Rate limits

async function verifyWithRetry(payload: object, maxRetries = 3) {
  for (let attempt = 0; attempt <= maxRetries; attempt++) {
    const res = await fetch('https://api.trustverify.co.uk/api/v1/kyc/verify', {
      method:  'POST',
      headers: {
        'Authorization': `Bearer ${process.env.TV_API_KEY}`,
        'Content-Type':  'application/json',
      },
      body: JSON.stringify(payload),
    });
    if (res.status !== 429) return res;

    // A daily-cap or monthly-quota 429 will not clear within a retry window;
    // only the per-IP flood limiter is worth waiting out.
    const body = await res.clone().json().catch(() => ({} as any));
    if (body?.code === 'DAILY_CAP_EXCEEDED') {
      throw new Error(`Daily API call cap reached; resets at ${body.resetsAt}`);
    }

    // Retry-After (seconds) and RateLimit-Reset (delta-seconds) come from the
    // flood limiter. Neither is guaranteed, so back off exponentially if absent.
    const retryAfter = Number(res.headers.get('Retry-After'));
    const resetIn    = Number(res.headers.get('RateLimit-Reset'));
    const hintedMs   = Number.isFinite(retryAfter) && retryAfter > 0 ? retryAfter * 1000
                     : Number.isFinite(resetIn)    && resetIn    > 0 ? resetIn    * 1000
                     : 0;

    await new Promise(r => setTimeout(r, Math.max(hintedMs, 1000 * 2 ** attempt)));
  }
  throw new Error('Rate limit retries exhausted');
}