@planescrm/sdk 0.4.0 → 0.72.0

package/dist/client.mjs

@@ -0,0 +1,3232 @@
+// src/config.ts
+var MemoryTokenStorage = class {
+  constructor(seed) {
+    this.tokens = seed ?? null;
+  }
+  async getTokens() {
+    return this.tokens;
+  }
+  async setTokens(tokens) {
+    this.tokens = tokens;
+  }
+};
+var DEFAULT_BASE_URL = "https://api.planescrm.com/api/v1";
+var DEFAULT_TIMEOUT = 3e4;
+var DEFAULT_MAX_RETRIES = 3;
+var DEFAULT_TOKEN_REFRESH_SKEW_MS = 6e4;
+
+// src/errors.ts
+var PlanesError = class extends Error {
+  constructor(message, status, code) {
+    super(message);
+    this.name = "PlanesError";
+    this.status = status;
+    this.code = code;
+  }
+};
+var AuthenticationError = class extends PlanesError {
+  constructor(message = "Authentication failed") {
+    super(message, 401, "authentication_error");
+    this.name = "AuthenticationError";
+  }
+};
+var AuthorizationError = class extends PlanesError {
+  constructor(message = "Insufficient permissions") {
+    super(message, 403, "authorization_error");
+    this.name = "AuthorizationError";
+  }
+};
+var NotFoundError = class extends PlanesError {
+  constructor(message = "Resource not found") {
+    super(message, 404, "not_found");
+    this.name = "NotFoundError";
+  }
+};
+var ValidationError = class extends PlanesError {
+  constructor(message = "Validation failed", fieldErrors = []) {
+    super(message, 400, "validation_error");
+    this.name = "ValidationError";
+    this.fieldErrors = fieldErrors;
+  }
+};
+var RateLimitError = class extends PlanesError {
+  constructor(retryAfter = 1, message = "Rate limit exceeded") {
+    super(message, 429, "rate_limit_error");
+    this.name = "RateLimitError";
+    this.retryAfter = retryAfter;
+  }
+};
+var ServerError = class extends PlanesError {
+  constructor(message = "Internal server error") {
+    super(message, 500, "server_error");
+    this.name = "ServerError";
+  }
+};
+var WebhookVerificationError = class extends PlanesError {
+  constructor(message = "Webhook signature verification failed") {
+    super(message, 400, "webhook_verification_error");
+    this.name = "WebhookVerificationError";
+  }
+};
+var OAuthError = class extends PlanesError {
+  constructor(errorCode, message = "OAuth error") {
+    super(message, 400, "oauth_error");
+    this.name = "OAuthError";
+    this.errorCode = errorCode;
+  }
+};
+
+// src/client-shims/node-crypto.ts
+function unavailable(name) {
+  throw new Error(
+    `${name} is not available in @planescrm/sdk/client. Use the main @planescrm/sdk entry on a server.`
+  );
+}
+function createHmac(_algorithm, _key) {
+  return unavailable("createHmac (webhook verification)");
+}
+function timingSafeEqual(_a, _b) {
+  return unavailable("timingSafeEqual (webhook verification)");
+}
+
+// src/oauth.ts
+async function refreshAccessToken(options) {
+  const baseUrl = options.baseUrl.replace(/\/+$/, "");
+  const url = `${baseUrl}/oauth/token`;
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    client_id: options.clientId,
+    client_secret: options.clientSecret,
+    refresh_token: options.refreshToken
+  });
+  const response = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: body.toString()
+  });
+  if (!response.ok) {
+    const errorBody = await response.json().catch(() => ({}));
+    const errorCode = errorBody["error"] ?? "unknown_error";
+    const errorDescription = errorBody["error_description"] ?? "Token refresh failed";
+    throw new OAuthError(errorCode, errorDescription);
+  }
+  return await response.json();
+}
+async function clientCredentialsGrant(options) {
+  const baseUrl = options.baseUrl.replace(/\/+$/, "");
+  const url = `${baseUrl}/oauth/token`;
+  const body = new URLSearchParams({
+    grant_type: "client_credentials",
+    client_id: options.clientId,
+    client_secret: options.clientSecret,
+    scope: options.scopes.join(" ")
+  });
+  const response = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: body.toString()
+  });
+  if (!response.ok) {
+    const errorBody = await response.json().catch(() => ({}));
+    const errorCode = errorBody["error"] ?? "unknown_error";
+    const errorDescription = errorBody["error_description"] ?? "Client credentials grant failed";
+    throw new OAuthError(errorCode, errorDescription);
+  }
+  return await response.json();
+}
+
+// src/http.ts
+var HttpClient = class {
+  constructor(config) {
+    this.baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+    this.accessToken = config.accessToken;
+    this.apiKey = config.apiKey;
+    this.timeout = config.timeout ?? DEFAULT_TIMEOUT;
+    this.retryOnRateLimit = config.retryOnRateLimit !== false;
+    this.maxRetries = config.maxRetries ?? DEFAULT_MAX_RETRIES;
+    this.getAccessToken = config.getAccessToken;
+    this.onUnauthorized = config.onUnauthorized;
+    this.fetchImpl = config.fetch;
+    if (config.clientId && config.clientSecret) {
+      this.oauth = {
+        clientId: config.clientId,
+        clientSecret: config.clientSecret,
+        tokenStorage: config.tokenStorage ?? new MemoryTokenStorage(),
+        skewMs: config.tokenRefreshSkewMs ?? DEFAULT_TOKEN_REFRESH_SKEW_MS,
+        scopes: config.scopes
+      };
+    }
+  }
+  async request(options) {
+    const url = this.buildUrl(options.path, options.params);
+    const bodyStr = options.body !== void 0 ? JSON.stringify(options.body) : void 0;
+    let lastError;
+    let didRefreshOn401 = false;
+    for (let attempt = 0; attempt <= this.maxRetries; attempt++) {
+      const authHeaders = await this.resolveAuthHeaders();
+      const headers = {
+        "Content-Type": "application/json",
+        ...authHeaders,
+        ...options.headers
+      };
+      if (options.idempotencyKey) headers["Idempotency-Key"] = options.idempotencyKey;
+      const timer = timeoutSignal(this.timeout);
+      const fetchOptions = {
+        method: options.method,
+        headers,
+        signal: timer.signal
+      };
+      if (bodyStr !== void 0) {
+        fetchOptions.body = bodyStr;
+      }
+      try {
+        const response = await (this.fetchImpl ?? fetch)(url, fetchOptions);
+        if (response.ok) {
+          if (response.status === 204) {
+            return void 0;
+          }
+          if (options.responseType === "arrayBuffer") {
+            return await response.arrayBuffer();
+          }
+          return await response.json();
+        }
+        if (response.status === 429 && this.retryOnRateLimit && attempt < this.maxRetries) {
+          const retryAfter = this.parseRetryAfter(response);
+          await this.sleep(retryAfter * 1e3);
+          continue;
+        }
+        if (response.status === 401 && this.oauth && !didRefreshOn401) {
+          didRefreshOn401 = true;
+          await this.refreshTokens();
+          attempt--;
+          continue;
+        }
+        if (response.status === 401 && this.onUnauthorized && !didRefreshOn401) {
+          didRefreshOn401 = true;
+          if (await this.recoverSession(authHeaders["Authorization"])) {
+            attempt--;
+            continue;
+          }
+        }
+        lastError = await this.mapError(response);
+        if (response.status !== 429 || !this.retryOnRateLimit) {
+          throw lastError;
+        }
+      } finally {
+        timer.clear();
+      }
+    }
+    throw lastError ?? new RateLimitError();
+  }
+  getAuthHeaders() {
+    if (this.getAccessToken) return {};
+    if (this.accessToken) {
+      return { Authorization: `Bearer ${this.accessToken}` };
+    }
+    if (this.apiKey) {
+      return { Authorization: `Bearer ${this.apiKey}` };
+    }
+    return {};
+  }
+  /**
+   * Resolve the Authorization header for the current request. For the static
+   * accessToken/apiKey modes this is {@link getAuthHeaders}. For the
+   * OAuth-managed path it reads the stored token, proactively refreshing when
+   * the token is within the skew window of expiry.
+   */
+  async resolveAuthHeaders() {
+    if (this.getAccessToken) {
+      const token = await withTimeout(this.getAccessToken(), this.timeout, "getAccessToken");
+      return token ? { Authorization: `Bearer ${token}` } : {};
+    }
+    if (!this.oauth) {
+      return this.getAuthHeaders();
+    }
+    const tokens = await this.oauth.tokenStorage.getTokens();
+    if (!tokens) {
+      return {};
+    }
+    if (tokens.expiresAt - Date.now() <= this.oauth.skewMs) {
+      const refreshed = await this.refreshTokens();
+      return { Authorization: `Bearer ${refreshed.accessToken}` };
+    }
+    return { Authorization: `Bearer ${tokens.accessToken}` };
+  }
+  /**
+   * Refresh the OAuth access token via `refreshAccessToken` and persist the new
+   * tokens through the configured {@link TokenStorage}. Concurrent callers share
+   * a single in-flight refresh.
+   */
+  async refreshTokens() {
+    if (!this.oauth) {
+      throw new AuthenticationError("Token refresh requires the OAuth clientId/clientSecret path");
+    }
+    if (this.refreshInFlight) {
+      return this.refreshInFlight;
+    }
+    const oauth = this.oauth;
+    this.refreshInFlight = (async () => {
+      const current = await oauth.tokenStorage.getTokens();
+      if (!current?.refreshToken) {
+        const response2 = await clientCredentialsGrant({
+          baseUrl: this.baseUrl,
+          clientId: oauth.clientId,
+          clientSecret: oauth.clientSecret,
+          scopes: oauth.scopes ?? []
+        });
+        const next2 = {
+          accessToken: response2.access_token,
+          refreshToken: response2.refresh_token ?? null,
+          expiresAt: Date.now() + response2.expires_in * 1e3
+        };
+        await oauth.tokenStorage.setTokens(next2);
+        return next2;
+      }
+      const response = await refreshAccessToken({
+        baseUrl: this.baseUrl,
+        clientId: oauth.clientId,
+        clientSecret: oauth.clientSecret,
+        refreshToken: current.refreshToken
+      });
+      const next = {
+        accessToken: response.access_token,
+        refreshToken: response.refresh_token || current.refreshToken,
+        expiresAt: Date.now() + response.expires_in * 1e3
+      };
+      await oauth.tokenStorage.setTokens(next);
+      return next;
+    })();
+    try {
+      return await this.refreshInFlight;
+    } finally {
+      this.refreshInFlight = void 0;
+    }
+  }
+  /**
+   * Ask the app to refresh its session after a 401. Resolves `true` when the
+   * request should be retried.
+   * - Requests that got a 401 while a refresh is running share that one call.
+   * - A request whose 401 arrives after a refresh already finished (it was
+   *   sent with the old token) doesn't start a second refresh: if the current
+   *   token differs from the one it sent, it just retries with the new one.
+   * - A refresh that throws, or doesn't settle within the request timeout,
+   *   counts as "still signed out": the original 401 surfaces.
+   */
+  async recoverSession(sentAuthorization) {
+    if (!this.onUnauthorized || !this.getAccessToken) return false;
+    if (!this.unauthorizedInFlight) {
+      try {
+        const current = await withTimeout(this.getAccessToken(), this.timeout, "getAccessToken");
+        if (current && `Bearer ${current}` !== sentAuthorization) return true;
+      } catch {
+        return false;
+      }
+    }
+    if (!this.unauthorizedInFlight) {
+      const call = this.onUnauthorized;
+      const inFlight = (async () => {
+        try {
+          return await withTimeout(call(), this.timeout, "onUnauthorized");
+        } catch {
+          return false;
+        }
+      })().finally(() => {
+        if (this.unauthorizedInFlight === inFlight) this.unauthorizedInFlight = void 0;
+      });
+      this.unauthorizedInFlight = inFlight;
+    }
+    return this.unauthorizedInFlight;
+  }
+  buildUrl(path, params) {
+    const url = new URL(`${this.baseUrl}${path}`);
+    if (params) {
+      for (const [key, value] of Object.entries(params)) {
+        if (value !== void 0 && value !== null) {
+          url.searchParams.set(key, String(value));
+        }
+      }
+    }
+    return url.toString();
+  }
+  parseRetryAfter(response) {
+    const header = response.headers.get("Retry-After");
+    if (header) {
+      const seconds = Number(header);
+      if (!Number.isNaN(seconds) && seconds > 0) {
+        return seconds;
+      }
+    }
+    return 1;
+  }
+  async mapError(response) {
+    let body = {};
+    try {
+      body = await response.json();
+    } catch {
+    }
+    const envelope = body["error"];
+    const message = (typeof body["message"] === "string" ? body["message"] : void 0) ?? (typeof envelope?.message === "string" ? envelope.message : void 0) ?? response.statusText ?? "Request failed";
+    switch (response.status) {
+      case 400: {
+        const fieldErrors = body["errors"] ?? [];
+        return new ValidationError(message, fieldErrors);
+      }
+      case 401:
+        return new AuthenticationError(message);
+      case 403:
+        return new AuthorizationError(message);
+      case 404:
+        return new NotFoundError(message);
+      case 429: {
+        const retryAfter = this.parseRetryAfter(response);
+        return new RateLimitError(retryAfter, message);
+      }
+      default:
+        if (response.status >= 500) {
+          return new ServerError(message);
+        }
+        return new PlanesError(message, response.status, "unknown_error");
+    }
+  }
+  sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+  }
+};
+function timeoutSignal(ms) {
+  if (typeof AbortSignal.timeout === "function") {
+    return { signal: AbortSignal.timeout(ms), clear: () => void 0 };
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), ms);
+  return { signal: controller.signal, clear: () => clearTimeout(timer) };
+}
+function withTimeout(promise, ms, what) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error(`${what} did not settle within ${ms}ms`)), ms);
+    Promise.resolve(promise).then(
+      (value) => {
+        clearTimeout(timer);
+        resolve(value);
+      },
+      (err) => {
+        clearTimeout(timer);
+        reject(err);
+      }
+    );
+  });
+}
+
+// src/resources/base-resource.ts
+var ApiResource = class {
+  constructor(http, basePath) {
+    this.http = http;
+    this.basePath = basePath;
+  }
+};
+var BaseResource = class extends ApiResource {
+  /**
+   * List entities with optional filters and pagination.
+   */
+  async list(params) {
+    return this.http.request({
+      method: "GET",
+      path: this.basePath,
+      params
+    });
+  }
+  /**
+   * Get a single entity by ID.
+   */
+  async get(id) {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/${id}`
+    });
+  }
+  /**
+   * Create a new entity. Pass `idempotencyKey` (a UUID you keep for retries) to
+   * make a retry safe on routes that honor it (customers, opportunities, contacts,
+   * tasks): a repeat returns the first response and creates nothing.
+   */
+  async create(data, options) {
+    return this.http.request({
+      method: "POST",
+      path: this.basePath,
+      body: data,
+      ...options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : {}
+    });
+  }
+  /**
+   * Update an existing entity.
+   */
+  async update(id, data) {
+    return this.http.request({
+      method: "PATCH",
+      path: `${this.basePath}/${id}`,
+      body: data
+    });
+  }
+  /**
+   * Delete an entity by ID.
+   */
+  async delete(id) {
+    await this.http.request({
+      method: "DELETE",
+      path: `${this.basePath}/${id}`
+    });
+  }
+};
+
+// src/resources/query-params.ts
+function toQueryParams(params) {
+  const out = {};
+  if (!params) return out;
+  for (const [key, value] of Object.entries(params)) {
+    if (value === void 0 || value === null) continue;
+    if (key === "customFields" && typeof value === "object" && !Array.isArray(value)) {
+      for (const [field, v] of Object.entries(value)) {
+        if (v !== void 0 && v !== null) out[`cf.${field}`] = String(v);
+      }
+      continue;
+    }
+    if (Array.isArray(value)) {
+      if (value.length === 0) continue;
+      out[key] = value.map(String).join(",");
+    } else {
+      out[key] = value;
+    }
+  }
+  return out;
+}
+
+// src/resources/opportunities.ts
+var OpportunityResource = class extends BaseResource {
+  constructor(http) {
+    super(http, "/opportunities");
+  }
+  /**
+   * List opportunities. `tag_ids` is ANY-of and travels as one comma-separated
+   * query value (`?tag_ids=a,b`), which is what the API's filter schema parses.
+   */
+  async list(params) {
+    return this.http.request({
+      method: "GET",
+      path: this.basePath,
+      params: toQueryParams(params)
+    });
+  }
+  /**
+   * GET /opportunities/trade-options — the active trades a client can request
+   * (`requestedTradeIds` on create/update), sorted by name.
+   */
+  async tradeOptions() {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/trade-options`
+    });
+  }
+  /** PUT /opportunities/{id} — partial update; stage moves go through workflow transitions. */
+  async update(id, data) {
+    return this.http.request({
+      method: "PUT",
+      path: `${this.basePath}/${id}`,
+      body: data
+    });
+  }
+  /** GET /opportunities/:id/transitions — the pipeline moves available from the current stage, for the caller's role. */
+  async listTransitions(id) {
+    return this.http.request({ method: "GET", path: `${this.basePath}/${id}/transitions` });
+  }
+  /**
+   * POST /opportunities/:id/transition — take one pipeline move, as the stage button does: required
+   * fields are checked, the move is logged, and the stage's automations run (they can send email).
+   */
+  async transition(id, data) {
+    return this.http.request({ method: "POST", path: `${this.basePath}/${id}/transition`, body: data });
+  }
+  /** GET /opportunities/:id/workflow — the pipeline instance with its transition history (404 if none). */
+  async getWorkflow(id) {
+    return this.http.request({ method: "GET", path: `${this.basePath}/${id}/workflow` });
+  }
+};
+
+// src/resources/customers.ts
+var CustomerResource = class extends BaseResource {
+  constructor(http) {
+    super(http, "/customers");
+  }
+  /**
+   * Update a customer. The API route is `PUT /customers/{id}` (not PATCH like
+   * the other resources), so this overrides the base verb; the body is still a
+   * partial — send only the fields to change. See `UpdateCustomerDto.address`
+   * for how a service address resolves to a property.
+   */
+  async update(id, data) {
+    return this.http.request({
+      method: "PUT",
+      path: `/customers/${id}`,
+      body: data
+    });
+  }
+  /**
+   * List customers. `tag_ids` is ANY-of and travels as one comma-separated
+   * query value (`?tag_ids=a,b`), which is what the API's filter schema parses.
+   */
+  async list(params) {
+    return this.http.request({
+      method: "GET",
+      path: this.basePath,
+      params: toQueryParams(params)
+    });
+  }
+  /**
+   * Fold a duplicate company (`loserId`) into a survivor (`winnerId`).
+   *
+   * Everything hanging off the loser moves to the winner, the winner's empty
+   * fields are filled from the loser, and the loser is soft-deleted with a
+   * resolvable pointer — `GET /customers/{loserId}` afterwards returns the
+   * winner's detail with a `mergedFrom` pointer, so a stored loser id keeps
+   * working. Irreversible; requires admin scope.
+   */
+  async merge(winnerId, loserId) {
+    return this.http.request({
+      method: "POST",
+      path: `/customers/${winnerId}/merge/${loserId}`
+    });
+  }
+  /**
+   * POST /customers/{id}/convert-to-company — turn a person customer into a
+   * company. The person becomes the company's primary contact (their email and
+   * phone, with do-not-contact and marketing opt-outs carried over). A customer
+   * that's already a company is a 409 `ALREADY_COMPANY`.
+   */
+  async convertToCompany(id, data = {}) {
+    return this.http.request({
+      method: "POST",
+      path: `${this.basePath}/${id}/convert-to-company`,
+      body: data
+    });
+  }
+};
+
+// src/resources/properties.ts
+var PropertyResource = class extends ApiResource {
+  constructor(http) {
+    super(http, "/properties");
+  }
+  /** GET /customers/{customerId}/properties — paginated (`page`, `limit` ≤ 100). */
+  async list(customerId, params) {
+    return this.http.request({
+      method: "GET",
+      path: `/customers/${customerId}/properties`,
+      params: toQueryParams(params)
+    });
+  }
+  /** GET /properties/{id} — one property, without naming its customer. */
+  async get(id) {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/${id}`
+    });
+  }
+  /** POST /customers/{customerId}/properties — the property inherits the customer's org path. */
+  async create(customerId, data) {
+    return this.http.request({
+      method: "POST",
+      path: `/customers/${customerId}/properties`,
+      body: data
+    });
+  }
+  /** PUT /customers/{customerId}/properties/{id} — partial update. */
+  async update(customerId, id, data) {
+    return this.http.request({
+      method: "PUT",
+      path: `/customers/${customerId}/properties/${id}`,
+      body: data
+    });
+  }
+  /** GET /customers/:customerId/properties/:id — one property, checked against its customer (404 if it isn't theirs). */
+  async getForCustomer(customerId, id) {
+    return this.http.request({
+      method: "GET",
+      path: `/customers/${customerId}/properties/${id}`
+    });
+  }
+  /** POST /properties/:id/geocode — queue a fresh geocode of the property's address. */
+  async geocode(id) {
+    return this.http.request({ method: "POST", path: `${this.basePath}/${id}/geocode` });
+  }
+  /** DELETE /customers/{customerId}/properties/{id} — soft delete (204). */
+  async delete(customerId, id) {
+    await this.http.request({
+      method: "DELETE",
+      path: `/customers/${customerId}/properties/${id}`
+    });
+  }
+};
+
+// src/resources/calendar-events.ts
+var CalendarEventResource = class extends BaseResource {
+  constructor(http) {
+    super(http, "/events");
+  }
+  async list(params) {
+    return this.http.request({
+      method: "GET",
+      path: this.basePath,
+      params: params ?? {}
+    });
+  }
+  /**
+   * PATCH /events/:id. For an occurrence of a recurring event, `editMode`
+   * picks which occurrences change (`this` when omitted — the server's
+   * default); it is ignored for one-time events.
+   */
+  async update(id, data, options = {}) {
+    return this.http.request({
+      method: "PATCH",
+      path: `${this.basePath}/${id}`,
+      params: { recurrence_edit_mode: options.editMode },
+      body: data
+    });
+  }
+  /**
+   * POST /events/:id/complete — marks the event completed and runs its "on
+   * complete" transition, best-effort. The event is completed even when the
+   * transition can't run; `workflow_trigger` says whether it fired, was
+   * skipped (none set, or `handled_by_pipeline_rule`: the pipeline's rule
+   * moves the record instead) or failed (with a reason).
+   */
+  async complete(id, body = {}) {
+    return this.http.request({
+      method: "POST",
+      path: `${this.basePath}/${id}/complete`,
+      body
+    });
+  }
+  /**
+   * POST /events/:id/cancel. For an occurrence of a recurring event, `editMode`
+   * picks which occurrences are cancelled (`this` when omitted). 409 if already
+   * cancelled; 422 for a completed event.
+   */
+  async cancel(id, options = {}) {
+    return this.http.request({
+      method: "POST",
+      path: `${this.basePath}/${id}/cancel`,
+      params: { recurrence_edit_mode: options.editMode }
+    });
+  }
+  /** POST /events/:id/participants — add a user, contact, crew or agent to the event. No invite is sent. */
+  async addParticipant(id, data) {
+    return this.http.request({
+      method: "POST",
+      path: `${this.basePath}/${id}/participants`,
+      body: data
+    });
+  }
+  /** PATCH /events/:id/participants/:participantId — set a participant's response. */
+  async updateParticipantStatus(id, participantId, status) {
+    return this.http.request({
+      method: "PATCH",
+      path: `${this.basePath}/${id}/participants/${participantId}`,
+      body: { status }
+    });
+  }
+};
+
+// src/resources/contracts.ts
+var ContractResource = class extends BaseResource {
+  constructor(http) {
+    super(http, "/contracts");
+  }
+  /** POST /contracts/for-subject — a bare agreement for a customer or a service schedule (no opportunity, no line groups). */
+  async createForSubject(data) {
+    return this.http.request({ method: "POST", path: `${this.basePath}/for-subject`, body: data });
+  }
+  /** POST /contracts/flat — a contract on an opportunity with a manually entered total and a contract template, no estimates. */
+  async createFlat(data) {
+    return this.http.request({ method: "POST", path: `${this.basePath}/flat`, body: data });
+  }
+  /** POST /contracts/{id}/change-orders — a change order on a signed or fulfilled contract (409 otherwise). */
+  async createChangeOrder(id, data) {
+    return this.http.request({
+      method: "POST",
+      path: `${this.basePath}/${id}/change-orders`,
+      body: data
+    });
+  }
+  /**
+   * GET /contracts/{id}/change-orders — the change orders written against a
+   * contract, oldest first, each with its line groups. A change order has none
+   * of its own, so asking for one returns an empty list.
+   */
+  async listChangeOrders(id) {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/${id}/change-orders`
+    });
+  }
+  /** POST /contracts/{id}/submit — submit for approval; auto-approved when under the tenant's threshold. */
+  async submit(id) {
+    return this.http.request({ method: "POST", path: `${this.basePath}/${id}/submit` });
+  }
+  /** POST /contracts/{id}/approve — approve a contract pending approval (needs the approve grant). */
+  async approve(id) {
+    return this.http.request({ method: "POST", path: `${this.basePath}/${id}/approve` });
+  }
+  /** POST /contracts/{id}/cancel — cancel a contract in any state before it's signed. */
+  async cancel(id) {
+    return this.http.request({ method: "POST", path: `${this.basePath}/${id}/cancel` });
+  }
+  /** POST /contracts/{id}/reopen — return a kicked-back contract to draft for review and re-send. */
+  async reopen(id) {
+    return this.http.request({ method: "POST", path: `${this.basePath}/${id}/reopen` });
+  }
+  /**
+   * POST /contracts/{id}/send — **emails the signer a "Review & Sign" link.**
+   * Snapshots the clauses and creates the signing token. An empty body
+   * addresses the customer; `signerContactId` sends it to that contact instead.
+   * The first send of a contract uses one unit of the tenant's e-signature
+   * allowance; a re-send doesn't. Not safe to retry blindly after a timeout: a
+   * repeat emails again.
+   */
+  async send(id, data = {}) {
+    return this.http.request({ method: "POST", path: `${this.basePath}/${id}/send`, body: data });
+  }
+  /**
+   * GET /contracts/{id}/pdf — the contract PDF bytes. `type: 'signed'` returns
+   * the stored signed copy (404 until it's signed); otherwise a preview renders.
+   */
+  async downloadPdf(id, options = {}) {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/${id}/pdf`,
+      params: options.type ? { type: options.type } : {},
+      headers: { Accept: "application/pdf" },
+      responseType: "arrayBuffer"
+    });
+  }
+};
+
+// src/resources/jobs.ts
+var JobResource = class extends ApiResource {
+  constructor(http) {
+    super(http, "/jobs");
+  }
+  /** The jobs under one opportunity — the same route as `listForOpportunity()`. */
+  async list(opportunityId, params) {
+    return this.listForOpportunity(opportunityId, params);
+  }
+  /**
+   * List the jobs under one opportunity — `GET /opportunities/{opportunityId}/jobs`,
+   * the API's job list route. Default order is `created_at` desc;
+   * `sort_by: 'recent'` puts the calling user's most recently opened jobs first.
+   */
+  async listForOpportunity(opportunityId, params) {
+    return this.http.request({
+      method: "GET",
+      path: `/opportunities/${opportunityId}/jobs`,
+      params: toQueryParams(params)
+    });
+  }
+  /** GET /opportunities/{opportunityId}/jobs/{id} */
+  async get(opportunityId, id) {
+    return this.http.request({
+      method: "GET",
+      path: `/opportunities/${opportunityId}/jobs/${id}`
+    });
+  }
+  /**
+   * POST /opportunities/{opportunityId}/jobs — 422 WORKFLOW_NOT_CONFIGURED when
+   * the trade has no published job workflow (check `getTradeCoverage()` first).
+   */
+  async create(opportunityId, data) {
+    return this.http.request({
+      method: "POST",
+      path: `/opportunities/${opportunityId}/jobs`,
+      body: data
+    });
+  }
+  /** PUT /opportunities/{opportunityId}/jobs/{id} — partial update (status, notes). */
+  async update(opportunityId, id, data) {
+    return this.http.request({
+      method: "PUT",
+      path: `/opportunities/${opportunityId}/jobs/${id}`,
+      body: data
+    });
+  }
+  /** DELETE /opportunities/{opportunityId}/jobs/{id} — soft delete (204). */
+  async delete(opportunityId, id) {
+    await this.http.request({
+      method: "DELETE",
+      path: `/opportunities/${opportunityId}/jobs/${id}`
+    });
+  }
+  /**
+   * GET /jobs/trade-coverage — every active trade with whether a job can be
+   * created under it (a published job workflow resolves: the trade's own or the
+   * generic one). Check before creating a job to avoid a 422
+   * WORKFLOW_NOT_CONFIGURED. Readable by any role that can create jobs (403
+   * otherwise); carries no workflow details.
+   */
+  async getTradeCoverage() {
+    return this.http.request({
+      method: "GET",
+      path: "/jobs/trade-coverage"
+    });
+  }
+  /** GET /jobs/{id}/workflow — the job's pipeline instance with its transition history (404 if none). */
+  async getWorkflow(id) {
+    return this.http.request({ method: "GET", path: `${this.basePath}/${id}/workflow` });
+  }
+  /**
+   * POST /jobs/{id}/transition — take one pipeline move, as the stage button
+   * does: required fields are checked, the move is logged, and **the
+   * transition's actions run**. A tenant can attach actions that create or send
+   * an invoice, charge a saved card, send a contract, or send email, SMS or a
+   * webhook. Not safe to retry blindly after a timeout: check `getWorkflow()`
+   * first, because a repeat runs the actions again.
+   */
+  async transition(id, data) {
+    return this.http.request({ method: "POST", path: `${this.basePath}/${id}/transition`, body: data });
+  }
+  /** GET /jobs/{id}/transitions — the pipeline moves available from the job's current stage, for the caller's role. */
+  async listTransitions(id) {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/${id}/transitions`
+    });
+  }
+};
+
+// src/resources/estimates.ts
+var EstimateResource = class extends ApiResource {
+  constructor(http) {
+    super(http, "/estimates");
+  }
+  /** GET /jobs/{jobId}/estimates — newest first, paginated (`page`, `limit` ≤ 100). */
+  async list(jobId, params) {
+    return this.http.request({
+      method: "GET",
+      path: `/jobs/${jobId}/estimates`,
+      params: toQueryParams(params)
+    });
+  }
+  /**
+   * Every estimate across all of one opportunity's jobs, in one request —
+   * `GET /opportunities/{opportunityId}/estimates`. Newest first; each row
+   * carries its `jobId`. Paginated with `page` / `limit` (max 100).
+   */
+  async listForOpportunity(opportunityId, params) {
+    return this.http.request({
+      method: "GET",
+      path: `/opportunities/${opportunityId}/estimates`,
+      params: toQueryParams(params)
+    });
+  }
+  /** GET /jobs/{jobId}/estimates/{id} — the estimate with its line items. */
+  async get(jobId, id) {
+    return this.http.request({
+      method: "GET",
+      path: `/jobs/${jobId}/estimates/${id}`
+    });
+  }
+  /** POST /jobs/{jobId}/estimates — optionally cloned from an estimate template. */
+  async create(jobId, data) {
+    return this.http.request({
+      method: "POST",
+      path: `/jobs/${jobId}/estimates`,
+      body: data
+    });
+  }
+  /** PUT /jobs/{jobId}/estimates/{id} — partial update (measurements, notes, discount, tax). */
+  async update(jobId, id, data) {
+    return this.http.request({
+      method: "PUT",
+      path: `/jobs/${jobId}/estimates/${id}`,
+      body: data
+    });
+  }
+  /** DELETE /jobs/{jobId}/estimates/{id} — soft delete (204). */
+  async delete(jobId, id) {
+    await this.http.request({
+      method: "DELETE",
+      path: `/jobs/${jobId}/estimates/${id}`
+    });
+  }
+  /** GET /estimates/{id}/workflow — the estimate's pipeline instance with its transition history (404 if none). */
+  async getWorkflow(id) {
+    return this.http.request({ method: "GET", path: `${this.basePath}/${id}/workflow` });
+  }
+  /**
+   * POST /estimates/{id}/transition — take one pipeline move. **The
+   * transition's actions run**, as for `jobs.transition()`: a tenant can attach
+   * actions that bill, charge, send a contract, or send email, SMS or a webhook.
+   * Not safe to retry blindly after a timeout: check `getWorkflow()` first.
+   */
+  async transition(id, data) {
+    return this.http.request({ method: "POST", path: `${this.basePath}/${id}/transition`, body: data });
+  }
+  /**
+   * PUT /jobs/{jobId}/estimates/{id}/status — move the estimate's status (see
+   * `UpdateEstimateStatusDto` for the allowed moves). The route itself sends
+   * nothing and creates no contract or invoice; a tenant's webhooks or
+   * automations on the status change can.
+   */
+  async updateStatus(jobId, id, data) {
+    return this.http.request({
+      method: "PUT",
+      path: `/jobs/${jobId}/estimates/${id}/status`,
+      body: data
+    });
+  }
+  /** GET /estimates/{id}/transitions — the pipeline moves available from the estimate's current stage, for the caller's role. */
+  async listTransitions(id) {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/${id}/transitions`
+    });
+  }
+  /**
+   * POST /jobs/{jobId}/estimates/{estimateId}/line-items — add a line item. With
+   * `materialCatalogId` or `tradeLaborItemId`, the catalog fills in description,
+   * unit and price. The estimate's subtotal and total are recalculated.
+   */
+  async createLineItem(jobId, estimateId, data) {
+    return this.http.request({
+      method: "POST",
+      path: `/jobs/${jobId}/estimates/${estimateId}/line-items`,
+      body: data
+    });
+  }
+  /** PUT /jobs/{jobId}/estimates/{estimateId}/line-items/{id} — partial update; totals are recalculated. */
+  async updateLineItem(jobId, estimateId, id, data) {
+    return this.http.request({
+      method: "PUT",
+      path: `/jobs/${jobId}/estimates/${estimateId}/line-items/${id}`,
+      body: data
+    });
+  }
+  /** DELETE /jobs/{jobId}/estimates/{estimateId}/line-items/{id} — totals are recalculated. */
+  async deleteLineItem(jobId, estimateId, id) {
+    await this.http.request({
+      method: "DELETE",
+      path: `/jobs/${jobId}/estimates/${estimateId}/line-items/${id}`
+    });
+  }
+  /** PUT /jobs/{jobId}/estimates/{estimateId}/line-items/reorder — set each item's `sortOrder` (and optionally `section`) in one call. */
+  async reorderLineItems(jobId, estimateId, data) {
+    return this.http.request({
+      method: "PUT",
+      path: `/jobs/${jobId}/estimates/${estimateId}/line-items/reorder`,
+      body: data
+    });
+  }
+};
+
+// src/resources/invoices.ts
+var InvoiceResource = class extends BaseResource {
+  constructor(http) {
+    super(http, "/admin/invoices");
+  }
+  /** List invoices, newest first. Each row carries the customer's `customerName`. */
+  async list(params) {
+    return this.http.request({
+      method: "GET",
+      path: this.basePath,
+      params
+    });
+  }
+  /**
+   * GET /admin/invoices/:id — the invoice with its line items, payments
+   * (including any `needs_review` payment) and `payLink` state.
+   */
+  async get(id) {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/${id}`
+    });
+  }
+  /**
+   * POST /admin/invoices/:id/pay-link — issue a fresh durable pay link for a
+   * `sent` or `partially_paid` invoice (Send Invoice grant) and return its URL,
+   * e.g. to share by text. Rotates: the previously emailed link stops working.
+   * Any other status → 409 `INVOICE_NOT_PAYABLE`.
+   */
+  async createPayLink(id) {
+    return this.http.request({
+      method: "POST",
+      path: `${this.basePath}/${id}/pay-link`
+    });
+  }
+  /**
+   * GET /admin/invoices/:id/pdf — the invoice PDF bytes (Read Invoice grant).
+   * A sent invoice returns the copy stored when it was sent; a draft renders on
+   * demand with a DRAFT watermark.
+   */
+  async downloadPdf(id) {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/${id}/pdf`,
+      headers: { Accept: "application/pdf" },
+      responseType: "arrayBuffer"
+    });
+  }
+  /**
+   * GET /admin/invoices/overdue — sent / partially paid invoices with a balance
+   * past their due date, most overdue first, each with `daysOverdue` and the
+   * last overdue offset reached (E56-F8-S2). Read Invoice.
+   */
+  async listOverdue(params) {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/overdue`,
+      params
+    });
+  }
+  /** GET /admin/invoices/{invoiceId}/payments — every payment recorded against the invoice (Read Payment). */
+  async listPayments(invoiceId) {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/${invoiceId}/payments`
+    });
+  }
+  /**
+   * GET /admin/payments/recording-settings — the tenant's resolved
+   * payment-recording settings (whether manual recording is on, and which
+   * methods). Read Invoice.
+   */
+  async getPaymentRecordingSettings() {
+    return this.http.request({
+      method: "GET",
+      path: "/admin/payments/recording-settings"
+    });
+  }
+  /** GET /admin/invoices/overdue/summary — `{ count, total }` of every overdue invoice. Read Invoice. */
+  async overdueSummary() {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/overdue/summary`
+    });
+  }
+};
+
+// src/resources/inventory.ts
+var InventoryResource = class extends BaseResource {
+  constructor(http) {
+    super(http, "/admin/inventory/items");
+  }
+  async list(params) {
+    return this.http.request({
+      method: "GET",
+      path: this.basePath,
+      params: toQueryParams(params)
+    });
+  }
+  /** PUT /admin/inventory/items/{id} — partial update. */
+  async update(id, data) {
+    return this.http.request({
+      method: "PUT",
+      path: `${this.basePath}/${id}`,
+      body: data
+    });
+  }
+  // ---- Material used on a job (E64-S9). The routes live under /jobs/{jobId}. ----
+  /**
+   * POST /jobs/{jobId}/consumption — record stock drawn from a location for a
+   * job. Each line lowers that location's on-hand quantity.
+   */
+  async recordJobConsumption(jobId, data) {
+    return this.http.request({
+      method: "POST",
+      path: `/jobs/${jobId}/consumption`,
+      body: data
+    });
+  }
+  /**
+   * GET /jobs/{jobId}/consumption — one page of the job's consume and return
+   * movements (newest first by default), the job's totals across every page,
+   * and page metadata. The rows are under `items`, not `data`.
+   */
+  async listJobConsumption(jobId, params) {
+    return this.http.request({
+      method: "GET",
+      path: `/jobs/${jobId}/consumption`,
+      params: toQueryParams(params)
+    });
+  }
+  /** POST /jobs/{jobId}/return — put unused stock from a job back into a location. */
+  async returnFromJob(jobId, data) {
+    return this.http.request({
+      method: "POST",
+      path: `/jobs/${jobId}/return`,
+      body: data
+    });
+  }
+  /** GET /jobs/{jobId}/material-variance — estimated vs actual material for the job. */
+  async getJobMaterialVariance(jobId) {
+    return this.http.request({
+      method: "GET",
+      path: `/jobs/${jobId}/material-variance`
+    });
+  }
+};
+
+// src/resources/contacts.ts
+var ContactChannelResource = class {
+  constructor(http, contactId) {
+    this.http = http;
+    this.contactId = contactId;
+  }
+  /** Returns `{ channel, duplicateOf }` — `duplicateOf` is the dedup signal. */
+  async create(data) {
+    return this.http.request({
+      method: "POST",
+      path: `/contacts/${this.contactId}/channels`,
+      body: data
+    });
+  }
+  async update(channelId, data) {
+    return this.http.request({
+      method: "PATCH",
+      path: `/contacts/${this.contactId}/channels/${channelId}`,
+      body: data
+    });
+  }
+  async delete(channelId) {
+    await this.http.request({
+      method: "DELETE",
+      path: `/contacts/${this.contactId}/channels/${channelId}`
+    });
+  }
+};
+var ContactResource = class extends BaseResource {
+  constructor(http) {
+    super(http, "/contacts");
+  }
+  /**
+   * List contacts. Typed against the real filter schema (customer_id /
+   * property_id / q / sort_by / sort_order / page / limit / include) — the base
+   * `list` would accept any key and let a typo reach the server as a 400.
+   * `include: ['channels', 'links']` attaches each row's channels and active
+   * links in the same response.
+   */
+  async list(params) {
+    return this.http.request({
+      method: "GET",
+      path: this.basePath,
+      params: toQueryParams(params)
+    });
+  }
+  async merge(winnerId, loserId) {
+    return this.http.request({
+      method: "POST",
+      path: `/contacts/${winnerId}/merge/${loserId}`
+    });
+  }
+  /** GET /contacts/roles — the distinct roles in use on active links, for a role picker. */
+  async listRoles() {
+    return this.http.request({ method: "GET", path: "/contacts/roles" });
+  }
+  /** GET /contacts/:id/links — every link, active and ended (history). `get()` returns active links only. */
+  async listLinks(contactId) {
+    return this.http.request({ method: "GET", path: `/contacts/${contactId}/links` });
+  }
+  /** POST /contacts/:id/links — link the contact to a customer or property. */
+  async addLink(contactId, data) {
+    return this.http.request({ method: "POST", path: `/contacts/${contactId}/links`, body: data });
+  }
+  /** PATCH /contacts/:id/links/:linkId — change role/primary, or end the link (`endedAt`). */
+  async updateLink(contactId, linkId, data) {
+    return this.http.request({
+      method: "PATCH",
+      path: `/contacts/${contactId}/links/${linkId}`,
+      body: data
+    });
+  }
+  /** POST /contacts/:id/workflow/start — opt the contact into the relationship pipeline (409 if started). */
+  async startWorkflow(contactId) {
+    return this.http.request({ method: "POST", path: `/contacts/${contactId}/workflow/start` });
+  }
+  /** GET /contacts/:id/workflow — current stage and the transitions available from it. */
+  async getWorkflow(contactId) {
+    return this.http.request({ method: "GET", path: `/contacts/${contactId}/workflow` });
+  }
+  /** POST /contacts/:id/workflow/transitions/:transitionId — 422 for an invalid move or unmet required fields. */
+  async transition(contactId, transitionId) {
+    return this.http.request({
+      method: "POST",
+      path: `/contacts/${contactId}/workflow/transitions/${transitionId}`,
+      body: {}
+    });
+  }
+  /** GET /contacts/:id/workflow/history */
+  async getWorkflowHistory(contactId) {
+    return this.http.request({ method: "GET", path: `/contacts/${contactId}/workflow/history` });
+  }
+  channels(contactId) {
+    return new ContactChannelResource(this.http, contactId);
+  }
+};
+
+// src/resources/activities.ts
+var ActivityResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  async create(data) {
+    return this.http.request({
+      method: "POST",
+      path: "/activities",
+      body: data
+    });
+  }
+  async list(params) {
+    return this.http.request({
+      method: "GET",
+      path: "/activities",
+      params
+    });
+  }
+  async listForEntity(entityType, entityId, params) {
+    return this.http.request({
+      method: "GET",
+      path: `/${entityType}/${entityId}/activities`,
+      params
+    });
+  }
+};
+
+// src/resources/communications.ts
+var CommunicationsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  async log(data) {
+    return this.http.request({
+      method: "POST",
+      path: "/communications",
+      body: data
+    });
+  }
+  async list(params) {
+    return this.http.request({
+      method: "GET",
+      path: "/communications",
+      params
+    });
+  }
+  async get(id) {
+    return this.http.request({
+      method: "GET",
+      path: `/communications/${id}`
+    });
+  }
+  async link(id, data) {
+    return this.http.request({
+      method: "POST",
+      path: `/communications/${id}/link`,
+      body: data
+    });
+  }
+};
+
+// src/resources/conversations.ts
+var ConversationsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  async log(data) {
+    return this.http.request({ method: "POST", path: "/conversations", body: data });
+  }
+  async list(params) {
+    return this.http.request({ method: "GET", path: "/conversations", params });
+  }
+  /** The review queue: `list()` pinned to `match_status: 'needs_review'`. */
+  async reviewQueue(params) {
+    return this.list({ ...params, match_status: "needs_review" });
+  }
+  async get(id) {
+    return this.http.request({ method: "GET", path: `/conversations/${encodeURIComponent(id)}` });
+  }
+  async update(id, data) {
+    return this.http.request({ method: "PATCH", path: `/conversations/${encodeURIComponent(id)}`, body: data });
+  }
+  async delete(id) {
+    await this.http.request({ method: "DELETE", path: `/conversations/${encodeURIComponent(id)}` });
+  }
+  async link(id, data) {
+    return this.http.request({ method: "POST", path: `/conversations/${encodeURIComponent(id)}/links`, body: data });
+  }
+  async unlink(id, linkId) {
+    return this.http.request({
+      method: "DELETE",
+      path: `/conversations/${encodeURIComponent(id)}/links/${encodeURIComponent(linkId)}`
+    });
+  }
+  async resolve(id, data) {
+    return this.http.request({ method: "POST", path: `/conversations/${encodeURIComponent(id)}/resolve`, body: data });
+  }
+  async getInternalDomains() {
+    return this.http.request({ method: "GET", path: "/conversations/settings/internal-domains" });
+  }
+  /** Requires an admin: the server checks `Update` on `Subject.Tenant` (tenant-wide matching config), not `Subject.Conversation`. */
+  async setInternalDomains(data) {
+    return this.http.request({ method: "PUT", path: "/conversations/settings/internal-domains", body: data });
+  }
+  /**
+   * E57-F2-S4 — disconnect the CALLER's own Circleback connection (Update
+   * Conversation). Another user's connection id is a 404. Connecting is the
+   * interactive browser OAuth flow (Settings → Conversations), not an SDK call.
+   */
+  async disconnectCircleback(data) {
+    return this.http.request({
+      method: "POST",
+      path: "/conversations/sources/circleback/disconnect",
+      body: data
+    });
+  }
+  /**
+   * E57-F2-S8 — pull one company's meetings from every active teammate's
+   * connected source (Update Conversation). 202, runs in the background.
+   * 404 for a company you can't see; 409 `NO_SOURCES` when nobody has one.
+   */
+  async pull(data) {
+    return this.http.request({ method: "POST", path: "/conversations/pull", body: data });
+  }
+  /**
+   * E57-F2-S9 — whether a Pull has finished: pass the `job_ids` `pull()`
+   * returned (1–50). Update Conversation, like `pull()`. 404
+   * `PULL_NOT_FOUND` when none of them is readable (expired after ~2h,
+   * unknown) — treat that as settled.
+   */
+  async getPullStatus(jobIds) {
+    return this.http.request({
+      method: "GET",
+      path: "/conversations/pull/status",
+      params: { job_ids: jobIds.join(",") }
+    });
+  }
+  /** E57-F2-S8 — sync the caller's OWN Circleback connection now (deduplicated). 409 `NO_CONNECTION` when they have none. */
+  async syncNow() {
+    return this.http.request({ method: "POST", path: "/conversations/sources/circleback/sync-now" });
+  }
+  /** E57-F2-S8 — the caller's own connection, `has_sources`, and (admins only) the roster. */
+  async syncStatus() {
+    return this.http.request({ method: "GET", path: "/conversations/sync-status" });
+  }
+  /**
+   * E57-F4-S1 — a synced meeting's transcript, fetched live from the meeting
+   * recorder (never stored by Planes; the response is `Cache-Control:
+   * no-store`). Read Conversation, plus the tenant's transcript-access rule:
+   * 403 `TRANSCRIPT_OWNER_ONLY` under `owner` for a non-owner; 409
+   * `TRANSCRIPT_SOURCE_UNAVAILABLE` (`owner_name` says who must reconnect) or
+   * `TRANSCRIPT_NOT_AVAILABLE` (not a synced meeting); 404 when you can't see
+   * the conversation. `segments: []` = no transcript yet.
+   */
+  async getTranscript(id) {
+    return this.http.request({
+      method: "GET",
+      path: `/conversations/${encodeURIComponent(id)}/transcript`
+    });
+  }
+  /** E57-F4-S1 — who can view transcripts: `owner` (default) or `viewers`. Read Conversation. */
+  async getTranscriptAccess() {
+    return this.http.request({ method: "GET", path: "/conversations/settings/transcript-access" });
+  }
+  /** E57-F4-S1 — requires an admin: the server checks `Update` on `Subject.Tenant`. */
+  async setTranscriptAccess(value) {
+    return this.http.request({
+      method: "PUT",
+      path: "/conversations/settings/transcript-access",
+      body: { transcript_access: value }
+    });
+  }
+};
+
+// src/resources/gmail.ts
+var GmailResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /**
+   * Send an email RIGHT NOW from the connected user's real Gmail address.
+   * Hits `POST /admin/integrations/google/gmail/send` — final per Task 4
+   * (`apps/api/src/modules/integrations/google/google-connection.controller.ts`).
+   */
+  async send(data) {
+    return this.http.request({
+      method: "POST",
+      path: "/admin/integrations/google/gmail/send",
+      body: data
+    });
+  }
+};
+
+// src/resources/documents.ts
+var DocumentsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /** Attach an external (link-only) document — e.g. a Google Drive link — to a record. */
+  async attachExternal(data) {
+    return this.http.request({
+      method: "POST",
+      path: "/documents/external",
+      body: data
+    });
+  }
+  /** Documents filed directly on one record (uploaded + external), newest first. */
+  async listForEntity(entityType, entityId) {
+    return this.http.request({
+      method: "GET",
+      path: `/${entityType}/${entityId}/documents`
+    });
+  }
+};
+
+// src/resources/tags.ts
+var TagResource = class extends ApiResource {
+  constructor(http) {
+    super(http, "/tags");
+  }
+  /** GET /tags */
+  async list(params) {
+    return this.http.request({
+      method: "GET",
+      path: this.basePath,
+      params
+    });
+  }
+  /** POST /tags — 409 on a case-insensitive duplicate name. */
+  async create(data) {
+    return this.http.request({ method: "POST", path: this.basePath, body: data });
+  }
+  /** PATCH /tags/:id — rename / recolor; 409 on a case-insensitive duplicate name. */
+  async update(id, data) {
+    return this.http.request({ method: "PATCH", path: `${this.basePath}/${id}`, body: data });
+  }
+  /** DELETE /tags/:id — cascades the tag off every record. */
+  async delete(id) {
+    await this.http.request({ method: "DELETE", path: `${this.basePath}/${id}` });
+  }
+  /**
+   * POST /tags/:winnerId/merge/:loserId — fold a duplicate tag into another: records
+   * move to the winner (`retagged`), duplicates are dropped (`dropped`), and the
+   * loser is deleted. Irreversible.
+   */
+  async merge(winnerId, loserId) {
+    return this.http.request({ method: "POST", path: `${this.basePath}/${winnerId}/merge/${loserId}` });
+  }
+  /** `TagsService.setEntityTags()` returns the final tag set wrapped in `{ tags }`. */
+  async setEntityTags(entityType, entityId, data) {
+    return this.http.request({
+      method: "PUT",
+      path: `/entities/${entityType}/${entityId}/tags`,
+      body: data
+    });
+  }
+  /**
+   * POST /entities/:type/:id/tags — add ONE tag, keeping the record's other tags.
+   * Safe to call concurrently with other tag changes on the same record (unlike
+   * read-modify-write through `setEntityTags()`). Adding a tag the record already
+   * carries is a no-op. Returns the record's full tag set.
+   */
+  async addEntityTag(entityType, entityId, ref) {
+    const body = ref.tagId !== void 0 ? { tag_id: ref.tagId } : { tag_name: ref.tagName };
+    return this.http.request({
+      method: "POST",
+      path: `/entities/${entityType}/${entityId}/tags`,
+      body
+    });
+  }
+  /**
+   * DELETE /entities/:type/:id/tags/:tagId — remove ONE tag, keeping the rest.
+   * Removing a tag the record doesn't carry is a no-op. Returns the record's
+   * full tag set.
+   */
+  async removeEntityTag(entityType, entityId, tagId) {
+    return this.http.request({
+      method: "DELETE",
+      path: `/entities/${entityType}/${entityId}/tags/${tagId}`
+    });
+  }
+  async getEntityTags(entityType, entityId) {
+    return this.http.request({
+      method: "GET",
+      path: `/entities/${entityType}/${entityId}/tags`
+    });
+  }
+  async getEntities(tagId, params) {
+    return this.http.request({
+      method: "GET",
+      path: `/tags/${tagId}/entities`,
+      params
+    });
+  }
+};
+
+// src/resources/lists.ts
+var ListsResource = class extends ApiResource {
+  constructor(http) {
+    super(http, "/lists");
+  }
+  /** GET /lists — every list, newest first, each with `member_count`. A bare array. */
+  async list() {
+    return this.http.request({ method: "GET", path: this.basePath });
+  }
+  /**
+   * GET /lists/filter-fields — the standard fields, their types and the operators
+   * each accepts for a smart list of this entity type, and whether custom fields
+   * are accepted (E66-S3). A save that breaks these rules is a 400.
+   */
+  async filterFields(entityType) {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/filter-fields`,
+      params: { entity_type: entityType }
+    });
+  }
+  /** GET /lists/:id — one list with an on-demand `member_count`. */
+  async get(id) {
+    return this.http.request({ method: "GET", path: `${this.basePath}/${id}` });
+  }
+  /** POST /lists */
+  async create(data) {
+    return this.http.request({ method: "POST", path: this.basePath, body: data });
+  }
+  /** PATCH /lists/:id — rename, or replace a smart list's definition. */
+  async update(id, data) {
+    return this.http.request({ method: "PATCH", path: `${this.basePath}/${id}`, body: data });
+  }
+  /** DELETE /lists/:id — soft delete; the records on the list are untouched. */
+  async delete(id) {
+    await this.http.request({ method: "DELETE", path: `${this.basePath}/${id}` });
+  }
+  /** POST /lists/:id/members — static lists only; idempotent on duplicates. */
+  async addMembers(id, members) {
+    return this.http.request({
+      method: "POST",
+      path: `${this.basePath}/${id}/members`,
+      body: { members }
+    });
+  }
+  /** DELETE /lists/:id/members — static lists only. */
+  async removeMembers(id, members) {
+    return this.http.request({
+      method: "DELETE",
+      path: `${this.basePath}/${id}/members`,
+      body: { members }
+    });
+  }
+  /** GET /lists/:id/recipients — people (audience, contact and customer lists), with consent. */
+  async getRecipients(id, params) {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/${id}/recipients`,
+      params
+    });
+  }
+  /** POST /lists/:id/export — queues a CSV export; a notification links the file when it's ready. */
+  async export(id, options) {
+    return this.http.request({
+      method: "POST",
+      path: `${this.basePath}/${id}/export`,
+      body: options ?? {}
+    });
+  }
+};
+
+// src/resources/lead-sources.ts
+var LeadSourcesResource = class extends ApiResource {
+  constructor(http) {
+    super(http, "/lead-sources");
+  }
+  /** GET /lead-sources — active ones by default, in display order. */
+  async list(options) {
+    const res = await this.http.request({
+      method: "GET",
+      path: this.basePath,
+      ...options?.includeInactive ? { params: { includeInactive: "true" } } : {}
+    });
+    return res.data;
+  }
+  /** POST /lead-sources — 409 on a duplicate key. */
+  async create(data) {
+    const res = await this.http.request({ method: "POST", path: this.basePath, body: data });
+    return res.data;
+  }
+  /** PATCH /lead-sources/:id — label, active flag or order; the key can't change. */
+  async update(id, data) {
+    const res = await this.http.request({
+      method: "PATCH",
+      path: `${this.basePath}/${id}`,
+      body: data
+    });
+    return res.data;
+  }
+  /** DELETE /lead-sources/:id — soft delete. */
+  async delete(id) {
+    await this.http.request({ method: "DELETE", path: `${this.basePath}/${id}` });
+  }
+};
+
+// src/resources/tasks.ts
+var TaskResource = class extends ApiResource {
+  constructor(http) {
+    super(http, "/tasks");
+  }
+  async list(params) {
+    return this.http.request({
+      method: "GET",
+      path: this.basePath,
+      params
+    });
+  }
+  /** GET /tasks/:id */
+  async get(id) {
+    return this.http.request({ method: "GET", path: `${this.basePath}/${id}` });
+  }
+  /** POST /tasks. Pass `idempotencyKey` to make a retry safe (E64-S6). */
+  async create(data, options) {
+    return this.http.request({
+      method: "POST",
+      path: this.basePath,
+      body: data,
+      ...options?.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : {}
+    });
+  }
+  /** PATCH /tasks/:id — non-terminal fields only; terminal status changes use the action methods. */
+  async update(id, data) {
+    return this.http.request({ method: "PATCH", path: `${this.basePath}/${id}`, body: data });
+  }
+  /**
+   * POST /tasks/:id/complete — fires the linked workflow transition (best-effort).
+   * The task always completes; `workflow_trigger` says whether the next step ran.
+   */
+  async complete(id) {
+    return this.http.request({ method: "POST", path: `${this.basePath}/${id}/complete` });
+  }
+  /** POST /tasks/:id/cancel */
+  async cancel(id) {
+    return this.http.request({ method: "POST", path: `${this.basePath}/${id}/cancel` });
+  }
+  /** POST /tasks/:id/reopen — the sanctioned resurrect of a completed/cancelled task. */
+  async reopen(id) {
+    return this.http.request({ method: "POST", path: `${this.basePath}/${id}/reopen` });
+  }
+};
+
+// src/resources/record-views.ts
+var RecordViewsResource = class {
+  constructor(http) {
+    this.http = http;
+    this.basePath = "/record-views";
+  }
+  /** POST /record-views — record that the calling user opened this record. Resolves on 204. */
+  async touch(input) {
+    await this.http.request({ method: "POST", path: this.basePath, body: input });
+  }
+  /** GET /record-views/recent — the calling user's most recently viewed records, newest first. */
+  async recent(params) {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/recent`,
+      params: toQueryParams(params)
+    });
+  }
+};
+
+// src/resources/modules.ts
+var ModulesResource = class {
+  constructor(http) {
+    this.http = http;
+    this.basePath = "/modules";
+  }
+  /** GET /modules — one entry per registered module key, in canonical order. */
+  async list() {
+    const res = await this.http.request({
+      method: "GET",
+      path: this.basePath
+    });
+    return res.data;
+  }
+};
+
+// src/resources/plan.ts
+var PlanResource = class {
+  constructor(http) {
+    this.http = http;
+    this.basePath = "/plan";
+  }
+  /** GET /plan — plan, billing status and the plan's ceiling. */
+  async get() {
+    const res = await this.http.request({
+      method: "GET",
+      path: this.basePath
+    });
+    return res.data;
+  }
+};
+
+// src/resources/me.ts
+var MeResource = class {
+  constructor(http) {
+    this.http = http;
+    this.basePath = "/me";
+  }
+  /**
+   * GET /me/abilities — the caller's effective ability: for an API key, the key
+   * role intersected with its acting agent's live role (`actingRole`).
+   */
+  async abilities() {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/abilities`
+    });
+  }
+};
+
+// src/resources/roles.ts
+var RolesResource = class {
+  constructor(http) {
+    this.http = http;
+    this.basePath = "/roles";
+  }
+  /** GET /roles — every role (not `system_agent`) with user and change counts. */
+  async list() {
+    return this.http.request({ method: "GET", path: this.basePath });
+  }
+  /** GET /roles/:key — one role's permission matrix, summary and grant version. */
+  async get(key) {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/${encodeURIComponent(key)}`
+    });
+  }
+  /**
+   * PUT /roles/:key/grants — sparse per-cell changes, all validated before any
+   * is written. 422 `GRANT_REQUIRED` / `GRANT_NOT_DELEGABLE` for locked cells,
+   * `CONFIRMATION_REQUIRED` when a money action is granted without
+   * `confirm: true` + `reason`, `ROLE_NOT_TUNABLE` for admin; 409
+   * `ROLE_VERSION_CONFLICT` on a stale `baseVersion`. Returns the updated role.
+   */
+  async updateGrants(key, body) {
+    return this.http.request({
+      method: "PUT",
+      path: `${this.basePath}/${encodeURIComponent(key)}/grants`,
+      body
+    });
+  }
+  /** DELETE /roles/:key/grants — back to the Planes defaults. Returns the reset role. */
+  async reset(key) {
+    return this.http.request({
+      method: "DELETE",
+      path: `${this.basePath}/${encodeURIComponent(key)}/grants`
+    });
+  }
+  /** GET /roles/history — the change log, newest first; page with `cursor`. */
+  async history(params) {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/history`,
+      ...params ? { params } : {}
+    });
+  }
+};
+
+// src/resources/invoice-settings.ts
+var InvoiceSettingsResource = class {
+  constructor(http) {
+    this.http = http;
+    this.basePath = "/admin/invoice-settings";
+  }
+  /**
+   * GET /admin/invoice-settings/offline-instructions — the plain-text
+   * instructions shown on the pay page when online payment is unavailable,
+   * or null when none are set.
+   */
+  async getOfflineInstructions() {
+    const res = await this.http.request({
+      method: "GET",
+      path: `${this.basePath}/offline-instructions`
+    });
+    return res.instructions;
+  }
+  /**
+   * PUT /admin/invoice-settings/offline-instructions — store plain text
+   * (trimmed, at most 2,000 characters); null or blank clears it. Returns the
+   * stored value.
+   */
+  async setOfflineInstructions(text) {
+    const body = { instructions: text };
+    const res = await this.http.request({
+      method: "PUT",
+      path: `${this.basePath}/offline-instructions`,
+      body
+    });
+    return res.instructions;
+  }
+  /**
+   * GET /admin/invoice-settings/overdue-offsets — the days after the due date
+   * at which `invoice.overdue` fires, ascending (default `[3, 7, 14]`).
+   */
+  async getOverdueOffsets() {
+    const res = await this.http.request({
+      method: "GET",
+      path: `${this.basePath}/overdue-offsets`
+    });
+    return res.offsets;
+  }
+  /**
+   * PUT /admin/invoice-settings/overdue-offsets — replace the offsets: 1 to 5
+   * unique whole days, each 1–90. Returns them sorted ascending. Admin only.
+   */
+  async setOverdueOffsets(offsets) {
+    const body = { offsets };
+    const res = await this.http.request({
+      method: "PUT",
+      path: `${this.basePath}/overdue-offsets`,
+      body
+    });
+    return res.offsets;
+  }
+  /**
+   * GET /admin/invoice-settings/attach-pdf — whether invoice emails carry the
+   * invoice PDF (on unless an admin turned it off).
+   */
+  async getAttachPdf() {
+    const res = await this.http.request({
+      method: "GET",
+      path: `${this.basePath}/attach-pdf`
+    });
+    return res.enabled;
+  }
+  /**
+   * PUT /admin/invoice-settings/attach-pdf — turn the PDF attachment on
+   * invoice emails on or off. Returns the stored value.
+   */
+  async setAttachPdf(enabled) {
+    const body = { enabled };
+    const res = await this.http.request({
+      method: "PUT",
+      path: `${this.basePath}/attach-pdf`,
+      body
+    });
+    return res.enabled;
+  }
+};
+
+// src/resources/invoice-reminders.ts
+var InvoiceRemindersResource = class {
+  constructor(http) {
+    this.http = http;
+    this.basePath = "/admin/invoice-reminders";
+  }
+  /** GET /admin/invoice-reminders — the rules, ascending by offset, and the overdue offsets. */
+  async list() {
+    return this.http.request({
+      method: "GET",
+      path: this.basePath
+    });
+  }
+  /**
+   * PUT /admin/invoice-reminders — replace the WHOLE rule set (a rule left out
+   * is deleted): up to 5 rules at unique offsets. Templates may use only
+   * `{{customerName}}`, `{{invoiceNumber}}`, `{{amountDue}}`, `{{total}}`,
+   * `{{dueDate}}`, `{{daysOverdue}}` and `{{companyName}}`; any other is a 422
+   * `REMINDER_TEMPLATE_INVALID` listing each one. Returns the stored set.
+   */
+  async update(rules) {
+    return this.http.request({
+      method: "PUT",
+      path: this.basePath,
+      body: { rules }
+    });
+  }
+  /**
+   * POST /admin/invoice-reminders/preview — render a subject and body exactly
+   * as the reminder email would, against an invoice or a sample. Sends nothing.
+   */
+  async preview(params) {
+    return this.http.request({
+      method: "POST",
+      path: `${this.basePath}/preview`,
+      body: params
+    });
+  }
+};
+
+// src/resources/event-automations.ts
+var EventAutomationsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  // Each request spells its path out in full (no computed base path) so the
+  // API's SDK route-parity audit (sdk-route-parity-audit.spec.ts) can read it.
+  /** GET — enabled and disabled automations, oldest first, optionally by event type or owner. */
+  async list(params = {}) {
+    const query = {};
+    if (params.owner_tag) query["owner_tag"] = params.owner_tag;
+    if (params.event_type) query["event_type"] = params.event_type;
+    const res = await this.http.request({
+      method: "GET",
+      path: "/admin/event-automations",
+      params: query
+    });
+    return res.data;
+  }
+  /** GET /:id — 404 when it doesn't exist or was deleted. */
+  async get(id) {
+    return this.http.request({
+      method: "GET",
+      path: `/admin/event-automations/${encodeURIComponent(id)}`
+    });
+  }
+  /**
+   * POST — create (201). 400 `VALIDATION_FAILED` for a bad body, or a 400
+   * naming the step whose `action_type` isn't allowed in automations.
+   */
+  async create(input) {
+    return this.http.request({
+      method: "POST",
+      path: "/admin/event-automations",
+      body: input
+    });
+  }
+  /**
+   * PATCH /:id — only the fields sent change. Sending `actions` replaces the
+   * list: keep each existing step's `id` so a step that already ran isn't run
+   * again. `{ enabled: false }` switches it off.
+   */
+  async update(id, input) {
+    return this.http.request({
+      method: "PATCH",
+      path: `/admin/event-automations/${encodeURIComponent(id)}`,
+      body: input
+    });
+  }
+  /** DELETE /:id — soft delete; returns `{ id }` (200). */
+  async delete(id) {
+    return this.http.request({
+      method: "DELETE",
+      path: `/admin/event-automations/${encodeURIComponent(id)}`
+    });
+  }
+};
+
+// src/resources/web-forms.ts
+var WebFormsResource = class {
+  constructor(http) {
+    this.http = http;
+    this.submissions = new WebFormSubmissionsResource(http);
+  }
+  // Each request spells its path out in full so the API's SDK route-parity
+  // audit (sdk-route-parity-audit.spec.ts) can read it.
+  /** GET — every form not archived, newest first. */
+  async list() {
+    const res = await this.http.request({ method: "GET", path: "/admin/web-forms" });
+    return res.data;
+  }
+  /** GET /trade-options — the active trades a `trade` question offers, by current name. */
+  async tradeOptions() {
+    const res = await this.http.request({ method: "GET", path: "/admin/web-forms/trade-options" });
+    return res.data;
+  }
+  /** GET /:id */
+  async get(id) {
+    return this.http.request({ method: "GET", path: `/admin/web-forms/${encodeURIComponent(id)}` });
+  }
+  /** POST — create (201) with its default routing. Pass `recipient_agent_ids`. */
+  async create(input) {
+    return this.http.request({ method: "POST", path: "/admin/web-forms", body: input });
+  }
+  /** PATCH /:id — only the fields sent change. `active: false` switches the form off. */
+  async update(id, input) {
+    return this.http.request({
+      method: "PATCH",
+      path: `/admin/web-forms/${encodeURIComponent(id)}`,
+      body: input
+    });
+  }
+  /** DELETE /:id — archive: the public URL stops working and routing stops. Returns `{ id }`. */
+  async archive(id) {
+    return this.http.request({ method: "DELETE", path: `/admin/web-forms/${encodeURIComponent(id)}` });
+  }
+  /** POST /:id/rotate-key — a new public key; the old embed stops working at once. */
+  async rotateKey(id) {
+    return this.http.request({
+      method: "POST",
+      path: `/admin/web-forms/${encodeURIComponent(id)}/rotate-key`
+    });
+  }
+};
+var WebFormSubmissionsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /** GET /submissions — the first page, newest first, with routing state. Use `listPage` to read on. */
+  async list(params = {}) {
+    return (await this.listPage(params)).data;
+  }
+  /**
+   * GET /submissions — one page plus `next`, which is null on the last page.
+   * Pass `next`'s `before` and `before_id` back in to read the following page.
+   */
+  async listPage(params = {}) {
+    const query = {};
+    for (const [k, v] of Object.entries(params)) if (v !== void 0) query[k] = v;
+    const res = await this.http.request({
+      method: "GET",
+      path: "/admin/web-forms/submissions",
+      params: query
+    });
+    return { data: res.data, next: res.next ?? null };
+  }
+  /** GET /submissions/:id — answers as seen, plus each routing step. */
+  async get(id) {
+    return this.http.request({
+      method: "GET",
+      path: `/admin/web-forms/submissions/${encodeURIComponent(id)}`
+    });
+  }
+  /** PATCH /submissions/:id — set triage status. */
+  async update(id, input) {
+    return this.http.request({
+      method: "PATCH",
+      path: `/admin/web-forms/submissions/${encodeURIComponent(id)}`,
+      body: input
+    });
+  }
+  /** POST /submissions/:id/route — retry failed steps, run never-run ones (not email, text or webhook: `skipped`); safe to repeat. */
+  async route(id) {
+    return this.http.request({
+      method: "POST",
+      path: `/admin/web-forms/submissions/${encodeURIComponent(id)}/route`
+    });
+  }
+};
+
+// src/resources/contact-sequences.ts
+var ContactSequencesResource = class {
+  constructor(http) {
+    this.http = http;
+    this.basePath = "/contact-sequences";
+  }
+  /** GET /contact-sequences — `{ data, meta: { total } }`, name-sorted, max 100. */
+  async list() {
+    return this.http.request({
+      method: "GET",
+      path: this.basePath
+    });
+  }
+};
+
+// src/resources/enrollments.ts
+var EnrollmentsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /**
+   * POST /contacts/:id/enrollments — `{ workflow_id }`. 409 if the contact is
+   * already active in the sequence; 422 if the sequence has no published version.
+   */
+  async enroll(contactId, workflowId) {
+    return this.http.request({
+      method: "POST",
+      path: `/contacts/${contactId}/enrollments`,
+      body: { workflow_id: workflowId }
+    });
+  }
+  /** GET /contacts/:id/enrollments — a bare array, newest first; optional `status` filter. */
+  async list(contactId, params) {
+    return this.http.request({
+      method: "GET",
+      path: `/contacts/${contactId}/enrollments`,
+      ...params ? { params } : {}
+    });
+  }
+  /**
+   * POST /enrollments/:id/exit — no body; the exit reason is recorded as
+   * `'manual'`. Idempotent: an already-ended enrollment is returned unchanged.
+   */
+  async exit(enrollmentId) {
+    return this.http.request({
+      method: "POST",
+      path: `/enrollments/${enrollmentId}/exit`
+    });
+  }
+};
+
+// src/resources/workflow-event-rules.ts
+var WorkflowEventRulesResource = class {
+  constructor(http, workflowId) {
+    this.http = http;
+    this.workflowId = workflowId;
+  }
+  // Each request spells its path out in full (no computed base path) so the
+  // API's SDK route-parity audit (sdk-route-parity-audit.spec.ts) can read it.
+  /** GET — a bare array of the workflow's live rules, newest first. 404 `WORKFLOW_NOT_FOUND`. */
+  async list() {
+    return this.http.request({
+      method: "GET",
+      path: `/admin/workflows/${encodeURIComponent(this.workflowId)}/event-rules`
+    });
+  }
+  /**
+   * POST — add a rule (201). `when` defaults to `{}` and `enabled` to true; use
+   * `when: {}` for the creation types in `WORKFLOW_EVENT_RULE_MATCH_ALL_EVENT_TYPES`.
+   * 400 `VALIDATION_FAILED` for a bad body; 404 `WORKFLOW_NOT_FOUND`.
+   */
+  async create(input) {
+    return this.http.request({
+      method: "POST",
+      path: `/admin/workflows/${encodeURIComponent(this.workflowId)}/event-rules`,
+      body: input
+    });
+  }
+  /** PATCH /:id — only the fields sent change (at least one). 404 `EVENT_RULE_NOT_FOUND`. */
+  async update(ruleId, input) {
+    return this.http.request({
+      method: "PATCH",
+      path: `/admin/workflows/${encodeURIComponent(this.workflowId)}/event-rules/${encodeURIComponent(ruleId)}`,
+      body: input
+    });
+  }
+  /** DELETE /:id — soft delete; returns `{ id }` (200). 404 `EVENT_RULE_NOT_FOUND`. */
+  async delete(ruleId) {
+    return this.http.request({
+      method: "DELETE",
+      path: `/admin/workflows/${encodeURIComponent(this.workflowId)}/event-rules/${encodeURIComponent(ruleId)}`
+    });
+  }
+};
+
+// src/resources/workflows.ts
+var WorkflowsResource = class {
+  constructor(http) {
+    this.http = http;
+    this.basePath = "/workflows";
+    this.adminPath = "/admin/workflows";
+  }
+  /**
+   * GET /workflows/:id/stages — the ordered stages of one workflow version. Pass
+   * a record's instance `workflowId` (e.g. from `GET /opportunities/:id/workflow`)
+   * to get the stages of the version that record is pinned to, even an archived
+   * one. 404 for an unknown or draft id; 403 if the caller cannot read the
+   * workflow's record type.
+   */
+  async getStages(workflowId) {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/${encodeURIComponent(workflowId)}/stages`
+    });
+  }
+  /**
+   * GET /workflows/transitions — transition summaries of every published
+   * workflow, or with `workflowId` of that one version (published or archived;
+   * an unknown, draft or other-tenant id returns an empty list). Each summary
+   * carries `workflow_id`, `workflow_version`, `lineage_workflow_id` and
+   * `automatic_only`. Only pipelines whose record type the caller can read
+   * are listed; an unreadable `workflowId` returns an empty list, not 403.
+   */
+  async listTransitions(params = {}) {
+    const query = {};
+    if (params.entityTypes && params.entityTypes.length > 0) query["entity_types"] = params.entityTypes.join(",");
+    if (params.workflowId) query["workflow_id"] = params.workflowId;
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/transitions`,
+      params: query
+    });
+  }
+  /**
+   * POST /admin/workflows/:wid/transitions — add a transition to a draft
+   * workflow. Pass `automaticOnly: true` for an edge only automation should
+   * fire (e.g. an event rule advancing on "contract sent").
+   */
+  async createTransition(workflowId, input) {
+    return this.http.request({
+      method: "POST",
+      path: `${this.adminPath}/${encodeURIComponent(workflowId)}/transitions`,
+      body: input
+    });
+  }
+  /**
+   * The event rules of one workflow (`/admin/workflows/:wid/event-rules`) —
+   * "advance automatically when…". Any version's id works; rules are keyed by
+   * the lineage root.
+   */
+  eventRules(workflowId) {
+    return new WorkflowEventRulesResource(this.http, workflowId);
+  }
+  /** PUT /admin/workflows/:wid/transitions/:tid — update a draft workflow's transition. */
+  async updateTransition(workflowId, transitionId, input) {
+    return this.http.request({
+      method: "PUT",
+      path: `${this.adminPath}/${encodeURIComponent(workflowId)}/transitions/${encodeURIComponent(transitionId)}`,
+      body: input
+    });
+  }
+};
+
+// src/resources/service-schedules.ts
+var ServiceSchedulesResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  // Each request spells its path out in full (no computed base path) so the
+  // API's SDK route-parity audit (sdk-route-parity-audit.spec.ts) can read it.
+  /** GET — the schedules of one customer or opportunity. */
+  async list(subject_type, subject_id) {
+    return this.http.request({
+      method: "GET",
+      path: "/service-schedules",
+      params: { subject_type, subject_id }
+    });
+  }
+  /** GET /:id — 404 when it doesn't exist or was deleted. */
+  async get(id) {
+    return this.http.request({
+      method: "GET",
+      path: `/service-schedules/${encodeURIComponent(id)}`
+    });
+  }
+  /**
+   * POST — create (201). The horizon's visits are generated straight away.
+   * 400 `INVALID_RECURRENCE_RULE`, `SERVICE_TRADE_REQUIRED` or a validation error.
+   */
+  async create(input) {
+    return this.http.request({
+      method: "POST",
+      path: "/service-schedules",
+      body: input
+    });
+  }
+  /**
+   * PATCH /:id — only the fields sent change. A cadence, time, crew, duration
+   * or horizon change regenerates future visits from today (`effective_from`,
+   * which must be today) and reports it in `regeneration`; a visit someone changed is never
+   * touched and is listed under `regeneration.protected`. The edit and its
+   * regeneration succeed or fail together. 400 `INVALID_EFFECTIVE_FROM` for any
+   * date but today.
+   */
+  async update(id, input) {
+    return this.http.request({
+      method: "PATCH",
+      path: `/service-schedules/${encodeURIComponent(id)}`,
+      body: input
+    });
+  }
+  /** POST /:id/preview-update — what `update` with the same input would do. Writes nothing. */
+  async previewUpdate(id, input) {
+    return this.http.request({
+      method: "POST",
+      path: `/service-schedules/${encodeURIComponent(id)}/preview-update`,
+      body: input
+    });
+  }
+  /** PATCH /:id/status — pause, resume (`active`) or end. Resume generates the horizon at once. */
+  async setStatus(id, status) {
+    return this.http.request({
+      method: "PATCH",
+      path: `/service-schedules/${encodeURIComponent(id)}/status`,
+      body: { status }
+    });
+  }
+  /** DELETE /:id — soft-delete (204). */
+  async delete(id) {
+    await this.http.request({
+      method: "DELETE",
+      path: `/service-schedules/${encodeURIComponent(id)}`
+    });
+  }
+  /**
+   * POST /conflicts/preview — before booking people, see who is already on
+   * another event (`conflicts`) and who would be outside their working hours
+   * (`working_hours`). Read-only and warn-only: nothing is ever blocked. Give
+   * exactly one of `windows` (single booking) or `schedule` (a cadence). 400 on
+   * invalid input, INVALID_RECURRENCE_RULE, INVALID_TIMEZONE or
+   * TOO_MANY_WINDOWS (> 400).
+   */
+  async previewConflicts(request) {
+    return this.http.request({
+      method: "POST",
+      path: "/service-schedules/conflicts/preview",
+      body: request
+    });
+  }
+  /** GET /settings/crew-roles — which agent roles count as assignable crew. */
+  async getCrewRoles() {
+    return this.http.request({
+      method: "GET",
+      path: "/service-schedules/settings/crew-roles"
+    });
+  }
+  /** PUT /settings/crew-roles — set the assignable roles (an override of the default). */
+  async setCrewRoles(roles) {
+    return this.http.request({
+      method: "PUT",
+      path: "/service-schedules/settings/crew-roles",
+      body: { roles }
+    });
+  }
+  /** GET /settings/crew — assignable crew with their home-base status. */
+  async listCrew() {
+    const res = await this.http.request({
+      method: "GET",
+      path: "/service-schedules/settings/crew"
+    });
+    return res.crew;
+  }
+  /** PUT /settings/crew/:agentId/home-address — set and geocode a crew member's home base. */
+  async setCrewHomeAddress(agentId, address) {
+    return this.http.request({
+      method: "PUT",
+      path: `/service-schedules/settings/crew/${encodeURIComponent(agentId)}/home-address`,
+      body: { address }
+    });
+  }
+};
+
+// src/resources/billing-schedules.ts
+var BillingScheduleResource = class extends BaseResource {
+  constructor(http) {
+    super(http, "/admin/billing-schedules");
+  }
+  /** GET /admin/billing-schedules — list rows (no lines; `line_count` and `next_amount` instead). */
+  async list(params) {
+    return this.http.request({
+      method: "GET",
+      path: this.basePath,
+      params: toQueryParams(params)
+    });
+  }
+  /** GET /admin/billing-schedules/:id — the schedule with its lines and next 3 periods. */
+  async get(id) {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/${encodeURIComponent(id)}`
+    });
+  }
+  /**
+   * POST /admin/billing-schedules. `timezone` defaults to the tenant's. A
+   * backdated `start_date` needs `backfill` ('skip' | 'draft'), else 400
+   * `BACKFILL_REQUIRED`; `collection: 'autopay'` without a platform-managed
+   * Stripe connection and a saved default card is 422 `AUTOPAY_UNAVAILABLE`
+   * (`reason` `no_connect` | `no_saved_method`).
+   */
+  async create(data) {
+    return this.http.request({
+      method: "POST",
+      path: this.basePath,
+      body: data
+    });
+  }
+  /**
+   * PATCH /admin/billing-schedules/:id — partial. `lines` replaces every line
+   * from `effective_from` (default: the next period not yet invoiced) as a new
+   * line version. 409 `CADENCE_LOCKED`; 422 `EFFECTIVE_DATE_IN_GENERATED_PERIOD`
+   * for a date inside an invoiced period.
+   */
+  async update(id, data) {
+    return this.http.request({
+      method: "PATCH",
+      path: `${this.basePath}/${encodeURIComponent(id)}`,
+      body: data
+    });
+  }
+  /** DELETE /admin/billing-schedules/:id — only a schedule that never invoiced (else 409 `SCHEDULE_HAS_INVOICES`). */
+  async delete(id) {
+    await this.http.request({
+      method: "DELETE",
+      path: `${this.basePath}/${encodeURIComponent(id)}`
+    });
+  }
+  /** GET /admin/billing-schedules/:id/versions — line version history, newest effective date first. */
+  async listVersions(id) {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/${encodeURIComponent(id)}/versions`
+    });
+  }
+  /**
+   * POST /admin/billing-schedules/:id/adjustments — add a one-off amount
+   * (signed; negative is a credit) to the schedule's next generated invoice.
+   * Billed exactly once; no automatic proration. 422 `ADJUSTMENT_INVALID`
+   * (zero, or the next invoice would go below zero) or `SCHEDULE_NOT_ACTIVE`.
+   */
+  async addAdjustment(id, data) {
+    return this.http.request({
+      method: "POST",
+      path: `${this.basePath}/${encodeURIComponent(id)}/adjustments`,
+      body: data
+    });
+  }
+  /** GET /admin/billing-schedules/:id/adjustments — oldest first; default pending and consumed. */
+  async listAdjustments(id, params) {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/${encodeURIComponent(id)}/adjustments`,
+      params: toQueryParams(params)
+    });
+  }
+  /**
+   * DELETE /admin/billing-schedules/:id/adjustments/:adjustmentId — cancel a
+   * pending adjustment (it never bills). Returns it; 409
+   * `ADJUSTMENT_ALREADY_CONSUMED` once an invoice carries it.
+   */
+  async cancelAdjustment(id, adjustmentId) {
+    return this.http.request({
+      method: "DELETE",
+      path: `${this.basePath}/${encodeURIComponent(id)}/adjustments/${encodeURIComponent(adjustmentId)}`
+    });
+  }
+  /** POST /admin/billing-schedules/:id/pause — 409 `INVALID_STATUS_TRANSITION` unless active. */
+  async pause(id) {
+    return this.http.request({
+      method: "POST",
+      path: `${this.basePath}/${encodeURIComponent(id)}/pause`
+    });
+  }
+  /** POST /admin/billing-schedules/:id/resume — periods that fell due while paused are skipped. */
+  async resume(id) {
+    return this.http.request({
+      method: "POST",
+      path: `${this.basePath}/${encodeURIComponent(id)}/resume`
+    });
+  }
+  /** POST /admin/billing-schedules/:id/end — no further periods generate. */
+  async end(id) {
+    return this.http.request({
+      method: "POST",
+      path: `${this.basePath}/${encodeURIComponent(id)}/end`
+    });
+  }
+  /** GET /admin/billing-schedules/:id/preview — the next `count` (1–24, default 6) periods from the first unbilled one. */
+  async preview(id, params) {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/${encodeURIComponent(id)}/preview`,
+      params: toQueryParams(params)
+    });
+  }
+  /** GET /admin/billing-schedules/:id/periods — the period ledger, newest first. */
+  async periods(id, params) {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/${encodeURIComponent(id)}/periods`,
+      params: toQueryParams(params)
+    });
+  }
+  /**
+   * GET /admin/billing-schedules/periods/needs-review — tenant-wide: needs_review
+   * rows plus failed and stuck (pending over 2h) deliveries.
+   */
+  async needsReview(params) {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/periods/needs-review`,
+      params: toQueryParams(params)
+    });
+  }
+  /**
+   * GET /admin/billing-schedules/autopay-summary — what disconnecting Stripe
+   * would touch: live autopay schedules, the distinct customers on them, and
+   * active saved cards on the current Stripe connection. On disconnect, autopay
+   * schedules that can no longer charge switch to emailed pay links.
+   */
+  async autopaySummary() {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/autopay-summary`
+    });
+  }
+  /**
+   * POST /admin/billing-schedules/:id/generate-now — bill the current due
+   * period now. Idempotent (`already_generated`); 409 `NOTHING_DUE` or
+   * `SCHEDULE_NOT_ACTIVE`.
+   */
+  async generateNow(id) {
+    return this.http.request({
+      method: "POST",
+      path: `${this.basePath}/${encodeURIComponent(id)}/generate-now`
+    });
+  }
+  /**
+   * POST /admin/billing-schedules/:id/periods/:periodStart/skip — skip one
+   * period (`periodStart` is `YYYY-MM-DD`). Returns the skipped ledger row;
+   * 400 `NOT_A_PERIOD`, 409 `PERIOD_ALREADY_INVOICED`.
+   */
+  async skipPeriod(id, periodStart, data = {}) {
+    return this.http.request({
+      method: "POST",
+      path: `${this.basePath}/${encodeURIComponent(id)}/periods/${encodeURIComponent(periodStart)}/skip`,
+      body: data
+    });
+  }
+  /**
+   * POST /admin/billing-schedules/:id/periods/:periodStart/regenerate — re-bill
+   * a period whose invoice was voided (new draft on the same ledger row).
+   * 409 `INVOICE_NOT_VOID` or `CHECKOUT_IN_FLIGHT`.
+   */
+  async regeneratePeriod(id, periodStart) {
+    return this.http.request({
+      method: "POST",
+      path: `${this.basePath}/${encodeURIComponent(id)}/periods/${encodeURIComponent(periodStart)}/regenerate`
+    });
+  }
+};
+
+// src/resources/custom-fields.ts
+var CustomFieldsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  /** List definitions, optionally narrowed to one entity type. */
+  async list(params) {
+    return this.http.request({
+      method: "GET",
+      path: "/custom-fields",
+      params
+    });
+  }
+  /** GET /admin/custom-fields — the same list through the admin route (Manage grant). */
+  async listAll(params) {
+    return this.http.request({
+      method: "GET",
+      path: "/admin/custom-fields",
+      params
+    });
+  }
+  /** GET /admin/custom-fields/:id */
+  async get(id) {
+    return this.http.request({
+      method: "GET",
+      path: `/admin/custom-fields/${id}`
+    });
+  }
+  /**
+   * POST /admin/custom-fields — define a new field. 400 for `job`, `vendor` or
+   * `agent` (those records can't hold values yet, PRD D6). A `fieldKey` must be
+   * unique per entity type: check `listAll({ entity_type, include_inactive: true })` first.
+   */
+  async create(data) {
+    return this.http.request({
+      method: "POST",
+      path: "/admin/custom-fields",
+      body: data
+    });
+  }
+  /** PATCH /admin/custom-fields/:id — `fieldKey` and `entityType` can't change. */
+  async update(id, data) {
+    return this.http.request({
+      method: "PATCH",
+      path: `/admin/custom-fields/${id}`,
+      body: data
+    });
+  }
+  /**
+   * DELETE /admin/custom-fields/:id — deactivates the definition (204). Records
+   * keep their stored values; `list({ include_inactive: true })` still shows it,
+   * and `update(id, { active: true })` brings it back.
+   */
+  async deactivate(id) {
+    await this.http.request({
+      method: "DELETE",
+      path: `/admin/custom-fields/${id}`
+    });
+  }
+};
+
+// src/resources/ortto.ts
+var OrttoResource = class {
+  constructor(http) {
+    this.http = http;
+    this.basePath = "/admin/integrations/ortto";
+  }
+  /** GET /admin/integrations/ortto/mappings — live mappings with their list names. */
+  async listMappings() {
+    const res = await this.http.request({
+      method: "GET",
+      path: `${this.basePath}/mappings`
+    });
+    return res.data;
+  }
+  /** GET /admin/integrations/ortto/audiences — the connected account's audiences (cached 60 s). */
+  async listAudiences(params) {
+    const res = await this.http.request({
+      method: "GET",
+      path: `${this.basePath}/audiences`,
+      params
+    });
+    return res.data;
+  }
+  /** POST /admin/integrations/ortto/mappings — 409 when the list already has a mapping. */
+  async createMapping(data) {
+    const res = await this.http.request({
+      method: "POST",
+      path: `${this.basePath}/mappings`,
+      body: data
+    });
+    return res.data;
+  }
+  /** PATCH /admin/integrations/ortto/mappings/:id — `ortto_tag` and/or `create_unmatched`. */
+  async updateMapping(id, data) {
+    const res = await this.http.request({
+      method: "PATCH",
+      path: `${this.basePath}/mappings/${id}`,
+      body: data
+    });
+    return res.data;
+  }
+  /**
+   * DELETE /admin/integrations/ortto/mappings/:id (204). A pull list becomes
+   * editable again and keeps its members; a push tag is NOT removed from Ortto.
+   */
+  async deleteMapping(id) {
+    await this.http.request({
+      method: "DELETE",
+      path: `${this.basePath}/mappings/${id}`
+    });
+  }
+  /**
+   * POST /admin/integrations/ortto/sync (202) — queue a sync for one mapping or
+   * the whole connection. Never calls Ortto in-request.
+   */
+  async sync(data = {}) {
+    const res = await this.http.request({
+      method: "POST",
+      path: `${this.basePath}/sync`,
+      body: data
+    });
+    return res.data;
+  }
+  /** GET /admin/integrations/ortto/sync-status — 404 when Ortto is not connected. */
+  async syncStatus() {
+    const res = await this.http.request({
+      method: "GET",
+      path: `${this.basePath}/sync-status`
+    });
+    return res.data;
+  }
+};
+
+// src/resources/webhook-subscriptions.ts
+var WebhookSubscriptionsResource = class extends ApiResource {
+  constructor(http) {
+    super(http, "/admin/webhooks");
+  }
+  /** POST /admin/webhooks — the returned `secret` is shown only this once. */
+  async create(data) {
+    return this.http.request({ method: "POST", path: this.basePath, body: data });
+  }
+  /** GET /admin/webhooks */
+  async list(params) {
+    return this.http.request({
+      method: "GET",
+      path: this.basePath,
+      params
+    });
+  }
+  /** GET /admin/webhooks/:id */
+  async get(id) {
+    return this.http.request({ method: "GET", path: `${this.basePath}/${id}` });
+  }
+  /** PATCH /admin/webhooks/:id */
+  async update(id, data) {
+    return this.http.request({ method: "PATCH", path: `${this.basePath}/${id}`, body: data });
+  }
+  /** DELETE /admin/webhooks/:id */
+  async delete(id) {
+    return this.http.request({ method: "DELETE", path: `${this.basePath}/${id}` });
+  }
+  /** POST /admin/webhooks/:id/test — sends one signed test event to the URL now. */
+  async test(id) {
+    return this.http.request({ method: "POST", path: `${this.basePath}/${id}/test` });
+  }
+  /**
+   * POST /admin/webhooks/:id/rotate-secret — replaces the signing secret and
+   * returns the new one, shown only this once. New deliveries are signed with
+   * it, but deliveries already queued (and their retries, for several minutes)
+   * keep the old one. `verifyWebhookSignature` checks one secret, so for a few
+   * minutes have your receiver try the new secret and fall back to the old one.
+   */
+  async rotateSecret(id) {
+    return this.http.request({
+      method: "POST",
+      path: `${this.basePath}/${id}/rotate-secret`
+    });
+  }
+  /** GET /admin/webhooks/:id/deliveries — newest first. */
+  async listDeliveries(id, params) {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/${id}/deliveries`,
+      params
+    });
+  }
+  /**
+   * POST /admin/webhooks/:id/deliveries/:deliveryId/retry — queues a new
+   * delivery of that event (202). The receiver sees the event again, so make
+   * it idempotent on the event id.
+   */
+  async retryDelivery(id, deliveryId) {
+    return this.http.request({
+      method: "POST",
+      path: `${this.basePath}/${id}/deliveries/${deliveryId}/retry`
+    });
+  }
+};
+
+// src/resources/users.ts
+var UsersResource = class extends ApiResource {
+  constructor(http) {
+    super(http, "/users");
+  }
+  /** GET /users — paged, with email, role, status and org fields (read grant on users). */
+  async list(params) {
+    return this.http.request({
+      method: "GET",
+      path: this.basePath,
+      params
+    });
+  }
+  /**
+   * GET /users/directory — active users' ids, names and roles, for pickers and
+   * for resolving an assignee. Every role can read it.
+   */
+  async directory(params) {
+    return this.http.request({
+      method: "GET",
+      path: `${this.basePath}/directory`,
+      params
+    });
+  }
+  /**
+   * GET /users/:id/working-hours — the user's own weekly hours and the tenant
+   * default. A non-admin caller may read only their own (403 otherwise).
+   */
+  async getWorkingHours(id) {
+    return this.http.request({ method: "GET", path: `${this.basePath}/${id}/working-hours` });
+  }
+};
+
+// src/resources/teams.ts
+var TeamsResource = class extends ApiResource {
+  constructor(http) {
+    super(http, "/teams");
+  }
+  /** GET /teams — every team, with `member_count`. */
+  async list() {
+    return this.http.request({ method: "GET", path: this.basePath });
+  }
+  /** GET /teams/:id — one team, with `members`. */
+  async get(id) {
+    return this.http.request({ method: "GET", path: `${this.basePath}/${id}` });
+  }
+};
+
+// src/webhooks.ts
+function verifyWebhookSignature(payload, signature, secret) {
+  if (!signature || !secret || !payload) {
+    return false;
+  }
+  const prefix = "sha256=";
+  if (!signature.startsWith(prefix)) {
+    return false;
+  }
+  const receivedHex = signature.slice(prefix.length);
+  if (!receivedHex) {
+    return false;
+  }
+  const expectedHmac = createHmac("sha256", secret).update(payload).digest("hex");
+  const receivedBuf = Buffer.from(receivedHex, "hex");
+  const expectedBuf = Buffer.from(expectedHmac, "hex");
+  if (receivedBuf.length !== expectedBuf.length) {
+    return false;
+  }
+  return timingSafeEqual(receivedBuf, expectedBuf);
+}
+function parseWebhookEvent(body, signature, secret) {
+  if (!verifyWebhookSignature(body, signature, secret)) {
+    throw new WebhookVerificationError();
+  }
+  return JSON.parse(body);
+}
+
+// src/webhook-router.ts
+var WebhookRouter = class {
+  constructor() {
+    /** pattern (composite key / entity wildcard / '*') → registered handlers. */
+    this.handlers = /* @__PURE__ */ new Map();
+  }
+  /**
+   * Register a handler for an event pattern.
+   *
+   * @param pattern - `"{entity_type}.{event_type}"` (e.g. `opportunity.created`),
+   *   an entity wildcard `"{entity_type}.*"` (e.g. `opportunity.*`), or the
+   *   global wildcard `"*"`. Matching is exact-string against the derived key;
+   *   see the class docs for the dotted-`event_type` shape.
+   * @param handler - Invoked with the full {@link WebhookDelivery} on a match.
+   * @returns `this`, for chaining.
+   */
+  on(pattern, handler) {
+    const existing = this.handlers.get(pattern);
+    if (existing) {
+      existing.push(handler);
+    } else {
+      this.handlers.set(pattern, [handler]);
+    }
+    return this;
+  }
+  /**
+   * Verify, parse, and dispatch a webhook delivery.
+   *
+   * The signature is verified first: on failure this throws
+   * {@link WebhookVerificationError} and dispatches nothing. On success it
+   * dispatches to every matching handler — specific key, then entity wildcard,
+   * then global — awaiting async handlers before resolving.
+   *
+   * @param input - The raw `{ body, signature, secret }`.
+   * @returns The parsed {@link WebhookDelivery}.
+   * @throws WebhookVerificationError if the signature is invalid.
+   */
+  async process(input) {
+    const delivery = parseWebhookEvent(input.body, input.signature, input.secret);
+    const { entity_type, event_type } = delivery.event;
+    const patterns = [`${entity_type}.${event_type}`, `${entity_type}.*`, "*"];
+    for (const pattern of patterns) {
+      const matched = this.handlers.get(pattern);
+      if (!matched) continue;
+      for (const handler of matched) {
+        await handler(delivery);
+      }
+    }
+    return delivery;
+  }
+};
+
+// src/client.ts
+var PlanesClient = class {
+  constructor(config) {
+    const hasOAuthCreds = Boolean(config.clientId) || Boolean(config.clientSecret);
+    const modes = [
+      config.accessToken ? "accessToken" : null,
+      config.apiKey ? "apiKey" : null,
+      hasOAuthCreds ? "clientId+clientSecret" : null
+    ].filter((m) => m !== null);
+    if (modes.length === 0) {
+      throw new Error(
+        "PlanesClient requires one auth mode: accessToken, apiKey, or clientId + clientSecret"
+      );
+    }
+    if (modes.length > 1) {
+      throw new Error(
+        `PlanesClient requires exactly one auth mode, not multiple (got: ${modes.join(", ")})`
+      );
+    }
+    if (hasOAuthCreds && (!config.clientId || !config.clientSecret)) {
+      throw new Error("PlanesClient OAuth mode requires both clientId and clientSecret");
+    }
+    this.http = new HttpClient(config);
+  }
+  get opportunities() {
+    if (!this._opportunities) {
+      this._opportunities = new OpportunityResource(this.http);
+    }
+    return this._opportunities;
+  }
+  get customers() {
+    if (!this._customers) {
+      this._customers = new CustomerResource(this.http);
+    }
+    return this._customers;
+  }
+  get properties() {
+    if (!this._properties) {
+      this._properties = new PropertyResource(this.http);
+    }
+    return this._properties;
+  }
+  get calendarEvents() {
+    if (!this._calendarEvents) {
+      this._calendarEvents = new CalendarEventResource(this.http);
+    }
+    return this._calendarEvents;
+  }
+  get contracts() {
+    if (!this._contracts) {
+      this._contracts = new ContractResource(this.http);
+    }
+    return this._contracts;
+  }
+  get jobs() {
+    if (!this._jobs) {
+      this._jobs = new JobResource(this.http);
+    }
+    return this._jobs;
+  }
+  get estimates() {
+    if (!this._estimates) {
+      this._estimates = new EstimateResource(this.http);
+    }
+    return this._estimates;
+  }
+  get invoices() {
+    if (!this._invoices) {
+      this._invoices = new InvoiceResource(this.http);
+    }
+    return this._invoices;
+  }
+  get inventory() {
+    if (!this._inventory) {
+      this._inventory = new InventoryResource(this.http);
+    }
+    return this._inventory;
+  }
+  get contacts() {
+    if (!this._contacts) {
+      this._contacts = new ContactResource(this.http);
+    }
+    return this._contacts;
+  }
+  get activities() {
+    if (!this._activities) {
+      this._activities = new ActivityResource(this.http);
+    }
+    return this._activities;
+  }
+  get communications() {
+    if (!this._communications) {
+      this._communications = new CommunicationsResource(this.http);
+    }
+    return this._communications;
+  }
+  /** Logged meetings — manual + provider-synced, with company matching (E55). */
+  get conversations() {
+    if (!this._conversations) {
+      this._conversations = new ConversationsResource(this.http);
+    }
+    return this._conversations;
+  }
+  get gmail() {
+    if (!this._gmail) {
+      this._gmail = new GmailResource(this.http);
+    }
+    return this._gmail;
+  }
+  get documents() {
+    if (!this._documents) {
+      this._documents = new DocumentsResource(this.http);
+    }
+    return this._documents;
+  }
+  get tags() {
+    if (!this._tags) {
+      this._tags = new TagResource(this.http);
+    }
+    return this._tags;
+  }
+  get lists() {
+    if (!this._lists) {
+      this._lists = new ListsResource(this.http);
+    }
+    return this._lists;
+  }
+  get leadSources() {
+    if (!this._leadSources) {
+      this._leadSources = new LeadSourcesResource(this.http);
+    }
+    return this._leadSources;
+  }
+  get tasks() {
+    if (!this._tasks) {
+      this._tasks = new TaskResource(this.http);
+    }
+    return this._tasks;
+  }
+  /** Record views — the "recently viewed" beacon + read (E41-F7). */
+  get recordViews() {
+    if (!this._recordViews) {
+      this._recordViews = new RecordViewsResource(this.http);
+    }
+    return this._recordViews;
+  }
+  /** Module status — which modules are active for the caller's tenant (E51-F1-S1). */
+  get modules() {
+    if (!this._modules) {
+      this._modules = new ModulesResource(this.http);
+    }
+    return this._modules;
+  }
+  /** The tenant's plan, billing status and plan ceiling — `plan.get()` (E54-F1-S2). */
+  get plan() {
+    if (!this._plan) {
+      this._plan = new PlanResource(this.http);
+    }
+    return this._plan;
+  }
+  /** The authenticated caller — `me.abilities()` (E52-F1-S3). */
+  get me() {
+    if (!this._me) {
+      this._me = new MeResource(this.http);
+    }
+    return this._me;
+  }
+  /** Settings → Roles, admin only — `roles.list/get/updateGrants/reset/history` (E52-F2-S5). */
+  get roles() {
+    if (!this._roles) {
+      this._roles = new RolesResource(this.http);
+    }
+    return this._roles;
+  }
+  /** Invoice settings — `invoiceSettings.getOfflineInstructions/setOfflineInstructions` (E56-F5-S4). */
+  get invoiceSettings() {
+    if (!this._invoiceSettings) {
+      this._invoiceSettings = new InvoiceSettingsResource(this.http);
+    }
+    return this._invoiceSettings;
+  }
+  /** Payment reminder settings, admin only — `invoiceReminders.list/update/preview` (E56-F8-S6). */
+  get invoiceReminders() {
+    if (!this._invoiceReminders) {
+      this._invoiceReminders = new InvoiceRemindersResource(this.http);
+    }
+    return this._invoiceReminders;
+  }
+  /** Event automations, admin only — `eventAutomations.list/get/create/update/delete` (E60-S2). */
+  get eventAutomations() {
+    if (!this._eventAutomations) {
+      this._eventAutomations = new EventAutomationsResource(this.http);
+    }
+    return this._eventAutomations;
+  }
+  /** Web forms and their submissions, admin only — `webForms.list/get/create/update/archive/rotateKey`, `webForms.submissions.list/get/update/route` (E60-S6). */
+  get webForms() {
+    if (!this._webForms) {
+      this._webForms = new WebFormsResource(this.http);
+    }
+    return this._webForms;
+  }
+  /** Published sequences a contact can be enrolled in (E51-F2-S6). */
+  get contactSequences() {
+    if (!this._contactSequences) {
+      this._contactSequences = new ContactSequencesResource(this.http);
+    }
+    return this._contactSequences;
+  }
+  /** Enroll a contact in a sequence, list its enrollments, exit one (E51-F2-S8). */
+  get enrollments() {
+    if (!this._enrollments) {
+      this._enrollments = new EnrollmentsResource(this.http);
+    }
+    return this._enrollments;
+  }
+  /** Tenant-readable workflow reads — a workflow version's ordered stages. */
+  get workflows() {
+    if (!this._workflows) {
+      this._workflows = new WorkflowsResource(this.http);
+    }
+    return this._workflows;
+  }
+  get serviceSchedules() {
+    if (!this._serviceSchedules) {
+      this._serviceSchedules = new ServiceSchedulesResource(this.http);
+    }
+    return this._serviceSchedules;
+  }
+  /**
+   * Recurring billing schedules (E56-F3) — CRUD, pause/resume/end, preview,
+   * the period ledger, Needs review, generate-now, skip and regenerate.
+   */
+  get billingSchedules() {
+    if (!this._billingSchedules) {
+      this._billingSchedules = new BillingScheduleResource(this.http);
+    }
+    return this._billingSchedules;
+  }
+  get customFields() {
+    if (!this._customFields) {
+      this._customFields = new CustomFieldsResource(this.http);
+    }
+    return this._customFields;
+  }
+  /** Ortto connector — list mappings, audiences, manual sync, sync status (E53). Admin-only. */
+  get ortto() {
+    if (!this._ortto) {
+      this._ortto = new OrttoResource(this.http);
+    }
+    return this._ortto;
+  }
+  /**
+   * Webhook subscriptions — where entity events are delivered (E64-S10). Admin
+   * grants and the `open_api` feature. Not `webhooks`: that is the event router.
+   */
+  get webhookSubscriptions() {
+    if (!this._webhookSubscriptions) {
+      this._webhookSubscriptions = new WebhookSubscriptionsResource(this.http);
+    }
+    return this._webhookSubscriptions;
+  }
+  /** The tenant's users, read-only: list and directory (E64-S10). */
+  get users() {
+    if (!this._users) {
+      this._users = new UsersResource(this.http);
+    }
+    return this._users;
+  }
+  /** Teams, read-only (E64-S10). */
+  get teams() {
+    if (!this._teams) {
+      this._teams = new TeamsResource(this.http);
+    }
+    return this._teams;
+  }
+  /**
+   * Ergonomic webhook event router — `client.webhooks.on(pattern, handler)`
+   * plus `client.webhooks.process({ body, signature, secret })`. Auth-independent
+   * (the signing secret is supplied per `.process()` call), so it is created
+   * lazily without the HTTP client. See {@link WebhookRouter}.
+   */
+  get webhooks() {
+    if (!this._webhooks) {
+      this._webhooks = new WebhookRouter();
+    }
+    return this._webhooks;
+  }
+};
+
+// src/client-entry.ts
+var SESSION_MODE = "session";
+var PlanesClient2 = class extends PlanesClient {
+  constructor(config) {
+    if (typeof config?.getAccessToken !== "function") {
+      throw new Error("PlanesClient (client entry) requires getAccessToken");
+    }
+    super({
+      accessToken: SESSION_MODE,
+      getAccessToken: config.getAccessToken,
+      ...config.baseUrl !== void 0 ? { baseUrl: config.baseUrl } : {},
+      ...config.onUnauthorized !== void 0 ? { onUnauthorized: config.onUnauthorized } : {},
+      ...config.fetch !== void 0 ? { fetch: config.fetch } : {},
+      ...config.timeout !== void 0 ? { timeout: config.timeout } : {},
+      ...config.retryOnRateLimit !== void 0 ? { retryOnRateLimit: config.retryOnRateLimit } : {},
+      ...config.maxRetries !== void 0 ? { maxRetries: config.maxRetries } : {}
+    });
+  }
+};
+export {
+  AuthenticationError,
+  AuthorizationError,
+  DEFAULT_BASE_URL,
+  DEFAULT_MAX_RETRIES,
+  DEFAULT_TIMEOUT,
+  NotFoundError,
+  PlanesClient2 as PlanesClient,
+  PlanesError,
+  RateLimitError,
+  ServerError,
+  ValidationError
+};
+//# sourceMappingURL=client.mjs.map