vanta-auditor-api-sdk 0.4.2 → 0.6.0

package/src/lib/files.ts

@@ -80,3 +80,25 @@ export function getContentTypeFromFileName(fileName: string): string | null {
 
   return mimeTypes[ext] || null;
 }
+
+/**
+ * Creates a Blob from file content with the given MIME type.
+ *
+ * Node.js Buffers are Uint8Array subclasses that may share a pooled
+ * ArrayBuffer (byteOffset > 0, byteLength < buffer.byteLength). Passing
+ * such a Buffer directly to `new Blob([buf])` can include the entire
+ * underlying pool on some runtimes, producing a Blob with extra bytes
+ * that corrupts multipart uploads.
+ *
+ * Copying into a standalone Uint8Array ensures the Blob receives only the
+ * intended bytes regardless of runtime behaviour.
+ */
+export function bytesToBlob(
+  content: Uint8Array<ArrayBufferLike> | ArrayBuffer | Blob | string,
+  contentType: string,
+): Blob {
+  if (content instanceof Uint8Array) {
+    return new Blob([new Uint8Array(content)], { type: contentType });
+  }
+  return new Blob([content as BlobPart], { type: contentType });
+}

package/src/lib/matchers.ts

@@ -248,8 +248,9 @@ export function match<T, E>(
         raw = body;
         break;
       default:
-        encoding satisfies never;
-        throw new Error(`Unsupported response type: ${encoding}`);
+        throw new Error(
+          `Unsupported response type: ${encoding satisfies never}`,
+        );
     }
 
     if (matcher.enc === "fail") {

package/src/lib/sdks.ts

@@ -22,7 +22,6 @@ import {
   isConnectionError,
   isTimeoutError,
   matchContentType,
-  matchStatusCode,
 } from "./http.js";
 import { Logger } from "./logger.js";
 import { retry, RetryConfig } from "./retries.js";
@@ -128,13 +127,15 @@ export class ClientSDK {
     if (!base) {
       return ERR(new InvalidRequestError("No base URL provided for operation"));
     }
-    const reqURL = new URL(base);
-    const inputURL = new URL(path, reqURL);
-
+    const baseURL = new URL(base);
+    let reqURL: URL;
     if (path) {
-      reqURL.pathname += reqURL.pathname.endsWith("/") ? "" : "/";
-      reqURL.pathname += inputURL.pathname.replace(/^\/+/, "");
+      baseURL.pathname = baseURL.pathname.replace(/\/+$/, "") + "/";
+      reqURL = new URL(path, baseURL);
+    } else {
+      reqURL = baseURL;
     }
+    reqURL.hash = "";
 
     let finalQuery = query || "";
 
@@ -232,7 +233,7 @@ export class ClientSDK {
     request: Request,
     options: {
       context: HookContext;
-      errorCodes: number | string | (number | string)[];
+      isErrorStatusCode: (statusCode: number) => boolean;
       retryConfig: RetryConfig;
       retryCodes: string[];
     },
@@ -245,7 +246,7 @@ export class ClientSDK {
       | UnexpectedClientError
     >
   > {
-    const { context, errorCodes } = options;
+    const { context, isErrorStatusCode } = options;
 
     return retry(
       async () => {
@@ -257,7 +258,7 @@ export class ClientSDK {
         let response = await this.#httpClient.request(req);
 
         try {
-          if (matchStatusCode(response, errorCodes)) {
+          if (isErrorStatusCode(response.status)) {
             const result = await this.#hooks.afterError(
               context,
               response,
@@ -308,9 +309,9 @@ export class ClientSDK {
   }
 }
 
-const jsonLikeContentTypeRE = /(application|text)\/.*?\+*json.*/;
+const jsonLikeContentTypeRE = /^(application|text)\/([^+]+\+)*json.*/;
 const jsonlLikeContentTypeRE =
-  /(application|text)\/(.*?\+*\bjsonl\b.*|.*?\+*\bx-ndjson\b.*)/;
+  /^(application|text)\/([^+]+\+)*(jsonl|x-ndjson)\b.*/;
 async function logRequest(logger: Logger | undefined, req: Request) {
   if (!logger) {
     return;
@@ -381,8 +382,6 @@ async function logResponse(
       break;
     case matchContentType(res, "application/jsonl")
       || jsonlLikeContentTypeRE.test(ct):
-      logger.log(await res.clone().text());
-      break;
     case matchContentType(res, "text/event-stream"):
       logger.log(`<${contentType}>`);
       break;

package/src/lib/security.ts

@@ -198,8 +198,7 @@ export function resolveSecurity(
         applyBearer(state, spec);
         break;
       default:
-        spec satisfies never;
-        throw SecurityError.unrecognizedType(type);
+        throw SecurityError.unrecognizedType((spec satisfies never, type));
     }
   });
 
@@ -241,8 +240,9 @@ function applyBearer(
 
 export function resolveGlobalSecurity(
   security: Partial<components.Security> | null | undefined,
+  allowedFields?: number[],
 ): SecurityState | null {
-  return resolveSecurity(
+  let inputs: SecurityInput[][] = [
     [
       {
         fieldName: "Authorization",
@@ -250,7 +250,18 @@ export function resolveGlobalSecurity(
         value: security?.bearerAuth ?? env().VANTA_BEARER_AUTH,
       },
     ],
-  );
+  ];
+
+  if (allowedFields) {
+    inputs = allowedFields.map((i) => {
+      if (i < 0 || i >= inputs.length) {
+        throw new RangeError(`invalid allowedFields index ${i}`);
+      }
+      return inputs[i]!;
+    });
+  }
+
+  return resolveSecurity(...inputs);
 }
 
 export async function extractSecurity<

package/src/lib/url.ts

@@ -13,21 +13,23 @@ export function pathToFunc(
   const paramRE = /\{([a-zA-Z0-9_][a-zA-Z0-9_-]*?)\}/g;
 
   return function buildURLPath(params: Record<string, unknown> = {}): string {
-    return pathPattern.replace(paramRE, function (_, placeholder) {
-      if (!hasOwn.call(params, placeholder)) {
-        throw new Error(`Parameter '${placeholder}' is required`);
-      }
+    return pathPattern
+      .replace(paramRE, function (_, placeholder) {
+        if (!hasOwn.call(params, placeholder)) {
+          throw new Error(`Parameter '${placeholder}' is required`);
+        }
 
-      const value = params[placeholder];
-      if (typeof value !== "string" && typeof value !== "number") {
-        throw new Error(
-          `Parameter '${placeholder}' must be a string or number`,
-        );
-      }
+        const value = params[placeholder];
+        if (typeof value !== "string" && typeof value !== "number") {
+          throw new Error(
+            `Parameter '${placeholder}' must be a string or number`,
+          );
+        }
 
-      return options?.charEncoding === "percent"
-        ? encodeURIComponent(`${value}`)
-        : `${value}`;
-    });
+        return options?.charEncoding === "percent"
+          ? encodeURIComponent(`${value}`)
+          : `${value}`;
+      })
+      .replace(/^\/+/, "");
   };
 }

package/src/models/components/acceptinformationrequestevidenceinput.ts

@@ -0,0 +1,46 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+
+/**
+ * Input for accepting evidence on an information request, indicating that
+ *
+ * @remarks
+ * the submitted evidence meets requirements. This changes the request's
+ * approvalStatus to an approved state and creates an activity log entry.
+ */
+export type AcceptInformationRequestEvidenceInput = {
+  /**
+   * Email of the auditor accepting the evidence.
+   *
+   * @remarks
+   * Must match an existing Vanta user who belongs to the audit firm making the API request.
+   */
+  auditorEmail: string;
+};
+
+/** @internal */
+export type AcceptInformationRequestEvidenceInput$Outbound = {
+  auditorEmail: string;
+};
+
+/** @internal */
+export const AcceptInformationRequestEvidenceInput$outboundSchema: z.ZodType<
+  AcceptInformationRequestEvidenceInput$Outbound,
+  z.ZodTypeDef,
+  AcceptInformationRequestEvidenceInput
+> = z.object({
+  auditorEmail: z.string(),
+});
+
+export function acceptInformationRequestEvidenceInputToJSON(
+  acceptInformationRequestEvidenceInput: AcceptInformationRequestEvidenceInput,
+): string {
+  return JSON.stringify(
+    AcceptInformationRequestEvidenceInput$outboundSchema.parse(
+      acceptInformationRequestEvidenceInput,
+    ),
+  );
+}

package/src/models/components/addinformationrequestcommentinput.ts

@@ -0,0 +1,67 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+
+/**
+ * Comments enable communication between auditors and customers about
+ *
+ * @remarks
+ * evidence requirements and submissions. All comments are immediately
+ * visible to both parties once created.
+ */
+export type AddInformationRequestCommentInput = {
+  /**
+   * The text content of the comment.
+   *
+   * @remarks
+   * Must be at least 1 character. Can include questions, clarifications,
+   * or explanations related to the information request.
+   */
+  text: string;
+  /**
+   * Email address of the comment author.
+   *
+   * @remarks
+   * Must match an existing Vanta user who belongs to the audit firm making the API request.
+   * This email uniquely identifies the author across systems.
+   */
+  email: string;
+  /**
+   * Timestamp when the comment was created in the external audit management system.
+   *
+   * @remarks
+   * This allows synchronizing comment timestamps from external systems.
+   * Format: ISO 8601 UTC timestamp.
+   */
+  creationDate: Date;
+};
+
+/** @internal */
+export type AddInformationRequestCommentInput$Outbound = {
+  text: string;
+  email: string;
+  creationDate: string;
+};
+
+/** @internal */
+export const AddInformationRequestCommentInput$outboundSchema: z.ZodType<
+  AddInformationRequestCommentInput$Outbound,
+  z.ZodTypeDef,
+  AddInformationRequestCommentInput
+> = z.object({
+  text: z.string(),
+  email: z.string(),
+  creationDate: z.date().transform(v => v.toISOString()),
+});
+
+export function addInformationRequestCommentInputToJSON(
+  addInformationRequestCommentInput: AddInformationRequestCommentInput,
+): string {
+  return JSON.stringify(
+    AddInformationRequestCommentInput$outboundSchema.parse(
+      addInformationRequestCommentInput,
+    ),
+  );
+}

package/src/models/components/audit.ts

@@ -8,6 +8,20 @@ import { Result as SafeParseResult } from "../../types/fp.js";
 import { SDKValidationError } from "../errors/sdkvalidationerror.js";
 import { AuditFocus, AuditFocus$inboundSchema } from "./auditfocus.js";
 
+/**
+ * Metadata about the auditor request list. This field is only present for IRL (Information
+ *
+ * @remarks
+ * Request List) based audits and will be undefined for standard audits. Use the presence
+ * of this field to differentiate between IRL and non-IRL audits.
+ */
+export type AuditorRequestListMetadata = {
+  /**
+   * Timestamp when information requests were shared with the customer. Null if not shared.
+   */
+  requestsSharedWithCustomer: Date | null;
+};
+
 export type Audit = {
   /**
    * The unique identifier for the audit.
@@ -41,6 +55,13 @@ export type Audit = {
    * The name of the framework for the audit
    */
   framework: string;
+  /**
+   * The display name for the audit. Returns the custom audit name if set,
+   *
+   * @remarks
+   * otherwise returns the framework name.
+   */
+  displayName: string;
   /**
    * Emails of auditors with access to audit
    */
@@ -66,8 +87,37 @@ export type Audit = {
    */
   completionDate: Date | null;
   auditFocus: AuditFocus;
+  /**
+   * Metadata about the auditor request list. This field is only present for IRL (Information
+   *
+   * @remarks
+   * Request List) based audits and will be undefined for standard audits. Use the presence
+   * of this field to differentiate between IRL and non-IRL audits.
+   */
+  auditorRequestListMetadata?: AuditorRequestListMetadata | undefined;
 };
 
+/** @internal */
+export const AuditorRequestListMetadata$inboundSchema: z.ZodType<
+  AuditorRequestListMetadata,
+  z.ZodTypeDef,
+  unknown
+> = z.object({
+  requestsSharedWithCustomer: z.nullable(
+    z.string().datetime({ offset: true }).transform(v => new Date(v)),
+  ),
+});
+
+export function auditorRequestListMetadataFromJSON(
+  jsonString: string,
+): SafeParseResult<AuditorRequestListMetadata, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => AuditorRequestListMetadata$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'AuditorRequestListMetadata' from JSON`,
+  );
+}
+
 /** @internal */
 export const Audit$inboundSchema: z.ZodType<Audit, z.ZodTypeDef, unknown> = z
   .object({
@@ -85,6 +135,7 @@ export const Audit$inboundSchema: z.ZodType<Audit, z.ZodTypeDef, unknown> = z
       z.string().datetime({ offset: true }).transform(v => new Date(v)),
     ),
     framework: z.string(),
+    displayName: z.string(),
     allowAuditorEmails: z.array(z.string()),
     allowAllAuditors: z.boolean(),
     deletionDate: z.nullable(
@@ -100,6 +151,9 @@ export const Audit$inboundSchema: z.ZodType<Audit, z.ZodTypeDef, unknown> = z
       z.string().datetime({ offset: true }).transform(v => new Date(v)),
     ),
     auditFocus: AuditFocus$inboundSchema,
+    auditorRequestListMetadata: z.lazy(() =>
+      AuditorRequestListMetadata$inboundSchema
+    ).optional(),
   });
 
 export function auditFromJSON(

package/src/models/components/auditorcontrol.ts

@@ -62,6 +62,14 @@ export type AuditorControl = {
    * The control's custom field values, if control custom fields is included in your Vanta instance.
    */
   customFields: Array<CustomField>;
+  /**
+   * When the control was created. Returns null for Vanta library controls.
+   */
+  creationDate: Date | null;
+  /**
+   * When the control was last modified. Returns null for Vanta library controls.
+   */
+  modificationDate: Date | null;
   /**
    * The report standard framework fulfilled by the control.
    */
@@ -105,6 +113,12 @@ export const AuditorControl$inboundSchema: z.ZodType<
   owner: z.nullable(z.lazy(() => Owner$inboundSchema)),
   role: z.nullable(z.string()).optional(),
   customFields: z.array(CustomField$inboundSchema),
+  creationDate: z.nullable(
+    z.string().datetime({ offset: true }).transform(v => new Date(v)),
+  ),
+  modificationDate: z.nullable(
+    z.string().datetime({ offset: true }).transform(v => new Date(v)),
+  ),
   framework: z.string(),
   sections: z.array(Section$inboundSchema),
 });

package/src/models/components/comment.ts

@@ -36,6 +36,15 @@ export type Comment = {
    * The email of the comment author. This acts as a unique identifier to map users between Vanta and external systems.
    */
   email: string | null;
+  /**
+   * Human-readable display name of the comment author.
+   *
+   * @remarks
+   * Null if the author's name is not available (e.g., user was deleted).
+   * This enables correct author attribution in integrations where users cannot
+   * be reliably matched across systems by email alone.
+   */
+  authorName: string | null;
 };
 
 /** @internal */
@@ -54,6 +63,7 @@ export const Comment$inboundSchema: z.ZodType<Comment, z.ZodTypeDef, unknown> =
       z.string().datetime({ offset: true }).transform(v => new Date(v)),
     ),
     email: z.nullable(z.string()),
+    authorName: z.nullable(z.string()),
   });
 
 export function commentFromJSON(

package/src/models/components/control.ts

@@ -61,6 +61,14 @@ export type Control = {
    * The control's custom field values, if control custom fields is included in your Vanta instance.
    */
   customFields: Array<CustomField>;
+  /**
+   * When the control was created. Returns null for Vanta library controls.
+   */
+  creationDate: Date | null;
+  /**
+   * When the control was last modified. Returns null for Vanta library controls.
+   */
+  modificationDate: Date | null;
 };
 
 /** @internal */
@@ -96,6 +104,12 @@ export const Control$inboundSchema: z.ZodType<Control, z.ZodTypeDef, unknown> =
     owner: z.nullable(z.lazy(() => ControlOwner$inboundSchema)),
     role: z.nullable(z.string()).optional(),
     customFields: z.array(CustomField$inboundSchema),
+    creationDate: z.nullable(
+      z.string().datetime({ offset: true }).transform(v => new Date(v)),
+    ),
+    modificationDate: z.nullable(
+      z.string().datetime({ offset: true }).transform(v => new Date(v)),
+    ),
   });
 
 export function controlFromJSON(

package/src/models/components/createinformationrequestinput.ts

@@ -0,0 +1,138 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+import { ClosedEnum } from "../../types/enums.js";
+import {
+  InformationRequestType,
+  InformationRequestType$outboundSchema,
+} from "./informationrequesttype.js";
+
+/**
+ * How frequently this request recurs. Null or omitted for one-time requests.
+ */
+export const CreateInformationRequestInputCadence = {
+  Annually: "ANNUALLY",
+  Biannually: "BIANNUALLY",
+  Monthly: "MONTHLY",
+  Quarterly: "QUARTERLY",
+} as const;
+/**
+ * How frequently this request recurs. Null or omitted for one-time requests.
+ */
+export type CreateInformationRequestInputCadence = ClosedEnum<
+  typeof CreateInformationRequestInputCadence
+>;
+
+/**
+ * Input for creating a new information request.
+ *
+ * @remarks
+ * New requests are created in an initial state by default.
+ */
+export type CreateInformationRequestInput = {
+  /**
+   * External unique ID to prevent duplicate requests across audit systems.
+   *
+   * @remarks
+   * Must be unique within the audit. Used for idempotency.
+   */
+  uniqueId: string;
+  /**
+   * Short, descriptive title summarizing what is being requested.
+   *
+   * @remarks
+   * Must be at least 1 character.
+   */
+  title: string;
+  /**
+   * Type of information request, defining what scope of evidence is needed.
+   *
+   * @remarks
+   *
+   * - POINT_IN_TIME: Evidence for a specific moment (e.g., current state of a policy)
+   * - POPULATION: Evidence covering all items in a category (e.g., all employees)
+   * - SAMPLE: Evidence for a representative sample (e.g., 10 random customer records)
+   */
+  requestType: InformationRequestType;
+  /**
+   * Detailed description explaining what evidence is needed.
+   *
+   * @remarks
+   * Helps the customer understand what to submit. Optional.
+   */
+  description?: string | null | undefined;
+  /**
+   * Framework codes this request addresses.
+   *
+   * @remarks
+   * An empty array if no framework codes are associated.
+   */
+  frameworkCodes: Array<string>;
+  /**
+   * How frequently this request recurs. Null or omitted for one-time requests.
+   */
+  cadence?: CreateInformationRequestInputCadence | null | undefined;
+  /**
+   * Deadline for fulfilling this request. Null or omitted if no deadline.
+   *
+   * @remarks
+   * Format: ISO 8601 UTC timestamp.
+   */
+  dueDate?: Date | null | undefined;
+  /**
+   * Start date of the audit period. Evidence before this date may not be accepted.
+   *
+   * @remarks
+   * Null or omitted if not restricted.
+   * Format: ISO 8601 UTC timestamp.
+   */
+  evidenceCaptureDate?: Date | null | undefined;
+};
+
+/** @internal */
+export const CreateInformationRequestInputCadence$outboundSchema:
+  z.ZodNativeEnum<typeof CreateInformationRequestInputCadence> = z.nativeEnum(
+    CreateInformationRequestInputCadence,
+  );
+
+/** @internal */
+export type CreateInformationRequestInput$Outbound = {
+  uniqueId: string;
+  title: string;
+  requestType: string;
+  description?: string | null | undefined;
+  frameworkCodes: Array<string>;
+  cadence?: string | null | undefined;
+  dueDate?: string | null | undefined;
+  evidenceCaptureDate?: string | null | undefined;
+};
+
+/** @internal */
+export const CreateInformationRequestInput$outboundSchema: z.ZodType<
+  CreateInformationRequestInput$Outbound,
+  z.ZodTypeDef,
+  CreateInformationRequestInput
+> = z.object({
+  uniqueId: z.string(),
+  title: z.string(),
+  requestType: InformationRequestType$outboundSchema,
+  description: z.nullable(z.string()).optional(),
+  frameworkCodes: z.array(z.string()),
+  cadence: z.nullable(CreateInformationRequestInputCadence$outboundSchema)
+    .optional(),
+  dueDate: z.nullable(z.date().transform(v => v.toISOString())).optional(),
+  evidenceCaptureDate: z.nullable(z.date().transform(v => v.toISOString()))
+    .optional(),
+});
+
+export function createInformationRequestInputToJSON(
+  createInformationRequestInput: CreateInformationRequestInput,
+): string {
+  return JSON.stringify(
+    CreateInformationRequestInput$outboundSchema.parse(
+      createInformationRequestInput,
+    ),
+  );
+}

package/src/models/components/deleteinformationrequestcommentinput.ts

@@ -0,0 +1,46 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v3";
+
+/**
+ * Deletes an existing comment on an information request.
+ *
+ * @remarks
+ * Only the original author of the comment can delete it.
+ */
+export type DeleteInformationRequestCommentInput = {
+  /**
+   * Email address of the comment author.
+   *
+   * @remarks
+   * Must match an existing Vanta user who belongs to the audit firm making the API request.
+   * This email uniquely identifies the author across systems.
+   */
+  email: string;
+};
+
+/** @internal */
+export type DeleteInformationRequestCommentInput$Outbound = {
+  email: string;
+};
+
+/** @internal */
+export const DeleteInformationRequestCommentInput$outboundSchema: z.ZodType<
+  DeleteInformationRequestCommentInput$Outbound,
+  z.ZodTypeDef,
+  DeleteInformationRequestCommentInput
+> = z.object({
+  email: z.string(),
+});
+
+export function deleteInformationRequestCommentInputToJSON(
+  deleteInformationRequestCommentInput: DeleteInformationRequestCommentInput,
+): string {
+  return JSON.stringify(
+    DeleteInformationRequestCommentInput$outboundSchema.parse(
+      deleteInformationRequestCommentInput,
+    ),
+  );
+}

package/src/models/components/evidenceurl.ts

@@ -24,6 +24,10 @@ export type EvidenceUrl = {
    * Set to true if this is a presigned s3 url. Set to false if this is a customer uploaded link
    */
   isDownloadable: boolean;
+  /**
+   * MIME type of the evidence file (e.g., "application/pdf", "image/png")
+   */
+  mimeType: string | null;
 };
 
 /** @internal */
@@ -36,6 +40,7 @@ export const EvidenceUrl$inboundSchema: z.ZodType<
   url: z.string(),
   filename: z.string(),
   isDownloadable: z.boolean(),
+  mimeType: z.nullable(z.string()),
 });
 
 export function evidenceUrlFromJSON(