@mitumba/sdk 1.28.0 → 1.30.0

package/dist/index.js

@@ -182,7 +182,7 @@ var APIClient = class {
         }
       }
     }
-    const headers = new Headers();
+    const headers = new Headers(options?.headers);
     if (body && !(body instanceof FormData)) {
       headers.set("Content-Type", "application/json");
     }
@@ -478,6 +478,80 @@ var AuthModule = class {
     await this.client.setSession(result);
     return result;
   }
+  /**
+   * One-time root bootstrap. The setup secret travels in a header and is never part of the JSON
+   * body, where an error logger or request capture is more likely to record it.
+   */
+  async setupRoot(input, options) {
+    const { setup_secret, ...body } = input;
+    return this.client.post(
+      "/auth/root/setup",
+      body,
+      { ...options, headers: { ...options?.headers, "X-Root-Setup-Secret": setup_secret } }
+    );
+  }
+  // ── Capabilities and backup-code lifecycle ──
+  /** Public auth-mode document. Never requires or changes the session. */
+  async capabilities(options) {
+    return this.client.get("/auth/capabilities", void 0, options);
+  }
+  /**
+   * Replace every backup code after re-proving the current password.
+   *
+   * The result is intentionally not persisted by the SDK: codes are shown once, and storing them in
+   * a browser turns a recovery credential into something a stolen session can read.
+   */
+  async regenerateBackupCodes(currentPassword, options) {
+    return this.client.post(
+      "/auth/2fa/backup-codes/regenerate",
+      { current_password: currentPassword },
+      options
+    );
+  }
+  // ── Assisted account recovery ──
+  async requestRecovery(input, options) {
+    return this.client.post("/auth/recovery/request", input, options);
+  }
+  /**
+   * Cancel with the token from the email. Always returns ok, whether it was valid or already used,
+   * so this cannot be used to probe for live recoveries.
+   */
+  async cancelRecovery(token, options) {
+    return this.client.post("/auth/recovery/cancel", { token }, options);
+  }
+  async recoveryStatus(tempToken, options) {
+    return this.client.get("/auth/recovery/status", { temp_token: tempToken }, options);
+  }
+  /**
+   * Complete with a fresh temp token once cooling-off ends. Tokens are persisted; backup codes are
+   * returned to the caller only and never stored.
+   */
+  async completeRecovery(tempToken, options) {
+    const result = await this.client.post("/auth/recovery/complete", { temp_token: tempToken }, options);
+    await this.client.setSession(result);
+    return result;
+  }
+  // ── Account recovery review (requires recovery:review) ──
+  async listRecoveryRequests(status = "pending", options) {
+    return this.client.get("/auth/recovery/queue", { status }, options);
+  }
+  async approveRecovery(id, reviewNote, options) {
+    return this.client.post(
+      `/auth/recovery/${id}/approve`,
+      { review_note: reviewNote },
+      options
+    );
+  }
+  async rejectRecovery(id, reviewNote, options) {
+    return this.client.post(
+      `/auth/recovery/${id}/reject`,
+      { review_note: reviewNote },
+      options
+    );
+  }
+  async recoveryEvents(id, options) {
+    return this.client.get(`/auth/recovery/${id}/events`, void 0, options);
+  }
 };
 
 // src/modules/listings.ts
@@ -725,6 +799,21 @@ var PayModule = class {
   async initPaystack(input, options) {
     return this.client.post("/pay/paystack/init", input, options);
   }
+  /**
+   * Initiate a provider-neutral checkout for an order.
+   *
+   * The payment provider is selected by the API. Continue checkout using the
+   * returned next action, then poll {@link getCheckoutStatus} for payment state.
+   * Retrying after cancellation requires the same input and idempotency key.
+   *
+   * @param input - Order, idempotency key, and buyer-selected payment method.
+   * @param options - Request options, including an optional abort signal.
+   * @returns The initiated attempt and its required continuation action.
+   * @throws {APIError} When the API rejects or cannot initiate the checkout.
+   */
+  async initiateCheckout(input, options) {
+    return this.client.post("/pay/checkout/initiate", input, options);
+  }
   /**
    * Poll for the current status of a payment by its order ID.
    *
@@ -1229,9 +1318,16 @@ var AdminModule = class {
     this.client = client;
   }
   client;
-  // ── IP Blocking ──
-  async blockIp(ip, durationHours, options) {
-    return this.client.post("/admin/block-ip", { ip, duration_hours: durationHours ?? 24 }, options);
+  async blockIp(ip, reasonOrDuration = 24, durationOrOptions, maybeOptions) {
+    const modern = typeof reasonOrDuration === "string";
+    const reason = modern ? reasonOrDuration : "No reason supplied by legacy SDK caller";
+    const durationHours = modern ? typeof durationOrOptions === "number" ? durationOrOptions : 24 : reasonOrDuration;
+    const options = modern ? typeof durationOrOptions === "object" ? durationOrOptions : maybeOptions : typeof durationOrOptions === "object" ? durationOrOptions : void 0;
+    return this.client.post(
+      "/admin/block-ip",
+      { ip, reason, duration_hours: durationHours },
+      options
+    );
   }
   async unblockIp(ip, options) {
     return this.client.post("/admin/unblock-ip", { ip }, options);
@@ -1352,6 +1448,49 @@ var AdminModule = class {
   async reinstateVaziOutfit(outfitId, options) {
     return this.client.post(`/admin/vazi/outfits/${outfitId}/reinstate`, void 0, options);
   }
+  // ── Operators, roles, and audit ──
+  async listOperators(options) {
+    return this.client.get("/admin/operators", void 0, options);
+  }
+  async listAdminRoles(options) {
+    return this.client.get("/admin/roles", void 0, options);
+  }
+  async grantOperatorPermission(userId, permission, options) {
+    return this.client.post(`/admin/operators/${userId}/permissions`, { permission }, options);
+  }
+  async revokeOperatorPermission(userId, permission, options) {
+    return this.client.delete(`/admin/operators/${userId}/permissions/${encodeURIComponent(permission)}`, void 0, options);
+  }
+  async grantOperatorRole(userId, role, options) {
+    return this.client.post(`/admin/operators/${userId}/roles`, { role }, options);
+  }
+  async getAuditLog(limit = 100, options) {
+    return this.client.get("/admin/audit", { limit }, options);
+  }
+  // ── Payout approval ──
+  async listPayoutsAwaitingApproval(options) {
+    return this.client.get("/admin/payouts/pending-approval", void 0, options);
+  }
+  async approvePayout(payoutId, options) {
+    return this.client.post(`/admin/payouts/${payoutId}/approve`, void 0, options);
+  }
+  async holdPayout(payoutId, reason, options) {
+    return this.client.post(`/admin/payouts/${payoutId}/hold`, { reason }, options);
+  }
+  /** Repair a Daraja payout whose provider reference failed to persist. */
+  async repairPayoutCorrelation(payoutId, providerRef, options) {
+    return this.client.post(`/admin/payouts/${payoutId}/correlation`, { provider_ref: providerRef }, options);
+  }
+  // ── Wholesale moderation ──
+  async listPendingWholesaleStores(options) {
+    return this.client.get("/admin/wholesale/pending", void 0, options);
+  }
+  async verifyWholesaleStore(storeId, options) {
+    return this.client.post(`/admin/wholesale/stores/${storeId}/verify`, void 0, options);
+  }
+  async unverifyWholesaleStore(storeId, options) {
+    return this.client.post(`/admin/wholesale/stores/${storeId}/unverify`, void 0, options);
+  }
   // ── Broadcast ──
   async broadcast(input, options) {
     return this.client.post("/admin/broadcast", input, options);