@splitin/verification-adapter-persona 0.1.0-beta.0

package/dist/index.js

@@ -0,0 +1,1356 @@
+import { defineProviderManifest, VERIFICATION_ADAPTER_CONTRACT_VERSION, secretStringProperty, plainStringProperty, ProviderError, isCanonicalStatus, isOpaqueSubjectReference, metadataContainsForbiddenIdentifier, ProviderRequiredInformationError } from '@splitin/verification-adapter-sdk';
+
+// src/adapter.ts
+var DEFAULT_KYB_FIELD_MAP = {
+  associatedPeople: "associated_people",
+  legalName: "business-legal-name",
+  registeredAddress: "business-registered-address",
+  physicalAddress: "business-physical-address",
+  jurisdictionCountryCode: "business-jurisdiction-country-code",
+  entityType: "business-entity-type",
+  evidenceReferences: "business-evidence-references",
+  relationshipReference: "relationship-reference",
+  relationshipKind: "relationship-kind",
+  claimedOwnershipPercentage: "claimed-ownership-percentage",
+  subjectReference: "subject-reference"
+};
+function createPersonaConfiguration(values) {
+  const kybCaseMode = parseKybCaseMode(values.kybCaseMode ?? values.PERSONA_KYB_CASE_MODE);
+  return Object.freeze({
+    apiKey: pick(values, "apiKey", "PERSONA_API_KEY"),
+    environmentId: pick(values, "environmentId", "PERSONA_ENVIRONMENT_ID"),
+    idvTemplateId: pick(values, "idvTemplateId", "PERSONA_IDV_TEMPLATE_ID"),
+    idvTemplateVersion: pick(values, "idvTemplateVersion", "PERSONA_IDV_TEMPLATE_VERSION"),
+    associatedPersonTemplateId: pick(values, "associatedPersonTemplateId", "PERSONA_ASSOCIATED_PERSON_TEMPLATE_ID"),
+    associatedPersonTemplateVersion: pick(values, "associatedPersonTemplateVersion", "PERSONA_ASSOCIATED_PERSON_TEMPLATE_VERSION"),
+    kybTransactionTypeId: pick(values, "kybTransactionTypeId", "PERSONA_KYB_TRANSACTION_TYPE_ID"),
+    kybWorkflowId: pick(values, "kybWorkflowId", "PERSONA_KYB_WORKFLOW_ID"),
+    kybWorkflowVersion: pick(values, "kybWorkflowVersion", "PERSONA_KYB_WORKFLOW_VERSION"),
+    caseTemplateId: pick(values, "caseTemplateId", "PERSONA_CASE_TEMPLATE_ID"),
+    caseType: optional(values, "caseType", "PERSONA_CASE_TYPE"),
+    ownershipCaseType: optional(values, "ownershipCaseType", "PERSONA_OWNERSHIP_CASE_TYPE"),
+    businessAuthorityCaseType: optional(values, "businessAuthorityCaseType", "PERSONA_BUSINESS_AUTHORITY_CASE_TYPE"),
+    kybCaseMode,
+    kybFieldMap: parseFieldMap(values.kybFieldMapJson ?? values.PERSONA_KYB_FIELD_MAP_JSON),
+    statusMappings: parseStatusMappings(values.statusMappingsJson ?? values.PERSONA_STATUS_MAPPINGS_JSON),
+    apiVersion: pick(values, "apiVersion", "PERSONA_API_VERSION"),
+    webhookSecretCurrent: pick(values, "webhookSecretCurrent", "PERSONA_WEBHOOK_SECRET_CURRENT"),
+    webhookSecretPrevious: optional(values, "webhookSecretPrevious", "PERSONA_WEBHOOK_SECRET_PREVIOUS"),
+    webhookToleranceSeconds: parseTolerance(values.webhookToleranceSeconds ?? values.PERSONA_WEBHOOK_TOLERANCE_SECONDS),
+    allowedOrigins: parseAllowedOrigins(values.allowedOrigins ?? values.PERSONA_ALLOWED_ORIGINS)
+  });
+}
+function personaWebhookSecrets(config) {
+  return [config.webhookSecretCurrent, config.webhookSecretPrevious].map((value) => value?.trim() ?? "").filter(Boolean);
+}
+function validatePersonaConfiguration(config, environment) {
+  const required = [
+    config.apiKey,
+    config.environmentId,
+    config.idvTemplateId,
+    config.idvTemplateVersion,
+    config.associatedPersonTemplateId,
+    config.associatedPersonTemplateVersion,
+    config.kybTransactionTypeId,
+    config.kybWorkflowId,
+    config.kybWorkflowVersion,
+    config.caseTemplateId,
+    config.apiVersion
+  ];
+  if (required.some((value) => !value.trim()) || personaWebhookSecrets(config).length === 0) {
+    throw invalid("Persona verification is not configured.", "persona_not_configured");
+  }
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(config.apiVersion)) {
+    throw invalid("Persona API version is invalid.", "persona_api_version_invalid");
+  }
+  const expectedKeyPrefix = environment === "production" ? "persona_production_" : "persona_sandbox_";
+  if (!config.apiKey.startsWith(expectedKeyPrefix)) {
+    throw invalid("Persona API key does not match the pinned environment.", "persona_credential_environment_mismatch");
+  }
+  assertPublishedVersion(config.idvTemplateVersion, "idv template");
+  assertPublishedVersion(config.associatedPersonTemplateVersion, "associated person template");
+  assertPublishedVersion(config.kybWorkflowVersion, "KYB workflow");
+  validateFieldMap(config.kybFieldMap);
+  validateStatusMappings(config.statusMappings);
+  if (environment === "production" && (!config.allowedOrigins || config.allowedOrigins.length === 0)) {
+    throw invalid("Persona production embedding origin allowlist is missing.", "persona_allowed_origins_missing");
+  }
+}
+function assertPublishedVersion(value, label) {
+  if (!/^[A-Za-z0-9._-]{3,128}$/.test(value) || /draft|latest|unpublished/i.test(value)) {
+    throw invalid(`Persona ${label} version must be a published version pin.`, "persona_unpublished_version");
+  }
+}
+function invalid(message, safeCode2) {
+  return new ProviderError("INVALID_CONFIGURATION", message, { safeCode: safeCode2 });
+}
+function pick(values, camel, conventional) {
+  return values[camel]?.trim() || values[conventional]?.trim() || "";
+}
+function optional(values, camel, conventional) {
+  const value = pick(values, camel, conventional);
+  return value || void 0;
+}
+function parseTolerance(value) {
+  if (value == null || value === "") return void 0;
+  const parsed = Number(value);
+  return Number.isInteger(parsed) && parsed >= 60 && parsed <= 900 ? parsed : 300;
+}
+function parseAllowedOrigins(value) {
+  if (!value) return void 0;
+  const result = [];
+  for (const candidate of value.split(",")) {
+    try {
+      const origin = new URL(candidate.trim()).origin;
+      if (!origin.startsWith("https:")) {
+        throw invalid("Persona embedding origins must be HTTPS.", "persona_origin_invalid");
+      }
+      if (!result.includes(origin)) result.push(origin);
+    } catch (error) {
+      if (error instanceof ProviderError) throw error;
+      throw invalid("Persona embedding origin allowlist is invalid.", "persona_origin_invalid");
+    }
+  }
+  return result;
+}
+function parseKybCaseMode(value) {
+  const normalized = value?.trim() || "workflow_managed";
+  if (normalized !== "workflow_managed" && normalized !== "engine_managed") {
+    throw invalid("Persona KYB case mode is invalid.", "persona_kyb_case_mode_invalid");
+  }
+  return normalized;
+}
+function parseFieldMap(value) {
+  if (!value) return DEFAULT_KYB_FIELD_MAP;
+  try {
+    const parsed = JSON.parse(value);
+    validateFieldMap(parsed);
+    return parsed;
+  } catch (error) {
+    if (error instanceof ProviderError) throw error;
+    throw invalid("Persona KYB field map is invalid.", "persona_field_map_invalid");
+  }
+}
+function validateFieldMap(value) {
+  const keys = Object.keys(DEFAULT_KYB_FIELD_MAP);
+  if (!value || keys.some((key) => typeof value[key] !== "string" || !/^[a-z][a-z0-9_-]{1,127}$/.test(value[key]))) {
+    throw invalid("Persona KYB field map is invalid.", "persona_field_map_invalid");
+  }
+  if (new Set(keys.map((key) => value[key])).size !== keys.length) {
+    throw invalid("Persona KYB field map contains duplicate fields.", "persona_field_map_duplicate");
+  }
+}
+function parseStatusMappings(value) {
+  if (!value) return void 0;
+  try {
+    const parsed = JSON.parse(value);
+    validateStatusMappings(parsed);
+    return parsed;
+  } catch (error) {
+    if (error instanceof ProviderError) throw error;
+    throw invalid("Persona status mappings are invalid.", "persona_status_mappings_invalid");
+  }
+}
+function validateStatusMappings(value) {
+  if (!value) return;
+  for (const [resource, mappings] of Object.entries(value)) {
+    if (!["inquiry", "transaction", "case", "report", "verification"].includes(resource) || !mappings || typeof mappings !== "object" || Array.isArray(mappings)) {
+      throw invalid("Persona status mappings are invalid.", "persona_status_mappings_invalid");
+    }
+    for (const [providerStatus, normalized] of Object.entries(mappings)) {
+      if (!/^[a-z0-9_-]{2,64}$/.test(providerStatus) || typeof normalized !== "string" || !isCanonicalStatus(normalized)) {
+        throw invalid("Persona status mappings are invalid.", "persona_status_mappings_invalid");
+      }
+    }
+  }
+}
+
+// src/constants.ts
+var PERSONA_API_HOST = "api.withpersona.com";
+var PERSONA_INQUIRY_HOST = "inquiry.withpersona.com";
+var PERSONA_DISCLOSURE = "Powered by Persona";
+var PERSONA_NORMALIZATION_VERSION = "persona-v1";
+var PERSONA_ALLOWED_EVENTS = /* @__PURE__ */ new Set([
+  "inquiry.created",
+  "inquiry.started",
+  "inquiry.pending",
+  "inquiry.completed",
+  "inquiry.marked-for-review",
+  "inquiry.approved",
+  "inquiry.declined",
+  "inquiry.failed",
+  "inquiry.expired",
+  "inquiry.redacted",
+  "transaction.created",
+  "transaction.status-updated",
+  "transaction.updated",
+  "transaction.redacted",
+  "case.created",
+  "case.assigned",
+  "case.resolved",
+  "case.reopened",
+  "case.updated",
+  "case.status-updated",
+  "case.redacted",
+  "report.created",
+  "report.ready",
+  "report.failed",
+  "report.redacted",
+  "verification.created",
+  "verification.passed",
+  "verification.failed",
+  "verification.redacted"
+]);
+var HUMAN_PACKAGES = /* @__PURE__ */ new Set(["human_idv"]);
+var INQUIRY_PACKAGES = /* @__PURE__ */ new Set(["human_idv", "associated_person_idv"]);
+var personaProviderManifest = defineProviderManifest({
+  contractVersion: VERIFICATION_ADAPTER_CONTRACT_VERSION,
+  adapterVersion: "1.0.0",
+  engineCompatibility: "1.0.0",
+  provider: "persona",
+  displayName: "Persona",
+  description: "Persona identity verification: human IDV, business KYB, associated people, and ownership review. Documents remain at Persona; adapters return opaque evidence references only.",
+  supportedPackages: ["human_idv", "business_kyb", "associated_person_idv", "ownership_review"],
+  supportedCountries: ["US"],
+  environments: ["sandbox", "production"],
+  capabilities: {
+    presentations: ["embedded", "hosted", "qr", "none"],
+    canResume: true,
+    canRetry: true,
+    canCancel: true,
+    canRedact: true
+  },
+  launcherKeys: ["persona_embedded", "hosted"],
+  launchPresentations: ["embedded", "hosted", "qr", "none"],
+  configurationSchemaVersion: "urn:splitin:verification:config:persona:v1",
+  configurationSchema: {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    type: "object",
+    additionalProperties: false,
+    required: [
+      "apiKey",
+      "environmentId",
+      "idvTemplateId",
+      "idvTemplateVersion",
+      "associatedPersonTemplateId",
+      "associatedPersonTemplateVersion",
+      "kybTransactionTypeId",
+      "kybWorkflowId",
+      "kybWorkflowVersion",
+      "caseTemplateId",
+      "apiVersion",
+      "webhookSecretCurrent"
+    ],
+    properties: {
+      apiKey: secretStringProperty(),
+      environmentId: plainStringProperty(),
+      idvTemplateId: plainStringProperty(),
+      idvTemplateVersion: plainStringProperty(),
+      associatedPersonTemplateId: plainStringProperty(),
+      associatedPersonTemplateVersion: plainStringProperty(),
+      kybTransactionTypeId: plainStringProperty(),
+      kybWorkflowId: plainStringProperty(),
+      kybWorkflowVersion: plainStringProperty(),
+      caseTemplateId: plainStringProperty(),
+      caseType: plainStringProperty(),
+      ownershipCaseType: { type: "string", minLength: 1, "x-secret": false },
+      businessAuthorityCaseType: { type: "string", minLength: 1, "x-secret": false },
+      kybCaseMode: { type: "string", enum: ["workflow_managed", "engine_managed"] },
+      kybFieldMapJson: { type: "string", minLength: 1, "x-secret": false },
+      statusMappingsJson: { type: "string", minLength: 1, "x-secret": false },
+      apiVersion: { type: "string", pattern: "^\\d{4}-\\d{2}-\\d{2}$" },
+      webhookSecretCurrent: secretStringProperty(),
+      webhookSecretPrevious: { type: "string", minLength: 1, "x-secret": true },
+      webhookToleranceSeconds: { type: "integer", minimum: 60, maximum: 900 },
+      allowedOrigins: { type: "string", minLength: 1, "x-secret": false }
+    }
+  },
+  webhook: {
+    protocol: "persona_hmac_sha256",
+    eventFamilies: ["inquiry", "transaction", "case", "report", "verification"],
+    toleranceSeconds: 300
+  },
+  dataPolicy: {
+    classifications: ["provider_resource_id", "normalized_status", "reason_codes", "evidence_reference"],
+    prohibitedPersistence: ["raw_webhook", "launch_secret", "document", "selfie", "government_id"],
+    rawPayloadPersistence: false,
+    browserSecretPersistence: false,
+    governmentIdentifierPersistence: false
+  },
+  retry: { sameResourceWhenResumable: true, newAttemptAfterTerminal: true },
+  cancellation: { supported: true, terminal: true },
+  redaction: { supported: true, asynchronous: false },
+  apiHosts: ["api.withpersona.com"],
+  testedApiVersions: ["2023-01-05"]
+});
+
+// src/status.ts
+function normalizePersonaStatus(value) {
+  switch (normalizeStatusKey(value)) {
+    case "created":
+      return { status: "created", reasonCodes: [] };
+    case "started":
+    case "pending":
+      return { status: "pending_user_input", reasonCodes: [] };
+    case "completed":
+      return { status: "processing", reasonCodes: ["persona_completed_awaiting_decision"] };
+    case "approved":
+    case "passed":
+      return { status: "verified", reasonCodes: [] };
+    case "declined":
+      return { status: "declined", reasonCodes: ["persona_declined"] };
+    case "marked_for_review":
+    case "needs_review":
+    case "in_review":
+    case "open":
+      return { status: "manual_review_required", reasonCodes: ["persona_manual_review_required"] };
+    case "failed":
+    case "errored":
+      return { status: "failed", reasonCodes: ["persona_verification_failed"] };
+    case "expired":
+      return { status: "expired", reasonCodes: ["persona_inquiry_expired"] };
+    case "canceled":
+    case "cancelled":
+      return { status: "canceled", reasonCodes: ["persona_inquiry_canceled"] };
+    case "redacted":
+      return { status: "redacted", reasonCodes: ["persona_redacted"] };
+    default:
+      return { status: "manual_review_required", reasonCodes: ["persona_unknown_status"] };
+  }
+}
+function resolvePersonaStatus(resourceKind, providerStatus, mappings) {
+  const configured = mappings?.[resourceKind]?.[normalizeStatusKey(providerStatus)];
+  return configured ? { status: configured, reasonCodes: [] } : normalizePersonaStatus(providerStatus);
+}
+function normalizeStatusKey(value) {
+  return String(value ?? "").trim().toLowerCase().replace(/[ -]+/g, "_");
+}
+function resourceCategory(value) {
+  if (value === "inquiry" || value === "transaction" || value === "case") return value;
+  if (value.startsWith("report")) return "report";
+  if (value.startsWith("verification")) return "verification";
+  return "verification";
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function asOptionalRecord(value) {
+  return isRecord(value) ? value : null;
+}
+function asRecord(value) {
+  if (!isRecord(value)) throw new ProviderError("UNKNOWN_PROVIDER_STATE", "Persona resource is invalid.", {
+    safeCode: "malformed_provider_response"
+  });
+  return value;
+}
+function requireResource(value, type) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new ProviderError("UNKNOWN_PROVIDER_STATE", "Persona resource is invalid.", {
+      safeCode: "malformed_provider_response"
+    });
+  }
+  if (type && value.type !== type) {
+    throw new ProviderError("UNKNOWN_PROVIDER_STATE", "Persona resource type is invalid.", {
+      safeCode: "malformed_provider_response"
+    });
+  }
+  return value;
+}
+function requireId(value) {
+  if (typeof value !== "string" || value.length < 4 || value.length > 256 || /\s/.test(value)) {
+    throw new ProviderError("UNKNOWN_PROVIDER_STATE", "Persona resource ID is invalid.", {
+      safeCode: "malformed_provider_response"
+    });
+  }
+  return value;
+}
+function requireText(value, label) {
+  if (typeof value !== "string" || value.trim().length === 0 || value.length > 256) {
+    throw new ProviderError("UNKNOWN_PROVIDER_STATE", `${label} is invalid.`, {
+      safeCode: "malformed_provider_response"
+    });
+  }
+  return value;
+}
+function assertOpaqueReference(value) {
+  if (!isOpaqueSubjectReference(value)) {
+    throw new ProviderError("TERMINAL_INPUT_FAILURE", "The subject reference is not an opaque identifier.", {
+      safeCode: "subject_reference_invalid"
+    });
+  }
+  return value;
+}
+function isTransactionId(value) {
+  return /^txn_[A-Za-z0-9_-]{4,252}$/.test(value);
+}
+function isCaseId(value) {
+  return /^case_[A-Za-z0-9_-]{4,251}$/.test(value);
+}
+function parseRetryAfter(value) {
+  if (!value || !/^\d{1,6}$/.test(value)) return void 0;
+  return Math.min(Number(value), 3600);
+}
+function mapPersonaHttpError(status, retryAfterHeader) {
+  const retryAfter = parseRetryAfter(retryAfterHeader);
+  const code = status === 401 || status === 403 ? "AUTHENTICATION_FAILED" : status === 429 ? "RATE_LIMITED" : status === 408 || status === 504 ? "TIMEOUT" : status >= 500 ? "RETRYABLE_PROVIDER_FAILURE" : "TERMINAL_INPUT_FAILURE";
+  return new ProviderError(code, "Persona request failed.", {
+    retryable: status === 408 || status === 429 || status >= 500,
+    retryAfterSeconds: retryAfter,
+    safeCode: code === "AUTHENTICATION_FAILED" ? "persona_authentication_failed" : code === "RATE_LIMITED" ? "persona_rate_limited" : code === "TIMEOUT" ? "persona_timeout" : code === "RETRYABLE_PROVIDER_FAILURE" ? "persona_provider_failure" : "persona_terminal_input_failure"
+  });
+}
+function legalPrefill(command) {
+  const fields = {};
+  const first = safePrefill(command.legalFirstName);
+  const last = safePrefill(command.legalLastName);
+  const email = safePrefill(command.email);
+  if (first) fields["name-first"] = first;
+  if (last) fields["name-last"] = last;
+  if (email) fields["email-address"] = email;
+  return fields;
+}
+function businessFields(command, map) {
+  const organization = command.organization;
+  if (!organization) throw new ProviderRequiredInformationError();
+  const fields = {
+    [map.legalName]: requiredCanonicalText(organization.legalName, 256),
+    [map.jurisdictionCountryCode]: normalizeCountryCode(organization.jurisdictionCountryCode)
+  };
+  if (organization.registeredAddress) fields[map.registeredAddress] = canonicalAddress(organization.registeredAddress);
+  if (organization.physicalAddress) fields[map.physicalAddress] = canonicalAddress(organization.physicalAddress);
+  const entityType = safePrefill(organization.entityType);
+  if (entityType) fields[map.entityType] = entityType;
+  const associatedPeople = (organization.associatedPeople ?? []).map((person) => {
+    const percentage = person.claimedOwnershipPercentage;
+    if (percentage !== null && percentage !== void 0 && (!Number.isFinite(percentage) || percentage < 0 || percentage > 100)) {
+      throw new ProviderRequiredInformationError("Ownership percentage is invalid.");
+    }
+    const result = {
+      subject_reference: assertOpaqueReference(person.subjectReference),
+      name_first: requiredCanonicalText(person.legalFirstName, 128),
+      name_last: requiredCanonicalText(person.legalLastName, 128),
+      association: person.relationshipKind
+    };
+    const email = safePrefill(person.email);
+    if (email) result.email_address = email;
+    if (percentage !== null && percentage !== void 0) result.percentage_ownership = percentage;
+    return result;
+  });
+  if (associatedPeople.length > 0) fields[map.associatedPeople] = associatedPeople;
+  const evidence = (organization.evidenceReferences ?? command.evidenceReferences ?? []).map((value) => ({
+    id: requireId(value),
+    type: "evidence"
+  }));
+  if (evidence.length > 0) fields[map.evidenceReferences] = evidence;
+  if (command.relationship) {
+    fields[map.relationshipReference] = assertOpaqueReference(command.relationship.relationshipReference);
+    fields[map.relationshipKind] = command.relationship.kind;
+    const percentage = command.relationship.claimedOwnershipPercentage;
+    if (percentage !== null && percentage !== void 0) {
+      if (!Number.isFinite(percentage) || percentage < 0 || percentage > 100) {
+        throw new ProviderRequiredInformationError("Ownership percentage is invalid.");
+      }
+      fields[map.claimedOwnershipPercentage] = percentage;
+    }
+    if (command.relationship.subjectReference) {
+      fields[map.subjectReference] = assertOpaqueReference(command.relationship.subjectReference);
+    }
+  }
+  return fields;
+}
+function canonicalAddress(value) {
+  const result = {
+    street_1: requiredCanonicalText(value.street1, 256),
+    city: requiredCanonicalText(value.city, 128),
+    postal_code: requiredCanonicalText(value.postalCode, 32),
+    country_code: normalizeCountryCode(value.countryCode)
+  };
+  const street2 = safePrefill(value.street2);
+  const subdivision = safePrefill(value.subdivision);
+  if (street2) result.street_2 = street2;
+  if (subdivision) result.subdivision = subdivision;
+  return result;
+}
+function parseAssociatedPersonRequirements(fieldsValue, fieldKey) {
+  const fields = asOptionalRecord(fieldsValue);
+  const field = fields?.[fieldKey];
+  const fieldRecord = asOptionalRecord(field);
+  const value = fieldRecord && "value" in fieldRecord ? fieldRecord.value : field;
+  if (!Array.isArray(value)) return [];
+  const result = [];
+  for (const candidate of value.slice(0, 100)) {
+    const item = asOptionalRecord(candidate);
+    if (!item) continue;
+    const subjectReference = firstString(item, ["subject_reference", "subject-reference", "account_reference_id"]);
+    const requirementKind = normalizeRequirementKind(firstString(item, ["requirement_kind", "requirement-kind", "association"]));
+    const verificationMode = normalizeVerificationMode(firstString(item, ["verification_mode", "verification-mode"]));
+    const providerStatus = firstString(item, ["status", "verification_status", "verification-status"]);
+    if (!subjectReference || !isOpaqueSubjectReference(subjectReference) || !requirementKind || !verificationMode || !providerStatus) continue;
+    const inquiryId = firstString(item, ["inquiry_id", "inquiry-id"]);
+    result.push({
+      subjectReference,
+      inquiryId: inquiryId && /^inq_[A-Za-z0-9_-]{4,252}$/.test(inquiryId) ? inquiryId : null,
+      requirementKind,
+      verificationMode,
+      normalizedStatus: normalizeAssociatedRequirementStatus(providerStatus, verificationMode),
+      mandatory: item.mandatory !== false && item.is_mandatory !== false && item["is-mandatory"] !== false,
+      claimedOwnershipPercentage: typeof item.percentage_ownership === "number" && Number.isFinite(item.percentage_ownership) && item.percentage_ownership >= 0 && item.percentage_ownership <= 100 ? item.percentage_ownership : null
+    });
+  }
+  return result;
+}
+function firstString(value, keys) {
+  for (const key of keys) {
+    if (typeof value[key] === "string" && String(value[key]).trim()) return String(value[key]).trim();
+  }
+  return null;
+}
+function normalizeRequirementKind(value) {
+  const normalized = normalizeStatusKey(value ?? "");
+  if (normalized === "ubo" || normalized === "director" || normalized === "officer" || normalized === "authorized_representative" || normalized === "associated_person") return normalized;
+  return null;
+}
+function normalizeVerificationMode(value) {
+  const normalized = normalizeStatusKey(value ?? "");
+  if (normalized === "not_required" || normalized === "database" || normalized === "inquiry") return normalized;
+  return null;
+}
+function normalizeAssociatedRequirementStatus(value, mode) {
+  const normalized = normalizeStatusKey(value);
+  if (mode === "not_required" || normalized === "not_required") return "not_required";
+  if (normalized === "approved" || normalized === "passed" || normalized === "verified") return "verified";
+  if (normalized === "completed" || normalized === "processing") return "processing";
+  if (normalized === "needs_review" || normalized === "marked_for_review" || normalized === "in_review") return "manual_review_required";
+  if (normalized === "declined") return "declined";
+  if (normalized === "failed" || normalized === "errored") return "failed";
+  if (normalized === "expired") return "expired";
+  if (normalized === "canceled" || normalized === "cancelled") return "canceled";
+  if (normalized === "required") return "required";
+  return "pending";
+}
+function requiredCanonicalText(value, maxLength) {
+  const trimmed = value?.trim();
+  if (!trimmed || trimmed.length > maxLength) throw new ProviderRequiredInformationError();
+  return trimmed;
+}
+function normalizeCountryCode(value) {
+  const normalized = value.trim().toUpperCase();
+  if (!/^[A-Z]{2}$/.test(normalized)) throw new ProviderRequiredInformationError();
+  return normalized;
+}
+function safePrefill(value) {
+  const trimmed = value?.trim();
+  return trimmed && trimmed.length <= 254 ? trimmed : null;
+}
+function parseObject(value) {
+  try {
+    const result = JSON.parse(value);
+    if (!isRecord(result)) throw new Error();
+    return result;
+  } catch {
+    throw new ProviderError("TERMINAL_INPUT_FAILURE", "Persona webhook JSON is invalid.", {
+      safeCode: "persona_webhook_payload_invalid"
+    });
+  }
+}
+function safeDate(value, fallback) {
+  const parsed = typeof value === "string" ? new Date(value) : fallback;
+  return Number.isFinite(parsed.getTime()) ? parsed.toISOString() : fallback.toISOString();
+}
+function safeOptionalDate(value) {
+  if (typeof value !== "string") return void 0;
+  const parsed = new Date(value);
+  return Number.isFinite(parsed.getTime()) ? parsed.toISOString() : void 0;
+}
+function statusFromEvent(name) {
+  return name.split(".").at(-1) ?? "needs_review";
+}
+function safeCode(value) {
+  if (typeof value !== "string") return null;
+  const normalized = value.trim().toLowerCase().replace(/[^a-z0-9_-]+/g, "_").slice(0, 64);
+  return normalized || null;
+}
+function findAssociatedPerson(payload) {
+  if (!Array.isArray(payload.included)) return null;
+  for (const value of payload.included) {
+    const resource = asOptionalRecord(value);
+    if (resource?.type !== "inquiry") continue;
+    const attributes = asOptionalRecord(resource.attributes);
+    const reference = attributes?.["reference-id"];
+    if (typeof reference === "string" && isOpaqueSubjectReference(reference) && typeof resource.id === "string") {
+      return { reference, inquiryId: requireId(resource.id) };
+    }
+  }
+  return null;
+}
+function caseRelatedResourceType(value) {
+  if (value === "inquiry" || value === "transaction") return value;
+  if (value.startsWith("report")) return "report";
+  if (value.startsWith("verification")) return "verification";
+  return null;
+}
+function redactionCollection(resourceType) {
+  if (resourceType === "case") return "cases";
+  if (resourceType === "account") return "accounts";
+  if (resourceType === "transaction") return "transactions";
+  if (resourceType === "report") return "reports";
+  if (resourceType === "verification") return "verifications";
+  return "inquiries";
+}
+var RESUMABLE_STATUSES = /* @__PURE__ */ new Set(["created", "pending_user_input", "paused"]);
+var HEX_64 = /^[0-9a-f]{64}$/i;
+async function verifyPersonaWebhook(request, options) {
+  const signatureHeader = request.headers.get("Persona-Signature");
+  const environmentId = request.headers.get("Persona-Environment-Id");
+  const secrets = options.secrets.map((value) => value.trim()).filter(Boolean);
+  if (!signatureHeader || secrets.length === 0 || environmentId !== options.expectedEnvironmentId) {
+    throw signatureFailure("Persona webhook authentication is invalid.");
+  }
+  const candidates = parsePersonaSignatures(signatureHeader);
+  if (candidates.length === 0) throw signatureFailure("Persona webhook signature is invalid.");
+  const nowSeconds = Math.floor((options.now?.() ?? /* @__PURE__ */ new Date()).getTime() / 1e3);
+  const tolerance = options.toleranceSeconds ?? 300;
+  const rawBytes = new Uint8Array(await request.arrayBuffer());
+  if (rawBytes.byteLength === 0 || rawBytes.byteLength > 1048576) {
+    throw payloadFailure("Persona webhook body size is invalid.");
+  }
+  let matched = null;
+  for (const candidate of candidates) {
+    if (Math.abs(nowSeconds - candidate.timestamp) > tolerance) continue;
+    for (const secret of secrets) {
+      const expected = await hmacSha256Hex(options.crypto, secret, signedPayload(candidate.timestamp, rawBytes));
+      if (timingSafeHexEqual(expected, candidate.signature)) {
+        matched = candidate;
+        break;
+      }
+    }
+    if (matched) break;
+  }
+  if (!matched) throw signatureFailure("Persona webhook signature is invalid or stale.");
+  const bodySha256 = await sha256HexBytes(options.crypto, rawBytes);
+  let transientJson;
+  try {
+    transientJson = JSON.parse(new TextDecoder().decode(rawBytes));
+  } catch {
+    transientJson = null;
+  }
+  let providerEventKey;
+  try {
+    providerEventKey = readPersonaEventId(transientJson);
+  } catch {
+    providerEventKey = `persona_${bodySha256}`;
+  }
+  return {
+    providerEventKey,
+    receivedAt: new Date(nowSeconds * 1e3).toISOString(),
+    signatureIssuedAt: new Date(matched.timestamp * 1e3).toISOString(),
+    bodySha256,
+    opaquePayload: rawBytes
+  };
+}
+function parsePersonaSignatures(header) {
+  const groups = header.trim().split(/\s+/);
+  const result = [];
+  for (const group of groups) {
+    let timestamp = null;
+    const signatures = [];
+    for (const part of group.split(",")) {
+      const [key, value] = part.split("=", 2);
+      if (key === "t" && /^\d{1,12}$/.test(value ?? "")) timestamp = Number(value);
+      if (key === "v1" && HEX_64.test(value ?? "")) signatures.push((value ?? "").toLowerCase());
+    }
+    if (timestamp !== null && Number.isSafeInteger(timestamp)) {
+      for (const signature of signatures) result.push({ timestamp, signature });
+    }
+  }
+  return result;
+}
+function signedPayload(timestamp, rawBody) {
+  const prefix = new TextEncoder().encode(`${timestamp}.`);
+  const result = new Uint8Array(prefix.length + rawBody.length);
+  result.set(prefix);
+  result.set(rawBody, prefix.length);
+  return result;
+}
+async function hmacSha256Hex(crypto, secret, value) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  return bytesToHex(new Uint8Array(await crypto.subtle.sign("HMAC", key, value)));
+}
+async function sha256HexBytes(crypto, value) {
+  return bytesToHex(new Uint8Array(await crypto.subtle.digest("SHA-256", Uint8Array.from(value))));
+}
+function timingSafeHexEqual(left, right) {
+  if (!HEX_64.test(left) || !HEX_64.test(right)) return false;
+  const a = hexToBytes(left);
+  const b = hexToBytes(right);
+  let mismatch = a.length ^ b.length;
+  for (let index = 0; index < Math.max(a.length, b.length); index += 1) {
+    mismatch |= (a[index] ?? 0) ^ (b[index] ?? 0);
+  }
+  return mismatch === 0;
+}
+function hexToBytes(value) {
+  return Uint8Array.from(value.match(/.{2}/g) ?? [], (pair) => Number.parseInt(pair, 16));
+}
+function bytesToHex(value) {
+  return Array.from(value, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function readPersonaEventId(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw payloadFailure("Persona webhook JSON is invalid.");
+  }
+  const data = value.data;
+  if (!data || typeof data !== "object" || Array.isArray(data)) {
+    throw payloadFailure("Persona webhook event is invalid.");
+  }
+  const id = data.id;
+  if (typeof id !== "string" || id.length < 8 || id.length > 256) {
+    throw payloadFailure("Persona webhook event ID is invalid.");
+  }
+  return id;
+}
+function signatureFailure(message) {
+  return new ProviderError("SIGNATURE_INVALID", message, {
+    retryable: false,
+    safeCode: "persona_webhook_signature_invalid"
+  });
+}
+function payloadFailure(message) {
+  return new ProviderError("TERMINAL_INPUT_FAILURE", message, {
+    retryable: false,
+    safeCode: "persona_webhook_payload_invalid"
+  });
+}
+
+// src/adapter.ts
+var PersonaVerificationAdapter = class {
+  contractVersion = VERIFICATION_ADAPTER_CONTRACT_VERSION;
+  manifest = personaProviderManifest;
+  provider = "persona";
+  environment;
+  runtime;
+  constructor(runtime) {
+    this.runtime = runtime;
+    this.environment = runtime.environment;
+    this.validateConfiguration();
+  }
+  validateConfiguration() {
+    validatePersonaConfiguration(this.runtime.configuration, this.environment);
+  }
+  async createAttempt(command) {
+    this.assertCommand(command);
+    this.assertAllowedOrigin(command.requestOrigin);
+    if (command.packageCode === "business_kyb") return this.createBusinessTransaction(command);
+    if (command.packageCode === "ownership_review") return this.createOwnershipReviewCase(command);
+    const template = this.templateFor(command.packageCode);
+    const attributes = {
+      "inquiry-template-id": template.id,
+      "inquiry-template-version-id": template.version,
+      "reference-id": assertOpaqueReference(command.subjectReference)
+    };
+    const fields = legalPrefill(command);
+    if (Object.keys(fields).length > 0) attributes.fields = fields;
+    const result = await this.call("/inquiries", {
+      method: "POST",
+      operation: "create",
+      idempotencyKey: command.idempotencyKey,
+      body: { data: { attributes } }
+    });
+    const inquiry = requireResource(result.data, "inquiry");
+    const status = requireText(inquiry.attributes?.status, "Persona inquiry status");
+    return {
+      attemptId: command.attemptId,
+      providerResourceId: requireId(inquiry.id),
+      providerStatus: status,
+      canonicalStatus: this.normalizeStatus("inquiry", status).status,
+      launch: await this.launchFor(command.attemptId, inquiry)
+    };
+  }
+  async resumeAttempt(command) {
+    this.assertAllowedOrigin(command.requestOrigin);
+    if (isTransactionId(command.providerResourceId) || isCaseId(command.providerResourceId)) {
+      if (isTransactionId(command.providerResourceId)) await this.getTransaction(command.providerResourceId, "resume");
+      else await this.getCase(command.providerResourceId, "resume");
+      return this.nonInteractiveLaunch(command.attemptId, "processing");
+    }
+    const inquiry = await this.getInquiry(command.providerResourceId, "resume");
+    return this.launchFor(command.attemptId, inquiry);
+  }
+  async retrieveAttempt(command) {
+    const resourceKind = isTransactionId(command.providerResourceId) ? "transaction" : isCaseId(command.providerResourceId) ? "case" : "inquiry";
+    const resource = resourceKind === "transaction" ? await this.getTransaction(command.providerResourceId, "retrieve") : resourceKind === "case" ? await this.getCase(command.providerResourceId, "retrieve") : await this.getInquiry(command.providerResourceId, "retrieve");
+    const providerStatus = requireText(resource.attributes?.status, `Persona ${resourceKind} status`);
+    const normalized = this.normalizeStatus(resourceKind, providerStatus);
+    return {
+      providerResourceId: requireId(resource.id),
+      providerStatus,
+      canonicalStatus: normalized.status,
+      occurredAt: safeDate(resource.attributes?.["updated-at"] ?? resource.attributes?.["created-at"], this.runtime.now()),
+      normalizedReasonCodes: normalized.reasonCodes,
+      safeMetadata: {
+        source: "retrieve",
+        adapter_version: this.manifest.adapterVersion,
+        event_version: this.runtime.configuration.apiVersion,
+        normalization_version: PERSONA_NORMALIZATION_VERSION,
+        provider_environment: this.environment,
+        provider_event_category: resourceKind
+      }
+    };
+  }
+  async retryAttempt(command) {
+    this.assertCommand(command);
+    if (command.previousProviderResourceId) {
+      const previous = await this.retrieveAttempt({
+        attemptId: command.attemptId,
+        providerResourceId: command.previousProviderResourceId,
+        configurationRevision: command.configurationRevision,
+        requestOrigin: command.requestOrigin
+      });
+      if (RESUMABLE_STATUSES.has(previous.canonicalStatus)) {
+        return {
+          attemptId: command.attemptId,
+          providerResourceId: previous.providerResourceId,
+          providerStatus: previous.providerStatus,
+          canonicalStatus: previous.canonicalStatus,
+          launch: await this.resumeAttempt({
+            attemptId: command.attemptId,
+            providerResourceId: previous.providerResourceId,
+            configurationRevision: command.configurationRevision,
+            requestOrigin: command.requestOrigin
+          })
+        };
+      }
+      if (previous.canonicalStatus === "processing") {
+        throw new ProviderError("RETRYABLE_PROVIDER_FAILURE", "Persona is still processing this attempt.", {
+          retryable: true,
+          retryAfterSeconds: 15,
+          safeCode: "persona_attempt_processing"
+        });
+      }
+      if (previous.canonicalStatus === "manual_review_required" || previous.canonicalStatus === "verified") {
+        throw new ProviderError("TERMINAL_INPUT_FAILURE", "Persona review state cannot be retried.", {
+          safeCode: previous.canonicalStatus === "verified" ? "persona_attempt_already_verified" : "persona_manual_review_pending"
+        });
+      }
+    }
+    const idempotencyKey = this.runtime.idempotency.keyFor("retry", command.attemptId, command.idempotencyKey);
+    return this.createAttempt({ ...command, idempotencyKey });
+  }
+  async cancelAttempt(command) {
+    if (isTransactionId(command.providerResourceId) || isCaseId(command.providerResourceId)) {
+      throw new ProviderError("UNSUPPORTED_CAPABILITY", "Persona does not support canceling non-interactive transactions or cases.", {
+        safeCode: "persona_noninteractive_cancel_unsupported"
+      });
+    }
+    const result = await this.call(
+      `/inquiries/${encodeURIComponent(requireId(command.providerResourceId))}/expire`,
+      {
+        method: "POST",
+        operation: "cancel",
+        idempotencyScope: command.attemptId,
+        idempotencyKey: `cancel:${command.attemptId}`,
+        body: {}
+      }
+    );
+    const inquiry = requireResource(result.data, "inquiry");
+    const providerStatus = requireText(inquiry.attributes?.status, "Persona inquiry status");
+    return {
+      accepted: true,
+      providerStatus,
+      canonicalStatus: this.normalizeStatus("inquiry", providerStatus).status
+    };
+  }
+  async redactSubject(command) {
+    if (!command.providerResourceId) return { completed: true, retryable: false, disposition: "not_applicable" };
+    try {
+      const collection = redactionCollection(command.providerResourceType);
+      await this.call(`/${collection}/${encodeURIComponent(requireId(command.providerResourceId))}`, {
+        method: "DELETE",
+        operation: "redact",
+        idempotencyScope: command.requestReference,
+        idempotencyKey: command.requestReference,
+        allowNotFound: true
+      });
+      return { completed: true, retryable: false, disposition: "redacted" };
+    } catch (error) {
+      return {
+        completed: false,
+        retryable: error instanceof ProviderError && error.retryable,
+        disposition: error instanceof ProviderError && error.retryable ? "retryable" : "failed"
+      };
+    }
+  }
+  verifyWebhook(request) {
+    return verifyPersonaWebhook(request, {
+      secrets: personaWebhookSecrets(this.runtime.configuration),
+      expectedEnvironmentId: this.runtime.configuration.environmentId,
+      toleranceSeconds: this.runtime.configuration.webhookToleranceSeconds ?? this.manifest.webhook.toleranceSeconds,
+      now: this.runtime.now,
+      crypto: this.runtime.crypto
+    });
+  }
+  async normalizeWebhook(input) {
+    try {
+      const body = parseObject(new TextDecoder().decode(input.opaquePayload));
+      const event = requireResource(body.data, "event");
+      const name = requireText(event.attributes?.name, "Persona event name");
+      const eventAllowlisted = PERSONA_ALLOWED_EVENTS.has(name);
+      const payload = asRecord(event.attributes?.payload);
+      const resource = requireResource(payload.data);
+      const providerStatus = String(resource.attributes?.status ?? statusFromEvent(name));
+      const resourceKind = requireText(resource.type, "Persona resource type");
+      const normalized = eventAllowlisted ? this.normalizeStatus(resourceCategory(resourceKind), providerStatus) : { status: "manual_review_required", reasonCodes: ["persona_unknown_event"] };
+      const associatedPerson = findAssociatedPerson(payload);
+      const isCase = resourceKind === "case";
+      const isTransaction = resourceKind === "transaction";
+      return {
+        providerEventKey: input.providerEventKey,
+        providerResourceId: requireId(resource.id),
+        eventType: `verification.provider_event.${normalized.status}`,
+        providerEventType: name,
+        canonicalStatus: normalized.status,
+        occurredAt: safeDate(event.attributes?.["created-at"], this.runtime.now()),
+        normalizedReasonCodes: normalized.reasonCodes,
+        safeMetadata: {
+          adapter_version: this.manifest.adapterVersion,
+          event_version: this.runtime.configuration.apiVersion,
+          normalization_version: PERSONA_NORMALIZATION_VERSION,
+          provider_environment: this.environment,
+          provider_event_category: resourceKind,
+          provider_status: providerStatus,
+          event_allowlisted: eventAllowlisted,
+          reconcile_required: !eventAllowlisted || normalized.reasonCodes.includes("persona_unknown_status"),
+          ...isCase ? {
+            provider_case_id: requireId(resource.id),
+            case_status: providerStatus,
+            case_resolution: safeCode(resource.attributes?.resolution)
+          } : {},
+          ...isTransaction ? {
+            provider_transaction_id: requireId(resource.id),
+            transaction_status: providerStatus
+          } : {},
+          ...associatedPerson ? {
+            associated_subject_reference: associatedPerson.reference,
+            associated_inquiry_id: associatedPerson.inquiryId,
+            associated_requirement_kind: "associated_person"
+          } : {},
+          redacted: name.endsWith(".redacted")
+        }
+      };
+    } catch (error) {
+      if (error instanceof ProviderError && error.code === "TERMINAL_INPUT_FAILURE") throw error;
+      throw new ProviderError("TERMINAL_INPUT_FAILURE", "Persona webhook payload is invalid.", {
+        safeCode: "persona_webhook_payload_invalid",
+        cause: error
+      });
+    }
+  }
+  async retrieveCaseTree(providerCaseId) {
+    const result = await this.call(
+      `/cases/${encodeURIComponent(requireId(providerCaseId))}?include=inquiries,txns,reports,verifications`,
+      { method: "GET", operation: "retrieve" }
+    );
+    const reviewCase = requireResource(result.data, "case");
+    const relatedResources = [];
+    const associatedPersonRequirements = [];
+    let associatedPersonDiscoveryComplete = false;
+    for (const candidate of result.included ?? []) {
+      const rawType = requireText(candidate.type, "Persona related resource type");
+      const resourceType = caseRelatedResourceType(rawType);
+      if (!resourceType) continue;
+      const status = typeof candidate.attributes?.status === "string" ? candidate.attributes.status : "unknown";
+      const reference = candidate.attributes?.["reference-id"];
+      relatedResources.push({
+        resourceType,
+        resourceId: requireId(candidate.id),
+        providerStatus: status,
+        subjectReference: typeof reference === "string" && isOpaqueSubjectReference(reference) ? reference : null
+      });
+      if (resourceType === "transaction") {
+        const normalized = this.normalizeStatus("transaction", status).status;
+        if (["verified", "declined", "failed", "manual_review_required"].includes(normalized)) {
+          associatedPersonDiscoveryComplete = true;
+        }
+        associatedPersonRequirements.push(...parseAssociatedPersonRequirements(
+          candidate.attributes?.fields,
+          this.runtime.configuration.kybFieldMap.associatedPeople
+        ));
+      }
+    }
+    return {
+      caseId: requireId(reviewCase.id),
+      providerStatus: requireText(reviewCase.attributes?.status, "Persona case status"),
+      resolution: safeCode(reviewCase.attributes?.resolution),
+      occurredAt: safeDate(reviewCase.attributes?.["updated-at"] ?? reviewCase.attributes?.["created-at"], this.runtime.now()),
+      relatedResources,
+      associatedPersonRequirements,
+      associatedPersonDiscoveryComplete
+    };
+  }
+  assertCommand(command) {
+    if (!this.manifest.supportedPackages.includes(command.packageCode)) {
+      throw new ProviderError("UNSUPPORTED_CAPABILITY", "Persona does not support this verification package.", {
+        safeCode: "unsupported_package"
+      });
+    }
+    if (!isOpaqueSubjectReference(command.subjectReference)) {
+      throw new ProviderError("TERMINAL_INPUT_FAILURE", "The subject reference is not an opaque identifier.", {
+        safeCode: "subject_reference_invalid"
+      });
+    }
+    if (metadataContainsForbiddenIdentifier(command.metadata)) {
+      throw new ProviderError("TERMINAL_INPUT_FAILURE", "Attempt metadata contains a forbidden identifier.", {
+        safeCode: "forbidden_identifier"
+      });
+    }
+  }
+  assertAllowedOrigin(origin) {
+    const allowed = this.runtime.configuration.allowedOrigins ?? [];
+    if (!origin) {
+      if (this.environment === "production") {
+        throw new ProviderError("TERMINAL_INPUT_FAILURE", "Persona launch origin is missing.", {
+          safeCode: "persona_origin_required"
+        });
+      }
+      return;
+    }
+    let normalized;
+    try {
+      normalized = new URL(origin).origin;
+    } catch {
+      throw new ProviderError("TERMINAL_INPUT_FAILURE", "Persona launch origin is invalid.", {
+        safeCode: "persona_origin_invalid"
+      });
+    }
+    if (allowed.length > 0 && !allowed.includes(normalized)) {
+      throw new ProviderError("TERMINAL_INPUT_FAILURE", "Persona launch origin is not allowlisted.", {
+        safeCode: "persona_origin_denied"
+      });
+    }
+  }
+  templateFor(packageCode) {
+    if (packageCode === "associated_person_idv") {
+      return {
+        id: this.runtime.configuration.associatedPersonTemplateId,
+        version: this.runtime.configuration.associatedPersonTemplateVersion
+      };
+    }
+    if (HUMAN_PACKAGES.has(packageCode) || INQUIRY_PACKAGES.has(packageCode)) {
+      return {
+        id: this.runtime.configuration.idvTemplateId,
+        version: this.runtime.configuration.idvTemplateVersion
+      };
+    }
+    throw new ProviderError("UNSUPPORTED_CAPABILITY", "Persona package is unsupported.", {
+      safeCode: "unsupported_package"
+    });
+  }
+  async getInquiry(providerResourceId, operation) {
+    const result = await this.call(`/inquiries/${encodeURIComponent(requireId(providerResourceId))}`, {
+      method: "GET",
+      operation
+    });
+    return requireResource(result.data, "inquiry");
+  }
+  async getTransaction(providerResourceId, operation) {
+    const result = await this.call(`/transactions/${encodeURIComponent(requireId(providerResourceId))}`, {
+      method: "GET",
+      operation
+    });
+    return requireResource(result.data, "transaction");
+  }
+  async getCase(providerResourceId, operation) {
+    const result = await this.call(`/cases/${encodeURIComponent(requireId(providerResourceId))}`, {
+      method: "GET",
+      operation
+    });
+    return requireResource(result.data, "case");
+  }
+  async createOwnershipReviewCase(command) {
+    const relationshipReference = assertOpaqueReference(command.subjectReference);
+    const caseType = command.relationship?.kind === "property_owner" ? this.runtime.configuration.ownershipCaseType : this.runtime.configuration.businessAuthorityCaseType ?? this.runtime.configuration.caseType;
+    const result = await this.call("/cases", {
+      method: "POST",
+      operation: "create",
+      idempotencyKey: command.idempotencyKey,
+      body: {
+        data: {
+          attributes: {
+            "case-template-id": this.runtime.configuration.caseTemplateId,
+            fields: {
+              "case-type": caseType,
+              "relationship-reference": relationshipReference
+            }
+          }
+        }
+      }
+    });
+    const reviewCase = requireResource(result.data, "case");
+    const providerStatus = requireText(reviewCase.attributes?.status, "Persona case status");
+    return {
+      attemptId: command.attemptId,
+      providerResourceId: requireId(reviewCase.id),
+      providerStatus,
+      canonicalStatus: this.normalizeStatus("case", providerStatus).status,
+      launch: this.nonInteractiveLaunch(command.attemptId, this.normalizeStatus("case", providerStatus).status),
+      linkedResources: [{
+        resourceType: "case",
+        resourceId: requireId(reviewCase.id),
+        relationshipCode: "initial_review_case",
+        providerStatus,
+        occurredAt: safeDate(reviewCase.attributes?.["created-at"], this.runtime.now())
+      }]
+    };
+  }
+  async createBusinessTransaction(command) {
+    const fields = businessFields(command, this.runtime.configuration.kybFieldMap);
+    const created = await this.call("/transactions", {
+      method: "POST",
+      operation: "create",
+      idempotencyKey: command.idempotencyKey,
+      body: {
+        data: {
+          attributes: {
+            "transaction-type-id": this.runtime.configuration.kybTransactionTypeId,
+            "workflow-id": this.runtime.configuration.kybWorkflowId,
+            "workflow-version-id": this.runtime.configuration.kybWorkflowVersion,
+            "reference-id": assertOpaqueReference(command.subjectReference),
+            fields
+          }
+        }
+      }
+    });
+    const transaction = requireResource(created.data, "transaction");
+    const transactionId = requireId(transaction.id);
+    const transactionStatus = requireText(transaction.attributes?.status, "Persona transaction status");
+    let reviewCase = await this.findWorkflowManagedCase(transactionId);
+    if (!reviewCase && (this.runtime.configuration.kybCaseMode ?? "workflow_managed") === "engine_managed") {
+      const caseResponse = await this.call("/cases", {
+        method: "POST",
+        operation: "create",
+        idempotencyKey: `${command.idempotencyKey}:case`,
+        body: {
+          data: {
+            attributes: {
+              "case-template-id": this.runtime.configuration.caseTemplateId,
+              fields: { "case-type": this.runtime.configuration.caseType }
+            }
+          }
+        }
+      });
+      reviewCase = requireResource(caseResponse.data, "case");
+      await this.call(`/cases/${encodeURIComponent(requireId(reviewCase.id))}/add-objects`, {
+        method: "POST",
+        operation: "create",
+        idempotencyKey: `${command.idempotencyKey}:case-link`,
+        body: { meta: { "object-ids": [transactionId] } }
+      });
+    }
+    const linkedResources = [{
+      resourceType: "transaction",
+      resourceId: transactionId,
+      relationshipCode: "kyb_transaction",
+      providerStatus: transactionStatus,
+      occurredAt: safeDate(transaction.attributes?.["created-at"], this.runtime.now())
+    }];
+    if (reviewCase) {
+      linkedResources.push({
+        resourceType: "case",
+        resourceId: requireId(reviewCase.id),
+        relationshipCode: "initial_review_case",
+        providerStatus: requireText(reviewCase.attributes?.status, "Persona case status"),
+        occurredAt: safeDate(reviewCase.attributes?.["created-at"], this.runtime.now())
+      });
+    }
+    return {
+      attemptId: command.attemptId,
+      providerResourceId: transactionId,
+      providerStatus: transactionStatus,
+      canonicalStatus: this.normalizeStatus("transaction", transactionStatus).status,
+      launch: this.nonInteractiveLaunch(command.attemptId, this.normalizeStatus("transaction", transactionStatus).status),
+      linkedResources
+    };
+  }
+  async findWorkflowManagedCase(transactionId) {
+    const result = await this.call(
+      `/transactions/${encodeURIComponent(transactionId)}?include=related-objects`,
+      { method: "GET", operation: "retrieve" }
+    );
+    for (const resource of result.included ?? []) {
+      if (resource.type === "case") return requireResource(resource, "case");
+    }
+    const transaction = requireResource(result.data, "transaction");
+    const related = asOptionalRecord(transaction.relationships?.["related-objects"]);
+    if (Array.isArray(related?.data)) {
+      const relationship = related.data.find((value) => asOptionalRecord(value)?.type === "case");
+      const caseId = asOptionalRecord(relationship)?.id;
+      if (typeof caseId === "string") return this.getCase(requireId(caseId), "retrieve");
+    }
+    return null;
+  }
+  normalizeStatus(resourceKind, providerStatus) {
+    return resolvePersonaStatus(resourceKind, providerStatus, this.runtime.configuration.statusMappings);
+  }
+  async launchFor(attemptId, inquiry) {
+    const inquiryId = requireId(inquiry.id);
+    const status = requireText(inquiry.attributes?.status, "Persona inquiry status").toLowerCase();
+    const canonical = this.normalizeStatus("inquiry", status).status;
+    let sessionToken;
+    if (status !== "created") {
+      const resumed = await this.call(`/inquiries/${encodeURIComponent(inquiryId)}/resume`, {
+        method: "POST",
+        operation: "resume",
+        idempotencyScope: inquiryId,
+        body: {}
+      });
+      sessionToken = requireText(resumed.meta?.["session-token"], "Persona session token");
+    }
+    const hostedUrl = `https://${PERSONA_INQUIRY_HOST}/verify?inquiry-id=${encodeURIComponent(inquiryId)}`;
+    return {
+      attemptId,
+      canonicalStatus: canonical,
+      presentation: sessionToken ? "embedded" : "hosted",
+      launcherKey: sessionToken ? "persona_embedded" : "hosted",
+      providerDisclosure: PERSONA_DISCLOSURE,
+      transientSecret: sessionToken,
+      transientSecretExpiresAt: sessionToken ? safeOptionalDate(inquiry.attributes?.["expires-at"]) : void 0,
+      hostedUrl: status === "created" || !sessionToken ? hostedUrl : hostedUrl,
+      hostedFallbackExpiresAt: safeOptionalDate(inquiry.attributes?.["expires-at"]),
+      continuationReference: inquiryId
+    };
+  }
+  nonInteractiveLaunch(attemptId, canonicalStatus) {
+    return {
+      attemptId,
+      canonicalStatus,
+      presentation: "none",
+      launcherKey: "hosted",
+      providerDisclosure: PERSONA_DISCLOSURE,
+      continuationReference: attemptId
+    };
+  }
+  async call(path, options) {
+    if (this.runtime.rateBudget) {
+      const budget = await this.runtime.rateBudget.acquire(options.operation);
+      if (!budget.allowed) {
+        throw new ProviderError("RATE_LIMITED", "Persona rate budget is exhausted.", {
+          retryable: true,
+          retryAfterSeconds: budget.retryAfterSeconds,
+          safeCode: "persona_rate_limited"
+        });
+      }
+    }
+    const startedAt = this.runtime.now().getTime();
+    const idempotencyKey = options.method === "GET" ? void 0 : this.runtime.idempotency.keyFor(options.operation, options.idempotencyScope ?? path, options.idempotencyKey);
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), 1e4);
+    try {
+      const response = await this.runtime.http.fetch(`https://${PERSONA_API_HOST}/api/v1${path}`, {
+        method: options.method,
+        headers: {
+          Accept: "application/json",
+          Authorization: `Bearer ${this.runtime.configuration.apiKey}`,
+          "Content-Type": "application/json",
+          "Persona-Version": this.runtime.configuration.apiVersion,
+          ...idempotencyKey ? { "Idempotency-Key": idempotencyKey } : {}
+        },
+        body: options.body === void 0 ? void 0 : JSON.stringify(options.body),
+        signal: controller.signal
+      });
+      if (!response.ok && !(options.allowNotFound && response.status === 404)) {
+        throw mapPersonaHttpError(response.status, response.headers.get("retry-after"));
+      }
+      const environmentId = response.headers.get("Persona-Environment-Id");
+      if (environmentId && environmentId !== this.runtime.configuration.environmentId) {
+        throw new ProviderError("TERMINAL_INPUT_FAILURE", "Persona response environment did not match the pinned route.", {
+          safeCode: "persona_environment_mismatch"
+        });
+      }
+      if (response.status === 204 || options.allowNotFound && response.status === 404) {
+        await this.recordObservation(options.operation, "success", `persona_${options.operation}_ok`, startedAt);
+        return {};
+      }
+      const result = await response.json().catch(() => {
+        throw new ProviderError("UNKNOWN_PROVIDER_STATE", "Persona returned a malformed response.", {
+          safeCode: "malformed_provider_response"
+        });
+      });
+      const unknown = this.responseHasUnknownStatus(result);
+      await this.recordObservation(
+        options.operation,
+        unknown ? "unknown_status" : "success",
+        unknown ? "persona_unknown_status" : `persona_${options.operation}_ok`,
+        startedAt
+      );
+      return result;
+    } catch (error) {
+      const failure = error instanceof ProviderError ? error : error instanceof DOMException && error.name === "AbortError" ? new ProviderError("TIMEOUT", "Persona request timed out.", {
+        retryable: true,
+        safeCode: "persona_timeout"
+      }) : new ProviderError("RETRYABLE_PROVIDER_FAILURE", "Persona verification is temporarily unavailable.", {
+        retryable: true,
+        safeCode: "persona_provider_failure",
+        cause: error
+      });
+      await this.recordObservation(
+        options.operation,
+        failure.retryable ? "retryable_failure" : "terminal_failure",
+        failure.safeCode,
+        startedAt
+      );
+      throw failure;
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
+  responseHasUnknownStatus(value) {
+    const result = asOptionalRecord(value);
+    const resource = asOptionalRecord(result?.data);
+    const attributes = asOptionalRecord(resource?.attributes);
+    if (typeof resource?.type !== "string" || typeof attributes?.status !== "string") return false;
+    return this.normalizeStatus(resourceCategory(resource.type), attributes.status).reasonCodes.includes("persona_unknown_status");
+  }
+  async recordObservation(operation, outcome, safeCode2, startedAt) {
+    const observedAt = this.runtime.now();
+    const latencyMs = Math.max(0, observedAt.getTime() - startedAt);
+    const metadata = {
+      provider: this.provider,
+      environment: this.environment,
+      operation,
+      outcome,
+      safe_code: safeCode2,
+      latency_ms: latencyMs
+    };
+    this.runtime.telemetry?.histogram?.("verification.provider.latency_ms", latencyMs, {
+      provider: this.provider,
+      operation
+    });
+    try {
+      await this.runtime.recordHealth({
+        operation,
+        outcome,
+        safeCode: safeCode2,
+        observedAt: observedAt.toISOString(),
+        latencyMs
+      });
+      if (outcome === "success") this.runtime.logger.info("verification_provider_operation", metadata);
+      else this.runtime.logger.warn("verification_provider_operation", metadata);
+    } catch {
+      this.runtime.logger.warn("verification_provider_health_record_failed", {
+        provider: this.provider,
+        environment: this.environment,
+        operation
+      });
+    }
+  }
+};
+
+export { DEFAULT_KYB_FIELD_MAP, PersonaVerificationAdapter, createPersonaConfiguration, normalizePersonaStatus, personaProviderManifest, verifyPersonaWebhook };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map