@delopay/sdk 0.83.0 → 0.86.0

package/dist/{chunk-G44EQT6Q.js → chunk-DQ36QCU7.js}

@@ -434,6 +434,39 @@ var Connectors = class {
   async list(accountId) {
     return this.request("GET", `/account/${encodeURIComponent(accountId)}/connectors`);
   }
+  /**
+   * The profile-scoped connector list. The merchant-wide `list()` is
+   * merchant-gated and 403s for a profile-entity (shop user) JWT; this
+   * variant is scoped server-side to the caller's own profile.
+   *
+   * `GET /account/{accountId}/profile/connectors`
+   */
+  async listByProfile(accountId) {
+    return this.request("GET", `/account/${encodeURIComponent(accountId)}/profile/connectors`);
+  }
+  /**
+   * The built-in e-Payouts reference catalog — the "Restore defaults" source.
+   * `GET /account/{accountId}/connectors/epayouts/catalog/defaults`
+   */
+  async getEpayoutsCatalogDefaults(accountId) {
+    return this.request(
+      "GET",
+      `/account/${encodeURIComponent(accountId)}/connectors/epayouts/catalog/defaults`
+    );
+  }
+  /**
+   * Sweep the merchant's own e-Payouts module and return the rails it
+   * actually has enabled. Server-side this makes many upstream calls, so it
+   * can take several seconds — show progress.
+   *
+   * `POST /account/{accountId}/connectors/{connectorId}/epayouts/catalog/sync`
+   */
+  async syncEpayoutsCatalog(accountId, connectorId) {
+    return this.request(
+      "POST",
+      `/account/${encodeURIComponent(accountId)}/connectors/${encodeURIComponent(connectorId)}/epayouts/catalog/sync`
+    );
+  }
   async update(accountId, connectorId, params) {
     return this.request(
       "POST",
@@ -466,6 +499,55 @@ var Connectors = class {
     );
   }
   // --- Advanced operations (Task 4.8) ---
+  /**
+   * Run the configuration checks for a vault (VGS) connector account:
+   * credential validity, write-only Collect scope, reachability, environment
+   * coherence, route coverage. Read-only but not cheap — it decrypts the
+   * vault's management credential and talks to VGS.
+   *
+   * `POST /account/{accountId}/connectors/{connectorId}/vault/verify`
+   */
+  async verifyVault(accountId, connectorId, params) {
+    return this.request(
+      "POST",
+      `/account/${encodeURIComponent(accountId)}/connectors/${encodeURIComponent(connectorId)}/vault/verify`,
+      { body: params }
+    );
+  }
+  /**
+   * Compute the route document the vault SHOULD have and diff it against
+   * what exists, without writing anything. The returned fingerprints must be
+   * echoed byte for byte on {@link Connectors.applyVaultRoutes}.
+   *
+   * A router without these endpoints answers 404 — render that as "this
+   * build cannot configure routes", never as "there is nothing to change".
+   *
+   * `POST /account/{accountId}/connectors/{connectorId}/vault/routes/preview`
+   */
+  async previewVaultRoutes(accountId, connectorId, params) {
+    return this.request(
+      "POST",
+      `/account/${encodeURIComponent(accountId)}/connectors/${encodeURIComponent(connectorId)}/vault/routes/preview`,
+      { body: params }
+    );
+  }
+  /**
+   * Write the routes the merchant just previewed. Both fingerprints come
+   * from the preview and are opaque: `expected_current_fingerprint` says the
+   * vault has not moved (`null` = "the preview found no routes" and is sent
+   * as `null`, never omitted), `expected_desired_fingerprint` says the
+   * document is still the one on screen. A 409 (`DE_04`) means the vault
+   * changed since the preview — nothing was written; preview again.
+   *
+   * `POST /account/{accountId}/connectors/{connectorId}/vault/routes/apply`
+   */
+  async applyVaultRoutes(accountId, connectorId, params) {
+    return this.request(
+      "POST",
+      `/account/${encodeURIComponent(accountId)}/connectors/${encodeURIComponent(connectorId)}/vault/routes/apply`,
+      { body: params }
+    );
+  }
   /** Verify connector credentials. `POST /account/connectors/verify` */
   async verify(params) {
     return this.request("POST", "/account/connectors/verify", { body: params });
@@ -1428,6 +1510,39 @@ var Payments = class {
       ...options
     });
   }
+  /**
+   * The status timeline of client/device observations captured while the
+   * buyer interacted with the payment (checkout opens, confirms, redirect
+   * legs, reported client signals), oldest first.
+   *
+   * `GET /payments/{paymentId}/client-context`
+   */
+  async listClientContext(paymentId, options) {
+    return this.request(
+      "GET",
+      `/payments/${encodeURIComponent(paymentId)}/client-context`,
+      options
+    );
+  }
+  /**
+   * Soft-delete a payment. Only payments whose status is in the merchant's
+   * delete policy (see {@link Payments.getDeletePolicy}) can be deleted;
+   * anything else fails with a precondition error.
+   *
+   * `DELETE /payments/{paymentId}`
+   */
+  async delete(paymentId, options) {
+    return this.request("DELETE", `/payments/${encodeURIComponent(paymentId)}`, options);
+  }
+  /**
+   * The effective deletable-status set for the calling merchant — lets a
+   * dashboard show the delete action only where it is allowed.
+   *
+   * `GET /payments/delete-policy`
+   */
+  async getDeletePolicy(options) {
+    return this.request("GET", "/payments/delete-policy", options);
+  }
   // --- Advanced operations (Task 3.2) ---
   /** Generate session tokens. `POST /payments/session-tokens` */
   async sessionTokens(params) {
@@ -1498,10 +1613,30 @@ var Payments = class {
   async listByFilter(params) {
     return this.request("POST", "/payments/list", { body: params });
   }
+  /**
+   * List payments by filter, scoped to the caller's profile (the shop-user
+   * twin of `listByFilter`). The backend narrows to the profile from the
+   * auth context, so `profile_id` / `project_id` must not be sent.
+   *
+   * Not to be confused with {@link Payments.listByProfile}, which is the GET
+   * cursor variant and rejects this body.
+   *
+   * `POST /payments/profile/list`
+   */
+  async listByProfileFilter(params, options) {
+    return this.request("POST", "/payments/profile/list", { body: params, ...options });
+  }
   /** Get payment filter options. `GET /payments/filter` */
   async getFilters(params) {
     return this.request("GET", "/payments/filter", { query: params });
   }
+  /**
+   * Get payment filter options, scoped to the caller's profile.
+   * `GET /payments/profile/filter`
+   */
+  async getFiltersByProfile(params) {
+    return this.request("GET", "/payments/profile/filter", { query: params });
+  }
   /** Get payment aggregates. `GET /payments/aggregate` */
   async aggregate(params) {
     return this.request("GET", "/payments/aggregate", { query: params });
@@ -1702,6 +1837,16 @@ var Profiles = class {
   async list(accountId) {
     return this.request("GET", `/account/${encodeURIComponent(accountId)}/business-profile`);
   }
+  /**
+   * List the business profiles the caller can see at profile scope — the
+   * `ProfileAccountRead` twin of `list()` (which needs merchant-level read).
+   * A shop-scoped user gets exactly their own shop back.
+   *
+   * `GET /account/{accountId}/profile`
+   */
+  async listByProfile(accountId) {
+    return this.request("GET", `/account/${encodeURIComponent(accountId)}/profile`);
+  }
   async update(accountId, profileId, params) {
     return this.request(
       "POST",
@@ -2345,7 +2490,7 @@ var Shops = class {
   /**
    * Upload a logo file for a shop. The file is stored in Delopay's configured
    * object store and a public HTTPS URL is returned. This method does NOT write
-   * the URL into the shop's `payment_link_config.default_config.logo` — call
+   * the URL into the shop's `payment_link_config.logo` — call
    * `shops.update` afterwards with the returned `logo_url` to persist the change.
    *
    * Accepts PNG, JPEG, WebP or SVG. The file must be ≤ 1 MiB.
@@ -2359,7 +2504,7 @@ var Shops = class {
    * ```typescript
    * const { logo_url } = await delopay.shops.uploadLogo('merch_1', 'pro_1', file);
    * await delopay.shops.update('merch_1', 'pro_1', {
-   *   payment_link_config: { default_config: { logo: logo_url } },
+   *   payment_link_config: { logo: logo_url },
    * });
    * ```
    */
@@ -2372,6 +2517,29 @@ var Shops = class {
       { body: form }
     );
   }
+  /**
+   * Update only the checkout appearance (the `payment_link_config` blob:
+   * theme, logo, colours, seller name, SDK layout/rules, DeloPay-branding
+   * toggle) of a shop. Applied as a whole-object replace of
+   * `payment_link_config`, mirroring the shop-update semantics.
+   *
+   * Gated on the dedicated `CheckoutBranding` permission, so "may restyle
+   * the checkout" can be granted without full account/shop write.
+   *
+   * `POST /shops/{merchantId}/{shopId}/checkout-branding`
+   *
+   * @param merchantId - The merchant account ID.
+   * @param shopId - The shop (business profile) ID to restyle.
+   * @param params - The new `payment_link_config` blob (full replacement).
+   * @returns The updated business profile.
+   */
+  async updateCheckoutBranding(merchantId, shopId, params, options) {
+    return this.request(
+      "POST",
+      `/shops/${encodeURIComponent(merchantId)}/${encodeURIComponent(shopId)}/checkout-branding`,
+      { body: params, ...options }
+    );
+  }
 };
 
 // src/resources/stripeConnect.ts
@@ -2478,6 +2646,26 @@ var Users = class {
   async update(params) {
     return this.request("POST", "/user/update", { body: params });
   }
+  /**
+   * RFC 7396 merge-patch the caller's own user-scoped metadata bucket.
+   * Returns the full user details, so callers can refresh their context
+   * without a second fetch.
+   *
+   * `PATCH /user/metadata`
+   */
+  async updateMetadata(params) {
+    return this.request("PATCH", "/user/metadata", { body: params });
+  }
+  /**
+   * RFC 7396 merge-patch the merchant-scoped metadata bucket shared by
+   * every dashboard user of the merchant. Same response contract as
+   * {@link Users.updateMetadata}.
+   *
+   * `PATCH /user/merchant/metadata`
+   */
+  async updateMerchantMetadata(params) {
+    return this.request("PATCH", "/user/merchant/metadata", { body: params });
+  }
   /**
    * Permanently delete the caller's account. Requires a fresh password
    * (and a current 6-digit TOTP code if the user has TOTP enrolled). On
@@ -3237,6 +3425,283 @@ var Subscriptions = class {
       ...options
     });
   }
+  /**
+   * Resolve which of the given payments were raised by a subscription.
+   * `POST /subscriptions/payments/lookup`
+   *
+   * The linkage exists in one direction only — an invoice points at the payment
+   * it settled, and nothing is stamped on the payment — so this is the only way
+   * to tell a subscription charge from a one-off one when you are holding a
+   * page of payments. In particular, do not use `off_session` or the presence
+   * of a mandate: an ordinary saved-card charge sets those identically.
+   *
+   * Ids that belong to no subscription are **absent** from `links` rather than
+   * returned as an error, so match on presence:
+   *
+   * ```ts
+   * const { links } = await subscriptions.lookupPayments(
+   *   { payment_ids: page.map((p) => p.payment_id) },
+   *   { headers: { 'X-Profile-Id': profileId } },
+   * );
+   * const bySubscription = new Map(links.map((l) => [l.payment_id, l]));
+   * ```
+   *
+   * Profile-scoped like every other subscription route, and that matters more
+   * here than elsewhere: a `payment_id` is merchant-supplied and only unique
+   * within a merchant, so the shop is part of the question, not an
+   * optimisation. Pass the profile that owns **the payments** — for a list
+   * spanning several shops, group the ids by shop and call once per group.
+   *
+   * At most 200 ids per call.
+   */
+  async lookupPayments(params, options) {
+    return this.request("POST", "/subscriptions/payments/lookup", { body: params, ...options });
+  }
+};
+
+// src/resources/settlement.ts
+var Settlement = class {
+  constructor(request) {
+    this.request = request;
+  }
+  /**
+   * Per-shop settlement rollup for the host merchant: unpaid totals and the
+   * running current period, one row per shop.
+   *
+   * `GET /settlement/overview`
+   */
+  async overview(params, options) {
+    return this.request("GET", "/settlement/overview", {
+      query: { test_mode: params.test_mode },
+      ...options
+    });
+  }
+  /**
+   * Live rollup of the current (not yet statemented) period.
+   *
+   * `GET /settlement/current`
+   */
+  async current(params, options) {
+    return this.request("GET", "/settlement/current", {
+      query: { test_mode: params.test_mode, profile_id: params.profile_id },
+      ...options
+    });
+  }
+  /**
+   * List generated settlement statements, newest first.
+   *
+   * `GET /settlement/statements`
+   */
+  async listStatements(params, options) {
+    return this.request("GET", "/settlement/statements", {
+      query: {
+        test_mode: params.test_mode,
+        profile_id: params.profile_id,
+        limit: params.limit,
+        offset: params.offset
+      },
+      ...options
+    });
+  }
+  /**
+   * One statement with its per-connector/currency breakdown.
+   *
+   * `GET /settlement/statements/{statementId}`
+   */
+  async retrieveStatement(statementId, options) {
+    return this.request(
+      "GET",
+      `/settlement/statements/${encodeURIComponent(statementId)}`,
+      options
+    );
+  }
+  /**
+   * Generate (or regenerate) the statement for one shop and calendar month.
+   *
+   * `POST /settlement/statements/generate`
+   */
+  async generateStatement(params, options) {
+    return this.request("POST", "/settlement/statements/generate", {
+      body: params,
+      ...options
+    });
+  }
+  /**
+   * Record payout progress on a statement (`unpaid` / `partial` / `paid`).
+   *
+   * `POST /settlement/statements/{statementId}/payout`
+   */
+  async updateStatementPayout(statementId, params, options) {
+    return this.request(
+      "POST",
+      `/settlement/statements/${encodeURIComponent(statementId)}/payout`,
+      { body: params, ...options }
+    );
+  }
+  /**
+   * Export a statement as PDF. Returns the raw PDF bytes as a `Blob`, with
+   * the same auth, retries and error handling as every other call — persist
+   * or object-URL it caller-side.
+   *
+   * `GET /settlement/statements/{statementId}/pdf`
+   *
+   * @example
+   * ```typescript
+   * const pdf = await delopay.settlement.downloadStatementPdf('stmt_1', {
+   *   currency: 'EUR',
+   *   include_transactions: true,
+   * });
+   * const url = URL.createObjectURL(pdf);
+   * ```
+   */
+  async downloadStatementPdf(statementId, params, options) {
+    return this.request("GET", `/settlement/statements/${encodeURIComponent(statementId)}/pdf`, {
+      query: {
+        currency: params?.currency,
+        include_transactions: params?.include_transactions
+      },
+      responseType: "blob",
+      ...options
+    });
+  }
+  /**
+   * The individual settled attempts of one shop's calendar month.
+   *
+   * `GET /settlement/lines`
+   */
+  async listLines(params, options) {
+    return this.request("GET", "/settlement/lines", {
+      query: {
+        profile_id: params.profile_id,
+        year: params.year,
+        month: params.month,
+        test_mode: params.test_mode,
+        limit: params.limit,
+        offset: params.offset
+      },
+      ...options
+    });
+  }
+  /**
+   * The fee schedules that currently apply to a shop.
+   *
+   * `GET /settlement/fee-config`
+   */
+  async feeConfig(params, options) {
+    return this.request("GET", "/settlement/fee-config", {
+      query: { profile_id: params.profile_id },
+      ...options
+    });
+  }
+  /**
+   * Enqueue a settlement-line backfill over historical attempts. Attempts
+   * already covered by a line are always skipped.
+   *
+   * `POST /settlement/backfill`
+   */
+  async backfill(params, options) {
+    return this.request("POST", "/settlement/backfill", { body: params, ...options });
+  }
+  /**
+   * Toggle whether a shop's owner can see their own settlement figures.
+   *
+   * `POST /settlement/shops/visibility`
+   */
+  async setShopVisibility(params, options) {
+    return this.request("POST", "/settlement/shops/visibility", {
+      body: params,
+      ...options
+    });
+  }
+  /**
+   * Manual adjustments recorded on a statement.
+   *
+   * `GET /settlement/statements/{statementId}/adjustments`
+   */
+  async listStatementAdjustments(statementId, options) {
+    return this.request(
+      "GET",
+      `/settlement/statements/${encodeURIComponent(statementId)}/adjustments`,
+      options
+    );
+  }
+  /**
+   * Add a manual adjustment to a statement. Positive `amount_usd` charges
+   * the shop (reducing their payout); negative credits them.
+   *
+   * `POST /settlement/statements/{statementId}/adjustments`
+   */
+  async createStatementAdjustment(statementId, params, options) {
+    return this.request(
+      "POST",
+      `/settlement/statements/${encodeURIComponent(statementId)}/adjustments`,
+      { body: params, ...options }
+    );
+  }
+  /**
+   * Remove a manual adjustment from a statement.
+   *
+   * `DELETE /settlement/statements/{statementId}/adjustments/{adjustmentId}`
+   */
+  async deleteStatementAdjustment(statementId, adjustmentId, options) {
+    return this.request(
+      "DELETE",
+      `/settlement/statements/${encodeURIComponent(statementId)}/adjustments/${encodeURIComponent(adjustmentId)}`,
+      options
+    );
+  }
+};
+
+// src/resources/operationLimits.ts
+var OperationLimits = class {
+  constructor(request) {
+    this.request = request;
+  }
+  /**
+   * List the merchant's limit rules, optionally for one operation.
+   *
+   * `GET /operation-limits/rules`
+   */
+  async listRules(params, options) {
+    return this.request("GET", "/operation-limits/rules", {
+      query: { operation: params?.operation },
+      ...options
+    });
+  }
+  /**
+   * Create or replace the limit rule for one target. Full-replace upsert:
+   * absent limit fields clear that dimension.
+   *
+   * `PUT /operation-limits/rules`
+   */
+  async upsertRule(params, options) {
+    return this.request("PUT", "/operation-limits/rules", { body: params, ...options });
+  }
+  /**
+   * Delete a limit rule.
+   *
+   * `DELETE /operation-limits/rules/{ruleId}`
+   */
+  async deleteRule(ruleId, options) {
+    return this.request("DELETE", `/operation-limits/rules/${encodeURIComponent(ruleId)}`, options);
+  }
+  /**
+   * The merchant-level enforcement settings. An untouched merchant gets the
+   * defaults: rolling window, admins not exempt.
+   *
+   * `GET /operation-limits/settings`
+   */
+  async retrieveSettings(options) {
+    return this.request("GET", "/operation-limits/settings", options);
+  }
+  /**
+   * Update the enforcement settings. Only provided fields change.
+   *
+   * `PUT /operation-limits/settings`
+   */
+  async updateSettings(params, options) {
+    return this.request("PUT", "/operation-limits/settings", { body: params, ...options });
+  }
 };
 
 // src/client.ts
@@ -3366,6 +3831,8 @@ var Delopay = class {
     this.relay = new Relay(request);
     this.stripeConnect = new StripeConnect(request);
     this.threeDsRules = new ThreeDsRules(request);
+    this.settlement = new Settlement(request);
+    this.operationLimits = new OperationLimits(request);
     this.subscriptions = new Subscriptions(request);
     this.files = new Files(request);
     this.export = new Export(request);
@@ -3489,7 +3956,8 @@ var Delopay = class {
           method,
           headers,
           body: serializedBody,
-          signal: combined.signal
+          signal: combined.signal,
+          ...options?.keepalive !== void 0 ? { keepalive: options.keepalive } : {}
         });
         const requestId = response.headers?.get("x-request-id") ?? response.headers?.get("x-trace-id") ?? void 0;
         emit("response", { status: response.status, method, path, requestId });
@@ -3536,6 +4004,12 @@ var Delopay = class {
           }
           throw error;
         }
+        if (options?.responseType === "blob") {
+          return await response.blob();
+        }
+        if (options?.responseType === "arraybuffer") {
+          return await response.arrayBuffer();
+        }
         const text = await response.text();
         return text ? JSON.parse(text) : void 0;
       } catch (err) {
@@ -4779,6 +5253,205 @@ function shadowFor(style) {
   }
 }
 
+// src/checkoutSession.ts
+function withoutCredentialHeaders(extra) {
+  if (!extra) return {};
+  const out = {};
+  for (const [key, value] of Object.entries(extra)) {
+    const lower = key.toLowerCase();
+    if (lower === "api-key" || lower === "authorization") continue;
+    out[key] = value;
+  }
+  return out;
+}
+var CheckoutSession = class {
+  constructor(options) {
+    this.merchantId = options.merchantId;
+    this.paymentId = options.paymentId;
+    this.publishableKey = options.publishableKey;
+    this.clientSecret = options.clientSecret;
+    this.client = new Delopay("", {
+      baseUrl: options.baseUrl,
+      sandbox: options.sandbox,
+      timeout: options.timeout,
+      maxRetries: options.maxRetries,
+      debug: options.debug,
+      logger: options.logger
+    });
+  }
+  get linkBase() {
+    return `/payment-link/${encodeURIComponent(this.merchantId)}/${encodeURIComponent(this.paymentId)}`;
+  }
+  /** Headers for the client-secret bearer routes (`/payment-link/*`). */
+  bearerHeaders(extra) {
+    return {
+      ...withoutCredentialHeaders(extra),
+      Authorization: `Bearer ${this.requireClientSecret()}`
+    };
+  }
+  /** Headers for the publishable-key routes (`/payments/*`, `/payment-methods`). */
+  pkHeaders(extra) {
+    if (!this.publishableKey) {
+      throw new DelopayError("This call requires the publishable key", {
+        status: 0,
+        code: "MISSING_CREDENTIAL",
+        type: "invalid_request"
+      });
+    }
+    return { ...withoutCredentialHeaders(extra), "api-key": this.publishableKey };
+  }
+  requireClientSecret() {
+    if (!this.clientSecret) {
+      throw new DelopayError("This call requires the payment client secret", {
+        status: 0,
+        code: "MISSING_CREDENTIAL",
+        type: "invalid_request"
+      });
+    }
+    return this.clientSecret;
+  }
+  /**
+   * The Paysepro rail catalog for the buyer's country.
+   *
+   * `GET /payment-link/{merchantId}/{paymentId}/paysepro/methods`
+   *
+   * @param country - Lowercase ISO 3166-1 alpha-2 country code.
+   */
+  async payseproMethods(country, options) {
+    return this.client.request("GET", `${this.linkBase}/paysepro/methods`, {
+      query: { cc: country },
+      ...options,
+      headers: this.bearerHeaders(options?.headers)
+    });
+  }
+  /**
+   * The e-Payouts rail catalog for the buyer's country, plus the set of
+   * countries that have at least one vendor.
+   *
+   * `GET /payment-link/{merchantId}/{paymentId}/epayouts/methods`
+   *
+   * @param country - Lowercase ISO 3166-1 alpha-2 country code.
+   */
+  async epayoutsMethods(country, options) {
+    return this.client.request("GET", `${this.linkBase}/epayouts/methods`, {
+      query: { cc: country },
+      ...options,
+      headers: this.bearerHeaders(options?.headers)
+    });
+  }
+  /**
+   * Record a buyer-side checkout event on the payment's status timeline.
+   *
+   * Telemetry semantics, built in so callers can genuinely fire-and-forget:
+   * the request is sent with `keepalive: true` (it survives the document
+   * navigating away, e.g. right before a `window.open`), and transport or
+   * server failures resolve to `undefined` instead of rejecting — telemetry
+   * must never break a checkout or surface an unhandled rejection. Do not
+   * `await` this in a click handler that must stay synchronous.
+   *
+   * A missing client secret still throws `MISSING_CREDENTIAL`: that is a
+   * wiring bug, not a telemetry failure.
+   *
+   * `POST /payment-link/{merchantId}/{paymentId}/checkout-events`
+   */
+  async recordEvent(params, options) {
+    const headers = this.bearerHeaders(options?.headers);
+    try {
+      return await this.client.request("POST", `${this.linkBase}/checkout-events`, {
+        body: params,
+        keepalive: true,
+        ...options,
+        headers
+      });
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * A short-lived VGS Collect session for browser-side card capture.
+   *
+   * A 404 — or a 400 carrying the "shop has no vault" code — means the shop
+   * has no vault configured; other errors must NOT be treated that way (a
+   * refused vault falling back to an unprotected card pane is exactly the
+   * bug this endpoint's error contract exists to prevent).
+   *
+   * `GET /payment-link/{merchantId}/{paymentId}/vault/collect-session`
+   */
+  async vaultCollectSession(options) {
+    return this.client.request("GET", `${this.linkBase}/vault/collect-session`, {
+      ...options,
+      headers: this.bearerHeaders(options?.headers)
+    });
+  }
+  /**
+   * Register the aliased card as a payment method and mint the one-shot
+   * `payment_token` the confirm call spends.
+   *
+   * `POST /payment-link/{merchantId}/{paymentId}/vault/payment-method`
+   */
+  async registerVaultPaymentMethod(params, options) {
+    return this.client.request("POST", `${this.linkBase}/vault/payment-method`, {
+      body: params,
+      ...options,
+      headers: this.bearerHeaders(options?.headers)
+    });
+  }
+  /**
+   * The payment's current state — status polling for redirect/popup rails.
+   *
+   * `GET /payments/{paymentId}` (publishable key + client secret)
+   */
+  async retrievePayment(options) {
+    return this.client.request("GET", `/payments/${encodeURIComponent(this.paymentId)}`, {
+      query: { client_secret: this.requireClientSecret() },
+      ...options,
+      headers: this.pkHeaders(options?.headers)
+    });
+  }
+  /**
+   * Update the payment before confirmation (e.g. persist custom-field
+   * answers as `metadata` on rails that never hit `/confirm`). The client
+   * secret is attached automatically.
+   *
+   * `POST /payments/{paymentId}` (publishable key)
+   */
+  async updatePayment(params, options) {
+    return this.client.request("POST", `/payments/${encodeURIComponent(this.paymentId)}`, {
+      body: { ...params, client_secret: this.requireClientSecret() },
+      ...options,
+      headers: this.pkHeaders(options?.headers)
+    });
+  }
+  /**
+   * Confirm the payment. The client secret is attached automatically; pass
+   * an `Idempotency-Key` header via `options` to make retries safe.
+   *
+   * `POST /payments/{paymentId}/confirm` (publishable key)
+   */
+  async confirmPayment(params, options) {
+    return this.client.request("POST", `/payments/${encodeURIComponent(this.paymentId)}/confirm`, {
+      body: { ...params, client_secret: this.requireClientSecret() },
+      ...options,
+      headers: this.pkHeaders(options?.headers)
+    });
+  }
+  /**
+   * Payment methods available for this payment.
+   *
+   * `GET /payment-methods` (publishable key + client secret)
+   *
+   * @param params - Optional filters; `country` is the highest-precedence
+   *   geo hint, ahead of billing address and IP geolocation.
+   */
+  async listPaymentMethods(params, options) {
+    return this.client.request("GET", "/payment-methods", {
+      query: { client_secret: this.requireClientSecret(), country: params?.country },
+      ...options,
+      headers: this.pkHeaders(options?.headers)
+    });
+  }
+};
+
 // src/nativePanes.ts
 var STRIPE_NATIVE_PANE_METHODS = [
   {
@@ -5023,6 +5696,8 @@ export {
   Regions,
   AvailabilityOverrides,
   Subscriptions,
+  Settlement,
+  OperationLimits,
   Delopay,
   leaf,
   allOf,
@@ -5084,6 +5759,7 @@ export {
   parseImportedBranding,
   applyBrandingVariables,
   shadowFor,
+  CheckoutSession,
   STRIPE_NATIVE_PANE_METHODS,
   NATIVE_PANE_ICON_KEYS,
   NATIVE_PANE_CATEGORY_KEYS,
@@ -5096,4 +5772,4 @@ export {
   focusedCheckoutUrl,
   CHECKOUT_EVENT_KINDS
 };
-//# sourceMappingURL=chunk-G44EQT6Q.js.map
+//# sourceMappingURL=chunk-DQ36QCU7.js.map