@didit-protocol/sdk-node 2.12.0 → 2.13.1

package/dist/index.cjs

@@ -192,6 +192,52 @@ function makeStatusError(status, body, headers, secrets = []) {
   const ErrorClass = STATUS_ERRORS[status] ?? (status >= 500 ? InternalServerError : APIStatusError);
   return new ErrorClass(message, status, cleanBody, redactHeaders(headers, secrets));
 }
+var REDACTED = "[redacted]";
+function redactStructured(value, secrets) {
+  const active = secrets.filter((s) => s.length > 0);
+  const text = (input) => active.some((secret) => input.includes(secret)) ? REDACTED : input;
+  const scrub = (input) => {
+    if (typeof input === "string") return text(input);
+    if (Array.isArray(input)) return input.map(scrub);
+    if (isRecord(input)) {
+      const out = /* @__PURE__ */ new Map();
+      const taken = new Set(Object.keys(input).filter((key) => text(key) === key));
+      let next = 1;
+      for (const [key, item] of Object.entries(input)) {
+        let name = key;
+        if (text(key) !== key) {
+          do {
+            name = next === 1 ? REDACTED : `${REDACTED}${next}`;
+            next++;
+          } while (taken.has(name));
+          taken.add(name);
+        }
+        out.set(name, scrub(item));
+      }
+      return Object.fromEntries(out);
+    }
+    return input;
+  };
+  return scrub(value);
+}
+function sanitizeResponse(headers, text, secrets) {
+  const clean = new Headers();
+  headers.forEach((value, name) => {
+    const folded = name.toLowerCase();
+    if (!secrets.some((secret) => secret && folded.includes(secret.toLowerCase()))) {
+      clean.append(name, redactStructured(value, secrets));
+    }
+  });
+  let body = REDACTED;
+  if (text) {
+    try {
+      body = JSON.stringify(redactStructured(JSON.parse(text), secrets));
+    } catch {
+      body = REDACTED;
+    }
+  }
+  return { headers: clean, text: body };
+}
 
 // src/core/api-promise.ts
 var APIPromise = class extends Promise {
@@ -282,7 +328,7 @@ function decodeDates(value, plan, named, depth = 0) {
 }
 
 // src/core/version.ts
-var VERSION = "2.12.0";
+var VERSION = "2.13.1";
 
 // src/core/runtime.ts
 function processLike() {
@@ -1669,6 +1715,14 @@ var DATE_PLANS = {
       action_required: "TransactionWalletOwnershipAction"
     }
   },
+  TransactionListTravelRule: {
+    p: {
+      data_unmasked: "TravelRuleDataUnmasked",
+      counterparty_vasp: { p: { dd_assessed_at: 1 } },
+      delivery: "TravelRuleDelivery",
+      discovery: { i: "TravelRuleDiscoveryStep" }
+    }
+  },
   TransactionNote: { p: { created_at: 1 } },
   TransactionRuleDetail: { p: { latest_triggered_at: 1, created_at: 1, updated_at: 1 } },
   TransactionSummary: { p: { txn_date: 1, created_at: 1 } },
@@ -1677,7 +1731,8 @@ var DATE_PLANS = {
       data_unmasked: "TravelRuleDataUnmasked",
       counterparty_vasp: { p: { dd_assessed_at: 1 } },
       delivery: "TravelRuleDelivery",
-      discovery: { i: "TravelRuleDiscoveryStep" }
+      discovery: { i: "TravelRuleDiscoveryStep" },
+      deliveries: { i: "TravelRuleDeliveryLogEntry" }
     }
   },
   TransactionWalletOwnershipAction: { p: { expires_at: 1 } },
@@ -1685,7 +1740,9 @@ var DATE_PLANS = {
   TransactionsListRelatedResponse: { p: { results: { i: "TransactionSummary" } } },
   TransactionsListResponse: {
     p: {
-      results: { i: { p: { txn_date: 1, created_at: 1, travel_rule: "TransactionTravelRule" } } }
+      results: {
+        i: { p: { txn_date: 1, created_at: 1, travel_rule: "TransactionListTravelRule" } }
+      }
     }
   },
   TransactionsNotesListResponse: { p: { results: { i: "TransactionNote" } } },
@@ -1707,6 +1764,8 @@ var DATE_PLANS = {
   TravelRuleCounterpartyScreeningStatus: { p: { screening: "TravelRuleCounterpartyScreening" } },
   TravelRuleDataUnmasked: { p: { at: 1 } },
   TravelRuleDelivery: { p: { next_attempt_at: 1, delivered_at: 1 } },
+  TravelRuleDeliveryLogEntry: { p: { created_at: 1, delivered_at: 1 } },
+  TravelRuleDeliveryLogPage: { p: { results: { i: "TravelRuleDeliveryLogEntry" } } },
   TravelRuleDiscoveryStep: { p: { at: 1 } },
   TravelRuleInboundResponse: { p: { travel_rule: "TravelRuleTransferDetail" } },
   TravelRuleListVaspsResponse: { p: { results: { i: "VaspDirectoryEntry" } } },
@@ -1766,7 +1825,8 @@ var DATE_PLANS = {
       data_unmasked: "TravelRuleDataUnmasked",
       created_at: 1,
       delivery: "TravelRuleDelivery",
-      discovery: { i: "TravelRuleDiscoveryStep" }
+      discovery: { i: "TravelRuleDiscoveryStep" },
+      deliveries: { i: "TravelRuleDeliveryLogEntry" }
     }
   },
   TravelRuleTransferRow: { p: { txn_date: 1, deadline_at: 1, created_at: 1 } },
@@ -1952,7 +2012,7 @@ var AccountApplications = class extends APIResource {
    *
    * Create an application inside an organization, in the data location you choose (`data_location`, the European Union by default; it can't be changed afterwards). The response includes `api_key`; persist it now (recoverable via GET). Requires owner/admin JWT.
    *
-   * Set initiate_login_uri to your HTTPS sign-in page on the exact website_url hostname, or an empty string to disable admin-sent sign-in links. Changing website_url also revalidates the saved sign-in URI. Invalid values return 400 with an initiate_login_uri field error; hostname and URI policy failures use https_url_on_registered_website_required.
+   * Set initiate_login_uri to your HTTPS sign-in page on the exact website_url hostname, or an empty string to disable admin-sent sign-in links. Changing website_url also revalidates the saved sign-in URI. Invalid values return 400 with an initiate_login_uri field error; hostname and URI policy failures use https_url_on_registered_website_required. An MCP token (a "Log in with Didit" grant, `token_use` `mcp`) also needs the `didit:management` scope, which carries the `applications` resource; a grant limited to `didit:verification` is refused with 403 before anything is created.
    *
    * `POST /organizations/me/{org_id}/applications/`
    *
@@ -1964,7 +2024,7 @@ var AccountApplications = class extends APIResource {
   /**
    * List the organization's applications
    *
-   * List the organization's applications, 50 per page by default. Use this to discover `app_id` values when recovering credentials from a new machine, then call `GET /organizations/me/{org_id}/applications/{app_id}/` for the API key. Requires an owner or admin Bearer token.
+   * List the organization's applications, 50 per page by default. Use this to discover `app_id` values when recovering credentials from a new machine, then call `GET /organizations/me/{org_id}/applications/{app_id}/` for the API key. Requires an owner or admin Bearer token. An MCP token (a "Log in with Didit" grant, `token_use` `mcp`) also needs the `didit:management` scope, which carries the `applications` resource; a grant limited to `didit:verification` is refused with 403 before any application is listed.
    *
    * `GET /organizations/me/{org_id}/applications/`
    *
@@ -1976,7 +2036,7 @@ var AccountApplications = class extends APIResource {
   /**
    * Get Application Credentials
    *
-   * Read one application's full record including `client_id` and `api_key`. Use this to recover a lost `api_key`.
+   * Read one application's full record including `client_id` and `api_key`. Use this to recover a lost `api_key`. An MCP token (a "Log in with Didit" grant, `token_use` `mcp`) also needs the `didit:management` scope, which carries the `applications` resource; a grant limited to `didit:verification` is refused with 403 before the application is read.
    *
    * `GET /organizations/me/{org_id}/applications/{app_id}/`
    *
@@ -1991,7 +2051,7 @@ var AccountApplications = class extends APIResource {
    *
    * Update application metadata (name, URLs, redirect URIs). `api_key` and `client_id` are never rotated. `products` is read-only: a `products` key in the body is ignored. `data_location` can't be changed after the application is created, except once on the live application created with your organization, while it is unused (see the request body). Requires owner/admin JWT.
    *
-   * Set initiate_login_uri to your HTTPS sign-in page on the exact website_url hostname, or an empty string to disable admin-sent sign-in links. Changing website_url also revalidates the saved sign-in URI. Invalid values return 400 with an initiate_login_uri field error; hostname and URI policy failures use https_url_on_registered_website_required.
+   * Set initiate_login_uri to your HTTPS sign-in page on the exact website_url hostname, or an empty string to disable admin-sent sign-in links. Changing website_url also revalidates the saved sign-in URI. Invalid values return 400 with an initiate_login_uri field error; hostname and URI policy failures use https_url_on_registered_website_required. An MCP token (a "Log in with Didit" grant, `token_use` `mcp`) also needs the `didit:management` scope, which carries the `applications` resource; a grant limited to `didit:verification` is refused with 403 before anything is changed.
    *
    * `PATCH /organizations/me/{org_id}/applications/{app_id}/`
    *
@@ -5113,7 +5173,7 @@ var Investigator = class extends APIResource {
   /**
    * Override a recommendation
    *
-   * Takes another action with a category and a reason. Also overrides a decision the Investigator took on its own while it still stands. Restricted keys need the `decisions` scope (write); transaction alerts also need `transactions` (write). Escalating a verification or transaction opens a case.
+   * Takes another action with a category and a reason. Also overrides a decision the Investigator took on its own while it still stands. Restricted keys need the `decisions` scope (write); transaction alerts also need `transactions` (write). Escalating a verification or transaction opens a case. Automated transaction decisions can be overridden only while the original decision still stands. The original decision remains unchanged, the override is recorded separately, and an immediate policy question is raised for its recorded situations with the original policy action. The override does not charge for another automated decision.
    *
    * `POST /v3/investigator/runs/{run_id}/override/`
    *
@@ -8050,6 +8110,12 @@ var TRANSACTIONS_TRAVEL_RULE_CREATE_MESSAGE = {
   body: "json",
   dates: "TravelRuleMessage"
 };
+var TRANSACTIONS_TRAVEL_RULE_LIST_DELIVERIES = {
+  method: "GET",
+  path: "/v3/transactions/{transaction_id}/travel-rule/deliveries/",
+  query: ["limit", "offset"],
+  dates: "TravelRuleDeliveryLogPage"
+};
 var TRANSACTIONS_TRAVEL_RULE_LIST_MESSAGES = {
   method: "GET",
   path: "/v3/transactions/{transaction_id}/travel-rule/messages/",
@@ -8099,7 +8165,9 @@ var TRANSACTIONS_LIST = {
   query: ["limit", "offset", "travel_rule_status", "assignee"],
   dates: {
     p: {
-      results: { i: { p: { txn_date: 1, created_at: 1, travel_rule: "TransactionTravelRule" } } }
+      results: {
+        i: { p: { txn_date: 1, created_at: 1, travel_rule: "TransactionListTravelRule" } }
+      }
     }
   }
 };
@@ -8293,6 +8361,23 @@ var TransactionsTravelRule = class extends APIResource {
       options
     );
   }
+  /**
+   * List Travel Rule delivery history
+   *
+   * Read the complete delivery history for a transaction, oldest first. Requires transaction read permission. Unlike the newest 100 entries embedded in detail, this endpoint paginates the full history. See [delivery history](/management-api/travel-rule/list-deliveries).
+   *
+   * `GET /v3/transactions/{transaction_id}/travel-rule/deliveries/`
+   *
+   * @param transactionId Didit-stable transaction UUID that owns the transfer.
+   */
+  listDeliveries(transactionId, params = {}, options) {
+    return this._client.requestPage(
+      TRANSACTIONS_TRAVEL_RULE_LIST_DELIVERIES,
+      [transactionId],
+      params,
+      options
+    );
+  }
   /**
    * List Travel Rule messages
    *
@@ -11136,11 +11221,15 @@ async function send(transport, request) {
       log(null, null, "timeout");
       return new APITimeoutError(
         `The issuer did not answer ${method} ${path} within ${transport.timeout} ms.`,
-        { cause }
+        // A request that carries secrets keeps no cause: a transport may quote the serialized body in it.
+        request.structuredRedaction ? void 0 : { cause }
       );
     }
     log(null, null, "connection_error");
-    return new APIConnectionError(`Could not reach the issuer for ${method} ${path}.`, { cause });
+    return new APIConnectionError(
+      `Could not reach the issuer for ${method} ${path}.`,
+      request.structuredRedaction ? void 0 : { cause }
+    );
   };
   let status;
   let responseHeaders;
@@ -11168,19 +11257,28 @@ async function send(transport, request) {
   } finally {
     clearTimeout(timer);
   }
-  log(status, responseHeaders);
+  const secrets = request.secrets ?? [];
+  const sanitized = request.structuredRedaction ? sanitizeResponse(responseHeaders, text, secrets) : null;
+  const errorHeaders = sanitized?.headers ?? responseHeaders;
+  log(status, errorHeaders);
   if (status < 200 || status > 299) {
-    throw makeStatusError(status, bodyOf(text), responseHeaders, request.secrets ?? []);
+    throw makeStatusError(
+      status,
+      bodyOf(sanitized?.text ?? text),
+      errorHeaders,
+      sanitized ? [] : secrets
+    );
   }
-  if (status === 204 || !text) return { status, headers: responseHeaders, data: null };
+  if (status === 204 || !text)
+    return { status, headers: responseHeaders, errorHeaders, data: null };
   try {
-    return { status, headers: responseHeaders, data: JSON.parse(text) };
+    return { status, headers: responseHeaders, errorHeaders, data: JSON.parse(text) };
   } catch {
-    const type = responseHeaders.get("content-type") ?? "no content type";
+    const type = errorHeaders.get("content-type") ?? "no content type";
     throw new APIResponseValidationError(
       `Expected a JSON response from ${method} ${path}, got ${type}.`,
       status,
-      responseHeaders
+      errorHeaders
     );
   }
 }
@@ -11285,10 +11383,16 @@ function textList(value, name) {
   }
   return [...value];
 }
+var MIN_SECRET_LENGTH = 16;
 function assertionSecrets(value) {
-  if (typeof value === "string") return value.length > 0 ? [value] : [];
+  if (typeof value === "string") return value.length >= MIN_SECRET_LENGTH ? [value] : [];
   if (Array.isArray(value)) return value.flatMap(assertionSecrets);
-  if (isRecord4(value)) return Object.values(value).flatMap(assertionSecrets);
+  if (isRecord4(value)) {
+    return Object.entries(value).flatMap(([key, item]) => [
+      ...assertionSecrets(key),
+      ...assertionSecrets(item)
+    ]);
+  }
   return [];
 }
 function optionalText(value, name) {
@@ -11568,7 +11672,6 @@ var Authentication = class _Authentication {
     if (assertion !== void 0 && assertion !== null) {
       if (!isRecord4(assertion)) throw new TypeError("assertion must be an object.");
       body.assertion = assertion;
-      secrets.push(...assertionSecrets(assertion));
     }
     const scopes = given.scopes;
     if (scopes !== void 0 && scopes !== null) body.scopes = textList(scopes, "scopes");
@@ -11583,7 +11686,19 @@ var Authentication = class _Authentication {
       }
       body.lifetime = lifetime;
     }
-    const call = { ...this.#bearerCall("POST", AGENT_CONSENT_PATH, token), json: body, secrets };
+    let sent;
+    try {
+      sent = JSON.parse(JSON.stringify(body));
+    } catch {
+      throw new TypeError("Could not encode the agent consent request.");
+    }
+    secrets.push(...assertionSecrets(sent.assertion));
+    const call = {
+      ...this.#bearerCall("POST", AGENT_CONSENT_PATH, token),
+      json: sent,
+      secrets,
+      structuredRedaction: true
+    };
     return await this.#object(call);
   }
   /**
@@ -11599,7 +11714,8 @@ var Authentication = class _Authentication {
     const call = {
       ...this.#bearerCall("POST", AGENT_CONSENT_PASSKEY_PATH, token),
       json: { challenge },
-      secrets: [token, challenge]
+      secrets: [token, challenge],
+      structuredRedaction: true
     };
     return await this.#object(call);
   }
@@ -11619,7 +11735,7 @@ var Authentication = class _Authentication {
       throw new APIResponseValidationError(
         `Expected a JSON object from ${call.method} ${pathOf(call.url)}.`,
         response.status,
-        response.headers
+        response.errorHeaders
       );
     }
     return response.data;