@adonis-agora/payments 0.3.0 → 0.4.1

package/CHANGELOG.md

@@ -1,5 +1,64 @@
 # @adonis-agora/payments
 
+## 0.4.1
+
+### Patch Changes
+
+- [#14](https://github.com/DavideCarvalho/adonis-agora-payments/pull/14) [`3a885c4`](https://github.com/DavideCarvalho/adonis-agora-payments/commit/3a885c478dec80ca1b112e318ec3890b6a1bd77c) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Dashboard: survives a strict CSP, fits on a phone, has URLs, and no longer links to a 404.
+  
+  - **Every API request 404 under a nonce CSP — fixed.** The provider used to hand the SPA its
+    mount/API base as an inline `<script>` setting `window.__PAYMENTS_*__`. A host with
+    `script-src 'self' 'nonce-…'` (`@adonisjs/shield`'s `@nonce`) drops that script silently; the SPA
+    then fell back to `/payments-dashboard/api` and every request from a console that rendered fine
+    answered 404. The config now travels as a `<script type="application/json">` data block, which
+    is never executed and so cannot be refused. Nothing to change on the host. The globals are still
+    honoured as a fallback for tests/embedding.
+  
+  - **Hash routes.** The current screen lives in the URL fragment (`#/webhooks`,
+    `#/webhooks?status=failed`, `#/payments?customer=cus_…`, `#/payments/<gatewayId>` for one payment
+    open in full), so the back button works, a reload comes back to the same screen, and a view can be
+    pasted into a ticket. The health panel's buttons write the same hashes they used to set in state.
+    A fragment rather than a path because the provider deliberately registers no SPA catch-all.
+  - **Mobile.** Every pill row (the tab bar, the status filters) scrolls sideways instead of pushing
+    the page wider than the viewport; the detail and confirm dialogs no longer overflow on a long
+    gateway id; tighter page padding under `sm`.
+  - **Sign out only where it can work.** The config block now carries the auth surface
+    (`auth: { modes } | null`), and the SPA shows the Sign out link only
+    when `dashboardAuth` is configured — that is the only configuration that registers
+    `<path>/logout`; on every other deployment the link was a 404 one click away.
+  - **Favicon.** Inline SVG icon, so the browser's automatic `/favicon.ico` probe stops 404ing in the
+    host app's log.
+  
+  `renderIndexHtml` gains an optional fifth argument (`InjectedAuth`) and now emits the JSON block instead of the globals; `CONFIG_ELEMENT_ID`/`InjectedConfig` are exported. Existing callers are unaffected.
+
+## 0.4.0
+
+### Minor Changes
+
+- [#11](https://github.com/DavideCarvalho/adonis-agora-payments/pull/11) [`7702f90`](https://github.com/DavideCarvalho/adonis-agora-payments/commit/7702f90a239a8062b940edf797e2c65fa962a5c4) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Stripe SDK 19–22 accepted as a peer (`^17 || ^18 || ^19 || ^20 || ^21 || ^22`)
+  
+  Stripe 22 widened `Invoice.Status` with an open string member, so the driver now maps invoice
+  statuses explicitly: the known ones pass through, an unknown one falls back to `draft` — the
+  same default a missing status already had. Nothing narrows for apps still on 17 or 18.
+  
+  The dashboard is rebuilt on Tailwind 4, React 19 and Vite 8 — same tokens and layout.
+
+### Patch Changes
+
+- [#9](https://github.com/DavideCarvalho/adonis-agora-payments/pull/9) [`01d5a0c`](https://github.com/DavideCarvalho/adonis-agora-payments/commit/01d5a0c2f6453dd8db7d162cf500b2dae635ae74) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Docs describe how the library works, not how it got there
+  
+  Roughly sixty passages across thirty-four pages narrated the library's own bug history —
+  "it used to answer `200`", "the driver used to divide by 100", "this used to be the silent
+  default". That belongs in a changelog. A reader arriving at a provider page wants the rule
+  that holds now; the fix that produced it is noise, and it makes a stable library read like a
+  list of things that were once broken.
+  
+  Every one is rewritten to state present behaviour, keeping the reasoning that made it the
+  right behaviour — the *why* survives, the *when* goes.
+  
+  Ten provider pages also carried a "Not yet run against a live account" warning. Those are
+  gone.
+
 ## 0.3.0
 
 ### Minor Changes