@splitin/verification-server 0.1.0-beta.0

package/dist/index.cjs

@@ -0,0 +1,1009 @@
+'use strict';
+
+var verificationEngine = require('@splitin/verification-engine');
+var verificationAdapterSdk = require('@splitin/verification-adapter-sdk');
+
+// src/catalog.ts
+var API_CONTRACT_VERSION = "1.0.0";
+var V1_ROUTES = Object.freeze([
+  { id: "sessions.create", method: "POST", path: "/v1/sessions", auth: "actor", csrf: true, idempotency: true, mutation: true },
+  { id: "sessions.resume", method: "POST", path: "/v1/sessions/:id/resume", auth: "actor", csrf: true, idempotency: true, mutation: true },
+  { id: "sessions.get", method: "GET", path: "/v1/sessions/:id", auth: "actor", csrf: false, idempotency: false, mutation: false },
+  { id: "sessions.retry", method: "POST", path: "/v1/sessions/:id/retry", auth: "actor", csrf: true, idempotency: true, mutation: true },
+  { id: "sessions.pause", method: "POST", path: "/v1/sessions/:id/pause", auth: "actor", csrf: true, idempotency: true, mutation: true },
+  { id: "sessions.cancel", method: "POST", path: "/v1/sessions/:id/cancel", auth: "actor", csrf: true, idempotency: true, mutation: true },
+  { id: "appeals.create", method: "POST", path: "/v1/appeals", auth: "actor", csrf: true, idempotency: true, mutation: true },
+  { id: "support.escalations", method: "POST", path: "/v1/support/escalations", auth: "actor", csrf: true, idempotency: true, mutation: true },
+  { id: "webhooks.ingest", method: "POST", path: "/v1/webhooks/:provider", auth: "none", csrf: false, idempotency: false, mutation: true },
+  { id: "protectedActions.evaluate", method: "POST", path: "/v1/protected-actions/evaluate", auth: "actor", csrf: true, idempotency: true, mutation: true },
+  { id: "admin.health", method: "GET", path: "/v1/admin/health", auth: "operator", csrf: false, idempotency: false, mutation: false },
+  { id: "admin.routes.get", method: "GET", path: "/v1/admin/routes", auth: "operator", csrf: false, idempotency: false, mutation: false },
+  { id: "admin.routes.mutate", method: "POST", path: "/v1/admin/routes", auth: "operator", csrf: true, idempotency: true, mutation: true },
+  { id: "admin.circuits.get", method: "GET", path: "/v1/admin/circuits", auth: "operator", csrf: false, idempotency: false, mutation: false },
+  { id: "admin.circuits.mutate", method: "POST", path: "/v1/admin/circuits", auth: "operator", csrf: true, idempotency: true, mutation: true },
+  { id: "admin.attempts", method: "GET", path: "/v1/admin/attempts", auth: "operator", csrf: false, idempotency: false, mutation: false },
+  { id: "admin.review.get", method: "GET", path: "/v1/admin/review", auth: "operator", csrf: false, idempotency: false, mutation: false },
+  { id: "admin.review.mutate", method: "POST", path: "/v1/admin/review", auth: "operator", csrf: true, idempotency: true, mutation: true },
+  { id: "admin.audit", method: "GET", path: "/v1/admin/audit", auth: "operator", csrf: false, idempotency: false, mutation: false },
+  { id: "admin.reconciliation.get", method: "GET", path: "/v1/admin/reconciliation", auth: "operator", csrf: false, idempotency: false, mutation: false },
+  { id: "admin.reconciliation.mutate", method: "POST", path: "/v1/admin/reconciliation", auth: "operator", csrf: true, idempotency: true, mutation: true },
+  { id: "admin.redaction.get", method: "GET", path: "/v1/admin/redaction", auth: "operator", csrf: false, idempotency: false, mutation: false },
+  { id: "admin.redaction.mutate", method: "POST", path: "/v1/admin/redaction", auth: "operator", csrf: true, idempotency: true, mutation: true },
+  { id: "workers.claim", method: "POST", path: "/v1/workers/claim", auth: "system", csrf: false, idempotency: true, mutation: true },
+  { id: "workers.process", method: "POST", path: "/v1/workers/process", auth: "system", csrf: false, idempotency: true, mutation: true }
+]);
+function listV1Paths() {
+  return [...new Set(V1_ROUTES.map((route) => route.path))].sort();
+}
+function matchV1Route(method, pathname, basePath = "") {
+  const relative = stripBasePath(pathname, basePath);
+  const normalizedMethod = method.toUpperCase();
+  if (normalizedMethod === "OPTIONS") {
+    const found = V1_ROUTES.find((route) => matchPath(route.path, relative));
+    return found ? { route: { ...found, method: "OPTIONS", csrf: false, idempotency: false, mutation: false }, params: matchPath(found.path, relative) ?? {} } : null;
+  }
+  for (const route of V1_ROUTES) {
+    if (route.method !== normalizedMethod) continue;
+    const params = matchPath(route.path, relative);
+    if (params) return { route, params };
+  }
+  return null;
+}
+function stripBasePath(pathname, basePath) {
+  const normalized = normalizePath(pathname);
+  const base = normalizePath(basePath);
+  if (!base || base === "/") return normalized;
+  if (normalized === base) return "/";
+  if (normalized.startsWith(`${base}/`)) return normalized.slice(base.length) || "/";
+  return normalized;
+}
+function normalizePath(value) {
+  const path = value.split("?")[0] ?? "/";
+  if (!path.startsWith("/")) return `/${path}`;
+  return path.replace(/\/+$/, "") || "/";
+}
+function matchPath(pattern, pathname) {
+  const patternParts = normalizePath(pattern).split("/").filter(Boolean);
+  const pathParts = normalizePath(pathname).split("/").filter(Boolean);
+  if (patternParts.length !== pathParts.length) return null;
+  const params = {};
+  for (let index = 0; index < patternParts.length; index += 1) {
+    const expected = patternParts[index];
+    const actual = pathParts[index];
+    if (expected.startsWith(":")) {
+      params[expected.slice(1)] = decodeURIComponent(actual);
+      continue;
+    }
+    if (expected !== actual) return null;
+  }
+  return params;
+}
+var VerificationHttpError = class extends Error {
+  constructor(status, code, message, retryAfterSeconds = null) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.retryAfterSeconds = retryAfterSeconds;
+    this.name = "VerificationHttpError";
+  }
+  status;
+  code;
+  retryAfterSeconds;
+};
+var SECRET_PATTERN = /sk_|rk_|whsec_|client_secret|ephemeral|password|bearer\s+[a-z0-9._-]+/i;
+function scrubUnsafeMessage(value) {
+  if (SECRET_PATTERN.test(value) || /provider\s+body|raw\s+webhook/i.test(value)) {
+    return "The verification request could not be completed.";
+  }
+  return value;
+}
+function toSafeErrorEnvelope(error, supportPath) {
+  if (error instanceof VerificationHttpError) {
+    return {
+      status: error.status,
+      retryAfterSeconds: error.retryAfterSeconds,
+      body: envelope(error.code, scrubUnsafeMessage(error.message), error.retryAfterSeconds, supportPath)
+    };
+  }
+  if (error instanceof verificationAdapterSdk.ProviderError) {
+    const status = error.retryable ? error.code === "RATE_LIMITED" ? 429 : 503 : 409;
+    return {
+      status,
+      retryAfterSeconds: error.retryAfterSeconds ?? null,
+      body: envelope(error.safeCode, scrubUnsafeMessage(error.message), error.retryAfterSeconds ?? null, supportPath)
+    };
+  }
+  const safe = verificationAdapterSdk.toSafeProviderFailure(error);
+  return {
+    status: 503,
+    retryAfterSeconds: safe.retryAfterSeconds ?? null,
+    body: envelope(safe.safeCode, "The verification request could not be completed.", safe.retryAfterSeconds ?? null, supportPath)
+  };
+}
+function envelope(code, message, retryAfterSeconds, supportPath) {
+  return {
+    contractVersion: "1.0.0",
+    error: {
+      code,
+      message,
+      retryable: retryAfterSeconds !== null || /retry|unavailable|rate/i.test(code)
+    },
+    safeErrorCode: code,
+    retryAfter: retryAfterSeconds,
+    supportPath
+  };
+}
+
+// src/types.ts
+var SESSION_CONTRACT_VERSION = "1.0.0";
+var FORBIDDEN_CLIENT_FIELDS = [
+  "provider",
+  "launcherKey",
+  "templateId",
+  "workflowId",
+  "apiOrigin",
+  "environment",
+  "configurationRevision",
+  "adapter",
+  "adapterVersion",
+  "routePolicyId"
+];
+
+// src/engine-adapter.ts
+function createEngineServerPlatform(platform) {
+  return {
+    async startSession(actor, input, idempotencyKey, request) {
+      const view = await mapEngine(() => platform.start(actor, {
+        packageCode: input.packageCode,
+        countryCode: input.countryCode ?? "US",
+        subjectReference: requireSubject(actor, input.subjectReference),
+        idempotencyKey,
+        action: input.action,
+        resourceType: input.resourceType,
+        resourceReference: input.resourceReference,
+        organization: input.organization,
+        relationship: input.relationship,
+        associatedPerson: input.associatedPerson,
+        legalFirstName: input.legalFirstName,
+        legalLastName: input.legalLastName,
+        email: input.email,
+        requestOrigin: request.headers.get("origin"),
+        metadata: input.metadata,
+        evidenceReferences: input.evidenceReferences
+      }));
+      return toSessionEnvelope(view);
+    },
+    async resumeSession(actor, input, request) {
+      return toSessionEnvelope(await mapEngine(() => platform.resume(actor, {
+        attemptId: input.attemptId,
+        requestOrigin: request.headers.get("origin")
+      })));
+    },
+    async getSession(actor, attemptId) {
+      return toSessionEnvelope(await mapEngine(() => platform.status(actor, attemptId)));
+    },
+    async retrySession(actor, input, request) {
+      const current = await mapEngine(() => platform.status(actor, input.attemptId));
+      return toSessionEnvelope(await mapEngine(() => platform.retry(actor, {
+        parentAttemptId: input.attemptId,
+        packageCode: current.packageCode,
+        countryCode: "US",
+        subjectReference: requireSubject(actor, void 0),
+        idempotencyKey: input.idempotencyKey,
+        requestOrigin: request.headers.get("origin")
+      })));
+    },
+    async pauseSession(actor, input) {
+      const view = await mapEngine(() => platform.pause(actor, input.attemptId));
+      return { attemptId: view.attemptId, status: view.status, paused: true, canResume: view.canResume, canRetry: view.canRetry };
+    },
+    async cancelSession(actor, input) {
+      const view = await mapEngine(() => platform.cancel(actor, input.attemptId));
+      return { attemptId: view.attemptId, status: view.status, canceled: true, canResume: view.canResume, canRetry: view.canRetry };
+    },
+    async createAppeal(actor, input) {
+      const attemptId = input.attemptId;
+      if (!attemptId) throw new VerificationHttpError(400, "INVALID_REQUEST", "An attempt ID is required.");
+      const result = await mapEngine(() => platform.appeal.submit(actor, {
+        attemptId,
+        reason: input.reasonCode
+      }));
+      return { appealId: result.appealId, status: "open" };
+    },
+    async createSupportEscalation(_actor, _input, idempotencyKey) {
+      return { escalationId: `esc_${idempotencyKey.replace(/[^A-Za-z0-9]/g, "").slice(0, 24)}`, status: "open" };
+    },
+    async ingestWebhook(provider, request) {
+      const result = await mapEngine(() => platform.ingestWebhook({
+        provider,
+        request,
+        tenantKey: "default"
+      }));
+      return { accepted: result.accepted, duplicate: result.duplicate, providerEventKey: result.eventId };
+    },
+    async evaluateProtectedAction(actor, input) {
+      const result = await mapEngine(() => platform.evaluateProtectedAction(actor, {
+        action: input.action,
+        resourceType: input.resourceType ?? "resource",
+        resourceReference: input.resourceReference ?? requireSubject(actor, void 0),
+        subjectReference: requireSubject(actor, void 0)
+      }));
+      if ("allowed" in result && result.allowed) {
+        return { allowed: true, enforcementActive: true };
+      }
+      return { allowed: false, ...result };
+    },
+    admin: {
+      async health(actor) {
+        const payload = await mapEngine(() => platform.admin.health(actor));
+        return { generatedAt: nowIso(), runtime: asRecords(payload), health: [], alerts: [] };
+      },
+      async routes(actor) {
+        const payload = await mapEngine(() => platform.admin.routes(actor));
+        return { generatedAt: nowIso(), routes: asRecords(payload), routeChanges: [] };
+      },
+      async mutateRoute(actor, input) {
+        if (input.operation === "approve") {
+          const result = await mapEngine(() => platform.admin.approveRoute(actor, input.requestId ?? "", input.reasonCode ?? "approved"));
+          return flatten(result);
+        }
+        if (input.operation === "propose") {
+          throw new VerificationHttpError(400, "INVALID_REQUEST", "Route proposals require a complete route payload on the engine admin API.");
+        }
+        throw new VerificationHttpError(400, "INVALID_REQUEST", "Unsupported route operation.");
+      },
+      async circuits(actor) {
+        const payload = await mapEngine(() => platform.admin.circuits(actor));
+        return { generatedAt: nowIso(), circuits: asRecords(payload) };
+      },
+      async setCircuit(actor, input) {
+        if (input.status === "circuit_open") {
+          const result = await mapEngine(() => platform.admin.emergencyDrain(actor, input.provider, input.providerEnvironment, input.errorCode ?? "admin_circuit"));
+          return flatten(result);
+        }
+        return { provider: input.provider, status: input.status };
+      },
+      async attempts(actor) {
+        const payload = await mapEngine(() => platform.admin.attempts(actor));
+        return { generatedAt: nowIso(), attempts: asRecords(payload) };
+      },
+      async review(_actor) {
+        return { generatedAt: nowIso(), appeals: [], manualExceptions: [], policyVersions: [] };
+      },
+      async mutateReview(actor, input) {
+        const requestId = input.requestId;
+        if (input.operation === "approve_manual_exception" && requestId) {
+          const result = await mapEngine(() => platform.review.decide(actor, {
+            proposalId: requestId,
+            transition: input.decision === "deny" ? "deny" : "approve",
+            reason: input.reasonCode ?? "approved"
+          }));
+          return flatten(result);
+        }
+        if (input.operation === "propose_manual_exception" && requestId) {
+          const result = await mapEngine(() => platform.review.propose(actor, {
+            attemptId: requestId,
+            proposedStatus: "verified",
+            reason: input.reasonCode ?? "proposed"
+          }));
+          return flatten(result);
+        }
+        throw new VerificationHttpError(400, "INVALID_REQUEST", "Unsupported review operation.");
+      },
+      async audit(actor) {
+        const payload = await mapEngine(() => platform.admin.audit(actor));
+        return { generatedAt: nowIso(), audit: asRecords(payload) };
+      },
+      async reconciliation(_actor) {
+        return { generatedAt: nowIso(), jobs: [], queues: {} };
+      },
+      async enqueueReconciliation(actor, input) {
+        const result = await mapEngine(() => platform.reconcile(actor, input.attemptId));
+        return flatten(result);
+      },
+      async redaction(_actor) {
+        return { generatedAt: nowIso(), privacyRequests: [], jobs: [] };
+      },
+      async approveRedaction(actor, input) {
+        const result = await mapEngine(() => platform.redact(actor, {
+          subjectReference: requireSubject(actor, void 0),
+          requestReference: input.privacyRequestId
+        }));
+        return flatten(result);
+      }
+    },
+    workers: {
+      async claim(actor, input) {
+        const kinds = input.queue === "reconciliation" ? ["reconcile"] : input.queue === "dead_letter" ? ["webhook", "reconcile", "redact"] : [input.queue === "redaction" ? "redact" : "webhook"];
+        const jobs = await mapEngine(() => platform.workers.claim(actor, {
+          workerId: actor.actorId,
+          kinds,
+          limit: input.limit ?? 8
+        }));
+        return {
+          leases: jobs.map((job) => ({
+            leaseId: job.leaseId ?? job.id,
+            jobId: job.id,
+            queue: input.queue
+          }))
+        };
+      },
+      async process(actor, input) {
+        const result = await mapEngine(() => platform.workers.process(actor, { id: input.jobId }));
+        return { processed: result.processed, disposition: result.disposition };
+      }
+    }
+  };
+}
+function toSessionEnvelope(view) {
+  return {
+    contractVersion: SESSION_CONTRACT_VERSION,
+    attemptId: view.attemptId,
+    packageCode: view.packageCode,
+    status: view.status,
+    presentation: view.launch?.presentation ?? "none",
+    launch: view.launch,
+    launcherKey: view.launch?.launcherKey ?? null,
+    providerDisclosure: view.launch?.providerDisclosure ?? null,
+    safeErrorCode: view.safeErrorCode,
+    retryAfter: view.retryAfter,
+    supportPath: view.supportPath,
+    expiresAt: view.expiresAt,
+    canResume: view.canResume,
+    canRetry: view.canRetry,
+    continuation: null
+  };
+}
+function requireSubject(actor, explicit) {
+  const subject = explicit ?? actor.authorizedSubjectScope[0];
+  if (!subject) throw new VerificationHttpError(400, "INVALID_REQUEST", "A subject reference is required.");
+  return subject;
+}
+function nowIso() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function asRecords(value) {
+  if (Array.isArray(value)) {
+    return value.map((item) => flatten(item));
+  }
+  return [flatten(value)];
+}
+function flatten(value) {
+  if (!value || typeof value !== "object") return { value: String(value) };
+  const record = {};
+  for (const [key, nested] of Object.entries(value)) {
+    if (nested === null || ["string", "number", "boolean"].includes(typeof nested)) {
+      record[key] = nested;
+    }
+  }
+  return record;
+}
+async function mapEngine(operation) {
+  try {
+    return await operation();
+  } catch (error) {
+    if (error instanceof VerificationHttpError) throw error;
+    if (error instanceof verificationEngine.AuthorizationError) {
+      throw new VerificationHttpError(403, "FORBIDDEN", error.message);
+    }
+    if (error instanceof verificationEngine.ClientRouteInjectionError) {
+      throw new VerificationHttpError(400, "UNSUPPORTED_REQUEST_FIELD", error.message);
+    }
+    if (error instanceof verificationEngine.EngineError) {
+      const status = error.code === "ATTEMPT_NOT_FOUND" ? 404 : error.code === "PRODUCTION_NOT_ACTIVATED" || error.code === "NO_ELIGIBLE_ROUTE" ? 409 : error.retryable ? 503 : 409;
+      throw new VerificationHttpError(status, error.code, error.message, error.retryAfterSeconds ?? null);
+    }
+    throw error;
+  }
+}
+
+// src/auth.ts
+var IDEMPOTENCY_KEY = /^[A-Za-z0-9._:~-]{8,128}$/;
+var OPERATOR_ROLES = /* @__PURE__ */ new Set(["operator", "admin", "reviewer", "approver"]);
+var SYSTEM_ROLES = /* @__PURE__ */ new Set(["system", "worker"]);
+function isCookieAuthenticated(request, override) {
+  if (override) return override(request);
+  const authorization = request.headers.get("authorization") ?? "";
+  if (/^bearer\s+/i.test(authorization)) return false;
+  return Boolean(request.headers.get("cookie"));
+}
+function requireCsrf(request, route, allowedOrigins) {
+  if (!route.csrf) return;
+  const origin = request.headers.get("origin") ?? originFromReferer(request.headers.get("referer"));
+  if (!origin) {
+    throw new VerificationHttpError(403, "CSRF_REJECTED", "Cookie-authenticated mutations require a trusted Origin.");
+  }
+  if (!allowedOrigins.includes(origin)) {
+    throw new VerificationHttpError(403, "ORIGIN_NOT_ALLOWED", "Request origin is not allowed.");
+  }
+}
+function requireOriginWhenPresent(request, allowedOrigins) {
+  const origin = request.headers.get("origin");
+  if (!origin) return;
+  if (!allowedOrigins.includes(origin)) {
+    throw new VerificationHttpError(403, "ORIGIN_NOT_ALLOWED", "Request origin is not allowed.");
+  }
+}
+function requireIdempotencyKey(request, route) {
+  if (!route.idempotency) return void 0;
+  const key = request.headers.get("idempotency-key")?.trim();
+  if (!key) {
+    throw new VerificationHttpError(400, "IDEMPOTENCY_KEY_REQUIRED", "Mutations require an Idempotency-Key header.");
+  }
+  if (!IDEMPOTENCY_KEY.test(key)) {
+    throw new VerificationHttpError(400, "INVALID_IDEMPOTENCY_KEY", "Idempotency-Key is invalid.");
+  }
+  return key;
+}
+function authorizeActor(actor, auth) {
+  if (auth === "none") return;
+  if (!actor.actorId || !actor.tenantKey) {
+    throw new VerificationHttpError(401, "UNAUTHENTICATED", "Authentication is required.");
+  }
+  if (auth === "actor") {
+    if (actor.actorType === "system" && !hasRole(actor, SYSTEM_ROLES) && !hasRole(actor, OPERATOR_ROLES)) {
+      throw new VerificationHttpError(403, "FORBIDDEN", "This actor cannot access subject verification sessions.");
+    }
+    return;
+  }
+  if (auth === "operator") {
+    if (actor.actorType !== "operator" && !hasRole(actor, OPERATOR_ROLES)) {
+      throw new VerificationHttpError(403, "FORBIDDEN", "Operator authorization is required.");
+    }
+    return;
+  }
+  if (auth === "system") {
+    if (actor.actorType !== "system" && !hasRole(actor, SYSTEM_ROLES)) {
+      throw new VerificationHttpError(403, "FORBIDDEN", "Worker authorization is required.");
+    }
+  }
+}
+function authorizeSubjectScope(actor, subjectReference) {
+  if (!subjectReference) return;
+  if (actor.actorType === "operator" || actor.actorType === "system") return;
+  if (subjectReference === actor.actorId) return;
+  if (actor.authorizedSubjectScope.includes("*")) return;
+  if (actor.authorizedSubjectScope.includes(subjectReference)) return;
+  throw new VerificationHttpError(403, "FORBIDDEN", "The actor is not authorized for this subject.");
+}
+function assertSeparationOfDuties(actor, otherActorId, action) {
+  if (!otherActorId) return;
+  if (otherActorId === actor.actorId) {
+    throw new VerificationHttpError(
+      403,
+      "SEPARATION_OF_DUTIES",
+      `A different authorized operator must ${action}.`
+    );
+  }
+}
+function hasRole(actor, allowed) {
+  return actor.roles.some((role) => allowed.has(role));
+}
+function originFromReferer(referer) {
+  if (!referer) return null;
+  try {
+    return new URL(referer).origin;
+  } catch {
+    return null;
+  }
+}
+function corsHeaders(request, allowedOrigins) {
+  const origin = request.headers.get("origin");
+  const allowOrigin = origin && allowedOrigins.includes(origin) ? origin : allowedOrigins[0] ?? "";
+  return {
+    Vary: "Origin",
+    "Access-Control-Allow-Origin": allowOrigin,
+    "Access-Control-Allow-Headers": "Authorization, Content-Type, Idempotency-Key, X-CSRF-Token",
+    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+    "Access-Control-Allow-Credentials": "true"
+  };
+}
+
+// src/json.ts
+function jsonResponse(body, status, extra = {}) {
+  const headers = new Headers({
+    "Cache-Control": "no-store",
+    "Content-Type": "application/json; charset=utf-8",
+    ...extra
+  });
+  if (typeof extra["Retry-After"] === "string") headers.set("Retry-After", extra["Retry-After"]);
+  return new Response(JSON.stringify(body), { status, headers });
+}
+async function readLimitedBody(request, maxBodyBytes) {
+  if (request.method === "GET" || request.method === "HEAD" || request.method === "OPTIONS") {
+    return request;
+  }
+  const raw = new Uint8Array(await request.arrayBuffer());
+  if (raw.byteLength > maxBodyBytes) {
+    throw new VerificationHttpError(413, "PAYLOAD_TOO_LARGE", "Request body exceeds the allowed size.");
+  }
+  return new Request(request.url, {
+    method: request.method,
+    headers: request.headers,
+    body: raw.byteLength > 0 ? raw : void 0
+  });
+}
+async function parseJsonObject(request, allowedKeys, options = {}) {
+  const contentType = request.headers.get("content-type") ?? "";
+  if (contentType && !contentType.toLowerCase().includes("application/json")) {
+    throw new VerificationHttpError(415, "INVALID_REQUEST", "Content-Type must be application/json.");
+  }
+  let body;
+  try {
+    const text = await request.text();
+    body = text.trim() ? JSON.parse(text) : {};
+  } catch {
+    throw new VerificationHttpError(400, "INVALID_JSON", "Request body must be valid JSON.");
+  }
+  if (!isPlainRecord(body)) {
+    throw new VerificationHttpError(400, "INVALID_REQUEST", "Request body must be an object.");
+  }
+  for (const key of Object.keys(body)) {
+    if (options.rejectRoutingFields && FORBIDDEN_CLIENT_FIELDS.includes(key)) {
+      throw new VerificationHttpError(400, "UNSUPPORTED_REQUEST_FIELD", `Unsupported request field: ${key}.`);
+    }
+    if (!allowedKeys.includes(key)) {
+      throw new VerificationHttpError(400, "UNSUPPORTED_REQUEST_FIELD", `Unsupported request field: ${key}.`);
+    }
+  }
+  return body;
+}
+function requiredString(body, field, pattern, maxLength) {
+  const value = body[field];
+  if (typeof value !== "string" || !pattern.test(value) || value.length > maxLength) {
+    throw new VerificationHttpError(400, "INVALID_REQUEST", `Invalid ${field}.`);
+  }
+  return value;
+}
+function optionalString(body, field, pattern, maxLength) {
+  const value = body[field];
+  if (value === void 0 || value === null) return void 0;
+  if (typeof value !== "string" || !pattern.test(value) || value.length > maxLength) {
+    throw new VerificationHttpError(400, "INVALID_REQUEST", `Invalid ${field}.`);
+  }
+  return value;
+}
+function optionalBoolean(body, field) {
+  const value = body[field];
+  if (value === void 0) return void 0;
+  if (typeof value !== "boolean") {
+    throw new VerificationHttpError(400, "INVALID_REQUEST", `Invalid ${field}.`);
+  }
+  return value;
+}
+function isPlainRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/handler.ts
+var PACKAGE = /^[a-z0-9][a-z0-9_.-]{1,80}$/;
+var ACTION = /^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)+$/;
+var IDENTIFIER = /^[A-Za-z0-9._:~-]{4,128}$/;
+var REASON = /^[a-z][a-z0-9_.-]{2,127}$/;
+var COUNTRY = /^[A-Z]{2}$/;
+var HASH = /^[a-f0-9]{64}$/;
+var ATTEMPT_ID = /^[A-Za-z0-9._:~-]{8,128}$/;
+var SESSION_KEYS = [
+  "packageCode",
+  "countryCode",
+  "action",
+  "resourceType",
+  "resourceReference",
+  "subjectReference",
+  "continuationToken",
+  "continuationKey",
+  "legalFirstName",
+  "legalLastName",
+  "email",
+  "organization",
+  "relationship",
+  "associatedPerson",
+  "evidenceReferences",
+  "metadata"
+];
+var APPEAL_KEYS = ["attemptId", "reasonCode", "nonBiometricPathRequested", "details"];
+var SUPPORT_KEYS = ["attemptId", "appealId", "reasonCode", "message"];
+var PROTECTED_KEYS = ["action", "resourceType", "resourceReference"];
+var ROUTE_KEYS = ["operation", "targetRoutePolicyId", "requestId", "action", "reasonCode"];
+var CIRCUIT_KEYS = ["provider", "providerEnvironment", "status", "errorCode", "circuitOpenUntil"];
+var REVIEW_KEYS = [
+  "operation",
+  "appealId",
+  "requestId",
+  "packageCode",
+  "decision",
+  "reasonCode",
+  "policyVersionId",
+  "evidenceReferenceHash",
+  "expiresAt"
+];
+var RECONCILE_KEYS = ["attemptId"];
+var REDACT_KEYS = ["privacyRequestId"];
+var WORKER_CLAIM_KEYS = ["queue", "limit"];
+var WORKER_PROCESS_KEYS = ["leaseId", "jobId"];
+function createVerificationFetchHandler(platform, options) {
+  const allowedOrigins = options.allowedOrigins ?? [];
+  const supportPath = options.supportPath ?? null;
+  const maxBodyBytes = options.maxBodyBytes ?? 1024 * 1024;
+  return async (incoming) => {
+    const extra = corsHeaders(incoming, allowedOrigins);
+    try {
+      requireOriginWhenPresent(incoming, allowedOrigins.length > 0 ? allowedOrigins : [incoming.headers.get("origin") ?? ""]);
+      const request = await readLimitedBody(incoming, maxBodyBytes);
+      const url = new URL(request.url);
+      const matched = matchV1Route(request.method, url.pathname, options.basePath);
+      if (!matched) {
+        if (request.method === "OPTIONS") {
+          return new Response(null, { status: 204, headers: extra });
+        }
+        throw new VerificationHttpError(404, "NOT_FOUND", "The verification endpoint was not found.");
+      }
+      const { route, params } = matched;
+      if (route.method === "OPTIONS") {
+        return new Response(null, { status: 204, headers: extra });
+      }
+      if (route.id === "webhooks.ingest") {
+        const provider = params.provider ?? "";
+        if (!verificationAdapterSdk.isProviderCode(provider)) {
+          throw new VerificationHttpError(400, "INVALID_REQUEST", "Invalid provider.");
+        }
+        const result = await platform.ingestWebhook(provider, request);
+        return jsonResponse(result, result.accepted ? 202 : 400, extra);
+      }
+      if (isCookieAuthenticated(request, options.isCookieAuthenticated) && route.csrf) {
+        if (allowedOrigins.length === 0) {
+          throw new VerificationHttpError(403, "CSRF_REJECTED", "Cookie-authenticated mutations require an origin allowlist.");
+        }
+        requireCsrf(request, route, allowedOrigins);
+      }
+      const actor = await options.resolveActor(request);
+      authorizeActor(actor, route.auth);
+      const idempotencyKey = requireIdempotencyKey(request, route) ?? "";
+      if (options.rateLimit) {
+        const budget = await options.rateLimit(actor, route.id);
+        if (!budget.allowed) {
+          throw new VerificationHttpError(429, "RATE_LIMITED", "Please wait before retrying.", budget.retryAfterSeconds ?? 30);
+        }
+      }
+      const body = route.mutation && route.method === "POST" && route.id !== "sessions.get" ? await parseBodyForRoute(route.id, request) : {};
+      const payload = await dispatch(platform, route.id, {
+        actor,
+        params,
+        body,
+        idempotencyKey,
+        request
+      });
+      return jsonResponse(payload, route.mutation && route.method === "POST" ? 200 : 200, extra);
+    } catch (error) {
+      const mapped = toSafeErrorEnvelope(error, supportPath);
+      const headers = { ...extra };
+      if (mapped.retryAfterSeconds !== null) headers["Retry-After"] = String(Math.max(1, Math.ceil(mapped.retryAfterSeconds)));
+      return jsonResponse(mapped.body, mapped.status, headers);
+    }
+  };
+}
+async function parseBodyForRoute(routeId, request) {
+  switch (routeId) {
+    case "sessions.create":
+      return parseJsonObject(request, SESSION_KEYS, { rejectRoutingFields: true });
+    case "sessions.resume":
+    case "sessions.retry":
+    case "sessions.pause":
+    case "sessions.cancel":
+      return parseJsonObject(request, []);
+    case "appeals.create":
+      return parseJsonObject(request, APPEAL_KEYS);
+    case "support.escalations":
+      return parseJsonObject(request, SUPPORT_KEYS);
+    case "protectedActions.evaluate":
+      return parseJsonObject(request, PROTECTED_KEYS);
+    case "admin.routes.mutate":
+      return parseJsonObject(request, ROUTE_KEYS, { rejectRoutingFields: false });
+    case "admin.circuits.mutate":
+      return parseJsonObject(request, CIRCUIT_KEYS, { rejectRoutingFields: false });
+    case "admin.review.mutate":
+      return parseJsonObject(request, REVIEW_KEYS, { rejectRoutingFields: false });
+    case "admin.reconciliation.mutate":
+      return parseJsonObject(request, RECONCILE_KEYS, { rejectRoutingFields: false });
+    case "admin.redaction.mutate":
+      return parseJsonObject(request, REDACT_KEYS, { rejectRoutingFields: false });
+    case "workers.claim":
+      return parseJsonObject(request, WORKER_CLAIM_KEYS, { rejectRoutingFields: false });
+    case "workers.process":
+      return parseJsonObject(request, WORKER_PROCESS_KEYS, { rejectRoutingFields: false });
+    default:
+      return {};
+  }
+}
+async function dispatch(platform, routeId, ctx) {
+  const attemptId = ctx.params.id;
+  switch (routeId) {
+    case "sessions.create": {
+      const input = parseStartInput(ctx.body);
+      authorizeSubjectScope(ctx.actor, input.subjectReference);
+      return platform.startSession(ctx.actor, input, ctx.idempotencyKey, ctx.request);
+    }
+    case "sessions.resume":
+      return platform.resumeSession(ctx.actor, { attemptId: requireAttemptId(attemptId), idempotencyKey: ctx.idempotencyKey }, ctx.request);
+    case "sessions.get":
+      return platform.getSession(ctx.actor, requireAttemptId(attemptId));
+    case "sessions.retry":
+      return platform.retrySession(ctx.actor, { attemptId: requireAttemptId(attemptId), idempotencyKey: ctx.idempotencyKey }, ctx.request);
+    case "sessions.pause":
+      return platform.pauseSession(ctx.actor, { attemptId: requireAttemptId(attemptId), idempotencyKey: ctx.idempotencyKey });
+    case "sessions.cancel":
+      return platform.cancelSession(ctx.actor, { attemptId: requireAttemptId(attemptId), idempotencyKey: ctx.idempotencyKey });
+    case "appeals.create":
+      return platform.createAppeal(ctx.actor, {
+        attemptId: optionalString(ctx.body, "attemptId", ATTEMPT_ID, 128),
+        reasonCode: requiredString(ctx.body, "reasonCode", REASON, 128),
+        nonBiometricPathRequested: optionalBoolean(ctx.body, "nonBiometricPathRequested"),
+        details: optionalString(ctx.body, "details", /^[\s\S]{1,2000}$/, 2e3)
+      }, ctx.idempotencyKey);
+    case "support.escalations":
+      return platform.createSupportEscalation(ctx.actor, {
+        attemptId: optionalString(ctx.body, "attemptId", ATTEMPT_ID, 128),
+        appealId: optionalString(ctx.body, "appealId", ATTEMPT_ID, 128),
+        reasonCode: requiredString(ctx.body, "reasonCode", REASON, 128),
+        message: optionalString(ctx.body, "message", /^[\s\S]{1,2000}$/, 2e3)
+      }, ctx.idempotencyKey);
+    case "protectedActions.evaluate":
+      return platform.evaluateProtectedAction(ctx.actor, parseProtectedAction(ctx.body), ctx.idempotencyKey);
+    case "admin.health":
+      return platform.admin.health(ctx.actor);
+    case "admin.routes.get":
+      return platform.admin.routes(ctx.actor);
+    case "admin.routes.mutate":
+      return mutateRoute(platform, ctx.actor, ctx.body, ctx.idempotencyKey);
+    case "admin.circuits.get":
+      return platform.admin.circuits(ctx.actor);
+    case "admin.circuits.mutate":
+      return platform.admin.setCircuit(ctx.actor, parseCircuit(ctx.body), ctx.idempotencyKey);
+    case "admin.attempts":
+      return platform.admin.attempts(ctx.actor);
+    case "admin.review.get":
+      return platform.admin.review(ctx.actor);
+    case "admin.review.mutate":
+      return mutateReview(platform, ctx.actor, ctx.body, ctx.idempotencyKey);
+    case "admin.audit":
+      return platform.admin.audit(ctx.actor);
+    case "admin.reconciliation.get":
+      return platform.admin.reconciliation(ctx.actor);
+    case "admin.reconciliation.mutate":
+      return platform.admin.enqueueReconciliation(ctx.actor, {
+        attemptId: requiredString(ctx.body, "attemptId", ATTEMPT_ID, 128)
+      }, ctx.idempotencyKey);
+    case "admin.redaction.get":
+      return platform.admin.redaction(ctx.actor);
+    case "admin.redaction.mutate":
+      return platform.admin.approveRedaction(ctx.actor, {
+        privacyRequestId: requiredString(ctx.body, "privacyRequestId", IDENTIFIER, 128)
+      }, ctx.idempotencyKey);
+    case "workers.claim":
+      return platform.workers.claim(ctx.actor, {
+        queue: parseWorkerQueue(ctx.body.queue),
+        limit: typeof ctx.body.limit === "number" ? ctx.body.limit : void 0
+      }, ctx.idempotencyKey);
+    case "workers.process":
+      return platform.workers.process(ctx.actor, {
+        leaseId: requiredString(ctx.body, "leaseId", IDENTIFIER, 128),
+        jobId: requiredString(ctx.body, "jobId", IDENTIFIER, 128)
+      }, ctx.idempotencyKey);
+    default:
+      throw new VerificationHttpError(404, "NOT_FOUND", "The verification endpoint was not found.");
+  }
+}
+function parseStartInput(body) {
+  const packageCode = requiredString(body, "packageCode", PACKAGE, 80);
+  if (!verificationAdapterSdk.isPackageCode(packageCode)) {
+    throw new VerificationHttpError(400, "INVALID_REQUEST", "Invalid packageCode.");
+  }
+  return {
+    packageCode,
+    countryCode: optionalString(body, "countryCode", COUNTRY, 2),
+    action: optionalString(body, "action", ACTION, 160),
+    resourceType: optionalString(body, "resourceType", /^[a-z][a-z0-9_]{1,63}$/, 64),
+    resourceReference: optionalString(body, "resourceReference", IDENTIFIER, 128),
+    subjectReference: optionalString(body, "subjectReference", IDENTIFIER, 128),
+    continuationToken: optionalString(body, "continuationToken", HASH, 64),
+    continuationKey: optionalString(body, "continuationKey", /^[a-z][a-z0-9_.-]{2,127}$/, 128),
+    legalFirstName: optionalString(body, "legalFirstName", /^[\p{L}\p{M}\s'.-]{1,80}$/u, 80) ?? null,
+    legalLastName: optionalString(body, "legalLastName", /^[\p{L}\p{M}\s'.-]{1,80}$/u, 80) ?? null,
+    email: optionalString(body, "email", /^[^\s@]+@[^\s@]+\.[^\s@]+$/, 254) ?? null,
+    organization: isRecord(body.organization) ? body.organization : void 0,
+    relationship: isRecord(body.relationship) ? body.relationship : void 0,
+    associatedPerson: isRecord(body.associatedPerson) ? body.associatedPerson : void 0,
+    evidenceReferences: Array.isArray(body.evidenceReferences) ? body.evidenceReferences.filter((value) => typeof value === "string") : void 0,
+    metadata: isRecord(body.metadata) ? sanitizeMetadata(body.metadata) : void 0
+  };
+}
+function parseProtectedAction(body) {
+  return {
+    action: requiredString(body, "action", ACTION, 160),
+    resourceType: optionalString(body, "resourceType", /^[a-z][a-z0-9_]{1,63}$/, 64),
+    resourceReference: optionalString(body, "resourceReference", IDENTIFIER, 128)
+  };
+}
+function parseCircuit(body) {
+  const status = requiredString(body, "status", /^(healthy|degraded|unavailable|circuit_open)$/, 32);
+  const environment = requiredString(body, "providerEnvironment", /^(sandbox|production)$/, 16);
+  return {
+    provider: requiredString(body, "provider", /^[a-z][a-z0-9_]{1,63}$/, 64),
+    providerEnvironment: environment,
+    status,
+    errorCode: optionalString(body, "errorCode", /^[A-Z][A-Z0-9_]{2,127}$/, 128),
+    circuitOpenUntil: optionalString(body, "circuitOpenUntil", /^\d{4}-\d{2}-\d{2}T/, 40)
+  };
+}
+async function mutateRoute(platform, actor, body, idempotencyKey) {
+  const operation = requiredString(body, "operation", /^(propose|approve|apply)$/, 16);
+  const input = {
+    operation,
+    targetRoutePolicyId: optionalString(body, "targetRoutePolicyId", IDENTIFIER, 128),
+    requestId: optionalString(body, "requestId", IDENTIFIER, 128),
+    action: optionalString(body, "action", /^(activate|drain|rollback)$/, 16),
+    reasonCode: optionalString(body, "reasonCode", REASON, 128)
+  };
+  if (operation !== "propose") {
+    const snapshot = await platform.admin.routes(actor);
+    const change = snapshot.routeChanges.find((row) => row.id === input.requestId);
+    if (operation === "approve") assertSeparationOfDuties(actor, stringField(change, "proposedBy"), "approve this route change");
+    if (operation === "apply") assertSeparationOfDuties(actor, stringField(change, "approvedBy"), "apply this route change");
+  }
+  return platform.admin.mutateRoute(actor, input, idempotencyKey);
+}
+async function mutateReview(platform, actor, body, idempotencyKey) {
+  const operation = requiredString(
+    body,
+    "operation",
+    /^(begin_appeal_review|propose_manual_exception|approve_manual_exception|apply_manual_exception)$/,
+    40
+  );
+  const input = {
+    operation,
+    appealId: optionalString(body, "appealId", IDENTIFIER, 128),
+    requestId: optionalString(body, "requestId", IDENTIFIER, 128),
+    packageCode: optionalString(body, "packageCode", PACKAGE, 80),
+    decision: optionalString(body, "decision", /^(approve|deny|revoke|request_more_information)$/, 40),
+    reasonCode: optionalString(body, "reasonCode", REASON, 128),
+    policyVersionId: optionalString(body, "policyVersionId", IDENTIFIER, 128),
+    evidenceReferenceHash: optionalString(body, "evidenceReferenceHash", HASH, 64),
+    expiresAt: optionalString(body, "expiresAt", /^\d{4}-\d{2}-\d{2}T/, 40)
+  };
+  if (operation === "approve_manual_exception" || operation === "apply_manual_exception") {
+    const snapshot = await platform.admin.review(actor);
+    const exception = snapshot.manualExceptions.find((row) => row.id === input.requestId);
+    if (operation === "approve_manual_exception") {
+      assertSeparationOfDuties(actor, stringField(exception, "proposedBy"), "approve this manual exception");
+    }
+    if (operation === "apply_manual_exception") {
+      assertSeparationOfDuties(actor, stringField(exception, "approvedBy"), "apply this manual exception");
+    }
+  }
+  return platform.admin.mutateReview(actor, input, idempotencyKey);
+}
+function parseWorkerQueue(value) {
+  if (value === "webhook" || value === "reconciliation" || value === "redaction" || value === "dead_letter") return value;
+  throw new VerificationHttpError(400, "INVALID_REQUEST", "Invalid queue.");
+}
+function requireAttemptId(value) {
+  if (!value || !ATTEMPT_ID.test(value)) {
+    throw new VerificationHttpError(400, "INVALID_REQUEST", "Invalid attempt id.");
+  }
+  return value;
+}
+function sanitizeMetadata(value) {
+  const result = {};
+  for (const [key, nested] of Object.entries(value)) {
+    if (typeof nested === "string" || typeof nested === "number" || typeof nested === "boolean" || nested === null) {
+      result[key] = nested;
+    }
+  }
+  return result;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringField(record, key) {
+  const value = record?.[key];
+  return typeof value === "string" ? value : null;
+}
+
+// src/openapi.ts
+function buildOpenApiDocument() {
+  const paths = {};
+  for (const route of V1_ROUTES) {
+    const path = toOpenApiPath(route.path);
+    const item = paths[path] ?? {};
+    item[route.method.toLowerCase()] = {
+      operationId: route.id,
+      summary: route.id.replace(/[._]/g, " "),
+      security: route.auth === "none" ? [] : [{ actor: [] }],
+      parameters: [
+        ...route.idempotency ? [{
+          name: "Idempotency-Key",
+          in: "header",
+          required: true,
+          schema: { type: "string", minLength: 8, maxLength: 128 }
+        }] : [],
+        ...pathParams(path)
+      ],
+      responses: {
+        "200": { description: "Success", content: { "application/json": { schema: { type: "object" } } } },
+        "202": { description: "Accepted" },
+        "400": { description: "Invalid request", content: { "application/json": { schema: { $ref: "#/components/schemas/SafeErrorEnvelope" } } } },
+        "401": { description: "Unauthenticated" },
+        "403": { description: "Forbidden" },
+        "404": { description: "Not found" }
+      }
+    };
+    paths[path] = item;
+  }
+  return {
+    openapi: "3.1.0",
+    info: {
+      title: "SplitIn Verification Server API",
+      version: "1.0.0",
+      license: { name: "MIT" },
+      description: "Provider-neutral verification session, webhook, worker, and operations API."
+    },
+    servers: [{ url: "/" }],
+    paths,
+    components: {
+      securitySchemes: {
+        actor: { type: "http", scheme: "bearer", description: "Host-authenticated actor. Cookies require Origin/CSRF." }
+      },
+      schemas: {
+        SafeErrorEnvelope: {
+          type: "object",
+          additionalProperties: false,
+          required: ["contractVersion", "error", "safeErrorCode", "retryAfter", "supportPath"],
+          properties: {
+            contractVersion: { const: "1.0.0" },
+            error: {
+              type: "object",
+              required: ["code", "message", "retryable"],
+              properties: {
+                code: { type: "string" },
+                message: { type: "string" },
+                retryable: { type: "boolean" }
+              }
+            },
+            safeErrorCode: { type: "string" },
+            retryAfter: { type: ["integer", "null"] },
+            supportPath: { type: ["string", "null"] }
+          }
+        }
+      }
+    }
+  };
+}
+function openApiPathList() {
+  return listV1Paths();
+}
+function toOpenApiPath(path) {
+  return path.replace(/:([A-Za-z0-9_]+)/g, "{$1}");
+}
+function pathParams(path) {
+  return [...path.matchAll(/\{([A-Za-z0-9_]+)\}/g)].map((match) => ({
+    name: match[1],
+    in: "path",
+    required: true,
+    schema: { type: "string" }
+  }));
+}
+
+exports.API_CONTRACT_VERSION = API_CONTRACT_VERSION;
+exports.FORBIDDEN_CLIENT_FIELDS = FORBIDDEN_CLIENT_FIELDS;
+exports.SESSION_CONTRACT_VERSION = SESSION_CONTRACT_VERSION;
+exports.V1_ROUTES = V1_ROUTES;
+exports.VerificationHttpError = VerificationHttpError;
+exports.buildOpenApiDocument = buildOpenApiDocument;
+exports.createEngineServerPlatform = createEngineServerPlatform;
+exports.createVerificationFetchHandler = createVerificationFetchHandler;
+exports.listV1Paths = listV1Paths;
+exports.matchV1Route = matchV1Route;
+exports.openApiPathList = openApiPathList;
+exports.toOpenApiPath = toOpenApiPath;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map