@takeal/cusfront-sdk 0.1.0

package/dist/resources/auth.d.ts

@@ -0,0 +1,132 @@
+import { H as HttpClient, T as TokenStore } from '../http-BkZZZI8K.js';
+
+/**
+ * Auth resource — `client.auth.*`.
+ *
+ * Covers the end-user-facing staged auth flow: password login
+ * with optional TOTP/OTP step-up. The shape mirrors the responses
+ * the Takeal API returns from `/auth/login`, `/auth/login/totp`,
+ * `/auth/login/otp/verify`, `/auth/login/2fa/switch`, and `/auth/me`.
+ *
+ * The login methods stash the JWT in the configured `TokenStore` on
+ * success so subsequent `client.*` calls authenticate automatically.
+ * Step-up responses (TotpRequired / OtpSent) carry their own short-
+ * lived challenge token which the caller passes to the next method
+ * — those tokens DO NOT go through the TokenStore (they're not the
+ * end-state JWT).
+ */
+interface User {
+    id: string;
+    email: string;
+    role: string;
+    is_active: boolean;
+    /** True for users auto-provisioned via the Telegram Mini App who still hold
+     *  a synthetic placeholder email. The client should prompt for a real email
+     *  and attach it via `auth.linkEmail` — this flips the flag to false. */
+    email_pending?: boolean;
+    created_at: string;
+    updated_at: string;
+}
+interface LoginInput {
+    email: string;
+    password: string;
+}
+/** Discriminated union — `stage` is the discriminator. */
+type LoginResponse = JwtIssued | TotpRequired | TotpSetupRequired;
+interface JwtIssued {
+    stage: "jwt";
+    access_token: string;
+    expires_at: string;
+    user: User;
+    /** True iff the user's role grants `system.view_hub`.
+     *  Cusfront ignores this; the operator console uses it to gate `/dashboard`. */
+    hub_access?: boolean;
+}
+interface TotpRequired {
+    stage: "totp_required";
+    challenge_token: string;
+    expires_at: string;
+    /** Alternate second factors. Pick one with `/2fa/switch`. */
+    available_methods: AvailableMethod[];
+}
+interface TotpSetupRequired {
+    stage: "totp_setup_required";
+    challenge_token: string;
+    expires_at: string;
+    /** OTPAuth URI rendered as a QR by the consumer. */
+    otpauth_url: string;
+    /** Same secret base32-encoded — for manual entry alongside QR. */
+    secret_base32: string;
+}
+interface AvailableMethod {
+    kind: "totp" | "telegram_otp" | "email_otp";
+    /** Short user-facing hint, e.g. `"Telegram (@user)"` or `"e****@example.com"`. */
+    hint?: string;
+}
+interface TotpVerifyInput {
+    challenge_token: string;
+    /** 6-digit TOTP code OR `XXXX-XXXX` backup code. */
+    code: string;
+}
+interface OtpVerifyInput {
+    challenge_token: string;
+    /** 6-digit one-time code delivered via the selected channel. */
+    code: string;
+}
+interface SwitchMethodInput {
+    challenge_token: string;
+    method: AvailableMethod["kind"];
+}
+interface OtpSentResponse {
+    stage: "otp_sent";
+    challenge_token: string;
+    expires_at: string;
+    method: AvailableMethod["kind"];
+    hint?: string;
+    available_methods: AvailableMethod[];
+}
+declare class AuthResource {
+    private readonly http;
+    private readonly tokens;
+    constructor(http: HttpClient, tokens: TokenStore);
+    /** Password-auth entry. May resolve to a JWT, or to a step-up
+     *  challenge that needs `verifyTotp` / `verifyOtp` next. */
+    login(input: LoginInput): Promise<LoginResponse>;
+    /** Verify a TOTP code (or XXXX-XXXX backup code) against a
+     *  `totp_required` challenge. On success the JWT is stored. */
+    verifyTotp(input: TotpVerifyInput): Promise<JwtIssued>;
+    /** Verify a 6-digit OTP code (Telegram / email) against an
+     *  `otp_sent` challenge. */
+    verifyOtp(input: OtpVerifyInput): Promise<JwtIssued>;
+    /** Swap the 2FA method mid-flow. Resolves to `otp_sent` for
+     *  telegram/email; for TOTP it short-circuits back to the challenge. */
+    switchMethod(input: SwitchMethodInput): Promise<OtpSentResponse>;
+    /** Exchange a signed Telegram Mini App `initData` payload for a session
+     *  JWT. The server validates the initData HMAC against the deployment's bot
+     *  token, then find-or-creates the end-user. First-time Telegram users are
+     *  auto-provisioned with `user.email_pending === true` — prompt them for a
+     *  real email and call {@link linkEmail}. Stores the JWT on success.
+     *
+     *  Most consumers use the higher-level `fromInitData` / `fromTelegramWebApp`
+     *  helpers in `@takeal/cusfront-sdk/telegram`; reach for this directly when
+     *  you already hold a configured client. */
+    exchangeTelegram(input: {
+        initData: string;
+    }): Promise<JwtIssued>;
+    /** Attach a real email to the current user (and clear `email_pending`).
+     *  Used after a Telegram exchange to satisfy the email requirement; also
+     *  works for a password user changing their address. 409 if taken. */
+    linkEmail(input: {
+        email: string;
+    }): Promise<User>;
+    /** Current user — fails 401 when the stored JWT is expired or
+     *  missing. Useful as a "do I have a session" probe on app boot. */
+    me(): Promise<User>;
+    /** Local sign-out. The SDK doesn't currently call a server-side
+     *  endpoint (the Takeal API issues stateless JWTs); clearing the
+     *  store is enough. Server-side session invalidation may land
+     *  with a future session table. */
+    signOut(): Promise<void>;
+}
+
+export { AuthResource, type AvailableMethod, type JwtIssued, type LoginInput, type LoginResponse, type OtpSentResponse, type OtpVerifyInput, type SwitchMethodInput, type TotpRequired, type TotpSetupRequired, type TotpVerifyInput, type User };

package/dist/resources/auth.js

@@ -0,0 +1,86 @@
+// src/resources/auth.ts
+var AuthResource = class {
+  constructor(http, tokens) {
+    this.http = http;
+    this.tokens = tokens;
+  }
+  /** Password-auth entry. May resolve to a JWT, or to a step-up
+   *  challenge that needs `verifyTotp` / `verifyOtp` next. */
+  async login(input) {
+    const resp = await this.http.post("/auth/login", {
+      body: input,
+      skipAuth: true
+    });
+    if (resp.stage === "jwt") {
+      await Promise.resolve(this.tokens.set(resp.access_token));
+    }
+    return resp;
+  }
+  /** Verify a TOTP code (or XXXX-XXXX backup code) against a
+   *  `totp_required` challenge. On success the JWT is stored. */
+  async verifyTotp(input) {
+    const resp = await this.http.post("/auth/login/totp", {
+      body: input,
+      skipAuth: true
+    });
+    await Promise.resolve(this.tokens.set(resp.access_token));
+    return resp;
+  }
+  /** Verify a 6-digit OTP code (Telegram / email) against an
+   *  `otp_sent` challenge. */
+  async verifyOtp(input) {
+    const resp = await this.http.post("/auth/login/otp/verify", {
+      body: input,
+      skipAuth: true
+    });
+    await Promise.resolve(this.tokens.set(resp.access_token));
+    return resp;
+  }
+  /** Swap the 2FA method mid-flow. Resolves to `otp_sent` for
+   *  telegram/email; for TOTP it short-circuits back to the challenge. */
+  async switchMethod(input) {
+    return this.http.post("/auth/login/2fa/switch", {
+      body: input,
+      skipAuth: true
+    });
+  }
+  /** Exchange a signed Telegram Mini App `initData` payload for a session
+   *  JWT. The server validates the initData HMAC against the deployment's bot
+   *  token, then find-or-creates the end-user. First-time Telegram users are
+   *  auto-provisioned with `user.email_pending === true` — prompt them for a
+   *  real email and call {@link linkEmail}. Stores the JWT on success.
+   *
+   *  Most consumers use the higher-level `fromInitData` / `fromTelegramWebApp`
+   *  helpers in `@takeal/cusfront-sdk/telegram`; reach for this directly when
+   *  you already hold a configured client. */
+  async exchangeTelegram(input) {
+    const resp = await this.http.post("/auth/telegram/exchange", {
+      body: { init_data: input.initData },
+      skipAuth: true
+    });
+    await Promise.resolve(this.tokens.set(resp.access_token));
+    return resp;
+  }
+  /** Attach a real email to the current user (and clear `email_pending`).
+   *  Used after a Telegram exchange to satisfy the email requirement; also
+   *  works for a password user changing their address. 409 if taken. */
+  async linkEmail(input) {
+    return this.http.post("/me/email", { body: { email: input.email } });
+  }
+  /** Current user — fails 401 when the stored JWT is expired or
+   *  missing. Useful as a "do I have a session" probe on app boot. */
+  async me() {
+    return this.http.get("/auth/me");
+  }
+  /** Local sign-out. The SDK doesn't currently call a server-side
+   *  endpoint (the Takeal API issues stateless JWTs); clearing the
+   *  store is enough. Server-side session invalidation may land
+   *  with a future session table. */
+  async signOut() {
+    await Promise.resolve(this.tokens.clear());
+  }
+};
+
+export { AuthResource };
+//# sourceMappingURL=auth.js.map
+//# sourceMappingURL=auth.js.map

package/dist/resources/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/resources/auth.ts"],"names":[],"mappings":";AAoGO,IAAM,eAAN,MAAmB;AAAA,EACxB,WAAA,CACmB,MACA,MAAA,EACjB;AAFiB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAChB;AAAA;AAAA;AAAA,EAIH,MAAM,MAAM,KAAA,EAA2C;AACrD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,KAAoB,aAAA,EAAe;AAAA,MAC9D,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,IAAI,IAAA,CAAK,UAAU,KAAA,EAAO;AACxB,MAAA,MAAM,QAAQ,OAAA,CAAQ,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,YAAY,CAAC,CAAA;AAAA,IAC1D;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA,EAIA,MAAM,WAAW,KAAA,EAA4C;AAC3D,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,KAAgB,kBAAA,EAAoB;AAAA,MAC/D,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,MAAM,QAAQ,OAAA,CAAQ,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,YAAY,CAAC,CAAA;AACxD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA,EAIA,MAAM,UAAU,KAAA,EAA2C;AACzD,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,KAAgB,wBAAA,EAA0B;AAAA,MACrE,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,MAAM,QAAQ,OAAA,CAAQ,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,YAAY,CAAC,CAAA;AACxD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA,EAIA,MAAM,aAAa,KAAA,EAAoD;AACrE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAsB,wBAAA,EAA0B;AAAA,MAC/D,IAAA,EAAM,KAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACX,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,iBAAiB,KAAA,EAAiD;AACtE,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAK,KAAgB,yBAAA,EAA2B;AAAA,MACtE,IAAA,EAAM,EAAE,SAAA,EAAW,KAAA,CAAM,QAAA,EAAS;AAAA,MAClC,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,MAAM,QAAQ,OAAA,CAAQ,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA,CAAK,YAAY,CAAC,CAAA;AACxD,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,KAAA,EAAyC;AACvD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAW,WAAA,EAAa,EAAE,IAAA,EAAM,EAAE,KAAA,EAAO,KAAA,CAAM,KAAA,EAAM,EAAG,CAAA;AAAA,EAC3E;AAAA;AAAA;AAAA,EAIA,MAAM,EAAA,GAAoB;AACxB,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAU,UAAU,CAAA;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAA,GAAyB;AAC7B,IAAA,MAAM,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,OAAO,CAAA;AAAA,EAC3C;AACF","file":"auth.js","sourcesContent":["import type { HttpClient } from \"../http.js\";\nimport type { TokenStore } from \"../token-store.js\";\n\n/**\n * Auth resource — `client.auth.*`.\n *\n * Covers the end-user-facing staged auth flow: password login\n * with optional TOTP/OTP step-up. The shape mirrors the responses\n * the Takeal API returns from `/auth/login`, `/auth/login/totp`,\n * `/auth/login/otp/verify`, `/auth/login/2fa/switch`, and `/auth/me`.\n *\n * The login methods stash the JWT in the configured `TokenStore` on\n * success so subsequent `client.*` calls authenticate automatically.\n * Step-up responses (TotpRequired / OtpSent) carry their own short-\n * lived challenge token which the caller passes to the next method\n * — those tokens DO NOT go through the TokenStore (they're not the\n * end-state JWT).\n */\n\nexport interface User {\n  id: string;\n  email: string;\n  role: string;\n  is_active: boolean;\n  /** True for users auto-provisioned via the Telegram Mini App who still hold\n   *  a synthetic placeholder email. The client should prompt for a real email\n   *  and attach it via `auth.linkEmail` — this flips the flag to false. */\n  email_pending?: boolean;\n  created_at: string;\n  updated_at: string;\n}\n\nexport interface LoginInput {\n  email: string;\n  password: string;\n}\n\n/** Discriminated union — `stage` is the discriminator. */\nexport type LoginResponse = JwtIssued | TotpRequired | TotpSetupRequired;\n\nexport interface JwtIssued {\n  stage: \"jwt\";\n  access_token: string;\n  expires_at: string;\n  user: User;\n  /** True iff the user's role grants `system.view_hub`.\n   *  Cusfront ignores this; the operator console uses it to gate `/dashboard`. */\n  hub_access?: boolean;\n}\n\nexport interface TotpRequired {\n  stage: \"totp_required\";\n  challenge_token: string;\n  expires_at: string;\n  /** Alternate second factors. Pick one with `/2fa/switch`. */\n  available_methods: AvailableMethod[];\n}\n\nexport interface TotpSetupRequired {\n  stage: \"totp_setup_required\";\n  challenge_token: string;\n  expires_at: string;\n  /** OTPAuth URI rendered as a QR by the consumer. */\n  otpauth_url: string;\n  /** Same secret base32-encoded — for manual entry alongside QR. */\n  secret_base32: string;\n}\n\nexport interface AvailableMethod {\n  kind: \"totp\" | \"telegram_otp\" | \"email_otp\";\n  /** Short user-facing hint, e.g. `\"Telegram (@user)\"` or `\"e****@example.com\"`. */\n  hint?: string;\n}\n\nexport interface TotpVerifyInput {\n  challenge_token: string;\n  /** 6-digit TOTP code OR `XXXX-XXXX` backup code. */\n  code: string;\n}\n\nexport interface OtpVerifyInput {\n  challenge_token: string;\n  /** 6-digit one-time code delivered via the selected channel. */\n  code: string;\n}\n\nexport interface SwitchMethodInput {\n  challenge_token: string;\n  method: AvailableMethod[\"kind\"];\n}\n\nexport interface OtpSentResponse {\n  stage: \"otp_sent\";\n  challenge_token: string;\n  expires_at: string;\n  method: AvailableMethod[\"kind\"];\n  hint?: string;\n  available_methods: AvailableMethod[];\n}\n\nexport class AuthResource {\n  constructor(\n    private readonly http: HttpClient,\n    private readonly tokens: TokenStore,\n  ) {}\n\n  /** Password-auth entry. May resolve to a JWT, or to a step-up\n   *  challenge that needs `verifyTotp` / `verifyOtp` next. */\n  async login(input: LoginInput): Promise<LoginResponse> {\n    const resp = await this.http.post<LoginResponse>(\"/auth/login\", {\n      body: input,\n      skipAuth: true,\n    });\n    if (resp.stage === \"jwt\") {\n      await Promise.resolve(this.tokens.set(resp.access_token));\n    }\n    return resp;\n  }\n\n  /** Verify a TOTP code (or XXXX-XXXX backup code) against a\n   *  `totp_required` challenge. On success the JWT is stored. */\n  async verifyTotp(input: TotpVerifyInput): Promise<JwtIssued> {\n    const resp = await this.http.post<JwtIssued>(\"/auth/login/totp\", {\n      body: input,\n      skipAuth: true,\n    });\n    await Promise.resolve(this.tokens.set(resp.access_token));\n    return resp;\n  }\n\n  /** Verify a 6-digit OTP code (Telegram / email) against an\n   *  `otp_sent` challenge. */\n  async verifyOtp(input: OtpVerifyInput): Promise<JwtIssued> {\n    const resp = await this.http.post<JwtIssued>(\"/auth/login/otp/verify\", {\n      body: input,\n      skipAuth: true,\n    });\n    await Promise.resolve(this.tokens.set(resp.access_token));\n    return resp;\n  }\n\n  /** Swap the 2FA method mid-flow. Resolves to `otp_sent` for\n   *  telegram/email; for TOTP it short-circuits back to the challenge. */\n  async switchMethod(input: SwitchMethodInput): Promise<OtpSentResponse> {\n    return this.http.post<OtpSentResponse>(\"/auth/login/2fa/switch\", {\n      body: input,\n      skipAuth: true,\n    });\n  }\n\n  /** Exchange a signed Telegram Mini App `initData` payload for a session\n   *  JWT. The server validates the initData HMAC against the deployment's bot\n   *  token, then find-or-creates the end-user. First-time Telegram users are\n   *  auto-provisioned with `user.email_pending === true` — prompt them for a\n   *  real email and call {@link linkEmail}. Stores the JWT on success.\n   *\n   *  Most consumers use the higher-level `fromInitData` / `fromTelegramWebApp`\n   *  helpers in `@takeal/cusfront-sdk/telegram`; reach for this directly when\n   *  you already hold a configured client. */\n  async exchangeTelegram(input: { initData: string }): Promise<JwtIssued> {\n    const resp = await this.http.post<JwtIssued>(\"/auth/telegram/exchange\", {\n      body: { init_data: input.initData },\n      skipAuth: true,\n    });\n    await Promise.resolve(this.tokens.set(resp.access_token));\n    return resp;\n  }\n\n  /** Attach a real email to the current user (and clear `email_pending`).\n   *  Used after a Telegram exchange to satisfy the email requirement; also\n   *  works for a password user changing their address. 409 if taken. */\n  async linkEmail(input: { email: string }): Promise<User> {\n    return this.http.post<User>(\"/me/email\", { body: { email: input.email } });\n  }\n\n  /** Current user — fails 401 when the stored JWT is expired or\n   *  missing. Useful as a \"do I have a session\" probe on app boot. */\n  async me(): Promise<User> {\n    return this.http.get<User>(\"/auth/me\");\n  }\n\n  /** Local sign-out. The SDK doesn't currently call a server-side\n   *  endpoint (the Takeal API issues stateless JWTs); clearing the\n   *  store is enough. Server-side session invalidation may land\n   *  with a future session table. */\n  async signOut(): Promise<void> {\n    await Promise.resolve(this.tokens.clear());\n  }\n}\n"]}

package/dist/resources/balance.cjs

@@ -0,0 +1,21 @@
+'use strict';
+
+// src/resources/balance.ts
+var BalanceResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /**
+   * Fetch the user's wallet balance for `currency` (ISO 4217, e.g. `"USD"`).
+   * Required — the ledger holds a separate balance per currency, so there is
+   * no "total" without one.
+   */
+  async get(currency) {
+    const q = new URLSearchParams({ currency }).toString();
+    return this.http.get(`/me/balance?${q}`);
+  }
+};
+
+exports.BalanceResource = BalanceResource;
+//# sourceMappingURL=balance.cjs.map
+//# sourceMappingURL=balance.cjs.map

package/dist/resources/balance.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/resources/balance.ts"],"names":[],"mappings":";;;AAiBO,IAAM,kBAAN,MAAsB;AAAA,EAC3B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOhD,MAAM,IAAI,QAAA,EAAoC;AAC5C,IAAA,MAAM,IAAI,IAAI,eAAA,CAAgB,EAAE,QAAA,EAAU,EAAE,QAAA,EAAS;AACrD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAa,CAAA,YAAA,EAAe,CAAC,CAAA,CAAE,CAAA;AAAA,EAClD;AACF","file":"balance.cjs","sourcesContent":["import type { HttpClient } from \"../http.js\";\n\n/**\n * Balance resource — `client.balance.*`.\n *\n * The user's wallet balance, tracked in the ledger. Mirrors\n * the Takeal API's `GET /me/balance?currency=<code>` route. Balance is per-currency:\n * the endpoint requires a `currency` query param and returns the amount held\n * in that currency.\n */\n\n/** Wallet balance for one currency. `amount` is a decimal string. */\nexport interface Balance {\n  amount: string;\n  currency: string;\n}\n\nexport class BalanceResource {\n  constructor(private readonly http: HttpClient) {}\n\n  /**\n   * Fetch the user's wallet balance for `currency` (ISO 4217, e.g. `\"USD\"`).\n   * Required — the ledger holds a separate balance per currency, so there is\n   * no \"total\" without one.\n   */\n  async get(currency: string): Promise<Balance> {\n    const q = new URLSearchParams({ currency }).toString();\n    return this.http.get<Balance>(`/me/balance?${q}`);\n  }\n}\n"]}

package/dist/resources/balance.d.cts

@@ -0,0 +1,27 @@
+import { H as HttpClient } from '../http-BkZZZI8K.cjs';
+
+/**
+ * Balance resource — `client.balance.*`.
+ *
+ * The user's wallet balance, tracked in the ledger. Mirrors
+ * the Takeal API's `GET /me/balance?currency=<code>` route. Balance is per-currency:
+ * the endpoint requires a `currency` query param and returns the amount held
+ * in that currency.
+ */
+/** Wallet balance for one currency. `amount` is a decimal string. */
+interface Balance {
+    amount: string;
+    currency: string;
+}
+declare class BalanceResource {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * Fetch the user's wallet balance for `currency` (ISO 4217, e.g. `"USD"`).
+     * Required — the ledger holds a separate balance per currency, so there is
+     * no "total" without one.
+     */
+    get(currency: string): Promise<Balance>;
+}
+
+export { type Balance, BalanceResource };

package/dist/resources/balance.d.ts

@@ -0,0 +1,27 @@
+import { H as HttpClient } from '../http-BkZZZI8K.js';
+
+/**
+ * Balance resource — `client.balance.*`.
+ *
+ * The user's wallet balance, tracked in the ledger. Mirrors
+ * the Takeal API's `GET /me/balance?currency=<code>` route. Balance is per-currency:
+ * the endpoint requires a `currency` query param and returns the amount held
+ * in that currency.
+ */
+/** Wallet balance for one currency. `amount` is a decimal string. */
+interface Balance {
+    amount: string;
+    currency: string;
+}
+declare class BalanceResource {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * Fetch the user's wallet balance for `currency` (ISO 4217, e.g. `"USD"`).
+     * Required — the ledger holds a separate balance per currency, so there is
+     * no "total" without one.
+     */
+    get(currency: string): Promise<Balance>;
+}
+
+export { type Balance, BalanceResource };

package/dist/resources/balance.js

@@ -0,0 +1,19 @@
+// src/resources/balance.ts
+var BalanceResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /**
+   * Fetch the user's wallet balance for `currency` (ISO 4217, e.g. `"USD"`).
+   * Required — the ledger holds a separate balance per currency, so there is
+   * no "total" without one.
+   */
+  async get(currency) {
+    const q = new URLSearchParams({ currency }).toString();
+    return this.http.get(`/me/balance?${q}`);
+  }
+};
+
+export { BalanceResource };
+//# sourceMappingURL=balance.js.map
+//# sourceMappingURL=balance.js.map

package/dist/resources/balance.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/resources/balance.ts"],"names":[],"mappings":";AAiBO,IAAM,kBAAN,MAAsB;AAAA,EAC3B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOhD,MAAM,IAAI,QAAA,EAAoC;AAC5C,IAAA,MAAM,IAAI,IAAI,eAAA,CAAgB,EAAE,QAAA,EAAU,EAAE,QAAA,EAAS;AACrD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAa,CAAA,YAAA,EAAe,CAAC,CAAA,CAAE,CAAA;AAAA,EAClD;AACF","file":"balance.js","sourcesContent":["import type { HttpClient } from \"../http.js\";\n\n/**\n * Balance resource — `client.balance.*`.\n *\n * The user's wallet balance, tracked in the ledger. Mirrors\n * the Takeal API's `GET /me/balance?currency=<code>` route. Balance is per-currency:\n * the endpoint requires a `currency` query param and returns the amount held\n * in that currency.\n */\n\n/** Wallet balance for one currency. `amount` is a decimal string. */\nexport interface Balance {\n  amount: string;\n  currency: string;\n}\n\nexport class BalanceResource {\n  constructor(private readonly http: HttpClient) {}\n\n  /**\n   * Fetch the user's wallet balance for `currency` (ISO 4217, e.g. `\"USD\"`).\n   * Required — the ledger holds a separate balance per currency, so there is\n   * no \"total\" without one.\n   */\n  async get(currency: string): Promise<Balance> {\n    const q = new URLSearchParams({ currency }).toString();\n    return this.http.get<Balance>(`/me/balance?${q}`);\n  }\n}\n"]}

package/dist/resources/blog.cjs

@@ -0,0 +1,39 @@
+'use strict';
+
+// src/resources/blog.ts
+var BlogResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /** Published posts, newest first. No authentication required. */
+  async list(input = {}) {
+    const q = new URLSearchParams();
+    if (input.page) q.set("page", String(input.page));
+    if (input.perPage) q.set("per_page", String(input.perPage));
+    if (input.tag) q.set("tag", input.tag);
+    if (input.locale) q.set("locale", input.locale);
+    const qs = q.toString();
+    return this.http.get(`/blog/posts${qs ? `?${qs}` : ""}`, {
+      skipAuth: true
+    });
+  }
+  /** One post by slug. No authentication required. */
+  async get(slug) {
+    return this.http.get(`/blog/posts/${encodeURIComponent(slug)}`, {
+      skipAuth: true
+    });
+  }
+  /**
+   * Absolute URL for an image path returned inside a post (`cover_url`, or an
+   * image block's `url`). Handy when the app renders on a different origin
+   * than the API.
+   */
+  imageUrl(baseUrl, path) {
+    if (/^https?:\/\//i.test(path)) return path;
+    return `${baseUrl.replace(/\/$/, "")}${path.startsWith("/") ? "" : "/"}${path}`;
+  }
+};
+
+exports.BlogResource = BlogResource;
+//# sourceMappingURL=blog.cjs.map
+//# sourceMappingURL=blog.cjs.map

package/dist/resources/blog.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/resources/blog.ts"],"names":[],"mappings":";;;AAmFO,IAAM,eAAN,MAAmB;AAAA,EACxB,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA;AAAA,EAGhD,MAAM,IAAA,CAAK,KAAA,GAAuB,EAAC,EAAsB;AACvD,IAAA,MAAM,CAAA,GAAI,IAAI,eAAA,EAAgB;AAC9B,IAAA,IAAI,KAAA,CAAM,MAAM,CAAA,CAAE,GAAA,CAAI,QAAQ,MAAA,CAAO,KAAA,CAAM,IAAI,CAAC,CAAA;AAChD,IAAA,IAAI,KAAA,CAAM,SAAS,CAAA,CAAE,GAAA,CAAI,YAAY,MAAA,CAAO,KAAA,CAAM,OAAO,CAAC,CAAA;AAC1D,IAAA,IAAI,MAAM,GAAA,EAAK,CAAA,CAAE,GAAA,CAAI,KAAA,EAAO,MAAM,GAAG,CAAA;AACrC,IAAA,IAAI,MAAM,MAAA,EAAQ,CAAA,CAAE,GAAA,CAAI,QAAA,EAAU,MAAM,MAAM,CAAA;AAC9C,IAAA,MAAM,EAAA,GAAK,EAAE,QAAA,EAAS;AACtB,IAAA,OAAO,IAAA,CAAK,KAAK,GAAA,CAAc,CAAA,WAAA,EAAc,KAAK,CAAA,CAAA,EAAI,EAAE,CAAA,CAAA,GAAK,EAAE,CAAA,CAAA,EAAI;AAAA,MACjE,QAAA,EAAU;AAAA,KACX,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,IAAI,IAAA,EAAiC;AACzC,IAAA,OAAO,KAAK,IAAA,CAAK,GAAA,CAAc,eAAe,kBAAA,CAAmB,IAAI,CAAC,CAAA,CAAA,EAAI;AAAA,MACxE,QAAA,EAAU;AAAA,KACX,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,QAAA,CAAS,SAAiB,IAAA,EAAsB;AAC9C,IAAA,IAAI,eAAA,CAAgB,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,IAAA;AACvC,IAAA,OAAO,CAAA,EAAG,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,EAAG,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAAI,EAAA,GAAK,GAAG,GAAG,IAAI,CAAA,CAAA;AAAA,EAC/E;AACF","file":"blog.cjs","sourcesContent":["import type { HttpClient } from \"../http.js\";\n\n/**\n * Blog resource — `client.blog.*`.\n *\n * Posts are public: these calls work before the user logs in, which is what\n * a marketing page or a Mini App landing screen needs.\n *\n * A post arrives as a **structured document**, not as HTML. `body_blocks` is\n * a flat list of typed nodes; map each `type` onto your own component and the\n * post inherits your site's styling. `body_markdown` is there too if you'd\n * rather run your own renderer.\n *\n * ```ts\n * const { posts } = await client.blog.list({ perPage: 5 });\n * const post = await client.blog.get(posts[0].slug);\n *\n * post.body_blocks.map((b) => {\n *   switch (b.type) {\n *     case \"heading\":   return <Heading level={b.level}>{b.text}</Heading>;\n *     case \"paragraph\": return <P>{b.text}</P>;\n *     case \"image\":     return <Figure src={b.url} alt={b.alt} caption={b.caption} />;\n *     case \"list\":      return <List ordered={b.ordered} items={b.items} />;\n *     case \"quote\":     return <Quote>{b.text}</Quote>;\n *     case \"code\":      return <Code lang={b.lang}>{b.text}</Code>;\n *     case \"divider\":   return <Hr />;\n *   }\n * });\n * ```\n *\n * Inline emphasis (`**bold**`, `[link](url)`) is left as Markdown inside\n * block text — every renderer already knows what to do with it.\n */\n\n/** One node of a post body. Discriminated on `type`. */\nexport type BlogBlock =\n  | { type: \"heading\"; level: number; text: string }\n  | { type: \"paragraph\"; text: string }\n  | { type: \"image\"; url: string; alt?: string; caption?: string }\n  | { type: \"list\"; ordered: boolean; items: string[] }\n  | { type: \"quote\"; text: string }\n  | { type: \"code\"; lang?: string; text: string }\n  | { type: \"divider\" };\n\nexport interface BlogPost {\n  /** Stable public key — link by this. */\n  slug: string;\n  title: string;\n  /** Teaser for cards; falls back to the first paragraph. */\n  excerpt: string;\n  /** Image URL, relative to the API origin. Absent when no cover is set. */\n  cover_url?: string;\n  /** Raw Markdown, for consumers that bring their own renderer. */\n  body_markdown: string;\n  /** The recommended input for rendering — see the module docs. */\n  body_blocks: BlogBlock[];\n  tags: string[];\n  /** Present only when the post declares one. */\n  locale?: string;\n  /** Rough read time in minutes (minimum 1). */\n  reading_minutes: number;\n  published_at: string | null;\n  updated_at: string;\n}\n\nexport interface BlogListInput {\n  /** 1-based. Default 1. */\n  page?: number;\n  /** 1..=50. Default 10. */\n  perPage?: number;\n  /** Only posts carrying this tag. */\n  tag?: string;\n  /** Only posts in this locale. */\n  locale?: string;\n}\n\nexport interface BlogList {\n  posts: BlogPost[];\n  total: number;\n  page: number;\n  per_page: number;\n}\n\nexport class BlogResource {\n  constructor(private readonly http: HttpClient) {}\n\n  /** Published posts, newest first. No authentication required. */\n  async list(input: BlogListInput = {}): Promise<BlogList> {\n    const q = new URLSearchParams();\n    if (input.page) q.set(\"page\", String(input.page));\n    if (input.perPage) q.set(\"per_page\", String(input.perPage));\n    if (input.tag) q.set(\"tag\", input.tag);\n    if (input.locale) q.set(\"locale\", input.locale);\n    const qs = q.toString();\n    return this.http.get<BlogList>(`/blog/posts${qs ? `?${qs}` : \"\"}`, {\n      skipAuth: true,\n    });\n  }\n\n  /** One post by slug. No authentication required. */\n  async get(slug: string): Promise<BlogPost> {\n    return this.http.get<BlogPost>(`/blog/posts/${encodeURIComponent(slug)}`, {\n      skipAuth: true,\n    });\n  }\n\n  /**\n   * Absolute URL for an image path returned inside a post (`cover_url`, or an\n   * image block's `url`). Handy when the app renders on a different origin\n   * than the API.\n   */\n  imageUrl(baseUrl: string, path: string): string {\n    if (/^https?:\\/\\//i.test(path)) return path;\n    return `${baseUrl.replace(/\\/$/, \"\")}${path.startsWith(\"/\") ? \"\" : \"/\"}${path}`;\n  }\n}\n"]}

package/dist/resources/blog.d.cts

@@ -0,0 +1,112 @@
+import { H as HttpClient } from '../http-BkZZZI8K.cjs';
+
+/**
+ * Blog resource — `client.blog.*`.
+ *
+ * Posts are public: these calls work before the user logs in, which is what
+ * a marketing page or a Mini App landing screen needs.
+ *
+ * A post arrives as a **structured document**, not as HTML. `body_blocks` is
+ * a flat list of typed nodes; map each `type` onto your own component and the
+ * post inherits your site's styling. `body_markdown` is there too if you'd
+ * rather run your own renderer.
+ *
+ * ```ts
+ * const { posts } = await client.blog.list({ perPage: 5 });
+ * const post = await client.blog.get(posts[0].slug);
+ *
+ * post.body_blocks.map((b) => {
+ *   switch (b.type) {
+ *     case "heading":   return <Heading level={b.level}>{b.text}</Heading>;
+ *     case "paragraph": return <P>{b.text}</P>;
+ *     case "image":     return <Figure src={b.url} alt={b.alt} caption={b.caption} />;
+ *     case "list":      return <List ordered={b.ordered} items={b.items} />;
+ *     case "quote":     return <Quote>{b.text}</Quote>;
+ *     case "code":      return <Code lang={b.lang}>{b.text}</Code>;
+ *     case "divider":   return <Hr />;
+ *   }
+ * });
+ * ```
+ *
+ * Inline emphasis (`**bold**`, `[link](url)`) is left as Markdown inside
+ * block text — every renderer already knows what to do with it.
+ */
+/** One node of a post body. Discriminated on `type`. */
+type BlogBlock = {
+    type: "heading";
+    level: number;
+    text: string;
+} | {
+    type: "paragraph";
+    text: string;
+} | {
+    type: "image";
+    url: string;
+    alt?: string;
+    caption?: string;
+} | {
+    type: "list";
+    ordered: boolean;
+    items: string[];
+} | {
+    type: "quote";
+    text: string;
+} | {
+    type: "code";
+    lang?: string;
+    text: string;
+} | {
+    type: "divider";
+};
+interface BlogPost {
+    /** Stable public key — link by this. */
+    slug: string;
+    title: string;
+    /** Teaser for cards; falls back to the first paragraph. */
+    excerpt: string;
+    /** Image URL, relative to the API origin. Absent when no cover is set. */
+    cover_url?: string;
+    /** Raw Markdown, for consumers that bring their own renderer. */
+    body_markdown: string;
+    /** The recommended input for rendering — see the module docs. */
+    body_blocks: BlogBlock[];
+    tags: string[];
+    /** Present only when the post declares one. */
+    locale?: string;
+    /** Rough read time in minutes (minimum 1). */
+    reading_minutes: number;
+    published_at: string | null;
+    updated_at: string;
+}
+interface BlogListInput {
+    /** 1-based. Default 1. */
+    page?: number;
+    /** 1..=50. Default 10. */
+    perPage?: number;
+    /** Only posts carrying this tag. */
+    tag?: string;
+    /** Only posts in this locale. */
+    locale?: string;
+}
+interface BlogList {
+    posts: BlogPost[];
+    total: number;
+    page: number;
+    per_page: number;
+}
+declare class BlogResource {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Published posts, newest first. No authentication required. */
+    list(input?: BlogListInput): Promise<BlogList>;
+    /** One post by slug. No authentication required. */
+    get(slug: string): Promise<BlogPost>;
+    /**
+     * Absolute URL for an image path returned inside a post (`cover_url`, or an
+     * image block's `url`). Handy when the app renders on a different origin
+     * than the API.
+     */
+    imageUrl(baseUrl: string, path: string): string;
+}
+
+export { type BlogBlock, type BlogList, type BlogListInput, type BlogPost, BlogResource };

package/dist/resources/blog.d.ts

@@ -0,0 +1,112 @@
+import { H as HttpClient } from '../http-BkZZZI8K.js';
+
+/**
+ * Blog resource — `client.blog.*`.
+ *
+ * Posts are public: these calls work before the user logs in, which is what
+ * a marketing page or a Mini App landing screen needs.
+ *
+ * A post arrives as a **structured document**, not as HTML. `body_blocks` is
+ * a flat list of typed nodes; map each `type` onto your own component and the
+ * post inherits your site's styling. `body_markdown` is there too if you'd
+ * rather run your own renderer.
+ *
+ * ```ts
+ * const { posts } = await client.blog.list({ perPage: 5 });
+ * const post = await client.blog.get(posts[0].slug);
+ *
+ * post.body_blocks.map((b) => {
+ *   switch (b.type) {
+ *     case "heading":   return <Heading level={b.level}>{b.text}</Heading>;
+ *     case "paragraph": return <P>{b.text}</P>;
+ *     case "image":     return <Figure src={b.url} alt={b.alt} caption={b.caption} />;
+ *     case "list":      return <List ordered={b.ordered} items={b.items} />;
+ *     case "quote":     return <Quote>{b.text}</Quote>;
+ *     case "code":      return <Code lang={b.lang}>{b.text}</Code>;
+ *     case "divider":   return <Hr />;
+ *   }
+ * });
+ * ```
+ *
+ * Inline emphasis (`**bold**`, `[link](url)`) is left as Markdown inside
+ * block text — every renderer already knows what to do with it.
+ */
+/** One node of a post body. Discriminated on `type`. */
+type BlogBlock = {
+    type: "heading";
+    level: number;
+    text: string;
+} | {
+    type: "paragraph";
+    text: string;
+} | {
+    type: "image";
+    url: string;
+    alt?: string;
+    caption?: string;
+} | {
+    type: "list";
+    ordered: boolean;
+    items: string[];
+} | {
+    type: "quote";
+    text: string;
+} | {
+    type: "code";
+    lang?: string;
+    text: string;
+} | {
+    type: "divider";
+};
+interface BlogPost {
+    /** Stable public key — link by this. */
+    slug: string;
+    title: string;
+    /** Teaser for cards; falls back to the first paragraph. */
+    excerpt: string;
+    /** Image URL, relative to the API origin. Absent when no cover is set. */
+    cover_url?: string;
+    /** Raw Markdown, for consumers that bring their own renderer. */
+    body_markdown: string;
+    /** The recommended input for rendering — see the module docs. */
+    body_blocks: BlogBlock[];
+    tags: string[];
+    /** Present only when the post declares one. */
+    locale?: string;
+    /** Rough read time in minutes (minimum 1). */
+    reading_minutes: number;
+    published_at: string | null;
+    updated_at: string;
+}
+interface BlogListInput {
+    /** 1-based. Default 1. */
+    page?: number;
+    /** 1..=50. Default 10. */
+    perPage?: number;
+    /** Only posts carrying this tag. */
+    tag?: string;
+    /** Only posts in this locale. */
+    locale?: string;
+}
+interface BlogList {
+    posts: BlogPost[];
+    total: number;
+    page: number;
+    per_page: number;
+}
+declare class BlogResource {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Published posts, newest first. No authentication required. */
+    list(input?: BlogListInput): Promise<BlogList>;
+    /** One post by slug. No authentication required. */
+    get(slug: string): Promise<BlogPost>;
+    /**
+     * Absolute URL for an image path returned inside a post (`cover_url`, or an
+     * image block's `url`). Handy when the app renders on a different origin
+     * than the API.
+     */
+    imageUrl(baseUrl: string, path: string): string;
+}
+
+export { type BlogBlock, type BlogList, type BlogListInput, type BlogPost, BlogResource };

package/dist/resources/blog.js

@@ -0,0 +1,37 @@
+// src/resources/blog.ts
+var BlogResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /** Published posts, newest first. No authentication required. */
+  async list(input = {}) {
+    const q = new URLSearchParams();
+    if (input.page) q.set("page", String(input.page));
+    if (input.perPage) q.set("per_page", String(input.perPage));
+    if (input.tag) q.set("tag", input.tag);
+    if (input.locale) q.set("locale", input.locale);
+    const qs = q.toString();
+    return this.http.get(`/blog/posts${qs ? `?${qs}` : ""}`, {
+      skipAuth: true
+    });
+  }
+  /** One post by slug. No authentication required. */
+  async get(slug) {
+    return this.http.get(`/blog/posts/${encodeURIComponent(slug)}`, {
+      skipAuth: true
+    });
+  }
+  /**
+   * Absolute URL for an image path returned inside a post (`cover_url`, or an
+   * image block's `url`). Handy when the app renders on a different origin
+   * than the API.
+   */
+  imageUrl(baseUrl, path) {
+    if (/^https?:\/\//i.test(path)) return path;
+    return `${baseUrl.replace(/\/$/, "")}${path.startsWith("/") ? "" : "/"}${path}`;
+  }
+};
+
+export { BlogResource };
+//# sourceMappingURL=blog.js.map
+//# sourceMappingURL=blog.js.map