@delopay/sdk 0.137.0 → 0.138.0

package/dist/internal.d.ts

@@ -1081,6 +1081,490 @@ interface AdminAuditLogExportRecord {
     entity_id: string | null;
     entity_name: string | null;
 }
+/**
+ * Which environment's rows to return.
+ *
+ * **`'all'` is never a default.** The page opens on `DEFAULT_ENV_FILTER` —
+ * live on production, test on the sandbox tenant — and sends the value
+ * explicitly. Omitting the field is read by the backend as `'live'`, not as
+ * `'all'`: a caller that forgot to say gets the safer of the two, and a test
+ * payment never appears in a view that reads as live.
+ */
+type DiagnosticEnvironment = 'all' | 'live' | 'test';
+/** The window every tab reads over. ISO 8601, inclusive at both ends. */
+interface DiagnosticWindow {
+    start_time: string;
+    end_time: string;
+}
+/** One page of a list. The console pages at 20; the backend caps `limit` at 200. */
+interface DiagnosticPage {
+    limit?: number;
+    offset?: number;
+}
+/**
+ * A paginated answer.
+ *
+ * `hidden_by_environment` is what lets the environment strip say "612 test-mode
+ * rows are hidden". An operator who cannot see how much is being withheld
+ * cannot tell an empty tab from a filtered one.
+ */
+interface DiagnosticList<T> {
+    rows: T[];
+    total_count: number;
+    hidden_by_environment: number;
+}
+/**
+ * Why a panel has no data, when the reason is not "there is none".
+ *
+ * The distinction this type exists for: **an unreachable log store must never
+ * render as "no errors found"**. Loki being down and Loki answering zero lines
+ * are opposite facts during an incident, and the second tells an operator to
+ * stop looking.
+ */
+interface DiagnosticSourceUnavailable {
+    /** `loki`, `alertmanager`, `analytics`, or a writer that is switched off. */
+    source: string;
+    /** The endpoint that did not answer, so it can be reached directly. */
+    endpoint: string | null;
+    reason: string;
+    last_success: string | null;
+    /** Where to go instead — Grafana, when one is configured. */
+    fallback_url: string | null;
+}
+/**
+ * A panel that either has data or says why it does not.
+ *
+ * Deliberately not `T | null`: a caller cannot tell an absent value from an
+ * absent source by looking at a nullable, and collapsing the two is how a dead
+ * log store comes to read as a quiet one.
+ */
+type DiagnosticPanel<T> = {
+    status: 'available';
+    data: T;
+} | {
+    status: 'unavailable';
+    data: DiagnosticSourceUnavailable;
+};
+/** Filters shared by every list request. */
+interface DiagnosticListParamsBase {
+    window?: DiagnosticWindow;
+    environment?: DiagnosticEnvironment;
+    page?: DiagnosticPage;
+}
+interface DiagnosticIncomingWebhookListParams extends DiagnosticListParamsBase {
+    merchant_id?: string;
+    profile_id?: string;
+    connector?: string[];
+    /** `applied` | `ignored` | `duplicate` | `rejected` | `dropped` | `error`. */
+    outcome?: string[];
+    provider_event_type?: string;
+    mapped_event_type?: string;
+    /** Any id the operator pasted, matched against every column it could be. */
+    object_id?: string;
+    request_id?: string;
+    /**
+     * `false` selects rows that failed verification **or** never reached it.
+     * "Show me what did not verify" must include the deliveries that failed
+     * before verification was attempted.
+     */
+    source_verified?: boolean;
+}
+interface DiagnosticIncomingWebhook {
+    event_id: string;
+    received_at: string;
+    merchant_id: string;
+    profile_id: string | null;
+    merchant_connector_id: string | null;
+    connector: string;
+    request_id: string;
+    /**
+     * Their event string. `null` means it could not be read off the body, which
+     * is an answer rather than a failure — there is no connector method that
+     * hands back a provider's own event name.
+     */
+    provider_event_type: string | null;
+    provider_event_id: string | null;
+    /** Ours. `null` is an unmapped event type, which the page tints amber. */
+    mapped_event_type: string | null;
+    object_type: string | null;
+    object_ref_id: string | null;
+    resolved_payment_id: string | null;
+    resolved_attempt_id: string | null;
+    /**
+     * `null` means verification was never attempted — a different fact from
+     * `false`, which means it was attempted and did not match.
+     */
+    source_verified: boolean | null;
+    outcome: string;
+    outcome_detail: string | null;
+    response_status: number;
+    latency_ms: number;
+    /**
+     * `true` only when the row is positively marked test. The TEST badge gates on
+     * this and never on the absence of it.
+     */
+    test_mode: boolean | null;
+}
+/** One delivery in full — what the row drawer draws. */
+interface DiagnosticIncomingWebhookDetail extends DiagnosticIncomingWebhook {
+    /** Masked. Credential headers were replaced before storage; signatures were not. */
+    headers: Record<string, unknown>;
+    /** Masked on read as well as encrypted at rest. */
+    body: Record<string, unknown>;
+    /**
+     * Which secret verified, in which environment, and whether the entity
+     * matched. Never the secret itself — the fingerprint is a digest.
+     */
+    verification_detail: Record<string, unknown> | null;
+    /**
+     * The router log lines for this delivery. `null` when the log store is
+     * unreachable, which the drawer must render as *unavailable* rather than as
+     * "the router logged nothing".
+     */
+    router_logs: DiagnosticRouterLog[] | null;
+    router_logs_unavailable: DiagnosticSourceUnavailable | null;
+}
+interface DiagnosticConnectorCallListParams extends DiagnosticListParamsBase {
+    merchant_id?: string;
+    connector?: string[];
+    flow?: string[];
+    payment_id?: string;
+    attempt_id?: string;
+    request_id?: string;
+    /** Inclusive. `400` is "everything that failed". */
+    status_code_min?: number;
+    /** Exclusive, so `[400, 500)` selects client errors alone. */
+    status_code_max_exclusive?: number;
+    min_latency_ms?: number;
+}
+interface DiagnosticConnectorCall {
+    id: string;
+    started_at: string;
+    merchant_id: string;
+    connector: string;
+    flow: string;
+    method: string;
+    url: string;
+    status_code: number;
+    latency_ms: number;
+    payment_id: string | null;
+    attempt_id: string | null;
+    refund_id: string | null;
+    dispute_id: string | null;
+    request_id: string;
+    test_mode: boolean | null;
+    /**
+     * Present on the single-call read only, and masked. List rows omit them so a
+     * page of twenty does not ship twenty payloads the table never renders.
+     */
+    request?: unknown;
+    response?: unknown;
+    error?: unknown;
+}
+interface DiagnosticRouterLogParams {
+    window?: DiagnosticWindow;
+    page?: DiagnosticPage;
+    /** `router`, `scheduler`, `drainer`. */
+    service?: string[];
+    hostname?: string[];
+    level?: string[];
+    flow?: string;
+    merchant_id?: string;
+    request_id?: string;
+    contains?: string;
+    collapse_duplicates?: boolean;
+}
+interface DiagnosticRouterLog {
+    time: string;
+    level: string;
+    service: string;
+    hostname: string | null;
+    flow: string | null;
+    merchant_id: string | null;
+    request_id: string | null;
+    message: string;
+    /**
+     * How many identical messages this row stands for. `null` means one line —
+     * never `1`, which the page would render as a count badge on every row.
+     */
+    repeat: number | null;
+}
+interface DiagnosticPaymentListParams extends DiagnosticListParamsBase {
+    merchant_id?: string;
+    profile_id?: string;
+    connector?: string[];
+    status?: string[];
+    error_code?: string;
+    /** Non-terminal for at least this long. Omit to show failures alone. */
+    stuck_minutes?: number;
+}
+interface DiagnosticPayment {
+    payment_id: string;
+    merchant_id: string;
+    profile_id: string | null;
+    merchant_name: string | null;
+    profile_name: string | null;
+    connector: string | null;
+    payment_method: string | null;
+    payment_method_type: string | null;
+    card_network: string | null;
+    card_last4: string | null;
+    amount: number;
+    amount_captured: number | null;
+    currency: string | null;
+    status: string;
+    attempt_count: number;
+    error_code: string | null;
+    error_message: string | null;
+    /**
+     * `null` when no `gateway_status_map` row maps the connector's code, which
+     * the page renders amber: the merchant saw a raw processor string.
+     */
+    unified_code: string | null;
+    unified_message: string | null;
+    created_at: string;
+    modified_at: string;
+    age_seconds: number;
+    test_mode: boolean | null;
+}
+interface DiagnosticErrorCodeCount {
+    code: string;
+    count: number;
+    /**
+     * The same code over the previous window of equal length. `null` renders as
+     * "new" — the code did not appear before, which zero would misreport as a
+     * measured fall to nothing.
+     */
+    previous_count: number | null;
+    unmapped: boolean;
+}
+/** Which diagnostic writers are recording on this deployment. */
+interface DiagnosticCaptureState {
+    incoming_webhooks: boolean;
+    connector_calls: boolean;
+    router_logs: boolean;
+}
+interface DiagnosticOutgoingWebhookListParams extends DiagnosticListParamsBase {
+    merchant_id?: string;
+    profile_id?: string;
+    object_id?: string;
+    event_type?: string[];
+    delivery?: 'delivered' | 'retrying' | 'stopped';
+}
+interface DiagnosticOutgoingAttempt {
+    event_id: string;
+    created_at: string;
+    delivered: boolean | null;
+    /** `events` records whether an attempt was notified, not what the shop answered. */
+    response_status: number | null;
+}
+interface DiagnosticOutgoingWebhook {
+    event_id: string;
+    initial_attempt_id: string | null;
+    created_at: string;
+    merchant_id: string | null;
+    profile_id: string | null;
+    event_type: string;
+    object_id: string;
+    object_type: string;
+    /** Not carried on the event row — the URL lives on the profile and is re-read per attempt. */
+    endpoint: string | null;
+    /** One entry per attempt, oldest first — the row of squares the page draws. */
+    attempts: DiagnosticOutgoingAttempt[];
+    delivered: boolean | null;
+    delivery_terminal_reason: string | null;
+    test_mode: boolean | null;
+}
+interface DiagnosticOutgoingWebhookSummary {
+    delivered_count: number;
+    total_count: number;
+    retrying_count: number;
+    stopped_count: number;
+    worst_endpoint: string | null;
+    worst_endpoint_failures: number;
+}
+interface DiagnosticQueueListParams {
+    page?: DiagnosticPage;
+    name?: string[];
+    runner?: string[];
+    status?: string[];
+    overdue_only?: boolean;
+    tracking_id?: string;
+}
+interface DiagnosticQueueItem {
+    id: string;
+    name: string | null;
+    runner: string | null;
+    tracking_id: string;
+    retry_count: number;
+    status: string;
+    business_status: string;
+    schedule_time: string;
+    /** Negative when overdue — the case the page tints. */
+    due_in_seconds: number;
+    created_at: string;
+}
+interface DiagnosticQueueSummary {
+    pending_count: number;
+    processing_count: number;
+    retrying_count: number;
+    finished_in_window: number;
+    oldest_overdue_seconds: number | null;
+    /** Approvals waiting on a person — a different queue with a different remedy. */
+    pending_approvals: number;
+}
+interface DiagnosticChangeListParams {
+    window?: DiagnosticWindow;
+    page?: DiagnosticPage;
+    merchant_id?: string;
+    kind?: string[];
+}
+interface DiagnosticChange {
+    id: string;
+    occurred_at: string;
+    /** `connector` | `routing` | `fees` | `access` | `config`. */
+    kind: string;
+    summary: string;
+    /** `null` for a change no person made — a scheduled job. A fact, not a gap. */
+    actor: string | null;
+    merchant_id: string | null;
+    profile_id: string | null;
+}
+type DiagnosticHealthState = 'healthy' | 'degraded' | 'failing' | 'unknown';
+interface DiagnosticHealthTile {
+    subject: string;
+    state: DiagnosticHealthState;
+    /** Already formatted — "4/4", "61.3%", "Stalled". The unit differs per tile. */
+    value: string;
+    delta: string | null;
+    note: string | null;
+    spark: number[];
+}
+type DiagnosticAttentionSeverity = 'critical' | 'warning' | 'watch';
+interface DiagnosticAttentionItem {
+    id: string;
+    severity: DiagnosticAttentionSeverity;
+    title: string;
+    detail: string;
+    scope: string;
+    count: number;
+    count_unit: string;
+    amount_at_risk: number | null;
+    currency: string | null;
+    shops_touched: number;
+    since_seconds: number | null;
+    /** The filter set Investigate applies. Opaque to the backend. */
+    investigate: Record<string, unknown>;
+}
+interface DiagnosticAttentionBoard {
+    items: DiagnosticAttentionItem[];
+    computed_at: string;
+    /**
+     * What was checked, so an empty board reads as a verdict rather than as a
+     * panel that failed to load. A check that could not run is absent from this
+     * list rather than silently counted as clear.
+     */
+    checks_run: string[];
+    vitals: DiagnosticHealthTile[];
+}
+interface DiagnosticAttentionParams {
+    window?: DiagnosticWindow;
+    environment?: DiagnosticEnvironment;
+}
+interface DiagnosticFiringAlert {
+    name: string;
+    /** From the alert's own labels. This service does not re-rank Alertmanager. */
+    severity: string;
+    summary: string;
+    firing_since: string;
+    labels: Record<string, unknown>;
+}
+interface DiagnosticReplicaHealth {
+    hostname: string;
+    version: string | null;
+    build: string | null;
+    state: DiagnosticHealthState;
+    dependencies: [string, string][];
+}
+interface DiagnosticDependencyCard {
+    subject: string;
+    value: string;
+    unit: string;
+    fraction: number | null;
+    state: DiagnosticHealthState;
+    note: string | null;
+}
+interface DiagnosticInfrastructure {
+    replicas: DiagnosticReplicaHealth[];
+    /** A finding in its own right: one replica answering differently explains a lot. */
+    build_mismatch: boolean;
+    dependencies: DiagnosticDependencyCard[];
+}
+interface DiagnosticNearMatch {
+    id: string;
+    kind: string;
+    description: string;
+}
+interface DiagnosticEmptyReason {
+    /** `outside_window` | `test_mode` | `typo`. */
+    code: string;
+    /** The one-click fix. `null` for `typo`, which has none. */
+    fix: Record<string, unknown> | null;
+}
+/**
+ * What the search box decided a pasted id is.
+ *
+ * `kind` says what it looks like; `found` says whether a row exists. Different
+ * answers, drawn differently: a well-shaped id that matches nothing gets the
+ * three reasons and their fixes, never an empty table.
+ */
+interface DiagnosticResolvedId {
+    id: string;
+    kind: string | null;
+    found: boolean;
+    near_matches: DiagnosticNearMatch[];
+    reasons: DiagnosticEmptyReason[];
+}
+interface DiagnosticTraceSpan {
+    source: string;
+    label: string;
+    started_at: string;
+    /** `null` for a span that has not finished — an enqueued job still unpicked. */
+    duration_ms: number | null;
+    depth: number;
+    failed: boolean;
+    detail: Record<string, unknown> | null;
+}
+interface DiagnosticTrace {
+    resolved: DiagnosticResolvedId;
+    payment_id: string | null;
+    spans: DiagnosticTraceSpan[];
+    /**
+     * Sources that could not be read. A waterfall with an unexplained gap reads
+     * as a period when nothing happened, which is the wrong conclusion.
+     */
+    unavailable_sources: DiagnosticSourceUnavailable[];
+}
+/**
+ * Unmask one field of one object.
+ *
+ * `reason` is required and stored verbatim on the audit row: an unmask nobody
+ * can review afterwards is a timestamp, not a record.
+ */
+interface DiagnosticRevealRequest {
+    /** `incoming_webhook` | `connector_call`. */
+    object_type: string;
+    object_id: string;
+    /** A JSON pointer into the stored document, e.g. `/data/object/customer`. */
+    field_path: string;
+    reason: string;
+}
+interface DiagnosticRevealResponse {
+    field_path: string;
+    value: unknown;
+    /** The audit row this reveal wrote. */
+    audit_log_id: string;
+}
 
 declare class Admin {
     private readonly request;
@@ -1519,6 +2003,182 @@ declare class ConnectorRestrictions {
     }>;
 }
 
+/**
+ * The diagnostic console (todos#122) — everything the router did, without a
+ * shell.
+ *
+ * Cross-merchant by construction: one call answers across every merchant on the
+ * deployment. The backend gates that on the `Diagnostic` permission, which is
+ * granted to DeloPay's internal staff roles alone, which is why this lives in
+ * `@delopay/sdk/internal` and never on the merchant-facing client.
+ *
+ * ## Two shapes worth knowing before you call anything
+ *
+ * **Lists answer {@link DiagnosticList}**, which carries `hidden_by_environment`
+ * beside the rows. That number is what lets a UI say "612 test-mode rows are
+ * hidden" rather than leaving an operator unable to tell an empty tab from a
+ * filtered one.
+ *
+ * **Two reads answer {@link DiagnosticPanel} instead** — {@link routerLogs} and
+ * {@link alerts} — because their sources can be down independently of the
+ * router. A panel is `available` with data or `unavailable` with a reason, and
+ * that distinction is the whole point: **an unreachable log store must never be
+ * rendered as "no errors found"**, and a `T[]` gives a caller no way to tell the
+ * two apart.
+ *
+ * ## The environment filter
+ *
+ * Every list takes `environment`. Omitting it is read by the backend as
+ * `'live'`, never as `'all'` — a caller that forgot to say gets the safer of the
+ * two, and a test payment never appears in a view that reads as live.
+ */
+declare class Diagnostic {
+    private readonly request;
+    constructor(request: RequestFn);
+    /**
+     * The ranked attention board — the page's landing state, with nothing typed.
+     *
+     * Always carries `checks_run` and `vitals`, so an empty `items` reads as
+     * "checked these things at 14:02, all clear" rather than as a panel that
+     * failed to load. A check that could not run is **absent** from `checks_run`
+     * rather than silently counted as clear.
+     */
+    attention(body?: DiagnosticAttentionParams): Promise<DiagnosticAttentionBoard>;
+    /**
+     * Provider webhooks received, across every merchant.
+     *
+     * `source_verified: false` selects rows that failed verification **or** never
+     * reached it — the deliveries that failed before verification was attempted
+     * are exactly the ones an operator opens this tab for.
+     */
+    listIncomingWebhooks(body?: DiagnosticIncomingWebhookListParams): Promise<DiagnosticList<DiagnosticIncomingWebhook>>;
+    /**
+     * One delivery in full: masked headers and body, the verification verdict,
+     * and the router log lines for its request id.
+     *
+     * `router_logs` is `null` — not `[]` — when the log store is unreachable, and
+     * `router_logs_unavailable` then says why. Render the first as *unavailable*,
+     * never as "the router logged nothing".
+     */
+    getIncomingWebhook(eventId: string): Promise<DiagnosticIncomingWebhookDetail>;
+    /** Shop webhooks sent, across every merchant, with each event's attempts folded in. */
+    listOutgoingWebhooks(body?: DiagnosticOutgoingWebhookListParams): Promise<DiagnosticList<DiagnosticOutgoingWebhook>>;
+    /**
+     * The four tiles above the shop-webhooks table.
+     *
+     * Counted under the same window and environment as the table but **without**
+     * its delivery filter — the tiles say what the window holds, and applying the
+     * filter would make every tile agree with whichever one is selected.
+     */
+    outgoingWebhookSummary(body?: DiagnosticOutgoingWebhookListParams): Promise<DiagnosticOutgoingWebhookSummary>;
+    /**
+     * Connector calls the router made.
+     *
+     * List rows carry no payload. Fetch one with {@link getConnectorCall} for the
+     * masked request and response.
+     */
+    listConnectorCalls(body?: DiagnosticConnectorCallListParams): Promise<DiagnosticList<DiagnosticConnectorCall>>;
+    /** One connector call, with its masked payloads. */
+    getConnectorCall(id: string): Promise<DiagnosticConnectorCall>;
+    /**
+     * Router logs, proxied from the deployment's log store.
+     *
+     * Answers a {@link DiagnosticPanel}. Check `status` before reading `data`:
+     * `'unavailable'` means the store did not answer, which is the opposite of
+     * "there were no errors" and must be rendered as such.
+     */
+    routerLogs(body?: DiagnosticRouterLogParams): Promise<DiagnosticPanel<DiagnosticList<DiagnosticRouterLog>>>;
+    /**
+     * Payments that are stuck or failed.
+     *
+     * Stuck means non-terminal for longer than `stuck_minutes`; failed means it
+     * ended without succeeding inside the window. Omitting `stuck_minutes` turns
+     * the first arm off rather than widening it.
+     */
+    listPayments(body?: DiagnosticPaymentListParams): Promise<DiagnosticList<DiagnosticPayment>>;
+    /**
+     * The error codes in this window, each with its count in the previous window
+     * of equal length.
+     *
+     * `previous_count: null` means the code did not appear before — render it as
+     * "new" rather than as a fall to zero.
+     */
+    paymentErrorCodes(body?: DiagnosticPaymentListParams): Promise<DiagnosticErrorCodeCount[]>;
+    /**
+     * Everything about one payment, in one call: the payment, its attempts, its
+     * status history, its client context, and what it produced — connector calls,
+     * webhooks both ways, and scheduler jobs.
+     *
+     * Read `diagnostic_capture` before rendering an empty section. A payment with
+     * no connector calls and a deployment that never recorded any are different
+     * facts, and the second must not read as the first.
+     *
+     * Typed loosely on purpose: the payment, attempts, status-history and
+     * client-context halves are the merchant-facing shapes this package already
+     * exports, and re-declaring them here would give consumers two names for one
+     * thing that could then drift apart.
+     */
+    getPayment(paymentId: string): Promise<Record<string, unknown>>;
+    /** Scheduler tasks, most overdue first. */
+    listQueues(body?: DiagnosticQueueListParams): Promise<DiagnosticList<DiagnosticQueueItem>>;
+    /**
+     * The four tiles above the queues table, plus the approvals count.
+     *
+     * `pending_approvals` is a **different** queue from `pending_count`: a stalled
+     * scheduler needs a consumer, a full approvals queue needs a person, and
+     * folding them into one number would point an operator at the wrong fix.
+     */
+    queueSummary(): Promise<DiagnosticQueueSummary>;
+    /**
+     * Replicas and their dependencies.
+     *
+     * `build_mismatch` is computed server-side rather than left for a caller to
+     * notice by comparing strings: one replica in four answering differently
+     * explains a whole class of "it only fails sometimes" incident, and is
+     * invisible unless something says it out loud.
+     */
+    infrastructure(): Promise<DiagnosticInfrastructure>;
+    /**
+     * Firing alerts, proxied from Alertmanager.
+     *
+     * Answers a {@link DiagnosticPanel} for the same reason {@link routerLogs}
+     * does: a strip that renders empty because Alertmanager is down says "nothing
+     * is firing", which is the most dangerous sentence this page could print.
+     */
+    alerts(): Promise<DiagnosticPanel<DiagnosticFiringAlert[]>>;
+    /** Config edits and admin actions inside the window. */
+    listChanges(body?: DiagnosticChangeListParams): Promise<DiagnosticList<DiagnosticChange>>;
+    /**
+     * What a pasted id is, and whether we hold it.
+     *
+     * `kind` and `found` are separate answers on purpose. A well-shaped id that
+     * matches nothing comes back `found: false` with the three `reasons` and
+     * their fixes — render that, never an empty table, which reads as "no such
+     * payment" when the real answer is "outside the window" or "it is a test
+     * payment".
+     */
+    resolveId(id: string): Promise<DiagnosticResolvedId>;
+    /**
+     * One id across every source, as an ordered span list.
+     *
+     * Accepts a payment, attempt, event or request id. Sources that could not be
+     * read are named in `unavailable_sources` rather than left out: a waterfall
+     * with an unexplained gap reads as a period when nothing happened.
+     */
+    trace(id: string): Promise<DiagnosticTrace>;
+    /**
+     * Unmask one field of one object.
+     *
+     * **Writes an audit row** naming the operator, the field and the object,
+     * before the value is returned — a reveal that could not be audited does not
+     * happen. Needs a dashboard JWT holding `DiagnosticReveal`; an admin API key
+     * cannot call it, because an API key names no person.
+     *
+     * `reason` is required and is stored verbatim.
+     */
+    reveal(body: DiagnosticRevealRequest): Promise<DiagnosticRevealResponse>;
+}
+
 declare class Gsm {
     private readonly request;
     constructor(request: RequestFn);
@@ -1747,6 +2407,12 @@ declare class DelopayInternal extends Delopay {
     readonly connectorRestrictions: ConnectorRestrictions;
     /** Per-shop / per-project connector allow-deny rules (routing-time). */
     readonly connectorRestrictionRules: ConnectorRestrictionRules;
+    /**
+     * The diagnostic console — everything the router did, without a shell
+     * (todos#122). Cross-merchant, and gated on the staff-only `Diagnostic`
+     * permission.
+     */
+    readonly diagnostic: Diagnostic;
     /** GSM (Gateway Status Mapping) routing rules. */
     readonly gsm: Gsm;
     /** Admin-only ledger credits/debits against a merchant's balance. */
@@ -1756,4 +2422,4 @@ declare class DelopayInternal extends Delopay {
     constructor(...args: ConstructorParameters<typeof Delopay>);
 }
 
-export { Admin, type AdminAdjustmentRequest, type AdminAdjustmentResponse, type AdminAnalyticsRequest, type AdminAttachVaultRequest, type AdminAttachVaultResponse, type AdminAttemptProcessorCost, type AdminAttemptProcessorCostBase, type AdminAttemptProcessorCostKnown, type AdminAttemptProcessorCostUnrecorded, type AdminAttemptProcessorCostWithoutFigure, type AdminAuditLogExportRecord, type AdminCreateLedgerRequest, type AdminCreateLedgerResponse, type AdminCreateUserForMerchantRequest, type AdminCustomerDetail, type AdminCustomerListParams, type AdminCustomerListResponse, type AdminLedgerAnalyticsRequest, type AdminLedgerAnalyticsResponse, AdminPortal, type AdminResetLedgerRequest, type AdminResetLedgerResponse, type AdminSetFreeRequest, type AdminSetHardFloorRequest, type AdminSetTrustedRequest, type AdminShopVaultState, type AdminSignInRequest, type AdminSuspendRequest, type AdminTransactionListParams, type AdminTransactionListResponse, type AdminUnsuspendRequest, type AdminUpdateUserRequest, type AdminUserResponse, type AdminVaultEntitlementState, type AdminVaultEnvironmentState, type AdminVaultStateResponse, AnalyticsScopeRequest, AnalyticsScopeResponse, type AuditActorInfo, type AuditActorKind, type AuditImpersonationKind, type AuditLogListParams, type AuditLogListResponse, type AuditLogResponse, AuditLogs, type AuditSessionInfo, AuthResponse, type AuthorizeResponse, BillingProfileResponse, BinaryExportOptions, Cache, type CardIssuerCreateRequest, type CardIssuerListResponse, type CardIssuerResponse, type CardIssuerUpdateRequest, CardIssuers, ClientAnalyticsRequest, Configs, type ConnectorRestrictionResponse, type ConnectorRestrictionRuleAction, type ConnectorRestrictionRuleResponse, ConnectorRestrictionRules, type ConnectorRestrictionScope, ConnectorRestrictions, type ConnectorVisibility, type CreateConnectorRestrictionRuleRequest, type CreateInternalUserRequest, type CreateTenantUserRequest, type CustomerSummary, type CustomerUser, Delopay, DelopayInternal, DeviceDrillRequest, DevicesAnalyticsResponse, DrillResponse, ExportEnvelope, ExportOptions, FeeRulePreviewRequest, FeeRulePreviewResponse, FeeScheduleCreateRequest, FeeScheduleResponse, FeeScheduleUpdateRequest, FeeStatementDetail, type FeeTotalBound, GeoAnalyticsResponse, GeoDrillRequest, Gsm, type GsmDecision, type GsmRuleCreateRequest, type GsmRuleResponse, type GsmRuleUpdateRequest, JsonExportOptions, type LastAdministratorRefusal, type LastAdministratorRoute, type LedgerDayBucket, type LedgerMerchant, type ListConnectorRestrictionRulesQuery, MerchantAccountResponse, MerchantAccountUpdateRequest, type OnboardMerchantRequest, type OnboardMerchantResponse, type OverviewStat, type OverviewStatsResponse, type PaymentAnalyticsRequest, type PaymentAnalyticsResponse, PaymentAttemptsListResponse, type PaymentAutoCloseConfigResponse, type PaymentAutoCloseOverrideResponse, PaymentClientContextListResponse, type PaymentPeriodStats, PaymentResponse, PaymentStatusHistoryResponse, PaymentsDeleteResponse, type PlatformAnalyticsResponse, PlatformBilling, PlatformFeeRuleInput, PlatformFeeRuleRecord, PlatformFees, ProfileResponse, ProjectResponse, type PromoConfigResponse, RefundListResponse, RequestFn, ScopeDrillRequest, SettlementCurrentParams, SettlementCurrentResponse, SettlementOverviewParams, SettlementOverviewResponse, SettlementStatementListParams, SettlementStatementListResponse, ShopResponse, SignUpWithMerchantIdRequest, type SignupToggleRequest, type SignupToggleResponse, StatementPdfParams, SubscriptionAnalyticsRequest, SubscriptionAnalyticsResponse, SubscriptionDrillRequest, type TransactionDeleteConfigResponse, type TransactionDeleteOverrideResponse, type UpdateConnectorRestrictionRuleRequest, type UpdateLedgerEntryRequest, type UpdatePaymentAutoCloseConfigRequest, type UpdatePaymentAutoCloseOverrideRequest, type UpdatePromoConfigRequest, type UpdateTransactionDeleteConfigRequest, type UpdateTransactionDeleteOverrideRequest, type UpsertConnectorRestrictionRequest, VaultEnvironment };
+export { Admin, type AdminAdjustmentRequest, type AdminAdjustmentResponse, type AdminAnalyticsRequest, type AdminAttachVaultRequest, type AdminAttachVaultResponse, type AdminAttemptProcessorCost, type AdminAttemptProcessorCostBase, type AdminAttemptProcessorCostKnown, type AdminAttemptProcessorCostUnrecorded, type AdminAttemptProcessorCostWithoutFigure, type AdminAuditLogExportRecord, type AdminCreateLedgerRequest, type AdminCreateLedgerResponse, type AdminCreateUserForMerchantRequest, type AdminCustomerDetail, type AdminCustomerListParams, type AdminCustomerListResponse, type AdminLedgerAnalyticsRequest, type AdminLedgerAnalyticsResponse, AdminPortal, type AdminResetLedgerRequest, type AdminResetLedgerResponse, type AdminSetFreeRequest, type AdminSetHardFloorRequest, type AdminSetTrustedRequest, type AdminShopVaultState, type AdminSignInRequest, type AdminSuspendRequest, type AdminTransactionListParams, type AdminTransactionListResponse, type AdminUnsuspendRequest, type AdminUpdateUserRequest, type AdminUserResponse, type AdminVaultEntitlementState, type AdminVaultEnvironmentState, type AdminVaultStateResponse, AnalyticsScopeRequest, AnalyticsScopeResponse, type AuditActorInfo, type AuditActorKind, type AuditImpersonationKind, type AuditLogListParams, type AuditLogListResponse, type AuditLogResponse, AuditLogs, type AuditSessionInfo, AuthResponse, type AuthorizeResponse, BillingProfileResponse, BinaryExportOptions, Cache, type CardIssuerCreateRequest, type CardIssuerListResponse, type CardIssuerResponse, type CardIssuerUpdateRequest, CardIssuers, ClientAnalyticsRequest, Configs, type ConnectorRestrictionResponse, type ConnectorRestrictionRuleAction, type ConnectorRestrictionRuleResponse, ConnectorRestrictionRules, type ConnectorRestrictionScope, ConnectorRestrictions, type ConnectorVisibility, type CreateConnectorRestrictionRuleRequest, type CreateInternalUserRequest, type CreateTenantUserRequest, type CustomerSummary, type CustomerUser, Delopay, DelopayInternal, DeviceDrillRequest, DevicesAnalyticsResponse, Diagnostic, type DiagnosticAttentionBoard, type DiagnosticAttentionItem, type DiagnosticAttentionParams, type DiagnosticAttentionSeverity, type DiagnosticCaptureState, type DiagnosticChange, type DiagnosticChangeListParams, type DiagnosticConnectorCall, type DiagnosticConnectorCallListParams, type DiagnosticDependencyCard, type DiagnosticEmptyReason, type DiagnosticEnvironment, type DiagnosticErrorCodeCount, type DiagnosticFiringAlert, type DiagnosticHealthState, type DiagnosticHealthTile, type DiagnosticIncomingWebhook, type DiagnosticIncomingWebhookDetail, type DiagnosticIncomingWebhookListParams, type DiagnosticInfrastructure, type DiagnosticList, type DiagnosticNearMatch, type DiagnosticOutgoingAttempt, type DiagnosticOutgoingWebhook, type DiagnosticOutgoingWebhookListParams, type DiagnosticOutgoingWebhookSummary, type DiagnosticPage, type DiagnosticPanel, type DiagnosticPayment, type DiagnosticPaymentListParams, type DiagnosticQueueItem, type DiagnosticQueueListParams, type DiagnosticQueueSummary, type DiagnosticReplicaHealth, type DiagnosticResolvedId, type DiagnosticRevealRequest, type DiagnosticRevealResponse, type DiagnosticRouterLog, type DiagnosticRouterLogParams, type DiagnosticSourceUnavailable, type DiagnosticTrace, type DiagnosticTraceSpan, type DiagnosticWindow, DrillResponse, ExportEnvelope, ExportOptions, FeeRulePreviewRequest, FeeRulePreviewResponse, FeeScheduleCreateRequest, FeeScheduleResponse, FeeScheduleUpdateRequest, FeeStatementDetail, type FeeTotalBound, GeoAnalyticsResponse, GeoDrillRequest, Gsm, type GsmDecision, type GsmRuleCreateRequest, type GsmRuleResponse, type GsmRuleUpdateRequest, JsonExportOptions, type LastAdministratorRefusal, type LastAdministratorRoute, type LedgerDayBucket, type LedgerMerchant, type ListConnectorRestrictionRulesQuery, MerchantAccountResponse, MerchantAccountUpdateRequest, type OnboardMerchantRequest, type OnboardMerchantResponse, type OverviewStat, type OverviewStatsResponse, type PaymentAnalyticsRequest, type PaymentAnalyticsResponse, PaymentAttemptsListResponse, type PaymentAutoCloseConfigResponse, type PaymentAutoCloseOverrideResponse, PaymentClientContextListResponse, type PaymentPeriodStats, PaymentResponse, PaymentStatusHistoryResponse, PaymentsDeleteResponse, type PlatformAnalyticsResponse, PlatformBilling, PlatformFeeRuleInput, PlatformFeeRuleRecord, PlatformFees, ProfileResponse, ProjectResponse, type PromoConfigResponse, RefundListResponse, RequestFn, ScopeDrillRequest, SettlementCurrentParams, SettlementCurrentResponse, SettlementOverviewParams, SettlementOverviewResponse, SettlementStatementListParams, SettlementStatementListResponse, ShopResponse, SignUpWithMerchantIdRequest, type SignupToggleRequest, type SignupToggleResponse, StatementPdfParams, SubscriptionAnalyticsRequest, SubscriptionAnalyticsResponse, SubscriptionDrillRequest, type TransactionDeleteConfigResponse, type TransactionDeleteOverrideResponse, type UpdateConnectorRestrictionRuleRequest, type UpdateLedgerEntryRequest, type UpdatePaymentAutoCloseConfigRequest, type UpdatePaymentAutoCloseOverrideRequest, type UpdatePromoConfigRequest, type UpdateTransactionDeleteConfigRequest, type UpdateTransactionDeleteOverrideRequest, type UpsertConnectorRestrictionRequest, VaultEnvironment };