@vaam-apps/vsms-node 0.3.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Vymalo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,54 @@
+# @vaam-apps/vsms-node
+
+Official Node.js SDK for [vsms](https://github.com/vaam-apps/vsms).
+
+Owns the `private_key_jwt` credential lifecycle, so a caller writes `client.sendMessage(...)` and never touches a JWT.
+
+## Features
+
+- **Automated `private_key_jwt` Auth**: Automatic assertion signing (RFC 7523), token acquisition, in-memory caching with safety margins, and single-flight de-duplication.
+- **Bounded 401 Refresh**: Transparently renews the access token and retries once if a token is invalidated mid-flight.
+- **Idempotency Support**: Built-in support for `Idempotency-Key` headers and response replay tracking (`SendMessageOutcome.idempotencyReplayed`).
+- **Standard TypeScript Types**: Clean domain types with zero framework lock-in.
+
+## Installation
+
+```bash
+npm install @vaam-apps/vsms-node
+# or
+pnpm add @vaam-apps/vsms-node
+```
+
+## Quickstart
+
+```typescript
+import { VsmsClient } from "@vaam-apps/vsms-node";
+
+// Initialize client with private key on disk or PEM string
+const client = VsmsClient.privateKeyJwt({
+  issuer: "http://127.0.0.1:8080",
+  clientId: "your-client-id",
+  keyPath: "/path/to/client-key.pem",
+  // scope defaults to "sms:send sms:read"
+});
+
+// Send an SMS
+const outcome = await client.sendMessage(
+  {
+    to: "+237677123456",
+    senderId: "VYMALO",
+    body: "Hello from @vaam-apps/vsms-node!",
+  },
+  {
+    // Optional retry-safe idempotency key
+    idempotencyKey: "my-custom-order-id-123",
+  }
+);
+
+console.log("Sent message:", outcome.result.messageId, "State:", outcome.result.state);
+console.log("Was replayed from cache:", outcome.idempotencyReplayed);
+
+// Read message status
+const message = await client.getMessage(outcome.result.messageId);
+console.log("Status:", message.state);
+```

package/dist/client.d.ts

@@ -0,0 +1,43 @@
+import { type PrivateKeyJwtConfigOptions, type TokenStore } from "./token.js";
+import type { Message, PreviewInput, PreviewResult, SendMessageInput, SendMessageResult } from "./types.js";
+export interface SendMessageOptions {
+    idempotencyKey?: string | undefined;
+}
+export interface SendMessageOutcome {
+    result: SendMessageResult;
+    idempotencyReplayed: boolean;
+}
+export interface VsmsClientOptions {
+    baseUrl: string;
+    tokenStore: TokenStore;
+}
+export interface PrivateKeyJwtClientOptions extends PrivateKeyJwtConfigOptions {
+    keyPath?: string | undefined;
+    privateKeyPem?: string | undefined;
+}
+export declare class VsmsClient {
+    #private;
+    constructor(options: VsmsClientOptions);
+    /**
+     * Convenience factory: constructs a VsmsClient using private_key_jwt authentication.
+     *
+     * Note: in this deployment, the OP issuer and API origin are the same host (sms-gateway
+     * mounts both /token and the REST router on the same listener), so baseUrl defaults to issuer.
+     */
+    static privateKeyJwt(options: PrivateKeyJwtClientOptions): VsmsClient;
+    get tokenStore(): TokenStore;
+    /**
+     * `POST /$procs/sendMessage`. Handles token acquisition, caching, bounded 401 retry,
+     * and optional `Idempotency-Key` header with replay tracking.
+     */
+    sendMessage(input: SendMessageInput, options?: SendMessageOptions | undefined): Promise<SendMessageOutcome>;
+    /**
+     * `POST /$procs/previewMessage`.
+     */
+    previewMessage(input: PreviewInput): Promise<PreviewResult>;
+    /**
+     * `GET /messages/{id}`.
+     */
+    getMessage(id: string): Promise<Message>;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,0BAA0B,EAE/B,KAAK,UAAU,EAChB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAKpB,MAAM,WAAW,kBAAkB;IACjC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,0BAA2B,SAAQ,0BAA0B;IAC5E,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAQD,qBAAa,UAAU;;gBAIT,OAAO,EAAE,iBAAiB;IAKtC;;;;;OAKG;IACH,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,0BAA0B,GAAG,UAAU;IAgBrE,IAAI,UAAU,IAAI,UAAU,CAE3B;IA4CD;;;OAGG;IACG,WAAW,CACf,KAAK,EAAE,gBAAgB,EACvB,OAAO,CAAC,EAAE,kBAAkB,GAAG,SAAS,GACvC,OAAO,CAAC,kBAAkB,CAAC;IA+C9B;;OAEG;IACG,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;IA8BjE;;OAEG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CA2B/C"}

package/dist/client.js

@@ -0,0 +1,167 @@
+import { SdkError } from "./error.js";
+import { PrivateKeyJwtTokenStore } from "./token.js";
+const IDEMPOTENCY_REPLAYED_HEADER = "idempotency-replayed";
+const IDEMPOTENCY_KEY_HEADER = "idempotency-key";
+export class VsmsClient {
+    #baseUrl;
+    #tokenStore;
+    constructor(options){
+        this.#baseUrl = options.baseUrl.replace(/\/+$/, "");
+        this.#tokenStore = options.tokenStore;
+    }
+    /**
+   * Convenience factory: constructs a VsmsClient using private_key_jwt authentication.
+   *
+   * Note: in this deployment, the OP issuer and API origin are the same host (sms-gateway
+   * mounts both /token and the REST router on the same listener), so baseUrl defaults to issuer.
+   */ static privateKeyJwt(options) {
+        const tokenStore = new PrivateKeyJwtTokenStore({
+            issuer: options.issuer,
+            clientId: options.clientId,
+            scope: options.scope,
+            audience: options.audience
+        }, {
+            keyPath: options.keyPath,
+            pemString: options.privateKeyPem
+        });
+        return new VsmsClient({
+            baseUrl: options.issuer,
+            tokenStore
+        });
+    }
+    get tokenStore() {
+        return this.#tokenStore;
+    }
+    #parseJsonOrThrow(text, status, method) {
+        try {
+            return JSON.parse(text);
+        } catch (err) {
+            throw new SdkError(`failed to parse ${method} response as JSON: ${text}`, {
+                cause: err,
+                httpStatus: status
+            });
+        }
+    }
+    /**
+   * Helper that calls an authenticated endpoint, with automatic bounded 401 retry.
+   */ async #fetchWithAuth(path, init) {
+        const url = `${this.#baseUrl}${path.startsWith("/") ? path : `/${path}`}`;
+        const makeRequest = async ()=>{
+            const token = await this.#tokenStore.get();
+            const headers = new Headers(init.headers);
+            headers.set("authorization", `Bearer ${token}`);
+            if (!headers.has("accept")) {
+                headers.set("accept", "application/json");
+            }
+            try {
+                return await fetch(url, {
+                    ...init,
+                    headers
+                });
+            } catch (err) {
+                throw new SdkError(`request to ${url} failed: network error`, {
+                    cause: err
+                });
+            }
+        };
+        let res = await makeRequest();
+        if (res.status === 401) {
+            await this.#tokenStore.invalidate();
+            res = await makeRequest();
+        }
+        return res;
+    }
+    /**
+   * `POST /$procs/sendMessage`. Handles token acquisition, caching, bounded 401 retry,
+   * and optional `Idempotency-Key` header with replay tracking.
+   */ async sendMessage(input, options) {
+        const headers = {
+            "content-type": "application/json",
+            accept: "application/json"
+        };
+        if (options?.idempotencyKey) {
+            headers[IDEMPOTENCY_KEY_HEADER] = options.idempotencyKey;
+        }
+        const response = await this.#fetchWithAuth("/$procs/sendMessage", {
+            method: "POST",
+            headers,
+            body: JSON.stringify({
+                args: input
+            })
+        });
+        const text = await response.text();
+        const isReplayed = response.headers.get(IDEMPOTENCY_REPLAYED_HEADER) === "true";
+        if (!response.ok) {
+            let parsed;
+            try {
+                parsed = JSON.parse(text);
+            } catch  {
+            // Fallback for non-JSON errors (e.g. text/plain idempotency in flight message)
+            }
+            throw new SdkError(parsed?.message ?? text ?? `sendMessage failed with status ${response.status}`, {
+                httpStatus: response.status,
+                gatewayCode: parsed?.code,
+                fieldErrors: typeof parsed?.details === "object" && parsed.details !== null ? parsed.details : undefined
+            });
+        }
+        const result = this.#parseJsonOrThrow(text, response.status, "sendMessage");
+        return {
+            result,
+            idempotencyReplayed: isReplayed
+        };
+    }
+    /**
+   * `POST /$procs/previewMessage`.
+   */ async previewMessage(input) {
+        const response = await this.#fetchWithAuth("/$procs/previewMessage", {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                accept: "application/json"
+            },
+            body: JSON.stringify({
+                args: input
+            })
+        });
+        const text = await response.text();
+        if (!response.ok) {
+            let parsed;
+            try {
+                parsed = JSON.parse(text);
+            } catch  {
+            // fallback
+            }
+            throw new SdkError(parsed?.message ?? text ?? `previewMessage failed with status ${response.status}`, {
+                httpStatus: response.status,
+                gatewayCode: parsed?.code
+            });
+        }
+        return this.#parseJsonOrThrow(text, response.status, "previewMessage");
+    }
+    /**
+   * `GET /messages/{id}`.
+   */ async getMessage(id) {
+        const response = await this.#fetchWithAuth(`/messages/${encodeURIComponent(id)}`, {
+            method: "GET",
+            headers: {
+                accept: "application/json"
+            }
+        });
+        const text = await response.text();
+        if (!response.ok) {
+            let parsed;
+            try {
+                parsed = JSON.parse(text);
+            } catch  {
+            // fallback
+            }
+            throw new SdkError(parsed?.message ?? text ?? `GET /messages/${id} failed with status ${response.status}`, {
+                httpStatus: response.status,
+                gatewayCode: parsed?.code
+            });
+        }
+        return this.#parseJsonOrThrow(text, response.status, `GET /messages/${id}`);
+    }
+}
+
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client.ts"],"sourcesContent":["import { SdkError } from \"./error.js\";\nimport {\n  type PrivateKeyJwtConfigOptions,\n  PrivateKeyJwtTokenStore,\n  type TokenStore,\n} from \"./token.js\";\nimport type {\n  Message,\n  PreviewInput,\n  PreviewResult,\n  SendMessageInput,\n  SendMessageResult,\n} from \"./types.js\";\n\nconst IDEMPOTENCY_REPLAYED_HEADER = \"idempotency-replayed\";\nconst IDEMPOTENCY_KEY_HEADER = \"idempotency-key\";\n\nexport interface SendMessageOptions {\n  idempotencyKey?: string | undefined;\n}\n\nexport interface SendMessageOutcome {\n  result: SendMessageResult;\n  idempotencyReplayed: boolean;\n}\n\nexport interface VsmsClientOptions {\n  baseUrl: string;\n  tokenStore: TokenStore;\n}\n\nexport interface PrivateKeyJwtClientOptions extends PrivateKeyJwtConfigOptions {\n  keyPath?: string | undefined;\n  privateKeyPem?: string | undefined;\n}\n\ninterface CratestackErrorResponseBody {\n  code?: string | undefined;\n  message?: string | undefined;\n  details?: unknown;\n}\n\nexport class VsmsClient {\n  readonly #baseUrl: string;\n  readonly #tokenStore: TokenStore;\n\n  constructor(options: VsmsClientOptions) {\n    this.#baseUrl = options.baseUrl.replace(/\\/+$/, \"\");\n    this.#tokenStore = options.tokenStore;\n  }\n\n  /**\n   * Convenience factory: constructs a VsmsClient using private_key_jwt authentication.\n   *\n   * Note: in this deployment, the OP issuer and API origin are the same host (sms-gateway\n   * mounts both /token and the REST router on the same listener), so baseUrl defaults to issuer.\n   */\n  static privateKeyJwt(options: PrivateKeyJwtClientOptions): VsmsClient {\n    const tokenStore = new PrivateKeyJwtTokenStore(\n      {\n        issuer: options.issuer,\n        clientId: options.clientId,\n        scope: options.scope,\n        audience: options.audience,\n      },\n      {\n        keyPath: options.keyPath,\n        pemString: options.privateKeyPem,\n      },\n    );\n    return new VsmsClient({ baseUrl: options.issuer, tokenStore });\n  }\n\n  get tokenStore(): TokenStore {\n    return this.#tokenStore;\n  }\n\n  #parseJsonOrThrow<T>(text: string, status: number, method: string): T {\n    try {\n      return JSON.parse(text) as T;\n    } catch (err) {\n      throw new SdkError(`failed to parse ${method} response as JSON: ${text}`, {\n        cause: err,\n        httpStatus: status,\n      });\n    }\n  }\n\n  /**\n   * Helper that calls an authenticated endpoint, with automatic bounded 401 retry.\n   */\n  async #fetchWithAuth(path: string, init: RequestInit): Promise<Response> {\n    const url = `${this.#baseUrl}${path.startsWith(\"/\") ? path : `/${path}`}`;\n\n    const makeRequest = async (): Promise<Response> => {\n      const token = await this.#tokenStore.get();\n      const headers = new Headers(init.headers);\n      headers.set(\"authorization\", `Bearer ${token}`);\n      if (!headers.has(\"accept\")) {\n        headers.set(\"accept\", \"application/json\");\n      }\n      try {\n        return await fetch(url, {\n          ...init,\n          headers,\n        });\n      } catch (err) {\n        throw new SdkError(`request to ${url} failed: network error`, { cause: err });\n      }\n    };\n\n    let res = await makeRequest();\n    if (res.status === 401) {\n      await this.#tokenStore.invalidate();\n      res = await makeRequest();\n    }\n    return res;\n  }\n\n  /**\n   * `POST /$procs/sendMessage`. Handles token acquisition, caching, bounded 401 retry,\n   * and optional `Idempotency-Key` header with replay tracking.\n   */\n  async sendMessage(\n    input: SendMessageInput,\n    options?: SendMessageOptions | undefined,\n  ): Promise<SendMessageOutcome> {\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      accept: \"application/json\",\n    };\n    if (options?.idempotencyKey) {\n      headers[IDEMPOTENCY_KEY_HEADER] = options.idempotencyKey;\n    }\n\n    const response = await this.#fetchWithAuth(\"/$procs/sendMessage\", {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify({ args: input }),\n    });\n\n    const text = await response.text();\n    const isReplayed = response.headers.get(IDEMPOTENCY_REPLAYED_HEADER) === \"true\";\n\n    if (!response.ok) {\n      let parsed: CratestackErrorResponseBody | undefined;\n      try {\n        parsed = JSON.parse(text) as CratestackErrorResponseBody;\n      } catch {\n        // Fallback for non-JSON errors (e.g. text/plain idempotency in flight message)\n      }\n\n      throw new SdkError(\n        parsed?.message ?? text ?? `sendMessage failed with status ${response.status}`,\n        {\n          httpStatus: response.status,\n          gatewayCode: parsed?.code,\n          fieldErrors:\n            typeof parsed?.details === \"object\" && parsed.details !== null\n              ? (parsed.details as Record<string, string[]>)\n              : undefined,\n        },\n      );\n    }\n\n    const result = this.#parseJsonOrThrow<SendMessageResult>(text, response.status, \"sendMessage\");\n\n    return {\n      result,\n      idempotencyReplayed: isReplayed,\n    };\n  }\n\n  /**\n   * `POST /$procs/previewMessage`.\n   */\n  async previewMessage(input: PreviewInput): Promise<PreviewResult> {\n    const response = await this.#fetchWithAuth(\"/$procs/previewMessage\", {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/json\",\n        accept: \"application/json\",\n      },\n      body: JSON.stringify({ args: input }),\n    });\n\n    const text = await response.text();\n    if (!response.ok) {\n      let parsed: CratestackErrorResponseBody | undefined;\n      try {\n        parsed = JSON.parse(text) as CratestackErrorResponseBody;\n      } catch {\n        // fallback\n      }\n      throw new SdkError(\n        parsed?.message ?? text ?? `previewMessage failed with status ${response.status}`,\n        {\n          httpStatus: response.status,\n          gatewayCode: parsed?.code,\n        },\n      );\n    }\n\n    return this.#parseJsonOrThrow<PreviewResult>(text, response.status, \"previewMessage\");\n  }\n\n  /**\n   * `GET /messages/{id}`.\n   */\n  async getMessage(id: string): Promise<Message> {\n    const response = await this.#fetchWithAuth(`/messages/${encodeURIComponent(id)}`, {\n      method: \"GET\",\n      headers: {\n        accept: \"application/json\",\n      },\n    });\n\n    const text = await response.text();\n    if (!response.ok) {\n      let parsed: CratestackErrorResponseBody | undefined;\n      try {\n        parsed = JSON.parse(text) as CratestackErrorResponseBody;\n      } catch {\n        // fallback\n      }\n      throw new SdkError(\n        parsed?.message ?? text ?? `GET /messages/${id} failed with status ${response.status}`,\n        {\n          httpStatus: response.status,\n          gatewayCode: parsed?.code,\n        },\n      );\n    }\n\n    return this.#parseJsonOrThrow<Message>(text, response.status, `GET /messages/${id}`);\n  }\n}\n"],"names":["SdkError","PrivateKeyJwtTokenStore","IDEMPOTENCY_REPLAYED_HEADER","IDEMPOTENCY_KEY_HEADER","VsmsClient","options","baseUrl","replace","tokenStore","privateKeyJwt","issuer","clientId","scope","audience","keyPath","pemString","privateKeyPem","text","status","method","JSON","parse","err","cause","httpStatus","path","init","url","startsWith","makeRequest","token","get","headers","Headers","set","has","fetch","res","invalidate","sendMessage","input","accept","idempotencyKey","response","body","stringify","args","isReplayed","ok","parsed","message","gatewayCode","code","fieldErrors","details","undefined","result","idempotencyReplayed","previewMessage","getMessage","id","encodeURIComponent"],"mappings":"AAAA,SAASA,QAAQ,QAAQ,aAAa;AACtC,SAEEC,uBAAuB,QAElB,aAAa;AASpB,MAAMC,8BAA8B;AACpC,MAAMC,yBAAyB;AA2B/B,OAAO,MAAMC;IACF,CAAA,OAAQ,CAAS;IACjB,CAAA,UAAW,CAAa;IAEjC,YAAYC,OAA0B,CAAE;QACtC,IAAI,CAAC,CAAA,OAAQ,GAAGA,QAAQC,OAAO,CAACC,OAAO,CAAC,QAAQ;QAChD,IAAI,CAAC,CAAA,UAAW,GAAGF,QAAQG,UAAU;IACvC;IAEA;;;;;GAKC,GACD,OAAOC,cAAcJ,OAAmC,EAAc;QACpE,MAAMG,aAAa,IAAIP,wBACrB;YACES,QAAQL,QAAQK,MAAM;YACtBC,UAAUN,QAAQM,QAAQ;YAC1BC,OAAOP,QAAQO,KAAK;YACpBC,UAAUR,QAAQQ,QAAQ;QAC5B,GACA;YACEC,SAAST,QAAQS,OAAO;YACxBC,WAAWV,QAAQW,aAAa;QAClC;QAEF,OAAO,IAAIZ,WAAW;YAAEE,SAASD,QAAQK,MAAM;YAAEF;QAAW;IAC9D;IAEA,IAAIA,aAAyB;QAC3B,OAAO,IAAI,CAAC,CAAA,UAAW;IACzB;IAEA,CAAA,gBAAiB,CAAIS,IAAY,EAAEC,MAAc,EAAEC,MAAc;QAC/D,IAAI;YACF,OAAOC,KAAKC,KAAK,CAACJ;QACpB,EAAE,OAAOK,KAAK;YACZ,MAAM,IAAItB,SAAS,CAAC,gBAAgB,EAAEmB,OAAO,mBAAmB,EAAEF,MAAM,EAAE;gBACxEM,OAAOD;gBACPE,YAAYN;YACd;QACF;IACF;IAEA;;GAEC,GACD,MAAM,CAAA,aAAc,CAACO,IAAY,EAAEC,IAAiB;QAClD,MAAMC,MAAM,GAAG,IAAI,CAAC,CAAA,OAAQ,GAAGF,KAAKG,UAAU,CAAC,OAAOH,OAAO,CAAC,CAAC,EAAEA,MAAM,EAAE;QAEzE,MAAMI,cAAc;YAClB,MAAMC,QAAQ,MAAM,IAAI,CAAC,CAAA,UAAW,CAACC,GAAG;YACxC,MAAMC,UAAU,IAAIC,QAAQP,KAAKM,OAAO;YACxCA,QAAQE,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAEJ,OAAO;YAC9C,IAAI,CAACE,QAAQG,GAAG,CAAC,WAAW;gBAC1BH,QAAQE,GAAG,CAAC,UAAU;YACxB;YACA,IAAI;gBACF,OAAO,MAAME,MAAMT,KAAK;oBACtB,GAAGD,IAAI;oBACPM;gBACF;YACF,EAAE,OAAOV,KAAK;gBACZ,MAAM,IAAItB,SAAS,CAAC,WAAW,EAAE2B,IAAI,sBAAsB,CAAC,EAAE;oBAAEJ,OAAOD;gBAAI;YAC7E;QACF;QAEA,IAAIe,MAAM,MAAMR;QAChB,IAAIQ,IAAInB,MAAM,KAAK,KAAK;YACtB,MAAM,IAAI,CAAC,CAAA,UAAW,CAACoB,UAAU;YACjCD,MAAM,MAAMR;QACd;QACA,OAAOQ;IACT;IAEA;;;GAGC,GACD,MAAME,YACJC,KAAuB,EACvBnC,OAAwC,EACX;QAC7B,MAAM2B,UAAkC;YACtC,gBAAgB;YAChBS,QAAQ;QACV;QACA,IAAIpC,SAASqC,gBAAgB;YAC3BV,OAAO,CAAC7B,uBAAuB,GAAGE,QAAQqC,cAAc;QAC1D;QAEA,MAAMC,WAAW,MAAM,IAAI,CAAC,CAAA,aAAc,CAAC,uBAAuB;YAChExB,QAAQ;YACRa;YACAY,MAAMxB,KAAKyB,SAAS,CAAC;gBAAEC,MAAMN;YAAM;QACrC;QAEA,MAAMvB,OAAO,MAAM0B,SAAS1B,IAAI;QAChC,MAAM8B,aAAaJ,SAASX,OAAO,CAACD,GAAG,CAAC7B,iCAAiC;QAEzE,IAAI,CAACyC,SAASK,EAAE,EAAE;YAChB,IAAIC;YACJ,IAAI;gBACFA,SAAS7B,KAAKC,KAAK,CAACJ;YACtB,EAAE,OAAM;YACN,+EAA+E;YACjF;YAEA,MAAM,IAAIjB,SACRiD,QAAQC,WAAWjC,QAAQ,CAAC,+BAA+B,EAAE0B,SAASzB,MAAM,EAAE,EAC9E;gBACEM,YAAYmB,SAASzB,MAAM;gBAC3BiC,aAAaF,QAAQG;gBACrBC,aACE,OAAOJ,QAAQK,YAAY,YAAYL,OAAOK,OAAO,KAAK,OACrDL,OAAOK,OAAO,GACfC;YACR;QAEJ;QAEA,MAAMC,SAAS,IAAI,CAAC,CAAA,gBAAiB,CAAoBvC,MAAM0B,SAASzB,MAAM,EAAE;QAEhF,OAAO;YACLsC;YACAC,qBAAqBV;QACvB;IACF;IAEA;;GAEC,GACD,MAAMW,eAAelB,KAAmB,EAA0B;QAChE,MAAMG,WAAW,MAAM,IAAI,CAAC,CAAA,aAAc,CAAC,0BAA0B;YACnExB,QAAQ;YACRa,SAAS;gBACP,gBAAgB;gBAChBS,QAAQ;YACV;YACAG,MAAMxB,KAAKyB,SAAS,CAAC;gBAAEC,MAAMN;YAAM;QACrC;QAEA,MAAMvB,OAAO,MAAM0B,SAAS1B,IAAI;QAChC,IAAI,CAAC0B,SAASK,EAAE,EAAE;YAChB,IAAIC;YACJ,IAAI;gBACFA,SAAS7B,KAAKC,KAAK,CAACJ;YACtB,EAAE,OAAM;YACN,WAAW;YACb;YACA,MAAM,IAAIjB,SACRiD,QAAQC,WAAWjC,QAAQ,CAAC,kCAAkC,EAAE0B,SAASzB,MAAM,EAAE,EACjF;gBACEM,YAAYmB,SAASzB,MAAM;gBAC3BiC,aAAaF,QAAQG;YACvB;QAEJ;QAEA,OAAO,IAAI,CAAC,CAAA,gBAAiB,CAAgBnC,MAAM0B,SAASzB,MAAM,EAAE;IACtE;IAEA;;GAEC,GACD,MAAMyC,WAAWC,EAAU,EAAoB;QAC7C,MAAMjB,WAAW,MAAM,IAAI,CAAC,CAAA,aAAc,CAAC,CAAC,UAAU,EAAEkB,mBAAmBD,KAAK,EAAE;YAChFzC,QAAQ;YACRa,SAAS;gBACPS,QAAQ;YACV;QACF;QAEA,MAAMxB,OAAO,MAAM0B,SAAS1B,IAAI;QAChC,IAAI,CAAC0B,SAASK,EAAE,EAAE;YAChB,IAAIC;YACJ,IAAI;gBACFA,SAAS7B,KAAKC,KAAK,CAACJ;YACtB,EAAE,OAAM;YACN,WAAW;YACb;YACA,MAAM,IAAIjB,SACRiD,QAAQC,WAAWjC,QAAQ,CAAC,cAAc,EAAE2C,GAAG,oBAAoB,EAAEjB,SAASzB,MAAM,EAAE,EACtF;gBACEM,YAAYmB,SAASzB,MAAM;gBAC3BiC,aAAaF,QAAQG;YACvB;QAEJ;QAEA,OAAO,IAAI,CAAC,CAAA,gBAAiB,CAAUnC,MAAM0B,SAASzB,MAAM,EAAE,CAAC,cAAc,EAAE0C,IAAI;IACrF;AACF"}

package/dist/error.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The one error type this SDK throws or returns.
+ * Wraps REST call errors, OAuth / token failures, and validation errors.
+ */
+export interface SdkErrorOptions {
+    httpStatus?: number | undefined;
+    gatewayCode?: string | undefined;
+    fieldErrors?: Record<string, string[]> | undefined;
+    cause?: unknown;
+}
+export declare class SdkError extends Error {
+    readonly httpStatus: number | undefined;
+    readonly gatewayCode: string | undefined;
+    readonly fieldErrors: Record<string, string[]> | undefined;
+    constructor(message: string, options?: SdkErrorOptions);
+    /**
+     * `true` for a `409 Conflict` (either a duplicate `clientRef` or an in-flight `Idempotency-Key`).
+     */
+    isConflict(): boolean;
+    /**
+     * `true` for the specific `409` `IdempotencyLayer` returns while
+     * another request under the *same* `Idempotency-Key` is still being
+     * processed (not yet reserved-and-replayable).
+     */
+    isIdempotencyInFlight(): boolean;
+    /**
+     * `true` for the `422` `IdempotencyLayer` returns when an
+     * `Idempotency-Key` is reused with a request that doesn't match the
+     * first one under that key byte-for-byte.
+     */
+    isIdempotencyKeyConflict(): boolean;
+    /**
+     * `true` if the final error surfaced from a call was a `401 Unauthorized`
+     * after bounded refresh was attempted.
+     */
+    isUnauthorized(): boolean;
+}
+//# sourceMappingURL=error.d.ts.map

package/dist/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../src/error.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,CAAC;IACnD,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,CAAC;gBAE/C,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe;IAQtD;;OAEG;IACH,UAAU,IAAI,OAAO;IAIrB;;;;OAIG;IACH,qBAAqB,IAAI,OAAO;IAIhC;;;;OAIG;IACH,wBAAwB,IAAI,OAAO;IAInC;;;OAGG;IACH,cAAc,IAAI,OAAO;CAG1B"}

package/dist/error.js

@@ -0,0 +1,44 @@
+/**
+ * The one error type this SDK throws or returns.
+ * Wraps REST call errors, OAuth / token failures, and validation errors.
+ */ export class SdkError extends Error {
+    httpStatus;
+    gatewayCode;
+    fieldErrors;
+    constructor(message, options){
+        super(message, {
+            cause: options?.cause
+        });
+        this.name = "SdkError";
+        this.httpStatus = options?.httpStatus;
+        this.gatewayCode = options?.gatewayCode;
+        this.fieldErrors = options?.fieldErrors;
+    }
+    /**
+   * `true` for a `409 Conflict` (either a duplicate `clientRef` or an in-flight `Idempotency-Key`).
+   */ isConflict() {
+        return this.httpStatus === 409;
+    }
+    /**
+   * `true` for the specific `409` `IdempotencyLayer` returns while
+   * another request under the *same* `Idempotency-Key` is still being
+   * processed (not yet reserved-and-replayable).
+   */ isIdempotencyInFlight() {
+        return this.httpStatus === 409 && this.message.includes("Idempotency-Key");
+    }
+    /**
+   * `true` for the `422` `IdempotencyLayer` returns when an
+   * `Idempotency-Key` is reused with a request that doesn't match the
+   * first one under that key byte-for-byte.
+   */ isIdempotencyKeyConflict() {
+        return this.httpStatus === 422 && this.message.includes("idempotency_key_conflict");
+    }
+    /**
+   * `true` if the final error surfaced from a call was a `401 Unauthorized`
+   * after bounded refresh was attempted.
+   */ isUnauthorized() {
+        return this.httpStatus === 401;
+    }
+}
+
+//# sourceMappingURL=error.js.map

package/dist/error.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/error.ts"],"sourcesContent":["/**\n * The one error type this SDK throws or returns.\n * Wraps REST call errors, OAuth / token failures, and validation errors.\n */\n\nexport interface SdkErrorOptions {\n  httpStatus?: number | undefined;\n  gatewayCode?: string | undefined;\n  fieldErrors?: Record<string, string[]> | undefined;\n  cause?: unknown;\n}\n\nexport class SdkError extends Error {\n  readonly httpStatus: number | undefined;\n  readonly gatewayCode: string | undefined;\n  readonly fieldErrors: Record<string, string[]> | undefined;\n\n  constructor(message: string, options?: SdkErrorOptions) {\n    super(message, { cause: options?.cause });\n    this.name = \"SdkError\";\n    this.httpStatus = options?.httpStatus;\n    this.gatewayCode = options?.gatewayCode;\n    this.fieldErrors = options?.fieldErrors;\n  }\n\n  /**\n   * `true` for a `409 Conflict` (either a duplicate `clientRef` or an in-flight `Idempotency-Key`).\n   */\n  isConflict(): boolean {\n    return this.httpStatus === 409;\n  }\n\n  /**\n   * `true` for the specific `409` `IdempotencyLayer` returns while\n   * another request under the *same* `Idempotency-Key` is still being\n   * processed (not yet reserved-and-replayable).\n   */\n  isIdempotencyInFlight(): boolean {\n    return this.httpStatus === 409 && this.message.includes(\"Idempotency-Key\");\n  }\n\n  /**\n   * `true` for the `422` `IdempotencyLayer` returns when an\n   * `Idempotency-Key` is reused with a request that doesn't match the\n   * first one under that key byte-for-byte.\n   */\n  isIdempotencyKeyConflict(): boolean {\n    return this.httpStatus === 422 && this.message.includes(\"idempotency_key_conflict\");\n  }\n\n  /**\n   * `true` if the final error surfaced from a call was a `401 Unauthorized`\n   * after bounded refresh was attempted.\n   */\n  isUnauthorized(): boolean {\n    return this.httpStatus === 401;\n  }\n}\n"],"names":["SdkError","Error","httpStatus","gatewayCode","fieldErrors","message","options","cause","name","isConflict","isIdempotencyInFlight","includes","isIdempotencyKeyConflict","isUnauthorized"],"mappings":"AAAA;;;CAGC,GASD,OAAO,MAAMA,iBAAiBC;IACnBC,WAA+B;IAC/BC,YAAgC;IAChCC,YAAkD;IAE3D,YAAYC,OAAe,EAAEC,OAAyB,CAAE;QACtD,KAAK,CAACD,SAAS;YAAEE,OAAOD,SAASC;QAAM;QACvC,IAAI,CAACC,IAAI,GAAG;QACZ,IAAI,CAACN,UAAU,GAAGI,SAASJ;QAC3B,IAAI,CAACC,WAAW,GAAGG,SAASH;QAC5B,IAAI,CAACC,WAAW,GAAGE,SAASF;IAC9B;IAEA;;GAEC,GACDK,aAAsB;QACpB,OAAO,IAAI,CAACP,UAAU,KAAK;IAC7B;IAEA;;;;GAIC,GACDQ,wBAAiC;QAC/B,OAAO,IAAI,CAACR,UAAU,KAAK,OAAO,IAAI,CAACG,OAAO,CAACM,QAAQ,CAAC;IAC1D;IAEA;;;;GAIC,GACDC,2BAAoC;QAClC,OAAO,IAAI,CAACV,UAAU,KAAK,OAAO,IAAI,CAACG,OAAO,CAACM,QAAQ,CAAC;IAC1D;IAEA;;;GAGC,GACDE,iBAA0B;QACxB,OAAO,IAAI,CAACX,UAAU,KAAK;IAC7B;AACF"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { type PrivateKeyJwtClientOptions, type SendMessageOptions, type SendMessageOutcome, VsmsClient, type VsmsClientOptions, } from "./client.js";
+export { SdkError, type SdkErrorOptions } from "./error.js";
+export { type CachedToken, type PrivateKeyJwtConfigOptions, PrivateKeyJwtTokenStore, type TokenAudience, type TokenStore, } from "./token.js";
+export * from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,UAAU,EACV,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,0BAA0B,EAC/B,uBAAuB,EACvB,KAAK,aAAa,EAClB,KAAK,UAAU,GAChB,MAAM,YAAY,CAAC;AACpB,cAAc,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,6 @@
+export { VsmsClient } from "./client.js";
+export { SdkError } from "./error.js";
+export { PrivateKeyJwtTokenStore } from "./token.js";
+export * from "./types.js";
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export {\n  type PrivateKeyJwtClientOptions,\n  type SendMessageOptions,\n  type SendMessageOutcome,\n  VsmsClient,\n  type VsmsClientOptions,\n} from \"./client.js\";\nexport { SdkError, type SdkErrorOptions } from \"./error.js\";\nexport {\n  type CachedToken,\n  type PrivateKeyJwtConfigOptions,\n  PrivateKeyJwtTokenStore,\n  type TokenAudience,\n  type TokenStore,\n} from \"./token.js\";\nexport * from \"./types.js\";\n"],"names":["VsmsClient","SdkError","PrivateKeyJwtTokenStore"],"mappings":"AAAA,SAIEA,UAAU,QAEL,cAAc;AACrB,SAASC,QAAQ,QAA8B,aAAa;AAC5D,SAGEC,uBAAuB,QAGlB,aAAa;AACpB,cAAc,aAAa"}

package/dist/token.d.ts

@@ -0,0 +1,27 @@
+export type TokenAudience = "token_endpoint" | "issuer";
+export interface PrivateKeyJwtConfigOptions {
+    issuer: string;
+    clientId: string;
+    scope?: string | undefined;
+    audience?: TokenAudience | undefined;
+}
+export interface CachedToken {
+    accessToken: string;
+    expiresAtMs: number;
+}
+export interface TokenStore {
+    get(): Promise<string>;
+    invalidate(): Promise<void> | void;
+}
+export declare class PrivateKeyJwtTokenStore implements TokenStore {
+    #private;
+    constructor(options: PrivateKeyJwtConfigOptions, keyMaterial: {
+        pemString?: string | undefined;
+        keyPath?: string | undefined;
+    });
+    static fromKeyPath(issuer: string, clientId: string, keyPath: string, scope?: string | undefined, audience?: TokenAudience | undefined): PrivateKeyJwtTokenStore;
+    static fromKeyPem(issuer: string, clientId: string, pemString: string, scope?: string | undefined, audience?: TokenAudience | undefined): PrivateKeyJwtTokenStore;
+    get(): Promise<string>;
+    invalidate(): void;
+}
+//# sourceMappingURL=token.d.ts.map

package/dist/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,aAAa,GAAG,gBAAgB,GAAG,QAAQ,CAAC;AAExD,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,QAAQ,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;CACtC;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AASD,MAAM,WAAW,UAAU;IACzB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACvB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACpC;AAID,qBAAa,uBAAwB,YAAW,UAAU;;gBAWtD,OAAO,EAAE,0BAA0B,EACnC,WAAW,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE;IAqC/E,MAAM,CAAC,WAAW,CAChB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,CAAC,EAAE,aAAa,GAAG,SAAS,GACnC,uBAAuB;IAI1B,MAAM,CAAC,UAAU,CACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,CAAC,EAAE,aAAa,GAAG,SAAS,GACnC,uBAAuB;IA0EpB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;IAsB5B,UAAU,IAAI,IAAI;CAGnB"}

package/dist/token.js

@@ -0,0 +1,155 @@
+import { randomUUID } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { importPKCS8, SignJWT } from "jose";
+import { SdkError } from "./error.js";
+const ASSERTION_TTL_SECONDS = 60;
+const CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+const DEFAULT_TOKEN_TTL_SECONDS = 15 * 60;
+const EXPIRY_SAFETY_MARGIN_SECONDS = 60;
+export class PrivateKeyJwtTokenStore {
+    #issuer;
+    #tokenEndpoint;
+    #clientId;
+    #scope;
+    #audience;
+    #signingKeyPromise;
+    #cached = null;
+    #inFlight = null;
+    constructor(options, keyMaterial){
+        this.#issuer = options.issuer.replace(/\/+$/, "");
+        this.#tokenEndpoint = `${this.#issuer}/token`;
+        this.#clientId = options.clientId;
+        const rawScope = options.scope ?? "sms:send sms:read";
+        const trimmedScope = rawScope.trim();
+        if (trimmedScope.length === 0) {
+            throw new SdkError("scope cannot be empty (must request explicit permissions, e.g. 'sms:send sms:read')");
+        }
+        this.#scope = trimmedScope;
+        this.#audience = options.audience ?? "token_endpoint";
+        this.#signingKeyPromise = (async ()=>{
+            let pem = keyMaterial.pemString;
+            if (pem === undefined && keyMaterial.keyPath !== undefined) {
+                try {
+                    pem = readFileSync(keyMaterial.keyPath, "utf8");
+                } catch (err) {
+                    throw new SdkError(`failed to read private key at ${keyMaterial.keyPath}`, {
+                        cause: err
+                    });
+                }
+            }
+            if (!pem) {
+                throw new SdkError("no private key PEM or key path provided");
+            }
+            try {
+                return await importPKCS8(pem, "RS256");
+            } catch (err) {
+                throw new SdkError("invalid RSA private key PEM (PKCS#8 expected)", {
+                    cause: err
+                });
+            }
+        })();
+    }
+    static fromKeyPath(issuer, clientId, keyPath, scope, audience) {
+        return new PrivateKeyJwtTokenStore({
+            issuer,
+            clientId,
+            scope,
+            audience
+        }, {
+            keyPath
+        });
+    }
+    static fromKeyPem(issuer, clientId, pemString, scope, audience) {
+        return new PrivateKeyJwtTokenStore({
+            issuer,
+            clientId,
+            scope,
+            audience
+        }, {
+            pemString
+        });
+    }
+    async #mintAssertion() {
+        const key = await this.#signingKeyPromise;
+        const now = Math.floor(Date.now() / 1000);
+        const aud = this.#audience === "issuer" ? this.#issuer : this.#tokenEndpoint;
+        return await new SignJWT({}).setProtectedHeader({
+            alg: "RS256",
+            kid: this.#clientId
+        }).setIssuer(this.#clientId).setSubject(this.#clientId).setAudience(aud).setJti(randomUUID()).setIssuedAt(now).setExpirationTime(now + ASSERTION_TTL_SECONDS).sign(key);
+    }
+    async #requestToken() {
+        let assertion;
+        try {
+            assertion = await this.#mintAssertion();
+        } catch (err) {
+            if (err instanceof SdkError) throw err;
+            throw new SdkError("failed to sign client assertion", {
+                cause: err
+            });
+        }
+        const body = new URLSearchParams({
+            grant_type: "client_credentials",
+            client_id: this.#clientId,
+            client_assertion_type: CLIENT_ASSERTION_TYPE,
+            client_assertion: assertion,
+            scope: this.#scope
+        });
+        let response;
+        try {
+            response = await fetch(this.#tokenEndpoint, {
+                method: "POST",
+                headers: {
+                    "content-type": "application/x-www-form-urlencoded"
+                },
+                body: body.toString()
+            });
+        } catch (err) {
+            throw new SdkError(`token request to ${this.#tokenEndpoint} failed: network error`, {
+                cause: err
+            });
+        }
+        const text = await response.text();
+        if (!response.ok) {
+            throw new SdkError(`token request to ${this.#tokenEndpoint} failed (${response.status}): ${text}`, {
+                httpStatus: response.status
+            });
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        } catch (err) {
+            throw new SdkError(`token response from ${this.#tokenEndpoint} is not valid JSON: ${text}`, {
+                cause: err
+            });
+        }
+        const ttlSeconds = parsed.expires_in ?? DEFAULT_TOKEN_TTL_SECONDS;
+        return {
+            accessToken: parsed.access_token,
+            expiresAtMs: Date.now() + Math.max(ttlSeconds - EXPIRY_SAFETY_MARGIN_SECONDS, 0) * 1000
+        };
+    }
+    async get() {
+        if (this.#cached != null && this.#cached.expiresAtMs > Date.now()) {
+            return this.#cached.accessToken;
+        }
+        if (this.#inFlight) {
+            return await this.#inFlight;
+        }
+        this.#inFlight = (async ()=>{
+            try {
+                const token = await this.#requestToken();
+                this.#cached = token;
+                return token.accessToken;
+            } finally{
+                this.#inFlight = null;
+            }
+        })();
+        return await this.#inFlight;
+    }
+    invalidate() {
+        this.#cached = null;
+    }
+}
+
+//# sourceMappingURL=token.js.map

package/dist/token.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/token.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { readFileSync } from \"node:fs\";\nimport { importPKCS8, SignJWT } from \"jose\";\nimport { SdkError } from \"./error.js\";\n\nconst ASSERTION_TTL_SECONDS = 60;\nconst CLIENT_ASSERTION_TYPE = \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\";\nconst DEFAULT_TOKEN_TTL_SECONDS = 15 * 60;\nconst EXPIRY_SAFETY_MARGIN_SECONDS = 60;\n\nexport type TokenAudience = \"token_endpoint\" | \"issuer\";\n\nexport interface PrivateKeyJwtConfigOptions {\n  issuer: string;\n  clientId: string;\n  scope?: string | undefined;\n  audience?: TokenAudience | undefined;\n}\n\nexport interface CachedToken {\n  accessToken: string;\n  expiresAtMs: number;\n}\n\ninterface TokenResponse {\n  access_token: string;\n  token_type?: string;\n  expires_in?: number;\n  scope?: string;\n}\n\nexport interface TokenStore {\n  get(): Promise<string>;\n  invalidate(): Promise<void> | void;\n}\n\ntype KeyLike = Awaited<ReturnType<typeof importPKCS8>>;\n\nexport class PrivateKeyJwtTokenStore implements TokenStore {\n  readonly #issuer: string;\n  readonly #tokenEndpoint: string;\n  readonly #clientId: string;\n  readonly #scope: string;\n  readonly #audience: TokenAudience;\n  readonly #signingKeyPromise: Promise<KeyLike>;\n  #cached: CachedToken | null = null;\n  #inFlight: Promise<string> | null = null;\n\n  constructor(\n    options: PrivateKeyJwtConfigOptions,\n    keyMaterial: { pemString?: string | undefined; keyPath?: string | undefined },\n  ) {\n    this.#issuer = options.issuer.replace(/\\/+$/, \"\");\n    this.#tokenEndpoint = `${this.#issuer}/token`;\n    this.#clientId = options.clientId;\n    const rawScope = options.scope ?? \"sms:send sms:read\";\n    const trimmedScope = rawScope.trim();\n    if (trimmedScope.length === 0) {\n      throw new SdkError(\n        \"scope cannot be empty (must request explicit permissions, e.g. 'sms:send sms:read')\",\n      );\n    }\n    this.#scope = trimmedScope;\n    this.#audience = options.audience ?? \"token_endpoint\";\n\n    this.#signingKeyPromise = (async () => {\n      let pem = keyMaterial.pemString;\n      if (pem === undefined && keyMaterial.keyPath !== undefined) {\n        try {\n          pem = readFileSync(keyMaterial.keyPath, \"utf8\");\n        } catch (err) {\n          throw new SdkError(`failed to read private key at ${keyMaterial.keyPath}`, {\n            cause: err,\n          });\n        }\n      }\n      if (!pem) {\n        throw new SdkError(\"no private key PEM or key path provided\");\n      }\n      try {\n        return await importPKCS8(pem, \"RS256\");\n      } catch (err) {\n        throw new SdkError(\"invalid RSA private key PEM (PKCS#8 expected)\", { cause: err });\n      }\n    })();\n  }\n\n  static fromKeyPath(\n    issuer: string,\n    clientId: string,\n    keyPath: string,\n    scope?: string | undefined,\n    audience?: TokenAudience | undefined,\n  ): PrivateKeyJwtTokenStore {\n    return new PrivateKeyJwtTokenStore({ issuer, clientId, scope, audience }, { keyPath });\n  }\n\n  static fromKeyPem(\n    issuer: string,\n    clientId: string,\n    pemString: string,\n    scope?: string | undefined,\n    audience?: TokenAudience | undefined,\n  ): PrivateKeyJwtTokenStore {\n    return new PrivateKeyJwtTokenStore({ issuer, clientId, scope, audience }, { pemString });\n  }\n\n  async #mintAssertion(): Promise<string> {\n    const key = await this.#signingKeyPromise;\n    const now = Math.floor(Date.now() / 1000);\n    const aud = this.#audience === \"issuer\" ? this.#issuer : this.#tokenEndpoint;\n\n    return await new SignJWT({})\n      .setProtectedHeader({ alg: \"RS256\", kid: this.#clientId })\n      .setIssuer(this.#clientId)\n      .setSubject(this.#clientId)\n      .setAudience(aud)\n      .setJti(randomUUID())\n      .setIssuedAt(now)\n      .setExpirationTime(now + ASSERTION_TTL_SECONDS)\n      .sign(key);\n  }\n\n  async #requestToken(): Promise<CachedToken> {\n    let assertion: string;\n    try {\n      assertion = await this.#mintAssertion();\n    } catch (err) {\n      if (err instanceof SdkError) throw err;\n      throw new SdkError(\"failed to sign client assertion\", { cause: err });\n    }\n\n    const body = new URLSearchParams({\n      grant_type: \"client_credentials\",\n      client_id: this.#clientId,\n      client_assertion_type: CLIENT_ASSERTION_TYPE,\n      client_assertion: assertion,\n      scope: this.#scope,\n    });\n\n    let response: Response;\n    try {\n      response = await fetch(this.#tokenEndpoint, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n        body: body.toString(),\n      });\n    } catch (err) {\n      throw new SdkError(`token request to ${this.#tokenEndpoint} failed: network error`, {\n        cause: err,\n      });\n    }\n\n    const text = await response.text();\n    if (!response.ok) {\n      throw new SdkError(\n        `token request to ${this.#tokenEndpoint} failed (${response.status}): ${text}`,\n        { httpStatus: response.status },\n      );\n    }\n\n    let parsed: TokenResponse;\n    try {\n      parsed = JSON.parse(text) as TokenResponse;\n    } catch (err) {\n      throw new SdkError(`token response from ${this.#tokenEndpoint} is not valid JSON: ${text}`, {\n        cause: err,\n      });\n    }\n\n    const ttlSeconds = parsed.expires_in ?? DEFAULT_TOKEN_TTL_SECONDS;\n    return {\n      accessToken: parsed.access_token,\n      expiresAtMs: Date.now() + Math.max(ttlSeconds - EXPIRY_SAFETY_MARGIN_SECONDS, 0) * 1000,\n    };\n  }\n\n  async get(): Promise<string> {\n    if (this.#cached != null && this.#cached.expiresAtMs > Date.now()) {\n      return this.#cached.accessToken;\n    }\n\n    if (this.#inFlight) {\n      return await this.#inFlight;\n    }\n\n    this.#inFlight = (async () => {\n      try {\n        const token = await this.#requestToken();\n        this.#cached = token;\n        return token.accessToken;\n      } finally {\n        this.#inFlight = null;\n      }\n    })();\n\n    return await this.#inFlight;\n  }\n\n  invalidate(): void {\n    this.#cached = null;\n  }\n}\n"],"names":["randomUUID","readFileSync","importPKCS8","SignJWT","SdkError","ASSERTION_TTL_SECONDS","CLIENT_ASSERTION_TYPE","DEFAULT_TOKEN_TTL_SECONDS","EXPIRY_SAFETY_MARGIN_SECONDS","PrivateKeyJwtTokenStore","options","keyMaterial","issuer","replace","clientId","rawScope","scope","trimmedScope","trim","length","audience","pem","pemString","undefined","keyPath","err","cause","fromKeyPath","fromKeyPem","key","now","Math","floor","Date","aud","setProtectedHeader","alg","kid","setIssuer","setSubject","setAudience","setJti","setIssuedAt","setExpirationTime","sign","assertion","body","URLSearchParams","grant_type","client_id","client_assertion_type","client_assertion","response","fetch","method","headers","toString","text","ok","status","httpStatus","parsed","JSON","parse","ttlSeconds","expires_in","accessToken","access_token","expiresAtMs","max","get","token","invalidate"],"mappings":"AAAA,SAASA,UAAU,QAAQ,cAAc;AACzC,SAASC,YAAY,QAAQ,UAAU;AACvC,SAASC,WAAW,EAAEC,OAAO,QAAQ,OAAO;AAC5C,SAASC,QAAQ,QAAQ,aAAa;AAEtC,MAAMC,wBAAwB;AAC9B,MAAMC,wBAAwB;AAC9B,MAAMC,4BAA4B,KAAK;AACvC,MAAMC,+BAA+B;AA8BrC,OAAO,MAAMC;IACF,CAAA,MAAO,CAAS;IAChB,CAAA,aAAc,CAAS;IACvB,CAAA,QAAS,CAAS;IAClB,CAAA,KAAM,CAAS;IACf,CAAA,QAAS,CAAgB;IACzB,CAAA,iBAAkB,CAAmB;IAC9C,CAAA,MAAO,GAAuB,KAAK;IACnC,CAAA,QAAS,GAA2B,KAAK;IAEzC,YACEC,OAAmC,EACnCC,WAA6E,CAC7E;QACA,IAAI,CAAC,CAAA,MAAO,GAAGD,QAAQE,MAAM,CAACC,OAAO,CAAC,QAAQ;QAC9C,IAAI,CAAC,CAAA,aAAc,GAAG,GAAG,IAAI,CAAC,CAAA,MAAO,CAAC,MAAM,CAAC;QAC7C,IAAI,CAAC,CAAA,QAAS,GAAGH,QAAQI,QAAQ;QACjC,MAAMC,WAAWL,QAAQM,KAAK,IAAI;QAClC,MAAMC,eAAeF,SAASG,IAAI;QAClC,IAAID,aAAaE,MAAM,KAAK,GAAG;YAC7B,MAAM,IAAIf,SACR;QAEJ;QACA,IAAI,CAAC,CAAA,KAAM,GAAGa;QACd,IAAI,CAAC,CAAA,QAAS,GAAGP,QAAQU,QAAQ,IAAI;QAErC,IAAI,CAAC,CAAA,iBAAkB,GAAG,AAAC,CAAA;YACzB,IAAIC,MAAMV,YAAYW,SAAS;YAC/B,IAAID,QAAQE,aAAaZ,YAAYa,OAAO,KAAKD,WAAW;gBAC1D,IAAI;oBACFF,MAAMpB,aAAaU,YAAYa,OAAO,EAAE;gBAC1C,EAAE,OAAOC,KAAK;oBACZ,MAAM,IAAIrB,SAAS,CAAC,8BAA8B,EAAEO,YAAYa,OAAO,EAAE,EAAE;wBACzEE,OAAOD;oBACT;gBACF;YACF;YACA,IAAI,CAACJ,KAAK;gBACR,MAAM,IAAIjB,SAAS;YACrB;YACA,IAAI;gBACF,OAAO,MAAMF,YAAYmB,KAAK;YAChC,EAAE,OAAOI,KAAK;gBACZ,MAAM,IAAIrB,SAAS,iDAAiD;oBAAEsB,OAAOD;gBAAI;YACnF;QACF,CAAA;IACF;IAEA,OAAOE,YACLf,MAAc,EACdE,QAAgB,EAChBU,OAAe,EACfR,KAA0B,EAC1BI,QAAoC,EACX;QACzB,OAAO,IAAIX,wBAAwB;YAAEG;YAAQE;YAAUE;YAAOI;QAAS,GAAG;YAAEI;QAAQ;IACtF;IAEA,OAAOI,WACLhB,MAAc,EACdE,QAAgB,EAChBQ,SAAiB,EACjBN,KAA0B,EAC1BI,QAAoC,EACX;QACzB,OAAO,IAAIX,wBAAwB;YAAEG;YAAQE;YAAUE;YAAOI;QAAS,GAAG;YAAEE;QAAU;IACxF;IAEA,MAAM,CAAA,aAAc;QAClB,MAAMO,MAAM,MAAM,IAAI,CAAC,CAAA,iBAAkB;QACzC,MAAMC,MAAMC,KAAKC,KAAK,CAACC,KAAKH,GAAG,KAAK;QACpC,MAAMI,MAAM,IAAI,CAAC,CAAA,QAAS,KAAK,WAAW,IAAI,CAAC,CAAA,MAAO,GAAG,IAAI,CAAC,CAAA,aAAc;QAE5E,OAAO,MAAM,IAAI/B,QAAQ,CAAC,GACvBgC,kBAAkB,CAAC;YAAEC,KAAK;YAASC,KAAK,IAAI,CAAC,CAAA,QAAS;QAAC,GACvDC,SAAS,CAAC,IAAI,CAAC,CAAA,QAAS,EACxBC,UAAU,CAAC,IAAI,CAAC,CAAA,QAAS,EACzBC,WAAW,CAACN,KACZO,MAAM,CAACzC,cACP0C,WAAW,CAACZ,KACZa,iBAAiB,CAACb,MAAMzB,uBACxBuC,IAAI,CAACf;IACV;IAEA,MAAM,CAAA,YAAa;QACjB,IAAIgB;QACJ,IAAI;YACFA,YAAY,MAAM,IAAI,CAAC,CAAA,aAAc;QACvC,EAAE,OAAOpB,KAAK;YACZ,IAAIA,eAAerB,UAAU,MAAMqB;YACnC,MAAM,IAAIrB,SAAS,mCAAmC;gBAAEsB,OAAOD;YAAI;QACrE;QAEA,MAAMqB,OAAO,IAAIC,gBAAgB;YAC/BC,YAAY;YACZC,WAAW,IAAI,CAAC,CAAA,QAAS;YACzBC,uBAAuB5C;YACvB6C,kBAAkBN;YAClB7B,OAAO,IAAI,CAAC,CAAA,KAAM;QACpB;QAEA,IAAIoC;QACJ,IAAI;YACFA,WAAW,MAAMC,MAAM,IAAI,CAAC,CAAA,aAAc,EAAE;gBAC1CC,QAAQ;gBACRC,SAAS;oBAAE,gBAAgB;gBAAoC;gBAC/DT,MAAMA,KAAKU,QAAQ;YACrB;QACF,EAAE,OAAO/B,KAAK;YACZ,MAAM,IAAIrB,SAAS,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAA,aAAc,CAAC,sBAAsB,CAAC,EAAE;gBAClFsB,OAAOD;YACT;QACF;QAEA,MAAMgC,OAAO,MAAML,SAASK,IAAI;QAChC,IAAI,CAACL,SAASM,EAAE,EAAE;YAChB,MAAM,IAAItD,SACR,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAA,aAAc,CAAC,SAAS,EAAEgD,SAASO,MAAM,CAAC,GAAG,EAAEF,MAAM,EAC9E;gBAAEG,YAAYR,SAASO,MAAM;YAAC;QAElC;QAEA,IAAIE;QACJ,IAAI;YACFA,SAASC,KAAKC,KAAK,CAACN;QACtB,EAAE,OAAOhC,KAAK;YACZ,MAAM,IAAIrB,SAAS,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAA,aAAc,CAAC,oBAAoB,EAAEqD,MAAM,EAAE;gBAC1F/B,OAAOD;YACT;QACF;QAEA,MAAMuC,aAAaH,OAAOI,UAAU,IAAI1D;QACxC,OAAO;YACL2D,aAAaL,OAAOM,YAAY;YAChCC,aAAanC,KAAKH,GAAG,KAAKC,KAAKsC,GAAG,CAACL,aAAaxD,8BAA8B,KAAK;QACrF;IACF;IAEA,MAAM8D,MAAuB;QAC3B,IAAI,IAAI,CAAC,CAAA,MAAO,IAAI,QAAQ,IAAI,CAAC,CAAA,MAAO,CAACF,WAAW,GAAGnC,KAAKH,GAAG,IAAI;YACjE,OAAO,IAAI,CAAC,CAAA,MAAO,CAACoC,WAAW;QACjC;QAEA,IAAI,IAAI,CAAC,CAAA,QAAS,EAAE;YAClB,OAAO,MAAM,IAAI,CAAC,CAAA,QAAS;QAC7B;QAEA,IAAI,CAAC,CAAA,QAAS,GAAG,AAAC,CAAA;YAChB,IAAI;gBACF,MAAMK,QAAQ,MAAM,IAAI,CAAC,CAAA,YAAa;gBACtC,IAAI,CAAC,CAAA,MAAO,GAAGA;gBACf,OAAOA,MAAML,WAAW;YAC1B,SAAU;gBACR,IAAI,CAAC,CAAA,QAAS,GAAG;YACnB;QACF,CAAA;QAEA,OAAO,MAAM,IAAI,CAAC,CAAA,QAAS;IAC7B;IAEAM,aAAmB;QACjB,IAAI,CAAC,CAAA,MAAO,GAAG;IACjB;AACF"}

package/dist/types.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Types describing vsms domain models and procedures.
+ *
+ * DESIGN DECISION: These types are deliberately hand-written rather than
+ * generated via `cratestack generate-typescript`.
+ *
+ * The full schema is large (23 models, 18 enums, 18 procedures), mostly
+ * concerning admin console operations and internal routing state. This SDK
+ * is focused purely on the integrator experience: sending messages, checking
+ * delivery, and previewing routing. Exposing the full CrateStack-generated
+ * types would clutter the SDK with internal models that integrators cannot
+ * access anyway. By hand-writing these types, we curate the public API
+ * surface to exactly what the SDK exposes.
+ */
+export type Encoding = "gsm7" | "ucs2";
+export type OperatorCode = "mtn" | "orange" | "camtel" | "nexttel" | "unknown";
+export type MessageClass = "otp" | "transactional" | "notification" | "marketing";
+export type MessageState = "accepted" | "queued" | "routed" | "submitted" | "delivered" | "uncertain" | "undelivered" | "failed" | "expired" | "rejected" | "cancelled";
+export interface PreviewInput {
+    body: string;
+    to?: string;
+}
+export interface PreviewResult {
+    encoding: Encoding;
+    segments: number;
+    length: number;
+    perSegment: number;
+    offending: string[];
+    suggestion?: string;
+    operator: OperatorCode;
+    normalizedTo?: string;
+}
+export interface SendMessageInput {
+    to: string;
+    body: string;
+    senderId?: string;
+    class?: MessageClass;
+    clientRef?: string;
+    /** ISO-8601 string */
+    scheduledAt?: string;
+    validityMinutes?: number;
+}
+export interface SendMessageResult {
+    messageId: string;
+    state: MessageState;
+    encoding: Encoding;
+    segments: number;
+    operator: OperatorCode;
+    estimatedCostXaf: string;
+}
+export interface Message {
+    id: string;
+    state: MessageState;
+    to: string;
+    body: string;
+    senderId?: string;
+    class: MessageClass;
+    clientRef?: string;
+    encoding: Encoding;
+    segments: number;
+    operator: OperatorCode;
+    estimatedCostXaf: string;
+    providerMessageRef?: string;
+    createdAt: string;
+    updatedAt: string;
+    [key: string]: unknown;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;AACvC,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAC/E,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,eAAe,GAAG,cAAc,GAAG,WAAW,CAAC;AAElF,MAAM,MAAM,YAAY,GACpB,UAAU,GACV,QAAQ,GACR,QAAQ,GACR,WAAW,GACX,WAAW,GACX,WAAW,GACX,aAAa,GACb,QAAQ,GACR,SAAS,GACT,UAAU,GACV,WAAW,CAAC;AAEhB,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,YAAY,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sBAAsB;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,YAAY,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,YAAY,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,YAAY,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,YAAY,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,YAAY,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB"}

package/dist/types.js

@@ -0,0 +1,16 @@
+/**
+ * Types describing vsms domain models and procedures.
+ *
+ * DESIGN DECISION: These types are deliberately hand-written rather than
+ * generated via `cratestack generate-typescript`.
+ *
+ * The full schema is large (23 models, 18 enums, 18 procedures), mostly
+ * concerning admin console operations and internal routing state. This SDK
+ * is focused purely on the integrator experience: sending messages, checking
+ * delivery, and previewing routing. Exposing the full CrateStack-generated
+ * types would clutter the SDK with internal models that integrators cannot
+ * access anyway. By hand-writing these types, we curate the public API
+ * surface to exactly what the SDK exposes.
+ */ export { };
+
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types.ts"],"sourcesContent":["/**\n * Types describing vsms domain models and procedures.\n *\n * DESIGN DECISION: These types are deliberately hand-written rather than\n * generated via `cratestack generate-typescript`.\n *\n * The full schema is large (23 models, 18 enums, 18 procedures), mostly\n * concerning admin console operations and internal routing state. This SDK\n * is focused purely on the integrator experience: sending messages, checking\n * delivery, and previewing routing. Exposing the full CrateStack-generated\n * types would clutter the SDK with internal models that integrators cannot\n * access anyway. By hand-writing these types, we curate the public API\n * surface to exactly what the SDK exposes.\n */\nexport type Encoding = \"gsm7\" | \"ucs2\";\nexport type OperatorCode = \"mtn\" | \"orange\" | \"camtel\" | \"nexttel\" | \"unknown\";\nexport type MessageClass = \"otp\" | \"transactional\" | \"notification\" | \"marketing\";\n\nexport type MessageState =\n  | \"accepted\"\n  | \"queued\"\n  | \"routed\"\n  | \"submitted\"\n  | \"delivered\"\n  | \"uncertain\"\n  | \"undelivered\"\n  | \"failed\"\n  | \"expired\"\n  | \"rejected\"\n  | \"cancelled\";\n\nexport interface PreviewInput {\n  body: string;\n  to?: string;\n}\n\nexport interface PreviewResult {\n  encoding: Encoding;\n  segments: number;\n  length: number;\n  perSegment: number;\n  offending: string[];\n  suggestion?: string;\n  operator: OperatorCode;\n  normalizedTo?: string;\n}\n\nexport interface SendMessageInput {\n  to: string;\n  body: string;\n  senderId?: string;\n  class?: MessageClass;\n  clientRef?: string;\n  /** ISO-8601 string */\n  scheduledAt?: string;\n  validityMinutes?: number;\n}\n\nexport interface SendMessageResult {\n  messageId: string;\n  state: MessageState;\n  encoding: Encoding;\n  segments: number;\n  operator: OperatorCode;\n  estimatedCostXaf: string;\n}\n\nexport interface Message {\n  id: string;\n  state: MessageState;\n  to: string;\n  body: string;\n  senderId?: string;\n  class: MessageClass;\n  clientRef?: string;\n  encoding: Encoding;\n  segments: number;\n  operator: OperatorCode;\n  estimatedCostXaf: string;\n  providerMessageRef?: string;\n  createdAt: string;\n  updatedAt: string;\n  [key: string]: unknown;\n}\n"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;CAaC,GAsDD,WAgBC"}

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@vaam-apps/vsms-node",
+  "version": "0.3.3",
+  "description": "Official Node.js SDK for vsms: owns the private_key_jwt credential lifecycle so integrators stop hand-rolling token acquisition.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/vaam-apps/vsms.git",
+    "directory": "sdks/node/vsms-sdk-node"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "dependencies": {
+    "jose": "^6.2.12"
+  },
+  "devDependencies": {
+    "@swc/cli": "^0.8.1",
+    "@swc/core": "^1.16.2",
+    "@types/node": "^26",
+    "typescript": "5.9.3"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "swc src -d dist --strip-leading-paths && tsc -p tsconfig.json --emitDeclarationOnly",
+    "typecheck": "tsc --noEmit",
+    "test": "node --test"
+  }
+}