@v3finance/core-sdk 0.2.3 → 0.2.4

package/CHANGELOG.md

@@ -3,6 +3,24 @@
 All notable changes to this package are documented in this file. The format is based on
 [Keep a Changelog](https://keepachangelog.com), and this project adheres to [Semantic Versioning](https://semver.org).
 
+## 0.2.4 — 2026-11-12
+
+Spec snapshot refreshed from the live API (commit `5e8f3e3`,
+[v3-finance/policy-engine#24](https://github.com/v3-finance/policy-engine/pull/24)). No operation
+was added or removed, no type changed, and no code in this package changed: the API now refuses a
+counterparty address that belongs to the vault itself.
+
+### Fixed
+
+- `counterparties.create()` and `counterparties.addAddress()` — an address that is one of this
+  vault's own addresses on the same network is refused with 409 `ADDRESS_IS_VAULT_ADDRESS`, and
+  `details` is `{address, network}`. Nothing is created or added. It used to be accepted, and the
+  retro-match then tagged internal transfers on that address as operations with the counterparty —
+  irreversibly, since removing the address does not untag them. Inside a chain or in the apply of
+  an approved request the code stays the chain's (`CHAIN_FAILED_ROLLED_BACK`, or `APPLY_FAILED` in
+  `applyError`), with the same sentence in `message`.
+- `docs/errors.md`: the code in the counterparty table, and where it arrives under another code.
+
 ## 0.2.3 — 2026-11-12
 
 Spec snapshot refreshed from the live API (commit `031d7bf`,

package/dist/cjs/generated/operations.js

@@ -10,7 +10,7 @@
 // the API does not slip in unclassified.
 //
 // Operations: 171 · admin: 40 · both: 1 · member: 127 · service: 3
-// Spec sha256: 1f0f2a38668572c443a84cb0207d4070b419a16c293b8e975f5e21c68e85b15a
+// Spec sha256: 1f2a93f5a31a423e3301b4bfa103ad3db26723285cae060d2e8a904a2b3bffe0
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OPERATIONS = void 0;
 exports.isAdminOperation = isAdminOperation;

package/dist/cjs/version.d.ts

@@ -1,5 +1,5 @@
 /** SDK version, sent in the `user-agent` header. */
-export declare const SDK_VERSION = "0.2.3";
+export declare const SDK_VERSION = "0.2.4";
 /** Default API base URL. */
 export declare const DEFAULT_BASE_URL = "https://policy-engine-rest.ezig.workers.dev";
 //# sourceMappingURL=version.d.ts.map

package/dist/cjs/version.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_BASE_URL = exports.SDK_VERSION = void 0;
 /** SDK version, sent in the `user-agent` header. */
-exports.SDK_VERSION = '0.2.3';
+exports.SDK_VERSION = '0.2.4';
 /** Default API base URL. */
 exports.DEFAULT_BASE_URL = 'https://policy-engine-rest.ezig.workers.dev';
 //# sourceMappingURL=version.js.map

package/dist/esm/generated/operations.js

@@ -9,7 +9,7 @@
 // the API does not slip in unclassified.
 //
 // Operations: 171 · admin: 40 · both: 1 · member: 127 · service: 3
-// Spec sha256: 1f0f2a38668572c443a84cb0207d4070b419a16c293b8e975f5e21c68e85b15a
+// Spec sha256: 1f2a93f5a31a423e3301b4bfa103ad3db26723285cae060d2e8a904a2b3bffe0
 export const OPERATIONS = {
     "DELETE /api/v1/me/push-tokens/{token}": {
         "method": "delete",

package/dist/esm/version.d.ts

@@ -1,5 +1,5 @@
 /** SDK version, sent in the `user-agent` header. */
-export declare const SDK_VERSION = "0.2.3";
+export declare const SDK_VERSION = "0.2.4";
 /** Default API base URL. */
 export declare const DEFAULT_BASE_URL = "https://policy-engine-rest.ezig.workers.dev";
 //# sourceMappingURL=version.d.ts.map

package/dist/esm/version.js

@@ -1,5 +1,5 @@
 /** SDK version, sent in the `user-agent` header. */
-export const SDK_VERSION = '0.2.3';
+export const SDK_VERSION = '0.2.4';
 /** Default API base URL. */
 export const DEFAULT_BASE_URL = 'https://policy-engine-rest.ezig.workers.dev';
 //# sourceMappingURL=version.js.map

package/docs/errors.md

@@ -329,18 +329,21 @@ Category keys and field keys and types are **immutable** after creation, and any
 
 ## Counterparties
 
-Note the statuses: conflicts in this domain answer **400**, not 409.
+Note the statuses: conflicts in this domain answer **400**, not 409 — all but `ADDRESS_IS_VAULT_ADDRESS`, which is a 409.
 
 | Code | Status | When | What to do |
 |---|---|---|---|
 | `NAME_TAKEN` | 400 | A counterparty with that name already exists in the vault. | Ask for a different name. |
 | `ADDRESS_TAKEN` | 400 | One of the addresses already belongs to another counterparty here. `message` names it when it can be resolved. | Show which address collides; the user must remove it from the other counterparty first. |
+| `ADDRESS_IS_VAULT_ADDRESS` | 409 | An address is one of this vault's own addresses on the same network — from `counterparties.create()` with `addresses`, or `counterparties.addAddress()`. It used to be accepted, and then the retro-match tagged past transfers and deposits on that address with the counterparty, matching tagged new ones, and removing the address does not untag them: internal transfers became operations with a counterparty in reports. Checked before anything is written — nothing was created or added. `details` is `{address, network}`: the first such address, trimmed, with the network lowercased. An EVM-shaped address matches regardless of letter case; an address of another vault is accepted. | Terminal, not a retry. Mark the address field from `details` and say it belongs to the vault itself. |
 | `NETWORK_NOT_REGISTERED` | 400 | An address names a network missing from the registry. `message` lists them. | Terminal for a non-admin: an administrator must register the network. |
 | `VALIDATION` | 400 | A required field (`name`, `address`, `code`) is empty after trimming. | Normal form validation. |
 | `CODE_TAKEN` | 400 | A counterparty **group** with that code already exists in the vault. | Ask for a different code. |
 | `ALREADY_MEMBER` | 400 | The counterparty is already in the group. | Benign. Treat as success and refresh. |
 | `NOT_FOUND` | 404 | The counterparty or group does not exist in this vault. | Refresh. (Arrives as a status-derived `NOT_FOUND` — see [Declared but never returned](#declared-but-never-returned).) |
 
+`ADDRESS_IS_VAULT_ADDRESS` arrives under its own code only from those two calls answered directly. When the same check fails inside a chain or in the apply of an approved request, the code is the chain's or the apply's, and the sentence travels in `message`, without `details.address` / `details.network`: a chain that needed no signatures — `counterparties.create()` with `groupId` or `newGroup`, or `approvals.createComposite()` — throws 400 `CHAIN_FAILED_ROLLED_BACK` (`CHAIN_FAILED_PARTIAL` if an earlier step could not be rolled back) with `Step N failed: …` and `details.stepIndex`; an approved request answers the vote with 200 and `applyError.code` `APPLY_FAILED` (a single request, the bare sentence) or `APPLY_FAILED_ROLLED_BACK` / `APPLY_FAILED_PARTIAL` (a composite one, with the `Step N failed:` prefix). The check comes first in the step as well: a `counterparty_update` that also renames the counterparty leaves the name untouched.
+
 Changing a group's membership is scoped to its own vault, and that is checked at the write, including when it arrives via an approved request. A cross-vault attempt fails as a plain 404, not with a distinct code.
 
 Group membership also gates destination whitelists: archiving a counterparty group revokes the whitelist it backs, because membership resolves over non-archived groups only. There is no error for this — transfers simply start being denied with `POLICY_DENIED`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@v3finance/core-sdk",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "The official TypeScript SDK for the V3 Finance Core API — custodial addresses, transfers under policy control, approvals, shared access, labelling and reports",
   "license": "MIT",
   "repository": {

package/src/generated/operations.ts

@@ -9,7 +9,7 @@
 // the API does not slip in unclassified.
 //
 // Operations: 171 · admin: 40 · both: 1 · member: 127 · service: 3
-// Spec sha256: 1f0f2a38668572c443a84cb0207d4070b419a16c293b8e975f5e21c68e85b15a
+// Spec sha256: 1f2a93f5a31a423e3301b4bfa103ad3db26723285cae060d2e8a904a2b3bffe0
 
 export type Audience = 'member' | 'admin' | 'service' | 'both' | 'unknown'
 

package/src/version.ts

@@ -1,5 +1,5 @@
 /** SDK version, sent in the `user-agent` header. */
-export const SDK_VERSION = '0.2.3'
+export const SDK_VERSION = '0.2.4'
 
 /** Default API base URL. */
 export const DEFAULT_BASE_URL = 'https://policy-engine-rest.ezig.workers.dev'