vesant-sdk 1.7.0 → 1.7.1-dev.0520b46

package/dist/kyc/core.mjs

@@ -1,3 +1,16 @@
+// src/core/auth.ts
+var StaticApiKeyProvider = class {
+  constructor(apiKey) {
+    this.apiKey = apiKey;
+  }
+  async getCredential() {
+    return this.apiKey ? { scheme: "Bearer", token: this.apiKey } : null;
+  }
+  canRefresh() {
+    return false;
+  }
+};
+
 // src/core/errors.ts
 var VesantError = class _VesantError extends Error {
   constructor(message, code, statusCode, details) {
@@ -214,7 +227,7 @@ function createConsoleLogger() {
 }
 
 // src/core/version.ts
-var SDK_VERSION = "1.7.0";
+var SDK_VERSION = "1.7.1";
 
 // src/shared/browser-utils.ts
 function generateUUID() {
@@ -239,6 +252,12 @@ var BaseClient = class {
     if (!config.tenantId?.trim()) {
       throw new ValidationError("tenantId is required and must be a non-empty string", ["tenantId"]);
     }
+    if (typeof fetch === "undefined") {
+      throw new VesantError(
+        "The Vesant SDK requires a global fetch (Node.js >= 18). Upgrade Node or provide a fetch polyfill.",
+        "RUNTIME_UNSUPPORTED"
+      );
+    }
     this.interceptors = config.interceptors || [];
     this.logger = config.logger || createConsoleLogger();
     let environment = config.environment;
@@ -257,11 +276,12 @@ var BaseClient = class {
       environment,
       headers: config.headers || {},
       timeout: config.timeout || 1e4,
-      retries: config.retries || 3,
+      retries: config.retries ?? 3,
       debug: config.debug || false,
       interceptors: this.interceptors,
       logger: this.logger
     };
+    this.authProvider = config.authProvider ?? (apiKey ? new StaticApiKeyProvider(apiKey) : void 0);
     if (config.circuitBreaker) {
       this.circuitBreaker = new CircuitBreaker(config.circuitBreaker);
     }
@@ -269,6 +289,19 @@ var BaseClient = class {
       this.rateLimitTracker = new RateLimitTracker();
     }
   }
+  /**
+   * Resolve the Idempotency-Key for a request. Mutating methods (POST/PUT/PATCH)
+   * get the caller-supplied key or a freshly minted UUID; non-mutating methods get
+   * none. requestWithRetry resolves this once and injects it so every retry reuses
+   * one key (letting the server dedup replays); a direct request() resolves per call.
+   */
+  resolveIdempotencyKey(method, requestOptions) {
+    const isMutating = ["POST", "PUT", "PATCH"].includes((method || "GET").toUpperCase());
+    if (!isMutating) {
+      return void 0;
+    }
+    return requestOptions?.idempotencyKey ?? generateUUID();
+  }
   /**
    * Make an HTTP request with timeout and error handling
    */
@@ -294,15 +327,20 @@ var BaseClient = class {
       ...this.config.headers,
       ...options.headers || {}
     };
-    if (this.config.apiKey) {
-      headers["Authorization"] = `Bearer ${this.config.apiKey}`;
+    const credential = await this.authProvider?.getCredential({
+      tenantId: this.config.tenantId,
+      requestId
+    });
+    if (credential) {
+      headers["Authorization"] = `${credential.scheme ?? "Bearer"} ${credential.token}`;
     }
     if (this.config.environment === "sandbox") {
       headers["X-Sandbox"] = "true";
     }
     const method = (options.method || "GET").toUpperCase();
-    if (["POST", "PUT", "PATCH"].includes(method)) {
-      headers["Idempotency-Key"] = requestOptions?.idempotencyKey || generateUUID();
+    const idempotencyKey = this.resolveIdempotencyKey(method, requestOptions);
+    if (idempotencyKey) {
+      headers["Idempotency-Key"] = idempotencyKey;
     }
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), this.config.timeout);
@@ -323,10 +361,28 @@ var BaseClient = class {
       if (this.config.debug) {
         this.logger.debug(`${finalOptions.method || "GET"} ${endpoint}`);
       }
-      const response = await fetch(url, {
+      let response = await fetch(url, {
         ...finalOptions,
         signal: controller.signal
       });
+      if (response.status === 401 && this.authProvider?.canRefresh?.()) {
+        const refreshed = await this.authProvider.getCredential({
+          tenantId: this.config.tenantId,
+          requestId,
+          forceRefresh: true
+        });
+        if (refreshed) {
+          this.config.onCredentialRotated?.({ reason: "unauthorized" });
+          finalOptions = {
+            ...finalOptions,
+            headers: {
+              ...finalOptions.headers,
+              Authorization: `${refreshed.scheme ?? "Bearer"} ${refreshed.token}`
+            }
+          };
+          response = await fetch(url, { ...finalOptions, signal: controller.signal });
+        }
+      }
       clearTimeout(timeoutId);
       if (this.rateLimitTracker) {
         this.rateLimitTracker.updateFromHeaders(response.headers);
@@ -415,9 +471,11 @@ var BaseClient = class {
    */
   async requestWithRetry(endpoint, options = {}, serviceURL, retries = this.config.retries, requestOptions) {
     let lastError;
+    const idempotencyKey = this.resolveIdempotencyKey(options.method || "GET", requestOptions);
+    const attemptOptions = idempotencyKey ? { ...requestOptions, idempotencyKey } : requestOptions;
     for (let attempt = 0; attempt <= retries; attempt++) {
       try {
-        return await this.request(endpoint, options, serviceURL, requestOptions);
+        return await this.request(endpoint, options, serviceURL, attemptOptions);
       } catch (error) {
         lastError = error instanceof Error ? error : new Error("Unknown error");
         if (requestOptions?.signal?.aborted) {
@@ -514,6 +572,9 @@ var BaseClient = class {
     if (config.interceptors) {
       this.interceptors = config.interceptors;
     }
+    if (config.authProvider !== void 0 || config.apiKey !== void 0) {
+      this.authProvider = this.config.authProvider ?? (this.config.apiKey ? new StaticApiKeyProvider(this.config.apiKey) : void 0);
+    }
   }
   /**
    * Get current configuration (readonly)
@@ -630,21 +691,20 @@ var KycClient = class extends BaseClient {
    * console.log(`KYC ID: ${result.kyc_id}`);
    * ```
    */
-  async requestKycSubmitLink(request) {
+  async requestKycSubmitLink(request, requestOptions) {
     return this.requestWithRetry("/api/v1/kyc/request", {
       method: "POST",
       body: JSON.stringify(request),
       headers: this.getUserHeaders()
-    });
+    }, void 0, void 0, requestOptions);
   }
   /**
    * Create a Event-Based Face Verification session.
    *
    * Inspect the response before showing UI:
-   * - `is_required === false` → skip face capture; `reason` explains why.
-   * - `device_type === 'desktop'` → render `qr_payload` as a QR; the
-   *   mobile device picks up the session via the connect endpoint.
-   * - `device_type === 'mobile'` → open the face capture modal directly.
+   * - `is_required === false` → skip face verification; `reason` explains why.
+   * - `verification_url` present → embed the hosted journey and poll status.
+   * - `verification_url` absent → use the local camera / QR fallback.
    *
    * @param request - Reference, customer_id, event, amount (for threshold events), optional URLs.
    */
@@ -668,12 +728,12 @@ var KycClient = class extends BaseClient {
    *
    * @param request - Token from `createEventBasedFaceVerificationSession`, plus the base64 selfie.
    */
-  async submitEventBasedFaceVerificationSession(request) {
+  async submitEventBasedFaceVerificationSession(request, requestOptions) {
     return this.request("/api/v1/kyc/face/submit", {
       method: "POST",
       body: JSON.stringify(request),
       headers: this.getUserHeaders()
-    });
+    }, void 0, requestOptions);
   }
   /**
    * Look up the current state of a Event-Based Face Verification session by its
@@ -691,11 +751,28 @@ var KycClient = class extends BaseClient {
       headers: this.getUserHeaders()
     });
   }
+  /**
+   * Mint a fresh hosted verification journey for the next attempt on an
+   * active session whose previous hosted-journey attempt was declined.
+   * Only valid while the session is active and attempts remain; the
+   * response carries the new `verification_url` to embed. Used internally
+   * by `FaceCaptureModal`'s Try Again flow in hosted-journey mode.
+   *
+   * @param token - The session token returned by `createEventBasedFaceVerificationSession`.
+   */
+  async retryEventBasedFaceVerificationJourney(token) {
+    return this.request("/api/v1/kyc/face/onsite/journey", {
+      method: "POST",
+      body: JSON.stringify({ token }),
+      headers: this.getUserHeaders()
+    });
+  }
   /**
    * Fetch the Redis-backed handoff session for a token. Same backing
-   * store as normal KYC (`kyc:session:<token>`, 15-minute TTL). Desktop
-   * callers poll `mobile_connected` to detect when a mobile device has
-   * scanned the QR and attached.
+   * store as normal KYC (`kyc:session:<token>`, 15-minute TTL). The
+   * Event-Based Face Verification database session still expires after
+   * 10 minutes. Desktop callers poll `mobile_connected` to detect when a
+   * mobile device has scanned the QR and attached.
    *
    * @param token - The session token returned by `createEventBasedFaceVerificationSession`.
    */
@@ -789,12 +866,12 @@ var KycClient = class extends BaseClient {
    * console.log(`Verification submitted: ${result.reference}`);
    * ```
    */
-  async submitVerification(request) {
+  async submitVerification(request, requestOptions) {
     return this.requestWithRetry("/api/v1/kyc/submit", {
       method: "POST",
       body: JSON.stringify(request),
       headers: this.getUserHeaders()
-    });
+    }, void 0, void 0, requestOptions);
   }
   /**
    * Get a KYC request by ID
@@ -1204,7 +1281,10 @@ var KYC_DECLINED_DESCRIPTIONS = {
   KYC_PROVIDER_REJECTED: "Identity verification was rejected by the verification provider",
   KYC_DECLINED: "Identity verification was declined"
 };
+function isKycDocumentExpiredCallbackEvent(value) {
+  return typeof value === "object" && value !== null && value.event === "kyc_document_expired";
+}
 
-export { KYC_DECLINED_DESCRIPTIONS, KycClient };
+export { KYC_DECLINED_DESCRIPTIONS, KycClient, isKycDocumentExpiredCallbackEvent };
 //# sourceMappingURL=core.mjs.map
 //# sourceMappingURL=core.mjs.map