@riseworks/riseworks-sdk 1.0.4

package/dist/index.cjs

@@ -0,0 +1,1406 @@
+'use strict';
+
+var crypto = require('node:crypto');
+var ethers = require('ethers');
+
+function _interopNamespaceDefault(e) {
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+
+var crypto__namespace = /*#__PURE__*/_interopNamespaceDefault(crypto);
+
+const PRIVATE_KEY_LENGTH = 66;
+const RISE_ID_LENGTH = 42;
+const RISE_API_URLS = {
+  dev: "https://b2b-api.dev-riseworks.io",
+  stg: "https://integrations-api.staging-riseworks.io",
+  prod: "https://integrations-api.riseworks.io"
+};
+const EXPECTED_CHAIN_IDS = {
+  dev: [421614],
+  stg: [421614],
+  prod: [42161]
+};
+const CENTS_TO_TOKEN_UNITS = 10000n;
+const generateIdempotencyKey = () => crypto.randomUUID();
+const apiPath = (strings, ...values) => strings.reduce((path, part, i) => {
+  if (i >= values.length) return `${path}${part}`;
+  const value = String(values[i]);
+  if (value === "" || value === "." || value === "..") {
+    throw new Error(
+      `Invalid path parameter ${JSON.stringify(value)}: expected a non-empty id`
+    );
+  }
+  return `${path}${part}${encodeURIComponent(value)}`;
+}, "");
+class ApiGroup {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  request(method, path, data, query, extraHeaders) {
+    return this.client.request(method, path, data, query, extraHeaders);
+  }
+}
+class WebhooksApi extends ApiGroup {
+  /**
+   * Register a new webhook endpoint to receive real-time notifications
+   *
+   * @param data - Webhook registration data including URL, events, and secret
+   * @returns Promise resolving to the registered webhook response
+   * @throws Error if registration fails or validation errors occur
+   */
+  async register(data) {
+    return this.request(
+      "POST",
+      "/v2/webhooks/register",
+      data
+    );
+  }
+  /**
+   * Update an existing webhook endpoint configuration
+   *
+   * @param webhookNanoid - Unique identifier of the webhook to update
+   * @param data - Updated webhook configuration data
+   * @returns Promise resolving to the updated webhook response
+   * @throws Error if update fails or webhook not found
+   */
+  async update(webhookNanoid, data) {
+    return this.request(
+      "PUT",
+      apiPath`/v2/webhooks/${webhookNanoid}`,
+      data
+    );
+  }
+  /**
+   * Retrieve details of a specific webhook endpoint
+   *
+   * @param webhookNanoid - Unique identifier of the webhook to retrieve
+   * @returns Promise resolving to the webhook details
+   * @throws Error if webhook not found or access denied
+   */
+  async get(webhookNanoid) {
+    return this.request(
+      "GET",
+      apiPath`/v2/webhooks/${webhookNanoid}`
+    );
+  }
+  /**
+   * List all webhook endpoints for the authenticated user or organization
+   *
+   * @param params - Query parameters for filtering and pagination
+   * @returns Promise resolving to the list of webhook endpoints
+   * @throws Error if listing fails or access denied
+   */
+  async list(params) {
+    return this.request(
+      "GET",
+      "/v2/webhooks",
+      void 0,
+      params
+    );
+  }
+  /**
+   * Send a test event to a webhook endpoint to verify connectivity
+   *
+   * @param webhookNanoid - Unique identifier of the webhook to test
+   * @param data - Test event data to send
+   * @returns Promise resolving to the test delivery response
+   * @throws Error if test fails or webhook not found
+   */
+  async test(webhookNanoid, data) {
+    return this.request(
+      "POST",
+      apiPath`/v2/webhooks/test/${webhookNanoid}`,
+      data
+    );
+  }
+  /**
+   * Retry a failed webhook delivery attempt
+   *
+   * @param deliveryNanoid - Unique identifier of the failed delivery to retry
+   * @returns Promise resolving to the retry delivery response
+   * @throws Error if retry fails or delivery not found
+   */
+  async retryDelivery(deliveryNanoid) {
+    return this.request(
+      "POST",
+      apiPath`/v2/webhooks/retry/${deliveryNanoid}`
+    );
+  }
+  /**
+   * Retrieve delivery history for a specific webhook endpoint
+   *
+   * @param webhookNanoid - Unique identifier of the webhook
+   * @param params - Query parameters for filtering and pagination
+   * @returns Promise resolving to the delivery history
+   * @throws Error if history retrieval fails or webhook not found
+   */
+  async getDeliveryHistory(webhookNanoid, params) {
+    return this.request(
+      "GET",
+      apiPath`/v2/webhooks/${webhookNanoid}/deliveries`,
+      void 0,
+      params
+    );
+  }
+  /**
+   * Retrieve a single webhook event (the original event payload Rise emitted)
+   * for a specific endpoint. Pair with {@link getDeliveryHistory} to inspect the
+   * delivery attempts for the same event.
+   *
+   * @param params - Webhook endpoint nanoid and the event nanoid to fetch
+   * @returns Promise resolving to the webhook event detail
+   * @throws Error if the event or endpoint is not found or access is denied
+   */
+  async getEvent(params) {
+    return this.request(
+      "GET",
+      apiPath`/v2/webhooks/${params.webhook_nanoid}/events/${params.event_nanoid}`
+    );
+  }
+}
+class AuthApi extends ApiGroup {
+  /**
+   * Get a Sign-In with Ethereum (SIWE) message for wallet authentication
+   *
+   * @param params - Authentication parameters including wallet address and Rise ID
+   * @returns Promise resolving to the SIWE message for signing
+   * @throws Error if message generation fails or invalid parameters
+   */
+  async getSiwe(params) {
+    return this.request(
+      "GET",
+      "/v2/auth/siwe",
+      void 0,
+      params
+    );
+  }
+  /**
+   * Verify a signed SIWE message to authenticate the user
+   *
+   * @param data - Verification data including the signed message and signature
+   * @returns Promise resolving to the authentication response with JWT token
+   * @throws Error if verification fails or signature is invalid
+   */
+  async verifySiwe(data) {
+    return this.request("POST", "/v2/auth/verify", data);
+  }
+}
+class CompanyApi extends ApiGroup {
+  /**
+   * Retrieve all users associated with a specific company
+   *
+   * @param params - Company parameters including company nanoid
+   * @returns Promise resolving to the list of company users
+   * @throws Error if retrieval fails or company not found
+   */
+  async getUsers(params) {
+    return this.request(
+      "GET",
+      apiPath`/v2/company/${params.nanoid}/users`
+    );
+  }
+  /**
+   * Retrieve detailed information about a company/organization
+   *
+   * @param params - Company parameters including company nanoid
+   * @returns Promise resolving to the organization details
+   * @throws Error if retrieval fails or company not found
+   */
+  async getDetails(params) {
+    return this.request(
+      "GET",
+      apiPath`/v2/company/${params.nanoid}/details`
+    );
+  }
+  /**
+   * Retrieve the current settings and configuration for a company
+   *
+   * @param params - Company parameters including company nanoid
+   * @returns Promise resolving to the company settings
+   * @throws Error if retrieval fails or company not found
+   */
+  async getSettings(params) {
+    return this.request(
+      "GET",
+      apiPath`/v2/company/${params.nanoid}/settings`
+    );
+  }
+  /**
+   * Retrieve role-specific settings for a user within a company
+   *
+   * @param params - Company and user parameters
+   * @returns Promise resolving to the role settings
+   * @throws Error if retrieval fails or user/company not found
+   */
+  async getRoleSettings(params) {
+    return this.request(
+      "GET",
+      apiPath`/v2/company/${params.nanoid}/members/${params.user_nanoid}/settings`
+    );
+  }
+  /**
+   * Retrieve contact information for a company/organization
+   *
+   * @param params - Company parameters including company nanoid
+   * @returns Promise resolving to the organization contacts
+   * @throws Error if retrieval fails or company not found
+   */
+  async getContacts(params) {
+    return this.request(
+      "GET",
+      apiPath`/v2/company/${params.nanoid}/contacts`
+    );
+  }
+  /**
+   * Retrieve ownership information for a company/organization
+   *
+   * @param params - Company parameters including company nanoid
+   * @returns Promise resolving to the organization ownership details
+   * @throws Error if retrieval fails or company not found
+   */
+  async getOwnership(params) {
+    return this.request(
+      "GET",
+      apiPath`/v2/company/${params.nanoid}/ownership`
+    );
+  }
+}
+class EntityBalanceApi extends ApiGroup {
+  /**
+   * Retrieve the current balance for an entity (company, team, or user)
+   *
+   * @param params - Balance request parameters including entity identifier
+   * @returns Promise resolving to the entity balance information
+   * @throws Error if retrieval fails or entity not found
+   */
+  async get(params) {
+    return this.request(
+      "GET",
+      "/v2/balance",
+      void 0,
+      params
+    );
+  }
+}
+class InvitesApi extends ApiGroup {
+  /**
+   * Send invitations to team members via email
+   *
+   * @param data - Invitation data including emails and team information
+   * @returns Promise resolving to the invitation response
+   * @throws Error if invitation fails or validation errors occur
+   */
+  async send(data) {
+    return this.request("POST", "/v2/invites", data);
+  }
+  /**
+   * Get typed data for manager invite signing (manual flow)
+   *
+   * @param data - Manager invite request data
+   * @returns Promise resolving to the typed data for manual signing
+   * @throws Error if typed data generation fails or validation errors occur
+   */
+  async getManagerInviteTypedData(data) {
+    return this.request(
+      "POST",
+      "/v2/invites/manager",
+      data
+    );
+  }
+  /**
+   * Send manager invite and sign
+   */
+  async sendManagerInvite(data) {
+    const { privateKey, ...inviteData } = data;
+    const createResponse = await this.getManagerInviteTypedData(inviteData);
+    const { signer, signature } = await this.client.signTypedData(
+      createResponse.data.typed_data.domain,
+      createResponse.data.typed_data.types,
+      createResponse.data.typed_data.typed_data,
+      privateKey
+    );
+    const executeData = {
+      invites: createResponse.data.invites,
+      signer,
+      typed_data: createResponse.data.typed_data.typed_data,
+      signature
+    };
+    return this.executeManagerInviteWithSignedData(executeData);
+  }
+  /**
+   * Execute manager invite with pre-signed data (manual flow)
+   *
+   * @param data - Signed manager invite data including signature
+   * @returns Promise resolving to the executed manager invite response
+   * @throws Error if execution fails or signature is invalid
+   */
+  async executeManagerInviteWithSignedData(data) {
+    return this.request(
+      "PUT",
+      "/v2/invites/manager",
+      data
+    );
+  }
+  /**
+   * Retrieve all invitations for a company or team
+   *
+   * @param params - Query parameters for filtering and pagination
+   * @returns Promise resolving to the list of invitations
+   * @throws Error if retrieval fails or access denied
+   */
+  async get(params) {
+    return this.request(
+      "GET",
+      "/v2/invites",
+      void 0,
+      params
+    );
+  }
+}
+class MeApi extends ApiGroup {
+  /**
+   * Retrieve information about the currently authenticated user
+   *
+   * @returns Promise resolving to the current user's information
+   * @throws Error if retrieval fails or authentication invalid
+   */
+  async get() {
+    return this.request("GET", "/v2/me");
+  }
+}
+const assertPaymentTypedDataMatchesRequest = (toSign, requested, expectedChainIds) => {
+  const chainId = toSign.domain?.chainId;
+  if (expectedChainIds && typeof chainId === "number" && !expectedChainIds.includes(chainId)) {
+    throw new Error(
+      `Refusing to sign: typed data chainId ${chainId} is not one of the expected chain ids [${expectedChainIds.join(", ")}] for this environment`
+    );
+  }
+  const signedFields = toSign.typed_data.data;
+  if (!signedFields) return;
+  if (typeof signedFields.paymentsCount === "string") {
+    const count = Number(signedFields.paymentsCount);
+    if (!Number.isInteger(count) || count > requested.to.length) {
+      throw new Error(
+        `Refusing to sign: typed data authorizes ${signedFields.paymentsCount} payments but only ${requested.to.length} were requested`
+      );
+    }
+  }
+  if (typeof signedFields.maxAmountPerPayment === "string") {
+    const maxRequestedCents = requested.to.reduce(
+      (max, recipient) => recipient.amount_cents > max ? recipient.amount_cents : max,
+      0
+    );
+    if (BigInt(signedFields.maxAmountPerPayment) > BigInt(maxRequestedCents) * CENTS_TO_TOKEN_UNITS) {
+      throw new Error(
+        `Refusing to sign: typed data authorizes up to ${signedFields.maxAmountPerPayment} token units per payment, above the requested maximum of ${maxRequestedCents} cents`
+      );
+    }
+  }
+};
+class PaymentsApi extends ApiGroup {
+  /**
+   * Retrieve a list of payments with optional filtering and pagination
+   *
+   * @param params - Query parameters for filtering and pagination
+   * @returns Promise resolving to the list of payments
+   * @throws Error if retrieval fails or access denied
+   */
+  async get(params) {
+    return this.request(
+      "GET",
+      "/v2/payments",
+      void 0,
+      params
+    );
+  }
+  /**
+   * Get typed data for payment signing (manual flow)
+   *
+   * @param data - Payment request data
+   * @param idempotencyKey - Optional idempotency key sent as `x-idempotency-key`.
+   *   When omitted, the transport generates a fresh one per call. Use a
+   *   DIFFERENT key for the matching `executePaymentWithSignedData` call — the
+   *   server takes the payment group id from the signed data, not the header, so
+   *   the two calls must not share a key (`sendPayment` handles this for you).
+   * @returns Promise resolving to the typed data for manual signing
+   * @throws Error if typed data generation fails or validation errors occur
+   */
+  async getPaymentTypedData(data, idempotencyKey) {
+    return this.request(
+      "POST",
+      "/v2/payments",
+      data,
+      void 0,
+      idempotencyKey ? { "x-idempotency-key": idempotencyKey } : void 0
+    );
+  }
+  /**
+   * Create and send payment with signature.
+   *
+   * Before signing, the server-provided typed data is checked against what the
+   * caller asked for (chain id, payment count, max per-payment amount) — the
+   * SDK refuses to sign an authorization broader than the request. The result
+   * carries the prepare step's `failed_payments` and `duplicates` so silently
+   * skipped or repeated recipients are visible to the caller.
+   */
+  async sendPayment(data) {
+    const { privateKey, idempotencyKey, ...paymentData } = data;
+    const createResponse = await this.getPaymentTypedData(
+      paymentData,
+      idempotencyKey
+    );
+    assertPaymentTypedDataMatchesRequest(
+      createResponse.data.to_sign,
+      paymentData,
+      this.client.getExpectedChainIds()
+    );
+    const { signer, signature } = await this.client.signTypedData(
+      createResponse.data.to_sign.domain,
+      createResponse.data.to_sign.types,
+      createResponse.data.to_sign.typed_data,
+      privateKey
+    );
+    const executeData = {
+      ...paymentData,
+      signer,
+      typed_data: createResponse.data.to_sign.typed_data,
+      signature,
+      payment_data: createResponse.data.payment_data
+    };
+    const executeResponse = await this.executePaymentWithSignedData(executeData);
+    return {
+      ...executeResponse,
+      failed_payments: createResponse.data.failed_payments,
+      duplicates: createResponse.data.duplicates
+    };
+  }
+  /**
+   * Execute payment with pre-signed data (manual flow)
+   *
+   * @param data - Signed payment data including signature
+   * @param idempotencyKey - Optional idempotency key sent as `x-idempotency-key`.
+   *   When omitted, the transport generates a fresh one per call. Use a fresh
+   *   key here (not the one from `getPaymentTypedData`) — the server takes the
+   *   payment group id from the signed data, so reusing the prepare key only
+   *   collides with the request-dedup window.
+   * @returns Promise resolving to the executed payment response
+   * @throws Error if execution fails or signature is invalid
+   */
+  async executePaymentWithSignedData(data, idempotencyKey) {
+    return this.request(
+      "PUT",
+      "/v2/payments",
+      data,
+      void 0,
+      idempotencyKey ? { "x-idempotency-key": idempotencyKey } : void 0
+    );
+  }
+}
+class PayrollApi extends ApiGroup {
+  /**
+   * Enable payroll functionality for a specific team
+   *
+   * @param data - Payroll enablement configuration data
+   * @returns Promise resolving to the payroll enablement response
+   * @throws Error if enablement fails or team not found
+   */
+  async enable(params, data) {
+    return this.request(
+      "POST",
+      apiPath`/v2/payroll/team/${params.team_nanoid}`,
+      data
+    );
+  }
+  /**
+   * Retrieve payroll information for a specific team
+   *
+   * @param params - Team payroll parameters including team nanoid
+   * @returns Promise resolving to the team payroll information
+   * @throws Error if retrieval fails or team not found
+   */
+  async getTeamPayroll(params) {
+    return this.request(
+      "GET",
+      apiPath`/v2/payroll/team/${params.team_nanoid}`
+    );
+  }
+}
+class TeamApi extends ApiGroup {
+}
+class UserApi extends ApiGroup {
+  /**
+   * Update the address information for the current user
+   *
+   * @param data - Updated user address information
+   * @returns Promise that resolves when update is complete
+   * @throws Error if update fails or validation errors occur
+   */
+  async updateAddress(data) {
+    return this.request("PUT", "/v2/user/address", data);
+  }
+  /**
+   * Update the avatar/profile picture for the current user
+   *
+   * @param data - Avatar update data including image file
+   * @returns Promise resolving to the avatar update response
+   * @throws Error if update fails or file validation errors occur
+   */
+  async updateAvatar(data) {
+    return this.request(
+      "POST",
+      "/v2/user/avatar/update",
+      data
+    );
+  }
+  /**
+   * Retrieve all companies associated with the current user
+   *
+   * @returns Promise resolving to the list of user's companies
+   * @throws Error if retrieval fails or authentication invalid
+   */
+  async getCompanies() {
+    return this.request("GET", "/v2/user/organizations");
+  }
+  /**
+   * Retrieve all teams associated with the current user
+   *
+   * @returns Promise resolving to the list of user's teams
+   * @throws Error if retrieval fails or authentication invalid
+   */
+  async getTeams() {
+    return this.request("GET", "/v2/user/teams");
+  }
+}
+let RiseApiClient$1 = class RiseApiClient {
+  baseUrl;
+  jwtToken;
+  riseId;
+  privateKey;
+  timeout;
+  headers;
+  isGeneratingJwt = false;
+  // API Groups
+  webhooks;
+  auth;
+  company;
+  entityBalance;
+  invites;
+  me;
+  payments;
+  payroll;
+  team;
+  user;
+  constructor(options) {
+    if (!(options.jwtToken || options.riseIdAuth)) {
+      throw new Error(
+        "Either JWT token or riseIdAuth configuration is required for authentication"
+      );
+    }
+    if (options.riseIdAuth) {
+      if (!(options.riseIdAuth.riseId && options.riseIdAuth.privateKey)) {
+        throw new Error(
+          "riseIdAuth configuration must include both riseId and privateKey"
+        );
+      }
+      if (!options.riseIdAuth.riseId.startsWith("0x") || options.riseIdAuth.riseId.length !== RISE_ID_LENGTH) {
+        throw new Error(
+          "Rise ID should be a valid hex address starting with 0x and exactly 42 characters long"
+        );
+      }
+      if (!options.riseIdAuth.privateKey.startsWith("0x") || options.riseIdAuth.privateKey.length !== PRIVATE_KEY_LENGTH) {
+        throw new Error(
+          "Private key should be a valid hex string starting with 0x and 64 characters long"
+        );
+      }
+    }
+    if (options.baseUrl) {
+      const isHttps = options.baseUrl.startsWith("https://");
+      const isLocalhost = /^http:\/\/(localhost|127\.0\.0\.1)(:\d+)?(\/|$)/.test(options.baseUrl);
+      if (!(isHttps || isLocalhost)) {
+        throw new Error(
+          `baseUrl must use https:// (got "${options.baseUrl}"). Plaintext http:// is only allowed for localhost.`
+        );
+      }
+      this.baseUrl = options.baseUrl;
+    } else {
+      const environment = options.environment ?? "prod";
+      this.baseUrl = RISE_API_URLS[environment];
+    }
+    this.jwtToken = options.jwtToken ?? "";
+    this.riseId = options.riseIdAuth?.riseId ?? "";
+    this.privateKey = options.riseIdAuth?.privateKey ?? "";
+    this.timeout = options.timeout ?? 3e4;
+    const authHeader = this.jwtToken ? `Bearer ${this.jwtToken}` : "";
+    this.headers = {
+      "Content-Type": "application/json",
+      Authorization: authHeader,
+      ...options.headers
+    };
+    this.webhooks = new WebhooksApi(this);
+    this.auth = new AuthApi(this);
+    this.company = new CompanyApi(this);
+    this.entityBalance = new EntityBalanceApi(this);
+    this.invites = new InvitesApi(this);
+    this.me = new MeApi(this);
+    this.payments = new PaymentsApi(this);
+    this.payroll = new PayrollApi(this);
+    this.team = new TeamApi(this);
+    this.user = new UserApi(this);
+  }
+  /**
+   * Update the JWT token for authentication
+   *
+   * @param newToken - New JWT token to use for authentication
+   * @throws Error if the token is empty or invalid
+   */
+  updateToken(newToken) {
+    if (!newToken) {
+      throw new Error("JWT token cannot be empty");
+    }
+    this.jwtToken = newToken;
+    this.headers.Authorization = `Bearer ${this.jwtToken}`;
+  }
+  /**
+   * Get the current JWT token
+   *
+   * @returns The current JWT token string
+   */
+  getToken() {
+    return this.jwtToken;
+  }
+  /**
+   * Check if the client is using JWT token authentication
+   *
+   * @returns True if using JWT token, false otherwise
+   */
+  isUsingJwtToken() {
+    return !!this.jwtToken;
+  }
+  /**
+   * Check if the client is using Rise ID and private key authentication
+   *
+   * @returns True if using Rise ID auth, false otherwise
+   */
+  isUsingRiseIdAuth() {
+    return !!(this.riseId && this.privateKey);
+  }
+  /**
+   * Get the Rise ID used for authentication
+   *
+   * @returns The Rise ID string
+   */
+  getRiseId() {
+    return this.riseId;
+  }
+  /**
+   * Resolve the signing key (per-call override or the configured key) or throw.
+   * Private on purpose — the raw key is never handed out; callers sign via
+   * {@link signTypedData} / {@link signMessage} and receive only the signature.
+   */
+  resolveSigningKey(overrideKey) {
+    const key = overrideKey ?? this.privateKey;
+    if (!key) {
+      throw new Error(
+        "A private key is required to sign. Provide privateKey in the request or configure riseIdAuth when creating the client."
+      );
+    }
+    return key;
+  }
+  /**
+   * Sign EIP-712 typed data with the configured key (or a per-call override).
+   * The key is used in-process and never returned, so it cannot be exfiltrated.
+   *
+   * @returns The signer address and the signature
+   */
+  async signTypedData(domain, types, value, overrideKey) {
+    const wallet = new ethers.ethers.Wallet(this.resolveSigningKey(overrideKey));
+    const signature = await wallet.signTypedData(domain, types, value);
+    return { signer: wallet.address, signature };
+  }
+  /**
+   * Sign a plain message with the configured key (or a per-call override).
+   *
+   * @returns The signer address and the signature
+   */
+  async signMessage(message, overrideKey) {
+    const wallet = new ethers.ethers.Wallet(this.resolveSigningKey(overrideKey));
+    const signature = await wallet.signMessage(message);
+    return { signer: wallet.address, signature };
+  }
+  /**
+   * Build an error for a failed API response. The status line goes in the
+   * message; the raw response body is attached as a NON-enumerable `responseBody`
+   * so it can be inspected deliberately but does not leak into
+   * JSON.stringify(error) or structured loggers that serialize error fields.
+   */
+  buildApiError(status, statusText, body) {
+    const error = new Error(`API request failed: ${status} ${statusText}`);
+    Object.defineProperty(error, "status", {
+      value: status,
+      enumerable: false
+    });
+    Object.defineProperty(error, "responseBody", {
+      value: body,
+      enumerable: false
+    });
+    return error;
+  }
+  /**
+   * Manually refresh the JWT token using Rise ID and private key
+   *
+   * @returns Promise resolving to the new JWT token
+   * @throws Error if Rise ID or private key not provided
+   */
+  async refreshJwtToken() {
+    if (!(this.privateKey && this.riseId)) {
+      throw new Error("Rise ID and private key are required for JWT refresh");
+    }
+    return await this.generateJwtToken();
+  }
+  /**
+   * Hostname of the configured base URL, or '' when it does not parse.
+   * Environment/chain checks compare hostnames, never URL substrings — a
+   * substring like 'riseworks.io' also matches attacker hosts such as
+   * evil.example/riseworks.io.
+   */
+  getBaseHostname() {
+    try {
+      return new URL(this.baseUrl).hostname;
+    } catch {
+      return "";
+    }
+  }
+  /**
+   * Get the current API environment
+   *
+   * @returns The current environment ('dev', 'stg', or 'prod')
+   */
+  getEnvironment() {
+    if (this.baseUrl === RISE_API_URLS.dev) return "dev";
+    if (this.baseUrl === RISE_API_URLS.stg) return "stg";
+    if (this.baseUrl === RISE_API_URLS.prod) return "prod";
+    const hostname = this.getBaseHostname();
+    if (hostname === "dev-riseworks.io" || hostname.endsWith(".dev-riseworks.io")) {
+      return "dev";
+    }
+    if (hostname === "staging-riseworks.io" || hostname.endsWith(".staging-riseworks.io")) {
+      return "stg";
+    }
+    return "prod";
+  }
+  /**
+   * Update the API environment and base URL
+   *
+   * @param environment - New environment to switch to
+   */
+  updateEnvironment(environment) {
+    this.baseUrl = RISE_API_URLS[environment];
+  }
+  /**
+   * Chain ids `sendPayment` will sign typed data for, resolved from the base
+   * URL. Null for custom base URLs (local nodes, proxies) — the pre-signing
+   * chain check is skipped there, since the expected chain is unknowable.
+   */
+  getExpectedChainIds() {
+    const hostname = this.getBaseHostname();
+    const riseDomains = [
+      "riseworks.io",
+      "dev-riseworks.io",
+      "staging-riseworks.io"
+    ];
+    const isKnownRiseUrl = Object.values(RISE_API_URLS).some((url) => url === this.baseUrl) || riseDomains.some(
+      (domain) => hostname === domain || hostname.endsWith(`.${domain}`)
+    );
+    return isKnownRiseUrl ? EXPECTED_CHAIN_IDS[this.getEnvironment()] : null;
+  }
+  /**
+   * Generate a JWT token using Sign-In with Ethereum (SIWE) authentication
+   *
+   * @returns Promise resolving to the generated JWT token
+   * @throws Error if Rise ID or private key not provided, or if generation fails
+   */
+  async generateJwtToken() {
+    if (!(this.riseId && this.privateKey)) {
+      throw new Error("Rise ID and private key are required for JWT generation");
+    }
+    if (this.isGeneratingJwt) {
+      throw new Error("JWT generation already in progress");
+    }
+    try {
+      await ethers.ethers.resolveAddress(this.riseId);
+    } catch (error) {
+      throw new Error(
+        `Invalid Rise ID address: ${error instanceof Error ? error.message : "Address validation failed"}`
+      );
+    }
+    this.isGeneratingJwt = true;
+    try {
+      const wallet = new ethers.ethers.Wallet(this.privateKey);
+      const walletAddress = wallet.address;
+      const siweUrl = `${this.baseUrl}/v2/auth/siwe?wallet=${walletAddress}&riseid=${this.riseId}`;
+      const siweResponse = await fetch(siweUrl);
+      if (!siweResponse.ok) {
+        const errorData = await siweResponse.json();
+        throw new Error(
+          `HTTP ${siweResponse.status}: ${errorData.data || "Unknown error"}`
+        );
+      }
+      const siweData = await siweResponse.json();
+      if (!siweData.success) {
+        throw new Error(siweData.data || "Failed to get SIWE message");
+      }
+      const siweMessage = siweData.data.siwe;
+      const signature = await wallet.signMessage(siweMessage);
+      const nonceMatch = siweMessage.match(/Nonce: (.+)/);
+      const nonce = nonceMatch?.[1]?.trim() ?? "";
+      if (!nonce) {
+        throw new Error("Could not extract nonce from SIWE message");
+      }
+      const verifyResponse = await fetch(`${this.baseUrl}/v2/auth/verify`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          message: siweMessage,
+          sig: signature,
+          nonce
+        })
+      });
+      if (!verifyResponse.ok) {
+        const errorData = await verifyResponse.json();
+        throw new Error(
+          `HTTP ${verifyResponse.status}: ${errorData.data || "Verification failed"}`
+        );
+      }
+      const verifyData = await verifyResponse.json();
+      if (!verifyData.success) {
+        throw new Error(verifyData.data || "Signature verification failed");
+      }
+      const jwtToken = verifyData.data.jwt;
+      this.jwtToken = jwtToken;
+      this.headers.Authorization = `Bearer ${this.jwtToken}`;
+      return jwtToken;
+    } finally {
+      this.isGeneratingJwt = false;
+    }
+  }
+  /**
+   * Check if JWT token is valid by making a test request
+   */
+  async isJwtValid() {
+    if (!this.jwtToken) {
+      return false;
+    }
+    try {
+      const response = await fetch(`${this.baseUrl}/v2/me`, {
+        method: "GET",
+        headers: this.headers,
+        signal: AbortSignal.timeout(this.timeout)
+      });
+      return response.ok;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Helper function to parse response body from different formats
+   */
+  async parseResponseBody(response) {
+    try {
+      return await response.json();
+    } catch {
+      try {
+        const text = await response.text();
+        return JSON.parse(text);
+      } catch {
+        return {};
+      }
+    }
+  }
+  /**
+   * Makes an HTTP request with proper error handling and type safety
+   */
+  async request(method, path, data, query, extraHeaders) {
+    if (this.riseId && this.privateKey && !(this.jwtToken && await this.isJwtValid())) {
+      try {
+        await this.generateJwtToken();
+      } catch (error) {
+        const errorMessage = error instanceof Error ? error.message : "Unknown error";
+        throw new Error(`Failed to generate JWT token: ${errorMessage}`);
+      }
+    }
+    const methodUpper = method.toUpperCase();
+    const autoIdempotencyKey = (methodUpper === "POST" || methodUpper === "PUT") && !extraHeaders?.["x-idempotency-key"] ? { "x-idempotency-key": generateIdempotencyKey() } : void 0;
+    const headers = extraHeaders || autoIdempotencyKey ? { ...this.headers, ...extraHeaders, ...autoIdempotencyKey } : this.headers;
+    const url = new URL(path, this.baseUrl);
+    if (query) {
+      for (const [key, value] of Object.entries(query)) {
+        if (value === void 0 || value === null) continue;
+        if (Array.isArray(value)) {
+          for (const item of value) {
+            if (item !== void 0 && item !== null) {
+              url.searchParams.append(key, String(item));
+            }
+          }
+        } else {
+          url.searchParams.append(key, String(value));
+        }
+      }
+    }
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), this.timeout);
+    try {
+      const response = await fetch(url.toString(), {
+        method,
+        headers,
+        body: data ? JSON.stringify(data) : void 0,
+        signal: controller.signal
+      });
+      clearTimeout(timeoutId);
+      if (!response.ok) {
+        const isIdempotent = ["GET", "HEAD", "OPTIONS"].includes(
+          method.toUpperCase()
+        );
+        if (response.status === 401 && this.riseId && this.privateKey && isIdempotent) {
+          clearTimeout(timeoutId);
+          try {
+            await this.generateJwtToken();
+          } catch (jwtError) {
+            const errorMessage = jwtError instanceof Error ? jwtError.message : "Unknown error";
+            throw new Error(`Failed to refresh JWT token: ${errorMessage}`);
+          }
+          const retryHeaders = extraHeaders ? { ...this.headers, ...extraHeaders } : this.headers;
+          const retryController = new AbortController();
+          const retryTimeoutId = setTimeout(
+            () => retryController.abort(),
+            this.timeout
+          );
+          try {
+            const retryResponse = await fetch(url.toString(), {
+              method,
+              headers: retryHeaders,
+              body: data ? JSON.stringify(data) : void 0,
+              signal: retryController.signal
+            });
+            if (!retryResponse.ok) {
+              const errorData2 = await this.parseResponseBody(retryResponse);
+              throw this.buildApiError(
+                retryResponse.status,
+                retryResponse.statusText,
+                errorData2
+              );
+            }
+            return await this.parseResponseBody(retryResponse);
+          } finally {
+            clearTimeout(retryTimeoutId);
+          }
+        }
+        const errorData = await this.parseResponseBody(response);
+        throw this.buildApiError(
+          response.status,
+          response.statusText,
+          errorData
+        );
+      }
+      return await this.parseResponseBody(response);
+    } catch (error) {
+      clearTimeout(timeoutId);
+      if (error instanceof Error) {
+        throw error;
+      }
+      throw new Error("Request failed");
+    }
+  }
+};
+
+class BillPayApi {
+  constructor(client) {
+    this.client = client;
+  }
+  async listRecipients(params) {
+    return this.client.rawRequest(
+      "GET",
+      apiPath`/v2/payments/teams/${params.team_nanoid}/external_entity`
+    );
+  }
+  async createRecipient(params, data) {
+    return this.client.rawRequest(
+      "POST",
+      apiPath`/v2/payments/teams/${params.team_nanoid}/external_entity/`,
+      data
+    );
+  }
+  async prepareInstantPayment(data) {
+    return this.client.rawRequest(
+      "POST",
+      "/v2/payments/external_entity/instant",
+      data
+    );
+  }
+  async create(data) {
+    return this.prepareInstantPayment(data);
+  }
+  async executeInstantPayment(data) {
+    return this.client.rawRequest(
+      "PUT",
+      "/v2/payments/external_entity/instant",
+      data
+    );
+  }
+  async execute(data) {
+    return this.executeInstantPayment(data);
+  }
+  async sendInstantPayment(data) {
+    const { privateKey, ...paymentData } = data;
+    const createResponse = await this.prepareInstantPayment(paymentData);
+    const { signer, signature } = await this.client.signTypedData(
+      createResponse.data.domain,
+      createResponse.data.types,
+      createResponse.data.typed_data,
+      privateKey
+    );
+    return this.executeInstantPayment({
+      ...paymentData,
+      signer,
+      typed_data: createResponse.data.typed_data,
+      signature
+    });
+  }
+  async send(data) {
+    return this.sendInstantPayment(data);
+  }
+}
+class RiseApiClient extends RiseApiClient$1 {
+  organizations;
+  billPay;
+  teams;
+  constructor(options) {
+    super(options);
+    const client = this;
+    Object.assign(this.webhooks, {
+      delete: async (webhookNanoid) => client.rawRequest(
+        "DELETE",
+        apiPath`/v2/webhooks/${webhookNanoid}`
+      ),
+      listDeliveries: async (webhookNanoid, params) => this.webhooks.getDeliveryHistory(webhookNanoid, params)
+    });
+    Object.assign(this.payments, {
+      prepare: async (data, idempotencyKey) => this.payments.getPaymentTypedData(data, idempotencyKey),
+      create: async (data, idempotencyKey) => this.payments.getPaymentTypedData(data, idempotencyKey),
+      execute: async (data, idempotencyKey) => this.payments.executePaymentWithSignedData(data, idempotencyKey)
+    });
+    Object.assign(this.invites, {
+      prepareManagerInvite: async (data) => this.invites.getManagerInviteTypedData(data),
+      executeManagerInvite: async (data) => this.invites.executeManagerInviteWithSignedData(data)
+    });
+    Object.assign(this.team, {
+      create: async (data) => client.rawRequest("POST", "/v2/teams", data),
+      get: async (params) => client.rawRequest(
+        "GET",
+        apiPath`/v2/teams/${params.team_nanoid}`
+      ),
+      update: async (paramsOrData, data) => {
+        const params = data ? paramsOrData : { team_nanoid: paramsOrData.team_nanoid };
+        const updateData = data ?? paramsOrData;
+        return client.rawRequest(
+          "PUT",
+          apiPath`/v2/teams/${params.team_nanoid}`,
+          updateData
+        );
+      },
+      delete: async (params) => client.rawRequest(
+        "DELETE",
+        apiPath`/v2/teams/${params.team_nanoid}`
+      ),
+      getUsers: async (params) => client.rawRequest(
+        "GET",
+        apiPath`/v2/teams/${params.team_nanoid}/users`
+      ),
+      getSettings: async (params) => client.rawRequest(
+        "GET",
+        apiPath`/v2/teams/${params.team_nanoid}/settings`
+      ),
+      updateSettings: async (params, data) => client.rawRequest(
+        "PUT",
+        apiPath`/v2/teams/${params.team_nanoid}/settings`,
+        data
+      ),
+      getMemberSettings: async (params) => client.rawRequest(
+        "GET",
+        apiPath`/v2/teams/${params.team_nanoid}/member/${params.user_nanoid}/settings`
+      ),
+      updateMemberSettings: async (params, data) => client.rawRequest(
+        "PUT",
+        apiPath`/v2/teams/${params.team_nanoid}/member/${params.user_nanoid}/settings`,
+        data
+      ),
+      getMemberSummary: async (params) => client.rawRequest(
+        "GET",
+        apiPath`/v2/teams/${params.team_nanoid}/member/${params.user_nanoid}/summary`
+      ),
+      removeMember: async (params) => client.rawRequest(
+        "DELETE",
+        apiPath`/v2/teams/${params.team_nanoid}/member/${params.user_nanoid}`
+      )
+    });
+    Object.assign(this.user, {
+      // Alias for the generated getCompanies (same /v2/user/organizations route).
+      getOrganizations: async () => client.rawRequest(
+        "GET",
+        "/v2/user/organizations"
+      )
+    });
+    this.organizations = this.company;
+    this.billPay = new BillPayApi(client);
+    this.teams = this.team;
+  }
+  rawRequest(method, path, data, query) {
+    return this.request(method, path, data, query);
+  }
+}
+
+const getUnixTimestamp = () => Math.floor(Date.now() / 1e3);
+class WebhookValidationError extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "WebhookValidationError";
+  }
+}
+class WebhookValidator {
+  secret;
+  tolerance;
+  constructor(secret, options) {
+    if (!secret) {
+      throw new Error("Webhook secret is required");
+    }
+    this.secret = secret;
+    this.tolerance = options?.tolerance ?? 600;
+  }
+  /**
+   * Validates a webhook event and returns the typed event object
+   *
+   * Throws an error if validation fails. Use validateEventSafe() for non-throwing validation.
+   *
+   * @param requestBody - The raw webhook request body (string or Buffer). Pass the raw bytes, NOT a parsed object — re-serializing changes the bytes and breaks signature verification.
+   * @param signature - The X-Rise-Signature header value from the webhook request
+   * @param options - Optional validation configuration
+   * @returns The parsed and typed webhook event
+   * @throws WebhookValidationError if validation fails
+   *
+   */
+  validateEvent(requestBody, signature, options) {
+    const result = this.validateEventSafe(requestBody, signature, options);
+    if (!(result.event && result.isValid)) {
+      throw new WebhookValidationError(
+        result.error ?? "Webhook validation failed",
+        result.code ?? (result.timestampValid === false ? "TIMESTAMP_TOO_OLD" : "INVALID_SIGNATURE")
+      );
+    }
+    return result.event;
+  }
+  /**
+   * Safely validates a webhook event without throwing errors
+   *
+   * Returns a result object instead of throwing. Use validateEvent() for throwing validation.
+   *
+   * @param requestBody - The raw webhook request body (string or Buffer). Pass the raw bytes, NOT a parsed object — re-serializing changes the bytes and breaks signature verification.
+   * @param signature - The X-Rise-Signature header value from the webhook request
+   * @param options - Optional validation configuration
+   * @returns WebhookValidationResult containing validation status and event data
+   *
+   */
+  validateEventSafe(requestBody, signature, options = {}) {
+    const { tolerance = this.tolerance } = options;
+    try {
+      const body = requestBody;
+      if (body === null || body === void 0) {
+        throw new WebhookValidationError(
+          "Request body cannot be null or undefined.",
+          "MALFORMED_PAYLOAD"
+        );
+      }
+      if (typeof body !== "string" && !Buffer.isBuffer(body)) {
+        throw new WebhookValidationError(
+          `Invalid request body type: ${typeof body}. Expected the raw string or Buffer body (a parsed object would break signature verification).`,
+          "MALFORMED_PAYLOAD"
+        );
+      }
+      const payloadString = typeof body === "string" ? body : body.toString("utf8");
+      if (!signature) {
+        return {
+          isValid: false,
+          code: "INVALID_SIGNATURE",
+          error: "Missing or invalid signature header"
+        };
+      }
+      const signatureParts = this.parseSignatureHeader(signature);
+      if (!signatureParts) {
+        return {
+          isValid: false,
+          code: "INVALID_SIGNATURE",
+          error: "Invalid signature format - expected format: t=timestamp,v1=hash"
+        };
+      }
+      const { timestamp, hash } = signatureParts;
+      const currentTime = getUnixTimestamp();
+      const timeDiff = currentTime - timestamp;
+      if (timeDiff > tolerance) {
+        return {
+          isValid: false,
+          code: "TIMESTAMP_TOO_OLD",
+          error: `Timestamp too old (${timeDiff}s ago, tolerance: ${tolerance}s)`,
+          timestampValid: false
+        };
+      }
+      if (timestamp > currentTime + 60) {
+        return {
+          isValid: false,
+          code: "TIMESTAMP_TOO_OLD",
+          error: `Timestamp is in the future (${timestamp - currentTime}s ahead)`,
+          timestampValid: false
+        };
+      }
+      const expectedHash = this.generateSignature(timestamp, payloadString);
+      const signatureValid = this.compareSignatures(hash, expectedHash);
+      if (!signatureValid) {
+        return {
+          isValid: false,
+          code: "INVALID_SIGNATURE",
+          error: "Invalid signature",
+          timestampValid: true
+        };
+      }
+      const payloadObject = JSON.parse(payloadString);
+      if (payloadObject.event_version?.includes("2.")) {
+        switch (payloadObject.event_type) {
+          case "payment.sent":
+            return {
+              isValid: true,
+              event: payloadObject,
+              timestampValid: true
+            };
+          case "withdraw_account.duplicated_detected":
+            return {
+              isValid: true,
+              event: payloadObject,
+              timestampValid: true
+            };
+          case "invite.accepted":
+            return {
+              isValid: true,
+              event: payloadObject,
+              timestampValid: true
+            };
+          case "deposit.received":
+            return {
+              isValid: true,
+              event: payloadObject,
+              timestampValid: true
+            };
+          case "payment.group.created":
+            return {
+              isValid: true,
+              event: payloadObject,
+              timestampValid: true
+            };
+          default:
+            return {
+              isValid: false,
+              code: "UNKNOWN_EVENT_TYPE",
+              error: `Unknown event type: ${payloadObject.event_type}`,
+              timestampValid: true
+            };
+        }
+      }
+      return {
+        isValid: false,
+        code: "UNKNOWN_EVENT_TYPE",
+        error: `Unknown event version: ${payloadObject.event_version}`,
+        timestampValid: true
+      };
+    } catch (error) {
+      return {
+        isValid: false,
+        code: error instanceof WebhookValidationError ? error.code : "MALFORMED_PAYLOAD",
+        error: error instanceof Error ? error.message : "Unknown validation error"
+      };
+    }
+  }
+  /**
+   * Generates a signature for a given timestamp and payload
+   *
+   * Useful for testing or custom validation logic.
+   *
+   * @param timestamp - Unix timestamp in seconds
+   * @param payload - The webhook payload as a string
+   * @returns The generated signature as a hexadecimal string
+   */
+  generateSignature(timestamp, payload) {
+    const signedPayload = `${timestamp}.${payload}`;
+    return crypto__namespace.createHmac("sha256", this.secret).update(signedPayload).digest("hex");
+  }
+  /**
+   * Parses the X-Rise-Signature header (format: t=timestamp,v1=hash)
+   *
+   * @param signature - The X-Rise-Signature header value
+   * @returns Object containing timestamp and hash, or null if parsing fails
+   */
+  parseSignatureHeader(signature) {
+    try {
+      const parts = signature.split(",");
+      if (parts.length !== 2) return null;
+      const timestampPart = parts[0]?.split("=");
+      const hashPart = parts[1]?.split("=");
+      if (timestampPart?.length !== 2 || hashPart?.length !== 2) return null;
+      if (timestampPart[0] !== "t" || hashPart[0] !== "v1") return null;
+      if (!timestampPart[1]) return null;
+      const timestamp = Number.parseInt(timestampPart[1], 10);
+      const hash = hashPart[1];
+      if (Number.isNaN(timestamp) || !hash) return null;
+      return { timestamp, hash };
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Compares two signatures using timing-safe comparison
+   *
+   * @param received - The signature received in the webhook request
+   * @param expected - The signature calculated from the payload and secret
+   * @returns True if signatures match, false otherwise
+   */
+  compareSignatures(received, expected) {
+    try {
+      const receivedBuffer = Buffer.from(received, "hex");
+      const expectedBuffer = Buffer.from(expected, "hex");
+      if (receivedBuffer.length !== expectedBuffer.length) {
+        return false;
+      }
+      return crypto__namespace.timingSafeEqual(receivedBuffer, expectedBuffer);
+    } catch {
+      return false;
+    }
+  }
+}
+
+exports.GeneratedRiseApiClient = RiseApiClient$1;
+exports.RiseApiClient = RiseApiClient;
+exports.WebhookValidationError = WebhookValidationError;
+exports.WebhookValidator = WebhookValidator;