release: 0.128.0

.github/workflows/ci.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ${{ github.repository == 'stainless-sdks/lithic-typescript' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Node
         uses: actions/setup-node@v4
@@ -41,7 +41,7 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Node
         uses: actions/setup-node@v4
@@ -74,7 +74,7 @@ jobs:
     runs-on: ${{ github.repository == 'stainless-sdks/lithic-typescript' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Node
         uses: actions/setup-node@v4

.github/workflows/publish-npm.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Node
         uses: actions/setup-node@v3

.github/workflows/release-doctor.yml

@@ -12,7 +12,7 @@ jobs:
     if: github.repository == 'lithic-com/lithic-node' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release-please') || github.head_ref == 'next')
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Check release environment
         run: |

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.127.0"
+  ".": "0.128.0"
 }

.stats.yml

@@ -1,4 +1,4 @@
 configured_endpoints: 176
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/lithic%2Flithic-4ecc06edca2cfad4eaf11573611e89823fda5f56370bac5cd02a498a6b277d09.yml
-openapi_spec_hash: 8f4a30bec4348cbde85b1e65bef9189a
-config_hash: 9dddee5f7af579864599849cb28a0770
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/lithic%2Flithic-14b3b5bca66c1e0935b314e469476f91193413c29a47ad4a0affa19beb14c7d3.yml
+openapi_spec_hash: afba11ad031397d6e3873485b5b42473
+config_hash: 31d71922d7838f34ae0875c9b8026d99

CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 0.128.0 (2026-01-22)
+
+Full Changelog: [v0.127.0...v0.128.0](https://github.com/lithic-com/lithic-node/compare/v0.127.0...v0.128.0)
+
+### Features
+
+* **api:** Add card.updated event ([ca68a38](https://github.com/lithic-com/lithic-node/commit/ca68a38160a3bb1aa0fce29571f5c8211ecb4079))
+* **api:** Add idempotency key to cards POST and PATCH endpoints ([98afb05](https://github.com/lithic-com/lithic-node/commit/98afb051ae43204a74957b83edbc1b91bb89d6d1))
+* **api:** Add tags field to card transactions ([062acce](https://github.com/lithic-com/lithic-node/commit/062acce766eae609ab715b095cf1e4226b4d0b8b))
+* **api:** make filter optional for Spend Velocity Auth Rules ([ef79410](https://github.com/lithic-com/lithic-node/commit/ef79410ccbc6a8c6409f80ec94704cd2fe138253))
+
+
+### Bug Fixes
+
+* **api:** Correct field name from ach_hold__period to ach_hold_period ([ead10f3](https://github.com/lithic-com/lithic-node/commit/ead10f32c6352afe9af48fb91d7573cd4f7ab00f))
+* **api:** mark AppleWebPushProvisioningResponse fields required ([3bb4fc1](https://github.com/lithic-com/lithic-node/commit/3bb4fc1d5d202fb0b04da2fd3940a67578618580))
+* **api:** rename WIRE_DRAWDOWN_REQUEST to WIRE_INBOUND_DRAWDOWN_REQUEST ([ef79410](https://github.com/lithic-com/lithic-node/commit/ef79410ccbc6a8c6409f80ec94704cd2fe138253))
+
+
+### Chores
+
+* Add spec linter for YAML and folded style multiline strings ([eefbc00](https://github.com/lithic-com/lithic-node/commit/eefbc0001bd83cdd8d54f04ab0429a9d3d38d8e7))
+* configure new SDK language ([19ac828](https://github.com/lithic-com/lithic-node/commit/19ac828b81e7c57de8ccd7ead0839b0e47d909b9))
+* fix typo in descriptions ([79ba3d6](https://github.com/lithic-com/lithic-node/commit/79ba3d6e33009523bb7cec77e96dca6ca94d3c7d))
+* **internal:** codegen related update ([9468191](https://github.com/lithic-com/lithic-node/commit/94681910790a2cc3db84c31cb4dd4fe9f4e36cad))
+* **internal:** configure MCP Server hosting ([4bda069](https://github.com/lithic-com/lithic-node/commit/4bda069ffdcb973684b39afa14aa4124eb9bf764))
+* **internal:** update `actions/checkout` version ([3de8381](https://github.com/lithic-com/lithic-node/commit/3de8381be8cacf5cbd152c3945cb709f1ed9a145))
+* **internal:** upgrade babel, qs, js-yaml ([5940b21](https://github.com/lithic-com/lithic-node/commit/5940b21506bacce1935195f6752b4b5293803c4e))
+* Rework event type generation to support spec splitting ([0466f6a](https://github.com/lithic-com/lithic-node/commit/0466f6abc05e245b96a3f7ea4e77917c0ceb2b0f))
+
 ## 0.127.0 (2026-01-08)
 
 Full Changelog: [v0.126.0...v0.127.0](https://github.com/lithic-com/lithic-node/compare/v0.126.0...v0.127.0)

api.md

@@ -747,6 +747,7 @@ Types:
 - <code><a href="./src/resources/webhooks.ts">CardRenewedWebhookEvent</a></code>
 - <code><a href="./src/resources/webhooks.ts">CardReissuedWebhookEvent</a></code>
 - <code><a href="./src/resources/webhooks.ts">CardShippedWebhookEvent</a></code>
+- <code><a href="./src/resources/webhooks.ts">CardUpdatedWebhookEvent</a></code>
 - <code><a href="./src/resources/webhooks.ts">CardTransactionUpdatedWebhookEvent</a></code>
 - <code><a href="./src/resources/webhooks.ts">CardTransactionEnhancedDataCreatedWebhookEvent</a></code>
 - <code><a href="./src/resources/webhooks.ts">CardTransactionEnhancedDataUpdatedWebhookEvent</a></code>

package.json

@@ -1,6 +1,6 @@
 {
   "name": "lithic",
-  "version": "0.127.0",
+  "version": "0.128.0",
   "description": "The official TypeScript library for the Lithic API",
   "author": "Lithic <sdk-feedback@lithic.com>",
   "types": "dist/index.d.ts",

src/client.ts

@@ -216,6 +216,7 @@ import {
   CardTransactionEnhancedDataCreatedWebhookEvent,
   CardTransactionEnhancedDataUpdatedWebhookEvent,
   CardTransactionUpdatedWebhookEvent,
+  CardUpdatedWebhookEvent,
   DigitalWalletTokenizationApprovalRequestWebhookEvent,
   DigitalWalletTokenizationResultWebhookEvent,
   DigitalWalletTokenizationTwoFactorAuthenticationCodeSentWebhookEvent,
@@ -1515,6 +1516,7 @@ export declare namespace Lithic {
     type CardRenewedWebhookEvent as CardRenewedWebhookEvent,
     type CardReissuedWebhookEvent as CardReissuedWebhookEvent,
     type CardShippedWebhookEvent as CardShippedWebhookEvent,
+    type CardUpdatedWebhookEvent as CardUpdatedWebhookEvent,
     type CardTransactionUpdatedWebhookEvent as CardTransactionUpdatedWebhookEvent,
     type CardTransactionEnhancedDataCreatedWebhookEvent as CardTransactionEnhancedDataCreatedWebhookEvent,
     type CardTransactionEnhancedDataUpdatedWebhookEvent as CardTransactionEnhancedDataUpdatedWebhookEvent,

src/resources/auth-rules/v2/v2.ts

@@ -928,8 +928,6 @@ export namespace RuleStats {
 }
 
 export interface VelocityLimitParams {
-  filters: VelocityLimitParams.Filters;
-
   /**
    * Velocity over the current day since 00:00 / 12 AM in Eastern Time
    */
@@ -940,6 +938,8 @@ export interface VelocityLimitParams {
    */
   scope: 'CARD' | 'ACCOUNT';
 
+  filters?: VelocityLimitParams.Filters;
+
   /**
    * The maximum amount of spend velocity allowed in the period in minor units (the
    * smallest unit of a currency, e.g. cents for USD). Transactions exceeding this

src/resources/cards/cards.ts

@@ -37,8 +37,16 @@ export class Cards extends APIResource {
    * });
    * ```
    */
-  create(body: CardCreateParams, options?: RequestOptions): APIPromise<Card> {
-    return this._client.post('/v1/cards', { body, ...options });
+  create(params: CardCreateParams, options?: RequestOptions): APIPromise<Card> {
+    const { 'Idempotency-Key': idempotencyKey, ...body } = params;
+    return this._client.post('/v1/cards', {
+      body,
+      ...options,
+      headers: buildHeaders([
+        { ...(idempotencyKey != null ? { 'Idempotency-Key': idempotencyKey } : undefined) },
+        options?.headers,
+      ]),
+    });
   }
 
   /**
@@ -784,12 +792,12 @@ export namespace CardWebProvisionResponse {
     /**
      * JWS object required for handoff to Apple's script.
      */
-    jws?: AppleWebPushProvisioningResponse.Jws;
+    jws: AppleWebPushProvisioningResponse.Jws;
 
     /**
      * A unique identifier for the JWS object.
      */
-    state?: string;
+    state: string;
   }
 
   export namespace AppleWebPushProvisioningResponse {
@@ -851,7 +859,7 @@ export namespace CardWebProvisionResponse {
 
 export interface CardCreateParams {
   /**
-   * Card types:
+   * Body param: Card types:
    *
    * - `VIRTUAL` - Card will authorize at any merchant and can be added to a digital
    *   wallet like Apple Pay or Google Pay (if the card program is digital
@@ -871,95 +879,99 @@ export interface CardCreateParams {
   type: 'MERCHANT_LOCKED' | 'PHYSICAL' | 'SINGLE_USE' | 'VIRTUAL' | 'UNLOCKED' | 'DIGITAL_WALLET';
 
   /**
-   * Globally unique identifier for the account that the card will be associated
-   * with. Required for programs enrolling users using the
+   * Body param: Globally unique identifier for the account that the card will be
+   * associated with. Required for programs enrolling users using the
    * [/account_holders endpoint](https://docs.lithic.com/docs/account-holders-kyc).
    * See [Managing Your Program](doc:managing-your-program) for more information.
    */
   account_token?: string;
 
   /**
-   * Globally unique identifier for an existing bulk order to associate this card
-   * with. When specified, the card will be added to the bulk order for batch
-   * shipment. Only applicable to cards of type PHYSICAL
+   * Body param: Globally unique identifier for an existing bulk order to associate
+   * this card with. When specified, the card will be added to the bulk order for
+   * batch shipment. Only applicable to cards of type PHYSICAL
    */
   bulk_order_token?: string;
 
   /**
-   * For card programs with more than one BIN range. This must be configured with
-   * Lithic before use. Identifies the card program/BIN range under which to create
-   * the card. If omitted, will utilize the program's default `card_program_token`.
-   * In Sandbox, use 00000000-0000-0000-1000-000000000000 and
+   * Body param: For card programs with more than one BIN range. This must be
+   * configured with Lithic before use. Identifies the card program/BIN range under
+   * which to create the card. If omitted, will utilize the program's default
+   * `card_program_token`. In Sandbox, use 00000000-0000-0000-1000-000000000000 and
    * 00000000-0000-0000-2000-000000000000 to test creating cards on specific card
    * programs.
    */
   card_program_token?: string;
 
+  /**
+   * Body param
+   */
   carrier?: Shared.Carrier;
 
   /**
-   * Specifies the digital card art to be displayed in the user’s digital wallet
-   * after tokenization. This artwork must be approved by Mastercard and configured
-   * by Lithic to use. See
+   * Body param: Specifies the digital card art to be displayed in the user’s digital
+   * wallet after tokenization. This artwork must be approved by Mastercard and
+   * configured by Lithic to use. See
    * [Flexible Card Art Guide](https://docs.lithic.com/docs/about-digital-wallets#flexible-card-art).
    */
   digital_card_art_token?: string;
 
   /**
-   * Two digit (MM) expiry month. If neither `exp_month` nor `exp_year` is provided,
-   * an expiration date will be generated.
+   * Body param: Two digit (MM) expiry month. If neither `exp_month` nor `exp_year`
+   * is provided, an expiration date will be generated.
    */
   exp_month?: string;
 
   /**
-   * Four digit (yyyy) expiry year. If neither `exp_month` nor `exp_year` is
-   * provided, an expiration date will be generated.
+   * Body param: Four digit (yyyy) expiry year. If neither `exp_month` nor `exp_year`
+   * is provided, an expiration date will be generated.
    */
   exp_year?: string;
 
   /**
-   * Friendly name to identify the card.
+   * Body param: Friendly name to identify the card.
    */
   memo?: string;
 
   /**
-   * Encrypted PIN block (in base64). Applies to cards of type `PHYSICAL` and
-   * `VIRTUAL`. See
+   * Body param: Encrypted PIN block (in base64). Applies to cards of type `PHYSICAL`
+   * and `VIRTUAL`. See
    * [Encrypted PIN Block](https://docs.lithic.com/docs/cards#encrypted-pin-block).
    */
   pin?: string;
 
   /**
-   * Only applicable to cards of type `PHYSICAL`. This must be configured with Lithic
-   * before use. Specifies the configuration (i.e., physical card art) that the card
-   * should be manufactured with.
+   * Body param: Only applicable to cards of type `PHYSICAL`. This must be configured
+   * with Lithic before use. Specifies the configuration (i.e., physical card art)
+   * that the card should be manufactured with.
    */
   product_id?: string;
 
   /**
-   * Restricted field limited to select use cases. Lithic will reach out directly if
-   * this field should be used. Globally unique identifier for the replacement card's
-   * account. If this field is specified, `replacement_for` must also be specified.
-   * If `replacement_for` is specified and this field is omitted, the replacement
-   * card's account will be inferred from the card being replaced.
+   * Body param: Restricted field limited to select use cases. Lithic will reach out
+   * directly if this field should be used. Globally unique identifier for the
+   * replacement card's account. If this field is specified, `replacement_for` must
+   * also be specified. If `replacement_for` is specified and this field is omitted,
+   * the replacement card's account will be inferred from the card being replaced.
    */
   replacement_account_token?: string;
 
   /**
-   * Additional context or information related to the card that this card will
-   * replace.
+   * Body param: Additional context or information related to the card that this card
+   * will replace.
    */
   replacement_comment?: string;
 
   /**
-   * Globally unique identifier for the card that this card will replace. If the card
-   * type is `PHYSICAL` it will be replaced by a `PHYSICAL` card. If the card type is
-   * `VIRTUAL` it will be replaced by a `VIRTUAL` card.
+   * Body param: Globally unique identifier for the card that this card will replace.
+   * If the card type is `PHYSICAL` it will be replaced by a `PHYSICAL` card. If the
+   * card type is `VIRTUAL` it will be replaced by a `VIRTUAL` card.
    */
   replacement_for?: string;
 
   /**
-   * Card state substatus values for the card that this card will replace:
+   * Body param: Card state substatus values for the card that this card will
+   * replace:
    *
    * - `LOST` - The physical card is no longer in the cardholder's possession due to
    *   being lost or never received by the cardholder.
@@ -1000,11 +1012,14 @@ export interface CardCreateParams {
     | 'UNDELIVERABLE'
     | 'OTHER';
 
+  /**
+   * Body param
+   */
   shipping_address?: Shared.ShippingAddress;
 
   /**
-   * Shipping method for the card. Only applies to cards of type PHYSICAL. Use of
-   * options besides `STANDARD` require additional permissions.
+   * Body param: Shipping method for the card. Only applies to cards of type
+   * PHYSICAL. Use of options besides `STANDARD` require additional permissions.
    *
    * - `STANDARD` - USPS regular mail or similar international option, with no
    *   tracking
@@ -1029,16 +1044,16 @@ export interface CardCreateParams {
     | 'STANDARD_WITH_TRACKING';
 
   /**
-   * Amount (in cents) to limit approved authorizations (e.g. 100000 would be a
-   * $1,000 limit). Transaction requests above the spend limit will be declined. Note
-   * that a spend limit of 0 is effectively no limit, and should only be used to
-   * reset or remove a prior limit. Only a limit of 1 or above will result in
-   * declined transactions due to checks against the card limit.
+   * Body param: Amount (in cents) to limit approved authorizations (e.g. 100000
+   * would be a $1,000 limit). Transaction requests above the spend limit will be
+   * declined. Note that a spend limit of 0 is effectively no limit, and should only
+   * be used to reset or remove a prior limit. Only a limit of 1 or above will result
+   * in declined transactions due to checks against the card limit.
    */
   spend_limit?: number;
 
   /**
-   * Spend limit duration values:
+   * Body param: Spend limit duration values:
    *
    * - `ANNUALLY` - Card will authorize transactions up to spend limit for the
    *   trailing year.
@@ -1054,14 +1069,19 @@ export interface CardCreateParams {
   spend_limit_duration?: SpendLimitDuration;
 
   /**
-   * Card state values:
+   * Body param: Card state values:
    *
    * - `OPEN` - Card will approve authorizations (if they match card and account
    *   parameters).
    * - `PAUSED` - Card will decline authorizations, but can be resumed at a later
    *   time.
    */
   state?: 'OPEN' | 'PAUSED';
+
+  /**
+   * Header param: Idempotency key for the request
+   */
+  'Idempotency-Key'?: string;
 }
 
 export interface CardUpdateParams {