@doany-ai/sdk 0.2.9-alpha.0 → 0.3.0-alpha.0

package/dist/modules/contacts.types.d.ts

@@ -0,0 +1,112 @@
+import type { Address, CreateOptions, Page, PageParams, VersionInput } from "./project.types";
+export type ContactSource = "website_registration" | "purchase" | "booking_form" | "contact_form" | "staff_entry" | "agent" | "import" | "api" | "unknown";
+/**
+ * Someone the business knows: a customer, a lead, someone who wrote in.
+ *
+ * `business_note`, `source`, `app_id`, `merged_into_id` and `merged_at` are
+ * shown to the site's admin and service callers only.
+ */
+export interface Contact {
+    id: string;
+    /** Always set. */
+    display_name: string;
+    given_name: string | null;
+    family_name: string | null;
+    /** Lower-case. */
+    email: string | null;
+    /** E.164, e.g. `+14155550123`. */
+    phone: string | null;
+    address: Address | null;
+    timezone: string | null;
+    preferred_language: string | null;
+    business_note?: string | null;
+    source?: ContactSource;
+    /** The site it came from; `null` for one the business entered. */
+    app_id?: string | null;
+    archived_at: string | null;
+    merged_into_id?: string | null;
+    merged_at?: string | null;
+    version: number;
+    created_at: string;
+    updated_at: string;
+}
+/** An account linked to a contact. */
+export interface ContactUserLink {
+    user_id: string;
+    email: string | null;
+    /** `self`: the account is this person. */
+    role: "self" | "admin" | "billing" | "member";
+    /** `records`: sees the contact's orders and buys as it. `profile`: its details only. */
+    access: "profile" | "records";
+    /** The contact this account buys as by default. */
+    is_default: boolean;
+    granted_via: "registration" | "email_match" | "staff" | "checkout" | "invite" | "claim";
+    status: "active" | "revoked";
+}
+/** A contact with the accounts linked to it (the latter for admin and service callers). */
+export interface ContactDetail extends Contact {
+    users?: ContactUserLink[];
+}
+export interface ContactListParams extends PageParams {
+    /** Part of the name, email or phone. */
+    q?: string;
+    /** `active` (default), `archived` or `all`. */
+    status?: "active" | "archived" | "all";
+    source?: ContactSource;
+    /** Contacts that came from this site. */
+    app_id?: string;
+    created_from?: string;
+    created_to?: string;
+}
+interface ContactFields {
+    given_name?: string | null;
+    family_name?: string | null;
+    email?: string | null;
+    phone?: string | null;
+    address?: Partial<Address> | null;
+    timezone?: string | null;
+    preferred_language?: string | null;
+    business_note?: string | null;
+}
+export interface CreateContactParams extends ContactFields {
+    /** Left out: the name, else the email, else the phone. */
+    display_name?: string | null;
+    /** `staff_entry` (default), `agent`, `import`, `api`. */
+    source?: "staff_entry" | "agent" | "import" | "api";
+}
+export interface UpdateContactParams extends ContactFields, VersionInput {
+    display_name?: string;
+}
+/**
+ * The people the business knows.
+ *
+ * A signed-in account reads and changes only its own contact (`me`, and
+ * `updateMe` — not its email, which follows its sign-in). Everything else
+ * takes the site's admin account or a service credential.
+ */
+export interface ContactsModule {
+    /** Contacts the caller may see; an account sees only its own. Rejects with 401 when nobody is signed in. */
+    list(params?: ContactListParams): Promise<Page<Contact>>;
+    /** One contact. Rejects with 404 when there is none, or the caller may not see it. */
+    get(contactId: string): Promise<ContactDetail>;
+    /** The signed-in account's own contact. Rejects with 404 when it has none yet. */
+    me(): Promise<ContactDetail>;
+    /** A new contact. Rejects with 400 on a malformed email or phone. */
+    create(params: CreateContactParams, options?: CreateOptions): Promise<Contact>;
+    update(contactId: string, params: UpdateContactParams): Promise<Contact>;
+    /** Changes the signed-in account's own contact. */
+    updateMe(params: UpdateContactParams): Promise<Contact>;
+    archive(contactId: string, params: VersionInput): Promise<Contact>;
+    restore(contactId: string, params: VersionInput): Promise<Contact>;
+    /**
+     * Merges a duplicate into another contact, for good: its account links move
+     * to the target and its orders are found under the target from then on.
+     * Returns the target.
+     */
+    merge(contactId: string, params: VersionInput & {
+        into_contact_id: string;
+    }): Promise<ContactDetail>;
+    /** Deletes a contact nothing refers to; otherwise 409 `IN_USE` (archive it instead). */
+    delete(contactId: string): Promise<void>;
+}
+export {};

package/dist/modules/contacts.types.js

@@ -0,0 +1 @@
+export {};

package/dist/modules/events.d.ts

@@ -0,0 +1,9 @@
+import { AxiosInstance } from "axios";
+import { EventsModule } from "./events.types";
+import { ProjectScope } from "./project.js";
+/**
+ * Creates the events module: `/projects/{project_id}/events`.
+ *
+ * @internal
+ */
+export declare function createEventsModule(axios: AxiosInstance, project: ProjectScope): EventsModule;

package/dist/modules/events.js

@@ -0,0 +1,15 @@
+import { queryOf } from "./project.js";
+/**
+ * Creates the events module: `/projects/{project_id}/events`.
+ *
+ * @internal
+ */
+export function createEventsModule(axios, project) {
+    return {
+        async list(params = {}) {
+            return (await axios.get(await project.path("/events"), {
+                params: queryOf(params),
+            }));
+        },
+    };
+}

package/dist/modules/events.types.d.ts

@@ -0,0 +1,42 @@
+import type { Page } from "./project.types";
+export type EventSubjectType = "order" | "payment" | "refund" | "dispute" | "contact";
+/**
+ * Something that happened to an order, a payment, a refund, a dispute or a
+ * contact — `order.placed`, `payment.succeeded`, `contact.merged`, … — and who
+ * did it.
+ */
+export interface ProjectEvent {
+    id: string;
+    event_type: string;
+    subject_type: EventSubjectType;
+    subject_id: string;
+    /** `type`: `system`, `provider`, `founder` (+ `user_id`), `agent`, `customer` (+ `project_user_id`), `guest`. */
+    actor: {
+        type: string;
+        user_id?: string;
+        project_user_id?: string;
+    };
+    data: Record<string, any>;
+    occurred_at: string;
+}
+export interface EventListParams {
+    /** The order's events, and those of its payments, refunds and disputes. */
+    order_id?: string;
+    /** The contact's (and merged contacts') events, and those of their orders. */
+    contact_id?: string;
+    subject_type?: EventSubjectType;
+    subject_id?: string;
+    /** A full type (`order.placed`) or a prefix ending in `.` (`refund.`). */
+    event_type?: string;
+    occurred_from?: string;
+    occurred_to?: string;
+    limit?: number;
+    cursor?: string;
+}
+/**
+ * The business's timeline. The site's admin and service callers only.
+ */
+export interface EventsModule {
+    /** Newest first. */
+    list(params?: EventListParams): Promise<Page<ProjectEvent>>;
+}

package/dist/modules/events.types.js

@@ -0,0 +1 @@
+export {};

package/dist/modules/order-access.d.ts

@@ -0,0 +1,20 @@
+import { AxiosInstance } from "axios";
+/**
+ * An order's access token (`X-Doany-Access-Token`): what lets a guest come back
+ * to an order they placed. Kept for the browser session by `orders.create` and
+ * sent by every call that accepts it — `orders.get`, `orders.cancel`,
+ * `payments.checkout`, `payments.getForOrder`.
+ *
+ * @internal
+ */
+/** cyrb53: a short, stable name for a value, so the value itself (a token, a
+ * buyer's details) is not what gets written as a storage key. */
+export declare function nameOf(text: string): string;
+/** Who the backend will take this request to be from: it keeps idempotency
+ * keys per signed-in account and per guest, so an unresolved attempt belongs
+ * to whoever made it and nobody else may reuse or clear it. */
+export declare function actorOf(axios: AxiosInstance): string;
+export declare function session(): Storage | null;
+export declare function rememberOrderToken(axios: AxiosInstance, appId: string, actor: string, orderId: string, token?: string): void;
+/** The header carrying this order's token: the one given, else the one kept. */
+export declare function orderAccessHeaders(axios: AxiosInstance, appId: string, orderId: string, accessToken?: string): Record<string, string>;

package/dist/modules/order-access.js

@@ -0,0 +1,84 @@
+/**
+ * An order's access token (`X-Doany-Access-Token`): what lets a guest come back
+ * to an order they placed. Kept for the browser session by `orders.create` and
+ * sent by every call that accepts it — `orders.get`, `orders.cancel`,
+ * `payments.checkout`, `payments.getForOrder`.
+ *
+ * @internal
+ */
+/** cyrb53: a short, stable name for a value, so the value itself (a token, a
+ * buyer's details) is not what gets written as a storage key. */
+export function nameOf(text) {
+    let h1 = 0xdeadbeef;
+    let h2 = 0x41c6ce57;
+    for (let i = 0; i < text.length; i++) {
+        const ch = text.charCodeAt(i);
+        h1 = Math.imul(h1 ^ ch, 2654435761);
+        h2 = Math.imul(h2 ^ ch, 1597334677);
+    }
+    h1 = Math.imul(h1 ^ (h1 >>> 16), 2246822507) ^ Math.imul(h2 ^ (h2 >>> 13), 3266489909);
+    h2 = Math.imul(h2 ^ (h2 >>> 16), 2246822507) ^ Math.imul(h1 ^ (h1 >>> 13), 3266489909);
+    return (4294967296 * (2097151 & h2) + (h1 >>> 0)).toString(36);
+}
+/** Who the backend will take this request to be from: it keeps idempotency
+ * keys per signed-in account and per guest, so an unresolved attempt belongs
+ * to whoever made it and nobody else may reuse or clear it. */
+export function actorOf(axios) {
+    var _a, _b, _c;
+    const header = (_c = (_b = (_a = axios.defaults) === null || _a === void 0 ? void 0 : _a.headers) === null || _b === void 0 ? void 0 : _b.common) === null || _c === void 0 ? void 0 : _c["Authorization"];
+    if (typeof header !== "string" || !header.startsWith("Bearer "))
+        return "guest";
+    try {
+        const payload = header.split(".")[1].replace(/-/g, "+").replace(/_/g, "/");
+        const sub = JSON.parse(atob(payload)).sub;
+        if (typeof sub === "string" && sub)
+            return `user:${sub}`;
+    }
+    catch (_d) {
+        /* not a JWT we can read */
+    }
+    return `token:${nameOf(header)}`;
+}
+export function session() {
+    try {
+        return typeof window !== "undefined" ? window.sessionStorage : null;
+    }
+    catch (_a) {
+        return null; // storage can be blocked (private mode, sandboxed iframe)
+    }
+}
+// A kept token belongs to whoever placed the order. It is stored under that
+// actor and looked up under the current one — plus `guest`, so an order placed
+// before signing in can still be opened after. What it never does is follow
+// the tab to another account, or stay usable once its account signed out.
+function tokenKey(axios, appId, actor, orderId) {
+    var _a, _b;
+    return `doany_order_token_${appId}_${nameOf(`${(_b = (_a = axios.defaults) === null || _a === void 0 ? void 0 : _a.baseURL) !== null && _b !== void 0 ? _b : ""}|${actor}`)}_${orderId}`;
+}
+export function rememberOrderToken(axios, appId, actor, orderId, token) {
+    var _a;
+    if (!token)
+        return;
+    try {
+        (_a = session()) === null || _a === void 0 ? void 0 : _a.setItem(tokenKey(axios, appId, actor, orderId), token);
+    }
+    catch (_b) {
+        /* best effort */
+    }
+}
+/** The header carrying this order's token: the one given, else the one kept. */
+export function orderAccessHeaders(axios, appId, orderId, accessToken) {
+    var _a, _b;
+    let token = accessToken;
+    if (!token) {
+        try {
+            const store = session();
+            token =
+                (_b = (_a = store === null || store === void 0 ? void 0 : store.getItem(tokenKey(axios, appId, actorOf(axios), orderId))) !== null && _a !== void 0 ? _a : store === null || store === void 0 ? void 0 : store.getItem(tokenKey(axios, appId, "guest", orderId))) !== null && _b !== void 0 ? _b : undefined;
+        }
+        catch (_c) {
+            token = undefined;
+        }
+    }
+    return token ? { "X-Doany-Access-Token": token } : {};
+}

package/dist/modules/orders.d.ts

@@ -1,5 +1,6 @@
 import { AxiosInstance } from "axios";
 import { OrdersModule } from "./orders.types";
+import { ProjectScope } from "./project.js";
 /** @internal Tests start from a page that has placed nothing. */
 export declare function resetOrderAttempts(): void;
 /**
@@ -14,8 +15,11 @@ export declare function resetOrderAttempts(): void;
  *   the same order — also after a page reload, for 15 minutes. Once the
  *   server has answered, the next identical order is a new one.
  * - **A guest can reopen their order.** The order's access token is kept for
- *   the browser session and sent with `get` / `cancel` for that order.
+ *   the browser session and sent with `get` / `cancel` for that order, and
+ *   with `payments.checkout` / `payments.getForOrder` (order-access.ts).
  *
  * @internal
  */
-export declare function createOrdersModule(axios: AxiosInstance, appId: string): OrdersModule;
+export declare function createOrdersModule(axios: AxiosInstance, appId: string, project: ProjectScope, { rememberAttempts, }?: {
+    rememberAttempts?: boolean;
+}): OrdersModule;