@conto_finance/sdk 0.1.0 → 0.4.0

package/dist/index.d.mts

@@ -1,3 +1,17 @@
+interface ApiErrorMetadata {
+    code: string;
+    status: number;
+    requestId?: string;
+    retryAfter?: number;
+    retryGuidance?: string;
+    actionUrl?: string;
+    fieldErrors?: Array<{
+        field: string;
+        message: string;
+    }>;
+    reasons?: string[];
+}
+
 /**
  * Conto Admin SDK
  *
@@ -24,6 +38,7 @@
  * await admin.agents.assignPolicy(agentId, policy.id);
  * ```
  */
+
 interface ContoAdminConfig {
     /** Your organization API key (conto_xxx...) */
     orgApiKey: string;
@@ -32,9 +47,13 @@ interface ContoAdminConfig {
     /** Request timeout in milliseconds. Defaults to 30000 */
     timeout?: number;
 }
-interface ContoAdminError extends Error {
-    code: string;
-    status: number;
+declare class ContoAdminError extends Error {
+    readonly code: string;
+    readonly status: number;
+    readonly requestId?: string;
+    readonly retryAfter?: number;
+    readonly retryGuidance?: string;
+    constructor(message: string, metadata: ApiErrorMetadata);
 }
 interface PaginationParams {
     limit?: number;
@@ -53,7 +72,11 @@ type AgentRiskTier = 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL';
 type AgentAttestationMode = 'KEY_ONLY' | 'SIGNED_REQUEST' | 'SIGNED_REQUEST_WITH_CONTEXT';
 type DelegationType = 'FULL' | 'LIMITED' | 'VIEW_ONLY' | 'PREAPPROVED' | 'ALLOWLIST';
 type ChainType = 'EVM' | 'SOLANA';
-type CustodyType = 'PRIVY' | 'SPONGE' | 'EXTERNAL' | 'SMART_CONTRACT';
+type CustomerCustodyMode = 'MANAGED' | 'EXTERNAL' | 'SMART_CONTRACT';
+type CustomerWalletControlModel = 'CONTO_MANAGED' | 'ORGANIZATION_CONTROLLED' | 'EXTERNAL' | 'CONTRACT_ENFORCED';
+type CustomerWalletKeyAccess = 'NO_SELF_SERVICE_EXPORT' | 'OWNER_AUTHORIZED_EXPORT' | 'EXPORT_RECONCILIATION_REQUIRED' | 'CUSTOMER_CONTROLLED' | 'CONTRACT_ADMINISTRATED' | 'EXPORTED';
+/** @deprecated Use CustomerCustodyMode. */
+type CustodyType = CustomerCustodyMode;
 type WalletType = 'EOA' | 'SMART_WALLET' | 'MULTISIG';
 type WalletStatus = 'ACTIVE' | 'FROZEN' | 'CLOSED' | 'ARCHIVED';
 type PolicyType = 'SPEND_LIMIT' | 'MERCHANT' | 'TIME_WINDOW' | 'CATEGORY' | 'VELOCITY' | 'COMPOSITE' | 'GEOGRAPHIC' | 'APPROVAL_THRESHOLD' | 'COUNTERPARTY' | 'BUDGET_ALLOCATION' | 'WHITELIST' | 'EXPIRATION' | 'CONTRACT_ALLOWLIST' | 'BLACKOUT_PERIOD';
@@ -72,25 +95,37 @@ interface Agent {
     riskTier?: AgentRiskTier;
     publicKey: string;
     status: AgentStatus;
-    externalId: string | null;
     attestationMode?: AgentAttestationMode;
     identityTags?: string[];
-    ownerMembershipId?: string | null;
+    externalId: string | null;
+    allowedContexts: string[];
+    webhookConfigured: boolean;
+    /** Callback query and fragment values are redacted in API responses. */
+    callbackUrl: string | null;
     owner?: {
         membershipId: string;
-        role: string;
-        userId?: string | null;
         name?: string | null;
-        email?: string | null;
     } | null;
-    allowedContexts: string | null;
-    organizationId: string;
+    setup: {
+        status: 'READY' | 'ACTION_REQUIRED';
+        issueCount: number;
+        issues: Array<{
+            code: 'OWNER_REQUIRED' | 'IDENTITY_SLUG_REQUIRED' | 'PURPOSE_REQUIRED';
+            field: 'ownerMembershipId' | 'agentIdSlug' | 'purpose';
+            severity: 'BLOCKING' | 'RECOMMENDED';
+            message: string;
+        }>;
+    };
     createdAt: string;
     updatedAt: string;
+    linkedWalletCount: number;
+    transactionCount: number;
     wallets?: AgentWalletLink[];
-    _count?: {
-        sentTransactions: number;
-    };
+    nextSteps?: Record<'createSdkKey' | 'linkWallet' | 'assignPolicy', {
+        method: 'POST';
+        path: string;
+        description: string;
+    }>;
 }
 interface CreateAgentInput {
     name: string;
@@ -106,6 +141,7 @@ interface CreateAgentInput {
     attestationMode?: AgentAttestationMode;
     identityTags?: string[];
     allowedContexts?: string[];
+    callbackUrl?: string;
 }
 interface UpdateAgentInput {
     name?: string;
@@ -120,6 +156,7 @@ interface UpdateAgentInput {
     attestationMode?: AgentAttestationMode;
     identityTags?: string[] | null;
     allowedContexts?: string[];
+    callbackUrl?: string | null;
 }
 interface ListAgentsParams extends PaginationParams {
     status?: string;
@@ -132,23 +169,26 @@ interface ListAgentsResponse {
     offset: number;
 }
 interface FreezeAgentInput {
-    reason: string;
     freezeWallets?: boolean;
 }
 interface UnfreezeAgentInput {
-    reason: string;
     unfreezeWallets?: boolean;
-    resetCounters?: boolean;
 }
 interface AgentWalletLink {
     id: string;
-    agentId: string;
     walletId: string;
     delegationType: DelegationType;
-    spendLimitPerTx: number;
-    spendLimitDaily: number;
+    spendLimitPerTx: number | null;
+    spendLimitDaily: number | null;
     spendLimitWeekly: number | null;
     spendLimitMonthly: number | null;
+    spentToday: number;
+    spentThisWeek: number;
+    spentThisMonth: number;
+    allowedHoursStart: number;
+    allowedHoursEnd: number;
+    allowedDays: string[];
+    timezone: string;
     isActive: boolean;
     wallet?: {
         id: string;
@@ -156,13 +196,205 @@ interface AgentWalletLink {
         address: string;
         usdcBalance: number;
         status: string;
-        custodyType?: string;
+        custodyMode?: CustomerCustodyMode;
+        controlModel?: CustomerWalletControlModel;
+        keyAccess?: CustomerWalletKeyAccess;
+    };
+    createdAt: string;
+    updatedAt: string;
+}
+interface AdminExternalCardOverlayEnforcement {
+    enforcementMode: 'POLICY_OVERLAY';
+    integrationMode: 'SDK_REQUIRED';
+    canBypass: true;
+    credentialStored: false;
+    credentialReleased: false;
+    executionResponsibility: 'CUSTOMER';
+    transactionVerification: 'SELF_REPORTED';
+}
+interface ExternalCard {
+    id: string;
+    name: string;
+    last4: string;
+    brand: 'VISA' | 'MASTERCARD' | 'AMEX' | 'DISCOVER' | 'OTHER' | null;
+    cardType: 'VIRTUAL' | 'PHYSICAL';
+    fundingType: 'DEBIT' | 'CREDIT';
+    status: 'ACTIVE' | 'PAUSED' | 'LOCKED' | 'EXPIRED' | 'CANCELLED';
+    isActive: boolean;
+    spendLimitDaily: number;
+    spendLimitWeekly: number | null;
+    spendLimitMonthly: number | null;
+    spendLimitPerTx: number;
+    spentToday: number;
+    spentThisWeek: number;
+    spentThisMonth: number;
+    remainingToday: number;
+    agentCount: number;
+    transactionCount: number;
+    enforcement: AdminExternalCardOverlayEnforcement;
+    createdAt: string;
+    updatedAt: string;
+}
+interface RegisterExternalCardInput {
+    name: string;
+    last4: string;
+    brand?: 'VISA' | 'MASTERCARD' | 'AMEX' | 'DISCOVER' | 'OTHER';
+    cardType?: 'VIRTUAL' | 'PHYSICAL';
+    fundingType?: 'DEBIT' | 'CREDIT';
+    spendLimitDaily?: number;
+    spendLimitWeekly?: number;
+    spendLimitMonthly?: number;
+    spendLimitPerTx?: number;
+    notes?: string;
+}
+interface AssignExternalCardInput {
+    cardId: string;
+    spendLimitDaily?: number;
+    spendLimitWeekly?: number;
+    spendLimitMonthly?: number;
+    spendLimitPerTx?: number;
+    allowedDays?: Array<'Sun' | 'Mon' | 'Tue' | 'Wed' | 'Thu' | 'Fri' | 'Sat'>;
+    allowedHoursStart?: number;
+    allowedHoursEnd?: number;
+    timezone: string;
+    allowedCategories?: string[];
+    blockedCategories?: string[];
+    allowedMerchants?: string[];
+    blockedMerchants?: string[];
+    activeFrom?: string | null;
+    activeUntil?: string | null;
+}
+type UpdateExternalCardAssignmentInput = Partial<Omit<AssignExternalCardInput, 'cardId'>>;
+interface AgentExternalCard {
+    id: string;
+    cardId: string;
+    cardName: string;
+    last4: string;
+    brand: string | null;
+    cardType: string;
+    fundingType: string;
+    cardStatus: string;
+    accessStatus: 'ACTIVE' | 'PAUSED' | 'REVOKED';
+    spendLimitDaily: number;
+    spendLimitWeekly: number | null;
+    spendLimitMonthly: number | null;
+    spendLimitPerTx: number;
+    spentToday: number;
+    spentThisWeek: number;
+    spentThisMonth: number;
+    remainingToday: number;
+    allowedDays: string[];
+    allowedHoursStart: number;
+    allowedHoursEnd: number;
+    timezone: string;
+    allowedCategories: string[] | null;
+    blockedCategories: string[] | null;
+    allowedMerchants: string[] | null;
+    blockedMerchants: string[] | null;
+    activeFrom: string | null;
+    activeUntil: string | null;
+    isActive: boolean;
+    enforcement: AdminExternalCardOverlayEnforcement;
+    createdAt: string;
+}
+interface RevokeExternalCardAssignmentResult {
+    unassigned: true;
+    cardId: string;
+    agentId: string;
+    revokedApprovals: number;
+    executingRequests: number;
+    reconciliationRequired: boolean;
+    enforcement: AdminExternalCardOverlayEnforcement;
+}
+interface PauseExternalCardAssignmentResult {
+    accessStatus: 'PAUSED';
+    cardId: string;
+    agentId: string;
+    revokedApprovals: number;
+    executingRequests: number;
+    reconciliationRequired: boolean;
+    enforcement: AdminExternalCardOverlayEnforcement;
+}
+type ExternalCardRequestStatus = 'APPROVED' | 'EXECUTING' | 'CONFIRMING' | 'COMPLETED' | 'DENIED' | 'EXPIRED' | 'CANCELLED';
+interface ExternalCardOverlayRequest {
+    requestId: string;
+    status: ExternalCardRequestStatus;
+    decision: string;
+    amount: number;
+    currency: string;
+    merchantName: string | null;
+    merchantId: string | null;
+    merchantCategory: string | null;
+    purpose: string | null;
+    expiresAt: string | null;
+    executionClaimedAt: string | null;
+    reconciliationRequired: boolean;
+    nextAction: 'BEGIN_EXECUTION' | 'CONFIRM_OR_RECONCILE' | 'POLL' | 'NONE';
+    transactionId: string | null;
+    transaction: {
+        id: string;
+        status: string;
+        amount: number;
+        currency: string;
+        externalTxId: string | null;
+        authorizedAt: string | null;
+    } | null;
+    card: {
+        id: string;
+        name: string;
+        last4: string;
+        brand: string | null;
+    };
+    agent: {
+        id: string;
+        name: string;
+    };
+    createdAt: string;
+    updatedAt: string;
+    enforcement: AdminExternalCardOverlayEnforcement;
+}
+interface ListExternalCardRequestsInput {
+    status?: ExternalCardRequestStatus;
+    limit?: number;
+}
+interface ListExternalCardRequestsResponse {
+    requests: ExternalCardOverlayRequest[];
+    summary: Partial<Record<ExternalCardRequestStatus, number>>;
+    enforcement: AdminExternalCardOverlayEnforcement;
+}
+interface ResolveExternalCardRequestInput {
+    resolution: 'EXECUTED' | 'NOT_EXECUTED';
+    reason: string;
+    externalTxId?: string;
+    authorizationCode?: string;
+    actualAmount?: number;
+    merchantDetails?: {
+        name?: string;
+        id?: string;
+        category?: string;
+        address?: string;
+        city?: string;
+        state?: string;
+        country?: string;
+        postalCode?: string;
     };
 }
+interface ResolveExternalCardRequestResult {
+    resolved: true;
+    requestId?: string;
+    status: string;
+    reservationReleased?: boolean;
+    releasedAmount?: number;
+    confirmed?: true;
+    replayed?: boolean;
+    transactionId?: string;
+    amount?: number;
+    currency?: string;
+    verificationStatus?: 'SELF_REPORTED';
+    enforcement?: AdminExternalCardOverlayEnforcement;
+}
 interface OrganizationMember {
     id: string;
-    organizationId: string;
-    userId: string;
     role: 'OWNER' | 'ADMIN' | 'MANAGER' | 'VIEWER' | 'MEMBER';
     createdAt: string;
     updatedAt: string;
@@ -215,24 +447,24 @@ interface Wallet {
     chainType: ChainType;
     chainId: string;
     walletType: WalletType;
-    custodyType: CustodyType;
+    custodyMode: CustomerCustodyMode;
+    controlModel: CustomerWalletControlModel;
+    keyAccess: CustomerWalletKeyAccess;
     usdcBalance: number;
     status: WalletStatus;
-    externalWalletId: string | null;
-    organizationId: string;
     createdAt: string;
     updatedAt: string;
+    linkedAgentCount?: number;
 }
 interface CreateWalletInput {
     name: string;
     chainType?: ChainType;
     chainId?: string;
-    custodyType?: CustodyType;
+    custodyMode?: Extract<CustomerCustodyMode, 'MANAGED' | 'EXTERNAL'>;
+    /** Root authority for a newly created managed wallet. */
+    controlModel?: Extract<CustomerWalletControlModel, 'CONTO_MANAGED' | 'ORGANIZATION_CONTROLLED'>;
     walletType?: WalletType;
     address?: string;
-    externalWalletId?: string;
-    importAddress?: string;
-    isWatchOnly?: boolean;
 }
 interface UpdateWalletInput {
     name?: string;
@@ -256,7 +488,9 @@ interface ProvisionWalletResult {
         address: string;
         chainId: string;
         chainType: string;
-        custodyType: string;
+        custodyMode: CustomerCustodyMode;
+        controlModel?: CustomerWalletControlModel;
+        keyAccess?: CustomerWalletKeyAccess;
         balance: number;
         currency: string;
     };
@@ -286,21 +520,32 @@ interface PolicyRule {
     value: string;
     action: RuleAction;
     createdAt: string;
+    updatedAt: string;
 }
 interface Policy {
     id: string;
     name: string;
     description: string | null;
     policyType: PolicyType;
+    scope: 'organization' | 'assigned';
     priority: number;
     isActive: boolean;
-    organizationId: string;
     rules?: PolicyRule[];
+    assignedAgents?: Array<{
+        id: string;
+        name: string;
+    }>;
+    assignedWallets?: Array<{
+        id: string;
+        name: string;
+    }>;
     createdAt: string;
     updatedAt: string;
-    _count?: {
-        agentPolicies: number;
-    };
+}
+interface AssignedPolicy {
+    policyId: string;
+    assignedAt: string;
+    policy: Policy;
 }
 interface CreatePolicyInput {
     name: string;
@@ -308,6 +553,7 @@ interface CreatePolicyInput {
     description?: string;
     priority?: number;
     isActive?: boolean;
+    scope?: 'organization' | 'assigned';
     rules?: CreatePolicyRuleInput[];
     agentIds?: string[];
 }
@@ -316,6 +562,7 @@ interface UpdatePolicyInput {
     description?: string;
     priority?: number;
     isActive?: boolean;
+    scope?: 'organization' | 'assigned';
 }
 interface ListPoliciesParams extends PaginationParams {
 }
@@ -337,19 +584,179 @@ interface UpdatePolicyRuleInput {
     value?: string;
     action?: RuleAction;
 }
+type PolicyVersionChangeType = 'CREATED' | 'UPDATED' | 'RULES_CHANGED' | 'ROLLED_BACK';
+interface PolicyVersionSnapshotRule {
+    ruleType: string;
+    operator: string;
+    value: string;
+    action: string;
+}
+interface PolicyVersionSnapshot {
+    name: string;
+    description: string | null;
+    policyType: string;
+    scope: 'organization' | 'assigned';
+    priority: number;
+    isActive: boolean;
+    rules: PolicyVersionSnapshotRule[];
+}
+interface PolicyVersionSummary {
+    version: number;
+    changeType: PolicyVersionChangeType;
+    note: string | null;
+    createdBy: string | null;
+    createdByType: string | null;
+    createdAt: string;
+    rulesCount: number;
+}
+interface PolicyVersionDetail extends Omit<PolicyVersionSummary, 'rulesCount'> {
+    snapshot: PolicyVersionSnapshot;
+}
+interface ListPolicyVersionsResponse {
+    versions: PolicyVersionSummary[];
+    total: number;
+    limit: number;
+    offset: number;
+}
+interface PolicyVersionFieldChange {
+    field: string;
+    from: unknown;
+    to: unknown;
+}
+interface PolicyVersionDiff {
+    fields: PolicyVersionFieldChange[];
+    rulesAdded: PolicyVersionSnapshotRule[];
+    rulesRemoved: PolicyVersionSnapshotRule[];
+    unchanged: boolean;
+}
+interface ComparePolicyVersionsResponse {
+    from: number;
+    to: number;
+    diff: PolicyVersionDiff;
+}
+interface RollbackPolicyVersionResponse extends Policy {
+    restoredFromVersion: number;
+    newVersion: number | null;
+}
+type StripeLinkCheckoutReadinessStatus = 'NOT_READY' | 'READY_FOR_VERIFICATION' | 'VERIFIED' | 'VERIFICATION_FAILED';
+type StripeLinkCheckoutVerification = 'NOT_RUN' | 'NOT_READY' | 'VERIFIED' | 'ACCOUNT_MISMATCH' | 'PROVIDER_UNAVAILABLE';
+/**
+ * Non-identifying readiness projection for the configured Stripe Link
+ * Checkout adapter. Merchant/account identifiers, URLs, credentials, hashes,
+ * Stripe objects, and raw provider errors are intentionally absent.
+ */
+interface StripeLinkCheckoutReadiness {
+    readonly status: StripeLinkCheckoutReadinessStatus;
+    readonly mode: 'TEST' | 'LIVE' | null;
+    readonly checks: {
+        readonly providerEnabled: boolean;
+        readonly checkoutEnabled: boolean;
+        readonly organizationAllowed: boolean;
+        readonly configurationValid: boolean;
+        readonly accountVerified: boolean;
+    };
+    readonly canVerify: boolean;
+    readonly verifiedAt: string | null;
+    readonly verification: StripeLinkCheckoutVerification;
+    readonly scope: {
+        readonly configuredMerchantCheckoutOnly: true;
+        readonly statement: string;
+    };
+    readonly link: {
+        readonly eligibilityGuaranteed: false;
+        readonly displayGuaranteed: false;
+        readonly selectionGuaranteed: false;
+        readonly statement: string;
+    };
+}
+interface StripeLinkCheckoutReadinessResult {
+    readonly readiness: StripeLinkCheckoutReadiness;
+}
 declare class ContoAdmin {
     private orgApiKey;
     private baseUrl;
     private timeout;
     agents: AgentsClient;
     wallets: WalletsClient;
+    cards: AdminCardsClient;
     policies: PoliciesClient;
     team: TeamClient;
+    paymentRails: PaymentRailsClient;
     constructor(config: ContoAdminConfig);
-    private fetchWithRetry;
     /** Make an authenticated request to the Conto API */
     request<T>(method: string, path: string, body?: Record<string, unknown>): Promise<T>;
 }
+declare class PaymentRailsClient {
+    private client;
+    constructor(client: ContoAdmin);
+    /** Read gate and configuration readiness without calling Stripe. */
+    getStripeLinkCheckoutReadiness(): Promise<StripeLinkCheckoutReadinessResult>;
+    /**
+     * Ask Conto to verify that its configured Stripe credential resolves to its
+     * configured merchant account. This call never returns either identifier.
+     */
+    verifyStripeLinkCheckoutAccount(): Promise<StripeLinkCheckoutReadinessResult>;
+}
+declare class AdminCardsClient {
+    private client;
+    constructor(client: ContoAdmin);
+    /** List masked external-card aliases. No card credentials are returned. */
+    list(): Promise<{
+        cards: ExternalCard[];
+        enforcement: AdminExternalCardOverlayEnforcement;
+    }>;
+    /** Register a masked alias for a customer card. Never pass PAN or CVC. */
+    register(input: RegisterExternalCardInput): Promise<{
+        card: ExternalCard;
+        enforcement: AdminExternalCardOverlayEnforcement;
+    }>;
+    /** Assign a card alias and cooperative policy controls to an agent. */
+    assignToAgent(agentId: string, input: AssignExternalCardInput): Promise<{
+        agentCard: AgentExternalCard;
+        enforcement: AdminExternalCardOverlayEnforcement;
+    }>;
+    listForAgent(agentId: string): Promise<{
+        cards: AgentExternalCard[];
+        enforcement: AdminExternalCardOverlayEnforcement;
+    }>;
+    /** Update limits, merchant rules, hours, and optional start or end dates. */
+    updateAgentAssignment(agentId: string, cardId: string, input: UpdateExternalCardAssignmentInput): Promise<{
+        agentCard: AgentExternalCard;
+        enforcement: AdminExternalCardOverlayEnforcement;
+    }>;
+    /** Pause an assignment and cancel its unused approvals. */
+    pauseForAgent(agentId: string, cardId: string): Promise<PauseExternalCardAssignmentResult>;
+    /** Resume a paused assignment when its alias and date range permit it. */
+    resumeForAgent(agentId: string, cardId: string): Promise<{
+        agentCard: AgentExternalCard;
+        enforcement: AdminExternalCardOverlayEnforcement;
+    }>;
+    /**
+     * Revoke an agent's overlay assignment. Unused grants are cancelled; claimed
+     * executions remain visible for reconciliation.
+     */
+    revokeFromAgent(agentId: string, cardId: string): Promise<RevokeExternalCardAssignmentResult>;
+    /** List overlay requests, including executions that need receipt reconciliation. */
+    listRequests(input?: ListExternalCardRequestsInput): Promise<ListExternalCardRequestsResponse>;
+    /**
+     * Resolve a claimed execution after checking the customer's processor or
+     * receipt. Resolving NOT_EXECUTED releases the reserved policy amount.
+     */
+    resolveRequest(requestId: string, input: ResolveExternalCardRequestInput): Promise<ResolveExternalCardRequestResult>;
+    /** Pause the Conto-controlled path and revoke live overlay grants. */
+    pause(cardId: string): Promise<{
+        card: Pick<ExternalCard, 'id' | 'name' | 'last4' | 'brand' | 'fundingType' | 'status' | 'isActive' | 'updatedAt'>;
+        revokedApprovals: number;
+        enforcement: AdminExternalCardOverlayEnforcement;
+    }>;
+    /** Resume the Conto-controlled path. This does not activate a card at its issuer. */
+    resume(cardId: string): Promise<{
+        card: Pick<ExternalCard, 'id' | 'name' | 'last4' | 'brand' | 'fundingType' | 'status' | 'isActive' | 'updatedAt'>;
+        revokedApprovals: number;
+        enforcement: AdminExternalCardOverlayEnforcement;
+    }>;
+    private setState;
+}
 declare class AgentsClient {
     private client;
     constructor(client: ContoAdmin);
@@ -366,9 +773,13 @@ declare class AgentsClient {
         message: string;
     }>;
     /** Freeze an agent, blocking all transactions */
-    freeze(agentId: string, input: FreezeAgentInput): Promise<Record<string, unknown>>;
+    freeze(agentId: string, input: FreezeAgentInput): Promise<{
+        frozen: boolean;
+    }>;
     /** Unfreeze an agent, restoring transaction ability */
-    unfreeze(agentId: string, input: UnfreezeAgentInput): Promise<Record<string, unknown>>;
+    unfreeze(agentId: string, input: UnfreezeAgentInput): Promise<{
+        frozen: boolean;
+    }>;
     /** List wallets linked to an agent */
     listWallets(agentId: string): Promise<{
         wallets: AgentWalletLink[];
@@ -381,10 +792,10 @@ declare class AgentsClient {
     }>;
     /** List policies assigned to an agent */
     listPolicies(agentId: string): Promise<{
-        policies: Array<Record<string, unknown>>;
+        policies: AssignedPolicy[];
     }>;
     /** Assign a policy to an agent */
-    assignPolicy(agentId: string, policyId: string, overrides?: Record<string, unknown>): Promise<Record<string, unknown>>;
+    assignPolicy(agentId: string, policyId: string): Promise<AssignedPolicy>;
     /** Unassign a policy from an agent */
     unassignPolicy(agentId: string, policyId: string): Promise<{
         success: boolean;
@@ -403,7 +814,7 @@ declare class WalletsClient {
     constructor(client: ContoAdmin);
     /** List wallets in the organization */
     list(params?: ListWalletsParams): Promise<ListWalletsResponse>;
-    /** Create a new wallet or attach an existing provider/self-custodied wallet */
+    /** Create a managed wallet or register an external address. */
     create(input: CreateWalletInput): Promise<Wallet>;
     /** Get a single wallet by ID */
     get(walletId: string): Promise<Wallet>;
@@ -456,17 +867,92 @@ declare class PoliciesClient {
         success: boolean;
         deletedCount: number;
     }>;
+    /** List the version history for a policy (newest first). */
+    listVersions(policyId: string, params?: PaginationParams): Promise<ListPolicyVersionsResponse>;
+    /** Get a single version's snapshot. */
+    getVersion(policyId: string, version: number): Promise<PolicyVersionDetail>;
+    /** Diff two versions of a policy. */
+    compareVersions(policyId: string, from: number, to: number): Promise<ComparePolicyVersionsResponse>;
+    /**
+     * Restore an earlier version. Appends a new ROLLED_BACK version. If the
+     * organization requires governance approval for policy changes, the API
+     * returns a pending-approval response instead of applying the rollback.
+     */
+    rollbackVersion(policyId: string, version: number, options?: {
+        note?: string;
+    }): Promise<RollbackPolicyVersionResponse>;
 }
 declare class TeamClient {
     private client;
     constructor(client: ContoAdmin);
     /** List organization memberships for the authenticated organization */
     listMembers(): Promise<{
-        organizationId: string;
         members: OrganizationMember[];
     }>;
 }
 
+type BrowserCheckoutTargetVerificationCode = 'BROWSER_CHECKOUT_TARGET_INVALID' | 'BROWSER_CHECKOUT_TARGET_NOT_FOUND' | 'BROWSER_CHECKOUT_TARGET_CHANGED' | 'BROWSER_CHECKOUT_TARGET_DISABLED';
+declare class BrowserCheckoutTargetVerificationError extends Error {
+    readonly code: BrowserCheckoutTargetVerificationCode;
+    constructor(code: BrowserCheckoutTargetVerificationCode, message: string);
+}
+/**
+ * Credential-free description of one payment-sensitive DOM target. The
+ * snapshot is created during proposal discovery and recomputed by the
+ * privileged browser process immediately before dispatch.
+ */
+interface BrowserCheckoutTargetSnapshot {
+    /** Current top-level page URL. Fragments are ignored. */
+    pageUrl: string;
+    /** Runtime-owned exact locator identity, such as a stable DOM path. */
+    locator: string;
+    tagName: string;
+    role?: string;
+    accessibleName?: string;
+    /** Resolved navigation target for anchors or controls, when present. */
+    targetUrl?: string;
+    /** Resolved form submission target, when present. */
+    formAction?: string;
+    /** Whether the exact control declares a new browsing context such as target=_blank. */
+    opensNewPage?: boolean;
+    disabled: boolean;
+}
+interface VerifiedBrowserCheckoutTarget<T> {
+    snapshot: BrowserCheckoutTargetSnapshot;
+    /** Performs the one payment-sensitive side effect and observes its result. */
+    dispatch(): Promise<GuardedBrowserDispatchResult<T>>;
+}
+/** Port implemented inside the isolated browser process. */
+interface BrowserCheckoutTargetResolver<T> {
+    resolve(input: {
+        authorization: CheckoutActionAuthorization;
+        browserSessionId: string;
+        action: AgentCheckoutAction | BrowserCheckoutAction;
+    }): Promise<VerifiedBrowserCheckoutTarget<T> | null>;
+}
+interface CanonicalBrowserCheckoutTargetSnapshot {
+    pageUrl: string;
+    locator: string;
+    tagName: string;
+    role: string | null;
+    accessibleName: string | null;
+    targetUrl: string | null;
+    formAction: string | null;
+    opensNewPage: boolean;
+    disabled: boolean;
+}
+declare function canonicalizeBrowserCheckoutTarget(snapshot: BrowserCheckoutTargetSnapshot): CanonicalBrowserCheckoutTargetSnapshot;
+/**
+ * Generates the exact opaque fingerprint sent as action.targetFingerprint.
+ * The raw DOM locator and target details stay inside the customer runtime.
+ */
+declare function fingerprintBrowserCheckoutTarget(snapshot: BrowserCheckoutTargetSnapshot): string;
+/**
+ * Creates a driver that re-resolves and verifies the exact DOM target after
+ * Conto's one-use claim and before the payment-sensitive browser side effect.
+ */
+declare function createVerifiedBrowserCheckoutDriver<T>(resolver: BrowserCheckoutTargetResolver<T>): PrivilegedBrowserCheckoutDriver<T>;
+
 /**
  * Conto SDK
  *
@@ -491,10 +977,11 @@ declare class TeamClient {
  * // Execute if approved
  * if (request.status === 'APPROVED') {
  *   const result = await conto.payments.execute(request.requestId);
- *   console.log(`Payment sent: ${result.txHash}`);
+ *   console.log(result.receipt?.txHash ? `Payment sent: ${result.receipt.txHash}` : `Payment ${result.status}`);
  * }
  * ```
  */
+
 interface ContoConfig {
     /** Your agent's SDK API key (conto_agent_xxx...) */
     apiKey: string;
@@ -514,8 +1001,20 @@ interface PaymentRequestInput {
     purpose?: string;
     /** Spend category for analytics */
     category?: string;
-    /** Additional context (will be stored) */
-    context?: Record<string, unknown>;
+    /** Typed invoice context associated with the payment */
+    context?: {
+        invoice?: {
+            vendorId?: string;
+            vendorAddress?: string;
+            id?: string;
+            hash?: string;
+            sourceUrl?: string;
+            payload?: unknown;
+            expectedAmount?: number | string;
+            currency?: string;
+            dueDate?: string;
+        };
+    };
     /** Specific wallet ID to use (optional) */
     walletId?: string;
     /** Payment urgency */
@@ -529,140 +1028,1242 @@ interface PaymentRequestInput {
     /** Client-supplied key for idempotent retries */
     idempotencyKey?: string;
 }
-interface PaymentRequestResult {
-    /** Unique request ID - use this to execute or check status */
-    requestId: string;
-    /** Current status */
-    status: 'APPROVED' | 'DENIED' | 'REQUIRES_APPROVAL' | 'EXECUTED';
-    /** True when the server returned a previously-created request for the same idempotency key */
-    idempotent?: boolean;
-    /** Wallet that will be used for payment (if approved) */
-    wallet?: {
+interface AgentSetupResult {
+    agent: {
+        id: string;
+        name: string;
+        status: 'active' | 'paused' | 'unavailable';
+        lastActiveAt: string | null;
+        createdAt: string;
+    };
+    wallets: Array<{
         id: string;
         address: string;
+        custodyMode: CustomerCustodyMode;
         chainId: string;
-        custodyType: string;
-        availableBalance: number;
+        chainName: string;
+        chainType: string;
+        isTestnet: boolean;
+        balance: number;
+        currency: string;
+        status: 'active' | 'paused' | 'unavailable';
+        limits: {
+            perTransaction: number | null;
+            daily: number | null;
+            weekly: number | null;
+            monthly: number | null;
+        };
+        spent: {
+            today: number;
+            thisWeek: number;
+            thisMonth: number;
+        };
+    }>;
+    policies: Array<{
+        id: string;
+        name: string;
+        description: string | null;
+        scope: 'organization' | 'assigned';
+        appliesVia: string[];
+        walletIds: string[];
+    }>;
+    counterparties: Array<{
+        id: string;
+        name: string;
+        address: string;
+        category: string;
+        trustScore: number;
+        trustLevel: 'trusted' | 'verified' | 'blocked' | 'unverified';
+        transactionCount: number;
+        totalVolume: number;
+    }>;
+    scopes: string[];
+}
+interface ExternalWalletApprovalInput {
+    amount: number;
+    senderAddress: string;
+    recipientAddress: string;
+    /** Numeric chain ID accepted by the external approval endpoint. */
+    chainId: number | `${number}`;
+    recipientName?: string;
+    purpose?: string;
+    category?: string;
+    context?: PaymentRequestInput['context'];
+}
+interface ExternalWalletApprovalResult {
+    approved: boolean;
+    decision: 'approved' | 'review_required' | 'declined';
+    status: 'ready_to_send' | 'review_required' | 'declined';
+    /** Budget denials can occur before a request is created. */
+    approvalId?: string;
+    approvalToken?: string;
+    expiresAt?: string;
+    confirmUrl?: string;
+    statusUrl?: string;
+    approvalRequestId?: string;
+    reasons: string[];
+    reasonCodes: string[];
+    requiresHumanApproval: boolean;
+    network?: {
+        type: 'evm' | 'solana';
+        id: string;
     };
+}
+interface ExternalWalletConfirmationInput {
+    txHash: string;
+    approvalToken?: string;
+}
+interface ExternalWalletConfirmationResult {
+    accepted: true;
+    confirmed: false;
+    requestId: string;
+    transactionId: string;
+    status: 'processing';
+    txHash: string;
+    network: {
+        type: 'evm' | 'solana';
+        id: string;
+    };
+    explorerUrl: string;
+    statusUrl: string;
+}
+interface PaymentRequestResult {
+    /** Unique request ID - use this to execute or check status */
+    requestId: string;
+    /** Current status */
+    status: 'APPROVED' | 'DENIED' | 'REQUIRES_APPROVAL' | 'ACTION_REQUIRED' | 'PROCESSING';
+    /** Requested amount */
+    amount: number;
+    /** Currency selected for the payment */
+    currency: string;
+    /** Recipient wallet address */
+    recipient: string;
+    /** Customer-facing custody model for the selected payment wallet */
+    custodyMode?: CustomerCustodyMode;
     /** When the approval expires (ISO timestamp) */
     expiresAt?: string;
-    /** Explanation of the decision */
+    /** Customer-facing explanation when action is required or the payment is denied */
     reasons: string[];
-    /** Policy violations (if denied) */
-    violations?: PolicyViolation[];
-    /** Currency used for the payment (e.g., 'USDC', 'USDC.e', 'pathUSD') */
-    currency?: string;
-    /** Chain information for the selected wallet */
-    chain?: {
-        chainId: string;
-        chainName: string;
-        chainType: string;
-        explorerUrl: string;
-    };
-    /** URL to execute this payment (convenience) */
-    executeUrl?: string;
-    /** Session ID for tracking (used in x402/MPP flows) */
-    sessionId?: string | null;
-    /** Explanation of why this wallet was selected */
-    walletSelectionReason?: string;
-    /** If autoExecute was true and approved, contains the execution result */
-    execution?: {
+    /** Approval workflow reference when a team decision is required */
+    approvalRequestId?: string;
+    /** Stable URL for polling and reconciliation */
+    statusUrl: string;
+    /** Next URL to follow for the returned status */
+    actionUrl?: string;
+    /** Public receipt data when execution has started */
+    receipt?: {
+        /** Stable Conto transaction ID for status checks and reconciliation */
         transactionId: string;
-        txHash: string;
-        explorerUrl: string;
-        status: string;
-    };
-    /** If autoExecute failed, the payment is still approved and can be executed manually */
-    autoExecuteError?: {
-        error: string;
-        code?: string;
-    };
-    /** Human-readable recovery hint for denied requests */
-    hint?: string;
-    /** Additional structured context for recovery or debugging */
-    context?: {
-        wallets?: Array<{
-            id: string;
-            address: string;
-            chainId?: string | null;
-            custodyType?: string | null;
-            balance: number;
-        }>;
-        nextSteps?: string[];
+        /** Present only for an onchain transfer. Simulations use transactionId. */
+        txHash?: string;
+        /** Whether this receipt represents live settlement or a test-mode payment */
+        settlementMode: 'live' | 'test';
+        explorerUrl?: string;
     };
 }
-interface PolicyViolation {
-    type: string;
-    limit: number;
-    current: number;
-    message: string;
-}
 interface PaymentExecuteResult {
-    /** Internal transaction ID */
-    transactionId: string;
-    /** Onchain transaction hash */
-    txHash: string;
-    /** Transaction status */
-    status: 'CONFIRMING' | 'CONFIRMED' | 'FAILED';
+    /** Payment request ID */
+    requestId: string;
+    /** Customer-facing execution state */
+    status: 'processing' | 'completed';
     /** Amount sent */
     amount: number;
     /** Currency (USDC) */
     currency: string;
     /** Recipient address */
     recipient: string;
-    /** Recipient name if provided */
-    recipientName?: string;
-    /** Wallet used */
-    wallet: {
-        address: string;
+    /** Public transaction receipt */
+    receipt: {
+        /** Stable Conto transaction ID for status checks and reconciliation */
+        transactionId: string;
+        /** Present only for an onchain transfer. Simulations use transactionId. */
+        txHash?: string;
+        /** Whether this receipt represents live settlement or a test-mode payment */
+        settlementMode: 'live' | 'test';
+        explorerUrl?: string;
     };
-    /** Block explorer URL */
-    explorerUrl: string;
 }
 interface PaymentStatusResult {
     requestId: string;
-    status: string;
-    policyResult: string;
+    /** Unknown for legacy records without execution evidence, or before execution. */
+    settlementMode: 'live' | 'test' | 'unknown';
+    status: 'approved' | 'declined' | 'review_required' | 'action_required' | 'reconciliation_required' | 'processing' | 'completed' | 'failed' | 'expired';
     amount: number;
     currency: string;
     recipient: string;
-    recipientName?: string;
+    recipientName: string | null;
+    purpose: string | null;
+    category: string | null;
+    expiresAt: string | null;
+    createdAt: string;
+    action: {
+        type: 'complete_verification';
+        url: string;
+    } | null;
+    transaction: {
+        /** Stable Conto transaction ID */
+        id: string;
+        settlementMode: 'live' | 'test' | 'unknown';
+        txHash: string | null;
+        status: 'processing' | 'completed' | 'failed';
+        confirmedAt: string | null;
+        blockNumber: number | null;
+        chain: {
+            type: 'evm' | 'solana';
+            id: string;
+        };
+        explorerUrl: string | null;
+        detailsUrl: string;
+    } | null;
+}
+interface ExternalCardOverlayEnforcement {
+    enforcementMode: 'POLICY_OVERLAY';
+    integrationMode: 'SDK_REQUIRED';
+    canBypass: true;
+    credentialStored: false;
+    credentialReleased: false;
+    executionResponsibility: 'CUSTOMER';
+    transactionVerification: 'SELF_REPORTED';
+}
+interface ExternalCardApprovalInput {
+    /** Stable caller-generated identifier, reused for every retry of this purchase intent. */
+    idempotencyKey: string;
+    cardId: string;
+    amount: number;
+    currency?: 'USD';
+    merchantName: string;
+    merchantId?: string;
+    merchantCategory?: string;
+    merchantAddress?: string;
+    merchantCountry?: string;
     purpose?: string;
-    category?: string;
-    wallet?: {
-        address: string;
+    context?: Record<string, unknown>;
+}
+interface ExternalCardApprovalResult {
+    approved: boolean;
+    decision: 'APPROVED' | 'DENIED' | 'REQUIRES_APPROVAL' | 'EXECUTING' | 'CONFIRMING' | 'COMPLETED' | 'EXPIRED' | 'CANCELLED';
+    requestId: string;
+    approvalToken?: string;
+    expiresAt?: string;
+    reasons: string[];
+    replayed: boolean;
+    transactionId?: string | null;
+    card: {
+        last4: string;
+        brand: string | null;
+        cardholderName: string | null;
     };
+    limits?: {
+        remainingDaily: number;
+        remainingPerTransaction: number;
+    };
+    enforcement: ExternalCardOverlayEnforcement;
+}
+interface ExternalCardExecutionClaimResult {
+    requestId: string;
+    claimed: boolean;
+    replayed: boolean;
+    state: string;
+    reconciliationRequired: boolean;
+    claimedAt?: string;
+    enforcement: ExternalCardOverlayEnforcement;
+}
+interface ExternalCardRequestStatusResult {
+    requestId: string;
+    status: string;
+    decision: string;
+    amount: number;
+    currency: string;
+    merchantName: string | null;
+    merchantId: string | null;
+    merchantCategory: string | null;
+    purpose: string | null;
+    reasons: string[];
     requiresApproval: boolean;
-    approvedAt?: string;
-    deniedAt?: string;
-    denialReason?: string;
-    expiresAt?: string;
-    createdAt: string;
-    transaction?: {
+    reviewed: boolean;
+    expiresAt: string | null;
+    executionClaimedAt: string | null;
+    reconciliationRequired: boolean;
+    nextAction: 'WAIT_FOR_APPROVAL' | 'BEGIN_EXECUTION' | 'CONFIRM_OR_RECONCILE' | 'POLL' | 'NONE';
+    transactionId: string | null;
+    transaction: {
         id: string;
-        txHash: string;
         status: string;
-        confirmedAt?: string;
-        blockNumber?: number;
+        amount: number;
+        currency: string;
+        externalTxId: string | null;
+        authorizedAt: string | null;
+    } | null;
+    enforcement: ExternalCardOverlayEnforcement;
+}
+interface ExternalCardConfirmationInput {
+    approvalToken: string;
+    /** Customer receipt, processor, or authorization reference. Never send PAN or CVC. */
+    externalTxId: string;
+    authorizationCode?: string;
+    actualAmount?: number;
+    /**
+     * Verification/enrichment only. Policy-bearing merchant fields must match
+     * the approval; confirmation cannot substitute the merchant, MCC, or country.
+     */
+    merchantDetails?: {
+        name?: string;
+        id?: string;
+        category?: string;
+        address?: string;
+        city?: string;
+        state?: string;
+        country?: string;
+        postalCode?: string;
     };
 }
-interface ContoError extends Error {
-    code: string;
-    status: number;
+interface ExternalCardConfirmationResult {
+    confirmed: true;
+    replayed: boolean;
+    transactionId: string;
+    status: string;
+    amount: number;
+    currency: string;
+    verificationStatus: 'SELF_REPORTED';
+    enforcement: ExternalCardOverlayEnforcement;
+}
+/**
+ * Input delivered to the customer's credential-using executor. The callback is
+ * invoked only after Conto approves the purchase. It deliberately excludes the
+ * Conto approval token and all card credential fields.
+ */
+interface ApprovedExternalCardExecution {
+    requestId: string;
+    /** Stable purchase key to pass through to the customer payment processor. */
+    idempotencyKey: string;
+    cardId: string;
+    amount: number;
+    currency: 'USD';
+    merchantName: string;
+    merchantId?: string;
+    merchantCategory?: string;
+    merchantAddress?: string;
+    merchantCountry?: string;
+    purpose?: string;
+    context?: Record<string, unknown>;
+}
+interface ExternalCardExecutionResult<TReceipt = unknown> {
+    externalTxId: string;
+    authorizationCode?: string;
+    actualAmount?: number;
+    merchantDetails?: ExternalCardConfirmationInput['merchantDetails'];
+    receipt: TReceipt;
+}
+type ExternalCardExecutor<TReceipt = unknown> = (approvedPurchase: ApprovedExternalCardExecution) => Promise<ExternalCardExecutionResult<TReceipt>>;
+interface ControlledExternalCardPaymentResult<TReceipt = unknown> {
+    approval: ExternalCardApprovalResult;
+    confirmation: ExternalCardConfirmationResult;
+    receipt: TReceipt;
+}
+interface ConnectedCardDrawMerchant {
+    /** Merchant name for policy evaluation. */
+    merchantName?: string;
+    /** Network merchant identifier. */
+    merchantId?: string;
+    /** Four-digit MCC string (e.g. "5411"). */
+    merchantCategory?: string;
+    /** Two- or three-letter country code. */
+    merchantCountry?: string;
+}
+interface ConnectedCardDrawInput {
+    /** Connected card id delegated to this agent. */
+    cardId: string;
+    /** Verified mandate id the draw is charged against. */
+    mandateId: string;
+    /**
+     * Stable 8 to 128 character key. The server is idempotent on this key: a
+     * replay of the same key returns the decision WITHOUT the credential, so
+     * reuse it only to reconcile the exact same draw, never to fetch the card
+     * material again.
+     */
+    idempotencyKey: string;
+    /** Integer amount in minor units (cents), greater than zero. */
+    amountMinor: number;
+    /** Only USD is supported. Defaults to USD. */
+    currency?: 'USD';
+    merchant: ConnectedCardDrawMerchant;
+}
+/**
+ * Live single-use card material returned by {@link ConnectedCardsClient.draw}.
+ *
+ * CREDENTIAL SAFETY (this is the product boundary): these fields are the real,
+ * usable card. They are returned exactly ONCE, on the successful mint, and can
+ * never be re-fetched. A replay of the same idempotencyKey returns the decision
+ * with no `credential`. Use these fields in-process at the intended merchant
+ * checkout only. Never log, print, serialize, persist, cache, or send them
+ * anywhere else. Do not place this object in an error, a Sentry breadcrumb, an
+ * analytics event, or any structured output that a host might record.
+ */
+interface ConnectedCardCredential {
+    /** The card number (PAN). Live card material. */
+    number: string;
+    /** The card security value. Live card material. */
+    securityValue: string;
+    expirationMonth: string;
+    expirationYear: string;
+    cardholderName?: string;
+}
+interface ConnectedCardDrawResult {
+    requestId: string;
+    /** True when this draw has issued a credential, including a replay without the secret. */
+    minted: boolean;
+    /** True when this call replayed a prior draw for the same idempotencyKey. */
+    replayed: boolean;
+    decision: 'APPROVED' | 'DENIED' | 'REQUIRES_APPROVAL';
+    reasons: string[];
+    /** Present when the draw outcome is ambiguous and needs reconciliation. */
+    reconciliationRequired?: boolean;
+    /**
+     * Live single-use card material. Present ONLY on a successful mint and
+     * returned exactly once. Absent on a replay, a denial, or a review decision.
+     * See {@link ConnectedCardCredential} for the handling rules.
+     */
+    credential?: ConnectedCardCredential;
+    /** Provider expiration of the one-time credential; present with a fresh credential. */
+    credentialExpiresAt?: string;
+}
+interface ConnectedCardMandateMerchant {
+    name: string | null;
+    categoryCode: string | null;
+    countryCode: string | null;
+    checkoutOrigin: string | null;
+}
+interface ConnectedCardMandate {
+    id: string;
+    providerReferenceId: string;
+    bindingId: string;
+    status: string;
+    verificationStatus: string;
+    amountMinor: number;
+    currency: string;
+    description: string;
+    merchant: ConnectedCardMandateMerchant;
+    expiresAt: string;
+    verifiedAt: string | null;
+    exhaustedAt: string | null;
+    revokedAt: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+interface ConnectedCardBrief {
+    last4: string;
+    brand: string | null;
+    fundingType: string;
+    cardType: string;
+    status: string;
+    spendLimitDaily: number | null;
+    spendLimitWeekly: number | null;
+    spendLimitMonthly: number | null;
+    spendLimitPerTx: number | null;
+}
+interface ConnectedCardReference {
+    id: string;
+    provider: string;
+    lifecycleState: string;
+    railStatus: string | null;
+}
+interface ConnectedCardDrawable {
+    bindingId: string;
+    agentId: string;
+    status: string;
+    cardId: string;
+    reference: ConnectedCardReference;
+    card: ConnectedCardBrief;
+    mandates: ConnectedCardMandate[];
+    createdAt: string;
+    updatedAt: string;
+}
+interface ConnectedCardListResult {
+    /** Masked drawable cards and their active mandates. No PAN or provider token. */
+    cards: ConnectedCardDrawable[];
+}
+interface StripeLinkPaymentMethod {
+    id: string;
+    type: string;
+    isDefault: boolean;
+    displayLabel: string;
+    last4?: string;
+    eligibleCredentialTypes: string[];
+}
+interface ListStripeLinkPaymentMethodsResult {
+    /** Authenticated tenant context, returned so operators can verify a target before writes. */
+    organizationId: string;
+    connectionId: string;
+    /** Masked Link payment methods eligible for the bound agent. */
+    paymentMethods: StripeLinkPaymentMethod[];
+}
+type CommerceTotalType = 'subtotal' | 'tax' | 'total' | 'items_base_amount' | 'items_discount' | 'discount' | 'fulfillment' | 'shipping' | 'fee' | 'gift_wrap' | 'tip' | 'store_credit';
+interface CommerceLineItemInput {
+    name: string;
+    quantity: number;
+    unitAmountMinor: number;
+    description?: string;
+    sku?: string;
+    productUrl?: string;
+}
+interface CommerceTotalInput {
+    type: CommerceTotalType;
+    label: string;
+    amountMinor: number;
+}
+interface CommerceFulfillmentInput {
+    recipient?: string;
+    addressLine1?: string;
+    addressLine2?: string;
+    locality?: string;
+    region?: string;
+    postalCode?: string;
+    countryCode?: string;
+}
+/** Exact Stripe Link purchase intent evaluated and bound by Conto policy. */
+interface BeginCommerceExecutionCommonInput {
+    /** Stable key for this exact intent. Reuse it when reconciling or retrying begin. */
+    idempotencyKey: string;
+    intentId?: string;
+    /** Integer amount in minor units (cents). */
+    amountMinor: number;
+    currency: 'USD';
+    purpose: string;
+    /** Optional semantic policy category, such as OFFICE_SUPPLIES. */
+    category?: string;
+    cart: {
+        lineItems: CommerceLineItemInput[];
+        totals: CommerceTotalInput[];
+        fulfillment?: CommerceFulfillmentInput;
+    };
+    providerPresentation: {
+        approvalSummary: string;
+        lineItemLabels: string[];
+    };
+}
+type AgentCheckoutActionKind = 'INITIATE_CHECKOUT' | 'OPEN_LINK' | 'CONFIRM_PAYMENT' | 'PLACE_ORDER';
+interface BrowserCheckoutAction {
+    kind: AgentCheckoutActionKind;
+    checkoutMethod: CommerceCheckoutMethod;
+    pageUrl: string;
+    /** Runtime-generated fingerprint of the exact DOM/action target. */
+    targetFingerprint: string;
+    targetUrl?: string;
+    targetLabel?: string;
+}
+interface AgentCheckoutAction extends Omit<BrowserCheckoutAction, 'checkoutMethod'> {
+    /** @deprecated Compatibility marker for executionMethod: 'AGENT_CHECKOUT'. */
+    provider: 'STRIPE_LINK';
+    checkoutMethod?: CommerceCheckoutMethod;
+}
+type BeginConnectedLinkExecutionInput = BeginCommerceExecutionCommonInput & {
+    connectionId: string;
+    paymentMethodId: string;
+};
+type BeginCommerceExecutionInput = (BeginConnectedLinkExecutionInput & {
+    /** Primary path: the server resolves the immutable Stripe seller profile. */
+    executionMethod: 'STRIPE_PAYMENT_INTENT';
+    counterparty: {
+        canonicalId: string;
+        displayName: string;
+    };
+}) | (BeginConnectedLinkExecutionInput & {
+    /** Optional compatibility transport for a configured MPP merchant. */
+    executionMethod?: 'MPP';
+    counterparty: {
+        canonicalId: string;
+        displayName: string;
+        checkoutUrl: string;
+        mppNetworkId: string;
+    };
+}) | (BeginCommerceExecutionCommonInput & {
+    /** Public Stripe-hosted Checkout with Link offered when eligible. */
+    executionMethod: 'LINK_CHECKOUT';
+    counterparty: {
+        /** Identifier for the merchant profile configured by the Conto operator. */
+        canonicalId: string;
+    };
+}) | (BeginCommerceExecutionCommonInput & {
+    /** Merchant-independent guard for an exact privileged browser action. */
+    executionMethod: 'AGENT_CHECKOUT';
+    browserSessionId: string;
+    action: AgentCheckoutAction;
+    counterparty: {
+        canonicalId: string;
+        displayName: string;
+        checkoutUrl: string;
+    };
+}) | (BeginCommerceExecutionCommonInput & {
+    /** Provider-neutral guard for one exact privileged browser action. */
+    executionMethod: 'BROWSER_CHECKOUT';
+    browserSessionId: string;
+    action: BrowserCheckoutAction;
+    counterparty: {
+        canonicalId: string;
+        displayName: string;
+        checkoutUrl: string;
+    };
+});
+type CommerceExecutionStatus = 'DRAFT' | 'ACTION_REQUIRED' | 'AUTHORIZING' | 'AWAITING_APPROVAL' | 'READY' | 'PROCESSING' | 'SETTLED' | 'COMPLETED' | 'DENIED' | 'CANCELLED' | 'FAILED' | 'RETURNED' | 'EXPIRED' | 'NEEDS_RECONCILIATION';
+type CommerceExecutionProvider = 'STABLECOIN' | 'TOKENIZED_CARD' | 'STRIPE_LINK';
+type CommerceExecutionChannel = 'BROWSER' | 'MERCHANT_API' | 'CREDENTIAL_BROKER' | 'BANK_API' | 'WALLET_SIGNER';
+type CommerceCheckoutMethod = 'LINK' | 'CARD' | 'SHOP_PAY' | 'PAYPAL';
+type CommerceSettlementRail = 'CARD' | 'ACH' | 'WIRE' | 'STABLECOIN';
+type CommerceProposalState = 'DRAFT' | 'NEEDS_CONTEXT' | 'READY_FOR_POLICY' | 'CANCELLED';
+type CommerceProposalMissingFact = 'AGENT' | 'AMOUNT' | 'CURRENCY' | 'PURPOSE' | 'COUNTERPARTY_ID' | 'COUNTERPARTY_NAME' | 'CART_LINE_ITEMS' | 'CART_TOTAL' | 'PROVIDER_PRESENTATION';
+type CommerceFactSource = 'USER_ASSERTED' | 'AGENT_INFERRED' | 'BROWSER_OBSERVED' | 'MERCHANT_SIGNED' | 'PROVIDER_CONFIRMED' | 'ISSUER_CONFIRMED';
+type CommerceFactConfidence = 'LOW' | 'MEDIUM' | 'HIGH' | 'VERIFIED';
+type CommerceProposalFactKey = 'AMOUNT' | 'CURRENCY' | 'PURPOSE' | 'CATEGORY' | 'COUNTERPARTY' | 'CART' | 'EXECUTION';
+interface CommerceFactProvenanceInput {
+    source: CommerceFactSource;
+    confidence: CommerceFactConfidence;
+    observedAt?: string;
+    evidenceFingerprint?: string;
+}
+interface NormalizeCommerceProposalInput {
+    /** Stable caller-selected key for this evolving proposal. */
+    proposalKey: string;
+    proposalId?: string;
+    /** Zero for a caller-confirmed create, or the exact revision being replaced. */
+    expectedRevision?: number;
+    draft?: boolean;
+    amountMinor?: number;
+    maximumAmountMinor?: number;
+    currency?: string;
+    purpose?: string;
+    category?: string;
+    counterparty?: {
+        canonicalId?: string;
+        displayName?: string;
+        checkoutUrl?: string;
+    };
+    cart?: {
+        lineItems?: CommerceLineItemInput[];
+        totals?: CommerceTotalInput[];
+        fulfillment?: CommerceFulfillmentInput;
+    };
+    providerPresentation?: {
+        approvalSummary: string;
+        lineItemLabels: string[];
+    };
+    execution?: {
+        executionChannel?: CommerceExecutionChannel;
+        checkoutMethod?: CommerceCheckoutMethod;
+        settlementRail?: CommerceSettlementRail;
+    };
+    provenance?: Partial<Record<CommerceProposalFactKey, CommerceFactProvenanceInput>>;
+    /** Organization-registered semantic facts validated before policy evaluation. */
+    extensions?: Array<{
+        namespace: string;
+        value: unknown;
+    }>;
+}
+interface CommerceContextRequirement {
+    fact: CommerceProposalMissingFact;
+    reasonCode: `MISSING_${CommerceProposalMissingFact}`;
+    prompt: string;
+}
+interface CommerceProposalResolution {
+    proposal: {
+        id: string;
+        organizationId: string;
+        actorUserId: string;
+        agentId?: string;
+        state: CommerceProposalState;
+        amountMinor?: number;
+        maximumAmountMinor?: number;
+        currency?: string;
+        purpose?: string;
+        category?: string;
+        counterparty?: NormalizeCommerceProposalInput['counterparty'];
+        cart?: NormalizeCommerceProposalInput['cart'];
+        providerPresentation?: NormalizeCommerceProposalInput['providerPresentation'];
+        execution?: NormalizeCommerceProposalInput['execution'];
+        provenance: Partial<Record<CommerceProposalFactKey, CommerceFactProvenanceInput>>;
+        extensions: Array<{
+            namespace: string;
+            value: unknown;
+            schemaRevision?: number;
+            schemaFingerprint?: string;
+        }>;
+        missingFacts: CommerceProposalMissingFact[];
+    };
+    proposalFingerprint: string;
+    /** Durable, monotonically increasing proposal revision. */
+    revision: number;
+    /** True only when this request created the proposal head. */
+    created: boolean;
+    outcome: 'NEEDS_CONTEXT' | 'READY_FOR_POLICY';
+    requirements: CommerceContextRequirement[];
+    nextAction: 'COLLECT_CONTEXT' | 'BEGIN_POLICY_EVALUATION';
+}
+type CommerceExecutionAdapterKind = 'STABLECOIN' | 'TOKENIZED_CARD' | 'STRIPE_LINK' | 'LINK_CHECKOUT' | 'CHECKOUT_GUARD';
+type CommerceExecutionSourceKind = 'STABLECOIN_WALLET' | 'TOKENIZED_CARD' | 'STRIPE_LINK' | 'STRIPE_LINK_CHECKOUT' | 'AGENT_BROWSER_CHECKOUT';
+type CommerceExecutionArtifactKind = 'CARD' | 'LINK_PAY_TOKEN' | 'SHARED_PAYMENT_TOKEN';
+type CommerceExecutionDeliveryMode = 'SERVER_ONLY_ARTIFACT' | 'PROVIDER_DIRECT' | 'USER_INTERACTIVE';
+type CommerceExecutionConstraint = 'AMOUNT' | 'CURRENCY' | 'COUNTERPARTY' | 'CART' | 'PURPOSE' | 'EXPIRY' | 'SINGLE_USE';
+type CommerceExecutionConstraintCoverageLevel = 'UNSUPPORTED' | 'OBSERVE_ONLY' | 'CONTO_PRECHECK' | 'PROVIDER_ENFORCED';
+type CommerceExecutionConstraintCoverage = Readonly<Record<CommerceExecutionConstraint, CommerceExecutionConstraintCoverageLevel>>;
+/** Provider-independent, allowlisted evidence. It contains no Link credential material. */
+interface CommerceExecutionEvidence {
+    schemaVersion: 'conto.commerce-evidence.v1';
+    traceId: string;
+    executionId: string;
+    intentId: string;
+    organizationId: string;
+    actorUserId: string;
+    agentId?: string;
+    provider: CommerceExecutionProvider;
+    sourceKind: CommerceExecutionSourceKind;
+    amountMinor: number;
+    currency: string;
+    purpose: string;
+    counterpartyId: string;
+    counterpartyName: string;
+    intentFingerprint: string;
+    policyDecisionId: string;
+    policySnapshotHash: string;
+    grantId: string;
+    deliveryMode?: CommerceExecutionDeliveryMode;
+    artifactKind?: CommerceExecutionArtifactKind;
+    enforcementCoverage?: CommerceExecutionConstraintCoverage;
+    status: CommerceExecutionStatus;
+    providerStatus?: string;
+    providerReference?: string;
+    transactionReference?: string;
+    checkoutReference?: string;
+    /** Actual method observed after Stripe settlement; Link cannot be forced to display or win. */
+    actualPaymentMethod?: 'LINK' | 'CARD';
+    browserAction?: {
+        kind: AgentCheckoutActionKind;
+        provider: 'STRIPE_LINK';
+        checkoutMethod?: CommerceCheckoutMethod;
+        trustPolicyRevision?: number;
+        trustPolicyFingerprint?: string;
+        merchantOrigin: string;
+        actionFingerprint: string;
+    };
+    refund?: {
+        amountMinor: number;
+        currency: string;
+        state: string;
+    };
+}
+/** Safe execution projection. Raw provider responses and payment artifacts are excluded. */
+interface CommerceExecution {
+    id: string;
+    intentId: string;
+    organizationId: string;
+    agentId?: string;
+    provider: CommerceExecutionProvider;
+    /** Execution path selected before settlement; distinct from actualPaymentMethod. */
+    executionAdapter: CommerceExecutionAdapterKind;
+    /** Provider-neutral channel that must consume the Conto authorization. */
+    executionChannel: CommerceExecutionChannel;
+    /** Selected checkout method, or the method observed after a dynamic checkout settles. */
+    checkoutMethod?: CommerceCheckoutMethod;
+    /** Expected settlement rail when the current execution source establishes it. */
+    settlementRail?: CommerceSettlementRail;
+    status: CommerceExecutionStatus;
+    providerStatus?: string;
+    providerReference?: string;
+    /** Sanitized Link approval or Stripe-hosted Checkout URL. */
+    approvalUrl?: string;
+    artifactKind?: CommerceExecutionArtifactKind;
+    deliveryMode?: CommerceExecutionDeliveryMode;
+    amountMinor: number;
+    currency: string;
+    purpose: string;
+    category?: string;
+    counterparty: {
+        id: string;
+        name: string;
+    };
+    evidence: CommerceExecutionEvidence;
+    evidenceFingerprint: string;
+}
+interface CommerceExecutionResult {
+    execution: CommerceExecution;
+}
+interface ExecuteCommerceExecutionResult extends CommerceExecutionResult {
+    checkout: {
+        submitted: boolean;
+        deliveryMode: 'SERVER_ONLY_ARTIFACT';
+        accepted: boolean;
+    } | {
+        submitted: true;
+        deliveryMode: 'PROVIDER_DIRECT';
+    };
+}
+interface CheckoutActionAuthorization {
+    /** Durable single-use record consumed by the privileged browser runtime. */
+    authorizationId: string;
+    executionId: string;
+    browserSessionId: string;
+    grantId: string;
+    intentFingerprint: string;
+    actionFingerprint: string;
+    merchantOrigin: string;
+    actionKind: AgentCheckoutActionKind;
+    provider: 'STRIPE_LINK';
+    checkoutMethod?: CommerceCheckoutMethod;
+    expiresAt: string;
+    singleUse: true;
+}
+interface AuthorizeCheckoutActionResult extends CommerceExecutionResult {
+    authorization: CheckoutActionAuthorization;
+}
+interface BrowserActionClaimResult {
+    authorization: {
+        authorizationId: string;
+        state: 'DISPATCHING';
+        actionFingerprint: string;
+        expiresAt: string;
+    };
+}
+interface BrowserActionFinalizeResult {
+    authorization: {
+        authorizationId: string;
+        state: 'CONSUMED' | 'INDETERMINATE';
+    };
+}
+interface BrowserActionDispatchObservationInput {
+    reference: string;
+    observedAt: string;
+    pageUrl: string;
+}
+interface GuardCheckoutResult<T> extends AuthorizeCheckoutActionResult {
+    result: T;
+}
+interface GuardedBrowserDispatchResult<T> {
+    result: T;
+    observation: BrowserActionDispatchObservationInput;
+}
+type GuardedCheckoutInput = Extract<BeginCommerceExecutionInput, {
+    executionMethod: 'AGENT_CHECKOUT' | 'BROWSER_CHECKOUT';
+}>;
+/** Privileged runtime port; the agent model must not receive this driver directly. */
+interface PrivilegedBrowserCheckoutDriver<T> {
+    dispatch(input: {
+        authorization: CheckoutActionAuthorization;
+        browserSessionId: string;
+        action: AgentCheckoutAction | BrowserCheckoutAction;
+    }): Promise<GuardedBrowserDispatchResult<T>>;
+}
+interface RunGuardedCheckoutResult<T> extends GuardCheckoutResult<T> {
+    dispatchAttemptId: string;
+    observation: BrowserActionDispatchObservationInput;
+}
+interface ProtocolPreAuthorizeResult {
+    authorized: boolean;
+    decision: 'approved' | 'declined' | 'review_required';
+    message: string;
+}
+interface X402PreAuthorizeInput {
+    amount: number;
+    recipientAddress: string;
+    resourceUrl: string;
+    context?: {
+        department?: string;
+        project?: string;
+    };
+    facilitator?: string;
+    scheme?: string;
+    /** Customer-supplied ID used to group authorization, recording, and spend reporting. */
+    sessionId?: string;
+    paymentId?: string;
+    /** Exact wallet address that will sign. Provide together with network. */
+    payerAddress?: string;
+    /** CAIP-2 network from the x402 challenge, for example eip155:8453. */
+    network?: string;
+}
+interface X402PreAuthorizeResult extends ProtocolPreAuthorizeResult {
+    x402: {
+        serviceDomain?: string;
+        amount: number;
+        sessionId?: string;
+    };
+}
+interface X402RecordInput {
+    amount: number;
+    currency?: string;
+    recipientAddress: string;
+    txHash: string;
+    resourceUrl: string;
+    /** Stable x402 payment identifier. Reuse this value to reconcile an ambiguous failure. */
+    paymentId: string;
+    /** Customer-supplied ID used to group related x402 payments. */
+    sessionId?: string;
+    /** Exact wallet address that signed. Provide together with network. */
+    payerAddress?: string;
+    /** CAIP-2 network from the x402 challenge, for example eip155:8453. */
+    network?: string;
+    context?: {
+        department?: string;
+        project?: string;
+    };
+    batchItems?: Array<{
+        amount: number;
+        resourceUrl: string;
+        paymentId: string;
+    }>;
+}
+interface X402RecordResult {
+    recorded: true;
+    confirmed: true;
+    txHash: string;
+    explorerUrl: string;
+    sessionId?: string;
+}
+interface MppPreAuthorizeInput {
+    amount: number;
+    recipientAddress: string;
+    resourceUrl: string;
+    context?: {
+        department?: string;
+        project?: string;
+    };
+    intent?: 'charge' | 'session';
+    depositAmount?: number;
+    /** Customer-supplied ID used to group authorization, recording, and spend reporting. */
+    sessionId?: string;
+    scheme?: string;
+    credentialId?: string;
+    challengeId?: string;
+    paymentMethod?: string;
+}
+interface MppPreAuthorizeResult extends ProtocolPreAuthorizeResult {
+    mpp: {
+        serviceDomain?: string;
+        amount: number;
+        sessionId?: string;
+    };
+}
+interface MppRecordInput {
+    amount: number;
+    currency?: string;
+    recipientAddress: string;
+    txHash?: string;
+    resourceUrl: string;
+    /** Stable MPP credential identifier. Reuse this value to reconcile an ambiguous failure. */
+    credentialId: string;
+    /** Customer-supplied ID used to group related MPP payments. */
+    sessionId?: string;
+    context?: {
+        department?: string;
+        project?: string;
+    };
+    paymentReceipt?: string;
+    intent?: 'charge' | 'session';
+    scheme?: string;
+    challengeId?: string;
+    paymentMethod?: string;
+    depositAmount?: number;
+    batchItems?: Array<{
+        amount: number;
+        resourceUrl: string;
+        credentialId: string;
+    }>;
+}
+interface MppRecordResult {
+    recorded: true;
+    txHash?: string;
+    explorerUrl?: string;
+    sessionId?: string;
+}
+interface ProtocolBudgetResult {
+    spend: {
+        daily: {
+            calls: number;
+            amount: number;
+        };
+        weekly: {
+            calls: number;
+            amount: number;
+        };
+        monthly: {
+            calls: number;
+            amount: number;
+        };
+        session: {
+            sessionId: string;
+            calls: number;
+            amount: number;
+        } | null;
+    };
+    limits: {
+        daily: number | null;
+        weekly: number | null;
+        monthly: number | null;
+        perPayment: number | null;
+    };
+    trend: {
+        spendPerHour: number;
+        callsPerHour: number;
+        averageCost: number;
+        estimatedHoursRemaining: number | null;
+    };
+}
+type X402BudgetResult = ProtocolBudgetResult;
+type MppBudgetResult = ProtocolBudgetResult;
+interface ProtocolServiceSummary {
+    domain: string;
+    name: string | null;
+    totalCalls: number;
+    totalSpend: number;
+    averageCost: number;
+    lastUsedAt: string | null;
+    recent: {
+        calls: number;
+        spend: number;
+        averageCost: number;
+    };
+}
+interface ProtocolServicesResult {
+    services: ProtocolServiceSummary[];
+    summary: {
+        serviceCount: number;
+        totalCalls: number;
+        totalSpend: number;
+        averageCost: number;
+    };
+    period: '24h' | '7d' | '30d' | '90d';
+}
+declare class ContoError extends Error {
+    readonly code: string;
+    readonly status: number;
+    readonly requestId?: string;
+    readonly retryAfter?: number;
+    readonly retryGuidance?: string;
+    readonly actionUrl?: string;
+    readonly fieldErrors?: ApiErrorMetadata['fieldErrors'];
+    readonly reasons?: string[];
+    constructor(message: string, metadata: ApiErrorMetadata);
+}
+/**
+ * The customer executor returned a receipt, but Conto did not acknowledge the
+ * confirmation. Persist confirmationInput and retry cards.confirm(); never run
+ * the customer executor again for this request.
+ */
+declare class ExternalCardConfirmationPendingError<TReceipt = unknown> extends ContoError {
+    readonly confirmationInput: ExternalCardConfirmationInput;
+    readonly receipt: TReceipt;
+    constructor(requestId: string, confirmationInput: ExternalCardConfirmationInput, receipt: TReceipt);
+}
+/**
+ * The privileged browser action ran, but Conto did not acknowledge its final
+ * observation. Retry finalizeBrowserAction with these exact fields; never run
+ * the browser action again.
+ */
+declare class BrowserActionFinalizationPendingError<TResult = unknown> extends ContoError {
+    readonly authorizationId: string;
+    readonly dispatchAttemptId: string;
+    readonly result: TResult;
+    readonly observation: BrowserActionDispatchObservationInput;
+    constructor(input: {
+        authorizationId: string;
+        dispatchAttemptId: string;
+        result: TResult;
+        observation: BrowserActionDispatchObservationInput;
+    });
+}
+interface ContoRequestOptions {
+    /** Set only when repeating this request cannot create an additional side effect. */
+    idempotent?: boolean;
+    /** Number of retries after the initial attempt. Defaults to 3. */
+    maxRetries?: number;
 }
 declare class Conto {
     private apiKey;
     private baseUrl;
     private timeout;
     payments: PaymentsClient;
+    cards: CardsClient;
+    connectedCards: ConnectedCardsClient;
+    x402: X402Client;
+    mpp: MppClient;
     constructor(config: ContoConfig);
-    private fetchWithRetry;
-    /** Make an authenticated request to the Giro API */
-    request<T>(method: string, path: string, body?: Record<string, unknown>): Promise<T>;
+    /**
+     * List masked Link payment methods for a session-created connection that is
+     * explicitly bound to this agent. No Link token or payment artifact is
+     * returned through the agent SDK.
+     */
+    listStripeLinkPaymentMethods(connectionId: string): Promise<ListStripeLinkPaymentMethodsResult>;
+    /**
+     * Normalize and durably revise a partial agent purchase proposal without
+     * creating a payment side effect. Missing facts return as NEEDS_CONTEXT
+     * requirements; changed writes require the exact prior revision.
+     */
+    normalizeCommerceProposal(input: NormalizeCommerceProposalInput): Promise<CommerceProposalResolution>;
+    /** Reload one durable proposal head in this agent and tenant scope. */
+    getCommerceProposal(proposalId: string): Promise<CommerceProposalResolution>;
+    /**
+     * Evaluate policy and begin one exact Stripe Link commerce intent.
+     *
+     * The stable idempotency key makes transport retries safe. Reusing it with a
+     * different intent is rejected by the API.
+     */
+    beginCommerceExecution(input: BeginCommerceExecutionInput): Promise<CommerceExecutionResult>;
+    /** Atomically consume the Conto authorization for one exact browser action. */
+    authorizeCheckoutAction(executionId: string, browserSessionId: string, action: AgentCheckoutAction | BrowserCheckoutAction): Promise<AuthorizeCheckoutActionResult>;
+    /** Claim a durable browser action for one stable privileged-runtime attempt. */
+    claimBrowserAction(authorizationId: string, dispatchAttemptId: string, browserSessionId: string, action: AgentCheckoutAction | BrowserCheckoutAction): Promise<BrowserActionClaimResult>;
+    /** Finalize the exact dispatch attempt; this never performs the browser side effect. */
+    finalizeBrowserAction(authorizationId: string, input: {
+        dispatchAttemptId: string;
+        outcome: 'CONSUMED' | 'INDETERMINATE';
+        observation?: BrowserActionDispatchObservationInput;
+    }): Promise<BrowserActionFinalizeResult>;
+    /**
+     * Own the complete privileged-browser enforcement sequence. The stable
+     * dispatchAttemptId must be persisted by the runtime before this call.
+     */
+    runGuardedCheckout<T>(input: GuardedCheckoutInput, runtime: {
+        dispatchAttemptId: string;
+        execute: (authorization: CheckoutActionAuthorization) => Promise<GuardedBrowserDispatchResult<T>>;
+    }): Promise<RunGuardedCheckoutResult<T>>;
+    /**
+     * Reference privileged-driver integration. Only this wrapper should be
+     * exposed as the agent's payment-sensitive browser tool.
+     */
+    runGuardedCheckoutWithDriver<T>(input: GuardedCheckoutInput, runtime: {
+        dispatchAttemptId: string;
+        driver: PrivilegedBrowserCheckoutDriver<T>;
+    }): Promise<RunGuardedCheckoutResult<T>>;
+    /**
+     * Policy-check and authorize an exact action before invoking a legacy callback.
+     * @deprecated Use runGuardedCheckout so the durable claim and final
+     * observation cannot be omitted.
+     */
+    guardCheckout<T>(input: GuardedCheckoutInput, executor: (authorization: CheckoutActionAuthorization) => Promise<T>): Promise<GuardCheckoutResult<T>>;
+    /** Read one agent-scoped commerce execution and its normalized evidence. */
+    getCommerceExecution(executionId: string): Promise<CommerceExecutionResult>;
+    /**
+     * Observe Link state and reconcile terminal accounting. This operation is
+     * safe to retry because it does not request another checkout execution.
+     */
+    refreshCommerceExecution(executionId: string): Promise<CommerceExecutionResult>;
+    /**
+     * Execute the approved provider-direct or server-only checkout handoff. Transport retries are
+     * deliberately disabled. Read or refresh the execution after an ambiguous
+     * failure before taking another execution action.
+     */
+    executeCommerceExecution(executionId: string): Promise<ExecuteCommerceExecutionResult>;
+    /**
+     * Request cancellation and release reserved spend after Link confirms it.
+     * Transport retries are disabled because a lost provider response requires
+     * reconciliation.
+     */
+    cancelCommerceExecution(executionId: string): Promise<CommerceExecutionResult>;
+    /** Read credentials, linked wallets, effective policies, and scopes without creating a payment. */
+    setup(): Promise<AgentSetupResult>;
+    /** Make an authenticated request to the Conto API */
+    request<T>(method: string, path: string, body?: Record<string, unknown>, options?: ContoRequestOptions): Promise<T>;
+}
+/** Agent client for the cooperative external-card policy overlay. */
+declare class CardsClient {
+    private client;
+    constructor(client: Conto);
+    approve(input: ExternalCardApprovalInput): Promise<ExternalCardApprovalResult>;
+    confirm(requestId: string, input: ExternalCardConfirmationInput): Promise<ExternalCardConfirmationResult>;
+    /**
+     * Atomically claim the approved intent before customer code accesses or uses
+     * the card credential. A request can be claimed only once.
+     */
+    begin(requestId: string, input: {
+        approvalToken: string;
+    }): Promise<ExternalCardExecutionClaimResult>;
+    /** Read execution and reconciliation state without exposing card credentials. */
+    status(requestId: string): Promise<ExternalCardRequestStatusResult>;
+    /**
+     * Create a reference payment tool whose executor callback is unreachable
+     * until Conto has returned a live approval grant.
+     *
+     * @deprecated Use the separate `@conto_finance/card-access` product package for
+     * customer-hosted card enforcement. This helper remains for compatibility.
+     */
+    controlled<TReceipt>(executor: ExternalCardExecutor<TReceipt>): ControlledExternalCardPaymentTool<TReceipt>;
+}
+/**
+ * Cooperative control for an existing customer credential store. The executor is
+ * customer-owned and remains bypassable if another code path can call it.
+ */
+declare class ControlledExternalCardPaymentTool<TReceipt = unknown> {
+    private cardsClient;
+    private executor;
+    constructor(cardsClient: CardsClient, executor: ExternalCardExecutor<TReceipt>);
+    pay(input: ExternalCardApprovalInput): Promise<ControlledExternalCardPaymentResult<TReceipt>>;
+}
+/**
+ * Agent client for connected cards (gated pilot).
+ *
+ * A connected card is a customer card enrolled through the provider and
+ * delegated to this agent. `draw` mints one single-use credential against a
+ * verified mandate; `list` returns the masked cards and mandates the agent may
+ * draw against. This is a separate rail from {@link CardsClient}: it does not
+ * share endpoints, scopes, or types with the external-card policy overlay.
+ *
+ * These methods return 404 until the tenant is enabled for the pilot.
+ */
+declare class ConnectedCardsClient {
+    private client;
+    constructor(client: Conto);
+    /**
+     * Draw one single-use card credential against a verified mandate.
+     *
+     * On an APPROVED, minted draw the result carries live card material in
+     * `credential`, returned exactly ONCE.
+     *
+     * CREDENTIAL SAFETY (load-bearing): the credential is the real, usable card.
+     * It is revealed a single time and cannot be re-fetched. Use it in-process at
+     * the intended merchant checkout only. Never log, print, serialize, persist,
+     * cache, or forward it, and never place it in an error, a monitoring event,
+     * or any other sink. See {@link ConnectedCardCredential}.
+     *
+     * Transport-level retry is deliberately OFF for this call. The server is
+     * idempotent on `idempotencyKey`, so an automatic retry after a successful
+     * mint would replay the draw and return the decision WITHOUT the credential,
+     * silently losing the one-shot card material. If a `draw` fails ambiguously,
+     * do not blindly retry: check the outcome, and reuse the same
+     * `idempotencyKey` only to reconcile the same draw.
+     *
+     * @example
+     * ```typescript
+     * const draw = await conto.connectedCards.draw({
+     *   cardId: 'cmm59z8fj000l49h7bjqza11p',
+     *   mandateId: 'cmm5a1b2c000m49h7defgh22q',
+     *   idempotencyKey: 'checkout_01J8...',
+     *   amountMinor: 4999,
+     *   merchant: { merchantName: 'Example Store', merchantCategory: '5311' },
+     * });
+     * if (draw.decision === 'APPROVED' && draw.credential) {
+     *   // Keep the credential in memory, acknowledge receipt, then use it at checkout.
+     *   await conto.connectedCards.acknowledgeDelivery(draw.requestId);
+     *   // Do not log or store draw.credential.
+     * }
+     * ```
+     */
+    draw(input: ConnectedCardDrawInput): Promise<ConnectedCardDrawResult>;
+    /**
+     * List the connected cards and active mandates this agent may draw against.
+     *
+     * The response is masked: no PAN and no provider tokens. This is a read-only
+     * GET, so transport retry on transient failures is safe.
+     */
+    /** Record receipt after a fresh draw. Does not confirm checkout or payment settlement. */
+    acknowledgeDelivery(requestId: string): Promise<{
+        acknowledged: boolean;
+        settlementVerified: false;
+    }>;
+    list(): Promise<ConnectedCardListResult>;
 }
 /** Client for payment operations */
 declare class PaymentsClient {
     private client;
+    /** Authorize an externally signed transfer. This write is not automatically retried. */
+    approve(input: ExternalWalletApprovalInput): Promise<ExternalWalletApprovalResult>;
+    /** Record an existing transfer. Never sends funds; reconcile conflicts using status(). */
+    confirm(requestId: string, input: ExternalWalletConfirmationInput): Promise<ExternalWalletConfirmationResult>;
     constructor(client: Conto);
     /**
      * Request authorization for a payment.
@@ -704,8 +2305,11 @@ declare class PaymentsClient {
      * @example
      * ```typescript
      * const result = await conto.payments.execute(request.requestId);
-     * console.log(`Transaction: ${result.txHash}`);
-     * console.log(`Explorer: ${result.explorerUrl}`);
+     * console.log(`Status: ${result.status}`);
+     * console.log(`Conto transaction: ${result.receipt.transactionId}`);
+     * console.log(`Settlement mode: ${result.receipt.settlementMode}`);
+     * console.log(`Transaction: ${result.receipt.txHash}`);
+     * if (result.receipt.explorerUrl) console.log(`Explorer: ${result.receipt.explorerUrl}`);
      * ```
      */
     execute(requestId: string): Promise<PaymentExecuteResult>;
@@ -717,8 +2321,8 @@ declare class PaymentsClient {
      * @example
      * ```typescript
      * const status = await conto.payments.status(requestId);
-     * if (status.transaction?.status === 'CONFIRMED') {
-     *   console.log('Payment confirmed at block', status.transaction.blockNumber);
+     * if (status.transaction?.status === 'completed') {
+     *   console.log('Payment confirmed', status.transaction.txHash);
      * }
      * ```
      */
@@ -737,7 +2341,9 @@ declare class PaymentsClient {
      *     recipientAddress: '0x...',
      *     purpose: 'Service fee'
      *   });
-     *   console.log(`Paid! TX: ${result.txHash}`);
+     *   console.log(`Payment status: ${result.status}`);
+     *   console.log(`Conto transaction: ${result.receipt.transactionId}`);
+     *   console.log(`Transaction: ${result.receipt.txHash}`);
      * } catch (error) {
      *   if (error.code === 'REQUIRES_APPROVAL') {
      *     console.log('Payment needs human approval');
@@ -749,5 +2355,31 @@ declare class PaymentsClient {
      */
     pay(input: PaymentRequestInput): Promise<PaymentExecuteResult>;
 }
+declare class X402Client {
+    private client;
+    constructor(client: Conto);
+    preAuthorize(input: X402PreAuthorizeInput): Promise<X402PreAuthorizeResult>;
+    record(input: X402RecordInput): Promise<X402RecordResult>;
+    budget(options?: {
+        sessionId?: string;
+    }): Promise<X402BudgetResult>;
+    services(options?: {
+        period?: '24h' | '7d' | '30d' | '90d';
+        limit?: number;
+    }): Promise<ProtocolServicesResult>;
+}
+declare class MppClient {
+    private client;
+    constructor(client: Conto);
+    preAuthorize(input: MppPreAuthorizeInput): Promise<MppPreAuthorizeResult>;
+    record(input: MppRecordInput): Promise<MppRecordResult>;
+    budget(options?: {
+        sessionId?: string;
+    }): Promise<MppBudgetResult>;
+    services(options?: {
+        period?: '24h' | '7d' | '30d' | '90d';
+        limit?: number;
+    }): Promise<ProtocolServicesResult>;
+}
 
-export { type Agent, type AgentStatus, type AgentType, type AgentWalletLink, type ChainType, Conto, ContoAdmin, type ContoAdminConfig, type ContoAdminError, type ContoConfig, type ContoError, type CreateAgentInput, type CreatePolicyInput, type CreatePolicyRuleInput, type CreateSdkKeyInput, type CreateSdkKeyResult, type CreateWalletInput, type CustodyType, type DelegationType, type FreezeAgentInput, Conto as Giro, type ContoConfig as GiroConfig, type ContoError as GiroError, type LinkWalletInput, type ListAgentsParams, type ListAgentsResponse, type ListPoliciesParams, type ListPoliciesResponse, type ListWalletsParams, type ListWalletsResponse, type PaginatedResponse, type PaginationParams, type PaymentExecuteResult, type PaymentRequestInput, type PaymentRequestResult, type PaymentStatusResult, type Policy, type PolicyRule, type PolicyType, type PolicyViolation, type ProvisionWalletResult, type RefreshBalanceResult, type RuleAction, type RuleOperator, type RuleType, type SdkKey, type SdkKeyType, type UnfreezeAgentInput, type UpdateAgentInput, type UpdatePolicyInput, type UpdatePolicyRuleInput, type UpdateWalletInput, type Wallet, type WalletChainBalanceSnapshot, type WalletStatus, type WalletType, Conto as default };
+export { type AdminExternalCardOverlayEnforcement, type Agent, type AgentCheckoutAction, type AgentCheckoutActionKind, type AgentExternalCard, type AgentSetupResult, type AgentStatus, type AgentType, type AgentWalletLink, type ApprovedExternalCardExecution, type AssignExternalCardInput, type AssignedPolicy, type AuthorizeCheckoutActionResult, type BeginCommerceExecutionInput, type BrowserActionClaimResult, type BrowserActionDispatchObservationInput, BrowserActionFinalizationPendingError, type BrowserActionFinalizeResult, type BrowserCheckoutAction, type BrowserCheckoutTargetResolver, type BrowserCheckoutTargetSnapshot, type BrowserCheckoutTargetVerificationCode, BrowserCheckoutTargetVerificationError, type CanonicalBrowserCheckoutTargetSnapshot, CardsClient, type ChainType, type CheckoutActionAuthorization, type CommerceCheckoutMethod, type CommerceContextRequirement, type CommerceExecution, type CommerceExecutionAdapterKind, type CommerceExecutionArtifactKind, type CommerceExecutionChannel, type CommerceExecutionConstraint, type CommerceExecutionConstraintCoverage, type CommerceExecutionConstraintCoverageLevel, type CommerceExecutionDeliveryMode, type CommerceExecutionEvidence, type CommerceExecutionProvider, type CommerceExecutionResult, type CommerceExecutionSourceKind, type CommerceExecutionStatus, type CommerceFactConfidence, type CommerceFactProvenanceInput, type CommerceFactSource, type CommerceFulfillmentInput, type CommerceLineItemInput, type CommerceProposalFactKey, type CommerceProposalMissingFact, type CommerceProposalResolution, type CommerceProposalState, type CommerceSettlementRail, type CommerceTotalInput, type CommerceTotalType, type ComparePolicyVersionsResponse, type ConnectedCardBrief, type ConnectedCardCredential, type ConnectedCardDrawInput, type ConnectedCardDrawMerchant, type ConnectedCardDrawResult, type ConnectedCardDrawable, type ConnectedCardListResult, type ConnectedCardMandate, type ConnectedCardMandateMerchant, type ConnectedCardReference, ConnectedCardsClient, Conto, ContoAdmin, type ContoAdminConfig, ContoAdminError, type ContoConfig, ContoError, type ContoRequestOptions, type ControlledExternalCardPaymentResult, ControlledExternalCardPaymentTool, type CreateAgentInput, type CreatePolicyInput, type CreatePolicyRuleInput, type CreateSdkKeyInput, type CreateSdkKeyResult, type CreateWalletInput, type CustodyType, type CustomerCustodyMode, type CustomerWalletControlModel, type CustomerWalletKeyAccess, type DelegationType, type ExecuteCommerceExecutionResult, type ExternalCard, type ExternalCardApprovalInput, type ExternalCardApprovalResult, type ExternalCardConfirmationInput, ExternalCardConfirmationPendingError, type ExternalCardConfirmationResult, type ExternalCardExecutionClaimResult, type ExternalCardExecutionResult, type ExternalCardExecutor, type ExternalCardOverlayEnforcement, type ExternalCardRequestStatusResult, type ExternalWalletApprovalInput, type ExternalWalletApprovalResult, type ExternalWalletConfirmationInput, type ExternalWalletConfirmationResult, type FreezeAgentInput, Conto as Giro, type ContoConfig as GiroConfig, ContoError as GiroError, type GuardCheckoutResult, type GuardedBrowserDispatchResult, type GuardedCheckoutInput, type LinkWalletInput, type ListAgentsParams, type ListAgentsResponse, type ListPoliciesParams, type ListPoliciesResponse, type ListPolicyVersionsResponse, type ListStripeLinkPaymentMethodsResult, type ListWalletsParams, type ListWalletsResponse, type MppBudgetResult, type MppPreAuthorizeInput, type MppPreAuthorizeResult, type MppRecordInput, type MppRecordResult, type NormalizeCommerceProposalInput, type OrganizationMember, type PaginatedResponse, type PaginationParams, type PauseExternalCardAssignmentResult, type PaymentExecuteResult, type PaymentRequestInput, type PaymentRequestResult, type PaymentStatusResult, type Policy, type PolicyRule, type PolicyType, type PolicyVersionChangeType, type PolicyVersionDetail, type PolicyVersionDiff, type PolicyVersionFieldChange, type PolicyVersionSnapshot, type PolicyVersionSnapshotRule, type PolicyVersionSummary, type PrivilegedBrowserCheckoutDriver, type ProtocolBudgetResult, type ProtocolPreAuthorizeResult, type ProtocolServiceSummary, type ProtocolServicesResult, type ProvisionWalletResult, type RefreshBalanceResult, type RegisterExternalCardInput, type RollbackPolicyVersionResponse, type RuleAction, type RuleOperator, type RuleType, type RunGuardedCheckoutResult, type SdkKey, type SdkKeyType, type StripeLinkCheckoutReadiness, type StripeLinkCheckoutReadinessResult, type StripeLinkCheckoutReadinessStatus, type StripeLinkCheckoutVerification, type StripeLinkPaymentMethod, type UnfreezeAgentInput, type UpdateAgentInput, type UpdateExternalCardAssignmentInput, type UpdatePolicyInput, type UpdatePolicyRuleInput, type UpdateWalletInput, type VerifiedBrowserCheckoutTarget, type Wallet, type WalletChainBalanceSnapshot, type WalletStatus, type WalletType, type X402BudgetResult, type X402PreAuthorizeInput, type X402PreAuthorizeResult, type X402RecordInput, type X402RecordResult, canonicalizeBrowserCheckoutTarget, createVerifiedBrowserCheckoutDriver, Conto as default, fingerprintBrowserCheckoutTarget };