@moonbase.sh/storefront 3.8.2 → 3.9.0

package/README.md

@@ -66,6 +66,18 @@ The widget renders directly into the host page's DOM and inherits its viewport.
 
 Hosts that ship a fixed-width legacy mobile viewport (for example Wix's classic mobile sites use `<meta name="viewport" content="width=320, user-scalable=yes">`) cause the browser to upscale every CSS pixel on the page. The widget auto-detects this and counter-scales itself with CSS `zoom` to remain readable; opt out with `disableViewportCompensation: true` if you want the widget to match the host's upscaled density. On Wix specifically, mounting the widget into a contained element via `target` is also an option — it switches the drawer from a viewport overlay to an in-flow component and sidesteps the upscale entirely.
 
+### Captchas
+
+A merchant can ask customers to solve a captcha before they sign up. With that turned on, the
+widget's sign-up form shows one, drawn in a frame from the store's own
+`https://<account-id>.moonbase.sh`. A site with a Content-Security-Policy only has to allow that
+address in `frame-src`, which it already needs for the checkout overlay, and nothing for the
+captcha provider itself.
+
+Widget versions from before captchas (3.7 and earlier) cannot show one, so while captchas are on,
+signing up from a site pinned to one of those fails. Checkout is unaffected by the widget version:
+it runs in Moonbase's own checkout, which shows its own captcha.
+
 ## Trigger intents
 
 Use intent methods to open specific views or execute actions: