@delopay/sdk 0.285.0 → 0.290.0

package/dist/index.cjs

@@ -42,6 +42,7 @@ __export(index_exports, {
   BRANDING_EXPORT_FORMAT: () => BRANDING_EXPORT_FORMAT,
   BRANDING_EXPORT_VERSION: () => BRANDING_EXPORT_VERSION,
   BUILTIN_PAYMENT_ICON_KEYS: () => BUILTIN_PAYMENT_ICON_KEYS,
+  Branding: () => Branding,
   BuyerBlocklist: () => BuyerBlocklist,
   BuyerConversations: () => BuyerConversations,
   BuyerEvidenceReviews: () => BuyerEvidenceReviews,
@@ -63,6 +64,7 @@ __export(index_exports, {
   CheckoutMethods: () => CheckoutMethods,
   CheckoutRecovery: () => CheckoutRecovery,
   CheckoutSession: () => CheckoutSession,
+  CheckoutTemplates: () => CheckoutTemplates,
   CostRules: () => CostRules,
   DEFAULT_BADGES: () => DEFAULT_BADGES,
   DEFAULT_BADGES_DARK: () => DEFAULT_BADGES_DARK,
@@ -112,7 +114,9 @@ __export(index_exports, {
   PaypalDisputes: () => PaypalDisputes,
   PresentationCache: () => PresentationCache,
   ProcessorCosts: () => ProcessorCosts,
+  ProcessorImports: () => ProcessorImports,
   Products: () => Products,
+  PspImportEventStream: () => PspImportEventStream,
   RTL_CHECKOUT_LOCALES: () => RTL_CHECKOUT_LOCALES,
   Regions: () => Regions,
   Risk: () => Risk,
@@ -164,6 +168,7 @@ __export(index_exports, {
   anyOf: () => anyOf,
   applyBrandingVariables: () => applyBrandingVariables,
   asAirwallexCardPreset: () => asAirwallexCardPreset,
+  brandingAssetPath: () => brandingAssetPath,
   buildBrandingExport: () => buildBrandingExport,
   builtinPaymentIconDataUri: () => builtinPaymentIconDataUri,
   builtinPaymentIconSvg: () => builtinPaymentIconSvg,
@@ -1999,6 +2004,44 @@ var Disputes = class {
       options
     );
   }
+  /**
+   * What a bulk action would do to the selected cases, changing nothing:
+   * each case as eligible or skipped with a reason, and what the eligible ones
+   * add up to per currency. Name the cases by `ids` or by the list's
+   * `filters`, exactly one of the two; at most `max_cases` are read.
+   *
+   * `POST /disputes/workspace/bulk/preview`. Needs a dashboard JWT.
+   */
+  async bulkPreview(request) {
+    const { filters, ...rest } = request;
+    return this.request("POST", "/disputes/workspace/bulk/preview", {
+      body: filters ? { ...rest, filters: workspaceQuery(filters) } : rest
+    });
+  }
+  /**
+   * Accept the listed cases at their processors, at most the preview's
+   * `max_run_cases` per call; send a larger set in parts under one
+   * `request_id`. Eligibility is decided again at run time, and every case
+   * gets its own result. An `unknown` result means the processor may have
+   * acted: read the case before acting on it again.
+   *
+   * `POST /disputes/workspace/bulk/accept`. Needs a dashboard JWT.
+   */
+  async bulkAccept(request) {
+    return this.request("POST", "/disputes/workspace/bulk/accept", { body: request });
+  }
+  /**
+   * Add the buyer of each listed case's payment to the buyer blocklist: the
+   * payment's email and customer id, and the device ids and IP address of the
+   * browser that paid, when DeloPay can tie them to it. Identifiers already
+   * blocked are not added again, and `unattributed` names those it could not
+   * tie to the buyer.
+   *
+   * `POST /disputes/workspace/bulk/block-buyer`. Needs a dashboard JWT.
+   */
+  async bulkBlockBuyer(request) {
+    return this.request("POST", "/disputes/workspace/bulk/block-buyer", { body: request });
+  }
   /**
    * Retrieve a dispute by its ID.
    *
@@ -5251,6 +5294,49 @@ var Users = class {
       body: params
     });
   }
+  /**
+   * A member's permission overrides in your merchant: every area that can be
+   * overridden at their level, with what their roles give, the level set for
+   * them, and what they have. `GET /user/employees/{user_id}/permission-overrides`
+   *
+   * Needs the *Users* read permission, and answers only for a member
+   * `listUsersInLineage` shows you (any other id is a 404 `UR_68`).
+   * `can_edit`, `can_raise` and each area's `grantable_level` say what you
+   * may change.
+   */
+  async getMemberPermissionOverrides(userId) {
+    return this.request(
+      "GET",
+      `/user/employees/${encodeURIComponent(userId)}/permission-overrides`
+    );
+  }
+  /**
+   * Replace a member's permission overrides. An area left out goes back to
+   * what their roles give. `PUT /user/employees/{user_id}/permission-overrides`
+   *
+   * Needs the *Users* write permission and a member within your reach, other
+   * than yourself. Keeping or lowering is always allowed; a gain must stay
+   * within what you hold in that area, and a gain above the member's roles
+   * needs `can_raise`. The change is audited and applies to the member's next
+   * request. A refusal is a `UR_68` whose `data` is
+   * `{ reason: 'permission_overrides', refusal }` (see
+   * {@link PermissionOverrideRefusal}).
+   */
+  async updateMemberPermissionOverrides(userId, params) {
+    return this.request(
+      "PUT",
+      `/user/employees/${encodeURIComponent(userId)}/permission-overrides`,
+      { body: params }
+    );
+  }
+  /**
+   * The permission overrides your own session acts under, sorted by area.
+   * An area named here has exactly that level, whatever a broader legacy area
+   * of the role would suggest. `GET /user/role/permission-overrides`
+   */
+  async getOwnPermissionOverrides() {
+    return this.request("GET", "/user/role/permission-overrides");
+  }
   /** Sign in via OIDC. `POST /user/oidc` */
   async signInOidc(params) {
     return this.request("POST", "/user/oidc", { body: params });
@@ -5475,7 +5561,8 @@ var IdentityVerifications = class {
   }
   /**
    * One verification. With `force_sync: true`, a verification the provider
-   * can still change (pending or in review) is read from the provider first.
+   * can still change (pending or in review, or a subject under ongoing AML
+   * monitoring) is read from the provider first.
    *
    * `GET /identity-verifications/{verification_id}`
    */
@@ -5487,8 +5574,9 @@ var IdentityVerifications = class {
   }
   /**
    * A subject's latest verification in one environment (live unless
-   * `test_mode: true`), with its checks. This is what risk rules read.
-   * `verification` is `null` when the subject has none.
+   * `test_mode: true`), with its checks, and the subject's verification under
+   * ongoing AML monitoring. This is what risk rules read. `verification` and
+   * `aml_monitoring` are `null` when the subject has none.
    *
    * `GET /identity-verifications/subjects/{subject_reference}`
    */
@@ -5513,6 +5601,78 @@ var IdentityVerifications = class {
       { query, ...options }
     );
   }
+  /**
+   * Switch ongoing AML monitoring of a verification's subject. The provider
+   * then keeps re-screening the subject against sanctions, PEP and
+   * adverse-media lists, and every change it reports is recorded. Only a
+   * verified person or business can be enrolled; monitoring can be switched
+   * off at any time. Needs permission to edit customers.
+   *
+   * `POST /identity-verifications/{verification_id}/aml-monitoring`
+   */
+  async setAmlMonitoring(verificationId, params, options) {
+    return this.request(
+      "POST",
+      `/identity-verifications/${encodeURIComponent(verificationId)}/aml-monitoring`,
+      { body: params, ...options }
+    );
+  }
+  /**
+   * Every change of the subject's AML result the provider reported while the
+   * subject was monitored, newest first, at most 100.
+   *
+   * `GET /identity-verifications/{verification_id}/aml-events`
+   */
+  async amlEvents(verificationId, options) {
+    return this.request(
+      "GET",
+      `/identity-verifications/${encodeURIComponent(verificationId)}/aml-events`,
+      options
+    );
+  }
+  /**
+   * A payment's screening by the transaction monitoring of the shop's
+   * screening account. Recorded only: it never holds or refuses the payment.
+   * Answers 404 when the payment has no screening. Needs permission to read
+   * payments.
+   *
+   * `GET /identity-verifications/payment-screenings/{payment_id}`
+   */
+  async paymentScreening(paymentId, options) {
+    return this.request(
+      "GET",
+      `/identity-verifications/payment-screenings/${encodeURIComponent(paymentId)}`,
+      options
+    );
+  }
+  /**
+   * Whether an account screens its shop's payments. Needs permission to read
+   * connectors.
+   *
+   * `GET /identity-verifications/accounts/{merchant_connector_id}/payment-screening`
+   */
+  async paymentScreeningSetting(merchantConnectorId, options) {
+    return this.request(
+      "GET",
+      `/identity-verifications/accounts/${encodeURIComponent(merchantConnectorId)}/payment-screening`,
+      options
+    );
+  }
+  /**
+   * Switch screening of the account's shop's payments. Switched on, every
+   * payment of the shop that succeeds from then on is screened shortly after,
+   * in the payment's own environment. A shop has at most one screening
+   * account. Needs permission to edit connectors.
+   *
+   * `PUT /identity-verifications/accounts/{merchant_connector_id}/payment-screening`
+   */
+  async updatePaymentScreeningSetting(merchantConnectorId, params, options) {
+    return this.request(
+      "PUT",
+      `/identity-verifications/accounts/${encodeURIComponent(merchantConnectorId)}/payment-screening`,
+      { body: params, ...options }
+    );
+  }
 };
 
 // src/resources/webhooks.ts
@@ -6251,6 +6411,110 @@ var ShopLabels = class {
   }
 };
 
+// src/resources/checkoutTemplates.ts
+var CheckoutTemplates = class {
+  constructor(request) {
+    this.request = request;
+  }
+  /**
+   * The merchant's templates, each with the shops on it and whether each
+   * runs the template's current settings.
+   * `GET /checkout-templates/{merchantId}`
+   */
+  async list(merchantId) {
+    return this.request("GET", `/checkout-templates/${encodeURIComponent(merchantId)}`);
+  }
+  /**
+   * Create a template, empty or copied from a shop's current settings. The
+   * shop copied from is not changed.
+   * `POST /checkout-templates/{merchantId}`
+   */
+  async create(merchantId, params) {
+    return this.request("POST", `/checkout-templates/${encodeURIComponent(merchantId)}`, {
+      body: params
+    });
+  }
+  /** `GET /checkout-templates/{merchantId}/{templateId}` */
+  async retrieve(merchantId, templateId) {
+    return this.request(
+      "GET",
+      `/checkout-templates/${encodeURIComponent(merchantId)}/${encodeURIComponent(templateId)}`
+    );
+  }
+  /**
+   * Rename a template. A name another template of the merchant holds is
+   * refused.
+   * `POST /checkout-templates/{merchantId}/{templateId}`
+   */
+  async rename(merchantId, templateId, params) {
+    return this.request(
+      "POST",
+      `/checkout-templates/${encodeURIComponent(merchantId)}/${encodeURIComponent(templateId)}`,
+      { body: params }
+    );
+  }
+  /**
+   * Delete a template. Refused while a shop is on it.
+   * `DELETE /checkout-templates/{merchantId}/{templateId}`
+   */
+  async delete(merchantId, templateId) {
+    return this.request(
+      "DELETE",
+      `/checkout-templates/${encodeURIComponent(merchantId)}/${encodeURIComponent(templateId)}`
+    );
+  }
+  /**
+   * Put shops on the template and copy its settings into them; a shop on
+   * another template moves. Each shop is reported on its own: one with
+   * `blockers` is left unchanged. `dry_run` changes nothing and reports what
+   * would change.
+   * `POST /checkout-templates/{merchantId}/{templateId}/shops`
+   */
+  async assign(merchantId, templateId, params) {
+    return this.request(
+      "POST",
+      `/checkout-templates/${encodeURIComponent(merchantId)}/${encodeURIComponent(templateId)}/shops`,
+      {
+        body: params
+      }
+    );
+  }
+  /**
+   * Take a shop off the template. It keeps every setting it has, as its own.
+   * `DELETE /checkout-templates/{merchantId}/{templateId}/shops/{profileId}`
+   */
+  async unassign(merchantId, templateId, profileId) {
+    return this.request(
+      "DELETE",
+      `/checkout-templates/${encodeURIComponent(merchantId)}/${encodeURIComponent(templateId)}/shops/${encodeURIComponent(profileId)}`
+    );
+  }
+  /**
+   * Copy the template's current settings into its shops, all or the ones
+   * named.
+   * `POST /checkout-templates/{merchantId}/{templateId}/apply`
+   */
+  async apply(merchantId, templateId, params = {}) {
+    return this.request(
+      "POST",
+      `/checkout-templates/${encodeURIComponent(merchantId)}/${encodeURIComponent(templateId)}/apply`,
+      {
+        body: params
+      }
+    );
+  }
+  /**
+   * The template a shop is on, if any. Readable by the shop's own members.
+   * `GET /checkout-templates/{merchantId}/shops/{profileId}`
+   */
+  async ofShop(merchantId, profileId) {
+    return this.request(
+      "GET",
+      `/checkout-templates/${encodeURIComponent(merchantId)}/shops/${encodeURIComponent(profileId)}`
+    );
+  }
+};
+
 // src/resources/buyerConversations.ts
 var BuyerConversations = class {
   constructor(request) {
@@ -9502,6 +9766,167 @@ var Live = class {
   }
 };
 
+// src/resources/processorImports.ts
+function toPspImportStreamEvent(event) {
+  switch (event.type) {
+    case "progress": {
+      let run;
+      try {
+        run = JSON.parse(event.data);
+      } catch {
+        return null;
+      }
+      if (run === null || typeof run !== "object" || Array.isArray(run)) return null;
+      return { type: "progress", run };
+    }
+    case "done":
+      return { type: "done" };
+    default:
+      return null;
+  }
+}
+var PspImportEventStream = class {
+  constructor(connection) {
+    this.connection = connection;
+  }
+  /** Close the stream; the iteration ends without an error. */
+  close() {
+    this.connection.close();
+  }
+  [Symbol.asyncIterator]() {
+    this.iterator ?? (this.iterator = this.events());
+    return this.iterator;
+  }
+  async *events() {
+    for await (const dispatch of this.connection.dispatches) {
+      if (!dispatch.event) continue;
+      const event = toPspImportStreamEvent(dispatch.event);
+      if (event) yield event;
+    }
+  }
+};
+var ProcessorImports = class {
+  constructor(request, openStream) {
+    this.request = request;
+    this.openStream = openStream;
+  }
+  /**
+   * Every connected processor account the caller may see, with what each can
+   * provide in the environment: listed, read payment by payment, or
+   * unavailable with a reason.
+   *
+   * `GET /refunds-disputes/imports/sources`
+   */
+  async sources(params) {
+    return this.request("GET", "/refunds-disputes/imports/sources", {
+      query: { test_mode: params.test_mode }
+    });
+  }
+  /**
+   * Start an import. A source a processor cannot provide is stored as
+   * `unavailable` with its reason. Refused while another import of the
+   * merchant runs in the same environment.
+   *
+   * `POST /refunds-disputes/imports`
+   */
+  async create(request) {
+    return this.request("POST", "/refunds-disputes/imports", { body: request });
+  }
+  /**
+   * The newest import in the environment, running or finished.
+   *
+   * `GET /refunds-disputes/imports/latest`
+   */
+  async latest(params) {
+    return this.request("GET", "/refunds-disputes/imports/latest", {
+      query: { test_mode: params.test_mode }
+    });
+  }
+  /** `GET /refunds-disputes/imports/{id}` */
+  async retrieve(id) {
+    return this.request("GET", `/refunds-disputes/imports/${encodeURIComponent(id)}`);
+  }
+  /**
+   * The records an import left out or could not record, each with its reason.
+   *
+   * `GET /refunds-disputes/imports/{id}/issues`
+   */
+  async issues(id, params) {
+    return this.request("GET", `/refunds-disputes/imports/${encodeURIComponent(id)}/issues`, {
+      query: { limit: params?.limit, offset: params?.offset }
+    });
+  }
+  /**
+   * Ask a running import to stop. It stops after the page it is reading;
+   * what it recorded stays recorded.
+   *
+   * `POST /refunds-disputes/imports/{id}/cancel`
+   */
+  async cancel(id) {
+    return this.request("POST", `/refunds-disputes/imports/${encodeURIComponent(id)}/cancel`);
+  }
+  /**
+   * Open the progress stream of an import. Resolves once the server answered;
+   * a `401` rejects with `DelopayAuthenticationError`.
+   *
+   * `GET /refunds-disputes/imports/{id}/stream`
+   *
+   * @example
+   * ```typescript
+   * const stream = await delopay.processorImports.stream(run.id, { signal });
+   * for await (const event of stream) {
+   *   if (event.type === 'progress') render(event.run);
+   * }
+   * ```
+   */
+  async stream(id, options = {}) {
+    const connection = await this.openStream(
+      `/refunds-disputes/imports/${encodeURIComponent(id)}/stream`,
+      {
+        ...options.signal ? { signal: options.signal } : {},
+        ...options.idleTimeoutMs !== void 0 ? { idleTimeoutMs: options.idleTimeoutMs } : {},
+        ...options.headers ? { headers: options.headers } : {}
+      }
+    );
+    return new PspImportEventStream(connection);
+  }
+};
+
+// src/resources/deploymentBranding.ts
+function brandingAssetPath(asset, version) {
+  const path = `/branding/assets/${encodeURIComponent(asset)}`;
+  return version ? `${path}?v=${encodeURIComponent(version)}` : path;
+}
+var Branding = class {
+  constructor(request, baseUrl) {
+    this.request = request;
+    this.baseUrl = baseUrl;
+  }
+  /**
+   * The saved branding. A `null` field means "keep your own default".
+   *
+   * Branding is cosmetic, so treat any failure as "nothing saved": routers
+   * from before this route answer 404, and a page must never wait long for
+   * it. Pass a `signal` (e.g. `AbortSignal.timeout(2500)`) to bound the call
+   * including its retries; a `timeout` alone applies to each attempt.
+   *
+   * `GET /branding`
+   */
+  async retrieve(options) {
+    return this.request("GET", "/branding", { ...options });
+  }
+  /**
+   * The address of one branding image or font file on this client's base
+   * URL, for an `<img src>` or a `@font-face` `src`. See
+   * {@link brandingAssetPath}.
+   *
+   * `GET /branding/assets/{asset}`
+   */
+  assetUrl(asset, version) {
+    return `${this.baseUrl}${brandingAssetPath(asset, version)}`;
+  }
+};
+
 // src/client.ts
 var PRODUCTION_URL = "https://api.delopay.net";
 var SANDBOX_URL = "https://sandbox.delopay.net";
@@ -9781,6 +10206,8 @@ var Delopay = class {
     this.messageTemplates = new MessageTemplates(request);
     this.risk = new Risk(request);
     this.live = new Live(request, openStream);
+    this.processorImports = new ProcessorImports(request, openStream);
+    this.branding = new Branding(request, this.baseUrl);
     this.subscriptions = new Subscriptions(request);
     this.buyerPortal = new BuyerPortal(request);
     this.buyerAccount = new BuyerAccount(request);
@@ -9792,6 +10219,7 @@ var Delopay = class {
     this.sellToRestrictions = new SellToRestrictions(request);
     this.buyerBlocklist = new BuyerBlocklist(request);
     this.shopLabels = new ShopLabels(request);
+    this.checkoutTemplates = new CheckoutTemplates(request);
     this.buyerConversations = new BuyerConversations(request);
     this.buyerEvidence = new BuyerEvidenceReviews(request);
     this.checkoutRecovery = new CheckoutRecovery(request);
@@ -14063,6 +14491,25 @@ var CheckoutSession = class {
       headers: this.bearerHeaders(options?.headers)
     });
   }
+  /**
+   * Reserve this payment attempt before a hosted card form contacts Stripe,
+   * Airwallex, or NomuPay. Send the provider object rendered to this checkout
+   * and retain the same `flow_id` across retries and any 3-D Secure step.
+   *
+   * Only `authorized: true` permits the form to contact its processor. A
+   * competing flow receives `false` and must reload; an unresolved provider
+   * outcome stays reserved, regardless of elapsed time. A buyer-blocklist
+   * refusal throws a `DelopayError` with code `DE_14`.
+   *
+   * `POST /payment-link/{merchantId}/{paymentId}/browser-card-claim`
+   */
+  async claimBrowserCard(params, options) {
+    return this.client.request("POST", `${this.linkBase}/browser-card-claim`, {
+      body: params,
+      ...options,
+      headers: this.bearerHeaders(options?.headers)
+    });
+  }
   /**
    * Confirm the Stripe card form's PaymentIntent through the router, for a
    * checkout payload with `card_connector_server_confirm: true`. Stripe refuses
@@ -14084,6 +14531,10 @@ var CheckoutSession = class {
    * and that secret confirms nothing without the secret key — then call this
    * again without a payment method to finalize.
    *
+   * Reserve the attempt with {@link claimBrowserCard} first. Send its granted
+   * `flow_id` as `browser_flow_id` on both the initial and post-action confirm;
+   * an omitted, null or nonholder flow is refused with `400` and code `IR_16`.
+   *
    * A PaymentMethod rules out what `stripe.createPaymentMethod` cannot
    * produce: Stripe names Amazon Pay and Klarna in the Express Checkout
    * Element, which need `stripe.createConfirmationToken` instead. Neither can
@@ -14947,6 +15398,7 @@ var encodeNativePanes = encodePanes;
   BRANDING_EXPORT_FORMAT,
   BRANDING_EXPORT_VERSION,
   BUILTIN_PAYMENT_ICON_KEYS,
+  Branding,
   BuyerBlocklist,
   BuyerConversations,
   BuyerEvidenceReviews,
@@ -14968,6 +15420,7 @@ var encodeNativePanes = encodePanes;
   CheckoutMethods,
   CheckoutRecovery,
   CheckoutSession,
+  CheckoutTemplates,
   CostRules,
   DEFAULT_BADGES,
   DEFAULT_BADGES_DARK,
@@ -15017,7 +15470,9 @@ var encodeNativePanes = encodePanes;
   PaypalDisputes,
   PresentationCache,
   ProcessorCosts,
+  ProcessorImports,
   Products,
+  PspImportEventStream,
   RTL_CHECKOUT_LOCALES,
   Regions,
   Risk,
@@ -15069,6 +15524,7 @@ var encodeNativePanes = encodePanes;
   anyOf,
   applyBrandingVariables,
   asAirwallexCardPreset,
+  brandingAssetPath,
   buildBrandingExport,
   builtinPaymentIconDataUri,
   builtinPaymentIconSvg,