@curless/agentbank-merchant-sdk 0.9.0 → 0.9.1

package/README.md

@@ -9,17 +9,21 @@ and you get:
 - **`checkout.openUCP`** — merchant-quoted **card** checkout over the **UCP** wire ([ucp.dev](https://ucp.dev)) — the UCP twin of `openACP` (same card settlement; reaches agents in the UCP ecosystem).
 - **`checkout.openX402`** — merchant-quoted **USDC (x402)** checkout. You set the authoritative USDC amount; the gateway freezes it and returns the x402 challenge; a buyer agent signs an EIP-3009 authorization and pays `{ sessionId }` on-chain. Settlement is on Base (mainnet or Sepolia, decided by your account/key) — your USDC lands at your address. The stablecoin twin of `openACP`.
 - **`orders`** — read your settled orders: `orders.list({ status, protocol, currency, from, to, limit, offset })` (filtered + paginated, with a total), `orders.get(id)` (one order in full + the card it was paid with), `orders.summary({…})` (count + gross by currency + breakdowns by protocol/status — a dashboard in one call).
-- **`AgentbankMerchant`** — typed client; also exposes `PaymentIntents` (create/get/capture/list/ledger-entries across ACP / x402 / AP2 / UCP / A2A), `PaymentLinks`, `Customers`, `BalanceTransactions`, and `WebhookEndpoints`. No refund method — refunds are Curless-originated (see below).
+- **`orders` refunds** — work the refund queue: `orders.listRefundRequests({ status })` (buyers' refund requests on your orders), `orders.approveRefund(id)` (approve → forwarded to Curless), `orders.rejectRefund(id, { note })`, and `orders.refund(orderId, { amount, reason })` (merchant-initiated direct refund, no buyer request). See **Refunds** below.
+- **`AgentbankMerchant`** — typed client; also exposes `PaymentIntents` (create/get/capture/list/ledger-entries across ACP / x402 / AP2 / UCP / A2A), `PaymentLinks`, `Customers`, `BalanceTransactions`, and `WebhookEndpoints`. (`PaymentIntents` has no `refund()` — the refund flow lives on `orders`.)
 - **`verifyWebhook` / `parseVerifiedWebhook`** — HMAC-SHA256 signature verification (Stripe-style `t=…,v1=…`), constant-time, **edge-safe** (Web Crypto, runs on Vercel Edge / Cloudflare Workers). Async — `await` them.
 - **`x402`** — emit/parse payments yourself (`buildChallenge()`, `decodeXPaymentHeader()`) **plus zero-crypto-knowledge helpers**: `usdc(network)` (contract + EIP-712 domain + decimals — no hardcoded hex), `isMainnet/isTestnet(network)`, `explorerTxUrl(network, txHash)` (a basescan / sepolia.basescan receipt link), `formatUsdc(baseUnits)` (exact 6-dp string, no float drift).
 
 agentbank never stores your catalog — the price you pass is authoritative, and you accept every agent-payment protocol with zero protocol code. One runtime dependency (`@curless/agentbank-core`). **Edge-safe** — Web Crypto only, no `node:` builtins. Node 18+.
 
-> **Refunds**: agentbank exposes no refund-initiation endpoint. The merchant
-> refunds in Curless (it holds the money); Curless executes the refund and
-> forwards the event, which advances the order/PI to `refunded` /
-> `partially_refunded`. Read the resulting state via `orders.list({ status:
-> 'refunded' })` or `paymentIntents.get()`.
+> **Refunds**: a buyer opens a refund request, or the merchant refunds directly
+> via `orders.refund(orderId)`. The merchant works the queue with
+> `orders.listRefundRequests` / `approveRefund` / `rejectRefund`. Approve forwards
+> the refund to Curless (which holds the money and executes the card refund); the
+> order flips to `refunded` / `partially_refunded` once Curless confirms via
+> webhook. Read the resulting state via `orders.list({ status: 'refunded' })` or
+> `paymentIntents.get()`. (agentbank never touches the rail directly — Curless
+> originates the actual money movement.)
 
 ## Fast path — open a merchant-quoted checkout
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@curless/agentbank-merchant-sdk",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "Merchant-side SDK for agentbank — accept agent payments: open a merchant-quoted card (ACP / UCP) or USDC (x402) checkout you price, list/summarize orders, PaymentIntents, edge-safe webhook verification, and x402 helpers.",
   "license": "MIT",
   "type": "module",