@sekyro/node 0.1.0-rc.2 → 0.1.0-rc.3

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @sekyro/node
 
+## 0.1.0-rc.3
+
+### Patch Changes
+
+- 4e7a4a3: Brand: the product is now **Sekyro AI** — package descriptions, READMEs, LICENSE text and the `@sekyro/node` configuration error messages say "Sekyro AI". No API change: package names, the `Sekyro` class, exports and header names are unchanged.
+- c3699fd: Type the end user's `network` (approximate location, operator, VPN/Tor/hosting flags, start IP) and `device` (platform, OS, browser, per-org device keys, signals) on `sessions.get()`, and the same context (without the IP) on `session.completed` / `session.failed` webhook data.
+- 1b6bef2: Profile v2 policy reasons, round 2. New eligibility reason `age_unverifiable` (the app sets a minimum age but the birth date could not be read — `doc_ocr`: retryable with a clearer photo; `population_registry`: final). `failureReason` is widened to every policy reason a session can end on: the session-level reasons plus `nationality_not_allowed`, `underage`, `document_type_not_accepted`, `document_nni_mismatch` and `age_unverifiable`. `@sekyro/web`: `PolicyFailureReason` widened, `age_unverifiable` in `DocReason` / `PopulationReason` / `RETRYABLE_REASONS`. `@sekyro/react`: ar/fr/en copy for `age_unverifiable`. `@sekyro/node`: `EligibilityReason` gains `age_unverifiable`; new `PolicyFailureReason` type used by `Session.failureReason` and the `session.failed` webhook data.
+- 1b6bef2: Profile v2 policy reasons. `@sekyro/web`: the eligibility check reasons `document_type_not_accepted` (retryable), `nationality_not_allowed` and `underage`; `SessionFailureReason` (`location_not_allowed`, `anonymizer_blocked`); `HostedSessionView.failureReason` and `acceptedDocumentTypes`. `@sekyro/react`: ar/fr/en copy for the five reasons. `@sekyro/node`: `SessionFailureReason`, `EligibilityReason`, and `failureReason` on `Session` and the `session.failed` webhook data.
+- 13d512f: Profile v2 step 3: identity-method choice, document-NNI registry submit, matching reasons, `subject` input. `@sekyro/web`: `IdentityMethod`, `MethodChoiceView` and `HostedSessionView.methodChoice`; `HostedStepView.attemptsExhausted` / `nniFromDocument` (and `SessionStepView.attemptsExhausted`); `HostedClient.selectMethod()` (`POST /hosted/method`); error codes `method_required` / `method_locked` / `document_nni_mismatch` (409 when a typed NNI differs from the document's); matching reasons `name_mismatch`, `birth_date_mismatch`, `nationality_mismatch` (doc_ocr + population_registry) and `document_number_mismatch` (doc_ocr) as `MatchReason`. The headless runner stops on a pending choice (`unavailable` / `method_required`, `on('method')`), adds `verification.methodChoice()` / `selectMethod()`, and submits the registry with an empty input when the document gave the NNI. `@sekyro/react`: ar/fr/en copy for the four reasons and the method screen; `<LivenessCapture>` handles the method step while the session waits on the choice: it offers only the methods it can run (the national number — it has no document capture) and selects it without a screen when it is the only one left. `@sekyro/node`: `CreateSessionInput.subject` (`SessionSubjectInput`), `CreateSessionInput.identityMethod` and `sessions.selectMethod(id, method)` (`POST /sessions/:id/method`, `IdentityMethod`) so partners can choose the identity method of an optional-document session, `subjectId` / `externalRef` / `subjectConflict` on `Session` and session webhooks, `SessionStep.attemptsExhausted`, `MatchReason`, and the `subject.updated` webhook data (`{ subjectId, sessionId, status, outcome }`).
+- acbf409: Profile v2 step 4: decision mode, desktop handoff, device stops, per-session profile overrides. `@sekyro/web`: decision-mode reasons `liveness_inconclusive`, `mobile_required`, `match_inconclusive`, `document_authenticity` (`DecisionReason`; the inconclusive three are retryable) and the registered `uncalibrated_capture_channel`; session failure reasons `capture_tampered`, `device_velocity_exceeded`, `device_cooldown`; `HostedStepView.requiresMobile` and `HostedSessionView.retryAfter`; the error code `inference_unavailable` (503, request-level, with `retryAfterSeconds` from `Retry-After` or the body). The headless runner retries `inference_unavailable` up to 3 times after `retryAfterSeconds` (default 10 s) under a fresh idempotency key and a fresh attestation, emitting `on('busy')` for each retry, then surfaces `unavailable / inference_unavailable`; it never captures a `requiresMobile` liveness step on desktop (`unavailable / mobile_required`, nothing uploaded) and adds `verification.mobileRequired()`; a `device_cooldown` result carries `retryAfter`. `@sekyro/react`: ar/fr/en coaching for the inconclusive reasons, "Continue on your phone" instead of the camera when liveness needs a phone, a "busy, trying again" notice, the device stop copy (the cooldown says when to try again — `retryAfterTime()`), no retry button for stops or `mobile_required`; bundle budget 23 → 24 KiB. `@sekyro/node`: `CreateSessionInput.profile` (`EkycProfileOverride`, a deep-partial of `EkycProfileSettings`; unknown keys are rejected server-side, widening answers `403 override_widens_profile` unless the app allows it), `Session.overriddenFields` / `riskSignals` / `retryAfter` (`overriddenFields` and `riskSignals` also on the session lifecycle webhooks), `DecisionReason`, the three device stops in `SessionFailureReason`, and the `subject.suspicious_activity` webhook data (`{ subjectId, sessionId, count }`).
+- 58e220c: Published bundles are now minified and no longer include source maps. The public API and types are unchanged.
+
 ## 0.1.0-rc.2
 
 ### Minor Changes

package/LICENSE

@@ -1,10 +1,10 @@
-Sekyro SDK — Proprietary License
+Sekyro AI SDK — Proprietary License
 
 Copyright (c) 2026 Ibtikar Technologies. All rights reserved.
 
 This software (the "SDK") is proprietary to Ibtikar Technologies. Use is
-permitted only under a Sekyro customer agreement with Ibtikar Technologies, and
-only to integrate the customer's own applications with the Sekyro
+permitted only under a Sekyro AI customer agreement with Ibtikar Technologies, and
+only to integrate the customer's own applications with the Sekyro AI
 identity-verification service. For that purpose you may install the SDK
 from the public npm registry and run it unmodified.
 

package/README.md

@@ -1,6 +1,6 @@
 # @sekyro/node
 
-Server SDK for [Sekyro](https://sekyro.ai) identity verification. Zero runtime
+Server SDK for [Sekyro AI](https://sekyro.ai) identity verification. Zero runtime
 dependencies, Node.js ≥ 20, ESM + CommonJS, typed.
 
 Two jobs, nothing else:
@@ -59,7 +59,7 @@ session.steps;   // [{ checkType, state, reason?, calibratedScore? }]
 ```
 
 There is no recipe argument. Your API key belongs to an **app**, and the app's
-eKYC profile (set in the Sekyro dashboard) decides which checks run. Every
+eKYC profile (set in the Sekyro AI dashboard) decides which checks run. Every
 field is optional:
 
 | field | meaning |
@@ -138,7 +138,7 @@ app.post("/webhooks/sekyro", express.raw({ type: "application/json" }), (req, re
 ```
 
 - The header is `t=<unix seconds>,v1=<hex>[,v1=<hex>]`. During a secret
-  rotation Sekyro signs with both the current and the previous secret, so the
+  rotation Sekyro AI signs with both the current and the previous secret, so the
   delivery is accepted when **any** `v1` matches the secret you hold.
 - **Header names.** Deliveries carry the signature in `x-sekyro-signature`
   (`SEKYRO_SIGNATURE_HEADER`) and, for the transition, the identical legacy

package/dist/index.cjs

@@ -1,308 +1 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/index.ts
-var src_exports = {};
-__export(src_exports, {
-  DEFAULT_BASE_URL: () => DEFAULT_BASE_URL,
-  DEFAULT_TIMEOUT_MS: () => DEFAULT_TIMEOUT_MS,
-  LEGACY_SIGNATURE_HEADER: () => LEGACY_SIGNATURE_HEADER,
-  SEKYRO_SIGNATURE_HEADER: () => SEKYRO_SIGNATURE_HEADER,
-  Sekyro: () => Sekyro,
-  SekyroApiError: () => SekyroApiError,
-  SekyroConfigError: () => SekyroConfigError,
-  SekyroWebhookError: () => SekyroWebhookError,
-  signatureFromHeaders: () => signatureFromHeaders,
-  verifyWebhook: () => verifyWebhook
-});
-module.exports = __toCommonJS(src_exports);
-
-// src/errors.ts
-var WEBHOOK_MESSAGES = {
-  invalid_signature: "No v1 signature in the header matches this body and secret",
-  stale: "Delivery timestamp is outside the tolerance window",
-  malformed: "Signature header or body is not in the expected format"
-};
-var SekyroWebhookError = class extends Error {
-  name = "SekyroWebhookError";
-  code;
-  constructor(code, message = WEBHOOK_MESSAGES[code]) {
-    super(message);
-    this.code = code;
-  }
-};
-var CONFIG_MESSAGES = {
-  missing_api_key: "Sekyro: `apiKey` is required",
-  invalid_base_url: "Sekyro: `baseUrl` must be an https: URL (http: is allowed only for localhost, 127.0.0.1 or [::1])"
-};
-var SekyroConfigError = class extends TypeError {
-  name = "SekyroConfigError";
-  code;
-  constructor(code, message = CONFIG_MESSAGES[code]) {
-    super(message);
-    this.code = code;
-  }
-};
-var SekyroApiError = class extends Error {
-  name = "SekyroApiError";
-  status;
-  code;
-  requestId;
-  retryable;
-  constructor(init) {
-    super(init.message, init.cause === void 0 ? void 0 : { cause: init.cause });
-    this.status = init.status;
-    this.code = init.code;
-    this.requestId = init.requestId;
-    this.retryable = isRetryable(init.status, init.code);
-  }
-};
-function isRetryable(status, code) {
-  if (code === "network" || code === "timeout") return true;
-  if (code === "idempotency_in_progress") return true;
-  if (status === 429) return true;
-  return status >= 500 && status <= 599;
-}
-
-// src/version.ts
-var SDK_VERSION = true ? "0.1.0-rc.2" : "0.0.0-dev";
-
-// src/client.ts
-var USER_AGENT = `@sekyro/node/${SDK_VERSION}`;
-var DEFAULT_BASE_URL = "https://api.sekyro.ai/api/v2";
-var DEFAULT_TIMEOUT_MS = 3e4;
-function isSuccessEnvelope(value) {
-  return typeof value === "object" && value !== null && value.success === true && "data" in value;
-}
-function isErrorEnvelope(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const v = value;
-  if (v.status !== "error" || typeof v.error !== "object" || v.error === null) return false;
-  const e = v.error;
-  return typeof e.code === "string" && typeof e.message === "string";
-}
-function isAbortLike(err) {
-  if (typeof err !== "object" || err === null) return false;
-  const name = err.name;
-  return name === "TimeoutError" || name === "AbortError";
-}
-var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
-function assertSafeBaseUrl(baseUrl) {
-  let url;
-  try {
-    url = new URL(baseUrl);
-  } catch {
-    throw new SekyroConfigError("invalid_base_url");
-  }
-  if (url.protocol === "https:") return;
-  if (url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname)) return;
-  throw new SekyroConfigError("invalid_base_url");
-}
-var Transport = class {
-  apiKey;
-  baseUrl;
-  timeoutMs;
-  fetchImpl;
-  constructor(opts) {
-    const baseUrl = (opts.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
-    assertSafeBaseUrl(baseUrl);
-    this.apiKey = opts.apiKey;
-    this.baseUrl = baseUrl;
-    this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-    this.fetchImpl = opts.fetch ?? globalThis.fetch;
-  }
-  async call(method, path, body, idempotencyKey) {
-    const headers = {
-      authorization: `Bearer ${this.apiKey}`,
-      accept: "application/json",
-      "user-agent": USER_AGENT
-    };
-    if (body !== void 0) headers["content-type"] = "application/json";
-    if (idempotencyKey !== void 0) headers["x-idempotency-key"] = idempotencyKey;
-    const init = {
-      method,
-      headers,
-      signal: AbortSignal.timeout(this.timeoutMs)
-    };
-    if (body !== void 0) init.body = JSON.stringify(body);
-    let res;
-    try {
-      res = await this.fetchImpl(`${this.baseUrl}${path}`, init);
-    } catch (err) {
-      if (isAbortLike(err)) {
-        throw new SekyroApiError({
-          status: 0,
-          code: "timeout",
-          message: `Request timed out after ${this.timeoutMs}ms`,
-          cause: err
-        });
-      }
-      throw new SekyroApiError({
-        status: 0,
-        code: "network",
-        message: `Network error: ${err instanceof Error ? err.message : String(err)}`,
-        cause: err
-      });
-    }
-    const text = await res.text();
-    let parsed;
-    let parseError;
-    try {
-      parsed = text.length > 0 ? JSON.parse(text) : void 0;
-    } catch (err) {
-      parseError = err;
-    }
-    if (!res.ok) {
-      if (isErrorEnvelope(parsed)) {
-        const init2 = {
-          status: res.status,
-          code: parsed.error.code,
-          message: parsed.error.message
-        };
-        if (parsed.error.request_id !== void 0) init2.requestId = parsed.error.request_id;
-        throw new SekyroApiError(init2);
-      }
-      throw new SekyroApiError({
-        status: res.status,
-        code: "http_error",
-        message: `HTTP ${res.status}${res.statusText ? ` ${res.statusText}` : ""}`
-      });
-    }
-    if (!isSuccessEnvelope(parsed)) {
-      throw new SekyroApiError({
-        status: res.status,
-        code: "malformed_response",
-        message: "Response is not a `{ success: true, data }` envelope",
-        cause: parseError
-      });
-    }
-    return parsed.data;
-  }
-};
-var SessionsApi = class {
-  /**
-   * Constructed by {@link Sekyro}; the transport is kept out of the public
-   * surface on purpose (only its bound `call` crosses this boundary).
-   * @internal
-   */
-  constructor(call) {
-    this.call = call;
-  }
-  call;
-  /**
-   * `POST /sessions`. Returns the one-time `clientToken` — hand it to the
-   * browser, never persist it. Pass an `idempotencyKey` so a retried call
-   * cannot create a second session.
-   */
-  async create(input = {}, opts = {}) {
-    const wire = await this.call("POST", "/sessions", input, opts.idempotencyKey);
-    return {
-      id: wire.id,
-      status: wire.status,
-      clientToken: wire.client_token,
-      hostedUrl: wire.hosted_url,
-      steps: wire.steps,
-      expiresAt: wire.expiresAt
-    };
-  }
-  /** `GET /sessions/:id` — the whitelisted view (no client token). */
-  async get(id) {
-    if (typeof id !== "string" || id.length === 0) {
-      throw new TypeError("sessions.get: `id` must be a non-empty string");
-    }
-    return this.call("GET", `/sessions/${encodeURIComponent(id)}`);
-  }
-};
-var Sekyro = class {
-  sessions;
-  constructor(opts) {
-    if (typeof opts?.apiKey !== "string" || opts.apiKey.length === 0) {
-      throw new SekyroConfigError("missing_api_key");
-    }
-    const transport = new Transport(opts);
-    this.sessions = new SessionsApi(transport.call.bind(transport));
-  }
-};
-
-// src/webhooks.ts
-var import_node_crypto = require("crypto");
-var SEKYRO_SIGNATURE_HEADER = "x-sekyro-signature";
-var LEGACY_SIGNATURE_HEADER = "x-ibtikar-signature";
-function signatureFromHeaders(headers) {
-  return readHeader(headers, SEKYRO_SIGNATURE_HEADER) ?? readHeader(headers, LEGACY_SIGNATURE_HEADER);
-}
-function readHeader(headers, name) {
-  if (typeof headers.get === "function") {
-    const v2 = headers.get(name);
-    return v2 === null || v2 === "" ? void 0 : v2;
-  }
-  const record = headers;
-  const key = Object.keys(record).find((k) => k.toLowerCase() === name);
-  if (key === void 0) return void 0;
-  const raw = record[key];
-  const v = Array.isArray(raw) ? raw[0] : raw;
-  return v === void 0 || v === "" ? void 0 : v;
-}
-var HEX64 = /^[0-9a-f]{64}$/i;
-function verifyWebhook(rawBody, header, secret, opts = {}) {
-  if (!header || !secret) throw new SekyroWebhookError("invalid_signature");
-  const parts = header.split(",").map((part) => {
-    const trimmed = part.trim();
-    const eq = trimmed.indexOf("=");
-    return eq === -1 ? [trimmed, ""] : [trimmed.slice(0, eq).trim(), trimmed.slice(eq + 1).trim()];
-  });
-  const tRaw = parts.find(([k]) => k === "t")?.[1];
-  const t = tRaw !== void 0 && /^\d+$/.test(tRaw) ? Number(tRaw) : Number.NaN;
-  const sigs = parts.filter(([k]) => k === "v1").map(([, v]) => v);
-  if (!Number.isSafeInteger(t) || sigs.length === 0) throw new SekyroWebhookError("malformed");
-  const nowSec = Math.floor((opts.now?.() ?? Date.now()) / 1e3);
-  const tolerance = opts.toleranceSec ?? 300;
-  if (Math.abs(nowSec - t) > tolerance) throw new SekyroWebhookError("stale");
-  const expected = (0, import_node_crypto.createHmac)("sha256", secret).update(`${t}.${rawBody}`).digest();
-  const ok = sigs.some((hex) => {
-    if (!HEX64.test(hex)) return false;
-    const got = Buffer.from(hex, "hex");
-    return got.length === expected.length && (0, import_node_crypto.timingSafeEqual)(got, expected);
-  });
-  if (!ok) throw new SekyroWebhookError("invalid_signature");
-  let parsed;
-  try {
-    parsed = JSON.parse(rawBody);
-  } catch {
-    throw new SekyroWebhookError("malformed", "Signed body is not valid JSON");
-  }
-  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new SekyroWebhookError("malformed", "Signed body is not a JSON object");
-  }
-  return parsed;
-}
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  DEFAULT_BASE_URL,
-  DEFAULT_TIMEOUT_MS,
-  LEGACY_SIGNATURE_HEADER,
-  SEKYRO_SIGNATURE_HEADER,
-  Sekyro,
-  SekyroApiError,
-  SekyroConfigError,
-  SekyroWebhookError,
-  signatureFromHeaders,
-  verifyWebhook
-});
-//# sourceMappingURL=index.cjs.map
+"use strict";var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __hasOwnProp=Object.prototype.hasOwnProperty;var __export=(target,all)=>{for(var name in all)__defProp(target,name,{get:all[name],enumerable:!0})},__copyProps=(to,from,except,desc)=>{if(from&&typeof from=="object"||typeof from=="function")for(let key of __getOwnPropNames(from))!__hasOwnProp.call(to,key)&&key!==except&&__defProp(to,key,{get:()=>from[key],enumerable:!(desc=__getOwnPropDesc(from,key))||desc.enumerable});return to};var __toCommonJS=mod=>__copyProps(__defProp({},"__esModule",{value:!0}),mod);var src_exports={};__export(src_exports,{DEFAULT_BASE_URL:()=>DEFAULT_BASE_URL,DEFAULT_TIMEOUT_MS:()=>DEFAULT_TIMEOUT_MS,LEGACY_SIGNATURE_HEADER:()=>LEGACY_SIGNATURE_HEADER,SEKYRO_SIGNATURE_HEADER:()=>SEKYRO_SIGNATURE_HEADER,Sekyro:()=>Sekyro,SekyroApiError:()=>SekyroApiError,SekyroConfigError:()=>SekyroConfigError,SekyroWebhookError:()=>SekyroWebhookError,signatureFromHeaders:()=>signatureFromHeaders,verifyWebhook:()=>verifyWebhook});module.exports=__toCommonJS(src_exports);var WEBHOOK_MESSAGES={invalid_signature:"No v1 signature in the header matches this body and secret",stale:"Delivery timestamp is outside the tolerance window",malformed:"Signature header or body is not in the expected format"},SekyroWebhookError=class extends Error{name="SekyroWebhookError";code;constructor(code,message=WEBHOOK_MESSAGES[code]){super(message),this.code=code}},CONFIG_MESSAGES={missing_api_key:"Sekyro AI: `apiKey` is required",invalid_base_url:"Sekyro AI: `baseUrl` must be an https: URL (http: is allowed only for localhost, 127.0.0.1 or [::1])"},SekyroConfigError=class extends TypeError{name="SekyroConfigError";code;constructor(code,message=CONFIG_MESSAGES[code]){super(message),this.code=code}},SekyroApiError=class extends Error{name="SekyroApiError";status;code;requestId;retryable;constructor(init){super(init.message,init.cause===void 0?void 0:{cause:init.cause}),this.status=init.status,this.code=init.code,this.requestId=init.requestId,this.retryable=isRetryable(init.status,init.code)}};function isRetryable(status,code){return code==="network"||code==="timeout"||code==="idempotency_in_progress"||status===429?!0:status>=500&&status<=599}var SDK_VERSION="0.1.0-rc.3";var USER_AGENT=`@sekyro/node/${SDK_VERSION}`,DEFAULT_BASE_URL="https://api.sekyro.ai/api/v2",DEFAULT_TIMEOUT_MS=3e4;function isSuccessEnvelope(value){return typeof value=="object"&&value!==null&&value.success===!0&&"data"in value}function isErrorEnvelope(value){if(typeof value!="object"||value===null)return!1;let v=value;if(v.status!=="error"||typeof v.error!="object"||v.error===null)return!1;let e=v.error;return typeof e.code=="string"&&typeof e.message=="string"}function isAbortLike(err){if(typeof err!="object"||err===null)return!1;let name=err.name;return name==="TimeoutError"||name==="AbortError"}var LOOPBACK_HOSTS=new Set(["localhost","127.0.0.1","[::1]"]);function assertSafeBaseUrl(baseUrl){let url;try{url=new URL(baseUrl)}catch{throw new SekyroConfigError("invalid_base_url")}if(url.protocol!=="https:"&&!(url.protocol==="http:"&&LOOPBACK_HOSTS.has(url.hostname)))throw new SekyroConfigError("invalid_base_url")}var Transport=class{apiKey;baseUrl;timeoutMs;fetchImpl;constructor(opts){let baseUrl=(opts.baseUrl??DEFAULT_BASE_URL).replace(/\/+$/,"");assertSafeBaseUrl(baseUrl),this.apiKey=opts.apiKey,this.baseUrl=baseUrl,this.timeoutMs=opts.timeoutMs??DEFAULT_TIMEOUT_MS,this.fetchImpl=opts.fetch??globalThis.fetch}async call(method,path,body,idempotencyKey){let headers={authorization:`Bearer ${this.apiKey}`,accept:"application/json","user-agent":USER_AGENT};body!==void 0&&(headers["content-type"]="application/json"),idempotencyKey!==void 0&&(headers["x-idempotency-key"]=idempotencyKey);let init={method,headers,signal:AbortSignal.timeout(this.timeoutMs)};body!==void 0&&(init.body=JSON.stringify(body));let res;try{res=await this.fetchImpl(`${this.baseUrl}${path}`,init)}catch(err){throw isAbortLike(err)?new SekyroApiError({status:0,code:"timeout",message:`Request timed out after ${this.timeoutMs}ms`,cause:err}):new SekyroApiError({status:0,code:"network",message:`Network error: ${err instanceof Error?err.message:String(err)}`,cause:err})}let text=await res.text(),parsed,parseError;try{parsed=text.length>0?JSON.parse(text):void 0}catch(err){parseError=err}if(!res.ok){if(isErrorEnvelope(parsed)){let init2={status:res.status,code:parsed.error.code,message:parsed.error.message};throw parsed.error.request_id!==void 0&&(init2.requestId=parsed.error.request_id),new SekyroApiError(init2)}throw new SekyroApiError({status:res.status,code:"http_error",message:`HTTP ${res.status}${res.statusText?` ${res.statusText}`:""}`})}if(!isSuccessEnvelope(parsed))throw new SekyroApiError({status:res.status,code:"malformed_response",message:"Response is not a `{ success: true, data }` envelope",cause:parseError});return parsed.data}},SessionsApi=class{constructor(call){this.call=call}call;async create(input={},opts={}){let wire=await this.call("POST","/sessions",input,opts.idempotencyKey);return{id:wire.id,status:wire.status,clientToken:wire.client_token,hostedUrl:wire.hosted_url,steps:wire.steps,expiresAt:wire.expiresAt}}async selectMethod(id,method){if(typeof id!="string"||id.length===0)throw new TypeError("sessions.selectMethod: `id` must be a non-empty string");return this.call("POST",`/sessions/${encodeURIComponent(id)}/method`,{method})}async get(id){if(typeof id!="string"||id.length===0)throw new TypeError("sessions.get: `id` must be a non-empty string");return this.call("GET",`/sessions/${encodeURIComponent(id)}`)}},Sekyro=class{sessions;constructor(opts){if(typeof opts?.apiKey!="string"||opts.apiKey.length===0)throw new SekyroConfigError("missing_api_key");let transport=new Transport(opts);this.sessions=new SessionsApi(transport.call.bind(transport))}};var import_node_crypto=require("crypto");var SEKYRO_SIGNATURE_HEADER="x-sekyro-signature",LEGACY_SIGNATURE_HEADER="x-ibtikar-signature";function signatureFromHeaders(headers){return readHeader(headers,SEKYRO_SIGNATURE_HEADER)??readHeader(headers,LEGACY_SIGNATURE_HEADER)}function readHeader(headers,name){if(typeof headers.get=="function"){let v2=headers.get(name);return v2===null||v2===""?void 0:v2}let record=headers,key=Object.keys(record).find(k=>k.toLowerCase()===name);if(key===void 0)return;let raw=record[key],v=Array.isArray(raw)?raw[0]:raw;return v===void 0||v===""?void 0:v}var HEX64=/^[0-9a-f]{64}$/i;function verifyWebhook(rawBody,header,secret,opts={}){if(!header||!secret)throw new SekyroWebhookError("invalid_signature");let parts=header.split(",").map(part=>{let trimmed=part.trim(),eq=trimmed.indexOf("=");return eq===-1?[trimmed,""]:[trimmed.slice(0,eq).trim(),trimmed.slice(eq+1).trim()]}),tRaw=parts.find(([k])=>k==="t")?.[1],t=tRaw!==void 0&&/^\d+$/.test(tRaw)?Number(tRaw):Number.NaN,sigs=parts.filter(([k])=>k==="v1").map(([,v])=>v);if(!Number.isSafeInteger(t)||sigs.length===0)throw new SekyroWebhookError("malformed");let nowSec=Math.floor((opts.now?.()??Date.now())/1e3),tolerance=opts.toleranceSec??300;if(Math.abs(nowSec-t)>tolerance)throw new SekyroWebhookError("stale");let expected=(0,import_node_crypto.createHmac)("sha256",secret).update(`${t}.${rawBody}`).digest();if(!sigs.some(hex=>{if(!HEX64.test(hex))return!1;let got=Buffer.from(hex,"hex");return got.length===expected.length&&(0,import_node_crypto.timingSafeEqual)(got,expected)}))throw new SekyroWebhookError("invalid_signature");let parsed;try{parsed=JSON.parse(rawBody)}catch{throw new SekyroWebhookError("malformed","Signed body is not valid JSON")}if(parsed===null||typeof parsed!="object"||Array.isArray(parsed))throw new SekyroWebhookError("malformed","Signed body is not a JSON object");return parsed}0&&(module.exports={DEFAULT_BASE_URL,DEFAULT_TIMEOUT_MS,LEGACY_SIGNATURE_HEADER,SEKYRO_SIGNATURE_HEADER,Sekyro,SekyroApiError,SekyroConfigError,SekyroWebhookError,signatureFromHeaders,verifyWebhook});