@billkit-eu/sdk 0.1.0

package/dist/index.cjs

@@ -0,0 +1,996 @@
+'use strict';
+
+// src/pagination.ts
+async function* paginate(listFn, options = {}) {
+  const { pageSize, filters } = options;
+  const cleanFilters = {};
+  if (filters) {
+    for (const [k, v] of Object.entries(filters)) {
+      if (v !== void 0) cleanFilters[k] = v;
+    }
+  }
+  let cursor;
+  for (; ; ) {
+    const page = await listFn({
+      ...cleanFilters,
+      limit: pageSize,
+      starting_after: cursor
+    });
+    const items = page.data ?? [];
+    for (const item of items) yield item;
+    if (!page.has_more || items.length === 0) return;
+    const last = items[items.length - 1];
+    cursor = last?.id;
+    if (cursor === void 0) return;
+  }
+}
+
+// src/resources.ts
+function dropUndefined(obj) {
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) {
+    if (v !== void 0) out[k] = v;
+  }
+  return out;
+}
+function splitIdempotency(params) {
+  const { idempotencyKey, ...rest } = params;
+  return { body: dropUndefined(rest), idempotencyKey };
+}
+var BaseResource = class {
+  constructor(t) {
+    this.t = t;
+  }
+  t;
+  get(path, query) {
+    return this.t.request({ method: "GET", path, query });
+  }
+  post(path, params) {
+    const { body, idempotencyKey } = splitIdempotency(params);
+    return this.t.request({ method: "POST", path, body, idempotencyKey });
+  }
+  /** POST with no body, used by lifecycle verbs (cancel, resume, revoke ...). */
+  postEmpty(path, params = {}) {
+    return this.t.request({
+      method: "POST",
+      path,
+      idempotencyKey: params.idempotencyKey
+    });
+  }
+  /** POST with a fixed body and no idempotency stripping (used by
+   *  endpoints whose body is fully specified by the caller's args
+   *  and not optional, e.g. `preview_update`). */
+  postFixed(path, body, params = {}) {
+    return this.t.request({
+      method: "POST",
+      path,
+      body,
+      idempotencyKey: params.idempotencyKey
+    });
+  }
+  del(path, params = {}) {
+    return this.t.request({
+      method: "DELETE",
+      path,
+      idempotencyKey: params.idempotencyKey
+    });
+  }
+};
+var Customers = class extends BaseResource {
+  /** Create a tenant-scoped buyer record. */
+  create(params = {}) {
+    return this.post("/v1/customers", params);
+  }
+  retrieve(id) {
+    return this.get(`/v1/customers/${id}`);
+  }
+  update(id, params = {}) {
+    return this.post(`/v1/customers/${id}`, params);
+  }
+  delete(id, params = {}) {
+    return this.del(`/v1/customers/${id}`, params);
+  }
+  list(params = {}) {
+    return this.get("/v1/customers", params);
+  }
+  /** Walk every page of `list()` and yield each customer. */
+  iter(options = {}) {
+    return paginate((p) => this.get("/v1/customers", p), { pageSize: options.pageSize });
+  }
+  /**
+   * Attach or replace the customer's VAT number; triggers server-side
+   * VIES validation. The response carries `vat_number_validated`
+   * reflecting whether VIES confirmed the number.
+   */
+  setVatNumber(id, params) {
+    return this.post(`/v1/customers/${id}/vat_number`, params);
+  }
+  /**
+   * Hard-purge a customer's PII for GDPR erasure. Distinct from
+   * `delete()` (soft delete): purge nulls email/name/country/VAT/
+   * metadata, sets `purged_at`, and is irreversible.
+   *
+   * The server requires `confirmed: true` as a fat-finger guard; the
+   * SDK defaults it to `true` so callers don't have to opt in twice.
+   */
+  purge(id, params = {}) {
+    const { confirmed = true, idempotencyKey } = params;
+    return this.postFixed(`/v1/customers/${id}/purge`, { confirmed }, { idempotencyKey });
+  }
+};
+var Products = class extends BaseResource {
+  /** Create a catalog Product, then attach one or more Prices to it. */
+  create(params) {
+    return this.post("/v1/products", params);
+  }
+  retrieve(id) {
+    return this.get(`/v1/products/${id}`);
+  }
+  /** Patch mutable Product fields. */
+  update(id, params) {
+    return this.post(`/v1/products/${id}`, params);
+  }
+  /** Archive a Product. */
+  delete(id, params = {}) {
+    return this.del(`/v1/products/${id}`, params);
+  }
+  list(params = {}) {
+    return this.get("/v1/products", params);
+  }
+  iter(options = {}) {
+    return paginate((p) => this.get("/v1/products", p), { pageSize: options.pageSize });
+  }
+};
+var Prices = class extends BaseResource {
+  /** Create immutable billing terms for an existing Product. */
+  create(params) {
+    return this.post("/v1/prices", params);
+  }
+  retrieve(id) {
+    return this.get(`/v1/prices/${id}`);
+  }
+  list(params = {}) {
+    return this.get("/v1/prices", params);
+  }
+  iter(options = {}) {
+    const filter = options.product_id === void 0 ? {} : { product_id: options.product_id };
+    return paginate((p) => this.get("/v1/prices", { ...filter, ...p }), {
+      pageSize: options.pageSize
+    });
+  }
+};
+var CheckoutSessions = class extends BaseResource {
+  create(params) {
+    return this.post("/v1/checkout/sessions", params);
+  }
+  retrieve(id) {
+    return this.get(`/v1/checkout/sessions/${id}`);
+  }
+};
+var OneShotPayments = class extends BaseResource {
+  /** Create a one-off charge; returns the object with a `redirect_url`. */
+  create(params) {
+    return this.post("/v1/checkout/one_shot", params);
+  }
+  retrieve(id) {
+    return this.get(`/v1/checkout/one_shot/${id}`);
+  }
+};
+var Subscriptions = class extends BaseResource {
+  retrieve(id) {
+    return this.get(`/v1/subscriptions/${id}`);
+  }
+  list(params = {}) {
+    return this.get("/v1/subscriptions", params);
+  }
+  iter(options = {}) {
+    return paginate((p) => this.get("/v1/subscriptions", p), { pageSize: options.pageSize });
+  }
+  cancel(id, params = {}) {
+    return this.postEmpty(`/v1/subscriptions/${id}/cancel`, params);
+  }
+  pause(id, params = {}) {
+    return this.postEmpty(`/v1/subscriptions/${id}/pause`, params);
+  }
+  resume(id, params = {}) {
+    return this.postEmpty(`/v1/subscriptions/${id}/resume`, params);
+  }
+  /**
+   * Reactivate a canceled-but-still-in-period subscription.
+   *
+   * Distinct from `resume()` (paused → active): `reactivate()` flips
+   * `canceled` back to `active` for the remainder of the current
+   * period, so the customer keeps service without a new checkout.
+   * Returns `409` if the period has already elapsed.
+   */
+  reactivate(id, params = {}) {
+    return this.postEmpty(`/v1/subscriptions/${id}/reactivate`, params);
+  }
+  previewUpdate(id, params) {
+    return this.postFixed(`/v1/subscriptions/${id}/preview_update`, {
+      target_price_id: params.target_price_id
+    });
+  }
+  update(id, params) {
+    return this.postFixed(
+      `/v1/subscriptions/${id}/update`,
+      { target_price_id: params.target_price_id },
+      { idempotencyKey: params.idempotencyKey }
+    );
+  }
+  reauthorizePaymentMethod(id, params) {
+    return this.postFixed(
+      `/v1/subscriptions/${id}/reauthorize_payment_method`,
+      { return_url: params.return_url },
+      { idempotencyKey: params.idempotencyKey }
+    );
+  }
+};
+var Refunds = class extends BaseResource {
+  create(params) {
+    return this.post("/v1/refunds", params);
+  }
+  retrieve(id) {
+    return this.get(`/v1/refunds/${id}`);
+  }
+  list(params = {}) {
+    return this.get("/v1/refunds", params);
+  }
+  iter(options = {}) {
+    return paginate((p) => this.get("/v1/refunds", p), { pageSize: options.pageSize });
+  }
+};
+var Disputes = class extends BaseResource {
+  retrieve(id) {
+    return this.get(`/v1/disputes/${id}`);
+  }
+  list(params = {}) {
+    return this.get("/v1/disputes", params);
+  }
+  iter(options = {}) {
+    return paginate((p) => this.get("/v1/disputes", p), { pageSize: options.pageSize });
+  }
+};
+var WebhookEndpoints = class extends BaseResource {
+  create(params) {
+    return this.post("/v1/webhook_endpoints", params);
+  }
+  retrieve(id) {
+    return this.get(`/v1/webhook_endpoints/${id}`);
+  }
+  update(id, params) {
+    return this.post(`/v1/webhook_endpoints/${id}`, params);
+  }
+  delete(id, params = {}) {
+    return this.del(`/v1/webhook_endpoints/${id}`, params);
+  }
+  /** Rotate the signing secret. The new `whsec_...` is returned once. */
+  rotateSecret(id, params = {}) {
+    return this.postEmpty(`/v1/webhook_endpoints/${id}/rotate_secret`, params);
+  }
+  list(params = {}) {
+    return this.get("/v1/webhook_endpoints", params);
+  }
+  iter(options = {}) {
+    return paginate((p) => this.get("/v1/webhook_endpoints", p), {
+      pageSize: options.pageSize
+    });
+  }
+  /**
+   * List per-attempt delivery records for one endpoint.
+   *
+   * Useful when a tenant's receiver is failing. Surfaces the status
+   * code, response body excerpt, error, and next-attempt timestamp
+   * for each event × endpoint pair.
+   */
+  listDeliveries(endpointId, params = {}) {
+    return this.get(
+      `/v1/webhook_endpoints/${endpointId}/deliveries`,
+      params
+    );
+  }
+  /** Walk every page of `listDeliveries()` for one endpoint. */
+  iterDeliveries(endpointId, options = {}) {
+    return paginate(
+      (p) => this.get(`/v1/webhook_endpoints/${endpointId}/deliveries`, p),
+      { pageSize: options.pageSize }
+    );
+  }
+  /** Fetch one delivery row for inspection before deciding to redeliver. */
+  getDelivery(endpointId, deliveryId) {
+    return this.get(`/v1/webhook_endpoints/${endpointId}/deliveries/${deliveryId}`);
+  }
+  /**
+   * Re-enqueue a delivery row for the dispatcher.
+   *
+   * Idempotent: a row already in `delivered` returns unchanged. A
+   * `pending` / `failed` row flips to `pending` with
+   * `next_attempt_at = now()`; `attempt_count` is preserved.
+   */
+  redeliver(endpointId, deliveryId, params = {}) {
+    return this.postEmpty(
+      `/v1/webhook_endpoints/${endpointId}/deliveries/${deliveryId}/redeliver`,
+      params
+    );
+  }
+};
+var Events = class extends BaseResource {
+  retrieve(id) {
+    return this.get(`/v1/events/${id}`);
+  }
+  list(params = {}) {
+    return this.get("/v1/events", params);
+  }
+  /** Walk every page of `list()`. Pass `type` to filter at the server. */
+  iter(options = {}) {
+    return paginate((p) => this.get("/v1/events", p), {
+      pageSize: options.pageSize,
+      filters: { type: options.type }
+    });
+  }
+};
+var Tenant = class extends BaseResource {
+  /** Cached Mollie profile shape (enabled methods, country, currency). */
+  capabilities() {
+    return this.get("/v1/tenant/capabilities");
+  }
+  /** Current portal branding row (business name, theme, capability flags). */
+  portalBranding() {
+    return this.get("/v1/tenant/portal_branding");
+  }
+  /**
+   * Partial-update the portal branding row.
+   *
+   * Only fields you set are sent. Pass `undefined` to leave a field
+   * untouched; sending an empty string explicitly clears it.
+   */
+  setPortalBranding(params = {}) {
+    return this.post("/v1/tenant/portal_branding", params);
+  }
+  /**
+   * Rotate the encrypted provider credential for this tenant.
+   *
+   * The new `api_key` is encrypted server-side; nothing is logged.
+   * `mode` defaults to the calling key's mode; prefix-mismatch
+   * (`test_...` under live, `live_...` under test) is rejected at the
+   * API boundary.
+   */
+  rotateProviderCredential(params) {
+    return this.post(
+      "/v1/tenant/provider_credential",
+      params
+    );
+  }
+};
+var Coupons = class extends BaseResource {
+  create(params) {
+    return this.post("/v1/coupons", params);
+  }
+  retrieve(id) {
+    return this.get(`/v1/coupons/${id}`);
+  }
+  update(id, params) {
+    return this.post(`/v1/coupons/${id}`, params);
+  }
+  delete(id, params = {}) {
+    return this.del(`/v1/coupons/${id}`, params);
+  }
+  /**
+   * Server-side dry-run of a coupon redemption.
+   *
+   * Returns the discount math without atomically claiming the coupon,
+   * which is useful for "preview before checkout" UX.
+   */
+  validate(params) {
+    const body = { code: params.code };
+    if (params.price_id !== void 0) body["price_id"] = params.price_id;
+    if (params.amount_cents !== void 0) body["amount_cents"] = params.amount_cents;
+    return this.postFixed("/v1/coupons/validate", body);
+  }
+  list(params = {}) {
+    return this.get("/v1/coupons", params);
+  }
+  iter(options = {}) {
+    return paginate((p) => this.get("/v1/coupons", p), { pageSize: options.pageSize });
+  }
+};
+var TaxRates = class extends BaseResource {
+  create(params) {
+    return this.post("/v1/tax_rates", params);
+  }
+  retrieve(id) {
+    return this.get(`/v1/tax_rates/${id}`);
+  }
+  update(id, params) {
+    return this.post(`/v1/tax_rates/${id}`, params);
+  }
+  delete(id, params = {}) {
+    return this.del(`/v1/tax_rates/${id}`, params);
+  }
+  list(params = {}) {
+    return this.get("/v1/tax_rates", params);
+  }
+  iter(options = {}) {
+    return paginate((p) => this.get("/v1/tax_rates", p), { pageSize: options.pageSize });
+  }
+};
+var Invoices = class extends BaseResource {
+  retrieve(id) {
+    return this.get(`/v1/invoices/${id}`);
+  }
+  list(params = {}) {
+    return this.get("/v1/invoices", params);
+  }
+  iter(options = {}) {
+    return paginate((p) => this.get("/v1/invoices", p), { pageSize: options.pageSize });
+  }
+};
+var AuditLogs = class extends BaseResource {
+  retrieve(id) {
+    return this.get(`/v1/audit_logs/${id}`);
+  }
+  list(params = {}) {
+    return this.get("/v1/audit_logs", params);
+  }
+  iter(options = {}) {
+    return paginate((p) => this.get("/v1/audit_logs", p), {
+      pageSize: options.pageSize,
+      filters: {
+        action: options.action,
+        resource_type: options.resource_type,
+        actor_id: options.actor_id
+      }
+    });
+  }
+};
+var Payments = class extends BaseResource {
+  retrieve(id) {
+    return this.get(`/v1/payments/${id}`);
+  }
+  list(params = {}) {
+    return this.get("/v1/payments", params);
+  }
+  iter(options = {}) {
+    return paginate((p) => this.get("/v1/payments", p), { pageSize: options.pageSize });
+  }
+};
+var BillingPortalSessions = class extends BaseResource {
+  create(params) {
+    return this.postFixed(
+      "/v1/billing_portal/sessions",
+      {
+        subscription_id: params.subscription_id,
+        return_url: params.return_url
+      },
+      { idempotencyKey: params.idempotencyKey }
+    );
+  }
+  /** Kill an in-the-wild portal session. Idempotent. */
+  revoke(id, params = {}) {
+    return this.postEmpty(`/v1/billing_portal/sessions/${id}/revoke`, params);
+  }
+};
+
+// src/errors.ts
+var BillKitError = class extends Error {
+  name = "BillKitError";
+  type;
+  code;
+  param;
+  statusCode;
+  requestId;
+  rawBody;
+  constructor(message, options = {}) {
+    super(message);
+    this.type = options.type;
+    this.code = options.code;
+    this.param = options.param;
+    this.statusCode = options.statusCode;
+    this.requestId = options.requestId;
+    this.rawBody = options.rawBody;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var APIConnectionError = class extends BillKitError {
+  name = "APIConnectionError";
+};
+var APIError = class extends BillKitError {
+  name = "APIError";
+};
+var ServerError = class extends APIError {
+  name = "ServerError";
+};
+var AuthenticationError = class extends BillKitError {
+  name = "AuthenticationError";
+};
+var PermissionError = class extends BillKitError {
+  name = "PermissionError";
+};
+var ResourceMissingError = class extends BillKitError {
+  name = "ResourceMissingError";
+};
+var InvalidRequestError = class extends BillKitError {
+  name = "InvalidRequestError";
+};
+var ConflictError = class extends BillKitError {
+  name = "ConflictError";
+};
+var RateLimitError = class extends BillKitError {
+  name = "RateLimitError";
+  retryAfter;
+  constructor(message, options = {}) {
+    super(message, options);
+    this.retryAfter = options.retryAfter;
+  }
+};
+var TYPE_TO_CLASS = {
+  api_connection_error: APIConnectionError,
+  // ``api_error`` is the Stripe-convention type for 5xx, so surface it as
+  // ServerError (a subclass of APIError) so `catch (e instanceof
+  // ServerError)` works without false negatives.
+  api_error: ServerError,
+  authentication_error: AuthenticationError,
+  permission_error: PermissionError,
+  invalid_request_error: InvalidRequestError,
+  idempotency_error: ConflictError,
+  conflict: ConflictError,
+  rate_limit_error: RateLimitError
+};
+function fallbackType(status) {
+  if (status === 401) return "authentication_error";
+  if (status === 403) return "permission_error";
+  if (status === 404) return "invalid_request_error";
+  if (status === 409) return "conflict";
+  if (status === 429) return "rate_limit_error";
+  if (status >= 500) return "api_error";
+  return "invalid_request_error";
+}
+function fallbackClass(status) {
+  if (status === 401) return AuthenticationError;
+  if (status === 403) return PermissionError;
+  if (status === 404) return ResourceMissingError;
+  if (status === 409) return ConflictError;
+  if (status === 429) return RateLimitError;
+  if (status >= 500) return ServerError;
+  return InvalidRequestError;
+}
+function errorFromResponse(args) {
+  const { status, body, requestId, retryAfter } = args;
+  const envelope = typeof body === "object" && body !== null && "error" in body ? body.error ?? {} : {};
+  const type = envelope.type ?? fallbackType(status);
+  const message = envelope.message ?? `BillKit API returned HTTP ${status} with no error body.`;
+  let cls = TYPE_TO_CLASS[type] ?? fallbackClass(status);
+  if (status === 404 && cls === InvalidRequestError) cls = ResourceMissingError;
+  if (status === 409 && cls === InvalidRequestError) cls = ConflictError;
+  const options = {
+    type,
+    code: envelope.code,
+    param: envelope.param,
+    statusCode: status,
+    requestId,
+    rawBody: typeof body === "object" && body !== null ? body : void 0
+  };
+  if (cls === RateLimitError) {
+    options.retryAfter = retryAfter;
+  }
+  return new cls(message, options);
+}
+
+// src/logging.ts
+var NOOP_LOGGER = {
+  debug() {
+  },
+  warn() {
+  }
+};
+
+// src/retry.ts
+var DEFAULT_RETRY_POLICY = {
+  maxAttempts: 4,
+  initialBackoffMs: 500,
+  backoffMultiplier: 2,
+  maxBackoffMs: 8e3,
+  maxRetryAfterMs: 3e4,
+  jitter: 0.25
+};
+function backoffForMs(attempt, policy) {
+  const base = policy.initialBackoffMs * policy.backoffMultiplier ** (attempt - 2);
+  const capped = Math.min(base, policy.maxBackoffMs);
+  const jitterRange = capped * policy.jitter;
+  const jittered = capped + (Math.random() * 2 - 1) * jitterRange;
+  return Math.max(0, jittered);
+}
+function shouldRetry(status, attempt, policy, retryAfterMs) {
+  if (attempt >= policy.maxAttempts) return false;
+  if (status === null) return true;
+  if (status === 429) {
+    if (retryAfterMs === void 0 || retryAfterMs < 0) return false;
+    return policy.maxRetryAfterMs === void 0 || retryAfterMs <= policy.maxRetryAfterMs;
+  }
+  return status >= 500;
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/version.ts
+var VERSION = "0.1.0";
+
+// src/transport.ts
+var DEFAULT_BASE_URL = "https://api.billkit.eu";
+var DEFAULT_TIMEOUT_MS = 3e4;
+function userAgent() {
+  return `billkit-node/${VERSION}`;
+}
+function autoIdempotencyKey(method, supplied) {
+  if (method === "GET") return void 0;
+  if (supplied !== void 0) return supplied;
+  const uuid = globalThis.crypto?.randomUUID?.();
+  if (uuid === void 0) {
+    throw new Error(
+      "BillKit: crypto.randomUUID() is unavailable, so a safe Idempotency-Key cannot be generated. Use Node 20+, Bun, Deno, or Cloudflare Workers, or pass your own `idempotencyKey` on this call."
+    );
+  }
+  return `sdk-${uuid}`;
+}
+function logSafeUrl(baseUrl, path) {
+  const normalised = path.startsWith("/") ? path : `/${path}`;
+  return baseUrl.replace(/\/$/, "") + normalised;
+}
+function buildUrl(baseUrl, path, query) {
+  const normalised = path.startsWith("/") ? path : `/${path}`;
+  const url = new URL(baseUrl.replace(/\/$/, "") + normalised);
+  if (query) {
+    for (const [k, v] of Object.entries(query)) {
+      if (v !== null && v !== void 0) {
+        url.searchParams.set(k, String(v));
+      }
+    }
+  }
+  return url.toString();
+}
+function buildHeaders(apiKey, hasBody, idempotencyKey, extra) {
+  const headers = new Headers({
+    Authorization: `Bearer ${apiKey}`,
+    "User-Agent": userAgent(),
+    Accept: "application/json"
+  });
+  if (hasBody) headers.set("Content-Type", "application/json");
+  if (idempotencyKey) headers.set("Idempotency-Key", idempotencyKey);
+  if (extra) {
+    for (const [k, v] of Object.entries(extra)) {
+      headers.set(k, v);
+    }
+  }
+  return headers;
+}
+async function parseJson(response) {
+  const text = await response.text();
+  if (!text) return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+}
+function parseRetryAfterMs(header) {
+  if (!header) return void 0;
+  const n = Number.parseFloat(header);
+  if (Number.isFinite(n) && n >= 0) return n * 1e3;
+  const retryAt = Date.parse(header);
+  if (Number.isNaN(retryAt)) return void 0;
+  return Math.max(0, retryAt - Date.now());
+}
+function retryDelayMs(status, attempt, policy, retryAfterMs) {
+  if (status === 429 && retryAfterMs !== void 0) return retryAfterMs;
+  return backoffForMs(attempt + 1, policy);
+}
+function connectionError(err, timeoutMs) {
+  const e = err;
+  if (e?.name === "TimeoutError" || e?.name === "AbortError") {
+    return new APIConnectionError(`BillKit request timed out after ${timeoutMs}ms.`);
+  }
+  return new APIConnectionError(e?.message ?? "Network request failed.");
+}
+var Transport = class {
+  apiKey;
+  baseUrl;
+  timeoutMs;
+  retryPolicy;
+  fetchFn;
+  logger;
+  constructor(config) {
+    if (!config.apiKey) {
+      throw new Error("BillKit: an API key is required (config.apiKey or BILLKIT_API_KEY env).");
+    }
+    this.apiKey = config.apiKey;
+    this.baseUrl = config.baseUrl ?? DEFAULT_BASE_URL;
+    this.timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    this.retryPolicy = config.retryPolicy ?? DEFAULT_RETRY_POLICY;
+    this.logger = config.logger ?? NOOP_LOGGER;
+    const fetchFn = config.fetch ?? globalThis.fetch;
+    if (!fetchFn) {
+      throw new Error(
+        "BillKit: no global fetch implementation found. Use Node 20+, Bun, Deno, Cloudflare Workers, or pass { fetch } in the client options."
+      );
+    }
+    this.fetchFn = fetchFn.bind(globalThis);
+  }
+  async request(options) {
+    const idempotencyKey = autoIdempotencyKey(options.method, options.idempotencyKey);
+    const url = buildUrl(this.baseUrl, options.path, options.query);
+    const headers = buildHeaders(
+      this.apiKey,
+      options.body !== void 0,
+      idempotencyKey,
+      options.extraHeaders
+    );
+    const body = options.body !== void 0 ? JSON.stringify(options.body) : void 0;
+    const loggedUrl = logSafeUrl(this.baseUrl, options.path);
+    let lastError = null;
+    for (let attempt = 1; attempt <= this.retryPolicy.maxAttempts; attempt++) {
+      this.logger.debug("BillKit request", {
+        method: options.method,
+        url: loggedUrl,
+        attempt,
+        maxAttempts: this.retryPolicy.maxAttempts
+      });
+      const startedAt = Date.now();
+      let response;
+      let parsedBody;
+      try {
+        const init = {
+          method: options.method,
+          headers,
+          signal: AbortSignal.timeout(this.timeoutMs)
+        };
+        if (body !== void 0) init.body = body;
+        response = await this.fetchFn(url, init);
+        parsedBody = await parseJson(response);
+      } catch (err) {
+        lastError = connectionError(err, this.timeoutMs);
+        if (!shouldRetry(null, attempt, this.retryPolicy)) throw lastError;
+        const delayMs2 = retryDelayMs(null, attempt, this.retryPolicy);
+        this.logger.warn("BillKit retrying", {
+          method: options.method,
+          url: loggedUrl,
+          reason: err?.name ?? "network error",
+          attempt,
+          delayMs: delayMs2
+        });
+        await sleep(delayMs2);
+        continue;
+      }
+      const requestId = response.headers.get("x-request-id") ?? response.headers.get("request-id") ?? void 0;
+      this.logger.debug("BillKit response", {
+        method: options.method,
+        url: loggedUrl,
+        status: response.status,
+        durationMs: Date.now() - startedAt,
+        requestId: requestId ?? null
+      });
+      if (response.ok) {
+        return parsedBody ?? void 0;
+      }
+      const retryAfterMs = parseRetryAfterMs(response.headers.get("retry-after"));
+      const error = errorFromResponse({
+        status: response.status,
+        body: parsedBody,
+        requestId,
+        retryAfter: retryAfterMs === void 0 ? void 0 : retryAfterMs / 1e3
+      });
+      if (!shouldRetry(response.status, attempt, this.retryPolicy, retryAfterMs)) {
+        throw error;
+      }
+      lastError = error;
+      const delayMs = retryDelayMs(response.status, attempt, this.retryPolicy, retryAfterMs);
+      this.logger.warn("BillKit retrying", {
+        method: options.method,
+        url: loggedUrl,
+        reason: `HTTP ${response.status}`,
+        attempt,
+        delayMs
+      });
+      await sleep(delayMs);
+    }
+    if (lastError) throw lastError;
+    throw new APIConnectionError("Retry budget exhausted with no recorded error.");
+  }
+};
+
+// src/client.ts
+function resolveApiKey(supplied) {
+  if (supplied) return supplied;
+  const env = globalThis.process?.env?.["BILLKIT_API_KEY"];
+  if (env) return env;
+  throw new Error(
+    "BillKit: missing API key. Pass { apiKey } or set BILLKIT_API_KEY in the environment."
+  );
+}
+var BillKit = class {
+  customers;
+  products;
+  prices;
+  checkoutSessions;
+  oneShotPayments;
+  subscriptions;
+  refunds;
+  disputes;
+  webhookEndpoints;
+  events;
+  tenant;
+  coupons;
+  taxRates;
+  invoices;
+  auditLogs;
+  payments;
+  billingPortalSessions;
+  constructor(options = {}) {
+    const transport = new Transport({
+      ...options,
+      apiKey: resolveApiKey(options.apiKey)
+    });
+    this.customers = new Customers(transport);
+    this.products = new Products(transport);
+    this.prices = new Prices(transport);
+    this.checkoutSessions = new CheckoutSessions(transport);
+    this.oneShotPayments = new OneShotPayments(transport);
+    this.subscriptions = new Subscriptions(transport);
+    this.refunds = new Refunds(transport);
+    this.disputes = new Disputes(transport);
+    this.webhookEndpoints = new WebhookEndpoints(transport);
+    this.events = new Events(transport);
+    this.tenant = new Tenant(transport);
+    this.coupons = new Coupons(transport);
+    this.taxRates = new TaxRates(transport);
+    this.invoices = new Invoices(transport);
+    this.auditLogs = new AuditLogs(transport);
+    this.payments = new Payments(transport);
+    this.billingPortalSessions = new BillingPortalSessions(transport);
+  }
+};
+
+// src/webhooks.ts
+var DEFAULT_WEBHOOK_TOLERANCE_SECONDS = 300;
+var WebhookVerificationError = class extends Error {
+  name = "WebhookVerificationError";
+  constructor(message) {
+    super(message);
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var textEncoder = new TextEncoder();
+var V1_HEX_RE = /^[0-9a-fA-F]{64}$/;
+function toBytes(payload) {
+  return typeof payload === "string" ? textEncoder.encode(payload) : payload;
+}
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) {
+    diff |= (a[i] ?? 0) ^ (b[i] ?? 0);
+  }
+  return diff === 0;
+}
+function hexToBytes(hex) {
+  if (!V1_HEX_RE.test(hex)) return null;
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    const byte = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    if (Number.isNaN(byte)) return null;
+    out[i] = byte;
+  }
+  return out;
+}
+function parseSignatureHeader(header) {
+  let tsRaw;
+  const v1List = [];
+  for (const chunk of header.split(",")) {
+    const idx = chunk.indexOf("=");
+    if (idx < 0) continue;
+    const key = chunk.slice(0, idx).trim();
+    const value = chunk.slice(idx + 1).trim();
+    if (key === "t") tsRaw = value;
+    else if (key === "v1") v1List.push(value);
+  }
+  if (!tsRaw || v1List.length === 0) {
+    throw new WebhookVerificationError(`Malformed BillKit-Signature header: ${header}`);
+  }
+  const ts = Number.parseInt(tsRaw, 10);
+  if (Number.isNaN(ts) || ts <= 0) {
+    throw new WebhookVerificationError(`Malformed timestamp in BillKit-Signature: ${tsRaw}`);
+  }
+  return { ts, v1List };
+}
+function toArrayBuffer(view) {
+  const out = new ArrayBuffer(view.byteLength);
+  new Uint8Array(out).set(view);
+  return out;
+}
+async function computeHmac(secret, signed) {
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle) {
+    throw new WebhookVerificationError(
+      "No SubtleCrypto available. The BillKit SDK requires Node 20+, Bun, Deno, Cloudflare Workers, or any runtime that exposes globalThis.crypto.subtle."
+    );
+  }
+  const key = await subtle.importKey(
+    "raw",
+    toArrayBuffer(textEncoder.encode(secret)),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = await subtle.sign("HMAC", key, toArrayBuffer(signed));
+  return new Uint8Array(signature);
+}
+async function verifyWebhookSignature(options) {
+  const {
+    payload,
+    signatureHeader,
+    secret,
+    toleranceSeconds = DEFAULT_WEBHOOK_TOLERANCE_SECONDS,
+    nowMs = Date.now()
+  } = options;
+  if (signatureHeader === null || signatureHeader === void 0) {
+    throw new WebhookVerificationError("Missing BillKit-Signature header.");
+  }
+  const { ts, v1List } = parseSignatureHeader(signatureHeader);
+  if (Math.abs(nowMs / 1e3 - ts) > toleranceSeconds) {
+    throw new WebhookVerificationError(
+      `Signature timestamp outside \xB1${toleranceSeconds}s tolerance.`
+    );
+  }
+  const payloadBytes = toBytes(payload);
+  const signed = new Uint8Array(payloadBytes.length + textEncoder.encode(`${ts}.`).length);
+  const prefix = textEncoder.encode(`${ts}.`);
+  signed.set(prefix, 0);
+  signed.set(payloadBytes, prefix.length);
+  const expected = await computeHmac(secret, signed);
+  let sawValidHex = false;
+  let matched = false;
+  for (const v1 of v1List) {
+    const received = hexToBytes(v1);
+    if (!received) continue;
+    sawValidHex = true;
+    if (constantTimeEqual(expected, received)) matched = true;
+  }
+  if (!sawValidHex) {
+    throw new WebhookVerificationError(
+      `Malformed v1 hex in BillKit-Signature: ${v1List.join(",")}`
+    );
+  }
+  if (!matched) {
+    throw new WebhookVerificationError("Signature mismatch.");
+  }
+  const decoder = new TextDecoder("utf-8", { fatal: false });
+  const text = decoder.decode(payloadBytes);
+  try {
+    return JSON.parse(text);
+  } catch (err) {
+    throw new WebhookVerificationError(
+      `Webhook body is not valid JSON: ${err.message}`
+    );
+  }
+}
+
+exports.APIConnectionError = APIConnectionError;
+exports.APIError = APIError;
+exports.AuthenticationError = AuthenticationError;
+exports.BillKit = BillKit;
+exports.BillKitError = BillKitError;
+exports.ConflictError = ConflictError;
+exports.DEFAULT_RETRY_POLICY = DEFAULT_RETRY_POLICY;
+exports.DEFAULT_WEBHOOK_TOLERANCE_SECONDS = DEFAULT_WEBHOOK_TOLERANCE_SECONDS;
+exports.InvalidRequestError = InvalidRequestError;
+exports.NOOP_LOGGER = NOOP_LOGGER;
+exports.PermissionError = PermissionError;
+exports.RateLimitError = RateLimitError;
+exports.ResourceMissingError = ResourceMissingError;
+exports.ServerError = ServerError;
+exports.VERSION = VERSION;
+exports.WebhookVerificationError = WebhookVerificationError;
+exports.paginate = paginate;
+exports.verifyWebhookSignature = verifyWebhookSignature;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map