@chaindaddy/js 0.2.0 → 0.3.1

package/dist/api.d.ts

@@ -15,8 +15,8 @@ export interface paths {
          * @description A verified coin page by chain and ticker: its name, token address, registration ID, logo, price,
          *     market cap, 24-hour volume, liquidity, 24-hour price change and holder count. A figure Chain Daddy
          *     does not have is `null`, never `0`. The logo is `null` for a page marked NSFW. Answers 404 for a
-         *     ticker with no verified page on that chain. Keyless, the same for every caller, and cached for
-         *     about a minute.
+         *     ticker with no verified page on that chain, and for a page Chain Daddy removed. Keyless, the same
+         *     for every caller, and cached for about a minute.
          */
         get: operations["getPublicCoin"];
         put?: never;
@@ -38,9 +38,10 @@ export interface paths {
          * List the apps on a verified coin's page
          * @description The apps a verified coin's page shows, in page order: each app's ID, name, description, version,
          *     category, icon and whether it is a built-in. It names the apps; it does not include what the owner
-         *     set up inside them. Apps turned off are left out, and so is every app rated NSFW. Answers 404 for
-         *     a ticker with no verified page on that chain. Keyless, the same for every caller, and cached for
-         *     about a minute.
+         *     set up inside them. Apps turned off are left out, and so is every app rated NSFW and every app the
+         *     page itself no longer shows (not reviewed yet, suspended or removed). Answers 404 for a ticker
+         *     with no verified page on that chain, and for a page Chain Daddy removed. Keyless, the same for
+         *     every caller, and cached for about a minute.
          */
         get: operations["listPublicCoinApps"];
         put?: never;
@@ -64,7 +65,8 @@ export interface paths {
          *     smallest unit as a decimal string, and `holds` (whether it is above zero). Use it to re-check a
          *     holding after someone signed in to your site with Chain Daddy, without an API key. Works for any
          *     token on a chain Chain Daddy serves. Each caller gets 60 requests a minute; past that it
-         *     answers 429. Cached for about 30 seconds.
+         *     answers 429. Cached for about 30 seconds. All callers together share a limit on chain reads:
+         *     in a busy moment it answers 503 with `Retry-After`.
          */
         get: operations["getPublicHolding"];
         put?: never;
@@ -86,10 +88,11 @@ export interface paths {
          * List a registration's verified sites
          * @description The websites a coin's registration has verified with a DNS record. `badgeHosts` show the coin's
          *     verified badge on the Chain Daddy sign-in page. `embedHosts` may also run the coin's apps and take
-         *     its checkout. A host covers its subdomains. `interactive` is `false` when there are no
+         *     its checkout. A host covers its subdomains, except one Chain Daddy has blocked. `interactive` is `false` when there are no
          *     `embedHosts` or Chain Daddy has turned the coin's embeds off. A registration with no verified
-         *     sites answers 200 with empty lists. Keyless, the same for every caller, and cached for about a
-         *     minute.
+         *     sites answers 200 with empty lists. Only the registration a verified coin page shows answers
+         *     (the `crownId` the coin read gives); any other ID answers 404. Keyless, the same for every
+         *     caller, and cached for about a minute.
          */
         get: operations["getPublicCrownSites"];
         put?: never;
@@ -833,6 +836,12 @@ export interface paths {
          *     A buyer paying a checkout session sends `checkoutSessionId` from their own session on chaindaddy.io. The
          *     session then fixes the store, the SKU, the quantity and `appAccountToken`, so `storeId` and `sku` may be
          *     left out. The amount and the fee are quoted exactly as for any other order of that item.
+         *
+         *     When the session's item belongs to an installed app, the order is that app's order: it pays the page, the
+         *     fee and the app's developer, needs `acknowledgeFinalSale: true`, and stays inside the app's limits. The app
+         *     is the item's own; an `appId` sent with a session is ignored. Everything is checked again when the order is
+         *     made, so a session opened while the item could be sold answers 409 `APP_ITEM_NOT_SOLD_HERE` once its
+         *     developer turns that off, pauses, or changes the item's terms.
          */
         post: operations["createIapOrder"];
         delete?: never;
@@ -864,6 +873,76 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v2/iap/checkout/sessions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Open a checkout session
+         * @description Take a payment for your coin's store on your own website. Your server calls this with a store key
+         *     (scope `orders:write`) and gets back `url`: send the buyer there with a plain link or a redirect. The
+         *     buyer pays on chaindaddy.io and returns to `successUrl`, or to `cancelUrl` if they leave.
+         *
+         *     A session sells one item (`lineItems` takes exactly one entry). The price, the fee and where the money
+         *     goes are the item's own, exactly as when it is bought on chaindaddy.io: a session changes none of them.
+         *
+         *     `successUrl` and `cancelUrl` must be `https` pages on one of the coin's verified sites, or a subdomain of
+         *     one (400 `RETURN_URL_NOT_VERIFIED`, which lists the sites that pass). The wallet that opened the store
+         *     must have signed the Seller Terms (403 `SELLER_TERMS_REQUIRED`).
+         *
+         *     An item of an app installed on the coin's page (its `sku` starts with `app.`) is sold through a session
+         *     only when the app's developer has allowed that item to be sold outside the app; otherwise the call answers
+         *     409 `APP_ITEM_NOT_SOLD_HERE`, with a `reason`. The sale pays the same wallets as inside the app: the page,
+         *     the fee and the developer's share. Such a session takes at most the app's per-order quantity.
+         *
+         *     Send an `Idempotency-Key`. A retry of the same request returns the session it opened, with status 200
+         *     and the header `Idempotent-Replayed: true`.
+         *
+         *     Learn that the session was paid from the `iap.order.confirmed` webhook (its payload carries
+         *     `checkoutSessionId`), or by reading the session. Never from the buyer arriving on `successUrl`.
+         *
+         *     Answers 404 `CHECKOUT_SESSIONS_DISABLED` where checkout sessions are not switched on, or are open to
+         *     test stores only and the key is a live store's. `GET /api/v2/iap/config` says which (`checkoutSessions`).
+         *     Guide: https://docs.chaindaddy.io/developer/take-payments-on-your-site
+         */
+        post: operations["createIapCheckoutSession"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v2/iap/checkout/sessions/{sessionId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The checkout session's id, `cs_` followed by 48 hex characters */
+                sessionId: components["parameters"]["IapCheckoutSessionId"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Get a checkout session
+         * @description Your server reads a session it opened, with a store key of the same store (scope `orders:read`).
+         *     `status` is `open`, `complete` once the buyer's payment is confirmed, or `expired`. `order` is the order
+         *     that paid it (or the buyer's latest attempt while it is open), and `receipt` is that order's signed
+         *     receipt once the session is complete. A key of any other store gets 404.
+         */
+        get: operations["getIapCheckoutSession"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v2/iap/checkout/sessions/{sessionId}/public": {
         parameters: {
             query?: never;
@@ -880,8 +959,16 @@ export interface paths {
          *     needs no credential (the session id in the buyer's link is enough) and never carries the session's
          *     `metadata` or `clientReferenceId`. The answer is never cached.
          *
+         *     When the item belongs to an app installed on the coin's page, `sku` names the app (`appId`) and carries
+         *     nothing else of the app's: no `appBps`, `appTermsVersion`, `appItemKey` or `appRole`, and an empty
+         *     `metadata`.
+         *
          *     Pass `origin` to learn whether a page on that origin may open this checkout in a popup
          *     (`openerAllowed`): it must be `https` on one of the coin's verified sites.
+         *
+         *     `returnAllowed` says whether the buyer may still be sent to `successUrl` and `cancelUrl`. It is checked
+         *     again on every read, so a coin whose site stopped being verified after the session was opened no longer
+         *     gets its buyers sent there; the pay page then shows the result itself.
          */
         get: operations["getIapPublicCheckoutSession"];
         put?: never;
@@ -949,7 +1036,8 @@ export interface paths {
          * List the event types a webhook can subscribe to
          * @description Returns every subscribable event type with a one-line description: registration, heartbeat, holder, trade
          *     and alert events, API quota events, deal lifecycle events (`deal.created`, `deal.accepted`,
-         *     `deal.rejected`, `deal.cancelled`, `deal.completed`, `deal.failed`) and creator-store events (`iap.*`).
+         *     `deal.rejected`, `deal.cancelled`, `deal.completed`, `deal.failed`), creator-store events (`iap.*`) and
+         *     `app.order.confirmed`, which tells a paid app's developer of each confirmed order made through the app.
          *     This list is exactly what create and update accept. Read it before creating a webhook rather than
          *     guessing names: a misspelled type is refused with 400.
          *
@@ -1273,6 +1361,18 @@ export interface components {
             error: string;
             /** @description Machine-readable error code (e.g. `IAP_PLAN_REQUIRED`, `INSUFFICIENT_QUANTITY`) */
             code?: string;
+            /**
+             * @description Which of a code's causes this is, where a code has several. Sent with `APP_NOT_SELLING`:
+             *     `app_not_published`, `selling_switched_off` (stopped by Chain Daddy), `developer_paused`
+             *     (paused by the app's developer), `developer_unavailable` (the developer cannot sell right
+             *     now; why is between them and Chain Daddy, and their own portal tells them), `no_payout_on_chain`
+             *     or `payout_contract_missing` (the developer is not paid on this chain). Sent with
+             *     `APP_ITEM_NOT_SOLD_HERE` (an app's item and a checkout session): any of those, or
+             *     `not_allowed_outside_app` (the app's developer has not allowed the item to be sold outside the app),
+             *     `app_not_installed`, `terms_changed` or `item_not_for_sale`. Absent on every other error. Expect new
+             *     values.
+             */
+            reason?: string;
         };
         /** @description One token prize. Amounts are base units, as strings. */
         IapAirdropAward: {
@@ -1852,6 +1952,46 @@ export interface components {
             wallet?: string;
             entitlements?: components["schemas"]["IapEntitlement"][];
         };
+        /** @description A checkout session, as the store's own server sees it */
+        IapCheckoutSession: {
+            /** @description `cs_` followed by 48 hex characters */
+            id?: string;
+            /**
+             * @description The page the buyer pays on. Link or redirect the buyer to it
+             * @example https://chaindaddy.io/_pay/cs_0f3a9c1e5b7d2a4c6e8f0b1d3a5c7e9f1b3d5a7c9e0f2a4c
+             */
+            url?: string;
+            /**
+             * @description `complete` once the payment is confirmed; `expired` when it was not paid by `expiresAt`
+             * @enum {string}
+             */
+            status?: "open" | "complete" | "expired";
+            /** @description False for a test store's session */
+            livemode?: boolean;
+            /** Format: date-time */
+            expiresAt?: string;
+            /** Format: date-time */
+            completedAt?: string | null;
+            /** Format: date-time */
+            createdAt?: string;
+            storeId?: string;
+            lineItems?: {
+                sku?: string;
+                quantity?: number;
+            }[];
+            successUrl?: string;
+            cancelUrl?: string;
+            clientReferenceId?: string | null;
+            metadata?: {
+                [key: string]: unknown;
+            };
+            /** @description The only wallet that can pay, when the session names one */
+            wallet?: string | null;
+            /** @description The order that paid the session, or the buyer's latest attempt while it is open; null until the buyer starts paying */
+            order?: components["schemas"]["IapOrder"] | null;
+            /** @description The paying order's signed receipt (a JWS), once the session is complete */
+            receipt?: string | null;
+        };
         /** @description A checkout session, as the buyer's pay page sees it. Never carries `metadata` or `clientReferenceId` */
         IapPublicCheckoutSession: {
             id?: string;
@@ -1869,6 +2009,11 @@ export interface components {
             wallet?: string | null;
             /** @description Whether a page on the `origin` passed may open this checkout in a popup. False when no `origin` is passed */
             openerAllowed?: boolean;
+            /**
+             * @description Whether `successUrl` and `cancelUrl` are both still on the coin's verified sites, as of this read.
+             *     When false the buyer is not sent to either
+             */
+            returnAllowed?: boolean;
         };
         IapSkuOwners: {
             entries?: {
@@ -2345,8 +2490,8 @@ export interface components {
             iat: number;
             /** @description Five minutes after `iat` */
             exp: number;
-            /** @description When the Chain Daddy session this sign-in rides on began */
-            auth_time: number;
+            /** @description When the Chain Daddy session this sign-in rides on began. Only for a client whose `sub` is the wallet; a client with a per-site `sub` gets none, because the same value at every site would link its ids */
+            auth_time?: number;
             /** @description Your `nonce`, when you sent one */
             nonce?: string;
             jti: string;
@@ -2625,7 +2770,7 @@ export interface operations {
                         /** @description The registration's ID on that chain */
                         crownId: number;
                         tokenAddress: string;
-                        /** @description The page's logo; `null` when it has none or the page is marked NSFW */
+                        /** @description The page's logo; `null` when it has none, the page is marked NSFW, or Chain Daddy removed the image */
                         logoUrl: string | null;
                         /** @description Whether the page carries the NSFW label */
                         nsfw: boolean;
@@ -2643,6 +2788,21 @@ export interface operations {
                     };
                 };
             };
+            /** @description The request came with the user agent of an AI or LLM crawler, and no cached answer was there to serve instead. Never sent to a browser or to a server using its own user agent. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": "ai_bot_blocked",
+                     *       "message": "AI/LLM scraping is not permitted. Use our API with a developer-tier API key for programmatic access."
+                     *     }
+                     */
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
             /** @description No verified page for that ticker on that chain, or an unknown chain */
             404: {
                 headers: {
@@ -2659,6 +2819,24 @@ export interface operations {
                     "application/json": components["schemas"]["Error"];
                 };
             };
+            /** @description More than 400 requests in a minute from one IP address, across the whole API. Never cached. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before trying again */
+                    "Retry-After"?: number;
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": "Too many requests. Please try again later.",
+                     *       "code": "rate_limit_exceeded",
+                     *       "message": "Too many requests. Please try again later."
+                     *     }
+                     */
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
             /** @description The read could not be answered right now. Never cached; try again. */
             503: {
                 headers: {
@@ -2737,6 +2915,21 @@ export interface operations {
                     };
                 };
             };
+            /** @description The request came with the user agent of an AI or LLM crawler, and no cached answer was there to serve instead. Never sent to a browser or to a server using its own user agent. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": "ai_bot_blocked",
+                     *       "message": "AI/LLM scraping is not permitted. Use our API with a developer-tier API key for programmatic access."
+                     *     }
+                     */
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
             /** @description No verified page for that ticker on that chain, or an unknown chain */
             404: {
                 headers: {
@@ -2753,6 +2946,24 @@ export interface operations {
                     "application/json": components["schemas"]["Error"];
                 };
             };
+            /** @description More than 400 requests in a minute from one IP address, across the whole API. Never cached. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before trying again */
+                    "Retry-After"?: number;
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": "Too many requests. Please try again later.",
+                     *       "code": "rate_limit_exceeded",
+                     *       "message": "Too many requests. Please try again later."
+                     *     }
+                     */
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
             /** @description The read could not be answered right now. Never cached; try again. */
             503: {
                 headers: {
@@ -2817,6 +3028,21 @@ export interface operations {
                     };
                 };
             };
+            /** @description The request came with the user agent of an AI or LLM crawler, and no cached answer was there to serve instead. Never sent to a browser or to a server using its own user agent. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": "ai_bot_blocked",
+                     *       "message": "AI/LLM scraping is not permitted. Use our API with a developer-tier API key for programmatic access."
+                     *     }
+                     */
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
             /** @description An unknown chain, or an address that is not one on that chain */
             404: {
                 headers: {
@@ -2851,9 +3077,15 @@ export interface operations {
                     "application/json": components["schemas"]["Error"];
                 };
             };
-            /** @description The read could not be answered right now. Never cached; try again. */
+            /**
+             * @description The read could not be answered right now. Never cached; try again. It never means the wallet
+             *     holds nothing. In a busy moment, when Chain Daddy is making as many chain reads as it allows,
+             *     it carries `Retry-After`.
+             */
             503: {
                 headers: {
+                    /** @description Seconds to wait before trying again. Sent only in a busy moment */
+                    "Retry-After"?: number;
                     [name: string]: unknown;
                 };
                 content: {
@@ -2908,7 +3140,7 @@ export interface operations {
                         chain: string;
                         chainId: string;
                         crownId: number;
-                        /** @description The coin's ticker; empty when the registration could not be read */
+                        /** @description The coin's ticker */
                         symbol: string;
                         badgeHosts: string[];
                         embedHosts: string[];
@@ -2916,7 +3148,22 @@ export interface operations {
                     };
                 };
             };
-            /** @description An unknown chain, or an ID that is not a positive whole number */
+            /** @description The request came with the user agent of an AI or LLM crawler, and no cached answer was there to serve instead. Never sent to a browser or to a server using its own user agent. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": "ai_bot_blocked",
+                     *       "message": "AI/LLM scraping is not permitted. Use our API with a developer-tier API key for programmatic access."
+                     *     }
+                     */
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description An unknown chain, an ID that is not a positive whole number, or a registration that is not a verified coin page's */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -2932,6 +3179,24 @@ export interface operations {
                     "application/json": components["schemas"]["Error"];
                 };
             };
+            /** @description More than 400 requests in a minute from one IP address, across the whole API. Never cached. */
+            429: {
+                headers: {
+                    /** @description Seconds to wait before trying again */
+                    "Retry-After"?: number;
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": "Too many requests. Please try again later.",
+                     *       "code": "rate_limit_exceeded",
+                     *       "message": "Too many requests. Please try again later."
+                     *     }
+                     */
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
             /** @description The read could not be answered right now. Never cached; try again. */
             503: {
                 headers: {
@@ -4256,7 +4521,9 @@ export interface operations {
                     /**
                      * @description The checkout session the buyer is paying. A buyer's session only: a store key gets 403
                      *     `SESSION_REQUIRED`. 409 `CHECKOUT_SESSION_EXPIRED` or `CHECKOUT_SESSION_COMPLETE` when the
-                     *     session can no longer be paid; 403 `CHECKOUT_SESSION_WALLET` when it names another wallet
+                     *     session can no longer be paid; 403 `CHECKOUT_SESSION_WALLET` when it names another wallet.
+                     *     A session takes one buyer at a time: 409 `CHECKOUT_SESSION_IN_USE` while another wallet has
+                     *     an order for it that can still be paid, or is paid and being confirmed
                      */
                     checkoutSessionId?: string;
                     /** @description Required with a store key; the wallet that receives the items */
@@ -4295,7 +4562,8 @@ export interface operations {
              * @description Sold out, or the wallet has reached the SKU's per-wallet limit. For an app's item: `APP_TERMS_CHANGED`
              *     (its developer changed its terms and the page's owner has not accepted them yet), `APP_NOT_INSTALLED`,
              *     `APP_NOT_SELLING`, `APP_ORDER_LIMIT` (above the per-purchase limit) or `APP_DAILY_LIMIT` (the wallet
-             *     reached what it may pay that app in 24 hours)
+             *     reached what it may pay that app in 24 hours). For an app's item paid through a checkout session:
+             *     `APP_ITEM_NOT_SOLD_HERE`, with a `reason`
              */
             409: {
                 headers: {
@@ -4367,6 +4635,192 @@ export interface operations {
             404: components["responses"]["IapNotFound"];
         };
     };
+    createIapCheckoutSession: {
+        parameters: {
+            query?: never;
+            header?: {
+                /**
+                 * @description Send a unique value (a UUID) with every POST. Retrying with the same key returns the first result
+                 *     and never sells, grants or consumes twice.
+                 */
+                "Idempotency-Key"?: components["parameters"]["IdempotencyKey"];
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description What is sold. Exactly one item */
+                    lineItems: {
+                        /** @description The item's SKU key in your store */
+                        sku: string;
+                        /** @default 1 */
+                        quantity?: number;
+                    }[];
+                    /**
+                     * Format: uri
+                     * @description Where the buyer returns after paying. `https`, on one of the coin's verified sites
+                     */
+                    successUrl: string;
+                    /**
+                     * Format: uri
+                     * @description Where the buyer returns if they leave without paying. Same rule as `successUrl`
+                     */
+                    cancelUrl: string;
+                    /**
+                     * @description Your own id for this checkout (a cart or user id). Echoed as `appAccountToken` on the order,
+                     *     its events and its receipt, which the buyer can read: a reference, not a secret
+                     */
+                    clientReferenceId?: string;
+                    /** @description Your own data, returned when you read the session. At most 20 keys and 4 KB. Never shown to the buyer */
+                    metadata?: {
+                        [key: string]: unknown;
+                    };
+                    /** @description When set, only this wallet can pay the session. An address on the store's chain */
+                    wallet?: string;
+                    /**
+                     * @description How long the session can be paid
+                     * @default 3600
+                     */
+                    expiresInSeconds?: number;
+                };
+            };
+        };
+        responses: {
+            /** @description A retry of a request already made under this `Idempotency-Key`; the session it opened */
+            200: {
+                headers: {
+                    "Idempotent-Replayed"?: "true";
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapCheckoutSession"];
+                };
+            };
+            /** @description The session. Send the buyer to `url` */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapCheckoutSession"];
+                };
+            };
+            /**
+             * @description `INVALID_REQUEST`, `IDEMPOTENCY_KEY_REQUIRED`, or `RETURN_URL_NOT_VERIFIED`: a return URL is not an
+             *     `https` page on one of the coin's verified sites
+             */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+            /** @description No store key, or one that is unknown or revoked (`INVALID_STORE_KEY`) */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+            /**
+             * @description `STORE_KEY_REQUIRED`: called with a signed-in session instead of a store key. `SCOPE_REQUIRED`: the key
+             *     lacks `orders:write`. `STORE_NOT_LIVE`: the store is paused or its plan lapsed. `SELLER_TERMS_REQUIRED`:
+             *     the wallet that opened the store has not signed the Seller Terms
+             */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+            /** @description `SKU_NOT_FOR_SALE`: no such item in the store. `CHECKOUT_SESSIONS_DISABLED`: not switched on here */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+            /**
+             * @description `SKU_NOT_FOR_SALE`: the item is archived, has no price or is an unlock. `APP_ITEM_NOT_SOLD_HERE`: the
+             *     item belongs to an app installed on the coin's page and cannot be sold from the coin's own site now.
+             *     `reason` says why: `not_allowed_outside_app` (the app's developer has not turned it on for this item),
+             *     `app_not_installed`, `terms_changed` (the coin's owner must accept the app's new terms on the coin's
+             *     page), `item_not_for_sale` (the app no longer sells it), or one of the `APP_NOT_SELLING` reasons
+             */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+            /**
+             * @description `IDEMPOTENCY_KEY_REUSED`: this `Idempotency-Key` already opened a session for a different request.
+             *     Nothing is returned or created; use a new key for a new session
+             */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+        };
+    };
+    getIapCheckoutSession: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The checkout session's id, `cs_` followed by 48 hex characters */
+                sessionId: components["parameters"]["IapCheckoutSessionId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The session */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapCheckoutSession"];
+                };
+            };
+            /** @description No store key, or one that is unknown or revoked */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+            /** @description `STORE_KEY_REQUIRED` (a signed-in session instead of a store key) or `SCOPE_REQUIRED` (the key lacks `orders:read`) */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["IapError"];
+                };
+            };
+            404: components["responses"]["IapNotFound"];
+        };
+    };
     getIapPublicCheckoutSession: {
         parameters: {
             query?: {

package/dist/cd.js

@@ -1,4 +1,4 @@
-"use strict";(()=>{var w="0.2.0";function b(t){let e="";for(let i of t)e+=String.fromCharCode(i);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function g(){return b(crypto.getRandomValues(new Uint8Array(32)))}function v(t,e,i,s){let c=a=>{if(a&&typeof a=="object"&&a.type===t)try{i(a)}catch{}},u=a=>{a.origin===e&&c(a.data)};window.addEventListener("message",u);let d=null;if(s&&typeof BroadcastChannel=="function"&&e===location.origin)try{d=new BroadcastChannel(s),d.onmessage=a=>c(a.data)}catch{d=null}return()=>{window.removeEventListener("message",u),d?.close()}}var h={get(t){try{return sessionStorage.getItem(t)}catch{return null}},set(t,e){try{sessionStorage.setItem(t,e)}catch{}},remove(t){try{sessionStorage.removeItem(t)}catch{}}};var A="https://api.chaindaddy.io",T={"https://api.chaindaddy.io":"https://chaindaddy.io/_oauth/authorize","https://staging-api.chaindaddy.io":"https://staging.chaindaddy.io/_oauth/authorize"},p="cd-signin",E="cd:signin",m="cd.signin";async function U(t){let e=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(t));return b(new Uint8Array(e))}function M(t="openid"){let e=t.split(/\s+/).filter(Boolean);return(e.includes("openid")?e:["openid",...e]).join(" ")}async function L(t,e,i){let s=new URLSearchParams({response_type:"code",client_id:e.clientId,redirect_uri:e.redirectUri,scope:M(t.scope),state:e.state,nonce:e.nonce,code_challenge:await U(e.verifier),code_challenge_method:"S256"});return t.claims&&s.set("claims",typeof t.claims=="string"?t.claims:JSON.stringify(t.claims)),`${i}?${s}`}function x(t,e){return{code:e,codeVerifier:t.verifier,state:t.state,nonce:t.nonce,issuer:t.issuer,clientId:t.clientId,redirectUri:t.redirectUri}}function f(t){let e=(t.issuer??A).replace(/\/$/,""),i=t.authorizeUrl??T[e];if(!i)return Promise.reject(new Error("authorizeUrl is required for this issuer"));if(!t.clientId||!t.redirectUri)return Promise.reject(new Error("clientId and redirectUri are required"));let s={state:g(),nonce:g(),verifier:g(),issuer:e,clientId:t.clientId,redirectUri:t.redirectUri};h.set(m,JSON.stringify(s));let c=window.open("",p,"popup,width=480,height=720");return(async()=>{let u=await L(t,s,i);if(!c)return location.assign(u),null;c.location.href=u;let d=new URL(t.redirectUri,location.href).origin;return new Promise((a,n)=>{let o=v(E,d,r=>{r.state===s.state&&(o(),h.remove(m),typeof r.error=="string"&&r.error?n(new Error(r.error)):r.iss!==e?n(new Error("the answer came from another issuer")):typeof r.code!="string"||!r.code?n(new Error("the answer carried no code")):a(x(s,r.code)))},p);t.signal?.addEventListener("abort",()=>{o(),n(new Error("aborted"))})})})()}async function S(){let t=new URLSearchParams(location.search),e={type:E,code:t.get("code"),state:t.get("state"),iss:t.get("iss"),error:t.get("error")};if(window.name===p){try{window.opener?.postMessage(e,location.origin)}catch{}try{let c=new BroadcastChannel(p);c.postMessage(e),c.close()}catch{}return window.close(),null}let i=h.get(m);h.remove(m);let s=i?JSON.parse(i):null;if(!s||e.state!==s.state)throw new Error("the sign-in state does not match: start again");if(e.error)throw new Error(e.error);if(e.iss!==s.issuer)throw new Error("the answer came from another issuer");if(!e.code)throw new Error("the answer carried no code");return x(s,e.code)}async function k(t){let e=await fetch(`${t.issuer}/api/v2/oauth/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:t.code,redirect_uri:t.redirectUri,client_id:t.clientId,code_verifier:t.codeVerifier})}),i=await e.json();if(!e.ok)throw new Error(`${i.error??e.status}: ${i.error_description??""}`.trim());return i}var O='<svg viewBox="0 0 24 24" fill="#FFD700" width="20" height="20" aria-hidden="true" xmlns="http://www.w3.org/2000/svg"><path d="M5 16L3 5l5.5 5L12 4l3.5 6L21 5l-2 11H5z" stroke="#B8860B" stroke-width="0.5"/><path d="M5 18h14v2H5v-2z" stroke="#B8860B" stroke-width="0.5"/></svg>',P=`
+"use strict";(()=>{var S="0.3.1";function v(t){let e="";for(let r of t)e+=String.fromCharCode(r);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function f(){return v(crypto.getRandomValues(new Uint8Array(32)))}function R(t,e,r,s,o){let d=n=>{if(n&&typeof n=="object"&&n.type===t)try{r(n)}catch{}},u=n=>{n.origin===e&&(!o||n.source===o)&&d(n.data)};window.addEventListener("message",u);let c=null;if(s&&typeof BroadcastChannel=="function"&&e===location.origin)try{c=new BroadcastChannel(s),c.onmessage=n=>d(n.data)}catch{c=null}return()=>{window.removeEventListener("message",u),c?.close()}}var m={get(t){try{return sessionStorage.getItem(t)}catch{return null}},set(t,e){try{sessionStorage.setItem(t,e)}catch{}},remove(t){try{sessionStorage.removeItem(t)}catch{}}};var q="https://api.chaindaddy.io",V={"https://api.chaindaddy.io":"https://chaindaddy.io/_oauth/authorize","https://staging-api.chaindaddy.io":"https://staging.chaindaddy.io/_oauth/authorize"},w="cd-signin",T="cd:signin",y="cd.signin";async function F(t){let e=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(t));return v(new Uint8Array(e))}function G(t="openid"){let e=t.split(/\s+/).filter(Boolean);return(e.includes("openid")?e:["openid",...e]).join(" ")}async function K(t,e,r){let s=new URLSearchParams({response_type:"code",client_id:e.clientId,redirect_uri:e.redirectUri,scope:G(t.scope),state:e.state,nonce:e.nonce,code_challenge:await F(e.verifier),code_challenge_method:"S256"});return t.claims&&s.set("claims",typeof t.claims=="string"?t.claims:JSON.stringify(t.claims)),`${r}?${s}`}function _(t,e){return{code:e,codeVerifier:t.verifier,state:t.state,nonce:t.nonce,issuer:t.issuer,clientId:t.clientId,redirectUri:t.redirectUri}}function b(t){let e=(t.issuer??q).replace(/\/$/,""),r=t.authorizeUrl??V[e];if(!r)return Promise.reject(new Error("authorizeUrl is required for this issuer"));if(!t.clientId||!t.redirectUri)return Promise.reject(new Error("clientId and redirectUri are required"));let s={state:f(),nonce:f(),verifier:f(),issuer:e,clientId:t.clientId,redirectUri:t.redirectUri};m.set(y,JSON.stringify(s));let o=window.open("",w,"popup,width=480,height=720");return(async()=>{let d=await K(t,s,r);if(!o)return location.assign(d),null;o.location.href=d;let u=new URL(t.redirectUri,location.href).origin;return new Promise((c,n)=>{let a=R(T,u,i=>{i.state===s.state&&(a(),m.remove(y),typeof i.error=="string"&&i.error?n(new Error(i.error)):i.iss!==e?n(new Error("the answer came from another issuer")):typeof i.code!="string"||!i.code?n(new Error("the answer carried no code")):c(_(s,i.code)))},w,o);t.signal?.addEventListener("abort",()=>{a(),n(new Error("aborted"))})})})()}async function U(){let t=new URLSearchParams(location.search),e={type:T,code:t.get("code"),state:t.get("state"),iss:t.get("iss"),error:t.get("error")};if(window.name===w){try{window.opener?.postMessage(e,location.origin)}catch{}try{let o=new BroadcastChannel(w);o.postMessage(e),o.close()}catch{}return window.close(),null}let r=m.get(y);m.remove(y);let s=r?JSON.parse(r):null;if(!s||e.state!==s.state)throw new Error("the sign-in state does not match: start again");if(e.error)throw new Error(e.error);if(e.iss!==s.issuer)throw new Error("the answer came from another issuer");if(!e.code)throw new Error("the answer carried no code");return _(s,e.code)}async function A(t){let e=await fetch(`${t.issuer}/api/v2/oauth/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:t.code,redirect_uri:t.redirectUri,client_id:t.clientId,code_verifier:t.codeVerifier})}),r=await e.json();if(!e.ok)throw new Error(`${r.error??e.status}: ${r.error_description??""}`.trim());return r}var W='<svg viewBox="0 0 24 24" fill="#FFD700" width="20" height="20" aria-hidden="true" xmlns="http://www.w3.org/2000/svg"><path d="M5 16L3 5l5.5 5L12 4l3.5 6L21 5l-2 11H5z" stroke="#B8860B" stroke-width="0.5"/><path d="M5 18h14v2H5v-2z" stroke="#B8860B" stroke-width="0.5"/></svg>',Y=`
 :host { display: inline-block; }
 button { display: inline-flex; align-items: center; justify-content: center; gap: 10px; box-sizing: border-box;
   min-height: 40px; padding: 0 16px; border-radius: 10px; font: 600 15px/1 system-ui, -apple-system, "Segoe UI", sans-serif;
@@ -7,16 +7,16 @@ button[data-theme="dark"] { background: #101828; color: #ffffff; border-color: #
 button:focus-visible { outline: 2px solid #f59e0b; outline-offset: 2px; }
 button:disabled { opacity: .6; cursor: default; }
 svg { flex: none; }
-`;function I(){if(typeof customElements>"u"||customElements.get("cd-signin-button"))return;class t extends HTMLElement{constructor(){super(),this.root=this.attachShadow({mode:"open"})}connectedCallback(){this.render()}attributeChangedCallback(){this.isConnected&&this.render()}render(){let i=this.getAttribute("text")==="continue"?"Continue with Chain Daddy":"Sign in with Chain Daddy",s=this.getAttribute("theme")==="dark"?"dark":"light";this.root.innerHTML=`<style>${P}</style><button type="button" part="button" data-theme="${s}">${O}<span></span></button>`;let c=this.root.querySelector("button");c.querySelector("span").textContent=i,c.addEventListener("click",()=>this.start())}start(){let i=s=>this.getAttribute(s)||void 0;f({clientId:i("client-id")??"",redirectUri:i("redirect-uri")??"",scope:i("scope"),claims:i("claims"),issuer:i("issuer"),authorizeUrl:i("authorize-url")}).then(s=>s&&this.dispatchEvent(new CustomEvent("cd-signin",{detail:s,bubbles:!0,composed:!0})),s=>this.dispatchEvent(new CustomEvent("cd-signin-error",{detail:{message:String(s?.message??s)},bubbles:!0,composed:!0})))}}t.observedAttributes=["theme","text"],customElements.define("cd-signin-button",t)}var C="https://embed.chaindaddy.io",y="https://embed-staging.chaindaddy.io";var H=["--cd-accent","--cd-surface","--cd-text","--cd-text-muted","--cd-border"];function _(t){try{if(t&&new URL(t).hostname==="js.staging.chaindaddy.io")return y}catch{}return C}var D=`
+`;function L(){if(typeof customElements>"u"||customElements.get("cd-signin-button"))return;class t extends HTMLElement{constructor(){super(),this.root=this.attachShadow({mode:"open"})}connectedCallback(){this.render()}attributeChangedCallback(){this.isConnected&&this.render()}render(){let r=this.getAttribute("text")==="continue"?"Continue with Chain Daddy":"Sign in with Chain Daddy",s=this.getAttribute("theme")==="dark"?"dark":"light";this.root.innerHTML=`<style>${Y}</style><button type="button" part="button" data-theme="${s}">${W}<span></span></button>`;let o=this.root.querySelector("button");o.querySelector("span").textContent=r,o.addEventListener("click",()=>this.start())}start(){let r=s=>this.getAttribute(s)||void 0;b({clientId:r("client-id")??"",redirectUri:r("redirect-uri")??"",scope:r("scope"),claims:r("claims"),issuer:r("issuer"),authorizeUrl:r("authorize-url")}).then(s=>s&&this.dispatchEvent(new CustomEvent("cd-signin",{detail:s,bubbles:!0,composed:!0})),s=>this.dispatchEvent(new CustomEvent("cd-signin-error",{detail:{message:String(s?.message??s)},bubbles:!0,composed:!0})))}}t.observedAttributes=["theme","text"],customElements.define("cd-signin-button",t)}var M="https://embed.chaindaddy.io",k="https://embed-staging.chaindaddy.io";var J=["--cd-accent","--cd-surface","--cd-text","--cd-text-muted","--cd-border"];function P(t){try{if(t&&new URL(t).hostname==="js.staging.chaindaddy.io")return k}catch{}return M}var X=`
 :host { display: block; }
 iframe { display: block; width: 100%; border: 0; height: 1px; opacity: 0; color-scheme: normal; }
 :host([data-cd-ready]) iframe { opacity: 1; }
 :host([data-cd-ready]) slot { display: none; }
 :host([data-cd-unavailable]) iframe { display: none; }
-`,z=`
+`,Q=`
 :host { display: inline-block; }
 button { box-sizing: border-box; min-height: 40px; padding: 0 16px; border-radius: 10px; cursor: pointer;
   font: 600 15px/1 system-ui, -apple-system, "Segoe UI", sans-serif;
   border: 1px solid var(--cd-border, #d0d5dd); background: var(--cd-accent, #f59e0b); color: var(--cd-text, #101828); }
 button:focus-visible { outline: 2px solid var(--cd-accent, #f59e0b); outline-offset: 2px; }
-`;function R(t={}){try{if(typeof customElements>"u"||typeof HTMLElement>"u")return;let e=t.origin===y?y:C;class i extends HTMLElement{constructor(){super(...arguments);this.kind="app";this.frame=null;this.onMessage=n=>this.receive(n)}connectedCallback(){try{this.shadowRoot||this.attachShadow({mode:"open"}),this.mount()}catch{this.unavailable()}}disconnectedCallback(){try{window.removeEventListener("message",this.onMessage),clearTimeout(this.timer)}catch{}}attributeChangedCallback(){try{this.isConnected&&this.shadowRoot&&this.mount()}catch{this.unavailable()}}src(){let n=(this.getAttribute("crown")??"").trim(),o=(this.getAttribute("chain")??"").trim(),r=(this.getAttribute("app")??"").trim();if(!/^[0-9]{1,18}$/.test(n)||!o||this.kind==="app"&&!r)return null;let l=new URLSearchParams({crown:n,chain:o});return this.kind==="app"?l.set("app",r):l.set("kind","coin"),l.set("mode",this.mode()),l.set("v","1"),`${e}/v1/frame?${l.toString()}`}mode(){let n=this.getAttribute("mode");if(n==="light"||n==="dark")return n;try{return window.matchMedia("(prefers-color-scheme: dark)").matches?"dark":"light"}catch{return"light"}}mount(){let n=this.shadowRoot;window.removeEventListener("message",this.onMessage),clearTimeout(this.timer),this.removeAttribute("data-cd-ready"),this.removeAttribute("data-cd-unavailable");let o=this.src();if(!o){n.innerHTML="<slot></slot>",this.frame=null;return}n.innerHTML=`<style>${D}</style><slot></slot>`;let r=document.createElement("iframe");r.setAttribute("loading","lazy"),r.setAttribute("referrerpolicy","strict-origin-when-cross-origin"),r.setAttribute("allow","clipboard-write; fullscreen"),r.setAttribute("title",this.kind==="coin"?"Coin on Chain Daddy":"App on Chain Daddy"),r.src=o,n.appendChild(r),this.frame=r,window.addEventListener("message",this.onMessage),this.timer=setTimeout(()=>{this.hasAttribute("data-cd-ready")||this.unavailable()},8e3)}receive(n){try{if(n.origin!==e||!this.frame||!n.source||n.source!==this.frame.contentWindow)return;let o=n.data;if(!o||typeof o!="object")return;if(o.type==="cd:ready")clearTimeout(this.timer),this.removeAttribute("data-cd-unavailable"),this.setAttribute("data-cd-ready",""),this.sendTheme(),this.dispatchEvent(new CustomEvent("cd:ready"));else if(o.type==="cd:resize"){let r=Number(o.height);Number.isFinite(r)&&(this.frame.style.height=`${Math.max(1,Math.min(4e3,Math.ceil(r)))}px`)}else o.type==="cd:unavailable"&&this.unavailable()}catch{}}sendTheme(){let n={},o=getComputedStyle(this);for(let r of H){let l=o.getPropertyValue(r).trim();l&&(n[r]=l)}this.frame?.contentWindow?.postMessage({type:"cd:theme",tokens:n},e)}unavailable(){try{if(clearTimeout(this.timer),this.removeAttribute("data-cd-ready"),this.hasAttribute("data-cd-unavailable"))return;this.setAttribute("data-cd-unavailable",""),this.dispatchEvent(new CustomEvent("cd:unavailable"))}catch{}}}i.observedAttributes=["crown","chain","app","mode"];class s extends i{}class c extends i{constructor(){super(...arguments);this.kind="coin"}}class u extends HTMLElement{connectedCallback(){try{let a=this.querySelector("a[href]"),n=a?new URL(a.getAttribute("href")??"",document.baseURI):null;if(!n||n.protocol!=="https:")return;let o=this.shadowRoot??this.attachShadow({mode:"open"});o.innerHTML=`<style>${z}</style><button type="button" part="button"></button>`;let r=o.querySelector("button");r.textContent=(a.textContent??"").trim()||"Buy on Chain Daddy",r.addEventListener("click",()=>{try{window.open(n.toString(),"cd-buy","popup,width=460,height=760")||window.location.assign(n.toString())}catch{}})}catch{}}}for(let[d,a]of[["cd-app",s],["cd-coin",c],["cd-buy",u]])customElements.get(d)||customElements.define(d,a)}catch{}}var N={version:w,signIn:f,handleCallback:S,exchangeCode:k};window.ChainDaddy=Object.assign(window.ChainDaddy??{},N);I();R({origin:_(document.currentScript?.src)});})();
+`;function O(t={}){try{if(typeof customElements>"u"||typeof HTMLElement>"u")return;let e=t.origin===k?k:M;class r extends HTMLElement{constructor(){super(...arguments);this.kind="app";this.frame=null;this.onMessage=n=>this.receive(n)}connectedCallback(){try{this.shadowRoot||this.attachShadow({mode:"open"}),this.mount()}catch{this.unavailable()}}disconnectedCallback(){try{window.removeEventListener("message",this.onMessage),clearTimeout(this.timer)}catch{}}attributeChangedCallback(){try{this.isConnected&&this.shadowRoot&&this.mount()}catch{this.unavailable()}}src(){let n=(this.getAttribute("crown")??"").trim(),a=(this.getAttribute("chain")??"").trim(),i=(this.getAttribute("app")??"").trim();if(!/^[0-9]{1,18}$/.test(n)||!a||this.kind==="app"&&!i)return null;let l=new URLSearchParams({crown:n,chain:a});return this.kind==="app"?l.set("app",i):l.set("kind","coin"),l.set("mode",this.mode()),l.set("v","1"),`${e}/v1/frame?${l.toString()}`}mode(){let n=this.getAttribute("mode");if(n==="light"||n==="dark")return n;try{return window.matchMedia("(prefers-color-scheme: dark)").matches?"dark":"light"}catch{return"light"}}mount(){let n=this.shadowRoot;window.removeEventListener("message",this.onMessage),clearTimeout(this.timer),this.removeAttribute("data-cd-ready"),this.removeAttribute("data-cd-unavailable");let a=this.src();if(!a){n.innerHTML="<slot></slot>",this.frame=null;return}n.innerHTML=`<style>${X}</style><slot></slot>`;let i=document.createElement("iframe");i.setAttribute("loading","lazy"),i.setAttribute("referrerpolicy","strict-origin-when-cross-origin"),i.setAttribute("allow","clipboard-write; fullscreen"),i.setAttribute("title",this.kind==="coin"?"Coin on Chain Daddy":"App on Chain Daddy"),i.src=a,n.appendChild(i),this.frame=i,window.addEventListener("message",this.onMessage),this.timer=setTimeout(()=>{this.hasAttribute("data-cd-ready")||this.unavailable()},8e3)}receive(n){try{if(n.origin!==e||!this.frame||!n.source||n.source!==this.frame.contentWindow)return;let a=n.data;if(!a||typeof a!="object")return;if(a.type==="cd:ready")clearTimeout(this.timer),this.removeAttribute("data-cd-unavailable"),this.setAttribute("data-cd-ready",""),this.sendTheme(),this.dispatchEvent(new CustomEvent("cd:ready"));else if(a.type==="cd:resize"){let i=Number(a.height);Number.isFinite(i)&&(this.frame.style.height=`${Math.max(1,Math.min(4e3,Math.ceil(i)))}px`)}else a.type==="cd:unavailable"&&this.unavailable()}catch{}}sendTheme(){let n={},a=getComputedStyle(this);for(let i of J){let l=a.getPropertyValue(i).trim();l&&(n[i]=l)}this.frame?.contentWindow?.postMessage({type:"cd:theme",tokens:n},e)}unavailable(){try{if(clearTimeout(this.timer),this.removeAttribute("data-cd-ready"),this.hasAttribute("data-cd-unavailable"))return;this.setAttribute("data-cd-unavailable",""),this.dispatchEvent(new CustomEvent("cd:unavailable"))}catch{}}}r.observedAttributes=["crown","chain","app","mode"];class s extends r{}class o extends r{constructor(){super(...arguments);this.kind="coin"}}class d extends HTMLElement{connectedCallback(){try{let c=this.querySelector("a[href]"),n=c?new URL(c.getAttribute("href")??"",document.baseURI):null;if(!n||n.protocol!=="https:")return;let a=this.shadowRoot??this.attachShadow({mode:"open"});a.innerHTML=`<style>${Q}</style><button type="button" part="button"></button>`;let i=a.querySelector("button");i.textContent=(c.textContent??"").trim()||"Buy on Chain Daddy",i.addEventListener("click",()=>{try{window.open(n.toString(),"cd-buy","popup,width=460,height=760")||window.location.assign(n.toString())}catch{}})}catch{}}}for(let[u,c]of[["cd-app",s],["cd-coin",o],["cd-buy",d]])customElements.get(u)||customElements.define(u,c)}catch{}}var Z=["https://chaindaddy.io","https://staging.chaindaddy.io"],D=()=>"cd-checkout-"+f(),H="popup,width=480,height=820",$=300,tt=7;function E(t){if(typeof t!="string")return null;let e;try{e=new URL(t)}catch{return null}let r=/^\/_pay\/([\w-]+)$/.exec(e.pathname);return r&&Z.includes(e.origin)&&!e.username&&!e.password?{href:e.origin+e.pathname,origin:e.origin,id:r[1]}:null}function C(t,e){if(typeof t!="string")return null;let r;try{r=new URL(t,location.href)}catch{return null}if(!/^https?:$/.test(r.protocol)||r.username||r.password)return null;let s=d=>{let u=d.split("=")[0];try{return decodeURIComponent(u.replace(/\+/g," "))}catch{return u}},o=r.search.slice(1).split("&").filter(d=>d&&s(d)!=="session_id");return o.push("session_id="+encodeURIComponent(e)),r.origin+r.pathname+"?"+o.join("&")+r.hash}var p;function N(t,e,r){return new Promise(s=>{let o=!1,d=0,u,c=l=>{clearInterval(i),clearTimeout(u),window.removeEventListener("message",n),r&&l.status==="completed"&&location.assign(r),s(l)},n=l=>{if(l.origin!==e.origin||l.source!==t)return;let g=l.data;if(!g||typeof g!="object")return;g.type==="cd:checkout.ready"&&(o=!0);let h=g.session;if(!(!h||typeof h!="object"||h.id!==e.id)){if(g.type==="cd:checkout.cancelled")c({status:"cancelled",session:{id:e.id}});else if(g.type==="cd:checkout.completed"&&(h.status==="complete"||h.status==="paid")){let I={id:e.id,status:h.status};typeof h.orderId=="string"&&/^[\w-]{1,128}$/.test(h.orderId)&&(I.orderId=h.orderId),c({status:"completed",session:I})}}},a=()=>{try{t.postMessage({type:"cd:checkout.hello"},e.origin)}catch{}},i=setInterval(()=>{t.closed?(clearInterval(i),u=setTimeout(()=>c({status:"closed"}),$)):(!o||++d%tt===0)&&a()},$);window.addEventListener("message",n),a()})}function x(t){let e=()=>new Error("checkout: url is not a Chain Daddy checkout session link"),r=(o,d,u)=>{p={popup:o,result:d,href:u};let c=()=>{p&&p.popup===o&&(p=void 0)};return d.then(c,c),d},s=o=>(location.assign(o.href),{status:"redirected"});try{let{url:o,successUrl:d}=t;if(d&&!C(d,""))throw new Error("checkout: successUrl is not a web address");let u=i=>d?C(d,i.id):null,c=typeof o=="function"?null:E(o);if(typeof o!="function"&&!c)throw e();if(p&&!p.popup.closed&&(!c||p.href===c.href))return p.popup.focus(),p.result;if(c){let i=window.open(c.href,D(),H);return i?r(i,N(i,c,u(c)),c.href):Promise.resolve(s(c))}let n=window.open("",D(),H),a=new Promise(i=>i(o())).then(i=>{let l=E(i);if(!l)throw n?.close(),e();return n?(n.location.href=l.href,N(n,l,u(l))):s(l)},i=>{throw n?.close(),i});return n?r(n,a):a}catch(o){return Promise.reject(o)}}var B=!1,z;function j(){B||typeof document>"u"||(B=!0,document.addEventListener("click",t=>{let e=t.target instanceof Element?t.target.closest("[data-cd-checkout]"):null;if(!e||t.defaultPrevented||t.button||t.metaKey||t.ctrlKey||t.shiftKey||t.altKey)return;let r=e.getAttribute("data-cd-checkout")||e.href,s=e.getAttribute("data-cd-success");if(!E(r)||s&&!C(s,""))return;t.preventDefault();let o=x({url:r,successUrl:s});o!==z&&(z=o,o.then(d=>void e.dispatchEvent(new CustomEvent("cd:checkout",{detail:d,bubbles:!0})),()=>{}))}))}var et={version:S,signIn:b,handleCallback:U,exchangeCode:A,checkout:x};window.ChainDaddy=Object.assign(window.ChainDaddy??{},et);L();O({origin:P(document.currentScript?.src)});j();})();

package/dist/cd.js.sri

@@ -1 +1 @@
-sha384-KKpjQXvfR3Rs+FsdOW+hfEJcZpfuYVXR+TcyRX0nbup+s/xRhLx102TTXL29eFE1
+sha384-EF2XlOLUJ0J2U3uy/hlkmXdqyRP0WVm2LYjWdTseg/+QC4El1HD+qMhMlandYcSF

package/dist/checkout.d.ts

@@ -0,0 +1,73 @@
+export interface CheckoutOptions {
+    /**
+     * The session's `url`, or a function that fetches it. With a function the
+     * popup opens blank at once (inside the click) and goes to the link when it
+     * arrives.
+     */
+    url: string | (() => string | Promise<string>);
+    /**
+     * Where your page goes once the buyer has paid, with `session_id` added, as
+     * the checkout's own return does. Left out, the call only resolves. The
+     * checkout never tells this page where to go.
+     */
+    successUrl?: string | null;
+}
+export type CheckoutResult = 
+/** The buyer paid. `session.status` is "complete" (confirmed) or "paid" (sent, still confirming). */
+{
+    status: 'completed';
+    session: {
+        id: string;
+        status: 'complete' | 'paid';
+        orderId?: string;
+    };
+}
+/** The buyer left the checkout without paying. */
+ | {
+    status: 'cancelled';
+    session: {
+        id: string;
+    };
+}
+/** The popup closed and said nothing: read the session on your server to know. */
+ | {
+    status: 'closed';
+}
+/** The popup was blocked, so this page is going to the session by link. */
+ | {
+    status: 'redirected';
+};
+/** A session page: its address as parsed, its origin, and the session's id. */
+export interface CheckoutTarget {
+    href: string;
+    origin: string;
+    id: string;
+}
+/**
+ * The session page `url` names, or null when it is anything else. Exact
+ * origin (so https, our host, no port), no credentials, and the path
+ * /_pay/<id> and nothing under it, all read from the parsed URL: never a
+ * prefix test on the string, which "https://chaindaddy.io@evil.example/_pay/x"
+ * passes. `href` is the page and nothing more: a query or fragment on the
+ * link is dropped, so nothing rides into our site on a checkout link.
+ */
+export declare function parseCheckoutUrl(url: unknown): CheckoutTarget | null;
+/**
+ * Opens a checkout session in a popup. Call it from a click handler: the popup
+ * opens at once, or a browser blocks it. Resolves with how it ended; rejects,
+ * before any window opens or moves, when `url` is not a checkout session link.
+ * When the popup is blocked, the page goes to the session by link instead.
+ */
+export declare function checkout(o: CheckoutOptions): Promise<CheckoutResult>;
+/**
+ * Makes every element with `data-cd-checkout` open its session in the popup:
+ * a link by its `href`, anything else by the attribute's value. One listener
+ * on the document, so elements added later work too. On a link this only adds
+ * to what the link already does: without this script, with a modifier key, or
+ * when the address is not a session link, the link is followed as usual.
+ *
+ * When the visit ends the element fires `cd:checkout` (bubbling) with the
+ * result as `detail`; once the buyer has paid, the page goes to the element's
+ * `data-cd-success`, if it has one.
+ */
+export declare function bindCheckoutButtons(): void;

package/dist/checkout.js

@@ -0,0 +1,168 @@
+// src/core.ts
+function b64url(bytes) {
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomToken() {
+  return b64url(crypto.getRandomValues(new Uint8Array(32)));
+}
+
+// src/checkout.ts
+var ORIGINS = ["https://chaindaddy.io", "https://staging.chaindaddy.io"];
+var windowName = () => "cd-checkout-" + randomToken();
+var FEATURES = "popup,width=480,height=820";
+var TICK_MS = 300;
+var QUIET_TICKS = 7;
+function parseCheckoutUrl(url) {
+  if (typeof url !== "string") return null;
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return null;
+  }
+  const m = /^\/_pay\/([\w-]+)$/.exec(u.pathname);
+  return m && ORIGINS.includes(u.origin) && !u.username && !u.password ? { href: u.origin + u.pathname, origin: u.origin, id: m[1] } : null;
+}
+function successTarget(successUrl, id) {
+  if (typeof successUrl !== "string") return null;
+  let u;
+  try {
+    u = new URL(successUrl, location.href);
+  } catch {
+    return null;
+  }
+  if (!/^https?:$/.test(u.protocol) || u.username || u.password) return null;
+  const key = (pair) => {
+    const raw = pair.split("=")[0];
+    try {
+      return decodeURIComponent(raw.replace(/\+/g, " "));
+    } catch {
+      return raw;
+    }
+  };
+  const pairs = u.search.slice(1).split("&").filter((pair) => pair && key(pair) !== "session_id");
+  pairs.push("session_id=" + encodeURIComponent(id));
+  return u.origin + u.pathname + "?" + pairs.join("&") + u.hash;
+}
+var current;
+function wait(popup, target, success) {
+  return new Promise((resolve) => {
+    let ready = false;
+    let quiet = 0;
+    let last;
+    const done = (result) => {
+      clearInterval(timer);
+      clearTimeout(last);
+      window.removeEventListener("message", onMessage);
+      if (success && result.status === "completed") location.assign(success);
+      resolve(result);
+    };
+    const onMessage = (e) => {
+      if (e.origin !== target.origin || e.source !== popup) return;
+      const data = e.data;
+      if (!data || typeof data !== "object") return;
+      if (data.type === "cd:checkout.ready") ready = true;
+      const s = data.session;
+      if (!s || typeof s !== "object" || s.id !== target.id) return;
+      if (data.type === "cd:checkout.cancelled") done({ status: "cancelled", session: { id: target.id } });
+      else if (data.type === "cd:checkout.completed" && (s.status === "complete" || s.status === "paid")) {
+        const session = { id: target.id, status: s.status };
+        if (typeof s.orderId === "string" && /^[\w-]{1,128}$/.test(s.orderId)) session.orderId = s.orderId;
+        done({ status: "completed", session });
+      }
+    };
+    const hello = () => {
+      try {
+        popup.postMessage({ type: "cd:checkout.hello" }, target.origin);
+      } catch {
+      }
+    };
+    const timer = setInterval(() => {
+      if (popup.closed) {
+        clearInterval(timer);
+        last = setTimeout(() => done({ status: "closed" }), TICK_MS);
+      } else if (!ready || ++quiet % QUIET_TICKS === 0) hello();
+    }, TICK_MS);
+    window.addEventListener("message", onMessage);
+    hello();
+  });
+}
+function checkout(o) {
+  const refused = () => new Error("checkout: url is not a Chain Daddy checkout session link");
+  const track = (popup, result, href) => {
+    current = { popup, result, href };
+    const over = () => {
+      if (current && current.popup === popup) current = void 0;
+    };
+    result.then(over, over);
+    return result;
+  };
+  const byLink = (target) => {
+    location.assign(target.href);
+    return { status: "redirected" };
+  };
+  try {
+    const { url, successUrl } = o;
+    if (successUrl && !successTarget(successUrl, "")) throw new Error("checkout: successUrl is not a web address");
+    const success = (t) => successUrl ? successTarget(successUrl, t.id) : null;
+    const target = typeof url === "function" ? null : parseCheckoutUrl(url);
+    if (typeof url !== "function" && !target) throw refused();
+    if (current && !current.popup.closed && (!target || current.href === target.href)) {
+      current.popup.focus();
+      return current.result;
+    }
+    if (target) {
+      const popup2 = window.open(target.href, windowName(), FEATURES);
+      return popup2 ? track(popup2, wait(popup2, target, success(target)), target.href) : Promise.resolve(byLink(target));
+    }
+    const popup = window.open("", windowName(), FEATURES);
+    const result = new Promise((resolve) => resolve(url())).then(
+      (fetched) => {
+        const t = parseCheckoutUrl(fetched);
+        if (!t) {
+          popup?.close();
+          throw refused();
+        }
+        if (!popup) return byLink(t);
+        popup.location.href = t.href;
+        return wait(popup, t, success(t));
+      },
+      (e) => {
+        popup?.close();
+        throw e;
+      }
+    );
+    return popup ? track(popup, result) : result;
+  } catch (e) {
+    return Promise.reject(e);
+  }
+}
+var bound = false;
+var reporting;
+function bindCheckoutButtons() {
+  if (bound || typeof document === "undefined") return;
+  bound = true;
+  document.addEventListener("click", (e) => {
+    const el = e.target instanceof Element ? e.target.closest("[data-cd-checkout]") : null;
+    if (!el || e.defaultPrevented || e.button || e.metaKey || e.ctrlKey || e.shiftKey || e.altKey) return;
+    const url = el.getAttribute("data-cd-checkout") || el.href;
+    const successUrl = el.getAttribute("data-cd-success");
+    if (!parseCheckoutUrl(url) || successUrl && !successTarget(successUrl, "")) return;
+    e.preventDefault();
+    const visit = checkout({ url, successUrl });
+    if (visit === reporting) return;
+    reporting = visit;
+    visit.then(
+      (detail) => void el.dispatchEvent(new CustomEvent("cd:checkout", { detail, bubbles: true })),
+      () => {
+      }
+    );
+  });
+}
+export {
+  bindCheckoutButtons,
+  checkout,
+  parseCheckoutUrl
+};

package/dist/core.d.ts

@@ -6,9 +6,10 @@ export declare function randomToken(): string;
 /**
  * Listens for messages of `type` from exactly `origin`, on window and on a
  * same-origin BroadcastChannel (which still works when a COOP header has
- * severed window.opener). Returns a function that stops listening.
+ * severed window.opener). With `from`, a window message counts only when
+ * that window sent it. Returns a function that stops listening.
  */
-export declare function listen(type: string, origin: string, onMessage: (data: Record<string, unknown>) => void, channel?: string): () => void;
+export declare function listen(type: string, origin: string, onMessage: (data: Record<string, unknown>) => void, channel?: string, from?: Window | null): () => void;
 /** sessionStorage that never throws (private windows, blocked storage). */
 export declare const store: {
     get(key: string): string | null;

package/dist/index.d.ts

@@ -4,3 +4,5 @@ export type { SignInOptions, SignInResult } from './signin';
 export { defineSignInButton } from './button';
 export { defineEmbedElements, embedOriginFor } from './embed';
 export type { EmbedOptions } from './embed';
+export { bindCheckoutButtons, checkout, parseCheckoutUrl } from './checkout';
+export type { CheckoutOptions, CheckoutResult, CheckoutTarget } from './checkout';

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/core.ts
-var VERSION = true ? "0.2.0" : "0.0.0";
+var VERSION = true ? "0.3.1" : "0.0.0";
 function b64url(bytes) {
   let s = "";
   for (const b of bytes) s += String.fromCharCode(b);
@@ -8,7 +8,7 @@ function b64url(bytes) {
 function randomToken() {
   return b64url(crypto.getRandomValues(new Uint8Array(32)));
 }
-function listen(type, origin, onMessage, channel) {
+function listen(type, origin, onMessage, channel, from) {
   const accept = (data) => {
     if (data && typeof data === "object" && data.type === type) {
       try {
@@ -18,7 +18,7 @@ function listen(type, origin, onMessage, channel) {
     }
   };
   const onWindow = (e) => {
-    if (e.origin === origin) accept(e.data);
+    if (e.origin === origin && (!from || e.source === from)) accept(e.data);
   };
   window.addEventListener("message", onWindow);
   let bc = null;
@@ -116,7 +116,7 @@ function signIn(o) {
         else if (m.iss !== issuer) reject(new Error("the answer came from another issuer"));
         else if (typeof m.code !== "string" || !m.code) reject(new Error("the answer carried no code"));
         else resolve(result(p, m.code));
-      }, POPUP_NAME);
+      }, POPUP_NAME, popup);
       o.signal?.addEventListener("abort", () => {
         stop();
         reject(new Error("aborted"));
@@ -397,14 +397,171 @@ function defineEmbedElements(options = {}) {
   } catch {
   }
 }
+
+// src/checkout.ts
+var ORIGINS = ["https://chaindaddy.io", "https://staging.chaindaddy.io"];
+var windowName = () => "cd-checkout-" + randomToken();
+var FEATURES = "popup,width=480,height=820";
+var TICK_MS = 300;
+var QUIET_TICKS = 7;
+function parseCheckoutUrl(url) {
+  if (typeof url !== "string") return null;
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return null;
+  }
+  const m = /^\/_pay\/([\w-]+)$/.exec(u.pathname);
+  return m && ORIGINS.includes(u.origin) && !u.username && !u.password ? { href: u.origin + u.pathname, origin: u.origin, id: m[1] } : null;
+}
+function successTarget(successUrl, id) {
+  if (typeof successUrl !== "string") return null;
+  let u;
+  try {
+    u = new URL(successUrl, location.href);
+  } catch {
+    return null;
+  }
+  if (!/^https?:$/.test(u.protocol) || u.username || u.password) return null;
+  const key = (pair) => {
+    const raw = pair.split("=")[0];
+    try {
+      return decodeURIComponent(raw.replace(/\+/g, " "));
+    } catch {
+      return raw;
+    }
+  };
+  const pairs = u.search.slice(1).split("&").filter((pair) => pair && key(pair) !== "session_id");
+  pairs.push("session_id=" + encodeURIComponent(id));
+  return u.origin + u.pathname + "?" + pairs.join("&") + u.hash;
+}
+var current;
+function wait(popup, target, success) {
+  return new Promise((resolve) => {
+    let ready = false;
+    let quiet = 0;
+    let last;
+    const done = (result2) => {
+      clearInterval(timer);
+      clearTimeout(last);
+      window.removeEventListener("message", onMessage);
+      if (success && result2.status === "completed") location.assign(success);
+      resolve(result2);
+    };
+    const onMessage = (e) => {
+      if (e.origin !== target.origin || e.source !== popup) return;
+      const data = e.data;
+      if (!data || typeof data !== "object") return;
+      if (data.type === "cd:checkout.ready") ready = true;
+      const s = data.session;
+      if (!s || typeof s !== "object" || s.id !== target.id) return;
+      if (data.type === "cd:checkout.cancelled") done({ status: "cancelled", session: { id: target.id } });
+      else if (data.type === "cd:checkout.completed" && (s.status === "complete" || s.status === "paid")) {
+        const session = { id: target.id, status: s.status };
+        if (typeof s.orderId === "string" && /^[\w-]{1,128}$/.test(s.orderId)) session.orderId = s.orderId;
+        done({ status: "completed", session });
+      }
+    };
+    const hello = () => {
+      try {
+        popup.postMessage({ type: "cd:checkout.hello" }, target.origin);
+      } catch {
+      }
+    };
+    const timer = setInterval(() => {
+      if (popup.closed) {
+        clearInterval(timer);
+        last = setTimeout(() => done({ status: "closed" }), TICK_MS);
+      } else if (!ready || ++quiet % QUIET_TICKS === 0) hello();
+    }, TICK_MS);
+    window.addEventListener("message", onMessage);
+    hello();
+  });
+}
+function checkout(o) {
+  const refused = () => new Error("checkout: url is not a Chain Daddy checkout session link");
+  const track = (popup, result2, href) => {
+    current = { popup, result: result2, href };
+    const over = () => {
+      if (current && current.popup === popup) current = void 0;
+    };
+    result2.then(over, over);
+    return result2;
+  };
+  const byLink = (target) => {
+    location.assign(target.href);
+    return { status: "redirected" };
+  };
+  try {
+    const { url, successUrl } = o;
+    if (successUrl && !successTarget(successUrl, "")) throw new Error("checkout: successUrl is not a web address");
+    const success = (t) => successUrl ? successTarget(successUrl, t.id) : null;
+    const target = typeof url === "function" ? null : parseCheckoutUrl(url);
+    if (typeof url !== "function" && !target) throw refused();
+    if (current && !current.popup.closed && (!target || current.href === target.href)) {
+      current.popup.focus();
+      return current.result;
+    }
+    if (target) {
+      const popup2 = window.open(target.href, windowName(), FEATURES);
+      return popup2 ? track(popup2, wait(popup2, target, success(target)), target.href) : Promise.resolve(byLink(target));
+    }
+    const popup = window.open("", windowName(), FEATURES);
+    const result2 = new Promise((resolve) => resolve(url())).then(
+      (fetched) => {
+        const t = parseCheckoutUrl(fetched);
+        if (!t) {
+          popup?.close();
+          throw refused();
+        }
+        if (!popup) return byLink(t);
+        popup.location.href = t.href;
+        return wait(popup, t, success(t));
+      },
+      (e) => {
+        popup?.close();
+        throw e;
+      }
+    );
+    return popup ? track(popup, result2) : result2;
+  } catch (e) {
+    return Promise.reject(e);
+  }
+}
+var bound = false;
+var reporting;
+function bindCheckoutButtons() {
+  if (bound || typeof document === "undefined") return;
+  bound = true;
+  document.addEventListener("click", (e) => {
+    const el = e.target instanceof Element ? e.target.closest("[data-cd-checkout]") : null;
+    if (!el || e.defaultPrevented || e.button || e.metaKey || e.ctrlKey || e.shiftKey || e.altKey) return;
+    const url = el.getAttribute("data-cd-checkout") || el.href;
+    const successUrl = el.getAttribute("data-cd-success");
+    if (!parseCheckoutUrl(url) || successUrl && !successTarget(successUrl, "")) return;
+    e.preventDefault();
+    const visit = checkout({ url, successUrl });
+    if (visit === reporting) return;
+    reporting = visit;
+    visit.then(
+      (detail) => void el.dispatchEvent(new CustomEvent("cd:checkout", { detail, bubbles: true })),
+      () => {
+      }
+    );
+  });
+}
 export {
   DEFAULT_ISSUER,
   VERSION,
+  bindCheckoutButtons,
   challengeFor,
+  checkout,
   defineEmbedElements,
   defineSignInButton,
   embedOriginFor,
   exchangeCode,
   handleCallback,
+  parseCheckoutUrl,
   signIn
 };

package/dist/signin.js

@@ -7,7 +7,7 @@ function b64url(bytes) {
 function randomToken() {
   return b64url(crypto.getRandomValues(new Uint8Array(32)));
 }
-function listen(type, origin, onMessage, channel) {
+function listen(type, origin, onMessage, channel, from) {
   const accept = (data) => {
     if (data && typeof data === "object" && data.type === type) {
       try {
@@ -17,7 +17,7 @@ function listen(type, origin, onMessage, channel) {
     }
   };
   const onWindow = (e) => {
-    if (e.origin === origin) accept(e.data);
+    if (e.origin === origin && (!from || e.source === from)) accept(e.data);
   };
   window.addEventListener("message", onWindow);
   let bc = null;
@@ -115,7 +115,7 @@ function signIn(o) {
         else if (m.iss !== issuer) reject(new Error("the answer came from another issuer"));
         else if (typeof m.code !== "string" || !m.code) reject(new Error("the answer carried no code"));
         else resolve(result(p, m.code));
-      }, POPUP_NAME);
+      }, POPUP_NAME, popup);
       o.signal?.addEventListener("abort", () => {
         stop();
         reject(new Error("aborted"));

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@chaindaddy/js",
-  "version": "0.2.0",
-  "description": "Chain Daddy for any website: Sign in with Chain Daddy (a popup and a button), a coin's apps on its own site (<cd-app>), and a server-side check that a store order was paid on chain, with checkout to follow",
+  "version": "0.3.1",
+  "description": "Chain Daddy for any website: Sign in with Chain Daddy (a popup and a button), a coin's apps on its own site (<cd-app>), checkout for a coin's store in a popup, and a server-side check that a store order was paid on chain",
   "homepage": "https://docs.chaindaddy.io/developer/javascript-sdk",
   "repository": {
     "type": "git",
@@ -30,6 +30,10 @@
       "types": "./dist/embed.d.ts",
       "default": "./dist/embed.js"
     },
+    "./checkout": {
+      "types": "./dist/checkout.d.ts",
+      "default": "./dist/checkout.js"
+    },
     "./verify": {
       "types": "./dist/verify.d.ts",
       "default": "./dist/verify.js"
@@ -56,6 +60,7 @@
   "devDependencies": {
     "esbuild": "^0.25.0",
     "jsdom": "^26.0.0",
+    "openapi-typescript": "7.13.0",
     "typescript": "^5.7.0",
     "vitest": "^3.2.0"
   },