@tapsilat/tapsilat-js 2026.7.7 → 2026.10.26

package/dist/index.cjs

@@ -12,6 +12,18 @@ var crypto = require('crypto');
 class TapsilatError extends Error {
     code;
     details;
+    /** HTTP status code, when the error came from an HTTP response */
+    statusCode;
+    /** `code` field from the API response body, as a string */
+    apiCode;
+    /** `status` field from the API response body */
+    apiStatus;
+    /** Per-field validation messages from the API response body */
+    errors;
+    /** Whether the API error says the request can be retried, as Elements errors do */
+    retryable;
+    /** Raw API response body */
+    rawBody;
     /**
      * @summary Creates a new TapsilatError instance
      * @description Initializes base error with message, code and optional details
@@ -40,7 +52,14 @@ class TapsilatError extends Error {
      * @returns New TapsilatError instance with properties from API error
      */
     static fromAPIError(apiError) {
-        return new TapsilatError(apiError.message, apiError.code, apiError.details);
+        const error = new TapsilatError(apiError.message, apiError.code, apiError.details);
+        error.statusCode = apiError.statusCode;
+        error.apiCode = apiError.apiCode;
+        error.apiStatus = apiError.apiStatus;
+        error.errors = apiError.errors;
+        error.retryable = apiError.retryable;
+        error.rawBody = apiError.rawBody;
+        return error;
     }
 }
 /**
@@ -51,7 +70,6 @@ class TapsilatError extends Error {
  * @extends TapsilatError
  */
 class TapsilatNetworkError extends TapsilatError {
-    statusCode;
     /**
      * @summary Creates a new network error instance
      * @description Initializes network error with message, code, status code and optional details
@@ -361,7 +379,7 @@ class HttpClient {
         let lastError = null;
         for (let attempt = 0; attempt <= maxRetries; attempt++) {
             try {
-                const response = await this.makeRequest(interceptedUrl, interceptedOptions, config?.timeout, config?.responseType);
+                const response = await this.makeRequest(interceptedUrl, interceptedOptions, config?.timeout ?? this.config.timeout, config?.responseType);
                 // Execute response interceptors
                 const interceptedResponse = await this.interceptors.executeResponseInterceptors(response, {
                     url: interceptedUrl,
@@ -437,44 +455,94 @@ class HttpClient {
      * @returns Processed API response
      */
     async processResponse(response, responseType) {
-        const contentType = response.headers.get("content-type");
-        const isJson = contentType?.includes("application/json");
-        let responseData;
-        try {
-            if (responseType === "blob") {
-                responseData = await response.blob();
+        const contentType = response.headers.get("content-type") ?? "";
+        // Binary downloads, such as order exports, are returned as they are
+        if (response.ok && (responseType === "blob" || responseType === "arraybuffer")) {
+            try {
+                const data = responseType === "blob" ? await response.blob() : await response.arrayBuffer();
+                return { success: true, status: response.status, data: data };
             }
-            else if (responseType === "arraybuffer") {
-                responseData = await response.arrayBuffer();
+            catch {
+                throw new TapsilatError("Failed to read response body", "PARSE_ERROR");
             }
-            else if (responseType === "text") {
-                responseData = await response.text();
+        }
+        let rawBody;
+        try {
+            rawBody = await response.text();
+        }
+        catch {
+            throw new TapsilatError("Failed to read response body", "PARSE_ERROR");
+        }
+        const trimmed = rawBody.trim();
+        let responseData = undefined;
+        if (trimmed !== "") {
+            const looksLikeJson = trimmed.startsWith("{") || trimmed.startsWith("[");
+            if (responseType === "text" && response.ok) {
+                responseData = rawBody;
             }
-            else if (isJson || responseType === "json") {
-                responseData = await response.json();
+            else if (contentType.includes("json") || looksLikeJson) {
+                try {
+                    responseData = JSON.parse(trimmed);
+                }
+                catch {
+                    if (response.ok) {
+                        throw new TapsilatError("Failed to parse response body", "PARSE_ERROR");
+                    }
+                    responseData = rawBody;
+                }
             }
             else {
-                responseData = await response.text();
+                responseData = rawBody;
             }
         }
-        catch {
-            throw new TapsilatError("Failed to parse response body", "PARSE_ERROR");
-        }
         // Handle successful responses
         if (response.ok) {
+            // A deployment serving the panel UI answers unknown routes with its HTML page and status 200
+            if (contentType.includes("text/html") || trimmed.startsWith("<")) {
+                return {
+                    success: false,
+                    status: response.status,
+                    error: {
+                        message: `Unexpected non-JSON response (Content-Type "${contentType}"); check that the endpoint URL and route are correct`,
+                        code: "UNEXPECTED_RESPONSE",
+                        statusCode: response.status,
+                        rawBody,
+                    },
+                };
+            }
             return {
                 success: true,
+                status: response.status,
                 data: responseData,
             };
         }
         // Handle error responses
         const error = this.createErrorFromResponse(response, responseData);
+        const body = responseData && typeof responseData === "object"
+            ? responseData
+            : {};
+        const errors = body.errors && typeof body.errors === "object" && !Array.isArray(body.errors)
+            ? body.errors
+            : undefined;
+        const nested = this.nestedError(body);
+        const apiCode = body.code !== undefined && body.code !== null ? body.code : nested?.code;
         return {
             success: false,
+            status: response.status,
             error: {
                 message: error.message,
                 code: error.code,
                 details: error.details,
+                statusCode: response.status,
+                apiCode: apiCode !== undefined && apiCode !== null
+                    ? String(apiCode)
+                    : undefined,
+                apiStatus: body.status !== undefined && body.status !== null
+                    ? String(body.status)
+                    : undefined,
+                errors,
+                retryable: typeof nested?.retryable === "boolean" ? nested.retryable : undefined,
+                rawBody,
             },
         };
     }
@@ -531,10 +599,28 @@ class HttpClient {
         }
         if (data && typeof data === "object") {
             const obj = data;
-            return (obj.message || obj.error || obj.detail);
+            const nested = this.nestedError(obj);
+            return (obj.message || (nested ? nested.message : obj.error) || obj.detail);
         }
         return undefined;
     }
+    /**
+     * @category HTTP Client Internals
+     * @summary Returns the error object of a nested error body
+     * @description Elements routes answer with {"error": {"code", "message", "retryable"}} instead of top-level fields
+     *
+     * @param data - The parsed response data
+     * @returns The nested error object, or undefined when `error` is not an object
+     */
+    nestedError(data) {
+        if (!data || typeof data !== "object") {
+            return undefined;
+        }
+        const error = data.error;
+        return error && typeof error === "object" && !Array.isArray(error)
+            ? error
+            : undefined;
+    }
     /**
      * @category HTTP Client Internals
      * @summary Extracts validation details from error response
@@ -578,6 +664,29 @@ class HttpClient {
      * @param params - Optional query parameters
      * @returns Complete request URL
      */
+    /**
+     * @category HTTP Client
+     * @summary Returns the configured base URL for another API version
+     * @description Replaces a trailing `/api/vN` path segment with `/api/{version}`, or appends `/api/{version}`
+     *
+     * @param version - API version such as "v2"
+     * @returns Base URL for that API version
+     */
+    versionedBaseURL(version) {
+        const base = (this.config.baseURL || "https://panel.tapsilat.dev/api/v1").replace(/\/+$/, "");
+        const url = new URL(base);
+        const segments = url.pathname.replace(/^\/+|\/+$/g, "").split("/").filter(Boolean);
+        if (segments.length >= 2 &&
+            segments[segments.length - 2] === "api" &&
+            segments[segments.length - 1].startsWith("v")) {
+            segments[segments.length - 1] = version;
+        }
+        else {
+            segments.push("api", version);
+        }
+        url.pathname = "/" + segments.join("/");
+        return url.toString().replace(/\/+$/, "");
+    }
     buildUrl(url, customBaseURL, params) {
         const baseURL = customBaseURL ||
             this.config.baseURL ||
@@ -1221,6 +1330,48 @@ function validateInstallments(installments) {
         };
     }
 }
+// GSM NUMBER CLEANING
+// Summary: Cleans a GSM number the same way the other Tapsilat SDKs do
+// Description: Strips spaces, dashes and parentheses, accepts digits with an optional leading +, and checks a minimum length per format
+/**
+ * Cleans and validates a GSM number for order creation
+ *
+ * @summary Clean a GSM number with the SDK-wide rules
+ * @description Removes spaces, dashes and parentheses, then checks that only digits and + remain and that the
+ * number is long enough for its format (international +, 00, national 0 or local). Any country is accepted.
+ *
+ * @param phone - Phone number as entered
+ * @returns The cleaned number, or an empty string when phone is empty
+ * @throws {TapsilatValidationError} When the number is malformed or too short
+ */
+function cleanGsmNumber(phone) {
+    if (!phone) {
+        return "";
+    }
+    const cleaned = phone.replace(/[\s\-()]/g, "");
+    if (!/^[+0-9]+$/.test(cleaned) || cleaned.replace(/\+/g, "") === "") {
+        throw new TapsilatValidationError(`Invalid phone number format: ${phone}`);
+    }
+    if (cleaned.startsWith("+")) {
+        if (cleaned.length < 8) {
+            throw new TapsilatValidationError(`International phone number too short: ${phone}`);
+        }
+    }
+    else if (cleaned.startsWith("00")) {
+        if (cleaned.length < 9) {
+            throw new TapsilatValidationError(`International phone number (00 format) too short: ${phone}`);
+        }
+    }
+    else if (cleaned.startsWith("0")) {
+        if (cleaned.length < 7) {
+            throw new TapsilatValidationError(`National phone number too short: ${phone}`);
+        }
+    }
+    else if (cleaned.length < 6) {
+        throw new TapsilatValidationError(`Local phone number too short: ${phone}`);
+    }
+    return cleaned;
+}
 
 /**
  * @category Configuration
@@ -1325,7 +1476,7 @@ class ConfigManager {
  * @throws {TapsilatError} On any response error
  */
 const handleResponse = (response, errorContext) => {
-    if (!response.success || !response.data) {
+    if (!response.success || response.data === undefined || response.data === null) {
         // Convert API errors to domain-specific errors
         if (response.error) {
             throw TapsilatError.fromAPIError(response.error);
@@ -1334,6 +1485,23 @@ const handleResponse = (response, errorContext) => {
     }
     return response.data;
 };
+/**
+ * Response handler for endpoints that may answer with an empty body
+ *
+ * @summary Process API responses whose success body can be empty
+ * @description Like handleResponse, but a successful empty body (for example HTTP 204) resolves to undefined
+ *
+ * @param response - The API response to process
+ * @param errorContext - Descriptive context for error messages
+ * @returns The data from a successful response, or undefined when the body was empty
+ * @throws {TapsilatError} On any response error
+ */
+const handleOptionalResponse = (response, errorContext) => {
+    if (response.success) {
+        return response.data ?? undefined;
+    }
+    return handleResponse(response, errorContext);
+};
 // ERROR HANDLING
 // Summary: Centralized error handling for consistent error reporting
 // Description: Processes caught errors and ensures they are properly converted to TapsilatError types
@@ -1358,26 +1526,510 @@ const handleError = (error, errorContext) => {
         : `Unknown error during ${errorContext}`, "NETWORK_ERROR");
 };
 
+/**
+ * Shared request handling for the SDK's grouped services
+ *
+ * @summary Base class for API service groups
+ * @description Unwraps responses, converts failures to TapsilatError and builds version 2 request configs.
+ */
+class ServiceBase {
+    httpClient;
+    constructor(httpClient) {
+        this.httpClient = httpClient;
+    }
+    /** Runs a request and returns its data, throwing on failure or an empty body */
+    async request(context, call) {
+        try {
+            return handleResponse(await call(), context);
+        }
+        catch (error) {
+            return handleError(error, context.toLowerCase());
+        }
+    }
+    /** Runs a request whose successful response may have an empty body */
+    async requestOptional(context, call) {
+        try {
+            return handleOptionalResponse(await call(), context);
+        }
+        catch (error) {
+            return handleError(error, context.toLowerCase());
+        }
+    }
+    /** Request config for version 2 routes, derived from the configured base URL */
+    v2(config = {}) {
+        return { ...config, baseURL: this.httpClient.versionedBaseURL("v2") };
+    }
+    /** Throws when a required identifier is missing and returns it URL-encoded */
+    id(value, name) {
+        if (!isNonEmptyString(value)) {
+            throw new TapsilatValidationError(`${name} is required and must be a non-empty string`, { provided: value });
+        }
+        return encodeURIComponent(value);
+    }
+}
+
+/**
+ * Submerchant management
+ *
+ * @summary Create, read, update and delete submerchants
+ * @description Covers the version 1 submerchant routes, item payout events and marketplace seller creation.
+ * Currency fields accept a currency UUID or an organization unit such as "TRY".
+ */
+class SubmerchantService extends ServiceBase {
+    /** Creates a submerchant; the response carries only code and message */
+    async createSubmerchant(request) {
+        return this.request("Create submerchant", () => this.httpClient.post("/submerchants", request));
+    }
+    async getSubmerchant(id) {
+        const path = `/submerchants/${this.id(id, "Submerchant ID")}`;
+        return this.request("Get submerchant", () => this.httpClient.get(path));
+    }
+    /** Lists submerchants; rows are returned under `row` */
+    async listSubmerchants(page = 1, perPage = 10) {
+        return this.request("List submerchants", () => this.httpClient.get("/submerchants", {
+            params: { page, per_page: perPage },
+        }));
+    }
+    /** Replaces the submerchant profile; send every field */
+    async updateSubmerchant(id, request) {
+        const path = `/submerchants/${this.id(id, "Submerchant ID")}`;
+        return this.request("Update submerchant", () => this.httpClient.patch(path, request));
+    }
+    async deleteSubmerchant(id) {
+        const path = `/submerchants/${this.id(id, "Submerchant ID")}`;
+        return this.request("Delete submerchant", () => this.httpClient.delete(path));
+    }
+    async getSuborganizationBySubmerchant(submerchantId) {
+        const path = `/submerchants/${this.id(submerchantId, "Submerchant ID")}/suborganization`;
+        return this.request("Get suborganization by submerchant", () => this.httpClient.get(path));
+    }
+    /**
+     * Records an item business event; time gates, approval and settlement remain separate.
+     * Repeating an event with the same idempotency key and payload is safe.
+     */
+    async recordSubmerchantPayoutEvent(request) {
+        return this.request("Record submerchant payout event", () => this.httpClient.post("/submerchant-payout-events", request));
+    }
+    /**
+     * Creates a logical marketplace seller; inspect `provisionings` for each VPOS account's readiness.
+     * Reuse the same idempotency key and request data when retrying.
+     */
+    async createMarketplaceSubmerchant(request) {
+        return this.request("Create marketplace submerchant", () => this.httpClient.post("/submerchants", request, this.v2()));
+    }
+}
+
+/**
+ * Virtual POS management
+ *
+ * @summary Manage VPOS configurations, their submerchants and acquirer lookups
+ * @description Updates replace the stored configuration: read the VPOS first and send every field back.
+ */
+class VposService extends ServiceBase {
+    async listVpos(params = {}) {
+        return this.request("List VPOS", () => this.httpClient.get("/vpos", {
+            params: { page: 1, per_page: 10, ...params },
+        }));
+    }
+    /** Creates a VPOS; `currencies` accepts currency UUIDs or units such as "TRY" */
+    async createVpos(request) {
+        return this.request("Create VPOS", () => this.httpClient.post("/vpos", request));
+    }
+    async getVpos(id) {
+        const path = `/vpos/${this.id(id, "VPOS ID")}`;
+        return this.request("Get VPOS", () => this.httpClient.get(path));
+    }
+    /** Replaces a VPOS configuration; fields left out are stored as empty or false */
+    async updateVpos(id, request) {
+        const path = `/vpos/${this.id(id, "VPOS ID")}`;
+        return this.request("Update VPOS", () => this.httpClient.patch(path, request));
+    }
+    async deleteVpos(id) {
+        const path = `/vpos/${this.id(id, "VPOS ID")}`;
+        return this.request("Delete VPOS", () => this.httpClient.delete(path));
+    }
+    async listVposAcquirers() {
+        return this.request("List VPOS acquirers", () => this.httpClient.get("/vpos/acquirers"));
+    }
+    async listCardSchemes() {
+        return this.request("List card schemes", () => this.httpClient.get("/vpos/card-schemes"));
+    }
+    async listVposAcquirerTemplates() {
+        return this.request("List VPOS acquirer templates", () => this.httpClient.get("/vpos/acquirer-templates"));
+    }
+    async listVposSubmerchants(params = {}) {
+        return this.request("List VPOS submerchants", () => this.httpClient.get("/vpos-submerchant", {
+            params: { page: 1, per_page: 10, ...params },
+        }));
+    }
+    async createVposSubmerchant(request) {
+        return this.request("Create VPOS submerchant", () => this.httpClient.post("/vpos-submerchant", request));
+    }
+    async getVposSubmerchant(id) {
+        const path = `/vpos-submerchant/${this.id(id, "VPOS submerchant ID")}`;
+        return this.request("Get VPOS submerchant", () => this.httpClient.get(path));
+    }
+    async updateVposSubmerchant(id, request) {
+        const path = `/vpos-submerchant/${this.id(id, "VPOS submerchant ID")}`;
+        return this.request("Update VPOS submerchant", () => this.httpClient.patch(path, request));
+    }
+    async deleteVposSubmerchant(id) {
+        const path = `/vpos-submerchant/${this.id(id, "VPOS submerchant ID")}`;
+        return this.request("Delete VPOS submerchant", () => this.httpClient.delete(path));
+    }
+}
+
+/**
+ * Card tokenization
+ *
+ * @summary Tokenize, list and delete saved cards
+ */
+class TokenizationService extends ServiceBase {
+    /** Tokenizes a card; returns 3D secure form details when verification is required */
+    async tokenizeCard(request) {
+        return this.request("Tokenize card", () => this.httpClient.post("/tokenization/card/tokenize", request));
+    }
+    async listSavedCards(page = 1, perPage = 10) {
+        return this.request("List saved cards", () => this.httpClient.get("/tokenization/card/list", {
+            params: { page, per_page: perPage },
+        }));
+    }
+    async deleteSavedCard(id) {
+        const path = `/tokenization/card/${this.id(id, "Card ID")}`;
+        return this.request("Delete saved card", () => this.httpClient.delete(path));
+    }
+}
+
+/**
+ * Marketplace API (version 2)
+ *
+ * @summary Manage marketplace sellers, payouts, policies and payout operations
+ * @description All calls use the version 2 routes derived from the configured base URL and are scoped to the
+ * API token's organization. Revisions are opaque strings: send them back exactly as received.
+ */
+class MarketplaceService extends ServiceBase {
+    currencies;
+    constructor(httpClient, currencies) {
+        super(httpClient);
+        this.currencies = currencies;
+    }
+    /** Lists sellers; `external_id` selects an exact external ID match */
+    async listMarketplaceSubmerchants(params = {}) {
+        return this.request("List marketplace submerchants", () => this.httpClient.get("/submerchants", this.v2({ params: { page: 1, per_page: 20, ...params } })));
+    }
+    /** Returns the seller profile and its current revision */
+    async getMarketplaceSubmerchant(id) {
+        const path = `/submerchants/${this.id(id, "Seller ID")}`;
+        return this.request("Get marketplace submerchant", () => this.httpClient.get(path, this.v2()));
+    }
+    /** Replaces the seller profile at its revision; inspect `approval_required` */
+    async updateMarketplaceSubmerchant(id, input) {
+        const path = `/submerchants/${this.id(id, "Seller ID")}`;
+        return this.request("Update marketplace submerchant", () => this.httpClient.patch(path, input, this.v2()));
+    }
+    /** Returns the selected accounts' requirements for a seller operation */
+    async getMarketplaceSellerContracts(filter) {
+        const query = new URLSearchParams({
+            currency_id: filter.currency_id,
+            seller_type: filter.seller_type,
+            operation: filter.operation,
+        });
+        for (const vposId of filter.vpos_ids ?? []) {
+            query.append("vpos_id", vposId);
+        }
+        return this.request("Get marketplace seller contracts", () => this.httpClient.get(`/marketplace/seller-contracts?${query.toString()}`, this.v2()));
+    }
+    /** Returns account registration, synchronization and available actions */
+    async getMarketplaceSellerAccounts(id) {
+        const path = `/submerchants/${this.id(id, "Seller ID")}/providers`;
+        return this.request("Get marketplace seller accounts", () => this.httpClient.get(path, this.v2()));
+    }
+    /** Runs an action listed on the account at its revision and environment; inspect the returned status */
+    async runMarketplaceSellerAccountAction(id, vposId, action) {
+        const path = `/submerchants/${this.id(id, "Seller ID")}/providers/${this.id(vposId, "VPOS ID")}/actions`;
+        return this.request("Run marketplace seller account action", () => this.httpClient.post(path, action, this.v2()));
+    }
+    async listMarketplacePayouts(filter = {}) {
+        return this.request("List marketplace payouts", () => this.httpClient.get("/submerchant-payouts", this.v2({ params: { page: 1, per_page: 20, ...filter } })));
+    }
+    /** Returns a payout's eligibility, approval and settlement state */
+    async getMarketplacePayout(id) {
+        const path = `/submerchant-payouts/${this.id(id, "Payout ID")}`;
+        return this.request("Get marketplace payout", () => this.httpClient.get(path, this.v2()));
+    }
+    /**
+     * Submits up to 100 eligible payouts for approval without bypassing release gates.
+     * "accepted" acknowledges approval; poll the payout for settlement.
+     */
+    async approveMarketplacePayouts(input) {
+        return this.request("Approve marketplace payouts", () => this.httpClient.post("/submerchant-payouts/approve", input, this.v2()));
+    }
+    async listMarketplaceApprovalPolicies() {
+        return this.request("List marketplace approval policies", () => this.httpClient.get("/marketplace/approval-policies", this.v2()));
+    }
+    async getMarketplaceApprovalPolicy(id) {
+        const path = `/marketplace/approval-policies/${this.id(id, "Policy ID")}`;
+        return this.request("Get marketplace approval policy", () => this.httpClient.get(path, this.v2()));
+    }
+    /** Creates an approval rule; a currency unit such as "TRY" is resolved to its UUID */
+    async createMarketplaceApprovalPolicy(input) {
+        const body = await this.withResolvedCurrency(input);
+        await this.requestOptional("Create marketplace approval policy", () => this.httpClient.post("/marketplace/approval-policies", body, this.v2()));
+    }
+    /** Replaces an approval rule; a currency unit such as "TRY" is resolved to its UUID */
+    async updateMarketplaceApprovalPolicy(id, input) {
+        const path = `/marketplace/approval-policies/${this.id(id, "Policy ID")}`;
+        const body = await this.withResolvedCurrency(input);
+        await this.requestOptional("Update marketplace approval policy", () => this.httpClient.patch(path, body, this.v2()));
+    }
+    async deleteMarketplaceApprovalPolicy(id) {
+        const path = `/marketplace/approval-policies/${this.id(id, "Policy ID")}`;
+        await this.requestOptional("Delete marketplace approval policy", () => this.httpClient.delete(path, this.v2()));
+    }
+    async listMarketplaceReleasePolicies() {
+        return this.request("List marketplace release policies", () => this.httpClient.get("/marketplace/release-policies", this.v2()));
+    }
+    async getMarketplaceReleasePolicy(id) {
+        const path = `/marketplace/release-policies/${this.id(id, "Policy ID")}`;
+        return this.request("Get marketplace release policy", () => this.httpClient.get(path, this.v2()));
+    }
+    async createMarketplaceReleasePolicy(input) {
+        return this.request("Create marketplace release policy", () => this.httpClient.post("/marketplace/release-policies", input, this.v2()));
+    }
+    async updateMarketplaceReleasePolicy(id, input) {
+        const path = `/marketplace/release-policies/${this.id(id, "Policy ID")}`;
+        return this.request("Update marketplace release policy", () => this.httpClient.patch(path, input, this.v2()));
+    }
+    async deleteMarketplaceReleasePolicy(id) {
+        const path = `/marketplace/release-policies/${this.id(id, "Policy ID")}`;
+        await this.requestOptional("Delete marketplace release policy", () => this.httpClient.delete(path, this.v2()));
+    }
+    async getMarketplaceApprovalSettings() {
+        return this.request("Get marketplace approval settings", () => this.httpClient.get("/marketplace/approval-settings", this.v2()));
+    }
+    async updateMarketplaceApprovalSettings(input) {
+        return this.request("Update marketplace approval settings", () => this.httpClient.patch("/marketplace/approval-settings", input, this.v2()));
+    }
+    /** Changes a payout allocation or withdraws approval; inspect `status` before treating it as complete */
+    async runMarketplacePayoutOperation(payoutId, input) {
+        const path = `/submerchant-payouts/${this.id(payoutId, "Payout ID")}/operations`;
+        return this.request("Run marketplace payout operation", () => this.httpClient.post(path, input, this.v2()));
+    }
+    /** Returns a persisted payout operation receipt */
+    async getMarketplacePayoutOperation(id) {
+        const path = `/marketplace/payout-operations/${this.id(id, "Operation ID")}`;
+        return this.request("Get marketplace payout operation", () => this.httpClient.get(path, this.v2()));
+    }
+    /** Checks the provider result without repeating the change */
+    async reconcileMarketplacePayoutOperation(id) {
+        const path = `/marketplace/payout-operations/${this.id(id, "Operation ID")}/reconcile`;
+        return this.request("Reconcile marketplace payout operation", () => this.httpClient.post(path, undefined, this.v2()));
+    }
+    /** Repeats an unresolved change only after the previous provider state is verified */
+    async retryMarketplacePayoutOperation(id) {
+        const path = `/marketplace/payout-operations/${this.id(id, "Operation ID")}/retry`;
+        return this.request("Retry marketplace payout operation", () => this.httpClient.post(path, undefined, this.v2()));
+    }
+    async withResolvedCurrency(input) {
+        if (!input.currency_id || input.currency_id.trim() === "") {
+            return input;
+        }
+        return {
+            ...input,
+            currency_id: await this.currencies.resolve(input.currency_id),
+        };
+    }
+}
+
+const UUID_PATTERN = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+/**
+ * Resolves organization currency units such as "TRY" to currency UUIDs
+ *
+ * @summary Cached lookup of organization currency IDs by unit
+ * @description Most endpoints accept currency units directly. Use this where the server requires a UUID,
+ * such as marketplace approval policies. The lookup is cached until invalidate() is called.
+ */
+class CurrencyResolver {
+    httpClient;
+    idsByUnit;
+    constructor(httpClient) {
+        this.httpClient = httpClient;
+    }
+    /**
+     * Returns the currency UUID for ref; a UUID is returned unchanged
+     *
+     * @param ref - Currency UUID or organization currency unit
+     * @throws {TapsilatValidationError} When ref is empty or not one of the organization's currencies
+     */
+    async resolve(ref) {
+        const trimmed = (ref ?? "").trim();
+        if (trimmed === "") {
+            throw new TapsilatValidationError("currency_id is required");
+        }
+        if (UUID_PATTERN.test(trimmed)) {
+            return trimmed;
+        }
+        const id = (await this.load()).get(trimmed.toUpperCase());
+        if (!id) {
+            throw new TapsilatValidationError(`Unknown currency reference "${ref}"; use a currency UUID or organization currency unit`);
+        }
+        return id;
+    }
+    /** Clears the cached currencies, for example after creating a currency */
+    invalidate() {
+        this.idsByUnit = undefined;
+    }
+    load() {
+        if (!this.idsByUnit) {
+            this.idsByUnit = this.fetch().catch((error) => {
+                this.idsByUnit = undefined;
+                throw error;
+            });
+        }
+        return this.idsByUnit;
+    }
+    async fetch() {
+        try {
+            const response = await this.httpClient.get("/organization/currencies");
+            const data = handleResponse(response, "Get organization currencies");
+            const map = new Map();
+            for (const currency of data.currencies ?? []) {
+                const unit = (currency.currency_unit ?? "").trim().toUpperCase();
+                if (unit && currency.id) {
+                    map.set(unit, currency.id);
+                }
+            }
+            return map;
+        }
+        catch (error) {
+            return handleError(error, "get organization currencies");
+        }
+    }
+}
+
+/** What a redacted secret prints as */
+const REDACTED = "[redacted]";
+/** The hook Node.js calls when console.log or util.inspect prints an object */
+const INSPECT = Symbol.for("nodejs.util.inspect.custom");
+/**
+ * Makes console.log and util.inspect print an object's `client_secret` as "[redacted]"
+ *
+ * @summary Keep a client secret out of logs
+ * @description
+ * Adds a non-enumerable inspect hook to the object itself, so JSON.stringify, property access and
+ * Object.keys still see the real secret. A copy made with spread or structuredClone does not keep
+ * the hook.
+ *
+ * @param value - A response object that carries `client_secret`
+ * @returns The same object
+ */
+const redactClientSecret = (value) => {
+    if (value && typeof value === "object" && "client_secret" in value) {
+        Object.defineProperty(value, INSPECT, {
+            value: function () {
+                return { ...this, client_secret: REDACTED };
+            },
+            enumerable: false,
+            configurable: true,
+            writable: true,
+        });
+    }
+    return value;
+};
+
+/** The header that carries the signature of every callback Tapsilat sends */
+const WEBHOOK_SIGNATURE_HEADER = "Tapsilat-Signature";
+/** How many seconds a callback's signature timestamp may differ from the current time */
+const WEBHOOK_TOLERANCE = 300;
+const LEGACY_PREFIX = "sha256=";
+const hmacHex = (secret, ...parts) => {
+    const hmac = crypto.createHmac("sha256", secret);
+    for (const part of parts) {
+        hmac.update(part);
+    }
+    return hmac.digest("hex");
+};
+// Compare in constant time so the signature cannot be guessed byte by byte
+const safeEqual = (expected, candidate) => {
+    const a = Buffer.from(expected);
+    const b = Buffer.from(candidate);
+    return a.length === b.length && crypto.timingSafeEqual(a, b);
+};
+const checkSeconds = (value, name) => {
+    if (value !== undefined && (typeof value !== "number" || Number.isNaN(value))) {
+        throw new TapsilatValidationError(`Webhook ${name} must be a number of seconds`);
+    }
+    return value;
+};
 // WEBHOOK SIGNATURE VERIFICATION
-// Summary: Security verification of webhook payloads using HMAC-SHA256
-// Description: Computes expected signature from payload and secret, compares with provided signature
+// Summary: Verify the Tapsilat-Signature header of a callback
+// Description: Checks the timestamped HMAC-SHA256 that Tapsilat signs every callback with
 /**
- * Verifies HMAC-SHA256 signature for webhook security
+ * Verifies the Tapsilat-Signature header of a callback against the organization's webhook secret
+ *
+ * @summary Verify the Tapsilat-Signature header of a callback
+ * @description
+ * Tapsilat sends "t=<unix timestamp>,v1=<hex HMAC-SHA256 of '<timestamp>.<raw body>'>". The timestamp
+ * must be within `tolerance` seconds of `now` so that a captured callback cannot be replayed. The
+ * comparison takes constant time.
  *
- * @summary Security verification of webhook payloads using HMAC-SHA256
- * @description Computes expected signature from payload and secret, compares with provided signature
+ * A bare hex HMAC-SHA256 of the payload, with or without a "sha256=" prefix, is still accepted for
+ * signatures made the way earlier versions of this SDK documented.
  *
- * @param payload - Raw webhook payload string
- * @param signature - Webhook signature from headers (should include "sha256=" prefix)
- * @param secret - Your webhook secret key
- * @returns true if signature is valid, false otherwise
+ * @param payload - The raw request body, before any JSON decoding
+ * @param signature - The Tapsilat-Signature header
+ * @param secret - The webhook secret from the panel's callback settings
+ * @param options - Timestamp tolerance and the current time
+ * @returns true when the signature is valid; false when it is missing, malformed, stale or wrong
+ * @throws {TapsilatValidationError} When payload is not a string or bytes, or an option is not a number
  */
-const verifyHmacSignature = (payload, signature, secret) => {
-    const expectedSignature = crypto
-        .createHmac("sha256", secret)
-        .update(payload)
-        .digest("hex");
-    return `sha256=${expectedSignature}` === signature;
+const verifyWebhookSignature = (payload, signature, secret, options = {}) => {
+    if (typeof payload !== "string" && !(payload instanceof Uint8Array)) {
+        throw new TapsilatValidationError("Webhook payload must be the raw request body as a string or Buffer");
+    }
+    const tolerance = checkSeconds(options.tolerance, "tolerance") ?? WEBHOOK_TOLERANCE;
+    const now = checkSeconds(options.now, "now") ?? Math.floor(Date.now() / 1000);
+    const header = typeof signature === "string" ? signature.trim() : "";
+    if (header === "" || typeof secret !== "string" || secret === "") {
+        return false;
+    }
+    if (header.startsWith(LEGACY_PREFIX) || !header.includes("=")) {
+        const legacy = header.startsWith(LEGACY_PREFIX) ? header.slice(LEGACY_PREFIX.length) : header;
+        return safeEqual(hmacHex(secret, payload), legacy.toLowerCase());
+    }
+    let timestamp;
+    const candidates = [];
+    for (const part of header.split(",")) {
+        const pair = part.trim();
+        const separator = pair.indexOf("=");
+        if (separator === -1) {
+            continue;
+        }
+        const key = pair.slice(0, separator);
+        const value = pair.slice(separator + 1);
+        if (key === "t") {
+            timestamp = value;
+        }
+        else if (key === "v1") {
+            candidates.push(value.toLowerCase());
+        }
+    }
+    if (timestamp === undefined || !/^[0-9]+$/.test(timestamp) || candidates.length === 0) {
+        return false;
+    }
+    const signedAt = Number(timestamp);
+    if (!Number.isSafeInteger(signedAt)) {
+        return false;
+    }
+    if (tolerance > 0 && Math.abs(now - signedAt) > tolerance) {
+        return false;
+    }
+    const expected = hmacHex(secret, `${timestamp}.`, payload);
+    let valid = false;
+    for (const candidate of candidates) {
+        valid = safeEqual(expected, candidate) || valid;
+    }
+    return valid;
 };
 
 /**
@@ -1400,6 +2052,15 @@ const verifyHmacSignature = (payload, signature, secret) => {
 class TapsilatSDK {
     httpClient;
     configManager;
+    currencyResolver;
+    /** Submerchant management, payout events and marketplace seller creation */
+    submerchants;
+    /** VPOS configurations, VPOS submerchants and acquirer lookups */
+    vpos;
+    /** Card tokenization and saved cards */
+    tokenization;
+    /** Marketplace sellers, payouts, policies and payout operations (API version 2) */
+    marketplace;
     // SDK INITIALIZATION
     // Summary: Initializes the Tapsilat SDK with configuration options
     // Description: Creates and configures a new instance of the TapsilatSDK with the provided configuration
@@ -1431,6 +2092,11 @@ class TapsilatSDK {
         validateBearerToken(config.bearerToken);
         this.configManager = new ConfigManager(config);
         this.httpClient = new HttpClient(this.configManager.getInternalConfig());
+        this.currencyResolver = new CurrencyResolver(this.httpClient);
+        this.submerchants = new SubmerchantService(this.httpClient);
+        this.vpos = new VposService(this.httpClient);
+        this.tokenization = new TokenizationService(this.httpClient);
+        this.marketplace = new MarketplaceService(this.httpClient, this.currencyResolver);
     }
     /**
      * Access to order operations
@@ -1474,6 +2140,8 @@ class TapsilatSDK {
             getExcel: (id) => this.getOrderExcel(id),
             createRefundRequest: (request) => this.createOrderRefundRequest(request),
             addOip: (request) => this.addOrderOip(request),
+            charge: (request) => this.chargeOrder(request),
+            allPayments: () => this.getAllOrdersPayments(),
         };
     }
     /**
@@ -1502,10 +2170,11 @@ class TapsilatSDK {
             currencies: () => this.getOrganizationCurrencies(),
             getLimitUser: (request) => this.getOrganizationLimitUser(request),
             setLimitUser: (request) => this.setOrganizationLimitUser(request),
-            limits: () => this.getOrganizationLimits(),
+            limits: (organizationId) => this.getOrganizationLimitsById(organizationId),
             meta: (name) => this.getOrganizationMeta(name),
             scopes: () => this.getOrganizationScopes(),
             suborganizations: (params) => this.getOrganizationSuborganizations(params),
+            suborganization: (id) => this.getSuborganizationDetail(id),
             createUser: (request) => this.createOrganizationUser(request),
             verifyUser: (request) => this.verifyOrganizationUser(request),
             verifyUserMobile: (request) => this.verifyOrganizationUserMobile(request),
@@ -1514,6 +2183,9 @@ class TapsilatSDK {
             suborganizationDetails: (id) => this.getOrganizationSuborganizationDetails(id),
             suborganizationSubmerchants: (id) => this.getOrganizationSuborganizationSubmerchants(id),
             createUserToken: (request) => this.createOrganizationUserToken(request),
+            createCurrency: (input) => this.createOrganizationCurrency(input),
+            partners: () => this.getOrganizationPartners(),
+            limitsById: (id, params) => this.getOrganizationLimitsById(id, params),
         };
     }
     /**
@@ -1545,6 +2217,7 @@ class TapsilatSDK {
             transactionPaymentTypes: () => this.getSystemTransactionPaymentTypes(),
             transactionPurposes: () => this.getSystemTransactionPurposes(),
             transactionStatuses: () => this.getSystemTransactionStatuses(),
+            config: () => this.getSystemConfig(),
         };
     }
     /**
@@ -1553,7 +2226,7 @@ class TapsilatSDK {
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     get webhooks() {
         return {
-            verify: (payload, signature, secret) => this.verifyWebhook(payload, signature, secret),
+            verify: (payload, signature, secret, options) => this.verifyWebhook(payload, signature, secret, options),
         };
     }
     // ORDER CREATION
@@ -1649,11 +2322,30 @@ class TapsilatSDK {
         if (!isValidEmail(buyer.email)) {
             throw new TapsilatValidationError("Buyer email must be a valid email address", { provided: buyer.email });
         }
+        const request = buyer.gsm_number
+            ? {
+                ...orderRequest,
+                buyer: { ...buyer, gsm_number: cleanGsmNumber(buyer.gsm_number) },
+            }
+            : orderRequest;
         try {
             // Make the API request
-            const createOrderResponse = await this.httpClient.post("/order/create", orderRequest);
+            const createOrderResponse = await this.httpClient.post("/order/create", request);
             // Use our generic response handler
-            return handleResponse(createOrderResponse, "Order creation");
+            const created = handleResponse(createOrderResponse, "Order creation");
+            // The create response has no checkout URL; read it from the order, ignoring failures
+            if (created.reference_id && !created.checkout_url) {
+                try {
+                    const order = await this.getOrder(created.reference_id);
+                    if (order?.checkout_url) {
+                        created.checkout_url = order.checkout_url;
+                    }
+                }
+                catch {
+                    // The order was created; a missing checkout URL is not an error
+                }
+            }
+            return created;
         }
         catch (error) {
             // Use our generic error handler
@@ -2220,19 +2912,15 @@ class TapsilatSDK {
         if (!isNonEmptyString(referenceId)) {
             throw new TapsilatValidationError("Order referenceId is required and must be a non-empty string", { provided: referenceId });
         }
-        try {
-            const getOrderTransactionsResponse = await this.httpClient.get(`/order/${referenceId}/transactions`);
-            if (!getOrderTransactionsResponse.success)
-                throw new TapsilatError(getOrderTransactionsResponse.error?.message ||
-                    "Order transactions retrieval failed", getOrderTransactionsResponse.error?.code ||
-                    "TRANSACTIONS_RETRIEVAL_FAILED");
-            if (!getOrderTransactionsResponse.data)
-                throw new TapsilatError("Order transactions response data is missing", "TRANSACTIONS_DATA_MISSING");
-            return getOrderTransactionsResponse.data;
-        }
-        catch (error) {
-            return handleError(error, "order transactions retrieval");
-        }
+        const getOrderTransactionsResponse = await this.httpClient.get(`/order/${encodeURIComponent(referenceId)}/transactions`);
+        if (!getOrderTransactionsResponse.success)
+            throw TapsilatError.fromAPIError({
+                message: "Order transactions retrieval failed",
+                code: "TRANSACTIONS_RETRIEVAL_FAILED",
+                ...getOrderTransactionsResponse.error,
+            });
+        // The server answers null when an order has no transactions
+        return getOrderTransactionsResponse.data ?? [];
     }
     // ORDER SUBMERCHANT LISTING
     // Summary: Retrieve paginated list of submerchants for orders
@@ -2281,28 +2969,31 @@ class TapsilatSDK {
         throw new TapsilatError("Checkout URL not found in order response", "CHECKOUT_URL_NOT_FOUND");
     }
     // WEBHOOK SIGNATURE VERIFICATION
-    // Summary: Validate webhook signature for security verification
-    // Description: Verifies the authenticity of webhook payloads using HMAC signature validation
+    // Summary: Verify the Tapsilat-Signature header of a callback
+    // Description: Checks the timestamped HMAC-SHA256 that Tapsilat signs every callback with
     /**
-     * Verifies webhook signature for security
+     * Verifies the Tapsilat-Signature header of a callback against the organization's webhook secret
      *
-     * @summary Validate webhook signature for security verification
-     * @description Verifies the authenticity of webhook payloads using HMAC signature validation.
-     *
-     * @param payload - Raw webhook payload string
-     * @param signature - Webhook signature from headers
-     * @param secret - Your webhook secret key
-     * @returns Promise resolving to true if signature is valid
-     * @throws {TapsilatValidationError} When input validation fails for payload, signature or secret
+     * @summary Verify the Tapsilat-Signature header of a callback
+     * @description
+     * Tapsilat sends "t=<unix timestamp>,v1=<hex HMAC-SHA256 of '<timestamp>.<raw body>'>". The timestamp
+     * must be within `options.tolerance` seconds (300 by default; 0 disables the check) of `options.now`
+     * (the current time by default) so that a captured callback cannot be replayed. The comparison takes
+     * constant time.
+     *
+     * A bare hex HMAC-SHA256 of the payload, with or without a "sha256=" prefix, is still accepted for
+     * signatures made the way earlier versions of this SDK documented.
+     *
+     * @param payload - The raw request body as a string or Buffer, before any JSON decoding
+     * @param signature - The Tapsilat-Signature header
+     * @param secret - The webhook secret from the panel's callback settings
+     * @param options - Timestamp tolerance in seconds and the current Unix time
+     * @returns Promise resolving to true when the signature is valid, and to false when the header or
+     * secret is empty, or the signature is malformed, stale or wrong
+     * @throws {TapsilatValidationError} When payload is not a string or bytes, or an option is not a number
      */
-    async verifyWebhook(payload, signature, secret) {
-        if (!isNonEmptyString(payload))
-            throw new TapsilatValidationError("Webhook payload is required and must be a non-empty string");
-        if (!isNonEmptyString(signature))
-            throw new TapsilatValidationError("Webhook signature is required and must be a non-empty string");
-        if (!isNonEmptyString(secret))
-            throw new TapsilatValidationError("Webhook secret is required and must be a non-empty string");
-        return verifyHmacSignature(payload, signature, secret);
+    async verifyWebhook(payload, signature, secret, options = {}) {
+        return verifyWebhookSignature(payload, signature, secret, options);
     }
     // API HEALTH STATUS CHECK
     // Summary: Check API service health and availability
@@ -2375,13 +3066,13 @@ class TapsilatSDK {
      * across multiple payments with specific due dates and requirements.
      *
      * @param {OrderPaymentTermCreateDTO} termData - Payment term creation data
-     * @param {string} termData.order_id - Reference ID of the existing order
-     * @param {string} termData.term_reference_id - Unique identifier for this payment term
+     * @param {string} termData.order_id - ID of the existing order (order_id from order creation, not its reference ID)
+     * @param {string} [termData.term_reference_id] - Unique identifier for this payment term
      * @param {number} termData.amount - Amount for this payment term
-     * @param {string} termData.due_date - Due date for this payment (ISO 8601 format)
-     * @param {number} termData.term_sequence - Sequence number for this term
+     * @param {string} termData.due_date - Due date for this payment (YYYY-MM-DD)
+     * @param {number} [termData.term_sequence] - Sequence number for this term
      * @param {boolean} termData.required - Whether this payment term is required
-     * @param {string} termData.status - Initial status of the payment term
+     * @param {string} [termData.status] - Initial status of the payment term
      * @param {string} [termData.data] - Additional metadata for the term
      * @param {string} [termData.paid_date] - Date when payment was completed
      *
@@ -2394,9 +3085,6 @@ class TapsilatSDK {
         if (!isNonEmptyString(termData.order_id)) {
             throw new TapsilatValidationError("Order ID is required and must be a non-empty string", { provided: termData.order_id });
         }
-        if (!isNonEmptyString(termData.term_reference_id)) {
-            throw new TapsilatValidationError("Term reference ID is required and must be a non-empty string", { provided: termData.term_reference_id });
-        }
         if (!isPositiveNumber(termData.amount)) {
             throw new TapsilatValidationError("Amount must be a positive number", {
                 provided: termData.amount,
@@ -2408,7 +3096,8 @@ class TapsilatSDK {
         if (!isNonEmptyString(termData.due_date)) {
             throw new TapsilatValidationError("Due date is required and must be a non-empty string", { provided: termData.due_date });
         }
-        if (!isInteger(termData.term_sequence)) {
+        if (termData.term_sequence !== undefined &&
+            !isInteger(termData.term_sequence)) {
             throw new TapsilatValidationError("Term sequence must be an integer", {
                 provided: termData.term_sequence,
             });
@@ -2418,9 +3107,6 @@ class TapsilatSDK {
                 provided: termData.required,
             });
         }
-        if (!isNonEmptyString(termData.status)) {
-            throw new TapsilatValidationError("Status is required and must be a non-empty string", { provided: termData.status });
-        }
         try {
             const createTermResponse = await this.httpClient.post("/order/term", termData);
             return handleResponse(createTermResponse, "Payment term creation");
@@ -2499,6 +3185,7 @@ class TapsilatSDK {
      * Only unpaid payment terms can be deleted.
      *
      * @param {PaymentTermDeleteRequest} deleteData - Payment term deletion data
+     * @param {string} deleteData.order_id - ID of the order (not its reference ID)
      * @param {string} deleteData.term_reference_id - Reference ID of the term to delete
      *
      * @returns {Promise<PaymentTermResponse>} Promise resolving to deleted payment term details
@@ -2507,6 +3194,9 @@ class TapsilatSDK {
      */
     async deleteOrderTerm(deleteData) {
         // Validate required fields
+        if (!isNonEmptyString(deleteData.order_id)) {
+            throw new TapsilatValidationError("Order ID is required and must be a non-empty string", { provided: deleteData.order_id });
+        }
         if (!isNonEmptyString(deleteData.term_reference_id)) {
             throw new TapsilatValidationError("Term reference ID is required and must be a non-empty string", { provided: deleteData.term_reference_id });
         }
@@ -2529,7 +3219,7 @@ class TapsilatSDK {
      * @param {OrderTermRefundRequest} refundData - Payment term refund data
      * @param {string} refundData.term_id - ID of the term to refund
      * @param {number} refundData.amount - Amount to refund
-     * @param {string} [refundData.reference_id] - Optional reference ID
+     * @param {string} refundData.reference_id - Reference ID of the order
      * @param {string} [refundData.term_payment_id] - Optional term payment ID
      *
      * @returns {Promise<PaymentTermRefundResponse>} Promise resolving to refund details
@@ -2541,6 +3231,9 @@ class TapsilatSDK {
         if (!isNonEmptyString(refundData.term_id)) {
             throw new TapsilatValidationError("Term ID is required and must be a non-empty string", { provided: refundData.term_id });
         }
+        if (!isNonEmptyString(refundData.reference_id)) {
+            throw new TapsilatValidationError("Order reference ID is required and must be a non-empty string", { provided: refundData.reference_id });
+        }
         if (!isPositiveNumber(refundData.amount)) {
             throw new TapsilatValidationError("Amount must be a positive number", {
                 provided: refundData.amount,
@@ -2572,6 +3265,8 @@ class TapsilatSDK {
      * @returns {Promise<PaymentTermResponse>} Promise resolving to terminated term details
      * @throws {TapsilatValidationError} When input validation fails
      * @throws {TapsilatError} When API returns an error response
+     * @deprecated The API has no payment term termination route, so this call always fails.
+     * Use deleteOrderTerm to remove a term or terminateOrder to end the whole order.
      */
     async terminateOrderTerm(terminateData) {
         // Validate required fields
@@ -2804,6 +3499,7 @@ class TapsilatSDK {
     }
     /**
      * Retrieve limit information for a specific organization user
+     * @deprecated The API has no organization user limit route, so this call always fails.
      */
     async getOrganizationLimitUser(request) {
         try {
@@ -2816,6 +3512,7 @@ class TapsilatSDK {
     }
     /**
      * Set limit for a specific organization user
+     * @deprecated The API has no organization user limit route, so this call always fails.
      */
     async setOrganizationLimitUser(request) {
         try {
@@ -2827,7 +3524,9 @@ class TapsilatSDK {
         }
     }
     /**
-     * Retrieve organization overall limits
+     * Retrieve an organization's limits
+     * @deprecated The API has no `/organization/limits` route, so this call always fails.
+     * Use getOrganizationLimitsById.
      */
     async getOrganizationLimits() {
         try {
@@ -2839,15 +3538,17 @@ class TapsilatSDK {
         }
     }
     /**
-     * Retrieve meta information for the organization
+     * Retrieve an organization meta value by name
+     *
+     * @param name - Name of the meta value
      */
     async getOrganizationMeta(name) {
         if (!isNonEmptyString(name)) {
-            throw new TapsilatValidationError("Meta name is required and must be a non-empty string");
+            throw new TapsilatValidationError("Meta name is required and must be a non-empty string", { provided: name });
         }
         try {
-            const organizationMetaResponse = await this.httpClient.get(`/organization/metas/${name}`);
-            return handleResponse(organizationMetaResponse, "Get organization meta");
+            const response = await this.httpClient.get(`/organization/metas/${encodeURIComponent(name)}`);
+            return handleResponse(response, "Get organization meta");
         }
         catch (error) {
             return handleError(error, "get organization meta");
@@ -2866,7 +3567,7 @@ class TapsilatSDK {
         }
     }
     /**
-     * Retrieve list of sub-organizations
+     * Retrieve a page of sub-organizations
      */
     async getOrganizationSuborganizations(params = {}) {
         if (params.page !== undefined) {
@@ -2935,6 +3636,271 @@ class TapsilatSDK {
             return handleError(error, "list organization VPOs");
         }
     }
+    // ORDER PAYMENTS AND CHARGING
+    /**
+     * Lists the payments made against an order with commission totals
+     *
+     * @param request - Identify the order by order_id, order_reference_id or conversation_id
+     */
+    async getOrderPayments(request) {
+        if (!isNonEmptyString(request.order_id) &&
+            !isNonEmptyString(request.order_reference_id) &&
+            !isNonEmptyString(request.conversation_id)) {
+            throw new TapsilatValidationError("One of order_id, order_reference_id or conversation_id is required");
+        }
+        try {
+            const response = await this.httpClient.post("/order/payments", request);
+            return handleResponse(response, "Get order payments");
+        }
+        catch (error) {
+            return handleError(error, "get order payments");
+        }
+    }
+    /**
+     * Charges an order; inspect isSuccess, since the request can succeed while the charge fails
+     */
+    async chargeOrder(request) {
+        if (!isNonEmptyString(request.order_reference_id)) {
+            throw new TapsilatValidationError("Order reference ID is required and must be a non-empty string", { provided: request.order_reference_id });
+        }
+        try {
+            const response = await this.httpClient.post("/order/charge", request);
+            return handleResponse(response, "Charge order");
+        }
+        catch (error) {
+            return handleError(error, "charge order");
+        }
+    }
+    /**
+     * Returns an order's payment details looked up by its conversation ID
+     */
+    async getOrderPaymentDetailsByConversationId(conversationId) {
+        if (!isNonEmptyString(conversationId)) {
+            throw new TapsilatValidationError("Conversation ID is required and must be a non-empty string", { provided: conversationId });
+        }
+        try {
+            const response = await this.httpClient.post("/order/payment-details", { conversation_id: conversationId });
+            return handleResponse(response, "Get order payment details");
+        }
+        catch (error) {
+            return handleError(error, "get order payment details");
+        }
+    }
+    /**
+     * Submits the stored item payout to the approval workflow
+     * @deprecated Use marketplace.approveMarketplacePayouts with explicit payout IDs.
+     */
+    async approveSubmerchantPayment(request) {
+        try {
+            const response = await this.httpClient.post("/submerchants/payment/approve", request);
+            return handleResponse(response, "Approve submerchant payment");
+        }
+        catch (error) {
+            return handleError(error, "approve submerchant payment");
+        }
+    }
+    /**
+     * Withdraws a stored payout's approval; inspect status and keep operation_id
+     */
+    async disapproveSubmerchantPayment(request) {
+        try {
+            const response = await this.httpClient.post("/submerchants/payment/disapprove", request);
+            return handleResponse(response, "Disapprove submerchant payment");
+        }
+        catch (error) {
+            return handleError(error, "disapprove submerchant payment");
+        }
+    }
+    /**
+     * Changes a stored payout allocation; inspect status and keep operation_id
+     */
+    async updateSubmerchantPaymentItem(request) {
+        try {
+            const response = await this.httpClient.put("/submerchants/payment/item", request);
+            return handleResponse(response, "Update submerchant payment item");
+        }
+        catch (error) {
+            return handleError(error, "update submerchant payment item");
+        }
+    }
+    // CARD INSTALLMENTS
+    /**
+     * Returns installment options and commission rates for a card BIN and amount
+     */
+    async getCardInstallments(request) {
+        if (!isNonEmptyString(request.bin)) {
+            throw new TapsilatValidationError("Card BIN is required", {
+                provided: request.bin,
+            });
+        }
+        try {
+            const response = await this.httpClient.get("/card/installments", { params: { ...request } });
+            return handleResponse(response, "Get card installments");
+        }
+        catch (error) {
+            return handleError(error, "get card installments");
+        }
+    }
+    /**
+     * Returns installment options grouped by bank card program, with an interest-free flag per row
+     */
+    async getInstallmentTable(request) {
+        try {
+            const response = await this.httpClient.get("/card/installment-table", { params: { ...request } });
+            return handleResponse(response, "Get installment table");
+        }
+        catch (error) {
+            return handleError(error, "get installment table");
+        }
+    }
+    // ELEMENTS SESSIONS
+    // Summary: Create, read and cancel sessions for the Tapsilat Elements card sheet
+    // Description: Your backend creates a session and hands only its client_secret to the app that opens the sheet
+    /**
+     * Creates a Tapsilat Elements session for the native card sheet
+     *
+     * @summary Create an Elements session
+     * @description
+     * Sends POST /elements/sessions. Hand the returned `client_secret` to your app, which opens the card
+     * sheet with it, and do not log or store it. A `pay` session needs `order_reference_id`; a `tokenize`
+     * session saves a card for `user_id` with the given `mode`.
+     *
+     * @param request - The session's purpose and its order or card owner
+     * @returns The new session with its `client_secret` and `elements_base_url`
+     * @throws {TapsilatValidationError} When `purpose` is missing
+     * @throws {TapsilatError} When the API rejects the request; `apiCode` and `retryable` say why
+     */
+    async createElementsSession(request) {
+        if (!isNonEmptyString(request?.purpose)) {
+            throw new TapsilatValidationError("Elements session purpose is required and must be a non-empty string", { provided: request?.purpose });
+        }
+        const body = Object.fromEntries(Object.entries(request).filter(([, value]) => value !== undefined && value !== null));
+        try {
+            const response = await this.httpClient.post("/elements/sessions", body);
+            return redactClientSecret(handleResponse(response, "Create Elements session"));
+        }
+        catch (error) {
+            return handleError(error, "create Elements session");
+        }
+    }
+    /**
+     * Returns the authoritative state and outcome of an Elements session
+     *
+     * @summary Get an Elements session
+     * @description
+     * Sends GET /elements/sessions/{id}. Read the outcome here on your backend before fulfilling an
+     * order, rather than trusting what the app reports.
+     *
+     * @param id - Session ID, such as "es_test_8Kq2nV0rX4"
+     * @throws {TapsilatError} With `apiCode` "session_not_found" and `statusCode` 404 for an unknown session
+     */
+    async getElementsSession(id) {
+        if (!isNonEmptyString(id)) {
+            throw new TapsilatValidationError("Elements session ID is required and must be a non-empty string", { provided: id });
+        }
+        try {
+            const response = await this.httpClient.get(`/elements/sessions/${encodeURIComponent(id)}`);
+            return handleResponse(response, "Get Elements session");
+        }
+        catch (error) {
+            return handleError(error, "get Elements session");
+        }
+    }
+    /**
+     * Cancels an Elements session that is still waiting for a card
+     *
+     * @summary Cancel an Elements session
+     * @description
+     * Sends POST /elements/sessions/{id}/cancel with no body. A session that is confirming or has
+     * completed comes back unchanged, so check `status` in the result.
+     *
+     * @param id - Session ID, such as "es_test_8Kq2nV0rX4"
+     */
+    async cancelElementsSession(id) {
+        if (!isNonEmptyString(id)) {
+            throw new TapsilatValidationError("Elements session ID is required and must be a non-empty string", { provided: id });
+        }
+        try {
+            const response = await this.httpClient.post(`/elements/sessions/${encodeURIComponent(id)}/cancel`);
+            return handleResponse(response, "Cancel Elements session");
+        }
+        catch (error) {
+            return handleError(error, "cancel Elements session");
+        }
+    }
+    // ORGANIZATION CURRENCIES, USERS AND SUBORGANIZATIONS
+    async listOrganizationCurrencyPresets() {
+        try {
+            const response = await this.httpClient.get("/organization/currency-presets");
+            return handleResponse(response, "List organization currency presets");
+        }
+        catch (error) {
+            return handleError(error, "list organization currency presets");
+        }
+    }
+    /**
+     * Adds a currency to the organization by ISO code, for example "USD"
+     */
+    async createOrganizationCurrency(input) {
+        const currencyCode = typeof input === "string" ? input : input?.currency_code;
+        if (!isNonEmptyString(currencyCode)) {
+            throw new TapsilatValidationError("Currency code is required", {
+                provided: currencyCode,
+            });
+        }
+        try {
+            const response = await this.httpClient.post("/organization/currencies", { currency_code: currencyCode.trim().toUpperCase() });
+            const created = handleResponse(response, "Create organization currency");
+            this.currencyResolver.invalidate();
+            return created;
+        }
+        catch (error) {
+            return handleError(error, "create organization currency");
+        }
+    }
+    /**
+     * Creates an access token for an organization user; expire is in minutes
+     */
+    async createOrganizationUserToken(request) {
+        try {
+            const response = await this.httpClient.post("/organization/user/token", request);
+            return handleResponse(response, "Create organization user token");
+        }
+        catch (error) {
+            return handleError(error, "create organization user token");
+        }
+    }
+    async getSuborganizationDetail(id) {
+        if (!isNonEmptyString(id)) {
+            throw new TapsilatValidationError("Suborganization ID is required and must be a non-empty string", { provided: id });
+        }
+        try {
+            const response = await this.httpClient.get(`/organization/suborganizations/${encodeURIComponent(id)}`);
+            return handleResponse(response, "Get suborganization");
+        }
+        catch (error) {
+            return handleError(error, "get suborganization");
+        }
+    }
+    async getSubmerchantBySuborganization(suborganizationId) {
+        if (!isNonEmptyString(suborganizationId)) {
+            throw new TapsilatValidationError("Suborganization ID is required and must be a non-empty string", { provided: suborganizationId });
+        }
+        try {
+            const response = await this.httpClient.get(`/organization/suborganizations/${encodeURIComponent(suborganizationId)}/submerchant`);
+            return handleResponse(response, "Get submerchant by suborganization");
+        }
+        catch (error) {
+            return handleError(error, "get submerchant by suborganization");
+        }
+    }
+    /**
+     * Returns the organization currency UUID for a unit such as "TRY"; a UUID is returned unchanged.
+     * Most endpoints accept units directly, so this is only needed where a UUID is required.
+     */
+    async resolveCurrencyId(ref) {
+        return this.currencyResolver.resolve(ref);
+    }
     async createSubscription(request) {
         try {
             const subcriptionCreateResponse = await this.httpClient.post("/subscription/create", request);
@@ -3004,25 +3970,6 @@ class TapsilatSDK {
     // ORDER PAYMENTS
     // Summary: Get payments for an order
     // Description: Retrieve a list of payments made for a specific order.
-    /**
-     * Gets payments for an order.
-     * Based on `get_order_payments` from the Python SDK.
-     *
-     * @summary Get order payments
-     * @description Retrieve a list of payments made for a specific order.
-     *
-     * @param request - Order payments request containing order_id
-     * @returns Promise resolving to order payments
-     */
-    async getOrderPayments(request) {
-        try {
-            const response = await this.httpClient.get(`/order/${request.order_id}/payment`);
-            return handleResponse(response, "Get order payments");
-        }
-        catch (error) {
-            return handleError(error, "get order payments");
-        }
-    }
     // ORDER PDF
     // Summary: Download order PDF
     // Description: Download order as a PDF file.
@@ -3037,7 +3984,7 @@ class TapsilatSDK {
      * @returns Promise resolving to a Blob representing the PDF
      */
     async getOrderPdf(id) {
-        const response = await this.httpClient.get(`/order/${id}/pdf`, { responseType: 'blob' });
+        const response = await this.httpClient.get(`/order/${encodeURIComponent(id)}/export/pdf`, { responseType: 'blob' });
         if (!response.success) {
             handleError(response.error, "get order pdf");
         }
@@ -3057,7 +4004,7 @@ class TapsilatSDK {
      * @returns Promise resolving to a Blob representing the Excel file
      */
     async getOrderExcel(id) {
-        const response = await this.httpClient.get(`/order/${id}/excel`, { responseType: 'blob' });
+        const response = await this.httpClient.get(`/order/${encodeURIComponent(id)}/export/excel`, { responseType: 'blob' });
         if (!response.success) {
             handleError(response.error, "get order excel");
         }
@@ -3078,8 +4025,7 @@ class TapsilatSDK {
      */
     async createOrderRefundRequest(request) {
         try {
-            const { reference_id, ...data } = request;
-            const response = await this.httpClient.post(`/order/${reference_id}/refund/request`, data);
+            const response = await this.httpClient.post("/order/refund-request", request);
             return handleResponse(response, "Create order refund request");
         }
         catch (error) {
@@ -3101,8 +4047,7 @@ class TapsilatSDK {
      */
     async addOrderOip(request) {
         try {
-            const { order_id, ...data } = request;
-            const response = await this.httpClient.post(`/order/${order_id}/oip`, data);
+            const response = await this.httpClient.post("/order/oip", request);
             return handleResponse(response, "Add order OIP");
         }
         catch (error) {
@@ -3252,22 +4197,63 @@ class TapsilatSDK {
     // Summary: Create organization user token
     // Description: Creates a token for an organization user.
     /**
-     * Creates an organization user token.
-     * Based on `create_organization_user_token` from the Python SDK.
-     *
-     * @summary Create organization user token
-     * @description Creates a token for an organization user.
-     *
-     * @param request - Token creation payload
-     * @returns Promise resolving to the created token details
+     * Get payments for an order
+     * @deprecated The API has no `/orders/payments` route, so this call always fails.
+     * Use getOrderPayments with an order ID, reference ID or conversation ID.
      */
-    async createOrganizationUserToken(request) {
+    async getAllOrdersPayments() {
         try {
-            const response = await this.httpClient.post(`/organization/user/token`, request);
-            return handleResponse(response, "Create organization user token");
+            const response = await this.httpClient.get("/orders/payments");
+            return handleResponse(response, "Get all orders payments");
         }
         catch (error) {
-            return handleError(error, "create organization user token");
+            return handleError(error, "get all orders payments");
+        }
+    }
+    /**
+     * Get organization partners
+     */
+    async getOrganizationPartners() {
+        try {
+            const response = await this.httpClient.get("/organization/partners");
+            return handleResponse(response, "Get organization partners");
+        }
+        catch (error) {
+            return handleError(error, "get organization partners");
+        }
+    }
+    /**
+     * Get organization limits by ID
+     */
+    async getOrganizationLimitsById(id, params) {
+        if (!isNonEmptyString(id)) {
+            throw new TapsilatValidationError("ID is required and must be a non-empty string");
+        }
+        try {
+            const queryParams = new URLSearchParams();
+            if (params?.currency)
+                queryParams.append("currency", params.currency);
+            if (params?.operation)
+                queryParams.append("operation", params.operation);
+            const queryString = queryParams.toString();
+            const url = `/organization/${encodeURIComponent(id)}/limits${queryString ? `?${queryString}` : ''}`;
+            const response = await this.httpClient.get(url);
+            return handleResponse(response, "Get organization limits by ID");
+        }
+        catch (error) {
+            return handleError(error, "get organization limits by ID");
+        }
+    }
+    /**
+     * Get system config
+     */
+    async getSystemConfig() {
+        try {
+            const response = await this.httpClient.get("/system/config");
+            return handleResponse(response, "Get system config");
+        }
+        catch (error) {
+            return handleError(error, "get system config");
         }
     }
 }
@@ -3290,13 +4276,341 @@ exports.BusinessType = void 0;
     BusinessType[BusinessType["UNKNOWN"] = 4] = "UNKNOWN";
 })(exports.BusinessType || (exports.BusinessType = {}));
 
+/**
+ * Request and response types for Tapsilat Elements sessions.
+ *
+ * Tapsilat Elements is the native Android and iOS card sheet. Your backend creates a session with
+ * its secret API key and hands only the session's `client_secret` to the app, which opens the sheet
+ * with it. Card data goes from the sheet to Tapsilat encrypted and never reaches your backend.
+ *
+ * Field names match the JSON wire format. Response fields are optional because the server omits
+ * empty values. `purpose`, `status` and `brand` are plain strings so that values added later still
+ * decode; compare them with the constants below.
+ */
+/**
+ * @category Elements
+ * @summary Purposes of an Elements session
+ */
+const ElementsSessionPurpose = Object.freeze({
+    /** Save a card for a user without charging it */
+    TOKENIZE: "tokenize",
+    /** Pay an existing order */
+    PAY: "pay",
+});
+/**
+ * @category Elements
+ * @summary Statuses of an Elements session
+ */
+const ElementsSessionStatus = Object.freeze({
+    REQUIRES_PAYMENT_METHOD: "requires_payment_method",
+    PROCESSING: "processing",
+    REQUIRES_ACTION: "requires_action",
+    SUCCEEDED: "succeeded",
+    FAILED: "failed",
+    EXPIRED: "expired",
+    CANCELED: "canceled",
+});
+/**
+ * @category Elements
+ * @summary Tokenize modes of an Elements session
+ */
+const ElementsTokenizeMode = Object.freeze({
+    /** 3D Secure */
+    SECURE: 1,
+    HALF_SECURE: 2,
+    NON_SECURE: 3,
+});
+/**
+ * @category Elements
+ * @summary Card brands an Elements session reports
+ */
+const ElementsCardBrand = Object.freeze({
+    VISA: "visa",
+    MASTERCARD: "mastercard",
+    AMEX: "amex",
+    TROY: "troy",
+    DISCOVER: "discover",
+    UNIONPAY: "unionpay",
+    UNKNOWN: "unknown",
+});
+
+const CODES = {
+    RECEIVED: 1,
+    UNPAID: 2,
+    PAID: 3,
+    PROCESSING: 4,
+    SHIPPED: 5,
+    ON_HOLD: 6,
+    WAITING_FOR_PAYMENT: 7,
+    CANCELLED: 8,
+    COMPLETED: 9,
+    REFUNDED: 10,
+    FRAUD: 11,
+    REJECTED: 12,
+    FAILURE: 13,
+    RETRYING: 14,
+    PARTIALLY_REFUNDED: 15,
+    SUB_MERCHANT_PAYMENT_APPROVED: 16,
+    SUB_MERCHANT_PAYMENT_DISAPPROVED: 17,
+    SUB_MERCHANT_PAYMENT_ERRORED: 18,
+    STILL_HAS_UNPAID_INSTALLMENTS: 19,
+    STILL_HAS_UNPAID_TERMS: 20,
+    EXPIRED: 21,
+    STILL_HAS_UNPAID_SUB_MERCHANT_PAYMENTS: 22,
+    PARTIALLY_PAID: 23,
+    TERMINATED: 24,
+    CARD_TOKENIZATION: 25,
+    PRE_AUTHORIZED: 26,
+    DISPUTED: 27,
+    PARTIALLY_DISPUTED: 28,
+    SUSPECT: 29,
+};
+/** The status names that GET /order/{reference_id}/status returns */
+const NAMES = Object.freeze({
+    [CODES.RECEIVED]: "Received",
+    [CODES.UNPAID]: "Unpaid",
+    [CODES.PAID]: "Paid",
+    [CODES.PROCESSING]: "Processing",
+    [CODES.SHIPPED]: "Shipped",
+    [CODES.ON_HOLD]: "On hold",
+    [CODES.WAITING_FOR_PAYMENT]: "Waiting for payment",
+    [CODES.CANCELLED]: "Cancelled",
+    [CODES.COMPLETED]: "Completed",
+    [CODES.REFUNDED]: "Refunded",
+    [CODES.FRAUD]: "Fraud",
+    [CODES.REJECTED]: "Rejected",
+    [CODES.FAILURE]: "Failure",
+    [CODES.RETRYING]: "Retrying",
+    [CODES.PARTIALLY_REFUNDED]: "Partially refunded",
+    [CODES.SUB_MERCHANT_PAYMENT_APPROVED]: "Sub merchant payment approved",
+    [CODES.SUB_MERCHANT_PAYMENT_DISAPPROVED]: "Sub merchant payment disapproved",
+    [CODES.SUB_MERCHANT_PAYMENT_ERRORED]: "Sub merchant payment errored",
+    [CODES.STILL_HAS_UNPAID_INSTALLMENTS]: "Still has unpaid installments",
+    [CODES.STILL_HAS_UNPAID_TERMS]: "Still has unpaid terms",
+    [CODES.EXPIRED]: "Expired",
+    [CODES.STILL_HAS_UNPAID_SUB_MERCHANT_PAYMENTS]: "Still has unpaid sub merchant payments",
+    [CODES.PARTIALLY_PAID]: "Partially Paid",
+    [CODES.TERMINATED]: "Terminated",
+    [CODES.CARD_TOKENIZATION]: "Card Tokenization",
+    [CODES.PRE_AUTHORIZED]: "Pre Authorized",
+    [CODES.DISPUTED]: "Disputed",
+    [CODES.PARTIALLY_DISPUTED]: "Partially disputed",
+    [CODES.SUSPECT]: "Suspect",
+});
+/** Statuses of an order whose payment was captured */
+const PAID_STATUSES = Object.freeze([
+    CODES.PAID,
+    CODES.COMPLETED,
+    CODES.SUB_MERCHANT_PAYMENT_APPROVED,
+]);
+/** Statuses of an order that will not be paid */
+const FAILED_STATUSES = Object.freeze([
+    CODES.CANCELLED,
+    CODES.FRAUD,
+    CODES.REJECTED,
+    CODES.FAILURE,
+    CODES.EXPIRED,
+    CODES.TERMINATED,
+]);
+/** Statuses of an order whose payment was refunded in full or in part */
+const REFUNDED_STATUSES = Object.freeze([CODES.REFUNDED, CODES.PARTIALLY_REFUNDED]);
+const isCode = (value) => Object.prototype.hasOwnProperty.call(NAMES, value);
+/**
+ * Returns the status code for a code, a numeric string such as order_lite callbacks send, or a status
+ * name such as "Paid" (case-insensitive), or null when the value is not a status
+ */
+const code = (status) => {
+    if (typeof status === "number") {
+        return Number.isInteger(status) && isCode(status) ? status : null;
+    }
+    if (typeof status !== "string") {
+        return null;
+    }
+    const trimmed = status.trim();
+    if (/^[0-9]+$/.test(trimmed)) {
+        return code(Number(trimmed));
+    }
+    const lower = trimmed.toLowerCase();
+    for (const [value, label] of Object.entries(NAMES)) {
+        if (label.toLowerCase() === lower) {
+            return Number(value);
+        }
+    }
+    return null;
+};
+/** Returns the status name, such as "Paid", or null when the value is not a status */
+const name = (status) => {
+    const statusCode = code(status);
+    return statusCode === null ? null : NAMES[statusCode];
+};
+const inGroup = (group, status) => {
+    const statusCode = code(status);
+    return statusCode !== null && group.includes(statusCode);
+};
+/**
+ * @category Order Management
+ * @summary Order status codes, their names and the paid, failed and refunded groups
+ * @description
+ * The numeric codes that callbacks and order details carry, and the names that
+ * GET /order/{reference_id}/status returns for them. Every helper accepts a code, a numeric string or
+ * a name.
+ *
+ * @example
+ * ```typescript
+ * const { status } = await tapsilat.getOrderStatus(referenceId); // e.g. "Waiting for payment"
+ * OrderStatus.isPaid(status); // Paid, Completed, Sub merchant payment approved
+ * OrderStatus.code(status); // 7; also accepts "7" or 7
+ * ```
+ */
+const OrderStatus = Object.freeze({
+    ...CODES,
+    NAMES,
+    PAID_STATUSES,
+    FAILED_STATUSES,
+    REFUNDED_STATUSES,
+    /** The code for a code, a numeric string or a name (case-insensitive), or null */
+    code,
+    /** The status name, such as "Paid", or null */
+    name,
+    /** Paid, Completed or Sub merchant payment approved */
+    isPaid: (status) => inGroup(PAID_STATUSES, status),
+    /** Cancelled, Fraud, Rejected, Failure, Expired or Terminated */
+    isFailed: (status) => inGroup(FAILED_STATUSES, status),
+    /** Refunded or Partially refunded */
+    isRefunded: (status) => inGroup(REFUNDED_STATUSES, status),
+});
+
+const ZERO_UUID = "00000000-0000-0000-0000-000000000000";
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const firstString = (values) => {
+    for (const value of values) {
+        if (typeof value === "string" && value !== "" && value !== ZERO_UUID) {
+            return value;
+        }
+        if (typeof value === "number" && Number.isSafeInteger(value)) {
+            return String(value);
+        }
+    }
+    return null;
+};
+/**
+ * @category Webhooks
+ * @summary A callback Tapsilat posts to an organization's callback URLs
+ * @description
+ * Tapsilat posts {"type": "...", "data": {...}, "token": "<delivery id>"} to the organization's callback
+ * URLs and to an order's payment_success_url and payment_failure_url. The shape of "data" depends on the
+ * type, which each organization chooses in the panel: "order_lite" (the default), "order",
+ * "order_payment_detail", "extended_order" or "payment_facilitator". The getters read the order's
+ * reference ID, conversation ID and status from whichever shape arrived.
+ *
+ * Verify the Tapsilat-Signature header with `verifyWebhook()` before trusting a callback.
+ *
+ * @example
+ * ```typescript
+ * const event = WebhookEvent.fromPayload(rawBody);
+ * if (event.isPaid()) {
+ *   await fulfil(event.referenceId);
+ * }
+ * ```
+ */
+class WebhookEvent {
+    static TYPE_ORDER = "order";
+    static TYPE_ORDER_LITE = "order_lite";
+    static TYPE_ORDER_PAYMENT_DETAIL = "order_payment_detail";
+    static TYPE_EXTENDED_ORDER = "extended_order";
+    static TYPE_PAYMENT_FACILITATOR = "payment_facilitator";
+    /** The callback type, such as "order_lite" */
+    type;
+    /** Unique per delivery */
+    token;
+    /** The callback's "data" object, or the whole payload when it has none */
+    data;
+    /** The decoded payload */
+    payload;
+    constructor(payload) {
+        this.payload = payload;
+        this.type = typeof payload.type === "string" ? payload.type : null;
+        this.token = typeof payload.token === "string" ? payload.token : null;
+        this.data = isObject(payload.data) ? payload.data : payload;
+    }
+    /**
+     * Decodes a raw callback body
+     *
+     * @param payload - The raw request body
+     * @throws {TapsilatValidationError} When the body is not a JSON object
+     */
+    static fromPayload(payload) {
+        const body = typeof payload === "string" ? payload : new TextDecoder().decode(payload);
+        let decoded;
+        try {
+            decoded = JSON.parse(body);
+        }
+        catch {
+            decoded = undefined;
+        }
+        if (!isObject(decoded)) {
+            throw new TapsilatValidationError("The webhook payload is not a JSON object");
+        }
+        return new WebhookEvent(decoded);
+    }
+    /** The order's reference ID */
+    get referenceId() {
+        const order = isObject(this.data.order) ? this.data.order : {};
+        return firstString([
+            this.data.orderReferenceId,
+            this.data.order_reference_id,
+            this.data.reference_id,
+            order.reference_id,
+        ]);
+    }
+    /** The conversation ID the order was created with */
+    get conversationId() {
+        return firstString([this.data.conversationId, this.data.conversation_id]);
+    }
+    /** The order status code (see OrderStatus), or null when this callback type carries none */
+    get statusCode() {
+        const code = OrderStatus.code(this.data.status);
+        if (code === null && isObject(this.data.order)) {
+            return OrderStatus.code(this.data.order.status);
+        }
+        return code;
+    }
+    /** The order status name, such as "Paid" */
+    get status() {
+        return OrderStatus.name(this.statusCode);
+    }
+    isPaid() {
+        return OrderStatus.isPaid(this.statusCode);
+    }
+    isFailed() {
+        return OrderStatus.isFailed(this.statusCode);
+    }
+    isRefunded() {
+        return OrderStatus.isRefunded(this.statusCode);
+    }
+}
+
 exports.ConfigManager = ConfigManager;
+exports.CurrencyResolver = CurrencyResolver;
+exports.ElementsCardBrand = ElementsCardBrand;
+exports.ElementsSessionPurpose = ElementsSessionPurpose;
+exports.ElementsSessionStatus = ElementsSessionStatus;
+exports.ElementsTokenizeMode = ElementsTokenizeMode;
+exports.MarketplaceService = MarketplaceService;
+exports.OrderStatus = OrderStatus;
+exports.SubmerchantService = SubmerchantService;
 exports.TapsilatAuthenticationError = TapsilatAuthenticationError;
 exports.TapsilatError = TapsilatError;
 exports.TapsilatNetworkError = TapsilatNetworkError;
 exports.TapsilatRateLimitError = TapsilatRateLimitError;
 exports.TapsilatSDK = TapsilatSDK;
 exports.TapsilatValidationError = TapsilatValidationError;
+exports.TokenizationService = TokenizationService;
+exports.VposService = VposService;
+exports.WEBHOOK_SIGNATURE_HEADER = WEBHOOK_SIGNATURE_HEADER;
+exports.WEBHOOK_TOLERANCE = WEBHOOK_TOLERANCE;
+exports.WebhookEvent = WebhookEvent;
+exports.cleanGsmNumber = cleanGsmNumber;
 exports.isValidCurrency = isValidCurrency;
 exports.isValidPaymentMethod = isValidPaymentMethod;
 exports.isValidUrl = isValidUrl;