@doany-ai/sdk 0.2.6 → 0.2.8

package/dist/client.js

@@ -3,7 +3,7 @@ import { createEntitiesModule } from "./modules/entities.js";
 import { createIntegrationsModule } from "./modules/integrations.js";
 import { createAuthModule } from "./modules/auth.js";
 import { createSsoModule } from "./modules/sso.js";
-import { createConnectorsModule, createUserConnectorsModule, } from "./modules/connectors.js";
+import { confirmAppUserConnection, createConnectorsModule, createUserConnectorsModule, } from "./modules/connectors.js";
 import { getAccessToken } from "./utils/auth-utils.js";
 import { createFunctionsModule } from "./modules/functions.js";
 import { createPaymentsModule } from "./modules/payments.js";
@@ -202,6 +202,9 @@ export function createClient(config) {
             return {
                 getCheckoutSession: full.getCheckoutSession.bind(full),
                 getSubscription: full.getSubscription.bind(full),
+                // Reading the products is not a decision for any browser, and a
+                // fulfilment function often needs what it just sold.
+                products: full.products,
             };
         })(),
         functions: createFunctionsModule(serviceRoleFunctionsAxiosClient, appId, {
@@ -231,6 +234,14 @@ export function createClient(config) {
         },
     };
     // If authentication is required, verify token and redirect to login if needed
+    // An app user coming back from a connector sign-in carries a one-time code
+    // (doany_connector, doany_connector_code). Confirm it with THIS user's
+    // session and drop it from the URL — app code never has to do this, and a
+    // forwarded link cannot attach a stranger's account because the confirm
+    // rides the session, not the code alone.
+    if (typeof window !== "undefined" && window.location) {
+        void finishPendingConnectorSignIn(axiosClient, appId);
+    }
     if (requiresAuth && typeof window !== "undefined") {
         // We perform this check asynchronously to not block client creation
         setTimeout(async () => {
@@ -376,6 +387,7 @@ export function createClientFromRequest(request) {
     const stateHeader = request.headers.get("Doany-State");
     const dataEnvHeader = request.headers.get("X-Data-Env");
     const originHeader = request.headers.get("X-Doany-Origin");
+    const runIdHeader = request.headers.get("X-Run-Id");
     if (!appId) {
         throw new Error("Doany-App-Id header is required, but is was not found on the request");
     }
@@ -440,6 +452,29 @@ export function createClientFromRequest(request) {
             // Not a URL. Forwarding it would only make the failure harder to read.
         }
     }
+    // The agent run this work belongs to. A backend function called from a
+    // run and one an app calls on its own are the same request shape, and this
+    // header is the only thing that tells them apart — the platform bills the
+    // run for the first and the app for the second. Dropped here, an agent's
+    // connector calls were attributed to the app.
+    if (runIdHeader) {
+        additionalHeaders["X-Run-Id"] = runIdHeader.slice(0, 128);
+    }
+    // Workflow diagnostics are separate from Annie's X-Run-Id attribution.
+    // The function proxy owns these headers; neither their presence nor their
+    // contents grant permissions or change billing. Match its bounded format.
+    if (serviceRoleToken) {
+        for (const name of [
+            "X-Doany-Workflow-Id",
+            "X-Doany-Workflow-Run-Id",
+            "X-Doany-Workflow-Step-Id",
+        ]) {
+            const value = request.headers.get(name);
+            if (value && /^[A-Za-z0-9_.:/-]{1,128}$/.test(value)) {
+                additionalHeaders[name] = value;
+            }
+        }
+    }
     return createClient({
         serverUrl: serverUrlHeader || "https://api.doany.ai",
         appId,
@@ -449,3 +484,40 @@ export function createClientFromRequest(request) {
         headers: additionalHeaders,
     });
 }
+const CONNECTOR_RETURN_PARAMS = ["doany_connector", "doany_connector_code", "doany_connector_status"];
+async function finishPendingConnectorSignIn(axios, appId) {
+    var _a, _b;
+    let params;
+    try {
+        params = new URLSearchParams(window.location.search);
+    }
+    catch (_c) {
+        return;
+    }
+    const connectorId = params.get("doany_connector");
+    const code = params.get("doany_connector_code");
+    if (!connectorId || !code)
+        return;
+    try {
+        await confirmAppUserConnection(axios, appId, connectorId, code);
+    }
+    catch (error) {
+        console.error("Could not finish the connector sign-in:", error);
+        // The code is one-time, so it stays in the URL while the failure may
+        // pass — no network, a 5xx, or a sign-in the app has not restored yet
+        // (401): a reload, or the app's own login, retries the confirmation.
+        // A definite rejection (spent, wrong or expired code) is cleared like a
+        // success, because retrying cannot help.
+        // The client's interceptor turns Axios failures into DoanyError, which
+        // carries the HTTP code as `status`; a raw Axios error keeps it under
+        // `response.status`.
+        const status = (_a = error === null || error === void 0 ? void 0 : error.status) !== null && _a !== void 0 ? _a : (_b = error === null || error === void 0 ? void 0 : error.response) === null || _b === void 0 ? void 0 : _b.status;
+        const definite = typeof status === "number" && status >= 400 && status < 500 && ![401, 408, 429].includes(status);
+        if (!definite)
+            return;
+    }
+    for (const name of CONNECTOR_RETURN_PARAMS)
+        params.delete(name);
+    const query = params.toString();
+    window.history.replaceState({}, document.title, `${window.location.pathname}${query ? `?${query}` : ""}${window.location.hash}`);
+}

package/dist/client.types.d.ts

@@ -150,10 +150,11 @@ export interface DoanyClient {
          * service-role caller, so the ordinary client cannot resolve a mode and
          * the read fails whatever the function forwards.
          *
-         * Only the reads are here. There is no service-role checkout — opening one
-         * is a decision that belongs to the browser that is actually there.
+         * Only the reads are here — the two above and the products. There
+         * is no service-role checkout: opening one is a decision that belongs to
+         * the browser that is actually there.
          */
-        payments: Pick<PaymentsModule, "getCheckoutSession" | "getSubscription">;
+        payments: Pick<PaymentsModule, "getCheckoutSession" | "getSubscription" | "products">;
         /** {@link SsoModule | SSO module} for generating SSO tokens.
          * @internal
          */

package/dist/index.d.ts

@@ -11,8 +11,8 @@ export type { FunctionsModule, FunctionName, FunctionNameRegistry, } from "./mod
 export type { AgentsModule, AgentName, AgentNameRegistry, AgentConversation, AgentMessage, AgentMessageReasoning, AgentMessageToolCall, AgentMessageUsage, AgentMessageCustomContext, AgentMessageMetadata, CreateConversationParams, } from "./modules/agents.types.js";
 export type { AiGatewayModule, AiGatewayConnection, } from "./modules/ai-gateway.types.js";
 export type { AppLogsModule } from "./modules/app-logs.types.js";
-export type { PaymentsModule, CheckoutLineItem, CreateCheckoutParams, CreateCheckoutResult, CreateEmbeddedCheckoutResult, CheckoutSession, SubscriptionState, BillingPortalParams, } from "./modules/payments.types.js";
+export type { PaymentsModule, ProductsModule, Product, ProductQuery, ProductSort, CheckoutLineItem, CreateCheckoutParams, CreateCheckoutResult, CreateEmbeddedCheckoutResult, CheckoutSession, SubscriptionState, BillingPortalParams, } from "./modules/payments.types.js";
 export type { SsoModule, SsoAccessTokenResponse } from "./modules/sso.types.js";
-export type { ConnectorsModule, UserConnectorsModule, } from "./modules/connectors.types.js";
+export type { ConnectorsModule, UserConnectorsModule, ConnectorApiRequest, ConnectorApiResponse, ConnectorProxyRawResponse, } from "./modules/connectors.types.js";
 export type { CustomIntegrationsModule, CustomIntegrationCallParams, CustomIntegrationCallResponse, } from "./modules/custom-integrations.types.js";
 export type { GetAccessTokenOptions, SaveAccessTokenOptions, RemoveAccessTokenOptions, GetLoginUrlOptions, } from "./utils/auth-utils.types.js";

package/dist/modules/connectors.d.ts

@@ -1,5 +1,12 @@
 import { AxiosInstance } from "axios";
 import { ConnectorsModule, UserConnectorsModule } from "./connectors.types.js";
+/**
+ * Finishes an app-user connection with the one-time code the platform put in
+ * the return URL. Called by the client on page load, never by app code: the
+ * confirm must ride the same user's session that started the sign-in.
+ * @internal
+ */
+export declare function confirmAppUserConnection(axios: AxiosInstance, appId: string, connectorId: string, code: string): Promise<void>;
 /**
  * Creates the Connectors module for the Doany SDK.
  *

package/dist/modules/connectors.js

@@ -1,3 +1,60 @@
+const CONNECTOR_API_METHODS = new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD"]);
+function assertNonEmptyString(value, label) {
+    if (!value || typeof value !== "string") {
+        throw new Error(`${label} is required and must be a string`);
+    }
+}
+/**
+ * One proxied call, exactly as @base44/sdk does it: validate the request,
+ * post the raw shape, map the raw (snake_case) answer to the typed one.
+ */
+async function proxyCall(axios, url, request) {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+    if (!request || typeof request !== "object") {
+        throw new Error("Request is required and must be an object");
+    }
+    assertNonEmptyString(request.path, "Request path");
+    const method = (_a = request.method) !== null && _a !== void 0 ? _a : "GET";
+    if (!CONNECTOR_API_METHODS.has(method)) {
+        throw new Error("Request method must be one of GET, POST, PUT, PATCH, DELETE, or HEAD");
+    }
+    const response = await axios.post(url, {
+        method,
+        // Omitted when unset so the proxy applies the connector's default host.
+        ...(request.host == null ? {} : { host: request.host }),
+        path: request.path,
+        query: (_b = request.query) !== null && _b !== void 0 ? _b : {},
+        headers: (_c = request.headers) !== null && _c !== void 0 ? _c : {},
+        body: (_d = request.body) !== null && _d !== void 0 ? _d : null,
+    });
+    const data = response;
+    return {
+        success: data.success,
+        phase: data.phase,
+        status: (_e = data.status_code) !== null && _e !== void 0 ? _e : null,
+        data: data.data,
+        dataBase64: (_f = data.data_base64) !== null && _f !== void 0 ? _f : null,
+        contentType: (_g = data.content_type) !== null && _g !== void 0 ? _g : null,
+        headers: (_h = data.headers) !== null && _h !== void 0 ? _h : {},
+        creditsCharged: (_j = data.credits_charged) !== null && _j !== void 0 ? _j : 0,
+        // A 200 envelope can still carry a failure (`sent_unconfirmed`, or the
+        // provider's own error); without these the caller knows a write may
+        // have happened but not why the answer is missing.
+        ...(data.error == null ? {} : { error: data.error }),
+        ...(data.error_message == null ? {} : { errorMessage: data.error_message }),
+    };
+}
+/**
+ * Finishes an app-user connection with the one-time code the platform put in
+ * the return URL. Called by the client on page load, never by app code: the
+ * confirm must ride the same user's session that started the sign-in.
+ * @internal
+ */
+export async function confirmAppUserConnection(axios, appId, connectorId, code) {
+    assertNonEmptyString(connectorId, "Connector ID");
+    assertNonEmptyString(code, "Confirmation code");
+    await axios.post(`/apps/${appId}/app-user-auth/connectors/${encodeURIComponent(connectorId)}/confirm`, { code });
+}
 /**
  * Creates the Connectors module for the Doany SDK.
  *
@@ -8,6 +65,16 @@
  */
 export function createConnectorsModule(axios, appId) {
     return {
+        async callApi(integrationType, request) {
+            assertNonEmptyString(integrationType, "Integration type");
+            // Encoded so a runtime-built identifier can only ever select a
+            // connector, never re-target another route under this token.
+            return proxyCall(axios, `/apps/${appId}/connectors/${encodeURIComponent(integrationType)}/call`, request);
+        },
+        async callCurrentAppUserApi(integrationType, request) {
+            assertNonEmptyString(integrationType, "Integration type");
+            return proxyCall(axios, `/apps/${appId}/app-user-connectors/${encodeURIComponent(integrationType)}/call`, request);
+        },
         /**
          * Retrieve an OAuth access token for a specific external integration type.
          * @deprecated Use getConnection(integrationType) and use the returned accessToken (and connectionConfig when needed) instead.
@@ -81,18 +148,14 @@ export function createConnectorsModule(axios, appId) {
 export function createUserConnectorsModule(axios, appId) {
     return {
         async connectAppUser(connectorId) {
-            if (!connectorId || typeof connectorId !== "string") {
-                throw new Error("Connector ID is required and must be a string");
-            }
-            const response = await axios.post(`/apps/${appId}/app-user-auth/connectors/${connectorId}/initiate`);
+            assertNonEmptyString(connectorId, "Connector ID");
+            const response = await axios.post(`/apps/${appId}/app-user-auth/connectors/${encodeURIComponent(connectorId)}/initiate`);
             const data = response;
             return data.redirect_url;
         },
         async disconnectAppUser(connectorId) {
-            if (!connectorId || typeof connectorId !== "string") {
-                throw new Error("Connector ID is required and must be a string");
-            }
-            await axios.delete(`/apps/${appId}/app-user-auth/connectors/${connectorId}`);
+            assertNonEmptyString(connectorId, "Connector ID");
+            await axios.delete(`/apps/${appId}/app-user-auth/connectors/${encodeURIComponent(connectorId)}`);
         },
     };
 }

package/dist/modules/connectors.types.d.ts

@@ -41,6 +41,65 @@ export interface AppUserConnectorConnectionResponse {
     /** Key-value configuration for the connection, or `null` if the connector does not provide one. */
     connectionConfig: Record<string, string> | null;
 }
+/**
+ * A request proxied to the external service on the app's behalf. The
+ * platform injects the credential; the app never sees a token.
+ */
+export interface ConnectorApiRequest {
+    /** HTTP method. Defaults to `GET`. */
+    method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD";
+    /** Path relative to the provider's API root. Must start with `/`. */
+    path: string;
+    /** Provider host to call; defaults to the connector's primary API host. Must be one of the connector's allowed hosts. */
+    host?: string;
+    /** Query parameters. */
+    query?: Record<string, string>;
+    /** Extra request headers. `Authorization` is ignored — the platform sets it. */
+    headers?: Record<string, string>;
+    /** JSON body. */
+    body?: unknown;
+}
+/**
+ * What a proxied call produced. HTTP 200 from the platform means only that
+ * the proxy worked; read `success`, `phase` and `status` for what the
+ * provider did.
+ */
+export interface ConnectorApiResponse<T = unknown> {
+    /** The provider answered 2xx. */
+    success: boolean;
+    /**
+     * `not_sent` — the request never left the platform (safe to retry).
+     * `responded` — the provider answered; see `status`.
+     * `sent_unconfirmed` — sent, but no answer came back; a write may have happened. Never auto-retry a write on this.
+     */
+    phase: "not_sent" | "responded" | "sent_unconfirmed";
+    /** The provider's HTTP status, or `null` when there was no response. */
+    status: number | null;
+    /** The provider's JSON body, when it sent one. */
+    data: T | null;
+    /** The provider's body as base64 when it was binary. */
+    dataBase64: string | null;
+    contentType: string | null;
+    headers: Record<string, string>;
+    /** Credits charged for this call. */
+    creditsCharged: number;
+    /** Set when `phase` is not `responded`. */
+    error?: string;
+    errorMessage?: string;
+}
+/** The proxy's raw answer on the wire (snake_case); {@link ConnectorApiResponse} is its typed form. */
+export interface ConnectorProxyRawResponse<T = unknown> {
+    success: boolean;
+    phase: "not_sent" | "responded" | "sent_unconfirmed";
+    status_code?: number | null;
+    data: T | null;
+    data_base64?: string | null;
+    content_type?: string | null;
+    headers?: Record<string, string>;
+    credits_charged?: number;
+    error?: string;
+    error_message?: string;
+}
 /**
  * Connectors module for managing OAuth tokens for external services.
  *
@@ -131,6 +190,32 @@ export interface AppUserConnectorConnectionResponse {
  * If you're working in a TypeScript project, you can generate types from your app's connector configurations to get autocomplete on integration type names when calling {@link getConnection}. See the [Dynamic Types](/developers/references/sdk/getting-started/dynamic-types) guide to get started.
  */
 export interface ConnectorsModule {
+    /**
+     * Calls the external service through the platform with the app's shared connection.
+     *
+     * This is the only way a backend function reaches a connector on doany: the platform injects the credential and forwards the request. The token methods below answer 403.
+     *
+     * @param integrationType - The connector's integration type, e.g. `'gmail'`.
+     * @param request - Method, path (relative to the provider's API root), query, headers and body.
+     * @returns The provider's answer wrapped in `success` / `phase` / `status`.
+     *
+     * @example
+     * ```typescript
+     * const res = await doany.asServiceRole.connectors.callApi('gmail', {
+     *   method: 'POST',
+     *   path: '/gmail/v1/users/me/messages/send',
+     *   body: { raw },
+     * });
+     * if (!res.success) { /* res.status is the provider's code, res.data its body *\/ }
+     * ```
+     */
+    callApi<T = unknown>(integrationType: ConnectorIntegrationType, request: ConnectorApiRequest): Promise<ConnectorApiResponse<T>>;
+    /**
+     * Calls the external service as the signed-in app user, through their own connection.
+     *
+     * Only works from a backend function the user triggered (the platform needs their identity). Same envelope as {@linkcode callApi}.
+     */
+    callCurrentAppUserApi<T = unknown>(integrationType: ConnectorIntegrationType, request: ConnectorApiRequest): Promise<ConnectorApiResponse<T>>;
     /**
      * Retrieves an OAuth access token for a specific [external integration type](#available-connectors).
      *

package/dist/modules/payments.d.ts

@@ -1,5 +1,16 @@
 import { AxiosInstance } from "axios";
-import { PaymentsModule } from "./payments.types";
+import { PaymentsModule, ProductsModule } from "./payments.types";
+/**
+ * The product reads.
+ *
+ * Parameters go over the wire exactly as an entity's do (`sort`, `limit`,
+ * `skip`, `q` as JSON), because the point of this module is that code written
+ * against `entities.Product` moves over by renaming it — same arguments, same
+ * records back.
+ *
+ * @internal
+ */
+export declare function createProductsModule(axios: AxiosInstance, appId: string): ProductsModule;
 /**
  * Creates the payments module for the Doany SDK.
  *

package/dist/modules/payments.js

@@ -1,3 +1,42 @@
+/**
+ * The product reads.
+ *
+ * Parameters go over the wire exactly as an entity's do (`sort`, `limit`,
+ * `skip`, `q` as JSON), because the point of this module is that code written
+ * against `entities.Product` moves over by renaming it — same arguments, same
+ * records back.
+ *
+ * @internal
+ */
+export function createProductsModule(axios, appId) {
+    const baseURL = `/apps/${appId}/payments/products`;
+    function params(sort, limit, skip) {
+        const out = {};
+        if (sort)
+            out.sort = sort;
+        if (limit)
+            out.limit = limit;
+        if (skip)
+            out.skip = skip;
+        return out;
+    }
+    return {
+        async list(sort, limit, skip) {
+            const data = await axios.get(baseURL, { params: params(sort, limit, skip) });
+            return data;
+        },
+        async filter(query, sort, limit, skip) {
+            const data = await axios.get(baseURL, {
+                params: { q: JSON.stringify(query), ...params(sort, limit, skip) },
+            });
+            return data;
+        },
+        async get(id) {
+            const data = await axios.get(`${baseURL}/${encodeURIComponent(id)}`);
+            return data;
+        },
+    };
+}
 /**
  * Creates the payments module for the Doany SDK.
  *
@@ -21,6 +60,7 @@ export function createPaymentsModule(axios, appId) {
     // Axios's declared return type does not reflect that, so the results below
     // are cast through `unknown`.
     return {
+        products: createProductsModule(axios, appId),
         createCheckoutSession,
         async getSubscription(subscriptionId) {
             const data = await axios.request({

package/dist/modules/payments.types.d.ts

@@ -1,13 +1,15 @@
 /**
  * One thing being sold in a checkout.
  *
- * A line item names a record in your own app data — doany keeps your catalog
+ * A line item names a record in your own app data — doany keeps your products
  * there rather than as objects inside Stripe, which is why switching from test
  * to real payments needs no migration.
  */
 export type CheckoutLineItem = {
     /**
-     * The `id` of a record in this app's `Product` entity.
+     * The `id` of one of this app's products — a record from
+     * {@linkcode ProductsModule | doany.payments.products}, or from the `Product`
+     * entity on an app whose products predate it.
      *
      * The price, name and currency all come from that record — you cannot pass
      * a price. This endpoint is reachable by anyone (a shop has to sell to
@@ -65,7 +67,7 @@ export type CreateCheckoutResult = {
     /** `test` in the preview, `live` on a published site that has gone live. */
     mode: "test" | "live";
     /**
-     * What the customer is about to agree to, decided by the catalog.
+     * What the customer is about to agree to, decided by the product.
      *
      * `subscription` when the products carry a `recurring_interval`, `payment`
      * otherwise. Say the right word on the button: "Subscribe" over a one-off
@@ -203,17 +205,98 @@ export type CheckoutSession = {
      */
     access_token?: string;
 };
+/**
+ * One of this app's products, as {@linkcode ProductsModule} returns it.
+ *
+ * The same shape an entity record has: the platform's fields and the system
+ * fields by their entity names, and every field of the app's own (`slug`,
+ * `category`, `image_url`, …) at the top level beside them.
+ */
+export type Product = {
+    id: string;
+    name: string;
+    description: string | null;
+    /** Minor units — 2400 is 24.00. `null` for something shown but not sold. */
+    price_cents: number | null;
+    /** Lowercase ISO code, or `null` for the checkout's default. */
+    currency: string | null;
+    /** Present => a subscription billed this often. `null` => a one-off. */
+    recurring_interval: "week" | "month" | "year" | null;
+    /** `false` is off sale: still readable, cannot be bought. */
+    is_available: boolean;
+    created_date: string;
+    updated_date: string;
+    created_by: string | null;
+    created_by_id: string | null;
+    is_sample: boolean;
+    /**
+     * Only ever on {@linkcode ProductsModule.get}: the product was removed from
+     * the store. Kept readable because past orders and subscriptions name it.
+     */
+    is_deleted?: true;
+    /**
+     * The app's own fields. `any`, as on an entity record, so code that read
+     * `product.slug.toLowerCase()` off `entities.Product` still type-checks.
+     */
+    [field: string]: any;
+};
+/**
+ * A field to order by, `-` first for descending: `"price_cents"`,
+ * `"-created_date"`, or one of the app's own fields.
+ */
+export type ProductSort = string;
+/**
+ * Equality only — `{ slug: "starter" }`, `{ is_available: true }`. Several
+ * fields must all match. `{ field: null }` also matches a product that does not
+ * have the field. Operators (`$gt`, `$in`, …) are refused.
+ */
+export type ProductQuery = Record<string, string | number | boolean | null>;
+/**
+ * Read this app's products. Read-only: products are added and priced by
+ * the app owner in the Payments panel, or by asking Annie.
+ *
+ * Same methods, arguments and results as an entity's reads, so code written
+ * against `entities.Product` moves over by renaming it. Records come back in
+ * the order they were created when no `sort` is given.
+ */
+export interface ProductsModule {
+    /**
+     * @example
+     * ```typescript
+     * const products = await doany.payments.products.list();
+     * const newest = await doany.payments.products.list('-created_date', 20);
+     * ```
+     */
+    list(sort?: ProductSort, limit?: number, skip?: number): Promise<Product[]>;
+    /**
+     * @example
+     * ```typescript
+     * const [plan] = await doany.payments.products.filter({ slug: 'pro' });
+     * const onSale = await doany.payments.products.filter(
+     *   { is_available: true }, 'price_cents', 10,
+     * );
+     * ```
+     */
+    filter(query: ProductQuery, sort?: ProductSort, limit?: number, skip?: number): Promise<Product[]>;
+    /**
+     * One product by id. A removed product is still returned, with
+     * `is_deleted: true`; an id that was never a product is a 404.
+     */
+    get(id: string): Promise<Product>;
+}
 /**
  * Take card payments on your site.
  *
  * Money goes to the app owner's own Stripe account — doany never holds it and
  * takes no cut. Stripe's usual per-transaction fee applies.
  *
- * ## Prices live in your data, not in your code
+ * ## Prices live with the product, not in your code
  *
- * Sellable things are records in this app's `Product` entity, with the price in
- * an integer `price_cents` field. A checkout names the product; the server
- * looks up what it costs.
+ * Sellable things are this app's products, read with
+ * {@linkcode PaymentsModule.products}, with the price in an integer
+ * `price_cents` field. A checkout names the product; the server looks up what
+ * it costs. (An app whose products predate this keeps them in a `Product`
+ * entity; checkout reads whichever one the app uses.)
  *
  * ## Test and real payments
  *
@@ -229,12 +312,14 @@ export type CheckoutSession = {
  * The same code covers both. There is no key to configure and no mode to set.
  */
 export interface PaymentsModule {
+    /** This app's products. See {@linkcode ProductsModule}. */
+    products: ProductsModule;
     /**
      * Opens a Stripe checkout and returns the URL to send the customer to.
      *
      * @example Sell one item
      * ```typescript
-     * // The price comes from the Product record, not from this call.
+     * // The price comes from the product, not from this call.
      * const { url } = await doany.payments.createCheckoutSession({
      *   line_items: [{ product_id: product.id, quantity: 1 }],
      *   success_path: '/thanks',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@doany-ai/sdk",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "description": "JavaScript SDK for the doany app platform (API-compatible fork of @base44/sdk)",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",