@doany-ai/sdk 0.2.3 → 0.2.5

package/dist/index.d.ts

@@ -11,7 +11,7 @@ export type { FunctionsModule, FunctionName, FunctionNameRegistry, } from "./mod
 export type { AgentsModule, AgentName, AgentNameRegistry, AgentConversation, AgentMessage, AgentMessageReasoning, AgentMessageToolCall, AgentMessageUsage, AgentMessageCustomContext, AgentMessageMetadata, CreateConversationParams, } from "./modules/agents.types.js";
 export type { AiGatewayModule, AiGatewayConnection, } from "./modules/ai-gateway.types.js";
 export type { AppLogsModule } from "./modules/app-logs.types.js";
-export type { PaymentsModule, CheckoutLineItem, CreateCheckoutParams, CreateCheckoutResult, CheckoutSession, SubscriptionState, BillingPortalParams, } from "./modules/payments.types.js";
+export type { PaymentsModule, CheckoutLineItem, CreateCheckoutParams, CreateCheckoutResult, CreateEmbeddedCheckoutResult, CheckoutSession, SubscriptionState, BillingPortalParams, } from "./modules/payments.types.js";
 export type { SsoModule, SsoAccessTokenResponse } from "./modules/sso.types.js";
 export type { ConnectorsModule, UserConnectorsModule, } from "./modules/connectors.types.js";
 export type { CustomIntegrationsModule, CustomIntegrationCallParams, CustomIntegrationCallResponse, } from "./modules/custom-integrations.types.js";

package/dist/modules/payments.js

@@ -9,18 +9,19 @@
  * @internal
  */
 export function createPaymentsModule(axios, appId) {
+    async function createCheckoutSession(params) {
+        const data = await axios.request({
+            method: "POST",
+            url: `/apps/${appId}/payments/checkout-session`,
+            data: params,
+        });
+        return data;
+    }
     // This client's response interceptor resolves requests to the response body.
     // Axios's declared return type does not reflect that, so the results below
     // are cast through `unknown`.
     return {
-        async createCheckoutSession(params) {
-            const data = await axios.request({
-                method: "POST",
-                url: `/apps/${appId}/payments/checkout-session`,
-                data: params,
-            });
-            return data;
-        },
+        createCheckoutSession,
         async getSubscription(subscriptionId) {
             const data = await axios.request({
                 method: "GET",

package/dist/modules/payments.types.d.ts

@@ -45,6 +45,18 @@ export type CreateCheckoutParams = {
     customer_email?: string;
     /** Your own data, returned with the order. Up to 20 keys. */
     metadata?: Record<string, string>;
+    /**
+     * Where the payment form appears.
+     *
+     * `hosted` — the default — sends the customer to checkout.stripe.com and
+     * brings them back to `success_path`. `embedded` keeps them on your page:
+     * mount Stripe.js with the `client_secret` you get back instead. An embedded
+     * session has no `url` at all, which is why the two results differ.
+     *
+     * `cancel_path` is ignored when embedded. There is nowhere to send someone
+     * who never left — closing your dialog is the cancel.
+     */
+    ui_mode?: "hosted" | "embedded";
 };
 export type CreateCheckoutResult = {
     id: string;
@@ -63,6 +75,27 @@ export type CreateCheckoutResult = {
     /** `month` / `year` / `week` for a subscription, `null` for a one-off. */
     interval: string | null;
 };
+/**
+ * What `ui_mode: "embedded"` returns instead.
+ *
+ * None of the three added fields is a secret. `client_secret` authorises this
+ * one session, the publishable key exists to be read off a page, and Stripe.js
+ * already puts the account id in its own requests — but all three have to reach
+ * the browser for the form to mount.
+ */
+export type CreateEmbeddedCheckoutResult = Omit<CreateCheckoutResult, "url"> & {
+    /** Always `null`: an embedded session has no page to send anyone to. */
+    url: null;
+    /** Pass to `loadStripe(...).initEmbeddedCheckout({ clientSecret })`. */
+    client_secret: string;
+    /** Pass to `loadStripe(publishable_key, { stripeAccount: stripe_account })`. */
+    publishable_key: string;
+    /**
+     * The connected account the charge belongs to, and `null` in test mode —
+     * there the shared sandbox is doany's own account, not the founder's.
+     */
+    stripe_account: string | null;
+};
 export type SubscriptionState = {
     id: string;
     mode: "test" | "live";
@@ -127,6 +160,23 @@ export type CheckoutSession = {
         amount_total: number | null;
     }>;
     metadata: Record<string, string>;
+    /**
+     * A session for the tab Stripe just returned to, when it came back signed
+     * out. Hand it to {@linkcode AuthModule.setToken} BEFORE reading or writing
+     * the user, or every write on the success page answers 401.
+     *
+     * Only ever present inside the editor preview, and only once per checkout.
+     * Checkout has to open in a new tab — an iframe cannot redirect itself to
+     * Stripe — and a preview login is a one-time code redeemed out of the URL
+     * at boot, so that tab starts with nothing of its own. A published site
+     * has a real session and never receives this.
+     *
+     * @example
+     * const session = await doany.payments.getCheckoutSession(sessionId);
+     * if (session.access_token) doany.auth.setToken(session.access_token);
+     * const user = await doany.auth.me();   // now this is the buyer
+     */
+    access_token?: string;
 };
 /**
  * Take card payments on your site.
@@ -169,7 +219,31 @@ export interface PaymentsModule {
      * window.location.href = url;
      * ```
      */
-    createCheckoutSession(params: CreateCheckoutParams): Promise<CreateCheckoutResult>;
+    createCheckoutSession(params: CreateCheckoutParams & {
+        ui_mode: "embedded";
+    }): Promise<CreateEmbeddedCheckoutResult>;
+    createCheckoutSession(params: CreateCheckoutParams & {
+        ui_mode?: "hosted";
+    }): Promise<CreateCheckoutResult>;
+    /**
+     * When the mode is not known at the call site — the params came from a
+     * variable typed `CreateCheckoutParams`, so they could be either — the result
+     * is the union, and `client_secret` is reachable only after narrowing:
+     *
+     * ```ts
+     * const session = await doany.payments.createCheckoutSession(params);
+     * if ("client_secret" in session) mountStripe(session.client_secret);
+     * else window.location.href = session.url;
+     * ```
+     *
+     * Narrow on the key, not on `if (session.url)`. `url` is `string` on one
+     * side and `null` on the other, and an empty string is falsy too, so
+     * truthiness leaves both members in play and reaches neither field.
+     *
+     * Without this third signature such a call fell through to the hosted
+     * signature and was told `url: string` for a session that returns null.
+     */
+    createCheckoutSession(params: CreateCheckoutParams): Promise<CreateCheckoutResult | CreateEmbeddedCheckoutResult>;
     /**
      * Reads a checkout back — what a success page calls to confirm the payment.
      *

package/dist/utils/axios-client.js

@@ -123,6 +123,18 @@ export function createAxiosClient({ baseURL, headers = {}, token, interceptRespo
             Accept: "application/json",
             ...headers,
         },
+        // Where there is no XHR — a backend function on Cloudflare Workers, Deno,
+        // Node — axios falls back to its fetch adapter, which builds a `Request`
+        // and hands it to `fetch`. A `Request` defaults to `cache: "default"`, and
+        // workerd accepts only "no-store", so it throws `Unsupported cache mode:
+        // default` before anything reaches the network. Measured on a live app:
+        // every `asServiceRole.entities.*` call from inside a backend function
+        // failed this way, which is exactly the fulfilment path a payment is told
+        // to use — an anonymous checkout took the money and wrote no order.
+        //
+        // Browsers keep the XHR adapter and ignore this entirely. Where it does
+        // apply, not caching is the correct behaviour for an API call anyway.
+        fetchOptions: { cache: "no-store" },
     });
     // Add token to requests if available
     if (token) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@doany-ai/sdk",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "JavaScript SDK for the doany app platform (API-compatible fork of @base44/sdk)",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",