vesant-sdk 1.7.0-dev.117915b → 1.7.0-dev.13bd228

package/dist/index.js

@@ -1,5 +1,61 @@
 'use strict';
 
+// src/core/auth.ts
+var StaticApiKeyProvider = class {
+  constructor(apiKey) {
+    this.apiKey = apiKey;
+  }
+  async getCredential() {
+    return this.apiKey ? { scheme: "Bearer", token: this.apiKey } : null;
+  }
+  canRefresh() {
+    return false;
+  }
+};
+var RefreshingTokenProvider = class {
+  constructor(opts) {
+    this.opts = opts;
+    this.cached = null;
+    this.inFlight = null;
+    this.skewMs = opts.skewMs ?? 3e4;
+    this.scheme = opts.scheme ?? "Bearer";
+    this.now = opts.now ?? (() => Date.now());
+  }
+  canRefresh() {
+    return true;
+  }
+  async getCredential(ctx) {
+    const forceRefresh = ctx?.forceRefresh ?? false;
+    if (!forceRefresh && this.cached && !this.isExpiring(this.cached)) {
+      return { scheme: this.scheme, token: this.cached.token };
+    }
+    const fresh = await this.refresh();
+    return { scheme: this.scheme, token: fresh.token };
+  }
+  isExpiring(token) {
+    if (token.expiresAt === void 0) {
+      return false;
+    }
+    return this.now() >= token.expiresAt - this.skewMs;
+  }
+  refresh() {
+    if (this.inFlight) {
+      return this.inFlight;
+    }
+    this.inFlight = (async () => {
+      try {
+        const fresh = await this.opts.fetchToken();
+        this.cached = fresh;
+        this.opts.onRotate?.({ expiresAt: fresh.expiresAt });
+        return fresh;
+      } finally {
+        this.inFlight = null;
+      }
+    })();
+    return this.inFlight;
+  }
+};
+
 // src/core/errors.ts
 var VesantError = class _VesantError extends Error {
   constructor(message, code, statusCode, details) {
@@ -347,6 +403,7 @@ var BaseClient = class {
       interceptors: this.interceptors,
       logger: this.logger
     };
+    this.authProvider = config.authProvider ?? (apiKey ? new StaticApiKeyProvider(apiKey) : void 0);
     if (config.circuitBreaker) {
       this.circuitBreaker = new CircuitBreaker(config.circuitBreaker);
     }
@@ -354,6 +411,19 @@ var BaseClient = class {
       this.rateLimitTracker = new RateLimitTracker();
     }
   }
+  /**
+   * Resolve the Idempotency-Key for a request. Mutating methods (POST/PUT/PATCH)
+   * get the caller-supplied key or a freshly minted UUID; non-mutating methods get
+   * none. requestWithRetry resolves this once and injects it so every retry reuses
+   * one key (letting the server dedup replays); a direct request() resolves per call.
+   */
+  resolveIdempotencyKey(method, requestOptions) {
+    const isMutating = ["POST", "PUT", "PATCH"].includes((method || "GET").toUpperCase());
+    if (!isMutating) {
+      return void 0;
+    }
+    return requestOptions?.idempotencyKey ?? generateUUID();
+  }
   /**
    * Make an HTTP request with timeout and error handling
    */
@@ -379,15 +449,20 @@ var BaseClient = class {
       ...this.config.headers,
       ...options.headers || {}
     };
-    if (this.config.apiKey) {
-      headers["Authorization"] = `Bearer ${this.config.apiKey}`;
+    const credential = await this.authProvider?.getCredential({
+      tenantId: this.config.tenantId,
+      requestId
+    });
+    if (credential) {
+      headers["Authorization"] = `${credential.scheme ?? "Bearer"} ${credential.token}`;
     }
     if (this.config.environment === "sandbox") {
       headers["X-Sandbox"] = "true";
     }
     const method = (options.method || "GET").toUpperCase();
-    if (["POST", "PUT", "PATCH"].includes(method)) {
-      headers["Idempotency-Key"] = requestOptions?.idempotencyKey || generateUUID();
+    const idempotencyKey = this.resolveIdempotencyKey(method, requestOptions);
+    if (idempotencyKey) {
+      headers["Idempotency-Key"] = idempotencyKey;
     }
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), this.config.timeout);
@@ -408,10 +483,28 @@ var BaseClient = class {
       if (this.config.debug) {
         this.logger.debug(`${finalOptions.method || "GET"} ${endpoint}`);
       }
-      const response = await fetch(url, {
+      let response = await fetch(url, {
         ...finalOptions,
         signal: controller.signal
       });
+      if (response.status === 401 && this.authProvider?.canRefresh?.()) {
+        const refreshed = await this.authProvider.getCredential({
+          tenantId: this.config.tenantId,
+          requestId,
+          forceRefresh: true
+        });
+        if (refreshed) {
+          this.config.onCredentialRotated?.({ reason: "unauthorized" });
+          finalOptions = {
+            ...finalOptions,
+            headers: {
+              ...finalOptions.headers,
+              Authorization: `${refreshed.scheme ?? "Bearer"} ${refreshed.token}`
+            }
+          };
+          response = await fetch(url, { ...finalOptions, signal: controller.signal });
+        }
+      }
       clearTimeout(timeoutId);
       if (this.rateLimitTracker) {
         this.rateLimitTracker.updateFromHeaders(response.headers);
@@ -500,9 +593,11 @@ var BaseClient = class {
    */
   async requestWithRetry(endpoint, options = {}, serviceURL, retries = this.config.retries, requestOptions) {
     let lastError;
+    const idempotencyKey = this.resolveIdempotencyKey(options.method || "GET", requestOptions);
+    const attemptOptions = idempotencyKey ? { ...requestOptions, idempotencyKey } : requestOptions;
     for (let attempt = 0; attempt <= retries; attempt++) {
       try {
-        return await this.request(endpoint, options, serviceURL, requestOptions);
+        return await this.request(endpoint, options, serviceURL, attemptOptions);
       } catch (error) {
         lastError = error instanceof Error ? error : new Error("Unknown error");
         if (requestOptions?.signal?.aborted) {
@@ -599,6 +694,9 @@ var BaseClient = class {
     if (config.interceptors) {
       this.interceptors = config.interceptors;
     }
+    if (config.authProvider !== void 0 || config.apiKey !== void 0) {
+      this.authProvider = this.config.authProvider ?? (this.config.apiKey ? new StaticApiKeyProvider(this.config.apiKey) : void 0);
+    }
   }
   /**
    * Get current configuration (readonly)
@@ -2709,7 +2807,13 @@ var KycClient = class extends BaseClient {
    *
    * Generates a link that the user can visit to submit their KYC documents.
    *
-   * @param request - Request containing the user ID, optional redirect URL, and optional callback URL (receives POST requests)
+   * Optionally pass the customer's registered identity data as
+   * `customer_data` (same shape as the geolocation `customer_data` block).
+   * It seeds the customer's risk profile so document verification can
+   * cross-check the submitted document against trusted reference data;
+   * fields never overwrite data already on the profile.
+   *
+   * @param request - Request containing the user ID, optional redirect URL, optional callback URL (receives POST requests), and optional customer identity data
    * @returns Response containing the redirect link and KYC ID
    *
    * @example
@@ -2717,19 +2821,27 @@ var KycClient = class extends BaseClient {
    * const result = await client.requestKycSubmitLink({
    *   user_id: "user_123",
    *   redirect_url: "https://merchant.com/kyc-complete", // optional
-   *   callback_url: "https://merchant.com/api/kyc-webhook" // optional - receives POST requests on status change
+   *   callback_url: "https://merchant.com/api/kyc-webhook", // optional - receives POST requests on status change
+   *   customer_data: { // optional - seeds the risk profile for document cross-checks
+   *     full_name: "John Doe",
+   *     date_of_birth: "1999-06-02", // ISO 8601
+   *     email: "john@example.com",
+   *     phone: "+94771234567",
+   *     address: "12 Main St, Colombo", // used for address verification
+   *     country: "LK"
+   *   }
    * });
    *
    * console.log(`Redirect user to: ${result.link}`);
    * console.log(`KYC ID: ${result.kyc_id}`);
    * ```
    */
-  async requestKycSubmitLink(request) {
+  async requestKycSubmitLink(request, requestOptions) {
     return this.requestWithRetry("/api/v1/kyc/request", {
       method: "POST",
       body: JSON.stringify(request),
       headers: this.getUserHeaders()
-    });
+    }, void 0, void 0, requestOptions);
   }
   /**
    * Create a Event-Based Face Verification session.
@@ -2762,12 +2874,12 @@ var KycClient = class extends BaseClient {
    *
    * @param request - Token from `createEventBasedFaceVerificationSession`, plus the base64 selfie.
    */
-  async submitEventBasedFaceVerificationSession(request) {
+  async submitEventBasedFaceVerificationSession(request, requestOptions) {
     return this.request("/api/v1/kyc/face/submit", {
       method: "POST",
       body: JSON.stringify(request),
       headers: this.getUserHeaders()
-    });
+    }, void 0, requestOptions);
   }
   /**
    * Look up the current state of a Event-Based Face Verification session by its
@@ -2866,7 +2978,7 @@ var KycClient = class extends BaseClient {
    * @example
    * ```typescript
    * const result = await client.submitVerification({
-   *   reference: "customer_123",
+   *   reference: "4d2aff34-ab86-422d-992e-50b1234a5b67",
    *   email: "customer@example.com",
    *   country: "US",
    *   document: {
@@ -2883,12 +2995,12 @@ var KycClient = class extends BaseClient {
    * console.log(`Verification submitted: ${result.reference}`);
    * ```
    */
-  async submitVerification(request) {
+  async submitVerification(request, requestOptions) {
     return this.requestWithRetry("/api/v1/kyc/submit", {
       method: "POST",
       body: JSON.stringify(request),
       headers: this.getUserHeaders()
-    });
+    }, void 0, void 0, requestOptions);
   }
   /**
    * Get a KYC request by ID
@@ -2898,7 +3010,7 @@ var KycClient = class extends BaseClient {
    *
    * @example
    * ```typescript
-   * const kyc = await client.getKycRequest("kyc_abc123");
+   * const kyc = await client.getKycRequest("550e8400-e29b-41d4-a716-446655440000");
    * console.log(`Status: ${kyc.status}, ID Verified: ${kyc.id_verified}`);
    * ```
    */
@@ -2973,7 +3085,7 @@ var KycClient = class extends BaseClient {
    * @example
    * ```typescript
    * await client.requestAdditionalDocuments({
-   *   id: "kyc_abc123",
+   *   id: "550e8400-e29b-41d4-a716-446655440000",
    *   document_types: ["address", "document_two"],
    *   message: "Please provide proof of address and secondary ID"
    * });
@@ -2994,7 +3106,7 @@ var KycClient = class extends BaseClient {
    *
    * @example
    * ```typescript
-   * const proofs = await client.getProofDownloadURLs("kyc_abc123");
+   * const proofs = await client.getProofDownloadURLs("550e8400-e29b-41d4-a716-446655440000");
    * proofs.forEach(proof => {
    *   console.log(`${proof.type}: ${proof.url} (expires: ${proof.expires_at})`);
    * });
@@ -3328,10 +3440,13 @@ var TaxClient = class extends BaseClient {
       { method: "POST" }
     );
   }
-  async checkTINStatus(customerID) {
+  async checkTINStatus(customerID, requestOptions) {
     return this.requestWithRetry(
       `/api/v1/tax/customer-tax-profiles/${customerID}/check-tin`,
-      { method: "POST" }
+      { method: "POST" },
+      void 0,
+      void 0,
+      requestOptions
     );
   }
   async reRequestTaxForm(customerID, input) {
@@ -3591,9 +3706,11 @@ exports.KycClient = KycClient;
 exports.NetworkError = NetworkError;
 exports.RateLimitError = RateLimitError;
 exports.RateLimitTracker = RateLimitTracker;
+exports.RefreshingTokenProvider = RefreshingTokenProvider;
 exports.RiskProfileClient = RiskProfileClient;
 exports.SDK_VERSION = SDK_VERSION;
 exports.ServiceUnavailableError = ServiceUnavailableError;
+exports.StaticApiKeyProvider = StaticApiKeyProvider;
 exports.TaxClient = TaxClient;
 exports.TimeoutError = TimeoutError;
 exports.ValidationError = ValidationError;