@splitin/verification-adapter-stripe-identity 0.1.0-beta.0

package/dist/index.js

@@ -0,0 +1,760 @@
+import { defineProviderManifest, VERIFICATION_ADAPTER_CONTRACT_VERSION, secretStringProperty, plainStringProperty, ProviderError, ProviderRequiredInformationError, isOpaqueSubjectReference, metadataContainsForbiddenIdentifier, ProviderUnavailableError } from '@splitin/verification-adapter-sdk';
+
+// src/adapter.ts
+
+// src/constants.ts
+var STRIPE_IDENTITY_API_VERSION = "2025-08-27.basil";
+var STRIPE_IDENTITY_API_HOST = "api.stripe.com";
+var STRIPE_IDENTITY_HOSTED_HOST = "verify.stripe.com";
+var STRIPE_IDENTITY_DISCLOSURE = "Powered by Stripe";
+var STRIPE_IDENTITY_EVENTS = /* @__PURE__ */ new Set([
+  "identity.verification_session.processing",
+  "identity.verification_session.verified",
+  "identity.verification_session.requires_input",
+  "identity.verification_session.canceled",
+  "identity.verification_session.redacted"
+]);
+var MANUAL_REVIEW_ERRORS = /* @__PURE__ */ new Set([
+  "consent_declined",
+  "country_not_supported",
+  "device_unsupported",
+  "document_unverified_other",
+  "selfie_document_missing_photo",
+  "selfie_face_mismatch",
+  "selfie_manipulated",
+  "selfie_unverified_other"
+]);
+var TERMINAL_DECLINE_ERRORS = /* @__PURE__ */ new Set(["under_supported_age"]);
+
+// src/configuration.ts
+function createStripeIdentityConfiguration(values) {
+  return Object.freeze({
+    restrictedKey: firstValue(values, "restrictedKey", "STRIPE_IDENTITY_RESTRICTED_KEY"),
+    accountId: firstValue(values, "accountId", "STRIPE_IDENTITY_ACCOUNT_ID"),
+    webhookSecret: firstValue(values, "webhookSecret", "STRIPE_IDENTITY_WEBHOOK_SECRET"),
+    webhookSecretPrevious: optionalValue(values, "webhookSecretPrevious", "STRIPE_IDENTITY_WEBHOOK_SECRET_PREVIOUS"),
+    apiVersion: firstValue(values, "apiVersion", "STRIPE_IDENTITY_API_VERSION") || STRIPE_IDENTITY_API_VERSION,
+    returnUrl: optionalValue(values, "returnUrl", "STRIPE_IDENTITY_RETURN_URL"),
+    webhookToleranceSeconds: parseTolerance(
+      values.webhookToleranceSeconds ?? values.STRIPE_IDENTITY_WEBHOOK_TOLERANCE_SECONDS
+    ),
+    requireMatchingSelfie: parseBoolean(
+      values.requireMatchingSelfie ?? values.STRIPE_IDENTITY_REQUIRE_MATCHING_SELFIE
+    )
+  });
+}
+function webhookSecretsFromConfig(config) {
+  return [config.webhookSecret, config.webhookSecretPrevious].map((value) => value?.trim() ?? "").filter((value) => value.startsWith("whsec_"));
+}
+function validateStripeIdentityConfiguration(config, environment) {
+  const expectedPrefix = environment === "production" ? "rk_live_" : "rk_test_";
+  if (!config.restrictedKey.startsWith(expectedPrefix)) {
+    throw new ProviderError("INVALID_CONFIGURATION", "Stripe Identity credentials do not match the pinned environment.", {
+      safeCode: "stripe_identity_credential_environment_mismatch"
+    });
+  }
+  if (webhookSecretsFromConfig(config).length === 0) {
+    throw new ProviderError("INVALID_CONFIGURATION", "Stripe Identity webhook authentication is not configured.", {
+      safeCode: "stripe_identity_webhook_secret_missing"
+    });
+  }
+  if (config.apiVersion !== STRIPE_IDENTITY_API_VERSION) {
+    throw new ProviderError("INVALID_CONFIGURATION", "Stripe Identity API version does not match the reviewed contract.", {
+      safeCode: "stripe_identity_api_version_mismatch"
+    });
+  }
+  if (!/^acct_[A-Za-z0-9]{8,252}$/.test(config.accountId)) {
+    throw new ProviderError("INVALID_CONFIGURATION", "Stripe Identity account is invalid.", {
+      safeCode: "stripe_identity_account_invalid"
+    });
+  }
+  if (config.returnUrl) assertHttpsReturnUrl(config.returnUrl);
+  if (config.webhookToleranceSeconds !== void 0 && (!Number.isInteger(config.webhookToleranceSeconds) || config.webhookToleranceSeconds < 60 || config.webhookToleranceSeconds > 900)) {
+    throw new ProviderError("INVALID_CONFIGURATION", "Stripe Identity webhook tolerance is invalid.", {
+      safeCode: "stripe_identity_webhook_tolerance_invalid"
+    });
+  }
+}
+function assertHttpsReturnUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new ProviderError("INVALID_CONFIGURATION", "Stripe Identity return URL is invalid.", {
+      safeCode: "stripe_identity_return_url_invalid"
+    });
+  }
+  if (url.protocol !== "https:" || Boolean(url.username || url.password)) {
+    throw new ProviderError("INVALID_CONFIGURATION", "Stripe Identity return URL is invalid.", {
+      safeCode: "stripe_identity_return_url_invalid"
+    });
+  }
+}
+function firstValue(values, camel, conventional) {
+  return values[camel]?.trim() || values[conventional]?.trim() || "";
+}
+function optionalValue(values, camel, conventional) {
+  const value = firstValue(values, camel, conventional);
+  return value || void 0;
+}
+function parseTolerance(value) {
+  if (value == null || value === "") return void 0;
+  const parsed = Number(value);
+  return Number.isInteger(parsed) && parsed >= 60 && parsed <= 900 ? parsed : 300;
+}
+function parseBoolean(value) {
+  if (value == null || value === "") return void 0;
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "true" || normalized === "1" || normalized === "yes") return true;
+  if (normalized === "false" || normalized === "0" || normalized === "no") return false;
+  return void 0;
+}
+var stripeIdentityProviderManifest = defineProviderManifest({
+  contractVersion: VERIFICATION_ADAPTER_CONTRACT_VERSION,
+  adapterVersion: "1.0.0",
+  engineCompatibility: "1.0.0",
+  provider: "stripe_identity",
+  displayName: "Stripe Identity",
+  description: "Human document identity verification via Stripe Identity. Connect, Payments, banks, and payouts are out of scope.",
+  supportedPackages: ["human_idv"],
+  supportedCountries: ["US"],
+  environments: ["sandbox", "production"],
+  capabilities: {
+    presentations: ["embedded", "hosted", "none"],
+    canResume: true,
+    canRetry: true,
+    canCancel: true,
+    canRedact: true
+  },
+  launcherKeys: ["stripe_identity", "hosted"],
+  launchPresentations: ["embedded", "hosted", "none"],
+  configurationSchemaVersion: "urn:splitin:verification:config:stripe-identity:v1",
+  configurationSchema: {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    type: "object",
+    additionalProperties: false,
+    required: ["restrictedKey", "accountId", "webhookSecret", "apiVersion"],
+    properties: {
+      restrictedKey: secretStringProperty(),
+      accountId: plainStringProperty(),
+      webhookSecret: secretStringProperty(),
+      webhookSecretPrevious: { type: "string", minLength: 1, "x-secret": true },
+      apiVersion: { type: "string", const: STRIPE_IDENTITY_API_VERSION },
+      returnUrl: { type: "string", format: "uri", "x-secret": false },
+      webhookToleranceSeconds: { type: "integer", minimum: 60, maximum: 900 },
+      requireMatchingSelfie: { type: "boolean" }
+    }
+  },
+  webhook: {
+    protocol: "stripe_v1_hmac",
+    eventFamilies: [
+      "identity.verification_session.processing",
+      "identity.verification_session.verified",
+      "identity.verification_session.requires_input",
+      "identity.verification_session.canceled",
+      "identity.verification_session.redacted"
+    ],
+    toleranceSeconds: 300
+  },
+  dataPolicy: {
+    classifications: ["provider_resource_id", "normalized_status", "reason_codes"],
+    prohibitedPersistence: ["raw_webhook", "launch_secret", "document", "selfie", "client_secret"],
+    rawPayloadPersistence: false,
+    browserSecretPersistence: false,
+    governmentIdentifierPersistence: false
+  },
+  retry: { sameResourceWhenResumable: true, newAttemptAfterTerminal: true },
+  cancellation: { supported: true, terminal: true },
+  redaction: { supported: true, asynchronous: true },
+  apiHosts: ["api.stripe.com"],
+  testedApiVersions: [STRIPE_IDENTITY_API_VERSION]
+});
+
+// src/status.ts
+function normalizeStripeIdentityStatus(status, lastErrorCode, eventType, redactionStatus) {
+  const reasonCodes = lastErrorCode && /^[a-z0-9_]{1,96}$/.test(lastErrorCode) ? [lastErrorCode] : [];
+  if (eventType === "identity.verification_session.redacted" || redactionStatus === "redacted") {
+    return { canonicalStatus: "redacted", reasonCodes: [...reasonCodes, "provider_redacted"] };
+  }
+  if (redactionStatus === "processing") {
+    return { canonicalStatus: "processing", reasonCodes: [...reasonCodes, "provider_redaction_processing"] };
+  }
+  if (status === "verified") return { canonicalStatus: "verified", reasonCodes };
+  if (status === "processing") return { canonicalStatus: "processing", reasonCodes };
+  if (status === "canceled") return { canonicalStatus: "canceled", reasonCodes };
+  if (status === "requires_input") {
+    return {
+      canonicalStatus: lastErrorCode && TERMINAL_DECLINE_ERRORS.has(lastErrorCode) ? "declined" : lastErrorCode && MANUAL_REVIEW_ERRORS.has(lastErrorCode) ? "manual_review_required" : "pending_user_input",
+      reasonCodes
+    };
+  }
+  return { canonicalStatus: "manual_review_required", reasonCodes: ["stripe_unknown_status"] };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function requireSession(value) {
+  if (!isRecord(value) || typeof value.id !== "string" || !/^vs_[A-Za-z0-9_]{8,252}$/.test(value.id) || typeof value.status !== "string" || typeof value.created !== "number" || typeof value.livemode !== "boolean") {
+    throw new ProviderError("UNKNOWN_PROVIDER_STATE", "Stripe Identity returned an invalid session.", {
+      safeCode: "malformed_provider_response"
+    });
+  }
+  return value;
+}
+function encodeSessionId(value) {
+  if (!/^vs_[A-Za-z0-9_]{8,252}$/.test(value)) throw new ProviderRequiredInformationError("Stripe Identity session id is invalid.");
+  return encodeURIComponent(value);
+}
+function safeClientSecret(value) {
+  return typeof value === "string" && /^vs_[A-Za-z0-9_]+_secret_[A-Za-z0-9_]+$/.test(value) ? value : void 0;
+}
+function safeStripeHostedUrl(value, hostedHost) {
+  if (typeof value !== "string") return void 0;
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && url.hostname === hostedHost && !url.username && !url.password ? url.toString() : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function safeEmail(value) {
+  const normalized = value.trim().toLowerCase();
+  if (normalized.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(normalized)) {
+    throw new ProviderRequiredInformationError();
+  }
+  return normalized;
+}
+function parseRetryAfter(value) {
+  if (!value || !/^\d{1,6}$/.test(value)) return void 0;
+  return Math.min(Number(value), 3600);
+}
+function isoExpiry(observedAt, ttlSeconds) {
+  return new Date(observedAt.getTime() + ttlSeconds * 1e3).toISOString();
+}
+async function sha256Hex(crypto, payload) {
+  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", Uint8Array.from(payload)));
+  return toHex(digest);
+}
+function timingSafeEqualHex(left, right) {
+  if (left.length !== right.length) return false;
+  let difference = 0;
+  for (let index = 0; index < left.length; index += 1) {
+    difference |= left.charCodeAt(index) ^ right.charCodeAt(index);
+  }
+  return difference === 0;
+}
+function toHex(value) {
+  return Array.from(value, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function mapProviderHttpError(status, retryAfterHeader, providerLabel) {
+  const retryAfter = parseRetryAfter(retryAfterHeader);
+  const code = status === 401 || status === 403 ? "AUTHENTICATION_FAILED" : status === 429 ? "RATE_LIMITED" : status === 408 || status === 504 ? "TIMEOUT" : status >= 500 ? "RETRYABLE_PROVIDER_FAILURE" : "TERMINAL_INPUT_FAILURE";
+  const prefix = providerLabel.replace(/[^a-z0-9]+/g, "_");
+  return new ProviderError(code, `${providerLabel} request failed.`, {
+    retryable: status === 408 || status === 429 || status >= 500,
+    retryAfterSeconds: retryAfter,
+    safeCode: code === "AUTHENTICATION_FAILED" ? `${prefix}_authentication_failed` : code === "RATE_LIMITED" ? `${prefix}_rate_limited` : code === "TIMEOUT" ? `${prefix}_timeout` : code === "RETRYABLE_PROVIDER_FAILURE" ? `${prefix}_provider_failure` : `${prefix}_terminal_input_failure`
+  });
+}
+async function verifyStripeIdentityWebhook(request, options) {
+  const rawBody = new Uint8Array(await request.arrayBuffer());
+  if (rawBody.byteLength === 0 || rawBody.byteLength > 1048576) {
+    throw new ProviderError("SIGNATURE_INVALID", "Stripe Identity webhook body is invalid.", {
+      safeCode: "stripe_identity_webhook_body_invalid"
+    });
+  }
+  const signature = parseStripeSignature(request.headers.get("stripe-signature"));
+  const nowSeconds = Math.floor(options.now.getTime() / 1e3);
+  if (Math.abs(nowSeconds - signature.timestamp) > options.toleranceSeconds) {
+    throw new ProviderError("SIGNATURE_INVALID", "Stripe Identity webhook signature is stale.", {
+      safeCode: "stripe_identity_webhook_replay"
+    });
+  }
+  const prefix = new TextEncoder().encode(`${signature.timestamp}.`);
+  const signedPayload = new Uint8Array(prefix.length + rawBody.length);
+  signedPayload.set(prefix);
+  signedPayload.set(rawBody, prefix.length);
+  let matched = false;
+  for (const secret of options.secrets) {
+    const digest = await hmacSha256Hex(options.crypto, secret, signedPayload);
+    if (signature.v1.some((candidate) => timingSafeEqualHex(digest, candidate))) matched = true;
+  }
+  if (!matched) {
+    throw new ProviderError("SIGNATURE_INVALID", "Stripe Identity webhook signature is invalid.", {
+      safeCode: "stripe_identity_webhook_signature_invalid"
+    });
+  }
+  const bodySha256 = await sha256Hex(options.crypto, rawBody);
+  let providerEventKey = `stripe_${bodySha256}`;
+  try {
+    const parsed = parseStripeEvent(rawBody);
+    assertLivemode(parsed.livemode, options.environment);
+    providerEventKey = parsed.id;
+  } catch (error) {
+    if (!(error instanceof ProviderError) || error.safeCode !== "stripe_webhook_payload_invalid") throw error;
+  }
+  return {
+    providerEventKey,
+    receivedAt: options.now.toISOString(),
+    bodySha256,
+    signatureIssuedAt: new Date(signature.timestamp * 1e3).toISOString(),
+    opaquePayload: rawBody
+  };
+}
+function parseStripeEvent(rawBody) {
+  let parsed;
+  try {
+    parsed = JSON.parse(new TextDecoder().decode(rawBody));
+  } catch {
+    throw new ProviderError("TERMINAL_INPUT_FAILURE", "Stripe Identity webhook payload is invalid.", {
+      safeCode: "stripe_webhook_payload_invalid"
+    });
+  }
+  if (!isRecord(parsed) || typeof parsed.id !== "string" || !/^evt_[A-Za-z0-9_]{8,252}$/.test(parsed.id) || typeof parsed.type !== "string" || typeof parsed.created !== "number" || typeof parsed.livemode !== "boolean" || !isRecord(parsed.data) || !isRecord(parsed.data.object)) {
+    throw new ProviderError("TERMINAL_INPUT_FAILURE", "Stripe Identity webhook event is invalid.", {
+      safeCode: "stripe_webhook_payload_invalid"
+    });
+  }
+  return parsed;
+}
+function eventIsAllowlisted(eventType) {
+  return STRIPE_IDENTITY_EVENTS.has(eventType);
+}
+function sessionFromEvent(event) {
+  return requireSession(event.data.object);
+}
+function normalizeAllowlistedEvent(event) {
+  const session = sessionFromEvent(event);
+  const allowlisted = eventIsAllowlisted(event.type);
+  return allowlisted ? normalizeStripeIdentityStatus(
+    session.status,
+    session.last_error?.code ?? null,
+    event.type,
+    session.redaction?.status ?? null
+  ) : { canonicalStatus: "manual_review_required", reasonCodes: ["stripe_unknown_event"] };
+}
+function parseStripeSignature(value) {
+  if (!value || value.length > 4096) {
+    throw new ProviderError("SIGNATURE_INVALID", "Stripe Identity signature is missing.", {
+      safeCode: "stripe_identity_signature_missing"
+    });
+  }
+  let timestamp = null;
+  const v1 = [];
+  for (const part of value.split(",")) {
+    const [key, candidate] = part.trim().split("=", 2);
+    if (key === "t" && /^\d{1,16}$/.test(candidate ?? "")) timestamp = Number(candidate);
+    if (key === "v1" && /^[a-f0-9]{64}$/i.test(candidate ?? "")) v1.push((candidate ?? "").toLowerCase());
+  }
+  if (!timestamp || !Number.isSafeInteger(timestamp) || v1.length === 0) {
+    throw new ProviderError("SIGNATURE_INVALID", "Stripe Identity signature is invalid.", {
+      safeCode: "stripe_identity_signature_invalid"
+    });
+  }
+  return { timestamp, v1 };
+}
+function assertLivemode(livemode, environment) {
+  if (livemode !== (environment === "production")) {
+    throw new ProviderError("TERMINAL_INPUT_FAILURE", "Stripe Identity mode does not match the pinned environment.", {
+      safeCode: "stripe_environment_mismatch"
+    });
+  }
+}
+async function hmacSha256Hex(crypto, secret, payload) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const digest = new Uint8Array(await crypto.subtle.sign("HMAC", key, payload));
+  return Array.from(digest, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+// src/adapter.ts
+var StripeIdentityVerificationAdapter = class {
+  contractVersion = VERIFICATION_ADAPTER_CONTRACT_VERSION;
+  manifest = stripeIdentityProviderManifest;
+  provider = "stripe_identity";
+  environment;
+  runtime;
+  constructor(runtime) {
+    this.runtime = runtime;
+    this.environment = runtime.environment;
+    this.validateConfiguration();
+  }
+  validateConfiguration() {
+    validateStripeIdentityConfiguration(this.runtime.configuration, this.environment);
+  }
+  async createAttempt(command) {
+    this.assertCommand(command);
+    const body = new URLSearchParams();
+    body.set("type", "document");
+    body.set("client_reference_id", await sha256Hex(this.runtime.crypto, new TextEncoder().encode(command.subjectReference)));
+    body.set("metadata[attempt_id]", command.attemptId);
+    body.set("options[document][require_matching_selfie]", this.runtime.configuration.requireMatchingSelfie === true ? "true" : "false");
+    if (command.email) body.set("provided_details[email]", safeEmail(command.email));
+    if (this.runtime.configuration.returnUrl) body.set("return_url", this.runtime.configuration.returnUrl);
+    const session = await this.call("/identity/verification_sessions", {
+      method: "POST",
+      operation: "create",
+      idempotencyScope: command.attemptId,
+      body,
+      idempotencyKey: command.idempotencyKey
+    });
+    return this.toAttemptResult(command.attemptId, session);
+  }
+  async resumeAttempt(command) {
+    const session = await this.getSession(command.providerResourceId, "resume");
+    return this.launchFor(command.attemptId, session);
+  }
+  async retrieveAttempt(command) {
+    return this.normalizeSnapshot(await this.getSession(command.providerResourceId, "retrieve"));
+  }
+  async retryAttempt(command) {
+    this.assertCommand(command);
+    if (command.previousProviderResourceId) {
+      const previous = await this.getSession(command.previousProviderResourceId, "retry");
+      if (previous.status === "requires_input") return this.toAttemptResult(command.attemptId, previous);
+      if (previous.redaction?.status === "redacted" || previous.status === "canceled") {
+        const idempotencyKey2 = this.runtime.idempotency.keyFor("retry", command.attemptId, command.idempotencyKey);
+        return this.createAttempt({ ...command, idempotencyKey: idempotencyKey2 });
+      }
+      if (previous.status === "processing") {
+        throw new ProviderError("RETRYABLE_PROVIDER_FAILURE", "Stripe Identity is still processing this attempt.", {
+          retryable: true,
+          retryAfterSeconds: 15,
+          safeCode: "stripe_identity_processing"
+        });
+      }
+      if (previous.status === "verified") {
+        throw new ProviderError("TERMINAL_INPUT_FAILURE", "A verified Stripe Identity attempt cannot be retried.", {
+          safeCode: "stripe_identity_already_verified"
+        });
+      }
+      throw new ProviderError("UNKNOWN_PROVIDER_STATE", "Stripe Identity retry state is not recognized.", {
+        safeCode: "stripe_identity_retry_state_unknown"
+      });
+    }
+    const idempotencyKey = this.runtime.idempotency.keyFor("retry", command.attemptId, command.idempotencyKey);
+    return this.createAttempt({ ...command, idempotencyKey });
+  }
+  async cancelAttempt(command) {
+    const current = await this.getSession(command.providerResourceId, "cancel");
+    if (current.status === "canceled") return { accepted: true, providerStatus: current.status, canonicalStatus: "canceled" };
+    if (current.status === "processing") {
+      throw new ProviderError("RETRYABLE_PROVIDER_FAILURE", "Stripe Identity is already processing this attempt.", {
+        retryable: true,
+        retryAfterSeconds: 15,
+        safeCode: "stripe_identity_processing"
+      });
+    }
+    if (current.status !== "requires_input") {
+      throw new ProviderError("TERMINAL_INPUT_FAILURE", "Stripe Identity cannot cancel this attempt state.", {
+        safeCode: current.status === "verified" ? "stripe_identity_already_verified" : "stripe_identity_cancel_state_invalid"
+      });
+    }
+    const session = await this.call(`/identity/verification_sessions/${encodeSessionId(command.providerResourceId)}/cancel`, {
+      method: "POST",
+      operation: "cancel",
+      idempotencyScope: command.attemptId,
+      body: new URLSearchParams()
+    });
+    return {
+      accepted: session.status === "canceled",
+      providerStatus: session.status,
+      canonicalStatus: session.status === "canceled" ? "canceled" : void 0
+    };
+  }
+  async redactSubject(command) {
+    if (!command.providerResourceId) throw new ProviderRequiredInformationError();
+    const current = await this.getSession(command.providerResourceId, "redact");
+    if (current.redaction?.status === "redacted") {
+      return { completed: true, retryable: false, disposition: "redacted" };
+    }
+    if (current.redaction?.status === "processing" || current.status === "processing") {
+      return { completed: false, retryable: true, disposition: "processing" };
+    }
+    if (current.status === "canceled") {
+      return { completed: true, retryable: false, disposition: "not_applicable" };
+    }
+    if (current.status !== "requires_input" && current.status !== "verified") {
+      return { completed: false, retryable: false, disposition: "failed" };
+    }
+    const session = await this.call(`/identity/verification_sessions/${encodeSessionId(command.providerResourceId)}/redact`, {
+      method: "POST",
+      operation: "redact",
+      idempotencyScope: command.requestReference,
+      body: new URLSearchParams(),
+      idempotencyKey: command.requestReference
+    });
+    const status = session.redaction?.status ?? "";
+    if (status === "redacted") return { completed: true, retryable: false, disposition: "redacted" };
+    if (status === "processing") return { completed: false, retryable: true, disposition: "processing" };
+    return { completed: false, retryable: false, disposition: "failed" };
+  }
+  async verifyWebhook(request) {
+    return verifyStripeIdentityWebhook(request, {
+      secrets: webhookSecretsFromConfig(this.runtime.configuration),
+      toleranceSeconds: this.runtime.configuration.webhookToleranceSeconds ?? this.manifest.webhook.toleranceSeconds ?? 300,
+      now: this.runtime.now(),
+      crypto: this.runtime.crypto,
+      environment: this.environment
+    });
+  }
+  async normalizeWebhook(input) {
+    const event = parseStripeEvent(input.opaquePayload);
+    if (event.id !== input.providerEventKey) {
+      throw new ProviderError("TERMINAL_INPUT_FAILURE", "Stripe Identity webhook event identity is inconsistent.", {
+        safeCode: "stripe_webhook_event_identity_mismatch"
+      });
+    }
+    const session = sessionFromEvent(event);
+    this.assertLivemode(event.livemode);
+    this.assertLivemode(session.livemode);
+    if (event.account && event.account !== this.runtime.configuration.accountId) {
+      throw new ProviderError("TERMINAL_INPUT_FAILURE", "Stripe Identity webhook account is inconsistent.", {
+        safeCode: "stripe_account_mismatch"
+      });
+    }
+    if (event.livemode !== session.livemode) {
+      throw new ProviderError("TERMINAL_INPUT_FAILURE", "Stripe Identity webhook mode is inconsistent.", {
+        safeCode: "stripe_environment_mismatch"
+      });
+    }
+    const eventAllowlisted = eventIsAllowlisted(event.type);
+    const normalized = normalizeAllowlistedEvent(event);
+    return {
+      providerEventKey: event.id,
+      providerResourceId: session.id,
+      eventType: `verification.provider_event.${normalized.canonicalStatus}`,
+      providerEventType: event.type,
+      canonicalStatus: normalized.canonicalStatus,
+      occurredAt: new Date(event.created * 1e3).toISOString(),
+      normalizedReasonCodes: normalized.reasonCodes,
+      safeMetadata: {
+        livemode: event.livemode,
+        adapter_version: this.manifest.adapterVersion,
+        normalization_version: "stripe-identity-v1",
+        event_allowlisted: eventAllowlisted,
+        reconcile_required: !eventAllowlisted || normalized.reasonCodes.includes("stripe_unknown_status")
+      }
+    };
+  }
+  assertCommand(command) {
+    if (command.packageCode !== "human_idv") {
+      throw new ProviderError("UNSUPPORTED_CAPABILITY", "Stripe Identity does not support this verification package.", {
+        safeCode: "unsupported_package"
+      });
+    }
+    if (!isOpaqueSubjectReference(command.subjectReference)) {
+      throw new ProviderError("TERMINAL_INPUT_FAILURE", "The subject reference is not an opaque identifier.", {
+        safeCode: "subject_reference_invalid"
+      });
+    }
+    if (metadataContainsForbiddenIdentifier(command.metadata)) {
+      throw new ProviderError("TERMINAL_INPUT_FAILURE", "Attempt metadata contains a forbidden identifier.", {
+        safeCode: "forbidden_identifier"
+      });
+    }
+  }
+  assertLivemode(livemode) {
+    if (livemode !== (this.environment === "production")) {
+      throw new ProviderError("TERMINAL_INPUT_FAILURE", "Stripe Identity mode does not match the pinned environment.", {
+        safeCode: "stripe_environment_mismatch"
+      });
+    }
+  }
+  async getSession(providerResourceId, operation) {
+    return this.call(`/identity/verification_sessions/${encodeSessionId(providerResourceId)}`, {
+      method: "GET",
+      operation
+    });
+  }
+  toAttemptResult(attemptId, session) {
+    const normalized = normalizeStripeIdentityStatus(
+      session.status,
+      session.last_error?.code ?? null,
+      void 0,
+      session.redaction?.status ?? null
+    );
+    return {
+      attemptId,
+      providerResourceId: session.id,
+      providerStatus: session.status,
+      canonicalStatus: normalized.canonicalStatus,
+      launch: this.launchFor(attemptId, session, normalized.canonicalStatus)
+    };
+  }
+  launchFor(attemptId, session, canonicalStatus) {
+    const status = canonicalStatus ?? normalizeStripeIdentityStatus(
+      session.status,
+      session.last_error?.code ?? null,
+      void 0,
+      session.redaction?.status ?? null
+    ).canonicalStatus;
+    if (session.status !== "requires_input") {
+      return {
+        attemptId,
+        canonicalStatus: status,
+        presentation: "none",
+        launcherKey: "hosted",
+        providerDisclosure: STRIPE_IDENTITY_DISCLOSURE,
+        continuationReference: session.id
+      };
+    }
+    const secret = safeClientSecret(session.client_secret);
+    const hostedUrl = safeStripeHostedUrl(session.url, STRIPE_IDENTITY_HOSTED_HOST);
+    const transientSecretExpiresAt = secret ? isoExpiry(this.runtime.now(), 86400) : void 0;
+    const hostedFallbackExpiresAt = hostedUrl ? isoExpiry(this.runtime.now(), 172800) : void 0;
+    if (!secret && !hostedUrl) {
+      throw new ProviderUnavailableError("Stripe Identity did not return resumable launch material.", {
+        safeCode: "stripe_identity_launch_material_missing"
+      });
+    }
+    const presentation = secret ? "embedded" : "hosted";
+    return {
+      attemptId,
+      canonicalStatus: status,
+      presentation,
+      launcherKey: secret ? "stripe_identity" : "hosted",
+      providerDisclosure: STRIPE_IDENTITY_DISCLOSURE,
+      transientSecret: secret,
+      transientSecretExpiresAt,
+      hostedUrl,
+      hostedFallbackExpiresAt,
+      continuationReference: session.id
+    };
+  }
+  normalizeSnapshot(session) {
+    const normalized = normalizeStripeIdentityStatus(
+      session.status,
+      session.last_error?.code ?? null,
+      void 0,
+      session.redaction?.status ?? null
+    );
+    return {
+      providerResourceId: session.id,
+      providerStatus: session.status,
+      canonicalStatus: normalized.canonicalStatus,
+      occurredAt: this.runtime.now().toISOString(),
+      providerCreatedAt: new Date(session.created * 1e3).toISOString(),
+      normalizedReasonCodes: normalized.reasonCodes,
+      safeMetadata: {
+        source: "retrieve",
+        livemode: session.livemode,
+        adapter_version: this.manifest.adapterVersion,
+        normalization_version: "stripe-identity-v1"
+      }
+    };
+  }
+  async call(path, options) {
+    if (this.runtime.rateBudget) {
+      const budget = await this.runtime.rateBudget.acquire(options.operation);
+      if (!budget.allowed) {
+        throw new ProviderError("RATE_LIMITED", "Stripe Identity rate budget is exhausted.", {
+          retryable: true,
+          retryAfterSeconds: budget.retryAfterSeconds,
+          safeCode: "stripe_identity_rate_limited"
+        });
+      }
+    }
+    const startedAt = this.runtime.now().getTime();
+    const idempotencyKey = options.method === "GET" ? void 0 : this.runtime.idempotency.keyFor(options.operation, options.idempotencyScope ?? path, options.idempotencyKey);
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), 1e4);
+    const url = `https://${STRIPE_IDENTITY_API_HOST}/v1${path}`;
+    try {
+      const response = await this.runtime.http.fetch(url, {
+        method: options.method,
+        headers: {
+          Authorization: `Bearer ${this.runtime.configuration.restrictedKey}`,
+          "Stripe-Version": this.runtime.configuration.apiVersion || STRIPE_IDENTITY_API_VERSION,
+          ...options.body ? { "Content-Type": "application/x-www-form-urlencoded" } : {},
+          ...idempotencyKey ? { "Idempotency-Key": idempotencyKey } : {}
+        },
+        body: options.body,
+        signal: controller.signal
+      });
+      const payload = await response.json().catch(() => null);
+      if (!response.ok) throw mapProviderHttpError(response.status, response.headers.get("retry-after"), "stripe_identity");
+      const result = requireSession(payload);
+      this.assertLivemode(result.livemode);
+      const normalized = normalizeStripeIdentityStatus(
+        result.status,
+        result.last_error?.code ?? null,
+        void 0,
+        result.redaction?.status ?? null
+      );
+      const unknown = normalized.reasonCodes.includes("stripe_unknown_status");
+      await this.recordObservation(
+        options.operation,
+        unknown ? "unknown_status" : "success",
+        unknown ? "stripe_unknown_status" : `stripe_identity_${options.operation}_ok`,
+        startedAt
+      );
+      return result;
+    } catch (error) {
+      const failure = error instanceof ProviderError ? error : error instanceof DOMException && error.name === "AbortError" ? new ProviderError("TIMEOUT", "Stripe Identity request timed out.", {
+        retryable: true,
+        safeCode: "stripe_timeout"
+      }) : new ProviderError("RETRYABLE_PROVIDER_FAILURE", "Stripe Identity request failed.", {
+        retryable: true,
+        safeCode: "stripe_provider_failure",
+        cause: error
+      });
+      await this.recordObservation(
+        options.operation,
+        failure.retryable ? "retryable_failure" : "terminal_failure",
+        failure.safeCode,
+        startedAt
+      );
+      throw failure;
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
+  async recordObservation(operation, outcome, safeCode, startedAt) {
+    const observedAt = this.runtime.now();
+    const latencyMs = Math.max(0, observedAt.getTime() - startedAt);
+    const metadata = {
+      provider: this.provider,
+      environment: this.environment,
+      operation,
+      outcome,
+      safe_code: safeCode,
+      latency_ms: latencyMs
+    };
+    this.runtime.telemetry?.histogram?.("verification.provider.latency_ms", latencyMs, {
+      provider: this.provider,
+      operation
+    });
+    this.runtime.telemetry?.counter?.("verification.provider.calls", 1, {
+      provider: this.provider,
+      operation,
+      outcome
+    });
+    try {
+      await this.runtime.recordHealth({
+        operation,
+        outcome,
+        safeCode,
+        observedAt: observedAt.toISOString(),
+        latencyMs
+      });
+      if (outcome === "success") this.runtime.logger.info("verification_provider_operation", metadata);
+      else this.runtime.logger.warn("verification_provider_operation", metadata);
+    } catch {
+      this.runtime.logger.warn("verification_provider_health_record_failed", {
+        provider: this.provider,
+        environment: this.environment,
+        operation
+      });
+    }
+  }
+};
+
+export { STRIPE_IDENTITY_API_VERSION, StripeIdentityVerificationAdapter, createStripeIdentityConfiguration, normalizeStripeIdentityStatus, stripeIdentityProviderManifest };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map