myxl-core 1.0.0

package/dist/ciam.js

@@ -0,0 +1,351 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toCommonJS = (from) => {
+  var entry = (__moduleCache ??= new WeakMap).get(from), desc;
+  if (entry)
+    return entry;
+  entry = __defProp({}, "__esModule", { value: true });
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (var key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(entry, key))
+        __defProp(entry, key, {
+          get: __accessProp.bind(from, key),
+          enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+        });
+  }
+  __moduleCache.set(from, entry);
+  return entry;
+};
+var __moduleCache;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// src/lib/encrypt-helper.ts
+var exports_encrypt_helper = {};
+__export(exports_encrypt_helper, {
+  makeXSignaturePayment: () => makeXSignaturePayment,
+  makeXSignatureLoyalty: () => makeXSignatureLoyalty,
+  makeXSignatureBountyAllotment: () => makeXSignatureBountyAllotment,
+  makeXSignatureBounty: () => makeXSignatureBounty,
+  makeXSignatureBasic: () => makeXSignatureBasic,
+  makeXSignature: () => makeXSignature,
+  makeAxApiSignature: () => makeAxApiSignature,
+  encryptXData: () => encryptXData,
+  encryptEncryptedField: () => encryptEncryptedField,
+  decryptXData: () => decryptXData,
+  decryptEncryptedField: () => decryptEncryptedField
+});
+import crypto from "crypto";
+function pkcs7Pad(buf, blockSize = 16) {
+  const pad = blockSize - buf.length % blockSize;
+  const padBuf = Buffer.alloc(pad, pad);
+  return Buffer.concat([buf, padBuf]);
+}
+function pkcs7Unpad(buf) {
+  const pad = buf[buf.length - 1] ?? 16;
+  if (pad < 1 || pad > 16)
+    throw new Error("Invalid PKCS7 padding");
+  return buf.slice(0, buf.length - pad);
+}
+function deriveIv(xtimeMs) {
+  const sha = crypto.createHash("sha256").update(String(xtimeMs)).digest("hex");
+  return Buffer.from(sha.slice(0, 16), "ascii");
+}
+function urlsafeB64Encode(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function urlsafeB64Decode(s) {
+  const b64 = s.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = b64 + "=".repeat((4 - b64.length % 4) % 4);
+  return Buffer.from(padded, "base64");
+}
+function encryptXData(plaintext, xtimeMs) {
+  const key = Buffer.from(XDATA_KEY, "ascii");
+  const iv = deriveIv(xtimeMs);
+  const padded = pkcs7Pad(Buffer.from(plaintext, "utf-8"));
+  const cipher = crypto.createCipheriv("aes-256-cbc", key, iv);
+  cipher.setAutoPadding(false);
+  const ct = Buffer.concat([cipher.update(padded), cipher.final()]);
+  return urlsafeB64Encode(ct);
+}
+function decryptXData(xdata, xtimeMs) {
+  const key = Buffer.from(XDATA_KEY, "ascii");
+  const iv = deriveIv(xtimeMs);
+  const ct = urlsafeB64Decode(xdata);
+  const decipher = crypto.createDecipheriv("aes-256-cbc", key, iv);
+  decipher.setAutoPadding(false);
+  const pt = Buffer.concat([decipher.update(ct), decipher.final()]);
+  return pkcs7Unpad(pt).toString("utf-8");
+}
+function makeXSignature(idToken, method, path, sigTimeSec) {
+  const keyStr = `${X_API_BASE_SECRET};${idToken};${method};${path};${sigTimeSec}`;
+  const msg = `${idToken};${sigTimeSec};`;
+  return crypto.createHmac("sha512", keyStr).update(msg).digest("hex");
+}
+function makeXSignaturePayment(accessToken, sigTimeSec, packageCode, tokenPayment, paymentMethod, paymentFor, path) {
+  const keyStr = `${X_API_BASE_SECRET};${sigTimeSec}#ae-hei_9Tee6he+Ik3Gais5=;POST;${path};${sigTimeSec}`;
+  const msg = `${accessToken};${tokenPayment};${sigTimeSec};${paymentFor};${paymentMethod};${packageCode};`;
+  return crypto.createHmac("sha512", keyStr).update(msg).digest("hex");
+}
+function makeXSignatureBounty(accessToken, sigTimeSec, packageCode, tokenPayment) {
+  const path = "api/v8/personalization/bounties-exchange";
+  const keyStr = `${X_API_BASE_SECRET};${accessToken};${sigTimeSec}#ae-hei_9Tee6he+Ik3Gais5=;POST;${path};${sigTimeSec}`;
+  const msg = `${accessToken};${tokenPayment};${sigTimeSec};${packageCode};`;
+  return crypto.createHmac("sha512", keyStr).update(msg).digest("hex");
+}
+function makeXSignatureLoyalty(sigTimeSec, packageCode, tokenConfirmation, path) {
+  const keyStr = `${X_API_BASE_SECRET};${sigTimeSec}#ae-hei_9Tee6he+Ik3Gais5=;POST;${path};${sigTimeSec}`;
+  const msg = `${tokenConfirmation};${sigTimeSec};${packageCode};`;
+  return crypto.createHmac("sha512", keyStr).update(msg).digest("hex");
+}
+function makeXSignatureBountyAllotment(sigTimeSec, packageCode, tokenConfirmation, path, destinationMsisdn) {
+  const keyStr = `${X_API_BASE_SECRET};${sigTimeSec}#ae-hei_9Tee6he+Ik3Gais5=;${destinationMsisdn};POST;${path};${sigTimeSec}`;
+  const msg = `${tokenConfirmation};${sigTimeSec};${destinationMsisdn};${packageCode};`;
+  return crypto.createHmac("sha512", keyStr).update(msg).digest("hex");
+}
+function makeXSignatureBasic(method, path, sigTimeSec) {
+  const keyStr = `${X_API_BASE_SECRET};${method};${path};${sigTimeSec}`;
+  const msg = `${sigTimeSec};en;`;
+  return crypto.createHmac("sha512", keyStr).update(msg).digest("hex");
+}
+function makeAxApiSignature(tsForSign, contact, code, contactType) {
+  const preimage = `${tsForSign}password${contactType}${contact}${code}openid`;
+  const digest = crypto.createHmac("sha256", Buffer.from(AX_API_SIG_KEY, "ascii")).update(preimage).digest();
+  return digest.toString("base64");
+}
+function decryptEncryptedField(encryptedB64) {
+  const ivAscii = encryptedB64.slice(-16);
+  const b64Part = encryptedB64.slice(0, -16);
+  const key = Buffer.from(ENCRYPTED_FIELD_KEY, "ascii");
+  const iv = Buffer.from(ivAscii, "ascii");
+  const ct = urlsafeB64Decode(b64Part);
+  const decipher = crypto.createDecipheriv("aes-128-cbc", key, iv);
+  decipher.setAutoPadding(false);
+  const pt = Buffer.concat([decipher.update(ct), decipher.final()]);
+  return pkcs7Unpad(pt).toString("utf-8");
+}
+function encryptEncryptedField(plaintext) {
+  const key = Buffer.from(ENCRYPTED_FIELD_KEY, "ascii");
+  const ivHex = crypto.randomBytes(8).toString("hex");
+  const iv = Buffer.from(ivHex, "ascii");
+  const padded = pkcs7Pad(Buffer.from(plaintext, "utf-8"));
+  const cipher = crypto.createCipheriv("aes-128-cbc", key, iv);
+  cipher.setAutoPadding(false);
+  const ct = Buffer.concat([cipher.update(padded), cipher.final()]);
+  return urlsafeB64Encode(ct) + ivHex;
+}
+var init_encrypt_helper = __esm(() => {
+  init_config();
+});
+
+// src/encrypt.ts
+function encryptSignXData(method, path, idToken, payload) {
+  const plainBody = JSON.stringify(payload);
+  const xtime = Date.now();
+  const xdata = encryptXData(plainBody, xtime);
+  const sigTimeSec = Math.floor(xtime / 1000);
+  const xSignature = makeXSignature(idToken, method, path, sigTimeSec);
+  return {
+    x_signature: xSignature,
+    encrypted_body: { xdata, xtime }
+  };
+}
+async function decryptXData2(xdata, xtimeMs) {
+  const { decryptXData: _decrypt } = (init_encrypt_helper(), __toCommonJS(exports_encrypt_helper));
+  return JSON.parse(_decrypt(xdata, xtimeMs));
+}
+var init_encrypt = __esm(() => {
+  init_config();
+  init_encrypt_helper();
+  init_encrypt_helper();
+});
+
+// src/lib/utils.ts
+import axios from "axios";
+import { v4 as uuidv4 } from "uuid";
+import { DateTime } from "luxon";
+function javaLikeTimestamp(dt = DateTime.now()) {
+  return dt.toMillis().toString();
+}
+async function sendApiRequest(path, payloadDict, idToken, method = "POST") {
+  const encryptedPayload = encryptSignXData(method, path, idToken, payloadDict);
+  const xtime = Number(encryptedPayload.encrypted_body.xtime);
+  const sigTimeSec = Math.floor(xtime / 1000);
+  const body = encryptedPayload.encrypted_body;
+  const x_sig = encryptedPayload.x_signature;
+  const headers = {
+    host: BASE_API_URL.replace(/^https?:\/\//, ""),
+    "content-type": "application/json; charset=utf-8",
+    "user-agent": UA,
+    "x-api-key": API_KEY,
+    authorization: `Bearer ${idToken}`,
+    "x-hv": "v3",
+    "x-signature-time": String(sigTimeSec),
+    "x-signature": x_sig,
+    "x-request-id": uuidv4(),
+    "x-request-at": javaLikeTimestamp(),
+    "x-version-app": X_APP_VERSION
+  };
+  const url = `${BASE_API_URL.replace(/\/$/, "")}/${path.replace(/^\//, "")}`;
+  const resp = await axios.post(url, body, {
+    headers,
+    timeout: 30000
+  });
+  const respData = resp.data;
+  const decryptedXData = await decryptXData2(respData.xdata, respData.xtime);
+  if (decryptedXData.status === "FAILED") {
+    throw new Error(JSON.stringify(decryptedXData));
+  }
+  return decryptedXData;
+}
+function unseal(getter, fallback) {
+  try {
+    const hex = getter();
+    if (!hex || typeof __SEED__ === "undefined")
+      return fallback;
+    const seed = Buffer.from(__SEED__, "hex");
+    const data = Buffer.from(hex, "hex");
+    return Buffer.from(data.map((b, i) => b ^ seed[i % seed.length])).toString("utf8");
+  } catch {
+    return fallback;
+  }
+}
+var init_utils = __esm(() => {
+  init_config();
+  init_encrypt();
+});
+
+// src/config.ts
+var BASE_API_URL, BASE_CIAM_URL, BASIC_AUTH, AX_FP_KEY, UA, API_KEY, ENCRYPTED_FIELD_KEY, XDATA_KEY, AX_API_SIG_KEY, X_API_BASE_SECRET, CIRCLE_MSISDN_KEY, X_APP_VERSION = "8.9.0";
+var init_config = __esm(() => {
+  init_utils();
+  BASE_API_URL = unseal(() => __E_BASE_API_URL__, "https://api.myxl.xlaxiata.co.id");
+  BASE_CIAM_URL = unseal(() => __E_BASE_CIAM_URL__, "https://gede.ciam.xlaxiata.co.id");
+  BASIC_AUTH = unseal(() => __E_BASIC_AUTH__, "OWZjOTdlZDEtNmEzMC00OGQ1LTk1MTYtNjBjNTNjZTNhMTM1OllEV21GNExKajlYSUt3UW56eTJlMmxiMHRKUWIyOW8z");
+  AX_FP_KEY = unseal(() => __E_AX_FP_KEY__, "18b4d589826af50241177961590e6693");
+  UA = unseal(() => __E_UA__, "myXL / 8.9.0(1202); com.android.vending; (samsung; SM-N935F; SDK 33; Android 13)");
+  API_KEY = unseal(() => __E_API_KEY__, "vT8tINqHaOxXbGE7eOWAhA==");
+  ENCRYPTED_FIELD_KEY = unseal(() => __E_ENCRYPTED_FIELD_KEY__, "5dccbf08920a5527");
+  XDATA_KEY = unseal(() => __E_XDATA_KEY__, "5dccbf08920a5527b99e222789c34bb7");
+  AX_API_SIG_KEY = unseal(() => __E_AX_API_SIG_KEY__, "18b4d589826af50241177961590e6693");
+  X_API_BASE_SECRET = unseal(() => __E_X_API_BASE_SECRET__, "mU1Y4n1vBjf3M7tMnRkFU08mVyUJHed8B5En3EAniu1mXLixeuASmBmKnkyzVziOye7rG5nIekMdthensbQMcOJ6SLnrkGyfXALD7mrBC6vuWv6G01pmD3XlU5rT7Tzx");
+  CIRCLE_MSISDN_KEY = unseal(() => __E_CIRCLE_MSISDN_KEY__, "5dccbf08920a5527");
+});
+
+// src/ciam.ts
+init_config();
+init_utils();
+import axios2 from "axios";
+import { DateTime as DateTime2, FixedOffsetZone } from "luxon";
+import { v4 as uuidv42 } from "uuid";
+async function getNewToken(refreshToken, axDeviceId, axFingerprint) {
+  try {
+    const url = `${BASE_CIAM_URL}/realms/xl-ciam/protocol/openid-connect/token`;
+    const gmt7Zone = FixedOffsetZone.instance(420);
+    const now = DateTime2.now().setZone(gmt7Zone);
+    const ax_request_at = now.toFormat("yyyy-MM-dd'T'HH:mm:ss.SSS") + "+0700";
+    const ax_request_id = uuidv42();
+    const headers = {
+      Host: BASE_CIAM_URL.replace("https://", ""),
+      "ax-request-at": ax_request_at,
+      "ax-device-id": axDeviceId,
+      "ax-request-id": ax_request_id,
+      "ax-request-device": "samsung",
+      "ax-request-device-model": "SM-N935F",
+      "ax-fingerprint": axFingerprint,
+      authorization: `Basic ${BASIC_AUTH}`,
+      "user-agent": UA,
+      "ax-substype": "PREPAID",
+      "content-type": "application/x-www-form-urlencoded"
+    };
+    const data = new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken
+    });
+    const resp = await axios2.post(url, data.toString(), {
+      headers,
+      timeout: 30000
+    });
+    return resp.data;
+  } catch (error) {
+    console.error("Refresh token tidak valid:", error);
+    throw new Error("Refresh token tidak valid.");
+  }
+}
+async function getProfile(accessToken, idToken) {
+  const path = "api/v8/profile";
+  const rawPayload = {
+    access_token: accessToken,
+    app_version: X_APP_VERSION,
+    is_enterprise: false,
+    lang: "en"
+  };
+  const res = await sendApiRequest(path, rawPayload, idToken, "POST");
+  return res.data.profile;
+}
+async function getBalance(idToken) {
+  const path = "api/v8/packages/balance-and-credit";
+  const rawPayload = {
+    is_enterprise: false,
+    lang: "en"
+  };
+  return await sendApiRequest(path, rawPayload, idToken, "POST");
+}
+async function getTieringInfo(idToken) {
+  const path = "gamification/api/v8/loyalties/tiering/info";
+  const rawPayload = {
+    is_enterprise: false,
+    lang: "en"
+  };
+  return await sendApiRequest(path, rawPayload, idToken, "POST");
+}
+async function getRedeemables({ idToken, isEnterprise }) {
+  const path = "api/v8/personalization/redeemables";
+  const rawPayload = {
+    is_enterprise: isEnterprise,
+    lang: "en"
+  };
+  return await sendApiRequest(path, rawPayload, idToken, "POST");
+}
+async function checkQuota(msisdn) {
+  const url = `https://xl-ku.my.id/end.php?check=package&number=${msisdn}&version=2`;
+  console.log(`Fetching quota for ${msisdn} from external API...`);
+  const response = await axios2.get(url);
+  return response.data;
+}
+async function fetchMyPackages({ idToken }) {
+  const path = "api/v8/packages/quota-details";
+  const rawPayload = {
+    is_enterprise: false,
+    lang: "en",
+    family_member_id: ""
+  };
+  return await sendApiRequest(path, rawPayload, idToken, "POST");
+}
+export {
+  getTieringInfo,
+  getRedeemables,
+  getProfile,
+  getNewToken,
+  getBalance,
+  fetchMyPackages,
+  checkQuota
+};

package/dist/client.d.ts

@@ -0,0 +1,56 @@
+type GetTransactionHistoryProps = {
+    idToken: string;
+};
+export type TransactionHistoryItem = {
+    category: string;
+    code: string;
+    formated_date: string;
+    icon: string;
+    payment_method: string;
+    payment_method_icon: string;
+    payment_method_label: string;
+    payment_status: string;
+    price: string;
+    raw_price: number;
+    show_time: boolean;
+    status: string;
+    target_msisdn: string;
+    timestamp: number;
+    title: string;
+    trx_code: string;
+    validity: string;
+};
+type TransactionHistory = TransactionHistoryItem[];
+export declare function getTransactionHistory({ idToken }: GetTransactionHistoryProps): Promise<TransactionHistory>;
+export type NotificationItem = {
+    brief_message: string;
+    category: string;
+    category_title: string;
+    full_message: string;
+    is_read: boolean;
+    notification_id: string;
+    timestamp: string;
+};
+export type NotificationData = {
+    data: NotificationItem[];
+    error: null | string;
+};
+export type DashboardData = {
+    contextual_message: Record<string, unknown>;
+    datadog_rum_flag: boolean;
+    loyalty: Record<string, unknown>;
+    notification: NotificationData;
+    profile: Record<string, unknown>;
+    special_for_you: Record<string, unknown>;
+};
+export type DashboardResponse = {
+    code: string;
+    data: DashboardData;
+    status: string;
+};
+type DashboardSegmentsProps = {
+    idToken: string;
+    accessToken: string;
+};
+export declare function dashboardSegments({ idToken, accessToken }: DashboardSegmentsProps): Promise<DashboardResponse>;
+export {};

package/dist/client.js

@@ -0,0 +1,276 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toCommonJS = (from) => {
+  var entry = (__moduleCache ??= new WeakMap).get(from), desc;
+  if (entry)
+    return entry;
+  entry = __defProp({}, "__esModule", { value: true });
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (var key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(entry, key))
+        __defProp(entry, key, {
+          get: __accessProp.bind(from, key),
+          enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+        });
+  }
+  __moduleCache.set(from, entry);
+  return entry;
+};
+var __moduleCache;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// src/config.ts
+var BASE_API_URL, BASE_CIAM_URL, BASIC_AUTH, AX_FP_KEY, UA, API_KEY, ENCRYPTED_FIELD_KEY, XDATA_KEY, AX_API_SIG_KEY, X_API_BASE_SECRET, CIRCLE_MSISDN_KEY, X_APP_VERSION = "8.9.0";
+var init_config = __esm(() => {
+  init_utils();
+  BASE_API_URL = unseal(() => __E_BASE_API_URL__, "https://api.myxl.xlaxiata.co.id");
+  BASE_CIAM_URL = unseal(() => __E_BASE_CIAM_URL__, "https://gede.ciam.xlaxiata.co.id");
+  BASIC_AUTH = unseal(() => __E_BASIC_AUTH__, "OWZjOTdlZDEtNmEzMC00OGQ1LTk1MTYtNjBjNTNjZTNhMTM1OllEV21GNExKajlYSUt3UW56eTJlMmxiMHRKUWIyOW8z");
+  AX_FP_KEY = unseal(() => __E_AX_FP_KEY__, "18b4d589826af50241177961590e6693");
+  UA = unseal(() => __E_UA__, "myXL / 8.9.0(1202); com.android.vending; (samsung; SM-N935F; SDK 33; Android 13)");
+  API_KEY = unseal(() => __E_API_KEY__, "vT8tINqHaOxXbGE7eOWAhA==");
+  ENCRYPTED_FIELD_KEY = unseal(() => __E_ENCRYPTED_FIELD_KEY__, "5dccbf08920a5527");
+  XDATA_KEY = unseal(() => __E_XDATA_KEY__, "5dccbf08920a5527b99e222789c34bb7");
+  AX_API_SIG_KEY = unseal(() => __E_AX_API_SIG_KEY__, "18b4d589826af50241177961590e6693");
+  X_API_BASE_SECRET = unseal(() => __E_X_API_BASE_SECRET__, "mU1Y4n1vBjf3M7tMnRkFU08mVyUJHed8B5En3EAniu1mXLixeuASmBmKnkyzVziOye7rG5nIekMdthensbQMcOJ6SLnrkGyfXALD7mrBC6vuWv6G01pmD3XlU5rT7Tzx");
+  CIRCLE_MSISDN_KEY = unseal(() => __E_CIRCLE_MSISDN_KEY__, "5dccbf08920a5527");
+});
+
+// src/lib/encrypt-helper.ts
+var exports_encrypt_helper = {};
+__export(exports_encrypt_helper, {
+  makeXSignaturePayment: () => makeXSignaturePayment,
+  makeXSignatureLoyalty: () => makeXSignatureLoyalty,
+  makeXSignatureBountyAllotment: () => makeXSignatureBountyAllotment,
+  makeXSignatureBounty: () => makeXSignatureBounty,
+  makeXSignatureBasic: () => makeXSignatureBasic,
+  makeXSignature: () => makeXSignature,
+  makeAxApiSignature: () => makeAxApiSignature,
+  encryptXData: () => encryptXData,
+  encryptEncryptedField: () => encryptEncryptedField,
+  decryptXData: () => decryptXData,
+  decryptEncryptedField: () => decryptEncryptedField
+});
+import crypto from "crypto";
+function pkcs7Pad(buf, blockSize = 16) {
+  const pad = blockSize - buf.length % blockSize;
+  const padBuf = Buffer.alloc(pad, pad);
+  return Buffer.concat([buf, padBuf]);
+}
+function pkcs7Unpad(buf) {
+  const pad = buf[buf.length - 1] ?? 16;
+  if (pad < 1 || pad > 16)
+    throw new Error("Invalid PKCS7 padding");
+  return buf.slice(0, buf.length - pad);
+}
+function deriveIv(xtimeMs) {
+  const sha = crypto.createHash("sha256").update(String(xtimeMs)).digest("hex");
+  return Buffer.from(sha.slice(0, 16), "ascii");
+}
+function urlsafeB64Encode(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function urlsafeB64Decode(s) {
+  const b64 = s.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = b64 + "=".repeat((4 - b64.length % 4) % 4);
+  return Buffer.from(padded, "base64");
+}
+function encryptXData(plaintext, xtimeMs) {
+  const key = Buffer.from(XDATA_KEY, "ascii");
+  const iv = deriveIv(xtimeMs);
+  const padded = pkcs7Pad(Buffer.from(plaintext, "utf-8"));
+  const cipher = crypto.createCipheriv("aes-256-cbc", key, iv);
+  cipher.setAutoPadding(false);
+  const ct = Buffer.concat([cipher.update(padded), cipher.final()]);
+  return urlsafeB64Encode(ct);
+}
+function decryptXData(xdata, xtimeMs) {
+  const key = Buffer.from(XDATA_KEY, "ascii");
+  const iv = deriveIv(xtimeMs);
+  const ct = urlsafeB64Decode(xdata);
+  const decipher = crypto.createDecipheriv("aes-256-cbc", key, iv);
+  decipher.setAutoPadding(false);
+  const pt = Buffer.concat([decipher.update(ct), decipher.final()]);
+  return pkcs7Unpad(pt).toString("utf-8");
+}
+function makeXSignature(idToken, method, path, sigTimeSec) {
+  const keyStr = `${X_API_BASE_SECRET};${idToken};${method};${path};${sigTimeSec}`;
+  const msg = `${idToken};${sigTimeSec};`;
+  return crypto.createHmac("sha512", keyStr).update(msg).digest("hex");
+}
+function makeXSignaturePayment(accessToken, sigTimeSec, packageCode, tokenPayment, paymentMethod, paymentFor, path) {
+  const keyStr = `${X_API_BASE_SECRET};${sigTimeSec}#ae-hei_9Tee6he+Ik3Gais5=;POST;${path};${sigTimeSec}`;
+  const msg = `${accessToken};${tokenPayment};${sigTimeSec};${paymentFor};${paymentMethod};${packageCode};`;
+  return crypto.createHmac("sha512", keyStr).update(msg).digest("hex");
+}
+function makeXSignatureBounty(accessToken, sigTimeSec, packageCode, tokenPayment) {
+  const path = "api/v8/personalization/bounties-exchange";
+  const keyStr = `${X_API_BASE_SECRET};${accessToken};${sigTimeSec}#ae-hei_9Tee6he+Ik3Gais5=;POST;${path};${sigTimeSec}`;
+  const msg = `${accessToken};${tokenPayment};${sigTimeSec};${packageCode};`;
+  return crypto.createHmac("sha512", keyStr).update(msg).digest("hex");
+}
+function makeXSignatureLoyalty(sigTimeSec, packageCode, tokenConfirmation, path) {
+  const keyStr = `${X_API_BASE_SECRET};${sigTimeSec}#ae-hei_9Tee6he+Ik3Gais5=;POST;${path};${sigTimeSec}`;
+  const msg = `${tokenConfirmation};${sigTimeSec};${packageCode};`;
+  return crypto.createHmac("sha512", keyStr).update(msg).digest("hex");
+}
+function makeXSignatureBountyAllotment(sigTimeSec, packageCode, tokenConfirmation, path, destinationMsisdn) {
+  const keyStr = `${X_API_BASE_SECRET};${sigTimeSec}#ae-hei_9Tee6he+Ik3Gais5=;${destinationMsisdn};POST;${path};${sigTimeSec}`;
+  const msg = `${tokenConfirmation};${sigTimeSec};${destinationMsisdn};${packageCode};`;
+  return crypto.createHmac("sha512", keyStr).update(msg).digest("hex");
+}
+function makeXSignatureBasic(method, path, sigTimeSec) {
+  const keyStr = `${X_API_BASE_SECRET};${method};${path};${sigTimeSec}`;
+  const msg = `${sigTimeSec};en;`;
+  return crypto.createHmac("sha512", keyStr).update(msg).digest("hex");
+}
+function makeAxApiSignature(tsForSign, contact, code, contactType) {
+  const preimage = `${tsForSign}password${contactType}${contact}${code}openid`;
+  const digest = crypto.createHmac("sha256", Buffer.from(AX_API_SIG_KEY, "ascii")).update(preimage).digest();
+  return digest.toString("base64");
+}
+function decryptEncryptedField(encryptedB64) {
+  const ivAscii = encryptedB64.slice(-16);
+  const b64Part = encryptedB64.slice(0, -16);
+  const key = Buffer.from(ENCRYPTED_FIELD_KEY, "ascii");
+  const iv = Buffer.from(ivAscii, "ascii");
+  const ct = urlsafeB64Decode(b64Part);
+  const decipher = crypto.createDecipheriv("aes-128-cbc", key, iv);
+  decipher.setAutoPadding(false);
+  const pt = Buffer.concat([decipher.update(ct), decipher.final()]);
+  return pkcs7Unpad(pt).toString("utf-8");
+}
+function encryptEncryptedField(plaintext) {
+  const key = Buffer.from(ENCRYPTED_FIELD_KEY, "ascii");
+  const ivHex = crypto.randomBytes(8).toString("hex");
+  const iv = Buffer.from(ivHex, "ascii");
+  const padded = pkcs7Pad(Buffer.from(plaintext, "utf-8"));
+  const cipher = crypto.createCipheriv("aes-128-cbc", key, iv);
+  cipher.setAutoPadding(false);
+  const ct = Buffer.concat([cipher.update(padded), cipher.final()]);
+  return urlsafeB64Encode(ct) + ivHex;
+}
+var init_encrypt_helper = __esm(() => {
+  init_config();
+});
+
+// src/encrypt.ts
+function encryptSignXData(method, path, idToken, payload) {
+  const plainBody = JSON.stringify(payload);
+  const xtime = Date.now();
+  const xdata = encryptXData(plainBody, xtime);
+  const sigTimeSec = Math.floor(xtime / 1000);
+  const xSignature = makeXSignature(idToken, method, path, sigTimeSec);
+  return {
+    x_signature: xSignature,
+    encrypted_body: { xdata, xtime }
+  };
+}
+async function decryptXData2(xdata, xtimeMs) {
+  const { decryptXData: _decrypt } = (init_encrypt_helper(), __toCommonJS(exports_encrypt_helper));
+  return JSON.parse(_decrypt(xdata, xtimeMs));
+}
+var init_encrypt = __esm(() => {
+  init_config();
+  init_encrypt_helper();
+  init_encrypt_helper();
+});
+
+// src/lib/utils.ts
+import axios from "axios";
+import { v4 as uuidv4 } from "uuid";
+import { DateTime } from "luxon";
+function javaLikeTimestamp(dt = DateTime.now()) {
+  return dt.toMillis().toString();
+}
+async function sendApiRequest(path, payloadDict, idToken, method = "POST") {
+  const encryptedPayload = encryptSignXData(method, path, idToken, payloadDict);
+  const xtime = Number(encryptedPayload.encrypted_body.xtime);
+  const sigTimeSec = Math.floor(xtime / 1000);
+  const body = encryptedPayload.encrypted_body;
+  const x_sig = encryptedPayload.x_signature;
+  const headers = {
+    host: BASE_API_URL.replace(/^https?:\/\//, ""),
+    "content-type": "application/json; charset=utf-8",
+    "user-agent": UA,
+    "x-api-key": API_KEY,
+    authorization: `Bearer ${idToken}`,
+    "x-hv": "v3",
+    "x-signature-time": String(sigTimeSec),
+    "x-signature": x_sig,
+    "x-request-id": uuidv4(),
+    "x-request-at": javaLikeTimestamp(),
+    "x-version-app": X_APP_VERSION
+  };
+  const url = `${BASE_API_URL.replace(/\/$/, "")}/${path.replace(/^\//, "")}`;
+  const resp = await axios.post(url, body, {
+    headers,
+    timeout: 30000
+  });
+  const respData = resp.data;
+  const decryptedXData = await decryptXData2(respData.xdata, respData.xtime);
+  if (decryptedXData.status === "FAILED") {
+    throw new Error(JSON.stringify(decryptedXData));
+  }
+  return decryptedXData;
+}
+function unseal(getter, fallback) {
+  try {
+    const hex = getter();
+    if (!hex || typeof __SEED__ === "undefined")
+      return fallback;
+    const seed = Buffer.from(__SEED__, "hex");
+    const data = Buffer.from(hex, "hex");
+    return Buffer.from(data.map((b, i) => b ^ seed[i % seed.length])).toString("utf8");
+  } catch {
+    return fallback;
+  }
+}
+var init_utils = __esm(() => {
+  init_config();
+  init_encrypt();
+});
+
+// src/client.ts
+init_utils();
+async function getTransactionHistory({ idToken }) {
+  const path = "payments/api/v8/transaction-history";
+  const payload = {
+    is_enterprise: false,
+    lang: "en"
+  };
+  console.log("Fetching transaction history...");
+  const res = await sendApiRequest(path, payload, idToken, "POST");
+  return res.data.list;
+}
+async function dashboardSegments({ idToken, accessToken }) {
+  const path = "dashboard/api/v8/segments";
+  const rawPayload = {
+    access_token: accessToken
+  };
+  const res = await sendApiRequest(path, rawPayload, idToken, "POST");
+  return res;
+}
+export {
+  getTransactionHistory,
+  dashboardSegments
+};