@didit-protocol/sdk-node 2.9.0 → 2.11.0

package/README.md

@@ -307,6 +307,7 @@ try {
 - `refresh(refreshToken)`: serialise refreshes for one session; reusing a consumed refresh token revokes the session.
 - `getSession(accessToken)` for an instant revocation check, `revokeSession(accessToken)`.
 - `createStepUp(accessToken, { action, amount?, currency?, returnTo? })` and `retrieveStepUp(accessToken, id)`: act only on status `approved`. The issuer currently requires `returnTo` and answers 400 without it.
+- `submitAgentConsent(accessToken, { challenge, decision, assertion?, scopes?, organizationIds?, lifetime? })` approves or denies an agent request (approval returns `{ code, redirect_uri, state }`, denial `{ status: "denied" }`; test `"code" in result`) and `createAgentApprovalOptions(accessToken, { challenge })` returns the WebAuthn `options` for the fresh passkey assertion a humans-only application requires (403 `passkey_required` without it). Neither is retried; the challenge and assertion are never logged.
 
 Authentication is in early access and reaches production with the 2026-11-01 Didit release.
 

package/dist/index.cjs

@@ -282,7 +282,7 @@ function decodeDates(value, plan, named, depth = 0) {
 }
 
 // src/core/version.ts
-var VERSION = "2.9.0";
+var VERSION = "2.11.0";
 
 // src/core/runtime.ts
 function processLike() {
@@ -1175,6 +1175,7 @@ var DATE_PLANS = {
   },
   AddressValidationResponse: { p: { created_at: 1 } },
   AgeEstimationEstimateResponse: { p: { created_at: 1 } },
+  AgentTopUp: { p: { created_at: 1 } },
   AmlMonitoringRetrieveJobResponse: { p: { created_at: 1, completed_at: 1 } },
   AmlRetrieveDatasetFreshnessResponse: { p: { dataset_freshness: "AMLDatasetFreshness" } },
   AmlScreenResponse: {
@@ -1192,6 +1193,7 @@ var DATE_PLANS = {
       updated_at: 1
     }
   },
+  BillingTopUpCharge: { p: { top_up: "AgentTopUp" } },
   BiometricRetention: { p: { deletes_at: 1 } },
   BiometricTemplatesListResponse: {
     p: { results: { i: { p: { retained_at: 1, expires_at: 1, purged_at: 1 } } } }
@@ -1950,6 +1952,8 @@ var AccountApplications = class extends APIResource {
    *
    * Create an application inside an organization, in the data location you choose (`data_location`, the European Union by default; it can't be changed afterwards). The response includes `api_key`; persist it now (recoverable via GET). Requires owner/admin JWT.
    *
+   * Set initiate_login_uri to your HTTPS sign-in page on the exact website_url hostname, or an empty string to disable admin-sent sign-in links. Changing website_url also revalidates the saved sign-in URI. Invalid values return 400 with an initiate_login_uri field error; hostname and URI policy failures use https_url_on_registered_website_required.
+   *
    * `POST /organizations/me/{org_id}/applications/`
    *
    * @param orgId UUID of the organization. Look it up with `GET /organizations/me/`.
@@ -1987,6 +1991,8 @@ var AccountApplications = class extends APIResource {
    *
    * Update application metadata (name, URLs, redirect URIs). `api_key` and `client_id` are never rotated. `products` is read-only: a `products` key in the body is ignored. `data_location` can't be changed after the application is created, except once on the live application created with your organization, while it is unused (see the request body). Requires owner/admin JWT.
    *
+   * Set initiate_login_uri to your HTTPS sign-in page on the exact website_url hostname, or an empty string to disable admin-sent sign-in links. Changing website_url also revalidates the saved sign-in URI. Invalid values return 400 with an initiate_login_uri field error; hostname and URI policy failures use https_url_on_registered_website_required.
+   *
    * `PATCH /organizations/me/{org_id}/applications/{app_id}/`
    *
    * @param orgId UUID of the organization that owns the application.
@@ -2287,7 +2293,12 @@ var Bank = class extends APIResource {
 
 // src/resources/billing.ts
 var BILLING_RETRIEVE_BALANCE = { method: "GET", path: "/v3/billing/balance/" };
-var BILLING_TOP_UP = { method: "POST", path: "/v3/billing/top-up/", body: "json" };
+var BILLING_TOP_UP = {
+  method: "POST",
+  path: "/v3/billing/top-up/",
+  body: "json",
+  dates: "BillingTopUpCharge"
+};
 var Billing = class extends APIResource {
   /**
    * Get credit balance
@@ -2302,9 +2313,24 @@ var Billing = class extends APIResource {
   /**
    * Top up credits
    *
-   * Add credits via a hosted Stripe Checkout session (**\$50 to \$20,000** per top-up). Top-ups are available on the Free, Growth and Scale plans, added at face value with no discount or bonus, and last 12 months; Enterprise annual contracts cannot top up. Redirect the customer to the returned `checkout_session_url`.
+   * Add credits to the organization's balance (**\$50 to \$20,000** per top-up). Top-ups are available on the Free, Growth and Scale plans, added at face value with no discount or bonus, and last 12 months; Enterprise annual contracts cannot top up.
+   *
+   * Two payment methods, chosen with `payment_method`:
+   *
+   * - `checkout` (default): creates a hosted Stripe Checkout session. Redirect the customer to the returned `checkout_session_url` (`200`).
+   * - `saved_card`: charges the organization's saved primary card off-session, now, at the normal self-serve amounts. Send an `Idempotency-Key` header (required for this method). It answers `201` when the card was charged, and `202` when a request with the same key is still being processed.
+   *
+   * **Agent top-ups (`saved_card`).** One switch controls them: "Connected AI agents can top up with your saved card". It is off by default and only a person signed in to the console can turn it on (Billing > Payment methods), never an API key or an agent. While it is on, agents and API keys can top up with the primary saved card. When it is off, the request returns `403` `agent_top_up_not_enabled` with a link a person can use to top up in the console.
+   *
+   * The balance is credited once the payment is confirmed, usually within seconds, and tax is added to the amount charged when it applies, so `total` can be higher than `credit_amount`. Read `GET /v3/billing/balance/` to confirm.
+   *
+   * **Idempotency.** Retrying with the same `Idempotency-Key` and the same amount returns the same top-up and never charges twice. The same key with another amount returns `409` `idempotency_key_conflict`.
+   *
+   * Every error of a `saved_card` request carries a `code` and a `detail`, and most also a `next_step` (read it only when it is present). When the step needs a person (for example `authentication_required`, where the card's bank asks the cardholder to approve and nothing is charged), `next_step.url` is a signed link to the console that opens the Top up dialog with the amount filled in and says which agent asked; nothing is charged until the person pays. Each top-up is marked with the agent's name in billing history and in the ordinary receipt email.
    *
    * `POST /v3/billing/top-up/`
+   *
+   * Accepts `options.idempotencyKey` (header `Idempotency-Key`).
    */
   topUp(params, options) {
     return this._client.request(BILLING_TOP_UP, [], params, options);
@@ -3482,7 +3508,7 @@ var CasesRegulatoryReports = class extends APIResource {
   /**
    * Create report from case
    *
-   * Create a draft FIU report for the case: DRAFT status, auto-populated from the optional template plus the case's subject, linked transactions, and narrative. Validate then finalize to produce the goAML XML and PDF.
+   * Create a draft FIU report for the case: DRAFT status, auto-populated from the optional template plus the case's subject, linked transactions, and narrative. Validate then finalize to produce the goAML XML and PDF. FFR (Confirmed Name Match Report, formerly the Funds Freeze Report) and PNMR (Partial Name Match Report) are activity reports: they report the case's subject, not transactions, so a draft links no transactions by default and the narrative, reason and action are written from the sanctions matches on the case's AML screenings.
    *
    * `POST /v3/organization/{organization_id}/application/{application_id}/cases/{case_uuid}/regulatory-reports/`
    *
@@ -6335,7 +6361,7 @@ var RegulatoryReports = class extends APIResource {
   /**
    * Finalize report
    *
-   * Re-validate, then render the goAML XML and PDF and upload both to S3. On SAR/STR/TFR reports, this also moves the case's transaction alerts from Pending SAR to SAR filed.
+   * Re-validate, then render the goAML XML and PDF and upload both to S3. On SAR/STR/TFR reports, this also moves the case's transaction alerts from Pending SAR to SAR filed. FFR and PNMR reports do not move alerts.
    *
    * `POST /v3/organization/{organization_id}/application/{application_id}/regulatory-reports/{report_uuid}/finalize/`
    *
@@ -6398,7 +6424,7 @@ var RegulatoryReports = class extends APIResource {
   /**
    * Validate report
    *
-   * Check the report against the obligatory goAML header fields (reporting entity ID, submission code, local currency, action taken, submission date), plus at least one attached transaction and a 2-letter jurisdiction, without generating any files. Also stores the result on the report: validation_errors and validated_at are updated, and a non-finalized report's status moves to VALIDATED (no errors) or back to DRAFT (errors).
+   * Check the report against the obligatory goAML header fields (reporting entity ID, submission code, local currency, action taken, submission date), plus at least one attached transaction and a 2-letter jurisdiction, without generating any files. For jurisdiction AE, once those pass, the report's goAML XML is also checked against the UAE FIU's goAML XML schema and each problem is returned as a field and a message; finalize refuses a report that fails. FFR and PNMR reports need no attached transaction: they require the case to have a subject, otherwise validation_errors contains an error with field `subject`. Also stores the result on the report: validation_errors and validated_at are updated, and a non-finalized report's status moves to VALIDATED (no errors) or back to DRAFT (errors).
    *
    * `POST /v3/organization/{organization_id}/application/{application_id}/regulatory-reports/{report_uuid}/validate/`
    *
@@ -6502,6 +6528,21 @@ var ReportTemplates = class extends APIResource {
   }
 };
 
+// src/resources/sandbox.ts
+var SANDBOX_LIST_SCENARIOS = { method: "GET", path: "/v1/sandbox/scenarios/" };
+var Sandbox = class extends APIResource {
+  /**
+   * List sandbox scenarios and Test VASP metadata
+   *
+   * Read the sandbox catalog Didit serves for testing. Authenticate with your application's API key or access token; a sandbox session's `Session-Token` also reads it, narrowed to the scenarios that session's workflow can produce. `scenarios`, `magic_values`, `risk_cases`, `sample_identity` and `delivery_conventions` describe the mocked session outcomes and the values that trigger them. `travel_rule` is the Didit Test VASP: its identity, the `routes` it answers over, and each scenario's own `route`. Every Test VASP exchange runs in process inside Didit, so `TEST_VASP` is not a live network or email transport and no real VASP is contacted. Pick a Travel Rule scenario by its beneficiary wallet address or by a beneficiary name of the form `Didit Test VASP <suffix>`. See [Travel Rule sandbox testing](/transaction-monitoring/travel-rule-sandbox).
+   *
+   * `GET /v1/sandbox/scenarios/`
+   */
+  listScenarios(options) {
+    return this._client.request(SANDBOX_LIST_SCENARIOS, [], void 0, options);
+  }
+};
+
 // src/resources/sessions.ts
 var SESSIONS_IMPORTS_CANCEL = {
   method: "POST",
@@ -10616,6 +10657,7 @@ var DiditResources = class extends APIClient {
   questionnaires = new Questionnaires(this);
   regulatoryReports = new RegulatoryReports(this);
   reportTemplates = new ReportTemplates(this);
+  sandbox = new Sandbox(this);
   sessions = new Sessions(this);
   transactions = new Transactions(this);
   travelRule = new TravelRule(this);
@@ -11213,6 +11255,8 @@ var JWKS_PATH = ".well-known/jwks.json";
 var TOKEN_PATH = "token/";
 var SESSION_PATH = "session/";
 var STEP_UP_PATH = "step-up/";
+var AGENT_CONSENT_PATH = "agents/consent/";
+var AGENT_CONSENT_PASSKEY_PATH = "agents/consent/passkey/";
 var DECIMAL_TEXT = /^-?[0-9]+(\.[0-9]+)?$/;
 function fieldsOf(value) {
   return value ?? {};
@@ -11231,6 +11275,23 @@ function bearerToken(value, name) {
   }
   return token;
 }
+function textList(value, name) {
+  if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) {
+    throw new TypeError(`${name} must be a list of strings.`);
+  }
+  return [...value];
+}
+function assertionSecrets(assertion) {
+  const response = isRecord4(assertion.response) ? assertion.response : {};
+  return [
+    assertion.id,
+    assertion.rawId,
+    response.clientDataJSON,
+    response.authenticatorData,
+    response.signature,
+    response.userHandle
+  ].filter((value) => typeof value === "string" && value.length > 0);
+}
 function optionalText(value, name) {
   if (value === void 0 || value === null) return void 0;
   if (typeof value !== "string") throw new TypeError(`${name} must be a string.`);
@@ -11483,6 +11544,66 @@ var Authentication = class _Authentication {
     const path = `${STEP_UP_PATH}${pathSegment(id, "id")}/`;
     return await this.#object(this.#bearerCall("GET", path, token));
   }
+  /**
+   * Approve or deny an agent's access request (`POST agents/consent/`) with a
+   * token of the signed-in person. Approval returns `{ code, redirect_uri,
+   * state }` (the agent exchanges the single-use code, valid 60 seconds, itself;
+   * no token is returned here); denial returns `{ status: "denied" }`. Tell them
+   * apart with `"code" in result`. A POST: never retried. The `challenge` and
+   * the `assertion` are never logged and are removed from error messages.
+   * Typical failures: 400 `invalid_grant` (unknown or expired request) and 403
+   * `passkey_required` (humans-only application: call
+   * `createAgentApprovalOptions`, run the passkey ceremony, pass the assertion).
+   */
+  async submitAgentConsent(accessToken, params) {
+    const token = bearerToken(accessToken, "accessToken");
+    const given = fieldsOf(params);
+    const challenge = requiredText(given.challenge, "challenge");
+    const decision = requiredText(given.decision, "decision");
+    if (decision !== "approve" && decision !== "deny") {
+      throw new TypeError('decision must be "approve" or "deny".');
+    }
+    const body = { challenge, decision };
+    const secrets = [token, challenge];
+    const assertion = given.assertion;
+    if (assertion !== void 0 && assertion !== null) {
+      if (!isRecord4(assertion)) throw new TypeError("assertion must be an object.");
+      body.assertion = assertion;
+      secrets.push(...assertionSecrets(assertion));
+    }
+    const scopes = given.scopes;
+    if (scopes !== void 0 && scopes !== null) body.scopes = textList(scopes, "scopes");
+    const organizationIds = given.organizationIds;
+    if (organizationIds !== void 0 && organizationIds !== null) {
+      body.organization_ids = textList(organizationIds, "organizationIds");
+    }
+    const lifetime = given.lifetime;
+    if (lifetime !== void 0 && lifetime !== null) {
+      if (typeof lifetime !== "number" || !Number.isInteger(lifetime)) {
+        throw new TypeError("lifetime must be an integer number of seconds.");
+      }
+      body.lifetime = lifetime;
+    }
+    const call = { ...this.#bearerCall("POST", AGENT_CONSENT_PATH, token), json: body, secrets };
+    return await this.#object(call);
+  }
+  /**
+   * Get WebAuthn request options bound to a pending agent request
+   * (`POST agents/consent/passkey/`) with a token of the signed-in person. Pass
+   * `options` to `navigator.credentials.get()` (decode the base64url fields),
+   * then send the result as `assertion` to `submitAgentConsent`. A POST: never
+   * retried; the `challenge` is never logged.
+   */
+  async createAgentApprovalOptions(accessToken, params) {
+    const token = bearerToken(accessToken, "accessToken");
+    const challenge = requiredText(fieldsOf(params).challenge, "challenge");
+    const call = {
+      ...this.#bearerCall("POST", AGENT_CONSENT_PASSKEY_PATH, token),
+      json: { challenge },
+      secrets: [token, challenge]
+    };
+    return await this.#object(call);
+  }
   // Requests ------------------------------------------------------------------
   #url(path) {
     return `${this.issuer}/${path}`;
@@ -11738,6 +11859,7 @@ exports.Questionnaires = Questionnaires;
 exports.RateLimitError = RateLimitError;
 exports.RegulatoryReports = RegulatoryReports;
 exports.ReportTemplates = ReportTemplates;
+exports.Sandbox = Sandbox;
 exports.Sessions = Sessions;
 exports.SessionsImports = SessionsImports;
 exports.SessionsReviews = SessionsReviews;