@conto_finance/sdk 0.6.0-beta.2 → 0.6.1

package/dist/index.js

@@ -46,7 +46,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@conto_finance/sdk",
-      version: "0.6.0-beta.2",
+      version: "0.6.1",
       description: "Conto SDK for AI agent payment authorization",
       main: "./dist/index.js",
       module: "./dist/index.mjs",
@@ -71,16 +71,10 @@ var require_package = __commonJS({
           types: "./dist/checkout-verifier.d.ts",
           import: "./dist/checkout-verifier.mjs",
           require: "./dist/checkout-verifier.js"
-        },
-        "./link-testing": {
-          types: "./dist/link-testing.d.ts",
-          import: "./dist/link-testing.mjs",
-          require: "./dist/link-testing.js"
         }
       },
       publishConfig: {
-        access: "public",
-        tag: "beta"
+        access: "public"
       },
       engines: {
         node: ">=20.19.0"
@@ -93,7 +87,7 @@ var require_package = __commonJS({
         dev: "tsup --watch",
         lint: "tsc --noEmit",
         test: "npm run lint && npm run test:contract && npm run test:consumer",
-        "test:contract": "npm run build && node --test test/contract.test.mjs test/playwright.test.mjs test/browserbase.test.mjs test/checkout-verifier.test.mjs test/developer-experience.test.mjs test/link.test.mjs test/link-testing.test.mjs test/checkout.test.mjs",
+        "test:contract": "npm run build && node --test test/contract.test.mjs test/playwright.test.mjs test/browserbase.test.mjs test/checkout-verifier.test.mjs test/developer-experience.test.mjs test/checkout.test.mjs test/purchases.test.mjs",
         "test:consumer": "npm run build && node --test test/consumer.test.mjs",
         "verify:release": "node scripts/verify-release.mjs",
         prepublishOnly: "npm run verify:release && npm run lint && npm run test:contract && npm run test:consumer"
@@ -156,9 +150,15 @@ var require_package_version = __commonJS({
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  AdminPurchasingClient: () => AdminPurchasingClient,
   BrowserActionFinalizationPendingError: () => BrowserActionFinalizationPendingError,
   BrowserCheckoutTargetVerificationError: () => BrowserCheckoutTargetVerificationError,
   CardsClient: () => CardsClient,
+  CheckoutApprovalDeniedError: () => CheckoutApprovalDeniedError,
+  CheckoutApprovalExpiredError: () => CheckoutApprovalExpiredError,
+  CheckoutApprovalPendingError: () => CheckoutApprovalPendingError,
+  CheckoutApprovalTimeoutError: () => CheckoutApprovalTimeoutError,
+  CheckoutCheckpointClosedError: () => CheckoutCheckpointClosedError,
   CheckoutClient: () => CheckoutClient,
   ConnectedCardsClient: () => ConnectedCardsClient,
   Conto: () => Conto,
@@ -168,19 +168,390 @@ __export(index_exports, {
   ControlledExternalCardPaymentTool: () => ControlledExternalCardPaymentTool,
   ExternalCardConfirmationPendingError: () => ExternalCardConfirmationPendingError,
   Giro: () => Conto,
-  LinkClient: () => LinkClient,
-  LinkPaymentExecutionError: () => LinkPaymentExecutionError,
+  OrganizationPurchasesClient: () => OrganizationPurchasesClient,
+  OrganizationRecurringPurchasesClient: () => OrganizationRecurringPurchasesClient,
+  PurchasesClient: () => PurchasesClient,
+  RecurringPurchasesClient: () => RecurringPurchasesClient,
   TestCardsClient: () => TestCardsClient,
   canonicalizeBrowserCheckoutTarget: () => canonicalizeBrowserCheckoutTarget,
   createVerifiedBrowserCheckoutDriver: () => createVerifiedBrowserCheckoutDriver,
   default: () => index_default,
-  fingerprintBrowserCheckoutTarget: () => fingerprintBrowserCheckoutTarget
+  fingerprintBrowserCheckoutTarget: () => fingerprintBrowserCheckoutTarget,
+  isFinalPurchaseStatus: () => isFinalPurchaseStatus,
+  parseServerSentEvents: () => parseServerSentEvents,
+  verifyPurchaseWebhook: () => verifyPurchaseWebhook
 });
 module.exports = __toCommonJS(index_exports);
 var Sentry2 = __toESM(require("@sentry/node"));
-var import_node_crypto2 = require("crypto");
+var import_node_crypto3 = require("crypto");
 var import_package_version2 = __toESM(require_package_version());
 
+// src/purchases.ts
+var import_node_crypto = require("crypto");
+var TERMINAL = /* @__PURE__ */ new Set(["succeeded", "blocked", "failed", "cancelled"]);
+var isFinalPurchaseStatus = (status) => TERMINAL.has(status);
+async function* parseServerSentEvents(body) {
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  let frame = { data: [] };
+  try {
+    while (true) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      buffer += decoder.decode(value, { stream: true });
+      let newline;
+      while ((newline = buffer.search(/\r?\n/)) >= 0) {
+        const line = buffer.slice(0, newline);
+        buffer = buffer.slice(newline + (buffer[newline] === "\r" ? 2 : 1));
+        if (line === "") {
+          if (frame.data.length || frame.event)
+            yield { id: frame.id, event: frame.event ?? "message", data: frame.data.join("\n") };
+          frame = { data: [] };
+          continue;
+        }
+        if (line.startsWith(":")) continue;
+        const colon = line.indexOf(":");
+        const field = colon < 0 ? line : line.slice(0, colon);
+        const raw = colon < 0 ? "" : line.slice(colon + 1).replace(/^ /, "");
+        if (field === "id") frame.id = raw;
+        else if (field === "event") frame.event = raw;
+        else if (field === "data") frame.data.push(raw);
+      }
+    }
+  } finally {
+    reader.releaseLock();
+  }
+}
+var sleep = (ms, signal) => new Promise((resolve) => {
+  const timer = setTimeout(resolve, ms);
+  signal?.addEventListener(
+    "abort",
+    () => {
+      clearTimeout(timer);
+      resolve();
+    },
+    { once: true }
+  );
+});
+function requirePurchaseId(id) {
+  if (!/^[a-z0-9]{8,64}$/i.test(id)) throw new TypeError("purchase id is not valid");
+  return encodeURIComponent(id);
+}
+function requireCycleKey(key) {
+  if (!/^[A-Za-z0-9._:-]{1,100}$/.test(key)) throw new TypeError("cycleKey is not valid");
+  return encodeURIComponent(key);
+}
+var _transport, _base;
+var RecurringPurchasesClient = class {
+  constructor(transport, basePath = "/api/sdk/recurring-purchases") {
+    __privateAdd(this, _transport);
+    __privateAdd(this, _base);
+    __privateSet(this, _transport, transport);
+    __privateSet(this, _base, basePath);
+  }
+  async list(buyerId) {
+    return __privateGet(this, _transport).request(
+      "GET",
+      buyerId ? `${__privateGet(this, _base)}?buyerId=${encodeURIComponent(buyerId)}` : __privateGet(this, _base)
+    );
+  }
+  async get(id) {
+    return __privateGet(this, _transport).request("GET", `${__privateGet(this, _base)}/${requirePurchaseId(id)}`);
+  }
+  /** Starts one order. The same cycle key returns the same order. */
+  async startCycle(id, cycleKey) {
+    requireCycleKey(cycleKey);
+    return __privateGet(this, _transport).request(
+      "POST",
+      `${__privateGet(this, _base)}/${requirePurchaseId(id)}/cycles`,
+      { cycleKey },
+      { idempotent: true }
+    );
+  }
+  /** Skips one order, also before it starts. */
+  async skipCycle(id, cycleKey) {
+    return __privateGet(this, _transport).request(
+      "POST",
+      `${__privateGet(this, _base)}/${requirePurchaseId(id)}/cycles/${requireCycleKey(cycleKey)}/skip`
+    );
+  }
+};
+_transport = new WeakMap();
+_base = new WeakMap();
+var _client;
+var OrganizationRecurringPurchasesClient = class extends RecurringPurchasesClient {
+  constructor(client) {
+    super(client, "/api/purchasing/recurring-purchases");
+    __privateAdd(this, _client);
+    __privateSet(this, _client, client);
+  }
+  /** Stops a repeat order. An order waiting for its payment time closes unpaid. */
+  async cancel(id) {
+    return __privateGet(this, _client).request(
+      "POST",
+      `/api/purchasing/recurring-purchases/${requirePurchaseId(id)}/cancel`
+    );
+  }
+};
+_client = new WeakMap();
+var _transport2, _base2;
+var PurchasesClient = class {
+  constructor(transport, basePath = "/api/sdk/purchases") {
+    __privateAdd(this, _transport2);
+    __privateAdd(this, _base2);
+    __privateSet(this, _transport2, transport);
+    __privateSet(this, _base2, basePath);
+  }
+  /**
+   * Starts a purchase and returns at once. Reusing the idempotency key with the
+   * same input returns the same purchase, so retrying after a lost response is safe.
+   */
+  async create(input, options) {
+    const idempotencyKey = options?.idempotencyKey?.trim();
+    if (!idempotencyKey || idempotencyKey.length < 8 || idempotencyKey.length > 255)
+      throw new TypeError("idempotencyKey must contain 8 to 255 characters");
+    if (!Number.isSafeInteger(input.maxCost?.amountMinor) || input.maxCost.amountMinor <= 0)
+      throw new TypeError("maxCost.amountMinor must be a positive integer");
+    return __privateGet(this, _transport2).request(
+      "POST",
+      __privateGet(this, _base2),
+      { ...input, idempotencyKey },
+      { idempotent: true }
+    );
+  }
+  async list(params = {}) {
+    const query = new URLSearchParams();
+    for (const [key, value] of Object.entries(params))
+      if (value !== void 0) query.set(key, String(value));
+    const suffix = query.toString();
+    return __privateGet(this, _transport2).request("GET", `${__privateGet(this, _base2)}${suffix ? `?${suffix}` : ""}`);
+  }
+  async get(id) {
+    return __privateGet(this, _transport2).request("GET", `${__privateGet(this, _base2)}/${requirePurchaseId(id)}`);
+  }
+  /**
+   * Answers an open action whose authority is `agent_or_buyer` with the fields
+   * it lists. The acknowledgment means recorded; the purchase shows the result.
+   * The same answer again returns the same acknowledgment.
+   */
+  async respond(id, input) {
+    return __privateGet(this, _transport2).request(
+      "POST",
+      `${__privateGet(this, _base2)}/${requirePurchaseId(id)}/responses`,
+      input,
+      { idempotent: true }
+    );
+  }
+  async events(id, params = {}) {
+    const query = new URLSearchParams({ after: String(params.after ?? 0) });
+    if (params.limit) query.set("limit", String(params.limit));
+    return __privateGet(this, _transport2).request("GET", `${__privateGet(this, _base2)}/${requirePurchaseId(id)}/events?${query}`);
+  }
+  /**
+   * Requests cancellation. Before payment the purchase stops. Once payment may
+   * have been submitted, `cancellationOutcome` is `too_late` and the purchase
+   * stays in reconciliation. Nothing is refunded by this call.
+   */
+  async cancel(id) {
+    return __privateGet(this, _transport2).request(
+      "POST",
+      `${__privateGet(this, _base2)}/${requirePurchaseId(id)}/cancel`,
+      void 0,
+      { idempotent: true }
+    );
+  }
+  /**
+   * Yields the purchase's events in version order until it reaches a final
+   * status. Streams with server-sent events and reconnects from the last
+   * version; falls back to polling where streaming is unavailable. A duplicate
+   * after a reconnect is dropped. A `purchase.resync` event carries the
+   * current purchase when the cursor could not be resumed.
+   */
+  async *watch(id, options = {}) {
+    const path = `${__privateGet(this, _base2)}/${requirePurchaseId(id)}`;
+    const mode = options.mode ?? "auto";
+    const interval = Math.max(500, options.pollIntervalMs ?? 2e3);
+    const deadline = options.maxWaitMs ? Date.now() + options.maxWaitMs : Infinity;
+    let cursor = Math.max(0, options.after ?? 0);
+    let streaming = mode !== "poll";
+    const emit = (event) => {
+      if (event.version <= cursor && event.type !== "purchase.resync") return null;
+      cursor = Math.max(cursor, event.version);
+      return event;
+    };
+    while (!options.signal?.aborted && Date.now() < deadline) {
+      if (streaming) {
+        try {
+          const response = await __privateGet(this, _transport2).openStream(
+            `${path}/events/stream?after=${cursor}`,
+            { signal: options.signal, lastEventId: String(cursor) }
+          );
+          if (!response.body) throw new Error("streaming unavailable");
+          for await (const frame of parseServerSentEvents(response.body)) {
+            if (frame.event === "end") return;
+            if (frame.event === "error") break;
+            if (frame.event === "resync") {
+              const purchase = JSON.parse(frame.data);
+              const event2 = {
+                id: `resync:${purchase.version}`,
+                purchaseId: purchase.id,
+                version: purchase.version,
+                type: "purchase.resync",
+                createdAt: purchase.updatedAt,
+                data: purchase
+              };
+              cursor = purchase.version;
+              yield event2;
+              if (isFinalPurchaseStatus(purchase.status)) return;
+              continue;
+            }
+            if (!frame.data) continue;
+            const event = emit(JSON.parse(frame.data));
+            if (!event) continue;
+            yield event;
+            if (isFinalPurchaseStatus(event.data.status)) return;
+          }
+          continue;
+        } catch (error) {
+          if (options.signal?.aborted) return;
+          if (isClientError(error)) throw error;
+          if (mode === "stream") {
+            await sleep(interval, options.signal);
+            continue;
+          }
+          streaming = false;
+        }
+      }
+      let page;
+      try {
+        page = await this.events(id, { after: cursor, limit: 100 });
+      } catch (error) {
+        if (codeOf(error) !== "CURSOR_INVALID") throw error;
+        const purchase = await this.get(id);
+        cursor = purchase.version;
+        yield {
+          id: `resync:${purchase.version}`,
+          purchaseId: purchase.id,
+          version: purchase.version,
+          type: "purchase.resync",
+          createdAt: purchase.updatedAt,
+          data: purchase
+        };
+        if (isFinalPurchaseStatus(purchase.status)) return;
+        continue;
+      }
+      for (const item of page.items) {
+        const event = emit(item);
+        if (!event) continue;
+        yield event;
+        if (isFinalPurchaseStatus(event.data.status)) return;
+      }
+      if (!page.hasMore) await sleep(interval, options.signal);
+    }
+  }
+};
+_transport2 = new WeakMap();
+_base2 = new WeakMap();
+var codeOf = (error) => error && typeof error === "object" && "code" in error ? String(error.code) : "";
+var isClientError = (error) => {
+  const status = error && typeof error === "object" && "status" in error ? Number(error.status) : 0;
+  return status >= 400 && status < 500 && status !== 408 && status !== 429;
+};
+var enc = encodeURIComponent;
+var _client2;
+var OrganizationPurchasesClient = class extends PurchasesClient {
+  constructor(client) {
+    super(client, "/api/purchasing/purchases");
+    __privateAdd(this, _client2);
+    __privateSet(this, _client2, client);
+  }
+  async list(params = {}) {
+    const query = new URLSearchParams();
+    for (const [key, value] of Object.entries(params))
+      if (value !== void 0) query.set(key, String(value));
+    const suffix = query.toString();
+    return __privateGet(this, _client2).request("GET", `/api/purchasing/purchases${suffix ? `?${suffix}` : ""}`);
+  }
+  /** A single-use link that opens the purchase's buyer actions on Conto's hosted page. */
+  createActionLink(id, input = {}) {
+    return __privateGet(this, _client2).request(
+      "POST",
+      `/api/purchasing/purchases/${requirePurchaseId(id)}/action-sessions`,
+      input
+    );
+  }
+};
+_client2 = new WeakMap();
+var _client3;
+var AdminPurchasingClient = class {
+  constructor(client) {
+    __privateAdd(this, _client3);
+    this.buyers = {
+      /** Maps one of your users to a buyer with its own agent, or returns the existing one. */
+      create: (input) => __privateGet(this, _client3).request("POST", "/api/purchasing/buyers", input),
+      get: (id) => __privateGet(this, _client3).request("GET", `/api/purchasing/buyers/${enc(id)}`),
+      list: (params = {}) => __privateGet(this, _client3).request("GET", `/api/purchasing/buyers?limit=${params.limit ?? 20}&offset=${params.offset ?? 0}`),
+      /** Stops the buyer's agent. Purchases that may already be paid stay visible. */
+      stop: (id) => __privateGet(this, _client3).request("POST", `/api/purchasing/buyers/${enc(id)}/stop`)
+    };
+    this.paymentMethods = {
+      /** A single-use link to the hosted setup page: limits, card and delegation. */
+      createSetupLink: (input) => __privateGet(this, _client3).request(
+        "POST",
+        "/api/purchasing/payment-methods/setup-sessions",
+        input
+      ),
+      list: (buyerId) => __privateGet(this, _client3).request(
+        "GET",
+        `/api/purchasing/payment-methods?buyerId=${enc(buyerId)}`
+      ),
+      remove: (id) => __privateGet(this, _client3).request(
+        "DELETE",
+        `/api/purchasing/payment-methods/${enc(id)}`
+      )
+    };
+    this.delegations = {
+      list: (buyerId) => __privateGet(this, _client3).request(
+        "GET",
+        `/api/purchasing/delegations?buyerId=${enc(buyerId)}`
+      ),
+      get: (id) => __privateGet(this, _client3).request("GET", `/api/purchasing/delegations/${enc(id)}`),
+      revoke: (id) => __privateGet(this, _client3).request(
+        "POST",
+        `/api/purchasing/delegations/${enc(id)}/revoke`
+      )
+    };
+    this.settings = {
+      get: () => __privateGet(this, _client3).request("GET", "/api/purchasing/settings"),
+      update: (input) => __privateGet(this, _client3).request(
+        "PUT",
+        "/api/purchasing/settings",
+        input
+      )
+    };
+    __privateSet(this, _client3, client);
+    this.purchases = new OrganizationPurchasesClient(client);
+    this.recurringPurchases = new OrganizationRecurringPurchasesClient(client);
+  }
+  /** What this organization can run now: test mode always, live once Conto enables it. */
+  capabilities() {
+    return __privateGet(this, _client3).request("GET", "/api/purchasing/capabilities");
+  }
+};
+_client3 = new WeakMap();
+function verifyPurchaseWebhook(input) {
+  const expected = (0, import_node_crypto.createHmac)("sha256", input.secret).update(input.body).digest();
+  const received = Buffer.from(input.signature ?? "", "hex");
+  if (received.length !== expected.length || !(0, import_node_crypto.timingSafeEqual)(received, expected))
+    throw new Error("Invalid webhook signature");
+  const payload = JSON.parse(input.body);
+  const age = ((input.now ?? /* @__PURE__ */ new Date()).getTime() - Date.parse(payload.timestamp)) / 1e3;
+  if (!Number.isFinite(age) || Math.abs(age) > (input.toleranceSeconds ?? 300))
+    throw new Error("Webhook timestamp is outside the tolerance");
+  return payload;
+}
+
 // src/http.ts
 var PUBLIC_PAYMENT_REASONS = /* @__PURE__ */ new Set([
   "The available balance is insufficient for this payment.",
@@ -398,7 +769,7 @@ function responseErrorMetadata(response, data) {
 }
 
 // src/browser-checkout.ts
-var import_node_crypto = require("crypto");
+var import_node_crypto2 = require("crypto");
 var MAX_URL_LENGTH = 2048;
 var MAX_LOCATOR_LENGTH = 1024;
 var MAX_TEXT_LENGTH = 500;
@@ -471,7 +842,7 @@ function canonicalizeBrowserCheckoutTarget(snapshot) {
 }
 function fingerprintBrowserCheckoutTarget(snapshot) {
   const canonical = canonicalizeBrowserCheckoutTarget(snapshot);
-  const digest = (0, import_node_crypto.createHash)("sha256").update(JSON.stringify(canonical)).digest("hex");
+  const digest = (0, import_node_crypto2.createHash)("sha256").update(JSON.stringify(canonical)).digest("hex");
   return `browser_target_sha256_${digest}`;
 }
 function createVerifiedBrowserCheckoutDriver(resolver) {
@@ -555,15 +926,51 @@ var ContoAdmin = class {
     this.cards = new AdminCardsClient(this);
     this.policies = new PoliciesClient(this);
     this.team = new TeamClient(this);
-    this.paymentRails = new PaymentRailsClient(this);
+    this.purchasing = new AdminPurchasingClient(this);
   }
-  /** Make an authenticated request to the Conto API */
-  async request(method, path, body) {
+  /**
+   * Opens an authenticated server-sent event stream. Used by
+   * `purchasing.purchases.watch()`. The server closes it after about 50 seconds.
+   * @internal
+   */
+  async openStream(path, init = {}) {
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    init.signal?.addEventListener("abort", abort, { once: true });
+    const timeoutId = setTimeout(abort, Math.max(this.timeout, 7e4));
+    try {
+      const response = await fetch(`${this.baseUrl}${path}`, {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${__privateGet(this, _orgApiKey)}`,
+          Accept: "text/event-stream",
+          "User-Agent": `@conto_finance/sdk-admin/${import_package_version.SDK_PACKAGE_VERSION}`,
+          ...init.lastEventId ? { "Last-Event-ID": init.lastEventId } : {}
+        },
+        signal: controller.signal
+      });
+      if (!response.ok) {
+        const data = await readResponseData(response);
+        throw new ContoAdminError(
+          responseErrorMessage(data, response.status),
+          responseErrorMetadata(response, data)
+        );
+      }
+      return response;
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
+  /**
+   * Make an authenticated request to the Conto API. Reads retry. A write retries
+   * only when `idempotent` says the API deduplicates it, as purchase creation does.
+   */
+  async request(method, path, body, options = {}) {
     const url = `${this.baseUrl}${path}`;
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), this.timeout);
     const normalizedMethod = method.toUpperCase();
-    const retryable = ["GET", "HEAD", "OPTIONS"].includes(normalizedMethod);
+    const retryable = ["GET", "HEAD", "OPTIONS"].includes(normalizedMethod) || options.idempotent === true;
     try {
       const response = await fetchWithRetry(
         url,
@@ -611,22 +1018,6 @@ var ContoAdmin = class {
   }
 };
 _orgApiKey = new WeakMap();
-var PaymentRailsClient = class {
-  constructor(client) {
-    this.client = client;
-  }
-  /** Read gate and configuration readiness without calling Stripe. */
-  async getStripeLinkCheckoutReadiness() {
-    return this.client.request("GET", "/api/stripe-link/checkout-readiness");
-  }
-  /**
-   * Ask Conto to verify that its configured Stripe credential resolves to its
-   * configured merchant account. This call never returns either identifier.
-   */
-  async verifyStripeLinkCheckoutAccount() {
-    return this.client.request("POST", "/api/stripe-link/checkout-readiness");
-  }
-};
 var AdminCardsClient = class {
   constructor(client) {
     this.client = client;
@@ -1081,27 +1472,6 @@ var ContoError = class extends Error {
     }
   }
 };
-var LinkPaymentExecutionError = class extends ContoError {
-  constructor(executionId, error) {
-    const original = error instanceof ContoError ? error : void 0;
-    super(
-      original?.message ?? "Link execution could not be confirmed",
-      {
-        code: original?.code ?? "LINK_EXECUTION_UNCONFIRMED",
-        status: original?.status ?? 0,
-        requestId: original?.requestId,
-        retryAfter: original?.retryAfter,
-        fieldErrors: original?.fieldErrors,
-        reasons: original?.reasons,
-        retryGuidance: "Call link.status(executionId) to reconcile. Do not create another purchase or retry execution blindly."
-      },
-      original?.diagnostics
-    );
-    this.nextAction = "RECONCILE";
-    this.name = "LinkPaymentExecutionError";
-    this.executionId = executionId;
-  }
-};
 var ExternalCardConfirmationPendingError = class extends ContoError {
   constructor(requestId, confirmationInput, receipt) {
     super("External card execution completed but confirmation is pending", {
@@ -1129,8 +1499,54 @@ var BrowserActionFinalizationPendingError = class extends ContoError {
     this.observation = input.observation;
   }
 };
+var CheckoutCheckpointClosedError = class extends ContoError {
+  constructor(checkpoint, message = `The checkpoint is ${checkpoint.stage.toLowerCase().replace(/_/g, " ")}. Stop this checkout.`, code = "CHECKOUT_CHECKPOINT_CLOSED") {
+    super(message, { code, status: 0 });
+    this.name = "CheckoutCheckpointClosedError";
+    this.checkpoint = checkpoint;
+    this.stage = checkpoint.stage;
+  }
+};
+var CheckoutApprovalDeniedError = class extends CheckoutCheckpointClosedError {
+  constructor(checkpoint) {
+    super(checkpoint, "The owner rejected this purchase. Do not pay.", "CHECKOUT_APPROVAL_DENIED");
+    this.name = "CheckoutApprovalDeniedError";
+  }
+};
+var CheckoutApprovalExpiredError = class extends CheckoutCheckpointClosedError {
+  constructor(checkpoint) {
+    super(
+      checkpoint,
+      "The owner did not approve this purchase in time. Do not pay.",
+      "CHECKOUT_APPROVAL_EXPIRED"
+    );
+    this.name = "CheckoutApprovalExpiredError";
+  }
+};
+var CheckoutApprovalPendingError = class extends ContoError {
+  constructor(checkpoint) {
+    super("The owner has not approved this purchase yet. Do not pay.", {
+      code: "CHECKOUT_APPROVAL_PENDING",
+      status: 0,
+      retryGuidance: "Call checkout.waitForApproval(error.checkpoint), then confirm the approved checkpoint."
+    });
+    this.name = "CheckoutApprovalPendingError";
+    this.checkpoint = checkpoint;
+  }
+};
+var CheckoutApprovalTimeoutError = class extends ContoError {
+  constructor(checkpoint) {
+    super("The owner has not decided yet. Do not pay.", {
+      code: "CHECKOUT_APPROVAL_TIMEOUT",
+      status: 0,
+      retryGuidance: "Wait again with checkout.waitForApproval, or call checkout.cancel to release the held spend."
+    });
+    this.name = "CheckoutApprovalTimeoutError";
+    this.checkpoint = checkpoint;
+  }
+};
 function generatedIdempotencyKey(prefix) {
-  return `${prefix}_${(0, import_node_crypto2.randomUUID)()}`;
+  return `${prefix}_${(0, import_node_crypto3.randomUUID)()}`;
 }
 function requireFinancialIdentifier(value, field) {
   if (!value || value.trim().length === 0) {
@@ -1191,7 +1607,6 @@ var Conto = class {
     this.baseUrl = (config.baseUrl || "https://conto.finance").replace(/\/$/, "");
     assertSecureBaseUrl(this.baseUrl);
     this.timeout = config.timeout || 3e4;
-    this.link = new LinkClient(this, config.link);
     this.checkout = new CheckoutClient(this);
     this.payments = new PaymentsClient(this);
     this.cards = new CardsClient(this);
@@ -1199,31 +1614,8 @@ var Conto = class {
     this.testCards = new TestCardsClient(this);
     this.x402 = new X402Client(this);
     this.mpp = new MppClient(this);
-  }
-  /**
-   * List masked Link payment methods for a session-created connection that is
-   * explicitly bound to this agent. No Link token or payment artifact is
-   * returned through the agent SDK.
-   */
-  async listStripeLinkPaymentMethods(connectionId, options) {
-    return this.request(
-      "GET",
-      withQuery("/api/sdk/stripe-link/payment-methods", {
-        connectionId,
-        ...options?.mode ? { mode: options.mode } : {}
-      })
-    );
-  }
-  /** Read live Link configuration diagnostics without retrieving credentials or authorizing payment. */
-  async getLinkSetup(input = {}) {
-    return this.request(
-      "GET",
-      withQuery("/api/sdk/stripe-link/setup", {
-        connectionId: input.connectionId,
-        paymentMethodId: input.paymentMethodId,
-        merchantId: input.merchantId
-      })
-    );
+    this.purchases = new PurchasesClient(this);
+    this.recurringPurchases = new RecurringPurchasesClient(this);
   }
   /**
    * Normalize and durably revise a partial agent purchase proposal without
@@ -1305,6 +1697,22 @@ var Conto = class {
       rethrowAmbiguousCommerceMutation(error, executionId, "authorize");
     }
   }
+  /**
+   * Report whether an authorized guarded browser checkout was paid. PAID keeps
+   * the held spend counted, NOT_PAID releases it, and UNKNOWN keeps it held for
+   * the owner to review. Safe to repeat with the same outcome.
+   */
+  async reportCommerceExecutionOutcome(executionId, input) {
+    return this.request(
+      "POST",
+      `/api/sdk/commerce-executions/${encodeURIComponent(executionId)}/outcome`,
+      {
+        outcome: input.outcome,
+        ...input.reference ? { reference: input.reference } : {}
+      },
+      { idempotent: true }
+    );
+  }
   /** Claim a durable browser action for one stable privileged-runtime attempt. */
   async claimBrowserAction(authorizationId, dispatchAttemptId, browserSessionId, action) {
     return this.request(
@@ -1492,6 +1900,39 @@ var Conto = class {
   async setup() {
     return this.request("GET", "/api/sdk/setup");
   }
+  /**
+   * Opens an authenticated server-sent event stream. Used by
+   * `purchases.watch()`. The server closes it after about 50 seconds.
+   * @internal
+   */
+  async openStream(path, init = {}) {
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    init.signal?.addEventListener("abort", abort, { once: true });
+    const timeoutId = setTimeout(abort, Math.max(this.timeout, 7e4));
+    try {
+      const response = await fetch(`${this.baseUrl}${path}`, {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${__privateGet(this, _apiKey)}`,
+          Accept: "text/event-stream",
+          "User-Agent": `@conto_finance/sdk/${import_package_version2.SDK_PACKAGE_VERSION}`,
+          ...init.lastEventId ? { "Last-Event-ID": init.lastEventId } : {}
+        },
+        signal: controller.signal
+      });
+      if (!response.ok) {
+        const data = await readResponseData(response);
+        throw new ContoError(
+          responseErrorMessage(data, response.status),
+          responseErrorMetadata(response, data)
+        );
+      }
+      return response;
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
   /** Make an authenticated request to the Conto API */
   async request(method, path, body, options = {}) {
     const url = `${this.baseUrl}${path}`;
@@ -1764,12 +2205,6 @@ var ConnectedCardsClient = class {
       currency: input.currency ?? "USD"
     });
   }
-  /**
-   * List the connected cards and active mandates this agent may draw against.
-   *
-   * The response is masked: no PAN and no provider tokens. This is a read-only
-   * GET, so transport retry on transient failures is safe.
-   */
   /** Record receipt after a fresh draw. Does not confirm checkout or payment settlement. */
   async acknowledgeDelivery(requestId) {
     return this.client.request(
@@ -1779,6 +2214,39 @@ var ConnectedCardsClient = class {
       { idempotent: true }
     );
   }
+  /**
+   * Report what happened with the card number after checkout.
+   *
+   * `USED` at the full approved amount closes the draw. `NOT_USED`, or `USED`
+   * with a smaller `amountMinor`, is recorded and shown to a person, who
+   * confirms it before the held amount is released. A report never releases
+   * held spend by itself and does not confirm settlement. Safe to repeat with
+   * the same report. A different second report gets HTTP 409.
+   *
+   * @example
+   * ```typescript
+   * await conto.connectedCards.reportOutcome(draw.requestId, { outcome: 'USED' });
+   * await conto.connectedCards.reportOutcome(draw.requestId, { outcome: 'USED', amountMinor: 1850 });
+   * await conto.connectedCards.reportOutcome(draw.requestId, { outcome: 'NOT_USED' });
+   * ```
+   */
+  async reportOutcome(requestId, report) {
+    return this.client.request(
+      "POST",
+      `/api/sdk/connected-cards/draws/${encodeURIComponent(requestId)}/outcome`,
+      {
+        outcome: report.outcome,
+        ...report.amountMinor !== void 0 ? { amountMinor: report.amountMinor } : {}
+      },
+      { idempotent: true }
+    );
+  }
+  /**
+   * List the connected cards and active mandates this agent may draw against.
+   *
+   * The response is masked: no PAN and no provider tokens. This is a read-only
+   * GET, so transport retry on transient failures is safe.
+   */
   async list() {
     return this.client.request("GET", "/api/sdk/connected-cards");
   }
@@ -2167,13 +2635,49 @@ function checkpointCart(amountMinor, lineItems, totals) {
     totals: totals ?? [{ type: "total", label: "Total", amountMinor }]
   };
 }
-var _client;
+var CLOSED_CHECKPOINT_STAGES = [
+  "DENIED",
+  "CANCELLED",
+  "EXPIRED",
+  "NOT_PAID"
+];
+function closedCheckpointError(checkpoint) {
+  if (checkpoint.approval?.status === "DENIED") return new CheckoutApprovalDeniedError(checkpoint);
+  if (checkpoint.approval?.status === "EXPIRED") {
+    return new CheckoutApprovalExpiredError(checkpoint);
+  }
+  return new CheckoutCheckpointClosedError(checkpoint);
+}
+function sleep2(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(signal.reason ?? new Error("Aborted"));
+      return;
+    }
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(signal?.reason ?? new Error("Aborted"));
+    };
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+var _client4;
 var CheckoutClient = class {
   constructor(client) {
-    __privateAdd(this, _client);
-    __privateSet(this, _client, client);
+    __privateAdd(this, _client4);
+    __privateSet(this, _client4, client);
   }
-  /** First checkpoint. A ContoError means Conto did not approve: stop the checkout. */
+  /**
+   * First checkpoint. Open the payment method only when the stage is APPROVED.
+   * AWAITING_APPROVAL means the owner must decide first: call waitForApproval().
+   * A ContoError means Conto did not approve: stop the checkout. A
+   * CheckoutCheckpointClosedError means this idempotency key belongs to a
+   * checkpoint that already closed.
+   */
   async begin(input) {
     const idempotencyKey = input.idempotencyKey?.trim();
     if (!idempotencyKey || idempotencyKey.length < 8 || idempotencyKey.length > 255) {
@@ -2185,7 +2689,7 @@ var CheckoutClient = class {
     if (input.currency !== void 0 && input.currency !== "USD") {
       throw checkoutError("Only USD checkouts are supported");
     }
-    const result = await __privateGet(this, _client).request(
+    const result = await __privateGet(this, _client4).request(
       "POST",
       "/api/sdk/checkout-checkpoints",
       {
@@ -2200,13 +2704,40 @@ var CheckoutClient = class {
       },
       { idempotent: true }
     );
+    if (CLOSED_CHECKPOINT_STAGES.includes(result.checkpoint.stage)) {
+      throw closedCheckpointError(result.checkpoint);
+    }
     return result.checkpoint;
   }
+  /**
+   * Waits while the owner decides on a checkpoint in AWAITING_APPROVAL and
+   * resolves to the approved checkpoint. Throws CheckoutApprovalDeniedError,
+   * CheckoutApprovalExpiredError, CheckoutCheckpointClosedError, or
+   * CheckoutApprovalTimeoutError (the spend stays held until you cancel).
+   */
+  async waitForApproval(checkpoint, options = {}) {
+    const timeoutMs = options.timeoutMs ?? 10 * 6e4;
+    const pollIntervalMs = Math.max(1e3, options.pollIntervalMs ?? 5e3);
+    const deadline = Date.now() + timeoutMs;
+    let current = checkpoint;
+    for (; ; ) {
+      if (current.stage !== "AWAITING_APPROVAL") {
+        if (CLOSED_CHECKPOINT_STAGES.includes(current.stage)) throw closedCheckpointError(current);
+        return current;
+      }
+      const remaining = deadline - Date.now();
+      if (remaining <= 0) throw new CheckoutApprovalTimeoutError(current);
+      await sleep2(Math.min(pollIntervalMs, remaining), options.signal);
+      current = await this.get(current.id);
+    }
+  }
   /**
    * Second checkpoint, right before the payment is submitted. If the total
    * changed since begin() (tax or shipping, for example), this cancels the
    * approved checkpoint and starts a new one at the final total, so the agent's
-   * rules see the amount actually being paid. Pay only if this resolves.
+   * rules see the amount actually being paid. Pay only if this resolves. A
+   * CheckoutApprovalPendingError means the owner must approve first: call
+   * waitForApproval(error.checkpoint), then confirm the checkpoint it returns.
    */
   async confirm(checkpoint, input) {
     if (input.currency !== void 0 && input.currency !== "USD") {
@@ -2237,22 +2768,31 @@ var CheckoutClient = class {
         lineItems: input.lineItems ?? checkpoint.cart.lineItems,
         totals: input.totals
       });
+      if (current.stage === "AWAITING_APPROVAL") throw new CheckoutApprovalPendingError(current);
+    }
+    try {
+      const result = await __privateGet(this, _client4).request(
+        "POST",
+        `/api/sdk/checkout-checkpoints/${encodeURIComponent(current.id)}/confirm`,
+        {
+          amountMinor: input.amountMinor,
+          currency: "USD",
+          ...input.pageUrl ? { pageUrl: input.pageUrl } : {}
+        },
+        { idempotent: true }
+      );
+      return result.checkpoint;
+    } catch (error) {
+      if (error instanceof ContoError && error.status === 409 && error.code === "APPROVAL_REQUIRED") {
+        const latest = await this.get(current.id);
+        if (latest.stage === "AWAITING_APPROVAL") throw new CheckoutApprovalPendingError(latest);
+      }
+      throw error;
     }
-    const result = await __privateGet(this, _client).request(
-      "POST",
-      `/api/sdk/checkout-checkpoints/${encodeURIComponent(current.id)}/confirm`,
-      {
-        amountMinor: input.amountMinor,
-        currency: "USD",
-        ...input.pageUrl ? { pageUrl: input.pageUrl } : {}
-      },
-      { idempotent: true }
-    );
-    return result.checkpoint;
   }
   /** Report what happened after a confirmed checkpoint. Safe to repeat with the same outcome. */
   async reportOutcome(checkpointId, input) {
-    const result = await __privateGet(this, _client).request(
+    const result = await __privateGet(this, _client4).request(
       "POST",
       `/api/sdk/checkout-checkpoints/${encodeURIComponent(checkpointId)}/outcome`,
       {
@@ -2263,9 +2803,12 @@ var CheckoutClient = class {
     );
     return result.checkpoint;
   }
-  /** Cancel a checkpoint that was not confirmed and release its spend. */
+  /**
+   * Cancel a checkpoint that was not confirmed and release its spend. A
+   * checkpoint waiting for the owner can be cancelled too.
+   */
   async cancel(checkpointId) {
-    const result = await __privateGet(this, _client).request(
+    const result = await __privateGet(this, _client4).request(
       "POST",
       `/api/sdk/checkout-checkpoints/${encodeURIComponent(checkpointId)}/cancel`,
       {},
@@ -2274,189 +2817,25 @@ var CheckoutClient = class {
     return result.checkpoint;
   }
   async get(checkpointId) {
-    const result = await __privateGet(this, _client).request(
+    const result = await __privateGet(this, _client4).request(
       "GET",
       `/api/sdk/checkout-checkpoints/${encodeURIComponent(checkpointId)}`
     );
     return result.checkpoint;
   }
 };
-_client = new WeakMap();
-var _client2, _defaults;
-var LinkClient = class {
-  constructor(client, defaults) {
-    __privateAdd(this, _client2);
-    __privateAdd(this, _defaults);
-    __privateSet(this, _client2, client);
-    __privateSet(this, _defaults, defaults ? { ...defaults } : void 0);
-  }
-  /** Inspect the configured live path. This is not a payment authorization or provider connectivity test. */
-  async setup(input = {}) {
-    return __privateGet(this, _client2).getLinkSetup({
-      connectionId: input.connectionId ?? __privateGet(this, _defaults)?.connectionId,
-      paymentMethodId: input.paymentMethodId ?? __privateGet(this, _defaults)?.paymentMethodId,
-      merchantId: input.merchantId
-    });
-  }
-  /** Read masked LIVE funding sources; never selects a source or initiates payment. */
-  async paymentMethods(connectionId) {
-    return __privateGet(this, _client2).listStripeLinkPaymentMethods(
-      this.identifier(connectionId ?? __privateGet(this, _defaults)?.connectionId, "connectionId"),
-      { mode: "LIVE" }
-    );
-  }
-  /**
-   * Begin one exact intent and execute only if already READY. Otherwise return
-   * the owner's approval action or existing state immediately, without polling.
-   */
-  async pay(input) {
-    const connectionId = this.identifier(
-      input.connectionId ?? __privateGet(this, _defaults)?.connectionId,
-      "connectionId"
-    );
-    const paymentMethodId = this.identifier(
-      input.paymentMethodId ?? __privateGet(this, _defaults)?.paymentMethodId,
-      "paymentMethodId"
-    );
-    if (!Number.isSafeInteger(input.amountMinor) || input.amountMinor <= 0 || input.currency !== void 0 && input.currency !== "USD" || !Array.isArray(input.lineItems) || input.lineItems.length === 0 || typeof input.purpose !== "string" || !input.purpose.trim()) {
-      throw new ContoError("Supply a positive USD amount in cents, purpose, and line items", {
-        code: "INVALID_LINK_PURCHASE",
-        status: 0
-      });
-    }
-    const itemTotal = input.lineItems.reduce((sum, item) => {
-      if (!item || typeof item.name !== "string" || !item.name.trim() || !Number.isSafeInteger(item.quantity) || item.quantity <= 0 || !Number.isSafeInteger(item.unitAmountMinor) || item.unitAmountMinor < 0) {
-        throw new ContoError(
-          "Each line item needs a name, positive integer quantity, and price in cents",
-          {
-            code: "INVALID_LINK_PURCHASE",
-            status: 0
-          }
-        );
-      }
-      return sum + item.quantity * item.unitAmountMinor;
-    }, 0);
-    if (!input.totals && (!Number.isSafeInteger(itemTotal) || itemTotal !== input.amountMinor)) {
-      throw new ContoError(
-        "Supply the exact totals breakdown when the amount differs from the line items",
-        {
-          code: "LINK_TOTALS_REQUIRED",
-          status: 0
-        }
-      );
-    }
-    const result = await __privateGet(this, _client2).beginCommerceExecution({
-      executionMethod: "LINK_PAY_TOKEN",
-      connectionId,
-      paymentMethodId,
-      idempotencyKey: input.idempotencyKey,
-      amountMinor: input.amountMinor,
-      currency: input.currency ?? "USD",
-      purpose: input.purpose,
-      category: input.category,
-      counterparty: { canonicalId: input.merchantId, checkoutUrl: input.checkoutUrl },
-      cart: {
-        lineItems: input.lineItems,
-        totals: input.totals ?? [{ type: "total", label: "Total", amountMinor: input.amountMinor }]
-      },
-      providerPresentation: {
-        approvalSummary: input.purpose.trim().slice(0, 500),
-        lineItemLabels: input.lineItems.map((item) => item.name.trim().slice(0, 120))
-      }
-    });
-    return this.executeIfReady(result);
-  }
-  /**
-   * Continue the existing payment after approval. Reads before any mutation and
-   * never submits an execution already processing or requiring reconciliation.
-   */
-  async resume(executionId) {
-    const id = this.identifier(executionId, "executionId");
-    const current = await __privateGet(this, _client2).getCommerceExecution(id);
-    this.assertLinkExecution(current);
-    if (["AUTHORIZING", "AWAITING_APPROVAL", "ACTION_REQUIRED"].includes(current.execution.status)) {
-      return this.executeIfReady(await __privateGet(this, _client2).refreshCommerceExecution(id));
-    }
-    return this.executeIfReady(current);
-  }
-  /** Observe and reconcile provider state. This method never submits a payment. */
-  async status(executionId) {
-    const id = this.identifier(executionId, "executionId");
-    this.assertLinkExecution(await __privateGet(this, _client2).getCommerceExecution(id));
-    return this.result(await __privateGet(this, _client2).refreshCommerceExecution(id));
-  }
-  /** Request cancellation of this existing Link payment; never retried automatically. */
-  async cancel(executionId) {
-    const id = this.identifier(executionId, "executionId");
-    this.assertLinkExecution(await __privateGet(this, _client2).getCommerceExecution(id));
-    try {
-      return this.result(await __privateGet(this, _client2).cancelCommerceExecution(id));
-    } catch (error) {
-      throw new LinkPaymentExecutionError(id, error);
-    }
-  }
-  identifier(value, field) {
-    if (typeof value !== "string" || !value.trim() || value.length > 255) {
-      throw new ContoError(
-        field === "executionId" ? "executionId is required; use the existing ID returned by link.pay()" : `${field} is required; configure the owner-provisioned Link IDs or supply them explicitly`,
-        {
-          code: "LINK_CONFIGURATION_REQUIRED",
-          status: 0
-        }
-      );
-    }
-    return value.trim();
-  }
-  assertLinkExecution(result) {
-    const execution = result.execution;
-    if (execution?.provider !== "STRIPE_LINK" || execution.executionAdapter !== "STRIPE_LINK" || execution.executionChannel !== "BROWSER" || execution.artifactKind !== void 0 && execution.artifactKind !== "LINK_PAY_TOKEN" || execution.deliveryMode !== void 0 && execution.deliveryMode !== "SERVER_ONLY_ARTIFACT") {
-      throw new ContoError("This execution is not a Link Pay Token checkout", {
-        code: "LINK_EXECUTION_MISMATCH",
-        status: 0
-      });
-    }
-  }
-  async executeIfReady(result) {
-    this.assertLinkExecution(result);
-    if (result.execution.status !== "READY") return this.result(result);
-    try {
-      return this.result(await __privateGet(this, _client2).executeCommerceExecution(result.execution.id));
-    } catch (error) {
-      throw new LinkPaymentExecutionError(result.execution.id, error);
-    }
-  }
-  result(result) {
-    this.assertLinkExecution(result);
-    const { execution } = result;
-    const awaitingApproval = ["AUTHORIZING", "AWAITING_APPROVAL", "ACTION_REQUIRED"].includes(
-      execution.status
-    );
-    const nextAction = execution.status === "READY" ? "RESUME" : execution.status === "NEEDS_RECONCILIATION" ? "RECONCILE" : awaitingApproval && execution.approvalUrl ? "APPROVE_IN_LINK" : awaitingApproval || ["DRAFT", "PROCESSING"].includes(execution.status) ? "WAIT" : [
-      "SETTLED",
-      "COMPLETED",
-      "DENIED",
-      "CANCELLED",
-      "FAILED",
-      "RETURNED",
-      "EXPIRED"
-    ].includes(execution.status) ? "NONE" : "RECONCILE";
-    return {
-      executionId: execution.id,
-      status: execution.status,
-      nextAction,
-      ...nextAction === "APPROVE_IN_LINK" ? { approvalUrl: execution.approvalUrl } : {},
-      execution,
-      ..."checkout" in result ? { checkout: result.checkout } : {}
-    };
-  }
-};
-_client2 = new WeakMap();
-_defaults = new WeakMap();
+_client4 = new WeakMap();
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AdminPurchasingClient,
   BrowserActionFinalizationPendingError,
   BrowserCheckoutTargetVerificationError,
   CardsClient,
+  CheckoutApprovalDeniedError,
+  CheckoutApprovalExpiredError,
+  CheckoutApprovalPendingError,
+  CheckoutApprovalTimeoutError,
+  CheckoutCheckpointClosedError,
   CheckoutClient,
   ConnectedCardsClient,
   Conto,
@@ -2466,10 +2845,15 @@ _defaults = new WeakMap();
   ControlledExternalCardPaymentTool,
   ExternalCardConfirmationPendingError,
   Giro,
-  LinkClient,
-  LinkPaymentExecutionError,
+  OrganizationPurchasesClient,
+  OrganizationRecurringPurchasesClient,
+  PurchasesClient,
+  RecurringPurchasesClient,
   TestCardsClient,
   canonicalizeBrowserCheckoutTarget,
   createVerifiedBrowserCheckoutDriver,
-  fingerprintBrowserCheckoutTarget
+  fingerprintBrowserCheckoutTarget,
+  isFinalPurchaseStatus,
+  parseServerSentEvents,
+  verifyPurchaseWebhook
 });