SDK Changelog

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

• featReplaced the runtime Guzzle dependency with PSR-18/PSR-17/PSR-7 interfaces and `php-http/discovery`; Guzzle remains dev-only for tests.
• featAdded SDK-G004/G005 HTTP retry behavior with idempotency gating, full jitter, `Retry-After` handling, replayable body checks, and response cleanup before retries.
• featChanged product and archive download APIs to return PSR-7 streams instead of materialized strings.
• featClosed SDK-opened multipart upload file handles on success and failure paths.
• featMade HTTP JSON response decoding strict with `JSON_THROW_ON_ERROR | JSON_BIGINT_AS_STRING` while preserving empty-body responses as empty arrays.
• featAdded an explicit `Omit` sentinel so request serialization can distinguish omitted fields from intentional `null` values.
• featWrapped API keys, frontend keys, proxy URLs, and credential secrets in redacting types with deliberate reveal boundaries for request serialization.
• featRejected HTTP redirect responses instead of following them with SDK authentication headers.
• featWired PHP guardrail tooling for Composer strict validation, PHP-CS-Fixer, PHPStan level 9, Psalm, PHPMD, Rector dry-run, PHPUnit, and Roave BC checks.

• featRequired Salesforce Named Credential configuration for truID callouts and removed raw API key, raw endpoint, Remote Site Setting, and manual `X-API-KEY` paths.
• featMade `connect()` a single bounded callout and moved brand data-service lookup to an explicit `getBrandDataServices(companyId, brandId)` method.
• featAdded pre-callout governor checks for exhausted callout budget and DML-before-callout transactions.
• featTracked SDK cumulative callout elapsed time, capped per-request timeouts by remaining budget, and refused calls after the Apex 120s transaction ceiling is exhausted.
• featReplaced message-only SDK failures with typed Apex exceptions that expose status, request id, headers, response body, and parsed error data through deliberate fields.
• featRedacted sensitive HTTP error headers/body/error data and truncated exposed response bodies while keeping raw response content out of exception messages.
• featChanged public SDK classes to `inherited sharing` so callers control sharing behavior consistently.
• featAdded Queueable `Database.AllowsCallouts` async client forms for SDK operations that need to run from trigger or post-DML contexts.
• featAdded Salesforce `HttpCalloutMock` coverage for the default transport public operation surface.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

• featConverted schema models to Java records with defensive copies and unknown-field preservation for response evolution safety.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

• featInitial PHP 8.2+ SDK with truID Connect API v4.0 workflows, Composer packaging, and parity coverage.
• featCollection start, direct-bank credentials, polling, challenge resolution, product downloads, product summary, and upload support.
• choreAdded PHP API reference and portal download archive support.

• featInitial Salesforce Apex SDK targeting Salesforce API version 67.0.
• featApex classes for configuration, HTTP transport, connect, direct-bank start, polling, challenge resolution, product downloads, collection delete, and bounded PDF upload.
• choreAdded Salesforce Apex API reference and portal download archive support.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

• fix`wait_for()` stops on terminal status (`code >= 2000`) or challenge codes, not on progress updates alone.
• fix`get_data()` sends `Accept: */*` so JSON data products download without HTTP 406 (was `application/octet-stream`).

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

• feat`upload(...)` on the connect context — create a collection by extracting data from PDF bank statements or JSON transaction files (`POST /extracter-api/uploads`).
• feat`get_all_products()` on the collection context — download every data product for a collection as a ZIP archive, returned as raw `bytes` (`GET /delivery-api/collections/{collectionId}/products/all`).
• feat`get_products_summary()` on the collection context — download the typed product summary (`GET /delivery-api/collections/{collectionId}/products/summary`).
• fixCorrected `__version__` (was pinned at `1.0.0`) to track the package version.

• feat`getAllProducts()` on the collection context — download every data product for a collection as a ZIP archive, returned as a `Buffer` (`GET /delivery-api/collections/{collectionId}/products/all`).
• featNew typed interfaces: `ProductsSummary`, `SummaryStatement`, `SummaryCustomer`, `SummaryCheck`, `SummaryAccount`, `SummaryTransaction`, `SummaryMonth`.

• feat`getAllProducts()` on the collection context — download every data product for a collection as a ZIP archive, returned as `byte[]` (`GET /delivery-api/collections/{collectionId}/products/all`).
• fixStabilised `NetworkTimeoutTest.testRequestTimeoutThrowsNetworkException` — it now uses a local stalled server socket instead of the external `httpbin.org` endpoint, so the read-timeout assertion no longer fails intermittently.

• fixMaven publish now uploads `.flattened-pom.xml` (via `flatten-maven-plugin`) so consumers resolve `okhttp` and `jackson-databind` transitively from `packages.truid.io`. Previously the raw `pom.xml` upload could leave end-user classpaths without OkHttp at runtime.
• chorePackage registry Lambda@Edge accepts HTTP Basic auth (NuGet, pip) in addition to Bearer.

• choreUpdated `pdoc` documentation generator requirement to `>=15.0.4`

• choreBumped `eslint` 10.3.0 → 10.4.0
• choreBumped `@types/node` 25.7.0 → 25.8.0
• choreBumped `brace-expansion` 5.0.5 → 5.0.6

• choreBumped `maven-shade-plugin` 3.6.0 → 3.6.2
• choreBumped `maven-javadoc-plugin` 3.11.2 → 3.12.0

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

• feat`webhookUrl`, `webhookAuthUrl`, `webhookHeaders`, and `correlation` to `ConnectContext.start()`
• feat`start()` parameters refactored into structured `Consumer`, `Credentials`, and `Webhook` value objects
• fixAdded Javadoc to `AccountPreset`; fixed `@see` reference in `TruIDService`
• fixReplaced raw service IDs with `TruIDService` enum throughout Javadoc examples

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

No language-specific changes beyond the cross-language notes.

• chorePatch release.

• chorePatch release.

• fixResolved mypy type errors in `HTTPClient` and `wait_for()`
• fixFixed proxy connectivity tests to use session-level proxy configuration

• securityUpgraded `axios` to 1.15.2 and `follow-redirects` to 1.16.0

• featJava compilation target lowered from 17 to 11 for broader runtime compatibility
• fixResolved NullPointerException in integration tests

• chorePatch release.

• chorePatch release.

• featProxy configuration now set at client level via a shared `HTTPClient`

• featHTTP proxy support with optional username/password authentication

No language-specific changes beyond the cross-language notes.

• chorePatch release.

• featBinary data product downloads now return `BinaryDownloadResponse` streams instead of buffering whole files into memory.
• featSDK core JSON serialization now uses source-generated metadata instead of reflection-based serializer options.
• featSchema and request option models are now sealed records with init-only data fields, read-only collection surfaces, and unknown JSON response fields preserved through extension-data bags.
• featProduct-summary monetary totals now use `decimal` instead of `double`.
• featAPI keys, client secrets, proxy passwords, and credential passwords are now stored with redacting `SecretString` wrappers and revealed only at deliberate HTTP or JSON serialization boundaries.
• featSDK core diagnostics now use an optional host-supplied callback instead of writing directly to stderr.
• featStart-request correlation behavior is now explicit and tested: webhook correlation maps to the top-level request field, and the standalone `correlation` parameter takes precedence.
• chorePatch release.

• chorePatch release.

• chorePatch release.

• feat`force` optional flag on `StartAsync()` — forces a new collection, bypassing consent/collection reuse.
• feat`correlation` as a standalone parameter on `StartAsync()` — sent as a flat top-level request field, so it can be supplied without a webhook (also still available via the `Webhook` model).

• chorePatch release.

• chorePatch release.

• fixProducts and data download endpoints now use `delivery-api` (was incorrectly routed to `consultant-api`).
• fixStatus polling uses `GET .../statuses/0` and returns a single status object.
• fix`WaitForAsync()` stops on terminal status (`code >= 2000`) or challenge codes, not on progress updates alone.
• fixProduct list responses that are a top-level JSON array are parsed correctly.
• fix`GetDataAsync()` sends `Accept: */*` so JSON data products download without HTTP 406 (was `application/octet-stream`).

• featInitial Python SDK release with full truID Connect API coverage

• featInitial TypeScript / Node.js SDK release with full truID Connect API coverage

• featInitial Java / Maven SDK release with full truID Connect API coverage

• feat`UploadAsync(...)` on the connect context — create a collection by extracting data from PDF bank statements or JSON transaction files (`POST /extracter-api/uploads`).
• feat`GetAllProductsAsync()` on the collection context — download every data product for a collection as a ZIP archive stream (`GET /delivery-api/collections/{collectionId}/products/all`).
• feat`GetProductsSummaryAsync()` on the collection context — download the typed product summary (`GET /delivery-api/collections/{collectionId}/products/summary`).
• featNew typed models: `ProductsSummary`, `SummaryStatement`, `SummaryCustomer`, `SummaryCheck`, `SummaryAccount`, `SummaryTransaction`, `SummaryMonth`.

• fixFixed connect flow to use correct API v4.0 multi-step endpoints.

• fixLicence header version parsing and publish pipeline alignment.

• featInitial .NET SDK release targeting .NET 10.