@didit-protocol/sdk-node 2.11.0 → 2.12.0

package/dist/index.cjs

@@ -150,7 +150,7 @@ function errorDetail(body) {
   return null;
 }
 function spellings(secret) {
-  const out = /* @__PURE__ */ new Set([secret]);
+  const out = /* @__PURE__ */ new Set([secret, JSON.stringify(secret).slice(1, -1)]);
   try {
     out.add(encodeURIComponent(secret));
     out.add(new URLSearchParams({ s: secret }).toString().slice(2));
@@ -282,7 +282,7 @@ function decodeDates(value, plan, named, depth = 0) {
 }
 
 // src/core/version.ts
-var VERSION = "2.11.0";
+var VERSION = "2.12.0";
 
 // src/core/runtime.ts
 function processLike() {
@@ -7950,7 +7950,11 @@ var Sessions = class extends APIResource {
    *
    * Every call that changes the status fires the `status.updated` [webhook](/integration/webhooks) once the change commits and appends an activity entry (with actor attribution and your `comment`) to the session's `reviews`, visible in [Get Decision](#get-/v3/session/-sessionId-/decision/) and in the console activity timeline. The user-profile aggregates linked to the session's `vendor_data` update as well. Declining disables ongoing AML monitoring for the session; re-approving re-enables it (from `Resubmitted`, `Declined`, or `Kyc Expired`) when the workflow has monitoring turned on. Approving or declining a child KYC that belongs to a KYB key-people check recomputes the parent business session's status. Set `send_email: true` (with `email_address`) to notify the user: a status notice for `Approved`/`Declined`, or a resubmission email containing the verification link and per-step reasons for `Resubmitted`. To check the email first, preview it with [Preview Decision Email](/sessions-api/preview-decision-email) (`Approved`, `Declined`) or [Preview Resubmission Email](/sessions-api/preview-resubmission) (`Resubmitted`) and pass its `preview_token` as `email_preview_token`: the update then sends exactly the previewed email, or returns `409` before changing anything when the email or the session changed since the preview or the receipt is older than 15 minutes.
    *
-   * Repeating `Approved` or `Declined` on a session that already has that status changes nothing and returns `200`: no webhook, no activity entry and no email. Repeating `Resubmitted` returns `400` (`The new status is the same as the current status.`). Missing or invalid credentials and missing permissions return `403`; an expired scoped API key returns `401`.
+   * Repeating `Approved` or `Declined` on a session that already has that status returns `200` without a status webhook, status activity entry or email. An `Approved` request can still create a same-person link as described below. Repeating `Resubmitted` returns `400` (`The new status is the same as the current status.`). Missing or invalid credentials and missing permissions return `403`; an expired scoped API key returns `401`.
+   *
+   * To record a reviewer decision that two verifications belong to the same person, send `new_status: "Approved"`, `link_to_session_id` and `link_reason`. Both sessions must be distinct, live KYC verifications in the same application. The target need not be approved or have a person profile. `link_reason` is separate from `comment`, must be nonblank after trimming and accepts at most 2000 characters. A reason without a target, linking with another status, an invalid or unavailable target, a self-link, or a KYB participant returns `400`. Approval and linking succeed together or neither changes. If either session already belongs to a group, their groups are joined. An already-approved source can be linked for the first time without another status event or email. A retry within the same group creates no additional link audit. Concurrent group edits return `409`; retry the request.
+   *
+   * Grouping does not merge person profiles, profile fields or biometric data. Each verification keeps its original profile association and deletion ownership. Deleting a verification removes it from the group. Link actions have a separate audit recording the actor, time and `link_reason`; they are not status-review entries. Group navigation and unlinking are console-only, with no public read or unlink endpoint.
    *
    * `PATCH /v3/session/{sessionId}/update-status/`
    *
@@ -11281,16 +11285,11 @@ function textList(value, name) {
   }
   return [...value];
 }
-function assertionSecrets(assertion) {
-  const response = isRecord4(assertion.response) ? assertion.response : {};
-  return [
-    assertion.id,
-    assertion.rawId,
-    response.clientDataJSON,
-    response.authenticatorData,
-    response.signature,
-    response.userHandle
-  ].filter((value) => typeof value === "string" && value.length > 0);
+function assertionSecrets(value) {
+  if (typeof value === "string") return value.length > 0 ? [value] : [];
+  if (Array.isArray(value)) return value.flatMap(assertionSecrets);
+  if (isRecord4(value)) return Object.values(value).flatMap(assertionSecrets);
+  return [];
 }
 function optionalText(value, name) {
   if (value === void 0 || value === null) return void 0;