@decentrys/dri-sdk 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Decentrys Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,48 @@
+# @decentrys/dri-sdk
+
+Digital Recovery Intelligence: fund tracing, attribution, intervention points
+and evidence packages.
+
+## Install
+
+```bash
+npm install @decentrys/dri-sdk
+```
+
+## What this is not
+
+Decentrys **never takes custody of assets**, and does not freeze, seize,
+transmit or return anything. It is not a law firm, a law enforcement agency or
+a licensed recovery agent, and nothing it returns is legal advice.
+
+The **Recovery Index is an analytical estimate** produced by a versioned model
+from the evidence in a case. It is not a prediction, a guarantee, or a promised
+recovery rate. Every response carries that disclaimer, and the client throws
+`MissingDisclosureError` if one ever arrives without it.
+
+## Use
+
+```ts
+const investigation = await dri.createInvestigation({ ... });
+await dri.traceFunds(investigation.id);           // one address, one hop
+const points = await dri.identifyInterventionPoints(investigation.id);
+```
+
+Intervention points separate `CUSTODIAL` from `CROSS_CHAIN`: a custodian holds
+the value, a bridge operator holds records of value that has moved on.
+Collapsing them sends legal budget after a paper trail.
+
+Attribution beyond a mixer is inference and is labelled as inference. An
+indirect connection is an observation about a counterparty, never an
+accusation about a person.
+
+**Secret keys only** — an investigation names third parties.
+
+## Licence
+
+MIT © Decentrys Labs
+
+## Links
+
+- [decentrys.com](https://decentrys.com) · [SDK overview](https://decentrys.com/sdk) · [Developer API](https://decentrys.com/developers)
+- Source: [github.com/teamdecentrys-byte/Decentrys](https://github.com/teamdecentrys-byte/Decentrys)

package/dist/browser/decentrys-dri.js

@@ -0,0 +1,290 @@
+"use strict";
+var DecentrysDri = (() => {
+  var __defProp = Object.defineProperty;
+  var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+  var __getOwnPropNames = Object.getOwnPropertyNames;
+  var __hasOwnProp = Object.prototype.hasOwnProperty;
+  var __export = (target, all) => {
+    for (var name in all)
+      __defProp(target, name, { get: all[name], enumerable: true });
+  };
+  var __copyProps = (to, from, except, desc) => {
+    if (from && typeof from === "object" || typeof from === "function") {
+      for (let key of __getOwnPropNames(from))
+        if (!__hasOwnProp.call(to, key) && key !== except)
+          __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+    }
+    return to;
+  };
+  var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+  // src/index.ts
+  var index_exports = {};
+  __export(index_exports, {
+    DecentrysDri: () => DecentrysDri,
+    DriError: () => DriError,
+    MissingDisclosureError: () => MissingDisclosureError,
+    RECOVERY_BANDS: () => RECOVERY_BANDS,
+    SDK_VERSION: () => SDK_VERSION,
+    assertAnalyticalDisclosure: () => assertAnalyticalDisclosure,
+    custodialPoints: () => custodialPoints,
+    inferredPoints: () => inferredPoints
+  });
+
+  // src/model.ts
+  var RECOVERY_BANDS = ["HIGH", "MODERATE", "LOW", "VERY_LOW"];
+  var MissingDisclosureError = class extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "MissingDisclosureError";
+    }
+  };
+  function assertAnalyticalDisclosure(index) {
+    if (index.analyticalOnly !== true) {
+      throw new MissingDisclosureError(
+        "This Recovery Index is not marked analytical-only. The Recovery Index is an analytical estimate and never a predicted recovery rate; refusing to hand back a score that does not say so."
+      );
+    }
+    if (typeof index.disclaimer !== "string" || index.disclaimer.trim().length === 0) {
+      throw new MissingDisclosureError(
+        "This Recovery Index arrived without its disclaimer. The disclaimer travels with the score by design, because a score shown without it is read as a promise of recovery."
+      );
+    }
+    return index;
+  }
+  function custodialPoints(analysis) {
+    return analysis.interventionPoints.filter((point) => point.kind === "CUSTODIAL");
+  }
+  function inferredPoints(analysis) {
+    return analysis.interventionPoints.filter((point) => !point.observedPath);
+  }
+
+  // src/client.ts
+  var SDK_VERSION = "0.1.0";
+  var DEFAULT_BASE_URL = "https://api.decentrys.com";
+  var DEFAULT_TIMEOUT_MS = 3e4;
+  var DriError = class extends Error {
+    constructor(status, message, code) {
+      super(message);
+      this.status = status;
+      this.code = code;
+      this.name = "DriError";
+    }
+    status;
+    code;
+  };
+  var DecentrysDri = class {
+    baseUrl;
+    apiKey;
+    timeoutMs;
+    fetchImpl;
+    constructor(config) {
+      if (!config.apiKey?.trim()) {
+        throw new Error("DRI: an apiKey is required. Create one at https://decentrys.com/developers.");
+      }
+      if (config.apiKey.startsWith("dk_pub_")) {
+        throw new Error(
+          "DRI: that is a publishable key. An investigation names third parties, and that must never run behind a credential shipped inside a client where anyone who downloads it can read it. Use a secret key, server-side."
+        );
+      }
+      this.apiKey = config.apiKey;
+      this.baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+      this.timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+      this.fetchImpl = config.fetch ?? resolveFetch();
+    }
+    // --- Investigations ------------------------------------------------------
+    /**
+     * Open an investigation seeded on one address.
+     *
+     * Nothing is traced yet. The seed node exists so the graph has a root before
+     * any chain call is made, which means a case can be opened and worked on
+     * even while a provider is unreachable.
+     */
+    createInvestigation(input) {
+      return this.request("POST", "/v1/dri/investigations", {
+        title: input.title,
+        chain: input.chain,
+        address: input.address,
+        ...input.incidentId ? { incidentId: input.incidentId } : {},
+        ...input.maxHops === void 0 ? {} : { maxHops: input.maxHops }
+      });
+    }
+    listInvestigations(limit) {
+      const query = limit === void 0 ? "" : `?limit=${encodeURIComponent(String(limit))}`;
+      return this.request(
+        "GET",
+        `/v1/dri/investigations${query}`
+      ).then((body) => body.investigations);
+    }
+    /**
+     * Follow the value one address further.
+     *
+     * One address, one hop, per call — and that is a deliberate limit rather
+     * than an unfinished feature. The public endpoints a trace reads are rate
+     * limited, and an unattended crawl to four hops exhausts them; the result
+     * then reads as "the funds vanished" rather than "we ran out of quota",
+     * which on this product is the worst possible way to be wrong. Call it in a
+     * loop if you want depth, and read `coverage.truncated` on each result.
+     */
+    traceFunds(input) {
+      return this.request("POST", `/v1/dri/investigations/${encode(input.investigationId)}/trace`, {
+        ...input.fromNodeId ? { fromNodeId: input.fromNodeId } : {}
+      });
+    }
+    /** The graph as it stands: every address reached, and how it was reached. */
+    getFlowGraph(investigationId) {
+      return this.request("GET", `/v1/dri/investigations/${encode(investigationId)}`);
+    }
+    /**
+     * Where a third party could act, and where attribution stops.
+     *
+     * Read both halves. An intervention point is a party who holds value and can
+     * be contacted, served or subpoenaed — whether it does anything is a matter
+     * for it, its regulators and any legal process, never for Decentrys. An
+     * attribution limit is where the trail stops being provable, and a case that
+     * reaches one has established an answer rather than failed.
+     *
+     * Every point carries `observedPath`. False means the connection to this
+     * case runs through mixing or privacy infrastructure and is therefore
+     * inference — an observation about a counterparty, never an accusation about
+     * a person. `inferredPoints()` isolates them.
+     */
+    identifyInterventionPoints(investigationId) {
+      return this.request(
+        "GET",
+        `/v1/dri/investigations/${encode(investigationId)}/intervention-points`
+      );
+    }
+    /**
+     * What happened on this case, oldest first, with the acting party on every
+     * entry.
+     *
+     * Merges the recovery record in when the incident behind the investigation
+     * has a case. Entries attributed to anyone other than Decentrys are recorded
+     * as reported by that party — Decentrys did not perform them and does not
+     * verify them.
+     */
+    getInvestigationTimeline(investigationId, limit) {
+      const query = limit === void 0 ? "" : `?limit=${encodeURIComponent(String(limit))}`;
+      return this.request(
+        "GET",
+        `/v1/dri/investigations/${encode(investigationId)}/timeline${query}`
+      );
+    }
+    // --- Recovery cases ------------------------------------------------------
+    /**
+     * The recovery cases of your organisation.
+     *
+     * A case is opened as part of an engagement, against a declared incident and
+     * a stated loss; the tranche ledger behind it is analyst work, so it is not
+     * something an API call brings into existence. This is how you find the
+     * `recoveryCaseId` that `getRecoveryIndex` and `generateEvidencePackage`
+     * take — and `getFlowGraph` reports it too, for an investigation attached to
+     * one.
+     */
+    listCases(limit) {
+      const query = limit === void 0 ? "" : `?limit=${encodeURIComponent(String(limit))}`;
+      return this.request("GET", `/v1/dri/cases${query}`).then((body) => body.cases);
+    }
+    /**
+     * The Recovery Index for a case.
+     *
+     * An **analytical estimate** of the current evidentiary and custodial
+     * position, produced by a versioned model from the evidence recorded in the
+     * case. It is not a probability, not a forecast, and not a representation
+     * that any value will be recovered. `modelVersion` and `inputsHash` come
+     * back with it so any figure shown to a client can be reproduced exactly
+     * from the record it was computed from.
+     *
+     * The disclaimer travels in the payload, and this method **refuses a
+     * response that does not carry it** rather than returning a bare number.
+     * That check is deliberately duplicated from the server: an integrator's
+     * dashboard renders whatever arrives, and "58 — MODERATE" beside the word
+     * recovery is read as a rate by everyone who sees it. If the caveat ever
+     * stops arriving, failing here is the only outcome that keeps the score
+     * honest.
+     */
+    getRecoveryIndex(recoveryCaseId) {
+      return this.request("GET", `/v1/dri/cases/${encode(recoveryCaseId)}/recovery-index`).then(assertAnalyticalDisclosure);
+    }
+    /**
+     * Prepare an evidence package for a recipient.
+     *
+     * **Prepared, not sent.** The package goes to you and, at your direction, to
+     * your counsel, your insurer or a law-enforcement agency. Decentrys does not
+     * contact counterparties on your behalf unless instructed, and recording
+     * that a package was transmitted is a separate act that names who sent it.
+     *
+     * The document is frozen and hashed at generation, because third parties
+     * make freezing decisions on the strength of these and one that could be
+     * regenerated differently afterwards would be worth nothing. Quote
+     * `contentHash` back to a recipient so they can verify what they hold.
+     */
+    generateEvidencePackage(input) {
+      return this.request(
+        "POST",
+        `/v1/dri/cases/${encode(input.recoveryCaseId)}/evidence-package`,
+        {
+          recipientType: input.recipientType,
+          recipientName: input.recipientName,
+          ...input.recoveryLeadId ? { recoveryLeadId: input.recoveryLeadId } : {}
+        }
+      );
+    }
+    // --- transport -----------------------------------------------------------
+    async request(method, path, body) {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+      try {
+        const response = await this.fetchImpl(`${this.baseUrl}${path}`, {
+          method,
+          headers: {
+            "content-type": "application/json",
+            "x-api-key": this.apiKey,
+            "user-agent": `decentrys-dri/${SDK_VERSION}`
+          },
+          ...body === void 0 ? {} : { body: JSON.stringify(body) },
+          signal: controller.signal
+        });
+        const text = await response.text();
+        if (!response.ok) {
+          const parsed2 = safeParse(text);
+          throw new DriError(
+            response.status,
+            typeof parsed2?.message === "string" ? parsed2.message : `Decentrys returned HTTP ${response.status}.`,
+            typeof parsed2?.code === "string" ? parsed2.code : void 0
+          );
+        }
+        if (!text) return void 0;
+        const parsed = safeParse(text);
+        if (parsed === null) throw new DriError(response.status, "The response was not valid JSON.");
+        return "data" in parsed ? parsed.data : parsed;
+      } catch (error) {
+        if (error instanceof DriError) throw error;
+        if (controller.signal.aborted) throw new DriError(0, `No response within ${this.timeoutMs}ms.`);
+        throw new DriError(0, error instanceof Error ? error.message : "Request failed.");
+      } finally {
+        clearTimeout(timer);
+      }
+    }
+  };
+  function encode(segment) {
+    return encodeURIComponent(segment);
+  }
+  function safeParse(text) {
+    try {
+      const parsed = JSON.parse(text);
+      return typeof parsed === "object" && parsed !== null ? parsed : null;
+    } catch {
+      return null;
+    }
+  }
+  function resolveFetch() {
+    const candidate = globalThis.fetch;
+    if (typeof candidate !== "function") {
+      throw new Error("DRI: no global fetch was found. Pass one via `new DecentrysDri({ fetch })`.");
+    }
+    return candidate.bind(globalThis);
+  }
+  return __toCommonJS(index_exports);
+})();

package/dist/browser/decentrys-dri.mjs

@@ -0,0 +1,265 @@
+// src/model.ts
+var RECOVERY_BANDS = ["HIGH", "MODERATE", "LOW", "VERY_LOW"];
+var MissingDisclosureError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "MissingDisclosureError";
+  }
+};
+function assertAnalyticalDisclosure(index) {
+  if (index.analyticalOnly !== true) {
+    throw new MissingDisclosureError(
+      "This Recovery Index is not marked analytical-only. The Recovery Index is an analytical estimate and never a predicted recovery rate; refusing to hand back a score that does not say so."
+    );
+  }
+  if (typeof index.disclaimer !== "string" || index.disclaimer.trim().length === 0) {
+    throw new MissingDisclosureError(
+      "This Recovery Index arrived without its disclaimer. The disclaimer travels with the score by design, because a score shown without it is read as a promise of recovery."
+    );
+  }
+  return index;
+}
+function custodialPoints(analysis) {
+  return analysis.interventionPoints.filter((point) => point.kind === "CUSTODIAL");
+}
+function inferredPoints(analysis) {
+  return analysis.interventionPoints.filter((point) => !point.observedPath);
+}
+
+// src/client.ts
+var SDK_VERSION = "0.1.0";
+var DEFAULT_BASE_URL = "https://api.decentrys.com";
+var DEFAULT_TIMEOUT_MS = 3e4;
+var DriError = class extends Error {
+  constructor(status, message, code) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.name = "DriError";
+  }
+  status;
+  code;
+};
+var DecentrysDri = class {
+  baseUrl;
+  apiKey;
+  timeoutMs;
+  fetchImpl;
+  constructor(config) {
+    if (!config.apiKey?.trim()) {
+      throw new Error("DRI: an apiKey is required. Create one at https://decentrys.com/developers.");
+    }
+    if (config.apiKey.startsWith("dk_pub_")) {
+      throw new Error(
+        "DRI: that is a publishable key. An investigation names third parties, and that must never run behind a credential shipped inside a client where anyone who downloads it can read it. Use a secret key, server-side."
+      );
+    }
+    this.apiKey = config.apiKey;
+    this.baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+    this.timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    this.fetchImpl = config.fetch ?? resolveFetch();
+  }
+  // --- Investigations ------------------------------------------------------
+  /**
+   * Open an investigation seeded on one address.
+   *
+   * Nothing is traced yet. The seed node exists so the graph has a root before
+   * any chain call is made, which means a case can be opened and worked on
+   * even while a provider is unreachable.
+   */
+  createInvestigation(input) {
+    return this.request("POST", "/v1/dri/investigations", {
+      title: input.title,
+      chain: input.chain,
+      address: input.address,
+      ...input.incidentId ? { incidentId: input.incidentId } : {},
+      ...input.maxHops === void 0 ? {} : { maxHops: input.maxHops }
+    });
+  }
+  listInvestigations(limit) {
+    const query = limit === void 0 ? "" : `?limit=${encodeURIComponent(String(limit))}`;
+    return this.request(
+      "GET",
+      `/v1/dri/investigations${query}`
+    ).then((body) => body.investigations);
+  }
+  /**
+   * Follow the value one address further.
+   *
+   * One address, one hop, per call — and that is a deliberate limit rather
+   * than an unfinished feature. The public endpoints a trace reads are rate
+   * limited, and an unattended crawl to four hops exhausts them; the result
+   * then reads as "the funds vanished" rather than "we ran out of quota",
+   * which on this product is the worst possible way to be wrong. Call it in a
+   * loop if you want depth, and read `coverage.truncated` on each result.
+   */
+  traceFunds(input) {
+    return this.request("POST", `/v1/dri/investigations/${encode(input.investigationId)}/trace`, {
+      ...input.fromNodeId ? { fromNodeId: input.fromNodeId } : {}
+    });
+  }
+  /** The graph as it stands: every address reached, and how it was reached. */
+  getFlowGraph(investigationId) {
+    return this.request("GET", `/v1/dri/investigations/${encode(investigationId)}`);
+  }
+  /**
+   * Where a third party could act, and where attribution stops.
+   *
+   * Read both halves. An intervention point is a party who holds value and can
+   * be contacted, served or subpoenaed — whether it does anything is a matter
+   * for it, its regulators and any legal process, never for Decentrys. An
+   * attribution limit is where the trail stops being provable, and a case that
+   * reaches one has established an answer rather than failed.
+   *
+   * Every point carries `observedPath`. False means the connection to this
+   * case runs through mixing or privacy infrastructure and is therefore
+   * inference — an observation about a counterparty, never an accusation about
+   * a person. `inferredPoints()` isolates them.
+   */
+  identifyInterventionPoints(investigationId) {
+    return this.request(
+      "GET",
+      `/v1/dri/investigations/${encode(investigationId)}/intervention-points`
+    );
+  }
+  /**
+   * What happened on this case, oldest first, with the acting party on every
+   * entry.
+   *
+   * Merges the recovery record in when the incident behind the investigation
+   * has a case. Entries attributed to anyone other than Decentrys are recorded
+   * as reported by that party — Decentrys did not perform them and does not
+   * verify them.
+   */
+  getInvestigationTimeline(investigationId, limit) {
+    const query = limit === void 0 ? "" : `?limit=${encodeURIComponent(String(limit))}`;
+    return this.request(
+      "GET",
+      `/v1/dri/investigations/${encode(investigationId)}/timeline${query}`
+    );
+  }
+  // --- Recovery cases ------------------------------------------------------
+  /**
+   * The recovery cases of your organisation.
+   *
+   * A case is opened as part of an engagement, against a declared incident and
+   * a stated loss; the tranche ledger behind it is analyst work, so it is not
+   * something an API call brings into existence. This is how you find the
+   * `recoveryCaseId` that `getRecoveryIndex` and `generateEvidencePackage`
+   * take — and `getFlowGraph` reports it too, for an investigation attached to
+   * one.
+   */
+  listCases(limit) {
+    const query = limit === void 0 ? "" : `?limit=${encodeURIComponent(String(limit))}`;
+    return this.request("GET", `/v1/dri/cases${query}`).then((body) => body.cases);
+  }
+  /**
+   * The Recovery Index for a case.
+   *
+   * An **analytical estimate** of the current evidentiary and custodial
+   * position, produced by a versioned model from the evidence recorded in the
+   * case. It is not a probability, not a forecast, and not a representation
+   * that any value will be recovered. `modelVersion` and `inputsHash` come
+   * back with it so any figure shown to a client can be reproduced exactly
+   * from the record it was computed from.
+   *
+   * The disclaimer travels in the payload, and this method **refuses a
+   * response that does not carry it** rather than returning a bare number.
+   * That check is deliberately duplicated from the server: an integrator's
+   * dashboard renders whatever arrives, and "58 — MODERATE" beside the word
+   * recovery is read as a rate by everyone who sees it. If the caveat ever
+   * stops arriving, failing here is the only outcome that keeps the score
+   * honest.
+   */
+  getRecoveryIndex(recoveryCaseId) {
+    return this.request("GET", `/v1/dri/cases/${encode(recoveryCaseId)}/recovery-index`).then(assertAnalyticalDisclosure);
+  }
+  /**
+   * Prepare an evidence package for a recipient.
+   *
+   * **Prepared, not sent.** The package goes to you and, at your direction, to
+   * your counsel, your insurer or a law-enforcement agency. Decentrys does not
+   * contact counterparties on your behalf unless instructed, and recording
+   * that a package was transmitted is a separate act that names who sent it.
+   *
+   * The document is frozen and hashed at generation, because third parties
+   * make freezing decisions on the strength of these and one that could be
+   * regenerated differently afterwards would be worth nothing. Quote
+   * `contentHash` back to a recipient so they can verify what they hold.
+   */
+  generateEvidencePackage(input) {
+    return this.request(
+      "POST",
+      `/v1/dri/cases/${encode(input.recoveryCaseId)}/evidence-package`,
+      {
+        recipientType: input.recipientType,
+        recipientName: input.recipientName,
+        ...input.recoveryLeadId ? { recoveryLeadId: input.recoveryLeadId } : {}
+      }
+    );
+  }
+  // --- transport -----------------------------------------------------------
+  async request(method, path, body) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    try {
+      const response = await this.fetchImpl(`${this.baseUrl}${path}`, {
+        method,
+        headers: {
+          "content-type": "application/json",
+          "x-api-key": this.apiKey,
+          "user-agent": `decentrys-dri/${SDK_VERSION}`
+        },
+        ...body === void 0 ? {} : { body: JSON.stringify(body) },
+        signal: controller.signal
+      });
+      const text = await response.text();
+      if (!response.ok) {
+        const parsed2 = safeParse(text);
+        throw new DriError(
+          response.status,
+          typeof parsed2?.message === "string" ? parsed2.message : `Decentrys returned HTTP ${response.status}.`,
+          typeof parsed2?.code === "string" ? parsed2.code : void 0
+        );
+      }
+      if (!text) return void 0;
+      const parsed = safeParse(text);
+      if (parsed === null) throw new DriError(response.status, "The response was not valid JSON.");
+      return "data" in parsed ? parsed.data : parsed;
+    } catch (error) {
+      if (error instanceof DriError) throw error;
+      if (controller.signal.aborted) throw new DriError(0, `No response within ${this.timeoutMs}ms.`);
+      throw new DriError(0, error instanceof Error ? error.message : "Request failed.");
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+};
+function encode(segment) {
+  return encodeURIComponent(segment);
+}
+function safeParse(text) {
+  try {
+    const parsed = JSON.parse(text);
+    return typeof parsed === "object" && parsed !== null ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function resolveFetch() {
+  const candidate = globalThis.fetch;
+  if (typeof candidate !== "function") {
+    throw new Error("DRI: no global fetch was found. Pass one via `new DecentrysDri({ fetch })`.");
+  }
+  return candidate.bind(globalThis);
+}
+export {
+  DecentrysDri,
+  DriError,
+  MissingDisclosureError,
+  RECOVERY_BANDS,
+  SDK_VERSION,
+  assertAnalyticalDisclosure,
+  custodialPoints,
+  inferredPoints
+};