vesant-sdk 1.7.2 → 1.8.0-dev.2b9e28d

package/dist/tax/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/auth.ts","../../src/core/errors.ts","../../src/core/circuit-breaker.ts","../../src/core/rate-limiter.ts","../../src/core/logger.ts","../../src/core/version.ts","../../src/shared/browser-utils.ts","../../src/core/client.ts","../../src/tax/client.ts"],"names":[],"mappings":";AAmCO,IAAM,uBAAN,MAAoD;AAAA,EACzD,YAA6B,MAAA,EAAgB;AAAhB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAAiB;AAAA,EAE9C,MAAM,aAAA,GAAgD;AACpD,IAAA,OAAO,IAAA,CAAK,SAAS,EAAE,MAAA,EAAQ,UAAU,KAAA,EAAO,IAAA,CAAK,QAAO,GAAI,IAAA;AAAA,EAClE;AAAA,EAEA,UAAA,GAAsB;AACpB,IAAA,OAAO,KAAA;AAAA,EACT;AACF,CAAA;;;ACtCO,IAAM,WAAA,GAAN,MAAM,YAAA,SAAoB,KAAA,CAAM;AAAA,EAGrC,WAAA,CACE,OAAA,EACO,IAAA,EACA,UAAA,EACA,OAAA,EACP;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AAJN,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAGP,IAAA,IAAA,CAAK,IAAA,GAAO,aAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,YAAA,CAAY,SAAS,CAAA;AAAA,EACnD;AACF,CAAA;AAOO,IAAM,YAAA,GAAN,MAAM,aAAA,SAAqB,WAAA,CAAY;AAAA,EAC5C,WAAA,CAAY,SAAwB,aAAA,EAAyB;AAC3D,IAAA,KAAA,CAAM,SAAS,eAAe,CAAA;AADI,IAAA,IAAA,CAAA,aAAA,GAAA,aAAA;AAElC,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,aAAA,CAAa,SAAS,CAAA;AAAA,EACpD;AACF,CAAA;AAEO,IAAM,eAAA,GAAN,MAAM,gBAAA,SAAwB,WAAA,CAAY;AAAA,EAC/C,WAAA,CAAY,SAAiB,MAAA,EAAmB;AAC9C,IAAA,KAAA,CAAM,OAAA,EAAS,kBAAA,EAAoB,GAAA,EAAK,EAAE,QAAQ,CAAA;AAClD,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,gBAAA,CAAgB,SAAS,CAAA;AAAA,EACvD;AACF,CAAA;AAEO,IAAM,uBAAA,GAAN,MAAM,wBAAA,SAAgC,WAAA,CAAY;AAAA,EACvD,WAAA,CAAY,UAAkB,qBAAA,EAAuB;AACnD,IAAA,KAAA,CAAM,OAAA,EAAS,uBAAuB,GAAG,CAAA;AACzC,IAAA,IAAA,CAAK,IAAA,GAAO,yBAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,wBAAA,CAAwB,SAAS,CAAA;AAAA,EAC/D;AACF,CAAA;AAUO,IAAM,mBAAA,GAAN,MAAM,oBAAA,SAA4B,WAAA,CAAY;AAAA,EACnD,WAAA,CAAY,UAAkB,uBAAA,EAAyB;AACrD,IAAA,KAAA,CAAM,OAAA,EAAS,wBAAwB,GAAG,CAAA;AAC1C,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,oBAAA,CAAoB,SAAS,CAAA;AAAA,EAC3D;AACF,CAAA;AAEO,IAAM,cAAA,GAAN,MAAM,eAAA,SAAuB,WAAA,CAAY;AAAA,EAC9C,YAAmB,UAAA,EAAqB;AACtC,IAAA,KAAA,CAAM,qBAAA,EAAuB,qBAAA,EAAuB,GAAA,EAAK,EAAE,YAAY,CAAA;AADtD,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AAEjB,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,eAAA,CAAe,SAAS,CAAA;AAAA,EACtD;AACF,CAAA;AAEO,IAAM,YAAA,GAAN,MAAM,aAAA,SAAqB,WAAA,CAAY;AAAA,EAC5C,YAAmB,OAAA,EAAiB;AAClC,IAAA,KAAA,CAAM,yBAAyB,OAAO,CAAA,EAAA,CAAA,EAAM,WAAW,GAAA,EAAK,EAAE,SAAS,CAAA;AADtD,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAEjB,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,aAAA,CAAa,SAAS,CAAA;AAAA,EACpD;AACF,CAAA;AAcO,IAAM,uBAAA,GAAN,MAAM,wBAAA,SAAgC,WAAA,CAAY;AAAA,EACvD,WAAA,GAAc;AACZ,IAAA,KAAA,CAAM,iEAAA,EAA8D,wBAAwB,GAAG,CAAA;AAC/F,IAAA,IAAA,CAAK,IAAA,GAAO,yBAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,wBAAA,CAAwB,SAAS,CAAA;AAAA,EAC/D;AACF,CAAA;;;AC5EO,IAAM,iBAAN,MAAqB;AAAA,EAU1B,WAAA,CAAY,MAAA,GAA+B,EAAC,EAAG;AAT/C,IAAA,IAAA,CAAQ,KAAA,GAA6B,QAAA;AACrC,IAAA,IAAA,CAAQ,QAAA,GAAW,CAAA;AACnB,IAAA,IAAA,CAAQ,SAAA,GAAY,CAAA;AACpB,IAAA,IAAA,CAAQ,eAAA,GAAiC,IAAA;AAOvC,IAAA,IAAA,CAAK,gBAAA,GAAmB,OAAO,gBAAA,IAAoB,CAAA;AACnD,IAAA,IAAA,CAAK,YAAA,GAAe,OAAO,YAAA,IAAgB,GAAA;AAC3C,IAAA,IAAA,CAAK,gBAAA,GAAmB,OAAO,gBAAA,IAAoB,CAAA;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA,EAKA,UAAA,GAAsB;AACpB,IAAA,IAAI,IAAA,CAAK,UAAU,QAAA,EAAU;AAC3B,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,IAAI,IAAA,CAAK,UAAU,MAAA,EAAQ;AACzB,MAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,MAAA,IAAI,KAAK,eAAA,IAAmB,GAAA,GAAM,IAAA,CAAK,eAAA,IAAmB,KAAK,YAAA,EAAc;AAC3E,QAAA,IAAA,CAAK,KAAA,GAAQ,WAAA;AACb,QAAA,IAAA,CAAK,SAAA,GAAY,CAAA;AACjB,QAAA,OAAO,IAAA;AAAA,MACT;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAGA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,SAAA,GAAkB;AAChB,IAAA,IAAI,IAAA,CAAK,UAAU,WAAA,EAAa;AAC9B,MAAA,IAAA,CAAK,SAAA,EAAA;AACL,MAAA,IAAI,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,gBAAA,EAAkB;AAC3C,QAAA,IAAA,CAAK,KAAA,GAAQ,QAAA;AACb,QAAA,IAAA,CAAK,QAAA,GAAW,CAAA;AAChB,QAAA,IAAA,CAAK,SAAA,GAAY,CAAA;AACjB,QAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AAAA,MACzB;AAAA,IACF,CAAA,MAAA,IAAW,IAAA,CAAK,KAAA,KAAU,QAAA,EAAU;AAClC,MAAA,IAAA,CAAK,QAAA,GAAW,CAAA;AAAA,IAClB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,SAAA,GAAkB;AAChB,IAAA,IAAA,CAAK,QAAA,EAAA;AACL,IAAA,IAAA,CAAK,eAAA,GAAkB,KAAK,GAAA,EAAI;AAEhC,IAAA,IAAI,IAAA,CAAK,UAAU,WAAA,EAAa;AAC9B,MAAA,IAAA,CAAK,KAAA,GAAQ,MAAA;AACb,MAAA,IAAA,CAAK,SAAA,GAAY,CAAA;AAAA,IACnB,WAAW,IAAA,CAAK,KAAA,KAAU,YAAY,IAAA,CAAK,QAAA,IAAY,KAAK,gBAAA,EAAkB;AAC5E,MAAA,IAAA,CAAK,KAAA,GAAQ,MAAA;AAAA,IACf;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,SAAA,GAAkC;AAChC,IAAA,OAAO;AAAA,MACL,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,iBAAiB,IAAA,CAAK,eAAA;AAAA,MACtB,aAAA,EACE,KAAK,KAAA,KAAU,MAAA,IAAU,KAAK,eAAA,GAC1B,IAAA,CAAK,eAAA,GAAkB,IAAA,CAAK,YAAA,GAC5B;AAAA,KACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,KAAA,GAAQ,QAAA;AACb,IAAA,IAAA,CAAK,QAAA,GAAW,CAAA;AAChB,IAAA,IAAA,CAAK,SAAA,GAAY,CAAA;AACjB,IAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AAAA,EACzB;AACF,CAAA;;;ACtGO,IAAM,mBAAN,MAAuB;AAAA,EAAvB,WAAA,GAAA;AACL,IAAA,IAAA,CAAQ,KAAA,GAAuB,IAAA;AAC/B,IAAA,IAAA,CAAQ,SAAA,GAA2B,IAAA;AACnC,IAAA,IAAA,CAAQ,KAAA,GAAuB,IAAA;AAC/B,IAAA,IAAA,CAAQ,UAAA,GAA4B,IAAA;AAAA,EAAA;AAAA;AAAA;AAAA;AAAA,EAKpC,kBAAkB,OAAA,EAAwB;AACxC,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,mBAAmB,CAAA;AAC7C,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,GAAA,CAAI,uBAAuB,CAAA;AACrD,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,mBAAmB,CAAA;AAC7C,IAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AAE5C,IAAA,IAAI,UAAU,IAAA,EAAM,IAAA,CAAK,KAAA,GAAQ,QAAA,CAAS,OAAO,EAAE,CAAA;AACnD,IAAA,IAAI,cAAc,IAAA,EAAM,IAAA,CAAK,SAAA,GAAY,QAAA,CAAS,WAAW,EAAE,CAAA;AAC/D,IAAA,IAAI,UAAU,IAAA,EAAM,IAAA,CAAK,KAAA,GAAQ,QAAA,CAAS,OAAO,EAAE,CAAA;AACnD,IAAA,IAAI,eAAe,IAAA,EAAM,IAAA,CAAK,UAAA,GAAa,QAAA,CAAS,YAAY,EAAE,CAAA;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA,EAKA,eAAA,GAA2B;AACzB,IAAA,IAAI,IAAA,CAAK,SAAA,KAAc,IAAA,IAAQ,IAAA,CAAK,aAAa,CAAA,EAAG;AAElD,MAAA,IAAI,IAAA,CAAK,UAAU,IAAA,EAAM;AACvB,QAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,QAAA,IAAI,GAAA,IAAO,KAAK,KAAA,EAAO;AAErB,UAAA,IAAA,CAAK,SAAA,GAAY,IAAA;AACjB,UAAA,IAAA,CAAK,KAAA,GAAQ,IAAA;AACb,UAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,UAAA,OAAO,KAAA;AAAA,QACT;AAAA,MACF;AACA,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,SAAA,GAA6B;AAC3B,IAAA,OAAO;AAAA,MACL,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,YAAY,IAAA,CAAK;AAAA,KACnB;AAAA,EACF;AACF,CAAA;;;ACrEO,SAAS,mBAAA,GAA8B;AAC5C,EAAA,OAAO;AAAA,IACL,KAAA,CAAM,SAAiB,IAAA,EAAgC;AACrD,MAAA,OAAA,CAAQ,IAAI,CAAA,aAAA,EAAgB,OAAO,IAAI,IAAA,KAAS,MAAA,GAAY,OAAO,EAAE,CAAA;AAAA,IACvE,CAAA;AAAA,IACA,IAAA,CAAK,SAAiB,IAAA,EAAgC;AACpD,MAAA,OAAA,CAAQ,KAAK,CAAA,aAAA,EAAgB,OAAO,IAAI,IAAA,KAAS,MAAA,GAAY,OAAO,EAAE,CAAA;AAAA,IACxE,CAAA;AAAA,IACA,IAAA,CAAK,SAAiB,IAAA,EAAgC;AACpD,MAAA,OAAA,CAAQ,KAAK,CAAA,aAAA,EAAgB,OAAO,IAAI,IAAA,KAAS,MAAA,GAAY,OAAO,EAAE,CAAA;AAAA,IACxE,CAAA;AAAA,IACA,KAAA,CAAM,SAAiB,IAAA,EAAgC;AACrD,MAAA,OAAA,CAAQ,MAAM,CAAA,aAAA,EAAgB,OAAO,IAAI,IAAA,KAAS,MAAA,GAAY,OAAO,EAAE,CAAA;AAAA,IACzE;AAAA,GACF;AACF;;;ACdO,IAAM,WAAA,GAAc,OAAA;;;ACOpB,SAAS,YAAA,GAAuB;AACrC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,MAAA,CAAO,UAAA,EAAY;AACtD,IAAA,OAAO,OAAO,UAAA,EAAW;AAAA,EAC3B;AAGA,EAAA,OAAO,sCAAA,CAAuC,OAAA,CAAQ,OAAA,EAAS,CAAC,CAAA,KAAM;AACpE,IAAA,MAAM,CAAA,GAAK,IAAA,CAAK,MAAA,EAAO,GAAI,EAAA,GAAM,CAAA;AACjC,IAAA,MAAM,CAAA,GAAI,CAAA,KAAM,GAAA,GAAM,CAAA,GAAK,IAAI,CAAA,GAAO,CAAA;AACtC,IAAA,OAAO,CAAA,CAAE,SAAS,EAAE,CAAA;AAAA,EACtB,CAAC,CAAA;AACH;;;ACQO,IAAe,aAAf,MAA0B;AAAA,EAQ/B,YAAY,MAAA,EAA0B;AAJtC,IAAA,IAAA,CAAQ,cAAA,GAAwC,IAAA;AAChD,IAAA,IAAA,CAAQ,gBAAA,GAA4C,IAAA;AAIlD,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,IAAA,EAAK,EAAG;AAC3B,MAAA,MAAM,IAAI,eAAA,CAAgB,oDAAA,EAAsD,CAAC,SAAS,CAAC,CAAA;AAAA,IAC7F;AACA,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,EAAU,IAAA,EAAK,EAAG;AAC5B,MAAA,MAAM,IAAI,eAAA,CAAgB,qDAAA,EAAuD,CAAC,UAAU,CAAC,CAAA;AAAA,IAC/F;AAIA,IAAA,IAAI,OAAO,UAAU,WAAA,EAAa;AAChC,MAAA,MAAM,IAAI,WAAA;AAAA,QACR,mGAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,YAAA,GAAe,MAAA,CAAO,YAAA,IAAgB,EAAC;AAC5C,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA,CAAO,MAAA,IAAU,mBAAA,EAAoB;AAGnD,IAAA,IAAI,cAAc,MAAA,CAAO,WAAA;AACzB,IAAA,MAAM,MAAA,GAAS,OAAO,MAAA,IAAU,EAAA;AAChC,IAAA,IAAI,MAAA,CAAO,UAAA,CAAW,UAAU,CAAA,EAAG;AACjC,MAAA,IAAI,gBAAgB,YAAA,EAAc;AAChC,QAAA,IAAA,CAAK,MAAA,CAAO,KAAK,gGAA2F,CAAA;AAAA,MAC9G;AACA,MAAA,WAAA,GAAc,SAAA;AAAA,IAChB,WAAW,MAAA,CAAO,UAAA,CAAW,UAAU,CAAA,IAAK,gBAAgB,SAAA,EAAW;AACrE,MAAA,IAAA,CAAK,MAAA,CAAO,KAAK,2IAAsI,CAAA;AAAA,IACzJ;AAEA,IAAA,IAAA,CAAK,MAAA,GAAS;AAAA,MACZ,GAAG,MAAA;AAAA,MACH,MAAA;AAAA,MACA,WAAA;AAAA,MACA,OAAA,EAAS,MAAA,CAAO,OAAA,IAAW,EAAC;AAAA,MAC5B,OAAA,EAAS,OAAO,OAAA,IAAW,GAAA;AAAA,MAC3B,OAAA,EAAS,OAAO,OAAA,IAAW,CAAA;AAAA,MAC3B,KAAA,EAAO,OAAO,KAAA,IAAS,KAAA;AAAA,MACvB,cAAc,IAAA,CAAK,YAAA;AAAA,MACnB,QAAQ,IAAA,CAAK;AAAA,KACf;AAIA,IAAA,IAAA,CAAK,eAAe,MAAA,CAAO,YAAA,KAAiB,SAAS,IAAI,oBAAA,CAAqB,MAAM,CAAA,GAAI,MAAA,CAAA;AAExF,IAAA,IAAI,OAAO,cAAA,EAAgB;AACzB,MAAA,IAAA,CAAK,cAAA,GAAiB,IAAI,cAAA,CAAe,MAAA,CAAO,cAAc,CAAA;AAAA,IAChE;AACA,IAAA,IAAI,OAAO,uBAAA,EAAyB;AAClC,MAAA,IAAA,CAAK,gBAAA,GAAmB,IAAI,gBAAA,EAAiB;AAAA,IAC/C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,qBAAA,CAAsB,QAAgB,cAAA,EAAqD;AACjG,IAAA,MAAM,UAAA,GAAa,CAAC,MAAA,EAAQ,KAAA,EAAO,OAAO,EAAE,QAAA,CAAA,CAAU,MAAA,IAAU,KAAA,EAAO,WAAA,EAAa,CAAA;AACpF,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,OAAO,cAAA,EAAgB,kBAAkB,YAAA,EAAa;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAgB,OAAA,CACd,QAAA,EACA,UAAuB,EAAC,EACxB,YACA,cAAA,EACY;AACZ,IAAA,MAAM,YAAY,YAAA,EAAa;AAG/B,IAAA,IAAI,KAAK,cAAA,IAAkB,CAAC,IAAA,CAAK,cAAA,CAAe,YAAW,EAAG;AAC5D,MAAA,MAAM,KAAA,GAAQ,IAAI,uBAAA,EAAwB;AAC1C,MAAA,KAAA,CAAM,SAAA,GAAY,SAAA;AAClB,MAAA,MAAM,KAAA;AAAA,IACR;AAGA,IAAA,IAAI,IAAA,CAAK,gBAAA,IAAoB,IAAA,CAAK,gBAAA,CAAiB,iBAAgB,EAAG;AACpE,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,gBAAA,CAAiB,SAAA,EAAU;AAC/C,MAAA,MAAM,KAAA,GAAQ,IAAI,cAAA,CAAe,MAAA,CAAO,cAAc,MAAS,CAAA;AAC/D,MAAA,KAAA,CAAM,SAAA,GAAY,SAAA;AAClB,MAAA,MAAM,KAAA;AAAA,IACR;AAEA,IAAA,MAAM,MAAM,CAAA,EAAG,UAAA,IAAc,KAAK,MAAA,CAAO,OAAO,GAAG,QAAQ,CAAA,CAAA;AAE3D,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,cAAA,EAAgB,kBAAA;AAAA,MAChB,aAAA,EAAe,KAAK,MAAA,CAAO,QAAA;AAAA,MAC3B,eAAA,EAAiB,iBAAiB,WAAW,CAAA,CAAA;AAAA,MAC7C,cAAA,EAAgB,SAAA;AAAA,MAChB,GAAG,KAAK,MAAA,CAAO,OAAA;AAAA,MACf,GAAK,OAAA,CAAQ,OAAA,IAAsC;AAAC,KACtD;AAIA,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,YAAA,EAAc,aAAA,CAAc;AAAA,MACxD,QAAA,EAAU,KAAK,MAAA,CAAO,QAAA;AAAA,MACtB;AAAA,KACD,CAAA;AACD,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,OAAA,CAAQ,eAAe,IAAI,CAAA,EAAG,UAAA,CAAW,UAAU,QAAQ,CAAA,CAAA,EAAI,WAAW,KAAK,CAAA,CAAA;AAAA,IACjF;AAGA,IAAA,IAAI,IAAA,CAAK,MAAA,CAAO,WAAA,KAAgB,SAAA,EAAW;AACzC,MAAA,OAAA,CAAQ,WAAW,CAAA,GAAI,MAAA;AAAA,IACzB;AAKA,IAAA,MAAM,MAAA,GAAA,CAAU,OAAA,CAAQ,MAAA,IAAU,KAAA,EAAO,WAAA,EAAY;AACrD,IAAA,MAAM,cAAA,GAAiB,IAAA,CAAK,qBAAA,CAAsB,MAAA,EAAQ,cAAc,CAAA;AACxE,IAAA,IAAI,cAAA,EAAgB;AAClB,MAAA,OAAA,CAAQ,iBAAiB,CAAA,GAAI,cAAA;AAAA,IAC/B;AAEA,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,SAAA,GAAY,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,CAAK,OAAO,OAAO,CAAA;AAG1E,IAAA,IAAI,gBAAgB,MAAA,EAAQ;AAC1B,MAAA,IAAI,cAAA,CAAe,OAAO,OAAA,EAAS;AACjC,QAAA,UAAA,CAAW,KAAA,EAAM;AAAA,MACnB,CAAA,MAAO;AACL,QAAA,cAAA,CAAe,MAAA,CAAO,gBAAA,CAAiB,OAAA,EAAS,MAAM,UAAA,CAAW,OAAM,EAAG,EAAE,IAAA,EAAM,IAAA,EAAM,CAAA;AAAA,MAC1F;AAAA,IACF;AAEA,IAAA,IAAI;AAEF,MAAA,IAAI,YAAA,GAA4B,EAAE,GAAG,OAAA,EAAS,OAAA,EAAQ;AACtD,MAAA,KAAA,MAAW,WAAA,IAAe,KAAK,YAAA,EAAc;AAC3C,QAAA,IAAI,YAAY,SAAA,EAAW;AACzB,UAAA,YAAA,GAAe,MAAM,WAAA,CAAY,SAAA,CAAU,GAAA,EAAK,YAAY,CAAA;AAAA,QAC9D;AAAA,MACF;AAEA,MAAA,IAAI,IAAA,CAAK,OAAO,KAAA,EAAO;AACrB,QAAA,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA,EAAG,YAAA,CAAa,UAAU,KAAK,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAE,CAAA;AAAA,MACjE;AAEA,MAAA,IAAI,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,QAC9B,GAAG,YAAA;AAAA,QACH,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAKD,MAAA,IAAI,SAAS,MAAA,KAAW,GAAA,IAAO,IAAA,CAAK,YAAA,EAAc,cAAa,EAAG;AAChE,QAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,YAAA,CAAa,aAAA,CAAc;AAAA,UACtD,QAAA,EAAU,KAAK,MAAA,CAAO,QAAA;AAAA,UACtB,SAAA;AAAA,UACA,YAAA,EAAc;AAAA,SACf,CAAA;AACD,QAAA,IAAI,SAAA,EAAW;AACb,UAAA,IAAA,CAAK,MAAA,CAAO,mBAAA,GAAsB,EAAE,MAAA,EAAQ,gBAAgB,CAAA;AAC5D,UAAA,YAAA,GAAe;AAAA,YACb,GAAG,YAAA;AAAA,YACH,OAAA,EAAS;AAAA,cACP,GAAI,YAAA,CAAa,OAAA;AAAA,cACjB,eAAe,CAAA,EAAG,SAAA,CAAU,UAAU,QAAQ,CAAA,CAAA,EAAI,UAAU,KAAK,CAAA;AAAA;AACnE,WACF;AACA,UAAA,QAAA,GAAW,MAAM,MAAM,GAAA,EAAK,EAAE,GAAG,YAAA,EAAc,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AAAA,QAC5E;AAAA,MACF;AAEA,MAAA,YAAA,CAAa,SAAS,CAAA;AAGtB,MAAA,IAAI,KAAK,gBAAA,EAAkB;AACzB,QAAA,IAAA,CAAK,gBAAA,CAAiB,iBAAA,CAAkB,QAAA,CAAS,OAAO,CAAA;AAAA,MAC1D;AAGA,MAAA,IAAI,cAAA,EAAgB,iBAAiB,aAAA,EAAe;AAClD,QAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,UAAA,IAAI,UAAmC,EAAC;AACxC,UAAA,IAAI;AAAE,YAAA,OAAA,GAAU,MAAM,SAAS,IAAA,EAAK;AAAA,UAAG,CAAA,CAAA,MAAQ;AAAA,UAAe;AAC9D,UAAA,IAAA,CAAK,mBAAA,CAAoB,QAAA,CAAS,MAAA,EAAQ,OAAA,EAAS,SAAS,CAAA;AAAA,QAC9D;AACA,QAAA,IAAA,CAAK,gBAAgB,SAAA,EAAU;AAC/B,QAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,WAAA,EAAY;AAC1C,QAAA,OAAO,MAAA;AAAA,MACT;AAEA,MAAA,IAAI,IAAA;AACJ,MAAA,IAAI;AACF,QAAA,IAAA,GAAO,MAAM,SAAS,IAAA,EAAK;AAAA,MAC7B,CAAA,CAAA,MAAQ;AAEN,QAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,UAAA,IAAA,CAAK,mBAAA,CAAoB,SAAS,MAAA,EAAQ;AAAA,YACxC,KAAA,EAAO,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA;AAAA,YAC9B,SAAS,QAAA,CAAS;AAAA,aACjB,SAAS,CAAA;AAAA,QACd;AAEA,QAAA,IAAA,CAAK,gBAAgB,SAAA,EAAU;AAC/B,QAAA,OAAO,KAAA,CAAA;AAAA,MACT;AAEA,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,IAAA,CAAK,oBAAoB,QAAA,CAAS,MAAA,EAAQ,IAAA,IAAQ,IAAI,SAAS,CAAA;AAAA,MACjE;AAGA,MAAA,IAAA,CAAK,gBAAgB,SAAA,EAAU;AAG/B,MAAA,IAAI,MAAA,GAAkB,IAAA;AACtB,MAAA,KAAA,MAAW,WAAA,IAAe,KAAK,YAAA,EAAc;AAC3C,QAAA,IAAI,YAAY,UAAA,EAAY;AAC1B,UAAA,MAAA,GAAS,MAAM,WAAA,CAAY,UAAA,CAAW,GAAA,EAAK,MAAM,CAAA;AAAA,QACnD;AAAA,MACF;AAEA,MAAA,IAAI,IAAA,CAAK,OAAO,KAAA,EAAO;AACrB,QAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,UAAA,EAAa,QAAA,CAAS,MAAM,CAAA,CAAE,CAAA;AAAA,MAClD;AAEA,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,YAAA,CAAa,SAAS,CAAA;AAGtB,MAAA,IACE,iBAAiB,WAAA,IACjB,KAAA,CAAM,UAAA,IACN,KAAA,CAAM,cAAc,GAAA,EACpB;AACA,QAAA,IAAA,CAAK,gBAAgB,SAAA,EAAU;AAAA,MACjC,CAAA,MAAA,IAAW,KAAA,YAAiB,YAAA,IAAgB,KAAA,YAAiB,YAAA,EAAc;AACzE,QAAA,IAAA,CAAK,gBAAgB,SAAA,EAAU;AAAA,MACjC;AAGA,MAAA,IAAI,KAAA,YAAiB,WAAA,IAAe,CAAC,KAAA,CAAM,SAAA,EAAW;AACpD,QAAA,KAAA,CAAM,SAAA,GAAY,SAAA;AAAA,MACpB;AAGA,MAAA,IAAI,iBAAiB,KAAA,EAAO;AAC1B,QAAA,KAAA,MAAW,WAAA,IAAe,KAAK,YAAA,EAAc;AAC3C,UAAA,IAAI,YAAY,OAAA,EAAS;AACvB,YAAA,MAAM,WAAA,CAAY,OAAA,CAAQ,GAAA,EAAK,KAAK,CAAA;AAAA,UACtC;AAAA,QACF;AAAA,MACF;AAEA,MAAA,IAAI,iBAAiB,KAAA,EAAO;AAC1B,QAAA,IAAI,KAAA,CAAM,SAAS,YAAA,EAAc;AAE/B,UAAA,IAAI,cAAA,EAAgB,QAAQ,OAAA,EAAS;AACnC,YAAA,MAAM,UAAA,GAAa,IAAI,WAAA,CAAY,iBAAA,EAAmB,iBAAiB,CAAA;AACvE,YAAA,UAAA,CAAW,SAAA,GAAY,SAAA;AACvB,YAAA,MAAM,UAAA;AAAA,UACR;AACA,UAAA,IAAA,CAAK,gBAAgB,SAAA,EAAU;AAC/B,UAAA,MAAM,YAAA,GAAe,IAAI,YAAA,CAAa,IAAA,CAAK,OAAO,OAAO,CAAA;AACzD,UAAA,YAAA,CAAa,SAAA,GAAY,SAAA;AACzB,UAAA,MAAM,YAAA;AAAA,QACR;AACA,QAAA,IAAI,iBAAiB,WAAA,EAAa;AAChC,UAAA,MAAM,KAAA;AAAA,QACR;AAAA,MACF;AAEA,MAAA,MAAM,YAAA,GAAe,IAAI,YAAA,CAAa,wBAAA,EAA0B,KAAK,CAAA;AACrE,MAAA,YAAA,CAAa,SAAA,GAAY,SAAA;AACzB,MAAA,IAAA,CAAK,gBAAgB,SAAA,EAAU;AAC/B,MAAA,MAAM,YAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAgB,gBAAA,CACd,QAAA,EACA,OAAA,GAAuB,EAAC,EACxB,UAAA,EACA,OAAA,GAAkB,IAAA,CAAK,MAAA,CAAO,OAAA,EAC9B,cAAA,EACY;AACZ,IAAA,IAAI,SAAA;AAIJ,IAAA,MAAM,iBAAiB,IAAA,CAAK,qBAAA,CAAsB,OAAA,CAAQ,MAAA,IAAU,OAAO,cAAc,CAAA;AACzF,IAAA,MAAM,iBAA6C,cAAA,GAC/C,EAAE,GAAG,cAAA,EAAgB,gBAAe,GACpC,cAAA;AAEJ,IAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,OAAA,EAAS,OAAA,EAAA,EAAW;AACnD,MAAA,IAAI;AACF,QAAA,OAAO,MAAM,IAAA,CAAK,OAAA,CAAW,QAAA,EAAU,OAAA,EAAS,YAAY,cAAc,CAAA;AAAA,MAC5E,SAAS,KAAA,EAAO;AACd,QAAA,SAAA,GAAY,KAAA,YAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,MAAM,eAAe,CAAA;AAGtE,QAAA,IAAI,cAAA,EAAgB,QAAQ,OAAA,EAAS;AACnC,UAAA,MAAM,SAAA;AAAA,QACR;AAGA,QAAA,IACE,SAAA,YAAqB,WAAA,IACrB,SAAA,CAAU,UAAA,IACV,SAAA,CAAU,UAAA,IAAc,GAAA,IACxB,SAAA,CAAU,UAAA,GAAa,GAAA,IACvB,SAAA,CAAU,UAAA,KAAe,GAAA,EACzB;AACA,UAAA,MAAM,SAAA;AAAA,QACR;AAGA,QAAA,IAAI,YAAY,OAAA,EAAS;AACvB,UAAA;AAAA,QACF;AAGA,QAAA,IAAI,KAAA;AACJ,QAAA,IAAI,SAAA,YAAqB,cAAA,IAAkB,SAAA,CAAU,UAAA,EAAY;AAC/D,UAAA,KAAA,GAAQ,UAAU,UAAA,GAAa,GAAA;AAAA,QACjC,CAAA,MAAO;AACL,UAAA,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,GAAA,GAAO,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,OAAO,CAAA,GAAI,IAAA,CAAK,MAAA,EAAO,GAAI,GAAA,EAAM,GAAK,CAAA;AAAA,QAC5E;AACA,QAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,KAAK,CAAC,CAAA;AAEzD,QAAA,IAAI,IAAA,CAAK,OAAO,KAAA,EAAO;AACrB,UAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,cAAA,EAAiB,OAAA,GAAU,CAAC,CAAA,CAAA,EAAI,OAAO,CAAA,OAAA,EAAU,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAC,CAAA,EAAA,CAAI,CAAA;AAAA,QACzF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,MAAM,IAAI,YAAA,CAAa,CAAA,qBAAA,EAAwB,OAAO,YAAY,SAAS,CAAA;AAAA,EAC7E;AAAA;AAAA;AAAA;AAAA,EAKU,mBAAA,CAAoB,MAAA,EAAgB,IAAA,EAA+B,SAAA,EAA2B;AACtG,IAAA,MAAM,UAAW,IAAA,CAAK,KAAA,IAAqB,IAAA,CAAK,OAAA,IAAsB,QAAQ,MAAM,CAAA,CAAA;AAEpF,IAAA,MAAM,cAAc,MAAmB;AACrC,MAAA,QAAQ,MAAA;AAAQ,QACd,KAAK,GAAA;AACH,UAAA,OAAO,IAAI,WAAA,CAAY,OAAA,EAAS,aAAA,EAAe,GAAG,CAAA;AAAA,QACpD,KAAK,GAAA;AACH,UAAA,OAAO,IAAI,oBAAoB,OAAO,CAAA;AAAA,QACxC,KAAK,GAAA;AACH,UAAA,OAAO,IAAI,WAAA,CAAY,OAAA,EAAS,WAAA,EAAa,GAAG,CAAA;AAAA,QAClD,KAAK,GAAA;AACH,UAAA,OAAO,IAAI,WAAA,CAAY,OAAA,EAAS,WAAA,EAAa,GAAG,CAAA;AAAA,QAClD,KAAK,GAAA;AACH,UAAA,OAAO,IAAI,WAAA,CAAY,OAAA,EAAS,mBAAA,EAAqB,GAAG,CAAA;AAAA,QAC1D,KAAK,GAAA,EAAK;AACR,UAAA,MAAM,UAAA,GAAc,IAAA,CAAK,WAAA,IAAuC,IAAA,CAAK,UAAA;AACrE,UAAA,OAAO,IAAI,eAAe,UAAU,CAAA;AAAA,QACtC;AAAA,QACA,KAAK,GAAA;AAAA,QACL,KAAK,GAAA;AAAA,QACL,KAAK,GAAA;AAAA,QACL,KAAK,GAAA;AACH,UAAA,OAAO,IAAI,wBAAwB,OAAO,CAAA;AAAA,QAC5C;AACE,UAAA,OAAO,IAAI,WAAA,CAAY,OAAA,EAAS,eAAA,EAAiB,MAAM,CAAA;AAAA;AAC3D,IACF,CAAA;AAEA,IAAA,MAAM,QAAQ,WAAA,EAAY;AAC1B,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,KAAA,CAAM,SAAA,GAAY,SAAA;AAAA,IACpB;AACA,IAAA,MAAM,KAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA,EAKU,iBAAiB,MAAA,EAAyC;AAClE,IAAA,MAAM,KAAA,GAAQ,IAAI,eAAA,EAAgB;AAElC,IAAA,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,OAAA,CAAQ,CAAC,CAAC,GAAA,EAAK,KAAK,CAAA,KAAM;AAC/C,MAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAAM;AACzC,QAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,UAAA,KAAA,CAAM,OAAA,CAAQ,CAAC,IAAA,KAAS,KAAA,CAAM,OAAO,GAAA,EAAK,MAAA,CAAO,IAAI,CAAC,CAAC,CAAA;AAAA,QACzD,CAAA,MAAO;AACL,UAAA,KAAA,CAAM,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,QACjC;AAAA,MACF;AAAA,IACF,CAAC,CAAA;AAED,IAAA,MAAM,WAAA,GAAc,MAAM,QAAA,EAAS;AACnC,IAAA,OAAO,WAAA,GAAc,CAAA,CAAA,EAAI,WAAW,CAAA,CAAA,GAAK,EAAA;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa,MAAA,EAAyC;AACpD,IAAA,IAAA,CAAK,MAAA,GAAS;AAAA,MACZ,GAAG,IAAA,CAAK,MAAA;AAAA,MACR,GAAG,MAAA;AAAA,MACH,OAAA,EAAS;AAAA,QACP,GAAG,KAAK,MAAA,CAAO,OAAA;AAAA,QACf,GAAI,MAAA,CAAO,OAAA,IAAW;AAAC;AACzB,KACF;AACA,IAAA,IAAI,OAAO,MAAA,EAAQ;AACjB,MAAA,IAAA,CAAK,SAAS,MAAA,CAAO,MAAA;AAAA,IACvB;AACA,IAAA,IAAI,OAAO,YAAA,EAAc;AACvB,MAAA,IAAA,CAAK,eAAe,MAAA,CAAO,YAAA;AAAA,IAC7B;AAGA,IAAA,IAAI,MAAA,CAAO,YAAA,KAAiB,MAAA,IAAa,MAAA,CAAO,WAAW,MAAA,EAAW;AACpE,MAAA,IAAA,CAAK,YAAA,GACH,IAAA,CAAK,MAAA,CAAO,YAAA,KACX,IAAA,CAAK,MAAA,CAAO,MAAA,GAAS,IAAI,oBAAA,CAAqB,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA,GAAI,MAAA,CAAA;AAAA,IACzE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,SAAA,GAAwC;AACtC,IAAA,OAAO,EAAE,GAAG,IAAA,CAAK,MAAA,EAAO;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,kBAAA,GAA6C;AAC3C,IAAA,OAAO,IAAA,CAAK,gBAAA,EAAkB,SAAA,EAAU,IAAK,IAAA;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA,EAKA,uBAAA,GAAuD;AACrD,IAAA,OAAO,IAAA,CAAK,cAAA,EAAgB,SAAA,EAAU,IAAK,IAAA;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,WAAA,GAA8D;AAClE,IAAA,OAAO,IAAA,CAAK,QAAQ,gBAAgB,CAAA;AAAA,EACtC;AACF,CAAA;;;ACpeO,IAAM,SAAA,GAAN,cAAwB,UAAA,CAAW;AAAA,EACxC,YAAY,MAAA,EAAyB;AACnC,IAAA,MAAM,UAAA,GAA+B;AAAA,MACnC,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,OAAA,EAAS,CAAA;AAAA,MACT,OAAO,MAAA,CAAO,KAAA;AAAA,MACd,aAAa,MAAA,CAAO;AAAA,KACtB;AACA,IAAA,KAAA,CAAM,UAAU,CAAA;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,4BAA4B,UAAA,EAAuD;AACvF,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,MACV,qCAAqC,UAAU,CAAA;AAAA,KACjD;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,UAAA,EAAuD;AAC1E,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,MACV,qCAAqC,UAAU,CAAA,aAAA,CAAA;AAAA,MAC/C,EAAE,QAAQ,MAAA;AAAO,KACnB;AAAA,EACF;AAAA,EAEA,MAAM,cAAA,CAAe,UAAA,EAAoB,cAAA,EAA0D;AACjG,IAAA,OAAO,IAAA,CAAK,gBAAA;AAAA,MACV,qCAAqC,UAAU,CAAA,UAAA,CAAA;AAAA,MAC/C,EAAE,QAAQ,MAAA,EAAO;AAAA,MACjB,MAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAA,CACJ,UAAA,EACA,KAAA,EACmC;AACnC,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,MACV,qCAAqC,UAAU,CAAA,gBAAA,CAAA;AAAA,MAC/C;AAAA,QACE,MAAA,EAAQ,MAAA;AAAA,QACR,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,KAAK;AAAA;AAC5B,KACF;AAAA,EACF;AAAA,EAEA,MAAM,uBAAA,CACJ,UAAA,EACA,KAAA,EACoC;AACpC,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,MACV,qCAAqC,UAAU,CAAA,mBAAA,CAAA;AAAA,MAC/C;AAAA,QACE,MAAA,EAAQ,MAAA;AAAA,QACR,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,KAAK;AAAA;AAC5B,KACF;AAAA,EACF;AAAA,EAEC,MAAM,qBAAqB,UAAA,EAA0D;AACpF,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,MACV,oCAAoC,UAAU,CAAA,UAAA;AAAA,KAChD;AAAA,EACF;AAAA,EAEA,MAAM,eAAA,CACJ,UAAA,EACA,cAAA,EACsB;AACtB,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,MACV,qCAAqC,UAAU,CAAA,cAAA,CAAA;AAAA,MAC/C,EAAE,QAAQ,KAAA,EAAM;AAAA,MAChB,MAAA;AAAA,MACA,EAAE,GAAG,cAAA,EAAgB,YAAA,EAAc,aAAA;AAAc,KACnD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAA,GAAiC;AACrC,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA,CAA6B,mBAAmB,CAAA;AACvE,IAAA,OAAO,GAAA,CAAI,KAAA;AAAA,EACb;AAAA,EAEA,MAAM,eAAe,KAAA,EAAqD;AACxE,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA,CAAqC,mBAAA,EAAqB;AAAA,MAC/E,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,OAAO;AAAA,KACtC,CAAA;AACD,IAAA,OAAO,GAAA,CAAI,OAAA;AAAA,EACb;AAAA,EAEA,MAAM,YAAA,GAA4C;AAChD,IAAA,OAAO,KAAK,OAAA,CAA4B,2BAAA,EAA6B,EAAE,MAAA,EAAQ,QAAQ,CAAA;AAAA,EACzF;AAAA,EAEA,MAAM,mBAAmB,OAAA,EAA4D;AACnF,IAAA,MAAM,SAAkC,EAAC;AACzC,IAAA,IAAI,OAAA,EAAS,UAAA,EAAY,MAAA,CAAO,UAAA,GAAa,OAAA,CAAQ,UAAA;AACrD,IAAA,IAAI,OAAA,EAAS,SAAA,EAAW,MAAA,CAAO,SAAA,GAAY,OAAA,CAAQ,SAAA;AACnD,IAAA,IAAI,OAAA,EAAS,OAAA,EAAS,MAAA,CAAO,OAAA,GAAU,OAAA,CAAQ,OAAA;AAC/C,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,MACV,CAAA,sCAAA,EAAyC,IAAA,CAAK,gBAAA,CAAiB,MAAM,CAAC,CAAA;AAAA,KACxE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,uBAAA,GAAkD;AACtD,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA;AAAA,MACrB;AAAA,KACF;AACA,IAAA,OAAO,GAAA,CAAI,IAAA;AAAA,EACb;AAAA,EAEA,MAAM,mBAAA,GAA0D;AAC9D,IAAA,OAAO,IAAA,CAAK,QAAmC,8BAA8B,CAAA;AAAA,EAC/E;AAAA,EAEA,MAAM,iBAAiB,IAAA,EAAsC;AAC3D,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA;AAAA,MACrB,CAAA,6BAAA,EAAgC,kBAAA,CAAmB,IAAI,CAAC,CAAA;AAAA,KAC1D;AACA,IAAA,OAAO,GAAA,CAAI,cAAA;AAAA,EACb;AACF","file":"index.mjs","sourcesContent":["/**\n * Pluggable authentication for BaseClient.\n *\n * A TokenProvider supplies the credential used for the Authorization header on\n * every request, resolved per-request (async) so callers can source short-lived\n * or rotating credentials (OAuth2 client-credentials, STS, Vault / Secrets\n * Manager) instead of a single static API key. The default StaticApiKeyProvider\n * preserves the original `apiKey` behavior with zero change for existing callers.\n */\n\nexport interface AuthCredential {\n  /** Authorization scheme (e.g. 'Bearer'); defaults to 'Bearer' when omitted. */\n  scheme?: string;\n  /** The credential value (bearer token / API key). */\n  token: string;\n}\n\nexport interface TokenProviderContext {\n  tenantId: string;\n  requestId: string;\n  /** When true, bypass any cache and obtain a fresh credential (e.g. after a 401). */\n  forceRefresh?: boolean;\n}\n\nexport interface TokenProvider {\n  /** Resolve the credential for a request, or null to send no Authorization header. */\n  getCredential(ctx: TokenProviderContext): Promise<AuthCredential | null>;\n  /** Whether this provider can obtain a fresh credential on demand (drives 401 retry). */\n  canRefresh?(): boolean;\n}\n\n/**\n * Default provider: wraps a static API key. Returns null when the key is empty\n * so the client sends no Authorization header, matching the pre-provider behavior.\n */\nexport class StaticApiKeyProvider implements TokenProvider {\n  constructor(private readonly apiKey: string) {}\n\n  async getCredential(): Promise<AuthCredential | null> {\n    return this.apiKey ? { scheme: 'Bearer', token: this.apiKey } : null;\n  }\n\n  canRefresh(): boolean {\n    return false;\n  }\n}\n\ninterface CachedToken {\n  token: string;\n  expiresAt?: number;\n}\n\nexport interface RefreshingTokenProviderOptions {\n  /** Fetches a fresh token. `expiresAt` is epoch milliseconds (optional). */\n  fetchToken: () => Promise<CachedToken>;\n  /** Refresh this many ms before expiry (default: 30_000). */\n  skewMs?: number;\n  /** Authorization scheme to emit (default: 'Bearer'). */\n  scheme?: string;\n  /** Observe each successful (re)fetch — for logging / metrics. */\n  onRotate?: (meta: { expiresAt?: number }) => void;\n  /** Injectable clock (default: Date.now). */\n  now?: () => number;\n}\n\n/**\n * Caches a fetched token and refreshes it when it is within the skew window of\n * expiry or when `forceRefresh` is requested. Concurrent refreshes are de-duped\n * into a single in-flight fetch.\n */\nexport class RefreshingTokenProvider implements TokenProvider {\n  private cached: CachedToken | null = null;\n  private inFlight: Promise<CachedToken> | null = null;\n  private readonly skewMs: number;\n  private readonly scheme: string;\n  private readonly now: () => number;\n\n  constructor(private readonly opts: RefreshingTokenProviderOptions) {\n    this.skewMs = opts.skewMs ?? 30_000;\n    this.scheme = opts.scheme ?? 'Bearer';\n    this.now = opts.now ?? (() => Date.now());\n  }\n\n  canRefresh(): boolean {\n    return true;\n  }\n\n  async getCredential(ctx?: TokenProviderContext): Promise<AuthCredential | null> {\n    const forceRefresh = ctx?.forceRefresh ?? false;\n    if (!forceRefresh && this.cached && !this.isExpiring(this.cached)) {\n      return { scheme: this.scheme, token: this.cached.token };\n    }\n    const fresh = await this.refresh();\n    return { scheme: this.scheme, token: fresh.token };\n  }\n\n  private isExpiring(token: CachedToken): boolean {\n    if (token.expiresAt === undefined) {\n      return false;\n    }\n    return this.now() >= token.expiresAt - this.skewMs;\n  }\n\n  private refresh(): Promise<CachedToken> {\n    if (this.inFlight) {\n      return this.inFlight;\n    }\n    this.inFlight = (async () => {\n      try {\n        const fresh = await this.opts.fetchToken();\n        this.cached = fresh;\n        this.opts.onRotate?.({ expiresAt: fresh.expiresAt });\n        return fresh;\n      } finally {\n        this.inFlight = null;\n      }\n    })();\n    return this.inFlight;\n  }\n}\n","/**\n * Error hierarchy for Vesant SDK\n *\n * Provides structured error handling with specific error types\n * for different failure scenarios.\n */\n\nexport class VesantError extends Error {\n  public requestId?: string;\n\n  constructor(\n    message: string,\n    public code: string,\n    public statusCode?: number,\n    public details?: Record<string, unknown>\n  ) {\n    super(message);\n    this.name = 'VesantError';\n    Object.setPrototypeOf(this, VesantError.prototype);\n  }\n}\n\n/** @deprecated Use VesantError instead */\nexport const CGSError = VesantError;\n/** @deprecated Use VesantError instead */\nexport type CGSError = VesantError;\n\nexport class NetworkError extends VesantError {\n  constructor(message: string, public originalError?: unknown) {\n    super(message, 'NETWORK_ERROR');\n    this.name = 'NetworkError';\n    Object.setPrototypeOf(this, NetworkError.prototype);\n  }\n}\n\nexport class ValidationError extends VesantError {\n  constructor(message: string, fields?: string[]) {\n    super(message, 'VALIDATION_ERROR', 400, { fields });\n    this.name = 'ValidationError';\n    Object.setPrototypeOf(this, ValidationError.prototype);\n  }\n}\n\nexport class ServiceUnavailableError extends VesantError {\n  constructor(message: string = 'Service unavailable') {\n    super(message, 'SERVICE_UNAVAILABLE', 503);\n    this.name = 'ServiceUnavailableError';\n    Object.setPrototypeOf(this, ServiceUnavailableError.prototype);\n  }\n}\n\nexport class ComplianceBlockedError extends VesantError {\n  constructor(reasons: string[]) {\n    super('Access blocked due to compliance rules', 'COMPLIANCE_BLOCKED', 403, { reasons });\n    this.name = 'ComplianceBlockedError';\n    Object.setPrototypeOf(this, ComplianceBlockedError.prototype);\n  }\n}\n\nexport class AuthenticationError extends VesantError {\n  constructor(message: string = 'Authentication failed') {\n    super(message, 'AUTHENTICATION_ERROR', 401);\n    this.name = 'AuthenticationError';\n    Object.setPrototypeOf(this, AuthenticationError.prototype);\n  }\n}\n\nexport class RateLimitError extends VesantError {\n  constructor(public retryAfter?: number) {\n    super('Rate limit exceeded', 'RATE_LIMIT_EXCEEDED', 429, { retryAfter });\n    this.name = 'RateLimitError';\n    Object.setPrototypeOf(this, RateLimitError.prototype);\n  }\n}\n\nexport class TimeoutError extends VesantError {\n  constructor(public timeout: number) {\n    super(`Request timeout after ${timeout}ms`, 'TIMEOUT', 408, { timeout });\n    this.name = 'TimeoutError';\n    Object.setPrototypeOf(this, TimeoutError.prototype);\n  }\n}\n\nexport class ComplianceError extends VesantError {\n  constructor(\n    message: string,\n    public originalError?: unknown,\n    code: string = 'COMPLIANCE_ERROR'\n  ) {\n    super(message, code);\n    this.name = 'ComplianceError';\n    Object.setPrototypeOf(this, ComplianceError.prototype);\n  }\n}\n\nexport class CircuitBreakerOpenError extends VesantError {\n  constructor() {\n    super('Circuit breaker is open — requests are temporarily blocked', 'CIRCUIT_BREAKER_OPEN', 503);\n    this.name = 'CircuitBreakerOpenError';\n    Object.setPrototypeOf(this, CircuitBreakerOpenError.prototype);\n  }\n}\n","/**\n * Circuit breaker pattern for resilient HTTP requests.\n *\n * States: closed (normal) -> open (failing) -> half-open (testing) -> closed\n */\n\nexport type CircuitBreakerState = 'closed' | 'open' | 'half-open';\n\nexport interface CircuitBreakerConfig {\n  /** Number of consecutive failures before opening the circuit (default: 5) */\n  failureThreshold?: number;\n  /** Time in ms to wait before transitioning from open to half-open (default: 30000) */\n  resetTimeout?: number;\n  /** Number of successes in half-open state before closing (default: 1) */\n  successThreshold?: number;\n}\n\nexport interface CircuitBreakerStatus {\n  state: CircuitBreakerState;\n  failures: number;\n  successes: number;\n  lastFailureTime: number | null;\n  nextRetryTime: number | null;\n}\n\nexport class CircuitBreaker {\n  private state: CircuitBreakerState = 'closed';\n  private failures = 0;\n  private successes = 0;\n  private lastFailureTime: number | null = null;\n\n  private readonly failureThreshold: number;\n  private readonly resetTimeout: number;\n  private readonly successThreshold: number;\n\n  constructor(config: CircuitBreakerConfig = {}) {\n    this.failureThreshold = config.failureThreshold ?? 5;\n    this.resetTimeout = config.resetTimeout ?? 30000;\n    this.successThreshold = config.successThreshold ?? 1;\n  }\n\n  /**\n   * Check if a request can proceed through the circuit breaker.\n   */\n  canExecute(): boolean {\n    if (this.state === 'closed') {\n      return true;\n    }\n\n    if (this.state === 'open') {\n      const now = Date.now();\n      if (this.lastFailureTime && now - this.lastFailureTime >= this.resetTimeout) {\n        this.state = 'half-open';\n        this.successes = 0;\n        return true;\n      }\n      return false;\n    }\n\n    // half-open: allow requests through for testing\n    return true;\n  }\n\n  /**\n   * Record a successful request.\n   */\n  onSuccess(): void {\n    if (this.state === 'half-open') {\n      this.successes++;\n      if (this.successes >= this.successThreshold) {\n        this.state = 'closed';\n        this.failures = 0;\n        this.successes = 0;\n        this.lastFailureTime = null;\n      }\n    } else if (this.state === 'closed') {\n      this.failures = 0;\n    }\n  }\n\n  /**\n   * Record a failed request.\n   */\n  onFailure(): void {\n    this.failures++;\n    this.lastFailureTime = Date.now();\n\n    if (this.state === 'half-open') {\n      this.state = 'open';\n      this.successes = 0;\n    } else if (this.state === 'closed' && this.failures >= this.failureThreshold) {\n      this.state = 'open';\n    }\n  }\n\n  /**\n   * Get current circuit breaker status.\n   */\n  getStatus(): CircuitBreakerStatus {\n    return {\n      state: this.state,\n      failures: this.failures,\n      successes: this.successes,\n      lastFailureTime: this.lastFailureTime,\n      nextRetryTime:\n        this.state === 'open' && this.lastFailureTime\n          ? this.lastFailureTime + this.resetTimeout\n          : null,\n    };\n  }\n\n  /**\n   * Reset the circuit breaker to its initial closed state.\n   */\n  reset(): void {\n    this.state = 'closed';\n    this.failures = 0;\n    this.successes = 0;\n    this.lastFailureTime = null;\n  }\n}\n","/**\n * Rate limit tracking from API response headers.\n *\n * Tracks X-RateLimit-* headers to enable pre-flight checks\n * before making requests.\n */\n\nexport interface RateLimitStatus {\n  /** Maximum requests allowed in the window */\n  limit: number | null;\n  /** Remaining requests in the current window */\n  remaining: number | null;\n  /** Unix timestamp (seconds) when the rate limit resets */\n  reset: number | null;\n  /** Seconds until the rate limit resets */\n  retryAfter: number | null;\n}\n\nexport class RateLimitTracker {\n  private limit: number | null = null;\n  private remaining: number | null = null;\n  private reset: number | null = null;\n  private retryAfter: number | null = null;\n\n  /**\n   * Extract rate limit information from response headers.\n   */\n  updateFromHeaders(headers: Headers): void {\n    const limit = headers.get('x-ratelimit-limit');\n    const remaining = headers.get('x-ratelimit-remaining');\n    const reset = headers.get('x-ratelimit-reset');\n    const retryAfter = headers.get('retry-after');\n\n    if (limit !== null) this.limit = parseInt(limit, 10);\n    if (remaining !== null) this.remaining = parseInt(remaining, 10);\n    if (reset !== null) this.reset = parseInt(reset, 10);\n    if (retryAfter !== null) this.retryAfter = parseInt(retryAfter, 10);\n  }\n\n  /**\n   * Check if the rate limit has been exceeded based on tracked headers.\n   */\n  isLimitExceeded(): boolean {\n    if (this.remaining !== null && this.remaining <= 0) {\n      // Check if the reset time has passed\n      if (this.reset !== null) {\n        const now = Math.floor(Date.now() / 1000);\n        if (now >= this.reset) {\n          // Reset window has passed, allow requests\n          this.remaining = null;\n          this.reset = null;\n          this.retryAfter = null;\n          return false;\n        }\n      }\n      return true;\n    }\n    return false;\n  }\n\n  /**\n   * Get current rate limit status.\n   */\n  getStatus(): RateLimitStatus {\n    return {\n      limit: this.limit,\n      remaining: this.remaining,\n      reset: this.reset,\n      retryAfter: this.retryAfter,\n    };\n  }\n}\n","import type { Logger } from './config';\n\nexport function createConsoleLogger(): Logger {\n  return {\n    debug(message: string, meta?: Record<string, unknown>) {\n      console.log(`[Vesant SDK] ${message}`, meta !== undefined ? meta : '');\n    },\n    info(message: string, meta?: Record<string, unknown>) {\n      console.info(`[Vesant SDK] ${message}`, meta !== undefined ? meta : '');\n    },\n    warn(message: string, meta?: Record<string, unknown>) {\n      console.warn(`[Vesant SDK] ${message}`, meta !== undefined ? meta : '');\n    },\n    error(message: string, meta?: Record<string, unknown>) {\n      console.error(`[Vesant SDK] ${message}`, meta !== undefined ? meta : '');\n    },\n  };\n}\n\nexport const noopLogger: Logger = {\n  debug() {},\n  info() {},\n  warn() {},\n  error() {},\n};\n","/**\n * Single source of truth for the SDK version.\n */\nexport const SDK_VERSION = '1.7.2';\n","/**\n * Shared browser utility functions.\n *\n * Extracted from ciphertext.ts and hooks.ts to avoid duplication.\n * All functions include SSR guards for safe server-side rendering.\n */\n\n/**\n * Generate a UUID v4\n */\nexport function generateUUID(): string {\n  if (typeof crypto !== 'undefined' && crypto.randomUUID) {\n    return crypto.randomUUID();\n  }\n\n  // Fallback for older browsers\n  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (c) => {\n    const r = (Math.random() * 16) | 0;\n    const v = c === 'x' ? r : (r & 0x3) | 0x8;\n    return v.toString(16);\n  });\n}\n\n/**\n * Generate a unique device ID that persists across sessions.\n * Falls back to a random UUID when localStorage is unavailable (SSR).\n */\nexport function generateDeviceId(): string {\n  if (typeof window === 'undefined' || typeof localStorage === 'undefined') {\n    return generateUUID();\n  }\n\n  const storageKey = 'vesant_device_id';\n  let deviceId = localStorage.getItem(storageKey);\n\n  if (!deviceId) {\n    deviceId = generateUUID();\n    localStorage.setItem(storageKey, deviceId);\n  }\n\n  return deviceId;\n}\n\n/**\n * Detect browser information from user agent.\n * Returns safe defaults when running server-side.\n */\nexport function getBrowserInfo(): {\n  browser: string;\n  browser_version: string;\n  os: string;\n  os_version: string;\n} {\n  if (typeof navigator === 'undefined') {\n    return { browser: 'unknown', browser_version: '', os: 'unknown', os_version: '' };\n  }\n\n  const ua = navigator.userAgent;\n  let browser = 'unknown';\n  let browserVersion = '';\n  let os = 'unknown';\n  let osVersion = '';\n\n  // Detect browser\n  if (ua.includes('Firefox/')) {\n    browser = 'Firefox';\n    browserVersion = ua.match(/Firefox\\/([\\d.]+)/)?.[1] || '';\n  } else if (ua.includes('Edg/')) {\n    browser = 'Edge';\n    browserVersion = ua.match(/Edg\\/([\\d.]+)/)?.[1] || '';\n  } else if (ua.includes('Chrome/')) {\n    browser = 'Chrome';\n    browserVersion = ua.match(/Chrome\\/([\\d.]+)/)?.[1] || '';\n  } else if (ua.includes('Safari/') && !ua.includes('Chrome')) {\n    browser = 'Safari';\n    browserVersion = ua.match(/Version\\/([\\d.]+)/)?.[1] || '';\n  } else if (ua.includes('Opera') || ua.includes('OPR/')) {\n    browser = 'Opera';\n    browserVersion = ua.match(/(?:Opera|OPR)\\/([\\d.]+)/)?.[1] || '';\n  }\n\n  // Detect OS\n  if (ua.includes('Windows')) {\n    os = 'Windows';\n    if (ua.includes('Windows NT 10.0')) osVersion = '10';\n    else if (ua.includes('Windows NT 6.3')) osVersion = '8.1';\n    else if (ua.includes('Windows NT 6.2')) osVersion = '8';\n    else if (ua.includes('Windows NT 6.1')) osVersion = '7';\n  } else if (ua.includes('Mac OS X')) {\n    os = 'macOS';\n    osVersion = ua.match(/Mac OS X ([\\d_]+)/)?.[1]?.replace(/_/g, '.') || '';\n  } else if (ua.includes('Linux')) {\n    os = 'Linux';\n  } else if (ua.includes('Android')) {\n    os = 'Android';\n    osVersion = ua.match(/Android ([\\d.]+)/)?.[1] || '';\n  } else if (ua.includes('iOS') || ua.includes('iPhone') || ua.includes('iPad')) {\n    os = 'iOS';\n    osVersion = ua.match(/OS ([\\d_]+)/)?.[1]?.replace(/_/g, '.') || '';\n  }\n\n  return { browser, browser_version: browserVersion, os, os_version: osVersion };\n}\n","/**\n * Base HTTP client for all Vesant SDK clients\n *\n * Provides common functionality:\n * - Request/response handling\n * - Error handling\n * - Retry logic with exponential backoff\n * - Timeout management\n * - Debug logging\n */\n\nimport type { BaseClientConfig, Logger, RequestInterceptor, RequestOptions } from './config';\nimport { type TokenProvider, StaticApiKeyProvider } from './auth';\nimport {\n  VesantError,\n  NetworkError,\n  TimeoutError,\n  AuthenticationError,\n  RateLimitError,\n  ServiceUnavailableError,\n  ValidationError,\n  CircuitBreakerOpenError,\n} from './errors';\nimport { CircuitBreaker, type CircuitBreakerStatus } from './circuit-breaker';\nimport { RateLimitTracker, type RateLimitStatus } from './rate-limiter';\nimport { createConsoleLogger } from './logger';\nimport { SDK_VERSION } from './version';\nimport { generateUUID } from '../shared/browser-utils';\n\nexport abstract class BaseClient {\n  protected config: BaseClientConfig & { timeout: number; retries: number };\n  protected logger: Logger;\n  private interceptors: RequestInterceptor[];\n  private circuitBreaker: CircuitBreaker | null = null;\n  private rateLimitTracker: RateLimitTracker | null = null;\n  private authProvider: TokenProvider | undefined;\n\n  constructor(config: BaseClientConfig) {\n    if (!config.baseURL?.trim()) {\n      throw new ValidationError('baseURL is required and must be a non-empty string', ['baseURL']);\n    }\n    if (!config.tenantId?.trim()) {\n      throw new ValidationError('tenantId is required and must be a non-empty string', ['tenantId']);\n    }\n\n    // The SDK relies on a global fetch (Node.js >= 18). Fail fast with a clear\n    // message rather than a later \"fetch is not defined\" ReferenceError.\n    if (typeof fetch === 'undefined') {\n      throw new VesantError(\n        'The Vesant SDK requires a global fetch (Node.js >= 18). Upgrade Node or provide a fetch polyfill.',\n        'RUNTIME_UNSUPPORTED'\n      );\n    }\n\n    this.interceptors = config.interceptors || [];\n    this.logger = config.logger || createConsoleLogger();\n\n    // Auto-detect environment from API key prefix\n    let environment = config.environment;\n    const apiKey = config.apiKey || '';\n    if (apiKey.startsWith('pk_test_')) {\n      if (environment === 'production') {\n        this.logger.warn('Sandbox API key (pk_test_*) used with environment: \"production\" — overriding to \"sandbox\"');\n      }\n      environment = 'sandbox';\n    } else if (apiKey.startsWith('pk_live_') && environment === 'sandbox') {\n      this.logger.warn('Production API key (pk_live_*) used with environment: \"sandbox\" — sandbox isolation will still be applied for backward compatibility');\n    }\n\n    this.config = {\n      ...config,\n      apiKey,\n      environment,\n      headers: config.headers || {},\n      timeout: config.timeout || 10000,\n      retries: config.retries ?? 3,\n      debug: config.debug || false,\n      interceptors: this.interceptors,\n      logger: this.logger,\n    };\n\n    // Default to a static-apiKey provider so the apiKey path is unchanged; an\n    // explicit authProvider (OAuth2 / rotating secrets) takes precedence.\n    this.authProvider = config.authProvider ?? (apiKey ? new StaticApiKeyProvider(apiKey) : undefined);\n\n    if (config.circuitBreaker) {\n      this.circuitBreaker = new CircuitBreaker(config.circuitBreaker);\n    }\n    if (config.enableRateLimitTracking) {\n      this.rateLimitTracker = new RateLimitTracker();\n    }\n  }\n\n  /**\n   * Resolve the Idempotency-Key for a request. Mutating methods (POST/PUT/PATCH)\n   * get the caller-supplied key or a freshly minted UUID; non-mutating methods get\n   * none. requestWithRetry resolves this once and injects it so every retry reuses\n   * one key (letting the server dedup replays); a direct request() resolves per call.\n   */\n  private resolveIdempotencyKey(method: string, requestOptions?: RequestOptions): string | undefined {\n    const isMutating = ['POST', 'PUT', 'PATCH'].includes((method || 'GET').toUpperCase());\n    if (!isMutating) {\n      return undefined;\n    }\n    return requestOptions?.idempotencyKey ?? generateUUID();\n  }\n\n  /**\n   * Make an HTTP request with timeout and error handling\n   */\n  protected async request<T>(\n    endpoint: string,\n    options: RequestInit = {},\n    serviceURL?: string,\n    requestOptions?: RequestOptions\n  ): Promise<T> {\n    const requestId = generateUUID();\n\n    // Circuit breaker check\n    if (this.circuitBreaker && !this.circuitBreaker.canExecute()) {\n      const error = new CircuitBreakerOpenError();\n      error.requestId = requestId;\n      throw error;\n    }\n\n    // Rate limit pre-check\n    if (this.rateLimitTracker && this.rateLimitTracker.isLimitExceeded()) {\n      const status = this.rateLimitTracker.getStatus();\n      const error = new RateLimitError(status.retryAfter ?? undefined);\n      error.requestId = requestId;\n      throw error;\n    }\n\n    const url = `${serviceURL || this.config.baseURL}${endpoint}`;\n\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n      'X-Tenant-ID': this.config.tenantId,\n      'X-SDK-Version': `vesant-sdk-ts/${SDK_VERSION}`,\n      'X-Request-ID': requestId,\n      ...this.config.headers,\n      ...((options.headers as Record<string, string>) || {}),\n    };\n\n    // Resolve the auth credential per-request via the token provider (async, so a\n    // provider can fetch/refresh short-lived credentials). No credential = no header.\n    const credential = await this.authProvider?.getCredential({\n      tenantId: this.config.tenantId,\n      requestId,\n    });\n    if (credential) {\n      headers['Authorization'] = `${credential.scheme ?? 'Bearer'} ${credential.token}`;\n    }\n\n    // Sandbox header\n    if (this.config.environment === 'sandbox') {\n      headers['X-Sandbox'] = 'true';\n    }\n\n    // Idempotency key for mutating methods. Via requestWithRetry the key arrives\n    // pre-resolved in requestOptions so all attempts share one; a direct request()\n    // falls back to minting one here.\n    const method = (options.method || 'GET').toUpperCase();\n    const idempotencyKey = this.resolveIdempotencyKey(method, requestOptions);\n    if (idempotencyKey) {\n      headers['Idempotency-Key'] = idempotencyKey;\n    }\n\n    const controller = new AbortController();\n    const timeoutId = setTimeout(() => controller.abort(), this.config.timeout);\n\n    // Link consumer AbortSignal to internal controller\n    if (requestOptions?.signal) {\n      if (requestOptions.signal.aborted) {\n        controller.abort();\n      } else {\n        requestOptions.signal.addEventListener('abort', () => controller.abort(), { once: true });\n      }\n    }\n\n    try {\n      // Run onRequest interceptors\n      let finalOptions: RequestInit = { ...options, headers };\n      for (const interceptor of this.interceptors) {\n        if (interceptor.onRequest) {\n          finalOptions = await interceptor.onRequest(url, finalOptions);\n        }\n      }\n\n      if (this.config.debug) {\n        this.logger.debug(`${finalOptions.method || 'GET'} ${endpoint}`);\n      }\n\n      let response = await fetch(url, {\n        ...finalOptions,\n        signal: controller.signal,\n      });\n\n      // Single-shot 401 re-auth: if the provider can refresh, a 401 forces one\n      // credential refresh and retry, reusing the same headers (incl. the\n      // Idempotency-Key) so a mutating request is not double-submitted.\n      if (response.status === 401 && this.authProvider?.canRefresh?.()) {\n        const refreshed = await this.authProvider.getCredential({\n          tenantId: this.config.tenantId,\n          requestId,\n          forceRefresh: true,\n        });\n        if (refreshed) {\n          this.config.onCredentialRotated?.({ reason: 'unauthorized' });\n          finalOptions = {\n            ...finalOptions,\n            headers: {\n              ...(finalOptions.headers as Record<string, string>),\n              Authorization: `${refreshed.scheme ?? 'Bearer'} ${refreshed.token}`,\n            },\n          };\n          response = await fetch(url, { ...finalOptions, signal: controller.signal });\n        }\n      }\n\n      clearTimeout(timeoutId);\n\n      // Track rate limit headers\n      if (this.rateLimitTracker) {\n        this.rateLimitTracker.updateFromHeaders(response.headers);\n      }\n\n      // Binary download path\n      if (requestOptions?.responseType === 'arraybuffer') {\n        if (!response.ok) {\n          let errData: Record<string, unknown> = {};\n          try { errData = await response.json(); } catch { /* ignore */ }\n          this.handleErrorResponse(response.status, errData, requestId);\n        }\n        this.circuitBreaker?.onSuccess();\n        const buffer = await response.arrayBuffer();\n        return buffer as unknown as T;\n      }\n\n      let data: Record<string, unknown> | undefined;\n      try {\n        data = await response.json();\n      } catch {\n        // Non-JSON response (HTML error pages, 204 No Content, etc.)\n        if (!response.ok) {\n          this.handleErrorResponse(response.status, {\n            error: `HTTP ${response.status}`,\n            message: response.statusText,\n          }, requestId);\n        }\n        // OK response but no JSON body (e.g., 204)\n        this.circuitBreaker?.onSuccess();\n        return undefined as unknown as T;\n      }\n\n      if (!response.ok) {\n        this.handleErrorResponse(response.status, data || {}, requestId);\n      }\n\n      // Record success for circuit breaker\n      this.circuitBreaker?.onSuccess();\n\n      // Run onResponse interceptors\n      let result: unknown = data;\n      for (const interceptor of this.interceptors) {\n        if (interceptor.onResponse) {\n          result = await interceptor.onResponse(url, result);\n        }\n      }\n\n      if (this.config.debug) {\n        this.logger.debug(`Response: ${response.status}`);\n      }\n\n      return result as T;\n    } catch (error) {\n      clearTimeout(timeoutId);\n\n      // Record failure for circuit breaker (skip for client errors)\n      if (\n        error instanceof VesantError &&\n        error.statusCode &&\n        error.statusCode >= 500\n      ) {\n        this.circuitBreaker?.onFailure();\n      } else if (error instanceof NetworkError || error instanceof TimeoutError) {\n        this.circuitBreaker?.onFailure();\n      }\n\n      // Attach requestId to VesantError instances\n      if (error instanceof VesantError && !error.requestId) {\n        error.requestId = requestId;\n      }\n\n      // Run onError interceptors\n      if (error instanceof Error) {\n        for (const interceptor of this.interceptors) {\n          if (interceptor.onError) {\n            await interceptor.onError(url, error);\n          }\n        }\n      }\n\n      if (error instanceof Error) {\n        if (error.name === 'AbortError') {\n          // Distinguish consumer abort from timeout\n          if (requestOptions?.signal?.aborted) {\n            const abortError = new VesantError('Request aborted', 'REQUEST_ABORTED');\n            abortError.requestId = requestId;\n            throw abortError;\n          }\n          this.circuitBreaker?.onFailure();\n          const timeoutError = new TimeoutError(this.config.timeout);\n          timeoutError.requestId = requestId;\n          throw timeoutError;\n        }\n        if (error instanceof VesantError) {\n          throw error;\n        }\n      }\n\n      const networkError = new NetworkError('Network request failed', error);\n      networkError.requestId = requestId;\n      this.circuitBreaker?.onFailure();\n      throw networkError;\n    }\n  }\n\n  /**\n   * Make an HTTP request with retry logic\n   */\n  protected async requestWithRetry<T>(\n    endpoint: string,\n    options: RequestInit = {},\n    serviceURL?: string,\n    retries: number = this.config.retries,\n    requestOptions?: RequestOptions\n  ): Promise<T> {\n    let lastError: Error | undefined;\n\n    // Resolve the idempotency key once so every retry attempt reuses it, letting\n    // the server dedup replays instead of re-processing (and re-billing) each try.\n    const idempotencyKey = this.resolveIdempotencyKey(options.method || 'GET', requestOptions);\n    const attemptOptions: RequestOptions | undefined = idempotencyKey\n      ? { ...requestOptions, idempotencyKey }\n      : requestOptions;\n\n    for (let attempt = 0; attempt <= retries; attempt++) {\n      try {\n        return await this.request<T>(endpoint, options, serviceURL, attemptOptions);\n      } catch (error) {\n        lastError = error instanceof Error ? error : new Error('Unknown error');\n\n        // Don't retry on consumer abort\n        if (requestOptions?.signal?.aborted) {\n          throw lastError;\n        }\n\n        // Don't retry on client errors (4xx), except 429 (rate limit)\n        if (\n          lastError instanceof VesantError &&\n          lastError.statusCode &&\n          lastError.statusCode >= 400 &&\n          lastError.statusCode < 500 &&\n          lastError.statusCode !== 429\n        ) {\n          throw lastError;\n        }\n\n        // Don't retry on last attempt\n        if (attempt === retries) {\n          break;\n        }\n\n        // Use Retry-After for 429, otherwise exponential backoff with jitter\n        let delay: number;\n        if (lastError instanceof RateLimitError && lastError.retryAfter) {\n          delay = lastError.retryAfter * 1000;\n        } else {\n          delay = Math.min(1000 * Math.pow(2, attempt) + Math.random() * 1000, 10000);\n        }\n        await new Promise((resolve) => setTimeout(resolve, delay));\n\n        if (this.config.debug) {\n          this.logger.debug(`Retry attempt ${attempt + 1}/${retries} after ${delay.toFixed(0)}ms`);\n        }\n      }\n    }\n\n    throw new NetworkError(`Request failed after ${retries} retries`, lastError);\n  }\n\n  /**\n   * Handle error responses from API\n   */\n  protected handleErrorResponse(status: number, data: Record<string, unknown>, requestId?: string): never {\n    const message = (data.error as string) || (data.message as string) || `HTTP ${status}`;\n\n    const createError = (): VesantError => {\n      switch (status) {\n        case 400:\n          return new VesantError(message, 'BAD_REQUEST', 400);\n        case 401:\n          return new AuthenticationError(message);\n        case 403:\n          return new VesantError(message, 'FORBIDDEN', 403);\n        case 404:\n          return new VesantError(message, 'NOT_FOUND', 404);\n        case 409:\n          return new VesantError(message, 'DUPLICATE_PROFILE', 409);\n        case 429: {\n          const retryAfter = (data.retry_after as number | undefined) || (data.retryAfter as number | undefined);\n          return new RateLimitError(retryAfter);\n        }\n        case 500:\n        case 502:\n        case 503:\n        case 504:\n          return new ServiceUnavailableError(message);\n        default:\n          return new VesantError(message, 'UNKNOWN_ERROR', status);\n      }\n    };\n\n    const error = createError();\n    if (requestId) {\n      error.requestId = requestId;\n    }\n    throw error;\n  }\n\n  /**\n   * Build query string from parameters\n   */\n  protected buildQueryString(params: Record<string, unknown>): string {\n    const query = new URLSearchParams();\n\n    Object.entries(params).forEach(([key, value]) => {\n      if (value !== undefined && value !== null) {\n        if (Array.isArray(value)) {\n          value.forEach((item) => query.append(key, String(item)));\n        } else {\n          query.append(key, String(value));\n        }\n      }\n    });\n\n    const queryString = query.toString();\n    return queryString ? `?${queryString}` : '';\n  }\n\n  /**\n   * Update client configuration\n   */\n  updateConfig(config: Partial<BaseClientConfig>): void {\n    this.config = {\n      ...this.config,\n      ...config,\n      headers: {\n        ...this.config.headers,\n        ...(config.headers || {}),\n      },\n    };\n    if (config.logger) {\n      this.logger = config.logger;\n    }\n    if (config.interceptors) {\n      this.interceptors = config.interceptors;\n    }\n    // Rebuild the auth provider when auth-related config changes so a rotated key\n    // or a swapped provider takes effect on subsequent requests.\n    if (config.authProvider !== undefined || config.apiKey !== undefined) {\n      this.authProvider =\n        this.config.authProvider ??\n        (this.config.apiKey ? new StaticApiKeyProvider(this.config.apiKey) : undefined);\n    }\n  }\n\n  /**\n   * Get current configuration (readonly)\n   */\n  getConfig(): Readonly<BaseClientConfig> {\n    return { ...this.config };\n  }\n\n  /**\n   * Get rate limit status from tracked response headers.\n   */\n  getRateLimitStatus(): RateLimitStatus | null {\n    return this.rateLimitTracker?.getStatus() ?? null;\n  }\n\n  /**\n   * Get circuit breaker status.\n   */\n  getCircuitBreakerStatus(): CircuitBreakerStatus | null {\n    return this.circuitBreaker?.getStatus() ?? null;\n  }\n\n  /**\n   * Health check endpoint\n   */\n  async healthCheck(): Promise<{ status: string; timestamp: string }> {\n    return this.request('/api/v1/health');\n  }\n}\n","import { BaseClient } from '../core/client';\nimport type { BaseClientConfig, RequestOptions } from '../core/config';\nimport type {\n  TaxClientConfig,\n  CustomerTaxProfileRecord,\n  CustomerTaxProfileDocuments,\n  ReRequestTaxFormInput,\n  EnableWithholdingInput,\n  EnableWithholdingResponse,\n  TINCheckResult,\n  TaxRules,\n  UpdateTaxRulesInput,\n  TaxRuleVersion,\n  RemindersRunResult,\n  ComplianceStats,\n  ComplianceStatsFilters,\n  GlobalTaxRule,\n  TreatyCountry,\n  TreatyCountryListResponse,\n} from './types';\n\nexport class TaxClient extends BaseClient {\n  constructor(config: TaxClientConfig) {\n    const baseConfig: BaseClientConfig = {\n      baseURL: config.baseURL,\n      tenantId: config.tenantId,\n      apiKey: config.apiKey,\n      headers: config.headers,\n      timeout: config.timeout,\n      retries: 3,\n      debug: config.debug,\n      environment: config.environment,\n    };\n    super(baseConfig);\n  }\n\n  // ==========================================================================\n  // P1 — Customer Tax Profile (core compliance flow)\n  // ==========================================================================\n\n  async getCustomerTaxProfileRecord(customerID: string): Promise<CustomerTaxProfileRecord> {\n    return this.request<CustomerTaxProfileRecord>(\n      `/api/v1/tax/customer-tax-profiles/${customerID}`\n    );\n  }\n\n  async requestTaxForm(customerID: string): Promise<CustomerTaxProfileRecord> {\n    return this.request<CustomerTaxProfileRecord>(\n      `/api/v1/tax/customer-tax-profiles/${customerID}/request-form`,\n      { method: 'POST' }\n    );\n  }\n\n  async checkTINStatus(customerID: string, requestOptions?: RequestOptions): Promise<TINCheckResult> {\n    return this.requestWithRetry<TINCheckResult>(\n      `/api/v1/tax/customer-tax-profiles/${customerID}/check-tin`,\n      { method: 'POST' },\n      undefined,\n      undefined,\n      requestOptions\n    );\n  }\n\n  async reRequestTaxForm(\n    customerID: string,\n    input: ReRequestTaxFormInput\n  ): Promise<CustomerTaxProfileRecord> {\n    return this.request<CustomerTaxProfileRecord>(\n      `/api/v1/tax/customer-tax-profiles/${customerID}/re-request-form`,\n      {\n        method: 'POST',\n        body: JSON.stringify(input),\n      }\n    );\n  }\n\n  async enableBackupWithholding(\n    customerID: string,\n    input: EnableWithholdingInput\n  ): Promise<EnableWithholdingResponse> {\n    return this.request<EnableWithholdingResponse>(\n      `/api/v1/tax/customer-tax-profiles/${customerID}/enable-withholding`,\n      {\n        method: 'POST',\n        body: JSON.stringify(input),\n      }\n    );\n  }\n\n   async getCustomerDocuments(customerID: string): Promise<CustomerTaxProfileDocuments> {\n    return this.request<CustomerTaxProfileDocuments>(\n      `/api/v1/tm/customer-tax-profiles/${customerID}/documents`\n    );\n  }\n\n  async downloadTaxForm(\n    customerID: string,\n    requestOptions?: RequestOptions\n  ): Promise<ArrayBuffer> {\n    return this.request<ArrayBuffer>(\n      `/api/v1/tax/customer-tax-profiles/${customerID}/download-form`,\n      { method: 'GET' },\n      undefined,\n      { ...requestOptions, responseType: 'arraybuffer' }\n    );\n  }\n\n  // ==========================================================================\n  // P2 — Tenant Tax Rules\n  // ==========================================================================\n\n  async getTaxRules(): Promise<TaxRules> {\n    const res = await this.request<{ rules: TaxRules }>('/api/v1/tax/rules');\n    return res.rules;\n  }\n\n  async updateTaxRules(input: UpdateTaxRulesInput): Promise<TaxRuleVersion> {\n    const res = await this.request<{ version: TaxRuleVersion }>('/api/v1/tax/rules', {\n      method: 'PUT',\n      body: JSON.stringify({ rules: input }),\n    });\n    return res.version;\n  }\n\n  async runReminders(): Promise<RemindersRunResult> {\n    return this.request<RemindersRunResult>('/api/v1/tax/reminders/run', { method: 'POST' });\n  }\n\n  async getComplianceStats(filters?: ComplianceStatsFilters): Promise<ComplianceStats> {\n    const params: Record<string, unknown> = {};\n    if (filters?.time_range) params.time_range = filters.time_range;\n    if (filters?.from_date) params.from_date = filters.from_date;\n    if (filters?.to_date) params.to_date = filters.to_date;\n    return this.request<ComplianceStats>(\n      `/api/v1/tax/tenant/w-form-tenant-stats${this.buildQueryString(params)}`\n    );\n  }\n\n  // ==========================================================================\n  // P3 — Global Tax Rule & Treaty Countries\n  // ==========================================================================\n\n  async getCurrentGlobalTaxRule(): Promise<GlobalTaxRule> {\n    const res = await this.request<{ success: boolean; message: string; data: GlobalTaxRule }>(\n      '/api/v1/tm/tenant/global-tax-rules/current'\n    );\n    return res.data;\n  }\n\n  async listTreatyCountries(): Promise<TreatyCountryListResponse> {\n    return this.request<TreatyCountryListResponse>('/api/v1/tax/treaty-countries');\n  }\n\n  async getTreatyCountry(code: string): Promise<TreatyCountry> {\n    const res = await this.request<{ treaty_country: TreatyCountry }>(\n      `/api/v1/tax/treaty-countries/${encodeURIComponent(code)}`\n    );\n    return res.treaty_country;\n  }\n}\n"]}
+{"version":3,"sources":["../../src/core/auth.ts","../../src/core/errors.ts","../../src/core/circuit-breaker.ts","../../src/core/rate-limiter.ts","../../src/core/logger.ts","../../src/core/version.ts","../../src/shared/browser-utils.ts","../../src/core/client.ts","../../src/tax/client.ts"],"names":[],"mappings":";AAmCO,IAAM,uBAAN,MAAoD;AAAA,EACzD,YAA6B,MAAA,EAAgB;AAAhB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAAiB;AAAA,EAE9C,MAAM,aAAA,GAAgD;AACpD,IAAA,OAAO,IAAA,CAAK,SAAS,EAAE,MAAA,EAAQ,UAAU,KAAA,EAAO,IAAA,CAAK,QAAO,GAAI,IAAA;AAAA,EAClE;AAAA,EAEA,UAAA,GAAsB;AACpB,IAAA,OAAO,KAAA;AAAA,EACT;AACF,CAAA;;;ACtCO,IAAM,WAAA,GAAN,MAAM,YAAA,SAAoB,KAAA,CAAM;AAAA,EAGrC,WAAA,CACE,OAAA,EACO,IAAA,EACA,UAAA,EACA,OAAA,EACP;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AAJN,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAGP,IAAA,IAAA,CAAK,IAAA,GAAO,aAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,YAAA,CAAY,SAAS,CAAA;AAAA,EACnD;AACF,CAAA;AAOO,IAAM,YAAA,GAAN,MAAM,aAAA,SAAqB,WAAA,CAAY;AAAA,EAC5C,WAAA,CAAY,SAAwB,aAAA,EAAyB;AAC3D,IAAA,KAAA,CAAM,SAAS,eAAe,CAAA;AADI,IAAA,IAAA,CAAA,aAAA,GAAA,aAAA;AAElC,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,aAAA,CAAa,SAAS,CAAA;AAAA,EACpD;AACF,CAAA;AAEO,IAAM,eAAA,GAAN,MAAM,gBAAA,SAAwB,WAAA,CAAY;AAAA,EAC/C,WAAA,CAAY,SAAiB,MAAA,EAAmB;AAC9C,IAAA,KAAA,CAAM,OAAA,EAAS,kBAAA,EAAoB,GAAA,EAAK,EAAE,QAAQ,CAAA;AAClD,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,gBAAA,CAAgB,SAAS,CAAA;AAAA,EACvD;AACF,CAAA;AAEO,IAAM,uBAAA,GAAN,MAAM,wBAAA,SAAgC,WAAA,CAAY;AAAA,EACvD,WAAA,CAAY,UAAkB,qBAAA,EAAuB;AACnD,IAAA,KAAA,CAAM,OAAA,EAAS,uBAAuB,GAAG,CAAA;AACzC,IAAA,IAAA,CAAK,IAAA,GAAO,yBAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,wBAAA,CAAwB,SAAS,CAAA;AAAA,EAC/D;AACF,CAAA;AAUO,IAAM,mBAAA,GAAN,MAAM,oBAAA,SAA4B,WAAA,CAAY;AAAA,EACnD,WAAA,CAAY,UAAkB,uBAAA,EAAyB;AACrD,IAAA,KAAA,CAAM,OAAA,EAAS,wBAAwB,GAAG,CAAA;AAC1C,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,oBAAA,CAAoB,SAAS,CAAA;AAAA,EAC3D;AACF,CAAA;AAEO,IAAM,cAAA,GAAN,MAAM,eAAA,SAAuB,WAAA,CAAY;AAAA,EAC9C,YAAmB,UAAA,EAAqB;AACtC,IAAA,KAAA,CAAM,qBAAA,EAAuB,qBAAA,EAAuB,GAAA,EAAK,EAAE,YAAY,CAAA;AADtD,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AAEjB,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,eAAA,CAAe,SAAS,CAAA;AAAA,EACtD;AACF,CAAA;AAEO,IAAM,YAAA,GAAN,MAAM,aAAA,SAAqB,WAAA,CAAY;AAAA,EAC5C,YAAmB,OAAA,EAAiB;AAClC,IAAA,KAAA,CAAM,yBAAyB,OAAO,CAAA,EAAA,CAAA,EAAM,WAAW,GAAA,EAAK,EAAE,SAAS,CAAA;AADtD,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAEjB,IAAA,IAAA,CAAK,IAAA,GAAO,cAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,aAAA,CAAa,SAAS,CAAA;AAAA,EACpD;AACF,CAAA;AAcO,IAAM,uBAAA,GAAN,MAAM,wBAAA,SAAgC,WAAA,CAAY;AAAA,EACvD,WAAA,GAAc;AACZ,IAAA,KAAA,CAAM,iEAAA,EAA8D,wBAAwB,GAAG,CAAA;AAC/F,IAAA,IAAA,CAAK,IAAA,GAAO,yBAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,wBAAA,CAAwB,SAAS,CAAA;AAAA,EAC/D;AACF,CAAA;;;AC5EO,IAAM,iBAAN,MAAqB;AAAA,EAU1B,WAAA,CAAY,MAAA,GAA+B,EAAC,EAAG;AAT/C,IAAA,IAAA,CAAQ,KAAA,GAA6B,QAAA;AACrC,IAAA,IAAA,CAAQ,QAAA,GAAW,CAAA;AACnB,IAAA,IAAA,CAAQ,SAAA,GAAY,CAAA;AACpB,IAAA,IAAA,CAAQ,eAAA,GAAiC,IAAA;AAOvC,IAAA,IAAA,CAAK,gBAAA,GAAmB,OAAO,gBAAA,IAAoB,CAAA;AACnD,IAAA,IAAA,CAAK,YAAA,GAAe,OAAO,YAAA,IAAgB,GAAA;AAC3C,IAAA,IAAA,CAAK,gBAAA,GAAmB,OAAO,gBAAA,IAAoB,CAAA;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA,EAKA,UAAA,GAAsB;AACpB,IAAA,IAAI,IAAA,CAAK,UAAU,QAAA,EAAU;AAC3B,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,IAAI,IAAA,CAAK,UAAU,MAAA,EAAQ;AACzB,MAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,MAAA,IAAI,KAAK,eAAA,IAAmB,GAAA,GAAM,IAAA,CAAK,eAAA,IAAmB,KAAK,YAAA,EAAc;AAC3E,QAAA,IAAA,CAAK,KAAA,GAAQ,WAAA;AACb,QAAA,IAAA,CAAK,SAAA,GAAY,CAAA;AACjB,QAAA,OAAO,IAAA;AAAA,MACT;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAGA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,SAAA,GAAkB;AAChB,IAAA,IAAI,IAAA,CAAK,UAAU,WAAA,EAAa;AAC9B,MAAA,IAAA,CAAK,SAAA,EAAA;AACL,MAAA,IAAI,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,gBAAA,EAAkB;AAC3C,QAAA,IAAA,CAAK,KAAA,GAAQ,QAAA;AACb,QAAA,IAAA,CAAK,QAAA,GAAW,CAAA;AAChB,QAAA,IAAA,CAAK,SAAA,GAAY,CAAA;AACjB,QAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AAAA,MACzB;AAAA,IACF,CAAA,MAAA,IAAW,IAAA,CAAK,KAAA,KAAU,QAAA,EAAU;AAClC,MAAA,IAAA,CAAK,QAAA,GAAW,CAAA;AAAA,IAClB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,SAAA,GAAkB;AAChB,IAAA,IAAA,CAAK,QAAA,EAAA;AACL,IAAA,IAAA,CAAK,eAAA,GAAkB,KAAK,GAAA,EAAI;AAEhC,IAAA,IAAI,IAAA,CAAK,UAAU,WAAA,EAAa;AAC9B,MAAA,IAAA,CAAK,KAAA,GAAQ,MAAA;AACb,MAAA,IAAA,CAAK,SAAA,GAAY,CAAA;AAAA,IACnB,WAAW,IAAA,CAAK,KAAA,KAAU,YAAY,IAAA,CAAK,QAAA,IAAY,KAAK,gBAAA,EAAkB;AAC5E,MAAA,IAAA,CAAK,KAAA,GAAQ,MAAA;AAAA,IACf;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,SAAA,GAAkC;AAChC,IAAA,OAAO;AAAA,MACL,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,iBAAiB,IAAA,CAAK,eAAA;AAAA,MACtB,aAAA,EACE,KAAK,KAAA,KAAU,MAAA,IAAU,KAAK,eAAA,GAC1B,IAAA,CAAK,eAAA,GAAkB,IAAA,CAAK,YAAA,GAC5B;AAAA,KACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,KAAA,GAAQ,QAAA;AACb,IAAA,IAAA,CAAK,QAAA,GAAW,CAAA;AAChB,IAAA,IAAA,CAAK,SAAA,GAAY,CAAA;AACjB,IAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AAAA,EACzB;AACF,CAAA;;;ACtGO,IAAM,mBAAN,MAAuB;AAAA,EAAvB,WAAA,GAAA;AACL,IAAA,IAAA,CAAQ,KAAA,GAAuB,IAAA;AAC/B,IAAA,IAAA,CAAQ,SAAA,GAA2B,IAAA;AACnC,IAAA,IAAA,CAAQ,KAAA,GAAuB,IAAA;AAC/B,IAAA,IAAA,CAAQ,UAAA,GAA4B,IAAA;AAAA,EAAA;AAAA;AAAA;AAAA;AAAA,EAKpC,kBAAkB,OAAA,EAAwB;AACxC,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,mBAAmB,CAAA;AAC7C,IAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,GAAA,CAAI,uBAAuB,CAAA;AACrD,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,mBAAmB,CAAA;AAC7C,IAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AAE5C,IAAA,IAAI,UAAU,IAAA,EAAM,IAAA,CAAK,KAAA,GAAQ,QAAA,CAAS,OAAO,EAAE,CAAA;AACnD,IAAA,IAAI,cAAc,IAAA,EAAM,IAAA,CAAK,SAAA,GAAY,QAAA,CAAS,WAAW,EAAE,CAAA;AAC/D,IAAA,IAAI,UAAU,IAAA,EAAM,IAAA,CAAK,KAAA,GAAQ,QAAA,CAAS,OAAO,EAAE,CAAA;AACnD,IAAA,IAAI,eAAe,IAAA,EAAM,IAAA,CAAK,UAAA,GAAa,QAAA,CAAS,YAAY,EAAE,CAAA;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA,EAKA,eAAA,GAA2B;AACzB,IAAA,IAAI,IAAA,CAAK,SAAA,KAAc,IAAA,IAAQ,IAAA,CAAK,aAAa,CAAA,EAAG;AAElD,MAAA,IAAI,IAAA,CAAK,UAAU,IAAA,EAAM;AACvB,QAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,QAAA,IAAI,GAAA,IAAO,KAAK,KAAA,EAAO;AAErB,UAAA,IAAA,CAAK,SAAA,GAAY,IAAA;AACjB,UAAA,IAAA,CAAK,KAAA,GAAQ,IAAA;AACb,UAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,UAAA,OAAO,KAAA;AAAA,QACT;AAAA,MACF;AACA,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,SAAA,GAA6B;AAC3B,IAAA,OAAO;AAAA,MACL,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,YAAY,IAAA,CAAK;AAAA,KACnB;AAAA,EACF;AACF,CAAA;;;ACrEO,SAAS,mBAAA,GAA8B;AAC5C,EAAA,OAAO;AAAA,IACL,KAAA,CAAM,SAAiB,IAAA,EAAgC;AACrD,MAAA,OAAA,CAAQ,IAAI,CAAA,aAAA,EAAgB,OAAO,IAAI,IAAA,KAAS,MAAA,GAAY,OAAO,EAAE,CAAA;AAAA,IACvE,CAAA;AAAA,IACA,IAAA,CAAK,SAAiB,IAAA,EAAgC;AACpD,MAAA,OAAA,CAAQ,KAAK,CAAA,aAAA,EAAgB,OAAO,IAAI,IAAA,KAAS,MAAA,GAAY,OAAO,EAAE,CAAA;AAAA,IACxE,CAAA;AAAA,IACA,IAAA,CAAK,SAAiB,IAAA,EAAgC;AACpD,MAAA,OAAA,CAAQ,KAAK,CAAA,aAAA,EAAgB,OAAO,IAAI,IAAA,KAAS,MAAA,GAAY,OAAO,EAAE,CAAA;AAAA,IACxE,CAAA;AAAA,IACA,KAAA,CAAM,SAAiB,IAAA,EAAgC;AACrD,MAAA,OAAA,CAAQ,MAAM,CAAA,aAAA,EAAgB,OAAO,IAAI,IAAA,KAAS,MAAA,GAAY,OAAO,EAAE,CAAA;AAAA,IACzE;AAAA,GACF;AACF;;;ACdO,IAAM,WAAA,GAAc,OAAA;;;ACOpB,SAAS,YAAA,GAAuB;AACrC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,IAAe,MAAA,CAAO,UAAA,EAAY;AACtD,IAAA,OAAO,OAAO,UAAA,EAAW;AAAA,EAC3B;AAGA,EAAA,OAAO,sCAAA,CAAuC,OAAA,CAAQ,OAAA,EAAS,CAAC,CAAA,KAAM;AACpE,IAAA,MAAM,CAAA,GAAK,IAAA,CAAK,MAAA,EAAO,GAAI,EAAA,GAAM,CAAA;AACjC,IAAA,MAAM,CAAA,GAAI,CAAA,KAAM,GAAA,GAAM,CAAA,GAAK,IAAI,CAAA,GAAO,CAAA;AACtC,IAAA,OAAO,CAAA,CAAE,SAAS,EAAE,CAAA;AAAA,EACtB,CAAC,CAAA;AACH;;;ACQO,IAAe,aAAf,MAA0B;AAAA,EAQ/B,YAAY,MAAA,EAA0B;AAJtC,IAAA,IAAA,CAAQ,cAAA,GAAwC,IAAA;AAChD,IAAA,IAAA,CAAQ,gBAAA,GAA4C,IAAA;AAIlD,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,IAAA,EAAK,EAAG;AAC3B,MAAA,MAAM,IAAI,eAAA,CAAgB,oDAAA,EAAsD,CAAC,SAAS,CAAC,CAAA;AAAA,IAC7F;AACA,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,EAAU,IAAA,EAAK,EAAG;AAC5B,MAAA,MAAM,IAAI,eAAA,CAAgB,qDAAA,EAAuD,CAAC,UAAU,CAAC,CAAA;AAAA,IAC/F;AAIA,IAAA,IAAI,OAAO,UAAU,WAAA,EAAa;AAChC,MAAA,MAAM,IAAI,WAAA;AAAA,QACR,mGAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,YAAA,GAAe,MAAA,CAAO,YAAA,IAAgB,EAAC;AAC5C,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA,CAAO,MAAA,IAAU,mBAAA,EAAoB;AAGnD,IAAA,IAAI,cAAc,MAAA,CAAO,WAAA;AACzB,IAAA,MAAM,MAAA,GAAS,OAAO,MAAA,IAAU,EAAA;AAChC,IAAA,IAAI,MAAA,CAAO,UAAA,CAAW,UAAU,CAAA,EAAG;AACjC,MAAA,IAAI,gBAAgB,YAAA,EAAc;AAChC,QAAA,IAAA,CAAK,MAAA,CAAO,KAAK,gGAA2F,CAAA;AAAA,MAC9G;AACA,MAAA,WAAA,GAAc,SAAA;AAAA,IAChB,WAAW,MAAA,CAAO,UAAA,CAAW,UAAU,CAAA,IAAK,gBAAgB,SAAA,EAAW;AACrE,MAAA,IAAA,CAAK,MAAA,CAAO,KAAK,2IAAsI,CAAA;AAAA,IACzJ;AAEA,IAAA,IAAA,CAAK,MAAA,GAAS;AAAA,MACZ,GAAG,MAAA;AAAA,MACH,MAAA;AAAA,MACA,WAAA;AAAA,MACA,OAAA,EAAS,MAAA,CAAO,OAAA,IAAW,EAAC;AAAA,MAC5B,OAAA,EAAS,OAAO,OAAA,IAAW,GAAA;AAAA,MAC3B,OAAA,EAAS,OAAO,OAAA,IAAW,CAAA;AAAA,MAC3B,KAAA,EAAO,OAAO,KAAA,IAAS,KAAA;AAAA,MACvB,cAAc,IAAA,CAAK,YAAA;AAAA,MACnB,QAAQ,IAAA,CAAK;AAAA,KACf;AAIA,IAAA,IAAA,CAAK,eAAe,MAAA,CAAO,YAAA,KAAiB,SAAS,IAAI,oBAAA,CAAqB,MAAM,CAAA,GAAI,MAAA,CAAA;AAExF,IAAA,IAAI,OAAO,cAAA,EAAgB;AACzB,MAAA,IAAA,CAAK,cAAA,GAAiB,IAAI,cAAA,CAAe,MAAA,CAAO,cAAc,CAAA;AAAA,IAChE;AACA,IAAA,IAAI,OAAO,uBAAA,EAAyB;AAClC,MAAA,IAAA,CAAK,gBAAA,GAAmB,IAAI,gBAAA,EAAiB;AAAA,IAC/C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,qBAAA,CAAsB,QAAgB,cAAA,EAAqD;AACjG,IAAA,MAAM,UAAA,GAAa,CAAC,MAAA,EAAQ,KAAA,EAAO,OAAO,EAAE,QAAA,CAAA,CAAU,MAAA,IAAU,KAAA,EAAO,WAAA,EAAa,CAAA;AACpF,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,OAAO,cAAA,EAAgB,kBAAkB,YAAA,EAAa;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAgB,OAAA,CACd,QAAA,EACA,UAAuB,EAAC,EACxB,YACA,cAAA,EACY;AACZ,IAAA,MAAM,YAAY,YAAA,EAAa;AAG/B,IAAA,IAAI,KAAK,cAAA,IAAkB,CAAC,IAAA,CAAK,cAAA,CAAe,YAAW,EAAG;AAC5D,MAAA,MAAM,KAAA,GAAQ,IAAI,uBAAA,EAAwB;AAC1C,MAAA,KAAA,CAAM,SAAA,GAAY,SAAA;AAClB,MAAA,MAAM,KAAA;AAAA,IACR;AAGA,IAAA,IAAI,IAAA,CAAK,gBAAA,IAAoB,IAAA,CAAK,gBAAA,CAAiB,iBAAgB,EAAG;AACpE,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,gBAAA,CAAiB,SAAA,EAAU;AAC/C,MAAA,MAAM,KAAA,GAAQ,IAAI,cAAA,CAAe,MAAA,CAAO,cAAc,MAAS,CAAA;AAC/D,MAAA,KAAA,CAAM,SAAA,GAAY,SAAA;AAClB,MAAA,MAAM,KAAA;AAAA,IACR;AAEA,IAAA,MAAM,MAAM,CAAA,EAAG,UAAA,IAAc,KAAK,MAAA,CAAO,OAAO,GAAG,QAAQ,CAAA,CAAA;AAE3D,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,cAAA,EAAgB,kBAAA;AAAA,MAChB,aAAA,EAAe,KAAK,MAAA,CAAO,QAAA;AAAA,MAC3B,eAAA,EAAiB,iBAAiB,WAAW,CAAA,CAAA;AAAA,MAC7C,cAAA,EAAgB,SAAA;AAAA,MAChB,GAAG,KAAK,MAAA,CAAO,OAAA;AAAA,MACf,GAAK,OAAA,CAAQ,OAAA,IAAsC;AAAC,KACtD;AAIA,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,YAAA,EAAc,aAAA,CAAc;AAAA,MACxD,QAAA,EAAU,KAAK,MAAA,CAAO,QAAA;AAAA,MACtB;AAAA,KACD,CAAA;AACD,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,OAAA,CAAQ,eAAe,IAAI,CAAA,EAAG,UAAA,CAAW,UAAU,QAAQ,CAAA,CAAA,EAAI,WAAW,KAAK,CAAA,CAAA;AAAA,IACjF;AAGA,IAAA,IAAI,IAAA,CAAK,MAAA,CAAO,WAAA,KAAgB,SAAA,EAAW;AACzC,MAAA,OAAA,CAAQ,WAAW,CAAA,GAAI,MAAA;AAAA,IACzB;AAKA,IAAA,MAAM,MAAA,GAAA,CAAU,OAAA,CAAQ,MAAA,IAAU,KAAA,EAAO,WAAA,EAAY;AACrD,IAAA,MAAM,cAAA,GAAiB,IAAA,CAAK,qBAAA,CAAsB,MAAA,EAAQ,cAAc,CAAA;AACxE,IAAA,IAAI,cAAA,EAAgB;AAClB,MAAA,OAAA,CAAQ,iBAAiB,CAAA,GAAI,cAAA;AAAA,IAC/B;AAEA,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,SAAA,GAAY,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,CAAK,OAAO,OAAO,CAAA;AAG1E,IAAA,IAAI,gBAAgB,MAAA,EAAQ;AAC1B,MAAA,IAAI,cAAA,CAAe,OAAO,OAAA,EAAS;AACjC,QAAA,UAAA,CAAW,KAAA,EAAM;AAAA,MACnB,CAAA,MAAO;AACL,QAAA,cAAA,CAAe,MAAA,CAAO,gBAAA,CAAiB,OAAA,EAAS,MAAM,UAAA,CAAW,OAAM,EAAG,EAAE,IAAA,EAAM,IAAA,EAAM,CAAA;AAAA,MAC1F;AAAA,IACF;AAEA,IAAA,IAAI;AAEF,MAAA,IAAI,YAAA,GAA4B,EAAE,GAAG,OAAA,EAAS,OAAA,EAAQ;AACtD,MAAA,KAAA,MAAW,WAAA,IAAe,KAAK,YAAA,EAAc;AAC3C,QAAA,IAAI,YAAY,SAAA,EAAW;AACzB,UAAA,YAAA,GAAe,MAAM,WAAA,CAAY,SAAA,CAAU,GAAA,EAAK,YAAY,CAAA;AAAA,QAC9D;AAAA,MACF;AAEA,MAAA,IAAI,IAAA,CAAK,OAAO,KAAA,EAAO;AACrB,QAAA,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA,EAAG,YAAA,CAAa,UAAU,KAAK,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAE,CAAA;AAAA,MACjE;AAEA,MAAA,IAAI,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,QAC9B,GAAG,YAAA;AAAA,QACH,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAKD,MAAA,IAAI,SAAS,MAAA,KAAW,GAAA,IAAO,IAAA,CAAK,YAAA,EAAc,cAAa,EAAG;AAChE,QAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,YAAA,CAAa,aAAA,CAAc;AAAA,UACtD,QAAA,EAAU,KAAK,MAAA,CAAO,QAAA;AAAA,UACtB,SAAA;AAAA,UACA,YAAA,EAAc;AAAA,SACf,CAAA;AACD,QAAA,IAAI,SAAA,EAAW;AACb,UAAA,IAAA,CAAK,MAAA,CAAO,mBAAA,GAAsB,EAAE,MAAA,EAAQ,gBAAgB,CAAA;AAC5D,UAAA,YAAA,GAAe;AAAA,YACb,GAAG,YAAA;AAAA,YACH,OAAA,EAAS;AAAA,cACP,GAAI,YAAA,CAAa,OAAA;AAAA,cACjB,eAAe,CAAA,EAAG,SAAA,CAAU,UAAU,QAAQ,CAAA,CAAA,EAAI,UAAU,KAAK,CAAA;AAAA;AACnE,WACF;AACA,UAAA,QAAA,GAAW,MAAM,MAAM,GAAA,EAAK,EAAE,GAAG,YAAA,EAAc,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AAAA,QAC5E;AAAA,MACF;AAEA,MAAA,YAAA,CAAa,SAAS,CAAA;AAGtB,MAAA,IAAI,KAAK,gBAAA,EAAkB;AACzB,QAAA,IAAA,CAAK,gBAAA,CAAiB,iBAAA,CAAkB,QAAA,CAAS,OAAO,CAAA;AAAA,MAC1D;AAGA,MAAA,IAAI,cAAA,EAAgB,iBAAiB,aAAA,EAAe;AAClD,QAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,UAAA,IAAI,UAAmC,EAAC;AACxC,UAAA,IAAI;AAAE,YAAA,OAAA,GAAU,MAAM,SAAS,IAAA,EAAK;AAAA,UAAG,CAAA,CAAA,MAAQ;AAAA,UAAe;AAC9D,UAAA,IAAA,CAAK,mBAAA,CAAoB,QAAA,CAAS,MAAA,EAAQ,OAAA,EAAS,SAAS,CAAA;AAAA,QAC9D;AACA,QAAA,IAAA,CAAK,gBAAgB,SAAA,EAAU;AAC/B,QAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,WAAA,EAAY;AAC1C,QAAA,OAAO,MAAA;AAAA,MACT;AAEA,MAAA,IAAI,IAAA;AACJ,MAAA,IAAI;AACF,QAAA,IAAA,GAAO,MAAM,SAAS,IAAA,EAAK;AAAA,MAC7B,CAAA,CAAA,MAAQ;AAEN,QAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,UAAA,IAAA,CAAK,mBAAA,CAAoB,SAAS,MAAA,EAAQ;AAAA,YACxC,KAAA,EAAO,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA;AAAA,YAC9B,SAAS,QAAA,CAAS;AAAA,aACjB,SAAS,CAAA;AAAA,QACd;AAEA,QAAA,IAAA,CAAK,gBAAgB,SAAA,EAAU;AAC/B,QAAA,OAAO,KAAA,CAAA;AAAA,MACT;AAEA,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,IAAA,CAAK,oBAAoB,QAAA,CAAS,MAAA,EAAQ,IAAA,IAAQ,IAAI,SAAS,CAAA;AAAA,MACjE;AAGA,MAAA,IAAA,CAAK,gBAAgB,SAAA,EAAU;AAG/B,MAAA,IAAI,MAAA,GAAkB,IAAA;AACtB,MAAA,KAAA,MAAW,WAAA,IAAe,KAAK,YAAA,EAAc;AAC3C,QAAA,IAAI,YAAY,UAAA,EAAY;AAC1B,UAAA,MAAA,GAAS,MAAM,WAAA,CAAY,UAAA,CAAW,GAAA,EAAK,MAAM,CAAA;AAAA,QACnD;AAAA,MACF;AAEA,MAAA,IAAI,IAAA,CAAK,OAAO,KAAA,EAAO;AACrB,QAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,UAAA,EAAa,QAAA,CAAS,MAAM,CAAA,CAAE,CAAA;AAAA,MAClD;AAEA,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,YAAA,CAAa,SAAS,CAAA;AAGtB,MAAA,IACE,iBAAiB,WAAA,IACjB,KAAA,CAAM,UAAA,IACN,KAAA,CAAM,cAAc,GAAA,EACpB;AACA,QAAA,IAAA,CAAK,gBAAgB,SAAA,EAAU;AAAA,MACjC,CAAA,MAAA,IAAW,KAAA,YAAiB,YAAA,IAAgB,KAAA,YAAiB,YAAA,EAAc;AACzE,QAAA,IAAA,CAAK,gBAAgB,SAAA,EAAU;AAAA,MACjC;AAGA,MAAA,IAAI,KAAA,YAAiB,WAAA,IAAe,CAAC,KAAA,CAAM,SAAA,EAAW;AACpD,QAAA,KAAA,CAAM,SAAA,GAAY,SAAA;AAAA,MACpB;AAGA,MAAA,IAAI,iBAAiB,KAAA,EAAO;AAC1B,QAAA,KAAA,MAAW,WAAA,IAAe,KAAK,YAAA,EAAc;AAC3C,UAAA,IAAI,YAAY,OAAA,EAAS;AACvB,YAAA,MAAM,WAAA,CAAY,OAAA,CAAQ,GAAA,EAAK,KAAK,CAAA;AAAA,UACtC;AAAA,QACF;AAAA,MACF;AAEA,MAAA,IAAI,iBAAiB,KAAA,EAAO;AAC1B,QAAA,IAAI,KAAA,CAAM,SAAS,YAAA,EAAc;AAE/B,UAAA,IAAI,cAAA,EAAgB,QAAQ,OAAA,EAAS;AACnC,YAAA,MAAM,UAAA,GAAa,IAAI,WAAA,CAAY,iBAAA,EAAmB,iBAAiB,CAAA;AACvE,YAAA,UAAA,CAAW,SAAA,GAAY,SAAA;AACvB,YAAA,MAAM,UAAA;AAAA,UACR;AACA,UAAA,IAAA,CAAK,gBAAgB,SAAA,EAAU;AAC/B,UAAA,MAAM,YAAA,GAAe,IAAI,YAAA,CAAa,IAAA,CAAK,OAAO,OAAO,CAAA;AACzD,UAAA,YAAA,CAAa,SAAA,GAAY,SAAA;AACzB,UAAA,MAAM,YAAA;AAAA,QACR;AACA,QAAA,IAAI,iBAAiB,WAAA,EAAa;AAChC,UAAA,MAAM,KAAA;AAAA,QACR;AAAA,MACF;AAEA,MAAA,MAAM,YAAA,GAAe,IAAI,YAAA,CAAa,wBAAA,EAA0B,KAAK,CAAA;AACrE,MAAA,YAAA,CAAa,SAAA,GAAY,SAAA;AACzB,MAAA,IAAA,CAAK,gBAAgB,SAAA,EAAU;AAC/B,MAAA,MAAM,YAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAgB,gBAAA,CACd,QAAA,EACA,OAAA,GAAuB,EAAC,EACxB,UAAA,EACA,OAAA,GAAkB,IAAA,CAAK,MAAA,CAAO,OAAA,EAC9B,cAAA,EACY;AACZ,IAAA,IAAI,SAAA;AAIJ,IAAA,MAAM,iBAAiB,IAAA,CAAK,qBAAA,CAAsB,OAAA,CAAQ,MAAA,IAAU,OAAO,cAAc,CAAA;AACzF,IAAA,MAAM,iBAA6C,cAAA,GAC/C,EAAE,GAAG,cAAA,EAAgB,gBAAe,GACpC,cAAA;AAEJ,IAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,OAAA,EAAS,OAAA,EAAA,EAAW;AACnD,MAAA,IAAI;AACF,QAAA,OAAO,MAAM,IAAA,CAAK,OAAA,CAAW,QAAA,EAAU,OAAA,EAAS,YAAY,cAAc,CAAA;AAAA,MAC5E,SAAS,KAAA,EAAO;AACd,QAAA,SAAA,GAAY,KAAA,YAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,MAAM,eAAe,CAAA;AAGtE,QAAA,IAAI,cAAA,EAAgB,QAAQ,OAAA,EAAS;AACnC,UAAA,MAAM,SAAA;AAAA,QACR;AAGA,QAAA,IACE,SAAA,YAAqB,WAAA,IACrB,SAAA,CAAU,UAAA,IACV,SAAA,CAAU,UAAA,IAAc,GAAA,IACxB,SAAA,CAAU,UAAA,GAAa,GAAA,IACvB,SAAA,CAAU,UAAA,KAAe,GAAA,EACzB;AACA,UAAA,MAAM,SAAA;AAAA,QACR;AAGA,QAAA,IAAI,YAAY,OAAA,EAAS;AACvB,UAAA;AAAA,QACF;AAGA,QAAA,IAAI,KAAA;AACJ,QAAA,IAAI,SAAA,YAAqB,cAAA,IAAkB,SAAA,CAAU,UAAA,EAAY;AAC/D,UAAA,KAAA,GAAQ,UAAU,UAAA,GAAa,GAAA;AAAA,QACjC,CAAA,MAAO;AACL,UAAA,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,GAAA,GAAO,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,OAAO,CAAA,GAAI,IAAA,CAAK,MAAA,EAAO,GAAI,GAAA,EAAM,GAAK,CAAA;AAAA,QAC5E;AACA,QAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,KAAK,CAAC,CAAA;AAEzD,QAAA,IAAI,IAAA,CAAK,OAAO,KAAA,EAAO;AACrB,UAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,CAAA,cAAA,EAAiB,OAAA,GAAU,CAAC,CAAA,CAAA,EAAI,OAAO,CAAA,OAAA,EAAU,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAC,CAAA,EAAA,CAAI,CAAA;AAAA,QACzF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,MAAM,IAAI,YAAA,CAAa,CAAA,qBAAA,EAAwB,OAAO,YAAY,SAAS,CAAA;AAAA,EAC7E;AAAA;AAAA;AAAA;AAAA,EAKU,mBAAA,CAAoB,MAAA,EAAgB,IAAA,EAA+B,SAAA,EAA2B;AACtG,IAAA,MAAM,UAAW,IAAA,CAAK,KAAA,IAAqB,IAAA,CAAK,OAAA,IAAsB,QAAQ,MAAM,CAAA,CAAA;AAEpF,IAAA,MAAM,cAAc,MAAmB;AACrC,MAAA,QAAQ,MAAA;AAAQ,QACd,KAAK,GAAA;AACH,UAAA,OAAO,IAAI,WAAA,CAAY,OAAA,EAAS,aAAA,EAAe,GAAG,CAAA;AAAA,QACpD,KAAK,GAAA;AACH,UAAA,OAAO,IAAI,oBAAoB,OAAO,CAAA;AAAA,QACxC,KAAK,GAAA;AACH,UAAA,OAAO,IAAI,WAAA,CAAY,OAAA,EAAS,WAAA,EAAa,GAAG,CAAA;AAAA,QAClD,KAAK,GAAA;AACH,UAAA,OAAO,IAAI,WAAA,CAAY,OAAA,EAAS,WAAA,EAAa,GAAG,CAAA;AAAA,QAClD,KAAK,GAAA;AACH,UAAA,OAAO,IAAI,WAAA,CAAY,OAAA,EAAS,mBAAA,EAAqB,GAAG,CAAA;AAAA,QAC1D,KAAK,GAAA,EAAK;AACR,UAAA,MAAM,UAAA,GAAc,IAAA,CAAK,WAAA,IAAuC,IAAA,CAAK,UAAA;AACrE,UAAA,OAAO,IAAI,eAAe,UAAU,CAAA;AAAA,QACtC;AAAA,QACA,KAAK,GAAA;AAAA,QACL,KAAK,GAAA;AAAA,QACL,KAAK,GAAA;AAAA,QACL,KAAK,GAAA;AACH,UAAA,OAAO,IAAI,wBAAwB,OAAO,CAAA;AAAA,QAC5C;AACE,UAAA,OAAO,IAAI,WAAA,CAAY,OAAA,EAAS,eAAA,EAAiB,MAAM,CAAA;AAAA;AAC3D,IACF,CAAA;AAEA,IAAA,MAAM,QAAQ,WAAA,EAAY;AAC1B,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,KAAA,CAAM,SAAA,GAAY,SAAA;AAAA,IACpB;AACA,IAAA,MAAM,KAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA,EAKU,iBAAiB,MAAA,EAAyC;AAClE,IAAA,MAAM,KAAA,GAAQ,IAAI,eAAA,EAAgB;AAElC,IAAA,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,OAAA,CAAQ,CAAC,CAAC,GAAA,EAAK,KAAK,CAAA,KAAM;AAC/C,MAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAAM;AACzC,QAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,UAAA,KAAA,CAAM,OAAA,CAAQ,CAAC,IAAA,KAAS,KAAA,CAAM,OAAO,GAAA,EAAK,MAAA,CAAO,IAAI,CAAC,CAAC,CAAA;AAAA,QACzD,CAAA,MAAO;AACL,UAAA,KAAA,CAAM,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,QACjC;AAAA,MACF;AAAA,IACF,CAAC,CAAA;AAED,IAAA,MAAM,WAAA,GAAc,MAAM,QAAA,EAAS;AACnC,IAAA,OAAO,WAAA,GAAc,CAAA,CAAA,EAAI,WAAW,CAAA,CAAA,GAAK,EAAA;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa,MAAA,EAAyC;AACpD,IAAA,IAAA,CAAK,MAAA,GAAS;AAAA,MACZ,GAAG,IAAA,CAAK,MAAA;AAAA,MACR,GAAG,MAAA;AAAA,MACH,OAAA,EAAS;AAAA,QACP,GAAG,KAAK,MAAA,CAAO,OAAA;AAAA,QACf,GAAI,MAAA,CAAO,OAAA,IAAW;AAAC;AACzB,KACF;AACA,IAAA,IAAI,OAAO,MAAA,EAAQ;AACjB,MAAA,IAAA,CAAK,SAAS,MAAA,CAAO,MAAA;AAAA,IACvB;AACA,IAAA,IAAI,OAAO,YAAA,EAAc;AACvB,MAAA,IAAA,CAAK,eAAe,MAAA,CAAO,YAAA;AAAA,IAC7B;AAGA,IAAA,IAAI,MAAA,CAAO,YAAA,KAAiB,MAAA,IAAa,MAAA,CAAO,WAAW,MAAA,EAAW;AACpE,MAAA,IAAA,CAAK,YAAA,GACH,IAAA,CAAK,MAAA,CAAO,YAAA,KACX,IAAA,CAAK,MAAA,CAAO,MAAA,GAAS,IAAI,oBAAA,CAAqB,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA,GAAI,MAAA,CAAA;AAAA,IACzE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,SAAA,GAAwC;AACtC,IAAA,OAAO,EAAE,GAAG,IAAA,CAAK,MAAA,EAAO;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,kBAAA,GAA6C;AAC3C,IAAA,OAAO,IAAA,CAAK,gBAAA,EAAkB,SAAA,EAAU,IAAK,IAAA;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA,EAKA,uBAAA,GAAuD;AACrD,IAAA,OAAO,IAAA,CAAK,cAAA,EAAgB,SAAA,EAAU,IAAK,IAAA;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,WAAA,GAA8D;AAClE,IAAA,OAAO,IAAA,CAAK,QAAQ,gBAAgB,CAAA;AAAA,EACtC;AACF,CAAA;;;ACpeO,IAAM,SAAA,GAAN,cAAwB,UAAA,CAAW;AAAA,EACxC,YAAY,MAAA,EAAyB;AACnC,IAAA,MAAM,UAAA,GAA+B;AAAA,MACnC,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,UAAU,MAAA,CAAO,QAAA;AAAA,MACjB,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,OAAA,EAAS,CAAA;AAAA,MACT,OAAO,MAAA,CAAO,KAAA;AAAA,MACd,aAAa,MAAA,CAAO;AAAA,KACtB;AACA,IAAA,KAAA,CAAM,UAAU,CAAA;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,4BAA4B,UAAA,EAAuD;AACvF,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,MACV,qCAAqC,UAAU,CAAA;AAAA,KACjD;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,UAAA,EAAuD;AAC1E,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,MACV,qCAAqC,UAAU,CAAA,aAAA,CAAA;AAAA,MAC/C,EAAE,QAAQ,MAAA;AAAO,KACnB;AAAA,EACF;AAAA,EAEA,MAAM,cAAA,CAAe,UAAA,EAAoB,cAAA,EAA0D;AACjG,IAAA,OAAO,IAAA,CAAK,gBAAA;AAAA,MACV,qCAAqC,UAAU,CAAA,UAAA,CAAA;AAAA,MAC/C,EAAE,QAAQ,MAAA,EAAO;AAAA,MACjB,MAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAA,CACJ,UAAA,EACA,KAAA,EACmC;AACnC,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,MACV,qCAAqC,UAAU,CAAA,gBAAA,CAAA;AAAA,MAC/C;AAAA,QACE,MAAA,EAAQ,MAAA;AAAA,QACR,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,KAAK;AAAA;AAC5B,KACF;AAAA,EACF;AAAA,EAEA,MAAM,uBAAA,CACJ,UAAA,EACA,KAAA,EACoC;AACpC,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,MACV,qCAAqC,UAAU,CAAA,mBAAA,CAAA;AAAA,MAC/C;AAAA,QACE,MAAA,EAAQ,MAAA;AAAA,QACR,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,KAAK;AAAA;AAC5B,KACF;AAAA,EACF;AAAA,EAEC,MAAM,qBAAqB,UAAA,EAA0D;AACpF,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,MACV,oCAAoC,UAAU,CAAA,UAAA;AAAA,KAChD;AAAA,EACF;AAAA,EAEA,MAAM,eAAA,CACJ,UAAA,EACA,cAAA,EACsB;AACtB,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,MACV,qCAAqC,UAAU,CAAA,cAAA,CAAA;AAAA,MAC/C,EAAE,QAAQ,KAAA,EAAM;AAAA,MAChB,MAAA;AAAA,MACA,EAAE,GAAG,cAAA,EAAgB,YAAA,EAAc,aAAA;AAAc,KACnD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAA,GAAiC;AACrC,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA,CAA6B,mBAAmB,CAAA;AACvE,IAAA,OAAO,GAAA,CAAI,KAAA;AAAA,EACb;AAAA,EAEA,MAAM,eAAe,KAAA,EAAqD;AACxE,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA,CAAqC,mBAAA,EAAqB;AAAA,MAC/E,MAAA,EAAQ,KAAA;AAAA,MACR,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,OAAO;AAAA,KACtC,CAAA;AACD,IAAA,OAAO,GAAA,CAAI,OAAA;AAAA,EACb;AAAA,EAEA,MAAM,YAAA,GAA4C;AAChD,IAAA,OAAO,KAAK,OAAA,CAA4B,2BAAA,EAA6B,EAAE,MAAA,EAAQ,QAAQ,CAAA;AAAA,EACzF;AAAA,EAEA,MAAM,mBAAmB,OAAA,EAA4D;AACnF,IAAA,MAAM,SAAkC,EAAC;AACzC,IAAA,IAAI,OAAA,EAAS,UAAA,EAAY,MAAA,CAAO,UAAA,GAAa,OAAA,CAAQ,UAAA;AACrD,IAAA,IAAI,OAAA,EAAS,SAAA,EAAW,MAAA,CAAO,SAAA,GAAY,OAAA,CAAQ,SAAA;AACnD,IAAA,IAAI,OAAA,EAAS,OAAA,EAAS,MAAA,CAAO,OAAA,GAAU,OAAA,CAAQ,OAAA;AAC/C,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,MACV,CAAA,sCAAA,EAAyC,IAAA,CAAK,gBAAA,CAAiB,MAAM,CAAC,CAAA;AAAA,KACxE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,uBAAA,GAAkD;AACtD,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA;AAAA,MACrB;AAAA,KACF;AACA,IAAA,OAAO,GAAA,CAAI,IAAA;AAAA,EACb;AAAA,EAEA,MAAM,mBAAA,GAA0D;AAC9D,IAAA,OAAO,IAAA,CAAK,QAAmC,8BAA8B,CAAA;AAAA,EAC/E;AAAA,EAEA,MAAM,iBAAiB,IAAA,EAAsC;AAC3D,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA;AAAA,MACrB,CAAA,6BAAA,EAAgC,kBAAA,CAAmB,IAAI,CAAC,CAAA;AAAA,KAC1D;AACA,IAAA,OAAO,GAAA,CAAI,cAAA;AAAA,EACb;AACF","file":"index.mjs","sourcesContent":["/**\n * Pluggable authentication for BaseClient.\n *\n * A TokenProvider supplies the credential used for the Authorization header on\n * every request, resolved per-request (async) so callers can source short-lived\n * or rotating credentials (OAuth2 client-credentials, STS, Vault / Secrets\n * Manager) instead of a single static API key. The default StaticApiKeyProvider\n * preserves the original `apiKey` behavior with zero change for existing callers.\n */\n\nexport interface AuthCredential {\n  /** Authorization scheme (e.g. 'Bearer'); defaults to 'Bearer' when omitted. */\n  scheme?: string;\n  /** The credential value (bearer token / API key). */\n  token: string;\n}\n\nexport interface TokenProviderContext {\n  tenantId: string;\n  requestId: string;\n  /** When true, bypass any cache and obtain a fresh credential (e.g. after a 401). */\n  forceRefresh?: boolean;\n}\n\nexport interface TokenProvider {\n  /** Resolve the credential for a request, or null to send no Authorization header. */\n  getCredential(ctx: TokenProviderContext): Promise<AuthCredential | null>;\n  /** Whether this provider can obtain a fresh credential on demand (drives 401 retry). */\n  canRefresh?(): boolean;\n}\n\n/**\n * Default provider: wraps a static API key. Returns null when the key is empty\n * so the client sends no Authorization header, matching the pre-provider behavior.\n */\nexport class StaticApiKeyProvider implements TokenProvider {\n  constructor(private readonly apiKey: string) {}\n\n  async getCredential(): Promise<AuthCredential | null> {\n    return this.apiKey ? { scheme: 'Bearer', token: this.apiKey } : null;\n  }\n\n  canRefresh(): boolean {\n    return false;\n  }\n}\n\ninterface CachedToken {\n  token: string;\n  expiresAt?: number;\n}\n\nexport interface RefreshingTokenProviderOptions {\n  /** Fetches a fresh token. `expiresAt` is epoch milliseconds (optional). */\n  fetchToken: () => Promise<CachedToken>;\n  /** Refresh this many ms before expiry (default: 30_000). */\n  skewMs?: number;\n  /** Authorization scheme to emit (default: 'Bearer'). */\n  scheme?: string;\n  /** Observe each successful (re)fetch — for logging / metrics. */\n  onRotate?: (meta: { expiresAt?: number }) => void;\n  /** Injectable clock (default: Date.now). */\n  now?: () => number;\n}\n\n/**\n * Caches a fetched token and refreshes it when it is within the skew window of\n * expiry or when `forceRefresh` is requested. Concurrent refreshes are de-duped\n * into a single in-flight fetch.\n */\nexport class RefreshingTokenProvider implements TokenProvider {\n  private cached: CachedToken | null = null;\n  private inFlight: Promise<CachedToken> | null = null;\n  private readonly skewMs: number;\n  private readonly scheme: string;\n  private readonly now: () => number;\n\n  constructor(private readonly opts: RefreshingTokenProviderOptions) {\n    this.skewMs = opts.skewMs ?? 30_000;\n    this.scheme = opts.scheme ?? 'Bearer';\n    this.now = opts.now ?? (() => Date.now());\n  }\n\n  canRefresh(): boolean {\n    return true;\n  }\n\n  async getCredential(ctx?: TokenProviderContext): Promise<AuthCredential | null> {\n    const forceRefresh = ctx?.forceRefresh ?? false;\n    if (!forceRefresh && this.cached && !this.isExpiring(this.cached)) {\n      return { scheme: this.scheme, token: this.cached.token };\n    }\n    const fresh = await this.refresh();\n    return { scheme: this.scheme, token: fresh.token };\n  }\n\n  private isExpiring(token: CachedToken): boolean {\n    if (token.expiresAt === undefined) {\n      return false;\n    }\n    return this.now() >= token.expiresAt - this.skewMs;\n  }\n\n  private refresh(): Promise<CachedToken> {\n    if (this.inFlight) {\n      return this.inFlight;\n    }\n    this.inFlight = (async () => {\n      try {\n        const fresh = await this.opts.fetchToken();\n        this.cached = fresh;\n        this.opts.onRotate?.({ expiresAt: fresh.expiresAt });\n        return fresh;\n      } finally {\n        this.inFlight = null;\n      }\n    })();\n    return this.inFlight;\n  }\n}\n","/**\n * Error hierarchy for Vesant SDK\n *\n * Provides structured error handling with specific error types\n * for different failure scenarios.\n */\n\nexport class VesantError extends Error {\n  public requestId?: string;\n\n  constructor(\n    message: string,\n    public code: string,\n    public statusCode?: number,\n    public details?: Record<string, unknown>\n  ) {\n    super(message);\n    this.name = 'VesantError';\n    Object.setPrototypeOf(this, VesantError.prototype);\n  }\n}\n\n/** @deprecated Use VesantError instead */\nexport const CGSError = VesantError;\n/** @deprecated Use VesantError instead */\nexport type CGSError = VesantError;\n\nexport class NetworkError extends VesantError {\n  constructor(message: string, public originalError?: unknown) {\n    super(message, 'NETWORK_ERROR');\n    this.name = 'NetworkError';\n    Object.setPrototypeOf(this, NetworkError.prototype);\n  }\n}\n\nexport class ValidationError extends VesantError {\n  constructor(message: string, fields?: string[]) {\n    super(message, 'VALIDATION_ERROR', 400, { fields });\n    this.name = 'ValidationError';\n    Object.setPrototypeOf(this, ValidationError.prototype);\n  }\n}\n\nexport class ServiceUnavailableError extends VesantError {\n  constructor(message: string = 'Service unavailable') {\n    super(message, 'SERVICE_UNAVAILABLE', 503);\n    this.name = 'ServiceUnavailableError';\n    Object.setPrototypeOf(this, ServiceUnavailableError.prototype);\n  }\n}\n\nexport class ComplianceBlockedError extends VesantError {\n  constructor(reasons: string[]) {\n    super('Access blocked due to compliance rules', 'COMPLIANCE_BLOCKED', 403, { reasons });\n    this.name = 'ComplianceBlockedError';\n    Object.setPrototypeOf(this, ComplianceBlockedError.prototype);\n  }\n}\n\nexport class AuthenticationError extends VesantError {\n  constructor(message: string = 'Authentication failed') {\n    super(message, 'AUTHENTICATION_ERROR', 401);\n    this.name = 'AuthenticationError';\n    Object.setPrototypeOf(this, AuthenticationError.prototype);\n  }\n}\n\nexport class RateLimitError extends VesantError {\n  constructor(public retryAfter?: number) {\n    super('Rate limit exceeded', 'RATE_LIMIT_EXCEEDED', 429, { retryAfter });\n    this.name = 'RateLimitError';\n    Object.setPrototypeOf(this, RateLimitError.prototype);\n  }\n}\n\nexport class TimeoutError extends VesantError {\n  constructor(public timeout: number) {\n    super(`Request timeout after ${timeout}ms`, 'TIMEOUT', 408, { timeout });\n    this.name = 'TimeoutError';\n    Object.setPrototypeOf(this, TimeoutError.prototype);\n  }\n}\n\nexport class ComplianceError extends VesantError {\n  constructor(\n    message: string,\n    public originalError?: unknown,\n    code: string = 'COMPLIANCE_ERROR'\n  ) {\n    super(message, code);\n    this.name = 'ComplianceError';\n    Object.setPrototypeOf(this, ComplianceError.prototype);\n  }\n}\n\nexport class CircuitBreakerOpenError extends VesantError {\n  constructor() {\n    super('Circuit breaker is open — requests are temporarily blocked', 'CIRCUIT_BREAKER_OPEN', 503);\n    this.name = 'CircuitBreakerOpenError';\n    Object.setPrototypeOf(this, CircuitBreakerOpenError.prototype);\n  }\n}\n","/**\n * Circuit breaker pattern for resilient HTTP requests.\n *\n * States: closed (normal) -> open (failing) -> half-open (testing) -> closed\n */\n\nexport type CircuitBreakerState = 'closed' | 'open' | 'half-open';\n\nexport interface CircuitBreakerConfig {\n  /** Number of consecutive failures before opening the circuit (default: 5) */\n  failureThreshold?: number;\n  /** Time in ms to wait before transitioning from open to half-open (default: 30000) */\n  resetTimeout?: number;\n  /** Number of successes in half-open state before closing (default: 1) */\n  successThreshold?: number;\n}\n\nexport interface CircuitBreakerStatus {\n  state: CircuitBreakerState;\n  failures: number;\n  successes: number;\n  lastFailureTime: number | null;\n  nextRetryTime: number | null;\n}\n\nexport class CircuitBreaker {\n  private state: CircuitBreakerState = 'closed';\n  private failures = 0;\n  private successes = 0;\n  private lastFailureTime: number | null = null;\n\n  private readonly failureThreshold: number;\n  private readonly resetTimeout: number;\n  private readonly successThreshold: number;\n\n  constructor(config: CircuitBreakerConfig = {}) {\n    this.failureThreshold = config.failureThreshold ?? 5;\n    this.resetTimeout = config.resetTimeout ?? 30000;\n    this.successThreshold = config.successThreshold ?? 1;\n  }\n\n  /**\n   * Check if a request can proceed through the circuit breaker.\n   */\n  canExecute(): boolean {\n    if (this.state === 'closed') {\n      return true;\n    }\n\n    if (this.state === 'open') {\n      const now = Date.now();\n      if (this.lastFailureTime && now - this.lastFailureTime >= this.resetTimeout) {\n        this.state = 'half-open';\n        this.successes = 0;\n        return true;\n      }\n      return false;\n    }\n\n    // half-open: allow requests through for testing\n    return true;\n  }\n\n  /**\n   * Record a successful request.\n   */\n  onSuccess(): void {\n    if (this.state === 'half-open') {\n      this.successes++;\n      if (this.successes >= this.successThreshold) {\n        this.state = 'closed';\n        this.failures = 0;\n        this.successes = 0;\n        this.lastFailureTime = null;\n      }\n    } else if (this.state === 'closed') {\n      this.failures = 0;\n    }\n  }\n\n  /**\n   * Record a failed request.\n   */\n  onFailure(): void {\n    this.failures++;\n    this.lastFailureTime = Date.now();\n\n    if (this.state === 'half-open') {\n      this.state = 'open';\n      this.successes = 0;\n    } else if (this.state === 'closed' && this.failures >= this.failureThreshold) {\n      this.state = 'open';\n    }\n  }\n\n  /**\n   * Get current circuit breaker status.\n   */\n  getStatus(): CircuitBreakerStatus {\n    return {\n      state: this.state,\n      failures: this.failures,\n      successes: this.successes,\n      lastFailureTime: this.lastFailureTime,\n      nextRetryTime:\n        this.state === 'open' && this.lastFailureTime\n          ? this.lastFailureTime + this.resetTimeout\n          : null,\n    };\n  }\n\n  /**\n   * Reset the circuit breaker to its initial closed state.\n   */\n  reset(): void {\n    this.state = 'closed';\n    this.failures = 0;\n    this.successes = 0;\n    this.lastFailureTime = null;\n  }\n}\n","/**\n * Rate limit tracking from API response headers.\n *\n * Tracks X-RateLimit-* headers to enable pre-flight checks\n * before making requests.\n */\n\nexport interface RateLimitStatus {\n  /** Maximum requests allowed in the window */\n  limit: number | null;\n  /** Remaining requests in the current window */\n  remaining: number | null;\n  /** Unix timestamp (seconds) when the rate limit resets */\n  reset: number | null;\n  /** Seconds until the rate limit resets */\n  retryAfter: number | null;\n}\n\nexport class RateLimitTracker {\n  private limit: number | null = null;\n  private remaining: number | null = null;\n  private reset: number | null = null;\n  private retryAfter: number | null = null;\n\n  /**\n   * Extract rate limit information from response headers.\n   */\n  updateFromHeaders(headers: Headers): void {\n    const limit = headers.get('x-ratelimit-limit');\n    const remaining = headers.get('x-ratelimit-remaining');\n    const reset = headers.get('x-ratelimit-reset');\n    const retryAfter = headers.get('retry-after');\n\n    if (limit !== null) this.limit = parseInt(limit, 10);\n    if (remaining !== null) this.remaining = parseInt(remaining, 10);\n    if (reset !== null) this.reset = parseInt(reset, 10);\n    if (retryAfter !== null) this.retryAfter = parseInt(retryAfter, 10);\n  }\n\n  /**\n   * Check if the rate limit has been exceeded based on tracked headers.\n   */\n  isLimitExceeded(): boolean {\n    if (this.remaining !== null && this.remaining <= 0) {\n      // Check if the reset time has passed\n      if (this.reset !== null) {\n        const now = Math.floor(Date.now() / 1000);\n        if (now >= this.reset) {\n          // Reset window has passed, allow requests\n          this.remaining = null;\n          this.reset = null;\n          this.retryAfter = null;\n          return false;\n        }\n      }\n      return true;\n    }\n    return false;\n  }\n\n  /**\n   * Get current rate limit status.\n   */\n  getStatus(): RateLimitStatus {\n    return {\n      limit: this.limit,\n      remaining: this.remaining,\n      reset: this.reset,\n      retryAfter: this.retryAfter,\n    };\n  }\n}\n","import type { Logger } from './config';\n\nexport function createConsoleLogger(): Logger {\n  return {\n    debug(message: string, meta?: Record<string, unknown>) {\n      console.log(`[Vesant SDK] ${message}`, meta !== undefined ? meta : '');\n    },\n    info(message: string, meta?: Record<string, unknown>) {\n      console.info(`[Vesant SDK] ${message}`, meta !== undefined ? meta : '');\n    },\n    warn(message: string, meta?: Record<string, unknown>) {\n      console.warn(`[Vesant SDK] ${message}`, meta !== undefined ? meta : '');\n    },\n    error(message: string, meta?: Record<string, unknown>) {\n      console.error(`[Vesant SDK] ${message}`, meta !== undefined ? meta : '');\n    },\n  };\n}\n\nexport const noopLogger: Logger = {\n  debug() {},\n  info() {},\n  warn() {},\n  error() {},\n};\n","/**\n * Single source of truth for the SDK version.\n */\nexport const SDK_VERSION = '1.8.0';\n","/**\n * Shared browser utility functions.\n *\n * Extracted from ciphertext.ts and hooks.ts to avoid duplication.\n * All functions include SSR guards for safe server-side rendering.\n */\n\n/**\n * Generate a UUID v4\n */\nexport function generateUUID(): string {\n  if (typeof crypto !== 'undefined' && crypto.randomUUID) {\n    return crypto.randomUUID();\n  }\n\n  // Fallback for older browsers\n  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (c) => {\n    const r = (Math.random() * 16) | 0;\n    const v = c === 'x' ? r : (r & 0x3) | 0x8;\n    return v.toString(16);\n  });\n}\n\n/**\n * Generate a unique device ID that persists across sessions.\n * Falls back to a random UUID when localStorage is unavailable (SSR).\n */\nexport function generateDeviceId(): string {\n  if (typeof window === 'undefined' || typeof localStorage === 'undefined') {\n    return generateUUID();\n  }\n\n  const storageKey = 'vesant_device_id';\n  let deviceId = localStorage.getItem(storageKey);\n\n  if (!deviceId) {\n    deviceId = generateUUID();\n    localStorage.setItem(storageKey, deviceId);\n  }\n\n  return deviceId;\n}\n\n/**\n * Detect browser information from user agent.\n * Returns safe defaults when running server-side.\n */\nexport function getBrowserInfo(): {\n  browser: string;\n  browser_version: string;\n  os: string;\n  os_version: string;\n} {\n  if (typeof navigator === 'undefined') {\n    return { browser: 'unknown', browser_version: '', os: 'unknown', os_version: '' };\n  }\n\n  const ua = navigator.userAgent;\n  let browser = 'unknown';\n  let browserVersion = '';\n  let os = 'unknown';\n  let osVersion = '';\n\n  // Detect browser\n  if (ua.includes('Firefox/')) {\n    browser = 'Firefox';\n    browserVersion = ua.match(/Firefox\\/([\\d.]+)/)?.[1] || '';\n  } else if (ua.includes('Edg/')) {\n    browser = 'Edge';\n    browserVersion = ua.match(/Edg\\/([\\d.]+)/)?.[1] || '';\n  } else if (ua.includes('Chrome/')) {\n    browser = 'Chrome';\n    browserVersion = ua.match(/Chrome\\/([\\d.]+)/)?.[1] || '';\n  } else if (ua.includes('Safari/') && !ua.includes('Chrome')) {\n    browser = 'Safari';\n    browserVersion = ua.match(/Version\\/([\\d.]+)/)?.[1] || '';\n  } else if (ua.includes('Opera') || ua.includes('OPR/')) {\n    browser = 'Opera';\n    browserVersion = ua.match(/(?:Opera|OPR)\\/([\\d.]+)/)?.[1] || '';\n  }\n\n  // Detect OS\n  if (ua.includes('Windows')) {\n    os = 'Windows';\n    if (ua.includes('Windows NT 10.0')) osVersion = '10';\n    else if (ua.includes('Windows NT 6.3')) osVersion = '8.1';\n    else if (ua.includes('Windows NT 6.2')) osVersion = '8';\n    else if (ua.includes('Windows NT 6.1')) osVersion = '7';\n  } else if (ua.includes('Mac OS X')) {\n    os = 'macOS';\n    osVersion = ua.match(/Mac OS X ([\\d_]+)/)?.[1]?.replace(/_/g, '.') || '';\n  } else if (ua.includes('Linux')) {\n    os = 'Linux';\n  } else if (ua.includes('Android')) {\n    os = 'Android';\n    osVersion = ua.match(/Android ([\\d.]+)/)?.[1] || '';\n  } else if (ua.includes('iOS') || ua.includes('iPhone') || ua.includes('iPad')) {\n    os = 'iOS';\n    osVersion = ua.match(/OS ([\\d_]+)/)?.[1]?.replace(/_/g, '.') || '';\n  }\n\n  return { browser, browser_version: browserVersion, os, os_version: osVersion };\n}\n","/**\n * Base HTTP client for all Vesant SDK clients\n *\n * Provides common functionality:\n * - Request/response handling\n * - Error handling\n * - Retry logic with exponential backoff\n * - Timeout management\n * - Debug logging\n */\n\nimport type { BaseClientConfig, Logger, RequestInterceptor, RequestOptions } from './config';\nimport { type TokenProvider, StaticApiKeyProvider } from './auth';\nimport {\n  VesantError,\n  NetworkError,\n  TimeoutError,\n  AuthenticationError,\n  RateLimitError,\n  ServiceUnavailableError,\n  ValidationError,\n  CircuitBreakerOpenError,\n} from './errors';\nimport { CircuitBreaker, type CircuitBreakerStatus } from './circuit-breaker';\nimport { RateLimitTracker, type RateLimitStatus } from './rate-limiter';\nimport { createConsoleLogger } from './logger';\nimport { SDK_VERSION } from './version';\nimport { generateUUID } from '../shared/browser-utils';\n\nexport abstract class BaseClient {\n  protected config: BaseClientConfig & { timeout: number; retries: number };\n  protected logger: Logger;\n  private interceptors: RequestInterceptor[];\n  private circuitBreaker: CircuitBreaker | null = null;\n  private rateLimitTracker: RateLimitTracker | null = null;\n  private authProvider: TokenProvider | undefined;\n\n  constructor(config: BaseClientConfig) {\n    if (!config.baseURL?.trim()) {\n      throw new ValidationError('baseURL is required and must be a non-empty string', ['baseURL']);\n    }\n    if (!config.tenantId?.trim()) {\n      throw new ValidationError('tenantId is required and must be a non-empty string', ['tenantId']);\n    }\n\n    // The SDK relies on a global fetch (Node.js >= 18). Fail fast with a clear\n    // message rather than a later \"fetch is not defined\" ReferenceError.\n    if (typeof fetch === 'undefined') {\n      throw new VesantError(\n        'The Vesant SDK requires a global fetch (Node.js >= 18). Upgrade Node or provide a fetch polyfill.',\n        'RUNTIME_UNSUPPORTED'\n      );\n    }\n\n    this.interceptors = config.interceptors || [];\n    this.logger = config.logger || createConsoleLogger();\n\n    // Auto-detect environment from API key prefix\n    let environment = config.environment;\n    const apiKey = config.apiKey || '';\n    if (apiKey.startsWith('pk_test_')) {\n      if (environment === 'production') {\n        this.logger.warn('Sandbox API key (pk_test_*) used with environment: \"production\" — overriding to \"sandbox\"');\n      }\n      environment = 'sandbox';\n    } else if (apiKey.startsWith('pk_live_') && environment === 'sandbox') {\n      this.logger.warn('Production API key (pk_live_*) used with environment: \"sandbox\" — sandbox isolation will still be applied for backward compatibility');\n    }\n\n    this.config = {\n      ...config,\n      apiKey,\n      environment,\n      headers: config.headers || {},\n      timeout: config.timeout || 10000,\n      retries: config.retries ?? 3,\n      debug: config.debug || false,\n      interceptors: this.interceptors,\n      logger: this.logger,\n    };\n\n    // Default to a static-apiKey provider so the apiKey path is unchanged; an\n    // explicit authProvider (OAuth2 / rotating secrets) takes precedence.\n    this.authProvider = config.authProvider ?? (apiKey ? new StaticApiKeyProvider(apiKey) : undefined);\n\n    if (config.circuitBreaker) {\n      this.circuitBreaker = new CircuitBreaker(config.circuitBreaker);\n    }\n    if (config.enableRateLimitTracking) {\n      this.rateLimitTracker = new RateLimitTracker();\n    }\n  }\n\n  /**\n   * Resolve the Idempotency-Key for a request. Mutating methods (POST/PUT/PATCH)\n   * get the caller-supplied key or a freshly minted UUID; non-mutating methods get\n   * none. requestWithRetry resolves this once and injects it so every retry reuses\n   * one key (letting the server dedup replays); a direct request() resolves per call.\n   */\n  private resolveIdempotencyKey(method: string, requestOptions?: RequestOptions): string | undefined {\n    const isMutating = ['POST', 'PUT', 'PATCH'].includes((method || 'GET').toUpperCase());\n    if (!isMutating) {\n      return undefined;\n    }\n    return requestOptions?.idempotencyKey ?? generateUUID();\n  }\n\n  /**\n   * Make an HTTP request with timeout and error handling\n   */\n  protected async request<T>(\n    endpoint: string,\n    options: RequestInit = {},\n    serviceURL?: string,\n    requestOptions?: RequestOptions\n  ): Promise<T> {\n    const requestId = generateUUID();\n\n    // Circuit breaker check\n    if (this.circuitBreaker && !this.circuitBreaker.canExecute()) {\n      const error = new CircuitBreakerOpenError();\n      error.requestId = requestId;\n      throw error;\n    }\n\n    // Rate limit pre-check\n    if (this.rateLimitTracker && this.rateLimitTracker.isLimitExceeded()) {\n      const status = this.rateLimitTracker.getStatus();\n      const error = new RateLimitError(status.retryAfter ?? undefined);\n      error.requestId = requestId;\n      throw error;\n    }\n\n    const url = `${serviceURL || this.config.baseURL}${endpoint}`;\n\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n      'X-Tenant-ID': this.config.tenantId,\n      'X-SDK-Version': `vesant-sdk-ts/${SDK_VERSION}`,\n      'X-Request-ID': requestId,\n      ...this.config.headers,\n      ...((options.headers as Record<string, string>) || {}),\n    };\n\n    // Resolve the auth credential per-request via the token provider (async, so a\n    // provider can fetch/refresh short-lived credentials). No credential = no header.\n    const credential = await this.authProvider?.getCredential({\n      tenantId: this.config.tenantId,\n      requestId,\n    });\n    if (credential) {\n      headers['Authorization'] = `${credential.scheme ?? 'Bearer'} ${credential.token}`;\n    }\n\n    // Sandbox header\n    if (this.config.environment === 'sandbox') {\n      headers['X-Sandbox'] = 'true';\n    }\n\n    // Idempotency key for mutating methods. Via requestWithRetry the key arrives\n    // pre-resolved in requestOptions so all attempts share one; a direct request()\n    // falls back to minting one here.\n    const method = (options.method || 'GET').toUpperCase();\n    const idempotencyKey = this.resolveIdempotencyKey(method, requestOptions);\n    if (idempotencyKey) {\n      headers['Idempotency-Key'] = idempotencyKey;\n    }\n\n    const controller = new AbortController();\n    const timeoutId = setTimeout(() => controller.abort(), this.config.timeout);\n\n    // Link consumer AbortSignal to internal controller\n    if (requestOptions?.signal) {\n      if (requestOptions.signal.aborted) {\n        controller.abort();\n      } else {\n        requestOptions.signal.addEventListener('abort', () => controller.abort(), { once: true });\n      }\n    }\n\n    try {\n      // Run onRequest interceptors\n      let finalOptions: RequestInit = { ...options, headers };\n      for (const interceptor of this.interceptors) {\n        if (interceptor.onRequest) {\n          finalOptions = await interceptor.onRequest(url, finalOptions);\n        }\n      }\n\n      if (this.config.debug) {\n        this.logger.debug(`${finalOptions.method || 'GET'} ${endpoint}`);\n      }\n\n      let response = await fetch(url, {\n        ...finalOptions,\n        signal: controller.signal,\n      });\n\n      // Single-shot 401 re-auth: if the provider can refresh, a 401 forces one\n      // credential refresh and retry, reusing the same headers (incl. the\n      // Idempotency-Key) so a mutating request is not double-submitted.\n      if (response.status === 401 && this.authProvider?.canRefresh?.()) {\n        const refreshed = await this.authProvider.getCredential({\n          tenantId: this.config.tenantId,\n          requestId,\n          forceRefresh: true,\n        });\n        if (refreshed) {\n          this.config.onCredentialRotated?.({ reason: 'unauthorized' });\n          finalOptions = {\n            ...finalOptions,\n            headers: {\n              ...(finalOptions.headers as Record<string, string>),\n              Authorization: `${refreshed.scheme ?? 'Bearer'} ${refreshed.token}`,\n            },\n          };\n          response = await fetch(url, { ...finalOptions, signal: controller.signal });\n        }\n      }\n\n      clearTimeout(timeoutId);\n\n      // Track rate limit headers\n      if (this.rateLimitTracker) {\n        this.rateLimitTracker.updateFromHeaders(response.headers);\n      }\n\n      // Binary download path\n      if (requestOptions?.responseType === 'arraybuffer') {\n        if (!response.ok) {\n          let errData: Record<string, unknown> = {};\n          try { errData = await response.json(); } catch { /* ignore */ }\n          this.handleErrorResponse(response.status, errData, requestId);\n        }\n        this.circuitBreaker?.onSuccess();\n        const buffer = await response.arrayBuffer();\n        return buffer as unknown as T;\n      }\n\n      let data: Record<string, unknown> | undefined;\n      try {\n        data = await response.json();\n      } catch {\n        // Non-JSON response (HTML error pages, 204 No Content, etc.)\n        if (!response.ok) {\n          this.handleErrorResponse(response.status, {\n            error: `HTTP ${response.status}`,\n            message: response.statusText,\n          }, requestId);\n        }\n        // OK response but no JSON body (e.g., 204)\n        this.circuitBreaker?.onSuccess();\n        return undefined as unknown as T;\n      }\n\n      if (!response.ok) {\n        this.handleErrorResponse(response.status, data || {}, requestId);\n      }\n\n      // Record success for circuit breaker\n      this.circuitBreaker?.onSuccess();\n\n      // Run onResponse interceptors\n      let result: unknown = data;\n      for (const interceptor of this.interceptors) {\n        if (interceptor.onResponse) {\n          result = await interceptor.onResponse(url, result);\n        }\n      }\n\n      if (this.config.debug) {\n        this.logger.debug(`Response: ${response.status}`);\n      }\n\n      return result as T;\n    } catch (error) {\n      clearTimeout(timeoutId);\n\n      // Record failure for circuit breaker (skip for client errors)\n      if (\n        error instanceof VesantError &&\n        error.statusCode &&\n        error.statusCode >= 500\n      ) {\n        this.circuitBreaker?.onFailure();\n      } else if (error instanceof NetworkError || error instanceof TimeoutError) {\n        this.circuitBreaker?.onFailure();\n      }\n\n      // Attach requestId to VesantError instances\n      if (error instanceof VesantError && !error.requestId) {\n        error.requestId = requestId;\n      }\n\n      // Run onError interceptors\n      if (error instanceof Error) {\n        for (const interceptor of this.interceptors) {\n          if (interceptor.onError) {\n            await interceptor.onError(url, error);\n          }\n        }\n      }\n\n      if (error instanceof Error) {\n        if (error.name === 'AbortError') {\n          // Distinguish consumer abort from timeout\n          if (requestOptions?.signal?.aborted) {\n            const abortError = new VesantError('Request aborted', 'REQUEST_ABORTED');\n            abortError.requestId = requestId;\n            throw abortError;\n          }\n          this.circuitBreaker?.onFailure();\n          const timeoutError = new TimeoutError(this.config.timeout);\n          timeoutError.requestId = requestId;\n          throw timeoutError;\n        }\n        if (error instanceof VesantError) {\n          throw error;\n        }\n      }\n\n      const networkError = new NetworkError('Network request failed', error);\n      networkError.requestId = requestId;\n      this.circuitBreaker?.onFailure();\n      throw networkError;\n    }\n  }\n\n  /**\n   * Make an HTTP request with retry logic\n   */\n  protected async requestWithRetry<T>(\n    endpoint: string,\n    options: RequestInit = {},\n    serviceURL?: string,\n    retries: number = this.config.retries,\n    requestOptions?: RequestOptions\n  ): Promise<T> {\n    let lastError: Error | undefined;\n\n    // Resolve the idempotency key once so every retry attempt reuses it, letting\n    // the server dedup replays instead of re-processing (and re-billing) each try.\n    const idempotencyKey = this.resolveIdempotencyKey(options.method || 'GET', requestOptions);\n    const attemptOptions: RequestOptions | undefined = idempotencyKey\n      ? { ...requestOptions, idempotencyKey }\n      : requestOptions;\n\n    for (let attempt = 0; attempt <= retries; attempt++) {\n      try {\n        return await this.request<T>(endpoint, options, serviceURL, attemptOptions);\n      } catch (error) {\n        lastError = error instanceof Error ? error : new Error('Unknown error');\n\n        // Don't retry on consumer abort\n        if (requestOptions?.signal?.aborted) {\n          throw lastError;\n        }\n\n        // Don't retry on client errors (4xx), except 429 (rate limit)\n        if (\n          lastError instanceof VesantError &&\n          lastError.statusCode &&\n          lastError.statusCode >= 400 &&\n          lastError.statusCode < 500 &&\n          lastError.statusCode !== 429\n        ) {\n          throw lastError;\n        }\n\n        // Don't retry on last attempt\n        if (attempt === retries) {\n          break;\n        }\n\n        // Use Retry-After for 429, otherwise exponential backoff with jitter\n        let delay: number;\n        if (lastError instanceof RateLimitError && lastError.retryAfter) {\n          delay = lastError.retryAfter * 1000;\n        } else {\n          delay = Math.min(1000 * Math.pow(2, attempt) + Math.random() * 1000, 10000);\n        }\n        await new Promise((resolve) => setTimeout(resolve, delay));\n\n        if (this.config.debug) {\n          this.logger.debug(`Retry attempt ${attempt + 1}/${retries} after ${delay.toFixed(0)}ms`);\n        }\n      }\n    }\n\n    throw new NetworkError(`Request failed after ${retries} retries`, lastError);\n  }\n\n  /**\n   * Handle error responses from API\n   */\n  protected handleErrorResponse(status: number, data: Record<string, unknown>, requestId?: string): never {\n    const message = (data.error as string) || (data.message as string) || `HTTP ${status}`;\n\n    const createError = (): VesantError => {\n      switch (status) {\n        case 400:\n          return new VesantError(message, 'BAD_REQUEST', 400);\n        case 401:\n          return new AuthenticationError(message);\n        case 403:\n          return new VesantError(message, 'FORBIDDEN', 403);\n        case 404:\n          return new VesantError(message, 'NOT_FOUND', 404);\n        case 409:\n          return new VesantError(message, 'DUPLICATE_PROFILE', 409);\n        case 429: {\n          const retryAfter = (data.retry_after as number | undefined) || (data.retryAfter as number | undefined);\n          return new RateLimitError(retryAfter);\n        }\n        case 500:\n        case 502:\n        case 503:\n        case 504:\n          return new ServiceUnavailableError(message);\n        default:\n          return new VesantError(message, 'UNKNOWN_ERROR', status);\n      }\n    };\n\n    const error = createError();\n    if (requestId) {\n      error.requestId = requestId;\n    }\n    throw error;\n  }\n\n  /**\n   * Build query string from parameters\n   */\n  protected buildQueryString(params: Record<string, unknown>): string {\n    const query = new URLSearchParams();\n\n    Object.entries(params).forEach(([key, value]) => {\n      if (value !== undefined && value !== null) {\n        if (Array.isArray(value)) {\n          value.forEach((item) => query.append(key, String(item)));\n        } else {\n          query.append(key, String(value));\n        }\n      }\n    });\n\n    const queryString = query.toString();\n    return queryString ? `?${queryString}` : '';\n  }\n\n  /**\n   * Update client configuration\n   */\n  updateConfig(config: Partial<BaseClientConfig>): void {\n    this.config = {\n      ...this.config,\n      ...config,\n      headers: {\n        ...this.config.headers,\n        ...(config.headers || {}),\n      },\n    };\n    if (config.logger) {\n      this.logger = config.logger;\n    }\n    if (config.interceptors) {\n      this.interceptors = config.interceptors;\n    }\n    // Rebuild the auth provider when auth-related config changes so a rotated key\n    // or a swapped provider takes effect on subsequent requests.\n    if (config.authProvider !== undefined || config.apiKey !== undefined) {\n      this.authProvider =\n        this.config.authProvider ??\n        (this.config.apiKey ? new StaticApiKeyProvider(this.config.apiKey) : undefined);\n    }\n  }\n\n  /**\n   * Get current configuration (readonly)\n   */\n  getConfig(): Readonly<BaseClientConfig> {\n    return { ...this.config };\n  }\n\n  /**\n   * Get rate limit status from tracked response headers.\n   */\n  getRateLimitStatus(): RateLimitStatus | null {\n    return this.rateLimitTracker?.getStatus() ?? null;\n  }\n\n  /**\n   * Get circuit breaker status.\n   */\n  getCircuitBreakerStatus(): CircuitBreakerStatus | null {\n    return this.circuitBreaker?.getStatus() ?? null;\n  }\n\n  /**\n   * Health check endpoint\n   */\n  async healthCheck(): Promise<{ status: string; timestamp: string }> {\n    return this.request('/api/v1/health');\n  }\n}\n","import { BaseClient } from '../core/client';\nimport type { BaseClientConfig, RequestOptions } from '../core/config';\nimport type {\n  TaxClientConfig,\n  CustomerTaxProfileRecord,\n  CustomerTaxProfileDocuments,\n  ReRequestTaxFormInput,\n  EnableWithholdingInput,\n  EnableWithholdingResponse,\n  TINCheckResult,\n  TaxRules,\n  UpdateTaxRulesInput,\n  TaxRuleVersion,\n  RemindersRunResult,\n  ComplianceStats,\n  ComplianceStatsFilters,\n  GlobalTaxRule,\n  TreatyCountry,\n  TreatyCountryListResponse,\n} from './types';\n\nexport class TaxClient extends BaseClient {\n  constructor(config: TaxClientConfig) {\n    const baseConfig: BaseClientConfig = {\n      baseURL: config.baseURL,\n      tenantId: config.tenantId,\n      apiKey: config.apiKey,\n      headers: config.headers,\n      timeout: config.timeout,\n      retries: 3,\n      debug: config.debug,\n      environment: config.environment,\n    };\n    super(baseConfig);\n  }\n\n  // ==========================================================================\n  // P1 — Customer Tax Profile (core compliance flow)\n  // ==========================================================================\n\n  async getCustomerTaxProfileRecord(customerID: string): Promise<CustomerTaxProfileRecord> {\n    return this.request<CustomerTaxProfileRecord>(\n      `/api/v1/tax/customer-tax-profiles/${customerID}`\n    );\n  }\n\n  async requestTaxForm(customerID: string): Promise<CustomerTaxProfileRecord> {\n    return this.request<CustomerTaxProfileRecord>(\n      `/api/v1/tax/customer-tax-profiles/${customerID}/request-form`,\n      { method: 'POST' }\n    );\n  }\n\n  async checkTINStatus(customerID: string, requestOptions?: RequestOptions): Promise<TINCheckResult> {\n    return this.requestWithRetry<TINCheckResult>(\n      `/api/v1/tax/customer-tax-profiles/${customerID}/check-tin`,\n      { method: 'POST' },\n      undefined,\n      undefined,\n      requestOptions\n    );\n  }\n\n  async reRequestTaxForm(\n    customerID: string,\n    input: ReRequestTaxFormInput\n  ): Promise<CustomerTaxProfileRecord> {\n    return this.request<CustomerTaxProfileRecord>(\n      `/api/v1/tax/customer-tax-profiles/${customerID}/re-request-form`,\n      {\n        method: 'POST',\n        body: JSON.stringify(input),\n      }\n    );\n  }\n\n  async enableBackupWithholding(\n    customerID: string,\n    input: EnableWithholdingInput\n  ): Promise<EnableWithholdingResponse> {\n    return this.request<EnableWithholdingResponse>(\n      `/api/v1/tax/customer-tax-profiles/${customerID}/enable-withholding`,\n      {\n        method: 'POST',\n        body: JSON.stringify(input),\n      }\n    );\n  }\n\n   async getCustomerDocuments(customerID: string): Promise<CustomerTaxProfileDocuments> {\n    return this.request<CustomerTaxProfileDocuments>(\n      `/api/v1/tm/customer-tax-profiles/${customerID}/documents`\n    );\n  }\n\n  async downloadTaxForm(\n    customerID: string,\n    requestOptions?: RequestOptions\n  ): Promise<ArrayBuffer> {\n    return this.request<ArrayBuffer>(\n      `/api/v1/tax/customer-tax-profiles/${customerID}/download-form`,\n      { method: 'GET' },\n      undefined,\n      { ...requestOptions, responseType: 'arraybuffer' }\n    );\n  }\n\n  // ==========================================================================\n  // P2 — Tenant Tax Rules\n  // ==========================================================================\n\n  async getTaxRules(): Promise<TaxRules> {\n    const res = await this.request<{ rules: TaxRules }>('/api/v1/tax/rules');\n    return res.rules;\n  }\n\n  async updateTaxRules(input: UpdateTaxRulesInput): Promise<TaxRuleVersion> {\n    const res = await this.request<{ version: TaxRuleVersion }>('/api/v1/tax/rules', {\n      method: 'PUT',\n      body: JSON.stringify({ rules: input }),\n    });\n    return res.version;\n  }\n\n  async runReminders(): Promise<RemindersRunResult> {\n    return this.request<RemindersRunResult>('/api/v1/tax/reminders/run', { method: 'POST' });\n  }\n\n  async getComplianceStats(filters?: ComplianceStatsFilters): Promise<ComplianceStats> {\n    const params: Record<string, unknown> = {};\n    if (filters?.time_range) params.time_range = filters.time_range;\n    if (filters?.from_date) params.from_date = filters.from_date;\n    if (filters?.to_date) params.to_date = filters.to_date;\n    return this.request<ComplianceStats>(\n      `/api/v1/tax/tenant/w-form-tenant-stats${this.buildQueryString(params)}`\n    );\n  }\n\n  // ==========================================================================\n  // P3 — Global Tax Rule & Treaty Countries\n  // ==========================================================================\n\n  async getCurrentGlobalTaxRule(): Promise<GlobalTaxRule> {\n    const res = await this.request<{ success: boolean; message: string; data: GlobalTaxRule }>(\n      '/api/v1/tm/tenant/global-tax-rules/current'\n    );\n    return res.data;\n  }\n\n  async listTreatyCountries(): Promise<TreatyCountryListResponse> {\n    return this.request<TreatyCountryListResponse>('/api/v1/tax/treaty-countries');\n  }\n\n  async getTreatyCountry(code: string): Promise<TreatyCountry> {\n    const res = await this.request<{ treaty_country: TreatyCountry }>(\n      `/api/v1/tax/treaty-countries/${encodeURIComponent(code)}`\n    );\n    return res.treaty_country;\n  }\n}\n"]}

package/dist/webhooks/index.d.mts

@@ -1,2 +1,2 @@
-export { B as BaseWebhookEvent, C as ComplianceCheckFailedPayload, D as DecisionRecordedPayload, G as GeolocationBlockedPayload, a as GeolocationVerifiedPayload, I as InMemoryDedupStore, b as InMemoryDedupStoreOptions, K as KycStatusChangedPayload, L as LabelAppliedPayload, c as LocationRequestCompletedPayload, N as NotificationWebhookEvent, P as ProfileCreatedPayload, d as ProfileUpdatedPayload, R as RiskCategoryChangedPayload, e as RiskScoreChangedPayload, T as TaxReminderSentPayload, W as WebhookAnyHandler, f as WebhookDedupStore, g as WebhookEvent, h as WebhookEventHandler, i as WebhookEventType, j as WebhookHandler, k as WebhookHandlerConfig, l as WebhookMiddlewareOptions, m as WebhookNotification, n as createNextWebhookHandler, o as createWebhookMiddleware, v as verifyWebhookSignature } from '../index-C3zUKydT.mjs';
+export { A as AmlBlockCallbackData, a as AmlBlockCallbackEvent, b as AmlCallbackCategory, B as BaseWebhookEvent, C as ComplianceCheckFailedPayload, D as DecisionRecordedPayload, G as GeolocationBlockedPayload, c as GeolocationVerifiedPayload, I as InMemoryDedupStore, d as InMemoryDedupStoreOptions, K as KycStatusChangedPayload, L as LabelAppliedPayload, e as LocationRequestCompletedPayload, N as NotificationWebhookEvent, P as ProfileCreatedPayload, f as ProfileUpdatedPayload, R as RiskCategoryChangedPayload, g as RiskScoreChangedPayload, T as TaxReminderSentPayload, W as WebhookAnyHandler, h as WebhookDedupStore, i as WebhookEvent, j as WebhookEventHandler, k as WebhookEventType, l as WebhookHandler, m as WebhookHandlerConfig, n as WebhookMiddlewareOptions, o as WebhookNotification, p as createNextWebhookHandler, q as createWebhookMiddleware, r as isAmlBlockCallbackEvent, v as verifyWebhookSignature } from '../index-C49a7fg2.mjs';
 import '../types-CBQRNL-l.mjs';

package/dist/webhooks/index.d.ts

@@ -1,2 +1,2 @@
-export { B as BaseWebhookEvent, C as ComplianceCheckFailedPayload, D as DecisionRecordedPayload, G as GeolocationBlockedPayload, a as GeolocationVerifiedPayload, I as InMemoryDedupStore, b as InMemoryDedupStoreOptions, K as KycStatusChangedPayload, L as LabelAppliedPayload, c as LocationRequestCompletedPayload, N as NotificationWebhookEvent, P as ProfileCreatedPayload, d as ProfileUpdatedPayload, R as RiskCategoryChangedPayload, e as RiskScoreChangedPayload, T as TaxReminderSentPayload, W as WebhookAnyHandler, f as WebhookDedupStore, g as WebhookEvent, h as WebhookEventHandler, i as WebhookEventType, j as WebhookHandler, k as WebhookHandlerConfig, l as WebhookMiddlewareOptions, m as WebhookNotification, n as createNextWebhookHandler, o as createWebhookMiddleware, v as verifyWebhookSignature } from '../index-DSDgS09k.js';
+export { A as AmlBlockCallbackData, a as AmlBlockCallbackEvent, b as AmlCallbackCategory, B as BaseWebhookEvent, C as ComplianceCheckFailedPayload, D as DecisionRecordedPayload, G as GeolocationBlockedPayload, c as GeolocationVerifiedPayload, I as InMemoryDedupStore, d as InMemoryDedupStoreOptions, K as KycStatusChangedPayload, L as LabelAppliedPayload, e as LocationRequestCompletedPayload, N as NotificationWebhookEvent, P as ProfileCreatedPayload, f as ProfileUpdatedPayload, R as RiskCategoryChangedPayload, g as RiskScoreChangedPayload, T as TaxReminderSentPayload, W as WebhookAnyHandler, h as WebhookDedupStore, i as WebhookEvent, j as WebhookEventHandler, k as WebhookEventType, l as WebhookHandler, m as WebhookHandlerConfig, n as WebhookMiddlewareOptions, o as WebhookNotification, p as createNextWebhookHandler, q as createWebhookMiddleware, r as isAmlBlockCallbackEvent, v as verifyWebhookSignature } from '../index-BosFSGan.js';
 import '../types-CBQRNL-l.js';

package/dist/webhooks/index.js

@@ -290,10 +290,16 @@ function buildHandler(options) {
   return handler;
 }
 
+// src/webhooks/types.ts
+function isAmlBlockCallbackEvent(value) {
+  return typeof value === "object" && value !== null && value.event === "aml" && value.block === true;
+}
+
 exports.InMemoryDedupStore = InMemoryDedupStore;
 exports.WebhookHandler = WebhookHandler;
 exports.createNextWebhookHandler = createNextWebhookHandler;
 exports.createWebhookMiddleware = createWebhookMiddleware;
+exports.isAmlBlockCallbackEvent = isAmlBlockCallbackEvent;
 exports.verifyWebhookSignature = verifyWebhookSignature;
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/webhooks/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/errors.ts","../../src/core/webhook-utils.ts","../../src/core/dedup.ts","../../src/webhooks/handler.ts","../../src/webhooks/middleware.ts"],"names":[],"mappings":";;;AAOO,IAAM,WAAA,GAAN,MAAM,YAAA,SAAoB,KAAA,CAAM;AAAA,EAGrC,WAAA,CACE,OAAA,EACO,IAAA,EACA,UAAA,EACA,OAAA,EACP;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AAJN,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAGP,IAAA,IAAA,CAAK,IAAA,GAAO,aAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,YAAA,CAAY,SAAS,CAAA;AAAA,EACnD;AACF,CAAA;AAeO,IAAM,eAAA,GAAN,MAAM,gBAAA,SAAwB,WAAA,CAAY;AAAA,EAC/C,WAAA,CAAY,SAAiB,MAAA,EAAmB;AAC9C,IAAA,KAAA,CAAM,OAAA,EAAS,kBAAA,EAAoB,GAAA,EAAK,EAAE,QAAQ,CAAA;AAClD,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,gBAAA,CAAgB,SAAS,CAAA;AAAA,EACvD;AACF,CAAA;;;ACTA,eAAsB,uBACpB,OAAA,EACA,SAAA,EACA,MAAA,EACA,IAAA,GAAsC,EAAC,EACrB;AAClB,EAAA,MAAM,MAAA,GAAS,qBAAqB,SAAS,CAAA;AAC7C,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,GAAA;AACpC,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAM,IAAK,KAAK,GAAA,EAAI;AAErC,IAAA,IAAI,SAAA,GAAY,KAAK,IAAA,CAAK,GAAA,CAAI,MAAM,MAAA,CAAO,CAAA,GAAI,GAAI,CAAA,GAAI,SAAA,EAAW;AAChE,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,MAAM,QAAA,GAAW,MAAM,iBAAA,CAAkB,CAAA,EAAG,OAAO,CAAC,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA,EAAI,MAAM,CAAA;AACzE,IAAA,OAAO,iBAAA,CAAkB,MAAA,CAAO,EAAA,EAAI,QAAQ,CAAA;AAAA,EAC9C;AAEA,EAAA,IAAI,IAAA,CAAK,gBAAgB,KAAA,EAAO;AAC9B,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,SAAA,GAAY,MAAM,iBAAA,CAAkB,OAAA,EAAS,MAAM,CAAA;AAEzD,EAAA,MAAM,gBAAA,GAAmB,UAAU,SAAS,CAAA,CAAA;AAE5C,EAAA,IAAI,SAAA,CAAU,UAAA,CAAW,SAAS,CAAA,EAAG;AACnC,IAAA,OAAO,iBAAA,CAAkB,WAAW,gBAAgB,CAAA;AAAA,EACtD;AAEA,EAAA,OAAO,iBAAA,CAAkB,WAAW,SAAS,CAAA;AAC/C;AAMA,SAAS,qBAAqB,SAAA,EAAqD;AACjF,EAAA,IAAI,CAAC,UAAU,QAAA,CAAS,IAAI,KAAK,CAAC,SAAA,CAAU,QAAA,CAAS,KAAK,CAAA,EAAG;AAC3D,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI,CAAA;AACJ,EAAA,IAAI,EAAA;AACJ,EAAA,KAAA,MAAW,IAAA,IAAQ,SAAA,CAAU,KAAA,CAAM,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,EAAA,GAAK,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC3B,IAAA,IAAI,OAAO,EAAA,EAAI;AACf,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,EAAE,EAAE,IAAA,EAAK;AACnC,IAAA,MAAM,QAAQ,IAAA,CAAK,KAAA,CAAM,EAAA,GAAK,CAAC,EAAE,IAAA,EAAK;AACtC,IAAA,IAAI,GAAA,KAAQ,GAAA,EAAK,CAAA,GAAI,MAAA,CAAO,KAAK,CAAA;AAAA,SAAA,IACxB,GAAA,KAAQ,MAAM,EAAA,GAAK,KAAA;AAAA,EAC9B;AACA,EAAA,IAAI,MAAM,MAAA,IAAa,MAAA,CAAO,MAAM,CAAC,CAAA,IAAK,CAAC,EAAA,EAAI;AAC7C,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,EAAE,GAAG,EAAA,EAAG;AACjB;AAMA,eAAe,iBAAA,CAAkB,SAAiB,MAAA,EAAiC;AAEjF,EAAA,IAAI,OAAO,UAAA,CAAW,MAAA,KAAW,WAAA,IAAe,UAAA,CAAW,OAAO,MAAA,EAAQ;AACxE,IAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,IAAA,MAAM,GAAA,GAAM,MAAM,UAAA,CAAW,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,MACzC,KAAA;AAAA,MACA,OAAA,CAAQ,OAAO,MAAM,CAAA;AAAA,MACrB,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,MAChC,KAAA;AAAA,MACA,CAAC,MAAM;AAAA,KACT;AACA,IAAA,MAAM,GAAA,GAAM,MAAM,UAAA,CAAW,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,GAAA,EAAK,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAC,CAAA;AACpF,IAAA,OAAO,KAAA,CAAM,KAAK,IAAI,UAAA,CAAW,GAAG,CAAC,CAAA,CAClC,IAAI,CAAC,CAAA,KAAM,EAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAC1C,KAAK,EAAE,CAAA;AAAA,EACZ;AAGA,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,OAAO,QAAQ,CAAA;AAC5C,IAAA,OAAO,UAAA,CAAW,UAAU,MAAM,CAAA,CAAE,OAAO,OAAO,CAAA,CAAE,OAAO,KAAK,CAAA;AAAA,EAClE,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,WAAA;AAAA,MACR,uFAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACF;AAKA,SAAS,iBAAA,CAAkB,GAAW,CAAA,EAAoB;AACxD,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,MAAA,IAAU,EAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAAA,EAC5C;AACA,EAAA,OAAO,MAAA,KAAW,CAAA;AACpB;;;AC/GO,IAAM,qBAAN,MAAsD;AAAA,EAK3D,WAAA,CAAY,IAAA,GAAkC,EAAC,EAAG;AAJlD,IAAA,IAAA,CAAiB,UAAA,uBAAiB,GAAA,EAAoB;AAKpD,IAAA,IAAA,CAAK,UAAA,GAAa,KAAK,UAAA,IAAc,GAAA;AACrC,IAAA,IAAA,CAAK,GAAA,GAAM,IAAA,CAAK,GAAA,KAAQ,MAAM,KAAK,GAAA,EAAI,CAAA;AAAA,EACzC;AAAA,EAEA,MAAM,KAAK,EAAA,EAA8B;AACvC,IAAA,OAAO,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,EAAE,CAAA;AAAA,EAC/B;AAAA,EAEA,MAAM,IAAA,CAAK,EAAA,EAAY,KAAA,EAA8B;AACnD,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,EAAA,EAAI,GAAA,GAAM,KAAK,CAAA;AAGnC,IAAA,IAAI,IAAA,CAAK,UAAA,CAAW,IAAA,GAAO,IAAA,CAAK,UAAA,EAAY;AAC1C,MAAA,KAAA,MAAW,CAAC,GAAA,EAAK,SAAS,CAAA,IAAK,KAAK,UAAA,EAAY;AAC9C,QAAA,IAAI,MAAM,SAAA,EAAW;AACnB,UAAA,IAAA,CAAK,UAAA,CAAW,OAAO,GAAG,CAAA;AAAA,QAC5B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ACnCA,SAAS,eAAe,KAAA,EAAyC;AAC/D,EAAA,IAAI,MAAM,EAAA,EAAI;AACZ,IAAA,OAAO,KAAA,CAAM,EAAA;AAAA,EACf;AACA,EAAA,IAAI,KAAA,CAAM,eAAe,sBAAA,EAAwB;AAC/C,IAAA,OAAO,MAAM,YAAA,EAAc,EAAA;AAAA,EAC7B;AACA,EAAA,OAAO,MAAA;AACT;AAEO,IAAM,iBAAN,MAAqB;AAAA,EAS1B,YAAY,MAAA,EAA8B;AAR1C,IAAA,IAAA,CAAQ,QAAA,uBAAe,GAAA,EAA6C;AACpE,IAAA,IAAA,CAAQ,cAAmC,EAAC;AAQ1C,IAAA,IAAA,CAAK,SAAS,MAAA,CAAO,MAAA;AACrB,IAAA,IAAA,CAAK,SAAA,GAAY,OAAO,SAAA,IAAa,GAAA;AACrC,IAAA,IAAA,CAAK,gBAAA,GAAmB,OAAO,gBAAA,IAAoB,IAAA;AACnD,IAAA,IAAA,CAAK,oBAAA,GAAuB,OAAO,oBAAA,IAAwB,IAAA;AAC3D,IAAA,IAAA,CAAK,UAAA,GAAa,MAAA,CAAO,UAAA,IAAc,IAAI,kBAAA,EAAmB;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA,EAKA,EAAA,CACE,WACA,OAAA,EACM;AACN,IAAA,MAAM,WAAW,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,SAAS,KAAK,EAAC;AAClD,IAAA,QAAA,CAAS,KAAK,OAAyC,CAAA;AACvD,IAAA,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,SAAA,EAAW,QAAQ,CAAA;AACrC,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAA,EAAkC;AACtC,IAAA,IAAA,CAAK,WAAA,CAAY,KAAK,OAAO,CAAA;AAC7B,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAA,CAAe,IAAA,EAAc,SAAA,EAA0C;AAC3E,IAAA,MAAM,UAAU,MAAM,sBAAA,CAAuB,IAAA,EAAM,SAAA,EAAW,KAAK,MAAA,EAAQ;AAAA,MACzE,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,aAAa,IAAA,CAAK;AAAA,KACnB,CAAA;AACD,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAI,eAAA,CAAgB,2BAAA,EAA6B,CAAC,WAAW,CAAC,CAAA;AAAA,IACtE;AAEA,IAAA,OAAO,IAAA,CAAK,iBAAiB,IAAI,CAAA;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAA,CAAO,IAAA,EAAc,SAAA,EAAkC;AAC3D,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,cAAA,CAAe,MAAM,SAAS,CAAA;AACvD,IAAA,MAAM,IAAA,CAAK,SAAS,KAAK,CAAA;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,WAAW,IAAA,EAAqC;AACpD,IAAA,OAAO,IAAA,CAAK,iBAAiB,IAAI,CAAA;AAAA,EACnC;AAAA,EAEA,MAAc,iBAAiB,IAAA,EAAqC;AAClE,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC7B,IAAA,MAAM,OAAA,GAAU,eAAe,KAAK,CAAA;AAEpC,IAAA,IAAI,CAAC,KAAA,CAAM,UAAA,IAAc,CAAC,OAAA,IAAW,CAAC,MAAM,SAAA,EAAW;AACrD,MAAA,MAAM,IAAI,eAAA;AAAA,QACR,4EAAA;AAAA,QACA,CAAC,YAAA,EAAc,IAAA,EAAM,WAAW;AAAA,OAClC;AAAA,IACF;AAIA,IAAA,IAAI,IAAA,CAAK,YAAY,CAAA,EAAG;AACtB,MAAA,MAAM,YAAY,IAAI,IAAA,CAAK,KAAA,CAAM,SAAS,EAAE,OAAA,EAAQ;AACpD,MAAA,IAAI,IAAA,CAAK,IAAI,IAAA,CAAK,GAAA,KAAQ,SAAS,CAAA,GAAI,KAAK,SAAA,EAAW;AACrD,QAAA,MAAM,IAAI,eAAA;AAAA,UACR,CAAA,qDAAA,EAAwD,KAAK,SAAS,CAAA,GAAA,CAAA;AAAA,UACtE,CAAC,WAAW;AAAA,SACd;AAAA,MACF;AAAA,IACF;AAGA,IAAA,IAAI,KAAK,gBAAA,EAAkB;AACzB,MAAA,IAAI,MAAM,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,OAAO,CAAA,EAAG;AACvC,QAAA,MAAM,IAAI,eAAA;AAAA,UACR,4BAA4B,OAAO,CAAA,2BAAA,CAAA;AAAA,UACnC,CAAC,IAAI;AAAA,SACP;AAAA,MACF;AACA,MAAA,MAAM,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,OAAA,EAAS,KAAK,SAAS,CAAA;AAAA,IACpD;AAEA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAc,SAAS,KAAA,EAAoC;AACzD,IAAA,MAAM,eAAe,IAAA,CAAK,QAAA,CAAS,IAAI,KAAA,CAAM,UAAU,KAAK,EAAC;AAC7D,IAAA,MAAM,cAAc,CAAC,GAAG,YAAA,EAAc,GAAG,KAAK,WAAW,CAAA;AAEzD,IAAA,KAAA,MAAW,WAAW,WAAA,EAAa;AACjC,MAAA,MAAO,QAA8B,KAAK,CAAA;AAAA,IAC5C;AAAA,EACF;AACF;;;ACrHO,SAAS,wBAAwB,OAAA,EAAmC;AACzE,EAAA,MAAM,OAAA,GAAU,aAAa,OAAO,CAAA;AACpC,EAAA,MAAM,eAAA,GAAkB,QAAQ,eAAA,IAAmB,qBAAA;AAEnD,EAAA,OAAO,OACL,GAAA,EACA,GAAA,EACA,IAAA,KACG;AACH,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,OAAO,GAAA,CAAI,IAAA,KAAS,QAAA,GAAW,IAAI,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,QAAA,CAAS,OAAO,CAAA;AAChF,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,eAAe,CAAA;AAE7C,MAAA,IAAI,CAAC,SAAA,IAAa,OAAO,SAAA,KAAc,QAAA,EAAU;AAC/C,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,6BAA6B,CAAA;AAC3D,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,CAAQ,MAAA,CAAO,IAAA,EAAM,SAAS,CAAA;AACpC,MAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,QAAA,EAAU,MAAM,CAAA;AAAA,IACzC,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,OAAA,GAAU,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,2BAAA;AAEzD,MAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,WAAW,CAAA,EAAG;AACjC,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,SAAS,CAAA;AAAA,MACzC,CAAA,MAAA,IAAW,QAAQ,QAAA,CAAS,WAAW,KAAK,OAAA,CAAQ,QAAA,CAAS,WAAW,CAAA,EAAG;AACzE,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,SAAS,CAAA;AAAA,MACzC,CAAA,MAAA,IAAW,OAAA,CAAQ,QAAA,CAAS,WAAW,CAAA,EAAG;AACxC,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,SAAS,CAAA;AAAA,MACzC,WAAW,IAAA,EAAM;AACf,QAAA,IAAA,CAAK,KAAK,CAAA;AAAA,MACZ,CAAA,MAAO;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,SAAS,CAAA;AAAA,MACzC;AAAA,IACF;AAAA,EACF,CAAA;AACF;AAOO,SAAS,yBACd,OAAA,EACyC;AACzC,EAAA,MAAM,OAAA,GAAU,aAAa,OAAO,CAAA;AACpC,EAAA,MAAM,eAAA,GAAkB,QAAQ,eAAA,IAAmB,qBAAA;AAEnD,EAAA,OAAO,OAAO,OAAA,KAAwC;AACpD,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,IAAA,EAAK;AAChC,MAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AAErD,MAAA,IAAI,CAAC,SAAA,EAAW;AACd,QAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,2BAAA,EAA6B,CAAA,EAAG;AAAA,UAC1E,MAAA,EAAQ,GAAA;AAAA,UACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,SAC/C,CAAA;AAAA,MACH;AAEA,MAAA,MAAM,OAAA,CAAQ,MAAA,CAAO,IAAA,EAAM,SAAS,CAAA;AAEpC,MAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,QAAA,EAAU,IAAA,EAAM,CAAA,EAAG;AAAA,QACtD,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,OAC/C,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,OAAA,GAAU,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,2BAAA;AACzD,MAAA,MAAM,SAAS,OAAA,CAAQ,QAAA,CAAS,WAAW,CAAA,GACvC,GAAA,GACA,QAAQ,QAAA,CAAS,WAAW,KAAK,OAAA,CAAQ,QAAA,CAAS,WAAW,CAAA,GAC3D,GAAA,GACA,QAAQ,QAAA,CAAS,WAAW,IAC1B,GAAA,GACA,GAAA;AAER,MAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG;AAAA,QACtD,MAAA;AAAA,QACA,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,OAC/C,CAAA;AAAA,IACH;AAAA,EACF,CAAA;AACF;AAEA,SAAS,aAAa,OAAA,EAAmD;AACvE,EAAA,MAAM,OAAA,GAAU,IAAI,cAAA,CAAe,OAAO,CAAA;AAE1C,EAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,IAAA,KAAA,MAAW,CAAC,WAAW,YAAY,CAAA,IAAK,OAAO,OAAA,CAAQ,OAAA,CAAQ,QAAQ,CAAA,EAAG;AACxE,MAAA,IAAI,YAAA,EAAc;AAChB,QAAA,OAAA,CAAQ,EAAA,CAAG,WAA+B,YAAY,CAAA;AAAA,MACxD;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,IAAA,OAAA,CAAQ,KAAA,CAAM,QAAQ,KAAK,CAAA;AAAA,EAC7B;AAEA,EAAA,OAAO,OAAA;AACT","file":"index.js","sourcesContent":["/**\n * Error hierarchy for Vesant SDK\n *\n * Provides structured error handling with specific error types\n * for different failure scenarios.\n */\n\nexport class VesantError extends Error {\n  public requestId?: string;\n\n  constructor(\n    message: string,\n    public code: string,\n    public statusCode?: number,\n    public details?: Record<string, unknown>\n  ) {\n    super(message);\n    this.name = 'VesantError';\n    Object.setPrototypeOf(this, VesantError.prototype);\n  }\n}\n\n/** @deprecated Use VesantError instead */\nexport const CGSError = VesantError;\n/** @deprecated Use VesantError instead */\nexport type CGSError = VesantError;\n\nexport class NetworkError extends VesantError {\n  constructor(message: string, public originalError?: unknown) {\n    super(message, 'NETWORK_ERROR');\n    this.name = 'NetworkError';\n    Object.setPrototypeOf(this, NetworkError.prototype);\n  }\n}\n\nexport class ValidationError extends VesantError {\n  constructor(message: string, fields?: string[]) {\n    super(message, 'VALIDATION_ERROR', 400, { fields });\n    this.name = 'ValidationError';\n    Object.setPrototypeOf(this, ValidationError.prototype);\n  }\n}\n\nexport class ServiceUnavailableError extends VesantError {\n  constructor(message: string = 'Service unavailable') {\n    super(message, 'SERVICE_UNAVAILABLE', 503);\n    this.name = 'ServiceUnavailableError';\n    Object.setPrototypeOf(this, ServiceUnavailableError.prototype);\n  }\n}\n\nexport class ComplianceBlockedError extends VesantError {\n  constructor(reasons: string[]) {\n    super('Access blocked due to compliance rules', 'COMPLIANCE_BLOCKED', 403, { reasons });\n    this.name = 'ComplianceBlockedError';\n    Object.setPrototypeOf(this, ComplianceBlockedError.prototype);\n  }\n}\n\nexport class AuthenticationError extends VesantError {\n  constructor(message: string = 'Authentication failed') {\n    super(message, 'AUTHENTICATION_ERROR', 401);\n    this.name = 'AuthenticationError';\n    Object.setPrototypeOf(this, AuthenticationError.prototype);\n  }\n}\n\nexport class RateLimitError extends VesantError {\n  constructor(public retryAfter?: number) {\n    super('Rate limit exceeded', 'RATE_LIMIT_EXCEEDED', 429, { retryAfter });\n    this.name = 'RateLimitError';\n    Object.setPrototypeOf(this, RateLimitError.prototype);\n  }\n}\n\nexport class TimeoutError extends VesantError {\n  constructor(public timeout: number) {\n    super(`Request timeout after ${timeout}ms`, 'TIMEOUT', 408, { timeout });\n    this.name = 'TimeoutError';\n    Object.setPrototypeOf(this, TimeoutError.prototype);\n  }\n}\n\nexport class ComplianceError extends VesantError {\n  constructor(\n    message: string,\n    public originalError?: unknown,\n    code: string = 'COMPLIANCE_ERROR'\n  ) {\n    super(message, code);\n    this.name = 'ComplianceError';\n    Object.setPrototypeOf(this, ComplianceError.prototype);\n  }\n}\n\nexport class CircuitBreakerOpenError extends VesantError {\n  constructor() {\n    super('Circuit breaker is open — requests are temporarily blocked', 'CIRCUIT_BREAKER_OPEN', 503);\n    this.name = 'CircuitBreakerOpenError';\n    Object.setPrototypeOf(this, CircuitBreakerOpenError.prototype);\n  }\n}\n","/**\n * Webhook signature verification utilities.\n *\n * Supports both Web Crypto API (browsers, Deno, Cloudflare Workers)\n * and Node.js crypto module with automatic runtime detection.\n * Uses constant-time comparison to prevent timing attacks.\n */\n\nimport { VesantError } from './errors';\n\nexport interface VerifyWebhookSignatureOptions {\n  /** Max allowed clock skew in ms for the signed-timestamp scheme (default: 300000). */\n  tolerance?: number;\n  /** Clock source for the tolerance check (default: Date.now). */\n  now?: () => number;\n  /** Accept the legacy body-only `sha256=<hex>` format (default: true, for migration). */\n  allowLegacy?: boolean;\n}\n\n/**\n * Verify an HMAC-SHA256 webhook signature.\n *\n * Supports two schemes:\n * - Signed-timestamp (preferred): `t=<unix>,v1=<hex>` where the HMAC is computed\n *   over `${t}.${payload}`. The timestamp is inside the signed material, so a\n *   replayed body is rejected once `|now - t|` exceeds the tolerance — the check\n *   is done BEFORE the HMAC compare and authenticates the timestamp.\n * - Legacy (body-only): `sha256=<hex>` (or raw hex) over the payload alone. Kept\n *   for the migration window; disable via `allowLegacy: false`.\n *\n * @returns true if the signature is valid\n */\nexport async function verifyWebhookSignature(\n  payload: string,\n  signature: string,\n  secret: string,\n  opts: VerifyWebhookSignatureOptions = {}\n): Promise<boolean> {\n  const signed = parseSignedTimestamp(signature);\n  if (signed) {\n    const tolerance = opts.tolerance ?? 300000;\n    const now = opts.now?.() ?? Date.now();\n    // Authenticate the timestamp first — reject replays before any HMAC compare.\n    if (tolerance > 0 && Math.abs(now - signed.t * 1000) > tolerance) {\n      return false;\n    }\n    const expected = await computeHmacSha256(`${signed.t}.${payload}`, secret);\n    return constantTimeEqual(signed.v1, expected);\n  }\n\n  if (opts.allowLegacy === false) {\n    return false;\n  }\n\n  const hexDigest = await computeHmacSha256(payload, secret);\n  // Backend sends \"sha256=<hex>\" format — support both prefixed and raw signatures\n  const expectedPrefixed = `sha256=${hexDigest}`;\n\n  if (signature.startsWith('sha256=')) {\n    return constantTimeEqual(signature, expectedPrefixed);\n  }\n\n  return constantTimeEqual(signature, hexDigest);\n}\n\n/**\n * Parse the `t=<unix>,v1=<hex>` signed-timestamp scheme; returns null if the\n * signature is not in that form (e.g. legacy `sha256=<hex>`).\n */\nfunction parseSignedTimestamp(signature: string): { t: number; v1: string } | null {\n  if (!signature.includes('t=') || !signature.includes('v1=')) {\n    return null;\n  }\n  let t: number | undefined;\n  let v1: string | undefined;\n  for (const part of signature.split(',')) {\n    const eq = part.indexOf('=');\n    if (eq === -1) continue;\n    const key = part.slice(0, eq).trim();\n    const value = part.slice(eq + 1).trim();\n    if (key === 't') t = Number(value);\n    else if (key === 'v1') v1 = value;\n  }\n  if (t === undefined || Number.isNaN(t) || !v1) {\n    return null;\n  }\n  return { t, v1 };\n}\n\n/**\n * Compute HMAC-SHA256 hex digest.\n * Automatically selects Web Crypto API or Node.js crypto.\n */\nasync function computeHmacSha256(message: string, secret: string): Promise<string> {\n  // Try Web Crypto API first (browsers, Deno, Cloudflare Workers, Node 18+)\n  if (typeof globalThis.crypto !== 'undefined' && globalThis.crypto.subtle) {\n    const encoder = new TextEncoder();\n    const key = await globalThis.crypto.subtle.importKey(\n      'raw',\n      encoder.encode(secret),\n      { name: 'HMAC', hash: 'SHA-256' },\n      false,\n      ['sign']\n    );\n    const sig = await globalThis.crypto.subtle.sign('HMAC', key, encoder.encode(message));\n    return Array.from(new Uint8Array(sig))\n      .map((b) => b.toString(16).padStart(2, '0'))\n      .join('');\n  }\n\n  // Fallback to Node.js crypto module\n  try {\n    const { createHmac } = await import('crypto');\n    return createHmac('sha256', secret).update(message).digest('hex');\n  } catch {\n    throw new VesantError(\n      'No crypto implementation available. Requires Web Crypto API or Node.js crypto module.',\n      'CRYPTO_UNAVAILABLE'\n    );\n  }\n}\n\n/**\n * Constant-time string comparison to prevent timing attacks.\n */\nfunction constantTimeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n\n  let result = 0;\n  for (let i = 0; i < a.length; i++) {\n    result |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return result === 0;\n}\n","/**\n * Pluggable dedup store for webhook replay protection.\n *\n * The default InMemoryDedupStore is process-local — correct for a single\n * long-lived process, but useless across replicas / serverless invocations where\n * the backend's at-least-once retries land on different instances. Supply a\n * shared implementation (e.g. Redis with SETNX + TTL) via WebhookHandlerConfig\n * to dedup reliably in those deployments.\n */\n\nexport interface WebhookDedupStore {\n  /** Has this event id already been processed? */\n  seen(id: string): Promise<boolean>;\n  /** Record this event id as processed, retained for at least ttlMs. */\n  mark(id: string, ttlMs: number): Promise<void>;\n}\n\nexport interface InMemoryDedupStoreOptions {\n  /** Purge expired entries once the map grows past this size (default: 1000). */\n  maxEntries?: number;\n  /** Injectable clock (default: Date.now). */\n  now?: () => number;\n}\n\nexport class InMemoryDedupStore implements WebhookDedupStore {\n  private readonly expiryById = new Map<string, number>();\n  private readonly maxEntries: number;\n  private readonly now: () => number;\n\n  constructor(opts: InMemoryDedupStoreOptions = {}) {\n    this.maxEntries = opts.maxEntries ?? 1000;\n    this.now = opts.now ?? (() => Date.now());\n  }\n\n  async seen(id: string): Promise<boolean> {\n    return this.expiryById.has(id);\n  }\n\n  async mark(id: string, ttlMs: number): Promise<void> {\n    const now = this.now();\n    this.expiryById.set(id, now + ttlMs);\n\n    // Bounded memory: purge expired entries once the map grows too large.\n    if (this.expiryById.size > this.maxEntries) {\n      for (const [key, expiresAt] of this.expiryById) {\n        if (now > expiresAt) {\n          this.expiryById.delete(key);\n        }\n      }\n    }\n  }\n}\n","/**\n * Webhook event handler with signature verification and typed dispatch.\n */\n\nimport { verifyWebhookSignature } from '../core/webhook-utils';\nimport { ValidationError } from '../core/errors';\nimport { InMemoryDedupStore, type WebhookDedupStore } from '../core';\nimport type {\n  WebhookEvent,\n  WebhookEventType,\n  WebhookEventHandler,\n  WebhookAnyHandler,\n  WebhookHandlerConfig,\n} from './types';\n\n/** Resolve the event id: the top-level `id`, or `notification.id` for the notification envelope. */\nfunction resolveEventId(event: WebhookEvent): string | undefined {\n  if (event.id) {\n    return event.id;\n  }\n  if (event.event_type === 'notification.created') {\n    return event.notification?.id;\n  }\n  return undefined;\n}\n\nexport class WebhookHandler {\n  private handlers = new Map<WebhookEventType, WebhookEventHandler[]>();\n  private anyHandlers: WebhookAnyHandler[] = [];\n  private readonly secret: string;\n  private readonly tolerance: number;\n  private readonly replayProtection: boolean;\n  private readonly allowLegacySignature: boolean;\n  private readonly dedupStore: WebhookDedupStore;\n\n  constructor(config: WebhookHandlerConfig) {\n    this.secret = config.secret;\n    this.tolerance = config.tolerance ?? 300000; // 5 minutes\n    this.replayProtection = config.replayProtection ?? true;\n    this.allowLegacySignature = config.allowLegacySignature ?? true;\n    this.dedupStore = config.dedupStore ?? new InMemoryDedupStore();\n  }\n\n  /**\n   * Register a handler for a specific event type.\n   */\n  on<T extends WebhookEventType>(\n    eventType: T,\n    handler: WebhookEventHandler<T>\n  ): this {\n    const existing = this.handlers.get(eventType) || [];\n    existing.push(handler as unknown as WebhookEventHandler);\n    this.handlers.set(eventType, existing);\n    return this;\n  }\n\n  /**\n   * Register a catch-all handler for all event types.\n   */\n  onAny(handler: WebhookAnyHandler): this {\n    this.anyHandlers.push(handler);\n    return this;\n  }\n\n  /**\n   * Verify signature and parse the webhook body.\n   */\n  async verifyAndParse(body: string, signature: string): Promise<WebhookEvent> {\n    const isValid = await verifyWebhookSignature(body, signature, this.secret, {\n      tolerance: this.tolerance,\n      allowLegacy: this.allowLegacySignature,\n    });\n    if (!isValid) {\n      throw new ValidationError('Invalid webhook signature', ['signature']);\n    }\n\n    return this.parseAndValidate(body);\n  }\n\n  /**\n   * Verify signature, parse, and dispatch to registered handlers.\n   */\n  async handle(body: string, signature: string): Promise<void> {\n    const event = await this.verifyAndParse(body, signature);\n    await this.dispatch(event);\n  }\n\n  /**\n   * Parse an event without signature verification (for testing).\n   */\n  async parseEvent(body: string): Promise<WebhookEvent> {\n    return this.parseAndValidate(body);\n  }\n\n  private async parseAndValidate(body: string): Promise<WebhookEvent> {\n    const event = JSON.parse(body) as WebhookEvent;\n    const eventId = resolveEventId(event);\n\n    if (!event.event_type || !eventId || !event.timestamp) {\n      throw new ValidationError(\n        'Invalid webhook event: missing required fields (event_type, id, timestamp)',\n        ['event_type', 'id', 'timestamp']\n      );\n    }\n\n    // Timestamp tolerance check (defense in depth; the signed-timestamp scheme\n    // also authenticates the timestamp in verifyWebhookSignature).\n    if (this.tolerance > 0) {\n      const eventTime = new Date(event.timestamp).getTime();\n      if (Math.abs(Date.now() - eventTime) > this.tolerance) {\n        throw new ValidationError(\n          `Webhook event timestamp is outside tolerance window (${this.tolerance}ms)`,\n          ['timestamp']\n        );\n      }\n    }\n\n    // Replay protection via the (pluggable) dedup store.\n    if (this.replayProtection) {\n      if (await this.dedupStore.seen(eventId)) {\n        throw new ValidationError(\n          `Duplicate webhook event: ${eventId} has already been processed`,\n          ['id']\n        );\n      }\n      await this.dedupStore.mark(eventId, this.tolerance);\n    }\n\n    return event;\n  }\n\n  private async dispatch(event: WebhookEvent): Promise<void> {\n    const typeHandlers = this.handlers.get(event.event_type) || [];\n    const allHandlers = [...typeHandlers, ...this.anyHandlers];\n\n    for (const handler of allHandlers) {\n      await (handler as WebhookAnyHandler)(event);\n    }\n  }\n}\n","/**\n * Framework middleware helpers for webhook handling.\n *\n * Provides pre-built integrations for Express/Connect and Next.js App Router.\n */\n\nimport { WebhookHandler } from './handler';\nimport type { WebhookHandlerConfig, WebhookEventType, WebhookEventHandler, WebhookAnyHandler } from './types';\n\nexport interface WebhookMiddlewareOptions extends WebhookHandlerConfig {\n  /** Event handlers to register */\n  handlers?: Partial<Record<WebhookEventType, WebhookEventHandler>>;\n  /** Catch-all handler */\n  onAny?: WebhookAnyHandler;\n}\n\n/**\n * Create an Express/Connect-compatible middleware for webhook handling.\n *\n * Expects the raw body to be available as `req.body` (string).\n * Use `express.raw({ type: 'application/json' })` or similar middleware upstream.\n */\nexport function createWebhookMiddleware(options: WebhookMiddlewareOptions) {\n  const handler = buildHandler(options);\n  const signatureHeader = options.signatureHeader || 'x-webhook-signature';\n\n  return async (\n    req: { body: string | Buffer; headers: Record<string, string | string[] | undefined> },\n    res: { status(code: number): { json(body: unknown): void }; json?(body: unknown): void },\n    next?: (err?: unknown) => void\n  ) => {\n    try {\n      const body = typeof req.body === 'string' ? req.body : req.body.toString('utf-8');\n      const signature = req.headers[signatureHeader];\n\n      if (!signature || typeof signature !== 'string') {\n        res.status(401).json({ error: 'Missing webhook signature' });\n        return;\n      }\n\n      await handler.handle(body, signature);\n      res.status(200).json({ received: true });\n    } catch (error) {\n      const message = error instanceof Error ? error.message : 'Webhook processing failed';\n\n      if (message.includes('signature')) {\n        res.status(401).json({ error: message });\n      } else if (message.includes('tolerance') || message.includes('timestamp')) {\n        res.status(400).json({ error: message });\n      } else if (message.includes('Duplicate')) {\n        res.status(409).json({ error: message });\n      } else if (next) {\n        next(error);\n      } else {\n        res.status(500).json({ error: message });\n      }\n    }\n  };\n}\n\n/**\n * Create a Next.js App Router-compatible webhook handler.\n *\n * Returns an async function `(request: Request) => Promise<Response>`.\n */\nexport function createNextWebhookHandler(\n  options: WebhookMiddlewareOptions\n): (request: Request) => Promise<Response> {\n  const handler = buildHandler(options);\n  const signatureHeader = options.signatureHeader || 'x-webhook-signature';\n\n  return async (request: Request): Promise<Response> => {\n    try {\n      const body = await request.text();\n      const signature = request.headers.get(signatureHeader);\n\n      if (!signature) {\n        return new Response(JSON.stringify({ error: 'Missing webhook signature' }), {\n          status: 401,\n          headers: { 'Content-Type': 'application/json' },\n        });\n      }\n\n      await handler.handle(body, signature);\n\n      return new Response(JSON.stringify({ received: true }), {\n        status: 200,\n        headers: { 'Content-Type': 'application/json' },\n      });\n    } catch (error) {\n      const message = error instanceof Error ? error.message : 'Webhook processing failed';\n      const status = message.includes('signature')\n        ? 401\n        : message.includes('tolerance') || message.includes('timestamp')\n          ? 400\n          : message.includes('Duplicate')\n            ? 409\n            : 500;\n\n      return new Response(JSON.stringify({ error: message }), {\n        status,\n        headers: { 'Content-Type': 'application/json' },\n      });\n    }\n  };\n}\n\nfunction buildHandler(options: WebhookMiddlewareOptions): WebhookHandler {\n  const handler = new WebhookHandler(options);\n\n  if (options.handlers) {\n    for (const [eventType, eventHandler] of Object.entries(options.handlers)) {\n      if (eventHandler) {\n        handler.on(eventType as WebhookEventType, eventHandler);\n      }\n    }\n  }\n\n  if (options.onAny) {\n    handler.onAny(options.onAny);\n  }\n\n  return handler;\n}\n"]}
+{"version":3,"sources":["../../src/core/errors.ts","../../src/core/webhook-utils.ts","../../src/core/dedup.ts","../../src/webhooks/handler.ts","../../src/webhooks/middleware.ts","../../src/webhooks/types.ts"],"names":[],"mappings":";;;AAOO,IAAM,WAAA,GAAN,MAAM,YAAA,SAAoB,KAAA,CAAM;AAAA,EAGrC,WAAA,CACE,OAAA,EACO,IAAA,EACA,UAAA,EACA,OAAA,EACP;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AAJN,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAGP,IAAA,IAAA,CAAK,IAAA,GAAO,aAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,YAAA,CAAY,SAAS,CAAA;AAAA,EACnD;AACF,CAAA;AAeO,IAAM,eAAA,GAAN,MAAM,gBAAA,SAAwB,WAAA,CAAY;AAAA,EAC/C,WAAA,CAAY,SAAiB,MAAA,EAAmB;AAC9C,IAAA,KAAA,CAAM,OAAA,EAAS,kBAAA,EAAoB,GAAA,EAAK,EAAE,QAAQ,CAAA;AAClD,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AACZ,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,gBAAA,CAAgB,SAAS,CAAA;AAAA,EACvD;AACF,CAAA;;;ACTA,eAAsB,uBACpB,OAAA,EACA,SAAA,EACA,MAAA,EACA,IAAA,GAAsC,EAAC,EACrB;AAClB,EAAA,MAAM,MAAA,GAAS,qBAAqB,SAAS,CAAA;AAC7C,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,SAAA,GAAY,KAAK,SAAA,IAAa,GAAA;AACpC,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAM,IAAK,KAAK,GAAA,EAAI;AAErC,IAAA,IAAI,SAAA,GAAY,KAAK,IAAA,CAAK,GAAA,CAAI,MAAM,MAAA,CAAO,CAAA,GAAI,GAAI,CAAA,GAAI,SAAA,EAAW;AAChE,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,MAAM,QAAA,GAAW,MAAM,iBAAA,CAAkB,CAAA,EAAG,OAAO,CAAC,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA,EAAI,MAAM,CAAA;AACzE,IAAA,OAAO,iBAAA,CAAkB,MAAA,CAAO,EAAA,EAAI,QAAQ,CAAA;AAAA,EAC9C;AAEA,EAAA,IAAI,IAAA,CAAK,gBAAgB,KAAA,EAAO;AAC9B,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,SAAA,GAAY,MAAM,iBAAA,CAAkB,OAAA,EAAS,MAAM,CAAA;AAEzD,EAAA,MAAM,gBAAA,GAAmB,UAAU,SAAS,CAAA,CAAA;AAE5C,EAAA,IAAI,SAAA,CAAU,UAAA,CAAW,SAAS,CAAA,EAAG;AACnC,IAAA,OAAO,iBAAA,CAAkB,WAAW,gBAAgB,CAAA;AAAA,EACtD;AAEA,EAAA,OAAO,iBAAA,CAAkB,WAAW,SAAS,CAAA;AAC/C;AAMA,SAAS,qBAAqB,SAAA,EAAqD;AACjF,EAAA,IAAI,CAAC,UAAU,QAAA,CAAS,IAAI,KAAK,CAAC,SAAA,CAAU,QAAA,CAAS,KAAK,CAAA,EAAG;AAC3D,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI,CAAA;AACJ,EAAA,IAAI,EAAA;AACJ,EAAA,KAAA,MAAW,IAAA,IAAQ,SAAA,CAAU,KAAA,CAAM,GAAG,CAAA,EAAG;AACvC,IAAA,MAAM,EAAA,GAAK,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC3B,IAAA,IAAI,OAAO,EAAA,EAAI;AACf,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,EAAE,EAAE,IAAA,EAAK;AACnC,IAAA,MAAM,QAAQ,IAAA,CAAK,KAAA,CAAM,EAAA,GAAK,CAAC,EAAE,IAAA,EAAK;AACtC,IAAA,IAAI,GAAA,KAAQ,GAAA,EAAK,CAAA,GAAI,MAAA,CAAO,KAAK,CAAA;AAAA,SAAA,IACxB,GAAA,KAAQ,MAAM,EAAA,GAAK,KAAA;AAAA,EAC9B;AACA,EAAA,IAAI,MAAM,MAAA,IAAa,MAAA,CAAO,MAAM,CAAC,CAAA,IAAK,CAAC,EAAA,EAAI;AAC7C,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,EAAE,GAAG,EAAA,EAAG;AACjB;AAMA,eAAe,iBAAA,CAAkB,SAAiB,MAAA,EAAiC;AAEjF,EAAA,IAAI,OAAO,UAAA,CAAW,MAAA,KAAW,WAAA,IAAe,UAAA,CAAW,OAAO,MAAA,EAAQ;AACxE,IAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,IAAA,MAAM,GAAA,GAAM,MAAM,UAAA,CAAW,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,MACzC,KAAA;AAAA,MACA,OAAA,CAAQ,OAAO,MAAM,CAAA;AAAA,MACrB,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,MAChC,KAAA;AAAA,MACA,CAAC,MAAM;AAAA,KACT;AACA,IAAA,MAAM,GAAA,GAAM,MAAM,UAAA,CAAW,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,GAAA,EAAK,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAC,CAAA;AACpF,IAAA,OAAO,KAAA,CAAM,KAAK,IAAI,UAAA,CAAW,GAAG,CAAC,CAAA,CAClC,IAAI,CAAC,CAAA,KAAM,EAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAC1C,KAAK,EAAE,CAAA;AAAA,EACZ;AAGA,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,OAAO,QAAQ,CAAA;AAC5C,IAAA,OAAO,UAAA,CAAW,UAAU,MAAM,CAAA,CAAE,OAAO,OAAO,CAAA,CAAE,OAAO,KAAK,CAAA;AAAA,EAClE,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,WAAA;AAAA,MACR,uFAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACF;AAKA,SAAS,iBAAA,CAAkB,GAAW,CAAA,EAAoB;AACxD,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,MAAA,IAAU,EAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAAA,EAC5C;AACA,EAAA,OAAO,MAAA,KAAW,CAAA;AACpB;;;AC/GO,IAAM,qBAAN,MAAsD;AAAA,EAK3D,WAAA,CAAY,IAAA,GAAkC,EAAC,EAAG;AAJlD,IAAA,IAAA,CAAiB,UAAA,uBAAiB,GAAA,EAAoB;AAKpD,IAAA,IAAA,CAAK,UAAA,GAAa,KAAK,UAAA,IAAc,GAAA;AACrC,IAAA,IAAA,CAAK,GAAA,GAAM,IAAA,CAAK,GAAA,KAAQ,MAAM,KAAK,GAAA,EAAI,CAAA;AAAA,EACzC;AAAA,EAEA,MAAM,KAAK,EAAA,EAA8B;AACvC,IAAA,OAAO,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,EAAE,CAAA;AAAA,EAC/B;AAAA,EAEA,MAAM,IAAA,CAAK,EAAA,EAAY,KAAA,EAA8B;AACnD,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,EAAA,EAAI,GAAA,GAAM,KAAK,CAAA;AAGnC,IAAA,IAAI,IAAA,CAAK,UAAA,CAAW,IAAA,GAAO,IAAA,CAAK,UAAA,EAAY;AAC1C,MAAA,KAAA,MAAW,CAAC,GAAA,EAAK,SAAS,CAAA,IAAK,KAAK,UAAA,EAAY;AAC9C,QAAA,IAAI,MAAM,SAAA,EAAW;AACnB,UAAA,IAAA,CAAK,UAAA,CAAW,OAAO,GAAG,CAAA;AAAA,QAC5B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ACnCA,SAAS,eAAe,KAAA,EAAyC;AAC/D,EAAA,IAAI,MAAM,EAAA,EAAI;AACZ,IAAA,OAAO,KAAA,CAAM,EAAA;AAAA,EACf;AACA,EAAA,IAAI,KAAA,CAAM,eAAe,sBAAA,EAAwB;AAC/C,IAAA,OAAO,MAAM,YAAA,EAAc,EAAA;AAAA,EAC7B;AACA,EAAA,OAAO,MAAA;AACT;AAEO,IAAM,iBAAN,MAAqB;AAAA,EAS1B,YAAY,MAAA,EAA8B;AAR1C,IAAA,IAAA,CAAQ,QAAA,uBAAe,GAAA,EAA6C;AACpE,IAAA,IAAA,CAAQ,cAAmC,EAAC;AAQ1C,IAAA,IAAA,CAAK,SAAS,MAAA,CAAO,MAAA;AACrB,IAAA,IAAA,CAAK,SAAA,GAAY,OAAO,SAAA,IAAa,GAAA;AACrC,IAAA,IAAA,CAAK,gBAAA,GAAmB,OAAO,gBAAA,IAAoB,IAAA;AACnD,IAAA,IAAA,CAAK,oBAAA,GAAuB,OAAO,oBAAA,IAAwB,IAAA;AAC3D,IAAA,IAAA,CAAK,UAAA,GAAa,MAAA,CAAO,UAAA,IAAc,IAAI,kBAAA,EAAmB;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA,EAKA,EAAA,CACE,WACA,OAAA,EACM;AACN,IAAA,MAAM,WAAW,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,SAAS,KAAK,EAAC;AAClD,IAAA,QAAA,CAAS,KAAK,OAAyC,CAAA;AACvD,IAAA,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,SAAA,EAAW,QAAQ,CAAA;AACrC,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAA,EAAkC;AACtC,IAAA,IAAA,CAAK,WAAA,CAAY,KAAK,OAAO,CAAA;AAC7B,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAA,CAAe,IAAA,EAAc,SAAA,EAA0C;AAC3E,IAAA,MAAM,UAAU,MAAM,sBAAA,CAAuB,IAAA,EAAM,SAAA,EAAW,KAAK,MAAA,EAAQ;AAAA,MACzE,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,aAAa,IAAA,CAAK;AAAA,KACnB,CAAA;AACD,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAI,eAAA,CAAgB,2BAAA,EAA6B,CAAC,WAAW,CAAC,CAAA;AAAA,IACtE;AAEA,IAAA,OAAO,IAAA,CAAK,iBAAiB,IAAI,CAAA;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAA,CAAO,IAAA,EAAc,SAAA,EAAkC;AAC3D,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,cAAA,CAAe,MAAM,SAAS,CAAA;AACvD,IAAA,MAAM,IAAA,CAAK,SAAS,KAAK,CAAA;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,WAAW,IAAA,EAAqC;AACpD,IAAA,OAAO,IAAA,CAAK,iBAAiB,IAAI,CAAA;AAAA,EACnC;AAAA,EAEA,MAAc,iBAAiB,IAAA,EAAqC;AAClE,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC7B,IAAA,MAAM,OAAA,GAAU,eAAe,KAAK,CAAA;AAEpC,IAAA,IAAI,CAAC,KAAA,CAAM,UAAA,IAAc,CAAC,OAAA,IAAW,CAAC,MAAM,SAAA,EAAW;AACrD,MAAA,MAAM,IAAI,eAAA;AAAA,QACR,4EAAA;AAAA,QACA,CAAC,YAAA,EAAc,IAAA,EAAM,WAAW;AAAA,OAClC;AAAA,IACF;AAIA,IAAA,IAAI,IAAA,CAAK,YAAY,CAAA,EAAG;AACtB,MAAA,MAAM,YAAY,IAAI,IAAA,CAAK,KAAA,CAAM,SAAS,EAAE,OAAA,EAAQ;AACpD,MAAA,IAAI,IAAA,CAAK,IAAI,IAAA,CAAK,GAAA,KAAQ,SAAS,CAAA,GAAI,KAAK,SAAA,EAAW;AACrD,QAAA,MAAM,IAAI,eAAA;AAAA,UACR,CAAA,qDAAA,EAAwD,KAAK,SAAS,CAAA,GAAA,CAAA;AAAA,UACtE,CAAC,WAAW;AAAA,SACd;AAAA,MACF;AAAA,IACF;AAGA,IAAA,IAAI,KAAK,gBAAA,EAAkB;AACzB,MAAA,IAAI,MAAM,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,OAAO,CAAA,EAAG;AACvC,QAAA,MAAM,IAAI,eAAA;AAAA,UACR,4BAA4B,OAAO,CAAA,2BAAA,CAAA;AAAA,UACnC,CAAC,IAAI;AAAA,SACP;AAAA,MACF;AACA,MAAA,MAAM,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,OAAA,EAAS,KAAK,SAAS,CAAA;AAAA,IACpD;AAEA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,MAAc,SAAS,KAAA,EAAoC;AACzD,IAAA,MAAM,eAAe,IAAA,CAAK,QAAA,CAAS,IAAI,KAAA,CAAM,UAAU,KAAK,EAAC;AAC7D,IAAA,MAAM,cAAc,CAAC,GAAG,YAAA,EAAc,GAAG,KAAK,WAAW,CAAA;AAEzD,IAAA,KAAA,MAAW,WAAW,WAAA,EAAa;AACjC,MAAA,MAAO,QAA8B,KAAK,CAAA;AAAA,IAC5C;AAAA,EACF;AACF;;;ACrHO,SAAS,wBAAwB,OAAA,EAAmC;AACzE,EAAA,MAAM,OAAA,GAAU,aAAa,OAAO,CAAA;AACpC,EAAA,MAAM,eAAA,GAAkB,QAAQ,eAAA,IAAmB,qBAAA;AAEnD,EAAA,OAAO,OACL,GAAA,EACA,GAAA,EACA,IAAA,KACG;AACH,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,OAAO,GAAA,CAAI,IAAA,KAAS,QAAA,GAAW,IAAI,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,QAAA,CAAS,OAAO,CAAA;AAChF,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,eAAe,CAAA;AAE7C,MAAA,IAAI,CAAC,SAAA,IAAa,OAAO,SAAA,KAAc,QAAA,EAAU;AAC/C,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,6BAA6B,CAAA;AAC3D,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,CAAQ,MAAA,CAAO,IAAA,EAAM,SAAS,CAAA;AACpC,MAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,QAAA,EAAU,MAAM,CAAA;AAAA,IACzC,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,OAAA,GAAU,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,2BAAA;AAEzD,MAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,WAAW,CAAA,EAAG;AACjC,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,SAAS,CAAA;AAAA,MACzC,CAAA,MAAA,IAAW,QAAQ,QAAA,CAAS,WAAW,KAAK,OAAA,CAAQ,QAAA,CAAS,WAAW,CAAA,EAAG;AACzE,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,SAAS,CAAA;AAAA,MACzC,CAAA,MAAA,IAAW,OAAA,CAAQ,QAAA,CAAS,WAAW,CAAA,EAAG;AACxC,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,SAAS,CAAA;AAAA,MACzC,WAAW,IAAA,EAAM;AACf,QAAA,IAAA,CAAK,KAAK,CAAA;AAAA,MACZ,CAAA,MAAO;AACL,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,SAAS,CAAA;AAAA,MACzC;AAAA,IACF;AAAA,EACF,CAAA;AACF;AAOO,SAAS,yBACd,OAAA,EACyC;AACzC,EAAA,MAAM,OAAA,GAAU,aAAa,OAAO,CAAA;AACpC,EAAA,MAAM,eAAA,GAAkB,QAAQ,eAAA,IAAmB,qBAAA;AAEnD,EAAA,OAAO,OAAO,OAAA,KAAwC;AACpD,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,IAAA,EAAK;AAChC,MAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA;AAErD,MAAA,IAAI,CAAC,SAAA,EAAW;AACd,QAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,2BAAA,EAA6B,CAAA,EAAG;AAAA,UAC1E,MAAA,EAAQ,GAAA;AAAA,UACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,SAC/C,CAAA;AAAA,MACH;AAEA,MAAA,MAAM,OAAA,CAAQ,MAAA,CAAO,IAAA,EAAM,SAAS,CAAA;AAEpC,MAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,QAAA,EAAU,IAAA,EAAM,CAAA,EAAG;AAAA,QACtD,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,OAC/C,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,OAAA,GAAU,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,2BAAA;AACzD,MAAA,MAAM,SAAS,OAAA,CAAQ,QAAA,CAAS,WAAW,CAAA,GACvC,GAAA,GACA,QAAQ,QAAA,CAAS,WAAW,KAAK,OAAA,CAAQ,QAAA,CAAS,WAAW,CAAA,GAC3D,GAAA,GACA,QAAQ,QAAA,CAAS,WAAW,IAC1B,GAAA,GACA,GAAA;AAER,MAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG;AAAA,QACtD,MAAA;AAAA,QACA,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,OAC/C,CAAA;AAAA,IACH;AAAA,EACF,CAAA;AACF;AAEA,SAAS,aAAa,OAAA,EAAmD;AACvE,EAAA,MAAM,OAAA,GAAU,IAAI,cAAA,CAAe,OAAO,CAAA;AAE1C,EAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,IAAA,KAAA,MAAW,CAAC,WAAW,YAAY,CAAA,IAAK,OAAO,OAAA,CAAQ,OAAA,CAAQ,QAAQ,CAAA,EAAG;AACxE,MAAA,IAAI,YAAA,EAAc;AAChB,QAAA,OAAA,CAAQ,EAAA,CAAG,WAA+B,YAAY,CAAA;AAAA,MACxD;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,IAAA,OAAA,CAAQ,KAAA,CAAM,QAAQ,KAAK,CAAA;AAAA,EAC7B;AAEA,EAAA,OAAO,OAAA;AACT;;;ACmJO,SAAS,wBAAwB,KAAA,EAAgD;AACtF,EAAA,OACE,OAAO,UAAU,QAAA,IACjB,KAAA,KAAU,QACT,KAAA,CAA8B,KAAA,KAAU,KAAA,IACxC,KAAA,CAA8B,KAAA,KAAU,IAAA;AAE7C","file":"index.js","sourcesContent":["/**\n * Error hierarchy for Vesant SDK\n *\n * Provides structured error handling with specific error types\n * for different failure scenarios.\n */\n\nexport class VesantError extends Error {\n  public requestId?: string;\n\n  constructor(\n    message: string,\n    public code: string,\n    public statusCode?: number,\n    public details?: Record<string, unknown>\n  ) {\n    super(message);\n    this.name = 'VesantError';\n    Object.setPrototypeOf(this, VesantError.prototype);\n  }\n}\n\n/** @deprecated Use VesantError instead */\nexport const CGSError = VesantError;\n/** @deprecated Use VesantError instead */\nexport type CGSError = VesantError;\n\nexport class NetworkError extends VesantError {\n  constructor(message: string, public originalError?: unknown) {\n    super(message, 'NETWORK_ERROR');\n    this.name = 'NetworkError';\n    Object.setPrototypeOf(this, NetworkError.prototype);\n  }\n}\n\nexport class ValidationError extends VesantError {\n  constructor(message: string, fields?: string[]) {\n    super(message, 'VALIDATION_ERROR', 400, { fields });\n    this.name = 'ValidationError';\n    Object.setPrototypeOf(this, ValidationError.prototype);\n  }\n}\n\nexport class ServiceUnavailableError extends VesantError {\n  constructor(message: string = 'Service unavailable') {\n    super(message, 'SERVICE_UNAVAILABLE', 503);\n    this.name = 'ServiceUnavailableError';\n    Object.setPrototypeOf(this, ServiceUnavailableError.prototype);\n  }\n}\n\nexport class ComplianceBlockedError extends VesantError {\n  constructor(reasons: string[]) {\n    super('Access blocked due to compliance rules', 'COMPLIANCE_BLOCKED', 403, { reasons });\n    this.name = 'ComplianceBlockedError';\n    Object.setPrototypeOf(this, ComplianceBlockedError.prototype);\n  }\n}\n\nexport class AuthenticationError extends VesantError {\n  constructor(message: string = 'Authentication failed') {\n    super(message, 'AUTHENTICATION_ERROR', 401);\n    this.name = 'AuthenticationError';\n    Object.setPrototypeOf(this, AuthenticationError.prototype);\n  }\n}\n\nexport class RateLimitError extends VesantError {\n  constructor(public retryAfter?: number) {\n    super('Rate limit exceeded', 'RATE_LIMIT_EXCEEDED', 429, { retryAfter });\n    this.name = 'RateLimitError';\n    Object.setPrototypeOf(this, RateLimitError.prototype);\n  }\n}\n\nexport class TimeoutError extends VesantError {\n  constructor(public timeout: number) {\n    super(`Request timeout after ${timeout}ms`, 'TIMEOUT', 408, { timeout });\n    this.name = 'TimeoutError';\n    Object.setPrototypeOf(this, TimeoutError.prototype);\n  }\n}\n\nexport class ComplianceError extends VesantError {\n  constructor(\n    message: string,\n    public originalError?: unknown,\n    code: string = 'COMPLIANCE_ERROR'\n  ) {\n    super(message, code);\n    this.name = 'ComplianceError';\n    Object.setPrototypeOf(this, ComplianceError.prototype);\n  }\n}\n\nexport class CircuitBreakerOpenError extends VesantError {\n  constructor() {\n    super('Circuit breaker is open — requests are temporarily blocked', 'CIRCUIT_BREAKER_OPEN', 503);\n    this.name = 'CircuitBreakerOpenError';\n    Object.setPrototypeOf(this, CircuitBreakerOpenError.prototype);\n  }\n}\n","/**\n * Webhook signature verification utilities.\n *\n * Supports both Web Crypto API (browsers, Deno, Cloudflare Workers)\n * and Node.js crypto module with automatic runtime detection.\n * Uses constant-time comparison to prevent timing attacks.\n */\n\nimport { VesantError } from './errors';\n\nexport interface VerifyWebhookSignatureOptions {\n  /** Max allowed clock skew in ms for the signed-timestamp scheme (default: 300000). */\n  tolerance?: number;\n  /** Clock source for the tolerance check (default: Date.now). */\n  now?: () => number;\n  /** Accept the legacy body-only `sha256=<hex>` format (default: true, for migration). */\n  allowLegacy?: boolean;\n}\n\n/**\n * Verify an HMAC-SHA256 webhook signature.\n *\n * Supports two schemes:\n * - Signed-timestamp (preferred): `t=<unix>,v1=<hex>` where the HMAC is computed\n *   over `${t}.${payload}`. The timestamp is inside the signed material, so a\n *   replayed body is rejected once `|now - t|` exceeds the tolerance — the check\n *   is done BEFORE the HMAC compare and authenticates the timestamp.\n * - Legacy (body-only): `sha256=<hex>` (or raw hex) over the payload alone. Kept\n *   for the migration window; disable via `allowLegacy: false`.\n *\n * @returns true if the signature is valid\n */\nexport async function verifyWebhookSignature(\n  payload: string,\n  signature: string,\n  secret: string,\n  opts: VerifyWebhookSignatureOptions = {}\n): Promise<boolean> {\n  const signed = parseSignedTimestamp(signature);\n  if (signed) {\n    const tolerance = opts.tolerance ?? 300000;\n    const now = opts.now?.() ?? Date.now();\n    // Authenticate the timestamp first — reject replays before any HMAC compare.\n    if (tolerance > 0 && Math.abs(now - signed.t * 1000) > tolerance) {\n      return false;\n    }\n    const expected = await computeHmacSha256(`${signed.t}.${payload}`, secret);\n    return constantTimeEqual(signed.v1, expected);\n  }\n\n  if (opts.allowLegacy === false) {\n    return false;\n  }\n\n  const hexDigest = await computeHmacSha256(payload, secret);\n  // Backend sends \"sha256=<hex>\" format — support both prefixed and raw signatures\n  const expectedPrefixed = `sha256=${hexDigest}`;\n\n  if (signature.startsWith('sha256=')) {\n    return constantTimeEqual(signature, expectedPrefixed);\n  }\n\n  return constantTimeEqual(signature, hexDigest);\n}\n\n/**\n * Parse the `t=<unix>,v1=<hex>` signed-timestamp scheme; returns null if the\n * signature is not in that form (e.g. legacy `sha256=<hex>`).\n */\nfunction parseSignedTimestamp(signature: string): { t: number; v1: string } | null {\n  if (!signature.includes('t=') || !signature.includes('v1=')) {\n    return null;\n  }\n  let t: number | undefined;\n  let v1: string | undefined;\n  for (const part of signature.split(',')) {\n    const eq = part.indexOf('=');\n    if (eq === -1) continue;\n    const key = part.slice(0, eq).trim();\n    const value = part.slice(eq + 1).trim();\n    if (key === 't') t = Number(value);\n    else if (key === 'v1') v1 = value;\n  }\n  if (t === undefined || Number.isNaN(t) || !v1) {\n    return null;\n  }\n  return { t, v1 };\n}\n\n/**\n * Compute HMAC-SHA256 hex digest.\n * Automatically selects Web Crypto API or Node.js crypto.\n */\nasync function computeHmacSha256(message: string, secret: string): Promise<string> {\n  // Try Web Crypto API first (browsers, Deno, Cloudflare Workers, Node 18+)\n  if (typeof globalThis.crypto !== 'undefined' && globalThis.crypto.subtle) {\n    const encoder = new TextEncoder();\n    const key = await globalThis.crypto.subtle.importKey(\n      'raw',\n      encoder.encode(secret),\n      { name: 'HMAC', hash: 'SHA-256' },\n      false,\n      ['sign']\n    );\n    const sig = await globalThis.crypto.subtle.sign('HMAC', key, encoder.encode(message));\n    return Array.from(new Uint8Array(sig))\n      .map((b) => b.toString(16).padStart(2, '0'))\n      .join('');\n  }\n\n  // Fallback to Node.js crypto module\n  try {\n    const { createHmac } = await import('crypto');\n    return createHmac('sha256', secret).update(message).digest('hex');\n  } catch {\n    throw new VesantError(\n      'No crypto implementation available. Requires Web Crypto API or Node.js crypto module.',\n      'CRYPTO_UNAVAILABLE'\n    );\n  }\n}\n\n/**\n * Constant-time string comparison to prevent timing attacks.\n */\nfunction constantTimeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n\n  let result = 0;\n  for (let i = 0; i < a.length; i++) {\n    result |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return result === 0;\n}\n","/**\n * Pluggable dedup store for webhook replay protection.\n *\n * The default InMemoryDedupStore is process-local — correct for a single\n * long-lived process, but useless across replicas / serverless invocations where\n * the backend's at-least-once retries land on different instances. Supply a\n * shared implementation (e.g. Redis with SETNX + TTL) via WebhookHandlerConfig\n * to dedup reliably in those deployments.\n */\n\nexport interface WebhookDedupStore {\n  /** Has this event id already been processed? */\n  seen(id: string): Promise<boolean>;\n  /** Record this event id as processed, retained for at least ttlMs. */\n  mark(id: string, ttlMs: number): Promise<void>;\n}\n\nexport interface InMemoryDedupStoreOptions {\n  /** Purge expired entries once the map grows past this size (default: 1000). */\n  maxEntries?: number;\n  /** Injectable clock (default: Date.now). */\n  now?: () => number;\n}\n\nexport class InMemoryDedupStore implements WebhookDedupStore {\n  private readonly expiryById = new Map<string, number>();\n  private readonly maxEntries: number;\n  private readonly now: () => number;\n\n  constructor(opts: InMemoryDedupStoreOptions = {}) {\n    this.maxEntries = opts.maxEntries ?? 1000;\n    this.now = opts.now ?? (() => Date.now());\n  }\n\n  async seen(id: string): Promise<boolean> {\n    return this.expiryById.has(id);\n  }\n\n  async mark(id: string, ttlMs: number): Promise<void> {\n    const now = this.now();\n    this.expiryById.set(id, now + ttlMs);\n\n    // Bounded memory: purge expired entries once the map grows too large.\n    if (this.expiryById.size > this.maxEntries) {\n      for (const [key, expiresAt] of this.expiryById) {\n        if (now > expiresAt) {\n          this.expiryById.delete(key);\n        }\n      }\n    }\n  }\n}\n","/**\n * Webhook event handler with signature verification and typed dispatch.\n */\n\nimport { verifyWebhookSignature } from '../core/webhook-utils';\nimport { ValidationError } from '../core/errors';\nimport { InMemoryDedupStore, type WebhookDedupStore } from '../core';\nimport type {\n  WebhookEvent,\n  WebhookEventType,\n  WebhookEventHandler,\n  WebhookAnyHandler,\n  WebhookHandlerConfig,\n} from './types';\n\n/** Resolve the event id: the top-level `id`, or `notification.id` for the notification envelope. */\nfunction resolveEventId(event: WebhookEvent): string | undefined {\n  if (event.id) {\n    return event.id;\n  }\n  if (event.event_type === 'notification.created') {\n    return event.notification?.id;\n  }\n  return undefined;\n}\n\nexport class WebhookHandler {\n  private handlers = new Map<WebhookEventType, WebhookEventHandler[]>();\n  private anyHandlers: WebhookAnyHandler[] = [];\n  private readonly secret: string;\n  private readonly tolerance: number;\n  private readonly replayProtection: boolean;\n  private readonly allowLegacySignature: boolean;\n  private readonly dedupStore: WebhookDedupStore;\n\n  constructor(config: WebhookHandlerConfig) {\n    this.secret = config.secret;\n    this.tolerance = config.tolerance ?? 300000; // 5 minutes\n    this.replayProtection = config.replayProtection ?? true;\n    this.allowLegacySignature = config.allowLegacySignature ?? true;\n    this.dedupStore = config.dedupStore ?? new InMemoryDedupStore();\n  }\n\n  /**\n   * Register a handler for a specific event type.\n   */\n  on<T extends WebhookEventType>(\n    eventType: T,\n    handler: WebhookEventHandler<T>\n  ): this {\n    const existing = this.handlers.get(eventType) || [];\n    existing.push(handler as unknown as WebhookEventHandler);\n    this.handlers.set(eventType, existing);\n    return this;\n  }\n\n  /**\n   * Register a catch-all handler for all event types.\n   */\n  onAny(handler: WebhookAnyHandler): this {\n    this.anyHandlers.push(handler);\n    return this;\n  }\n\n  /**\n   * Verify signature and parse the webhook body.\n   */\n  async verifyAndParse(body: string, signature: string): Promise<WebhookEvent> {\n    const isValid = await verifyWebhookSignature(body, signature, this.secret, {\n      tolerance: this.tolerance,\n      allowLegacy: this.allowLegacySignature,\n    });\n    if (!isValid) {\n      throw new ValidationError('Invalid webhook signature', ['signature']);\n    }\n\n    return this.parseAndValidate(body);\n  }\n\n  /**\n   * Verify signature, parse, and dispatch to registered handlers.\n   */\n  async handle(body: string, signature: string): Promise<void> {\n    const event = await this.verifyAndParse(body, signature);\n    await this.dispatch(event);\n  }\n\n  /**\n   * Parse an event without signature verification (for testing).\n   */\n  async parseEvent(body: string): Promise<WebhookEvent> {\n    return this.parseAndValidate(body);\n  }\n\n  private async parseAndValidate(body: string): Promise<WebhookEvent> {\n    const event = JSON.parse(body) as WebhookEvent;\n    const eventId = resolveEventId(event);\n\n    if (!event.event_type || !eventId || !event.timestamp) {\n      throw new ValidationError(\n        'Invalid webhook event: missing required fields (event_type, id, timestamp)',\n        ['event_type', 'id', 'timestamp']\n      );\n    }\n\n    // Timestamp tolerance check (defense in depth; the signed-timestamp scheme\n    // also authenticates the timestamp in verifyWebhookSignature).\n    if (this.tolerance > 0) {\n      const eventTime = new Date(event.timestamp).getTime();\n      if (Math.abs(Date.now() - eventTime) > this.tolerance) {\n        throw new ValidationError(\n          `Webhook event timestamp is outside tolerance window (${this.tolerance}ms)`,\n          ['timestamp']\n        );\n      }\n    }\n\n    // Replay protection via the (pluggable) dedup store.\n    if (this.replayProtection) {\n      if (await this.dedupStore.seen(eventId)) {\n        throw new ValidationError(\n          `Duplicate webhook event: ${eventId} has already been processed`,\n          ['id']\n        );\n      }\n      await this.dedupStore.mark(eventId, this.tolerance);\n    }\n\n    return event;\n  }\n\n  private async dispatch(event: WebhookEvent): Promise<void> {\n    const typeHandlers = this.handlers.get(event.event_type) || [];\n    const allHandlers = [...typeHandlers, ...this.anyHandlers];\n\n    for (const handler of allHandlers) {\n      await (handler as WebhookAnyHandler)(event);\n    }\n  }\n}\n","/**\n * Framework middleware helpers for webhook handling.\n *\n * Provides pre-built integrations for Express/Connect and Next.js App Router.\n */\n\nimport { WebhookHandler } from './handler';\nimport type { WebhookHandlerConfig, WebhookEventType, WebhookEventHandler, WebhookAnyHandler } from './types';\n\nexport interface WebhookMiddlewareOptions extends WebhookHandlerConfig {\n  /** Event handlers to register */\n  handlers?: Partial<Record<WebhookEventType, WebhookEventHandler>>;\n  /** Catch-all handler */\n  onAny?: WebhookAnyHandler;\n}\n\n/**\n * Create an Express/Connect-compatible middleware for webhook handling.\n *\n * Expects the raw body to be available as `req.body` (string).\n * Use `express.raw({ type: 'application/json' })` or similar middleware upstream.\n */\nexport function createWebhookMiddleware(options: WebhookMiddlewareOptions) {\n  const handler = buildHandler(options);\n  const signatureHeader = options.signatureHeader || 'x-webhook-signature';\n\n  return async (\n    req: { body: string | Buffer; headers: Record<string, string | string[] | undefined> },\n    res: { status(code: number): { json(body: unknown): void }; json?(body: unknown): void },\n    next?: (err?: unknown) => void\n  ) => {\n    try {\n      const body = typeof req.body === 'string' ? req.body : req.body.toString('utf-8');\n      const signature = req.headers[signatureHeader];\n\n      if (!signature || typeof signature !== 'string') {\n        res.status(401).json({ error: 'Missing webhook signature' });\n        return;\n      }\n\n      await handler.handle(body, signature);\n      res.status(200).json({ received: true });\n    } catch (error) {\n      const message = error instanceof Error ? error.message : 'Webhook processing failed';\n\n      if (message.includes('signature')) {\n        res.status(401).json({ error: message });\n      } else if (message.includes('tolerance') || message.includes('timestamp')) {\n        res.status(400).json({ error: message });\n      } else if (message.includes('Duplicate')) {\n        res.status(409).json({ error: message });\n      } else if (next) {\n        next(error);\n      } else {\n        res.status(500).json({ error: message });\n      }\n    }\n  };\n}\n\n/**\n * Create a Next.js App Router-compatible webhook handler.\n *\n * Returns an async function `(request: Request) => Promise<Response>`.\n */\nexport function createNextWebhookHandler(\n  options: WebhookMiddlewareOptions\n): (request: Request) => Promise<Response> {\n  const handler = buildHandler(options);\n  const signatureHeader = options.signatureHeader || 'x-webhook-signature';\n\n  return async (request: Request): Promise<Response> => {\n    try {\n      const body = await request.text();\n      const signature = request.headers.get(signatureHeader);\n\n      if (!signature) {\n        return new Response(JSON.stringify({ error: 'Missing webhook signature' }), {\n          status: 401,\n          headers: { 'Content-Type': 'application/json' },\n        });\n      }\n\n      await handler.handle(body, signature);\n\n      return new Response(JSON.stringify({ received: true }), {\n        status: 200,\n        headers: { 'Content-Type': 'application/json' },\n      });\n    } catch (error) {\n      const message = error instanceof Error ? error.message : 'Webhook processing failed';\n      const status = message.includes('signature')\n        ? 401\n        : message.includes('tolerance') || message.includes('timestamp')\n          ? 400\n          : message.includes('Duplicate')\n            ? 409\n            : 500;\n\n      return new Response(JSON.stringify({ error: message }), {\n        status,\n        headers: { 'Content-Type': 'application/json' },\n      });\n    }\n  };\n}\n\nfunction buildHandler(options: WebhookMiddlewareOptions): WebhookHandler {\n  const handler = new WebhookHandler(options);\n\n  if (options.handlers) {\n    for (const [eventType, eventHandler] of Object.entries(options.handlers)) {\n      if (eventHandler) {\n        handler.on(eventType as WebhookEventType, eventHandler);\n      }\n    }\n  }\n\n  if (options.onAny) {\n    handler.onAny(options.onAny);\n  }\n\n  return handler;\n}\n","/**\n * Webhook event types and payload definitions.\n */\n\nimport type { Timestamp, UUID, RiskLevel } from '../core/types';\nimport type { WebhookDedupStore } from '../core';\n\n// --- Event Types ---\n\nexport type WebhookEventType =\n  | 'notification.created'\n  | 'risk.score.changed'\n  | 'risk.category.changed'\n  | 'profile.created'\n  | 'profile.updated'\n  | 'geolocation.verified'\n  | 'geolocation.blocked'\n  | 'kyc.status.changed'\n  | 'kyc.approved'\n  | 'kyc.declined'\n  | 'decision.recorded'\n  | 'label.applied'\n  | 'location_request.completed'\n  | 'compliance.check.failed'\n  | 'tax.reminder.sent';\n\n// --- Base Event ---\n\nexport interface BaseWebhookEvent<\n  T extends WebhookEventType = WebhookEventType,\n  P = unknown,\n> {\n  /**\n   * Top-level event id (typed events). The notification envelope carries none —\n   * the handler resolves the id from `notification.id`.\n   */\n  id?: UUID;\n  event_type: T;\n  tenant_id: string;\n  environment: 'production' | 'sandbox';\n  /** Absent on the notification envelope; present on typed events. */\n  customer_id?: string;\n  payload: P;\n  timestamp: Timestamp;\n  metadata?: Record<string, unknown>;\n}\n\n// --- Typed Payloads ---\n\nexport interface RiskScoreChangedPayload {\n  previous_score: number;\n  new_score: number;\n  risk_level: RiskLevel;\n  factors: string[];\n}\n\nexport interface RiskCategoryChangedPayload {\n  previous_category: string;\n  new_category: string;\n  risk_level: RiskLevel;\n}\n\nexport interface ProfileCreatedPayload {\n  customer_id: string;\n  entity_type: string;\n  source: string;\n}\n\nexport interface ProfileUpdatedPayload {\n  customer_id: string;\n  updated_fields: string[];\n}\n\nexport interface GeolocationVerifiedPayload {\n  latitude: number;\n  longitude: number;\n  country: string;\n  region?: string;\n  is_compliant: boolean;\n}\n\nexport interface GeolocationBlockedPayload {\n  latitude: number;\n  longitude: number;\n  country: string;\n  region?: string;\n  reasons: string[];\n}\n\nexport interface KycStatusChangedPayload {\n  previous_status: string;\n  new_status: string;\n  provider?: string;\n}\n\nexport interface DecisionRecordedPayload {\n  decision_id: string;\n  decision_type: string;\n  category: string;\n  source: string;\n  risk_score?: number;\n}\n\nexport interface LabelAppliedPayload {\n  label_type: string;\n  reasons?: string[];\n}\n\nexport interface LocationRequestCompletedPayload {\n  request_id: string;\n  status: string;\n  latitude?: number;\n  longitude?: number;\n}\n\nexport interface ComplianceCheckFailedPayload {\n  check_type: string;\n  reasons: string[];\n  severity: string;\n}\n\nexport interface TaxReminderSentPayload {\n  /** W-form the reminder is for (e.g. \"W-9\", \"W-8BEN\", \"W-8BEN-E\") */\n  form_type: string;\n  /** Sequential count of reminders sent in the current solicitation cycle */\n  reminder_count: number;\n  /** Configured maximum reminders per cycle (reminder_max_count) */\n  max_count: number;\n}\n\n// --- Notification Envelope (the real notification-service producer payload) ---\n\nexport interface WebhookNotification {\n  id: string;\n  user_id?: string;\n  title?: string;\n  message?: string;\n}\n\n/**\n * The `notification.created` envelope emitted by notification-service. Unlike the\n * typed events it has no top-level `id`/`customer_id` and no `payload`; the data\n * is nested under `notification`.\n */\nexport interface NotificationWebhookEvent {\n  id?: UUID;\n  event_type: 'notification.created';\n  tenant_id: string;\n  environment: 'production' | 'sandbox';\n  customer_id?: string;\n  notification: WebhookNotification;\n  timestamp: Timestamp;\n  metadata?: Record<string, unknown>;\n}\n\n// --- Discriminated Union ---\n\nexport type WebhookEvent =\n  | NotificationWebhookEvent\n  | BaseWebhookEvent<'risk.score.changed', RiskScoreChangedPayload>\n  | BaseWebhookEvent<'risk.category.changed', RiskCategoryChangedPayload>\n  | BaseWebhookEvent<'profile.created', ProfileCreatedPayload>\n  | BaseWebhookEvent<'profile.updated', ProfileUpdatedPayload>\n  | BaseWebhookEvent<'geolocation.verified', GeolocationVerifiedPayload>\n  | BaseWebhookEvent<'geolocation.blocked', GeolocationBlockedPayload>\n  | BaseWebhookEvent<'kyc.status.changed', KycStatusChangedPayload>\n  | BaseWebhookEvent<'kyc.approved', KycStatusChangedPayload>\n  | BaseWebhookEvent<'kyc.declined', KycStatusChangedPayload>\n  | BaseWebhookEvent<'decision.recorded', DecisionRecordedPayload>\n  | BaseWebhookEvent<'label.applied', LabelAppliedPayload>\n  | BaseWebhookEvent<'location_request.completed', LocationRequestCompletedPayload>\n  | BaseWebhookEvent<'compliance.check.failed', ComplianceCheckFailedPayload>\n  | BaseWebhookEvent<'tax.reminder.sent', TaxReminderSentPayload>;\n\n// --- Handler Config ---\n\nexport interface WebhookHandlerConfig {\n  /** Webhook signing secret for signature verification */\n  secret: string;\n  /** Header name containing the signature (default: 'x-webhook-signature') */\n  signatureHeader?: string;\n  /** Maximum age of webhook event in ms (default: 300000 = 5 minutes) */\n  tolerance?: number;\n  /** Enable replay protection to reject duplicate event IDs (default: true) */\n  replayProtection?: boolean;\n  /** Pluggable dedup store for replay protection (default: in-memory, process-local). */\n  dedupStore?: WebhookDedupStore;\n  /** Accept the legacy body-only `sha256=<hex>` signature during migration (default: true). */\n  allowLegacySignature?: boolean;\n}\n\n// --- Handler Types ---\n\nexport type WebhookEventHandler<T extends WebhookEventType = WebhookEventType> = (\n  event: Extract<WebhookEvent, { event_type: T }>\n) => void | Promise<void>;\n\nexport type WebhookAnyHandler = (event: WebhookEvent) => void | Promise<void>;\n\n// --- AML Block Callback ---\n\n/** Watchlist category an AML screening matched. */\nexport type AmlCallbackCategory =\n  | 'sanction'\n  | 'pep'\n  | 'adverse_media'\n  | 'fraud'\n  | 'terrorism'\n  | 'narcotics'\n  | 'financial_crime'\n  | 'warning'\n  | 'fitness_probity'\n  | 'previous_client'\n  | 'unknown'\n  | (string & Record<string, never>);\n\nexport interface AmlBlockCallbackData {\n  /** Your customer identifier — the one the screening ran against. */\n  customer_id: string;\n  /** Screened full name. Omitted when the screening had no full name. */\n  customer_name?: string;\n  /**\n   * Derived from the number of matches against your tenant's risk thresholds —\n   * not from the category. A sanction match is not automatically `high`.\n   */\n  risk_level: RiskLevel;\n  /** The category that matched. `previous_client` is a match on your internal watchlist only. */\n  category: AmlCallbackCategory;\n  /** Total matches, including internal watchlist matches. */\n  hits_count: number;\n  /** Name of the AML alert rule that decided the block. */\n  applied_rule?: string;\n  /** ISO 8601 UTC time the screening ran. */\n  screened_at?: Timestamp;\n}\n\n/**\n * Body POSTed to the webhook URL in your AML screening settings when a\n * screening matches a watchlist and the governing alert rule carries the\n * `block` reaction. Signed with `X-Webhook-Signature: sha256=<hex>`\n * (HMAC-SHA256 of the raw body).\n *\n * Sent only for blocks — nothing is delivered for a clear screening or for a\n * rule that only alerts. Screenings that run without a request from you (after\n * an accepted KYC, or after a name or date-of-birth change) are reported only\n * through this webhook.\n */\nexport interface AmlBlockCallbackEvent {\n  /** Always `\"aml\"` — dispatch on this. */\n  event: 'aml';\n  /** The screening reference you supplied, or a generated identifier for automatic screenings. */\n  reference: string;\n  /** The screening record ID — unique per screening, so dedup on it. */\n  resource_id: string;\n  /** Always `\"blocked\"`. */\n  status: 'blocked';\n  /** Always `true`. */\n  block: true;\n  /**\n   * Human-readable reason for display and audit. Wording is not stable — branch\n   * on `data.category` and `data.risk_level` instead.\n   */\n  block_reason: string;\n  data: AmlBlockCallbackData;\n}\n\n/**\n * Type guard for the AML block webhook. Narrows an already signature-verified,\n * parsed payload to {@link AmlBlockCallbackEvent}.\n */\nexport function isAmlBlockCallbackEvent(value: unknown): value is AmlBlockCallbackEvent {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    (value as { event?: unknown }).event === 'aml' &&\n    (value as { block?: unknown }).block === true\n  );\n}\n"]}

package/dist/webhooks/index.mjs

@@ -288,6 +288,11 @@ function buildHandler(options) {
   return handler;
 }
 
-export { InMemoryDedupStore, WebhookHandler, createNextWebhookHandler, createWebhookMiddleware, verifyWebhookSignature };
+// src/webhooks/types.ts
+function isAmlBlockCallbackEvent(value) {
+  return typeof value === "object" && value !== null && value.event === "aml" && value.block === true;
+}
+
+export { InMemoryDedupStore, WebhookHandler, createNextWebhookHandler, createWebhookMiddleware, isAmlBlockCallbackEvent, verifyWebhookSignature };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map