@conto_finance/sdk 0.5.5 → 0.6.0-beta.2

package/dist/index.js

@@ -46,7 +46,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@conto_finance/sdk",
-      version: "0.5.5",
+      version: "0.6.0-beta.2",
       description: "Conto SDK for AI agent payment authorization",
       main: "./dist/index.js",
       module: "./dist/index.mjs",
@@ -71,10 +71,16 @@ var require_package = __commonJS({
           types: "./dist/checkout-verifier.d.ts",
           import: "./dist/checkout-verifier.mjs",
           require: "./dist/checkout-verifier.js"
+        },
+        "./link-testing": {
+          types: "./dist/link-testing.d.ts",
+          import: "./dist/link-testing.mjs",
+          require: "./dist/link-testing.js"
         }
       },
       publishConfig: {
-        access: "public"
+        access: "public",
+        tag: "beta"
       },
       engines: {
         node: ">=20.19.0"
@@ -83,11 +89,11 @@ var require_package = __commonJS({
         "dist"
       ],
       scripts: {
-        build: "tsup src/index.ts src/playwright.ts src/browserbase.ts src/checkout-verifier.ts --format cjs,esm --dts",
-        dev: "tsup src/index.ts src/playwright.ts src/browserbase.ts src/checkout-verifier.ts --format cjs,esm --dts --watch",
+        build: "tsup",
+        dev: "tsup --watch",
         lint: "tsc --noEmit",
         test: "npm run lint && npm run test:contract && npm run test:consumer",
-        "test:contract": "npm run build && node --test test/contract.test.mjs test/playwright.test.mjs test/browserbase.test.mjs test/checkout-verifier.test.mjs test/developer-experience.test.mjs",
+        "test:contract": "npm run build && node --test test/contract.test.mjs test/playwright.test.mjs test/browserbase.test.mjs test/checkout-verifier.test.mjs test/developer-experience.test.mjs test/link.test.mjs test/link-testing.test.mjs test/checkout.test.mjs",
         "test:consumer": "npm run build && node --test test/consumer.test.mjs",
         "verify:release": "node scripts/verify-release.mjs",
         prepublishOnly: "npm run verify:release && npm run lint && npm run test:contract && npm run test:consumer"
@@ -153,6 +159,7 @@ __export(index_exports, {
   BrowserActionFinalizationPendingError: () => BrowserActionFinalizationPendingError,
   BrowserCheckoutTargetVerificationError: () => BrowserCheckoutTargetVerificationError,
   CardsClient: () => CardsClient,
+  CheckoutClient: () => CheckoutClient,
   ConnectedCardsClient: () => ConnectedCardsClient,
   Conto: () => Conto,
   ContoAdmin: () => ContoAdmin,
@@ -161,6 +168,8 @@ __export(index_exports, {
   ControlledExternalCardPaymentTool: () => ControlledExternalCardPaymentTool,
   ExternalCardConfirmationPendingError: () => ExternalCardConfirmationPendingError,
   Giro: () => Conto,
+  LinkClient: () => LinkClient,
+  LinkPaymentExecutionError: () => LinkPaymentExecutionError,
   TestCardsClient: () => TestCardsClient,
   canonicalizeBrowserCheckoutTarget: () => canonicalizeBrowserCheckoutTarget,
   createVerifiedBrowserCheckoutDriver: () => createVerifiedBrowserCheckoutDriver,
@@ -688,8 +697,11 @@ var AdminCardsClient = class {
     return this.client.request("GET", `/api/external-cards/requests${suffix ? `?${suffix}` : ""}`);
   }
   /**
-   * Resolve a claimed execution after checking the customer's processor or
-   * receipt. Resolving NOT_EXECUTED releases the reserved policy amount.
+   * @deprecated Resolution requires a signed-in user. SDK admin keys and
+   * organization API keys receive HTTP 403 INSUFFICIENT_PERMISSIONS from this
+   * endpoint. Have a signed-in organization owner or admin review the processor
+   * evidence and resolve the request through Conto's authenticated interface.
+   * Retained for source compatibility; this method does not bypass that restriction.
    */
   async resolveRequest(requestId, input) {
     return this.client.request(
@@ -1053,7 +1065,7 @@ function isValidBrowserActionObservation(value) {
   }
 }
 var ContoError = class extends Error {
-  constructor(message, metadata) {
+  constructor(message, metadata, diagnostics) {
     super(message);
     this.name = "ContoError";
     this.code = metadata.code;
@@ -1064,6 +1076,30 @@ var ContoError = class extends Error {
     this.actionUrl = metadata.actionUrl;
     this.fieldErrors = metadata.fieldErrors;
     this.reasons = metadata.reasons;
+    if (diagnostics !== null && typeof diagnostics === "object" && !Array.isArray(diagnostics) && "version" in diagnostics && diagnostics.version === "conto.setup-diagnostics.v1") {
+      this.diagnostics = diagnostics;
+    }
+  }
+};
+var LinkPaymentExecutionError = class extends ContoError {
+  constructor(executionId, error) {
+    const original = error instanceof ContoError ? error : void 0;
+    super(
+      original?.message ?? "Link execution could not be confirmed",
+      {
+        code: original?.code ?? "LINK_EXECUTION_UNCONFIRMED",
+        status: original?.status ?? 0,
+        requestId: original?.requestId,
+        retryAfter: original?.retryAfter,
+        fieldErrors: original?.fieldErrors,
+        reasons: original?.reasons,
+        retryGuidance: "Call link.status(executionId) to reconcile. Do not create another purchase or retry execution blindly."
+      },
+      original?.diagnostics
+    );
+    this.nextAction = "RECONCILE";
+    this.name = "LinkPaymentExecutionError";
+    this.executionId = executionId;
   }
 };
 var ExternalCardConfirmationPendingError = class extends ContoError {
@@ -1155,6 +1191,8 @@ var Conto = class {
     this.baseUrl = (config.baseUrl || "https://conto.finance").replace(/\/$/, "");
     assertSecureBaseUrl(this.baseUrl);
     this.timeout = config.timeout || 3e4;
+    this.link = new LinkClient(this, config.link);
+    this.checkout = new CheckoutClient(this);
     this.payments = new PaymentsClient(this);
     this.cards = new CardsClient(this);
     this.connectedCards = new ConnectedCardsClient(this);
@@ -1167,10 +1205,24 @@ var Conto = class {
    * explicitly bound to this agent. No Link token or payment artifact is
    * returned through the agent SDK.
    */
-  async listStripeLinkPaymentMethods(connectionId) {
+  async listStripeLinkPaymentMethods(connectionId, options) {
     return this.request(
       "GET",
-      withQuery("/api/sdk/stripe-link/payment-methods", { connectionId })
+      withQuery("/api/sdk/stripe-link/payment-methods", {
+        connectionId,
+        ...options?.mode ? { mode: options.mode } : {}
+      })
+    );
+  }
+  /** Read live Link configuration diagnostics without retrieving credentials or authorizing payment. */
+  async getLinkSetup(input = {}) {
+    return this.request(
+      "GET",
+      withQuery("/api/sdk/stripe-link/setup", {
+        connectionId: input.connectionId,
+        paymentMethodId: input.paymentMethodId,
+        merchantId: input.merchantId
+      })
     );
   }
   /**
@@ -1466,7 +1518,8 @@ var Conto = class {
       if (!response.ok) {
         throw new ContoError(
           responseErrorMessage(data, response.status),
-          responseErrorMetadata(response, data)
+          responseErrorMetadata(response, data),
+          data !== null && typeof data === "object" && "diagnostics" in data ? data.diagnostics : void 0
         );
       }
       return data;
@@ -2099,11 +2152,312 @@ var MppClient = class {
   }
 };
 var index_default = Conto;
+function checkoutError(message, code = "INVALID_CHECKOUT_CHECKPOINT") {
+  return new ContoError(message, { code, status: 0 });
+}
+function checkpointCart(amountMinor, lineItems, totals) {
+  if (!Number.isSafeInteger(amountMinor) || amountMinor <= 0) {
+    throw checkoutError("amountMinor must be a positive integer number of cents");
+  }
+  if (!Array.isArray(lineItems) || lineItems.length === 0) {
+    throw checkoutError("Supply at least one line item");
+  }
+  return {
+    lineItems,
+    totals: totals ?? [{ type: "total", label: "Total", amountMinor }]
+  };
+}
+var _client;
+var CheckoutClient = class {
+  constructor(client) {
+    __privateAdd(this, _client);
+    __privateSet(this, _client, client);
+  }
+  /** First checkpoint. A ContoError means Conto did not approve: stop the checkout. */
+  async begin(input) {
+    const idempotencyKey = input.idempotencyKey?.trim();
+    if (!idempotencyKey || idempotencyKey.length < 8 || idempotencyKey.length > 255) {
+      throw checkoutError(
+        "idempotencyKey must contain 8 to 255 characters",
+        "INVALID_IDEMPOTENCY_KEY"
+      );
+    }
+    if (input.currency !== void 0 && input.currency !== "USD") {
+      throw checkoutError("Only USD checkouts are supported");
+    }
+    const result = await __privateGet(this, _client).request(
+      "POST",
+      "/api/sdk/checkout-checkpoints",
+      {
+        idempotencyKey,
+        merchant: input.merchant,
+        amountMinor: input.amountMinor,
+        currency: "USD",
+        purpose: input.purpose,
+        ...input.category ? { category: input.category } : {},
+        ...input.checkoutMethod ? { checkoutMethod: input.checkoutMethod } : {},
+        cart: checkpointCart(input.amountMinor, input.lineItems, input.totals)
+      },
+      { idempotent: true }
+    );
+    return result.checkpoint;
+  }
+  /**
+   * Second checkpoint, right before the payment is submitted. If the total
+   * changed since begin() (tax or shipping, for example), this cancels the
+   * approved checkpoint and starts a new one at the final total, so the agent's
+   * rules see the amount actually being paid. Pay only if this resolves.
+   */
+  async confirm(checkpoint, input) {
+    if (input.currency !== void 0 && input.currency !== "USD") {
+      throw checkoutError("Only USD checkouts are supported");
+    }
+    if (!Number.isSafeInteger(input.amountMinor) || input.amountMinor <= 0) {
+      throw checkoutError("amountMinor must be a positive integer number of cents");
+    }
+    let current = checkpoint;
+    if (input.amountMinor !== checkpoint.amountMinor) {
+      try {
+        await this.cancel(checkpoint.id);
+      } catch (error) {
+        const closed = error instanceof ContoError && error.status === 409 && ["CANCELLED", "EXPIRED", "DENIED"].includes((await this.get(checkpoint.id)).stage);
+        if (!closed) throw error;
+      }
+      current = await this.begin({
+        idempotencyKey: `${checkpoint.idempotencyKey.slice(0, 200)}:final-${input.amountMinor}`,
+        merchant: {
+          id: checkpoint.merchant.id,
+          name: checkpoint.merchant.name,
+          checkoutUrl: checkpoint.merchant.checkoutUrl ?? ""
+        },
+        amountMinor: input.amountMinor,
+        purpose: checkpoint.purpose,
+        ...checkpoint.category ? { category: checkpoint.category } : {},
+        checkoutMethod: checkpoint.checkoutMethod,
+        lineItems: input.lineItems ?? checkpoint.cart.lineItems,
+        totals: input.totals
+      });
+    }
+    const result = await __privateGet(this, _client).request(
+      "POST",
+      `/api/sdk/checkout-checkpoints/${encodeURIComponent(current.id)}/confirm`,
+      {
+        amountMinor: input.amountMinor,
+        currency: "USD",
+        ...input.pageUrl ? { pageUrl: input.pageUrl } : {}
+      },
+      { idempotent: true }
+    );
+    return result.checkpoint;
+  }
+  /** Report what happened after a confirmed checkpoint. Safe to repeat with the same outcome. */
+  async reportOutcome(checkpointId, input) {
+    const result = await __privateGet(this, _client).request(
+      "POST",
+      `/api/sdk/checkout-checkpoints/${encodeURIComponent(checkpointId)}/outcome`,
+      {
+        outcome: input.outcome,
+        ...input.reference ? { reference: input.reference } : {}
+      },
+      { idempotent: true }
+    );
+    return result.checkpoint;
+  }
+  /** Cancel a checkpoint that was not confirmed and release its spend. */
+  async cancel(checkpointId) {
+    const result = await __privateGet(this, _client).request(
+      "POST",
+      `/api/sdk/checkout-checkpoints/${encodeURIComponent(checkpointId)}/cancel`,
+      {},
+      { idempotent: true }
+    );
+    return result.checkpoint;
+  }
+  async get(checkpointId) {
+    const result = await __privateGet(this, _client).request(
+      "GET",
+      `/api/sdk/checkout-checkpoints/${encodeURIComponent(checkpointId)}`
+    );
+    return result.checkpoint;
+  }
+};
+_client = new WeakMap();
+var _client2, _defaults;
+var LinkClient = class {
+  constructor(client, defaults) {
+    __privateAdd(this, _client2);
+    __privateAdd(this, _defaults);
+    __privateSet(this, _client2, client);
+    __privateSet(this, _defaults, defaults ? { ...defaults } : void 0);
+  }
+  /** Inspect the configured live path. This is not a payment authorization or provider connectivity test. */
+  async setup(input = {}) {
+    return __privateGet(this, _client2).getLinkSetup({
+      connectionId: input.connectionId ?? __privateGet(this, _defaults)?.connectionId,
+      paymentMethodId: input.paymentMethodId ?? __privateGet(this, _defaults)?.paymentMethodId,
+      merchantId: input.merchantId
+    });
+  }
+  /** Read masked LIVE funding sources; never selects a source or initiates payment. */
+  async paymentMethods(connectionId) {
+    return __privateGet(this, _client2).listStripeLinkPaymentMethods(
+      this.identifier(connectionId ?? __privateGet(this, _defaults)?.connectionId, "connectionId"),
+      { mode: "LIVE" }
+    );
+  }
+  /**
+   * Begin one exact intent and execute only if already READY. Otherwise return
+   * the owner's approval action or existing state immediately, without polling.
+   */
+  async pay(input) {
+    const connectionId = this.identifier(
+      input.connectionId ?? __privateGet(this, _defaults)?.connectionId,
+      "connectionId"
+    );
+    const paymentMethodId = this.identifier(
+      input.paymentMethodId ?? __privateGet(this, _defaults)?.paymentMethodId,
+      "paymentMethodId"
+    );
+    if (!Number.isSafeInteger(input.amountMinor) || input.amountMinor <= 0 || input.currency !== void 0 && input.currency !== "USD" || !Array.isArray(input.lineItems) || input.lineItems.length === 0 || typeof input.purpose !== "string" || !input.purpose.trim()) {
+      throw new ContoError("Supply a positive USD amount in cents, purpose, and line items", {
+        code: "INVALID_LINK_PURCHASE",
+        status: 0
+      });
+    }
+    const itemTotal = input.lineItems.reduce((sum, item) => {
+      if (!item || typeof item.name !== "string" || !item.name.trim() || !Number.isSafeInteger(item.quantity) || item.quantity <= 0 || !Number.isSafeInteger(item.unitAmountMinor) || item.unitAmountMinor < 0) {
+        throw new ContoError(
+          "Each line item needs a name, positive integer quantity, and price in cents",
+          {
+            code: "INVALID_LINK_PURCHASE",
+            status: 0
+          }
+        );
+      }
+      return sum + item.quantity * item.unitAmountMinor;
+    }, 0);
+    if (!input.totals && (!Number.isSafeInteger(itemTotal) || itemTotal !== input.amountMinor)) {
+      throw new ContoError(
+        "Supply the exact totals breakdown when the amount differs from the line items",
+        {
+          code: "LINK_TOTALS_REQUIRED",
+          status: 0
+        }
+      );
+    }
+    const result = await __privateGet(this, _client2).beginCommerceExecution({
+      executionMethod: "LINK_PAY_TOKEN",
+      connectionId,
+      paymentMethodId,
+      idempotencyKey: input.idempotencyKey,
+      amountMinor: input.amountMinor,
+      currency: input.currency ?? "USD",
+      purpose: input.purpose,
+      category: input.category,
+      counterparty: { canonicalId: input.merchantId, checkoutUrl: input.checkoutUrl },
+      cart: {
+        lineItems: input.lineItems,
+        totals: input.totals ?? [{ type: "total", label: "Total", amountMinor: input.amountMinor }]
+      },
+      providerPresentation: {
+        approvalSummary: input.purpose.trim().slice(0, 500),
+        lineItemLabels: input.lineItems.map((item) => item.name.trim().slice(0, 120))
+      }
+    });
+    return this.executeIfReady(result);
+  }
+  /**
+   * Continue the existing payment after approval. Reads before any mutation and
+   * never submits an execution already processing or requiring reconciliation.
+   */
+  async resume(executionId) {
+    const id = this.identifier(executionId, "executionId");
+    const current = await __privateGet(this, _client2).getCommerceExecution(id);
+    this.assertLinkExecution(current);
+    if (["AUTHORIZING", "AWAITING_APPROVAL", "ACTION_REQUIRED"].includes(current.execution.status)) {
+      return this.executeIfReady(await __privateGet(this, _client2).refreshCommerceExecution(id));
+    }
+    return this.executeIfReady(current);
+  }
+  /** Observe and reconcile provider state. This method never submits a payment. */
+  async status(executionId) {
+    const id = this.identifier(executionId, "executionId");
+    this.assertLinkExecution(await __privateGet(this, _client2).getCommerceExecution(id));
+    return this.result(await __privateGet(this, _client2).refreshCommerceExecution(id));
+  }
+  /** Request cancellation of this existing Link payment; never retried automatically. */
+  async cancel(executionId) {
+    const id = this.identifier(executionId, "executionId");
+    this.assertLinkExecution(await __privateGet(this, _client2).getCommerceExecution(id));
+    try {
+      return this.result(await __privateGet(this, _client2).cancelCommerceExecution(id));
+    } catch (error) {
+      throw new LinkPaymentExecutionError(id, error);
+    }
+  }
+  identifier(value, field) {
+    if (typeof value !== "string" || !value.trim() || value.length > 255) {
+      throw new ContoError(
+        field === "executionId" ? "executionId is required; use the existing ID returned by link.pay()" : `${field} is required; configure the owner-provisioned Link IDs or supply them explicitly`,
+        {
+          code: "LINK_CONFIGURATION_REQUIRED",
+          status: 0
+        }
+      );
+    }
+    return value.trim();
+  }
+  assertLinkExecution(result) {
+    const execution = result.execution;
+    if (execution?.provider !== "STRIPE_LINK" || execution.executionAdapter !== "STRIPE_LINK" || execution.executionChannel !== "BROWSER" || execution.artifactKind !== void 0 && execution.artifactKind !== "LINK_PAY_TOKEN" || execution.deliveryMode !== void 0 && execution.deliveryMode !== "SERVER_ONLY_ARTIFACT") {
+      throw new ContoError("This execution is not a Link Pay Token checkout", {
+        code: "LINK_EXECUTION_MISMATCH",
+        status: 0
+      });
+    }
+  }
+  async executeIfReady(result) {
+    this.assertLinkExecution(result);
+    if (result.execution.status !== "READY") return this.result(result);
+    try {
+      return this.result(await __privateGet(this, _client2).executeCommerceExecution(result.execution.id));
+    } catch (error) {
+      throw new LinkPaymentExecutionError(result.execution.id, error);
+    }
+  }
+  result(result) {
+    this.assertLinkExecution(result);
+    const { execution } = result;
+    const awaitingApproval = ["AUTHORIZING", "AWAITING_APPROVAL", "ACTION_REQUIRED"].includes(
+      execution.status
+    );
+    const nextAction = execution.status === "READY" ? "RESUME" : execution.status === "NEEDS_RECONCILIATION" ? "RECONCILE" : awaitingApproval && execution.approvalUrl ? "APPROVE_IN_LINK" : awaitingApproval || ["DRAFT", "PROCESSING"].includes(execution.status) ? "WAIT" : [
+      "SETTLED",
+      "COMPLETED",
+      "DENIED",
+      "CANCELLED",
+      "FAILED",
+      "RETURNED",
+      "EXPIRED"
+    ].includes(execution.status) ? "NONE" : "RECONCILE";
+    return {
+      executionId: execution.id,
+      status: execution.status,
+      nextAction,
+      ...nextAction === "APPROVE_IN_LINK" ? { approvalUrl: execution.approvalUrl } : {},
+      execution,
+      ..."checkout" in result ? { checkout: result.checkout } : {}
+    };
+  }
+};
+_client2 = new WeakMap();
+_defaults = new WeakMap();
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   BrowserActionFinalizationPendingError,
   BrowserCheckoutTargetVerificationError,
   CardsClient,
+  CheckoutClient,
   ConnectedCardsClient,
   Conto,
   ContoAdmin,
@@ -2112,6 +2466,8 @@ var index_default = Conto;
   ControlledExternalCardPaymentTool,
   ExternalCardConfirmationPendingError,
   Giro,
+  LinkClient,
+  LinkPaymentExecutionError,
   TestCardsClient,
   canonicalizeBrowserCheckoutTarget,
   createVerifiedBrowserCheckoutDriver,