@securelend/sdk 0.1.0-beta.5 → 0.2.0-beta.0

package/dist/index.mjs

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { createHash, createHmac, timingSafeEqual } from 'crypto';
 
 // src/client.ts
 
@@ -51,6 +52,30 @@ var ServerError = class extends SecureLendError {
     this.name = "ServerError";
   }
 };
+var FeatureDisabledError = class extends SecureLendError {
+  constructor(message = "This feature is off for this workspace.", details) {
+    super(message, "feature_disabled", details);
+    this.name = "FeatureDisabledError";
+  }
+};
+var ConsentRequiredError = class extends SecureLendError {
+  constructor(message = "A live consent is required before this package can be read.", details) {
+    super(message, "consent_required", details);
+    this.name = "ConsentRequiredError";
+  }
+};
+var InvalidTransitionError = class extends SecureLendError {
+  constructor(message = "That outcome is not available.", details) {
+    super(message, "invalid_transition", details);
+    this.name = "InvalidTransitionError";
+  }
+};
+var WebhookSignatureError = class extends SecureLendError {
+  constructor(message = "Webhook signature did not match.", details) {
+    super(message, "webhook_signature", details);
+    this.name = "WebhookSignatureError";
+  }
+};
 
 // src/utils/mcp.ts
 var MCPClient = class {
@@ -125,6 +150,197 @@ var MCPClient = class {
     this.debug = false;
   }
 };
+var OUTCOME_STATES = [
+  "viewed",
+  "info_requested",
+  "declined",
+  "term_sheet",
+  "approved",
+  "funded",
+  "withdrawn"
+];
+var DECLINE_REASON_CODES = [
+  "outside_credit_box",
+  "industry",
+  "time_in_business",
+  "dscr",
+  "collateral",
+  "amount",
+  "state",
+  "credit_score",
+  "docs_incomplete",
+  "capacity",
+  "other"
+];
+var SHARE_SCOPES = ["summary", "memo", "checks", "documents"];
+var FEEDBACK_TYPES = [
+  "rating",
+  "edit",
+  "comment",
+  "approve",
+  "reject",
+  "regenerate"
+];
+var FEEDBACK_TARGETS = [
+  "memo_section",
+  "memo",
+  "tool",
+  "decision",
+  "lead_match"
+];
+var EVENT_TYPES = [
+  "lead.created",
+  "lead.matched",
+  "lead.notified",
+  "package.shared",
+  "package.opened",
+  "consent.revoked",
+  "outcome.recorded",
+  "credit_box.updated",
+  "feedback.recorded"
+];
+var leadSchema = z.object({
+  id: z.string(),
+  tenantId: z.string().nullable().optional(),
+  status: z.string().nullable().optional(),
+  productType: z.string().nullable().optional(),
+  amount: z.number().nullable().optional(),
+  legalName: z.string().nullable().optional(),
+  email: z.string().nullable().optional(),
+  caseId: z.string().nullable().optional(),
+  lenders: z.array(
+    z.object({
+      id: z.string().nullable().optional(),
+      name: z.string().optional(),
+      tenantId: z.string().nullable().optional()
+    }).passthrough()
+  ).optional(),
+  createdAt: z.string().optional(),
+  updatedAt: z.string().optional()
+}).passthrough();
+var leadListSchema = z.object({
+  items: z.array(leadSchema),
+  tenantId: z.string().optional()
+}).passthrough();
+var uploadResultSchema = z.object({
+  key: z.string().optional(),
+  filename: z.string().optional(),
+  documentType: z.string().optional(),
+  applicationId: z.string().optional()
+}).passthrough();
+var matchComponentsSchema = z.object({
+  rules: z.number().nullable().optional(),
+  fit: z.number().nullable().optional(),
+  outcome: z.number().nullable().optional(),
+  sba: z.number().nullable().optional(),
+  samples: z.number().nullable().optional()
+}).passthrough();
+var lenderMatchSchema = z.object({
+  lenderId: z.string().nullable().optional(),
+  score: z.number().nullable().optional(),
+  components: matchComponentsSchema.nullable().optional(),
+  generationId: z.string().nullable().optional()
+}).passthrough();
+var matchListSchema = z.object({
+  leadId: z.string(),
+  generationId: z.string().nullable().optional(),
+  lenders: z.array(lenderMatchSchema)
+}).passthrough();
+var packageSchema = z.object({
+  packageId: z.string().optional(),
+  caseId: z.string().optional(),
+  id: z.string().optional(),
+  generationId: z.string().nullable().optional(),
+  auth: z.string().optional(),
+  error: z.string().optional(),
+  deskUrl: z.string().optional()
+}).passthrough();
+var shareConsentSchema = z.object({
+  id: z.string(),
+  leadId: z.string(),
+  packageId: z.string(),
+  packageVersion: z.number(),
+  lenderId: z.string().optional(),
+  scope: z.array(z.string()),
+  expiresAt: z.string(),
+  revokedAt: z.string().nullable().optional(),
+  borrowerRef: z.string().optional(),
+  grantedAt: z.string().optional()
+}).passthrough();
+var shareReceiptSchema = z.object({
+  id: z.string(),
+  consentId: z.string(),
+  event: z.string(),
+  createdAt: z.string(),
+  lenderId: z.string().optional()
+}).passthrough();
+var leadOutcomeSchema = z.object({
+  id: z.string(),
+  leadId: z.string(),
+  lenderId: z.string(),
+  state: z.string(),
+  reasonCode: z.string().nullable().optional(),
+  reasonText: z.string().nullable().optional(),
+  fundedAmount: z.number().nullable().optional(),
+  fundedOn: z.string().nullable().optional(),
+  surface: z.string().optional(),
+  feedbackId: z.string().nullable().optional(),
+  matchGenerationId: z.string().nullable().optional(),
+  createdAt: z.string().optional()
+}).passthrough();
+var creditBoxSchema = z.object({
+  version: z.number(),
+  lenderId: z.string().optional(),
+  criteria: z.record(z.unknown()).optional(),
+  capacityPerWeek: z.number().nullable().optional(),
+  status: z.string(),
+  pausedUntil: z.string().nullable().optional(),
+  createdAt: z.string().optional()
+}).passthrough();
+var creditBoxViewSchema = z.object({
+  current: creditBoxSchema.nullable(),
+  versions: z.array(creditBoxSchema)
+}).passthrough();
+var feedbackEventSchema = z.object({
+  id: z.string(),
+  generationId: z.string().nullable().optional(),
+  caseId: z.string().nullable().optional(),
+  surface: z.string().optional(),
+  type: z.string(),
+  rating: z.number().nullable().optional(),
+  comment: z.string().nullable().optional(),
+  targetKind: z.string().optional(),
+  targetKey: z.string().optional(),
+  createdAt: z.string().optional()
+}).passthrough();
+var feedbackCreatedSchema = z.object({
+  id: z.string()
+}).passthrough();
+var liquidityCellSchema = z.object({
+  key: z.string(),
+  leads: z.number(),
+  matchRate: z.number().nullable().optional(),
+  responseRate48h: z.number().nullable().optional(),
+  medianResponseMs: z.number().nullable().optional(),
+  termSheetRate: z.number().nullable().optional(),
+  fundedRate: z.number().nullable().optional(),
+  fundedAmount: z.number().nullable().optional(),
+  lenderCount: z.number().optional()
+}).passthrough();
+var liquidityReportSchema = z.object({
+  view: z.string(),
+  groupBy: z.string(),
+  cells: z.array(liquidityCellSchema)
+}).passthrough();
+var secureLendEventSchema = z.object({
+  type: z.string(),
+  id: z.string(),
+  createdAt: z.string(),
+  tenantId: z.string(),
+  data: z.record(z.unknown()).optional()
+}).passthrough();
+
+// src/types/index.ts
 var anyObjectSchema = z.object({}).passthrough();
 var CreditTier = /* @__PURE__ */ ((CreditTier2) => {
   CreditTier2["PRIME"] = "PRIME";
@@ -695,6 +911,834 @@ var leaseVsPurchaseResponseSchema = z.object({
   }),
   widget: z.string().optional()
 });
+var CONSENT_CODES = /* @__PURE__ */ new Set([
+  "consent_required",
+  "consent_revoked",
+  "consent_expired"
+]);
+function sleep(ms) {
+  if (ms <= 0) return Promise.resolve();
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function newIdempotencyKey() {
+  const cryptoRef = globalThis.crypto;
+  if (cryptoRef && typeof cryptoRef.randomUUID === "function") {
+    return cryptoRef.randomUUID();
+  }
+  return `idem_${Date.now().toString(16)}_${Math.random().toString(16).slice(2)}`;
+}
+function bearer(apiKey) {
+  if (!apiKey) return void 0;
+  const trimmed = apiKey.trim();
+  if (!trimmed) return void 0;
+  return trimmed.toLowerCase().startsWith("bearer ") ? trimmed : `Bearer ${trimmed}`;
+}
+function retryDelay(response, fallback) {
+  const header = response.headers.get("retry-after");
+  if (header && /^\d+$/.test(header)) {
+    return Math.min(Number(header) * 1e3, 2e3);
+  }
+  return fallback;
+}
+function validationMessage(code) {
+  if (code === "reason_required") return "A decline needs a reason code.";
+  if (code === "funded_amount_required") return "Funded needs an amount.";
+  if (code === "funded_date_required") {
+    return "Funded needs a date as YYYY-MM-DD.";
+  }
+  if (code === "confirmation_required") {
+    return "The lead needs confirmation before it is created.";
+  }
+  return "The request was not accepted.";
+}
+var RestClient = class {
+  constructor(options) {
+    this.baseUrl = options.baseUrl.replace(/\/$/, "");
+    this.apiKey = options.apiKey;
+    this.fetchImpl = options.fetchImpl;
+    this.maxRetries = options.maxRetries ?? 2;
+    this.retryDelayMs = options.retryDelayMs ?? 0;
+  }
+  setApiKey(apiKey) {
+    this.apiKey = apiKey;
+  }
+  async send(request) {
+    const retries = request.form ? 0 : this.maxRetries;
+    const url = this.url(request.path, request.query);
+    const init = this.init(request);
+    let lastError = null;
+    for (let attempt = 0; attempt <= retries; attempt += 1) {
+      let response;
+      try {
+        response = await this.fetcher()(url, init);
+      } catch (err) {
+        const detail = err instanceof Error && err.message ? err.message.replace(/\s+/g, " ").slice(0, 180) : "";
+        lastError = new NetworkError(
+          detail ? `The request did not reach the server. ${detail}` : "The request did not reach the server."
+        );
+        if (attempt < retries) {
+          await sleep(this.retryDelayMs);
+          continue;
+        }
+        throw lastError;
+      }
+      if ((response.status === 429 || response.status >= 500) && attempt < retries) {
+        await sleep(retryDelay(response, this.retryDelayMs));
+        continue;
+      }
+      return this.read(response, request);
+    }
+    throw lastError || new NetworkError("The request did not reach the server.");
+  }
+  fetcher() {
+    if (this.fetchImpl) return this.fetchImpl;
+    if (typeof globalThis.fetch === "function") {
+      return globalThis.fetch.bind(globalThis);
+    }
+    throw new NetworkError("This runtime has no fetch implementation.");
+  }
+  url(path, query) {
+    const suffix = path.startsWith("/") ? path : `/${path}`;
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(query || {})) {
+      if (value == null || value === "") continue;
+      params.set(key, String(value));
+    }
+    const qs = params.toString();
+    return `${this.baseUrl}${suffix}${qs ? `?${qs}` : ""}`;
+  }
+  init(request) {
+    const headers = { accept: "application/json" };
+    const authorization = bearer(this.apiKey);
+    if (authorization) headers.authorization = authorization;
+    const method = request.method.toUpperCase();
+    if (method === "POST" || method === "PUT" || method === "PATCH") {
+      headers["idempotency-key"] = request.idempotencyKey || newIdempotencyKey();
+    }
+    if (request.form) {
+      return { method, headers, body: request.form };
+    }
+    if (request.body !== void 0) {
+      headers["content-type"] = "application/json";
+      return { method, headers, body: JSON.stringify(request.body) };
+    }
+    return { method, headers };
+  }
+  async read(response, request) {
+    const text = await response.text();
+    let payload = null;
+    if (text) {
+      try {
+        payload = JSON.parse(text);
+      } catch {
+        payload = null;
+      }
+    }
+    if (response.status >= 200 && response.status < 300) {
+      try {
+        return request.schema.parse(payload ?? {});
+      } catch (err) {
+        if (err instanceof z.ZodError) {
+          throw new ValidationError(
+            "The server response did not match the expected shape.",
+            { issues: err.issues.map((issue) => issue.path.join(".")) }
+          );
+        }
+        throw err;
+      }
+    }
+    const code = String(payload?.error || "");
+    const details = { status: response.status, error: code || void 0 };
+    if (response.status === 401 || code === "invalid_signature") {
+      throw new AuthenticationError("The API key was not accepted.");
+    }
+    if (response.status === 429) {
+      const retryAfter = response.headers.get("retry-after");
+      throw new RateLimitError(
+        "The request was rate limited.",
+        retryAfter && /^\d+$/.test(retryAfter) ? Number(retryAfter) : void 0
+      );
+    }
+    if (CONSENT_CODES.has(code)) {
+      const message = code === "consent_revoked" ? "This consent was revoked." : code === "consent_expired" ? "This consent has expired." : "A live consent is required before this package can be read.";
+      throw new ConsentRequiredError(message, details);
+    }
+    if (code === "invalid_transition") {
+      throw new InvalidTransitionError(
+        "That outcome is not available.",
+        details
+      );
+    }
+    if (request.featureGated && (response.status === 404 || response.status === 403 && (code === "not_found" || code === "feature_disabled"))) {
+      throw new FeatureDisabledError(
+        "This feature is off for this workspace.",
+        details
+      );
+    }
+    if (response.status === 404) {
+      throw new NotFoundError("The record was not found.");
+    }
+    if (response.status === 403) {
+      throw new SecureLendError(
+        "This action is not available for this session.",
+        "forbidden",
+        details
+      );
+    }
+    if (response.status >= 500) {
+      throw new ServerError("The server could not complete the request.");
+    }
+    throw new ValidationError(validationMessage(code), details);
+  }
+};
+
+// src/contract.ts
+var PLATFORM_ROUTES = {
+  createLead: "/v1/placement/enquiries",
+  listLeads: "/v1/leads",
+  uploadLeadDocument: "/v1/placement/enquiries/:id/documents",
+  compare: "/v1/placement/compare",
+  lenderMcp: "/v1/lender/mcp",
+  consents: "/v1/share-consents",
+  revokeConsent: "/v1/share-consents/:id/revoke",
+  receipts: "/v1/share-receipts",
+  outcomes: "/v1/leads/:id/outcomes",
+  creditBox: "/v1/credit-box",
+  pauseCreditBox: "/v1/credit-box/pause",
+  resumeCreditBox: "/v1/credit-box/resume",
+  feedback: "/v1/feedback",
+  caseFeedback: "/v1/cases/:id/feedback",
+  liquidity: "/v1/marketplace/liquidity"
+};
+function routeWithId(template, id) {
+  return template.replace(":id", encodeURIComponent(id));
+}
+
+// src/resources/leads.ts
+var Leads = class {
+  constructor(rest) {
+    this.rest = rest;
+  }
+  async create(input, options = {}) {
+    return this.rest.send({
+      method: "POST",
+      path: PLATFORM_ROUTES.createLead,
+      body: input,
+      schema: leadSchema,
+      idempotencyKey: options.idempotencyKey
+    });
+  }
+  async list(filter = {}) {
+    const page = await this.rest.send({
+      method: "GET",
+      path: PLATFORM_ROUTES.listLeads,
+      query: { status: filter.status || "pending" },
+      schema: leadListSchema
+    });
+    return page.items;
+  }
+  /** Lender view. A lead outside this workspace is not found. */
+  async get(id) {
+    const wanted = String(id || "").trim();
+    if (!wanted) throw new ValidationError("A lead id is required.");
+    const items = await this.list({ status: "all" });
+    const lead = items.find((row) => row.id === wanted);
+    if (!lead) throw new NotFoundError("The record was not found.");
+    return leadSchema.parse(lead);
+  }
+  /**
+   * One HTTP request per file. The platform route stores a single file.
+   */
+  async uploadDocuments(enquiryId, files, options = {}) {
+    const id = String(enquiryId || "").trim();
+    if (!id) throw new ValidationError("A lead id is required.");
+    if (!files?.length) throw new ValidationError("A file is required.");
+    const saved = [];
+    for (const file of files) {
+      if (!file?.bytes?.byteLength) {
+        throw new ValidationError("A file is required.");
+      }
+      const form = new FormData();
+      const copy = new ArrayBuffer(file.bytes.byteLength);
+      new Uint8Array(copy).set(file.bytes);
+      const blob = new Blob([copy], { type: file.mime || "application/pdf" });
+      form.append("file", blob, file.filename || "upload.pdf");
+      if (file.documentType) form.append("documentType", file.documentType);
+      saved.push(
+        await this.rest.send({
+          method: "POST",
+          path: routeWithId(PLATFORM_ROUTES.uploadLeadDocument, id),
+          form,
+          schema: uploadResultSchema,
+          idempotencyKey: options.idempotencyKey
+        })
+      );
+    }
+    return saved;
+  }
+};
+var compareSchema = z.object({
+  metadata: z.object({
+    generationId: z.string().optional(),
+    match: z.array(z.record(z.unknown())).optional()
+  }).passthrough().optional()
+}).passthrough();
+var COMPARE_LOAN_PRODUCTS = /* @__PURE__ */ new Set([
+  "personal_loans",
+  "business_loans",
+  "personal_mortgages",
+  "business_mortgages",
+  "car_loans",
+  "student_loans"
+]);
+var COMPARE_STATIC_PRODUCTS = /* @__PURE__ */ new Set([
+  "personal_credit_cards",
+  "business_credit_cards",
+  "personal_banking",
+  "business_banking",
+  "savings_accounts"
+]);
+function compareProductKey(value) {
+  const raw = String(value || "").trim().toLowerCase().replace(/^compare_/, "").replace(/[\s-]+/g, "_");
+  if (!raw) return null;
+  if (COMPARE_LOAN_PRODUCTS.has(raw) || COMPARE_STATIC_PRODUCTS.has(raw)) {
+    return raw;
+  }
+  if (raw === "personal_loan" || raw === "installment_loan") {
+    return "personal_loans";
+  }
+  return null;
+}
+function numberOrNull(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function stringOrNull(value) {
+  return typeof value === "string" && value ? value : null;
+}
+var Matches = class {
+  constructor(rest) {
+    this.rest = rest;
+  }
+  /**
+   * Runs a match for this lead. generationId is set when outcome matching is on.
+   * With the flag off, the lead's own lenders are returned and the ranking is unchanged.
+   */
+  async list(leadId) {
+    const id = String(leadId || "").trim();
+    if (!id) throw new ValidationError("A lead id is required.");
+    const page = await this.rest.send({
+      method: "GET",
+      path: PLATFORM_ROUTES.listLeads,
+      query: { status: "all" },
+      schema: leadListSchema
+    });
+    const lead = page.items.find((row) => row.id === id);
+    if (!lead) throw new NotFoundError("The record was not found.");
+    const product = compareProductKey(lead.productType);
+    const amount = numberOrNull(lead.amount);
+    const needsAmount = product != null && COMPARE_LOAN_PRODUCTS.has(product);
+    if (!product || needsAmount && !(amount != null && amount > 0)) {
+      return matchListSchema.parse({
+        leadId: id,
+        generationId: null,
+        lenders: (lead.lenders || []).map((lender) => ({
+          lenderId: lender.id ?? null,
+          score: null,
+          generationId: null,
+          components: null
+        }))
+      });
+    }
+    const compared = await this.rest.send({
+      method: "POST",
+      path: PLATFORM_ROUTES.compare,
+      body: {
+        productType: product,
+        ...amount != null && amount > 0 ? { loanAmount: amount, amount } : {}
+      },
+      schema: compareSchema
+    });
+    const generationId = compared.metadata?.generationId ?? null;
+    const rows = compared.metadata?.match;
+    const lenders = Array.isArray(rows) ? rows.map((row) => ({
+      lenderId: stringOrNull(row.lenderId),
+      score: numberOrNull(row.score),
+      generationId,
+      components: matchComponentsSchema.parse({
+        rules: numberOrNull(row.rules),
+        fit: numberOrNull(row.fit),
+        outcome: numberOrNull(row.outcome),
+        sba: numberOrNull(row.sba),
+        samples: numberOrNull(row.samples)
+      })
+    })) : (lead.lenders || []).map((lender) => ({
+      lenderId: lender.id ?? null,
+      score: null,
+      generationId: null,
+      components: null
+    }));
+    return matchListSchema.parse({ leadId: id, generationId, lenders });
+  }
+};
+var rpcSchema = z.object({
+  result: z.object({
+    structuredContent: z.unknown().optional(),
+    content: z.array(
+      z.object({
+        type: z.string(),
+        text: z.string().optional()
+      }).passthrough()
+    ).optional(),
+    isError: z.boolean().optional()
+  }).passthrough().optional(),
+  error: z.object({
+    message: z.string().optional()
+  }).passthrough().optional()
+}).passthrough();
+function payloadOf(rpc) {
+  const structured = rpc.result?.structuredContent;
+  if (structured && typeof structured === "object" && !Array.isArray(structured)) {
+    return structured;
+  }
+  const text = rpc.result?.content?.find((item) => item.type === "text")?.text;
+  if (text) {
+    try {
+      const parsed = JSON.parse(text);
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        return parsed;
+      }
+    } catch {
+      throw new ValidationError(
+        "The package response did not include a result."
+      );
+    }
+  }
+  throw new ValidationError("The package response did not include a result.");
+}
+function raiseToolError(payload) {
+  const code = typeof payload.error === "string" ? payload.error : "";
+  if (!code) return;
+  if (code === "consent_required" || code === "consent_revoked" || code === "consent_expired") {
+    throw new ConsentRequiredError(
+      code === "consent_revoked" ? "This consent was revoked." : "A live consent is required before this package can be read.",
+      { error: code }
+    );
+  }
+  if (code === "not_found")
+    throw new NotFoundError("The record was not found.");
+  if (code === "sign_in_required") {
+    throw new AuthenticationError("The API key was not accepted.");
+  }
+  throw new SecureLendError("The package request failed.", code, {
+    error: code
+  });
+}
+var Packages = class {
+  constructor(rest) {
+    this.rest = rest;
+  }
+  async start(input) {
+    if (!input?.borrower || input.amount == null || !input.currency || !input.security) {
+      throw new ValidationError(
+        "A package needs a borrower, amount, currency, and security."
+      );
+    }
+    return this.call("start_underwriting_package", { ...input });
+  }
+  async read(id, options = {}) {
+    const packageId = String(id || "").trim();
+    if (!packageId) throw new ValidationError("A package id is required.");
+    const args = { caseId: packageId, packageId };
+    if (options.version != null) args.packageVersion = options.version;
+    return this.call("read_package", args);
+  }
+  async call(name, args) {
+    const rpc = await this.rest.send({
+      method: "POST",
+      path: PLATFORM_ROUTES.lenderMcp,
+      body: {
+        jsonrpc: "2.0",
+        id: 1,
+        method: "tools/call",
+        params: { name, arguments: args }
+      },
+      schema: rpcSchema
+    });
+    if (rpc.error) {
+      throw new SecureLendError("The package request failed.", "mcp_error", {
+        message: rpc.error.message
+      });
+    }
+    const payload = payloadOf(rpc);
+    raiseToolError(payload);
+    return packageSchema.parse(payload);
+  }
+};
+var consentListSchema = z.object({ items: z.array(shareConsentSchema) }).passthrough();
+var receiptListSchema = z.object({ items: z.array(shareReceiptSchema) }).passthrough();
+var Consents = class {
+  constructor(rest) {
+    this.rest = rest;
+  }
+  /**
+   * One consent row per lender id. The live route stores a row only when the
+   * lender id is the session tenant. Omit lenderIds to use that default.
+   */
+  async create(input, options = {}) {
+    const leadId = String(input?.leadId || "").trim();
+    const packageId = String(input?.packageId || "").trim();
+    const borrowerRef = String(input?.borrowerRef || "").trim();
+    if (!leadId || !packageId) {
+      throw new ValidationError("A consent needs a lead and a package.");
+    }
+    if (!Number.isInteger(input.packageVersion) || input.packageVersion < 1) {
+      throw new ValidationError("A consent needs a package version.");
+    }
+    if (!input.expiresAt)
+      throw new ValidationError("A consent needs an expiry.");
+    if (!borrowerRef)
+      throw new ValidationError("A borrower reference is required.");
+    if (borrowerRef.includes("@")) {
+      throw new ValidationError(
+        "Use a reference you choose. Do not type an email or an account number."
+      );
+    }
+    const scope = input.scope?.length ? input.scope : ["summary"];
+    if (scope.some(
+      (item) => !SHARE_SCOPES.includes(item)
+    )) {
+      throw new ValidationError(
+        "Scope must be summary, memo, checks, or documents."
+      );
+    }
+    const lenderIds = input.lenderIds?.length ? input.lenderIds : [void 0];
+    const saved = [];
+    for (const lenderId of lenderIds) {
+      const body = {
+        leadId,
+        packageId,
+        packageVersion: input.packageVersion,
+        scope,
+        expiresAt: input.expiresAt,
+        borrowerRef
+      };
+      if (lenderId) body.lenderId = lenderId;
+      saved.push(
+        await this.rest.send({
+          method: "POST",
+          path: PLATFORM_ROUTES.consents,
+          body,
+          schema: shareConsentSchema,
+          featureGated: true,
+          idempotencyKey: options.idempotencyKey
+        })
+      );
+    }
+    return saved;
+  }
+  async list(leadId) {
+    const page = await this.rest.send({
+      method: "GET",
+      path: PLATFORM_ROUTES.consents,
+      schema: consentListSchema,
+      featureGated: true
+    });
+    if (!leadId) return page.items;
+    return page.items.filter((row) => row.leadId === leadId);
+  }
+  async revoke(id, options = {}) {
+    const consentId = String(id || "").trim();
+    if (!consentId) throw new ValidationError("A consent id is required.");
+    return this.rest.send({
+      method: "POST",
+      path: routeWithId(PLATFORM_ROUTES.revokeConsent, consentId),
+      body: {},
+      schema: shareConsentSchema,
+      featureGated: true,
+      idempotencyKey: options.idempotencyKey
+    });
+  }
+  async receipts(id) {
+    const page = await this.rest.send({
+      method: "GET",
+      path: PLATFORM_ROUTES.receipts,
+      schema: receiptListSchema,
+      featureGated: true
+    });
+    if (!id) return page.items;
+    return page.items.filter((row) => row.consentId === id);
+  }
+};
+function rawBytes(raw) {
+  return Buffer.isBuffer(raw) ? raw : Buffer.from(raw, "utf8");
+}
+function safeEqualHex(expected, presented) {
+  const left = Buffer.from(expected, "utf8");
+  const right = Buffer.from(presented, "utf8");
+  if (left.length !== right.length) return false;
+  return timingSafeEqual(left, right);
+}
+function signOutcomePayload(raw, secret) {
+  const digest = createHash("sha256").update(String(secret || ""), "utf8").update(".").update(rawBytes(raw)).digest("hex");
+  return `sha256=${digest}`;
+}
+function signWebhook(raw, secret, timestampSec = Math.floor(Date.now() / 1e3)) {
+  const mac = createHmac("sha256", String(secret || "")).update(`${timestampSec}.`).update(rawBytes(raw)).digest("hex");
+  return `t=${timestampSec},v1=${mac}`;
+}
+function readStamp(header) {
+  const match = header.match(/(?:^|,\s*)t=(\d+),v1=([a-fA-F0-9]+)/);
+  if (!match) return null;
+  return { t: Number(match[1]), mac: match[2].toLowerCase() };
+}
+function verifyWebhook(rawBody, signatureHeader, secret, options = {}) {
+  const header = String(signatureHeader || "").trim();
+  const key = String(secret || "");
+  if (!key || !header) {
+    throw new WebhookSignatureError("Webhook signature did not match.");
+  }
+  const stamp = readStamp(header);
+  if (stamp) {
+    const tolerance = options.toleranceSec ?? 300;
+    const nowSec = Math.floor((options.nowMs ?? Date.now()) / 1e3);
+    if (!Number.isFinite(stamp.t) || Math.abs(nowSec - stamp.t) > tolerance) {
+      throw new WebhookSignatureError(
+        "This webhook is outside the time window."
+      );
+    }
+    const expected2 = signWebhook(rawBody, key, stamp.t).split("v1=")[1] || "";
+    if (!safeEqualHex(expected2, stamp.mac)) {
+      throw new WebhookSignatureError("Webhook signature did not match.");
+    }
+    return true;
+  }
+  const presented = header.replace(/^sha256=/i, "").trim().toLowerCase();
+  const expected = signOutcomePayload(rawBody, key).replace(/^sha256=/, "");
+  if (!safeEqualHex(expected, presented)) {
+    throw new WebhookSignatureError("Webhook signature did not match.");
+  }
+  return true;
+}
+function parseEvent(input) {
+  try {
+    const event = secureLendEventSchema.parse(input);
+    return { ...event, data: event.data ?? {} };
+  } catch (err) {
+    if (err instanceof z.ZodError) {
+      throw new ValidationError(
+        "The webhook event did not match the expected shape.",
+        {
+          issues: err.issues.map((issue) => issue.path.join("."))
+        }
+      );
+    }
+    throw err;
+  }
+}
+
+// src/resources/outcomes.ts
+var outcomeListSchema = z.object({ items: z.array(leadOutcomeSchema) }).passthrough();
+var Outcomes = class {
+  constructor(rest) {
+    this.rest = rest;
+  }
+  /**
+   * Declined without a reason code, and funded without an amount and date,
+   * fail here and do not call the server.
+   */
+  async record(leadId, input, options = {}) {
+    const id = String(leadId || "").trim();
+    const state = String(input?.state || "").trim();
+    if (!id) throw new ValidationError("A lead id is required.");
+    if (!OUTCOME_STATES.includes(state)) {
+      throw new ValidationError("That outcome state is not recognized.");
+    }
+    const reasonCode = input.reasonCode ? String(input.reasonCode).trim() : "";
+    if (state === "declined") {
+      if (!DECLINE_REASON_CODES.includes(
+        reasonCode
+      )) {
+        throw new ValidationError("A decline needs a reason code.");
+      }
+      if (reasonCode === "other" && !String(input.reasonText || "").trim()) {
+        throw new ValidationError("A decline needs a reason code.");
+      }
+    }
+    if (state === "funded") {
+      const amount = Number(input.fundedAmount);
+      const date = String(input.fundedOn || "").trim();
+      if (!Number.isFinite(amount) || amount <= 0) {
+        throw new ValidationError("Funded needs an amount.");
+      }
+      if (!/^\d{4}-\d{2}-\d{2}$/.test(date)) {
+        throw new ValidationError("Funded needs a date as YYYY-MM-DD.");
+      }
+    }
+    const body = { state };
+    if (input.lenderId) body.lenderId = input.lenderId;
+    if (reasonCode) body.reasonCode = reasonCode;
+    if (input.reasonText) body.reasonText = input.reasonText;
+    if (state === "funded") {
+      body.fundedAmount = Number(input.fundedAmount);
+      body.fundedOn = String(input.fundedOn);
+    }
+    if (input.surface) body.surface = input.surface;
+    return this.rest.send({
+      method: "POST",
+      path: routeWithId(PLATFORM_ROUTES.outcomes, id),
+      body,
+      schema: leadOutcomeSchema,
+      featureGated: true,
+      idempotencyKey: options.idempotencyKey
+    });
+  }
+  async list(leadId) {
+    const id = String(leadId || "").trim();
+    if (!id) throw new ValidationError("A lead id is required.");
+    const page = await this.rest.send({
+      method: "GET",
+      path: routeWithId(PLATFORM_ROUTES.outcomes, id),
+      schema: outcomeListSchema,
+      featureGated: true
+    });
+    return page.items;
+  }
+  /** Header value for POST /v1/webhooks/lender-outcomes. */
+  signPayload(rawBody, secret) {
+    return signOutcomePayload(rawBody, secret);
+  }
+};
+
+// src/resources/creditBox.ts
+var CreditBoxClient = class {
+  constructor(rest) {
+    this.rest = rest;
+  }
+  async get() {
+    return this.rest.send({
+      method: "GET",
+      path: PLATFORM_ROUTES.creditBox,
+      schema: creditBoxViewSchema,
+      featureGated: true
+    });
+  }
+  async put(input, options = {}) {
+    const body = writeBody(input);
+    return this.rest.send({
+      method: "PUT",
+      path: PLATFORM_ROUTES.creditBox,
+      body,
+      schema: creditBoxSchema,
+      featureGated: true,
+      idempotencyKey: options.idempotencyKey
+    });
+  }
+  async pause(input = {}, options = {}) {
+    return this.rest.send({
+      method: "POST",
+      path: PLATFORM_ROUTES.pauseCreditBox,
+      body: input.until ? { until: input.until } : {},
+      schema: creditBoxSchema,
+      featureGated: true,
+      idempotencyKey: options.idempotencyKey
+    });
+  }
+  async resume(options = {}) {
+    return this.rest.send({
+      method: "POST",
+      path: PLATFORM_ROUTES.resumeCreditBox,
+      body: {},
+      schema: creditBoxSchema,
+      featureGated: true,
+      idempotencyKey: options.idempotencyKey
+    });
+  }
+};
+function writeBody(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    throw new ValidationError("A credit box needs criteria.");
+  }
+  if ("criteria" in input) {
+    const criteria = input.criteria;
+    if (!criteria || typeof criteria !== "object" || Array.isArray(criteria)) {
+      throw new ValidationError("A credit box needs criteria.");
+    }
+    return input;
+  }
+  return { criteria: input };
+}
+var feedbackListSchema = z.object({ items: z.array(feedbackEventSchema) }).passthrough();
+var Feedback = class {
+  constructor(rest) {
+    this.rest = rest;
+  }
+  async submit(event, options = {}) {
+    const type = String(event?.type || "").trim();
+    const kind = String(event?.target?.kind || "").trim();
+    const key = String(event?.target?.key || "").trim();
+    if (!FEEDBACK_TYPES.includes(type)) {
+      throw new ValidationError("That feedback type is not recognized.");
+    }
+    if (!FEEDBACK_TARGETS.includes(kind) || !key) {
+      throw new ValidationError("Feedback needs a target.");
+    }
+    if (type === "rating") {
+      const rating = Number(event.rating);
+      if (!Number.isInteger(rating) || rating < 1 || rating > 9) {
+        throw new ValidationError("A rating is a whole number from 1 to 9.");
+      }
+    }
+    return this.rest.send({
+      method: "POST",
+      path: PLATFORM_ROUTES.feedback,
+      body: {
+        type,
+        surface: event.surface || "api",
+        target: { kind, key },
+        ...event.rating != null ? { rating: event.rating } : {},
+        ...event.comment ? { comment: event.comment } : {},
+        ...event.generationId ? { generationId: event.generationId } : {},
+        ...event.caseId ? { caseId: event.caseId } : {},
+        ...event.before != null ? { before: event.before } : {},
+        ...event.after != null ? { after: event.after } : {}
+      },
+      schema: feedbackCreatedSchema,
+      featureGated: true,
+      idempotencyKey: options.idempotencyKey
+    });
+  }
+  async listForCase(caseId) {
+    const id = String(caseId || "").trim();
+    if (!id) throw new ValidationError("A case id is required.");
+    const page = await this.rest.send({
+      method: "GET",
+      path: routeWithId(PLATFORM_ROUTES.caseFeedback, id),
+      schema: feedbackListSchema,
+      featureGated: true
+    });
+    return page.items;
+  }
+};
+
+// src/resources/liquidity.ts
+var Liquidity = class {
+  constructor(rest) {
+    this.rest = rest;
+  }
+  async get(query = {}) {
+    return this.rest.send({
+      method: "GET",
+      path: PLATFORM_ROUTES.liquidity,
+      query: {
+        groupBy: query.groupBy || "product",
+        from: query.from,
+        to: query.to
+      },
+      schema: liquidityReportSchema,
+      featureGated: true
+    });
+  }
+};
 
 // src/client.ts
 var SecureLend = class {
@@ -710,8 +1754,28 @@ var SecureLend = class {
     }
     this.mcpClient = new MCPClient({ apiKey: config?.apiKey || "", mcpURL });
     this.mcp = this.mcpClient.mcp;
+    let apiBaseUrl = config?.apiBaseUrl || "https://securelend.ai";
+    if (typeof window !== "undefined" && apiBaseUrl.startsWith("/")) {
+      apiBaseUrl = window.location.origin + apiBaseUrl;
+    }
+    this.rest = new RestClient({
+      baseUrl: apiBaseUrl,
+      apiKey: config?.apiKey,
+      fetchImpl: config?.fetch
+    });
+    this.leads = new Leads(this.rest);
+    this.matches = new Matches(this.rest);
+    this.packages = new Packages(this.rest);
+    this.consents = new Consents(this.rest);
+    this.outcomes = new Outcomes(this.rest);
+    this.creditBox = new CreditBoxClient(this.rest);
+    this.feedback = new Feedback(this.rest);
+    this.liquidity = new Liquidity(this.rest);
+    this.webhooks = { verify: verifyWebhook, parseEvent, sign: signWebhook };
   }
   // --- Loan Comparison ---
+  // These methods call the comparison MCP (default https://mcp.securelend.ai/mcp).
+  // They are not sent to /v1/lender/mcp.
   async comparePersonalLoans(request) {
     return this.callTool(
       "compare_personal_loans",
@@ -877,6 +1941,7 @@ var SecureLend = class {
    */
   setApiKey(apiKey) {
     this.mcpClient.setApiKey(apiKey);
+    this.rest.setApiKey(apiKey);
   }
   // --- Private Helpers ---
   async callTool(toolName, request, schema) {
@@ -937,6 +2002,6 @@ var SecureLend = class {
   }
 };
 
-export { ApplicationStatus, ApplicationType, AuthenticationError, CreditTier, NetworkError, NotFoundError, ProductType, ProviderStatus, RateLimitError, SecureLend, SecureLendError, ServerError, ValidationError, anyOfferSchema, applicationProviderSchema, autoLoanSearchSchema, bankAccountOfferSchema, businessApplicantSchema, businessBankingComparisonResponseSchema, businessBankingOfferSchema, businessBankingSearchSchema, businessCreditCardComparisonResponseSchema, businessCreditCardOfferSchema, businessCreditCardSearchSchema, businessLoanSearchSchema, createBusinessApplicationSchema, createPersonalApplicationSchema, creditCardOfferSchema, displayOfferFormResponseSchema, displayOfferFormSchema, displayUploadDocumentsFormResponseSchema, displayUploadDocumentsFormSchema, documentTypeEnum, getMultipleOffersSchema, getOfferSchema, leaseVsPurchaseResponseSchema, leaseVsPurchaseSchema, loanComparisonResponseSchema, loanOfferSchema, loanPaymentResponseSchema, loanPaymentSchema, mortgagePaymentResponseSchema, mortgagePaymentSchema, mortgageSearchSchema, personalApplicantSchema, personalApplicationSchema, personalBankingComparisonResponseSchema, personalBankingOfferSchema, personalBankingSearchSchema, personalCreditCardComparisonResponseSchema, personalCreditCardOfferSchema, personalCreditCardSearchSchema, personalLoanSearchSchema, savingsComparisonResponseSchema, savingsOfferSchema, savingsSearchSchema, studentLoanSearchSchema, submitDocumentsResponseSchema, submitDocumentsSchema, trackOfferStatusResponseSchema, trackOfferStatusSchema };
+export { ApplicationStatus, ApplicationType, AuthenticationError, ConsentRequiredError, CreditTier, DECLINE_REASON_CODES, EVENT_TYPES, FEEDBACK_TARGETS, FEEDBACK_TYPES, FeatureDisabledError, InvalidTransitionError, NetworkError, NotFoundError, OUTCOME_STATES, ProductType, ProviderStatus, RateLimitError, SHARE_SCOPES, SecureLend, SecureLendError, ServerError, ValidationError, WebhookSignatureError, anyOfferSchema, applicationProviderSchema, autoLoanSearchSchema, bankAccountOfferSchema, businessApplicantSchema, businessBankingComparisonResponseSchema, businessBankingOfferSchema, businessBankingSearchSchema, businessCreditCardComparisonResponseSchema, businessCreditCardOfferSchema, businessCreditCardSearchSchema, businessLoanSearchSchema, createBusinessApplicationSchema, createPersonalApplicationSchema, creditBoxSchema, creditBoxViewSchema, creditCardOfferSchema, displayOfferFormResponseSchema, displayOfferFormSchema, displayUploadDocumentsFormResponseSchema, displayUploadDocumentsFormSchema, documentTypeEnum, feedbackCreatedSchema, feedbackEventSchema, getMultipleOffersSchema, getOfferSchema, leadListSchema, leadOutcomeSchema, leadSchema, leaseVsPurchaseResponseSchema, leaseVsPurchaseSchema, lenderMatchSchema, liquidityCellSchema, liquidityReportSchema, loanComparisonResponseSchema, loanOfferSchema, loanPaymentResponseSchema, loanPaymentSchema, matchComponentsSchema, matchListSchema, mortgagePaymentResponseSchema, mortgagePaymentSchema, mortgageSearchSchema, packageSchema, parseEvent, personalApplicantSchema, personalApplicationSchema, personalBankingComparisonResponseSchema, personalBankingOfferSchema, personalBankingSearchSchema, personalCreditCardComparisonResponseSchema, personalCreditCardOfferSchema, personalCreditCardSearchSchema, personalLoanSearchSchema, savingsComparisonResponseSchema, savingsOfferSchema, savingsSearchSchema, secureLendEventSchema, shareConsentSchema, shareReceiptSchema, signOutcomePayload, signWebhook, studentLoanSearchSchema, submitDocumentsResponseSchema, submitDocumentsSchema, trackOfferStatusResponseSchema, trackOfferStatusSchema, uploadResultSchema, verifyWebhook };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map