@bizjaya/finclient 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 BizJaya TechLab S/B
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,50 @@
-# Temporary Holding Version
+# @bizjaya/finclient
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The official TypeScript SDK for FinCopy's public `/v1` API. It supports Node.js 18 and later, with ESM and CommonJS builds.
+
+```sh
+npm install @bizjaya/finclient
+```
+
+```ts
+import { FinClient } from "@bizjaya/finclient";
+
+const fin = new FinClient({ apiKey: process.env.FINCOPY_API_KEY! });
+const accounts = await fin.copy.accounts.list();
+for (const account of accounts) console.log(account.Fleet?.Account?.Id, account.Fleet?.Account?.Login);
+
+// Read what changed since the saved cursor, one page at a time; save the cursor after each page.
+let cursor: string | undefined = loadSavedCursor();
+for await (const page of fin.copy.changes.readPages(cursor)) {
+  for (const change of page.Changes ?? []) console.log(change.Entity, change.AccountId, change.OID, change.Status);
+  if (page.Cursor) saveCursor(page.Cursor);
+}
+```
+
+`loadSavedCursor` and `saveCursor` stand for your own storage. The first call without a cursor starts at "now".
+
+A failed call throws `FinApiError` with `statusCode`, FinCopy's `code`, `errors`, and, when the SDK set it, `errorCode`
+(`timeout`, `network`, `rate_limited`, `invalid_response` or `empty_response`) and `retryAfterMs`. Calls are retried on
+rate limits, gateway errors and network failures, honouring the API's `Retry-After`.
+
+The client is server-side only. Do not put an API key in browser JavaScript, a mobile application, a public repository, or a
+client-side environment variable. FinCopy's envelope is handled by the client; DTO fields keep the API's PascalCase wire names.
+Writes automatically carry an `Idempotency-Key`, which can be supplied explicitly in the request options when a caller needs
+to retry the same operation later. Orders complete asynchronously; use the change feed or webhook to learn their result.
+
+The API key grants the permissions assigned to that key. Store it as a server secret and give it only the permissions the
+application needs.
+
+See [FinCopy API docs](https://fincopy.io/docs) and the [FinClient source](https://github.com/bizjaya/FinClient). The
+[QuickStart](./examples/QuickStart.ts) example lists accounts and reads the change feed; its order call is commented out
+because it places a trade.
+
+## Build from source
+
+```sh
+npm ci
+npm run generate:types
+npm run typecheck
+npm test
+npm run build
+```

package/dist/index.cjs

@@ -0,0 +1,517 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  AccountsResource: () => AccountsResource,
+  ChangesResource: () => ChangesResource,
+  FinApiError: () => FinApiError,
+  FinClient: () => FinClient,
+  FinHttpTransport: () => FinHttpTransport,
+  FinWebhook: () => FinWebhook,
+  OrdersResource: () => OrdersResource,
+  WebhooksResource: () => WebhooksResource,
+  readAllChanges: () => readAllChanges,
+  readChangePages: () => readChangePages
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/change-feed.ts
+async function* readChangePages(readPage, cursor, signal) {
+  const seen = /* @__PURE__ */ new Set();
+  if (cursor) seen.add(cursor);
+  for (; ; ) {
+    if (signal?.aborted) throw signal.reason;
+    const page = await readPage(cursor, signal);
+    yield page;
+    if (!page.More) return;
+    if (!page.Cursor || page.Cursor === cursor || seen.has(page.Cursor)) {
+      throw new Error("The FinCopy change feed returned More without a new cursor.");
+    }
+    seen.add(page.Cursor);
+    cursor = page.Cursor;
+  }
+}
+async function* readAllChanges(readPage, cursor, signal) {
+  for await (const page of readChangePages(readPage, cursor, signal)) {
+    for (const change of page.Changes ?? []) yield change;
+  }
+}
+
+// src/http-transport.ts
+var import_node_crypto = require("crypto");
+
+// src/api-error.ts
+var FinApiError = class extends Error {
+  /** The HTTP status code returned by the API, or 0 when no response arrived (timeout or network failure). */
+  statusCode;
+  /** The FinCopy response code, when present. */
+  code;
+  /** Validation and service errors returned by the API. */
+  errors;
+  /** Set by the SDK for timeouts, network failures, rate limits and malformed responses; null for other API errors. */
+  errorCode;
+  /** How long the API asked the caller to wait (the Retry-After header), in milliseconds, when it said. */
+  retryAfterMs;
+  constructor(statusCode, message, code = null, errors = [], details = {}) {
+    super(message || "The FinCopy API request failed.", details.cause === void 0 ? void 0 : { cause: details.cause });
+    this.name = "FinApiError";
+    this.statusCode = statusCode;
+    this.code = code;
+    this.errors = errors;
+    this.errorCode = details.errorCode ?? null;
+    this.retryAfterMs = details.retryAfterMs ?? null;
+  }
+};
+
+// src/http-transport.ts
+var retryableStatuses = /* @__PURE__ */ new Set([429, 502, 503, 504]);
+var writeMethods = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+var FinHttpTransport = class {
+  apiKey;
+  baseUrl;
+  timeoutMs;
+  maxRetries;
+  fetcher;
+  delay;
+  random;
+  constructor(options) {
+    if (!options.apiKey?.trim()) throw new TypeError("apiKey is required.");
+    this.apiKey = options.apiKey;
+    this.baseUrl = (options.baseUrl ?? "https://api.fincopy.io").replace(/\/+$/, "");
+    const base = new URL(this.baseUrl);
+    if (!/^https?:$/.test(base.protocol) || base.search || base.hash) {
+      throw new TypeError("baseUrl must be an absolute HTTP or HTTPS URL without a query or fragment.");
+    }
+    this.timeoutMs = options.timeoutMs ?? 3e4;
+    this.maxRetries = options.maxRetries ?? 3;
+    if (!Number.isFinite(this.timeoutMs) || this.timeoutMs <= 0) throw new RangeError("timeoutMs must be positive.");
+    if (!Number.isInteger(this.maxRetries) || this.maxRetries < 0) throw new RangeError("maxRetries cannot be negative.");
+    this.fetcher = options.fetch ?? globalThis.fetch.bind(globalThis);
+    this.delay = options.retryDelay ?? ((milliseconds, signal) => new Promise((resolve, reject) => {
+      if (signal?.aborted) {
+        reject(signal.reason);
+        return;
+      }
+      const onAbort = () => {
+        clearTimeout(timer);
+        reject(signal?.reason);
+      };
+      const timer = setTimeout(() => {
+        signal?.removeEventListener("abort", onAbort);
+        resolve();
+      }, milliseconds);
+      signal?.addEventListener("abort", onAbort, { once: true });
+      if (signal?.aborted) onAbort();
+    }));
+    this.random = options.random ?? Math.random;
+  }
+  async request(method, path, body, requestOptions = {}) {
+    const envelope = await this.sendEnvelope(method, path, body, requestOptions);
+    return envelope.data;
+  }
+  async sendEnvelope(method, path, body, requestOptions = {}) {
+    const verb = method.toUpperCase();
+    const writes = writeMethods.has(verb);
+    const bodyText = body === void 0 ? void 0 : JSON.stringify(body, (_key, value) => value === null ? void 0 : value);
+    const idempotencyKey = writes ? idempotencyKeyOf(requestOptions.idempotencyKey) : void 0;
+    const url = new URL(path.replace(/^\//, ""), `${this.baseUrl}/`);
+    for (let retry = 0; ; retry++) {
+      if (requestOptions.signal?.aborted) throw requestOptions.signal.reason;
+      const controller = new AbortController();
+      const onAbort = () => controller.abort(requestOptions.signal?.reason);
+      requestOptions.signal?.addEventListener("abort", onAbort, { once: true });
+      if (requestOptions.signal?.aborted) onAbort();
+      let timedOut = false;
+      const timer = setTimeout(() => {
+        timedOut = true;
+        controller.abort(new Error("FinCopy request timed out."));
+      }, this.timeoutMs);
+      let response;
+      let raw;
+      try {
+        const headers = new Headers({ "X-Api-Key": this.apiKey, Accept: "application/json" });
+        if (bodyText !== void 0) headers.set("Content-Type", "application/json");
+        if (idempotencyKey !== void 0) headers.set("Idempotency-Key", idempotencyKey);
+        response = await this.fetcher(url, {
+          method: verb,
+          headers,
+          body: bodyText,
+          signal: controller.signal
+        });
+        raw = await response.text();
+      } catch (error) {
+        if (requestOptions.signal?.aborted) throw error;
+        if (retry >= this.maxRetries) {
+          throw timedOut ? new FinApiError(0, "The FinCopy API did not answer in time.", null, [], { errorCode: "timeout", cause: error }) : new FinApiError(0, "The FinCopy API could not be reached.", null, [], { errorCode: "network", cause: error });
+        }
+        await this.pause(this.backoff(retry), requestOptions.signal);
+        continue;
+      } finally {
+        clearTimeout(timer);
+        requestOptions.signal?.removeEventListener("abort", onAbort);
+      }
+      const serverWait = retryAfterMsOf(response.headers.get("Retry-After"));
+      if (retryableStatuses.has(response.status)) {
+        if (retry < this.maxRetries && (serverWait === null || serverWait <= maxServerRetryAfterMs)) {
+          await this.pause(serverWait ?? (response.status === 429 ? rateLimitBackoff(retry) : this.backoff(retry)), requestOptions.signal);
+          continue;
+        }
+      }
+      let envelope = null;
+      try {
+        envelope = raw ? JSON.parse(raw) : null;
+      } catch {
+      }
+      if (!response.ok || !envelope || envelope.isOk !== true) {
+        const fallback = `The FinCopy API request failed with HTTP ${response.status}.`;
+        const message = typeof envelope?.message === "string" && envelope.message ? envelope.message : fallback;
+        const errorCode = response.status === 429 ? "rate_limited" : response.ok ? "invalid_response" : null;
+        throw new FinApiError(
+          response.status,
+          message,
+          envelope?.code ?? null,
+          errorsOf(envelope?.errors),
+          { errorCode, retryAfterMs: serverWait }
+        );
+      }
+      if (!Object.prototype.hasOwnProperty.call(envelope, "data") || envelope.data === null) {
+        throw new FinApiError(
+          response.status,
+          "The FinCopy API returned an empty response.",
+          envelope.code ?? null,
+          errorsOf(envelope.errors),
+          { errorCode: "empty_response" }
+        );
+      }
+      return envelope;
+    }
+  }
+  async requestPage(method, path, requestOptions = {}) {
+    const envelope = await this.sendEnvelope(method, path, void 0, requestOptions);
+    if (!Array.isArray(envelope.data)) {
+      throw new FinApiError(200, "The FinCopy API returned an invalid page.", envelope.code ?? null, envelope.errors ?? []);
+    }
+    return {
+      items: envelope.data,
+      paging: envelope.paging ?? null,
+      code: envelope.code ?? 200,
+      isOk: true,
+      message: envelope.message ?? null,
+      errors: envelope.errors ?? [],
+      chksum: envelope.chksum ?? null
+    };
+  }
+  backoff(retry) {
+    return Math.min(maxBackoffMs, 250 * 2 ** retry * (0.75 + this.random() * 0.5));
+  }
+  async pause(milliseconds, signal) {
+    if (signal?.aborted) throw signal.reason;
+    if (milliseconds > 0) await this.delay(milliseconds, signal);
+  }
+};
+var maxServerRetryAfterMs = 6e4;
+var maxBackoffMs = 3e4;
+function rateLimitBackoff(retry) {
+  return Math.min(maxBackoffMs, Math.max(1e3, 1e3 * 2 ** retry));
+}
+function retryAfterMsOf(header) {
+  const value = header?.trim();
+  if (!value) return null;
+  if (/^\d+$/.test(value)) return Number(value) * 1e3;
+  const at = Date.parse(value);
+  if (Number.isNaN(at)) return null;
+  const wait = at - Date.now();
+  return wait > 0 ? wait : null;
+}
+function errorsOf(errors) {
+  return Array.isArray(errors) ? errors.map((error) => typeof error === "string" ? error : JSON.stringify(error)) : [];
+}
+function idempotencyKeyOf(supplied) {
+  const key = supplied?.trim();
+  if (!key) return (0, import_node_crypto.randomUUID)();
+  if (key.length > 120 || /[\u0000-\u001f\u007f]/.test(key)) {
+    throw new TypeError("idempotencyKey must be 1-120 characters without control characters.");
+  }
+  return key;
+}
+
+// src/resources.ts
+function pageQuery(query = {}) {
+  const params = new URLSearchParams();
+  const scalarKeys = ["PageNo", "PageSize", "PageOff", "IsAsc", "SortCol", "SortDir", "SrchCol", "SrchVal"];
+  for (const key of scalarKeys) {
+    const value2 = query[key];
+    if (value2 !== void 0) params.append(key, String(value2));
+  }
+  if (query.Search !== void 0) params.append("search", query.Search);
+  for (const key of ["SortBy", "SrchBy", "Include"]) {
+    for (const value2 of query[key] ?? []) params.append(key, value2);
+  }
+  const value = params.toString();
+  return value ? `?${value}` : "";
+}
+function accountPath(accountId) {
+  if (!accountId?.trim()) throw new TypeError("accountId is required.");
+  return `v1/accounts/${encodeURIComponent(accountId)}`;
+}
+function numericId(value, name) {
+  if (!Number.isSafeInteger(value) || value < 0) throw new RangeError(`${name} must be a non-negative safe integer.`);
+  return String(value);
+}
+function dateQuery(value) {
+  return value instanceof Date ? value.toISOString() : value;
+}
+var AccountsResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /** Lists the accounts this API key can reach. */
+  list(options = {}) {
+    return this.http.request("GET", "v1/accounts", void 0, options);
+  }
+  /** Adds a hosted account for the key's owner. */
+  make(command, options = {}) {
+    return this.http.request("POST", "v1/accounts/make", command, options);
+  }
+  /** Reads one account and its latest state. */
+  get(accountId, options = {}) {
+    return this.http.request("GET", accountPath(accountId), void 0, options);
+  }
+  /** Sets or clears the account's external reference. */
+  setExternalRef(accountId, command, options = {}) {
+    return this.http.request("PUT", `${accountPath(accountId)}/external-ref`, command, options);
+  }
+  /** Reads the account's trading settings. */
+  getTrading(accountId, options = {}) {
+    return this.http.request("GET", `${accountPath(accountId)}/fxs`, void 0, options);
+  }
+  /** Changes the account's trading settings. */
+  patchTrading(accountId, command, options = {}) {
+    return this.http.request("PATCH", `${accountPath(accountId)}/fxs`, command, options);
+  }
+  /** Lists the account's symbols and their BUY and SELL books. */
+  listPairs(accountId, query = {}, options = {}) {
+    return this.http.requestPage("GET", `${accountPath(accountId)}/pairs${pageQuery(query)}`, options);
+  }
+  /** Reads one symbol and its settings. */
+  getPair(accountId, prno, options = {}) {
+    return this.http.request("GET", `${accountPath(accountId)}/pairs/${numericId(prno, "prno")}`, void 0, options);
+  }
+  /** Changes one symbol's settings. */
+  patchPair(accountId, prno, command, options = {}) {
+    return this.http.request("PATCH", `${accountPath(accountId)}/pairs/${numericId(prno, "prno")}`, command, options);
+  }
+  /** Lists HYBRID DCA proposals waiting for an answer. */
+  dcaQueue(accountId, options = {}) {
+    return this.http.request("GET", `${accountPath(accountId)}/dca-queue`, void 0, options);
+  }
+  /** Reads broker symbols and the account's enabled symbols. */
+  symbols(accountId, options = {}) {
+    return this.http.request("GET", `${accountPath(accountId)}/symbols`, void 0, options);
+  }
+  /** Adds and removes symbols from the account's enabled list. */
+  editSymbols(accountId, command, options = {}) {
+    return this.http.request("PUT", `${accountPath(accountId)}/symbols`, command, options);
+  }
+  /** Reads a symbol's broker specification and latest quote. */
+  quote(accountId, symbol, options = {}) {
+    if (!symbol?.trim()) throw new TypeError("symbol is required.");
+    return this.http.request("GET", `${accountPath(accountId)}/quotes/${encodeURIComponent(symbol)}`, void 0, options);
+  }
+  /** Reads daily performance rows for one account and optional UTC date range. */
+  performance(accountId, query = {}) {
+    const params = new URLSearchParams();
+    if (query.fromDt !== void 0) params.set("fromDt", dateQuery(query.fromDt));
+    if (query.toDt !== void 0) params.set("toDt", dateQuery(query.toDt));
+    const encoded = params.toString();
+    const suffix = encoded ? `?${encoded}` : "";
+    return this.http.request("GET", `${accountPath(accountId)}/performance${suffix}`, void 0, query);
+  }
+  /** Reads recent activity for one account. */
+  activity(accountId, options = {}) {
+    return this.http.request("GET", `${accountPath(accountId)}/activity`, void 0, options);
+  }
+  /** Queues a start operation for the hosted terminal. */
+  start(accountId, options = {}) {
+    return this.operation(accountId, "start", options);
+  }
+  /** Queues a stop operation for the hosted terminal. */
+  stop(accountId, options = {}) {
+    return this.operation(accountId, "stop", options);
+  }
+  /** Queues a restart operation for the hosted terminal. */
+  restart(accountId, options = {}) {
+    return this.operation(accountId, "restart", options);
+  }
+  /** Queues removal of the hosted account and its terminal. */
+  remove(accountId, options = {}) {
+    return this.operation(accountId, "remove", options);
+  }
+  operation(accountId, operation, options) {
+    return this.http.request("POST", `${accountPath(accountId)}/${operation}`, void 0, options);
+  }
+};
+var OrdersResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /** Lists live, queued and pending orders. */
+  list(accountId, query = {}, options = {}) {
+    return this.http.requestPage("GET", `${accountPath(accountId)}/orders${pageQuery(query)}`, options);
+  }
+  /** Lists settled orders, newest first. */
+  history(accountId, query = {}, options = {}) {
+    return this.http.requestPage("GET", `${accountPath(accountId)}/orders/history${pageQuery(query)}`, options);
+  }
+  /** Reads one settled order. */
+  historyItem(accountId, oid, options = {}) {
+    return this.http.request("GET", `${accountPath(accountId)}/orders/history/${numericId(oid, "oid")}`, void 0, options);
+  }
+  /** Reads one live or settled order. */
+  get(accountId, oid, options = {}) {
+    return this.http.request("GET", `${accountPath(accountId)}/orders/${numericId(oid, "oid")}`, void 0, options);
+  }
+  /** Sends one FXS action. A successful response means queued for the terminal, not filled. */
+  make(accountId, command, options = {}) {
+    return this.http.request("POST", `${accountPath(accountId)}/orders`, command, options);
+  }
+  /** Accepts or rejects one HYBRID DCA proposal. */
+  answerDca(accountId, oid, command, options = {}) {
+    return this.http.request("POST", `${accountPath(accountId)}/dca/${numericId(oid, "oid")}/answer`, command, options);
+  }
+  /** Reads the quote, limits, books and settings used by the trade ticket. */
+  preInfo(accountId, command, options = {}) {
+    return this.http.request("POST", `${accountPath(accountId)}/orders/preinfo`, command, options);
+  }
+  /** Sends a BUY and SELL trade together. A successful response means queued, not filled. */
+  hedge(accountId, command, options = {}) {
+    return this.http.request("POST", `${accountPath(accountId)}/orders/hedge`, command, options);
+  }
+  /** Changes an order's TP field, SL field, expiry or pending price. */
+  modify(accountId, command, options = {}) {
+    return this.http.request("POST", `${accountPath(accountId)}/trades/modify`, command, options);
+  }
+  /** Cancels an order that has not yet been delivered to the terminal. */
+  cancelWaiting(accountId, command, options = {}) {
+    return this.http.request("POST", `${accountPath(accountId)}/trades/cancel-waiting`, command, options);
+  }
+};
+var ChangesResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /** Reads one changes page using an optional cursor. */
+  get(cursor, take = 500, options = {}) {
+    if (!Number.isInteger(take) || take < 1 || take > 1e3) throw new RangeError("take must be between 1 and 1000.");
+    const params = new URLSearchParams({ take: String(take) });
+    if (cursor) params.set("cursor", cursor);
+    return this.http.request("GET", `v1/accounts/changes?${params}`, void 0, options);
+  }
+  /**
+   * Streams the available changes page by page, following each returned cursor. Save each page's `Cursor` after handling
+   * its `Changes`, so a restart resumes from there.
+   */
+  readPages(cursor, take = 500, signal) {
+    return readChangePages((next, nextSignal) => this.page(next, take, nextSignal), cursor, signal);
+  }
+  /** Streams every currently available change, following each returned cursor. Use `readPages` to save the cursor. */
+  readAll(cursor, take = 500, signal) {
+    return readAllChanges((next, nextSignal) => this.page(next, take, nextSignal), cursor, signal);
+  }
+  async page(cursor, take, signal) {
+    const page = await this.get(cursor, take, { signal });
+    return { Changes: page.Changes ?? [], Cursor: page.Cursor ?? null, More: page.More ?? false };
+  }
+};
+var WebhooksResource = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /** Reads this key's webhook configuration. */
+  get(options = {}) {
+    return this.http.request("GET", "v1/accounts/webhook", void 0, options);
+  }
+  /** Sets the HTTPS destination and returns its signing secret once. */
+  set(command, options = {}) {
+    return this.http.request("PUT", "v1/accounts/webhook", command, options);
+  }
+  /** Removes this key's webhook. */
+  delete(options = {}) {
+    return this.http.request("DELETE", "v1/accounts/webhook", void 0, options);
+  }
+  /** Sends a signed test POST to this key's webhook. */
+  ping(options = {}) {
+    return this.http.request("POST", "v1/accounts/webhook/ping", void 0, options);
+  }
+};
+
+// src/client.ts
+var FinClient = class {
+  copy;
+  constructor(options) {
+    const transport = new FinHttpTransport(options);
+    this.copy = {
+      accounts: new AccountsResource(transport),
+      orders: new OrdersResource(transport),
+      changes: new ChangesResource(transport),
+      webhooks: new WebhooksResource(transport)
+    };
+  }
+};
+
+// src/webhook.ts
+var import_node_crypto2 = require("crypto");
+var FinWebhook = class {
+  static allowedSkewSeconds = 300;
+  /** Verify X-FinCopy-Signature over the timestamp and the exact raw request body. */
+  static verify(secret, timestamp, body, signature) {
+    if (!secret || !signature) return false;
+    const timestampText = String(timestamp);
+    if (!/^\d+$/.test(timestampText)) return false;
+    const seconds = Number(timestampText);
+    if (!Number.isSafeInteger(seconds)) return false;
+    const now = Math.floor(Date.now() / 1e3);
+    if (now - seconds > this.allowedSkewSeconds || seconds - now > this.allowedSkewSeconds) return false;
+    const suppliedHex = signature.startsWith("sha256=") ? signature.slice(7) : signature;
+    if (!/^[a-fA-F0-9]{64}$/.test(suppliedHex)) return false;
+    const supplied = Buffer.from(suppliedHex, "hex");
+    const signedBody = Buffer.isBuffer(body) ? body : Buffer.from(body);
+    const expected = (0, import_node_crypto2.createHmac)("sha256", Buffer.from(secret, "utf8")).update(Buffer.from(`${timestampText}.`, "utf8")).update(signedBody).digest();
+    return supplied.length === expected.length && (0, import_node_crypto2.timingSafeEqual)(supplied, expected);
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AccountsResource,
+  ChangesResource,
+  FinApiError,
+  FinClient,
+  FinHttpTransport,
+  FinWebhook,
+  OrdersResource,
+  WebhooksResource,
+  readAllChanges,
+  readChangePages
+});