@paybetaby/node-sdk 1.0.1 → 1.0.3

package/dist/index.js

@@ -23,6 +23,9 @@ var PaybetaApiError = class extends PaybetaError {
 };
 
 // src/http.ts
+function isSuccessEnvelope(payload) {
+  return typeof payload === "object" && payload !== null && payload.status === "success" && "data" in payload && typeof payload.timestamp === "string";
+}
 var HttpClient = class {
   constructor(config) {
     this.config = config;
@@ -82,7 +85,7 @@ var HttpClient = class {
         errDetail.timestamp ?? (/* @__PURE__ */ new Date()).toISOString()
       );
     }
-    return payload;
+    return isSuccessEnvelope(payload) ? payload.data : payload;
   }
   get(path, query) {
     return this.request("GET", path, { query });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/http.ts","../src/resources/transactions.ts","../src/resources/payments.ts","../src/resources/escrows.ts","../src/resources/disputes.ts","../src/resources/webhooks.ts","../src/client.ts"],"names":["createHmac","timingSafeEqual"],"mappings":";;;;;AAAO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EACtC,WAAA,CAAY,SAAiB,OAAA,EAA+B;AAC1D,IAAA,KAAA,CAAM,OAAA,EAAS,SAAS,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,GAAI,MAAS,CAAA;AAClF,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AACF;AAEO,IAAM,eAAA,GAAN,cAA8B,YAAA,CAAa;AAAA,EAMhD,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,OAAA,EAAiB,SAAiB,SAAA,EAAmB;AAC7F,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AACF;;;ACLO,IAAM,aAAN,MAAiB;AAAA,EACtB,YAA6B,MAAA,EAA0B;AAA1B,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAA2B;AAAA,EAExD,MAAM,OAAA,CACJ,MAAA,EACA,IAAA,EACA,OAAA,EAIY;AAKZ,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,GAAA,EAAM,IAAI,CAAA,CAAA,EAAI,IAAA,CAAK,OAAO,OAAO,CAAA;AAErD,IAAA,IAAI,SAAS,KAAA,EAAO;AAClB,MAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxD,QAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAAM;AACzC,UAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,GAAA,EAAK,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,QACzC;AAAA,MACF;AAAA,IACF;AAEA,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,WAAA,EAAa,KAAK,MAAA,CAAO,MAAA;AAAA,MACzB,MAAA,EAAQ;AAAA,KACV;AAEA,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI,OAAA,EAAS,SAAS,MAAA,EAAW;AAC/B,MAAA,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AAC1B,MAAA,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,IAAI,CAAA;AAAA,IACpC;AAEA,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,CAAK,OAAO,OAAO,CAAA;AAEtE,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,CAAI,QAAA,EAAS,EAAG;AAAA,QACrC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA;AAAA,QACA,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AASZ,MAAA,IAAI,GAAA,YAAe,KAAA,IAAS,GAAA,CAAI,IAAA,KAAS,YAAA,EAAc;AACrD,QAAA,MAAM,IAAI,YAAA,CAAa,CAAA,wBAAA,EAA2B,IAAA,CAAK,MAAA,CAAO,OAAO,CAAA,EAAA,CAAA,EAAM,EAAE,KAAA,EAAO,GAAA,EAAK,CAAA;AAAA,MAC3F;AACA,MAAA,MAAM,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC9D,MAAA,MAAM,IAAI,aAAa,CAAA,mCAAA,EAAsC,MAAM,IAAI,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,IACvF,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAEA,IAAA,IAAI,OAAA;AACJ,IAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AAC5D,IAAA,IAAI,WAAA,CAAY,QAAA,CAAS,kBAAkB,CAAA,EAAG;AAC5C,MAAA,OAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAAA,IAClD,CAAA,MAAO;AACL,MAAA,OAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAAA,IAClD;AAEA,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,OAAA,GAAW,WAAW,EAAC;AAC7B,MAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,KAAA,IAAS,EAAC;AACpC,MAAA,MAAM,IAAI,eAAA;AAAA,QACR,QAAA,CAAS,MAAA;AAAA,QACT,SAAA,CAAU,IAAA,IAAQ,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA;AAAA,QACxC,SAAA,CAAU,OAAA,IAAW,OAAA,CAAQ,OAAA,IAAW,gBAAA;AAAA,QACxC,UAAU,OAAA,IAAW,EAAA;AAAA,QACrB,SAAA,CAAU,SAAA,IAAA,iBAAa,IAAI,IAAA,IAAO,WAAA;AAAY,OAChD;AAAA,IACF;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,GAAA,CAAO,MAAc,KAAA,EAAkF;AACrG,IAAA,OAAO,KAAK,OAAA,CAAW,KAAA,EAAO,IAAA,EAAM,EAAE,OAAO,CAAA;AAAA,EAC/C;AAAA,EAEA,IAAA,CAAQ,MAAc,IAAA,EAA4B;AAChD,IAAA,OAAO,KAAK,OAAA,CAAW,MAAA,EAAQ,IAAA,EAAM,EAAE,MAAM,CAAA;AAAA,EAC/C;AAAA,EAEA,KAAA,CAAS,MAAc,IAAA,EAA4B;AACjD,IAAA,OAAO,KAAK,OAAA,CAAW,OAAA,EAAS,IAAA,EAAM,EAAE,MAAM,CAAA;AAAA,EAChD;AAAA,EAEA,OAAU,IAAA,EAA0B;AAClC,IAAA,OAAO,IAAA,CAAK,OAAA,CAAW,QAAA,EAAU,IAAI,CAAA;AAAA,EACvC;AACF,CAAA;;;AChHO,IAAM,uBAAN,MAA2B;AAAA,EAChC,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA,EAEhD,MAAA,CAAO,QAAiC,IAAA,EAA6C;AACnF,IAAA,MAAM,IAAA,GAAO,MAAM,cAAA,GACf,EAAE,GAAG,MAAA,EAAQ,cAAA,EAAgB,IAAA,CAAK,cAAA,EAAe,GACjD,MAAA;AACJ,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAkB,eAAA,EAAiB,IAAI,CAAA;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,KAAK,MAAA,EAAyD;AAC5D,IAAA,MAAM,EAAE,UAAA,EAAY,GAAG,IAAA,EAAK,GAAI,UAAU,EAAC;AAC3C,IAAA,MAAM,IAAA,GAAO,UAAA,GAAa,CAAA,uBAAA,EAA0B,UAAU,CAAA,CAAA,GAAK,eAAA;AACnE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAmB,IAAA,EAAM,IAAmD,CAAA;AAAA,EAC/F;AAAA,EAEA,SAAS,EAAA,EAAkC;AACzC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAiB,CAAA,cAAA,EAAiB,EAAE,CAAA,CAAE,CAAA;AAAA,EACzD;AAAA,EAEA,YAAY,EAAA,EAAyC;AACnD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAwB,CAAA,cAAA,EAAiB,EAAE,CAAA,QAAA,CAAU,CAAA;AAAA,EACxE;AACF,CAAA;;;AC7BO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA,EAEhD,SAAS,MAAA,EAAiD;AACxD,IAAA,MAAM,EAAE,cAAA,EAAgB,GAAG,IAAA,EAAK,GAAI,MAAA;AACpC,IAAA,MAAM,OAAO,cAAA,GAAiB,EAAE,GAAG,IAAA,EAAM,gBAAe,GAAI,IAAA;AAC5D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAc,WAAA,EAAa,IAAI,CAAA;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,KAAK,MAAA,EAAiD;AACpD,IAAA,MAAM,EAAE,UAAA,EAAY,GAAG,IAAA,EAAK,GAAI,UAAU,EAAC;AAC3C,IAAA,MAAM,IAAA,GAAO,UAAA,GAAa,CAAA,mBAAA,EAAsB,UAAU,CAAA,CAAA,GAAK,WAAA;AAC/D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAe,IAAA,EAAM,IAAmD,CAAA;AAAA,EAC3F;AAAA,EAEA,SAAS,EAAA,EAA8B;AACrC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAa,CAAA,UAAA,EAAa,EAAE,CAAA,CAAE,CAAA;AAAA,EACjD;AAAA,EAEA,OAAO,EAAA,EAA8B;AACnC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAc,CAAA,UAAA,EAAa,EAAE,CAAA,OAAA,CAAS,CAAA;AAAA,EACzD;AAAA,EAEA,MAAM,EAAA,EAA8B;AAClC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAc,CAAA,UAAA,EAAa,EAAE,CAAA,MAAA,CAAQ,CAAA;AAAA,EACxD;AAAA,EAEA,aAAa,EAAA,EAAuC;AAClD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAsB,CAAA,UAAA,EAAa,EAAE,CAAA,SAAA,CAAW,CAAA;AAAA,EACnE;AACF,CAAA;;;AC/BO,IAAM,kBAAN,MAAsB;AAAA,EAC3B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA,EAEhD,MAAA,CAAO,QAA4B,IAAA,EAAwC;AACzE,IAAA,MAAM,IAAA,GAAO,MAAM,cAAA,GACf,EAAE,GAAG,MAAA,EAAQ,cAAA,EAAgB,IAAA,CAAK,cAAA,EAAe,GACjD,MAAA;AACJ,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAa,UAAA,EAAY,IAAI,CAAA;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,KAAK,MAAA,EAAyD;AAC5D,IAAA,MAAM,EAAE,UAAA,EAAY,GAAG,IAAA,EAAK,GAAI,UAAU,EAAC;AAC3C,IAAA,MAAM,IAAA,GAAO,UAAA,GAAa,CAAA,kBAAA,EAAqB,UAAU,CAAA,CAAA,GAAK,UAAA;AAC9D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAwB,IAAA,EAAM,IAAmD,CAAA;AAAA,EACpG;AAAA,EAEA,SAAS,EAAA,EAA6B;AACpC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAY,CAAA,SAAA,EAAY,EAAE,CAAA,CAAE,CAAA;AAAA,EAC/C;AAAA,EAEA,gBAAgB,EAAA,EAAoC;AAClD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAmB,CAAA,SAAA,EAAY,EAAE,CAAA,QAAA,CAAU,CAAA;AAAA,EAC9D;AAAA,EAEA,mBAAmB,EAAA,EAA+C;AAChE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAA8B,CAAA,SAAA,EAAY,EAAE,CAAA,WAAA,CAAa,CAAA;AAAA,EAC5E;AAAA,EAEA,OAAA,CAAQ,IAAY,MAAA,EAA+C;AACjE,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,YAAY,MAAM,CAAA;AAAA,EAChE;AAAA,EAEA,OAAO,EAAA,EAA6B;AAClC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,CAAA,OAAA,CAAS,CAAA;AAAA,EACvD;AAAA,EAEA,QAAQ,EAAA,EAA6B;AACnC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,CAAA,QAAA,CAAU,CAAA;AAAA,EACxD;AAAA,EAEA,OAAO,EAAA,EAA6B;AAClC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,CAAA,OAAA,CAAS,CAAA;AAAA,EACvD;AAAA,EAEA,eAAA,CAAgB,IAAY,MAAA,EAAiD;AAC3E,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,qBAAqB,MAAM,CAAA;AAAA,EACzE;AAAA,EAEA,YAAA,CAAa,IAAY,MAAA,EAA8C;AACrE,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,kBAAkB,MAAM,CAAA;AAAA,EACtE;AACF,CAAA;;;AC7DO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA,EAEhD,KAAK,MAAA,EAA6C;AAChD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAc,WAAA,EAAa,MAAM,CAAA;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,KAAK,MAAA,EAAiD;AACpD,IAAA,MAAM,EAAE,UAAA,EAAY,GAAG,IAAA,EAAK,GAAI,UAAU,EAAC;AAC3C,IAAA,MAAM,IAAA,GAAO,UAAA,GAAa,CAAA,mBAAA,EAAsB,UAAU,CAAA,CAAA,GAAK,WAAA;AAC/D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAe,IAAA,EAAM,IAAmD,CAAA;AAAA,EAC3F;AAAA,EAEA,SAAS,EAAA,EAA8B;AACrC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAa,CAAA,UAAA,EAAa,EAAE,CAAA,CAAE,CAAA;AAAA,EACjD;AAAA,EAEA,aAAa,EAAA,EAAiC;AAC5C,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAgB,CAAA,UAAA,EAAa,EAAE,CAAA,SAAA,CAAW,CAAA;AAAA,EAC7D;AAAA,EAEA,cAAA,CAAe,IAAY,MAAA,EAAiD;AAC1E,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAe,CAAA,UAAA,EAAa,EAAE,aAAa,MAAM,CAAA;AAAA,EACpE;AAAA,EAEA,OAAA,CAAQ,IAAY,MAAA,EAAgD;AAClE,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAc,CAAA,UAAA,EAAa,EAAE,YAAY,MAAM,CAAA;AAAA,EAClE;AAAA,EAEA,MAAA,CAAO,IAAY,MAAA,EAA+C;AAChE,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAc,CAAA,UAAA,EAAa,EAAE,WAAW,MAAM,CAAA;AAAA,EACjE;AACF,CAAA;AC5CO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAA6B,MAAA,EAAgB;AAAhB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiB9C,cAAA,CACE,OAAA,EACA,SAAA,EACA,SAAA,EACiB;AACjB,IAAA,IAAI,CAAC,KAAK,MAAA,EAAQ;AAChB,MAAA,MAAM,IAAI,YAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,OAAO,OAAO,OAAA,KAAY,WAAW,OAAA,GAAU,OAAA,CAAQ,SAAS,MAAM,CAAA;AAK5E,IAAA,MAAM,YAAA,GAAe,UAAU,UAAA,CAAW,SAAS,IAAI,SAAA,CAAU,KAAA,CAAM,SAAA,CAAU,MAAM,CAAA,GAAI,SAAA;AAE3F,IAAA,MAAM,QAAA,GAAWA,iBAAA,CAAW,QAAA,EAAU,IAAA,CAAK,MAAM,CAAA,CAC9C,MAAA,CAAO,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA,CAC7B,OAAO,KAAK,CAAA;AAEf,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI,WAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,MAAA,CAAO,IAAA,CAAK,YAAA,EAAc,KAAK,CAAA;AACxC,MAAA,WAAA,GAAc,MAAA,CAAO,IAAA,CAAK,QAAA,EAAU,KAAK,CAAA;AAAA,IAC3C,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,aAAa,0BAA0B,CAAA;AAAA,IACnD;AAEA,IAAA,IAAI,WAAA,CAAY,WAAW,MAAA,CAAO,MAAA,IAAU,CAACC,sBAAA,CAAgB,WAAA,EAAa,MAAM,CAAA,EAAG;AACjF,MAAA,MAAM,IAAI,aAAa,uCAAuC,CAAA;AAAA,IAChE;AAEA,IAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB;AACF,CAAA;;;ACzCO,IAAM,gBAAN,MAAoB;AAAA,EAOzB,YAAY,MAAA,EAA6B;AACvC,IAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAClB,MAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,IACrD;AAEA,IAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW;AAAA,MAC1B,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf,OAAA,EAAS,OAAO,OAAA,IAAW,4BAAA;AAAA,MAC3B,OAAA,EAAS,OAAO,OAAA,IAAW;AAAA,KAC5B,CAAA;AAED,IAAA,IAAA,CAAK,YAAA,GAAe,IAAI,oBAAA,CAAqB,IAAI,CAAA;AACjD,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,gBAAA,CAAiB,IAAI,CAAA;AACzC,IAAA,IAAA,CAAK,OAAA,GAAU,IAAI,eAAA,CAAgB,IAAI,CAAA;AACvC,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,gBAAA,CAAiB,IAAI,CAAA;AACzC,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,gBAAA,CAAiB,MAAA,CAAO,iBAAiB,EAAE,CAAA;AAAA,EACjE;AACF","file":"index.js","sourcesContent":["export class PaybetaError extends Error {\n  constructor(message: string, options?: { cause?: unknown }) {\n    super(message, options?.cause !== undefined ? { cause: options.cause } : undefined);\n    this.name = 'PaybetaError';\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\nexport class PaybetaApiError extends PaybetaError {\n  readonly status: number;\n  readonly code: string;\n  readonly traceId: string;\n  readonly timestamp: string;\n\n  constructor(status: number, code: string, message: string, traceId: string, timestamp: string) {\n    super(message);\n    this.name = 'PaybetaApiError';\n    this.status = status;\n    this.code = code;\n    this.traceId = traceId;\n    this.timestamp = timestamp;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n","import { PaybetaApiError, PaybetaError } from './errors.js';\n\nexport interface HttpClientConfig {\n  apiKey: string;\n  baseUrl: string;\n  timeout: number;\n}\n\ninterface ApiErrorBody {\n  error?: {\n    code?: string;\n    message?: string;\n    traceId?: string;\n    timestamp?: string;\n  };\n  message?: string;\n}\n\nexport class HttpClient {\n  constructor(private readonly config: HttpClientConfig) {}\n\n  async request<T>(\n    method: string,\n    path: string,\n    options?: {\n      body?: unknown;\n      query?: Record<string, string | number | boolean | undefined | null>;\n    },\n  ): Promise<T> {\n    // The public API is served behind api-gateway under a /v1 prefix — the\n    // gateway's route table only matches /v1/... and 404s anything else, so\n    // every request must go there regardless of how `path` is written by\n    // the resource classes below.\n    const url = new URL(`/v1${path}`, this.config.baseUrl);\n\n    if (options?.query) {\n      for (const [key, value] of Object.entries(options.query)) {\n        if (value !== undefined && value !== null) {\n          url.searchParams.set(key, String(value));\n        }\n      }\n    }\n\n    const headers: Record<string, string> = {\n      'X-API-Key': this.config.apiKey,\n      Accept: 'application/json',\n    };\n\n    let body: string | undefined;\n    if (options?.body !== undefined) {\n      headers['Content-Type'] = 'application/json';\n      body = JSON.stringify(options.body);\n    }\n\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.config.timeout);\n\n    let response: Response;\n    try {\n      response = await fetch(url.toString(), {\n        method,\n        headers,\n        body,\n        signal: controller.signal,\n      });\n    } catch (err) {\n      // Every failure that can come out of `fetch` itself — timeout, DNS\n      // failure, connection refused, TLS error, etc. — is normalized to\n      // PaybetaError here, not just AbortError. Previously only the\n      // timeout case was wrapped, so callers had to separately handle a\n      // raw, unwrapped TypeError/AggregateError from `fetch` for every\n      // other kind of network failure; PaybetaApiError is reserved for\n      // \"the API responded, and it was an error,\" which none of these\n      // are. The original error is preserved as `cause` for debugging.\n      if (err instanceof Error && err.name === 'AbortError') {\n        throw new PaybetaError(`Request timed out after ${this.config.timeout}ms`, { cause: err });\n      }\n      const detail = err instanceof Error ? err.message : String(err);\n      throw new PaybetaError(`Network request to PayBeta failed: ${detail}`, { cause: err });\n    } finally {\n      clearTimeout(timer);\n    }\n\n    let payload: unknown;\n    const contentType = response.headers.get('content-type') ?? '';\n    if (contentType.includes('application/json')) {\n      payload = await response.json().catch(() => null);\n    } else {\n      payload = await response.text().catch(() => null);\n    }\n\n    if (!response.ok) {\n      const errBody = (payload ?? {}) as ApiErrorBody;\n      const errDetail = errBody.error ?? {};\n      throw new PaybetaApiError(\n        response.status,\n        errDetail.code ?? String(response.status),\n        errDetail.message ?? errBody.message ?? 'Request failed',\n        errDetail.traceId ?? '',\n        errDetail.timestamp ?? new Date().toISOString(),\n      );\n    }\n\n    return payload as T;\n  }\n\n  get<T>(path: string, query?: Record<string, string | number | boolean | undefined | null>): Promise<T> {\n    return this.request<T>('GET', path, { query });\n  }\n\n  post<T>(path: string, body?: unknown): Promise<T> {\n    return this.request<T>('POST', path, { body });\n  }\n\n  patch<T>(path: string, body?: unknown): Promise<T> {\n    return this.request<T>('PATCH', path, { body });\n  }\n\n  delete<T>(path: string): Promise<T> {\n    return this.request<T>('DELETE', path);\n  }\n}\n","import type { HttpClient } from '../http.js';\nimport type {\n  Transaction,\n  CreateTransactionParams,\n  ListTransactionsParams,\n  TransactionEvent,\n} from '../types/transactions.js';\nimport type { RequestOptions } from '../types/common.js';\n\nexport class TransactionsResource {\n  constructor(private readonly http: HttpClient) {}\n\n  create(params: CreateTransactionParams, opts?: RequestOptions): Promise<Transaction> {\n    const body = opts?.idempotencyKey\n      ? { ...params, idempotencyKey: opts.idempotencyKey }\n      : params;\n    return this.http.post<Transaction>('/transactions', body);\n  }\n\n  /**\n   * Lists transactions. The bare `/transactions` endpoint is platform-role\n   * only — an API-key (merchant) caller gets a 403 there — so passing\n   * `merchantId` routes to `/transactions/merchant/:merchantId` instead.\n   */\n  list(params?: ListTransactionsParams): Promise<Transaction[]> {\n    const { merchantId, ...rest } = params ?? {};\n    const path = merchantId ? `/transactions/merchant/${merchantId}` : '/transactions';\n    return this.http.get<Transaction[]>(path, rest as Record<string, string | number | undefined>);\n  }\n\n  retrieve(id: string): Promise<Transaction> {\n    return this.http.get<Transaction>(`/transactions/${id}`);\n  }\n\n  listHistory(id: string): Promise<TransactionEvent[]> {\n    return this.http.get<TransactionEvent[]>(`/transactions/${id}/history`);\n  }\n}\n","import type { HttpClient } from '../http.js';\nimport type {\n  Payment,\n  PaymentAttempt,\n  InitiatePaymentParams,\n  ListPaymentsParams,\n} from '../types/payments.js';\n\nexport class PaymentsResource {\n  constructor(private readonly http: HttpClient) {}\n\n  initiate(params: InitiatePaymentParams): Promise<Payment> {\n    const { idempotencyKey, ...rest } = params;\n    const body = idempotencyKey ? { ...rest, idempotencyKey } : rest;\n    return this.http.post<Payment>('/payments', body);\n  }\n\n  /**\n   * Lists payments. The bare `/payments` endpoint is platform-role only —\n   * an API-key (merchant) caller gets a 403 there — so passing `merchantId`\n   * (which every merchant API key call needs) routes to\n   * `/payments/merchant/:merchantId` instead, matching what the API\n   * actually allows a merchant credential to call.\n   */\n  list(params?: ListPaymentsParams): Promise<Payment[]> {\n    const { merchantId, ...rest } = params ?? {};\n    const path = merchantId ? `/payments/merchant/${merchantId}` : '/payments';\n    return this.http.get<Payment[]>(path, rest as Record<string, string | number | undefined>);\n  }\n\n  retrieve(id: string): Promise<Payment> {\n    return this.http.get<Payment>(`/payments/${id}`);\n  }\n\n  verify(id: string): Promise<Payment> {\n    return this.http.post<Payment>(`/payments/${id}/verify`);\n  }\n\n  retry(id: string): Promise<Payment> {\n    return this.http.post<Payment>(`/payments/${id}/retry`);\n  }\n\n  listAttempts(id: string): Promise<PaymentAttempt[]> {\n    return this.http.get<PaymentAttempt[]>(`/payments/${id}/attempts`);\n  }\n}\n","import type { HttpClient } from '../http.js';\nimport type {\n  Escrow,\n  EscrowBalance,\n  EscrowListResponse,\n  EscrowConditionsResponse,\n  CreateEscrowParams,\n  ListEscrowsParams,\n  ReleaseEscrowParams,\n  ConfirmDeliveryParams,\n  ConfirmBuyerParams,\n} from '../types/escrows.js';\nimport type { RequestOptions } from '../types/common.js';\n\nexport class EscrowsResource {\n  constructor(private readonly http: HttpClient) {}\n\n  create(params: CreateEscrowParams, opts?: RequestOptions): Promise<Escrow> {\n    const body = opts?.idempotencyKey\n      ? { ...params, idempotencyKey: opts.idempotencyKey }\n      : params;\n    return this.http.post<Escrow>('/escrows', body);\n  }\n\n  /**\n   * Lists escrows. The bare `/escrows` endpoint is platform-role only — an\n   * API-key (merchant) caller gets a 403 there — so passing `merchantId`\n   * routes to `/escrows/merchant/:merchantId` instead. Unlike\n   * payments/transactions/disputes, this returns a `{ escrows, total,\n   * limit, offset }` envelope rather than a bare array.\n   */\n  list(params?: ListEscrowsParams): Promise<EscrowListResponse> {\n    const { merchantId, ...rest } = params ?? {};\n    const path = merchantId ? `/escrows/merchant/${merchantId}` : '/escrows';\n    return this.http.get<EscrowListResponse>(path, rest as Record<string, string | number | undefined>);\n  }\n\n  retrieve(id: string): Promise<Escrow> {\n    return this.http.get<Escrow>(`/escrows/${id}`);\n  }\n\n  retrieveBalance(id: string): Promise<EscrowBalance> {\n    return this.http.get<EscrowBalance>(`/escrows/${id}/balance`);\n  }\n\n  retrieveConditions(id: string): Promise<EscrowConditionsResponse> {\n    return this.http.get<EscrowConditionsResponse>(`/escrows/${id}/conditions`);\n  }\n\n  release(id: string, params?: ReleaseEscrowParams): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/release`, params);\n  }\n\n  refund(id: string): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/refund`);\n  }\n\n  dispute(id: string): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/dispute`);\n  }\n\n  cancel(id: string): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/cancel`);\n  }\n\n  confirmDelivery(id: string, params?: ConfirmDeliveryParams): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/confirm-delivery`, params);\n  }\n\n  confirmBuyer(id: string, params?: ConfirmBuyerParams): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/confirm-buyer`, params);\n  }\n}\n","import type { HttpClient } from '../http.js';\nimport type {\n  Dispute,\n  Evidence,\n  OpenDisputeParams,\n  ListDisputesParams,\n  UploadEvidenceParams,\n  ResolveDisputeParams,\n  CancelDisputeParams,\n} from '../types/disputes.js';\n\nexport class DisputesResource {\n  constructor(private readonly http: HttpClient) {}\n\n  open(params: OpenDisputeParams): Promise<Dispute> {\n    return this.http.post<Dispute>('/disputes', params);\n  }\n\n  /**\n   * Lists disputes. The bare `/disputes` endpoint is platform-role only —\n   * an API-key (merchant) caller gets a 403 there — so passing\n   * `merchantId` routes to `/disputes/merchant/:merchantId` instead.\n   */\n  list(params?: ListDisputesParams): Promise<Dispute[]> {\n    const { merchantId, ...rest } = params ?? {};\n    const path = merchantId ? `/disputes/merchant/${merchantId}` : '/disputes';\n    return this.http.get<Dispute[]>(path, rest as Record<string, string | number | undefined>);\n  }\n\n  retrieve(id: string): Promise<Dispute> {\n    return this.http.get<Dispute>(`/disputes/${id}`);\n  }\n\n  listEvidence(id: string): Promise<Evidence[]> {\n    return this.http.get<Evidence[]>(`/disputes/${id}/evidence`);\n  }\n\n  uploadEvidence(id: string, params: UploadEvidenceParams): Promise<Evidence> {\n    return this.http.post<Evidence>(`/disputes/${id}/evidence`, params);\n  }\n\n  resolve(id: string, params: ResolveDisputeParams): Promise<Dispute> {\n    return this.http.post<Dispute>(`/disputes/${id}/resolve`, params);\n  }\n\n  cancel(id: string, params: CancelDisputeParams): Promise<Dispute> {\n    return this.http.post<Dispute>(`/disputes/${id}/cancel`, params);\n  }\n}\n","import { createHmac, timingSafeEqual } from 'crypto';\nimport { PaybetaError } from '../errors.js';\nimport type { WebhookEvent } from '../types/webhooks.js';\n\nexport class WebhooksResource {\n  constructor(private readonly secret: string) {}\n\n  /**\n   * Verifies the signature on an incoming webhook and parses the payload.\n   *\n   * PayBeta signs the concatenation of the delivery timestamp and the raw\n   * request body — `HMAC-SHA256(secret, \"${timestamp}.${rawBody}\")` — and\n   * sends the result hex-encoded, prefixed with `sha256=`, in the\n   * `X-PayBeta-Signature` header (see OutboundWebhookService). The\n   * timestamp itself arrives separately in `X-PayBeta-Timestamp`, so both\n   * headers are required here, not just the signature.\n   *\n   * Pass the raw request body (before JSON parsing), the value of the\n   * `X-PayBeta-Signature` header, and the value of the `X-PayBeta-Timestamp`\n   * header. Throws `PaybetaError` if the signature is invalid or the\n   * secret was not configured.\n   */\n  constructEvent<T = unknown>(\n    rawBody: string | Buffer,\n    signature: string,\n    timestamp: string,\n  ): WebhookEvent<T> {\n    if (!this.secret) {\n      throw new PaybetaError(\n        'webhookSecret must be set on PaybetaClient to verify webhook signatures',\n      );\n    }\n\n    const body = typeof rawBody === 'string' ? rawBody : rawBody.toString('utf8');\n\n    // Accept the header verbatim (`sha256=<hex>`) or a bare hex digest, so\n    // callers who've already stripped the prefix don't get a confusing\n    // \"invalid signature format\" error.\n    const hexSignature = signature.startsWith('sha256=') ? signature.slice('sha256='.length) : signature;\n\n    const expected = createHmac('sha256', this.secret)\n      .update(`${timestamp}.${body}`)\n      .digest('hex');\n\n    let actual: Buffer;\n    let expectedBuf: Buffer;\n    try {\n      actual = Buffer.from(hexSignature, 'hex');\n      expectedBuf = Buffer.from(expected, 'hex');\n    } catch {\n      throw new PaybetaError('Invalid signature format');\n    }\n\n    if (expectedBuf.length !== actual.length || !timingSafeEqual(expectedBuf, actual)) {\n      throw new PaybetaError('Webhook signature verification failed');\n    }\n\n    return JSON.parse(body) as WebhookEvent<T>;\n  }\n}\n","import { HttpClient } from './http.js';\nimport { TransactionsResource } from './resources/transactions.js';\nimport { PaymentsResource } from './resources/payments.js';\nimport { EscrowsResource } from './resources/escrows.js';\nimport { DisputesResource } from './resources/disputes.js';\nimport { WebhooksResource } from './resources/webhooks.js';\n\nexport interface PaybetaClientConfig {\n  /** API key obtained from the Paybeta dashboard (pb_live_* or pb_test_*) */\n  apiKey: string;\n  /** Override the default API base URL. Defaults to https://api.usepaybeta.com */\n  baseUrl?: string;\n  /** Webhook signing secret used to verify incoming webhook payloads */\n  webhookSecret?: string;\n  /** Request timeout in milliseconds. Defaults to 30000 */\n  timeout?: number;\n}\n\nexport class PaybetaClient {\n  readonly transactions: TransactionsResource;\n  readonly payments: PaymentsResource;\n  readonly escrows: EscrowsResource;\n  readonly disputes: DisputesResource;\n  readonly webhooks: WebhooksResource;\n\n  constructor(config: PaybetaClientConfig) {\n    if (!config.apiKey) {\n      throw new Error('PaybetaClient: apiKey is required');\n    }\n\n    const http = new HttpClient({\n      apiKey: config.apiKey,\n      baseUrl: config.baseUrl ?? 'https://api.usepaybeta.com',\n      timeout: config.timeout ?? 30_000,\n    });\n\n    this.transactions = new TransactionsResource(http);\n    this.payments = new PaymentsResource(http);\n    this.escrows = new EscrowsResource(http);\n    this.disputes = new DisputesResource(http);\n    this.webhooks = new WebhooksResource(config.webhookSecret ?? '');\n  }\n}\n"]}
+{"version":3,"sources":["../src/errors.ts","../src/http.ts","../src/resources/transactions.ts","../src/resources/payments.ts","../src/resources/escrows.ts","../src/resources/disputes.ts","../src/resources/webhooks.ts","../src/client.ts"],"names":["createHmac","timingSafeEqual"],"mappings":";;;;;AAAO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EACtC,WAAA,CAAY,SAAiB,OAAA,EAA+B;AAC1D,IAAA,KAAA,CAAM,OAAA,EAAS,SAAS,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,GAAI,MAAS,CAAA;AAClF,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AACF;AAEO,IAAM,eAAA,GAAN,cAA8B,YAAA,CAAa;AAAA,EAMhD,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,OAAA,EAAiB,SAAiB,SAAA,EAAmB;AAC7F,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AACF;;;ACKA,SAAS,kBAAkB,OAAA,EAA8C;AACvE,EAAA,OACE,OAAO,OAAA,KAAY,QAAA,IACnB,OAAA,KAAY,IAAA,IACX,OAAA,CAAoC,MAAA,KAAW,SAAA,IAChD,MAAA,IAAU,OAAA,IACV,OAAQ,OAAA,CAAoC,SAAA,KAAc,QAAA;AAE9D;AAEO,IAAM,aAAN,MAAiB;AAAA,EACtB,YAA6B,MAAA,EAA0B;AAA1B,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAA2B;AAAA,EAExD,MAAM,OAAA,CACJ,MAAA,EACA,IAAA,EACA,OAAA,EAIY;AAKZ,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,GAAA,EAAM,IAAI,CAAA,CAAA,EAAI,IAAA,CAAK,OAAO,OAAO,CAAA;AAErD,IAAA,IAAI,SAAS,KAAA,EAAO;AAClB,MAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxD,QAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAAM;AACzC,UAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,GAAA,EAAK,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,QACzC;AAAA,MACF;AAAA,IACF;AAEA,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,WAAA,EAAa,KAAK,MAAA,CAAO,MAAA;AAAA,MACzB,MAAA,EAAQ;AAAA,KACV;AAEA,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI,OAAA,EAAS,SAAS,MAAA,EAAW;AAC/B,MAAA,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AAC1B,MAAA,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,IAAI,CAAA;AAAA,IACpC;AAEA,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,CAAK,OAAO,OAAO,CAAA;AAEtE,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,CAAI,QAAA,EAAS,EAAG;AAAA,QACrC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA;AAAA,QACA,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AASZ,MAAA,IAAI,GAAA,YAAe,KAAA,IAAS,GAAA,CAAI,IAAA,KAAS,YAAA,EAAc;AACrD,QAAA,MAAM,IAAI,YAAA,CAAa,CAAA,wBAAA,EAA2B,IAAA,CAAK,MAAA,CAAO,OAAO,CAAA,EAAA,CAAA,EAAM,EAAE,KAAA,EAAO,GAAA,EAAK,CAAA;AAAA,MAC3F;AACA,MAAA,MAAM,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC9D,MAAA,MAAM,IAAI,aAAa,CAAA,mCAAA,EAAsC,MAAM,IAAI,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,IACvF,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAEA,IAAA,IAAI,OAAA;AACJ,IAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AAC5D,IAAA,IAAI,WAAA,CAAY,QAAA,CAAS,kBAAkB,CAAA,EAAG;AAC5C,MAAA,OAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAAA,IAClD,CAAA,MAAO;AACL,MAAA,OAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAAA,IAClD;AAEA,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,OAAA,GAAW,WAAW,EAAC;AAC7B,MAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,KAAA,IAAS,EAAC;AACpC,MAAA,MAAM,IAAI,eAAA;AAAA,QACR,QAAA,CAAS,MAAA;AAAA,QACT,SAAA,CAAU,IAAA,IAAQ,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA;AAAA,QACxC,SAAA,CAAU,OAAA,IAAW,OAAA,CAAQ,OAAA,IAAW,gBAAA;AAAA,QACxC,UAAU,OAAA,IAAW,EAAA;AAAA,QACrB,SAAA,CAAU,SAAA,IAAA,iBAAa,IAAI,IAAA,IAAO,WAAA;AAAY,OAChD;AAAA,IACF;AAEA,IAAA,OAAQ,iBAAA,CAAkB,OAAO,CAAA,GAAI,OAAA,CAAQ,IAAA,GAAO,OAAA;AAAA,EACtD;AAAA,EAEA,GAAA,CAAO,MAAc,KAAA,EAAkF;AACrG,IAAA,OAAO,KAAK,OAAA,CAAW,KAAA,EAAO,IAAA,EAAM,EAAE,OAAO,CAAA;AAAA,EAC/C;AAAA,EAEA,IAAA,CAAQ,MAAc,IAAA,EAA4B;AAChD,IAAA,OAAO,KAAK,OAAA,CAAW,MAAA,EAAQ,IAAA,EAAM,EAAE,MAAM,CAAA;AAAA,EAC/C;AAAA,EAEA,KAAA,CAAS,MAAc,IAAA,EAA4B;AACjD,IAAA,OAAO,KAAK,OAAA,CAAW,OAAA,EAAS,IAAA,EAAM,EAAE,MAAM,CAAA;AAAA,EAChD;AAAA,EAEA,OAAU,IAAA,EAA0B;AAClC,IAAA,OAAO,IAAA,CAAK,OAAA,CAAW,QAAA,EAAU,IAAI,CAAA;AAAA,EACvC;AACF,CAAA;;;ACpIO,IAAM,uBAAN,MAA2B;AAAA,EAChC,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA,EAEhD,MAAA,CAAO,QAAiC,IAAA,EAA6C;AACnF,IAAA,MAAM,IAAA,GAAO,MAAM,cAAA,GACf,EAAE,GAAG,MAAA,EAAQ,cAAA,EAAgB,IAAA,CAAK,cAAA,EAAe,GACjD,MAAA;AACJ,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAkB,eAAA,EAAiB,IAAI,CAAA;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,KAAK,MAAA,EAAyD;AAC5D,IAAA,MAAM,EAAE,UAAA,EAAY,GAAG,IAAA,EAAK,GAAI,UAAU,EAAC;AAC3C,IAAA,MAAM,IAAA,GAAO,UAAA,GAAa,CAAA,uBAAA,EAA0B,UAAU,CAAA,CAAA,GAAK,eAAA;AACnE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAmB,IAAA,EAAM,IAAmD,CAAA;AAAA,EAC/F;AAAA,EAEA,SAAS,EAAA,EAAkC;AACzC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAiB,CAAA,cAAA,EAAiB,EAAE,CAAA,CAAE,CAAA;AAAA,EACzD;AAAA,EAEA,YAAY,EAAA,EAAyC;AACnD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAwB,CAAA,cAAA,EAAiB,EAAE,CAAA,QAAA,CAAU,CAAA;AAAA,EACxE;AACF,CAAA;;;AC7BO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA,EAEhD,SAAS,MAAA,EAAiD;AACxD,IAAA,MAAM,EAAE,cAAA,EAAgB,GAAG,IAAA,EAAK,GAAI,MAAA;AACpC,IAAA,MAAM,OAAO,cAAA,GAAiB,EAAE,GAAG,IAAA,EAAM,gBAAe,GAAI,IAAA;AAC5D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAc,WAAA,EAAa,IAAI,CAAA;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,KAAK,MAAA,EAAiD;AACpD,IAAA,MAAM,EAAE,UAAA,EAAY,GAAG,IAAA,EAAK,GAAI,UAAU,EAAC;AAC3C,IAAA,MAAM,IAAA,GAAO,UAAA,GAAa,CAAA,mBAAA,EAAsB,UAAU,CAAA,CAAA,GAAK,WAAA;AAC/D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAe,IAAA,EAAM,IAAmD,CAAA;AAAA,EAC3F;AAAA,EAEA,SAAS,EAAA,EAA8B;AACrC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAa,CAAA,UAAA,EAAa,EAAE,CAAA,CAAE,CAAA;AAAA,EACjD;AAAA,EAEA,OAAO,EAAA,EAA8B;AACnC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAc,CAAA,UAAA,EAAa,EAAE,CAAA,OAAA,CAAS,CAAA;AAAA,EACzD;AAAA,EAEA,MAAM,EAAA,EAA8B;AAClC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAc,CAAA,UAAA,EAAa,EAAE,CAAA,MAAA,CAAQ,CAAA;AAAA,EACxD;AAAA,EAEA,aAAa,EAAA,EAAuC;AAClD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAsB,CAAA,UAAA,EAAa,EAAE,CAAA,SAAA,CAAW,CAAA;AAAA,EACnE;AACF,CAAA;;;AC/BO,IAAM,kBAAN,MAAsB;AAAA,EAC3B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA,EAEhD,MAAA,CAAO,QAA4B,IAAA,EAAwC;AACzE,IAAA,MAAM,IAAA,GAAO,MAAM,cAAA,GACf,EAAE,GAAG,MAAA,EAAQ,cAAA,EAAgB,IAAA,CAAK,cAAA,EAAe,GACjD,MAAA;AACJ,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAa,UAAA,EAAY,IAAI,CAAA;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,KAAK,MAAA,EAAyD;AAC5D,IAAA,MAAM,EAAE,UAAA,EAAY,GAAG,IAAA,EAAK,GAAI,UAAU,EAAC;AAC3C,IAAA,MAAM,IAAA,GAAO,UAAA,GAAa,CAAA,kBAAA,EAAqB,UAAU,CAAA,CAAA,GAAK,UAAA;AAC9D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAwB,IAAA,EAAM,IAAmD,CAAA;AAAA,EACpG;AAAA,EAEA,SAAS,EAAA,EAA6B;AACpC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAY,CAAA,SAAA,EAAY,EAAE,CAAA,CAAE,CAAA;AAAA,EAC/C;AAAA,EAEA,gBAAgB,EAAA,EAAoC;AAClD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAmB,CAAA,SAAA,EAAY,EAAE,CAAA,QAAA,CAAU,CAAA;AAAA,EAC9D;AAAA,EAEA,mBAAmB,EAAA,EAA+C;AAChE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAA8B,CAAA,SAAA,EAAY,EAAE,CAAA,WAAA,CAAa,CAAA;AAAA,EAC5E;AAAA,EAEA,OAAA,CAAQ,IAAY,MAAA,EAA+C;AACjE,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,YAAY,MAAM,CAAA;AAAA,EAChE;AAAA,EAEA,OAAO,EAAA,EAA6B;AAClC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,CAAA,OAAA,CAAS,CAAA;AAAA,EACvD;AAAA,EAEA,QAAQ,EAAA,EAA6B;AACnC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,CAAA,QAAA,CAAU,CAAA;AAAA,EACxD;AAAA,EAEA,OAAO,EAAA,EAA6B;AAClC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,CAAA,OAAA,CAAS,CAAA;AAAA,EACvD;AAAA,EAEA,eAAA,CAAgB,IAAY,MAAA,EAAiD;AAC3E,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,qBAAqB,MAAM,CAAA;AAAA,EACzE;AAAA,EAEA,YAAA,CAAa,IAAY,MAAA,EAA8C;AACrE,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,kBAAkB,MAAM,CAAA;AAAA,EACtE;AACF,CAAA;;;AC7DO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA,EAEhD,KAAK,MAAA,EAA6C;AAChD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAc,WAAA,EAAa,MAAM,CAAA;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,KAAK,MAAA,EAAiD;AACpD,IAAA,MAAM,EAAE,UAAA,EAAY,GAAG,IAAA,EAAK,GAAI,UAAU,EAAC;AAC3C,IAAA,MAAM,IAAA,GAAO,UAAA,GAAa,CAAA,mBAAA,EAAsB,UAAU,CAAA,CAAA,GAAK,WAAA;AAC/D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAe,IAAA,EAAM,IAAmD,CAAA;AAAA,EAC3F;AAAA,EAEA,SAAS,EAAA,EAA8B;AACrC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAa,CAAA,UAAA,EAAa,EAAE,CAAA,CAAE,CAAA;AAAA,EACjD;AAAA,EAEA,aAAa,EAAA,EAAiC;AAC5C,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAgB,CAAA,UAAA,EAAa,EAAE,CAAA,SAAA,CAAW,CAAA;AAAA,EAC7D;AAAA,EAEA,cAAA,CAAe,IAAY,MAAA,EAAiD;AAC1E,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAe,CAAA,UAAA,EAAa,EAAE,aAAa,MAAM,CAAA;AAAA,EACpE;AAAA,EAEA,OAAA,CAAQ,IAAY,MAAA,EAAgD;AAClE,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAc,CAAA,UAAA,EAAa,EAAE,YAAY,MAAM,CAAA;AAAA,EAClE;AAAA,EAEA,MAAA,CAAO,IAAY,MAAA,EAA+C;AAChE,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAc,CAAA,UAAA,EAAa,EAAE,WAAW,MAAM,CAAA;AAAA,EACjE;AACF,CAAA;AC5CO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAA6B,MAAA,EAAgB;AAAhB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiB9C,cAAA,CACE,OAAA,EACA,SAAA,EACA,SAAA,EACiB;AACjB,IAAA,IAAI,CAAC,KAAK,MAAA,EAAQ;AAChB,MAAA,MAAM,IAAI,YAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,OAAO,OAAO,OAAA,KAAY,WAAW,OAAA,GAAU,OAAA,CAAQ,SAAS,MAAM,CAAA;AAK5E,IAAA,MAAM,YAAA,GAAe,UAAU,UAAA,CAAW,SAAS,IAAI,SAAA,CAAU,KAAA,CAAM,SAAA,CAAU,MAAM,CAAA,GAAI,SAAA;AAE3F,IAAA,MAAM,QAAA,GAAWA,iBAAA,CAAW,QAAA,EAAU,IAAA,CAAK,MAAM,CAAA,CAC9C,MAAA,CAAO,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA,CAC7B,OAAO,KAAK,CAAA;AAEf,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI,WAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,MAAA,CAAO,IAAA,CAAK,YAAA,EAAc,KAAK,CAAA;AACxC,MAAA,WAAA,GAAc,MAAA,CAAO,IAAA,CAAK,QAAA,EAAU,KAAK,CAAA;AAAA,IAC3C,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,aAAa,0BAA0B,CAAA;AAAA,IACnD;AAEA,IAAA,IAAI,WAAA,CAAY,WAAW,MAAA,CAAO,MAAA,IAAU,CAACC,sBAAA,CAAgB,WAAA,EAAa,MAAM,CAAA,EAAG;AACjF,MAAA,MAAM,IAAI,aAAa,uCAAuC,CAAA;AAAA,IAChE;AAEA,IAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB;AACF,CAAA;;;ACzCO,IAAM,gBAAN,MAAoB;AAAA,EAOzB,YAAY,MAAA,EAA6B;AACvC,IAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAClB,MAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,IACrD;AAEA,IAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW;AAAA,MAC1B,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf,OAAA,EAAS,OAAO,OAAA,IAAW,4BAAA;AAAA,MAC3B,OAAA,EAAS,OAAO,OAAA,IAAW;AAAA,KAC5B,CAAA;AAED,IAAA,IAAA,CAAK,YAAA,GAAe,IAAI,oBAAA,CAAqB,IAAI,CAAA;AACjD,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,gBAAA,CAAiB,IAAI,CAAA;AACzC,IAAA,IAAA,CAAK,OAAA,GAAU,IAAI,eAAA,CAAgB,IAAI,CAAA;AACvC,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,gBAAA,CAAiB,IAAI,CAAA;AACzC,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,gBAAA,CAAiB,MAAA,CAAO,iBAAiB,EAAE,CAAA;AAAA,EACjE;AACF","file":"index.js","sourcesContent":["export class PaybetaError extends Error {\n  constructor(message: string, options?: { cause?: unknown }) {\n    super(message, options?.cause !== undefined ? { cause: options.cause } : undefined);\n    this.name = 'PaybetaError';\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\nexport class PaybetaApiError extends PaybetaError {\n  readonly status: number;\n  readonly code: string;\n  readonly traceId: string;\n  readonly timestamp: string;\n\n  constructor(status: number, code: string, message: string, traceId: string, timestamp: string) {\n    super(message);\n    this.name = 'PaybetaApiError';\n    this.status = status;\n    this.code = code;\n    this.traceId = traceId;\n    this.timestamp = timestamp;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n","import { PaybetaApiError, PaybetaError } from './errors.js';\n\nexport interface HttpClientConfig {\n  apiKey: string;\n  baseUrl: string;\n  timeout: number;\n}\n\ninterface ApiErrorBody {\n  error?: {\n    code?: string;\n    message?: string;\n    traceId?: string;\n    timestamp?: string;\n  };\n  message?: string;\n}\n\n// Every successful api-main response is wrapped by a global interceptor as\n// `{ status: 'success', data: <actual payload>, timestamp }` — checked by\n// shape (not just presence of `data`) so a legitimate resource that happens\n// to have its own `data`/`status` field is never mistaken for the envelope.\ninterface SuccessEnvelope {\n  status: 'success';\n  data: unknown;\n  timestamp: string;\n}\n\nfunction isSuccessEnvelope(payload: unknown): payload is SuccessEnvelope {\n  return (\n    typeof payload === 'object' &&\n    payload !== null &&\n    (payload as Record<string, unknown>).status === 'success' &&\n    'data' in payload &&\n    typeof (payload as Record<string, unknown>).timestamp === 'string'\n  );\n}\n\nexport class HttpClient {\n  constructor(private readonly config: HttpClientConfig) {}\n\n  async request<T>(\n    method: string,\n    path: string,\n    options?: {\n      body?: unknown;\n      query?: Record<string, string | number | boolean | undefined | null>;\n    },\n  ): Promise<T> {\n    // The public API is served behind api-gateway under a /v1 prefix — the\n    // gateway's route table only matches /v1/... and 404s anything else, so\n    // every request must go there regardless of how `path` is written by\n    // the resource classes below.\n    const url = new URL(`/v1${path}`, this.config.baseUrl);\n\n    if (options?.query) {\n      for (const [key, value] of Object.entries(options.query)) {\n        if (value !== undefined && value !== null) {\n          url.searchParams.set(key, String(value));\n        }\n      }\n    }\n\n    const headers: Record<string, string> = {\n      'X-API-Key': this.config.apiKey,\n      Accept: 'application/json',\n    };\n\n    let body: string | undefined;\n    if (options?.body !== undefined) {\n      headers['Content-Type'] = 'application/json';\n      body = JSON.stringify(options.body);\n    }\n\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.config.timeout);\n\n    let response: Response;\n    try {\n      response = await fetch(url.toString(), {\n        method,\n        headers,\n        body,\n        signal: controller.signal,\n      });\n    } catch (err) {\n      // Every failure that can come out of `fetch` itself — timeout, DNS\n      // failure, connection refused, TLS error, etc. — is normalized to\n      // PaybetaError here, not just AbortError. Previously only the\n      // timeout case was wrapped, so callers had to separately handle a\n      // raw, unwrapped TypeError/AggregateError from `fetch` for every\n      // other kind of network failure; PaybetaApiError is reserved for\n      // \"the API responded, and it was an error,\" which none of these\n      // are. The original error is preserved as `cause` for debugging.\n      if (err instanceof Error && err.name === 'AbortError') {\n        throw new PaybetaError(`Request timed out after ${this.config.timeout}ms`, { cause: err });\n      }\n      const detail = err instanceof Error ? err.message : String(err);\n      throw new PaybetaError(`Network request to PayBeta failed: ${detail}`, { cause: err });\n    } finally {\n      clearTimeout(timer);\n    }\n\n    let payload: unknown;\n    const contentType = response.headers.get('content-type') ?? '';\n    if (contentType.includes('application/json')) {\n      payload = await response.json().catch(() => null);\n    } else {\n      payload = await response.text().catch(() => null);\n    }\n\n    if (!response.ok) {\n      const errBody = (payload ?? {}) as ApiErrorBody;\n      const errDetail = errBody.error ?? {};\n      throw new PaybetaApiError(\n        response.status,\n        errDetail.code ?? String(response.status),\n        errDetail.message ?? errBody.message ?? 'Request failed',\n        errDetail.traceId ?? '',\n        errDetail.timestamp ?? new Date().toISOString(),\n      );\n    }\n\n    return (isSuccessEnvelope(payload) ? payload.data : payload) as T;\n  }\n\n  get<T>(path: string, query?: Record<string, string | number | boolean | undefined | null>): Promise<T> {\n    return this.request<T>('GET', path, { query });\n  }\n\n  post<T>(path: string, body?: unknown): Promise<T> {\n    return this.request<T>('POST', path, { body });\n  }\n\n  patch<T>(path: string, body?: unknown): Promise<T> {\n    return this.request<T>('PATCH', path, { body });\n  }\n\n  delete<T>(path: string): Promise<T> {\n    return this.request<T>('DELETE', path);\n  }\n}\n","import type { HttpClient } from '../http.js';\nimport type {\n  Transaction,\n  CreateTransactionParams,\n  ListTransactionsParams,\n  TransactionEvent,\n} from '../types/transactions.js';\nimport type { RequestOptions } from '../types/common.js';\n\nexport class TransactionsResource {\n  constructor(private readonly http: HttpClient) {}\n\n  create(params: CreateTransactionParams, opts?: RequestOptions): Promise<Transaction> {\n    const body = opts?.idempotencyKey\n      ? { ...params, idempotencyKey: opts.idempotencyKey }\n      : params;\n    return this.http.post<Transaction>('/transactions', body);\n  }\n\n  /**\n   * Lists transactions. The bare `/transactions` endpoint is platform-role\n   * only — an API-key (merchant) caller gets a 403 there — so passing\n   * `merchantId` routes to `/transactions/merchant/:merchantId` instead.\n   */\n  list(params?: ListTransactionsParams): Promise<Transaction[]> {\n    const { merchantId, ...rest } = params ?? {};\n    const path = merchantId ? `/transactions/merchant/${merchantId}` : '/transactions';\n    return this.http.get<Transaction[]>(path, rest as Record<string, string | number | undefined>);\n  }\n\n  retrieve(id: string): Promise<Transaction> {\n    return this.http.get<Transaction>(`/transactions/${id}`);\n  }\n\n  listHistory(id: string): Promise<TransactionEvent[]> {\n    return this.http.get<TransactionEvent[]>(`/transactions/${id}/history`);\n  }\n}\n","import type { HttpClient } from '../http.js';\nimport type {\n  Payment,\n  PaymentAttempt,\n  InitiatePaymentParams,\n  ListPaymentsParams,\n} from '../types/payments.js';\n\nexport class PaymentsResource {\n  constructor(private readonly http: HttpClient) {}\n\n  initiate(params: InitiatePaymentParams): Promise<Payment> {\n    const { idempotencyKey, ...rest } = params;\n    const body = idempotencyKey ? { ...rest, idempotencyKey } : rest;\n    return this.http.post<Payment>('/payments', body);\n  }\n\n  /**\n   * Lists payments. The bare `/payments` endpoint is platform-role only —\n   * an API-key (merchant) caller gets a 403 there — so passing `merchantId`\n   * (which every merchant API key call needs) routes to\n   * `/payments/merchant/:merchantId` instead, matching what the API\n   * actually allows a merchant credential to call.\n   */\n  list(params?: ListPaymentsParams): Promise<Payment[]> {\n    const { merchantId, ...rest } = params ?? {};\n    const path = merchantId ? `/payments/merchant/${merchantId}` : '/payments';\n    return this.http.get<Payment[]>(path, rest as Record<string, string | number | undefined>);\n  }\n\n  retrieve(id: string): Promise<Payment> {\n    return this.http.get<Payment>(`/payments/${id}`);\n  }\n\n  verify(id: string): Promise<Payment> {\n    return this.http.post<Payment>(`/payments/${id}/verify`);\n  }\n\n  retry(id: string): Promise<Payment> {\n    return this.http.post<Payment>(`/payments/${id}/retry`);\n  }\n\n  listAttempts(id: string): Promise<PaymentAttempt[]> {\n    return this.http.get<PaymentAttempt[]>(`/payments/${id}/attempts`);\n  }\n}\n","import type { HttpClient } from '../http.js';\nimport type {\n  Escrow,\n  EscrowBalance,\n  EscrowListResponse,\n  EscrowConditionsResponse,\n  CreateEscrowParams,\n  ListEscrowsParams,\n  ReleaseEscrowParams,\n  ConfirmDeliveryParams,\n  ConfirmBuyerParams,\n} from '../types/escrows.js';\nimport type { RequestOptions } from '../types/common.js';\n\nexport class EscrowsResource {\n  constructor(private readonly http: HttpClient) {}\n\n  create(params: CreateEscrowParams, opts?: RequestOptions): Promise<Escrow> {\n    const body = opts?.idempotencyKey\n      ? { ...params, idempotencyKey: opts.idempotencyKey }\n      : params;\n    return this.http.post<Escrow>('/escrows', body);\n  }\n\n  /**\n   * Lists escrows. The bare `/escrows` endpoint is platform-role only — an\n   * API-key (merchant) caller gets a 403 there — so passing `merchantId`\n   * routes to `/escrows/merchant/:merchantId` instead. Unlike\n   * payments/transactions/disputes, this returns a `{ escrows, total,\n   * limit, offset }` envelope rather than a bare array.\n   */\n  list(params?: ListEscrowsParams): Promise<EscrowListResponse> {\n    const { merchantId, ...rest } = params ?? {};\n    const path = merchantId ? `/escrows/merchant/${merchantId}` : '/escrows';\n    return this.http.get<EscrowListResponse>(path, rest as Record<string, string | number | undefined>);\n  }\n\n  retrieve(id: string): Promise<Escrow> {\n    return this.http.get<Escrow>(`/escrows/${id}`);\n  }\n\n  retrieveBalance(id: string): Promise<EscrowBalance> {\n    return this.http.get<EscrowBalance>(`/escrows/${id}/balance`);\n  }\n\n  retrieveConditions(id: string): Promise<EscrowConditionsResponse> {\n    return this.http.get<EscrowConditionsResponse>(`/escrows/${id}/conditions`);\n  }\n\n  release(id: string, params?: ReleaseEscrowParams): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/release`, params);\n  }\n\n  refund(id: string): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/refund`);\n  }\n\n  dispute(id: string): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/dispute`);\n  }\n\n  cancel(id: string): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/cancel`);\n  }\n\n  confirmDelivery(id: string, params?: ConfirmDeliveryParams): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/confirm-delivery`, params);\n  }\n\n  confirmBuyer(id: string, params?: ConfirmBuyerParams): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/confirm-buyer`, params);\n  }\n}\n","import type { HttpClient } from '../http.js';\nimport type {\n  Dispute,\n  Evidence,\n  OpenDisputeParams,\n  ListDisputesParams,\n  UploadEvidenceParams,\n  ResolveDisputeParams,\n  CancelDisputeParams,\n} from '../types/disputes.js';\n\nexport class DisputesResource {\n  constructor(private readonly http: HttpClient) {}\n\n  open(params: OpenDisputeParams): Promise<Dispute> {\n    return this.http.post<Dispute>('/disputes', params);\n  }\n\n  /**\n   * Lists disputes. The bare `/disputes` endpoint is platform-role only —\n   * an API-key (merchant) caller gets a 403 there — so passing\n   * `merchantId` routes to `/disputes/merchant/:merchantId` instead.\n   */\n  list(params?: ListDisputesParams): Promise<Dispute[]> {\n    const { merchantId, ...rest } = params ?? {};\n    const path = merchantId ? `/disputes/merchant/${merchantId}` : '/disputes';\n    return this.http.get<Dispute[]>(path, rest as Record<string, string | number | undefined>);\n  }\n\n  retrieve(id: string): Promise<Dispute> {\n    return this.http.get<Dispute>(`/disputes/${id}`);\n  }\n\n  listEvidence(id: string): Promise<Evidence[]> {\n    return this.http.get<Evidence[]>(`/disputes/${id}/evidence`);\n  }\n\n  uploadEvidence(id: string, params: UploadEvidenceParams): Promise<Evidence> {\n    return this.http.post<Evidence>(`/disputes/${id}/evidence`, params);\n  }\n\n  resolve(id: string, params: ResolveDisputeParams): Promise<Dispute> {\n    return this.http.post<Dispute>(`/disputes/${id}/resolve`, params);\n  }\n\n  cancel(id: string, params: CancelDisputeParams): Promise<Dispute> {\n    return this.http.post<Dispute>(`/disputes/${id}/cancel`, params);\n  }\n}\n","import { createHmac, timingSafeEqual } from 'crypto';\nimport { PaybetaError } from '../errors.js';\nimport type { WebhookEvent } from '../types/webhooks.js';\n\nexport class WebhooksResource {\n  constructor(private readonly secret: string) {}\n\n  /**\n   * Verifies the signature on an incoming webhook and parses the payload.\n   *\n   * PayBeta signs the concatenation of the delivery timestamp and the raw\n   * request body — `HMAC-SHA256(secret, \"${timestamp}.${rawBody}\")` — and\n   * sends the result hex-encoded, prefixed with `sha256=`, in the\n   * `X-PayBeta-Signature` header (see OutboundWebhookService). The\n   * timestamp itself arrives separately in `X-PayBeta-Timestamp`, so both\n   * headers are required here, not just the signature.\n   *\n   * Pass the raw request body (before JSON parsing), the value of the\n   * `X-PayBeta-Signature` header, and the value of the `X-PayBeta-Timestamp`\n   * header. Throws `PaybetaError` if the signature is invalid or the\n   * secret was not configured.\n   */\n  constructEvent<T = unknown>(\n    rawBody: string | Buffer,\n    signature: string,\n    timestamp: string,\n  ): WebhookEvent<T> {\n    if (!this.secret) {\n      throw new PaybetaError(\n        'webhookSecret must be set on PaybetaClient to verify webhook signatures',\n      );\n    }\n\n    const body = typeof rawBody === 'string' ? rawBody : rawBody.toString('utf8');\n\n    // Accept the header verbatim (`sha256=<hex>`) or a bare hex digest, so\n    // callers who've already stripped the prefix don't get a confusing\n    // \"invalid signature format\" error.\n    const hexSignature = signature.startsWith('sha256=') ? signature.slice('sha256='.length) : signature;\n\n    const expected = createHmac('sha256', this.secret)\n      .update(`${timestamp}.${body}`)\n      .digest('hex');\n\n    let actual: Buffer;\n    let expectedBuf: Buffer;\n    try {\n      actual = Buffer.from(hexSignature, 'hex');\n      expectedBuf = Buffer.from(expected, 'hex');\n    } catch {\n      throw new PaybetaError('Invalid signature format');\n    }\n\n    if (expectedBuf.length !== actual.length || !timingSafeEqual(expectedBuf, actual)) {\n      throw new PaybetaError('Webhook signature verification failed');\n    }\n\n    return JSON.parse(body) as WebhookEvent<T>;\n  }\n}\n","import { HttpClient } from './http.js';\nimport { TransactionsResource } from './resources/transactions.js';\nimport { PaymentsResource } from './resources/payments.js';\nimport { EscrowsResource } from './resources/escrows.js';\nimport { DisputesResource } from './resources/disputes.js';\nimport { WebhooksResource } from './resources/webhooks.js';\n\nexport interface PaybetaClientConfig {\n  /** API key obtained from the Paybeta dashboard (pb_live_* or pb_test_*) */\n  apiKey: string;\n  /** Override the default API base URL. Defaults to https://api.usepaybeta.com */\n  baseUrl?: string;\n  /** Webhook signing secret used to verify incoming webhook payloads */\n  webhookSecret?: string;\n  /** Request timeout in milliseconds. Defaults to 30000 */\n  timeout?: number;\n}\n\nexport class PaybetaClient {\n  readonly transactions: TransactionsResource;\n  readonly payments: PaymentsResource;\n  readonly escrows: EscrowsResource;\n  readonly disputes: DisputesResource;\n  readonly webhooks: WebhooksResource;\n\n  constructor(config: PaybetaClientConfig) {\n    if (!config.apiKey) {\n      throw new Error('PaybetaClient: apiKey is required');\n    }\n\n    const http = new HttpClient({\n      apiKey: config.apiKey,\n      baseUrl: config.baseUrl ?? 'https://api.usepaybeta.com',\n      timeout: config.timeout ?? 30_000,\n    });\n\n    this.transactions = new TransactionsResource(http);\n    this.payments = new PaymentsResource(http);\n    this.escrows = new EscrowsResource(http);\n    this.disputes = new DisputesResource(http);\n    this.webhooks = new WebhooksResource(config.webhookSecret ?? '');\n  }\n}\n"]}

package/dist/index.mjs

@@ -21,6 +21,9 @@ var PaybetaApiError = class extends PaybetaError {
 };
 
 // src/http.ts
+function isSuccessEnvelope(payload) {
+  return typeof payload === "object" && payload !== null && payload.status === "success" && "data" in payload && typeof payload.timestamp === "string";
+}
 var HttpClient = class {
   constructor(config) {
     this.config = config;
@@ -80,7 +83,7 @@ var HttpClient = class {
         errDetail.timestamp ?? (/* @__PURE__ */ new Date()).toISOString()
       );
     }
-    return payload;
+    return isSuccessEnvelope(payload) ? payload.data : payload;
   }
   get(path, query) {
     return this.request("GET", path, { query });

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/http.ts","../src/resources/transactions.ts","../src/resources/payments.ts","../src/resources/escrows.ts","../src/resources/disputes.ts","../src/resources/webhooks.ts","../src/client.ts"],"names":[],"mappings":";;;AAAO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EACtC,WAAA,CAAY,SAAiB,OAAA,EAA+B;AAC1D,IAAA,KAAA,CAAM,OAAA,EAAS,SAAS,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,GAAI,MAAS,CAAA;AAClF,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AACF;AAEO,IAAM,eAAA,GAAN,cAA8B,YAAA,CAAa;AAAA,EAMhD,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,OAAA,EAAiB,SAAiB,SAAA,EAAmB;AAC7F,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AACF;;;ACLO,IAAM,aAAN,MAAiB;AAAA,EACtB,YAA6B,MAAA,EAA0B;AAA1B,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAA2B;AAAA,EAExD,MAAM,OAAA,CACJ,MAAA,EACA,IAAA,EACA,OAAA,EAIY;AAKZ,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,GAAA,EAAM,IAAI,CAAA,CAAA,EAAI,IAAA,CAAK,OAAO,OAAO,CAAA;AAErD,IAAA,IAAI,SAAS,KAAA,EAAO;AAClB,MAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxD,QAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAAM;AACzC,UAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,GAAA,EAAK,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,QACzC;AAAA,MACF;AAAA,IACF;AAEA,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,WAAA,EAAa,KAAK,MAAA,CAAO,MAAA;AAAA,MACzB,MAAA,EAAQ;AAAA,KACV;AAEA,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI,OAAA,EAAS,SAAS,MAAA,EAAW;AAC/B,MAAA,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AAC1B,MAAA,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,IAAI,CAAA;AAAA,IACpC;AAEA,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,CAAK,OAAO,OAAO,CAAA;AAEtE,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,CAAI,QAAA,EAAS,EAAG;AAAA,QACrC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA;AAAA,QACA,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AASZ,MAAA,IAAI,GAAA,YAAe,KAAA,IAAS,GAAA,CAAI,IAAA,KAAS,YAAA,EAAc;AACrD,QAAA,MAAM,IAAI,YAAA,CAAa,CAAA,wBAAA,EAA2B,IAAA,CAAK,MAAA,CAAO,OAAO,CAAA,EAAA,CAAA,EAAM,EAAE,KAAA,EAAO,GAAA,EAAK,CAAA;AAAA,MAC3F;AACA,MAAA,MAAM,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC9D,MAAA,MAAM,IAAI,aAAa,CAAA,mCAAA,EAAsC,MAAM,IAAI,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,IACvF,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAEA,IAAA,IAAI,OAAA;AACJ,IAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AAC5D,IAAA,IAAI,WAAA,CAAY,QAAA,CAAS,kBAAkB,CAAA,EAAG;AAC5C,MAAA,OAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAAA,IAClD,CAAA,MAAO;AACL,MAAA,OAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAAA,IAClD;AAEA,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,OAAA,GAAW,WAAW,EAAC;AAC7B,MAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,KAAA,IAAS,EAAC;AACpC,MAAA,MAAM,IAAI,eAAA;AAAA,QACR,QAAA,CAAS,MAAA;AAAA,QACT,SAAA,CAAU,IAAA,IAAQ,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA;AAAA,QACxC,SAAA,CAAU,OAAA,IAAW,OAAA,CAAQ,OAAA,IAAW,gBAAA;AAAA,QACxC,UAAU,OAAA,IAAW,EAAA;AAAA,QACrB,SAAA,CAAU,SAAA,IAAA,iBAAa,IAAI,IAAA,IAAO,WAAA;AAAY,OAChD;AAAA,IACF;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,GAAA,CAAO,MAAc,KAAA,EAAkF;AACrG,IAAA,OAAO,KAAK,OAAA,CAAW,KAAA,EAAO,IAAA,EAAM,EAAE,OAAO,CAAA;AAAA,EAC/C;AAAA,EAEA,IAAA,CAAQ,MAAc,IAAA,EAA4B;AAChD,IAAA,OAAO,KAAK,OAAA,CAAW,MAAA,EAAQ,IAAA,EAAM,EAAE,MAAM,CAAA;AAAA,EAC/C;AAAA,EAEA,KAAA,CAAS,MAAc,IAAA,EAA4B;AACjD,IAAA,OAAO,KAAK,OAAA,CAAW,OAAA,EAAS,IAAA,EAAM,EAAE,MAAM,CAAA;AAAA,EAChD;AAAA,EAEA,OAAU,IAAA,EAA0B;AAClC,IAAA,OAAO,IAAA,CAAK,OAAA,CAAW,QAAA,EAAU,IAAI,CAAA;AAAA,EACvC;AACF,CAAA;;;AChHO,IAAM,uBAAN,MAA2B;AAAA,EAChC,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA,EAEhD,MAAA,CAAO,QAAiC,IAAA,EAA6C;AACnF,IAAA,MAAM,IAAA,GAAO,MAAM,cAAA,GACf,EAAE,GAAG,MAAA,EAAQ,cAAA,EAAgB,IAAA,CAAK,cAAA,EAAe,GACjD,MAAA;AACJ,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAkB,eAAA,EAAiB,IAAI,CAAA;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,KAAK,MAAA,EAAyD;AAC5D,IAAA,MAAM,EAAE,UAAA,EAAY,GAAG,IAAA,EAAK,GAAI,UAAU,EAAC;AAC3C,IAAA,MAAM,IAAA,GAAO,UAAA,GAAa,CAAA,uBAAA,EAA0B,UAAU,CAAA,CAAA,GAAK,eAAA;AACnE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAmB,IAAA,EAAM,IAAmD,CAAA;AAAA,EAC/F;AAAA,EAEA,SAAS,EAAA,EAAkC;AACzC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAiB,CAAA,cAAA,EAAiB,EAAE,CAAA,CAAE,CAAA;AAAA,EACzD;AAAA,EAEA,YAAY,EAAA,EAAyC;AACnD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAwB,CAAA,cAAA,EAAiB,EAAE,CAAA,QAAA,CAAU,CAAA;AAAA,EACxE;AACF,CAAA;;;AC7BO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA,EAEhD,SAAS,MAAA,EAAiD;AACxD,IAAA,MAAM,EAAE,cAAA,EAAgB,GAAG,IAAA,EAAK,GAAI,MAAA;AACpC,IAAA,MAAM,OAAO,cAAA,GAAiB,EAAE,GAAG,IAAA,EAAM,gBAAe,GAAI,IAAA;AAC5D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAc,WAAA,EAAa,IAAI,CAAA;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,KAAK,MAAA,EAAiD;AACpD,IAAA,MAAM,EAAE,UAAA,EAAY,GAAG,IAAA,EAAK,GAAI,UAAU,EAAC;AAC3C,IAAA,MAAM,IAAA,GAAO,UAAA,GAAa,CAAA,mBAAA,EAAsB,UAAU,CAAA,CAAA,GAAK,WAAA;AAC/D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAe,IAAA,EAAM,IAAmD,CAAA;AAAA,EAC3F;AAAA,EAEA,SAAS,EAAA,EAA8B;AACrC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAa,CAAA,UAAA,EAAa,EAAE,CAAA,CAAE,CAAA;AAAA,EACjD;AAAA,EAEA,OAAO,EAAA,EAA8B;AACnC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAc,CAAA,UAAA,EAAa,EAAE,CAAA,OAAA,CAAS,CAAA;AAAA,EACzD;AAAA,EAEA,MAAM,EAAA,EAA8B;AAClC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAc,CAAA,UAAA,EAAa,EAAE,CAAA,MAAA,CAAQ,CAAA;AAAA,EACxD;AAAA,EAEA,aAAa,EAAA,EAAuC;AAClD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAsB,CAAA,UAAA,EAAa,EAAE,CAAA,SAAA,CAAW,CAAA;AAAA,EACnE;AACF,CAAA;;;AC/BO,IAAM,kBAAN,MAAsB;AAAA,EAC3B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA,EAEhD,MAAA,CAAO,QAA4B,IAAA,EAAwC;AACzE,IAAA,MAAM,IAAA,GAAO,MAAM,cAAA,GACf,EAAE,GAAG,MAAA,EAAQ,cAAA,EAAgB,IAAA,CAAK,cAAA,EAAe,GACjD,MAAA;AACJ,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAa,UAAA,EAAY,IAAI,CAAA;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,KAAK,MAAA,EAAyD;AAC5D,IAAA,MAAM,EAAE,UAAA,EAAY,GAAG,IAAA,EAAK,GAAI,UAAU,EAAC;AAC3C,IAAA,MAAM,IAAA,GAAO,UAAA,GAAa,CAAA,kBAAA,EAAqB,UAAU,CAAA,CAAA,GAAK,UAAA;AAC9D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAwB,IAAA,EAAM,IAAmD,CAAA;AAAA,EACpG;AAAA,EAEA,SAAS,EAAA,EAA6B;AACpC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAY,CAAA,SAAA,EAAY,EAAE,CAAA,CAAE,CAAA;AAAA,EAC/C;AAAA,EAEA,gBAAgB,EAAA,EAAoC;AAClD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAmB,CAAA,SAAA,EAAY,EAAE,CAAA,QAAA,CAAU,CAAA;AAAA,EAC9D;AAAA,EAEA,mBAAmB,EAAA,EAA+C;AAChE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAA8B,CAAA,SAAA,EAAY,EAAE,CAAA,WAAA,CAAa,CAAA;AAAA,EAC5E;AAAA,EAEA,OAAA,CAAQ,IAAY,MAAA,EAA+C;AACjE,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,YAAY,MAAM,CAAA;AAAA,EAChE;AAAA,EAEA,OAAO,EAAA,EAA6B;AAClC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,CAAA,OAAA,CAAS,CAAA;AAAA,EACvD;AAAA,EAEA,QAAQ,EAAA,EAA6B;AACnC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,CAAA,QAAA,CAAU,CAAA;AAAA,EACxD;AAAA,EAEA,OAAO,EAAA,EAA6B;AAClC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,CAAA,OAAA,CAAS,CAAA;AAAA,EACvD;AAAA,EAEA,eAAA,CAAgB,IAAY,MAAA,EAAiD;AAC3E,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,qBAAqB,MAAM,CAAA;AAAA,EACzE;AAAA,EAEA,YAAA,CAAa,IAAY,MAAA,EAA8C;AACrE,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,kBAAkB,MAAM,CAAA;AAAA,EACtE;AACF,CAAA;;;AC7DO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA,EAEhD,KAAK,MAAA,EAA6C;AAChD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAc,WAAA,EAAa,MAAM,CAAA;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,KAAK,MAAA,EAAiD;AACpD,IAAA,MAAM,EAAE,UAAA,EAAY,GAAG,IAAA,EAAK,GAAI,UAAU,EAAC;AAC3C,IAAA,MAAM,IAAA,GAAO,UAAA,GAAa,CAAA,mBAAA,EAAsB,UAAU,CAAA,CAAA,GAAK,WAAA;AAC/D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAe,IAAA,EAAM,IAAmD,CAAA;AAAA,EAC3F;AAAA,EAEA,SAAS,EAAA,EAA8B;AACrC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAa,CAAA,UAAA,EAAa,EAAE,CAAA,CAAE,CAAA;AAAA,EACjD;AAAA,EAEA,aAAa,EAAA,EAAiC;AAC5C,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAgB,CAAA,UAAA,EAAa,EAAE,CAAA,SAAA,CAAW,CAAA;AAAA,EAC7D;AAAA,EAEA,cAAA,CAAe,IAAY,MAAA,EAAiD;AAC1E,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAe,CAAA,UAAA,EAAa,EAAE,aAAa,MAAM,CAAA;AAAA,EACpE;AAAA,EAEA,OAAA,CAAQ,IAAY,MAAA,EAAgD;AAClE,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAc,CAAA,UAAA,EAAa,EAAE,YAAY,MAAM,CAAA;AAAA,EAClE;AAAA,EAEA,MAAA,CAAO,IAAY,MAAA,EAA+C;AAChE,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAc,CAAA,UAAA,EAAa,EAAE,WAAW,MAAM,CAAA;AAAA,EACjE;AACF,CAAA;AC5CO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAA6B,MAAA,EAAgB;AAAhB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiB9C,cAAA,CACE,OAAA,EACA,SAAA,EACA,SAAA,EACiB;AACjB,IAAA,IAAI,CAAC,KAAK,MAAA,EAAQ;AAChB,MAAA,MAAM,IAAI,YAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,OAAO,OAAO,OAAA,KAAY,WAAW,OAAA,GAAU,OAAA,CAAQ,SAAS,MAAM,CAAA;AAK5E,IAAA,MAAM,YAAA,GAAe,UAAU,UAAA,CAAW,SAAS,IAAI,SAAA,CAAU,KAAA,CAAM,SAAA,CAAU,MAAM,CAAA,GAAI,SAAA;AAE3F,IAAA,MAAM,QAAA,GAAW,UAAA,CAAW,QAAA,EAAU,IAAA,CAAK,MAAM,CAAA,CAC9C,MAAA,CAAO,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA,CAC7B,OAAO,KAAK,CAAA;AAEf,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI,WAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,MAAA,CAAO,IAAA,CAAK,YAAA,EAAc,KAAK,CAAA;AACxC,MAAA,WAAA,GAAc,MAAA,CAAO,IAAA,CAAK,QAAA,EAAU,KAAK,CAAA;AAAA,IAC3C,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,aAAa,0BAA0B,CAAA;AAAA,IACnD;AAEA,IAAA,IAAI,WAAA,CAAY,WAAW,MAAA,CAAO,MAAA,IAAU,CAAC,eAAA,CAAgB,WAAA,EAAa,MAAM,CAAA,EAAG;AACjF,MAAA,MAAM,IAAI,aAAa,uCAAuC,CAAA;AAAA,IAChE;AAEA,IAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB;AACF,CAAA;;;ACzCO,IAAM,gBAAN,MAAoB;AAAA,EAOzB,YAAY,MAAA,EAA6B;AACvC,IAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAClB,MAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,IACrD;AAEA,IAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW;AAAA,MAC1B,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf,OAAA,EAAS,OAAO,OAAA,IAAW,4BAAA;AAAA,MAC3B,OAAA,EAAS,OAAO,OAAA,IAAW;AAAA,KAC5B,CAAA;AAED,IAAA,IAAA,CAAK,YAAA,GAAe,IAAI,oBAAA,CAAqB,IAAI,CAAA;AACjD,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,gBAAA,CAAiB,IAAI,CAAA;AACzC,IAAA,IAAA,CAAK,OAAA,GAAU,IAAI,eAAA,CAAgB,IAAI,CAAA;AACvC,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,gBAAA,CAAiB,IAAI,CAAA;AACzC,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,gBAAA,CAAiB,MAAA,CAAO,iBAAiB,EAAE,CAAA;AAAA,EACjE;AACF","file":"index.mjs","sourcesContent":["export class PaybetaError extends Error {\n  constructor(message: string, options?: { cause?: unknown }) {\n    super(message, options?.cause !== undefined ? { cause: options.cause } : undefined);\n    this.name = 'PaybetaError';\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\nexport class PaybetaApiError extends PaybetaError {\n  readonly status: number;\n  readonly code: string;\n  readonly traceId: string;\n  readonly timestamp: string;\n\n  constructor(status: number, code: string, message: string, traceId: string, timestamp: string) {\n    super(message);\n    this.name = 'PaybetaApiError';\n    this.status = status;\n    this.code = code;\n    this.traceId = traceId;\n    this.timestamp = timestamp;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n","import { PaybetaApiError, PaybetaError } from './errors.js';\n\nexport interface HttpClientConfig {\n  apiKey: string;\n  baseUrl: string;\n  timeout: number;\n}\n\ninterface ApiErrorBody {\n  error?: {\n    code?: string;\n    message?: string;\n    traceId?: string;\n    timestamp?: string;\n  };\n  message?: string;\n}\n\nexport class HttpClient {\n  constructor(private readonly config: HttpClientConfig) {}\n\n  async request<T>(\n    method: string,\n    path: string,\n    options?: {\n      body?: unknown;\n      query?: Record<string, string | number | boolean | undefined | null>;\n    },\n  ): Promise<T> {\n    // The public API is served behind api-gateway under a /v1 prefix — the\n    // gateway's route table only matches /v1/... and 404s anything else, so\n    // every request must go there regardless of how `path` is written by\n    // the resource classes below.\n    const url = new URL(`/v1${path}`, this.config.baseUrl);\n\n    if (options?.query) {\n      for (const [key, value] of Object.entries(options.query)) {\n        if (value !== undefined && value !== null) {\n          url.searchParams.set(key, String(value));\n        }\n      }\n    }\n\n    const headers: Record<string, string> = {\n      'X-API-Key': this.config.apiKey,\n      Accept: 'application/json',\n    };\n\n    let body: string | undefined;\n    if (options?.body !== undefined) {\n      headers['Content-Type'] = 'application/json';\n      body = JSON.stringify(options.body);\n    }\n\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.config.timeout);\n\n    let response: Response;\n    try {\n      response = await fetch(url.toString(), {\n        method,\n        headers,\n        body,\n        signal: controller.signal,\n      });\n    } catch (err) {\n      // Every failure that can come out of `fetch` itself — timeout, DNS\n      // failure, connection refused, TLS error, etc. — is normalized to\n      // PaybetaError here, not just AbortError. Previously only the\n      // timeout case was wrapped, so callers had to separately handle a\n      // raw, unwrapped TypeError/AggregateError from `fetch` for every\n      // other kind of network failure; PaybetaApiError is reserved for\n      // \"the API responded, and it was an error,\" which none of these\n      // are. The original error is preserved as `cause` for debugging.\n      if (err instanceof Error && err.name === 'AbortError') {\n        throw new PaybetaError(`Request timed out after ${this.config.timeout}ms`, { cause: err });\n      }\n      const detail = err instanceof Error ? err.message : String(err);\n      throw new PaybetaError(`Network request to PayBeta failed: ${detail}`, { cause: err });\n    } finally {\n      clearTimeout(timer);\n    }\n\n    let payload: unknown;\n    const contentType = response.headers.get('content-type') ?? '';\n    if (contentType.includes('application/json')) {\n      payload = await response.json().catch(() => null);\n    } else {\n      payload = await response.text().catch(() => null);\n    }\n\n    if (!response.ok) {\n      const errBody = (payload ?? {}) as ApiErrorBody;\n      const errDetail = errBody.error ?? {};\n      throw new PaybetaApiError(\n        response.status,\n        errDetail.code ?? String(response.status),\n        errDetail.message ?? errBody.message ?? 'Request failed',\n        errDetail.traceId ?? '',\n        errDetail.timestamp ?? new Date().toISOString(),\n      );\n    }\n\n    return payload as T;\n  }\n\n  get<T>(path: string, query?: Record<string, string | number | boolean | undefined | null>): Promise<T> {\n    return this.request<T>('GET', path, { query });\n  }\n\n  post<T>(path: string, body?: unknown): Promise<T> {\n    return this.request<T>('POST', path, { body });\n  }\n\n  patch<T>(path: string, body?: unknown): Promise<T> {\n    return this.request<T>('PATCH', path, { body });\n  }\n\n  delete<T>(path: string): Promise<T> {\n    return this.request<T>('DELETE', path);\n  }\n}\n","import type { HttpClient } from '../http.js';\nimport type {\n  Transaction,\n  CreateTransactionParams,\n  ListTransactionsParams,\n  TransactionEvent,\n} from '../types/transactions.js';\nimport type { RequestOptions } from '../types/common.js';\n\nexport class TransactionsResource {\n  constructor(private readonly http: HttpClient) {}\n\n  create(params: CreateTransactionParams, opts?: RequestOptions): Promise<Transaction> {\n    const body = opts?.idempotencyKey\n      ? { ...params, idempotencyKey: opts.idempotencyKey }\n      : params;\n    return this.http.post<Transaction>('/transactions', body);\n  }\n\n  /**\n   * Lists transactions. The bare `/transactions` endpoint is platform-role\n   * only — an API-key (merchant) caller gets a 403 there — so passing\n   * `merchantId` routes to `/transactions/merchant/:merchantId` instead.\n   */\n  list(params?: ListTransactionsParams): Promise<Transaction[]> {\n    const { merchantId, ...rest } = params ?? {};\n    const path = merchantId ? `/transactions/merchant/${merchantId}` : '/transactions';\n    return this.http.get<Transaction[]>(path, rest as Record<string, string | number | undefined>);\n  }\n\n  retrieve(id: string): Promise<Transaction> {\n    return this.http.get<Transaction>(`/transactions/${id}`);\n  }\n\n  listHistory(id: string): Promise<TransactionEvent[]> {\n    return this.http.get<TransactionEvent[]>(`/transactions/${id}/history`);\n  }\n}\n","import type { HttpClient } from '../http.js';\nimport type {\n  Payment,\n  PaymentAttempt,\n  InitiatePaymentParams,\n  ListPaymentsParams,\n} from '../types/payments.js';\n\nexport class PaymentsResource {\n  constructor(private readonly http: HttpClient) {}\n\n  initiate(params: InitiatePaymentParams): Promise<Payment> {\n    const { idempotencyKey, ...rest } = params;\n    const body = idempotencyKey ? { ...rest, idempotencyKey } : rest;\n    return this.http.post<Payment>('/payments', body);\n  }\n\n  /**\n   * Lists payments. The bare `/payments` endpoint is platform-role only —\n   * an API-key (merchant) caller gets a 403 there — so passing `merchantId`\n   * (which every merchant API key call needs) routes to\n   * `/payments/merchant/:merchantId` instead, matching what the API\n   * actually allows a merchant credential to call.\n   */\n  list(params?: ListPaymentsParams): Promise<Payment[]> {\n    const { merchantId, ...rest } = params ?? {};\n    const path = merchantId ? `/payments/merchant/${merchantId}` : '/payments';\n    return this.http.get<Payment[]>(path, rest as Record<string, string | number | undefined>);\n  }\n\n  retrieve(id: string): Promise<Payment> {\n    return this.http.get<Payment>(`/payments/${id}`);\n  }\n\n  verify(id: string): Promise<Payment> {\n    return this.http.post<Payment>(`/payments/${id}/verify`);\n  }\n\n  retry(id: string): Promise<Payment> {\n    return this.http.post<Payment>(`/payments/${id}/retry`);\n  }\n\n  listAttempts(id: string): Promise<PaymentAttempt[]> {\n    return this.http.get<PaymentAttempt[]>(`/payments/${id}/attempts`);\n  }\n}\n","import type { HttpClient } from '../http.js';\nimport type {\n  Escrow,\n  EscrowBalance,\n  EscrowListResponse,\n  EscrowConditionsResponse,\n  CreateEscrowParams,\n  ListEscrowsParams,\n  ReleaseEscrowParams,\n  ConfirmDeliveryParams,\n  ConfirmBuyerParams,\n} from '../types/escrows.js';\nimport type { RequestOptions } from '../types/common.js';\n\nexport class EscrowsResource {\n  constructor(private readonly http: HttpClient) {}\n\n  create(params: CreateEscrowParams, opts?: RequestOptions): Promise<Escrow> {\n    const body = opts?.idempotencyKey\n      ? { ...params, idempotencyKey: opts.idempotencyKey }\n      : params;\n    return this.http.post<Escrow>('/escrows', body);\n  }\n\n  /**\n   * Lists escrows. The bare `/escrows` endpoint is platform-role only — an\n   * API-key (merchant) caller gets a 403 there — so passing `merchantId`\n   * routes to `/escrows/merchant/:merchantId` instead. Unlike\n   * payments/transactions/disputes, this returns a `{ escrows, total,\n   * limit, offset }` envelope rather than a bare array.\n   */\n  list(params?: ListEscrowsParams): Promise<EscrowListResponse> {\n    const { merchantId, ...rest } = params ?? {};\n    const path = merchantId ? `/escrows/merchant/${merchantId}` : '/escrows';\n    return this.http.get<EscrowListResponse>(path, rest as Record<string, string | number | undefined>);\n  }\n\n  retrieve(id: string): Promise<Escrow> {\n    return this.http.get<Escrow>(`/escrows/${id}`);\n  }\n\n  retrieveBalance(id: string): Promise<EscrowBalance> {\n    return this.http.get<EscrowBalance>(`/escrows/${id}/balance`);\n  }\n\n  retrieveConditions(id: string): Promise<EscrowConditionsResponse> {\n    return this.http.get<EscrowConditionsResponse>(`/escrows/${id}/conditions`);\n  }\n\n  release(id: string, params?: ReleaseEscrowParams): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/release`, params);\n  }\n\n  refund(id: string): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/refund`);\n  }\n\n  dispute(id: string): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/dispute`);\n  }\n\n  cancel(id: string): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/cancel`);\n  }\n\n  confirmDelivery(id: string, params?: ConfirmDeliveryParams): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/confirm-delivery`, params);\n  }\n\n  confirmBuyer(id: string, params?: ConfirmBuyerParams): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/confirm-buyer`, params);\n  }\n}\n","import type { HttpClient } from '../http.js';\nimport type {\n  Dispute,\n  Evidence,\n  OpenDisputeParams,\n  ListDisputesParams,\n  UploadEvidenceParams,\n  ResolveDisputeParams,\n  CancelDisputeParams,\n} from '../types/disputes.js';\n\nexport class DisputesResource {\n  constructor(private readonly http: HttpClient) {}\n\n  open(params: OpenDisputeParams): Promise<Dispute> {\n    return this.http.post<Dispute>('/disputes', params);\n  }\n\n  /**\n   * Lists disputes. The bare `/disputes` endpoint is platform-role only —\n   * an API-key (merchant) caller gets a 403 there — so passing\n   * `merchantId` routes to `/disputes/merchant/:merchantId` instead.\n   */\n  list(params?: ListDisputesParams): Promise<Dispute[]> {\n    const { merchantId, ...rest } = params ?? {};\n    const path = merchantId ? `/disputes/merchant/${merchantId}` : '/disputes';\n    return this.http.get<Dispute[]>(path, rest as Record<string, string | number | undefined>);\n  }\n\n  retrieve(id: string): Promise<Dispute> {\n    return this.http.get<Dispute>(`/disputes/${id}`);\n  }\n\n  listEvidence(id: string): Promise<Evidence[]> {\n    return this.http.get<Evidence[]>(`/disputes/${id}/evidence`);\n  }\n\n  uploadEvidence(id: string, params: UploadEvidenceParams): Promise<Evidence> {\n    return this.http.post<Evidence>(`/disputes/${id}/evidence`, params);\n  }\n\n  resolve(id: string, params: ResolveDisputeParams): Promise<Dispute> {\n    return this.http.post<Dispute>(`/disputes/${id}/resolve`, params);\n  }\n\n  cancel(id: string, params: CancelDisputeParams): Promise<Dispute> {\n    return this.http.post<Dispute>(`/disputes/${id}/cancel`, params);\n  }\n}\n","import { createHmac, timingSafeEqual } from 'crypto';\nimport { PaybetaError } from '../errors.js';\nimport type { WebhookEvent } from '../types/webhooks.js';\n\nexport class WebhooksResource {\n  constructor(private readonly secret: string) {}\n\n  /**\n   * Verifies the signature on an incoming webhook and parses the payload.\n   *\n   * PayBeta signs the concatenation of the delivery timestamp and the raw\n   * request body — `HMAC-SHA256(secret, \"${timestamp}.${rawBody}\")` — and\n   * sends the result hex-encoded, prefixed with `sha256=`, in the\n   * `X-PayBeta-Signature` header (see OutboundWebhookService). The\n   * timestamp itself arrives separately in `X-PayBeta-Timestamp`, so both\n   * headers are required here, not just the signature.\n   *\n   * Pass the raw request body (before JSON parsing), the value of the\n   * `X-PayBeta-Signature` header, and the value of the `X-PayBeta-Timestamp`\n   * header. Throws `PaybetaError` if the signature is invalid or the\n   * secret was not configured.\n   */\n  constructEvent<T = unknown>(\n    rawBody: string | Buffer,\n    signature: string,\n    timestamp: string,\n  ): WebhookEvent<T> {\n    if (!this.secret) {\n      throw new PaybetaError(\n        'webhookSecret must be set on PaybetaClient to verify webhook signatures',\n      );\n    }\n\n    const body = typeof rawBody === 'string' ? rawBody : rawBody.toString('utf8');\n\n    // Accept the header verbatim (`sha256=<hex>`) or a bare hex digest, so\n    // callers who've already stripped the prefix don't get a confusing\n    // \"invalid signature format\" error.\n    const hexSignature = signature.startsWith('sha256=') ? signature.slice('sha256='.length) : signature;\n\n    const expected = createHmac('sha256', this.secret)\n      .update(`${timestamp}.${body}`)\n      .digest('hex');\n\n    let actual: Buffer;\n    let expectedBuf: Buffer;\n    try {\n      actual = Buffer.from(hexSignature, 'hex');\n      expectedBuf = Buffer.from(expected, 'hex');\n    } catch {\n      throw new PaybetaError('Invalid signature format');\n    }\n\n    if (expectedBuf.length !== actual.length || !timingSafeEqual(expectedBuf, actual)) {\n      throw new PaybetaError('Webhook signature verification failed');\n    }\n\n    return JSON.parse(body) as WebhookEvent<T>;\n  }\n}\n","import { HttpClient } from './http.js';\nimport { TransactionsResource } from './resources/transactions.js';\nimport { PaymentsResource } from './resources/payments.js';\nimport { EscrowsResource } from './resources/escrows.js';\nimport { DisputesResource } from './resources/disputes.js';\nimport { WebhooksResource } from './resources/webhooks.js';\n\nexport interface PaybetaClientConfig {\n  /** API key obtained from the Paybeta dashboard (pb_live_* or pb_test_*) */\n  apiKey: string;\n  /** Override the default API base URL. Defaults to https://api.usepaybeta.com */\n  baseUrl?: string;\n  /** Webhook signing secret used to verify incoming webhook payloads */\n  webhookSecret?: string;\n  /** Request timeout in milliseconds. Defaults to 30000 */\n  timeout?: number;\n}\n\nexport class PaybetaClient {\n  readonly transactions: TransactionsResource;\n  readonly payments: PaymentsResource;\n  readonly escrows: EscrowsResource;\n  readonly disputes: DisputesResource;\n  readonly webhooks: WebhooksResource;\n\n  constructor(config: PaybetaClientConfig) {\n    if (!config.apiKey) {\n      throw new Error('PaybetaClient: apiKey is required');\n    }\n\n    const http = new HttpClient({\n      apiKey: config.apiKey,\n      baseUrl: config.baseUrl ?? 'https://api.usepaybeta.com',\n      timeout: config.timeout ?? 30_000,\n    });\n\n    this.transactions = new TransactionsResource(http);\n    this.payments = new PaymentsResource(http);\n    this.escrows = new EscrowsResource(http);\n    this.disputes = new DisputesResource(http);\n    this.webhooks = new WebhooksResource(config.webhookSecret ?? '');\n  }\n}\n"]}
+{"version":3,"sources":["../src/errors.ts","../src/http.ts","../src/resources/transactions.ts","../src/resources/payments.ts","../src/resources/escrows.ts","../src/resources/disputes.ts","../src/resources/webhooks.ts","../src/client.ts"],"names":[],"mappings":";;;AAAO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EACtC,WAAA,CAAY,SAAiB,OAAA,EAA+B;AAC1D,IAAA,KAAA,CAAM,OAAA,EAAS,SAAS,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,GAAI,MAAS,CAAA;AAClF,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AACF;AAEO,IAAM,eAAA,GAAN,cAA8B,YAAA,CAAa;AAAA,EAMhD,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAc,OAAA,EAAiB,SAAiB,SAAA,EAAmB;AAC7F,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AACF;;;ACKA,SAAS,kBAAkB,OAAA,EAA8C;AACvE,EAAA,OACE,OAAO,OAAA,KAAY,QAAA,IACnB,OAAA,KAAY,IAAA,IACX,OAAA,CAAoC,MAAA,KAAW,SAAA,IAChD,MAAA,IAAU,OAAA,IACV,OAAQ,OAAA,CAAoC,SAAA,KAAc,QAAA;AAE9D;AAEO,IAAM,aAAN,MAAiB;AAAA,EACtB,YAA6B,MAAA,EAA0B;AAA1B,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAA2B;AAAA,EAExD,MAAM,OAAA,CACJ,MAAA,EACA,IAAA,EACA,OAAA,EAIY;AAKZ,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,GAAA,EAAM,IAAI,CAAA,CAAA,EAAI,IAAA,CAAK,OAAO,OAAO,CAAA;AAErD,IAAA,IAAI,SAAS,KAAA,EAAO;AAClB,MAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxD,QAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAAM;AACzC,UAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,GAAA,EAAK,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,QACzC;AAAA,MACF;AAAA,IACF;AAEA,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,WAAA,EAAa,KAAK,MAAA,CAAO,MAAA;AAAA,MACzB,MAAA,EAAQ;AAAA,KACV;AAEA,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI,OAAA,EAAS,SAAS,MAAA,EAAW;AAC/B,MAAA,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AAC1B,MAAA,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,IAAI,CAAA;AAAA,IACpC;AAEA,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,CAAK,OAAO,OAAO,CAAA;AAEtE,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,CAAI,QAAA,EAAS,EAAG;AAAA,QACrC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,IAAA;AAAA,QACA,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AASZ,MAAA,IAAI,GAAA,YAAe,KAAA,IAAS,GAAA,CAAI,IAAA,KAAS,YAAA,EAAc;AACrD,QAAA,MAAM,IAAI,YAAA,CAAa,CAAA,wBAAA,EAA2B,IAAA,CAAK,MAAA,CAAO,OAAO,CAAA,EAAA,CAAA,EAAM,EAAE,KAAA,EAAO,GAAA,EAAK,CAAA;AAAA,MAC3F;AACA,MAAA,MAAM,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC9D,MAAA,MAAM,IAAI,aAAa,CAAA,mCAAA,EAAsC,MAAM,IAAI,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,IACvF,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAEA,IAAA,IAAI,OAAA;AACJ,IAAA,MAAM,WAAA,GAAc,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AAC5D,IAAA,IAAI,WAAA,CAAY,QAAA,CAAS,kBAAkB,CAAA,EAAG;AAC5C,MAAA,OAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAAA,IAClD,CAAA,MAAO;AACL,MAAA,OAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAAA,IAClD;AAEA,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,OAAA,GAAW,WAAW,EAAC;AAC7B,MAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,KAAA,IAAS,EAAC;AACpC,MAAA,MAAM,IAAI,eAAA;AAAA,QACR,QAAA,CAAS,MAAA;AAAA,QACT,SAAA,CAAU,IAAA,IAAQ,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA;AAAA,QACxC,SAAA,CAAU,OAAA,IAAW,OAAA,CAAQ,OAAA,IAAW,gBAAA;AAAA,QACxC,UAAU,OAAA,IAAW,EAAA;AAAA,QACrB,SAAA,CAAU,SAAA,IAAA,iBAAa,IAAI,IAAA,IAAO,WAAA;AAAY,OAChD;AAAA,IACF;AAEA,IAAA,OAAQ,iBAAA,CAAkB,OAAO,CAAA,GAAI,OAAA,CAAQ,IAAA,GAAO,OAAA;AAAA,EACtD;AAAA,EAEA,GAAA,CAAO,MAAc,KAAA,EAAkF;AACrG,IAAA,OAAO,KAAK,OAAA,CAAW,KAAA,EAAO,IAAA,EAAM,EAAE,OAAO,CAAA;AAAA,EAC/C;AAAA,EAEA,IAAA,CAAQ,MAAc,IAAA,EAA4B;AAChD,IAAA,OAAO,KAAK,OAAA,CAAW,MAAA,EAAQ,IAAA,EAAM,EAAE,MAAM,CAAA;AAAA,EAC/C;AAAA,EAEA,KAAA,CAAS,MAAc,IAAA,EAA4B;AACjD,IAAA,OAAO,KAAK,OAAA,CAAW,OAAA,EAAS,IAAA,EAAM,EAAE,MAAM,CAAA;AAAA,EAChD;AAAA,EAEA,OAAU,IAAA,EAA0B;AAClC,IAAA,OAAO,IAAA,CAAK,OAAA,CAAW,QAAA,EAAU,IAAI,CAAA;AAAA,EACvC;AACF,CAAA;;;ACpIO,IAAM,uBAAN,MAA2B;AAAA,EAChC,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA,EAEhD,MAAA,CAAO,QAAiC,IAAA,EAA6C;AACnF,IAAA,MAAM,IAAA,GAAO,MAAM,cAAA,GACf,EAAE,GAAG,MAAA,EAAQ,cAAA,EAAgB,IAAA,CAAK,cAAA,EAAe,GACjD,MAAA;AACJ,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAkB,eAAA,EAAiB,IAAI,CAAA;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,KAAK,MAAA,EAAyD;AAC5D,IAAA,MAAM,EAAE,UAAA,EAAY,GAAG,IAAA,EAAK,GAAI,UAAU,EAAC;AAC3C,IAAA,MAAM,IAAA,GAAO,UAAA,GAAa,CAAA,uBAAA,EAA0B,UAAU,CAAA,CAAA,GAAK,eAAA;AACnE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAmB,IAAA,EAAM,IAAmD,CAAA;AAAA,EAC/F;AAAA,EAEA,SAAS,EAAA,EAAkC;AACzC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAiB,CAAA,cAAA,EAAiB,EAAE,CAAA,CAAE,CAAA;AAAA,EACzD;AAAA,EAEA,YAAY,EAAA,EAAyC;AACnD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAwB,CAAA,cAAA,EAAiB,EAAE,CAAA,QAAA,CAAU,CAAA;AAAA,EACxE;AACF,CAAA;;;AC7BO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA,EAEhD,SAAS,MAAA,EAAiD;AACxD,IAAA,MAAM,EAAE,cAAA,EAAgB,GAAG,IAAA,EAAK,GAAI,MAAA;AACpC,IAAA,MAAM,OAAO,cAAA,GAAiB,EAAE,GAAG,IAAA,EAAM,gBAAe,GAAI,IAAA;AAC5D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAc,WAAA,EAAa,IAAI,CAAA;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,KAAK,MAAA,EAAiD;AACpD,IAAA,MAAM,EAAE,UAAA,EAAY,GAAG,IAAA,EAAK,GAAI,UAAU,EAAC;AAC3C,IAAA,MAAM,IAAA,GAAO,UAAA,GAAa,CAAA,mBAAA,EAAsB,UAAU,CAAA,CAAA,GAAK,WAAA;AAC/D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAe,IAAA,EAAM,IAAmD,CAAA;AAAA,EAC3F;AAAA,EAEA,SAAS,EAAA,EAA8B;AACrC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAa,CAAA,UAAA,EAAa,EAAE,CAAA,CAAE,CAAA;AAAA,EACjD;AAAA,EAEA,OAAO,EAAA,EAA8B;AACnC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAc,CAAA,UAAA,EAAa,EAAE,CAAA,OAAA,CAAS,CAAA;AAAA,EACzD;AAAA,EAEA,MAAM,EAAA,EAA8B;AAClC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAc,CAAA,UAAA,EAAa,EAAE,CAAA,MAAA,CAAQ,CAAA;AAAA,EACxD;AAAA,EAEA,aAAa,EAAA,EAAuC;AAClD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAsB,CAAA,UAAA,EAAa,EAAE,CAAA,SAAA,CAAW,CAAA;AAAA,EACnE;AACF,CAAA;;;AC/BO,IAAM,kBAAN,MAAsB;AAAA,EAC3B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA,EAEhD,MAAA,CAAO,QAA4B,IAAA,EAAwC;AACzE,IAAA,MAAM,IAAA,GAAO,MAAM,cAAA,GACf,EAAE,GAAG,MAAA,EAAQ,cAAA,EAAgB,IAAA,CAAK,cAAA,EAAe,GACjD,MAAA;AACJ,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAa,UAAA,EAAY,IAAI,CAAA;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,KAAK,MAAA,EAAyD;AAC5D,IAAA,MAAM,EAAE,UAAA,EAAY,GAAG,IAAA,EAAK,GAAI,UAAU,EAAC;AAC3C,IAAA,MAAM,IAAA,GAAO,UAAA,GAAa,CAAA,kBAAA,EAAqB,UAAU,CAAA,CAAA,GAAK,UAAA;AAC9D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAwB,IAAA,EAAM,IAAmD,CAAA;AAAA,EACpG;AAAA,EAEA,SAAS,EAAA,EAA6B;AACpC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAY,CAAA,SAAA,EAAY,EAAE,CAAA,CAAE,CAAA;AAAA,EAC/C;AAAA,EAEA,gBAAgB,EAAA,EAAoC;AAClD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAmB,CAAA,SAAA,EAAY,EAAE,CAAA,QAAA,CAAU,CAAA;AAAA,EAC9D;AAAA,EAEA,mBAAmB,EAAA,EAA+C;AAChE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAA8B,CAAA,SAAA,EAAY,EAAE,CAAA,WAAA,CAAa,CAAA;AAAA,EAC5E;AAAA,EAEA,OAAA,CAAQ,IAAY,MAAA,EAA+C;AACjE,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,YAAY,MAAM,CAAA;AAAA,EAChE;AAAA,EAEA,OAAO,EAAA,EAA6B;AAClC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,CAAA,OAAA,CAAS,CAAA;AAAA,EACvD;AAAA,EAEA,QAAQ,EAAA,EAA6B;AACnC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,CAAA,QAAA,CAAU,CAAA;AAAA,EACxD;AAAA,EAEA,OAAO,EAAA,EAA6B;AAClC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,CAAA,OAAA,CAAS,CAAA;AAAA,EACvD;AAAA,EAEA,eAAA,CAAgB,IAAY,MAAA,EAAiD;AAC3E,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,qBAAqB,MAAM,CAAA;AAAA,EACzE;AAAA,EAEA,YAAA,CAAa,IAAY,MAAA,EAA8C;AACrE,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAa,CAAA,SAAA,EAAY,EAAE,kBAAkB,MAAM,CAAA;AAAA,EACtE;AACF,CAAA;;;AC7DO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA,EAEhD,KAAK,MAAA,EAA6C;AAChD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAc,WAAA,EAAa,MAAM,CAAA;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,KAAK,MAAA,EAAiD;AACpD,IAAA,MAAM,EAAE,UAAA,EAAY,GAAG,IAAA,EAAK,GAAI,UAAU,EAAC;AAC3C,IAAA,MAAM,IAAA,GAAO,UAAA,GAAa,CAAA,mBAAA,EAAsB,UAAU,CAAA,CAAA,GAAK,WAAA;AAC/D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAe,IAAA,EAAM,IAAmD,CAAA;AAAA,EAC3F;AAAA,EAEA,SAAS,EAAA,EAA8B;AACrC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAa,CAAA,UAAA,EAAa,EAAE,CAAA,CAAE,CAAA;AAAA,EACjD;AAAA,EAEA,aAAa,EAAA,EAAiC;AAC5C,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAgB,CAAA,UAAA,EAAa,EAAE,CAAA,SAAA,CAAW,CAAA;AAAA,EAC7D;AAAA,EAEA,cAAA,CAAe,IAAY,MAAA,EAAiD;AAC1E,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAe,CAAA,UAAA,EAAa,EAAE,aAAa,MAAM,CAAA;AAAA,EACpE;AAAA,EAEA,OAAA,CAAQ,IAAY,MAAA,EAAgD;AAClE,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAc,CAAA,UAAA,EAAa,EAAE,YAAY,MAAM,CAAA;AAAA,EAClE;AAAA,EAEA,MAAA,CAAO,IAAY,MAAA,EAA+C;AAChE,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAc,CAAA,UAAA,EAAa,EAAE,WAAW,MAAM,CAAA;AAAA,EACjE;AACF,CAAA;AC5CO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAA6B,MAAA,EAAgB;AAAhB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiB9C,cAAA,CACE,OAAA,EACA,SAAA,EACA,SAAA,EACiB;AACjB,IAAA,IAAI,CAAC,KAAK,MAAA,EAAQ;AAChB,MAAA,MAAM,IAAI,YAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,OAAO,OAAO,OAAA,KAAY,WAAW,OAAA,GAAU,OAAA,CAAQ,SAAS,MAAM,CAAA;AAK5E,IAAA,MAAM,YAAA,GAAe,UAAU,UAAA,CAAW,SAAS,IAAI,SAAA,CAAU,KAAA,CAAM,SAAA,CAAU,MAAM,CAAA,GAAI,SAAA;AAE3F,IAAA,MAAM,QAAA,GAAW,UAAA,CAAW,QAAA,EAAU,IAAA,CAAK,MAAM,CAAA,CAC9C,MAAA,CAAO,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA,CAC7B,OAAO,KAAK,CAAA;AAEf,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI,WAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,MAAA,CAAO,IAAA,CAAK,YAAA,EAAc,KAAK,CAAA;AACxC,MAAA,WAAA,GAAc,MAAA,CAAO,IAAA,CAAK,QAAA,EAAU,KAAK,CAAA;AAAA,IAC3C,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,aAAa,0BAA0B,CAAA;AAAA,IACnD;AAEA,IAAA,IAAI,WAAA,CAAY,WAAW,MAAA,CAAO,MAAA,IAAU,CAAC,eAAA,CAAgB,WAAA,EAAa,MAAM,CAAA,EAAG;AACjF,MAAA,MAAM,IAAI,aAAa,uCAAuC,CAAA;AAAA,IAChE;AAEA,IAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB;AACF,CAAA;;;ACzCO,IAAM,gBAAN,MAAoB;AAAA,EAOzB,YAAY,MAAA,EAA6B;AACvC,IAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAClB,MAAA,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAAA,IACrD;AAEA,IAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW;AAAA,MAC1B,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf,OAAA,EAAS,OAAO,OAAA,IAAW,4BAAA;AAAA,MAC3B,OAAA,EAAS,OAAO,OAAA,IAAW;AAAA,KAC5B,CAAA;AAED,IAAA,IAAA,CAAK,YAAA,GAAe,IAAI,oBAAA,CAAqB,IAAI,CAAA;AACjD,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,gBAAA,CAAiB,IAAI,CAAA;AACzC,IAAA,IAAA,CAAK,OAAA,GAAU,IAAI,eAAA,CAAgB,IAAI,CAAA;AACvC,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,gBAAA,CAAiB,IAAI,CAAA;AACzC,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,gBAAA,CAAiB,MAAA,CAAO,iBAAiB,EAAE,CAAA;AAAA,EACjE;AACF","file":"index.mjs","sourcesContent":["export class PaybetaError extends Error {\n  constructor(message: string, options?: { cause?: unknown }) {\n    super(message, options?.cause !== undefined ? { cause: options.cause } : undefined);\n    this.name = 'PaybetaError';\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\nexport class PaybetaApiError extends PaybetaError {\n  readonly status: number;\n  readonly code: string;\n  readonly traceId: string;\n  readonly timestamp: string;\n\n  constructor(status: number, code: string, message: string, traceId: string, timestamp: string) {\n    super(message);\n    this.name = 'PaybetaApiError';\n    this.status = status;\n    this.code = code;\n    this.traceId = traceId;\n    this.timestamp = timestamp;\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n","import { PaybetaApiError, PaybetaError } from './errors.js';\n\nexport interface HttpClientConfig {\n  apiKey: string;\n  baseUrl: string;\n  timeout: number;\n}\n\ninterface ApiErrorBody {\n  error?: {\n    code?: string;\n    message?: string;\n    traceId?: string;\n    timestamp?: string;\n  };\n  message?: string;\n}\n\n// Every successful api-main response is wrapped by a global interceptor as\n// `{ status: 'success', data: <actual payload>, timestamp }` — checked by\n// shape (not just presence of `data`) so a legitimate resource that happens\n// to have its own `data`/`status` field is never mistaken for the envelope.\ninterface SuccessEnvelope {\n  status: 'success';\n  data: unknown;\n  timestamp: string;\n}\n\nfunction isSuccessEnvelope(payload: unknown): payload is SuccessEnvelope {\n  return (\n    typeof payload === 'object' &&\n    payload !== null &&\n    (payload as Record<string, unknown>).status === 'success' &&\n    'data' in payload &&\n    typeof (payload as Record<string, unknown>).timestamp === 'string'\n  );\n}\n\nexport class HttpClient {\n  constructor(private readonly config: HttpClientConfig) {}\n\n  async request<T>(\n    method: string,\n    path: string,\n    options?: {\n      body?: unknown;\n      query?: Record<string, string | number | boolean | undefined | null>;\n    },\n  ): Promise<T> {\n    // The public API is served behind api-gateway under a /v1 prefix — the\n    // gateway's route table only matches /v1/... and 404s anything else, so\n    // every request must go there regardless of how `path` is written by\n    // the resource classes below.\n    const url = new URL(`/v1${path}`, this.config.baseUrl);\n\n    if (options?.query) {\n      for (const [key, value] of Object.entries(options.query)) {\n        if (value !== undefined && value !== null) {\n          url.searchParams.set(key, String(value));\n        }\n      }\n    }\n\n    const headers: Record<string, string> = {\n      'X-API-Key': this.config.apiKey,\n      Accept: 'application/json',\n    };\n\n    let body: string | undefined;\n    if (options?.body !== undefined) {\n      headers['Content-Type'] = 'application/json';\n      body = JSON.stringify(options.body);\n    }\n\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.config.timeout);\n\n    let response: Response;\n    try {\n      response = await fetch(url.toString(), {\n        method,\n        headers,\n        body,\n        signal: controller.signal,\n      });\n    } catch (err) {\n      // Every failure that can come out of `fetch` itself — timeout, DNS\n      // failure, connection refused, TLS error, etc. — is normalized to\n      // PaybetaError here, not just AbortError. Previously only the\n      // timeout case was wrapped, so callers had to separately handle a\n      // raw, unwrapped TypeError/AggregateError from `fetch` for every\n      // other kind of network failure; PaybetaApiError is reserved for\n      // \"the API responded, and it was an error,\" which none of these\n      // are. The original error is preserved as `cause` for debugging.\n      if (err instanceof Error && err.name === 'AbortError') {\n        throw new PaybetaError(`Request timed out after ${this.config.timeout}ms`, { cause: err });\n      }\n      const detail = err instanceof Error ? err.message : String(err);\n      throw new PaybetaError(`Network request to PayBeta failed: ${detail}`, { cause: err });\n    } finally {\n      clearTimeout(timer);\n    }\n\n    let payload: unknown;\n    const contentType = response.headers.get('content-type') ?? '';\n    if (contentType.includes('application/json')) {\n      payload = await response.json().catch(() => null);\n    } else {\n      payload = await response.text().catch(() => null);\n    }\n\n    if (!response.ok) {\n      const errBody = (payload ?? {}) as ApiErrorBody;\n      const errDetail = errBody.error ?? {};\n      throw new PaybetaApiError(\n        response.status,\n        errDetail.code ?? String(response.status),\n        errDetail.message ?? errBody.message ?? 'Request failed',\n        errDetail.traceId ?? '',\n        errDetail.timestamp ?? new Date().toISOString(),\n      );\n    }\n\n    return (isSuccessEnvelope(payload) ? payload.data : payload) as T;\n  }\n\n  get<T>(path: string, query?: Record<string, string | number | boolean | undefined | null>): Promise<T> {\n    return this.request<T>('GET', path, { query });\n  }\n\n  post<T>(path: string, body?: unknown): Promise<T> {\n    return this.request<T>('POST', path, { body });\n  }\n\n  patch<T>(path: string, body?: unknown): Promise<T> {\n    return this.request<T>('PATCH', path, { body });\n  }\n\n  delete<T>(path: string): Promise<T> {\n    return this.request<T>('DELETE', path);\n  }\n}\n","import type { HttpClient } from '../http.js';\nimport type {\n  Transaction,\n  CreateTransactionParams,\n  ListTransactionsParams,\n  TransactionEvent,\n} from '../types/transactions.js';\nimport type { RequestOptions } from '../types/common.js';\n\nexport class TransactionsResource {\n  constructor(private readonly http: HttpClient) {}\n\n  create(params: CreateTransactionParams, opts?: RequestOptions): Promise<Transaction> {\n    const body = opts?.idempotencyKey\n      ? { ...params, idempotencyKey: opts.idempotencyKey }\n      : params;\n    return this.http.post<Transaction>('/transactions', body);\n  }\n\n  /**\n   * Lists transactions. The bare `/transactions` endpoint is platform-role\n   * only — an API-key (merchant) caller gets a 403 there — so passing\n   * `merchantId` routes to `/transactions/merchant/:merchantId` instead.\n   */\n  list(params?: ListTransactionsParams): Promise<Transaction[]> {\n    const { merchantId, ...rest } = params ?? {};\n    const path = merchantId ? `/transactions/merchant/${merchantId}` : '/transactions';\n    return this.http.get<Transaction[]>(path, rest as Record<string, string | number | undefined>);\n  }\n\n  retrieve(id: string): Promise<Transaction> {\n    return this.http.get<Transaction>(`/transactions/${id}`);\n  }\n\n  listHistory(id: string): Promise<TransactionEvent[]> {\n    return this.http.get<TransactionEvent[]>(`/transactions/${id}/history`);\n  }\n}\n","import type { HttpClient } from '../http.js';\nimport type {\n  Payment,\n  PaymentAttempt,\n  InitiatePaymentParams,\n  ListPaymentsParams,\n} from '../types/payments.js';\n\nexport class PaymentsResource {\n  constructor(private readonly http: HttpClient) {}\n\n  initiate(params: InitiatePaymentParams): Promise<Payment> {\n    const { idempotencyKey, ...rest } = params;\n    const body = idempotencyKey ? { ...rest, idempotencyKey } : rest;\n    return this.http.post<Payment>('/payments', body);\n  }\n\n  /**\n   * Lists payments. The bare `/payments` endpoint is platform-role only —\n   * an API-key (merchant) caller gets a 403 there — so passing `merchantId`\n   * (which every merchant API key call needs) routes to\n   * `/payments/merchant/:merchantId` instead, matching what the API\n   * actually allows a merchant credential to call.\n   */\n  list(params?: ListPaymentsParams): Promise<Payment[]> {\n    const { merchantId, ...rest } = params ?? {};\n    const path = merchantId ? `/payments/merchant/${merchantId}` : '/payments';\n    return this.http.get<Payment[]>(path, rest as Record<string, string | number | undefined>);\n  }\n\n  retrieve(id: string): Promise<Payment> {\n    return this.http.get<Payment>(`/payments/${id}`);\n  }\n\n  verify(id: string): Promise<Payment> {\n    return this.http.post<Payment>(`/payments/${id}/verify`);\n  }\n\n  retry(id: string): Promise<Payment> {\n    return this.http.post<Payment>(`/payments/${id}/retry`);\n  }\n\n  listAttempts(id: string): Promise<PaymentAttempt[]> {\n    return this.http.get<PaymentAttempt[]>(`/payments/${id}/attempts`);\n  }\n}\n","import type { HttpClient } from '../http.js';\nimport type {\n  Escrow,\n  EscrowBalance,\n  EscrowListResponse,\n  EscrowConditionsResponse,\n  CreateEscrowParams,\n  ListEscrowsParams,\n  ReleaseEscrowParams,\n  ConfirmDeliveryParams,\n  ConfirmBuyerParams,\n} from '../types/escrows.js';\nimport type { RequestOptions } from '../types/common.js';\n\nexport class EscrowsResource {\n  constructor(private readonly http: HttpClient) {}\n\n  create(params: CreateEscrowParams, opts?: RequestOptions): Promise<Escrow> {\n    const body = opts?.idempotencyKey\n      ? { ...params, idempotencyKey: opts.idempotencyKey }\n      : params;\n    return this.http.post<Escrow>('/escrows', body);\n  }\n\n  /**\n   * Lists escrows. The bare `/escrows` endpoint is platform-role only — an\n   * API-key (merchant) caller gets a 403 there — so passing `merchantId`\n   * routes to `/escrows/merchant/:merchantId` instead. Unlike\n   * payments/transactions/disputes, this returns a `{ escrows, total,\n   * limit, offset }` envelope rather than a bare array.\n   */\n  list(params?: ListEscrowsParams): Promise<EscrowListResponse> {\n    const { merchantId, ...rest } = params ?? {};\n    const path = merchantId ? `/escrows/merchant/${merchantId}` : '/escrows';\n    return this.http.get<EscrowListResponse>(path, rest as Record<string, string | number | undefined>);\n  }\n\n  retrieve(id: string): Promise<Escrow> {\n    return this.http.get<Escrow>(`/escrows/${id}`);\n  }\n\n  retrieveBalance(id: string): Promise<EscrowBalance> {\n    return this.http.get<EscrowBalance>(`/escrows/${id}/balance`);\n  }\n\n  retrieveConditions(id: string): Promise<EscrowConditionsResponse> {\n    return this.http.get<EscrowConditionsResponse>(`/escrows/${id}/conditions`);\n  }\n\n  release(id: string, params?: ReleaseEscrowParams): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/release`, params);\n  }\n\n  refund(id: string): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/refund`);\n  }\n\n  dispute(id: string): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/dispute`);\n  }\n\n  cancel(id: string): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/cancel`);\n  }\n\n  confirmDelivery(id: string, params?: ConfirmDeliveryParams): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/confirm-delivery`, params);\n  }\n\n  confirmBuyer(id: string, params?: ConfirmBuyerParams): Promise<Escrow> {\n    return this.http.post<Escrow>(`/escrows/${id}/confirm-buyer`, params);\n  }\n}\n","import type { HttpClient } from '../http.js';\nimport type {\n  Dispute,\n  Evidence,\n  OpenDisputeParams,\n  ListDisputesParams,\n  UploadEvidenceParams,\n  ResolveDisputeParams,\n  CancelDisputeParams,\n} from '../types/disputes.js';\n\nexport class DisputesResource {\n  constructor(private readonly http: HttpClient) {}\n\n  open(params: OpenDisputeParams): Promise<Dispute> {\n    return this.http.post<Dispute>('/disputes', params);\n  }\n\n  /**\n   * Lists disputes. The bare `/disputes` endpoint is platform-role only —\n   * an API-key (merchant) caller gets a 403 there — so passing\n   * `merchantId` routes to `/disputes/merchant/:merchantId` instead.\n   */\n  list(params?: ListDisputesParams): Promise<Dispute[]> {\n    const { merchantId, ...rest } = params ?? {};\n    const path = merchantId ? `/disputes/merchant/${merchantId}` : '/disputes';\n    return this.http.get<Dispute[]>(path, rest as Record<string, string | number | undefined>);\n  }\n\n  retrieve(id: string): Promise<Dispute> {\n    return this.http.get<Dispute>(`/disputes/${id}`);\n  }\n\n  listEvidence(id: string): Promise<Evidence[]> {\n    return this.http.get<Evidence[]>(`/disputes/${id}/evidence`);\n  }\n\n  uploadEvidence(id: string, params: UploadEvidenceParams): Promise<Evidence> {\n    return this.http.post<Evidence>(`/disputes/${id}/evidence`, params);\n  }\n\n  resolve(id: string, params: ResolveDisputeParams): Promise<Dispute> {\n    return this.http.post<Dispute>(`/disputes/${id}/resolve`, params);\n  }\n\n  cancel(id: string, params: CancelDisputeParams): Promise<Dispute> {\n    return this.http.post<Dispute>(`/disputes/${id}/cancel`, params);\n  }\n}\n","import { createHmac, timingSafeEqual } from 'crypto';\nimport { PaybetaError } from '../errors.js';\nimport type { WebhookEvent } from '../types/webhooks.js';\n\nexport class WebhooksResource {\n  constructor(private readonly secret: string) {}\n\n  /**\n   * Verifies the signature on an incoming webhook and parses the payload.\n   *\n   * PayBeta signs the concatenation of the delivery timestamp and the raw\n   * request body — `HMAC-SHA256(secret, \"${timestamp}.${rawBody}\")` — and\n   * sends the result hex-encoded, prefixed with `sha256=`, in the\n   * `X-PayBeta-Signature` header (see OutboundWebhookService). The\n   * timestamp itself arrives separately in `X-PayBeta-Timestamp`, so both\n   * headers are required here, not just the signature.\n   *\n   * Pass the raw request body (before JSON parsing), the value of the\n   * `X-PayBeta-Signature` header, and the value of the `X-PayBeta-Timestamp`\n   * header. Throws `PaybetaError` if the signature is invalid or the\n   * secret was not configured.\n   */\n  constructEvent<T = unknown>(\n    rawBody: string | Buffer,\n    signature: string,\n    timestamp: string,\n  ): WebhookEvent<T> {\n    if (!this.secret) {\n      throw new PaybetaError(\n        'webhookSecret must be set on PaybetaClient to verify webhook signatures',\n      );\n    }\n\n    const body = typeof rawBody === 'string' ? rawBody : rawBody.toString('utf8');\n\n    // Accept the header verbatim (`sha256=<hex>`) or a bare hex digest, so\n    // callers who've already stripped the prefix don't get a confusing\n    // \"invalid signature format\" error.\n    const hexSignature = signature.startsWith('sha256=') ? signature.slice('sha256='.length) : signature;\n\n    const expected = createHmac('sha256', this.secret)\n      .update(`${timestamp}.${body}`)\n      .digest('hex');\n\n    let actual: Buffer;\n    let expectedBuf: Buffer;\n    try {\n      actual = Buffer.from(hexSignature, 'hex');\n      expectedBuf = Buffer.from(expected, 'hex');\n    } catch {\n      throw new PaybetaError('Invalid signature format');\n    }\n\n    if (expectedBuf.length !== actual.length || !timingSafeEqual(expectedBuf, actual)) {\n      throw new PaybetaError('Webhook signature verification failed');\n    }\n\n    return JSON.parse(body) as WebhookEvent<T>;\n  }\n}\n","import { HttpClient } from './http.js';\nimport { TransactionsResource } from './resources/transactions.js';\nimport { PaymentsResource } from './resources/payments.js';\nimport { EscrowsResource } from './resources/escrows.js';\nimport { DisputesResource } from './resources/disputes.js';\nimport { WebhooksResource } from './resources/webhooks.js';\n\nexport interface PaybetaClientConfig {\n  /** API key obtained from the Paybeta dashboard (pb_live_* or pb_test_*) */\n  apiKey: string;\n  /** Override the default API base URL. Defaults to https://api.usepaybeta.com */\n  baseUrl?: string;\n  /** Webhook signing secret used to verify incoming webhook payloads */\n  webhookSecret?: string;\n  /** Request timeout in milliseconds. Defaults to 30000 */\n  timeout?: number;\n}\n\nexport class PaybetaClient {\n  readonly transactions: TransactionsResource;\n  readonly payments: PaymentsResource;\n  readonly escrows: EscrowsResource;\n  readonly disputes: DisputesResource;\n  readonly webhooks: WebhooksResource;\n\n  constructor(config: PaybetaClientConfig) {\n    if (!config.apiKey) {\n      throw new Error('PaybetaClient: apiKey is required');\n    }\n\n    const http = new HttpClient({\n      apiKey: config.apiKey,\n      baseUrl: config.baseUrl ?? 'https://api.usepaybeta.com',\n      timeout: config.timeout ?? 30_000,\n    });\n\n    this.transactions = new TransactionsResource(http);\n    this.payments = new PaymentsResource(http);\n    this.escrows = new EscrowsResource(http);\n    this.disputes = new DisputesResource(http);\n    this.webhooks = new WebhooksResource(config.webhookSecret ?? '');\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paybetaby/node-sdk",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Official Node.js SDK for the Paybeta payments API",
   "repository": {
     "type": "git",