squarefi-bff-api-module 1.36.46 → 1.36.48

package/dist/api/frontend.d.ts

@@ -13,6 +13,29 @@ export declare const frontend: {
             list: ({ status, ...params }?: API.Frontend.Issuing.Cards.List.Request) => Promise<API.Frontend.Issuing.Cards.List.Response>;
             deposit: ({ card_id, ...data }: API.Frontend.Issuing.Cards.Deposit.Request) => Promise<API.Frontend.Issuing.Cards.Deposit.Response>;
             withdraw: ({ card_id, ...data }: API.Frontend.Issuing.Cards.Withdraw.Request) => Promise<API.Frontend.Issuing.Cards.Withdraw.Response>;
+            getById: ({ card_id, }: API.Frontend.Issuing.Cards.Get.Request) => Promise<API.Frontend.Issuing.Cards.Get.Response>;
+            /** Rename (and other editable card fields). */
+            update: ({ card_id, ...data }: API.Frontend.Issuing.Cards.Update.Request) => Promise<API.Frontend.Issuing.Cards.Update.Response>;
+            /** Terminal, unlike freeze — a closed card cannot be reopened. */
+            close: ({ card_id, }: API.Frontend.Issuing.Cards.Close.Request) => Promise<API.Frontend.Issuing.Cards.Close.Response>;
+            freeze: ({ card_id, }: API.Frontend.Issuing.Cards.Freeze.Request) => Promise<API.Frontend.Issuing.Cards.Freeze.Response>;
+            unfreeze: ({ card_id, }: API.Frontend.Issuing.Cards.Unfreeze.Request) => Promise<API.Frontend.Issuing.Cards.Unfreeze.Response>;
+            limits: {
+                update: ({ card_id, ...data }: API.Frontend.Issuing.Cards.Limits.Request) => Promise<API.Frontend.Issuing.Cards.Limits.Response>;
+            };
+            /**
+             * PLAINTEXT PAN/CVV — server-to-server only. In a browser or mobile client use
+             * `sensitiveEncrypted` instead, so the card number never travels readable.
+             */
+            sensitive: ({ card_id, }: API.Frontend.Issuing.Cards.Sensitive.Request) => Promise<API.Frontend.Issuing.Cards.Sensitive.Response>;
+            /**
+             * PAN/CVV over the encrypted channel: generates an AES-256 key, sends it encrypted to
+             * the server's RSA public key (`SERVER_PUBLIC_KEY_BASE64`) and decrypts the answer —
+             * the same exchange as the legacy `issuing.cards.sensitiveData.encrypted.secretKey`,
+             * against the frontend route.
+             */
+            sensitiveEncrypted: ({ card_id, }: API.Frontend.Issuing.Cards.SensitiveEncrypted.Request) => Promise<API.Frontend.Issuing.Cards.SensitiveEncrypted.Response>;
+            transactions: ({ card_id, ...params }: API.Frontend.Issuing.Cards.Transactions.Request) => Promise<API.Frontend.Issuing.Cards.Transactions.Response>;
             create: (data: API.Frontend.Issuing.Cards.Create.Request) => Promise<API.Frontend.Issuing.Cards.Create.Response>;
         };
         cardholders: {
@@ -32,6 +55,8 @@ export declare const frontend: {
         subAccounts: {
             getAll: (params?: API.Frontend.Issuing.SubAccounts.List.Request) => Promise<API.Frontend.Issuing.SubAccounts.List.Response>;
             getById: ({ sub_account_id, }: API.Frontend.Issuing.SubAccounts.Get.Request) => Promise<API.Frontend.Issuing.SubAccounts.Get.Response>;
+            create: (data: API.Frontend.Issuing.SubAccounts.Create.Request) => Promise<API.Frontend.Issuing.SubAccounts.Create.Response>;
+            transactions: ({ sub_account_id, ...params }: API.Frontend.Issuing.SubAccounts.Transactions.Request) => Promise<API.Frontend.Issuing.SubAccounts.Transactions.Response>;
             deposit: ({ sub_account_id, ...data }: API.Frontend.Issuing.SubAccounts.Deposit.Request) => Promise<API.Frontend.Issuing.SubAccounts.Deposit.Response>;
             withdraw: ({ sub_account_id, ...data }: API.Frontend.Issuing.SubAccounts.Withdraw.Request) => Promise<API.Frontend.Issuing.SubAccounts.Withdraw.Response>;
         };

package/dist/api/frontend.js

@@ -1,4 +1,5 @@
 import { apiClientV1, apiClientV1Frontend } from '../utils/apiClientFactory';
+import { makeSecureRequest } from '../utils/encrypt';
 export const frontend = {
     access: {
         keys: {
@@ -29,6 +30,38 @@ export const frontend = {
             // first through `cardholders.*` — an unlinked user gets `400 CARDHOLDER_NOT_LINKED`).
             // Issuing fee / initial top-up follow the group tariff; pass `currency_id` (and optionally
             // `initial_topup`) whenever the tariff carries money.
+            getById: ({ card_id, }) => apiClientV1Frontend.getRequest(`/frontend/issuing/cards/${card_id}`),
+            /** Rename (and other editable card fields). */
+            update: ({ card_id, ...data }) => apiClientV1Frontend.patchRequest(`/frontend/issuing/cards/${card_id}`, { data }),
+            /** Terminal, unlike freeze — a closed card cannot be reopened. */
+            close: ({ card_id, }) => apiClientV1Frontend.deleteRequest(`/frontend/issuing/cards/${card_id}`),
+            freeze: ({ card_id, }) => apiClientV1Frontend.putRequest(`/frontend/issuing/cards/${card_id}/freeze`),
+            unfreeze: ({ card_id, }) => apiClientV1Frontend.putRequest(`/frontend/issuing/cards/${card_id}/unfreeze`),
+            limits: {
+                update: ({ card_id, ...data }) => apiClientV1Frontend.putRequest(`/frontend/issuing/cards/${card_id}/limits`, { data }),
+            },
+            /**
+             * PLAINTEXT PAN/CVV — server-to-server only. In a browser or mobile client use
+             * `sensitiveEncrypted` instead, so the card number never travels readable.
+             */
+            sensitive: ({ card_id, }) => apiClientV1Frontend.getRequest(`/frontend/issuing/cards/${card_id}/sensitive`),
+            /**
+             * PAN/CVV over the encrypted channel: generates an AES-256 key, sends it encrypted to
+             * the server's RSA public key (`SERVER_PUBLIC_KEY_BASE64`) and decrypts the answer —
+             * the same exchange as the legacy `issuing.cards.sensitiveData.encrypted.secretKey`,
+             * against the frontend route.
+             */
+            sensitiveEncrypted: async ({ card_id, }) => {
+                const serverPublicKey = process.env.SERVER_PUBLIC_KEY_BASE64;
+                if (!serverPublicKey) {
+                    throw new Error('SERVER_PUBLIC_KEY_BASE64 is not set');
+                }
+                return makeSecureRequest({
+                    callback: (props) => apiClientV1Frontend.postRequest(`/frontend/issuing/cards/${card_id}/sensitive/secretkey`, { data: props }),
+                    publicKey: serverPublicKey,
+                });
+            },
+            transactions: ({ card_id, ...params }) => apiClientV1Frontend.getRequest(`/frontend/issuing/cards/${card_id}/transactions`, { params }),
             create: (data) => apiClientV1Frontend.postRequest('/frontend/issuing/cards', {
                 data,
             }),
@@ -85,6 +118,8 @@ export const frontend = {
             // sub-accounts — prefer that over `getById`, whose shape varies with the vendor.
             getAll: (params = {}) => apiClientV1Frontend.getRequest('/frontend/issuing/sub-accounts', { params }),
             getById: ({ sub_account_id, }) => apiClientV1Frontend.getRequest(`/frontend/issuing/sub-accounts/${sub_account_id}`),
+            create: (data) => apiClientV1Frontend.postRequest('/frontend/issuing/sub-accounts', { data }),
+            transactions: ({ sub_account_id, ...params }) => apiClientV1Frontend.getRequest(`/frontend/issuing/sub-accounts/${sub_account_id}/transactions`, { params }),
             deposit: ({ sub_account_id, ...data }) => apiClientV1Frontend.postRequest(`/frontend/issuing/sub-accounts/${sub_account_id}/deposit`, { data }),
             // Concurrent withdrawals on the same sub-account are rejected with `409`. The currency is
             // taken from the sub-account, so only the amount is needed.

package/dist/api/types/autogen/apiV1Frontend.types.d.ts

@@ -2058,6 +2058,8 @@ export interface paths {
                     wallet_id?: string;
                     /** @description Filter cards by program ID */
                     program_id?: string;
+                    /** @description Only cards drawing from this sub-account. */
+                    sub_account_id?: string;
                     /** @description Filter cards by program sub-account type (prepaid or balance) */
                     sub_account_type?: "prepaid" | "balance";
                     /** @description Filter cards by status (matches issuing_cards.card_status).
@@ -2595,6 +2597,89 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/frontend/issuing/cards/{card_id}/sensitive/secretkey": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Get card sensitive data over an encrypted channel
+         * @description PAN / CVV without ever putting them in a readable response body — prefer this
+         *     over `GET /sensitive` in any browser or mobile client.
+         *
+         *     The client generates a 32-byte AES-256 key, encrypts it to the server's RSA
+         *     public key (`RSA-OAEP`; `PKCS1` is accepted for older clients) and sends it
+         *     base64-encoded as `encrypted_key`. The response carries the card data
+         *     AES-256-CBC encrypted with that same key, plus the `iv` used.
+         *
+         *     Decrypting `data` with the key and IV yields
+         *     `{ success, data: { card_number, cvv, expiry_month, expiry_year, security_code }, timestamp }`.
+         *
+         *     **Access**: ADMIN on the card's wallet, or the scoped `user` role on their OWN card.
+         *
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path: {
+                    card_id: string;
+                };
+                cookie?: never;
+            };
+            requestBody: {
+                content: {
+                    "application/json": {
+                        /** @description Base64 of the AES-256 key encrypted to the server's RSA public key. */
+                        encrypted_key: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Encrypted sensitive data */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @example true */
+                            success: boolean;
+                            /** @example true */
+                            encrypted: boolean;
+                            /** @description Base64 AES-256-CBC ciphertext of the sensitive-data envelope. */
+                            data: string;
+                            /** @description Base64 IV used for the AES encryption. */
+                            iv: string;
+                        };
+                    };
+                };
+                /** @description Missing or undecryptable `encrypted_key`, or a key that is not 32 bytes */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+                /** @description Server key not configured, or encryption failed */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/frontend/issuing/cards/{card_id}/freeze": {
         parameters: {
             query?: never;
@@ -12257,11 +12342,12 @@ export interface components {
                 [key: string]: unknown;
             } | null;
         };
-        /** @description Sub-account funding a card — the subset of `fiat_accounts` columns joined onto each card. */
+        /** @description Sub-account funding a card — the `fiat_accounts` row joined onto each card, with the same `currency` / `issuing_program` / `account_details` enrichment `GET /sub-accounts` applies, so a card page can drive top-up and render balances without a second request. */
         IssuingCardSubAccount: {
             /** Format: uuid */
             id: string;
             nick_name?: string | null;
+            /** @description Live balance from the issuing ledger (falls back to the cached column). */
             balance?: number | null;
             /** @enum {string} */
             type: "balance" | "prepaid";
@@ -12275,6 +12361,11 @@ export interface components {
              * @description crypto.uuid of the account currency
              */
             account_currency: string;
+            currency?: components["schemas"]["CurrencyRef"];
+            /** @description Program embed (carries `order_types`, which the top-up flow reads); null when program_id is null. */
+            issuing_program?: components["schemas"]["IssuingProgram"] | null;
+            /** @description Bank details from the vendor meta; empty string `""` when none are available. */
+            account_details?: components["schemas"]["BankAccountDetails"] | "";
             /** Format: uuid */
             program_id?: string | null;
             /** Format: uuid */

package/dist/api/types/types.d.ts

@@ -672,6 +672,13 @@ export declare namespace API {
         }
         namespace Issuing {
             type CardsRoot = pathsV1Frontend['/frontend/issuing/cards'];
+            type CardRoot = pathsV1Frontend['/frontend/issuing/cards/{card_id}'];
+            type CardFreezeRoot = pathsV1Frontend['/frontend/issuing/cards/{card_id}/freeze'];
+            type CardUnfreezeRoot = pathsV1Frontend['/frontend/issuing/cards/{card_id}/unfreeze'];
+            type CardLimitsRoot = pathsV1Frontend['/frontend/issuing/cards/{card_id}/limits'];
+            type CardSensitiveRoot = pathsV1Frontend['/frontend/issuing/cards/{card_id}/sensitive'];
+            type CardTransactionsRoot = pathsV1Frontend['/frontend/issuing/cards/{card_id}/transactions'];
+            type SubAccountTransactionsRoot = pathsV1Frontend['/frontend/issuing/sub-accounts/{sub_account_id}/transactions'];
             type CardDepositRoot = pathsV1Frontend['/frontend/issuing/cards/{card_id}/deposit'];
             type CardWithdrawRoot = pathsV1Frontend['/frontend/issuing/cards/{card_id}/withdraw'];
             type SubAccountDepositRoot = pathsV1Frontend['/frontend/issuing/sub-accounts/{sub_account_id}/deposit'];
@@ -711,6 +718,17 @@ export declare namespace API {
                     };
                     type Response = SubAccountRoot['get']['responses']['200']['content']['application/json'];
                 }
+                export namespace Create {
+                    type Request = SubAccountsRoot['post']['requestBody']['content']['application/json'];
+                    type Response = SubAccountsRoot['post']['responses']['201']['content']['application/json'];
+                }
+                export namespace Transactions {
+                    type Request = {
+                        sub_account_id: string;
+                    } & NonNullable<SubAccountTransactionsRoot['get']['parameters']['query']>;
+                    type Response = SubAccountTransactionsRoot['get']['responses']['200']['content']['application/json'];
+                    type Transaction = NonNullable<Response['data']>[number];
+                }
                 export namespace Deposit {
                     type Request = {
                         sub_account_id: string;
@@ -731,6 +749,74 @@ export declare namespace API {
                     type Response = CardsRoot['get']['responses']['200']['content']['application/json'];
                     type Card = NonNullable<Response['data']>[number];
                 }
+                namespace Get {
+                    type Request = {
+                        card_id: string;
+                    };
+                    type Response = CardRoot['get']['responses']['200']['content']['application/json'];
+                    type Card = NonNullable<Response['data']>;
+                }
+                /** Rename (and other editable card fields). */
+                namespace Update {
+                    type Request = {
+                        card_id: string;
+                    } & CardRoot['patch']['requestBody']['content']['application/json'];
+                    type Response = CardRoot['patch']['responses']['200']['content']['application/json'];
+                }
+                /** Close the card — terminal, unlike freeze. */
+                namespace Close {
+                    type Request = {
+                        card_id: string;
+                    };
+                    type Response = CardRoot['delete']['responses']['200']['content']['application/json'];
+                }
+                namespace Freeze {
+                    type Request = {
+                        card_id: string;
+                    };
+                    type Response = CardFreezeRoot['put']['responses']['200']['content']['application/json'];
+                }
+                namespace Unfreeze {
+                    type Request = {
+                        card_id: string;
+                    };
+                    type Response = CardUnfreezeRoot['put']['responses']['200']['content']['application/json'];
+                }
+                namespace Limits {
+                    type Request = {
+                        card_id: string;
+                    } & CardLimitsRoot['put']['requestBody']['content']['application/json'];
+                    type Response = CardLimitsRoot['put']['responses']['200']['content']['application/json'];
+                }
+                /**
+                 * Card PAN/CVV in PLAINTEXT. Server-to-server only — a browser or mobile client
+                 * should use `SensitiveEncrypted`, which never puts the PAN in a readable body.
+                 */
+                namespace Sensitive {
+                    type Request = {
+                        card_id: string;
+                    };
+                    type Response = CardSensitiveRoot['get']['responses']['200']['content']['application/json'];
+                }
+                /**
+                 * Card PAN/CVV over an end-to-end encrypted channel: the client's AES-256 key is
+                 * sent encrypted to the server's RSA public key, and the answer comes back
+                 * encrypted with that same key. The SDK does the key exchange and the decryption,
+                 * so the caller just receives the decrypted payload.
+                 */
+                namespace SensitiveEncrypted {
+                    type Request = {
+                        card_id: string;
+                    };
+                    type Response = API.Cards.SensitiveData;
+                }
+                namespace Transactions {
+                    type Request = {
+                        card_id: string;
+                    } & NonNullable<CardTransactionsRoot['get']['parameters']['query']>;
+                    type Response = CardTransactionsRoot['get']['responses']['200']['content']['application/json'];
+                    type Transaction = NonNullable<Response['data']>[number];
+                }
                 namespace Create {
                     type Request = Omit<CardsRoot['post']['requestBody']['content']['application/json'], 'cardholder_id'> & {
                         cardholder_id?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "squarefi-bff-api-module",
-  "version": "1.36.46",
+  "version": "1.36.48",
   "description": "Squarefi BFF API client module",
   "type": "module",
   "main": "./dist/index.js",