mupag-sdk 0.2.0

package/README.md

@@ -0,0 +1,224 @@
+# MuPag SDK para Node.js
+
+SDK TypeScript/Node.js oficial da MuPag. A ideia e deixar pagamento tao facil quanto criar um cliente, chamar `mupag.charges.create(...)` e seguir com o produto.
+
+Ele foi desenhado para parecer uma biblioteca escrita por pessoa: nomes curtos, erros uteis, retries seguros e idempotencia automatica. Sem cliente HTTP pesado, sem codigo gerado vazando para sua aplicacao.
+
+## Install
+
+```bash
+npm install mupag-sdk
+```
+
+> Migração: se seu projeto ainda usa `mupay-sdk`, atualize a dependência e os imports para `mupag-sdk`.
+
+## Quickstart em menos de 1 minuto
+
+```ts
+import { MuPag } from 'mupag-sdk';
+
+const mupag = new MuPag({
+  apiKey: process.env.MUPAG_API_KEY!,
+  env: 'test'
+});
+
+const charge = await mupag.charges.create({
+  amount_cents: 9990,
+  payment_method: 'pix',
+  customer: {
+    id: 'cus_123',
+    name: 'Ana Silva',
+    email: 'ana@example.com',
+    tax_id: '12345678901'
+  }
+});
+
+console.log(charge.charge_id);
+```
+
+Pronto: o SDK escolhe a URL do sandbox, envia `Authorization`, gera `Idempotency-Key`, serializa JSON e faz retry seguro para respostas transientes.
+
+## Por que integrar com a SDK e nao montar HTTP na mao?
+
+- `mupag.charges.create(...)` e legivel por quem acabou de chegar no codigo.
+- Todo POST financeiro recebe idempotencia automaticamente.
+- Erros vem tipados com `code`, `suggestion`, `documentationUrl` e `requestId`.
+- Webhooks validam HMAC-SHA256, timestamp e payload bruto.
+- Bundle minificado+gzip fica abaixo de 50KB; hoje esta em torno de 1.7KB gzip.
+
+## Examples
+
+### PIX charge
+
+```ts
+const charge = await mupag.charges.create({
+  amount_cents: 9990,
+  payment_method: 'pix',
+  customer: {
+    id: 'cus_123',
+    name: 'Ana Silva',
+    email: 'ana@example.com',
+    tax_id: '12345678901'
+  },
+  description: 'Plano Pro mensal'
+});
+```
+
+### Card charge
+
+```ts
+const charge = await mupag.charges.create({
+  amount_cents: 14990,
+  payment_method: 'credit_card',
+  customer: {
+    id: 'cus_123',
+    name: 'Ana Silva',
+    email: 'ana@example.com',
+    tax_id: '12345678901'
+  },
+  card_token_id: '11111111-1111-1111-1111-111111111111',
+  payer_ip: '203.0.113.10',
+  installments: 1,
+  metadata: { cart_id: 'cart_789' }
+});
+```
+
+`payer_ip` deve ser o IP literal observado no checkout do pagador e atestado pelo merchant;
+nao envie o IP do servidor que chama a MuPag. O contrato atual aceita somente uma parcela,
+rejeita `soft_descriptor` e falha fechado quando o merchant exige 3DS.
+
+### Cancel subscription
+
+```ts
+const subscription = await mupag.subscriptions.cancel('sub_123', {
+  mode: 'immediate',
+  reason: 'customer_request'
+});
+```
+
+### Cancel charge
+
+O cancelamento exige uma chave estável definida pela aplicação porque o mesmo valor precisa
+sobreviver a processos e filas diferentes:
+
+```ts
+const cancellation = await mupag.charges.cancel('ch_123', {
+  idempotencyKey: 'cancel_order_123_attempt_1',
+  reason: 'payment_attempt_cancelled'
+});
+```
+
+### Refund
+
+```ts
+const refund = await mupag.refunds.create('ch_123', {
+  amount_cents: 9990,
+  reason: 'requested_by_customer'
+});
+```
+
+### Webhook validation
+
+```ts
+const event = await mupag.webhooks.constructEvent(
+  rawPayload,
+  request.headers.get('mupag-signature')!,
+  process.env.MUPAG_WEBHOOK_SECRET!
+);
+
+if (event.type === 'charge.paid') {
+  console.log(event.data);
+}
+```
+
+## Errors
+
+Erros da API preservam os campos DX-first do Problem Details:
+
+```ts
+import { ValidationError } from 'mupag-sdk';
+
+try {
+  await mupag.charges.create({
+    amount_cents: 0,
+    payment_method: 'pix',
+    customer: {
+      id: 'cus_123',
+      name: 'Ana Silva',
+      email: 'ana@example.com',
+      tax_id: '12345678901'
+    }
+  });
+} catch (error) {
+  if (error instanceof ValidationError) {
+    console.log(error.code);
+    console.log(error.suggestion);
+    console.log(error.documentationUrl);
+    console.log(error.requestId);
+  }
+}
+```
+
+Quando uma mutação pode ter sido aceita, mas a resposta final não é confiável, o SDK lança
+`OutcomeUnknownError`. A chave efetivamente enviada fica disponível no campo estruturado
+`idempotencyKey` e não aparece na mensagem do erro. Reutilize essa chave somente com o mesmo
+payload:
+
+```ts
+import { OutcomeUnknownError } from 'mupag-sdk';
+
+try {
+  await mupag.charges.create(payload, { idempotencyKey: 'order_123_attempt_1' });
+} catch (error) {
+  if (error instanceof OutcomeUnknownError) {
+    await reconcileUsingTheSamePayload(error.idempotencyKey, payload);
+  }
+}
+```
+
+## Runtime support
+
+- Node.js 18+
+- Bun
+- Deno
+- Cloudflare Workers
+- Vercel Edge
+
+O SDK usa `fetch`, `AbortController`, `crypto.subtle` e `TextEncoder`, sem `axios` ou `got`.
+
+## Como publicar no npm
+
+O pacote e publico e sem escopo: `mupag-sdk`. Pacotes npm sem escopo sao publicados no registry publico pelo proprio nome, desde que o nome esteja disponivel.
+
+Fluxo recomendado:
+
+1. Crie/acesse uma conta em [npmjs.com](https://www.npmjs.com/).
+2. Garanta que a equipe MuPag tem permissao para publicar `mupag-sdk`.
+3. Rode checks locais:
+
+```bash
+npm ci
+npm run check
+npm pack --dry-run
+```
+
+4. Publique manualmente:
+
+```bash
+npm publish
+```
+
+No fluxo atual, a publicação manual não usa provenance: o manifesto ainda não aponta para um
+repositório público correspondente e não existe uma execução de CI/OIDC compatível para assinar
+o artefato. Habilite `npm publish --provenance` somente depois que esses dois requisitos forem
+atendidos. O repositório não publica a SDK automaticamente pela pipeline do GitHub.
+
+Segundo a documentacao do npm, pacotes sem escopo sao publicos por natureza; para pacotes com escopo seria necessario `npm publish --access public`.
+
+## Useful docs
+
+- [API errors](https://docs.mupag.com.br/errors)
+- [Charges](https://docs.mupag.com.br/api/charges)
+- [Subscriptions](https://docs.mupag.com.br/api/subscriptions)
+- [Refunds](https://docs.mupag.com.br/api/refunds)
+- [Webhooks](https://docs.mupag.com.br/webhooks)

package/dist/chunk-FQHYME3I.js

@@ -0,0 +1,2 @@
+import {h as h$1}from'./chunk-M4RQIIHN.js';var m=300,f=1024*1024;async function p(e,s,o,n={}){let t=typeof e=="string"?e:new TextDecoder().decode(e);if((typeof e=="string"?new TextEncoder().encode(e).byteLength:e.byteLength)>f)throw new h$1({message:"Payload de webhook excede o limite seguro.",code:"webhook_payload_too_large",suggestion:"Rejeite o request com HTTP 413 antes de processar o evento."});let r=n.toleranceSeconds??m;if(o.length<1||o.length>512||o.trim()!==o)throw new h$1({message:"Webhook secret invalido.",code:"webhook_secret_invalid",suggestion:"Configure o webhook secret exato e nao use valor vazio ou com espacos externos."});if(!Number.isSafeInteger(r)||r<1||r>1440*60)throw new h$1({message:"Tolerancia de webhook invalida.",code:"webhook_tolerance_invalid",suggestion:"Use uma tolerancia inteira entre 1 segundo e 24 horas."});let d=w(s);if(Math.abs(Math.floor(Date.now()/1e3)-d.timestamp)>r)throw new h$1({message:"Assinatura de webhook fora da janela de tolerancia.",code:"webhook_timestamp_outside_tolerance",suggestion:"Confira relogio do servidor e rejeite replays antigos."});let g=await b(o,`${d.timestamp}.${t}`);if(!y(g,d.value))throw new h$1({message:"Assinatura de webhook invalida.",code:"webhook_signature_mismatch",suggestion:"Use o webhook secret correto e o payload bruto, sem parse antes da validacao."});let a;try{a=JSON.parse(t);}catch{throw new h$1({message:"Payload de webhook nao e JSON valido.",code:"webhook_payload_invalid",suggestion:"Use o payload bruto recebido no endpoint da MuPag."})}if(typeof a.id!="string"||a.id.length===0||a.id.length>256||typeof a.type!="string"||a.type.length===0||a.type.length>128||a.data===null||typeof a.data!="object"||Array.isArray(a.data))throw new h$1({message:"Payload de webhook valido, mas sem campos obrigatorios.",code:"webhook_payload_invalid",suggestion:"Verifique se voce esta usando o endpoint de webhook da MuPag."});return a}var h=class{constructEvent=p};function w(e){if(e.length>4096)throw c();let s=e.split(",");if(s.length>16)throw c();let o,n;for(let l of s){let r=l.trim(),d=r.indexOf("=");if(d<=0)throw c();let u=r.slice(0,d),g=r.slice(d+1);if(u==="t"){if(o!==void 0)throw c();o=g;}else if(u==="v1"){if(n!==void 0)throw c();n=g;}}if(o===void 0||!/^(?:0|[1-9]\d*)$/.test(o))throw c();let t=Number(o);if(!Number.isSafeInteger(t)||t<=0||n===void 0||!/^[a-f0-9]{64}$/i.test(n))throw c();return {timestamp:t,value:n}}function c(){return new h$1({message:"Header de assinatura de webhook malformado.",code:"webhook_signature_malformed",suggestion:"Envie o header no formato t=<unix>,v1=<assinatura_hex>."})}async function b(e,s){let o=await crypto.subtle.importKey("raw",new TextEncoder().encode(e),{name:"HMAC",hash:"SHA-256"},false,["sign"]),n=await crypto.subtle.sign("HMAC",o,new TextEncoder().encode(s));return [...new Uint8Array(n)].map(t=>t.toString(16).padStart(2,"0")).join("")}function y(e,s){let o=Math.max(e.length,s.length),n=e.length^s.length;for(let t=0;t<o;t+=1)n|=(e.charCodeAt(t)||0)^(s.charCodeAt(t)||0);return n===0}export{p as a,h as b};//# sourceMappingURL=chunk-FQHYME3I.js.map
+//# sourceMappingURL=chunk-FQHYME3I.js.map

package/dist/chunk-FQHYME3I.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/webhooks.ts"],"names":["DEFAULT_TOLERANCE_SECONDS","MAX_WEBHOOK_BYTES","constructWebhookEvent","rawPayload","signatureHeader","secret","options","payload","WebhookSignatureError","toleranceSeconds","signature","parseSignatureHeader","expected","hmacSha256Hex","constantTimeEqual","event","WebhooksResource","malformedSignatureHeader","parts","timestampText","value","rawPart","part","separator","key","candidate","timestamp","byte","left","right","maxLength","diff","index"],"mappings":"2CAOA,IAAMA,CAAAA,CAA4B,GAAA,CAC5BC,CAAAA,CAAoB,IAAA,CAAO,IAAA,CASjC,eAAsBC,CAAAA,CACpBC,CAAAA,CACAC,CAAAA,CACAC,CAAAA,CACAC,CAAAA,CAA0B,EAAC,CACC,CAC5B,IAAMC,CAAAA,CAAU,OAAOJ,CAAAA,EAAe,QAAA,CAAWA,CAAAA,CAAa,IAAI,WAAA,EAAY,CAAE,MAAA,CAAOA,CAAU,CAAA,CAEjG,GAAA,CADqB,OAAOA,CAAAA,EAAe,SAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAOA,CAAU,CAAA,CAAE,UAAA,CAAaA,CAAAA,CAAW,UAAA,EAChGF,CAAAA,CACjB,MAAM,IAAIO,GAAAA,CAAsB,CAC9B,OAAA,CAAS,4CAAA,CACT,IAAA,CAAM,2BAAA,CACN,UAAA,CAAY,6DACd,CAAC,CAAA,CAEH,IAAMC,CAAAA,CAAmBH,CAAAA,CAAQ,gBAAA,EAAoBN,CAAAA,CACrD,GAAIK,CAAAA,CAAO,MAAA,CAAS,GAAKA,CAAAA,CAAO,MAAA,CAAS,GAAA,EAAOA,CAAAA,CAAO,IAAA,EAAK,GAAMA,CAAAA,CAChE,MAAM,IAAIG,GAAAA,CAAsB,CAC9B,OAAA,CAAS,0BAAA,CACT,IAAA,CAAM,wBAAA,CACN,UAAA,CAAY,iFACd,CAAC,CAAA,CAEH,GACE,CAAC,MAAA,CAAO,aAAA,CAAcC,CAAgB,CAAA,EACnCA,CAAAA,CAAmB,CAAA,EACnBA,CAAAA,CAAmB,IAAA,CAAU,EAAA,CAEhC,MAAM,IAAID,GAAAA,CAAsB,CAC9B,OAAA,CAAS,iCAAA,CACT,IAAA,CAAM,2BAAA,CACN,UAAA,CAAY,wDACd,CAAC,CAAA,CAEH,IAAME,CAAAA,CAAYC,CAAAA,CAAqBP,CAAe,CAAA,CAGtD,GAFmB,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,EAAI,CAAI,GAAI,CAAA,CAAIM,CAAAA,CAAU,SAAS,CAAA,CAE9DD,CAAAA,CACf,MAAM,IAAID,GAAAA,CAAsB,CAC9B,OAAA,CAAS,qDAAA,CACT,IAAA,CAAM,qCAAA,CACN,UAAA,CAAY,wDACd,CAAC,CAAA,CAGH,IAAMI,CAAAA,CAAW,MAAMC,CAAAA,CAAcR,CAAAA,CAAQ,CAAA,EAAGK,CAAAA,CAAU,SAAS,CAAA,CAAA,EAAIH,CAAO,CAAA,CAAE,CAAA,CAChF,GAAI,CAACO,CAAAA,CAAkBF,CAAAA,CAAUF,CAAAA,CAAU,KAAK,CAAA,CAC9C,MAAM,IAAIF,GAAAA,CAAsB,CAC9B,OAAA,CAAS,iCAAA,CACT,IAAA,CAAM,4BAAA,CACN,UAAA,CAAY,+EACd,CAAC,CAAA,CAGH,IAAIO,CAAAA,CACJ,GAAI,CACFA,CAAAA,CAAQ,IAAA,CAAK,KAAA,CAAMR,CAAO,EAC5B,CAAA,KAAQ,CACN,MAAM,IAAIC,GAAAA,CAAsB,CAC9B,OAAA,CAAS,uCAAA,CACT,IAAA,CAAM,yBAAA,CACN,UAAA,CAAY,oDACd,CAAC,CACH,CACA,GAAI,OAAOO,CAAAA,CAAM,EAAA,EAAO,QAAA,EAAYA,CAAAA,CAAM,EAAA,CAAG,MAAA,GAAW,CAAA,EAAKA,CAAAA,CAAM,EAAA,CAAG,MAAA,CAAS,GAAA,EAC1E,OAAOA,CAAAA,CAAM,IAAA,EAAS,QAAA,EAAYA,CAAAA,CAAM,IAAA,CAAK,MAAA,GAAW,CAAA,EAAKA,CAAAA,CAAM,IAAA,CAAK,MAAA,CAAS,GAAA,EACjFA,CAAAA,CAAM,IAAA,GAAS,IAAA,EAAQ,OAAOA,CAAAA,CAAM,IAAA,EAAS,QAAA,EAAY,KAAA,CAAM,OAAA,CAAQA,CAAAA,CAAM,IAAI,CAAA,CACpF,MAAM,IAAIP,GAAAA,CAAsB,CAC9B,OAAA,CAAS,yDAAA,CACT,IAAA,CAAM,yBAAA,CACN,UAAA,CAAY,+DACd,CAAC,CAAA,CAGH,OAAOO,CACT,CAEO,IAAMC,CAAAA,CAAN,KAAuB,CAC5B,cAAA,CAAiBd,CACnB,EAEA,SAASS,CAAAA,CAAqBP,CAAAA,CAAyB,CACrD,GAAIA,CAAAA,CAAgB,MAAA,CAAS,IAAA,CAAM,MAAMa,CAAAA,EAAyB,CAClE,IAAMC,CAAAA,CAAQd,CAAAA,CAAgB,KAAA,CAAM,GAAG,CAAA,CACvC,GAAIc,CAAAA,CAAM,MAAA,CAAS,EAAA,CAAI,MAAMD,CAAAA,EAAyB,CAEtD,IAAIE,CAAAA,CACAC,CAAAA,CACJ,IAAA,IAAWC,CAAAA,IAAWH,CAAAA,CAAO,CAC3B,IAAMI,CAAAA,CAAOD,CAAAA,CAAQ,IAAA,EAAK,CACpBE,CAAAA,CAAYD,CAAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,CAClC,GAAIC,CAAAA,EAAa,CAAA,CAAG,MAAMN,CAAAA,EAAyB,CACnD,IAAMO,CAAAA,CAAMF,CAAAA,CAAK,KAAA,CAAM,CAAA,CAAGC,CAAS,CAAA,CAC7BE,CAAAA,CAAYH,CAAAA,CAAK,KAAA,CAAMC,CAAAA,CAAY,CAAC,CAAA,CAC1C,GAAIC,CAAAA,GAAQ,IAAK,CACf,GAAIL,CAAAA,GAAkB,MAAA,CAAW,MAAMF,CAAAA,EAAyB,CAChEE,CAAAA,CAAgBM,EAClB,CAAA,KAAA,GAAWD,CAAAA,GAAQ,IAAA,CAAM,CACvB,GAAIJ,CAAAA,GAAU,MAAA,CAAW,MAAMH,CAAAA,EAAyB,CACxDG,CAAAA,CAAQK,EACV,CACF,CAEA,GAAIN,CAAAA,GAAkB,MAAA,EAAa,CAAC,kBAAA,CAAmB,IAAA,CAAKA,CAAa,CAAA,CACvE,MAAMF,CAAAA,EAAyB,CAEjC,IAAMS,CAAAA,CAAY,MAAA,CAAOP,CAAa,CAAA,CACtC,GAAI,CAAC,MAAA,CAAO,aAAA,CAAcO,CAAS,CAAA,EAAKA,CAAAA,EAAa,CAAA,EAAKN,CAAAA,GAAU,MAAA,EAAa,CAAC,iBAAA,CAAkB,IAAA,CAAKA,CAAK,CAAA,CAC5G,MAAMH,CAAAA,EAAyB,CAGjC,OAAO,CAAE,SAAA,CAAAS,CAAAA,CAAW,KAAA,CAAAN,CAAM,CAC5B,CAEA,SAASH,CAAAA,EAA2B,CAClC,OAAO,IAAIT,GAAAA,CAAsB,CAC/B,OAAA,CAAS,6CAAA,CACT,IAAA,CAAM,6BAAA,CACN,UAAA,CAAY,yDACd,CAAC,CACH,CAEA,eAAeK,CAAAA,CAAcR,CAAAA,CAAgBe,CAAAA,CAAe,CAC1D,IAAMI,CAAAA,CAAM,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA,CAC9B,KAAA,CACA,IAAI,WAAA,EAAY,CAAE,MAAA,CAAOnB,CAAM,CAAA,CAC/B,CAAE,IAAA,CAAM,MAAA,CAAQ,IAAA,CAAM,SAAU,CAAA,CAChC,KAAA,CACA,CAAC,MAAM,CACT,CAAA,CACMK,CAAAA,CAAY,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,MAAA,CAAQc,CAAAA,CAAK,IAAI,WAAA,EAAY,CAAE,MAAA,CAAOJ,CAAK,CAAC,CAAA,CACvF,OAAO,CAAC,GAAG,IAAI,UAAA,CAAWV,CAAS,CAAC,CAAA,CACjC,GAAA,CAAKiB,CAAAA,EAASA,CAAAA,CAAK,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,CAAA,CAAG,GAAG,CAAC,CAAA,CAChD,IAAA,CAAK,EAAE,CACZ,CAEA,SAASb,CAAAA,CAAkBc,CAAAA,CAAcC,CAAAA,CAAe,CACtD,IAAMC,CAAAA,CAAY,IAAA,CAAK,GAAA,CAAIF,CAAAA,CAAK,MAAA,CAAQC,CAAAA,CAAM,MAAM,CAAA,CAChDE,CAAAA,CAAOH,CAAAA,CAAK,MAAA,CAASC,CAAAA,CAAM,MAAA,CAE/B,IAAA,IAASG,CAAAA,CAAQ,CAAA,CAAGA,CAAAA,CAAQF,CAAAA,CAAWE,CAAAA,EAAS,CAAA,CAC9CD,CAAAA,EAAAA,CAASH,CAAAA,CAAK,UAAA,CAAWI,CAAK,CAAA,EAAK,CAAA,GAAMH,CAAAA,CAAM,UAAA,CAAWG,CAAK,CAAA,EAAK,CAAA,CAAA,CAGtE,OAAOD,CAAAA,GAAS,CAClB","file":"chunk-FQHYME3I.js","sourcesContent":["import { WebhookSignatureError } from './errors.js';\nimport type { JsonValue, MuPagEvent } from './types.js';\n\nexport type WebhookOptions = {\n  toleranceSeconds?: number;\n};\n\nconst DEFAULT_TOLERANCE_SECONDS = 300;\nconst MAX_WEBHOOK_BYTES = 1024 * 1024;\n\n/**\n * Valida assinatura HMAC-SHA256 de webhook e retorna evento tipado.\n *\n * A verificacao usa Web Crypto para funcionar tambem em Deno, Bun e edge\n * runtimes. O formato de assinatura e `t=<unix>,v1=<hex>`, sempre sobre\n * `timestamp.payload`, evitando replay com tolerancia curta.\n */\nexport async function constructWebhookEvent<TData extends JsonValue = JsonValue>(\n  rawPayload: string | Uint8Array,\n  signatureHeader: string,\n  secret: string,\n  options: WebhookOptions = {}\n): Promise<MuPagEvent<TData>> {\n  const payload = typeof rawPayload === 'string' ? rawPayload : new TextDecoder().decode(rawPayload);\n  const payloadBytes = typeof rawPayload === 'string' ? new TextEncoder().encode(rawPayload).byteLength : rawPayload.byteLength;\n  if (payloadBytes > MAX_WEBHOOK_BYTES) {\n    throw new WebhookSignatureError({\n      message: 'Payload de webhook excede o limite seguro.',\n      code: 'webhook_payload_too_large',\n      suggestion: 'Rejeite o request com HTTP 413 antes de processar o evento.'\n    });\n  }\n  const toleranceSeconds = options.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS;\n  if (secret.length < 1 || secret.length > 512 || secret.trim() !== secret) {\n    throw new WebhookSignatureError({\n      message: 'Webhook secret invalido.',\n      code: 'webhook_secret_invalid',\n      suggestion: 'Configure o webhook secret exato e nao use valor vazio ou com espacos externos.'\n    });\n  }\n  if (\n    !Number.isSafeInteger(toleranceSeconds)\n    || toleranceSeconds < 1\n    || toleranceSeconds > 24 * 60 * 60\n  ) {\n    throw new WebhookSignatureError({\n      message: 'Tolerancia de webhook invalida.',\n      code: 'webhook_tolerance_invalid',\n      suggestion: 'Use uma tolerancia inteira entre 1 segundo e 24 horas.'\n    });\n  }\n  const signature = parseSignatureHeader(signatureHeader);\n  const ageSeconds = Math.abs(Math.floor(Date.now() / 1000) - signature.timestamp);\n\n  if (ageSeconds > toleranceSeconds) {\n    throw new WebhookSignatureError({\n      message: 'Assinatura de webhook fora da janela de tolerancia.',\n      code: 'webhook_timestamp_outside_tolerance',\n      suggestion: 'Confira relogio do servidor e rejeite replays antigos.'\n    });\n  }\n\n  const expected = await hmacSha256Hex(secret, `${signature.timestamp}.${payload}`);\n  if (!constantTimeEqual(expected, signature.value)) {\n    throw new WebhookSignatureError({\n      message: 'Assinatura de webhook invalida.',\n      code: 'webhook_signature_mismatch',\n      suggestion: 'Use o webhook secret correto e o payload bruto, sem parse antes da validacao.'\n    });\n  }\n\n  let event: MuPagEvent<TData>;\n  try {\n    event = JSON.parse(payload) as MuPagEvent<TData>;\n  } catch {\n    throw new WebhookSignatureError({\n      message: 'Payload de webhook nao e JSON valido.',\n      code: 'webhook_payload_invalid',\n      suggestion: 'Use o payload bruto recebido no endpoint da MuPag.'\n    });\n  }\n  if (typeof event.id !== 'string' || event.id.length === 0 || event.id.length > 256\n    || typeof event.type !== 'string' || event.type.length === 0 || event.type.length > 128\n    || event.data === null || typeof event.data !== 'object' || Array.isArray(event.data)) {\n    throw new WebhookSignatureError({\n      message: 'Payload de webhook valido, mas sem campos obrigatorios.',\n      code: 'webhook_payload_invalid',\n      suggestion: 'Verifique se voce esta usando o endpoint de webhook da MuPag.'\n    });\n  }\n\n  return event;\n}\n\nexport class WebhooksResource {\n  constructEvent = constructWebhookEvent;\n}\n\nfunction parseSignatureHeader(signatureHeader: string) {\n  if (signatureHeader.length > 4096) throw malformedSignatureHeader();\n  const parts = signatureHeader.split(',');\n  if (parts.length > 16) throw malformedSignatureHeader();\n\n  let timestampText: string | undefined;\n  let value: string | undefined;\n  for (const rawPart of parts) {\n    const part = rawPart.trim();\n    const separator = part.indexOf('=');\n    if (separator <= 0) throw malformedSignatureHeader();\n    const key = part.slice(0, separator);\n    const candidate = part.slice(separator + 1);\n    if (key === 't') {\n      if (timestampText !== undefined) throw malformedSignatureHeader();\n      timestampText = candidate;\n    } else if (key === 'v1') {\n      if (value !== undefined) throw malformedSignatureHeader();\n      value = candidate;\n    }\n  }\n\n  if (timestampText === undefined || !/^(?:0|[1-9]\\d*)$/.test(timestampText)) {\n    throw malformedSignatureHeader();\n  }\n  const timestamp = Number(timestampText);\n  if (!Number.isSafeInteger(timestamp) || timestamp <= 0 || value === undefined || !/^[a-f0-9]{64}$/i.test(value)) {\n    throw malformedSignatureHeader();\n  }\n\n  return { timestamp, value };\n}\n\nfunction malformedSignatureHeader() {\n  return new WebhookSignatureError({\n    message: 'Header de assinatura de webhook malformado.',\n    code: 'webhook_signature_malformed',\n    suggestion: 'Envie o header no formato t=<unix>,v1=<assinatura_hex>.'\n  });\n}\n\nasync function hmacSha256Hex(secret: string, value: string) {\n  const key = await crypto.subtle.importKey(\n    'raw',\n    new TextEncoder().encode(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign']\n  );\n  const signature = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(value));\n  return [...new Uint8Array(signature)]\n    .map((byte) => byte.toString(16).padStart(2, '0'))\n    .join('');\n}\n\nfunction constantTimeEqual(left: string, right: string) {\n  const maxLength = Math.max(left.length, right.length);\n  let diff = left.length ^ right.length;\n\n  for (let index = 0; index < maxLength; index += 1) {\n    diff |= (left.charCodeAt(index) || 0) ^ (right.charCodeAt(index) || 0);\n  }\n\n  return diff === 0;\n}\n"]}

package/dist/chunk-M4RQIIHN.js

@@ -0,0 +1,2 @@
+var u=class extends Error{status;code;requestId;suggestion;documentationUrl;constructor(e){super(e.message,e.cause===void 0?void 0:{cause:e.cause}),this.name="MuPagError",this.status=e.status,this.code=e.code,this.requestId=e.requestId,this.suggestion=e.suggestion,this.documentationUrl=e.documentationUrl;}},t=class extends u{constructor(e){super(e),this.name="APIError";}},i=class extends t{retryAfter;constructor(e){super(e),this.name="RateLimitError",this.retryAfter=e.retryAfter;}},d=class extends t{constructor(e){super(e),this.name="ValidationError";}},a=class extends t{constructor(e){super(e),this.name="AuthError";}},c=class extends t{constructor(e){super(e),this.name="IdempotencyError";}},m=class extends t{idempotencyKey;outcomeUnknown=true;constructor(e,s){let r=s instanceof t?s:void 0;super({message:"O resultado da mutacao e desconhecido; reutilize a Idempotency-Key exposta com o mesmo payload.",status:r?.status,code:"outcome_unknown",requestId:r?.requestId,suggestion:"Reutilize a mesma Idempotency-Key e o mesmo payload para reconciliar a operacao.",documentationUrl:r?.documentationUrl,cause:s}),this.name="OutcomeUnknownError",this.idempotencyKey=e;}},g=class extends u{constructor(e){super(e),this.name="WebhookSignatureError";}};function y(n,e,s){let r=l(e)?e:{},o={message:r.detail??r.title??`A API retornou HTTP ${n}.`,status:n,code:r.code,requestId:r.request_id??s.get("request-id")??void 0,suggestion:r.suggestion,documentationUrl:r.documentation_url};return n===401||n===403?new a(o):n===409&&r.code==="idempotency_key_reused"?new c(o):n===400||n===422?new d(o):n===429?new i({...o,retryAfter:f(s.get("retry-after"))}):new t(o)}function f(n){if(n===null)return;if(/^\d+$/.test(n))return Number(n);let e=Date.parse(n);if(!Number.isNaN(e))return Math.max(0,Math.ceil((e-Date.now())/1e3))}function l(n){return typeof n=="object"&&n!==null&&!Array.isArray(n)}export{u as a,t as b,i as c,d,a as e,c as f,m as g,g as h,y as i};//# sourceMappingURL=chunk-M4RQIIHN.js.map
+//# sourceMappingURL=chunk-M4RQIIHN.js.map

package/dist/chunk-M4RQIIHN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts"],"names":["MuPagError","options","APIError","RateLimitError","ValidationError","AuthError","IdempotencyError","OutcomeUnknownError","idempotencyKey","cause","apiCause","WebhookSignatureError","createApiError","status","payload","headers","problem","isProblemDetails","parseRetryAfter","value","retryAt"],"mappings":"AAsBO,IAAMA,EAAN,cAAyB,KAAM,CAC3B,MAAA,CACA,KACA,SAAA,CACA,UAAA,CACA,gBAAA,CAST,WAAA,CAAYC,EAA4B,CACtC,KAAA,CAAMA,EAAQ,OAAA,CAASA,CAAAA,CAAQ,QAAU,MAAA,CAAY,MAAA,CAAY,CAAE,KAAA,CAAOA,EAAQ,KAAM,CAAC,CAAA,CACzF,IAAA,CAAK,KAAO,YAAA,CACZ,IAAA,CAAK,MAAA,CAASA,CAAAA,CAAQ,OACtB,IAAA,CAAK,IAAA,CAAOA,EAAQ,IAAA,CACpB,IAAA,CAAK,UAAYA,CAAAA,CAAQ,SAAA,CACzB,IAAA,CAAK,UAAA,CAAaA,EAAQ,UAAA,CAC1B,IAAA,CAAK,gBAAA,CAAmBA,CAAAA,CAAQ,iBAClC,CACF,CAAA,CAEaC,CAAAA,CAAN,cAAuBF,CAAW,CACvC,WAAA,CAAYC,EAA4B,CACtC,KAAA,CAAMA,CAAO,CAAA,CACb,IAAA,CAAK,IAAA,CAAO,WACd,CACF,CAAA,CAEaE,CAAAA,CAAN,cAA6BD,CAAS,CAClC,WAET,WAAA,CAAYD,CAAAA,CAAkE,CAC5E,KAAA,CAAMA,CAAO,CAAA,CACb,IAAA,CAAK,KAAO,gBAAA,CACZ,IAAA,CAAK,WAAaA,CAAAA,CAAQ,WAC5B,CACF,CAAA,CAEaG,EAAN,cAA8BF,CAAS,CAC5C,WAAA,CAAYD,EAA4B,CACtC,KAAA,CAAMA,CAAO,CAAA,CACb,KAAK,IAAA,CAAO,kBACd,CACF,CAAA,CAEaI,CAAAA,CAAN,cAAwBH,CAAS,CACtC,WAAA,CAAYD,CAAAA,CAA4B,CACtC,KAAA,CAAMA,CAAO,EACb,IAAA,CAAK,IAAA,CAAO,YACd,CACF,CAAA,CAEaK,CAAAA,CAAN,cAA+BJ,CAAS,CAC7C,WAAA,CAAYD,EAA4B,CACtC,KAAA,CAAMA,CAAO,CAAA,CACb,IAAA,CAAK,IAAA,CAAO,mBACd,CACF,CAAA,CAEaM,CAAAA,CAAN,cAAkCL,CAAS,CACvC,cAAA,CACA,cAAA,CAAiB,IAAA,CAQ1B,WAAA,CAAYM,EAAwBC,CAAAA,CAAgB,CAClD,IAAMC,CAAAA,CAAWD,CAAAA,YAAiBP,EAAWO,CAAAA,CAAQ,MAAA,CACrD,KAAA,CAAM,CACJ,QACE,iGAAA,CACF,MAAA,CAAQC,GAAU,MAAA,CAClB,IAAA,CAAM,kBACN,SAAA,CAAWA,CAAAA,EAAU,SAAA,CACrB,UAAA,CACE,mFACF,gBAAA,CAAkBA,CAAAA,EAAU,iBAC5B,KAAA,CAAAD,CACF,CAAC,CAAA,CACD,IAAA,CAAK,IAAA,CAAO,qBAAA,CACZ,KAAK,cAAA,CAAiBD,EACxB,CACF,CAAA,CAEaG,EAAN,cAAoCX,CAAW,CACpD,WAAA,CAAYC,EAA4B,CACtC,KAAA,CAAMA,CAAO,CAAA,CACb,IAAA,CAAK,KAAO,wBACd,CACF,EAEO,SAASW,EACdC,CAAAA,CACAC,CAAAA,CACAC,CAAAA,CACU,CACV,IAAMC,CAAAA,CAAUC,CAAAA,CAAiBH,CAAO,CAAA,CAAIA,EAAU,EAAC,CAEjDb,EAA6B,CACjC,OAAA,CAFce,EAAQ,MAAA,EAAUA,CAAAA,CAAQ,KAAA,EAAS,CAAA,oBAAA,EAAuBH,CAAM,CAAA,CAAA,CAAA,CAG9E,MAAA,CAAAA,CAAAA,CACA,IAAA,CAAMG,EAAQ,IAAA,CACd,SAAA,CAAWA,CAAAA,CAAQ,UAAA,EAAcD,EAAQ,GAAA,CAAI,YAAY,GAAK,MAAA,CAC9D,UAAA,CAAYC,EAAQ,UAAA,CACpB,gBAAA,CAAkBA,CAAAA,CAAQ,iBAC5B,EAEA,OAAIH,CAAAA,GAAW,KAAOA,CAAAA,GAAW,GAAA,CACxB,IAAIR,CAAAA,CAAUJ,CAAO,CAAA,CAG1BY,CAAAA,GAAW,KAAOG,CAAAA,CAAQ,IAAA,GAAS,yBAC9B,IAAIV,CAAAA,CAAiBL,CAAO,CAAA,CAGjCY,CAAAA,GAAW,GAAA,EAAOA,CAAAA,GAAW,IACxB,IAAIT,CAAAA,CAAgBH,CAAO,CAAA,CAGhCY,IAAW,GAAA,CACN,IAAIV,CAAAA,CAAe,CACxB,GAAGF,CAAAA,CACH,UAAA,CAAYiB,EAAgBH,CAAAA,CAAQ,GAAA,CAAI,aAAa,CAAC,CACxD,CAAC,CAAA,CAGI,IAAIb,CAAAA,CAASD,CAAO,CAC7B,CAEA,SAASiB,EAAgBC,CAAAA,CAA0C,CACjE,GAAIA,CAAAA,GAAU,KAAM,OACpB,GAAI,QAAQ,IAAA,CAAKA,CAAK,EAAG,OAAO,MAAA,CAAOA,CAAK,CAAA,CAC5C,IAAMC,CAAAA,CAAU,IAAA,CAAK,KAAA,CAAMD,CAAK,EAChC,GAAI,CAAA,MAAA,CAAO,KAAA,CAAMC,CAAO,EACxB,OAAO,IAAA,CAAK,IAAI,CAAA,CAAG,IAAA,CAAK,MAAMA,CAAAA,CAAU,IAAA,CAAK,GAAA,EAAI,EAAK,GAAK,CAAC,CAC9D,CAEA,SAASH,CAAAA,CAAiBE,EAAuD,CAC/E,OAAO,OAAOA,CAAAA,EAAU,UAAYA,CAAAA,GAAU,IAAA,EAAQ,CAAC,KAAA,CAAM,OAAA,CAAQA,CAAK,CAC5E","file":"chunk-M4RQIIHN.js","sourcesContent":["import type { JsonObject, JsonValue } from './types.js';\n\nexport type ProblemDetails = JsonObject & {\n  title?: string | undefined;\n  detail?: string | undefined;\n  status?: number | undefined;\n  code?: string | undefined;\n  suggestion?: string | undefined;\n  documentation_url?: string | undefined;\n  request_id?: string | undefined;\n};\n\nexport type MuPagErrorOptions = {\n  message: string;\n  status?: number | undefined;\n  code?: string | undefined;\n  requestId?: string | undefined;\n  suggestion?: string | undefined;\n  documentationUrl?: string | undefined;\n  cause?: unknown | undefined;\n};\n\nexport class MuPagError extends Error {\n  readonly status: number | undefined;\n  readonly code: string | undefined;\n  readonly requestId: string | undefined;\n  readonly suggestion: string | undefined;\n  readonly documentationUrl: string | undefined;\n\n  /**\n   * Mantem os campos de erro da API acessiveis no SDK sem expor payload bruto.\n   *\n   * A API publica envia Problem Details com extensoes DX-first. O SDK preserva\n   * codigo, sugestao, link e request_id para o integrador resolver o problema\n   * sem abrir suporte, mas evita guardar headers ou corpo inteiro com dados sensiveis.\n   */\n  constructor(options: MuPagErrorOptions) {\n    super(options.message, options.cause === undefined ? undefined : { cause: options.cause });\n    this.name = 'MuPagError';\n    this.status = options.status;\n    this.code = options.code;\n    this.requestId = options.requestId;\n    this.suggestion = options.suggestion;\n    this.documentationUrl = options.documentationUrl;\n  }\n}\n\nexport class APIError extends MuPagError {\n  constructor(options: MuPagErrorOptions) {\n    super(options);\n    this.name = 'APIError';\n  }\n}\n\nexport class RateLimitError extends APIError {\n  readonly retryAfter: number | undefined;\n\n  constructor(options: MuPagErrorOptions & { retryAfter?: number | undefined }) {\n    super(options);\n    this.name = 'RateLimitError';\n    this.retryAfter = options.retryAfter;\n  }\n}\n\nexport class ValidationError extends APIError {\n  constructor(options: MuPagErrorOptions) {\n    super(options);\n    this.name = 'ValidationError';\n  }\n}\n\nexport class AuthError extends APIError {\n  constructor(options: MuPagErrorOptions) {\n    super(options);\n    this.name = 'AuthError';\n  }\n}\n\nexport class IdempotencyError extends APIError {\n  constructor(options: MuPagErrorOptions) {\n    super(options);\n    this.name = 'IdempotencyError';\n  }\n}\n\nexport class OutcomeUnknownError extends APIError {\n  readonly idempotencyKey: string;\n  readonly outcomeUnknown = true;\n\n  /**\n   * Indica que uma mutacao pode ter sido aceita, mas nao houve confirmacao confiavel.\n   *\n   * A chave fica disponivel apenas no campo estruturado para evitar vazamento acidental\n   * em logs. O integrador deve reutiliza-la com exatamente o mesmo payload.\n   */\n  constructor(idempotencyKey: string, cause: unknown) {\n    const apiCause = cause instanceof APIError ? cause : undefined;\n    super({\n      message:\n        'O resultado da mutacao e desconhecido; reutilize a Idempotency-Key exposta com o mesmo payload.',\n      status: apiCause?.status,\n      code: 'outcome_unknown',\n      requestId: apiCause?.requestId,\n      suggestion:\n        'Reutilize a mesma Idempotency-Key e o mesmo payload para reconciliar a operacao.',\n      documentationUrl: apiCause?.documentationUrl,\n      cause\n    });\n    this.name = 'OutcomeUnknownError';\n    this.idempotencyKey = idempotencyKey;\n  }\n}\n\nexport class WebhookSignatureError extends MuPagError {\n  constructor(options: MuPagErrorOptions) {\n    super(options);\n    this.name = 'WebhookSignatureError';\n  }\n}\n\nexport function createApiError(\n  status: number,\n  payload: JsonValue | undefined,\n  headers: Headers\n): APIError {\n  const problem = isProblemDetails(payload) ? payload : {};\n  const message = problem.detail ?? problem.title ?? `A API retornou HTTP ${status}.`;\n  const options: MuPagErrorOptions = {\n    message,\n    status,\n    code: problem.code,\n    requestId: problem.request_id ?? headers.get('request-id') ?? undefined,\n    suggestion: problem.suggestion,\n    documentationUrl: problem.documentation_url\n  };\n\n  if (status === 401 || status === 403) {\n    return new AuthError(options);\n  }\n\n  if (status === 409 && problem.code === 'idempotency_key_reused') {\n    return new IdempotencyError(options);\n  }\n\n  if (status === 400 || status === 422) {\n    return new ValidationError(options);\n  }\n\n  if (status === 429) {\n    return new RateLimitError({\n      ...options,\n      retryAfter: parseRetryAfter(headers.get('retry-after'))\n    });\n  }\n\n  return new APIError(options);\n}\n\nfunction parseRetryAfter(value: string | null): number | undefined {\n  if (value === null) return undefined;\n  if (/^\\d+$/.test(value)) return Number(value);\n  const retryAt = Date.parse(value);\n  if (Number.isNaN(retryAt)) return undefined;\n  return Math.max(0, Math.ceil((retryAt - Date.now()) / 1_000));\n}\n\nfunction isProblemDetails(value: JsonValue | undefined): value is ProblemDetails {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n"]}

package/dist/errors.cjs

@@ -0,0 +1,2 @@
+'use strict';var u=class extends Error{status;code;requestId;suggestion;documentationUrl;constructor(e){super(e.message,e.cause===void 0?void 0:{cause:e.cause}),this.name="MuPagError",this.status=e.status,this.code=e.code,this.requestId=e.requestId,this.suggestion=e.suggestion,this.documentationUrl=e.documentationUrl;}},t=class extends u{constructor(e){super(e),this.name="APIError";}},i=class extends t{retryAfter;constructor(e){super(e),this.name="RateLimitError",this.retryAfter=e.retryAfter;}},d=class extends t{constructor(e){super(e),this.name="ValidationError";}},a=class extends t{constructor(e){super(e),this.name="AuthError";}},c=class extends t{constructor(e){super(e),this.name="IdempotencyError";}},m=class extends t{idempotencyKey;outcomeUnknown=true;constructor(e,s){let r=s instanceof t?s:void 0;super({message:"O resultado da mutacao e desconhecido; reutilize a Idempotency-Key exposta com o mesmo payload.",status:r?.status,code:"outcome_unknown",requestId:r?.requestId,suggestion:"Reutilize a mesma Idempotency-Key e o mesmo payload para reconciliar a operacao.",documentationUrl:r?.documentationUrl,cause:s}),this.name="OutcomeUnknownError",this.idempotencyKey=e;}},g=class extends u{constructor(e){super(e),this.name="WebhookSignatureError";}};function y(n,e,s){let r=l(e)?e:{},o={message:r.detail??r.title??`A API retornou HTTP ${n}.`,status:n,code:r.code,requestId:r.request_id??s.get("request-id")??void 0,suggestion:r.suggestion,documentationUrl:r.documentation_url};return n===401||n===403?new a(o):n===409&&r.code==="idempotency_key_reused"?new c(o):n===400||n===422?new d(o):n===429?new i({...o,retryAfter:f(s.get("retry-after"))}):new t(o)}function f(n){if(n===null)return;if(/^\d+$/.test(n))return Number(n);let e=Date.parse(n);if(!Number.isNaN(e))return Math.max(0,Math.ceil((e-Date.now())/1e3))}function l(n){return typeof n=="object"&&n!==null&&!Array.isArray(n)}exports.APIError=t;exports.AuthError=a;exports.IdempotencyError=c;exports.MuPagError=u;exports.OutcomeUnknownError=m;exports.RateLimitError=i;exports.ValidationError=d;exports.WebhookSignatureError=g;exports.createApiError=y;//# sourceMappingURL=errors.cjs.map
+//# sourceMappingURL=errors.cjs.map

package/dist/errors.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts"],"names":["MuPagError","options","APIError","RateLimitError","ValidationError","AuthError","IdempotencyError","OutcomeUnknownError","idempotencyKey","cause","apiCause","WebhookSignatureError","createApiError","status","payload","headers","problem","isProblemDetails","parseRetryAfter","value","retryAt"],"mappings":"aAsBO,IAAMA,EAAN,cAAyB,KAAM,CAC3B,MAAA,CACA,KACA,SAAA,CACA,UAAA,CACA,gBAAA,CAST,WAAA,CAAYC,EAA4B,CACtC,KAAA,CAAMA,EAAQ,OAAA,CAASA,CAAAA,CAAQ,QAAU,MAAA,CAAY,MAAA,CAAY,CAAE,KAAA,CAAOA,EAAQ,KAAM,CAAC,CAAA,CACzF,IAAA,CAAK,KAAO,YAAA,CACZ,IAAA,CAAK,MAAA,CAASA,CAAAA,CAAQ,OACtB,IAAA,CAAK,IAAA,CAAOA,EAAQ,IAAA,CACpB,IAAA,CAAK,UAAYA,CAAAA,CAAQ,SAAA,CACzB,IAAA,CAAK,UAAA,CAAaA,EAAQ,UAAA,CAC1B,IAAA,CAAK,gBAAA,CAAmBA,CAAAA,CAAQ,iBAClC,CACF,CAAA,CAEaC,CAAAA,CAAN,cAAuBF,CAAW,CACvC,WAAA,CAAYC,EAA4B,CACtC,KAAA,CAAMA,CAAO,CAAA,CACb,IAAA,CAAK,IAAA,CAAO,WACd,CACF,CAAA,CAEaE,CAAAA,CAAN,cAA6BD,CAAS,CAClC,WAET,WAAA,CAAYD,CAAAA,CAAkE,CAC5E,KAAA,CAAMA,CAAO,CAAA,CACb,IAAA,CAAK,KAAO,gBAAA,CACZ,IAAA,CAAK,WAAaA,CAAAA,CAAQ,WAC5B,CACF,CAAA,CAEaG,EAAN,cAA8BF,CAAS,CAC5C,WAAA,CAAYD,EAA4B,CACtC,KAAA,CAAMA,CAAO,CAAA,CACb,KAAK,IAAA,CAAO,kBACd,CACF,CAAA,CAEaI,CAAAA,CAAN,cAAwBH,CAAS,CACtC,WAAA,CAAYD,CAAAA,CAA4B,CACtC,KAAA,CAAMA,CAAO,EACb,IAAA,CAAK,IAAA,CAAO,YACd,CACF,CAAA,CAEaK,CAAAA,CAAN,cAA+BJ,CAAS,CAC7C,WAAA,CAAYD,EAA4B,CACtC,KAAA,CAAMA,CAAO,CAAA,CACb,IAAA,CAAK,IAAA,CAAO,mBACd,CACF,CAAA,CAEaM,CAAAA,CAAN,cAAkCL,CAAS,CACvC,cAAA,CACA,cAAA,CAAiB,IAAA,CAQ1B,WAAA,CAAYM,EAAwBC,CAAAA,CAAgB,CAClD,IAAMC,CAAAA,CAAWD,CAAAA,YAAiBP,EAAWO,CAAAA,CAAQ,MAAA,CACrD,KAAA,CAAM,CACJ,QACE,iGAAA,CACF,MAAA,CAAQC,GAAU,MAAA,CAClB,IAAA,CAAM,kBACN,SAAA,CAAWA,CAAAA,EAAU,SAAA,CACrB,UAAA,CACE,mFACF,gBAAA,CAAkBA,CAAAA,EAAU,iBAC5B,KAAA,CAAAD,CACF,CAAC,CAAA,CACD,IAAA,CAAK,IAAA,CAAO,qBAAA,CACZ,KAAK,cAAA,CAAiBD,EACxB,CACF,CAAA,CAEaG,EAAN,cAAoCX,CAAW,CACpD,WAAA,CAAYC,EAA4B,CACtC,KAAA,CAAMA,CAAO,CAAA,CACb,IAAA,CAAK,KAAO,wBACd,CACF,EAEO,SAASW,EACdC,CAAAA,CACAC,CAAAA,CACAC,CAAAA,CACU,CACV,IAAMC,CAAAA,CAAUC,CAAAA,CAAiBH,CAAO,CAAA,CAAIA,EAAU,EAAC,CAEjDb,EAA6B,CACjC,OAAA,CAFce,EAAQ,MAAA,EAAUA,CAAAA,CAAQ,KAAA,EAAS,CAAA,oBAAA,EAAuBH,CAAM,CAAA,CAAA,CAAA,CAG9E,MAAA,CAAAA,CAAAA,CACA,IAAA,CAAMG,EAAQ,IAAA,CACd,SAAA,CAAWA,CAAAA,CAAQ,UAAA,EAAcD,EAAQ,GAAA,CAAI,YAAY,GAAK,MAAA,CAC9D,UAAA,CAAYC,EAAQ,UAAA,CACpB,gBAAA,CAAkBA,CAAAA,CAAQ,iBAC5B,EAEA,OAAIH,CAAAA,GAAW,KAAOA,CAAAA,GAAW,GAAA,CACxB,IAAIR,CAAAA,CAAUJ,CAAO,CAAA,CAG1BY,CAAAA,GAAW,KAAOG,CAAAA,CAAQ,IAAA,GAAS,yBAC9B,IAAIV,CAAAA,CAAiBL,CAAO,CAAA,CAGjCY,CAAAA,GAAW,GAAA,EAAOA,CAAAA,GAAW,IACxB,IAAIT,CAAAA,CAAgBH,CAAO,CAAA,CAGhCY,IAAW,GAAA,CACN,IAAIV,CAAAA,CAAe,CACxB,GAAGF,CAAAA,CACH,UAAA,CAAYiB,EAAgBH,CAAAA,CAAQ,GAAA,CAAI,aAAa,CAAC,CACxD,CAAC,CAAA,CAGI,IAAIb,CAAAA,CAASD,CAAO,CAC7B,CAEA,SAASiB,EAAgBC,CAAAA,CAA0C,CACjE,GAAIA,CAAAA,GAAU,KAAM,OACpB,GAAI,QAAQ,IAAA,CAAKA,CAAK,EAAG,OAAO,MAAA,CAAOA,CAAK,CAAA,CAC5C,IAAMC,CAAAA,CAAU,IAAA,CAAK,KAAA,CAAMD,CAAK,EAChC,GAAI,CAAA,MAAA,CAAO,KAAA,CAAMC,CAAO,EACxB,OAAO,IAAA,CAAK,IAAI,CAAA,CAAG,IAAA,CAAK,MAAMA,CAAAA,CAAU,IAAA,CAAK,GAAA,EAAI,EAAK,GAAK,CAAC,CAC9D,CAEA,SAASH,CAAAA,CAAiBE,EAAuD,CAC/E,OAAO,OAAOA,CAAAA,EAAU,UAAYA,CAAAA,GAAU,IAAA,EAAQ,CAAC,KAAA,CAAM,OAAA,CAAQA,CAAK,CAC5E","file":"errors.cjs","sourcesContent":["import type { JsonObject, JsonValue } from './types.js';\n\nexport type ProblemDetails = JsonObject & {\n  title?: string | undefined;\n  detail?: string | undefined;\n  status?: number | undefined;\n  code?: string | undefined;\n  suggestion?: string | undefined;\n  documentation_url?: string | undefined;\n  request_id?: string | undefined;\n};\n\nexport type MuPagErrorOptions = {\n  message: string;\n  status?: number | undefined;\n  code?: string | undefined;\n  requestId?: string | undefined;\n  suggestion?: string | undefined;\n  documentationUrl?: string | undefined;\n  cause?: unknown | undefined;\n};\n\nexport class MuPagError extends Error {\n  readonly status: number | undefined;\n  readonly code: string | undefined;\n  readonly requestId: string | undefined;\n  readonly suggestion: string | undefined;\n  readonly documentationUrl: string | undefined;\n\n  /**\n   * Mantem os campos de erro da API acessiveis no SDK sem expor payload bruto.\n   *\n   * A API publica envia Problem Details com extensoes DX-first. O SDK preserva\n   * codigo, sugestao, link e request_id para o integrador resolver o problema\n   * sem abrir suporte, mas evita guardar headers ou corpo inteiro com dados sensiveis.\n   */\n  constructor(options: MuPagErrorOptions) {\n    super(options.message, options.cause === undefined ? undefined : { cause: options.cause });\n    this.name = 'MuPagError';\n    this.status = options.status;\n    this.code = options.code;\n    this.requestId = options.requestId;\n    this.suggestion = options.suggestion;\n    this.documentationUrl = options.documentationUrl;\n  }\n}\n\nexport class APIError extends MuPagError {\n  constructor(options: MuPagErrorOptions) {\n    super(options);\n    this.name = 'APIError';\n  }\n}\n\nexport class RateLimitError extends APIError {\n  readonly retryAfter: number | undefined;\n\n  constructor(options: MuPagErrorOptions & { retryAfter?: number | undefined }) {\n    super(options);\n    this.name = 'RateLimitError';\n    this.retryAfter = options.retryAfter;\n  }\n}\n\nexport class ValidationError extends APIError {\n  constructor(options: MuPagErrorOptions) {\n    super(options);\n    this.name = 'ValidationError';\n  }\n}\n\nexport class AuthError extends APIError {\n  constructor(options: MuPagErrorOptions) {\n    super(options);\n    this.name = 'AuthError';\n  }\n}\n\nexport class IdempotencyError extends APIError {\n  constructor(options: MuPagErrorOptions) {\n    super(options);\n    this.name = 'IdempotencyError';\n  }\n}\n\nexport class OutcomeUnknownError extends APIError {\n  readonly idempotencyKey: string;\n  readonly outcomeUnknown = true;\n\n  /**\n   * Indica que uma mutacao pode ter sido aceita, mas nao houve confirmacao confiavel.\n   *\n   * A chave fica disponivel apenas no campo estruturado para evitar vazamento acidental\n   * em logs. O integrador deve reutiliza-la com exatamente o mesmo payload.\n   */\n  constructor(idempotencyKey: string, cause: unknown) {\n    const apiCause = cause instanceof APIError ? cause : undefined;\n    super({\n      message:\n        'O resultado da mutacao e desconhecido; reutilize a Idempotency-Key exposta com o mesmo payload.',\n      status: apiCause?.status,\n      code: 'outcome_unknown',\n      requestId: apiCause?.requestId,\n      suggestion:\n        'Reutilize a mesma Idempotency-Key e o mesmo payload para reconciliar a operacao.',\n      documentationUrl: apiCause?.documentationUrl,\n      cause\n    });\n    this.name = 'OutcomeUnknownError';\n    this.idempotencyKey = idempotencyKey;\n  }\n}\n\nexport class WebhookSignatureError extends MuPagError {\n  constructor(options: MuPagErrorOptions) {\n    super(options);\n    this.name = 'WebhookSignatureError';\n  }\n}\n\nexport function createApiError(\n  status: number,\n  payload: JsonValue | undefined,\n  headers: Headers\n): APIError {\n  const problem = isProblemDetails(payload) ? payload : {};\n  const message = problem.detail ?? problem.title ?? `A API retornou HTTP ${status}.`;\n  const options: MuPagErrorOptions = {\n    message,\n    status,\n    code: problem.code,\n    requestId: problem.request_id ?? headers.get('request-id') ?? undefined,\n    suggestion: problem.suggestion,\n    documentationUrl: problem.documentation_url\n  };\n\n  if (status === 401 || status === 403) {\n    return new AuthError(options);\n  }\n\n  if (status === 409 && problem.code === 'idempotency_key_reused') {\n    return new IdempotencyError(options);\n  }\n\n  if (status === 400 || status === 422) {\n    return new ValidationError(options);\n  }\n\n  if (status === 429) {\n    return new RateLimitError({\n      ...options,\n      retryAfter: parseRetryAfter(headers.get('retry-after'))\n    });\n  }\n\n  return new APIError(options);\n}\n\nfunction parseRetryAfter(value: string | null): number | undefined {\n  if (value === null) return undefined;\n  if (/^\\d+$/.test(value)) return Number(value);\n  const retryAt = Date.parse(value);\n  if (Number.isNaN(retryAt)) return undefined;\n  return Math.max(0, Math.ceil((retryAt - Date.now()) / 1_000));\n}\n\nfunction isProblemDetails(value: JsonValue | undefined): value is ProblemDetails {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n"]}

package/dist/errors.d.cts

@@ -0,0 +1,70 @@
+import { J as JsonObject, o as JsonValue } from './types-C1s3-E1E.cjs';
+
+type ProblemDetails = JsonObject & {
+    title?: string | undefined;
+    detail?: string | undefined;
+    status?: number | undefined;
+    code?: string | undefined;
+    suggestion?: string | undefined;
+    documentation_url?: string | undefined;
+    request_id?: string | undefined;
+};
+type MuPagErrorOptions = {
+    message: string;
+    status?: number | undefined;
+    code?: string | undefined;
+    requestId?: string | undefined;
+    suggestion?: string | undefined;
+    documentationUrl?: string | undefined;
+    cause?: unknown | undefined;
+};
+declare class MuPagError extends Error {
+    readonly status: number | undefined;
+    readonly code: string | undefined;
+    readonly requestId: string | undefined;
+    readonly suggestion: string | undefined;
+    readonly documentationUrl: string | undefined;
+    /**
+     * Mantem os campos de erro da API acessiveis no SDK sem expor payload bruto.
+     *
+     * A API publica envia Problem Details com extensoes DX-first. O SDK preserva
+     * codigo, sugestao, link e request_id para o integrador resolver o problema
+     * sem abrir suporte, mas evita guardar headers ou corpo inteiro com dados sensiveis.
+     */
+    constructor(options: MuPagErrorOptions);
+}
+declare class APIError extends MuPagError {
+    constructor(options: MuPagErrorOptions);
+}
+declare class RateLimitError extends APIError {
+    readonly retryAfter: number | undefined;
+    constructor(options: MuPagErrorOptions & {
+        retryAfter?: number | undefined;
+    });
+}
+declare class ValidationError extends APIError {
+    constructor(options: MuPagErrorOptions);
+}
+declare class AuthError extends APIError {
+    constructor(options: MuPagErrorOptions);
+}
+declare class IdempotencyError extends APIError {
+    constructor(options: MuPagErrorOptions);
+}
+declare class OutcomeUnknownError extends APIError {
+    readonly idempotencyKey: string;
+    readonly outcomeUnknown = true;
+    /**
+     * Indica que uma mutacao pode ter sido aceita, mas nao houve confirmacao confiavel.
+     *
+     * A chave fica disponivel apenas no campo estruturado para evitar vazamento acidental
+     * em logs. O integrador deve reutiliza-la com exatamente o mesmo payload.
+     */
+    constructor(idempotencyKey: string, cause: unknown);
+}
+declare class WebhookSignatureError extends MuPagError {
+    constructor(options: MuPagErrorOptions);
+}
+declare function createApiError(status: number, payload: JsonValue | undefined, headers: Headers): APIError;
+
+export { APIError, AuthError, IdempotencyError, MuPagError, type MuPagErrorOptions, OutcomeUnknownError, type ProblemDetails, RateLimitError, ValidationError, WebhookSignatureError, createApiError };

package/dist/errors.d.ts

@@ -0,0 +1,70 @@
+import { J as JsonObject, o as JsonValue } from './types-C1s3-E1E.js';
+
+type ProblemDetails = JsonObject & {
+    title?: string | undefined;
+    detail?: string | undefined;
+    status?: number | undefined;
+    code?: string | undefined;
+    suggestion?: string | undefined;
+    documentation_url?: string | undefined;
+    request_id?: string | undefined;
+};
+type MuPagErrorOptions = {
+    message: string;
+    status?: number | undefined;
+    code?: string | undefined;
+    requestId?: string | undefined;
+    suggestion?: string | undefined;
+    documentationUrl?: string | undefined;
+    cause?: unknown | undefined;
+};
+declare class MuPagError extends Error {
+    readonly status: number | undefined;
+    readonly code: string | undefined;
+    readonly requestId: string | undefined;
+    readonly suggestion: string | undefined;
+    readonly documentationUrl: string | undefined;
+    /**
+     * Mantem os campos de erro da API acessiveis no SDK sem expor payload bruto.
+     *
+     * A API publica envia Problem Details com extensoes DX-first. O SDK preserva
+     * codigo, sugestao, link e request_id para o integrador resolver o problema
+     * sem abrir suporte, mas evita guardar headers ou corpo inteiro com dados sensiveis.
+     */
+    constructor(options: MuPagErrorOptions);
+}
+declare class APIError extends MuPagError {
+    constructor(options: MuPagErrorOptions);
+}
+declare class RateLimitError extends APIError {
+    readonly retryAfter: number | undefined;
+    constructor(options: MuPagErrorOptions & {
+        retryAfter?: number | undefined;
+    });
+}
+declare class ValidationError extends APIError {
+    constructor(options: MuPagErrorOptions);
+}
+declare class AuthError extends APIError {
+    constructor(options: MuPagErrorOptions);
+}
+declare class IdempotencyError extends APIError {
+    constructor(options: MuPagErrorOptions);
+}
+declare class OutcomeUnknownError extends APIError {
+    readonly idempotencyKey: string;
+    readonly outcomeUnknown = true;
+    /**
+     * Indica que uma mutacao pode ter sido aceita, mas nao houve confirmacao confiavel.
+     *
+     * A chave fica disponivel apenas no campo estruturado para evitar vazamento acidental
+     * em logs. O integrador deve reutiliza-la com exatamente o mesmo payload.
+     */
+    constructor(idempotencyKey: string, cause: unknown);
+}
+declare class WebhookSignatureError extends MuPagError {
+    constructor(options: MuPagErrorOptions);
+}
+declare function createApiError(status: number, payload: JsonValue | undefined, headers: Headers): APIError;
+
+export { APIError, AuthError, IdempotencyError, MuPagError, type MuPagErrorOptions, OutcomeUnknownError, type ProblemDetails, RateLimitError, ValidationError, WebhookSignatureError, createApiError };

package/dist/errors.js

@@ -0,0 +1,2 @@
+export{b as APIError,e as AuthError,f as IdempotencyError,a as MuPagError,g as OutcomeUnknownError,c as RateLimitError,d as ValidationError,h as WebhookSignatureError,i as createApiError}from'./chunk-M4RQIIHN.js';//# sourceMappingURL=errors.js.map
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"errors.js"}

package/dist/index.cjs

@@ -0,0 +1,3 @@
+'use strict';var f=class extends Error{status;code;requestId;suggestion;documentationUrl;constructor(n){super(n.message,n.cause===void 0?void 0:{cause:n.cause}),this.name="MuPagError",this.status=n.status,this.code=n.code,this.requestId=n.requestId,this.suggestion=n.suggestion,this.documentationUrl=n.documentationUrl;}},_=class extends f{constructor(n){super(n),this.name="APIError";}},$=class extends _{retryAfter;constructor(n){super(n),this.name="RateLimitError",this.retryAfter=n.retryAfter;}},X=class extends _{constructor(n){super(n),this.name="ValidationError";}},Z=class extends _{constructor(n){super(n),this.name="AuthError";}},Q=class extends _{constructor(n){super(n),this.name="IdempotencyError";}},M=class extends _{idempotencyKey;outcomeUnknown=true;constructor(n,t){let o=t instanceof _?t:void 0;super({message:"O resultado da mutacao e desconhecido; reutilize a Idempotency-Key exposta com o mesmo payload.",status:o?.status,code:"outcome_unknown",requestId:o?.requestId,suggestion:"Reutilize a mesma Idempotency-Key e o mesmo payload para reconciliar a operacao.",documentationUrl:o?.documentationUrl,cause:t}),this.name="OutcomeUnknownError",this.idempotencyKey=n;}},k=class extends f{constructor(n){super(n),this.name="WebhookSignatureError";}};function ne(e,n,t){let o=Oe(n)?n:{},i={message:o.detail??o.title??`A API retornou HTTP ${e}.`,status:e,code:o.code,requestId:o.request_id??t.get("request-id")??void 0,suggestion:o.suggestion,documentationUrl:o.documentation_url};return e===401||e===403?new Z(i):e===409&&o.code==="idempotency_key_reused"?new Q(i):e===400||e===422?new X(i):e===429?new $({...i,retryAfter:Ae(t.get("retry-after"))}):new _(i)}function Ae(e){if(e===null)return;if(/^\d+$/.test(e))return Number(e);let n=Date.parse(e);if(!Number.isNaN(n))return Math.max(0,Math.ceil((n-Date.now())/1e3))}function Oe(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function R(e){let n="";for(let t of e){let o=Ie(t);if(o!==void 0){n=(n+o).slice(-19);for(let r=12;r<=n.length;r+=1)if(ve(n.slice(-r)))return  true}else {if(/^[\s\p{P}\p{S}\p{M}\p{Cc}\p{Cf}]$/u.test(t))continue;n="";}}return  false}function Ie(e){let n=e.codePointAt(0);if(n>=48&&n<=57)return e;if(!/^\p{Decimal_Number}$/u.test(e))return;let t=n;for(;t>0&&/^\p{Decimal_Number}$/u.test(String.fromCodePoint(t-1));)t-=1;return String((n-t)%10)}function ve(e){if(!/^[0-9]{12,19}$/.test(e))return  false;let n=0,t=false;for(let o=e.length-1;o>=0;o-=1){let r=e.charCodeAt(o)-48;t&&(r*=2,r>9&&(r-=9)),n+=r,t=!t;}return n%10===0}var te="0.2.0";var Ne={maxRetries:2,initialDelayMs:200,maxDelayMs:2e3},Ue=2*1024*1024,qe=16*1024*1024,$e=1024*1024,Me=new Set(["fingerprint_conflict","idempotency_fingerprint_conflict","idempotency_key_reused"]),oe={test:"https://api.sandbox.mupag.com.br",prd:"https://api.mupag.com.br"},J=class{apiKey;baseUrl;fetcher;timeoutMs;maxResponseBytes;retry;constructor(n){if(typeof n.apiKey!="string"||!n.apiKey.trim()||n.apiKey.length>512||!/^[\x21-\x7e]+$/.test(n.apiKey))throw new f({message:"Informe uma apiKey valida para criar o cliente MuPag.",code:"missing_api_key",suggestion:"Use uma chave sk_test_ no sandbox ou sk_prd_ em producao."});if(n.env!=="test"&&n.env!=="prd")throw new f({message:"Informe explicitamente o ambiente test ou prd.",code:"missing_environment",suggestion:"Use env: test enquanto estiver integrando no sandbox."});let t=n.env==="test"?"sk_test_":"sk_prd_";if(!n.apiKey.startsWith(t))throw new f({message:"A apiKey informada nao pertence ao ambiente selecionado.",code:"api_key_environment_mismatch",suggestion:`Use uma chave ${t} no ambiente ${n.env}.`});this.apiKey=n.apiKey,this.baseUrl=Ye(n.baseUrl??oe[n.env],n.env);let o=n.fetch??globalThis.fetch;if(typeof o!="function")throw new f({message:"O runtime nao oferece fetch.",code:"fetch_unavailable"});this.fetcher=o.bind(globalThis),this.timeoutMs=n.timeoutMs??3e4,this.retry={...Ne,...n.retry},this.maxResponseBytes=n.maxResponseBytes??Ue,Ge(this.timeoutMs,this.maxResponseBytes,this.retry);}async request(n,t,o={}){let r=n.toUpperCase(),i=Je(r),s=o.idempotencyKey??(i?Le():void 0),d=this.createUrl(t,o.query),m=new Headers({authorization:`Bearer ${this.apiKey}`,accept:"application/json","user-agent":`mupag-sdk/${te}`}),u;if(o.body!==void 0&&(m.set("content-type","application/json"),u=JSON.stringify(o.body),new TextEncoder().encode(u).byteLength>$e))throw new f({message:"O corpo da requisicao excede o limite seguro do SDK.",code:"request_too_large",suggestion:"Reduza metadata e itens antes de enviar a requisicao."});s!==void 0&&(Ke(s,o.idempotencyKey!==void 0),m.set("idempotency-key",s));let c=r==="GET"||r==="DELETE"||s!==void 0,g=0,y,T;for(;;){let D=new AbortController,xe=setTimeout(()=>D.abort(),this.timeoutMs),ee={method:r,headers:m,signal:D.signal};u!==void 0&&(ee.body=u);try{let p=await this.fetcher(d,ee),j=await De(p,this.maxResponseBytes);if(p.ok){let Pe=y!==void 0&&o.validateResponseAfterAmbiguous!==void 0?o.validateResponseAfterAmbiguous:o.validateResponse;if((i||o.validateResponse!==void 0)&&!ze(j,Pe))throw B(p,"invalid_success_response",i?"A API retornou sucesso sem uma confirmacao valida da mutacao.":"A API retornou sucesso com um contrato de resposta invalido.");return j}throw ne(p.status,j,p.headers)}catch(p){if(T=p,i&&He(p)&&y===void 0&&(y=p),i&&re(p))throw new M(s,p);if(!Be(p,c)||g>=this.retry.maxRetries)throw i&&(y!==void 0||ie(p))?new M(s,y??p):p}finally{clearTimeout(xe);}await We(Fe(g,this.retry,T)),g+=1;}}createUrl(n,t={}){let o=new URL(`${this.baseUrl}${n}`);for(let[r,i]of Object.entries(t))i!==void 0&&o.searchParams.set(r,String(i));return o}};function Le(){let e=globalThis.crypto;if(typeof e?.randomUUID=="function")return `sdk_${e.randomUUID()}`;if(typeof e?.getRandomValues=="function"){let n=new Uint8Array(16);return e.getRandomValues(n),`sdk_${Array.from(n,t=>t.toString(16).padStart(2,"0")).join("")}`}throw new f({message:"O runtime nao oferece um gerador criptografico para a Idempotency-Key.",code:"secure_random_unavailable",suggestion:"Use um runtime com Web Crypto habilitado ou informe uma Idempotency-Key segura."})}function Ke(e,n){if(e.length<1||e.length>128||!/^[\x21-\x7e]+$/.test(e)||n&&R(e))throw new f({message:"Idempotency-Key invalida.",code:"invalid_idempotency_key",suggestion:"Envie de 1 a 128 caracteres ASCII visiveis, sem espacos."})}async function De(e,n){let t=await je(e,n);if(t.trim())try{return JSON.parse(t)}catch{throw new _({message:"A API retornou um corpo que nao e JSON.",status:e.status,code:"invalid_json_response",suggestion:"Tente novamente e informe o request_id ao suporte se o problema persistir."})}}async function je(e,n){let t=e.headers.get("content-length");if(t!==null){if(!/^\d+$/.test(t)||!Number.isSafeInteger(Number(t)))throw B(e,"invalid_content_length","A API retornou Content-Length invalido.");if(Number(t)>n)throw B(e,"response_too_large","A resposta da API excedeu o limite configurado.")}if(!e.body)return "";let o=e.body.getReader(),r=[],i=0;try{for(;;){let{done:m,value:u}=await o.read();if(m)break;if(u){if(i+=u.byteLength,i>n)throw await o.cancel("response limit exceeded"),B(e,"response_too_large","A resposta da API excedeu o limite configurado.");r.push(u);}}}finally{o.releaseLock();}let s=new Uint8Array(i),d=0;for(let m of r)s.set(m,d),d+=m.byteLength;return new TextDecoder().decode(s)}function B(e,n,t){return new _({message:t,status:e.status,code:n,suggestion:"Tente novamente e informe o request_id ao suporte se o problema persistir."})}function Be(e,n){return n?e instanceof _?e.status===408||e.status===425||e.status===429||e.status===409&&e.code==="idempotency_in_progress"||e.status!==void 0&&e.status>=500:true:false}function Je(e){return e==="POST"||e==="PUT"||e==="PATCH"||e==="DELETE"}function He(e){return e instanceof _?e.status===408||e.status===425||e.status!==void 0&&e.status>=500||e.status!==void 0&&e.status>=200&&e.status<400||ie(e)||re(e):true}function re(e){return !(e instanceof _)||e.status!==409||e.code==="idempotency_in_progress"?false:!Me.has(e.code??"")}function ie(e){return e instanceof _&&e.status===409&&e.code==="idempotency_in_progress"}function ze(e,n){return n!==void 0?n(e):typeof e=="object"&&e!==null&&!Array.isArray(e)}function Fe(e,n,t){return t instanceof $&&t.retryAfter!==void 0?Math.min(Math.max(t.retryAfter,0)*1e3,3e4):Ve(e,n)}function Ve(e,n){return Math.min(n.initialDelayMs*2**e,n.maxDelayMs)}function We(e){return e<=0?Promise.resolve():new Promise(n=>setTimeout(n,e))}function Ye(e,n){let t;try{t=new URL(e);}catch{throw new f({message:"baseUrl invalida.",code:"invalid_base_url"})}let o=new URL(oe[n]).origin,r=n==="test"&&["localhost","127.0.0.1","[::1]"].includes(t.hostname),i=t.origin===o||r,s=t.protocol==="https:"||r&&t.protocol==="http:";if(!i||!s||t.username||t.password||t.pathname!==""&&t.pathname!=="/"||t.search||t.hash)throw new f({message:"baseUrl nao e uma origem permitida para o ambiente selecionado.",code:"invalid_base_url"});return t.origin}function Ge(e,n,t){if(!Number.isSafeInteger(e)||e<1||e>12e4)throw new f({message:"timeoutMs invalido.",code:"invalid_timeout"});if(!Number.isSafeInteger(n)||n<1||n>qe)throw new f({message:"maxResponseBytes invalido.",code:"invalid_response_limit"});if(!Number.isSafeInteger(t.maxRetries)||t.maxRetries<0||t.maxRetries>5||!Number.isSafeInteger(t.initialDelayMs)||t.initialDelayMs<0||!Number.isSafeInteger(t.maxDelayMs)||t.maxDelayMs<t.initialDelayMs||t.maxDelayMs>3e4)throw new f({message:"Configuracao de retry invalida.",code:"invalid_retry_config"})}var Xe=9e15,Ze=/^[A-Za-z0-9_-]+$/,H=class{constructor(n){this.http=n;}http;create(n,t={}){let o=kn(h(n,"checkout session")),r=h(t,"request options");return this.http.request("POST","/v1/checkout-sessions",{body:o,idempotencyKey:r.idempotencyKey,validateResponse:en})}},z=class{constructor(n){this.http=n;}http;create(n,t={}){let o=wn(h(n,"charge")),r=h(t,"request options");return this.http.request("POST","/v1/charges",{body:o,idempotencyKey:r.idempotencyKey,validateResponse:i=>se(i,o),validateResponseAfterAmbiguous:i=>se(i,o,false)})}cancel(n,t){I(n,"charge id");let o=h(t,"charge cancellation options");return yn(o),this.http.request("POST",`/v1/charges/${encodeURIComponent(n)}/cancel`,{body:o.reason===void 0?{}:{reason:o.reason},idempotencyKey:o.idempotencyKey,validateResponse:r=>rn(r,n)})}list(n={}){let t=h(n,"charge list");return Cn(t),this.http.request("GET","/v1/charges",{query:t,validateResponse:o=>sn(o,t)})}},F=class{constructor(n){this.http=n;}http;create(n,t={}){let o=En(h(n,"subscription")),r=h(t,"request options");return ce(r,80),this.http.request("POST","/v1/subscriptions",{body:o,idempotencyKey:r.idempotencyKey,validateResponse:i=>he(i,o),validateResponseAfterAmbiguous:i=>dn(i,o)})}cancel(n,t,o={}){I(n,"subscription id");let r=Tn(h(t,"subscription cancellation")),i=h(o,"request options");return ce(i,80),this.http.request("POST",`/v1/subscriptions/${encodeURIComponent(n)}/cancel`,{body:r,idempotencyKey:i.idempotencyKey,validateResponse:s=>cn(s,n,r)})}},V=class{constructor(n){this.http=n;}http;update(n,t,o={}){I(n,"customer id"),a(n,"customer id");let r=h(t,"customer update"),i=h(o,"request options");return Rn(r),this.http.request("PATCH",`/v1/customers/${encodeURIComponent(n)}`,{body:r,idempotencyKey:i.idempotencyKey,validateResponse:s=>un(s,n)})}},W=class{constructor(n){this.http=n;}http;create(n,t,o={}){I(n,"charge id");let r=Qe(h(t,"refund")),i=h(o,"request options");return this.http.request("POST",`/v1/charges/${encodeURIComponent(n)}/refunds`,{body:r,idempotencyKey:i.idempotencyKey,validateResponse:s=>ae(s,n,r),validateResponseAfterAmbiguous:s=>r.amount_cents!==void 0&&ae(s,n,r)})}get(n){return I(n,"refund id"),this.http.request("GET",`/v1/refunds/${encodeURIComponent(n)}`,{validateResponse:t=>ye(t,n)})}listByCharge(n,t={}){I(n,"charge id");let o=h(t,"refund list");return gn(o),this.http.request("GET",`/v1/charges/${encodeURIComponent(n)}/refunds`,{query:o,validateResponse:r=>fn(r,o,n)})}};function Qe(e){let n=e.amount_cents,t=e.full,o=e.reason,r=n!==void 0;if(r===(t===true))throw new TypeError("Refund exige exatamente amount_cents ou full=true.");if(r&&(!Number.isSafeInteger(n)||n<=0))throw new TypeError("Refund amount_cents precisa ser um inteiro seguro positivo.");if(o===void 0)return e;if(typeof o!="string")throw new TypeError("Refund reason invalido.");let s=le(o);if(s.length<1||s.length>500||/[\x00-\x1f\x7f]/.test(s))throw new TypeError("Refund reason invalido.");return a(s,"reason"),{...e,reason:s}}function le(e){let n=0,t=e.length;for(;n<t&&e.charCodeAt(n)<=32;)n+=1;for(;t>n&&e.charCodeAt(t-1)<=32;)t-=1;return e.slice(n,t)}function en(e){return w(e)&&A(e.id)&&A(e.url)&&hn(e.url)&&A(e.expires_at)&&q(e.expires_at)}var nn=new Set(["created","pending","authorized","paid","partially_refunded","refunded","failed","expired","cancelled","disputed","chargeback","under_review"]),me=new Set(["created","pending","authorized","paid","partially_refunded","refunded","failed","expired","cancelled","disputed","chargeback","under_review"]),_e=new Set(["requested","processing","completed","failed","cancelled","unknown"]),tn=new Set(["trialing","active","past_due","unpaid","paused","incomplete"]),on=new Set(["trialing","active","incomplete"]);function se(e,n,t=true){if(!w(e))return  false;let o=e.coupon_code!==void 0,r=o&&e.coupon_code!==null,i=e.original_amount_cents!==void 0,s=e.amount_subtotal_cents!==void 0;if(o&&(e.coupon_code===null?n.coupon_code!==void 0:n.coupon_code===void 0||e.coupon_code!==n.coupon_code)||i&&e.original_amount_cents!==n.amount_cents||s&&e.amount_subtotal_cents!==n.amount_cents)return  false;let d=r||i||s;return x(e.charge_id)&&Number.isSafeInteger(e.amount_cents)&&e.amount_cents>0&&(e.amount_cents===n.amount_cents||t&&n.coupon_code!==void 0&&e.amount_cents<=n.amount_cents||!t&&n.coupon_code!==void 0&&d&&e.amount_cents<=n.amount_cents)&&typeof e.status=="string"&&nn.has(e.status)&&Te(e)&&L(e.payment_method,n.payment_method)&&ge(e,n.customer.id)&&L(e.external_reference,n.external_reference)}function rn(e,n){return !w(e)||e.charge_id!==n||e.reason!=="payment_attempt_cancelled"?false:e.status==="cancellation_pending"?e.cancelled_at===null:e.status==="cancelled"&&A(e.cancelled_at)&&q(e.cancelled_at)}function sn(e,n){return !w(e)||!Array.isArray(e.data)||e.data.length>(n.limit??25)||!we(e.next_cursor,n.cursor)?false:e.data.every(t=>an(t,n))}function an(e,n){if(!w(e)||!x(e.charge_id)||!Number.isSafeInteger(e.amount_cents)||e.amount_cents<1||typeof e.status!="string"||!me.has(e.status)||typeof e.created_at!="string"||n.status!==void 0&&e.status!==n.status||n.payment_method!==void 0&&e.payment_method!==void 0&&e.payment_method!==n.payment_method||!ge(e,n.customer_id)||!Te(e))return  false;let t=O(e.created_at);if(t===void 0)return  false;let o=n.created_at_from===void 0?void 0:O(n.created_at_from),r=n.created_at_to===void 0?void 0:O(n.created_at_to);return (o===void 0||t>=o)&&(r===void 0||t<r)}function pe(e,n){return w(e)&&A(e.id)&&(n===void 0||e.id===n)&&A(e.status)}function he(e,n){return pe(e)&&on.has(e.status)&&e.customer_id===n.customer_id&&e.plan_id===n.plan_id&&e.payment_method===n.payment_method&&L(e.card_token_id,n.card_token_id)&&L(e.external_reference,n.external_reference)&&ln(e,"coupon_id",n.coupon_id)&&e.cancel_at_period_end===false}function dn(e,n){return he(e,n)&&(n.coupon_id===void 0||w(e)&&e.coupon_id===n.coupon_id)}function cn(e,n,t){if(!pe(e,n))return  false;if(Object.prototype.hasOwnProperty.call(e,"cancellation_reason")){let o=e.cancellation_reason;if(t.reason===void 0?o!==null:o!==t.reason)return  false}return t.mode==="immediate"?e.status==="canceled"&&e.cancel_at_period_end===false:e.cancel_at_period_end===true&&tn.has(e.status)}function un(e,n){return w(e)&&e.id===n}function ae(e,n,t){return w(e)&&x(e.refund_id)&&e.charge_id===n&&Number.isSafeInteger(e.amount_cents)&&e.amount_cents>0&&(t.amount_cents===void 0||e.amount_cents===t.amount_cents)&&typeof e.status=="string"&&_e.has(e.status)&&E(e.reason)&&L(e.reason,t.reason)&&typeof e.requested_at=="string"&&q(e.requested_at)}function ye(e,n,t){return w(e)&&x(e.refund_id)&&(n===void 0||e.refund_id===n)&&x(e.charge_id)&&(t===void 0||e.charge_id===t)&&Number.isSafeInteger(e.amount_cents)&&e.amount_cents>0&&typeof e.status=="string"&&_e.has(e.status)&&typeof e.requested_at=="string"&&q(e.requested_at)&&E(e.psp_refund_id)&&E(e.reason)&&Ee(e.completed_at)&&E(e.failure_reason)}function fn(e,n,t){return w(e)&&Array.isArray(e.refunds)&&e.refunds.length<=(n.limit??100)&&we(e.next_cursor,n.cursor)&&e.refunds.every(o=>ye(o,void 0,t))}function w(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function A(e){return typeof e=="string"&&e.length>0}function x(e){return typeof e=="string"&&e.length<=256&&/^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(e)}function L(e,n){return e===void 0?true:e===null?n===void 0:n!==void 0&&e===n}function ln(e,n,t){if(!Object.prototype.hasOwnProperty.call(e,n))return  true;let o=e[n];return t===void 0?o===null:o===t}function ge(e,n){let t=[];if(Object.prototype.hasOwnProperty.call(e,"customer_id")){if(!x(e.customer_id))return  false;t.push(e.customer_id);}if(Object.prototype.hasOwnProperty.call(e,"customer")){if(!w(e.customer)||!Object.prototype.hasOwnProperty.call(e.customer,"id")||!x(e.customer.id))return  false;t.push(e.customer.id);}return t.every(o=>o===t[0]&&(n===void 0||o===n))}function we(e,n){return e==null||e===""||typeof e=="string"&&be(e,256)&&e!==n}function be(e,n){if(e.length<1||e.length>n||!Ze.test(e))return  false;let o=e.replace(/-/g,"+").replace(/_/g,"/")+"=".repeat((4-e.length%4)%4);try{let r=atob(o);return btoa(r).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")===e}catch{return  false}}function q(e){return O(e)!==void 0}function O(e){let n=/^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:[Zz]|[+-](\d{2}):(\d{2}))$/.exec(e);if(n===null)return;let t=Number(n[1]),o=Number(n[2]),r=Number(n[3]),i=Number(n[4]),s=Number(n[5]),d=Number(n[6]),m=n[7]===void 0?0:Number(n[7]),u=n[8]===void 0?0:Number(n[8]);if(o<1||o>12||r<1||r>mn(t,o)||i>23||s>59||d>60||m>23||u>59)return;let c=e.replace("t","T").replace(/z$/,"Z"),g=d===60,y=g?`${c.slice(0,17)}59${c.slice(19)}`:c,T=Date.parse(y);return Number.isNaN(T)?void 0:T+(g?1e3:0)}function mn(e,n){return n===2?e%4===0&&(e%100!==0||e%400===0)?29:28:[4,6,9,11].includes(n)?30:31}function de(e){return e===void 0||typeof e=="string"}function E(e){return e==null||typeof e=="string"}function _n(e){return e===void 0||x(e)}function pn(e){return e===null||_n(e)}function ke(e){return e===void 0||typeof e=="string"&&q(e)}function Ee(e){return e===null||ke(e)}function Te(e){return E(e.psp_charge_id)&&pn(e.card_token_id)&&E(e.card_brand)&&E(e.card_last4)&&E(e.three_ds_acs_url)&&E(e.failure_classification)&&E(e.pix_qr_code_base64)&&E(e.pix_emv_code)&&de(e.pix_qr_code)&&de(e.pix_copy_paste)&&Ee(e.expires_at)&&ke(e.created_at)}function hn(e){try{return new URL(e).origin!=="null"}catch{return  false}}function yn(e){if(b(e,["idempotencyKey","reason"],"charge cancellation options"),typeof e.idempotencyKey!="string"||e.idempotencyKey.length<1||e.idempotencyKey.length>128||!/^[\x21-\x7e]+$/.test(e.idempotencyKey))throw new TypeError("Idempotency-Key de cancelamento deve ser ASCII visivel com ate 128 caracteres.");if(e.reason!==void 0&&e.reason!=="payment_attempt_cancelled")throw new TypeError("reason invalido para cancelamento de charge.")}function gn(e){if(e.limit!==void 0&&(!Number.isSafeInteger(e.limit)||e.limit<1||e.limit>100))throw new TypeError("Refund list limit precisa estar entre 1 e 100.");Re(e.cursor,256,"cursor");}function wn(e){if(b(e,["amount_cents","payment_method","customer","installments","card_token","card_token_id","save_card","description","soft_descriptor","payer_ip","auth_only","product_max_installments","external_reference","expires_in_seconds","metadata","affiliate_code","coupon_code","split_rules","is_mit","initial_mit_reference_id"],"charge"),U(e.amount_cents,100,Xe,"amount_cents"),e.payment_method!=="pix"&&e.payment_method!=="credit_card")throw new TypeError("payment_method precisa ser pix ou credit_card.");if(b(e.customer,["id","name","email","tax_id"],"customer"),S(e.customer.id,"customer.id"),a(e.customer.id,"customer.id"),C(e.customer.name,200,"customer.name"),a(e.customer.name,"customer.name"),C(e.customer.email,254,"customer.email"),a(e.customer.email,"customer.email"),!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e.customer.email))throw new TypeError("customer.email invalido.");if(C(e.customer.tax_id,14,"customer.tax_id"),!/^(?:[0-9]{11}|[0-9]{14})$/.test(e.customer.tax_id))throw new TypeError("customer.tax_id precisa conter CPF ou CNPJ sem formatacao.");if(v(e.installments,1,1,"installments"),v(e.product_max_installments,1,1,"product_max_installments"),v(e.expires_in_seconds,60,Number.MAX_SAFE_INTEGER,"expires_in_seconds"),l(e.card_token,4096,"card_token"),S(e.card_token_id,"card_token_id"),e.card_token!==void 0&&R(e.card_token))throw new TypeError("card_token contem possivel numero de cartao.");if(e.card_token_id!==void 0&&R(e.card_token_id))throw new TypeError("card_token_id contem possivel numero de cartao.");if(l(e.description,500,"description"),a(e.description,"description"),e.soft_descriptor!==void 0&&(typeof e.soft_descriptor!="string"||e.soft_descriptor!==""))throw new TypeError("soft_descriptor nao e suportado pelo PSP Asaas.");if(e.payer_ip!==void 0){let r=C(e.payer_ip,45,"payer_ip");if(!Sn(r))throw new TypeError("payer_ip precisa ser um IP literal IPv4 ou IPv6.")}if(l(e.external_reference,256,"external_reference"),a(e.external_reference,"external_reference"),l(e.affiliate_code,128,"affiliate_code"),a(e.affiliate_code,"affiliate_code"),l(e.coupon_code,128,"coupon_code"),a(e.coupon_code,"coupon_code"),N(e.save_card,"save_card"),N(e.auth_only,"auth_only"),N(e.is_mit,"is_mit"),e.auth_only===true)throw new TypeError("auth_only ainda nao e suportado pela API.");let n=e.metadata===void 0?void 0:Y(e.metadata,"metadata"),t=e.card_token!==void 0,o=e.card_token_id!==void 0;if(e.payment_method==="credit_card"&&e.payer_ip===void 0)throw new TypeError("credit_card exige payer_ip literal do pagador.");if(e.payment_method==="credit_card"&&t===o)throw new TypeError("credit_card exige exatamente card_token ou card_token_id.");if(e.payment_method==="pix"&&(t||o||e.save_card!==void 0||e.installments!==void 0||e.product_max_installments!==void 0))throw new TypeError("Campos de cartao nao podem ser enviados em uma cobranca PIX.");if(e.is_mit===true){if(!o||e.initial_mit_reference_id===void 0||t)throw new TypeError("MIT exige card_token_id e initial_mit_reference_id, sem card_token bruto.")}else if(e.initial_mit_reference_id!==void 0)throw new TypeError("initial_mit_reference_id exige is_mit=true.");return S(e.initial_mit_reference_id,"initial_mit_reference_id"),a(e.initial_mit_reference_id,"initial_mit_reference_id"),bn(e.split_rules,e.amount_cents),n===void 0?e:{...e,metadata:n}}function bn(e,n){if(e===void 0)return;if(!Array.isArray(e)||e.length>50)throw new TypeError("split_rules aceita no maximo 50 itens.");let t=BigInt(n),o=0n,r=0n;for(let i of e)if(b(i,["recipient_id","value_type","value_bps","value_cents"],"split rule"),K(i.recipient_id,"split_rules.recipient_id"),a(i.recipient_id,"split_rules.recipient_id"),i.value_type==="fixed_amount"){if(U(i.value_cents,1,n,"split_rules.value_cents"),i.value_bps!==void 0)throw new TypeError("fixed_amount nao aceita value_bps.");o+=BigInt(i.value_cents);}else if(i.value_type==="percentage_of_gross"){if(U(i.value_bps,1,1e4,"split_rules.value_bps"),i.value_cents!==void 0)throw new TypeError("percentage_of_gross nao aceita value_cents.");r+=BigInt(i.value_bps),o+=t*BigInt(i.value_bps)/10000n;}else throw new TypeError("split_rules.value_type invalido.");if(r>10000n||o>t)throw new TypeError("split_rules agregado nao pode exceder o valor da cobranca.")}function kn(e){if(b(e,["items","success_url","cancel_url","customer_id","customer_data","allowed_payment_methods","affiliate_code","coupon_id","utm_params","expires_in_minutes","metadata","collect_shipping_address","delivery_type","allow_coupons"],"checkout"),!Array.isArray(e.items)||e.items.length<1||e.items.length>100)throw new TypeError("items precisa conter de 1 a 100 itens.");let n=0;for(let r of e.items){b(r,["name","quantity","unit_amount_cents"],"checkout item"),C(r.name,200,"items.name"),a(r.name,"items.name"),U(r.quantity,1,1e6,"items.quantity"),U(r.unit_amount_cents,100,Number.MAX_SAFE_INTEGER,"items.unit_amount_cents");let i=r.quantity*r.unit_amount_cents;if(n+=i,!Number.isSafeInteger(i)||!Number.isSafeInteger(n))throw new TypeError("Total do checkout excede o limite seguro.")}if(fe(e.success_url,"success_url"),fe(e.cancel_url,"cancel_url"),e.customer_id!==void 0&&e.customer_data!==void 0)throw new TypeError("customer_id e customer_data sao mutuamente exclusivos.");if(S(e.customer_id,"customer_id"),a(e.customer_id,"customer_id"),e.customer_data!==void 0&&(b(e.customer_data,["name","email","document","phone"],"customer_data"),l(e.customer_data.name,200,"customer_data.name"),a(e.customer_data.name,"customer_data.name"),l(e.customer_data.email,320,"customer_data.email"),a(e.customer_data.email,"customer_data.email"),l(e.customer_data.document,64,"customer_data.document"),l(e.customer_data.phone,32,"customer_data.phone")),e.allowed_payment_methods!==void 0){let r=[...e.allowed_payment_methods];if(r.length<1||r.length>2||new Set(r).size!==r.length||r.some(i=>i!=="pix"&&i!=="credit_card"))throw new TypeError("allowed_payment_methods invalido.")}if(S(e.coupon_id,"coupon_id"),e.allow_coupons===false&&e.coupon_id!==void 0)throw new TypeError("coupon_id nao pode ser usado quando allow_coupons=false.");l(e.affiliate_code,128,"affiliate_code"),a(e.affiliate_code,"affiliate_code"),l(e.delivery_type,64,"delivery_type"),a(e.delivery_type,"delivery_type"),v(e.expires_in_minutes,1,1440,"expires_in_minutes"),N(e.collect_shipping_address,"collect_shipping_address"),N(e.allow_coupons,"allow_coupons");let t=e.metadata===void 0?void 0:Y(e.metadata,"metadata"),o=e.utm_params===void 0?void 0:Y(e.utm_params,"utm_params");return t===void 0&&o===void 0?e:{...e,metadata:t,utm_params:o}}function En(e){if(b(e,["customer_id","plan_id","payment_method","trial_days","card_token_id","coupon_id","affiliate_code","metadata","external_reference"],"subscription"),K(e.customer_id,"customer_id"),a(e.customer_id,"customer_id"),K(e.plan_id,"plan_id"),e.payment_method!=="pix"&&e.payment_method!=="credit_card")throw new TypeError("payment_method precisa ser pix ou credit_card.");if(S(e.card_token_id,"card_token_id"),e.card_token_id!==void 0&&R(e.card_token_id))throw new TypeError("card_token_id contem possivel numero de cartao.");if(e.payment_method==="credit_card"&&e.card_token_id===void 0)throw new TypeError("credit_card exige card_token_id.");if(e.payment_method==="pix"&&e.card_token_id!==void 0)throw new TypeError("card_token_id nao pode ser enviado para PIX.");S(e.coupon_id,"coupon_id"),v(e.trial_days,0,365,"trial_days"),l(e.affiliate_code,128,"affiliate_code"),a(e.affiliate_code,"affiliate_code"),l(e.external_reference,256,"external_reference"),a(e.external_reference,"external_reference");let n=e.metadata===void 0?void 0:Y(e.metadata,"metadata");return n===void 0?e:{...e,metadata:n}}function Tn(e){if(b(e,["mode","reason"],"subscription cancellation"),e.mode!=="immediate"&&e.mode!=="end_of_period")throw new TypeError("mode invalido.");if(e.reason===void 0)return e;if(typeof e.reason!="string")throw new TypeError("reason invalido.");let n=le(e.reason);return n.length===0?{mode:e.mode}:(l(n,500,"reason"),a(n,"reason"),{...e,reason:n})}function Rn(e){if(b(e,["name","email","tax_id","phone","birth_date","external_reference","marketing_consent"],"customer"),C(e.name,200,"name"),a(e.name,"name"),C(e.email,320,"email"),a(e.email,"email"),!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e.email))throw new TypeError("email invalido.");if(l(e.tax_id,64,"tax_id"),l(e.phone,32,"phone"),l(e.external_reference,256,"external_reference"),a(e.external_reference,"external_reference"),N(e.marketing_consent,"marketing_consent"),e.birth_date!==void 0&&!/^\d{4}-\d{2}-\d{2}$/.test(e.birth_date))throw new TypeError("birth_date precisa usar YYYY-MM-DD.")}function Cn(e){if(b(e,["status","customer_id","payment_method","created_at_from","created_at_to","limit","cursor"],"charge list"),e.status!==void 0&&!me.has(e.status))throw new TypeError("status invalido.");if(e.payment_method!==void 0&&e.payment_method!=="pix"&&e.payment_method!=="credit_card")throw new TypeError("payment_method invalido.");if(S(e.customer_id,"customer_id"),a(e.customer_id,"customer_id"),v(e.limit,1,100,"limit"),Re(e.cursor,256,"cursor"),ue(e.created_at_from,"created_at_from"),ue(e.created_at_to,"created_at_to"),e.created_at_from!==void 0&&e.created_at_to!==void 0&&O(e.created_at_from)>=O(e.created_at_to))throw new TypeError("created_at_from precisa ser anterior a created_at_to.")}function ce(e,n){if(e.idempotencyKey!==void 0&&e.idempotencyKey.length>n)throw new TypeError(`Idempotency-Key deve ter no maximo ${n} caracteres neste recurso.`)}function b(e,n,t){if(e===null||typeof e!="object"||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype)throw new TypeError(`${t} precisa ser um objeto simples.`);let o=new Set(n),r=Object.keys(e).find(i=>!o.has(i));if(r!==void 0)throw new TypeError(`${t} contem campo nao suportado: ${r}.`)}function I(e,n){let t=K(e,n);a(t,n);}function K(e,n){let t=C(e,256,n);if(!/^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(t))throw new TypeError(`${n} invalido.`);return t}function S(e,n){e!==void 0&&K(e,n);}function C(e,n,t){if(typeof e!="string"||e.trim().length<1||e.length>n||/[\x00-\x1f\x7f]/.test(e))throw new TypeError(`${t} invalido.`);return e}function l(e,n,t){e!==void 0&&C(e,n,t);}function U(e,n,t,o){if(!Number.isSafeInteger(e)||e<n||e>t)throw new TypeError(`${o} precisa ser inteiro entre ${n} e ${t}.`)}function v(e,n,t,o){e!==void 0&&U(e,n,t,o);}function N(e,n){if(e!==void 0&&typeof e!="boolean")throw new TypeError(`${n} precisa ser boolean.`)}function Re(e,n,t){if(e!==void 0&&(typeof e!="string"||!be(e,n)))throw new TypeError(`${t} invalido.`)}function ue(e,n){if(e!==void 0&&(typeof e!="string"||!q(e)))throw new TypeError(`${n} precisa ser uma data ISO-8601.`)}function Sn(e){return Ce(e)||xn(e)}function Ce(e){let n=e.split(".");return n.length===4&&n.every(t=>/^(?:0|[1-9][0-9]{0,2})$/.test(t)&&Number(t)<=255)}function xn(e){if(!e.includes(":")||!/^[0-9A-Fa-f:.]+$/.test(e))return  false;let n=e.indexOf("::");if(n!==-1&&e.indexOf("::",n+2)!==-1)return  false;let o=(n===-1?[e]:[e.slice(0,n),e.slice(n+2)]).flatMap(i=>i===""?[]:i.split(":"));if(o.some(i=>i.length===0))return  false;let r=0;for(let[i,s]of o.entries())if(s.includes(".")){if(i!==o.length-1||!Ce(s))return  false;r+=2;}else {if(!/^[0-9A-Fa-f]{1,4}$/.test(s))return  false;r+=1;}return n===-1?r===8:r<8}function fe(e,n){if(typeof e!="string"||e.length>2048)throw new TypeError(`${n} invalida.`);let t;try{t=new URL(e);}catch{throw new TypeError(`${n} precisa ser URL absoluta.`)}let o=["localhost","127.0.0.1","[::1]"].includes(t.hostname);if(t.protocol!=="https:"&&!(o&&t.protocol==="http:")||t.username||t.password)throw new TypeError(`${n} precisa ser URL HTTPS segura.`)}function Pn(e,n){b(e,Object.keys(e),n);let t=[{value:e,depth:0}],o=new WeakSet,r=0;for(;t.length>0;){let i=t.pop();if(!i)break;if(r+=1,r>1e4||i.depth>32)throw new TypeError(`${n} excede o limite de complexidade.`);let s=i.value;if(!(s===null||typeof s=="boolean")){if(typeof s=="string"){if(R(s))throw new TypeError(`${n} contem possivel numero de cartao.`);continue}if(typeof s=="number"){if(!Number.isFinite(s))throw new TypeError(`${n} contem numero invalido.`);if(R(JSON.stringify(s)))throw new TypeError(`${n} contem possivel numero de cartao.`);continue}if(typeof s!="object")throw new TypeError(`${n} contem valor nao-JSON.`);if(o.has(s))throw new TypeError(`${n} contem ciclo.`);o.add(s);for(let[d,m]of Object.entries(s)){if(R(d))throw new TypeError(`${n} contem possivel numero de cartao.`);let u=d.normalize("NFKC").toLowerCase();if(/[^\x00-\x7f]/.test(u))throw new TypeError(`${n} contem nome de campo Unicode nao suportado.`);let c=u.replace(/[^a-z0-9]/g,""),g=c.replace(/[0-9]+$/,"").replace(/(cvv|cvc|csc|cid|cav)[0-9]+/g,"$1");if(["__proto__","prototype","constructor"].includes(u)||["pan","cardnumber"].includes(c)||["cvv","cvc","cav"].some(y=>["","value","code","number"].some(T=>g.endsWith(y+T)))||["csc","cid"].some(y=>["","value","code","number"].some(T=>g===y+T||["card","amex","americanexpress"].some(D=>g.endsWith(D+y+T))))||g.endsWith("cardidentificationnumber")||g.endsWith("cardsecuritynumber")||["securitycode","securityvalue","verificationcode","verificationnumber","verificationvalue"].some(y=>g.endsWith(y)))throw new TypeError(`${n} contem campo sensivel proibido.`);t.push({value:m,depth:i.depth+1});}}}}function Y(e,n){return Pn(e,n),e}function h(e,n){let t;try{t=JSON.stringify(e,(r,i)=>{if(typeof i=="number"&&!Number.isFinite(i))throw new TypeError(`${n} contem numero invalido.`);if(["symbol","function","bigint"].includes(typeof i))throw new TypeError(`${n} contem valor nao-JSON.`);return i});}catch{throw new TypeError(`${n} contem valor nao-JSON.`)}if(t===void 0)throw new TypeError(`${n} invalido.`);let o;try{o=JSON.parse(t);}catch{throw new TypeError(`${n} contem valor nao-JSON.`)}if(!w(o))throw new TypeError(`${n} invalido.`);return o}function a(e,n){if(e!==void 0&&R(e))throw new TypeError(`${n} contem possivel numero de cartao.`)}var An=300,On=1024*1024;async function In(e,n,t,o={}){let r=typeof e=="string"?e:new TextDecoder().decode(e);if((typeof e=="string"?new TextEncoder().encode(e).byteLength:e.byteLength)>On)throw new k({message:"Payload de webhook excede o limite seguro.",code:"webhook_payload_too_large",suggestion:"Rejeite o request com HTTP 413 antes de processar o evento."});let s=o.toleranceSeconds??An;if(t.length<1||t.length>512||t.trim()!==t)throw new k({message:"Webhook secret invalido.",code:"webhook_secret_invalid",suggestion:"Configure o webhook secret exato e nao use valor vazio ou com espacos externos."});if(!Number.isSafeInteger(s)||s<1||s>1440*60)throw new k({message:"Tolerancia de webhook invalida.",code:"webhook_tolerance_invalid",suggestion:"Use uma tolerancia inteira entre 1 segundo e 24 horas."});let d=vn(n);if(Math.abs(Math.floor(Date.now()/1e3)-d.timestamp)>s)throw new k({message:"Assinatura de webhook fora da janela de tolerancia.",code:"webhook_timestamp_outside_tolerance",suggestion:"Confira relogio do servidor e rejeite replays antigos."});let u=await Nn(t,`${d.timestamp}.${r}`);if(!Un(u,d.value))throw new k({message:"Assinatura de webhook invalida.",code:"webhook_signature_mismatch",suggestion:"Use o webhook secret correto e o payload bruto, sem parse antes da validacao."});let c;try{c=JSON.parse(r);}catch{throw new k({message:"Payload de webhook nao e JSON valido.",code:"webhook_payload_invalid",suggestion:"Use o payload bruto recebido no endpoint da MuPag."})}if(typeof c.id!="string"||c.id.length===0||c.id.length>256||typeof c.type!="string"||c.type.length===0||c.type.length>128||c.data===null||typeof c.data!="object"||Array.isArray(c.data))throw new k({message:"Payload de webhook valido, mas sem campos obrigatorios.",code:"webhook_payload_invalid",suggestion:"Verifique se voce esta usando o endpoint de webhook da MuPag."});return c}var G=class{constructEvent=In};function vn(e){if(e.length>4096)throw P();let n=e.split(",");if(n.length>16)throw P();let t,o;for(let i of n){let s=i.trim(),d=s.indexOf("=");if(d<=0)throw P();let m=s.slice(0,d),u=s.slice(d+1);if(m==="t"){if(t!==void 0)throw P();t=u;}else if(m==="v1"){if(o!==void 0)throw P();o=u;}}if(t===void 0||!/^(?:0|[1-9]\d*)$/.test(t))throw P();let r=Number(t);if(!Number.isSafeInteger(r)||r<=0||o===void 0||!/^[a-f0-9]{64}$/i.test(o))throw P();return {timestamp:r,value:o}}function P(){return new k({message:"Header de assinatura de webhook malformado.",code:"webhook_signature_malformed",suggestion:"Envie o header no formato t=<unix>,v1=<assinatura_hex>."})}async function Nn(e,n){let t=await crypto.subtle.importKey("raw",new TextEncoder().encode(e),{name:"HMAC",hash:"SHA-256"},false,["sign"]),o=await crypto.subtle.sign("HMAC",t,new TextEncoder().encode(n));return [...new Uint8Array(o)].map(r=>r.toString(16).padStart(2,"0")).join("")}function Un(e,n){let t=Math.max(e.length,n.length),o=e.length^n.length;for(let r=0;r<t;r+=1)o|=(e.charCodeAt(r)||0)^(n.charCodeAt(r)||0);return o===0}var Se=class{charges;checkoutSessions;customers;refunds;subscriptions;webhooks;constructor(n){let t=new J({env:n.env,apiKey:n.apiKey,baseUrl:n.baseUrl,fetch:n.fetch,timeoutMs:n.timeoutMs,maxResponseBytes:n.maxResponseBytes,retry:n.retry});this.charges=new z(t),this.checkoutSessions=new H(t),this.customers=new V(t),this.refunds=new W(t),this.subscriptions=new F(t),this.webhooks=new G;}};
+exports.APIError=_;exports.AuthError=Z;exports.ChargesResource=z;exports.CheckoutSessionsResource=H;exports.CustomersResource=V;exports.IdempotencyError=Q;exports.MuPag=Se;exports.MuPagError=f;exports.OutcomeUnknownError=M;exports.RateLimitError=$;exports.RefundsResource=W;exports.SubscriptionsResource=F;exports.ValidationError=X;exports.WebhookSignatureError=k;exports.WebhooksResource=G;exports.constructWebhookEvent=In;exports.createApiError=ne;//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map