@fonderie/client 0.1.0 → 0.2.0

package/dist/index.js

@@ -24,6 +24,7 @@ var HttpClient = class {
     };
     if (opts.token) headers["Authorization"] = `Bearer ${opts.token}`;
     if (opts.cookie) headers["Cookie"] = opts.cookie;
+    if (opts.workspaceId) headers["X-Workspace-ID"] = opts.workspaceId;
     const fetchInit = {
       method: opts.method,
       headers,
@@ -31,6 +32,10 @@ var HttpClient = class {
     };
     if (opts.body !== void 0) fetchInit.body = JSON.stringify(opts.body);
     const res = await fetch(`${this.baseUrl}${opts.path}`, fetchInit);
+    if (res.status === 204) {
+      if (!res.ok) throw new FonderieApiError("unknown", res.statusText, res.status);
+      return void 0;
+    }
     const data = await res.json();
     if (!res.ok || res.status === 202) {
       const err = data;
@@ -40,27 +45,42 @@ var HttpClient = class {
   }
 };
 
-// src/modules/auth.ts
-var PhoneClient = class {
-  constructor(http) {
+// src/modules/audit.ts
+var AuditClient = class {
+  constructor(http, tokens) {
     this.http = http;
+    this.tokens = tokens;
   }
   http;
-  sendVerification(phone) {
-    return this.http.request({
-      method: "POST",
-      path: "/auth/phone/send-verification",
-      body: { phone }
-    });
+  tokens;
+  workspaceId;
+  setAccessToken(token) {
+    this.tokens.set(token);
   }
-  verify(phone, otp) {
+  // Scopes the audit query to a workspace (X-Workspace-ID). Falls back to
+  // the caller's personal workspace when unset, same as billing/workspaces.
+  setWorkspaceId(workspaceId) {
+    this.workspaceId = workspaceId;
+  }
+  listEvents(input = {}) {
+    const params = new URLSearchParams();
+    if (input.limit !== void 0) params.set("limit", String(input.limit));
+    if (input.type) params.set("type", input.type);
+    if (input.actorId) params.set("actorId", input.actorId);
+    if (input.from) params.set("from", input.from.toISOString());
+    if (input.to) params.set("to", input.to.toISOString());
+    if (input.cursor) params.set("cursor", input.cursor);
+    const qs = params.toString();
     return this.http.request({
-      method: "POST",
-      path: "/auth/phone/verify",
-      body: { phone, otp }
+      method: "GET",
+      path: `/audit${qs ? `?${qs}` : ""}`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
     });
   }
 };
+
+// src/modules/auth.ts
 var MfaClient = class {
   constructor(http, token) {
     this.http = http;
@@ -75,36 +95,43 @@ var MfaClient = class {
       token: this.token()
     });
   }
-  verify(code) {
+  verify(token) {
     return this.http.request({
       method: "POST",
       path: "/auth/mfa/verify",
-      body: { token: code },
+      body: { token },
       token: this.token()
     });
   }
-  disable(code) {
+  disable(token) {
     return this.http.request({
       method: "POST",
       path: "/auth/mfa/disable",
-      body: { code },
+      body: { token },
+      token: this.token()
+    });
+  }
+  // POST /auth/mfa/backup-codes (mfaTokenSchema { token }) — returns a fresh set.
+  regenerateBackupCodes(token) {
+    return this.http.request({
+      method: "POST",
+      path: "/auth/mfa/backup-codes",
+      body: { token },
       token: this.token()
     });
   }
 };
 var AuthClient = class {
-  constructor(http, accessToken) {
+  constructor(http, tokens) {
     this.http = http;
-    this.accessToken = accessToken;
-    this.phone = new PhoneClient(http);
-    this.mfa = new MfaClient(http, () => this.accessToken);
+    this.tokens = tokens;
+    this.mfa = new MfaClient(http, () => this.tokens.get());
   }
   http;
-  accessToken;
-  phone;
+  tokens;
   mfa;
   setAccessToken(token) {
-    this.accessToken = token;
+    this.tokens.set(token);
   }
   // ── Public ─────────────────────────────────────────────────────────────────
   register(input) {
@@ -142,11 +169,12 @@ var AuthClient = class {
       body: input
     });
   }
-  verifyEmail(pin) {
+  verifyEmail(token) {
     return this.http.request({
       method: "POST",
-      path: "/auth/email/verify",
-      body: { pin }
+      path: "/auth/verify",
+      body: { token },
+      token: this.tokens.get()
     });
   }
   // ── Protected ──────────────────────────────────────────────────────────────
@@ -155,14 +183,14 @@ var AuthClient = class {
       method: "POST",
       path: "/auth/logout",
       body: refreshToken ? { refreshToken } : void 0,
-      token: this.accessToken
+      token: this.tokens.get()
     });
   }
   sendVerificationEmail() {
     return this.http.request({
-      method: "POST",
-      path: "/auth/email/send-verification",
-      token: this.accessToken
+      method: "GET",
+      path: "/auth/send-verification",
+      token: this.tokens.get()
     });
   }
   // ── Protected + Verified ───────────────────────────────────────────────────
@@ -170,38 +198,1026 @@ var AuthClient = class {
     return this.http.request({
       method: "GET",
       path: "/users",
-      token: this.accessToken
+      token: this.tokens.get()
+    });
+  }
+  updateProfile(input) {
+    return this.http.request({
+      method: "PUT",
+      path: "/users/profile",
+      body: input,
+      token: this.tokens.get()
+    });
+  }
+  updatePreferences(input) {
+    return this.http.request({
+      method: "PUT",
+      path: "/users/preferences",
+      body: input,
+      token: this.tokens.get()
+    });
+  }
+  updateEmail(email) {
+    return this.http.request({
+      method: "PUT",
+      path: "/users/email",
+      body: { email },
+      token: this.tokens.get()
+    });
+  }
+  updatePhone(phone) {
+    return this.http.request({
+      method: "PUT",
+      path: "/users/phone",
+      body: { phone },
+      token: this.tokens.get()
     });
   }
-  updateUser(input) {
+  changePassword(input) {
     return this.http.request({
       method: "PUT",
-      path: "/users/update",
+      path: "/users/password",
       body: input,
-      token: this.accessToken
+      token: this.tokens.get()
+    });
+  }
+  // GET /users/export — the caller's own data as a portable bundle (SAR).
+  exportData() {
+    return this.http.request({
+      method: "GET",
+      path: "/users/export",
+      token: this.tokens.get()
     });
   }
   deleteUser() {
     return this.http.request({
       method: "DELETE",
       path: "/users",
-      token: this.accessToken
+      token: this.tokens.get()
+    });
+  }
+};
+
+// src/modules/billing.ts
+var BillingClient = class {
+  constructor(http, tokens) {
+    this.http = http;
+    this.tokens = tokens;
+  }
+  http;
+  tokens;
+  workspaceId;
+  setAccessToken(token) {
+    this.tokens.set(token);
+  }
+  // Subscriber is resolved from this workspace ID (X-Workspace-ID) when set,
+  // falling back to the session user otherwise — see @fonderie/billing's
+  // resolveSubscriber. Call with undefined to bill the signed-in user directly.
+  setWorkspaceId(workspaceId) {
+    this.workspaceId = workspaceId;
+  }
+  // ── Plans — public read-only ────────────────────────────────────────────────
+  listPlans() {
+    return this.http.request({
+      method: "GET",
+      path: "/plans"
+    });
+  }
+  getPlan(planId) {
+    return this.http.request({
+      method: "GET",
+      path: `/plans/${planId}`
+    });
+  }
+  // ── Plans — admin write ──────────────────────────────────────────────────────
+  // Unlike every other write in this client, @fonderie/billing does not gate
+  // these with requireAuth or an admin token — "the caller is responsible for
+  // authorization" (its own routes.ts comment). Sending the session token is
+  // harmless (the server ignores it) but does nothing on its own; gate access
+  // to these calls yourself (an app-level route guard, a reverse-proxy admin
+  // zone, or similar) before wiring them into a UI.
+  createPlan(input) {
+    return this.http.request({
+      method: "POST",
+      path: "/plans",
+      body: input,
+      token: this.tokens.get()
+    });
+  }
+  updatePlan(planId, input) {
+    return this.http.request({
+      method: "PUT",
+      path: `/plans/${planId}`,
+      body: input,
+      token: this.tokens.get()
+    });
+  }
+  deletePlan(planId) {
+    return this.http.request({
+      method: "DELETE",
+      path: `/plans/${planId}`,
+      token: this.tokens.get()
+    });
+  }
+  // ── Subscription ─────────────────────────────────────────────────────────────
+  getSubscription() {
+    return this.http.request({
+      method: "GET",
+      path: "/billing/subscription",
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  // ── Checkout / portal ────────────────────────────────────────────────────────
+  createCheckoutSession(input) {
+    return this.http.request({
+      method: "POST",
+      path: "/billing/checkout",
+      body: input,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  createPortalSession() {
+    return this.http.request({
+      method: "POST",
+      path: "/billing/portal",
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  // ── Usage ────────────────────────────────────────────────────────────────────
+  recordUsage(input) {
+    return this.http.request({
+      method: "POST",
+      path: "/billing/usage",
+      body: input,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  getUsage(metric) {
+    return this.http.request({
+      method: "GET",
+      path: `/billing/usage/${metric}`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+};
+
+// src/modules/customers.ts
+var CustomersClient = class {
+  constructor(http, tokens) {
+    this.http = http;
+    this.tokens = tokens;
+  }
+  http;
+  tokens;
+  workspaceId;
+  setAccessToken(token) {
+    this.tokens.set(token);
+  }
+  // Scopes every request to this workspace (X-Workspace-ID). Falls back to
+  // the caller's personal workspace when unset, same as billing/workspaces/audit/webhooks.
+  setWorkspaceId(workspaceId) {
+    this.workspaceId = workspaceId;
+  }
+  // ── Core customer CRUD ───────────────────────────────────────────────────────
+  listCustomers(input = {}) {
+    const params = new URLSearchParams();
+    if (input.search !== void 0) params.set("search", input.search);
+    if (input.blacklisted !== void 0) params.set("blacklisted", String(input.blacklisted));
+    if (input.limit !== void 0) params.set("limit", String(input.limit));
+    if (input.offset !== void 0) params.set("offset", String(input.offset));
+    const qs = params.toString();
+    return this.http.request({
+      method: "GET",
+      path: qs ? `/customers?${qs}` : "/customers",
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  createCustomer(input = {}) {
+    return this.http.request({
+      method: "POST",
+      path: "/customers",
+      body: input,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  // depth defaults to 2 server-side; pass { depth: 1 } for one level of
+  // relationship expansion instead of the D2 (nested-relationships) shape.
+  getCustomer(customerId, input = {}) {
+    const qs = input.depth === 1 ? "?depth=1" : "";
+    return this.http.request({
+      method: "GET",
+      path: `/customers/${customerId}${qs}`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  updateCustomer(customerId, input) {
+    return this.http.request({
+      method: "PUT",
+      path: `/customers/${customerId}`,
+      body: input,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  deleteCustomer(customerId) {
+    return this.http.request({
+      method: "DELETE",
+      path: `/customers/${customerId}`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  blacklistCustomer(customerId, input = {}) {
+    return this.http.request({
+      method: "POST",
+      path: `/customers/${customerId}/blacklist`,
+      body: input,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  unblacklistCustomer(customerId) {
+    return this.http.request({
+      method: "POST",
+      path: `/customers/${customerId}/unblacklist`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  // ── Emails ───────────────────────────────────────────────────────────────────
+  listEmails(customerId) {
+    return this.http.request({
+      method: "GET",
+      path: `/customers/${customerId}/emails`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  addEmail(customerId, input) {
+    return this.http.request({
+      method: "POST",
+      path: `/customers/${customerId}/emails`,
+      body: input,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  // Only the label is editable — email addresses themselves are immutable
+  // once added; remove and re-add to change the address.
+  updateEmailLabel(customerId, emailId, label) {
+    return this.http.request({
+      method: "PATCH",
+      path: `/customers/${customerId}/emails/${emailId}`,
+      body: { label },
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  setPrimaryEmail(customerId, emailId) {
+    return this.http.request({
+      method: "PUT",
+      path: `/customers/${customerId}/emails/${emailId}/primary`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  removeEmail(customerId, emailId) {
+    return this.http.request({
+      method: "DELETE",
+      path: `/customers/${customerId}/emails/${emailId}`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  // ── Phones ───────────────────────────────────────────────────────────────────
+  listPhones(customerId) {
+    return this.http.request({
+      method: "GET",
+      path: `/customers/${customerId}/phones`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  addPhone(customerId, input) {
+    return this.http.request({
+      method: "POST",
+      path: `/customers/${customerId}/phones`,
+      body: input,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  // Only the label is editable — same as updateEmailLabel.
+  updatePhoneLabel(customerId, phoneId, label) {
+    return this.http.request({
+      method: "PATCH",
+      path: `/customers/${customerId}/phones/${phoneId}`,
+      body: { label },
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  setPrimaryPhone(customerId, phoneId) {
+    return this.http.request({
+      method: "PUT",
+      path: `/customers/${customerId}/phones/${phoneId}/primary`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  removePhone(customerId, phoneId) {
+    return this.http.request({
+      method: "DELETE",
+      path: `/customers/${customerId}/phones/${phoneId}`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  // ── Addresses ────────────────────────────────────────────────────────────────
+  listAddresses(customerId) {
+    return this.http.request({
+      method: "GET",
+      path: `/customers/${customerId}/addresses`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  addAddress(customerId, input) {
+    return this.http.request({
+      method: "POST",
+      path: `/customers/${customerId}/addresses`,
+      body: input,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  // Only the label is editable — same as updateEmailLabel.
+  updateAddressLabel(customerId, addrId, label) {
+    return this.http.request({
+      method: "PATCH",
+      path: `/customers/${customerId}/addresses/${addrId}`,
+      body: { label },
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  setPrimaryAddress(customerId, addrId) {
+    return this.http.request({
+      method: "PUT",
+      path: `/customers/${customerId}/addresses/${addrId}/primary`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  removeAddress(customerId, addrId) {
+    return this.http.request({
+      method: "DELETE",
+      path: `/customers/${customerId}/addresses/${addrId}`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  // ── Notes ────────────────────────────────────────────────────────────────────
+  listNotes(customerId) {
+    return this.http.request({
+      method: "GET",
+      path: `/customers/${customerId}/notes`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  createNote(customerId, body) {
+    return this.http.request({
+      method: "POST",
+      path: `/customers/${customerId}/notes`,
+      body: { body },
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  updateNote(customerId, noteId, body) {
+    return this.http.request({
+      method: "PUT",
+      path: `/customers/${customerId}/notes/${noteId}`,
+      body: { body },
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  deleteNote(customerId, noteId) {
+    return this.http.request({
+      method: "DELETE",
+      path: `/customers/${customerId}/notes/${noteId}`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  // ── Tags ─────────────────────────────────────────────────────────────────────
+  listTags(customerId) {
+    return this.http.request({
+      method: "GET",
+      path: `/customers/${customerId}/tags`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  addTag(customerId, tag) {
+    return this.http.request({
+      method: "POST",
+      path: `/customers/${customerId}/tags`,
+      body: { tag },
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  removeTag(customerId, tag) {
+    return this.http.request({
+      method: "DELETE",
+      path: `/customers/${customerId}/tags/${encodeURIComponent(tag)}`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  // ── Relationships ────────────────────────────────────────────────────────────
+  listRelationships(customerId) {
+    return this.http.request({
+      method: "GET",
+      path: `/customers/${customerId}/relationships`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  addRelationship(customerId, input) {
+    return this.http.request({
+      method: "POST",
+      path: `/customers/${customerId}/relationships`,
+      body: input,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  setPrimaryRelationship(customerId, relatedId) {
+    return this.http.request({
+      method: "PUT",
+      path: `/customers/${customerId}/relationships/${relatedId}/primary`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  removeRelationship(customerId, relatedId) {
+    return this.http.request({
+      method: "DELETE",
+      path: `/customers/${customerId}/relationships/${relatedId}`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  // ── Labels ───────────────────────────────────────────────────────────────────
+  // Shared vocabulary across all customers in the workspace — labels are
+  // looked up/created implicitly by addEmail/addPhone/addAddress's `label`
+  // string; these two methods are for managing the vocabulary directly
+  // (e.g. an admin screen listing/pruning unused labels).
+  listLabels(type) {
+    return this.http.request({
+      method: "GET",
+      path: `/customers/labels?type=${type}`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  removeLabel(labelId) {
+    return this.http.request({
+      method: "DELETE",
+      path: `/customers/labels/${labelId}`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
     });
   }
 };
 
+// src/modules/webhooks.ts
+var WebhooksClient = class {
+  constructor(http, tokens) {
+    this.http = http;
+    this.tokens = tokens;
+  }
+  http;
+  tokens;
+  workspaceId;
+  setAccessToken(token) {
+    this.tokens.set(token);
+  }
+  // Scopes every request to this workspace (X-Workspace-ID). Falls back to
+  // the caller's personal workspace when unset, same as billing/workspaces/audit.
+  setWorkspaceId(workspaceId) {
+    this.workspaceId = workspaceId;
+  }
+  listEndpoints() {
+    return this.http.request({
+      method: "GET",
+      path: "/webhooks",
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  // The response includes `secret` — shown once, at creation. There is no
+  // way to retrieve it again afterward; store it or let the caller copy it.
+  createEndpoint(input) {
+    return this.http.request({
+      method: "POST",
+      path: "/webhooks",
+      body: input,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  getEndpoint(endpointId) {
+    return this.http.request({
+      method: "GET",
+      path: `/webhooks/${endpointId}`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  updateEndpoint(endpointId, input) {
+    return this.http.request({
+      method: "PATCH",
+      path: `/webhooks/${endpointId}`,
+      body: input,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  deleteEndpoint(endpointId) {
+    return this.http.request({
+      method: "DELETE",
+      path: `/webhooks/${endpointId}`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  listDeliveries(endpointId) {
+    return this.http.request({
+      method: "GET",
+      path: `/webhooks/${endpointId}/deliveries`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  testEndpoint(endpointId) {
+    return this.http.request({
+      method: "POST",
+      path: `/webhooks/${endpointId}/test`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+};
+
+// src/modules/workspaces.ts
+var WorkspacesClient = class {
+  constructor(http, tokens) {
+    this.http = http;
+    this.tokens = tokens;
+  }
+  http;
+  tokens;
+  workspaceId;
+  setAccessToken(token) {
+    this.tokens.set(token);
+  }
+  // Scopes every subsequent request to this workspace (X-Workspace-ID).
+  // Falls back to the caller's personal workspace when unset.
+  setWorkspaceId(workspaceId) {
+    this.workspaceId = workspaceId;
+  }
+  // ── Workspace creation + listing ─────────────────────────────────────────────
+  listWorkspaces() {
+    return this.http.request({
+      method: "GET",
+      path: "/workspaces",
+      token: this.tokens.get()
+    });
+  }
+  createWorkspace(input) {
+    return this.http.request({
+      method: "POST",
+      path: "/workspaces",
+      body: input,
+      token: this.tokens.get()
+    });
+  }
+  getWorkspace(id) {
+    return this.http.request({
+      method: "GET",
+      path: `/workspaces/${id}`,
+      token: this.tokens.get()
+    });
+  }
+  updateWorkspace(input) {
+    return this.http.request({
+      method: "PUT",
+      path: "/workspaces",
+      body: input,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  // Personal workspaces can't be archived — the server returns 403 if you try.
+  archiveWorkspace() {
+    return this.http.request({
+      method: "POST",
+      path: "/workspaces/archive",
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  restoreWorkspace() {
+    return this.http.request({
+      method: "POST",
+      path: "/workspaces/restore",
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  // ── Roles ────────────────────────────────────────────────────────────────────
+  listRoles() {
+    return this.http.request({
+      method: "GET",
+      path: "/workspaces/roles",
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  createRole(input) {
+    return this.http.request({
+      method: "POST",
+      path: "/workspaces/roles",
+      body: input,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  getRole(roleId) {
+    return this.http.request({
+      method: "GET",
+      path: `/workspaces/roles/${roleId}`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  updateRole(roleId, input) {
+    return this.http.request({
+      method: "PUT",
+      path: `/workspaces/roles/${roleId}`,
+      body: input,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  removeRole(roleId) {
+    return this.http.request({
+      method: "DELETE",
+      path: `/workspaces/roles/${roleId}`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  getRolePermissions(roleId) {
+    return this.http.request({
+      method: "GET",
+      path: `/workspaces/roles/${roleId}/permissions`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  setRolePermissions(roleId, permissions) {
+    return this.http.request({
+      method: "POST",
+      path: `/workspaces/roles/${roleId}/permissions`,
+      body: { permissions },
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  // ── Members ──────────────────────────────────────────────────────────────────
+  listMembers() {
+    return this.http.request({
+      method: "GET",
+      path: "/workspaces/members",
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  removeMember(userId) {
+    return this.http.request({
+      method: "DELETE",
+      path: `/workspaces/members/${userId}`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  getMemberRoles(userId) {
+    return this.http.request({
+      method: "GET",
+      path: `/workspaces/members/${userId}/roles`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  addMemberRole(userId, roleId) {
+    return this.http.request({
+      method: "POST",
+      path: `/workspaces/members/${userId}/roles`,
+      body: { roleId },
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  removeMemberRole(userId, roleId) {
+    return this.http.request({
+      method: "DELETE",
+      path: `/workspaces/members/${userId}/roles/${roleId}`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  // ── Invitations ──────────────────────────────────────────────────────────────
+  listInvitations() {
+    return this.http.request({
+      method: "GET",
+      path: "/workspaces/invitations",
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  invite(entries) {
+    return this.http.request({
+      method: "POST",
+      path: "/workspaces/invitations",
+      body: entries,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  cancelInvitation(inviteId) {
+    return this.http.request({
+      method: "DELETE",
+      path: `/workspaces/invitations/${inviteId}`,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  acceptInvitation(pin) {
+    return this.http.request({
+      method: "POST",
+      path: "/workspaces/invitations/accept",
+      body: { pin },
+      token: this.tokens.get()
+    });
+  }
+  // ── Settings ─────────────────────────────────────────────────────────────────
+  getSettings() {
+    return this.http.request({
+      method: "GET",
+      path: "/workspaces/settings",
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+  updateSettings(input) {
+    return this.http.request({
+      method: "PUT",
+      path: "/workspaces/settings",
+      body: input,
+      token: this.tokens.get(),
+      workspaceId: this.workspaceId
+    });
+  }
+};
+
+// src/token-store.ts
+var TokenStore = class {
+  token;
+  constructor(initial) {
+    this.token = initial;
+  }
+  get() {
+    return this.token;
+  }
+  set(token) {
+    this.token = token;
+  }
+};
+
 // src/client.ts
 var FonderieClient = class {
   auth;
+  billing;
+  workspaces;
+  audit;
+  webhooks;
+  customers;
+  http;
+  constructor(opts) {
+    this.http = new HttpClient(opts.baseUrl);
+    const tokens = new TokenStore(opts.accessToken);
+    this.auth = new AuthClient(this.http, tokens);
+    this.billing = new BillingClient(this.http, tokens);
+    this.workspaces = new WorkspacesClient(this.http, tokens);
+    this.audit = new AuditClient(this.http, tokens);
+    this.webhooks = new WebhooksClient(this.http, tokens);
+    this.customers = new CustomersClient(this.http, tokens);
+  }
+};
+
+// src/modules/config-admin.ts
+function envQuery(environment) {
+  return environment ? `?environment=${encodeURIComponent(environment)}` : "";
+}
+var ConfigAdminClient = class {
+  http;
+  adminToken;
+  constructor(opts) {
+    this.http = new HttpClient(opts.baseUrl);
+    this.adminToken = opts.adminToken;
+  }
+  // ── Config ───────────────────────────────────────────────────────────────
+  listConfig(environment) {
+    return this.http.request({
+      method: "GET",
+      path: `/admin/config${envQuery(environment)}`,
+      token: this.adminToken
+    });
+  }
+  getConfig(key, environment) {
+    return this.http.request({
+      method: "GET",
+      path: `/admin/config/${key}${envQuery(environment)}`,
+      token: this.adminToken
+    });
+  }
+  setConfig(key, input, environment) {
+    return this.http.request({
+      method: "PUT",
+      path: `/admin/config/${key}${envQuery(environment)}`,
+      body: input,
+      token: this.adminToken
+    });
+  }
+  deleteConfig(key, environment) {
+    return this.http.request({
+      method: "DELETE",
+      path: `/admin/config/${key}${envQuery(environment)}`,
+      token: this.adminToken
+    });
+  }
+  listConfigRevisions(key, environment) {
+    return this.http.request({
+      method: "GET",
+      path: `/admin/config/${key}/revisions${envQuery(environment)}`,
+      token: this.adminToken
+    });
+  }
+  rollbackConfig(key, input, environment) {
+    return this.http.request({
+      method: "POST",
+      path: `/admin/config/${key}/rollback${envQuery(environment)}`,
+      body: input,
+      token: this.adminToken
+    });
+  }
+  // ── Secrets (masked) ─────────────────────────────────────────────────────
+  listSecrets(environment) {
+    return this.http.request({
+      method: "GET",
+      path: `/admin/secrets${envQuery(environment)}`,
+      token: this.adminToken
+    });
+  }
+  getSecret(key, environment) {
+    return this.http.request({
+      method: "GET",
+      path: `/admin/secrets/${key}${envQuery(environment)}`,
+      token: this.adminToken
+    });
+  }
+  setSecret(key, input, environment) {
+    return this.http.request({
+      method: "PUT",
+      path: `/admin/secrets/${key}${envQuery(environment)}`,
+      body: input,
+      token: this.adminToken
+    });
+  }
+  deleteSecret(key, environment) {
+    return this.http.request({
+      method: "DELETE",
+      path: `/admin/secrets/${key}${envQuery(environment)}`,
+      token: this.adminToken
+    });
+  }
+  listSecretRevisions(key, environment) {
+    return this.http.request({
+      method: "GET",
+      path: `/admin/secrets/${key}/revisions${envQuery(environment)}`,
+      token: this.adminToken
+    });
+  }
+  rollbackSecret(key, input, environment) {
+    return this.http.request({
+      method: "POST",
+      path: `/admin/secrets/${key}/rollback${envQuery(environment)}`,
+      body: input,
+      token: this.adminToken
+    });
+  }
+  // POST (not GET) so the decrypted value never lands in a URL or access log.
+  revealSecret(key, environment) {
+    return this.http.request({
+      method: "POST",
+      path: `/admin/secrets/${key}/reveal${envQuery(environment)}`,
+      token: this.adminToken
+    });
+  }
+};
+
+// src/modules/courier-admin.ts
+var CourierAdminClient = class {
   http;
+  adminToken;
   constructor(opts) {
     this.http = new HttpClient(opts.baseUrl);
-    this.auth = new AuthClient(this.http, opts.accessToken);
+    this.adminToken = opts.adminToken;
+  }
+  listTemplates() {
+    return this.http.request({
+      method: "GET",
+      path: "/admin/templates",
+      token: this.adminToken
+    });
+  }
+  getTemplate(type, locale) {
+    const q = locale ? `?locale=${encodeURIComponent(locale)}` : "";
+    return this.http.request({
+      method: "GET",
+      path: `/admin/templates/${type}${q}`,
+      token: this.adminToken
+    });
+  }
+  setTemplate(type, input, locale) {
+    const q = locale ? `?locale=${encodeURIComponent(locale)}` : "";
+    return this.http.request({
+      method: "PUT",
+      path: `/admin/templates/${type}${q}`,
+      body: input,
+      token: this.adminToken
+    });
+  }
+  deleteTemplate(type, locale) {
+    const q = locale ? `?locale=${encodeURIComponent(locale)}` : "";
+    return this.http.request({
+      method: "DELETE",
+      path: `/admin/templates/${type}${q}`,
+      token: this.adminToken
+    });
+  }
+  listRevisions(type, locale) {
+    const q = locale ? `?locale=${encodeURIComponent(locale)}` : "";
+    return this.http.request({
+      method: "GET",
+      path: `/admin/templates/${type}/revisions${q}`,
+      token: this.adminToken
+    });
+  }
+  rollback(type, input, locale) {
+    const q = locale ? `?locale=${encodeURIComponent(locale)}` : "";
+    return this.http.request({
+      method: "POST",
+      path: `/admin/templates/${type}/rollback${q}`,
+      body: input,
+      token: this.adminToken
+    });
   }
 };
 export {
+  AuditClient,
   AuthClient,
+  BillingClient,
+  ConfigAdminClient,
+  CourierAdminClient,
+  CustomersClient,
   FonderieApiError,
-  FonderieClient
+  FonderieClient,
+  WebhooksClient,
+  WorkspacesClient
 };
 //# sourceMappingURL=index.js.map