@nevermined-io/payments 1.11.1 → 1.12.0

package/dist/api/nvm-api.d.ts

@@ -32,6 +32,8 @@ export declare const API_URL_GET_MEMBERS = "/api/v1/organizations/members";
 export declare const API_URL_MY_MEMBERSHIPS = "/api/v1/organizations/my-memberships";
 export declare const API_URL_ORG_ACTIVITY = "/api/v1/organizations/:orgId/activity";
 export declare const API_URL_CONNECT_STRIPE_ACCOUNT = "/api/v1/fiat/stripe/account";
+export declare const API_URL_CREATE_ORDER = "/api/v1/orders";
+export declare const API_URL_GET_ORDER = "/api/v1/orders/:orderId";
 export interface BackendApiOptions {
     /**
      * The host of the backend server

package/dist/api/nvm-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nvm-api.d.ts","sourceRoot":"","sources":["../../src/api/nvm-api.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,qBAAqB,2BAA2B,CAAA;AAC7D,eAAO,MAAM,sBAAsB,4BAA4B,CAAA;AAC/D,eAAO,MAAM,gCAAgC,kCAAkC,CAAA;AAC/E,eAAO,MAAM,iBAAiB,qCAAqC,CAAA;AACnE,eAAO,MAAM,oBAAoB,qCAAqC,CAAA;AACtE,eAAO,MAAM,uBAAuB,2CAA2C,CAAA;AAI/E,eAAO,MAAM,kBAAkB,4BAA4B,CAAA;AAC3D,eAAO,MAAM,gBAAgB,mCAAmC,CAAA;AAChE,eAAO,MAAM,iBAAiB,2BAA2B,CAAA;AACzD,eAAO,MAAM,uBAAuB,0CAA0C,CAAA;AAC9E,eAAO,MAAM,kBAAkB,yCAAyC,CAAA;AACxE,eAAO,MAAM,iBAAiB,gCAAgC,CAAA;AAC9D,eAAO,MAAM,2BAA2B,yCAAyC,CAAA;AACjF,eAAO,MAAM,sBAAsB,kDAAkD,CAAA;AACrF,eAAO,MAAM,yBAAyB,kDAAkD,CAAA;AACxF,eAAO,MAAM,oBAAoB,0DAA0D,CAAA;AAC3F,eAAO,MAAM,wBAAwB,gDAAgD,CAAA;AACrF,eAAO,MAAM,8BAA8B,2CAA2C,CAAA;AACtF,eAAO,MAAM,qCAAqC,4CAA4C,CAAA;AAC9F,eAAO,MAAM,4BAA4B,qCAAqC,CAAA;AAC9E,eAAO,MAAM,mCAAmC,6CAA6C,CAAA;AAC7F,eAAO,MAAM,yBAAyB,6BAA6B,CAAA;AACnE,eAAO,MAAM,0BAA0B,wBAAwB,CAAA;AAC/D,eAAO,MAAM,0BAA0B,wBAAwB,CAAA;AAI/D,eAAO,MAAM,6BAA6B,4BAA4B,CAAA;AACtE,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAC5D,eAAO,MAAM,kBAAkB,uBAAuB,CAAA;AACtD,eAAO,MAAM,kBAAkB,uBAAuB,CAAA;AACtD,eAAO,MAAM,uBAAuB,gCAAgC,CAAA;AACpE,eAAO,MAAM,mBAAmB,kCAAkC,CAAA;AAClE,eAAO,MAAM,mBAAmB,kCAAkC,CAAA;AAClE,eAAO,MAAM,sBAAsB,yCAAyC,CAAA;AAC5E,eAAO,MAAM,oBAAoB,0CAA0C,CAAA;AAC3E,eAAO,MAAM,8BAA8B,gCAAgC,CAAA;AAE3E,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,WAAW,EAAE,MAAM,CAAA;IAEnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB;;OAEG;IACH,OAAO,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAA;CACpC;AAED,qBAAa,kBAAkB;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,gBAAgB,UAAO;IACvB,SAAS,CAAC,EAAE,MAAM,CAAY;IAC9B,OAAO,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAK;CACzC;AAED,8BAAsB,kBAAkB;;IAyCtC,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,kBAAkB;IAW7D,YAAY,CAAC,cAAc,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,EAAE,WAAW,CAAC,EAAE,MAAM;;;IActE,OAAO,CACX,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,EACnD,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,GAAG,EACV,UAAU,GAAE,kBAEX;IAqBG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,GAAE,kBAA+C;IAI5E,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,kBAAkB;IAI3D,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,kBAAkB;IAI1D,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,kBAAkB;CAGpE"}
+{"version":3,"file":"nvm-api.d.ts","sourceRoot":"","sources":["../../src/api/nvm-api.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,qBAAqB,2BAA2B,CAAA;AAC7D,eAAO,MAAM,sBAAsB,4BAA4B,CAAA;AAC/D,eAAO,MAAM,gCAAgC,kCAAkC,CAAA;AAC/E,eAAO,MAAM,iBAAiB,qCAAqC,CAAA;AACnE,eAAO,MAAM,oBAAoB,qCAAqC,CAAA;AACtE,eAAO,MAAM,uBAAuB,2CAA2C,CAAA;AAI/E,eAAO,MAAM,kBAAkB,4BAA4B,CAAA;AAC3D,eAAO,MAAM,gBAAgB,mCAAmC,CAAA;AAChE,eAAO,MAAM,iBAAiB,2BAA2B,CAAA;AACzD,eAAO,MAAM,uBAAuB,0CAA0C,CAAA;AAC9E,eAAO,MAAM,kBAAkB,yCAAyC,CAAA;AACxE,eAAO,MAAM,iBAAiB,gCAAgC,CAAA;AAC9D,eAAO,MAAM,2BAA2B,yCAAyC,CAAA;AACjF,eAAO,MAAM,sBAAsB,kDAAkD,CAAA;AACrF,eAAO,MAAM,yBAAyB,kDAAkD,CAAA;AACxF,eAAO,MAAM,oBAAoB,0DAA0D,CAAA;AAC3F,eAAO,MAAM,wBAAwB,gDAAgD,CAAA;AACrF,eAAO,MAAM,8BAA8B,2CAA2C,CAAA;AACtF,eAAO,MAAM,qCAAqC,4CAA4C,CAAA;AAC9F,eAAO,MAAM,4BAA4B,qCAAqC,CAAA;AAC9E,eAAO,MAAM,mCAAmC,6CAA6C,CAAA;AAC7F,eAAO,MAAM,yBAAyB,6BAA6B,CAAA;AACnE,eAAO,MAAM,0BAA0B,wBAAwB,CAAA;AAC/D,eAAO,MAAM,0BAA0B,wBAAwB,CAAA;AAI/D,eAAO,MAAM,6BAA6B,4BAA4B,CAAA;AACtE,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAC5D,eAAO,MAAM,kBAAkB,uBAAuB,CAAA;AACtD,eAAO,MAAM,kBAAkB,uBAAuB,CAAA;AACtD,eAAO,MAAM,uBAAuB,gCAAgC,CAAA;AACpE,eAAO,MAAM,mBAAmB,kCAAkC,CAAA;AAClE,eAAO,MAAM,mBAAmB,kCAAkC,CAAA;AAClE,eAAO,MAAM,sBAAsB,yCAAyC,CAAA;AAC5E,eAAO,MAAM,oBAAoB,0CAA0C,CAAA;AAC3E,eAAO,MAAM,8BAA8B,gCAAgC,CAAA;AAG3E,eAAO,MAAM,oBAAoB,mBAAmB,CAAA;AACpD,eAAO,MAAM,iBAAiB,4BAA4B,CAAA;AAE1D,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,WAAW,EAAE,MAAM,CAAA;IAEnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB;;OAEG;IACH,OAAO,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAA;CACpC;AAED,qBAAa,kBAAkB;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,gBAAgB,UAAO;IACvB,SAAS,CAAC,EAAE,MAAM,CAAY;IAC9B,OAAO,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAK;CACzC;AAED,8BAAsB,kBAAkB;;IAyCtC,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,kBAAkB;IAW7D,YAAY,CAAC,cAAc,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,EAAE,WAAW,CAAC,EAAE,MAAM;;;IActE,OAAO,CACX,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,EACnD,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,GAAG,EACV,UAAU,GAAE,kBAEX;IAqBG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,GAAE,kBAA+C;IAI5E,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,kBAAkB;IAI3D,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,kBAAkB;IAI1D,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,kBAAkB;CAGpE"}

package/dist/api/nvm-api.js

@@ -39,6 +39,10 @@ export const API_URL_GET_MEMBERS = '/api/v1/organizations/members';
 export const API_URL_MY_MEMBERSHIPS = '/api/v1/organizations/my-memberships';
 export const API_URL_ORG_ACTIVITY = '/api/v1/organizations/:orgId/activity';
 export const API_URL_CONNECT_STRIPE_ACCOUNT = '/api/v1/fiat/stripe/account';
+// Browser-fiat Orders (nvm-monorepo epic #3238). POST is merchant-authenticated
+// (org-scoped NVM API key); GET is anonymous — the unguessable id is the access control.
+export const API_URL_CREATE_ORDER = '/api/v1/orders';
+export const API_URL_GET_ORDER = '/api/v1/orders/:orderId';
 export class HTTPRequestOptions {
     constructor() {
         this.sendThroughProxy = true;

package/dist/api/nvm-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"nvm-api.js","sourceRoot":"","sources":["../../src/api/nvm-api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAA;AAC7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,yBAAyB,CAAA;AAC/D,MAAM,CAAC,MAAM,gCAAgC,GAAG,+BAA+B,CAAA;AAC/E,MAAM,CAAC,MAAM,iBAAiB,GAAG,kCAAkC,CAAA;AACnE,MAAM,CAAC,MAAM,oBAAoB,GAAG,kCAAkC,CAAA;AACtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,wCAAwC,CAAA;AAC/E,iFAAiF;AACjF,8EAA8E;AAC9E,qEAAqE;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAG,yBAAyB,CAAA;AAC3D,MAAM,CAAC,MAAM,gBAAgB,GAAG,gCAAgC,CAAA;AAChE,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAA;AACzD,MAAM,CAAC,MAAM,uBAAuB,GAAG,uCAAuC,CAAA;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,sCAAsC,CAAA;AACxE,MAAM,CAAC,MAAM,iBAAiB,GAAG,6BAA6B,CAAA;AAC9D,MAAM,CAAC,MAAM,2BAA2B,GAAG,sCAAsC,CAAA;AACjF,MAAM,CAAC,MAAM,sBAAsB,GAAG,+CAA+C,CAAA;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,+CAA+C,CAAA;AACxF,MAAM,CAAC,MAAM,oBAAoB,GAAG,uDAAuD,CAAA;AAC3F,MAAM,CAAC,MAAM,wBAAwB,GAAG,6CAA6C,CAAA;AACrF,MAAM,CAAC,MAAM,8BAA8B,GAAG,wCAAwC,CAAA;AACtF,MAAM,CAAC,MAAM,qCAAqC,GAAG,yCAAyC,CAAA;AAC9F,MAAM,CAAC,MAAM,4BAA4B,GAAG,kCAAkC,CAAA;AAC9E,MAAM,CAAC,MAAM,mCAAmC,GAAG,0CAA0C,CAAA;AAC7F,MAAM,CAAC,MAAM,yBAAyB,GAAG,0BAA0B,CAAA;AACnE,MAAM,CAAC,MAAM,0BAA0B,GAAG,qBAAqB,CAAA;AAC/D,MAAM,CAAC,MAAM,0BAA0B,GAAG,qBAAqB,CAAA;AAC/D,4EAA4E;AAC5E,2EAA2E;AAC3E,2DAA2D;AAC3D,MAAM,CAAC,MAAM,6BAA6B,GAAG,yBAAyB,CAAA;AACtE,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AAC5D,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAA;AACtD,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAA;AACtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,6BAA6B,CAAA;AACpE,MAAM,CAAC,MAAM,mBAAmB,GAAG,+BAA+B,CAAA;AAClE,MAAM,CAAC,MAAM,mBAAmB,GAAG,+BAA+B,CAAA;AAClE,MAAM,CAAC,MAAM,sBAAsB,GAAG,sCAAsC,CAAA;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,uCAAuC,CAAA;AAC3E,MAAM,CAAC,MAAM,8BAA8B,GAAG,6BAA6B,CAAA;AA0B3E,MAAM,OAAO,kBAAkB;IAA/B;QAEE,qBAAgB,GAAG,IAAI,CAAA;QACvB,cAAS,GAAY,SAAS,CAAA;QAC9B,YAAO,GAA+B,EAAE,CAAA;IAC1C,CAAC;CAAA;AAED,MAAM,OAAgB,kBAAkB;IACtC,oCAAoC;IACpC,yBAAyB;IACzB,uBAAuB;IAEvB,yCAAyC;IACzC,6BAA6B;IAC7B,kCAAkC;IAClC,uBAAuB;IACvB,sEAAsE;IACtE,MAAM;IAEN,kBAAkB;IAClB,eAAe;IACf,+BAA+B;IAC/B,MAAM;IAEN,UAAU;IACV,6DAA6D;IAC7D,gDAAgD;IAChD,0CAA0C;IAC1C,6BAA6B;IAC7B,UAAU;IACV,QAAQ;IACR,cAAc;IACd,0BAA0B;IAC1B,MAAM;IAEN,mBAAmB;IACnB,UAAU;IACV,kDAAkD;IAClD,gDAAgD;IAChD,sBAAsB;IACtB,6FAA6F;IAC7F,MAAM;IACN,IAAI;IAEJ;QACE,iEAAiE;IACnE,CAAC;IAED,QAAQ,CAAC,YAAoB,EAAE,UAA8B;QAC3D,IAAI,KAAU,CAAA;QACd,IAAI,UAAU,CAAC,gBAAgB,EAAE,CAAC;YAChC,IAAI,CAAC,UAAU,CAAC,SAAS;gBACvB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;YACzE,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAA;QAC/E,CAAC;aAAM,CAAC;YACN,OAAO,YAAY,CAAA;QACrB,CAAC;IACH,CAAC;IAED,YAAY,CAAC,cAAyC,EAAE,WAAoB;QAC1E,OAAO;YACL,GAAG,CAAC,WAAW,IAAI,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC;YAC9D,GAAG,cAAc;SAClB,CAAA;IACH,CAAC;IAED,kCAAkC;IAClC,0BAA0B;IAC1B,4BAA4B;IAC5B,wCAAwC;IACxC,MAAM;IACN,IAAI;IAEJ,KAAK,CAAC,OAAO,CACX,MAAmD,EACnD,GAAW,EACX,IAAU,EACV,aAAiC;QAC/B,gBAAgB,EAAE,KAAK;KACxB;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC;gBAC3B,MAAM;gBACN,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;gBACnC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,EAAE,UAAU,CAAC,WAAW,CAAC;gBAC5E,GAAG,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,kDAAkD;aAC1E,CAAC,CAAA;YAEF,OAAO,QAAQ,CAAA;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CACb,QAAQ,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,IAAI,gBAAgB,EAAE,CACjF,CAAA;YACH,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,aAAiC,EAAE,gBAAgB,EAAE,IAAI,EAAE;QAChF,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;IACxD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,IAAS,EAAE,UAA8B;QAC/D,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;IACpD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,IAAS,EAAE,UAA8B;QAC9D,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;IACnD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,IAAS,EAAE,UAA8B;QACjE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;IACtD,CAAC;CACF","sourcesContent":["import axios from 'axios'\n\nexport const API_URL_REGISTER_PLAN = '/api/v1/protocol/plans'\nexport const API_URL_REGISTER_AGENT = '/api/v1/protocol/agents'\nexport const API_URL_REGISTER_AGENTS_AND_PLAN = '/api/v1/protocol/agents/plans'\nexport const API_URL_GET_AGENT = '/api/v1/protocol/agents/:agentId'\nexport const API_URL_UPDATE_AGENT = '/api/v1/protocol/agents/:agentId'\nexport const API_URL_GET_AGENT_PLANS = '/api/v1/protocol/agents/:agentId/plans'\n// GET: the caller's own agents (?orgId= scopes to an org the caller belongs to).\n// Same path as API_URL_REGISTER_AGENT (disambiguated by GET vs POST); mirrors\n// the existing API_URL_REGISTER_PLAN / API_URL_GET_PLANS pair below.\nexport const API_URL_GET_AGENTS = '/api/v1/protocol/agents'\nexport const API_URL_GET_PLAN = '/api/v1/protocol/plans/:planId'\nexport const API_URL_GET_PLANS = '/api/v1/protocol/plans'\nexport const API_URL_GET_PLAN_AGENTS = '/api/v1/protocol/plans/:planId/agents'\nexport const API_URL_ORDER_PLAN = '/api/v1/protocol/plans/:planId/order'\nexport const API_URL_MINT_PLAN = '/api/v1/protocol/plans/mint'\nexport const API_URL_MINT_EXPIRABLE_PLAN = '/api/v1/protocol/plans/mintExpirable'\nexport const API_URL_ADD_PLAN_AGENT = '/api/v1/protocol/agents/:agentId/plan/:planId'\nexport const API_URL_REMOVE_PLAN_AGENT = '/api/v1/protocol/agents/:agentId/plan/:planId'\nexport const API_URL_PLAN_BALANCE = '/api/v1/protocol/plans/:planId/balance/:holderAddress'\nexport const API_URL_INITIALIZE_AGENT = '/api/v1/protocol/agents/initialize/:agentId'\nexport const API_URL_SIMULATE_AGENT_REQUEST = '/api/v1/protocol/agents/simulate/start'\nexport const API_URL_SIMULATE_REDEEM_AGENT_REQUEST = '/api/v1/protocol/agents/simulate/finish'\nexport const API_URL_TRACK_AGENT_SUB_TASK = '/api/v1/protocol/agent-sub-tasks'\nexport const API_URL_VALIDATE_AGENT_ACCESS_TOKEN = '/api/v1/protocol/token/validate/:agentId'\nexport const API_URL_CREATE_PERMISSION = '/api/v1/x402/permissions'\nexport const API_URL_VERIFY_PERMISSIONS = '/api/v1/x402/verify'\nexport const API_URL_SETTLE_PERMISSIONS = '/api/v1/x402/settle'\n// MPP seller/buyer surface. Sibling routes of /api/v1/x402, never children:\n// an MPP access token is byte-identical to an x402 one on the wire, so the\n// route is what fixes the protocol. See nvm-monorepo#2641.\nexport const API_URL_MPP_CREATE_PERMISSION = '/api/v1/mpp/permissions'\nexport const API_URL_MPP_CHALLENGE = '/api/v1/mpp/challenge'\nexport const API_URL_MPP_VERIFY = '/api/v1/mpp/verify'\nexport const API_URL_MPP_SETTLE = '/api/v1/mpp/settle'\nexport const API_URL_STRIPE_CHECKOUT = '/api/v1/fiat/stripe/payment'\nexport const API_URL_CREATE_USER = '/api/v1/organizations/account'\nexport const API_URL_GET_MEMBERS = '/api/v1/organizations/members'\nexport const API_URL_MY_MEMBERSHIPS = '/api/v1/organizations/my-memberships'\nexport const API_URL_ORG_ACTIVITY = '/api/v1/organizations/:orgId/activity'\nexport const API_URL_CONNECT_STRIPE_ACCOUNT = '/api/v1/fiat/stripe/account'\n\nexport interface BackendApiOptions {\n  /**\n   * The host of the backend server\n   */\n  backendHost: string\n\n  /**\n   * The Nevermined API Key. This key identify your user and is required to interact with the Nevermined API.\n   * You can get your API key by logging in to the Nevermined App.\n   * @see https://nevermined.ai/docs/tutorials/integration/nvm-api-keys\n   */\n  apiKey?: string\n\n  /**\n   * The host of the Nevermined Proxy\n   */\n  proxyHost?: string\n\n  /**\n   * Additional headers to send with the requests\n   */\n  headers?: { [key: string]: string }\n}\n\nexport class HTTPRequestOptions {\n  accessToken?: string\n  sendThroughProxy = true\n  proxyHost?: string = undefined\n  headers?: { [key: string]: string } = {}\n}\n\nexport abstract class AbstractHTTPClient {\n  // protected opts: BackendApiOptions\n  // private hasKey = false\n  // private agentId = ''\n\n  // constructor(opts: BackendApiOptions) {\n  //   const defaultHeaders = {\n  //     Accept: 'application/json',\n  //     ...opts.headers,\n  //     ...(opts.apiKey && { Authorization: `Bearer ${opts.apiKey}` }),\n  //   }\n\n  //   this.opts = {\n  //     ...opts,\n  //     headers: defaultHeaders,\n  //   }\n\n  //   try {\n  //     if (this.opts.apiKey && this.opts.apiKey.length > 0) {\n  //       const jwt = decodeJwt(this.opts.apiKey)\n  //       if (isEthereumAddress(jwt.sub)) {\n  //         this.hasKey = true\n  //       }\n  //     }\n  //   } catch {\n  //     this.hasKey = false\n  //   }\n\n  //   let backendUrl\n  //   try {\n  //     backendUrl = new URL(this.opts.backendHost)\n  //     this.opts.backendHost = backendUrl.origin\n  //   } catch (error) {\n  //     throw new Error(`Invalid URL: ${this.opts.backendHost} - ${(error as Error).message}`)\n  //   }\n  // }\n\n  constructor() {\n    // Empty constructor - required for abstract class implementation\n  }\n\n  parseUrl(urlRequested: string, reqOptions: HTTPRequestOptions) {\n    let _host: URL\n    if (reqOptions.sendThroughProxy) {\n      if (!reqOptions.proxyHost)\n        throw new Error('Proxy host is required when sendThroughProxy is true')\n      return `${new URL(reqOptions.proxyHost).origin}${new URL(urlRequested).href}`\n    } else {\n      return urlRequested\n    }\n  }\n\n  parseHeaders(requestHeaders: { [key: string]: string }, accessToken?: string) {\n    return {\n      ...(accessToken && { Authorization: `Bearer ${accessToken}` }),\n      ...requestHeaders,\n    }\n  }\n\n  // setBearerToken(token: string) {\n  //   this.opts.headers = {\n  //     ...this.opts.headers,\n  //     Authorization: `Bearer ${token}`,\n  //   }\n  // }\n\n  async request(\n    method: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH',\n    url: string,\n    data?: any,\n    reqOptions: HTTPRequestOptions = {\n      sendThroughProxy: false,\n    },\n  ) {\n    try {\n      const response = await axios({\n        method,\n        url: this.parseUrl(url, reqOptions),\n        headers: this.parseHeaders(reqOptions.headers || {}, reqOptions.accessToken),\n        ...(data && { data }), // Only include `data` for methods that support it\n      })\n\n      return response\n    } catch (err) {\n      if (axios.isAxiosError(err) && err.response) {\n        throw new Error(\n          `HTTP ${err.response.status}: ${err.response.data?.message || 'Request failed'}`,\n        )\n      }\n      throw new Error('Network error or request failed without a response.')\n    }\n  }\n\n  async get(url: string, reqOptions: HTTPRequestOptions = { sendThroughProxy: true }) {\n    return this.request('GET', url, undefined, reqOptions)\n  }\n\n  async post(url: string, data: any, reqOptions: HTTPRequestOptions) {\n    return this.request('POST', url, data, reqOptions)\n  }\n\n  async put(url: string, data: any, reqOptions: HTTPRequestOptions) {\n    return this.request('PUT', url, data, reqOptions)\n  }\n\n  async delete(url: string, data: any, reqOptions: HTTPRequestOptions) {\n    return this.request('DELETE', url, data, reqOptions)\n  }\n}\n"]}
+{"version":3,"file":"nvm-api.js","sourceRoot":"","sources":["../../src/api/nvm-api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAA;AAC7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,yBAAyB,CAAA;AAC/D,MAAM,CAAC,MAAM,gCAAgC,GAAG,+BAA+B,CAAA;AAC/E,MAAM,CAAC,MAAM,iBAAiB,GAAG,kCAAkC,CAAA;AACnE,MAAM,CAAC,MAAM,oBAAoB,GAAG,kCAAkC,CAAA;AACtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,wCAAwC,CAAA;AAC/E,iFAAiF;AACjF,8EAA8E;AAC9E,qEAAqE;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAG,yBAAyB,CAAA;AAC3D,MAAM,CAAC,MAAM,gBAAgB,GAAG,gCAAgC,CAAA;AAChE,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAA;AACzD,MAAM,CAAC,MAAM,uBAAuB,GAAG,uCAAuC,CAAA;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,sCAAsC,CAAA;AACxE,MAAM,CAAC,MAAM,iBAAiB,GAAG,6BAA6B,CAAA;AAC9D,MAAM,CAAC,MAAM,2BAA2B,GAAG,sCAAsC,CAAA;AACjF,MAAM,CAAC,MAAM,sBAAsB,GAAG,+CAA+C,CAAA;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,+CAA+C,CAAA;AACxF,MAAM,CAAC,MAAM,oBAAoB,GAAG,uDAAuD,CAAA;AAC3F,MAAM,CAAC,MAAM,wBAAwB,GAAG,6CAA6C,CAAA;AACrF,MAAM,CAAC,MAAM,8BAA8B,GAAG,wCAAwC,CAAA;AACtF,MAAM,CAAC,MAAM,qCAAqC,GAAG,yCAAyC,CAAA;AAC9F,MAAM,CAAC,MAAM,4BAA4B,GAAG,kCAAkC,CAAA;AAC9E,MAAM,CAAC,MAAM,mCAAmC,GAAG,0CAA0C,CAAA;AAC7F,MAAM,CAAC,MAAM,yBAAyB,GAAG,0BAA0B,CAAA;AACnE,MAAM,CAAC,MAAM,0BAA0B,GAAG,qBAAqB,CAAA;AAC/D,MAAM,CAAC,MAAM,0BAA0B,GAAG,qBAAqB,CAAA;AAC/D,4EAA4E;AAC5E,2EAA2E;AAC3E,2DAA2D;AAC3D,MAAM,CAAC,MAAM,6BAA6B,GAAG,yBAAyB,CAAA;AACtE,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAA;AAC5D,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAA;AACtD,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAA;AACtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,6BAA6B,CAAA;AACpE,MAAM,CAAC,MAAM,mBAAmB,GAAG,+BAA+B,CAAA;AAClE,MAAM,CAAC,MAAM,mBAAmB,GAAG,+BAA+B,CAAA;AAClE,MAAM,CAAC,MAAM,sBAAsB,GAAG,sCAAsC,CAAA;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,uCAAuC,CAAA;AAC3E,MAAM,CAAC,MAAM,8BAA8B,GAAG,6BAA6B,CAAA;AAC3E,gFAAgF;AAChF,yFAAyF;AACzF,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAA;AACpD,MAAM,CAAC,MAAM,iBAAiB,GAAG,yBAAyB,CAAA;AA0B1D,MAAM,OAAO,kBAAkB;IAA/B;QAEE,qBAAgB,GAAG,IAAI,CAAA;QACvB,cAAS,GAAY,SAAS,CAAA;QAC9B,YAAO,GAA+B,EAAE,CAAA;IAC1C,CAAC;CAAA;AAED,MAAM,OAAgB,kBAAkB;IACtC,oCAAoC;IACpC,yBAAyB;IACzB,uBAAuB;IAEvB,yCAAyC;IACzC,6BAA6B;IAC7B,kCAAkC;IAClC,uBAAuB;IACvB,sEAAsE;IACtE,MAAM;IAEN,kBAAkB;IAClB,eAAe;IACf,+BAA+B;IAC/B,MAAM;IAEN,UAAU;IACV,6DAA6D;IAC7D,gDAAgD;IAChD,0CAA0C;IAC1C,6BAA6B;IAC7B,UAAU;IACV,QAAQ;IACR,cAAc;IACd,0BAA0B;IAC1B,MAAM;IAEN,mBAAmB;IACnB,UAAU;IACV,kDAAkD;IAClD,gDAAgD;IAChD,sBAAsB;IACtB,6FAA6F;IAC7F,MAAM;IACN,IAAI;IAEJ;QACE,iEAAiE;IACnE,CAAC;IAED,QAAQ,CAAC,YAAoB,EAAE,UAA8B;QAC3D,IAAI,KAAU,CAAA;QACd,IAAI,UAAU,CAAC,gBAAgB,EAAE,CAAC;YAChC,IAAI,CAAC,UAAU,CAAC,SAAS;gBACvB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;YACzE,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAA;QAC/E,CAAC;aAAM,CAAC;YACN,OAAO,YAAY,CAAA;QACrB,CAAC;IACH,CAAC;IAED,YAAY,CAAC,cAAyC,EAAE,WAAoB;QAC1E,OAAO;YACL,GAAG,CAAC,WAAW,IAAI,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC;YAC9D,GAAG,cAAc;SAClB,CAAA;IACH,CAAC;IAED,kCAAkC;IAClC,0BAA0B;IAC1B,4BAA4B;IAC5B,wCAAwC;IACxC,MAAM;IACN,IAAI;IAEJ,KAAK,CAAC,OAAO,CACX,MAAmD,EACnD,GAAW,EACX,IAAU,EACV,aAAiC;QAC/B,gBAAgB,EAAE,KAAK;KACxB;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC;gBAC3B,MAAM;gBACN,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;gBACnC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,EAAE,UAAU,CAAC,WAAW,CAAC;gBAC5E,GAAG,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,kDAAkD;aAC1E,CAAC,CAAA;YAEF,OAAO,QAAQ,CAAA;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CACb,QAAQ,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,IAAI,gBAAgB,EAAE,CACjF,CAAA;YACH,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,aAAiC,EAAE,gBAAgB,EAAE,IAAI,EAAE;QAChF,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;IACxD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,IAAS,EAAE,UAA8B;QAC/D,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;IACpD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,IAAS,EAAE,UAA8B;QAC9D,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;IACnD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,IAAS,EAAE,UAA8B;QACjE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;IACtD,CAAC;CACF","sourcesContent":["import axios from 'axios'\n\nexport const API_URL_REGISTER_PLAN = '/api/v1/protocol/plans'\nexport const API_URL_REGISTER_AGENT = '/api/v1/protocol/agents'\nexport const API_URL_REGISTER_AGENTS_AND_PLAN = '/api/v1/protocol/agents/plans'\nexport const API_URL_GET_AGENT = '/api/v1/protocol/agents/:agentId'\nexport const API_URL_UPDATE_AGENT = '/api/v1/protocol/agents/:agentId'\nexport const API_URL_GET_AGENT_PLANS = '/api/v1/protocol/agents/:agentId/plans'\n// GET: the caller's own agents (?orgId= scopes to an org the caller belongs to).\n// Same path as API_URL_REGISTER_AGENT (disambiguated by GET vs POST); mirrors\n// the existing API_URL_REGISTER_PLAN / API_URL_GET_PLANS pair below.\nexport const API_URL_GET_AGENTS = '/api/v1/protocol/agents'\nexport const API_URL_GET_PLAN = '/api/v1/protocol/plans/:planId'\nexport const API_URL_GET_PLANS = '/api/v1/protocol/plans'\nexport const API_URL_GET_PLAN_AGENTS = '/api/v1/protocol/plans/:planId/agents'\nexport const API_URL_ORDER_PLAN = '/api/v1/protocol/plans/:planId/order'\nexport const API_URL_MINT_PLAN = '/api/v1/protocol/plans/mint'\nexport const API_URL_MINT_EXPIRABLE_PLAN = '/api/v1/protocol/plans/mintExpirable'\nexport const API_URL_ADD_PLAN_AGENT = '/api/v1/protocol/agents/:agentId/plan/:planId'\nexport const API_URL_REMOVE_PLAN_AGENT = '/api/v1/protocol/agents/:agentId/plan/:planId'\nexport const API_URL_PLAN_BALANCE = '/api/v1/protocol/plans/:planId/balance/:holderAddress'\nexport const API_URL_INITIALIZE_AGENT = '/api/v1/protocol/agents/initialize/:agentId'\nexport const API_URL_SIMULATE_AGENT_REQUEST = '/api/v1/protocol/agents/simulate/start'\nexport const API_URL_SIMULATE_REDEEM_AGENT_REQUEST = '/api/v1/protocol/agents/simulate/finish'\nexport const API_URL_TRACK_AGENT_SUB_TASK = '/api/v1/protocol/agent-sub-tasks'\nexport const API_URL_VALIDATE_AGENT_ACCESS_TOKEN = '/api/v1/protocol/token/validate/:agentId'\nexport const API_URL_CREATE_PERMISSION = '/api/v1/x402/permissions'\nexport const API_URL_VERIFY_PERMISSIONS = '/api/v1/x402/verify'\nexport const API_URL_SETTLE_PERMISSIONS = '/api/v1/x402/settle'\n// MPP seller/buyer surface. Sibling routes of /api/v1/x402, never children:\n// an MPP access token is byte-identical to an x402 one on the wire, so the\n// route is what fixes the protocol. See nvm-monorepo#2641.\nexport const API_URL_MPP_CREATE_PERMISSION = '/api/v1/mpp/permissions'\nexport const API_URL_MPP_CHALLENGE = '/api/v1/mpp/challenge'\nexport const API_URL_MPP_VERIFY = '/api/v1/mpp/verify'\nexport const API_URL_MPP_SETTLE = '/api/v1/mpp/settle'\nexport const API_URL_STRIPE_CHECKOUT = '/api/v1/fiat/stripe/payment'\nexport const API_URL_CREATE_USER = '/api/v1/organizations/account'\nexport const API_URL_GET_MEMBERS = '/api/v1/organizations/members'\nexport const API_URL_MY_MEMBERSHIPS = '/api/v1/organizations/my-memberships'\nexport const API_URL_ORG_ACTIVITY = '/api/v1/organizations/:orgId/activity'\nexport const API_URL_CONNECT_STRIPE_ACCOUNT = '/api/v1/fiat/stripe/account'\n// Browser-fiat Orders (nvm-monorepo epic #3238). POST is merchant-authenticated\n// (org-scoped NVM API key); GET is anonymous — the unguessable id is the access control.\nexport const API_URL_CREATE_ORDER = '/api/v1/orders'\nexport const API_URL_GET_ORDER = '/api/v1/orders/:orderId'\n\nexport interface BackendApiOptions {\n  /**\n   * The host of the backend server\n   */\n  backendHost: string\n\n  /**\n   * The Nevermined API Key. This key identify your user and is required to interact with the Nevermined API.\n   * You can get your API key by logging in to the Nevermined App.\n   * @see https://nevermined.ai/docs/tutorials/integration/nvm-api-keys\n   */\n  apiKey?: string\n\n  /**\n   * The host of the Nevermined Proxy\n   */\n  proxyHost?: string\n\n  /**\n   * Additional headers to send with the requests\n   */\n  headers?: { [key: string]: string }\n}\n\nexport class HTTPRequestOptions {\n  accessToken?: string\n  sendThroughProxy = true\n  proxyHost?: string = undefined\n  headers?: { [key: string]: string } = {}\n}\n\nexport abstract class AbstractHTTPClient {\n  // protected opts: BackendApiOptions\n  // private hasKey = false\n  // private agentId = ''\n\n  // constructor(opts: BackendApiOptions) {\n  //   const defaultHeaders = {\n  //     Accept: 'application/json',\n  //     ...opts.headers,\n  //     ...(opts.apiKey && { Authorization: `Bearer ${opts.apiKey}` }),\n  //   }\n\n  //   this.opts = {\n  //     ...opts,\n  //     headers: defaultHeaders,\n  //   }\n\n  //   try {\n  //     if (this.opts.apiKey && this.opts.apiKey.length > 0) {\n  //       const jwt = decodeJwt(this.opts.apiKey)\n  //       if (isEthereumAddress(jwt.sub)) {\n  //         this.hasKey = true\n  //       }\n  //     }\n  //   } catch {\n  //     this.hasKey = false\n  //   }\n\n  //   let backendUrl\n  //   try {\n  //     backendUrl = new URL(this.opts.backendHost)\n  //     this.opts.backendHost = backendUrl.origin\n  //   } catch (error) {\n  //     throw new Error(`Invalid URL: ${this.opts.backendHost} - ${(error as Error).message}`)\n  //   }\n  // }\n\n  constructor() {\n    // Empty constructor - required for abstract class implementation\n  }\n\n  parseUrl(urlRequested: string, reqOptions: HTTPRequestOptions) {\n    let _host: URL\n    if (reqOptions.sendThroughProxy) {\n      if (!reqOptions.proxyHost)\n        throw new Error('Proxy host is required when sendThroughProxy is true')\n      return `${new URL(reqOptions.proxyHost).origin}${new URL(urlRequested).href}`\n    } else {\n      return urlRequested\n    }\n  }\n\n  parseHeaders(requestHeaders: { [key: string]: string }, accessToken?: string) {\n    return {\n      ...(accessToken && { Authorization: `Bearer ${accessToken}` }),\n      ...requestHeaders,\n    }\n  }\n\n  // setBearerToken(token: string) {\n  //   this.opts.headers = {\n  //     ...this.opts.headers,\n  //     Authorization: `Bearer ${token}`,\n  //   }\n  // }\n\n  async request(\n    method: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH',\n    url: string,\n    data?: any,\n    reqOptions: HTTPRequestOptions = {\n      sendThroughProxy: false,\n    },\n  ) {\n    try {\n      const response = await axios({\n        method,\n        url: this.parseUrl(url, reqOptions),\n        headers: this.parseHeaders(reqOptions.headers || {}, reqOptions.accessToken),\n        ...(data && { data }), // Only include `data` for methods that support it\n      })\n\n      return response\n    } catch (err) {\n      if (axios.isAxiosError(err) && err.response) {\n        throw new Error(\n          `HTTP ${err.response.status}: ${err.response.data?.message || 'Request failed'}`,\n        )\n      }\n      throw new Error('Network error or request failed without a response.')\n    }\n  }\n\n  async get(url: string, reqOptions: HTTPRequestOptions = { sendThroughProxy: true }) {\n    return this.request('GET', url, undefined, reqOptions)\n  }\n\n  async post(url: string, data: any, reqOptions: HTTPRequestOptions) {\n    return this.request('POST', url, data, reqOptions)\n  }\n\n  async put(url: string, data: any, reqOptions: HTTPRequestOptions) {\n    return this.request('PUT', url, data, reqOptions)\n  }\n\n  async delete(url: string, data: any, reqOptions: HTTPRequestOptions) {\n    return this.request('DELETE', url, data, reqOptions)\n  }\n}\n"]}

package/dist/api/orders-api.d.ts

@@ -0,0 +1,146 @@
+import { PaymentOptions } from '../common/types.js';
+import { BasePaymentsAPI } from './base-payments.js';
+/**
+ * Buyer-facing lifecycle status of an Order, as published on the wire by the
+ * Nevermined API (`WireOrderStatus` in nvm-monorepo
+ * `apps/api/src/orders/order-status.ts`).
+ */
+export type OrderStatus = 'requires_payment' | 'paid' | 'refunded' | 'partially_refunded' | 'disputed' | 'failed';
+/**
+ * Body of `POST /api/v1/orders` (`RegisterOrderDto`). The authenticated
+ * merchant key sets the price; the seller's Stripe Connect account is
+ * resolved server-side and is deliberately NOT part of this contract.
+ */
+export interface CreateOrderOptions {
+    /**
+     * Charge amount in USD cents (at least `100`, i.e. $1.00). The API validates
+     * the upper bound (`BCK.ORDER.0001`); a deployment may enforce a lower
+     * per-order cap (`BCK.ORDER.0003`).
+     */
+    amountMinor: number;
+    /** ISO currency, lower-cased. Phase 1 is USD-only; defaults to `'usd'`. */
+    currency?: 'usd';
+    /** Human-readable description of the charge (max 1024 chars). */
+    description?: string;
+    /** Opaque merchant-supplied buyer reference, e.g. the merchant's own order id (max 255 chars). */
+    buyerRef?: string;
+    /**
+     * Idempotency key (max 255 chars). A retry with the same key returns the
+     * original Order unchanged (and its `clientSecret` while the Order is still
+     * payable); the other fields of the retry are ignored, not merged. A retry
+     * with a different `amountMinor` or `currency` is refused with `BCK.ORDER.0007`.
+     */
+    idempotencyKey?: string;
+    /** Cart line items — merchant-defined structure, recorded verbatim (keys are not transformed), opaque to the API. */
+    lineItems?: Array<Record<string, unknown>>;
+    /** Merchant-defined metadata, recorded verbatim (keys are not transformed), opaque to the API. */
+    metadata?: Record<string, unknown>;
+    /** Stripe capture mode. Phase 1 supports `'automatic'` only (the default). */
+    captureMode?: 'automatic';
+    /** Payment Service Provider that settles the Order. Phase 1 implements `'stripe'` only (the default). */
+    paymentProvider?: 'stripe';
+}
+/** Response of `POST /api/v1/orders` (`CreateOrderResponseDto`). */
+export interface CreateOrderResult {
+    /** Unguessable Order id — the buyer-facing access control for {@link OrdersAPI.getOrder}. */
+    orderId: string;
+    status: OrderStatus;
+    /** Stripe PaymentIntent client secret the browser confirms against. Present only while the Order is payable. */
+    clientSecret?: string;
+}
+/**
+ * Buyer-safe view of an Order (`OrderResponseDto`). It never carries the
+ * merchant identity, the Connect account or the fee breakdown.
+ */
+export interface Order {
+    /** Unguessable Order id. */
+    id: string;
+    /** Charge amount in USD cents. */
+    amountMinor: number;
+    currency: string;
+    status: OrderStatus;
+    /** Total refunded so far, in cents. */
+    amountRefundedMinor: number;
+    description: string | null;
+    buyerRef: string | null;
+    /** The Stripe PaymentIntent backing this Order; `null` until it is created. */
+    paymentIntentId: string | null;
+    /** ISO-8601 instant when the Order stops being payable; `null` if it never expires. */
+    expiresAt: string | null;
+    /** Present only while the Order is payable. */
+    clientSecret?: string;
+}
+/**
+ * The OrdersAPI class wraps the browser-fiat Orders endpoints. An Order is a
+ * merchant-initiated, off-plan charge for an arbitrary amount (the Stripe
+ * PaymentIntent analog) that the buyer's browser confirms client-side — no
+ * plan, no buyer Nevermined account, no delegation.
+ *
+ * @remarks
+ * `createOrder` requires an **organization-scoped** NVM API key: the API reads
+ * the merchant organization from the key's own org tag, so a personal key is
+ * refused with `BCK.ORDER.0003`. `Payments.setOrganizationId` (the
+ * `X-Current-Org-Id` header) does not substitute for an org-scoped key.
+ *
+ * This client is the merchant's: a `Payments` instance is always constructed
+ * with an NVM API key. The buyer never needs one — the buyer's browser confirms
+ * the `clientSecret` with Stripe.js and can poll `GET /api/v1/orders/:id`
+ * directly, which is why {@link OrdersAPI.getOrder} sends no key on that call.
+ *
+ * @see nvm-monorepo `apps/api/src/orders/README.md` (epic #3238)
+ */
+export declare class OrdersAPI extends BasePaymentsAPI {
+    static getInstance(options: PaymentOptions): OrdersAPI;
+    /**
+     * Creates an Order and its PaymentIntent, returning the `clientSecret` a
+     * browser confirms against (`POST /api/v1/orders`).
+     *
+     * @remarks
+     * This method is oriented to merchants. The NVM API Key must be scoped to an
+     * active organization whose Stripe Connect account can receive card payments.
+     *
+     * @param options - @see {@link CreateOrderOptions}. `currency` defaults to `'usd'`.
+     * @returns The new Order id, its status and — while payable — the `clientSecret`.
+     * @throws PaymentsError carrying the backend catalogue code: `BCK.ORDER.0001`
+     *   (invalid request), `BCK.ORDER.0003` (not an active organization / over the
+     *   per-order cap), `BCK.ORDER.0007` (idempotency-key conflict),
+     *   `BCK.ORDER.0010` (velocity cap — retryable), `BCK.ORDER.0004`/`0005`
+     *   (Connect account / PaymentIntent failure, no money moved). A refusal
+     *   without a catalogue code (e.g. a gateway or throttle response) carries
+     *   `http_<status>` instead.
+     * @example
+     * ```
+     *  const { orderId, clientSecret } = await payments.orders.createOrder({
+     *    amountMinor: 3437, // $34.37
+     *    description: 'Cart checkout — 3 items',
+     *    idempotencyKey: 'merchant-order-4821',
+     *  })
+     * ```
+     */
+    createOrder(options: CreateOrderOptions): Promise<CreateOrderResult>;
+    /**
+     * Reads the buyer-safe view of an Order by id (`GET /api/v1/orders/:id`).
+     *
+     * @remarks
+     * The endpoint is anonymous — the unguessable id is the sole access control —
+     * so this call sends no API key (the `Payments` instance still needs one to
+     * be constructed). The response never includes the merchant identity or the
+     * fee, and carries `clientSecret` only while the Order is payable.
+     *
+     * @param orderId - The unguessable Order id returned by {@link createOrder}.
+     * @returns @see {@link Order}
+     * @throws PaymentsError with code `BCK.ORDER.0002` when no Order has this id.
+     *   The read endpoint is rate-limited — all anonymous callers behind one IP
+     *   share a bucket of 60 requests per minute — and a throttled call carries
+     *   no catalogue code, so it surfaces as code `http_429`. That is distinct
+     *   from the create-side velocity cap `BCK.ORDER.0010`; poll sparingly and
+     *   back off on `http_429`.
+     * @example
+     * ```
+     *  const order = await payments.orders.getOrder(orderId)
+     *  if (order.status === 'paid') fulfil(order)
+     * ```
+     */
+    getOrder(orderId: string): Promise<Order>;
+}
+//# sourceMappingURL=orders-api.d.ts.map

package/dist/api/orders-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orders-api.d.ts","sourceRoot":"","sources":["../../src/api/orders-api.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAGpD;;;;GAIG;AACH,MAAM,MAAM,WAAW,GACnB,kBAAkB,GAClB,MAAM,GACN,UAAU,GACV,oBAAoB,GACpB,UAAU,GACV,QAAQ,CAAA;AAEZ;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAA;IACnB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,KAAK,CAAA;IAChB,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,kGAAkG;IAClG,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,qHAAqH;IACrH,SAAS,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC1C,kGAAkG;IAClG,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,8EAA8E;IAC9E,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,yGAAyG;IACzG,eAAe,CAAC,EAAE,QAAQ,CAAA;CAC3B;AAED,oEAAoE;AACpE,MAAM,WAAW,iBAAiB;IAChC,6FAA6F;IAC7F,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,WAAW,CAAA;IACnB,gHAAgH;IAChH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,KAAK;IACpB,4BAA4B;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,kCAAkC;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,WAAW,CAAA;IACnB,uCAAuC;IACvC,mBAAmB,EAAE,MAAM,CAAA;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,+EAA+E;IAC/E,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,uFAAuF;IACvF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,SAAU,SAAQ,eAAe;IAC5C,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,cAAc,GAAG,SAAS;IAItD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACU,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAUjF;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACU,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;CASvD"}

package/dist/api/orders-api.js

@@ -0,0 +1,107 @@
+import { safeParseJson } from '../common/helper.js';
+import { PaymentsError } from '../common/payments.error.js';
+import { BasePaymentsAPI } from './base-payments.js';
+import { API_URL_CREATE_ORDER, API_URL_GET_ORDER } from './nvm-api.js';
+/**
+ * The OrdersAPI class wraps the browser-fiat Orders endpoints. An Order is a
+ * merchant-initiated, off-plan charge for an arbitrary amount (the Stripe
+ * PaymentIntent analog) that the buyer's browser confirms client-side — no
+ * plan, no buyer Nevermined account, no delegation.
+ *
+ * @remarks
+ * `createOrder` requires an **organization-scoped** NVM API key: the API reads
+ * the merchant organization from the key's own org tag, so a personal key is
+ * refused with `BCK.ORDER.0003`. `Payments.setOrganizationId` (the
+ * `X-Current-Org-Id` header) does not substitute for an org-scoped key.
+ *
+ * This client is the merchant's: a `Payments` instance is always constructed
+ * with an NVM API key. The buyer never needs one — the buyer's browser confirms
+ * the `clientSecret` with Stripe.js and can poll `GET /api/v1/orders/:id`
+ * directly, which is why {@link OrdersAPI.getOrder} sends no key on that call.
+ *
+ * @see nvm-monorepo `apps/api/src/orders/README.md` (epic #3238)
+ */
+export class OrdersAPI extends BasePaymentsAPI {
+    static getInstance(options) {
+        return new OrdersAPI(options);
+    }
+    /**
+     * Creates an Order and its PaymentIntent, returning the `clientSecret` a
+     * browser confirms against (`POST /api/v1/orders`).
+     *
+     * @remarks
+     * This method is oriented to merchants. The NVM API Key must be scoped to an
+     * active organization whose Stripe Connect account can receive card payments.
+     *
+     * @param options - @see {@link CreateOrderOptions}. `currency` defaults to `'usd'`.
+     * @returns The new Order id, its status and — while payable — the `clientSecret`.
+     * @throws PaymentsError carrying the backend catalogue code: `BCK.ORDER.0001`
+     *   (invalid request), `BCK.ORDER.0003` (not an active organization / over the
+     *   per-order cap), `BCK.ORDER.0007` (idempotency-key conflict),
+     *   `BCK.ORDER.0010` (velocity cap — retryable), `BCK.ORDER.0004`/`0005`
+     *   (Connect account / PaymentIntent failure, no money moved). A refusal
+     *   without a catalogue code (e.g. a gateway or throttle response) carries
+     *   `http_<status>` instead.
+     * @example
+     * ```
+     *  const { orderId, clientSecret } = await payments.orders.createOrder({
+     *    amountMinor: 3437, // $34.37
+     *    description: 'Cart checkout — 3 items',
+     *    idempotencyKey: 'merchant-order-4821',
+     *  })
+     * ```
+     */
+    async createOrder(options) {
+        const body = { ...options, currency: options.currency ?? 'usd' };
+        const url = new URL(API_URL_CREATE_ORDER, this.environment.backend);
+        const response = await fetch(url, this.getBackendHTTPOptions('POST', body));
+        if (!response.ok) {
+            throw PaymentsError.fromBackend('Unable to create order', await backendError(response));
+        }
+        return response.json();
+    }
+    /**
+     * Reads the buyer-safe view of an Order by id (`GET /api/v1/orders/:id`).
+     *
+     * @remarks
+     * The endpoint is anonymous — the unguessable id is the sole access control —
+     * so this call sends no API key (the `Payments` instance still needs one to
+     * be constructed). The response never includes the merchant identity or the
+     * fee, and carries `clientSecret` only while the Order is payable.
+     *
+     * @param orderId - The unguessable Order id returned by {@link createOrder}.
+     * @returns @see {@link Order}
+     * @throws PaymentsError with code `BCK.ORDER.0002` when no Order has this id.
+     *   The read endpoint is rate-limited — all anonymous callers behind one IP
+     *   share a bucket of 60 requests per minute — and a throttled call carries
+     *   no catalogue code, so it surfaces as code `http_429`. That is distinct
+     *   from the create-side velocity cap `BCK.ORDER.0010`; poll sparingly and
+     *   back off on `http_429`.
+     * @example
+     * ```
+     *  const order = await payments.orders.getOrder(orderId)
+     *  if (order.status === 'paid') fulfil(order)
+     * ```
+     */
+    async getOrder(orderId) {
+        const query = API_URL_GET_ORDER.replace(':orderId', encodeURIComponent(orderId));
+        const url = new URL(query, this.environment.backend);
+        const response = await fetch(url, this.getPublicHTTPOptions('GET'));
+        if (!response.ok) {
+            throw PaymentsError.fromBackend('Unable to get order', await backendError(response));
+        }
+        return response.json();
+    }
+}
+/**
+ * Backend error envelope with an `http_<status>` fallback `code`, so a refusal
+ * that is not an `NVMException` (the read endpoint's throttle is a Nest
+ * `ThrottlerException` with no `code`) is still branchable by callers instead
+ * of collapsing to the generic `payments_error`. A catalogue `code` in the body
+ * always wins. Same convention as the Python SDK's `PaymentsError.from_response`.
+ */
+async function backendError(response) {
+    const body = (await safeParseJson(response));
+    return { code: `http_${response.status}`, ...body };
+}
+//# sourceMappingURL=orders-api.js.map

package/dist/api/orders-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orders-api.js","sourceRoot":"","sources":["../../src/api/orders-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AAE3D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAkFtE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,SAAU,SAAQ,eAAe;IAC5C,MAAM,CAAC,WAAW,CAAC,OAAuB;QACxC,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,CAAA;IAC/B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACI,KAAK,CAAC,WAAW,CAAC,OAA2B;QAClD,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,KAAK,EAAE,CAAA;QAChE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QACnE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;QAC3E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,aAAa,CAAC,WAAW,CAAC,wBAAwB,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAA;QACzF,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAA;IACxB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACI,KAAK,CAAC,QAAQ,CAAC,OAAe;QACnC,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,UAAU,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAA;QAChF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QACpD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAA;QACnE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,aAAa,CAAC,WAAW,CAAC,qBAAqB,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAA;QACtF,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAA;IACxB,CAAC;CACF;AAED;;;;;;GAMG;AACH,KAAK,UAAU,YAAY,CAAC,QAAkB;IAC5C,MAAM,IAAI,GAAG,CAAC,MAAM,aAAa,CAAC,QAAQ,CAAC,CAA4B,CAAA;IACvE,OAAO,EAAE,IAAI,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,CAAA;AACrD,CAAC","sourcesContent":["import { safeParseJson } from '../common/helper.js'\nimport { PaymentsError } from '../common/payments.error.js'\nimport { PaymentOptions } from '../common/types.js'\nimport { BasePaymentsAPI } from './base-payments.js'\nimport { API_URL_CREATE_ORDER, API_URL_GET_ORDER } from './nvm-api.js'\n\n/**\n * Buyer-facing lifecycle status of an Order, as published on the wire by the\n * Nevermined API (`WireOrderStatus` in nvm-monorepo\n * `apps/api/src/orders/order-status.ts`).\n */\nexport type OrderStatus =\n  | 'requires_payment'\n  | 'paid'\n  | 'refunded'\n  | 'partially_refunded'\n  | 'disputed'\n  | 'failed'\n\n/**\n * Body of `POST /api/v1/orders` (`RegisterOrderDto`). The authenticated\n * merchant key sets the price; the seller's Stripe Connect account is\n * resolved server-side and is deliberately NOT part of this contract.\n */\nexport interface CreateOrderOptions {\n  /**\n   * Charge amount in USD cents (at least `100`, i.e. $1.00). The API validates\n   * the upper bound (`BCK.ORDER.0001`); a deployment may enforce a lower\n   * per-order cap (`BCK.ORDER.0003`).\n   */\n  amountMinor: number\n  /** ISO currency, lower-cased. Phase 1 is USD-only; defaults to `'usd'`. */\n  currency?: 'usd'\n  /** Human-readable description of the charge (max 1024 chars). */\n  description?: string\n  /** Opaque merchant-supplied buyer reference, e.g. the merchant's own order id (max 255 chars). */\n  buyerRef?: string\n  /**\n   * Idempotency key (max 255 chars). A retry with the same key returns the\n   * original Order unchanged (and its `clientSecret` while the Order is still\n   * payable); the other fields of the retry are ignored, not merged. A retry\n   * with a different `amountMinor` or `currency` is refused with `BCK.ORDER.0007`.\n   */\n  idempotencyKey?: string\n  /** Cart line items — merchant-defined structure, recorded verbatim (keys are not transformed), opaque to the API. */\n  lineItems?: Array<Record<string, unknown>>\n  /** Merchant-defined metadata, recorded verbatim (keys are not transformed), opaque to the API. */\n  metadata?: Record<string, unknown>\n  /** Stripe capture mode. Phase 1 supports `'automatic'` only (the default). */\n  captureMode?: 'automatic'\n  /** Payment Service Provider that settles the Order. Phase 1 implements `'stripe'` only (the default). */\n  paymentProvider?: 'stripe'\n}\n\n/** Response of `POST /api/v1/orders` (`CreateOrderResponseDto`). */\nexport interface CreateOrderResult {\n  /** Unguessable Order id — the buyer-facing access control for {@link OrdersAPI.getOrder}. */\n  orderId: string\n  status: OrderStatus\n  /** Stripe PaymentIntent client secret the browser confirms against. Present only while the Order is payable. */\n  clientSecret?: string\n}\n\n/**\n * Buyer-safe view of an Order (`OrderResponseDto`). It never carries the\n * merchant identity, the Connect account or the fee breakdown.\n */\nexport interface Order {\n  /** Unguessable Order id. */\n  id: string\n  /** Charge amount in USD cents. */\n  amountMinor: number\n  currency: string\n  status: OrderStatus\n  /** Total refunded so far, in cents. */\n  amountRefundedMinor: number\n  description: string | null\n  buyerRef: string | null\n  /** The Stripe PaymentIntent backing this Order; `null` until it is created. */\n  paymentIntentId: string | null\n  /** ISO-8601 instant when the Order stops being payable; `null` if it never expires. */\n  expiresAt: string | null\n  /** Present only while the Order is payable. */\n  clientSecret?: string\n}\n\n/**\n * The OrdersAPI class wraps the browser-fiat Orders endpoints. An Order is a\n * merchant-initiated, off-plan charge for an arbitrary amount (the Stripe\n * PaymentIntent analog) that the buyer's browser confirms client-side — no\n * plan, no buyer Nevermined account, no delegation.\n *\n * @remarks\n * `createOrder` requires an **organization-scoped** NVM API key: the API reads\n * the merchant organization from the key's own org tag, so a personal key is\n * refused with `BCK.ORDER.0003`. `Payments.setOrganizationId` (the\n * `X-Current-Org-Id` header) does not substitute for an org-scoped key.\n *\n * This client is the merchant's: a `Payments` instance is always constructed\n * with an NVM API key. The buyer never needs one — the buyer's browser confirms\n * the `clientSecret` with Stripe.js and can poll `GET /api/v1/orders/:id`\n * directly, which is why {@link OrdersAPI.getOrder} sends no key on that call.\n *\n * @see nvm-monorepo `apps/api/src/orders/README.md` (epic #3238)\n */\nexport class OrdersAPI extends BasePaymentsAPI {\n  static getInstance(options: PaymentOptions): OrdersAPI {\n    return new OrdersAPI(options)\n  }\n\n  /**\n   * Creates an Order and its PaymentIntent, returning the `clientSecret` a\n   * browser confirms against (`POST /api/v1/orders`).\n   *\n   * @remarks\n   * This method is oriented to merchants. The NVM API Key must be scoped to an\n   * active organization whose Stripe Connect account can receive card payments.\n   *\n   * @param options - @see {@link CreateOrderOptions}. `currency` defaults to `'usd'`.\n   * @returns The new Order id, its status and — while payable — the `clientSecret`.\n   * @throws PaymentsError carrying the backend catalogue code: `BCK.ORDER.0001`\n   *   (invalid request), `BCK.ORDER.0003` (not an active organization / over the\n   *   per-order cap), `BCK.ORDER.0007` (idempotency-key conflict),\n   *   `BCK.ORDER.0010` (velocity cap — retryable), `BCK.ORDER.0004`/`0005`\n   *   (Connect account / PaymentIntent failure, no money moved). A refusal\n   *   without a catalogue code (e.g. a gateway or throttle response) carries\n   *   `http_<status>` instead.\n   * @example\n   * ```\n   *  const { orderId, clientSecret } = await payments.orders.createOrder({\n   *    amountMinor: 3437, // $34.37\n   *    description: 'Cart checkout — 3 items',\n   *    idempotencyKey: 'merchant-order-4821',\n   *  })\n   * ```\n   */\n  public async createOrder(options: CreateOrderOptions): Promise<CreateOrderResult> {\n    const body = { ...options, currency: options.currency ?? 'usd' }\n    const url = new URL(API_URL_CREATE_ORDER, this.environment.backend)\n    const response = await fetch(url, this.getBackendHTTPOptions('POST', body))\n    if (!response.ok) {\n      throw PaymentsError.fromBackend('Unable to create order', await backendError(response))\n    }\n    return response.json()\n  }\n\n  /**\n   * Reads the buyer-safe view of an Order by id (`GET /api/v1/orders/:id`).\n   *\n   * @remarks\n   * The endpoint is anonymous — the unguessable id is the sole access control —\n   * so this call sends no API key (the `Payments` instance still needs one to\n   * be constructed). The response never includes the merchant identity or the\n   * fee, and carries `clientSecret` only while the Order is payable.\n   *\n   * @param orderId - The unguessable Order id returned by {@link createOrder}.\n   * @returns @see {@link Order}\n   * @throws PaymentsError with code `BCK.ORDER.0002` when no Order has this id.\n   *   The read endpoint is rate-limited — all anonymous callers behind one IP\n   *   share a bucket of 60 requests per minute — and a throttled call carries\n   *   no catalogue code, so it surfaces as code `http_429`. That is distinct\n   *   from the create-side velocity cap `BCK.ORDER.0010`; poll sparingly and\n   *   back off on `http_429`.\n   * @example\n   * ```\n   *  const order = await payments.orders.getOrder(orderId)\n   *  if (order.status === 'paid') fulfil(order)\n   * ```\n   */\n  public async getOrder(orderId: string): Promise<Order> {\n    const query = API_URL_GET_ORDER.replace(':orderId', encodeURIComponent(orderId))\n    const url = new URL(query, this.environment.backend)\n    const response = await fetch(url, this.getPublicHTTPOptions('GET'))\n    if (!response.ok) {\n      throw PaymentsError.fromBackend('Unable to get order', await backendError(response))\n    }\n    return response.json()\n  }\n}\n\n/**\n * Backend error envelope with an `http_<status>` fallback `code`, so a refusal\n * that is not an `NVMException` (the read endpoint's throttle is a Nest\n * `ThrottlerException` with no `code`) is still branchable by callers instead\n * of collapsing to the generic `payments_error`. A catalogue `code` in the body\n * always wins. Same convention as the Python SDK's `PaymentsError.from_response`.\n */\nasync function backendError(response: Response): Promise<Record<string, unknown>> {\n  const body = (await safeParseJson(response)) as Record<string, unknown>\n  return { code: `http_${response.status}`, ...body }\n}\n"]}

package/dist/index.d.ts

@@ -12,6 +12,8 @@ export { ContractsAPI } from './api/contracts-api.js';
 export { CURRENT_ORG_ID_HEADER } from './api/base-payments.js';
 export type { PublicationOptions } from './api/base-payments.js';
 export { OrganizationsAPI } from './api/organizations-api/organizations-api.js';
+export { OrdersAPI } from './api/orders-api.js';
+export type { CreateOrderOptions, CreateOrderResult, Order, OrderStatus } from './api/orders-api.js';
 export { OrganizationMemberRole, OrganizationType, OrganizationActivityEventType, } from './api/organizations-api/types.js';
 export type { MyMembership, OrganizationActivityEvent, OrganizationActivityFilters, OrganizationActivityPage, } from './api/organizations-api/types.js';
 export { buildPaymentRequired, resolveNetwork, resolveScheme } from './x402/facilitator-api.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,8CAA8C,CAAA;AAC5D,YAAY,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,YAAY,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAA;AAC/E,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,6BAA6B,GAC9B,MAAM,kCAAkC,CAAA;AACzC,YAAY,EACV,YAAY,EACZ,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AAGzC,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAC/F,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,YAAY,EACV,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,sBAAsB,EACtB,eAAe,EACf,WAAW,GACZ,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,mBAAmB,EACnB,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,eAAe,EACf,uBAAuB,EACvB,uBAAuB,EACvB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,2BAA2B,CAAA;AAGlC,cAAc,gBAAgB,CAAA;AAG9B,YAAY,EACV,cAAc,EACd,aAAa,EACb,cAAc,EACd,SAAS,EACT,cAAc,EACd,UAAU,GACX,MAAM,8BAA8B,CAAA;AAGrC,YAAY,EACV,SAAS,EACT,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,2BAA2B,CAAA;AAGlC,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAGvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AAExE,YAAY,EACV,SAAS,EACT,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,sBAAsB,EACtB,IAAI,EACJ,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,0BAA0B,EAC1B,qCAAqC,EACrC,YAAY,EACZ,qCAAqC,GACtC,MAAM,gBAAgB,CAAA;AAGvB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,4BAA4B,EAC5B,aAAa,IAAI,gBAAgB,GAClC,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,EAC1B,iCAAiC,GAClC,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,8CAA8C,CAAA;AAC5D,YAAY,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,YAAY,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAA;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACpG,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,6BAA6B,GAC9B,MAAM,kCAAkC,CAAA;AACzC,YAAY,EACV,YAAY,EACZ,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AAGzC,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAC/F,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,YAAY,EACV,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,sBAAsB,EACtB,eAAe,EACf,WAAW,GACZ,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,mBAAmB,EACnB,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,eAAe,EACf,uBAAuB,EACvB,uBAAuB,EACvB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,2BAA2B,CAAA;AAGlC,cAAc,gBAAgB,CAAA;AAG9B,YAAY,EACV,cAAc,EACd,aAAa,EACb,cAAc,EACd,SAAS,EACT,cAAc,EACd,UAAU,GACX,MAAM,8BAA8B,CAAA;AAGrC,YAAY,EACV,SAAS,EACT,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,2BAA2B,CAAA;AAGlC,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAGvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AAExE,YAAY,EACV,SAAS,EACT,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,sBAAsB,EACtB,IAAI,EACJ,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,0BAA0B,EAC1B,qCAAqC,EACrC,YAAY,EACZ,qCAAqC,GACtC,MAAM,gBAAgB,CAAA;AAGvB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,4BAA4B,EAC5B,aAAa,IAAI,gBAAgB,GAClC,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,EAC1B,iCAAiC,GAClC,MAAM,qBAAqB,CAAA"}

package/dist/index.js

@@ -10,6 +10,7 @@ export * from './api/observability-api/observability-api.js';
 export { ContractsAPI } from './api/contracts-api.js';
 export { CURRENT_ORG_ID_HEADER } from './api/base-payments.js';
 export { OrganizationsAPI } from './api/organizations-api/organizations-api.js';
+export { OrdersAPI } from './api/orders-api.js';
 export { OrganizationMemberRole, OrganizationType, OrganizationActivityEventType, } from './api/organizations-api/types.js';
 // x402 utilities and types
 export { buildPaymentRequired, resolveNetwork, resolveScheme } from './x402/facilitator-api.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,8CAA8C,CAAA;AAE5D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAE9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAA;AAC/E,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,6BAA6B,GAC9B,MAAM,kCAAkC,CAAA;AAQzC,2BAA2B;AAC3B,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAC/F,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAqBxD,iDAAiD;AACjD,cAAc,gBAAgB,CAAA;AAwB9B,qBAAqB;AACrB,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AAqBxE,4EAA4E;AAC5E,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,4BAA4B,EAC5B,aAAa,IAAI,gBAAgB,GAClC,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,EAC1B,iCAAiC,GAClC,MAAM,qBAAqB,CAAA","sourcesContent":["export * from './environments.js'\nexport * from './payments.js'\nexport * from './utils.js'\nexport * from './common/api-version.js'\nexport * from './common/types.js'\nexport * from './common/payments.error.js'\nexport * from './common/helper.js'\nexport * from './api/query-api.js'\nexport * from './api/observability-api/observability-api.js'\nexport type { BackendApiOptions } from './api/nvm-api.js'\nexport { ContractsAPI } from './api/contracts-api.js'\nexport { CURRENT_ORG_ID_HEADER } from './api/base-payments.js'\nexport type { PublicationOptions } from './api/base-payments.js'\nexport { OrganizationsAPI } from './api/organizations-api/organizations-api.js'\nexport {\n  OrganizationMemberRole,\n  OrganizationType,\n  OrganizationActivityEventType,\n} from './api/organizations-api/types.js'\nexport type {\n  MyMembership,\n  OrganizationActivityEvent,\n  OrganizationActivityFilters,\n  OrganizationActivityPage,\n} from './api/organizations-api/types.js'\n\n// x402 utilities and types\nexport { buildPaymentRequired, resolveNetwork, resolveScheme } from './x402/facilitator-api.js'\nexport { DelegationAPI } from './x402/delegation-api.js'\nexport type {\n  PaymentMethodSummary,\n  UpdatePaymentMethodDto,\n  DelegationSummary,\n  DelegationListResponse,\n  PurchasingPower,\n  ListOptions,\n} from './x402/delegation-api.js'\nexport type {\n  X402PaymentRequired,\n  X402PaymentAccepted,\n  X402Resource,\n  X402Scheme,\n  X402SchemeExtra,\n  VerifyPermissionsParams,\n  VerifyPermissionsResult,\n  SettlePermissionsParams,\n  SettlePermissionsResult,\n} from './x402/facilitator-api.js'\n\n// MPP (Machine Payments Protocol) public surface\nexport * from './mpp/index.js'\n\n// MCP public types\nexport type {\n  CreditsContext,\n  CreditsOption,\n  PaywallOptions,\n  McpConfig,\n  PaywallContext,\n  AuthResult,\n} from './mcp/types/paywall.types.js'\n\n// MCP HTTP types\nexport type {\n  OAuthUrls,\n  OAuthConfig,\n  HttpRouterConfig,\n  HttpServerConfig,\n  HttpServerResult,\n} from './mcp/types/http.types.js'\n\n// MCP extended config type\nexport type { ExtendedMcpConfig } from './mcp/index.js'\n\n// MCP HTTP utilities\nexport { createRequireAuthMiddleware } from './mcp/http/oauth-router.js'\n\nexport type {\n  AgentCard,\n  TaskHandlerResult,\n  TaskStatusUpdateEvent,\n  ExecutionEventBus,\n  AgentExecutor,\n  RequestContext,\n  PushNotificationConfig,\n  Task,\n  MessageSendParams,\n  SendMessageResponse,\n  TaskQueryParams,\n  GetTaskResponse,\n  TaskPushNotificationConfig,\n  SetTaskPushNotificationConfigResponse,\n  TaskIdParams,\n  GetTaskPushNotificationConfigResponse,\n} from './a2a/types.js'\n\n// x402 v2 A2A in-band transport utilities (mirrors the Python X402A2AUtils)\nexport {\n  X402A2AUtils,\n  x402A2AUtils,\n  X402A2AMetadata,\n  X402_SETTLEMENT_DEFERRED_KEY,\n  PaymentStatus as A2APaymentStatus,\n} from './a2a/x402-a2a.js'\nexport {\n  A2A_X402_EXTENSION_URI,\n  NVM_PAYMENT_EXTENSION_URI,\n  AGENT_CARD_WELL_KNOWN_PATH,\n  LEGACY_AGENT_CARD_WELL_KNOWN_PATH,\n} from './a2a/agent-card.js'\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAA;AACjC,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA;AAC1B,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,8CAA8C,CAAA;AAE5D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAE9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAA;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAE/C,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,6BAA6B,GAC9B,MAAM,kCAAkC,CAAA;AAQzC,2BAA2B;AAC3B,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAC/F,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAqBxD,iDAAiD;AACjD,cAAc,gBAAgB,CAAA;AAwB9B,qBAAqB;AACrB,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AAqBxE,4EAA4E;AAC5E,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,4BAA4B,EAC5B,aAAa,IAAI,gBAAgB,GAClC,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,EAC1B,iCAAiC,GAClC,MAAM,qBAAqB,CAAA","sourcesContent":["export * from './environments.js'\nexport * from './payments.js'\nexport * from './utils.js'\nexport * from './common/api-version.js'\nexport * from './common/types.js'\nexport * from './common/payments.error.js'\nexport * from './common/helper.js'\nexport * from './api/query-api.js'\nexport * from './api/observability-api/observability-api.js'\nexport type { BackendApiOptions } from './api/nvm-api.js'\nexport { ContractsAPI } from './api/contracts-api.js'\nexport { CURRENT_ORG_ID_HEADER } from './api/base-payments.js'\nexport type { PublicationOptions } from './api/base-payments.js'\nexport { OrganizationsAPI } from './api/organizations-api/organizations-api.js'\nexport { OrdersAPI } from './api/orders-api.js'\nexport type { CreateOrderOptions, CreateOrderResult, Order, OrderStatus } from './api/orders-api.js'\nexport {\n  OrganizationMemberRole,\n  OrganizationType,\n  OrganizationActivityEventType,\n} from './api/organizations-api/types.js'\nexport type {\n  MyMembership,\n  OrganizationActivityEvent,\n  OrganizationActivityFilters,\n  OrganizationActivityPage,\n} from './api/organizations-api/types.js'\n\n// x402 utilities and types\nexport { buildPaymentRequired, resolveNetwork, resolveScheme } from './x402/facilitator-api.js'\nexport { DelegationAPI } from './x402/delegation-api.js'\nexport type {\n  PaymentMethodSummary,\n  UpdatePaymentMethodDto,\n  DelegationSummary,\n  DelegationListResponse,\n  PurchasingPower,\n  ListOptions,\n} from './x402/delegation-api.js'\nexport type {\n  X402PaymentRequired,\n  X402PaymentAccepted,\n  X402Resource,\n  X402Scheme,\n  X402SchemeExtra,\n  VerifyPermissionsParams,\n  VerifyPermissionsResult,\n  SettlePermissionsParams,\n  SettlePermissionsResult,\n} from './x402/facilitator-api.js'\n\n// MPP (Machine Payments Protocol) public surface\nexport * from './mpp/index.js'\n\n// MCP public types\nexport type {\n  CreditsContext,\n  CreditsOption,\n  PaywallOptions,\n  McpConfig,\n  PaywallContext,\n  AuthResult,\n} from './mcp/types/paywall.types.js'\n\n// MCP HTTP types\nexport type {\n  OAuthUrls,\n  OAuthConfig,\n  HttpRouterConfig,\n  HttpServerConfig,\n  HttpServerResult,\n} from './mcp/types/http.types.js'\n\n// MCP extended config type\nexport type { ExtendedMcpConfig } from './mcp/index.js'\n\n// MCP HTTP utilities\nexport { createRequireAuthMiddleware } from './mcp/http/oauth-router.js'\n\nexport type {\n  AgentCard,\n  TaskHandlerResult,\n  TaskStatusUpdateEvent,\n  ExecutionEventBus,\n  AgentExecutor,\n  RequestContext,\n  PushNotificationConfig,\n  Task,\n  MessageSendParams,\n  SendMessageResponse,\n  TaskQueryParams,\n  GetTaskResponse,\n  TaskPushNotificationConfig,\n  SetTaskPushNotificationConfigResponse,\n  TaskIdParams,\n  GetTaskPushNotificationConfigResponse,\n} from './a2a/types.js'\n\n// x402 v2 A2A in-band transport utilities (mirrors the Python X402A2AUtils)\nexport {\n  X402A2AUtils,\n  x402A2AUtils,\n  X402A2AMetadata,\n  X402_SETTLEMENT_DEFERRED_KEY,\n  PaymentStatus as A2APaymentStatus,\n} from './a2a/x402-a2a.js'\nexport {\n  A2A_X402_EXTENSION_URI,\n  NVM_PAYMENT_EXTENSION_URI,\n  AGENT_CARD_WELL_KNOWN_PATH,\n  LEGACY_AGENT_CARD_WELL_KNOWN_PATH,\n} from './a2a/agent-card.js'\n"]}

package/dist/mcp/http/session-manager.d.ts

@@ -56,6 +56,26 @@ export declare class SessionManager {
     getRequestContext(sessionId: string): RequestContext | undefined;
     /**
      * Get or create a transport for a session.
+     *
+     * Always builds a FRESH transport, even when a transport is already cached for
+     * this session id. The transports are created in stateless mode
+     * (`sessionIdGenerator: undefined`), and the SDK's stateless transport is
+     * single-request by design — reusing a cached one yields an empty-body HTTP 500
+     * on the second request. Spec-compliant clients (Claude, Cursor, the official
+     * SDK) echo the `Mcp-Session-Id` we return on `initialize` back on every
+     * subsequent request, which used to route them straight into that broken reuse
+     * path. Rebuilding per request keeps the echoed-id path working exactly like the
+     * no-header path.
+     *
+     * The session map still records the latest transport per id so DELETE can
+     * terminate it and requests for an unknown id can be rejected. This managed
+     * server runs in stateless JSON-response mode (`enableJsonResponse: true`) and
+     * does NOT support standalone GET/SSE streams — the stateless transport rejects
+     * them — so there is no long-lived stream for a later POST to disrupt.
+     *
+     * ponytail: one shared McpServer that every request `close()`s and reconnects —
+     * two in-flight requests still race (tracked in #424). Per-session server+transport
+     * pairs are the upgrade if concurrency ever matters.
      */
     getOrCreateSession(sessionId: string): Promise<any>;
     /**

package/dist/mcp/http/session-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-manager.d.ts","sourceRoot":"","sources":["../../../src/mcp/http/session-manager.ts"],"names":[],"mappings":"AAUA;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAA;IACtD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,EAAE,CAAC,EAAE,MAAM,CAAA;CACZ;AAmBD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,yCAAyC;IACzC,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAA;IAC9C,2CAA2C;IAC3C,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAA;IAChD,sBAAsB;IACtB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC;AAED;;GAEG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAA8B;IAC9C,OAAO,CAAC,eAAe,CAAyC;IAChE,OAAO,CAAC,SAAS,CAAY;IAC7B,OAAO,CAAC,MAAM,CAAsB;gBAExB,MAAM,GAAE,oBAAyB;IAI7C;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI;IAI/B;;OAEG;IACH,iBAAiB,IAAI,MAAM;IAI3B;;OAEG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAItC;;OAEG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,GAAG,GAAG,SAAS;IAI9C;;;OAGG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI;IAInE;;;OAGG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIhE;;OAEG;IACG,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IA4DzD;;OAEG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAsB1C;;OAEG;IACH,iBAAiB,IAAI,MAAM,EAAE;IAI7B;;OAEG;IACH,eAAe,IAAI,MAAM;IAIzB;;OAEG;IACH,kBAAkB,IAAI,IAAI;IAQ1B;;OAEG;IACH,OAAO,CAAC,GAAG;CAGZ;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,GAAE,oBAAyB,GAAG,cAAc,CAEtF"}
+{"version":3,"file":"session-manager.d.ts","sourceRoot":"","sources":["../../../src/mcp/http/session-manager.ts"],"names":[],"mappings":"AAUA;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAA;IACtD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,EAAE,CAAC,EAAE,MAAM,CAAA;CACZ;AAmBD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,yCAAyC;IACzC,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAA;IAC9C,2CAA2C;IAC3C,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAA;IAChD,sBAAsB;IACtB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC;AAED;;GAEG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAA8B;IAC9C,OAAO,CAAC,eAAe,CAAyC;IAChE,OAAO,CAAC,SAAS,CAAY;IAC7B,OAAO,CAAC,MAAM,CAAsB;gBAExB,MAAM,GAAE,oBAAyB;IAI7C;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI;IAI/B;;OAEG;IACH,iBAAiB,IAAI,MAAM;IAI3B;;OAEG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAItC;;OAEG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,GAAG,GAAG,SAAS;IAI9C;;;OAGG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI;IAInE;;;OAGG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIhE;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAqDzD;;OAEG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAsB1C;;OAEG;IACH,iBAAiB,IAAI,MAAM,EAAE;IAI7B;;OAEG;IACH,eAAe,IAAI,MAAM;IAIzB;;OAEG;IACH,kBAAkB,IAAI,IAAI;IAQ1B;;OAEG;IACH,OAAO,CAAC,GAAG;CAGZ;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,GAAE,oBAAyB,GAAG,cAAc,CAEtF"}

package/dist/mcp/http/session-manager.js

@@ -71,14 +71,28 @@ export class SessionManager {
     }
     /**
      * Get or create a transport for a session.
+     *
+     * Always builds a FRESH transport, even when a transport is already cached for
+     * this session id. The transports are created in stateless mode
+     * (`sessionIdGenerator: undefined`), and the SDK's stateless transport is
+     * single-request by design — reusing a cached one yields an empty-body HTTP 500
+     * on the second request. Spec-compliant clients (Claude, Cursor, the official
+     * SDK) echo the `Mcp-Session-Id` we return on `initialize` back on every
+     * subsequent request, which used to route them straight into that broken reuse
+     * path. Rebuilding per request keeps the echoed-id path working exactly like the
+     * no-header path.
+     *
+     * The session map still records the latest transport per id so DELETE can
+     * terminate it and requests for an unknown id can be rejected. This managed
+     * server runs in stateless JSON-response mode (`enableJsonResponse: true`) and
+     * does NOT support standalone GET/SSE streams — the stateless transport rejects
+     * them — so there is no long-lived stream for a later POST to disrupt.
+     *
+     * ponytail: one shared McpServer that every request `close()`s and reconnects —
+     * two in-flight requests still race (tracked in #424). Per-session server+transport
+     * pairs are the upgrade if concurrency ever matters.
      */
     async getOrCreateSession(sessionId) {
-        if (this.sessions.has(sessionId)) {
-            const existingSession = this.sessions.get(sessionId);
-            if (existingSession) {
-                return existingSession;
-            }
-        }
         if (!this.mcpServer) {
             throw new Error('MCP server not set. Call setMcpServer() first.');
         }

package/dist/mcp/http/session-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-manager.js","sourceRoot":"","sources":["../../../src/mcp/http/session-manager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAEnC,mEAAmE;AACnE,IAAI,6BAA6B,GAAQ,IAAI,CAAA;AAa7C;;GAEG;AACH,KAAK,UAAU,iBAAiB;IAC9B,IAAI,CAAC,6BAA6B,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,oDAAoD,CAAC,CAAA;YACjF,6BAA6B,GAAG,MAAM,CAAC,6BAA6B,CAAA;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,4GAA4G,CAC7G,CAAA;QACH,CAAC;IACH,CAAC;IACD,OAAO,6BAA6B,CAAA;AACtC,CAAC;AAcD;;GAEG;AACH,MAAM,OAAO,cAAc;IAMzB,YAAY,SAA+B,EAAE;QALrC,aAAQ,GAAqB,IAAI,GAAG,EAAE,CAAA;QACtC,oBAAe,GAAgC,IAAI,GAAG,EAAE,CAAA;QACxD,cAAS,GAAQ,IAAI,CAAA;QAI3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAAW;QACtB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAA;IACzB,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,UAAU,EAAE,CAAA;IACrB,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACrC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACrC,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,SAAiB,EAAE,OAAuB;QAC1D,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IAC9C,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,SAAiB;QACjC,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC5C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CAAC,SAAiB;QACxC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YACpD,IAAI,eAAe,EAAE,CAAC;gBACpB,OAAO,eAAe,CAAA;YACxB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QACnE,CAAC;QAED,uFAAuF;QACvF,qFAAqF;QACrF,oFAAoF;QACpF,sFAAsF;QACtF,sFAAsF;QACtF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAA;QAC9B,CAAC;QAAC,OAAO,EAAE,EAAE,CAAC;YACZ,+DAA+D;QACjE,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,iBAAiB,EAAE,CAAA;QAEhD,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,SAAS,GAAG,IAAI,cAAc,CAAC;YACnC,kBAAkB,EAAE,SAAS;YAC7B,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAA;QAEF,0EAA0E;QAC1E,yEAAyE;QACzE,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;YACvB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAC/B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YACtC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,SAAS,CAAC,CAAA;YAC3C,IAAI,CAAC,GAAG,EAAE,CAAC,gCAAgC,SAAS,EAAE,CAAC,CAAA;QACzD,CAAC,CAAA;QAED,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAEvC,mFAAmF;QACnF,iFAAiF;QACjF,gFAAgF;QAChF,6DAA6D;QAC7D,IAAI,SAAS,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;YACrC,SAAS,CAAC,YAAY,GAAG,IAAI,CAAA;QAC/B,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QAEvC,IAAI,CAAC,GAAG,EAAE,CAAC,qCAAqC,SAAS,EAAE,CAAC,CAAA;QAC5D,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,SAAS,CAAC,CAAA;QAEzC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,SAAiB;QAC9B,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YAC9C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAC/B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA,CAAC,2BAA2B;YAClE,IAAI,CAAC,GAAG,EAAE,CAAC,qBAAqB,SAAS,EAAE,CAAC,CAAA;YAC5C,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,SAAS,CAAC,CAAA;YAE3C,sDAAsD;YACtD,IAAI,SAAS,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;gBACvD,IAAI,CAAC;oBACH,SAAS,CAAC,KAAK,EAAE,CAAA;gBACnB,CAAC;gBAAC,MAAM,CAAC;oBACP,sBAAsB;gBACxB,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;IACzC,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAA;IAC3B,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAA;QAC3C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAA;QAChC,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,CAAC,iBAAiB,UAAU,CAAC,MAAM,WAAW,CAAC,CAAA;IAC3D,CAAC;IAED;;OAEG;IACK,GAAG,CAAC,OAAe;QACzB,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAA;IAC5B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAA+B,EAAE;IACpE,OAAO,IAAI,cAAc,CAAC,MAAM,CAAC,CAAA;AACnC,CAAC","sourcesContent":["/**\n * Session manager for MCP transports.\n * Handles creation, retrieval, and cleanup of StreamableHTTPServerTransport instances.\n * Also stores request context (headers) per session for authentication.\n */\nimport { randomUUID } from 'crypto'\n\n// We'll dynamically import the SDK to avoid hard dependency issues\nlet StreamableHTTPServerTransport: any = null\n\n/**\n * Request context stored per session.\n * Contains HTTP headers and other request info needed for authentication.\n */\nexport interface RequestContext {\n  headers: Record<string, string | string[] | undefined>\n  method?: string\n  url?: string\n  ip?: string\n}\n\n/**\n * Lazily load the MCP SDK transport.\n */\nasync function getTransportClass(): Promise<any> {\n  if (!StreamableHTTPServerTransport) {\n    try {\n      const module = await import('@modelcontextprotocol/sdk/server/streamableHttp.js')\n      StreamableHTTPServerTransport = module.StreamableHTTPServerTransport\n    } catch (error) {\n      throw new Error(\n        'Failed to load @modelcontextprotocol/sdk. Make sure it is installed: npm install @modelcontextprotocol/sdk',\n      )\n    }\n  }\n  return StreamableHTTPServerTransport\n}\n\n/**\n * Configuration for session manager.\n */\nexport interface SessionManagerConfig {\n  /** Callback when a session is created */\n  onSessionCreated?: (sessionId: string) => void\n  /** Callback when a session is destroyed */\n  onSessionDestroyed?: (sessionId: string) => void\n  /** Logger function */\n  log?: (message: string) => void\n}\n\n/**\n * Manages MCP transport sessions.\n */\nexport class SessionManager {\n  private sessions: Map<string, any> = new Map()\n  private requestContexts: Map<string, RequestContext> = new Map()\n  private mcpServer: any = null\n  private config: SessionManagerConfig\n\n  constructor(config: SessionManagerConfig = {}) {\n    this.config = config\n  }\n\n  /**\n   * Set the MCP server that transports will connect to.\n   */\n  setMcpServer(server: any): void {\n    this.mcpServer = server\n  }\n\n  /**\n   * Generate a new session ID.\n   */\n  generateSessionId(): string {\n    return randomUUID()\n  }\n\n  /**\n   * Check if a session exists.\n   */\n  hasSession(sessionId: string): boolean {\n    return this.sessions.has(sessionId)\n  }\n\n  /**\n   * Get an existing session's transport.\n   */\n  getSession(sessionId: string): any | undefined {\n    return this.sessions.get(sessionId)\n  }\n\n  /**\n   * Store request context (headers, etc.) for a session.\n   * This is called when an HTTP request arrives, before dispatching to MCP.\n   */\n  setRequestContext(sessionId: string, context: RequestContext): void {\n    this.requestContexts.set(sessionId, context)\n  }\n\n  /**\n   * Get the stored request context for a session.\n   * Returns undefined if no context is stored.\n   */\n  getRequestContext(sessionId: string): RequestContext | undefined {\n    return this.requestContexts.get(sessionId)\n  }\n\n  /**\n   * Get or create a transport for a session.\n   */\n  async getOrCreateSession(sessionId: string): Promise<any> {\n    if (this.sessions.has(sessionId)) {\n      const existingSession = this.sessions.get(sessionId)\n      if (existingSession) {\n        return existingSession\n      }\n    }\n\n    if (!this.mcpServer) {\n      throw new Error('MCP server not set. Call setMcpServer() first.')\n    }\n\n    // In stateless mode (sessionIdGenerator: undefined), each request gets a new transport\n    // but McpServer can only have one transport at a time. Close the existing connection\n    // before connecting the new transport so Protocol._transport is reset to undefined.\n    // The StreamableHTTPServerTransport with enableJsonResponse does not auto-close after\n    // sending a JSON response, so we must close it explicitly before each new connection.\n    try {\n      await this.mcpServer.close()\n    } catch (_e) {\n      // Ignore close errors — server may not have been connected yet\n    }\n\n    const TransportClass = await getTransportClass()\n\n    // Use stateless mode (sessionIdGenerator: undefined) to avoid requiring\n    // Mcp-Session-Id header on every request. This allows clients to make\n    // direct JSON-RPC calls without the full MCP initialization handshake.\n    const transport = new TransportClass({\n      sessionIdGenerator: undefined,\n      enableJsonResponse: true,\n    })\n\n    // Set onclose BEFORE connect() so the SDK chains it with its own handler.\n    // When the transport closes, both our cleanup and the SDK's cleanup run.\n    transport.onclose = () => {\n      this.sessions.delete(sessionId)\n      this.requestContexts.delete(sessionId)\n      this.config.onSessionDestroyed?.(sessionId)\n      this.log?.(`Transport closed for session ${sessionId}`)\n    }\n\n    await this.mcpServer.connect(transport)\n\n    // Force _initialized to true to allow requests without requiring initialize first.\n    // This maintains backward compatibility with clients that don't send initialize.\n    // The SDK sets _initialized = true only after processing an initialize request,\n    // but we want to accept tool/resource/prompt calls directly.\n    if (transport._initialized === false) {\n      transport._initialized = true\n    }\n\n    this.sessions.set(sessionId, transport)\n\n    this.log?.(`Created new transport for session ${sessionId}`)\n    this.config.onSessionCreated?.(sessionId)\n\n    return transport\n  }\n\n  /**\n   * Destroy a session.\n   */\n  destroySession(sessionId: string): boolean {\n    if (this.sessions.has(sessionId)) {\n      const transport = this.sessions.get(sessionId)\n      this.sessions.delete(sessionId)\n      this.requestContexts.delete(sessionId) // Clean up request context\n      this.log?.(`Destroyed session ${sessionId}`)\n      this.config.onSessionDestroyed?.(sessionId)\n\n      // Try to close the transport if it has a close method\n      if (transport && typeof transport.close === 'function') {\n        try {\n          transport.close()\n        } catch {\n          // Ignore close errors\n        }\n      }\n\n      return true\n    }\n    return false\n  }\n\n  /**\n   * Get all active session IDs.\n   */\n  getActiveSessions(): string[] {\n    return Array.from(this.sessions.keys())\n  }\n\n  /**\n   * Get the number of active sessions.\n   */\n  getSessionCount(): number {\n    return this.sessions.size\n  }\n\n  /**\n   * Destroy all sessions.\n   */\n  destroyAllSessions(): void {\n    const sessionIds = this.getActiveSessions()\n    for (const sessionId of sessionIds) {\n      this.destroySession(sessionId)\n    }\n    this.log?.(`Destroyed all ${sessionIds.length} sessions`)\n  }\n\n  /**\n   * Internal logging helper (no-op if log not provided).\n   */\n  private log(message: string): void {\n    this.config.log?.(message)\n  }\n}\n\n/**\n * Create a new session manager.\n */\nexport function createSessionManager(config: SessionManagerConfig = {}): SessionManager {\n  return new SessionManager(config)\n}\n"]}
+{"version":3,"file":"session-manager.js","sourceRoot":"","sources":["../../../src/mcp/http/session-manager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAEnC,mEAAmE;AACnE,IAAI,6BAA6B,GAAQ,IAAI,CAAA;AAa7C;;GAEG;AACH,KAAK,UAAU,iBAAiB;IAC9B,IAAI,CAAC,6BAA6B,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,oDAAoD,CAAC,CAAA;YACjF,6BAA6B,GAAG,MAAM,CAAC,6BAA6B,CAAA;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,4GAA4G,CAC7G,CAAA;QACH,CAAC;IACH,CAAC;IACD,OAAO,6BAA6B,CAAA;AACtC,CAAC;AAcD;;GAEG;AACH,MAAM,OAAO,cAAc;IAMzB,YAAY,SAA+B,EAAE;QALrC,aAAQ,GAAqB,IAAI,GAAG,EAAE,CAAA;QACtC,oBAAe,GAAgC,IAAI,GAAG,EAAE,CAAA;QACxD,cAAS,GAAQ,IAAI,CAAA;QAI3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAAW;QACtB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAA;IACzB,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,UAAU,EAAE,CAAA;IACrB,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACrC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACrC,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,SAAiB,EAAE,OAAuB;QAC1D,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IAC9C,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,SAAiB;QACjC,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC5C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,KAAK,CAAC,kBAAkB,CAAC,SAAiB;QACxC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QACnE,CAAC;QAED,uFAAuF;QACvF,qFAAqF;QACrF,oFAAoF;QACpF,sFAAsF;QACtF,sFAAsF;QACtF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAA;QAC9B,CAAC;QAAC,OAAO,EAAE,EAAE,CAAC;YACZ,+DAA+D;QACjE,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,iBAAiB,EAAE,CAAA;QAEhD,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,SAAS,GAAG,IAAI,cAAc,CAAC;YACnC,kBAAkB,EAAE,SAAS;YAC7B,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAA;QAEF,0EAA0E;QAC1E,yEAAyE;QACzE,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;YACvB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAC/B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YACtC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,SAAS,CAAC,CAAA;YAC3C,IAAI,CAAC,GAAG,EAAE,CAAC,gCAAgC,SAAS,EAAE,CAAC,CAAA;QACzD,CAAC,CAAA;QAED,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAEvC,mFAAmF;QACnF,iFAAiF;QACjF,gFAAgF;QAChF,6DAA6D;QAC7D,IAAI,SAAS,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;YACrC,SAAS,CAAC,YAAY,GAAG,IAAI,CAAA;QAC/B,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QAEvC,IAAI,CAAC,GAAG,EAAE,CAAC,qCAAqC,SAAS,EAAE,CAAC,CAAA;QAC5D,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,SAAS,CAAC,CAAA;QAEzC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,SAAiB;QAC9B,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YAC9C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAC/B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA,CAAC,2BAA2B;YAClE,IAAI,CAAC,GAAG,EAAE,CAAC,qBAAqB,SAAS,EAAE,CAAC,CAAA;YAC5C,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,SAAS,CAAC,CAAA;YAE3C,sDAAsD;YACtD,IAAI,SAAS,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;gBACvD,IAAI,CAAC;oBACH,SAAS,CAAC,KAAK,EAAE,CAAA;gBACnB,CAAC;gBAAC,MAAM,CAAC;oBACP,sBAAsB;gBACxB,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;IACzC,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAA;IAC3B,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAA;QAC3C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAA;QAChC,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,CAAC,iBAAiB,UAAU,CAAC,MAAM,WAAW,CAAC,CAAA;IAC3D,CAAC;IAED;;OAEG;IACK,GAAG,CAAC,OAAe;QACzB,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAA;IAC5B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAA+B,EAAE;IACpE,OAAO,IAAI,cAAc,CAAC,MAAM,CAAC,CAAA;AACnC,CAAC","sourcesContent":["/**\n * Session manager for MCP transports.\n * Handles creation, retrieval, and cleanup of StreamableHTTPServerTransport instances.\n * Also stores request context (headers) per session for authentication.\n */\nimport { randomUUID } from 'crypto'\n\n// We'll dynamically import the SDK to avoid hard dependency issues\nlet StreamableHTTPServerTransport: any = null\n\n/**\n * Request context stored per session.\n * Contains HTTP headers and other request info needed for authentication.\n */\nexport interface RequestContext {\n  headers: Record<string, string | string[] | undefined>\n  method?: string\n  url?: string\n  ip?: string\n}\n\n/**\n * Lazily load the MCP SDK transport.\n */\nasync function getTransportClass(): Promise<any> {\n  if (!StreamableHTTPServerTransport) {\n    try {\n      const module = await import('@modelcontextprotocol/sdk/server/streamableHttp.js')\n      StreamableHTTPServerTransport = module.StreamableHTTPServerTransport\n    } catch (error) {\n      throw new Error(\n        'Failed to load @modelcontextprotocol/sdk. Make sure it is installed: npm install @modelcontextprotocol/sdk',\n      )\n    }\n  }\n  return StreamableHTTPServerTransport\n}\n\n/**\n * Configuration for session manager.\n */\nexport interface SessionManagerConfig {\n  /** Callback when a session is created */\n  onSessionCreated?: (sessionId: string) => void\n  /** Callback when a session is destroyed */\n  onSessionDestroyed?: (sessionId: string) => void\n  /** Logger function */\n  log?: (message: string) => void\n}\n\n/**\n * Manages MCP transport sessions.\n */\nexport class SessionManager {\n  private sessions: Map<string, any> = new Map()\n  private requestContexts: Map<string, RequestContext> = new Map()\n  private mcpServer: any = null\n  private config: SessionManagerConfig\n\n  constructor(config: SessionManagerConfig = {}) {\n    this.config = config\n  }\n\n  /**\n   * Set the MCP server that transports will connect to.\n   */\n  setMcpServer(server: any): void {\n    this.mcpServer = server\n  }\n\n  /**\n   * Generate a new session ID.\n   */\n  generateSessionId(): string {\n    return randomUUID()\n  }\n\n  /**\n   * Check if a session exists.\n   */\n  hasSession(sessionId: string): boolean {\n    return this.sessions.has(sessionId)\n  }\n\n  /**\n   * Get an existing session's transport.\n   */\n  getSession(sessionId: string): any | undefined {\n    return this.sessions.get(sessionId)\n  }\n\n  /**\n   * Store request context (headers, etc.) for a session.\n   * This is called when an HTTP request arrives, before dispatching to MCP.\n   */\n  setRequestContext(sessionId: string, context: RequestContext): void {\n    this.requestContexts.set(sessionId, context)\n  }\n\n  /**\n   * Get the stored request context for a session.\n   * Returns undefined if no context is stored.\n   */\n  getRequestContext(sessionId: string): RequestContext | undefined {\n    return this.requestContexts.get(sessionId)\n  }\n\n  /**\n   * Get or create a transport for a session.\n   *\n   * Always builds a FRESH transport, even when a transport is already cached for\n   * this session id. The transports are created in stateless mode\n   * (`sessionIdGenerator: undefined`), and the SDK's stateless transport is\n   * single-request by design — reusing a cached one yields an empty-body HTTP 500\n   * on the second request. Spec-compliant clients (Claude, Cursor, the official\n   * SDK) echo the `Mcp-Session-Id` we return on `initialize` back on every\n   * subsequent request, which used to route them straight into that broken reuse\n   * path. Rebuilding per request keeps the echoed-id path working exactly like the\n   * no-header path.\n   *\n   * The session map still records the latest transport per id so DELETE can\n   * terminate it and requests for an unknown id can be rejected. This managed\n   * server runs in stateless JSON-response mode (`enableJsonResponse: true`) and\n   * does NOT support standalone GET/SSE streams — the stateless transport rejects\n   * them — so there is no long-lived stream for a later POST to disrupt.\n   *\n   * ponytail: one shared McpServer that every request `close()`s and reconnects —\n   * two in-flight requests still race (tracked in #424). Per-session server+transport\n   * pairs are the upgrade if concurrency ever matters.\n   */\n  async getOrCreateSession(sessionId: string): Promise<any> {\n    if (!this.mcpServer) {\n      throw new Error('MCP server not set. Call setMcpServer() first.')\n    }\n\n    // In stateless mode (sessionIdGenerator: undefined), each request gets a new transport\n    // but McpServer can only have one transport at a time. Close the existing connection\n    // before connecting the new transport so Protocol._transport is reset to undefined.\n    // The StreamableHTTPServerTransport with enableJsonResponse does not auto-close after\n    // sending a JSON response, so we must close it explicitly before each new connection.\n    try {\n      await this.mcpServer.close()\n    } catch (_e) {\n      // Ignore close errors — server may not have been connected yet\n    }\n\n    const TransportClass = await getTransportClass()\n\n    // Use stateless mode (sessionIdGenerator: undefined) to avoid requiring\n    // Mcp-Session-Id header on every request. This allows clients to make\n    // direct JSON-RPC calls without the full MCP initialization handshake.\n    const transport = new TransportClass({\n      sessionIdGenerator: undefined,\n      enableJsonResponse: true,\n    })\n\n    // Set onclose BEFORE connect() so the SDK chains it with its own handler.\n    // When the transport closes, both our cleanup and the SDK's cleanup run.\n    transport.onclose = () => {\n      this.sessions.delete(sessionId)\n      this.requestContexts.delete(sessionId)\n      this.config.onSessionDestroyed?.(sessionId)\n      this.log?.(`Transport closed for session ${sessionId}`)\n    }\n\n    await this.mcpServer.connect(transport)\n\n    // Force _initialized to true to allow requests without requiring initialize first.\n    // This maintains backward compatibility with clients that don't send initialize.\n    // The SDK sets _initialized = true only after processing an initialize request,\n    // but we want to accept tool/resource/prompt calls directly.\n    if (transport._initialized === false) {\n      transport._initialized = true\n    }\n\n    this.sessions.set(sessionId, transport)\n\n    this.log?.(`Created new transport for session ${sessionId}`)\n    this.config.onSessionCreated?.(sessionId)\n\n    return transport\n  }\n\n  /**\n   * Destroy a session.\n   */\n  destroySession(sessionId: string): boolean {\n    if (this.sessions.has(sessionId)) {\n      const transport = this.sessions.get(sessionId)\n      this.sessions.delete(sessionId)\n      this.requestContexts.delete(sessionId) // Clean up request context\n      this.log?.(`Destroyed session ${sessionId}`)\n      this.config.onSessionDestroyed?.(sessionId)\n\n      // Try to close the transport if it has a close method\n      if (transport && typeof transport.close === 'function') {\n        try {\n          transport.close()\n        } catch {\n          // Ignore close errors\n        }\n      }\n\n      return true\n    }\n    return false\n  }\n\n  /**\n   * Get all active session IDs.\n   */\n  getActiveSessions(): string[] {\n    return Array.from(this.sessions.keys())\n  }\n\n  /**\n   * Get the number of active sessions.\n   */\n  getSessionCount(): number {\n    return this.sessions.size\n  }\n\n  /**\n   * Destroy all sessions.\n   */\n  destroyAllSessions(): void {\n    const sessionIds = this.getActiveSessions()\n    for (const sessionId of sessionIds) {\n      this.destroySession(sessionId)\n    }\n    this.log?.(`Destroyed all ${sessionIds.length} sessions`)\n  }\n\n  /**\n   * Internal logging helper (no-op if log not provided).\n   */\n  private log(message: string): void {\n    this.config.log?.(message)\n  }\n}\n\n/**\n * Create a new session manager.\n */\nexport function createSessionManager(config: SessionManagerConfig = {}): SessionManager {\n  return new SessionManager(config)\n}\n"]}

package/dist/payments.d.ts

@@ -10,6 +10,7 @@ import type { PaymentsA2AServerOptions, PaymentsA2AServerResult } from './a2a/se
 import { buildPaymentAgentCard } from './a2a/agent-card.js';
 import * as mcpModule from './mcp/index.js';
 import { OrganizationsAPI } from './api/organizations-api/organizations-api.js';
+import { OrdersAPI } from './api/orders-api.js';
 import { FacilitatorAPI } from './x402/facilitator-api.js';
 import { X402TokenAPI } from './x402/token.js';
 import { DelegationAPI } from './x402/delegation-api.js';
@@ -23,6 +24,7 @@ import { MppAPI } from './mpp/mpp-api.js';
  *
  * Each of these functionalities is encapsulated in its own API class:
  * - `plans`: Manages AI Plans, including registration and ordering and retrieving plan details.
+ * - `orders`: Browser-fiat Orders — merchant-initiated, off-plan charges for an arbitrary amount.
  * - `agents`: Handles AI Agents, including registration of AI Agents and access token generation.
  * - `requests`: Manages requests received by AI Agents, including validation and tracking.
  * - `observability`: Provides observability and logging utilities for AI Agents with Helicone integration
@@ -34,6 +36,7 @@ export declare class Payments extends BasePaymentsAPI {
     requests: AgentRequestsAPI;
     observability: ObservabilityAPI;
     organizations: OrganizationsAPI;
+    orders: OrdersAPI;
     contracts: ContractsAPI;
     facilitator: FacilitatorAPI;
     x402: X402TokenAPI;

package/dist/payments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payments.d.ts","sourceRoot":"","sources":["../src/payments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAE/C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAA;AAE/E,OAAO,KAAK,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAExF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAEzC;;;;;;;;;;;;GAYG;AACH,qBAAa,QAAS,SAAQ,eAAe;IACpC,KAAK,EAAG,UAAU,CAAA;IAClB,KAAK,EAAG,QAAQ,CAAA;IAChB,MAAM,EAAG,SAAS,CAAA;IAClB,QAAQ,EAAG,gBAAgB,CAAA;IAC3B,aAAa,EAAG,gBAAgB,CAAA;IAChC,aAAa,EAAG,gBAAgB,CAAA;IAChC,SAAS,EAAG,YAAY,CAAA;IACxB,WAAW,EAAG,cAAc,CAAA;IAC5B,IAAI,EAAG,YAAY,CAAA;IAC1B;;;;;;;;;;OAUG;IACI,GAAG,EAAG,MAAM,CAAA;IACnB,OAAO,CAAC,YAAY,CAAC,CAAgB;IACrC,OAAO,CAAC,WAAW,CAAC,CAAe;IAEnC;;;;OAIG;IACH,OAAO,CAAC,eAAe,CAAC,CAAkD;IAE1E;;;OAGG;IACH,IAAW,GAAG;QAEV;;;WAGG;yBAEQ,IAAI,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,KACzD,uBAAuB;QAE1B;;;;WAIG;6BACwB,GAAG;MAOjC;IAED;;;OAGG;IACH,IAAW,GAAG;;;sDAuIoC,CAAC,cAAc,CAAC,2LAKnC,CAAC;sDAK/B,CAAC,cACK,CAAC,uEAIO,CAAC;oFAKoC,CAAC,cACpD,CAAD,mLAGS,CAAC;;;;;;;6FA4C2H,CAAC,cAAc,CAAC;8IAAwd,CAAC,cAAwB,CAAC;+FAAyc,CAAC,cAAc,CAAC;;;kBAxBxjC,CAAC;;;;mBAwBsgJ,CAAC;;;;;;;;;MAtM/iJ;IAED;;;;;;;OAOG;IACH,IAAW,UAAU,IAAI,aAAa,CAUrC;IAED;;;OAGG;IACH,MAAM,CAAC,GAAG;;MAA4B;IAEtC;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,cAAc;IAO1C;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,cAAc;IAoBjD;;;;;OAKG;IACH,OAAO;IAOP;;OAEG;IACH,OAAO,CAAC,aAAa;IAarB;;;;;;;;;;OAUG;IACI,OAAO;IAMd;;;;;;;;;OASG;IACI,MAAM;IAIb;;;;;;;;;;;;;;;;;;;;OAoBG;IACa,iBAAiB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAiBtE;;;;;;;OAOG;IACH,IAAI,UAAU,IAAI,OAAO,CAExB;CACF"}
+{"version":3,"file":"payments.d.ts","sourceRoot":"","sources":["../src/payments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAE/C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAA;AAE/E,OAAO,KAAK,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAExF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAA;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAEzC;;;;;;;;;;;;;GAaG;AACH,qBAAa,QAAS,SAAQ,eAAe;IACpC,KAAK,EAAG,UAAU,CAAA;IAClB,KAAK,EAAG,QAAQ,CAAA;IAChB,MAAM,EAAG,SAAS,CAAA;IAClB,QAAQ,EAAG,gBAAgB,CAAA;IAC3B,aAAa,EAAG,gBAAgB,CAAA;IAChC,aAAa,EAAG,gBAAgB,CAAA;IAChC,MAAM,EAAG,SAAS,CAAA;IAClB,SAAS,EAAG,YAAY,CAAA;IACxB,WAAW,EAAG,cAAc,CAAA;IAC5B,IAAI,EAAG,YAAY,CAAA;IAC1B;;;;;;;;;;OAUG;IACI,GAAG,EAAG,MAAM,CAAA;IACnB,OAAO,CAAC,YAAY,CAAC,CAAgB;IACrC,OAAO,CAAC,WAAW,CAAC,CAAe;IAEnC;;;;OAIG;IACH,OAAO,CAAC,eAAe,CAAC,CAAkD;IAE1E;;;OAGG;IACH,IAAW,GAAG;QAEV;;;WAGG;yBAEQ,IAAI,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,KACzD,uBAAuB;QAE1B;;;;WAIG;6BACwB,GAAG;MAOjC;IAED;;;OAGG;IACH,IAAW,GAAG;;;sDA+Hb,CAAC,cACC,CAAA,2LAMO,CAAC;sDAE+B,CAAC,cAAc,CAAC,uEACxB,CAAC;oFASlC,CAAA,cACW,CAAC,mLAQmD,CAAC;;;;;;;6FA0CjD,CAAC,cAEhB,CAAH;8IAM4V,CAAC,cAAwB,CAAC;+FAAyc,CAAC,cAAc,CAAC;;;kBA7B/zB,CAAC;;;;mBA6B6wI,CAAC;;;;;;;;;MAxM5xI;IAED;;;;;;;OAOG;IACH,IAAW,UAAU,IAAI,aAAa,CAUrC;IAED;;;OAGG;IACH,MAAM,CAAC,GAAG;;MAA4B;IAEtC;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,cAAc;IAO1C;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,cAAc;IAoBjD;;;;;OAKG;IACH,OAAO;IAOP;;OAEG;IACH,OAAO,CAAC,aAAa;IAcrB;;;;;;;;;;OAUG;IACI,OAAO;IAMd;;;;;;;;;OASG;IACI,MAAM;IAIb;;;;;;;;;;;;;;;;;;;;OAoBG;IACa,iBAAiB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAkBtE;;;;;;;OAOG;IACH,IAAI,UAAU,IAAI,OAAO,CAExB;CACF"}

package/dist/payments.js

@@ -11,6 +11,7 @@ import { PaymentsA2AServer } from './a2a/server.js';
 import { buildPaymentAgentCard } from './a2a/agent-card.js';
 import * as mcpModule from './mcp/index.js';
 import { OrganizationsAPI } from './api/organizations-api/organizations-api.js';
+import { OrdersAPI } from './api/orders-api.js';
 import { FacilitatorAPI } from './x402/facilitator-api.js';
 import { X402TokenAPI } from './x402/token.js';
 import { DelegationAPI } from './x402/delegation-api.js';
@@ -24,6 +25,7 @@ import { MppAPI } from './mpp/mpp-api.js';
  *
  * Each of these functionalities is encapsulated in its own API class:
  * - `plans`: Manages AI Plans, including registration and ordering and retrieving plan details.
+ * - `orders`: Browser-fiat Orders — merchant-initiated, off-plan charges for an arbitrary amount.
  * - `agents`: Handles AI Agents, including registration of AI Agents and access token generation.
  * - `requests`: Manages requests received by AI Agents, including validation and tracking.
  * - `observability`: Provides observability and logging utilities for AI Agents with Helicone integration
@@ -157,6 +159,7 @@ export class Payments extends BasePaymentsAPI {
         this.requests = AgentRequestsAPI.getInstance(options);
         this.observability = ObservabilityAPI.getInstance(options);
         this.organizations = OrganizationsAPI.getInstance(options);
+        this.orders = OrdersAPI.getInstance(options);
         this.query = AIQueryApi.getInstance();
         this.contracts = new ContractsAPI(options);
         this.facilitator = FacilitatorAPI.getInstance(options);
@@ -221,6 +224,7 @@ export class Payments extends BasePaymentsAPI {
         this.requests?.setOrganizationId(organizationId);
         this.observability?.setOrganizationId(organizationId);
         this.organizations?.setOrganizationId(organizationId);
+        this.orders?.setOrganizationId(organizationId);
         this.contracts?.setOrganizationId(organizationId);
         this.facilitator?.setOrganizationId(organizationId);
         this.x402?.setOrganizationId(organizationId);

package/dist/payments.js.map

@@ -1 +1 @@
-{"version":3,"file":"payments.js","sourceRoot":"","sources":["../src/payments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAE1D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAExD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAEzC;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,QAAS,SAAQ,eAAe;IAgC3C;;;OAGG;IACH,IAAW,GAAG;QACZ,OAAO;YACL;;;eAGG;YACH,KAAK,EAAE,CACL,OAA0D,EACjC,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;YAE5F;;;;eAIG;YACH,SAAS,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;gBAChC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;oBACvB,IAAI,CAAC,YAAY,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,CAAA;gBAC9C,CAAC;gBACD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;YACnD,CAAC;SACF,CAAA;IACH,CAAC;IAED;;;OAGG;IACH,IAAW,GAAG;QACZ,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAA;QAC5D,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAA;IAC7B,CAAC;IAED;;;;;;;OAOG;IACH,IAAW,UAAU;QACnB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,GAAG,aAAa,CAAC,WAAW,CAAC;gBAC3C,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,WAAW,EAAE,IAAI,CAAC,eAAe;gBACjC,cAAc,EAAE,IAAI,CAAC,qBAAqB,IAAI,SAAS;gBACvD,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAQD;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,WAAW,CAAC,OAAuB;QACxC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,aAAa,CAAC,gCAAgC,CAAC,CAAA;QAC3D,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACrC,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAAuB;QAC/C,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,aAAa,CAAC,uBAAuB,CAAC,CAAA;QAClD,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACzC,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAW,CAAA;QAChE,IAAI,YAAY,EAAE,CAAC;YACjB,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QACtC,CAAC;QAED,MAAM,iBAAiB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAW,CAAA;QAC1E,IAAI,iBAAiB,EAAE,CAAC;YACtB,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;QAC3C,CAAC;QAED,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;QAEvD,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IACpC,CAAC;IAED;;;;;OAKG;IACH,YAAoB,OAAuB,EAAE,iBAAiB,GAAG,IAAI;QACnE,KAAK,CAAC,OAAO,CAAC,CAAA;QAEd,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAA;QAC1C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;IAC7B,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,OAAuB;QAC3C,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC1C,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC5C,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QACrD,IAAI,CAAC,aAAa,GAAG,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC1D,IAAI,CAAC,aAAa,GAAG,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC1D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,CAAA;QACrC,IAAI,CAAC,SAAS,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,CAAA;QAC1C,IAAI,CAAC,WAAW,GAAG,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QACtD,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC7C,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;IACxC,CAAC;IAED;;;;;;;;;;OAUG;IACI,OAAO;QACZ,IAAI,CAAC,IAAI,CAAC,iBAAiB;YAAE,OAAM;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,oBAAoB,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;QACpF,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAA;IACvC,CAAC;IAED;;;;;;;;;OASG;IACI,MAAM;QACX,IAAI,CAAC,SAAS,GAAG,EAAE,CAAA;IACrB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACa,iBAAiB,CAAC,cAA6B;QAC7D,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QAC7C,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QAC9C,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QAChD,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QACrD,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QACrD,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QACjD,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QACnD,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QAC5C,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QAC3C,sEAAsE;QACtE,mEAAmE;QACnE,iEAAiE;QACjE,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;IACrD,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAA;IAClC,CAAC;;AA9KD;;;GAGG;AACI,YAAG,GAAG,EAAE,qBAAqB,EAAE,CAAA","sourcesContent":["import { AIQueryApi } from './api/query-api.js'\nimport { PaymentsError } from './common/payments.error.js'\nimport { PaymentOptions } from './common/types.js'\nimport { BasePaymentsAPI } from './api/base-payments.js'\nimport { PlansAPI } from './api/plans-api.js'\nimport { ContractsAPI } from './api/contracts-api.js'\nimport { AgentsAPI } from './api/agents-api.js'\nimport { AgentRequestsAPI } from './api/requests-api.js'\nimport { ObservabilityAPI } from './api/observability-api/observability-api.js'\nimport { ClientRegistry } from './a2a/clientRegistry.js'\nimport type { PaymentsA2AServerOptions, PaymentsA2AServerResult } from './a2a/server.js'\nimport { PaymentsA2AServer } from './a2a/server.js'\nimport { buildPaymentAgentCard } from './a2a/agent-card.js'\nimport * as mcpModule from './mcp/index.js'\nimport { OrganizationsAPI } from './api/organizations-api/organizations-api.js'\nimport { FacilitatorAPI } from './x402/facilitator-api.js'\nimport { X402TokenAPI } from './x402/token.js'\nimport { DelegationAPI } from './x402/delegation-api.js'\nimport { MppAPI } from './mpp/mpp-api.js'\n\n/**\n * Main class that interacts with the Nevermined payments API.\n * Use `Payments.getInstance` for server-side usage or `Payments.getBrowserInstance` for browser usage.\n * @remarks This API requires a Nevermined API Key, which can be obtained by logging in to the Nevermined App.\n *\n * The library provides methods to manage AI Agents, Plans & process AI Agent Requests.\n *\n * Each of these functionalities is encapsulated in its own API class:\n * - `plans`: Manages AI Plans, including registration and ordering and retrieving plan details.\n * - `agents`: Handles AI Agents, including registration of AI Agents and access token generation.\n * - `requests`: Manages requests received by AI Agents, including validation and tracking.\n * - `observability`: Provides observability and logging utilities for AI Agents with Helicone integration\n */\nexport class Payments extends BasePaymentsAPI {\n  public query!: AIQueryApi\n  public plans!: PlansAPI\n  public agents!: AgentsAPI\n  public requests!: AgentRequestsAPI\n  public observability!: ObservabilityAPI\n  public organizations!: OrganizationsAPI\n  public contracts!: ContractsAPI\n  public facilitator!: FacilitatorAPI\n  public x402!: X402TokenAPI\n  /**\n   * MPP (Machine Payments Protocol) surface — challenge/credential framing over\n   * the same plans, delegations and credit burn as x402.\n   *\n   * @experimental Shipped ahead of its epic's declared MVP scope, so that the\n   * Express middleware's own dependency on it is reachable rather than hidden\n   * behind an internal handle. The NAME is settled — `payments.mpp` beside\n   * `payments.x402` is what a seller will guess, and renaming it after a tag\n   * costs a major. The SHAPE is not: this surface may change in a minor\n   * release until the epic adopts it.\n   */\n  public mpp!: MppAPI\n  private _a2aRegistry?: ClientRegistry\n  private _delegation?: DelegationAPI\n\n  /**\n   * Cached MCP integration to preserve configuration (e.g., agentId, serverName)\n   * across multiple getter accesses. This ensures callers do not need to retain\n   * a reference to a previously configured instance.\n   */\n  private _mcpIntegration?: ReturnType<typeof mcpModule.buildMcpIntegration>\n\n  /**\n   * Exposes A2A server and client registry methods.\n   * The client registry is initialized only if getClient is called.\n   */\n  public get a2a() {\n    return {\n      /**\n       * Starts the A2A server with payment integration.\n       * @param options - Server options.\n       */\n      start: (\n        options: Omit<PaymentsA2AServerOptions, 'paymentsService'>,\n      ): PaymentsA2AServerResult => PaymentsA2AServer.start({ ...options, paymentsService: this }),\n\n      /**\n       * Gets (or creates) a RegisteredPaymentsClient for the given alias.\n       * The registry is initialized only on first use.\n       * @param options - ClientRegistryOptions.\n       */\n      getClient: async (options: any) => {\n        if (!this._a2aRegistry) {\n          this._a2aRegistry = new ClientRegistry(this)\n        }\n        return await this._a2aRegistry.getClient(options)\n      },\n    }\n  }\n\n  /**\n   * Returns the MCP integration API. The instance is memoized so that configuration\n   * set via `configure({ agentId, serverName })` persists across calls.\n   */\n  public get mcp() {\n    if (!this._mcpIntegration) {\n      this._mcpIntegration = mcpModule.buildMcpIntegration(this)\n    }\n    return this._mcpIntegration\n  }\n\n  /**\n   * Returns the Delegation API for listing enrolled payment methods.\n   * The instance is lazily initialized on first access — the current\n   * organization pin (set via `setOrganizationId` or the constructor\n   * option) and the backend API version pin (`options.version`) are\n   * forwarded so the first call carries the right `X-Current-Org-Id`\n   * and `Nevermined-Version` headers.\n   */\n  public get delegation(): DelegationAPI {\n    if (!this._delegation) {\n      this._delegation = DelegationAPI.getInstance({\n        nvmApiKey: this.nvmApiKey,\n        environment: this.environmentName,\n        organizationId: this.currentOrganizationId ?? undefined,\n        version: this.version,\n      })\n    }\n    return this._delegation\n  }\n\n  /**\n   * Static A2A helpers and utilities.\n   * Example: Payments.a2a.buildPaymentAgentCard(...)\n   */\n  static a2a = { buildPaymentAgentCard }\n\n  /**\n   * Get an instance of the Payments class for server-side usage.\n   *\n   * @param options - The options to initialize the payments class.\n   * @example\n   * ```\n   * const payments = Payments.getInstance({\n   *   nvmApiKey: 'your-nvm-api-key',\n   *   environment: 'sandbox'\n   * })\n   * ```\n   * @returns An instance of {@link Payments}\n   * @throws PaymentsError if nvmApiKey is missing.\n   */\n  static getInstance(options: PaymentOptions) {\n    if (!options.nvmApiKey) {\n      throw new PaymentsError('Nevermined API Key is required')\n    }\n    return new Payments(options, false)\n  }\n\n  /**\n   * Get an instance of the Payments class for browser usage.\n   *\n   * @remarks\n   * This is a browser-only function.\n   *\n   * @param options - The options to initialize the payments class.\n   * @example\n   * ```\n   * const payments = Payments.getBrowserInstance({\n   *   returnUrl: 'https://mysite.example',\n   *   environment: 'sandbox',\n   *   appId: 'my-app-id',\n   *   version: '1.1'\n   * })\n   * ```\n   * @returns An instance of {@link Payments}\n   * @throws PaymentsError if returnUrl is missing.\n   */\n  static getBrowserInstance(options: PaymentOptions) {\n    if (!options.returnUrl) {\n      throw new PaymentsError('returnUrl is required')\n    }\n    const url = new URL(window.location.href)\n    const urlNvmApiKey = url.searchParams.get('nvmApiKey') as string\n    if (urlNvmApiKey) {\n      url.searchParams.delete('nvmApiKey')\n    }\n\n    const urlAccountAddress = url.searchParams.get('accountAddress') as string\n    if (urlAccountAddress) {\n      url.searchParams.delete('accountAddress')\n    }\n\n    history.replaceState(history.state, '', url.toString())\n\n    return new Payments(options, true)\n  }\n\n  /**\n   * Initializes the Payments class.\n   *\n   * @param options - The options to initialize the payments class.\n   * @param isBrowserInstance - Whether this instance is for browser usage.\n   */\n  private constructor(options: PaymentOptions, isBrowserInstance = true) {\n    super(options)\n\n    this.isBrowserInstance = isBrowserInstance\n    this.initializeApi(options)\n  }\n\n  /**\n   * Initializes the AI Query Protocol API.\n   */\n  private initializeApi(options: PaymentOptions) {\n    this.plans = PlansAPI.getInstance(options)\n    this.agents = AgentsAPI.getInstance(options)\n    this.requests = AgentRequestsAPI.getInstance(options)\n    this.observability = ObservabilityAPI.getInstance(options)\n    this.organizations = OrganizationsAPI.getInstance(options)\n    this.query = AIQueryApi.getInstance()\n    this.contracts = new ContractsAPI(options)\n    this.facilitator = FacilitatorAPI.getInstance(options)\n    this.x402 = X402TokenAPI.getInstance(options)\n    this.mpp = MppAPI.getInstance(options)\n  }\n\n  /**\n   * Initiates the connect flow. The user's browser will be redirected to\n   * the Nevermined App login page.\n   *\n   * @remarks\n   * This is a browser-only function.\n   * @example\n   * ```\n   * payments.connect()\n   * ```\n   */\n  public connect() {\n    if (!this.isBrowserInstance) return\n    const url = new URL(`/login?returnUrl=${this.returnUrl}`, this.environment.frontend)\n    window.location.href = url.toString()\n  }\n\n  /**\n   * Logs out the user by removing the NVM API key.\n   *\n   * @remarks\n   * This is a browser-only function.\n   * @example\n   * ```\n   * payments.logout()\n   * ```\n   */\n  public logout() {\n    this.nvmApiKey = ''\n  }\n\n  /**\n   * Pins (or clears) the active organization workspace used by every\n   * subsequent authenticated request. The SDK forwards the choice as the\n   * `X-Current-Org-Id` header so the backend scopes publications and\n   * other org-aware queries to the requested organization.\n   *\n   * Pass `null` to clear the pin and let the backend fall back to the\n   * API key's org tag or the caller's most-recent active membership.\n   *\n   * For one-off targeting (e.g. publish a single agent into Org B without\n   * leaving Org B as the active workspace) prefer the per-call\n   * `{ organizationId }` option on `agents.registerAgent` /\n   * `plans.registerPlan` / similar.\n   *\n   * @param organizationId - Org ID to pin (e.g. `org-…`) or `null` to clear.\n   * @example\n   * ```ts\n   * payments.setOrganizationId('org-abc123')\n   * await payments.agents.registerAgent(metadata, api, [planId]) // lands in org-abc123\n   * ```\n   */\n  public override setOrganizationId(organizationId: string | null): void {\n    super.setOrganizationId(organizationId)\n    this.plans?.setOrganizationId(organizationId)\n    this.agents?.setOrganizationId(organizationId)\n    this.requests?.setOrganizationId(organizationId)\n    this.observability?.setOrganizationId(organizationId)\n    this.organizations?.setOrganizationId(organizationId)\n    this.contracts?.setOrganizationId(organizationId)\n    this.facilitator?.setOrganizationId(organizationId)\n    this.x402?.setOrganizationId(organizationId)\n    this.mpp?.setOrganizationId(organizationId)\n    // `_delegation` is lazy — the getter forwards `currentOrganizationId`\n    // on first access, so only propagate to an already-built instance.\n    // (Eagerly constructing it here would change the lazy contract.)\n    this._delegation?.setOrganizationId(organizationId)\n  }\n\n  /**\n   * Checks if a user is logged in.\n   * @example\n   * ```\n   * payments.isLoggedIn\n   * ```\n   * @returns True if the user is logged in.\n   */\n  get isLoggedIn(): boolean {\n    return this.nvmApiKey.length > 0\n  }\n}\n"]}
+{"version":3,"file":"payments.js","sourceRoot":"","sources":["../src/payments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAE1D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAExD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAA;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAEzC;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,QAAS,SAAQ,eAAe;IAiC3C;;;OAGG;IACH,IAAW,GAAG;QACZ,OAAO;YACL;;;eAGG;YACH,KAAK,EAAE,CACL,OAA0D,EACjC,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;YAE5F;;;;eAIG;YACH,SAAS,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;gBAChC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;oBACvB,IAAI,CAAC,YAAY,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,CAAA;gBAC9C,CAAC;gBACD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;YACnD,CAAC;SACF,CAAA;IACH,CAAC;IAED;;;OAGG;IACH,IAAW,GAAG;QACZ,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAA;QAC5D,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAA;IAC7B,CAAC;IAED;;;;;;;OAOG;IACH,IAAW,UAAU;QACnB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,GAAG,aAAa,CAAC,WAAW,CAAC;gBAC3C,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,WAAW,EAAE,IAAI,CAAC,eAAe;gBACjC,cAAc,EAAE,IAAI,CAAC,qBAAqB,IAAI,SAAS;gBACvD,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAQD;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,WAAW,CAAC,OAAuB;QACxC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,aAAa,CAAC,gCAAgC,CAAC,CAAA;QAC3D,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACrC,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAAuB;QAC/C,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,aAAa,CAAC,uBAAuB,CAAC,CAAA;QAClD,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACzC,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAW,CAAA;QAChE,IAAI,YAAY,EAAE,CAAC;YACjB,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QACtC,CAAC;QAED,MAAM,iBAAiB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAW,CAAA;QAC1E,IAAI,iBAAiB,EAAE,CAAC;YACtB,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;QAC3C,CAAC;QAED,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;QAEvD,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IACpC,CAAC;IAED;;;;;OAKG;IACH,YAAoB,OAAuB,EAAE,iBAAiB,GAAG,IAAI;QACnE,KAAK,CAAC,OAAO,CAAC,CAAA;QAEd,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAA;QAC1C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;IAC7B,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,OAAuB;QAC3C,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC1C,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC5C,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QACrD,IAAI,CAAC,aAAa,GAAG,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC1D,IAAI,CAAC,aAAa,GAAG,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC1D,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC5C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,CAAA;QACrC,IAAI,CAAC,SAAS,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,CAAA;QAC1C,IAAI,CAAC,WAAW,GAAG,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QACtD,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC7C,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;IACxC,CAAC;IAED;;;;;;;;;;OAUG;IACI,OAAO;QACZ,IAAI,CAAC,IAAI,CAAC,iBAAiB;YAAE,OAAM;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,oBAAoB,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;QACpF,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAA;IACvC,CAAC;IAED;;;;;;;;;OASG;IACI,MAAM;QACX,IAAI,CAAC,SAAS,GAAG,EAAE,CAAA;IACrB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACa,iBAAiB,CAAC,cAA6B;QAC7D,KAAK,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QAC7C,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QAC9C,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QAChD,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QACrD,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QACrD,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QAC9C,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QACjD,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QACnD,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QAC5C,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;QAC3C,sEAAsE;QACtE,mEAAmE;QACnE,iEAAiE;QACjE,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAA;IACrD,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAA;IAClC,CAAC;;AAhLD;;;GAGG;AACI,YAAG,GAAG,EAAE,qBAAqB,EAAE,CAAA","sourcesContent":["import { AIQueryApi } from './api/query-api.js'\nimport { PaymentsError } from './common/payments.error.js'\nimport { PaymentOptions } from './common/types.js'\nimport { BasePaymentsAPI } from './api/base-payments.js'\nimport { PlansAPI } from './api/plans-api.js'\nimport { ContractsAPI } from './api/contracts-api.js'\nimport { AgentsAPI } from './api/agents-api.js'\nimport { AgentRequestsAPI } from './api/requests-api.js'\nimport { ObservabilityAPI } from './api/observability-api/observability-api.js'\nimport { ClientRegistry } from './a2a/clientRegistry.js'\nimport type { PaymentsA2AServerOptions, PaymentsA2AServerResult } from './a2a/server.js'\nimport { PaymentsA2AServer } from './a2a/server.js'\nimport { buildPaymentAgentCard } from './a2a/agent-card.js'\nimport * as mcpModule from './mcp/index.js'\nimport { OrganizationsAPI } from './api/organizations-api/organizations-api.js'\nimport { OrdersAPI } from './api/orders-api.js'\nimport { FacilitatorAPI } from './x402/facilitator-api.js'\nimport { X402TokenAPI } from './x402/token.js'\nimport { DelegationAPI } from './x402/delegation-api.js'\nimport { MppAPI } from './mpp/mpp-api.js'\n\n/**\n * Main class that interacts with the Nevermined payments API.\n * Use `Payments.getInstance` for server-side usage or `Payments.getBrowserInstance` for browser usage.\n * @remarks This API requires a Nevermined API Key, which can be obtained by logging in to the Nevermined App.\n *\n * The library provides methods to manage AI Agents, Plans & process AI Agent Requests.\n *\n * Each of these functionalities is encapsulated in its own API class:\n * - `plans`: Manages AI Plans, including registration and ordering and retrieving plan details.\n * - `orders`: Browser-fiat Orders — merchant-initiated, off-plan charges for an arbitrary amount.\n * - `agents`: Handles AI Agents, including registration of AI Agents and access token generation.\n * - `requests`: Manages requests received by AI Agents, including validation and tracking.\n * - `observability`: Provides observability and logging utilities for AI Agents with Helicone integration\n */\nexport class Payments extends BasePaymentsAPI {\n  public query!: AIQueryApi\n  public plans!: PlansAPI\n  public agents!: AgentsAPI\n  public requests!: AgentRequestsAPI\n  public observability!: ObservabilityAPI\n  public organizations!: OrganizationsAPI\n  public orders!: OrdersAPI\n  public contracts!: ContractsAPI\n  public facilitator!: FacilitatorAPI\n  public x402!: X402TokenAPI\n  /**\n   * MPP (Machine Payments Protocol) surface — challenge/credential framing over\n   * the same plans, delegations and credit burn as x402.\n   *\n   * @experimental Shipped ahead of its epic's declared MVP scope, so that the\n   * Express middleware's own dependency on it is reachable rather than hidden\n   * behind an internal handle. The NAME is settled — `payments.mpp` beside\n   * `payments.x402` is what a seller will guess, and renaming it after a tag\n   * costs a major. The SHAPE is not: this surface may change in a minor\n   * release until the epic adopts it.\n   */\n  public mpp!: MppAPI\n  private _a2aRegistry?: ClientRegistry\n  private _delegation?: DelegationAPI\n\n  /**\n   * Cached MCP integration to preserve configuration (e.g., agentId, serverName)\n   * across multiple getter accesses. This ensures callers do not need to retain\n   * a reference to a previously configured instance.\n   */\n  private _mcpIntegration?: ReturnType<typeof mcpModule.buildMcpIntegration>\n\n  /**\n   * Exposes A2A server and client registry methods.\n   * The client registry is initialized only if getClient is called.\n   */\n  public get a2a() {\n    return {\n      /**\n       * Starts the A2A server with payment integration.\n       * @param options - Server options.\n       */\n      start: (\n        options: Omit<PaymentsA2AServerOptions, 'paymentsService'>,\n      ): PaymentsA2AServerResult => PaymentsA2AServer.start({ ...options, paymentsService: this }),\n\n      /**\n       * Gets (or creates) a RegisteredPaymentsClient for the given alias.\n       * The registry is initialized only on first use.\n       * @param options - ClientRegistryOptions.\n       */\n      getClient: async (options: any) => {\n        if (!this._a2aRegistry) {\n          this._a2aRegistry = new ClientRegistry(this)\n        }\n        return await this._a2aRegistry.getClient(options)\n      },\n    }\n  }\n\n  /**\n   * Returns the MCP integration API. The instance is memoized so that configuration\n   * set via `configure({ agentId, serverName })` persists across calls.\n   */\n  public get mcp() {\n    if (!this._mcpIntegration) {\n      this._mcpIntegration = mcpModule.buildMcpIntegration(this)\n    }\n    return this._mcpIntegration\n  }\n\n  /**\n   * Returns the Delegation API for listing enrolled payment methods.\n   * The instance is lazily initialized on first access — the current\n   * organization pin (set via `setOrganizationId` or the constructor\n   * option) and the backend API version pin (`options.version`) are\n   * forwarded so the first call carries the right `X-Current-Org-Id`\n   * and `Nevermined-Version` headers.\n   */\n  public get delegation(): DelegationAPI {\n    if (!this._delegation) {\n      this._delegation = DelegationAPI.getInstance({\n        nvmApiKey: this.nvmApiKey,\n        environment: this.environmentName,\n        organizationId: this.currentOrganizationId ?? undefined,\n        version: this.version,\n      })\n    }\n    return this._delegation\n  }\n\n  /**\n   * Static A2A helpers and utilities.\n   * Example: Payments.a2a.buildPaymentAgentCard(...)\n   */\n  static a2a = { buildPaymentAgentCard }\n\n  /**\n   * Get an instance of the Payments class for server-side usage.\n   *\n   * @param options - The options to initialize the payments class.\n   * @example\n   * ```\n   * const payments = Payments.getInstance({\n   *   nvmApiKey: 'your-nvm-api-key',\n   *   environment: 'sandbox'\n   * })\n   * ```\n   * @returns An instance of {@link Payments}\n   * @throws PaymentsError if nvmApiKey is missing.\n   */\n  static getInstance(options: PaymentOptions) {\n    if (!options.nvmApiKey) {\n      throw new PaymentsError('Nevermined API Key is required')\n    }\n    return new Payments(options, false)\n  }\n\n  /**\n   * Get an instance of the Payments class for browser usage.\n   *\n   * @remarks\n   * This is a browser-only function.\n   *\n   * @param options - The options to initialize the payments class.\n   * @example\n   * ```\n   * const payments = Payments.getBrowserInstance({\n   *   returnUrl: 'https://mysite.example',\n   *   environment: 'sandbox',\n   *   appId: 'my-app-id',\n   *   version: '1.1'\n   * })\n   * ```\n   * @returns An instance of {@link Payments}\n   * @throws PaymentsError if returnUrl is missing.\n   */\n  static getBrowserInstance(options: PaymentOptions) {\n    if (!options.returnUrl) {\n      throw new PaymentsError('returnUrl is required')\n    }\n    const url = new URL(window.location.href)\n    const urlNvmApiKey = url.searchParams.get('nvmApiKey') as string\n    if (urlNvmApiKey) {\n      url.searchParams.delete('nvmApiKey')\n    }\n\n    const urlAccountAddress = url.searchParams.get('accountAddress') as string\n    if (urlAccountAddress) {\n      url.searchParams.delete('accountAddress')\n    }\n\n    history.replaceState(history.state, '', url.toString())\n\n    return new Payments(options, true)\n  }\n\n  /**\n   * Initializes the Payments class.\n   *\n   * @param options - The options to initialize the payments class.\n   * @param isBrowserInstance - Whether this instance is for browser usage.\n   */\n  private constructor(options: PaymentOptions, isBrowserInstance = true) {\n    super(options)\n\n    this.isBrowserInstance = isBrowserInstance\n    this.initializeApi(options)\n  }\n\n  /**\n   * Initializes the AI Query Protocol API.\n   */\n  private initializeApi(options: PaymentOptions) {\n    this.plans = PlansAPI.getInstance(options)\n    this.agents = AgentsAPI.getInstance(options)\n    this.requests = AgentRequestsAPI.getInstance(options)\n    this.observability = ObservabilityAPI.getInstance(options)\n    this.organizations = OrganizationsAPI.getInstance(options)\n    this.orders = OrdersAPI.getInstance(options)\n    this.query = AIQueryApi.getInstance()\n    this.contracts = new ContractsAPI(options)\n    this.facilitator = FacilitatorAPI.getInstance(options)\n    this.x402 = X402TokenAPI.getInstance(options)\n    this.mpp = MppAPI.getInstance(options)\n  }\n\n  /**\n   * Initiates the connect flow. The user's browser will be redirected to\n   * the Nevermined App login page.\n   *\n   * @remarks\n   * This is a browser-only function.\n   * @example\n   * ```\n   * payments.connect()\n   * ```\n   */\n  public connect() {\n    if (!this.isBrowserInstance) return\n    const url = new URL(`/login?returnUrl=${this.returnUrl}`, this.environment.frontend)\n    window.location.href = url.toString()\n  }\n\n  /**\n   * Logs out the user by removing the NVM API key.\n   *\n   * @remarks\n   * This is a browser-only function.\n   * @example\n   * ```\n   * payments.logout()\n   * ```\n   */\n  public logout() {\n    this.nvmApiKey = ''\n  }\n\n  /**\n   * Pins (or clears) the active organization workspace used by every\n   * subsequent authenticated request. The SDK forwards the choice as the\n   * `X-Current-Org-Id` header so the backend scopes publications and\n   * other org-aware queries to the requested organization.\n   *\n   * Pass `null` to clear the pin and let the backend fall back to the\n   * API key's org tag or the caller's most-recent active membership.\n   *\n   * For one-off targeting (e.g. publish a single agent into Org B without\n   * leaving Org B as the active workspace) prefer the per-call\n   * `{ organizationId }` option on `agents.registerAgent` /\n   * `plans.registerPlan` / similar.\n   *\n   * @param organizationId - Org ID to pin (e.g. `org-…`) or `null` to clear.\n   * @example\n   * ```ts\n   * payments.setOrganizationId('org-abc123')\n   * await payments.agents.registerAgent(metadata, api, [planId]) // lands in org-abc123\n   * ```\n   */\n  public override setOrganizationId(organizationId: string | null): void {\n    super.setOrganizationId(organizationId)\n    this.plans?.setOrganizationId(organizationId)\n    this.agents?.setOrganizationId(organizationId)\n    this.requests?.setOrganizationId(organizationId)\n    this.observability?.setOrganizationId(organizationId)\n    this.organizations?.setOrganizationId(organizationId)\n    this.orders?.setOrganizationId(organizationId)\n    this.contracts?.setOrganizationId(organizationId)\n    this.facilitator?.setOrganizationId(organizationId)\n    this.x402?.setOrganizationId(organizationId)\n    this.mpp?.setOrganizationId(organizationId)\n    // `_delegation` is lazy — the getter forwards `currentOrganizationId`\n    // on first access, so only propagate to an already-built instance.\n    // (Eagerly constructing it here would change the lazy contract.)\n    this._delegation?.setOrganizationId(organizationId)\n  }\n\n  /**\n   * Checks if a user is logged in.\n   * @example\n   * ```\n   * payments.isLoggedIn\n   * ```\n   * @returns True if the user is logged in.\n   */\n  get isLoggedIn(): boolean {\n    return this.nvmApiKey.length > 0\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nevermined-io/payments",
-  "version": "1.11.1",
+  "version": "1.12.0",
   "description": "Typescript SDK to interact with the Nevermined Payments Protocol",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",