@didit-protocol/sdk-node 2.10.0 → 2.11.1

package/README.md

@@ -307,6 +307,7 @@ try {
 - `refresh(refreshToken)`: serialise refreshes for one session; reusing a consumed refresh token revokes the session.
 - `getSession(accessToken)` for an instant revocation check, `revokeSession(accessToken)`.
 - `createStepUp(accessToken, { action, amount?, currency?, returnTo? })` and `retrieveStepUp(accessToken, id)`: act only on status `approved`. The issuer currently requires `returnTo` and answers 400 without it.
+- `submitAgentConsent(accessToken, { challenge, decision, assertion?, scopes?, organizationIds?, lifetime? })` approves or denies an agent request (approval returns `{ code, redirect_uri, state }`, denial `{ status: "denied" }`; test `"code" in result`) and `createAgentApprovalOptions(accessToken, { challenge })` returns the WebAuthn `options` for the fresh passkey assertion a humans-only application requires (403 `passkey_required` without it). Neither is retried; the challenge and assertion are never logged.
 
 Authentication is in early access and reaches production with the 2026-11-01 Didit release.
 

package/dist/index.cjs

@@ -150,7 +150,7 @@ function errorDetail(body) {
   return null;
 }
 function spellings(secret) {
-  const out = /* @__PURE__ */ new Set([secret]);
+  const out = /* @__PURE__ */ new Set([secret, JSON.stringify(secret).slice(1, -1)]);
   try {
     out.add(encodeURIComponent(secret));
     out.add(new URLSearchParams({ s: secret }).toString().slice(2));
@@ -282,7 +282,7 @@ function decodeDates(value, plan, named, depth = 0) {
 }
 
 // src/core/version.ts
-var VERSION = "2.10.0";
+var VERSION = "2.11.1";
 
 // src/core/runtime.ts
 function processLike() {
@@ -1952,6 +1952,8 @@ var AccountApplications = class extends APIResource {
    *
    * Create an application inside an organization, in the data location you choose (`data_location`, the European Union by default; it can't be changed afterwards). The response includes `api_key`; persist it now (recoverable via GET). Requires owner/admin JWT.
    *
+   * Set initiate_login_uri to your HTTPS sign-in page on the exact website_url hostname, or an empty string to disable admin-sent sign-in links. Changing website_url also revalidates the saved sign-in URI. Invalid values return 400 with an initiate_login_uri field error; hostname and URI policy failures use https_url_on_registered_website_required.
+   *
    * `POST /organizations/me/{org_id}/applications/`
    *
    * @param orgId UUID of the organization. Look it up with `GET /organizations/me/`.
@@ -1989,6 +1991,8 @@ var AccountApplications = class extends APIResource {
    *
    * Update application metadata (name, URLs, redirect URIs). `api_key` and `client_id` are never rotated. `products` is read-only: a `products` key in the body is ignored. `data_location` can't be changed after the application is created, except once on the live application created with your organization, while it is unused (see the request body). Requires owner/admin JWT.
    *
+   * Set initiate_login_uri to your HTTPS sign-in page on the exact website_url hostname, or an empty string to disable admin-sent sign-in links. Changing website_url also revalidates the saved sign-in URI. Invalid values return 400 with an initiate_login_uri field error; hostname and URI policy failures use https_url_on_registered_website_required.
+   *
    * `PATCH /organizations/me/{org_id}/applications/{app_id}/`
    *
    * @param orgId UUID of the organization that owns the application.
@@ -6524,6 +6528,21 @@ var ReportTemplates = class extends APIResource {
   }
 };
 
+// src/resources/sandbox.ts
+var SANDBOX_LIST_SCENARIOS = { method: "GET", path: "/v1/sandbox/scenarios/" };
+var Sandbox = class extends APIResource {
+  /**
+   * List sandbox scenarios and Test VASP metadata
+   *
+   * Read the sandbox catalog Didit serves for testing. Authenticate with your application's API key or access token; a sandbox session's `Session-Token` also reads it, narrowed to the scenarios that session's workflow can produce. `scenarios`, `magic_values`, `risk_cases`, `sample_identity` and `delivery_conventions` describe the mocked session outcomes and the values that trigger them. `travel_rule` is the Didit Test VASP: its identity, the `routes` it answers over, and each scenario's own `route`. Every Test VASP exchange runs in process inside Didit, so `TEST_VASP` is not a live network or email transport and no real VASP is contacted. Pick a Travel Rule scenario by its beneficiary wallet address or by a beneficiary name of the form `Didit Test VASP <suffix>`. See [Travel Rule sandbox testing](/transaction-monitoring/travel-rule-sandbox).
+   *
+   * `GET /v1/sandbox/scenarios/`
+   */
+  listScenarios(options) {
+    return this._client.request(SANDBOX_LIST_SCENARIOS, [], void 0, options);
+  }
+};
+
 // src/resources/sessions.ts
 var SESSIONS_IMPORTS_CANCEL = {
   method: "POST",
@@ -10638,6 +10657,7 @@ var DiditResources = class extends APIClient {
   questionnaires = new Questionnaires(this);
   regulatoryReports = new RegulatoryReports(this);
   reportTemplates = new ReportTemplates(this);
+  sandbox = new Sandbox(this);
   sessions = new Sessions(this);
   transactions = new Transactions(this);
   travelRule = new TravelRule(this);
@@ -11235,6 +11255,8 @@ var JWKS_PATH = ".well-known/jwks.json";
 var TOKEN_PATH = "token/";
 var SESSION_PATH = "session/";
 var STEP_UP_PATH = "step-up/";
+var AGENT_CONSENT_PATH = "agents/consent/";
+var AGENT_CONSENT_PASSKEY_PATH = "agents/consent/passkey/";
 var DECIMAL_TEXT = /^-?[0-9]+(\.[0-9]+)?$/;
 function fieldsOf(value) {
   return value ?? {};
@@ -11253,6 +11275,18 @@ function bearerToken(value, name) {
   }
   return token;
 }
+function textList(value, name) {
+  if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) {
+    throw new TypeError(`${name} must be a list of strings.`);
+  }
+  return [...value];
+}
+function assertionSecrets(value) {
+  if (typeof value === "string") return value.length > 0 ? [value] : [];
+  if (Array.isArray(value)) return value.flatMap(assertionSecrets);
+  if (isRecord4(value)) return Object.values(value).flatMap(assertionSecrets);
+  return [];
+}
 function optionalText(value, name) {
   if (value === void 0 || value === null) return void 0;
   if (typeof value !== "string") throw new TypeError(`${name} must be a string.`);
@@ -11505,6 +11539,66 @@ var Authentication = class _Authentication {
     const path = `${STEP_UP_PATH}${pathSegment(id, "id")}/`;
     return await this.#object(this.#bearerCall("GET", path, token));
   }
+  /**
+   * Approve or deny an agent's access request (`POST agents/consent/`) with a
+   * token of the signed-in person. Approval returns `{ code, redirect_uri,
+   * state }` (the agent exchanges the single-use code, valid 60 seconds, itself;
+   * no token is returned here); denial returns `{ status: "denied" }`. Tell them
+   * apart with `"code" in result`. A POST: never retried. The `challenge` and
+   * the `assertion` are never logged and are removed from error messages.
+   * Typical failures: 400 `invalid_grant` (unknown or expired request) and 403
+   * `passkey_required` (humans-only application: call
+   * `createAgentApprovalOptions`, run the passkey ceremony, pass the assertion).
+   */
+  async submitAgentConsent(accessToken, params) {
+    const token = bearerToken(accessToken, "accessToken");
+    const given = fieldsOf(params);
+    const challenge = requiredText(given.challenge, "challenge");
+    const decision = requiredText(given.decision, "decision");
+    if (decision !== "approve" && decision !== "deny") {
+      throw new TypeError('decision must be "approve" or "deny".');
+    }
+    const body = { challenge, decision };
+    const secrets = [token, challenge];
+    const assertion = given.assertion;
+    if (assertion !== void 0 && assertion !== null) {
+      if (!isRecord4(assertion)) throw new TypeError("assertion must be an object.");
+      body.assertion = assertion;
+      secrets.push(...assertionSecrets(assertion));
+    }
+    const scopes = given.scopes;
+    if (scopes !== void 0 && scopes !== null) body.scopes = textList(scopes, "scopes");
+    const organizationIds = given.organizationIds;
+    if (organizationIds !== void 0 && organizationIds !== null) {
+      body.organization_ids = textList(organizationIds, "organizationIds");
+    }
+    const lifetime = given.lifetime;
+    if (lifetime !== void 0 && lifetime !== null) {
+      if (typeof lifetime !== "number" || !Number.isInteger(lifetime)) {
+        throw new TypeError("lifetime must be an integer number of seconds.");
+      }
+      body.lifetime = lifetime;
+    }
+    const call = { ...this.#bearerCall("POST", AGENT_CONSENT_PATH, token), json: body, secrets };
+    return await this.#object(call);
+  }
+  /**
+   * Get WebAuthn request options bound to a pending agent request
+   * (`POST agents/consent/passkey/`) with a token of the signed-in person. Pass
+   * `options` to `navigator.credentials.get()` (decode the base64url fields),
+   * then send the result as `assertion` to `submitAgentConsent`. A POST: never
+   * retried; the `challenge` is never logged.
+   */
+  async createAgentApprovalOptions(accessToken, params) {
+    const token = bearerToken(accessToken, "accessToken");
+    const challenge = requiredText(fieldsOf(params).challenge, "challenge");
+    const call = {
+      ...this.#bearerCall("POST", AGENT_CONSENT_PASSKEY_PATH, token),
+      json: { challenge },
+      secrets: [token, challenge]
+    };
+    return await this.#object(call);
+  }
   // Requests ------------------------------------------------------------------
   #url(path) {
     return `${this.issuer}/${path}`;
@@ -11760,6 +11854,7 @@ exports.Questionnaires = Questionnaires;
 exports.RateLimitError = RateLimitError;
 exports.RegulatoryReports = RegulatoryReports;
 exports.ReportTemplates = ReportTemplates;
+exports.Sandbox = Sandbox;
 exports.Sessions = Sessions;
 exports.SessionsImports = SessionsImports;
 exports.SessionsReviews = SessionsReviews;