@skalpgg/sdk 1.0.0 → 1.3.0

package/README.md

@@ -1,6 +1,6 @@
 # skalp
 
-The official Skalp SDK for Node.js and edge runtimes: hosted checkout, subscriptions, webhook verification and license checks, with types for every response.
+The official Skalp SDK for Node.js and edge runtimes: hosted checkout, subscriptions, your product catalog and key stock, webhook verification and license checks, with types for every response.
 
 Full documentation with Next.js, Express, NestJS, Hono and Fastify examples: https://skalp.gg/docs/sdk
 
@@ -41,21 +41,121 @@ Create the key on the API keys page of your dashboard. Each key is bound to one
 
 | Method | Scope |
 | --- | --- |
-| `checkout.create({ productId, customerEmail?, metadata?, couponCode?, returnUrl? })` | `checkout:write` |
+| `checkout.create({ productId, quantity?, customerEmail?, metadata?, couponCode?, returnUrl?, customFields? })` | `checkout:write` |
 | `checkout.get(id)` | `checkout:read` |
+| `orders.list({ status?, productId?, email?, createdAfter?, createdBefore?, updatedSince?, limit?, offset? })` | `orders:read` |
 | `orders.get(id)` | `orders:read` |
-| `products.list()` | `products:read` |
+| `orders.cancel(id)` | `orders:write` |
+| `orders.replace(id, { serialIds?, values?, reason? })` | `orders:write` |
+| `products.list({ status? })` | `products:read` |
+| `products.get(idOrSlug)` | `products:read` |
+| `products.create({ name, price, fulfillmentType?, submit?, ... })` | `products:write` |
+| `products.update(idOrSlug, { price?, status?: 'DRAFT' \| 'ARCHIVED', ... })` | `products:write` |
+| `products.archive(idOrSlug)` | `products:write` |
+| `products.submit(idOrSlug)` | `products:write` |
+| `products.stock(idOrSlug)` | `products:read` |
+| `products.listSerials(idOrSlug, { status?, limit?, offset? })` | `products:write` |
+| `products.addSerials(idOrSlug, { serials?, text?, delimiter? })` | `products:write` |
+| `products.deleteSerial(idOrSlug, serialId)` | `products:write` |
+| `categories.list()` | `products:read` |
+| `categories.create({ name })` / `categories.update(id, { name?, sortOrder? })` / `categories.delete(id)` | `products:write` |
+| `groups.list()` / `groups.get(id)` | `products:read` |
+| `groups.create({ title, productIds, ... })` / `groups.update(id, { ... })` / `groups.delete(id)` | `products:write` |
+| `coupons.list()` / `coupons.get(id)` | `coupons:read` |
+| `coupons.create({ code, discountType?, discountPercent?, discountAmount?, validFrom?, validTo?, maxUses?, ... })` / `coupons.update(id, { ... })` / `coupons.delete(id)` | `coupons:write` |
+| `customers.list({ search?, limit?, offset? })` / `customers.get(id)` | `customers:read` |
+| `customers.create({ email, name?, note? })` / `customers.update(id, { name?, note? })` / `customers.delete(id)` | `customers:write` |
+| `customers.adjustBalance(id, { amount, reason? })` | `customers:write` |
+| `feedback.list({ productId?, rating?, limit?, offset? })` / `feedback.get(id)` | `feedback:read` |
+| `feedback.reply(id, { message })` / `feedback.appeal(id, { reason })` | `feedback:write` |
+| `queries.list({ status?, limit?, offset? })` / `queries.get(id)` | `queries:read` |
+| `queries.reply(id, { message })` / `queries.close(id)` / `queries.reopen(id)` | `queries:write` |
+| `blacklist.list({ type? })` / `whitelist.list({ type? })` | `blacklist:read` |
+| `blacklist.add({ type, value, note? })` / `whitelist.add({ ... })` / `blacklist.remove(id)` / `whitelist.remove(id)` | `blacklist:write` |
 | `subscriptions.createCheckout({ productId \| productSlug, externalRef?, customerEmail?, currency?, ... })` | `checkout:write` |
 | `subscriptions.getCheckout(id)` | `checkout:read` |
 | `subscriptions.list({ externalRef?, status?, updatedSince?, limit?, offset? })` | `subscriptions:read` |
 | `subscriptions.get(id)` | `subscriptions:read` |
+| `subscriptions.changePlan(id, { productId \| productSlug })` | `subscriptions:write` |
 | `subscriptions.cancel(id)` | `subscriptions:write` |
+| `subscriptions.createUsageCharge(id, { amount, currency, description, idempotencyKey, periodStart, periodEnd })` | `subscriptions:write` |
 | `subscriptions.listInvoices(id)` | `subscriptions:read` |
+| `coins.createCheckout({ steamHex, coins, idempotencyKey?, returnUrl? })` | `coins:purchase` |
+| `coins.getCheckoutStatus(reference)` | `coins:read` |
+| `licenses.validate({ key, productId?, hardwareId? })` | `licenses:validate` |
+| `licenses.resetDevices({ key, hardwareId? })` | `licenses:write` |
 | `licenses.verify({ licenseKey, serverIp, serverKey, serverPort? })` | none |
 | `licenses.heartbeat({ licenseKey, serverIp })` | none |
 | `webhooks.constructEvent(rawBody, headers)` | none |
 | `webhooks.verify(rawBody, headers)` | none |
 
+`products:write` does not include `products:read`: a key that manages the catalog usually needs both. Every catalog call counts against the key's rate limit.
+
+## Catalog
+
+```ts
+const product = await skalp.products.create({
+  name: 'Aurora Pro key',
+  price: 19.5,
+  fulfillmentType: 'SERIAL',
+})
+
+const { added, skipped, stock } = await skalp.products.addSerials(product.id, {
+  text: await readFile('keys.txt', 'utf8'),
+})
+
+await skalp.products.submit(product.id)
+```
+
+A product starts as a `DRAFT`. `submit` sends it to review, and the review sets `ACTIVE` or `REJECTED`; read the product to see which. `update` accepts only `DRAFT` and `ARCHIVED` as a `status`, and `archive` takes a product off sale without deleting anything. Pass `null` to `update` to clear `comparePrice`, `storeCategoryId`, `dynamicUrl` or `licenseDurationDays`.
+
+`addSerials` splits `text` on new lines unless you pass `delimiter` (`'comma'`, `'semicolon'` or any other string). A key the product already has is counted in `skipped` and not added again. `listSerials` returns the plain key values, which is why it needs `products:write`.
+
+## Orders and customers
+
+```ts
+const { data: orders } = await skalp.orders.list({ status: 'COMPLETED', updatedSince: lastSync, limit: 100 })
+
+await skalp.orders.cancel(order.id)
+
+const { replacements } = await skalp.orders.replace(order.id, { reason: 'Key does not activate' })
+
+await skalp.customers.adjustBalance(customer.id, { amount: 10, reason: 'Goodwill credit' })
+```
+
+`cancel` works only on a `PENDING` order and returns it as `CANCELED`. `replace` swaps the delivered keys of a completed order: with no `serialIds` it replaces every key, and with no `values` it draws the new ones from stock (`values` is required for keys that come from your server). The replacement keys come back in `replacements[].value`. `orders.get` also returns `serialsReplaced` and the `replacements` history.
+
+`updatedSince` lists oldest change first, so you can page through it and keep the last `updatedAt` as your cursor; without it, newest orders come first. Amounts are in major units (`19.5`), balances cannot go below zero, and a customer with a balance cannot be deleted.
+
+Coupons take `validFrom`, `validTo` as an ISO string or a `Date`; `coupons.update` accepts `null` to clear `validTo`, `maxUses`, `minPurchaseAmount` and `description`.
+
+## Support and access rules
+
+`feedback` and `queries` expose product reviews and buyer conversations. `queries.reply`, `close` and `reopen` return the whole conversation with its `messages`. `blacklist` and `whitelist` use the same calls and the same `blacklist:read` and `blacklist:write` scopes; a whitelisted buyer is never blocked by a blacklist rule.
+
+```ts
+await skalp.blacklist.add({ type: 'EMAIL', value: 'chargeback@example.com', note: 'Disputed order 1042' })
+```
+
+`type` is `EMAIL`, `IP`, `COUNTRY`, `ISP`, `ASN` or `HOST`. `blacklist.list` and `whitelist.list` return every rule as one array, not a page.
+
+## Usage charges
+
+```ts
+const charge = await skalp.subscriptions.createUsageCharge(subscription.id, {
+  amount: 12.34,
+  currency: 'EUR',
+  description: 'Traffic over your plan, September 2026',
+  idempotencyKey: `overage:${tenantId}:2026-09`,
+  periodStart: new Date('2026-09-01T00:00:00Z'),
+  periodEnd: new Date('2026-10-01T00:00:00Z'),
+})
+
+if (charge.status === 'open') await emailPaymentLink(charge.hostedUrl)
+```
+
+The same `idempotencyKey` always returns the same charge, so retry with it after a timeout or a 5xx.
+
 ## Webhooks
 
 Pass the raw request body, not parsed JSON, together with the request headers. `constructEvent` checks the `Skalp-Signature` header, an HMAC-SHA256 over the timestamp and the exact bytes Skalp sent, and rejects deliveries older than 5 minutes.
@@ -74,8 +174,24 @@ export async function POST(request: Request) {
 
 A webhook with the default events receives every purchase as both `order.paid` and its legacy name `purchase.completed`. Handle `order.paid` and deduplicate on `data.idempotencyKey`.
 
+`order.created`, `order.updated`, `order.canceled`, `order.replaced`, `query.created`, `query.replied`, `feedback.received` and the subscription events `subscription.updated`, `subscription.trial_started`, `subscription.trial_ended` and `subscription.upcoming` are not in the default list either: subscribe the webhook to them by name, and `event.type` narrows `event.data` to the right payload. `order.created`, `order.updated` and `order.canceled` carry the order as `orders.get` returns it, plus `previousStatus`; `order.replaced` adds `reason` and the new keys in `replacements[].key`. The three trial and upcoming events are accepted by the API but the backend does not send them yet.
+
+`product.created`, `product.updated` and `product.stock` are not in the default list: subscribe the webhook to them by name. `product.stock` carries `stock`, `previousStock` and `change` whenever the number of available keys changes.
+
 ## Errors
 
-API errors throw `SkalpError` with `status`, `code` (for example `STORE_REQUIRED`) and the parsed `body`. A `429` is retried up to `maxRetries` times (default 2) when the limit resets within 10 seconds. An invalid webhook signature throws `SkalpSignatureError`.
+A refusal from the API throws `SkalpError` with `status`, `code` (for example `STORE_REQUIRED`) and the parsed `body`. A network failure or a timeout throws `SkalpConnectionError`, naming the call and keeping the original in `cause`, so the two are easy to tell apart:
+
+```ts
+try {
+  await skalp.orders.get(id)
+} catch (error) {
+  if (error instanceof SkalpError) return reportRefusal(error.code, error.status)
+  if (error instanceof SkalpConnectionError) return retryLater()
+  throw error
+}
+```
+
+A `429` is retried up to `maxRetries` times (default 2) when the limit resets within 10 seconds. `constructEvent` throws `SkalpSignatureError` with `reason: 'stale' | 'invalid'`: `'stale'` means the delivery is outside the 5 minute replay window, `'invalid'` means the bytes or the secret do not match.
 
 The constructor throws if it finds an API key in a browser, so the mistake shows up the first time you run the code rather than after a secret key has shipped to users. Pass `dangerouslyAllowBrowser: true` to override it.

package/dist/cjs/index.d.ts

@@ -1,5 +1,6 @@
-import type { CheckoutSession, CheckoutSessionStatus, CreateCheckoutParams, CreateSubscriptionCheckoutParams, HeartbeatParams, Invoice, LicenseVerification, ListSubscriptionsParams, Order, Product, SkalpEvent, Subscription, SubscriptionCheckout, SubscriptionCheckoutStatus, SubscriptionList, VerifyLicenseParams } from './types.js';
+import type { AccessRule, AddAccessRuleParams, AddSerialsParams, AddSerialsResult, AdjustCustomerBalanceParams, AppealFeedbackParams, ChangeSubscriptionPlanParams, CheckoutSession, CheckoutSessionStatus, CoinCheckout, CoinCheckoutStatus, Coupon, CreateCheckoutParams, CreateCoinCheckoutParams, CreateCouponParams, CreateCustomerParams, CreateProductGroupParams, CreateProductParams, CreateStoreCategoryParams, CreateSubscriptionCheckoutParams, CreateUsageChargeParams, Customer, CustomerDetails, CustomerList, Deleted, Feedback, FeedbackList, HeartbeatParams, Invoice, LicenseKeyInfo, LicenseValidation, LicenseVerification, ListAccessRulesParams, ListCustomersParams, ListFeedbackParams, ListOrdersParams, ListProductsParams, ListQueriesParams, ListSerialsParams, ListSubscriptionsParams, Order, OrderKeysReplaced, OrderList, Product, ProductGroup, ProductStock, ReplaceOrderKeysParams, ReplyParams, SerialList, SkalpEvent, StoreCategory, StoreCategoryWithCount, Subscription, SubscriptionCheckout, SubscriptionCheckoutStatus, SubscriptionList, SupportQueryDetails, SupportQueryList, ResetLicenseDevicesParams, UpdateCouponParams, UpdateCustomerParams, UpdateProductGroupParams, UpdateProductParams, UpdateStoreCategoryParams, UsageCharge, ValidateLicenseParams, VerifyLicenseParams } from './types.js';
 export type * from './types.js';
+export declare const VERSION = "1.3.0";
 export interface SkalpOptions {
     apiKey?: string;
     webhookSecret?: string;
@@ -19,35 +20,113 @@ export declare class SkalpError extends Error {
     readonly body: unknown;
     constructor(message: string, status: number, code?: string, body?: unknown);
 }
+export declare class SkalpConnectionError extends Error {
+    constructor(method: string, path: string, cause: unknown);
+}
+export type SignatureFailure = 'stale' | 'invalid';
 export declare class SkalpSignatureError extends Error {
-    constructor(message?: string);
+    readonly reason: SignatureFailure;
+    constructor(reason?: SignatureFailure);
 }
 export declare class Skalp {
     #private;
     constructor(options?: string | SkalpOptions);
     readonly checkout: {
-        create: (params: CreateCheckoutParams) => Promise<CheckoutSession>;
+        create: ({ productId, quantity, customerEmail, metadata, couponCode, returnUrl, customFields }: CreateCheckoutParams) => Promise<CheckoutSession>;
         get: (id: string) => Promise<CheckoutSessionStatus>;
     };
     readonly orders: {
+        list: ({ status, productId, email, createdAfter, createdBefore, updatedSince, limit, offset }?: ListOrdersParams) => Promise<OrderList>;
         get: (id: string) => Promise<Order>;
+        cancel: (id: string) => Promise<Order>;
+        replace: (id: string, { serialIds, values, reason }?: ReplaceOrderKeysParams) => Promise<OrderKeysReplaced>;
     };
     readonly products: {
-        list: () => Promise<Product[]>;
+        list: ({ status }?: ListProductsParams) => Promise<Product[]>;
+        get: (idOrSlug: string) => Promise<Product>;
+        create: (params: CreateProductParams) => Promise<Product>;
+        update: (idOrSlug: string, params: UpdateProductParams) => Promise<Product>;
+        archive: (idOrSlug: string) => Promise<Product>;
+        submit: (idOrSlug: string) => Promise<Product>;
+        stock: (idOrSlug: string) => Promise<ProductStock>;
+        listSerials: (idOrSlug: string, { status, limit, offset }?: ListSerialsParams) => Promise<SerialList>;
+        addSerials: (idOrSlug: string, { serials, text, delimiter }: AddSerialsParams) => Promise<AddSerialsResult>;
+        deleteSerial: (idOrSlug: string, serialId: string) => Promise<Deleted>;
+    };
+    readonly categories: {
+        list: () => Promise<StoreCategoryWithCount[]>;
+        create: ({ name }: CreateStoreCategoryParams) => Promise<StoreCategory>;
+        update: (id: string, { name, sortOrder }: UpdateStoreCategoryParams) => Promise<StoreCategory>;
+        delete: (id: string) => Promise<Deleted>;
+    };
+    readonly groups: {
+        list: () => Promise<ProductGroup[]>;
+        get: (id: string) => Promise<ProductGroup>;
+        create: (params: CreateProductGroupParams) => Promise<ProductGroup>;
+        update: (id: string, params: UpdateProductGroupParams) => Promise<ProductGroup>;
+        delete: (id: string) => Promise<Deleted>;
+    };
+    readonly coupons: {
+        list: () => Promise<Coupon[]>;
+        get: (id: string) => Promise<Coupon>;
+        create: (params: CreateCouponParams) => Promise<Coupon>;
+        update: (id: string, params: UpdateCouponParams) => Promise<Coupon>;
+        delete: (id: string) => Promise<Deleted>;
+    };
+    readonly customers: {
+        list: ({ search, limit, offset }?: ListCustomersParams) => Promise<CustomerList>;
+        get: (id: string) => Promise<CustomerDetails>;
+        create: ({ email, name, note }: CreateCustomerParams) => Promise<Customer>;
+        update: (id: string, { name, note }: UpdateCustomerParams) => Promise<Customer>;
+        delete: (id: string) => Promise<Deleted>;
+        adjustBalance: (id: string, { amount, reason }: AdjustCustomerBalanceParams) => Promise<Customer>;
+    };
+    readonly feedback: {
+        list: ({ productId, rating, limit, offset }?: ListFeedbackParams) => Promise<FeedbackList>;
+        get: (id: string) => Promise<Feedback>;
+        reply: (id: string, { message }: ReplyParams) => Promise<Feedback>;
+        appeal: (id: string, { reason }: AppealFeedbackParams) => Promise<Feedback>;
+    };
+    readonly queries: {
+        list: ({ status, limit, offset }?: ListQueriesParams) => Promise<SupportQueryList>;
+        get: (id: string) => Promise<SupportQueryDetails>;
+        reply: (id: string, { message }: ReplyParams) => Promise<SupportQueryDetails>;
+        close: (id: string) => Promise<SupportQueryDetails>;
+        reopen: (id: string) => Promise<SupportQueryDetails>;
+    };
+    readonly blacklist: {
+        list: ({ type }?: ListAccessRulesParams) => Promise<AccessRule[]>;
+        add: ({ type, value, note }: AddAccessRuleParams) => Promise<AccessRule>;
+        remove: (id: string) => Promise<Deleted>;
+    };
+    readonly whitelist: {
+        list: ({ type }?: ListAccessRulesParams) => Promise<AccessRule[]>;
+        add: ({ type, value, note }: AddAccessRuleParams) => Promise<AccessRule>;
+        remove: (id: string) => Promise<Deleted>;
+    };
+    readonly coins: {
+        createCheckout: ({ steamHex, coins, idempotencyKey, returnUrl }: CreateCoinCheckoutParams) => Promise<CoinCheckout>;
+        getCheckoutStatus: (reference: string) => Promise<CoinCheckoutStatus>;
     };
     readonly subscriptions: {
-        createCheckout: (params: CreateSubscriptionCheckoutParams) => Promise<SubscriptionCheckout>;
+        createCheckout: ({ productId, productSlug, customerEmail, externalRef, metadata, currency, returnUrl, }: CreateSubscriptionCheckoutParams) => Promise<SubscriptionCheckout>;
         getCheckout: (id: string) => Promise<SubscriptionCheckoutStatus>;
-        list: (params?: ListSubscriptionsParams) => Promise<SubscriptionList>;
+        list: ({ externalRef, status, updatedSince, limit, offset }?: ListSubscriptionsParams) => Promise<SubscriptionList>;
         get: (id: string) => Promise<Subscription>;
+        changePlan: (id: string, { productId, productSlug }: ChangeSubscriptionPlanParams) => Promise<Subscription>;
         cancel: (id: string) => Promise<Subscription>;
+        createUsageCharge: (id: string, { amount, currency, description, idempotencyKey, periodStart, periodEnd }: CreateUsageChargeParams) => Promise<UsageCharge>;
         listInvoices: (id: string) => Promise<Invoice[]>;
     };
     readonly licenses: {
-        verify: (params: VerifyLicenseParams) => Promise<LicenseVerification>;
-        heartbeat: (params: HeartbeatParams) => Promise<{
+        verify: ({ licenseKey, serverIp, serverKey, serverPort }: VerifyLicenseParams) => Promise<LicenseVerification>;
+        heartbeat: ({ licenseKey, serverIp }: HeartbeatParams) => Promise<{
             valid: boolean;
         }>;
+        validate: ({ key, productId, hardwareId }: ValidateLicenseParams) => Promise<LicenseValidation>;
+        resetDevices: ({ key, hardwareId }: ResetLicenseDevicesParams) => Promise<{
+            license: LicenseKeyInfo;
+        }>;
     };
     readonly webhooks: {
         verify: (payload: WebhookPayload, signature: SignatureSource, secret?: string) => Promise<boolean>;

package/dist/cjs/index.js

@@ -1,8 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Skalp = exports.SkalpSignatureError = exports.SkalpError = void 0;
+exports.Skalp = exports.SkalpSignatureError = exports.SkalpConnectionError = exports.SkalpError = exports.VERSION = void 0;
+exports.VERSION = '1.3.0';
 const SIGNATURE_HEADER = 'skalp-signature';
 const SIGNATURE_TOLERANCE_SECONDS = 300;
+const USER_AGENT = `skalp-node/${exports.VERSION}`;
+const DEFAULT_TIMEOUT_MS = 30_000;
+const MAX_RETRY_WAIT_SECONDS = 10;
 class SkalpError extends Error {
     status;
     code;
@@ -16,16 +20,69 @@ class SkalpError extends Error {
     }
 }
 exports.SkalpError = SkalpError;
+class SkalpConnectionError extends Error {
+    constructor(method, path, cause) {
+        super(`Skalp: ${method} ${path}: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+        this.name = 'SkalpConnectionError';
+    }
+}
+exports.SkalpConnectionError = SkalpConnectionError;
 class SkalpSignatureError extends Error {
-    constructor(message = 'Invalid Skalp webhook signature') {
-        super(message);
+    reason;
+    constructor(reason = 'invalid') {
+        super(reason === 'stale'
+            ? 'Skalp: webhook signature is outside the replay window'
+            : 'Skalp: invalid webhook signature');
         this.name = 'SkalpSignatureError';
+        this.reason = reason;
     }
 }
 exports.SkalpSignatureError = SkalpSignatureError;
 const env = (name) => globalThis.process?.env?.[name];
 const segment = (id) => encodeURIComponent(id);
-const MAX_RETRY_WAIT_SECONDS = 10;
+const isoDate = (value) => (value instanceof Date ? value.toISOString() : value);
+const optionalDate = (value) => value instanceof Date ? value.toISOString() : value;
+const PRODUCT_FIELDS = [
+    'name',
+    'slug',
+    'description',
+    'shortDescription',
+    'price',
+    'comparePrice',
+    'category',
+    'categoryId',
+    'storeCategoryId',
+    'tags',
+    'images',
+    'videoUrl',
+    'fulfillmentType',
+    'billingInterval',
+    'trialPeriodDays',
+    'dynamicUrl',
+    'licenseDeviceLimit',
+    'licenseDurationDays',
+];
+const COUPON_FIELDS = [
+    'discountType',
+    'discountPercent',
+    'discountAmount',
+    'productIds',
+    'disabledWithVolumeDiscounts',
+    'description',
+    'maxUses',
+    'minPurchaseAmount',
+    'oneTimePerUser',
+];
+const GROUP_FIELDS = ['title', 'productIds', 'description', 'image', 'sortPriority', 'unlisted'];
+function pick(source, keys) {
+    const picked = {};
+    for (const key of keys) {
+        const value = source[key];
+        if (value !== undefined)
+            picked[key] = value;
+    }
+    return picked;
+}
 class Skalp {
     #apiKey;
     #webhookSecret;
@@ -38,7 +95,7 @@ class Skalp {
         this.#apiKey = o.apiKey ?? env('SKALP_API_KEY');
         this.#webhookSecret = o.webhookSecret ?? env('SKALP_WEBHOOK_SECRET');
         this.#baseUrl = (o.baseUrl ?? env('SKALP_API_URL') ?? 'https://api.skalp.gg').replace(/\/+$/, '');
-        this.#timeout = o.timeout ?? 30_000;
+        this.#timeout = o.timeout && o.timeout > 0 ? o.timeout : DEFAULT_TIMEOUT_MS;
         this.#maxRetries = o.maxRetries ?? 2;
         this.#fetch = o.fetch ?? ((...args) => fetch(...args));
         if (this.#apiKey && 'window' in globalThis && 'document' in globalThis && !o.dangerouslyAllowBrowser) {
@@ -46,62 +103,198 @@ class Skalp {
         }
     }
     checkout = {
-        create: (params) => {
-            const { productId, ...rest } = params;
-            return this.#request('POST', '/v1/checkout/sessions', {
-                body: { items: [{ productId, quantity: 1 }], ...rest },
-            });
-        },
+        create: ({ productId, quantity, customerEmail, metadata, couponCode, returnUrl, customFields }) => this.#request('POST', '/v1/checkout/sessions', {
+            body: { items: [{ productId, quantity }], customerEmail, metadata, couponCode, returnUrl, customFields },
+        }),
         get: (id) => this.#request('GET', `/v1/checkout/sessions/${segment(id)}`),
     };
     orders = {
+        list: ({ status, productId, email, createdAfter, createdBefore, updatedSince, limit, offset } = {}) => this.#request('GET', '/v1/orders', {
+            query: {
+                status,
+                productId,
+                email,
+                createdAfter: optionalDate(createdAfter),
+                createdBefore: optionalDate(createdBefore),
+                updatedSince: optionalDate(updatedSince),
+                limit,
+                offset,
+            },
+        }),
         get: (id) => this.#request('GET', `/v1/orders/${segment(id)}`),
+        cancel: (id) => this.#request('POST', `/v1/orders/${segment(id)}/cancel`),
+        replace: (id, { serialIds, values, reason } = {}) => this.#request('POST', `/v1/orders/${segment(id)}/replacement`, {
+            body: { serialIds, values, reason },
+        }),
     };
     products = {
-        list: () => this.#request('GET', '/v1/products'),
+        list: ({ status } = {}) => this.#request('GET', '/v1/products', { query: { status } }),
+        get: (idOrSlug) => this.#request('GET', `/v1/products/${segment(idOrSlug)}`),
+        create: (params) => this.#request('POST', '/v1/products', {
+            body: pick(params, [...PRODUCT_FIELDS, 'productType', 'submit']),
+        }),
+        update: (idOrSlug, params) => this.#request('PATCH', `/v1/products/${segment(idOrSlug)}`, {
+            body: pick(params, [...PRODUCT_FIELDS, 'status']),
+        }),
+        archive: (idOrSlug) => this.#request('DELETE', `/v1/products/${segment(idOrSlug)}`),
+        submit: (idOrSlug) => this.#request('POST', `/v1/products/${segment(idOrSlug)}/submit`),
+        stock: (idOrSlug) => this.#request('GET', `/v1/products/${segment(idOrSlug)}/stock`),
+        listSerials: (idOrSlug, { status, limit, offset } = {}) => this.#request('GET', `/v1/products/${segment(idOrSlug)}/serials`, {
+            query: { status, limit, offset },
+        }),
+        addSerials: (idOrSlug, { serials, text, delimiter }) => this.#request('POST', `/v1/products/${segment(idOrSlug)}/serials`, {
+            body: { serials, text, delimiter },
+        }),
+        deleteSerial: (idOrSlug, serialId) => this.#request('DELETE', `/v1/products/${segment(idOrSlug)}/serials/${segment(serialId)}`),
+    };
+    categories = {
+        list: () => this.#request('GET', '/v1/categories'),
+        create: ({ name }) => this.#request('POST', '/v1/categories', { body: { name } }),
+        update: (id, { name, sortOrder }) => this.#request('PATCH', `/v1/categories/${segment(id)}`, { body: { name, sortOrder } }),
+        delete: (id) => this.#request('DELETE', `/v1/categories/${segment(id)}`),
+    };
+    groups = {
+        list: () => this.#request('GET', '/v1/groups'),
+        get: (id) => this.#request('GET', `/v1/groups/${segment(id)}`),
+        create: (params) => this.#request('POST', '/v1/groups', { body: pick(params, GROUP_FIELDS) }),
+        update: (id, params) => this.#request('PATCH', `/v1/groups/${segment(id)}`, { body: pick(params, GROUP_FIELDS) }),
+        delete: (id) => this.#request('DELETE', `/v1/groups/${segment(id)}`),
+    };
+    coupons = {
+        list: () => this.#request('GET', '/v1/coupons'),
+        get: (id) => this.#request('GET', `/v1/coupons/${segment(id)}`),
+        create: (params) => this.#request('POST', '/v1/coupons', {
+            body: {
+                ...pick(params, [...COUPON_FIELDS, 'code']),
+                validFrom: optionalDate(params.validFrom),
+                validTo: optionalDate(params.validTo),
+            },
+        }),
+        update: (id, params) => this.#request('PATCH', `/v1/coupons/${segment(id)}`, {
+            body: {
+                ...pick(params, [...COUPON_FIELDS, 'isActive']),
+                validFrom: optionalDate(params.validFrom),
+                validTo: optionalDate(params.validTo),
+            },
+        }),
+        delete: (id) => this.#request('DELETE', `/v1/coupons/${segment(id)}`),
+    };
+    customers = {
+        list: ({ search, limit, offset } = {}) => this.#request('GET', '/v1/customers', { query: { search, limit, offset } }),
+        get: (id) => this.#request('GET', `/v1/customers/${segment(id)}`),
+        create: ({ email, name, note }) => this.#request('POST', '/v1/customers', { body: { email, name, note } }),
+        update: (id, { name, note }) => this.#request('PATCH', `/v1/customers/${segment(id)}`, { body: { name, note } }),
+        delete: (id) => this.#request('DELETE', `/v1/customers/${segment(id)}`),
+        adjustBalance: (id, { amount, reason }) => this.#request('POST', `/v1/customers/${segment(id)}/balance`, { body: { amount, reason } }),
+    };
+    feedback = {
+        list: ({ productId, rating, limit, offset } = {}) => this.#request('GET', '/v1/feedback', { query: { productId, rating, limit, offset } }),
+        get: (id) => this.#request('GET', `/v1/feedback/${segment(id)}`),
+        reply: (id, { message }) => this.#request('POST', `/v1/feedback/${segment(id)}/reply`, { body: { message } }),
+        appeal: (id, { reason }) => this.#request('POST', `/v1/feedback/${segment(id)}/appeal`, { body: { reason } }),
+    };
+    queries = {
+        list: ({ status, limit, offset } = {}) => this.#request('GET', '/v1/queries', { query: { status, limit, offset } }),
+        get: (id) => this.#request('GET', `/v1/queries/${segment(id)}`),
+        reply: (id, { message }) => this.#request('POST', `/v1/queries/${segment(id)}/reply`, { body: { message } }),
+        close: (id) => this.#request('POST', `/v1/queries/${segment(id)}/close`),
+        reopen: (id) => this.#request('POST', `/v1/queries/${segment(id)}/reopen`),
+    };
+    blacklist = this.#accessRules('blacklist');
+    whitelist = this.#accessRules('whitelist');
+    #accessRules(list) {
+        return {
+            list: ({ type } = {}) => this.#request('GET', `/v1/${list}`, { query: { type } }),
+            add: ({ type, value, note }) => this.#request('POST', `/v1/${list}`, { body: { type, value, note } }),
+            remove: (id) => this.#request('DELETE', `/v1/${list}/${segment(id)}`),
+        };
+    }
+    coins = {
+        createCheckout: ({ steamHex, coins, idempotencyKey, returnUrl }) => this.#request('POST', '/coins/checkout', {
+            body: { steamHex, coins, idempotencyKey, returnUrl },
+        }),
+        getCheckoutStatus: (reference) => this.#request('GET', `/coins/checkout/${segment(reference)}/status`),
     };
     subscriptions = {
-        createCheckout: (params) => this.#request('POST', '/v1/subscriptions/checkout', { body: params }),
+        createCheckout: ({ productId, productSlug, customerEmail, externalRef, metadata, currency, returnUrl, }) => this.#request('POST', '/v1/subscriptions/checkout', {
+            body: { productId, productSlug, customerEmail, externalRef, metadata, currency, returnUrl },
+        }),
         getCheckout: (id) => this.#request('GET', `/v1/subscriptions/checkout/${segment(id)}`),
-        list: (params = {}) => this.#request('GET', '/v1/subscriptions', {
+        list: ({ externalRef, status, updatedSince, limit, offset } = {}) => this.#request('GET', '/v1/subscriptions', {
             query: {
-                ...params,
-                updatedSince: params.updatedSince instanceof Date ? params.updatedSince.toISOString() : params.updatedSince,
+                externalRef,
+                status,
+                updatedSince: updatedSince instanceof Date ? updatedSince.toISOString() : updatedSince,
+                limit,
+                offset,
             },
         }),
         get: (id) => this.#request('GET', `/v1/subscriptions/${segment(id)}`),
+        changePlan: (id, { productId, productSlug }) => this.#request('POST', `/v1/subscriptions/${segment(id)}/plan`, {
+            body: { productId, productSlug },
+        }),
         cancel: (id) => this.#request('DELETE', `/v1/subscriptions/${segment(id)}`),
+        createUsageCharge: (id, { amount, currency, description, idempotencyKey, periodStart, periodEnd }) => this.#request('POST', `/v1/subscriptions/${segment(id)}/usage-charges`, {
+            body: {
+                amount,
+                currency,
+                description,
+                idempotencyKey,
+                periodStart: isoDate(periodStart),
+                periodEnd: isoDate(periodEnd),
+            },
+        }),
         listInvoices: (id) => this.#request('GET', `/v1/subscriptions/${segment(id)}/invoices`).then((r) => r.data),
     };
     licenses = {
-        verify: (params) => this.#request('POST', '/licenses/verify', { body: params, auth: false }),
-        heartbeat: (params) => this.#request('POST', '/licenses/heartbeat', { body: params, auth: false }),
+        verify: ({ licenseKey, serverIp, serverKey, serverPort }) => this.#request('POST', '/licenses/verify', {
+            body: { licenseKey, serverIp, serverKey, serverPort },
+            auth: false,
+        }),
+        heartbeat: ({ licenseKey, serverIp }) => this.#request('POST', '/licenses/heartbeat', {
+            body: { licenseKey, serverIp },
+            auth: false,
+        }),
+        // Keys sold with the "License key" delivery. Needs the licenses:validate
+        // scope; a key with only that scope may ship inside your app.
+        validate: ({ key, productId, hardwareId }) => this.#request('POST', '/v1/licenses/validate', {
+            body: { key, productId, hardwareId },
+        }),
+        // Frees the machines a key is bound to. Needs licenses:write; call it
+        // from your server only.
+        resetDevices: ({ key, hardwareId }) => this.#request('POST', '/v1/licenses/devices/reset', {
+            body: { key, hardwareId },
+        }),
     };
     webhooks = {
-        verify: async (payload, signature, secret) => {
-            const key = secret ?? this.#webhookSecret;
-            if (!key) {
-                throw new Error('Skalp: missing webhook secret. Pass it as the third argument or set SKALP_WEBHOOK_SECRET.');
-            }
-            const encoder = new TextEncoder();
-            const body = toBytes(payload, encoder);
-            const parsed = parseSignature(readSignature(signature));
-            if (!parsed || Math.abs(Date.now() / 1000 - parsed.timestamp) > SIGNATURE_TOLERANCE_SECONDS)
-                return false;
-            const prefix = encoder.encode(`${parsed.timestamp}.`);
-            const signed = new Uint8Array(prefix.length + body.length);
-            signed.set(prefix);
-            signed.set(body, prefix.length);
-            const hmac = await crypto.subtle.importKey('raw', encoder.encode(key), { name: 'HMAC', hash: 'SHA-256' }, false, ['verify']);
-            return crypto.subtle.verify('HMAC', hmac, parsed.signature, signed);
-        },
+        verify: async (payload, signature, secret) => (await this.#checkSignature(payload, signature, secret)) === undefined,
         constructEvent: async (payload, signature, secret) => {
-            if (!(await this.webhooks.verify(payload, signature, secret)))
-                throw new SkalpSignatureError();
+            const failure = await this.#checkSignature(payload, signature, secret);
+            if (failure)
+                throw new SkalpSignatureError(failure);
             const text = typeof payload === 'string' ? payload : new TextDecoder().decode(payload);
             return JSON.parse(text);
         },
     };
+    async #checkSignature(payload, signature, secret) {
+        const key = secret ?? this.#webhookSecret;
+        if (!key) {
+            throw new Error('Skalp: missing webhook secret. Pass it as the third argument or set SKALP_WEBHOOK_SECRET.');
+        }
+        const encoder = new TextEncoder();
+        const body = toBytes(payload, encoder);
+        const parsed = parseSignature(readSignature(signature));
+        if (!parsed)
+            return 'invalid';
+        if (Math.abs(Date.now() / 1000 - parsed.timestamp) > SIGNATURE_TOLERANCE_SECONDS)
+            return 'stale';
+        const prefix = encoder.encode(`${parsed.timestamp}.`);
+        const signed = new Uint8Array(prefix.length + body.length);
+        signed.set(prefix);
+        signed.set(body, prefix.length);
+        const hmac = await crypto.subtle.importKey('raw', encoder.encode(key), { name: 'HMAC', hash: 'SHA-256' }, false, ['verify']);
+        return (await crypto.subtle.verify('HMAC', hmac, parsed.signature, signed)) ? undefined : 'invalid';
+    }
     async #request(method, path, { body, query, auth = true } = {}) {
         if (auth && !this.#apiKey) {
             throw new Error('Skalp: missing API key. Pass it to new Skalp(apiKey) or set SKALP_API_KEY.');
@@ -111,18 +304,24 @@ class Skalp {
             if (value !== undefined && value !== null)
                 url.searchParams.set(name, String(value));
         }
-        const headers = { accept: 'application/json' };
+        const headers = { accept: 'application/json', 'user-agent': USER_AGENT };
         if (auth)
             headers['x-api-key'] = this.#apiKey;
         if (body !== undefined)
             headers['content-type'] = 'application/json';
         for (let attempt = 0;; attempt++) {
-            const res = await this.#fetch(url, {
-                method,
-                headers,
-                body: body === undefined ? undefined : JSON.stringify(body),
-                signal: AbortSignal.timeout(this.#timeout),
-            });
+            let res;
+            try {
+                res = await this.#fetch(url, {
+                    method,
+                    headers,
+                    body: body === undefined ? undefined : JSON.stringify(body),
+                    signal: AbortSignal.timeout(this.#timeout),
+                });
+            }
+            catch (cause) {
+                throw new SkalpConnectionError(method, path, cause);
+            }
             if (res.status === 429 && attempt < this.#maxRetries) {
                 const wait = retryAfterSeconds(res, attempt);
                 if (wait <= MAX_RETRY_WAIT_SECONDS) {
@@ -188,7 +387,7 @@ function retryAfterSeconds(res, attempt) {
     const reset = Number(res.headers.get('x-ratelimit-reset'));
     if (reset > 0)
         return Math.max(reset - Date.now() / 1000, 0.5);
-    return 2 ** attempt;
+    return 2 ** Math.min(attempt, 5);
 }
 function toError(status, body) {
     const b = (body && typeof body === 'object' ? body : {});