@delopay/sdk 0.12.0 → 0.13.0

package/dist/index.d.cts

@@ -1378,6 +1378,13 @@ interface ProfileCreateRequest {
     redirect_to_merchant_with_http_post?: boolean | null;
     webhook_details?: Record<string, unknown> | null;
     metadata?: Record<string, unknown> | null;
+    /**
+     * Origins permitted to embed this profile's hosted checkout in an
+     * iframe. Each entry is a full origin (`scheme://host[:port]`, no
+     * path). Empty/null defaults to same-origin only — strict
+     * clickjacking defense.
+     */
+    iframe_allowed_origins?: string[] | null;
 }
 interface ProfileUpdateRequest {
     profile_name?: string | null;
@@ -1388,6 +1395,11 @@ interface ProfileUpdateRequest {
     webhook_details?: Record<string, unknown> | null;
     metadata?: Record<string, unknown> | null;
     payment_link_config?: BusinessPaymentLinkConfig | null;
+    /**
+     * Origins permitted to embed this profile's hosted checkout in an
+     * iframe. See {@link ProfileCreateRequest.iframe_allowed_origins}.
+     */
+    iframe_allowed_origins?: string[] | null;
 }
 interface ProfileResponse {
     merchant_id: string;
@@ -1406,6 +1418,11 @@ interface ProfileResponse {
     payment_response_hash_key?: string | null;
     webhook_details?: Record<string, unknown> | null;
     metadata?: Record<string, unknown> | null;
+    /**
+     * Origins permitted to embed this profile's hosted checkout in an
+     * iframe. See {@link ProfileCreateRequest.iframe_allowed_origins}.
+     */
+    iframe_allowed_origins?: string[] | null;
     [key: string]: unknown;
 }
 type BlocklistAddRequest = {

package/dist/index.d.ts

@@ -1378,6 +1378,13 @@ interface ProfileCreateRequest {
     redirect_to_merchant_with_http_post?: boolean | null;
     webhook_details?: Record<string, unknown> | null;
     metadata?: Record<string, unknown> | null;
+    /**
+     * Origins permitted to embed this profile's hosted checkout in an
+     * iframe. Each entry is a full origin (`scheme://host[:port]`, no
+     * path). Empty/null defaults to same-origin only — strict
+     * clickjacking defense.
+     */
+    iframe_allowed_origins?: string[] | null;
 }
 interface ProfileUpdateRequest {
     profile_name?: string | null;
@@ -1388,6 +1395,11 @@ interface ProfileUpdateRequest {
     webhook_details?: Record<string, unknown> | null;
     metadata?: Record<string, unknown> | null;
     payment_link_config?: BusinessPaymentLinkConfig | null;
+    /**
+     * Origins permitted to embed this profile's hosted checkout in an
+     * iframe. See {@link ProfileCreateRequest.iframe_allowed_origins}.
+     */
+    iframe_allowed_origins?: string[] | null;
 }
 interface ProfileResponse {
     merchant_id: string;
@@ -1406,6 +1418,11 @@ interface ProfileResponse {
     payment_response_hash_key?: string | null;
     webhook_details?: Record<string, unknown> | null;
     metadata?: Record<string, unknown> | null;
+    /**
+     * Origins permitted to embed this profile's hosted checkout in an
+     * iframe. See {@link ProfileCreateRequest.iframe_allowed_origins}.
+     */
+    iframe_allowed_origins?: string[] | null;
     [key: string]: unknown;
 }
 type BlocklistAddRequest = {

package/dist/internal.cjs

@@ -3005,6 +3005,36 @@ var AdminPortal = class {
   async deleteAccount(merchantId) {
     return this.request("DELETE", `/admin-portal/accounts/${encodeURIComponent(merchantId)}`);
   }
+  /**
+   * Create a brand-new user attached to the given merchant. The user is
+   * marked `is_verified = true` so the admin can hand off credentials
+   * immediately — no email round-trip is sent.
+   */
+  async createUserForMerchant(customerId, body) {
+    return this.request(
+      "POST",
+      `/admin-portal/customers/${encodeURIComponent(customerId)}/users`,
+      { body }
+    );
+  }
+  /**
+   * Edit a user record. Any subset of fields may be supplied. `role_id`
+   * requires `merchant_id`. `password` triggers a password reset (validated
+   * against signup policy + JWT blacklist). `reset_2fa` clears TOTP state
+   * so the user re-enrolls on next login. `is_active` supports both
+   * directions: false soft-disables, true reactivates a soft-disabled user.
+   */
+  async updateUser(userId, body) {
+    return this.request("PATCH", `/admin-portal/users/${encodeURIComponent(userId)}`, { body });
+  }
+  /**
+   * Soft-delete a user globally: deactivates the row, blacklists existing
+   * JWTs, and wipes credentials. Distinct from `deleteUserRole`, which
+   * removes a single role binding while leaving the user signed-in elsewhere.
+   */
+  async deleteUser(userId) {
+    return this.request("DELETE", `/admin-portal/users/${encodeURIComponent(userId)}`);
+  }
 };
 
 // src/internal/resources/auditLogs.ts