What happened
PR #23 fixed the A2A, OpenAI-compat, and Vercel adapters, which were constructing new VoidlyPay({ baseUrl, signingSecretKey }) — option names the SDK ignores (it reads apiBase/apiUrl and secretBase64/secretKey). Result: the BYO signing key was dropped and paid/signed calls failed.
Why CI didn't catch it
voidly-pay-smoke-tests.yml only runs on pull_request for paths agent-sdk/** — so changes under adapters/** never trigger CI.
- The
.js adapters aren't type-checked, and the Vercel adapter used an as any cast that suppressed the type error.
Proposed fix
This is the actual hole that let a broken-payments-path change ship silently. Low effort, high value.
What happened
PR #23 fixed the A2A, OpenAI-compat, and Vercel adapters, which were constructing
new VoidlyPay({ baseUrl, signingSecretKey })— option names the SDK ignores (it readsapiBase/apiUrlandsecretBase64/secretKey). Result: the BYO signing key was dropped and paid/signed calls failed.Why CI didn't catch it
voidly-pay-smoke-tests.ymlonly runs onpull_requestfor pathsagent-sdk/**— so changes underadapters/**never trigger CI..jsadapters aren't type-checked, and the Vercel adapter used anas anycast that suppressed the type error.Proposed fix
adapters/**to the smoke-testspull_requestpath filter.tsc --noEmitonadapters/vercel-ai) and a lint rule against strayas anyin adapter SDK construction.VoidlyPaywith config keys that exist onVoidlyPayConfig(guards against option-name drift).This is the actual hole that let a broken-payments-path change ship silently. Low effort, high value.