@conto_finance/sdk 0.5.1 → 0.5.3

package/README.md

@@ -2,7 +2,7 @@
 
 Conto is a buyer-side control layer. Integrate it in the agent owner's runtime or payment tools;
 the owner or budget holder sets policy before the agent pays.
-See [buyer-side control](https://conto.finance/docs/guides/buyer-side-control) for the authorization
+See [buyer-side control](https://conto.finance/docs/introduction/concepts) for the authorization
 and execution boundary.
 
 TypeScript SDK for Conto. Use it when you control the agent runtime and want typed access to
@@ -99,9 +99,9 @@ await admin.cards.resumeForAgent('agent_id', card.id);
 await admin.cards.revokeFromAgent('agent_id', card.id);
 ```
 
-The policy overlay stops at approval, claiming, and reconciliation. For a
-customer-hosted payment tool that gates access to customer payment code, see
-[Card Access](https://conto.finance/docs/card-access/overview), available on request.
+The policy overlay stops at approval, claiming, and reconciliation. For
+connected cards, see
+[Connected cards](https://conto.finance/docs/guides/connected-cards).
 The legacy `conto.cards.controlled()` helper remains available for compatibility. Use
 `admin.cards.listRequests({ status: 'EXECUTING' })` for reconciliation and
 `admin.cards.pause(card.id)` to revoke unclaimed grants and stop new approvals
@@ -251,7 +251,7 @@ requirements.
 For browser checkouts on supported rails (Link, card, Shop Pay, or PayPal), use
 `runGuardedCheckout` with `executionMethod: 'BROWSER_CHECKOUT'`. Other rails and checkout flows are
 not covered. It binds and atomically authorizes one exact Link, card,
-Shop Pay, or PayPal browser action without requiring merchant or private provider integration. The
+Shop Pay, or PayPal browser action without requiring private provider integration. The
 privileged browser executor must be available only through this wrapper; an unrestricted click or
 payment tool would bypass the control. Persist its stable dispatch attempt before calling the helper; it owns authorization,
 one-use claim, the privileged callback, and finalization. See `docs/AGENT_CHECKOUT_GUARD.md` for the

package/dist/index.d.mts

@@ -1872,8 +1872,7 @@ interface ProtocolPreAuthorizeResult {
     /**
      * Present when authorized. Pass grantId and grantSignature to record(). A
      * record without a valid, unexpired grant is accepted but treated as a policy
-     * bypass: the payment is flagged and the owner is alerted. The organization
-     * can also have the agent frozen automatically.
+     * bypass: the payment is flagged and the owner is alerted.
      */
     grantId?: string;
     grantSignature?: string;
@@ -2048,6 +2047,11 @@ interface MppRecordInput extends ProtocolRecordGrant {
         resourceUrl: string;
         credentialId: string;
     }>;
+    /**
+     * Send true on the final record of a session (`intent: 'session'`). Conto
+     * closes the session and releases the unused part of its grant.
+     */
+    closeSession?: boolean;
 }
 interface MppRecordResult extends ProtocolRecordGrantResult {
     recorded: true;
@@ -2279,7 +2283,7 @@ declare class ControlledExternalCardPaymentTool<TReceipt = unknown> {
     pay(input: ExternalCardApprovalInput): Promise<ControlledExternalCardPaymentResult<TReceipt>>;
 }
 /**
- * Agent client for connected cards (gated pilot).
+ * Agent client for connected cards (Builder and Enterprise plans).
  *
  * A connected card is a customer card enrolled through the provider and
  * delegated to this agent. `draw` mints one single-use credential against a
@@ -2287,7 +2291,7 @@ declare class ControlledExternalCardPaymentTool<TReceipt = unknown> {
  * draw against. This is a separate rail from {@link CardsClient}: it does not
  * share endpoints, scopes, or types with the external-card policy overlay.
  *
- * These methods return 404 until the tenant is enabled for the pilot.
+ * On plans without connected cards, these methods return an upgrade error.
  */
 declare class ConnectedCardsClient {
     private client;

package/dist/index.d.ts

@@ -1872,8 +1872,7 @@ interface ProtocolPreAuthorizeResult {
     /**
      * Present when authorized. Pass grantId and grantSignature to record(). A
      * record without a valid, unexpired grant is accepted but treated as a policy
-     * bypass: the payment is flagged and the owner is alerted. The organization
-     * can also have the agent frozen automatically.
+     * bypass: the payment is flagged and the owner is alerted.
      */
     grantId?: string;
     grantSignature?: string;
@@ -2048,6 +2047,11 @@ interface MppRecordInput extends ProtocolRecordGrant {
         resourceUrl: string;
         credentialId: string;
     }>;
+    /**
+     * Send true on the final record of a session (`intent: 'session'`). Conto
+     * closes the session and releases the unused part of its grant.
+     */
+    closeSession?: boolean;
 }
 interface MppRecordResult extends ProtocolRecordGrantResult {
     recorded: true;
@@ -2279,7 +2283,7 @@ declare class ControlledExternalCardPaymentTool<TReceipt = unknown> {
     pay(input: ExternalCardApprovalInput): Promise<ControlledExternalCardPaymentResult<TReceipt>>;
 }
 /**
- * Agent client for connected cards (gated pilot).
+ * Agent client for connected cards (Builder and Enterprise plans).
  *
  * A connected card is a customer card enrolled through the provider and
  * delegated to this agent. `draw` mints one single-use credential against a
@@ -2287,7 +2291,7 @@ declare class ControlledExternalCardPaymentTool<TReceipt = unknown> {
  * draw against. This is a separate rail from {@link CardsClient}: it does not
  * share endpoints, scopes, or types with the external-card policy overlay.
  *
- * These methods return 404 until the tenant is enabled for the pilot.
+ * On plans without connected cards, these methods return an upgrade error.
  */
 declare class ConnectedCardsClient {
     private client;

package/dist/index.js

@@ -39,7 +39,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@conto_finance/sdk",
-      version: "0.5.1",
+      version: "0.5.3",
       description: "Conto SDK for AI agent payment authorization",
       main: "./dist/index.js",
       module: "./dist/index.mjs",
@@ -175,7 +175,15 @@ var PUBLIC_PAYMENT_REASONS = /* @__PURE__ */ new Set([
   "This payment requires approval before it can proceed.",
   "No usable wallet is linked to this agent.",
   "This payee needs review before payments to it can proceed automatically.",
-  "A reviewer declined this payment."
+  "A reviewer declined this payment.",
+  "This payment is missing a category, which a payment control requires.",
+  "This payment is missing the recipient country, which a payment control requires.",
+  "This payment is missing the target contract address, which a payment control requires.",
+  "This payment is missing the service URL, which a payment control requires.",
+  "This payment is missing a session ID, which a payment control requires.",
+  "This payment is missing the x402 facilitator, which a payment control requires.",
+  "This payment is missing the MPP intent, which a payment control requires.",
+  "This payment is missing the MPP payment method, which a payment control requires."
 ]);
 function customerPaymentReasons(value) {
   return Array.isArray(value) ? [

package/dist/index.mjs

@@ -14,7 +14,7 @@ var require_package = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@conto_finance/sdk",
-      version: "0.5.1",
+      version: "0.5.3",
       description: "Conto SDK for AI agent payment authorization",
       main: "./dist/index.js",
       module: "./dist/index.mjs",
@@ -131,7 +131,15 @@ var PUBLIC_PAYMENT_REASONS = /* @__PURE__ */ new Set([
   "This payment requires approval before it can proceed.",
   "No usable wallet is linked to this agent.",
   "This payee needs review before payments to it can proceed automatically.",
-  "A reviewer declined this payment."
+  "A reviewer declined this payment.",
+  "This payment is missing a category, which a payment control requires.",
+  "This payment is missing the recipient country, which a payment control requires.",
+  "This payment is missing the target contract address, which a payment control requires.",
+  "This payment is missing the service URL, which a payment control requires.",
+  "This payment is missing a session ID, which a payment control requires.",
+  "This payment is missing the x402 facilitator, which a payment control requires.",
+  "This payment is missing the MPP intent, which a payment control requires.",
+  "This payment is missing the MPP payment method, which a payment control requires."
 ]);
 function customerPaymentReasons(value) {
   return Array.isArray(value) ? [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@conto_finance/sdk",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "Conto SDK for AI agent payment authorization",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",