@qelos/sdk 4.2.0 → 4.2.2

package/dist/payments.js.map

@@ -1 +1 @@
-{"version":3,"file":"payments.js","sourceRoot":"","sources":["../src/payments.ts"],"names":[],"mappings":"AACA,OAAO,OAAO,MAAM,YAAY,CAAC;AAgCjC,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,OAAO;IACrC,YAAY,GAAG,MAAM,CAAC;IAE9B,YAAY,OAAwB;QAClC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;IAED,QAAQ,CAAC,KAA8B;QACrC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,eAAe,CAAC,KAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC,WAAW,CAAU,GAAG,IAAI,CAAC,YAAY,gBAAgB,EAAE,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,CAAC,MAAc;QACpB,OAAO,IAAI,CAAC,WAAW,CAAQ,GAAG,IAAI,CAAC,YAAY,UAAU,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,MAAc,EAAE,YAA0B,EAAE,UAAmB;QAC7E,OAAO,IAAI,CAAC,WAAW,CACrB,GAAG,IAAI,CAAC,YAAY,gBAAgB,EACpC;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;SAC3D,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,MAAuB;QAC9B,OAAO,IAAI,CAAC,WAAW,CACrB,GAAG,IAAI,CAAC,YAAY,WAAW,EAC/B;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;SAC7B,CACF,CAAC;IACJ,CAAC;IAED,iBAAiB;QACf,OAAO,IAAI,CAAC,WAAW,CAAgB,GAAG,IAAI,CAAC,YAAY,mBAAmB,CAAC,CAAC;IAClF,CAAC;IAED,kBAAkB,CAAC,cAAsB;QACvC,OAAO,IAAI,CAAC,WAAW,CACrB,GAAG,IAAI,CAAC,YAAY,kBAAkB,cAAc,SAAS,EAC7D,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,KAA2B;QACrC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,eAAe,CAAC,KAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC,WAAW,CAAa,GAAG,IAAI,CAAC,YAAY,YAAY,EAAE,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,WAAW,CAAW,GAAG,IAAI,CAAC,YAAY,aAAa,SAAS,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,cAAc,CAAC,IAAY,EAAE,MAAe;QAC1C,OAAO,IAAI,CAAC,WAAW,CACrB,GAAG,IAAI,CAAC,YAAY,mBAAmB,EACvC;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;SACvC,CACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"payments.js","sourceRoot":"","sources":["../src/payments.ts"],"names":[],"mappings":"AACA,OAAO,OAAO,MAAM,YAAY,CAAC;AAsCjC,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,OAAO;IACrC,YAAY,GAAG,MAAM,CAAC;IAE9B,YAAY,OAAwB;QAClC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;IAED,QAAQ,CAAC,KAA8B;QACrC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,eAAe,CAAC,KAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC,WAAW,CAAU,GAAG,IAAI,CAAC,YAAY,gBAAgB,EAAE,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,CAAC,MAAc;QACpB,OAAO,IAAI,CAAC,WAAW,CAAQ,GAAG,IAAI,CAAC,YAAY,UAAU,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,MAAc,EAAE,YAA0B,EAAE,UAAmB;QAC7E,OAAO,IAAI,CAAC,WAAW,CACrB,GAAG,IAAI,CAAC,YAAY,gBAAgB,EACpC;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;SAC3D,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,MAAuB;QAC9B,OAAO,IAAI,CAAC,WAAW,CACrB,GAAG,IAAI,CAAC,YAAY,WAAW,EAC/B;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;SAC7B,CACF,CAAC;IACJ,CAAC;IAED,iBAAiB;QACf,OAAO,IAAI,CAAC,WAAW,CAAgB,GAAG,IAAI,CAAC,YAAY,mBAAmB,CAAC,CAAC;IAClF,CAAC;IAED,kBAAkB,CAAC,cAAsB;QACvC,OAAO,IAAI,CAAC,WAAW,CACrB,GAAG,IAAI,CAAC,YAAY,kBAAkB,cAAc,SAAS,EAC7D,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,KAA2B;QACrC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,eAAe,CAAC,KAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC,WAAW,CAAa,GAAG,IAAI,CAAC,YAAY,YAAY,EAAE,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,WAAW,CAAW,GAAG,IAAI,CAAC,YAAY,aAAa,SAAS,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,cAAc,CAAC,IAAY,EAAE,MAAe;QAC1C,OAAO,IAAI,CAAC,WAAW,CACrB,GAAG,IAAI,CAAC,YAAY,mBAAmB,EACvC;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;SACvC,CACF,CAAC;IACJ,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qelos/sdk",
-  "version": "4.2.0",
+  "version": "4.2.2",
   "description": "SDK for Qelos API",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -102,7 +102,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@qelos/global-types": "^4.2.0"
+    "@qelos/global-types": "^4.2.2"
   },
   "devDependencies": {
     "tsx": "^4.21.0",

package/src/administrator/integrations.ts

@@ -38,6 +38,7 @@ export default class QlIntegrations extends BaseSDK {
     trigger?: any;
     target?: any;
     dataManipulation?: any;
+    targetManipulation?: any;
   }): Promise<IIntegration> {
     return this.callJsonApi<IIntegration>(
       `${this.relativePath}/${integrationId}`,
@@ -53,6 +54,7 @@ export default class QlIntegrations extends BaseSDK {
     trigger: any;
     target: any;
     dataManipulation?: any;
+    targetManipulation?: any;
     active?: boolean;
   }): Promise<IIntegration> {
     return this.callJsonApi<IIntegration>(this.relativePath, {

package/src/administrator/payments.ts

@@ -3,7 +3,7 @@ import BaseSDK from '../base-sdk';
 import {
   IPlan, ISubscription, IInvoice, ICoupon,
   BillableEntityType, SubscriptionStatus, InvoiceStatus, BillingCycle,
-  IPaymentsConfigurationMetadata,
+  IPaymentsConfigurationMetadata, CheckoutCustomer,
 } from '@qelos/global-types';
 
 export interface PaymentsConfigurationRecord {
@@ -28,6 +28,12 @@ export interface AdminCheckoutRequest {
    * use `setSubscriptionDynamicAmount()` + a separate `checkout()` call instead.
    */
   amount?: number;
+  /**
+   * Real-world identity of the billable entity. Passed through to the payment
+   * provider (e.g. Sumit) so it can create a properly-named customer record
+   * instead of falling back to the raw billable entity ID.
+   */
+  customer?: CheckoutCustomer;
 }
 
 export interface CreateSubscriptionData {

package/src/authentication.ts

@@ -1,6 +1,26 @@
 import { QelosSDKOptions } from './types';
 import BaseSDK from './base-sdk';
 import { decodeMeUser } from './services/decode-uri-fields';
+import {
+  buildMcpAuthorizePath,
+  buildMcpTokenExchangeBody,
+  type McpAuthorizeOptions,
+  type McpOAuthTokenResponse,
+  type McpTokenExchangeOptions,
+  type McpTokenExchangeResult,
+} from './mcp-auth';
+
+export type {
+  McpAuthorizeOptions,
+  McpCallbackInput,
+  McpCallbackParams,
+  McpTokenExchangeOptions,
+  McpTokenExchangeResult,
+  DecodedMcpOAuthStatePayload,
+  McpPagePathOptions,
+} from './mcp-auth';
+
+export { parseMcpCallbackParams } from './mcp-auth';
 
 export interface IUser {
   _id: string;
@@ -376,6 +396,50 @@ export default class QlAuthentication extends BaseSDK {
     return this.exchangeAuthCallback(refreshToken);
   }
 
+  getMcpAuthorizeUrl(options: McpAuthorizeOptions): string {
+    if (!options.redirectUri) {
+      throw new Error('redirectUri is required');
+    }
+    return this.buildUrl(buildMcpAuthorizePath(options));
+  }
+
+  async exchangeMcpAuthorizationCode(options: McpTokenExchangeOptions): Promise<McpTokenExchangeResult> {
+    const { code, redirectUri, codeVerifier } = options;
+    if (!code || !redirectUri || !codeVerifier) {
+      throw new Error('code, redirectUri, and codeVerifier are required');
+    }
+
+    const res = await this.callApi('/api/auth/mcp/token', {
+      method: 'post',
+      headers: { 'content-type': 'application/x-www-form-urlencoded' },
+      body: buildMcpTokenExchangeBody(options).toString(),
+    });
+
+    if (!res.ok) {
+      let detail = '';
+      try {
+        detail = (await res.text()).slice(0, 512);
+      } catch {
+        /* ignore */
+      }
+      throw new Error(
+        `failed to exchange MCP authorization code: HTTP ${res.status}${detail ? ` — ${detail}` : ''}`,
+      );
+    }
+
+    const body = (await res.json()) as McpOAuthTokenResponse;
+    this.#accessToken = body.access_token;
+    this.#refreshToken = body.refresh_token;
+
+    const user = await this.getLoggedInUser();
+    return {
+      accessToken: body.access_token,
+      refreshToken: body.refresh_token,
+      expiresIn: body.expires_in,
+      user,
+    };
+  }
+
   getLoggedInUser() {
     return this.callJsonApi<IUser>('/api/me').then(decodeMeUser);
   }

package/src/index.ts

@@ -16,6 +16,7 @@ const noExtraHeadersUrls = new Set([
   '/api/signin',
   '/api/signup',
   '/api/auth/callback',
+  '/api/auth/mcp/token',
 ])
 
 export type {
@@ -23,6 +24,13 @@ export type {
   SocialAuthCallbackPayload,
   SocialProvider,
   SocialLoginOptions,
+  McpAuthorizeOptions,
+  McpCallbackInput,
+  McpCallbackParams,
+  McpTokenExchangeOptions,
+  McpTokenExchangeResult,
+  DecodedMcpOAuthStatePayload,
+  McpPagePathOptions,
 } from './authentication';
 
 export type { BlueprintEntitiesRegistry } from './blueprints';
@@ -31,8 +39,20 @@ export {
   parseSocialCallbackRefreshToken,
   getSocialAuthSetCookieParts,
   applySocialAuthCookiesToServerResponse,
+  parseMcpCallbackParams,
 } from './authentication';
 
+export {
+  buildMcpAuthorizePath,
+  buildMcpAuthorizePathFromQuery,
+  buildMcpLoginRedirectUrl,
+  buildMcpConsentPageUrl,
+  resolveMcpLoginRedirect,
+  appendMcpAccessDeniedRedirect,
+  decodeMcpOAuthStatePayload,
+  buildMcpTokenExchangeBody,
+} from './mcp-auth';
+
 export default class QelosSDK extends BaseSDK {
   #customHeaders = {}
 

package/src/mcp-auth.ts

@@ -0,0 +1,293 @@
+import type { IUser } from './authentication';
+
+export interface McpAuthorizeOptions {
+  redirectUri: string;
+  state?: string;
+  codeChallenge?: string;
+  codeChallengeMethod?: string;
+  clientId?: string;
+}
+
+export interface McpTokenExchangeOptions {
+  code: string;
+  redirectUri: string;
+  codeVerifier: string;
+}
+
+export interface McpTokenExchangeResult {
+  accessToken: string;
+  refreshToken: string;
+  expiresIn: number;
+  user: IUser;
+}
+
+/** Callback URL or query bag from an MCP OAuth redirect. */
+export type McpCallbackInput =
+  | string
+  | URL
+  | URLSearchParams
+  | Record<string, string | string[] | undefined>;
+
+export interface McpCallbackParams {
+  code?: string;
+  state?: string;
+  error?: string;
+  errorDescription?: string;
+}
+
+/** Decoded MCP OAuth state JWT payload (display only — not verified). */
+export interface DecodedMcpOAuthStatePayload {
+  redirectUri?: string;
+  state?: string;
+  codeChallenge?: string;
+  codeChallengeMethod?: string;
+  tenant?: string;
+  clientId?: string;
+}
+
+export interface McpPagePathOptions {
+  loginPath?: string;
+  consentPath?: string;
+}
+
+function readQueryValue(
+  input: Record<string, string | string[] | undefined>,
+  key: string,
+): string | undefined {
+  const raw = input[key];
+  if (Array.isArray(raw)) {
+    return raw[0] && typeof raw[0] === 'string' ? raw[0] : undefined;
+  }
+  return typeof raw === 'string' ? raw : undefined;
+}
+
+function searchParamsFromString(input: string): URLSearchParams | undefined {
+  try {
+    const url = new URL(input);
+    if (url.search) {
+      return url.searchParams;
+    }
+    if (url.hash.length > 1) {
+      return new URLSearchParams(url.hash.slice(1));
+    }
+    return url.searchParams;
+  } catch {
+    const trimmed = input.trim();
+    if (!trimmed) {
+      return undefined;
+    }
+    const queryPart = trimmed.startsWith('?')
+      ? trimmed.slice(1)
+      : trimmed.startsWith('#')
+        ? trimmed.slice(1)
+        : trimmed.includes('=')
+          ? trimmed
+          : undefined;
+    return queryPart ? new URLSearchParams(queryPart) : undefined;
+  }
+}
+
+function searchParamsFromInput(input: McpCallbackInput): URLSearchParams | undefined {
+  if (input instanceof URLSearchParams) {
+    return input;
+  }
+  if (input instanceof URL) {
+    if (input.search.length > 1) {
+      return input.searchParams;
+    }
+    if (input.hash.length > 1) {
+      return new URLSearchParams(input.hash.slice(1));
+    }
+    return input.searchParams;
+  }
+  if (typeof input === 'string') {
+    return searchParamsFromString(input);
+  }
+
+  const params = new URLSearchParams();
+  const code = readQueryValue(input, 'code');
+  const state = readQueryValue(input, 'state');
+  const error = readQueryValue(input, 'error');
+  const errorDescription = readQueryValue(input, 'error_description');
+  if (code) params.set('code', code);
+  if (state) params.set('state', state);
+  if (error) params.set('error', error);
+  if (errorDescription) params.set('error_description', errorDescription);
+  return params.toString() ? params : undefined;
+}
+
+/**
+ * Parse authorization callback parameters from an MCP OAuth redirect.
+ * Accepts a full URL, {@link URL}, `URLSearchParams`, a query/fragment string,
+ * or a query object such as `req.query` from Next.js or Express.
+ */
+export function parseMcpCallbackParams(input: McpCallbackInput): McpCallbackParams {
+  const params = searchParamsFromInput(input);
+  if (!params) {
+    return {};
+  }
+
+  const result: McpCallbackParams = {};
+  const code = params.get('code');
+  const state = params.get('state');
+  const error = params.get('error');
+  const errorDescription = params.get('error_description');
+  if (code) result.code = code;
+  if (state) result.state = state;
+  if (error) result.error = error;
+  if (errorDescription) result.errorDescription = errorDescription;
+  return result;
+}
+
+/** Relative authorize path with query string for {@link QlAuthentication.getMcpAuthorizeUrl}. */
+export function buildMcpAuthorizePath(options: McpAuthorizeOptions): string {
+  const search = new URLSearchParams({ redirect_uri: options.redirectUri });
+  if (options.state) search.set('state', options.state);
+  if (options.codeChallenge) search.set('code_challenge', options.codeChallenge);
+  if (options.codeChallengeMethod) search.set('code_challenge_method', options.codeChallengeMethod);
+  if (options.clientId) search.set('client_id', options.clientId);
+  return `/api/auth/mcp/authorize?${search.toString()}`;
+}
+
+/**
+ * Build `/api/auth/mcp/authorize?…` from OAuth authorize query params
+ * (e.g. when `/mcp/authorize` receives a direct client redirect).
+ */
+export function buildMcpAuthorizePathFromQuery(
+  query: Record<string, string | string[] | undefined>,
+): string | null {
+  const redirectUri = readQueryValue(query, 'redirect_uri');
+  if (!redirectUri) {
+    return null;
+  }
+
+  const options: McpAuthorizeOptions = { redirectUri };
+  const state = readQueryValue(query, 'state');
+  const codeChallenge = readQueryValue(query, 'code_challenge');
+  const codeChallengeMethod = readQueryValue(query, 'code_challenge_method');
+  const clientId = readQueryValue(query, 'client_id');
+  if (state) options.state = state;
+  if (codeChallenge) options.codeChallenge = codeChallenge;
+  if (codeChallengeMethod) options.codeChallengeMethod = codeChallengeMethod;
+  if (clientId) options.clientId = clientId;
+  return buildMcpAuthorizePath(options);
+}
+
+/** Login redirect used by Qelos after an unauthenticated MCP authorize request. */
+export function buildMcpLoginRedirectUrl(
+  authorizePath: string,
+  options?: Pick<McpPagePathOptions, 'loginPath'>,
+): string {
+  const loginPath = options?.loginPath ?? '/login';
+  return `${loginPath}?redirect=${encodeURIComponent(authorizePath)}`;
+}
+
+/** Consent page URL issued after the user signs in during MCP OAuth. */
+export function buildMcpConsentPageUrl(
+  mcpState: string,
+  options?: Pick<McpPagePathOptions, 'consentPath'>,
+): string {
+  const consentPath = options?.consentPath ?? '/mcp/authorize';
+  return `${consentPath}?mcp_state=${encodeURIComponent(mcpState)}`;
+}
+
+/**
+ * Resolve the post-login redirect target from login-page query params.
+ * Matches the resume logic used by the Qelos admin login flow.
+ */
+export function resolveMcpLoginRedirect(
+  query: Record<string, string | string[] | undefined>,
+  options?: McpPagePathOptions,
+): string | null {
+  const redirect = readQueryValue(query, 'redirect');
+  if (redirect) {
+    return redirect;
+  }
+
+  const mcpState = readQueryValue(query, 'mcp_state');
+  if (mcpState) {
+    return buildMcpConsentPageUrl(mcpState, options);
+  }
+
+  return buildMcpAuthorizePathFromQuery(query);
+}
+
+/** Redirect URI with `error=access_denied` for MCP consent denial. */
+export function appendMcpAccessDeniedRedirect(
+  redirectUri: string,
+  oauthState?: string | null,
+): string {
+  try {
+    const url = new URL(redirectUri);
+    url.searchParams.set('error', 'access_denied');
+    if (oauthState) {
+      url.searchParams.set('state', oauthState);
+    }
+    return url.toString();
+  } catch {
+    const separator = redirectUri.includes('?') ? '&' : '?';
+    let result = `${redirectUri}${separator}error=access_denied`;
+    if (oauthState) {
+      result += `&state=${encodeURIComponent(oauthState)}`;
+    }
+    return result;
+  }
+}
+
+/**
+ * Decode the signed `mcp_state` JWT payload for display on a consent page.
+ * Does not verify the signature — use only for UI labels, not authorization.
+ */
+export function decodeMcpOAuthStatePayload(mcpState: string): DecodedMcpOAuthStatePayload | null {
+  if (!mcpState) {
+    return null;
+  }
+
+  try {
+    const parts = mcpState.split('.');
+    if (parts.length !== 3 || !parts[1]) {
+      return null;
+    }
+
+    const base64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+    const json =
+      typeof globalThis.atob === 'function'
+        ? globalThis.atob(base64)
+        : Buffer.from(base64, 'base64').toString('utf8');
+    const decoded = JSON.parse(json) as {
+      ru?: string;
+      s?: string;
+      cc?: string;
+      ccm?: string;
+      t?: string;
+      cid?: string;
+    };
+
+    const payload: DecodedMcpOAuthStatePayload = {};
+    if (decoded.ru) payload.redirectUri = decoded.ru;
+    if (decoded.s) payload.state = decoded.s;
+    if (decoded.cc) payload.codeChallenge = decoded.cc;
+    if (decoded.ccm) payload.codeChallengeMethod = decoded.ccm;
+    if (decoded.t) payload.tenant = decoded.t;
+    if (decoded.cid) payload.clientId = decoded.cid;
+    return payload.redirectUri ? payload : null;
+  } catch {
+    return null;
+  }
+}
+
+export interface McpOAuthTokenResponse {
+  access_token: string;
+  refresh_token: string;
+  token_type: string;
+  expires_in: number;
+}
+
+export function buildMcpTokenExchangeBody(options: McpTokenExchangeOptions): URLSearchParams {
+  return new URLSearchParams({
+    grant_type: 'authorization_code',
+    code: options.code,
+    redirect_uri: options.redirectUri,
+    code_verifier: options.codeVerifier,
+  });
+}

package/src/payments.ts

@@ -1,6 +1,6 @@
 import { QelosSDKOptions } from './types';
 import BaseSDK from './base-sdk';
-import { IPlan, ISubscription, IInvoice, ICoupon, BillingCycle } from '@qelos/global-types';
+import { IPlan, ISubscription, IInvoice, ICoupon, BillingCycle, CheckoutCustomer } from '@qelos/global-types';
 
 export interface CheckoutRequest {
   /** Required when not providing `subscriptionId`. Must be a non-dynamic plan. */
@@ -10,6 +10,12 @@ export interface CheckoutRequest {
   couponCode?: string;
   successUrl?: string;
   cancelUrl?: string;
+  /**
+   * Real-world identity of the billable entity. Passed through to the payment
+   * provider (e.g. Sumit) so it can create a properly-named customer record
+   * instead of falling back to the raw billable entity ID.
+   */
+  customer?: CheckoutCustomer;
   /**
    * When true, cancels any existing active or trialing subscription for the
    * authenticated billable entity before starting checkout (e.g. plan change).