@chaindaddy/js 0.2.0 → 0.3.0

package/dist/api.d.ts

@@ -864,6 +864,72 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v2/iap/checkout/sessions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Open a checkout session
+         * @description Take a payment for your coin's store on your own website. Your server calls this with a store key
+         *     (scope `orders:write`) and gets back `url`: send the buyer there with a plain link or a redirect. The
+         *     buyer pays on chaindaddy.io and returns to `successUrl`, or to `cancelUrl` if they leave.
+         *
+         *     A session sells one item (`lineItems` takes exactly one entry). The price, the fee and where the money
+         *     goes are the item's own, exactly as when it is bought on chaindaddy.io: a session changes none of them.
+         *
+         *     `successUrl` and `cancelUrl` must be `https` pages on one of the coin's verified sites, or a subdomain of
+         *     one (400 `RETURN_URL_NOT_VERIFIED`, which lists the sites that pass). The wallet that opened the store
+         *     must have signed the Seller Terms (403 `SELLER_TERMS_REQUIRED`). An item that belongs to an installed app
+         *     cannot be sold through a session (409 `SKU_NOT_FOR_SALE`).
+         *
+         *     Send an `Idempotency-Key`. A retry of the same request returns the session it opened, with status 200
+         *     and the header `Idempotent-Replayed: true`.
+         *
+         *     Learn that the session was paid from the `iap.order.confirmed` webhook (its payload carries
+         *     `checkoutSessionId`), or by reading the session. Never from the buyer arriving on `successUrl`.
+         *
+         *     Answers 404 `CHECKOUT_SESSIONS_DISABLED` where checkout sessions are not switched on, or are open to
+         *     test stores only and the key is a live store's. `GET /api/v2/iap/config` says which (`checkoutSessions`).
+         *     Guide: https://docs.chaindaddy.io/developer/take-payments-on-your-site
+         */
+        post: operations["createIapCheckoutSession"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v2/iap/checkout/sessions/{sessionId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The checkout session's id, `cs_` followed by 48 hex characters */
+                sessionId: components["parameters"]["IapCheckoutSessionId"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Get a checkout session
+         * @description Your server reads a session it opened, with a store key of the same store (scope `orders:read`).
+         *     `status` is `open`, `complete` once the buyer's payment is confirmed, or `expired`. `order` is the order
+         *     that paid it (or the buyer's latest attempt while it is open), and `receipt` is that order's signed
+         *     receipt once the session is complete. A key of any other store gets 404.
+         */
+        get: operations["getIapCheckoutSession"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v2/iap/checkout/sessions/{sessionId}/public": {
         parameters: {
             query?: never;
@@ -882,6 +948,10 @@ export interface paths {
          *
          *     Pass `origin` to learn whether a page on that origin may open this checkout in a popup
          *     (`openerAllowed`): it must be `https` on one of the coin's verified sites.
+         *
+         *     `returnAllowed` says whether the buyer may still be sent to `successUrl` and `cancelUrl`. It is checked
+         *     again on every read, so a coin whose site stopped being verified after the session was opened no longer
+         *     gets its buyers sent there; the pay page then shows the result itself.
          */
         get: operations["getIapPublicCheckoutSession"];
         put?: never;
@@ -1852,6 +1922,46 @@ export interface components {
             wallet?: string;
             entitlements?: components["schemas"]["IapEntitlement"][];
         };
+        /** @description A checkout session, as the store's own server sees it */
+        IapCheckoutSession: {
+            /** @description `cs_` followed by 48 hex characters */
+            id?: string;
+            /**
+             * @description The page the buyer pays on. Link or redirect the buyer to it
+             * @example https://chaindaddy.io/_pay/cs_0f3a9c1e5b7d2a4c6e8f0b1d3a5c7e9f1b3d5a7c9e0f2a4c
+             */
+            url?: string;
+            /**
+             * @description `complete` once the payment is confirmed; `expired` when it was not paid by `expiresAt`
+             * @enum {string}
+             */
+            status?: "open" | "complete" | "expired";
+            /** @description False for a test store's session */
+            livemode?: boolean;
+            /** Format: date-time */
+            expiresAt?: string;
+            /** Format: date-time */
+            completedAt?: string | null;
+            /** Format: date-time */
+            createdAt?: string;
+            storeId?: string;
+            lineItems?: {
+                sku?: string;
+                quantity?: number;
+            }[];
+            successUrl?: string;
+            cancelUrl?: string;
+            clientReferenceId?: string | null;
+            metadata?: {
+                [key: string]: unknown;
+            };
+            /** @description The only wallet that can pay, when the session names one */
+            wallet?: string | null;
+            /** @description The order that paid the session, or the buyer's latest attempt while it is open; null until the buyer starts paying */
+            order?: components["schemas"]["IapOrder"] | null;
+            /** @description The paying order's signed receipt (a JWS), once the session is complete */
+            receipt?: string | null;
+        };
         /** @description A checkout session, as the buyer's pay page sees it. Never carries `metadata` or `clientReferenceId` */
         IapPublicCheckoutSession: {
             id?: string;
@@ -1869,6 +1979,11 @@ export interface components {
             wallet?: string | null;
             /** @description Whether a page on the `origin` passed may open this checkout in a popup. False when no `origin` is passed */
             openerAllowed?: boolean;
+            /**
+             * @description Whether `successUrl` and `cancelUrl` are both still on the coin's verified sites, as of this read.
+             *     When false the buyer is not sent to either
+             */
+            returnAllowed?: boolean;
         };
         IapSkuOwners: {
             entries?: {
@@ -4256,7 +4371,9 @@ export interface operations {
                     /**
                      * @description The checkout session the buyer is paying. A buyer's session only: a store key gets 403
                      *     `SESSION_REQUIRED`. 409 `CHECKOUT_SESSION_EXPIRED` or `CHECKOUT_SESSION_COMPLETE` when the
-                     *     session can no longer be paid; 403 `CHECKOUT_SESSION_WALLET` when it names another wallet
+                     *     session can no longer be paid; 403 `CHECKOUT_SESSION_WALLET` when it names another wallet.
+                     *     A session takes one buyer at a time: 409 `CHECKOUT_SESSION_IN_USE` while another wallet has
+                     *     an order for it that can still be paid, or is paid and being confirmed
                      */
                     checkoutSessionId?: string;
                     /** @description Required with a store key; the wallet that receives the items */
@@ -4367,6 +4484,186 @@ export interface operations {
             404: components["responses"]["IapNotFound"];
         };
     };
+    createIapCheckoutSession: {
+        parameters: {
+            query?: never;
+            header?: {
+                /**
+                 * @description Send a unique value (a UUID) with every POST. Retrying with the same key returns the first result
+                 *     and never sells, grants or consumes twice.
+                 */
+                "Idempotency-Key"?: components["parameters"]["IdempotencyKey"];
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description What is sold. Exactly one item */
+                    lineItems: {
+                        /** @description The item's SKU key in your store */
+                        sku: string;
+                        /** @default 1 */
+                        quantity?: number;
+                    }[];
+                    /**
+                     * Format: uri
+                     * @description Where the buyer returns after paying. `https`, on one of the coin's verified sites
+                     */
+                    successUrl: string;
+                    /**
+                     * Format: uri
+                     * @description Where the buyer returns if they leave without paying. Same rule as `successUrl`
+                     */
+                    cancelUrl: string;
+                    /**
+                     * @description Your own id for this checkout (a cart or user id). Echoed as `appAccountToken` on the order,
+                     *     its events and its receipt, which the buyer can read: a reference, not a secret
+                     */
+                    clientReferenceId?: string;
+                    /** @description Your own data, returned when you read the session. At most 20 keys and 4 KB. Never shown to the buyer */
+                    metadata?: {
+                        [key: string]: unknown;
+                    };
+                    /** @description When set, only this wallet can pay the session. An address on the store's chain */
+                    wallet?: string;
+                    /**
+                     * @description How long the session can be paid
+                     * @default 3600
+                     */
+                    expiresInSeconds?: number;
+                };
+            };
+        };
+        responses: {
+            /** @description A retry of a request already made under this `Idempotency-Key`; the session it opened */
+            200: {
+                headers: {
+                    "Idempotent-Replayed"?: "true";
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapCheckoutSession"];
+                };
+            };
+            /** @description The session. Send the buyer to `url` */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapCheckoutSession"];
+                };
+            };
+            /**
+             * @description `INVALID_REQUEST`, `IDEMPOTENCY_KEY_REQUIRED`, or `RETURN_URL_NOT_VERIFIED`: a return URL is not an
+             *     `https` page on one of the coin's verified sites
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+            /** @description No store key, or one that is unknown or revoked (`INVALID_STORE_KEY`) */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+            /**
+             * @description `STORE_KEY_REQUIRED`: called with a signed-in session instead of a store key. `SCOPE_REQUIRED`: the key
+             *     lacks `orders:write`. `STORE_NOT_LIVE`: the store is paused or its plan lapsed. `SELLER_TERMS_REQUIRED`:
+             *     the wallet that opened the store has not signed the Seller Terms
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+            /** @description `SKU_NOT_FOR_SALE`: no such item in the store. `CHECKOUT_SESSIONS_DISABLED`: not switched on here */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+            /** @description `SKU_NOT_FOR_SALE`: the item is archived, has no price, is an unlock, or belongs to an installed app */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+            /**
+             * @description `IDEMPOTENCY_KEY_REUSED`: this `Idempotency-Key` already opened a session for a different request.
+             *     Nothing is returned or created; use a new key for a new session
+             */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+        };
+    };
+    getIapCheckoutSession: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The checkout session's id, `cs_` followed by 48 hex characters */
+                sessionId: components["parameters"]["IapCheckoutSessionId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The session */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapCheckoutSession"];
+                };
+            };
+            /** @description No store key, or one that is unknown or revoked */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+            /** @description `STORE_KEY_REQUIRED` (a signed-in session instead of a store key) or `SCOPE_REQUIRED` (the key lacks `orders:read`) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+            404: components["responses"]["IapNotFound"];
+        };
+    };
     getIapPublicCheckoutSession: {
         parameters: {
             query?: {

package/dist/cd.js

@@ -1,4 +1,4 @@
-"use strict";(()=>{var w="0.2.0";function b(t){let e="";for(let i of t)e+=String.fromCharCode(i);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function g(){return b(crypto.getRandomValues(new Uint8Array(32)))}function v(t,e,i,s){let c=a=>{if(a&&typeof a=="object"&&a.type===t)try{i(a)}catch{}},u=a=>{a.origin===e&&c(a.data)};window.addEventListener("message",u);let d=null;if(s&&typeof BroadcastChannel=="function"&&e===location.origin)try{d=new BroadcastChannel(s),d.onmessage=a=>c(a.data)}catch{d=null}return()=>{window.removeEventListener("message",u),d?.close()}}var h={get(t){try{return sessionStorage.getItem(t)}catch{return null}},set(t,e){try{sessionStorage.setItem(t,e)}catch{}},remove(t){try{sessionStorage.removeItem(t)}catch{}}};var A="https://api.chaindaddy.io",T={"https://api.chaindaddy.io":"https://chaindaddy.io/_oauth/authorize","https://staging-api.chaindaddy.io":"https://staging.chaindaddy.io/_oauth/authorize"},p="cd-signin",E="cd:signin",m="cd.signin";async function U(t){let e=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(t));return b(new Uint8Array(e))}function M(t="openid"){let e=t.split(/\s+/).filter(Boolean);return(e.includes("openid")?e:["openid",...e]).join(" ")}async function L(t,e,i){let s=new URLSearchParams({response_type:"code",client_id:e.clientId,redirect_uri:e.redirectUri,scope:M(t.scope),state:e.state,nonce:e.nonce,code_challenge:await U(e.verifier),code_challenge_method:"S256"});return t.claims&&s.set("claims",typeof t.claims=="string"?t.claims:JSON.stringify(t.claims)),`${i}?${s}`}function x(t,e){return{code:e,codeVerifier:t.verifier,state:t.state,nonce:t.nonce,issuer:t.issuer,clientId:t.clientId,redirectUri:t.redirectUri}}function f(t){let e=(t.issuer??A).replace(/\/$/,""),i=t.authorizeUrl??T[e];if(!i)return Promise.reject(new Error("authorizeUrl is required for this issuer"));if(!t.clientId||!t.redirectUri)return Promise.reject(new Error("clientId and redirectUri are required"));let s={state:g(),nonce:g(),verifier:g(),issuer:e,clientId:t.clientId,redirectUri:t.redirectUri};h.set(m,JSON.stringify(s));let c=window.open("",p,"popup,width=480,height=720");return(async()=>{let u=await L(t,s,i);if(!c)return location.assign(u),null;c.location.href=u;let d=new URL(t.redirectUri,location.href).origin;return new Promise((a,n)=>{let o=v(E,d,r=>{r.state===s.state&&(o(),h.remove(m),typeof r.error=="string"&&r.error?n(new Error(r.error)):r.iss!==e?n(new Error("the answer came from another issuer")):typeof r.code!="string"||!r.code?n(new Error("the answer carried no code")):a(x(s,r.code)))},p);t.signal?.addEventListener("abort",()=>{o(),n(new Error("aborted"))})})})()}async function S(){let t=new URLSearchParams(location.search),e={type:E,code:t.get("code"),state:t.get("state"),iss:t.get("iss"),error:t.get("error")};if(window.name===p){try{window.opener?.postMessage(e,location.origin)}catch{}try{let c=new BroadcastChannel(p);c.postMessage(e),c.close()}catch{}return window.close(),null}let i=h.get(m);h.remove(m);let s=i?JSON.parse(i):null;if(!s||e.state!==s.state)throw new Error("the sign-in state does not match: start again");if(e.error)throw new Error(e.error);if(e.iss!==s.issuer)throw new Error("the answer came from another issuer");if(!e.code)throw new Error("the answer carried no code");return x(s,e.code)}async function k(t){let e=await fetch(`${t.issuer}/api/v2/oauth/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:t.code,redirect_uri:t.redirectUri,client_id:t.clientId,code_verifier:t.codeVerifier})}),i=await e.json();if(!e.ok)throw new Error(`${i.error??e.status}: ${i.error_description??""}`.trim());return i}var O='<svg viewBox="0 0 24 24" fill="#FFD700" width="20" height="20" aria-hidden="true" xmlns="http://www.w3.org/2000/svg"><path d="M5 16L3 5l5.5 5L12 4l3.5 6L21 5l-2 11H5z" stroke="#B8860B" stroke-width="0.5"/><path d="M5 18h14v2H5v-2z" stroke="#B8860B" stroke-width="0.5"/></svg>',P=`
+"use strict";(()=>{var S="0.3.0";function v(t){let e="";for(let n of t)e+=String.fromCharCode(n);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function f(){return v(crypto.getRandomValues(new Uint8Array(32)))}function R(t,e,n,s){let a=o=>{if(o&&typeof o=="object"&&o.type===t)try{n(o)}catch{}},d=o=>{o.origin===e&&a(o.data)};window.addEventListener("message",d);let u=null;if(s&&typeof BroadcastChannel=="function"&&e===location.origin)try{u=new BroadcastChannel(s),u.onmessage=o=>a(o.data)}catch{u=null}return()=>{window.removeEventListener("message",d),u?.close()}}var m={get(t){try{return sessionStorage.getItem(t)}catch{return null}},set(t,e){try{sessionStorage.setItem(t,e)}catch{}},remove(t){try{sessionStorage.removeItem(t)}catch{}}};var q="https://api.chaindaddy.io",V={"https://api.chaindaddy.io":"https://chaindaddy.io/_oauth/authorize","https://staging-api.chaindaddy.io":"https://staging.chaindaddy.io/_oauth/authorize"},w="cd-signin",T="cd:signin",y="cd.signin";async function F(t){let e=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(t));return v(new Uint8Array(e))}function G(t="openid"){let e=t.split(/\s+/).filter(Boolean);return(e.includes("openid")?e:["openid",...e]).join(" ")}async function K(t,e,n){let s=new URLSearchParams({response_type:"code",client_id:e.clientId,redirect_uri:e.redirectUri,scope:G(t.scope),state:e.state,nonce:e.nonce,code_challenge:await F(e.verifier),code_challenge_method:"S256"});return t.claims&&s.set("claims",typeof t.claims=="string"?t.claims:JSON.stringify(t.claims)),`${n}?${s}`}function _(t,e){return{code:e,codeVerifier:t.verifier,state:t.state,nonce:t.nonce,issuer:t.issuer,clientId:t.clientId,redirectUri:t.redirectUri}}function b(t){let e=(t.issuer??q).replace(/\/$/,""),n=t.authorizeUrl??V[e];if(!n)return Promise.reject(new Error("authorizeUrl is required for this issuer"));if(!t.clientId||!t.redirectUri)return Promise.reject(new Error("clientId and redirectUri are required"));let s={state:f(),nonce:f(),verifier:f(),issuer:e,clientId:t.clientId,redirectUri:t.redirectUri};m.set(y,JSON.stringify(s));let a=window.open("",w,"popup,width=480,height=720");return(async()=>{let d=await K(t,s,n);if(!a)return location.assign(d),null;a.location.href=d;let u=new URL(t.redirectUri,location.href).origin;return new Promise((o,i)=>{let c=R(T,u,r=>{r.state===s.state&&(c(),m.remove(y),typeof r.error=="string"&&r.error?i(new Error(r.error)):r.iss!==e?i(new Error("the answer came from another issuer")):typeof r.code!="string"||!r.code?i(new Error("the answer carried no code")):o(_(s,r.code)))},w);t.signal?.addEventListener("abort",()=>{c(),i(new Error("aborted"))})})})()}async function U(){let t=new URLSearchParams(location.search),e={type:T,code:t.get("code"),state:t.get("state"),iss:t.get("iss"),error:t.get("error")};if(window.name===w){try{window.opener?.postMessage(e,location.origin)}catch{}try{let a=new BroadcastChannel(w);a.postMessage(e),a.close()}catch{}return window.close(),null}let n=m.get(y);m.remove(y);let s=n?JSON.parse(n):null;if(!s||e.state!==s.state)throw new Error("the sign-in state does not match: start again");if(e.error)throw new Error(e.error);if(e.iss!==s.issuer)throw new Error("the answer came from another issuer");if(!e.code)throw new Error("the answer carried no code");return _(s,e.code)}async function A(t){let e=await fetch(`${t.issuer}/api/v2/oauth/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:t.code,redirect_uri:t.redirectUri,client_id:t.clientId,code_verifier:t.codeVerifier})}),n=await e.json();if(!e.ok)throw new Error(`${n.error??e.status}: ${n.error_description??""}`.trim());return n}var W='<svg viewBox="0 0 24 24" fill="#FFD700" width="20" height="20" aria-hidden="true" xmlns="http://www.w3.org/2000/svg"><path d="M5 16L3 5l5.5 5L12 4l3.5 6L21 5l-2 11H5z" stroke="#B8860B" stroke-width="0.5"/><path d="M5 18h14v2H5v-2z" stroke="#B8860B" stroke-width="0.5"/></svg>',Y=`
 :host { display: inline-block; }
 button { display: inline-flex; align-items: center; justify-content: center; gap: 10px; box-sizing: border-box;
   min-height: 40px; padding: 0 16px; border-radius: 10px; font: 600 15px/1 system-ui, -apple-system, "Segoe UI", sans-serif;
@@ -7,16 +7,16 @@ button[data-theme="dark"] { background: #101828; color: #ffffff; border-color: #
 button:focus-visible { outline: 2px solid #f59e0b; outline-offset: 2px; }
 button:disabled { opacity: .6; cursor: default; }
 svg { flex: none; }
-`;function I(){if(typeof customElements>"u"||customElements.get("cd-signin-button"))return;class t extends HTMLElement{constructor(){super(),this.root=this.attachShadow({mode:"open"})}connectedCallback(){this.render()}attributeChangedCallback(){this.isConnected&&this.render()}render(){let i=this.getAttribute("text")==="continue"?"Continue with Chain Daddy":"Sign in with Chain Daddy",s=this.getAttribute("theme")==="dark"?"dark":"light";this.root.innerHTML=`<style>${P}</style><button type="button" part="button" data-theme="${s}">${O}<span></span></button>`;let c=this.root.querySelector("button");c.querySelector("span").textContent=i,c.addEventListener("click",()=>this.start())}start(){let i=s=>this.getAttribute(s)||void 0;f({clientId:i("client-id")??"",redirectUri:i("redirect-uri")??"",scope:i("scope"),claims:i("claims"),issuer:i("issuer"),authorizeUrl:i("authorize-url")}).then(s=>s&&this.dispatchEvent(new CustomEvent("cd-signin",{detail:s,bubbles:!0,composed:!0})),s=>this.dispatchEvent(new CustomEvent("cd-signin-error",{detail:{message:String(s?.message??s)},bubbles:!0,composed:!0})))}}t.observedAttributes=["theme","text"],customElements.define("cd-signin-button",t)}var C="https://embed.chaindaddy.io",y="https://embed-staging.chaindaddy.io";var H=["--cd-accent","--cd-surface","--cd-text","--cd-text-muted","--cd-border"];function _(t){try{if(t&&new URL(t).hostname==="js.staging.chaindaddy.io")return y}catch{}return C}var D=`
+`;function L(){if(typeof customElements>"u"||customElements.get("cd-signin-button"))return;class t extends HTMLElement{constructor(){super(),this.root=this.attachShadow({mode:"open"})}connectedCallback(){this.render()}attributeChangedCallback(){this.isConnected&&this.render()}render(){let n=this.getAttribute("text")==="continue"?"Continue with Chain Daddy":"Sign in with Chain Daddy",s=this.getAttribute("theme")==="dark"?"dark":"light";this.root.innerHTML=`<style>${Y}</style><button type="button" part="button" data-theme="${s}">${W}<span></span></button>`;let a=this.root.querySelector("button");a.querySelector("span").textContent=n,a.addEventListener("click",()=>this.start())}start(){let n=s=>this.getAttribute(s)||void 0;b({clientId:n("client-id")??"",redirectUri:n("redirect-uri")??"",scope:n("scope"),claims:n("claims"),issuer:n("issuer"),authorizeUrl:n("authorize-url")}).then(s=>s&&this.dispatchEvent(new CustomEvent("cd-signin",{detail:s,bubbles:!0,composed:!0})),s=>this.dispatchEvent(new CustomEvent("cd-signin-error",{detail:{message:String(s?.message??s)},bubbles:!0,composed:!0})))}}t.observedAttributes=["theme","text"],customElements.define("cd-signin-button",t)}var M="https://embed.chaindaddy.io",k="https://embed-staging.chaindaddy.io";var J=["--cd-accent","--cd-surface","--cd-text","--cd-text-muted","--cd-border"];function P(t){try{if(t&&new URL(t).hostname==="js.staging.chaindaddy.io")return k}catch{}return M}var X=`
 :host { display: block; }
 iframe { display: block; width: 100%; border: 0; height: 1px; opacity: 0; color-scheme: normal; }
 :host([data-cd-ready]) iframe { opacity: 1; }
 :host([data-cd-ready]) slot { display: none; }
 :host([data-cd-unavailable]) iframe { display: none; }
-`,z=`
+`,Q=`
 :host { display: inline-block; }
 button { box-sizing: border-box; min-height: 40px; padding: 0 16px; border-radius: 10px; cursor: pointer;
   font: 600 15px/1 system-ui, -apple-system, "Segoe UI", sans-serif;
   border: 1px solid var(--cd-border, #d0d5dd); background: var(--cd-accent, #f59e0b); color: var(--cd-text, #101828); }
 button:focus-visible { outline: 2px solid var(--cd-accent, #f59e0b); outline-offset: 2px; }
-`;function R(t={}){try{if(typeof customElements>"u"||typeof HTMLElement>"u")return;let e=t.origin===y?y:C;class i extends HTMLElement{constructor(){super(...arguments);this.kind="app";this.frame=null;this.onMessage=n=>this.receive(n)}connectedCallback(){try{this.shadowRoot||this.attachShadow({mode:"open"}),this.mount()}catch{this.unavailable()}}disconnectedCallback(){try{window.removeEventListener("message",this.onMessage),clearTimeout(this.timer)}catch{}}attributeChangedCallback(){try{this.isConnected&&this.shadowRoot&&this.mount()}catch{this.unavailable()}}src(){let n=(this.getAttribute("crown")??"").trim(),o=(this.getAttribute("chain")??"").trim(),r=(this.getAttribute("app")??"").trim();if(!/^[0-9]{1,18}$/.test(n)||!o||this.kind==="app"&&!r)return null;let l=new URLSearchParams({crown:n,chain:o});return this.kind==="app"?l.set("app",r):l.set("kind","coin"),l.set("mode",this.mode()),l.set("v","1"),`${e}/v1/frame?${l.toString()}`}mode(){let n=this.getAttribute("mode");if(n==="light"||n==="dark")return n;try{return window.matchMedia("(prefers-color-scheme: dark)").matches?"dark":"light"}catch{return"light"}}mount(){let n=this.shadowRoot;window.removeEventListener("message",this.onMessage),clearTimeout(this.timer),this.removeAttribute("data-cd-ready"),this.removeAttribute("data-cd-unavailable");let o=this.src();if(!o){n.innerHTML="<slot></slot>",this.frame=null;return}n.innerHTML=`<style>${D}</style><slot></slot>`;let r=document.createElement("iframe");r.setAttribute("loading","lazy"),r.setAttribute("referrerpolicy","strict-origin-when-cross-origin"),r.setAttribute("allow","clipboard-write; fullscreen"),r.setAttribute("title",this.kind==="coin"?"Coin on Chain Daddy":"App on Chain Daddy"),r.src=o,n.appendChild(r),this.frame=r,window.addEventListener("message",this.onMessage),this.timer=setTimeout(()=>{this.hasAttribute("data-cd-ready")||this.unavailable()},8e3)}receive(n){try{if(n.origin!==e||!this.frame||!n.source||n.source!==this.frame.contentWindow)return;let o=n.data;if(!o||typeof o!="object")return;if(o.type==="cd:ready")clearTimeout(this.timer),this.removeAttribute("data-cd-unavailable"),this.setAttribute("data-cd-ready",""),this.sendTheme(),this.dispatchEvent(new CustomEvent("cd:ready"));else if(o.type==="cd:resize"){let r=Number(o.height);Number.isFinite(r)&&(this.frame.style.height=`${Math.max(1,Math.min(4e3,Math.ceil(r)))}px`)}else o.type==="cd:unavailable"&&this.unavailable()}catch{}}sendTheme(){let n={},o=getComputedStyle(this);for(let r of H){let l=o.getPropertyValue(r).trim();l&&(n[r]=l)}this.frame?.contentWindow?.postMessage({type:"cd:theme",tokens:n},e)}unavailable(){try{if(clearTimeout(this.timer),this.removeAttribute("data-cd-ready"),this.hasAttribute("data-cd-unavailable"))return;this.setAttribute("data-cd-unavailable",""),this.dispatchEvent(new CustomEvent("cd:unavailable"))}catch{}}}i.observedAttributes=["crown","chain","app","mode"];class s extends i{}class c extends i{constructor(){super(...arguments);this.kind="coin"}}class u extends HTMLElement{connectedCallback(){try{let a=this.querySelector("a[href]"),n=a?new URL(a.getAttribute("href")??"",document.baseURI):null;if(!n||n.protocol!=="https:")return;let o=this.shadowRoot??this.attachShadow({mode:"open"});o.innerHTML=`<style>${z}</style><button type="button" part="button"></button>`;let r=o.querySelector("button");r.textContent=(a.textContent??"").trim()||"Buy on Chain Daddy",r.addEventListener("click",()=>{try{window.open(n.toString(),"cd-buy","popup,width=460,height=760")||window.location.assign(n.toString())}catch{}})}catch{}}}for(let[d,a]of[["cd-app",s],["cd-coin",c],["cd-buy",u]])customElements.get(d)||customElements.define(d,a)}catch{}}var N={version:w,signIn:f,handleCallback:S,exchangeCode:k};window.ChainDaddy=Object.assign(window.ChainDaddy??{},N);I();R({origin:_(document.currentScript?.src)});})();
+`;function O(t={}){try{if(typeof customElements>"u"||typeof HTMLElement>"u")return;let e=t.origin===k?k:M;class n extends HTMLElement{constructor(){super(...arguments);this.kind="app";this.frame=null;this.onMessage=i=>this.receive(i)}connectedCallback(){try{this.shadowRoot||this.attachShadow({mode:"open"}),this.mount()}catch{this.unavailable()}}disconnectedCallback(){try{window.removeEventListener("message",this.onMessage),clearTimeout(this.timer)}catch{}}attributeChangedCallback(){try{this.isConnected&&this.shadowRoot&&this.mount()}catch{this.unavailable()}}src(){let i=(this.getAttribute("crown")??"").trim(),c=(this.getAttribute("chain")??"").trim(),r=(this.getAttribute("app")??"").trim();if(!/^[0-9]{1,18}$/.test(i)||!c||this.kind==="app"&&!r)return null;let l=new URLSearchParams({crown:i,chain:c});return this.kind==="app"?l.set("app",r):l.set("kind","coin"),l.set("mode",this.mode()),l.set("v","1"),`${e}/v1/frame?${l.toString()}`}mode(){let i=this.getAttribute("mode");if(i==="light"||i==="dark")return i;try{return window.matchMedia("(prefers-color-scheme: dark)").matches?"dark":"light"}catch{return"light"}}mount(){let i=this.shadowRoot;window.removeEventListener("message",this.onMessage),clearTimeout(this.timer),this.removeAttribute("data-cd-ready"),this.removeAttribute("data-cd-unavailable");let c=this.src();if(!c){i.innerHTML="<slot></slot>",this.frame=null;return}i.innerHTML=`<style>${X}</style><slot></slot>`;let r=document.createElement("iframe");r.setAttribute("loading","lazy"),r.setAttribute("referrerpolicy","strict-origin-when-cross-origin"),r.setAttribute("allow","clipboard-write; fullscreen"),r.setAttribute("title",this.kind==="coin"?"Coin on Chain Daddy":"App on Chain Daddy"),r.src=c,i.appendChild(r),this.frame=r,window.addEventListener("message",this.onMessage),this.timer=setTimeout(()=>{this.hasAttribute("data-cd-ready")||this.unavailable()},8e3)}receive(i){try{if(i.origin!==e||!this.frame||!i.source||i.source!==this.frame.contentWindow)return;let c=i.data;if(!c||typeof c!="object")return;if(c.type==="cd:ready")clearTimeout(this.timer),this.removeAttribute("data-cd-unavailable"),this.setAttribute("data-cd-ready",""),this.sendTheme(),this.dispatchEvent(new CustomEvent("cd:ready"));else if(c.type==="cd:resize"){let r=Number(c.height);Number.isFinite(r)&&(this.frame.style.height=`${Math.max(1,Math.min(4e3,Math.ceil(r)))}px`)}else c.type==="cd:unavailable"&&this.unavailable()}catch{}}sendTheme(){let i={},c=getComputedStyle(this);for(let r of J){let l=c.getPropertyValue(r).trim();l&&(i[r]=l)}this.frame?.contentWindow?.postMessage({type:"cd:theme",tokens:i},e)}unavailable(){try{if(clearTimeout(this.timer),this.removeAttribute("data-cd-ready"),this.hasAttribute("data-cd-unavailable"))return;this.setAttribute("data-cd-unavailable",""),this.dispatchEvent(new CustomEvent("cd:unavailable"))}catch{}}}n.observedAttributes=["crown","chain","app","mode"];class s extends n{}class a extends n{constructor(){super(...arguments);this.kind="coin"}}class d extends HTMLElement{connectedCallback(){try{let o=this.querySelector("a[href]"),i=o?new URL(o.getAttribute("href")??"",document.baseURI):null;if(!i||i.protocol!=="https:")return;let c=this.shadowRoot??this.attachShadow({mode:"open"});c.innerHTML=`<style>${Q}</style><button type="button" part="button"></button>`;let r=c.querySelector("button");r.textContent=(o.textContent??"").trim()||"Buy on Chain Daddy",r.addEventListener("click",()=>{try{window.open(i.toString(),"cd-buy","popup,width=460,height=760")||window.location.assign(i.toString())}catch{}})}catch{}}}for(let[u,o]of[["cd-app",s],["cd-coin",a],["cd-buy",d]])customElements.get(u)||customElements.define(u,o)}catch{}}var Z=["https://chaindaddy.io","https://staging.chaindaddy.io"],D=()=>"cd-checkout-"+f(),H="popup,width=480,height=820",$=300,tt=7;function E(t){if(typeof t!="string")return null;let e;try{e=new URL(t)}catch{return null}let n=/^\/_pay\/([\w-]+)$/.exec(e.pathname);return n&&Z.includes(e.origin)&&!e.username&&!e.password?{href:e.origin+e.pathname,origin:e.origin,id:n[1]}:null}function C(t,e){if(typeof t!="string")return null;let n;try{n=new URL(t,location.href)}catch{return null}if(!/^https?:$/.test(n.protocol)||n.username||n.password)return null;let s=d=>{let u=d.split("=")[0];try{return decodeURIComponent(u.replace(/\+/g," "))}catch{return u}},a=n.search.slice(1).split("&").filter(d=>d&&s(d)!=="session_id");return a.push("session_id="+encodeURIComponent(e)),n.origin+n.pathname+"?"+a.join("&")+n.hash}var p;function N(t,e,n){return new Promise(s=>{let a=!1,d=0,u,o=l=>{clearInterval(r),clearTimeout(u),window.removeEventListener("message",i),n&&l.status==="completed"&&location.assign(n),s(l)},i=l=>{if(l.origin!==e.origin||l.source!==t)return;let g=l.data;if(!g||typeof g!="object")return;g.type==="cd:checkout.ready"&&(a=!0);let h=g.session;if(!(!h||typeof h!="object"||h.id!==e.id)){if(g.type==="cd:checkout.cancelled")o({status:"cancelled",session:{id:e.id}});else if(g.type==="cd:checkout.completed"&&(h.status==="complete"||h.status==="paid")){let I={id:e.id,status:h.status};typeof h.orderId=="string"&&/^[\w-]{1,128}$/.test(h.orderId)&&(I.orderId=h.orderId),o({status:"completed",session:I})}}},c=()=>{try{t.postMessage({type:"cd:checkout.hello"},e.origin)}catch{}},r=setInterval(()=>{t.closed?(clearInterval(r),u=setTimeout(()=>o({status:"closed"}),$)):(!a||++d%tt===0)&&c()},$);window.addEventListener("message",i),c()})}function x(t){let e=()=>new Error("checkout: url is not a Chain Daddy checkout session link"),n=(a,d,u)=>{p={popup:a,result:d,href:u};let o=()=>{p&&p.popup===a&&(p=void 0)};return d.then(o,o),d},s=a=>(location.assign(a.href),{status:"redirected"});try{let{url:a,successUrl:d}=t;if(d&&!C(d,""))throw new Error("checkout: successUrl is not a web address");let u=r=>d?C(d,r.id):null,o=typeof a=="function"?null:E(a);if(typeof a!="function"&&!o)throw e();if(p&&!p.popup.closed&&(!o||p.href===o.href))return p.popup.focus(),p.result;if(o){let r=window.open(o.href,D(),H);return r?n(r,N(r,o,u(o)),o.href):Promise.resolve(s(o))}let i=window.open("",D(),H),c=new Promise(r=>r(a())).then(r=>{let l=E(r);if(!l)throw i?.close(),e();return i?(i.location.href=l.href,N(i,l,u(l))):s(l)},r=>{throw i?.close(),r});return i?n(i,c):c}catch(a){return Promise.reject(a)}}var B=!1,z;function j(){B||typeof document>"u"||(B=!0,document.addEventListener("click",t=>{let e=t.target instanceof Element?t.target.closest("[data-cd-checkout]"):null;if(!e||t.defaultPrevented||t.button||t.metaKey||t.ctrlKey||t.shiftKey||t.altKey)return;let n=e.getAttribute("data-cd-checkout")||e.href,s=e.getAttribute("data-cd-success");if(!E(n)||s&&!C(s,""))return;t.preventDefault();let a=x({url:n,successUrl:s});a!==z&&(z=a,a.then(d=>void e.dispatchEvent(new CustomEvent("cd:checkout",{detail:d,bubbles:!0})),()=>{}))}))}var et={version:S,signIn:b,handleCallback:U,exchangeCode:A,checkout:x};window.ChainDaddy=Object.assign(window.ChainDaddy??{},et);L();O({origin:P(document.currentScript?.src)});j();})();

package/dist/cd.js.sri

@@ -1 +1 @@
-sha384-KKpjQXvfR3Rs+FsdOW+hfEJcZpfuYVXR+TcyRX0nbup+s/xRhLx102TTXL29eFE1
+sha384-oAzz7JY6TsxFo7MvOAoI5wWjgXMDQsM27deR2Rr9F1DCHjZMz+Tb0oN9LT46GSnm

package/dist/checkout.d.ts

@@ -0,0 +1,73 @@
+export interface CheckoutOptions {
+    /**
+     * The session's `url`, or a function that fetches it. With a function the
+     * popup opens blank at once (inside the click) and goes to the link when it
+     * arrives.
+     */
+    url: string | (() => string | Promise<string>);
+    /**
+     * Where your page goes once the buyer has paid, with `session_id` added, as
+     * the checkout's own return does. Left out, the call only resolves. The
+     * checkout never tells this page where to go.
+     */
+    successUrl?: string | null;
+}
+export type CheckoutResult = 
+/** The buyer paid. `session.status` is "complete" (confirmed) or "paid" (sent, still confirming). */
+{
+    status: 'completed';
+    session: {
+        id: string;
+        status: 'complete' | 'paid';
+        orderId?: string;
+    };
+}
+/** The buyer left the checkout without paying. */
+ | {
+    status: 'cancelled';
+    session: {
+        id: string;
+    };
+}
+/** The popup closed and said nothing: read the session on your server to know. */
+ | {
+    status: 'closed';
+}
+/** The popup was blocked, so this page is going to the session by link. */
+ | {
+    status: 'redirected';
+};
+/** A session page: its address as parsed, its origin, and the session's id. */
+export interface CheckoutTarget {
+    href: string;
+    origin: string;
+    id: string;
+}
+/**
+ * The session page `url` names, or null when it is anything else. Exact
+ * origin (so https, our host, no port), no credentials, and the path
+ * /_pay/<id> and nothing under it, all read from the parsed URL: never a
+ * prefix test on the string, which "https://chaindaddy.io@evil.example/_pay/x"
+ * passes. `href` is the page and nothing more: a query or fragment on the
+ * link is dropped, so nothing rides into our site on a checkout link.
+ */
+export declare function parseCheckoutUrl(url: unknown): CheckoutTarget | null;
+/**
+ * Opens a checkout session in a popup. Call it from a click handler: the popup
+ * opens at once, or a browser blocks it. Resolves with how it ended; rejects,
+ * before any window opens or moves, when `url` is not a checkout session link.
+ * When the popup is blocked, the page goes to the session by link instead.
+ */
+export declare function checkout(o: CheckoutOptions): Promise<CheckoutResult>;
+/**
+ * Makes every element with `data-cd-checkout` open its session in the popup:
+ * a link by its `href`, anything else by the attribute's value. One listener
+ * on the document, so elements added later work too. On a link this only adds
+ * to what the link already does: without this script, with a modifier key, or
+ * when the address is not a session link, the link is followed as usual.
+ *
+ * When the visit ends the element fires `cd:checkout` (bubbling) with the
+ * result as `detail`; once the buyer has paid, the page goes to the element's
+ * `data-cd-success`, if it has one.
+ */
+export declare function bindCheckoutButtons(): void;

package/dist/checkout.js

@@ -0,0 +1,168 @@
+// src/core.ts
+function b64url(bytes) {
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomToken() {
+  return b64url(crypto.getRandomValues(new Uint8Array(32)));
+}
+
+// src/checkout.ts
+var ORIGINS = ["https://chaindaddy.io", "https://staging.chaindaddy.io"];
+var windowName = () => "cd-checkout-" + randomToken();
+var FEATURES = "popup,width=480,height=820";
+var TICK_MS = 300;
+var QUIET_TICKS = 7;
+function parseCheckoutUrl(url) {
+  if (typeof url !== "string") return null;
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return null;
+  }
+  const m = /^\/_pay\/([\w-]+)$/.exec(u.pathname);
+  return m && ORIGINS.includes(u.origin) && !u.username && !u.password ? { href: u.origin + u.pathname, origin: u.origin, id: m[1] } : null;
+}
+function successTarget(successUrl, id) {
+  if (typeof successUrl !== "string") return null;
+  let u;
+  try {
+    u = new URL(successUrl, location.href);
+  } catch {
+    return null;
+  }
+  if (!/^https?:$/.test(u.protocol) || u.username || u.password) return null;
+  const key = (pair) => {
+    const raw = pair.split("=")[0];
+    try {
+      return decodeURIComponent(raw.replace(/\+/g, " "));
+    } catch {
+      return raw;
+    }
+  };
+  const pairs = u.search.slice(1).split("&").filter((pair) => pair && key(pair) !== "session_id");
+  pairs.push("session_id=" + encodeURIComponent(id));
+  return u.origin + u.pathname + "?" + pairs.join("&") + u.hash;
+}
+var current;
+function wait(popup, target, success) {
+  return new Promise((resolve) => {
+    let ready = false;
+    let quiet = 0;
+    let last;
+    const done = (result) => {
+      clearInterval(timer);
+      clearTimeout(last);
+      window.removeEventListener("message", onMessage);
+      if (success && result.status === "completed") location.assign(success);
+      resolve(result);
+    };
+    const onMessage = (e) => {
+      if (e.origin !== target.origin || e.source !== popup) return;
+      const data = e.data;
+      if (!data || typeof data !== "object") return;
+      if (data.type === "cd:checkout.ready") ready = true;
+      const s = data.session;
+      if (!s || typeof s !== "object" || s.id !== target.id) return;
+      if (data.type === "cd:checkout.cancelled") done({ status: "cancelled", session: { id: target.id } });
+      else if (data.type === "cd:checkout.completed" && (s.status === "complete" || s.status === "paid")) {
+        const session = { id: target.id, status: s.status };
+        if (typeof s.orderId === "string" && /^[\w-]{1,128}$/.test(s.orderId)) session.orderId = s.orderId;
+        done({ status: "completed", session });
+      }
+    };
+    const hello = () => {
+      try {
+        popup.postMessage({ type: "cd:checkout.hello" }, target.origin);
+      } catch {
+      }
+    };
+    const timer = setInterval(() => {
+      if (popup.closed) {
+        clearInterval(timer);
+        last = setTimeout(() => done({ status: "closed" }), TICK_MS);
+      } else if (!ready || ++quiet % QUIET_TICKS === 0) hello();
+    }, TICK_MS);
+    window.addEventListener("message", onMessage);
+    hello();
+  });
+}
+function checkout(o) {
+  const refused = () => new Error("checkout: url is not a Chain Daddy checkout session link");
+  const track = (popup, result, href) => {
+    current = { popup, result, href };
+    const over = () => {
+      if (current && current.popup === popup) current = void 0;
+    };
+    result.then(over, over);
+    return result;
+  };
+  const byLink = (target) => {
+    location.assign(target.href);
+    return { status: "redirected" };
+  };
+  try {
+    const { url, successUrl } = o;
+    if (successUrl && !successTarget(successUrl, "")) throw new Error("checkout: successUrl is not a web address");
+    const success = (t) => successUrl ? successTarget(successUrl, t.id) : null;
+    const target = typeof url === "function" ? null : parseCheckoutUrl(url);
+    if (typeof url !== "function" && !target) throw refused();
+    if (current && !current.popup.closed && (!target || current.href === target.href)) {
+      current.popup.focus();
+      return current.result;
+    }
+    if (target) {
+      const popup2 = window.open(target.href, windowName(), FEATURES);
+      return popup2 ? track(popup2, wait(popup2, target, success(target)), target.href) : Promise.resolve(byLink(target));
+    }
+    const popup = window.open("", windowName(), FEATURES);
+    const result = new Promise((resolve) => resolve(url())).then(
+      (fetched) => {
+        const t = parseCheckoutUrl(fetched);
+        if (!t) {
+          popup?.close();
+          throw refused();
+        }
+        if (!popup) return byLink(t);
+        popup.location.href = t.href;
+        return wait(popup, t, success(t));
+      },
+      (e) => {
+        popup?.close();
+        throw e;
+      }
+    );
+    return popup ? track(popup, result) : result;
+  } catch (e) {
+    return Promise.reject(e);
+  }
+}
+var bound = false;
+var reporting;
+function bindCheckoutButtons() {
+  if (bound || typeof document === "undefined") return;
+  bound = true;
+  document.addEventListener("click", (e) => {
+    const el = e.target instanceof Element ? e.target.closest("[data-cd-checkout]") : null;
+    if (!el || e.defaultPrevented || e.button || e.metaKey || e.ctrlKey || e.shiftKey || e.altKey) return;
+    const url = el.getAttribute("data-cd-checkout") || el.href;
+    const successUrl = el.getAttribute("data-cd-success");
+    if (!parseCheckoutUrl(url) || successUrl && !successTarget(successUrl, "")) return;
+    e.preventDefault();
+    const visit = checkout({ url, successUrl });
+    if (visit === reporting) return;
+    reporting = visit;
+    visit.then(
+      (detail) => void el.dispatchEvent(new CustomEvent("cd:checkout", { detail, bubbles: true })),
+      () => {
+      }
+    );
+  });
+}
+export {
+  bindCheckoutButtons,
+  checkout,
+  parseCheckoutUrl
+};

package/dist/index.d.ts

@@ -4,3 +4,5 @@ export type { SignInOptions, SignInResult } from './signin';
 export { defineSignInButton } from './button';
 export { defineEmbedElements, embedOriginFor } from './embed';
 export type { EmbedOptions } from './embed';
+export { bindCheckoutButtons, checkout, parseCheckoutUrl } from './checkout';
+export type { CheckoutOptions, CheckoutResult, CheckoutTarget } from './checkout';

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/core.ts
-var VERSION = true ? "0.2.0" : "0.0.0";
+var VERSION = true ? "0.3.0" : "0.0.0";
 function b64url(bytes) {
   let s = "";
   for (const b of bytes) s += String.fromCharCode(b);
@@ -397,14 +397,171 @@ function defineEmbedElements(options = {}) {
   } catch {
   }
 }
+
+// src/checkout.ts
+var ORIGINS = ["https://chaindaddy.io", "https://staging.chaindaddy.io"];
+var windowName = () => "cd-checkout-" + randomToken();
+var FEATURES = "popup,width=480,height=820";
+var TICK_MS = 300;
+var QUIET_TICKS = 7;
+function parseCheckoutUrl(url) {
+  if (typeof url !== "string") return null;
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return null;
+  }
+  const m = /^\/_pay\/([\w-]+)$/.exec(u.pathname);
+  return m && ORIGINS.includes(u.origin) && !u.username && !u.password ? { href: u.origin + u.pathname, origin: u.origin, id: m[1] } : null;
+}
+function successTarget(successUrl, id) {
+  if (typeof successUrl !== "string") return null;
+  let u;
+  try {
+    u = new URL(successUrl, location.href);
+  } catch {
+    return null;
+  }
+  if (!/^https?:$/.test(u.protocol) || u.username || u.password) return null;
+  const key = (pair) => {
+    const raw = pair.split("=")[0];
+    try {
+      return decodeURIComponent(raw.replace(/\+/g, " "));
+    } catch {
+      return raw;
+    }
+  };
+  const pairs = u.search.slice(1).split("&").filter((pair) => pair && key(pair) !== "session_id");
+  pairs.push("session_id=" + encodeURIComponent(id));
+  return u.origin + u.pathname + "?" + pairs.join("&") + u.hash;
+}
+var current;
+function wait(popup, target, success) {
+  return new Promise((resolve) => {
+    let ready = false;
+    let quiet = 0;
+    let last;
+    const done = (result2) => {
+      clearInterval(timer);
+      clearTimeout(last);
+      window.removeEventListener("message", onMessage);
+      if (success && result2.status === "completed") location.assign(success);
+      resolve(result2);
+    };
+    const onMessage = (e) => {
+      if (e.origin !== target.origin || e.source !== popup) return;
+      const data = e.data;
+      if (!data || typeof data !== "object") return;
+      if (data.type === "cd:checkout.ready") ready = true;
+      const s = data.session;
+      if (!s || typeof s !== "object" || s.id !== target.id) return;
+      if (data.type === "cd:checkout.cancelled") done({ status: "cancelled", session: { id: target.id } });
+      else if (data.type === "cd:checkout.completed" && (s.status === "complete" || s.status === "paid")) {
+        const session = { id: target.id, status: s.status };
+        if (typeof s.orderId === "string" && /^[\w-]{1,128}$/.test(s.orderId)) session.orderId = s.orderId;
+        done({ status: "completed", session });
+      }
+    };
+    const hello = () => {
+      try {
+        popup.postMessage({ type: "cd:checkout.hello" }, target.origin);
+      } catch {
+      }
+    };
+    const timer = setInterval(() => {
+      if (popup.closed) {
+        clearInterval(timer);
+        last = setTimeout(() => done({ status: "closed" }), TICK_MS);
+      } else if (!ready || ++quiet % QUIET_TICKS === 0) hello();
+    }, TICK_MS);
+    window.addEventListener("message", onMessage);
+    hello();
+  });
+}
+function checkout(o) {
+  const refused = () => new Error("checkout: url is not a Chain Daddy checkout session link");
+  const track = (popup, result2, href) => {
+    current = { popup, result: result2, href };
+    const over = () => {
+      if (current && current.popup === popup) current = void 0;
+    };
+    result2.then(over, over);
+    return result2;
+  };
+  const byLink = (target) => {
+    location.assign(target.href);
+    return { status: "redirected" };
+  };
+  try {
+    const { url, successUrl } = o;
+    if (successUrl && !successTarget(successUrl, "")) throw new Error("checkout: successUrl is not a web address");
+    const success = (t) => successUrl ? successTarget(successUrl, t.id) : null;
+    const target = typeof url === "function" ? null : parseCheckoutUrl(url);
+    if (typeof url !== "function" && !target) throw refused();
+    if (current && !current.popup.closed && (!target || current.href === target.href)) {
+      current.popup.focus();
+      return current.result;
+    }
+    if (target) {
+      const popup2 = window.open(target.href, windowName(), FEATURES);
+      return popup2 ? track(popup2, wait(popup2, target, success(target)), target.href) : Promise.resolve(byLink(target));
+    }
+    const popup = window.open("", windowName(), FEATURES);
+    const result2 = new Promise((resolve) => resolve(url())).then(
+      (fetched) => {
+        const t = parseCheckoutUrl(fetched);
+        if (!t) {
+          popup?.close();
+          throw refused();
+        }
+        if (!popup) return byLink(t);
+        popup.location.href = t.href;
+        return wait(popup, t, success(t));
+      },
+      (e) => {
+        popup?.close();
+        throw e;
+      }
+    );
+    return popup ? track(popup, result2) : result2;
+  } catch (e) {
+    return Promise.reject(e);
+  }
+}
+var bound = false;
+var reporting;
+function bindCheckoutButtons() {
+  if (bound || typeof document === "undefined") return;
+  bound = true;
+  document.addEventListener("click", (e) => {
+    const el = e.target instanceof Element ? e.target.closest("[data-cd-checkout]") : null;
+    if (!el || e.defaultPrevented || e.button || e.metaKey || e.ctrlKey || e.shiftKey || e.altKey) return;
+    const url = el.getAttribute("data-cd-checkout") || el.href;
+    const successUrl = el.getAttribute("data-cd-success");
+    if (!parseCheckoutUrl(url) || successUrl && !successTarget(successUrl, "")) return;
+    e.preventDefault();
+    const visit = checkout({ url, successUrl });
+    if (visit === reporting) return;
+    reporting = visit;
+    visit.then(
+      (detail) => void el.dispatchEvent(new CustomEvent("cd:checkout", { detail, bubbles: true })),
+      () => {
+      }
+    );
+  });
+}
 export {
   DEFAULT_ISSUER,
   VERSION,
+  bindCheckoutButtons,
   challengeFor,
+  checkout,
   defineEmbedElements,
   defineSignInButton,
   embedOriginFor,
   exchangeCode,
   handleCallback,
+  parseCheckoutUrl,
   signIn
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@chaindaddy/js",
-  "version": "0.2.0",
-  "description": "Chain Daddy for any website: Sign in with Chain Daddy (a popup and a button), a coin's apps on its own site (<cd-app>), and a server-side check that a store order was paid on chain, with checkout to follow",
+  "version": "0.3.0",
+  "description": "Chain Daddy for any website: Sign in with Chain Daddy (a popup and a button), a coin's apps on its own site (<cd-app>), checkout for a coin's store in a popup, and a server-side check that a store order was paid on chain",
   "homepage": "https://docs.chaindaddy.io/developer/javascript-sdk",
   "repository": {
     "type": "git",
@@ -30,6 +30,10 @@
       "types": "./dist/embed.d.ts",
       "default": "./dist/embed.js"
     },
+    "./checkout": {
+      "types": "./dist/checkout.d.ts",
+      "default": "./dist/checkout.js"
+    },
     "./verify": {
       "types": "./dist/verify.d.ts",
       "default": "./dist/verify.js"