@delopay/sdk 0.61.0 → 0.62.0

package/README.md

@@ -50,52 +50,61 @@ const delopay = new Delopay(apiKey, {
 
 ## Usage Examples
 
-### Create and confirm a payment
+### Create a payment
+
+> **Never send raw card numbers through the SDK.** Delopay's API is not a
+> raw-PAN endpoint: cards are collected on the Delopay **hosted checkout**
+> (or via a payment link), so card data never touches your server and stays
+> out of your PCI scope. Server-side you create the payment and hand the buyer
+> off; you confirm server-side only with a saved `payment_token`, a
+> `mandate_id`, or a redirect method (e.g. a PayPal wallet) — never card data.
 
 ```typescript
-// Create with confirm: true to skip a separate confirm call
+// Recommended: hosted checkout via a payment link.
 const payment = await delopay.payments.create({
   amount: 2500,
   currency: 'EUR',
-  confirm: true,
-  capture_method: 'automatic',
-  payment_method: 'card',
-  payment_method_data: {
-    card: {
-      card_number: '4242424242424242',
-      card_exp_month: '12',
-      card_exp_year: '2030',
-      card_cvc: '123',
-    },
-  },
+  payment_link: true,
   customer_id: 'cus_abc123',
-  description: 'Premium subscription',
+  description: 'Order #1234',
   return_url: 'https://example.com/checkout/complete',
 });
 
-// Or create first, then confirm separately
-const pending = await delopay.payments.create({
-  amount: 2500,
-  currency: 'EUR',
-  description: 'Premium subscription',
-});
+// Send the buyer here — they pick a method and enter card details on the
+// hosted page. Delopay handles 3-D Secure and redirects.
+console.log(payment.payment_link?.link);
+
+// Fulfil on the payment_succeeded webhook, or re-check server-side:
+const final = await delopay.payments.retrieve(payment.payment_id);
+```
+
+Confirm server-side **without card data** — with a saved token (off-session):
 
+```typescript
 const confirmed = await delopay.payments.confirm(pending.payment_id, {
-  payment_method: 'card',
-  payment_method_data: {
-    card: {
-      card_number: '4242424242424242',
-      card_exp_month: '12',
-      card_exp_year: '2030',
-      card_cvc: '123',
-    },
-  },
+  payment_token: savedPaymentToken, // from paymentMethods.listForCustomer()
+  off_session: true,
   return_url: 'https://example.com/checkout/complete',
 });
 
 console.log(confirmed.status); // 'succeeded' | 'requires_customer_action' | …
 ```
 
+Or with a redirect payment method that involves no card data at all:
+
+```typescript
+const paypal = await delopay.payments.create({
+  amount: 2500,
+  currency: 'EUR',
+  confirm: true,
+  payment_method: 'wallet',
+  payment_method_type: 'paypal',
+  payment_method_data: { wallet: { paypal_redirect: {} } },
+  return_url: 'https://example.com/checkout/complete',
+});
+// paypal.next_action?.redirect_to_url → send the buyer there to approve
+```
+
 ### Create a refund
 
 ```typescript

package/dist/{chunk-ADPSXHH7.js → chunk-2OWZIFZO.js}

@@ -2340,6 +2340,23 @@ var Users = class {
   async addUser(params) {
     return this.request("POST", "/user/employees/add", { body: params });
   }
+  /**
+   * Impersonate one of your own team members — `POST /user/employees/impersonate`.
+   *
+   * Mints a session token **as** the given member, so the dashboard renders
+   * exactly what they see (useful for support and role verification). The
+   * caller needs the *Impersonation* permission, and the member's role must
+   * rank **strictly below** the caller's (`Profile < Merchant < Organization`);
+   * the server rejects self-impersonation, cross-merchant targets, and
+   * equal/higher roles.
+   *
+   * The returned token is tab-scoped by design: open it in a fresh tab (e.g.
+   * `/auth/impersonate?token=…`) rather than replacing the caller's own
+   * session. No auth cookie is set on the response.
+   */
+  async impersonateEmployee(params) {
+    return this.request("POST", "/user/employees/impersonate", { body: params });
+  }
   async acceptInvitation(params) {
     return this.request("POST", "/user/employees/invite/accept", { body: params });
   }
@@ -4236,4 +4253,4 @@ export {
   applyBrandingVariables,
   shadowFor
 };
-//# sourceMappingURL=chunk-ADPSXHH7.js.map
+//# sourceMappingURL=chunk-2OWZIFZO.js.map