@mixrpay/agent-sdk 0.6.1 → 0.7.0

package/dist/index.cjs

@@ -23,6 +23,7 @@ __export(index_exports, {
   AgentWallet: () => AgentWallet,
   InsufficientBalanceError: () => InsufficientBalanceError,
   InvalidSessionKeyError: () => InvalidSessionKeyError,
+  MerchantNotAllowedError: () => MerchantNotAllowedError,
   MixrPayError: () => MixrPayError,
   PaymentFailedError: () => PaymentFailedError,
   SDK_VERSION: () => SDK_VERSION,
@@ -265,6 +266,23 @@ var SessionRevokedError = class extends MixrPayError {
     this.reason = reason;
   }
 };
+var MerchantNotAllowedError = class extends MixrPayError {
+  /** The merchant/tool that was attempted */
+  attempted;
+  /** The patterns that are allowed by the session */
+  allowedPatterns;
+  constructor(attempted, allowedPatterns) {
+    const patternsPreview = allowedPatterns.slice(0, 3).join(", ");
+    const suffix = allowedPatterns.length > 3 ? "..." : "";
+    super(
+      `Payment to "${attempted}" not allowed. Session allowlist: ${patternsPreview}${suffix}. Update the session allowlist or create a new session.`,
+      "MERCHANT_NOT_ALLOWED"
+    );
+    this.name = "MerchantNotAllowedError";
+    this.attempted = attempted;
+    this.allowedPatterns = allowedPatterns;
+  }
+};
 function isMixrPayError(error) {
   return error instanceof MixrPayError;
 }
@@ -575,6 +593,9 @@ var AgentWallet = class {
   // Session key info cache
   sessionKeyInfo;
   sessionKeyInfoFetchedAt;
+  // Merchant allowlist (fetched from server)
+  allowlist;
+  allowlistFetchedAt;
   /**
    * Create a new AgentWallet instance.
    * 
@@ -651,6 +672,126 @@ var AgentWallet = class {
     }
   }
   // ===========================================================================
+  // Merchant Allowlist Validation
+  // ===========================================================================
+  /**
+   * Fetch the merchant allowlist from the server.
+   * Caches the result for 5 minutes to avoid excessive API calls.
+   */
+  async fetchAllowlist() {
+    const CACHE_TTL_MS = 5 * 60 * 1e3;
+    if (this.allowlist !== void 0 && this.allowlistFetchedAt) {
+      const age = Date.now() - this.allowlistFetchedAt;
+      if (age < CACHE_TTL_MS) {
+        return this.allowlist;
+      }
+    }
+    try {
+      const info = await this.getSessionKeyInfo();
+      this.allowlist = info.allowedMerchants || [];
+      this.allowlistFetchedAt = Date.now();
+      this.logger.debug("Fetched allowlist", {
+        patterns: this.allowlist.length,
+        allowAll: this.allowlist.length === 0
+      });
+      return this.allowlist;
+    } catch (error) {
+      this.logger.warn("Failed to fetch allowlist, allowing all merchants", { error });
+      this.allowlist = [];
+      this.allowlistFetchedAt = Date.now();
+      return this.allowlist;
+    }
+  }
+  /**
+   * Validate that a target is allowed by the session's allowlist.
+   * 
+   * @param target - URL, domain, or tool name to check
+   * @param type - Type of target: 'url' for HTTP requests, 'tool' for MCP tools
+   * @throws {MerchantNotAllowedError} If target is not in allowlist
+   */
+  async validateMerchantAllowed(target, type) {
+    const allowlist = await this.fetchAllowlist();
+    if (allowlist.length === 0) {
+      return;
+    }
+    const isAllowed = this.matchesAllowlist(target, allowlist, type);
+    if (!isAllowed) {
+      throw new MerchantNotAllowedError(target, allowlist);
+    }
+  }
+  /**
+   * Check if a target matches any pattern in the allowlist.
+   */
+  matchesAllowlist(target, allowlist, type) {
+    for (const pattern of allowlist) {
+      if (this.matchPattern(target, pattern, type)) {
+        return true;
+      }
+    }
+    return false;
+  }
+  /**
+   * Check if a target matches a single pattern.
+   */
+  matchPattern(target, pattern, type) {
+    if (type === "url") {
+      return this.matchUrlPattern(target, pattern);
+    } else {
+      return this.matchToolPattern(target, pattern);
+    }
+  }
+  /**
+   * Match a URL or domain against a pattern.
+   */
+  matchUrlPattern(target, pattern) {
+    let hostname;
+    try {
+      if (target.includes("://")) {
+        const url = new URL(target);
+        hostname = url.hostname.toLowerCase();
+      } else {
+        hostname = target.toLowerCase();
+      }
+    } catch {
+      return false;
+    }
+    const normalizedPattern = pattern.toLowerCase().trim();
+    let patternDomain = normalizedPattern;
+    if (patternDomain.includes("://")) {
+      try {
+        patternDomain = new URL(patternDomain).hostname;
+      } catch {
+      }
+    }
+    if (hostname === patternDomain) {
+      return true;
+    }
+    if (patternDomain.startsWith("*.")) {
+      const baseDomain = patternDomain.substring(2);
+      if (hostname.endsWith(`.${baseDomain}`) && hostname !== baseDomain) {
+        return true;
+      }
+    }
+    return false;
+  }
+  /**
+   * Match an MCP tool name against a pattern.
+   */
+  matchToolPattern(toolName, pattern) {
+    const normalizedTool = toolName.toLowerCase().trim();
+    const normalizedPattern = pattern.toLowerCase().trim();
+    if (normalizedTool === normalizedPattern) {
+      return true;
+    }
+    if (normalizedPattern.endsWith("/*")) {
+      const baseProvider = normalizedPattern.substring(0, normalizedPattern.length - 2);
+      if (normalizedTool.startsWith(`${baseProvider}/`)) {
+        return true;
+      }
+    }
+    return false;
+  }
+  // ===========================================================================
   // Static Agent Registration Methods
   // ===========================================================================
   /**
@@ -1038,6 +1179,7 @@ var AgentWallet = class {
    */
   async fetch(url, init) {
     this.logger.debug(`Fetching ${init?.method || "GET"} ${url}`);
+    await this.validateMerchantAllowed(url, "url");
     const requestId = crypto.randomUUID();
     const correlationId = this.extractCorrelationId(init?.headers);
     const controller = new AbortController();
@@ -1311,7 +1453,8 @@ var AgentWallet = class {
           },
           expiresAt: data.expires_at ? new Date(data.expires_at) : null,
           createdAt: data.created_at ? new Date(data.created_at) : null,
-          name: data.name
+          name: data.name,
+          allowedMerchants: data.allowed_merchants ?? data.allowedMerchants ?? []
         };
         this.sessionKeyInfoFetchedAt = Date.now();
         return this.sessionKeyInfo;
@@ -1877,6 +2020,7 @@ var AgentWallet = class {
       feature
     } = options;
     this.logger.debug("callMerchantApi", { url, method, merchantPublicKey, priceUsd });
+    await this.validateMerchantAllowed(url, "url");
     if (priceUsd !== void 0 && this.maxPaymentUsd !== void 0 && priceUsd > this.maxPaymentUsd) {
       throw new SpendingLimitExceededError("client_max", this.maxPaymentUsd, priceUsd);
     }
@@ -2084,6 +2228,7 @@ Timestamp: ${timestamp}`;
    */
   async callMCPTool(toolName, args = {}) {
     this.logger.debug("callMCPTool", { toolName, args });
+    await this.validateMerchantAllowed(toolName, "tool");
     const authHeaders = await this.getMCPAuthHeaders();
     const response = await fetch(`${this.baseUrl}/api/mcp`, {
       method: "POST",
@@ -2473,6 +2618,7 @@ Timestamp: ${timestamp}`;
    */
   async callMCPToolWithSession(sessionId, toolName, args = {}) {
     this.logger.debug("callMCPToolWithSession", { sessionId, toolName, args });
+    await this.validateMerchantAllowed(toolName, "tool");
     const response = await fetch(`${this.baseUrl}/api/mcp`, {
       method: "POST",
       headers: {
@@ -2523,6 +2669,7 @@ Timestamp: ${timestamp}`;
   AgentWallet,
   InsufficientBalanceError,
   InvalidSessionKeyError,
+  MerchantNotAllowedError,
   MixrPayError,
   PaymentFailedError,
   SDK_VERSION,

package/dist/index.d.cts

@@ -158,6 +158,8 @@ interface SessionKeyInfo {
     createdAt: Date | null;
     /** Optional name given to this session key */
     name?: string;
+    /** Allowed merchants/tools (empty = allow all) */
+    allowedMerchants?: string[];
 }
 /**
  * Spending statistics for the current session.
@@ -561,6 +563,8 @@ declare class AgentWallet {
     private totalSpentUsd;
     private sessionKeyInfo?;
     private sessionKeyInfoFetchedAt?;
+    private allowlist?;
+    private allowlistFetchedAt?;
     /**
      * Create a new AgentWallet instance.
      *
@@ -590,6 +594,35 @@ declare class AgentWallet {
      * Validate the configuration before initialization.
      */
     private validateConfig;
+    /**
+     * Fetch the merchant allowlist from the server.
+     * Caches the result for 5 minutes to avoid excessive API calls.
+     */
+    private fetchAllowlist;
+    /**
+     * Validate that a target is allowed by the session's allowlist.
+     *
+     * @param target - URL, domain, or tool name to check
+     * @param type - Type of target: 'url' for HTTP requests, 'tool' for MCP tools
+     * @throws {MerchantNotAllowedError} If target is not in allowlist
+     */
+    private validateMerchantAllowed;
+    /**
+     * Check if a target matches any pattern in the allowlist.
+     */
+    private matchesAllowlist;
+    /**
+     * Check if a target matches a single pattern.
+     */
+    private matchPattern;
+    /**
+     * Match a URL or domain against a pattern.
+     */
+    private matchUrlPattern;
+    /**
+     * Match an MCP tool name against a pattern.
+     */
+    private matchToolPattern;
     /**
      * Register a new agent with MixrPay.
      *
@@ -1783,6 +1816,34 @@ declare class SessionRevokedError extends MixrPayError {
     readonly reason?: string;
     constructor(sessionId: string, reason?: string);
 }
+/**
+ * Thrown when a payment is attempted to a merchant/tool not in the session's allowlist.
+ *
+ * This error indicates the session key has a configured allowlist that doesn't
+ * include the target merchant or tool.
+ *
+ * ## Resolution
+ * 1. Update the session's allowlist to include the target
+ * 2. Create a new session with the correct allowlist
+ * 3. Use a session without allowlist restrictions
+ *
+ * @example
+ * ```typescript
+ * catch (error) {
+ *   if (error instanceof MerchantNotAllowedError) {
+ *     console.log(`Cannot pay "${error.attempted}"`);
+ *     console.log(`Allowed patterns: ${error.allowedPatterns.join(', ')}`);
+ *   }
+ * }
+ * ```
+ */
+declare class MerchantNotAllowedError extends MixrPayError {
+    /** The merchant/tool that was attempted */
+    readonly attempted: string;
+    /** The patterns that are allowed by the session */
+    readonly allowedPatterns: string[];
+    constructor(attempted: string, allowedPatterns: string[]);
+}
 /**
  * Check if an error is a MixrPay SDK error.
  *
@@ -1819,4 +1880,4 @@ declare function isMixrPayError(error: unknown): error is MixrPayError;
  */
 declare function getErrorMessage(error: unknown): string;
 
-export { type AgentMessage, type AgentRunConfig, type AgentRunEvent, type AgentRunOptions, type AgentRunResult, type AgentRunStatusResult, AgentWallet, type AgentWalletConfig, type CallMerchantApiOptions, type ChargeResult, type DiagnosticsResult, InsufficientBalanceError, InvalidSessionKeyError, MixrPayError, type PaymentEvent, PaymentFailedError, SDK_VERSION, type SessionAuthorization, SessionExpiredError, SessionKeyExpiredError, type SessionKeyInfo, SessionLimitExceededError, SessionNotFoundError, SessionRevokedError, type SessionStats, SpendingLimitExceededError, type SpendingStats, X402ProtocolError, getErrorMessage, isMixrPayError };
+export { type AgentMessage, type AgentRunConfig, type AgentRunEvent, type AgentRunOptions, type AgentRunResult, type AgentRunStatusResult, AgentWallet, type AgentWalletConfig, type CallMerchantApiOptions, type ChargeResult, type DiagnosticsResult, InsufficientBalanceError, InvalidSessionKeyError, MerchantNotAllowedError, MixrPayError, type PaymentEvent, PaymentFailedError, SDK_VERSION, type SessionAuthorization, SessionExpiredError, SessionKeyExpiredError, type SessionKeyInfo, SessionLimitExceededError, SessionNotFoundError, SessionRevokedError, type SessionStats, SpendingLimitExceededError, type SpendingStats, X402ProtocolError, getErrorMessage, isMixrPayError };

package/dist/index.d.ts

@@ -158,6 +158,8 @@ interface SessionKeyInfo {
     createdAt: Date | null;
     /** Optional name given to this session key */
     name?: string;
+    /** Allowed merchants/tools (empty = allow all) */
+    allowedMerchants?: string[];
 }
 /**
  * Spending statistics for the current session.
@@ -561,6 +563,8 @@ declare class AgentWallet {
     private totalSpentUsd;
     private sessionKeyInfo?;
     private sessionKeyInfoFetchedAt?;
+    private allowlist?;
+    private allowlistFetchedAt?;
     /**
      * Create a new AgentWallet instance.
      *
@@ -590,6 +594,35 @@ declare class AgentWallet {
      * Validate the configuration before initialization.
      */
     private validateConfig;
+    /**
+     * Fetch the merchant allowlist from the server.
+     * Caches the result for 5 minutes to avoid excessive API calls.
+     */
+    private fetchAllowlist;
+    /**
+     * Validate that a target is allowed by the session's allowlist.
+     *
+     * @param target - URL, domain, or tool name to check
+     * @param type - Type of target: 'url' for HTTP requests, 'tool' for MCP tools
+     * @throws {MerchantNotAllowedError} If target is not in allowlist
+     */
+    private validateMerchantAllowed;
+    /**
+     * Check if a target matches any pattern in the allowlist.
+     */
+    private matchesAllowlist;
+    /**
+     * Check if a target matches a single pattern.
+     */
+    private matchPattern;
+    /**
+     * Match a URL or domain against a pattern.
+     */
+    private matchUrlPattern;
+    /**
+     * Match an MCP tool name against a pattern.
+     */
+    private matchToolPattern;
     /**
      * Register a new agent with MixrPay.
      *
@@ -1783,6 +1816,34 @@ declare class SessionRevokedError extends MixrPayError {
     readonly reason?: string;
     constructor(sessionId: string, reason?: string);
 }
+/**
+ * Thrown when a payment is attempted to a merchant/tool not in the session's allowlist.
+ *
+ * This error indicates the session key has a configured allowlist that doesn't
+ * include the target merchant or tool.
+ *
+ * ## Resolution
+ * 1. Update the session's allowlist to include the target
+ * 2. Create a new session with the correct allowlist
+ * 3. Use a session without allowlist restrictions
+ *
+ * @example
+ * ```typescript
+ * catch (error) {
+ *   if (error instanceof MerchantNotAllowedError) {
+ *     console.log(`Cannot pay "${error.attempted}"`);
+ *     console.log(`Allowed patterns: ${error.allowedPatterns.join(', ')}`);
+ *   }
+ * }
+ * ```
+ */
+declare class MerchantNotAllowedError extends MixrPayError {
+    /** The merchant/tool that was attempted */
+    readonly attempted: string;
+    /** The patterns that are allowed by the session */
+    readonly allowedPatterns: string[];
+    constructor(attempted: string, allowedPatterns: string[]);
+}
 /**
  * Check if an error is a MixrPay SDK error.
  *
@@ -1819,4 +1880,4 @@ declare function isMixrPayError(error: unknown): error is MixrPayError;
  */
 declare function getErrorMessage(error: unknown): string;
 
-export { type AgentMessage, type AgentRunConfig, type AgentRunEvent, type AgentRunOptions, type AgentRunResult, type AgentRunStatusResult, AgentWallet, type AgentWalletConfig, type CallMerchantApiOptions, type ChargeResult, type DiagnosticsResult, InsufficientBalanceError, InvalidSessionKeyError, MixrPayError, type PaymentEvent, PaymentFailedError, SDK_VERSION, type SessionAuthorization, SessionExpiredError, SessionKeyExpiredError, type SessionKeyInfo, SessionLimitExceededError, SessionNotFoundError, SessionRevokedError, type SessionStats, SpendingLimitExceededError, type SpendingStats, X402ProtocolError, getErrorMessage, isMixrPayError };
+export { type AgentMessage, type AgentRunConfig, type AgentRunEvent, type AgentRunOptions, type AgentRunResult, type AgentRunStatusResult, AgentWallet, type AgentWalletConfig, type CallMerchantApiOptions, type ChargeResult, type DiagnosticsResult, InsufficientBalanceError, InvalidSessionKeyError, MerchantNotAllowedError, MixrPayError, type PaymentEvent, PaymentFailedError, SDK_VERSION, type SessionAuthorization, SessionExpiredError, SessionKeyExpiredError, type SessionKeyInfo, SessionLimitExceededError, SessionNotFoundError, SessionRevokedError, type SessionStats, SpendingLimitExceededError, type SpendingStats, X402ProtocolError, getErrorMessage, isMixrPayError };

package/dist/index.js

@@ -229,6 +229,23 @@ var SessionRevokedError = class extends MixrPayError {
     this.reason = reason;
   }
 };
+var MerchantNotAllowedError = class extends MixrPayError {
+  /** The merchant/tool that was attempted */
+  attempted;
+  /** The patterns that are allowed by the session */
+  allowedPatterns;
+  constructor(attempted, allowedPatterns) {
+    const patternsPreview = allowedPatterns.slice(0, 3).join(", ");
+    const suffix = allowedPatterns.length > 3 ? "..." : "";
+    super(
+      `Payment to "${attempted}" not allowed. Session allowlist: ${patternsPreview}${suffix}. Update the session allowlist or create a new session.`,
+      "MERCHANT_NOT_ALLOWED"
+    );
+    this.name = "MerchantNotAllowedError";
+    this.attempted = attempted;
+    this.allowedPatterns = allowedPatterns;
+  }
+};
 function isMixrPayError(error) {
   return error instanceof MixrPayError;
 }
@@ -539,6 +556,9 @@ var AgentWallet = class {
   // Session key info cache
   sessionKeyInfo;
   sessionKeyInfoFetchedAt;
+  // Merchant allowlist (fetched from server)
+  allowlist;
+  allowlistFetchedAt;
   /**
    * Create a new AgentWallet instance.
    * 
@@ -615,6 +635,126 @@ var AgentWallet = class {
     }
   }
   // ===========================================================================
+  // Merchant Allowlist Validation
+  // ===========================================================================
+  /**
+   * Fetch the merchant allowlist from the server.
+   * Caches the result for 5 minutes to avoid excessive API calls.
+   */
+  async fetchAllowlist() {
+    const CACHE_TTL_MS = 5 * 60 * 1e3;
+    if (this.allowlist !== void 0 && this.allowlistFetchedAt) {
+      const age = Date.now() - this.allowlistFetchedAt;
+      if (age < CACHE_TTL_MS) {
+        return this.allowlist;
+      }
+    }
+    try {
+      const info = await this.getSessionKeyInfo();
+      this.allowlist = info.allowedMerchants || [];
+      this.allowlistFetchedAt = Date.now();
+      this.logger.debug("Fetched allowlist", {
+        patterns: this.allowlist.length,
+        allowAll: this.allowlist.length === 0
+      });
+      return this.allowlist;
+    } catch (error) {
+      this.logger.warn("Failed to fetch allowlist, allowing all merchants", { error });
+      this.allowlist = [];
+      this.allowlistFetchedAt = Date.now();
+      return this.allowlist;
+    }
+  }
+  /**
+   * Validate that a target is allowed by the session's allowlist.
+   * 
+   * @param target - URL, domain, or tool name to check
+   * @param type - Type of target: 'url' for HTTP requests, 'tool' for MCP tools
+   * @throws {MerchantNotAllowedError} If target is not in allowlist
+   */
+  async validateMerchantAllowed(target, type) {
+    const allowlist = await this.fetchAllowlist();
+    if (allowlist.length === 0) {
+      return;
+    }
+    const isAllowed = this.matchesAllowlist(target, allowlist, type);
+    if (!isAllowed) {
+      throw new MerchantNotAllowedError(target, allowlist);
+    }
+  }
+  /**
+   * Check if a target matches any pattern in the allowlist.
+   */
+  matchesAllowlist(target, allowlist, type) {
+    for (const pattern of allowlist) {
+      if (this.matchPattern(target, pattern, type)) {
+        return true;
+      }
+    }
+    return false;
+  }
+  /**
+   * Check if a target matches a single pattern.
+   */
+  matchPattern(target, pattern, type) {
+    if (type === "url") {
+      return this.matchUrlPattern(target, pattern);
+    } else {
+      return this.matchToolPattern(target, pattern);
+    }
+  }
+  /**
+   * Match a URL or domain against a pattern.
+   */
+  matchUrlPattern(target, pattern) {
+    let hostname;
+    try {
+      if (target.includes("://")) {
+        const url = new URL(target);
+        hostname = url.hostname.toLowerCase();
+      } else {
+        hostname = target.toLowerCase();
+      }
+    } catch {
+      return false;
+    }
+    const normalizedPattern = pattern.toLowerCase().trim();
+    let patternDomain = normalizedPattern;
+    if (patternDomain.includes("://")) {
+      try {
+        patternDomain = new URL(patternDomain).hostname;
+      } catch {
+      }
+    }
+    if (hostname === patternDomain) {
+      return true;
+    }
+    if (patternDomain.startsWith("*.")) {
+      const baseDomain = patternDomain.substring(2);
+      if (hostname.endsWith(`.${baseDomain}`) && hostname !== baseDomain) {
+        return true;
+      }
+    }
+    return false;
+  }
+  /**
+   * Match an MCP tool name against a pattern.
+   */
+  matchToolPattern(toolName, pattern) {
+    const normalizedTool = toolName.toLowerCase().trim();
+    const normalizedPattern = pattern.toLowerCase().trim();
+    if (normalizedTool === normalizedPattern) {
+      return true;
+    }
+    if (normalizedPattern.endsWith("/*")) {
+      const baseProvider = normalizedPattern.substring(0, normalizedPattern.length - 2);
+      if (normalizedTool.startsWith(`${baseProvider}/`)) {
+        return true;
+      }
+    }
+    return false;
+  }
+  // ===========================================================================
   // Static Agent Registration Methods
   // ===========================================================================
   /**
@@ -1002,6 +1142,7 @@ var AgentWallet = class {
    */
   async fetch(url, init) {
     this.logger.debug(`Fetching ${init?.method || "GET"} ${url}`);
+    await this.validateMerchantAllowed(url, "url");
     const requestId = crypto.randomUUID();
     const correlationId = this.extractCorrelationId(init?.headers);
     const controller = new AbortController();
@@ -1275,7 +1416,8 @@ var AgentWallet = class {
           },
           expiresAt: data.expires_at ? new Date(data.expires_at) : null,
           createdAt: data.created_at ? new Date(data.created_at) : null,
-          name: data.name
+          name: data.name,
+          allowedMerchants: data.allowed_merchants ?? data.allowedMerchants ?? []
         };
         this.sessionKeyInfoFetchedAt = Date.now();
         return this.sessionKeyInfo;
@@ -1841,6 +1983,7 @@ var AgentWallet = class {
       feature
     } = options;
     this.logger.debug("callMerchantApi", { url, method, merchantPublicKey, priceUsd });
+    await this.validateMerchantAllowed(url, "url");
     if (priceUsd !== void 0 && this.maxPaymentUsd !== void 0 && priceUsd > this.maxPaymentUsd) {
       throw new SpendingLimitExceededError("client_max", this.maxPaymentUsd, priceUsd);
     }
@@ -2048,6 +2191,7 @@ Timestamp: ${timestamp}`;
    */
   async callMCPTool(toolName, args = {}) {
     this.logger.debug("callMCPTool", { toolName, args });
+    await this.validateMerchantAllowed(toolName, "tool");
     const authHeaders = await this.getMCPAuthHeaders();
     const response = await fetch(`${this.baseUrl}/api/mcp`, {
       method: "POST",
@@ -2437,6 +2581,7 @@ Timestamp: ${timestamp}`;
    */
   async callMCPToolWithSession(sessionId, toolName, args = {}) {
     this.logger.debug("callMCPToolWithSession", { sessionId, toolName, args });
+    await this.validateMerchantAllowed(toolName, "tool");
     const response = await fetch(`${this.baseUrl}/api/mcp`, {
       method: "POST",
       headers: {
@@ -2486,6 +2631,7 @@ export {
   AgentWallet,
   InsufficientBalanceError,
   InvalidSessionKeyError,
+  MerchantNotAllowedError,
   MixrPayError,
   PaymentFailedError,
   SDK_VERSION,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mixrpay/agent-sdk",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "MixrPay Agent SDK - Enable AI agents to make x402 payments with session keys",
   "type": "module",
   "main": "./dist/index.js",