@conto_finance/sdk 0.6.0 → 0.6.1

package/dist/index.js

@@ -46,7 +46,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@conto_finance/sdk",
-      version: "0.6.0",
+      version: "0.6.1",
       description: "Conto SDK for AI agent payment authorization",
       main: "./dist/index.js",
       module: "./dist/index.mjs",
@@ -87,7 +87,7 @@ var require_package = __commonJS({
         dev: "tsup --watch",
         lint: "tsc --noEmit",
         test: "npm run lint && npm run test:contract && npm run test:consumer",
-        "test:contract": "npm run build && node --test test/contract.test.mjs test/playwright.test.mjs test/browserbase.test.mjs test/checkout-verifier.test.mjs test/developer-experience.test.mjs test/checkout.test.mjs",
+        "test:contract": "npm run build && node --test test/contract.test.mjs test/playwright.test.mjs test/browserbase.test.mjs test/checkout-verifier.test.mjs test/developer-experience.test.mjs test/checkout.test.mjs test/purchases.test.mjs",
         "test:consumer": "npm run build && node --test test/consumer.test.mjs",
         "verify:release": "node scripts/verify-release.mjs",
         prepublishOnly: "npm run verify:release && npm run lint && npm run test:contract && npm run test:consumer"
@@ -150,6 +150,7 @@ var require_package_version = __commonJS({
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  AdminPurchasingClient: () => AdminPurchasingClient,
   BrowserActionFinalizationPendingError: () => BrowserActionFinalizationPendingError,
   BrowserCheckoutTargetVerificationError: () => BrowserCheckoutTargetVerificationError,
   CardsClient: () => CardsClient,
@@ -167,17 +168,390 @@ __export(index_exports, {
   ControlledExternalCardPaymentTool: () => ControlledExternalCardPaymentTool,
   ExternalCardConfirmationPendingError: () => ExternalCardConfirmationPendingError,
   Giro: () => Conto,
+  OrganizationPurchasesClient: () => OrganizationPurchasesClient,
+  OrganizationRecurringPurchasesClient: () => OrganizationRecurringPurchasesClient,
+  PurchasesClient: () => PurchasesClient,
+  RecurringPurchasesClient: () => RecurringPurchasesClient,
   TestCardsClient: () => TestCardsClient,
   canonicalizeBrowserCheckoutTarget: () => canonicalizeBrowserCheckoutTarget,
   createVerifiedBrowserCheckoutDriver: () => createVerifiedBrowserCheckoutDriver,
   default: () => index_default,
-  fingerprintBrowserCheckoutTarget: () => fingerprintBrowserCheckoutTarget
+  fingerprintBrowserCheckoutTarget: () => fingerprintBrowserCheckoutTarget,
+  isFinalPurchaseStatus: () => isFinalPurchaseStatus,
+  parseServerSentEvents: () => parseServerSentEvents,
+  verifyPurchaseWebhook: () => verifyPurchaseWebhook
 });
 module.exports = __toCommonJS(index_exports);
 var Sentry2 = __toESM(require("@sentry/node"));
-var import_node_crypto2 = require("crypto");
+var import_node_crypto3 = require("crypto");
 var import_package_version2 = __toESM(require_package_version());
 
+// src/purchases.ts
+var import_node_crypto = require("crypto");
+var TERMINAL = /* @__PURE__ */ new Set(["succeeded", "blocked", "failed", "cancelled"]);
+var isFinalPurchaseStatus = (status) => TERMINAL.has(status);
+async function* parseServerSentEvents(body) {
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  let frame = { data: [] };
+  try {
+    while (true) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      buffer += decoder.decode(value, { stream: true });
+      let newline;
+      while ((newline = buffer.search(/\r?\n/)) >= 0) {
+        const line = buffer.slice(0, newline);
+        buffer = buffer.slice(newline + (buffer[newline] === "\r" ? 2 : 1));
+        if (line === "") {
+          if (frame.data.length || frame.event)
+            yield { id: frame.id, event: frame.event ?? "message", data: frame.data.join("\n") };
+          frame = { data: [] };
+          continue;
+        }
+        if (line.startsWith(":")) continue;
+        const colon = line.indexOf(":");
+        const field = colon < 0 ? line : line.slice(0, colon);
+        const raw = colon < 0 ? "" : line.slice(colon + 1).replace(/^ /, "");
+        if (field === "id") frame.id = raw;
+        else if (field === "event") frame.event = raw;
+        else if (field === "data") frame.data.push(raw);
+      }
+    }
+  } finally {
+    reader.releaseLock();
+  }
+}
+var sleep = (ms, signal) => new Promise((resolve) => {
+  const timer = setTimeout(resolve, ms);
+  signal?.addEventListener(
+    "abort",
+    () => {
+      clearTimeout(timer);
+      resolve();
+    },
+    { once: true }
+  );
+});
+function requirePurchaseId(id) {
+  if (!/^[a-z0-9]{8,64}$/i.test(id)) throw new TypeError("purchase id is not valid");
+  return encodeURIComponent(id);
+}
+function requireCycleKey(key) {
+  if (!/^[A-Za-z0-9._:-]{1,100}$/.test(key)) throw new TypeError("cycleKey is not valid");
+  return encodeURIComponent(key);
+}
+var _transport, _base;
+var RecurringPurchasesClient = class {
+  constructor(transport, basePath = "/api/sdk/recurring-purchases") {
+    __privateAdd(this, _transport);
+    __privateAdd(this, _base);
+    __privateSet(this, _transport, transport);
+    __privateSet(this, _base, basePath);
+  }
+  async list(buyerId) {
+    return __privateGet(this, _transport).request(
+      "GET",
+      buyerId ? `${__privateGet(this, _base)}?buyerId=${encodeURIComponent(buyerId)}` : __privateGet(this, _base)
+    );
+  }
+  async get(id) {
+    return __privateGet(this, _transport).request("GET", `${__privateGet(this, _base)}/${requirePurchaseId(id)}`);
+  }
+  /** Starts one order. The same cycle key returns the same order. */
+  async startCycle(id, cycleKey) {
+    requireCycleKey(cycleKey);
+    return __privateGet(this, _transport).request(
+      "POST",
+      `${__privateGet(this, _base)}/${requirePurchaseId(id)}/cycles`,
+      { cycleKey },
+      { idempotent: true }
+    );
+  }
+  /** Skips one order, also before it starts. */
+  async skipCycle(id, cycleKey) {
+    return __privateGet(this, _transport).request(
+      "POST",
+      `${__privateGet(this, _base)}/${requirePurchaseId(id)}/cycles/${requireCycleKey(cycleKey)}/skip`
+    );
+  }
+};
+_transport = new WeakMap();
+_base = new WeakMap();
+var _client;
+var OrganizationRecurringPurchasesClient = class extends RecurringPurchasesClient {
+  constructor(client) {
+    super(client, "/api/purchasing/recurring-purchases");
+    __privateAdd(this, _client);
+    __privateSet(this, _client, client);
+  }
+  /** Stops a repeat order. An order waiting for its payment time closes unpaid. */
+  async cancel(id) {
+    return __privateGet(this, _client).request(
+      "POST",
+      `/api/purchasing/recurring-purchases/${requirePurchaseId(id)}/cancel`
+    );
+  }
+};
+_client = new WeakMap();
+var _transport2, _base2;
+var PurchasesClient = class {
+  constructor(transport, basePath = "/api/sdk/purchases") {
+    __privateAdd(this, _transport2);
+    __privateAdd(this, _base2);
+    __privateSet(this, _transport2, transport);
+    __privateSet(this, _base2, basePath);
+  }
+  /**
+   * Starts a purchase and returns at once. Reusing the idempotency key with the
+   * same input returns the same purchase, so retrying after a lost response is safe.
+   */
+  async create(input, options) {
+    const idempotencyKey = options?.idempotencyKey?.trim();
+    if (!idempotencyKey || idempotencyKey.length < 8 || idempotencyKey.length > 255)
+      throw new TypeError("idempotencyKey must contain 8 to 255 characters");
+    if (!Number.isSafeInteger(input.maxCost?.amountMinor) || input.maxCost.amountMinor <= 0)
+      throw new TypeError("maxCost.amountMinor must be a positive integer");
+    return __privateGet(this, _transport2).request(
+      "POST",
+      __privateGet(this, _base2),
+      { ...input, idempotencyKey },
+      { idempotent: true }
+    );
+  }
+  async list(params = {}) {
+    const query = new URLSearchParams();
+    for (const [key, value] of Object.entries(params))
+      if (value !== void 0) query.set(key, String(value));
+    const suffix = query.toString();
+    return __privateGet(this, _transport2).request("GET", `${__privateGet(this, _base2)}${suffix ? `?${suffix}` : ""}`);
+  }
+  async get(id) {
+    return __privateGet(this, _transport2).request("GET", `${__privateGet(this, _base2)}/${requirePurchaseId(id)}`);
+  }
+  /**
+   * Answers an open action whose authority is `agent_or_buyer` with the fields
+   * it lists. The acknowledgment means recorded; the purchase shows the result.
+   * The same answer again returns the same acknowledgment.
+   */
+  async respond(id, input) {
+    return __privateGet(this, _transport2).request(
+      "POST",
+      `${__privateGet(this, _base2)}/${requirePurchaseId(id)}/responses`,
+      input,
+      { idempotent: true }
+    );
+  }
+  async events(id, params = {}) {
+    const query = new URLSearchParams({ after: String(params.after ?? 0) });
+    if (params.limit) query.set("limit", String(params.limit));
+    return __privateGet(this, _transport2).request("GET", `${__privateGet(this, _base2)}/${requirePurchaseId(id)}/events?${query}`);
+  }
+  /**
+   * Requests cancellation. Before payment the purchase stops. Once payment may
+   * have been submitted, `cancellationOutcome` is `too_late` and the purchase
+   * stays in reconciliation. Nothing is refunded by this call.
+   */
+  async cancel(id) {
+    return __privateGet(this, _transport2).request(
+      "POST",
+      `${__privateGet(this, _base2)}/${requirePurchaseId(id)}/cancel`,
+      void 0,
+      { idempotent: true }
+    );
+  }
+  /**
+   * Yields the purchase's events in version order until it reaches a final
+   * status. Streams with server-sent events and reconnects from the last
+   * version; falls back to polling where streaming is unavailable. A duplicate
+   * after a reconnect is dropped. A `purchase.resync` event carries the
+   * current purchase when the cursor could not be resumed.
+   */
+  async *watch(id, options = {}) {
+    const path = `${__privateGet(this, _base2)}/${requirePurchaseId(id)}`;
+    const mode = options.mode ?? "auto";
+    const interval = Math.max(500, options.pollIntervalMs ?? 2e3);
+    const deadline = options.maxWaitMs ? Date.now() + options.maxWaitMs : Infinity;
+    let cursor = Math.max(0, options.after ?? 0);
+    let streaming = mode !== "poll";
+    const emit = (event) => {
+      if (event.version <= cursor && event.type !== "purchase.resync") return null;
+      cursor = Math.max(cursor, event.version);
+      return event;
+    };
+    while (!options.signal?.aborted && Date.now() < deadline) {
+      if (streaming) {
+        try {
+          const response = await __privateGet(this, _transport2).openStream(
+            `${path}/events/stream?after=${cursor}`,
+            { signal: options.signal, lastEventId: String(cursor) }
+          );
+          if (!response.body) throw new Error("streaming unavailable");
+          for await (const frame of parseServerSentEvents(response.body)) {
+            if (frame.event === "end") return;
+            if (frame.event === "error") break;
+            if (frame.event === "resync") {
+              const purchase = JSON.parse(frame.data);
+              const event2 = {
+                id: `resync:${purchase.version}`,
+                purchaseId: purchase.id,
+                version: purchase.version,
+                type: "purchase.resync",
+                createdAt: purchase.updatedAt,
+                data: purchase
+              };
+              cursor = purchase.version;
+              yield event2;
+              if (isFinalPurchaseStatus(purchase.status)) return;
+              continue;
+            }
+            if (!frame.data) continue;
+            const event = emit(JSON.parse(frame.data));
+            if (!event) continue;
+            yield event;
+            if (isFinalPurchaseStatus(event.data.status)) return;
+          }
+          continue;
+        } catch (error) {
+          if (options.signal?.aborted) return;
+          if (isClientError(error)) throw error;
+          if (mode === "stream") {
+            await sleep(interval, options.signal);
+            continue;
+          }
+          streaming = false;
+        }
+      }
+      let page;
+      try {
+        page = await this.events(id, { after: cursor, limit: 100 });
+      } catch (error) {
+        if (codeOf(error) !== "CURSOR_INVALID") throw error;
+        const purchase = await this.get(id);
+        cursor = purchase.version;
+        yield {
+          id: `resync:${purchase.version}`,
+          purchaseId: purchase.id,
+          version: purchase.version,
+          type: "purchase.resync",
+          createdAt: purchase.updatedAt,
+          data: purchase
+        };
+        if (isFinalPurchaseStatus(purchase.status)) return;
+        continue;
+      }
+      for (const item of page.items) {
+        const event = emit(item);
+        if (!event) continue;
+        yield event;
+        if (isFinalPurchaseStatus(event.data.status)) return;
+      }
+      if (!page.hasMore) await sleep(interval, options.signal);
+    }
+  }
+};
+_transport2 = new WeakMap();
+_base2 = new WeakMap();
+var codeOf = (error) => error && typeof error === "object" && "code" in error ? String(error.code) : "";
+var isClientError = (error) => {
+  const status = error && typeof error === "object" && "status" in error ? Number(error.status) : 0;
+  return status >= 400 && status < 500 && status !== 408 && status !== 429;
+};
+var enc = encodeURIComponent;
+var _client2;
+var OrganizationPurchasesClient = class extends PurchasesClient {
+  constructor(client) {
+    super(client, "/api/purchasing/purchases");
+    __privateAdd(this, _client2);
+    __privateSet(this, _client2, client);
+  }
+  async list(params = {}) {
+    const query = new URLSearchParams();
+    for (const [key, value] of Object.entries(params))
+      if (value !== void 0) query.set(key, String(value));
+    const suffix = query.toString();
+    return __privateGet(this, _client2).request("GET", `/api/purchasing/purchases${suffix ? `?${suffix}` : ""}`);
+  }
+  /** A single-use link that opens the purchase's buyer actions on Conto's hosted page. */
+  createActionLink(id, input = {}) {
+    return __privateGet(this, _client2).request(
+      "POST",
+      `/api/purchasing/purchases/${requirePurchaseId(id)}/action-sessions`,
+      input
+    );
+  }
+};
+_client2 = new WeakMap();
+var _client3;
+var AdminPurchasingClient = class {
+  constructor(client) {
+    __privateAdd(this, _client3);
+    this.buyers = {
+      /** Maps one of your users to a buyer with its own agent, or returns the existing one. */
+      create: (input) => __privateGet(this, _client3).request("POST", "/api/purchasing/buyers", input),
+      get: (id) => __privateGet(this, _client3).request("GET", `/api/purchasing/buyers/${enc(id)}`),
+      list: (params = {}) => __privateGet(this, _client3).request("GET", `/api/purchasing/buyers?limit=${params.limit ?? 20}&offset=${params.offset ?? 0}`),
+      /** Stops the buyer's agent. Purchases that may already be paid stay visible. */
+      stop: (id) => __privateGet(this, _client3).request("POST", `/api/purchasing/buyers/${enc(id)}/stop`)
+    };
+    this.paymentMethods = {
+      /** A single-use link to the hosted setup page: limits, card and delegation. */
+      createSetupLink: (input) => __privateGet(this, _client3).request(
+        "POST",
+        "/api/purchasing/payment-methods/setup-sessions",
+        input
+      ),
+      list: (buyerId) => __privateGet(this, _client3).request(
+        "GET",
+        `/api/purchasing/payment-methods?buyerId=${enc(buyerId)}`
+      ),
+      remove: (id) => __privateGet(this, _client3).request(
+        "DELETE",
+        `/api/purchasing/payment-methods/${enc(id)}`
+      )
+    };
+    this.delegations = {
+      list: (buyerId) => __privateGet(this, _client3).request(
+        "GET",
+        `/api/purchasing/delegations?buyerId=${enc(buyerId)}`
+      ),
+      get: (id) => __privateGet(this, _client3).request("GET", `/api/purchasing/delegations/${enc(id)}`),
+      revoke: (id) => __privateGet(this, _client3).request(
+        "POST",
+        `/api/purchasing/delegations/${enc(id)}/revoke`
+      )
+    };
+    this.settings = {
+      get: () => __privateGet(this, _client3).request("GET", "/api/purchasing/settings"),
+      update: (input) => __privateGet(this, _client3).request(
+        "PUT",
+        "/api/purchasing/settings",
+        input
+      )
+    };
+    __privateSet(this, _client3, client);
+    this.purchases = new OrganizationPurchasesClient(client);
+    this.recurringPurchases = new OrganizationRecurringPurchasesClient(client);
+  }
+  /** What this organization can run now: test mode always, live once Conto enables it. */
+  capabilities() {
+    return __privateGet(this, _client3).request("GET", "/api/purchasing/capabilities");
+  }
+};
+_client3 = new WeakMap();
+function verifyPurchaseWebhook(input) {
+  const expected = (0, import_node_crypto.createHmac)("sha256", input.secret).update(input.body).digest();
+  const received = Buffer.from(input.signature ?? "", "hex");
+  if (received.length !== expected.length || !(0, import_node_crypto.timingSafeEqual)(received, expected))
+    throw new Error("Invalid webhook signature");
+  const payload = JSON.parse(input.body);
+  const age = ((input.now ?? /* @__PURE__ */ new Date()).getTime() - Date.parse(payload.timestamp)) / 1e3;
+  if (!Number.isFinite(age) || Math.abs(age) > (input.toleranceSeconds ?? 300))
+    throw new Error("Webhook timestamp is outside the tolerance");
+  return payload;
+}
+
 // src/http.ts
 var PUBLIC_PAYMENT_REASONS = /* @__PURE__ */ new Set([
   "The available balance is insufficient for this payment.",
@@ -395,7 +769,7 @@ function responseErrorMetadata(response, data) {
 }
 
 // src/browser-checkout.ts
-var import_node_crypto = require("crypto");
+var import_node_crypto2 = require("crypto");
 var MAX_URL_LENGTH = 2048;
 var MAX_LOCATOR_LENGTH = 1024;
 var MAX_TEXT_LENGTH = 500;
@@ -468,7 +842,7 @@ function canonicalizeBrowserCheckoutTarget(snapshot) {
 }
 function fingerprintBrowserCheckoutTarget(snapshot) {
   const canonical = canonicalizeBrowserCheckoutTarget(snapshot);
-  const digest = (0, import_node_crypto.createHash)("sha256").update(JSON.stringify(canonical)).digest("hex");
+  const digest = (0, import_node_crypto2.createHash)("sha256").update(JSON.stringify(canonical)).digest("hex");
   return `browser_target_sha256_${digest}`;
 }
 function createVerifiedBrowserCheckoutDriver(resolver) {
@@ -552,14 +926,51 @@ var ContoAdmin = class {
     this.cards = new AdminCardsClient(this);
     this.policies = new PoliciesClient(this);
     this.team = new TeamClient(this);
+    this.purchasing = new AdminPurchasingClient(this);
   }
-  /** Make an authenticated request to the Conto API */
-  async request(method, path, body) {
+  /**
+   * Opens an authenticated server-sent event stream. Used by
+   * `purchasing.purchases.watch()`. The server closes it after about 50 seconds.
+   * @internal
+   */
+  async openStream(path, init = {}) {
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    init.signal?.addEventListener("abort", abort, { once: true });
+    const timeoutId = setTimeout(abort, Math.max(this.timeout, 7e4));
+    try {
+      const response = await fetch(`${this.baseUrl}${path}`, {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${__privateGet(this, _orgApiKey)}`,
+          Accept: "text/event-stream",
+          "User-Agent": `@conto_finance/sdk-admin/${import_package_version.SDK_PACKAGE_VERSION}`,
+          ...init.lastEventId ? { "Last-Event-ID": init.lastEventId } : {}
+        },
+        signal: controller.signal
+      });
+      if (!response.ok) {
+        const data = await readResponseData(response);
+        throw new ContoAdminError(
+          responseErrorMessage(data, response.status),
+          responseErrorMetadata(response, data)
+        );
+      }
+      return response;
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
+  /**
+   * Make an authenticated request to the Conto API. Reads retry. A write retries
+   * only when `idempotent` says the API deduplicates it, as purchase creation does.
+   */
+  async request(method, path, body, options = {}) {
     const url = `${this.baseUrl}${path}`;
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), this.timeout);
     const normalizedMethod = method.toUpperCase();
-    const retryable = ["GET", "HEAD", "OPTIONS"].includes(normalizedMethod);
+    const retryable = ["GET", "HEAD", "OPTIONS"].includes(normalizedMethod) || options.idempotent === true;
     try {
       const response = await fetchWithRetry(
         url,
@@ -1135,7 +1546,7 @@ var CheckoutApprovalTimeoutError = class extends ContoError {
   }
 };
 function generatedIdempotencyKey(prefix) {
-  return `${prefix}_${(0, import_node_crypto2.randomUUID)()}`;
+  return `${prefix}_${(0, import_node_crypto3.randomUUID)()}`;
 }
 function requireFinancialIdentifier(value, field) {
   if (!value || value.trim().length === 0) {
@@ -1203,6 +1614,8 @@ var Conto = class {
     this.testCards = new TestCardsClient(this);
     this.x402 = new X402Client(this);
     this.mpp = new MppClient(this);
+    this.purchases = new PurchasesClient(this);
+    this.recurringPurchases = new RecurringPurchasesClient(this);
   }
   /**
    * Normalize and durably revise a partial agent purchase proposal without
@@ -1487,6 +1900,39 @@ var Conto = class {
   async setup() {
     return this.request("GET", "/api/sdk/setup");
   }
+  /**
+   * Opens an authenticated server-sent event stream. Used by
+   * `purchases.watch()`. The server closes it after about 50 seconds.
+   * @internal
+   */
+  async openStream(path, init = {}) {
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    init.signal?.addEventListener("abort", abort, { once: true });
+    const timeoutId = setTimeout(abort, Math.max(this.timeout, 7e4));
+    try {
+      const response = await fetch(`${this.baseUrl}${path}`, {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${__privateGet(this, _apiKey)}`,
+          Accept: "text/event-stream",
+          "User-Agent": `@conto_finance/sdk/${import_package_version2.SDK_PACKAGE_VERSION}`,
+          ...init.lastEventId ? { "Last-Event-ID": init.lastEventId } : {}
+        },
+        signal: controller.signal
+      });
+      if (!response.ok) {
+        const data = await readResponseData(response);
+        throw new ContoError(
+          responseErrorMessage(data, response.status),
+          responseErrorMetadata(response, data)
+        );
+      }
+      return response;
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
   /** Make an authenticated request to the Conto API */
   async request(method, path, body, options = {}) {
     const url = `${this.baseUrl}${path}`;
@@ -1759,12 +2205,6 @@ var ConnectedCardsClient = class {
       currency: input.currency ?? "USD"
     });
   }
-  /**
-   * List the connected cards and active mandates this agent may draw against.
-   *
-   * The response is masked: no PAN and no provider tokens. This is a read-only
-   * GET, so transport retry on transient failures is safe.
-   */
   /** Record receipt after a fresh draw. Does not confirm checkout or payment settlement. */
   async acknowledgeDelivery(requestId) {
     return this.client.request(
@@ -1774,6 +2214,39 @@ var ConnectedCardsClient = class {
       { idempotent: true }
     );
   }
+  /**
+   * Report what happened with the card number after checkout.
+   *
+   * `USED` at the full approved amount closes the draw. `NOT_USED`, or `USED`
+   * with a smaller `amountMinor`, is recorded and shown to a person, who
+   * confirms it before the held amount is released. A report never releases
+   * held spend by itself and does not confirm settlement. Safe to repeat with
+   * the same report. A different second report gets HTTP 409.
+   *
+   * @example
+   * ```typescript
+   * await conto.connectedCards.reportOutcome(draw.requestId, { outcome: 'USED' });
+   * await conto.connectedCards.reportOutcome(draw.requestId, { outcome: 'USED', amountMinor: 1850 });
+   * await conto.connectedCards.reportOutcome(draw.requestId, { outcome: 'NOT_USED' });
+   * ```
+   */
+  async reportOutcome(requestId, report) {
+    return this.client.request(
+      "POST",
+      `/api/sdk/connected-cards/draws/${encodeURIComponent(requestId)}/outcome`,
+      {
+        outcome: report.outcome,
+        ...report.amountMinor !== void 0 ? { amountMinor: report.amountMinor } : {}
+      },
+      { idempotent: true }
+    );
+  }
+  /**
+   * List the connected cards and active mandates this agent may draw against.
+   *
+   * The response is masked: no PAN and no provider tokens. This is a read-only
+   * GET, so transport retry on transient failures is safe.
+   */
   async list() {
     return this.client.request("GET", "/api/sdk/connected-cards");
   }
@@ -2175,7 +2648,7 @@ function closedCheckpointError(checkpoint) {
   }
   return new CheckoutCheckpointClosedError(checkpoint);
 }
-function sleep(ms, signal) {
+function sleep2(ms, signal) {
   return new Promise((resolve, reject) => {
     if (signal?.aborted) {
       reject(signal.reason ?? new Error("Aborted"));
@@ -2192,11 +2665,11 @@ function sleep(ms, signal) {
     signal?.addEventListener("abort", onAbort, { once: true });
   });
 }
-var _client;
+var _client4;
 var CheckoutClient = class {
   constructor(client) {
-    __privateAdd(this, _client);
-    __privateSet(this, _client, client);
+    __privateAdd(this, _client4);
+    __privateSet(this, _client4, client);
   }
   /**
    * First checkpoint. Open the payment method only when the stage is APPROVED.
@@ -2216,7 +2689,7 @@ var CheckoutClient = class {
     if (input.currency !== void 0 && input.currency !== "USD") {
       throw checkoutError("Only USD checkouts are supported");
     }
-    const result = await __privateGet(this, _client).request(
+    const result = await __privateGet(this, _client4).request(
       "POST",
       "/api/sdk/checkout-checkpoints",
       {
@@ -2254,7 +2727,7 @@ var CheckoutClient = class {
       }
       const remaining = deadline - Date.now();
       if (remaining <= 0) throw new CheckoutApprovalTimeoutError(current);
-      await sleep(Math.min(pollIntervalMs, remaining), options.signal);
+      await sleep2(Math.min(pollIntervalMs, remaining), options.signal);
       current = await this.get(current.id);
     }
   }
@@ -2298,7 +2771,7 @@ var CheckoutClient = class {
       if (current.stage === "AWAITING_APPROVAL") throw new CheckoutApprovalPendingError(current);
     }
     try {
-      const result = await __privateGet(this, _client).request(
+      const result = await __privateGet(this, _client4).request(
         "POST",
         `/api/sdk/checkout-checkpoints/${encodeURIComponent(current.id)}/confirm`,
         {
@@ -2319,7 +2792,7 @@ var CheckoutClient = class {
   }
   /** Report what happened after a confirmed checkpoint. Safe to repeat with the same outcome. */
   async reportOutcome(checkpointId, input) {
-    const result = await __privateGet(this, _client).request(
+    const result = await __privateGet(this, _client4).request(
       "POST",
       `/api/sdk/checkout-checkpoints/${encodeURIComponent(checkpointId)}/outcome`,
       {
@@ -2335,7 +2808,7 @@ var CheckoutClient = class {
    * checkpoint waiting for the owner can be cancelled too.
    */
   async cancel(checkpointId) {
-    const result = await __privateGet(this, _client).request(
+    const result = await __privateGet(this, _client4).request(
       "POST",
       `/api/sdk/checkout-checkpoints/${encodeURIComponent(checkpointId)}/cancel`,
       {},
@@ -2344,16 +2817,17 @@ var CheckoutClient = class {
     return result.checkpoint;
   }
   async get(checkpointId) {
-    const result = await __privateGet(this, _client).request(
+    const result = await __privateGet(this, _client4).request(
       "GET",
       `/api/sdk/checkout-checkpoints/${encodeURIComponent(checkpointId)}`
     );
     return result.checkpoint;
   }
 };
-_client = new WeakMap();
+_client4 = new WeakMap();
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AdminPurchasingClient,
   BrowserActionFinalizationPendingError,
   BrowserCheckoutTargetVerificationError,
   CardsClient,
@@ -2371,8 +2845,15 @@ _client = new WeakMap();
   ControlledExternalCardPaymentTool,
   ExternalCardConfirmationPendingError,
   Giro,
+  OrganizationPurchasesClient,
+  OrganizationRecurringPurchasesClient,
+  PurchasesClient,
+  RecurringPurchasesClient,
   TestCardsClient,
   canonicalizeBrowserCheckoutTarget,
   createVerifiedBrowserCheckoutDriver,
-  fingerprintBrowserCheckoutTarget
+  fingerprintBrowserCheckoutTarget,
+  isFinalPurchaseStatus,
+  parseServerSentEvents,
+  verifyPurchaseWebhook
 });