@dataships/sdk 0.0.0-stage → 2.0.1

package/dist/index.js

@@ -0,0 +1,763 @@
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), member.set(obj, value), value);
+var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
+
+// src/auth/headers.ts
+var SERVER_KEY_PREFIX = "ds_sk_";
+var isServerKey = (key) => key.startsWith(SERVER_KEY_PREFIX);
+var isServerKeyAuth = (auth) => "serverKey" in auth;
+var isUnsafeServerKeyAuth = (auth) => "unsafeServerKey" in auth;
+var isTokenProviderAuth = (auth) => typeof auth.getToken === "function";
+var resolveTokenProviderAuth = async (auth) => {
+  const token = await auth.getToken();
+  if (!token) {
+    throw new Error("DatashipsClient: auth.getToken() returned an empty token");
+  }
+  return { publicKey: auth.publicKey, token };
+};
+var UNSAFE_SERVER_KEY_APP_MARKER = "unsafe-server-key";
+var UNSAFE_SERVER_KEY_WARNING = "Dataships SDK: the merchant SERVER KEY is being used in the browser (auth.unsafeServerKey). Anyone who views this page's source can act as this merchant until the key is revoked. Mint a short-lived token on your server and pass auth: { publicKey, token } instead.";
+var assertBrowserAuth = (auth) => {
+  if (isUnsafeServerKeyAuth(auth)) {
+    if (!auth.unsafeServerKey || !isServerKey(auth.unsafeServerKey)) {
+      throw new Error(
+        "DatashipsClient: auth.unsafeServerKey must be a server key (ds_sk_\u2026); a public key belongs in auth: { publicKey, token }"
+      );
+    }
+    warnUnsafeServerKey();
+    return;
+  }
+  if (isServerKey(auth.publicKey)) {
+    throw new Error(
+      "DatashipsClient: a server key (ds_sk_\u2026) must never be used in the browser; use the public key with a merchant-signed token, or DatashipsServerClient from '@dataships/sdk/server' on your server"
+    );
+  }
+  const hasProvider = "getToken" in auth && auth.getToken !== void 0;
+  if (hasProvider && "token" in auth && auth.token !== void 0) {
+    throw new Error(
+      "DatashipsClient: pass either auth.token or auth.getToken, not both"
+    );
+  }
+  if (hasProvider) {
+    if (!isTokenProviderAuth(auth)) {
+      throw new Error("DatashipsClient: auth.getToken must be a function");
+    }
+    return;
+  }
+  if (!auth.token) {
+    throw new Error(
+      "DatashipsClient: auth.token is required with a public key (the merchant's server mints it), or auth.getToken to fetch one per request"
+    );
+  }
+};
+var warnUnsafeServerKey = () => {
+  const c = globalThis.console;
+  c?.warn?.(UNSAFE_SERVER_KEY_WARNING);
+};
+var authHeaders = (auth) => {
+  if (isUnsafeServerKeyAuth(auth)) return { "X-Api-Key": auth.unsafeServerKey };
+  return isServerKeyAuth(auth) ? { "X-Api-Key": auth.serverKey } : { "X-Api-Key": auth.publicKey, Authorization: `Bearer ${auth.token}` };
+};
+
+// src/baseUrl.ts
+var PRODUCTION_BASE_URL = "https://api.dataships.io";
+var resolveBaseUrl = (env = "production", baseUrl) => {
+  if (baseUrl) return baseUrl;
+  if (env === "production") return PRODUCTION_BASE_URL;
+  throw new Error(
+    `Dataships SDK: env "${env}" has no default base URL; pass \`baseUrl\``
+  );
+};
+
+// src/transport/retry.ts
+var TERMINAL_STATUSES = /* @__PURE__ */ new Set([
+  400,
+  401,
+  403,
+  404,
+  417,
+  422,
+  426
+]);
+var isTerminalStatus = (status) => status !== void 0 && TERMINAL_STATUSES.has(status);
+var CONSENT_SESSION_ALREADY_PROCESSED = "CONSENT_SESSION_ALREADY_PROCESSED";
+var TERMINAL_ERROR_CODES = /* @__PURE__ */ new Set([
+  CONSENT_SESSION_ALREADY_PROCESSED
+]);
+var isTerminalErrorCode = (errorCode) => errorCode !== void 0 && TERMINAL_ERROR_CODES.has(errorCode);
+var MAX_FAILURES = 4;
+var backoffMs = (failureCount) => failureCount >= MAX_FAILURES ? 0 : failureCount * 2e3;
+var defaultRetryPolicy = {
+  shouldRetry: (failureCount, status, errorCode) => !isTerminalStatus(status) && !isTerminalErrorCode(errorCode) && failureCount < MAX_FAILURES,
+  delayMs: backoffMs
+};
+var upsertSessionRetryPolicy = defaultRetryPolicy;
+var noRetryPolicy = {
+  shouldRetry: () => false,
+  delayMs: () => 0
+};
+
+// src/transport/errors.ts
+var DatashipsError = class extends Error {
+  constructor(args) {
+    super(`Dataships request failed (${args.status || "network"})`);
+    this.name = "DatashipsError";
+    this.status = args.status;
+    this.body = args.body;
+    this.challenge = args.challenge ?? null;
+    this.code = errorCodeFromBody(args.body);
+    this.reason = reasonFromBody(args.body);
+  }
+  /** 401 (missing / refused credential) or 403 (unknown, revoked or disabled key). */
+  get isAuthenticationFailure() {
+    return this.status === 401 || this.status === 403;
+  }
+  /** 409 `CONSENT_SESSION_ALREADY_PROCESSED`: the session is closed; no later call on it can succeed. */
+  get isSessionProcessed() {
+    return this.code === CONSENT_SESSION_ALREADY_PROCESSED;
+  }
+};
+var errorCodeFromBody = (body) => {
+  if (typeof body !== "object" || body === null) return null;
+  const errors = body.errors;
+  if (!Array.isArray(errors)) return null;
+  const code = errors[0]?.code;
+  return typeof code === "string" ? code : null;
+};
+var reasonFromBody = (body) => {
+  if (typeof body !== "object" || body === null) return null;
+  const message = body.message;
+  return typeof message === "string" && message.length > 0 ? message : null;
+};
+
+// src/session/consentSession.ts
+var CONSENT_SESSION_START_PATH = "/v1/consent-session";
+var CONSENT_SESSION_CONSENT_PATH = "/v1/consent-session/consent";
+var CONSENT_SESSION_HEARTBEAT_PATH = "/v1/consent-session/heartbeat";
+var CONSENT_SESSION_TRIGGER_VERIFICATION_CODE_PATH = "/v1/consent-session/trigger-verification-code";
+var CONSENT_SESSION_SUBMIT_VERIFICATION_CODE_PATH = "/v1/consent-session/submit-verification-code";
+var CONSENT_SESSION_SUBMIT_PATH = "/v1/consent-session/submit";
+var COUNTRY_NOT_FOUND_CODE = "COUNTRY_NOT_FOUND";
+var SUBMIT_VERIFICATION_CODE_ERROR_CODES = [
+  "CODE_EXPIRED",
+  "CODE_INVALID",
+  "NUMBER_MAX_ATTEMPTS_EXCEEDED"
+];
+var verificationErrorCodeFromBody = errorCodeFromBody;
+var buildUpsertRequest = (args) => ({
+  identifier: args.identifier,
+  identifierType: args.identifierType,
+  locale: args.locale,
+  ...args.userIp ? { userIp: args.userIp } : {},
+  ...args.format ? { format: args.format } : {},
+  integration: {
+    ...args.context,
+    type: args.integrationType
+  }
+});
+var isCountryNotFound = (error) => error.status === 422 && error.code === COUNTRY_NOT_FOUND_CODE;
+var emptyUpsertResponse = () => ({
+  consentSessionId: null,
+  consents: [],
+  userVerificationRequired: null,
+  lastHeartbeat: null,
+  identifier: null
+});
+var buildSaveConsentRequest = (args) => ({
+  consentSessionId: args.consentSessionId,
+  channel: args.channel,
+  consent: args.consent
+});
+var buildHeartbeatRequest = (args) => ({
+  consentSessionId: args.consentSessionId
+});
+var buildTriggerVerificationCodeRequest = (args) => ({
+  consentSessionId: args.consentSessionId
+});
+var buildSubmitVerificationCodeRequest = (args) => ({
+  consentSessionId: args.consentSessionId,
+  verificationCode: args.verificationCode,
+  referenceId: args.referenceId
+});
+var buildSubmitRequest = (args) => {
+  const details = { ...args.details };
+  if (details.submittedAt instanceof Date) details.submittedAt = details.submittedAt.toISOString();
+  if (typeof details.billingCountryCode === "string") {
+    details.billingCountryCode = details.billingCountryCode.trim().toUpperCase();
+  }
+  return {
+    datashipsSessionId: args.datashipsSessionId,
+    user: normaliseSubmitUser(args.user),
+    integration: { ...details, type: args.integrationType }
+  };
+};
+var normaliseSubmitUser = (user) => {
+  const firstName = user?.firstName?.trim() ?? "";
+  const lastName = user?.lastName?.trim() ?? "";
+  if (!firstName || !lastName) {
+    throw new Error(
+      "submitSession: user.firstName and user.lastName are required (core-api refuses a blank name)"
+    );
+  }
+  return { firstName, lastName };
+};
+
+// src/session/operations.ts
+var upsertSession = async (args) => {
+  const { adapter, input } = args;
+  const identifier = input.identifier ?? (await adapter.getIdentifier(input.identifierType)).identifier;
+  const context = await adapter.getSessionContext();
+  const body = buildUpsertRequest({
+    integrationType: adapter.integrationType,
+    locale: adapter.getLocale(),
+    identifier,
+    identifierType: input.identifierType,
+    userIp: input.userIp,
+    format: input.format,
+    context
+  });
+  try {
+    const response = await args.post({
+      path: CONSENT_SESSION_START_PATH,
+      body,
+      retry: args.retry
+    });
+    return response ?? emptyUpsertResponse();
+  } catch (error) {
+    if (error instanceof DatashipsError && isCountryNotFound(error)) {
+      return emptyUpsertResponse();
+    }
+    throw error;
+  }
+};
+var saveConsent = (args) => args.post({
+  path: CONSENT_SESSION_CONSENT_PATH,
+  body: buildSaveConsentRequest({
+    consentSessionId: args.consentSessionId,
+    channel: args.channel,
+    consent: args.consent
+  }),
+  retry: args.retry
+});
+var heartbeat = (args) => args.post({
+  path: CONSENT_SESSION_HEARTBEAT_PATH,
+  body: buildHeartbeatRequest({ consentSessionId: args.consentSessionId }),
+  retry: args.retry
+});
+var triggerVerificationCode = (args) => args.post({
+  path: CONSENT_SESSION_TRIGGER_VERIFICATION_CODE_PATH,
+  body: buildTriggerVerificationCodeRequest({
+    consentSessionId: args.consentSessionId
+  }),
+  retry: noRetryPolicy
+});
+var submitVerificationCode = async (args) => {
+  try {
+    await args.post({
+      path: CONSENT_SESSION_SUBMIT_VERIFICATION_CODE_PATH,
+      body: buildSubmitVerificationCodeRequest({
+        consentSessionId: args.consentSessionId,
+        verificationCode: args.verificationCode,
+        referenceId: args.referenceId
+      }),
+      retry: noRetryPolicy
+    });
+    return { verified: true, errorCode: null };
+  } catch (error) {
+    if (error instanceof DatashipsError && error.status === 400) {
+      return {
+        verified: false,
+        errorCode: verificationErrorCodeFromBody(error.body)
+      };
+    }
+    throw error;
+  }
+};
+var submitSession = async (args) => {
+  const { adapter, input } = args;
+  const datashipsSessionId = input.datashipsSessionId ?? adapter.getDatashipsSessionId?.();
+  if (!datashipsSessionId) {
+    throw new Error(
+      "submitSession: datashipsSessionId is required; this adapter holds no beacon of its own"
+    );
+  }
+  await args.post({
+    path: CONSENT_SESSION_SUBMIT_PATH,
+    body: buildSubmitRequest({
+      datashipsSessionId,
+      integrationType: adapter.integrationType,
+      user: input.user,
+      details: input.details
+    }),
+    retry: args.retry
+  });
+  if (input.datashipsSessionId === void 0 && input.resetBeacon !== false) {
+    adapter.resetDatashipsSessionId?.();
+  }
+};
+
+// src/transport/fetch.ts
+var postJson = async ({
+  url,
+  headers,
+  body,
+  fetch,
+  retry
+}) => {
+  let attempt = 0;
+  while (true) {
+    let response;
+    let networkError;
+    const attemptHeaders = typeof headers === "function" ? await headers() : headers;
+    try {
+      response = await fetch(url, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...attemptHeaders },
+        body: JSON.stringify(body)
+      });
+    } catch (err) {
+      networkError = err;
+    }
+    const status = response?.status;
+    const ok = response?.ok ?? false;
+    if (ok && response) {
+      const text = await response.text();
+      return text ? JSON.parse(text) : void 0;
+    }
+    const errorBody = response ? await readBody(response) : null;
+    const errorCode = errorCodeFromBody(errorBody) ?? void 0;
+    if (!retry.shouldRetry(attempt, status, errorCode)) {
+      if (networkError) throw networkError;
+      throw new DatashipsError({
+        status: status ?? 0,
+        body: errorBody,
+        challenge: response?.headers.get("WWW-Authenticate") ?? null
+      });
+    }
+    attempt += 1;
+    const delay = retry.delayMs(attempt);
+    if (delay > 0) await new Promise((r) => setTimeout(r, delay));
+  }
+};
+var readBody = async (response) => {
+  const text = await response.text();
+  if (!text) return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+};
+
+// src/client.ts
+var DEFAULT_HEARTBEAT_INTERVAL_MS = 210 * 1e3;
+var DEFAULT_HEARTBEAT_DURATION_MS = 10 * 60 * 1e3;
+var _auth, _fetch, _upsertSessionRetry, _defaultRetry, _DatashipsClient_instances, previewUpsertResponse_fn, credentialHeaders_fn, requireAuth_fn, requireConsentSessionId_fn, sendHeartbeat_fn, post_fn;
+var DatashipsClient = class {
+  constructor(opts) {
+    __privateAdd(this, _DatashipsClient_instances);
+    __privateAdd(this, _auth);
+    __privateAdd(this, _fetch);
+    __privateAdd(this, _upsertSessionRetry);
+    __privateAdd(this, _defaultRetry);
+    this.adapter = opts.adapter;
+    if (opts.auth) assertBrowserAuth(opts.auth);
+    if (!opts.auth && !opts.adapter.previewMode) {
+      throw new Error(
+        "DatashipsClient: `auth: { publicKey, token }` (or `{ publicKey, getToken }`) is required unless the adapter runs in preview mode"
+      );
+    }
+    this.publicKey = opts.auth && !isUnsafeServerKeyAuth(opts.auth) ? opts.auth.publicKey : null;
+    __privateSet(this, _auth, opts.auth ?? null);
+    this.app = opts.app;
+    this.version = opts.version;
+    this.baseUrl = resolveBaseUrl(opts.env, opts.baseUrl);
+    __privateSet(this, _fetch, opts.fetch ?? globalThis.fetch.bind(globalThis));
+    __privateSet(this, _upsertSessionRetry, opts.retry?.upsertSession ?? upsertSessionRetryPolicy);
+    __privateSet(this, _defaultRetry, opts.retry?.default ?? defaultRetryPolicy);
+  }
+  /** The credentials in use, or null for a preview-mode client constructed without them. */
+  get auth() {
+    return __privateGet(this, _auth);
+  }
+  /** Whether this client runs on the unsafe server-key escape hatch. */
+  get isUnsafeServerKey() {
+    return __privateGet(this, _auth) !== null && isUnsafeServerKeyAuth(__privateGet(this, _auth));
+  }
+  /**
+   * Replace the Bearer token before it expires. The next call and any running
+   * heartbeat use it; a missed rotation surfaces as a 401 on the next call.
+   * Not applicable under `auth.getToken`, which already fetches one per request.
+   */
+  setToken(token) {
+    if (!__privateGet(this, _auth)) {
+      throw new Error(
+        "DatashipsClient: setToken() requires a client constructed with `auth`"
+      );
+    }
+    if (isUnsafeServerKeyAuth(__privateGet(this, _auth))) {
+      throw new Error(
+        "DatashipsClient: setToken() does not apply under auth.unsafeServerKey; there is no token to rotate"
+      );
+    }
+    if (isTokenProviderAuth(__privateGet(this, _auth))) {
+      throw new Error(
+        "DatashipsClient: setToken() does not apply under auth.getToken; the provider is called before every request"
+      );
+    }
+    if (!token) {
+      throw new Error("DatashipsClient: token must be a non-empty string");
+    }
+    __privateSet(this, _auth, { ...__privateGet(this, _auth), token });
+  }
+  /**
+   * Open or update the consent session for one identifier type
+   * (`POST /v1/consent-session`, contract v2). The client only states which
+   * identifier type it holds; the server decides the channels and returns one
+   * entry per channel to render. An empty `consents` means render nothing:
+   * that also covers a 204 No Content (a surface that never collects, no
+   * eligible channel, or a checkout that already asked on an earlier step) and
+   * a user IP the API could not geolocate (422 COUNTRY_NOT_FOUND), both of
+   * which resolve instead of throwing.
+   */
+  async upsertSession(input) {
+    const preview = __privateMethod(this, _DatashipsClient_instances, previewUpsertResponse_fn).call(this, input.identifierType, input.format);
+    if (preview) return preview;
+    return upsertSession({
+      adapter: this.adapter,
+      input,
+      post: __privateMethod(this, _DatashipsClient_instances, post_fn).bind(this),
+      retry: __privateGet(this, _upsertSessionRetry)
+    });
+  }
+  async saveConsent(input) {
+    if (this.adapter.previewMode) return;
+    await saveConsent({
+      consentSessionId: __privateMethod(this, _DatashipsClient_instances, requireConsentSessionId_fn).call(this, input.session),
+      channel: input.channel,
+      consent: input.consent,
+      post: __privateMethod(this, _DatashipsClient_instances, post_fn).bind(this),
+      retry: __privateGet(this, _defaultRetry)
+    });
+  }
+  /**
+   * Ask the backend to send an OTP verification code to the phone-channel
+   * session's number. `referenceId` must be echoed back on
+   * {@link submitVerificationCode}. Never retried — a retry could send the
+   * buyer duplicate codes.
+   *
+   * In preview mode no code is sent and `{ userVerificationTriggered: false }` is
+   * returned, mirroring a store without verification enabled.
+   */
+  async triggerVerificationCode(input) {
+    if (this.adapter.previewMode) {
+      return {
+        userVerificationTriggered: false,
+        referenceId: null,
+        codeLength: null,
+        resendAfterSeconds: null
+      };
+    }
+    return triggerVerificationCode({
+      consentSessionId: input.consentSessionId,
+      post: __privateMethod(this, _DatashipsClient_instances, post_fn).bind(this)
+    });
+  }
+  /**
+   * Submit the OTP code the buyer received. Resolves
+   * `{ verified: true, errorCode: null }` on 2xx. A 400 rejection resolves
+   * `{ verified: false, errorCode }` with the body's `errors[0].code` (see
+   * `SUBMIT_VERIFICATION_CODE_ERROR_CODES`), or `null` when the body carries
+   * none. Any other failure throws. Never retried — a rejection is definitive.
+   *
+   * In preview mode resolves verified without a network call.
+   */
+  async submitVerificationCode(input) {
+    if (this.adapter.previewMode) return { verified: true, errorCode: null };
+    return submitVerificationCode({
+      ...input,
+      post: __privateMethod(this, _DatashipsClient_instances, post_fn).bind(this)
+    });
+  }
+  /**
+   * Complete the sessions opened under a beacon: the placed order (or the
+   * flow's equivalent) lands on every sibling session and processing is
+   * queued (`POST /v1/consent-session/submit`).
+   *
+   * `user.firstName` / `lastName` are required (the backend refuses a blank
+   * name; the SDK refuses it before sending). The beacon defaults to the
+   * adapter's own `datashipsSessionId`, which is then discarded once the
+   * submit is accepted. Idempotent on the backend; a
+   * beacon that matches no session is accepted silently. Retried on 409 and
+   * server errors like any other call.
+   *
+   * In preview mode nothing is sent; the beacon is still discarded so a
+   * styled sandbox behaves like a real checkout.
+   */
+  async submitSession(input) {
+    const adapter = this.adapter;
+    if (adapter.previewMode) {
+      if (input.datashipsSessionId === void 0 && input.resetBeacon !== false) {
+        adapter.resetDatashipsSessionId?.();
+      }
+      return;
+    }
+    await submitSession({
+      adapter,
+      input,
+      post: __privateMethod(this, _DatashipsClient_instances, post_fn).bind(this),
+      retry: __privateGet(this, _defaultRetry)
+    });
+  }
+  /**
+   * Begin a periodic heartbeat. Returns an idempotent stop function. The
+   * scheduler stops itself at the duration limit, when the credential is
+   * refused (401 / 403) and when the session has already been processed; every
+   * failure is reported through `onError`.
+   */
+  startHeartbeat(session, opts = {}) {
+    if (this.adapter.previewMode) return () => {
+    };
+    const intervalMs = opts.intervalMs ?? DEFAULT_HEARTBEAT_INTERVAL_MS;
+    const durationMs = opts.durationMs ?? DEFAULT_HEARTBEAT_DURATION_MS;
+    const startedAt = Date.now();
+    let stopped = false;
+    const stop = () => {
+      if (stopped) return;
+      stopped = true;
+      clearInterval(handle);
+    };
+    const handle = setInterval(() => {
+      if (Date.now() - startedAt >= durationMs) {
+        stop();
+        return;
+      }
+      __privateMethod(this, _DatashipsClient_instances, sendHeartbeat_fn).call(this, session).catch((error) => {
+        opts.onError?.(error);
+        if (error instanceof DatashipsError && (error.isAuthenticationFailure || error.isSessionProcessed)) {
+          stop();
+        }
+      });
+    }, intervalMs);
+    return stop;
+  }
+};
+_auth = new WeakMap();
+_fetch = new WeakMap();
+_upsertSessionRetry = new WeakMap();
+_defaultRetry = new WeakMap();
+_DatashipsClient_instances = new WeakSet();
+/**
+ * In preview mode, return the adapter's synthetic upsert response so the
+ * widget can be styled without live calls. Returns null when the adapter is
+ * live (or hasn't opted in), in which case the caller proceeds with the real
+ * network request.
+ */
+previewUpsertResponse_fn = function(identifierType, format) {
+  if (this.adapter.previewMode && this.adapter.getPreviewUpsertResponse) {
+    return this.adapter.getPreviewUpsertResponse(identifierType, format);
+  }
+  return null;
+};
+credentialHeaders_fn = async function() {
+  const auth = __privateMethod(this, _DatashipsClient_instances, requireAuth_fn).call(this);
+  return authHeaders(
+    isTokenProviderAuth(auth) ? await resolveTokenProviderAuth(auth) : auth
+  );
+};
+requireAuth_fn = function() {
+  if (!__privateGet(this, _auth)) {
+    throw new Error(
+      "DatashipsClient: no credentials configured; pass `auth: { publicKey, token }`"
+    );
+  }
+  return __privateGet(this, _auth);
+};
+requireConsentSessionId_fn = function(session) {
+  if (!session.consentSessionId) {
+    throw new Error(
+      "DatashipsClient: consentSessionId is required"
+    );
+  }
+  return session.consentSessionId;
+};
+sendHeartbeat_fn = async function(session) {
+  await heartbeat({
+    consentSessionId: __privateMethod(this, _DatashipsClient_instances, requireConsentSessionId_fn).call(this, session),
+    post: __privateMethod(this, _DatashipsClient_instances, post_fn).bind(this),
+    retry: __privateGet(this, _defaultRetry)
+  });
+};
+post_fn = async function(args) {
+  const staticHeaders = {
+    // The marker lets the backend tell an exposed key in a page from a genuine server call.
+    "X-Dataships-App": `${this.app} (SDK: ${this.adapter.name}${this.isUnsafeServerKey ? `; ${UNSAFE_SERVER_KEY_APP_MARKER}` : ""})`,
+    "X-Dataships-Version": `${this.version} (SDK: ${"2.0.1"})`
+  };
+  return postJson({
+    url: `${this.baseUrl}${args.path}`,
+    // Resolved per attempt so a token provider hands every retry a fresh token.
+    headers: async () => ({
+      ...await __privateMethod(this, _DatashipsClient_instances, credentialHeaders_fn).call(this),
+      ...staticHeaders
+    }),
+    body: args.body,
+    fetch: __privateGet(this, _fetch),
+    retry: args.retry
+  });
+};
+
+// src/utils/sha256.ts
+var sha256Hex = async (input) => {
+  const buf = new TextEncoder().encode(input);
+  const digest = await crypto.subtle.digest("SHA-256", buf);
+  return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, "0")).join("");
+};
+
+// src/utils/uuid.ts
+var randomUuid = (cryptoObj = globalThis.crypto) => {
+  if (cryptoObj && typeof cryptoObj.randomUUID === "function") {
+    return cryptoObj.randomUUID();
+  }
+  const bytes = new Uint8Array(16);
+  if (cryptoObj && typeof cryptoObj.getRandomValues === "function") {
+    cryptoObj.getRandomValues(bytes);
+  } else {
+    for (let i = 0; i < 16; i++) bytes[i] = Math.floor(Math.random() * 256);
+  }
+  bytes[6] = bytes[6] & 15 | 64;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, "0"));
+  return hex.slice(0, 4).join("") + "-" + hex.slice(4, 6).join("") + "-" + hex.slice(6, 8).join("") + "-" + hex.slice(8, 10).join("") + "-" + hex.slice(10, 16).join("");
+};
+
+// src/session/previewUpsertResponse.ts
+var DEFAULT_EMAIL_OPT_IN_TEXT = "We would like to email you news and promotions. Tick to opt in.";
+var DEFAULT_EMAIL_OPT_IN_CONSENT_DESCRIPTION = "Click here for an overview of how your personal data is processed for marketing purposes or see our Privacy Policy for further information.";
+var DEFAULT_SMS_OPT_IN_TEXT = "We would like to text you news and promotions. Tick to opt in.";
+var DEFAULT_SMS_OPT_IN_CONSENT_DESCRIPTION = "Based on the channel preferences set above, you agree to receive recurring automated marketing messages (e.g. AI content, cart reminders) from {{COMPANY_NAME}} at the number you provide. Consent is not a condition of purchase. We may share info with service providers per our Privacy Policy. Reply STOP to cancel or click the unsubscribe link (where available). For help reply HELP or email {{PRIVACY_EMAIL}}. Msg frequency varies. Msg & data rates may apply. By proceeding, you also agree to our Terms of Service (incl. arbitration) & Privacy Policy.";
+var fakeEmailUpsertResponse = {
+  consentSessionId: "01HQB3QRZVV0737R0R25BTQBGF",
+  consents: [
+    {
+      channel: "EMAIL",
+      consentType: "OPT_IN",
+      checked: false,
+      widgetConfig: {
+        text: DEFAULT_EMAIL_OPT_IN_TEXT,
+        consentDescription: DEFAULT_EMAIL_OPT_IN_CONSENT_DESCRIPTION,
+        marketingInformation: '<h1>Marketing Information</h1>\n<p>We may send you direct marketing communications, product information and promotional offers. You can withdraw your consent at any time. See our <a href="https://dataships.io/privacy-centre">Privacy Policy</a> or contact us at <a href="mailto:privacy@example.com">privacy@example.com</a> for further information.</p>\n',
+        policyURL: "https://dataships.io/privacy-centre",
+        mobileTermsOfServiceURL: null,
+        privacyEmail: "privacy@example.com",
+        placeholderValues: null
+      }
+    }
+  ],
+  userVerificationRequired: null,
+  lastHeartbeat: "2026-06-17T00:00:00Z",
+  identifier: null
+};
+var fakePhoneUpsertResponse = {
+  consentSessionId: "01HQB3QRZVV0737R0R25BTQBGG",
+  consents: [
+    {
+      channel: "SMS",
+      consentType: "OPT_IN",
+      checked: false,
+      widgetConfig: {
+        text: DEFAULT_SMS_OPT_IN_TEXT,
+        consentDescription: DEFAULT_SMS_OPT_IN_CONSENT_DESCRIPTION,
+        marketingInformation: '<h1>Marketing Information</h1>\n<p>We may send you marketing text messages about products and promotional offers. Message frequency varies. You can withdraw your consent at any time by replying STOP. See our <a href="https://dataships.io/privacy-centre">Privacy Policy</a> or contact us at <a href="mailto:privacy@example.com">privacy@example.com</a> for further information.</p>\n',
+        policyURL: "https://dataships.io/privacy-centre",
+        mobileTermsOfServiceURL: "https://dataships.io/mobile-terms",
+        privacyEmail: "privacy@example.com",
+        placeholderValues: null
+      }
+    }
+  ],
+  userVerificationRequired: false,
+  lastHeartbeat: "2026-06-17T00:00:00Z",
+  identifier: null
+};
+var MARKETING_MODAL_HREF = "#dataships-marketing-modal";
+var CHECKBOX_LABEL_BOLD_PHRASES = ["consent", "object", "opt in", "opt out", "STOP", "HELP"];
+var CONSENT_DESCRIPTION_BOLD_PHRASES = ["STOP", "HELP"];
+var escapeHtml = (text) => text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+var escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var wrapPhrase = (html, phrase, wrap) => html.replace(
+  new RegExp(`${escapeRegExp(escapeHtml(phrase))}(?![^<]*>)(?![^<]*</a>)`, "gi"),
+  wrap
+);
+var toHtmlCopy = (text, widgetConfig, boldPhrases) => {
+  let html = escapeHtml(text);
+  const links = [
+    ["Terms of Service", widgetConfig.mobileTermsOfServiceURL],
+    ["Privacy Policy", widgetConfig.policyURL],
+    ["Click here", MARKETING_MODAL_HREF]
+  ];
+  for (const [phrase, href] of links) {
+    if (!href) continue;
+    html = wrapPhrase(html, phrase, (match) => `<a href="${escapeHtml(href)}">${match}</a>`);
+  }
+  for (const phrase of boldPhrases) {
+    html = wrapPhrase(html, phrase, (match) => `<strong>${match}</strong>`);
+  }
+  return `<p>${html}</p>`;
+};
+var withHtmlCopy = (response) => ({
+  ...response,
+  consents: response.consents.map((consent) => {
+    const { widgetConfig } = consent;
+    return {
+      ...consent,
+      widgetConfig: {
+        ...widgetConfig,
+        text: widgetConfig.text === null ? null : toHtmlCopy(widgetConfig.text, widgetConfig, CHECKBOX_LABEL_BOLD_PHRASES),
+        consentDescription: widgetConfig.consentDescription === null ? null : toHtmlCopy(
+          widgetConfig.consentDescription,
+          widgetConfig,
+          CONSENT_DESCRIPTION_BOLD_PHRASES
+        )
+      }
+    };
+  })
+});
+var previewUpsertResponse = (identifierType, format = "json") => {
+  const response = identifierType === "PHONE" ? fakePhoneUpsertResponse : fakeEmailUpsertResponse;
+  return format === "html" ? withHtmlCopy(response) : response;
+};
+
+// src/types.ts
+var SUPPORTED_LOCALES = [
+  "en",
+  "es",
+  "de",
+  "pt",
+  "ro",
+  "hr",
+  "da",
+  "fi",
+  "fr",
+  "hu",
+  "it",
+  "nb",
+  "pl",
+  "sk",
+  "sv",
+  "nl",
+  "el",
+  "cs",
+  "zh",
+  "ja",
+  "is"
+];
+
+export { CONSENT_SESSION_ALREADY_PROCESSED, CONSENT_SESSION_SUBMIT_PATH, COUNTRY_NOT_FOUND_CODE, DatashipsClient, DatashipsError, DatashipsError as DatashipsHttpError, SUBMIT_VERIFICATION_CODE_ERROR_CODES, SUPPORTED_LOCALES, UNSAFE_SERVER_KEY_APP_MARKER, UNSAFE_SERVER_KEY_WARNING, authHeaders, buildSubmitRequest, defaultRetryPolicy, fakeEmailUpsertResponse, fakePhoneUpsertResponse, noRetryPolicy, normaliseSubmitUser, previewUpsertResponse, randomUuid, sha256Hex, upsertSessionRetryPolicy, verificationErrorCodeFromBody };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map