// Node.js 22.12+. Server-side only. No dependencies.
const API = 'https://api.sendwich.kr';

export class SendwichError extends Error {
  constructor(status, code, requestId) {
    super(`sendwich: ${code} (${status})`);
    this.status = status;
    this.code = code;
    this.requestId = requestId;
  }
}

async function request(path, method = 'GET', body, idempotencyKey) {
  const key = process.env.SENDWICH_API_KEY;
  if (!key) throw new Error('Set the server-only SENDWICH_API_KEY variable.');
  const response = await fetch(API + path, {
    method,
    signal: AbortSignal.timeout(10000),
    headers: {
      Authorization: `Bearer ${key}`,
      ...(body ? { 'Content-Type': 'application/json' } : {}),
      ...(idempotencyKey ? { 'Idempotency-Key': idempotencyKey } : {})
    },
    ...(body ? { body: JSON.stringify(body) } : {})
  });
  const data = await response.json().catch(() => ({}));
  if (!response.ok) throw new SendwichError(
    response.status, data.error?.code || 'request_failed',
    data.error?.request_id || response.headers.get('X-Request-ID')
  );
  return data;
}

function sessionPath(id) {
  if (!/^vrf_[A-Za-z0-9_-]+$/.test(id)) throw new Error('Invalid verification ID.');
  return `/v1/verifications/${encodeURIComponent(id)}`;
}

export function createVerification(body, idempotencyKey) {
  if (!/^[A-Za-z0-9_.:-]{8,128}$/.test(idempotencyKey || '')) {
    throw new Error('Provide a stable Idempotency-Key for this attempt.');
  }
  // Retry uncertain creates using the same body and key; do not auto-generate here.
  return request('/v1/verifications', 'POST', body, idempotencyKey);
}
export const getVerification = id => request(sessionPath(id));
export const cancelVerification = id => request(sessionPath(id) + '/cancel', 'POST');