@naturalpay/sdk 1.6.4 → 1.6.6

package/dist/cjs/BaseClient.js

@@ -43,8 +43,8 @@ function normalizeClientOptions(options) {
     const headers = (0, headers_js_1.mergeHeaders)({
         "X-Fern-Language": "JavaScript",
         "X-Fern-SDK-Name": "@naturalpay/sdk",
-        "X-Fern-SDK-Version": "1.6.4",
-        "User-Agent": "@naturalpay/sdk/1.6.4",
+        "X-Fern-SDK-Version": "1.6.6",
+        "User-Agent": "@naturalpay/sdk/1.6.6",
         "X-Fern-Runtime": core.RUNTIME.type,
         "X-Fern-Runtime-Version": core.RUNTIME.version,
         "X-Instance-ID": options === null || options === void 0 ? void 0 : options.instanceId,

package/dist/cjs/api/resources/paymentRequests/types/CreatePaymentRequestsResponseDataRelationshipsPayerAgent.d.ts

@@ -0,0 +1,8 @@
+import type * as Natural from "../../../index.js";
+/**
+ * Payer agent, or null unless addressed by agent ID or agent handle.
+ */
+export interface CreatePaymentRequestsResponseDataRelationshipsPayerAgent {
+    /** Related resource identifier. */
+    data: Natural.CreatePaymentRequestsResponseDataRelationshipsPayerAgentData | null;
+}

package/dist/cjs/api/resources/paymentRequests/types/CreatePaymentRequestsResponseDataRelationshipsPayerAgent.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/api/resources/paymentRequests/types/CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.d.ts

@@ -0,0 +1,8 @@
+import type * as Natural from "../../../index.js";
+/**
+ * Related resource identifier.
+ */
+export interface CreatePaymentRequestsResponseDataRelationshipsPayerAgentData {
+    type: Natural.CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType;
+    id: string;
+}

package/dist/cjs/api/resources/paymentRequests/types/CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/api/resources/paymentRequests/types/CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType.d.ts

@@ -0,0 +1,4 @@
+export declare const CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType: {
+    readonly Agent: "agent";
+};
+export type CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType = (typeof CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType)[keyof typeof CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType];

package/dist/cjs/api/resources/paymentRequests/types/CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType.js

@@ -0,0 +1,7 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType = void 0;
+exports.CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType = {
+    Agent: "agent",
+};

package/dist/cjs/api/resources/paymentRequests/types/NewPayReqRels.d.ts

@@ -4,4 +4,6 @@ export interface NewPayReqRels {
     requesterParty: Natural.NewPayReqRequesterRel;
     /** Resolved payer party, if the payer is known to Natural. */
     payerParty: Natural.NewPayReqPayerRel;
+    /** Payer agent, or null unless addressed by agent ID or agent handle. */
+    payerAgent: Natural.CreatePaymentRequestsResponseDataRelationshipsPayerAgent;
 }

package/dist/cjs/api/resources/paymentRequests/types/index.d.ts

@@ -31,6 +31,9 @@ export * from "./CreatePaymentRequestsRequestPayerPartyId.js";
 export * from "./CreatePaymentRequestsRequestPayerPhone.js";
 export * from "./CreatePaymentRequestsResponseDataAttributesInitiatorAgent.js";
 export * from "./CreatePaymentRequestsResponseDataAttributesInitiatorParty.js";
+export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgent.js";
+export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.js";
+export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType.js";
 export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerPartyData.js";
 export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerPartyDataType.js";
 export * from "./DeclinedReq.js";

package/dist/cjs/api/resources/paymentRequests/types/index.js

@@ -47,6 +47,9 @@ __exportStar(require("./CreatePaymentRequestsRequestPayerPartyId.js"), exports);
 __exportStar(require("./CreatePaymentRequestsRequestPayerPhone.js"), exports);
 __exportStar(require("./CreatePaymentRequestsResponseDataAttributesInitiatorAgent.js"), exports);
 __exportStar(require("./CreatePaymentRequestsResponseDataAttributesInitiatorParty.js"), exports);
+__exportStar(require("./CreatePaymentRequestsResponseDataRelationshipsPayerAgent.js"), exports);
+__exportStar(require("./CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.js"), exports);
+__exportStar(require("./CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType.js"), exports);
 __exportStar(require("./CreatePaymentRequestsResponseDataRelationshipsPayerPartyData.js"), exports);
 __exportStar(require("./CreatePaymentRequestsResponseDataRelationshipsPayerPartyDataType.js"), exports);
 __exportStar(require("./DeclinedReq.js"), exports);

package/dist/cjs/core/fetcher/Fetcher.js

@@ -22,6 +22,7 @@ const getResponseBody_js_1 = require("./getResponseBody.js");
 const Headers_js_1 = require("./Headers.js");
 const makeRequest_js_1 = require("./makeRequest.js");
 const RawResponse_js_1 = require("./RawResponse.js");
+const redactUrl_js_1 = require("./redactUrl.js");
 const requestWithRetries_js_1 = require("./requestWithRetries.js");
 const SENSITIVE_HEADERS = new Set([
     "authorization",
@@ -53,100 +54,16 @@ function redactHeaders(headers) {
     }
     return filtered;
 }
-const SENSITIVE_QUERY_PARAMS = new Set([
-    "api_key",
-    "api-key",
-    "apikey",
-    "token",
-    "access_token",
-    "access-token",
-    "auth_token",
-    "auth-token",
-    "password",
-    "passwd",
-    "secret",
-    "api_secret",
-    "api-secret",
-    "apisecret",
-    "key",
-    "session",
-    "session_id",
-    "session-id",
-]);
 function redactQueryParameters(queryParameters) {
     if (queryParameters == null) {
         return undefined;
     }
     const redacted = {};
     for (const [key, value] of Object.entries(queryParameters)) {
-        redacted[key] = SENSITIVE_QUERY_PARAMS.has(key.toLowerCase()) ? "[REDACTED]" : value;
+        redacted[key] = redactUrl_js_1.SENSITIVE_QUERY_PARAMS.has(key.toLowerCase()) ? "[REDACTED]" : value;
     }
     return redacted;
 }
-function redactUrl(url) {
-    const protocolIndex = url.indexOf("://");
-    if (protocolIndex === -1)
-        return url;
-    const afterProtocol = protocolIndex + 3;
-    // Find the first delimiter that marks the end of the authority section
-    const pathStart = url.indexOf("/", afterProtocol);
-    let queryStart = url.indexOf("?", afterProtocol);
-    let fragmentStart = url.indexOf("#", afterProtocol);
-    const firstDelimiter = Math.min(pathStart === -1 ? url.length : pathStart, queryStart === -1 ? url.length : queryStart, fragmentStart === -1 ? url.length : fragmentStart);
-    // Find the LAST @ before the delimiter (handles multiple @ in credentials)
-    let atIndex = -1;
-    for (let i = afterProtocol; i < firstDelimiter; i++) {
-        if (url[i] === "@") {
-            atIndex = i;
-        }
-    }
-    if (atIndex !== -1) {
-        url = `${url.slice(0, afterProtocol)}[REDACTED]@${url.slice(atIndex + 1)}`;
-    }
-    // Recalculate queryStart since url might have changed
-    queryStart = url.indexOf("?");
-    if (queryStart === -1)
-        return url;
-    fragmentStart = url.indexOf("#", queryStart);
-    const queryEnd = fragmentStart !== -1 ? fragmentStart : url.length;
-    const queryString = url.slice(queryStart + 1, queryEnd);
-    if (queryString.length === 0)
-        return url;
-    // FAST PATH: Quick check if any sensitive keywords present
-    // Using indexOf is faster than regex for simple substring matching
-    const lower = queryString.toLowerCase();
-    const hasSensitive = lower.includes("token") ||
-        lower.includes("key") ||
-        lower.includes("password") ||
-        lower.includes("passwd") ||
-        lower.includes("secret") ||
-        lower.includes("session") ||
-        lower.includes("auth");
-    if (!hasSensitive) {
-        return url;
-    }
-    // SLOW PATH: Parse and redact
-    const redactedParams = [];
-    const params = queryString.split("&");
-    for (const param of params) {
-        const equalIndex = param.indexOf("=");
-        if (equalIndex === -1) {
-            redactedParams.push(param);
-            continue;
-        }
-        const key = param.slice(0, equalIndex);
-        let shouldRedact = SENSITIVE_QUERY_PARAMS.has(key.toLowerCase());
-        if (!shouldRedact && key.includes("%")) {
-            try {
-                const decodedKey = decodeURIComponent(key);
-                shouldRedact = SENSITIVE_QUERY_PARAMS.has(decodedKey.toLowerCase());
-            }
-            catch (_a) { }
-        }
-        redactedParams.push(shouldRedact ? `${key}=[REDACTED]` : param);
-    }
-    return url.slice(0, queryStart + 1) + redactedParams.join("&") + url.slice(queryEnd);
-}
 function getHeaders(args) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;
@@ -198,7 +115,7 @@ function fetcherImpl(args) {
         if (logger.isDebug()) {
             const metadata = {
                 method: args.method,
-                url: redactUrl(url),
+                url: (0, redactUrl_js_1.redactUrl)(url),
                 headers: redactHeaders(headers),
                 queryParameters: redactQueryParameters(args.queryParameters),
                 hasBody: requestBody != null,
@@ -213,7 +130,7 @@ function fetcherImpl(args) {
                 if (logger.isDebug()) {
                     const metadata = {
                         method: args.method,
-                        url: redactUrl(url),
+                        url: (0, redactUrl_js_1.redactUrl)(url),
                         statusCode: response.status,
                         responseHeaders: redactHeaders(response.headers),
                     };
@@ -231,7 +148,7 @@ function fetcherImpl(args) {
                 if (logger.isError()) {
                     const metadata = {
                         method: args.method,
-                        url: redactUrl(url),
+                        url: (0, redactUrl_js_1.redactUrl)(url),
                         statusCode: response.status,
                         responseHeaders: redactHeaders(Object.fromEntries(response.headers.entries())),
                     };
@@ -253,7 +170,7 @@ function fetcherImpl(args) {
                 if (logger.isError()) {
                     const metadata = {
                         method: args.method,
-                        url: redactUrl(url),
+                        url: (0, redactUrl_js_1.redactUrl)(url),
                     };
                     logger.error("HTTP request was aborted", metadata);
                 }
@@ -271,7 +188,7 @@ function fetcherImpl(args) {
                 if (logger.isError()) {
                     const metadata = {
                         method: args.method,
-                        url: redactUrl(url),
+                        url: (0, redactUrl_js_1.redactUrl)(url),
                         timeoutMs: args.timeoutMs,
                     };
                     logger.error("HTTP request timed out", metadata);
@@ -289,7 +206,7 @@ function fetcherImpl(args) {
                 if (logger.isError()) {
                     const metadata = {
                         method: args.method,
-                        url: redactUrl(url),
+                        url: (0, redactUrl_js_1.redactUrl)(url),
                         errorMessage: error.message,
                     };
                     logger.error("HTTP request failed with error", metadata);
@@ -307,7 +224,7 @@ function fetcherImpl(args) {
             if (logger.isError()) {
                 const metadata = {
                     method: args.method,
-                    url: redactUrl(url),
+                    url: (0, redactUrl_js_1.redactUrl)(url),
                     error: (0, json_js_1.toJson)(error),
                 };
                 logger.error("HTTP request failed with unknown error", metadata);

package/dist/cjs/core/fetcher/makePassthroughRequest.js

@@ -15,6 +15,7 @@ const join_js_1 = require("../url/join.js");
 const EndpointSupplier_js_1 = require("./EndpointSupplier.js");
 const getFetchFn_js_1 = require("./getFetchFn.js");
 const makeRequest_js_1 = require("./makeRequest.js");
+const redactUrl_js_1 = require("./redactUrl.js");
 const requestWithRetries_js_1 = require("./requestWithRetries.js");
 const Supplier_js_1 = require("./Supplier.js");
 /**
@@ -79,8 +80,10 @@ function makePassthroughRequest(input, init, clientOptions, requestOptions) {
                 }
             }
         }
-        // Apply auth headers
-        if (clientOptions.getAuthHeaders != null) {
+        // Apply auth headers, but only when the resolved URL targets the configured base URL.
+        // This prevents the SDK's credentials from leaking to an unrelated host when a caller
+        // passes an absolute cross-origin URL into the passthrough fetch escape hatch.
+        if (clientOptions.getAuthHeaders != null && targetsBaseUrl(fullUrl, baseUrl)) {
             const authHeaders = yield clientOptions.getAuthHeaders();
             for (const [key, value] of Object.entries(authHeaders)) {
                 mergedHeaders[key.toLowerCase()] = value;
@@ -115,7 +118,7 @@ function makePassthroughRequest(input, init, clientOptions, requestOptions) {
         if (logger.isDebug()) {
             logger.debug("Making passthrough HTTP request", {
                 method,
-                url: fullUrl,
+                url: (0, redactUrl_js_1.redactUrl)(fullUrl),
                 hasBody: body != null,
             });
         }
@@ -126,10 +129,29 @@ function makePassthroughRequest(input, init, clientOptions, requestOptions) {
         if (logger.isDebug()) {
             logger.debug("Passthrough HTTP request completed", {
                 method,
-                url: fullUrl,
+                url: (0, redactUrl_js_1.redactUrl)(fullUrl),
                 statusCode: response.status,
             });
         }
         return response;
     });
 }
+/**
+ * Returns true when the resolved request URL points at the same origin as the
+ * configured base URL. Relative paths are always joined onto the base URL, so
+ * they resolve to the base origin and return true. Absolute URLs only match when
+ * their origin equals the base origin. When there is no base URL to compare
+ * against, or either value is not a parseable absolute URL, this returns false so
+ * auth headers are not attached.
+ */
+function targetsBaseUrl(fullUrl, baseUrl) {
+    if (baseUrl == null) {
+        return false;
+    }
+    try {
+        return new URL(fullUrl).origin === new URL(baseUrl).origin;
+    }
+    catch (_a) {
+        return false;
+    }
+}

package/dist/cjs/core/fetcher/redactUrl.d.ts

@@ -0,0 +1,2 @@
+export declare const SENSITIVE_QUERY_PARAMS: Set<string>;
+export declare function redactUrl(url: string): string;

package/dist/cjs/core/fetcher/redactUrl.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SENSITIVE_QUERY_PARAMS = void 0;
+exports.redactUrl = redactUrl;
+exports.SENSITIVE_QUERY_PARAMS = new Set([
+    "api_key",
+    "api-key",
+    "apikey",
+    "token",
+    "access_token",
+    "access-token",
+    "auth_token",
+    "auth-token",
+    "password",
+    "passwd",
+    "secret",
+    "api_secret",
+    "api-secret",
+    "apisecret",
+    "key",
+    "session",
+    "session_id",
+    "session-id",
+]);
+function redactUrl(url) {
+    const protocolIndex = url.indexOf("://");
+    if (protocolIndex === -1)
+        return url;
+    const afterProtocol = protocolIndex + 3;
+    // Find the first delimiter that marks the end of the authority section
+    const pathStart = url.indexOf("/", afterProtocol);
+    let queryStart = url.indexOf("?", afterProtocol);
+    let fragmentStart = url.indexOf("#", afterProtocol);
+    const firstDelimiter = Math.min(pathStart === -1 ? url.length : pathStart, queryStart === -1 ? url.length : queryStart, fragmentStart === -1 ? url.length : fragmentStart);
+    // Find the LAST @ before the delimiter (handles multiple @ in credentials)
+    let atIndex = -1;
+    for (let i = afterProtocol; i < firstDelimiter; i++) {
+        if (url[i] === "@") {
+            atIndex = i;
+        }
+    }
+    if (atIndex !== -1) {
+        url = `${url.slice(0, afterProtocol)}[REDACTED]@${url.slice(atIndex + 1)}`;
+    }
+    // Recalculate queryStart since url might have changed
+    queryStart = url.indexOf("?");
+    if (queryStart === -1)
+        return url;
+    fragmentStart = url.indexOf("#", queryStart);
+    const queryEnd = fragmentStart !== -1 ? fragmentStart : url.length;
+    const queryString = url.slice(queryStart + 1, queryEnd);
+    if (queryString.length === 0)
+        return url;
+    // FAST PATH: Quick check if any sensitive keywords present
+    // Using indexOf is faster than regex for simple substring matching
+    const lower = queryString.toLowerCase();
+    const hasSensitive = lower.includes("token") ||
+        lower.includes("key") ||
+        lower.includes("password") ||
+        lower.includes("passwd") ||
+        lower.includes("secret") ||
+        lower.includes("session") ||
+        lower.includes("auth");
+    if (!hasSensitive) {
+        return url;
+    }
+    // SLOW PATH: Parse and redact
+    const redactedParams = [];
+    const params = queryString.split("&");
+    for (const param of params) {
+        const equalIndex = param.indexOf("=");
+        if (equalIndex === -1) {
+            redactedParams.push(param);
+            continue;
+        }
+        const key = param.slice(0, equalIndex);
+        let shouldRedact = exports.SENSITIVE_QUERY_PARAMS.has(key.toLowerCase());
+        if (!shouldRedact && key.includes("%")) {
+            try {
+                const decodedKey = decodeURIComponent(key);
+                shouldRedact = exports.SENSITIVE_QUERY_PARAMS.has(decodedKey.toLowerCase());
+            }
+            catch (_a) { }
+        }
+        redactedParams.push(shouldRedact ? `${key}=[REDACTED]` : param);
+    }
+    return url.slice(0, queryStart + 1) + redactedParams.join("&") + url.slice(queryEnd);
+}

package/dist/cjs/serialization/resources/paymentRequests/types/CreatePaymentRequestsResponseDataRelationshipsPayerAgent.d.ts

@@ -0,0 +1,10 @@
+import type * as Natural from "../../../../api/index.js";
+import * as core from "../../../../core/index.js";
+import type * as serializers from "../../../index.js";
+import { CreatePaymentRequestsResponseDataRelationshipsPayerAgentData } from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.js";
+export declare const CreatePaymentRequestsResponseDataRelationshipsPayerAgent: core.serialization.ObjectSchema<serializers.CreatePaymentRequestsResponseDataRelationshipsPayerAgent.Raw, Natural.CreatePaymentRequestsResponseDataRelationshipsPayerAgent>;
+export declare namespace CreatePaymentRequestsResponseDataRelationshipsPayerAgent {
+    interface Raw {
+        data?: CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.Raw | null;
+    }
+}

package/dist/cjs/serialization/resources/paymentRequests/types/CreatePaymentRequestsResponseDataRelationshipsPayerAgent.js

@@ -0,0 +1,42 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreatePaymentRequestsResponseDataRelationshipsPayerAgent = void 0;
+const core = __importStar(require("../../../../core/index.js"));
+const CreatePaymentRequestsResponseDataRelationshipsPayerAgentData_js_1 = require("./CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.js");
+exports.CreatePaymentRequestsResponseDataRelationshipsPayerAgent = core.serialization.object({
+    data: CreatePaymentRequestsResponseDataRelationshipsPayerAgentData_js_1.CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.nullable(),
+});

package/dist/cjs/serialization/resources/paymentRequests/types/CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.d.ts

@@ -0,0 +1,11 @@
+import type * as Natural from "../../../../api/index.js";
+import * as core from "../../../../core/index.js";
+import type * as serializers from "../../../index.js";
+import { CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType } from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType.js";
+export declare const CreatePaymentRequestsResponseDataRelationshipsPayerAgentData: core.serialization.ObjectSchema<serializers.CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.Raw, Natural.CreatePaymentRequestsResponseDataRelationshipsPayerAgentData>;
+export declare namespace CreatePaymentRequestsResponseDataRelationshipsPayerAgentData {
+    interface Raw {
+        type: CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType.Raw;
+        id: string;
+    }
+}

package/dist/cjs/serialization/resources/paymentRequests/types/CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.js

@@ -0,0 +1,43 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreatePaymentRequestsResponseDataRelationshipsPayerAgentData = void 0;
+const core = __importStar(require("../../../../core/index.js"));
+const CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType_js_1 = require("./CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType.js");
+exports.CreatePaymentRequestsResponseDataRelationshipsPayerAgentData = core.serialization.object({
+    type: CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType_js_1.CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType,
+    id: core.serialization.string(),
+});

package/dist/cjs/serialization/resources/paymentRequests/types/CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType.d.ts

@@ -0,0 +1,7 @@
+import type * as Natural from "../../../../api/index.js";
+import * as core from "../../../../core/index.js";
+import type * as serializers from "../../../index.js";
+export declare const CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType: core.serialization.Schema<serializers.CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType.Raw, Natural.CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType>;
+export declare namespace CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType {
+    type Raw = "agent";
+}

package/dist/cjs/serialization/resources/paymentRequests/types/CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType.js

@@ -0,0 +1,39 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType = void 0;
+const core = __importStar(require("../../../../core/index.js"));
+exports.CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType = core.serialization.enum_(["agent"]);

package/dist/cjs/serialization/resources/paymentRequests/types/NewPayReqRels.d.ts

@@ -1,6 +1,7 @@
 import type * as Natural from "../../../../api/index.js";
 import * as core from "../../../../core/index.js";
 import type * as serializers from "../../../index.js";
+import { CreatePaymentRequestsResponseDataRelationshipsPayerAgent } from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgent.js";
 import { NewPayReqPayerRel } from "./NewPayReqPayerRel.js";
 import { NewPayReqRequesterRel } from "./NewPayReqRequesterRel.js";
 export declare const NewPayReqRels: core.serialization.ObjectSchema<serializers.NewPayReqRels.Raw, Natural.NewPayReqRels>;
@@ -8,5 +9,6 @@ export declare namespace NewPayReqRels {
     interface Raw {
         requesterParty: NewPayReqRequesterRel.Raw;
         payerParty: NewPayReqPayerRel.Raw;
+        payerAgent: CreatePaymentRequestsResponseDataRelationshipsPayerAgent.Raw;
     }
 }

package/dist/cjs/serialization/resources/paymentRequests/types/NewPayReqRels.js

@@ -36,9 +36,11 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.NewPayReqRels = void 0;
 const core = __importStar(require("../../../../core/index.js"));
+const CreatePaymentRequestsResponseDataRelationshipsPayerAgent_js_1 = require("./CreatePaymentRequestsResponseDataRelationshipsPayerAgent.js");
 const NewPayReqPayerRel_js_1 = require("./NewPayReqPayerRel.js");
 const NewPayReqRequesterRel_js_1 = require("./NewPayReqRequesterRel.js");
 exports.NewPayReqRels = core.serialization.object({
     requesterParty: NewPayReqRequesterRel_js_1.NewPayReqRequesterRel,
     payerParty: NewPayReqPayerRel_js_1.NewPayReqPayerRel,
+    payerAgent: CreatePaymentRequestsResponseDataRelationshipsPayerAgent_js_1.CreatePaymentRequestsResponseDataRelationshipsPayerAgent,
 });

package/dist/cjs/serialization/resources/paymentRequests/types/index.d.ts

@@ -31,6 +31,9 @@ export * from "./CreatePaymentRequestsRequestPayerPartyId.js";
 export * from "./CreatePaymentRequestsRequestPayerPhone.js";
 export * from "./CreatePaymentRequestsResponseDataAttributesInitiatorAgent.js";
 export * from "./CreatePaymentRequestsResponseDataAttributesInitiatorParty.js";
+export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgent.js";
+export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.js";
+export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType.js";
 export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerPartyData.js";
 export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerPartyDataType.js";
 export * from "./DeclinedReq.js";

package/dist/cjs/serialization/resources/paymentRequests/types/index.js

@@ -47,6 +47,9 @@ __exportStar(require("./CreatePaymentRequestsRequestPayerPartyId.js"), exports);
 __exportStar(require("./CreatePaymentRequestsRequestPayerPhone.js"), exports);
 __exportStar(require("./CreatePaymentRequestsResponseDataAttributesInitiatorAgent.js"), exports);
 __exportStar(require("./CreatePaymentRequestsResponseDataAttributesInitiatorParty.js"), exports);
+__exportStar(require("./CreatePaymentRequestsResponseDataRelationshipsPayerAgent.js"), exports);
+__exportStar(require("./CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.js"), exports);
+__exportStar(require("./CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType.js"), exports);
 __exportStar(require("./CreatePaymentRequestsResponseDataRelationshipsPayerPartyData.js"), exports);
 __exportStar(require("./CreatePaymentRequestsResponseDataRelationshipsPayerPartyDataType.js"), exports);
 __exportStar(require("./DeclinedReq.js"), exports);

package/dist/cjs/version.d.ts

@@ -1 +1 @@
-export declare const SDK_VERSION = "1.6.4";
+export declare const SDK_VERSION = "1.6.6";

package/dist/cjs/version.js

@@ -1,4 +1,4 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SDK_VERSION = void 0;
-exports.SDK_VERSION = "1.6.4";
+exports.SDK_VERSION = "1.6.6";

package/dist/esm/BaseClient.mjs

@@ -6,8 +6,8 @@ export function normalizeClientOptions(options) {
     const headers = mergeHeaders({
         "X-Fern-Language": "JavaScript",
         "X-Fern-SDK-Name": "@naturalpay/sdk",
-        "X-Fern-SDK-Version": "1.6.4",
-        "User-Agent": "@naturalpay/sdk/1.6.4",
+        "X-Fern-SDK-Version": "1.6.6",
+        "User-Agent": "@naturalpay/sdk/1.6.6",
         "X-Fern-Runtime": core.RUNTIME.type,
         "X-Fern-Runtime-Version": core.RUNTIME.version,
         "X-Instance-ID": options === null || options === void 0 ? void 0 : options.instanceId,

package/dist/esm/api/resources/paymentRequests/types/CreatePaymentRequestsResponseDataRelationshipsPayerAgent.d.mts

@@ -0,0 +1,8 @@
+import type * as Natural from "../../../index.mjs";
+/**
+ * Payer agent, or null unless addressed by agent ID or agent handle.
+ */
+export interface CreatePaymentRequestsResponseDataRelationshipsPayerAgent {
+    /** Related resource identifier. */
+    data: Natural.CreatePaymentRequestsResponseDataRelationshipsPayerAgentData | null;
+}

package/dist/esm/api/resources/paymentRequests/types/CreatePaymentRequestsResponseDataRelationshipsPayerAgent.mjs

@@ -0,0 +1,2 @@
+// This file was auto-generated by Fern from our API Definition.
+export {};

package/dist/esm/api/resources/paymentRequests/types/CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.d.mts

@@ -0,0 +1,8 @@
+import type * as Natural from "../../../index.mjs";
+/**
+ * Related resource identifier.
+ */
+export interface CreatePaymentRequestsResponseDataRelationshipsPayerAgentData {
+    type: Natural.CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType;
+    id: string;
+}

package/dist/esm/api/resources/paymentRequests/types/CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.mjs

@@ -0,0 +1,2 @@
+// This file was auto-generated by Fern from our API Definition.
+export {};

package/dist/esm/api/resources/paymentRequests/types/CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType.d.mts

@@ -0,0 +1,4 @@
+export declare const CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType: {
+    readonly Agent: "agent";
+};
+export type CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType = (typeof CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType)[keyof typeof CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType];

package/dist/esm/api/resources/paymentRequests/types/CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType.mjs

@@ -0,0 +1,4 @@
+// This file was auto-generated by Fern from our API Definition.
+export const CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType = {
+    Agent: "agent",
+};

package/dist/esm/api/resources/paymentRequests/types/NewPayReqRels.d.mts

@@ -4,4 +4,6 @@ export interface NewPayReqRels {
     requesterParty: Natural.NewPayReqRequesterRel;
     /** Resolved payer party, if the payer is known to Natural. */
     payerParty: Natural.NewPayReqPayerRel;
+    /** Payer agent, or null unless addressed by agent ID or agent handle. */
+    payerAgent: Natural.CreatePaymentRequestsResponseDataRelationshipsPayerAgent;
 }

package/dist/esm/api/resources/paymentRequests/types/index.d.mts

@@ -31,6 +31,9 @@ export * from "./CreatePaymentRequestsRequestPayerPartyId.mjs";
 export * from "./CreatePaymentRequestsRequestPayerPhone.mjs";
 export * from "./CreatePaymentRequestsResponseDataAttributesInitiatorAgent.mjs";
 export * from "./CreatePaymentRequestsResponseDataAttributesInitiatorParty.mjs";
+export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgent.mjs";
+export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.mjs";
+export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType.mjs";
 export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerPartyData.mjs";
 export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerPartyDataType.mjs";
 export * from "./DeclinedReq.mjs";

package/dist/esm/api/resources/paymentRequests/types/index.mjs

@@ -31,6 +31,9 @@ export * from "./CreatePaymentRequestsRequestPayerPartyId.mjs";
 export * from "./CreatePaymentRequestsRequestPayerPhone.mjs";
 export * from "./CreatePaymentRequestsResponseDataAttributesInitiatorAgent.mjs";
 export * from "./CreatePaymentRequestsResponseDataAttributesInitiatorParty.mjs";
+export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgent.mjs";
+export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.mjs";
+export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType.mjs";
 export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerPartyData.mjs";
 export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerPartyDataType.mjs";
 export * from "./DeclinedReq.mjs";

package/dist/esm/core/fetcher/Fetcher.mjs

@@ -18,6 +18,7 @@ import { getResponseBody } from "./getResponseBody.mjs";
 import { Headers } from "./Headers.mjs";
 import { makeRequest } from "./makeRequest.mjs";
 import { abortRawResponse, toRawResponse, unknownRawResponse } from "./RawResponse.mjs";
+import { redactUrl, SENSITIVE_QUERY_PARAMS } from "./redactUrl.mjs";
 import { requestWithRetries } from "./requestWithRetries.mjs";
 const SENSITIVE_HEADERS = new Set([
     "authorization",
@@ -49,26 +50,6 @@ function redactHeaders(headers) {
     }
     return filtered;
 }
-const SENSITIVE_QUERY_PARAMS = new Set([
-    "api_key",
-    "api-key",
-    "apikey",
-    "token",
-    "access_token",
-    "access-token",
-    "auth_token",
-    "auth-token",
-    "password",
-    "passwd",
-    "secret",
-    "api_secret",
-    "api-secret",
-    "apisecret",
-    "key",
-    "session",
-    "session_id",
-    "session-id",
-]);
 function redactQueryParameters(queryParameters) {
     if (queryParameters == null) {
         return undefined;
@@ -79,70 +60,6 @@ function redactQueryParameters(queryParameters) {
     }
     return redacted;
 }
-function redactUrl(url) {
-    const protocolIndex = url.indexOf("://");
-    if (protocolIndex === -1)
-        return url;
-    const afterProtocol = protocolIndex + 3;
-    // Find the first delimiter that marks the end of the authority section
-    const pathStart = url.indexOf("/", afterProtocol);
-    let queryStart = url.indexOf("?", afterProtocol);
-    let fragmentStart = url.indexOf("#", afterProtocol);
-    const firstDelimiter = Math.min(pathStart === -1 ? url.length : pathStart, queryStart === -1 ? url.length : queryStart, fragmentStart === -1 ? url.length : fragmentStart);
-    // Find the LAST @ before the delimiter (handles multiple @ in credentials)
-    let atIndex = -1;
-    for (let i = afterProtocol; i < firstDelimiter; i++) {
-        if (url[i] === "@") {
-            atIndex = i;
-        }
-    }
-    if (atIndex !== -1) {
-        url = `${url.slice(0, afterProtocol)}[REDACTED]@${url.slice(atIndex + 1)}`;
-    }
-    // Recalculate queryStart since url might have changed
-    queryStart = url.indexOf("?");
-    if (queryStart === -1)
-        return url;
-    fragmentStart = url.indexOf("#", queryStart);
-    const queryEnd = fragmentStart !== -1 ? fragmentStart : url.length;
-    const queryString = url.slice(queryStart + 1, queryEnd);
-    if (queryString.length === 0)
-        return url;
-    // FAST PATH: Quick check if any sensitive keywords present
-    // Using indexOf is faster than regex for simple substring matching
-    const lower = queryString.toLowerCase();
-    const hasSensitive = lower.includes("token") ||
-        lower.includes("key") ||
-        lower.includes("password") ||
-        lower.includes("passwd") ||
-        lower.includes("secret") ||
-        lower.includes("session") ||
-        lower.includes("auth");
-    if (!hasSensitive) {
-        return url;
-    }
-    // SLOW PATH: Parse and redact
-    const redactedParams = [];
-    const params = queryString.split("&");
-    for (const param of params) {
-        const equalIndex = param.indexOf("=");
-        if (equalIndex === -1) {
-            redactedParams.push(param);
-            continue;
-        }
-        const key = param.slice(0, equalIndex);
-        let shouldRedact = SENSITIVE_QUERY_PARAMS.has(key.toLowerCase());
-        if (!shouldRedact && key.includes("%")) {
-            try {
-                const decodedKey = decodeURIComponent(key);
-                shouldRedact = SENSITIVE_QUERY_PARAMS.has(decodedKey.toLowerCase());
-            }
-            catch (_a) { }
-        }
-        redactedParams.push(shouldRedact ? `${key}=[REDACTED]` : param);
-    }
-    return url.slice(0, queryStart + 1) + redactedParams.join("&") + url.slice(queryEnd);
-}
 function getHeaders(args) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;

package/dist/esm/core/fetcher/makePassthroughRequest.mjs

@@ -12,6 +12,7 @@ import { join } from "../url/join.mjs";
 import { EndpointSupplier } from "./EndpointSupplier.mjs";
 import { getFetchFn } from "./getFetchFn.mjs";
 import { makeRequest } from "./makeRequest.mjs";
+import { redactUrl } from "./redactUrl.mjs";
 import { requestWithRetries } from "./requestWithRetries.mjs";
 import { Supplier } from "./Supplier.mjs";
 /**
@@ -76,8 +77,10 @@ export function makePassthroughRequest(input, init, clientOptions, requestOption
                 }
             }
         }
-        // Apply auth headers
-        if (clientOptions.getAuthHeaders != null) {
+        // Apply auth headers, but only when the resolved URL targets the configured base URL.
+        // This prevents the SDK's credentials from leaking to an unrelated host when a caller
+        // passes an absolute cross-origin URL into the passthrough fetch escape hatch.
+        if (clientOptions.getAuthHeaders != null && targetsBaseUrl(fullUrl, baseUrl)) {
             const authHeaders = yield clientOptions.getAuthHeaders();
             for (const [key, value] of Object.entries(authHeaders)) {
                 mergedHeaders[key.toLowerCase()] = value;
@@ -112,7 +115,7 @@ export function makePassthroughRequest(input, init, clientOptions, requestOption
         if (logger.isDebug()) {
             logger.debug("Making passthrough HTTP request", {
                 method,
-                url: fullUrl,
+                url: redactUrl(fullUrl),
                 hasBody: body != null,
             });
         }
@@ -123,10 +126,29 @@ export function makePassthroughRequest(input, init, clientOptions, requestOption
         if (logger.isDebug()) {
             logger.debug("Passthrough HTTP request completed", {
                 method,
-                url: fullUrl,
+                url: redactUrl(fullUrl),
                 statusCode: response.status,
             });
         }
         return response;
     });
 }
+/**
+ * Returns true when the resolved request URL points at the same origin as the
+ * configured base URL. Relative paths are always joined onto the base URL, so
+ * they resolve to the base origin and return true. Absolute URLs only match when
+ * their origin equals the base origin. When there is no base URL to compare
+ * against, or either value is not a parseable absolute URL, this returns false so
+ * auth headers are not attached.
+ */
+function targetsBaseUrl(fullUrl, baseUrl) {
+    if (baseUrl == null) {
+        return false;
+    }
+    try {
+        return new URL(fullUrl).origin === new URL(baseUrl).origin;
+    }
+    catch (_a) {
+        return false;
+    }
+}

package/dist/esm/core/fetcher/redactUrl.d.mts

@@ -0,0 +1,2 @@
+export declare const SENSITIVE_QUERY_PARAMS: Set<string>;
+export declare function redactUrl(url: string): string;

package/dist/esm/core/fetcher/redactUrl.mjs

@@ -0,0 +1,84 @@
+export const SENSITIVE_QUERY_PARAMS = new Set([
+    "api_key",
+    "api-key",
+    "apikey",
+    "token",
+    "access_token",
+    "access-token",
+    "auth_token",
+    "auth-token",
+    "password",
+    "passwd",
+    "secret",
+    "api_secret",
+    "api-secret",
+    "apisecret",
+    "key",
+    "session",
+    "session_id",
+    "session-id",
+]);
+export function redactUrl(url) {
+    const protocolIndex = url.indexOf("://");
+    if (protocolIndex === -1)
+        return url;
+    const afterProtocol = protocolIndex + 3;
+    // Find the first delimiter that marks the end of the authority section
+    const pathStart = url.indexOf("/", afterProtocol);
+    let queryStart = url.indexOf("?", afterProtocol);
+    let fragmentStart = url.indexOf("#", afterProtocol);
+    const firstDelimiter = Math.min(pathStart === -1 ? url.length : pathStart, queryStart === -1 ? url.length : queryStart, fragmentStart === -1 ? url.length : fragmentStart);
+    // Find the LAST @ before the delimiter (handles multiple @ in credentials)
+    let atIndex = -1;
+    for (let i = afterProtocol; i < firstDelimiter; i++) {
+        if (url[i] === "@") {
+            atIndex = i;
+        }
+    }
+    if (atIndex !== -1) {
+        url = `${url.slice(0, afterProtocol)}[REDACTED]@${url.slice(atIndex + 1)}`;
+    }
+    // Recalculate queryStart since url might have changed
+    queryStart = url.indexOf("?");
+    if (queryStart === -1)
+        return url;
+    fragmentStart = url.indexOf("#", queryStart);
+    const queryEnd = fragmentStart !== -1 ? fragmentStart : url.length;
+    const queryString = url.slice(queryStart + 1, queryEnd);
+    if (queryString.length === 0)
+        return url;
+    // FAST PATH: Quick check if any sensitive keywords present
+    // Using indexOf is faster than regex for simple substring matching
+    const lower = queryString.toLowerCase();
+    const hasSensitive = lower.includes("token") ||
+        lower.includes("key") ||
+        lower.includes("password") ||
+        lower.includes("passwd") ||
+        lower.includes("secret") ||
+        lower.includes("session") ||
+        lower.includes("auth");
+    if (!hasSensitive) {
+        return url;
+    }
+    // SLOW PATH: Parse and redact
+    const redactedParams = [];
+    const params = queryString.split("&");
+    for (const param of params) {
+        const equalIndex = param.indexOf("=");
+        if (equalIndex === -1) {
+            redactedParams.push(param);
+            continue;
+        }
+        const key = param.slice(0, equalIndex);
+        let shouldRedact = SENSITIVE_QUERY_PARAMS.has(key.toLowerCase());
+        if (!shouldRedact && key.includes("%")) {
+            try {
+                const decodedKey = decodeURIComponent(key);
+                shouldRedact = SENSITIVE_QUERY_PARAMS.has(decodedKey.toLowerCase());
+            }
+            catch (_a) { }
+        }
+        redactedParams.push(shouldRedact ? `${key}=[REDACTED]` : param);
+    }
+    return url.slice(0, queryStart + 1) + redactedParams.join("&") + url.slice(queryEnd);
+}

package/dist/esm/serialization/resources/paymentRequests/types/CreatePaymentRequestsResponseDataRelationshipsPayerAgent.d.mts

@@ -0,0 +1,10 @@
+import type * as Natural from "../../../../api/index.mjs";
+import * as core from "../../../../core/index.mjs";
+import type * as serializers from "../../../index.mjs";
+import { CreatePaymentRequestsResponseDataRelationshipsPayerAgentData } from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.mjs";
+export declare const CreatePaymentRequestsResponseDataRelationshipsPayerAgent: core.serialization.ObjectSchema<serializers.CreatePaymentRequestsResponseDataRelationshipsPayerAgent.Raw, Natural.CreatePaymentRequestsResponseDataRelationshipsPayerAgent>;
+export declare namespace CreatePaymentRequestsResponseDataRelationshipsPayerAgent {
+    interface Raw {
+        data?: CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.Raw | null;
+    }
+}

package/dist/esm/serialization/resources/paymentRequests/types/CreatePaymentRequestsResponseDataRelationshipsPayerAgent.mjs

@@ -0,0 +1,6 @@
+// This file was auto-generated by Fern from our API Definition.
+import * as core from "../../../../core/index.mjs";
+import { CreatePaymentRequestsResponseDataRelationshipsPayerAgentData } from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.mjs";
+export const CreatePaymentRequestsResponseDataRelationshipsPayerAgent = core.serialization.object({
+    data: CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.nullable(),
+});

package/dist/esm/serialization/resources/paymentRequests/types/CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.d.mts

@@ -0,0 +1,11 @@
+import type * as Natural from "../../../../api/index.mjs";
+import * as core from "../../../../core/index.mjs";
+import type * as serializers from "../../../index.mjs";
+import { CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType } from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType.mjs";
+export declare const CreatePaymentRequestsResponseDataRelationshipsPayerAgentData: core.serialization.ObjectSchema<serializers.CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.Raw, Natural.CreatePaymentRequestsResponseDataRelationshipsPayerAgentData>;
+export declare namespace CreatePaymentRequestsResponseDataRelationshipsPayerAgentData {
+    interface Raw {
+        type: CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType.Raw;
+        id: string;
+    }
+}

package/dist/esm/serialization/resources/paymentRequests/types/CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.mjs

@@ -0,0 +1,7 @@
+// This file was auto-generated by Fern from our API Definition.
+import * as core from "../../../../core/index.mjs";
+import { CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType } from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType.mjs";
+export const CreatePaymentRequestsResponseDataRelationshipsPayerAgentData = core.serialization.object({
+    type: CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType,
+    id: core.serialization.string(),
+});

package/dist/esm/serialization/resources/paymentRequests/types/CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType.d.mts

@@ -0,0 +1,7 @@
+import type * as Natural from "../../../../api/index.mjs";
+import * as core from "../../../../core/index.mjs";
+import type * as serializers from "../../../index.mjs";
+export declare const CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType: core.serialization.Schema<serializers.CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType.Raw, Natural.CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType>;
+export declare namespace CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType {
+    type Raw = "agent";
+}

package/dist/esm/serialization/resources/paymentRequests/types/CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType.mjs

@@ -0,0 +1,3 @@
+// This file was auto-generated by Fern from our API Definition.
+import * as core from "../../../../core/index.mjs";
+export const CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType = core.serialization.enum_(["agent"]);

package/dist/esm/serialization/resources/paymentRequests/types/NewPayReqRels.d.mts

@@ -1,6 +1,7 @@
 import type * as Natural from "../../../../api/index.mjs";
 import * as core from "../../../../core/index.mjs";
 import type * as serializers from "../../../index.mjs";
+import { CreatePaymentRequestsResponseDataRelationshipsPayerAgent } from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgent.mjs";
 import { NewPayReqPayerRel } from "./NewPayReqPayerRel.mjs";
 import { NewPayReqRequesterRel } from "./NewPayReqRequesterRel.mjs";
 export declare const NewPayReqRels: core.serialization.ObjectSchema<serializers.NewPayReqRels.Raw, Natural.NewPayReqRels>;
@@ -8,5 +9,6 @@ export declare namespace NewPayReqRels {
     interface Raw {
         requesterParty: NewPayReqRequesterRel.Raw;
         payerParty: NewPayReqPayerRel.Raw;
+        payerAgent: CreatePaymentRequestsResponseDataRelationshipsPayerAgent.Raw;
     }
 }

package/dist/esm/serialization/resources/paymentRequests/types/NewPayReqRels.mjs

@@ -1,8 +1,10 @@
 // This file was auto-generated by Fern from our API Definition.
 import * as core from "../../../../core/index.mjs";
+import { CreatePaymentRequestsResponseDataRelationshipsPayerAgent } from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgent.mjs";
 import { NewPayReqPayerRel } from "./NewPayReqPayerRel.mjs";
 import { NewPayReqRequesterRel } from "./NewPayReqRequesterRel.mjs";
 export const NewPayReqRels = core.serialization.object({
     requesterParty: NewPayReqRequesterRel,
     payerParty: NewPayReqPayerRel,
+    payerAgent: CreatePaymentRequestsResponseDataRelationshipsPayerAgent,
 });

package/dist/esm/serialization/resources/paymentRequests/types/index.d.mts

@@ -31,6 +31,9 @@ export * from "./CreatePaymentRequestsRequestPayerPartyId.mjs";
 export * from "./CreatePaymentRequestsRequestPayerPhone.mjs";
 export * from "./CreatePaymentRequestsResponseDataAttributesInitiatorAgent.mjs";
 export * from "./CreatePaymentRequestsResponseDataAttributesInitiatorParty.mjs";
+export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgent.mjs";
+export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.mjs";
+export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType.mjs";
 export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerPartyData.mjs";
 export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerPartyDataType.mjs";
 export * from "./DeclinedReq.mjs";

package/dist/esm/serialization/resources/paymentRequests/types/index.mjs

@@ -31,6 +31,9 @@ export * from "./CreatePaymentRequestsRequestPayerPartyId.mjs";
 export * from "./CreatePaymentRequestsRequestPayerPhone.mjs";
 export * from "./CreatePaymentRequestsResponseDataAttributesInitiatorAgent.mjs";
 export * from "./CreatePaymentRequestsResponseDataAttributesInitiatorParty.mjs";
+export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgent.mjs";
+export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgentData.mjs";
+export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerAgentDataType.mjs";
 export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerPartyData.mjs";
 export * from "./CreatePaymentRequestsResponseDataRelationshipsPayerPartyDataType.mjs";
 export * from "./DeclinedReq.mjs";

package/dist/esm/version.d.mts

@@ -1 +1 @@
-export declare const SDK_VERSION = "1.6.4";
+export declare const SDK_VERSION = "1.6.6";

package/dist/esm/version.mjs

@@ -1 +1 @@
-export const SDK_VERSION = "1.6.4";
+export const SDK_VERSION = "1.6.6";

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@naturalpay/sdk",
-    "version": "1.6.4",
+    "version": "1.6.6",
     "private": false,
     "repository": {
         "type": "git",