@human-gateway/sdk 0.0.1 → 0.1.0-alpha.1

package/dist/chunk-GJKDROWD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types.ts"],"sourcesContent":["export type HumanGatewayEnvironment =\r\n    | \"production\"\r\n    | \"sandbox\";\r\n\r\nexport type HumanGatewayMode =\r\n    | \"auto\"\r\n    | \"popup\"\r\n    | \"modal\"\r\n    | \"redirect\";\r\n\r\nexport type HumanGatewayOptions = {\r\n    projectId: string;\r\n    environment?: HumanGatewayEnvironment;\r\n    mode?: HumanGatewayMode;\r\n    baseUrl?: string;\r\n    timeoutMs?: number;\r\n};\r\n\r\nexport type HumanGatewayVerifyOptions = {\r\n    actionKey?: string;\r\n    onOpen?: () => void;\r\n    onClose?: () => void;\r\n    onSuccess?: (result: HumanGatewayResult) => void;\r\n    onError?: (error: HumanGatewayError) => void;\r\n};\r\n\r\nexport type HumanGatewayAuthOptions = {\r\n    actionKey?: string;\r\n    onOpen?: () => void;\r\n    onClose?: () => void;\r\n    onSuccess?: (result: HumanGatewayAuthResult) => void;\r\n    onError?: (error: HumanGatewayError) => void;\r\n};\r\n\r\nexport type HumanGatewayResult = {\r\n    success: boolean;\r\n    verified_human: boolean;\r\n    verification_level: HumanGatewayVerificationLevel;\r\n    unique_for_partner: boolean;\r\n    already_verified: boolean;\r\n    project_id: string;\r\n};\r\n\r\nexport type HumanGatewayAuthResult = {\r\n    success: boolean;\r\n    event?: \"auth.completed\";\r\n    verified_human: boolean;\r\n    verification_level: HumanGatewayVerificationLevel;\r\n    partner_user_id: string;\r\n    auth_session_id: string;\r\n    project_id: string;\r\n    expires_at: string;\r\n};\r\n\r\nexport type HumanGatewayMessage = {\r\n    source: \"human-gateway\";\r\n    type: \"human_gateway.verification.completed\";\r\n    payload: HumanGatewayResult;\r\n};\r\n\r\nexport type HumanGatewayAuthMessage = {\r\n    source: \"human-gateway\";\r\n    type: \"human_gateway.auth.completed\";\r\n    payload: HumanGatewayAuthResult;\r\n};\r\n\r\nexport type HumanGatewayErrorCode =\r\n    | \"popup_blocked\"\r\n    | \"user_closed\"\r\n    | \"timeout\"\r\n    | \"invalid_message\"\r\n    | \"invalid_origin\"\r\n    | \"verification_failed\"\r\n    | \"auth_failed\"\r\n    | \"unknown_error\";\r\n\r\nexport class HumanGatewayError extends Error {\r\n    code: HumanGatewayErrorCode;\r\n\r\n    constructor(code: HumanGatewayErrorCode, message: string) {\r\n        super(message);\r\n        this.name = \"HumanGatewayError\";\r\n        this.code = code;\r\n    }\r\n}\r\n\r\nexport type HumanGatewayCallbackEventName =\r\n    | \"verification.completed\"\r\n    | \"auth.completed\"\r\n    | \"callback.test\"\r\n    | (string & {});\r\n\r\nexport type HumanGatewayCallbackPayload = Record<string, unknown> & {\r\n    event_id?: unknown;\r\n    event?: unknown;\r\n    project_id?: unknown;\r\n};\r\n\r\nexport type HumanGatewayCallbackHeaders =\r\n    | Headers\r\n    | Record<string, string | string[] | null | undefined>;\r\n\r\nexport type VerifyCallbackInput = {\r\n    body: string;\r\n    headers: HumanGatewayCallbackHeaders;\r\n    secret: string;\r\n    toleranceMs?: number;\r\n    expectedProjectId?: string;\r\n};\r\n\r\nexport type VerifiedHumanGatewayCallback = {\r\n    event_id: string;\r\n    event: HumanGatewayCallbackEventName;\r\n    project_id: string;\r\n    timestamp: number;\r\n    payload: HumanGatewayCallbackPayload;\r\n};\r\n\r\nexport type HumanGatewayCallbackErrorCode =\r\n    | \"callback_missing_body\"\r\n    | \"callback_missing_secret\"\r\n    | \"callback_missing_header\"\r\n    | \"callback_invalid_timestamp\"\r\n    | \"callback_expired_timestamp\"\r\n    | \"callback_invalid_signature_format\"\r\n    | \"callback_invalid_signature\"\r\n    | \"callback_invalid_json\"\r\n    | \"callback_invalid_payload\"\r\n    | \"callback_event_id_mismatch\"\r\n    | \"callback_event_type_mismatch\"\r\n    | \"callback_project_id_mismatch\";\r\n\r\nexport class HumanGatewayCallbackError extends Error {\r\n    code: HumanGatewayCallbackErrorCode;\r\n\r\n    constructor(code: HumanGatewayCallbackErrorCode, message: string) {\r\n        super(message);\r\n        this.name = \"HumanGatewayCallbackError\";\r\n        this.code = code;\r\n    }\r\n}\r\n\r\nexport type HumanGatewayVerificationLevel =\r\n    | \"device\"\r\n    | \"document\"\r\n    | \"secure_document\"\r\n    | \"orb\"\r\n    | null;"],"mappings":"AA4EO,IAAMA,EAAN,cAAgC,KAAM,CAGzC,YAAYC,EAA6BC,EAAiB,CACtD,MAAMA,CAAO,EACb,KAAK,KAAO,oBACZ,KAAK,KAAOD,CAChB,CACJ,EAgDaE,EAAN,cAAwC,KAAM,CAGjD,YAAYF,EAAqCC,EAAiB,CAC9D,MAAMA,CAAO,EACb,KAAK,KAAO,4BACZ,KAAK,KAAOD,CAChB,CACJ","names":["HumanGatewayError","code","message","HumanGatewayCallbackError"]}

package/dist/index.cjs

@@ -0,0 +1,2 @@
+"use strict";var g=Object.defineProperty;var _=Object.getOwnPropertyDescriptor;var b=Object.getOwnPropertyNames;var k=Object.prototype.hasOwnProperty;var M=(t,e)=>{for(var a in e)g(t,a,{get:e[a],enumerable:!0})},x=(t,e,a,r)=>{if(e&&typeof e=="object"||typeof e=="function")for(let o of b(e))!k.call(t,o)&&o!==a&&g(t,o,{get:()=>e[o],enumerable:!(r=_(e,o))||r.enumerable});return t};var E=t=>x(g({},"__esModule",{value:!0}),t);var V={};M(V,{HumanGateway:()=>w,HumanGatewayError:()=>n});module.exports=E(V);var n=class extends Error{constructor(e,a){super(a),this.name="HumanGatewayError",this.code=e}};function R(t=480,e=720){let a=typeof window<"u"?Math.min(t,Math.floor(window.innerWidth*.92)):t,r=typeof window<"u"?Math.min(e,Math.floor(window.innerHeight*.88)):e,o=typeof window<"u"?Math.max(0,window.screenX+(window.outerWidth-a)/2):0,s=typeof window<"u"?Math.max(0,window.screenY+(window.outerHeight-r)/2):0;return[`width=${a}`,`height=${r}`,`left=${o}`,`top=${s}`,"resizable=yes","scrollbars=yes","status=no","toolbar=no","menubar=no"].join(",")}function v({url:t,width:e,height:a}){if(typeof window>"u")throw new n("unknown_error","HumanGateway popup verification requires a browser environment.");let r=window.open(t,"human_gateway_verification",R(e,a));if(!r)throw new n("popup_blocked","The verification popup was blocked by the browser.");return r.focus(),r}function j(t){if(typeof t!="object"||t===null)return!1;let e=t;return e.source==="human-gateway"&&e.type==="human_gateway.verification.completed"&&typeof e.payload=="object"&&e.payload!==null}function I(t){if(typeof t!="object"||t===null)return!1;let e=t;return e.source==="human-gateway"&&e.type==="human_gateway.auth.completed"&&typeof e.payload=="object"&&e.payload!==null}function H({popup:t,expectedOrigin:e,expectedProjectId:a,timeoutMs:r,onClose:o}){return new Promise((s,p)=>{let l=!1,m=()=>{window.removeEventListener("message",d),window.clearTimeout(h),window.clearInterval(f)},y=i=>{l||(l=!0,m(),s(i))},u=i=>{l||(l=!0,m(),p(i))},d=i=>{if(i.origin!==e)return;if(!j(i.data)){u(new n("invalid_message","Received an invalid Human Gateway verification message."));return}let c=i.data.payload;if(c.project_id!==a){u(new n("invalid_message","Received a verification result for a different project."));return}if(!c.success||!c.verified_human){u(new n("verification_failed","Human Gateway verification did not complete successfully."));return}y(c)},h=window.setTimeout(()=>{u(new n("timeout","Human Gateway verification timed out."))},r),f=window.setInterval(()=>{t.closed&&(o?.(),u(new n("user_closed","The verification window was closed before completion.")))},500);window.addEventListener("message",d)})}function G({popup:t,expectedOrigin:e,expectedProjectId:a,timeoutMs:r,onClose:o}){return new Promise((s,p)=>{let l=!1,m=()=>{window.removeEventListener("message",d),window.clearTimeout(h),window.clearInterval(f)},y=i=>{l||(l=!0,m(),s(i))},u=i=>{l||(l=!0,m(),p(i))},d=i=>{if(i.origin!==e)return;if(!I(i.data)){u(new n("invalid_message","Received an invalid Human Gateway auth message."));return}let c=i.data.payload;if(c.project_id!==a){u(new n("invalid_message","Received an auth result for a different project."));return}if(!c.success||!c.verified_human||!c.partner_user_id||!c.auth_session_id){u(new n("auth_failed","Human Gateway auth did not complete successfully."));return}y(c)},h=window.setTimeout(()=>{u(new n("timeout","Human Gateway auth timed out."))},r),f=window.setInterval(()=>{t.closed&&(o?.(),u(new n("user_closed","The auth window was closed before completion.")))},500);window.addEventListener("message",d)})}var A=300*1e3;function P(){return"https://humangateway.dev"}function C(t){let e=new URL(`/verify/${t.projectId}`,t.baseUrl);return e.searchParams.set("sdk","1"),e.searchParams.set("origin",window.location.origin),e.searchParams.set("mode","popup"),t.actionKey&&e.searchParams.set("actionKey",t.actionKey),e.toString()}function U(t){let e=new URL(`/auth/${t.projectId}`,t.baseUrl);return e.searchParams.set("sdk","1"),e.searchParams.set("origin",window.location.origin),e.searchParams.set("mode","popup"),t.actionKey&&e.searchParams.set("actionKey",t.actionKey),e.toString()}var w=class{constructor(e){this.activeVerification=null;this.activeAuth=null;if(!e.projectId)throw new n("unknown_error","HumanGateway requires a projectId.");this.projectId=e.projectId,this.environment=e.environment??"production",this.mode=e.mode??"auto",this.baseUrl=e.baseUrl??P(),this.timeoutMs=e.timeoutMs??A}async verify(e={}){return this.activeVerification?this.activeVerification:(this.activeVerification=this.runVerification(e).finally(()=>{this.activeVerification=null}),this.activeVerification)}async auth(e={}){return this.activeAuth?this.activeAuth:(this.activeAuth=this.runAuth(e).finally(()=>{this.activeAuth=null}),this.activeAuth)}async runVerification(e){try{if(typeof window>"u")throw new n("unknown_error","HumanGateway.verify() requires a browser environment.");if(this.mode==="redirect")throw new n("unknown_error","Redirect mode is not implemented in this SDK alpha.");let a=C({baseUrl:this.baseUrl,projectId:this.projectId,...e.actionKey?{actionKey:e.actionKey}:{}}),r=new URL(this.baseUrl).origin,o=v({url:a});e.onOpen?.();let s=await H({popup:o,expectedOrigin:r,expectedProjectId:this.projectId,timeoutMs:this.timeoutMs,...e.onClose?{onClose:e.onClose}:{}});e.onSuccess?.(s);try{o.close()}catch{}return s}catch(a){let r=a instanceof n?a:new n("unknown_error",a instanceof Error?a.message:"Unknown Human Gateway SDK error.");throw e.onError?.(r),r}}async runAuth(e){try{if(typeof window>"u")throw new n("unknown_error","HumanGateway.auth() requires a browser environment.");if(this.mode==="redirect")throw new n("unknown_error","Redirect mode is not implemented in this SDK alpha.");let a=U({baseUrl:this.baseUrl,projectId:this.projectId,...e.actionKey?{actionKey:e.actionKey}:{}}),r=new URL(this.baseUrl).origin,o=v({url:a});e.onOpen?.();let s=await G({popup:o,expectedOrigin:r,expectedProjectId:this.projectId,timeoutMs:this.timeoutMs,...e.onClose?{onClose:e.onClose}:{}});e.onSuccess?.(s);try{o.close()}catch{}return s}catch(a){let r=a instanceof n?a:new n("unknown_error",a instanceof Error?a.message:"Unknown Human Gateway SDK auth error.");throw e.onError?.(r),r}}};0&&(module.exports={HumanGateway,HumanGatewayError});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/types.ts","../src/popup.ts","../src/post-message.ts","../src/client.ts"],"sourcesContent":["export { HumanGateway } from \"./client\";\r\nexport type {\r\n    HumanGatewayAuthMessage,\r\n    HumanGatewayAuthOptions,\r\n    HumanGatewayAuthResult,\r\n    HumanGatewayEnvironment,\r\n    HumanGatewayErrorCode,\r\n    HumanGatewayMessage,\r\n    HumanGatewayMode,\r\n    HumanGatewayOptions,\r\n    HumanGatewayResult,\r\n    HumanGatewayVerifyOptions,\r\n    HumanGatewayVerificationLevel,\r\n} from \"./types\";\r\nexport { HumanGatewayError } from \"./types\";","export type HumanGatewayEnvironment =\r\n    | \"production\"\r\n    | \"sandbox\";\r\n\r\nexport type HumanGatewayMode =\r\n    | \"auto\"\r\n    | \"popup\"\r\n    | \"modal\"\r\n    | \"redirect\";\r\n\r\nexport type HumanGatewayOptions = {\r\n    projectId: string;\r\n    environment?: HumanGatewayEnvironment;\r\n    mode?: HumanGatewayMode;\r\n    baseUrl?: string;\r\n    timeoutMs?: number;\r\n};\r\n\r\nexport type HumanGatewayVerifyOptions = {\r\n    actionKey?: string;\r\n    onOpen?: () => void;\r\n    onClose?: () => void;\r\n    onSuccess?: (result: HumanGatewayResult) => void;\r\n    onError?: (error: HumanGatewayError) => void;\r\n};\r\n\r\nexport type HumanGatewayAuthOptions = {\r\n    actionKey?: string;\r\n    onOpen?: () => void;\r\n    onClose?: () => void;\r\n    onSuccess?: (result: HumanGatewayAuthResult) => void;\r\n    onError?: (error: HumanGatewayError) => void;\r\n};\r\n\r\nexport type HumanGatewayResult = {\r\n    success: boolean;\r\n    verified_human: boolean;\r\n    verification_level: HumanGatewayVerificationLevel;\r\n    unique_for_partner: boolean;\r\n    already_verified: boolean;\r\n    project_id: string;\r\n};\r\n\r\nexport type HumanGatewayAuthResult = {\r\n    success: boolean;\r\n    event?: \"auth.completed\";\r\n    verified_human: boolean;\r\n    verification_level: HumanGatewayVerificationLevel;\r\n    partner_user_id: string;\r\n    auth_session_id: string;\r\n    project_id: string;\r\n    expires_at: string;\r\n};\r\n\r\nexport type HumanGatewayMessage = {\r\n    source: \"human-gateway\";\r\n    type: \"human_gateway.verification.completed\";\r\n    payload: HumanGatewayResult;\r\n};\r\n\r\nexport type HumanGatewayAuthMessage = {\r\n    source: \"human-gateway\";\r\n    type: \"human_gateway.auth.completed\";\r\n    payload: HumanGatewayAuthResult;\r\n};\r\n\r\nexport type HumanGatewayErrorCode =\r\n    | \"popup_blocked\"\r\n    | \"user_closed\"\r\n    | \"timeout\"\r\n    | \"invalid_message\"\r\n    | \"invalid_origin\"\r\n    | \"verification_failed\"\r\n    | \"auth_failed\"\r\n    | \"unknown_error\";\r\n\r\nexport class HumanGatewayError extends Error {\r\n    code: HumanGatewayErrorCode;\r\n\r\n    constructor(code: HumanGatewayErrorCode, message: string) {\r\n        super(message);\r\n        this.name = \"HumanGatewayError\";\r\n        this.code = code;\r\n    }\r\n}\r\n\r\nexport type HumanGatewayCallbackEventName =\r\n    | \"verification.completed\"\r\n    | \"auth.completed\"\r\n    | \"callback.test\"\r\n    | (string & {});\r\n\r\nexport type HumanGatewayCallbackPayload = Record<string, unknown> & {\r\n    event_id?: unknown;\r\n    event?: unknown;\r\n    project_id?: unknown;\r\n};\r\n\r\nexport type HumanGatewayCallbackHeaders =\r\n    | Headers\r\n    | Record<string, string | string[] | null | undefined>;\r\n\r\nexport type VerifyCallbackInput = {\r\n    body: string;\r\n    headers: HumanGatewayCallbackHeaders;\r\n    secret: string;\r\n    toleranceMs?: number;\r\n    expectedProjectId?: string;\r\n};\r\n\r\nexport type VerifiedHumanGatewayCallback = {\r\n    event_id: string;\r\n    event: HumanGatewayCallbackEventName;\r\n    project_id: string;\r\n    timestamp: number;\r\n    payload: HumanGatewayCallbackPayload;\r\n};\r\n\r\nexport type HumanGatewayCallbackErrorCode =\r\n    | \"callback_missing_body\"\r\n    | \"callback_missing_secret\"\r\n    | \"callback_missing_header\"\r\n    | \"callback_invalid_timestamp\"\r\n    | \"callback_expired_timestamp\"\r\n    | \"callback_invalid_signature_format\"\r\n    | \"callback_invalid_signature\"\r\n    | \"callback_invalid_json\"\r\n    | \"callback_invalid_payload\"\r\n    | \"callback_event_id_mismatch\"\r\n    | \"callback_event_type_mismatch\"\r\n    | \"callback_project_id_mismatch\";\r\n\r\nexport class HumanGatewayCallbackError extends Error {\r\n    code: HumanGatewayCallbackErrorCode;\r\n\r\n    constructor(code: HumanGatewayCallbackErrorCode, message: string) {\r\n        super(message);\r\n        this.name = \"HumanGatewayCallbackError\";\r\n        this.code = code;\r\n    }\r\n}\r\n\r\nexport type HumanGatewayVerificationLevel =\r\n    | \"device\"\r\n    | \"document\"\r\n    | \"secure_document\"\r\n    | \"orb\"\r\n    | null;","import { HumanGatewayError } from \"./types\";\r\n\r\ntype OpenPopupInput = {\r\n    url: string;\r\n    width?: number;\r\n    height?: number;\r\n};\r\n\r\nexport function getPopupFeatures(width = 480, height = 720): string {\r\n    const safeWidth =\r\n        typeof window !== \"undefined\"\r\n            ? Math.min(width, Math.floor(window.innerWidth * 0.92))\r\n            : width;\r\n\r\n    const safeHeight =\r\n        typeof window !== \"undefined\"\r\n            ? Math.min(height, Math.floor(window.innerHeight * 0.88))\r\n            : height;\r\n\r\n    const left =\r\n        typeof window !== \"undefined\"\r\n            ? Math.max(0, window.screenX + (window.outerWidth - safeWidth) / 2)\r\n            : 0;\r\n\r\n    const top =\r\n        typeof window !== \"undefined\"\r\n            ? Math.max(0, window.screenY + (window.outerHeight - safeHeight) / 2)\r\n            : 0;\r\n\r\n    return [\r\n        `width=${safeWidth}`,\r\n        `height=${safeHeight}`,\r\n        `left=${left}`,\r\n        `top=${top}`,\r\n        \"resizable=yes\",\r\n        \"scrollbars=yes\",\r\n        \"status=no\",\r\n        \"toolbar=no\",\r\n        \"menubar=no\",\r\n    ].join(\",\");\r\n}\r\n\r\nexport function openVerificationPopup({\r\n    url,\r\n    width,\r\n    height,\r\n}: OpenPopupInput): Window {\r\n    if (typeof window === \"undefined\") {\r\n        throw new HumanGatewayError(\r\n            \"unknown_error\",\r\n            \"HumanGateway popup verification requires a browser environment.\"\r\n        );\r\n    }\r\n\r\n    const popup = window.open(\r\n        url,\r\n        \"human_gateway_verification\",\r\n        getPopupFeatures(width, height)\r\n    );\r\n\r\n    if (!popup) {\r\n        throw new HumanGatewayError(\r\n            \"popup_blocked\",\r\n            \"The verification popup was blocked by the browser.\"\r\n        );\r\n    }\r\n\r\n    popup.focus();\r\n\r\n    return popup;\r\n}","import {\r\n    HumanGatewayAuthMessage,\r\n    HumanGatewayAuthResult,\r\n    HumanGatewayError,\r\n    HumanGatewayMessage,\r\n    HumanGatewayResult,\r\n} from \"./types\";\r\n\r\ntype WaitForMessageInput = {\r\n    popup: Window;\r\n    expectedOrigin: string;\r\n    expectedProjectId: string;\r\n    timeoutMs: number;\r\n    onClose?: () => void;\r\n};\r\n\r\nfunction isHumanGatewayVerificationMessage(\r\n    value: unknown\r\n): value is HumanGatewayMessage {\r\n    if (typeof value !== \"object\" || value === null) {\r\n        return false;\r\n    }\r\n\r\n    const message = value as Partial<HumanGatewayMessage>;\r\n\r\n    return (\r\n        message.source === \"human-gateway\" &&\r\n        message.type === \"human_gateway.verification.completed\" &&\r\n        typeof message.payload === \"object\" &&\r\n        message.payload !== null\r\n    );\r\n}\r\n\r\nfunction isHumanGatewayAuthMessage(\r\n    value: unknown\r\n): value is HumanGatewayAuthMessage {\r\n    if (typeof value !== \"object\" || value === null) {\r\n        return false;\r\n    }\r\n\r\n    const message = value as Partial<HumanGatewayAuthMessage>;\r\n\r\n    return (\r\n        message.source === \"human-gateway\" &&\r\n        message.type === \"human_gateway.auth.completed\" &&\r\n        typeof message.payload === \"object\" &&\r\n        message.payload !== null\r\n    );\r\n}\r\n\r\nexport function waitForVerificationMessage({\r\n    popup,\r\n    expectedOrigin,\r\n    expectedProjectId,\r\n    timeoutMs,\r\n    onClose,\r\n}: WaitForMessageInput): Promise<HumanGatewayResult> {\r\n    return new Promise((resolve, reject) => {\r\n        let settled = false;\r\n\r\n        const cleanup = () => {\r\n            window.removeEventListener(\"message\", onMessage);\r\n            window.clearTimeout(timeoutId);\r\n            window.clearInterval(closeCheckId);\r\n        };\r\n\r\n        const settleResolve = (result: HumanGatewayResult) => {\r\n            if (settled) return;\r\n\r\n            settled = true;\r\n            cleanup();\r\n            resolve(result);\r\n        };\r\n\r\n        const settleReject = (error: HumanGatewayError) => {\r\n            if (settled) return;\r\n\r\n            settled = true;\r\n            cleanup();\r\n            reject(error);\r\n        };\r\n\r\n        const onMessage = (event: MessageEvent) => {\r\n            if (event.origin !== expectedOrigin) {\r\n                return;\r\n            }\r\n\r\n            if (!isHumanGatewayVerificationMessage(event.data)) {\r\n                settleReject(\r\n                    new HumanGatewayError(\r\n                        \"invalid_message\",\r\n                        \"Received an invalid Human Gateway verification message.\"\r\n                    )\r\n                );\r\n                return;\r\n            }\r\n\r\n            const result = event.data.payload;\r\n\r\n            if (result.project_id !== expectedProjectId) {\r\n                settleReject(\r\n                    new HumanGatewayError(\r\n                        \"invalid_message\",\r\n                        \"Received a verification result for a different project.\"\r\n                    )\r\n                );\r\n                return;\r\n            }\r\n\r\n            if (!result.success || !result.verified_human) {\r\n                settleReject(\r\n                    new HumanGatewayError(\r\n                        \"verification_failed\",\r\n                        \"Human Gateway verification did not complete successfully.\"\r\n                    )\r\n                );\r\n                return;\r\n            }\r\n\r\n            settleResolve(result);\r\n        };\r\n\r\n        const timeoutId = window.setTimeout(() => {\r\n            settleReject(\r\n                new HumanGatewayError(\r\n                    \"timeout\",\r\n                    \"Human Gateway verification timed out.\"\r\n                )\r\n            );\r\n        }, timeoutMs);\r\n\r\n        const closeCheckId = window.setInterval(() => {\r\n            if (popup.closed) {\r\n                onClose?.();\r\n\r\n                settleReject(\r\n                    new HumanGatewayError(\r\n                        \"user_closed\",\r\n                        \"The verification window was closed before completion.\"\r\n                    )\r\n                );\r\n            }\r\n        }, 500);\r\n\r\n        window.addEventListener(\"message\", onMessage);\r\n    });\r\n}\r\n\r\nexport function waitForAuthMessage({\r\n    popup,\r\n    expectedOrigin,\r\n    expectedProjectId,\r\n    timeoutMs,\r\n    onClose,\r\n}: WaitForMessageInput): Promise<HumanGatewayAuthResult> {\r\n    return new Promise((resolve, reject) => {\r\n        let settled = false;\r\n\r\n        const cleanup = () => {\r\n            window.removeEventListener(\"message\", onMessage);\r\n            window.clearTimeout(timeoutId);\r\n            window.clearInterval(closeCheckId);\r\n        };\r\n\r\n        const settleResolve = (result: HumanGatewayAuthResult) => {\r\n            if (settled) return;\r\n\r\n            settled = true;\r\n            cleanup();\r\n            resolve(result);\r\n        };\r\n\r\n        const settleReject = (error: HumanGatewayError) => {\r\n            if (settled) return;\r\n\r\n            settled = true;\r\n            cleanup();\r\n            reject(error);\r\n        };\r\n\r\n        const onMessage = (event: MessageEvent) => {\r\n            if (event.origin !== expectedOrigin) {\r\n                return;\r\n            }\r\n\r\n            if (!isHumanGatewayAuthMessage(event.data)) {\r\n                settleReject(\r\n                    new HumanGatewayError(\r\n                        \"invalid_message\",\r\n                        \"Received an invalid Human Gateway auth message.\"\r\n                    )\r\n                );\r\n                return;\r\n            }\r\n\r\n            const result = event.data.payload;\r\n\r\n            if (result.project_id !== expectedProjectId) {\r\n                settleReject(\r\n                    new HumanGatewayError(\r\n                        \"invalid_message\",\r\n                        \"Received an auth result for a different project.\"\r\n                    )\r\n                );\r\n                return;\r\n            }\r\n\r\n            if (\r\n                !result.success ||\r\n                !result.verified_human ||\r\n                !result.partner_user_id ||\r\n                !result.auth_session_id\r\n            ) {\r\n                settleReject(\r\n                    new HumanGatewayError(\r\n                        \"auth_failed\",\r\n                        \"Human Gateway auth did not complete successfully.\"\r\n                    )\r\n                );\r\n                return;\r\n            }\r\n\r\n            settleResolve(result);\r\n        };\r\n\r\n        const timeoutId = window.setTimeout(() => {\r\n            settleReject(\r\n                new HumanGatewayError(\r\n                    \"timeout\",\r\n                    \"Human Gateway auth timed out.\"\r\n                )\r\n            );\r\n        }, timeoutMs);\r\n\r\n        const closeCheckId = window.setInterval(() => {\r\n            if (popup.closed) {\r\n                onClose?.();\r\n\r\n                settleReject(\r\n                    new HumanGatewayError(\r\n                        \"user_closed\",\r\n                        \"The auth window was closed before completion.\"\r\n                    )\r\n                );\r\n            }\r\n        }, 500);\r\n\r\n        window.addEventListener(\"message\", onMessage);\r\n    });\r\n}","import { openVerificationPopup } from \"./popup\";\r\nimport {\r\n    waitForAuthMessage,\r\n    waitForVerificationMessage,\r\n} from \"./post-message\";\r\nimport {\r\n    HumanGatewayAuthOptions,\r\n    HumanGatewayAuthResult,\r\n    HumanGatewayError,\r\n    HumanGatewayOptions,\r\n    HumanGatewayResult,\r\n    HumanGatewayVerifyOptions,\r\n} from \"./types\";\r\n\r\nconst DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;\r\n\r\nfunction getDefaultBaseUrl() {\r\n    return \"https://humangateway.dev\";\r\n}\r\n\r\nfunction buildVerificationUrl(input: {\r\n    baseUrl: string;\r\n    projectId: string;\r\n    actionKey?: string;\r\n}): string {\r\n    const url = new URL(`/verify/${input.projectId}`, input.baseUrl);\r\n\r\n    url.searchParams.set(\"sdk\", \"1\");\r\n    url.searchParams.set(\"origin\", window.location.origin);\r\n    url.searchParams.set(\"mode\", \"popup\");\r\n\r\n    if (input.actionKey) {\r\n        url.searchParams.set(\"actionKey\", input.actionKey);\r\n    }\r\n\r\n    return url.toString();\r\n}\r\n\r\nfunction buildAuthUrl(input: {\r\n    baseUrl: string;\r\n    projectId: string;\r\n    actionKey?: string;\r\n}): string {\r\n    const url = new URL(`/auth/${input.projectId}`, input.baseUrl);\r\n\r\n    url.searchParams.set(\"sdk\", \"1\");\r\n    url.searchParams.set(\"origin\", window.location.origin);\r\n    url.searchParams.set(\"mode\", \"popup\");\r\n\r\n    if (input.actionKey) {\r\n        url.searchParams.set(\"actionKey\", input.actionKey);\r\n    }\r\n\r\n    return url.toString();\r\n}\r\n\r\nexport class HumanGateway {\r\n    private readonly projectId: string;\r\n    private readonly environment: NonNullable<HumanGatewayOptions[\"environment\"]>;\r\n    private readonly mode: NonNullable<HumanGatewayOptions[\"mode\"]>;\r\n    private readonly baseUrl: string;\r\n    private readonly timeoutMs: number;\r\n    private activeVerification: Promise<HumanGatewayResult> | null = null;\r\n    private activeAuth: Promise<HumanGatewayAuthResult> | null = null;\r\n\r\n    constructor(options: HumanGatewayOptions) {\r\n        if (!options.projectId) {\r\n            throw new HumanGatewayError(\r\n                \"unknown_error\",\r\n                \"HumanGateway requires a projectId.\"\r\n            );\r\n        }\r\n\r\n        this.projectId = options.projectId;\r\n        this.environment = options.environment ?? \"production\";\r\n        this.mode = options.mode ?? \"auto\";\r\n        this.baseUrl = options.baseUrl ?? getDefaultBaseUrl();\r\n        this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\r\n    }\r\n\r\n    async verify(\r\n        verifyOptions: HumanGatewayVerifyOptions = {}\r\n    ): Promise<HumanGatewayResult> {\r\n        if (this.activeVerification) {\r\n            return this.activeVerification;\r\n        }\r\n\r\n        this.activeVerification = this.runVerification(verifyOptions).finally(() => {\r\n            this.activeVerification = null;\r\n        });\r\n\r\n        return this.activeVerification;\r\n    }\r\n\r\n    async auth(\r\n        authOptions: HumanGatewayAuthOptions = {}\r\n    ): Promise<HumanGatewayAuthResult> {\r\n        if (this.activeAuth) {\r\n            return this.activeAuth;\r\n        }\r\n\r\n        this.activeAuth = this.runAuth(authOptions).finally(() => {\r\n            this.activeAuth = null;\r\n        });\r\n\r\n        return this.activeAuth;\r\n    }\r\n\r\n    private async runVerification(\r\n        verifyOptions: HumanGatewayVerifyOptions\r\n    ): Promise<HumanGatewayResult> {\r\n        try {\r\n            if (typeof window === \"undefined\") {\r\n                throw new HumanGatewayError(\r\n                    \"unknown_error\",\r\n                    \"HumanGateway.verify() requires a browser environment.\"\r\n                );\r\n            }\r\n\r\n            if (this.mode === \"redirect\") {\r\n                throw new HumanGatewayError(\r\n                    \"unknown_error\",\r\n                    \"Redirect mode is not implemented in this SDK alpha.\"\r\n                );\r\n            }\r\n\r\n            const verificationUrl = buildVerificationUrl({\r\n                baseUrl: this.baseUrl,\r\n                projectId: this.projectId,\r\n                ...(verifyOptions.actionKey\r\n                    ? { actionKey: verifyOptions.actionKey }\r\n                    : {}),\r\n            });\r\n\r\n            const expectedOrigin = new URL(this.baseUrl).origin;\r\n\r\n            const popup = openVerificationPopup({\r\n                url: verificationUrl,\r\n            });\r\n\r\n            verifyOptions.onOpen?.();\r\n\r\n            const result = await waitForVerificationMessage({\r\n                popup,\r\n                expectedOrigin,\r\n                expectedProjectId: this.projectId,\r\n                timeoutMs: this.timeoutMs,\r\n                ...(verifyOptions.onClose\r\n                    ? { onClose: verifyOptions.onClose }\r\n                    : {}),\r\n            });\r\n\r\n            verifyOptions.onSuccess?.(result);\r\n\r\n            try {\r\n                popup.close();\r\n            } catch {\r\n                // Ignore close errors. Some browsers may block programmatic close.\r\n            }\r\n\r\n            return result;\r\n        } catch (error) {\r\n            const normalizedError =\r\n                error instanceof HumanGatewayError\r\n                    ? error\r\n                    : new HumanGatewayError(\r\n                        \"unknown_error\",\r\n                        error instanceof Error\r\n                            ? error.message\r\n                            : \"Unknown Human Gateway SDK error.\"\r\n                    );\r\n\r\n            verifyOptions.onError?.(normalizedError);\r\n\r\n            throw normalizedError;\r\n        }\r\n    }\r\n\r\n    private async runAuth(\r\n        authOptions: HumanGatewayAuthOptions\r\n    ): Promise<HumanGatewayAuthResult> {\r\n        try {\r\n            if (typeof window === \"undefined\") {\r\n                throw new HumanGatewayError(\r\n                    \"unknown_error\",\r\n                    \"HumanGateway.auth() requires a browser environment.\"\r\n                );\r\n            }\r\n\r\n            if (this.mode === \"redirect\") {\r\n                throw new HumanGatewayError(\r\n                    \"unknown_error\",\r\n                    \"Redirect mode is not implemented in this SDK alpha.\"\r\n                );\r\n            }\r\n\r\n            const authUrl = buildAuthUrl({\r\n                baseUrl: this.baseUrl,\r\n                projectId: this.projectId,\r\n                ...(authOptions.actionKey ? { actionKey: authOptions.actionKey } : {}),\r\n            });\r\n\r\n            const expectedOrigin = new URL(this.baseUrl).origin;\r\n\r\n            const popup = openVerificationPopup({\r\n                url: authUrl,\r\n            });\r\n\r\n            authOptions.onOpen?.();\r\n\r\n            const result = await waitForAuthMessage({\r\n                popup,\r\n                expectedOrigin,\r\n                expectedProjectId: this.projectId,\r\n                timeoutMs: this.timeoutMs,\r\n                ...(authOptions.onClose\r\n                    ? { onClose: authOptions.onClose }\r\n                    : {}),\r\n            });\r\n\r\n            authOptions.onSuccess?.(result);\r\n\r\n            try {\r\n                popup.close();\r\n            } catch {\r\n                // Ignore close errors. Some browsers may block programmatic close.\r\n            }\r\n\r\n            return result;\r\n        } catch (error) {\r\n            const normalizedError =\r\n                error instanceof HumanGatewayError\r\n                    ? error\r\n                    : new HumanGatewayError(\r\n                        \"unknown_error\",\r\n                        error instanceof Error\r\n                            ? error.message\r\n                            : \"Unknown Human Gateway SDK auth error.\"\r\n                    );\r\n\r\n            authOptions.onError?.(normalizedError);\r\n\r\n            throw normalizedError;\r\n        }\r\n    }\r\n}"],"mappings":"yaAAA,IAAAA,EAAA,GAAAC,EAAAD,EAAA,kBAAAE,EAAA,sBAAAC,IAAA,eAAAC,EAAAJ,GC4EO,IAAMK,EAAN,cAAgC,KAAM,CAGzC,YAAYC,EAA6BC,EAAiB,CACtD,MAAMA,CAAO,EACb,KAAK,KAAO,oBACZ,KAAK,KAAOD,CAChB,CACJ,EC5EO,SAASE,EAAiBC,EAAQ,IAAKC,EAAS,IAAa,CAChE,IAAMC,EACF,OAAO,OAAW,IACZ,KAAK,IAAIF,EAAO,KAAK,MAAM,OAAO,WAAa,GAAI,CAAC,EACpDA,EAEJG,EACF,OAAO,OAAW,IACZ,KAAK,IAAIF,EAAQ,KAAK,MAAM,OAAO,YAAc,GAAI,CAAC,EACtDA,EAEJG,EACF,OAAO,OAAW,IACZ,KAAK,IAAI,EAAG,OAAO,SAAW,OAAO,WAAaF,GAAa,CAAC,EAChE,EAEJG,EACF,OAAO,OAAW,IACZ,KAAK,IAAI,EAAG,OAAO,SAAW,OAAO,YAAcF,GAAc,CAAC,EAClE,EAEV,MAAO,CACH,SAASD,CAAS,GAClB,UAAUC,CAAU,GACpB,QAAQC,CAAI,GACZ,OAAOC,CAAG,GACV,gBACA,iBACA,YACA,aACA,YACJ,EAAE,KAAK,GAAG,CACd,CAEO,SAASC,EAAsB,CAClC,IAAAC,EACA,MAAAP,EACA,OAAAC,CACJ,EAA2B,CACvB,GAAI,OAAO,OAAW,IAClB,MAAM,IAAIO,EACN,gBACA,iEACJ,EAGJ,IAAMC,EAAQ,OAAO,KACjBF,EACA,6BACAR,EAAiBC,EAAOC,CAAM,CAClC,EAEA,GAAI,CAACQ,EACD,MAAM,IAAID,EACN,gBACA,oDACJ,EAGJ,OAAAC,EAAM,MAAM,EAELA,CACX,CCtDA,SAASC,EACLC,EAC4B,CAC5B,GAAI,OAAOA,GAAU,UAAYA,IAAU,KACvC,MAAO,GAGX,IAAMC,EAAUD,EAEhB,OACIC,EAAQ,SAAW,iBACnBA,EAAQ,OAAS,wCACjB,OAAOA,EAAQ,SAAY,UAC3BA,EAAQ,UAAY,IAE5B,CAEA,SAASC,EACLF,EACgC,CAChC,GAAI,OAAOA,GAAU,UAAYA,IAAU,KACvC,MAAO,GAGX,IAAMC,EAAUD,EAEhB,OACIC,EAAQ,SAAW,iBACnBA,EAAQ,OAAS,gCACjB,OAAOA,EAAQ,SAAY,UAC3BA,EAAQ,UAAY,IAE5B,CAEO,SAASE,EAA2B,CACvC,MAAAC,EACA,eAAAC,EACA,kBAAAC,EACA,UAAAC,EACA,QAAAC,CACJ,EAAqD,CACjD,OAAO,IAAI,QAAQ,CAACC,EAASC,IAAW,CACpC,IAAIC,EAAU,GAERC,EAAU,IAAM,CAClB,OAAO,oBAAoB,UAAWC,CAAS,EAC/C,OAAO,aAAaC,CAAS,EAC7B,OAAO,cAAcC,CAAY,CACrC,EAEMC,EAAiBC,GAA+B,CAC9CN,IAEJA,EAAU,GACVC,EAAQ,EACRH,EAAQQ,CAAM,EAClB,EAEMC,EAAgBC,GAA6B,CAC3CR,IAEJA,EAAU,GACVC,EAAQ,EACRF,EAAOS,CAAK,EAChB,EAEMN,EAAaO,GAAwB,CACvC,GAAIA,EAAM,SAAWf,EACjB,OAGJ,GAAI,CAACN,EAAkCqB,EAAM,IAAI,EAAG,CAChDF,EACI,IAAIG,EACA,kBACA,yDACJ,CACJ,EACA,MACJ,CAEA,IAAMJ,EAASG,EAAM,KAAK,QAE1B,GAAIH,EAAO,aAAeX,EAAmB,CACzCY,EACI,IAAIG,EACA,kBACA,yDACJ,CACJ,EACA,MACJ,CAEA,GAAI,CAACJ,EAAO,SAAW,CAACA,EAAO,eAAgB,CAC3CC,EACI,IAAIG,EACA,sBACA,2DACJ,CACJ,EACA,MACJ,CAEAL,EAAcC,CAAM,CACxB,EAEMH,EAAY,OAAO,WAAW,IAAM,CACtCI,EACI,IAAIG,EACA,UACA,uCACJ,CACJ,CACJ,EAAGd,CAAS,EAENQ,EAAe,OAAO,YAAY,IAAM,CACtCX,EAAM,SACNI,IAAU,EAEVU,EACI,IAAIG,EACA,cACA,uDACJ,CACJ,EAER,EAAG,GAAG,EAEN,OAAO,iBAAiB,UAAWR,CAAS,CAChD,CAAC,CACL,CAEO,SAASS,EAAmB,CAC/B,MAAAlB,EACA,eAAAC,EACA,kBAAAC,EACA,UAAAC,EACA,QAAAC,CACJ,EAAyD,CACrD,OAAO,IAAI,QAAQ,CAACC,EAASC,IAAW,CACpC,IAAIC,EAAU,GAERC,EAAU,IAAM,CAClB,OAAO,oBAAoB,UAAWC,CAAS,EAC/C,OAAO,aAAaC,CAAS,EAC7B,OAAO,cAAcC,CAAY,CACrC,EAEMC,EAAiBC,GAAmC,CAClDN,IAEJA,EAAU,GACVC,EAAQ,EACRH,EAAQQ,CAAM,EAClB,EAEMC,EAAgBC,GAA6B,CAC3CR,IAEJA,EAAU,GACVC,EAAQ,EACRF,EAAOS,CAAK,EAChB,EAEMN,EAAaO,GAAwB,CACvC,GAAIA,EAAM,SAAWf,EACjB,OAGJ,GAAI,CAACH,EAA0BkB,EAAM,IAAI,EAAG,CACxCF,EACI,IAAIG,EACA,kBACA,iDACJ,CACJ,EACA,MACJ,CAEA,IAAMJ,EAASG,EAAM,KAAK,QAE1B,GAAIH,EAAO,aAAeX,EAAmB,CACzCY,EACI,IAAIG,EACA,kBACA,kDACJ,CACJ,EACA,MACJ,CAEA,GACI,CAACJ,EAAO,SACR,CAACA,EAAO,gBACR,CAACA,EAAO,iBACR,CAACA,EAAO,gBACV,CACEC,EACI,IAAIG,EACA,cACA,mDACJ,CACJ,EACA,MACJ,CAEAL,EAAcC,CAAM,CACxB,EAEMH,EAAY,OAAO,WAAW,IAAM,CACtCI,EACI,IAAIG,EACA,UACA,+BACJ,CACJ,CACJ,EAAGd,CAAS,EAENQ,EAAe,OAAO,YAAY,IAAM,CACtCX,EAAM,SACNI,IAAU,EAEVU,EACI,IAAIG,EACA,cACA,+CACJ,CACJ,EAER,EAAG,GAAG,EAEN,OAAO,iBAAiB,UAAWR,CAAS,CAChD,CAAC,CACL,CC3OA,IAAMU,EAAqB,IAAS,IAEpC,SAASC,GAAoB,CACzB,MAAO,0BACX,CAEA,SAASC,EAAqBC,EAInB,CACP,IAAMC,EAAM,IAAI,IAAI,WAAWD,EAAM,SAAS,GAAIA,EAAM,OAAO,EAE/D,OAAAC,EAAI,aAAa,IAAI,MAAO,GAAG,EAC/BA,EAAI,aAAa,IAAI,SAAU,OAAO,SAAS,MAAM,EACrDA,EAAI,aAAa,IAAI,OAAQ,OAAO,EAEhCD,EAAM,WACNC,EAAI,aAAa,IAAI,YAAaD,EAAM,SAAS,EAG9CC,EAAI,SAAS,CACxB,CAEA,SAASC,EAAaF,EAIX,CACP,IAAMC,EAAM,IAAI,IAAI,SAASD,EAAM,SAAS,GAAIA,EAAM,OAAO,EAE7D,OAAAC,EAAI,aAAa,IAAI,MAAO,GAAG,EAC/BA,EAAI,aAAa,IAAI,SAAU,OAAO,SAAS,MAAM,EACrDA,EAAI,aAAa,IAAI,OAAQ,OAAO,EAEhCD,EAAM,WACNC,EAAI,aAAa,IAAI,YAAaD,EAAM,SAAS,EAG9CC,EAAI,SAAS,CACxB,CAEO,IAAME,EAAN,KAAmB,CAStB,YAAYC,EAA8B,CAH1C,KAAQ,mBAAyD,KACjE,KAAQ,WAAqD,KAGzD,GAAI,CAACA,EAAQ,UACT,MAAM,IAAIC,EACN,gBACA,oCACJ,EAGJ,KAAK,UAAYD,EAAQ,UACzB,KAAK,YAAcA,EAAQ,aAAe,aAC1C,KAAK,KAAOA,EAAQ,MAAQ,OAC5B,KAAK,QAAUA,EAAQ,SAAWN,EAAkB,EACpD,KAAK,UAAYM,EAAQ,WAAaP,CAC1C,CAEA,MAAM,OACFS,EAA2C,CAAC,EACjB,CAC3B,OAAI,KAAK,mBACE,KAAK,oBAGhB,KAAK,mBAAqB,KAAK,gBAAgBA,CAAa,EAAE,QAAQ,IAAM,CACxE,KAAK,mBAAqB,IAC9B,CAAC,EAEM,KAAK,mBAChB,CAEA,MAAM,KACFC,EAAuC,CAAC,EACT,CAC/B,OAAI,KAAK,WACE,KAAK,YAGhB,KAAK,WAAa,KAAK,QAAQA,CAAW,EAAE,QAAQ,IAAM,CACtD,KAAK,WAAa,IACtB,CAAC,EAEM,KAAK,WAChB,CAEA,MAAc,gBACVD,EAC2B,CAC3B,GAAI,CACA,GAAI,OAAO,OAAW,IAClB,MAAM,IAAID,EACN,gBACA,uDACJ,EAGJ,GAAI,KAAK,OAAS,WACd,MAAM,IAAIA,EACN,gBACA,qDACJ,EAGJ,IAAMG,EAAkBT,EAAqB,CACzC,QAAS,KAAK,QACd,UAAW,KAAK,UAChB,GAAIO,EAAc,UACZ,CAAE,UAAWA,EAAc,SAAU,EACrC,CAAC,CACX,CAAC,EAEKG,EAAiB,IAAI,IAAI,KAAK,OAAO,EAAE,OAEvCC,EAAQC,EAAsB,CAChC,IAAKH,CACT,CAAC,EAEDF,EAAc,SAAS,EAEvB,IAAMM,EAAS,MAAMC,EAA2B,CAC5C,MAAAH,EACA,eAAAD,EACA,kBAAmB,KAAK,UACxB,UAAW,KAAK,UAChB,GAAIH,EAAc,QACZ,CAAE,QAASA,EAAc,OAAQ,EACjC,CAAC,CACX,CAAC,EAEDA,EAAc,YAAYM,CAAM,EAEhC,GAAI,CACAF,EAAM,MAAM,CAChB,MAAQ,CAER,CAEA,OAAOE,CACX,OAASE,EAAO,CACZ,IAAMC,EACFD,aAAiBT,EACXS,EACA,IAAIT,EACF,gBACAS,aAAiB,MACXA,EAAM,QACN,kCACV,EAER,MAAAR,EAAc,UAAUS,CAAe,EAEjCA,CACV,CACJ,CAEA,MAAc,QACVR,EAC+B,CAC/B,GAAI,CACA,GAAI,OAAO,OAAW,IAClB,MAAM,IAAIF,EACN,gBACA,qDACJ,EAGJ,GAAI,KAAK,OAAS,WACd,MAAM,IAAIA,EACN,gBACA,qDACJ,EAGJ,IAAMW,EAAUd,EAAa,CACzB,QAAS,KAAK,QACd,UAAW,KAAK,UAChB,GAAIK,EAAY,UAAY,CAAE,UAAWA,EAAY,SAAU,EAAI,CAAC,CACxE,CAAC,EAEKE,EAAiB,IAAI,IAAI,KAAK,OAAO,EAAE,OAEvCC,EAAQC,EAAsB,CAChC,IAAKK,CACT,CAAC,EAEDT,EAAY,SAAS,EAErB,IAAMK,EAAS,MAAMK,EAAmB,CACpC,MAAAP,EACA,eAAAD,EACA,kBAAmB,KAAK,UACxB,UAAW,KAAK,UAChB,GAAIF,EAAY,QACV,CAAE,QAASA,EAAY,OAAQ,EAC/B,CAAC,CACX,CAAC,EAEDA,EAAY,YAAYK,CAAM,EAE9B,GAAI,CACAF,EAAM,MAAM,CAChB,MAAQ,CAER,CAEA,OAAOE,CACX,OAASE,EAAO,CACZ,IAAMC,EACFD,aAAiBT,EACXS,EACA,IAAIT,EACF,gBACAS,aAAiB,MACXA,EAAM,QACN,uCACV,EAER,MAAAP,EAAY,UAAUQ,CAAe,EAE/BA,CACV,CACJ,CACJ","names":["src_exports","__export","HumanGateway","HumanGatewayError","__toCommonJS","HumanGatewayError","code","message","getPopupFeatures","width","height","safeWidth","safeHeight","left","top","openVerificationPopup","url","HumanGatewayError","popup","isHumanGatewayVerificationMessage","value","message","isHumanGatewayAuthMessage","waitForVerificationMessage","popup","expectedOrigin","expectedProjectId","timeoutMs","onClose","resolve","reject","settled","cleanup","onMessage","timeoutId","closeCheckId","settleResolve","result","settleReject","error","event","HumanGatewayError","waitForAuthMessage","DEFAULT_TIMEOUT_MS","getDefaultBaseUrl","buildVerificationUrl","input","url","buildAuthUrl","HumanGateway","options","HumanGatewayError","verifyOptions","authOptions","verificationUrl","expectedOrigin","popup","openVerificationPopup","result","waitForVerificationMessage","error","normalizedError","authUrl","waitForAuthMessage"]}

package/dist/index.d.cts

@@ -0,0 +1,19 @@
+import { m as HumanGatewayOptions, p as HumanGatewayVerifyOptions, n as HumanGatewayResult, a as HumanGatewayAuthOptions, b as HumanGatewayAuthResult } from './types-BR0Sarec.cjs';
+export { H as HumanGatewayAuthMessage, h as HumanGatewayEnvironment, i as HumanGatewayError, j as HumanGatewayErrorCode, k as HumanGatewayMessage, l as HumanGatewayMode, o as HumanGatewayVerificationLevel } from './types-BR0Sarec.cjs';
+
+declare class HumanGateway {
+    private readonly projectId;
+    private readonly environment;
+    private readonly mode;
+    private readonly baseUrl;
+    private readonly timeoutMs;
+    private activeVerification;
+    private activeAuth;
+    constructor(options: HumanGatewayOptions);
+    verify(verifyOptions?: HumanGatewayVerifyOptions): Promise<HumanGatewayResult>;
+    auth(authOptions?: HumanGatewayAuthOptions): Promise<HumanGatewayAuthResult>;
+    private runVerification;
+    private runAuth;
+}
+
+export { HumanGateway, HumanGatewayAuthOptions, HumanGatewayAuthResult, HumanGatewayOptions, HumanGatewayResult, HumanGatewayVerifyOptions };

package/dist/index.d.ts

@@ -0,0 +1,19 @@
+import { m as HumanGatewayOptions, p as HumanGatewayVerifyOptions, n as HumanGatewayResult, a as HumanGatewayAuthOptions, b as HumanGatewayAuthResult } from './types-BR0Sarec.js';
+export { H as HumanGatewayAuthMessage, h as HumanGatewayEnvironment, i as HumanGatewayError, j as HumanGatewayErrorCode, k as HumanGatewayMessage, l as HumanGatewayMode, o as HumanGatewayVerificationLevel } from './types-BR0Sarec.js';
+
+declare class HumanGateway {
+    private readonly projectId;
+    private readonly environment;
+    private readonly mode;
+    private readonly baseUrl;
+    private readonly timeoutMs;
+    private activeVerification;
+    private activeAuth;
+    constructor(options: HumanGatewayOptions);
+    verify(verifyOptions?: HumanGatewayVerifyOptions): Promise<HumanGatewayResult>;
+    auth(authOptions?: HumanGatewayAuthOptions): Promise<HumanGatewayAuthResult>;
+    private runVerification;
+    private runAuth;
+}
+
+export { HumanGateway, HumanGatewayAuthOptions, HumanGatewayAuthResult, HumanGatewayOptions, HumanGatewayResult, HumanGatewayVerifyOptions };

package/dist/index.js

@@ -0,0 +1,2 @@
+import{a}from"./chunk-GJKDROWD.js";function v(t=480,e=720){let n=typeof window<"u"?Math.min(t,Math.floor(window.innerWidth*.92)):t,r=typeof window<"u"?Math.min(e,Math.floor(window.innerHeight*.88)):e,i=typeof window<"u"?Math.max(0,window.screenX+(window.outerWidth-n)/2):0,s=typeof window<"u"?Math.max(0,window.screenY+(window.outerHeight-r)/2):0;return[`width=${n}`,`height=${r}`,`left=${i}`,`top=${s}`,"resizable=yes","scrollbars=yes","status=no","toolbar=no","menubar=no"].join(",")}function h({url:t,width:e,height:n}){if(typeof window>"u")throw new a("unknown_error","HumanGateway popup verification requires a browser environment.");let r=window.open(t,"human_gateway_verification",v(e,n));if(!r)throw new a("popup_blocked","The verification popup was blocked by the browser.");return r.focus(),r}function b(t){if(typeof t!="object"||t===null)return!1;let e=t;return e.source==="human-gateway"&&e.type==="human_gateway.verification.completed"&&typeof e.payload=="object"&&e.payload!==null}function M(t){if(typeof t!="object"||t===null)return!1;let e=t;return e.source==="human-gateway"&&e.type==="human_gateway.auth.completed"&&typeof e.payload=="object"&&e.payload!==null}function H({popup:t,expectedOrigin:e,expectedProjectId:n,timeoutMs:r,onClose:i}){return new Promise((s,d)=>{let w=!1,m=()=>{window.removeEventListener("message",l),window.clearTimeout(y),window.clearInterval(f)},p=o=>{w||(w=!0,m(),s(o))},u=o=>{w||(w=!0,m(),d(o))},l=o=>{if(o.origin!==e)return;if(!b(o.data)){u(new a("invalid_message","Received an invalid Human Gateway verification message."));return}let c=o.data.payload;if(c.project_id!==n){u(new a("invalid_message","Received a verification result for a different project."));return}if(!c.success||!c.verified_human){u(new a("verification_failed","Human Gateway verification did not complete successfully."));return}p(c)},y=window.setTimeout(()=>{u(new a("timeout","Human Gateway verification timed out."))},r),f=window.setInterval(()=>{t.closed&&(i?.(),u(new a("user_closed","The verification window was closed before completion.")))},500);window.addEventListener("message",l)})}function G({popup:t,expectedOrigin:e,expectedProjectId:n,timeoutMs:r,onClose:i}){return new Promise((s,d)=>{let w=!1,m=()=>{window.removeEventListener("message",l),window.clearTimeout(y),window.clearInterval(f)},p=o=>{w||(w=!0,m(),s(o))},u=o=>{w||(w=!0,m(),d(o))},l=o=>{if(o.origin!==e)return;if(!M(o.data)){u(new a("invalid_message","Received an invalid Human Gateway auth message."));return}let c=o.data.payload;if(c.project_id!==n){u(new a("invalid_message","Received an auth result for a different project."));return}if(!c.success||!c.verified_human||!c.partner_user_id||!c.auth_session_id){u(new a("auth_failed","Human Gateway auth did not complete successfully."));return}p(c)},y=window.setTimeout(()=>{u(new a("timeout","Human Gateway auth timed out."))},r),f=window.setInterval(()=>{t.closed&&(i?.(),u(new a("user_closed","The auth window was closed before completion.")))},500);window.addEventListener("message",l)})}var I=300*1e3;function _(){return"https://humangateway.dev"}function R(t){let e=new URL(`/verify/${t.projectId}`,t.baseUrl);return e.searchParams.set("sdk","1"),e.searchParams.set("origin",window.location.origin),e.searchParams.set("mode","popup"),t.actionKey&&e.searchParams.set("actionKey",t.actionKey),e.toString()}function j(t){let e=new URL(`/auth/${t.projectId}`,t.baseUrl);return e.searchParams.set("sdk","1"),e.searchParams.set("origin",window.location.origin),e.searchParams.set("mode","popup"),t.actionKey&&e.searchParams.set("actionKey",t.actionKey),e.toString()}var g=class{constructor(e){this.activeVerification=null;this.activeAuth=null;if(!e.projectId)throw new a("unknown_error","HumanGateway requires a projectId.");this.projectId=e.projectId,this.environment=e.environment??"production",this.mode=e.mode??"auto",this.baseUrl=e.baseUrl??_(),this.timeoutMs=e.timeoutMs??I}async verify(e={}){return this.activeVerification?this.activeVerification:(this.activeVerification=this.runVerification(e).finally(()=>{this.activeVerification=null}),this.activeVerification)}async auth(e={}){return this.activeAuth?this.activeAuth:(this.activeAuth=this.runAuth(e).finally(()=>{this.activeAuth=null}),this.activeAuth)}async runVerification(e){try{if(typeof window>"u")throw new a("unknown_error","HumanGateway.verify() requires a browser environment.");if(this.mode==="redirect")throw new a("unknown_error","Redirect mode is not implemented in this SDK alpha.");let n=R({baseUrl:this.baseUrl,projectId:this.projectId,...e.actionKey?{actionKey:e.actionKey}:{}}),r=new URL(this.baseUrl).origin,i=h({url:n});e.onOpen?.();let s=await H({popup:i,expectedOrigin:r,expectedProjectId:this.projectId,timeoutMs:this.timeoutMs,...e.onClose?{onClose:e.onClose}:{}});e.onSuccess?.(s);try{i.close()}catch{}return s}catch(n){let r=n instanceof a?n:new a("unknown_error",n instanceof Error?n.message:"Unknown Human Gateway SDK error.");throw e.onError?.(r),r}}async runAuth(e){try{if(typeof window>"u")throw new a("unknown_error","HumanGateway.auth() requires a browser environment.");if(this.mode==="redirect")throw new a("unknown_error","Redirect mode is not implemented in this SDK alpha.");let n=j({baseUrl:this.baseUrl,projectId:this.projectId,...e.actionKey?{actionKey:e.actionKey}:{}}),r=new URL(this.baseUrl).origin,i=h({url:n});e.onOpen?.();let s=await G({popup:i,expectedOrigin:r,expectedProjectId:this.projectId,timeoutMs:this.timeoutMs,...e.onClose?{onClose:e.onClose}:{}});e.onSuccess?.(s);try{i.close()}catch{}return s}catch(n){let r=n instanceof a?n:new a("unknown_error",n instanceof Error?n.message:"Unknown Human Gateway SDK auth error.");throw e.onError?.(r),r}}};export{g as HumanGateway,a as HumanGatewayError};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/popup.ts","../src/post-message.ts","../src/client.ts"],"sourcesContent":["import { HumanGatewayError } from \"./types\";\r\n\r\ntype OpenPopupInput = {\r\n    url: string;\r\n    width?: number;\r\n    height?: number;\r\n};\r\n\r\nexport function getPopupFeatures(width = 480, height = 720): string {\r\n    const safeWidth =\r\n        typeof window !== \"undefined\"\r\n            ? Math.min(width, Math.floor(window.innerWidth * 0.92))\r\n            : width;\r\n\r\n    const safeHeight =\r\n        typeof window !== \"undefined\"\r\n            ? Math.min(height, Math.floor(window.innerHeight * 0.88))\r\n            : height;\r\n\r\n    const left =\r\n        typeof window !== \"undefined\"\r\n            ? Math.max(0, window.screenX + (window.outerWidth - safeWidth) / 2)\r\n            : 0;\r\n\r\n    const top =\r\n        typeof window !== \"undefined\"\r\n            ? Math.max(0, window.screenY + (window.outerHeight - safeHeight) / 2)\r\n            : 0;\r\n\r\n    return [\r\n        `width=${safeWidth}`,\r\n        `height=${safeHeight}`,\r\n        `left=${left}`,\r\n        `top=${top}`,\r\n        \"resizable=yes\",\r\n        \"scrollbars=yes\",\r\n        \"status=no\",\r\n        \"toolbar=no\",\r\n        \"menubar=no\",\r\n    ].join(\",\");\r\n}\r\n\r\nexport function openVerificationPopup({\r\n    url,\r\n    width,\r\n    height,\r\n}: OpenPopupInput): Window {\r\n    if (typeof window === \"undefined\") {\r\n        throw new HumanGatewayError(\r\n            \"unknown_error\",\r\n            \"HumanGateway popup verification requires a browser environment.\"\r\n        );\r\n    }\r\n\r\n    const popup = window.open(\r\n        url,\r\n        \"human_gateway_verification\",\r\n        getPopupFeatures(width, height)\r\n    );\r\n\r\n    if (!popup) {\r\n        throw new HumanGatewayError(\r\n            \"popup_blocked\",\r\n            \"The verification popup was blocked by the browser.\"\r\n        );\r\n    }\r\n\r\n    popup.focus();\r\n\r\n    return popup;\r\n}","import {\r\n    HumanGatewayAuthMessage,\r\n    HumanGatewayAuthResult,\r\n    HumanGatewayError,\r\n    HumanGatewayMessage,\r\n    HumanGatewayResult,\r\n} from \"./types\";\r\n\r\ntype WaitForMessageInput = {\r\n    popup: Window;\r\n    expectedOrigin: string;\r\n    expectedProjectId: string;\r\n    timeoutMs: number;\r\n    onClose?: () => void;\r\n};\r\n\r\nfunction isHumanGatewayVerificationMessage(\r\n    value: unknown\r\n): value is HumanGatewayMessage {\r\n    if (typeof value !== \"object\" || value === null) {\r\n        return false;\r\n    }\r\n\r\n    const message = value as Partial<HumanGatewayMessage>;\r\n\r\n    return (\r\n        message.source === \"human-gateway\" &&\r\n        message.type === \"human_gateway.verification.completed\" &&\r\n        typeof message.payload === \"object\" &&\r\n        message.payload !== null\r\n    );\r\n}\r\n\r\nfunction isHumanGatewayAuthMessage(\r\n    value: unknown\r\n): value is HumanGatewayAuthMessage {\r\n    if (typeof value !== \"object\" || value === null) {\r\n        return false;\r\n    }\r\n\r\n    const message = value as Partial<HumanGatewayAuthMessage>;\r\n\r\n    return (\r\n        message.source === \"human-gateway\" &&\r\n        message.type === \"human_gateway.auth.completed\" &&\r\n        typeof message.payload === \"object\" &&\r\n        message.payload !== null\r\n    );\r\n}\r\n\r\nexport function waitForVerificationMessage({\r\n    popup,\r\n    expectedOrigin,\r\n    expectedProjectId,\r\n    timeoutMs,\r\n    onClose,\r\n}: WaitForMessageInput): Promise<HumanGatewayResult> {\r\n    return new Promise((resolve, reject) => {\r\n        let settled = false;\r\n\r\n        const cleanup = () => {\r\n            window.removeEventListener(\"message\", onMessage);\r\n            window.clearTimeout(timeoutId);\r\n            window.clearInterval(closeCheckId);\r\n        };\r\n\r\n        const settleResolve = (result: HumanGatewayResult) => {\r\n            if (settled) return;\r\n\r\n            settled = true;\r\n            cleanup();\r\n            resolve(result);\r\n        };\r\n\r\n        const settleReject = (error: HumanGatewayError) => {\r\n            if (settled) return;\r\n\r\n            settled = true;\r\n            cleanup();\r\n            reject(error);\r\n        };\r\n\r\n        const onMessage = (event: MessageEvent) => {\r\n            if (event.origin !== expectedOrigin) {\r\n                return;\r\n            }\r\n\r\n            if (!isHumanGatewayVerificationMessage(event.data)) {\r\n                settleReject(\r\n                    new HumanGatewayError(\r\n                        \"invalid_message\",\r\n                        \"Received an invalid Human Gateway verification message.\"\r\n                    )\r\n                );\r\n                return;\r\n            }\r\n\r\n            const result = event.data.payload;\r\n\r\n            if (result.project_id !== expectedProjectId) {\r\n                settleReject(\r\n                    new HumanGatewayError(\r\n                        \"invalid_message\",\r\n                        \"Received a verification result for a different project.\"\r\n                    )\r\n                );\r\n                return;\r\n            }\r\n\r\n            if (!result.success || !result.verified_human) {\r\n                settleReject(\r\n                    new HumanGatewayError(\r\n                        \"verification_failed\",\r\n                        \"Human Gateway verification did not complete successfully.\"\r\n                    )\r\n                );\r\n                return;\r\n            }\r\n\r\n            settleResolve(result);\r\n        };\r\n\r\n        const timeoutId = window.setTimeout(() => {\r\n            settleReject(\r\n                new HumanGatewayError(\r\n                    \"timeout\",\r\n                    \"Human Gateway verification timed out.\"\r\n                )\r\n            );\r\n        }, timeoutMs);\r\n\r\n        const closeCheckId = window.setInterval(() => {\r\n            if (popup.closed) {\r\n                onClose?.();\r\n\r\n                settleReject(\r\n                    new HumanGatewayError(\r\n                        \"user_closed\",\r\n                        \"The verification window was closed before completion.\"\r\n                    )\r\n                );\r\n            }\r\n        }, 500);\r\n\r\n        window.addEventListener(\"message\", onMessage);\r\n    });\r\n}\r\n\r\nexport function waitForAuthMessage({\r\n    popup,\r\n    expectedOrigin,\r\n    expectedProjectId,\r\n    timeoutMs,\r\n    onClose,\r\n}: WaitForMessageInput): Promise<HumanGatewayAuthResult> {\r\n    return new Promise((resolve, reject) => {\r\n        let settled = false;\r\n\r\n        const cleanup = () => {\r\n            window.removeEventListener(\"message\", onMessage);\r\n            window.clearTimeout(timeoutId);\r\n            window.clearInterval(closeCheckId);\r\n        };\r\n\r\n        const settleResolve = (result: HumanGatewayAuthResult) => {\r\n            if (settled) return;\r\n\r\n            settled = true;\r\n            cleanup();\r\n            resolve(result);\r\n        };\r\n\r\n        const settleReject = (error: HumanGatewayError) => {\r\n            if (settled) return;\r\n\r\n            settled = true;\r\n            cleanup();\r\n            reject(error);\r\n        };\r\n\r\n        const onMessage = (event: MessageEvent) => {\r\n            if (event.origin !== expectedOrigin) {\r\n                return;\r\n            }\r\n\r\n            if (!isHumanGatewayAuthMessage(event.data)) {\r\n                settleReject(\r\n                    new HumanGatewayError(\r\n                        \"invalid_message\",\r\n                        \"Received an invalid Human Gateway auth message.\"\r\n                    )\r\n                );\r\n                return;\r\n            }\r\n\r\n            const result = event.data.payload;\r\n\r\n            if (result.project_id !== expectedProjectId) {\r\n                settleReject(\r\n                    new HumanGatewayError(\r\n                        \"invalid_message\",\r\n                        \"Received an auth result for a different project.\"\r\n                    )\r\n                );\r\n                return;\r\n            }\r\n\r\n            if (\r\n                !result.success ||\r\n                !result.verified_human ||\r\n                !result.partner_user_id ||\r\n                !result.auth_session_id\r\n            ) {\r\n                settleReject(\r\n                    new HumanGatewayError(\r\n                        \"auth_failed\",\r\n                        \"Human Gateway auth did not complete successfully.\"\r\n                    )\r\n                );\r\n                return;\r\n            }\r\n\r\n            settleResolve(result);\r\n        };\r\n\r\n        const timeoutId = window.setTimeout(() => {\r\n            settleReject(\r\n                new HumanGatewayError(\r\n                    \"timeout\",\r\n                    \"Human Gateway auth timed out.\"\r\n                )\r\n            );\r\n        }, timeoutMs);\r\n\r\n        const closeCheckId = window.setInterval(() => {\r\n            if (popup.closed) {\r\n                onClose?.();\r\n\r\n                settleReject(\r\n                    new HumanGatewayError(\r\n                        \"user_closed\",\r\n                        \"The auth window was closed before completion.\"\r\n                    )\r\n                );\r\n            }\r\n        }, 500);\r\n\r\n        window.addEventListener(\"message\", onMessage);\r\n    });\r\n}","import { openVerificationPopup } from \"./popup\";\r\nimport {\r\n    waitForAuthMessage,\r\n    waitForVerificationMessage,\r\n} from \"./post-message\";\r\nimport {\r\n    HumanGatewayAuthOptions,\r\n    HumanGatewayAuthResult,\r\n    HumanGatewayError,\r\n    HumanGatewayOptions,\r\n    HumanGatewayResult,\r\n    HumanGatewayVerifyOptions,\r\n} from \"./types\";\r\n\r\nconst DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;\r\n\r\nfunction getDefaultBaseUrl() {\r\n    return \"https://humangateway.dev\";\r\n}\r\n\r\nfunction buildVerificationUrl(input: {\r\n    baseUrl: string;\r\n    projectId: string;\r\n    actionKey?: string;\r\n}): string {\r\n    const url = new URL(`/verify/${input.projectId}`, input.baseUrl);\r\n\r\n    url.searchParams.set(\"sdk\", \"1\");\r\n    url.searchParams.set(\"origin\", window.location.origin);\r\n    url.searchParams.set(\"mode\", \"popup\");\r\n\r\n    if (input.actionKey) {\r\n        url.searchParams.set(\"actionKey\", input.actionKey);\r\n    }\r\n\r\n    return url.toString();\r\n}\r\n\r\nfunction buildAuthUrl(input: {\r\n    baseUrl: string;\r\n    projectId: string;\r\n    actionKey?: string;\r\n}): string {\r\n    const url = new URL(`/auth/${input.projectId}`, input.baseUrl);\r\n\r\n    url.searchParams.set(\"sdk\", \"1\");\r\n    url.searchParams.set(\"origin\", window.location.origin);\r\n    url.searchParams.set(\"mode\", \"popup\");\r\n\r\n    if (input.actionKey) {\r\n        url.searchParams.set(\"actionKey\", input.actionKey);\r\n    }\r\n\r\n    return url.toString();\r\n}\r\n\r\nexport class HumanGateway {\r\n    private readonly projectId: string;\r\n    private readonly environment: NonNullable<HumanGatewayOptions[\"environment\"]>;\r\n    private readonly mode: NonNullable<HumanGatewayOptions[\"mode\"]>;\r\n    private readonly baseUrl: string;\r\n    private readonly timeoutMs: number;\r\n    private activeVerification: Promise<HumanGatewayResult> | null = null;\r\n    private activeAuth: Promise<HumanGatewayAuthResult> | null = null;\r\n\r\n    constructor(options: HumanGatewayOptions) {\r\n        if (!options.projectId) {\r\n            throw new HumanGatewayError(\r\n                \"unknown_error\",\r\n                \"HumanGateway requires a projectId.\"\r\n            );\r\n        }\r\n\r\n        this.projectId = options.projectId;\r\n        this.environment = options.environment ?? \"production\";\r\n        this.mode = options.mode ?? \"auto\";\r\n        this.baseUrl = options.baseUrl ?? getDefaultBaseUrl();\r\n        this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\r\n    }\r\n\r\n    async verify(\r\n        verifyOptions: HumanGatewayVerifyOptions = {}\r\n    ): Promise<HumanGatewayResult> {\r\n        if (this.activeVerification) {\r\n            return this.activeVerification;\r\n        }\r\n\r\n        this.activeVerification = this.runVerification(verifyOptions).finally(() => {\r\n            this.activeVerification = null;\r\n        });\r\n\r\n        return this.activeVerification;\r\n    }\r\n\r\n    async auth(\r\n        authOptions: HumanGatewayAuthOptions = {}\r\n    ): Promise<HumanGatewayAuthResult> {\r\n        if (this.activeAuth) {\r\n            return this.activeAuth;\r\n        }\r\n\r\n        this.activeAuth = this.runAuth(authOptions).finally(() => {\r\n            this.activeAuth = null;\r\n        });\r\n\r\n        return this.activeAuth;\r\n    }\r\n\r\n    private async runVerification(\r\n        verifyOptions: HumanGatewayVerifyOptions\r\n    ): Promise<HumanGatewayResult> {\r\n        try {\r\n            if (typeof window === \"undefined\") {\r\n                throw new HumanGatewayError(\r\n                    \"unknown_error\",\r\n                    \"HumanGateway.verify() requires a browser environment.\"\r\n                );\r\n            }\r\n\r\n            if (this.mode === \"redirect\") {\r\n                throw new HumanGatewayError(\r\n                    \"unknown_error\",\r\n                    \"Redirect mode is not implemented in this SDK alpha.\"\r\n                );\r\n            }\r\n\r\n            const verificationUrl = buildVerificationUrl({\r\n                baseUrl: this.baseUrl,\r\n                projectId: this.projectId,\r\n                ...(verifyOptions.actionKey\r\n                    ? { actionKey: verifyOptions.actionKey }\r\n                    : {}),\r\n            });\r\n\r\n            const expectedOrigin = new URL(this.baseUrl).origin;\r\n\r\n            const popup = openVerificationPopup({\r\n                url: verificationUrl,\r\n            });\r\n\r\n            verifyOptions.onOpen?.();\r\n\r\n            const result = await waitForVerificationMessage({\r\n                popup,\r\n                expectedOrigin,\r\n                expectedProjectId: this.projectId,\r\n                timeoutMs: this.timeoutMs,\r\n                ...(verifyOptions.onClose\r\n                    ? { onClose: verifyOptions.onClose }\r\n                    : {}),\r\n            });\r\n\r\n            verifyOptions.onSuccess?.(result);\r\n\r\n            try {\r\n                popup.close();\r\n            } catch {\r\n                // Ignore close errors. Some browsers may block programmatic close.\r\n            }\r\n\r\n            return result;\r\n        } catch (error) {\r\n            const normalizedError =\r\n                error instanceof HumanGatewayError\r\n                    ? error\r\n                    : new HumanGatewayError(\r\n                        \"unknown_error\",\r\n                        error instanceof Error\r\n                            ? error.message\r\n                            : \"Unknown Human Gateway SDK error.\"\r\n                    );\r\n\r\n            verifyOptions.onError?.(normalizedError);\r\n\r\n            throw normalizedError;\r\n        }\r\n    }\r\n\r\n    private async runAuth(\r\n        authOptions: HumanGatewayAuthOptions\r\n    ): Promise<HumanGatewayAuthResult> {\r\n        try {\r\n            if (typeof window === \"undefined\") {\r\n                throw new HumanGatewayError(\r\n                    \"unknown_error\",\r\n                    \"HumanGateway.auth() requires a browser environment.\"\r\n                );\r\n            }\r\n\r\n            if (this.mode === \"redirect\") {\r\n                throw new HumanGatewayError(\r\n                    \"unknown_error\",\r\n                    \"Redirect mode is not implemented in this SDK alpha.\"\r\n                );\r\n            }\r\n\r\n            const authUrl = buildAuthUrl({\r\n                baseUrl: this.baseUrl,\r\n                projectId: this.projectId,\r\n                ...(authOptions.actionKey ? { actionKey: authOptions.actionKey } : {}),\r\n            });\r\n\r\n            const expectedOrigin = new URL(this.baseUrl).origin;\r\n\r\n            const popup = openVerificationPopup({\r\n                url: authUrl,\r\n            });\r\n\r\n            authOptions.onOpen?.();\r\n\r\n            const result = await waitForAuthMessage({\r\n                popup,\r\n                expectedOrigin,\r\n                expectedProjectId: this.projectId,\r\n                timeoutMs: this.timeoutMs,\r\n                ...(authOptions.onClose\r\n                    ? { onClose: authOptions.onClose }\r\n                    : {}),\r\n            });\r\n\r\n            authOptions.onSuccess?.(result);\r\n\r\n            try {\r\n                popup.close();\r\n            } catch {\r\n                // Ignore close errors. Some browsers may block programmatic close.\r\n            }\r\n\r\n            return result;\r\n        } catch (error) {\r\n            const normalizedError =\r\n                error instanceof HumanGatewayError\r\n                    ? error\r\n                    : new HumanGatewayError(\r\n                        \"unknown_error\",\r\n                        error instanceof Error\r\n                            ? error.message\r\n                            : \"Unknown Human Gateway SDK auth error.\"\r\n                    );\r\n\r\n            authOptions.onError?.(normalizedError);\r\n\r\n            throw normalizedError;\r\n        }\r\n    }\r\n}"],"mappings":"mCAQO,SAASA,EAAiBC,EAAQ,IAAKC,EAAS,IAAa,CAChE,IAAMC,EACF,OAAO,OAAW,IACZ,KAAK,IAAIF,EAAO,KAAK,MAAM,OAAO,WAAa,GAAI,CAAC,EACpDA,EAEJG,EACF,OAAO,OAAW,IACZ,KAAK,IAAIF,EAAQ,KAAK,MAAM,OAAO,YAAc,GAAI,CAAC,EACtDA,EAEJG,EACF,OAAO,OAAW,IACZ,KAAK,IAAI,EAAG,OAAO,SAAW,OAAO,WAAaF,GAAa,CAAC,EAChE,EAEJG,EACF,OAAO,OAAW,IACZ,KAAK,IAAI,EAAG,OAAO,SAAW,OAAO,YAAcF,GAAc,CAAC,EAClE,EAEV,MAAO,CACH,SAASD,CAAS,GAClB,UAAUC,CAAU,GACpB,QAAQC,CAAI,GACZ,OAAOC,CAAG,GACV,gBACA,iBACA,YACA,aACA,YACJ,EAAE,KAAK,GAAG,CACd,CAEO,SAASC,EAAsB,CAClC,IAAAC,EACA,MAAAP,EACA,OAAAC,CACJ,EAA2B,CACvB,GAAI,OAAO,OAAW,IAClB,MAAM,IAAIO,EACN,gBACA,iEACJ,EAGJ,IAAMC,EAAQ,OAAO,KACjBF,EACA,6BACAR,EAAiBC,EAAOC,CAAM,CAClC,EAEA,GAAI,CAACQ,EACD,MAAM,IAAID,EACN,gBACA,oDACJ,EAGJ,OAAAC,EAAM,MAAM,EAELA,CACX,CCtDA,SAASC,EACLC,EAC4B,CAC5B,GAAI,OAAOA,GAAU,UAAYA,IAAU,KACvC,MAAO,GAGX,IAAMC,EAAUD,EAEhB,OACIC,EAAQ,SAAW,iBACnBA,EAAQ,OAAS,wCACjB,OAAOA,EAAQ,SAAY,UAC3BA,EAAQ,UAAY,IAE5B,CAEA,SAASC,EACLF,EACgC,CAChC,GAAI,OAAOA,GAAU,UAAYA,IAAU,KACvC,MAAO,GAGX,IAAMC,EAAUD,EAEhB,OACIC,EAAQ,SAAW,iBACnBA,EAAQ,OAAS,gCACjB,OAAOA,EAAQ,SAAY,UAC3BA,EAAQ,UAAY,IAE5B,CAEO,SAASE,EAA2B,CACvC,MAAAC,EACA,eAAAC,EACA,kBAAAC,EACA,UAAAC,EACA,QAAAC,CACJ,EAAqD,CACjD,OAAO,IAAI,QAAQ,CAACC,EAASC,IAAW,CACpC,IAAIC,EAAU,GAERC,EAAU,IAAM,CAClB,OAAO,oBAAoB,UAAWC,CAAS,EAC/C,OAAO,aAAaC,CAAS,EAC7B,OAAO,cAAcC,CAAY,CACrC,EAEMC,EAAiBC,GAA+B,CAC9CN,IAEJA,EAAU,GACVC,EAAQ,EACRH,EAAQQ,CAAM,EAClB,EAEMC,EAAgBC,GAA6B,CAC3CR,IAEJA,EAAU,GACVC,EAAQ,EACRF,EAAOS,CAAK,EAChB,EAEMN,EAAaO,GAAwB,CACvC,GAAIA,EAAM,SAAWf,EACjB,OAGJ,GAAI,CAACN,EAAkCqB,EAAM,IAAI,EAAG,CAChDF,EACI,IAAIG,EACA,kBACA,yDACJ,CACJ,EACA,MACJ,CAEA,IAAMJ,EAASG,EAAM,KAAK,QAE1B,GAAIH,EAAO,aAAeX,EAAmB,CACzCY,EACI,IAAIG,EACA,kBACA,yDACJ,CACJ,EACA,MACJ,CAEA,GAAI,CAACJ,EAAO,SAAW,CAACA,EAAO,eAAgB,CAC3CC,EACI,IAAIG,EACA,sBACA,2DACJ,CACJ,EACA,MACJ,CAEAL,EAAcC,CAAM,CACxB,EAEMH,EAAY,OAAO,WAAW,IAAM,CACtCI,EACI,IAAIG,EACA,UACA,uCACJ,CACJ,CACJ,EAAGd,CAAS,EAENQ,EAAe,OAAO,YAAY,IAAM,CACtCX,EAAM,SACNI,IAAU,EAEVU,EACI,IAAIG,EACA,cACA,uDACJ,CACJ,EAER,EAAG,GAAG,EAEN,OAAO,iBAAiB,UAAWR,CAAS,CAChD,CAAC,CACL,CAEO,SAASS,EAAmB,CAC/B,MAAAlB,EACA,eAAAC,EACA,kBAAAC,EACA,UAAAC,EACA,QAAAC,CACJ,EAAyD,CACrD,OAAO,IAAI,QAAQ,CAACC,EAASC,IAAW,CACpC,IAAIC,EAAU,GAERC,EAAU,IAAM,CAClB,OAAO,oBAAoB,UAAWC,CAAS,EAC/C,OAAO,aAAaC,CAAS,EAC7B,OAAO,cAAcC,CAAY,CACrC,EAEMC,EAAiBC,GAAmC,CAClDN,IAEJA,EAAU,GACVC,EAAQ,EACRH,EAAQQ,CAAM,EAClB,EAEMC,EAAgBC,GAA6B,CAC3CR,IAEJA,EAAU,GACVC,EAAQ,EACRF,EAAOS,CAAK,EAChB,EAEMN,EAAaO,GAAwB,CACvC,GAAIA,EAAM,SAAWf,EACjB,OAGJ,GAAI,CAACH,EAA0BkB,EAAM,IAAI,EAAG,CACxCF,EACI,IAAIG,EACA,kBACA,iDACJ,CACJ,EACA,MACJ,CAEA,IAAMJ,EAASG,EAAM,KAAK,QAE1B,GAAIH,EAAO,aAAeX,EAAmB,CACzCY,EACI,IAAIG,EACA,kBACA,kDACJ,CACJ,EACA,MACJ,CAEA,GACI,CAACJ,EAAO,SACR,CAACA,EAAO,gBACR,CAACA,EAAO,iBACR,CAACA,EAAO,gBACV,CACEC,EACI,IAAIG,EACA,cACA,mDACJ,CACJ,EACA,MACJ,CAEAL,EAAcC,CAAM,CACxB,EAEMH,EAAY,OAAO,WAAW,IAAM,CACtCI,EACI,IAAIG,EACA,UACA,+BACJ,CACJ,CACJ,EAAGd,CAAS,EAENQ,EAAe,OAAO,YAAY,IAAM,CACtCX,EAAM,SACNI,IAAU,EAEVU,EACI,IAAIG,EACA,cACA,+CACJ,CACJ,EAER,EAAG,GAAG,EAEN,OAAO,iBAAiB,UAAWR,CAAS,CAChD,CAAC,CACL,CC3OA,IAAMU,EAAqB,IAAS,IAEpC,SAASC,GAAoB,CACzB,MAAO,0BACX,CAEA,SAASC,EAAqBC,EAInB,CACP,IAAMC,EAAM,IAAI,IAAI,WAAWD,EAAM,SAAS,GAAIA,EAAM,OAAO,EAE/D,OAAAC,EAAI,aAAa,IAAI,MAAO,GAAG,EAC/BA,EAAI,aAAa,IAAI,SAAU,OAAO,SAAS,MAAM,EACrDA,EAAI,aAAa,IAAI,OAAQ,OAAO,EAEhCD,EAAM,WACNC,EAAI,aAAa,IAAI,YAAaD,EAAM,SAAS,EAG9CC,EAAI,SAAS,CACxB,CAEA,SAASC,EAAaF,EAIX,CACP,IAAMC,EAAM,IAAI,IAAI,SAASD,EAAM,SAAS,GAAIA,EAAM,OAAO,EAE7D,OAAAC,EAAI,aAAa,IAAI,MAAO,GAAG,EAC/BA,EAAI,aAAa,IAAI,SAAU,OAAO,SAAS,MAAM,EACrDA,EAAI,aAAa,IAAI,OAAQ,OAAO,EAEhCD,EAAM,WACNC,EAAI,aAAa,IAAI,YAAaD,EAAM,SAAS,EAG9CC,EAAI,SAAS,CACxB,CAEO,IAAME,EAAN,KAAmB,CAStB,YAAYC,EAA8B,CAH1C,KAAQ,mBAAyD,KACjE,KAAQ,WAAqD,KAGzD,GAAI,CAACA,EAAQ,UACT,MAAM,IAAIC,EACN,gBACA,oCACJ,EAGJ,KAAK,UAAYD,EAAQ,UACzB,KAAK,YAAcA,EAAQ,aAAe,aAC1C,KAAK,KAAOA,EAAQ,MAAQ,OAC5B,KAAK,QAAUA,EAAQ,SAAWN,EAAkB,EACpD,KAAK,UAAYM,EAAQ,WAAaP,CAC1C,CAEA,MAAM,OACFS,EAA2C,CAAC,EACjB,CAC3B,OAAI,KAAK,mBACE,KAAK,oBAGhB,KAAK,mBAAqB,KAAK,gBAAgBA,CAAa,EAAE,QAAQ,IAAM,CACxE,KAAK,mBAAqB,IAC9B,CAAC,EAEM,KAAK,mBAChB,CAEA,MAAM,KACFC,EAAuC,CAAC,EACT,CAC/B,OAAI,KAAK,WACE,KAAK,YAGhB,KAAK,WAAa,KAAK,QAAQA,CAAW,EAAE,QAAQ,IAAM,CACtD,KAAK,WAAa,IACtB,CAAC,EAEM,KAAK,WAChB,CAEA,MAAc,gBACVD,EAC2B,CAC3B,GAAI,CACA,GAAI,OAAO,OAAW,IAClB,MAAM,IAAID,EACN,gBACA,uDACJ,EAGJ,GAAI,KAAK,OAAS,WACd,MAAM,IAAIA,EACN,gBACA,qDACJ,EAGJ,IAAMG,EAAkBT,EAAqB,CACzC,QAAS,KAAK,QACd,UAAW,KAAK,UAChB,GAAIO,EAAc,UACZ,CAAE,UAAWA,EAAc,SAAU,EACrC,CAAC,CACX,CAAC,EAEKG,EAAiB,IAAI,IAAI,KAAK,OAAO,EAAE,OAEvCC,EAAQC,EAAsB,CAChC,IAAKH,CACT,CAAC,EAEDF,EAAc,SAAS,EAEvB,IAAMM,EAAS,MAAMC,EAA2B,CAC5C,MAAAH,EACA,eAAAD,EACA,kBAAmB,KAAK,UACxB,UAAW,KAAK,UAChB,GAAIH,EAAc,QACZ,CAAE,QAASA,EAAc,OAAQ,EACjC,CAAC,CACX,CAAC,EAEDA,EAAc,YAAYM,CAAM,EAEhC,GAAI,CACAF,EAAM,MAAM,CAChB,MAAQ,CAER,CAEA,OAAOE,CACX,OAASE,EAAO,CACZ,IAAMC,EACFD,aAAiBT,EACXS,EACA,IAAIT,EACF,gBACAS,aAAiB,MACXA,EAAM,QACN,kCACV,EAER,MAAAR,EAAc,UAAUS,CAAe,EAEjCA,CACV,CACJ,CAEA,MAAc,QACVR,EAC+B,CAC/B,GAAI,CACA,GAAI,OAAO,OAAW,IAClB,MAAM,IAAIF,EACN,gBACA,qDACJ,EAGJ,GAAI,KAAK,OAAS,WACd,MAAM,IAAIA,EACN,gBACA,qDACJ,EAGJ,IAAMW,EAAUd,EAAa,CACzB,QAAS,KAAK,QACd,UAAW,KAAK,UAChB,GAAIK,EAAY,UAAY,CAAE,UAAWA,EAAY,SAAU,EAAI,CAAC,CACxE,CAAC,EAEKE,EAAiB,IAAI,IAAI,KAAK,OAAO,EAAE,OAEvCC,EAAQC,EAAsB,CAChC,IAAKK,CACT,CAAC,EAEDT,EAAY,SAAS,EAErB,IAAMK,EAAS,MAAMK,EAAmB,CACpC,MAAAP,EACA,eAAAD,EACA,kBAAmB,KAAK,UACxB,UAAW,KAAK,UAChB,GAAIF,EAAY,QACV,CAAE,QAASA,EAAY,OAAQ,EAC/B,CAAC,CACX,CAAC,EAEDA,EAAY,YAAYK,CAAM,EAE9B,GAAI,CACAF,EAAM,MAAM,CAChB,MAAQ,CAER,CAEA,OAAOE,CACX,OAASE,EAAO,CACZ,IAAMC,EACFD,aAAiBT,EACXS,EACA,IAAIT,EACF,gBACAS,aAAiB,MACXA,EAAM,QACN,uCACV,EAER,MAAAP,EAAY,UAAUQ,CAAe,EAE/BA,CACV,CACJ,CACJ","names":["getPopupFeatures","width","height","safeWidth","safeHeight","left","top","openVerificationPopup","url","HumanGatewayError","popup","isHumanGatewayVerificationMessage","value","message","isHumanGatewayAuthMessage","waitForVerificationMessage","popup","expectedOrigin","expectedProjectId","timeoutMs","onClose","resolve","reject","settled","cleanup","onMessage","timeoutId","closeCheckId","settleResolve","result","settleReject","error","event","HumanGatewayError","waitForAuthMessage","DEFAULT_TIMEOUT_MS","getDefaultBaseUrl","buildVerificationUrl","input","url","buildAuthUrl","HumanGateway","options","HumanGatewayError","verifyOptions","authOptions","verificationUrl","expectedOrigin","popup","openVerificationPopup","result","waitForVerificationMessage","error","normalizedError","authUrl","waitForAuthMessage"]}

package/dist/server.cjs

@@ -0,0 +1,2 @@
+"use strict";var b=Object.defineProperty;var G=Object.getOwnPropertyDescriptor;var C=Object.getOwnPropertyNames;var x=Object.prototype.hasOwnProperty;var E=(e,a)=>{for(var t in a)b(e,t,{get:a[t],enumerable:!0})},j=(e,a,t,i)=>{if(a&&typeof a=="object"||typeof a=="function")for(let r of C(a))!x.call(e,r)&&r!==t&&b(e,r,{get:()=>a[r],enumerable:!(i=G(a,r))||i.enumerable});return e};var A=e=>j(b({},"__esModule",{value:!0}),e);var L={};E(L,{HumanGatewayCallbackError:()=>n,verifyCallback:()=>H,verifyCallbackSignature:()=>m});module.exports=A(L);var w=require("buffer"),d=require("crypto"),N=300*1e3;function m({rawBody:e,timestamp:a,signature:t,secret:i,toleranceMs:r=N}){if(!e||!a||!t||!i)return!1;let l=Number(a);if(!Number.isFinite(l)||Math.abs(Date.now()-l)>r||!/^[a-f0-9]{64}$/i.test(t))return!1;let p=(0,d.createHmac)("sha256",i).update(`${a}.${e}`).digest("hex"),o=w.Buffer.from(p,"hex"),c=w.Buffer.from(t,"hex");return o.length!==c.length?!1:(0,d.timingSafeEqual)(o,c)}var n=class extends Error{constructor(a,t){super(t),this.name="HumanGatewayCallbackError",this.code=a}};var S=300*1e3,V="x-hg-event-id",I="x-hg-event",R="x-hg-project-id",M="x-hg-timestamp",P="x-hg-signature";function O(e,a){let t=e;if(typeof t.get=="function")return t.get(a);let i=a.toLowerCase();for(let[r,l]of Object.entries(e))if(r.toLowerCase()===i)return Array.isArray(l)?l[0]??null:l??null;return null}function s(e,a){let t=O(e,a);if(!t)throw new n("callback_missing_header",`Missing required Human Gateway callback header: ${a}.`);return t}function T(e){let a=Number(e.timestamp);if(!Number.isFinite(a))throw new n("callback_invalid_timestamp","Human Gateway callback timestamp is invalid.");if(Math.abs(Date.now()-a)>e.toleranceMs)throw new n("callback_expired_timestamp","Human Gateway callback timestamp is outside the allowed tolerance.");return a}function D(e){let a;try{a=JSON.parse(e)}catch{throw new n("callback_invalid_json","Human Gateway callback body is not valid JSON.")}if(typeof a!="object"||a===null||Array.isArray(a))throw new n("callback_invalid_payload","Human Gateway callback payload must be a JSON object.");return a}function f(e){let a=e.payload[e.field];if(typeof a!="string"||!a)throw new n("callback_invalid_payload",`Human Gateway callback payload is missing a valid ${e.field}.`);return a}function y(e){if(e.actual!==e.expected)throw new n(e.code,e.message)}function H({body:e,headers:a,secret:t,toleranceMs:i=S,expectedProjectId:r}){if(!e)throw new n("callback_missing_body","Human Gateway callback raw body is required.");if(!t)throw new n("callback_missing_secret","Human Gateway callback secret is required.");let l=s(a,V),g=s(a,I),p=s(a,R),o=s(a,M),c=s(a,P);if(!/^[a-f0-9]{64}$/i.test(c))throw new n("callback_invalid_signature_format","Human Gateway callback signature format is invalid.");let h=T({timestamp:o,toleranceMs:i});if(!m({rawBody:e,timestamp:o,signature:c,secret:t,toleranceMs:i}))throw new n("callback_invalid_signature","Human Gateway callback signature is invalid.");let u=D(e),k=f({payload:u,field:"event_id"}),v=f({payload:u,field:"event"}),_=f({payload:u,field:"project_id"});return y({actual:k,expected:l,code:"callback_event_id_mismatch",message:"Human Gateway callback event_id does not match the signed header."}),y({actual:v,expected:g,code:"callback_event_type_mismatch",message:"Human Gateway callback event type does not match the signed header."}),y({actual:_,expected:p,code:"callback_project_id_mismatch",message:"Human Gateway callback project_id does not match the signed header."}),r&&y({actual:_,expected:r,code:"callback_project_id_mismatch",message:"Human Gateway callback project_id does not match the expected project."}),{event_id:k,event:v,project_id:_,timestamp:h,payload:u}}0&&(module.exports={HumanGatewayCallbackError,verifyCallback,verifyCallbackSignature});
+//# sourceMappingURL=server.cjs.map

package/dist/server.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server.ts","../src/verify-callback-signature.ts","../src/types.ts","../src/verify-callback.ts"],"sourcesContent":["export {\r\n    verifyCallbackSignature,\r\n    type VerifyCallbackSignatureInput,\r\n} from \"./verify-callback-signature\";\r\n\r\nexport { verifyCallback } from \"./verify-callback\";\r\n\r\nexport type {\r\n    HumanGatewayCallbackErrorCode,\r\n    HumanGatewayCallbackEventName,\r\n    HumanGatewayCallbackHeaders,\r\n    HumanGatewayCallbackPayload,\r\n    VerifiedHumanGatewayCallback,\r\n    VerifyCallbackInput,\r\n} from \"./types\";\r\n\r\nexport { HumanGatewayCallbackError } from \"./types\";","import { Buffer } from \"node:buffer\";\r\nimport { createHmac, timingSafeEqual } from \"node:crypto\";\r\n\r\nexport type VerifyCallbackSignatureInput = {\r\n    rawBody: string;\r\n    timestamp: string | null | undefined;\r\n    signature: string | null | undefined;\r\n    secret: string;\r\n    toleranceMs?: number;\r\n};\r\n\r\nconst DEFAULT_TOLERANCE_MS = 5 * 60 * 1000;\r\n\r\nexport function verifyCallbackSignature({\r\n    rawBody,\r\n    timestamp,\r\n    signature,\r\n    secret,\r\n    toleranceMs = DEFAULT_TOLERANCE_MS,\r\n}: VerifyCallbackSignatureInput): boolean {\r\n    if (!rawBody || !timestamp || !signature || !secret) {\r\n        return false;\r\n    }\r\n\r\n    const timestampNumber = Number(timestamp);\r\n\r\n    if (!Number.isFinite(timestampNumber)) {\r\n        return false;\r\n    }\r\n\r\n    const age = Math.abs(Date.now() - timestampNumber);\r\n\r\n    if (age > toleranceMs) {\r\n        return false;\r\n    }\r\n\r\n    if (!/^[a-f0-9]{64}$/i.test(signature)) {\r\n        return false;\r\n    }\r\n\r\n    const expectedSignature = createHmac(\"sha256\", secret)\r\n        .update(`${timestamp}.${rawBody}`)\r\n        .digest(\"hex\");\r\n\r\n    const expectedBuffer = Buffer.from(expectedSignature, \"hex\");\r\n    const receivedBuffer = Buffer.from(signature, \"hex\");\r\n\r\n    if (expectedBuffer.length !== receivedBuffer.length) {\r\n        return false;\r\n    }\r\n\r\n    return timingSafeEqual(expectedBuffer, receivedBuffer);\r\n}","export type HumanGatewayEnvironment =\r\n    | \"production\"\r\n    | \"sandbox\";\r\n\r\nexport type HumanGatewayMode =\r\n    | \"auto\"\r\n    | \"popup\"\r\n    | \"modal\"\r\n    | \"redirect\";\r\n\r\nexport type HumanGatewayOptions = {\r\n    projectId: string;\r\n    environment?: HumanGatewayEnvironment;\r\n    mode?: HumanGatewayMode;\r\n    baseUrl?: string;\r\n    timeoutMs?: number;\r\n};\r\n\r\nexport type HumanGatewayVerifyOptions = {\r\n    actionKey?: string;\r\n    onOpen?: () => void;\r\n    onClose?: () => void;\r\n    onSuccess?: (result: HumanGatewayResult) => void;\r\n    onError?: (error: HumanGatewayError) => void;\r\n};\r\n\r\nexport type HumanGatewayAuthOptions = {\r\n    actionKey?: string;\r\n    onOpen?: () => void;\r\n    onClose?: () => void;\r\n    onSuccess?: (result: HumanGatewayAuthResult) => void;\r\n    onError?: (error: HumanGatewayError) => void;\r\n};\r\n\r\nexport type HumanGatewayResult = {\r\n    success: boolean;\r\n    verified_human: boolean;\r\n    verification_level: HumanGatewayVerificationLevel;\r\n    unique_for_partner: boolean;\r\n    already_verified: boolean;\r\n    project_id: string;\r\n};\r\n\r\nexport type HumanGatewayAuthResult = {\r\n    success: boolean;\r\n    event?: \"auth.completed\";\r\n    verified_human: boolean;\r\n    verification_level: HumanGatewayVerificationLevel;\r\n    partner_user_id: string;\r\n    auth_session_id: string;\r\n    project_id: string;\r\n    expires_at: string;\r\n};\r\n\r\nexport type HumanGatewayMessage = {\r\n    source: \"human-gateway\";\r\n    type: \"human_gateway.verification.completed\";\r\n    payload: HumanGatewayResult;\r\n};\r\n\r\nexport type HumanGatewayAuthMessage = {\r\n    source: \"human-gateway\";\r\n    type: \"human_gateway.auth.completed\";\r\n    payload: HumanGatewayAuthResult;\r\n};\r\n\r\nexport type HumanGatewayErrorCode =\r\n    | \"popup_blocked\"\r\n    | \"user_closed\"\r\n    | \"timeout\"\r\n    | \"invalid_message\"\r\n    | \"invalid_origin\"\r\n    | \"verification_failed\"\r\n    | \"auth_failed\"\r\n    | \"unknown_error\";\r\n\r\nexport class HumanGatewayError extends Error {\r\n    code: HumanGatewayErrorCode;\r\n\r\n    constructor(code: HumanGatewayErrorCode, message: string) {\r\n        super(message);\r\n        this.name = \"HumanGatewayError\";\r\n        this.code = code;\r\n    }\r\n}\r\n\r\nexport type HumanGatewayCallbackEventName =\r\n    | \"verification.completed\"\r\n    | \"auth.completed\"\r\n    | \"callback.test\"\r\n    | (string & {});\r\n\r\nexport type HumanGatewayCallbackPayload = Record<string, unknown> & {\r\n    event_id?: unknown;\r\n    event?: unknown;\r\n    project_id?: unknown;\r\n};\r\n\r\nexport type HumanGatewayCallbackHeaders =\r\n    | Headers\r\n    | Record<string, string | string[] | null | undefined>;\r\n\r\nexport type VerifyCallbackInput = {\r\n    body: string;\r\n    headers: HumanGatewayCallbackHeaders;\r\n    secret: string;\r\n    toleranceMs?: number;\r\n    expectedProjectId?: string;\r\n};\r\n\r\nexport type VerifiedHumanGatewayCallback = {\r\n    event_id: string;\r\n    event: HumanGatewayCallbackEventName;\r\n    project_id: string;\r\n    timestamp: number;\r\n    payload: HumanGatewayCallbackPayload;\r\n};\r\n\r\nexport type HumanGatewayCallbackErrorCode =\r\n    | \"callback_missing_body\"\r\n    | \"callback_missing_secret\"\r\n    | \"callback_missing_header\"\r\n    | \"callback_invalid_timestamp\"\r\n    | \"callback_expired_timestamp\"\r\n    | \"callback_invalid_signature_format\"\r\n    | \"callback_invalid_signature\"\r\n    | \"callback_invalid_json\"\r\n    | \"callback_invalid_payload\"\r\n    | \"callback_event_id_mismatch\"\r\n    | \"callback_event_type_mismatch\"\r\n    | \"callback_project_id_mismatch\";\r\n\r\nexport class HumanGatewayCallbackError extends Error {\r\n    code: HumanGatewayCallbackErrorCode;\r\n\r\n    constructor(code: HumanGatewayCallbackErrorCode, message: string) {\r\n        super(message);\r\n        this.name = \"HumanGatewayCallbackError\";\r\n        this.code = code;\r\n    }\r\n}\r\n\r\nexport type HumanGatewayVerificationLevel =\r\n    | \"device\"\r\n    | \"document\"\r\n    | \"secure_document\"\r\n    | \"orb\"\r\n    | null;","import { verifyCallbackSignature } from \"./verify-callback-signature\";\r\nimport {\r\n    HumanGatewayCallbackError,\r\n    HumanGatewayCallbackHeaders,\r\n    HumanGatewayCallbackPayload,\r\n    VerifiedHumanGatewayCallback,\r\n    VerifyCallbackInput,\r\n} from \"./types\";\r\n\r\nconst DEFAULT_TOLERANCE_MS = 5 * 60 * 1000;\r\n\r\nconst HEADER_EVENT_ID = \"x-hg-event-id\";\r\nconst HEADER_EVENT = \"x-hg-event\";\r\nconst HEADER_PROJECT_ID = \"x-hg-project-id\";\r\nconst HEADER_TIMESTAMP = \"x-hg-timestamp\";\r\nconst HEADER_SIGNATURE = \"x-hg-signature\";\r\n\r\nfunction getHeader(\r\n    headers: HumanGatewayCallbackHeaders,\r\n    name: string\r\n): string | null {\r\n    const maybeHeaders = headers as {\r\n        get?: (headerName: string) => string | null;\r\n    };\r\n\r\n    if (typeof maybeHeaders.get === \"function\") {\r\n        return maybeHeaders.get(name);\r\n    }\r\n\r\n    const normalizedName = name.toLowerCase();\r\n\r\n    for (const [key, value] of Object.entries(headers)) {\r\n        if (key.toLowerCase() !== normalizedName) {\r\n            continue;\r\n        }\r\n\r\n        if (Array.isArray(value)) {\r\n            return value[0] ?? null;\r\n        }\r\n\r\n        return value ?? null;\r\n    }\r\n\r\n    return null;\r\n}\r\n\r\nfunction requireHeader(\r\n    headers: HumanGatewayCallbackHeaders,\r\n    name: string\r\n): string {\r\n    const value = getHeader(headers, name);\r\n\r\n    if (!value) {\r\n        throw new HumanGatewayCallbackError(\r\n            \"callback_missing_header\",\r\n            `Missing required Human Gateway callback header: ${name}.`\r\n        );\r\n    }\r\n\r\n    return value;\r\n}\r\n\r\nfunction parseTimestamp(input: {\r\n    timestamp: string;\r\n    toleranceMs: number;\r\n}): number {\r\n    const timestampNumber = Number(input.timestamp);\r\n\r\n    if (!Number.isFinite(timestampNumber)) {\r\n        throw new HumanGatewayCallbackError(\r\n            \"callback_invalid_timestamp\",\r\n            \"Human Gateway callback timestamp is invalid.\"\r\n        );\r\n    }\r\n\r\n    const age = Math.abs(Date.now() - timestampNumber);\r\n\r\n    if (age > input.toleranceMs) {\r\n        throw new HumanGatewayCallbackError(\r\n            \"callback_expired_timestamp\",\r\n            \"Human Gateway callback timestamp is outside the allowed tolerance.\"\r\n        );\r\n    }\r\n\r\n    return timestampNumber;\r\n}\r\n\r\nfunction parsePayload(body: string): HumanGatewayCallbackPayload {\r\n    let parsed: unknown;\r\n\r\n    try {\r\n        parsed = JSON.parse(body);\r\n    } catch {\r\n        throw new HumanGatewayCallbackError(\r\n            \"callback_invalid_json\",\r\n            \"Human Gateway callback body is not valid JSON.\"\r\n        );\r\n    }\r\n\r\n    if (\r\n        typeof parsed !== \"object\" ||\r\n        parsed === null ||\r\n        Array.isArray(parsed)\r\n    ) {\r\n        throw new HumanGatewayCallbackError(\r\n            \"callback_invalid_payload\",\r\n            \"Human Gateway callback payload must be a JSON object.\"\r\n        );\r\n    }\r\n\r\n    return parsed as HumanGatewayCallbackPayload;\r\n}\r\n\r\nfunction requireStringPayloadField(input: {\r\n    payload: HumanGatewayCallbackPayload;\r\n    field: \"event_id\" | \"event\" | \"project_id\";\r\n}): string {\r\n    const value = input.payload[input.field];\r\n\r\n    if (typeof value !== \"string\" || !value) {\r\n        throw new HumanGatewayCallbackError(\r\n            \"callback_invalid_payload\",\r\n            `Human Gateway callback payload is missing a valid ${input.field}.`\r\n        );\r\n    }\r\n\r\n    return value;\r\n}\r\n\r\nfunction assertMatches(input: {\r\n    actual: string;\r\n    expected: string;\r\n    code:\r\n    | \"callback_event_id_mismatch\"\r\n    | \"callback_event_type_mismatch\"\r\n    | \"callback_project_id_mismatch\";\r\n    message: string;\r\n}): void {\r\n    if (input.actual !== input.expected) {\r\n        throw new HumanGatewayCallbackError(input.code, input.message);\r\n    }\r\n}\r\n\r\nexport function verifyCallback({\r\n    body,\r\n    headers,\r\n    secret,\r\n    toleranceMs = DEFAULT_TOLERANCE_MS,\r\n    expectedProjectId,\r\n}: VerifyCallbackInput): VerifiedHumanGatewayCallback {\r\n    if (!body) {\r\n        throw new HumanGatewayCallbackError(\r\n            \"callback_missing_body\",\r\n            \"Human Gateway callback raw body is required.\"\r\n        );\r\n    }\r\n\r\n    if (!secret) {\r\n        throw new HumanGatewayCallbackError(\r\n            \"callback_missing_secret\",\r\n            \"Human Gateway callback secret is required.\"\r\n        );\r\n    }\r\n\r\n    const headerEventId = requireHeader(headers, HEADER_EVENT_ID);\r\n    const headerEvent = requireHeader(headers, HEADER_EVENT);\r\n    const headerProjectId = requireHeader(headers, HEADER_PROJECT_ID);\r\n    const headerTimestamp = requireHeader(headers, HEADER_TIMESTAMP);\r\n    const headerSignature = requireHeader(headers, HEADER_SIGNATURE);\r\n\r\n    if (!/^[a-f0-9]{64}$/i.test(headerSignature)) {\r\n        throw new HumanGatewayCallbackError(\r\n            \"callback_invalid_signature_format\",\r\n            \"Human Gateway callback signature format is invalid.\"\r\n        );\r\n    }\r\n\r\n    const timestamp = parseTimestamp({\r\n        timestamp: headerTimestamp,\r\n        toleranceMs,\r\n    });\r\n\r\n    const signatureIsValid = verifyCallbackSignature({\r\n        rawBody: body,\r\n        timestamp: headerTimestamp,\r\n        signature: headerSignature,\r\n        secret,\r\n        toleranceMs,\r\n    });\r\n\r\n    if (!signatureIsValid) {\r\n        throw new HumanGatewayCallbackError(\r\n            \"callback_invalid_signature\",\r\n            \"Human Gateway callback signature is invalid.\"\r\n        );\r\n    }\r\n\r\n    const payload = parsePayload(body);\r\n\r\n    const payloadEventId = requireStringPayloadField({\r\n        payload,\r\n        field: \"event_id\",\r\n    });\r\n\r\n    const payloadEvent = requireStringPayloadField({\r\n        payload,\r\n        field: \"event\",\r\n    });\r\n\r\n    const payloadProjectId = requireStringPayloadField({\r\n        payload,\r\n        field: \"project_id\",\r\n    });\r\n\r\n    assertMatches({\r\n        actual: payloadEventId,\r\n        expected: headerEventId,\r\n        code: \"callback_event_id_mismatch\",\r\n        message:\r\n            \"Human Gateway callback event_id does not match the signed header.\",\r\n    });\r\n\r\n    assertMatches({\r\n        actual: payloadEvent,\r\n        expected: headerEvent,\r\n        code: \"callback_event_type_mismatch\",\r\n        message:\r\n            \"Human Gateway callback event type does not match the signed header.\",\r\n    });\r\n\r\n    assertMatches({\r\n        actual: payloadProjectId,\r\n        expected: headerProjectId,\r\n        code: \"callback_project_id_mismatch\",\r\n        message:\r\n            \"Human Gateway callback project_id does not match the signed header.\",\r\n    });\r\n\r\n    if (expectedProjectId) {\r\n        assertMatches({\r\n            actual: payloadProjectId,\r\n            expected: expectedProjectId,\r\n            code: \"callback_project_id_mismatch\",\r\n            message:\r\n                \"Human Gateway callback project_id does not match the expected project.\",\r\n        });\r\n    }\r\n\r\n    return {\r\n        event_id: payloadEventId,\r\n        event: payloadEvent,\r\n        project_id: payloadProjectId,\r\n        timestamp,\r\n        payload,\r\n    };\r\n}"],"mappings":"yaAAA,IAAAA,EAAA,GAAAC,EAAAD,EAAA,+BAAAE,EAAA,mBAAAC,EAAA,4BAAAC,IAAA,eAAAC,EAAAL,GCAA,IAAAM,EAAuB,kBACvBC,EAA4C,kBAUtCC,EAAuB,IAAS,IAE/B,SAASC,EAAwB,CACpC,QAAAC,EACA,UAAAC,EACA,UAAAC,EACA,OAAAC,EACA,YAAAC,EAAcN,CAClB,EAA0C,CACtC,GAAI,CAACE,GAAW,CAACC,GAAa,CAACC,GAAa,CAACC,EACzC,MAAO,GAGX,IAAME,EAAkB,OAAOJ,CAAS,EAYxC,GAVI,CAAC,OAAO,SAASI,CAAe,GAIxB,KAAK,IAAI,KAAK,IAAI,EAAIA,CAAe,EAEvCD,GAIN,CAAC,kBAAkB,KAAKF,CAAS,EACjC,MAAO,GAGX,IAAMI,KAAoB,cAAW,SAAUH,CAAM,EAChD,OAAO,GAAGF,CAAS,IAAID,CAAO,EAAE,EAChC,OAAO,KAAK,EAEXO,EAAiB,SAAO,KAAKD,EAAmB,KAAK,EACrDE,EAAiB,SAAO,KAAKN,EAAW,KAAK,EAEnD,OAAIK,EAAe,SAAWC,EAAe,OAClC,MAGJ,mBAAgBD,EAAgBC,CAAc,CACzD,CCgFO,IAAMC,EAAN,cAAwC,KAAM,CAGjD,YAAYC,EAAqCC,EAAiB,CAC9D,MAAMA,CAAO,EACb,KAAK,KAAO,4BACZ,KAAK,KAAOD,CAChB,CACJ,ECnIA,IAAME,EAAuB,IAAS,IAEhCC,EAAkB,gBAClBC,EAAe,aACfC,EAAoB,kBACpBC,EAAmB,iBACnBC,EAAmB,iBAEzB,SAASC,EACLC,EACAC,EACa,CACb,IAAMC,EAAeF,EAIrB,GAAI,OAAOE,EAAa,KAAQ,WAC5B,OAAOA,EAAa,IAAID,CAAI,EAGhC,IAAME,EAAiBF,EAAK,YAAY,EAExC,OAAW,CAACG,EAAKC,CAAK,IAAK,OAAO,QAAQL,CAAO,EAC7C,GAAII,EAAI,YAAY,IAAMD,EAI1B,OAAI,MAAM,QAAQE,CAAK,EACZA,EAAM,CAAC,GAAK,KAGhBA,GAAS,KAGpB,OAAO,IACX,CAEA,SAASC,EACLN,EACAC,EACM,CACN,IAAMI,EAAQN,EAAUC,EAASC,CAAI,EAErC,GAAI,CAACI,EACD,MAAM,IAAIE,EACN,0BACA,mDAAmDN,CAAI,GAC3D,EAGJ,OAAOI,CACX,CAEA,SAASG,EAAeC,EAGb,CACP,IAAMC,EAAkB,OAAOD,EAAM,SAAS,EAE9C,GAAI,CAAC,OAAO,SAASC,CAAe,EAChC,MAAM,IAAIH,EACN,6BACA,8CACJ,EAKJ,GAFY,KAAK,IAAI,KAAK,IAAI,EAAIG,CAAe,EAEvCD,EAAM,YACZ,MAAM,IAAIF,EACN,6BACA,oEACJ,EAGJ,OAAOG,CACX,CAEA,SAASC,EAAaC,EAA2C,CAC7D,IAAIC,EAEJ,GAAI,CACAA,EAAS,KAAK,MAAMD,CAAI,CAC5B,MAAQ,CACJ,MAAM,IAAIL,EACN,wBACA,gDACJ,CACJ,CAEA,GACI,OAAOM,GAAW,UAClBA,IAAW,MACX,MAAM,QAAQA,CAAM,EAEpB,MAAM,IAAIN,EACN,2BACA,uDACJ,EAGJ,OAAOM,CACX,CAEA,SAASC,EAA0BL,EAGxB,CACP,IAAMJ,EAAQI,EAAM,QAAQA,EAAM,KAAK,EAEvC,GAAI,OAAOJ,GAAU,UAAY,CAACA,EAC9B,MAAM,IAAIE,EACN,2BACA,qDAAqDE,EAAM,KAAK,GACpE,EAGJ,OAAOJ,CACX,CAEA,SAASU,EAAcN,EAQd,CACL,GAAIA,EAAM,SAAWA,EAAM,SACvB,MAAM,IAAIF,EAA0BE,EAAM,KAAMA,EAAM,OAAO,CAErE,CAEO,SAASO,EAAe,CAC3B,KAAAJ,EACA,QAAAZ,EACA,OAAAiB,EACA,YAAAC,EAAczB,EACd,kBAAA0B,CACJ,EAAsD,CAClD,GAAI,CAACP,EACD,MAAM,IAAIL,EACN,wBACA,8CACJ,EAGJ,GAAI,CAACU,EACD,MAAM,IAAIV,EACN,0BACA,4CACJ,EAGJ,IAAMa,EAAgBd,EAAcN,EAASN,CAAe,EACtD2B,EAAcf,EAAcN,EAASL,CAAY,EACjD2B,EAAkBhB,EAAcN,EAASJ,CAAiB,EAC1D2B,EAAkBjB,EAAcN,EAASH,CAAgB,EACzD2B,EAAkBlB,EAAcN,EAASF,CAAgB,EAE/D,GAAI,CAAC,kBAAkB,KAAK0B,CAAe,EACvC,MAAM,IAAIjB,EACN,oCACA,qDACJ,EAGJ,IAAMkB,EAAYjB,EAAe,CAC7B,UAAWe,EACX,YAAAL,CACJ,CAAC,EAUD,GAAI,CARqBQ,EAAwB,CAC7C,QAASd,EACT,UAAWW,EACX,UAAWC,EACX,OAAAP,EACA,YAAAC,CACJ,CAAC,EAGG,MAAM,IAAIX,EACN,6BACA,8CACJ,EAGJ,IAAMoB,EAAUhB,EAAaC,CAAI,EAE3BgB,EAAiBd,EAA0B,CAC7C,QAAAa,EACA,MAAO,UACX,CAAC,EAEKE,EAAef,EAA0B,CAC3C,QAAAa,EACA,MAAO,OACX,CAAC,EAEKG,EAAmBhB,EAA0B,CAC/C,QAAAa,EACA,MAAO,YACX,CAAC,EAED,OAAAZ,EAAc,CACV,OAAQa,EACR,SAAUR,EACV,KAAM,6BACN,QACI,mEACR,CAAC,EAEDL,EAAc,CACV,OAAQc,EACR,SAAUR,EACV,KAAM,+BACN,QACI,qEACR,CAAC,EAEDN,EAAc,CACV,OAAQe,EACR,SAAUR,EACV,KAAM,+BACN,QACI,qEACR,CAAC,EAEGH,GACAJ,EAAc,CACV,OAAQe,EACR,SAAUX,EACV,KAAM,+BACN,QACI,wEACR,CAAC,EAGE,CACH,SAAUS,EACV,MAAOC,EACP,WAAYC,EACZ,UAAAL,EACA,QAAAE,CACJ,CACJ","names":["server_exports","__export","HumanGatewayCallbackError","verifyCallback","verifyCallbackSignature","__toCommonJS","import_node_buffer","import_node_crypto","DEFAULT_TOLERANCE_MS","verifyCallbackSignature","rawBody","timestamp","signature","secret","toleranceMs","timestampNumber","expectedSignature","expectedBuffer","receivedBuffer","HumanGatewayCallbackError","code","message","DEFAULT_TOLERANCE_MS","HEADER_EVENT_ID","HEADER_EVENT","HEADER_PROJECT_ID","HEADER_TIMESTAMP","HEADER_SIGNATURE","getHeader","headers","name","maybeHeaders","normalizedName","key","value","requireHeader","HumanGatewayCallbackError","parseTimestamp","input","timestampNumber","parsePayload","body","parsed","requireStringPayloadField","assertMatches","verifyCallback","secret","toleranceMs","expectedProjectId","headerEventId","headerEvent","headerProjectId","headerTimestamp","headerSignature","timestamp","verifyCallbackSignature","payload","payloadEventId","payloadEvent","payloadProjectId"]}

package/dist/server.d.cts

@@ -0,0 +1,15 @@
+import { q as VerifyCallbackInput, V as VerifiedHumanGatewayCallback } from './types-BR0Sarec.cjs';
+export { c as HumanGatewayCallbackError, d as HumanGatewayCallbackErrorCode, e as HumanGatewayCallbackEventName, f as HumanGatewayCallbackHeaders, g as HumanGatewayCallbackPayload } from './types-BR0Sarec.cjs';
+
+type VerifyCallbackSignatureInput = {
+    rawBody: string;
+    timestamp: string | null | undefined;
+    signature: string | null | undefined;
+    secret: string;
+    toleranceMs?: number;
+};
+declare function verifyCallbackSignature({ rawBody, timestamp, signature, secret, toleranceMs, }: VerifyCallbackSignatureInput): boolean;
+
+declare function verifyCallback({ body, headers, secret, toleranceMs, expectedProjectId, }: VerifyCallbackInput): VerifiedHumanGatewayCallback;
+
+export { VerifiedHumanGatewayCallback, VerifyCallbackInput, type VerifyCallbackSignatureInput, verifyCallback, verifyCallbackSignature };

package/dist/server.d.ts

@@ -0,0 +1,15 @@
+import { q as VerifyCallbackInput, V as VerifiedHumanGatewayCallback } from './types-BR0Sarec.js';
+export { c as HumanGatewayCallbackError, d as HumanGatewayCallbackErrorCode, e as HumanGatewayCallbackEventName, f as HumanGatewayCallbackHeaders, g as HumanGatewayCallbackPayload } from './types-BR0Sarec.js';
+
+type VerifyCallbackSignatureInput = {
+    rawBody: string;
+    timestamp: string | null | undefined;
+    signature: string | null | undefined;
+    secret: string;
+    toleranceMs?: number;
+};
+declare function verifyCallbackSignature({ rawBody, timestamp, signature, secret, toleranceMs, }: VerifyCallbackSignatureInput): boolean;
+
+declare function verifyCallback({ body, headers, secret, toleranceMs, expectedProjectId, }: VerifyCallbackInput): VerifiedHumanGatewayCallback;
+
+export { VerifiedHumanGatewayCallback, VerifyCallbackInput, type VerifyCallbackSignatureInput, verifyCallback, verifyCallbackSignature };

package/dist/server.js

@@ -0,0 +1,2 @@
+import{b as n}from"./chunk-GJKDROWD.js";import{Buffer as k}from"buffer";import{createHmac as h,timingSafeEqual as H}from"crypto";var v=300*1e3;function y({rawBody:e,timestamp:a,signature:t,secret:r,toleranceMs:i=v}){if(!e||!a||!t||!r)return!1;let l=Number(a);if(!Number.isFinite(l)||Math.abs(Date.now()-l)>i||!/^[a-f0-9]{64}$/i.test(t))return!1;let u=h("sha256",r).update(`${a}.${e}`).digest("hex"),c=k.from(u,"hex"),o=k.from(t,"hex");return c.length!==o.length?!1:H(c,o)}var C=300*1e3,E="x-hg-event-id",G="x-hg-event",x="x-hg-project-id",N="x-hg-timestamp",S="x-hg-signature";function j(e,a){let t=e;if(typeof t.get=="function")return t.get(a);let r=a.toLowerCase();for(let[i,l]of Object.entries(e))if(i.toLowerCase()===r)return Array.isArray(l)?l[0]??null:l??null;return null}function s(e,a){let t=j(e,a);if(!t)throw new n("callback_missing_header",`Missing required Human Gateway callback header: ${a}.`);return t}function A(e){let a=Number(e.timestamp);if(!Number.isFinite(a))throw new n("callback_invalid_timestamp","Human Gateway callback timestamp is invalid.");if(Math.abs(Date.now()-a)>e.toleranceMs)throw new n("callback_expired_timestamp","Human Gateway callback timestamp is outside the allowed tolerance.");return a}function I(e){let a;try{a=JSON.parse(e)}catch{throw new n("callback_invalid_json","Human Gateway callback body is not valid JSON.")}if(typeof a!="object"||a===null||Array.isArray(a))throw new n("callback_invalid_payload","Human Gateway callback payload must be a JSON object.");return a}function b(e){let a=e.payload[e.field];if(typeof a!="string"||!a)throw new n("callback_invalid_payload",`Human Gateway callback payload is missing a valid ${e.field}.`);return a}function d(e){if(e.actual!==e.expected)throw new n(e.code,e.message)}function V({body:e,headers:a,secret:t,toleranceMs:r=C,expectedProjectId:i}){if(!e)throw new n("callback_missing_body","Human Gateway callback raw body is required.");if(!t)throw new n("callback_missing_secret","Human Gateway callback secret is required.");let l=s(a,E),p=s(a,G),u=s(a,x),c=s(a,N),o=s(a,S);if(!/^[a-f0-9]{64}$/i.test(o))throw new n("callback_invalid_signature_format","Human Gateway callback signature format is invalid.");let w=A({timestamp:c,toleranceMs:r});if(!y({rawBody:e,timestamp:c,signature:o,secret:t,toleranceMs:r}))throw new n("callback_invalid_signature","Human Gateway callback signature is invalid.");let m=I(e),g=b({payload:m,field:"event_id"}),_=b({payload:m,field:"event"}),f=b({payload:m,field:"project_id"});return d({actual:g,expected:l,code:"callback_event_id_mismatch",message:"Human Gateway callback event_id does not match the signed header."}),d({actual:_,expected:p,code:"callback_event_type_mismatch",message:"Human Gateway callback event type does not match the signed header."}),d({actual:f,expected:u,code:"callback_project_id_mismatch",message:"Human Gateway callback project_id does not match the signed header."}),i&&d({actual:f,expected:i,code:"callback_project_id_mismatch",message:"Human Gateway callback project_id does not match the expected project."}),{event_id:g,event:_,project_id:f,timestamp:w,payload:m}}export{n as HumanGatewayCallbackError,V as verifyCallback,y as verifyCallbackSignature};
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/verify-callback-signature.ts","../src/verify-callback.ts"],"sourcesContent":["import { Buffer } from \"node:buffer\";\r\nimport { createHmac, timingSafeEqual } from \"node:crypto\";\r\n\r\nexport type VerifyCallbackSignatureInput = {\r\n    rawBody: string;\r\n    timestamp: string | null | undefined;\r\n    signature: string | null | undefined;\r\n    secret: string;\r\n    toleranceMs?: number;\r\n};\r\n\r\nconst DEFAULT_TOLERANCE_MS = 5 * 60 * 1000;\r\n\r\nexport function verifyCallbackSignature({\r\n    rawBody,\r\n    timestamp,\r\n    signature,\r\n    secret,\r\n    toleranceMs = DEFAULT_TOLERANCE_MS,\r\n}: VerifyCallbackSignatureInput): boolean {\r\n    if (!rawBody || !timestamp || !signature || !secret) {\r\n        return false;\r\n    }\r\n\r\n    const timestampNumber = Number(timestamp);\r\n\r\n    if (!Number.isFinite(timestampNumber)) {\r\n        return false;\r\n    }\r\n\r\n    const age = Math.abs(Date.now() - timestampNumber);\r\n\r\n    if (age > toleranceMs) {\r\n        return false;\r\n    }\r\n\r\n    if (!/^[a-f0-9]{64}$/i.test(signature)) {\r\n        return false;\r\n    }\r\n\r\n    const expectedSignature = createHmac(\"sha256\", secret)\r\n        .update(`${timestamp}.${rawBody}`)\r\n        .digest(\"hex\");\r\n\r\n    const expectedBuffer = Buffer.from(expectedSignature, \"hex\");\r\n    const receivedBuffer = Buffer.from(signature, \"hex\");\r\n\r\n    if (expectedBuffer.length !== receivedBuffer.length) {\r\n        return false;\r\n    }\r\n\r\n    return timingSafeEqual(expectedBuffer, receivedBuffer);\r\n}","import { verifyCallbackSignature } from \"./verify-callback-signature\";\r\nimport {\r\n    HumanGatewayCallbackError,\r\n    HumanGatewayCallbackHeaders,\r\n    HumanGatewayCallbackPayload,\r\n    VerifiedHumanGatewayCallback,\r\n    VerifyCallbackInput,\r\n} from \"./types\";\r\n\r\nconst DEFAULT_TOLERANCE_MS = 5 * 60 * 1000;\r\n\r\nconst HEADER_EVENT_ID = \"x-hg-event-id\";\r\nconst HEADER_EVENT = \"x-hg-event\";\r\nconst HEADER_PROJECT_ID = \"x-hg-project-id\";\r\nconst HEADER_TIMESTAMP = \"x-hg-timestamp\";\r\nconst HEADER_SIGNATURE = \"x-hg-signature\";\r\n\r\nfunction getHeader(\r\n    headers: HumanGatewayCallbackHeaders,\r\n    name: string\r\n): string | null {\r\n    const maybeHeaders = headers as {\r\n        get?: (headerName: string) => string | null;\r\n    };\r\n\r\n    if (typeof maybeHeaders.get === \"function\") {\r\n        return maybeHeaders.get(name);\r\n    }\r\n\r\n    const normalizedName = name.toLowerCase();\r\n\r\n    for (const [key, value] of Object.entries(headers)) {\r\n        if (key.toLowerCase() !== normalizedName) {\r\n            continue;\r\n        }\r\n\r\n        if (Array.isArray(value)) {\r\n            return value[0] ?? null;\r\n        }\r\n\r\n        return value ?? null;\r\n    }\r\n\r\n    return null;\r\n}\r\n\r\nfunction requireHeader(\r\n    headers: HumanGatewayCallbackHeaders,\r\n    name: string\r\n): string {\r\n    const value = getHeader(headers, name);\r\n\r\n    if (!value) {\r\n        throw new HumanGatewayCallbackError(\r\n            \"callback_missing_header\",\r\n            `Missing required Human Gateway callback header: ${name}.`\r\n        );\r\n    }\r\n\r\n    return value;\r\n}\r\n\r\nfunction parseTimestamp(input: {\r\n    timestamp: string;\r\n    toleranceMs: number;\r\n}): number {\r\n    const timestampNumber = Number(input.timestamp);\r\n\r\n    if (!Number.isFinite(timestampNumber)) {\r\n        throw new HumanGatewayCallbackError(\r\n            \"callback_invalid_timestamp\",\r\n            \"Human Gateway callback timestamp is invalid.\"\r\n        );\r\n    }\r\n\r\n    const age = Math.abs(Date.now() - timestampNumber);\r\n\r\n    if (age > input.toleranceMs) {\r\n        throw new HumanGatewayCallbackError(\r\n            \"callback_expired_timestamp\",\r\n            \"Human Gateway callback timestamp is outside the allowed tolerance.\"\r\n        );\r\n    }\r\n\r\n    return timestampNumber;\r\n}\r\n\r\nfunction parsePayload(body: string): HumanGatewayCallbackPayload {\r\n    let parsed: unknown;\r\n\r\n    try {\r\n        parsed = JSON.parse(body);\r\n    } catch {\r\n        throw new HumanGatewayCallbackError(\r\n            \"callback_invalid_json\",\r\n            \"Human Gateway callback body is not valid JSON.\"\r\n        );\r\n    }\r\n\r\n    if (\r\n        typeof parsed !== \"object\" ||\r\n        parsed === null ||\r\n        Array.isArray(parsed)\r\n    ) {\r\n        throw new HumanGatewayCallbackError(\r\n            \"callback_invalid_payload\",\r\n            \"Human Gateway callback payload must be a JSON object.\"\r\n        );\r\n    }\r\n\r\n    return parsed as HumanGatewayCallbackPayload;\r\n}\r\n\r\nfunction requireStringPayloadField(input: {\r\n    payload: HumanGatewayCallbackPayload;\r\n    field: \"event_id\" | \"event\" | \"project_id\";\r\n}): string {\r\n    const value = input.payload[input.field];\r\n\r\n    if (typeof value !== \"string\" || !value) {\r\n        throw new HumanGatewayCallbackError(\r\n            \"callback_invalid_payload\",\r\n            `Human Gateway callback payload is missing a valid ${input.field}.`\r\n        );\r\n    }\r\n\r\n    return value;\r\n}\r\n\r\nfunction assertMatches(input: {\r\n    actual: string;\r\n    expected: string;\r\n    code:\r\n    | \"callback_event_id_mismatch\"\r\n    | \"callback_event_type_mismatch\"\r\n    | \"callback_project_id_mismatch\";\r\n    message: string;\r\n}): void {\r\n    if (input.actual !== input.expected) {\r\n        throw new HumanGatewayCallbackError(input.code, input.message);\r\n    }\r\n}\r\n\r\nexport function verifyCallback({\r\n    body,\r\n    headers,\r\n    secret,\r\n    toleranceMs = DEFAULT_TOLERANCE_MS,\r\n    expectedProjectId,\r\n}: VerifyCallbackInput): VerifiedHumanGatewayCallback {\r\n    if (!body) {\r\n        throw new HumanGatewayCallbackError(\r\n            \"callback_missing_body\",\r\n            \"Human Gateway callback raw body is required.\"\r\n        );\r\n    }\r\n\r\n    if (!secret) {\r\n        throw new HumanGatewayCallbackError(\r\n            \"callback_missing_secret\",\r\n            \"Human Gateway callback secret is required.\"\r\n        );\r\n    }\r\n\r\n    const headerEventId = requireHeader(headers, HEADER_EVENT_ID);\r\n    const headerEvent = requireHeader(headers, HEADER_EVENT);\r\n    const headerProjectId = requireHeader(headers, HEADER_PROJECT_ID);\r\n    const headerTimestamp = requireHeader(headers, HEADER_TIMESTAMP);\r\n    const headerSignature = requireHeader(headers, HEADER_SIGNATURE);\r\n\r\n    if (!/^[a-f0-9]{64}$/i.test(headerSignature)) {\r\n        throw new HumanGatewayCallbackError(\r\n            \"callback_invalid_signature_format\",\r\n            \"Human Gateway callback signature format is invalid.\"\r\n        );\r\n    }\r\n\r\n    const timestamp = parseTimestamp({\r\n        timestamp: headerTimestamp,\r\n        toleranceMs,\r\n    });\r\n\r\n    const signatureIsValid = verifyCallbackSignature({\r\n        rawBody: body,\r\n        timestamp: headerTimestamp,\r\n        signature: headerSignature,\r\n        secret,\r\n        toleranceMs,\r\n    });\r\n\r\n    if (!signatureIsValid) {\r\n        throw new HumanGatewayCallbackError(\r\n            \"callback_invalid_signature\",\r\n            \"Human Gateway callback signature is invalid.\"\r\n        );\r\n    }\r\n\r\n    const payload = parsePayload(body);\r\n\r\n    const payloadEventId = requireStringPayloadField({\r\n        payload,\r\n        field: \"event_id\",\r\n    });\r\n\r\n    const payloadEvent = requireStringPayloadField({\r\n        payload,\r\n        field: \"event\",\r\n    });\r\n\r\n    const payloadProjectId = requireStringPayloadField({\r\n        payload,\r\n        field: \"project_id\",\r\n    });\r\n\r\n    assertMatches({\r\n        actual: payloadEventId,\r\n        expected: headerEventId,\r\n        code: \"callback_event_id_mismatch\",\r\n        message:\r\n            \"Human Gateway callback event_id does not match the signed header.\",\r\n    });\r\n\r\n    assertMatches({\r\n        actual: payloadEvent,\r\n        expected: headerEvent,\r\n        code: \"callback_event_type_mismatch\",\r\n        message:\r\n            \"Human Gateway callback event type does not match the signed header.\",\r\n    });\r\n\r\n    assertMatches({\r\n        actual: payloadProjectId,\r\n        expected: headerProjectId,\r\n        code: \"callback_project_id_mismatch\",\r\n        message:\r\n            \"Human Gateway callback project_id does not match the signed header.\",\r\n    });\r\n\r\n    if (expectedProjectId) {\r\n        assertMatches({\r\n            actual: payloadProjectId,\r\n            expected: expectedProjectId,\r\n            code: \"callback_project_id_mismatch\",\r\n            message:\r\n                \"Human Gateway callback project_id does not match the expected project.\",\r\n        });\r\n    }\r\n\r\n    return {\r\n        event_id: payloadEventId,\r\n        event: payloadEvent,\r\n        project_id: payloadProjectId,\r\n        timestamp,\r\n        payload,\r\n    };\r\n}"],"mappings":"wCAAA,OAAS,UAAAA,MAAc,SACvB,OAAS,cAAAC,EAAY,mBAAAC,MAAuB,SAU5C,IAAMC,EAAuB,IAAS,IAE/B,SAASC,EAAwB,CACpC,QAAAC,EACA,UAAAC,EACA,UAAAC,EACA,OAAAC,EACA,YAAAC,EAAcN,CAClB,EAA0C,CACtC,GAAI,CAACE,GAAW,CAACC,GAAa,CAACC,GAAa,CAACC,EACzC,MAAO,GAGX,IAAME,EAAkB,OAAOJ,CAAS,EAYxC,GAVI,CAAC,OAAO,SAASI,CAAe,GAIxB,KAAK,IAAI,KAAK,IAAI,EAAIA,CAAe,EAEvCD,GAIN,CAAC,kBAAkB,KAAKF,CAAS,EACjC,MAAO,GAGX,IAAMI,EAAoBV,EAAW,SAAUO,CAAM,EAChD,OAAO,GAAGF,CAAS,IAAID,CAAO,EAAE,EAChC,OAAO,KAAK,EAEXO,EAAiBZ,EAAO,KAAKW,EAAmB,KAAK,EACrDE,EAAiBb,EAAO,KAAKO,EAAW,KAAK,EAEnD,OAAIK,EAAe,SAAWC,EAAe,OAClC,GAGJX,EAAgBU,EAAgBC,CAAc,CACzD,CC3CA,IAAMC,EAAuB,IAAS,IAEhCC,EAAkB,gBAClBC,EAAe,aACfC,EAAoB,kBACpBC,EAAmB,iBACnBC,EAAmB,iBAEzB,SAASC,EACLC,EACAC,EACa,CACb,IAAMC,EAAeF,EAIrB,GAAI,OAAOE,EAAa,KAAQ,WAC5B,OAAOA,EAAa,IAAID,CAAI,EAGhC,IAAME,EAAiBF,EAAK,YAAY,EAExC,OAAW,CAACG,EAAKC,CAAK,IAAK,OAAO,QAAQL,CAAO,EAC7C,GAAII,EAAI,YAAY,IAAMD,EAI1B,OAAI,MAAM,QAAQE,CAAK,EACZA,EAAM,CAAC,GAAK,KAGhBA,GAAS,KAGpB,OAAO,IACX,CAEA,SAASC,EACLN,EACAC,EACM,CACN,IAAMI,EAAQN,EAAUC,EAASC,CAAI,EAErC,GAAI,CAACI,EACD,MAAM,IAAIE,EACN,0BACA,mDAAmDN,CAAI,GAC3D,EAGJ,OAAOI,CACX,CAEA,SAASG,EAAeC,EAGb,CACP,IAAMC,EAAkB,OAAOD,EAAM,SAAS,EAE9C,GAAI,CAAC,OAAO,SAASC,CAAe,EAChC,MAAM,IAAIH,EACN,6BACA,8CACJ,EAKJ,GAFY,KAAK,IAAI,KAAK,IAAI,EAAIG,CAAe,EAEvCD,EAAM,YACZ,MAAM,IAAIF,EACN,6BACA,oEACJ,EAGJ,OAAOG,CACX,CAEA,SAASC,EAAaC,EAA2C,CAC7D,IAAIC,EAEJ,GAAI,CACAA,EAAS,KAAK,MAAMD,CAAI,CAC5B,MAAQ,CACJ,MAAM,IAAIL,EACN,wBACA,gDACJ,CACJ,CAEA,GACI,OAAOM,GAAW,UAClBA,IAAW,MACX,MAAM,QAAQA,CAAM,EAEpB,MAAM,IAAIN,EACN,2BACA,uDACJ,EAGJ,OAAOM,CACX,CAEA,SAASC,EAA0BL,EAGxB,CACP,IAAMJ,EAAQI,EAAM,QAAQA,EAAM,KAAK,EAEvC,GAAI,OAAOJ,GAAU,UAAY,CAACA,EAC9B,MAAM,IAAIE,EACN,2BACA,qDAAqDE,EAAM,KAAK,GACpE,EAGJ,OAAOJ,CACX,CAEA,SAASU,EAAcN,EAQd,CACL,GAAIA,EAAM,SAAWA,EAAM,SACvB,MAAM,IAAIF,EAA0BE,EAAM,KAAMA,EAAM,OAAO,CAErE,CAEO,SAASO,EAAe,CAC3B,KAAAJ,EACA,QAAAZ,EACA,OAAAiB,EACA,YAAAC,EAAczB,EACd,kBAAA0B,CACJ,EAAsD,CAClD,GAAI,CAACP,EACD,MAAM,IAAIL,EACN,wBACA,8CACJ,EAGJ,GAAI,CAACU,EACD,MAAM,IAAIV,EACN,0BACA,4CACJ,EAGJ,IAAMa,EAAgBd,EAAcN,EAASN,CAAe,EACtD2B,EAAcf,EAAcN,EAASL,CAAY,EACjD2B,EAAkBhB,EAAcN,EAASJ,CAAiB,EAC1D2B,EAAkBjB,EAAcN,EAASH,CAAgB,EACzD2B,EAAkBlB,EAAcN,EAASF,CAAgB,EAE/D,GAAI,CAAC,kBAAkB,KAAK0B,CAAe,EACvC,MAAM,IAAIjB,EACN,oCACA,qDACJ,EAGJ,IAAMkB,EAAYjB,EAAe,CAC7B,UAAWe,EACX,YAAAL,CACJ,CAAC,EAUD,GAAI,CARqBQ,EAAwB,CAC7C,QAASd,EACT,UAAWW,EACX,UAAWC,EACX,OAAAP,EACA,YAAAC,CACJ,CAAC,EAGG,MAAM,IAAIX,EACN,6BACA,8CACJ,EAGJ,IAAMoB,EAAUhB,EAAaC,CAAI,EAE3BgB,EAAiBd,EAA0B,CAC7C,QAAAa,EACA,MAAO,UACX,CAAC,EAEKE,EAAef,EAA0B,CAC3C,QAAAa,EACA,MAAO,OACX,CAAC,EAEKG,EAAmBhB,EAA0B,CAC/C,QAAAa,EACA,MAAO,YACX,CAAC,EAED,OAAAZ,EAAc,CACV,OAAQa,EACR,SAAUR,EACV,KAAM,6BACN,QACI,mEACR,CAAC,EAEDL,EAAc,CACV,OAAQc,EACR,SAAUR,EACV,KAAM,+BACN,QACI,qEACR,CAAC,EAEDN,EAAc,CACV,OAAQe,EACR,SAAUR,EACV,KAAM,+BACN,QACI,qEACR,CAAC,EAEGH,GACAJ,EAAc,CACV,OAAQe,EACR,SAAUX,EACV,KAAM,+BACN,QACI,wEACR,CAAC,EAGE,CACH,SAAUS,EACV,MAAOC,EACP,WAAYC,EACZ,UAAAL,EACA,QAAAE,CACJ,CACJ","names":["Buffer","createHmac","timingSafeEqual","DEFAULT_TOLERANCE_MS","verifyCallbackSignature","rawBody","timestamp","signature","secret","toleranceMs","timestampNumber","expectedSignature","expectedBuffer","receivedBuffer","DEFAULT_TOLERANCE_MS","HEADER_EVENT_ID","HEADER_EVENT","HEADER_PROJECT_ID","HEADER_TIMESTAMP","HEADER_SIGNATURE","getHeader","headers","name","maybeHeaders","normalizedName","key","value","requireHeader","HumanGatewayCallbackError","parseTimestamp","input","timestampNumber","parsePayload","body","parsed","requireStringPayloadField","assertMatches","verifyCallback","secret","toleranceMs","expectedProjectId","headerEventId","headerEvent","headerProjectId","headerTimestamp","headerSignature","timestamp","verifyCallbackSignature","payload","payloadEventId","payloadEvent","payloadProjectId"]}

package/dist/types-BR0Sarec.d.cts

@@ -0,0 +1,85 @@
+type HumanGatewayEnvironment = "production" | "sandbox";
+type HumanGatewayMode = "auto" | "popup" | "modal" | "redirect";
+type HumanGatewayOptions = {
+    projectId: string;
+    environment?: HumanGatewayEnvironment;
+    mode?: HumanGatewayMode;
+    baseUrl?: string;
+    timeoutMs?: number;
+};
+type HumanGatewayVerifyOptions = {
+    actionKey?: string;
+    onOpen?: () => void;
+    onClose?: () => void;
+    onSuccess?: (result: HumanGatewayResult) => void;
+    onError?: (error: HumanGatewayError) => void;
+};
+type HumanGatewayAuthOptions = {
+    actionKey?: string;
+    onOpen?: () => void;
+    onClose?: () => void;
+    onSuccess?: (result: HumanGatewayAuthResult) => void;
+    onError?: (error: HumanGatewayError) => void;
+};
+type HumanGatewayResult = {
+    success: boolean;
+    verified_human: boolean;
+    verification_level: HumanGatewayVerificationLevel;
+    unique_for_partner: boolean;
+    already_verified: boolean;
+    project_id: string;
+};
+type HumanGatewayAuthResult = {
+    success: boolean;
+    event?: "auth.completed";
+    verified_human: boolean;
+    verification_level: HumanGatewayVerificationLevel;
+    partner_user_id: string;
+    auth_session_id: string;
+    project_id: string;
+    expires_at: string;
+};
+type HumanGatewayMessage = {
+    source: "human-gateway";
+    type: "human_gateway.verification.completed";
+    payload: HumanGatewayResult;
+};
+type HumanGatewayAuthMessage = {
+    source: "human-gateway";
+    type: "human_gateway.auth.completed";
+    payload: HumanGatewayAuthResult;
+};
+type HumanGatewayErrorCode = "popup_blocked" | "user_closed" | "timeout" | "invalid_message" | "invalid_origin" | "verification_failed" | "auth_failed" | "unknown_error";
+declare class HumanGatewayError extends Error {
+    code: HumanGatewayErrorCode;
+    constructor(code: HumanGatewayErrorCode, message: string);
+}
+type HumanGatewayCallbackEventName = "verification.completed" | "auth.completed" | "callback.test" | (string & {});
+type HumanGatewayCallbackPayload = Record<string, unknown> & {
+    event_id?: unknown;
+    event?: unknown;
+    project_id?: unknown;
+};
+type HumanGatewayCallbackHeaders = Headers | Record<string, string | string[] | null | undefined>;
+type VerifyCallbackInput = {
+    body: string;
+    headers: HumanGatewayCallbackHeaders;
+    secret: string;
+    toleranceMs?: number;
+    expectedProjectId?: string;
+};
+type VerifiedHumanGatewayCallback = {
+    event_id: string;
+    event: HumanGatewayCallbackEventName;
+    project_id: string;
+    timestamp: number;
+    payload: HumanGatewayCallbackPayload;
+};
+type HumanGatewayCallbackErrorCode = "callback_missing_body" | "callback_missing_secret" | "callback_missing_header" | "callback_invalid_timestamp" | "callback_expired_timestamp" | "callback_invalid_signature_format" | "callback_invalid_signature" | "callback_invalid_json" | "callback_invalid_payload" | "callback_event_id_mismatch" | "callback_event_type_mismatch" | "callback_project_id_mismatch";
+declare class HumanGatewayCallbackError extends Error {
+    code: HumanGatewayCallbackErrorCode;
+    constructor(code: HumanGatewayCallbackErrorCode, message: string);
+}
+type HumanGatewayVerificationLevel = "device" | "document" | "secure_document" | "orb" | null;
+
+export { type HumanGatewayAuthMessage as H, type VerifiedHumanGatewayCallback as V, type HumanGatewayAuthOptions as a, type HumanGatewayAuthResult as b, HumanGatewayCallbackError as c, type HumanGatewayCallbackErrorCode as d, type HumanGatewayCallbackEventName as e, type HumanGatewayCallbackHeaders as f, type HumanGatewayCallbackPayload as g, type HumanGatewayEnvironment as h, HumanGatewayError as i, type HumanGatewayErrorCode as j, type HumanGatewayMessage as k, type HumanGatewayMode as l, type HumanGatewayOptions as m, type HumanGatewayResult as n, type HumanGatewayVerificationLevel as o, type HumanGatewayVerifyOptions as p, type VerifyCallbackInput as q };

package/dist/types-BR0Sarec.d.ts

@@ -0,0 +1,85 @@
+type HumanGatewayEnvironment = "production" | "sandbox";
+type HumanGatewayMode = "auto" | "popup" | "modal" | "redirect";
+type HumanGatewayOptions = {
+    projectId: string;
+    environment?: HumanGatewayEnvironment;
+    mode?: HumanGatewayMode;
+    baseUrl?: string;
+    timeoutMs?: number;
+};
+type HumanGatewayVerifyOptions = {
+    actionKey?: string;
+    onOpen?: () => void;
+    onClose?: () => void;
+    onSuccess?: (result: HumanGatewayResult) => void;
+    onError?: (error: HumanGatewayError) => void;
+};
+type HumanGatewayAuthOptions = {
+    actionKey?: string;
+    onOpen?: () => void;
+    onClose?: () => void;
+    onSuccess?: (result: HumanGatewayAuthResult) => void;
+    onError?: (error: HumanGatewayError) => void;
+};
+type HumanGatewayResult = {
+    success: boolean;
+    verified_human: boolean;
+    verification_level: HumanGatewayVerificationLevel;
+    unique_for_partner: boolean;
+    already_verified: boolean;
+    project_id: string;
+};
+type HumanGatewayAuthResult = {
+    success: boolean;
+    event?: "auth.completed";
+    verified_human: boolean;
+    verification_level: HumanGatewayVerificationLevel;
+    partner_user_id: string;
+    auth_session_id: string;
+    project_id: string;
+    expires_at: string;
+};
+type HumanGatewayMessage = {
+    source: "human-gateway";
+    type: "human_gateway.verification.completed";
+    payload: HumanGatewayResult;
+};
+type HumanGatewayAuthMessage = {
+    source: "human-gateway";
+    type: "human_gateway.auth.completed";
+    payload: HumanGatewayAuthResult;
+};
+type HumanGatewayErrorCode = "popup_blocked" | "user_closed" | "timeout" | "invalid_message" | "invalid_origin" | "verification_failed" | "auth_failed" | "unknown_error";
+declare class HumanGatewayError extends Error {
+    code: HumanGatewayErrorCode;
+    constructor(code: HumanGatewayErrorCode, message: string);
+}
+type HumanGatewayCallbackEventName = "verification.completed" | "auth.completed" | "callback.test" | (string & {});
+type HumanGatewayCallbackPayload = Record<string, unknown> & {
+    event_id?: unknown;
+    event?: unknown;
+    project_id?: unknown;
+};
+type HumanGatewayCallbackHeaders = Headers | Record<string, string | string[] | null | undefined>;
+type VerifyCallbackInput = {
+    body: string;
+    headers: HumanGatewayCallbackHeaders;
+    secret: string;
+    toleranceMs?: number;
+    expectedProjectId?: string;
+};
+type VerifiedHumanGatewayCallback = {
+    event_id: string;
+    event: HumanGatewayCallbackEventName;
+    project_id: string;
+    timestamp: number;
+    payload: HumanGatewayCallbackPayload;
+};
+type HumanGatewayCallbackErrorCode = "callback_missing_body" | "callback_missing_secret" | "callback_missing_header" | "callback_invalid_timestamp" | "callback_expired_timestamp" | "callback_invalid_signature_format" | "callback_invalid_signature" | "callback_invalid_json" | "callback_invalid_payload" | "callback_event_id_mismatch" | "callback_event_type_mismatch" | "callback_project_id_mismatch";
+declare class HumanGatewayCallbackError extends Error {
+    code: HumanGatewayCallbackErrorCode;
+    constructor(code: HumanGatewayCallbackErrorCode, message: string);
+}
+type HumanGatewayVerificationLevel = "device" | "document" | "secure_document" | "orb" | null;
+
+export { type HumanGatewayAuthMessage as H, type VerifiedHumanGatewayCallback as V, type HumanGatewayAuthOptions as a, type HumanGatewayAuthResult as b, HumanGatewayCallbackError as c, type HumanGatewayCallbackErrorCode as d, type HumanGatewayCallbackEventName as e, type HumanGatewayCallbackHeaders as f, type HumanGatewayCallbackPayload as g, type HumanGatewayEnvironment as h, HumanGatewayError as i, type HumanGatewayErrorCode as j, type HumanGatewayMessage as k, type HumanGatewayMode as l, type HumanGatewayOptions as m, type HumanGatewayResult as n, type HumanGatewayVerificationLevel as o, type HumanGatewayVerifyOptions as p, type VerifyCallbackInput as q };

package/package.json

@@ -1,16 +1,46 @@
-{
-  "name": "@human-gateway/sdk",
-  "version": "0.0.1",
-  "description": "Official Human Gateway SDK placeholder. Public SDK coming soon.",
-  "main": "index.js",
-  "type": "module",
-  "keywords": [
-    "human-gateway",
-    "world-id",
-    "verification",
-    "authentication",
-    "sdk"
-  ],
-  "author": "Human Gateway",
-  "license": "MIT"
-}
+{
+  "name": "@human-gateway/sdk",
+  "version": "0.1.0-alpha.1",
+  "description": "Human verification SDK for Human Gateway.",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js",
+      "require": "./dist/server.cjs"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit",
+    "prepack": "npm run build",
+    "prepublishOnly": "npm run typecheck && npm run build"
+  },
+  "keywords": [
+    "human-gateway",
+    "world-id",
+    "verification",
+    "identity",
+    "sdk"
+  ],
+  "author": "Human Gateway",
+  "license": "MIT",
+  "sideEffects": false,
+  "devDependencies": {
+    "@types/node": "^25.9.1",
+    "tsup": "^8.5.1",
+    "typescript": "^5.9.3"
+  }
+}

package/index.js

@@ -1,5 +0,0 @@
-export const version = "0.0.1";
-
-export function humanGatewaySdkPlaceholder() {
-    return "Human Gateway SDK placeholder. Public SDK coming soon.";
-}