@canopypay/checkout-sdk 0.2.0 → 0.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/dist/index.d.cts +8 -37
  2. package/dist/index.d.ts +8 -37
  3. package/package.json +3 -2
package/dist/index.d.cts CHANGED
@@ -1,7 +1,7 @@
1
1
  /**
2
- * Canopy checkout SDK loader (Phase 23 Plan 08, SDK-01 / SDK-04 / API-03).
2
+ * Canopy checkout SDK loader.
3
3
  *
4
- * The whole merchant integration, measured (`sdk-loader-contract.md`):
4
+ * The whole merchant integration:
5
5
  *
6
6
  * ```html
7
7
  * <script src="https://canopy.example/v1/canopy.js"></script>
@@ -13,7 +13,7 @@
13
13
  * capability,
14
14
  * merchant: "cnpy_pk_live_abc123",
15
15
  * onEvent: (e) => {
16
- * // SDK-04: `paid` is advisory only -- it drives UI, never fulfilment.
16
+ * // `paid` is advisory only -- it drives UI, never fulfilment.
17
17
  * // Fulfilment reads a webhook or a server-side status call.
18
18
  * if (e.type === "paid") showBanner("Payment sent — we'll confirm shortly");
19
19
  * },
@@ -29,25 +29,7 @@
29
29
  *
30
30
  * One entry point (`mount`), one option surface (`surface: "popup" | "iframe"
31
31
  * | "auto"`, default `"popup"`), seven events (`ready`, `resize`, `paid`,
32
- * `error`, `close`, `surface_unavailable`, `fallback_offered`). See
33
- * `.claude/skills/spike-findings-Canopy/references/sdk-loader-contract.md`
34
- * and `.claude/skills/spike-findings-Canopy/references/embed-surface-selection.md`
35
- * for the full contract this file implements.
36
- *
37
- * Bump LOADER_VERSION whenever this file's runtime behaviour changes.
38
- * `scripts/build-checkout-sdk.ts` extracts this exact literal by regex from
39
- * this source file (not the built bundle) so the immutable serving path
40
- * (`/v1/{version}/canopy.js`) and this loader's own `Canopy.__version`
41
- * self-report are always the same value by construction.
42
- *
43
- * Phase 31 Plan 02 (DIST-01, DIST-04): the five types below are hoisted
44
- * above the IIFE and `export type`-ed so `packages/checkout-sdk/src/index.ts`
45
- * (the npm entry) can re-export a real merchant-facing surface instead of
46
- * shipping a 13-byte `export { }` declaration file. This is byte-safe --
47
- * type-only exports are erased before esbuild picks its format wrapper, so
48
- * the IIFE build this script tag serves is unaffected (verified sha
49
- * `644fbe336e875f4f` both ways, spike 100 exp2/exp3). `Internal` stays
50
- * inside the IIFE: it is not part of the merchant-facing surface.
32
+ * `error`, `close`, `surface_unavailable`, `fallback_offered`).
51
33
  */
52
34
  type CanopyEventType = "ready" | "resize" | "paid" | "error" | "close" | "surface_unavailable" | "fallback_offered";
53
35
  type CanopyEvent = {
@@ -64,14 +46,14 @@ type MountOptions = {
64
46
  handshakeTimeoutMs?: number;
65
47
  fallbackLabel?: string;
66
48
  /**
67
- * Phase 31 Plan 05 (DIST-02): the Canopy origin `mount()` builds the
68
- * checkout URL against and pins the `postMessage` listener to. A
49
+ * The Canopy origin `mount()` builds the checkout URL against and pins
50
+ * the `postMessage` listener to. A
69
51
  * `<script src="https://.../v1/canopy.js">` tag can be discovered
70
52
  * automatically; a bundled npm consumer has no such tag, so it MUST state
71
53
  * this explicitly or `mount()` refuses with `canopy_origin_undiscoverable`.
72
54
  * There is no default -- baking one in would turn that loud, diagnosable
73
55
  * refusal into a silent wrong-origin checkout for every sandbox or
74
- * self-hosted integration (31-RESEARCH.md Pitfall 5). Must be a bare
56
+ * self-hosted integration. Must be a bare
75
57
  * origin (no path, search, or hash) and `https`, except for the
76
58
  * `localhost` / `127.0.0.1` development affordance. Wins over a present
77
59
  * script tag when both are available.
@@ -83,18 +65,7 @@ type CanopyHandle = {
83
65
  destroy: () => void;
84
66
  };
85
67
 
86
- /**
87
- * Canopy checkout SDK npm entry (Phase 31 Plan 02, DIST-01 / DIST-04).
88
- *
89
- * This is the `npm i @canopypay/checkout-sdk` consumer surface -- it delegates
90
- * to `./loader`'s IIFE (imported here for its side effect of installing
91
- * `window.Canopy`) rather than re-implementing `mount()`. A second
92
- * implementation of the security-relevant origin pinning and the
93
- * publishable-key prefix check would fork exactly the mechanism DIST-01
94
- * exists to keep singular. See
95
- * `.claude/skills/spike-findings-Canopy/references/sdk-package-distribution.md`
96
- * § "How to Build It" step 2 for the verified shape this file follows.
97
- */
68
+ /** Canopy checkout SDK -- the `npm i @canopypay/checkout-sdk` entry point. */
98
69
 
99
70
  declare global {
100
71
  interface Window {
package/dist/index.d.ts CHANGED
@@ -1,7 +1,7 @@
1
1
  /**
2
- * Canopy checkout SDK loader (Phase 23 Plan 08, SDK-01 / SDK-04 / API-03).
2
+ * Canopy checkout SDK loader.
3
3
  *
4
- * The whole merchant integration, measured (`sdk-loader-contract.md`):
4
+ * The whole merchant integration:
5
5
  *
6
6
  * ```html
7
7
  * <script src="https://canopy.example/v1/canopy.js"></script>
@@ -13,7 +13,7 @@
13
13
  * capability,
14
14
  * merchant: "cnpy_pk_live_abc123",
15
15
  * onEvent: (e) => {
16
- * // SDK-04: `paid` is advisory only -- it drives UI, never fulfilment.
16
+ * // `paid` is advisory only -- it drives UI, never fulfilment.
17
17
  * // Fulfilment reads a webhook or a server-side status call.
18
18
  * if (e.type === "paid") showBanner("Payment sent — we'll confirm shortly");
19
19
  * },
@@ -29,25 +29,7 @@
29
29
  *
30
30
  * One entry point (`mount`), one option surface (`surface: "popup" | "iframe"
31
31
  * | "auto"`, default `"popup"`), seven events (`ready`, `resize`, `paid`,
32
- * `error`, `close`, `surface_unavailable`, `fallback_offered`). See
33
- * `.claude/skills/spike-findings-Canopy/references/sdk-loader-contract.md`
34
- * and `.claude/skills/spike-findings-Canopy/references/embed-surface-selection.md`
35
- * for the full contract this file implements.
36
- *
37
- * Bump LOADER_VERSION whenever this file's runtime behaviour changes.
38
- * `scripts/build-checkout-sdk.ts` extracts this exact literal by regex from
39
- * this source file (not the built bundle) so the immutable serving path
40
- * (`/v1/{version}/canopy.js`) and this loader's own `Canopy.__version`
41
- * self-report are always the same value by construction.
42
- *
43
- * Phase 31 Plan 02 (DIST-01, DIST-04): the five types below are hoisted
44
- * above the IIFE and `export type`-ed so `packages/checkout-sdk/src/index.ts`
45
- * (the npm entry) can re-export a real merchant-facing surface instead of
46
- * shipping a 13-byte `export { }` declaration file. This is byte-safe --
47
- * type-only exports are erased before esbuild picks its format wrapper, so
48
- * the IIFE build this script tag serves is unaffected (verified sha
49
- * `644fbe336e875f4f` both ways, spike 100 exp2/exp3). `Internal` stays
50
- * inside the IIFE: it is not part of the merchant-facing surface.
32
+ * `error`, `close`, `surface_unavailable`, `fallback_offered`).
51
33
  */
52
34
  type CanopyEventType = "ready" | "resize" | "paid" | "error" | "close" | "surface_unavailable" | "fallback_offered";
53
35
  type CanopyEvent = {
@@ -64,14 +46,14 @@ type MountOptions = {
64
46
  handshakeTimeoutMs?: number;
65
47
  fallbackLabel?: string;
66
48
  /**
67
- * Phase 31 Plan 05 (DIST-02): the Canopy origin `mount()` builds the
68
- * checkout URL against and pins the `postMessage` listener to. A
49
+ * The Canopy origin `mount()` builds the checkout URL against and pins
50
+ * the `postMessage` listener to. A
69
51
  * `<script src="https://.../v1/canopy.js">` tag can be discovered
70
52
  * automatically; a bundled npm consumer has no such tag, so it MUST state
71
53
  * this explicitly or `mount()` refuses with `canopy_origin_undiscoverable`.
72
54
  * There is no default -- baking one in would turn that loud, diagnosable
73
55
  * refusal into a silent wrong-origin checkout for every sandbox or
74
- * self-hosted integration (31-RESEARCH.md Pitfall 5). Must be a bare
56
+ * self-hosted integration. Must be a bare
75
57
  * origin (no path, search, or hash) and `https`, except for the
76
58
  * `localhost` / `127.0.0.1` development affordance. Wins over a present
77
59
  * script tag when both are available.
@@ -83,18 +65,7 @@ type CanopyHandle = {
83
65
  destroy: () => void;
84
66
  };
85
67
 
86
- /**
87
- * Canopy checkout SDK npm entry (Phase 31 Plan 02, DIST-01 / DIST-04).
88
- *
89
- * This is the `npm i @canopypay/checkout-sdk` consumer surface -- it delegates
90
- * to `./loader`'s IIFE (imported here for its side effect of installing
91
- * `window.Canopy`) rather than re-implementing `mount()`. A second
92
- * implementation of the security-relevant origin pinning and the
93
- * publishable-key prefix check would fork exactly the mechanism DIST-01
94
- * exists to keep singular. See
95
- * `.claude/skills/spike-findings-Canopy/references/sdk-package-distribution.md`
96
- * § "How to Build It" step 2 for the verified shape this file follows.
97
- */
68
+ /** Canopy checkout SDK -- the `npm i @canopypay/checkout-sdk` entry point. */
98
69
 
99
70
  declare global {
100
71
  interface Window {
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@canopypay/checkout-sdk",
3
3
  "private": false,
4
- "version": "0.2.0",
4
+ "version": "0.2.1",
5
5
  "type": "module",
6
6
  "main": "./dist/index.cjs",
7
7
  "module": "./dist/index.js",
@@ -26,7 +26,8 @@
26
26
  ],
27
27
  "scripts": {
28
28
  "build": "tsup --config tsup.config.ts",
29
- "build:npm": "tsup --config tsup.npm.config.ts"
29
+ "build:npm": "tsup --config tsup.npm.config.ts",
30
+ "prepublishOnly": "npm --prefix ../.. run sdk:build && npm run build:npm"
30
31
  },
31
32
  "canopy": {
32
33
  "loaderVersion": "2",