAM,uBAAN,MAA2B;AAAA,EAChC,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA,EAEhD,MAAA,CAAO,QAAiC,IAAA,EAA6C;AACnF,IAAA,MAAM,IAAA,GAAO,MAAM,cAAA,GACf,EAAE,GAAG,MAAA,EAAQ,cAAA,EAAgB,IAAA,CAAK,cAAA,EAAe,GACjD,MAAA;AACJ,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAkB,eAAA,EAAiB,IAAI,CAAA;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,KAAK,MAAA,EAAyD;AAC5D,IAAA,MAAM,EAAE,UAAA,EAAY,GAAG,IAAA,EAAK,GAAI,UAAU,EAAC;AAC3C,IAAA,MAAM,IAAA,GAAO,UAAA,GAAa,CAAA,uBAAA,EAA0B,UAAU,CAAA,CAAA,GAAK,eAAA;AACnE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAmB,IAAA,EAAM,IAAmD,CAAA;AAAA,EAC/F;AAAA,EAEA,SAAS,EAAA,EAAkC;AACzC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAiB,CAAA,cAAA,EAAiB,EAAE,CAAA,CAAE,CAAA;AAAA,EACzD;AAAA,EAEA,YAAY,EAAA,EAAyC;AACnD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAwB,CAAA,cAAA,EAAiB,EAAE,CAAA,QAAA,CAAU,CAAA;AAAA,EACxE;AACF,CAAA;;;AC7BO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA,EAEhD,SAAS,MAAA,EAAiD;AACxD,IAAA,MAAM,EAAE,cAAA,EAAgB,GAAG,IAAA,EAAK,GAAI,MAAA;AACpC,IAAA,MAAM,OAAO,cAAA,GAAiB,EAAE,GAAG,IAAA,EAAM,gBAAe,GAAI,IAAA;AAC5D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAc,WAAA,EAAa,IAAI,CAAA;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,KAAK,MAAA,EAAiD;AACpD,IAAA,MAAM,EAAE,UAAA,EAAY,GAAG,IAAA,EAAK,GAAI,UAAU,EAAC;AAC3C,IAAA,MAAM,IAAA,GAAO,UAAA,GAAa,CAAA,mBAAA,EAAsB,UAAU,CAAA,CAAA,GAAK,WAAA;AAC/D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAe,IAAA,EAAM,IAAmD,CAAA;AAAA,EAC3F;AAAA,EAEA,SAAS,EAAA,EAA8B;AACrC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAa,CAAA,UAAA,EAAa,EAAE,CAAA,CAAE,CAAA;AAAA,EACjD;AAAA,EAEA,OAAO,EAAA,EAA8B;AACnC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAc,CAAA,UAAA,EAAa,EAAE,CAAA,OAAA,CAAS,CAAA;AAAA,EACzD;AAAA,EAEA,MAAM,EAAA,EAA8B;AAClC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAc,CAAA,UAAA,EAAa,EAAE,CAAA,MAAA,CAAQ,CAAA;AAAA,EACxD;AAAA,EAEA,aAAa,EAAA,EAAuC;AAClD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAsB,CAAA,UAAA,EAAa,EAAE,CAAA,SAAA,CAAW,CAAA;AAAA,EACnE;AACF,CAAA;;;AC/BO,IAAM,kBAAN,MAAsB;AAAA,EAC3B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA,EAEhD,MAAA,CAAO,QAA4B,IAAA,EAAwC;AACzE,IAAA,MAAM,IAAA,GAAO,MAAM,cAAA,GACf,EAAE,GAAG,MAAA,EAAQ,cAAA,EAAgB,IAAA,CAAK,cAAA,EAAe,GACjD,MAAA;AACJ,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAa,UAAA,EAAY,IAAI,CAAA;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,KAAK,MAAA,EAAyD;AAC5D,IAAA,MAAM,EAAE,UAAA,EAAY,GAAG,IAAA,EAAK,GAAI,UAAU,EAAC;AAC3C,IAAA,MAAM,IAAA,GAAO,UAAA,GAAa,CAAA,kBAAA,EAAqB,UAAU,CAAA,CAAA,GAAK,UAAA;AAC9D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAwB,IAAA,EAAM,IAAmD,CAAA;AAAA,EACpG;AAAA,EAEA,SAAS,EAAA,EAA6B;AACpC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAY,CAAA,SAAA,EAAY,EAAE,CAAA,CAAE,CAAA;AAAA,EAC/C;AAAA,EAEA,gBAAgB,EAAA,EAAoC;AAClD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAmB,CAAA,SAAA,EAAY,EAAE,CAAA,QAAA,CAAU,CAAA;AAAA,EAC9D;AAAA,EAEA,mBAAmB,EAAA,EAA+C;AAChE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAA8B,CAAA,SAAA,EAAY,EAAE,CAAA,WAAA,CAAa,CAAA;AAAA,EAC5E;AAAA,EAEA,OAAA,CAAQ,IAAY,MAAA,EAA+C;AACjE,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,YAAY,MAAM,CAAA;AAAA,EAChE;AAAA,EAEA,OAAO,EAAA,EAA6B;AAClC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,CAAA,OAAA,CAAS,CAAA;AAAA,EACvD;AAAA,EAEA,QAAQ,EAAA,EAA6B;AACnC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,CAAA,QAAA,CAAU,CAAA;AAAA,EACxD;AAAA,EAEA,OAAO,EAAA,EAA6B;AAClC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,CAAA,OAAA,CAAS,CAAA;AAAA,EACvD;AAAA,EAEA,eAAA,CAAgB,IAAY,MAAA,EAAiD;AAC3E,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,qBAAqB,MAAM,CAAA;AAAA,EACzE;AAAA,EAEA,YAAA,CAAa,IAAY,MAAA,EAA8C;AACrE,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,kBAAkB,MAAM,CAAA;AAAA,EACtE;AACF,CAAA;;;AC7DO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA,EAEhD,KAAK,MAAA,EAA6C;AAChD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAc,WAAA,EAAa,MAAM,CAAA;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,KAAK,MAAA,EAAiD;AACpD,IAAA,MAAM,EAAE,UAAA,EAAY,GAAG,IAAA,EAAK,GAAI,UAAU,EAAC;AAC3C,IAAA,MAAM,IAAA,GAAO,UAAA,GAAa,CAAA,mBAAA,EAAsB,UAAU,CAAA,CAAA,GAAK,WAAA;AAC/D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAe,IAAA,EAAM,IAAmD,CAAA;AAAA,EAC3F;AAAA,EAEA,SAAS,EAAA,EAA8B;AACrC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAa,CAAA,UAAA,EAAa,EAAE,CAAA,CAAE,CAAA;AAAA,EACjD;AAAA,EAEA,aAAa,EAAA,EAAiC;AAC5C,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAgB,CAAA,UAAA,EAAa,EAAE,CAAA,SAAA,CAAW,CAAA;AAAA,EAC7D;AAAA,EAEA,cAAA,CAAe,IAAY,MAAA,EAAiD;AAC1E,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAe,CAAA,UAAA,EAAa,EAAE,aAAa,MAAM,CAAA;AAAA,EACpE;AAAA,EAEA,OAAA,CAAQ,IAAY,MAAA,EAAgD;AAClE,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAc,CAAA,UAAA,EAAa,EAAE,YAAY,MAAM,CAAA;AAAA,EAClE;AAAA,EAEA,MAAA,CAAO,IAAY,MAAA,EAA+C;AAChE,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAc,CAAA,UAAA,EAAa,EAAE,WAAW,MAAM,CAAA;AAAA,EACjE;AACF,CAAA;AC5CO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAA6B,MAAA,EAAgB;AAAhB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiB9C,cAAA,CACE,OAAA,EACA,SAAA,EACA,SAAA,EACiB;AACjB,IAAA,IAAI,CAAC,KAAK,MAAA,EAAQ;AAChB,MAAA,MAAM,IAAI,YAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,OAAO,OAAO,OAAA,KAAY,WAAW,OAAA,GAAU,OAAA,CAAQ,SAAS,MAAM,CAAA;AAK5E,IAAA,MAAM,YAAA,GAAe,UAAU,UAAA,CAAW,SAAS,IAAI,SAAA,CAAU,KAAA,CAAM,SAAA,CAAU,MAAM,CAAA,GAAI,SAAA;AAE3F,IAAA,MAAM,QAAA,GAAWA,iBAAA,CAAW,QAAA,EAAU,IAAA,CAAK,MAAM,CAAA,CAC9C,MAAA,CAAO,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA,CAC7B,OAAO,KAAK,CAAA;AAEf,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI,WAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,MAAA,CAAO,IAAA,CAAK,YAAA,EAAc,KAAK,CAAA;AACxC,MAAA,WAAA,GAAc,MAAA,CAAO,IAAA,CAAK,QAAA,EAAU,KAAK,CAAA;AAAA,IAC3C,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,aAAa,0BAA0B,CAAA;AAAA,IACnD;AAEA,IAAA,IAAI,WAAA,CAAY,WAAW,MAAA,CAAO,MAAA,IAAU,CAACC,sBAAA,CAAgB,WAAA,EAAa,MAAM,CAAA,EAAG;AACjF,MAAA,MAAM,IAAI,aAAa,uCAAuC,CAAA;AAAA,IAChE;AAEA,IAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB;AACF,CAAA;;;ACzCO,IAAM,gBAAN,MAAoB;AAAA,EAOzB,YAAY,MAAA,EAA6B;AACvC,IAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAClB,MAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,IACrD;AAEA,IAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW;AAAA,MAC1B,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf,OAAA,EAAS,OAAO,OAAA,IAAW,4BAAA;AAAA,MAC3B,OAAA,EAAS,OAAO,OAAA,IAAW;AAAA,KAC5B,CAAA;AAED,IAAA,IAAA,CAAK,YAAA,GAAe,IAAI,oBAAA,CAAqB,IAAI,CAAA;AACjD,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,gBAAA,CAAiB,IAAI,CAAA;AACzC,IAAA,IAAA,CAAK,OAAA,GAAU,IAAI,eAAA,CAAgB,IAAI,CAAA;AACvC,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,gBAAA,CAAiB,IAAI,CAAA;AACzC,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,gBAAA,CAAiB,MAAA,CAAO,iBAAiB,EAAE,CAAA;AAAA,EACjE;AACF","file":"index.js","sourcesContent":["export class PaybetaError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'PaybetaError';\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\nexport class PaybetaApiError extends PaybetaError {\n  readonly status: number;\n  readonly code: string;\n  readonly traceId: string;\n  readonly timestamp: string;\n\n  constructor(status: number, code: string, message: string, traceId: string, timestamp: string) {\n    super(message);\n    this.name = 'PaybetaApiError';\n    this.status = status;\n    this.code = code;\n    this.traceId = traceId;\n    this.timestamp = timestamp;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n","import { PaybetaApiError, PaybetaError } from './errors.js';\n\nexport interface HttpClientConfig {\n  apiKey: string;\n  baseUrl: string;\n  timeout: number;\n}\n\ninterface ApiErrorBody {\n  error?: {\n    code?: string;\n    message?: string;\n    traceId?: string;\n    timestamp?: string;\n  };\n  message?: string;\n}\n\nexport class HttpClient {\n  constructor(private readonly config: HttpClientConfig) {}\n\n  async request<T>(\n    method: string,\n    path: string,\n    options?: {\n      body?: unknown;\n      query?: Record<string, string | number | boolean | undefined | null>;\n    },\n  ): Promise<T> {\n    // The public API is served behind api-gateway under a /v1 prefix — the\n    // gateway's route table only matches /v1/... and 404s anything else, so\n    // every request must go there regardless of how `path` is written by\n    // the resource classes below.\n    const url = new URL(`/v1${path}`, this.config.baseUrl);\n\n    if (options?.query) {\n      for (const [key, value] of Object.entries(options.query)) {\n        if (value !== undefined && value !== null) {\n          url.searchParams.set(key, String(value));\n        }\n      }\n    }\n\n    const headers: Record<string, string> = {\n      'X-API-Key': this.config.apiKey,\n      Accept: 'application/json',\n    };\n\n    let body: string | undefined;\n    if (options?.body !== undefined) {\n      headers['Content-Type'] = 'application/json';\n      body = JSON.stringify(options.body);\n    }\n\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.config.timeout);\n\n    let response: Response;\n    try {\n      response = await fetch(url.toString(), {\n        method,\n        headers,\n        body,\n        signal: controller.signal,\n      });\n    } catch (err) {\n      if (err instanceof Error && err.name === 'AbortError') {\n        throw new PaybetaError(`Request timed out after ${this.config.timeout}ms`);\n      }\n      throw err;\n    } finally {\n      clearTimeout(timer);\n    }\n\n    let payload: unknown;\n    const contentType = response.headers.get('content-type') ?? '';\n    if (contentType.includes('application/json')) {\n      payload = await response.json().catch(() => null);\n    } else {\n      payload = await response.text().catch(() => null);\n    }\n\n    if (!response.ok) {\n      const errBody = (payload ?? {}) as ApiErrorBody;\n      const errDetail = errBody.error ?? {};\n      throw new PaybetaApiError(\n        response.status,\n        errDetail.code ?? String(response.status),\n        errDetail.message ?? errBody.message ?? 'Request failed',\n        errDetail.traceId ?? '',\n        errDetail.timestamp ?? new Date().toISOString(),\n      );\n    }\n\n    return payload as T;\n  }\n\n  get<T>(path: string, query?: Record<string, string | number | boolean | undefined | null>): Promise<T> {\n    return this.request<T>('GET', path, { query });\n  }\n\n  post<T>(path: string, body?: unknown): Promise<T> {\n    return this.request<T>('POST', path, { body });\n  }\n\n  patch<T>(path: string, body?: unknown): Promise<T> {\n    return this.request<T>('PATCH', path, { body });\n  }\n\n  delete<T>(path: string): Promise<T> {\n    return this.request<T>('DELETE', path);\n  }\n}\n","import type { HttpClient } from '../http.js';\nimport type {\n  Transaction,\n  CreateTransactionParams,\n  ListTransactionsParams,\n  TransactionEvent,\n} from '../types/transactions.js';\nimport type { RequestOptions } from '../types/common.js';\n\nexport class TransactionsResource {\n  constructor(private readonly http: HttpClient) {}\n\n  create(params: CreateTransactionParams, opts?: RequestOptions): Promise<Transaction> {\n    const body = opts?.idempotencyKey\n      ? { ...params, idempotencyKey: opts.idempotencyKey }\n      : params;\n    return this.http.post<Transaction>('/transactions', body);\n  }\n\n  /**\n   * Lists transactions. The bare `/transactions` endpoint is platform-role\n   * only — an API-key (merchant) caller gets a 403 there — so passing\n   * `merchantId` routes to `/transactions/merchant/:merchantId` instead.\n   */\n  list(params?: ListTransactionsParams): Promise<Transaction[]> {\n    const { merchantId, ...rest } = params ?? {};\n    const path = merchantId ? `/transactions/merchant/${merchantId}` : '/transactions';\n    return this.http.get<Transaction[]>(path, rest as Record<string, string | number | undefined>);\n  }\n\n  retrieve(id: string): Promise<Transaction> {\n    return this.http.get<Transaction>(`/transactions/${id}`);\n  }\n\n  listHistory(id: string): Promise<TransactionEvent[]> {\n    return this.http.get<TransactionEvent[]>(`/transactions/${id}/history`);\n  }\n}\n","import type { HttpClient } from '../http.js';\nimport type {\n  Payment,\n  PaymentAttempt,\n  InitiatePaymentParams,\n  ListPaymentsParams,\n} from '../types/payments.js';\n\nexport class PaymentsResource {\n  constructor(private readonly http: HttpClient) {}\n\n  initiate(params: InitiatePaymentParams): Promise<Payment> {\n    const { idempotencyKey, ...rest } = params;\n    const body = idempotencyKey ? { ...rest, idempotencyKey } : rest;\n    return this.http.post<Payment>('/payments', body);\n  }\n\n  /**\n   * Lists payments. The bare `/payments` endpoint is platform-role only —\n   * an API-key (merchant) caller gets a 403 there — so passing `merchantId`\n   * (which every merchant API key call needs) routes to\n   * `/payments/merchant/:merchantId` instead, matching what the API\n   * actually allows a merchant credential to call.\n   */\n  list(params?: ListPaymentsParams): Promise<Payment[]> {\n    const { merchantId, ...rest } = params ?? {};\n    const path = merchantId ? `/payments/merchant/${merchantId}` : '/payments';\n    return this.http.get<Payment[]>(path, rest as Record<string, string | number | undefined>);\n  }\n\n  retrieve(id: string): Promise<Payment> {\n    return this.http.get<Payment>(`/payments/${id}`);\n  }\n\n  verify(id: string): Promise<Payment> {\n    return this.http.post<Payment>(`/payments/${id}/verify`);\n  }\n\n  retry(id: string): Promise<Payment> {\n    return this.http.post<Payment>(`/payments/${id}/retry`);\n  }\n\n  listAttempts(id: string): Promise<PaymentAttempt[]> {\n    return this.http.get<PaymentAttempt[]>(`/payments/${id}/attempts`);\n  }\n}\n","import type { HttpClient } from '../http.js';\nimport type {\n  Escrow,\n  EscrowBalance,\n  EscrowListResponse,\n  EscrowConditionsResponse,\n  CreateEscrowParams,\n  ListEscrowsParams,\n  ReleaseEscrowParams,\n  ConfirmDeliveryParams,\n  ConfirmBuyerParams,\n} from '../types/escrows.js';\nimport type { RequestOptions } from '../types/common.js';\n\nexport class EscrowsResource {\n  constructor(private readonly http: HttpClient) {}\n\n  create(params: CreateEscrowParams, opts?: RequestOptions): Promise<Escrow> {\n    const body = opts?.idempotencyKey\n      ? { ...params, idempotencyKey: opts.idempotencyKey }\n      : params;\n    return this.http.post<Escrow>('/escrows', body);\n  }\n\n  /**\n   * Lists escrows. The bare `/escrows` endpoint is platform-role only — an\n   * API-key (merchant) caller gets a 403 there — so passing `merchantId`\n   * routes to `/escrows/merchant/:merchantId` instead. Unlike\n   * payments/transactions/disputes, this returns a `{ escrows, total,\n   * limit, offset }` envelope rather than a bare array.\n   */\n  list(params?: ListEscrowsParams): Promise<EscrowListResponse> {\n    const { merchantId, ...rest } = params ?? {};\n    const path = merchantId ? `/escrows/merchant/${merchantId}` : '/escrows';\n    return this.http.get<EscrowListResponse>(path, rest as Record<string, string | number | undefined>);\n  }\n\n  retrieve(id: string): Promise<Escrow> {\n    return this.http.get<Escrow>(`/escrows/${id}`);\n  }\n\n  retrieveBalance(id: string): Promise<EscrowBalance> {\n    return this.http.get<EscrowBalance>(`/escrows/${id}/balance`);\n  }\n\n  retrieveConditions(id: string): Promise<EscrowConditionsResponse> {\n    return this.http.get<EscrowConditionsResponse>(`/escrows/${id}/conditions`);\n  }\n\n  release(id: string, params?: ReleaseEscrowParams): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/release`, params);\n  }\n\n  refund(id: string): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/refund`);\n  }\n\n  dispute(id: string): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/dispute`);\n  }\n\n  cancel(id: string): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/cancel`);\n  }\n\n  confirmDelivery(id: string, params?: ConfirmDeliveryParams): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/confirm-delivery`, params);\n  }\n\n  confirmBuyer(id: string, params?: ConfirmBuyerParams): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/confirm-buyer`, params);\n  }\n}\n","import type { HttpClient } from '../http.js';\nimport type {\n  Dispute,\n  Evidence,\n  OpenDisputeParams,\n  ListDisputesParams,\n  UploadEvidenceParams,\n  ResolveDisputeParams,\n  CancelDisputeParams,\n} from '../types/disputes.js';\n\nexport class DisputesResource {\n  constructor(private readonly http: HttpClient) {}\n\n  open(params: OpenDisputeParams): Promise<Dispute> {\n    return this.http.post<Dispute>('/disputes', params);\n  }\n\n  /**\n   * Lists disputes. The bare `/disputes` endpoint is platform-role only —\n   * an API-key (merchant) caller gets a 403 there — so passing\n   * `merchantId` routes to `/disputes/merchant/:merchantId` instead.\n   */\n  list(params?: ListDisputesParams): Promise<Dispute[]> {\n    const { merchantId, ...rest } = params ?? {};\n    const path = merchantId ? `/disputes/merchant/${merchantId}` : '/disputes';\n    return this.http.get<Dispute[]>(path, rest as Record<string, string | number | undefined>);\n  }\n\n  retrieve(id: string): Promise<Dispute> {\n    return this.http.get<Dispute>(`/disputes/${id}`);\n  }\n\n  listEvidence(id: string): Promise<Evidence[]> {\n    return this.http.get<Evidence[]>(`/disputes/${id}/evidence`);\n  }\n\n  uploadEvidence(id: string, params: UploadEvidenceParams): Promise<Evidence> {\n    return this.http.post<Evidence>(`/disputes/${id}/evidence`, params);\n  }\n\n  resolve(id: string, params: ResolveDisputeParams): Promise<Dispute> {\n    return this.http.post<Dispute>(`/disputes/${id}/resolve`, params);\n  }\n\n  cancel(id: string, params: CancelDisputeParams): Promise<Dispute> {\n    return this.http.post<Dispute>(`/disputes/${id}/cancel`, params);\n  }\n}\n","import { createHmac, timingSafeEqual } from 'crypto';\nimport { PaybetaError } from '../errors.js';\nimport type { WebhookEvent } from '../types/webhooks.js';\n\nexport class WebhooksResource {\n  constructor(private readonly secret: string) {}\n\n  /**\n   * Verifies the signature on an incoming webhook and parses the payload.\n   *\n   * PayBeta signs the concatenation of the delivery timestamp and the raw\n   * request body — `HMAC-SHA256(secret, \"${timestamp}.${rawBody}\")` — and\n   * sends the result hex-encoded, prefixed with `sha256=`, in the\n   * `X-PayBeta-Signature` header (see OutboundWebhookService). The\n   * timestamp itself arrives separately in `X-PayBeta-Timestamp`, so both\n   * headers are required here, not just the signature.\n   *\n   * Pass the raw request body (before JSON parsing), the value of the\n   * `X-PayBeta-Signature` header, and the value of the `X-PayBeta-Timestamp`\n   * header. Throws `PaybetaError` if the signature is invalid or the\n   * secret was not configured.\n   */\n  constructEvent<T = unknown>(\n    rawBody: string | Buffer,\n    signature: string,\n    timestamp: string,\n  ): WebhookEvent<T> {\n    if (!this.secret) {\n      throw new PaybetaError(\n        'webhookSecret must be set on PaybetaClient to verify webhook signatures',\n      );\n    }\n\n    const body = typeof rawBody === 'string' ? rawBody : rawBody.toString('utf8');\n\n    // Accept the header verbatim (`sha256=<hex>`) or a bare hex digest, so\n    // callers who've already stripped the prefix don't get a confusing\n    // \"invalid signature format\" error.\n    const hexSignature = signature.startsWith('sha256=') ? signature.slice('sha256='.length) : signature;\n\n    const expected = createHmac('sha256', this.secret)\n      .update(`${timestamp}.${body}`)\n      .digest('hex');\n\n    let actual: Buffer;\n    let expectedBuf: Buffer;\n    try {\n      actual = Buffer.from(hexSignature, 'hex');\n      expectedBuf = Buffer.from(expected, 'hex');\n    } catch {\n      throw new PaybetaError('Invalid signature format');\n    }\n\n    if (expectedBuf.length !== actual.length || !timingSafeEqual(expectedBuf, actual)) {\n      throw new PaybetaError('Webhook signature verification failed');\n    }\n\n    return JSON.parse(body) as WebhookEvent<T>;\n  }\n}\n","import { HttpClient } from './http.js';\nimport { TransactionsResource } from './resources/transactions.js';\nimport { PaymentsResource } from './resources/payments.js';\nimport { EscrowsResource } from './resources/escrows.js';\nimport { DisputesResource } from './resources/disputes.js';\nimport { WebhooksResource } from './resources/webhooks.js';\n\nexport interface PaybetaClientConfig {\n  /** API key obtained from the Paybeta dashboard (pb_live_* or pb_test_*) */\n  apiKey: string;\n  /** Override the default API base URL. Defaults to https://api.usepaybeta.com */\n  baseUrl?: string;\n  /** Webhook signing secret used to verify incoming webhook payloads */\n  webhookSecret?: string;\n  /** Request timeout in milliseconds. Defaults to 30000 */\n  timeout?: number;\n}\n\nexport class PaybetaClient {\n  readonly transactions: TransactionsResource;\n  readonly payments: PaymentsResource;\n  readonly escrows: EscrowsResource;\n  readonly disputes: DisputesResource;\n  readonly webhooks: WebhooksResource;\n\n  constructor(config: PaybetaClientConfig) {\n    if (!config.apiKey) {\n      throw new Error('PaybetaClient: apiKey is required');\n    }\n\n    const http = new HttpClient({\n      apiKey: config.apiKey,\n      baseUrl: config.baseUrl ?? 'https://api.usepaybeta.com',\n      timeout: config.timeout ?? 30_000,\n    });\n\n    this.transactions = new TransactionsResource(http);\n    this.payments = new PaymentsResource(http);\n    this.escrows = new EscrowsResource(http);\n    this.disputes = new DisputesResource(http);\n    this.webhooks = new WebhooksResource(config.webhookSecret ?? '');\n  }\n}\n"]}

package/dist/index.mjs

@@ -0,0 +1,309 @@
+import { createHmac, timingSafeEqual } from 'crypto';
+
+// src/errors.ts
+var PaybetaError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PaybetaError";
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var PaybetaApiError = class extends PaybetaError {
+  constructor(status, code, message, traceId, timestamp) {
+    super(message);
+    this.name = "PaybetaApiError";
+    this.status = status;
+    this.code = code;
+    this.traceId = traceId;
+    this.timestamp = timestamp;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+
+// src/http.ts
+var HttpClient = class {
+  constructor(config) {
+    this.config = config;
+  }
+  async request(method, path, options) {
+    const url = new URL(`/v1${path}`, this.config.baseUrl);
+    if (options?.query) {
+      for (const [key, value] of Object.entries(options.query)) {
+        if (value !== void 0 && value !== null) {
+          url.searchParams.set(key, String(value));
+        }
+      }
+    }
+    const headers = {
+      "X-API-Key": this.config.apiKey,
+      Accept: "application/json"
+    };
+    let body;
+    if (options?.body !== void 0) {
+      headers["Content-Type"] = "application/json";
+      body = JSON.stringify(options.body);
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.config.timeout);
+    let response;
+    try {
+      response = await fetch(url.toString(), {
+        method,
+        headers,
+        body,
+        signal: controller.signal
+      });
+    } catch (err) {
+      if (err instanceof Error && err.name === "AbortError") {
+        throw new PaybetaError(`Request timed out after ${this.config.timeout}ms`);
+      }
+      throw err;
+    } finally {
+      clearTimeout(timer);
+    }
+    let payload;
+    const contentType = response.headers.get("content-type") ?? "";
+    if (contentType.includes("application/json")) {
+      payload = await response.json().catch(() => null);
+    } else {
+      payload = await response.text().catch(() => null);
+    }
+    if (!response.ok) {
+      const errBody = payload ?? {};
+      const errDetail = errBody.error ?? {};
+      throw new PaybetaApiError(
+        response.status,
+        errDetail.code ?? String(response.status),
+        errDetail.message ?? errBody.message ?? "Request failed",
+        errDetail.traceId ?? "",
+        errDetail.timestamp ?? (/* @__PURE__ */ new Date()).toISOString()
+      );
+    }
+    return payload;
+  }
+  get(path, query) {
+    return this.request("GET", path, { query });
+  }
+  post(path, body) {
+    return this.request("POST", path, { body });
+  }
+  patch(path, body) {
+    return this.request("PATCH", path, { body });
+  }
+  delete(path) {
+    return this.request("DELETE", path);
+  }
+};
+
+// src/resources/transactions.ts
+var TransactionsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  create(params, opts) {
+    const body = opts?.idempotencyKey ? { ...params, idempotencyKey: opts.idempotencyKey } : params;
+    return this.http.post("/transactions", body);
+  }
+  /**
+   * Lists transactions. The bare `/transactions` endpoint is platform-role
+   * only — an API-key (merchant) caller gets a 403 there — so passing
+   * `merchantId` routes to `/transactions/merchant/:merchantId` instead.
+   */
+  list(params) {
+    const { merchantId, ...rest } = params ?? {};
+    const path = merchantId ? `/transactions/merchant/${merchantId}` : "/transactions";
+    return this.http.get(path, rest);
+  }
+  retrieve(id) {
+    return this.http.get(`/transactions/${id}`);
+  }
+  listHistory(id) {
+    return this.http.get(`/transactions/${id}/history`);
+  }
+};
+
+// src/resources/payments.ts
+var PaymentsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  initiate(params) {
+    const { idempotencyKey, ...rest } = params;
+    const body = idempotencyKey ? { ...rest, idempotencyKey } : rest;
+    return this.http.post("/payments", body);
+  }
+  /**
+   * Lists payments. The bare `/payments` endpoint is platform-role only —
+   * an API-key (merchant) caller gets a 403 there — so passing `merchantId`
+   * (which every merchant API key call needs) routes to
+   * `/payments/merchant/:merchantId` instead, matching what the API
+   * actually allows a merchant credential to call.
+   */
+  list(params) {
+    const { merchantId, ...rest } = params ?? {};
+    const path = merchantId ? `/payments/merchant/${merchantId}` : "/payments";
+    return this.http.get(path, rest);
+  }
+  retrieve(id) {
+    return this.http.get(`/payments/${id}`);
+  }
+  verify(id) {
+    return this.http.post(`/payments/${id}/verify`);
+  }
+  retry(id) {
+    return this.http.post(`/payments/${id}/retry`);
+  }
+  listAttempts(id) {
+    return this.http.get(`/payments/${id}/attempts`);
+  }
+};
+
+// src/resources/escrows.ts
+var EscrowsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  create(params, opts) {
+    const body = opts?.idempotencyKey ? { ...params, idempotencyKey: opts.idempotencyKey } : params;
+    return this.http.post("/escrows", body);
+  }
+  /**
+   * Lists escrows. The bare `/escrows` endpoint is platform-role only — an
+   * API-key (merchant) caller gets a 403 there — so passing `merchantId`
+   * routes to `/escrows/merchant/:merchantId` instead. Unlike
+   * payments/transactions/disputes, this returns a `{ escrows, total,
+   * limit, offset }` envelope rather than a bare array.
+   */
+  list(params) {
+    const { merchantId, ...rest } = params ?? {};
+    const path = merchantId ? `/escrows/merchant/${merchantId}` : "/escrows";
+    return this.http.get(path, rest);
+  }
+  retrieve(id) {
+    return this.http.get(`/escrows/${id}`);
+  }
+  retrieveBalance(id) {
+    return this.http.get(`/escrows/${id}/balance`);
+  }
+  retrieveConditions(id) {
+    return this.http.get(`/escrows/${id}/conditions`);
+  }
+  release(id, params) {
+    return this.http.post(`/escrows/${id}/release`, params);
+  }
+  refund(id) {
+    return this.http.post(`/escrows/${id}/refund`);
+  }
+  dispute(id) {
+    return this.http.post(`/escrows/${id}/dispute`);
+  }
+  cancel(id) {
+    return this.http.post(`/escrows/${id}/cancel`);
+  }
+  confirmDelivery(id, params) {
+    return this.http.post(`/escrows/${id}/confirm-delivery`, params);
+  }
+  confirmBuyer(id, params) {
+    return this.http.post(`/escrows/${id}/confirm-buyer`, params);
+  }
+};
+
+// src/resources/disputes.ts
+var DisputesResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  open(params) {
+    return this.http.post("/disputes", params);
+  }
+  /**
+   * Lists disputes. The bare `/disputes` endpoint is platform-role only —
+   * an API-key (merchant) caller gets a 403 there — so passing
+   * `merchantId` routes to `/disputes/merchant/:merchantId` instead.
+   */
+  list(params) {
+    const { merchantId, ...rest } = params ?? {};
+    const path = merchantId ? `/disputes/merchant/${merchantId}` : "/disputes";
+    return this.http.get(path, rest);
+  }
+  retrieve(id) {
+    return this.http.get(`/disputes/${id}`);
+  }
+  listEvidence(id) {
+    return this.http.get(`/disputes/${id}/evidence`);
+  }
+  uploadEvidence(id, params) {
+    return this.http.post(`/disputes/${id}/evidence`, params);
+  }
+  resolve(id, params) {
+    return this.http.post(`/disputes/${id}/resolve`, params);
+  }
+  cancel(id, params) {
+    return this.http.post(`/disputes/${id}/cancel`, params);
+  }
+};
+var WebhooksResource = class {
+  constructor(secret) {
+    this.secret = secret;
+  }
+  /**
+   * Verifies the signature on an incoming webhook and parses the payload.
+   *
+   * PayBeta signs the concatenation of the delivery timestamp and the raw
+   * request body — `HMAC-SHA256(secret, "${timestamp}.${rawBody}")` — and
+   * sends the result hex-encoded, prefixed with `sha256=`, in the
+   * `X-PayBeta-Signature` header (see OutboundWebhookService). The
+   * timestamp itself arrives separately in `X-PayBeta-Timestamp`, so both
+   * headers are required here, not just the signature.
+   *
+   * Pass the raw request body (before JSON parsing), the value of the
+   * `X-PayBeta-Signature` header, and the value of the `X-PayBeta-Timestamp`
+   * header. Throws `PaybetaError` if the signature is invalid or the
+   * secret was not configured.
+   */
+  constructEvent(rawBody, signature, timestamp) {
+    if (!this.secret) {
+      throw new PaybetaError(
+        "webhookSecret must be set on PaybetaClient to verify webhook signatures"
+      );
+    }
+    const body = typeof rawBody === "string" ? rawBody : rawBody.toString("utf8");
+    const hexSignature = signature.startsWith("sha256=") ? signature.slice("sha256=".length) : signature;
+    const expected = createHmac("sha256", this.secret).update(`${timestamp}.${body}`).digest("hex");
+    let actual;
+    let expectedBuf;
+    try {
+      actual = Buffer.from(hexSignature, "hex");
+      expectedBuf = Buffer.from(expected, "hex");
+    } catch {
+      throw new PaybetaError("Invalid signature format");
+    }
+    if (expectedBuf.length !== actual.length || !timingSafeEqual(expectedBuf, actual)) {
+      throw new PaybetaError("Webhook signature verification failed");
+    }
+    return JSON.parse(body);
+  }
+};
+
+// src/client.ts
+var PaybetaClient = class {
+  constructor(config) {
+    if (!config.apiKey) {
+      throw new Error("PaybetaClient: apiKey is required");
+    }
+    const http = new HttpClient({
+      apiKey: config.apiKey,
+      baseUrl: config.baseUrl ?? "https://api.usepaybeta.com",
+      timeout: config.timeout ?? 3e4
+    });
+    this.transactions = new TransactionsResource(http);
+    this.payments = new PaymentsResource(http);
+    this.escrows = new EscrowsResource(http);
+    this.disputes = new DisputesResource(http);
+    this.webhooks = new WebhooksResource(config.webhookSecret ?? "");
+  }
+};
+
+export { PaybetaApiError, PaybetaClient, PaybetaError };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map