@curless/agentbank-sdk 0.1.2 → 0.2.0

package/README.md

@@ -56,6 +56,12 @@ if (auth.status === 'authorized') {
 ## Notes
 
 - **Amounts** are minor-unit integers (USD = cents).
-- **Errors** throw `AgentbankError` with `.status` + `.code`.
+- **Errors** throw `AgentbankError` with `.status` + `.code` — including
+  transport failures: `status === 0` with code `timeout` / `aborted` /
+  `network_error` means no HTTP response happened. One catch type.
+- **Timeouts**: every request has a 30s deadline by default. Tune per client
+  (`new Agentbank({ ..., timeoutMs })`) or per request
+  (`RequestOptions.timeoutMs`; `0` disables). `RequestOptions.signal` accepts
+  an `AbortSignal` for caller-side cancellation.
 - ESM-only; Node ≥ 18 (uses global `fetch`).
 - Pass `fetch` in the constructor to inject a custom implementation (tests, proxies).

package/dist/buyer-wallet.d.ts

@@ -0,0 +1,37 @@
+export type BuyerUser = {
+    id: string;
+    email: string;
+    name: string | null;
+    mode: string;
+};
+export type DeviceLogin = {
+    userCode: string;
+    verificationUri: string;
+    verificationUriComplete: string;
+    expiresIn: number;
+    interval: number;
+};
+export type BuyerSession = {
+    login: (email: string, password: string) => Promise<BuyerUser>;
+    /**
+     * Begin a browser sign-in for a client that has no browser.
+     *
+     * Returns where to send the person and a `wait()` that resolves when they
+     * finish there. The device code itself never leaves this object — it is the
+     * bearer credential that collects the resulting session, so handing it to a
+     * caller who only needs a URL would be handing out the login.
+     */
+    startDeviceLogin: () => Promise<DeviceLogin & {
+        wait: () => Promise<BuyerUser>;
+    }>;
+    fetch: <T>(path: string, init?: RequestInit) => Promise<T>;
+    current: () => BuyerUser | null;
+    /** Revoke the session server-side, then forget it. Safe to call signed out. */
+    logout: () => Promise<void>;
+};
+export declare const NOT_LOGGED_IN = "buyer_not_logged_in";
+export declare const SESSION_EXPIRED = "buyer_session_expired";
+export declare const createBuyerSession: (opts: {
+    baseUrl: string;
+}) => BuyerSession;
+//# sourceMappingURL=buyer-wallet.d.ts.map

package/dist/buyer-wallet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buyer-wallet.d.ts","sourceRoot":"","sources":["../src/buyer-wallet.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,SAAS,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzF,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/D;;;;;;;OAOG;IACH,gBAAgB,EAAE,MAAM,OAAO,CAAC,WAAW,GAAG;QAAE,IAAI,EAAE,MAAM,OAAO,CAAC,SAAS,CAAC,CAAA;KAAE,CAAC,CAAC;IAClF,KAAK,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,EAAE,MAAM,SAAS,GAAG,IAAI,CAAC;IAChC,+EAA+E;IAC/E,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B,CAAC;AAKF,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,eAAe,0BAA0B,CAAC;AAEvD,eAAO,MAAM,kBAAkB,GAAI,MAAM;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,YAsK9D,CAAC"}

package/dist/buyer-wallet.js

@@ -0,0 +1,132 @@
+import { AgentbankError, toError } from '@curless/agentbank-core';
+// Distinct codes so the model can tell the two states apart and say the right
+// thing to the person. Collapsing them is how "your session expired" gets
+// rendered as "you have no orders".
+export const NOT_LOGGED_IN = 'buyer_not_logged_in';
+export const SESSION_EXPIRED = 'buyer_session_expired';
+export const createBuyerSession = (opts) => {
+    let token = null;
+    let user = null;
+    // Wall-clock expiry from the server's expiresIn, so an obviously-dead token
+    // is reported as expired without a round-trip that would 401 anyway.
+    let expiresAt = 0;
+    const call = async (path, init = {}, bearer, 
+    // Statuses that carry a meaningful body rather than an error. Device
+    // polling uses it: 202 means "not yet", which is an answer.
+    alsoOk) => {
+        let res;
+        try {
+            res = await fetch(`${opts.baseUrl}${path}`, {
+                ...init,
+                headers: {
+                    'content-type': 'application/json',
+                    ...(bearer ? { authorization: `Bearer ${bearer}` } : {}),
+                    ...(init.headers ?? {}),
+                },
+            });
+        }
+        catch (err) {
+            throw new AgentbankError(0, 'network_error', `agentbank API unreachable at ${opts.baseUrl}: ${err.message}`);
+        }
+        if (!res.ok && !alsoOk?.(res.status)) {
+            const text = await res.text().catch(() => '');
+            let json;
+            try {
+                json = text ? JSON.parse(text) : undefined;
+            }
+            catch {
+                json = undefined;
+            }
+            throw toError(res.status, json);
+        }
+        return (await res.json());
+    };
+    const adopt = (body) => {
+        token = body.token;
+        user = body.user;
+        expiresAt = Date.now() + body.expiresIn * 1000;
+        return body.user;
+    };
+    return {
+        startDeviceLogin: async () => {
+            const started = await call('/v1/buyer/device', {
+                method: 'POST',
+                body: '{}',
+            });
+            const deadline = Date.now() + started.expiresIn * 1000;
+            const wait = async () => {
+                // Server-driven interval, and it can raise it: a `slow_down` that the
+                // client ignores is a client that keeps being told to slow down.
+                let waitMs = started.interval * 1000;
+                while (Date.now() < deadline) {
+                    await new Promise((r) => setTimeout(r, waitMs));
+                    const res = await call('/v1/buyer/device/token', { method: 'POST', body: JSON.stringify({ deviceCode: started.deviceCode }) }, undefined, 
+                    // 202 is "not finished", not a failure — the generic error path
+                    // would abandon a login the person is still completing.
+                    (status) => status === 202).catch((err) => {
+                        throw err;
+                    });
+                    if (res.status === 'approved' && res.token && res.user) {
+                        return adopt({ token: res.token, expiresIn: res.expiresIn ?? 3600, user: res.user });
+                    }
+                    if (res.status === 'slow_down')
+                        waitMs = Math.min(waitMs * 2, 10_000);
+                }
+                throw new AgentbankError(408, 'buyer_login_timeout', 'the sign-in was not completed in time — start it again');
+            };
+            const { deviceCode: _secret, ...publicPart } = started;
+            return { ...publicPart, wait };
+        },
+        login: async (email, password) => {
+            const body = await call('/v1/buyer/session', { method: 'POST', body: JSON.stringify({ email, password }) });
+            return adopt(body);
+        },
+        fetch: async (path, init = {}) => {
+            if (!token) {
+                throw new AgentbankError(401, NOT_LOGGED_IN, 'no wallet session on this server yet — call wallet_login with the buyer’s email first');
+            }
+            if (Date.now() >= expiresAt) {
+                // Say it plainly and drop the dead token. A stale bearer that keeps
+                // getting sent turns every wallet read into an opaque 401, and an
+                // expired session rendered as an empty balance is a lie about money.
+                token = null;
+                const who = user?.email;
+                user = null;
+                throw new AgentbankError(401, SESSION_EXPIRED, `the wallet session${who ? ` for ${who}` : ''} has expired — call wallet_login again. This is NOT a zero balance and NOT an empty order list.`);
+            }
+            try {
+                return await call(path, init, token);
+            }
+            catch (err) {
+                // The server rejected a token we believed in — revoked, or signed by a
+                // deployment that has since rotated its secret. Same rule: report the
+                // session, not the resource.
+                //
+                // ⚠️ 401 ONLY. A 403 means the server knows exactly who this is and is
+                // refusing the ACTION — "over the limit you set", "live mode", "this
+                // wallet is suspended". Treating those as an expired session signs the
+                // person out for hitting their own spend cap, and then they cannot even
+                // raise it, because raising it needs the session they just lost.
+                if (err instanceof AgentbankError && err.status === 401) {
+                    token = null;
+                    user = null;
+                    throw new AgentbankError(err.status, SESSION_EXPIRED, `the wallet session is no longer valid — call wallet_login again. This is NOT a zero balance and NOT an empty order list. (${err.message})`);
+                }
+                throw err;
+            }
+        },
+        current: () => user,
+        logout: async () => {
+            // Tell the server FIRST, while the credential still works. Forgetting it
+            // locally and then trying to revoke would leave a live token nobody can
+            // reach — a sign-out in appearance only.
+            if (token) {
+                await call('/v1/buyer/session/revoke', { method: 'POST', body: '{}' }, token).catch(() => undefined);
+            }
+            token = null;
+            user = null;
+            expiresAt = 0;
+        },
+    };
+};
+//# sourceMappingURL=buyer-wallet.js.map

package/dist/buyer-wallet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buyer-wallet.js","sourceRoot":"","sources":["../src/buyer-wallet.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAsClE,8EAA8E;AAC9E,0EAA0E;AAC1E,oCAAoC;AACpC,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AACnD,MAAM,CAAC,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,IAAyB,EAAgB,EAAE;IAC5E,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,IAAI,GAAqB,IAAI,CAAC;IAClC,4EAA4E;IAC5E,qEAAqE;IACrE,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,MAAM,IAAI,GAAG,KAAK,EAChB,IAAY,EACZ,OAAoB,EAAE,EACtB,MAAe;IACf,qEAAqE;IACrE,4DAA4D;IAC5D,MAAoC,EACxB,EAAE;QACd,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;gBAC1C,GAAG,IAAI;gBACP,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACxD,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;iBACxB;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CACtB,CAAC,EACD,eAAe,EACf,gCAAgC,IAAI,CAAC,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,CAC1E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;IACjC,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,IAA2D,EAAa,EAAE;QACvF,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACnB,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACjB,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QAC/C,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC,CAAC;IAEF,OAAO;QACL,gBAAgB,EAAE,KAAK,IAAI,EAAE;YAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAuC,kBAAkB,EAAE;gBACnF,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI;aACX,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;YAEvD,MAAM,IAAI,GAAG,KAAK,IAAwB,EAAE;gBAC1C,sEAAsE;gBACtE,iEAAiE;gBACjE,IAAI,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACrC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;oBAC7B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;oBAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAMpB,wBAAwB,EACxB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,EAC5E,SAAS;oBACT,gEAAgE;oBAChE,wDAAwD;oBACxD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,GAAG,CAC3B,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;wBACd,MAAM,GAAG,CAAC;oBACZ,CAAC,CAAC,CAAC;oBACH,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;wBACvD,OAAO,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;oBACvF,CAAC;oBACD,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;wBAAE,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;gBACxE,CAAC;gBACD,MAAM,IAAI,cAAc,CACtB,GAAG,EACH,qBAAqB,EACrB,wDAAwD,CACzD,CAAC;YACJ,CAAC,CAAC;YAEF,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,OAAO,CAAC;YACvD,OAAO,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC;QACjC,CAAC;QAED,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CACrB,mBAAmB,EACnB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAC9D,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAED,KAAK,EAAE,KAAK,EAAK,IAAY,EAAE,OAAoB,EAAE,EAAc,EAAE;YACnE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,cAAc,CACtB,GAAG,EACH,aAAa,EACb,uFAAuF,CACxF,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,EAAE,CAAC;gBAC5B,oEAAoE;gBACpE,kEAAkE;gBAClE,qEAAqE;gBACrE,KAAK,GAAG,IAAI,CAAC;gBACb,MAAM,GAAG,GAAG,IAAI,EAAE,KAAK,CAAC;gBACxB,IAAI,GAAG,IAAI,CAAC;gBACZ,MAAM,IAAI,cAAc,CACtB,GAAG,EACH,eAAe,EACf,qBAAqB,GAAG,CAAC,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,iGAAiG,CAC/I,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,uEAAuE;gBACvE,sEAAsE;gBACtE,6BAA6B;gBAC7B,EAAE;gBACF,uEAAuE;gBACvE,qEAAqE;gBACrE,uEAAuE;gBACvE,wEAAwE;gBACxE,iEAAiE;gBACjE,IAAI,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACxD,KAAK,GAAG,IAAI,CAAC;oBACb,IAAI,GAAG,IAAI,CAAC;oBACZ,MAAM,IAAI,cAAc,CACtB,GAAG,CAAC,MAAM,EACV,eAAe,EACf,6HAA6H,GAAG,CAAC,OAAO,GAAG,CAC5I,CAAC;gBACJ,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI;QACnB,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,yEAAyE;YACzE,wEAAwE;YACxE,yCAAyC;YACzC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC,KAAK,CACjF,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;YACJ,CAAC;YACD,KAAK,GAAG,IAAI,CAAC;YACb,IAAI,GAAG,IAAI,CAAC;YACZ,SAAS,GAAG,CAAC,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/index.d.ts

@@ -1,6 +1,15 @@
 export { Agentbank } from './client.js';
 export type { AgentbankOptions, FetchLike, RequestOptions } from './client.js';
-export { AgentbankError } from '@curless/agentbank-core';
+export { AgentbankError, toError } from '@curless/agentbank-core';
+/**
+ * The buyer's wallet session — the face an integrator actually uses.
+ *
+ * It lives HERE, not in @curless/agentbank-core: core is the shared kernel
+ * (crypto, errors, HTTP) that every package builds on, and nobody outside this
+ * repo should be importing it directly. This is the official buyer SDK, so this
+ * is where a buyer-side capability belongs.
+ */
+export { NOT_LOGGED_IN, SESSION_EXPIRED, type BuyerSession, type BuyerUser, type DeviceLogin, createBuyerSession, } from './buyer-wallet.js';
 export type { CreateAgentInput, UpdateAgentInput, AgentCredentialScope, } from './resources/agents.js';
 export type { CreateCustomerInput, UpdateCustomerInput } from './resources/customers.js';
 export type { CatalogItem, Merchant } from './resources/merchants.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,YAAY,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACzF,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACtE,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,YAAY,EACV,KAAK,EACL,eAAe,EACf,sBAAsB,EACtB,WAAW,EACX,kBAAkB,EAClB,QAAQ,EACR,cAAc,EACd,eAAe,EACf,QAAQ,EACR,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,wBAAwB,EACxB,WAAW,EACX,aAAa,GACd,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,YAAY,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAElE;;;;;;;GAOG;AACH,OAAO,EACL,aAAa,EACb,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACzF,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACtE,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,YAAY,EACV,KAAK,EACL,eAAe,EACf,sBAAsB,EACtB,WAAW,EACX,kBAAkB,EAClB,QAAQ,EACR,cAAc,EACd,eAAe,EACf,QAAQ,EACR,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,wBAAwB,EACxB,WAAW,EACX,aAAa,GACd,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,3 +1,12 @@
 export { Agentbank } from './client.js';
-export { AgentbankError } from '@curless/agentbank-core';
+export { AgentbankError, toError } from '@curless/agentbank-core';
+/**
+ * The buyer's wallet session — the face an integrator actually uses.
+ *
+ * It lives HERE, not in @curless/agentbank-core: core is the shared kernel
+ * (crypto, errors, HTTP) that every package builds on, and nobody outside this
+ * repo should be importing it directly. This is the official buyer SDK, so this
+ * is where a buyer-side capability belongs.
+ */
+export { NOT_LOGGED_IN, SESSION_EXPIRED, createBuyerSession, } from './buyer-wallet.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAElE;;;;;;;GAOG;AACH,OAAO,EACL,aAAa,EACb,eAAe,EAIf,kBAAkB,GACnB,MAAM,mBAAmB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@curless/agentbank-sdk",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "Official buyer/agent SDK for agentbank — OAuth, agent + customer management, Wallets, and the Pay spend-control plane.",
   "license": "MIT",
   "type": "module",
@@ -17,7 +17,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@curless/agentbank-core": "^0.1.1"
+    "@curless/agentbank-core": "^0.7.0"
   },
   "devDependencies": {
     "@types/node": "^22.10.1",
@@ -39,7 +39,7 @@
   "repository": {
     "type": "git",
     "url": "git+https://gitlab.com/robin-ruan/agentbank.git",
-    "directory": "packages/sdk"
+    "directory": "packages/sdks/sdk"
   },
   "author": "robin",
   "scripts": {