@revkeen/sdk 1.20260414.869 → 1.20260414.883

package/README.md

@@ -0,0 +1,137 @@
+# RevKeen TypeScript SDK
+
+[![npm version](https://img.shields.io/npm/v/@revkeen/sdk.svg)](https://www.npmjs.com/package/@revkeen/sdk)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+
+Official TypeScript/Node.js SDK for the [RevKeen API](https://docs.revkeen.com/api-reference/openapi) — auto-generated from the OpenAPI specification via [Fern](https://buildwithfern.com).
+
+## Installation
+
+```bash
+npm install @revkeen/sdk
+```
+
+```bash
+pnpm add @revkeen/sdk
+```
+
+```bash
+yarn add @revkeen/sdk
+```
+
+## Quick Start
+
+```typescript
+import { RevKeen } from '@revkeen/sdk';
+
+const client = new RevKeen({ apiKey: process.env.REVKEEN_API_KEY! });
+
+const customers = await client.customers.list({ limit: 10 });
+
+for (const customer of customers.data) {
+  console.log(customer.name, customer.email);
+}
+```
+
+## Authentication
+
+### API Key (recommended for server-to-server)
+
+```typescript
+const client = new RevKeen({ apiKey: process.env.REVKEEN_API_KEY! });
+```
+
+### OAuth 2.1 (recommended for MCP and third-party integrations)
+
+```typescript
+const client = new RevKeen({
+  oauth: {
+    clientId: process.env.REVKEEN_CLIENT_ID!,
+    clientSecret: process.env.REVKEEN_CLIENT_SECRET!,
+    scopes: ['customers:read', 'invoices:read'],
+  },
+});
+```
+
+The SDK handles token acquisition, caching, and automatic refresh. See the [OAuth guide](https://docs.revkeen.com/docs/developers/oauth) for details.
+
+## Resources
+
+Every API resource is available as a typed property on the client:
+
+| Resource | Method examples |
+|----------|----------------|
+| `client.customers` | `list()`, `create()`, `get()`, `update()`, `delete()` |
+| `client.invoices` | `list()`, `create()`, `get()`, `update()`, `finalize()`, `send()`, `void()` |
+| `client.subscriptions` | `list()`, `create()`, `get()`, `update()`, `cancel()`, `pause()`, `resume()` |
+| `client.products` | `list()`, `create()`, `get()`, `update()`, `delete()` |
+| `client.payments` | `list()`, `create()`, `get()` |
+| `client.checkoutSessions` | `create()`, `get()` |
+| `client.discounts` | `list()`, `create()`, `get()`, `update()`, `delete()` |
+| `client.creditNotes` | `list()`, `create()`, `get()` |
+| `client.paymentLinks` | `list()`, `create()`, `get()`, `update()` |
+| `client.paymentMethods` | `list()`, `get()`, `detach()` |
+| `client.webhookEndpoints` | `list()`, `create()`, `delete()` |
+| `client.events` | `list()`, `get()` |
+| `client.entitlements` | `list()`, `check()` |
+
+## Webhook Verification
+
+```typescript
+import { constructEvent, WebhookSignatureVerificationError } from '@revkeen/sdk';
+
+try {
+  const event = constructEvent(
+    requestBody,
+    headers['revkeen-signature'],
+    process.env.REVKEEN_WEBHOOK_SECRET!
+  );
+
+  switch (event.type) {
+    case 'invoice.paid':
+      console.log('Invoice paid:', event.data.id);
+      break;
+  }
+} catch (error) {
+  if (error instanceof WebhookSignatureVerificationError) {
+    console.error('Invalid signature');
+  }
+}
+```
+
+## Error Handling
+
+```typescript
+try {
+  const customer = await client.customers.get('cus_nonexistent');
+} catch (error) {
+  if (error instanceof RevKeen.ApiError) {
+    console.error(`API error ${error.statusCode}: ${error.message}`);
+  }
+}
+```
+
+## Configuration
+
+```typescript
+const client = new RevKeen({
+  apiKey: process.env.REVKEEN_API_KEY!,
+  // Staging environment
+  baseUrl: 'https://staging-api.revkeen.com',
+  // Custom timeout (ms)
+  timeoutInSeconds: 30,
+});
+```
+
+## Compatibility
+
+- **Runtime:** Node.js 18+
+- **Package format:** ESM and CommonJS
+- **TypeScript:** Full type definitions included
+
+## Links
+
+- [API Reference](https://docs.revkeen.com/api-reference/openapi)
+- [SDK Documentation](https://docs.revkeen.com/docs/developers/sdks/typescript)
+- [Go SDK](https://github.com/revkeen/sdk-go)
+- [PHP SDK](https://github.com/revkeen/sdk-php)

package/dist/auth.d.mts

@@ -0,0 +1,17 @@
+interface OAuthConfig {
+    clientId: string;
+    clientSecret: string;
+    tokenEndpoint?: string;
+    scopes?: string[];
+}
+declare class OAuthTokenManager {
+    private config;
+    private cachedToken;
+    private inflightRequest;
+    constructor(config: OAuthConfig);
+    getToken(): Promise<string>;
+    private fetchToken;
+    private requestToken;
+}
+
+export { type OAuthConfig, OAuthTokenManager };

package/dist/auth.d.ts

@@ -0,0 +1,17 @@
+interface OAuthConfig {
+    clientId: string;
+    clientSecret: string;
+    tokenEndpoint?: string;
+    scopes?: string[];
+}
+declare class OAuthTokenManager {
+    private config;
+    private cachedToken;
+    private inflightRequest;
+    constructor(config: OAuthConfig);
+    getToken(): Promise<string>;
+    private fetchToken;
+    private requestToken;
+}
+
+export { type OAuthConfig, OAuthTokenManager };

package/dist/auth.js

@@ -0,0 +1,111 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/auth.ts
+var auth_exports = {};
+__export(auth_exports, {
+  OAuthTokenManager: () => OAuthTokenManager
+});
+module.exports = __toCommonJS(auth_exports);
+
+// src/core/errors.ts
+var RevKeenError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "RevKeenError";
+  }
+};
+
+// src/core/oauth.ts
+var DEFAULT_TOKEN_ENDPOINT = "https://api.revkeen.com/api/auth/oauth2/token";
+var PRE_EXPIRY_BUFFER_MS = 6e4;
+var OAuthTokenManager = class {
+  config;
+  cachedToken = null;
+  inflightRequest = null;
+  constructor(config) {
+    this.config = {
+      clientId: config.clientId,
+      clientSecret: config.clientSecret,
+      tokenEndpoint: config.tokenEndpoint || DEFAULT_TOKEN_ENDPOINT,
+      scopes: config.scopes
+    };
+  }
+  async getToken() {
+    if (this.cachedToken && Date.now() < this.cachedToken.expiresAt - PRE_EXPIRY_BUFFER_MS) {
+      return this.cachedToken.accessToken;
+    }
+    if (this.inflightRequest) {
+      return this.inflightRequest;
+    }
+    this.inflightRequest = this.fetchToken();
+    try {
+      return await this.inflightRequest;
+    } finally {
+      this.inflightRequest = null;
+    }
+  }
+  async fetchToken() {
+    if (this.cachedToken?.refreshToken) {
+      try {
+        return await this.requestToken("refresh_token");
+      } catch {
+      }
+    }
+    return await this.requestToken("client_credentials");
+  }
+  async requestToken(grantType) {
+    const body = new URLSearchParams();
+    body.set("grant_type", grantType);
+    if (grantType === "client_credentials") {
+      body.set("client_id", this.config.clientId);
+      body.set("client_secret", this.config.clientSecret);
+      if (this.config.scopes?.length) {
+        body.set("scope", this.config.scopes.join(" "));
+      }
+    } else if (grantType === "refresh_token" && this.cachedToken?.refreshToken) {
+      body.set("refresh_token", this.cachedToken.refreshToken);
+      body.set("client_id", this.config.clientId);
+      body.set("client_secret", this.config.clientSecret);
+    }
+    const res = await fetch(this.config.tokenEndpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: body.toString()
+    });
+    if (!res.ok) {
+      const errorBody = await res.text().catch(() => "");
+      throw new RevKeenError(
+        `OAuth token request failed (${res.status}): ${errorBody || res.statusText}`
+      );
+    }
+    const data = await res.json();
+    this.cachedToken = {
+      accessToken: data.access_token,
+      refreshToken: data.refresh_token ?? this.cachedToken?.refreshToken,
+      expiresAt: Date.now() + data.expires_in * 1e3
+    };
+    return data.access_token;
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  OAuthTokenManager
+});
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth.ts","../src/core/errors.ts","../src/core/oauth.ts"],"sourcesContent":["export { OAuthTokenManager } from \"./core/oauth.js\";\nexport type { OAuthConfig } from \"./core/oauth.js\";\n","export class RevKeenError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"RevKeenError\";\n  }\n}\n\nexport class RevKeenAPIError extends RevKeenError {\n  constructor(\n    public readonly status: number,\n    message: string,\n    public readonly body: unknown,\n  ) {\n    super(message);\n    this.name = \"RevKeenAPIError\";\n  }\n}\n\nexport class RevKeenTimeoutError extends RevKeenError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"RevKeenTimeoutError\";\n  }\n}\n","import { RevKeenError } from \"./errors.js\";\n\nexport interface OAuthConfig {\n  clientId: string;\n  clientSecret: string;\n  tokenEndpoint?: string;\n  scopes?: string[];\n}\n\ninterface TokenResponse {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token?: string;\n  scope?: string;\n}\n\ninterface CachedToken {\n  accessToken: string;\n  refreshToken?: string;\n  expiresAt: number;\n}\n\nconst DEFAULT_TOKEN_ENDPOINT = \"https://api.revkeen.com/api/auth/oauth2/token\";\nconst PRE_EXPIRY_BUFFER_MS = 60_000; // Refresh 60s before expiry\n\nexport class OAuthTokenManager {\n  private config: Required<Pick<OAuthConfig, \"clientId\" | \"clientSecret\" | \"tokenEndpoint\">> &\n    Pick<OAuthConfig, \"scopes\">;\n  private cachedToken: CachedToken | null = null;\n  private inflightRequest: Promise<string> | null = null;\n\n  constructor(config: OAuthConfig) {\n    this.config = {\n      clientId: config.clientId,\n      clientSecret: config.clientSecret,\n      tokenEndpoint: config.tokenEndpoint || DEFAULT_TOKEN_ENDPOINT,\n      scopes: config.scopes,\n    };\n  }\n\n  async getToken(): Promise<string> {\n    // Return cached token if still valid\n    if (this.cachedToken && Date.now() < this.cachedToken.expiresAt - PRE_EXPIRY_BUFFER_MS) {\n      return this.cachedToken.accessToken;\n    }\n\n    // Deduplicate concurrent requests\n    if (this.inflightRequest) {\n      return this.inflightRequest;\n    }\n\n    this.inflightRequest = this.fetchToken();\n    try {\n      return await this.inflightRequest;\n    } finally {\n      this.inflightRequest = null;\n    }\n  }\n\n  private async fetchToken(): Promise<string> {\n    // Try refresh token first if available\n    if (this.cachedToken?.refreshToken) {\n      try {\n        return await this.requestToken(\"refresh_token\");\n      } catch {\n        // Fall back to client_credentials\n      }\n    }\n\n    return await this.requestToken(\"client_credentials\");\n  }\n\n  private async requestToken(grantType: \"client_credentials\" | \"refresh_token\"): Promise<string> {\n    const body = new URLSearchParams();\n    body.set(\"grant_type\", grantType);\n\n    if (grantType === \"client_credentials\") {\n      body.set(\"client_id\", this.config.clientId);\n      body.set(\"client_secret\", this.config.clientSecret);\n      if (this.config.scopes?.length) {\n        body.set(\"scope\", this.config.scopes.join(\" \"));\n      }\n    } else if (grantType === \"refresh_token\" && this.cachedToken?.refreshToken) {\n      body.set(\"refresh_token\", this.cachedToken.refreshToken);\n      body.set(\"client_id\", this.config.clientId);\n      body.set(\"client_secret\", this.config.clientSecret);\n    }\n\n    const res = await fetch(this.config.tokenEndpoint, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body: body.toString(),\n    });\n\n    if (!res.ok) {\n      const errorBody = await res.text().catch(() => \"\");\n      throw new RevKeenError(\n        `OAuth token request failed (${res.status}): ${errorBody || res.statusText}`\n      );\n    }\n\n    const data = (await res.json()) as TokenResponse;\n\n    this.cachedToken = {\n      accessToken: data.access_token,\n      refreshToken: data.refresh_token ?? this.cachedToken?.refreshToken,\n      expiresAt: Date.now() + data.expires_in * 1000,\n    };\n\n    return data.access_token;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAO,IAAM,eAAN,cAA2B,MAAM;AAAA,EACtC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;ACkBA,IAAM,yBAAyB;AAC/B,IAAM,uBAAuB;AAEtB,IAAM,oBAAN,MAAwB;AAAA,EACrB;AAAA,EAEA,cAAkC;AAAA,EAClC,kBAA0C;AAAA,EAElD,YAAY,QAAqB;AAC/B,SAAK,SAAS;AAAA,MACZ,UAAU,OAAO;AAAA,MACjB,cAAc,OAAO;AAAA,MACrB,eAAe,OAAO,iBAAiB;AAAA,MACvC,QAAQ,OAAO;AAAA,IACjB;AAAA,EACF;AAAA,EAEA,MAAM,WAA4B;AAEhC,QAAI,KAAK,eAAe,KAAK,IAAI,IAAI,KAAK,YAAY,YAAY,sBAAsB;AACtF,aAAO,KAAK,YAAY;AAAA,IAC1B;AAGA,QAAI,KAAK,iBAAiB;AACxB,aAAO,KAAK;AAAA,IACd;AAEA,SAAK,kBAAkB,KAAK,WAAW;AACvC,QAAI;AACF,aAAO,MAAM,KAAK;AAAA,IACpB,UAAE;AACA,WAAK,kBAAkB;AAAA,IACzB;AAAA,EACF;AAAA,EAEA,MAAc,aAA8B;AAE1C,QAAI,KAAK,aAAa,cAAc;AAClC,UAAI;AACF,eAAO,MAAM,KAAK,aAAa,eAAe;AAAA,MAChD,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,WAAO,MAAM,KAAK,aAAa,oBAAoB;AAAA,EACrD;AAAA,EAEA,MAAc,aAAa,WAAoE;AAC7F,UAAM,OAAO,IAAI,gBAAgB;AACjC,SAAK,IAAI,cAAc,SAAS;AAEhC,QAAI,cAAc,sBAAsB;AACtC,WAAK,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC1C,WAAK,IAAI,iBAAiB,KAAK,OAAO,YAAY;AAClD,UAAI,KAAK,OAAO,QAAQ,QAAQ;AAC9B,aAAK,IAAI,SAAS,KAAK,OAAO,OAAO,KAAK,GAAG,CAAC;AAAA,MAChD;AAAA,IACF,WAAW,cAAc,mBAAmB,KAAK,aAAa,cAAc;AAC1E,WAAK,IAAI,iBAAiB,KAAK,YAAY,YAAY;AACvD,WAAK,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC1C,WAAK,IAAI,iBAAiB,KAAK,OAAO,YAAY;AAAA,IACpD;AAEA,UAAM,MAAM,MAAM,MAAM,KAAK,OAAO,eAAe;AAAA,MACjD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,MAC/D,MAAM,KAAK,SAAS;AAAA,IACtB,CAAC;AAED,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,YAAY,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AACjD,YAAM,IAAI;AAAA,QACR,+BAA+B,IAAI,MAAM,MAAM,aAAa,IAAI,UAAU;AAAA,MAC5E;AAAA,IACF;AAEA,UAAM,OAAQ,MAAM,IAAI,KAAK;AAE7B,SAAK,cAAc;AAAA,MACjB,aAAa,KAAK;AAAA,MAClB,cAAc,KAAK,iBAAiB,KAAK,aAAa;AAAA,MACtD,WAAW,KAAK,IAAI,IAAI,KAAK,aAAa;AAAA,IAC5C;AAEA,WAAO,KAAK;AAAA,EACd;AACF;","names":[]}

package/dist/auth.mjs

@@ -0,0 +1,7 @@
+import {
+  OAuthTokenManager
+} from "./chunk-VKMDZSYJ.mjs";
+export {
+  OAuthTokenManager
+};
+//# sourceMappingURL=auth.mjs.map

package/dist/auth.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/chunk-R2LGIZGP.mjs

@@ -0,0 +1,179 @@
+// src/webhooks.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var WEBHOOK_TOLERANCE_IN_SECONDS = 300;
+function extractWebhookHeaders(headers) {
+  const getHeader = (name) => {
+    const value = headers[name] || headers[name.toLowerCase()];
+    if (Array.isArray(value)) return value[0];
+    return value || void 0;
+  };
+  const signature = getHeader("X-Revkeen-Signature") || getHeader("x-rk-signature");
+  if (!signature) {
+    throw new WebhookSignatureVerificationError(
+      "Missing webhook signature header (X-Revkeen-Signature or x-rk-signature)"
+    );
+  }
+  return {
+    signature,
+    version: getHeader("X-Revkeen-Version"),
+    account: getHeader("X-Revkeen-Account"),
+    eventId: getHeader("X-Revkeen-Event-Id"),
+    timestamp: getHeader("X-Revkeen-Timestamp")
+  };
+}
+var WebhookSignatureVerificationError = class _WebhookSignatureVerificationError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "WebhookSignatureVerificationError";
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, _WebhookSignatureVerificationError);
+    }
+  }
+};
+function parseSignatureHeader(header) {
+  const parts = header.split(",");
+  let timestamp;
+  const signatures = [];
+  for (const part of parts) {
+    const [key, value] = part.split("=");
+    if (key === "t") {
+      timestamp = parseInt(value, 10);
+    } else if (key === "v1") {
+      signatures.push(value);
+    }
+  }
+  if (!timestamp || signatures.length === 0) {
+    throw new WebhookSignatureVerificationError(
+      "Invalid signature header: missing timestamp or signature"
+    );
+  }
+  return { timestamp, signatures };
+}
+function verifySignature(options) {
+  const {
+    payload,
+    signature,
+    secret,
+    tolerance = WEBHOOK_TOLERANCE_IN_SECONDS
+  } = options;
+  if (!signature) {
+    throw new WebhookSignatureVerificationError(
+      "Missing webhook signature header"
+    );
+  }
+  const parsed = parseSignatureHeader(signature);
+  const currentTime = Math.floor(Date.now() / 1e3);
+  const timeDiff = Math.abs(currentTime - parsed.timestamp);
+  if (timeDiff > tolerance) {
+    throw new WebhookSignatureVerificationError(
+      `Timestamp outside tolerance window (${timeDiff}s > ${tolerance}s). The webhook might be a replay attack, or your server's clock might be out of sync.`
+    );
+  }
+  const signedPayload = `${parsed.timestamp}.${payload}`;
+  const expectedSignature = createHmac("sha256", secret).update(signedPayload, "utf8").digest("hex");
+  const signatureValid = parsed.signatures.some((sig) => {
+    try {
+      const sigBuffer = Buffer.from(sig, "hex");
+      const expectedBuffer = Buffer.from(expectedSignature, "hex");
+      if (sigBuffer.length !== expectedBuffer.length) {
+        return false;
+      }
+      return timingSafeEqual(sigBuffer, expectedBuffer);
+    } catch {
+      return false;
+    }
+  });
+  if (!signatureValid) {
+    throw new WebhookSignatureVerificationError(
+      "Signature verification failed. Ensure you're using the correct webhook secret and the raw request body."
+    );
+  }
+  return true;
+}
+function constructEvent(payload, signature, secret, options) {
+  verifySignature({
+    payload,
+    signature,
+    secret,
+    tolerance: options?.tolerance
+  });
+  try {
+    const event = JSON.parse(payload);
+    if (!event.id || !event.type || !event.data) {
+      throw new Error("Invalid event structure");
+    }
+    return event;
+  } catch (error) {
+    if (error instanceof SyntaxError) {
+      throw new WebhookSignatureVerificationError(
+        "Invalid JSON payload: " + error.message
+      );
+    }
+    throw error;
+  }
+}
+function constructEventWithHeaders(payload, headers, secret, options) {
+  verifySignature({
+    payload,
+    signature: headers.signature,
+    secret,
+    tolerance: options?.tolerance
+  });
+  try {
+    const event = JSON.parse(payload);
+    if (!event.id || !event.type || !event.data) {
+      throw new Error("Invalid event structure");
+    }
+    return {
+      ...event,
+      api_version: event.api_version || headers.version || "unknown",
+      account: event.account || headers.account
+    };
+  } catch (error) {
+    if (error instanceof SyntaxError) {
+      throw new WebhookSignatureVerificationError(
+        "Invalid JSON payload: " + error.message
+      );
+    }
+    throw error;
+  }
+}
+var webhooks = {
+  /**
+   * Constructs and verifies a webhook event
+   * @see constructEvent
+   */
+  constructEvent,
+  /**
+   * Constructs and verifies a webhook event with header metadata
+   * @see constructEventWithHeaders
+   */
+  constructEventWithHeaders,
+  /**
+   * Extract webhook headers from request
+   * @see extractWebhookHeaders
+   */
+  extractWebhookHeaders,
+  /**
+   * Verifies a webhook signature without parsing the payload
+   * @see verifySignature
+   */
+  verifySignature,
+  /**
+   * Default timestamp tolerance in seconds
+   */
+  TOLERANCE_IN_SECONDS: WEBHOOK_TOLERANCE_IN_SECONDS
+};
+var webhooks_default = webhooks;
+
+export {
+  WEBHOOK_TOLERANCE_IN_SECONDS,
+  extractWebhookHeaders,
+  WebhookSignatureVerificationError,
+  verifySignature,
+  constructEvent,
+  constructEventWithHeaders,
+  webhooks,
+  webhooks_default
+};
+//# sourceMappingURL=chunk-R2LGIZGP.mjs.map

package/dist/chunk-R2LGIZGP.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/webhooks.ts"],"sourcesContent":["/**\n * RevKeen Webhook Utilities for TypeScript/Node.js SDK\n *\n * This file is automatically bundled with the generated SDK.\n * It provides webhook signature verification and event construction.\n *\n * ## Webhook Headers\n *\n * RevKeen sends the following headers with each webhook delivery:\n * - `X-Revkeen-Signature`: HMAC signature (format: `t=xxx,v1=yyy`)\n * - `X-Revkeen-Version`: API version date (e.g., `2026-01-01`)\n * - `X-Revkeen-Account`: Merchant account ID\n * - `X-Revkeen-Event-Id`: Unique event identifier\n * - `X-Revkeen-Timestamp`: Unix timestamp\n *\n * @example Basic usage\n * ```typescript\n * import { RevKeen, constructEvent, WebhookSignatureVerificationError } from '@revkeen/sdk';\n *\n * // In your webhook endpoint\n * app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {\n *   const signature = req.headers['x-revkeen-signature'] as string;\n *\n *   try {\n *     const event = constructEvent(req.body.toString(), signature, webhookSecret);\n *\n *     switch (event.type) {\n *       case 'invoice.paid':\n *         const invoice = event.data.object;\n *         // Handle invoice paid...\n *         break;\n *       case 'subscription.created':\n *         const subscription = event.data.object;\n *         // Handle subscription created...\n *         break;\n *     }\n *\n *     res.json({ received: true });\n *   } catch (error) {\n *     if (error instanceof WebhookSignatureVerificationError) {\n *       console.error('Webhook signature verification failed:', error.message);\n *       return res.status(400).json({ error: 'Invalid signature' });\n *     }\n *     throw error;\n *   }\n * });\n * ```\n *\n * @example With version headers (recommended)\n * ```typescript\n * import {\n *   extractWebhookHeaders,\n *   constructEventWithHeaders,\n *   WebhookSignatureVerificationError\n * } from '@revkeen/sdk';\n *\n * app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {\n *   try {\n *     const headers = extractWebhookHeaders(req.headers);\n *     const event = constructEventWithHeaders(req.body.toString(), headers, webhookSecret);\n *\n *     console.log('API Version:', event.api_version);\n *     console.log('Account:', event.account);\n *\n *     // Handle the event...\n *     res.json({ received: true });\n *   } catch (error) {\n *     if (error instanceof WebhookSignatureVerificationError) {\n *       return res.status(400).json({ error: 'Invalid signature' });\n *     }\n *     throw error;\n *   }\n * });\n * ```\n */\n\nimport { createHmac, timingSafeEqual } from \"crypto\";\n\n/**\n * Default tolerance for timestamp validation (5 minutes)\n */\nexport const WEBHOOK_TOLERANCE_IN_SECONDS = 300;\n\n/**\n * All possible webhook event types\n */\nexport type WebhookEventType =\n  // Invoice events\n  | \"invoice.created\"\n  | \"invoice.updated\"\n  | \"invoice.finalized\"\n  | \"invoice.sent\"\n  | \"invoice.paid\"\n  | \"invoice.voided\"\n  | \"invoice.payment_failed\"\n  | \"invoice.overdue\"\n  // Subscription events\n  | \"subscription.created\"\n  | \"subscription.updated\"\n  | \"subscription.renewed\"\n  | \"subscription.canceled\"\n  | \"subscription.paused\"\n  | \"subscription.resumed\"\n  | \"subscription.trial_ending\"\n  | \"subscription.trial_ended\"\n  | \"subscription.past_due\"\n  // Payment events\n  | \"payment.succeeded\"\n  | \"payment.failed\"\n  | \"payment.refunded\"\n  | \"payment.disputed\"\n  | \"payment.captured\"\n  // Customer events\n  | \"customer.created\"\n  | \"customer.updated\"\n  | \"customer.deleted\"\n  | \"customer.payment_method.attached\"\n  | \"customer.payment_method.detached\"\n  // Checkout events\n  | \"checkout.session.completed\"\n  | \"checkout.session.expired\"\n  | \"checkout.session.async_payment_succeeded\"\n  | \"checkout.session.async_payment_failed\"\n  // Order events\n  | \"order.created\"\n  | \"order.updated\"\n  | \"order.paid\"\n  | \"order.canceled\"\n  | \"order.fulfilled\"\n  // Plan/Product events\n  | \"plan.created\"\n  | \"plan.updated\"\n  | \"plan.deleted\"\n  | \"product.created\"\n  | \"product.updated\"\n  | \"product.deleted\"\n  // Price events\n  | \"price.created\"\n  | \"price.updated\"\n  | \"price.deleted\"\n  // Integration events\n  | \"integration.product_mapping.created\"\n  | \"integration.product_mapping.updated\"\n  | \"integration.product_mapping.deleted\";\n\n/**\n * Webhook event data structure\n */\nexport interface WebhookEventData<T = unknown> {\n  /** The object that triggered the event */\n  object: T;\n  /** Previous attributes if this is an update event */\n  previous_attributes?: Partial<T>;\n}\n\n/**\n * Webhook event structure (Stripe-compatible)\n */\nexport interface WebhookEvent<T = unknown> {\n  /** Unique event identifier */\n  id: string;\n  /** Object type, always \"event\" */\n  object: \"event\";\n  /** Event type */\n  type: WebhookEventType;\n  /** Unix timestamp when the event was created */\n  created: number;\n  /** Whether this is a live mode event */\n  livemode: boolean;\n  /** API version used to render the event data */\n  api_version: string;\n  /** Merchant account ID */\n  account?: string;\n  /** Event data */\n  data: WebhookEventData<T>;\n  /** Request information */\n  request?: {\n    id?: string;\n    idempotency_key?: string;\n  };\n}\n\n/**\n * Options for webhook signature verification\n */\nexport interface WebhookVerifyOptions {\n  /** The raw request body as a string */\n  payload: string;\n  /** The signature header value (revkeen-signature) */\n  signature: string;\n  /** Your webhook secret (starts with rk_wh_) */\n  secret: string;\n  /** Tolerance in seconds for timestamp validation (default: 300) */\n  tolerance?: number;\n}\n\n/**\n * Webhook headers sent with each delivery\n */\nexport interface WebhookHeaders {\n  /** X-Revkeen-Signature: HMAC signature (t=xxx,v1=yyy) */\n  signature: string;\n  /** X-Revkeen-Version: API version date (e.g., \"2026-01-01\") */\n  version?: string;\n  /** X-Revkeen-Account: Merchant account ID */\n  account?: string;\n  /** X-Revkeen-Event-Id: Unique event identifier */\n  eventId?: string;\n  /** X-Revkeen-Timestamp: Unix timestamp */\n  timestamp?: string;\n}\n\n/**\n * Extract webhook headers from request headers\n * Works with both Request objects and plain header objects\n *\n * @example\n * ```typescript\n * // Express.js\n * const headers = extractWebhookHeaders({\n *   'x-revkeen-signature': req.headers['x-revkeen-signature'],\n *   'x-revkeen-version': req.headers['x-revkeen-version'],\n *   'x-revkeen-account': req.headers['x-revkeen-account'],\n *   'x-revkeen-event-id': req.headers['x-revkeen-event-id'],\n *   'x-revkeen-timestamp': req.headers['x-revkeen-timestamp'],\n * });\n *\n * // Next.js / Web Request\n * const headers = extractWebhookHeaders({\n *   'x-revkeen-signature': request.headers.get('x-revkeen-signature'),\n *   'x-revkeen-version': request.headers.get('x-revkeen-version'),\n *   'x-revkeen-account': request.headers.get('x-revkeen-account'),\n *   'x-revkeen-event-id': request.headers.get('x-revkeen-event-id'),\n *   'x-revkeen-timestamp': request.headers.get('x-revkeen-timestamp'),\n * });\n * ```\n */\nexport function extractWebhookHeaders(\n  headers: Record<string, string | string[] | null | undefined>\n): WebhookHeaders {\n  const getHeader = (name: string): string | undefined => {\n    const value = headers[name] || headers[name.toLowerCase()];\n    if (Array.isArray(value)) return value[0];\n    return value || undefined;\n  };\n\n  const signature = getHeader(\"X-Revkeen-Signature\") || getHeader(\"x-rk-signature\");\n  if (!signature) {\n    throw new WebhookSignatureVerificationError(\n      \"Missing webhook signature header (X-Revkeen-Signature or x-rk-signature)\"\n    );\n  }\n\n  return {\n    signature,\n    version: getHeader(\"X-Revkeen-Version\"),\n    account: getHeader(\"X-Revkeen-Account\"),\n    eventId: getHeader(\"X-Revkeen-Event-Id\"),\n    timestamp: getHeader(\"X-Revkeen-Timestamp\"),\n  };\n}\n\n/**\n * Error thrown when webhook signature verification fails\n */\nexport class WebhookSignatureVerificationError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"WebhookSignatureVerificationError\";\n    // Maintains proper stack trace for where our error was thrown\n    if (Error.captureStackTrace) {\n      Error.captureStackTrace(this, WebhookSignatureVerificationError);\n    }\n  }\n}\n\n/**\n * Parsed webhook signature components\n */\ninterface ParsedSignature {\n  timestamp: number;\n  signatures: string[];\n}\n\n/**\n * Parses a webhook signature header\n * Format: \"t={timestamp},v1={signature}\"\n */\nfunction parseSignatureHeader(header: string): ParsedSignature {\n  const parts = header.split(\",\");\n  let timestamp: number | undefined;\n  const signatures: string[] = [];\n\n  for (const part of parts) {\n    const [key, value] = part.split(\"=\");\n\n    if (key === \"t\") {\n      timestamp = parseInt(value, 10);\n    } else if (key === \"v1\") {\n      signatures.push(value);\n    }\n  }\n\n  if (!timestamp || signatures.length === 0) {\n    throw new WebhookSignatureVerificationError(\n      \"Invalid signature header: missing timestamp or signature\"\n    );\n  }\n\n  return { timestamp, signatures };\n}\n\n/**\n * Verifies a webhook signature and returns whether it's valid\n *\n * @param options - Verification options\n * @returns true if the signature is valid\n * @throws WebhookSignatureVerificationError if verification fails\n */\nexport function verifySignature(options: WebhookVerifyOptions): boolean {\n  const {\n    payload,\n    signature,\n    secret,\n    tolerance = WEBHOOK_TOLERANCE_IN_SECONDS,\n  } = options;\n\n  // Check if signature header exists\n  if (!signature) {\n    throw new WebhookSignatureVerificationError(\n      \"Missing webhook signature header\"\n    );\n  }\n\n  // Parse signature header\n  const parsed = parseSignatureHeader(signature);\n\n  // Check timestamp tolerance (prevent replay attacks)\n  const currentTime = Math.floor(Date.now() / 1000);\n  const timeDiff = Math.abs(currentTime - parsed.timestamp);\n\n  if (timeDiff > tolerance) {\n    throw new WebhookSignatureVerificationError(\n      `Timestamp outside tolerance window (${timeDiff}s > ${tolerance}s). ` +\n        \"The webhook might be a replay attack, or your server's clock might be out of sync.\"\n    );\n  }\n\n  // Generate expected signature\n  const signedPayload = `${parsed.timestamp}.${payload}`;\n  const expectedSignature = createHmac(\"sha256\", secret)\n    .update(signedPayload, \"utf8\")\n    .digest(\"hex\");\n\n  // Compare signatures using constant-time comparison\n  const signatureValid = parsed.signatures.some((sig) => {\n    try {\n      const sigBuffer = Buffer.from(sig, \"hex\");\n      const expectedBuffer = Buffer.from(expectedSignature, \"hex\");\n\n      // Only compare if lengths match\n      if (sigBuffer.length !== expectedBuffer.length) {\n        return false;\n      }\n\n      return timingSafeEqual(sigBuffer, expectedBuffer);\n    } catch {\n      return false;\n    }\n  });\n\n  if (!signatureValid) {\n    throw new WebhookSignatureVerificationError(\n      \"Signature verification failed. \" +\n        \"Ensure you're using the correct webhook secret and the raw request body.\"\n    );\n  }\n\n  return true;\n}\n\n/**\n * Constructs and verifies a webhook event from a raw payload\n *\n * @param payload - The raw request body as a string\n * @param signature - The signature header value (revkeen-signature header)\n * @param secret - Your webhook secret (starts with rk_wh_)\n * @param options - Additional options\n * @returns The verified webhook event\n * @throws WebhookSignatureVerificationError if verification fails\n *\n * @example\n * ```typescript\n * // Express.js example\n * app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {\n *   const event = constructEvent(\n *     req.body.toString(),\n *     req.headers['revkeen-signature'] as string,\n *     process.env.REVKEEN_WEBHOOK_SECRET!\n *   );\n *\n *   console.log('Received event:', event.type);\n *   res.json({ received: true });\n * });\n * ```\n *\n * @example\n * ```typescript\n * // Next.js API route example\n * export async function POST(req: Request) {\n *   const body = await req.text();\n *   const signature = req.headers.get('revkeen-signature')!;\n *\n *   const event = constructEvent(body, signature, process.env.REVKEEN_WEBHOOK_SECRET!);\n *\n *   // Handle the event...\n *   return Response.json({ received: true });\n * }\n * ```\n */\nexport function constructEvent(\n  payload: string,\n  signature: string,\n  secret: string,\n  options?: {\n    tolerance?: number;\n  }\n): WebhookEvent {\n  // Verify the signature\n  verifySignature({\n    payload,\n    signature,\n    secret,\n    tolerance: options?.tolerance,\n  });\n\n  // Parse and return the event\n  try {\n    const event = JSON.parse(payload) as WebhookEvent;\n\n    // Basic validation\n    if (!event.id || !event.type || !event.data) {\n      throw new Error(\"Invalid event structure\");\n    }\n\n    return event;\n  } catch (error) {\n    if (error instanceof SyntaxError) {\n      throw new WebhookSignatureVerificationError(\n        \"Invalid JSON payload: \" + error.message\n      );\n    }\n    throw error;\n  }\n}\n\n/**\n * Constructs and verifies a webhook event with header metadata\n *\n * This function extracts version information from headers and merges it\n * with the event payload for a richer event object.\n *\n * @param payload - The raw request body as a string\n * @param headers - Webhook headers extracted from the request\n * @param secret - Your webhook secret (starts with rk_wh_)\n * @param options - Additional options\n * @returns The verified webhook event with header metadata\n * @throws WebhookSignatureVerificationError if verification fails\n *\n * @example\n * ```typescript\n * // Express.js example\n * app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {\n *   const headers = extractWebhookHeaders(req.headers);\n *   const event = constructEventWithHeaders(\n *     req.body.toString(),\n *     headers,\n *     process.env.REVKEEN_WEBHOOK_SECRET!\n *   );\n *\n *   console.log('API Version:', event.api_version);\n *   console.log('Account:', event.account);\n *   res.json({ received: true });\n * });\n * ```\n */\nexport function constructEventWithHeaders(\n  payload: string,\n  headers: WebhookHeaders,\n  secret: string,\n  options?: {\n    tolerance?: number;\n  }\n): WebhookEvent {\n  // Verify the signature using the header\n  verifySignature({\n    payload,\n    signature: headers.signature,\n    secret,\n    tolerance: options?.tolerance,\n  });\n\n  // Parse the event\n  try {\n    const event = JSON.parse(payload) as WebhookEvent;\n\n    // Basic validation\n    if (!event.id || !event.type || !event.data) {\n      throw new Error(\"Invalid event structure\");\n    }\n\n    // Merge header metadata into event if not already present\n    return {\n      ...event,\n      api_version: event.api_version || headers.version || \"unknown\",\n      account: event.account || headers.account,\n    };\n  } catch (error) {\n    if (error instanceof SyntaxError) {\n      throw new WebhookSignatureVerificationError(\n        \"Invalid JSON payload: \" + error.message\n      );\n    }\n    throw error;\n  }\n}\n\n/**\n * Webhook utilities namespace for SDK integration\n */\nexport const webhooks = {\n  /**\n   * Constructs and verifies a webhook event\n   * @see constructEvent\n   */\n  constructEvent,\n\n  /**\n   * Constructs and verifies a webhook event with header metadata\n   * @see constructEventWithHeaders\n   */\n  constructEventWithHeaders,\n\n  /**\n   * Extract webhook headers from request\n   * @see extractWebhookHeaders\n   */\n  extractWebhookHeaders,\n\n  /**\n   * Verifies a webhook signature without parsing the payload\n   * @see verifySignature\n   */\n  verifySignature,\n\n  /**\n   * Default timestamp tolerance in seconds\n   */\n  TOLERANCE_IN_SECONDS: WEBHOOK_TOLERANCE_IN_SECONDS,\n};\n\nexport default webhooks;\n"],"mappings":";AA4EA,SAAS,YAAY,uBAAuB;AAKrC,IAAM,+BAA+B;AA4JrC,SAAS,sBACd,SACgB;AAChB,QAAM,YAAY,CAAC,SAAqC;AACtD,UAAM,QAAQ,QAAQ,IAAI,KAAK,QAAQ,KAAK,YAAY,CAAC;AACzD,QAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,CAAC;AACxC,WAAO,SAAS;AAAA,EAClB;AAEA,QAAM,YAAY,UAAU,qBAAqB,KAAK,UAAU,gBAAgB;AAChF,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,SAAS,UAAU,mBAAmB;AAAA,IACtC,SAAS,UAAU,mBAAmB;AAAA,IACtC,SAAS,UAAU,oBAAoB;AAAA,IACvC,WAAW,UAAU,qBAAqB;AAAA,EAC5C;AACF;AAKO,IAAM,oCAAN,MAAM,2CAA0C,MAAM;AAAA,EAC3D,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAEZ,QAAI,MAAM,mBAAmB;AAC3B,YAAM,kBAAkB,MAAM,kCAAiC;AAAA,IACjE;AAAA,EACF;AACF;AAcA,SAAS,qBAAqB,QAAiC;AAC7D,QAAM,QAAQ,OAAO,MAAM,GAAG;AAC9B,MAAI;AACJ,QAAM,aAAuB,CAAC;AAE9B,aAAW,QAAQ,OAAO;AACxB,UAAM,CAAC,KAAK,KAAK,IAAI,KAAK,MAAM,GAAG;AAEnC,QAAI,QAAQ,KAAK;AACf,kBAAY,SAAS,OAAO,EAAE;AAAA,IAChC,WAAW,QAAQ,MAAM;AACvB,iBAAW,KAAK,KAAK;AAAA,IACvB;AAAA,EACF;AAEA,MAAI,CAAC,aAAa,WAAW,WAAW,GAAG;AACzC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,WAAW,WAAW;AACjC;AASO,SAAS,gBAAgB,SAAwC;AACtE,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY;AAAA,EACd,IAAI;AAGJ,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,QAAM,SAAS,qBAAqB,SAAS;AAG7C,QAAM,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAChD,QAAM,WAAW,KAAK,IAAI,cAAc,OAAO,SAAS;AAExD,MAAI,WAAW,WAAW;AACxB,UAAM,IAAI;AAAA,MACR,uCAAuC,QAAQ,OAAO,SAAS;AAAA,IAEjE;AAAA,EACF;AAGA,QAAM,gBAAgB,GAAG,OAAO,SAAS,IAAI,OAAO;AACpD,QAAM,oBAAoB,WAAW,UAAU,MAAM,EAClD,OAAO,eAAe,MAAM,EAC5B,OAAO,KAAK;AAGf,QAAM,iBAAiB,OAAO,WAAW,KAAK,CAAC,QAAQ;AACrD,QAAI;AACF,YAAM,YAAY,OAAO,KAAK,KAAK,KAAK;AACxC,YAAM,iBAAiB,OAAO,KAAK,mBAAmB,KAAK;AAG3D,UAAI,UAAU,WAAW,eAAe,QAAQ;AAC9C,eAAO;AAAA,MACT;AAEA,aAAO,gBAAgB,WAAW,cAAc;AAAA,IAClD,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AAED,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAEA,SAAO;AACT;AAyCO,SAAS,eACd,SACA,WACA,QACA,SAGc;AAEd,kBAAgB;AAAA,IACd;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,SAAS;AAAA,EACtB,CAAC;AAGD,MAAI;AACF,UAAM,QAAQ,KAAK,MAAM,OAAO;AAGhC,QAAI,CAAC,MAAM,MAAM,CAAC,MAAM,QAAQ,CAAC,MAAM,MAAM;AAC3C,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC3C;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,aAAa;AAChC,YAAM,IAAI;AAAA,QACR,2BAA2B,MAAM;AAAA,MACnC;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;AAgCO,SAAS,0BACd,SACA,SACA,QACA,SAGc;AAEd,kBAAgB;AAAA,IACd;AAAA,IACA,WAAW,QAAQ;AAAA,IACnB;AAAA,IACA,WAAW,SAAS;AAAA,EACtB,CAAC;AAGD,MAAI;AACF,UAAM,QAAQ,KAAK,MAAM,OAAO;AAGhC,QAAI,CAAC,MAAM,MAAM,CAAC,MAAM,QAAQ,CAAC,MAAM,MAAM;AAC3C,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC3C;AAGA,WAAO;AAAA,MACL,GAAG;AAAA,MACH,aAAa,MAAM,eAAe,QAAQ,WAAW;AAAA,MACrD,SAAS,MAAM,WAAW,QAAQ;AAAA,IACpC;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,aAAa;AAChC,YAAM,IAAI;AAAA,QACR,2BAA2B,MAAM;AAAA,MACnC;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;AAKO,IAAM,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA,EAKtB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AAAA;AAAA;AAAA;AAAA,EAKA,sBAAsB;AACxB;AAEA,IAAO,mBAAQ;","names":[]}

package/dist/chunk-VKMDZSYJ.mjs

@@ -0,0 +1,102 @@
+// src/core/errors.ts
+var RevKeenError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "RevKeenError";
+  }
+};
+var RevKeenAPIError = class extends RevKeenError {
+  constructor(status, message, body) {
+    super(message);
+    this.status = status;
+    this.body = body;
+    this.name = "RevKeenAPIError";
+  }
+};
+var RevKeenTimeoutError = class extends RevKeenError {
+  constructor(message) {
+    super(message);
+    this.name = "RevKeenTimeoutError";
+  }
+};
+
+// src/core/oauth.ts
+var DEFAULT_TOKEN_ENDPOINT = "https://api.revkeen.com/api/auth/oauth2/token";
+var PRE_EXPIRY_BUFFER_MS = 6e4;
+var OAuthTokenManager = class {
+  config;
+  cachedToken = null;
+  inflightRequest = null;
+  constructor(config) {
+    this.config = {
+      clientId: config.clientId,
+      clientSecret: config.clientSecret,
+      tokenEndpoint: config.tokenEndpoint || DEFAULT_TOKEN_ENDPOINT,
+      scopes: config.scopes
+    };
+  }
+  async getToken() {
+    if (this.cachedToken && Date.now() < this.cachedToken.expiresAt - PRE_EXPIRY_BUFFER_MS) {
+      return this.cachedToken.accessToken;
+    }
+    if (this.inflightRequest) {
+      return this.inflightRequest;
+    }
+    this.inflightRequest = this.fetchToken();
+    try {
+      return await this.inflightRequest;
+    } finally {
+      this.inflightRequest = null;
+    }
+  }
+  async fetchToken() {
+    if (this.cachedToken?.refreshToken) {
+      try {
+        return await this.requestToken("refresh_token");
+      } catch {
+      }
+    }
+    return await this.requestToken("client_credentials");
+  }
+  async requestToken(grantType) {
+    const body = new URLSearchParams();
+    body.set("grant_type", grantType);
+    if (grantType === "client_credentials") {
+      body.set("client_id", this.config.clientId);
+      body.set("client_secret", this.config.clientSecret);
+      if (this.config.scopes?.length) {
+        body.set("scope", this.config.scopes.join(" "));
+      }
+    } else if (grantType === "refresh_token" && this.cachedToken?.refreshToken) {
+      body.set("refresh_token", this.cachedToken.refreshToken);
+      body.set("client_id", this.config.clientId);
+      body.set("client_secret", this.config.clientSecret);
+    }
+    const res = await fetch(this.config.tokenEndpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: body.toString()
+    });
+    if (!res.ok) {
+      const errorBody = await res.text().catch(() => "");
+      throw new RevKeenError(
+        `OAuth token request failed (${res.status}): ${errorBody || res.statusText}`
+      );
+    }
+    const data = await res.json();
+    this.cachedToken = {
+      accessToken: data.access_token,
+      refreshToken: data.refresh_token ?? this.cachedToken?.refreshToken,
+      expiresAt: Date.now() + data.expires_in * 1e3
+    };
+    return data.access_token;
+  }
+};
+
+export {
+  RevKeenError,
+  RevKeenAPIError,
+  RevKeenTimeoutError,
+  OAuthTokenManager
+};
+//# sourceMappingURL=chunk-VKMDZSYJ.mjs.map

package/dist/chunk-VKMDZSYJ.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/errors.ts","../src/core/oauth.ts"],"sourcesContent":["export class RevKeenError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"RevKeenError\";\n  }\n}\n\nexport class RevKeenAPIError extends RevKeenError {\n  constructor(\n    public readonly status: number,\n    message: string,\n    public readonly body: unknown,\n  ) {\n    super(message);\n    this.name = \"RevKeenAPIError\";\n  }\n}\n\nexport class RevKeenTimeoutError extends RevKeenError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"RevKeenTimeoutError\";\n  }\n}\n","import { RevKeenError } from \"./errors.js\";\n\nexport interface OAuthConfig {\n  clientId: string;\n  clientSecret: string;\n  tokenEndpoint?: string;\n  scopes?: string[];\n}\n\ninterface TokenResponse {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token?: string;\n  scope?: string;\n}\n\ninterface CachedToken {\n  accessToken: string;\n  refreshToken?: string;\n  expiresAt: number;\n}\n\nconst DEFAULT_TOKEN_ENDPOINT = \"https://api.revkeen.com/api/auth/oauth2/token\";\nconst PRE_EXPIRY_BUFFER_MS = 60_000; // Refresh 60s before expiry\n\nexport class OAuthTokenManager {\n  private config: Required<Pick<OAuthConfig, \"clientId\" | \"clientSecret\" | \"tokenEndpoint\">> &\n    Pick<OAuthConfig, \"scopes\">;\n  private cachedToken: CachedToken | null = null;\n  private inflightRequest: Promise<string> | null = null;\n\n  constructor(config: OAuthConfig) {\n    this.config = {\n      clientId: config.clientId,\n      clientSecret: config.clientSecret,\n      tokenEndpoint: config.tokenEndpoint || DEFAULT_TOKEN_ENDPOINT,\n      scopes: config.scopes,\n    };\n  }\n\n  async getToken(): Promise<string> {\n    // Return cached token if still valid\n    if (this.cachedToken && Date.now() < this.cachedToken.expiresAt - PRE_EXPIRY_BUFFER_MS) {\n      return this.cachedToken.accessToken;\n    }\n\n    // Deduplicate concurrent requests\n    if (this.inflightRequest) {\n      return this.inflightRequest;\n    }\n\n    this.inflightRequest = this.fetchToken();\n    try {\n      return await this.inflightRequest;\n    } finally {\n      this.inflightRequest = null;\n    }\n  }\n\n  private async fetchToken(): Promise<string> {\n    // Try refresh token first if available\n    if (this.cachedToken?.refreshToken) {\n      try {\n        return await this.requestToken(\"refresh_token\");\n      } catch {\n        // Fall back to client_credentials\n      }\n    }\n\n    return await this.requestToken(\"client_credentials\");\n  }\n\n  private async requestToken(grantType: \"client_credentials\" | \"refresh_token\"): Promise<string> {\n    const body = new URLSearchParams();\n    body.set(\"grant_type\", grantType);\n\n    if (grantType === \"client_credentials\") {\n      body.set(\"client_id\", this.config.clientId);\n      body.set(\"client_secret\", this.config.clientSecret);\n      if (this.config.scopes?.length) {\n        body.set(\"scope\", this.config.scopes.join(\" \"));\n      }\n    } else if (grantType === \"refresh_token\" && this.cachedToken?.refreshToken) {\n      body.set(\"refresh_token\", this.cachedToken.refreshToken);\n      body.set(\"client_id\", this.config.clientId);\n      body.set(\"client_secret\", this.config.clientSecret);\n    }\n\n    const res = await fetch(this.config.tokenEndpoint, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body: body.toString(),\n    });\n\n    if (!res.ok) {\n      const errorBody = await res.text().catch(() => \"\");\n      throw new RevKeenError(\n        `OAuth token request failed (${res.status}): ${errorBody || res.statusText}`\n      );\n    }\n\n    const data = (await res.json()) as TokenResponse;\n\n    this.cachedToken = {\n      accessToken: data.access_token,\n      refreshToken: data.refresh_token ?? this.cachedToken?.refreshToken,\n      expiresAt: Date.now() + data.expires_in * 1000,\n    };\n\n    return data.access_token;\n  }\n}\n"],"mappings":";AAAO,IAAM,eAAN,cAA2B,MAAM;AAAA,EACtC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,kBAAN,cAA8B,aAAa;AAAA,EAChD,YACkB,QAChB,SACgB,MAChB;AACA,UAAM,OAAO;AAJG;AAEA;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,aAAa;AAAA,EACpD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;ACAA,IAAM,yBAAyB;AAC/B,IAAM,uBAAuB;AAEtB,IAAM,oBAAN,MAAwB;AAAA,EACrB;AAAA,EAEA,cAAkC;AAAA,EAClC,kBAA0C;AAAA,EAElD,YAAY,QAAqB;AAC/B,SAAK,SAAS;AAAA,MACZ,UAAU,OAAO;AAAA,MACjB,cAAc,OAAO;AAAA,MACrB,eAAe,OAAO,iBAAiB;AAAA,MACvC,QAAQ,OAAO;AAAA,IACjB;AAAA,EACF;AAAA,EAEA,MAAM,WAA4B;AAEhC,QAAI,KAAK,eAAe,KAAK,IAAI,IAAI,KAAK,YAAY,YAAY,sBAAsB;AACtF,aAAO,KAAK,YAAY;AAAA,IAC1B;AAGA,QAAI,KAAK,iBAAiB;AACxB,aAAO,KAAK;AAAA,IACd;AAEA,SAAK,kBAAkB,KAAK,WAAW;AACvC,QAAI;AACF,aAAO,MAAM,KAAK;AAAA,IACpB,UAAE;AACA,WAAK,kBAAkB;AAAA,IACzB;AAAA,EACF;AAAA,EAEA,MAAc,aAA8B;AAE1C,QAAI,KAAK,aAAa,cAAc;AAClC,UAAI;AACF,eAAO,MAAM,KAAK,aAAa,eAAe;AAAA,MAChD,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,WAAO,MAAM,KAAK,aAAa,oBAAoB;AAAA,EACrD;AAAA,EAEA,MAAc,aAAa,WAAoE;AAC7F,UAAM,OAAO,IAAI,gBAAgB;AACjC,SAAK,IAAI,cAAc,SAAS;AAEhC,QAAI,cAAc,sBAAsB;AACtC,WAAK,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC1C,WAAK,IAAI,iBAAiB,KAAK,OAAO,YAAY;AAClD,UAAI,KAAK,OAAO,QAAQ,QAAQ;AAC9B,aAAK,IAAI,SAAS,KAAK,OAAO,OAAO,KAAK,GAAG,CAAC;AAAA,MAChD;AAAA,IACF,WAAW,cAAc,mBAAmB,KAAK,aAAa,cAAc;AAC1E,WAAK,IAAI,iBAAiB,KAAK,YAAY,YAAY;AACvD,WAAK,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC1C,WAAK,IAAI,iBAAiB,KAAK,OAAO,YAAY;AAAA,IACpD;AAEA,UAAM,MAAM,MAAM,MAAM,KAAK,OAAO,eAAe;AAAA,MACjD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,MAC/D,MAAM,KAAK,SAAS;AAAA,IACtB,CAAC;AAED,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,YAAY,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AACjD,YAAM,IAAI;AAAA,QACR,+BAA+B,IAAI,MAAM,MAAM,aAAa,IAAI,UAAU;AAAA,MAC5E;AAAA,IACF;AAEA,UAAM,OAAQ,MAAM,IAAI,KAAK;AAE7B,SAAK,cAAc;AAAA,MACjB,aAAa,KAAK;AAAA,MAClB,cAAc,KAAK,iBAAiB,KAAK,aAAa;AAAA,MACtD,WAAW,KAAK,IAAI,IAAI,KAAK,aAAa;AAAA,IAC5C;AAEA,WAAO,KAAK;AAAA,EACd;AACF;","names":[]}