@didit-protocol/sdk-node 2.1.0 → 2.3.0

package/README.md

@@ -346,7 +346,13 @@ Choices this SDK makes where the shared design leaves them to each language:
 
 ## Versioning
 
-This package follows [semantic versioning](https://semver.org). A breaking change to the public SDK surface is a major version (a minor version while the version is 0.x).
+This package follows [semantic versioning](https://semver.org), with one rule for API changes shared by every Didit server SDK ([docs/DESIGN.md](docs/DESIGN.md) section 13):
+
+- A change that mirrors the Didit API is a minor version, even when it can break typed code: a type change, a field that can now be null, or a removed field, operation or enum value. The API already behaves that way for every caller, so an older version of this package is not safer. The release notes list such changes under "API changes that can break typed code".
+- A major version is only for a change to the SDK's own design: renaming or removing a method or resource the API still has, changing client configuration, errors, retries, pagination or webhook verification, or dropping a supported runtime version.
+- An API update that only changes documentation releases nothing on its own.
+
+The version number is this package's own: it moved to 2.x on 2026-11-05 under the earlier rule and continues from there.
 Releases and `CHANGELOG.md` are produced by release-please from conventional commits.
 When the API removes or renames an endpoint, the SDK keeps the old method as deprecated for one more minor version.
 

package/dist/index.cjs

@@ -282,7 +282,7 @@ function decodeDates(value, plan, named, depth = 0) {
 }
 
 // src/core/version.ts
-var VERSION = "2.1.0";
+var VERSION = "2.3.0";
 
 // src/core/runtime.ts
 function processLike() {
@@ -2264,8 +2264,6 @@ var Bank = class extends APIResource {
   /**
    * Check a bank account
    *
-   * **Not available in production yet.** Bank Verification is switched off in production, so until it is switched on this endpoint answers `404` with `bank_verification_not_available`. Do not build on it yet. The rest of this description is what the endpoint does once it is available.
-   *
    * Check that a bank account belongs to the person or company you name, before you send money to it. No session and no sign-in: send the name and the account, read the result. It is the [account check](/core-technology/bank-verification/account-check) of the Bank Verification step, run from your backend.
    *
    * **What you send.** The account's `country` (ISO 3166-1 alpha-3), the `account` the way that country writes it, and the `holder` name: `full_name` for a person or `business_name` for a company. A business name checks a business account.
@@ -2276,7 +2274,7 @@ var Bank = class extends APIResource {
    *
    * **Every request is a new check.** There is no idempotency key and no endpoint to read a check back, so a retried request runs, and is billed, again. Store the response.
    *
-   * **Sandbox.** Where Bank Verification is available, a sandbox key calls no bank and is charged nothing. The last 4 characters of the IBAN, else of the account number, choose the answer: `0001` a `close_match` with a `holder_name`, `0002` a `close_match` without one, `0003` and `0006` a `no_match`, `0004` `cannot_verify`, `0005` a `503` and `0009` a `400`. Any other ending is a `match`.
+   * **Sandbox.** Use a sandbox API key with the sample account details. A sandbox key calls no bank and is charged nothing. The last 4 characters of the IBAN, else of the account number, choose the answer: `0001` a `close_match` with a `holder_name`, `0002` a `close_match` without one, `0003` and `0006` a `no_match`, `0004` `cannot_verify`, `0005` a `503` and `0009` a `400`. Any other ending is a `match`.
    *
    * **API keys.** A scoped API key needs write access to sessions.
    *
@@ -4194,7 +4192,7 @@ var Email = class extends APIResource {
    *
    * **How send and check pair up.** Verification state is keyed by your application plus the `email` address - the check call does not take `request_id`. Each new send creates a pending verification that lives for **5 minutes**: call the check with the same address and the code the user received before the window closes. Calling send again for the same address while a verification is pending generates a fresh code for that same verification (`status: "Retry"`, same `request_id`); the previous code stops working. At most one retry is attached this way (two sends total); a further send starts a fresh verification with a new `request_id`. The 5-minute window is measured from the first send and is not extended by retries.
    *
-   * **Deliverability pre-check.** Before anything is sent, the address goes through syntax and DNS/MX validation. Addresses that cannot receive mail return `200` with `status: "Undeliverable"` and `reason: "email_can_not_be_delivered"` - no email is sent, nothing is billed, and the verification is immediately finalized as `Declined` (a follow-up check returns `Expired or Not Found`). A downstream send failure reports the same way.
+   * **Deliverability pre-check.** Before anything is sent, the address goes through syntax and DNS/MX validation. Addresses that cannot receive mail return `200` with `status: "Undeliverable"` and `reason: "email_can_not_be_delivered"` - no email is sent, nothing is billed, and the verification is immediately finalized as `Declined` (a follow-up check returns `Expired or Not Found`). A send that fails for a reason that is not the address (the email could not be handed over for delivery) returns `503` instead: no code is sent, nothing is billed, the verification stays open and the same request can be repeated.
    *
    * **Code format and branding.** Codes are 4–8 characters (`options.code_size`, default 6), numeric by default; set `options.alphanumeric_code: true` for uppercase letters and digits (the check comparison is case-insensitive). The email template is localized via `options.locale` (54 supported languages) and can use your application's white-label branding via `options.use_white_label_customization`.
    *
@@ -6115,7 +6113,7 @@ var Pricing = class extends APIResource {
   /**
    * Get bank verification prices (public, unauthenticated)
    *
-   * Returns the list price of each Bank Verification method in every country: bank sign-in with its balance and transactions add-ons, and the account check. Bank Verification is not enabled in production yet, so a bank step is refused on production workflows until it is; treat these prices as a list price, not as an offer you can buy today. Use it to quote a bank step before you build a workflow, or to show bank prices in your own product.
+   * Returns the list price of each Bank Verification method in every country: bank sign-in with its balance and transactions add-ons, and the account check. A method a country does not offer today shows as not available, with no price. Use it to quote a bank step before you build a workflow, or to show bank prices in your own product.
    *
    * Public: send no auth header. The response contains no organization data and is the same for every caller. It is cached publicly for one hour and carries an `ETag`, so send `If-None-Match` to get a `304 Not Modified` when nothing changed.
    *
@@ -6146,7 +6144,7 @@ var ProofOfAddress = class extends APIResource {
    *
    * **Latency.** Extraction is LLM-based: typical calls take **5–15 seconds**, multi-page PDFs up to **~30 seconds**. Configure a client timeout of **at least 45 seconds** and do not retry before the call completes.
    *
-   * **How it works.** The document (image or PDF, up to 15 MB; encrypted PDFs require `document_password`) is classified into a document type and subtype (e.g. `UTILITY_BILL` / `WATER_BILL`), and the issuer, dates, holder name, and address are extracted with LLM-based extraction. The address is parsed and geocoded into `poa_parsed_address`. PDF/EXIF forensics screen for tampering - modification after digital signing, known PDF editors, overlay-text manipulation, suspicious re-exports - surfacing `SUSPECTED_DOCUMENT_MANIPULATION` or `DOCUMENT_METADATA_MISMATCH`. Document age is validated against `poa_document_age_months`, and the language against `poa_languages_allowed`. If you pass `expected_address`, `expected_country`, or `expected_first_name`/`expected_last_name`, the extracted values are cross-checked and mismatches are flagged.
+   * **How it works.** The document (image or PDF, up to 15 MB; encrypted PDFs require `document_password`) is classified into a document type and subtype (e.g. `UTILITY_BILL` / `WATER_BILL`), and the issuer, dates, holder name, and address are extracted with LLM-based extraction. The address is parsed and geocoded into `poa_parsed_address`. PDF/EXIF forensics screen for tampering - modification after digital signing, known PDF editors, overlay-text manipulation, suspicious re-exports - surfacing `SUSPECTED_DOCUMENT_MANIPULATION` or `DOCUMENT_METADATA_MISMATCH`. A text field that was blanked and re-typed in another font, where the file itself holds no proof of whether its content changed, surfaces `POA_DOCUMENT_UNPROVEN_TEXT_REPLACEMENT`. Document age is validated against `poa_document_age_months`, and the language against `poa_languages_allowed`. If you pass `expected_address`, `expected_country`, or `expected_first_name`/`expected_last_name`, the extracted values are cross-checked and mismatches are flagged.
    *
    * **Decision logic.** `status` is `Approved` unless at least one warning resolves to a decline. Hard failures always decline: `MISSING_ADDRESS_INFORMATION`, `POA_DOCUMENT_EXPIRED`, `INVALID_DOCUMENT_TYPE`, `UNABLE_TO_VALIDATE_DOCUMENT_AGE`, plus `UNABLE_TO_EXTRACT_ISSUE_DATE` and `POA_NAME_NOT_DETECTED` (not configurable on this endpoint). Five risk groups are configurable per request via the `poa_*_action` options (`DECLINE` or `NO_ACTION`, all defaulting to `DECLINE`). `POA_DOCUMENT_NOT_SUPPORTED_FOR_APPLICATION` and `UNPARSABLE_OR_INVALID_ADDRESS` are informational on this endpoint and never decline. A document that cannot be processed at all returns `400`; a readable but problematic document returns `200` with `status: "Declined"` - always inspect `poa.status` and `poa.warnings`, not just the HTTP code.
    *