@sscodeaxis/paywall-sdk 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,15 @@
+# Changelog
+
+All notable changes to this SDK are documented here. Format loosely follows [Keep a Changelog](https://keepachangelog.com/).
+
+## 0.1.0 — Unreleased
+
+Initial version. Covers all 5 planned phases:
+
+- **Core client** — `PaywallSDK`, API-key auth, typed `SdkApiError`/`SdkConfigError`.
+- **Checkout & catalog** — `listPlans`, `createIntent`, `getIntent`, `completeIntent`. Not currently backed by this repo's `apps/api` — the checkout-intent feature lives only in the `marketplace` fork; these methods 404 here until/unless that changes.
+- **Entitlements & licensing** — `entitlements.check/getUsage/incrementUsage/decrementUsage`, `licenseKeys.validate`, `devices.register`. Required adding new API-key-authenticated backend routes (`/public/runtime/**`, `/public/devices`) that didn't previously exist — see `apps/api/src/entitlements/public-runtime.controller.ts` and `apps/api/src/devices/public-devices.controller.ts`.
+- **Webhooks** — `constructWebhookEvent` (HMAC-SHA256 verification, matching `apps/api/src/webhooks/webhook-dispatch.service.ts`'s signing scheme exactly).
+- **Packaging & DX** — this package, README quickstart, CHANGELOG, test suite (14 tests covering the HTTP client and webhook verification).
+
+Not published to npm yet — see README's "External requirements" section.

package/README.md

@@ -0,0 +1,139 @@
+# @sscodeaxis/paywall-sdk
+
+Server-side SDK for integrating checkout, entitlements, licensing, and webhooks against the SSCodeAxis API. Node.js only (uses the built-in `fetch` on Node 18+, and Node's `crypto` module for webhook verification) — this is meant to run in your backend, never in a browser, since it's authenticated with a secret API key.
+
+Every method below is verified against a live sscodeaxis `apps/api` (see each client's own doc comment in `src/` for what was actually tested) — see [External requirements](#external-requirements) for the one thing still pending.
+
+## Install
+
+Currently a workspace-internal package (`workspace:*`) within the sscodeaxis monorepo, not yet published to the public npm registry - add it as a dependency the same way `@sscodeaxis/shared`/`@sscodeaxis/ui` are used elsewhere in this repo. Once it's published:
+
+```bash
+npm install @sscodeaxis/paywall-sdk
+```
+
+## Quickstart
+
+```ts
+import { PaywallSDK } from "@sscodeaxis/paywall-sdk";
+
+const sdk = new PaywallSDK({
+  apiKey: process.env.PLATFORM_API_KEY!, // Dashboard -> API Keys
+  baseUrl: process.env.PLATFORM_API_URL!, // e.g. https://api.yourdomain.com
+});
+```
+
+### Checkout
+
+```ts
+// 1. On your backend, start a checkout for a customer:
+const { id: intentId } = await sdk.checkout.createIntent({
+  customerEmail: "customer@example.com",
+  planId: "...",
+  priceId: "...",
+  successUrl: "https://yourapp.com/thanks",
+  cancelUrl: "https://yourapp.com/cancelled",
+});
+
+// 2. Redirect the customer to your hosted checkout page with `intentId`.
+//    On that page (customer's browser — no API key needed there):
+const { intent, providers } = await sdk.checkout.getIntent(intentId);
+// ...render `providers` for the customer to pick one, then:
+const session = await sdk.checkout.completeIntent(intentId, providers[0].id);
+```
+
+```ts
+// List your active plans/prices:
+const plans = await sdk.checkout.listPlans();
+```
+
+### Entitlements & usage
+
+```ts
+const { allowed } = await sdk.entitlements.check("advanced-reports");
+if (!allowed) throw new Error("Not entitled to this feature");
+
+const usage = await sdk.entitlements.getUsage("api-calls");
+console.log(`${usage.used}/${usage.limit ?? "unlimited"}`);
+
+await sdk.entitlements.incrementUsage("api-calls"); // throws SdkApiError (403) if over limit
+await sdk.entitlements.decrementUsage("api-calls"); // e.g. on a refund/undo
+```
+
+> `check()` tolerates an entitlement key with no definition at all (returns `allowed: false`). `getUsage`/`incrementUsage`/`decrementUsage` don't - they throw `SdkApiError` (500) for a genuinely undefined key, so only call those for keys you've actually defined as metered entitlements in the dashboard.
+
+### License keys
+
+```ts
+const result = await sdk.licenseKeys.validate(userEnteredKey);
+if (result.valid) {
+  console.log(result.licenseId, result.status, result.expiresAt);
+} else {
+  console.log("Invalid:", result.reason); // "not_found" | "inactive" | "expired" | "activation_limit_reached"
+}
+```
+
+### Devices
+
+```ts
+const device = await sdk.devices.register({
+  deviceId: "stable-client-generated-id",
+  platform: "DESKTOP", // "IOS" | "ANDROID" | "WEB" | "DESKTOP" | "OTHER"
+  licenseId: license?.licenseId,
+});
+```
+
+### Webhooks
+
+```ts
+import { constructWebhookEvent } from "@sscodeaxis/paywall-sdk";
+
+// Express example — you MUST use the raw body, not an already-JSON-parsed one:
+app.post("/webhooks/platform", express.raw({ type: "application/json" }), (req, res) => {
+  const event = constructWebhookEvent(
+    req.body.toString("utf8"),
+    {
+      signature: req.header("X-Webhook-Signature"),
+      eventType: req.header("X-Webhook-Event"),
+      deliveryId: req.header("X-Webhook-Delivery-Id"),
+    },
+    process.env.PLATFORM_WEBHOOK_SECRET!, // from your webhook endpoint's settings in the dashboard
+  );
+
+  switch (event.eventType) {
+    case "subscription.updated":
+      // handle event.payload
+      break;
+  }
+
+  res.sendStatus(200);
+});
+```
+
+`constructWebhookEvent` throws `SdkConfigError` if the signature is missing, malformed, or doesn't match — by design, so a handler can't accidentally process an unverified payload.
+
+## Error handling
+
+Every method throws:
+
+- `SdkApiError` — a non-2xx API response. Has `.status` (HTTP status) and `.body` (parsed JSON error body, when present) so you can branch on specific cases (401 = bad/revoked key, 403 = e.g. usage limit exceeded, 404 = unknown key).
+- `SdkConfigError` — client-side misuse (missing config, bad webhook signature). Never thrown for an API response.
+
+```ts
+import { SdkApiError } from "@sscodeaxis/paywall-sdk";
+
+try {
+  await sdk.entitlements.incrementUsage("api-calls");
+} catch (err) {
+  if (err instanceof SdkApiError && err.status === 403) {
+    // over limit — prompt to upgrade
+  }
+  throw err;
+}
+```
+
+## External requirements
+
+- **Publish to npm** — the package builds and works as a workspace dependency today; publishing under `@sscodeaxis/paywall-sdk` to the public registry (`publishConfig.access: "public"` is already set) is the only step left before third-party developers can `npm install` it directly.
+
+Everything else this SDK talks to already exists and is verified against a live sscodeaxis `apps/api`: checkout (`/public/plans`, `/checkout-intents`), webhook signature verification, entitlement runtime checks/usage (`/public/runtime/entitlements/*`), license key validation (`/public/runtime/license-keys/validate`), and device registration (`/public/devices`).

package/dist/checkout.d.ts

@@ -0,0 +1,31 @@
+import type { HttpClient } from "./client";
+import type { Plan, CreateCheckoutIntentInput, CreateCheckoutIntentResult, CheckoutIntentDetail, CheckoutSession } from "./types";
+/**
+ * Wraps `apps/api/src/payments/public/public-catalog.controller.ts` and
+ * `public-checkout-intents.controller.ts` - the "embed our checkout"
+ * flow. `listPlans` and `createIntent` are called from YOUR backend (they
+ * need your API key); `getIntent`/`completeIntent` are called from the
+ * customer's own browser on your hosted checkout page (no API key - the
+ * intent id itself is the short-lived, single-use capability), so those two
+ * also work with an `HttpClient` that has no `apiKey` set, as long as
+ * `baseUrl` is configured. This class doesn't enforce that distinction;
+ * it's on you not to leak your API key into a page the customer's browser
+ * loads.
+ *
+ * Verified against a live sscodeaxis apps/api: `GET /public/plans` returns
+ * `200 []` for an app with no plans yet, and `POST /checkout-intents`
+ * validates its body and returns a clean 404 ("Plan not found") for an
+ * unknown planId - the full request pipeline works end-to-end.
+ */
+export declare class CheckoutClient {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Active plans (with active prices) visible to your API key's organization/application. */
+    listPlans(): Promise<Plan[]>;
+    /** Starts a checkout for a specific customer email + plan/price. Returns an intent id to redirect the customer to. */
+    createIntent(input: CreateCheckoutIntentInput): Promise<CreateCheckoutIntentResult>;
+    /** Fetches an intent + the available payment providers to render on your hosted checkout page. */
+    getIntent(intentId: string): Promise<CheckoutIntentDetail>;
+    /** Customer picked a provider - completes the intent and returns the resulting checkout session. */
+    completeIntent(intentId: string, providerId: string): Promise<CheckoutSession>;
+}

package/dist/checkout.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CheckoutClient = void 0;
+/**
+ * Wraps `apps/api/src/payments/public/public-catalog.controller.ts` and
+ * `public-checkout-intents.controller.ts` - the "embed our checkout"
+ * flow. `listPlans` and `createIntent` are called from YOUR backend (they
+ * need your API key); `getIntent`/`completeIntent` are called from the
+ * customer's own browser on your hosted checkout page (no API key - the
+ * intent id itself is the short-lived, single-use capability), so those two
+ * also work with an `HttpClient` that has no `apiKey` set, as long as
+ * `baseUrl` is configured. This class doesn't enforce that distinction;
+ * it's on you not to leak your API key into a page the customer's browser
+ * loads.
+ *
+ * Verified against a live sscodeaxis apps/api: `GET /public/plans` returns
+ * `200 []` for an app with no plans yet, and `POST /checkout-intents`
+ * validates its body and returns a clean 404 ("Plan not found") for an
+ * unknown planId - the full request pipeline works end-to-end.
+ */
+class CheckoutClient {
+    http;
+    constructor(http) {
+        this.http = http;
+    }
+    /** Active plans (with active prices) visible to your API key's organization/application. */
+    listPlans() {
+        return this.http.request("GET", "/public/plans");
+    }
+    /** Starts a checkout for a specific customer email + plan/price. Returns an intent id to redirect the customer to. */
+    createIntent(input) {
+        return this.http.request("POST", "/checkout-intents", input);
+    }
+    /** Fetches an intent + the available payment providers to render on your hosted checkout page. */
+    getIntent(intentId) {
+        return this.http.request("GET", `/checkout-intents/${encodeURIComponent(intentId)}`);
+    }
+    /** Customer picked a provider - completes the intent and returns the resulting checkout session. */
+    completeIntent(intentId, providerId) {
+        return this.http.request("POST", `/checkout-intents/${encodeURIComponent(intentId)}/complete`, { providerId });
+    }
+}
+exports.CheckoutClient = CheckoutClient;
+//# sourceMappingURL=checkout.js.map

package/dist/checkout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout.js","sourceRoot":"","sources":["../src/checkout.ts"],"names":[],"mappings":";;;AASA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAa,cAAc;IACI;IAA7B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,4FAA4F;IAC5F,SAAS;QACP,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAS,KAAK,EAAE,eAAe,CAAC,CAAC;IAC3D,CAAC;IAED,sHAAsH;IACtH,YAAY,CAAC,KAAgC;QAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAA6B,MAAM,EAAE,mBAAmB,EAAE,KAAK,CAAC,CAAC;IAC3F,CAAC;IAED,kGAAkG;IAClG,SAAS,CAAC,QAAgB;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CACtB,KAAK,EACL,qBAAqB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CACpD,CAAC;IACJ,CAAC;IAED,oGAAoG;IACpG,cAAc,CAAC,QAAgB,EAAE,UAAkB;QACjD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CACtB,MAAM,EACN,qBAAqB,kBAAkB,CAAC,QAAQ,CAAC,WAAW,EAC5D,EAAE,UAAU,EAAE,CACf,CAAC;IACJ,CAAC;CACF;AA7BD,wCA6BC"}

package/dist/client.d.ts

@@ -0,0 +1,26 @@
+export interface PaywallClientConfig {
+    /** The API key issued to your application (Dashboard -> API Keys). Sent as `X-API-Key`. */
+    apiKey: string;
+    /**
+     * Base URL of the platform API this application is deployed against, e.g.
+     * `https://api.yourdomain.com`. No default is baked in - see this SDK's
+     * README "External requirements" section for what needs to be filled in
+     * before this can point at a real deployment.
+     */
+    baseUrl: string;
+    /** Overrides the global `fetch` (e.g. for testing, or older Node runtimes). Defaults to `globalThis.fetch`. */
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Thin, dependency-free HTTP wrapper every resource class in this SDK is
+ * built on. Not meant to be used directly by SDK consumers - see
+ * `CheckoutClient`, `EntitlementsClient`, etc. in index.ts for the actual
+ * public surface.
+ */
+export declare class HttpClient {
+    private readonly apiKey;
+    private readonly baseUrl;
+    private readonly fetchImpl;
+    constructor(config: PaywallClientConfig);
+    request<T>(method: string, path: string, body?: unknown): Promise<T>;
+}

package/dist/client.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpClient = void 0;
+const errors_1 = require("./errors");
+/**
+ * Thin, dependency-free HTTP wrapper every resource class in this SDK is
+ * built on. Not meant to be used directly by SDK consumers - see
+ * `CheckoutClient`, `EntitlementsClient`, etc. in index.ts for the actual
+ * public surface.
+ */
+class HttpClient {
+    apiKey;
+    baseUrl;
+    fetchImpl;
+    constructor(config) {
+        if (!config.apiKey) {
+            throw new errors_1.SdkConfigError("apiKey is required");
+        }
+        if (!config.baseUrl) {
+            throw new errors_1.SdkConfigError("baseUrl is required - e.g. https://api.yourdomain.com");
+        }
+        if (typeof (config.fetchImpl ?? globalThis.fetch) !== "function") {
+            throw new errors_1.SdkConfigError("No fetch implementation available - pass `fetchImpl` explicitly on Node < 18");
+        }
+        this.apiKey = config.apiKey;
+        this.baseUrl = config.baseUrl.replace(/\/+$/, "");
+        this.fetchImpl = config.fetchImpl ?? globalThis.fetch;
+    }
+    async request(method, path, body) {
+        const res = await this.fetchImpl(`${this.baseUrl}${path}`, {
+            method,
+            headers: {
+                "X-API-Key": this.apiKey,
+                ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
+            },
+            body: body !== undefined ? JSON.stringify(body) : undefined,
+        });
+        const text = await res.text();
+        const parsed = text ? safeJsonParse(text) : undefined;
+        if (!res.ok) {
+            const message = (parsed && typeof parsed === "object" && "message" in parsed
+                ? String(parsed.message)
+                : undefined) ?? `Request failed with status ${res.status}`;
+            throw new errors_1.SdkApiError(res.status, message, parsed);
+        }
+        return parsed;
+    }
+}
+exports.HttpClient = HttpClient;
+function safeJsonParse(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":";;;AAAA,qCAAuD;AAgBvD;;;;;GAKG;AACH,MAAa,UAAU;IACJ,MAAM,CAAS;IACf,OAAO,CAAS;IAChB,SAAS,CAAe;IAEzC,YAAY,MAA2B;QACrC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,uBAAc,CAAC,oBAAoB,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,uBAAc,CAAC,uDAAuD,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,UAAU,EAAE,CAAC;YACjE,MAAM,IAAI,uBAAc,CACtB,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QAC3D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YACzD,MAAM;YACN,OAAO,EAAE;gBACP,WAAW,EAAE,IAAI,CAAC,MAAM;gBACxB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtE;YACD,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC5D,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEtD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,OAAO,GACX,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,SAAS,IAAI,MAAM;gBAC1D,CAAC,CAAC,MAAM,CAAE,MAA+B,CAAC,OAAO,CAAC;gBAClD,CAAC,CAAC,SAAS,CAAC,IAAI,8BAA8B,GAAG,CAAC,MAAM,EAAE,CAAC;YAC/D,MAAM,IAAI,oBAAW,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;QAED,OAAO,MAAW,CAAC;IACrB,CAAC;CACF;AA9CD,gCA8CC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/devices.d.ts

@@ -0,0 +1,16 @@
+import type { HttpClient } from "./client";
+import type { RegisterDeviceInput, DeviceRegistration } from "./types";
+/** Wraps `apps/api/src/devices/public-devices.controller.ts`
+ * (`POST /public/devices`). Requires an application-scoped API key. */
+export declare class DevicesClient {
+    private readonly http;
+    /**
+     * Registers (or re-checks-in) a device. Upserts on `deviceId` - safe to
+     * call every time your app starts, not just on first install. If
+     * `licenseId` is set and that license has a `deviceLimit`, registering a
+     * genuinely new device enforces it (throws `SdkApiError` 403 if full) -
+     * an already-known device re-checking in is never rejected for this.
+     */
+    constructor(http: HttpClient);
+    register(input: RegisterDeviceInput): Promise<DeviceRegistration>;
+}

package/dist/devices.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DevicesClient = void 0;
+/** Wraps `apps/api/src/devices/public-devices.controller.ts`
+ * (`POST /public/devices`). Requires an application-scoped API key. */
+class DevicesClient {
+    http;
+    /**
+     * Registers (or re-checks-in) a device. Upserts on `deviceId` - safe to
+     * call every time your app starts, not just on first install. If
+     * `licenseId` is set and that license has a `deviceLimit`, registering a
+     * genuinely new device enforces it (throws `SdkApiError` 403 if full) -
+     * an already-known device re-checking in is never rejected for this.
+     */
+    constructor(http) {
+        this.http = http;
+    }
+    register(input) {
+        return this.http.request("POST", "/public/devices", input);
+    }
+}
+exports.DevicesClient = DevicesClient;
+//# sourceMappingURL=devices.js.map

package/dist/devices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devices.js","sourceRoot":"","sources":["../src/devices.ts"],"names":[],"mappings":";;;AAGA;uEACuE;AACvE,MAAa,aAAa;IAQK;IAP7B;;;;;;OAMG;IACH,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,QAAQ,CAAC,KAA0B;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAqB,MAAM,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAC;IACjF,CAAC;CACF;AAbD,sCAaC"}

package/dist/entitlements.d.ts

@@ -0,0 +1,30 @@
+import type { HttpClient } from "./client";
+import type { EntitlementCheckResult, UsageSnapshot } from "./types";
+/**
+ * Wraps `apps/api/src/entitlements/public-runtime-entitlements.controller.ts`
+ * (`/public/runtime/entitlements/*`) - the "can this customer do X" checks
+ * an integrating app calls at runtime. Requires an application-scoped API
+ * key (an org-only key without an application will get a 400 from the API).
+ *
+ * `check()` tolerates an entitlement key with no definition at all for this
+ * application (returns `{ allowed: false, ... }`), but `getUsage`,
+ * `incrementUsage`, and `decrementUsage` don't - they throw `SdkApiError`
+ * (500) for a genuinely undefined key. This mirrors the underlying
+ * RuntimeAuthorizationService's own behavior (not something this SDK adds),
+ * so only call those three for keys you know are defined as metered
+ * entitlements in the dashboard.
+ */
+export declare class EntitlementsClient {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Is this entitlement key allowed for your application right now? */
+    check(key: string): Promise<EntitlementCheckResult>;
+    /** Current usage/limit/remaining for a metered entitlement key. */
+    getUsage(key: string): Promise<UsageSnapshot>;
+    /** Records usage against a metered entitlement key. Throws `SdkApiError` (403) if this would exceed the limit. */
+    incrementUsage(key: string, amount?: number): Promise<UsageSnapshot>;
+    /** Reverses previously recorded usage (e.g. a refund, an undone action). Floors at zero. */
+    decrementUsage(key: string, amount?: number): Promise<{
+        success: true;
+    }>;
+}

package/dist/entitlements.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EntitlementsClient = void 0;
+/**
+ * Wraps `apps/api/src/entitlements/public-runtime-entitlements.controller.ts`
+ * (`/public/runtime/entitlements/*`) - the "can this customer do X" checks
+ * an integrating app calls at runtime. Requires an application-scoped API
+ * key (an org-only key without an application will get a 400 from the API).
+ *
+ * `check()` tolerates an entitlement key with no definition at all for this
+ * application (returns `{ allowed: false, ... }`), but `getUsage`,
+ * `incrementUsage`, and `decrementUsage` don't - they throw `SdkApiError`
+ * (500) for a genuinely undefined key. This mirrors the underlying
+ * RuntimeAuthorizationService's own behavior (not something this SDK adds),
+ * so only call those three for keys you know are defined as metered
+ * entitlements in the dashboard.
+ */
+class EntitlementsClient {
+    http;
+    constructor(http) {
+        this.http = http;
+    }
+    /** Is this entitlement key allowed for your application right now? */
+    check(key) {
+        return this.http.request("GET", `/public/runtime/entitlements/${encodeURIComponent(key)}`);
+    }
+    /** Current usage/limit/remaining for a metered entitlement key. */
+    getUsage(key) {
+        return this.http.request("GET", `/public/runtime/entitlements/${encodeURIComponent(key)}/usage`);
+    }
+    /** Records usage against a metered entitlement key. Throws `SdkApiError` (403) if this would exceed the limit. */
+    incrementUsage(key, amount = 1) {
+        return this.http.request("POST", `/public/runtime/entitlements/${encodeURIComponent(key)}/increment`, { amount });
+    }
+    /** Reverses previously recorded usage (e.g. a refund, an undone action). Floors at zero. */
+    decrementUsage(key, amount = 1) {
+        return this.http.request("POST", `/public/runtime/entitlements/${encodeURIComponent(key)}/decrement`, { amount });
+    }
+}
+exports.EntitlementsClient = EntitlementsClient;
+//# sourceMappingURL=entitlements.js.map

package/dist/entitlements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlements.js","sourceRoot":"","sources":["../src/entitlements.ts"],"names":[],"mappings":";;;AAGA;;;;;;;;;;;;;GAaG;AACH,MAAa,kBAAkB;IACA;IAA7B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,sEAAsE;IACtE,KAAK,CAAC,GAAW;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CACtB,KAAK,EACL,gCAAgC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAC1D,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,QAAQ,CAAC,GAAW;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CACtB,KAAK,EACL,gCAAgC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAChE,CAAC;IACJ,CAAC;IAED,kHAAkH;IAClH,cAAc,CAAC,GAAW,EAAE,MAAM,GAAG,CAAC;QACpC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CACtB,MAAM,EACN,gCAAgC,kBAAkB,CAAC,GAAG,CAAC,YAAY,EACnE,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;IAED,4FAA4F;IAC5F,cAAc,CAAC,GAAW,EAAE,MAAM,GAAG,CAAC;QACpC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CACtB,MAAM,EACN,gCAAgC,kBAAkB,CAAC,GAAG,CAAC,YAAY,EACnE,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;CACF;AApCD,gDAoCC"}

package/dist/errors.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Thrown for any non-2xx response from the API. `status` and `body` are the
+ * raw HTTP status and parsed JSON error body (when present) so callers can
+ * branch on specific failure modes (e.g. 401 = bad/revoked API key, 403 =
+ * usage limit exceeded, 404 = unknown entitlement key) without string-
+ * matching `message`.
+ */
+export declare class SdkApiError extends Error {
+    readonly status: number;
+    readonly body: unknown;
+    constructor(status: number, message: string, body: unknown);
+}
+/** Thrown for client-side misuse (e.g. missing required config) - never for API responses. */
+export declare class SdkConfigError extends Error {
+    constructor(message: string);
+}

package/dist/errors.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SdkConfigError = exports.SdkApiError = void 0;
+/**
+ * Thrown for any non-2xx response from the API. `status` and `body` are the
+ * raw HTTP status and parsed JSON error body (when present) so callers can
+ * branch on specific failure modes (e.g. 401 = bad/revoked API key, 403 =
+ * usage limit exceeded, 404 = unknown entitlement key) without string-
+ * matching `message`.
+ */
+class SdkApiError extends Error {
+    status;
+    body;
+    constructor(status, message, body) {
+        super(message);
+        this.name = "SdkApiError";
+        this.status = status;
+        this.body = body;
+    }
+}
+exports.SdkApiError = SdkApiError;
+/** Thrown for client-side misuse (e.g. missing required config) - never for API responses. */
+class SdkConfigError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "SdkConfigError";
+    }
+}
+exports.SdkConfigError = SdkConfigError;
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";;;AAAA;;;;;;GAMG;AACH,MAAa,WAAY,SAAQ,KAAK;IAC3B,MAAM,CAAS;IACf,IAAI,CAAU;IAEvB,YAAY,MAAc,EAAE,OAAe,EAAE,IAAa;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAVD,kCAUC;AAED,8FAA8F;AAC9F,MAAa,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AALD,wCAKC"}

package/dist/index.d.ts

@@ -0,0 +1,29 @@
+import { type PaywallClientConfig } from "./client";
+import { CheckoutClient } from "./checkout";
+import { EntitlementsClient } from "./entitlements";
+import { LicenseKeysClient } from "./licenses";
+import { DevicesClient } from "./devices";
+/**
+ * Server-side SDK for integrating against the SSCodeAxis API.
+ * See README.md for a quickstart and the "External requirements" section
+ * for what needs to be filled in (API base URL, API key) before this can
+ * talk to a real deployment.
+ *
+ * ```ts
+ * const sdk = new PaywallSDK({ apiKey: process.env.PLATFORM_API_KEY!, baseUrl: process.env.PLATFORM_API_URL! });
+ * const { id } = await sdk.checkout.createIntent({ customerEmail, planId, priceId });
+ * // redirect the customer to your hosted checkout page with `id`
+ * ```
+ */
+export declare class PaywallSDK {
+    readonly checkout: CheckoutClient;
+    readonly entitlements: EntitlementsClient;
+    readonly licenseKeys: LicenseKeysClient;
+    readonly devices: DevicesClient;
+    constructor(config: PaywallClientConfig);
+}
+export type { PaywallClientConfig } from "./client";
+export { SdkApiError, SdkConfigError } from "./errors";
+export { constructWebhookEvent } from "./webhooks";
+export type { WebhookEvent } from "./webhooks";
+export * from "./types";

package/dist/index.js

@@ -0,0 +1,55 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.constructWebhookEvent = exports.SdkConfigError = exports.SdkApiError = exports.PaywallSDK = void 0;
+const client_1 = require("./client");
+const checkout_1 = require("./checkout");
+const entitlements_1 = require("./entitlements");
+const licenses_1 = require("./licenses");
+const devices_1 = require("./devices");
+/**
+ * Server-side SDK for integrating against the SSCodeAxis API.
+ * See README.md for a quickstart and the "External requirements" section
+ * for what needs to be filled in (API base URL, API key) before this can
+ * talk to a real deployment.
+ *
+ * ```ts
+ * const sdk = new PaywallSDK({ apiKey: process.env.PLATFORM_API_KEY!, baseUrl: process.env.PLATFORM_API_URL! });
+ * const { id } = await sdk.checkout.createIntent({ customerEmail, planId, priceId });
+ * // redirect the customer to your hosted checkout page with `id`
+ * ```
+ */
+class PaywallSDK {
+    checkout;
+    entitlements;
+    licenseKeys;
+    devices;
+    constructor(config) {
+        const http = new client_1.HttpClient(config);
+        this.checkout = new checkout_1.CheckoutClient(http);
+        this.entitlements = new entitlements_1.EntitlementsClient(http);
+        this.licenseKeys = new licenses_1.LicenseKeysClient(http);
+        this.devices = new devices_1.DevicesClient(http);
+    }
+}
+exports.PaywallSDK = PaywallSDK;
+var errors_1 = require("./errors");
+Object.defineProperty(exports, "SdkApiError", { enumerable: true, get: function () { return errors_1.SdkApiError; } });
+Object.defineProperty(exports, "SdkConfigError", { enumerable: true, get: function () { return errors_1.SdkConfigError; } });
+var webhooks_1 = require("./webhooks");
+Object.defineProperty(exports, "constructWebhookEvent", { enumerable: true, get: function () { return webhooks_1.constructWebhookEvent; } });
+__exportStar(require("./types"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,qCAAgE;AAChE,yCAA4C;AAC5C,iDAAoD;AACpD,yCAA+C;AAC/C,uCAA0C;AAE1C;;;;;;;;;;;GAWG;AACH,MAAa,UAAU;IACZ,QAAQ,CAAiB;IACzB,YAAY,CAAqB;IACjC,WAAW,CAAoB;IAC/B,OAAO,CAAgB;IAEhC,YAAY,MAA2B;QACrC,MAAM,IAAI,GAAG,IAAI,mBAAU,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,IAAI,yBAAc,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,YAAY,GAAG,IAAI,iCAAkB,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,WAAW,GAAG,IAAI,4BAAiB,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,GAAG,IAAI,uBAAa,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;CACF;AAbD,gCAaC;AAGD,mCAAuD;AAA9C,qGAAA,WAAW,OAAA;AAAE,wGAAA,cAAc,OAAA;AACpC,uCAAmD;AAA1C,iHAAA,qBAAqB,OAAA;AAE9B,0CAAwB"}

package/dist/licenses.d.ts

@@ -0,0 +1,12 @@
+import type { HttpClient } from "./client";
+import type { LicenseKeyValidationResult } from "./types";
+/** Wraps `apps/api/src/entitlements/public-license-keys.controller.ts`
+ * (`POST /public/runtime/license-keys/validate`). Org-scoped only - the key
+ * itself is the capability, so there's no applicationId requirement (unlike
+ * the entitlements/devices public routes). */
+export declare class LicenseKeysClient {
+    private readonly http;
+    constructor(http: HttpClient);
+    /** Validates a license key a customer entered (activation-status/expiry/activation-limit checks included). Never throws for an invalid key - check `.valid`. */
+    validate(key: string): Promise<LicenseKeyValidationResult>;
+}

package/dist/licenses.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LicenseKeysClient = void 0;
+/** Wraps `apps/api/src/entitlements/public-license-keys.controller.ts`
+ * (`POST /public/runtime/license-keys/validate`). Org-scoped only - the key
+ * itself is the capability, so there's no applicationId requirement (unlike
+ * the entitlements/devices public routes). */
+class LicenseKeysClient {
+    http;
+    constructor(http) {
+        this.http = http;
+    }
+    /** Validates a license key a customer entered (activation-status/expiry/activation-limit checks included). Never throws for an invalid key - check `.valid`. */
+    validate(key) {
+        return this.http.request("POST", "/public/runtime/license-keys/validate", { key });
+    }
+}
+exports.LicenseKeysClient = LicenseKeysClient;
+//# sourceMappingURL=licenses.js.map

package/dist/licenses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"licenses.js","sourceRoot":"","sources":["../src/licenses.ts"],"names":[],"mappings":";;;AAGA;;;8CAG8C;AAC9C,MAAa,iBAAiB;IACC;IAA7B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,gKAAgK;IAChK,QAAQ,CAAC,GAAW;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CACtB,MAAM,EACN,uCAAuC,EACvC,EAAE,GAAG,EAAE,CACR,CAAC;IACJ,CAAC;CACF;AAXD,8CAWC"}

package/dist/types.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Response shapes are hand-written from the current API implementation
+ * (apps/api/src/payments/public/*, apps/api/src/entitlements/*,
+ * apps/api/src/devices/*) rather than generated from a schema - accurate as
+ * of this SDK version, but see the README's "External requirements"
+ * section: generating these from the OpenAPI/Swagger spec instead is a
+ * recommended follow-up so they can't silently drift from the real API.
+ */
+export interface Price {
+    id: string;
+    planId: string;
+    currency: string;
+    unitAmount: number;
+    interval: string | null;
+    status: string;
+}
+export interface Plan {
+    id: string;
+    name: string;
+    status: string;
+    sortOrder: number;
+    prices: Price[];
+}
+export interface CreateCheckoutIntentInput {
+    customerEmail: string;
+    planId: string;
+    priceId: string;
+    successUrl?: string;
+    cancelUrl?: string;
+}
+export interface CreateCheckoutIntentResult {
+    id: string;
+    expiresAt: string;
+}
+export interface PaymentProviderSummary {
+    id: string;
+    type: string;
+    displayName: string;
+}
+export interface CheckoutIntentDetail {
+    intent: {
+        id: string;
+        status: "PENDING" | "COMPLETED" | "EXPIRED";
+        customerEmail: string;
+        planId: string;
+        priceId: string;
+        expiresAt: string;
+    };
+    providers: PaymentProviderSummary[];
+}
+/**
+ * Loosely typed on purpose - this is whatever `CheckoutService.create()`
+ * returns (a `CheckoutSession` row plus provider-specific redirect info),
+ * which varies by provider. Narrow with your own type if you need
+ * provider-specific fields.
+ */
+export interface CheckoutSession {
+    id: string;
+    status: string;
+    [key: string]: unknown;
+}
+export interface EntitlementCheckResult {
+    allowed: boolean;
+    numberValue: number | null;
+    textValue: string | null;
+    isUnlimited: boolean;
+}
+export interface UsageSnapshot {
+    used: number;
+    limit: number | null;
+    remaining: number | null;
+    isUnlimited: boolean;
+}
+export type LicenseKeyValidationResult = {
+    valid: true;
+    licenseId: string;
+    status: string;
+    type: string;
+    expiresAt: string | null;
+    seatLimit: number | null;
+    deviceLimit: number | null;
+} | {
+    valid: false;
+    reason: "not_found" | "inactive" | "expired" | "activation_limit_reached";
+};
+export type DevicePlatform = "IOS" | "ANDROID" | "WEB" | "DESKTOP" | "OTHER";
+export interface RegisterDeviceInput {
+    deviceId: string;
+    platform: DevicePlatform;
+    userId?: string;
+    licenseId?: string;
+    appVersion?: string;
+    osVersion?: string;
+    pushToken?: string;
+}
+export interface DeviceRegistration {
+    id: string;
+    applicationId: string;
+    organizationId: string;
+    deviceId: string;
+    platform: DevicePlatform;
+    status: string;
+    userId: string | null;
+    licenseId: string | null;
+    lastSeenAt: string;
+}

package/dist/types.js

@@ -0,0 +1,11 @@
+"use strict";
+/**
+ * Response shapes are hand-written from the current API implementation
+ * (apps/api/src/payments/public/*, apps/api/src/entitlements/*,
+ * apps/api/src/devices/*) rather than generated from a schema - accurate as
+ * of this SDK version, but see the README's "External requirements"
+ * section: generating these from the OpenAPI/Swagger spec instead is a
+ * recommended follow-up so they can't silently drift from the real API.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG"}

package/dist/webhooks.d.ts

@@ -0,0 +1,30 @@
+export interface WebhookEvent<T = unknown> {
+    eventType: string;
+    deliveryId: string;
+    payload: T;
+}
+/**
+ * Verifies and parses an inbound webhook from the platform. Mirrors
+ * `apps/api/src/webhooks/webhook-dispatch.service.ts`'s `attemptDelivery`:
+ * the platform signs `HMAC-SHA256(secret, rawBody).hex()`, sends it as
+ * `X-Webhook-Signature: sha256=<hex>`, plus `X-Webhook-Event` and
+ * `X-Webhook-Delivery-Id` headers alongside the raw JSON body.
+ *
+ * `rawBody` MUST be the exact, unmodified request body bytes/text - not a
+ * value re-serialized after `JSON.parse`, since the signature is computed
+ * over the exact bytes the platform sent and any whitespace/key-order
+ * difference from re-stringifying breaks verification. Get this from your
+ * framework's raw-body middleware (e.g. Express: `express.raw()` on this
+ * route, not `express.json()`), not from an already-parsed request body.
+ *
+ * Throws `SdkConfigError` if the signature is missing/malformed or doesn't
+ * match - this is a hard failure by design (same as Stripe's
+ * `constructEvent`), not a boolean return, so a webhook handler can't
+ * accidentally process an unverified payload by forgetting to check a
+ * return value.
+ */
+export declare function constructWebhookEvent<T = unknown>(rawBody: string, headers: {
+    signature: string | undefined | null;
+    eventType: string | undefined | null;
+    deliveryId: string | undefined | null;
+}, secret: string): WebhookEvent<T>;

package/dist/webhooks.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.constructWebhookEvent = constructWebhookEvent;
+const node_crypto_1 = require("node:crypto");
+const errors_1 = require("./errors");
+const SIGNATURE_HEADER_PREFIX = "sha256=";
+/**
+ * Verifies and parses an inbound webhook from the platform. Mirrors
+ * `apps/api/src/webhooks/webhook-dispatch.service.ts`'s `attemptDelivery`:
+ * the platform signs `HMAC-SHA256(secret, rawBody).hex()`, sends it as
+ * `X-Webhook-Signature: sha256=<hex>`, plus `X-Webhook-Event` and
+ * `X-Webhook-Delivery-Id` headers alongside the raw JSON body.
+ *
+ * `rawBody` MUST be the exact, unmodified request body bytes/text - not a
+ * value re-serialized after `JSON.parse`, since the signature is computed
+ * over the exact bytes the platform sent and any whitespace/key-order
+ * difference from re-stringifying breaks verification. Get this from your
+ * framework's raw-body middleware (e.g. Express: `express.raw()` on this
+ * route, not `express.json()`), not from an already-parsed request body.
+ *
+ * Throws `SdkConfigError` if the signature is missing/malformed or doesn't
+ * match - this is a hard failure by design (same as Stripe's
+ * `constructEvent`), not a boolean return, so a webhook handler can't
+ * accidentally process an unverified payload by forgetting to check a
+ * return value.
+ */
+function constructWebhookEvent(rawBody, headers, secret) {
+    if (!headers.signature) {
+        throw new errors_1.SdkConfigError("Missing X-Webhook-Signature header");
+    }
+    if (!headers.signature.startsWith(SIGNATURE_HEADER_PREFIX)) {
+        throw new errors_1.SdkConfigError(`Unrecognized signature header format: "${headers.signature}"`);
+    }
+    if (!headers.eventType) {
+        throw new errors_1.SdkConfigError("Missing X-Webhook-Event header");
+    }
+    if (!headers.deliveryId) {
+        throw new errors_1.SdkConfigError("Missing X-Webhook-Delivery-Id header");
+    }
+    const provided = headers.signature.slice(SIGNATURE_HEADER_PREFIX.length);
+    const expected = (0, node_crypto_1.createHmac)("sha256", secret).update(rawBody).digest("hex");
+    const providedBuf = Buffer.from(provided, "hex");
+    const expectedBuf = Buffer.from(expected, "hex");
+    const signatureValid = providedBuf.length === expectedBuf.length && (0, node_crypto_1.timingSafeEqual)(providedBuf, expectedBuf);
+    if (!signatureValid) {
+        throw new errors_1.SdkConfigError("Webhook signature verification failed");
+    }
+    let payload;
+    try {
+        payload = JSON.parse(rawBody);
+    }
+    catch {
+        throw new errors_1.SdkConfigError("Webhook body is not valid JSON");
+    }
+    return { eventType: headers.eventType, deliveryId: headers.deliveryId, payload };
+}
+//# sourceMappingURL=webhooks.js.map

package/dist/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":";;AA+BA,sDA0CC;AAzED,6CAA0D;AAC1D,qCAA0C;AAE1C,MAAM,uBAAuB,GAAG,SAAS,CAAC;AAQ1C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAgB,qBAAqB,CACnC,OAAe,EACf,OAIC,EACD,MAAc;IAEd,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,uBAAc,CAAC,oCAAoC,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,uBAAc,CAAC,0CAA0C,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,uBAAc,CAAC,gCAAgC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,IAAI,uBAAc,CAAC,sCAAsC,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE5E,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,cAAc,GAClB,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAEzF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,uBAAc,CAAC,uCAAuC,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,OAAU,CAAC;IACf,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAM,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAc,CAAC,gCAAgC,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC;AACnF,CAAC"}

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@sscodeaxis/paywall-sdk",
+  "version": "0.1.0",
+  "description": "Server-side SDK for integrating checkout, entitlements, licensing, and webhooks against the SSCodeAxis API.",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc",
+    "lint": "eslint .",
+    "type-check": "tsc --noEmit",
+    "test": "VITE_CJS_IGNORE_WARNING=true vitest run",
+    "clean": "rm -rf dist"
+  },
+  "keywords": [
+    "checkout",
+    "entitlements",
+    "licensing",
+    "webhooks",
+    "sdk"
+  ],
+  "license": "UNLICENSED",
+  "devDependencies": {
+    "@types/node": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
+  }
+}