@doany-ai/sdk 0.2.9-alpha.0 → 0.3.0-alpha.0

package/dist/modules/orders.js

@@ -1,3 +1,5 @@
+import { actorOf, nameOf, orderAccessHeaders, rememberOrderToken, session } from "./order-access.js";
+import { queryOf, seg } from "./project.js";
 // Shared by every client the page creates: two clients placing the same order
 // at once are still one attempt, and neither may release a key the other is
 // still waiting on. Entries are named by app, actor and request.
@@ -23,40 +25,6 @@ function newKey() {
  * that ordering the same things again later is a new order.
  */
 const ATTEMPT_TTL_MS = 15 * 60 * 1000;
-/** cyrb53: a short, stable name for a payload, so the payload itself (the buyer's
- * details) is not what gets written as a storage key. A collision would only
- * reuse a key for a different payload, which the backend refuses with 409. */
-function nameOf(text) {
-    let h1 = 0xdeadbeef;
-    let h2 = 0x41c6ce57;
-    for (let i = 0; i < text.length; i++) {
-        const ch = text.charCodeAt(i);
-        h1 = Math.imul(h1 ^ ch, 2654435761);
-        h2 = Math.imul(h2 ^ ch, 1597334677);
-    }
-    h1 = Math.imul(h1 ^ (h1 >>> 16), 2246822507) ^ Math.imul(h2 ^ (h2 >>> 13), 3266489909);
-    h2 = Math.imul(h2 ^ (h2 >>> 16), 2246822507) ^ Math.imul(h1 ^ (h1 >>> 13), 3266489909);
-    return (4294967296 * (2097151 & h2) + (h1 >>> 0)).toString(36);
-}
-/** Who the backend will take this request to be from: it keeps idempotency
- * keys per signed-in account and per guest, so an unresolved attempt belongs
- * to whoever made it and nobody else may reuse or clear it. */
-function actorOf(axios) {
-    var _a, _b, _c;
-    const header = (_c = (_b = (_a = axios.defaults) === null || _a === void 0 ? void 0 : _a.headers) === null || _b === void 0 ? void 0 : _b.common) === null || _c === void 0 ? void 0 : _c["Authorization"];
-    if (typeof header !== "string" || !header.startsWith("Bearer "))
-        return "guest";
-    try {
-        const payload = header.split(".")[1].replace(/-/g, "+").replace(/_/g, "/");
-        const sub = JSON.parse(atob(payload)).sub;
-        if (typeof sub === "string" && sub)
-            return `user:${sub}`;
-    }
-    catch (_d) {
-        /* not a JWT we can read */
-    }
-    return `token:${nameOf(header)}`;
-}
 /**
  * The request exactly as it will be sent, in one canonical form: keys sorted,
  * `quantity` filled in with its default, `variant_id` lower-cased.
@@ -104,7 +72,7 @@ function tidyBuyer(buyer) {
     }
     return out;
 }
-function wireOf(params) {
+function wireOf(params, appId) {
     const items = Array.isArray(params === null || params === void 0 ? void 0 : params.items)
         ? params.items.map((item) => item && typeof item === "object"
             ? {
@@ -116,15 +84,9 @@ function wireOf(params) {
             }
             : item)
         : params === null || params === void 0 ? void 0 : params.items;
-    return canonical({ ...params, items, buyer: tidyBuyer(params === null || params === void 0 ? void 0 : params.buyer) });
-}
-function session() {
-    try {
-        return typeof window !== "undefined" ? window.sessionStorage : null;
-    }
-    catch (_a) {
-        return null; // storage can be blocked (private mode, sandboxed iframe)
-    }
+    // The site the order is placed on, unless the page names another (or none).
+    const app_id = (params === null || params === void 0 ? void 0 : params.app_id) === undefined ? appId : params.app_id;
+    return canonical({ ...params, app_id, items, buyer: tidyBuyer(params === null || params === void 0 ? void 0 : params.buyer) });
 }
 /**
  * Creates the orders module for the Doany SDK.
@@ -138,12 +100,17 @@ function session() {
  *   the same order — also after a page reload, for 15 minutes. Once the
  *   server has answered, the next identical order is a new one.
  * - **A guest can reopen their order.** The order's access token is kept for
- *   the browser session and sent with `get` / `cancel` for that order.
+ *   the browser session and sent with `get` / `cancel` for that order, and
+ *   with `payments.checkout` / `payments.getForOrder` (order-access.ts).
  *
  * @internal
  */
-export function createOrdersModule(axios, appId) {
-    const baseURL = `/apps/${appId}/orders`;
+export function createOrdersModule(axios, appId, project, { 
+// Off for the service role: a backend function's runtime serves many
+// invocations under the same app key, and state shared between them would
+// hand one invocation another's order, or swallow an order as a duplicate.
+rememberAttempts = true, } = {}) {
+    const orders = (suffix = "") => project.path(`/orders${suffix}`);
     // Keys of orders whose outcome is unknown. In memory, and mirrored to
     // sessionStorage so that reloading the page after a failed request — the
     // usual way people recover — still retries with the same key.
@@ -194,137 +161,136 @@ export function createOrdersModule(axios, appId) {
             }
         },
     };
-    // A kept token belongs to whoever placed the order. It is stored under that
-    // actor and looked up under the current one — plus `guest`, so an order placed
-    // before signing in can still be opened after. What it never does is follow
-    // the tab to another account, or stay usable once its account signed out.
-    const tokenKey = (actor, orderId) => { var _a, _b; return `doany_order_token_${appId}_${nameOf(`${(_b = (_a = axios.defaults) === null || _a === void 0 ? void 0 : _a.baseURL) !== null && _b !== void 0 ? _b : ""}|${actor}`)}_${orderId}`; };
-    function remember(actor, orderId, token) {
-        var _a;
-        if (!token)
-            return;
-        try {
-            (_a = session()) === null || _a === void 0 ? void 0 : _a.setItem(tokenKey(actor, orderId), token);
-        }
-        catch (_b) {
-            /* best effort */
-        }
-    }
-    function accessHeaders(orderId, options) {
-        var _a, _b;
-        let token = options === null || options === void 0 ? void 0 : options.accessToken;
-        if (!token) {
-            try {
-                const store = session();
-                token =
-                    (_b = (_a = store === null || store === void 0 ? void 0 : store.getItem(tokenKey(actorOf(axios), orderId))) !== null && _a !== void 0 ? _a : store === null || store === void 0 ? void 0 : store.getItem(tokenKey("guest", orderId))) !== null && _b !== void 0 ? _b : undefined;
-            }
-            catch (_c) {
-                token = undefined;
-            }
-        }
-        return token ? { "X-Doany-Access-Token": token } : {};
-    }
+    const accessHeaders = (orderId, accessToken) => orderAccessHeaders(axios, appId, orderId, accessToken);
     return {
         create(params, options) {
-            var _a, _b, _c, _d, _e;
-            // Read once, before anything is awaited: the request goes out as this
-            // actor, and its token must be kept for this actor even if the page has
-            // signed in as someone else by the time the answer arrives.
-            const actor = actorOf(axios);
-            const wire = wireOf(params);
-            const fingerprint = JSON.stringify([(_b = (_a = axios.defaults) === null || _a === void 0 ? void 0 : _a.baseURL) !== null && _b !== void 0 ? _b : "", appId, actor, wire]);
-            const flight = `${(_c = options === null || options === void 0 ? void 0 : options.idempotencyKey) !== null && _c !== void 0 ? _c : ""}\u0000${fingerprint}`;
-            // A second identical call while the first is still out is the same
-            // attempt (a double click): it gets the first one's answer, not a
-            // request of its own.
-            const running = inFlight.get(flight);
-            if (running)
-                return running;
-            const key = (_e = (_d = options === null || options === void 0 ? void 0 : options.idempotencyKey) !== null && _d !== void 0 ? _d : undecided.get(fingerprint)) !== null && _e !== void 0 ? _e : newKey();
-            // Written on every attempt, not only the first: the window runs from the
-            // LAST time this key went out, or a retry late in it would leave the next
-            // one without the key of an order that may just have been placed.
-            if (!(options === null || options === void 0 ? void 0 : options.idempotencyKey))
-                undecided.set(fingerprint, key);
-            // Only the attempt that put a key there may take it away: a page-keyed
-            // attempt for the same things must not release the automatic one's key.
-            const settle = () => {
-                if (!(options === null || options === void 0 ? void 0 : options.idempotencyKey) && undecided.get(fingerprint) === key) {
-                    undecided.delete(fingerprint);
-                }
-            };
-            const attempt = (async () => {
-                var _a;
-                try {
+            if (!rememberAttempts) {
+                // One call, one key: the caller's, else a new one. A function that
+                // retries passes its own key.
+                return (async () => {
+                    var _a, _b;
                     const data = (await axios.request({
                         method: "POST",
-                        url: baseURL,
-                        data: wire,
-                        headers: { "Idempotency-Key": key },
+                        url: await orders(),
+                        data: wireOf(params, appId),
+                        headers: { "Idempotency-Key": (_a = options === null || options === void 0 ? void 0 : options.idempotencyKey) !== null && _a !== void 0 ? _a : newKey() },
                     }));
-                    // A 2xx that does not carry an order (a proxy's page, a mismatched
-                    // deployment) decides nothing: the key stays for the retry.
-                    if (typeof ((_a = data === null || data === void 0 ? void 0 : data.order) === null || _a === void 0 ? void 0 : _a.id) !== "string") {
+                    if (typeof ((_b = data === null || data === void 0 ? void 0 : data.order) === null || _b === void 0 ? void 0 : _b.id) !== "string") {
                         throw new Error("The order service answered without an order");
                     }
-                    settle();
-                    remember(actor, data.order.id, data.access_token);
                     return data;
-                }
-                catch (error) {
-                    // A 4xx is a decision (refused, invalid) — except 408 and 429, and
-                    // 401, which the rest of the client also treats as "try again"
-                    // (client.ts): a proxy can time out AFTER passing the request on.
-                    // Everything else may have placed the order, so the same key goes
-                    // out again next time; keeping a key too long costs nothing.
-                    const status = error === null || error === void 0 ? void 0 : error.status;
-                    if (typeof status === "number" &&
-                        status >= 400 &&
-                        status < 500 &&
-                        ![401, 408, 429].includes(status)) {
+                })();
+            }
+            return (async () => {
+                var _a, _b, _c, _d, _e;
+                // The actor is read after the path, with nothing awaited between it and
+                // the request: the request goes out as this actor, and its token must be
+                // kept for this actor even if the page signs in as someone else before
+                // the answer arrives. (Read before the path, a sign-in during the first
+                // public-settings read would file the order under the previous account.)
+                const url = await orders();
+                const actor = actorOf(axios);
+                const wire = wireOf(params, appId);
+                const fingerprint = JSON.stringify([(_b = (_a = axios.defaults) === null || _a === void 0 ? void 0 : _a.baseURL) !== null && _b !== void 0 ? _b : "", appId, actor, wire]);
+                const flight = `${(_c = options === null || options === void 0 ? void 0 : options.idempotencyKey) !== null && _c !== void 0 ? _c : ""}\u0000${fingerprint}`;
+                // A second identical call while the first is still out is the same
+                // attempt (a double click): it gets the first one's answer, not a
+                // request of its own.
+                const running = inFlight.get(flight);
+                if (running)
+                    return running;
+                const key = (_e = (_d = options === null || options === void 0 ? void 0 : options.idempotencyKey) !== null && _d !== void 0 ? _d : undecided.get(fingerprint)) !== null && _e !== void 0 ? _e : newKey();
+                // Written on every attempt, not only the first: the window runs from the
+                // LAST time this key went out, or a retry late in it would leave the next
+                // one without the key of an order that may just have been placed.
+                if (!(options === null || options === void 0 ? void 0 : options.idempotencyKey))
+                    undecided.set(fingerprint, key);
+                // Only the attempt that put a key there may take it away: a page-keyed
+                // attempt for the same things must not release the automatic one's key.
+                const settle = () => {
+                    if (!(options === null || options === void 0 ? void 0 : options.idempotencyKey) && undecided.get(fingerprint) === key) {
+                        undecided.delete(fingerprint);
+                    }
+                };
+                const attempt = (async () => {
+                    var _a;
+                    try {
+                        const data = (await axios.request({
+                            method: "POST",
+                            url,
+                            data: wire,
+                            headers: { "Idempotency-Key": key },
+                        }));
+                        // A 2xx that does not carry an order (a proxy's page, a mismatched
+                        // deployment) decides nothing: the key stays for the retry.
+                        if (typeof ((_a = data === null || data === void 0 ? void 0 : data.order) === null || _a === void 0 ? void 0 : _a.id) !== "string") {
+                            throw new Error("The order service answered without an order");
+                        }
                         settle();
+                        rememberOrderToken(axios, appId, actor, data.order.id, data.access_token);
+                        return data;
+                    }
+                    catch (error) {
+                        // A 4xx is a decision (refused, invalid) — except 408 and 429, and
+                        // 401, which the rest of the client also treats as "try again"
+                        // (client.ts): a proxy can time out AFTER passing the request on.
+                        // Everything else may have placed the order, so the same key goes
+                        // out again next time; keeping a key too long costs nothing.
+                        const status = error === null || error === void 0 ? void 0 : error.status;
+                        if (typeof status === "number" &&
+                            status >= 400 &&
+                            status < 500 &&
+                            ![401, 408, 429].includes(status)) {
+                            settle();
+                        }
+                        else if (!(options === null || options === void 0 ? void 0 : options.idempotencyKey)) {
+                            // Still undecided: the window runs from now, however long the
+                            // request itself was out.
+                            undecided.set(fingerprint, key);
+                        }
+                        throw error;
                     }
-                    else if (!(options === null || options === void 0 ? void 0 : options.idempotencyKey)) {
-                        // Still undecided: the window runs from now, however long the
-                        // request itself was out.
-                        undecided.set(fingerprint, key);
+                    finally {
+                        inFlight.delete(flight);
                     }
-                    throw error;
-                }
-                finally {
-                    inFlight.delete(flight);
-                }
+                })();
+                inFlight.set(flight, attempt);
+                return attempt;
             })();
-            inFlight.set(flight, attempt);
-            return attempt;
         },
         async list(params = {}) {
-            const query = {};
-            if (params.status)
-                query.status = params.status;
-            if (params.limit)
-                query.limit = params.limit;
-            if (params.skip)
-                query.skip = params.skip;
-            if (params.sort)
-                query.sort = params.sort;
-            const data = await axios.get(baseURL, { params: query });
-            return data;
+            return (await axios.get(await orders(), { params: queryOf(params) }));
         },
         async get(orderId, options) {
-            const data = await axios.get(`${baseURL}/${encodeURIComponent(orderId)}`, {
-                headers: accessHeaders(orderId, options),
-            });
-            return data;
+            return (await axios.get(await orders(`/${seg(orderId)}`), {
+                headers: accessHeaders(orderId, options === null || options === void 0 ? void 0 : options.accessToken),
+            }));
+        },
+        async update(orderId, params) {
+            return (await axios.patch(await orders(`/${seg(orderId)}`), params));
         },
         async cancel(orderId, options) {
-            const data = await axios.request({
+            const version = options === null || options === void 0 ? void 0 : options.version;
+            return (await axios.request({
+                method: "POST",
+                url: await orders(`/${seg(orderId)}/cancel`),
+                // The version is optional here: a customer's cancel sends none.
+                data: version === undefined ? undefined : { version },
+                headers: accessHeaders(orderId, options === null || options === void 0 ? void 0 : options.accessToken),
+            }));
+        },
+        async setFulfillment(orderId, { status, version }) {
+            return (await axios.put(await orders(`/${seg(orderId)}/fulfillment`), {
+                status,
+                version,
+            }));
+        },
+        async complete(orderId, { version }) {
+            return (await axios.request({
                 method: "POST",
-                url: `${baseURL}/${encodeURIComponent(orderId)}/cancel`,
-                headers: accessHeaders(orderId, options),
-            });
-            return data;
+                url: await orders(`/${seg(orderId)}/complete`),
+                data: { version },
+            }));
         },
     };
 }

package/dist/modules/orders.types.d.ts

@@ -1,57 +1,104 @@
-export type OrderStatus = "open" | "completed" | "canceled";
-export type FulfillmentStatus = "pending" | "in_progress" | "completed" | "canceled";
+import type { Address, Page, PageParams, VersionInput } from "./project.types";
+/**
+ * - `pending`: placed on the site, waiting for its payment; expires after an hour unpaid.
+ * - `placed`: paid, free, or entered by the business. Has an order number.
+ * - `completed`: the business marked it done. Cannot be canceled any more.
+ * - `canceled`, `expired`.
+ */
+export type OrderStatus = "pending" | "placed" | "completed" | "canceled" | "expired";
+export type OrderChannel = "online" | "staff";
+/** Delivery is marked for the whole order. */
+export type FulfillmentStatus = "not_required" | "unfulfilled" | "fulfilled";
 /** A line of an order. Names, price and duration are as they were when it was placed. */
 export interface OrderItem {
     id: string;
-    variant_id: string;
+    variant_id: string | null;
     item_name: string;
-    variant_name: string;
+    variant_name: string | null;
     duration_minutes: number | null;
     unit_amount: number;
     quantity: number;
     line_amount: number;
-    fulfillment_mode: "manual" | "calendar";
-    fulfillment_status: FulfillmentStatus | null;
-    fulfilled_at: string | null;
 }
 export interface OrderBuyer {
     name: string;
     email: string | null;
     phone: string | null;
 }
+/** An address, plus who receives it (empty: the buyer). */
+export interface ShippingAddress extends Address {
+    name: string | null;
+    phone: string | null;
+}
 export interface Order {
     id: string;
-    /** The number to show the customer. */
-    order_number: string;
+    /** Consecutive per business and environment, given when the order is placed. Show it as `#12`. */
+    order_number: number | null;
     status: OrderStatus;
+    channel: OrderChannel;
+    /** When a `pending` order stops waiting for its payment. */
+    expires_at: string | null;
+    fulfillment_status: FulfillmentStatus;
     currency: string;
     /** In the currency's smallest unit (cents). */
     total_amount: number;
+    /** A test (preview) order or a real one. */
+    livemode: boolean;
+    /** The site it was placed on. */
+    app_id: string | null;
+    contact_id: string | null;
+    /** The account that placed it. */
+    user_id: string | null;
     buyer: OrderBuyer;
+    shipping_address: ShippingAddress | null;
+    customer_note: string | null;
+    /** Only the site's admin and service callers see it. */
+    internal_note?: string | null;
+    /** In the order they were bought in. */
     items: OrderItem[];
     payment: {
-        /** `false` for a free order, which is `completed` as soon as it is placed. */
+        /** `false` for a free order, which is `placed` as soon as it is created. */
         required: boolean;
         amount_received: number;
         amount_refunded: number;
     };
+    /** Only the site's admin and service callers see it. */
+    created_by?: "customer" | "owner" | "system";
+    created_by_user_id?: string | null;
+    access?: {
+        issued: boolean;
+        revoked: boolean;
+    };
+    version: number;
     created_at: string;
+    updated_at: string;
+    placed_at: string | null;
     completed_at: string | null;
     canceled_at: string | null;
 }
 export interface OrderSummary {
     id: string;
-    order_number: string;
+    order_number: number | null;
     status: OrderStatus;
+    channel: OrderChannel;
+    fulfillment_status: FulfillmentStatus;
     currency: string;
     total_amount: number;
+    livemode: boolean;
+    app_id: string | null;
+    contact_id: string | null;
+    user_id: string | null;
     buyer: {
         name: string;
     };
     created_at: string;
 }
 export interface CreateOrderParams {
-    /** What is being bought. Prices are not sent: the order takes them from the catalog. */
+    /** `online` (default): a customer on the site. `staff`: the business entering one. */
+    channel?: OrderChannel;
+    /** The site it is placed on. Defaults to this client's app. */
+    app_id?: string | null;
+    /** 1–100 variants, each once. Prices are not sent: the order takes them from the catalog. */
     items: Array<{
         variant_id: string;
         quantity?: number;
@@ -62,6 +109,16 @@ export interface CreateOrderParams {
         email?: string;
         phone?: string;
     };
+    /** Required when something in it is shipped (`kind: "physical"`): at least `line` and `country`. */
+    shipping_address?: Partial<ShippingAddress>;
+    /** Up to 1000 characters. */
+    customer_note?: string;
+    /** `staff` only, and required there: a real order or a test. */
+    livemode?: boolean;
+    /** `staff` only: the contact it is for, instead of matching the buyer. */
+    contact_id?: string;
+    /** `staff` only. */
+    internal_note?: string;
 }
 export interface CreateOrderOptions {
     /**
@@ -75,34 +132,54 @@ export interface CreateOrderResult {
     order: Order;
     /**
      * Lets someone who is not signed in open this order again. The SDK keeps it
-     * for the rest of the browser session, so `orders.get` and `orders.cancel`
-     * work without passing it; put it in a link (after `#`) to reach the order
-     * from elsewhere.
+     * for the rest of the browser session, so `orders.get`, `orders.cancel` and
+     * the payments calls work without passing it; put it in a link (after `#`)
+     * to reach the order from elsewhere.
      */
     access_token?: string;
-    /** `false` when the order is free and already completed. */
+    /** `false` when the order is free and already placed. */
     payment_required: boolean;
 }
-export interface OrderListParams {
+export interface OrderListParams extends PageParams {
     status?: OrderStatus;
-    limit?: number;
-    skip?: number;
-    /** `created_at` (default, newest first), `total_amount`, `order_number`, `status`; `-` in front for descending. */
-    sort?: string;
+    channel?: OrderChannel;
+    /** Orders placed on this site. */
+    app_id?: string;
+    /** The contact's orders, and those of contacts merged into it. */
+    contact_id?: string;
+    user_id?: string;
+    /** Order number, buyer name or email. */
+    q?: string;
+    created_from?: string;
+    created_to?: string;
 }
 export interface OrderAccessOptions {
     /** The order's `access_token`, when it came from a link rather than from this browser session. */
     accessToken?: string;
 }
+export interface UpdateOrderParams extends VersionInput {
+    /** Not once the order is delivered, completed or closed. */
+    shipping_address?: Partial<ShippingAddress> | null;
+    internal_note?: string | null;
+}
 /**
- * Orders placed on the site.
+ * Orders.
+ *
+ * Who sees an order: the account that placed it, accounts with the records
+ * of its contact, anyone holding its access token, the site's admin and
+ * service callers. Anyone else gets 404.
  */
 export interface OrdersModule {
     /**
      * Places an order for catalog variants. Works signed in or not.
      *
-     * Rejects with status 409 and `code` `NOT_PURCHASABLE` (with `data.variant_id`)
-     * when something in it cannot be bought, or `MIXED_CURRENCY`.
+     * Rejects with 409 `NOT_PURCHASABLE` (`details.variant_id`, `details.reason`)
+     * when something in it cannot be bought, 409 `MIXED_CURRENCY`, or 429
+     * `RATE_LIMITED`.
+     *
+     * An `online` order takes its environment (preview or published) from the
+     * page's `Origin`, which a backend function does not send: with
+     * `asServiceRole`, enter a `staff` order and say `livemode` instead.
      *
      * @example
      * ```typescript
@@ -113,13 +190,26 @@ export interface OrdersModule {
      * ```
      */
     create(params: CreateOrderParams, options?: CreateOrderOptions): Promise<CreateOrderResult>;
-    /** The signed-in customer's orders, newest first. Rejects with status 401 when nobody is signed in. */
-    list(params?: OrderListParams): Promise<OrderSummary[]>;
+    /** The orders the caller may see, newest first. Rejects with 401 when nobody is signed in. */
+    list(params?: OrderListParams): Promise<Page<OrderSummary>>;
+    /** One order. */
+    get(orderId: string, options?: OrderAccessOptions): Promise<Order>;
+    /** Changes the shipping address or the internal note. The site's admin and service callers only. */
+    update(orderId: string, params: UpdateOrderParams): Promise<Order>;
     /**
-     * One order. Available to the signed-in customer who placed it, or to anyone
-     * holding its access token; otherwise rejects with status 404.
+     * Cancels a `pending` or `placed` order (a customer: only one not paid yet).
+     * Canceling is not refunding. Rejects with 409 `INVALID_STATE` once the
+     * order is completed or expired, 409 `PAYMENT_UNRESOLVED` while a payment
+     * is still being confirmed.
      */
-    get(orderId: string, options?: OrderAccessOptions): Promise<Order>;
-    /** Cancels an order that is still `open`. Rejects with status 409 (`INVALID_STATE`) otherwise. */
-    cancel(orderId: string, options?: OrderAccessOptions): Promise<Order>;
+    cancel(orderId: string, options?: OrderAccessOptions & Partial<VersionInput>): Promise<Order>;
+    /** Marks the whole order delivered, or takes that back. `placed` orders only. */
+    setFulfillment(orderId: string, params: VersionInput & {
+        status: "fulfilled" | "unfulfilled";
+    }): Promise<Order>;
+    /**
+     * Says the order is done. Nothing may still be owed (409 `INVALID_STATE`,
+     * `details.amount_due`); delivery is not required.
+     */
+    complete(orderId: string, params: VersionInput): Promise<Order>;
 }

package/dist/modules/payments.d.ts

@@ -1,5 +1,6 @@
 import { AxiosInstance } from "axios";
 import { PaymentsModule, ProductsModule } from "./payments.types";
+import { ProjectScope } from "./project.js";
 /**
  * The product reads.
  *
@@ -21,4 +22,4 @@ export declare function createProductsModule(axios: AxiosInstance, appId: string
  *
  * @internal
  */
-export declare function createPaymentsModule(axios: AxiosInstance, appId: string): PaymentsModule;
+export declare function createPaymentsModule(axios: AxiosInstance, appId: string, project: ProjectScope): PaymentsModule;

package/dist/modules/payments.js

@@ -1,3 +1,5 @@
+import { orderAccessHeaders } from "./order-access.js";
+import { queryOf, seg } from "./project.js";
 /**
  * The product reads.
  *
@@ -47,7 +49,7 @@ export function createProductsModule(axios, appId) {
  *
  * @internal
  */
-export function createPaymentsModule(axios, appId) {
+export function createPaymentsModule(axios, appId, project) {
     async function createCheckoutSession(params) {
         const data = await axios.request({
             method: "POST",
@@ -84,5 +86,30 @@ export function createPaymentsModule(axios, appId) {
             });
             return data;
         },
+        // Paying for an order: /projects/{project_id}/orders/{order_id}/...
+        // The order's access token rides along, as for orders.get.
+        async checkout(orderId, params = {}, options) {
+            const data = await axios.request({
+                method: "POST",
+                url: await project.path(`/orders/${seg(orderId)}/checkout`),
+                data: params,
+                headers: orderAccessHeaders(axios, appId, orderId, options === null || options === void 0 ? void 0 : options.accessToken),
+            });
+            return data;
+        },
+        async getForOrder(orderId, options) {
+            const data = await axios.get(await project.path(`/orders/${seg(orderId)}/payments`), {
+                headers: orderAccessHeaders(axios, appId, orderId, options === null || options === void 0 ? void 0 : options.accessToken),
+            });
+            return data;
+        },
+        async list(params = {}) {
+            const data = await axios.get(await project.path("/payments"), { params: queryOf(params) });
+            return data;
+        },
+        async get(paymentId) {
+            const data = await axios.get(await project.path(`/payments/${seg(paymentId)}`));
+            return data;
+        },
     };
 }