vesant-sdk 1.7.0-dev.fce9898 → 1.7.0-dev.fe84882

package/dist/index-C3zUKydT.d.mts

@@ -0,0 +1,264 @@
+import { U as UUID, T as Timestamp, R as RiskLevel } from './types-CBQRNL-l.mjs';
+
+/**
+ * Pluggable dedup store for webhook replay protection.
+ *
+ * The default InMemoryDedupStore is process-local — correct for a single
+ * long-lived process, but useless across replicas / serverless invocations where
+ * the backend's at-least-once retries land on different instances. Supply a
+ * shared implementation (e.g. Redis with SETNX + TTL) via WebhookHandlerConfig
+ * to dedup reliably in those deployments.
+ */
+interface WebhookDedupStore {
+    /** Has this event id already been processed? */
+    seen(id: string): Promise<boolean>;
+    /** Record this event id as processed, retained for at least ttlMs. */
+    mark(id: string, ttlMs: number): Promise<void>;
+}
+interface InMemoryDedupStoreOptions {
+    /** Purge expired entries once the map grows past this size (default: 1000). */
+    maxEntries?: number;
+    /** Injectable clock (default: Date.now). */
+    now?: () => number;
+}
+declare class InMemoryDedupStore implements WebhookDedupStore {
+    private readonly expiryById;
+    private readonly maxEntries;
+    private readonly now;
+    constructor(opts?: InMemoryDedupStoreOptions);
+    seen(id: string): Promise<boolean>;
+    mark(id: string, ttlMs: number): Promise<void>;
+}
+
+/**
+ * Webhook signature verification utilities.
+ *
+ * Supports both Web Crypto API (browsers, Deno, Cloudflare Workers)
+ * and Node.js crypto module with automatic runtime detection.
+ * Uses constant-time comparison to prevent timing attacks.
+ */
+interface VerifyWebhookSignatureOptions {
+    /** Max allowed clock skew in ms for the signed-timestamp scheme (default: 300000). */
+    tolerance?: number;
+    /** Clock source for the tolerance check (default: Date.now). */
+    now?: () => number;
+    /** Accept the legacy body-only `sha256=<hex>` format (default: true, for migration). */
+    allowLegacy?: boolean;
+}
+/**
+ * Verify an HMAC-SHA256 webhook signature.
+ *
+ * Supports two schemes:
+ * - Signed-timestamp (preferred): `t=<unix>,v1=<hex>` where the HMAC is computed
+ *   over `${t}.${payload}`. The timestamp is inside the signed material, so a
+ *   replayed body is rejected once `|now - t|` exceeds the tolerance — the check
+ *   is done BEFORE the HMAC compare and authenticates the timestamp.
+ * - Legacy (body-only): `sha256=<hex>` (or raw hex) over the payload alone. Kept
+ *   for the migration window; disable via `allowLegacy: false`.
+ *
+ * @returns true if the signature is valid
+ */
+declare function verifyWebhookSignature(payload: string, signature: string, secret: string, opts?: VerifyWebhookSignatureOptions): Promise<boolean>;
+
+/**
+ * Webhook event types and payload definitions.
+ */
+
+type WebhookEventType = 'notification.created' | 'risk.score.changed' | 'risk.category.changed' | 'profile.created' | 'profile.updated' | 'geolocation.verified' | 'geolocation.blocked' | 'kyc.status.changed' | 'kyc.approved' | 'kyc.declined' | 'decision.recorded' | 'label.applied' | 'location_request.completed' | 'compliance.check.failed' | 'tax.reminder.sent';
+interface BaseWebhookEvent<T extends WebhookEventType = WebhookEventType, P = unknown> {
+    /**
+     * Top-level event id (typed events). The notification envelope carries none —
+     * the handler resolves the id from `notification.id`.
+     */
+    id?: UUID;
+    event_type: T;
+    tenant_id: string;
+    environment: 'production' | 'sandbox';
+    /** Absent on the notification envelope; present on typed events. */
+    customer_id?: string;
+    payload: P;
+    timestamp: Timestamp;
+    metadata?: Record<string, unknown>;
+}
+interface RiskScoreChangedPayload {
+    previous_score: number;
+    new_score: number;
+    risk_level: RiskLevel;
+    factors: string[];
+}
+interface RiskCategoryChangedPayload {
+    previous_category: string;
+    new_category: string;
+    risk_level: RiskLevel;
+}
+interface ProfileCreatedPayload {
+    customer_id: string;
+    entity_type: string;
+    source: string;
+}
+interface ProfileUpdatedPayload {
+    customer_id: string;
+    updated_fields: string[];
+}
+interface GeolocationVerifiedPayload {
+    latitude: number;
+    longitude: number;
+    country: string;
+    region?: string;
+    is_compliant: boolean;
+}
+interface GeolocationBlockedPayload {
+    latitude: number;
+    longitude: number;
+    country: string;
+    region?: string;
+    reasons: string[];
+}
+interface KycStatusChangedPayload {
+    previous_status: string;
+    new_status: string;
+    provider?: string;
+}
+interface DecisionRecordedPayload {
+    decision_id: string;
+    decision_type: string;
+    category: string;
+    source: string;
+    risk_score?: number;
+}
+interface LabelAppliedPayload {
+    label_type: string;
+    reasons?: string[];
+}
+interface LocationRequestCompletedPayload {
+    request_id: string;
+    status: string;
+    latitude?: number;
+    longitude?: number;
+}
+interface ComplianceCheckFailedPayload {
+    check_type: string;
+    reasons: string[];
+    severity: string;
+}
+interface TaxReminderSentPayload {
+    /** W-form the reminder is for (e.g. "W-9", "W-8BEN", "W-8BEN-E") */
+    form_type: string;
+    /** Sequential count of reminders sent in the current solicitation cycle */
+    reminder_count: number;
+    /** Configured maximum reminders per cycle (reminder_max_count) */
+    max_count: number;
+}
+interface WebhookNotification {
+    id: string;
+    user_id?: string;
+    title?: string;
+    message?: string;
+}
+/**
+ * The `notification.created` envelope emitted by notification-service. Unlike the
+ * typed events it has no top-level `id`/`customer_id` and no `payload`; the data
+ * is nested under `notification`.
+ */
+interface NotificationWebhookEvent {
+    id?: UUID;
+    event_type: 'notification.created';
+    tenant_id: string;
+    environment: 'production' | 'sandbox';
+    customer_id?: string;
+    notification: WebhookNotification;
+    timestamp: Timestamp;
+    metadata?: Record<string, unknown>;
+}
+type WebhookEvent = NotificationWebhookEvent | BaseWebhookEvent<'risk.score.changed', RiskScoreChangedPayload> | BaseWebhookEvent<'risk.category.changed', RiskCategoryChangedPayload> | BaseWebhookEvent<'profile.created', ProfileCreatedPayload> | BaseWebhookEvent<'profile.updated', ProfileUpdatedPayload> | BaseWebhookEvent<'geolocation.verified', GeolocationVerifiedPayload> | BaseWebhookEvent<'geolocation.blocked', GeolocationBlockedPayload> | BaseWebhookEvent<'kyc.status.changed', KycStatusChangedPayload> | BaseWebhookEvent<'kyc.approved', KycStatusChangedPayload> | BaseWebhookEvent<'kyc.declined', KycStatusChangedPayload> | BaseWebhookEvent<'decision.recorded', DecisionRecordedPayload> | BaseWebhookEvent<'label.applied', LabelAppliedPayload> | BaseWebhookEvent<'location_request.completed', LocationRequestCompletedPayload> | BaseWebhookEvent<'compliance.check.failed', ComplianceCheckFailedPayload> | BaseWebhookEvent<'tax.reminder.sent', TaxReminderSentPayload>;
+interface WebhookHandlerConfig {
+    /** Webhook signing secret for signature verification */
+    secret: string;
+    /** Header name containing the signature (default: 'x-webhook-signature') */
+    signatureHeader?: string;
+    /** Maximum age of webhook event in ms (default: 300000 = 5 minutes) */
+    tolerance?: number;
+    /** Enable replay protection to reject duplicate event IDs (default: true) */
+    replayProtection?: boolean;
+    /** Pluggable dedup store for replay protection (default: in-memory, process-local). */
+    dedupStore?: WebhookDedupStore;
+    /** Accept the legacy body-only `sha256=<hex>` signature during migration (default: true). */
+    allowLegacySignature?: boolean;
+}
+type WebhookEventHandler<T extends WebhookEventType = WebhookEventType> = (event: Extract<WebhookEvent, {
+    event_type: T;
+}>) => void | Promise<void>;
+type WebhookAnyHandler = (event: WebhookEvent) => void | Promise<void>;
+
+/**
+ * Webhook event handler with signature verification and typed dispatch.
+ */
+
+declare class WebhookHandler {
+    private handlers;
+    private anyHandlers;
+    private readonly secret;
+    private readonly tolerance;
+    private readonly replayProtection;
+    private readonly allowLegacySignature;
+    private readonly dedupStore;
+    constructor(config: WebhookHandlerConfig);
+    /**
+     * Register a handler for a specific event type.
+     */
+    on<T extends WebhookEventType>(eventType: T, handler: WebhookEventHandler<T>): this;
+    /**
+     * Register a catch-all handler for all event types.
+     */
+    onAny(handler: WebhookAnyHandler): this;
+    /**
+     * Verify signature and parse the webhook body.
+     */
+    verifyAndParse(body: string, signature: string): Promise<WebhookEvent>;
+    /**
+     * Verify signature, parse, and dispatch to registered handlers.
+     */
+    handle(body: string, signature: string): Promise<void>;
+    /**
+     * Parse an event without signature verification (for testing).
+     */
+    parseEvent(body: string): Promise<WebhookEvent>;
+    private parseAndValidate;
+    private dispatch;
+}
+
+/**
+ * Framework middleware helpers for webhook handling.
+ *
+ * Provides pre-built integrations for Express/Connect and Next.js App Router.
+ */
+
+interface WebhookMiddlewareOptions extends WebhookHandlerConfig {
+    /** Event handlers to register */
+    handlers?: Partial<Record<WebhookEventType, WebhookEventHandler>>;
+    /** Catch-all handler */
+    onAny?: WebhookAnyHandler;
+}
+/**
+ * Create an Express/Connect-compatible middleware for webhook handling.
+ *
+ * Expects the raw body to be available as `req.body` (string).
+ * Use `express.raw({ type: 'application/json' })` or similar middleware upstream.
+ */
+declare function createWebhookMiddleware(options: WebhookMiddlewareOptions): (req: {
+    body: string | Buffer;
+    headers: Record<string, string | string[] | undefined>;
+}, res: {
+    status(code: number): {
+        json(body: unknown): void;
+    };
+    json?(body: unknown): void;
+}, next?: (err?: unknown) => void) => Promise<void>;
+/**
+ * Create a Next.js App Router-compatible webhook handler.
+ *
+ * Returns an async function `(request: Request) => Promise<Response>`.
+ */
+declare function createNextWebhookHandler(options: WebhookMiddlewareOptions): (request: Request) => Promise<Response>;
+
+export { type BaseWebhookEvent as B, type ComplianceCheckFailedPayload as C, type DecisionRecordedPayload as D, type GeolocationBlockedPayload as G, InMemoryDedupStore as I, type KycStatusChangedPayload as K, type LabelAppliedPayload as L, type NotificationWebhookEvent as N, type ProfileCreatedPayload as P, type RiskCategoryChangedPayload as R, type TaxReminderSentPayload as T, type VerifyWebhookSignatureOptions as V, type WebhookAnyHandler as W, type GeolocationVerifiedPayload as a, type InMemoryDedupStoreOptions as b, type LocationRequestCompletedPayload as c, type ProfileUpdatedPayload as d, type RiskScoreChangedPayload as e, type WebhookDedupStore as f, type WebhookEvent as g, type WebhookEventHandler as h, type WebhookEventType as i, WebhookHandler as j, type WebhookHandlerConfig as k, type WebhookMiddlewareOptions as l, type WebhookNotification as m, createNextWebhookHandler as n, createWebhookMiddleware as o, verifyWebhookSignature as v };

package/dist/index-DSDgS09k.d.ts

@@ -0,0 +1,264 @@
+import { U as UUID, T as Timestamp, R as RiskLevel } from './types-CBQRNL-l.js';
+
+/**
+ * Pluggable dedup store for webhook replay protection.
+ *
+ * The default InMemoryDedupStore is process-local — correct for a single
+ * long-lived process, but useless across replicas / serverless invocations where
+ * the backend's at-least-once retries land on different instances. Supply a
+ * shared implementation (e.g. Redis with SETNX + TTL) via WebhookHandlerConfig
+ * to dedup reliably in those deployments.
+ */
+interface WebhookDedupStore {
+    /** Has this event id already been processed? */
+    seen(id: string): Promise<boolean>;
+    /** Record this event id as processed, retained for at least ttlMs. */
+    mark(id: string, ttlMs: number): Promise<void>;
+}
+interface InMemoryDedupStoreOptions {
+    /** Purge expired entries once the map grows past this size (default: 1000). */
+    maxEntries?: number;
+    /** Injectable clock (default: Date.now). */
+    now?: () => number;
+}
+declare class InMemoryDedupStore implements WebhookDedupStore {
+    private readonly expiryById;
+    private readonly maxEntries;
+    private readonly now;
+    constructor(opts?: InMemoryDedupStoreOptions);
+    seen(id: string): Promise<boolean>;
+    mark(id: string, ttlMs: number): Promise<void>;
+}
+
+/**
+ * Webhook signature verification utilities.
+ *
+ * Supports both Web Crypto API (browsers, Deno, Cloudflare Workers)
+ * and Node.js crypto module with automatic runtime detection.
+ * Uses constant-time comparison to prevent timing attacks.
+ */
+interface VerifyWebhookSignatureOptions {
+    /** Max allowed clock skew in ms for the signed-timestamp scheme (default: 300000). */
+    tolerance?: number;
+    /** Clock source for the tolerance check (default: Date.now). */
+    now?: () => number;
+    /** Accept the legacy body-only `sha256=<hex>` format (default: true, for migration). */
+    allowLegacy?: boolean;
+}
+/**
+ * Verify an HMAC-SHA256 webhook signature.
+ *
+ * Supports two schemes:
+ * - Signed-timestamp (preferred): `t=<unix>,v1=<hex>` where the HMAC is computed
+ *   over `${t}.${payload}`. The timestamp is inside the signed material, so a
+ *   replayed body is rejected once `|now - t|` exceeds the tolerance — the check
+ *   is done BEFORE the HMAC compare and authenticates the timestamp.
+ * - Legacy (body-only): `sha256=<hex>` (or raw hex) over the payload alone. Kept
+ *   for the migration window; disable via `allowLegacy: false`.
+ *
+ * @returns true if the signature is valid
+ */
+declare function verifyWebhookSignature(payload: string, signature: string, secret: string, opts?: VerifyWebhookSignatureOptions): Promise<boolean>;
+
+/**
+ * Webhook event types and payload definitions.
+ */
+
+type WebhookEventType = 'notification.created' | 'risk.score.changed' | 'risk.category.changed' | 'profile.created' | 'profile.updated' | 'geolocation.verified' | 'geolocation.blocked' | 'kyc.status.changed' | 'kyc.approved' | 'kyc.declined' | 'decision.recorded' | 'label.applied' | 'location_request.completed' | 'compliance.check.failed' | 'tax.reminder.sent';
+interface BaseWebhookEvent<T extends WebhookEventType = WebhookEventType, P = unknown> {
+    /**
+     * Top-level event id (typed events). The notification envelope carries none —
+     * the handler resolves the id from `notification.id`.
+     */
+    id?: UUID;
+    event_type: T;
+    tenant_id: string;
+    environment: 'production' | 'sandbox';
+    /** Absent on the notification envelope; present on typed events. */
+    customer_id?: string;
+    payload: P;
+    timestamp: Timestamp;
+    metadata?: Record<string, unknown>;
+}
+interface RiskScoreChangedPayload {
+    previous_score: number;
+    new_score: number;
+    risk_level: RiskLevel;
+    factors: string[];
+}
+interface RiskCategoryChangedPayload {
+    previous_category: string;
+    new_category: string;
+    risk_level: RiskLevel;
+}
+interface ProfileCreatedPayload {
+    customer_id: string;
+    entity_type: string;
+    source: string;
+}
+interface ProfileUpdatedPayload {
+    customer_id: string;
+    updated_fields: string[];
+}
+interface GeolocationVerifiedPayload {
+    latitude: number;
+    longitude: number;
+    country: string;
+    region?: string;
+    is_compliant: boolean;
+}
+interface GeolocationBlockedPayload {
+    latitude: number;
+    longitude: number;
+    country: string;
+    region?: string;
+    reasons: string[];
+}
+interface KycStatusChangedPayload {
+    previous_status: string;
+    new_status: string;
+    provider?: string;
+}
+interface DecisionRecordedPayload {
+    decision_id: string;
+    decision_type: string;
+    category: string;
+    source: string;
+    risk_score?: number;
+}
+interface LabelAppliedPayload {
+    label_type: string;
+    reasons?: string[];
+}
+interface LocationRequestCompletedPayload {
+    request_id: string;
+    status: string;
+    latitude?: number;
+    longitude?: number;
+}
+interface ComplianceCheckFailedPayload {
+    check_type: string;
+    reasons: string[];
+    severity: string;
+}
+interface TaxReminderSentPayload {
+    /** W-form the reminder is for (e.g. "W-9", "W-8BEN", "W-8BEN-E") */
+    form_type: string;
+    /** Sequential count of reminders sent in the current solicitation cycle */
+    reminder_count: number;
+    /** Configured maximum reminders per cycle (reminder_max_count) */
+    max_count: number;
+}
+interface WebhookNotification {
+    id: string;
+    user_id?: string;
+    title?: string;
+    message?: string;
+}
+/**
+ * The `notification.created` envelope emitted by notification-service. Unlike the
+ * typed events it has no top-level `id`/`customer_id` and no `payload`; the data
+ * is nested under `notification`.
+ */
+interface NotificationWebhookEvent {
+    id?: UUID;
+    event_type: 'notification.created';
+    tenant_id: string;
+    environment: 'production' | 'sandbox';
+    customer_id?: string;
+    notification: WebhookNotification;
+    timestamp: Timestamp;
+    metadata?: Record<string, unknown>;
+}
+type WebhookEvent = NotificationWebhookEvent | BaseWebhookEvent<'risk.score.changed', RiskScoreChangedPayload> | BaseWebhookEvent<'risk.category.changed', RiskCategoryChangedPayload> | BaseWebhookEvent<'profile.created', ProfileCreatedPayload> | BaseWebhookEvent<'profile.updated', ProfileUpdatedPayload> | BaseWebhookEvent<'geolocation.verified', GeolocationVerifiedPayload> | BaseWebhookEvent<'geolocation.blocked', GeolocationBlockedPayload> | BaseWebhookEvent<'kyc.status.changed', KycStatusChangedPayload> | BaseWebhookEvent<'kyc.approved', KycStatusChangedPayload> | BaseWebhookEvent<'kyc.declined', KycStatusChangedPayload> | BaseWebhookEvent<'decision.recorded', DecisionRecordedPayload> | BaseWebhookEvent<'label.applied', LabelAppliedPayload> | BaseWebhookEvent<'location_request.completed', LocationRequestCompletedPayload> | BaseWebhookEvent<'compliance.check.failed', ComplianceCheckFailedPayload> | BaseWebhookEvent<'tax.reminder.sent', TaxReminderSentPayload>;
+interface WebhookHandlerConfig {
+    /** Webhook signing secret for signature verification */
+    secret: string;
+    /** Header name containing the signature (default: 'x-webhook-signature') */
+    signatureHeader?: string;
+    /** Maximum age of webhook event in ms (default: 300000 = 5 minutes) */
+    tolerance?: number;
+    /** Enable replay protection to reject duplicate event IDs (default: true) */
+    replayProtection?: boolean;
+    /** Pluggable dedup store for replay protection (default: in-memory, process-local). */
+    dedupStore?: WebhookDedupStore;
+    /** Accept the legacy body-only `sha256=<hex>` signature during migration (default: true). */
+    allowLegacySignature?: boolean;
+}
+type WebhookEventHandler<T extends WebhookEventType = WebhookEventType> = (event: Extract<WebhookEvent, {
+    event_type: T;
+}>) => void | Promise<void>;
+type WebhookAnyHandler = (event: WebhookEvent) => void | Promise<void>;
+
+/**
+ * Webhook event handler with signature verification and typed dispatch.
+ */
+
+declare class WebhookHandler {
+    private handlers;
+    private anyHandlers;
+    private readonly secret;
+    private readonly tolerance;
+    private readonly replayProtection;
+    private readonly allowLegacySignature;
+    private readonly dedupStore;
+    constructor(config: WebhookHandlerConfig);
+    /**
+     * Register a handler for a specific event type.
+     */
+    on<T extends WebhookEventType>(eventType: T, handler: WebhookEventHandler<T>): this;
+    /**
+     * Register a catch-all handler for all event types.
+     */
+    onAny(handler: WebhookAnyHandler): this;
+    /**
+     * Verify signature and parse the webhook body.
+     */
+    verifyAndParse(body: string, signature: string): Promise<WebhookEvent>;
+    /**
+     * Verify signature, parse, and dispatch to registered handlers.
+     */
+    handle(body: string, signature: string): Promise<void>;
+    /**
+     * Parse an event without signature verification (for testing).
+     */
+    parseEvent(body: string): Promise<WebhookEvent>;
+    private parseAndValidate;
+    private dispatch;
+}
+
+/**
+ * Framework middleware helpers for webhook handling.
+ *
+ * Provides pre-built integrations for Express/Connect and Next.js App Router.
+ */
+
+interface WebhookMiddlewareOptions extends WebhookHandlerConfig {
+    /** Event handlers to register */
+    handlers?: Partial<Record<WebhookEventType, WebhookEventHandler>>;
+    /** Catch-all handler */
+    onAny?: WebhookAnyHandler;
+}
+/**
+ * Create an Express/Connect-compatible middleware for webhook handling.
+ *
+ * Expects the raw body to be available as `req.body` (string).
+ * Use `express.raw({ type: 'application/json' })` or similar middleware upstream.
+ */
+declare function createWebhookMiddleware(options: WebhookMiddlewareOptions): (req: {
+    body: string | Buffer;
+    headers: Record<string, string | string[] | undefined>;
+}, res: {
+    status(code: number): {
+        json(body: unknown): void;
+    };
+    json?(body: unknown): void;
+}, next?: (err?: unknown) => void) => Promise<void>;
+/**
+ * Create a Next.js App Router-compatible webhook handler.
+ *
+ * Returns an async function `(request: Request) => Promise<Response>`.
+ */
+declare function createNextWebhookHandler(options: WebhookMiddlewareOptions): (request: Request) => Promise<Response>;
+
+export { type BaseWebhookEvent as B, type ComplianceCheckFailedPayload as C, type DecisionRecordedPayload as D, type GeolocationBlockedPayload as G, InMemoryDedupStore as I, type KycStatusChangedPayload as K, type LabelAppliedPayload as L, type NotificationWebhookEvent as N, type ProfileCreatedPayload as P, type RiskCategoryChangedPayload as R, type TaxReminderSentPayload as T, type VerifyWebhookSignatureOptions as V, type WebhookAnyHandler as W, type GeolocationVerifiedPayload as a, type InMemoryDedupStoreOptions as b, type LocationRequestCompletedPayload as c, type ProfileUpdatedPayload as d, type RiskScoreChangedPayload as e, type WebhookDedupStore as f, type WebhookEvent as g, type WebhookEventHandler as h, type WebhookEventType as i, WebhookHandler as j, type WebhookHandlerConfig as k, type WebhookMiddlewareOptions as l, type WebhookNotification as m, createNextWebhookHandler as n, createWebhookMiddleware as o, verifyWebhookSignature as v };

package/dist/index.d.mts

@@ -1,16 +1,33 @@
-import { L as Logger } from './client-BolQlL5e.mjs';
-export { B as BaseClient, a as BaseClientConfig, C as CGSConfig, b as CircuitBreaker, c as CircuitBreakerConfig, d as CircuitBreakerState, e as CircuitBreakerStatus, f as RateLimitStatus, g as RateLimitTracker, h as RequestInterceptor, R as RequestOptions, i as RequiredBaseClientConfig, j as RequiredCGSConfig, k as RequiredVesantConfig, V as VesantConfig } from './client-BolQlL5e.mjs';
-export { A as APIResponse, B as BlockReason, C as CustomerStatus, E as EntityType, b as ErrorResponse, L as LocationCompliance, a as PaginatedResponse, P as PaginationParams, c as Reason, d as Result, R as RiskLevel, S as SuccessResponse, T as Timestamp, U as UUID, V as VerificationEventType } from './types-CBQRNL-l.mjs';
-export { BaseWebhookEvent, ComplianceCheckFailedPayload, DecisionRecordedPayload, GeolocationBlockedPayload, GeolocationVerifiedPayload, KycStatusChangedPayload, LabelAppliedPayload, LocationRequestCompletedPayload, ProfileCreatedPayload, ProfileUpdatedPayload, RiskCategoryChangedPayload, RiskScoreChangedPayload, TaxReminderSentPayload, WebhookAnyHandler, WebhookEvent, WebhookEventHandler, WebhookEventType, WebhookHandler, WebhookHandlerConfig, WebhookMiddlewareOptions, createNextWebhookHandler, createWebhookMiddleware, verifyWebhookSignature } from './webhooks/index.mjs';
-export { A as APIError, d as AlertFilters, e as AlertListResponse, f as AlertSeverity, g as AlertStatus, h as AlertType, C as CipherTextCustomerData, i as CipherTextOptions, j as CipherTextPayload, k as CipherTextReason, l as CipherTextResult, m as ComplianceCheckResponse, n as CreateGeofenceRuleRequest, o as CreateJurisdictionRequest, p as CreateLocationRequestRequest, q as DashboardMetrics, r as DecryptedCipherText, s as DeviceFingerprint, D as DeviceFingerprintRequest, t as DeviceTrustResult, u as GeoIPResult, v as GeofenceAction, w as GeofenceEvaluation, x as GeofenceRule, y as GeofenceRuleType, z as GeolocationAlert, G as GeolocationClient, B as GeolocationClientConfig, E as GeolocationConfigResponse, F as GeolocationRecord, J as JurisdictionConfig, H as LocationCaptureRequest, I as LocationCaptureResponse, a as LocationRequest, K as LocationRequestChannel, b as LocationRequestFilters, c as LocationRequestListResponse, M as LocationRequestResult, N as LocationRequestStatus, O as LocationShareInfo, L as LocationVerification, R as ResendLocationRequestRequest, U as UpdateDeviceTrustRequest, P as UpdateGeofenceRuleRequest, Q as UpdateJurisdictionRequest, S as UseAlertsOptions, T as UseAlertsResult, W as UseGeolocationOptions, X as UseGeolocationResult, Y as UseLocationCaptureOptions, Z as UseLocationCaptureResult, _ as UseLocationRequestsOptions, $ as UseLocationRequestsResult, a0 as ValidateCipherTextRequest, V as ValidateCipherTextResponse, a1 as VerifyIPRequest, a2 as WiFiNetwork } from './client-DMIRx7Tu.mjs';
-export { decodeCipherText, generateCipherText, isCipherTextExpired } from './geolocation/index.mjs';
+import { L as Logger } from './client-q9fN8Hhf.mjs';
+export { A as AuthCredential, B as BaseClient, a as BaseClientConfig, C as CGSConfig, b as CircuitBreaker, c as CircuitBreakerConfig, d as CircuitBreakerState, e as CircuitBreakerStatus, f as RateLimitStatus, g as RateLimitTracker, h as RefreshingTokenProvider, i as RefreshingTokenProviderOptions, j as RequestInterceptor, R as RequestOptions, k as RequiredBaseClientConfig, l as RequiredCGSConfig, m as RequiredVesantConfig, S as StaticApiKeyProvider, T as TokenProvider, n as TokenProviderContext, V as VesantConfig } from './client-q9fN8Hhf.mjs';
+import { a as PaginatedResponse } from './types-CBQRNL-l.mjs';
+export { A as APIResponse, B as BlockReason, C as CustomerStatus, E as EntityType, b as ErrorResponse, L as LocationCompliance, P as PaginationParams, c as Reason, d as Result, R as RiskLevel, S as SuccessResponse, T as Timestamp, U as UUID, V as VerificationEventType } from './types-CBQRNL-l.mjs';
+export { B as BaseWebhookEvent, C as ComplianceCheckFailedPayload, D as DecisionRecordedPayload, G as GeolocationBlockedPayload, a as GeolocationVerifiedPayload, I as InMemoryDedupStore, b as InMemoryDedupStoreOptions, K as KycStatusChangedPayload, L as LabelAppliedPayload, c as LocationRequestCompletedPayload, N as NotificationWebhookEvent, P as ProfileCreatedPayload, d as ProfileUpdatedPayload, R as RiskCategoryChangedPayload, e as RiskScoreChangedPayload, T as TaxReminderSentPayload, V as VerifyWebhookSignatureOptions, W as WebhookAnyHandler, f as WebhookDedupStore, g as WebhookEvent, h as WebhookEventHandler, i as WebhookEventType, j as WebhookHandler, k as WebhookHandlerConfig, l as WebhookMiddlewareOptions, m as WebhookNotification, n as createNextWebhookHandler, o as createWebhookMiddleware, v as verifyWebhookSignature } from './index-C3zUKydT.mjs';
+export { A as APIError, d as AlertFilters, e as AlertListResponse, f as AlertSeverity, g as AlertStatus, h as AlertType, C as CipherTextCustomerData, i as CipherTextOptions, j as CipherTextPayload, k as CipherTextReason, l as CipherTextResult, m as ComplianceCheckResponse, n as CreateGeofenceRuleRequest, o as CreateJurisdictionRequest, p as CreateLocationRequestRequest, q as DashboardMetrics, r as DecryptedCipherText, s as DeviceFingerprint, D as DeviceFingerprintRequest, t as DeviceTrustResult, u as GeoIPResult, v as GeofenceAction, w as GeofenceEvaluation, x as GeofenceRule, y as GeofenceRuleType, z as GeolocationAlert, G as GeolocationClient, B as GeolocationClientConfig, E as GeolocationConfigResponse, F as GeolocationRecord, J as JurisdictionConfig, H as LocationCaptureRequest, I as LocationCaptureResponse, a as LocationRequest, K as LocationRequestChannel, b as LocationRequestFilters, c as LocationRequestListResponse, M as LocationRequestResult, N as LocationRequestStatus, O as LocationShareInfo, L as LocationVerification, R as ResendLocationRequestRequest, U as UpdateDeviceTrustRequest, P as UpdateGeofenceRuleRequest, Q as UpdateJurisdictionRequest, S as UseAlertsOptions, T as UseAlertsResult, W as UseGeolocationOptions, X as UseGeolocationResult, Y as UseLocationCaptureOptions, Z as UseLocationCaptureResult, _ as UseLocationRequestsOptions, $ as UseLocationRequestsResult, a0 as ValidateCipherTextRequest, V as ValidateCipherTextResponse, a1 as VerifyIPRequest } from './client-CvWNRwwg.mjs';
+export { GpsIntegrityInput, GpsIntegrityOptions, GpsIntegrityResult, assessGpsIntegrity, decodeCipherText, generateCipherText, gpsIntegrityInputFromPosition, isCipherTextExpired, probeGeolocationPermission } from './geolocation/index.mjs';
 export { RiskProfileClient } from './risk-profile/index.mjs';
 export { a as CreateCustomerProfileRequest, a as CreateProfileRequest, C as CustomerProfile, P as CustomerProfileFilters, b as CustomerProfileListResponse, E as EmploymentType, L as LegalForm, c as ProfileDetailsResponse, P as ProfileFilters, b as ProfileListResponse, R as RiskCategory, d as RiskConfiguration, e as RiskDashboardMetrics, f as RiskFactor, g as RiskFactorType, h as RiskHistory, S as ScreeningStatus, U as UpdateProfileRequest } from './types-BOFaMQxI.mjs';
 export { sdkReasons } from './compliance/index.mjs';
-export { C as ComplianceClient, a as ComplianceLocationRequestInput, b as ComplianceLocationRequestResult, c as CurrencyRates, D as DEFAULT_CURRENCY_RATES, E as EventVerificationRequest, d as EventVerificationResponse, L as LoginVerificationRequest, e as LoginVerificationResponse, R as RegistrationVerificationRequest, f as RegistrationVerificationResponse, T as TransactionRiskResult, g as TransactionVerificationRequest, h as TransactionVerificationResponse } from './client-ZNdnpWe7.mjs';
-export { CheckKycStatusRequest, CheckKycStatusResponse, CreateEventBasedFaceVerificationSessionRequest, CreateEventBasedFaceVerificationSessionResponse, DocumentType, DocumentVerificationRequest, DocumentVerificationResponse, EventBasedFaceVerificationCallback, EventBasedFaceVerificationDeviceType, EventBasedFaceVerificationEvent, EventBasedFaceVerificationFrequencyTrigger, EventBasedFaceVerificationReactionResult, EventBasedFaceVerificationReactions, EventBasedFaceVerificationThresholdTrigger, EventBasedFaceVerificationTriggers, FaceProof, KYC_DECLINED_DESCRIPTIONS, KycAlert, KycAlertFilters, KycAlertListResponse, KycAlertStatus, KycAlertType, KycClient, KycClientConfig, KycCustomerProfile, KycDeclinedCode, KycHandoffSession, KycOverview, KycPagination, KycPreferences, KycRequest, KycRequestFilters, KycRequestListResponse, KycStatus, Name, Proof, ProofDownloadURL, ProofType, RequestAdditionalDocumentsRequest, RequestKycSubmitLinkRequest, RequestKycSubmitLinkResponse, SubmitEventBasedFaceVerificationSessionRequest, SubmittedDocument, SupportedDocumentType, UpdateKycAlertRequest, UpdateKycPreferencesRequest, UpdateKycStatusRequest, UseKycAlertsOptions, UseKycAlertsResult, UseKycOverviewOptions, UseKycOverviewResult, UseKycPreferencesResult, UseKycRequestsOptions, UseKycRequestsResult, UseKycSubmissionOptions, UseKycSubmissionResult } from './kyc/index.mjs';
+export { C as ComplianceClient, a as ComplianceLocationRequestInput, b as ComplianceLocationRequestResult, c as CurrencyRates, D as DEFAULT_CURRENCY_RATES, E as EventVerificationRequest, d as EventVerificationResponse, L as LoginVerificationRequest, e as LoginVerificationResponse, R as RegistrationVerificationRequest, f as RegistrationVerificationResponse, T as TransactionRiskResult, g as TransactionVerificationRequest, h as TransactionVerificationResponse } from './client-Dps40EtF.mjs';
+export { CheckKycStatusRequest, CheckKycStatusResponse, CreateEventBasedFaceVerificationSessionRequest, CreateEventBasedFaceVerificationSessionResponse, DocumentType, DocumentVerificationRequest, DocumentVerificationResponse, EventBasedFaceVerificationCallback, EventBasedFaceVerificationDeviceType, EventBasedFaceVerificationEvent, EventBasedFaceVerificationFrequencyTrigger, EventBasedFaceVerificationReactionResult, EventBasedFaceVerificationReactions, EventBasedFaceVerificationThresholdTrigger, EventBasedFaceVerificationTriggers, FaceProof, KYC_DECLINED_DESCRIPTIONS, KycAlert, KycAlertFilters, KycAlertListResponse, KycAlertStatus, KycAlertType, KycClient, KycClientConfig, KycCustomerData, KycCustomerProfile, KycDeclinedCode, KycHandoffSession, KycOverview, KycPagination, KycPreferences, KycRequest, KycRequestFilters, KycRequestListResponse, KycStatus, Name, Proof, ProofDownloadURL, ProofType, RequestAdditionalDocumentsRequest, RequestKycSubmitLinkRequest, RequestKycSubmitLinkResponse, SubmitEventBasedFaceVerificationSessionRequest, SubmittedDocument, SupportedDocumentType, UpdateKycAlertRequest, UpdateKycPreferencesRequest, UpdateKycStatusRequest, UseKycAlertsOptions, UseKycAlertsResult, UseKycOverviewOptions, UseKycOverviewResult, UseKycPreferencesResult, UseKycRequestsOptions, UseKycRequestsResult, UseKycSubmissionOptions, UseKycSubmissionResult } from './kyc/index.mjs';
 export { CTPFormStatus, CTPTINStatus, ComplianceStats, ComplianceStatsFilters, CustomerTaxProfileDocuments, CustomerTaxProfileRecord, CustomerType, DocumentRequestBreakdown, EmailSendingMethod, EnableWithholdingInput, EnableWithholdingResponse, GlobalTaxRule, ReRequestTaxFormInput, RemindersRunResult, TINCheckResult, TINStatusBreakdown, TaxClient, TaxClientConfig, TaxRuleApprovalStatus, TaxRuleVersion, TaxRules, TransactionAction, TreatyCountry, TreatyCountryListResponse, UpdateTaxRulesInput, WFormCountBreakdown, WFormStatusBreakdown } from './tax/index.mjs';
 
+/**
+ * Lazily walk every item across all pages of a paginated endpoint. `fetchPage`
+ * is called with a 1-based page number and must return a PaginatedResponse.
+ * Iteration advances until `total_pages` is reached, and stops early if a page
+ * returns no items (a guard against a runaway loop on an over-reported
+ * total_pages). Pages are fetched on demand as the consumer iterates.
+ *
+ * @example
+ * for await (const profile of paginate((page) => client.listProfiles({ page }))) {
+ *   // ...
+ * }
+ */
+declare function paginate<T>(fetchPage: (page: number) => Promise<PaginatedResponse<T>>): AsyncGenerator<T, void, void>;
+/** Collect every item from a paginated endpoint into a single array. */
+declare function collectAll<T>(fetchPage: (page: number) => Promise<PaginatedResponse<T>>): Promise<T[]>;
+
 /**
  * Error hierarchy for Vesant SDK
  *
@@ -68,4 +85,4 @@ declare const noopLogger: Logger;
  */
 declare const SDK_VERSION = "1.7.0";
 
-export { AuthenticationError, CGSError, CircuitBreakerOpenError, ComplianceBlockedError, ComplianceError, Logger, NetworkError, RateLimitError, SDK_VERSION, ServiceUnavailableError, TimeoutError, ValidationError, VesantError, createConsoleLogger, noopLogger };
+export { AuthenticationError, CGSError, CircuitBreakerOpenError, ComplianceBlockedError, ComplianceError, Logger, NetworkError, PaginatedResponse, RateLimitError, SDK_VERSION, ServiceUnavailableError, TimeoutError, ValidationError, VesantError, collectAll, createConsoleLogger, noopLogger, paginate };