@spreadspace/embed 0.1.0

package/dist/index.d.cts

@@ -0,0 +1,682 @@
+import { C as CursorPaginated, R as RequestOptions, v as verifyWebhookSignature, a as verifyAndParseWebhook } from './webhooks-D6PW9fcE.cjs';
+export { D as DocumentFailedPayload, b as DocumentProcessedPayload, E as ExtractionReadyPayload, J as JobCompletedPayload, L as LoanClassifiedPayload, V as VerifyAndParseResult, c as VerifyOptions, W as WebhookEvent, d as WebhookEventType, e as WebhookSignatureError } from './webhooks-D6PW9fcE.cjs';
+
+/**
+ * Public error hierarchy for the SpreadSpace SDK.
+ *
+ * Any non-2xx response from the API is thrown as an instance of one of the
+ * subclasses below so integrators can pattern-match on the error type without
+ * parsing response bodies. The shape mirrors the canonical
+ * `ApiErrorResponse` envelope:
+ *
+ *   { error: { type, message, request_id, details? } }
+ *
+ * `request_id` is preserved on every thrown error so customers can quote it
+ * in support tickets.
+ */
+interface SpreadSpaceErrorParams {
+    type: string;
+    message: string;
+    statusCode: number;
+    requestId?: string;
+    rawBody?: unknown;
+    details?: Record<string, string>;
+}
+/**
+ * Base class for every error thrown by the SDK in response to a non-2xx
+ * API response. Network-layer failures (DNS, TCP reset, fetch abort) are
+ * surfaced as `NetworkError`.
+ */
+declare class SpreadSpaceError extends Error {
+    /**
+     * The canonical `error.type` string from the API envelope, e.g.
+     * `invalid_request`, `rate_limited`, `idempotency_request_mismatch`.
+     * Stable across versions — clients pattern-match on this.
+     */
+    readonly type: string;
+    /** HTTP status code. */
+    readonly statusCode: number;
+    /** `X-Request-ID` echoed from the server. Quote in support tickets. */
+    readonly requestId?: string;
+    /** Raw response body for debugging. May be the parsed JSON or a string. */
+    readonly rawBody?: unknown;
+    /** Optional structured details (e.g. `borrower_id` on `pii_claim_required`). */
+    readonly details?: Record<string, string>;
+    constructor(params: SpreadSpaceErrorParams);
+}
+/** 400 Bad Request — typically schema validation. */
+declare class InvalidRequestError extends SpreadSpaceError {
+}
+/** 401 Unauthorized — missing, expired, or invalid API key. */
+declare class AuthenticationError extends SpreadSpaceError {
+}
+/**
+ * 403 Forbidden — caller is authenticated but lacks permission. Includes
+ * the PII-claim-required and business-email-required cases.
+ */
+declare class PermissionError extends SpreadSpaceError {
+}
+/** 404 Not Found. */
+declare class NotFoundError extends SpreadSpaceError {
+}
+/**
+ * 409 Conflict — typically `idempotency_request_mismatch` (same key, different
+ * body) or a domain-specific conflict (duplicate resource).
+ */
+declare class ConflictError extends SpreadSpaceError {
+}
+/**
+ * 429 Too Many Requests. The SDK retries automatically up to `maxRetries`,
+ * honoring `Retry-After`; this error is only thrown when retries are
+ * exhausted.
+ */
+declare class RateLimitError extends SpreadSpaceError {
+}
+/**
+ * 5xx Server Error. Retries are exhausted by the time this surfaces.
+ */
+declare class ServerError extends SpreadSpaceError {
+}
+/**
+ * Transport-level failure — DNS, TCP reset, fetch abort, JSON parse failure
+ * on a 2xx response. Distinct from API-shaped errors so integrators can
+ * decide to retry differently.
+ */
+declare class NetworkError extends Error {
+    readonly cause?: unknown;
+    constructor(message: string, cause?: unknown);
+}
+
+/**
+ * Pager handed back from resource `.list()` methods. Three ways to consume:
+ *
+ * 1. **`for await`** — iterate every item across all pages. The most common.
+ *
+ *      for await (const loan of client.loans.list()) { ... }
+ *
+ * 2. **`.toArray()`** — eagerly drain into a single array. Convenient for
+ *    small result sets; avoid for unbounded queries (the entire result
+ *    must fit in memory).
+ *
+ *      const loans = await client.loans.list().toArray();
+ *
+ * 3. **`for await ... of pager.pages()`** — iterate page-at-a-time, one
+ *    network round-trip per loop body. Useful when the integrator wants to
+ *    batch-process results (e.g. write a chunk to a DB, then continue).
+ *
+ *      for await (const page of client.loans.list().pages()) { ... }
+ */
+interface AsyncPager<T> extends AsyncIterableIterator<T> {
+    /**
+     * Eagerly consume every page and return all items as a single array.
+     * Throws if any underlying request fails.
+     */
+    toArray(): Promise<T[]>;
+    /**
+     * Page-by-page async iterator. Each yielded value is a
+     * `CursorPaginated<T>` envelope — useful when you want to control
+     * batch-size flow rather than per-item flow.
+     */
+    pages(): AsyncIterableIterator<CursorPaginated<T>>;
+}
+
+/**
+ * Resource facade for `/api/borrowers`. Includes both the standard CRUD
+ * verbs and the borrower-specific flows that don't fit `update()` —
+ * `claim()` (PII-claim flow, SOC 2 / GLBA) and `grantAudit()` (audit
+ * delegation).
+ */
+declare class BorrowersResource {
+    private readonly client;
+    constructor(client: SpreadSpaceClient);
+    /**
+     * Retrieve a borrower by id.
+     *
+     *   GET /api/borrowers/{id}
+     */
+    retrieve<T = unknown>(borrowerId: string, options?: RequestOptions): Promise<T>;
+    /**
+     * Create a new borrower.
+     *
+     *   POST /api/borrowers
+     */
+    create<T = unknown>(params: Record<string, unknown>, options?: RequestOptions): Promise<T>;
+    /**
+     * Iterate every borrower visible to the calling principal.
+     *
+     *   GET /api/borrowers
+     */
+    list<T = unknown>(params?: {
+        limit?: number;
+        cursor?: string;
+    }, options?: RequestOptions): AsyncPager<T>;
+    /**
+     * Assign a lender to this borrower.
+     *
+     *   POST /api/borrowers/{id}/assign
+     */
+    assign<T = unknown>(borrowerId: string, params: Record<string, unknown>, options?: RequestOptions): Promise<T>;
+    /**
+     * Claim PII access on a borrower. Required by SOC 2 / GLBA before an
+     * admin can view the borrower's extracted financials. Surfaced as a verb
+     * method (rather than `update()`) because the audit log records this as
+     * a distinct event and integrators reading the SDK want to see the flow
+     * by name.
+     *
+     *   POST /api/borrowers/{id}/claim
+     */
+    claim<T = unknown>(borrowerId: string, params: Record<string, unknown>, options?: RequestOptions): Promise<T>;
+    /**
+     * Fetch the audit log for a borrower (PII access events, claim grants,
+     * etc.).
+     *
+     *   GET /api/borrowers/{id}/audit-log
+     */
+    auditLog<T = unknown>(borrowerId: string, options?: RequestOptions): Promise<T>;
+    /**
+     * List loans associated with a borrower.
+     *
+     *   GET /api/borrowers/{borrowerId}/loans
+     */
+    loans<T = unknown>(borrowerId: string, params?: {
+        limit?: number;
+        cursor?: string;
+    }, options?: RequestOptions): AsyncPager<T>;
+    /**
+     * List jobs (document packages) for a borrower.
+     *
+     *   GET /api/borrowers/{id}/jobs
+     */
+    jobs<T = unknown>(borrowerId: string, params?: {
+        limit?: number;
+        cursor?: string;
+    }, options?: RequestOptions): AsyncPager<T>;
+    /**
+     * Fetch results for a specific job under a borrower.
+     *
+     *   GET /api/borrowers/{id}/jobs/{jobId}/results
+     */
+    jobResults<T = unknown>(borrowerId: string, jobId: string, options?: RequestOptions): Promise<T>;
+}
+
+/**
+ * Resource facade for the document upload pipeline. Documents flow:
+ *
+ *   1. `presignedUrl()` to get a signed S3 PUT URL
+ *   2. The integrator's backend uploads bytes directly to S3
+ *   3. `confirmUpload()` to kick off the extraction pipeline
+ *   4. Webhook `extraction.ready` fires when results are queryable
+ *
+ * No `update()` — once uploaded, document content is immutable; metadata
+ * lives on the parent borrower / loan / job.
+ */
+declare class DocumentsResource {
+    private readonly client;
+    constructor(client: SpreadSpaceClient);
+    /**
+     * Request a presigned S3 PUT URL for a single document upload.
+     *
+     *   POST /api/documents/presigned-url
+     */
+    presignedUrl<T = unknown>(params: Record<string, unknown>, options?: RequestOptions): Promise<T>;
+    /**
+     * Confirm a single uploaded document, kicking off the extraction
+     * pipeline.
+     *
+     *   POST /api/documents/{jobId}/confirm-upload
+     */
+    confirmUpload<T = unknown>(jobId: string, params?: Record<string, unknown>, options?: RequestOptions): Promise<T>;
+    /**
+     * Confirm a batch of uploaded documents in a single request. Faster than
+     * looping `confirmUpload()` when the integrator has many files in one
+     * package.
+     *
+     *   POST /api/documents/confirm-uploads
+     */
+    batchConfirm<T = unknown>(params: Record<string, unknown>, options?: RequestOptions): Promise<T>;
+    /**
+     * Get a presigned S3 GET URL to download a previously-uploaded document.
+     *
+     *   GET /api/documents/{jobId}/download-url
+     */
+    downloadUrl<T = unknown>(jobId: string, options?: RequestOptions): Promise<T>;
+    /**
+     * Fetch processing status for a document upload.
+     *
+     *   GET /api/documents/{jobId}/status
+     */
+    status<T = unknown>(jobId: string, options?: RequestOptions): Promise<T>;
+}
+
+/**
+ * Resource facade for embed sessions — short-lived tokens scoped to a
+ * single loan. Mint server-side via the integrator's API key, then pass
+ * the resulting `embed_token` to the browser to bootstrap the SpreadSpace
+ * review widget.
+ *
+ * Sub-namespace structure (`embed.sessions.create(...)`) mirrors the route
+ * shape (`/api/embed/sessions`) and leaves room for future embed
+ * resources without crowding the top-level `embed` object.
+ */
+declare class EmbedSessionsResource {
+    private readonly client;
+    constructor(client: SpreadSpaceClient);
+    /**
+     * Mint an embed-session token for a loan. The minted token has a strict
+     * subset of the calling API key's scopes and is locked to the supplied
+     * `loan_id` — it cannot be used to access other loans or to mint further
+     * tokens.
+     *
+     *   POST /api/embed/sessions
+     *
+     *   Body: { loan_id, scopes?, expires_in_seconds? }
+     *   Returns: { embed_token, expires_at, ... }
+     */
+    create<T = unknown>(params: Record<string, unknown>, options?: RequestOptions): Promise<T>;
+    /**
+     * Revoke an embed session early — useful when the integrator's UI flow
+     * ends before the natural expiry, or when reissuing after a logout.
+     *
+     *   DELETE /api/embed/sessions/{sessionId}
+     */
+    revoke<T = unknown>(sessionId: string, options?: RequestOptions): Promise<T>;
+}
+/**
+ * Top-level `client.embed` namespace. Currently surfaces only the
+ * `sessions` sub-resource; future phases (e.g. embed-only audit logs)
+ * land here.
+ */
+declare class EmbedResource {
+    readonly sessions: EmbedSessionsResource;
+    constructor(client: SpreadSpaceClient);
+}
+
+/**
+ * Resource facade for extracted document data. Extractions are scoped under
+ * a borrower (the canonical PII boundary) — every endpoint takes a
+ * `borrowerId` path segment so the multi-tenant access checks have an
+ * unambiguous scope.
+ *
+ * Per-document-type endpoints (`balanceSheet`, `pl`, etc.) return
+ * roll-ups across all documents of that type uploaded for the borrower.
+ * The generic `query()` is the structured-search endpoint —
+ * integrators that build their own UIs on top of the extraction data
+ * typically want this one.
+ *
+ * `move()` reassigns a document's loan binding — shipped as a verb method
+ * (not `update()`) because it traverses the loan-membership tables, not
+ * the extraction row.
+ */
+declare class ExtractionsResource {
+    private readonly client;
+    constructor(client: SpreadSpaceClient);
+    /**
+     * Iterate every extraction for a borrower.
+     *
+     *   GET /api/borrowers/{borrowerId}/extractions
+     */
+    list<T = unknown>(borrowerId: string, params?: {
+        limit?: number;
+        cursor?: string;
+    }, options?: RequestOptions): AsyncPager<T>;
+    /**
+     * Structured query across a borrower's extractions. Filter by document
+     * type, period, and other metadata.
+     *
+     *   POST /api/borrowers/{borrowerId}/extractions/query
+     */
+    query<T = unknown>(borrowerId: string, params: Record<string, unknown>, options?: RequestOptions): Promise<T>;
+    /**
+     * Move an extracted document to a different loan under the same
+     * borrower. Use when the user uploaded a doc to the wrong package.
+     *
+     *   POST /api/borrowers/{borrowerId}/extractions/{docId}/move
+     */
+    move<T = unknown>(borrowerId: string, docId: string, params: Record<string, unknown>, options?: RequestOptions): Promise<T>;
+    /**
+     * Roll-up of the borrower's bank-statement analyses across all
+     * uploaded statements.
+     *
+     *   GET /api/borrowers/{borrowerId}/extractions/bank-statement-analysis
+     */
+    bankStatementAnalysis<T = unknown>(borrowerId: string, options?: RequestOptions): Promise<T>;
+    /**
+     * Roll-up of the borrower's balance sheet across all uploaded
+     * balance-sheet documents.
+     */
+    balanceSheet<T = unknown>(borrowerId: string, options?: RequestOptions): Promise<T>;
+    /** P&L roll-up across uploaded P&L documents. */
+    pl<T = unknown>(borrowerId: string, options?: RequestOptions): Promise<T>;
+    /** Cash-flow roll-up. */
+    cashFlow<T = unknown>(borrowerId: string, options?: RequestOptions): Promise<T>;
+    /** Accounts payable roll-up. */
+    accountsPayable<T = unknown>(borrowerId: string, options?: RequestOptions): Promise<T>;
+    /** Accounts receivable roll-up. */
+    accountsReceivable<T = unknown>(borrowerId: string, options?: RequestOptions): Promise<T>;
+    /**
+     * Generic report endpoint — pass the report type as a path segment.
+     * Useful for report types added after this SDK release.
+     *
+     *   GET /api/borrowers/{borrowerId}/extractions/reports/{reportType}
+     */
+    report<T = unknown>(borrowerId: string, reportType: string, options?: RequestOptions): Promise<T>;
+}
+
+/**
+ * Resource facade for `/api/jobs`. A "job" is a document package — a
+ * batch of files uploaded together. Read-only from this surface; jobs
+ * are created implicitly by the upload pipeline.
+ */
+declare class JobsResource {
+    private readonly client;
+    constructor(client: SpreadSpaceClient);
+    /**
+     * Iterate jobs visible to the calling principal.
+     *
+     *   GET /api/jobs
+     */
+    list<T = unknown>(params?: {
+        limit?: number;
+        cursor?: string;
+    }, options?: RequestOptions): AsyncPager<T>;
+    /**
+     * Fetch processing status for a job.
+     *
+     *   GET /api/jobs/{jobId}/status
+     */
+    status<T = unknown>(jobId: string, options?: RequestOptions): Promise<T>;
+    /**
+     * Fetch results for a job — the rolled-up extraction outcomes.
+     *
+     *   GET /api/jobs/{jobId}/results
+     */
+    results<T = unknown>(jobId: string, options?: RequestOptions): Promise<T>;
+}
+
+/**
+ * Resource facade for `/api/loans`. Loans are the top-level package unit —
+ * a borrower has many loans, each loan is the scope of a documents bundle.
+ */
+declare class LoansResource {
+    private readonly client;
+    constructor(client: SpreadSpaceClient);
+    /**
+     * Retrieve a loan by id.
+     *
+     *   GET /api/loans/{loanId}
+     */
+    retrieve<T = unknown>(loanId: string, options?: RequestOptions): Promise<T>;
+    /**
+     * Create a new loan.
+     *
+     *   POST /api/loans
+     */
+    create<T = unknown>(params: Record<string, unknown>, options?: RequestOptions): Promise<T>;
+    /**
+     * Update an existing loan.
+     *
+     *   PATCH /api/loans/{loanId}
+     */
+    update<T = unknown>(loanId: string, params: Record<string, unknown>, options?: RequestOptions): Promise<T>;
+    /**
+     * Iterate every loan visible to the calling principal. Returns an
+     * `AsyncPager<T>` — consume with `for await`, `.toArray()`, or
+     * `.pages()`.
+     *
+     *   GET /api/loans
+     */
+    list<T = unknown>(params?: {
+        limit?: number;
+        cursor?: string;
+        borrower_id?: string;
+    }, options?: RequestOptions): AsyncPager<T>;
+    /**
+     * Assign a lender to this loan. Calls `POST /api/loans/{id}/assign`.
+     * Surfaced as a verb method rather than forcing it through `update()`
+     * because the assignment flow is semantically distinct from a generic
+     * field patch (it touches the lender-access table, not the loan row).
+     */
+    assign<T = unknown>(loanId: string, params: Record<string, unknown>, options?: RequestOptions): Promise<T>;
+    /**
+     * Fetch the audit log for a loan.
+     *
+     *   GET /api/loans/{loanId}/audit-log
+     */
+    auditLog<T = unknown>(loanId: string, options?: RequestOptions): Promise<T>;
+}
+
+/**
+ * Resource facade for webhook endpoints (`/api/webhooks/*`) plus the
+ * webhook signature helpers as static methods for discoverability.
+ *
+ * The verification helpers are also exported as bare functions from
+ * `@spreadspace/embed/webhooks` for tree-shakeable import paths in
+ * webhook receiver Lambdas (where `SpreadSpaceClient` would otherwise pull
+ * in the entire resource layer).
+ */
+declare class WebhooksResource {
+    private readonly client;
+    /**
+     * Verify a `SpreadSpace-Signature` header against a body and signing
+     * secret. Throws `WebhookSignatureError` on any failure.
+     */
+    static readonly verifySignature: typeof verifyWebhookSignature;
+    /**
+     * Verify a webhook signature and JSON-parse the body into a typed
+     * `WebhookEvent`. Throws `WebhookSignatureError` on signature failure or
+     * invalid JSON.
+     */
+    static readonly verifyAndParse: typeof verifyAndParseWebhook;
+    constructor(client: SpreadSpaceClient);
+    /**
+     * List configured webhook endpoints for this organization.
+     *
+     *   GET /api/webhooks
+     */
+    list<T = unknown>(params?: {
+        limit?: number;
+        cursor?: string;
+    }, options?: RequestOptions): AsyncPager<T>;
+    /**
+     * Retrieve a single webhook endpoint.
+     *
+     *   GET /api/webhooks/{id}
+     */
+    retrieve<T = unknown>(endpointId: string, options?: RequestOptions): Promise<T>;
+    /**
+     * Create a new webhook endpoint. The response carries the plaintext
+     * signing secret exactly once — store it server-side, do not log it.
+     *
+     *   POST /api/webhooks
+     */
+    create<T = unknown>(params: Record<string, unknown>, options?: RequestOptions): Promise<T>;
+    /**
+     * Update endpoint metadata (URL, subscribed event types, enabled flag).
+     *
+     *   PATCH /api/webhooks/{id}
+     */
+    update<T = unknown>(endpointId: string, params: Record<string, unknown>, options?: RequestOptions): Promise<T>;
+    /**
+     * Delete a webhook endpoint.
+     *
+     *   DELETE /api/webhooks/{id}
+     */
+    delete<T = unknown>(endpointId: string, options?: RequestOptions): Promise<T>;
+    /**
+     * Rotate an endpoint's signing secret. The old secret remains valid for
+     * a grace window so deliveries in flight aren't dropped. Returns the new
+     * plaintext secret exactly once.
+     *
+     *   POST /api/webhooks/{id}/rotate
+     */
+    rotateSecret<T = unknown>(endpointId: string, params?: Record<string, unknown>, options?: RequestOptions): Promise<T>;
+    /**
+     * Iterate delivery attempts for an endpoint.
+     *
+     *   GET /api/webhooks/{id}/deliveries
+     */
+    deliveries<T = unknown>(endpointId: string, params?: {
+        limit?: number;
+        cursor?: string;
+    }, options?: RequestOptions): AsyncPager<T>;
+    /**
+     * Manually replay a delivery (e.g. after fixing a downstream outage).
+     *
+     *   POST /api/webhooks/{id}/deliveries/{deliveryId}/replay
+     */
+    replayDelivery<T = unknown>(endpointId: string, deliveryId: string, params?: Record<string, unknown>, options?: RequestOptions): Promise<T>;
+}
+
+interface SpreadSpaceClientOptions {
+    /**
+     * The API key for authentication. Live keys begin with `ss_live_`, test
+     * keys with `ss_test_`. Issue and manage keys from the SpreadSpace
+     * dashboard.
+     */
+    apiKey: string;
+    /**
+     * Base URL for the API. Defaults to `https://api.spreadspace.app`.
+     * Override for staging (`https://staging-api.spreadspace.app`) or for
+     * local development (`http://localhost:8080`).
+     */
+    baseUrl?: string;
+    /**
+     * Override the SDK-pinned `SpreadSpace-Version` header. Defaults to the
+     * version this SDK release was built against. Set this only when
+     * intentionally targeting a different surface version than the SDK was
+     * tested against.
+     */
+    apiVersion?: string;
+    /**
+     * Request timeout in milliseconds. Default: 30000 (30s). The timeout is
+     * applied per individual HTTP attempt — retries get a fresh window each.
+     */
+    timeout?: number;
+    /**
+     * Maximum number of retry attempts after the initial request. Default: 3.
+     * Retries trigger on:
+     *   - 429 Rate Limited (honors `Retry-After` if present)
+     *   - 5xx Server Errors
+     *   - Transport-level network failures
+     * 4xx other than 429 do not retry.
+     */
+    maxRetries?: number;
+    /**
+     * Custom `fetch` implementation. Defaults to `globalThis.fetch`. Inject a
+     * mock here to write hermetic tests without monkey-patching the global.
+     */
+    fetch?: typeof fetch;
+    /**
+     * Custom idempotency-key generator. Defaults to `crypto.randomUUID()`.
+     */
+    idempotencyKeyGenerator?: () => string;
+}
+/**
+ * Internal options for the low-level `request()` method. Resource methods
+ * compose these on top of the public `RequestOptions`.
+ */
+interface InternalRequestOptions extends RequestOptions {
+    /**
+     * JSON-serializable request body. Encoded as `application/json` with
+     * `Content-Type: application/json; charset=utf-8`.
+     */
+    body?: unknown;
+    /**
+     * Query parameters appended to the URL. `undefined` values are skipped.
+     */
+    query?: Record<string, string | number | boolean | undefined>;
+}
+/**
+ * Top-level entry point of the SpreadSpace SDK.
+ *
+ * Single instance per integrator process — the resources hanging off it are
+ * thin facades, not separate clients, so spinning up multiple
+ * `SpreadSpaceClient`s only matters when juggling multiple API keys.
+ *
+ * Wire-format invariants the client guarantees on every request:
+ *   - `Authorization: Bearer <apiKey>`
+ *   - `SpreadSpace-Version: <apiVersion>`
+ *   - `User-Agent: spreadspace-node/<sdkVersion> node/<nodeVersion>`
+ *   - `Idempotency-Key: <auto-generated UUID>` on every POST/PATCH/PUT/DELETE
+ *     unless the caller supplies one explicitly or sets `idempotencyKey: null`
+ *
+ * Retries on 429, 5xx, and transport failures up to `maxRetries` times with
+ * exponential backoff (capped) and jitter; honors `Retry-After`.
+ */
+declare class SpreadSpaceClient {
+    /** Resolved base URL (no trailing slash). */
+    readonly baseUrl: string;
+    /** Resolved API version string (the `SpreadSpace-Version` header value). */
+    readonly apiVersion: string;
+    /** Public so resource files can pull it for `paginate()` URL construction. */
+    readonly maxRetries: number;
+    readonly loans: LoansResource;
+    readonly borrowers: BorrowersResource;
+    readonly documents: DocumentsResource;
+    readonly extractions: ExtractionsResource;
+    readonly jobs: JobsResource;
+    readonly webhooks: WebhooksResource;
+    readonly embed: EmbedResource;
+    private readonly apiKey;
+    private readonly timeoutMs;
+    private readonly fetchImpl;
+    private readonly idempotencyKeyGenerator;
+    constructor(options: SpreadSpaceClientOptions);
+    /**
+     * Low-level request method. Resource layer wraps this with ergonomic
+     * method names; integrators can call it directly to hit endpoints not yet
+     * surfaced via a typed resource.
+     *
+     * Returns the parsed JSON body. For 204 No Content responses (currently
+     * none in the API but reserved), returns `undefined as T`.
+     */
+    request<T>(method: 'GET' | 'POST' | 'PATCH' | 'PUT' | 'DELETE', path: string, options?: InternalRequestOptions): Promise<T>;
+    /**
+     * Convenience wrapper around `paginate()` for resource list methods. Lets
+     * each resource simply do `return this.client.paginate(...)` rather than
+     * importing the helper directly.
+     */
+    paginate<T>(path: string, params?: Record<string, string | number | boolean | undefined>, options?: RequestOptions): AsyncPager<T>;
+    private buildUrl;
+    private buildHeaders;
+    private buildUserAgent;
+    /**
+     * Compute the next retry delay. Exponential backoff with full jitter,
+     * floored by `Retry-After` if the server provided one (we never retry
+     * faster than the server asked us to).
+     *
+     *   base = min(maxDelay, baseDelay * 2^attempt)
+     *   delay = random(0, base)
+     *
+     * Full jitter (vs. equal jitter) is the AWS-recommended default — it
+     * minimizes thundering-herd across many concurrent retrying clients.
+     */
+    private computeRetryDelay;
+    private parseSuccessBody;
+    private buildErrorFromResponse;
+}
+
+/**
+ * The SDK package version. Sent on every outbound request as part of the
+ * `User-Agent` string so server-side telemetry can pick up which SDK release
+ * a customer is running.
+ *
+ * Hand-rolled rather than imported from `package.json` because tsup output
+ * doesn't include the package manifest — keeping it as a TS literal avoids a
+ * runtime `fs` read from the dist bundle.
+ *
+ * Bump in lockstep with `package.json`.
+ */
+declare const SDK_VERSION = "0.1.0";
+/**
+ * Default API surface version pinned by this SDK release. Sent as the
+ * `SpreadSpace-Version` header on every request unless the integrator
+ * overrides it via `SpreadSpaceClientOptions.apiVersion`.
+ *
+ * Once the SDK is published, this value is the contract: the SDK guarantees
+ * the request/response shapes match this dated surface. Bumping requires a
+ * new SDK release that codegens against the new spec.
+ */
+declare const DEFAULT_API_VERSION = "2026-05-03";
+
+export { type AsyncPager, AuthenticationError, BorrowersResource, ConflictError, CursorPaginated, DEFAULT_API_VERSION, DocumentsResource, EmbedResource, EmbedSessionsResource, ExtractionsResource, type InternalRequestOptions, InvalidRequestError, JobsResource, LoansResource, NetworkError, NotFoundError, PermissionError, RateLimitError, RequestOptions, SDK_VERSION, ServerError, SpreadSpaceClient, type SpreadSpaceClientOptions, SpreadSpaceError, WebhooksResource, verifyAndParseWebhook, verifyWebhookSignature };