gardeshpay-sdk 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 GardeshPay / PayGate365
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,212 @@
-# Temporary Holding Version
+# GardeshPay Node SDK (`gardeshpay-sdk`)
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Official **Node.js SDK** for the **GardeshPay Merchant API**.
+
+It wraps the payment APIs merchants call from their backend: create → redirect buyer → verify before fulfill, with **API key + HMAC-SHA256** request signing (and webhook signature helpers).
+
+```bash
+npm install gardeshpay-sdk
+```
+
+> The unscoped npm name `gardeshpay` is already taken by an unrelated 2020 package (`1.0.2`). This official SDK publishes as **`gardeshpay-sdk`**. Import class name is still `GardeshPay`.
+
+> **Server-side only.** Never put `apiKey` / `hmacSecret` in browser code.
+
+---
+
+## What this package does
+
+| You call | SDK does |
+|----------|----------|
+| `createPayment(...)` | `POST /v1/payments` + HMAC headers + idempotency |
+| `verifyPayment(id)` | `POST /v1/payments/{id}/verify` (fulfillment gate) |
+| `getPayment(id)` | `GET /v1/payments/{id}` |
+| `createRefund(...)` | `POST /v1/payments/{id}/refunds` |
+| `verifyWebhook(...)` | Check inbound webhook HMAC (notification only) |
+
+Same HTTP API as cURL / OpenAPI — just less boilerplate.
+
+---
+
+## Quick start
+
+```ts
+import { GardeshPay } from "gardeshpay-sdk";
+
+const gp = new GardeshPay({
+  apiKey: process.env.GARDESHPAY_API_KEY!,
+  hmacSecret: process.env.GARDESHPAY_HMAC_SECRET!,
+  baseUrl: process.env.GARDESHPAY_BASE_URL!, // e.g. https://api.example.com/v1
+});
+
+// 1) Create payment
+const payment = await gp.createPayment({
+  orderRef: "ORD-1001",
+  amountRial: 250_000,
+  returnUrl: "https://shop.example.com/return",
+  description: "Order 1001",
+});
+
+// 2) Redirect the buyer
+const redirectTo = payment.startPayUrl ?? payment.checkoutUrl;
+// res.redirect(redirectTo)
+
+// 3) On returnUrl — ALWAYS verify before fulfill
+const verified = await gp.verifyPayment(payment.paymentId);
+if (verified.status === "SUCCEEDED") {
+  // ship / unlock order
+}
+```
+
+---
+
+## Auth (HMAC)
+
+Every request is signed as:
+
+```text
+METHOD\nPATH?QUERY\nTIMESTAMP\nNONCE\nSHA256_HEX(body)
+X-Signature = Base64(HMAC-SHA256(hmacSecret, canonical))
+```
+
+Headers sent automatically:
+
+- `X-Api-Key`
+- `X-Timestamp` (unix seconds)
+- `X-Nonce`
+- `X-Signature`
+- `Idempotency-Key` on create / verify / refund
+
+Get keys from the merchant portal after your gateway is **ACTIVE** (API keys page).
+
+---
+
+## Webhooks (optional notifications)
+
+Webhooks are **not** proof of payment. Always `verifyPayment` (or GET status) before fulfill.
+
+```ts
+import { verifyWebhook } from "gardeshpay-sdk";
+import express from "express";
+
+const app = express();
+app.post(
+  "/webhooks/gardeshpay",
+  express.raw({ type: "application/json" }),
+  (req, res) => {
+    const result = verifyWebhook({
+      secret: process.env.GARDESHPAY_WEBHOOK_SECRET!,
+      rawBody: req.body as Buffer,
+      headers: req.headers,
+    });
+    if (!result.ok) return res.status(401).send(result.reason);
+
+    // enqueue background verifyPayment(paymentId) — then fulfill
+    res.sendStatus(200);
+  },
+);
+```
+
+Configure the webhook URL + secret on the gateway settings page in the portal.
+
+`verifyWebhook` validates the signed delivery headers for you. You still must verify the payment; delivery success ≠ money settled.
+
+---
+
+## API reference
+
+### `new GardeshPay(options)`
+
+| Option | Required | Description |
+|--------|----------|-------------|
+| `apiKey` | yes | Portal API key (`pk_…`) |
+| `hmacSecret` | yes | HMAC secret for that key |
+| `baseUrl` | yes | Base URL **including** `/v1` |
+| `timeoutMs` | no | Default `30000` |
+| `fetch` | no | Custom fetch (tests) |
+
+### `createPayment(input)`
+
+| Field | Required | Notes |
+|-------|----------|-------|
+| `orderRef` | yes | Your order id |
+| `amountRial` | yes | Integer Rials |
+| `returnUrl` | yes | Buyer browser return (not proof) |
+| `callbackUrl` | no | Optional webhook override if allowed |
+| `description` | no | |
+| `expiresInSec` | no | |
+| `metadata` | no | string map |
+| `idempotencyKey` | no | Auto UUID if omitted |
+
+Returns `paymentId`, `authority`, `checkoutUrl`, `startPayUrl` (when present), `status`, …
+
+### `verifyPayment(paymentId)`
+
+Fulfill only when `status === "SUCCEEDED"`. Safe to retry (idempotent).
+
+### `getPayment(paymentId)` / `createRefund({ paymentId, amountRial })`
+
+Status inquiry and refunds.
+
+### Errors
+
+Failed HTTP calls throw `GardeshPayError` with `status`, optional `code` / `correlationId`, and problem-details body when present.
+
+---
+
+## Payment flow
+
+```text
+Merchant backend                 GardeshPay API              Buyer
+     |-- createPayment ---------->|                           |
+     |<-- paymentId + URLs -------|                           |
+     |--------- redirect buyer ------------------------------>|
+     |                           |<-- pay at bank/checkout ---|
+     |<-- returnUrl?paymentId ----|                           |
+     |-- verifyPayment ---------->|                           |
+     |<-- SUCCEEDED / … ----------|                           |
+     |-- fulfill order -----------|                           |
+```
+
+Optional: webhook `payment.succeeded` may arrive in parallel — still verify.
+
+---
+
+## TypeScript
+
+Published with full `.d.ts`. Works with ESM and CommonJS:
+
+```ts
+import { GardeshPay } from "gardeshpay-sdk";
+// or
+const { GardeshPay } = require("gardeshpay-sdk");
+```
+
+Node **18+** (native `fetch` + `node:crypto`).
+
+---
+
+## Development
+
+```bash
+npm install
+npm test
+npm run build
+```
+
+---
+
+## Security checklist
+
+- [ ] Store secrets in env / secret manager — never in git or frontend
+- [ ] Use HTTPS `returnUrl` / webhook URL
+- [ ] Treat `returnUrl` query as a hint only
+- [ ] Treat webhook as a hint only
+- [ ] Fulfill only after `verifyPayment` → `SUCCEEDED`
+- [ ] Use unique `orderRef` / idempotency keys
+
+---
+
+## License
+
+MIT © GardeshPay

package/dist/index.cjs

@@ -0,0 +1,307 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  GardeshPay: () => GardeshPay,
+  GardeshPayError: () => GardeshPayError,
+  hmacSha256Base64: () => hmacSha256Base64,
+  hmacSha256Hex: () => hmacSha256Hex,
+  merchantCanonical: () => merchantCanonical,
+  newIdempotencyKey: () => newIdempotencyKey,
+  newNonce: () => newNonce,
+  sha256Hex: () => sha256Hex,
+  signMerchantRequest: () => signMerchantRequest,
+  unixSeconds: () => unixSeconds,
+  verifyWebhook: () => verifyWebhook
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/errors.ts
+var GardeshPayError = class extends Error {
+  status;
+  code;
+  correlationId;
+  problem;
+  bodyText;
+  constructor(message, opts) {
+    super(message);
+    this.name = "GardeshPayError";
+    this.status = opts.status;
+    this.code = opts.code;
+    this.correlationId = opts.correlationId;
+    this.problem = opts.problem;
+    this.bodyText = opts.bodyText;
+  }
+};
+
+// src/hmac.ts
+var import_node_crypto = require("crypto");
+function sha256Hex(body) {
+  return (0, import_node_crypto.createHash)("sha256").update(body ?? "").digest("hex");
+}
+function merchantCanonical(method, pathWithQuery, timestamp, nonce, bodySha256Hex) {
+  return [method, pathWithQuery, timestamp, nonce, bodySha256Hex].join("\n");
+}
+function hmacSha256Base64(secret, canonical) {
+  return (0, import_node_crypto.createHmac)("sha256", secret).update(canonical, "utf8").digest("base64");
+}
+function hmacSha256Hex(secret, message) {
+  return (0, import_node_crypto.createHmac)("sha256", secret).update(message, "utf8").digest("hex");
+}
+function signMerchantRequest(opts) {
+  const bodyHash = sha256Hex(opts.body);
+  const canonical = merchantCanonical(
+    opts.method.toUpperCase(),
+    opts.pathWithQuery,
+    opts.timestamp,
+    opts.nonce,
+    bodyHash
+  );
+  return hmacSha256Base64(opts.secret, canonical);
+}
+function newNonce() {
+  return `n-${(0, import_node_crypto.randomUUID)()}`;
+}
+function newIdempotencyKey() {
+  return (0, import_node_crypto.randomUUID)();
+}
+function unixSeconds(now = Date.now()) {
+  return String(Math.floor(now / 1e3));
+}
+function safeEqualHex(a, b) {
+  try {
+    const left = Buffer.from(a, "utf8");
+    const right = Buffer.from(b, "utf8");
+    if (left.length !== right.length) return false;
+    return (0, import_node_crypto.timingSafeEqual)(left, right);
+  } catch {
+    return false;
+  }
+}
+
+// src/client.ts
+var GardeshPay = class {
+  apiKey;
+  hmacSecret;
+  baseUrl;
+  fetchImpl;
+  timeoutMs;
+  constructor(options) {
+    if (!options?.apiKey?.trim()) throw new Error("apiKey is required");
+    if (!options?.hmacSecret?.trim()) throw new Error("hmacSecret is required");
+    if (!options?.baseUrl?.trim()) throw new Error("baseUrl is required (include /v1)");
+    this.apiKey = options.apiKey.trim();
+    this.hmacSecret = options.hmacSecret.trim();
+    this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+    this.fetchImpl = options.fetch ?? fetch;
+    this.timeoutMs = options.timeoutMs ?? 3e4;
+  }
+  /** Create a payment and get checkout / start-pay URLs. */
+  async createPayment(input) {
+    const data = await this.request({
+      method: "POST",
+      path: "/payments",
+      body: {
+        orderRef: input.orderRef,
+        amountRial: input.amountRial,
+        returnUrl: input.returnUrl,
+        callbackUrl: input.callbackUrl,
+        description: input.description,
+        expiresInSec: input.expiresInSec,
+        metadata: input.metadata,
+        gatewayId: input.gatewayId
+      },
+      idempotencyKey: input.idempotencyKey ?? newIdempotencyKey(),
+      correlationId: input.correlationId
+    });
+    return data;
+  }
+  /** GET payment status (masked). */
+  async getPayment(paymentId) {
+    return this.request({
+      method: "GET",
+      path: `/payments/${encodeURIComponent(paymentId)}`
+    });
+  }
+  /**
+   * Authoritative verify before fulfillment (idempotent).
+   * Fulfill only when `status === "SUCCEEDED"`.
+   */
+  async verifyPayment(paymentId, opts) {
+    return this.request({
+      method: "POST",
+      path: `/payments/${encodeURIComponent(paymentId)}/verify`,
+      // Empty body — matches typical verify clients; HMAC hashes empty string.
+      idempotencyKey: opts?.idempotencyKey ?? newIdempotencyKey()
+    });
+  }
+  /** Create a refund against a succeeded payment. */
+  async createRefund(input) {
+    return this.request({
+      method: "POST",
+      path: `/payments/${encodeURIComponent(input.paymentId)}/refunds`,
+      body: {
+        amountRial: input.amountRial,
+        reason: input.reason
+      },
+      idempotencyKey: input.idempotencyKey ?? newIdempotencyKey()
+    });
+  }
+  async request(opts) {
+    const pathWithQuery = opts.path.startsWith("/") ? opts.path : `/${opts.path}`;
+    const url = `${this.baseUrl}${pathWithQuery}`;
+    const bodyText = opts.method === "GET" || opts.body === void 0 ? "" : JSON.stringify(opts.body ?? {});
+    const timestamp = unixSeconds();
+    const nonce = newNonce();
+    const signPath = `/v1${pathWithQuery}`;
+    const signature = signMerchantRequest({
+      secret: this.hmacSecret,
+      method: opts.method,
+      pathWithQuery: signPath,
+      timestamp,
+      nonce,
+      body: bodyText
+    });
+    const headers = {
+      Accept: "application/json",
+      "X-Api-Key": this.apiKey,
+      "X-Timestamp": timestamp,
+      "X-Nonce": nonce,
+      "X-Signature": signature
+    };
+    if (bodyText) headers["Content-Type"] = "application/json";
+    if (opts.idempotencyKey) headers["Idempotency-Key"] = opts.idempotencyKey;
+    if (opts.correlationId) headers["X-Correlation-Id"] = opts.correlationId;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    let res;
+    try {
+      res = await this.fetchImpl(url, {
+        method: opts.method,
+        headers,
+        body: bodyText || void 0,
+        signal: controller.signal
+      });
+    } catch (err) {
+      clearTimeout(timer);
+      throw new GardeshPayError(
+        err instanceof Error ? err.message : "network error",
+        { status: 0 }
+      );
+    } finally {
+      clearTimeout(timer);
+    }
+    const text = await res.text();
+    let json = void 0;
+    if (text) {
+      try {
+        json = JSON.parse(text);
+      } catch {
+        json = void 0;
+      }
+    }
+    if (!res.ok) {
+      const problem = json && typeof json === "object" ? json : void 0;
+      throw new GardeshPayError(problem?.detail || problem?.title || `HTTP ${res.status}`, {
+        status: res.status,
+        code: problem?.code,
+        correlationId: problem?.correlationId,
+        problem,
+        bodyText: text
+      });
+    }
+    if (json && typeof json === "object" && "data" in json) {
+      return json.data;
+    }
+    return json;
+  }
+};
+
+// src/webhooks.ts
+function header(headers, name) {
+  const direct = headers[name] ?? headers[name.toLowerCase()];
+  if (Array.isArray(direct)) return direct[0];
+  if (typeof direct === "string") return direct;
+  const key = Object.keys(headers).find((k) => k.toLowerCase() === name.toLowerCase());
+  if (!key) return void 0;
+  const v = headers[key];
+  return Array.isArray(v) ? v[0] : v;
+}
+function verifyWebhook(opts) {
+  const skew = opts.skewSeconds ?? 300;
+  const now = opts.nowSeconds ?? Math.floor(Date.now() / 1e3);
+  const raw = typeof opts.rawBody === "string" ? opts.rawBody : opts.rawBody.toString("utf8");
+  const paygateSig = header(opts.headers, "X-PayGate-Signature");
+  const paygateTs = header(opts.headers, "X-PayGate-Timestamp");
+  if (paygateSig && paygateTs) {
+    const ts = Number(paygateTs);
+    if (!Number.isFinite(ts) || Math.abs(now - ts) > skew) {
+      return { ok: false, reason: "timestamp skew" };
+    }
+    const expectedHex = hmacSha256Hex(opts.secret, `${paygateTs}.${raw}`);
+    const presented = paygateSig.replace(/^sha256=/i, "").trim();
+    if (!safeEqualHex(expectedHex, presented)) {
+      return { ok: false, reason: "invalid signature" };
+    }
+    return {
+      ok: true,
+      timestamp: paygateTs,
+      eventType: header(opts.headers, "X-PayGate-Event")
+    };
+  }
+  const pg365 = header(opts.headers, "X-PG365-Signature");
+  if (pg365) {
+    const parts = Object.fromEntries(
+      pg365.split(",").map((p) => {
+        const [k, ...rest] = p.trim().split("=");
+        return [k, rest.join("=")];
+      })
+    );
+    const t = parts.t;
+    const v1 = parts.v1;
+    if (!t || !v1) return { ok: false, reason: "malformed X-PG365-Signature" };
+    const ts = Number(t);
+    if (!Number.isFinite(ts) || Math.abs(now - ts) > skew) {
+      return { ok: false, reason: "timestamp skew" };
+    }
+    const expected = hmacSha256Hex(opts.secret, `${t}.${raw}`);
+    if (!safeEqualHex(expected, v1)) {
+      return { ok: false, reason: "invalid signature" };
+    }
+    return { ok: true, timestamp: t };
+  }
+  return { ok: false, reason: "missing webhook signature headers" };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  GardeshPay,
+  GardeshPayError,
+  hmacSha256Base64,
+  hmacSha256Hex,
+  merchantCanonical,
+  newIdempotencyKey,
+  newNonce,
+  sha256Hex,
+  signMerchantRequest,
+  unixSeconds,
+  verifyWebhook
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/hmac.ts","../src/client.ts","../src/webhooks.ts"],"sourcesContent":["export { GardeshPay } from \"./client.js\";\nexport { GardeshPayError } from \"./errors.js\";\nexport {\n  hmacSha256Base64,\n  hmacSha256Hex,\n  merchantCanonical,\n  newIdempotencyKey,\n  newNonce,\n  sha256Hex,\n  signMerchantRequest,\n  unixSeconds,\n} from \"./hmac.js\";\nexport { verifyWebhook } from \"./webhooks.js\";\nexport type {\n  CreatePaymentInput,\n  CreatePaymentResult,\n  CreateRefundInput,\n  GardeshPayOptions,\n  PaymentResult,\n  PaymentStatus,\n  ProblemDetails,\n  RefundResult,\n  VerifyPaymentResult,\n} from \"./types.js\";\n","import type { ProblemDetails } from \"./types.js\";\n\nexport class GardeshPayError extends Error {\n  readonly status: number;\n  readonly code?: string;\n  readonly correlationId?: string;\n  readonly problem?: ProblemDetails;\n  readonly bodyText?: string;\n\n  constructor(\n    message: string,\n    opts: {\n      status: number;\n      code?: string;\n      correlationId?: string;\n      problem?: ProblemDetails;\n      bodyText?: string;\n    },\n  ) {\n    super(message);\n    this.name = \"GardeshPayError\";\n    this.status = opts.status;\n    this.code = opts.code;\n    this.correlationId = opts.correlationId;\n    this.problem = opts.problem;\n    this.bodyText = opts.bodyText;\n  }\n}\n","import { createHash, createHmac, randomUUID, timingSafeEqual } from \"node:crypto\";\n\n/** SHA-256 hex of UTF-8 body (empty string when body is empty). */\nexport function sha256Hex(body: string | Buffer | Uint8Array): string {\n  return createHash(\"sha256\").update(body ?? \"\").digest(\"hex\");\n}\n\n/**\n * Merchant API canonical string (must match Java `HmacSigner.merchantCanonical`):\n * `METHOD\\nPATH?QUERY\\nTIMESTAMP\\nNONCE\\nSHA256_HEX(body)`\n */\nexport function merchantCanonical(\n  method: string,\n  pathWithQuery: string,\n  timestamp: string,\n  nonce: string,\n  bodySha256Hex: string,\n): string {\n  return [method, pathWithQuery, timestamp, nonce, bodySha256Hex].join(\"\\n\");\n}\n\n/** Base64(HMAC-SHA256(secret, canonical)) — value for `X-Signature`. */\nexport function hmacSha256Base64(secret: string, canonical: string): string {\n  return createHmac(\"sha256\", secret).update(canonical, \"utf8\").digest(\"base64\");\n}\n\n/** Hex(HMAC-SHA256(secret, message)) — used for live webhook signatures. */\nexport function hmacSha256Hex(secret: string, message: string): string {\n  return createHmac(\"sha256\", secret).update(message, \"utf8\").digest(\"hex\");\n}\n\nexport function signMerchantRequest(opts: {\n  secret: string;\n  method: string;\n  pathWithQuery: string;\n  timestamp: string;\n  nonce: string;\n  body: string;\n}): string {\n  const bodyHash = sha256Hex(opts.body);\n  const canonical = merchantCanonical(\n    opts.method.toUpperCase(),\n    opts.pathWithQuery,\n    opts.timestamp,\n    opts.nonce,\n    bodyHash,\n  );\n  return hmacSha256Base64(opts.secret, canonical);\n}\n\nexport function newNonce(): string {\n  return `n-${randomUUID()}`;\n}\n\nexport function newIdempotencyKey(): string {\n  return randomUUID();\n}\n\nexport function unixSeconds(now = Date.now()): string {\n  return String(Math.floor(now / 1000));\n}\n\nexport function safeEqualHex(a: string, b: string): boolean {\n  try {\n    const left = Buffer.from(a, \"utf8\");\n    const right = Buffer.from(b, \"utf8\");\n    if (left.length !== right.length) return false;\n    return timingSafeEqual(left, right);\n  } catch {\n    return false;\n  }\n}\n","import { GardeshPayError } from \"./errors.js\";\nimport { newIdempotencyKey, newNonce, signMerchantRequest, unixSeconds } from \"./hmac.js\";\nimport type {\n  CreatePaymentInput,\n  CreatePaymentResult,\n  CreateRefundInput,\n  GardeshPayOptions,\n  PaymentResult,\n  ProblemDetails,\n  RefundResult,\n  VerifyPaymentResult,\n} from \"./types.js\";\n\ntype RequestOpts = {\n  method: \"GET\" | \"POST\";\n  path: string;\n  body?: unknown;\n  idempotencyKey?: string;\n  correlationId?: string;\n};\n\nexport class GardeshPay {\n  readonly apiKey: string;\n  readonly hmacSecret: string;\n  readonly baseUrl: string;\n  private readonly fetchImpl: typeof fetch;\n  private readonly timeoutMs: number;\n\n  constructor(options: GardeshPayOptions) {\n    if (!options?.apiKey?.trim()) throw new Error(\"apiKey is required\");\n    if (!options?.hmacSecret?.trim()) throw new Error(\"hmacSecret is required\");\n    if (!options?.baseUrl?.trim()) throw new Error(\"baseUrl is required (include /v1)\");\n    this.apiKey = options.apiKey.trim();\n    this.hmacSecret = options.hmacSecret.trim();\n    this.baseUrl = options.baseUrl.replace(/\\/+$/, \"\");\n    this.fetchImpl = options.fetch ?? fetch;\n    this.timeoutMs = options.timeoutMs ?? 30_000;\n  }\n\n  /** Create a payment and get checkout / start-pay URLs. */\n  async createPayment(input: CreatePaymentInput): Promise<CreatePaymentResult> {\n    const data = await this.request<CreatePaymentResult>({\n      method: \"POST\",\n      path: \"/payments\",\n      body: {\n        orderRef: input.orderRef,\n        amountRial: input.amountRial,\n        returnUrl: input.returnUrl,\n        callbackUrl: input.callbackUrl,\n        description: input.description,\n        expiresInSec: input.expiresInSec,\n        metadata: input.metadata,\n        gatewayId: input.gatewayId,\n      },\n      idempotencyKey: input.idempotencyKey ?? newIdempotencyKey(),\n      correlationId: input.correlationId,\n    });\n    return data;\n  }\n\n  /** GET payment status (masked). */\n  async getPayment(paymentId: string): Promise<PaymentResult> {\n    return this.request<PaymentResult>({\n      method: \"GET\",\n      path: `/payments/${encodeURIComponent(paymentId)}`,\n    });\n  }\n\n  /**\n   * Authoritative verify before fulfillment (idempotent).\n   * Fulfill only when `status === \"SUCCEEDED\"`.\n   */\n  async verifyPayment(\n    paymentId: string,\n    opts?: { idempotencyKey?: string },\n  ): Promise<VerifyPaymentResult> {\n    return this.request<VerifyPaymentResult>({\n      method: \"POST\",\n      path: `/payments/${encodeURIComponent(paymentId)}/verify`,\n      // Empty body — matches typical verify clients; HMAC hashes empty string.\n      idempotencyKey: opts?.idempotencyKey ?? newIdempotencyKey(),\n    });\n  }\n\n  /** Create a refund against a succeeded payment. */\n  async createRefund(input: CreateRefundInput): Promise<RefundResult> {\n    return this.request<RefundResult>({\n      method: \"POST\",\n      path: `/payments/${encodeURIComponent(input.paymentId)}/refunds`,\n      body: {\n        amountRial: input.amountRial,\n        reason: input.reason,\n      },\n      idempotencyKey: input.idempotencyKey ?? newIdempotencyKey(),\n    });\n  }\n\n  private async request<T>(opts: RequestOpts): Promise<T> {\n    const pathWithQuery = opts.path.startsWith(\"/\") ? opts.path : `/${opts.path}`;\n    const url = `${this.baseUrl}${pathWithQuery}`;\n    const bodyText =\n      opts.method === \"GET\" || opts.body === undefined ? \"\" : JSON.stringify(opts.body ?? {});\n    const timestamp = unixSeconds();\n    const nonce = newNonce();\n    // Sign against the public path as exposed under /v1 (matches Java filter).\n    const signPath = `/v1${pathWithQuery}`;\n    const signature = signMerchantRequest({\n      secret: this.hmacSecret,\n      method: opts.method,\n      pathWithQuery: signPath,\n      timestamp,\n      nonce,\n      body: bodyText,\n    });\n\n    const headers: Record<string, string> = {\n      Accept: \"application/json\",\n      \"X-Api-Key\": this.apiKey,\n      \"X-Timestamp\": timestamp,\n      \"X-Nonce\": nonce,\n      \"X-Signature\": signature,\n    };\n    if (bodyText) headers[\"Content-Type\"] = \"application/json\";\n    if (opts.idempotencyKey) headers[\"Idempotency-Key\"] = opts.idempotencyKey;\n    if (opts.correlationId) headers[\"X-Correlation-Id\"] = opts.correlationId;\n\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n    let res: Response;\n    try {\n      res = await this.fetchImpl(url, {\n        method: opts.method,\n        headers,\n        body: bodyText || undefined,\n        signal: controller.signal,\n      });\n    } catch (err) {\n      clearTimeout(timer);\n      throw new GardeshPayError(\n        err instanceof Error ? err.message : \"network error\",\n        { status: 0 },\n      );\n    } finally {\n      clearTimeout(timer);\n    }\n\n    const text = await res.text();\n    let json: unknown = undefined;\n    if (text) {\n      try {\n        json = JSON.parse(text);\n      } catch {\n        json = undefined;\n      }\n    }\n\n    if (!res.ok) {\n      const problem = (json && typeof json === \"object\" ? json : undefined) as\n        | ProblemDetails\n        | undefined;\n      throw new GardeshPayError(problem?.detail || problem?.title || `HTTP ${res.status}`, {\n        status: res.status,\n        code: problem?.code,\n        correlationId: problem?.correlationId,\n        problem,\n        bodyText: text,\n      });\n    }\n\n    if (json && typeof json === \"object\" && \"data\" in json) {\n      return (json as { data: T }).data;\n    }\n    return json as T;\n  }\n}\n","import { hmacSha256Hex, safeEqualHex } from \"./hmac.js\";\n\nexport type WebhookHeaders = Record<string, string | string[] | undefined>;\n\nfunction header(headers: WebhookHeaders, name: string): string | undefined {\n  const direct = headers[name] ?? headers[name.toLowerCase()];\n  if (Array.isArray(direct)) return direct[0];\n  if (typeof direct === \"string\") return direct;\n  // case-insensitive fallback\n  const key = Object.keys(headers).find((k) => k.toLowerCase() === name.toLowerCase());\n  if (!key) return undefined;\n  const v = headers[key];\n  return Array.isArray(v) ? v[0] : v;\n}\n\n/**\n * Verify an inbound GardeshPay / PayGate365 webhook.\n *\n * Live notification-service signs with:\n * - `X-PayGate-Signature: sha256=<hex(HMAC-SHA256(secret, `${t}.${rawBody}`))>`\n * - `X-PayGate-Timestamp: <unix seconds>`\n *\n * Docs also mention `X-PG365-Signature: t=…,v1=…` — both are accepted.\n *\n * Webhooks are **notifications only**. Always call `payments.verify` (or GET)\n * before fulfilling an order.\n */\nexport function verifyWebhook(opts: {\n  secret: string;\n  rawBody: string | Buffer;\n  headers: WebhookHeaders;\n  /** Max clock skew in seconds (default 300). */\n  skewSeconds?: number;\n  nowSeconds?: number;\n}): { ok: true; timestamp: string; eventType?: string } | { ok: false; reason: string } {\n  const skew = opts.skewSeconds ?? 300;\n  const now = opts.nowSeconds ?? Math.floor(Date.now() / 1000);\n  const raw = typeof opts.rawBody === \"string\" ? opts.rawBody : opts.rawBody.toString(\"utf8\");\n\n  const paygateSig = header(opts.headers, \"X-PayGate-Signature\");\n  const paygateTs = header(opts.headers, \"X-PayGate-Timestamp\");\n  if (paygateSig && paygateTs) {\n    const ts = Number(paygateTs);\n    if (!Number.isFinite(ts) || Math.abs(now - ts) > skew) {\n      return { ok: false, reason: \"timestamp skew\" };\n    }\n    const expectedHex = hmacSha256Hex(opts.secret, `${paygateTs}.${raw}`);\n    const presented = paygateSig.replace(/^sha256=/i, \"\").trim();\n    if (!safeEqualHex(expectedHex, presented)) {\n      return { ok: false, reason: \"invalid signature\" };\n    }\n    return {\n      ok: true,\n      timestamp: paygateTs,\n      eventType: header(opts.headers, \"X-PayGate-Event\"),\n    };\n  }\n\n  const pg365 = header(opts.headers, \"X-PG365-Signature\");\n  if (pg365) {\n    // Format: t=<unix>,v1=<hex>\n    const parts = Object.fromEntries(\n      pg365.split(\",\").map((p) => {\n        const [k, ...rest] = p.trim().split(\"=\");\n        return [k, rest.join(\"=\")];\n      }),\n    ) as Record<string, string>;\n    const t = parts.t;\n    const v1 = parts.v1;\n    if (!t || !v1) return { ok: false, reason: \"malformed X-PG365-Signature\" };\n    const ts = Number(t);\n    if (!Number.isFinite(ts) || Math.abs(now - ts) > skew) {\n      return { ok: false, reason: \"timestamp skew\" };\n    }\n    const expected = hmacSha256Hex(opts.secret, `${t}.${raw}`);\n    if (!safeEqualHex(expected, v1)) {\n      return { ok: false, reason: \"invalid signature\" };\n    }\n    return { ok: true, timestamp: t };\n  }\n\n  return { ok: false, reason: \"missing webhook signature headers\" };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACEO,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YACE,SACA,MAOA;AACA,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS,KAAK;AACnB,SAAK,OAAO,KAAK;AACjB,SAAK,gBAAgB,KAAK;AAC1B,SAAK,UAAU,KAAK;AACpB,SAAK,WAAW,KAAK;AAAA,EACvB;AACF;;;AC3BA,yBAAoE;AAG7D,SAAS,UAAU,MAA4C;AACpE,aAAO,+BAAW,QAAQ,EAAE,OAAO,QAAQ,EAAE,EAAE,OAAO,KAAK;AAC7D;AAMO,SAAS,kBACd,QACA,eACA,WACA,OACA,eACQ;AACR,SAAO,CAAC,QAAQ,eAAe,WAAW,OAAO,aAAa,EAAE,KAAK,IAAI;AAC3E;AAGO,SAAS,iBAAiB,QAAgB,WAA2B;AAC1E,aAAO,+BAAW,UAAU,MAAM,EAAE,OAAO,WAAW,MAAM,EAAE,OAAO,QAAQ;AAC/E;AAGO,SAAS,cAAc,QAAgB,SAAyB;AACrE,aAAO,+BAAW,UAAU,MAAM,EAAE,OAAO,SAAS,MAAM,EAAE,OAAO,KAAK;AAC1E;AAEO,SAAS,oBAAoB,MAOzB;AACT,QAAM,WAAW,UAAU,KAAK,IAAI;AACpC,QAAM,YAAY;AAAA,IAChB,KAAK,OAAO,YAAY;AAAA,IACxB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL;AAAA,EACF;AACA,SAAO,iBAAiB,KAAK,QAAQ,SAAS;AAChD;AAEO,SAAS,WAAmB;AACjC,SAAO,SAAK,+BAAW,CAAC;AAC1B;AAEO,SAAS,oBAA4B;AAC1C,aAAO,+BAAW;AACpB;AAEO,SAAS,YAAY,MAAM,KAAK,IAAI,GAAW;AACpD,SAAO,OAAO,KAAK,MAAM,MAAM,GAAI,CAAC;AACtC;AAEO,SAAS,aAAa,GAAW,GAAoB;AAC1D,MAAI;AACF,UAAM,OAAO,OAAO,KAAK,GAAG,MAAM;AAClC,UAAM,QAAQ,OAAO,KAAK,GAAG,MAAM;AACnC,QAAI,KAAK,WAAW,MAAM,OAAQ,QAAO;AACzC,eAAO,oCAAgB,MAAM,KAAK;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AClDO,IAAM,aAAN,MAAiB;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACQ;AAAA,EACA;AAAA,EAEjB,YAAY,SAA4B;AACtC,QAAI,CAAC,SAAS,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,oBAAoB;AAClE,QAAI,CAAC,SAAS,YAAY,KAAK,EAAG,OAAM,IAAI,MAAM,wBAAwB;AAC1E,QAAI,CAAC,SAAS,SAAS,KAAK,EAAG,OAAM,IAAI,MAAM,mCAAmC;AAClF,SAAK,SAAS,QAAQ,OAAO,KAAK;AAClC,SAAK,aAAa,QAAQ,WAAW,KAAK;AAC1C,SAAK,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,EAAE;AACjD,SAAK,YAAY,QAAQ,SAAS;AAClC,SAAK,YAAY,QAAQ,aAAa;AAAA,EACxC;AAAA;AAAA,EAGA,MAAM,cAAc,OAAyD;AAC3E,UAAM,OAAO,MAAM,KAAK,QAA6B;AAAA,MACnD,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,MAAM;AAAA,QACJ,UAAU,MAAM;AAAA,QAChB,YAAY,MAAM;AAAA,QAClB,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,aAAa,MAAM;AAAA,QACnB,cAAc,MAAM;AAAA,QACpB,UAAU,MAAM;AAAA,QAChB,WAAW,MAAM;AAAA,MACnB;AAAA,MACA,gBAAgB,MAAM,kBAAkB,kBAAkB;AAAA,MAC1D,eAAe,MAAM;AAAA,IACvB,CAAC;AACD,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,WAAW,WAA2C;AAC1D,WAAO,KAAK,QAAuB;AAAA,MACjC,QAAQ;AAAA,MACR,MAAM,aAAa,mBAAmB,SAAS,CAAC;AAAA,IAClD,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,cACJ,WACA,MAC8B;AAC9B,WAAO,KAAK,QAA6B;AAAA,MACvC,QAAQ;AAAA,MACR,MAAM,aAAa,mBAAmB,SAAS,CAAC;AAAA;AAAA,MAEhD,gBAAgB,MAAM,kBAAkB,kBAAkB;AAAA,IAC5D,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,aAAa,OAAiD;AAClE,WAAO,KAAK,QAAsB;AAAA,MAChC,QAAQ;AAAA,MACR,MAAM,aAAa,mBAAmB,MAAM,SAAS,CAAC;AAAA,MACtD,MAAM;AAAA,QACJ,YAAY,MAAM;AAAA,QAClB,QAAQ,MAAM;AAAA,MAChB;AAAA,MACA,gBAAgB,MAAM,kBAAkB,kBAAkB;AAAA,IAC5D,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,QAAW,MAA+B;AACtD,UAAM,gBAAgB,KAAK,KAAK,WAAW,GAAG,IAAI,KAAK,OAAO,IAAI,KAAK,IAAI;AAC3E,UAAM,MAAM,GAAG,KAAK,OAAO,GAAG,aAAa;AAC3C,UAAM,WACJ,KAAK,WAAW,SAAS,KAAK,SAAS,SAAY,KAAK,KAAK,UAAU,KAAK,QAAQ,CAAC,CAAC;AACxF,UAAM,YAAY,YAAY;AAC9B,UAAM,QAAQ,SAAS;AAEvB,UAAM,WAAW,MAAM,aAAa;AACpC,UAAM,YAAY,oBAAoB;AAAA,MACpC,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK;AAAA,MACb,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA,MAAM;AAAA,IACR,CAAC;AAED,UAAM,UAAkC;AAAA,MACtC,QAAQ;AAAA,MACR,aAAa,KAAK;AAAA,MAClB,eAAe;AAAA,MACf,WAAW;AAAA,MACX,eAAe;AAAA,IACjB;AACA,QAAI,SAAU,SAAQ,cAAc,IAAI;AACxC,QAAI,KAAK,eAAgB,SAAQ,iBAAiB,IAAI,KAAK;AAC3D,QAAI,KAAK,cAAe,SAAQ,kBAAkB,IAAI,KAAK;AAE3D,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,SAAS;AACjE,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,KAAK,UAAU,KAAK;AAAA,QAC9B,QAAQ,KAAK;AAAA,QACb;AAAA,QACA,MAAM,YAAY;AAAA,QAClB,QAAQ,WAAW;AAAA,MACrB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,mBAAa,KAAK;AAClB,YAAM,IAAI;AAAA,QACR,eAAe,QAAQ,IAAI,UAAU;AAAA,QACrC,EAAE,QAAQ,EAAE;AAAA,MACd;AAAA,IACF,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAEA,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,QAAI,OAAgB;AACpB,QAAI,MAAM;AACR,UAAI;AACF,eAAO,KAAK,MAAM,IAAI;AAAA,MACxB,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAEA,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,UAAW,QAAQ,OAAO,SAAS,WAAW,OAAO;AAG3D,YAAM,IAAI,gBAAgB,SAAS,UAAU,SAAS,SAAS,QAAQ,IAAI,MAAM,IAAI;AAAA,QACnF,QAAQ,IAAI;AAAA,QACZ,MAAM,SAAS;AAAA,QACf,eAAe,SAAS;AAAA,QACxB;AAAA,QACA,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAEA,QAAI,QAAQ,OAAO,SAAS,YAAY,UAAU,MAAM;AACtD,aAAQ,KAAqB;AAAA,IAC/B;AACA,WAAO;AAAA,EACT;AACF;;;AC1KA,SAAS,OAAO,SAAyB,MAAkC;AACzE,QAAM,SAAS,QAAQ,IAAI,KAAK,QAAQ,KAAK,YAAY,CAAC;AAC1D,MAAI,MAAM,QAAQ,MAAM,EAAG,QAAO,OAAO,CAAC;AAC1C,MAAI,OAAO,WAAW,SAAU,QAAO;AAEvC,QAAM,MAAM,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,MAAM,KAAK,YAAY,CAAC;AACnF,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,IAAI,QAAQ,GAAG;AACrB,SAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI;AACnC;AAcO,SAAS,cAAc,MAO0D;AACtF,QAAM,OAAO,KAAK,eAAe;AACjC,QAAM,MAAM,KAAK,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC3D,QAAM,MAAM,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU,KAAK,QAAQ,SAAS,MAAM;AAE1F,QAAM,aAAa,OAAO,KAAK,SAAS,qBAAqB;AAC7D,QAAM,YAAY,OAAO,KAAK,SAAS,qBAAqB;AAC5D,MAAI,cAAc,WAAW;AAC3B,UAAM,KAAK,OAAO,SAAS;AAC3B,QAAI,CAAC,OAAO,SAAS,EAAE,KAAK,KAAK,IAAI,MAAM,EAAE,IAAI,MAAM;AACrD,aAAO,EAAE,IAAI,OAAO,QAAQ,iBAAiB;AAAA,IAC/C;AACA,UAAM,cAAc,cAAc,KAAK,QAAQ,GAAG,SAAS,IAAI,GAAG,EAAE;AACpE,UAAM,YAAY,WAAW,QAAQ,aAAa,EAAE,EAAE,KAAK;AAC3D,QAAI,CAAC,aAAa,aAAa,SAAS,GAAG;AACzC,aAAO,EAAE,IAAI,OAAO,QAAQ,oBAAoB;AAAA,IAClD;AACA,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,WAAW;AAAA,MACX,WAAW,OAAO,KAAK,SAAS,iBAAiB;AAAA,IACnD;AAAA,EACF;AAEA,QAAM,QAAQ,OAAO,KAAK,SAAS,mBAAmB;AACtD,MAAI,OAAO;AAET,UAAM,QAAQ,OAAO;AAAA,MACnB,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM;AAC1B,cAAM,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG;AACvC,eAAO,CAAC,GAAG,KAAK,KAAK,GAAG,CAAC;AAAA,MAC3B,CAAC;AAAA,IACH;AACA,UAAM,IAAI,MAAM;AAChB,UAAM,KAAK,MAAM;AACjB,QAAI,CAAC,KAAK,CAAC,GAAI,QAAO,EAAE,IAAI,OAAO,QAAQ,8BAA8B;AACzE,UAAM,KAAK,OAAO,CAAC;AACnB,QAAI,CAAC,OAAO,SAAS,EAAE,KAAK,KAAK,IAAI,MAAM,EAAE,IAAI,MAAM;AACrD,aAAO,EAAE,IAAI,OAAO,QAAQ,iBAAiB;AAAA,IAC/C;AACA,UAAM,WAAW,cAAc,KAAK,QAAQ,GAAG,CAAC,IAAI,GAAG,EAAE;AACzD,QAAI,CAAC,aAAa,UAAU,EAAE,GAAG;AAC/B,aAAO,EAAE,IAAI,OAAO,QAAQ,oBAAoB;AAAA,IAClD;AACA,WAAO,EAAE,IAAI,MAAM,WAAW,EAAE;AAAA,EAClC;AAEA,SAAO,EAAE,IAAI,OAAO,QAAQ,oCAAoC;AAClE;","names":[]}

package/dist/index.d.cts

@@ -0,0 +1,177 @@
+type PaymentStatus = "CREATED" | "AWAITING_PAYMENT" | "SUCCEEDED" | "FAILED" | "EXPIRED" | "REVIEW" | "REFUNDED" | "PARTIALLY_REFUNDED" | "CANCELLED";
+type GardeshPayOptions = {
+    /** API key from the merchant portal (per gateway). */
+    apiKey: string;
+    /** HMAC secret shown with the API key — used to sign every request. */
+    hmacSecret: string;
+    /**
+     * Public Merchant API base including `/v1`, e.g.
+     * `https://api.example.com/v1`
+     */
+    baseUrl: string;
+    /** Optional fetch override (tests / custom agents). */
+    fetch?: typeof fetch;
+    /** Default timeout in ms (default 30_000). */
+    timeoutMs?: number;
+};
+type CreatePaymentInput = {
+    orderRef: string;
+    /** Integer amount in Iranian Rials. */
+    amountRial: number;
+    /** Buyer return URL after bank/checkout. Not proof of payment. */
+    returnUrl: string;
+    callbackUrl?: string;
+    description?: string;
+    expiresInSec?: number;
+    metadata?: Record<string, string>;
+    gatewayId?: string;
+    /** Optional idempotency key; auto-generated UUID when omitted. */
+    idempotencyKey?: string;
+    correlationId?: string;
+};
+type CreatePaymentResult = {
+    paymentId: string;
+    authority: string;
+    checkoutUrl: string;
+    /** Prefer this for redirect when present. */
+    startPayUrl?: string;
+    redirectUrl?: string;
+    status: PaymentStatus;
+    amountRial: number;
+    organizationId?: string;
+    expiresAt?: string;
+};
+type PaymentResult = {
+    paymentId: string;
+    authority?: string;
+    status: PaymentStatus;
+    amountRial: number;
+    orderRef?: string;
+    checkoutUrl?: string;
+    startPayUrl?: string;
+    expiresAt?: string;
+    verifiedAt?: string | null;
+    reviewReason?: string | null;
+    [key: string]: unknown;
+};
+type VerifyPaymentResult = {
+    paymentId: string;
+    status: PaymentStatus;
+    amountRial: number;
+    verifiedAt?: string | null;
+    reviewReason?: string | null;
+};
+type CreateRefundInput = {
+    paymentId: string;
+    amountRial: number;
+    reason?: string;
+    idempotencyKey?: string;
+};
+type RefundResult = {
+    refundId?: string;
+    paymentId?: string;
+    status?: string;
+    amountRial?: number;
+    [key: string]: unknown;
+};
+type ProblemDetails = {
+    type?: string;
+    title?: string;
+    status?: number;
+    detail?: string;
+    code?: string;
+    correlationId?: string;
+    [key: string]: unknown;
+};
+
+declare class GardeshPay {
+    readonly apiKey: string;
+    readonly hmacSecret: string;
+    readonly baseUrl: string;
+    private readonly fetchImpl;
+    private readonly timeoutMs;
+    constructor(options: GardeshPayOptions);
+    /** Create a payment and get checkout / start-pay URLs. */
+    createPayment(input: CreatePaymentInput): Promise<CreatePaymentResult>;
+    /** GET payment status (masked). */
+    getPayment(paymentId: string): Promise<PaymentResult>;
+    /**
+     * Authoritative verify before fulfillment (idempotent).
+     * Fulfill only when `status === "SUCCEEDED"`.
+     */
+    verifyPayment(paymentId: string, opts?: {
+        idempotencyKey?: string;
+    }): Promise<VerifyPaymentResult>;
+    /** Create a refund against a succeeded payment. */
+    createRefund(input: CreateRefundInput): Promise<RefundResult>;
+    private request;
+}
+
+declare class GardeshPayError extends Error {
+    readonly status: number;
+    readonly code?: string;
+    readonly correlationId?: string;
+    readonly problem?: ProblemDetails;
+    readonly bodyText?: string;
+    constructor(message: string, opts: {
+        status: number;
+        code?: string;
+        correlationId?: string;
+        problem?: ProblemDetails;
+        bodyText?: string;
+    });
+}
+
+/** SHA-256 hex of UTF-8 body (empty string when body is empty). */
+declare function sha256Hex(body: string | Buffer | Uint8Array): string;
+/**
+ * Merchant API canonical string (must match Java `HmacSigner.merchantCanonical`):
+ * `METHOD\nPATH?QUERY\nTIMESTAMP\nNONCE\nSHA256_HEX(body)`
+ */
+declare function merchantCanonical(method: string, pathWithQuery: string, timestamp: string, nonce: string, bodySha256Hex: string): string;
+/** Base64(HMAC-SHA256(secret, canonical)) — value for `X-Signature`. */
+declare function hmacSha256Base64(secret: string, canonical: string): string;
+/** Hex(HMAC-SHA256(secret, message)) — used for live webhook signatures. */
+declare function hmacSha256Hex(secret: string, message: string): string;
+declare function signMerchantRequest(opts: {
+    secret: string;
+    method: string;
+    pathWithQuery: string;
+    timestamp: string;
+    nonce: string;
+    body: string;
+}): string;
+declare function newNonce(): string;
+declare function newIdempotencyKey(): string;
+declare function unixSeconds(now?: number): string;
+
+type WebhookHeaders = Record<string, string | string[] | undefined>;
+/**
+ * Verify an inbound GardeshPay / PayGate365 webhook.
+ *
+ * Live notification-service signs with:
+ * - `X-PayGate-Signature: sha256=<hex(HMAC-SHA256(secret, `${t}.${rawBody}`))>`
+ * - `X-PayGate-Timestamp: <unix seconds>`
+ *
+ * Docs also mention `X-PG365-Signature: t=…,v1=…` — both are accepted.
+ *
+ * Webhooks are **notifications only**. Always call `payments.verify` (or GET)
+ * before fulfilling an order.
+ */
+declare function verifyWebhook(opts: {
+    secret: string;
+    rawBody: string | Buffer;
+    headers: WebhookHeaders;
+    /** Max clock skew in seconds (default 300). */
+    skewSeconds?: number;
+    nowSeconds?: number;
+}): {
+    ok: true;
+    timestamp: string;
+    eventType?: string;
+} | {
+    ok: false;
+    reason: string;
+};
+
+export { type CreatePaymentInput, type CreatePaymentResult, type CreateRefundInput, GardeshPay, GardeshPayError, type GardeshPayOptions, type PaymentResult, type PaymentStatus, type ProblemDetails, type RefundResult, type VerifyPaymentResult, hmacSha256Base64, hmacSha256Hex, merchantCanonical, newIdempotencyKey, newNonce, sha256Hex, signMerchantRequest, unixSeconds, verifyWebhook };

package/dist/index.d.ts

@@ -0,0 +1,177 @@
+type PaymentStatus = "CREATED" | "AWAITING_PAYMENT" | "SUCCEEDED" | "FAILED" | "EXPIRED" | "REVIEW" | "REFUNDED" | "PARTIALLY_REFUNDED" | "CANCELLED";
+type GardeshPayOptions = {
+    /** API key from the merchant portal (per gateway). */
+    apiKey: string;
+    /** HMAC secret shown with the API key — used to sign every request. */
+    hmacSecret: string;
+    /**
+     * Public Merchant API base including `/v1`, e.g.
+     * `https://api.example.com/v1`
+     */
+    baseUrl: string;
+    /** Optional fetch override (tests / custom agents). */
+    fetch?: typeof fetch;
+    /** Default timeout in ms (default 30_000). */
+    timeoutMs?: number;
+};
+type CreatePaymentInput = {
+    orderRef: string;
+    /** Integer amount in Iranian Rials. */
+    amountRial: number;
+    /** Buyer return URL after bank/checkout. Not proof of payment. */
+    returnUrl: string;
+    callbackUrl?: string;
+    description?: string;
+    expiresInSec?: number;
+    metadata?: Record<string, string>;
+    gatewayId?: string;
+    /** Optional idempotency key; auto-generated UUID when omitted. */
+    idempotencyKey?: string;
+    correlationId?: string;
+};
+type CreatePaymentResult = {
+    paymentId: string;
+    authority: string;
+    checkoutUrl: string;
+    /** Prefer this for redirect when present. */
+    startPayUrl?: string;
+    redirectUrl?: string;
+    status: PaymentStatus;
+    amountRial: number;
+    organizationId?: string;
+    expiresAt?: string;
+};
+type PaymentResult = {
+    paymentId: string;
+    authority?: string;
+    status: PaymentStatus;
+    amountRial: number;
+    orderRef?: string;
+    checkoutUrl?: string;
+    startPayUrl?: string;
+    expiresAt?: string;
+    verifiedAt?: string | null;
+    reviewReason?: string | null;
+    [key: string]: unknown;
+};
+type VerifyPaymentResult = {
+    paymentId: string;
+    status: PaymentStatus;
+    amountRial: number;
+    verifiedAt?: string | null;
+    reviewReason?: string | null;
+};
+type CreateRefundInput = {
+    paymentId: string;
+    amountRial: number;
+    reason?: string;
+    idempotencyKey?: string;
+};
+type RefundResult = {
+    refundId?: string;
+    paymentId?: string;
+    status?: string;
+    amountRial?: number;
+    [key: string]: unknown;
+};
+type ProblemDetails = {
+    type?: string;
+    title?: string;
+    status?: number;
+    detail?: string;
+    code?: string;
+    correlationId?: string;
+    [key: string]: unknown;
+};
+
+declare class GardeshPay {
+    readonly apiKey: string;
+    readonly hmacSecret: string;
+    readonly baseUrl: string;
+    private readonly fetchImpl;
+    private readonly timeoutMs;
+    constructor(options: GardeshPayOptions);
+    /** Create a payment and get checkout / start-pay URLs. */
+    createPayment(input: CreatePaymentInput): Promise<CreatePaymentResult>;
+    /** GET payment status (masked). */
+    getPayment(paymentId: string): Promise<PaymentResult>;
+    /**
+     * Authoritative verify before fulfillment (idempotent).
+     * Fulfill only when `status === "SUCCEEDED"`.
+     */
+    verifyPayment(paymentId: string, opts?: {
+        idempotencyKey?: string;
+    }): Promise<VerifyPaymentResult>;
+    /** Create a refund against a succeeded payment. */
+    createRefund(input: CreateRefundInput): Promise<RefundResult>;
+    private request;
+}
+
+declare class GardeshPayError extends Error {
+    readonly status: number;
+    readonly code?: string;
+    readonly correlationId?: string;
+    readonly problem?: ProblemDetails;
+    readonly bodyText?: string;
+    constructor(message: string, opts: {
+        status: number;
+        code?: string;
+        correlationId?: string;
+        problem?: ProblemDetails;
+        bodyText?: string;
+    });
+}
+
+/** SHA-256 hex of UTF-8 body (empty string when body is empty). */
+declare function sha256Hex(body: string | Buffer | Uint8Array): string;
+/**
+ * Merchant API canonical string (must match Java `HmacSigner.merchantCanonical`):
+ * `METHOD\nPATH?QUERY\nTIMESTAMP\nNONCE\nSHA256_HEX(body)`
+ */
+declare function merchantCanonical(method: string, pathWithQuery: string, timestamp: string, nonce: string, bodySha256Hex: string): string;
+/** Base64(HMAC-SHA256(secret, canonical)) — value for `X-Signature`. */
+declare function hmacSha256Base64(secret: string, canonical: string): string;
+/** Hex(HMAC-SHA256(secret, message)) — used for live webhook signatures. */
+declare function hmacSha256Hex(secret: string, message: string): string;
+declare function signMerchantRequest(opts: {
+    secret: string;
+    method: string;
+    pathWithQuery: string;
+    timestamp: string;
+    nonce: string;
+    body: string;
+}): string;
+declare function newNonce(): string;
+declare function newIdempotencyKey(): string;
+declare function unixSeconds(now?: number): string;
+
+type WebhookHeaders = Record<string, string | string[] | undefined>;
+/**
+ * Verify an inbound GardeshPay / PayGate365 webhook.
+ *
+ * Live notification-service signs with:
+ * - `X-PayGate-Signature: sha256=<hex(HMAC-SHA256(secret, `${t}.${rawBody}`))>`
+ * - `X-PayGate-Timestamp: <unix seconds>`
+ *
+ * Docs also mention `X-PG365-Signature: t=…,v1=…` — both are accepted.
+ *
+ * Webhooks are **notifications only**. Always call `payments.verify` (or GET)
+ * before fulfilling an order.
+ */
+declare function verifyWebhook(opts: {
+    secret: string;
+    rawBody: string | Buffer;
+    headers: WebhookHeaders;
+    /** Max clock skew in seconds (default 300). */
+    skewSeconds?: number;
+    nowSeconds?: number;
+}): {
+    ok: true;
+    timestamp: string;
+    eventType?: string;
+} | {
+    ok: false;
+    reason: string;
+};
+
+export { type CreatePaymentInput, type CreatePaymentResult, type CreateRefundInput, GardeshPay, GardeshPayError, type GardeshPayOptions, type PaymentResult, type PaymentStatus, type ProblemDetails, type RefundResult, type VerifyPaymentResult, hmacSha256Base64, hmacSha256Hex, merchantCanonical, newIdempotencyKey, newNonce, sha256Hex, signMerchantRequest, unixSeconds, verifyWebhook };

package/dist/index.js

@@ -0,0 +1,270 @@
+// src/errors.ts
+var GardeshPayError = class extends Error {
+  status;
+  code;
+  correlationId;
+  problem;
+  bodyText;
+  constructor(message, opts) {
+    super(message);
+    this.name = "GardeshPayError";
+    this.status = opts.status;
+    this.code = opts.code;
+    this.correlationId = opts.correlationId;
+    this.problem = opts.problem;
+    this.bodyText = opts.bodyText;
+  }
+};
+
+// src/hmac.ts
+import { createHash, createHmac, randomUUID, timingSafeEqual } from "crypto";
+function sha256Hex(body) {
+  return createHash("sha256").update(body ?? "").digest("hex");
+}
+function merchantCanonical(method, pathWithQuery, timestamp, nonce, bodySha256Hex) {
+  return [method, pathWithQuery, timestamp, nonce, bodySha256Hex].join("\n");
+}
+function hmacSha256Base64(secret, canonical) {
+  return createHmac("sha256", secret).update(canonical, "utf8").digest("base64");
+}
+function hmacSha256Hex(secret, message) {
+  return createHmac("sha256", secret).update(message, "utf8").digest("hex");
+}
+function signMerchantRequest(opts) {
+  const bodyHash = sha256Hex(opts.body);
+  const canonical = merchantCanonical(
+    opts.method.toUpperCase(),
+    opts.pathWithQuery,
+    opts.timestamp,
+    opts.nonce,
+    bodyHash
+  );
+  return hmacSha256Base64(opts.secret, canonical);
+}
+function newNonce() {
+  return `n-${randomUUID()}`;
+}
+function newIdempotencyKey() {
+  return randomUUID();
+}
+function unixSeconds(now = Date.now()) {
+  return String(Math.floor(now / 1e3));
+}
+function safeEqualHex(a, b) {
+  try {
+    const left = Buffer.from(a, "utf8");
+    const right = Buffer.from(b, "utf8");
+    if (left.length !== right.length) return false;
+    return timingSafeEqual(left, right);
+  } catch {
+    return false;
+  }
+}
+
+// src/client.ts
+var GardeshPay = class {
+  apiKey;
+  hmacSecret;
+  baseUrl;
+  fetchImpl;
+  timeoutMs;
+  constructor(options) {
+    if (!options?.apiKey?.trim()) throw new Error("apiKey is required");
+    if (!options?.hmacSecret?.trim()) throw new Error("hmacSecret is required");
+    if (!options?.baseUrl?.trim()) throw new Error("baseUrl is required (include /v1)");
+    this.apiKey = options.apiKey.trim();
+    this.hmacSecret = options.hmacSecret.trim();
+    this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+    this.fetchImpl = options.fetch ?? fetch;
+    this.timeoutMs = options.timeoutMs ?? 3e4;
+  }
+  /** Create a payment and get checkout / start-pay URLs. */
+  async createPayment(input) {
+    const data = await this.request({
+      method: "POST",
+      path: "/payments",
+      body: {
+        orderRef: input.orderRef,
+        amountRial: input.amountRial,
+        returnUrl: input.returnUrl,
+        callbackUrl: input.callbackUrl,
+        description: input.description,
+        expiresInSec: input.expiresInSec,
+        metadata: input.metadata,
+        gatewayId: input.gatewayId
+      },
+      idempotencyKey: input.idempotencyKey ?? newIdempotencyKey(),
+      correlationId: input.correlationId
+    });
+    return data;
+  }
+  /** GET payment status (masked). */
+  async getPayment(paymentId) {
+    return this.request({
+      method: "GET",
+      path: `/payments/${encodeURIComponent(paymentId)}`
+    });
+  }
+  /**
+   * Authoritative verify before fulfillment (idempotent).
+   * Fulfill only when `status === "SUCCEEDED"`.
+   */
+  async verifyPayment(paymentId, opts) {
+    return this.request({
+      method: "POST",
+      path: `/payments/${encodeURIComponent(paymentId)}/verify`,
+      // Empty body — matches typical verify clients; HMAC hashes empty string.
+      idempotencyKey: opts?.idempotencyKey ?? newIdempotencyKey()
+    });
+  }
+  /** Create a refund against a succeeded payment. */
+  async createRefund(input) {
+    return this.request({
+      method: "POST",
+      path: `/payments/${encodeURIComponent(input.paymentId)}/refunds`,
+      body: {
+        amountRial: input.amountRial,
+        reason: input.reason
+      },
+      idempotencyKey: input.idempotencyKey ?? newIdempotencyKey()
+    });
+  }
+  async request(opts) {
+    const pathWithQuery = opts.path.startsWith("/") ? opts.path : `/${opts.path}`;
+    const url = `${this.baseUrl}${pathWithQuery}`;
+    const bodyText = opts.method === "GET" || opts.body === void 0 ? "" : JSON.stringify(opts.body ?? {});
+    const timestamp = unixSeconds();
+    const nonce = newNonce();
+    const signPath = `/v1${pathWithQuery}`;
+    const signature = signMerchantRequest({
+      secret: this.hmacSecret,
+      method: opts.method,
+      pathWithQuery: signPath,
+      timestamp,
+      nonce,
+      body: bodyText
+    });
+    const headers = {
+      Accept: "application/json",
+      "X-Api-Key": this.apiKey,
+      "X-Timestamp": timestamp,
+      "X-Nonce": nonce,
+      "X-Signature": signature
+    };
+    if (bodyText) headers["Content-Type"] = "application/json";
+    if (opts.idempotencyKey) headers["Idempotency-Key"] = opts.idempotencyKey;
+    if (opts.correlationId) headers["X-Correlation-Id"] = opts.correlationId;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    let res;
+    try {
+      res = await this.fetchImpl(url, {
+        method: opts.method,
+        headers,
+        body: bodyText || void 0,
+        signal: controller.signal
+      });
+    } catch (err) {
+      clearTimeout(timer);
+      throw new GardeshPayError(
+        err instanceof Error ? err.message : "network error",
+        { status: 0 }
+      );
+    } finally {
+      clearTimeout(timer);
+    }
+    const text = await res.text();
+    let json = void 0;
+    if (text) {
+      try {
+        json = JSON.parse(text);
+      } catch {
+        json = void 0;
+      }
+    }
+    if (!res.ok) {
+      const problem = json && typeof json === "object" ? json : void 0;
+      throw new GardeshPayError(problem?.detail || problem?.title || `HTTP ${res.status}`, {
+        status: res.status,
+        code: problem?.code,
+        correlationId: problem?.correlationId,
+        problem,
+        bodyText: text
+      });
+    }
+    if (json && typeof json === "object" && "data" in json) {
+      return json.data;
+    }
+    return json;
+  }
+};
+
+// src/webhooks.ts
+function header(headers, name) {
+  const direct = headers[name] ?? headers[name.toLowerCase()];
+  if (Array.isArray(direct)) return direct[0];
+  if (typeof direct === "string") return direct;
+  const key = Object.keys(headers).find((k) => k.toLowerCase() === name.toLowerCase());
+  if (!key) return void 0;
+  const v = headers[key];
+  return Array.isArray(v) ? v[0] : v;
+}
+function verifyWebhook(opts) {
+  const skew = opts.skewSeconds ?? 300;
+  const now = opts.nowSeconds ?? Math.floor(Date.now() / 1e3);
+  const raw = typeof opts.rawBody === "string" ? opts.rawBody : opts.rawBody.toString("utf8");
+  const paygateSig = header(opts.headers, "X-PayGate-Signature");
+  const paygateTs = header(opts.headers, "X-PayGate-Timestamp");
+  if (paygateSig && paygateTs) {
+    const ts = Number(paygateTs);
+    if (!Number.isFinite(ts) || Math.abs(now - ts) > skew) {
+      return { ok: false, reason: "timestamp skew" };
+    }
+    const expectedHex = hmacSha256Hex(opts.secret, `${paygateTs}.${raw}`);
+    const presented = paygateSig.replace(/^sha256=/i, "").trim();
+    if (!safeEqualHex(expectedHex, presented)) {
+      return { ok: false, reason: "invalid signature" };
+    }
+    return {
+      ok: true,
+      timestamp: paygateTs,
+      eventType: header(opts.headers, "X-PayGate-Event")
+    };
+  }
+  const pg365 = header(opts.headers, "X-PG365-Signature");
+  if (pg365) {
+    const parts = Object.fromEntries(
+      pg365.split(",").map((p) => {
+        const [k, ...rest] = p.trim().split("=");
+        return [k, rest.join("=")];
+      })
+    );
+    const t = parts.t;
+    const v1 = parts.v1;
+    if (!t || !v1) return { ok: false, reason: "malformed X-PG365-Signature" };
+    const ts = Number(t);
+    if (!Number.isFinite(ts) || Math.abs(now - ts) > skew) {
+      return { ok: false, reason: "timestamp skew" };
+    }
+    const expected = hmacSha256Hex(opts.secret, `${t}.${raw}`);
+    if (!safeEqualHex(expected, v1)) {
+      return { ok: false, reason: "invalid signature" };
+    }
+    return { ok: true, timestamp: t };
+  }
+  return { ok: false, reason: "missing webhook signature headers" };
+}
+export {
+  GardeshPay,
+  GardeshPayError,
+  hmacSha256Base64,
+  hmacSha256Hex,
+  merchantCanonical,
+  newIdempotencyKey,
+  newNonce,
+  sha256Hex,
+  signMerchantRequest,
+  unixSeconds,
+  verifyWebhook
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts","../src/hmac.ts","../src/client.ts","../src/webhooks.ts"],"sourcesContent":["import type { ProblemDetails } from \"./types.js\";\n\nexport class GardeshPayError extends Error {\n  readonly status: number;\n  readonly code?: string;\n  readonly correlationId?: string;\n  readonly problem?: ProblemDetails;\n  readonly bodyText?: string;\n\n  constructor(\n    message: string,\n    opts: {\n      status: number;\n      code?: string;\n      correlationId?: string;\n      problem?: ProblemDetails;\n      bodyText?: string;\n    },\n  ) {\n    super(message);\n    this.name = \"GardeshPayError\";\n    this.status = opts.status;\n    this.code = opts.code;\n    this.correlationId = opts.correlationId;\n    this.problem = opts.problem;\n    this.bodyText = opts.bodyText;\n  }\n}\n","import { createHash, createHmac, randomUUID, timingSafeEqual } from \"node:crypto\";\n\n/** SHA-256 hex of UTF-8 body (empty string when body is empty). */\nexport function sha256Hex(body: string | Buffer | Uint8Array): string {\n  return createHash(\"sha256\").update(body ?? \"\").digest(\"hex\");\n}\n\n/**\n * Merchant API canonical string (must match Java `HmacSigner.merchantCanonical`):\n * `METHOD\\nPATH?QUERY\\nTIMESTAMP\\nNONCE\\nSHA256_HEX(body)`\n */\nexport function merchantCanonical(\n  method: string,\n  pathWithQuery: string,\n  timestamp: string,\n  nonce: string,\n  bodySha256Hex: string,\n): string {\n  return [method, pathWithQuery, timestamp, nonce, bodySha256Hex].join(\"\\n\");\n}\n\n/** Base64(HMAC-SHA256(secret, canonical)) — value for `X-Signature`. */\nexport function hmacSha256Base64(secret: string, canonical: string): string {\n  return createHmac(\"sha256\", secret).update(canonical, \"utf8\").digest(\"base64\");\n}\n\n/** Hex(HMAC-SHA256(secret, message)) — used for live webhook signatures. */\nexport function hmacSha256Hex(secret: string, message: string): string {\n  return createHmac(\"sha256\", secret).update(message, \"utf8\").digest(\"hex\");\n}\n\nexport function signMerchantRequest(opts: {\n  secret: string;\n  method: string;\n  pathWithQuery: string;\n  timestamp: string;\n  nonce: string;\n  body: string;\n}): string {\n  const bodyHash = sha256Hex(opts.body);\n  const canonical = merchantCanonical(\n    opts.method.toUpperCase(),\n    opts.pathWithQuery,\n    opts.timestamp,\n    opts.nonce,\n    bodyHash,\n  );\n  return hmacSha256Base64(opts.secret, canonical);\n}\n\nexport function newNonce(): string {\n  return `n-${randomUUID()}`;\n}\n\nexport function newIdempotencyKey(): string {\n  return randomUUID();\n}\n\nexport function unixSeconds(now = Date.now()): string {\n  return String(Math.floor(now / 1000));\n}\n\nexport function safeEqualHex(a: string, b: string): boolean {\n  try {\n    const left = Buffer.from(a, \"utf8\");\n    const right = Buffer.from(b, \"utf8\");\n    if (left.length !== right.length) return false;\n    return timingSafeEqual(left, right);\n  } catch {\n    return false;\n  }\n}\n","import { GardeshPayError } from \"./errors.js\";\nimport { newIdempotencyKey, newNonce, signMerchantRequest, unixSeconds } from \"./hmac.js\";\nimport type {\n  CreatePaymentInput,\n  CreatePaymentResult,\n  CreateRefundInput,\n  GardeshPayOptions,\n  PaymentResult,\n  ProblemDetails,\n  RefundResult,\n  VerifyPaymentResult,\n} from \"./types.js\";\n\ntype RequestOpts = {\n  method: \"GET\" | \"POST\";\n  path: string;\n  body?: unknown;\n  idempotencyKey?: string;\n  correlationId?: string;\n};\n\nexport class GardeshPay {\n  readonly apiKey: string;\n  readonly hmacSecret: string;\n  readonly baseUrl: string;\n  private readonly fetchImpl: typeof fetch;\n  private readonly timeoutMs: number;\n\n  constructor(options: GardeshPayOptions) {\n    if (!options?.apiKey?.trim()) throw new Error(\"apiKey is required\");\n    if (!options?.hmacSecret?.trim()) throw new Error(\"hmacSecret is required\");\n    if (!options?.baseUrl?.trim()) throw new Error(\"baseUrl is required (include /v1)\");\n    this.apiKey = options.apiKey.trim();\n    this.hmacSecret = options.hmacSecret.trim();\n    this.baseUrl = options.baseUrl.replace(/\\/+$/, \"\");\n    this.fetchImpl = options.fetch ?? fetch;\n    this.timeoutMs = options.timeoutMs ?? 30_000;\n  }\n\n  /** Create a payment and get checkout / start-pay URLs. */\n  async createPayment(input: CreatePaymentInput): Promise<CreatePaymentResult> {\n    const data = await this.request<CreatePaymentResult>({\n      method: \"POST\",\n      path: \"/payments\",\n      body: {\n        orderRef: input.orderRef,\n        amountRial: input.amountRial,\n        returnUrl: input.returnUrl,\n        callbackUrl: input.callbackUrl,\n        description: input.description,\n        expiresInSec: input.expiresInSec,\n        metadata: input.metadata,\n        gatewayId: input.gatewayId,\n      },\n      idempotencyKey: input.idempotencyKey ?? newIdempotencyKey(),\n      correlationId: input.correlationId,\n    });\n    return data;\n  }\n\n  /** GET payment status (masked). */\n  async getPayment(paymentId: string): Promise<PaymentResult> {\n    return this.request<PaymentResult>({\n      method: \"GET\",\n      path: `/payments/${encodeURIComponent(paymentId)}`,\n    });\n  }\n\n  /**\n   * Authoritative verify before fulfillment (idempotent).\n   * Fulfill only when `status === \"SUCCEEDED\"`.\n   */\n  async verifyPayment(\n    paymentId: string,\n    opts?: { idempotencyKey?: string },\n  ): Promise<VerifyPaymentResult> {\n    return this.request<VerifyPaymentResult>({\n      method: \"POST\",\n      path: `/payments/${encodeURIComponent(paymentId)}/verify`,\n      // Empty body — matches typical verify clients; HMAC hashes empty string.\n      idempotencyKey: opts?.idempotencyKey ?? newIdempotencyKey(),\n    });\n  }\n\n  /** Create a refund against a succeeded payment. */\n  async createRefund(input: CreateRefundInput): Promise<RefundResult> {\n    return this.request<RefundResult>({\n      method: \"POST\",\n      path: `/payments/${encodeURIComponent(input.paymentId)}/refunds`,\n      body: {\n        amountRial: input.amountRial,\n        reason: input.reason,\n      },\n      idempotencyKey: input.idempotencyKey ?? newIdempotencyKey(),\n    });\n  }\n\n  private async request<T>(opts: RequestOpts): Promise<T> {\n    const pathWithQuery = opts.path.startsWith(\"/\") ? opts.path : `/${opts.path}`;\n    const url = `${this.baseUrl}${pathWithQuery}`;\n    const bodyText =\n      opts.method === \"GET\" || opts.body === undefined ? \"\" : JSON.stringify(opts.body ?? {});\n    const timestamp = unixSeconds();\n    const nonce = newNonce();\n    // Sign against the public path as exposed under /v1 (matches Java filter).\n    const signPath = `/v1${pathWithQuery}`;\n    const signature = signMerchantRequest({\n      secret: this.hmacSecret,\n      method: opts.method,\n      pathWithQuery: signPath,\n      timestamp,\n      nonce,\n      body: bodyText,\n    });\n\n    const headers: Record<string, string> = {\n      Accept: \"application/json\",\n      \"X-Api-Key\": this.apiKey,\n      \"X-Timestamp\": timestamp,\n      \"X-Nonce\": nonce,\n      \"X-Signature\": signature,\n    };\n    if (bodyText) headers[\"Content-Type\"] = \"application/json\";\n    if (opts.idempotencyKey) headers[\"Idempotency-Key\"] = opts.idempotencyKey;\n    if (opts.correlationId) headers[\"X-Correlation-Id\"] = opts.correlationId;\n\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n    let res: Response;\n    try {\n      res = await this.fetchImpl(url, {\n        method: opts.method,\n        headers,\n        body: bodyText || undefined,\n        signal: controller.signal,\n      });\n    } catch (err) {\n      clearTimeout(timer);\n      throw new GardeshPayError(\n        err instanceof Error ? err.message : \"network error\",\n        { status: 0 },\n      );\n    } finally {\n      clearTimeout(timer);\n    }\n\n    const text = await res.text();\n    let json: unknown = undefined;\n    if (text) {\n      try {\n        json = JSON.parse(text);\n      } catch {\n        json = undefined;\n      }\n    }\n\n    if (!res.ok) {\n      const problem = (json && typeof json === \"object\" ? json : undefined) as\n        | ProblemDetails\n        | undefined;\n      throw new GardeshPayError(problem?.detail || problem?.title || `HTTP ${res.status}`, {\n        status: res.status,\n        code: problem?.code,\n        correlationId: problem?.correlationId,\n        problem,\n        bodyText: text,\n      });\n    }\n\n    if (json && typeof json === \"object\" && \"data\" in json) {\n      return (json as { data: T }).data;\n    }\n    return json as T;\n  }\n}\n","import { hmacSha256Hex, safeEqualHex } from \"./hmac.js\";\n\nexport type WebhookHeaders = Record<string, string | string[] | undefined>;\n\nfunction header(headers: WebhookHeaders, name: string): string | undefined {\n  const direct = headers[name] ?? headers[name.toLowerCase()];\n  if (Array.isArray(direct)) return direct[0];\n  if (typeof direct === \"string\") return direct;\n  // case-insensitive fallback\n  const key = Object.keys(headers).find((k) => k.toLowerCase() === name.toLowerCase());\n  if (!key) return undefined;\n  const v = headers[key];\n  return Array.isArray(v) ? v[0] : v;\n}\n\n/**\n * Verify an inbound GardeshPay / PayGate365 webhook.\n *\n * Live notification-service signs with:\n * - `X-PayGate-Signature: sha256=<hex(HMAC-SHA256(secret, `${t}.${rawBody}`))>`\n * - `X-PayGate-Timestamp: <unix seconds>`\n *\n * Docs also mention `X-PG365-Signature: t=…,v1=…` — both are accepted.\n *\n * Webhooks are **notifications only**. Always call `payments.verify` (or GET)\n * before fulfilling an order.\n */\nexport function verifyWebhook(opts: {\n  secret: string;\n  rawBody: string | Buffer;\n  headers: WebhookHeaders;\n  /** Max clock skew in seconds (default 300). */\n  skewSeconds?: number;\n  nowSeconds?: number;\n}): { ok: true; timestamp: string; eventType?: string } | { ok: false; reason: string } {\n  const skew = opts.skewSeconds ?? 300;\n  const now = opts.nowSeconds ?? Math.floor(Date.now() / 1000);\n  const raw = typeof opts.rawBody === \"string\" ? opts.rawBody : opts.rawBody.toString(\"utf8\");\n\n  const paygateSig = header(opts.headers, \"X-PayGate-Signature\");\n  const paygateTs = header(opts.headers, \"X-PayGate-Timestamp\");\n  if (paygateSig && paygateTs) {\n    const ts = Number(paygateTs);\n    if (!Number.isFinite(ts) || Math.abs(now - ts) > skew) {\n      return { ok: false, reason: \"timestamp skew\" };\n    }\n    const expectedHex = hmacSha256Hex(opts.secret, `${paygateTs}.${raw}`);\n    const presented = paygateSig.replace(/^sha256=/i, \"\").trim();\n    if (!safeEqualHex(expectedHex, presented)) {\n      return { ok: false, reason: \"invalid signature\" };\n    }\n    return {\n      ok: true,\n      timestamp: paygateTs,\n      eventType: header(opts.headers, \"X-PayGate-Event\"),\n    };\n  }\n\n  const pg365 = header(opts.headers, \"X-PG365-Signature\");\n  if (pg365) {\n    // Format: t=<unix>,v1=<hex>\n    const parts = Object.fromEntries(\n      pg365.split(\",\").map((p) => {\n        const [k, ...rest] = p.trim().split(\"=\");\n        return [k, rest.join(\"=\")];\n      }),\n    ) as Record<string, string>;\n    const t = parts.t;\n    const v1 = parts.v1;\n    if (!t || !v1) return { ok: false, reason: \"malformed X-PG365-Signature\" };\n    const ts = Number(t);\n    if (!Number.isFinite(ts) || Math.abs(now - ts) > skew) {\n      return { ok: false, reason: \"timestamp skew\" };\n    }\n    const expected = hmacSha256Hex(opts.secret, `${t}.${raw}`);\n    if (!safeEqualHex(expected, v1)) {\n      return { ok: false, reason: \"invalid signature\" };\n    }\n    return { ok: true, timestamp: t };\n  }\n\n  return { ok: false, reason: \"missing webhook signature headers\" };\n}\n"],"mappings":";AAEO,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YACE,SACA,MAOA;AACA,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS,KAAK;AACnB,SAAK,OAAO,KAAK;AACjB,SAAK,gBAAgB,KAAK;AAC1B,SAAK,UAAU,KAAK;AACpB,SAAK,WAAW,KAAK;AAAA,EACvB;AACF;;;AC3BA,SAAS,YAAY,YAAY,YAAY,uBAAuB;AAG7D,SAAS,UAAU,MAA4C;AACpE,SAAO,WAAW,QAAQ,EAAE,OAAO,QAAQ,EAAE,EAAE,OAAO,KAAK;AAC7D;AAMO,SAAS,kBACd,QACA,eACA,WACA,OACA,eACQ;AACR,SAAO,CAAC,QAAQ,eAAe,WAAW,OAAO,aAAa,EAAE,KAAK,IAAI;AAC3E;AAGO,SAAS,iBAAiB,QAAgB,WAA2B;AAC1E,SAAO,WAAW,UAAU,MAAM,EAAE,OAAO,WAAW,MAAM,EAAE,OAAO,QAAQ;AAC/E;AAGO,SAAS,cAAc,QAAgB,SAAyB;AACrE,SAAO,WAAW,UAAU,MAAM,EAAE,OAAO,SAAS,MAAM,EAAE,OAAO,KAAK;AAC1E;AAEO,SAAS,oBAAoB,MAOzB;AACT,QAAM,WAAW,UAAU,KAAK,IAAI;AACpC,QAAM,YAAY;AAAA,IAChB,KAAK,OAAO,YAAY;AAAA,IACxB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL;AAAA,EACF;AACA,SAAO,iBAAiB,KAAK,QAAQ,SAAS;AAChD;AAEO,SAAS,WAAmB;AACjC,SAAO,KAAK,WAAW,CAAC;AAC1B;AAEO,SAAS,oBAA4B;AAC1C,SAAO,WAAW;AACpB;AAEO,SAAS,YAAY,MAAM,KAAK,IAAI,GAAW;AACpD,SAAO,OAAO,KAAK,MAAM,MAAM,GAAI,CAAC;AACtC;AAEO,SAAS,aAAa,GAAW,GAAoB;AAC1D,MAAI;AACF,UAAM,OAAO,OAAO,KAAK,GAAG,MAAM;AAClC,UAAM,QAAQ,OAAO,KAAK,GAAG,MAAM;AACnC,QAAI,KAAK,WAAW,MAAM,OAAQ,QAAO;AACzC,WAAO,gBAAgB,MAAM,KAAK;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AClDO,IAAM,aAAN,MAAiB;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACQ;AAAA,EACA;AAAA,EAEjB,YAAY,SAA4B;AACtC,QAAI,CAAC,SAAS,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,oBAAoB;AAClE,QAAI,CAAC,SAAS,YAAY,KAAK,EAAG,OAAM,IAAI,MAAM,wBAAwB;AAC1E,QAAI,CAAC,SAAS,SAAS,KAAK,EAAG,OAAM,IAAI,MAAM,mCAAmC;AAClF,SAAK,SAAS,QAAQ,OAAO,KAAK;AAClC,SAAK,aAAa,QAAQ,WAAW,KAAK;AAC1C,SAAK,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,EAAE;AACjD,SAAK,YAAY,QAAQ,SAAS;AAClC,SAAK,YAAY,QAAQ,aAAa;AAAA,EACxC;AAAA;AAAA,EAGA,MAAM,cAAc,OAAyD;AAC3E,UAAM,OAAO,MAAM,KAAK,QAA6B;AAAA,MACnD,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,MAAM;AAAA,QACJ,UAAU,MAAM;AAAA,QAChB,YAAY,MAAM;AAAA,QAClB,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,aAAa,MAAM;AAAA,QACnB,cAAc,MAAM;AAAA,QACpB,UAAU,MAAM;AAAA,QAChB,WAAW,MAAM;AAAA,MACnB;AAAA,MACA,gBAAgB,MAAM,kBAAkB,kBAAkB;AAAA,MAC1D,eAAe,MAAM;AAAA,IACvB,CAAC;AACD,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,WAAW,WAA2C;AAC1D,WAAO,KAAK,QAAuB;AAAA,MACjC,QAAQ;AAAA,MACR,MAAM,aAAa,mBAAmB,SAAS,CAAC;AAAA,IAClD,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,cACJ,WACA,MAC8B;AAC9B,WAAO,KAAK,QAA6B;AAAA,MACvC,QAAQ;AAAA,MACR,MAAM,aAAa,mBAAmB,SAAS,CAAC;AAAA;AAAA,MAEhD,gBAAgB,MAAM,kBAAkB,kBAAkB;AAAA,IAC5D,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,aAAa,OAAiD;AAClE,WAAO,KAAK,QAAsB;AAAA,MAChC,QAAQ;AAAA,MACR,MAAM,aAAa,mBAAmB,MAAM,SAAS,CAAC;AAAA,MACtD,MAAM;AAAA,QACJ,YAAY,MAAM;AAAA,QAClB,QAAQ,MAAM;AAAA,MAChB;AAAA,MACA,gBAAgB,MAAM,kBAAkB,kBAAkB;AAAA,IAC5D,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,QAAW,MAA+B;AACtD,UAAM,gBAAgB,KAAK,KAAK,WAAW,GAAG,IAAI,KAAK,OAAO,IAAI,KAAK,IAAI;AAC3E,UAAM,MAAM,GAAG,KAAK,OAAO,GAAG,aAAa;AAC3C,UAAM,WACJ,KAAK,WAAW,SAAS,KAAK,SAAS,SAAY,KAAK,KAAK,UAAU,KAAK,QAAQ,CAAC,CAAC;AACxF,UAAM,YAAY,YAAY;AAC9B,UAAM,QAAQ,SAAS;AAEvB,UAAM,WAAW,MAAM,aAAa;AACpC,UAAM,YAAY,oBAAoB;AAAA,MACpC,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK;AAAA,MACb,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA,MAAM;AAAA,IACR,CAAC;AAED,UAAM,UAAkC;AAAA,MACtC,QAAQ;AAAA,MACR,aAAa,KAAK;AAAA,MAClB,eAAe;AAAA,MACf,WAAW;AAAA,MACX,eAAe;AAAA,IACjB;AACA,QAAI,SAAU,SAAQ,cAAc,IAAI;AACxC,QAAI,KAAK,eAAgB,SAAQ,iBAAiB,IAAI,KAAK;AAC3D,QAAI,KAAK,cAAe,SAAQ,kBAAkB,IAAI,KAAK;AAE3D,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,SAAS;AACjE,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,KAAK,UAAU,KAAK;AAAA,QAC9B,QAAQ,KAAK;AAAA,QACb;AAAA,QACA,MAAM,YAAY;AAAA,QAClB,QAAQ,WAAW;AAAA,MACrB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,mBAAa,KAAK;AAClB,YAAM,IAAI;AAAA,QACR,eAAe,QAAQ,IAAI,UAAU;AAAA,QACrC,EAAE,QAAQ,EAAE;AAAA,MACd;AAAA,IACF,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAEA,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,QAAI,OAAgB;AACpB,QAAI,MAAM;AACR,UAAI;AACF,eAAO,KAAK,MAAM,IAAI;AAAA,MACxB,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAEA,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,UAAW,QAAQ,OAAO,SAAS,WAAW,OAAO;AAG3D,YAAM,IAAI,gBAAgB,SAAS,UAAU,SAAS,SAAS,QAAQ,IAAI,MAAM,IAAI;AAAA,QACnF,QAAQ,IAAI;AAAA,QACZ,MAAM,SAAS;AAAA,QACf,eAAe,SAAS;AAAA,QACxB;AAAA,QACA,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAEA,QAAI,QAAQ,OAAO,SAAS,YAAY,UAAU,MAAM;AACtD,aAAQ,KAAqB;AAAA,IAC/B;AACA,WAAO;AAAA,EACT;AACF;;;AC1KA,SAAS,OAAO,SAAyB,MAAkC;AACzE,QAAM,SAAS,QAAQ,IAAI,KAAK,QAAQ,KAAK,YAAY,CAAC;AAC1D,MAAI,MAAM,QAAQ,MAAM,EAAG,QAAO,OAAO,CAAC;AAC1C,MAAI,OAAO,WAAW,SAAU,QAAO;AAEvC,QAAM,MAAM,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,MAAM,KAAK,YAAY,CAAC;AACnF,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,IAAI,QAAQ,GAAG;AACrB,SAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI;AACnC;AAcO,SAAS,cAAc,MAO0D;AACtF,QAAM,OAAO,KAAK,eAAe;AACjC,QAAM,MAAM,KAAK,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC3D,QAAM,MAAM,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU,KAAK,QAAQ,SAAS,MAAM;AAE1F,QAAM,aAAa,OAAO,KAAK,SAAS,qBAAqB;AAC7D,QAAM,YAAY,OAAO,KAAK,SAAS,qBAAqB;AAC5D,MAAI,cAAc,WAAW;AAC3B,UAAM,KAAK,OAAO,SAAS;AAC3B,QAAI,CAAC,OAAO,SAAS,EAAE,KAAK,KAAK,IAAI,MAAM,EAAE,IAAI,MAAM;AACrD,aAAO,EAAE,IAAI,OAAO,QAAQ,iBAAiB;AAAA,IAC/C;AACA,UAAM,cAAc,cAAc,KAAK,QAAQ,GAAG,SAAS,IAAI,GAAG,EAAE;AACpE,UAAM,YAAY,WAAW,QAAQ,aAAa,EAAE,EAAE,KAAK;AAC3D,QAAI,CAAC,aAAa,aAAa,SAAS,GAAG;AACzC,aAAO,EAAE,IAAI,OAAO,QAAQ,oBAAoB;AAAA,IAClD;AACA,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,WAAW;AAAA,MACX,WAAW,OAAO,KAAK,SAAS,iBAAiB;AAAA,IACnD;AAAA,EACF;AAEA,QAAM,QAAQ,OAAO,KAAK,SAAS,mBAAmB;AACtD,MAAI,OAAO;AAET,UAAM,QAAQ,OAAO;AAAA,MACnB,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM;AAC1B,cAAM,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG;AACvC,eAAO,CAAC,GAAG,KAAK,KAAK,GAAG,CAAC;AAAA,MAC3B,CAAC;AAAA,IACH;AACA,UAAM,IAAI,MAAM;AAChB,UAAM,KAAK,MAAM;AACjB,QAAI,CAAC,KAAK,CAAC,GAAI,QAAO,EAAE,IAAI,OAAO,QAAQ,8BAA8B;AACzE,UAAM,KAAK,OAAO,CAAC;AACnB,QAAI,CAAC,OAAO,SAAS,EAAE,KAAK,KAAK,IAAI,MAAM,EAAE,IAAI,MAAM;AACrD,aAAO,EAAE,IAAI,OAAO,QAAQ,iBAAiB;AAAA,IAC/C;AACA,UAAM,WAAW,cAAc,KAAK,QAAQ,GAAG,CAAC,IAAI,GAAG,EAAE;AACzD,QAAI,CAAC,aAAa,UAAU,EAAE,GAAG;AAC/B,aAAO,EAAE,IAAI,OAAO,QAAQ,oBAAoB;AAAA,IAClD;AACA,WAAO,EAAE,IAAI,MAAM,WAAW,EAAE;AAAA,EAClC;AAEA,SAAO,EAAE,IAAI,OAAO,QAAQ,oCAAoC;AAClE;","names":[]}

package/package.json

@@ -1,6 +1,59 @@
 {
   "name": "gardeshpay-sdk",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Official Node.js SDK for GardeshPay / PayGate365 Merchant API — payments, verify, refunds, HMAC auth, webhook signature helpers. (npm name gardeshpay was already taken by an unrelated 2020 package.)",
+  "license": "MIT",
+  "author": "GardeshPay / PayGate365",
+  "keywords": [
+    "gardeshpay",
+    "paygate365",
+    "payment",
+    "iran",
+    "ipg",
+    "hmac",
+    "merchant-api",
+    "psp"
+  ],
+  "homepage": "https://source365.ir/paygate365",
+  "repository": {
+    "type": "git",
+    "url": "git+https://source365.ir/paygate365/gardeshpay.git"
+  },
+  "bugs": {
+    "url": "https://source365.ir/paygate365/gardeshpay/issues"
+  },
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "build": "tsup src/index.ts --format esm,cjs --dts --clean --sourcemap",
+    "test": "node --import tsx --test test/**/*.test.ts",
+    "prepublishOnly": "npm run build && npm test",
+    "typecheck": "tsc --noEmit"
+  },
+  "devDependencies": {
+    "@types/node": "^22.13.10",
+    "tsup": "^8.4.0",
+    "tsx": "^4.19.3",
+    "typescript": "^5.8.2"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}