@baziapi/sdk 1.0.0

package/dist/index.mjs

@@ -0,0 +1,793 @@
+class BaziError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = this.constructor.name;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+}
+
+var __defProp$5 = Object.defineProperty;
+var __defNormalProp$5 = (obj, key, value) => key in obj ? __defProp$5(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$5 = (obj, key, value) => __defNormalProp$5(obj, typeof key !== "symbol" ? key + "" : key, value);
+class ApiError extends BaziError {
+  constructor(statusCode, message, errors, requestId, retryAfter) {
+    super(message);
+    __publicField$5(this, "kind", "api_error");
+    /** HTTP status code returned by the server. */
+    __publicField$5(this, "statusCode");
+    /** Detailed server-side validation errors, if any. */
+    __publicField$5(this, "errors");
+    /** Request ID from the `X-Request-ID` response header, if present. */
+    __publicField$5(this, "requestId");
+    /**
+     * Raw `Retry-After` header value from the server response.
+     * Used internally by the retry layer — not intended for consumer use.
+     * @internal
+     */
+    __publicField$5(this, "_retryAfter");
+    this.statusCode = statusCode;
+    this.errors = errors;
+    this.requestId = requestId;
+    this._retryAfter = retryAfter ?? null;
+  }
+}
+class ValidationError extends BaziError {
+  constructor(field, message) {
+    super(message);
+    __publicField$5(this, "kind", "validation_error");
+    /** The name of the field that failed validation. */
+    __publicField$5(this, "field");
+    this.field = field;
+  }
+}
+class TimeoutError extends BaziError {
+  constructor(timeoutMs) {
+    super(`Request timed out after ${timeoutMs}ms`);
+    __publicField$5(this, "kind", "timeout_error");
+    /** The configured timeout in milliseconds. */
+    __publicField$5(this, "timeoutMs");
+    this.timeoutMs = timeoutMs;
+  }
+}
+class NetworkError extends BaziError {
+  constructor(cause) {
+    const message = cause instanceof Error ? `Network error: ${cause.message}` : "Network error: unknown failure";
+    super(message);
+    __publicField$5(this, "kind", "network_error");
+    /** The original error thrown by `fetch()`. */
+    __publicField$5(this, "cause");
+    this.cause = cause;
+  }
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+const RETRYABLE_STATUS_CODES = /* @__PURE__ */ new Set([429, 500, 502, 503, 504]);
+const NON_RETRYABLE_STATUS_CODES = /* @__PURE__ */ new Set([400, 401, 403, 404, 409, 422]);
+function isRetryableStatus(statusCode) {
+  if (NON_RETRYABLE_STATUS_CODES.has(statusCode)) return false;
+  return RETRYABLE_STATUS_CODES.has(statusCode);
+}
+function computeBackoffDelay(attemptIndex, retryDelay, retryAfterMs) {
+  const backoff = retryDelay * 2 ** attemptIndex;
+  return retryAfterMs !== void 0 ? Math.max(backoff, retryAfterMs) : backoff;
+}
+function parseRetryAfterMs(value) {
+  if (value === null) return void 0;
+  const seconds = Number(value);
+  if (!Number.isNaN(seconds)) return seconds * 1e3;
+  const date = new Date(value);
+  if (!Number.isNaN(date.getTime())) {
+    return Math.max(0, date.getTime() - Date.now());
+  }
+  return void 0;
+}
+
+var __defProp$4 = Object.defineProperty;
+var __defNormalProp$4 = (obj, key, value) => key in obj ? __defProp$4(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$4 = (obj, key, value) => __defNormalProp$4(obj, key + "" , value);
+class HttpClient {
+  constructor(config) {
+    __publicField$4(this, "config");
+    this.config = config;
+  }
+  /**
+   * Performs a GET request.
+   * @param path - URL path relative to baseUrl.
+   * @param bearerToken - Optional JWT bearer token.
+   */
+  async get(path, bearerToken) {
+    return this.request({
+      method: "GET",
+      path,
+      authenticated: true,
+      ...bearerToken !== void 0 ? { bearerToken } : {}
+    });
+  }
+  /**
+   * Performs a POST request.
+   * @param path - URL path relative to baseUrl.
+   * @param body - JSON request body.
+   * @param bearerToken - Optional JWT bearer token.
+   */
+  async post(path, body, bearerToken) {
+    return this.request({
+      method: "POST",
+      path,
+      authenticated: true,
+      ...body !== void 0 ? { body } : {},
+      ...bearerToken !== void 0 ? { bearerToken } : {}
+    });
+  }
+  /**
+   * Performs a PATCH request.
+   * @param path - URL path relative to baseUrl.
+   * @param body - JSON request body.
+   * @param bearerToken - Optional JWT bearer token.
+   */
+  async patch(path, body, bearerToken) {
+    return this.request({
+      method: "PATCH",
+      path,
+      authenticated: true,
+      ...body !== void 0 ? { body } : {},
+      ...bearerToken !== void 0 ? { bearerToken } : {}
+    });
+  }
+  /**
+   * Performs a DELETE request.
+   * @param path - URL path relative to baseUrl.
+   * @param bearerToken - Optional JWT bearer token.
+   */
+  async delete(path, bearerToken) {
+    return this.request({
+      method: "DELETE",
+      path,
+      authenticated: true,
+      ...bearerToken !== void 0 ? { bearerToken } : {}
+    });
+  }
+  buildHeaders(options) {
+    const headers = {
+      "Content-Type": "application/json",
+      Accept: "application/json"
+    };
+    if (this.config.apiKey) {
+      headers["x-api-key"] = this.config.apiKey;
+    }
+    if (options.authenticated) {
+      const token = options.bearerToken ?? this.config.apiKey;
+      if (token) {
+        headers["Authorization"] = `Bearer ${token}`;
+      }
+    }
+    return headers;
+  }
+  buildUrl(path) {
+    const base = this.config.baseUrl.replace(/\/$/, "");
+    return `${base}${path}`;
+  }
+  async executeRequest(options) {
+    const url = this.buildUrl(options.path);
+    const headers = this.buildHeaders(options);
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), this.config.timeout);
+    let response;
+    try {
+      const fetchBody = options.body !== void 0 ? JSON.stringify(options.body) : null;
+      response = await fetch(url, {
+        method: options.method,
+        headers,
+        body: fetchBody,
+        signal: controller.signal
+      });
+    } catch (error) {
+      if (error instanceof Error && error.name === "AbortError") {
+        throw new TimeoutError(this.config.timeout);
+      }
+      throw new NetworkError(error);
+    } finally {
+      clearTimeout(timeoutId);
+    }
+    const requestId = response.headers.get("x-request-id") ?? void 0;
+    const retryAfter = response.headers.get("retry-after");
+    if (!response.ok) {
+      let body = {};
+      try {
+        body = await response.json();
+      } catch {
+      }
+      const apiError = new ApiError(
+        response.status,
+        typeof body.message === "string" ? body.message : `HTTP ${response.status}`,
+        Array.isArray(body["errors"]) ? body["errors"] : void 0,
+        requestId,
+        retryAfter
+      );
+      this.config.onError?.(apiError);
+      throw apiError;
+    }
+    const json = await response.json();
+    return json.data;
+  }
+  async request(options) {
+    let lastError;
+    for (let attempt = 0; attempt <= this.config.retries; attempt++) {
+      try {
+        return await this.executeRequest(options);
+      } catch (error) {
+        lastError = error;
+        const shouldRetry = (() => {
+          if (error instanceof ApiError) return isRetryableStatus(error.statusCode);
+          if (error instanceof NetworkError) return true;
+          return false;
+        })();
+        if (!shouldRetry || attempt >= this.config.retries) break;
+        const retryAfterMs = (() => {
+          if (error instanceof ApiError) {
+            return parseRetryAfterMs(error._retryAfter);
+          }
+          return void 0;
+        })();
+        const delay = computeBackoffDelay(attempt, this.config.retryDelay, retryAfterMs);
+        await sleep(delay);
+      }
+    }
+    throw lastError;
+  }
+}
+
+const DATE_REGEX = /^\d{4}-\d{2}-\d{2}$/;
+const TIME_REGEX = /^\d{2}:\d{2}$/;
+const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function assertRequired(field, value) {
+  if (value === void 0 || value === null || value === "") {
+    throw new ValidationError(field, `${field} is required`);
+  }
+}
+function assertString(field, value) {
+  if (typeof value !== "string") {
+    throw new ValidationError(field, `${field} must be a string`);
+  }
+}
+function assertMinLength(field, value, min) {
+  if (value.length < min) {
+    throw new ValidationError(field, `${field} must be at least ${min} characters`);
+  }
+}
+function assertExactLength(field, value, length) {
+  if (value.length !== length) {
+    throw new ValidationError(field, `${field} must be exactly ${length} characters`);
+  }
+}
+function assertPattern(field, value, pattern, hint) {
+  if (!pattern.test(value)) {
+    throw new ValidationError(field, `${field} ${hint}`);
+  }
+}
+function assertEnum(field, value, allowed) {
+  if (!allowed.includes(value)) {
+    throw new ValidationError(field, `${field} must be one of: ${allowed.join(", ")}`);
+  }
+}
+function assertCalendarDate(field, value) {
+  const [yearStr, monthStr, dayStr] = value.split("-");
+  const year = Number(yearStr);
+  const month = Number(monthStr);
+  const day = Number(dayStr);
+  const date = new Date(year, month - 1, day);
+  if (date.getFullYear() !== year || date.getMonth() + 1 !== month || date.getDate() !== day) {
+    throw new ValidationError(field, `${field} is not a valid calendar date`);
+  }
+}
+function validateBaziRequest(input) {
+  assertRequired("birthDate", input.birthDate);
+  assertString("birthDate", input.birthDate);
+  assertPattern("birthDate", input.birthDate, DATE_REGEX, "must be in YYYY-MM-DD format");
+  assertCalendarDate("birthDate", input.birthDate);
+  if (input.birthTime !== void 0 && input.birthTime !== "") {
+    assertString("birthTime", input.birthTime);
+    assertPattern("birthTime", input.birthTime, TIME_REGEX, "must be in HH:mm format");
+  }
+  assertRequired("gender", input.gender);
+  assertEnum("gender", input.gender, ["male", "female"]);
+  if (input.timezone !== void 0) {
+    assertString("timezone", input.timezone);
+  }
+  if (input.language !== void 0) {
+    assertEnum("language", input.language, ["en", "zh"]);
+  }
+}
+function validateRegisterRequest(input) {
+  assertRequired("name", input.name);
+  assertString("name", input.name);
+  assertRequired("email", input.email);
+  assertString("email", input.email);
+  assertPattern("email", input.email, EMAIL_REGEX, "must be a valid email address");
+  assertRequired("password", input.password);
+  assertString("password", input.password);
+  assertMinLength("password", input.password, 6);
+  if (input.country !== void 0) {
+    assertString("country", input.country);
+  }
+}
+function validateLoginRequest(input) {
+  assertRequired("email", input.email);
+  assertString("email", input.email);
+  assertPattern("email", input.email, EMAIL_REGEX, "must be a valid email address");
+  assertRequired("password", input.password);
+  assertString("password", input.password);
+}
+function validateVerifyEmailRequest(input) {
+  assertRequired("email", input.email);
+  assertString("email", input.email);
+  assertPattern("email", input.email, EMAIL_REGEX, "must be a valid email address");
+  assertRequired("otp", input.otp);
+  assertString("otp", input.otp);
+  assertExactLength("otp", input.otp, 6);
+}
+function validateForgotPasswordRequest(input) {
+  assertRequired("email", input.email);
+  assertString("email", input.email);
+  assertPattern("email", input.email, EMAIL_REGEX, "must be a valid email address");
+}
+function validateResetPasswordRequest(input) {
+  assertRequired("email", input.email);
+  assertString("email", input.email);
+  assertPattern("email", input.email, EMAIL_REGEX, "must be a valid email address");
+  assertRequired("otp", input.otp);
+  assertString("otp", input.otp);
+  assertExactLength("otp", input.otp, 6);
+  assertRequired("newPassword", input.newPassword);
+  assertString("newPassword", input.newPassword);
+  assertMinLength("newPassword", input.newPassword, 6);
+}
+function validateChangePasswordRequest(input) {
+  assertRequired("oldPassword", input.oldPassword);
+  assertString("oldPassword", input.oldPassword);
+  assertRequired("newPassword", input.newPassword);
+  assertString("newPassword", input.newPassword);
+  assertMinLength("newPassword", input.newPassword, 6);
+}
+
+const API_VERSION = "v1";
+
+var __defProp$3 = Object.defineProperty;
+var __defNormalProp$3 = (obj, key, value) => key in obj ? __defProp$3(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$3 = (obj, key, value) => __defNormalProp$3(obj, key + "" , value);
+class BaziResource {
+  /** @internal */
+  constructor(http) {
+    __publicField$3(this, "http");
+    this.http = http;
+  }
+  /**
+   * Calculate BaZi (Four Pillars of Destiny) for a given birth date and time.
+   *
+   * Validates input client-side before sending the request.
+   * Requires an API key set on the client.
+   *
+   * @param input - The birth information required for calculation.
+   * @returns A promise resolving to the full BaZi analysis result.
+   *
+   * @throws {ValidationError} If the input fails client-side validation.
+   * @throws {ApiError} If the server rejects the request (4xx/5xx).
+   * @throws {TimeoutError} If the request exceeds the configured timeout.
+   * @throws {NetworkError} If a network-level failure occurs.
+   *
+   * @example
+   * ```typescript
+   * const result = await client.bazi.calculate({
+   *   birthDate: '1998-08-12',
+   *   birthTime: '10:30',
+   *   gender: 'male',
+   *   timezone: 'Asia/Dhaka',
+   *   language: 'en',
+   * });
+   *
+   * console.log(result.pillars);
+   * console.log(result.luckPillars?.pillars);
+   * ```
+   */
+  async calculate(input) {
+    validateBaziRequest(input);
+    return this.http.post(`/api/${API_VERSION}/bazi/calculate`, input);
+  }
+}
+
+var __defProp$2 = Object.defineProperty;
+var __defNormalProp$2 = (obj, key, value) => key in obj ? __defProp$2(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$2 = (obj, key, value) => __defNormalProp$2(obj, key + "" , value);
+const AUTH_BASE = `/api/${API_VERSION}/auth`;
+class AuthResource {
+  /** @internal */
+  constructor(http) {
+    __publicField$2(this, "http");
+    this.http = http;
+  }
+  /**
+   * Register a new user account.
+   *
+   * @param input - Registration data including name, email, and password.
+   * @returns A promise resolving to `null` on success (email verification required).
+   *
+   * @throws {ValidationError} If input is invalid.
+   * @throws {ApiError} If the email is already registered (409).
+   *
+   * @example
+   * ```typescript
+   * await client.auth.register({
+   *   name: 'Jane Doe',
+   *   email: 'jane@example.com',
+   *   password: 'secret123',
+   * });
+   * ```
+   */
+  async register(input) {
+    validateRegisterRequest(input);
+    return this.http.post(`${AUTH_BASE}/register`, input);
+  }
+  /**
+   * Verify an email address using the OTP sent during registration.
+   *
+   * @param input - Email address and 6-digit OTP.
+   * @returns A promise resolving to `null` on success.
+   *
+   * @throws {ValidationError} If input is invalid.
+   * @throws {ApiError} If OTP is incorrect or expired (400).
+   */
+  async verifyEmail(input) {
+    validateVerifyEmailRequest(input);
+    return this.http.post(`${AUTH_BASE}/verify-email`, input);
+  }
+  /**
+   * Log in with email and password.
+   *
+   * @param input - Email and password credentials.
+   * @returns A promise resolving to access token, refresh token, and user data.
+   *
+   * @throws {ValidationError} If input is invalid.
+   * @throws {ApiError} If credentials are incorrect (401).
+   *
+   * @example
+   * ```typescript
+   * const { accessToken, user } = await client.auth.login({
+   *   email: 'jane@example.com',
+   *   password: 'secret123',
+   * });
+   * ```
+   */
+  async login(input) {
+    validateLoginRequest(input);
+    return this.http.post(`${AUTH_BASE}/login`, input);
+  }
+  /**
+   * Refresh an expired access token using a valid refresh token.
+   *
+   * @param refreshToken - A valid refresh token previously issued by `login()`.
+   * @returns A promise resolving to a new access token.
+   *
+   * @throws {ApiError} If the refresh token is invalid or expired (401).
+   */
+  async refreshToken(refreshToken) {
+    return this.http.post(
+      `${AUTH_BASE}/refresh-token`,
+      void 0,
+      refreshToken
+    );
+  }
+  /**
+   * Initiate a password reset flow by requesting an OTP via email.
+   *
+   * @param input - Email address of the account to reset.
+   * @returns A promise resolving to `null` on success.
+   *
+   * @throws {ValidationError} If the email is invalid.
+   * @throws {ApiError} If the email is not registered (404).
+   */
+  async forgotPassword(input) {
+    validateForgotPasswordRequest(input);
+    return this.http.post(`${AUTH_BASE}/forgot-password`, input);
+  }
+  /**
+   * Complete a password reset using the OTP received via email.
+   *
+   * @param input - Email, OTP, and new password.
+   * @returns A promise resolving to `null` on success.
+   *
+   * @throws {ValidationError} If input is invalid.
+   * @throws {ApiError} If OTP is incorrect or expired (400).
+   */
+  async resetPassword(input) {
+    validateResetPasswordRequest(input);
+    return this.http.post(`${AUTH_BASE}/reset-password`, input);
+  }
+  /**
+   * Change the authenticated user's password.
+   * Requires a valid JWT access token.
+   *
+   * @param input - Old password and new password.
+   * @param bearerToken - Valid JWT access token from `login()`.
+   * @returns A promise resolving to `null` on success.
+   *
+   * @throws {ValidationError} If input is invalid.
+   * @throws {ApiError} If old password is incorrect (401) or token is invalid.
+   */
+  async changePassword(input, bearerToken) {
+    validateChangePasswordRequest(input);
+    return this.http.post(`${AUTH_BASE}/change-password`, input, bearerToken);
+  }
+  /**
+   * Retrieve the authenticated user's profile.
+   * Requires a valid JWT access token.
+   *
+   * @param bearerToken - Valid JWT access token from `login()`.
+   * @returns A promise resolving to the user profile.
+   *
+   * @throws {ApiError} If the token is invalid or expired (401).
+   *
+   * @example
+   * ```typescript
+   * const profile = await client.auth.me(accessToken);
+   * console.log(profile.email);
+   * ```
+   */
+  async me(bearerToken) {
+    return this.http.get(`${AUTH_BASE}/me`, bearerToken);
+  }
+  /**
+   * Log out the authenticated user, invalidating their session.
+   * Requires a valid JWT access token.
+   *
+   * @param bearerToken - Valid JWT access token from `login()`.
+   * @returns A promise resolving to `null` on success.
+   *
+   * @throws {ApiError} If the token is invalid or expired (401).
+   */
+  async logout(bearerToken) {
+    return this.http.post(`${AUTH_BASE}/logout`, void 0, bearerToken);
+  }
+}
+
+var __defProp$1 = Object.defineProperty;
+var __defNormalProp$1 = (obj, key, value) => key in obj ? __defProp$1(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$1 = (obj, key, value) => __defNormalProp$1(obj, key + "" , value);
+const API_KEY_BASE = `/api/${API_VERSION}/api-keys`;
+class ApiKeyResource {
+  /** @internal */
+  constructor(http) {
+    __publicField$1(this, "http");
+    this.http = http;
+  }
+  /**
+   * List all API keys associated with the authenticated user's account.
+   * Only the key prefix is returned — not the full raw key.
+   *
+   * @param bearerToken - Valid JWT access token from `client.auth.login()`.
+   * @returns A promise resolving to an array of API key metadata.
+   *
+   * @throws {ApiError} If the token is invalid or expired (401).
+   *
+   * @example
+   * ```typescript
+   * const keys = await client.apiKeys.list(accessToken);
+   * keys.forEach(key => console.log(key.prefix, key.isActive));
+   * ```
+   */
+  async list(bearerToken) {
+    return this.http.get(API_KEY_BASE, bearerToken);
+  }
+  /**
+   * Generate a new API key for the authenticated user.
+   *
+   * **Important:** The full raw key is returned only once in this response.
+   * Store it securely — it cannot be retrieved again.
+   *
+   * @param bearerToken - Valid JWT access token from `client.auth.login()`.
+   * @returns A promise resolving to the newly created API key including the full raw key.
+   *
+   * @throws {ApiError} If the token is invalid or the user's plan limit is reached.
+   *
+   * @example
+   * ```typescript
+   * const { key, prefix } = await client.apiKeys.create(accessToken);
+   * // Store `key` securely — it won't be shown again
+   * console.log('Your API key:', key);
+   * ```
+   */
+  async create(bearerToken) {
+    return this.http.post(`${API_KEY_BASE}/generate`, void 0, bearerToken);
+  }
+  /**
+   * Revoke (deactivate) an API key by its ID.
+   * Revoked keys are permanently disabled and cannot be re-activated.
+   *
+   * @param keyId - The ID of the API key to revoke.
+   * @param bearerToken - Valid JWT access token from `client.auth.login()`.
+   * @returns A promise resolving to the revoked API key metadata.
+   *
+   * @throws {ApiError} If the key is not found (404) or doesn't belong to the user (403).
+   *
+   * @example
+   * ```typescript
+   * await client.apiKeys.revoke(keyId, accessToken);
+   * ```
+   */
+  async revoke(keyId, bearerToken) {
+    return this.http.patch(`${API_KEY_BASE}/${keyId}/revoke`, void 0, bearerToken);
+  }
+}
+
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  let result = 0;
+  for (let i = 0; i < a.length; i++) {
+    result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return result === 0;
+}
+function toUint8Array(data) {
+  if (typeof data === "string") {
+    return new TextEncoder().encode(data);
+  }
+  return data;
+}
+function bufferToHex(buffer) {
+  const byteArray = new Uint8Array(buffer);
+  let hex = "";
+  for (const byte of byteArray) {
+    hex += byte.toString(16).padStart(2, "0");
+  }
+  return hex;
+}
+class WebhookService {
+  /**
+   * Verifies an incoming webhook HMAC-SHA256 signature.
+   *
+   * @param options - Verification options including payload, signature, and secret.
+   * @returns `true` if the signature is valid; `false` otherwise.
+   *
+   * @example
+   * ```typescript
+   * import { BaziClient } from '@bazi/sdk';
+   *
+   * const client = new BaziClient();
+   * const isValid = await client.webhooks.verifySignature({
+   *   payload: rawBody,
+   *   signature: req.headers['x-bazi-signature'],
+   *   secret: process.env.BAZI_WEBHOOK_SECRET!,
+   * });
+   *
+   * if (!isValid) {
+   *   return res.status(401).send('Invalid signature');
+   * }
+   * ```
+   */
+  async verifySignature(options) {
+    const { payload, signature, secret } = options;
+    if (!payload || !signature || !secret) {
+      return false;
+    }
+    try {
+      const cleanSignature = signature.trim().toLowerCase();
+      const expectedSignature = await this.computeHmac(payload, secret);
+      return constantTimeEqual(cleanSignature, expectedSignature.toLowerCase());
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Computes an HMAC-SHA256 digest in hex string format using Web Crypto API.
+   *
+   * @param payload - Raw request payload.
+   * @param secret - Secret key.
+   * @returns Hexadecimal digest string.
+   */
+  async computeHmac(payload, secret) {
+    const encoder = new TextEncoder();
+    const keyData = encoder.encode(secret);
+    const dataBytes = toUint8Array(payload);
+    const cryptoSubtle = globalThis.crypto?.subtle;
+    if (!cryptoSubtle) {
+      throw new Error(
+        "Crypto API is not available in the current environment. Ensure Node.js 18+ or an environment with Web Crypto API support."
+      );
+    }
+    const cryptoKey = await cryptoSubtle.importKey(
+      "raw",
+      keyData,
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["sign"]
+    );
+    const signatureBuffer = await cryptoSubtle.sign(
+      "HMAC",
+      cryptoKey,
+      dataBytes
+    );
+    return bufferToHex(signatureBuffer);
+  }
+}
+async function verifyWebhookSignature(options) {
+  const service = new WebhookService();
+  return service.verifySignature(options);
+}
+
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+const DEFAULT_BASE_URL = "https://api.bazi.dev";
+const DEFAULT_TIMEOUT = 1e4;
+const DEFAULT_RETRIES = 3;
+const DEFAULT_RETRY_DELAY = 500;
+class BaziClient {
+  /**
+   * Creates a new BaziClient instance.
+   *
+   * @param options - Client configuration options.
+   *
+   * @example
+   * ```typescript
+   * // Production usage
+   * const client = new BaziClient({ apiKey: 'bazi_xxxx' });
+   *
+   * // Development / self-hosted
+   * const client = new BaziClient({
+   *   apiKey: 'bazi_xxxx',
+   *   baseUrl: 'http://localhost:5000',
+   *   timeout: 30_000,
+   *   retries: 1,
+   * });
+   * ```
+   */
+  constructor(options = {}) {
+    __publicField(this, "httpClient");
+    /**
+     * BaZi calculation resource.
+     * Endpoint: `POST /api/v1/bazi/calculate`
+     */
+    __publicField(this, "bazi");
+    /**
+     * Authentication resource.
+     * Endpoints: register, login, logout, verifyEmail, forgotPassword, resetPassword, changePassword, me
+     */
+    __publicField(this, "auth");
+    /**
+     * API Key management resource.
+     * Endpoints: list, create, revoke
+     */
+    __publicField(this, "apiKeys");
+    /**
+     * Webhook utilities for verifying HMAC-SHA256 signatures.
+     */
+    __publicField(this, "webhooks");
+    this.httpClient = new HttpClient({
+      baseUrl: options.baseUrl ?? DEFAULT_BASE_URL,
+      apiKey: options.apiKey ?? "",
+      timeout: options.timeout ?? DEFAULT_TIMEOUT,
+      retries: options.retries ?? DEFAULT_RETRIES,
+      retryDelay: options.retryDelay ?? DEFAULT_RETRY_DELAY,
+      onError: options.onError
+    });
+    this.bazi = new BaziResource(this.httpClient);
+    this.auth = new AuthResource(this.httpClient);
+    this.apiKeys = new ApiKeyResource(this.httpClient);
+    this.webhooks = new WebhookService();
+  }
+  /**
+   * Direct convenience method to calculate BaZi (Four Pillars of Destiny).
+   * Shortcut for `client.bazi.calculate(input)`.
+   *
+   * @param input - The birth information required for calculation.
+   * @returns A promise resolving to the full BaZi analysis result.
+   */
+  async calculate(input) {
+    return this.bazi.calculate(input);
+  }
+}
+
+export { API_VERSION, ApiError, BaziClient, BaziError, NetworkError, TimeoutError, ValidationError, WebhookService, verifyWebhookSignature };