@didit-protocol/sdk-node 2.13.0 → 2.14.0

package/dist/index.js

@@ -188,6 +188,52 @@ function makeStatusError(status, body, headers, secrets = []) {
   const ErrorClass = STATUS_ERRORS[status] ?? (status >= 500 ? InternalServerError : APIStatusError);
   return new ErrorClass(message, status, cleanBody, redactHeaders(headers, secrets));
 }
+var REDACTED = "[redacted]";
+function redactStructured(value, secrets) {
+  const active = secrets.filter((s) => s.length > 0);
+  const text = (input) => active.some((secret) => input.includes(secret)) ? REDACTED : input;
+  const scrub = (input) => {
+    if (typeof input === "string") return text(input);
+    if (Array.isArray(input)) return input.map(scrub);
+    if (isRecord(input)) {
+      const out = /* @__PURE__ */ new Map();
+      const taken = new Set(Object.keys(input).filter((key) => text(key) === key));
+      let next = 1;
+      for (const [key, item] of Object.entries(input)) {
+        let name = key;
+        if (text(key) !== key) {
+          do {
+            name = next === 1 ? REDACTED : `${REDACTED}${next}`;
+            next++;
+          } while (taken.has(name));
+          taken.add(name);
+        }
+        out.set(name, scrub(item));
+      }
+      return Object.fromEntries(out);
+    }
+    return input;
+  };
+  return scrub(value);
+}
+function sanitizeResponse(headers, text, secrets) {
+  const clean = new Headers();
+  headers.forEach((value, name) => {
+    const folded = name.toLowerCase();
+    if (!secrets.some((secret) => secret && folded.includes(secret.toLowerCase()))) {
+      clean.append(name, redactStructured(value, secrets));
+    }
+  });
+  let body = REDACTED;
+  if (text) {
+    try {
+      body = JSON.stringify(redactStructured(JSON.parse(text), secrets));
+    } catch {
+      body = REDACTED;
+    }
+  }
+  return { headers: clean, text: body };
+}
 
 // src/core/api-promise.ts
 var APIPromise = class extends Promise {
@@ -278,7 +324,7 @@ function decodeDates(value, plan, named, depth = 0) {
 }
 
 // src/core/version.ts
-var VERSION = "2.13.0";
+var VERSION = "2.14.0";
 
 // src/core/runtime.ts
 function processLike() {
@@ -1670,7 +1716,8 @@ var DATE_PLANS = {
       data_unmasked: "TravelRuleDataUnmasked",
       counterparty_vasp: { p: { dd_assessed_at: 1 } },
       delivery: "TravelRuleDelivery",
-      discovery: { i: "TravelRuleDiscoveryStep" }
+      discovery: { i: "TravelRuleDiscoveryStep" },
+      user_choice: "TravelRuleUserChoice"
     }
   },
   TransactionNote: { p: { created_at: 1 } },
@@ -1682,7 +1729,8 @@ var DATE_PLANS = {
       counterparty_vasp: { p: { dd_assessed_at: 1 } },
       delivery: "TravelRuleDelivery",
       discovery: { i: "TravelRuleDiscoveryStep" },
-      deliveries: { i: "TravelRuleDeliveryLogEntry" }
+      deliveries: { i: "TravelRuleDeliveryLogEntry" },
+      user_choice: "TravelRuleUserChoice"
     }
   },
   TransactionWalletOwnershipAction: { p: { expires_at: 1 } },
@@ -1776,12 +1824,15 @@ var DATE_PLANS = {
       created_at: 1,
       delivery: "TravelRuleDelivery",
       discovery: { i: "TravelRuleDiscoveryStep" },
-      deliveries: { i: "TravelRuleDeliveryLogEntry" }
+      deliveries: { i: "TravelRuleDeliveryLogEntry" },
+      user_choice: "TravelRuleUserChoice"
     }
   },
   TravelRuleTransferRow: { p: { txn_date: 1, deadline_at: 1, created_at: 1 } },
   TravelRuleTransfersListResponse: { p: { results: { i: "TravelRuleTransferRow" } } },
   TravelRuleUnmatchedDepositsListResponse: { p: { results: { i: "TravelRuleTransferRow" } } },
+  TravelRuleUserChoice: { p: { link_expires_at: 1 } },
+  TravelRuleUserLinkResponse: { p: { expires_at: 1 } },
   TravelRuleWalletAddressesListResponse: { p: { results: { i: "WalletAddressEntry" } } },
   TravelRuleWalletProofReview: { p: { method_chosen_at: 1, decided_at: 1, created_at: 1 } },
   TravelRuleWalletProofsListResponse: { p: { results: { i: "TravelRuleWalletProofReview" } } },
@@ -2783,6 +2834,12 @@ var Businesses = class extends APIResource {
 };
 
 // src/resources/cases.ts
+var CASES_BLUEPRINTS_AI_DRAFT = {
+  method: "POST",
+  path: "/v3/organization/{organization_id}/application/{application_id}/cases/blueprints/ai-draft/",
+  scope: "application",
+  body: "json"
+};
 var CASES_BLUEPRINTS_CREATE = {
   method: "POST",
   path: "/v3/organization/{organization_id}/application/{application_id}/cases/blueprints/",
@@ -3257,10 +3314,20 @@ var CASES_UPDATE = {
   dates: "CaseDetail"
 };
 var CasesBlueprints = class extends APIResource {
+  /**
+   * Draft case blueprint with AI
+   *
+   * Generate an unsaved blueprint proposal. Requires write:cases. Returns a draft object, not a blueprint UUID; no blueprint or saved policy draft is created. Review the proposal, choose assignees and any teams, approvals or routing, then create or update a blueprint separately. Invalid generated content or generation failure returns 503. See [blueprint AI drafts](/management-api/case-blueprints/ai-draft).
+   *
+   * `POST /v3/organization/{organization_id}/application/{application_id}/cases/blueprints/ai-draft/`
+   */
+  aiDraft(params, options) {
+    return this._client.request(CASES_BLUEPRINTS_AI_DRAFT, [], params, options);
+  }
   /**
    * Create blueprint
    *
-   * Create a case blueprint: general settings (assignment, escalation, transfer, 4-eyes pairing) plus content_config, the six sections that drive the case page. Set publish=false to create an unpublished draft; Publish creates its first live version. Discarding a never-published draft deletes it.
+   * Create a case blueprint: general settings (assignment, escalation, transfer, 4-eyes pairing) plus content_config, the six sections that drive the case page. Set publish=false to create an unpublished draft; Publish creates its first live version. Discarding a never-published draft deletes it. applies_to accepts the six case-type values. content_config.stages.items[].worked_by is an optional active review-team UUID from this application. These settings are preserved in case policy snapshots; later edits do not change existing snapshots.
    *
    * `POST /v3/organization/{organization_id}/application/{application_id}/cases/blueprints/`
    */
@@ -3374,7 +3441,7 @@ var CasesBlueprints = class extends APIResource {
   /**
    * Update blueprint
    *
-   * Partially update a blueprint's general settings or content_config.
+   * Partially update a blueprint's general settings or content_config. applies_to accepts the six case-type values. content_config.stages.items[].worked_by is an optional active review-team UUID from this application. These settings are preserved in case policy snapshots; later edits do not change existing snapshots.
    *
    * `PATCH /v3/organization/{organization_id}/application/{application_id}/cases/blueprints/{blueprint_uuid}/`
    *
@@ -3415,7 +3482,7 @@ var CasesLinks = class extends APIResource {
   /**
    * Add case link
    *
-   * Attach a session, business session, or transaction to the case. Rejected with 400 if the entity belongs to a different subject than the case.
+   * Attach a session, business session, transaction, or network to the case. Rejected with 400 if the entity belongs to a different subject than the case. Network links require write:cases plus read:networks, Networks access and investigation access for the network scope. The network must be visible and contain the case subject. Manually adding links to network-generated cases is not allowed.
    *
    * `POST /v3/organization/{organization_id}/application/{application_id}/cases/{case_uuid}/links/`
    *
@@ -3832,7 +3899,7 @@ var Cases = class extends APIResource {
   /**
    * Create case
    *
-   * Create a case anchored to exactly one subject (a user or a business), directly or by deriving the subject from an attached session/transaction link. Source is always `MANUAL` for API-created cases.
+   * Create a case anchored to exactly one subject (a user or a business), directly or by deriving the subject from an attached session/transaction link. Source is always `MANUAL` for API-created cases. Network links require write:cases plus read:networks, Networks access and investigation access for the network scope. The network must be visible and contain the case subject. Manually adding links to network-generated cases is not allowed. An explicit subject is required whenever links includes a network.
    *
    * `POST /v3/organization/{organization_id}/application/{application_id}/cases/`
    */
@@ -8060,6 +8127,12 @@ var TRANSACTIONS_TRAVEL_RULE_CREATE_MESSAGE = {
   body: "json",
   dates: "TravelRuleMessage"
 };
+var TRANSACTIONS_TRAVEL_RULE_CREATE_USER_LINK = {
+  method: "POST",
+  path: "/v3/transactions/{transaction_id}/travel-rule/user-link/",
+  body: "json",
+  dates: "TravelRuleUserLinkResponse"
+};
 var TRANSACTIONS_TRAVEL_RULE_LIST_DELIVERIES = {
   method: "GET",
   path: "/v3/transactions/{transaction_id}/travel-rule/deliveries/",
@@ -8311,6 +8384,23 @@ var TransactionsTravelRule = class extends APIResource {
       options
     );
   }
+  /**
+   * Create or email a Travel Rule end-user link
+   *
+   * Issue a new link and revoke previous open links for this transfer. Requires write access to transactions and an outbound transfer in AWAITING_COUNTERPARTY, COUNTERPARTY_VASP_NOT_FOUND, COUNTERPARTY_VASP_NOT_REACHABLE, UNCONFIRMED_OWNERSHIP or ON_HOLD. channel=email uses the end user's Didit-record email and verification-session language when available. A send failure returns the link with emailed_to empty; email_available reports address availability, not delivery. See [User links](/management-api/travel-rule/create-user-link).
+   *
+   * `POST /v3/transactions/{transaction_id}/travel-rule/user-link/`
+   *
+   * @param transactionId Didit-stable transaction UUID that owns the transfer.
+   */
+  createUserLink(transactionId, params = {}, options) {
+    return this._client.request(
+      TRANSACTIONS_TRAVEL_RULE_CREATE_USER_LINK,
+      [transactionId],
+      params,
+      options
+    );
+  }
   /**
    * List Travel Rule delivery history
    *
@@ -8361,9 +8451,9 @@ var TransactionsTravelRule = class extends APIResource {
     );
   }
   /**
-   * Finish, cancel, resend, or update the originator wallet of a Travel Rule transfer
+   * Update a Travel Rule transfer
    *
-   * Provide `payment_txn_id` to report the on-chain hash and move an outbound COMPLETED transfer to FINISHED (its INTERNAL-rail counterpart also moves to FINISHED), `{"action": "cancel"}` to cancel a non-terminal transfer, or `{"action": "resend"}` to route an outbound transfer stuck in COUNTERPARTY_VASP_NOT_FOUND, COUNTERPARTY_VASP_NOT_REACHABLE, or NOT_ENOUGH_COUNTERPARTY_DATA again (improve the counterparty data first, e.g. add a travel_address to the destination wallet entry). resend applies to outbound transfers only. `{"action": "update_compliance_email", "compliance_email": "desk@example.com"}` replaces the compliance email of an outbound transfer in one of those three statuses, the fix for `reason: email_undeliverable`: the status does not change, and the next `resend` sends the request to that address. A resend is queued, not run inside the request: the response shows the transfer back in AWAITING_COUNTERPARTY with a `resend queued` timeline entry and a queued `delivery`, and where it went arrives as a `travel_rule.status.updated` webhook. When the transfer went over GTR, VerifyVASP or Sygna Bridge, the network learns the on-chain hash or the cancellation after the response, with retries; `delivery` shows how that message stands. `{"action": "update_originator_wallet", "wallet_address": "..."}` records the wallet the funds actually left from on an outbound transfer, for example the address a UTXO withdrawal was broadcast from rather than the main wallet you declared. It changes the record only: nothing is sent to the counterparty again and the status stays. The originator becomes `chain_details.originator` with `source: updated`, the change is added to the `timeline` with the previous and the new wallet, and the INTERNAL-rail counterpart of the transfer is updated the same way. `{"action": "beneficiary_vasp", "beneficiary_vasp": "<directory VASP id>"}` names the counterparty yourself when discovery could not, on an outbound transfer in COUNTERPARTY_VASP_NOT_FOUND, COUNTERPARTY_VASP_NOT_REACHABLE or NOT_ENOUGH_COUNTERPARTY_DATA: the transfer is routed to that VASP and sent again.
+   * Provide `payment_txn_id` to report the on-chain hash and move an outbound COMPLETED transfer to FINISHED (its INTERNAL-rail counterpart also moves to FINISHED), `{"action": "cancel"}` to cancel a non-terminal transfer, or `{"action": "resend"}` to route an outbound transfer stuck in COUNTERPARTY_VASP_NOT_FOUND, COUNTERPARTY_VASP_NOT_REACHABLE, or NOT_ENOUGH_COUNTERPARTY_DATA again (improve the counterparty data first, e.g. add a travel_address to the destination wallet entry). resend applies to outbound transfers only. `{"action": "update_compliance_email", "compliance_email": "desk@example.com"}` replaces the compliance email of an outbound transfer in one of those three statuses, the fix for `reason: email_undeliverable`: the status does not change, and the next `resend` sends the request to that address. A resend is queued, not run inside the request: the response shows the transfer back in AWAITING_COUNTERPARTY with a `resend queued` timeline entry and a queued `delivery`, and where it went arrives as a `travel_rule.status.updated` webhook. When the transfer went over GTR, VerifyVASP or Sygna Bridge, the network learns the on-chain hash or the cancellation after the response, with retries; `delivery` shows how that message stands. `{"action": "update_originator_wallet", "wallet_address": "..."}` records the wallet the funds actually left from on an outbound transfer, for example the address a UTXO withdrawal was broadcast from rather than the main wallet you declared. It changes the record only: nothing is sent to the counterparty again and the status stays. The originator becomes `chain_details.originator` with `source: updated`, the change is added to the `timeline` with the previous and the new wallet, and the INTERNAL-rail counterpart of the transfer is updated the same way. `{"action": "beneficiary_vasp", "beneficiary_vasp": "<directory VASP id>"}` names the counterparty yourself when discovery could not, on an outbound transfer in COUNTERPARTY_VASP_NOT_FOUND, COUNTERPARTY_VASP_NOT_REACHABLE or NOT_ENOUGH_COUNTERPARTY_DATA: the transfer is routed to that VASP and sent again. Cancellation accepts an optional reason and returns cancel_reason and cancelled_by. Resend accepts notify_on_answer; omission preserves the saved preference, initially false. Resend invalidates the previous counterparty pickup link. action=add_vasp_hint requires name, accepts lei and country, saves the hint and re-runs discovery under the same outbound/status restrictions as resend. update_compliance_email also accepts vasp_name and saves the address as an application-private contact when the transfer has a known directory VASP.
    *
    * `PATCH /v3/transactions/{transaction_id}/travel-rule/`
    *
@@ -8550,6 +8640,7 @@ var TRAVEL_RULE_TRANSFERS_LIST = {
   method: "GET",
   path: "/v3/travel-rule/transfers/",
   query: [
+    "search",
     "direction",
     "status",
     "rail",
@@ -8663,6 +8754,12 @@ var TRAVEL_RULE_CLEAR_VASP_DECISION = {
   path: "/v3/travel-rule/vasps/{vasp_id}/decision/",
   dates: "TravelRuleCounterpartyDecisionResponse"
 };
+var TRAVEL_RULE_CREATE_VASP = {
+  method: "POST",
+  path: "/v3/travel-rule/vasps/",
+  body: "json",
+  dates: "VaspDirectoryEntry"
+};
 var TRAVEL_RULE_CREATE_WIDGET_SESSION = {
   method: "POST",
   path: "/v3/travel-rule/widget-session/",
@@ -9052,6 +9149,16 @@ var TravelRule = class extends APIResource {
   clearVaspDecision(vaspId, options) {
     return this._client.request(TRAVEL_RULE_CLEAR_VASP_DECISION, [vaspId], void 0, options);
   }
+  /**
+   * Create a private VASP directory entry
+   *
+   * Add a VASP privately to your application and optionally invite it. Requires write access to transactions. The response uses source=added_by_you. A matching visible name or LEI returns 409 with the existing vasp_id. See [Search the directory](/management-api/travel-rule/search-vasps).
+   *
+   * `POST /v3/travel-rule/vasps/`
+   */
+  createVasp(params, options) {
+    return this._client.request(TRAVEL_RULE_CREATE_VASP, [], params, options);
+  }
   /**
    * Mint a wallet-ownership widget session
    *
@@ -9077,7 +9184,7 @@ var TravelRule = class extends APIResource {
   /**
    * Search the VASP directory
    *
-   * Paginated, name-sorted search of the VASP directory: the shared directory entries, which Didit builds from the ESMA interim MiCA register, the public TRISA directory, the global LEI register and its own curation, plus the members of the Didit network. Each row carries the routes your application has to it today. Your own application's profile is never listed. Rows also carry the shared due-diligence assessment and your application's own decision, entity screening and questionnaires.
+   * Paginated, name-sorted search of the VASP directory: the shared directory entries, which Didit builds from the ESMA interim MiCA register, the public TRISA directory, the global LEI register and its own curation, plus the members of the Didit network. Each row carries the routes your application has to it today. Your own application's profile is never listed. Rows also carry the shared due-diligence assessment and your application's own decision, entity screening and questionnaires. Includes entries your application added privately. The optional source field distinguishes their provenance; kind=didit member results may omit source.
    *
    * `GET /v3/travel-rule/vasps/`
    */
@@ -11171,11 +11278,15 @@ async function send(transport, request) {
       log(null, null, "timeout");
       return new APITimeoutError(
         `The issuer did not answer ${method} ${path} within ${transport.timeout} ms.`,
-        { cause }
+        // A request that carries secrets keeps no cause: a transport may quote the serialized body in it.
+        request.structuredRedaction ? void 0 : { cause }
       );
     }
     log(null, null, "connection_error");
-    return new APIConnectionError(`Could not reach the issuer for ${method} ${path}.`, { cause });
+    return new APIConnectionError(
+      `Could not reach the issuer for ${method} ${path}.`,
+      request.structuredRedaction ? void 0 : { cause }
+    );
   };
   let status;
   let responseHeaders;
@@ -11203,19 +11314,28 @@ async function send(transport, request) {
   } finally {
     clearTimeout(timer);
   }
-  log(status, responseHeaders);
+  const secrets = request.secrets ?? [];
+  const sanitized = request.structuredRedaction ? sanitizeResponse(responseHeaders, text, secrets) : null;
+  const errorHeaders = sanitized?.headers ?? responseHeaders;
+  log(status, errorHeaders);
   if (status < 200 || status > 299) {
-    throw makeStatusError(status, bodyOf(text), responseHeaders, request.secrets ?? []);
+    throw makeStatusError(
+      status,
+      bodyOf(sanitized?.text ?? text),
+      errorHeaders,
+      sanitized ? [] : secrets
+    );
   }
-  if (status === 204 || !text) return { status, headers: responseHeaders, data: null };
+  if (status === 204 || !text)
+    return { status, headers: responseHeaders, errorHeaders, data: null };
   try {
-    return { status, headers: responseHeaders, data: JSON.parse(text) };
+    return { status, headers: responseHeaders, errorHeaders, data: JSON.parse(text) };
   } catch {
-    const type = responseHeaders.get("content-type") ?? "no content type";
+    const type = errorHeaders.get("content-type") ?? "no content type";
     throw new APIResponseValidationError(
       `Expected a JSON response from ${method} ${path}, got ${type}.`,
       status,
-      responseHeaders
+      errorHeaders
     );
   }
 }
@@ -11320,10 +11440,16 @@ function textList(value, name) {
   }
   return [...value];
 }
+var MIN_SECRET_LENGTH = 16;
 function assertionSecrets(value) {
-  if (typeof value === "string") return value.length > 0 ? [value] : [];
+  if (typeof value === "string") return value.length >= MIN_SECRET_LENGTH ? [value] : [];
   if (Array.isArray(value)) return value.flatMap(assertionSecrets);
-  if (isRecord4(value)) return Object.values(value).flatMap(assertionSecrets);
+  if (isRecord4(value)) {
+    return Object.entries(value).flatMap(([key, item]) => [
+      ...assertionSecrets(key),
+      ...assertionSecrets(item)
+    ]);
+  }
   return [];
 }
 function optionalText(value, name) {
@@ -11603,7 +11729,6 @@ var Authentication = class _Authentication {
     if (assertion !== void 0 && assertion !== null) {
       if (!isRecord4(assertion)) throw new TypeError("assertion must be an object.");
       body.assertion = assertion;
-      secrets.push(...assertionSecrets(assertion));
     }
     const scopes = given.scopes;
     if (scopes !== void 0 && scopes !== null) body.scopes = textList(scopes, "scopes");
@@ -11618,7 +11743,19 @@ var Authentication = class _Authentication {
       }
       body.lifetime = lifetime;
     }
-    const call = { ...this.#bearerCall("POST", AGENT_CONSENT_PATH, token), json: body, secrets };
+    let sent;
+    try {
+      sent = JSON.parse(JSON.stringify(body));
+    } catch {
+      throw new TypeError("Could not encode the agent consent request.");
+    }
+    secrets.push(...assertionSecrets(sent.assertion));
+    const call = {
+      ...this.#bearerCall("POST", AGENT_CONSENT_PATH, token),
+      json: sent,
+      secrets,
+      structuredRedaction: true
+    };
     return await this.#object(call);
   }
   /**
@@ -11634,7 +11771,8 @@ var Authentication = class _Authentication {
     const call = {
       ...this.#bearerCall("POST", AGENT_CONSENT_PASSKEY_PATH, token),
       json: { challenge },
-      secrets: [token, challenge]
+      secrets: [token, challenge],
+      structuredRedaction: true
     };
     return await this.#object(call);
   }
@@ -11654,7 +11792,7 @@ var Authentication = class _Authentication {
       throw new APIResponseValidationError(
         `Expected a JSON object from ${call.method} ${pathOf(call.url)}.`,
         response.status,
-        response.headers
+        response.errorHeaders
       );
     }
     return response.data;