Identity PF/PJ fields + complete v2 transactions coverage (plus toolchain modernization: pnpm 11, TS 6, jest 30, eslint flat config)

[cernadasjuan]

Summary

Adds the new Pluggy API 0.24 identity PF/PJ fields and modernizes the entire SDK toolchain. The runtime surface is backward-compatible for Node 12+ consumers (engines.node unchanged); everything else is dev/CI tooling, supply-chain hardening, or additive feature work. After this PR, pnpm audit is fully clean (0/0/0/0) and CI fails on any vulnerability regression.

Feature changes (consumer-visible)

• Identity PF/PJ fields — surfaces the new fields exposed by Pluggy API 0.24 in Identity (this branch's original commit).
• fetchTransactionsCursor / fetchAllTransactions filters — expose dateTo and ids (max 500) on TransactionCursorFilters, matching GET /v2/transactions fully.
• fetchTransactions is now @deprecated — IDEs will show the page-based method struck through and point callers at the cursor-based replacements. Method itself is retained for backward compatibility.
• engines.node: ">=12.0.0" — explicit floor (matches what jsonwebtoken@9 requires today, which was already the implicit minimum). No published version had declared engines, so this is documenting reality, not narrowing support.
• jsonwebtoken 9.0.2 → 9.0.3 — pulls in patched jws@4 and resolves a known advisory on the runtime path.

Package manager: pnpm 11 + supply-chain hardening

• Migrate from npm to pnpm 11 (corepack-managed via the packageManager field).
• New pnpm-workspace.yaml enforces:
  • minimumReleaseAge: 14d (versions younger than 14 days are rejected at resolve time; one short-term CVE bypass active until 2026-05-22).
  • trustPolicy: no-downgrade with a 90-day expiration window.
  • engineStrict: true, blockExoticSubdeps: true, exact pinning via savePrefix: "".
  • allowBuilds — postinstall scripts are denied by default; each one needs an explicit decision (unrs-resolver is documented as false).
• package-lock.json and .npmrc removed; .gitignore blocks npm/yarn lockfiles from creeping back in.

TypeScript: 4.6.2 → 6.0.3 + tsconfig split

• TS upgrade required a few tsconfig adjustments: explicit rootDir, moduleResolution: node10 + ignoreDeprecations: "6.0", esModuleInterop: true, isolatedModules: true (needed by ts-jest with module: node16), and an explicit strict: false to preserve previous laxness (TS 6 flipped strict to true by default — enabling it surfaces real but unrelated null-handling work).
• target: "ES2019", lib: ["ES2019"], module: "node16" — Microsoft-recommended config for Node 12 consumers. Output stays CommonJS because the package has no "type": "module".
• Split into two tsconfigs:
  • tsconfig.json — used by the IDE and ts-jest. Includes src/ and tests/, noEmit: true. Fixes editor "Cannot find name 'describe'" errors on test files.
  • tsconfig.build.json — used by pnpm run build. Emits only src/ to dist/.
• Tests/utils updated: import * as nock from 'nock' → import nock from 'nock' (TS 6 rejects calling a namespace import).
• src/baseApi.ts adds a one-line decoded.payload as jwt.JwtPayload cast required by the stricter @types/jsonwebtoken@9 types — Pluggy-minted JWTs always carry a JSON payload, so the cast just teaches the compiler the invariant that the v8 types silently assumed.

Jest 30 + dev-dep modernization

• jest 29.7.0 → 30.3.0, ts-jest 29.2.4 → 29.4.9, @types/jest 29.5.12 → 30.0.0.
• @types/node 16.18.78 → 16.18.126 (closest match to engines.node that compiles cleanly with TS 6 — the @types/node@12 stream pre-dates TS 6 lib types and fails to build).
• @types/jsonwebtoken 8.5.4 → 9.0.10 (aligns with jsonwebtoken@9).
• nock 13.5.4 → 14.0.15, dotenv 16.4.5 → 17.4.2 (with quiet: true in setupTests.ts to suppress the v17 runtime banner).
• semantic-release 22.0.12 → 25.0.3 plus all @semantic-release/* plugins to their current latest. No release config changes required (the release block in package.json uses defaults; cosmiconfig file-relocation BC of v23 does not apply, and v11 / v14 preset BC for commit-analyzer / release-notes-generator does not apply either).
• Dropped unused ts-node from root devDeps (no script invokes it; jest.config.js is JS, ts-jest is unrelated to ts-node). The example/ workspace keeps its own copy.
• Bumped devEngines.runtime.version to >=24.10.0 (required by pnpm@11.1.3 and semantic-release@25).

ESLint: migrate to flat config + Node API guardrail

• Migrate .eslintrc.js → eslint.config.js (required by eslint 9+).
• @typescript-eslint/eslint-plugin and @typescript-eslint/parser 2.16.0 → 8.59.2; eslint 10.0.3 → 10.3.0; new deps: typescript-eslint, @eslint/js, globals.
• Preserves the previous rule set: same recommended presets, plus targeted offs for no-require-imports (net-new in v8 recommended) and no-unused-vars (v8 now flags const arrays consumed only by typeof X[number], a pattern used throughout src/types/*).
• New: eslint-plugin-n with no-unsupported-features/{node,es}-builtins scoped to src/**/*.ts. Reads engines.node and statically rejects any Node API call that is not available in the supported range (e.g. fs.promises.cp would fail). Closes the gap left by @types/node (which describes a specific Node version and cannot truly constrain to Node 12).
• eslint-plugin-n@17.24.0 chosen instead of v18 because v18 is ESM-only and incompatible with our CJS eslint.config.js.

Supply-chain: dev-tree vulnerability cleanup

Patches transitive dev-dependency vulnerabilities reaching us through the @semantic-release/* tree (notably the unmaintained @semantic-release/git@10.0.1) and the jest tree, plus one in the eslint tree. All patches are applied via pnpm overrides pinned to exact versions — range overrides like >=1.1.13 cause pnpm to pick the latest matching version, which breaks semver against parents declaring ^1.x. Affected dev-only deps include lodash, lodash-es, braces, micromatch, @babel/helpers, js-yaml, brace-expansion. The single runtime-path advisory is handled separately by the jsonwebtoken bump documented above.

Final audit state: pnpm audit reports 0 critical / 0 high / 0 moderate / 0 low, and pnpm audit signatures verifies all 701 packages. One override (brace-expansion@5.0.6) is currently 13 days old and is allow-listed in minimumReleaseAgeExclude with a # Remove after 2026-05-22 note (the day the 14-day window closes on the fixed version).

CI workflows

• actions/checkout@v4 → v6.0.2 (pinned), actions/setup-node@v4 → v6.4.0 (pinned).
• Node version bumped to 24 in both workflows (required by pnpm 11 and semantic-release v25).
• Switched install from npm ci to pnpm install --frozen-lockfile; pnpm activated via corepack enable followed by a second setup-node call for the cache: 'pnpm' to find it.
• release.yml now runs the strict supply-chain audit step (pnpm audit && pnpm audit signatures) before the release. Any vulnerability at any severity fails the release.
• integration-tests.yml now runs the same audit step on its daily schedule, catching newly-disclosed advisories that land between releases.
• release.yml uses pnpm exec semantic-release instead of npx.

Documentation

• README.md declares the minimum supported Node version (>=12.0.0).
• CLAUDE.md refreshed with:
  • Lint footgun (pnpm run lint reformats src/ via prettier@1.19.1; use pnpm exec eslint . to lint without touching formatting).
  • TypeScript & build setup (two-tsconfig pattern, strict: false rationale, Node-12 target).
  • Supply-chain section (workspace yaml rules + reminder to revisit overrides on dep bumps).
  • Node version surface (engines vs devEngines vs @types/node vs eslint-plugin-n).
  • Updated transactions row in the methods table.
  • Refreshed "Last Updated" + SDK Status to mention identity PF/PJ and v2 cursor coverage.

Test plan

• pnpm install --frozen-lockfile succeeds on a clean checkout (Node 24+).
• pnpm run build produces a clean dist/ (CJS, declarations, no test files).
• pnpm test — 11/11 passing locally.
• pnpm run audit:supply-chain — No known vulnerabilities found and all 701 signatures verified.
• CI release.yml job passes on this branch when merged to master (strict audit gate is the riskiest piece — if a new advisory drops before release, it will fail and need a follow-up override).
• CI integration-tests.yml scheduled run passes.
• Spot-check that the existing examples in example/ still build (they have their own package.json and are untouched, but the SDK they import was rebuilt).

Follow-ups (not in this PR)

• Remove brace-expansion from minimumReleaseAgeExclude after 2026-05-22 (the patched version turns 14 days old).
• Prettier bump (1.19.1 is from 2019, deprecated) — would mass-reformat 19 files, so left for a dedicated PR.
• Enabling TypeScript strict: true — would surface real null-handling work, especially around jwt.decode and class member initialization. Belongs in a focused PR.
• Add Node 12 / 14 to the test matrix in CI as a runtime safety net behind eslint-plugin-n (currently only Node 24 is tested).

🤖 Generated with Claude Code

[jhonatan-pluggy]

LGTM