Statements in.
Ledger rows out.

# 1. Register the upload (declare what you are sending)
curl -X POST "$PARSER_URL/v1/uploads" \
  -H "Authorization: Bearer $PARSER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "document_kind": "bank_statement",
    "filename": "statement.pdf",
    "content_type": "application/pdf",
    "size": 482113,
    "sha256": "<hex sha-256 of the file>"
  }'
# 201 -> { "id": "<upload_id>", "upload_url": "<upload URL>", "expires_at": "..." }

# 2. Send the file to the returned upload URL
curl -X PUT "<upload_url>" -H "Content-Type: application/pdf" \
  --data-binary @statement.pdf

# 3. Mark it complete (suffix and MIME are checked again here)
curl -X POST "$PARSER_URL/v1/uploads/<upload_id>/complete" \
  -H "Authorization: Bearer $PARSER_API_KEY"
# 200 -> { "id": "<upload_id>", "status": "ready" }

# 4. Create the job (Idempotency-Key is required)
curl -X POST "$PARSER_URL/v1/jobs" \
  -H "Authorization: Bearer $PARSER_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{ "upload_id": "<upload_id>" }'
# add "password": "..." for protected statements
# -> { "id": "<job_id>", "status": "queued", "document_kind": "bank_statement", ... }

# 5a. Poll if you would rather not take a webhook
curl "$PARSER_URL/v1/jobs/<job_id>" -H "Authorization: Bearer $PARSER_API_KEY"

# 5b. When the status is "succeeded", fetch the result
curl "$PARSER_URL/v1/jobs/<job_id>/result" -H "Authorization: Bearer $PARSER_API_KEY"
# -> { "download_url": "<short-lived>", "expires_in": ..., "schema_version": "2.0", ... }

{
  "schema_version": "2.0",
  "meta": {
    "bank_name": "...", "ifsc_code": "...", "account_number": "XXXX1234",
    "detected_currency": "INR",
    "period": { "start": "2025-01-01", "end": "2025-01-31" },
    "opening_balance": "1000.00", "closing_balance": "1250.00"
  },
  "transactions": [{
    "date": "2025-01-15",
    "amount": "250.00",
    "description": "NEFT synthetic credit",
    "metadata": { "balance_after": "1250.00", "transaction_id": "synthetic-txn-1" }
  }]
}

import { createHmac, timingSafeEqual } from "node:crypto";

// Signature = "sha256=" + HMAC-SHA256(secret, `${timestamp}.${eventId}.${rawBody}`)
export function verify(req, rawBody, secret) {
  const ts = req.headers["x-webhook-timestamp"];
  const id = req.headers["x-webhook-event-id"];
  const got = Buffer.from(req.headers["x-webhook-signature"] ?? "");
  const want = Buffer.from(
    "sha256=" + createHmac("sha256", secret).update(`${ts}.${id}.${rawBody}`).digest("hex"),
  );
  return got.length === want.length && timingSafeEqual(got, want);
}

// event_type: "job.completed"
// body.data: { job_id, status: "succeeded" | "failed_document" | "failed_internal", error_code }