@ophelio/sdk 0.1.0

package/dist/index.cjs

@@ -0,0 +1,1116 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/core/errors.ts
+var OphelioError = class extends Error {
+	/** HTTP status code, or null for non-HTTP failures (network, timeout). */
+	status;
+	/** AIP status string (e.g. 'NOT_FOUND'), or null when unavailable. */
+	code;
+	/** Raw `error.details` array from the response, when present. */
+	details;
+	/** The raw parsed response body, when present. */
+	raw;
+	constructor(message, options = {}) {
+		super(message);
+		this.name = this.constructor.name;
+		this.status = options.status ?? null;
+		this.code = options.code ?? null;
+		this.details = options.details;
+		this.raw = options.raw;
+	}
+};
+var InvalidArgumentError = class extends OphelioError {};
+var UnauthenticatedError = class extends OphelioError {};
+var PermissionDeniedError = class extends OphelioError {};
+var NotFoundError = class extends OphelioError {};
+var AlreadyExistsError = class extends OphelioError {};
+var ResourceExhaustedError = class extends OphelioError {};
+var InternalError = class extends OphelioError {};
+var UnimplementedError = class extends OphelioError {};
+var UnavailableError = class extends OphelioError {};
+/** Request never reached the API or the response never arrived. */
+var OphelioConnectionError = class extends OphelioError {};
+/** The configured timeoutMs elapsed before the API responded. */
+var OphelioTimeoutError = class extends OphelioError {};
+/** X-Ophelio-Signature did not match the webhook payload. */
+var WebhookSignatureVerificationError = class extends OphelioError {};
+const AIP_CODE_TO_ERROR = {
+	INVALID_ARGUMENT: InvalidArgumentError,
+	UNAUTHENTICATED: UnauthenticatedError,
+	PERMISSION_DENIED: PermissionDeniedError,
+	NOT_FOUND: NotFoundError,
+	ALREADY_EXISTS: AlreadyExistsError,
+	RESOURCE_EXHAUSTED: ResourceExhaustedError,
+	INTERNAL: InternalError,
+	UNIMPLEMENTED: UnimplementedError,
+	UNAVAILABLE: UnavailableError
+};
+const HTTP_STATUS_TO_AIP = {
+	400: "INVALID_ARGUMENT",
+	401: "UNAUTHENTICATED",
+	403: "PERMISSION_DENIED",
+	404: "NOT_FOUND",
+	409: "ALREADY_EXISTS",
+	410: "NOT_FOUND",
+	422: "INVALID_ARGUMENT",
+	429: "RESOURCE_EXHAUSTED",
+	500: "INTERNAL",
+	501: "UNIMPLEMENTED",
+	503: "UNAVAILABLE"
+};
+/**
+* Build the most specific OphelioError for a non-2xx response. Prefers the
+* AIP status string from the body; falls back to the HTTP status code when
+* the body isn't a valid envelope (e.g. a proxy error page).
+*/
+function errorFromResponse(httpStatus, bodyText) {
+	let parsed;
+	try {
+		parsed = JSON.parse(bodyText);
+	} catch {
+		parsed = void 0;
+	}
+	const envelope = parsed?.error;
+	const aipCode = typeof envelope?.status === "string" ? envelope.status : HTTP_STATUS_TO_AIP[httpStatus];
+	const message = typeof envelope?.message === "string" && envelope.message.length > 0 ? envelope.message : `Request failed with status ${httpStatus}.`;
+	return new (aipCode && AIP_CODE_TO_ERROR[aipCode] || OphelioError)(message, {
+		status: httpStatus,
+		code: aipCode ?? null,
+		details: Array.isArray(envelope?.details) ? envelope.details : void 0,
+		raw: parsed
+	});
+}
+//#endregion
+//#region src/core/retry.ts
+const BASE_DELAY_MS = 500;
+const MAX_BACKOFF_MS = 8e3;
+const MAX_RETRY_AFTER_MS = 3e4;
+const RETRYABLE_STATUSES = new Set([
+	429,
+	502,
+	503,
+	504
+]);
+function isRetryableStatus(status) {
+	return RETRYABLE_STATUSES.has(status);
+}
+/**
+* Delay before retry attempt `attempt` (0-based). Exponential backoff with
+* full jitter, unless the server sent a usable Retry-After (seconds or
+* HTTP-date), which wins but is capped so a hostile header can't park the
+* caller for minutes.
+*/
+function backoffDelayMs(attempt, retryAfter) {
+	if (retryAfter) {
+		const seconds = Number(retryAfter);
+		if (Number.isFinite(seconds) && seconds >= 0) return Math.min(seconds * 1e3, MAX_RETRY_AFTER_MS);
+		const dateMs = Date.parse(retryAfter);
+		if (!Number.isNaN(dateMs)) return Math.min(Math.max(dateMs - Date.now(), 0), MAX_RETRY_AFTER_MS);
+	}
+	const cap = Math.min(MAX_BACKOFF_MS, BASE_DELAY_MS * 2 ** attempt);
+	return Math.random() * cap;
+}
+function sleep(ms) {
+	return new Promise((resolvePromise) => setTimeout(resolvePromise, ms));
+}
+//#endregion
+//#region src/core/transport.ts
+const DEFAULT_BASE_URL = "https://api.ophel.io";
+const DEFAULT_TIMEOUT_MS = 3e4;
+const DEFAULT_MAX_RETRIES = 2;
+var Transport = class {
+	apiKey;
+	baseUrl;
+	fetchFn;
+	headers;
+	timeoutMs;
+	maxRetries;
+	constructor(options) {
+		if (!options.apiKey && !options.headers) throw new OphelioError("Ophelio requires an apiKey (or custom headers carrying your own authentication).");
+		this.apiKey = options.apiKey;
+		this.baseUrl = (options.baseUrl ?? "https://api.ophel.io").replace(/\/+$/, "");
+		this.fetchFn = options.fetch ?? globalThis.fetch.bind(globalThis);
+		this.headers = options.headers ?? {};
+		this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+		this.maxRetries = options.maxRetries ?? DEFAULT_MAX_RETRIES;
+	}
+	async request(params) {
+		const url = this.buildUrl(params);
+		const headers = this.buildHeaders(params);
+		const maxAttempts = params.retryable ? this.maxRetries + 1 : 1;
+		const init = {
+			method: params.method,
+			headers,
+			...params.body !== void 0 ? { body: JSON.stringify(params.body) } : {}
+		};
+		let lastError = new OphelioError("Request failed.");
+		let retryAfter = null;
+		for (let attempt = 0; attempt < maxAttempts; attempt++) {
+			if (attempt > 0) await sleep(backoffDelayMs(attempt - 1, retryAfter));
+			let response;
+			try {
+				response = await this.fetchFn(url, {
+					...init,
+					signal: this.combineSignals(params.options?.signal)
+				});
+			} catch (error) {
+				lastError = this.normaliseFetchError(error, params.options?.signal);
+				if (params.options?.signal?.aborted) throw lastError;
+				if (attempt < maxAttempts - 1) continue;
+				throw lastError;
+			}
+			if (response.ok) return this.parseBody(response);
+			retryAfter = response.headers.get("retry-after");
+			const bodyText = await response.text().catch(() => "");
+			const error = errorFromResponse(response.status, bodyText);
+			if (params.retryable && isRetryableStatus(response.status) && attempt < maxAttempts - 1) {
+				lastError = error;
+				continue;
+			}
+			throw error;
+		}
+		throw lastError;
+	}
+	buildUrl(params) {
+		const search = new URLSearchParams();
+		for (const [key, value] of Object.entries(params.query ?? {})) if (value !== void 0) search.set(key, value);
+		const queryString = search.toString();
+		return `${this.baseUrl}${params.path}${queryString ? `?${queryString}` : ""}`;
+	}
+	buildHeaders(params) {
+		return {
+			Accept: "application/json",
+			...params.body !== void 0 ? { "Content-Type": "application/json" } : {},
+			...this.apiKey ? { "X-Api-Key": this.apiKey } : {},
+			...this.headers,
+			...params.idempotencyKey ? { "Idempotency-Key": params.idempotencyKey } : {},
+			...params.options?.headers
+		};
+	}
+	combineSignals(callerSignal) {
+		const timeoutSignal = AbortSignal.timeout(this.timeoutMs);
+		return callerSignal ? AbortSignal.any([callerSignal, timeoutSignal]) : timeoutSignal;
+	}
+	normaliseFetchError(error, callerSignal) {
+		if (callerSignal?.aborted) return new OphelioConnectionError("Request aborted by caller.", { raw: error });
+		if (error instanceof DOMException && error.name === "TimeoutError") return new OphelioTimeoutError(`Request timed out after ${this.timeoutMs} ms.`, { raw: error });
+		return new OphelioConnectionError(`Request failed to send: ${error instanceof Error ? error.message : String(error)}`, { raw: error });
+	}
+	async parseBody(response) {
+		const text = await response.text();
+		if (!text) return void 0;
+		try {
+			return JSON.parse(text);
+		} catch {
+			throw new OphelioError("API returned a non-JSON response body.", {
+				status: response.status,
+				raw: text
+			});
+		}
+	}
+};
+//#endregion
+//#region src/resources/resource.ts
+var APIResource = class {
+	transport;
+	constructor(transport) {
+		this.transport = transport;
+	}
+};
+//#endregion
+//#region src/resources/admit.ts
+var AdmitResource = class extends APIResource {
+	/** Gate admission check: `GET /admit?card=<cardId>`. */
+	check(params, options) {
+		return this.transport.request({
+			method: "GET",
+			path: "/api/v1/admit",
+			query: { card: params.card },
+			retryable: true,
+			options
+		});
+	}
+};
+//#endregion
+//#region src/resources/billing-option-sales-channels.ts
+var BillingOptionSalesChannelsResource = class extends APIResource {
+	/** Remove a sales-channel link. Create via billingOptions.createSalesChannelLink(). */
+	async delete(id, options) {
+		await this.transport.request({
+			method: "DELETE",
+			path: `/api/v1/billing-option-sales-channels/${encodeURIComponent(id)}`,
+			retryable: false,
+			options
+		});
+	}
+};
+//#endregion
+//#region src/resources/billing-options.ts
+var BillingOptionsResource = class extends APIResource {
+	async list(options) {
+		return (await this.transport.request({
+			method: "GET",
+			path: "/api/v1/billing-options",
+			retryable: true,
+			options
+		})).billing_options;
+	}
+	get(id, options) {
+		return this.transport.request({
+			method: "GET",
+			path: `/api/v1/billing-options/${encodeURIComponent(id)}`,
+			retryable: true,
+			options
+		});
+	}
+	update(id, params, options) {
+		return this.transport.request({
+			method: "PATCH",
+			path: `/api/v1/billing-options/${encodeURIComponent(id)}`,
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	async delete(id, options) {
+		await this.transport.request({
+			method: "DELETE",
+			path: `/api/v1/billing-options/${encodeURIComponent(id)}`,
+			retryable: false,
+			options
+		});
+	}
+	async listSalesChannels(id, options) {
+		return (await this.transport.request({
+			method: "GET",
+			path: `/api/v1/billing-options/${encodeURIComponent(id)}/sales-channels`,
+			retryable: true,
+			options
+		})).sales_channels;
+	}
+	createSalesChannelLink(id, params, options) {
+		return this.transport.request({
+			method: "POST",
+			path: `/api/v1/billing-options/${encodeURIComponent(id)}/sales-channels`,
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+};
+//#endregion
+//#region src/resources/customers.ts
+var CustomersResource = class extends APIResource {
+	async list(options) {
+		return (await this.transport.request({
+			method: "GET",
+			path: "/api/v1/customers",
+			retryable: true,
+			options
+		})).customers;
+	}
+	get(id, options) {
+		return this.transport.request({
+			method: "GET",
+			path: `/api/v1/customers/${encodeURIComponent(id)}`,
+			retryable: true,
+			options
+		});
+	}
+	create(params, options) {
+		return this.transport.request({
+			method: "POST",
+			path: "/api/v1/customers",
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	update(id, params, options) {
+		return this.transport.request({
+			method: "PATCH",
+			path: `/api/v1/customers/${encodeURIComponent(id)}`,
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	async delete(id, options) {
+		await this.transport.request({
+			method: "DELETE",
+			path: `/api/v1/customers/${encodeURIComponent(id)}`,
+			retryable: false,
+			options
+		});
+	}
+	async listMemberships(id, options) {
+		return (await this.transport.request({
+			method: "GET",
+			path: `/api/v1/customers/${encodeURIComponent(id)}/memberships`,
+			retryable: true,
+			options
+		})).memberships;
+	}
+};
+//#endregion
+//#region src/resources/entitlements.ts
+var EntitlementsResource = class extends APIResource {
+	/**
+	* Redeem one quota unit for a member. Idempotent: the Idempotency-Key is
+	* generated once per call (and reused across the SDK's internal retries),
+	* so replays return the original redemption instead of double-spending.
+	*/
+	redeem(params, options = {}) {
+		const { idempotencyKey, ...requestOptions } = options;
+		return this.transport.request({
+			method: "POST",
+			path: "/api/v1/entitlements/redeem",
+			body: params,
+			idempotencyKey: idempotencyKey ?? crypto.randomUUID(),
+			retryable: true,
+			options: requestOptions
+		});
+	}
+	/**
+	* Fire-and-forget batch usage reporting (one row per member). Idempotent
+	* per (key, member). Returns the recorded usage rows.
+	*/
+	async recordUsage(params, options = {}) {
+		const { idempotencyKey, ...requestOptions } = options;
+		return (await this.transport.request({
+			method: "POST",
+			path: "/api/v1/entitlements/usage",
+			body: params,
+			idempotencyKey: idempotencyKey ?? crypto.randomUUID(),
+			retryable: true,
+			options: requestOptions
+		})).usage;
+	}
+	async list(options) {
+		return (await this.transport.request({
+			method: "GET",
+			path: "/api/v1/entitlements",
+			retryable: true,
+			options
+		})).entitlements;
+	}
+	get(id, options) {
+		return this.transport.request({
+			method: "GET",
+			path: `/api/v1/entitlements/${encodeURIComponent(id)}`,
+			retryable: true,
+			options
+		});
+	}
+	create(params, options) {
+		return this.transport.request({
+			method: "POST",
+			path: "/api/v1/entitlements",
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	update(id, params, options) {
+		return this.transport.request({
+			method: "PATCH",
+			path: `/api/v1/entitlements/${encodeURIComponent(id)}`,
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	async delete(id, options) {
+		await this.transport.request({
+			method: "DELETE",
+			path: `/api/v1/entitlements/${encodeURIComponent(id)}`,
+			retryable: false,
+			options
+		});
+	}
+};
+//#endregion
+//#region src/resources/member-roles.ts
+var MemberRolesResource = class extends APIResource {
+	async list(options) {
+		return (await this.transport.request({
+			method: "GET",
+			path: "/api/v1/member-roles",
+			retryable: true,
+			options
+		})).member_roles;
+	}
+	get(id, options) {
+		return this.transport.request({
+			method: "GET",
+			path: `/api/v1/member-roles/${encodeURIComponent(id)}`,
+			retryable: true,
+			options
+		});
+	}
+	create(params, options) {
+		return this.transport.request({
+			method: "POST",
+			path: "/api/v1/member-roles",
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	update(id, params, options) {
+		return this.transport.request({
+			method: "PATCH",
+			path: `/api/v1/member-roles/${encodeURIComponent(id)}`,
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	async delete(id, options) {
+		await this.transport.request({
+			method: "DELETE",
+			path: `/api/v1/member-roles/${encodeURIComponent(id)}`,
+			retryable: false,
+			options
+		});
+	}
+};
+//#endregion
+//#region src/resources/members.ts
+var MembersResource = class extends APIResource {
+	/**
+	* Active-member list for offline gate caching. Pass the previous
+	* response's `generated_at` as `since` to fetch incrementally.
+	*/
+	sync(params = {}, options) {
+		return this.transport.request({
+			method: "GET",
+			path: "/api/v1/members/sync",
+			query: { since: params.since },
+			retryable: true,
+			options
+		});
+	}
+	get(id, options) {
+		return this.transport.request({
+			method: "GET",
+			path: `/api/v1/members/${encodeURIComponent(id)}`,
+			retryable: true,
+			options
+		});
+	}
+	async listEntitlements(id, params = {}, options) {
+		return (await this.transport.request({
+			method: "GET",
+			path: `/api/v1/members/${encodeURIComponent(id)}/entitlements`,
+			query: { type: params.type },
+			retryable: true,
+			options
+		})).entitlements;
+	}
+	/** Issue a fresh card id, invalidating the old card at the gate. */
+	reissueCard(id, params = {}, options) {
+		return this.transport.request({
+			method: "POST",
+			path: `/api/v1/members/${encodeURIComponent(id)}/reissue-card`,
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+};
+//#endregion
+//#region src/resources/memberships.ts
+var MembershipsResource = class extends APIResource {
+	async list(options) {
+		return (await this.transport.request({
+			method: "GET",
+			path: "/api/v1/memberships",
+			retryable: true,
+			options
+		})).memberships;
+	}
+	get(id, options) {
+		return this.transport.request({
+			method: "GET",
+			path: `/api/v1/memberships/${encodeURIComponent(id)}`,
+			retryable: true,
+			options
+		});
+	}
+	create(params, options) {
+		return this.transport.request({
+			method: "POST",
+			path: "/api/v1/memberships",
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	update(id, params, options) {
+		return this.transport.request({
+			method: "PATCH",
+			path: `/api/v1/memberships/${encodeURIComponent(id)}`,
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	/** Cancellation is a state change, not a delete — see also `uncancel`. */
+	cancel(id, params, options) {
+		return this.transport.request({
+			method: "POST",
+			path: `/api/v1/memberships/${encodeURIComponent(id)}/cancel`,
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	uncancel(id, options) {
+		return this.transport.request({
+			method: "POST",
+			path: `/api/v1/memberships/${encodeURIComponent(id)}/uncancel`,
+			retryable: false,
+			options
+		});
+	}
+	async listTransactions(id, options) {
+		return (await this.transport.request({
+			method: "GET",
+			path: `/api/v1/memberships/${encodeURIComponent(id)}/transactions`,
+			retryable: true,
+			options
+		})).transactions;
+	}
+	/**
+	* Report a payment outcome. Ophel.io never processes payments — your
+	* payment provider does; this records the result and drives dunning.
+	*/
+	createTransaction(id, params, options) {
+		return this.transport.request({
+			method: "POST",
+			path: `/api/v1/memberships/${encodeURIComponent(id)}/transactions`,
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	async listMembers(id, options) {
+		return (await this.transport.request({
+			method: "GET",
+			path: `/api/v1/memberships/${encodeURIComponent(id)}/members`,
+			retryable: true,
+			options
+		})).members;
+	}
+	/** Open the next term. Rejected (409) while cancelled or cancellation-pending. */
+	renew(id, params, options) {
+		return this.transport.request({
+			method: "POST",
+			path: `/api/v1/memberships/${encodeURIComponent(id)}/renew`,
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	/**
+	* Move to a linked higher plan. Applies immediately or schedules at term
+	* end — `scheduled_change` is non-null in the deferred case.
+	*/
+	upgrade(id, params, options) {
+		return this.transport.request({
+			method: "POST",
+			path: `/api/v1/memberships/${encodeURIComponent(id)}/upgrade`,
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	/** Mirror of upgrade towards a linked lower plan. */
+	downgrade(id, params, options) {
+		return this.transport.request({
+			method: "POST",
+			path: `/api/v1/memberships/${encodeURIComponent(id)}/downgrade`,
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	async listScheduledChanges(id, params, options) {
+		return (await this.transport.request({
+			method: "GET",
+			path: `/api/v1/memberships/${encodeURIComponent(id)}/scheduled-changes`,
+			query: params?.status ? { status: params.status } : void 0,
+			retryable: true,
+			options
+		})).scheduled_changes;
+	}
+	async cancelScheduledChange(id, changeId, options) {
+		await this.transport.request({
+			method: "DELETE",
+			path: `/api/v1/memberships/${encodeURIComponent(id)}/scheduled-changes/${encodeURIComponent(changeId)}`,
+			retryable: false,
+			options
+		});
+	}
+	async listTermTransactions(id, termId, options) {
+		return (await this.transport.request({
+			method: "GET",
+			path: `/api/v1/memberships/${encodeURIComponent(id)}/terms/${encodeURIComponent(termId)}/transactions`,
+			retryable: true,
+			options
+		})).transactions;
+	}
+};
+//#endregion
+//#region src/resources/plan-entitlements.ts
+var PlanEntitlementsResource = class extends APIResource {
+	get(id, options) {
+		return this.transport.request({
+			method: "GET",
+			path: `/api/v1/plan-entitlements/${encodeURIComponent(id)}`,
+			retryable: true,
+			options
+		});
+	}
+	update(id, params, options) {
+		return this.transport.request({
+			method: "PATCH",
+			path: `/api/v1/plan-entitlements/${encodeURIComponent(id)}`,
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	/** Detach an entitlement from its plan. Attach via plans.createEntitlement(). */
+	async delete(id, options) {
+		await this.transport.request({
+			method: "DELETE",
+			path: `/api/v1/plan-entitlements/${encodeURIComponent(id)}`,
+			retryable: false,
+			options
+		});
+	}
+};
+//#endregion
+//#region src/resources/plan-links.ts
+var PlanLinksResource = class extends APIResource {
+	/** Remove an upgrade/downgrade link. Create via plans.createPlanLink(). */
+	async delete(id, options) {
+		await this.transport.request({
+			method: "DELETE",
+			path: `/api/v1/plan-links/${encodeURIComponent(id)}`,
+			retryable: false,
+			options
+		});
+	}
+};
+//#endregion
+//#region src/resources/plan-pricing-group-mappings.ts
+var PlanPricingGroupMappingsResource = class extends APIResource {
+	/** Remove a pricing mapping. Create via plans.createPricingGroupMapping(). */
+	async delete(id, options) {
+		await this.transport.request({
+			method: "DELETE",
+			path: `/api/v1/plan-pricing-group-mappings/${encodeURIComponent(id)}`,
+			retryable: false,
+			options
+		});
+	}
+};
+//#endregion
+//#region src/resources/plans.ts
+var PlansResource = class extends APIResource {
+	async list(options) {
+		return (await this.transport.request({
+			method: "GET",
+			path: "/api/v1/plans",
+			retryable: true,
+			options
+		})).plans;
+	}
+	get(id, options) {
+		return this.transport.request({
+			method: "GET",
+			path: `/api/v1/plans/${encodeURIComponent(id)}`,
+			retryable: true,
+			options
+		});
+	}
+	async listBillingOptions(id, options) {
+		return (await this.transport.request({
+			method: "GET",
+			path: `/api/v1/plans/${encodeURIComponent(id)}/billing-options`,
+			retryable: true,
+			options
+		})).billing_options;
+	}
+	async listEntitlements(id, options) {
+		return (await this.transport.request({
+			method: "GET",
+			path: `/api/v1/plans/${encodeURIComponent(id)}/entitlements`,
+			retryable: true,
+			options
+		})).entitlements;
+	}
+	create(params, options) {
+		return this.transport.request({
+			method: "POST",
+			path: "/api/v1/plans",
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	update(id, params, options) {
+		return this.transport.request({
+			method: "PATCH",
+			path: `/api/v1/plans/${encodeURIComponent(id)}`,
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	async delete(id, options) {
+		await this.transport.request({
+			method: "DELETE",
+			path: `/api/v1/plans/${encodeURIComponent(id)}`,
+			retryable: false,
+			options
+		});
+	}
+	createBillingOption(id, params, options) {
+		return this.transport.request({
+			method: "POST",
+			path: `/api/v1/plans/${encodeURIComponent(id)}/billing-options`,
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	async listPlanLinks(id, options) {
+		return (await this.transport.request({
+			method: "GET",
+			path: `/api/v1/plans/${encodeURIComponent(id)}/plan-links`,
+			retryable: true,
+			options
+		})).plan_links;
+	}
+	createPlanLink(id, params, options) {
+		return this.transport.request({
+			method: "POST",
+			path: `/api/v1/plans/${encodeURIComponent(id)}/plan-links`,
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	createEntitlement(id, params, options) {
+		return this.transport.request({
+			method: "POST",
+			path: `/api/v1/plans/${encodeURIComponent(id)}/entitlements`,
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	async listPricingGroupMappings(id, options) {
+		return (await this.transport.request({
+			method: "GET",
+			path: `/api/v1/plans/${encodeURIComponent(id)}/pricing-group-mappings`,
+			retryable: true,
+			options
+		})).pricing_group_mappings;
+	}
+	createPricingGroupMapping(id, params, options) {
+		return this.transport.request({
+			method: "POST",
+			path: `/api/v1/plans/${encodeURIComponent(id)}/pricing-group-mappings`,
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+};
+//#endregion
+//#region src/resources/pricing-groups.ts
+var PricingGroupsResource = class extends APIResource {
+	async list(options) {
+		return (await this.transport.request({
+			method: "GET",
+			path: "/api/v1/pricing-groups",
+			retryable: true,
+			options
+		})).pricing_groups;
+	}
+	get(id, options) {
+		return this.transport.request({
+			method: "GET",
+			path: `/api/v1/pricing-groups/${encodeURIComponent(id)}`,
+			retryable: true,
+			options
+		});
+	}
+	create(params, options) {
+		return this.transport.request({
+			method: "POST",
+			path: "/api/v1/pricing-groups",
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	update(id, params, options) {
+		return this.transport.request({
+			method: "PATCH",
+			path: `/api/v1/pricing-groups/${encodeURIComponent(id)}`,
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	async delete(id, options) {
+		await this.transport.request({
+			method: "DELETE",
+			path: `/api/v1/pricing-groups/${encodeURIComponent(id)}`,
+			retryable: false,
+			options
+		});
+	}
+};
+//#endregion
+//#region src/resources/sales-channels.ts
+var SalesChannelsResource = class extends APIResource {
+	async list(options) {
+		return (await this.transport.request({
+			method: "GET",
+			path: "/api/v1/sales-channels",
+			retryable: true,
+			options
+		})).sales_channels;
+	}
+	get(id, options) {
+		return this.transport.request({
+			method: "GET",
+			path: `/api/v1/sales-channels/${encodeURIComponent(id)}`,
+			retryable: true,
+			options
+		});
+	}
+	create(params, options) {
+		return this.transport.request({
+			method: "POST",
+			path: "/api/v1/sales-channels",
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	update(id, params, options) {
+		return this.transport.request({
+			method: "PATCH",
+			path: `/api/v1/sales-channels/${encodeURIComponent(id)}`,
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	async delete(id, options) {
+		await this.transport.request({
+			method: "DELETE",
+			path: `/api/v1/sales-channels/${encodeURIComponent(id)}`,
+			retryable: false,
+			options
+		});
+	}
+};
+//#endregion
+//#region src/resources/webhook-subscriptions.ts
+var WebhookSubscriptionsResource = class extends APIResource {
+	async list(options) {
+		return (await this.transport.request({
+			method: "GET",
+			path: "/api/v1/webhook-subscriptions",
+			retryable: true,
+			options
+		})).webhook_subscriptions;
+	}
+	get(id, options) {
+		return this.transport.request({
+			method: "GET",
+			path: `/api/v1/webhook-subscriptions/${encodeURIComponent(id)}`,
+			retryable: true,
+			options
+		});
+	}
+	async listDeliveries(id, options) {
+		return (await this.transport.request({
+			method: "GET",
+			path: `/api/v1/webhook-subscriptions/${encodeURIComponent(id)}/deliveries`,
+			retryable: true,
+			options
+		})).webhook_deliveries;
+	}
+	/** The HMAC signing secret is only returned on creation — store it then. */
+	create(params, options) {
+		return this.transport.request({
+			method: "POST",
+			path: "/api/v1/webhook-subscriptions",
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	update(id, params, options) {
+		return this.transport.request({
+			method: "PATCH",
+			path: `/api/v1/webhook-subscriptions/${encodeURIComponent(id)}`,
+			body: params,
+			retryable: false,
+			options
+		});
+	}
+	async delete(id, options) {
+		await this.transport.request({
+			method: "DELETE",
+			path: `/api/v1/webhook-subscriptions/${encodeURIComponent(id)}`,
+			retryable: false,
+			options
+		});
+	}
+};
+//#endregion
+//#region src/webhooks/verify.ts
+const encoder = new TextEncoder();
+async function computeSignatureHex(payload, secret) {
+	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(payload));
+	return Array.from(new Uint8Array(signature)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function timingSafeEqualHex(a, b) {
+	if (a.length !== b.length) return false;
+	let mismatch = 0;
+	for (let i = 0; i < a.length; i++) mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+	return mismatch === 0;
+}
+/**
+* Verify the `X-Ophelio-Signature` header against the raw request body.
+* Pass the body exactly as received — re-serialising the parsed JSON can
+* change key order/whitespace and break verification.
+*/
+async function verifyWebhookSignature(payload, signature, secret) {
+	const provided = signature.startsWith("sha256=") ? signature.slice(7) : signature;
+	return timingSafeEqualHex(await computeSignatureHex(payload, secret), provided.toLowerCase());
+}
+/**
+* Verify and parse a webhook delivery in one step. Throws
+* WebhookSignatureVerificationError when the signature doesn't match, or
+* OphelioError when the payload isn't a structurally valid event.
+*/
+async function constructEvent(payload, signature, secret) {
+	if (!await verifyWebhookSignature(payload, signature, secret)) throw new WebhookSignatureVerificationError("Webhook signature verification failed.");
+	let parsed;
+	try {
+		parsed = JSON.parse(payload);
+	} catch {
+		throw new OphelioError("Webhook payload is not valid JSON.");
+	}
+	const event = parsed;
+	if (!event || typeof event.id !== "string" || typeof event.type !== "string" || typeof event.create_time !== "string" || typeof event.data !== "object" || event.data === null) throw new OphelioError("Webhook payload is not a valid Ophelio event.");
+	return event;
+}
+//#endregion
+//#region src/client.ts
+/**
+* Ophel.io API client.
+*
+* ```ts
+* const ophelio = new Ophelio({ apiKey: process.env.OPHELIO_API_KEY })
+* const result = await ophelio.admit.check({ card: 'M-123456' })
+* ```
+*/
+var Ophelio = class Ophelio {
+	admit;
+	members;
+	memberships;
+	customers;
+	entitlements;
+	plans;
+	billingOptions;
+	memberRoles;
+	pricingGroups;
+	salesChannels;
+	planEntitlements;
+	planLinks;
+	planPricingGroupMappings;
+	billingOptionSalesChannels;
+	webhookSubscriptions;
+	/** Webhook helpers — usable without a client instance (no API key). */
+	static webhooks = {
+		verifySignature: verifyWebhookSignature,
+		constructEvent
+	};
+	webhooks = Ophelio.webhooks;
+	constructor(options) {
+		const transport = new Transport(options);
+		this.admit = new AdmitResource(transport);
+		this.members = new MembersResource(transport);
+		this.memberships = new MembershipsResource(transport);
+		this.customers = new CustomersResource(transport);
+		this.entitlements = new EntitlementsResource(transport);
+		this.plans = new PlansResource(transport);
+		this.billingOptions = new BillingOptionsResource(transport);
+		this.memberRoles = new MemberRolesResource(transport);
+		this.pricingGroups = new PricingGroupsResource(transport);
+		this.salesChannels = new SalesChannelsResource(transport);
+		this.planEntitlements = new PlanEntitlementsResource(transport);
+		this.planLinks = new PlanLinksResource(transport);
+		this.planPricingGroupMappings = new PlanPricingGroupMappingsResource(transport);
+		this.billingOptionSalesChannels = new BillingOptionSalesChannelsResource(transport);
+		this.webhookSubscriptions = new WebhookSubscriptionsResource(transport);
+	}
+};
+/**
+* Canonical webhook event codes for the Ophel.io platform.
+*
+* This is the protocol-level source of truth shared by the API (event
+* emission), the web app (subscription UI), and the SDK (typed webhook
+* events). UI copy (labels, descriptions, categories) lives in ophelio-web.
+*/
+const WEBHOOK_EVENT_CODES = [
+	"membership.created",
+	"membership.renewed",
+	"membership.renewal_due",
+	"membership.payment_failed",
+	"membership.expired",
+	"membership.grace_entered",
+	"membership.cancelled",
+	"membership.upgraded",
+	"membership.downgraded",
+	"scheduled_change.failed",
+	"entitlement.used",
+	"member.card_issued",
+	"member.removed",
+	"plan.updated"
+];
+//#endregion
+exports.AlreadyExistsError = AlreadyExistsError;
+exports.DEFAULT_BASE_URL = DEFAULT_BASE_URL;
+exports.InternalError = InternalError;
+exports.InvalidArgumentError = InvalidArgumentError;
+exports.NotFoundError = NotFoundError;
+exports.Ophelio = Ophelio;
+exports.OphelioConnectionError = OphelioConnectionError;
+exports.OphelioError = OphelioError;
+exports.OphelioTimeoutError = OphelioTimeoutError;
+exports.PermissionDeniedError = PermissionDeniedError;
+exports.ResourceExhaustedError = ResourceExhaustedError;
+exports.UnauthenticatedError = UnauthenticatedError;
+exports.UnavailableError = UnavailableError;
+exports.UnimplementedError = UnimplementedError;
+exports.WEBHOOK_EVENT_CODES = WEBHOOK_EVENT_CODES;
+exports.WebhookSignatureVerificationError = WebhookSignatureVerificationError;
+exports.constructEvent = constructEvent;
+exports.verifyWebhookSignature = verifyWebhookSignature;