@delopay/sdk 0.86.0 → 0.88.0

package/dist/index.d.cts

@@ -149,6 +149,13 @@ interface PaymentCreateRequest {
     description?: string | null;
     /** URL to redirect the customer to after payment (required for redirect-based methods). */
     return_url?: string | null;
+    /**
+     * How long the client secret / hosted checkout link stays usable, in
+     * seconds from creation. Omit to inherit the shop's default
+     * (`business_profile.session_expiry`, itself defaulting to 15 minutes).
+     * The backend rejects values outside its accepted window with a 400.
+     */
+    session_expiry?: number | null;
     /** Descriptor shown on the customer's bank statement (name portion). */
     statement_descriptor_name?: string | null;
     /** Descriptor shown on the customer's bank statement (suffix portion). */
@@ -211,6 +218,8 @@ interface PaymentCreateRequest {
 interface PaymentUpdateRequest {
     amount?: number | null;
     currency?: Currency | null;
+    /** See {@link PaymentCreateRequest.session_expiry}. */
+    session_expiry?: number | null;
     order_tax_amount?: number | null;
     amount_to_capture?: number | null;
     shipping_cost?: number | null;
@@ -346,6 +355,14 @@ interface PaymentResponse {
     client_secret?: string | null;
     /** ISO 8601 timestamp when the payment was created. */
     created?: string | null;
+    /**
+     * ISO 8601 timestamp when the payment (its client secret / hosted
+     * checkout link) expires — the backend's resolved `session_expiry`, which
+     * may differ from the requested one if it was omitted or clamped.
+     * Backends predating the field omit the key entirely (`undefined` here);
+     * backends that expose it may still send `null` when no expiry applies.
+     */
+    expires_on?: string | null;
     /** ISO 8601 timestamp of the last status update. */
     last_updated?: string | null;
     /** Whether the payment method is saved for future use. */
@@ -3856,11 +3873,15 @@ interface OperationLimitRule {
     merchant_id: string;
     operation: LimitedOperation;
     scope: OperationLimitScope;
-    scope_id?: string | null;
-    max_amount_per_operation?: number | null;
-    max_total_amount_per_window?: number | null;
-    max_count_per_window?: number | null;
-    max_payment_age_days?: number | null;
+    /**
+     * Always present on the wire (nullable, never omitted) — as are the four
+     * limit fields below: the backend serializes every `Option` key.
+     */
+    scope_id: string | null;
+    max_amount_per_operation: number | null;
+    max_total_amount_per_window: number | null;
+    max_count_per_window: number | null;
+    max_payment_age_days: number | null;
     window_hours: number;
     /** ISO currency code of the amount fields. */
     currency: string;
@@ -7496,6 +7517,61 @@ declare class CheckoutSession {
     /** Headers for the publishable-key routes (`/payments/*`, `/payment-methods`). */
     private pkHeaders;
     private requireClientSecret;
+    /**
+     * The hosted checkout's bootstrap payload for a one-time payment —
+     * `CheckoutDetails` while payable, a status view once settled.
+     *
+     * Deliberately unauthenticated: a `pay_` link bootstraps before any
+     * credential exists, so no credential header is ever attached (caller
+     * extras are still stripped of credentials). The response is a large
+     * discriminated union owned by the consuming checkout, which keeps its
+     * own types and runtime gates — hence the loose return type.
+     *
+     * `theme` is the route's one declared query parameter (a named checkout
+     * variant, backend#793). `locale` travels as `Accept-Language` — the only
+     * channel the backend's locale resolution reads; a `?locale=` query is
+     * silently ignored by this route.
+     *
+     * `GET /payment-link/data/{merchantId}/{paymentId}`
+     */
+    fetchCheckoutData(params?: {
+        locale?: string;
+        theme?: string;
+    }, options?: RequestExtras): Promise<Record<string, unknown>>;
+    /**
+     * The subscription twin of {@link CheckoutSession.fetchCheckoutData}: the
+     * bootstrap payload for a `sub_` checkout. Authenticated with the
+     * subscription's client secret (construct the session with the `sub_…` id
+     * in the `paymentId` slot). `locale` travels as `Accept-Language`, same
+     * as {@link CheckoutSession.fetchCheckoutData}.
+     *
+     * `GET /subscriptions/data/{merchantId}/{subscriptionId}`
+     */
+    fetchSubscriptionData(params?: {
+        locale?: string;
+    }, options?: RequestExtras): Promise<Record<string, unknown>>;
+    /**
+     * Report buyer/device signals for rails that never reach
+     * `/payments/{id}/confirm` (the Stripe SAQ-A rail: raw cards, Apple Pay,
+     * Google Pay). Same telemetry contract as
+     * {@link CheckoutSession.recordEvent}: sent with `keepalive: true`, and
+     * failures resolve instead of rejecting — signals must never block or
+     * break a checkout. Unauthenticated by design.
+     *
+     * `POST /payment-link/client-signals/{merchantId}/{paymentId}`
+     */
+    reportClientSignals(params: {
+        browser_info?: Record<string, unknown>;
+        signals: Record<string, unknown>;
+    }, options?: RequestExtras): Promise<void>;
+    /**
+     * Confirm a subscription (PayPal approval rail). The client secret is
+     * attached automatically; the shop's profile id travels as the
+     * `X-Profile-Id` header the subscription routes require.
+     *
+     * `POST /subscriptions/{subscriptionId}/confirm` (publishable key)
+     */
+    confirmSubscription(subscriptionId: string, profileId: string, params: Omit<ConfirmSubscriptionRequest, 'client_secret'>, options?: RequestExtras): Promise<ConfirmSubscriptionResponse>;
     /**
      * The Paysepro rail catalog for the buyer's country.
      *

package/dist/index.d.ts

@@ -149,6 +149,13 @@ interface PaymentCreateRequest {
     description?: string | null;
     /** URL to redirect the customer to after payment (required for redirect-based methods). */
     return_url?: string | null;
+    /**
+     * How long the client secret / hosted checkout link stays usable, in
+     * seconds from creation. Omit to inherit the shop's default
+     * (`business_profile.session_expiry`, itself defaulting to 15 minutes).
+     * The backend rejects values outside its accepted window with a 400.
+     */
+    session_expiry?: number | null;
     /** Descriptor shown on the customer's bank statement (name portion). */
     statement_descriptor_name?: string | null;
     /** Descriptor shown on the customer's bank statement (suffix portion). */
@@ -211,6 +218,8 @@ interface PaymentCreateRequest {
 interface PaymentUpdateRequest {
     amount?: number | null;
     currency?: Currency | null;
+    /** See {@link PaymentCreateRequest.session_expiry}. */
+    session_expiry?: number | null;
     order_tax_amount?: number | null;
     amount_to_capture?: number | null;
     shipping_cost?: number | null;
@@ -346,6 +355,14 @@ interface PaymentResponse {
     client_secret?: string | null;
     /** ISO 8601 timestamp when the payment was created. */
     created?: string | null;
+    /**
+     * ISO 8601 timestamp when the payment (its client secret / hosted
+     * checkout link) expires — the backend's resolved `session_expiry`, which
+     * may differ from the requested one if it was omitted or clamped.
+     * Backends predating the field omit the key entirely (`undefined` here);
+     * backends that expose it may still send `null` when no expiry applies.
+     */
+    expires_on?: string | null;
     /** ISO 8601 timestamp of the last status update. */
     last_updated?: string | null;
     /** Whether the payment method is saved for future use. */
@@ -3856,11 +3873,15 @@ interface OperationLimitRule {
     merchant_id: string;
     operation: LimitedOperation;
     scope: OperationLimitScope;
-    scope_id?: string | null;
-    max_amount_per_operation?: number | null;
-    max_total_amount_per_window?: number | null;
-    max_count_per_window?: number | null;
-    max_payment_age_days?: number | null;
+    /**
+     * Always present on the wire (nullable, never omitted) — as are the four
+     * limit fields below: the backend serializes every `Option` key.
+     */
+    scope_id: string | null;
+    max_amount_per_operation: number | null;
+    max_total_amount_per_window: number | null;
+    max_count_per_window: number | null;
+    max_payment_age_days: number | null;
     window_hours: number;
     /** ISO currency code of the amount fields. */
     currency: string;
@@ -7496,6 +7517,61 @@ declare class CheckoutSession {
     /** Headers for the publishable-key routes (`/payments/*`, `/payment-methods`). */
     private pkHeaders;
     private requireClientSecret;
+    /**
+     * The hosted checkout's bootstrap payload for a one-time payment —
+     * `CheckoutDetails` while payable, a status view once settled.
+     *
+     * Deliberately unauthenticated: a `pay_` link bootstraps before any
+     * credential exists, so no credential header is ever attached (caller
+     * extras are still stripped of credentials). The response is a large
+     * discriminated union owned by the consuming checkout, which keeps its
+     * own types and runtime gates — hence the loose return type.
+     *
+     * `theme` is the route's one declared query parameter (a named checkout
+     * variant, backend#793). `locale` travels as `Accept-Language` — the only
+     * channel the backend's locale resolution reads; a `?locale=` query is
+     * silently ignored by this route.
+     *
+     * `GET /payment-link/data/{merchantId}/{paymentId}`
+     */
+    fetchCheckoutData(params?: {
+        locale?: string;
+        theme?: string;
+    }, options?: RequestExtras): Promise<Record<string, unknown>>;
+    /**
+     * The subscription twin of {@link CheckoutSession.fetchCheckoutData}: the
+     * bootstrap payload for a `sub_` checkout. Authenticated with the
+     * subscription's client secret (construct the session with the `sub_…` id
+     * in the `paymentId` slot). `locale` travels as `Accept-Language`, same
+     * as {@link CheckoutSession.fetchCheckoutData}.
+     *
+     * `GET /subscriptions/data/{merchantId}/{subscriptionId}`
+     */
+    fetchSubscriptionData(params?: {
+        locale?: string;
+    }, options?: RequestExtras): Promise<Record<string, unknown>>;
+    /**
+     * Report buyer/device signals for rails that never reach
+     * `/payments/{id}/confirm` (the Stripe SAQ-A rail: raw cards, Apple Pay,
+     * Google Pay). Same telemetry contract as
+     * {@link CheckoutSession.recordEvent}: sent with `keepalive: true`, and
+     * failures resolve instead of rejecting — signals must never block or
+     * break a checkout. Unauthenticated by design.
+     *
+     * `POST /payment-link/client-signals/{merchantId}/{paymentId}`
+     */
+    reportClientSignals(params: {
+        browser_info?: Record<string, unknown>;
+        signals: Record<string, unknown>;
+    }, options?: RequestExtras): Promise<void>;
+    /**
+     * Confirm a subscription (PayPal approval rail). The client secret is
+     * attached automatically; the shop's profile id travels as the
+     * `X-Profile-Id` header the subscription routes require.
+     *
+     * `POST /subscriptions/{subscriptionId}/confirm` (publishable key)
+     */
+    confirmSubscription(subscriptionId: string, profileId: string, params: Omit<ConfirmSubscriptionRequest, 'client_secret'>, options?: RequestExtras): Promise<ConfirmSubscriptionResponse>;
     /**
      * The Paysepro rail catalog for the buyer's country.
      *

package/dist/index.js

@@ -88,7 +88,7 @@ import {
   surfacePadValue,
   verticalGapValue,
   visibleCustomFields
-} from "./chunk-DQ36QCU7.js";
+} from "./chunk-BWTQ34HP.js";
 export {
   ALL_CUSTOM_FIELD_CONDITION_SOURCES,
   ALL_CUSTOM_FIELD_OPERATORS,

package/dist/internal.cjs

@@ -5390,6 +5390,14 @@ function withoutCredentialHeaders(extra) {
   }
   return out;
 }
+function withoutHeader(headers, name) {
+  const out = {};
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() === name) continue;
+    out[key] = value;
+  }
+  return out;
+}
 var CheckoutSession = class {
   constructor(options) {
     this.merchantId = options.merchantId;
@@ -5436,6 +5444,112 @@ var CheckoutSession = class {
     }
     return this.clientSecret;
   }
+  /**
+   * The hosted checkout's bootstrap payload for a one-time payment —
+   * `CheckoutDetails` while payable, a status view once settled.
+   *
+   * Deliberately unauthenticated: a `pay_` link bootstraps before any
+   * credential exists, so no credential header is ever attached (caller
+   * extras are still stripped of credentials). The response is a large
+   * discriminated union owned by the consuming checkout, which keeps its
+   * own types and runtime gates — hence the loose return type.
+   *
+   * `theme` is the route's one declared query parameter (a named checkout
+   * variant, backend#793). `locale` travels as `Accept-Language` — the only
+   * channel the backend's locale resolution reads; a `?locale=` query is
+   * silently ignored by this route.
+   *
+   * `GET /payment-link/data/{merchantId}/{paymentId}`
+   */
+  async fetchCheckoutData(params, options) {
+    return this.client.request(
+      "GET",
+      `/payment-link/data/${encodeURIComponent(this.merchantId)}/${encodeURIComponent(this.paymentId)}`,
+      {
+        query: { theme: params?.theme },
+        ...options,
+        headers: {
+          ...params?.locale ? {
+            ...withoutHeader(withoutCredentialHeaders(options?.headers), "accept-language"),
+            "Accept-Language": params.locale
+          } : withoutCredentialHeaders(options?.headers)
+        }
+      }
+    );
+  }
+  /**
+   * The subscription twin of {@link CheckoutSession.fetchCheckoutData}: the
+   * bootstrap payload for a `sub_` checkout. Authenticated with the
+   * subscription's client secret (construct the session with the `sub_…` id
+   * in the `paymentId` slot). `locale` travels as `Accept-Language`, same
+   * as {@link CheckoutSession.fetchCheckoutData}.
+   *
+   * `GET /subscriptions/data/{merchantId}/{subscriptionId}`
+   */
+  async fetchSubscriptionData(params, options) {
+    return this.client.request(
+      "GET",
+      `/subscriptions/data/${encodeURIComponent(this.merchantId)}/${encodeURIComponent(this.paymentId)}`,
+      {
+        ...options,
+        headers: {
+          ...params?.locale ? {
+            ...withoutHeader(this.bearerHeaders(options?.headers), "accept-language"),
+            "Accept-Language": params.locale
+          } : this.bearerHeaders(options?.headers)
+        }
+      }
+    );
+  }
+  /**
+   * Report buyer/device signals for rails that never reach
+   * `/payments/{id}/confirm` (the Stripe SAQ-A rail: raw cards, Apple Pay,
+   * Google Pay). Same telemetry contract as
+   * {@link CheckoutSession.recordEvent}: sent with `keepalive: true`, and
+   * failures resolve instead of rejecting — signals must never block or
+   * break a checkout. Unauthenticated by design.
+   *
+   * `POST /payment-link/client-signals/{merchantId}/{paymentId}`
+   */
+  async reportClientSignals(params, options) {
+    try {
+      await this.client.request(
+        "POST",
+        `/payment-link/client-signals/${encodeURIComponent(this.merchantId)}/${encodeURIComponent(this.paymentId)}`,
+        {
+          body: params,
+          keepalive: true,
+          ...options,
+          headers: withoutCredentialHeaders(options?.headers)
+        }
+      );
+    } catch {
+    }
+  }
+  /**
+   * Confirm a subscription (PayPal approval rail). The client secret is
+   * attached automatically; the shop's profile id travels as the
+   * `X-Profile-Id` header the subscription routes require.
+   *
+   * `POST /subscriptions/{subscriptionId}/confirm` (publishable key)
+   */
+  async confirmSubscription(subscriptionId, profileId, params, options) {
+    return this.client.request(
+      "POST",
+      `/subscriptions/${encodeURIComponent(subscriptionId)}/confirm`,
+      {
+        body: { ...params, client_secret: this.requireClientSecret() },
+        ...options,
+        // Strip any caller-supplied x-profile-id first (case-insensitively):
+        // Fetch folds duplicate headers into `caller, pro_x`, and the
+        // subscription routes must see exactly one profile scope.
+        headers: {
+          ...withoutHeader(this.pkHeaders(options?.headers), "x-profile-id"),
+          "X-Profile-Id": profileId
+        }
+      }
+    );
+  }
   /**
    * The Paysepro rail catalog for the buyer's country.
    *