letsfg 2026.5.71 → 2026.5.73

package/dist/index.d.ts

@@ -282,7 +282,7 @@ declare function getOfferDetailPromptNotes(offer: OfferDetailLike): string[];
  * const bt = new LetsFG({ bearerToken: process.env.LETSFG_BEARER_TOKEN });
  * const flights = await bt.search('GDN', 'BER', '2026-03-03');
  *
- * // Developer API (prepaid credits)
+ * // Developer API (look-to-book search: 200 free after every booking)
  * const bt2 = new LetsFG({ apiKey: 'letsfg_...' });
  * const flights2 = await bt2.search('LHR', 'JFK', '2026-04-15');
  * ```
@@ -402,7 +402,7 @@ interface SearchOptions {
 interface LetsFGConfig {
     /** PFS Bearer token from `letsfg auth`. Enables free search via POST /api/search polling. */
     bearerToken?: string;
-    /** Developer API key (prepaid credits, no per-booking fee). */
+    /** Developer API key. Look-to-book search; no booking fee, no transaction fee. */
     apiKey?: string;
     baseUrl?: string;
     timeout?: number;
@@ -495,11 +495,19 @@ declare class LetsFG {
      */
     resolveLocation(query: string): Promise<Array<Record<string, unknown>>>;
     /**
-     * Unlock a flight offer — confirms live price, reveals direct airline booking URL.
-     * Developer API only, legacy — there is no unlock endpoint on a PFS Bearer
-     * token, so PFS callers use book() directly.
+     * RETIRED 2026-09-08. Throws instead of calling the server.
+     *
+     * There is no unlock step on any lane. Unlock existed to confirm a live price
+     * before charging; booking now HOLDS the fare on the connected payment method
+     * and captures only once a real airline PNR exists, so a fare that moved
+     * cannot become a charge for a ticket you did not get. If it moves at
+     * checkout you get a `price_change` question to accept or decline instead.
+     *
+     * Kept as a method, and throwing locally rather than making the request, so an
+     * older caller gets one clear sentence at the line that is actually wrong —
+     * not a 410 body to decode, and not a TypeError somewhere else.
      */
-    unlock(offerId: string): Promise<UnlockResult>;
+    unlock(_offerId: string): Promise<UnlockResult>;
     /**
      * Book a flight.
      *
@@ -509,11 +517,64 @@ declare class LetsFG {
      * complete, { ok, booked: false, booking_url } — hand the link to the user,
      * nothing was charged.
      *
-     * Developer API (X-API-Key): charges ticket price + service fee via Stripe,
-     * creates a real PNR. Requires unlock() first. Always provide
-     * idempotencyKey to prevent double-bookings on retry.
+     * Developer API (X-API-Key): POST /flights/book. NO unlock step. searchId is
+     * REQUIRED — an offer is bookable only inside the search that produced it.
+     * The connected Revolut method is HELD, not charged; a LetsFG booking agent
+     * buys the ticket and the hold is captured only against a real airline PNR.
+     * Returns the 202 { ok, booking_id, state, held, charged: 0, poll_url } —
+     * poll getBooking(bookingId) until `terminal`, or use bookAndWait().
+     * Always provide idempotencyKey: a retry with the same key returns the
+     * existing booking instead of opening a second hold on the card.
      */
     book(offerId: string, passengers: Passenger[], contactEmail: string, contactPhone?: string, idempotencyKey?: string, searchId?: string): Promise<BookingResult | Record<string, unknown>>;
+    /**
+     * Poll a Developer API flight booking.
+     *
+     * Poll every few seconds until `terminal` is true. The poll is ALSO how LetsFG
+     * knows you are still there, which is what keeps a booking paused on a
+     * question alive — so do not back off to minutes.
+     *
+     * States: authorised, card_issued, booking_in_progress, awaiting_settlement,
+     * then completed (with `pnr` and `charged_amount`), failed (hold released,
+     * nothing charged) or needs_attention (a human at LetsFG is on it — do not
+     * book again).
+     */
+    getBooking(bookingId: string): Promise<Record<string, unknown>>;
+    /**
+     * Answer the open `question` on a booking.
+     *
+     * Echo the question's `round`. A stale round is refused with 409 rather than
+     * guessed at, so an answer to an old question can never be applied to a new
+     * one. Seat: { seats: [...] } or { skip: true }. Price change or paid extra:
+     * { confirm: true } or { skip: true } — declining an extra still completes
+     * the booking, without it.
+     */
+    answerBooking(bookingId: string, round: number, answer?: {
+        seats?: Array<Record<string, unknown>>;
+        confirm?: boolean;
+        skip?: boolean;
+    }): Promise<Record<string, unknown>>;
+    /**
+     * Book and poll to a terminal state. Mirrors bookHotelAndWait().
+     *
+     * Blocks for as long as the booking takes (4–11 minutes typically), so use
+     * book() + getBooking() instead if your caller has a request timeout.
+     *
+     * `onQuestion` returns the answer for answerBooking(). Without it, a fare
+     * increase is ACCEPTED and a paid extra is DECLINED — the conservative
+     * reading of "the traveller asked for this flight".
+     */
+    bookAndWait(offerId: string, passengers: Passenger[], contactEmail: string, searchId: string, opts?: {
+        contactPhone?: string;
+        idempotencyKey?: string;
+        pollMs?: number;
+        timeoutMs?: number;
+        onQuestion?: (q: Record<string, unknown>) => {
+            seats?: Array<Record<string, unknown>>;
+            confirm?: boolean;
+            skip?: boolean;
+        };
+    }): Promise<Record<string, unknown>>;
     /**
      * Resolve a place name to the city id that searchHotels() needs.
      *
@@ -621,13 +682,30 @@ declare class LetsFG {
      */
     cancelHotel(confirmation: string): Promise<Record<string, unknown>>;
     /**
-     * [Developer API only] Attach a card to a PAID prepaid Developer API account.
+     * [Developer API] Mint a one-time link for connecting a Revolut payment method.
+     *
+     * This replaced setupPayment() on 2026-09-08. Nothing is charged to connect, and
+     * card details never touch LetsFG: the returned `connect_url` opens a hosted page
+     * where the developer saves a card, Revolut Pay or Google Pay. A PERSON must open
+     * it in a browser — there is no endpoint that takes card details, so do not ask a
+     * user for a card number and do not try to automate this step.
+     *
+     * Most agents should NOT need a Developer API account at all. To authenticate for
+     * search and booking, run `letsfg auth`, which creates no billing account.
+     */
+    connectPayment(): Promise<Record<string, unknown>>;
+    /**
+     * RETIRED 2026-09-08 with Stripe. Throws instead of calling the server.
+     *
+     * `/agents/setup-payment` answers 410 Gone. Payment enrolment moved onto the same
+     * Revolut rail as the rest of the product: call connectPayment() and open the
+     * `connect_url` it returns.
      *
-     * Most agents should NOT call this. It is unrelated to authenticating for
-     * search and booking — for that, run `letsfg auth`, which puts a card on file
-     * through a zero-amount setup and creates no billing account.
+     * Kept as a method, and throwing locally rather than making the request, for the
+     * same reason as unlock() — an older caller gets one clear sentence at the line that
+     * is actually wrong, not a 410 body to decode and not a TypeError somewhere else.
      */
-    setupPayment(token?: string): Promise<Record<string, unknown>>;
+    setupPayment(_token?: string): Promise<Record<string, unknown>>;
     /**
      * Get current agent profile and usage stats.
      */

package/dist/index.js

@@ -1719,13 +1719,23 @@ var LetsFG = class {
     return Array.isArray(data) ? data : data.locations || [];
   }
   /**
-   * Unlock a flight offer — confirms live price, reveals direct airline booking URL.
-   * Developer API only, legacy — there is no unlock endpoint on a PFS Bearer
-   * token, so PFS callers use book() directly.
+   * RETIRED 2026-09-08. Throws instead of calling the server.
+   *
+   * There is no unlock step on any lane. Unlock existed to confirm a live price
+   * before charging; booking now HOLDS the fare on the connected payment method
+   * and captures only once a real airline PNR exists, so a fare that moved
+   * cannot become a charge for a ticket you did not get. If it moves at
+   * checkout you get a `price_change` question to accept or decline instead.
+   *
+   * Kept as a method, and throwing locally rather than making the request, so an
+   * older caller gets one clear sentence at the line that is actually wrong —
+   * not a 410 body to decode, and not a TypeError somewhere else.
    */
-  async unlock(offerId) {
-    this.requireApiKey();
-    return this.post("/developers/api/v1/bookings/unlock", { offer_id: offerId });
+  async unlock(_offerId) {
+    throw new LetsFGError(
+      "unlock() was retired on 2026-09-08 and the endpoint answers 410 Gone. There is no unlock step: call book() directly. The fare is held on the connected payment method and captured only against a real airline PNR. See https://letsfg.co/developers/api/docs",
+      410
+    );
   }
   /**
    * Book a flight.
@@ -1736,9 +1746,14 @@ var LetsFG = class {
    * complete, { ok, booked: false, booking_url } — hand the link to the user,
    * nothing was charged.
    *
-   * Developer API (X-API-Key): charges ticket price + service fee via Stripe,
-   * creates a real PNR. Requires unlock() first. Always provide
-   * idempotencyKey to prevent double-bookings on retry.
+   * Developer API (X-API-Key): POST /flights/book. NO unlock step. searchId is
+   * REQUIRED — an offer is bookable only inside the search that produced it.
+   * The connected Revolut method is HELD, not charged; a LetsFG booking agent
+   * buys the ticket and the hold is captured only against a real airline PNR.
+   * Returns the 202 { ok, booking_id, state, held, charged: 0, poll_url } —
+   * poll getBooking(bookingId) until `terminal`, or use bookAndWait().
+   * Always provide idempotencyKey: a retry with the same key returns the
+   * existing booking instead of opening a second hold on the card.
    */
   async book(offerId, passengers, contactEmail, contactPhone = "", idempotencyKey = "", searchId = "") {
     this.requireAuth();
@@ -1759,15 +1774,92 @@ var LetsFG = class {
       });
     }
     this.requireApiKey();
+    if (!searchId) {
+      throw new LetsFGError(
+        "searchId is required to book on the Developer API \u2014 pass the search_id from search()'s result. An offer can only be booked inside the search that produced it. (Before 2026-09-08 this argument was ignored on this path.)",
+        400
+      );
+    }
+    const pax = passengers.map((p) => ({ ...p }));
+    if (contactPhone && pax.length && !pax[0].phone_number) pax[0].phone_number = contactPhone;
     const body = {
+      search_id: searchId,
       offer_id: offerId,
-      booking_type: "flight",
-      passengers,
-      contact_email: contactEmail,
-      contact_phone: contactPhone
+      passengers: pax,
+      contact_email: contactEmail
     };
     if (idempotencyKey) body.idempotency_key = idempotencyKey;
-    return this.post("/developers/api/v1/bookings/book", body);
+    return this.post("/developers/api/v1/flights/book", body);
+  }
+  /**
+   * Poll a Developer API flight booking.
+   *
+   * Poll every few seconds until `terminal` is true. The poll is ALSO how LetsFG
+   * knows you are still there, which is what keeps a booking paused on a
+   * question alive — so do not back off to minutes.
+   *
+   * States: authorised, card_issued, booking_in_progress, awaiting_settlement,
+   * then completed (with `pnr` and `charged_amount`), failed (hold released,
+   * nothing charged) or needs_attention (a human at LetsFG is on it — do not
+   * book again).
+   */
+  async getBooking(bookingId) {
+    this.requireApiKey();
+    return this.getWithAuth(
+      `/developers/api/v1/flights/bookings/${encodeURIComponent(bookingId)}`
+    );
+  }
+  /**
+   * Answer the open `question` on a booking.
+   *
+   * Echo the question's `round`. A stale round is refused with 409 rather than
+   * guessed at, so an answer to an old question can never be applied to a new
+   * one. Seat: { seats: [...] } or { skip: true }. Price change or paid extra:
+   * { confirm: true } or { skip: true } — declining an extra still completes
+   * the booking, without it.
+   */
+  async answerBooking(bookingId, round, answer = {}) {
+    this.requireApiKey();
+    return this.post(
+      `/developers/api/v1/flights/bookings/${encodeURIComponent(bookingId)}/answer`,
+      { round, ...answer }
+    );
+  }
+  /**
+   * Book and poll to a terminal state. Mirrors bookHotelAndWait().
+   *
+   * Blocks for as long as the booking takes (4–11 minutes typically), so use
+   * book() + getBooking() instead if your caller has a request timeout.
+   *
+   * `onQuestion` returns the answer for answerBooking(). Without it, a fare
+   * increase is ACCEPTED and a paid extra is DECLINED — the conservative
+   * reading of "the traveller asked for this flight".
+   */
+  async bookAndWait(offerId, passengers, contactEmail, searchId, opts = {}) {
+    const { contactPhone = "", idempotencyKey = "", pollMs = 5e3, timeoutMs = 9e5, onQuestion } = opts;
+    const started = await this.book(
+      offerId,
+      passengers,
+      contactEmail,
+      contactPhone,
+      idempotencyKey,
+      searchId
+    );
+    if (!started || started.ok !== true) return started;
+    const bookingId = String(started.booking_id);
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+      await new Promise((r) => setTimeout(r, pollMs));
+      const state = await this.getBooking(bookingId);
+      const question = state.question;
+      if (question) {
+        const answer = onQuestion ? onQuestion(question) : question.kind === "extra" ? { skip: true } : { confirm: true };
+        await this.answerBooking(bookingId, Number(question.round), answer);
+        continue;
+      }
+      if (state.terminal) return state;
+    }
+    return this.getBooking(bookingId);
   }
   // ── Hotels ──────────────────────────────────────────────────────────
   //
@@ -1925,15 +2017,37 @@ var LetsFG = class {
     );
   }
   /**
-   * [Developer API only] Attach a card to a PAID prepaid Developer API account.
+   * [Developer API] Mint a one-time link for connecting a Revolut payment method.
+   *
+   * This replaced setupPayment() on 2026-09-08. Nothing is charged to connect, and
+   * card details never touch LetsFG: the returned `connect_url` opens a hosted page
+   * where the developer saves a card, Revolut Pay or Google Pay. A PERSON must open
+   * it in a browser — there is no endpoint that takes card details, so do not ask a
+   * user for a card number and do not try to automate this step.
    *
-   * Most agents should NOT call this. It is unrelated to authenticating for
-   * search and booking — for that, run `letsfg auth`, which puts a card on file
-   * through a zero-amount setup and creates no billing account.
+   * Most agents should NOT need a Developer API account at all. To authenticate for
+   * search and booking, run `letsfg auth`, which creates no billing account.
    */
-  async setupPayment(token = "tok_visa") {
+  async connectPayment() {
     this.requireApiKey();
-    return this.post("/developers/api/v1/agents/setup-payment", { token });
+    return this.post("/developers/api/v1/agents/connect-payment", {});
+  }
+  /**
+   * RETIRED 2026-09-08 with Stripe. Throws instead of calling the server.
+   *
+   * `/agents/setup-payment` answers 410 Gone. Payment enrolment moved onto the same
+   * Revolut rail as the rest of the product: call connectPayment() and open the
+   * `connect_url` it returns.
+   *
+   * Kept as a method, and throwing locally rather than making the request, for the
+   * same reason as unlock() — an older caller gets one clear sentence at the line that
+   * is actually wrong, not a 410 body to decode and not a TypeError somewhere else.
+   */
+  async setupPayment(_token) {
+    throw new LetsFGError(
+      "setupPayment() was retired on 2026-09-08 with Stripe and the endpoint answers 410 Gone. Call connectPayment() instead and open the connect_url it returns; nothing is charged to connect. See https://letsfg.co/developers/api/docs",
+      410
+    );
   }
   /**
    * Get current agent profile and usage stats.

package/dist/index.mjs

@@ -22,7 +22,7 @@ import {
   offerSummary,
   rankOffers,
   selectDiverseTop
-} from "./chunk-GO3FXQXC.mjs";
+} from "./chunk-F5BBI6XX.mjs";
 export {
   AuthenticationError,
   BoostedTravel,

package/package.json

@@ -1,56 +1,56 @@
-{
-  "name": "letsfg",
-  "version": "2026.5.71",
-  "description": "Flights and hotels for AI agents. Server-side engine covers hundreds of airlines; hotels are real bookable inventory with free cancellation and pay-later terms. Includes open-source ranking engine.",
-  "main": "dist/index.js",
-  "module": "dist/index.mjs",
-  "types": "dist/index.d.ts",
-  "bin": {
-    "letsfg": "dist/cli.js"
-  },
-  "files": [
-    "dist/",
-    "README.md",
-    "LICENSE"
-  ],
-  "scripts": {
-    "build": "tsup src/index.ts src/cli.ts --format cjs,esm --dts --clean",
-    "test": "tsx --test src/index.test.ts src/auth.test.ts",
-    "prepublishOnly": "npm run build"
-  },
-  "keywords": [
-    "flights",
-    "travel",
-    "booking",
-    "agent",
-    "ai",
-    "cli",
-    "autonomous",
-    "mcp",
-    "openai",
-    "airline",
-    "ndc",
-    "search",
-    "ndc",
-    "hotels",
-    "hotel-booking",
-    "hotel-search",
-    "accommodation"
-  ],
-  "author": "LetsFG",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/LetsFG/LetsFG.git"
-  },
-  "homepage": "https://letsfg.co",
-  "devDependencies": {
-    "@types/node": "^25.3.3",
-    "tsup": "^8.0.0",
-    "tsx": "^4.19.0",
-    "typescript": "^5.3.0"
-  },
-  "engines": {
-    "node": ">=18.0.0"
-  }
-}
+{
+  "name": "letsfg",
+  "version": "2026.5.73",
+  "description": "Flights and hotels for AI agents. Server-side engine covers hundreds of airlines; hotels are real bookable inventory with free cancellation and pay-later terms. Includes open-source ranking engine.",
+  "main": "dist/index.js",
+  "module": "dist/index.mjs",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "letsfg": "dist/cli.js"
+  },
+  "files": [
+    "dist/",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsup src/index.ts src/cli.ts --format cjs,esm --dts --clean",
+    "test": "tsx --test src/index.test.ts src/auth.test.ts",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "flights",
+    "travel",
+    "booking",
+    "agent",
+    "ai",
+    "cli",
+    "autonomous",
+    "mcp",
+    "openai",
+    "airline",
+    "ndc",
+    "search",
+    "ndc",
+    "hotels",
+    "hotel-booking",
+    "hotel-search",
+    "accommodation"
+  ],
+  "author": "LetsFG",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/LetsFG/LetsFG.git"
+  },
+  "homepage": "https://letsfg.co",
+  "devDependencies": {
+    "@types/node": "^25.3.3",
+    "tsup": "^8.0.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.3.0"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  }
+}

package/dist/auth-SYZ5AYZ6.mjs

@@ -1,16 +0,0 @@
-import {
-  BearerTokenError,
-  getBearerToken,
-  paymentAuth,
-  requestEnrolment,
-  saveToken,
-  verifyPaymentMethod
-} from "./chunk-XNO2W77S.mjs";
-export {
-  BearerTokenError,
-  getBearerToken,
-  paymentAuth,
-  requestEnrolment,
-  saveToken,
-  verifyPaymentMethod
-};

package/dist/chunk-XNO2W77S.mjs

@@ -1,126 +0,0 @@
-// src/auth.ts
-import { readFileSync, writeFileSync, mkdirSync, chmodSync, existsSync } from "fs";
-import { homedir, platform } from "os";
-import { join, dirname } from "path";
-var BASE_URL = process.env.LETSFG_BASE_URL || "https://letsfg.co";
-var TOKEN_TTL_MS = 90 * 24 * 3600 * 1e3;
-var BearerTokenError = class extends Error {
-};
-function configPath() {
-  const base = platform() === "win32" ? process.env.APPDATA || homedir() : homedir();
-  return join(base, ".letsfg", "config.json");
-}
-function loadConfig() {
-  const p = configPath();
-  if (!existsSync(p)) return {};
-  try {
-    return JSON.parse(readFileSync(p, "utf-8"));
-  } catch {
-    return {};
-  }
-}
-function saveConfig(cfg) {
-  const p = configPath();
-  mkdirSync(dirname(p), { recursive: true });
-  writeFileSync(p, JSON.stringify(cfg, null, 2));
-  try {
-    chmodSync(p, 384);
-  } catch {
-  }
-}
-function getBearerToken() {
-  const env = process.env.LETSFG_BEARER_TOKEN;
-  if (env) return env;
-  const auth = loadConfig().pfs_auth;
-  if (auth?.token && Date.now() < auth.expires_at - 36e5) {
-    return auth.token;
-  }
-  throw new BearerTokenError(
-    "No valid LetsFG Bearer token.\n  Run:  letsfg auth        (adds a payment method \u2014 nothing is charged)\n  Or:   export LETSFG_BEARER_TOKEN=<token>"
-  );
-}
-function saveToken(token, expiresAt) {
-  const cfg = loadConfig();
-  cfg.pfs_auth = { token, expires_at: expiresAt ?? Date.now() + TOKEN_TTL_MS };
-  saveConfig(cfg);
-}
-async function postJson(path, payload) {
-  const resp = await fetch(`${BASE_URL}${path}`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json", "User-Agent": "LetsFG-js/0.1.0", "X-Client-Type": "js-sdk" },
-    body: JSON.stringify(payload)
-  });
-  const data = await resp.json().catch(() => ({}));
-  return { status: resp.status, data };
-}
-function parseExpiry(raw) {
-  if (typeof raw === "number") return raw * 1e3;
-  if (typeof raw === "string") {
-    const ms = Date.parse(raw);
-    if (!Number.isNaN(ms)) return ms;
-  }
-  return Date.now() + TOKEN_TTL_MS;
-}
-async function requestEnrolment() {
-  const { status, data } = await postJson("/api/agent-access/request", {});
-  if (status !== 200 && status !== 402) {
-    throw new BearerTokenError(`Could not start authentication (HTTP ${status}): ${data.error || ""}`);
-  }
-  return data;
-}
-async function verifyPaymentMethod(opts) {
-  const payload = {};
-  if (opts.setupSessionId) payload.setup_session_id = opts.setupSessionId;
-  else if (opts.paymentMethodId) payload.payment_method_id = opts.paymentMethodId;
-  else if (opts.cardToken) payload.card_token = opts.cardToken;
-  else throw new BearerTokenError("Provide one of setupSessionId, paymentMethodId, or cardToken.");
-  const { status, data } = await postJson("/api/agent-access/verify", payload);
-  if (status !== 200 || !data.token) {
-    throw new BearerTokenError(`Verification failed (HTTP ${status}). ${data.hint || data.error || ""}`.trim());
-  }
-  const token = data.token;
-  saveToken(token, parseExpiry(data.expires_at));
-  return token;
-}
-function openBrowser(url) {
-  import("child_process").then(({ exec }) => {
-    const cmd = platform() === "win32" ? `start "" "${url}"` : platform() === "darwin" ? `open "${url}"` : `xdg-open "${url}"`;
-    exec(cmd, () => {
-    });
-  }).catch(() => {
-  });
-}
-async function paymentAuth(openBrowserFlag = true) {
-  console.log("\n  Connecting to LetsFG...");
-  const data = await requestEnrolment();
-  const setupUrl = data.setup_url;
-  const sessionId = data.setup_session_id;
-  if (!setupUrl || !sessionId) {
-    throw new BearerTokenError("Server did not return a setup URL. Check https://letsfg.co/for-agents");
-  }
-  console.log("\n  LetsFG needs a payment method on file before it can search or book.");
-  console.log("  Nothing is charged now \u2014 this is a zero-amount card setup.\n");
-  console.log("  Step 1 \u2014 add a card here:\n");
-  console.log(`     ${setupUrl}
-`);
-  if (openBrowserFlag) openBrowser(setupUrl);
-  console.log("  Step 2 \u2014 press Enter once you've finished.");
-  const readline = await import("readline/promises");
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  await rl.question("");
-  rl.close();
-  process.stdout.write("  Verifying... ");
-  const token = await verifyPaymentMethod({ setupSessionId: sessionId });
-  const expiresAt = loadConfig().pfs_auth?.expires_at ?? Date.now() + TOKEN_TTL_MS;
-  console.log(`done. Token valid until ${new Date(expiresAt).toISOString().slice(0, 10)}.`);
-  return token;
-}
-
-export {
-  BearerTokenError,
-  getBearerToken,
-  saveToken,
-  requestEnrolment,
-  verifyPaymentMethod,
-  paymentAuth
-};