Release v4.6.0

[janpaepke]

Summary

Prepares the v4.6.0 release. Full flat list in CHANGELOG.md; categorized notes for the GitHub Release body are drafted in RELEASE_NOTES_v4.6.0.md.

New APIs

• Add Invoices API support (feat: add Invoices API support #506)
• Add terminal pairing codes endpoints (feat: add terminal pairing codes endpoints #508)
• Complete Routes API coverage: paymentRoutes.get + a route getPayment() helper (feat: complete Routes API coverage (get endpoint + payment link) #511)

Runtime & compatibility

• Run on non-Node.js runtimes (Bun, Deno, Cloudflare Workers) + dangerouslyAllowBrowser (feat: support non-Node.js runtimes (Bun, Deno, edge) #490)

Enhancements

• parameterDefaults option for OAuth clients (feat: add parameterDefaults for OAuth clients #517)
• storeCredentials on payment/order create (feat: add storeCredentials parameter to payment create and order create #480)
• testmode/profileId on the remaining endpoints; deprecate callback-as-second-argument overloads (feat: declare testmode/profileId on endpoints that accept them #514)
• testmode on permissions.get (feat: support testmode on get-permission + sync permissions docs #503); profileId on the Apple Pay session (feat(applePay): add profileId to payment session request #512)
• legalEntity/registrationOffice/incorporationDate on Create client link (feat: add legalEntity, registrationOffice, incorporationDate to client link params #495)
• metadata on connect balance transfers (feat(balance-transfers): support metadata on connect balance transfers #492); mode/updatedAt on the Terminal type (fix: align terminal response type with the API #507)

Type & documentation sync

• payments (feat(payments): sync types with the Mollie API spec #510, fix(payments): sync types, enums, and JSDoc with current Mollie API #516), settlements (feat: sync settlements with the Mollie API spec #509), subscriptions (feat(subscriptions): reconcile types with the Mollie API spec #504), profiles (feat(profiles): sync types and docs with the Mollie API spec #505), organizations (feat(organizations): sync resource with the Mollie API spec #502), refunds (feat(refunds): sync types and docs with Mollie API spec #484), onboarding (feat: sync onboarding types with the current API spec #500), paymentLinks (feat(paymentLinks): sync types and docs with Mollie API spec #501), methods (feat(methods): sync types and docs with Mollie API spec #488), chargebacks (feat(chargebacks): sync types with API spec #487), capabilities/OAuth/customers (docs(capabilities): sync requirement field JSDoc with API spec #494, docs: enrich OAuth token JSDoc from the API spec #496, docs(customers): sync JSDoc with Mollie API reference #498)

Fixes

• Capture payment embedding via embed instead of the ignored include (fix(captures): embed the payment via the embed query parameter #483)

Deprecations

• Deprecate the Orders API (chore: deprecate Orders API binders and methods #486)

Maintenance

• npm Trusted Publishing / OIDC (set up github actions as trusted publisher on npmjs.com #485); dev-deps + form-data advisory (chore(deps): update dev dependencies and patch form-data advisory #482)

Release prep (this PR)

• Update changelog, add missing @since 4.6.0 tags, deprecate the numeric profiles categoryCode, clarify the release-process docs, and bump to 4.6.0.

[edorivai]

Reviewed as a release PR. LGTM.

• Version: 4.5.0 → 4.6.0 minor bump — correct, since the whole batch is additive + deprecations with no breaking changes.
• CHANGELOG: cross-checked against every PR merged since v4.5.0 — complete and accurate. Correctly omits the non-user-facing ones (#481 test fix, #493 test reorg, #513 dev tooling). Date is today.
• src changes: three @since 4.6.0/@deprecated JSDoc backfills (InvoiceHelper.getPdfUrl, OrganizationHelper.getDashboardUrl, profile categoryCode→businessCategory) — appropriate; other new helpers already carried @since from their own PRs.
• Process docs (CLAUDE.md/publish.yml/CONTRIBUTING.md) now match the protected-master / release-PR flow this PR uses. Self-consistent.

One pre-publish check (not blocking this PR): #508 (terminal pairing codes) ships in this release and was previously held over two unverified runtime constants — the resource dispatch string (terminal-pairing-code) and the _embedded key (terminal-pairing-codes). Worth confirming both against a real API response before publishing the GitHub Release, since a wrong value throws at runtime on every pairing-code call.