@pryzr/verify 0.3.0

package/README.md

@@ -0,0 +1,44 @@
+# Pryzr Verify TypeScript client
+
+This server-side client handles authentication, safe retries, timeouts, and Pryzr’s standard error responses for you. Keep your Pryzr API key on the server—never include it in browser or mobile-app code.
+
+## Start a verification
+
+```bash
+npm install @pryzr/verify
+```
+
+```ts
+import { PryzrVerifyClient } from "@pryzr/verify";
+
+const pryzr = new PryzrVerifyClient({
+  apiKey: process.env.PRYZR_API_KEY!,
+});
+
+const { playerUrl, verification } = await pryzr.startVerification({
+  playerReference: "player-1042",
+  caseReference: "signup-1042",
+  jurisdiction: "US-NJ",
+  minimumAge: 21,
+});
+
+// Redirect the intended player to playerUrl from your authenticated flow.
+// Do not log this short-lived URL or send it to analytics.
+```
+
+That single method creates the Pryzr player record and verification session. Store `verification.id` in your system so you can match later status updates to the correct player.
+
+## Advanced control
+
+Use `createApplicant` and `createVerificationCase` separately if your integration needs to control or retry each step itself. Mutation methods accept an idempotency key; reuse the same key and the same request after a timeout with an uncertain outcome.
+
+The client also supports:
+
+- verification status, history, resubmission, and cancellation
+- signed webhook setup, secret rotation, testing, and redelivery
+- transaction events
+- consented PlayPrint summaries
+
+The API key selects the correct workspace and environment automatically. You do not need to send workspace, environment, verification-provider, or workflow IDs in normal API requests.
+
+Webhook secrets are shown once. Save them in a server-side secret manager before continuing. Never log API keys, webhook secrets, player verification URLs, or identity data.

package/dist/index.d.ts

@@ -0,0 +1,265 @@
+/**
+ * Server-side client for the Pryzr Verify API. API credentials must never be
+ * shipped to browser code.
+ */
+export { PRYZR_WEBHOOK_TOLERANCE_SECONDS, verifyPryzrWebhookSignature, verifyPryzrWebhookWithSecrets, } from "./webhooks";
+export type PryzrEnvironment = "sandbox" | "production";
+export declare const operatorApiOperationAvailability: {
+    readonly createApplicant: "implemented";
+    readonly getApplicant: "implemented";
+    readonly createVerificationCase: "implemented";
+    readonly listVerificationCases: "implemented";
+    readonly getVerificationCase: "implemented";
+    readonly resubmitVerificationCase: "implemented";
+    readonly cancelVerificationCase: "implemented";
+    readonly listVerificationCaseEvents: "implemented";
+    readonly createWebhookEndpoint: "implemented";
+    readonly updateWebhookEndpoint: "implemented";
+    readonly rotateWebhookSigningSecret: "implemented";
+    readonly sendTestWebhook: "implemented";
+    readonly listWebhookDeliveries: "implemented";
+    readonly redeliverWebhook: "implemented";
+    readonly submitTransactionEvent: "implemented";
+    readonly submitTelemetry: "implemented";
+};
+export type VerificationCaseStatus = "created" | "ready" | "in_progress" | "processing" | "manual_review" | "resubmission_required" | "approved" | "declined" | "expired" | "abandoned" | "verification_expired";
+export interface Applicant {
+    id: string;
+    operator_applicant_ref: string;
+    created_at: string;
+}
+export interface VerificationCase {
+    id: string;
+    applicant_id: string;
+    operator_case_ref: string;
+    environment: PryzrEnvironment;
+    jurisdiction: string;
+    status: VerificationCaseStatus;
+    result: {
+        outcome: "approve" | "decline" | "review" | null;
+    };
+    created_at: string;
+    updated_at: string;
+}
+export interface PlayerLaunch {
+    url: string;
+    expires_at: string;
+}
+export interface VerificationCaseWithPlayer extends VerificationCase {
+    player: PlayerLaunch;
+}
+export interface VerificationCaseEvent {
+    id: string;
+    type: string;
+    occurred_at: string;
+}
+export interface CursorPage<T> {
+    data: T[];
+    next_cursor: string | null;
+}
+export declare const operatorWebhookEventTypes: readonly ["verification_case.created", "verification_case.processing", "verification_case.review_required", "verification_case.resubmission_required", "verification_case.approved", "verification_case.declined", "verification_case.expired", "verification_case.abandoned", "verification_case.verification_expired", "verification_case.reopened_for_review", "verification_case.deleted"];
+export type OperatorWebhookEventType = (typeof operatorWebhookEventTypes)[number];
+export type WebhookEndpointStatus = "active" | "paused" | "disabled";
+export type WebhookDeliveryStatus = "pending" | "retry_wait" | "succeeded" | "failed" | "dead_letter" | "cancelled";
+export interface PryzrVerifyClientOptions {
+    apiKey: string;
+    baseUrl?: string;
+    fetch?: typeof globalThis.fetch;
+    requestTimeoutMs?: number;
+    maxRetries?: number;
+    retryDelayMs?: number;
+    sleep?: (milliseconds: number) => Promise<void>;
+}
+export interface StartVerificationInput {
+    playerReference: string;
+    caseReference: string;
+    jurisdiction: string;
+    minimumAge: number;
+    applicantIdempotencyKey?: string;
+    caseIdempotencyKey?: string;
+}
+export interface StartedVerification {
+    applicant: Applicant;
+    verification: VerificationCaseWithPlayer;
+    playerUrl: string;
+}
+export interface TransactionEventInput {
+    operatorEventRef: string;
+    eventType: "DEPOSIT" | "PURCHASE" | "REDEMPTION" | "REFUND" | "CHARGEBACK" | "BONUS" | "PAYMENT_FAILURE" | "REVERSAL";
+    status: "PENDING" | "SUCCEEDED" | "FAILED" | "REVERSED";
+    amountMinor?: number;
+    currency?: string;
+    operatorAccountRef: string;
+    paymentInstrumentRef?: string;
+    deviceRef?: string;
+    sessionRef?: string;
+    networkRef?: string;
+    countryCode?: string;
+    occurredAt: string;
+}
+export interface PlayPrintTelemetryEvent {
+    eventId: string;
+    sequence: number;
+    occurredAt: string;
+    subjectRef: string;
+    sessionRef: string;
+    deviceRef: string;
+    consentReceiptRef?: string;
+    signals: Readonly<Record<string, unknown>>;
+}
+export type SigningSecret = {
+    id: string;
+    key_label: string;
+    secret: string;
+    secret_omitted?: never;
+} | {
+    id: string;
+    key_label: string;
+    secret?: never;
+    secret_omitted: true;
+};
+export interface WebhookEndpoint {
+    id: string;
+    url: string;
+    description: string | null;
+    environment: PryzrEnvironment;
+    status: WebhookEndpointStatus;
+    event_types: OperatorWebhookEventType[];
+    disabled_reason_code?: string | null;
+    created_at: string;
+    updated_at?: string;
+}
+export interface CreatedWebhookEndpoint extends WebhookEndpoint {
+    signing_secret: SigningSecret;
+}
+export interface WebhookDelivery {
+    id: string;
+    endpoint_id: string;
+    event_id: string;
+    event_type: OperatorWebhookEventType | "webhook_endpoint.test";
+    environment: PryzrEnvironment;
+    status: WebhookDeliveryStatus;
+    test: boolean;
+    attempt_count: number;
+    max_attempts: number;
+    last_response_status: number | null;
+    last_error_code: string | null;
+    next_attempt_at: string;
+    completed_at: string | null;
+    created_at: string;
+    redelivery_of_id: string | null;
+}
+export interface WebhookDeliveryPage {
+    data: WebhookDelivery[];
+    next_cursor: string | null;
+}
+export interface ApiErrorBody {
+    error: {
+        code: string;
+        message: string;
+        request_id: string;
+        details?: Array<{
+            field: string;
+            reason: string;
+        }>;
+    };
+}
+export declare class PryzrVerifyApiError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly requestId: string | null;
+    readonly details: ApiErrorBody["error"]["details"];
+    constructor(status: number, code: string, requestId: string | null, details: ApiErrorBody["error"]["details"], message: string);
+}
+export interface ListWebhookDeliveriesQuery {
+    limit?: number;
+    cursor?: string;
+    endpoint_id?: string;
+    status?: WebhookDeliveryStatus;
+    event_type?: OperatorWebhookEventType | "webhook_endpoint.test";
+    created_after?: string;
+    created_before?: string;
+    include_test?: boolean;
+}
+export interface ListVerificationCasesQuery {
+    limit?: number;
+    cursor?: string;
+    status?: VerificationCaseStatus;
+}
+export interface ListVerificationCaseEventsQuery {
+    limit?: number;
+    cursor?: string;
+}
+export declare class PryzrVerifyClient {
+    private readonly apiKey;
+    private readonly baseUrl;
+    private readonly fetchImplementation;
+    private readonly requestTimeoutMs;
+    private readonly maxRetries;
+    private readonly retryDelayMs;
+    private readonly sleep;
+    constructor(options: PryzrVerifyClientOptions);
+    createApplicant(input: {
+        operator_applicant_ref: string;
+    }, idempotencyKey: string): Promise<Applicant>;
+    /** Create the player record and verification session in one call. */
+    startVerification(input: StartVerificationInput): Promise<StartedVerification>;
+    getApplicant(applicantId: string): Promise<Applicant>;
+    createVerificationCase(input: {
+        applicant_id: string;
+        operator_case_ref: string;
+        jurisdiction: string;
+        required_minimum_age: number;
+    }, idempotencyKey: string): Promise<VerificationCaseWithPlayer>;
+    listVerificationCases(query?: ListVerificationCasesQuery): Promise<CursorPage<VerificationCase>>;
+    getVerificationCase(caseId: string): Promise<VerificationCase>;
+    resubmitVerificationCase(caseId: string, idempotencyKey: string): Promise<VerificationCaseWithPlayer>;
+    cancelVerificationCase(caseId: string, idempotencyKey: string): Promise<VerificationCase>;
+    listVerificationCaseEvents(caseId: string, query?: ListVerificationCaseEventsQuery): Promise<CursorPage<VerificationCaseEvent>>;
+    createWebhookEndpoint(input: {
+        url: string;
+        description?: string | null;
+        event_types: OperatorWebhookEventType[];
+    }, idempotencyKey: string): Promise<CreatedWebhookEndpoint>;
+    updateWebhookEndpoint(endpointId: string, input: {
+        status?: "active" | "paused";
+        event_types?: OperatorWebhookEventType[];
+    }, idempotencyKey: string): Promise<WebhookEndpoint>;
+    rotateWebhookSigningSecret(endpointId: string, input: {
+        overlap_seconds?: number;
+    }, idempotencyKey: string): Promise<{
+        endpoint_id: string;
+        overlap_seconds: number;
+        signing_secret: SigningSecret;
+    }>;
+    sendTestWebhook(endpointId: string, idempotencyKey: string): Promise<{
+        delivery_id: string;
+        endpoint_id: string;
+        event_id: string;
+        event_type: "webhook_endpoint.test";
+        test: true;
+        status: "queued";
+    }>;
+    listWebhookDeliveries(query?: ListWebhookDeliveriesQuery): Promise<WebhookDeliveryPage>;
+    redeliverWebhook(deliveryId: string, input: {
+        reason_code?: string;
+    }, idempotencyKey: string): Promise<{
+        delivery_id: string;
+        source_delivery_id: string;
+        created: boolean;
+        status: "queued";
+    }>;
+    submitTransactionEvent(input: TransactionEventInput, idempotencyKey: string): Promise<{
+        event_id: string;
+        replayed: boolean;
+        findings: Array<{
+            reason_code: string;
+            severity: string;
+            explanation: string;
+        }>;
+    }>;
+    submitTelemetry(events: PlayPrintTelemetryEvent[], idempotencyKey: string): Promise<{
+        events: unknown[];
+    }>;
+    private request;
+}

package/dist/index.js

@@ -0,0 +1,261 @@
+/**
+ * Server-side client for the Pryzr Verify API. API credentials must never be
+ * shipped to browser code.
+ */
+export { PRYZR_WEBHOOK_TOLERANCE_SECONDS, verifyPryzrWebhookSignature, verifyPryzrWebhookWithSecrets, } from "./webhooks";
+export const operatorApiOperationAvailability = {
+    createApplicant: "implemented",
+    getApplicant: "implemented",
+    createVerificationCase: "implemented",
+    listVerificationCases: "implemented",
+    getVerificationCase: "implemented",
+    resubmitVerificationCase: "implemented",
+    cancelVerificationCase: "implemented",
+    listVerificationCaseEvents: "implemented",
+    createWebhookEndpoint: "implemented",
+    updateWebhookEndpoint: "implemented",
+    rotateWebhookSigningSecret: "implemented",
+    sendTestWebhook: "implemented",
+    listWebhookDeliveries: "implemented",
+    redeliverWebhook: "implemented",
+    submitTransactionEvent: "implemented",
+    submitTelemetry: "implemented",
+};
+export const operatorWebhookEventTypes = [
+    "verification_case.created",
+    "verification_case.processing",
+    "verification_case.review_required",
+    "verification_case.resubmission_required",
+    "verification_case.approved",
+    "verification_case.declined",
+    "verification_case.expired",
+    "verification_case.abandoned",
+    "verification_case.verification_expired",
+    "verification_case.reopened_for_review",
+    "verification_case.deleted",
+];
+export class PryzrVerifyApiError extends Error {
+    status;
+    code;
+    requestId;
+    details;
+    constructor(status, code, requestId, details, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.requestId = requestId;
+        this.details = details;
+        this.name = "PryzrVerifyApiError";
+    }
+}
+export class PryzrVerifyClient {
+    apiKey;
+    baseUrl;
+    fetchImplementation;
+    requestTimeoutMs;
+    maxRetries;
+    retryDelayMs;
+    sleep;
+    constructor(options) {
+        if (!/^pzk_(sandbox|production)_[0-9a-f]{16}_[A-Za-z0-9_-]{43}$/.test(options.apiKey)) {
+            throw new TypeError("A Pryzr Verify server-side API credential is required.");
+        }
+        this.apiKey = options.apiKey;
+        this.baseUrl = (options.baseUrl ?? "https://verify.pryzr.tech/api/v1").replace(/\/$/, "");
+        this.fetchImplementation = options.fetch ?? globalThis.fetch;
+        if (!this.fetchImplementation)
+            throw new TypeError("A Fetch API implementation is required.");
+        this.requestTimeoutMs = boundedInteger(options.requestTimeoutMs ?? 10_000, 1, 120_000);
+        this.maxRetries = boundedInteger(options.maxRetries ?? 2, 0, 5);
+        this.retryDelayMs = boundedInteger(options.retryDelayMs ?? 250, 0, 10_000);
+        this.sleep =
+            options.sleep ??
+                ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
+    }
+    createApplicant(input, idempotencyKey) {
+        return this.request("/applicants", {
+            method: "POST",
+            body: input,
+            idempotencyKey,
+        });
+    }
+    /** Create the player record and verification session in one call. */
+    async startVerification(input) {
+        const applicant = await this.createApplicant({ operator_applicant_ref: input.playerReference }, input.applicantIdempotencyKey ?? crypto.randomUUID());
+        const verification = await this.createVerificationCase({
+            applicant_id: applicant.id,
+            operator_case_ref: input.caseReference,
+            jurisdiction: input.jurisdiction,
+            required_minimum_age: input.minimumAge,
+        }, input.caseIdempotencyKey ?? crypto.randomUUID());
+        return { applicant, verification, playerUrl: verification.player.url };
+    }
+    getApplicant(applicantId) {
+        return this.request(`/applicants/${encodeURIComponent(applicantId)}`, { method: "GET" });
+    }
+    createVerificationCase(input, idempotencyKey) {
+        return this.request("/verification-cases", {
+            method: "POST",
+            body: input,
+            idempotencyKey,
+        });
+    }
+    listVerificationCases(query = {}) {
+        return this.request("/verification-cases", { method: "GET", query });
+    }
+    getVerificationCase(caseId) {
+        return this.request(`/verification-cases/${encodeURIComponent(caseId)}`, { method: "GET" });
+    }
+    resubmitVerificationCase(caseId, idempotencyKey) {
+        return this.request(`/verification-cases/${encodeURIComponent(caseId)}/resubmissions`, {
+            method: "POST",
+            body: {},
+            idempotencyKey,
+        });
+    }
+    cancelVerificationCase(caseId, idempotencyKey) {
+        return this.request(`/verification-cases/${encodeURIComponent(caseId)}/cancel`, {
+            method: "POST",
+            body: {},
+            idempotencyKey,
+        });
+    }
+    listVerificationCaseEvents(caseId, query = {}) {
+        return this.request(`/verification-cases/${encodeURIComponent(caseId)}/events`, {
+            method: "GET",
+            query,
+        });
+    }
+    createWebhookEndpoint(input, idempotencyKey) {
+        return this.request("/webhook-endpoints", {
+            method: "POST",
+            body: input,
+            idempotencyKey,
+        });
+    }
+    updateWebhookEndpoint(endpointId, input, idempotencyKey) {
+        return this.request(`/webhook-endpoints/${encodeURIComponent(endpointId)}`, {
+            method: "PATCH",
+            body: input,
+            idempotencyKey,
+        });
+    }
+    rotateWebhookSigningSecret(endpointId, input, idempotencyKey) {
+        return this.request(`/webhook-endpoints/${encodeURIComponent(endpointId)}/rotate-secret`, {
+            method: "POST",
+            body: input,
+            idempotencyKey,
+        });
+    }
+    sendTestWebhook(endpointId, idempotencyKey) {
+        return this.request(`/webhook-endpoints/${encodeURIComponent(endpointId)}/test`, {
+            method: "POST",
+            body: {},
+            idempotencyKey,
+        });
+    }
+    listWebhookDeliveries(query = {}) {
+        return this.request("/webhook-deliveries", { method: "GET", query });
+    }
+    redeliverWebhook(deliveryId, input, idempotencyKey) {
+        return this.request(`/webhook-deliveries/${encodeURIComponent(deliveryId)}/redeliver`, {
+            method: "POST",
+            body: input,
+            idempotencyKey,
+        });
+    }
+    submitTransactionEvent(input, idempotencyKey) {
+        return this.request("/transaction-events", {
+            method: "POST",
+            body: input,
+            idempotencyKey,
+        });
+    }
+    submitTelemetry(events, idempotencyKey) {
+        return this.request("/telemetry", {
+            method: "POST",
+            body: { events },
+            idempotencyKey,
+        });
+    }
+    async request(path, options) {
+        const url = new URL(`${this.baseUrl}${path}`);
+        for (const [key, value] of Object.entries(options.query ?? {})) {
+            if (value !== undefined)
+                url.searchParams.set(key, String(value));
+        }
+        const headers = new Headers({
+            accept: "application/json",
+            authorization: `Bearer ${this.apiKey}`,
+        });
+        if (options.body !== undefined)
+            headers.set("content-type", "application/json");
+        if (options.idempotencyKey)
+            headers.set("idempotency-key", options.idempotencyKey);
+        const body = options.body === undefined ? undefined : JSON.stringify(options.body);
+        let response;
+        for (let attempt = 0; attempt <= this.maxRetries; attempt += 1) {
+            response = undefined;
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), this.requestTimeoutMs);
+            try {
+                response = await this.fetchImplementation(url, {
+                    method: options.method,
+                    headers,
+                    signal: controller.signal,
+                    ...(body !== undefined ? { body } : {}),
+                });
+            }
+            catch {
+                if (attempt === this.maxRetries) {
+                    const timedOut = controller.signal.aborted;
+                    throw new PryzrVerifyApiError(0, timedOut ? "REQUEST_TIMEOUT" : "NETWORK_ERROR", null, undefined, timedOut ? "Pryzr Verify request timed out." : "Pryzr Verify could not be reached.");
+                }
+            }
+            finally {
+                clearTimeout(timeout);
+            }
+            if (response && ![429, 503].includes(response.status))
+                break;
+            if (attempt < this.maxRetries)
+                await this.sleep(this.retryDelayMs * 2 ** attempt);
+        }
+        if (!response)
+            throw new PryzrVerifyApiError(0, "NETWORK_ERROR", null, undefined, "Pryzr Verify could not be reached.");
+        const payload = await readJson(response);
+        if (!response.ok) {
+            const error = isApiErrorBody(payload) ? payload.error : null;
+            throw new PryzrVerifyApiError(response.status, error?.code ?? "HTTP_ERROR", error?.request_id ?? response.headers.get("x-request-id"), error?.details, redactErrorMessage(error?.message ?? `Pryzr Verify returned HTTP ${response.status}.`));
+        }
+        return payload;
+    }
+}
+function boundedInteger(value, minimum, maximum) {
+    if (!Number.isInteger(value) || value < minimum || value > maximum)
+        throw new TypeError(`Expected an integer between ${minimum} and ${maximum}.`);
+    return value;
+}
+function redactErrorMessage(message) {
+    return message
+        .replace(/pzk_(sandbox|production)_[A-Za-z0-9_-]+/g, "[REDACTED_CREDENTIAL]")
+        .replace(/Bearer\s+[A-Za-z0-9._~-]+/gi, "Bearer [REDACTED]")
+        .replace(/[\r\n\t]+/g, " ")
+        .slice(0, 500);
+}
+async function readJson(response) {
+    const contentType = response.headers.get("content-type") ?? "";
+    if (!contentType.toLowerCase().includes("application/json")) {
+        throw new PryzrVerifyApiError(response.status, "INVALID_RESPONSE", response.headers.get("x-request-id"), undefined, "Pryzr Verify returned a non-JSON response.");
+    }
+    return response.json();
+}
+function isApiErrorBody(value) {
+    if (typeof value !== "object" || value === null || !("error" in value))
+        return false;
+    const error = value.error;
+    return (typeof error === "object" &&
+        error !== null &&
+        typeof error.code === "string" &&
+        typeof error.message === "string" &&
+        typeof error.request_id === "string");
+}

package/dist/webhooks.d.ts

@@ -0,0 +1,27 @@
+export declare const PRYZR_WEBHOOK_TOLERANCE_SECONDS = 300;
+/**
+ * Verify a Pryzr webhook against the exact raw request body. Call this before
+ * JSON parsing and before any side effect. Multiple space-separated v1 values
+ * are accepted during signing-secret rotation.
+ */
+export declare function verifyPryzrWebhookSignature(input: {
+    secret: string;
+    rawBody: string;
+    signatureHeader: string;
+    timestampHeader: string;
+    now?: Date;
+    toleranceSeconds?: number;
+}): boolean;
+/**
+ * Verify against every currently accepted secret during a bounded rotation
+ * overlap. Callers should remove the retiring secret as soon as the overlap
+ * ends. Secret values are never returned or included in errors.
+ */
+export declare function verifyPryzrWebhookWithSecrets(input: {
+    secrets: readonly string[];
+    rawBody: string;
+    signatureHeader: string;
+    timestampHeader: string;
+    now?: Date;
+    toleranceSeconds?: number;
+}): boolean;

package/dist/webhooks.js

@@ -0,0 +1,61 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+export const PRYZR_WEBHOOK_TOLERANCE_SECONDS = 300;
+const signaturePattern = /^v1=[0-9a-f]{64}$/;
+/**
+ * Verify a Pryzr webhook against the exact raw request body. Call this before
+ * JSON parsing and before any side effect. Multiple space-separated v1 values
+ * are accepted during signing-secret rotation.
+ */
+export function verifyPryzrWebhookSignature(input) {
+    if (Buffer.byteLength(input.secret, "utf8") < 32) {
+        throw new TypeError("Pryzr webhook secrets contain at least 32 bytes.");
+    }
+    const tolerance = input.toleranceSeconds ?? PRYZR_WEBHOOK_TOLERANCE_SECONDS;
+    if (!Number.isSafeInteger(tolerance) || tolerance < 0 || tolerance > 3_600) {
+        throw new TypeError("Webhook replay tolerance must be between 0 and 3600 seconds.");
+    }
+    if (!/^\d{1,15}$/.test(input.timestampHeader))
+        return false;
+    const timestamp = Number(input.timestampHeader);
+    if (!Number.isSafeInteger(timestamp) || timestamp <= 0)
+        return false;
+    const now = input.now ?? new Date();
+    if (Number.isNaN(now.getTime()))
+        return false;
+    if (Math.abs(Math.floor(now.getTime() / 1_000) - timestamp) > tolerance)
+        return false;
+    const expected = `v1=${createHmac("sha256", input.secret)
+        .update(`${timestamp}.${input.rawBody}`, "utf8")
+        .digest("hex")}`;
+    const expectedBytes = Buffer.from(expected, "utf8");
+    return input.signatureHeader.split(" ").some((candidate) => {
+        if (!signaturePattern.test(candidate))
+            return false;
+        const candidateBytes = Buffer.from(candidate, "utf8");
+        return (candidateBytes.length === expectedBytes.length &&
+            timingSafeEqual(candidateBytes, expectedBytes));
+    });
+}
+/**
+ * Verify against every currently accepted secret during a bounded rotation
+ * overlap. Callers should remove the retiring secret as soon as the overlap
+ * ends. Secret values are never returned or included in errors.
+ */
+export function verifyPryzrWebhookWithSecrets(input) {
+    if (input.secrets.length < 1 || input.secrets.length > 2) {
+        throw new TypeError("Provide one active secret or active and retiring secrets.");
+    }
+    let accepted = false;
+    for (const secret of input.secrets) {
+        const valid = verifyPryzrWebhookSignature({
+            secret,
+            rawBody: input.rawBody,
+            signatureHeader: input.signatureHeader,
+            timestampHeader: input.timestampHeader,
+            ...(input.now ? { now: input.now } : {}),
+            ...(input.toleranceSeconds === undefined ? {} : { toleranceSeconds: input.toleranceSeconds }),
+        });
+        accepted = valid || accepted;
+    }
+    return accepted;
+}

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@pryzr/verify",
+  "version": "0.3.0",
+  "description": "Server-side TypeScript SDK for Pryzr Verify",
+  "type": "module",
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Pryzr/pryzr-verify.git",
+    "directory": "sdk/typescript"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "devDependencies": {
+    "typescript": "^5.9.0"
+  }
+}