@certysign/sdk 1.0.0 → 2.1.0

package/src/lib/SigningSessionResource.js

@@ -0,0 +1,183 @@
+/**
+ * @fileoverview SigningSessionResource — multi-recipient hash-based signing
+ *
+ * Manages signing sessions where:
+ *  - Document hashes are registered (documents stay local)
+ *  - Recipients are added with sequential or parallel signing order
+ *  - OTP verification is required before each recipient can sign
+ *  - HSM signs the hash for each verified recipient
+ *
+ * Covers:
+ *  - create()         Create a signing session
+ *  - get()            Get session status
+ *  - list()           List sessions
+ *  - sendOtp()        Send OTP to a recipient
+ *  - verifyOtp()      Verify recipient OTP
+ *  - recipientSign()  Recipient signs after OTP verification
+ */
+
+'use strict';
+
+class SigningSessionResource {
+  /** @param {import('./HttpClient').HttpClient} http */
+  constructor(http) {
+    this._http = http;
+  }
+
+  /**
+   * Create a signing session with document hashes and recipients.
+   *
+   * @param {CreateSessionOptions} options
+   * @returns {Promise<Object>}
+   *
+   * @example
+   * const session = await client.sessions.create({
+   *   name: 'Q1 Contract',
+   *   documents: [
+   *     { hash: 'abc123...', fileName: 'contract.pdf', hashAlgorithm: 'sha256' }
+   *   ],
+   *   recipients: [
+   *     { email: 'ceo@example.com', name: 'Jane CEO', role: 'signer', order: 1 },
+   *     { email: 'cfo@example.com', name: 'John CFO', role: 'signer', order: 2 }
+   *   ],
+   *   signingOrder: 'sequential'
+   * });
+   *
+   * console.log(session.data._id);                  // Session ID
+   * console.log(session.data.recipients[0].recipientId); // Use for OTP/sign
+   */
+  create(options) {
+    const {
+      name,
+      description,
+      documents,
+      recipients,
+      signingOrder = 'parallel',
+      expiresAt
+    } = options;
+
+    if (!name)          throw new Error('create: name is required');
+    if (!documents?.length) throw new Error('create: documents array is required');
+    if (!recipients?.length) throw new Error('create: recipients array is required');
+
+    return this._http.post('/sdk/v1/signing-sessions', {
+      data: { name, description, documents, recipients, signingOrder, expiresAt }
+    });
+  }
+
+  /**
+   * Get a signing session by ID.
+   *
+   * @param {string} sessionId
+   * @returns {Promise<Object>}
+   */
+  get(sessionId) {
+    if (!sessionId) throw new Error('get: sessionId is required');
+    return this._http.get(`/sdk/v1/signing-sessions/${encodeURIComponent(sessionId)}`);
+  }
+
+  /**
+   * List signing sessions with pagination.
+   *
+   * @param {Object} [options]
+   * @param {number} [options.page=1]
+   * @param {number} [options.limit=20]
+   * @param {string} [options.status]
+   * @returns {Promise<Object>}
+   */
+  list(options = {}) {
+    return this._http.get('/sdk/v1/signing-sessions', { params: options });
+  }
+
+  /**
+   * Send an OTP verification code to a recipient's email.
+   *
+   * @param {string} sessionId
+   * @param {string} recipientId
+   * @returns {Promise<Object>}
+   *
+   * @example
+   * await client.sessions.sendOtp(sessionId, recipientId);
+   * // Recipient receives a 6-digit code via email
+   */
+  sendOtp(sessionId, recipientId) {
+    if (!sessionId)   throw new Error('sendOtp: sessionId is required');
+    if (!recipientId) throw new Error('sendOtp: recipientId is required');
+    return this._http.post(
+      `/sdk/v1/signing-sessions/${encodeURIComponent(sessionId)}/recipients/${encodeURIComponent(recipientId)}/send-otp`
+    );
+  }
+
+  /**
+   * Verify a recipient's OTP code.
+   * On success, returns a short-lived signing token.
+   *
+   * @param {string} sessionId
+   * @param {string} recipientId
+   * @param {string} code - 6-digit OTP from email
+   * @returns {Promise<Object>} - { signingToken, expiresAt }
+   *
+   * @example
+   * const result = await client.sessions.verifyOtp(sessionId, recipientId, '123456');
+   * const signingToken = result.data.signingToken;
+   */
+  verifyOtp(sessionId, recipientId, code) {
+    if (!sessionId)   throw new Error('verifyOtp: sessionId is required');
+    if (!recipientId) throw new Error('verifyOtp: recipientId is required');
+    if (!code)        throw new Error('verifyOtp: code is required');
+
+    return this._http.post(
+      `/sdk/v1/signing-sessions/${encodeURIComponent(sessionId)}/recipients/${encodeURIComponent(recipientId)}/verify-otp`,
+      { data: { code: String(code) } }
+    );
+  }
+
+  /**
+   * Recipient signs all documents in the session.
+   * Requires the signing token obtained from verifyOtp().
+   *
+   * @param {string} sessionId
+   * @param {string} recipientId
+   * @param {string} signingToken - Token from verifyOtp()
+   * @returns {Promise<Object>} - { signedDocuments, certificate, chain }
+   *
+   * @example
+   * const result = await client.sessions.recipientSign(
+   *   sessionId, recipientId, signingToken
+   * );
+   *
+   * // Use SignatureEmbedder to embed signatures into local documents
+   * for (const doc of result.data.signedDocuments) {
+   *   const signedPdf = await client.embedder.embedInPdf(pdfBuffer, {
+   *     signature:   doc.signature,
+   *     certificate: result.data.certificate,
+   *     chain:       result.data.chain,
+   *     reason:      'Contract signing',
+   *     signerName:  'Jane CEO'
+   *   });
+   *   fs.writeFileSync(`./signed-${doc.fileName}`, signedPdf);
+   * }
+   */
+  recipientSign(sessionId, recipientId, signingToken) {
+    if (!sessionId)    throw new Error('recipientSign: sessionId is required');
+    if (!recipientId)  throw new Error('recipientSign: recipientId is required');
+    if (!signingToken) throw new Error('recipientSign: signingToken is required');
+
+    return this._http.post(
+      `/sdk/v1/signing-sessions/${encodeURIComponent(sessionId)}/recipients/${encodeURIComponent(recipientId)}/sign`,
+      { data: { signingToken } }
+    );
+  }
+}
+
+/**
+ * @typedef {Object} CreateSessionOptions
+ * @property {string} name - Session name
+ * @property {string} [description]
+ * @property {{ hash: string, fileName: string, hashAlgorithm?: string, mimeType?: string }[]} documents
+ * @property {{ email: string, name: string, role?: string, order?: number }[]} recipients
+ * @property {'sequential'|'parallel'} [signingOrder='parallel']
+ * @property {string} [expiresAt] - ISO date
+ */
+
+module.exports = { SigningSessionResource };

package/examples/certificate-flow.js

@@ -1,198 +0,0 @@
-/**
- * Full PKI Certificate Lifecycle Example
- *
- * Demonstrates the complete X.509 certificate workflow:
- *  1. Issue a per-document certificate
- *  2. Check current status (should be 'good')
- *  3. Verify the certificate (chain, revocation, validity)
- *  4. Download CA chain and save it locally
- *  5. Perform a point-in-time verification
- *  6. Fetch and cache the CRL locally
- *  7. Check a serial number directly against the CRL JSON
- *  8. Perform an OCSP query
- *
- * This pattern is used by HIE systems that need to:
- *  - Verify document signing certificates before granting access
- *  - Cache CRL/OCSP responses to meet response time SLAs
- *
- * Prerequisites:
- *   npm install @certysign/sdk
- *   export CERTYSIGN_PUBLIC_KEY="cs_pk_..."
- *   export CERTYSIGN_SECRET_KEY="cs_sk_..."
- */
-
-'use strict';
-
-const fs   = require('fs');
-const path = require('path');
-const { CertySignClient, CertySignError } = require('@certysign/sdk');
-
-const client = new CertySignClient({
-  publicKey:   process.env.CERTYSIGN_PUBLIC_KEY,
-  secretKey:   process.env.CERTYSIGN_SECRET_KEY,
-  environment: 'production'
-});
-
-async function runCertificateFlow() {
-  console.log('\n[PKI] CertySign Certificate Lifecycle Demo');
-  console.log('─'.repeat(60));
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // 1. Issue a certificate
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log('\n[PKI] 1. Issuing X.509 certificate...');
-
-  const issueResult = await client.certificates.issue({
-    commonName:   'HIE Integration Node — KNH',
-    organisation: 'Kenyatta National Hospital',
-    country:      'KE',
-    state:        'Nairobi',
-    locality:     'Nairobi',
-    email:        'pki@knh.or.ke',
-    validityDays: 365,
-    metadata:     { system: 'HIE-NODE-KNH-PROD', issuedAt: new Date().toISOString() }
-  });
-
-  const cert = issueResult.data;
-  console.log(`  serialNumber : ${cert.serialNumber}`);
-  console.log(`  fingerprint  : ${cert.fingerprint}`);
-  console.log(`  validFrom    : ${cert.validFrom}`);
-  console.log(`  validUntil   : ${cert.validUntil}`);
-  console.log(`  Subject CN   : ${cert.subject?.cn}`);
-
-  // Store private key securely (shown ONCE — CertySign does not retain it)
-  const keyPath = path.join(__dirname, 'hie-node-knh.key.pem');
-  fs.writeFileSync(keyPath, cert.privateKey, { mode: 0o600 });
-  console.log(`  privateKey   → ${keyPath}  (mode 600)`);
-
-  const certPath = path.join(__dirname, 'hie-node-knh.crt.pem');
-  fs.writeFileSync(certPath, cert.pemCertificate);
-  console.log(`  certificate  → ${certPath}`);
-
-  const { serialNumber } = cert;
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // 2. Real-time status check (should be 'good')
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log('\n[PKI] 2. Certificate status check...');
-  const statusResult = await client.certificates.status(serialNumber);
-  const status = statusResult.data;
-  console.log(`  status         : ${status.status}`);
-  if (status.status === 'revoked') {
-    console.log(`  revocationDate : ${status.revocationDate}`);
-    console.log(`  reason         : ${status.revocationReason}`);
-  }
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // 3. Full certificate verification (chain + revocation)
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log('\n[PKI] 3. Full certificate verification...');
-  const verifyResult = await client.certificates.verify(serialNumber);
-  const verification = verifyResult.data;
-  console.log(`  valid              : ${verification.valid}`);
-  console.log(`  chainVerified      : ${verification.chainVerified}`);
-  console.log(`  revocationChecked  : ${verification.revocationChecked}`);
-  console.log(`  certStatus         : ${verification.certStatus}`);
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // 4. Download CA chain and install in local trust store
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log('\n[PKI] 4. Downloading CA chain...');
-  const chainPem = await client.pki.chain();
-  const chainPath = path.join(__dirname, 'certysign-chain.pem');
-  fs.writeFileSync(chainPath, chainPem);
-  console.log(`  CA chain → ${chainPath}`);
-  console.log(`  (${chainPem.split('-----BEGIN CERTIFICATE-----').length - 1} cert(s) in bundle)`);
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // 5. Point-in-time verification
-  //    Used by HIE to check if a cert was valid at the time a document was signed
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log('\n[PKI] 5. Point-in-time verification...');
-  const signingTime = new Date(Date.now() - 5 * 60 * 1000);   // 5 minutes ago
-  const ptResult = await client.certificates.verify(serialNumber, signingTime);
-  console.log(`  valid at ${signingTime.toISOString()} : ${ptResult.data.valid}`);
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // 6. Fetch and cache CRL (JSON format for application-level checks)
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log('\n[PKI] 6. Fetching CRL (JSON)...');
-  const crlJson = await client.pki.crl('json');
-  const crl = crlJson.data;
-  console.log(`  issuer        : ${crl.issuer}`);
-  console.log(`  thisUpdate    : ${crl.thisUpdate}`);
-  console.log(`  nextUpdate    : ${crl.nextUpdate}`);
-  console.log(`  revokedCount  : ${crl.revokedCount}`);
-
-  // Build a Set of revoked serial numbers for fast in-process lookups
-  const revokedSet = new Set((crl.crl || []).map(e => e.serialNumber));
-  console.log(`  Revoked set   : ${revokedSet.size} entries loaded`);
-
-  // Cache on disk until nextUpdate
-  fs.writeFileSync(
-    path.join(__dirname, 'crl-cache.json'),
-    JSON.stringify({ ...crl, cachedAt: new Date().toISOString() }, null, 2)
-  );
-
-  // Also download DER CRL for systems that need binary format
-  console.log('\n[PKI] 6b. Downloading DER CRL...');
-  const crlDer = await client.pki.crl('der');
-  fs.writeFileSync(path.join(__dirname, 'certysign-intermediate.crl'), crlDer);
-  console.log(`  certysign-intermediate.crl — ${crlDer.length} bytes`);
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // 7. In-process revocation check using cached CRL
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log('\n[PKI] 7. Local CRL check...');
-  const isRevoked = revokedSet.has(serialNumber);
-  console.log(`  Serial ${serialNumber.slice(0, 12)}... : ${isRevoked ? 'REVOKED' : 'not in CRL'}`);
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // 8. OCSP query — freshest revocation status
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log('\n[PKI] 8. OCSP query...');
-  const ocspResult = await client.pki.ocsp(serialNumber, 'json');
-  const ocsp = ocspResult.data;
-  console.log(`  status         : ${ocsp.status}`);
-  console.log(`  producedAt     : ${ocsp.producedAt}`);
-  console.log(`  responderId    : ${ocsp.responderId}`);
-  console.log(`  nextUpdate     : ${ocsp.nextUpdate}`);
-  console.log(`  signatureAlgo  : ${ocsp.signatureAlgorithm}`);
-  if (ocsp.certIdHash) {
-    console.log(`  CertID algo    : ${ocsp.certIdHash.algorithm}`);
-    console.log(`  issuerNameHash : ${ocsp.certIdHash.issuerNameHash?.slice(0, 16)}...`);
-  }
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // 9. CA Info — inspect the trust hierarchy
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log('\n[PKI] 9. CA hierarchy info...');
-  const info = await client.pki.info();
-  const caInfo = info.data;
-  console.log(`  Root CA        : ${caInfo.rootCA?.subject?.commonName}`);
-  console.log(`  Root CA expiry : ${caInfo.rootCA?.validity?.notAfter}`);
-  console.log(`  Inter CA       : ${caInfo.intermediateCA?.subject?.commonName}`);
-  console.log(`  Inter CA expiry: ${caInfo.intermediateCA?.validity?.notAfter}`);
-  console.log(`  CRL URL        : ${caInfo.intermediateCA?.crlUrl}`);
-  console.log(`  OCSP URL       : ${caInfo.intermediateCA?.ocspUrl}`);
-  console.log(`  Initialised    : ${caInfo.status?.initialized}`);
-
-  console.log('\n[PKI] ✓ Certificate lifecycle demo complete');
-  console.log('─'.repeat(60));
-}
-
-// ── Run ───────────────────────────────────────────────────────────────────────
-
-(async () => {
-  try {
-    await runCertificateFlow();
-  } catch (err) {
-    if (err instanceof CertySignError) {
-      console.error(`\n[PKI] API Error (${err.statusCode}): ${err.message}`);
-      if (err.details) console.error('[PKI] Details:', JSON.stringify(err.details, null, 2));
-    } else {
-      console.error('\n[PKI] Error:', err.message);
-    }
-    process.exit(1);
-  }
-})();

package/examples/dha-integration.js

@@ -1,208 +0,0 @@
-/**
- * DHA Kenya — Health Claims Quick-Sign Integration
- *
- * This example demonstrates the standard integration pattern for the
- * Department of Health Affairs (DHA) Kenya claims processing system.
- *
- * Workflow:
- *  1. Load a health claim PDF
- *  2. Sign it using quickSign() — creates envelope, uploads, signs in one call
- *  3. Issue a per-document X.509 certificate bound to the claim
- *  4. Store the envelopeId and certificate serial number in the claims DB
- *  5. Optionally verify the certificate via OCSP before archiving
- *
- * Prerequisites:
- *   npm install @certysign/sdk
- *   export CERTYSIGN_PUBLIC_KEY="cs_pk_..."
- *   export CERTYSIGN_SECRET_KEY="cs_sk_..."
- */
-
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-const { CertySignClient } = require('@certysign/sdk');
-
-// ── Initialise client ────────────────────────────────────────────────────────
-
-const client = new CertySignClient({
-  publicKey:   process.env.CERTYSIGN_PUBLIC_KEY,
-  secretKey:   process.env.CERTYSIGN_SECRET_KEY,
-  environment: 'production'                         // 'staging' for UAT
-});
-
-// ── Simulated DHA claim record ───────────────────────────────────────────────
-
-const claim = {
-  id:          'CLM-2026-003421',
-  patientName: 'John Kamau Njoroge',
-  facility:    'Kenyatta National Hospital',
-  approvedBy:  'Dr. Amina Okonkwo',
-  approverEmail: 'amina.okonkwo@dha.go.ke',
-  department:  'Primary Health Outreach',
-  amount:      45_000            // KES
-};
-
-// ── Main integration function ────────────────────────────────────────────────
-
-async function processClaim(claim) {
-  console.log(`\n[DHA] Processing claim ${claim.id} — ${claim.facility}`);
-  console.log('─'.repeat(60));
-
-  // Step 1: Load the generated claim PDF (your system produces this)
-  const pdfPath = path.join(__dirname, 'sample-claim.pdf');
-  let pdfBuffer;
-  try {
-    pdfBuffer = fs.readFileSync(pdfPath);
-  } catch {
-    // Create a minimal placeholder for demo purposes
-    pdfBuffer = Buffer.from('%PDF-1.4 sample claim document');
-    console.warn('[DHA] Using placeholder PDF — replace with real claim PDF in production');
-  }
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // Step 2: Sign the claim document
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log('\n[DHA] Signing claim document...');
-
-  const signResult = await client.sign.quickSign({
-    document:    pdfBuffer,
-    filename:    `claim-${claim.id}.pdf`,
-    signerName:  claim.approvedBy,
-    signerEmail: claim.approverEmail,
-    reason:      `Health claim approval — DHA Kenya (${claim.id})`,
-    location:    'Nairobi, Kenya',
-    metadata: {
-      claimId:    claim.id,
-      patientName: claim.patientName,
-      facility:   claim.facility,
-      department: claim.department,
-      amount:     claim.amount,
-      currency:   'KES',
-      system:     'DHA-CLAIMS-PROD'
-    }
-  });
-
-  const { envelopeId, certificate: sigCert } = signResult.data;
-  console.log(`[DHA] ✓ Document signed`);
-  console.log(`      envelopeId : ${envelopeId}`);
-  console.log(`      sigCert SN : ${sigCert?.serialNumber || '(embedded in PDF)'}`);
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // Step 3: Issue a per-document X.509 certificate for the claim
-  // This cert is used by the HIE system to grant document access
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log('\n[DHA] Issuing per-document X.509 certificate...');
-
-  const certResult = await client.certificates.issue({
-    commonName:   `DHA-${claim.id}`,
-    organisation: 'Department of Health Affairs Kenya',
-    country:      'KE',
-    state:        'Nairobi',
-    locality:     'Nairobi',
-    email:        claim.approverEmail,
-    validityDays: 365,
-    metadata: {
-      claimId:    claim.id,
-      envelopeId,
-      facility:   claim.facility,
-      issuedAt:   new Date().toISOString()
-    }
-  });
-
-  const cert = certResult.data;
-  console.log(`[DHA] ✓ Certificate issued`);
-  console.log(`      serialNumber : ${cert.serialNumber}`);
-  console.log(`      fingerprint  : ${cert.fingerprint}`);
-  console.log(`      validUntil   : ${cert.validUntil}`);
-  console.log(`      privateKey   : [SHOW ONCE — store securely]`);
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // Step 4: Verify the certificate is good via OCSP
-  // (optional but recommended before archiving)
-  // ─────────────────────────────────────────────────────────────────────────
-  console.log('\n[DHA] Verifying certificate via OCSP...');
-
-  const ocspResult = await client.pki.ocsp(cert.serialNumber, 'json');
-  const ocspStatus = ocspResult.data;
-
-  console.log(`[DHA] OCSP status  : ${ocspStatus.status}`);
-  console.log(`      responderId  : ${ocspStatus.responderId}`);
-  console.log(`      nextUpdate   : ${ocspStatus.nextUpdate}`);
-
-  if (ocspStatus.status !== 'good') {
-    throw new Error(`[DHA] Unexpected OCSP status: ${ocspStatus.status}`);
-  }
-
-  // ─────────────────────────────────────────────────────────────────────────
-  // Step 5: Store claim record with signing proof
-  // ─────────────────────────────────────────────────────────────────────────
-  const claimRecord = {
-    claimId:           claim.id,
-    envelopeId,
-    certificateSerial: cert.serialNumber,
-    certificateExpiry: cert.validUntil,
-    signedAt:          new Date().toISOString(),
-    status:            'SIGNED',
-    // Store PEM cert for offline verification (NOT the private key in production DB)
-    pemCertificate:    cert.pemCertificate
-  };
-
-  console.log('\n[DHA] ✓ Claim processed successfully');
-  console.log('─'.repeat(60));
-  console.log('[DHA] Claim record:', JSON.stringify(claimRecord, null, 2));
-
-  return claimRecord;
-}
-
-// ── Retrieve and verify an archived claim ────────────────────────────────────
-
-async function verifyClaim(claimRecord) {
-  console.log(`\n[DHA] Verifying archived claim ${claimRecord.claimId}`);
-  console.log('─'.repeat(60));
-
-  // Check signing envelope still has valid signatures
-  const envelopeResult = await client.sign.verifyById(claimRecord.envelopeId);
-  const env = envelopeResult.data;
-
-  console.log(`[DHA] Envelope status   : ${env.status}`);
-  console.log(`[DHA] Signature valid   : ${env.valid}`);
-  console.log(`[DHA] Signed by         : ${env.signerName}`);
-  console.log(`[DHA] Signed at         : ${env.signedAt}`);
-
-  // Check certificate status
-  const certStatus = await client.certificates.status(claimRecord.certificateSerial);
-  console.log(`[DHA] Certificate status: ${certStatus.data.status}`);
-
-  // Point-in-time verification — was cert valid when signing happened?
-  const certAtTime = await client.certificates.verify(
-    claimRecord.certificateSerial,
-    claimRecord.signedAt
-  );
-  console.log(`[DHA] Cert valid-at-signing: ${certAtTime.data.valid}`);
-
-  return {
-    envelopeValid:    env.valid,
-    certificateStatus: certStatus.data.status,
-    certValidAtSigning: certAtTime.data.valid
-  };
-}
-
-// ── Run example ──────────────────────────────────────────────────────────────
-
-(async () => {
-  try {
-    const record = await processClaim(claim);
-    await verifyClaim(record);
-  } catch (err) {
-    if (err.code === 'INVALID_API_KEY') {
-      console.error('\n[DHA] Authentication failed — check CERTYSIGN_PUBLIC_KEY / CERTYSIGN_SECRET_KEY');
-    } else if (err.code === 'RATE_LIMIT_EXCEEDED') {
-      console.error('\n[DHA] Rate limit reached — implement request throttling');
-    } else {
-      console.error('\n[DHA] Error:', err.message);
-      if (err.details) console.error('[DHA] Details:', JSON.stringify(err.details, null, 2));
-    }
-    process.exit(1);
-  }
-})();