@vivoa/partner-sdk 0.1.0

package/dist/cjs/adapters/in-memory/fake-vivoa.js

@@ -0,0 +1,468 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FakeVivoa = void 0;
+const node_crypto_1 = require("node:crypto");
+const node_crypto_ts_1 = require("../node-crypto.js");
+const system_clock_ts_1 = require("../system-clock.js");
+const errors_ts_1 = require("../../domain/errors.js");
+const signature_ts_1 = require("../../domain/signature.js");
+const merchant_ts_1 = require("../../domain/merchant.js");
+const webhook_ts_1 = require("../../domain/webhook.js");
+class HttpError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+/** `POST /merchants` body — matches CreateMerchantDto's whitelist exactly (a stale `handle` 400s, like on the real platform). */
+const CREATE_MERCHANT_KEYS = new Set(['email', 'name', 'countries', 'industry', 'externalId']);
+/** Mirrors `shared/utils/slugify.ts` on the platform closely enough for a fake. */
+function slugify(value) {
+    return value
+        .toLowerCase()
+        .normalize('NFD')
+        .replace(/[̀-ͯ]/g, '')
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/(^-|-$)/g, '')
+        .slice(0, 40);
+}
+const REASON = {
+    400: 'Bad Request',
+    401: 'Unauthorized',
+    403: 'Forbidden',
+    404: 'Not Found',
+    409: 'Conflict',
+    429: 'Too Many Requests',
+    500: 'Internal Server Error',
+};
+/**
+ * In-memory Vivoa Partner API behind the `HttpTransport` port. It verifies the
+ * real HMAC signature and enforces the same rules as the platform
+ * (`engine/partner-api`): quota, allowed countries, unique handle, active-only
+ * writes, fleet scoping, activation state machine and per-minute rate limit.
+ * The shared contract suite (`test/contract`) runs against this fake AND the
+ * live API, so the two cannot silently drift.
+ */
+class FakeVivoa {
+    clock;
+    activation;
+    pollsUntilLive;
+    failureReason;
+    crypto;
+    onWebhook;
+    operators = new Map();
+    merchants = new Map();
+    handles = new Set();
+    constructor(options = {}) {
+        this.clock = options.clock ?? system_clock_ts_1.systemClock;
+        this.crypto = options.crypto ?? node_crypto_ts_1.nodeCrypto;
+        this.activation = options.activation ?? 'live';
+        this.pollsUntilLive = options.pollsUntilLive ?? 2;
+        this.failureReason = options.failureReason ?? 'droplet pool exhausted';
+        this.onWebhook = options.onWebhook;
+        for (const handle of options.takenHandles ?? [])
+            this.handles.add(handle);
+        for (const seed of options.operators ?? [])
+            this.addOperator(seed);
+    }
+    addOperator(seed) {
+        const state = {
+            name: 'Fake Partner',
+            status: 'active',
+            plan: 'starter',
+            maxStores: 3,
+            allowedRegions: ['SV'],
+            rateLimitPerMin: 60,
+            ...seed,
+            id: `op_${(0, node_crypto_1.randomUUID)().slice(0, 8)}`,
+            window: { startMs: 0, count: 0 },
+            webhook: null,
+            deliveries: [],
+        };
+        this.operators.set(seed.apiKey, state);
+        return this.profile(state);
+    }
+    setOperatorStatus(apiKey, status) {
+        this.requireOperatorByKey(apiKey).status = status;
+    }
+    /** Test helper: flip a merchant's runtime (e.g. simulate ops tearing it down). */
+    setRuntime(merchantId, runtime) {
+        const m = this.merchants.get(merchantId);
+        if (m)
+            m.runtime = runtime;
+    }
+    async send(req) {
+        try {
+            const url = new URL(req.url);
+            const operator = await this.authenticate(req, url.pathname);
+            this.rateLimit(operator);
+            const result = await this.route(operator, req.method, url, req.body);
+            return json(200, result);
+        }
+        catch (err) {
+            if (err instanceof errors_ts_1.VivoaNetworkError)
+                throw err;
+            if (err instanceof HttpError) {
+                return json(err.status, { statusCode: err.status, message: err.message, error: REASON[err.status] });
+            }
+            return json(500, { statusCode: 500, message: err.message, error: REASON[500] });
+        }
+    }
+    // ── auth (mirrors core/partner/guards) ──────────────────────────────────
+    async authenticate(req, path) {
+        const h = lower(req.headers);
+        const key = h[signature_ts_1.PARTNER_HEADERS.key];
+        const timestamp = h[signature_ts_1.PARTNER_HEADERS.timestamp];
+        const signature = h[signature_ts_1.PARTNER_HEADERS.signature];
+        if (!key || !timestamp || !signature)
+            throw new HttpError(401, 'Missing partner auth headers');
+        const ts = Number(timestamp);
+        if (!Number.isFinite(ts))
+            throw new HttpError(401, 'Invalid timestamp');
+        if (Math.abs(Math.floor(this.clock.nowMs() / 1000) - ts) > signature_ts_1.MAX_CLOCK_SKEW_SECONDS) {
+            throw new HttpError(401, 'Timestamp skew too large');
+        }
+        const operator = this.operators.get(key);
+        if (!operator)
+            throw new HttpError(401, 'Unknown partner key');
+        const expected = await this.crypto.hmacSha256Hex(operator.apiSecret, (0, signature_ts_1.canonicalRequestPayload)({
+            timestamp,
+            method: req.method,
+            path,
+            bodySha256Hex: await this.crypto.sha256Hex(req.body ?? ''),
+        }));
+        if (!(await this.crypto.timingSafeEqualHex(expected, signature))) {
+            throw new HttpError(401, 'Invalid signature');
+        }
+        return operator;
+    }
+    rateLimit(operator) {
+        const now = this.clock.nowMs();
+        if (now - operator.window.startMs >= 60_000)
+            operator.window = { startMs: now, count: 0 };
+        operator.window.count += 1;
+        if (operator.window.count > operator.rateLimitPerMin) {
+            throw new HttpError(429, `Rate limit of ${operator.rateLimitPerMin} req/min exceeded`);
+        }
+    }
+    requireActive(operator) {
+        if (operator.status !== 'active') {
+            throw new HttpError(403, `Operator is ${operator.status} — write operations require an active account`);
+        }
+    }
+    // ── routing (mirrors partner-api.controller.ts) ─────────────────────────
+    async route(op, method, url, rawBody) {
+        const path = url.pathname.replace(/^\/partner\/v1/, '');
+        const body = rawBody ? JSON.parse(rawBody) : {};
+        const merchantRoute = path.match(/^\/merchants\/([^/]+)\/(status|activate|suspend|reactivate)$/);
+        if (method === 'GET' && path === '/me')
+            return this.profile(op);
+        if (method === 'POST' && path === '/me/rotate-secret') {
+            this.requireActive(op);
+            op.apiSecret = (0, node_crypto_1.randomUUID)().replace(/-/g, '') + (0, node_crypto_1.randomUUID)().replace(/-/g, '');
+            return { apiSecret: op.apiSecret };
+        }
+        if (method === 'GET' && path === '/merchants')
+            return this.list(op, url.searchParams);
+        if (method === 'POST' && path === '/merchants') {
+            this.requireActive(op);
+            return this.create(op, body);
+        }
+        if (merchantRoute) {
+            const [, id, action] = merchantRoute;
+            const merchant = this.owned(op, decodeURIComponent(id));
+            if (method === 'GET' && action === 'status')
+                return this.statusView(merchant, true);
+            if (method === 'POST') {
+                this.requireActive(op);
+                if (action === 'activate')
+                    return this.activate(op, merchant);
+                if (action === 'suspend') {
+                    merchant.status = 'suspended';
+                    if (merchant.runtime !== 'not_activated')
+                        merchant.runtime = 'suspended';
+                    this.emit(op, 'merchant.suspended', merchant);
+                    return { storeId: merchant.id, status: 'suspended' };
+                }
+                if (action === 'reactivate') {
+                    merchant.status = 'active';
+                    if (merchant.runtime === 'suspended')
+                        merchant.runtime = 'live';
+                    this.emit(op, 'merchant.reactivated', merchant);
+                    return { storeId: merchant.id, status: 'active' };
+                }
+            }
+        }
+        if (method === 'GET' && path === '/fleet/analytics')
+            return this.analytics(op);
+        if (path === '/webhooks' || path.startsWith('/webhooks/'))
+            return this.webhookRoute(op, method, path, body, url);
+        throw new HttpError(404, `Cannot ${method} ${url.pathname}`);
+    }
+    create(op, body) {
+        const unknownKey = Object.keys(body).find((k) => !CREATE_MERCHANT_KEYS.has(k));
+        if (unknownKey)
+            throw new HttpError(400, `property ${unknownKey} should not exist`);
+        const email = String(body.email ?? '');
+        const name = String(body.name ?? '');
+        const countries = Array.isArray(body.countries) ? body.countries.map(String) : [];
+        const externalId = body.externalId === undefined ? undefined : String(body.externalId);
+        const problems = [];
+        if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email))
+            problems.push('email must be an email');
+        if (!name)
+            problems.push('name must be longer than or equal to 1 characters');
+        if (countries.length === 0)
+            problems.push('countries should not be empty');
+        if (externalId !== undefined && externalId.length > merchant_ts_1.MAX_EXTERNAL_ID_LENGTH) {
+            problems.push(`externalId must be shorter than or equal to ${merchant_ts_1.MAX_EXTERNAL_ID_LENGTH} characters`);
+        }
+        if (problems.length)
+            throw new HttpError(400, problems.join('; '));
+        // Idempotent replay BEFORE quota/region checks — mirrors the platform.
+        if (externalId) {
+            const existing = this.fleet(op).find((m) => m.externalId === externalId);
+            if (existing)
+                return publicMerchant(existing);
+        }
+        if (this.fleet(op).length >= op.maxStores) {
+            throw new HttpError(403, `Operator '${op.name}' has reached the store limit of ${op.maxStores} for plan '${op.plan}'`);
+        }
+        const forbidden = countries.filter((c) => !op.allowedRegions.includes(c));
+        if (forbidden.length) {
+            throw new HttpError(400, `Countries not allowed for this operator: ${forbidden.join(', ')}. Allowed: ${op.allowedRegions.join(', ')}`);
+        }
+        const merchant = {
+            id: (0, node_crypto_1.randomUUID)().replace(/-/g, '').slice(0, 24),
+            name,
+            handle: this.allocateHandle(name),
+            status: 'active',
+            runtime: 'not_activated',
+            countries,
+            plan: 'basic',
+            domain: null,
+            ownerEmail: email,
+            externalId: externalId ?? null,
+            createdAt: new Date(this.clock.nowMs()).toISOString(),
+            operatorId: op.id,
+            pollsLeft: 0,
+        };
+        this.handles.add(merchant.handle);
+        this.merchants.set(merchant.id, merchant);
+        this.emit(op, 'merchant.created', merchant, { externalId: merchant.externalId });
+        return publicMerchant(merchant);
+    }
+    /**
+     * Mirrors `StoreService.allocateHandle`: the readable slug of `name` first,
+     * a random `-xxxx` suffix if it (or a seeded `takenHandles` entry) is
+     * already used. The platform assigns this — a partner never sends one.
+     */
+    allocateHandle(name) {
+        const base = slugify(name) || 'tienda';
+        if (!this.handles.has(base))
+            return base;
+        for (let attempt = 0; attempt < 8; attempt++) {
+            const suffix = (0, node_crypto_1.randomUUID)().replace(/-/g, '').slice(0, 4);
+            const candidate = `${base.slice(0, 34)}-${suffix}`;
+            if (!this.handles.has(candidate))
+                return candidate;
+        }
+        throw new HttpError(500, `Could not allocate a free handle for "${name}"`);
+    }
+    activate(op, m) {
+        if (m.runtime === 'creating' || m.runtime === 'live' || m.runtime === 'suspended') {
+            throw new HttpError(409, m.runtime === 'suspended'
+                ? `Merchant '${m.handle}' is suspended — use reactivate instead`
+                : `Merchant '${m.handle}' is already ${m.runtime}`);
+        }
+        switch (this.activation) {
+            case 'fail':
+                m.runtime = 'failed';
+                this.emit(op, 'merchant.failed', m, { reason: this.failureReason });
+                throw new HttpError(500, this.failureReason);
+            case 'slow':
+                m.runtime = 'creating';
+                m.pollsLeft = this.pollsUntilLive;
+                return this.statusView(m, false);
+            case 'drop':
+                m.runtime = 'creating';
+                m.pollsLeft = this.pollsUntilLive;
+                throw new errors_ts_1.VivoaNetworkError('POST activate: socket hang up');
+            default:
+                this.goLive(m);
+                return this.statusView(m, false);
+        }
+    }
+    goLive(m) {
+        m.runtime = 'live';
+        m.domain = `${m.handle}.vivoa.store`;
+        const op = [...this.operators.values()].find((o) => o.id === m.operatorId);
+        if (op)
+            this.emit(op, 'merchant.live', m);
+    }
+    statusView(m, isPoll) {
+        if (isPoll && m.runtime === 'creating') {
+            if (m.pollsLeft <= 0)
+                this.goLive(m);
+            else
+                m.pollsLeft -= 1;
+        }
+        return {
+            storeId: m.id,
+            handle: m.handle,
+            status: m.status,
+            deployStatus: m.runtime,
+            domain: m.domain,
+            apiBaseUrl: m.runtime === 'live' ? 'https://shared-api.vivoa.app' : null,
+        };
+    }
+    list(op, qs) {
+        const page = Math.max(1, Number(qs.get('page')) || 1);
+        const limit = Math.min(Math.max(1, Number(qs.get('limit')) || 20), 100);
+        const search = qs.get('search')?.toLowerCase();
+        const externalId = qs.get('externalId') ?? undefined;
+        const rows = this.fleet(op)
+            .filter((m) => !search || m.name.toLowerCase().includes(search) || m.handle.includes(search))
+            .filter((m) => !externalId || m.externalId === externalId)
+            .sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+        return {
+            data: rows.slice((page - 1) * limit, page * limit).map(publicMerchant),
+            meta: { total: rows.length, page, limit },
+        };
+    }
+    analytics(op) {
+        const fleet = this.fleet(op);
+        const byStatus = {};
+        for (const m of fleet)
+            byStatus[m.status] = (byStatus[m.status] ?? 0) + 1;
+        return {
+            operatorId: op.id,
+            stores: { total: fleet.length, active: byStatus.active ?? 0, suspended: byStatus.suspended ?? 0, byStatus },
+            revenue: { grossVolume: 0, currency: 'USD', pendingAmount: 0, completedPayments: 0, avgTicket: 0 },
+        };
+    }
+    async webhookRoute(op, method, path, body, url) {
+        if (method === 'GET' && path === '/webhooks')
+            return webhookView(op);
+        if (method === 'GET' && path === '/webhooks/deliveries') {
+            const limit = Math.min(Number(url.searchParams.get('limit')) || 25, 100);
+            return op.deliveries.slice(0, limit);
+        }
+        this.requireActive(op);
+        if (method === 'PUT' && path === '/webhooks') {
+            const target = String(body.url ?? '');
+            if (!/^https?:\/\//.test(target))
+                throw new HttpError(400, 'url must be a URL address');
+            const events = Array.isArray(body.events) ? body.events.map(String) : [];
+            const unknown = events.filter((e) => !webhook_ts_1.MERCHANT_EVENT_TYPES.includes(e));
+            if (unknown.length)
+                throw new HttpError(400, `each value in events must be one of the following values: ${webhook_ts_1.MERCHANT_EVENT_TYPES.join(', ')}`);
+            const isNew = !op.webhook;
+            const secret = op.webhook?.secret ?? `whsec_${(0, node_crypto_1.randomUUID)().replace(/-/g, '')}`;
+            op.webhook = { url: target, events, secret, updatedAt: new Date(this.clock.nowMs()).toISOString() };
+            return { webhook: webhookView(op), signingSecret: isNew ? secret : null };
+        }
+        if (method === 'DELETE' && path === '/webhooks') {
+            op.webhook = null;
+            return webhookView(op);
+        }
+        if (!op.webhook)
+            throw new HttpError(404, 'No webhook configured for this operator');
+        if (method === 'POST' && path === '/webhooks/rotate-secret') {
+            op.webhook.secret = `whsec_${(0, node_crypto_1.randomUUID)().replace(/-/g, '')}`;
+            return { signingSecret: op.webhook.secret };
+        }
+        if (method === 'POST' && path === '/webhooks/test') {
+            return this.deliver(op, 'platform.test', { message: 'Test event from Vivoa', operatorId: op.id });
+        }
+        throw new HttpError(404, `Cannot ${method} /partner/v1${path}`);
+    }
+    // ── events → signed webhook ─────────────────────────────────────────────
+    emit(op, event, m, extra = {}) {
+        if (!op.webhook)
+            return;
+        if (op.webhook.events.length > 0 && !op.webhook.events.includes(event))
+            return;
+        void this.deliver(op, event, {
+            merchantId: m.id,
+            handle: m.handle,
+            operatorId: op.id,
+            occurredAt: new Date(this.clock.nowMs()).toISOString(),
+            ...extra,
+        });
+    }
+    async deliver(op, event, data) {
+        const hook = op.webhook;
+        const body = JSON.stringify({ event, data, sentAt: new Date(this.clock.nowMs()).toISOString() });
+        const signature = await this.crypto.hmacSha256Hex(hook.secret, body);
+        this.onWebhook?.({
+            url: hook.url,
+            headers: { 'content-type': 'application/json', 'x-vivoa-event': event, 'x-vivoa-signature': `sha256=${signature}` },
+            body,
+        });
+        const delivery = {
+            id: (0, node_crypto_1.randomUUID)(),
+            event,
+            statusCode: 200,
+            success: true,
+            error: null,
+            durationMs: 1,
+            attempt: 1,
+            createdAt: new Date(this.clock.nowMs()).toISOString(),
+        };
+        op.deliveries.unshift(delivery);
+        return delivery;
+    }
+    // ── helpers ─────────────────────────────────────────────────────────────
+    fleet(op) {
+        return [...this.merchants.values()].filter((m) => m.operatorId === op.id);
+    }
+    owned(op, id) {
+        const m = this.merchants.get(id);
+        if (!m || m.operatorId !== op.id)
+            throw new HttpError(404, `Merchant store '${id}' not found for this operator`);
+        return m;
+    }
+    profile(op) {
+        return {
+            id: op.id,
+            name: op.name,
+            status: op.status,
+            plan: op.plan,
+            storesUsed: this.fleet(op).length,
+            maxStores: op.maxStores,
+            allowedRegions: [...op.allowedRegions],
+            rateLimitPerMin: op.rateLimitPerMin,
+        };
+    }
+    requireOperatorByKey(apiKey) {
+        const op = this.operators.get(apiKey);
+        if (!op)
+            throw new Error(`FakeVivoa: unknown operator key ${apiKey}`);
+        return op;
+    }
+}
+exports.FakeVivoa = FakeVivoa;
+function publicMerchant(m) {
+    const { operatorId: _op, pollsLeft: _polls, ...view } = m;
+    return { ...view, countries: [...view.countries] };
+}
+function webhookView(op) {
+    return {
+        configured: !!op.webhook,
+        url: op.webhook?.url ?? null,
+        events: op.webhook ? [...op.webhook.events] : [],
+        active: !!op.webhook,
+        updatedAt: op.webhook?.updatedAt ?? null,
+    };
+}
+function json(status, body) {
+    return { status, headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) };
+}
+function lower(headers) {
+    const out = {};
+    for (const [k, v] of Object.entries(headers))
+        out[k.toLowerCase()] = v;
+    return out;
+}

package/dist/cjs/adapters/manual-clock.d.ts

@@ -0,0 +1,9 @@
+import type { Clock } from '../ports/clock.port.ts';
+/** Deterministic clock: `sleep` advances time instantly. For tests and the fake. */
+export declare class ManualClock implements Clock {
+    private current;
+    constructor(startMs?: number);
+    nowMs(): number;
+    sleep(ms: number): Promise<void>;
+    advance(ms: number): void;
+}

package/dist/cjs/adapters/manual-clock.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ManualClock = void 0;
+/** Deterministic clock: `sleep` advances time instantly. For tests and the fake. */
+class ManualClock {
+    current;
+    constructor(startMs = Date.UTC(2026, 0, 1)) {
+        this.current = startMs;
+    }
+    nowMs() {
+        return this.current;
+    }
+    async sleep(ms) {
+        this.current += ms;
+    }
+    advance(ms) {
+        this.current += ms;
+    }
+}
+exports.ManualClock = ManualClock;

package/dist/cjs/adapters/node-crypto.d.ts

@@ -0,0 +1,2 @@
+import type { CryptoProvider } from '../ports/crypto.port.ts';
+export declare const nodeCrypto: CryptoProvider;

package/dist/cjs/adapters/node-crypto.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nodeCrypto = void 0;
+const node_crypto_1 = require("node:crypto");
+exports.nodeCrypto = {
+    sha256Hex: (data) => (0, node_crypto_1.createHash)('sha256').update(data).digest('hex'),
+    hmacSha256Hex: (secret, data) => (0, node_crypto_1.createHmac)('sha256', secret).update(data).digest('hex'),
+    timingSafeEqualHex: (a, b) => {
+        const x = Buffer.from(a, 'hex');
+        const y = Buffer.from(b, 'hex');
+        return x.length > 0 && x.length === y.length && (0, node_crypto_1.timingSafeEqual)(x, y);
+    },
+};

package/dist/cjs/adapters/system-clock.d.ts

@@ -0,0 +1,2 @@
+import type { Clock } from '../ports/clock.port.ts';
+export declare const systemClock: Clock;

package/dist/cjs/adapters/system-clock.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.systemClock = void 0;
+exports.systemClock = {
+    nowMs: () => Date.now(),
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+};

package/dist/cjs/application/partner-client.d.ts

@@ -0,0 +1,45 @@
+import type { HttpTransport } from '../ports/http-transport.port.ts';
+import type { CryptoProvider } from '../ports/crypto.port.ts';
+import type { Clock } from '../ports/clock.port.ts';
+import { type SdkLogger } from '../ports/logger.port.ts';
+import { MeResource } from './resources/me.ts';
+import { MerchantsResource } from './resources/merchants.ts';
+import { WebhooksResource } from './resources/webhooks.ts';
+import { FleetResource } from './resources/fleet.ts';
+import { type ProvisionStoreOptions, type ProvisionStoreResult } from './use-cases/provision-store.ts';
+import { type VerifyWebhookParams } from '../webhooks/verify-webhook.ts';
+import type { CreateMerchantInput, MerchantStatus } from '../domain/merchant.ts';
+import type { WebhookEvent } from '../domain/webhook.ts';
+export declare const SDK_VERSION = "0.1.0";
+/** Every adapter is injected — the client itself has no I/O of its own. */
+export interface PartnerClientDeps {
+    baseUrl: string;
+    apiKey: string;
+    apiSecret: string;
+    transport: HttpTransport;
+    crypto: CryptoProvider;
+    clock: Clock;
+    logger?: SdkLogger;
+    timeoutMs?: number;
+    maxRetries?: number;
+}
+export declare class VivoaPartnerClient {
+    readonly me: MeResource;
+    readonly merchants: MerchantsResource;
+    readonly webhooks: WebhooksResource;
+    readonly fleet: FleetResource;
+    private readonly provisioning;
+    private readonly crypto;
+    constructor(deps: PartnerClientDeps);
+    /**
+     * Ensure a merchant exists for `input.externalId`, activate it and wait until
+     * it is live. Safe to call again with the same externalId — it resumes.
+     */
+    provisionStore(input: CreateMerchantInput, options?: ProvisionStoreOptions): Promise<ProvisionStoreResult>;
+    waitUntilSettled(merchantId: string, options?: {
+        timeoutMs?: number;
+        pollIntervalMs?: number;
+    }): Promise<MerchantStatus>;
+    /** Verify + parse an incoming webhook with this client's crypto adapter. */
+    verifyWebhook(params: VerifyWebhookParams): Promise<WebhookEvent>;
+}

package/dist/cjs/application/partner-client.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VivoaPartnerClient = exports.SDK_VERSION = void 0;
+const logger_port_ts_1 = require("../ports/logger.port.js");
+const signed_http_ts_1 = require("./signed-http.js");
+const me_ts_1 = require("./resources/me.js");
+const merchants_ts_1 = require("./resources/merchants.js");
+const webhooks_ts_1 = require("./resources/webhooks.js");
+const fleet_ts_1 = require("./resources/fleet.js");
+const provision_store_ts_1 = require("./use-cases/provision-store.js");
+const verify_webhook_ts_1 = require("../webhooks/verify-webhook.js");
+exports.SDK_VERSION = '0.1.0';
+class VivoaPartnerClient {
+    me;
+    merchants;
+    webhooks;
+    fleet;
+    provisioning;
+    crypto;
+    constructor(deps) {
+        const http = new signed_http_ts_1.SignedHttpClient({
+            baseUrl: deps.baseUrl,
+            apiKey: deps.apiKey,
+            apiSecret: deps.apiSecret,
+            transport: deps.transport,
+            crypto: deps.crypto,
+            clock: deps.clock,
+            logger: deps.logger ?? logger_port_ts_1.silentLogger,
+            timeoutMs: deps.timeoutMs ?? 30_000,
+            maxRetries: deps.maxRetries ?? 2,
+            userAgent: `vivoa-partner-sdk/${exports.SDK_VERSION}`,
+        });
+        this.crypto = deps.crypto;
+        this.me = new me_ts_1.MeResource(http);
+        this.merchants = new merchants_ts_1.MerchantsResource(http);
+        this.webhooks = new webhooks_ts_1.WebhooksResource(http);
+        this.fleet = new fleet_ts_1.FleetResource(http);
+        this.provisioning = new provision_store_ts_1.ProvisionStoreUseCase(this.merchants, deps.clock);
+    }
+    /**
+     * Ensure a merchant exists for `input.externalId`, activate it and wait until
+     * it is live. Safe to call again with the same externalId — it resumes.
+     */
+    provisionStore(input, options) {
+        return this.provisioning.execute(input, options);
+    }
+    waitUntilSettled(merchantId, options) {
+        return this.provisioning.waitUntilSettled(merchantId, options);
+    }
+    /** Verify + parse an incoming webhook with this client's crypto adapter. */
+    verifyWebhook(params) {
+        return (0, verify_webhook_ts_1.verifyWebhook)(this.crypto, params);
+    }
+}
+exports.VivoaPartnerClient = VivoaPartnerClient;

package/dist/cjs/application/resources/fleet.d.ts

@@ -0,0 +1,7 @@
+import type { SignedHttpClient } from '../signed-http.ts';
+import type { FleetAnalytics } from '../../domain/operator.ts';
+export declare class FleetResource {
+    private readonly http;
+    constructor(http: SignedHttpClient);
+    analytics(): Promise<FleetAnalytics>;
+}

package/dist/cjs/application/resources/fleet.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FleetResource = void 0;
+class FleetResource {
+    http;
+    constructor(http) {
+        this.http = http;
+    }
+    analytics() {
+        return this.http.request('GET', '/partner/v1/fleet/analytics');
+    }
+}
+exports.FleetResource = FleetResource;

package/dist/cjs/application/resources/me.d.ts

@@ -0,0 +1,13 @@
+import type { SignedHttpClient } from '../signed-http.ts';
+import type { OperatorProfile, RotatedApiSecret } from '../../domain/operator.ts';
+export declare class MeResource {
+    private readonly http;
+    constructor(http: SignedHttpClient);
+    /** Plan, quota usage (`storesUsed/maxStores`), allowed countries, rate limit. */
+    get(): Promise<OperatorProfile>;
+    /**
+     * Rotates the apiSecret. The new secret is returned ONCE and this client
+     * switches to it immediately; persist it before the process exits.
+     */
+    rotateSecret(): Promise<RotatedApiSecret>;
+}