@hello-bill/node 2.1.1-beta.6 → 2.1.1-beta.7

package/CHANGELOG.md

@@ -1,38 +1,35 @@
 # Changelog
 
-## 2.1.1-beta.6
-
-## 2.1.1-beta.5
-
-## 2.1.1-beta.4
-
-## 2.1.1-beta.3
-
-## 2.1.1-beta.2
+## 2.1.0-beta.0
 
-## 2.1.1-beta.1
+### Minor Changes
 
-## 2.1.1-beta.0
+- 3dc28b1: # 1.1.0 — Stage A: HelloBill v1.15 Partner SDK
 
-## 2.1.0
+  Initial scope-canonical release of the `@hello-bill/{node,sdk}` packages under The-Bunch ownership. Minor bump because T#8 + T#9 added new public-API surfaces (5 framework adapters + Direct API client). Bumps past the prior `1.0.0` versions (published 2026-05-14 by the previous maintainer).
 
-## 2.1.0-beta.3
+  ## `@hello-bill/node`
 
-### Patch Changes
+  - **Type-delta refresh** to v1.15 Partner API: structured `ProductSetup.details`, required `WebhookEnvelope.context: ContextEntry[]`, required-nullable `referral_id`, masked `BankDetailsObject`, narrowed `SetupStatusChanged.previous_status`, `SelectedProduct.location` server-derived per spec §16.
+  - **Session middleware** — `createHellobillRouter` for express; `sessions.list` + `sessions.get` proxies; inbound `Idempotency-Key` plumbing; 5-header passthrough allowlist (`Retry-After`, `X-RateLimit-*`); full upstream session JSON forwarded; optional `partnerSession` CSRF resolver per spec §19:3478.
+  - **Webhook receiver** — `createWebhookHandler` with HMAC-SHA256 over raw bytes, pluggable `WebhookDedupeStore`, exhaustive 12-variant dispatcher with compile-time `assertNever`; `verifyWebhookSignature` boolean wrapper alongside the throwing `verifyWebhook`.
+  - **Framework adapters** (new) — `@hello-bill/node/{hono,koa,next}` with lazy peer-dependency loading.
+  - **Direct API client** (new) — `HelloBillPartner` class with `.sessions.{create,list,get,products,property,loa,customers}`, `.customers.status`, `.bankDetails.{submit,get}` — server-to-server alternative to the embed. Shares `TokenManager` with the middleware.
+  - **`HellobillApiError.headers`** — typed errors now expose upstream response headers so partners can read `Retry-After` (425) and `X-RateLimit-*` (429).
 
-- Fix the embed's data-route parity between the SDK and the node middleware. The
-  SDK middleware client now calls short, baseEndpoint-relative paths
-  (`/service-slots`, `/savings-summary`, `/loa-document`) consistent with the
-  other routes, and the node SDK mounts those three routes on all four framework
-  adapters (express, hono, koa, next), with a new `loaDocument` proxy handler.
-  Previously the SDK called full upstream paths the node middleware never served,
-  so service-slots, savings-summary, and loa-document bridge calls 404'd.
+  ## `@hello-bill/sdk`
 
-## 2.1.0-beta.2
+  - **Architecture pivot Shadow-DOM → iframe + postMessage** per spec §9.5.9: parent SDK now creates an iframe at `embed.hellobill.app/v1/onboard?token={session_token}`, handles a 27-variant postMessage envelope, FIFO outbound queue (cap 50, drop-oldest), synchronous origin verification, thenable proxy supporting both sync `HelloBill.init({...})` and `await HelloBill.init({...})` patterns.
+  - **Operational events** — `hb:resize` (parent applies to iframe height) and `hb:navigate` (default `window.open(url, '_blank', 'noopener')`).
+  - **`HelloBillEmbed` export alias** matching spec §9.3:1871 / embed HTML L1972.
+  - **`OnCloseReason` literal union** narrowed to `'user_dismissed' | 'timeout' | 'error'` per spec §16.
+  - **`mapGoodlordToSessionData` + `GoodlordTenancy`** integration helpers + **`buildNoJsFallbackUrl`** helper for no-JS partner fallbacks.
+  - **React + Vue widgets** (new) — `@hello-bill/sdk/{react,vue}` `HelloBillWidget` components with lifecycle-bound init/destroy.
 
-## 2.1.0-beta.1
+  ## Notes
 
-## 2.1.0-beta.0
+  - Iframe content (the 19-screen embed UX) does NOT ship in this release — it deploys separately to `embed.hellobill.app/v1/onboard` in Stage B. Partners can install the SDK at v1.1.0; the iframe will be live once Stage B ships.
+  - Direct API client (`@hello-bill/node` `HelloBillPartner`) is fully functional in v1.1.0 — does not depend on Stage B.
 
 All notable changes to `@hello-bill/node` will be documented in this file.
 

package/dist/express/index.d.cts

@@ -1,5 +1,5 @@
-import { C as CreateHellobillHandlerOptions } from '../index-9PkSdjVq.cjs';
-import '../webhooks-Cv4e8oXp.cjs';
+import { C as CreateHellobillHandlerOptions } from '../index-D5WlUYVZ.cjs';
+import '../webhooks-DePW-Bjp.cjs';
 
 /**
  * Express adapter for the framework-agnostic SDK core.

package/dist/express/index.d.ts

@@ -1,5 +1,5 @@
-import { C as CreateHellobillHandlerOptions } from '../index-BAETgMms.js';
-import '../webhooks-Cv4e8oXp.js';
+import { C as CreateHellobillHandlerOptions } from '../index-jK9cEnEY.js';
+import '../webhooks-DePW-Bjp.js';
 
 /**
  * Express adapter for the framework-agnostic SDK core.

package/dist/express/index.js

@@ -932,21 +932,6 @@ function createHellobillHandler(opts) {
     if (!result2) return;
     passthroughUpstream(res, result2.status, result2.body, result2.requestId, result2.headers);
   };
-  const loaDocument = async (req, res) => {
-    const rawLoa = req.query.loa_id ?? req.params?.id;
-    const loaId = Array.isArray(rawLoa) ? rawLoa[0] : rawLoa;
-    if (!loaId) {
-      sendError(res, 400, "validation.missing_required_field", "loa_id query parameter required");
-      return;
-    }
-    const result2 = await safeCallUpstream(res, {
-      method: "GET",
-      path: `/partner/loa/${encodeURIComponent(loaId)}/document`,
-      logger
-    });
-    if (!result2) return;
-    passthroughUpstream(res, result2.status, result2.body, result2.requestId, result2.headers);
-  };
   const webhookHandler = opts.webhook ? createWebhookHandler({ ...opts.webhook, logger: opts.webhook.logger ?? opts.logger }) : void 0;
   const result = {
     session,
@@ -958,8 +943,7 @@ function createHellobillHandler(opts) {
     property,
     sessions: { list: sessionsList, get: sessionsGet },
     savingsSummary,
-    serviceSlots,
-    loaDocument
+    serviceSlots
   };
   if (webhookHandler !== void 0) {
     result.webhook = webhookHandler;
@@ -1048,9 +1032,6 @@ function createHellobillRouter(opts) {
   router.get("/property", asyncWrap(handlers.property));
   router.get("/sessions", asyncWrap(handlers.sessions.list));
   router.get("/sessions/:id", asyncWrap(handlers.sessions.get));
-  router.get("/service-slots", asyncWrap(handlers.serviceSlots));
-  router.get("/savings-summary", asyncWrap(handlers.savingsSummary));
-  router.get("/loa-document", asyncWrap(handlers.loaDocument));
   router.use(
     (err, _req, res, _next) => {
       opts.logger?.error?.("hellobill.router_error", { message: err?.message });