@vexpay/node 0.1.0

package/dist/index.js

@@ -0,0 +1,770 @@
+// src/errors.ts
+var VexPayError = class extends Error {
+  /** HTTP status, when the API answered. */
+  status;
+  /** Machine-readable API code, e.g. `insufficient_balance`. */
+  code;
+  /** Parsed response body, when the API answered. */
+  body;
+  /** Request id from the `x-request-id` response header, when present. */
+  requestId;
+  constructor(message, details = {}) {
+    super(message);
+    this.name = new.target.name;
+    this.status = details.status;
+    this.code = details.code;
+    this.body = details.body;
+    this.requestId = details.requestId;
+  }
+};
+var VexPayConfigurationError = class extends VexPayError {
+};
+var VexPayAuthenticationError = class extends VexPayError {
+};
+var VexPayInvalidRequestError = class extends VexPayError {
+};
+var VexPayNotFoundError = class extends VexPayError {
+};
+var VexPayConflictError = class extends VexPayError {
+};
+var VexPayRateLimitError = class extends VexPayError {
+};
+var VexPayAPIError = class extends VexPayError {
+};
+var VexPayConnectionError = class extends VexPayError {
+};
+var VexPayTimeoutError = class extends VexPayConnectionError {
+};
+var VexPaySignatureVerificationError = class extends VexPayError {
+};
+var MACHINE_CODE = /^[a-z][a-z0-9_]*$/;
+function messageFrom(body, status) {
+  if (body && typeof body === "object") {
+    const { message, error } = body;
+    if (Array.isArray(message)) return message.join("; ");
+    if (typeof message === "string" && message) return message;
+    if (typeof error === "string" && error) return error;
+  }
+  if (typeof body === "string" && body) return body;
+  return `VEXPay API responded with HTTP ${status}`;
+}
+function errorFromResponse(status, body, requestId) {
+  const rawCode = body && typeof body === "object" ? body.error : void 0;
+  const code = typeof rawCode === "string" && MACHINE_CODE.test(rawCode) ? rawCode : void 0;
+  const details = { status, code, body, requestId };
+  const message = messageFrom(body, status);
+  if (status === 401) return new VexPayAuthenticationError(message, details);
+  if (status === 404) return new VexPayNotFoundError(message, details);
+  if (status === 409) return new VexPayConflictError(message, details);
+  if (status === 429) return new VexPayRateLimitError(message, details);
+  if (status >= 500) return new VexPayAPIError(message, details);
+  return new VexPayInvalidRequestError(message, details);
+}
+
+// src/version.ts
+var VERSION = "0.1.0";
+
+// src/core.ts
+var INITIAL_RETRY_DELAY_MS = 500;
+var MAX_RETRY_DELAY_MS = 8e3;
+var MAX_RETRY_AFTER_MS = 6e4;
+function defaultSleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function userAgent() {
+  const runtime = typeof process !== "undefined" && process.version ? ` node/${process.version}` : "";
+  return `vexpay-node/${VERSION}${runtime}`;
+}
+function parseRetryAfter(value, now = Date.now()) {
+  if (!value) return void 0;
+  const seconds = Number(value);
+  if (Number.isFinite(seconds) && seconds >= 0) return Math.min(seconds * 1e3, MAX_RETRY_AFTER_MS);
+  const date = Date.parse(value);
+  if (Number.isFinite(date)) return Math.min(Math.max(0, date - now), MAX_RETRY_AFTER_MS);
+  return void 0;
+}
+function backoffDelay(attempt, random = Math.random) {
+  const ceiling = Math.min(INITIAL_RETRY_DELAY_MS * 2 ** attempt, MAX_RETRY_DELAY_MS);
+  return Math.round(ceiling / 2 + random() * (ceiling / 2));
+}
+function isRetryable(error) {
+  if (error instanceof VexPayConnectionError) return true;
+  if (error.status === 429) return true;
+  if (error.status !== void 0 && error.status >= 500) return true;
+  return error.status === 409 && error.code === "idempotency_request_in_progress";
+}
+function buildUrl(baseUrl, path, query) {
+  const url = new URL(path.replace(/^\//, ""), baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`);
+  for (const [key, value] of Object.entries(query ?? {})) {
+    if (value !== void 0 && value !== null) url.searchParams.set(key, String(value));
+  }
+  return url.toString();
+}
+async function readBody(response) {
+  const text = await response.text();
+  if (!text) return void 0;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+var HttpClient = class {
+  constructor(config) {
+    this.config = config;
+    this.sleep = config.sleep ?? defaultSleep;
+  }
+  sleep;
+  async request(method, path, params = {}, options = {}) {
+    const maxRetries = options.maxNetworkRetries ?? this.config.maxNetworkRetries;
+    const timeoutMs = options.timeoutMs ?? this.config.timeoutMs;
+    const url = buildUrl(this.config.baseUrl, path, params.query);
+    const headers = {
+      accept: "application/json",
+      "x-api-key": this.config.apiKey,
+      "user-agent": userAgent()
+    };
+    if (params.body !== void 0) headers["content-type"] = "application/json";
+    if (method === "POST") headers["idempotency-key"] = options.idempotencyKey ?? crypto.randomUUID();
+    const body = params.body === void 0 ? void 0 : JSON.stringify(params.body);
+    for (let attempt = 0; ; attempt += 1) {
+      let error;
+      let retryAfterMs;
+      try {
+        const response = await this.send(url, { method, headers, body }, timeoutMs, options.signal);
+        const parsed = await readBody(response);
+        if (response.ok) return parsed;
+        error = errorFromResponse(response.status, parsed, response.headers.get("x-request-id") ?? void 0);
+        retryAfterMs = parseRetryAfter(response.headers.get("retry-after"));
+      } catch (caught) {
+        if (!(caught instanceof VexPayError)) throw caught;
+        error = caught;
+      }
+      if (attempt >= maxRetries || !isRetryable(error) || options.signal?.aborted) throw error;
+      await this.sleep(retryAfterMs ?? backoffDelay(attempt));
+    }
+  }
+  async send(url, init, timeoutMs, signal) {
+    const controller = new AbortController();
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      controller.abort();
+    }, timeoutMs);
+    const onAbort = () => controller.abort();
+    signal?.addEventListener("abort", onAbort, { once: true });
+    try {
+      return await this.config.fetch(url, { ...init, signal: controller.signal });
+    } catch (caught) {
+      if (timedOut) {
+        throw new VexPayTimeoutError(`Request to VEXPay timed out after ${timeoutMs}ms`);
+      }
+      if (signal?.aborted) throw caught;
+      const reason = caught instanceof Error ? caught.message : String(caught);
+      throw new VexPayConnectionError(`Could not reach VEXPay: ${reason}`);
+    } finally {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", onAbort);
+    }
+  }
+};
+
+// src/pagination.ts
+var PagePromise = class {
+  constructor(fetchPage, startCursor) {
+    this.fetchPage = fetchPage;
+    this.startCursor = startCursor;
+  }
+  firstPage;
+  first() {
+    return this.firstPage ??= this.fetchPage(this.startCursor);
+  }
+  then(onfulfilled, onrejected) {
+    return this.first().then(onfulfilled, onrejected);
+  }
+  catch(onrejected) {
+    return this.first().catch(onrejected);
+  }
+  finally(onfinally) {
+    return this.first().finally(onfinally);
+  }
+  async *[Symbol.asyncIterator]() {
+    let page = await this.first();
+    let cursor = this.startCursor;
+    for (; ; ) {
+      for (const item of page.items) yield item;
+      const next = page.nextCursor;
+      if (!next || next === cursor) return;
+      cursor = next;
+      page = await this.fetchPage(next);
+    }
+  }
+  /** Collects items across pages, stopping after `limit` (default 10 000). */
+  async autoPagingToArray({ limit = 1e4 } = {}) {
+    const items = [];
+    for await (const item of this) {
+      items.push(item);
+      if (items.length >= limit) break;
+    }
+    return items;
+  }
+};
+
+// src/generated/routes.ts
+var ROUTES = {
+  Balance_getBalance: { method: "GET", path: "/v1/balance" },
+  CheckoutSessions_create: { method: "POST", path: "/v1/checkout/sessions" },
+  CheckoutSessions_retrieve: { method: "GET", path: "/v1/checkout/sessions/{id}" },
+  Merchants_addPayoutMethod: { method: "POST", path: "/v1/merchants/{id}/payout-methods" },
+  Merchants_confirmVerify: { method: "POST", path: "/v1/merchants/{id}/verify" },
+  Merchants_confirmVerifyMethod: { method: "POST", path: "/v1/merchants/{id}/payout-methods/{methodId}/verify" },
+  Merchants_create: { method: "POST", path: "/v1/merchants" },
+  Merchants_deletePayoutMethod: { method: "DELETE", path: "/v1/merchants/{id}/payout-methods/{methodId}" },
+  Merchants_getBalance: { method: "GET", path: "/v1/merchants/{id}/balance" },
+  Merchants_getById: { method: "GET", path: "/v1/merchants/{id}" },
+  Merchants_listAuditEvents: { method: "GET", path: "/v1/merchants/{id}/audit-events" },
+  Merchants_listOrGetByRef: { method: "GET", path: "/v1/merchants" },
+  Merchants_listPayoutMethods: { method: "GET", path: "/v1/merchants/{id}/payout-methods" },
+  Merchants_remove: { method: "DELETE", path: "/v1/merchants/{id}" },
+  Merchants_setDefaultPayoutMethod: { method: "POST", path: "/v1/merchants/{id}/payout-methods/{methodId}/default" },
+  Merchants_startVerify: { method: "POST", path: "/v1/merchants/{id}/verify/start" },
+  Merchants_startVerifyMethod: { method: "POST", path: "/v1/merchants/{id}/payout-methods/{methodId}/verify/start" },
+  Merchants_transfer: { method: "POST", path: "/v1/merchants/{id}/transfers" },
+  Merchants_update: { method: "PATCH", path: "/v1/merchants/{id}" },
+  Notifications_sendTest: { method: "POST", path: "/v1/notifications/test" },
+  PaymentLinks_get: { method: "GET", path: "/v1/payment-links/{id}" },
+  PaymentLinks_remove: { method: "DELETE", path: "/v1/payment-links/{id}" },
+  PaymentLinks_update: { method: "PATCH", path: "/v1/payment-links/{id}" },
+  Payments_executeC2p: { method: "POST", path: "/v1/payments/c2p" },
+  Payments_executeVpos: { method: "POST", path: "/v1/payments/vpos" },
+  Payments_getBanks: { method: "GET", path: "/v1/banks" },
+  Payments_getPayment: { method: "GET", path: "/v1/payments/{id}" },
+  Payments_getPaymentByRef: { method: "GET", path: "/v1/payments/by-ref/{externalRef}" },
+  Payments_getQuote: { method: "GET", path: "/v1/quote" },
+  Payments_requestC2p: { method: "POST", path: "/v1/payments/c2p/request" },
+  Payments_reversePayment: { method: "POST", path: "/v1/payments/{id}/reverse" },
+  Payments_verifyPagoMovil: { method: "POST", path: "/v1/payments/pago-movil/verify" },
+  Payouts_create: { method: "POST", path: "/v1/payouts" },
+  Payouts_createBatch: { method: "POST", path: "/v1/payouts/batch" },
+  Payouts_createInstant: { method: "POST", path: "/v1/payouts/instant" },
+  Payouts_getById: { method: "GET", path: "/v1/payouts/{id}" },
+  Payouts_getByRef: { method: "GET", path: "/v1/payouts/by-ref/{externalRef}" },
+  Payouts_list: { method: "GET", path: "/v1/payouts" },
+  Products_create: { method: "POST", path: "/v1/products" },
+  Products_createLink: { method: "POST", path: "/v1/products/{id}/links" },
+  Products_get: { method: "GET", path: "/v1/products/{id}" },
+  Products_list: { method: "GET", path: "/v1/products" },
+  Products_listLinks: { method: "GET", path: "/v1/products/{id}/links" },
+  Products_remove: { method: "DELETE", path: "/v1/products/{id}" },
+  Products_update: { method: "PATCH", path: "/v1/products/{id}" },
+  R4Operations_consultarOperacion: { method: "GET", path: "/v1/payments/operations/{id}" },
+  R4Operations_creditoCuentas: { method: "POST", path: "/v1/payments/credit/account" },
+  R4Operations_creditoInmediato: { method: "POST", path: "/v1/payments/credit" },
+  R4Operations_debitoInmediato: { method: "POST", path: "/v1/payments/debit" },
+  R4Operations_dispersarCredito: { method: "POST", path: "/v1/payments/credit/disburse" },
+  R4Operations_dispersarPagos: { method: "POST", path: "/v1/payments/payouts" },
+  R4Operations_ejecutarVuelto: { method: "POST", path: "/v1/payments/change" },
+  R4Operations_generarOtp: { method: "POST", path: "/v1/payments/debit/otp" },
+  R4Operations_pollOperation: { method: "POST", path: "/v1/payments/operations/poll" },
+  TenantPayoutAccount_confirmVerify: { method: "POST", path: "/v1/tenant/payout-account/verify" },
+  TenantPayoutAccount_get: { method: "GET", path: "/v1/tenant/payout-account" },
+  TenantPayoutAccount_startVerify: { method: "POST", path: "/v1/tenant/payout-account/verify/start" },
+  TenantPayoutAccount_upsert: { method: "PUT", path: "/v1/tenant/payout-account" },
+  TenantPayoutAccount_upsertPost: { method: "POST", path: "/v1/tenant/payout-account" },
+  Webhooks_createWebhook: { method: "POST", path: "/v1/webhooks" },
+  Webhooks_deleteWebhook: { method: "DELETE", path: "/v1/webhooks/{id}" },
+  Webhooks_listWebhooks: { method: "GET", path: "/v1/webhooks" },
+  Webhooks_updateWebhook: { method: "PATCH", path: "/v1/webhooks/{id}" }
+};
+
+// src/resource.ts
+var APIResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /** Async so a bad argument surfaces as a rejected promise, never a synchronous throw. */
+  async call(operationId, args = {}, options) {
+    const route = ROUTES[operationId];
+    const path = route.path.replace(/\{(\w+)\}/g, (_match, name) => {
+      const value = args.path?.[name];
+      if (typeof value !== "string" || value === "") {
+        throw new VexPayInvalidRequestError(`Missing required path parameter "${name}" for ${operationId}.`);
+      }
+      return encodeURIComponent(value);
+    });
+    return this.http.request(
+      route.method,
+      path,
+      { query: args.query, body: args.body },
+      options
+    );
+  }
+};
+
+// src/resources/account.ts
+var Banks = class extends APIResource {
+  list(options) {
+    return this.call("Payments_getBanks", {}, options);
+  }
+};
+var Quotes = class extends APIResource {
+  retrieve(params, options) {
+    return this.call("Payments_getQuote", { query: params }, options);
+  }
+};
+var Balance = class extends APIResource {
+  retrieve(options) {
+    return this.call("Balance_getBalance", {}, options);
+  }
+};
+var Payouts = class extends APIResource {
+  create(params, options) {
+    return this.call("Payouts_create", { body: params }, options);
+  }
+  /** Pay out immediately (crédito inmediato). */
+  createInstant(params, options) {
+    return this.call("Payouts_createInstant", { body: params }, options);
+  }
+  /** Many payouts in one request, with item-level idempotency. */
+  createBatch(params, options) {
+    return this.call("Payouts_createBatch", { body: params }, options);
+  }
+  /** Await for one page, or `for await` over every payout. */
+  list(params = {}, options) {
+    return new PagePromise(
+      (cursor) => this.call("Payouts_list", { query: { ...params, cursor } }, options),
+      params.cursor
+    );
+  }
+  retrieve(id, options) {
+    return this.call("Payouts_getById", { path: { id } }, options);
+  }
+  retrieveByRef(externalRef, options) {
+    return this.call("Payouts_getByRef", { path: { externalRef } }, options);
+  }
+};
+var TenantPayoutAccount = class extends APIResource {
+  retrieve(options) {
+    return this.call("TenantPayoutAccount_get", {}, options);
+  }
+  /** Create or replace the payout account (PUT). */
+  upsert(params, options) {
+    return this.call("TenantPayoutAccount_upsert", { body: params }, options);
+  }
+  /** Same as `upsert`, sent as POST (supports `Idempotency-Key`). */
+  create(params, options) {
+    return this.call("TenantPayoutAccount_upsertPost", { body: params }, options);
+  }
+  startVerification(options) {
+    return this.call("TenantPayoutAccount_startVerify", {}, options);
+  }
+  confirmVerification(params, options) {
+    return this.call("TenantPayoutAccount_confirmVerify", { body: params }, options);
+  }
+};
+var WebhookEndpoints = class extends APIResource {
+  /** The response includes the signing `secret` — store it to verify deliveries. */
+  create(params, options) {
+    return this.call("Webhooks_createWebhook", { body: params }, options);
+  }
+  list(options) {
+    return this.call("Webhooks_listWebhooks", {}, options);
+  }
+  update(id, params, options) {
+    return this.call("Webhooks_updateWebhook", { path: { id }, body: params }, options);
+  }
+  delete(id, options) {
+    return this.call("Webhooks_deleteWebhook", { path: { id } }, options);
+  }
+  /** Send a `notification.test` delivery to your endpoints. */
+  sendTest(options) {
+    return this.call("Notifications_sendTest", {}, options);
+  }
+};
+
+// src/resources/commerce.ts
+var CheckoutSessions = class extends APIResource {
+  /** `clientSecret` is returned only here — hand it to the browser, never store or log it. */
+  create(params, options) {
+    return this.call("CheckoutSessions_create", { body: params }, options);
+  }
+  retrieve(id, options) {
+    return this.call("CheckoutSessions_retrieve", { path: { id } }, options);
+  }
+};
+var Checkout = class extends APIResource {
+  sessions = new CheckoutSessions(this.http);
+};
+var Products = class extends APIResource {
+  create(params, options) {
+    return this.call("Products_create", { body: params }, options);
+  }
+  /** Await for one page, or `for await` over every product. */
+  list(params = {}, options) {
+    return new PagePromise(
+      (cursor) => this.call("Products_list", { query: { ...params, cursor } }, options),
+      params.cursor
+    );
+  }
+  retrieve(id, options) {
+    return this.call("Products_get", { path: { id } }, options);
+  }
+  update(id, params, options) {
+    return this.call("Products_update", { path: { id }, body: params }, options);
+  }
+  delete(id, options) {
+    return this.call("Products_remove", { path: { id } }, options);
+  }
+  /** Publish a shareable `/pay/:slug` link for this product. */
+  createLink(id, params, options) {
+    return this.call("Products_createLink", { path: { id }, body: params }, options);
+  }
+  listLinks(id, options) {
+    return this.call("Products_listLinks", { path: { id } }, options);
+  }
+};
+var PaymentLinks = class extends APIResource {
+  retrieve(id, options) {
+    return this.call("PaymentLinks_get", { path: { id } }, options);
+  }
+  update(id, params, options) {
+    return this.call("PaymentLinks_update", { path: { id }, body: params }, options);
+  }
+  delete(id, options) {
+    return this.call("PaymentLinks_remove", { path: { id } }, options);
+  }
+};
+
+// src/resources/merchants.ts
+var PayoutMethods = class extends APIResource {
+  list(merchantId, options) {
+    return this.call("Merchants_listPayoutMethods", { path: { id: merchantId } }, options);
+  }
+  create(merchantId, params, options) {
+    return this.call("Merchants_addPayoutMethod", { path: { id: merchantId }, body: params }, options);
+  }
+  setDefault(merchantId, methodId, options) {
+    return this.call("Merchants_setDefaultPayoutMethod", { path: { id: merchantId, methodId } }, options);
+  }
+  delete(merchantId, methodId, options) {
+    return this.call("Merchants_deletePayoutMethod", { path: { id: merchantId, methodId } }, options);
+  }
+  /** Send micro-deposits to this payout method. */
+  startVerification(merchantId, methodId, options) {
+    return this.call("Merchants_startVerifyMethod", { path: { id: merchantId, methodId } }, options);
+  }
+  /** Confirm the micro-deposit amounts the merchant saw. */
+  confirmVerification(merchantId, methodId, params, options) {
+    return this.call(
+      "Merchants_confirmVerifyMethod",
+      { path: { id: merchantId, methodId }, body: params },
+      options
+    );
+  }
+};
+var Merchants = class extends APIResource {
+  payoutMethods = new PayoutMethods(this.http);
+  /** `externalRef` is required and is the idempotency key for merchant creation. */
+  create(params, options) {
+    return this.call("Merchants_create", { body: params }, options);
+  }
+  /** Await for one page (`items`, `nextCursor`), or `for await` over every merchant. */
+  list(params = {}, options) {
+    return new PagePromise(
+      (cursor) => this.call("Merchants_listOrGetByRef", { query: { ...params, cursor } }, options),
+      params.cursor
+    );
+  }
+  retrieve(id, options) {
+    return this.call("Merchants_getById", { path: { id } }, options);
+  }
+  /** Look up a merchant by the `externalRef` you created it with. */
+  retrieveByRef(externalRef, options) {
+    return this.call("Merchants_listOrGetByRef", { query: { externalRef } }, options);
+  }
+  update(id, params, options) {
+    return this.call("Merchants_update", { path: { id }, body: params }, options);
+  }
+  delete(id, options) {
+    return this.call("Merchants_remove", { path: { id } }, options);
+  }
+  retrieveBalance(id, options) {
+    return this.call("Merchants_getBalance", { path: { id } }, options);
+  }
+  /** Move VES between this merchant's balance and another. */
+  transfer(id, params, options) {
+    return this.call("Merchants_transfer", { path: { id }, body: params }, options);
+  }
+  listAuditEvents(id, options) {
+    return this.call("Merchants_listAuditEvents", { path: { id } }, options);
+  }
+  /** Send micro-deposits to the merchant's default payout method. */
+  startVerification(id, options) {
+    return this.call("Merchants_startVerify", { path: { id } }, options);
+  }
+  confirmVerification(id, params, options) {
+    return this.call("Merchants_confirmVerify", { path: { id }, body: params }, options);
+  }
+};
+
+// src/resources/payments.ts
+var C2p = class extends APIResource {
+  /** Create a C2P intent; the payer's bank sends them a token (R4 also triggers the SMS). */
+  request(params, options) {
+    return this.call("Payments_requestC2p", { body: params }, options);
+  }
+  /** Charge with the bank-issued token. Pass `intentId` from `request()`. */
+  execute(params, options) {
+    return this.call("Payments_executeC2p", { body: params }, options);
+  }
+};
+var Vpos = class extends APIResource {
+  create(params, options) {
+    return this.call("Payments_executeVpos", { body: params }, options);
+  }
+};
+var PagoMovil = class extends APIResource {
+  verify(params, options) {
+    return this.call("Payments_verifyPagoMovil", { body: params }, options);
+  }
+};
+var Debit = class extends APIResource {
+  requestOtp(params, options) {
+    return this.call("R4Operations_generarOtp", { body: params }, options);
+  }
+  execute(params, options) {
+    return this.call("R4Operations_debitoInmediato", { body: params }, options);
+  }
+};
+var Credit = class extends APIResource {
+  /** Instant credit to a Pago Móvil phone. */
+  create(params, options) {
+    return this.call("R4Operations_creditoInmediato", { body: params }, options);
+  }
+  /** Instant credit to a bank account. */
+  toAccount(params, options) {
+    return this.call("R4Operations_creditoCuentas", { body: params }, options);
+  }
+  /** Disburse one credit across several recipients. */
+  disburse(params, options) {
+    return this.call("R4Operations_dispersarCredito", { body: params }, options);
+  }
+};
+var Operations = class extends APIResource {
+  retrieve(id, options) {
+    return this.call("R4Operations_consultarOperacion", { path: { id } }, options);
+  }
+  /** Re-check a pending operation with the bank now. */
+  poll(params, options) {
+    return this.call("R4Operations_pollOperation", { body: params }, options);
+  }
+};
+var Dispersals = class extends APIResource {
+  create(params, options) {
+    return this.call("R4Operations_dispersarPagos", { body: params }, options);
+  }
+};
+var Change = class extends APIResource {
+  create(params, options) {
+    return this.call("R4Operations_ejecutarVuelto", { body: params }, options);
+  }
+};
+var Payments = class extends APIResource {
+  c2p = new C2p(this.http);
+  vpos = new Vpos(this.http);
+  pagoMovil = new PagoMovil(this.http);
+  debit = new Debit(this.http);
+  credit = new Credit(this.http);
+  operations = new Operations(this.http);
+  dispersals = new Dispersals(this.http);
+  change = new Change(this.http);
+  retrieve(id, options) {
+    return this.call("Payments_getPayment", { path: { id } }, options);
+  }
+  /** Look up a payment by the `externalRef` you sent. */
+  retrieveByRef(externalRef, options) {
+    return this.call("Payments_getPaymentByRef", { path: { externalRef } }, options);
+  }
+  /** Reverse a completed C2P payment. */
+  reverse(id, options) {
+    return this.call("Payments_reversePayment", { path: { id } }, options);
+  }
+};
+
+// src/webhooks.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var WEBHOOK_EVENT_NAMES = [
+  "payment.pending",
+  "payment.completed",
+  "payment.failed",
+  "payment.canceled",
+  "payment.reversed",
+  "merchant.verified",
+  "merchant.rejected",
+  "merchant.deactivated",
+  "merchant.reactivated",
+  "merchant.balance.updated",
+  "merchant.created",
+  "merchant.activated",
+  "merchant.updated",
+  "merchant.kyb_required",
+  "merchant.restricted",
+  "merchant.capability.updated",
+  "merchant.wallet_credit",
+  "payout.completed",
+  "payout.failed",
+  "tenant.status_changed",
+  "tenant.api_key.created",
+  "tenant.api_key.rotated",
+  "tenant.api_key.revoked",
+  "notification.test"
+];
+var SIGNATURE_HEADER = "VexPay-Signature";
+var DEFAULT_TOLERANCE_SECONDS = 300;
+var RAW_BODY_HINT = 'Pass the raw request body exactly as received (string or Buffer). Parsing and re-serializing JSON \u2014 e.g. JSON.stringify(req.body) \u2014 changes the bytes and breaks the signature. In Express use express.raw({ type: "application/json" }) on the webhook route.';
+function sign(secret, timestamp, payload) {
+  return createHmac("sha256", secret).update(`${timestamp}.${payload}`, "utf8").digest("hex");
+}
+function parseHeader(header) {
+  let timestamp;
+  const signatures = [];
+  for (const part of header.split(",")) {
+    const index = part.indexOf("=");
+    if (index <= 0) return null;
+    const key = part.slice(0, index).trim();
+    const value = part.slice(index + 1).trim();
+    if (key === "t") timestamp = value;
+    else if (key === "v1") signatures.push(value);
+  }
+  if (!timestamp || !/^\d+$/.test(timestamp)) return null;
+  return { timestamp: Number(timestamp), signatures };
+}
+function safeEqualHex(expected, actual) {
+  const a = Buffer.from(expected, "utf8");
+  const b = Buffer.from(actual, "utf8");
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+var Webhooks = class {
+  /**
+   * Verifies a delivery's `VexPay-Signature` header and returns the parsed event.
+   * Throws VexPaySignatureVerificationError on a bad signature or a stale timestamp.
+   */
+  constructEvent(rawBody, signatureHeader, secret, options = {}) {
+    if (typeof rawBody !== "string" && !(rawBody instanceof Uint8Array)) {
+      throw new VexPaySignatureVerificationError(`Webhook payload must be the raw body. ${RAW_BODY_HINT}`);
+    }
+    if (!secret) {
+      throw new VexPaySignatureVerificationError("A webhook signing secret is required.");
+    }
+    const payload = typeof rawBody === "string" ? rawBody : Buffer.from(rawBody).toString("utf8");
+    const header = Array.isArray(signatureHeader) ? signatureHeader[0] : signatureHeader;
+    const parsed = header ? parseHeader(header) : null;
+    if (!parsed) {
+      throw new VexPaySignatureVerificationError(
+        `Unable to parse the ${SIGNATURE_HEADER} header. Expected "t=<timestamp>,v1=<signature>".`
+      );
+    }
+    if (parsed.signatures.length === 0) {
+      throw new VexPaySignatureVerificationError(`No v1 signatures found in the ${SIGNATURE_HEADER} header.`);
+    }
+    const tolerance = options.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS;
+    const now = options.now ?? Math.floor(Date.now() / 1e3);
+    if (tolerance > 0 && Math.abs(now - parsed.timestamp) > tolerance) {
+      throw new VexPaySignatureVerificationError(
+        `Webhook timestamp is outside the ${tolerance}s tolerance \u2014 possible replay. Check your server clock if this repeats.`
+      );
+    }
+    const expected = sign(secret, parsed.timestamp, payload);
+    if (!parsed.signatures.some((candidate) => safeEqualHex(expected, candidate))) {
+      throw new VexPaySignatureVerificationError(
+        `No signature matches the expected signature for this payload. Check the endpoint secret. ${RAW_BODY_HINT}`
+      );
+    }
+    try {
+      return JSON.parse(payload);
+    } catch {
+      throw new VexPaySignatureVerificationError("Webhook payload is not valid JSON.");
+    }
+  }
+  /** Builds a valid `VexPay-Signature` value — for your own tests. */
+  generateTestHeader({
+    payload,
+    secret,
+    timestamp = Math.floor(Date.now() / 1e3)
+  }) {
+    return `t=${timestamp},v1=${sign(secret, timestamp, payload)}`;
+  }
+};
+
+// src/client.ts
+var DEFAULT_BASE_URL = "https://api.pay.vexwallet.co";
+var VexPay = class {
+  /** @internal */
+  http;
+  banks;
+  quotes;
+  balance;
+  payments;
+  checkout;
+  merchants;
+  payouts;
+  products;
+  paymentLinks;
+  tenantPayoutAccount;
+  webhookEndpoints;
+  /** Offline helpers: `constructEvent` verifies deliveries; no API calls. */
+  webhooks = new Webhooks();
+  constructor(apiKey, options = {}) {
+    if (typeof apiKey !== "string" || apiKey.trim() === "") {
+      throw new VexPayConfigurationError(
+        "A VEXPay API key is required: new VexPay(process.env.VEXPAY_API_KEY)."
+      );
+    }
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    if (typeof fetchImpl !== "function") {
+      throw new VexPayConfigurationError("No fetch implementation found. Use Node.js 20+ or pass options.fetch.");
+    }
+    const config = {
+      apiKey: apiKey.trim(),
+      baseUrl: options.baseUrl ?? DEFAULT_BASE_URL,
+      timeoutMs: options.timeoutMs ?? 3e4,
+      maxNetworkRetries: options.maxNetworkRetries ?? 2,
+      fetch: fetchImpl.bind(globalThis)
+    };
+    this.http = new HttpClient(config);
+    this.banks = new Banks(this.http);
+    this.quotes = new Quotes(this.http);
+    this.balance = new Balance(this.http);
+    this.payments = new Payments(this.http);
+    this.checkout = new Checkout(this.http);
+    this.merchants = new Merchants(this.http);
+    this.payouts = new Payouts(this.http);
+    this.products = new Products(this.http);
+    this.paymentLinks = new PaymentLinks(this.http);
+    this.tenantPayoutAccount = new TenantPayoutAccount(this.http);
+    this.webhookEndpoints = new WebhookEndpoints(this.http);
+  }
+};
+export {
+  DEFAULT_BASE_URL,
+  DEFAULT_TOLERANCE_SECONDS,
+  PagePromise,
+  SIGNATURE_HEADER,
+  VERSION,
+  VexPay,
+  VexPayAPIError,
+  VexPayAuthenticationError,
+  VexPayConfigurationError,
+  VexPayConflictError,
+  VexPayConnectionError,
+  VexPayError,
+  VexPayInvalidRequestError,
+  VexPayNotFoundError,
+  VexPayRateLimitError,
+  VexPaySignatureVerificationError,
+  VexPayTimeoutError,
+  WEBHOOK_EVENT_NAMES,
+  Webhooks,
+  VexPay as default
+};
+//# sourceMappingURL=index.js.map