@conto_finance/sdk 0.6.1 → 0.6.2-beta.1

package/README.md

@@ -80,6 +80,9 @@ if (checkpoint.stage === 'AWAITING_APPROVAL') {
   // The agent's rules need the owner. Throws if the owner rejects or the approval expires.
   checkpoint = await conto.checkout.waitForApproval(checkpoint, { timeoutMs: 15 * 60_000 });
 }
+if (checkpoint.stage !== 'APPROVED') {
+  throw new Error('Inspect the existing purchase before continuing.');
+}
 // Open Link. The buyer signs in and the final total appears.
 
 const confirmed = await conto.checkout.confirm(checkpoint, {
@@ -107,6 +110,68 @@ await conto.checkout.reportOutcome(confirmed.id, { outcome: 'PAID', reference: o
 - Conto records what your checkout reports and does not see the charge. For control at the
   moment of payment, pay with a Conto-managed wallet or a card Conto authorizes.
 
+## Stripe Link cards
+
+The Link controls integration kit targets SDK `0.6.2-beta.1`. Install the bundled
+tarball when evaluating that candidate; packaging does not publish it to npm.
+The [minimal trusted-runtime example](https://github.com/Conto-Finance/conto/tree/main/examples/link-wallet-agent)
+uses the existing agent SDK key, requires no shopping frontend, and never pays.
+
+Stripe Link is Stripe's payment wallet, and Conto integrates with it. `conto.checkout.getLinkCard()`
+asks Conto first, then asks Stripe Link for a card only after Conto approves the purchase, for
+exactly the approved amount at that store. Stripe Link issues the card. It runs Stripe's `link-cli`
+on your machine with your own Link login (`npm i -g @stripe/link-cli`, then `link-cli auth login`).
+The person approves each card in the Link app. Conto does not receive the card. It stores only the
+Link request ID.
+
+```typescript
+import { linkCliWallet } from '@conto_finance/sdk/link-wallet';
+
+const wallet = linkCliWallet({ test: true });
+
+// At the payment step, once the final total with shipping and tax is known.
+const result = await conto.checkout.getLinkCard({
+  idempotencyKey: order.id,
+  merchant: { id: 'acme-retail', name: 'ACME Retail', checkoutUrl: page.url() },
+  amountMinor: 8532,
+  purpose: 'Drip coffee maker the shopper chose',
+  lineItems: [{ name: 'Drip coffee maker', quantity: 1, unitAmountMinor: 7900 }],
+  wallet,
+});
+
+// Fill in result.card in the store's card form, then right before paying:
+const confirmed = await conto.checkout.confirm(result.checkpoint, {
+  amountMinor: 8532,
+  lineItems: observedItems,
+  totals: observedCharges,
+  paymentReference: result.paymentReference,
+});
+// Pay, then report the outcome with the same paymentReference.
+```
+
+- Link is never asked for a card before Conto approves. A denial at Conto throws before any Link
+  call. When a rule requires approval, `getLinkCard()` waits for the owner first.
+- When the person declines in Link, the request expires, the wait passes `linkApprovalTimeoutMs`,
+  or `link-cli` is missing or logged out, `getLinkCard()` cancels the checkpoint to release the
+  held spend and throws `LinkCardDeniedError`, `LinkCardExpiredError`, `LinkCardTimeoutError`, or
+  `LinkWalletUnavailableError`. All extend `LinkCardError`. Do not pay.
+- Retrying with the same input resumes the same checkpoint and Link request.
+- The card (`number`, `securityValue` for the CVC, `expMonth`, `expYear`, `validUntil`, `last4`,
+  `brand`) stays in this process. Printing or serializing the result shows only the last four
+  digits. It never appears in an error.
+- The card covers the approved total, so `confirm()` with a `paymentReference` refuses a
+  different total. Call `conto.checkout.replaceLinkCard(result, { wallet, amountMinor })` to
+  cancel the old card and checkpoint and get a card for the final total.
+- Any `LinkWallet` works in place of `linkCliWallet()`: it creates a card request, waits for
+  approval, retrieves the card, and cancels.
+- The protection holds only when the agent cannot also run `link-cli`, use a shell, or call Link
+  with your credentials itself.
+- Pass observed final items and charges to `confirm()` even when the total is unchanged.
+  The server rejects a changed cart against the approved intent. The trusted host must
+  validate the actual merchant and checkout, own a durable one-use payment dispatch
+  claim, and keep card use outside model tools. Replaying a confirmed checkpoint is
+  not permission to submit payment again.
+
 ## External-card Policy Overlay
 
 The admin client registers only a masked card alias and assigns cooperative

package/dist/browserbase.d.mts

@@ -1,6 +1,7 @@
 import { Browser } from 'playwright-core';
 import { GuardedPlaywrightCheckoutHttpHandler, PlaywrightSessionObservation, GuardedPlaywrightCheckoutClient, PlaywrightCdpSessionRegistryConfig, EncryptedPlaywrightCheckoutTargetStoreConfig, GuardedPlaywrightCheckoutRuntimeConfig } from './playwright.mjs';
 import './index.mjs';
+import './link-wallet.mjs';
 
 /** Exact provider endpoints verified against Browserbase's session API; never use a wildcard. */
 declare const BROWSERBASE_CONNECT_ORIGINS: readonly string[];

package/dist/browserbase.d.ts

@@ -1,6 +1,7 @@
 import { Browser } from 'playwright-core';
 import { GuardedPlaywrightCheckoutHttpHandler, PlaywrightSessionObservation, GuardedPlaywrightCheckoutClient, PlaywrightCdpSessionRegistryConfig, EncryptedPlaywrightCheckoutTargetStoreConfig, GuardedPlaywrightCheckoutRuntimeConfig } from './playwright.js';
 import './index.js';
+import './link-wallet.js';
 
 /** Exact provider endpoints verified against Browserbase's session API; never use a wildcard. */
 declare const BROWSERBASE_CONNECT_ORIGINS: readonly string[];

package/dist/browserbase.mjs

@@ -2,7 +2,7 @@ import {
   createGuardedPlaywrightCheckoutRuntimeHost
 } from "./chunk-VSIO6PYA.mjs";
 import "./chunk-O5RAAB2U.mjs";
-import "./chunk-WSIKPUZJ.mjs";
+import "./chunk-TGOYFBKZ.mjs";
 
 // src/browserbase.ts
 import { createHmac, timingSafeEqual } from "crypto";

package/dist/checkout-verifier.mjs

@@ -1,4 +1,4 @@
-import "./chunk-WSIKPUZJ.mjs";
+import "./chunk-TGOYFBKZ.mjs";
 
 // src/checkout-verifier.ts
 import { createHash, randomUUID } from "crypto";

package/dist/{chunk-WSIKPUZJ.mjs → chunk-TGOYFBKZ.mjs}

@@ -34,11 +34,13 @@ var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot
 var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
 var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
+var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
 
 export {
   __commonJS,
   __toESM,
   __privateGet,
   __privateAdd,
-  __privateSet
+  __privateSet,
+  __privateMethod
 };