@sneekin/sdk 0.3.2 → 1.1.0

package/dist/verify/index.js

@@ -0,0 +1,441 @@
+// src/core/client.ts
+var SneekApiError = class extends Error {
+  constructor(status, type, title, detail) {
+    super(`${title}${detail ? `: ${detail}` : ""} [${status}]`);
+    this.status = status;
+    this.type = type;
+    this.title = title;
+    this.detail = detail;
+    this.name = "SneekApiError";
+  }
+  status;
+  type;
+  title;
+  detail;
+};
+var SneekClient = class {
+  apiUrl;
+  apiKey;
+  fetchImpl;
+  maxRetries;
+  retryBaseMs;
+  constructor(options) {
+    if (!options.apiUrl) throw new Error("apiUrl is required");
+    if (!options.apiKey) throw new Error("apiKey is required");
+    this.apiUrl = options.apiUrl.replace(/\/+$/, "");
+    this.apiKey = options.apiKey;
+    this.fetchImpl = options.fetch ?? fetch;
+    this.maxRetries = options.maxRetries ?? 2;
+    this.retryBaseMs = options.retryBaseMs ?? 200;
+  }
+  async request(method, path, body, extraHeaders) {
+    const raw = body === void 0 ? void 0 : JSON.stringify(body);
+    let attempt = 0;
+    let lastError;
+    for (; ; ) {
+      try {
+        const response = await this.fetchImpl(`${this.apiUrl}${path}`, {
+          method,
+          headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${this.apiKey}`,
+            ...extraHeaders ?? {}
+          },
+          body: raw
+        });
+        const text = await response.text();
+        const parsed = text ? parseJson(text) : void 0;
+        if (!response.ok) {
+          const problem = asProblem(parsed);
+          const error = new SneekApiError(
+            response.status,
+            problem.type ?? "about:blank",
+            problem.title ?? response.statusText,
+            problem.detail
+          );
+          if (response.status >= 500 && attempt < this.maxRetries) {
+            lastError = error;
+            await this.backoff(attempt++);
+            continue;
+          }
+          throw error;
+        }
+        return parsed;
+      } catch (error) {
+        if (error instanceof SneekApiError) throw error;
+        if (attempt < this.maxRetries) {
+          lastError = error;
+          await this.backoff(attempt++);
+          continue;
+        }
+        throw lastError ?? error;
+      }
+    }
+  }
+  backoff(attempt) {
+    return new Promise((resolve) => setTimeout(resolve, this.retryBaseMs * 2 ** attempt));
+  }
+};
+function parseJson(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+function asProblem(value) {
+  if (typeof value !== "object" || value === null) return {};
+  const problem = value;
+  return {
+    type: typeof problem.type === "string" ? problem.type : void 0,
+    title: typeof problem.title === "string" ? problem.title : void 0,
+    detail: typeof problem.detail === "string" ? problem.detail : void 0
+  };
+}
+
+// src/core/derive-keys.ts
+import { hkdfSync } from "crypto";
+var KEY_LABELS = {
+  qrSigningKey: "sneek-qr-v1",
+  webhookSigningKey: "sneek-webhook-v1",
+  proofKey: "sneek-proof-v1"
+};
+function deriveKeys(apiKey) {
+  if (typeof apiKey !== "string" || apiKey.length === 0) {
+    throw new TypeError("apiKey must be a nonempty string");
+  }
+  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
+  const derive = (label) => Buffer.from(
+    hkdfSync("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
+  );
+  return {
+    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
+    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
+    proofKey: derive(KEY_LABELS.proofKey)
+  };
+}
+
+// src/verify/handler.ts
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+
+// src/verify/auth-schema.ts
+import { z } from "zod";
+var BrowserProof = z.string().min(1).max(4096);
+var VerificationId = z.string().uuid();
+var QrReference = z.string().regex(/^[0-9a-f]{64}$/);
+var ConfigActionSchema = z.object({ action: z.literal("config") }).strict();
+var RequestActionSchema = z.object({
+  action: z.literal("request"),
+  identifier: z.string().min(3).max(254)
+}).strict();
+var SwitchActionSchema = z.object({
+  action: z.literal("switch"),
+  requestId: VerificationId,
+  channel: z.enum(["sms", "whatsapp", "email", "push"]),
+  proof: BrowserProof
+}).strict();
+var VerifyCodeActionSchema = z.object({
+  action: z.literal("verify"),
+  requestId: VerificationId,
+  code: z.string().min(4).max(12).optional(),
+  proof: BrowserProof
+}).strict();
+var VerifyQrActionSchema = z.object({
+  action: z.literal("verify"),
+  requestId: VerificationId,
+  ref: QrReference,
+  bindingProof: BrowserProof
+}).strict();
+var CreateQrActionSchema = z.object({ action: z.literal("create") }).strict();
+var QrStatusActionSchema = z.object({
+  action: z.literal("status"),
+  ref: QrReference,
+  bindingProof: BrowserProof
+}).strict();
+var QrWebhookEventSchema = z.object({
+  type: z.literal("qr.approved"),
+  applicationId: z.string().uuid(),
+  ref: QrReference,
+  requestId: VerificationId
+}).strict();
+var SneekVerifyActionSchema = z.union([
+  ConfigActionSchema,
+  RequestActionSchema,
+  SwitchActionSchema,
+  VerifyCodeActionSchema,
+  VerifyQrActionSchema,
+  CreateQrActionSchema,
+  QrStatusActionSchema
+]);
+
+// src/verify/handler.ts
+var SneekVerifyHandler = class {
+  client;
+  allowedOrigins;
+  keys;
+  approvalStore;
+  onVerified;
+  jwksByIssuer = /* @__PURE__ */ new Map();
+  constructor(options) {
+    this.client = new SneekClient({
+      apiUrl: options.apiUrl,
+      apiKey: options.apiKey,
+      fetch: options.fetch
+    });
+    this.allowedOrigins = new Set(options.allowedOrigins.map((origin) => new URL(origin).origin));
+    this.keys = deriveKeys(options.apiKey);
+    this.approvalStore = options.approvalStore;
+    this.onVerified = options.onVerified;
+  }
+  async handle(request) {
+    const origin = this.getAllowedOrigin(request);
+    if (request.method !== "POST" || !origin) {
+      return jsonResponse({ error: "Forbidden" }, 403);
+    }
+    let body;
+    try {
+      body = await request.json();
+    } catch {
+      return jsonResponse({ error: "Invalid JSON body" }, 400);
+    }
+    const action = SneekVerifyActionSchema.safeParse(body);
+    if (!action.success) return jsonResponse({ error: "Invalid auth action" }, 400);
+    switch (action.data.action) {
+      case "config":
+        return this.config(origin);
+      case "request":
+        return this.startVerification(action.data.identifier, origin);
+      case "switch":
+        return this.switchVerification(action.data, origin);
+      case "verify":
+        return this.verify(action.data, origin);
+      case "create":
+        return this.createQr(origin);
+      case "status":
+        return this.qrStatus(action.data.ref, action.data.bindingProof, origin);
+    }
+  }
+  async handleWebhook(request) {
+    if (request.method !== "POST") return jsonResponse({ error: "Invalid webhook" }, 405);
+    const contentLength = Number(request.headers.get("content-length") ?? 0);
+    if (contentLength > 16384) return jsonResponse({ error: "Invalid webhook" }, 413);
+    const signature = request.headers.get("sneek-signature") ?? "";
+    const match = /^t=(\d{1,12}),v1=([A-Za-z0-9_-]{43})$/.exec(signature);
+    if (!match) return jsonResponse({ error: "Invalid webhook signature" }, 401);
+    const timestamp = Number(match[1]);
+    const now = Math.floor(Date.now() / 1e3);
+    if (!Number.isSafeInteger(timestamp) || Math.abs(now - timestamp) > 300) {
+      return jsonResponse({ error: "Expired webhook signature" }, 401);
+    }
+    let body;
+    try {
+      const text = await request.text();
+      if (Buffer.byteLength(text, "utf8") > 16384) return jsonResponse({ error: "Invalid webhook" }, 413);
+      body = JSON.parse(text);
+    } catch {
+      return jsonResponse({ error: "Invalid webhook body" }, 400);
+    }
+    const event = QrWebhookEventSchema.safeParse(body);
+    if (!event.success || !this.isValidWebhookSignature(timestamp, event.data, match[2])) {
+      return jsonResponse({ error: "Invalid webhook signature" }, 401);
+    }
+    const session = await this.approvalStore.readQrSession(event.data.ref);
+    if (!session || session.applicationId !== event.data.applicationId || session.expiresAt <= Date.now()) {
+      return jsonResponse({ error: "Unknown or expired QR approval" }, 401);
+    }
+    const recorded = await this.approvalStore.recordQrApproval(event.data, Date.now());
+    if (recorded === "missing") return jsonResponse({ error: "Unknown or expired QR approval" }, 401);
+    return new Response(null, { status: 204 });
+  }
+  getAllowedOrigin(request) {
+    const origin = request.headers.get("origin");
+    if (!origin || origin === "null") return null;
+    try {
+      const parsed = new URL(origin);
+      return parsed.origin === origin && this.allowedOrigins.has(parsed.origin) && new URL(request.url).origin === parsed.origin ? parsed.origin : null;
+    } catch {
+      return null;
+    }
+  }
+  async config(origin) {
+    const partner = await this.client.request("GET", "/api/verify/qr/partner-config");
+    const enabled = partner.origins.includes(origin);
+    return jsonResponse({
+      origin,
+      enabled,
+      ...enabled ? { applicationId: partner.applicationId } : {}
+    }, 200);
+  }
+  async startVerification(identifier, origin) {
+    const result = await this.client.request("POST", "/api/verify", { identifier });
+    return this.startResponse(result, origin);
+  }
+  async switchVerification(action, origin) {
+    if (!this.isValidProof(action.proof, action.requestId, origin)) {
+      return jsonResponse({ error: "Invalid or expired browser proof" }, 403);
+    }
+    const result = await this.client.request(
+      "POST",
+      `/api/verify/${action.requestId}/switch`,
+      { channel: action.channel }
+    );
+    return this.startResponse(result, origin);
+  }
+  async verify(action, origin) {
+    if ("proof" in action) {
+      if (!this.isValidProof(action.proof, action.requestId, origin)) {
+        return jsonResponse({ error: "Invalid or expired browser proof" }, 403);
+      }
+    } else {
+      const session = await this.qrSession(action.ref, action.bindingProof, origin);
+      if (!session || session.requestId !== action.requestId) {
+        return jsonResponse({ error: "QR approval is not bound to this browser" }, 403);
+      }
+    }
+    const body = "proof" in action && action.code !== void 0 ? { code: action.code } : {};
+    const result = await this.client.request(
+      "POST",
+      `/api/verify/${action.requestId}/check`,
+      body
+    );
+    if (result.status !== "verified") {
+      return jsonResponse({ error: "This verification requires additional account setup" }, 403);
+    }
+    const partner = await this.client.request("GET", "/api/verify/qr/partner-config");
+    let payload;
+    try {
+      const jwks = this.jwksByIssuer.get(partner.issuer) ?? createRemoteJWKSet(new URL("/oauth/jwks", partner.issuer));
+      this.jwksByIssuer.set(partner.issuer, jwks);
+      ({ payload } = await jwtVerify(result.idToken, jwks, {
+        issuer: partner.issuer,
+        audience: partner.clientId
+      }));
+    } catch {
+      return jsonResponse({ error: "Sneek verification token is invalid" }, 502);
+    }
+    const claims = this.verifiedClaims(payload, action.requestId);
+    if (!claims) return jsonResponse({ error: "Sneek verification token is invalid" }, 502);
+    if (!await this.approvalStore.claimJti(claims.jti, claims.expiresAt * 1e3)) {
+      return jsonResponse({ error: "Sneek verification token was already used" }, 401);
+    }
+    const verified = {
+      identifier: claims.identifier,
+      kind: claims.kind,
+      method: claims.method,
+      verifiedAt: new Date(claims.verifiedAt * 1e3).toISOString(),
+      requestId: action.requestId
+    };
+    await this.onVerified(verified);
+    return jsonResponse({ status: "verified", ...verified }, 200);
+  }
+  verifiedClaims(payload, requestId) {
+    const requestClaim = payload.verification_request_id;
+    const issuedAt = payload.auth_time ?? payload.iat;
+    const methods = payload.amr;
+    const email = payload.email;
+    const mobile = payload.phone_number;
+    const hasEmail = typeof email === "string" && payload.email_verified === true;
+    const hasMobile = typeof mobile === "string" && payload.phone_number_verified === true;
+    if (payload.sub !== requestId || requestClaim !== requestId || typeof payload.exp !== "number" || typeof issuedAt !== "number" || typeof payload.jti !== "string" || !payload.jti || !Array.isArray(methods) || methods.length === 0 || methods.some((method) => typeof method !== "string" || !method) || hasEmail === hasMobile) return null;
+    return {
+      identifier: hasEmail ? email : mobile,
+      kind: hasEmail ? "email" : "mobile",
+      method: methods.join(" "),
+      verifiedAt: issuedAt,
+      expiresAt: payload.exp,
+      jti: payload.jti
+    };
+  }
+  startResponse(result, origin) {
+    const expiresAt = Date.parse(result.expiresAt);
+    if (!Number.isFinite(expiresAt) || expiresAt <= Date.now()) {
+      return jsonResponse({ error: "Verification response is invalid or expired" }, 502);
+    }
+    return jsonResponse({
+      requestId: result.id,
+      channel: result.channel,
+      maskedIdentifier: result.maskedIdentifier,
+      expiresAt: result.expiresAt,
+      ...result.instruction ? { instruction: result.instruction } : {},
+      ...result.alternatives ? { alternatives: result.alternatives } : {},
+      ...result.challengeNumber ? { challengeNumber: result.challengeNumber } : {},
+      proof: this.createProof(result.id, origin, expiresAt)
+    }, 200);
+  }
+  createProof(requestId, origin, expiresAt) {
+    const payload = Buffer.from(JSON.stringify({
+      requestId,
+      origin,
+      expiresAt,
+      nonce: randomBytes(16).toString("base64url")
+    })).toString("base64url");
+    const signature = createHmac("sha256", this.keys.proofKey).update(payload).digest("base64url");
+    return `${payload}.${signature}`;
+  }
+  isValidProof(proof, requestId, origin) {
+    const [payload, signature, ...extra] = proof.split(".");
+    if (!payload || !signature || extra.length > 0) return false;
+    const expected = createHmac("sha256", this.keys.proofKey).update(payload).digest();
+    const actual = Buffer.from(signature, "base64url");
+    if (actual.length !== expected.length || !timingSafeEqual(expected, actual)) return false;
+    try {
+      const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+      return decoded.requestId === requestId && decoded.origin === origin && typeof decoded.expiresAt === "number" && decoded.expiresAt > Date.now() && typeof decoded.nonce === "string";
+    } catch {
+      return false;
+    }
+  }
+  async createQr(origin) {
+    const partner = await this.partnerConfig();
+    if (!partner.origins.includes(origin)) return jsonResponse({ error: "Origin is not registered for QR verification" }, 403);
+    const nonce = randomBytes(32).toString("hex");
+    const ref = createHash("sha256").update(nonce).digest("hex");
+    const issuedAt = Math.floor(Date.now() / 1e3);
+    const expiresAt = (issuedAt + partner.qrTtlSeconds) * 1e3;
+    const bindingProof = randomBytes(32).toString("base64url");
+    const signature = createHmac("sha256", this.keys.qrSigningKey).update(["sneek-qr-v1", partner.applicationId, nonce, origin, String(issuedAt)].join("\n")).digest().subarray(0, 16).toString("base64url");
+    await this.approvalStore.createQrSession({
+      ref,
+      applicationId: partner.applicationId,
+      origin,
+      bindingProofHash: this.hash(bindingProof),
+      expiresAt
+    });
+    return jsonResponse({ ref, nonce, issuedAt, expiresAt, signature, bindingProof }, 200);
+  }
+  async qrStatus(ref, bindingProof, origin) {
+    const session = await this.qrSession(ref, bindingProof, origin);
+    if (!session) return jsonResponse({ error: "QR approval is not bound to this browser" }, 403);
+    if (!session.requestId) return jsonResponse({ status: "pending" }, 200);
+    return jsonResponse({ status: "approved", requestId: session.requestId }, 200);
+  }
+  async qrSession(ref, bindingProof, origin) {
+    const session = await this.approvalStore.readQrSession(ref);
+    if (!session || session.origin !== origin || session.expiresAt <= Date.now()) return null;
+    const expected = Buffer.from(session.bindingProofHash, "hex");
+    const actual = Buffer.from(this.hash(bindingProof), "hex");
+    if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) return null;
+    return session;
+  }
+  async partnerConfig() {
+    return this.client.request("GET", "/api/verify/qr/partner-config");
+  }
+  isValidWebhookSignature(timestamp, event, signature) {
+    const expected = createHmac("sha256", this.keys.webhookSigningKey).update(["sneek-webhook-v1", String(timestamp), event.type, event.applicationId, event.ref, event.requestId].join("\n")).digest();
+    const actual = Buffer.from(signature, "base64url");
+    return actual.length === expected.length && timingSafeEqual(expected, actual);
+  }
+  hash(value) {
+    return createHash("sha256").update(value).digest("hex");
+  }
+};
+function jsonResponse(body, status) {
+  return Response.json(body, { status });
+}
+export {
+  SneekApiError,
+  SneekClient,
+  SneekVerifyHandler,
+  deriveKeys
+};

package/package.json

@@ -1,49 +1,69 @@
 {
-  "name": "@sneekin/sdk",
-  "version": "0.3.2",
-  "publishConfig": {
-    "access": "public"
-  },
-  "description": "Node.js SDK for the Sneek Messaging API",
-  "homepage": "https://sneek.in/docs",
-  "bugs": {
-    "url": "https://sneek.in/docs"
-  },
-  "main": "dist/index.js",
-  "module": "dist/index.mjs",
-  "types": "dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.mjs",
-      "require": "./dist/index.js"
+    "name": "@sneekin/sdk",
+    "version": "1.1.0",
+    "publishConfig": {
+        "access": "public"
+    },
+    "description": "Server-side SDK for Sneek verification, messaging, and payments",
+    "homepage": "https://sneek.in/docs",
+    "bugs": {
+        "url": "https://sneek.in/docs"
+    },
+    "type": "module",
+    "main": "./dist/index.cjs",
+    "module": "./dist/index.js",
+    "types": "./dist/index.d.ts",
+    "exports": {
+        ".": {
+            "types": "./dist/index.d.ts",
+            "import": "./dist/index.js",
+            "require": "./dist/index.cjs"
+        },
+        "./verify": {
+            "types": "./dist/verify/index.d.ts",
+            "import": "./dist/verify/index.js",
+            "require": "./dist/verify/index.cjs"
+        },
+        "./messages": {
+            "types": "./dist/messages/index.d.ts",
+            "import": "./dist/messages/index.js",
+            "require": "./dist/messages/index.cjs"
+        },
+        "./pay": {
+            "types": "./dist/pay/index.d.ts",
+            "import": "./dist/pay/index.js",
+            "require": "./dist/pay/index.cjs"
+        }
+    },
+    "files": [
+        "dist"
+    ],
+    "sideEffects": false,
+    "scripts": {
+        "build": "tsup && tsc -p tsconfig.json --emitDeclarationOnly",
+        "type-check": "tsc -p tsconfig.json --noEmit",
+        "test": "node --test --import tsx test/*.test.ts test/*.test.mjs",
+        "test:package": "node --test test/package-built.test.mjs"
+    },
+    "keywords": [
+        "sneek",
+        "verification",
+        "messaging",
+        "payments"
+    ],
+    "author": "Abblor Tech Pvt Ltd <abblorltd@gmail.com> (https://sneek.in)",
+    "license": "UNLICENSED",
+    "dependencies": {
+        "jose": "6.2.8",
+        "zod": "3.25.76"
+    },
+    "devDependencies": {
+        "@types/node": "22.19.17",
+        "tsup": "8.5.1",
+        "tsx": "4.21.0",
+        "typescript": "6.0.3"
+    },
+    "engines": {
+        "node": ">=20"
     }
-  },
-  "files": [
-    "dist"
-  ],
-  "scripts": {
-    "build": "tsup",
-    "type-check": "tsc --noEmit",
-    "test": "node --test --import tsx test/*.test.ts"
-  },
-  "keywords": [
-    "sneek",
-    "messaging",
-    "sms",
-    "whatsapp",
-    "email",
-    "otp"
-  ],
-  "author": "Abblor Tech Pvt Ltd <abblorltd@gmail.com> (https://sneek.in)",
-  "license": "UNLICENSED",
-  "devDependencies": {
-    "@types/node": "^20.11.0",
-    "tsup": "^8.0.0",
-    "tsx": "^4.7.0",
-    "typescript": "^5.3.3"
-  },
-  "engines": {
-    "node": ">=18"
-  }
-}
+}

package/README.md

@@ -1,134 +0,0 @@
-# @sneekin/sdk
-
-Node.js SDK for the **Sneek Send** API — deliver OTPs and transactional
-messages over SMS, WhatsApp, and email through Sneek's pre-approved DLT
-sender, WhatsApp BSP number, and warmed email domain.
-
-> Sneek **delivers**; your app generates and verifies its own OTP codes.
-
-## Installation
-
-```bash
-npm install @sneekin/sdk
-```
-
-## Quick start
-
-```ts
-import { Sneek } from '@sneekin/sdk';
-
-const sneek = new Sneek({
-  apiUrl: process.env.SNEEK_API_URL ?? 'https://api.sneek.in',
-  apiKey: process.env.SNEEK_API_KEY!, // snk_live_… or snk_test_…
-});
-
-// Generic send (body OR template)
-await sneek.messages.send({
-  to: '+919876543210',
-  body: 'Your OTP to login to ConfHub is 482917. Do not share it.',
-  channel: 'sms', // 'auto' | 'sms' | 'whatsapp' | 'email'
-});
-
-// Channel helpers
-await sneek.sendSMS('+919876543210', 'Your code is 482917');
-await sneek.sendWhatsApp('+919876543210', 'Your code is 482917');
-await sneek.sendEmail('user@example.com', 'Your code is 482917');
-
-// OTP body-formatting helper (you generate the code yourself)
-await sneek.sendOTP({
-  to: '+919876543210',
-  code: '482917',
-  appName: 'ConfHub',
-  channel: 'auto',
-});
-
-// DLT/provider templates (server-rendered)
-await sneek.messages.send({
-  to: '+919876543210',
-  channel: 'sms',
-  template: 'otp_login',
-  variables: { appName: 'ConfHub', otp: '482917' },
-});
-```
-
-### Message intent (`type`)
-
-Declare whether a message is an OTP or a plain communication so Sneek picks the
-correct approved provider template — instead of guessing from the body text:
-
-```ts
-// Auth / OTP template
-await sneek.messages.send({ to, body: 'Your code is 482917', type: 'otp' });
-
-// Utility / communication template
-await sneek.messages.send({
-  to,
-  body: 'Your booking BK-7781 is confirmed.',
-  type: 'transactional',
-});
-```
-
-`type` accepts `'otp'` or `'transactional'`. When omitted, Sneek infers intent
-from the body (which can misclassify digit groups like `BK-7781` as an OTP), so
-**passing `type` explicitly is recommended.** `sendOTP(...)` always tags
-`type: 'otp'` for you.
-
-## Authentication
-
-Every request is sent with `Authorization: Bearer <apiKey>`. Mint keys from the
-Sneek admin (`/o/<org>/applications/<id>` → API keys). Keys are shown **once**;
-store them in your environment / secret manager. `snk_test_…` keys hit dev
-adapters; `snk_live_…` keys deliver for real.
-
-## Errors & retries
-
-- Non-2xx responses throw `SneekApiError` with `{ status, type, title, detail }`
-  (RFC-7807 problem-details).
-- Transient `5xx` and network failures are retried with exponential backoff
-  (`maxRetries`, default 2; `retryBaseMs`, default 200ms).
-
-## Idempotency & rate limits
-
-Pass `idempotencyKey` to make a send safely repeatable — the first call is
-processed and its result is replayed for any retry with the same key (per
-application), so a dropped connection never sends twice. This pairs with the
-SDK's automatic `5xx` retries.
-
-```ts
-await sneek.messages.send({
-  to: '+919876543210',
-  type: 'otp',
-  body: 'Your code is 482917',
-  idempotencyKey: 'order-4815-otp',
-});
-```
-
-Sends are rate-limited per application (your plan's per-minute / per-day quota),
-per recipient, and per source IP. Exceeding a limit throws `SneekApiError` with
-`status === 429`; the problem body carries `retry_after` (seconds).
-
-
-```ts
-import { SneekApiError } from '@sneekin/sdk';
-
-try {
-  await sneek.sendSMS('+91…', 'hi');
-} catch (err) {
-  if (err instanceof SneekApiError && err.status === 401) {
-    // invalid / revoked key
-  }
-}
-```
-
-## API
-
-| Method | Description |
-| --- | --- |
-| `messages.send(input)` | Send a message (body or template; optional `type` intent). Returns `202` accepted envelope. |
-| `messages.get(id)` | Fetch a previously-sent message by id. |
-| `sendSMS/sendWhatsApp/sendEmail(to, body, clientRef?)` | Channel-pinned helpers. |
-| `sendOTP({ to, code, appName?, channel?, template?, variables? })` | Format + send an OTP body. |
-
-## License
-
-UNLICENSED — © Abblor Tech Pvt Ltd.