v0.14.0

Added

• Private payments with Hinkal (live on the P2Flux API since 26 October 2026). privatePayment: 'hinkal' on createPayment() and createPaymentLink() (once and reusable, not subscriptions) adds "Pay privately with Hinkal"
  to the hosted checkout. It comes back on the result, on resolvePayment() and on link terms.
• accounting.refundable on a verification is false for a payment made through a privacy service
  (its on-chain payer is that service's contract, so P2Flux will not prepare a refund); link payments
  in the manage view carry refundable and screening. Absent means refundable as before.
  (https://p2flux.com/docs/payments.html#private)

0.13.0 - Redirect checkout

Added

• Redirect checkout. returnUrl on createPayment() and createPaymentLink(): after paying, the
  hosted checkout sends the buyer back with p2flux_reference, p2flux_tx and p2flux_status in
  the query. Every create result now carries checkoutUrl, the hosted page to send the buyer to.
  resolvePayment() and link terms report returnUrl. An older API leaves both out. (https://p2flux.com/docs/payments.html#return)

npm: npm i @p2flux/sdk@0.13.0

0.12.0 - Optional webhooks

Added

• Optional webhooks (live on the P2Flux API since 15 October 2026). Pass notifyUrl (a public
  https URL) to createPayment() or createPaymentLink() and P2Flux POSTs payment.paid,
  subscription.charged or subscription.updated there, retrying for about 18 hours. Without it
  nothing changes. notifyUrl comes back on the result only when the payment or link is watched.
  (https://p2flux.com/docs/webhooks.html)
• handleNotification(body, expect) - confirms a notification with the API before you fulfil:
  { reference } for a payment, { linkId, manage } for a link. Returns confirmed, a dedupeKey
  built from the verified payment (never the event id), and throws when the answer is not final yet
  (answer 5xx; it is sent again).

v0.11.1 - paywall refusal handling

Fixed

• Paywall helper: a refusal from P2Flux (a 429 rate limit above all) is answered with a 402 again -
  never served free through onUnavailable: 'free', and never turned into a 503 for every agent
  because somebody flooded junk payment headers. Only an unreachable or failing P2Flux is
  "unavailable".

v0.11.0 - sanctions screening

Added

• Sanctions screening (live since 7 October 2026): error codes PAYER_SANCTIONED (action
  STOP_SUBSCRIPTION - stop charging that subscription) and RECIPIENT_SANCTIONED (action
  INVALID_REQUEST - the receiving wallet is on the OFAC list; retrying gives the same answer).
  Nothing was submitted when either is returned. Show buyers a neutral message such as "This wallet
  cannot be used with P2Flux. No transaction was submitted." (https://p2flux.com/docs/errors.html#sanctions)
• verifyPayment() returns screening: 'clear' | 'sanctioned' | 'unknown' when the API sends it.
• paymentLinkStatus(): subscribers carry paidCount when the API sends it.

v0.10.0 - payment links

Added

• Payment links - createPaymentLink(terms), paymentLinkStatus({ link } | { manage }),
  collectPaymentLink(manage, subscriptionId), stopPaymentLink(manage, subscriptionId) and, for
  custom checkouts, openPaymentLink(link, payer?) and subscribePaymentLink(link, subscriptionRef). Invoices paid once, fixed prices paid many
  times, and subscriptions P2Flux collects for you - no server needed.
  (https://p2flux.com/docs/payment-links.html)
• checkoutLink('link' | 'links', token) for the buyer's link and the merchant's overview.
• Error codes INVALID_LINK, LINK_EXPIRED, LINK_UNAVAILABLE, ALREADY_SUBSCRIBED.

v0.9.0

Added

• checkoutLink(page, token) — the address that opens a checkout page (pay, subscribe,
  cancel, refund, approve) for a token the API issued, with the token in the fragment.
• checkoutUrl option — where buyers open the checkout. Defaults to P2Flux's hosted checkout for
  the API in use; set it when you host the checkout yourself
  (https://p2flux.com/docs/self-hosted-checkout.html). Must be https (http only for localhost).

Nothing else changed.

v0.8.0

Added

• @p2flux/sdk/paywall — charge AI agents for a route over x402 without an x402 library:
  createPaywall({ apiUrl, recipient, price }) with express() middleware, wrap() for Fetch-API
  handlers, and the framework-neutral guard(). Pay-per-request and prepaid balance; the payment is
  settled before the handler runs and serves one response. A separate entry point: the main client
  is unchanged and byte-identical.
• Usage pricing — paywall.usage({ url, paymentHeader, maxPrice }, work): the agent signs for at
  most maxPrice (x402 upto), you charge what the request cost.
• Requests signed as bots (Web Bot Auth) count as agents under agentsOnly; an agent's prepaid
  refund request is answered with its receipt.

v0.7.2

Packaging, documentation and examples. No behaviour changed: every method keeps its name,
arguments and return shape, and dist/ is byte-identical to a fresh build of the same source.

Added

• Published to npm as @p2flux/sdk. Installation is npm install @p2flux/sdk — no git tag to
  pin. package.json gains the public metadata a registry page needs (homepage, bugs, keywords,
  engines: node >=18, publishConfig.access) and sideEffects: false, which a new test earns
  rather than assumes: importing the module is proven to leave globalThis untouched.
• docs/payment-flow.md — the whole merchant lifecycle in one page, including the browser half
  this SDK never sees: the checkout handshake, why p2flux.payment.completed is a claim, and how to
  make the paid transition happen exactly once.
• docs/server-and-browser.md — which half of a JavaScript application each thing belongs to,
  and how to keep a bearer capability out of a client bundle. NEXT_PUBLIC_* and its equivalents
  are named explicitly, because that is how a credential actually escapes.
• docs/recovery.md, docs/testing.md, docs/production-checklist.md, and a recipes
  section in docs/errors.md covering the situations rather than only the codes.
• examples/complete-payment-flow/ — a runnable merchant integration on node:http: order,
  checkout handshake, repeat-safe verification, recovery fallback. It runs against a canned API, so
  no wallet, USDC or chain is involved.
• test/stub-api.ts — that canned API, exported as startStubApi() and runnable standalone. It
  answers PAYMENT_CONFIRMING for a hash starting 0xc0 and TRANSACTION_NOT_FOUND for one
  starting 0xbad, so the waiting and rejection paths are reachable offline.
• Automated documentation and example tests. npm test now also runs every example against the
  canned API, drives the complete-flow demo end to end, checks that dist/ matches a fresh build,
  and validates every documented method, option, import, snippet, link and error code against the
  source.

Changed

• Examples are one operation each, all reading configuration from the environment and failing
  with the missing variable's name: create-payment.ts, create-sponsored-payment.ts,
  verify-payment.ts, recover-payment.ts, network-fee-in-usdc.ts, subscription-signup.ts,
  charge-subscription.ts, recover-charge.ts, renewal-worker.ts, refund.ts, cancel.ts.
  The declare const stubs are gone, so every example actually runs.
• The README leads with the first successful integration: install, a five-minute payment, the
  checkout flow, verify before fulfilling, USDC network fees, subscriptions, runtime support, then
  links. Runtime support is stated plainly: an ESM-only package that CommonJS applications can load
  with a dynamic import(), and a server-side client rather than a browser SDK.
• The integration guide is split into getting-started, payment-flow, payments,
  network-fee-in-usdc, subscriptions, refunds, recovery, errors, testing,
  production-checklist and server-and-browser. docs/guide.md is now the index.

Install

npm install @p2flux/sdk

https://www.npmjs.com/package/@p2flux/sdk

v0.7.1

capabilities() now returns sponsorContracts (the contract carrying each sponsored operation, which the API always sent and the client dropped). Full 'Paying the network fee in USDC' guide section, capabilities() and sponsored accounting in docs/protocol-contract.md, per-wallet limit guidance in the errors table, and examples/network-fee-in-usdc.ts. Install: npm install github:P2Flux/sdk-js#v0.7.1