@takeal/cusfront-sdk 0.1.0

package/dist/resources/blog.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/resources/blog.ts"],"names":[],"mappings":";AAmFO,IAAM,eAAN,MAAmB;AAAA,EACxB,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA;AAAA,EAGhD,MAAM,IAAA,CAAK,KAAA,GAAuB,EAAC,EAAsB;AACvD,IAAA,MAAM,CAAA,GAAI,IAAI,eAAA,EAAgB;AAC9B,IAAA,IAAI,KAAA,CAAM,MAAM,CAAA,CAAE,GAAA,CAAI,QAAQ,MAAA,CAAO,KAAA,CAAM,IAAI,CAAC,CAAA;AAChD,IAAA,IAAI,KAAA,CAAM,SAAS,CAAA,CAAE,GAAA,CAAI,YAAY,MAAA,CAAO,KAAA,CAAM,OAAO,CAAC,CAAA;AAC1D,IAAA,IAAI,MAAM,GAAA,EAAK,CAAA,CAAE,GAAA,CAAI,KAAA,EAAO,MAAM,GAAG,CAAA;AACrC,IAAA,IAAI,MAAM,MAAA,EAAQ,CAAA,CAAE,GAAA,CAAI,QAAA,EAAU,MAAM,MAAM,CAAA;AAC9C,IAAA,MAAM,EAAA,GAAK,EAAE,QAAA,EAAS;AACtB,IAAA,OAAO,IAAA,CAAK,KAAK,GAAA,CAAc,CAAA,WAAA,EAAc,KAAK,CAAA,CAAA,EAAI,EAAE,CAAA,CAAA,GAAK,EAAE,CAAA,CAAA,EAAI;AAAA,MACjE,QAAA,EAAU;AAAA,KACX,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,IAAI,IAAA,EAAiC;AACzC,IAAA,OAAO,KAAK,IAAA,CAAK,GAAA,CAAc,eAAe,kBAAA,CAAmB,IAAI,CAAC,CAAA,CAAA,EAAI;AAAA,MACxE,QAAA,EAAU;AAAA,KACX,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,QAAA,CAAS,SAAiB,IAAA,EAAsB;AAC9C,IAAA,IAAI,eAAA,CAAgB,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,IAAA;AACvC,IAAA,OAAO,CAAA,EAAG,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,EAAG,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAAI,EAAA,GAAK,GAAG,GAAG,IAAI,CAAA,CAAA;AAAA,EAC/E;AACF","file":"blog.js","sourcesContent":["import type { HttpClient } from \"../http.js\";\n\n/**\n * Blog resource — `client.blog.*`.\n *\n * Posts are public: these calls work before the user logs in, which is what\n * a marketing page or a Mini App landing screen needs.\n *\n * A post arrives as a **structured document**, not as HTML. `body_blocks` is\n * a flat list of typed nodes; map each `type` onto your own component and the\n * post inherits your site's styling. `body_markdown` is there too if you'd\n * rather run your own renderer.\n *\n * ```ts\n * const { posts } = await client.blog.list({ perPage: 5 });\n * const post = await client.blog.get(posts[0].slug);\n *\n * post.body_blocks.map((b) => {\n *   switch (b.type) {\n *     case \"heading\":   return <Heading level={b.level}>{b.text}</Heading>;\n *     case \"paragraph\": return <P>{b.text}</P>;\n *     case \"image\":     return <Figure src={b.url} alt={b.alt} caption={b.caption} />;\n *     case \"list\":      return <List ordered={b.ordered} items={b.items} />;\n *     case \"quote\":     return <Quote>{b.text}</Quote>;\n *     case \"code\":      return <Code lang={b.lang}>{b.text}</Code>;\n *     case \"divider\":   return <Hr />;\n *   }\n * });\n * ```\n *\n * Inline emphasis (`**bold**`, `[link](url)`) is left as Markdown inside\n * block text — every renderer already knows what to do with it.\n */\n\n/** One node of a post body. Discriminated on `type`. */\nexport type BlogBlock =\n  | { type: \"heading\"; level: number; text: string }\n  | { type: \"paragraph\"; text: string }\n  | { type: \"image\"; url: string; alt?: string; caption?: string }\n  | { type: \"list\"; ordered: boolean; items: string[] }\n  | { type: \"quote\"; text: string }\n  | { type: \"code\"; lang?: string; text: string }\n  | { type: \"divider\" };\n\nexport interface BlogPost {\n  /** Stable public key — link by this. */\n  slug: string;\n  title: string;\n  /** Teaser for cards; falls back to the first paragraph. */\n  excerpt: string;\n  /** Image URL, relative to the API origin. Absent when no cover is set. */\n  cover_url?: string;\n  /** Raw Markdown, for consumers that bring their own renderer. */\n  body_markdown: string;\n  /** The recommended input for rendering — see the module docs. */\n  body_blocks: BlogBlock[];\n  tags: string[];\n  /** Present only when the post declares one. */\n  locale?: string;\n  /** Rough read time in minutes (minimum 1). */\n  reading_minutes: number;\n  published_at: string | null;\n  updated_at: string;\n}\n\nexport interface BlogListInput {\n  /** 1-based. Default 1. */\n  page?: number;\n  /** 1..=50. Default 10. */\n  perPage?: number;\n  /** Only posts carrying this tag. */\n  tag?: string;\n  /** Only posts in this locale. */\n  locale?: string;\n}\n\nexport interface BlogList {\n  posts: BlogPost[];\n  total: number;\n  page: number;\n  per_page: number;\n}\n\nexport class BlogResource {\n  constructor(private readonly http: HttpClient) {}\n\n  /** Published posts, newest first. No authentication required. */\n  async list(input: BlogListInput = {}): Promise<BlogList> {\n    const q = new URLSearchParams();\n    if (input.page) q.set(\"page\", String(input.page));\n    if (input.perPage) q.set(\"per_page\", String(input.perPage));\n    if (input.tag) q.set(\"tag\", input.tag);\n    if (input.locale) q.set(\"locale\", input.locale);\n    const qs = q.toString();\n    return this.http.get<BlogList>(`/blog/posts${qs ? `?${qs}` : \"\"}`, {\n      skipAuth: true,\n    });\n  }\n\n  /** One post by slug. No authentication required. */\n  async get(slug: string): Promise<BlogPost> {\n    return this.http.get<BlogPost>(`/blog/posts/${encodeURIComponent(slug)}`, {\n      skipAuth: true,\n    });\n  }\n\n  /**\n   * Absolute URL for an image path returned inside a post (`cover_url`, or an\n   * image block's `url`). Handy when the app renders on a different origin\n   * than the API.\n   */\n  imageUrl(baseUrl: string, path: string): string {\n    if (/^https?:\\/\\//i.test(path)) return path;\n    return `${baseUrl.replace(/\\/$/, \"\")}${path.startsWith(\"/\") ? \"\" : \"/\"}${path}`;\n  }\n}\n"]}

package/dist/resources/branding.cjs

@@ -0,0 +1,16 @@
+'use strict';
+
+// src/resources/branding.ts
+var BrandingResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /** Fetch the deployment's public brand config. Safe to call before login. */
+  async get(opts = {}) {
+    return this.http.get("/branding", { skipAuth: true, signal: opts.signal });
+  }
+};
+
+exports.BrandingResource = BrandingResource;
+//# sourceMappingURL=branding.cjs.map
+//# sourceMappingURL=branding.cjs.map

package/dist/resources/branding.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/resources/branding.ts"],"names":[],"mappings":";;;AA2BO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA;AAAA,EAGhD,MAAM,GAAA,CAAI,IAAA,GAAiC,EAAC,EAAsB;AAChE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAc,WAAA,EAAa,EAAE,UAAU,IAAA,EAAM,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,CAAA;AAAA,EACrF;AACF","file":"branding.cjs","sourcesContent":["import type { HttpClient } from \"../http.js\";\n\n/**\n * Branding resource — `client.branding.*`.\n *\n * Runtime white-label config published by the deployment at `GET /branding`\n * (public, no auth). Lets a Cusfront re-theme itself on the fly — platform\n * name, logo, favicon and the label used for the end-user's balance — without\n * a rebuild. Pairs with the build-time `BrandConfig`: the server-side values\n * win whenever both are present.\n */\n\n/** Public brand config of the deployment. All strings; empty = use the client default. */\nexport interface Branding {\n  /** Platform display name (e.g. the white-label brand). */\n  platform_name: string;\n  /** Name of the merchant-facing portal. */\n  merchant_portal_name: string;\n  /** Logo image — absolute URL or `data:` URI. Empty → client default. */\n  logo_url: string;\n  /** Favicon — absolute URL or `data:` URI. Empty → client default. */\n  favicon_url: string;\n  /** User-facing name of the balance, e.g. `\"Wallet\"` or `\"Acme Wallet\"`.\n   *  Display-only: the `balance` API shape never changes with it. */\n  wallet_label: string;\n}\n\nexport class BrandingResource {\n  constructor(private readonly http: HttpClient) {}\n\n  /** Fetch the deployment's public brand config. Safe to call before login. */\n  async get(opts: { signal?: AbortSignal } = {}): Promise<Branding> {\n    return this.http.get<Branding>(\"/branding\", { skipAuth: true, signal: opts.signal });\n  }\n}\n"]}

package/dist/resources/branding.d.cts

@@ -0,0 +1,35 @@
+import { H as HttpClient } from '../http-BkZZZI8K.cjs';
+
+/**
+ * Branding resource — `client.branding.*`.
+ *
+ * Runtime white-label config published by the deployment at `GET /branding`
+ * (public, no auth). Lets a Cusfront re-theme itself on the fly — platform
+ * name, logo, favicon and the label used for the end-user's balance — without
+ * a rebuild. Pairs with the build-time `BrandConfig`: the server-side values
+ * win whenever both are present.
+ */
+/** Public brand config of the deployment. All strings; empty = use the client default. */
+interface Branding {
+    /** Platform display name (e.g. the white-label brand). */
+    platform_name: string;
+    /** Name of the merchant-facing portal. */
+    merchant_portal_name: string;
+    /** Logo image — absolute URL or `data:` URI. Empty → client default. */
+    logo_url: string;
+    /** Favicon — absolute URL or `data:` URI. Empty → client default. */
+    favicon_url: string;
+    /** User-facing name of the balance, e.g. `"Wallet"` or `"Acme Wallet"`.
+     *  Display-only: the `balance` API shape never changes with it. */
+    wallet_label: string;
+}
+declare class BrandingResource {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Fetch the deployment's public brand config. Safe to call before login. */
+    get(opts?: {
+        signal?: AbortSignal;
+    }): Promise<Branding>;
+}
+
+export { type Branding, BrandingResource };

package/dist/resources/branding.d.ts

@@ -0,0 +1,35 @@
+import { H as HttpClient } from '../http-BkZZZI8K.js';
+
+/**
+ * Branding resource — `client.branding.*`.
+ *
+ * Runtime white-label config published by the deployment at `GET /branding`
+ * (public, no auth). Lets a Cusfront re-theme itself on the fly — platform
+ * name, logo, favicon and the label used for the end-user's balance — without
+ * a rebuild. Pairs with the build-time `BrandConfig`: the server-side values
+ * win whenever both are present.
+ */
+/** Public brand config of the deployment. All strings; empty = use the client default. */
+interface Branding {
+    /** Platform display name (e.g. the white-label brand). */
+    platform_name: string;
+    /** Name of the merchant-facing portal. */
+    merchant_portal_name: string;
+    /** Logo image — absolute URL or `data:` URI. Empty → client default. */
+    logo_url: string;
+    /** Favicon — absolute URL or `data:` URI. Empty → client default. */
+    favicon_url: string;
+    /** User-facing name of the balance, e.g. `"Wallet"` or `"Acme Wallet"`.
+     *  Display-only: the `balance` API shape never changes with it. */
+    wallet_label: string;
+}
+declare class BrandingResource {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Fetch the deployment's public brand config. Safe to call before login. */
+    get(opts?: {
+        signal?: AbortSignal;
+    }): Promise<Branding>;
+}
+
+export { type Branding, BrandingResource };

package/dist/resources/branding.js

@@ -0,0 +1,14 @@
+// src/resources/branding.ts
+var BrandingResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /** Fetch the deployment's public brand config. Safe to call before login. */
+  async get(opts = {}) {
+    return this.http.get("/branding", { skipAuth: true, signal: opts.signal });
+  }
+};
+
+export { BrandingResource };
+//# sourceMappingURL=branding.js.map
+//# sourceMappingURL=branding.js.map

package/dist/resources/branding.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/resources/branding.ts"],"names":[],"mappings":";AA2BO,IAAM,mBAAN,MAAuB;AAAA,EAC5B,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA;AAAA,EAGhD,MAAM,GAAA,CAAI,IAAA,GAAiC,EAAC,EAAsB;AAChE,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAc,WAAA,EAAa,EAAE,UAAU,IAAA,EAAM,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,CAAA;AAAA,EACrF;AACF","file":"branding.js","sourcesContent":["import type { HttpClient } from \"../http.js\";\n\n/**\n * Branding resource — `client.branding.*`.\n *\n * Runtime white-label config published by the deployment at `GET /branding`\n * (public, no auth). Lets a Cusfront re-theme itself on the fly — platform\n * name, logo, favicon and the label used for the end-user's balance — without\n * a rebuild. Pairs with the build-time `BrandConfig`: the server-side values\n * win whenever both are present.\n */\n\n/** Public brand config of the deployment. All strings; empty = use the client default. */\nexport interface Branding {\n  /** Platform display name (e.g. the white-label brand). */\n  platform_name: string;\n  /** Name of the merchant-facing portal. */\n  merchant_portal_name: string;\n  /** Logo image — absolute URL or `data:` URI. Empty → client default. */\n  logo_url: string;\n  /** Favicon — absolute URL or `data:` URI. Empty → client default. */\n  favicon_url: string;\n  /** User-facing name of the balance, e.g. `\"Wallet\"` or `\"Acme Wallet\"`.\n   *  Display-only: the `balance` API shape never changes with it. */\n  wallet_label: string;\n}\n\nexport class BrandingResource {\n  constructor(private readonly http: HttpClient) {}\n\n  /** Fetch the deployment's public brand config. Safe to call before login. */\n  async get(opts: { signal?: AbortSignal } = {}): Promise<Branding> {\n    return this.http.get<Branding>(\"/branding\", { skipAuth: true, signal: opts.signal });\n  }\n}\n"]}

package/dist/resources/cards.cjs

@@ -0,0 +1,91 @@
+'use strict';
+
+// src/resources/cards.ts
+var CardsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /**
+   * Issue a card backed by the user's wallet balance. Resolves to the new
+   * `Card`. On a ledger failure after provider creation, the Takeal API rolls the row
+   * to `failed` (never an orphaned active card); inspect `status` /
+   * `failure_reason` on the result.
+   */
+  async create(input) {
+    const { idempotencyKey, ...body } = input;
+    return this.http.post("/me/cards", {
+      body,
+      idempotencyKey
+    });
+  }
+  /** Fetch one card by id. */
+  async get(id) {
+    return this.http.get(`/me/cards/${encodeURIComponent(id)}`);
+  }
+  /** List the caller's cards, most recent first. */
+  async list() {
+    return this.http.get("/me/cards");
+  }
+  /**
+   * Remaining balance of a prepaid card. `currency` is required by the Takeal API and
+   * forwarded as a query param.
+   */
+  async balance(id, currency) {
+    const q = new URLSearchParams({ currency }).toString();
+    return this.http.get(
+      `/me/cards/${encodeURIComponent(id)}/balance?${q}`
+    );
+  }
+  /**
+   * Freeze the caller's own card. Reversible via {@link unfreeze}. The optional
+   * `reason` is recorded on the audit trail. Resolves to the updated card.
+   * 404 if the card isn't the caller's; 501 if the issuer can't freeze.
+   */
+  async freeze(id, reason) {
+    return this.http.post(
+      `/me/cards/${encodeURIComponent(id)}/freeze`,
+      { body: { reason } }
+    );
+  }
+  /**
+   * Reveal the FULL PAN + CVV for the caller's own card. Re-auth gated
+   * (password, + TOTP when the user has it enrolled) and rate-limited
+   * server-side. The Takeal API never persists this data and marks the
+   * response no-store; the SDK returns it verbatim and holds nothing.
+   *
+   * **Consumer security duties** (the SDK can't enforce these for you):
+   * keep the result in volatile memory only, never write it to
+   * localStorage / logs, and clear it within `expires_in_seconds`.
+   *
+   * 401 bad re-auth · 403 not your card · 429 rate-limited · 501 connector
+   * has no sensitive-data endpoint · 503 provider error.
+   */
+  async reveal(id, input) {
+    return this.http.post(
+      `/me/cards/${encodeURIComponent(id)}/reveal`,
+      { body: { password: input.password, totp_code: input.totpCode } }
+    );
+  }
+  /** Unfreeze a previously-frozen card. Idempotent on an already-active card. */
+  async unfreeze(id) {
+    return this.http.post(
+      `/me/cards/${encodeURIComponent(id)}/unfreeze`,
+      { body: {} }
+    );
+  }
+  /**
+   * Terminate the caller's own card. **One-way** — a terminated card cannot be
+   * reactivated. The optional `reason` is audited. Idempotent on an
+   * already-terminated card.
+   */
+  async terminate(id, reason) {
+    return this.http.post(
+      `/me/cards/${encodeURIComponent(id)}/terminate`,
+      { body: { reason } }
+    );
+  }
+};
+
+exports.CardsResource = CardsResource;
+//# sourceMappingURL=cards.cjs.map
+//# sourceMappingURL=cards.cjs.map

package/dist/resources/cards.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/resources/cards.ts"],"names":[],"mappings":";;;AAkIO,IAAM,gBAAN,MAAoB;AAAA,EACzB,YAA6B,IAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQhD,MAAM,OAAO,KAAA,EAAuC;AAClD,IAAA,MAAM,EAAE,cAAA,EAAgB,GAAG,IAAA,EAAK,GAAI,KAAA;AACpC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAW,WAAA,EAAa;AAAA,MACvC,IAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,IAAI,EAAA,EAA2B;AACnC,IAAA,OAAO,KAAK,IAAA,CAAK,GAAA,CAAU,aAAa,kBAAA,CAAmB,EAAE,CAAC,CAAA,CAAE,CAAA;AAAA,EAClE;AAAA;AAAA,EAGA,MAAM,IAAA,GAAwB;AAC5B,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAY,WAAW,CAAA;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAA,CAAQ,EAAA,EAAY,QAAA,EAAwC;AAChE,IAAA,MAAM,IAAI,IAAI,eAAA,CAAgB,EAAE,QAAA,EAAU,EAAE,QAAA,EAAS;AACrD,IAAA,OAAO,KAAK,IAAA,CAAK,GAAA;AAAA,MACf,CAAA,UAAA,EAAa,kBAAA,CAAmB,EAAE,CAAC,YAAY,CAAC,CAAA;AAAA,KAClD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,MAAA,CAAO,EAAA,EAAY,MAAA,EAAgC;AACvD,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA;AAAA,MACf,CAAA,UAAA,EAAa,kBAAA,CAAmB,EAAE,CAAC,CAAA,OAAA,CAAA;AAAA,MACnC,EAAE,IAAA,EAAM,EAAE,MAAA,EAAO;AAAE,KACrB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,MAAA,CAAO,EAAA,EAAY,KAAA,EAA+C;AACtE,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA;AAAA,MACf,CAAA,UAAA,EAAa,kBAAA,CAAmB,EAAE,CAAC,CAAA,OAAA,CAAA;AAAA,MACnC,EAAE,MAAM,EAAE,QAAA,EAAU,MAAM,QAAA,EAAU,SAAA,EAAW,KAAA,CAAM,QAAA,EAAS;AAAE,KAClE;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,SAAS,EAAA,EAA2B;AACxC,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA;AAAA,MACf,CAAA,UAAA,EAAa,kBAAA,CAAmB,EAAE,CAAC,CAAA,SAAA,CAAA;AAAA,MACnC,EAAE,IAAA,EAAM,EAAC;AAAE,KACb;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,SAAA,CAAU,EAAA,EAAY,MAAA,EAAgC;AAC1D,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA;AAAA,MACf,CAAA,UAAA,EAAa,kBAAA,CAAmB,EAAE,CAAC,CAAA,UAAA,CAAA;AAAA,MACnC,EAAE,IAAA,EAAM,EAAE,MAAA,EAAO;AAAE,KACrB;AAAA,EACF;AACF","file":"cards.cjs","sourcesContent":["import type { HttpClient } from \"../http.js\";\nimport type { CustomerInfo } from \"../types/customer.js\";\n\n/**\n * Cards resource — `client.cards.*`.\n *\n * The end-user \"money OUT\" surface: a user issues themselves a card backed by\n * their wallet balance via an issuer connector. Mirrors the Takeal API's\n * `/me/cards` routes:\n *\n *   POST   /me/cards                 → create\n *   GET    /me/cards                 → list (most recent first)\n *   GET    /me/cards/{id}            → get\n *   GET    /me/cards/{id}/balance    → balance (prepaid remaining)\n *   POST   /me/cards/{id}/freeze     → freeze\n *   POST   /me/cards/{id}/unfreeze   → unfreeze\n *   POST   /me/cards/{id}/terminate  → terminate (one-way)\n *\n * The lifecycle actions are ownership-gated server-side: a caller can only\n * freeze / unfreeze / terminate a card that belongs to them (else 404).\n *\n * ## What is intentionally NOT here\n *\n * Card-data reveal (PAN / CVV) is a separate, security-sensitive flow with its\n * own re-auth + rate-limit + audit contract and is intentionally\n * NOT part of this resource (tracked separately).\n *\n * Today only PREPAID is wired end-to-end; CREDIT and GIFT return 400 from\n * the Takeal API until their issuer flows land.\n */\n\n/** Card product. Only `prepaid` is fully implemented today. */\nexport type CardType = \"credit\" | \"prepaid\" | \"gift\";\n\n/**\n * Card lifecycle state.\n *\n * `pending_payment` is a transient state: the row exists but the\n * per-card issuance-fee debit has not yet succeeded; such cards have no\n * provider reference and no user-visible side effects.\n */\nexport type CardStatus =\n  | \"pending_payment\"\n  | \"active\"\n  | \"frozen\"\n  | \"terminated\"\n  | \"redeemed\"\n  | \"failed\";\n\n/**\n * A card record as the Takeal API returns it. Mirrors the `cards` table. Note the\n * SDK never receives the full PAN or CVV here — only `last4` + expiry. The\n * gift-card `redemption_code` is returned exactly once (on create) and\n * scrubbed from subsequent list/get responses.\n */\nexport interface Card {\n  id: string;\n  user_id: string;\n  card_type: CardType;\n  /** Slug of the issuer that minted this card, as configured by the deployment. */\n  connector_slug: string;\n  /** The connector's own reference, populated once it responds. */\n  provider_reference: string | null;\n  status: CardStatus;\n  /** Last four digits of the PAN — safe to display. */\n  last4: string | null;\n  expiry_month: number | null;\n  expiry_year: number | null;\n  /** Gift cards only, present once on create then scrubbed. */\n  redemption_code?: string;\n  /** Decimal as a string. */\n  initial_amount: string | null;\n  currency: string;\n  failure_reason: string | null;\n  created_at: string;\n  updated_at: string;\n}\n\nexport interface CreateCardInput {\n  /** `prepaid` (the only fully-wired type today), `credit`, or `gift`. */\n  type: CardType;\n  /** Decimal as a string. The prepaid load amount drained from wallet balance. */\n  initial_amount?: string;\n  /** ISO 4217 code, e.g. `\"USD\"`. */\n  currency: string;\n  /**\n   * Optional. Slug of a specific issuer to mint with. Omit to let\n   * the Takeal API pick the first active issuer. Unknown slug → 400; empty issuer\n   * list → 503.\n   */\n  issuer_slug?: string;\n  metadata?: Record<string, string>;\n  /** Structured billing details — real issuers require these for 3DS / KYC. */\n  customer?: CustomerInfo;\n  /**\n   * Required by the Takeal API on this write endpoint. Same key + body replays the\n   * original card; same key + different body returns 409.\n   */\n  idempotencyKey: string;\n}\n\n/** Remaining balance of a prepaid card. */\nexport interface CardBalance {\n  amount: string;\n  currency: string;\n}\n\n/** Re-auth gate for {@link CardsResource.reveal}. */\nexport interface RevealCardInput {\n  /** The user's account password — mandatory re-auth. */\n  password: string;\n  /** TOTP code; required only when the user has TOTP enrolled. */\n  totpCode?: string;\n}\n\n/**\n * Full card data from a successful reveal. **Security**: never persist this —\n * keep it in volatile memory only, clear it within `expires_in_seconds`, and\n * never write it to localStorage / logs (the API marks the response no-store).\n */\nexport interface RevealedCard {\n  pan: string;\n  cvv: string;\n  expiry_month: number;\n  expiry_year: number;\n  holder_name: string;\n  /** Display window before the client should auto-clear the data. */\n  expires_in_seconds: number;\n}\n\nexport class CardsResource {\n  constructor(private readonly http: HttpClient) {}\n\n  /**\n   * Issue a card backed by the user's wallet balance. Resolves to the new\n   * `Card`. On a ledger failure after provider creation, the Takeal API rolls the row\n   * to `failed` (never an orphaned active card); inspect `status` /\n   * `failure_reason` on the result.\n   */\n  async create(input: CreateCardInput): Promise<Card> {\n    const { idempotencyKey, ...body } = input;\n    return this.http.post<Card>(\"/me/cards\", {\n      body,\n      idempotencyKey,\n    });\n  }\n\n  /** Fetch one card by id. */\n  async get(id: string): Promise<Card> {\n    return this.http.get<Card>(`/me/cards/${encodeURIComponent(id)}`);\n  }\n\n  /** List the caller's cards, most recent first. */\n  async list(): Promise<Card[]> {\n    return this.http.get<Card[]>(\"/me/cards\");\n  }\n\n  /**\n   * Remaining balance of a prepaid card. `currency` is required by the Takeal API and\n   * forwarded as a query param.\n   */\n  async balance(id: string, currency: string): Promise<CardBalance> {\n    const q = new URLSearchParams({ currency }).toString();\n    return this.http.get<CardBalance>(\n      `/me/cards/${encodeURIComponent(id)}/balance?${q}`,\n    );\n  }\n\n  /**\n   * Freeze the caller's own card. Reversible via {@link unfreeze}. The optional\n   * `reason` is recorded on the audit trail. Resolves to the updated card.\n   * 404 if the card isn't the caller's; 501 if the issuer can't freeze.\n   */\n  async freeze(id: string, reason?: string): Promise<Card> {\n    return this.http.post<Card>(\n      `/me/cards/${encodeURIComponent(id)}/freeze`,\n      { body: { reason } },\n    );\n  }\n\n  /**\n   * Reveal the FULL PAN + CVV for the caller's own card. Re-auth gated\n   * (password, + TOTP when the user has it enrolled) and rate-limited\n   * server-side. The Takeal API never persists this data and marks the\n   * response no-store; the SDK returns it verbatim and holds nothing.\n   *\n   * **Consumer security duties** (the SDK can't enforce these for you):\n   * keep the result in volatile memory only, never write it to\n   * localStorage / logs, and clear it within `expires_in_seconds`.\n   *\n   * 401 bad re-auth · 403 not your card · 429 rate-limited · 501 connector\n   * has no sensitive-data endpoint · 503 provider error.\n   */\n  async reveal(id: string, input: RevealCardInput): Promise<RevealedCard> {\n    return this.http.post<RevealedCard>(\n      `/me/cards/${encodeURIComponent(id)}/reveal`,\n      { body: { password: input.password, totp_code: input.totpCode } },\n    );\n  }\n\n  /** Unfreeze a previously-frozen card. Idempotent on an already-active card. */\n  async unfreeze(id: string): Promise<Card> {\n    return this.http.post<Card>(\n      `/me/cards/${encodeURIComponent(id)}/unfreeze`,\n      { body: {} },\n    );\n  }\n\n  /**\n   * Terminate the caller's own card. **One-way** — a terminated card cannot be\n   * reactivated. The optional `reason` is audited. Idempotent on an\n   * already-terminated card.\n   */\n  async terminate(id: string, reason?: string): Promise<Card> {\n    return this.http.post<Card>(\n      `/me/cards/${encodeURIComponent(id)}/terminate`,\n      { body: { reason } },\n    );\n  }\n}\n"]}

package/dist/resources/cards.d.cts

@@ -0,0 +1,166 @@
+import { H as HttpClient } from '../http-BkZZZI8K.cjs';
+import { C as CustomerInfo } from '../customer-CoxPwe5o.cjs';
+
+/**
+ * Cards resource — `client.cards.*`.
+ *
+ * The end-user "money OUT" surface: a user issues themselves a card backed by
+ * their wallet balance via an issuer connector. Mirrors the Takeal API's
+ * `/me/cards` routes:
+ *
+ *   POST   /me/cards                 → create
+ *   GET    /me/cards                 → list (most recent first)
+ *   GET    /me/cards/{id}            → get
+ *   GET    /me/cards/{id}/balance    → balance (prepaid remaining)
+ *   POST   /me/cards/{id}/freeze     → freeze
+ *   POST   /me/cards/{id}/unfreeze   → unfreeze
+ *   POST   /me/cards/{id}/terminate  → terminate (one-way)
+ *
+ * The lifecycle actions are ownership-gated server-side: a caller can only
+ * freeze / unfreeze / terminate a card that belongs to them (else 404).
+ *
+ * ## What is intentionally NOT here
+ *
+ * Card-data reveal (PAN / CVV) is a separate, security-sensitive flow with its
+ * own re-auth + rate-limit + audit contract and is intentionally
+ * NOT part of this resource (tracked separately).
+ *
+ * Today only PREPAID is wired end-to-end; CREDIT and GIFT return 400 from
+ * the Takeal API until their issuer flows land.
+ */
+/** Card product. Only `prepaid` is fully implemented today. */
+type CardType = "credit" | "prepaid" | "gift";
+/**
+ * Card lifecycle state.
+ *
+ * `pending_payment` is a transient state: the row exists but the
+ * per-card issuance-fee debit has not yet succeeded; such cards have no
+ * provider reference and no user-visible side effects.
+ */
+type CardStatus = "pending_payment" | "active" | "frozen" | "terminated" | "redeemed" | "failed";
+/**
+ * A card record as the Takeal API returns it. Mirrors the `cards` table. Note the
+ * SDK never receives the full PAN or CVV here — only `last4` + expiry. The
+ * gift-card `redemption_code` is returned exactly once (on create) and
+ * scrubbed from subsequent list/get responses.
+ */
+interface Card {
+    id: string;
+    user_id: string;
+    card_type: CardType;
+    /** Slug of the issuer that minted this card, as configured by the deployment. */
+    connector_slug: string;
+    /** The connector's own reference, populated once it responds. */
+    provider_reference: string | null;
+    status: CardStatus;
+    /** Last four digits of the PAN — safe to display. */
+    last4: string | null;
+    expiry_month: number | null;
+    expiry_year: number | null;
+    /** Gift cards only, present once on create then scrubbed. */
+    redemption_code?: string;
+    /** Decimal as a string. */
+    initial_amount: string | null;
+    currency: string;
+    failure_reason: string | null;
+    created_at: string;
+    updated_at: string;
+}
+interface CreateCardInput {
+    /** `prepaid` (the only fully-wired type today), `credit`, or `gift`. */
+    type: CardType;
+    /** Decimal as a string. The prepaid load amount drained from wallet balance. */
+    initial_amount?: string;
+    /** ISO 4217 code, e.g. `"USD"`. */
+    currency: string;
+    /**
+     * Optional. Slug of a specific issuer to mint with. Omit to let
+     * the Takeal API pick the first active issuer. Unknown slug → 400; empty issuer
+     * list → 503.
+     */
+    issuer_slug?: string;
+    metadata?: Record<string, string>;
+    /** Structured billing details — real issuers require these for 3DS / KYC. */
+    customer?: CustomerInfo;
+    /**
+     * Required by the Takeal API on this write endpoint. Same key + body replays the
+     * original card; same key + different body returns 409.
+     */
+    idempotencyKey: string;
+}
+/** Remaining balance of a prepaid card. */
+interface CardBalance {
+    amount: string;
+    currency: string;
+}
+/** Re-auth gate for {@link CardsResource.reveal}. */
+interface RevealCardInput {
+    /** The user's account password — mandatory re-auth. */
+    password: string;
+    /** TOTP code; required only when the user has TOTP enrolled. */
+    totpCode?: string;
+}
+/**
+ * Full card data from a successful reveal. **Security**: never persist this —
+ * keep it in volatile memory only, clear it within `expires_in_seconds`, and
+ * never write it to localStorage / logs (the API marks the response no-store).
+ */
+interface RevealedCard {
+    pan: string;
+    cvv: string;
+    expiry_month: number;
+    expiry_year: number;
+    holder_name: string;
+    /** Display window before the client should auto-clear the data. */
+    expires_in_seconds: number;
+}
+declare class CardsResource {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * Issue a card backed by the user's wallet balance. Resolves to the new
+     * `Card`. On a ledger failure after provider creation, the Takeal API rolls the row
+     * to `failed` (never an orphaned active card); inspect `status` /
+     * `failure_reason` on the result.
+     */
+    create(input: CreateCardInput): Promise<Card>;
+    /** Fetch one card by id. */
+    get(id: string): Promise<Card>;
+    /** List the caller's cards, most recent first. */
+    list(): Promise<Card[]>;
+    /**
+     * Remaining balance of a prepaid card. `currency` is required by the Takeal API and
+     * forwarded as a query param.
+     */
+    balance(id: string, currency: string): Promise<CardBalance>;
+    /**
+     * Freeze the caller's own card. Reversible via {@link unfreeze}. The optional
+     * `reason` is recorded on the audit trail. Resolves to the updated card.
+     * 404 if the card isn't the caller's; 501 if the issuer can't freeze.
+     */
+    freeze(id: string, reason?: string): Promise<Card>;
+    /**
+     * Reveal the FULL PAN + CVV for the caller's own card. Re-auth gated
+     * (password, + TOTP when the user has it enrolled) and rate-limited
+     * server-side. The Takeal API never persists this data and marks the
+     * response no-store; the SDK returns it verbatim and holds nothing.
+     *
+     * **Consumer security duties** (the SDK can't enforce these for you):
+     * keep the result in volatile memory only, never write it to
+     * localStorage / logs, and clear it within `expires_in_seconds`.
+     *
+     * 401 bad re-auth · 403 not your card · 429 rate-limited · 501 connector
+     * has no sensitive-data endpoint · 503 provider error.
+     */
+    reveal(id: string, input: RevealCardInput): Promise<RevealedCard>;
+    /** Unfreeze a previously-frozen card. Idempotent on an already-active card. */
+    unfreeze(id: string): Promise<Card>;
+    /**
+     * Terminate the caller's own card. **One-way** — a terminated card cannot be
+     * reactivated. The optional `reason` is audited. Idempotent on an
+     * already-terminated card.
+     */
+    terminate(id: string, reason?: string): Promise<Card>;
+}
+
+export { type Card, type CardBalance, type CardStatus, type CardType, CardsResource, type CreateCardInput, type RevealCardInput, type RevealedCard };

package/dist/resources/cards.d.ts

@@ -0,0 +1,166 @@
+import { H as HttpClient } from '../http-BkZZZI8K.js';
+import { C as CustomerInfo } from '../customer-CoxPwe5o.js';
+
+/**
+ * Cards resource — `client.cards.*`.
+ *
+ * The end-user "money OUT" surface: a user issues themselves a card backed by
+ * their wallet balance via an issuer connector. Mirrors the Takeal API's
+ * `/me/cards` routes:
+ *
+ *   POST   /me/cards                 → create
+ *   GET    /me/cards                 → list (most recent first)
+ *   GET    /me/cards/{id}            → get
+ *   GET    /me/cards/{id}/balance    → balance (prepaid remaining)
+ *   POST   /me/cards/{id}/freeze     → freeze
+ *   POST   /me/cards/{id}/unfreeze   → unfreeze
+ *   POST   /me/cards/{id}/terminate  → terminate (one-way)
+ *
+ * The lifecycle actions are ownership-gated server-side: a caller can only
+ * freeze / unfreeze / terminate a card that belongs to them (else 404).
+ *
+ * ## What is intentionally NOT here
+ *
+ * Card-data reveal (PAN / CVV) is a separate, security-sensitive flow with its
+ * own re-auth + rate-limit + audit contract and is intentionally
+ * NOT part of this resource (tracked separately).
+ *
+ * Today only PREPAID is wired end-to-end; CREDIT and GIFT return 400 from
+ * the Takeal API until their issuer flows land.
+ */
+/** Card product. Only `prepaid` is fully implemented today. */
+type CardType = "credit" | "prepaid" | "gift";
+/**
+ * Card lifecycle state.
+ *
+ * `pending_payment` is a transient state: the row exists but the
+ * per-card issuance-fee debit has not yet succeeded; such cards have no
+ * provider reference and no user-visible side effects.
+ */
+type CardStatus = "pending_payment" | "active" | "frozen" | "terminated" | "redeemed" | "failed";
+/**
+ * A card record as the Takeal API returns it. Mirrors the `cards` table. Note the
+ * SDK never receives the full PAN or CVV here — only `last4` + expiry. The
+ * gift-card `redemption_code` is returned exactly once (on create) and
+ * scrubbed from subsequent list/get responses.
+ */
+interface Card {
+    id: string;
+    user_id: string;
+    card_type: CardType;
+    /** Slug of the issuer that minted this card, as configured by the deployment. */
+    connector_slug: string;
+    /** The connector's own reference, populated once it responds. */
+    provider_reference: string | null;
+    status: CardStatus;
+    /** Last four digits of the PAN — safe to display. */
+    last4: string | null;
+    expiry_month: number | null;
+    expiry_year: number | null;
+    /** Gift cards only, present once on create then scrubbed. */
+    redemption_code?: string;
+    /** Decimal as a string. */
+    initial_amount: string | null;
+    currency: string;
+    failure_reason: string | null;
+    created_at: string;
+    updated_at: string;
+}
+interface CreateCardInput {
+    /** `prepaid` (the only fully-wired type today), `credit`, or `gift`. */
+    type: CardType;
+    /** Decimal as a string. The prepaid load amount drained from wallet balance. */
+    initial_amount?: string;
+    /** ISO 4217 code, e.g. `"USD"`. */
+    currency: string;
+    /**
+     * Optional. Slug of a specific issuer to mint with. Omit to let
+     * the Takeal API pick the first active issuer. Unknown slug → 400; empty issuer
+     * list → 503.
+     */
+    issuer_slug?: string;
+    metadata?: Record<string, string>;
+    /** Structured billing details — real issuers require these for 3DS / KYC. */
+    customer?: CustomerInfo;
+    /**
+     * Required by the Takeal API on this write endpoint. Same key + body replays the
+     * original card; same key + different body returns 409.
+     */
+    idempotencyKey: string;
+}
+/** Remaining balance of a prepaid card. */
+interface CardBalance {
+    amount: string;
+    currency: string;
+}
+/** Re-auth gate for {@link CardsResource.reveal}. */
+interface RevealCardInput {
+    /** The user's account password — mandatory re-auth. */
+    password: string;
+    /** TOTP code; required only when the user has TOTP enrolled. */
+    totpCode?: string;
+}
+/**
+ * Full card data from a successful reveal. **Security**: never persist this —
+ * keep it in volatile memory only, clear it within `expires_in_seconds`, and
+ * never write it to localStorage / logs (the API marks the response no-store).
+ */
+interface RevealedCard {
+    pan: string;
+    cvv: string;
+    expiry_month: number;
+    expiry_year: number;
+    holder_name: string;
+    /** Display window before the client should auto-clear the data. */
+    expires_in_seconds: number;
+}
+declare class CardsResource {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * Issue a card backed by the user's wallet balance. Resolves to the new
+     * `Card`. On a ledger failure after provider creation, the Takeal API rolls the row
+     * to `failed` (never an orphaned active card); inspect `status` /
+     * `failure_reason` on the result.
+     */
+    create(input: CreateCardInput): Promise<Card>;
+    /** Fetch one card by id. */
+    get(id: string): Promise<Card>;
+    /** List the caller's cards, most recent first. */
+    list(): Promise<Card[]>;
+    /**
+     * Remaining balance of a prepaid card. `currency` is required by the Takeal API and
+     * forwarded as a query param.
+     */
+    balance(id: string, currency: string): Promise<CardBalance>;
+    /**
+     * Freeze the caller's own card. Reversible via {@link unfreeze}. The optional
+     * `reason` is recorded on the audit trail. Resolves to the updated card.
+     * 404 if the card isn't the caller's; 501 if the issuer can't freeze.
+     */
+    freeze(id: string, reason?: string): Promise<Card>;
+    /**
+     * Reveal the FULL PAN + CVV for the caller's own card. Re-auth gated
+     * (password, + TOTP when the user has it enrolled) and rate-limited
+     * server-side. The Takeal API never persists this data and marks the
+     * response no-store; the SDK returns it verbatim and holds nothing.
+     *
+     * **Consumer security duties** (the SDK can't enforce these for you):
+     * keep the result in volatile memory only, never write it to
+     * localStorage / logs, and clear it within `expires_in_seconds`.
+     *
+     * 401 bad re-auth · 403 not your card · 429 rate-limited · 501 connector
+     * has no sensitive-data endpoint · 503 provider error.
+     */
+    reveal(id: string, input: RevealCardInput): Promise<RevealedCard>;
+    /** Unfreeze a previously-frozen card. Idempotent on an already-active card. */
+    unfreeze(id: string): Promise<Card>;
+    /**
+     * Terminate the caller's own card. **One-way** — a terminated card cannot be
+     * reactivated. The optional `reason` is audited. Idempotent on an
+     * already-terminated card.
+     */
+    terminate(id: string, reason?: string): Promise<Card>;
+}
+
+export { type Card, type CardBalance, type CardStatus, type CardType, CardsResource, type CreateCardInput, type RevealCardInput, type RevealedCard };

package/dist/resources/cards.js

@@ -0,0 +1,89 @@
+// src/resources/cards.ts
+var CardsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /**
+   * Issue a card backed by the user's wallet balance. Resolves to the new
+   * `Card`. On a ledger failure after provider creation, the Takeal API rolls the row
+   * to `failed` (never an orphaned active card); inspect `status` /
+   * `failure_reason` on the result.
+   */
+  async create(input) {
+    const { idempotencyKey, ...body } = input;
+    return this.http.post("/me/cards", {
+      body,
+      idempotencyKey
+    });
+  }
+  /** Fetch one card by id. */
+  async get(id) {
+    return this.http.get(`/me/cards/${encodeURIComponent(id)}`);
+  }
+  /** List the caller's cards, most recent first. */
+  async list() {
+    return this.http.get("/me/cards");
+  }
+  /**
+   * Remaining balance of a prepaid card. `currency` is required by the Takeal API and
+   * forwarded as a query param.
+   */
+  async balance(id, currency) {
+    const q = new URLSearchParams({ currency }).toString();
+    return this.http.get(
+      `/me/cards/${encodeURIComponent(id)}/balance?${q}`
+    );
+  }
+  /**
+   * Freeze the caller's own card. Reversible via {@link unfreeze}. The optional
+   * `reason` is recorded on the audit trail. Resolves to the updated card.
+   * 404 if the card isn't the caller's; 501 if the issuer can't freeze.
+   */
+  async freeze(id, reason) {
+    return this.http.post(
+      `/me/cards/${encodeURIComponent(id)}/freeze`,
+      { body: { reason } }
+    );
+  }
+  /**
+   * Reveal the FULL PAN + CVV for the caller's own card. Re-auth gated
+   * (password, + TOTP when the user has it enrolled) and rate-limited
+   * server-side. The Takeal API never persists this data and marks the
+   * response no-store; the SDK returns it verbatim and holds nothing.
+   *
+   * **Consumer security duties** (the SDK can't enforce these for you):
+   * keep the result in volatile memory only, never write it to
+   * localStorage / logs, and clear it within `expires_in_seconds`.
+   *
+   * 401 bad re-auth · 403 not your card · 429 rate-limited · 501 connector
+   * has no sensitive-data endpoint · 503 provider error.
+   */
+  async reveal(id, input) {
+    return this.http.post(
+      `/me/cards/${encodeURIComponent(id)}/reveal`,
+      { body: { password: input.password, totp_code: input.totpCode } }
+    );
+  }
+  /** Unfreeze a previously-frozen card. Idempotent on an already-active card. */
+  async unfreeze(id) {
+    return this.http.post(
+      `/me/cards/${encodeURIComponent(id)}/unfreeze`,
+      { body: {} }
+    );
+  }
+  /**
+   * Terminate the caller's own card. **One-way** — a terminated card cannot be
+   * reactivated. The optional `reason` is audited. Idempotent on an
+   * already-terminated card.
+   */
+  async terminate(id, reason) {
+    return this.http.post(
+      `/me/cards/${encodeURIComponent(id)}/terminate`,
+      { body: { reason } }
+    );
+  }
+};
+
+export { CardsResource };
+//# sourceMappingURL=cards.js.map
+//# sourceMappingURL=cards.js.map