@delopay/sdk 0.100.0 → 0.100.2

package/dist/index.cjs

@@ -219,8 +219,7 @@ var ApiKeys = class {
   // JWT-authenticated routes under `/account/{merchantId}/profile/api-keys`.
   // The caller's shop (business profile) comes from the JWT, never from the
   // request, so a shop-scoped user can only mint/list/manage keys pinned to
-  // their own shop. Requires a backend with profile-scoped API key support
-  // (DeloPay-net/delopay-backend#344).
+  // their own shop. Requires a backend with profile-scoped API key support.
   /**
    * Create a new API key pinned to the caller's shop (business profile).
    * `POST /account/{merchantId}/profile/api-keys`
@@ -5725,7 +5724,7 @@ var CheckoutSession = class {
    * own types and runtime gates — hence the loose return type.
    *
    * `theme` is the route's one declared query parameter (a named checkout
-   * variant, backend#793). `locale` travels as `Accept-Language` — the only
+   * variant). `locale` travels as `Accept-Language` — the only
    * channel the backend's locale resolution reads; a `?locale=` query is
    * silently ignored by this route.
    *
@@ -5880,10 +5879,17 @@ var CheckoutSession = class {
   /**
    * A short-lived VGS Collect session for browser-side card capture.
    *
-   * A 404 — or a 400 carrying the "shop has no vault" code — means the shop
-   * has no vault configured; other errors must NOT be treated that way (a
-   * refused vault falling back to an unprotected card pane is exactly the
-   * bug this endpoint's error contract exists to prevent).
+   * **Exactly one refusal means "this shop has no vault": a 400 carrying
+   * `IR_19`.** Every other refusal means a vault exists and could not be used,
+   * and answering it by falling back to the processor's own card pane sends an
+   * unprotected card number to the very processor the shop pays to hide it
+   * from — the bug this endpoint's error contract exists to prevent.
+   *
+   * A **404 is not benign.** The router answers it when the shop's vault
+   * account cannot be found — the state a shop is left in when its vault
+   * connector is deleted while the profile keeps naming the id: it still
+   * reports the vault as enabled and still expects its cards cloaked. The same
+   * status also covers a payment that does not exist.
    *
    * `GET /payment-link/{merchantId}/{paymentId}/vault/collect-session`
    */