open-phiz-sdk 0.1.0

package/README.md

@@ -0,0 +1,77 @@
+# `open-phiz-sdk`
+
+Server-side TypeScript SDK for Open Phiz open login. Use this package in the mini-app business
+backend. Do not bundle it into a mini-app, browser application, Flutter package, or native host app.
+
+## Install
+
+```bash
+bun add open-phiz-sdk
+```
+
+Node.js 22.12 or newer is required.
+
+## Exchange a login code
+
+```ts
+import { OpenPlatformClient } from 'open-phiz-sdk';
+
+const openPlatform = new OpenPlatformClient({
+  baseUrl: process.env.OPEN_PHIZ_BASE_URL!,
+  appId: process.env.OPEN_PHIZ_APP_ID!,
+  appSecret: process.env.OPEN_PHIZ_APP_SECRET!,
+});
+
+const session = await openPlatform.code2Session(loginCode);
+// Persist your own business session. Do not return sessionKey to the mini-app.
+```
+
+## Session and phone APIs
+
+```ts
+const checked = await openPlatform.checkSession({
+  openId: session.openId,
+  sessionKey: session.sessionKey,
+});
+
+const reset = await openPlatform.resetSession({
+  openId: session.openId,
+  sessionKey: session.sessionKey,
+});
+
+const phoneInfo = await openPlatform.getPhoneNumber({ code: phoneAuthorizationCode });
+```
+
+The SDK obtains and caches the app `access_token` in memory for session and phone operations.
+Concurrent refreshes share one request. An invalid internally managed token is refreshed once; an
+explicitly supplied token is never retried automatically.
+
+## Error handling
+
+```ts
+import { OpenPlatformSdkError } from 'open-phiz-sdk';
+
+try {
+  await openPlatform.code2Session(loginCode);
+} catch (error) {
+  if (error instanceof OpenPlatformSdkError) {
+    console.error({
+      code: error.code,
+      status: error.status,
+      requestId: error.requestId,
+      retryable: error.retryable,
+    });
+  }
+}
+```
+
+Do not log the login code, AppSecret, access token, session key, or phone authorization code. Use the
+returned Request ID with the Open Platform diagnostics page.
+
+## Transport policy
+
+- HTTPS is mandatory outside localhost unless `allowInsecureHttp` is explicitly enabled for an
+  isolated development network.
+- AppSecret is sent only in JSON request bodies, never in query strings.
+- The SDK does not persist credentials or tokens to disk.
+- Requests time out after 10 seconds by default and accept an `AbortSignal`.

package/dist/index.d.ts

@@ -0,0 +1,98 @@
+interface OpenPlatformClientOptions {
+    /** Open Phiz origin or deployment prefix, for example https://open.example.com. */
+    baseUrl: string;
+    appId: string;
+    /** Store this value only in the business backend or its secret manager. */
+    appSecret: string;
+    /** Defaults to the runtime global fetch implementation. */
+    fetch?: typeof globalThis.fetch;
+    /** Per-request timeout. Defaults to 10 seconds. */
+    timeoutMs?: number;
+    /** Refresh cached app access tokens this long before expiry. Defaults to 60 seconds. */
+    tokenRefreshSkewMs?: number;
+    /** Intended for isolated development networks only. */
+    allowInsecureHttp?: boolean;
+}
+interface RequestOptions {
+    signal?: AbortSignal;
+}
+interface AccessTokenOptions extends RequestOptions {
+    forceRefresh?: boolean;
+}
+interface Code2SessionResult {
+    openId: string;
+    sessionKey: string;
+    expiresIn: number;
+    unionId?: string;
+}
+interface AppAccessTokenResult {
+    accessToken: string;
+    expiresIn: number;
+}
+interface SessionInput extends RequestOptions {
+    openId: string;
+    sessionKey: string;
+    accessToken?: string;
+}
+interface CheckSessionResult {
+    openId: string;
+    valid: true;
+}
+interface ResetSessionResult {
+    openId: string;
+    sessionKey: string;
+}
+interface PhoneNumberInput extends RequestOptions {
+    code: string;
+    accessToken?: string;
+}
+interface PhoneInfo {
+    phoneNumber: string;
+    purePhoneNumber: string;
+    countryCode: string;
+    watermark: {
+        timestamp: number;
+        appid: string;
+    };
+}
+
+declare class OpenPlatformClient {
+    private readonly baseUrl;
+    private readonly appId;
+    private readonly appSecret;
+    private readonly fetchImplementation;
+    private readonly timeoutMs;
+    private readonly tokenRefreshSkewMs;
+    private cachedAccessToken;
+    private pendingAccessToken;
+    constructor(options: OpenPlatformClientOptions);
+    code2Session(code: string, options?: RequestOptions): Promise<Code2SessionResult>;
+    getAccessToken(options?: AccessTokenOptions): Promise<AppAccessTokenResult>;
+    invalidateAccessToken(): void;
+    checkSession(input: SessionInput): Promise<CheckSessionResult>;
+    resetSession(input: SessionInput): Promise<ResetSessionResult>;
+    getPhoneNumber(input: PhoneNumberInput): Promise<PhoneInfo>;
+    private issueAccessToken;
+    private authorizedRequest;
+    private request;
+    private redactServerMessage;
+}
+
+type OpenPlatformErrorCode = number | 'ABORTED' | 'INVALID_RESPONSE' | 'NETWORK_ERROR' | 'TIMEOUT';
+interface OpenPlatformSdkErrorOptions {
+    code: OpenPlatformErrorCode;
+    status?: number;
+    requestId?: string;
+}
+declare class OpenPlatformSdkError extends Error {
+    readonly code: OpenPlatformErrorCode;
+    readonly status: number | undefined;
+    readonly requestId: string | undefined;
+    readonly retryable: boolean;
+    constructor(message: string, options: OpenPlatformSdkErrorOptions);
+}
+
+/** Create the signature required by check-session and reset-session. */
+declare function createSessionSignature(sessionKey: string): string;
+
+export { type AccessTokenOptions, type AppAccessTokenResult, type CheckSessionResult, type Code2SessionResult, OpenPlatformClient, type OpenPlatformClientOptions, type OpenPlatformErrorCode, OpenPlatformSdkError, type PhoneInfo, type PhoneNumberInput, type RequestOptions, type ResetSessionResult, type SessionInput, createSessionSignature };

package/dist/index.js

@@ -0,0 +1,311 @@
+import { createHmac } from 'crypto';
+
+// src/errors.ts
+var OpenPlatformSdkError = class extends Error {
+  code;
+  status;
+  requestId;
+  retryable;
+  constructor(message, options) {
+    super(message);
+    this.name = "OpenPlatformSdkError";
+    this.code = options.code;
+    this.status = options.status;
+    this.requestId = options.requestId;
+    this.retryable = options.code === "NETWORK_ERROR" || options.code === "TIMEOUT" || options.code === 42901 || options.status === 429 || options.status !== void 0 && options.status >= 500;
+  }
+};
+function createSessionSignature(sessionKey) {
+  if (!sessionKey.trim()) throw new TypeError("sessionKey must not be empty");
+  return createHmac("sha256", sessionKey).update("").digest("hex");
+}
+
+// src/client.ts
+var DEFAULT_TIMEOUT_MS = 1e4;
+var DEFAULT_TOKEN_REFRESH_SKEW_MS = 6e4;
+function requiredString(value, field) {
+  if (typeof value !== "string" || !value) {
+    throw new OpenPlatformSdkError(`Open Platform returned an invalid ${field}`, {
+      code: "INVALID_RESPONSE"
+    });
+  }
+  return value;
+}
+function requiredStringValue(value, field) {
+  if (typeof value !== "string") {
+    throw new OpenPlatformSdkError(`Open Platform returned an invalid ${field}`, {
+      code: "INVALID_RESPONSE"
+    });
+  }
+  return value;
+}
+function requiredNonNegativeInteger(value, field) {
+  if (typeof value !== "number" || !Number.isInteger(value) || value < 0) {
+    throw new OpenPlatformSdkError(`Open Platform returned an invalid ${field}`, {
+      code: "INVALID_RESPONSE"
+    });
+  }
+  return value;
+}
+function requiredRecord(value, field) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new OpenPlatformSdkError(`Open Platform returned an invalid ${field}`, {
+      code: "INVALID_RESPONSE"
+    });
+  }
+  return value;
+}
+function normalizeBaseUrl(value, allowInsecureHttp) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new TypeError("baseUrl must be a valid HTTP(S) URL");
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new TypeError("baseUrl must use HTTP or HTTPS");
+  }
+  if (url.username || url.password || url.search || url.hash) {
+    throw new TypeError("baseUrl must not contain credentials, query parameters, or a fragment");
+  }
+  const localHostnames = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+  if (url.protocol === "http:" && !allowInsecureHttp && !localHostnames.has(url.hostname)) {
+    throw new TypeError("baseUrl must use HTTPS outside localhost");
+  }
+  url.pathname = `${url.pathname.replace(/\/+$/, "")}/`;
+  return url;
+}
+function validateClientOptions(options) {
+  if (!options.appId.trim()) throw new TypeError("appId must not be empty");
+  if (!options.appSecret.trim()) throw new TypeError("appSecret must not be empty");
+  if (options.timeoutMs !== void 0 && (!Number.isInteger(options.timeoutMs) || options.timeoutMs <= 0)) {
+    throw new TypeError("timeoutMs must be a positive integer");
+  }
+  if (options.tokenRefreshSkewMs !== void 0 && (!Number.isInteger(options.tokenRefreshSkewMs) || options.tokenRefreshSkewMs < 0)) {
+    throw new TypeError("tokenRefreshSkewMs must be a non-negative integer");
+  }
+}
+var OpenPlatformClient = class {
+  baseUrl;
+  appId;
+  appSecret;
+  fetchImplementation;
+  timeoutMs;
+  tokenRefreshSkewMs;
+  cachedAccessToken;
+  pendingAccessToken;
+  constructor(options) {
+    validateClientOptions(options);
+    this.baseUrl = normalizeBaseUrl(options.baseUrl, options.allowInsecureHttp === true);
+    this.appId = options.appId.trim();
+    this.appSecret = options.appSecret.trim();
+    this.fetchImplementation = options.fetch ?? globalThis.fetch;
+    this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    this.tokenRefreshSkewMs = options.tokenRefreshSkewMs ?? DEFAULT_TOKEN_REFRESH_SKEW_MS;
+    if (typeof this.fetchImplementation !== "function") {
+      throw new TypeError("A fetch implementation is required");
+    }
+  }
+  async code2Session(code, options = {}) {
+    if (!code.trim()) throw new TypeError("code must not be empty");
+    const data = await this.request("/api/v1/open/sns/code2session", {
+      body: { appId: this.appId, appSecret: this.appSecret, code: code.trim() },
+      ...options
+    });
+    const result = requiredRecord(data, "code2session response");
+    const unionId = result.unionId;
+    if (unionId !== void 0 && typeof unionId !== "string") {
+      throw new OpenPlatformSdkError("Open Platform returned an invalid unionId", {
+        code: "INVALID_RESPONSE"
+      });
+    }
+    return {
+      openId: requiredString(result.openId, "openId"),
+      sessionKey: requiredString(result.sessionKey, "sessionKey"),
+      expiresIn: requiredNonNegativeInteger(result.expiresIn, "expiresIn"),
+      ...unionId ? { unionId } : {}
+    };
+  }
+  async getAccessToken(options = {}) {
+    const now = Date.now();
+    if (options.forceRefresh !== true && this.cachedAccessToken && now < this.cachedAccessToken.expiresAtMs - this.cachedAccessToken.refreshSkewMs) {
+      return {
+        accessToken: this.cachedAccessToken.value,
+        expiresIn: Math.max(0, Math.floor((this.cachedAccessToken.expiresAtMs - now) / 1e3))
+      };
+    }
+    if (this.pendingAccessToken) return this.pendingAccessToken;
+    this.pendingAccessToken = this.issueAccessToken(options).finally(() => {
+      this.pendingAccessToken = void 0;
+    });
+    return this.pendingAccessToken;
+  }
+  invalidateAccessToken() {
+    this.cachedAccessToken = void 0;
+  }
+  async checkSession(input) {
+    if (!input.openId.trim()) throw new TypeError("openId must not be empty");
+    const data = await this.authorizedRequest(
+      "/api/v1/open/sns/check-session",
+      {
+        openId: input.openId.trim(),
+        signature: createSessionSignature(input.sessionKey),
+        sigMethod: "hmac_sha256"
+      },
+      input
+    );
+    const result = requiredRecord(data, "check-session response");
+    if (result.valid !== true) {
+      throw new OpenPlatformSdkError("Open Platform returned an invalid session status", {
+        code: "INVALID_RESPONSE"
+      });
+    }
+    return { openId: requiredString(result.openId, "openId"), valid: true };
+  }
+  async resetSession(input) {
+    if (!input.openId.trim()) throw new TypeError("openId must not be empty");
+    const data = await this.authorizedRequest(
+      "/api/v1/open/sns/reset-session",
+      {
+        openId: input.openId.trim(),
+        signature: createSessionSignature(input.sessionKey),
+        sigMethod: "hmac_sha256"
+      },
+      input
+    );
+    const result = requiredRecord(data, "reset-session response");
+    return {
+      openId: requiredString(result.openId, "openId"),
+      sessionKey: requiredString(result.sessionKey, "sessionKey")
+    };
+  }
+  async getPhoneNumber(input) {
+    if (!input.code.trim()) throw new TypeError("code must not be empty");
+    const data = await this.authorizedRequest(
+      "/api/v1/open/sns/phone-number",
+      { code: input.code.trim() },
+      input
+    );
+    const result = requiredRecord(data, "phone-number response");
+    const phoneInfo = requiredRecord(result.phoneInfo, "phoneInfo");
+    const watermark = requiredRecord(phoneInfo.watermark, "phoneInfo.watermark");
+    return {
+      phoneNumber: requiredString(phoneInfo.phoneNumber, "phoneInfo.phoneNumber"),
+      purePhoneNumber: requiredString(phoneInfo.purePhoneNumber, "phoneInfo.purePhoneNumber"),
+      countryCode: requiredStringValue(phoneInfo.countryCode, "phoneInfo.countryCode"),
+      watermark: {
+        timestamp: requiredNonNegativeInteger(watermark.timestamp, "phoneInfo.watermark.timestamp"),
+        appid: requiredString(watermark.appid, "phoneInfo.watermark.appid")
+      }
+    };
+  }
+  async issueAccessToken(options) {
+    const data = await this.request("/api/v1/open/sns/access-token", {
+      body: { appId: this.appId, appSecret: this.appSecret },
+      ...options
+    });
+    const result = requiredRecord(data, "access-token response");
+    const accessToken = requiredString(result.accessToken, "accessToken");
+    const expiresIn = requiredNonNegativeInteger(result.expiresIn, "expiresIn");
+    const ttlMs = expiresIn * 1e3;
+    this.cachedAccessToken = {
+      value: accessToken,
+      expiresAtMs: Date.now() + ttlMs,
+      refreshSkewMs: Math.min(this.tokenRefreshSkewMs, Math.floor(ttlMs / 2))
+    };
+    return { accessToken, expiresIn };
+  }
+  async authorizedRequest(path, body, options) {
+    const trimmedAccessToken = options.accessToken?.trim();
+    const explicitAccessToken = trimmedAccessToken === "" ? void 0 : trimmedAccessToken;
+    const accessToken = explicitAccessToken ?? (await this.getAccessToken(options)).accessToken;
+    try {
+      return await this.request(path, {
+        body,
+        accessToken,
+        ...options.signal ? { signal: options.signal } : {}
+      });
+    } catch (error) {
+      if (explicitAccessToken || !(error instanceof OpenPlatformSdkError) || error.code !== 40016) {
+        throw error;
+      }
+      this.invalidateAccessToken();
+      const refreshed = await this.getAccessToken({ ...options, forceRefresh: true });
+      return this.request(path, {
+        body,
+        accessToken: refreshed.accessToken,
+        ...options.signal ? { signal: options.signal } : {}
+      });
+    }
+  }
+  async request(path, options) {
+    const url = new URL(path.replace(/^\/+/, ""), this.baseUrl);
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
+    const onAbort = () => controller.abort();
+    options.signal?.addEventListener("abort", onAbort, { once: true });
+    if (options.signal?.aborted) controller.abort();
+    let response;
+    try {
+      response = await this.fetchImplementation(url, {
+        method: "POST",
+        headers: {
+          Accept: "application/json",
+          "Content-Type": "application/json",
+          ...options.accessToken ? { Authorization: `Bearer ${options.accessToken}` } : {}
+        },
+        body: JSON.stringify(options.body),
+        signal: controller.signal
+      });
+    } catch {
+      const callerAborted = options.signal?.aborted === true;
+      const timedOut = controller.signal.aborted && !callerAborted;
+      throw new OpenPlatformSdkError(
+        callerAborted ? "Open Platform request was aborted" : timedOut ? "Open Platform request timed out" : "Open Platform request failed",
+        { code: callerAborted ? "ABORTED" : timedOut ? "TIMEOUT" : "NETWORK_ERROR" }
+      );
+    } finally {
+      clearTimeout(timeout);
+      options.signal?.removeEventListener("abort", onAbort);
+    }
+    const requestId = response.headers.get("x-request-id") ?? void 0;
+    let payload;
+    try {
+      payload = await response.json();
+    } catch {
+      throw new OpenPlatformSdkError("Open Platform returned non-JSON data", {
+        code: "INVALID_RESPONSE",
+        status: response.status,
+        ...requestId ? { requestId } : {}
+      });
+    }
+    if (!response.ok || payload.code !== 0) {
+      const code = typeof payload.code === "number" ? payload.code : "INVALID_RESPONSE";
+      const serverMessage = typeof payload.error === "string" ? this.redactServerMessage(payload.error, options) : "Request failed";
+      throw new OpenPlatformSdkError(`Open Platform request failed: ${serverMessage}`, {
+        code,
+        status: response.status,
+        ...requestId ? { requestId } : {}
+      });
+    }
+    return payload.data;
+  }
+  redactServerMessage(message, options) {
+    const values = /* @__PURE__ */ new Set([this.appSecret]);
+    if (options.accessToken) values.add(options.accessToken);
+    for (const [key, value] of Object.entries(options.body)) {
+      if (typeof value === "string" && /(code|secret|signature|token)/i.test(key)) {
+        values.add(value);
+      }
+    }
+    let redacted = message;
+    for (const value of values) {
+      if (value) redacted = redacted.replaceAll(value, "[REDACTED]");
+    }
+    return redacted;
+  }
+};
+
+export { OpenPlatformClient, OpenPlatformSdkError, createSessionSignature };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts","../src/signature.ts","../src/client.ts"],"names":[],"mappings":";;;AAaO,IAAM,oBAAA,GAAN,cAAmC,KAAA,CAAM;AAAA,EACrC,IAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EAET,WAAA,CAAY,SAAiB,OAAA,EAAsC;AACjE,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,sBAAA;AACZ,IAAA,IAAA,CAAK,OAAO,OAAA,CAAQ,IAAA;AACpB,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACtB,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,SAAA;AACzB,IAAA,IAAA,CAAK,YACH,OAAA,CAAQ,IAAA,KAAS,eAAA,IACjB,OAAA,CAAQ,SAAS,SAAA,IACjB,OAAA,CAAQ,IAAA,KAAS,KAAA,IACjB,QAAQ,MAAA,KAAW,GAAA,IAClB,QAAQ,MAAA,KAAW,MAAA,IAAa,QAAQ,MAAA,IAAU,GAAA;AAAA,EACvD;AACF;AC7BO,SAAS,uBAAuB,UAAA,EAA4B;AACjE,EAAA,IAAI,CAAC,UAAA,CAAW,IAAA,IAAQ,MAAM,IAAI,UAAU,8BAA8B,CAAA;AAC1E,EAAA,OAAO,UAAA,CAAW,UAAU,UAAU,CAAA,CAAE,OAAO,EAAE,CAAA,CAAE,OAAO,KAAK,CAAA;AACjE;;;ACSA,IAAM,kBAAA,GAAqB,GAAA;AAC3B,IAAM,6BAAA,GAAgC,GAAA;AAmBtC,SAAS,cAAA,CAAe,OAAgB,KAAA,EAAuB;AAC7D,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,EAAO;AACvC,IAAA,MAAM,IAAI,oBAAA,CAAqB,CAAA,kCAAA,EAAqC,KAAK,CAAA,CAAA,EAAI;AAAA,MAC3E,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,mBAAA,CAAoB,OAAgB,KAAA,EAAuB;AAClE,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,MAAM,IAAI,oBAAA,CAAqB,CAAA,kCAAA,EAAqC,KAAK,CAAA,CAAA,EAAI;AAAA,MAC3E,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,0BAAA,CAA2B,OAAgB,KAAA,EAAuB;AACzE,EAAA,IAAI,OAAO,UAAU,QAAA,IAAY,CAAC,OAAO,SAAA,CAAU,KAAK,CAAA,IAAK,KAAA,GAAQ,CAAA,EAAG;AACtE,IAAA,MAAM,IAAI,oBAAA,CAAqB,CAAA,kCAAA,EAAqC,KAAK,CAAA,CAAA,EAAI;AAAA,MAC3E,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,cAAA,CAAe,OAAgB,KAAA,EAAwC;AAC9E,EAAA,IAAI,CAAC,SAAS,OAAO,KAAA,KAAU,YAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC/D,IAAA,MAAM,IAAI,oBAAA,CAAqB,CAAA,kCAAA,EAAqC,KAAK,CAAA,CAAA,EAAI;AAAA,MAC3E,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,gBAAA,CAAiB,OAAe,iBAAA,EAAiC;AACxE,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,KAAK,CAAA;AAAA,EACrB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,UAAU,qCAAqC,CAAA;AAAA,EAC3D;AAEA,EAAA,IAAI,GAAA,CAAI,QAAA,KAAa,QAAA,IAAY,GAAA,CAAI,aAAa,OAAA,EAAS;AACzD,IAAA,MAAM,IAAI,UAAU,gCAAgC,CAAA;AAAA,EACtD;AACA,EAAA,IAAI,IAAI,QAAA,IAAY,GAAA,CAAI,YAAY,GAAA,CAAI,MAAA,IAAU,IAAI,IAAA,EAAM;AAC1D,IAAA,MAAM,IAAI,UAAU,uEAAuE,CAAA;AAAA,EAC7F;AAEA,EAAA,MAAM,cAAA,uBAAqB,GAAA,CAAI,CAAC,aAAa,WAAA,EAAa,KAAA,EAAO,OAAO,CAAC,CAAA;AACzE,EAAA,IAAI,GAAA,CAAI,QAAA,KAAa,OAAA,IAAW,CAAC,iBAAA,IAAqB,CAAC,cAAA,CAAe,GAAA,CAAI,GAAA,CAAI,QAAQ,CAAA,EAAG;AACvF,IAAA,MAAM,IAAI,UAAU,0CAA0C,CAAA;AAAA,EAChE;AAEA,EAAA,GAAA,CAAI,WAAW,CAAA,EAAG,GAAA,CAAI,SAAS,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAC,CAAA,CAAA,CAAA;AAClD,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,sBAAsB,OAAA,EAA0C;AACvE,EAAA,IAAI,CAAC,QAAQ,KAAA,CAAM,IAAA,IAAQ,MAAM,IAAI,UAAU,yBAAyB,CAAA;AACxE,EAAA,IAAI,CAAC,QAAQ,SAAA,CAAU,IAAA,IAAQ,MAAM,IAAI,UAAU,6BAA6B,CAAA;AAChF,EAAA,IACE,OAAA,CAAQ,SAAA,KAAc,MAAA,KACrB,CAAC,MAAA,CAAO,SAAA,CAAU,OAAA,CAAQ,SAAS,CAAA,IAAK,OAAA,CAAQ,SAAA,IAAa,CAAA,CAAA,EAC9D;AACA,IAAA,MAAM,IAAI,UAAU,sCAAsC,CAAA;AAAA,EAC5D;AACA,EAAA,IACE,OAAA,CAAQ,kBAAA,KAAuB,MAAA,KAC9B,CAAC,MAAA,CAAO,SAAA,CAAU,OAAA,CAAQ,kBAAkB,CAAA,IAAK,OAAA,CAAQ,kBAAA,GAAqB,CAAA,CAAA,EAC/E;AACA,IAAA,MAAM,IAAI,UAAU,mDAAmD,CAAA;AAAA,EACzE;AACF;AAEO,IAAM,qBAAN,MAAyB;AAAA,EACb,OAAA;AAAA,EACA,KAAA;AAAA,EACA,SAAA;AAAA,EACA,mBAAA;AAAA,EACA,SAAA;AAAA,EACA,kBAAA;AAAA,EACT,iBAAA;AAAA,EACA,kBAAA;AAAA,EAER,YAAY,OAAA,EAAoC;AAC9C,IAAA,qBAAA,CAAsB,OAAO,CAAA;AAC7B,IAAA,IAAA,CAAK,UAAU,gBAAA,CAAiB,OAAA,CAAQ,OAAA,EAAS,OAAA,CAAQ,sBAAsB,IAAI,CAAA;AACnF,IAAA,IAAA,CAAK,KAAA,GAAQ,OAAA,CAAQ,KAAA,CAAM,IAAA,EAAK;AAChC,IAAA,IAAA,CAAK,SAAA,GAAY,OAAA,CAAQ,SAAA,CAAU,IAAA,EAAK;AACxC,IAAA,IAAA,CAAK,mBAAA,GAAsB,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AACvD,IAAA,IAAA,CAAK,SAAA,GAAY,QAAQ,SAAA,IAAa,kBAAA;AACtC,IAAA,IAAA,CAAK,kBAAA,GAAqB,QAAQ,kBAAA,IAAsB,6BAAA;AAExD,IAAA,IAAI,OAAO,IAAA,CAAK,mBAAA,KAAwB,UAAA,EAAY;AAClD,MAAA,MAAM,IAAI,UAAU,oCAAoC,CAAA;AAAA,IAC1D;AAAA,EACF;AAAA,EAEA,MAAM,YAAA,CAAa,IAAA,EAAc,OAAA,GAA0B,EAAC,EAAgC;AAC1F,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,IAAQ,MAAM,IAAI,UAAU,wBAAwB,CAAA;AAC9D,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,+BAAA,EAAiC;AAAA,MAC/D,IAAA,EAAM,EAAE,KAAA,EAAO,IAAA,CAAK,KAAA,EAAO,SAAA,EAAW,IAAA,CAAK,SAAA,EAAW,IAAA,EAAM,IAAA,CAAK,IAAA,EAAK,EAAE;AAAA,MACxE,GAAG;AAAA,KACJ,CAAA;AAED,IAAA,MAAM,MAAA,GAAS,cAAA,CAAe,IAAA,EAAM,uBAAuB,CAAA;AAC3D,IAAA,MAAM,UAAU,MAAA,CAAO,OAAA;AACvB,IAAA,IAAI,OAAA,KAAY,MAAA,IAAa,OAAO,OAAA,KAAY,QAAA,EAAU;AACxD,MAAA,MAAM,IAAI,qBAAqB,2CAAA,EAA6C;AAAA,QAC1E,IAAA,EAAM;AAAA,OACP,CAAA;AAAA,IACH;AACA,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,cAAA,CAAe,MAAA,CAAO,MAAA,EAAQ,QAAQ,CAAA;AAAA,MAC9C,UAAA,EAAY,cAAA,CAAe,MAAA,CAAO,UAAA,EAAY,YAAY,CAAA;AAAA,MAC1D,SAAA,EAAW,0BAAA,CAA2B,MAAA,CAAO,SAAA,EAAW,WAAW,CAAA;AAAA,MACnE,GAAI,OAAA,GAAU,EAAE,OAAA,KAAY;AAAC,KAC/B;AAAA,EACF;AAAA,EAEA,MAAM,cAAA,CAAe,OAAA,GAA8B,EAAC,EAAkC;AACpF,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IACE,OAAA,CAAQ,YAAA,KAAiB,IAAA,IACzB,IAAA,CAAK,iBAAA,IACL,GAAA,GAAM,IAAA,CAAK,iBAAA,CAAkB,WAAA,GAAc,IAAA,CAAK,iBAAA,CAAkB,aAAA,EAClE;AACA,MAAA,OAAO;AAAA,QACL,WAAA,EAAa,KAAK,iBAAA,CAAkB,KAAA;AAAA,QACpC,SAAA,EAAW,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,KAAA,CAAA,CAAO,IAAA,CAAK,iBAAA,CAAkB,WAAA,GAAc,GAAA,IAAO,GAAI,CAAC;AAAA,OACtF;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,kBAAA,EAAoB,OAAO,IAAA,CAAK,kBAAA;AACzC,IAAA,IAAA,CAAK,qBAAqB,IAAA,CAAK,gBAAA,CAAiB,OAAO,CAAA,CAAE,QAAQ,MAAM;AACrE,MAAA,IAAA,CAAK,kBAAA,GAAqB,MAAA;AAAA,IAC5B,CAAC,CAAA;AACD,IAAA,OAAO,IAAA,CAAK,kBAAA;AAAA,EACd;AAAA,EAEA,qBAAA,GAA8B;AAC5B,IAAA,IAAA,CAAK,iBAAA,GAAoB,MAAA;AAAA,EAC3B;AAAA,EAEA,MAAM,aAAa,KAAA,EAAkD;AACnE,IAAA,IAAI,CAAC,MAAM,MAAA,CAAO,IAAA,IAAQ,MAAM,IAAI,UAAU,0BAA0B,CAAA;AACxE,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,iBAAA;AAAA,MACtB,gCAAA;AAAA,MACA;AAAA,QACE,MAAA,EAAQ,KAAA,CAAM,MAAA,CAAO,IAAA,EAAK;AAAA,QAC1B,SAAA,EAAW,sBAAA,CAAuB,KAAA,CAAM,UAAU,CAAA;AAAA,QAClD,SAAA,EAAW;AAAA,OACb;AAAA,MACA;AAAA,KACF;AACA,IAAA,MAAM,MAAA,GAAS,cAAA,CAAe,IAAA,EAAM,wBAAwB,CAAA;AAC5D,IAAA,IAAI,MAAA,CAAO,UAAU,IAAA,EAAM;AACzB,MAAA,MAAM,IAAI,qBAAqB,kDAAA,EAAoD;AAAA,QACjF,IAAA,EAAM;AAAA,OACP,CAAA;AAAA,IACH;AACA,IAAA,OAAO,EAAE,QAAQ,cAAA,CAAe,MAAA,CAAO,QAAQ,QAAQ,CAAA,EAAG,OAAO,IAAA,EAAK;AAAA,EACxE;AAAA,EAEA,MAAM,aAAa,KAAA,EAAkD;AACnE,IAAA,IAAI,CAAC,MAAM,MAAA,CAAO,IAAA,IAAQ,MAAM,IAAI,UAAU,0BAA0B,CAAA;AACxE,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,iBAAA;AAAA,MACtB,gCAAA;AAAA,MACA;AAAA,QACE,MAAA,EAAQ,KAAA,CAAM,MAAA,CAAO,IAAA,EAAK;AAAA,QAC1B,SAAA,EAAW,sBAAA,CAAuB,KAAA,CAAM,UAAU,CAAA;AAAA,QAClD,SAAA,EAAW;AAAA,OACb;AAAA,MACA;AAAA,KACF;AACA,IAAA,MAAM,MAAA,GAAS,cAAA,CAAe,IAAA,EAAM,wBAAwB,CAAA;AAC5D,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,cAAA,CAAe,MAAA,CAAO,MAAA,EAAQ,QAAQ,CAAA;AAAA,MAC9C,UAAA,EAAY,cAAA,CAAe,MAAA,CAAO,UAAA,EAAY,YAAY;AAAA,KAC5D;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,KAAA,EAA6C;AAChE,IAAA,IAAI,CAAC,MAAM,IAAA,CAAK,IAAA,IAAQ,MAAM,IAAI,UAAU,wBAAwB,CAAA;AACpE,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,iBAAA;AAAA,MACtB,+BAAA;AAAA,MACA,EAAE,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,MAAK,EAAE;AAAA,MAC1B;AAAA,KACF;AACA,IAAA,MAAM,MAAA,GAAS,cAAA,CAAe,IAAA,EAAM,uBAAuB,CAAA;AAC3D,IAAA,MAAM,SAAA,GAAY,cAAA,CAAe,MAAA,CAAO,SAAA,EAAW,WAAW,CAAA;AAC9D,IAAA,MAAM,SAAA,GAAY,cAAA,CAAe,SAAA,CAAU,SAAA,EAAW,qBAAqB,CAAA;AAC3E,IAAA,OAAO;AAAA,MACL,WAAA,EAAa,cAAA,CAAe,SAAA,CAAU,WAAA,EAAa,uBAAuB,CAAA;AAAA,MAC1E,eAAA,EAAiB,cAAA,CAAe,SAAA,CAAU,eAAA,EAAiB,2BAA2B,CAAA;AAAA,MACtF,WAAA,EAAa,mBAAA,CAAoB,SAAA,CAAU,WAAA,EAAa,uBAAuB,CAAA;AAAA,MAC/E,SAAA,EAAW;AAAA,QACT,SAAA,EAAW,0BAAA,CAA2B,SAAA,CAAU,SAAA,EAAW,+BAA+B,CAAA;AAAA,QAC1F,KAAA,EAAO,cAAA,CAAe,SAAA,CAAU,KAAA,EAAO,2BAA2B;AAAA;AACpE,KACF;AAAA,EACF;AAAA,EAEA,MAAc,iBAAiB,OAAA,EAAwD;AACrF,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,+BAAA,EAAiC;AAAA,MAC/D,MAAM,EAAE,KAAA,EAAO,KAAK,KAAA,EAAO,SAAA,EAAW,KAAK,SAAA,EAAU;AAAA,MACrD,GAAG;AAAA,KACJ,CAAA;AACD,IAAA,MAAM,MAAA,GAAS,cAAA,CAAe,IAAA,EAAM,uBAAuB,CAAA;AAC3D,IAAA,MAAM,WAAA,GAAc,cAAA,CAAe,MAAA,CAAO,WAAA,EAAa,aAAa,CAAA;AACpE,IAAA,MAAM,SAAA,GAAY,0BAAA,CAA2B,MAAA,CAAO,SAAA,EAAW,WAAW,CAAA;AAC1E,IAAA,MAAM,QAAQ,SAAA,GAAY,GAAA;AAC1B,IAAA,IAAA,CAAK,iBAAA,GAAoB;AAAA,MACvB,KAAA,EAAO,WAAA;AAAA,MACP,WAAA,EAAa,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA;AAAA,MAC1B,aAAA,EAAe,KAAK,GAAA,CAAI,IAAA,CAAK,oBAAoB,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAC;AAAA,KACxE;AACA,IAAA,OAAO,EAAE,aAAa,SAAA,EAAU;AAAA,EAClC;AAAA,EAEA,MAAc,iBAAA,CACZ,IAAA,EACA,IAAA,EACA,OAAA,EACkB;AAClB,IAAA,MAAM,kBAAA,GAAqB,OAAA,CAAQ,WAAA,EAAa,IAAA,EAAK;AACrD,IAAA,MAAM,mBAAA,GAAsB,kBAAA,KAAuB,EAAA,GAAK,MAAA,GAAY,kBAAA;AACpE,IAAA,MAAM,cAAc,mBAAA,IAAA,CAAwB,MAAM,IAAA,CAAK,cAAA,CAAe,OAAO,CAAA,EAAG,WAAA;AAEhF,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM;AAAA,QAC9B,IAAA;AAAA,QACA,WAAA;AAAA,QACA,GAAI,QAAQ,MAAA,GAAS,EAAE,QAAQ,OAAA,CAAQ,MAAA,KAAW;AAAC,OACpD,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,uBAAuB,EAAE,KAAA,YAAiB,oBAAA,CAAA,IAAyB,KAAA,CAAM,SAAS,KAAA,EAAO;AAC3F,QAAA,MAAM,KAAA;AAAA,MACR;AACA,MAAA,IAAA,CAAK,qBAAA,EAAsB;AAC3B,MAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,cAAA,CAAe,EAAE,GAAG,OAAA,EAAS,YAAA,EAAc,IAAA,EAAM,CAAA;AAC9E,MAAA,OAAO,IAAA,CAAK,QAAQ,IAAA,EAAM;AAAA,QACxB,IAAA;AAAA,QACA,aAAa,SAAA,CAAU,WAAA;AAAA,QACvB,GAAI,QAAQ,MAAA,GAAS,EAAE,QAAQ,OAAA,CAAQ,MAAA,KAAW;AAAC,OACpD,CAAA;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAc,OAAA,CAAQ,IAAA,EAAc,OAAA,EAAmD;AACrF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,IAAA,CAAK,QAAQ,MAAA,EAAQ,EAAE,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA;AAC1D,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,UAAU,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AACnE,IAAA,MAAM,OAAA,GAAU,MAAM,UAAA,CAAW,KAAA,EAAM;AACvC,IAAA,OAAA,CAAQ,QAAQ,gBAAA,CAAiB,OAAA,EAAS,SAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AACjE,IAAA,IAAI,OAAA,CAAQ,MAAA,EAAQ,OAAA,EAAS,UAAA,CAAW,KAAA,EAAM;AAE9C,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,mBAAA,CAAoB,GAAA,EAAK;AAAA,QAC7C,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,MAAA,EAAQ,kBAAA;AAAA,UACR,cAAA,EAAgB,kBAAA;AAAA,UAChB,GAAI,OAAA,CAAQ,WAAA,GAAc,EAAE,aAAA,EAAe,UAAU,OAAA,CAAQ,WAAW,CAAA,CAAA,EAAG,GAAI;AAAC,SAClF;AAAA,QACA,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,IAAI,CAAA;AAAA,QACjC,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAAA,IACH,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,MAAA,EAAQ,OAAA,KAAY,IAAA;AAClD,MAAA,MAAM,QAAA,GAAW,UAAA,CAAW,MAAA,CAAO,OAAA,IAAW,CAAC,aAAA;AAC/C,MAAA,MAAM,IAAI,oBAAA;AAAA,QACR,aAAA,GACI,mCAAA,GACA,QAAA,GACE,iCAAA,GACA,8BAAA;AAAA,QACN,EAAE,IAAA,EAAM,aAAA,GAAgB,SAAA,GAAY,QAAA,GAAW,YAAY,eAAA;AAAgB,OAC7E;AAAA,IACF,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,OAAO,CAAA;AACpB,MAAA,OAAA,CAAQ,MAAA,EAAQ,mBAAA,CAAoB,OAAA,EAAS,OAAO,CAAA;AAAA,IACtD;AAEA,IAAA,MAAM,SAAA,GAAY,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,MAAA;AAC1D,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAW,MAAM,SAAS,IAAA,EAAK;AAAA,IACjC,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,qBAAqB,sCAAA,EAAwC;AAAA,QACrE,IAAA,EAAM,kBAAA;AAAA,QACN,QAAQ,QAAA,CAAS,MAAA;AAAA,QACjB,GAAI,SAAA,GAAY,EAAE,SAAA,KAAc;AAAC,OAClC,CAAA;AAAA,IACH;AAEA,IAAA,IAAI,CAAC,QAAA,CAAS,EAAA,IAAM,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtC,MAAA,MAAM,OAAO,OAAO,OAAA,CAAQ,IAAA,KAAS,QAAA,GAAW,QAAQ,IAAA,GAAO,kBAAA;AAC/D,MAAA,MAAM,aAAA,GACJ,OAAO,OAAA,CAAQ,KAAA,KAAU,QAAA,GACrB,KAAK,mBAAA,CAAoB,OAAA,CAAQ,KAAA,EAAO,OAAO,CAAA,GAC/C,gBAAA;AACN,MAAA,MAAM,IAAI,oBAAA,CAAqB,CAAA,8BAAA,EAAiC,aAAa,CAAA,CAAA,EAAI;AAAA,QAC/E,IAAA;AAAA,QACA,QAAQ,QAAA,CAAS,MAAA;AAAA,QACjB,GAAI,SAAA,GAAY,EAAE,SAAA,KAAc;AAAC,OAClC,CAAA;AAAA,IACH;AAEA,IAAA,OAAO,OAAA,CAAQ,IAAA;AAAA,EACjB;AAAA,EAEQ,mBAAA,CAAoB,SAAiB,OAAA,EAAyC;AACpF,IAAA,MAAM,yBAAS,IAAI,GAAA,CAAY,CAAC,IAAA,CAAK,SAAS,CAAC,CAAA;AAC/C,IAAA,IAAI,OAAA,CAAQ,WAAA,EAAa,MAAA,CAAO,GAAA,CAAI,QAAQ,WAAW,CAAA;AACvD,IAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,CAAA,EAAG;AACvD,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,gCAAA,CAAiC,IAAA,CAAK,GAAG,CAAA,EAAG;AAC3E,QAAA,MAAA,CAAO,IAAI,KAAK,CAAA;AAAA,MAClB;AAAA,IACF;AAEA,IAAA,IAAI,QAAA,GAAW,OAAA;AACf,IAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,MAAA,IAAI,KAAA,EAAO,QAAA,GAAW,QAAA,CAAS,UAAA,CAAW,OAAO,YAAY,CAAA;AAAA,IAC/D;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AACF","file":"index.js","sourcesContent":["export type OpenPlatformErrorCode =\n  | number\n  | 'ABORTED'\n  | 'INVALID_RESPONSE'\n  | 'NETWORK_ERROR'\n  | 'TIMEOUT';\n\ninterface OpenPlatformSdkErrorOptions {\n  code: OpenPlatformErrorCode;\n  status?: number;\n  requestId?: string;\n}\n\nexport class OpenPlatformSdkError extends Error {\n  readonly code: OpenPlatformErrorCode;\n  readonly status: number | undefined;\n  readonly requestId: string | undefined;\n  readonly retryable: boolean;\n\n  constructor(message: string, options: OpenPlatformSdkErrorOptions) {\n    super(message);\n    this.name = 'OpenPlatformSdkError';\n    this.code = options.code;\n    this.status = options.status;\n    this.requestId = options.requestId;\n    this.retryable =\n      options.code === 'NETWORK_ERROR' ||\n      options.code === 'TIMEOUT' ||\n      options.code === 42901 ||\n      options.status === 429 ||\n      (options.status !== undefined && options.status >= 500);\n  }\n}\n","import { createHmac } from 'node:crypto';\n\n/** Create the signature required by check-session and reset-session. */\nexport function createSessionSignature(sessionKey: string): string {\n  if (!sessionKey.trim()) throw new TypeError('sessionKey must not be empty');\n  return createHmac('sha256', sessionKey).update('').digest('hex');\n}\n","import { OpenPlatformSdkError } from './errors';\nimport { createSessionSignature } from './signature';\nimport type {\n  AccessTokenOptions,\n  AppAccessTokenResult,\n  CheckSessionResult,\n  Code2SessionResult,\n  OpenPlatformClientOptions,\n  PhoneInfo,\n  PhoneNumberInput,\n  RequestOptions,\n  ResetSessionResult,\n  SessionInput,\n} from './types';\n\nconst DEFAULT_TIMEOUT_MS = 10_000;\nconst DEFAULT_TOKEN_REFRESH_SKEW_MS = 60_000;\n\ninterface ApiEnvelope {\n  code?: unknown;\n  error?: unknown;\n  data?: unknown;\n}\n\ninterface CachedAccessToken {\n  value: string;\n  expiresAtMs: number;\n  refreshSkewMs: number;\n}\n\ninterface InternalRequestOptions extends RequestOptions {\n  body: Record<string, unknown>;\n  accessToken?: string;\n}\n\nfunction requiredString(value: unknown, field: string): string {\n  if (typeof value !== 'string' || !value) {\n    throw new OpenPlatformSdkError(`Open Platform returned an invalid ${field}`, {\n      code: 'INVALID_RESPONSE',\n    });\n  }\n  return value;\n}\n\nfunction requiredStringValue(value: unknown, field: string): string {\n  if (typeof value !== 'string') {\n    throw new OpenPlatformSdkError(`Open Platform returned an invalid ${field}`, {\n      code: 'INVALID_RESPONSE',\n    });\n  }\n  return value;\n}\n\nfunction requiredNonNegativeInteger(value: unknown, field: string): number {\n  if (typeof value !== 'number' || !Number.isInteger(value) || value < 0) {\n    throw new OpenPlatformSdkError(`Open Platform returned an invalid ${field}`, {\n      code: 'INVALID_RESPONSE',\n    });\n  }\n  return value;\n}\n\nfunction requiredRecord(value: unknown, field: string): Record<string, unknown> {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    throw new OpenPlatformSdkError(`Open Platform returned an invalid ${field}`, {\n      code: 'INVALID_RESPONSE',\n    });\n  }\n  return value as Record<string, unknown>;\n}\n\nfunction normalizeBaseUrl(value: string, allowInsecureHttp: boolean): URL {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new TypeError('baseUrl must be a valid HTTP(S) URL');\n  }\n\n  if (url.protocol !== 'https:' && url.protocol !== 'http:') {\n    throw new TypeError('baseUrl must use HTTP or HTTPS');\n  }\n  if (url.username || url.password || url.search || url.hash) {\n    throw new TypeError('baseUrl must not contain credentials, query parameters, or a fragment');\n  }\n\n  const localHostnames = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);\n  if (url.protocol === 'http:' && !allowInsecureHttp && !localHostnames.has(url.hostname)) {\n    throw new TypeError('baseUrl must use HTTPS outside localhost');\n  }\n\n  url.pathname = `${url.pathname.replace(/\\/+$/, '')}/`;\n  return url;\n}\n\nfunction validateClientOptions(options: OpenPlatformClientOptions): void {\n  if (!options.appId.trim()) throw new TypeError('appId must not be empty');\n  if (!options.appSecret.trim()) throw new TypeError('appSecret must not be empty');\n  if (\n    options.timeoutMs !== undefined &&\n    (!Number.isInteger(options.timeoutMs) || options.timeoutMs <= 0)\n  ) {\n    throw new TypeError('timeoutMs must be a positive integer');\n  }\n  if (\n    options.tokenRefreshSkewMs !== undefined &&\n    (!Number.isInteger(options.tokenRefreshSkewMs) || options.tokenRefreshSkewMs < 0)\n  ) {\n    throw new TypeError('tokenRefreshSkewMs must be a non-negative integer');\n  }\n}\n\nexport class OpenPlatformClient {\n  private readonly baseUrl: URL;\n  private readonly appId: string;\n  private readonly appSecret: string;\n  private readonly fetchImplementation: typeof globalThis.fetch;\n  private readonly timeoutMs: number;\n  private readonly tokenRefreshSkewMs: number;\n  private cachedAccessToken: CachedAccessToken | undefined;\n  private pendingAccessToken: Promise<AppAccessTokenResult> | undefined;\n\n  constructor(options: OpenPlatformClientOptions) {\n    validateClientOptions(options);\n    this.baseUrl = normalizeBaseUrl(options.baseUrl, options.allowInsecureHttp === true);\n    this.appId = options.appId.trim();\n    this.appSecret = options.appSecret.trim();\n    this.fetchImplementation = options.fetch ?? globalThis.fetch;\n    this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    this.tokenRefreshSkewMs = options.tokenRefreshSkewMs ?? DEFAULT_TOKEN_REFRESH_SKEW_MS;\n\n    if (typeof this.fetchImplementation !== 'function') {\n      throw new TypeError('A fetch implementation is required');\n    }\n  }\n\n  async code2Session(code: string, options: RequestOptions = {}): Promise<Code2SessionResult> {\n    if (!code.trim()) throw new TypeError('code must not be empty');\n    const data = await this.request('/api/v1/open/sns/code2session', {\n      body: { appId: this.appId, appSecret: this.appSecret, code: code.trim() },\n      ...options,\n    });\n\n    const result = requiredRecord(data, 'code2session response');\n    const unionId = result.unionId;\n    if (unionId !== undefined && typeof unionId !== 'string') {\n      throw new OpenPlatformSdkError('Open Platform returned an invalid unionId', {\n        code: 'INVALID_RESPONSE',\n      });\n    }\n    return {\n      openId: requiredString(result.openId, 'openId'),\n      sessionKey: requiredString(result.sessionKey, 'sessionKey'),\n      expiresIn: requiredNonNegativeInteger(result.expiresIn, 'expiresIn'),\n      ...(unionId ? { unionId } : {}),\n    };\n  }\n\n  async getAccessToken(options: AccessTokenOptions = {}): Promise<AppAccessTokenResult> {\n    const now = Date.now();\n    if (\n      options.forceRefresh !== true &&\n      this.cachedAccessToken &&\n      now < this.cachedAccessToken.expiresAtMs - this.cachedAccessToken.refreshSkewMs\n    ) {\n      return {\n        accessToken: this.cachedAccessToken.value,\n        expiresIn: Math.max(0, Math.floor((this.cachedAccessToken.expiresAtMs - now) / 1000)),\n      };\n    }\n\n    if (this.pendingAccessToken) return this.pendingAccessToken;\n    this.pendingAccessToken = this.issueAccessToken(options).finally(() => {\n      this.pendingAccessToken = undefined;\n    });\n    return this.pendingAccessToken;\n  }\n\n  invalidateAccessToken(): void {\n    this.cachedAccessToken = undefined;\n  }\n\n  async checkSession(input: SessionInput): Promise<CheckSessionResult> {\n    if (!input.openId.trim()) throw new TypeError('openId must not be empty');\n    const data = await this.authorizedRequest(\n      '/api/v1/open/sns/check-session',\n      {\n        openId: input.openId.trim(),\n        signature: createSessionSignature(input.sessionKey),\n        sigMethod: 'hmac_sha256',\n      },\n      input\n    );\n    const result = requiredRecord(data, 'check-session response');\n    if (result.valid !== true) {\n      throw new OpenPlatformSdkError('Open Platform returned an invalid session status', {\n        code: 'INVALID_RESPONSE',\n      });\n    }\n    return { openId: requiredString(result.openId, 'openId'), valid: true };\n  }\n\n  async resetSession(input: SessionInput): Promise<ResetSessionResult> {\n    if (!input.openId.trim()) throw new TypeError('openId must not be empty');\n    const data = await this.authorizedRequest(\n      '/api/v1/open/sns/reset-session',\n      {\n        openId: input.openId.trim(),\n        signature: createSessionSignature(input.sessionKey),\n        sigMethod: 'hmac_sha256',\n      },\n      input\n    );\n    const result = requiredRecord(data, 'reset-session response');\n    return {\n      openId: requiredString(result.openId, 'openId'),\n      sessionKey: requiredString(result.sessionKey, 'sessionKey'),\n    };\n  }\n\n  async getPhoneNumber(input: PhoneNumberInput): Promise<PhoneInfo> {\n    if (!input.code.trim()) throw new TypeError('code must not be empty');\n    const data = await this.authorizedRequest(\n      '/api/v1/open/sns/phone-number',\n      { code: input.code.trim() },\n      input\n    );\n    const result = requiredRecord(data, 'phone-number response');\n    const phoneInfo = requiredRecord(result.phoneInfo, 'phoneInfo');\n    const watermark = requiredRecord(phoneInfo.watermark, 'phoneInfo.watermark');\n    return {\n      phoneNumber: requiredString(phoneInfo.phoneNumber, 'phoneInfo.phoneNumber'),\n      purePhoneNumber: requiredString(phoneInfo.purePhoneNumber, 'phoneInfo.purePhoneNumber'),\n      countryCode: requiredStringValue(phoneInfo.countryCode, 'phoneInfo.countryCode'),\n      watermark: {\n        timestamp: requiredNonNegativeInteger(watermark.timestamp, 'phoneInfo.watermark.timestamp'),\n        appid: requiredString(watermark.appid, 'phoneInfo.watermark.appid'),\n      },\n    };\n  }\n\n  private async issueAccessToken(options: RequestOptions): Promise<AppAccessTokenResult> {\n    const data = await this.request('/api/v1/open/sns/access-token', {\n      body: { appId: this.appId, appSecret: this.appSecret },\n      ...options,\n    });\n    const result = requiredRecord(data, 'access-token response');\n    const accessToken = requiredString(result.accessToken, 'accessToken');\n    const expiresIn = requiredNonNegativeInteger(result.expiresIn, 'expiresIn');\n    const ttlMs = expiresIn * 1000;\n    this.cachedAccessToken = {\n      value: accessToken,\n      expiresAtMs: Date.now() + ttlMs,\n      refreshSkewMs: Math.min(this.tokenRefreshSkewMs, Math.floor(ttlMs / 2)),\n    };\n    return { accessToken, expiresIn };\n  }\n\n  private async authorizedRequest(\n    path: string,\n    body: Record<string, unknown>,\n    options: RequestOptions & { accessToken?: string }\n  ): Promise<unknown> {\n    const trimmedAccessToken = options.accessToken?.trim();\n    const explicitAccessToken = trimmedAccessToken === '' ? undefined : trimmedAccessToken;\n    const accessToken = explicitAccessToken ?? (await this.getAccessToken(options)).accessToken;\n\n    try {\n      return await this.request(path, {\n        body,\n        accessToken,\n        ...(options.signal ? { signal: options.signal } : {}),\n      });\n    } catch (error) {\n      if (explicitAccessToken || !(error instanceof OpenPlatformSdkError) || error.code !== 40016) {\n        throw error;\n      }\n      this.invalidateAccessToken();\n      const refreshed = await this.getAccessToken({ ...options, forceRefresh: true });\n      return this.request(path, {\n        body,\n        accessToken: refreshed.accessToken,\n        ...(options.signal ? { signal: options.signal } : {}),\n      });\n    }\n  }\n\n  private async request(path: string, options: InternalRequestOptions): Promise<unknown> {\n    const url = new URL(path.replace(/^\\/+/, ''), this.baseUrl);\n    const controller = new AbortController();\n    const timeout = setTimeout(() => controller.abort(), this.timeoutMs);\n    const onAbort = () => controller.abort();\n    options.signal?.addEventListener('abort', onAbort, { once: true });\n    if (options.signal?.aborted) controller.abort();\n\n    let response: Response;\n    try {\n      response = await this.fetchImplementation(url, {\n        method: 'POST',\n        headers: {\n          Accept: 'application/json',\n          'Content-Type': 'application/json',\n          ...(options.accessToken ? { Authorization: `Bearer ${options.accessToken}` } : {}),\n        },\n        body: JSON.stringify(options.body),\n        signal: controller.signal,\n      });\n    } catch {\n      const callerAborted = options.signal?.aborted === true;\n      const timedOut = controller.signal.aborted && !callerAborted;\n      throw new OpenPlatformSdkError(\n        callerAborted\n          ? 'Open Platform request was aborted'\n          : timedOut\n            ? 'Open Platform request timed out'\n            : 'Open Platform request failed',\n        { code: callerAborted ? 'ABORTED' : timedOut ? 'TIMEOUT' : 'NETWORK_ERROR' }\n      );\n    } finally {\n      clearTimeout(timeout);\n      options.signal?.removeEventListener('abort', onAbort);\n    }\n\n    const requestId = response.headers.get('x-request-id') ?? undefined;\n    let payload: ApiEnvelope;\n    try {\n      payload = (await response.json()) as ApiEnvelope;\n    } catch {\n      throw new OpenPlatformSdkError('Open Platform returned non-JSON data', {\n        code: 'INVALID_RESPONSE',\n        status: response.status,\n        ...(requestId ? { requestId } : {}),\n      });\n    }\n\n    if (!response.ok || payload.code !== 0) {\n      const code = typeof payload.code === 'number' ? payload.code : 'INVALID_RESPONSE';\n      const serverMessage =\n        typeof payload.error === 'string'\n          ? this.redactServerMessage(payload.error, options)\n          : 'Request failed';\n      throw new OpenPlatformSdkError(`Open Platform request failed: ${serverMessage}`, {\n        code,\n        status: response.status,\n        ...(requestId ? { requestId } : {}),\n      });\n    }\n\n    return payload.data;\n  }\n\n  private redactServerMessage(message: string, options: InternalRequestOptions): string {\n    const values = new Set<string>([this.appSecret]);\n    if (options.accessToken) values.add(options.accessToken);\n    for (const [key, value] of Object.entries(options.body)) {\n      if (typeof value === 'string' && /(code|secret|signature|token)/i.test(key)) {\n        values.add(value);\n      }\n    }\n\n    let redacted = message;\n    for (const value of values) {\n      if (value) redacted = redacted.replaceAll(value, '[REDACTED]');\n    }\n    return redacted;\n  }\n}\n"]}

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "open-phiz-sdk",
+  "version": "0.1.0",
+  "description": "Server-side SDK for Open Phiz open login APIs",
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/phiz-clip/open-phiz.git",
+    "directory": "packages/open-platform-sdk"
+  },
+  "homepage": "https://github.com/phiz-clip/open-phiz#readme",
+  "bugs": "https://github.com/phiz-clip/open-phiz/issues",
+  "keywords": [
+    "open-phiz",
+    "mini-app",
+    "open-login",
+    "server-sdk"
+  ],
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "bun test src",
+    "test:coverage": "bun test --coverage --coverage-reporter=lcov --coverage-dir=coverage src",
+    "type-check": "tsc --noEmit",
+    "lint": "eslint src",
+    "lint:fix": "eslint src --fix",
+    "pack:check": "npm pack --dry-run --json",
+    "clean": "rm -rf dist"
+  },
+  "engines": {
+    "node": ">=22.12.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": false
+  },
+  "devDependencies": {
+    "@phiz/eslint-config": "workspace:*",
+    "@phiz/tsconfig": "workspace:*",
+    "@types/node": "^22.20.0",
+    "tsup": "^8.5.1",
+    "typescript": "^6.0.3"
+  }
+}