vanta-auditor-api-sdk 0.4.1 → 0.5.0

package/src/lib/files.ts

@@ -80,3 +80,25 @@ export function getContentTypeFromFileName(fileName: string): string | null {
 
   return mimeTypes[ext] || null;
 }
+
+/**
+ * Creates a Blob from file content with the given MIME type.
+ *
+ * Node.js Buffers are Uint8Array subclasses that may share a pooled
+ * ArrayBuffer (byteOffset > 0, byteLength < buffer.byteLength). Passing
+ * such a Buffer directly to `new Blob([buf])` can include the entire
+ * underlying pool on some runtimes, producing a Blob with extra bytes
+ * that corrupts multipart uploads.
+ *
+ * Copying into a standalone Uint8Array ensures the Blob receives only the
+ * intended bytes regardless of runtime behaviour.
+ */
+export function bytesToBlob(
+  content: Uint8Array<ArrayBufferLike> | ArrayBuffer | Blob | string,
+  contentType: string,
+): Blob {
+  if (content instanceof Uint8Array) {
+    return new Blob([new Uint8Array(content)], { type: contentType });
+  }
+  return new Blob([content as BlobPart], { type: contentType });
+}

package/src/lib/matchers.ts

@@ -248,8 +248,9 @@ export function match<T, E>(
         raw = body;
         break;
       default:
-        encoding satisfies never;
-        throw new Error(`Unsupported response type: ${encoding}`);
+        throw new Error(
+          `Unsupported response type: ${encoding satisfies never}`,
+        );
     }
 
     if (matcher.enc === "fail") {

package/src/lib/sdks.ts

@@ -22,7 +22,6 @@ import {
   isConnectionError,
   isTimeoutError,
   matchContentType,
-  matchStatusCode,
 } from "./http.js";
 import { Logger } from "./logger.js";
 import { retry, RetryConfig } from "./retries.js";
@@ -128,13 +127,15 @@ export class ClientSDK {
     if (!base) {
       return ERR(new InvalidRequestError("No base URL provided for operation"));
     }
-    const reqURL = new URL(base);
-    const inputURL = new URL(path, reqURL);
-
+    const baseURL = new URL(base);
+    let reqURL: URL;
     if (path) {
-      reqURL.pathname += reqURL.pathname.endsWith("/") ? "" : "/";
-      reqURL.pathname += inputURL.pathname.replace(/^\/+/, "");
+      baseURL.pathname = baseURL.pathname.replace(/\/+$/, "") + "/";
+      reqURL = new URL(path, baseURL);
+    } else {
+      reqURL = baseURL;
     }
+    reqURL.hash = "";
 
     let finalQuery = query || "";
 
@@ -232,7 +233,7 @@ export class ClientSDK {
     request: Request,
     options: {
       context: HookContext;
-      errorCodes: number | string | (number | string)[];
+      isErrorStatusCode: (statusCode: number) => boolean;
       retryConfig: RetryConfig;
       retryCodes: string[];
     },
@@ -245,7 +246,7 @@ export class ClientSDK {
       | UnexpectedClientError
     >
   > {
-    const { context, errorCodes } = options;
+    const { context, isErrorStatusCode } = options;
 
     return retry(
       async () => {
@@ -257,7 +258,7 @@ export class ClientSDK {
         let response = await this.#httpClient.request(req);
 
         try {
-          if (matchStatusCode(response, errorCodes)) {
+          if (isErrorStatusCode(response.status)) {
             const result = await this.#hooks.afterError(
               context,
               response,
@@ -308,9 +309,9 @@ export class ClientSDK {
   }
 }
 
-const jsonLikeContentTypeRE = /(application|text)\/.*?\+*json.*/;
+const jsonLikeContentTypeRE = /^(application|text)\/([^+]+\+)*json.*/;
 const jsonlLikeContentTypeRE =
-  /(application|text)\/(.*?\+*\bjsonl\b.*|.*?\+*\bx-ndjson\b.*)/;
+  /^(application|text)\/([^+]+\+)*(jsonl|x-ndjson)\b.*/;
 async function logRequest(logger: Logger | undefined, req: Request) {
   if (!logger) {
     return;
@@ -381,8 +382,6 @@ async function logResponse(
       break;
     case matchContentType(res, "application/jsonl")
       || jsonlLikeContentTypeRE.test(ct):
-      logger.log(await res.clone().text());
-      break;
     case matchContentType(res, "text/event-stream"):
       logger.log(`<${contentType}>`);
       break;

package/src/lib/security.ts

@@ -198,8 +198,7 @@ export function resolveSecurity(
         applyBearer(state, spec);
         break;
       default:
-        spec satisfies never;
-        throw SecurityError.unrecognizedType(type);
+        throw SecurityError.unrecognizedType((spec satisfies never, type));
     }
   });
 
@@ -241,8 +240,9 @@ function applyBearer(
 
 export function resolveGlobalSecurity(
   security: Partial<components.Security> | null | undefined,
+  allowedFields?: number[],
 ): SecurityState | null {
-  return resolveSecurity(
+  let inputs: SecurityInput[][] = [
     [
       {
         fieldName: "Authorization",
@@ -250,7 +250,18 @@ export function resolveGlobalSecurity(
         value: security?.bearerAuth ?? env().VANTA_BEARER_AUTH,
       },
     ],
-  );
+  ];
+
+  if (allowedFields) {
+    inputs = allowedFields.map((i) => {
+      if (i < 0 || i >= inputs.length) {
+        throw new RangeError(`invalid allowedFields index ${i}`);
+      }
+      return inputs[i]!;
+    });
+  }
+
+  return resolveSecurity(...inputs);
 }
 
 export async function extractSecurity<

package/src/lib/url.ts

@@ -13,21 +13,23 @@ export function pathToFunc(
   const paramRE = /\{([a-zA-Z0-9_][a-zA-Z0-9_-]*?)\}/g;
 
   return function buildURLPath(params: Record<string, unknown> = {}): string {
-    return pathPattern.replace(paramRE, function (_, placeholder) {
-      if (!hasOwn.call(params, placeholder)) {
-        throw new Error(`Parameter '${placeholder}' is required`);
-      }
+    return pathPattern
+      .replace(paramRE, function (_, placeholder) {
+        if (!hasOwn.call(params, placeholder)) {
+          throw new Error(`Parameter '${placeholder}' is required`);
+        }
 
-      const value = params[placeholder];
-      if (typeof value !== "string" && typeof value !== "number") {
-        throw new Error(
-          `Parameter '${placeholder}' must be a string or number`,
-        );
-      }
+        const value = params[placeholder];
+        if (typeof value !== "string" && typeof value !== "number") {
+          throw new Error(
+            `Parameter '${placeholder}' must be a string or number`,
+          );
+        }
 
-      return options?.charEncoding === "percent"
-        ? encodeURIComponent(`${value}`)
-        : `${value}`;
-    });
+        return options?.charEncoding === "percent"
+          ? encodeURIComponent(`${value}`)
+          : `${value}`;
+      })
+      .replace(/^\/+/, "");
   };
 }

package/src/models/components/acceptinformationrequestevidenceinput.ts

@@ -0,0 +1,46 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+
+/**
+ * Input for accepting evidence on an information request, indicating that
+ *
+ * @remarks
+ * the submitted evidence meets requirements. This changes the request's
+ * approvalStatus to an approved state and creates an activity log entry.
+ */
+export type AcceptInformationRequestEvidenceInput = {
+  /**
+   * Email of the auditor accepting the evidence.
+   *
+   * @remarks
+   * Must match an existing Vanta user who belongs to the audit firm making the API request.
+   */
+  auditorEmail: string;
+};
+
+/** @internal */
+export type AcceptInformationRequestEvidenceInput$Outbound = {
+  auditorEmail: string;
+};
+
+/** @internal */
+export const AcceptInformationRequestEvidenceInput$outboundSchema: z.ZodType<
+  AcceptInformationRequestEvidenceInput$Outbound,
+  z.ZodTypeDef,
+  AcceptInformationRequestEvidenceInput
+> = z.object({
+  auditorEmail: z.string(),
+});
+
+export function acceptInformationRequestEvidenceInputToJSON(
+  acceptInformationRequestEvidenceInput: AcceptInformationRequestEvidenceInput,
+): string {
+  return JSON.stringify(
+    AcceptInformationRequestEvidenceInput$outboundSchema.parse(
+      acceptInformationRequestEvidenceInput,
+    ),
+  );
+}

package/src/models/components/addauditorinput.ts

@@ -3,9 +3,6 @@
  */
 
 import * as z from "zod/v3";
-import { safeParse } from "../../lib/schemas.js";
-import { Result as SafeParseResult } from "../../types/fp.js";
-import { SDKValidationError } from "../errors/sdkvalidationerror.js";
 
 export type AddAuditorInput = {
   /**
@@ -22,16 +19,6 @@ export type AddAuditorInput = {
   familyName: string;
 };
 
-/** @internal */
-export const AddAuditorInput$inboundSchema: z.ZodType<
-  AddAuditorInput,
-  z.ZodTypeDef,
-  unknown
-> = z.object({
-  email: z.string(),
-  givenName: z.string(),
-  familyName: z.string(),
-});
 /** @internal */
 export type AddAuditorInput$Outbound = {
   email: string;
@@ -55,12 +42,3 @@ export function addAuditorInputToJSON(
 ): string {
   return JSON.stringify(AddAuditorInput$outboundSchema.parse(addAuditorInput));
 }
-export function addAuditorInputFromJSON(
-  jsonString: string,
-): SafeParseResult<AddAuditorInput, SDKValidationError> {
-  return safeParse(
-    jsonString,
-    (x) => AddAuditorInput$inboundSchema.parse(JSON.parse(x)),
-    `Failed to parse 'AddAuditorInput' from JSON`,
-  );
-}

package/src/models/components/addcommentinput.ts

@@ -3,9 +3,6 @@
  */
 
 import * as z from "zod/v3";
-import { safeParse } from "../../lib/schemas.js";
-import { Result as SafeParseResult } from "../../types/fp.js";
-import { SDKValidationError } from "../errors/sdkvalidationerror.js";
 
 export type AddCommentInput = {
   /**
@@ -22,18 +19,6 @@ export type AddCommentInput = {
   creationDate: Date;
 };
 
-/** @internal */
-export const AddCommentInput$inboundSchema: z.ZodType<
-  AddCommentInput,
-  z.ZodTypeDef,
-  unknown
-> = z.object({
-  text: z.string(),
-  email: z.string(),
-  creationDate: z.string().datetime({ offset: true }).transform(v =>
-    new Date(v)
-  ),
-});
 /** @internal */
 export type AddCommentInput$Outbound = {
   text: string;
@@ -57,12 +42,3 @@ export function addCommentInputToJSON(
 ): string {
   return JSON.stringify(AddCommentInput$outboundSchema.parse(addCommentInput));
 }
-export function addCommentInputFromJSON(
-  jsonString: string,
-): SafeParseResult<AddCommentInput, SDKValidationError> {
-  return safeParse(
-    jsonString,
-    (x) => AddCommentInput$inboundSchema.parse(JSON.parse(x)),
-    `Failed to parse 'AddCommentInput' from JSON`,
-  );
-}

package/src/models/components/addinformationrequestcommentinput.ts

@@ -0,0 +1,67 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+
+/**
+ * Comments enable communication between auditors and customers about
+ *
+ * @remarks
+ * evidence requirements and submissions. All comments are immediately
+ * visible to both parties once created.
+ */
+export type AddInformationRequestCommentInput = {
+  /**
+   * The text content of the comment.
+   *
+   * @remarks
+   * Must be at least 1 character. Can include questions, clarifications,
+   * or explanations related to the information request.
+   */
+  text: string;
+  /**
+   * Email address of the comment author.
+   *
+   * @remarks
+   * Must match an existing Vanta user who belongs to the audit firm making the API request.
+   * This email uniquely identifies the author across systems.
+   */
+  email: string;
+  /**
+   * Timestamp when the comment was created in the external audit management system.
+   *
+   * @remarks
+   * This allows synchronizing comment timestamps from external systems.
+   * Format: ISO 8601 UTC timestamp.
+   */
+  creationDate: Date;
+};
+
+/** @internal */
+export type AddInformationRequestCommentInput$Outbound = {
+  text: string;
+  email: string;
+  creationDate: string;
+};
+
+/** @internal */
+export const AddInformationRequestCommentInput$outboundSchema: z.ZodType<
+  AddInformationRequestCommentInput$Outbound,
+  z.ZodTypeDef,
+  AddInformationRequestCommentInput
+> = z.object({
+  text: z.string(),
+  email: z.string(),
+  creationDate: z.date().transform(v => v.toISOString()),
+});
+
+export function addInformationRequestCommentInputToJSON(
+  addInformationRequestCommentInput: AddInformationRequestCommentInput,
+): string {
+  return JSON.stringify(
+    AddInformationRequestCommentInput$outboundSchema.parse(
+      addInformationRequestCommentInput,
+    ),
+  );
+}

package/src/models/components/audit.ts

@@ -6,11 +6,21 @@ import * as z from "zod/v3";
 import { safeParse } from "../../lib/schemas.js";
 import { Result as SafeParseResult } from "../../types/fp.js";
 import { SDKValidationError } from "../errors/sdkvalidationerror.js";
-import {
-  AuditFocus,
-  AuditFocus$inboundSchema,
-  AuditFocus$outboundSchema,
-} from "./auditfocus.js";
+import { AuditFocus, AuditFocus$inboundSchema } from "./auditfocus.js";
+
+/**
+ * Metadata about the auditor request list. This field is only present for IRL (Information
+ *
+ * @remarks
+ * Request List) based audits and will be undefined for standard audits. Use the presence
+ * of this field to differentiate between IRL and non-IRL audits.
+ */
+export type AuditorRequestListMetadata = {
+  /**
+   * Timestamp when information requests were shared with the customer. Null if not shared.
+   */
+  requestsSharedWithCustomer: Date | null;
+};
 
 export type Audit = {
   /**
@@ -45,6 +55,13 @@ export type Audit = {
    * The name of the framework for the audit
    */
   framework: string;
+  /**
+   * The display name for the audit. Returns the custom audit name if set,
+   *
+   * @remarks
+   * otherwise returns the framework name.
+   */
+  displayName: string;
   /**
    * Emails of auditors with access to audit
    */
@@ -70,8 +87,37 @@ export type Audit = {
    */
   completionDate: Date | null;
   auditFocus: AuditFocus;
+  /**
+   * Metadata about the auditor request list. This field is only present for IRL (Information
+   *
+   * @remarks
+   * Request List) based audits and will be undefined for standard audits. Use the presence
+   * of this field to differentiate between IRL and non-IRL audits.
+   */
+  auditorRequestListMetadata?: AuditorRequestListMetadata | undefined;
 };
 
+/** @internal */
+export const AuditorRequestListMetadata$inboundSchema: z.ZodType<
+  AuditorRequestListMetadata,
+  z.ZodTypeDef,
+  unknown
+> = z.object({
+  requestsSharedWithCustomer: z.nullable(
+    z.string().datetime({ offset: true }).transform(v => new Date(v)),
+  ),
+});
+
+export function auditorRequestListMetadataFromJSON(
+  jsonString: string,
+): SafeParseResult<AuditorRequestListMetadata, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => AuditorRequestListMetadata$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'AuditorRequestListMetadata' from JSON`,
+  );
+}
+
 /** @internal */
 export const Audit$inboundSchema: z.ZodType<Audit, z.ZodTypeDef, unknown> = z
   .object({
@@ -89,6 +135,7 @@ export const Audit$inboundSchema: z.ZodType<Audit, z.ZodTypeDef, unknown> = z
       z.string().datetime({ offset: true }).transform(v => new Date(v)),
     ),
     framework: z.string(),
+    displayName: z.string(),
     allowAuditorEmails: z.array(z.string()),
     allowAllAuditors: z.boolean(),
     deletionDate: z.nullable(
@@ -104,52 +151,11 @@ export const Audit$inboundSchema: z.ZodType<Audit, z.ZodTypeDef, unknown> = z
       z.string().datetime({ offset: true }).transform(v => new Date(v)),
     ),
     auditFocus: AuditFocus$inboundSchema,
+    auditorRequestListMetadata: z.lazy(() =>
+      AuditorRequestListMetadata$inboundSchema
+    ).optional(),
   });
-/** @internal */
-export type Audit$Outbound = {
-  id: string;
-  customerOrganizationName: string;
-  customerDisplayName: string | null;
-  customerOrganizationId: string;
-  auditStartDate: string;
-  auditEndDate: string;
-  earlyAccessStartsAt: string | null;
-  framework: string;
-  allowAuditorEmails: Array<string>;
-  allowAllAuditors: boolean;
-  deletionDate: string | null;
-  creationDate: string;
-  modificationDate: string | null;
-  completionDate: string | null;
-  auditFocus: string;
-};
-
-/** @internal */
-export const Audit$outboundSchema: z.ZodType<
-  Audit$Outbound,
-  z.ZodTypeDef,
-  Audit
-> = z.object({
-  id: z.string(),
-  customerOrganizationName: z.string(),
-  customerDisplayName: z.nullable(z.string()),
-  customerOrganizationId: z.string(),
-  auditStartDate: z.date().transform(v => v.toISOString()),
-  auditEndDate: z.date().transform(v => v.toISOString()),
-  earlyAccessStartsAt: z.nullable(z.date().transform(v => v.toISOString())),
-  framework: z.string(),
-  allowAuditorEmails: z.array(z.string()),
-  allowAllAuditors: z.boolean(),
-  deletionDate: z.nullable(z.date().transform(v => v.toISOString())),
-  creationDate: z.date().transform(v => v.toISOString()),
-  modificationDate: z.nullable(z.date().transform(v => v.toISOString())),
-  completionDate: z.nullable(z.date().transform(v => v.toISOString())),
-  auditFocus: AuditFocus$outboundSchema,
-});
 
-export function auditToJSON(audit: Audit): string {
-  return JSON.stringify(Audit$outboundSchema.parse(audit));
-}
 export function auditFromJSON(
   jsonString: string,
 ): SafeParseResult<Audit, SDKValidationError> {

package/src/models/components/auditevidencestate.ts

@@ -19,7 +19,3 @@ export type AuditEvidenceState = ClosedEnum<typeof AuditEvidenceState>;
 export const AuditEvidenceState$inboundSchema: z.ZodNativeEnum<
   typeof AuditEvidenceState
 > = z.nativeEnum(AuditEvidenceState);
-/** @internal */
-export const AuditEvidenceState$outboundSchema: z.ZodNativeEnum<
-  typeof AuditEvidenceState
-> = AuditEvidenceState$inboundSchema;

package/src/models/components/auditevidencetype.ts

@@ -16,7 +16,3 @@ export type AuditEvidenceType = ClosedEnum<typeof AuditEvidenceType>;
 export const AuditEvidenceType$inboundSchema: z.ZodNativeEnum<
   typeof AuditEvidenceType
 > = z.nativeEnum(AuditEvidenceType);
-/** @internal */
-export const AuditEvidenceType$outboundSchema: z.ZodNativeEnum<
-  typeof AuditEvidenceType
-> = AuditEvidenceType$inboundSchema;

package/src/models/components/auditevidenceupdateinput.ts

@@ -3,12 +3,8 @@
  */
 
 import * as z from "zod/v3";
-import { safeParse } from "../../lib/schemas.js";
-import { Result as SafeParseResult } from "../../types/fp.js";
-import { SDKValidationError } from "../errors/sdkvalidationerror.js";
 import {
   AuditorEnabledStateTransition,
-  AuditorEnabledStateTransition$inboundSchema,
   AuditorEnabledStateTransition$outboundSchema,
 } from "./auditorenabledstatetransition.js";
 
@@ -24,15 +20,6 @@ export type AuditEvidenceUpdateInput = {
   statusUpdate?: StatusUpdate | undefined;
 };
 
-/** @internal */
-export const StatusUpdate$inboundSchema: z.ZodType<
-  StatusUpdate,
-  z.ZodTypeDef,
-  unknown
-> = z.object({
-  auditorEmail: z.string(),
-  stateTransition: AuditorEnabledStateTransition$inboundSchema,
-});
 /** @internal */
 export type StatusUpdate$Outbound = {
   auditorEmail: string;
@@ -52,24 +39,7 @@ export const StatusUpdate$outboundSchema: z.ZodType<
 export function statusUpdateToJSON(statusUpdate: StatusUpdate): string {
   return JSON.stringify(StatusUpdate$outboundSchema.parse(statusUpdate));
 }
-export function statusUpdateFromJSON(
-  jsonString: string,
-): SafeParseResult<StatusUpdate, SDKValidationError> {
-  return safeParse(
-    jsonString,
-    (x) => StatusUpdate$inboundSchema.parse(JSON.parse(x)),
-    `Failed to parse 'StatusUpdate' from JSON`,
-  );
-}
 
-/** @internal */
-export const AuditEvidenceUpdateInput$inboundSchema: z.ZodType<
-  AuditEvidenceUpdateInput,
-  z.ZodTypeDef,
-  unknown
-> = z.object({
-  statusUpdate: z.lazy(() => StatusUpdate$inboundSchema).optional(),
-});
 /** @internal */
 export type AuditEvidenceUpdateInput$Outbound = {
   statusUpdate?: StatusUpdate$Outbound | undefined;
@@ -91,12 +61,3 @@ export function auditEvidenceUpdateInputToJSON(
     AuditEvidenceUpdateInput$outboundSchema.parse(auditEvidenceUpdateInput),
   );
 }
-export function auditEvidenceUpdateInputFromJSON(
-  jsonString: string,
-): SafeParseResult<AuditEvidenceUpdateInput, SDKValidationError> {
-  return safeParse(
-    jsonString,
-    (x) => AuditEvidenceUpdateInput$inboundSchema.parse(JSON.parse(x)),
-    `Failed to parse 'AuditEvidenceUpdateInput' from JSON`,
-  );
-}

package/src/models/components/auditfocus.ts

@@ -14,6 +14,3 @@ export type AuditFocus = ClosedEnum<typeof AuditFocus>;
 /** @internal */
 export const AuditFocus$inboundSchema: z.ZodNativeEnum<typeof AuditFocus> = z
   .nativeEnum(AuditFocus);
-/** @internal */
-export const AuditFocus$outboundSchema: z.ZodNativeEnum<typeof AuditFocus> =
-  AuditFocus$inboundSchema;

package/src/models/components/auditor.ts

@@ -36,31 +36,7 @@ export const Auditor$inboundSchema: z.ZodType<Auditor, z.ZodTypeDef, unknown> =
     givenName: z.string(),
     familyName: z.string(),
   });
-/** @internal */
-export type Auditor$Outbound = {
-  id: string;
-  organizationId: string;
-  email: string;
-  givenName: string;
-  familyName: string;
-};
 
-/** @internal */
-export const Auditor$outboundSchema: z.ZodType<
-  Auditor$Outbound,
-  z.ZodTypeDef,
-  Auditor
-> = z.object({
-  id: z.string(),
-  organizationId: z.string(),
-  email: z.string(),
-  givenName: z.string(),
-  familyName: z.string(),
-});
-
-export function auditorToJSON(auditor: Auditor): string {
-  return JSON.stringify(Auditor$outboundSchema.parse(auditor));
-}
 export function auditorFromJSON(
   jsonString: string,
 ): SafeParseResult<Auditor, SDKValidationError> {