@delopay/sdk 0.334.0 → 0.338.0

package/dist/index.cjs

@@ -1021,7 +1021,7 @@ var Connectors = class {
     );
   }
   /**
-   * Share a connector with more shops of the same merchant (todos#320).
+   * Share a connector with more shops of the same merchant.
    * `POST /account/{accountId}/connectors/{connectorId}/shops`
    *
    * Nothing is copied: every shop sends payments to the same account, on the
@@ -1035,7 +1035,7 @@ var Connectors = class {
     );
   }
   /**
-   * Fold copies of the same provider account into this connector (todos#395).
+   * Fold copies of the same provider account into this connector.
    * `POST /account/{accountId}/connectors/{connectorId}/consolidate`
    *
    * The copies' shops move to the connector with their on/off state, routing,
@@ -1063,7 +1063,7 @@ var Connectors = class {
     );
   }
   /**
-   * Stop a connector serving one shop (todos#407). Any shop may leave, the
+   * Stop a connector serving one shop. Any shop may leave, the
    * one the connector was created in included, while another one stays: the
    * last shop is refused, and the connector is deleted instead. The account,
    * its limits and every other shop on it are unaffected.
@@ -1078,7 +1078,7 @@ var Connectors = class {
   /**
    * Read the transaction currencies a connector may process: its own list,
    * what the provider is known to accept with its methods, and the effective
-   * currencies in each shop it serves (todos#333).
+   * currencies in each shop it serves.
    * `GET /account/{accountId}/connectors/{connectorId}/currencies`
    */
   async getCurrencies(accountId, connectorId) {
@@ -2967,6 +2967,21 @@ var Payments = class {
     if (Object.keys(query).length === 0) return this.request("GET", path);
     return this.request("GET", path, { query });
   }
+  /**
+   * The payment's buyer risk evaluations, newest first (at most 50): each
+   * one's score from 0 to 100, its band, the action the merchant's model asks
+   * for that band and the action that was taken, the signals that fired with
+   * the points each added, and the model version it was scored with.
+   *
+   * A payment is scored at every confirm that is about to reach a processor;
+   * a payment never scored answers an empty list. A caller scoped to one shop
+   * reads only that shop's payments.
+   *
+   * `GET /payments/{paymentId}/buyer-risk`
+   */
+  async buyerRisk(paymentId, options) {
+    return this.request("GET", `/payments/${encodeURIComponent(paymentId)}/buyer-risk`, options);
+  }
   /** Product names and prices as frozen when the payment was created. */
   async productLines(paymentId) {
     return this.request("GET", `/payments/${encodeURIComponent(paymentId)}/lines`);
@@ -3130,6 +3145,12 @@ var Payments = class {
    * @param paymentId - The payment intent ID to confirm.
    * @param params - Confirmation parameters (payment method data, return URL, etc.).
    * @returns The updated payment intent.
+   *
+   * A buyer the merchant's buyer risk model refuses fails before any processor
+   * is called, with a `DelopayError` of code `DE_23` (`buyer_risk_refused`,
+   * HTTP 422). The error does not say which signal fired; read the evaluation
+   * with {@link Payments.buyerRisk}. A shop whose payments are switched off is
+   * refused with `DE_21`.
    */
   async confirm(paymentId, params) {
     return this.request("POST", `/payments/${encodeURIComponent(paymentId)}/confirm`, {
@@ -3661,6 +3682,31 @@ var Profiles = class {
       { body: { is_archived: false } }
     );
   }
+  /**
+   * Switch a shop's payments off. While they are off the shop takes no new
+   * payment: creating one, and confirming one no provider holds yet, is
+   * refused with `DE_21`, and its hosted checkout does not render. A payment a
+   * provider already holds is finished; refunds and disputes are unaffected.
+   * Needs the `ShopPaymentsSwitch` area's `Write` and a signed-in user.
+   * Repeating the same state is safe.
+   *
+   * `PUT /account/{accountId}/business-profile/{profileId}/payments-switch`
+   */
+  async disablePayments(accountId, profileId) {
+    return this.request(
+      "PUT",
+      `/account/${encodeURIComponent(accountId)}/business-profile/${encodeURIComponent(profileId)}/payments-switch`,
+      { body: { payments_disabled: true } }
+    );
+  }
+  /** Switch a shop's payments on again after {@link Profiles.disablePayments}. */
+  async enablePayments(accountId, profileId) {
+    return this.request(
+      "PUT",
+      `/account/${encodeURIComponent(accountId)}/business-profile/${encodeURIComponent(profileId)}/payments-switch`,
+      { body: { payments_disabled: false } }
+    );
+  }
   /** Archived shop identities in the caller's merchant and shop-read scope. */
   async listArchived(accountId) {
     return this.request(
@@ -6758,7 +6804,7 @@ var SellToRestrictions = class {
     );
   }
   /**
-   * One payment connector account's own policy (todos#504), and which buyer
+   * One payment connector account's own policy, and which buyer
    * signals its payments can be judged on. Needs the merchant-level `Read`
    * rung; a shop-scoped role is refused.
    * `GET /sell-to-restrictions/connectors/{merchant_connector_id}`
@@ -10866,6 +10912,9 @@ var Delopay = class {
     this.maxRetries = options?.maxRetries ?? 2;
     this.debug = options?.debug ?? false;
     if (options?.logger !== void 0) this.logger = options.logger;
+    if (options?.profileId !== void 0 && options.profileId !== "") {
+      this.profileId = options.profileId;
+    }
     if (options?.baseUrl !== void 0) {
       this.baseUrl = options.baseUrl;
     } else if (options?.sandbox) {
@@ -11014,6 +11063,17 @@ var Delopay = class {
     return url;
   }
   /** The credential header: the JWT when one is set, else the API key. */
+  /**
+   * The client's `X-Profile-Id`, unless the call names one itself (in any
+   * letter case: two spellings would be sent as one joined value).
+   */
+  profileHeaders(callHeaders) {
+    if (this.profileId === void 0) return {};
+    const named = Object.keys(callHeaders ?? {}).some(
+      (name) => name.toLowerCase() === "x-profile-id"
+    );
+    return named ? {} : { "X-Profile-Id": this.profileId };
+  }
   authHeaders() {
     if (this.jwtToken) return { Authorization: `Bearer ${this.jwtToken}` };
     if (this.apiKey) return { "api-key": this.apiKey };
@@ -11057,6 +11117,7 @@ var Delopay = class {
     const lastEventId = options.lastEventId ?? "";
     const headers = {
       ...this.authHeaders(),
+      ...this.profileHeaders(options.headers),
       Accept: "text/event-stream",
       ...lastEventId ? { "Last-Event-ID": lastEventId } : {},
       ...options.headers
@@ -11194,6 +11255,7 @@ var Delopay = class {
     const url = this.buildUrl(path, options?.query);
     let headers = {
       ...this.authHeaders(),
+      ...this.profileHeaders(options?.headers),
       ...options?.headers
     };
     const isRawBody = options?.body !== void 0 && options?.body !== null && (options.body instanceof FormData || options.body instanceof Blob || options.body instanceof ArrayBuffer || options.body instanceof URLSearchParams);
@@ -13783,7 +13845,7 @@ function decodeBranding(source) {
       DEFAULT_BRANDING.whopSelection
     ),
     paypalValidTint: parseBool(extras["paypalValidTint"], DEFAULT_BRANDING.paypalValidTint),
-    // A look stored before todos#412 has no e-Payouts keys: the form keeps
+    // A look stored before e-Payouts had its own keys has none: the form keeps
     // the PayPal values it was drawn with until then.
     epayoutsCardLayout: pickEnum(
       extras["epayoutsCardLayout"],
@@ -14472,7 +14534,7 @@ function parseImportedBranding(raw) {
       dflt.whopSelection
     ),
     paypalValidTint: parseBool(root["paypalValidTint"], dflt.paypalValidTint),
-    // A look stored before todos#412 has no e-Payouts keys: the form keeps
+    // A look stored before e-Payouts had its own keys has none: the form keeps
     // the PayPal values it was drawn with until then.
     epayoutsCardLayout: pickEnum(
       root["epayoutsCardLayout"],
@@ -14932,6 +14994,52 @@ var CheckoutSession = class {
       }
     );
   }
+  /**
+   * The methods the buyer may pick for a subscription that waits for the
+   * choice (`method_choice_pending`), judged for the buyer. Call it from the
+   * buyer's browser: the sell-to country is read from this request's own
+   * connection. A cancelled subscription answers 400, and one that already
+   * bills on an account answers 409 (`DE_20`). Authenticated with the
+   * subscription's client secret.
+   *
+   * `GET /subscriptions/method-options/{merchantId}/{subscriptionId}`
+   */
+  async subscriptionMethodOptions(options) {
+    return this.client.request(
+      "GET",
+      `/subscriptions/method-options/${encodeURIComponent(this.merchantId)}/${encodeURIComponent(this.paymentId)}`,
+      {
+        ...options,
+        headers: this.bearerHeaders(options?.headers)
+      }
+    );
+  }
+  /**
+   * Bind a waiting subscription to the method the buyer picked and open its
+   * first cycle on that method's billing account. The methods are judged
+   * again from this request; afterwards
+   * {@link CheckoutSession.fetchSubscriptionData} describes the bound
+   * subscription (Stripe's Payment Element for `card`, `confirmSubscription`
+   * for the others). Picking the same method again answers the bound
+   * subscription. A subscription bound to another method already, or whose
+   * billing account changed meanwhile, answers 409 (`DE_20`); a method not
+   * offered to this buyer, or a cancelled subscription, answers 400.
+   * Authenticated with the subscription's client secret.
+   *
+   * `POST /subscriptions/select-method/{merchantId}/{subscriptionId}`
+   */
+  async selectSubscriptionMethod(method, options) {
+    const body = { method };
+    return this.client.request(
+      "POST",
+      `/subscriptions/select-method/${encodeURIComponent(this.merchantId)}/${encodeURIComponent(this.paymentId)}`,
+      {
+        body,
+        ...options,
+        headers: this.bearerHeaders(options?.headers)
+      }
+    );
+  }
   /**
    * Confirm a subscription (PayPal approval rail). The client secret is
    * attached automatically; the shop's profile id travels as the
@@ -15205,7 +15313,9 @@ var CheckoutSession = class {
    * Only `authorized: true` permits the form to contact its processor. A
    * competing flow receives `false` and must reload; an unresolved provider
    * outcome stays reserved, regardless of elapsed time. A buyer-blocklist
-   * refusal throws a `DelopayError` with code `DE_14`.
+   * refusal throws a `DelopayError` with code `DE_14`; a shop whose payments
+   * DeloPay stopped is refused with `DE_22`, and a shop whose payments the
+   * merchant switched off with `DE_21`.
    *
    * `POST /payment-link/{merchantId}/{paymentId}/browser-card-claim`
    */
@@ -15231,7 +15341,11 @@ var CheckoutSession = class {
    * against the shop's sell-to restrictions before Stripe authorises, and a
    * refusal throws a `DelopayError` with code `DE_10`. A buyer on the
    * merchant's buyer blocklist is refused before any Stripe call with code
-   * `DE_14` (`buyer_blocked`, 422), which names no entry. When the answer's
+   * `DE_14` (`buyer_blocked`, 422), which names no entry, a shop whose
+   * payments DeloPay stopped with `DE_22`, and a shop whose payments the
+   * merchant switched off with `DE_21`. A buyer the merchant's buyer risk
+   * model refuses fails with `DE_23` (`buyer_risk_refused`, 422), which says
+   * nothing about the signals. When the answer's
    * `status` is `requires_action`, run `stripe.handleNextAction` with its
    * `client_secret` — safe, because the intent is `confirmation_method=manual`
    * and that secret confirms nothing without the secret key — then call this
@@ -15462,7 +15576,7 @@ var CheckoutSession = class {
   /**
    * Reopen a provider session the buyer switched away from, when they pick the
    * same method again, instead of opening a second session at the provider
-   * (delopay-todos#401). Pass an `attempt_id` from the checkout's
+   *. Pass an `attempt_id` from the checkout's
    * `reopenable_attempts`; the attempt becomes the payment's active one again
    * and `redirect_url` sends the buyer back to it. Refused (`IR_16`) when the
    * payment no longer awaits a method, a payment is under way on the checkout,