@delopay/sdk 0.83.0 → 0.86.0

package/dist/internal.cjs

@@ -43,6 +43,7 @@ __export(internal_exports, {
   Cache: () => Cache,
   CardIssuers: () => CardIssuers,
   Cards: () => Cards,
+  CheckoutSession: () => CheckoutSession,
   Configs: () => Configs,
   ConnectorRestrictionRules: () => ConnectorRestrictionRules,
   ConnectorRestrictions: () => ConnectorRestrictions,
@@ -63,11 +64,13 @@ __export(internal_exports, {
   NATIVE_PANES_MAX: () => NATIVE_PANES_MAX,
   NATIVE_PANE_CATEGORY_KEYS: () => NATIVE_PANE_CATEGORY_KEYS,
   NATIVE_PANE_ICON_KEYS: () => NATIVE_PANE_ICON_KEYS,
+  OperationLimits: () => OperationLimits,
   PlatformBilling: () => PlatformBilling,
   PlatformFees: () => PlatformFees,
   Regions: () => Regions,
   STRIPE_NATIVE_PANE_METHODS: () => STRIPE_NATIVE_PANE_METHODS,
   Search: () => Search,
+  Settlement: () => Settlement,
   Subscriptions: () => Subscriptions,
   Webhooks: () => Webhooks,
   allOf: () => allOf,
@@ -557,6 +560,39 @@ var Connectors = class {
   async list(accountId) {
     return this.request("GET", `/account/${encodeURIComponent(accountId)}/connectors`);
   }
+  /**
+   * The profile-scoped connector list. The merchant-wide `list()` is
+   * merchant-gated and 403s for a profile-entity (shop user) JWT; this
+   * variant is scoped server-side to the caller's own profile.
+   *
+   * `GET /account/{accountId}/profile/connectors`
+   */
+  async listByProfile(accountId) {
+    return this.request("GET", `/account/${encodeURIComponent(accountId)}/profile/connectors`);
+  }
+  /**
+   * The built-in e-Payouts reference catalog — the "Restore defaults" source.
+   * `GET /account/{accountId}/connectors/epayouts/catalog/defaults`
+   */
+  async getEpayoutsCatalogDefaults(accountId) {
+    return this.request(
+      "GET",
+      `/account/${encodeURIComponent(accountId)}/connectors/epayouts/catalog/defaults`
+    );
+  }
+  /**
+   * Sweep the merchant's own e-Payouts module and return the rails it
+   * actually has enabled. Server-side this makes many upstream calls, so it
+   * can take several seconds — show progress.
+   *
+   * `POST /account/{accountId}/connectors/{connectorId}/epayouts/catalog/sync`
+   */
+  async syncEpayoutsCatalog(accountId, connectorId) {
+    return this.request(
+      "POST",
+      `/account/${encodeURIComponent(accountId)}/connectors/${encodeURIComponent(connectorId)}/epayouts/catalog/sync`
+    );
+  }
   async update(accountId, connectorId, params) {
     return this.request(
       "POST",
@@ -589,6 +625,55 @@ var Connectors = class {
     );
   }
   // --- Advanced operations (Task 4.8) ---
+  /**
+   * Run the configuration checks for a vault (VGS) connector account:
+   * credential validity, write-only Collect scope, reachability, environment
+   * coherence, route coverage. Read-only but not cheap — it decrypts the
+   * vault's management credential and talks to VGS.
+   *
+   * `POST /account/{accountId}/connectors/{connectorId}/vault/verify`
+   */
+  async verifyVault(accountId, connectorId, params) {
+    return this.request(
+      "POST",
+      `/account/${encodeURIComponent(accountId)}/connectors/${encodeURIComponent(connectorId)}/vault/verify`,
+      { body: params }
+    );
+  }
+  /**
+   * Compute the route document the vault SHOULD have and diff it against
+   * what exists, without writing anything. The returned fingerprints must be
+   * echoed byte for byte on {@link Connectors.applyVaultRoutes}.
+   *
+   * A router without these endpoints answers 404 — render that as "this
+   * build cannot configure routes", never as "there is nothing to change".
+   *
+   * `POST /account/{accountId}/connectors/{connectorId}/vault/routes/preview`
+   */
+  async previewVaultRoutes(accountId, connectorId, params) {
+    return this.request(
+      "POST",
+      `/account/${encodeURIComponent(accountId)}/connectors/${encodeURIComponent(connectorId)}/vault/routes/preview`,
+      { body: params }
+    );
+  }
+  /**
+   * Write the routes the merchant just previewed. Both fingerprints come
+   * from the preview and are opaque: `expected_current_fingerprint` says the
+   * vault has not moved (`null` = "the preview found no routes" and is sent
+   * as `null`, never omitted), `expected_desired_fingerprint` says the
+   * document is still the one on screen. A 409 (`DE_04`) means the vault
+   * changed since the preview — nothing was written; preview again.
+   *
+   * `POST /account/{accountId}/connectors/{connectorId}/vault/routes/apply`
+   */
+  async applyVaultRoutes(accountId, connectorId, params) {
+    return this.request(
+      "POST",
+      `/account/${encodeURIComponent(accountId)}/connectors/${encodeURIComponent(connectorId)}/vault/routes/apply`,
+      { body: params }
+    );
+  }
   /** Verify connector credentials. `POST /account/connectors/verify` */
   async verify(params) {
     return this.request("POST", "/account/connectors/verify", { body: params });
@@ -1551,6 +1636,39 @@ var Payments = class {
       ...options
     });
   }
+  /**
+   * The status timeline of client/device observations captured while the
+   * buyer interacted with the payment (checkout opens, confirms, redirect
+   * legs, reported client signals), oldest first.
+   *
+   * `GET /payments/{paymentId}/client-context`
+   */
+  async listClientContext(paymentId, options) {
+    return this.request(
+      "GET",
+      `/payments/${encodeURIComponent(paymentId)}/client-context`,
+      options
+    );
+  }
+  /**
+   * Soft-delete a payment. Only payments whose status is in the merchant's
+   * delete policy (see {@link Payments.getDeletePolicy}) can be deleted;
+   * anything else fails with a precondition error.
+   *
+   * `DELETE /payments/{paymentId}`
+   */
+  async delete(paymentId, options) {
+    return this.request("DELETE", `/payments/${encodeURIComponent(paymentId)}`, options);
+  }
+  /**
+   * The effective deletable-status set for the calling merchant — lets a
+   * dashboard show the delete action only where it is allowed.
+   *
+   * `GET /payments/delete-policy`
+   */
+  async getDeletePolicy(options) {
+    return this.request("GET", "/payments/delete-policy", options);
+  }
   // --- Advanced operations (Task 3.2) ---
   /** Generate session tokens. `POST /payments/session-tokens` */
   async sessionTokens(params) {
@@ -1621,10 +1739,30 @@ var Payments = class {
   async listByFilter(params) {
     return this.request("POST", "/payments/list", { body: params });
   }
+  /**
+   * List payments by filter, scoped to the caller's profile (the shop-user
+   * twin of `listByFilter`). The backend narrows to the profile from the
+   * auth context, so `profile_id` / `project_id` must not be sent.
+   *
+   * Not to be confused with {@link Payments.listByProfile}, which is the GET
+   * cursor variant and rejects this body.
+   *
+   * `POST /payments/profile/list`
+   */
+  async listByProfileFilter(params, options) {
+    return this.request("POST", "/payments/profile/list", { body: params, ...options });
+  }
   /** Get payment filter options. `GET /payments/filter` */
   async getFilters(params) {
     return this.request("GET", "/payments/filter", { query: params });
   }
+  /**
+   * Get payment filter options, scoped to the caller's profile.
+   * `GET /payments/profile/filter`
+   */
+  async getFiltersByProfile(params) {
+    return this.request("GET", "/payments/profile/filter", { query: params });
+  }
   /** Get payment aggregates. `GET /payments/aggregate` */
   async aggregate(params) {
     return this.request("GET", "/payments/aggregate", { query: params });
@@ -1825,6 +1963,16 @@ var Profiles = class {
   async list(accountId) {
     return this.request("GET", `/account/${encodeURIComponent(accountId)}/business-profile`);
   }
+  /**
+   * List the business profiles the caller can see at profile scope — the
+   * `ProfileAccountRead` twin of `list()` (which needs merchant-level read).
+   * A shop-scoped user gets exactly their own shop back.
+   *
+   * `GET /account/{accountId}/profile`
+   */
+  async listByProfile(accountId) {
+    return this.request("GET", `/account/${encodeURIComponent(accountId)}/profile`);
+  }
   async update(accountId, profileId, params) {
     return this.request(
       "POST",
@@ -2468,7 +2616,7 @@ var Shops = class {
   /**
    * Upload a logo file for a shop. The file is stored in Delopay's configured
    * object store and a public HTTPS URL is returned. This method does NOT write
-   * the URL into the shop's `payment_link_config.default_config.logo` — call
+   * the URL into the shop's `payment_link_config.logo` — call
    * `shops.update` afterwards with the returned `logo_url` to persist the change.
    *
    * Accepts PNG, JPEG, WebP or SVG. The file must be ≤ 1 MiB.
@@ -2482,7 +2630,7 @@ var Shops = class {
    * ```typescript
    * const { logo_url } = await delopay.shops.uploadLogo('merch_1', 'pro_1', file);
    * await delopay.shops.update('merch_1', 'pro_1', {
-   *   payment_link_config: { default_config: { logo: logo_url } },
+   *   payment_link_config: { logo: logo_url },
    * });
    * ```
    */
@@ -2495,6 +2643,29 @@ var Shops = class {
       { body: form }
     );
   }
+  /**
+   * Update only the checkout appearance (the `payment_link_config` blob:
+   * theme, logo, colours, seller name, SDK layout/rules, DeloPay-branding
+   * toggle) of a shop. Applied as a whole-object replace of
+   * `payment_link_config`, mirroring the shop-update semantics.
+   *
+   * Gated on the dedicated `CheckoutBranding` permission, so "may restyle
+   * the checkout" can be granted without full account/shop write.
+   *
+   * `POST /shops/{merchantId}/{shopId}/checkout-branding`
+   *
+   * @param merchantId - The merchant account ID.
+   * @param shopId - The shop (business profile) ID to restyle.
+   * @param params - The new `payment_link_config` blob (full replacement).
+   * @returns The updated business profile.
+   */
+  async updateCheckoutBranding(merchantId, shopId, params, options) {
+    return this.request(
+      "POST",
+      `/shops/${encodeURIComponent(merchantId)}/${encodeURIComponent(shopId)}/checkout-branding`,
+      { body: params, ...options }
+    );
+  }
 };
 
 // src/resources/stripeConnect.ts
@@ -2601,6 +2772,26 @@ var Users = class {
   async update(params) {
     return this.request("POST", "/user/update", { body: params });
   }
+  /**
+   * RFC 7396 merge-patch the caller's own user-scoped metadata bucket.
+   * Returns the full user details, so callers can refresh their context
+   * without a second fetch.
+   *
+   * `PATCH /user/metadata`
+   */
+  async updateMetadata(params) {
+    return this.request("PATCH", "/user/metadata", { body: params });
+  }
+  /**
+   * RFC 7396 merge-patch the merchant-scoped metadata bucket shared by
+   * every dashboard user of the merchant. Same response contract as
+   * {@link Users.updateMetadata}.
+   *
+   * `PATCH /user/merchant/metadata`
+   */
+  async updateMerchantMetadata(params) {
+    return this.request("PATCH", "/user/merchant/metadata", { body: params });
+  }
   /**
    * Permanently delete the caller's account. Requires a fresh password
    * (and a current 6-digit TOTP code if the user has TOTP enrolled). On
@@ -3360,6 +3551,283 @@ var Subscriptions = class {
       ...options
     });
   }
+  /**
+   * Resolve which of the given payments were raised by a subscription.
+   * `POST /subscriptions/payments/lookup`
+   *
+   * The linkage exists in one direction only — an invoice points at the payment
+   * it settled, and nothing is stamped on the payment — so this is the only way
+   * to tell a subscription charge from a one-off one when you are holding a
+   * page of payments. In particular, do not use `off_session` or the presence
+   * of a mandate: an ordinary saved-card charge sets those identically.
+   *
+   * Ids that belong to no subscription are **absent** from `links` rather than
+   * returned as an error, so match on presence:
+   *
+   * ```ts
+   * const { links } = await subscriptions.lookupPayments(
+   *   { payment_ids: page.map((p) => p.payment_id) },
+   *   { headers: { 'X-Profile-Id': profileId } },
+   * );
+   * const bySubscription = new Map(links.map((l) => [l.payment_id, l]));
+   * ```
+   *
+   * Profile-scoped like every other subscription route, and that matters more
+   * here than elsewhere: a `payment_id` is merchant-supplied and only unique
+   * within a merchant, so the shop is part of the question, not an
+   * optimisation. Pass the profile that owns **the payments** — for a list
+   * spanning several shops, group the ids by shop and call once per group.
+   *
+   * At most 200 ids per call.
+   */
+  async lookupPayments(params, options) {
+    return this.request("POST", "/subscriptions/payments/lookup", { body: params, ...options });
+  }
+};
+
+// src/resources/settlement.ts
+var Settlement = class {
+  constructor(request) {
+    this.request = request;
+  }
+  /**
+   * Per-shop settlement rollup for the host merchant: unpaid totals and the
+   * running current period, one row per shop.
+   *
+   * `GET /settlement/overview`
+   */
+  async overview(params, options) {
+    return this.request("GET", "/settlement/overview", {
+      query: { test_mode: params.test_mode },
+      ...options
+    });
+  }
+  /**
+   * Live rollup of the current (not yet statemented) period.
+   *
+   * `GET /settlement/current`
+   */
+  async current(params, options) {
+    return this.request("GET", "/settlement/current", {
+      query: { test_mode: params.test_mode, profile_id: params.profile_id },
+      ...options
+    });
+  }
+  /**
+   * List generated settlement statements, newest first.
+   *
+   * `GET /settlement/statements`
+   */
+  async listStatements(params, options) {
+    return this.request("GET", "/settlement/statements", {
+      query: {
+        test_mode: params.test_mode,
+        profile_id: params.profile_id,
+        limit: params.limit,
+        offset: params.offset
+      },
+      ...options
+    });
+  }
+  /**
+   * One statement with its per-connector/currency breakdown.
+   *
+   * `GET /settlement/statements/{statementId}`
+   */
+  async retrieveStatement(statementId, options) {
+    return this.request(
+      "GET",
+      `/settlement/statements/${encodeURIComponent(statementId)}`,
+      options
+    );
+  }
+  /**
+   * Generate (or regenerate) the statement for one shop and calendar month.
+   *
+   * `POST /settlement/statements/generate`
+   */
+  async generateStatement(params, options) {
+    return this.request("POST", "/settlement/statements/generate", {
+      body: params,
+      ...options
+    });
+  }
+  /**
+   * Record payout progress on a statement (`unpaid` / `partial` / `paid`).
+   *
+   * `POST /settlement/statements/{statementId}/payout`
+   */
+  async updateStatementPayout(statementId, params, options) {
+    return this.request(
+      "POST",
+      `/settlement/statements/${encodeURIComponent(statementId)}/payout`,
+      { body: params, ...options }
+    );
+  }
+  /**
+   * Export a statement as PDF. Returns the raw PDF bytes as a `Blob`, with
+   * the same auth, retries and error handling as every other call — persist
+   * or object-URL it caller-side.
+   *
+   * `GET /settlement/statements/{statementId}/pdf`
+   *
+   * @example
+   * ```typescript
+   * const pdf = await delopay.settlement.downloadStatementPdf('stmt_1', {
+   *   currency: 'EUR',
+   *   include_transactions: true,
+   * });
+   * const url = URL.createObjectURL(pdf);
+   * ```
+   */
+  async downloadStatementPdf(statementId, params, options) {
+    return this.request("GET", `/settlement/statements/${encodeURIComponent(statementId)}/pdf`, {
+      query: {
+        currency: params?.currency,
+        include_transactions: params?.include_transactions
+      },
+      responseType: "blob",
+      ...options
+    });
+  }
+  /**
+   * The individual settled attempts of one shop's calendar month.
+   *
+   * `GET /settlement/lines`
+   */
+  async listLines(params, options) {
+    return this.request("GET", "/settlement/lines", {
+      query: {
+        profile_id: params.profile_id,
+        year: params.year,
+        month: params.month,
+        test_mode: params.test_mode,
+        limit: params.limit,
+        offset: params.offset
+      },
+      ...options
+    });
+  }
+  /**
+   * The fee schedules that currently apply to a shop.
+   *
+   * `GET /settlement/fee-config`
+   */
+  async feeConfig(params, options) {
+    return this.request("GET", "/settlement/fee-config", {
+      query: { profile_id: params.profile_id },
+      ...options
+    });
+  }
+  /**
+   * Enqueue a settlement-line backfill over historical attempts. Attempts
+   * already covered by a line are always skipped.
+   *
+   * `POST /settlement/backfill`
+   */
+  async backfill(params, options) {
+    return this.request("POST", "/settlement/backfill", { body: params, ...options });
+  }
+  /**
+   * Toggle whether a shop's owner can see their own settlement figures.
+   *
+   * `POST /settlement/shops/visibility`
+   */
+  async setShopVisibility(params, options) {
+    return this.request("POST", "/settlement/shops/visibility", {
+      body: params,
+      ...options
+    });
+  }
+  /**
+   * Manual adjustments recorded on a statement.
+   *
+   * `GET /settlement/statements/{statementId}/adjustments`
+   */
+  async listStatementAdjustments(statementId, options) {
+    return this.request(
+      "GET",
+      `/settlement/statements/${encodeURIComponent(statementId)}/adjustments`,
+      options
+    );
+  }
+  /**
+   * Add a manual adjustment to a statement. Positive `amount_usd` charges
+   * the shop (reducing their payout); negative credits them.
+   *
+   * `POST /settlement/statements/{statementId}/adjustments`
+   */
+  async createStatementAdjustment(statementId, params, options) {
+    return this.request(
+      "POST",
+      `/settlement/statements/${encodeURIComponent(statementId)}/adjustments`,
+      { body: params, ...options }
+    );
+  }
+  /**
+   * Remove a manual adjustment from a statement.
+   *
+   * `DELETE /settlement/statements/{statementId}/adjustments/{adjustmentId}`
+   */
+  async deleteStatementAdjustment(statementId, adjustmentId, options) {
+    return this.request(
+      "DELETE",
+      `/settlement/statements/${encodeURIComponent(statementId)}/adjustments/${encodeURIComponent(adjustmentId)}`,
+      options
+    );
+  }
+};
+
+// src/resources/operationLimits.ts
+var OperationLimits = class {
+  constructor(request) {
+    this.request = request;
+  }
+  /**
+   * List the merchant's limit rules, optionally for one operation.
+   *
+   * `GET /operation-limits/rules`
+   */
+  async listRules(params, options) {
+    return this.request("GET", "/operation-limits/rules", {
+      query: { operation: params?.operation },
+      ...options
+    });
+  }
+  /**
+   * Create or replace the limit rule for one target. Full-replace upsert:
+   * absent limit fields clear that dimension.
+   *
+   * `PUT /operation-limits/rules`
+   */
+  async upsertRule(params, options) {
+    return this.request("PUT", "/operation-limits/rules", { body: params, ...options });
+  }
+  /**
+   * Delete a limit rule.
+   *
+   * `DELETE /operation-limits/rules/{ruleId}`
+   */
+  async deleteRule(ruleId, options) {
+    return this.request("DELETE", `/operation-limits/rules/${encodeURIComponent(ruleId)}`, options);
+  }
+  /**
+   * The merchant-level enforcement settings. An untouched merchant gets the
+   * defaults: rolling window, admins not exempt.
+   *
+   * `GET /operation-limits/settings`
+   */
+  async retrieveSettings(options) {
+    return this.request("GET", "/operation-limits/settings", options);
+  }
+  /**
+   * Update the enforcement settings. Only provided fields change.
+   *
+   * `PUT /operation-limits/settings`
+   */
+  async updateSettings(params, options) {
+    return this.request("PUT", "/operation-limits/settings", { body: params, ...options });
+  }
 };
 
 // src/client.ts
@@ -3489,6 +3957,8 @@ var Delopay = class {
     this.relay = new Relay(request);
     this.stripeConnect = new StripeConnect(request);
     this.threeDsRules = new ThreeDsRules(request);
+    this.settlement = new Settlement(request);
+    this.operationLimits = new OperationLimits(request);
     this.subscriptions = new Subscriptions(request);
     this.files = new Files(request);
     this.export = new Export(request);
@@ -3612,7 +4082,8 @@ var Delopay = class {
           method,
           headers,
           body: serializedBody,
-          signal: combined.signal
+          signal: combined.signal,
+          ...options?.keepalive !== void 0 ? { keepalive: options.keepalive } : {}
         });
         const requestId = response.headers?.get("x-request-id") ?? response.headers?.get("x-trace-id") ?? void 0;
         emit("response", { status: response.status, method, path, requestId });
@@ -3659,6 +4130,12 @@ var Delopay = class {
           }
           throw error;
         }
+        if (options?.responseType === "blob") {
+          return await response.blob();
+        }
+        if (options?.responseType === "arraybuffer") {
+          return await response.arrayBuffer();
+        }
         const text = await response.text();
         return text ? JSON.parse(text) : void 0;
       } catch (err) {
@@ -4902,6 +5379,205 @@ function shadowFor(style) {
   }
 }
 
+// src/checkoutSession.ts
+function withoutCredentialHeaders(extra) {
+  if (!extra) return {};
+  const out = {};
+  for (const [key, value] of Object.entries(extra)) {
+    const lower = key.toLowerCase();
+    if (lower === "api-key" || lower === "authorization") continue;
+    out[key] = value;
+  }
+  return out;
+}
+var CheckoutSession = class {
+  constructor(options) {
+    this.merchantId = options.merchantId;
+    this.paymentId = options.paymentId;
+    this.publishableKey = options.publishableKey;
+    this.clientSecret = options.clientSecret;
+    this.client = new Delopay("", {
+      baseUrl: options.baseUrl,
+      sandbox: options.sandbox,
+      timeout: options.timeout,
+      maxRetries: options.maxRetries,
+      debug: options.debug,
+      logger: options.logger
+    });
+  }
+  get linkBase() {
+    return `/payment-link/${encodeURIComponent(this.merchantId)}/${encodeURIComponent(this.paymentId)}`;
+  }
+  /** Headers for the client-secret bearer routes (`/payment-link/*`). */
+  bearerHeaders(extra) {
+    return {
+      ...withoutCredentialHeaders(extra),
+      Authorization: `Bearer ${this.requireClientSecret()}`
+    };
+  }
+  /** Headers for the publishable-key routes (`/payments/*`, `/payment-methods`). */
+  pkHeaders(extra) {
+    if (!this.publishableKey) {
+      throw new DelopayError("This call requires the publishable key", {
+        status: 0,
+        code: "MISSING_CREDENTIAL",
+        type: "invalid_request"
+      });
+    }
+    return { ...withoutCredentialHeaders(extra), "api-key": this.publishableKey };
+  }
+  requireClientSecret() {
+    if (!this.clientSecret) {
+      throw new DelopayError("This call requires the payment client secret", {
+        status: 0,
+        code: "MISSING_CREDENTIAL",
+        type: "invalid_request"
+      });
+    }
+    return this.clientSecret;
+  }
+  /**
+   * The Paysepro rail catalog for the buyer's country.
+   *
+   * `GET /payment-link/{merchantId}/{paymentId}/paysepro/methods`
+   *
+   * @param country - Lowercase ISO 3166-1 alpha-2 country code.
+   */
+  async payseproMethods(country, options) {
+    return this.client.request("GET", `${this.linkBase}/paysepro/methods`, {
+      query: { cc: country },
+      ...options,
+      headers: this.bearerHeaders(options?.headers)
+    });
+  }
+  /**
+   * The e-Payouts rail catalog for the buyer's country, plus the set of
+   * countries that have at least one vendor.
+   *
+   * `GET /payment-link/{merchantId}/{paymentId}/epayouts/methods`
+   *
+   * @param country - Lowercase ISO 3166-1 alpha-2 country code.
+   */
+  async epayoutsMethods(country, options) {
+    return this.client.request("GET", `${this.linkBase}/epayouts/methods`, {
+      query: { cc: country },
+      ...options,
+      headers: this.bearerHeaders(options?.headers)
+    });
+  }
+  /**
+   * Record a buyer-side checkout event on the payment's status timeline.
+   *
+   * Telemetry semantics, built in so callers can genuinely fire-and-forget:
+   * the request is sent with `keepalive: true` (it survives the document
+   * navigating away, e.g. right before a `window.open`), and transport or
+   * server failures resolve to `undefined` instead of rejecting — telemetry
+   * must never break a checkout or surface an unhandled rejection. Do not
+   * `await` this in a click handler that must stay synchronous.
+   *
+   * A missing client secret still throws `MISSING_CREDENTIAL`: that is a
+   * wiring bug, not a telemetry failure.
+   *
+   * `POST /payment-link/{merchantId}/{paymentId}/checkout-events`
+   */
+  async recordEvent(params, options) {
+    const headers = this.bearerHeaders(options?.headers);
+    try {
+      return await this.client.request("POST", `${this.linkBase}/checkout-events`, {
+        body: params,
+        keepalive: true,
+        ...options,
+        headers
+      });
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * A short-lived VGS Collect session for browser-side card capture.
+   *
+   * A 404 — or a 400 carrying the "shop has no vault" code — means the shop
+   * has no vault configured; other errors must NOT be treated that way (a
+   * refused vault falling back to an unprotected card pane is exactly the
+   * bug this endpoint's error contract exists to prevent).
+   *
+   * `GET /payment-link/{merchantId}/{paymentId}/vault/collect-session`
+   */
+  async vaultCollectSession(options) {
+    return this.client.request("GET", `${this.linkBase}/vault/collect-session`, {
+      ...options,
+      headers: this.bearerHeaders(options?.headers)
+    });
+  }
+  /**
+   * Register the aliased card as a payment method and mint the one-shot
+   * `payment_token` the confirm call spends.
+   *
+   * `POST /payment-link/{merchantId}/{paymentId}/vault/payment-method`
+   */
+  async registerVaultPaymentMethod(params, options) {
+    return this.client.request("POST", `${this.linkBase}/vault/payment-method`, {
+      body: params,
+      ...options,
+      headers: this.bearerHeaders(options?.headers)
+    });
+  }
+  /**
+   * The payment's current state — status polling for redirect/popup rails.
+   *
+   * `GET /payments/{paymentId}` (publishable key + client secret)
+   */
+  async retrievePayment(options) {
+    return this.client.request("GET", `/payments/${encodeURIComponent(this.paymentId)}`, {
+      query: { client_secret: this.requireClientSecret() },
+      ...options,
+      headers: this.pkHeaders(options?.headers)
+    });
+  }
+  /**
+   * Update the payment before confirmation (e.g. persist custom-field
+   * answers as `metadata` on rails that never hit `/confirm`). The client
+   * secret is attached automatically.
+   *
+   * `POST /payments/{paymentId}` (publishable key)
+   */
+  async updatePayment(params, options) {
+    return this.client.request("POST", `/payments/${encodeURIComponent(this.paymentId)}`, {
+      body: { ...params, client_secret: this.requireClientSecret() },
+      ...options,
+      headers: this.pkHeaders(options?.headers)
+    });
+  }
+  /**
+   * Confirm the payment. The client secret is attached automatically; pass
+   * an `Idempotency-Key` header via `options` to make retries safe.
+   *
+   * `POST /payments/{paymentId}/confirm` (publishable key)
+   */
+  async confirmPayment(params, options) {
+    return this.client.request("POST", `/payments/${encodeURIComponent(this.paymentId)}/confirm`, {
+      body: { ...params, client_secret: this.requireClientSecret() },
+      ...options,
+      headers: this.pkHeaders(options?.headers)
+    });
+  }
+  /**
+   * Payment methods available for this payment.
+   *
+   * `GET /payment-methods` (publishable key + client secret)
+   *
+   * @param params - Optional filters; `country` is the highest-precedence
+   *   geo hint, ahead of billing address and IP geolocation.
+   */
+  async listPaymentMethods(params, options) {
+    return this.client.request("GET", "/payment-methods", {
+      query: { client_secret: this.requireClientSecret(), country: params?.country },
+      ...options,
+      headers: this.pkHeaders(options?.headers)
+    });
+  }
+};
+
 // src/nativePanes.ts
 var STRIPE_NATIVE_PANE_METHODS = [
   {
@@ -5331,6 +6007,212 @@ var AdminPortal = class {
       { body: { iframe_allowed_origins: origins } }
     );
   }
+  /**
+   * Soft-delete a transaction of ANY merchant. Only payments whose status
+   * is in the admin delete policy can be deleted; the action is audited.
+   *
+   * `DELETE /admin-portal/transactions/{paymentId}`
+   */
+  async deleteTransaction(paymentId) {
+    return this.request("DELETE", `/admin-portal/transactions/${encodeURIComponent(paymentId)}`);
+  }
+  /**
+   * Recover (undelete) a soft-deleted transaction. Audited.
+   *
+   * `POST /admin-portal/transactions/{paymentId}/recover`
+   */
+  async recoverTransaction(paymentId) {
+    return this.request(
+      "POST",
+      `/admin-portal/transactions/${encodeURIComponent(paymentId)}/recover`
+    );
+  }
+  /**
+   * Client/device observations captured while the buyer interacted with a
+   * transaction of ANY merchant, oldest first.
+   *
+   * `GET /admin-portal/transactions/{paymentId}/client-context`
+   */
+  async getTransactionClientContext(paymentId) {
+    return this.request(
+      "GET",
+      `/admin-portal/transactions/${encodeURIComponent(paymentId)}/client-context`
+    );
+  }
+  /**
+   * The global payment auto-close policy.
+   * `GET /admin-portal/auto-close-config`
+   */
+  async getAutoCloseConfig() {
+    return this.request("GET", "/admin-portal/auto-close-config");
+  }
+  /**
+   * Update the global payment auto-close policy. PATCH semantics — omitted
+   * fields are left unchanged.
+   *
+   * `PUT /admin-portal/auto-close-config`
+   */
+  async updateAutoCloseConfig(params) {
+    return this.request("PUT", "/admin-portal/auto-close-config", { body: params });
+  }
+  /**
+   * One merchant's auto-close override plus the effective values.
+   * `GET /admin-portal/accounts/{merchantId}/auto-close-config`
+   */
+  async getMerchantAutoCloseConfig(merchantId) {
+    return this.request(
+      "GET",
+      `/admin-portal/accounts/${encodeURIComponent(merchantId)}/auto-close-config`
+    );
+  }
+  /**
+   * Replace one merchant's auto-close override. REPLACE semantics — sending
+   * both fields as `null` removes the override entirely.
+   *
+   * `PUT /admin-portal/accounts/{merchantId}/auto-close-config`
+   */
+  async updateMerchantAutoCloseConfig(merchantId, params) {
+    return this.request(
+      "PUT",
+      `/admin-portal/accounts/${encodeURIComponent(merchantId)}/auto-close-config`,
+      { body: params }
+    );
+  }
+  /**
+   * The global transaction soft-delete policy (statuses admins may delete,
+   * plus the deploy-time env ceiling).
+   *
+   * `GET /admin-portal/transaction-delete-config`
+   */
+  async getTransactionDeleteConfig() {
+    return this.request("GET", "/admin-portal/transaction-delete-config");
+  }
+  /**
+   * Replace the global deletable-status set. Must be a subset of the env
+   * ceiling.
+   *
+   * `PUT /admin-portal/transaction-delete-config`
+   */
+  async updateTransactionDeleteConfig(params) {
+    return this.request("PUT", "/admin-portal/transaction-delete-config", { body: params });
+  }
+  /**
+   * One merchant's deletable-status override plus the effective set.
+   * `GET /admin-portal/accounts/{merchantId}/transaction-delete-config`
+   */
+  async getMerchantTransactionDeleteConfig(merchantId) {
+    return this.request(
+      "GET",
+      `/admin-portal/accounts/${encodeURIComponent(merchantId)}/transaction-delete-config`
+    );
+  }
+  /**
+   * Replace one merchant's deletable-status override. `statuses: null`
+   * removes the override; an empty list forbids deletion entirely.
+   *
+   * `PUT /admin-portal/accounts/{merchantId}/transaction-delete-config`
+   */
+  async updateMerchantTransactionDeleteConfig(merchantId, params) {
+    return this.request(
+      "PUT",
+      `/admin-portal/accounts/${encodeURIComponent(merchantId)}/transaction-delete-config`,
+      { body: params }
+    );
+  }
+  /**
+   * A merchant's settlement statements. Same shapes as the merchant-facing
+   * `settlement` resource, admin-authenticated.
+   *
+   * `GET /admin-portal/accounts/{merchantId}/settlement/statements`
+   */
+  async listSettlementStatements(merchantId, params) {
+    return this.request(
+      "GET",
+      `/admin-portal/accounts/${encodeURIComponent(merchantId)}/settlement/statements`,
+      {
+        query: {
+          test_mode: params.test_mode,
+          profile_id: params.profile_id,
+          limit: params.limit,
+          offset: params.offset
+        }
+      }
+    );
+  }
+  /**
+   * One settlement statement with its breakdown.
+   * `GET /admin-portal/accounts/{merchantId}/settlement/statements/{statementId}`
+   */
+  async getSettlementStatement(merchantId, statementId) {
+    return this.request(
+      "GET",
+      `/admin-portal/accounts/${encodeURIComponent(merchantId)}/settlement/statements/${encodeURIComponent(statementId)}`
+    );
+  }
+  /**
+   * Export a settlement statement as PDF. Returns the raw bytes as a `Blob`
+   * with the same auth and error handling as every other call.
+   *
+   * `GET /admin-portal/accounts/{merchantId}/settlement/statements/{statementId}/pdf`
+   */
+  async downloadSettlementStatementPdf(merchantId, statementId, params) {
+    return this.request(
+      "GET",
+      `/admin-portal/accounts/${encodeURIComponent(merchantId)}/settlement/statements/${encodeURIComponent(statementId)}/pdf`,
+      {
+        query: {
+          currency: params?.currency,
+          include_transactions: params?.include_transactions
+        },
+        responseType: "blob"
+      }
+    );
+  }
+  /**
+   * A merchant's per-shop settlement overview.
+   * `GET /admin-portal/accounts/{merchantId}/settlement/overview`
+   */
+  async settlementOverview(merchantId, params) {
+    return this.request(
+      "GET",
+      `/admin-portal/accounts/${encodeURIComponent(merchantId)}/settlement/overview`,
+      { query: { test_mode: params.test_mode } }
+    );
+  }
+  /**
+   * A merchant's live current-period settlement rollup.
+   * `GET /admin-portal/accounts/{merchantId}/settlement/current`
+   */
+  async settlementCurrent(merchantId, params) {
+    return this.request(
+      "GET",
+      `/admin-portal/accounts/${encodeURIComponent(merchantId)}/settlement/current`,
+      { query: { test_mode: params.test_mode, profile_id: params.profile_id } }
+    );
+  }
+  /**
+   * A merchant's vault state: the attach entitlement, and the vault
+   * configuration of every shop.
+   *
+   * `GET /admin-portal/accounts/{merchantId}/vault`
+   */
+  async getVaultState(merchantId) {
+    return this.request("GET", `/admin-portal/accounts/${encodeURIComponent(merchantId)}/vault`);
+  }
+  /**
+   * Attach a vault to one of a merchant's shops — creates the vault
+   * connector account and points the profile at it in one request. The
+   * Collect credentials are verified write-only before anything is stored.
+   *
+   * `POST /admin-portal/accounts/{merchantId}/vault/attach`
+   */
+  async attachVault(merchantId, params) {
+    return this.request(
+      "POST",
+      `/admin-portal/accounts/${encodeURIComponent(merchantId)}/vault/attach`,
+      { body: params }
+    );
+  }
   /**
    * Fetch the global welcome promotional-credit config (amount + message)
    * granted to newly created billing profiles. Internal-admin route.
@@ -5718,6 +6600,7 @@ var DelopayInternal = class extends Delopay {
   Cache,
   CardIssuers,
   Cards,
+  CheckoutSession,
   Configs,
   ConnectorRestrictionRules,
   ConnectorRestrictions,
@@ -5738,11 +6621,13 @@ var DelopayInternal = class extends Delopay {
   NATIVE_PANES_MAX,
   NATIVE_PANE_CATEGORY_KEYS,
   NATIVE_PANE_ICON_KEYS,
+  OperationLimits,
   PlatformBilling,
   PlatformFees,
   Regions,
   STRIPE_NATIVE_PANE_METHODS,
   Search,
+  Settlement,
   Subscriptions,
   Webhooks,
   allOf,