@checkcourt/sdk 0.0.0-stage → 0.4.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 CheckCourt
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,245 @@
-# Temporary Holding Version
+# CheckCourt TypeScript SDK
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+`@checkcourt/sdk` is the official TypeScript SDK for the [CheckCourt](https://checkcourt.de)
+app platform. It takes care of the parts of an integration that are easy to get wrong:
+
+- a typed client for every endpoint under `/api/v1`, generated from the OpenAPI spec
+- API key, installation token and member token authentication, with token caching and
+  safe refresh rotation
+- OAuth 2.1 with PKCE for member apps
+- webhook signature verification with typed events
+- UI extensions: context token and request verification, a builder for declarative UI
+  documents, and a browser helper for iframe extensions
+- a fully typed app manifest
+
+Everything the SDK does can also be built with plain HTTP. The protocol is described in the
+[developer documentation](https://docs.checkcourt.de/docs/developer).
+
+The SDK is an ES module for Node.js 20 or later and ships its own type definitions. It uses
+WebCrypto, so webhook and extension verification also run on edge runtimes such as
+Cloudflare Workers, Vercel Edge or Deno. Its only runtime dependency is `openapi-fetch`.
+
+## Install
+
+```bash
+npm install @checkcourt/sdk
+```
+
+Every release is also tagged on [GitHub](https://github.com/CheckCourt/sdk/releases).
+
+## Quick start
+
+### API client with installation auth (club apps)
+
+```ts
+import { createCheckCourtClient, getInstallation, installationAuth, unwrap } from "@checkcourt/sdk";
+
+const client = createCheckCourtClient({
+  auth: installationAuth({
+    clientId: process.env.CHECKCOURT_CLIENT_ID!, // cca_app_…
+    clientSecret: process.env.CHECKCOURT_CLIENT_SECRET!, // ccas_…
+    installationId: "inst_123", // from the app.installed event
+  }),
+});
+
+const installation = await getInstallation(client);
+const { courts } = await unwrap(client.GET("/courts"));
+```
+
+`installationAuth` fetches a short-lived installation token when needed, caches it and
+renews it shortly before it expires. Use `apiKeyAuth(key)` for your own club's API key and
+`userAuth({ … })` for member tokens from OAuth. Calls return `{ data, error, response }`;
+`unwrap()` returns `data` or throws a `CheckCourtApiError`. Requests are retried once
+after a `401` with a fresh token and with backoff after a `429`.
+
+### Verify a webhook
+
+```ts
+import { SIGNATURE_HEADER, isEventType, verifyWebhook } from "@checkcourt/sdk";
+
+export async function POST(request: Request) {
+  const event = await verifyWebhook({
+    secret: process.env.CHECKCOURT_WEBHOOK_SECRET!, // whsec_…
+    rawBody: await request.text(),
+    signatureHeader: request.headers.get(SIGNATURE_HEADER),
+  });
+
+  if (isEventType(event, "booking.created")) {
+    console.log("new booking", event.data.booking_id);
+  }
+  return new Response(null, { status: 200 });
+}
+```
+
+`verifyWebhook` throws a `WebhookSignatureError` when the signature or timestamp does not
+check out. Deduplicate on `event.id`: retries carry the same id.
+
+### Declarative extensions and the `ui` builder
+
+```ts
+import { ExtensionVerificationError, toast, ui, verifyExtensionRequest } from "@checkcourt/sdk";
+
+export async function POST(request: Request) {
+  let ext;
+  try {
+    ext = await verifyExtensionRequest({
+      secret: process.env.CHECKCOURT_WEBHOOK_SECRET!,
+      rawBody: await request.text(),
+      headers: request.headers,
+    });
+  } catch (err) {
+    if (err instanceof ExtensionVerificationError) return new Response(null, { status: 401 });
+    throw err;
+  }
+
+  const { context } = ext;
+  if (context.point !== "booking.detail.panel") return new Response(null, { status: 404 });
+
+  if (!(await courtHasDoor(context.subject.id))) {
+    // Nothing relevant for this booking: CheckCourt shows no card at all.
+    return Response.json(ui.hidden());
+  }
+
+  if (ext.kind === "action" && ext.actionId === "door.open") {
+    await openDoor(context.subject.id);
+    return Response.json(ui.doc([ui.text("The door is open.")], { toast: toast.success("Door opened") }));
+  }
+
+  return Response.json(
+    ui.doc([
+      ui.heading("Court door"),
+      ui.row([ui.stat("Opened today", "12"), ui.badge("Online", "secondary")]),
+      ui.button("Open door", "door.open"),
+    ]),
+  );
+}
+```
+
+CheckCourt keeps a successful render for 30 seconds. Pass `maxAge` (seconds, at most 300,
+sent as `cache.max_age`) to change that for one answer, or `0` when the panel must always
+be fresh:
+
+```ts
+return Response.json(ui.doc([ui.stat("Battery", `${level} %`)], { maxAge: 0 }));
+```
+
+A `Cache-Control` response header (`no-store`, `max-age=N`) works too; `maxAge` wins when
+both are set. In your sandbox club nothing is cached.
+
+Compare `context.installation_id` and `context.tenant_id` with what you stored from
+`app.installed` before you act on a request. For the context token alone (for example in
+the backend of an iframe extension), use `verifyExtensionContext(token, secret)`.
+
+### OAuth with PKCE (member apps)
+
+```ts
+import { buildAuthorizeUrl, createPkcePair, createState, exchangeCode, parseAuthorizeCallback } from "@checkcourt/sdk";
+
+// 1. Redirect the member to CheckCourt
+const pkce = await createPkcePair();
+const state = createState();
+// keep pkce.verifier and state in the member's session
+const authorizeUrl = buildAuthorizeUrl({
+  clientId: process.env.CHECKCOURT_CLIENT_ID!,
+  redirectUri: "https://calendar.example.com/callback",
+  state,
+  codeChallenge: pkce.challenge,
+});
+
+// 2. In the callback, check state and exchange the code
+const { code } = parseAuthorizeCallback(new URL(callbackUrl), state);
+const tokens = await exchangeCode({
+  clientId: process.env.CHECKCOURT_CLIENT_ID!,
+  clientSecret: process.env.CHECKCOURT_CLIENT_SECRET!,
+  code,
+  redirectUri: "https://calendar.example.com/callback",
+  codeVerifier: pkce.verifier,
+});
+```
+
+Pass the stored tokens to `userAuth({ tokens, onTokens, … })`; it refreshes them with
+rotation and calls `onTokens` with every new set, which you must persist.
+
+### iframe extensions (browser)
+
+```ts
+import { connectExtensionFrame } from "@checkcourt/sdk/iframe";
+
+const frame = connectExtensionFrame(); // keeps the height in sync and applies the theme
+
+// Send frame.context to your backend and verify it there, never in the browser.
+await fetch("/api/session", { method: "POST", body: JSON.stringify({ context: frame.context }) });
+
+frame.toast("success", "Saved");
+frame.navigate("/booking?date=2026-10-07");
+```
+
+Import the browser entry point `@checkcourt/sdk/iframe` only; it needs no secrets.
+
+## Entry points
+
+| Import | Runs in | Contents |
+|---|---|---|
+| `@checkcourt/sdk` | Server | Everything except the iframe part |
+| `@checkcourt/sdk/oauth` | Server | OAuth and installation tokens |
+| `@checkcourt/sdk/webhooks` | Server, edge | Webhook verification and event types |
+| `@checkcourt/sdk/extensions` | Server, edge | Context tokens, request verification, UI builder |
+| `@checkcourt/sdk/manifest` | Anywhere | `defineManifest` and constants |
+| `@checkcourt/sdk/iframe` | Browser | `connectExtensionFrame` and messages |
+
+Client secrets, webhook secrets and refresh tokens belong on your server only.
+
+## Documentation
+
+Full guides and the API reference: <https://docs.checkcourt.de/docs/developer/sdk>
+
+## Versioning
+
+The SDK follows semantic versioning but is still in `0.x`: minor releases may contain
+breaking changes until 1.0. Pin a version and read the [changelog](CHANGELOG.md) before you
+upgrade.
+
+The exported constant `OPENAPI_SPEC_SHA256` is the SHA-256 of the spec the bundled types
+were generated from, in the form served at `https://app.checkcourt.de/api/v1/openapi`.
+Compare it with a hash of that response to see whether the platform has changed since this
+release.
+
+## Security
+
+Please do not report security issues in public GitHub issues. Report them privately to
+CheckCourt support at [support@checkcourt.de](mailto:support@checkcourt.de).
+
+## Contributing
+
+Bug reports and pull requests are welcome.
+
+```bash
+npm install
+npm run typecheck
+npm test
+npm run build
+```
+
+The API types in `src/generated/` are generated from the live OpenAPI spec:
+
+```bash
+npm run generate                                    # https://app.checkcourt.de/api/v1/openapi
+CHECKCOURT_OPENAPI=./openapi.json npm run generate  # a local file or another URL
+```
+
+The generated types follow the platform. A release may ship types for endpoints that are
+about to be deployed, so do not regenerate them in an unrelated pull request.
+
+### Releasing
+
+1. Bump `version` in `package.json` (`npm version <x.y.z> --no-git-tag-version`).
+2. Add the release to `CHANGELOG.md`.
+3. Run `npm run build` and commit, including the rebuilt `dist/`.
+4. Tag the commit `vX.Y.Z` and push the tag (`git push origin vX.Y.Z`).
+
+The release workflow checks that the tag matches the package version and that `dist/` is
+up to date, then publishes to npm with provenance via trusted publishing.
+
+## License
+
+[MIT](LICENSE)

package/dist/auth.d.ts

@@ -0,0 +1,54 @@
+import { type FetchLike, type InstallationToken, type UserTokenSet } from "./oauth.js";
+export interface AuthContext {
+    baseUrl?: string;
+    fetch?: FetchLike;
+}
+/**
+ * How the client gets its bearer token. Share one strategy object between clients (for example
+ * one per club via `tenantId`) to share its token cache and refresh lock.
+ */
+export interface AuthStrategy {
+    getAccessToken(context?: AuthContext): Promise<string>;
+    /** Called after a 401 with the token that failed; true if a retry with a fresh token can help. */
+    invalidate?(token: string): boolean;
+}
+/** A management (`ck_mgmt_…`) or personal (`ck_user_…`) API key. */
+export declare function apiKeyAuth(apiKey: string): AuthStrategy;
+interface CredentialOptions {
+    clientId: string;
+    clientSecret: string;
+    baseUrl?: string;
+    fetch?: FetchLike;
+    /** Renew this long before expiry. Default 60. */
+    refreshMarginSeconds?: number;
+}
+export interface InstallationAuth extends AuthStrategy {
+    /** The cached token, fetching one if needed. */
+    getToken(context?: AuthContext): Promise<InstallationToken>;
+}
+/** Club installation: exchanges client credentials for `cca_` tokens, cached until shortly before expiry. */
+export declare function installationAuth(options: CredentialOptions & {
+    installationId: string;
+}): InstallationAuth;
+/** What you need to persist per member; a full `UserTokenSet` fits too. */
+export type StoredUserTokens = Pick<UserTokenSet, "accessToken" | "refreshToken" | "expiresAt"> & Partial<Pick<UserTokenSet, "scope" | "installations">>;
+export interface UserAuth extends AuthStrategy {
+    /** The tokens currently in use (after any rotation). */
+    getTokens(): StoredUserTokens;
+    /** Forces a refresh now; concurrent calls share one request. */
+    refresh(context?: AuthContext): Promise<StoredUserTokens>;
+}
+/**
+ * Member connection (`ccu_` / `ccr_`). Refreshes shortly before expiry with rotation; concurrent
+ * requests share a single refresh so the chain is never reused. `onTokens` runs after every
+ * rotation and before the new token is used: persist there, the old refresh token is spent.
+ *
+ * Errors: `TokenRevokedError` (`invalid_grant`, also after the 180-day chain limit) is final for
+ * this strategy. `AppTemporarilyUnavailableError` leaves the tokens untouched; try again later.
+ * The lock is per process: refresh one member in one place at a time.
+ */
+export declare function userAuth(options: CredentialOptions & {
+    tokens: StoredUserTokens;
+    onTokens: (tokens: UserTokenSet) => void | Promise<void>;
+}): UserAuth;
+export {};

package/dist/auth.js

@@ -0,0 +1,96 @@
+import { TokenRevokedError } from "./errors.js";
+import { fetchInstallationToken, refreshTokens, } from "./oauth.js";
+/** A management (`ck_mgmt_…`) or personal (`ck_user_…`) API key. */
+export function apiKeyAuth(apiKey) {
+    return { getAccessToken: async () => apiKey };
+}
+/** Club installation: exchanges client credentials for `cca_` tokens, cached until shortly before expiry. */
+export function installationAuth(options) {
+    const margin = (options.refreshMarginSeconds ?? 60) * 1000;
+    let cached = null;
+    let inflight = null;
+    const getToken = async (context = {}) => {
+        if (cached && cached.expiresAt - margin > Date.now())
+            return cached;
+        inflight ??= fetchInstallationToken({
+            clientId: options.clientId,
+            clientSecret: options.clientSecret,
+            installationId: options.installationId,
+            baseUrl: options.baseUrl ?? context.baseUrl,
+            fetch: options.fetch ?? context.fetch,
+        })
+            .then((token) => (cached = token))
+            .finally(() => {
+            inflight = null;
+        });
+        return inflight;
+    };
+    return {
+        getToken,
+        getAccessToken: async (context) => (await getToken(context)).accessToken,
+        invalidate(token) {
+            if (cached?.accessToken === token)
+                cached = null;
+            return true;
+        },
+    };
+}
+/**
+ * Member connection (`ccu_` / `ccr_`). Refreshes shortly before expiry with rotation; concurrent
+ * requests share a single refresh so the chain is never reused. `onTokens` runs after every
+ * rotation and before the new token is used: persist there, the old refresh token is spent.
+ *
+ * Errors: `TokenRevokedError` (`invalid_grant`, also after the 180-day chain limit) is final for
+ * this strategy. `AppTemporarilyUnavailableError` leaves the tokens untouched; try again later.
+ * The lock is per process: refresh one member in one place at a time.
+ */
+export function userAuth(options) {
+    const margin = (options.refreshMarginSeconds ?? 60) * 1000;
+    let current = { ...options.tokens };
+    let revoked = null;
+    let inflight = null;
+    const refresh = (context = {}) => {
+        if (revoked)
+            return Promise.reject(revoked);
+        inflight ??= (async () => {
+            try {
+                const next = await refreshTokens({
+                    clientId: options.clientId,
+                    clientSecret: options.clientSecret,
+                    refreshToken: current.refreshToken,
+                    baseUrl: options.baseUrl ?? context.baseUrl,
+                    fetch: options.fetch ?? context.fetch,
+                });
+                current = next;
+                await options.onTokens(next);
+                return next;
+            }
+            catch (err) {
+                if (err instanceof TokenRevokedError)
+                    revoked = err;
+                throw err;
+            }
+        })().finally(() => {
+            inflight = null;
+        });
+        return inflight;
+    };
+    return {
+        getTokens: () => current,
+        refresh,
+        async getAccessToken(context) {
+            if (revoked)
+                throw revoked;
+            if (current.expiresAt - margin > Date.now())
+                return current.accessToken;
+            return (await refresh(context)).accessToken;
+        },
+        invalidate(token) {
+            if (revoked)
+                return false;
+            if (current.accessToken === token)
+                current = { ...current, expiresAt: 0 };
+            return true;
+        },
+    };
+}

package/dist/client.d.ts

@@ -0,0 +1,38 @@
+import { type Client } from "openapi-fetch";
+import type { AuthStrategy } from "./auth.js";
+import type { FetchLike } from "./oauth.js";
+import type { paths } from "./generated/schema.js";
+export declare const TENANT_HEADER = "X-Tenant-Id";
+export interface RetryOptions {
+    /** Retries after a 429. Default 2. */
+    maxRetries?: number;
+    /** Wait without `Retry-After`: this doubled per attempt. Default 1000. */
+    baseDelayMs?: number;
+    /** Longer waits are not attempted; the 429 is returned instead. Default 60000. */
+    maxDelayMs?: number;
+}
+export interface CheckCourtClientOptions {
+    /** Defaults to https://app.checkcourt.de; a trailing `/api/v1` is accepted. */
+    baseUrl?: string;
+    auth: AuthStrategy;
+    /** Sent as `X-Tenant-Id` unless a request sets its own. Needed for member tokens with several clubs and personal keys. */
+    tenantId?: string;
+    fetch?: FetchLike;
+    /** `false` disables retries on 429. */
+    retry?: RetryOptions | false;
+    headers?: Record<string, string>;
+}
+export type CheckCourtClient = Client<paths>;
+export declare function retryAfterMs(value: string | null, now?: number): number | null;
+/**
+ * Typed `/api/v1` client (openapi-fetch). Calls return `{ data, error, response }`; wrap them in
+ * `unwrap()` to get `data` or a thrown `CheckCourtApiError`. A 401 triggers one retry with a fresh
+ * token; 429 is retried with backoff, honouring `Retry-After`.
+ */
+export declare function createCheckCourtClient(options: CheckCourtClientOptions): CheckCourtClient;
+/** Returns `data` of an openapi-fetch call or throws `CheckCourtApiError` with status, code and message. */
+export declare function unwrap<T>(call: Promise<{
+    data?: T;
+    error?: unknown;
+    response: Response;
+}>): Promise<T>;

package/dist/client.js

@@ -0,0 +1,71 @@
+import createClient, {} from "openapi-fetch";
+import { CheckCourtApiError } from "./errors.js";
+import { normalizeBaseUrl } from "./internal/base-url.js";
+export const TENANT_HEADER = "X-Tenant-Id";
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+export function retryAfterMs(value, now = Date.now()) {
+    if (!value)
+        return null;
+    if (/^\d+$/.test(value.trim()))
+        return Number(value.trim()) * 1000;
+    const date = Date.parse(value);
+    return Number.isNaN(date) ? null : Math.max(0, date - now);
+}
+// Never awaited: under Next.js' patched fetch the body is a tee branch whose cancel() never settles.
+function discard(response) {
+    try {
+        response.body?.cancel().catch(() => { });
+    }
+    catch {
+        // Already consumed or locked: nothing to free.
+    }
+}
+/**
+ * Typed `/api/v1` client (openapi-fetch). Calls return `{ data, error, response }`; wrap them in
+ * `unwrap()` to get `data` or a thrown `CheckCourtApiError`. A 401 triggers one retry with a fresh
+ * token; 429 is retried with backoff, honouring `Retry-After`.
+ */
+export function createCheckCourtClient(options) {
+    const baseUrl = normalizeBaseUrl(options.baseUrl);
+    const doFetch = options.fetch ?? ((request) => fetch(request));
+    const retry = options.retry === false ? null : options.retry ?? {};
+    const maxRetries = retry?.maxRetries ?? 2;
+    const baseDelay = retry?.baseDelayMs ?? 1000;
+    const maxDelay = retry?.maxDelayMs ?? 60_000;
+    const context = { baseUrl, fetch: doFetch };
+    const authedFetch = async (request) => {
+        let retries = 0;
+        let reauthenticated = false;
+        for (;;) {
+            const attempt = request.clone();
+            const token = await options.auth.getAccessToken(context);
+            attempt.headers.set("Authorization", `Bearer ${token}`);
+            if (options.tenantId && !attempt.headers.has(TENANT_HEADER))
+                attempt.headers.set(TENANT_HEADER, options.tenantId);
+            const response = await doFetch(attempt);
+            if (response.status === 401 && !reauthenticated && options.auth.invalidate?.(token)) {
+                reauthenticated = true;
+                discard(response);
+                continue;
+            }
+            if (response.status === 429 && retry && retries < maxRetries) {
+                const delay = retryAfterMs(response.headers.get("Retry-After")) ?? baseDelay * 2 ** retries;
+                if (delay <= maxDelay) {
+                    retries += 1;
+                    discard(response);
+                    await sleep(delay);
+                    continue;
+                }
+            }
+            return response;
+        }
+    };
+    return createClient({ baseUrl: `${baseUrl}/api/v1`, fetch: authedFetch, headers: options.headers });
+}
+/** Returns `data` of an openapi-fetch call or throws `CheckCourtApiError` with status, code and message. */
+export async function unwrap(call) {
+    const { data, error, response } = await call;
+    if (error !== undefined || !response.ok)
+        throw CheckCourtApiError.fromBody(response.status, error, response);
+    return data;
+}

package/dist/errors.d.ts

@@ -0,0 +1,74 @@
+export type CheckCourtErrorKind = "CheckCourtError" | "CheckCourtApiError" | "OAuthError" | "TokenRevokedError" | "AppTemporarilyUnavailableError" | "WebhookSignatureError" | "ExtensionVerificationError";
+declare const KIND: unique symbol;
+/**
+ * Base class for every error the SDK throws on purpose. `instanceof` works across copies of the
+ * SDK (it checks a brand, not the prototype); `isCheckCourtError(err, kind)` does the same as a function.
+ */
+export declare class CheckCourtError extends Error {
+    static readonly [KIND]: CheckCourtErrorKind;
+    static [Symbol.hasInstance](this: {
+        [KIND]?: CheckCourtErrorKind;
+    }, value: unknown): boolean;
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+export type ApiErrorCode = "UNAUTHORIZED" | "VALIDATION" | "FORBIDDEN" | "NOT_FOUND" | "BUSINESS_RULE" | "RATE_LIMITED" | (string & {});
+/** A non-2xx answer from `/api/v1`. Branch on `code`; `message` is German and may change. */
+export declare class CheckCourtApiError extends CheckCourtError {
+    static readonly [KIND]: CheckCourtErrorKind;
+    readonly status: number;
+    readonly code: ApiErrorCode;
+    readonly response?: Response;
+    constructor(status: number, code: ApiErrorCode, message: string, response?: Response);
+    static fromBody(status: number, body: unknown, response?: Response): CheckCourtApiError;
+}
+/** An RFC 6749 error from `/api/oauth/*`, e.g. `invalid_client` or `slow_down`. */
+export declare class OAuthError extends CheckCourtError {
+    static readonly [KIND]: CheckCourtErrorKind;
+    readonly status: number;
+    readonly error: string;
+    readonly description: string;
+    constructor(status: number, error: string, description: string);
+}
+/**
+ * `invalid_grant`: the refresh token or code is dead (expired, revoked, reused, chain older than
+ * 180 days, member disconnected everywhere). Only a new authorization helps.
+ */
+export declare class TokenRevokedError extends OAuthError {
+    static readonly [KIND]: CheckCourtErrorKind;
+    constructor(status: number, error: string, description: string);
+}
+/**
+ * `temporarily_unavailable` on refresh: the grant is still valid but nothing may run right now
+ * (connection paused, app suspended, account banned). The refresh token was not consumed.
+ */
+export declare class AppTemporarilyUnavailableError extends OAuthError {
+    static readonly [KIND]: CheckCourtErrorKind;
+    constructor(status: number, error: string, description: string);
+}
+export declare function oauthErrorFrom(status: number, body: unknown): OAuthError;
+export type WebhookSignatureFailure = "missing_header" | "malformed_header" | "timestamp_out_of_tolerance" | "signature_mismatch" | "invalid_payload";
+export declare class WebhookSignatureError extends CheckCourtError {
+    static readonly [KIND]: CheckCourtErrorKind;
+    readonly reason: WebhookSignatureFailure;
+    constructor(reason: WebhookSignatureFailure, message: string);
+}
+export type ExtensionVerificationFailure = "malformed_token" | "unsupported_algorithm" | "invalid_signature" | "invalid_claims" | "expired" | "not_yet_valid" | "request_signature" | "invalid_body" | "context_mismatch";
+export declare class ExtensionVerificationError extends CheckCourtError {
+    static readonly [KIND]: CheckCourtErrorKind;
+    readonly reason: ExtensionVerificationFailure;
+    constructor(reason: ExtensionVerificationFailure, message: string);
+}
+interface ErrorKinds {
+    CheckCourtError: CheckCourtError;
+    CheckCourtApiError: CheckCourtApiError;
+    OAuthError: OAuthError;
+    TokenRevokedError: TokenRevokedError;
+    AppTemporarilyUnavailableError: AppTemporarilyUnavailableError;
+    WebhookSignatureError: WebhookSignatureError;
+    ExtensionVerificationError: ExtensionVerificationError;
+}
+/** True for errors from any copy of the SDK; with `kind`, also for that class or a subclass of it. */
+export declare function isCheckCourtError<K extends CheckCourtErrorKind = "CheckCourtError">(error: unknown, kind?: K): error is ErrorKinds[K];
+export {};