@greensecurity/javascript-sdk 0.45.0-beta.9 → 0.45.0

package/src/sdk/lookups.ts

@@ -3,11 +3,30 @@
  */
 
 import { lookupsListLookupSystems } from "../funcs/lookupsListLookupSystems.js";
+import { lookupsLookupCompanyManagers } from "../funcs/lookupsLookupCompanyManagers.js";
+import { lookupsLookupPostalCode } from "../funcs/lookupsLookupPostalCode.js";
 import { ClientSDK, RequestOptions } from "../lib/sdks.js";
 import * as operations from "../models/operations/index.js";
 import { unwrapAsync } from "../types/fp.js";
 
 export class Lookups extends ClientSDK {
+  /**
+   * List the managers of a company for addressing a message
+   *
+   * @remarks
+   * List the active managers of a company who have an email address, so someone who belongs to that company can contact them. Readable by a vendor of the company, a manager of the company, or an admin; every other caller receives a 404. Carries only the fields needed to address a message, not the full company manager or user record. Distinct from `/companies/{id}/managers`, which is the administration listing and is gated on the `company_managers` view permission.
+   */
+  async lookupCompanyManagers(
+    request: operations.LookupCompanyManagersRequest,
+    options?: RequestOptions,
+  ): Promise<operations.LookupCompanyManagersLookupCompanyManagersOk> {
+    return unwrapAsync(lookupsLookupCompanyManagers(
+      this,
+      request,
+      options,
+    ));
+  }
+
   /**
    * List systems for dropdown/picker use
    *
@@ -31,4 +50,36 @@ export class Lookups extends ClientSDK {
       options,
     ));
   }
+
+  /**
+   * Check a postal code against a state and country
+   *
+   * @remarks
+   * Cross-checks a postal code against a state/province and country, the same check
+   * every write path that stores a US or Canadian address enforces server-side (e.g.
+   * `PUT /users/{id}`, `PUT /vendors/{vendor_id_or_me}`). Useful for validating an
+   * address before submitting it elsewhere.
+   *
+   * `status` is one of:
+   * - `ok` — the postal code belongs to the given state/province.
+   * - `invalid` — the postal code is not shaped like a real one for the given country.
+   * - `mismatch` — the postal code is well-formed but belongs to a different state or
+   *   province. `expected_states` names the state(s) it actually maps to.
+   * - `unknown` — nothing to check against (an unsupported country, or a postal code
+   *   absent from the US ZIP dataset). Treated as acceptable by every write path that
+   *   uses this check.
+   *
+   * Only the US and Canada have a real code-to-subdivision map; every other country
+   * always returns `unknown`.
+   */
+  async lookupPostalCode(
+    request: operations.LookupPostalCodeRequest,
+    options?: RequestOptions,
+  ): Promise<operations.LookupPostalCodeLookupPostalCodeOk> {
+    return unwrapAsync(lookupsLookupPostalCode(
+      this,
+      request,
+      options,
+    ));
+  }
 }

package/src/sdk/reports.ts

@@ -62,9 +62,9 @@ export class Reports extends ClientSDK {
    * | `404` | No such run, or it is outside your access scope. | Stop. |
    * | `403` | Your account is locked, or lacks the `scheduled_reports` view permission. | Stop. |
    *
-   * **Bound your polling.** A `409` is not a promise that the run will finish. Report
-   * generation has no terminal failure state today, so a run whose generation crashed part way
-   * through stays in `processing` and keeps answering `409` indefinitely. Apply your own
+   * **Bound your polling.** A `409` is not a promise that the run will finish. A run that fails
+   * while generating is now recorded as `failed` and answers `422`, but a run whose worker died
+   * outright still stays in `processing` and keeps answering `409` indefinitely. Apply your own
    * timeout or maximum attempt count and treat exhaustion as a failure; do not retry forever.
    *
    * Access control: the URL's `full_report_id` must be in the caller's read scope for

package/src/sdk/sdk.ts

@@ -73,6 +73,11 @@ export class GreenSecurity extends ClientSDK {
     return (this._companies ??= new Companies(this._options));
   }
 
+  private _lookups?: Lookups;
+  get lookups(): Lookups {
+    return (this._lookups ??= new Lookups(this._options));
+  }
+
   private _zones?: Zones;
   get zones(): Zones {
     return (this._zones ??= new Zones(this._options));
@@ -118,11 +123,6 @@ export class GreenSecurity extends ClientSDK {
     return (this._fhirConfigs ??= new FhirConfigs(this._options));
   }
 
-  private _lookups?: Lookups;
-  get lookups(): Lookups {
-    return (this._lookups ??= new Lookups(this._options));
-  }
-
   private _reports?: Reports;
   get reports(): Reports {
     return (this._reports ??= new Reports(this._options));
@@ -140,6 +140,9 @@ export class GreenSecurity extends ClientSDK {
     } | Request;
     secret: string;
   }): Promise<
+    | webhooks.SendFullReportCreatedRequest
+    | webhooks.SendFullReportUpdatedRequest
+    | webhooks.SendFullReportDestroyedRequest
     | webhooks.SendVendorCreatedRequest
     | webhooks.SendVendorUpdatedRequest
     | webhooks.SendVendorDestroyedRequest

package/src/sdk/users.ts

@@ -85,6 +85,12 @@ export class Users extends ClientSDK {
    * Only submitted fields are applied — unrecognised fields are silently ignored.
    * Changing `email` automatically resets `bounced_email` to `false`.
    *
+   * Submitting `zip`, `state`, or `country` cross-checks the postal code against the
+   * resulting state/country (using the existing value for any of the three left out
+   * of the request). A code that is not shaped like a real postal code, or that
+   * provably belongs to a different state, is rejected with `422` naming the correct
+   * state.
+   *
    * Each subkey of `email_preferences` is independently optional; sending
    * `{ "email_preferences": { "send_weekly_summary_email": true } }` flips
    * only that flag and leaves the others unchanged.
@@ -142,6 +148,43 @@ export class Users extends ClientSDK {
    * 3. Site redirects to your selected `return_url`
    * 4. The `user_token` will be appended as a query string parameter to your `return_url` - you must parse this token and store it
    * 5. Fetch the user object from `/users/me` using the token
+   *
+   * ## Finishing a "Login with Green Security" flow
+   *
+   * Green Security is also a SAML2 **identity provider**. When a third-party service provider sends a user to
+   * `/saml/idp/sso` to sign in with their Green Security account, the user lands on a Green Security login screen
+   * carrying an `sso_state` query string parameter. That parameter is a signed, five-minute record of which service
+   * provider is waiting, where its assertion consumer service lives, and what `RelayState` it sent.
+   *
+   * Authentication itself is unchanged - the user may still need a password, an MFA code, a magic link or a round trip
+   * to their own SAML IdP, and every `requires` value above applies as normal. The only difference is that you must
+   * echo `sso_state` back on **every** call in the sequence, unchanged, including the follow-up that carries the
+   * `mfa_code`.
+   *
+   * Each `202` response carries the verified blob back to you in its own top-level `sso_state` field. Send back the
+   * value from the response you just received rather than the one you started with. The two are normally the same
+   * string, but re-sending your original copy is how a blob the server has already rejected gets resent, and it forces
+   * you to hold login state you would otherwise not need.
+   *
+   * 1. Read `sso_state` from the query string of the login screen you were sent to
+   * 2. Run the login exactly as you would otherwise, adding `sso_state` to each request body and taking the value for
+   *    the next request from the previous `202` response
+   * 3. On the `200` response, read `sso.continue_url`
+   * 4. Navigate the browser to `sso.continue_url` - a full page navigation, not a background fetch. It answers with a
+   *    self-submitting form that delivers the signed `SAMLResponse` and the original `RelayState` to the service
+   *    provider
+   * 5. The service provider validates the assertion and the user is signed in on their side
+   *
+   * On the `password_reset` leg the blob is **also** appended to `redirect_url` as a query parameter, alongside
+   * `return_url`. The browser follows that redirect and leaves the JSON body behind, so anything the remaining legs of
+   * the login still need has to ride the URL. Preserve the query string exactly as given.
+   *
+   * An invalid `sso_state` never fails a login. A forged, edited or expired blob is silently dropped and the request is
+   * then treated as an ordinary login, so valid credentials still return `200` - just with no `sso` object. Check for
+   * `sso` explicitly rather than reading `200` as proof the hand-off survived. When it is absent, do not retry with the
+   * same blob; the user has to start again from the service provider. See the
+   * [Login with Green Security](https://greensecurity.apidocumentation.com/guides/sso-login-with-green-security)
+   * guide for the service provider half of this flow.
    */
   async postAuthenticate(
     request: operations.PostAuthenticateRequestBody,

package/src/sdk/vendors.ts

@@ -28,6 +28,7 @@ import { vendorsGetVendorInvoiceDetails } from "../funcs/vendorsGetVendorInvoice
 import { vendorsGetVendorInvoiceReceipt } from "../funcs/vendorsGetVendorInvoiceReceipt.js";
 import { vendorsGetVendorLegalName } from "../funcs/vendorsGetVendorLegalName.js";
 import { vendorsGetVendorPaymentResponsibility } from "../funcs/vendorsGetVendorPaymentResponsibility.js";
+import { vendorsGetVendorScreeningQuestions } from "../funcs/vendorsGetVendorScreeningQuestions.js";
 import { vendorsGetVendorsDetails } from "../funcs/vendorsGetVendorsDetails.js";
 import { vendorsGetVendorsExportStatus } from "../funcs/vendorsGetVendorsExportStatus.js";
 import { vendorsGetVendorTargetFacilities } from "../funcs/vendorsGetVendorTargetFacilities.js";
@@ -132,6 +133,10 @@ export class Vendors extends ClientSDK {
    * `company_id` is optional for company managers — it defaults to their own company.
    * All other callers must provide `company_id`. The caller must have access to the
    * specified company (verified via scoped access policy) and the `vendors:add` permission.
+   *
+   * `zip` is cross-checked against `state`: a code that is not shaped like a real postal
+   * code, or that provably belongs to a different state, is rejected with `422` naming
+   * the correct state.
    */
   async createVendor(
     request: operations.CreateVendorRequestBody,
@@ -719,6 +724,7 @@ export class Vendors extends ClientSDK {
    * invoice.line_items
    * invoice.invoice_transactions
    * invoice.may_pay_invoice
+   * invoice.associated_credentials
    * invoice_transactions.payee
    */
   async getVendorInvoiceDetails(
@@ -880,7 +886,15 @@ export class Vendors extends ClientSDK {
    * From `location` this endpoint reads only `timezone`, `address1`, `address2`,
    * `city`, `state`, `zip`, `phone`, `mobile_phone` and `fax`. The `address` and
    * `country` properties of the shared `UserLocation` schema are ignored here and
-   * updating them is not supported.
+   * updating them is not supported. `state` accepts a US state or a Canadian
+   * province — the vendor's country, set only at registration, is not editable
+   * through this endpoint.
+   *
+   * Submitting `location.zip` or `location.state` cross-checks the postal code
+   * against the resulting state (using the vendor's existing value for whichever
+   * of the two is left out of the request). A code that is not shaped like a real
+   * postal code, or that provably belongs to a different state, is rejected with
+   * `422` naming the correct state.
    *
    * For `title`, the `supervisor` fields, and every `location` field except
    * `timezone`, the value sent is the value stored: omit a field to leave it
@@ -1187,6 +1201,25 @@ export class Vendors extends ClientSDK {
     ));
   }
 
+  /**
+   * List a vendor's target-facility screening questions and answers
+   *
+   * @remarks
+   * Returns every active target-facility screening question that currently applies to the vendor at the given facility, each paired with the vendor's answer when one has been given. Questions that have not been answered are included with a null answer. Read-only; used to review a rep's screening answers.
+   */
+  async getVendorScreeningQuestions(
+    request: operations.GetVendorScreeningQuestionsRequest,
+    options?: RequestOptions,
+  ): Promise<
+    operations.GetVendorScreeningQuestionsGetVendorScreeningQuestionsOk
+  > {
+    return unwrapAsync(vendorsGetVendorScreeningQuestions(
+      this,
+      request,
+      options,
+    ));
+  }
+
   /**
    * Get the next unanswered screening question
    *