@doany-ai/sdk 0.2.8 → 0.3.0-alpha.0

package/dist/modules/contacts.types.d.ts

@@ -0,0 +1,112 @@
+import type { Address, CreateOptions, Page, PageParams, VersionInput } from "./project.types";
+export type ContactSource = "website_registration" | "purchase" | "booking_form" | "contact_form" | "staff_entry" | "agent" | "import" | "api" | "unknown";
+/**
+ * Someone the business knows: a customer, a lead, someone who wrote in.
+ *
+ * `business_note`, `source`, `app_id`, `merged_into_id` and `merged_at` are
+ * shown to the site's admin and service callers only.
+ */
+export interface Contact {
+    id: string;
+    /** Always set. */
+    display_name: string;
+    given_name: string | null;
+    family_name: string | null;
+    /** Lower-case. */
+    email: string | null;
+    /** E.164, e.g. `+14155550123`. */
+    phone: string | null;
+    address: Address | null;
+    timezone: string | null;
+    preferred_language: string | null;
+    business_note?: string | null;
+    source?: ContactSource;
+    /** The site it came from; `null` for one the business entered. */
+    app_id?: string | null;
+    archived_at: string | null;
+    merged_into_id?: string | null;
+    merged_at?: string | null;
+    version: number;
+    created_at: string;
+    updated_at: string;
+}
+/** An account linked to a contact. */
+export interface ContactUserLink {
+    user_id: string;
+    email: string | null;
+    /** `self`: the account is this person. */
+    role: "self" | "admin" | "billing" | "member";
+    /** `records`: sees the contact's orders and buys as it. `profile`: its details only. */
+    access: "profile" | "records";
+    /** The contact this account buys as by default. */
+    is_default: boolean;
+    granted_via: "registration" | "email_match" | "staff" | "checkout" | "invite" | "claim";
+    status: "active" | "revoked";
+}
+/** A contact with the accounts linked to it (the latter for admin and service callers). */
+export interface ContactDetail extends Contact {
+    users?: ContactUserLink[];
+}
+export interface ContactListParams extends PageParams {
+    /** Part of the name, email or phone. */
+    q?: string;
+    /** `active` (default), `archived` or `all`. */
+    status?: "active" | "archived" | "all";
+    source?: ContactSource;
+    /** Contacts that came from this site. */
+    app_id?: string;
+    created_from?: string;
+    created_to?: string;
+}
+interface ContactFields {
+    given_name?: string | null;
+    family_name?: string | null;
+    email?: string | null;
+    phone?: string | null;
+    address?: Partial<Address> | null;
+    timezone?: string | null;
+    preferred_language?: string | null;
+    business_note?: string | null;
+}
+export interface CreateContactParams extends ContactFields {
+    /** Left out: the name, else the email, else the phone. */
+    display_name?: string | null;
+    /** `staff_entry` (default), `agent`, `import`, `api`. */
+    source?: "staff_entry" | "agent" | "import" | "api";
+}
+export interface UpdateContactParams extends ContactFields, VersionInput {
+    display_name?: string;
+}
+/**
+ * The people the business knows.
+ *
+ * A signed-in account reads and changes only its own contact (`me`, and
+ * `updateMe` — not its email, which follows its sign-in). Everything else
+ * takes the site's admin account or a service credential.
+ */
+export interface ContactsModule {
+    /** Contacts the caller may see; an account sees only its own. Rejects with 401 when nobody is signed in. */
+    list(params?: ContactListParams): Promise<Page<Contact>>;
+    /** One contact. Rejects with 404 when there is none, or the caller may not see it. */
+    get(contactId: string): Promise<ContactDetail>;
+    /** The signed-in account's own contact. Rejects with 404 when it has none yet. */
+    me(): Promise<ContactDetail>;
+    /** A new contact. Rejects with 400 on a malformed email or phone. */
+    create(params: CreateContactParams, options?: CreateOptions): Promise<Contact>;
+    update(contactId: string, params: UpdateContactParams): Promise<Contact>;
+    /** Changes the signed-in account's own contact. */
+    updateMe(params: UpdateContactParams): Promise<Contact>;
+    archive(contactId: string, params: VersionInput): Promise<Contact>;
+    restore(contactId: string, params: VersionInput): Promise<Contact>;
+    /**
+     * Merges a duplicate into another contact, for good: its account links move
+     * to the target and its orders are found under the target from then on.
+     * Returns the target.
+     */
+    merge(contactId: string, params: VersionInput & {
+        into_contact_id: string;
+    }): Promise<ContactDetail>;
+    /** Deletes a contact nothing refers to; otherwise 409 `IN_USE` (archive it instead). */
+    delete(contactId: string): Promise<void>;
+}
+export {};

package/dist/modules/contacts.types.js

@@ -0,0 +1 @@
+export {};

package/dist/modules/events.d.ts

@@ -0,0 +1,9 @@
+import { AxiosInstance } from "axios";
+import { EventsModule } from "./events.types";
+import { ProjectScope } from "./project.js";
+/**
+ * Creates the events module: `/projects/{project_id}/events`.
+ *
+ * @internal
+ */
+export declare function createEventsModule(axios: AxiosInstance, project: ProjectScope): EventsModule;

package/dist/modules/events.js

@@ -0,0 +1,15 @@
+import { queryOf } from "./project.js";
+/**
+ * Creates the events module: `/projects/{project_id}/events`.
+ *
+ * @internal
+ */
+export function createEventsModule(axios, project) {
+    return {
+        async list(params = {}) {
+            return (await axios.get(await project.path("/events"), {
+                params: queryOf(params),
+            }));
+        },
+    };
+}

package/dist/modules/events.types.d.ts

@@ -0,0 +1,42 @@
+import type { Page } from "./project.types";
+export type EventSubjectType = "order" | "payment" | "refund" | "dispute" | "contact";
+/**
+ * Something that happened to an order, a payment, a refund, a dispute or a
+ * contact — `order.placed`, `payment.succeeded`, `contact.merged`, … — and who
+ * did it.
+ */
+export interface ProjectEvent {
+    id: string;
+    event_type: string;
+    subject_type: EventSubjectType;
+    subject_id: string;
+    /** `type`: `system`, `provider`, `founder` (+ `user_id`), `agent`, `customer` (+ `project_user_id`), `guest`. */
+    actor: {
+        type: string;
+        user_id?: string;
+        project_user_id?: string;
+    };
+    data: Record<string, any>;
+    occurred_at: string;
+}
+export interface EventListParams {
+    /** The order's events, and those of its payments, refunds and disputes. */
+    order_id?: string;
+    /** The contact's (and merged contacts') events, and those of their orders. */
+    contact_id?: string;
+    subject_type?: EventSubjectType;
+    subject_id?: string;
+    /** A full type (`order.placed`) or a prefix ending in `.` (`refund.`). */
+    event_type?: string;
+    occurred_from?: string;
+    occurred_to?: string;
+    limit?: number;
+    cursor?: string;
+}
+/**
+ * The business's timeline. The site's admin and service callers only.
+ */
+export interface EventsModule {
+    /** Newest first. */
+    list(params?: EventListParams): Promise<Page<ProjectEvent>>;
+}

package/dist/modules/events.types.js

@@ -0,0 +1 @@
+export {};

package/dist/modules/order-access.d.ts

@@ -0,0 +1,20 @@
+import { AxiosInstance } from "axios";
+/**
+ * An order's access token (`X-Doany-Access-Token`): what lets a guest come back
+ * to an order they placed. Kept for the browser session by `orders.create` and
+ * sent by every call that accepts it — `orders.get`, `orders.cancel`,
+ * `payments.checkout`, `payments.getForOrder`.
+ *
+ * @internal
+ */
+/** cyrb53: a short, stable name for a value, so the value itself (a token, a
+ * buyer's details) is not what gets written as a storage key. */
+export declare function nameOf(text: string): string;
+/** Who the backend will take this request to be from: it keeps idempotency
+ * keys per signed-in account and per guest, so an unresolved attempt belongs
+ * to whoever made it and nobody else may reuse or clear it. */
+export declare function actorOf(axios: AxiosInstance): string;
+export declare function session(): Storage | null;
+export declare function rememberOrderToken(axios: AxiosInstance, appId: string, actor: string, orderId: string, token?: string): void;
+/** The header carrying this order's token: the one given, else the one kept. */
+export declare function orderAccessHeaders(axios: AxiosInstance, appId: string, orderId: string, accessToken?: string): Record<string, string>;

package/dist/modules/order-access.js

@@ -0,0 +1,84 @@
+/**
+ * An order's access token (`X-Doany-Access-Token`): what lets a guest come back
+ * to an order they placed. Kept for the browser session by `orders.create` and
+ * sent by every call that accepts it — `orders.get`, `orders.cancel`,
+ * `payments.checkout`, `payments.getForOrder`.
+ *
+ * @internal
+ */
+/** cyrb53: a short, stable name for a value, so the value itself (a token, a
+ * buyer's details) is not what gets written as a storage key. */
+export function nameOf(text) {
+    let h1 = 0xdeadbeef;
+    let h2 = 0x41c6ce57;
+    for (let i = 0; i < text.length; i++) {
+        const ch = text.charCodeAt(i);
+        h1 = Math.imul(h1 ^ ch, 2654435761);
+        h2 = Math.imul(h2 ^ ch, 1597334677);
+    }
+    h1 = Math.imul(h1 ^ (h1 >>> 16), 2246822507) ^ Math.imul(h2 ^ (h2 >>> 13), 3266489909);
+    h2 = Math.imul(h2 ^ (h2 >>> 16), 2246822507) ^ Math.imul(h1 ^ (h1 >>> 13), 3266489909);
+    return (4294967296 * (2097151 & h2) + (h1 >>> 0)).toString(36);
+}
+/** Who the backend will take this request to be from: it keeps idempotency
+ * keys per signed-in account and per guest, so an unresolved attempt belongs
+ * to whoever made it and nobody else may reuse or clear it. */
+export function actorOf(axios) {
+    var _a, _b, _c;
+    const header = (_c = (_b = (_a = axios.defaults) === null || _a === void 0 ? void 0 : _a.headers) === null || _b === void 0 ? void 0 : _b.common) === null || _c === void 0 ? void 0 : _c["Authorization"];
+    if (typeof header !== "string" || !header.startsWith("Bearer "))
+        return "guest";
+    try {
+        const payload = header.split(".")[1].replace(/-/g, "+").replace(/_/g, "/");
+        const sub = JSON.parse(atob(payload)).sub;
+        if (typeof sub === "string" && sub)
+            return `user:${sub}`;
+    }
+    catch (_d) {
+        /* not a JWT we can read */
+    }
+    return `token:${nameOf(header)}`;
+}
+export function session() {
+    try {
+        return typeof window !== "undefined" ? window.sessionStorage : null;
+    }
+    catch (_a) {
+        return null; // storage can be blocked (private mode, sandboxed iframe)
+    }
+}
+// A kept token belongs to whoever placed the order. It is stored under that
+// actor and looked up under the current one — plus `guest`, so an order placed
+// before signing in can still be opened after. What it never does is follow
+// the tab to another account, or stay usable once its account signed out.
+function tokenKey(axios, appId, actor, orderId) {
+    var _a, _b;
+    return `doany_order_token_${appId}_${nameOf(`${(_b = (_a = axios.defaults) === null || _a === void 0 ? void 0 : _a.baseURL) !== null && _b !== void 0 ? _b : ""}|${actor}`)}_${orderId}`;
+}
+export function rememberOrderToken(axios, appId, actor, orderId, token) {
+    var _a;
+    if (!token)
+        return;
+    try {
+        (_a = session()) === null || _a === void 0 ? void 0 : _a.setItem(tokenKey(axios, appId, actor, orderId), token);
+    }
+    catch (_b) {
+        /* best effort */
+    }
+}
+/** The header carrying this order's token: the one given, else the one kept. */
+export function orderAccessHeaders(axios, appId, orderId, accessToken) {
+    var _a, _b;
+    let token = accessToken;
+    if (!token) {
+        try {
+            const store = session();
+            token =
+                (_b = (_a = store === null || store === void 0 ? void 0 : store.getItem(tokenKey(axios, appId, actorOf(axios), orderId))) !== null && _a !== void 0 ? _a : store === null || store === void 0 ? void 0 : store.getItem(tokenKey(axios, appId, "guest", orderId))) !== null && _b !== void 0 ? _b : undefined;
+        }
+        catch (_c) {
+            token = undefined;
+        }
+    }
+    return token ? { "X-Doany-Access-Token": token } : {};
+}

package/dist/modules/orders.d.ts

@@ -0,0 +1,25 @@
+import { AxiosInstance } from "axios";
+import { OrdersModule } from "./orders.types";
+import { ProjectScope } from "./project.js";
+/** @internal Tests start from a page that has placed nothing. */
+export declare function resetOrderAttempts(): void;
+/**
+ * Creates the orders module for the Doany SDK.
+ *
+ * Two things are handled here so that page code does not have to:
+ *
+ * - **Retries do not double-order.** The backend requires an `Idempotency-Key`.
+ *   Identical calls that overlap are one request (a double click), and a key
+ *   is kept for an identical order for as long as its outcome is unknown (it
+ *   failed without an answer), so a retry after a dropped connection lands on
+ *   the same order — also after a page reload, for 15 minutes. Once the
+ *   server has answered, the next identical order is a new one.
+ * - **A guest can reopen their order.** The order's access token is kept for
+ *   the browser session and sent with `get` / `cancel` for that order, and
+ *   with `payments.checkout` / `payments.getForOrder` (order-access.ts).
+ *
+ * @internal
+ */
+export declare function createOrdersModule(axios: AxiosInstance, appId: string, project: ProjectScope, { rememberAttempts, }?: {
+    rememberAttempts?: boolean;
+}): OrdersModule;

package/dist/modules/orders.js

@@ -0,0 +1,296 @@
+import { actorOf, nameOf, orderAccessHeaders, rememberOrderToken, session } from "./order-access.js";
+import { queryOf, seg } from "./project.js";
+// Shared by every client the page creates: two clients placing the same order
+// at once are still one attempt, and neither may release a key the other is
+// still waiting on. Entries are named by app, actor and request.
+const inFlight = new Map();
+const memory = new Map();
+/** @internal Tests start from a page that has placed nothing. */
+export function resetOrderAttempts() {
+    inFlight.clear();
+    memory.clear();
+}
+function newKey() {
+    const c = globalThis.crypto;
+    if (c === null || c === void 0 ? void 0 : c.randomUUID)
+        return `order-${c.randomUUID()}`;
+    let out = "order-";
+    for (let i = 0; i < 32; i++)
+        out += Math.floor(Math.random() * 16).toString(16);
+    return out;
+}
+/**
+ * How long an order whose outcome is unknown keeps its key across page loads.
+ * Long enough to cover "the request failed, reload, try again"; short enough
+ * that ordering the same things again later is a new order.
+ */
+const ATTEMPT_TTL_MS = 15 * 60 * 1000;
+/**
+ * The request exactly as it will be sent, in one canonical form: keys sorted,
+ * `quantity` filled in with its default, `variant_id` lower-cased.
+ *
+ * The retry key is looked up by THIS, and this is what goes over the wire, so
+ * "same key" always means "the very same request". Anything looser breaks in
+ * one of two ways: write the same order with the keys in another order and it
+ * would get a second key (a duplicate order), or fold two requests the backend
+ * tells apart — a stray space, a blank optional field — into one and the
+ * refusal of one would release the key of the other. So whatever is
+ * normalised here is normalised in the request itself, never only in the key.
+ */
+function canonical(value) {
+    if (Array.isArray(value))
+        return value.map(canonical);
+    if (value && typeof value === "object") {
+        const out = {};
+        for (const key of Object.keys(value).sort()) {
+            const item = value[key];
+            if (item !== undefined)
+                out[key] = canonical(item);
+        }
+        return out;
+    }
+    return value;
+}
+const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+/** A valid name or email in the one form the backend stores it in, so editing
+ * a stray space or a capital between a failed attempt and its retry is still
+ * the same order. Anything blank or invalid is left exactly as typed: the
+ * backend refuses it, and a refused request must stay its own request. */
+function tidyBuyer(buyer) {
+    if (!buyer || typeof buyer !== "object")
+        return buyer;
+    const out = { ...buyer };
+    // `email: null` and no email are the same thing to the backend.
+    for (const optional of ["email", "phone"]) {
+        if (out[optional] === null)
+            delete out[optional];
+    }
+    if (typeof out.name === "string" && out.name.trim())
+        out.name = out.name.trim();
+    if (typeof out.email === "string" && EMAIL.test(out.email.trim())) {
+        out.email = out.email.trim().toLowerCase();
+    }
+    return out;
+}
+function wireOf(params, appId) {
+    const items = Array.isArray(params === null || params === void 0 ? void 0 : params.items)
+        ? params.items.map((item) => item && typeof item === "object"
+            ? {
+                ...item,
+                variant_id: typeof item.variant_id === "string" ? item.variant_id.toLowerCase() : item.variant_id,
+                // Only a quantity that was left out: null or anything else odd
+                // goes to the backend as it is and is refused there.
+                quantity: item.quantity === undefined ? 1 : item.quantity,
+            }
+            : item)
+        : params === null || params === void 0 ? void 0 : params.items;
+    // The site the order is placed on, unless the page names another (or none).
+    const app_id = (params === null || params === void 0 ? void 0 : params.app_id) === undefined ? appId : params.app_id;
+    return canonical({ ...params, app_id, items, buyer: tidyBuyer(params === null || params === void 0 ? void 0 : params.buyer) });
+}
+/**
+ * Creates the orders module for the Doany SDK.
+ *
+ * Two things are handled here so that page code does not have to:
+ *
+ * - **Retries do not double-order.** The backend requires an `Idempotency-Key`.
+ *   Identical calls that overlap are one request (a double click), and a key
+ *   is kept for an identical order for as long as its outcome is unknown (it
+ *   failed without an answer), so a retry after a dropped connection lands on
+ *   the same order — also after a page reload, for 15 minutes. Once the
+ *   server has answered, the next identical order is a new one.
+ * - **A guest can reopen their order.** The order's access token is kept for
+ *   the browser session and sent with `get` / `cancel` for that order, and
+ *   with `payments.checkout` / `payments.getForOrder` (order-access.ts).
+ *
+ * @internal
+ */
+export function createOrdersModule(axios, appId, project, { 
+// Off for the service role: a backend function's runtime serves many
+// invocations under the same app key, and state shared between them would
+// hand one invocation another's order, or swallow an order as a duplicate.
+rememberAttempts = true, } = {}) {
+    const orders = (suffix = "") => project.path(`/orders${suffix}`);
+    // Keys of orders whose outcome is unknown. In memory, and mirrored to
+    // sessionStorage so that reloading the page after a failed request — the
+    // usual way people recover — still retries with the same key.
+    const fresh = (at) => typeof at === "number" && Date.now() - at < ATTEMPT_TTL_MS;
+    const attemptKey = (fingerprint) => `doany_order_attempt_${appId}_${nameOf(fingerprint)}`;
+    const undecided = {
+        get(fingerprint) {
+            var _a, _b;
+            // The window applies wherever the key is held: a tab left open is not a
+            // reason to answer a new order with an old one.
+            const held = memory.get(fingerprint);
+            if (held && fresh(held.at))
+                return held.key;
+            memory.delete(fingerprint);
+            try {
+                const raw = (_a = session()) === null || _a === void 0 ? void 0 : _a.getItem(attemptKey(fingerprint));
+                if (!raw)
+                    return undefined;
+                const saved = JSON.parse(raw);
+                if (saved.key && fresh(saved.at))
+                    return saved.key;
+                (_b = session()) === null || _b === void 0 ? void 0 : _b.removeItem(attemptKey(fingerprint));
+            }
+            catch (_c) {
+                /* unreadable storage is the same as nothing stored */
+            }
+            return undefined;
+        },
+        set(fingerprint, key) {
+            var _a;
+            const entry = { key, at: Date.now() };
+            memory.set(fingerprint, entry);
+            try {
+                (_a = session()) === null || _a === void 0 ? void 0 : _a.setItem(attemptKey(fingerprint), JSON.stringify(entry));
+            }
+            catch (_b) {
+                /* best effort */
+            }
+        },
+        delete(fingerprint) {
+            var _a;
+            memory.delete(fingerprint);
+            try {
+                (_a = session()) === null || _a === void 0 ? void 0 : _a.removeItem(attemptKey(fingerprint));
+            }
+            catch (_b) {
+                /* best effort */
+            }
+        },
+    };
+    const accessHeaders = (orderId, accessToken) => orderAccessHeaders(axios, appId, orderId, accessToken);
+    return {
+        create(params, options) {
+            if (!rememberAttempts) {
+                // One call, one key: the caller's, else a new one. A function that
+                // retries passes its own key.
+                return (async () => {
+                    var _a, _b;
+                    const data = (await axios.request({
+                        method: "POST",
+                        url: await orders(),
+                        data: wireOf(params, appId),
+                        headers: { "Idempotency-Key": (_a = options === null || options === void 0 ? void 0 : options.idempotencyKey) !== null && _a !== void 0 ? _a : newKey() },
+                    }));
+                    if (typeof ((_b = data === null || data === void 0 ? void 0 : data.order) === null || _b === void 0 ? void 0 : _b.id) !== "string") {
+                        throw new Error("The order service answered without an order");
+                    }
+                    return data;
+                })();
+            }
+            return (async () => {
+                var _a, _b, _c, _d, _e;
+                // The actor is read after the path, with nothing awaited between it and
+                // the request: the request goes out as this actor, and its token must be
+                // kept for this actor even if the page signs in as someone else before
+                // the answer arrives. (Read before the path, a sign-in during the first
+                // public-settings read would file the order under the previous account.)
+                const url = await orders();
+                const actor = actorOf(axios);
+                const wire = wireOf(params, appId);
+                const fingerprint = JSON.stringify([(_b = (_a = axios.defaults) === null || _a === void 0 ? void 0 : _a.baseURL) !== null && _b !== void 0 ? _b : "", appId, actor, wire]);
+                const flight = `${(_c = options === null || options === void 0 ? void 0 : options.idempotencyKey) !== null && _c !== void 0 ? _c : ""}\u0000${fingerprint}`;
+                // A second identical call while the first is still out is the same
+                // attempt (a double click): it gets the first one's answer, not a
+                // request of its own.
+                const running = inFlight.get(flight);
+                if (running)
+                    return running;
+                const key = (_e = (_d = options === null || options === void 0 ? void 0 : options.idempotencyKey) !== null && _d !== void 0 ? _d : undecided.get(fingerprint)) !== null && _e !== void 0 ? _e : newKey();
+                // Written on every attempt, not only the first: the window runs from the
+                // LAST time this key went out, or a retry late in it would leave the next
+                // one without the key of an order that may just have been placed.
+                if (!(options === null || options === void 0 ? void 0 : options.idempotencyKey))
+                    undecided.set(fingerprint, key);
+                // Only the attempt that put a key there may take it away: a page-keyed
+                // attempt for the same things must not release the automatic one's key.
+                const settle = () => {
+                    if (!(options === null || options === void 0 ? void 0 : options.idempotencyKey) && undecided.get(fingerprint) === key) {
+                        undecided.delete(fingerprint);
+                    }
+                };
+                const attempt = (async () => {
+                    var _a;
+                    try {
+                        const data = (await axios.request({
+                            method: "POST",
+                            url,
+                            data: wire,
+                            headers: { "Idempotency-Key": key },
+                        }));
+                        // A 2xx that does not carry an order (a proxy's page, a mismatched
+                        // deployment) decides nothing: the key stays for the retry.
+                        if (typeof ((_a = data === null || data === void 0 ? void 0 : data.order) === null || _a === void 0 ? void 0 : _a.id) !== "string") {
+                            throw new Error("The order service answered without an order");
+                        }
+                        settle();
+                        rememberOrderToken(axios, appId, actor, data.order.id, data.access_token);
+                        return data;
+                    }
+                    catch (error) {
+                        // A 4xx is a decision (refused, invalid) — except 408 and 429, and
+                        // 401, which the rest of the client also treats as "try again"
+                        // (client.ts): a proxy can time out AFTER passing the request on.
+                        // Everything else may have placed the order, so the same key goes
+                        // out again next time; keeping a key too long costs nothing.
+                        const status = error === null || error === void 0 ? void 0 : error.status;
+                        if (typeof status === "number" &&
+                            status >= 400 &&
+                            status < 500 &&
+                            ![401, 408, 429].includes(status)) {
+                            settle();
+                        }
+                        else if (!(options === null || options === void 0 ? void 0 : options.idempotencyKey)) {
+                            // Still undecided: the window runs from now, however long the
+                            // request itself was out.
+                            undecided.set(fingerprint, key);
+                        }
+                        throw error;
+                    }
+                    finally {
+                        inFlight.delete(flight);
+                    }
+                })();
+                inFlight.set(flight, attempt);
+                return attempt;
+            })();
+        },
+        async list(params = {}) {
+            return (await axios.get(await orders(), { params: queryOf(params) }));
+        },
+        async get(orderId, options) {
+            return (await axios.get(await orders(`/${seg(orderId)}`), {
+                headers: accessHeaders(orderId, options === null || options === void 0 ? void 0 : options.accessToken),
+            }));
+        },
+        async update(orderId, params) {
+            return (await axios.patch(await orders(`/${seg(orderId)}`), params));
+        },
+        async cancel(orderId, options) {
+            const version = options === null || options === void 0 ? void 0 : options.version;
+            return (await axios.request({
+                method: "POST",
+                url: await orders(`/${seg(orderId)}/cancel`),
+                // The version is optional here: a customer's cancel sends none.
+                data: version === undefined ? undefined : { version },
+                headers: accessHeaders(orderId, options === null || options === void 0 ? void 0 : options.accessToken),
+            }));
+        },
+        async setFulfillment(orderId, { status, version }) {
+            return (await axios.put(await orders(`/${seg(orderId)}/fulfillment`), {
+                status,
+                version,
+            }));
+        },
+        async complete(orderId, { version }) {
+            return (await axios.request({
+                method: "POST",
+                url: await orders(`/${seg(orderId)}/complete`),
+                data: { version },
+            }));
+        },
+    };
+}