@n1xv/stripe-elements 0.0.0-stage → 0.1.1

package/README.md

@@ -1,3 +1,106 @@
-# Temporary Holding Version
+# @n1xv/stripe-elements
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Stripe Elements on **your** checkout screen, instead of a redirect to someone
+else's.
+
+Hosted Checkout is one line and works. What it cannot do is sit inside your own
+page: no wallet row above your paywall button, no consent sentence recorded
+against the press, no saved card for a returning buyer, and no control over the
+screen where the money is actually taken.
+
+This package is the mechanics of doing it yourself. It is **not** a checkout —
+there is no modal, no copy, no price and no consent text here. Those belong to
+the product.
+
+## What it does
+
+```ts
+import { mountElements } from '@n1xv/stripe-elements';
+
+const checkout = await mountElements(
+  // The charge does not exist yet. It is created when Pay is pressed.
+  { deferred: { amount: 1200, currency: 'USD', recurring: true } },
+  {
+    publishableKey: () => fetch('/api/billing/config').then((r) => r.json()).then((c) => c.publishableKey),
+    slots: { payment: '#card', express: '#wallets' },
+    onChange: (complete) => setCanPay(complete),
+    billing: { country },          // collected before this, so Stripe stops asking
+    wallet: {
+      ready: () => Boolean(total),  // a wallet sheet fixes its amount when it opens
+      onNotReady: () => toast('One moment — still pricing.'),
+      create: () => createChargeOnServer(),
+    },
+    onWalletResult: (r) => r.outcome === 'completed' && done(),
+  },
+);
+
+if (!checkout) return; // payments are switched off; render the screen anyway
+
+// On your Pay button:
+const problem = await checkout.submit();       // validates before anything is created
+if (problem) return show(problem);
+const secret = await createChargeOnServer();   // now, not before
+const result = await checkout.confirm(secret);
+```
+
+`null` from `mountElements` is an ordinary answer: a fresh clone has no keys and
+must still render.
+
+## Why deferred
+
+The charge is created when Pay is pressed, not to make a form appear. Creating
+it first means every buyer who merely *looked* at the card form has left an
+incomplete subscription behind — and the consent has to be ticked before a form
+that does not exist yet.
+
+## What is decided here, and what is not
+
+Nothing in this package grants anything or decides a price. Both are settled
+server-side before a secret exists, and entitlements follow the webhook a moment
+after the payment clears — so poll your own billing state rather than trusting
+what the page saw.
+
+## The three outcomes
+
+`completed`, `closed`, `unavailable` — never a boolean. A caller that collapses
+them tells somebody whose card was declined that payments are down.
+
+`retry: true` means *this charge is spent*: Stripe refuses further confirmations
+against an intent declined too many times, and every attempt after that fails
+for a reason that has nothing to do with the card being typed. Build a new
+charge.
+
+Card errors are passed through in Stripe's own words — "insufficient funds" is
+actionable, "that didn't go through" is not. Everything else is ours and is
+listed in `DEFAULT_MESSAGES`; override it to translate.
+
+## Theme
+
+```ts
+appearance: { scope: '.app', darkClass: 'dark', primaryVariable: '--primary' }
+```
+
+Stripe's iframe cannot inherit CSS, so the palette is handed over. Name the
+element your theme actually lives on: reading `<html>` for a class that is set
+somewhere else is true-always or false-always, and the symptom is a black card
+form inside a white page.
+
+## Keeping the server in step
+
+A deferred form is told which methods to offer, because it has no intent to
+read them from. Keep `paymentMethodTypes` equal to the server's
+`payment_method_types`, or the form offers a method the intent will refuse — a
+decline with no cause the buyer can act on.
+
+> Stripe renamed the underlying option to `allowedPaymentMethodTypes`. The old
+> `paymentMethodTypes` is **rejected outright** by current Stripe.js — "no
+> longer supported in this version" — thrown at mount, so the form simply never
+> appears. This package sends the current name; the option on `MountOptions`
+> keeps the familiar one.
+
+## Origin
+
+Lifted from a production checkout in `nrr-tv`, with the product removed: the
+plan ladder, the credit packs, the legal copy and the modal that composed them
+stayed behind. The comments explaining *why* came with the code, because each
+one is a bug somebody already paid for.

package/dist/appearance.d.ts

@@ -0,0 +1,31 @@
+import type { Appearance } from '@stripe/stripe-js';
+/**
+ * Make Stripe's iframe look like the rest of the app.
+ *
+ * Read off the live theme rather than hard-coded: an app with a light and a
+ * dark mode cannot let the element inherit CSS across an iframe boundary, so a
+ * fixed palette here is a white form on a black card for half the users.
+ *
+ * Which element carries the theme is the caller's to say, and getting it wrong
+ * is invisible in every test that does not look at the answer. The version this
+ * came from asked `<html>` for an attribute nothing in that app ever set, so
+ * the condition was true always and every form rendered in Stripe's night
+ * theme — including on a light page. Hence `scope`: name the element the theme
+ * actually lives on.
+ */
+export type ThemeSource = {
+    /**
+     * The element the theme and the brand variables live on, as a selector.
+     * Defaults to `:root`, which is right when nothing scopes them.
+     */
+    scope?: string;
+    /** The class that means dark. Defaults to `dark`. */
+    darkClass?: string;
+    /** The CSS custom property holding the accent colour. */
+    primaryVariable?: string;
+    /** Used when the variable is absent — local dev, or a page without the theme. */
+    primaryFallback?: string;
+    borderRadius?: string;
+};
+export declare function appearanceFromTheme(source?: ThemeSource): Appearance;
+//# sourceMappingURL=appearance.d.ts.map

package/dist/appearance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appearance.d.ts","sourceRoot":"","sources":["../src/appearance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iFAAiF;IACjF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,MAAM,GAAE,WAAgB,GAAG,UAAU,CAuBxE"}

package/dist/appearance.js

@@ -0,0 +1,17 @@
+export function appearanceFromTheme(source = {}) {
+    const { scope = ':root', darkClass = 'dark', primaryVariable = '--primary', primaryFallback = '#7c3aed', borderRadius = '12px', } = source;
+    // `:root` always matches, but a named scope may not have rendered yet — and
+    // falling through to the document element is better than throwing inside a
+    // checkout.
+    const element = document.querySelector(scope) ?? document.documentElement;
+    const css = getComputedStyle(element);
+    const dark = element.classList.contains(darkClass);
+    return {
+        theme: dark ? 'night' : 'stripe',
+        variables: {
+            colorPrimary: css.getPropertyValue(primaryVariable).trim() || primaryFallback,
+            borderRadius,
+        },
+    };
+}
+//# sourceMappingURL=appearance.js.map

package/dist/appearance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appearance.js","sourceRoot":"","sources":["../src/appearance.ts"],"names":[],"mappings":"AA+BA,MAAM,UAAU,mBAAmB,CAAC,SAAsB,EAAE;IAC1D,MAAM,EACJ,KAAK,GAAG,OAAO,EACf,SAAS,GAAG,MAAM,EAClB,eAAe,GAAG,WAAW,EAC7B,eAAe,GAAG,SAAS,EAC3B,YAAY,GAAG,MAAM,GACtB,GAAG,MAAM,CAAC;IAEX,4EAA4E;IAC5E,2EAA2E;IAC3E,YAAY;IACZ,MAAM,OAAO,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,eAAe,CAAC;IAC1E,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAEnD,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;QAChC,SAAS,EAAE;YACT,YAAY,EAAE,GAAG,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,IAAI,eAAe;YAC7E,YAAY;SACb;KACF,CAAC;AACJ,CAAC"}

package/dist/elements.d.ts

@@ -0,0 +1,151 @@
+import type { Appearance } from '@stripe/stripe-js';
+import { type ThemeSource } from './appearance.js';
+import { type OutcomeMessages } from './outcome.js';
+import { type PublishableKeySource } from './stripe-js.js';
+import type { BillingAddress, ConfirmResult, MountIntent, MountedCheckout, WalletHooks } from './types.js';
+/**
+ * Stripe Elements, mounted into your own checkout screen.
+ *
+ * Vanilla `@stripe/stripe-js` rather than the React bindings: the payments
+ * layer stays a plain async API the UI calls, which keeps this package usable
+ * from any framework and avoids a second React tree inside a modal.
+ *
+ * Three elements, and each earns its place:
+ *
+ * - **Express Checkout** is Apple Pay / Google Pay / Link. It only renders the
+ *   wallets the visitor can actually use, so on a desktop without any it draws
+ *   nothing — the caller has to treat an empty express row as normal rather
+ *   than as a failure to load.
+ * - **Payment** is the card form.
+ * - **Address** is collected by the caller BEFORE this, not here: the total
+ *   depends on it and a finalised invoice cannot be re-taxed.
+ *
+ * Nothing here grants anything, and nothing here decides a price. Both are
+ * settled server-side before a secret exists.
+ */
+/**
+ * The height of a wallet button, in px.
+ *
+ * Stripe draws its buttons inside an iframe, so CSS on the host side cannot
+ * touch them — the only lever is this option, and its range is 40–55 (default
+ * 44). 55 is the top of that range and the closest it can come to an ordinary
+ * button, which is why a host's own buttons should be pinned to the same
+ * number rather than left at whatever their padding produced.
+ */
+export declare const EXPRESS_BUTTON_HEIGHT = 55;
+/**
+ * The payment methods a DEFERRED form offers.
+ *
+ * The same list the intent will be created with, named here because a deferred
+ * form has no intent to read it from. Left unset, the form offers whatever the
+ * dashboard enables and can then fail at confirmation against an intent that
+ * accepts something narrower — a decline with no cause the buyer can act on.
+ *
+ * Passed to Stripe as `allowedPaymentMethodTypes`. It used to be
+ * `paymentMethodTypes`, and that name is not merely deprecated: current
+ * Stripe.js REFUSES the call outright — "`paymentMethodTypes` is no longer
+ * supported in this version of Stripe.js" — so the form never appears at all.
+ * The failure arrives as a thrown error at mount, which a caller that catches
+ * broadly will report as a generic problem.
+ */
+export declare const DEFAULT_PAYMENT_METHOD_TYPES: readonly ["card", "link"];
+export type MountOptions = {
+    /** Where each element goes, as selectors. */
+    slots: {
+        payment?: string;
+        express?: string;
+    };
+    /** Needed before anything can be drawn. */
+    publishableKey: PublishableKeySource;
+    /** Reports completeness so the caller can enable its own Pay button. */
+    onChange?: (complete: boolean) => void;
+    /**
+     * Lets the form show cards this buyer has already saved.
+     *
+     * A client secret describes one PAYMENT, not one person, so without this the
+     * Payment Element has no way to know whose cards to offer and shows a blank
+     * form to everybody — including a subscriber whose card is charged monthly.
+     * Absent when Stripe could not mint one, which costs the convenience and
+     * nothing else.
+     */
+    customerSessionSecret?: string;
+    /**
+     * How a WALLET payment ended.
+     *
+     * Apple Pay and Google Pay confirm from inside the element's own sheet, not
+     * from the caller's Pay button, so their outcome arrives here rather than as
+     * the return value of `confirm()`. Without it a successful wallet payment
+     * leaves the checkout sitting open on a charge that has already cleared.
+     */
+    onWalletResult?: (result: ConfirmResult) => void;
+    wallet?: WalletHooks;
+    /**
+     * The buyer's email, so Link can recognise them.
+     *
+     * Link keeps a wallet against an EMAIL, including one created on somebody
+     * else's site. Told it up front, Link offers the saved cards behind it —
+     * verifying with a code — instead of an empty form.
+     */
+    email?: string;
+    /**
+     * The billing address the caller already collected, when it did.
+     *
+     * Present it and Stripe stops asking: the Payment Element collects a billing
+     * address by default, which puts a SECOND country dropdown under the card on
+     * a screen that already asked. Two selectors is not only an extra step — they
+     * can disagree, and the tax on the invoice was computed from the caller's.
+     */
+    billing?: BillingAddress;
+    /** Defaults to reading the live theme; pass an object to fix it. */
+    appearance?: Appearance | ThemeSource;
+    /** Defaults to `['card', 'link']`. Must match the server's intent. */
+    paymentMethodTypes?: readonly string[];
+    /** Override to translate. See `OutcomeMessages`. */
+    messages?: OutcomeMessages;
+    /**
+     * Where a redirecting method brings the buyer back. Defaults to the current
+     * origin and path.
+     *
+     * The query is dropped deliberately: a buyer coming back from a redirect
+     * carries Stripe's own result parameters in it, and reusing that as the next
+     * return address sends them back to a stale secret.
+     */
+    returnUrl?: () => string;
+};
+/**
+ * Mount the payment form — for a server-created secret, or ahead of one.
+ *
+ * Returns null when Stripe.js could not load or payments are switched off,
+ * which is an ordinary answer rather than a throw: a fresh clone with no keys
+ * must still render its screen.
+ */
+export declare function mountElements(intent: MountIntent, options: MountOptions): Promise<MountedCheckout | null>;
+/**
+ * Mount a form that stores a card without charging it.
+ *
+ * No wallet row: Apple Pay and Google Pay can be saved, but the reason to be on
+ * this screen is to put a card on file for renewals, and a wallet tile there
+ * reads as a way to pay for something.
+ */
+export declare function mountCardSetup(clientSecret: string, options: Omit<MountOptions, 'slots' | 'wallet' | 'onWalletResult'> & {
+    slot: string;
+}): Promise<MountedCheckout | null>;
+/**
+ * Answer a challenge on a payment that already exists.
+ *
+ * Nothing is collected and nothing is mounted: the card is the one on file, the
+ * charge was raised server-side, and the only thing missing is the cardholder
+ * tapping their bank's prompt.
+ *
+ * `retry` keeps its meaning — this payment is spent. What a fresh one LOOKS
+ * like differs: a checkout screen rebuilds its own charge, while here the
+ * charge belongs to an update the provider is holding, so the only way forward
+ * is a working card on file and a fresh amendment. Stripping the flag here
+ * leaves the caller with `unavailable` and no way to tell "the card on file was
+ * refused for good" from "Stripe.js did not load".
+ */
+export declare function authenticate(clientSecret: string, options: {
+    publishableKey: PublishableKeySource;
+    messages?: OutcomeMessages;
+}): Promise<ConfirmResult>;
+//# sourceMappingURL=elements.d.ts.map

package/dist/elements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"elements.d.ts","sourceRoot":"","sources":["../src/elements.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EAKX,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAA0C,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAC5F,OAAO,EAAgB,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EAEb,WAAW,EACX,eAAe,EACf,WAAW,EACZ,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,4BAA4B,2BAA4B,CAAC;AActE,MAAM,MAAM,YAAY,GAAG;IACzB,6CAA6C;IAC7C,KAAK,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,2CAA2C;IAC3C,cAAc,EAAE,oBAAoB,CAAC;IACrC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC;IACvC;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;IACjD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,oEAAoE;IACpE,UAAU,CAAC,EAAE,UAAU,GAAG,WAAW,CAAC;IACtC,sEAAsE;IACtE,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,oDAAoD;IACpD,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;CAC1B,CAAC;AAOF;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CA6OjC;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,QAAQ,GAAG,gBAAgB,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GACpF,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAGjC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE;IAAE,cAAc,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,EAAE,eAAe,CAAA;CAAE,GAC5E,OAAO,CAAC,aAAa,CAAC,CAMxB"}

package/dist/elements.js

@@ -0,0 +1,380 @@
+import { appearanceFromTheme } from './appearance.js';
+import { classifyConfirmError, DEFAULT_MESSAGES } from './outcome.js';
+import { loadStripeJs } from './stripe-js.js';
+/**
+ * Stripe Elements, mounted into your own checkout screen.
+ *
+ * Vanilla `@stripe/stripe-js` rather than the React bindings: the payments
+ * layer stays a plain async API the UI calls, which keeps this package usable
+ * from any framework and avoids a second React tree inside a modal.
+ *
+ * Three elements, and each earns its place:
+ *
+ * - **Express Checkout** is Apple Pay / Google Pay / Link. It only renders the
+ *   wallets the visitor can actually use, so on a desktop without any it draws
+ *   nothing — the caller has to treat an empty express row as normal rather
+ *   than as a failure to load.
+ * - **Payment** is the card form.
+ * - **Address** is collected by the caller BEFORE this, not here: the total
+ *   depends on it and a finalised invoice cannot be re-taxed.
+ *
+ * Nothing here grants anything, and nothing here decides a price. Both are
+ * settled server-side before a secret exists.
+ */
+/**
+ * The height of a wallet button, in px.
+ *
+ * Stripe draws its buttons inside an iframe, so CSS on the host side cannot
+ * touch them — the only lever is this option, and its range is 40–55 (default
+ * 44). 55 is the top of that range and the closest it can come to an ordinary
+ * button, which is why a host's own buttons should be pinned to the same
+ * number rather than left at whatever their padding produced.
+ */
+export const EXPRESS_BUTTON_HEIGHT = 55;
+/**
+ * The payment methods a DEFERRED form offers.
+ *
+ * The same list the intent will be created with, named here because a deferred
+ * form has no intent to read it from. Left unset, the form offers whatever the
+ * dashboard enables and can then fail at confirmation against an intent that
+ * accepts something narrower — a decline with no cause the buyer can act on.
+ *
+ * Passed to Stripe as `allowedPaymentMethodTypes`. It used to be
+ * `paymentMethodTypes`, and that name is not merely deprecated: current
+ * Stripe.js REFUSES the call outright — "`paymentMethodTypes` is no longer
+ * supported in this version of Stripe.js" — so the form never appears at all.
+ * The failure arrives as a thrown error at mount, which a caller that catches
+ * broadly will report as a generic problem.
+ */
+export const DEFAULT_PAYMENT_METHOD_TYPES = ['card', 'link'];
+const isThemeSource = (a) => a !== undefined && !('theme' in a) && !('variables' in a) && !('rules' in a);
+const defaultReturnUrl = () => `${window.location.origin}${window.location.pathname}`;
+/**
+ * Mount the payment form — for a server-created secret, or ahead of one.
+ *
+ * Returns null when Stripe.js could not load or payments are switched off,
+ * which is an ordinary answer rather than a throw: a fresh clone with no keys
+ * must still render its screen.
+ */
+export async function mountElements(intent, options) {
+    const { slots, publishableKey, onChange, customerSessionSecret, onWalletResult, wallet, email, billing, paymentMethodTypes = DEFAULT_PAYMENT_METHOD_TYPES, messages = DEFAULT_MESSAGES, returnUrl = defaultReturnUrl, } = options;
+    const stripe = await loadStripeJs(publishableKey).catch(() => null);
+    if (!stripe)
+        return null;
+    const appearance = isThemeSource(options.appearance)
+        ? appearanceFromTheme(options.appearance)
+        : (options.appearance ?? appearanceFromTheme());
+    const deferred = 'deferred' in intent ? intent.deferred : null;
+    const kind = 'deferred' in intent ? 'payment' : (intent.kind ?? 'payment');
+    let complete = false;
+    // Everything that does not depend on which kind of form this is. Stripe types
+    // the two shapes as separate overloads, so the CALL has to branch even though
+    // most of the options do not.
+    const shared = {
+        appearance,
+        ...(customerSessionSecret ? { customerSessionClientSecret: customerSessionSecret } : {}),
+    };
+    /**
+     * The two modes are spelled out rather than computed, because Stripe types
+     * them as separate members of a union: a `mode` narrowed to
+     * `'subscription' | 'payment'` matches neither, and the call stops
+     * typechecking for a reason that has nothing to do with it being wrong.
+     *
+     * Something that renews unattended needs a card usable off-session; a
+     * one-off is over when it is paid, and keeping the card is the buyer's own
+     * tick in the element.
+     */
+    const deferredOptions = deferred
+        ? deferred.recurring
+            ? {
+                mode: 'subscription',
+                amount: deferred.amount,
+                currency: deferred.currency.toLowerCase(),
+                setupFutureUsage: 'off_session',
+                allowedPaymentMethodTypes: [...paymentMethodTypes],
+                ...shared,
+            }
+            : {
+                mode: 'payment',
+                amount: deferred.amount,
+                currency: deferred.currency.toLowerCase(),
+                allowedPaymentMethodTypes: [...paymentMethodTypes],
+                ...shared,
+            }
+        : null;
+    const elements = deferredOptions
+        ? stripe.elements(deferredOptions)
+        : stripe.elements({ clientSecret: intent.secret, ...shared });
+    // A country we do not have cannot be sent, and suppressing the field without
+    // sending one is a dead end: Stripe refuses the confirmation and the buyer
+    // has nowhere to type the answer. Falling back to Stripe's own field costs a
+    // duplicate dropdown in a case that should not happen — the cheaper failure.
+    const address = billing?.country ? billing : undefined;
+    const payment = slots.payment
+        ? elements.create('payment', {
+            layout: 'tabs',
+            ...(email ? { defaultValues: { billingDetails: { email } } } : {}),
+            // Suppress EXACTLY what was already asked for, field by field.
+            // `address: "never"` hides all of it and then Stripe demands a complete
+            // address back at confirmation; naming the fields keeps the contract to
+            // the ones the caller can satisfy.
+            ...(address
+                ? {
+                    fields: {
+                        billingDetails: {
+                            address: {
+                                country: 'never',
+                                postalCode: address.postalCode ? 'never' : 'auto',
+                                line1: 'auto',
+                                line2: 'auto',
+                                city: 'auto',
+                                state: 'auto',
+                            },
+                        },
+                    },
+                }
+                : {}),
+        })
+        : null;
+    if (payment && slots.payment) {
+        payment.on('change', (e) => {
+            complete = e.complete;
+            onChange?.(complete);
+        });
+        payment.mount(slots.payment);
+    }
+    const submit = async () => {
+        const { error } = await elements.submit();
+        // Stripe's own words: "Your card number is incomplete" tells the buyer
+        // where to look, and a sentence of ours would not.
+        return error ? (error.message ?? messages.declined) : null;
+    };
+    /**
+     * The wallet row, and the handler without which it is decoration.
+     *
+     * A wallet button does NOT pay by itself: pressing it opens the sheet and
+     * then waits for a `confirm` handler to take it from there. Mounted without
+     * one, Apple Pay and Google Pay open, collect a card, and go nowhere — the
+     * worst version of a payment method that does not work, because the buyer has
+     * every reason to believe they have just paid.
+     */
+    let express = null;
+    if (slots.express && document.querySelector(slots.express)) {
+        try {
+            const el = elements.create('expressCheckout', {
+                /**
+                 * Wallets first, Link last.
+                 *
+                 * Stripe's default is a dynamic order it optimises per visitor, which
+                 * puts Link — a Stripe account, i.e. one more thing to sign into —
+                 * ahead of the wallet already unlocked on the device.
+                 */
+                paymentMethodOrder: ['applePay', 'googlePay', 'link'],
+                buttonHeight: EXPRESS_BUTTON_HEIGHT,
+                layout: {
+                    /**
+                     * One per row. Left to Stripe, two wallets share a row and come out
+                     * half the width of the card button beneath them — three buttons
+                     * doing the same job in two different sizes, which on a phone reads
+                     * as two of them being secondary.
+                     */
+                    maxColumns: 1,
+                    /**
+                     * Never fold the rest behind a "more" button: the overflow menu hides
+                     * the cheapest conversion there is — a wallet the visitor has already
+                     * authenticated — behind a second tap.
+                     */
+                    overflow: 'never',
+                },
+            });
+            el.on('ready', (event) => {
+                const available = event
+                    .availablePaymentMethods;
+                wallet?.onReady?.(Object.keys(available ?? {}).filter((k) => available?.[k]));
+            });
+            if (wallet) {
+                // Refusing to resolve is how Stripe is told to keep the sheet shut —
+                // far better than a sheet that opens, takes a fingerprint and then
+                // fails on a total that moved under it.
+                el.on('click', (event) => {
+                    if (!wallet.ready())
+                        return wallet.onNotReady();
+                    event.resolve();
+                });
+            }
+            el.on('confirm', () => {
+                void (async () => {
+                    const failed = await submit();
+                    if (failed)
+                        return onWalletResult?.({ outcome: 'closed', error: failed });
+                    /**
+                     * The charge, created only now — the wallet sheet is the one path
+                     * that reaches a confirmation without passing the caller's Pay
+                     * button, so it has to raise the charge itself. A null means the
+                     * caller already knows why, so there is nothing to report twice.
+                     */
+                    const secret = deferred ? await wallet?.create() : undefined;
+                    if (deferred && !secret)
+                        return;
+                    // Deliberately WITHOUT the collected address: a wallet supplies its
+                    // own billing details from the card in it, and `payment_method_data`
+                    // on that confirmation fights the payment method the sheet produced.
+                    const result = await confirmPayment(stripe, elements, {
+                        clientSecret: secret ?? undefined,
+                        messages,
+                        returnUrl,
+                    });
+                    onWalletResult?.(result);
+                })();
+            });
+            el.mount(slots.express);
+            express = el;
+        }
+        catch {
+            /* no wallet available — the card form is still there */
+        }
+    }
+    return {
+        complete: () => complete,
+        submit,
+        /**
+         * Re-price without rebuilding.
+         *
+         * The total moves while the form is open — a buyer who changes their
+         * country changes the tax — and a deferred form carries the amount itself,
+         * so an element left at the old one confirms an intent whose total no
+         * longer matches and Stripe refuses it. Remounting instead would throw away
+         * a half-typed card on a country change.
+         */
+        update: async (charge) => {
+            if (!deferred)
+                return;
+            await elements.update({
+                amount: charge.amount,
+                currency: charge.currency.toLowerCase(),
+            });
+        },
+        /**
+         * BOTH elements, not just the form.
+         *
+         * Destroying only the payment element leaves the wallet row mounted against
+         * a client secret that no longer exists — a Google Pay button sitting under
+         * an error message, on a payment that was already abandoned.
+         */
+        destroy: () => {
+            elements.getElement('payment')?.destroy();
+            express?.destroy();
+        },
+        confirm: (clientSecret) => kind === 'setup'
+            ? confirmSetup(stripe, elements, { messages, returnUrl })
+            : confirmPayment(stripe, elements, { billing: address, clientSecret, messages, returnUrl }),
+    };
+}
+/**
+ * Mount a form that stores a card without charging it.
+ *
+ * No wallet row: Apple Pay and Google Pay can be saved, but the reason to be on
+ * this screen is to put a card on file for renewals, and a wallet tile there
+ * reads as a way to pay for something.
+ */
+export function mountCardSetup(clientSecret, options) {
+    const { slot, ...rest } = options;
+    return mountElements({ secret: clientSecret, kind: 'setup' }, { ...rest, slots: { payment: slot } });
+}
+/**
+ * Answer a challenge on a payment that already exists.
+ *
+ * Nothing is collected and nothing is mounted: the card is the one on file, the
+ * charge was raised server-side, and the only thing missing is the cardholder
+ * tapping their bank's prompt.
+ *
+ * `retry` keeps its meaning — this payment is spent. What a fresh one LOOKS
+ * like differs: a checkout screen rebuilds its own charge, while here the
+ * charge belongs to an update the provider is holding, so the only way forward
+ * is a working card on file and a fresh amendment. Stripping the flag here
+ * leaves the caller with `unavailable` and no way to tell "the card on file was
+ * refused for good" from "Stripe.js did not load".
+ */
+export async function authenticate(clientSecret, options) {
+    const messages = options.messages ?? DEFAULT_MESSAGES;
+    const stripe = await loadStripeJs(options.publishableKey).catch(() => null);
+    if (!stripe)
+        return { outcome: 'unavailable', error: messages.unavailable };
+    const { error } = await stripe.handleNextAction({ clientSecret });
+    return classifyConfirmError(error ?? null, messages);
+}
+/**
+ * Store the card, and mark it usable everywhere.
+ *
+ * `allow_redisplay: 'always'` is not a detail — it is the difference between a
+ * card that appears in settings and the next checkout, and one that silently
+ * does not. A SetupIntent has no field for it and a card confirmed without one
+ * comes back `unspecified`, which every "saved cards" surface filters out. The
+ * consent behind it is the act itself: this call only happens because somebody
+ * opened "Add a card" and pressed save.
+ */
+async function confirmSetup(stripe, elements, opts) {
+    const { error, setupIntent } = await stripe.confirmSetup({
+        elements,
+        redirect: 'if_required',
+        confirmParams: {
+            payment_method_data: { allow_redisplay: 'always' },
+            // A setup that pins `card` cannot redirect today — but the obligation
+            // belongs to the call, not to the current list, and the day Link joins it
+            // this is what stops a hosted-page failure.
+            return_url: opts.returnUrl(),
+        },
+    });
+    const result = classifyConfirmError(error ?? null, opts.messages);
+    if (result.outcome !== 'completed')
+        return result;
+    // Which card was stored, so a caller that needs it billed can say so.
+    const cardId = typeof setupIntent?.payment_method === 'string'
+        ? setupIntent.payment_method
+        : setupIntent?.payment_method?.id;
+    return cardId ? { ...result, cardId } : result;
+}
+/**
+ * Take the payment without leaving the page.
+ *
+ * `redirect: 'if_required'` keeps the buyer here for cards and only navigates
+ * for methods that genuinely cannot complete inline. A plain `redirect:
+ * 'always'` would send everyone away and bring them back on a return_url — the
+ * same hand-off an own-screen checkout exists to avoid.
+ */
+async function confirmPayment(stripe, elements, opts) {
+    const { error } = await stripe.confirmPayment({
+        elements,
+        ...(opts.clientSecret ? { clientSecret: opts.clientSecret } : {}),
+        redirect: 'if_required',
+        confirmParams: {
+            /**
+             * REQUIRED, even though almost nobody is sent anywhere.
+             *
+             * `redirect: 'if_required'` decides whether the buyer travels; it does
+             * not excuse the caller from saying where they would land. Stripe refuses
+             * the whole confirmation for any method that MIGHT redirect when this is
+             * absent — which is how Link comes to open a hosted page reading
+             * "Something went wrong".
+             */
+            return_url: opts.returnUrl(),
+            // The address the element was told not to ask for. Only sent when it was
+            // suppressed — passing it while the element still collects one would
+            // overwrite whatever the buyer typed there.
+            ...(opts.billing
+                ? {
+                    payment_method_data: {
+                        billing_details: {
+                            address: {
+                                country: opts.billing.country,
+                                ...(opts.billing.postalCode ? { postal_code: opts.billing.postalCode } : {}),
+                            },
+                        },
+                    },
+                }
+                : {}),
+        },
+    });
+    return classifyConfirmError(error ?? null, opts.messages);
+}
+//# sourceMappingURL=elements.js.map

package/dist/elements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"elements.js","sourceRoot":"","sources":["../src/elements.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,mBAAmB,EAAoB,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAwB,MAAM,cAAc,CAAC;AAC5F,OAAO,EAAE,YAAY,EAA6B,MAAM,gBAAgB,CAAC;AAUzE;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,MAAM,EAAE,MAAM,CAAU,CAAC;AA2EtE,MAAM,aAAa,GAAG,CAAC,CAAuC,EAAoB,EAAE,CAClF,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;AAE/E,MAAM,gBAAgB,GAAG,GAAW,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;AAE9F;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAmB,EACnB,OAAqB;IAErB,MAAM,EACJ,KAAK,EACL,cAAc,EACd,QAAQ,EACR,qBAAqB,EACrB,cAAc,EACd,MAAM,EACN,KAAK,EACL,OAAO,EACP,kBAAkB,GAAG,4BAA4B,EACjD,QAAQ,GAAG,gBAAgB,EAC3B,SAAS,GAAG,gBAAgB,GAC7B,GAAG,OAAO,CAAC;IAEZ,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;QAClD,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC;QACzC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,IAAI,mBAAmB,EAAE,CAAC,CAAC;IAElD,MAAM,QAAQ,GAAG,UAAU,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,MAAM,IAAI,GAAG,UAAU,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC;IAE3E,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,8EAA8E;IAC9E,8EAA8E;IAC9E,8BAA8B;IAC9B,MAAM,MAAM,GAAG;QACb,UAAU;QACV,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,2BAA2B,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzF,CAAC;IAEF;;;;;;;;;OASG;IACH,MAAM,eAAe,GAAmC,QAAQ;QAC9D,CAAC,CAAC,QAAQ,CAAC,SAAS;YAClB,CAAC,CAAC;gBACE,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE;gBACzC,gBAAgB,EAAE,aAAa;gBAC/B,yBAAyB,EAAE,CAAC,GAAG,kBAAkB,CAAC;gBAClD,GAAG,MAAM;aACV;YACH,CAAC,CAAC;gBACE,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE;gBACzC,yBAAyB,EAAE,CAAC,GAAG,kBAAkB,CAAC;gBAClD,GAAG,MAAM;aACV;QACL,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,QAAQ,GAAmB,eAAe;QAC9C,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;QAClC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAG,MAA6B,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAExF,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAEvD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO;QAC3B,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE;YACzB,MAAM,EAAE,MAAM;YACd,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,+DAA+D;YAC/D,wEAAwE;YACxE,wEAAwE;YACxE,mCAAmC;YACnC,GAAG,CAAC,OAAO;gBACT,CAAC,CAAC;oBACE,MAAM,EAAE;wBACN,cAAc,EAAE;4BACd,OAAO,EAAE;gCACP,OAAO,EAAE,OAAgB;gCACzB,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAE,OAAiB,CAAC,CAAC,CAAE,MAAgB;gCACvE,KAAK,EAAE,MAAe;gCACtB,KAAK,EAAE,MAAe;gCACtB,IAAI,EAAE,MAAe;gCACrB,KAAK,EAAE,MAAe;6BACvB;yBACF;qBACF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IAET,IAAI,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;YACzB,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;YACtB,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,IAA4B,EAAE;QAChD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC1C,uEAAuE;QACvE,mDAAmD;QACnD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,CAAC,CAAC;IAEF;;;;;;;;OAQG;IACH,IAAI,OAAO,GAAwC,IAAI,CAAC;IACxD,IAAI,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,iBAAiB,EAAE;gBAC5C;;;;;;mBAMG;gBACH,kBAAkB,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC;gBACrD,YAAY,EAAE,qBAAqB;gBACnC,MAAM,EAAE;oBACN;;;;;uBAKG;oBACH,UAAU,EAAE,CAAC;oBACb;;;;uBAIG;oBACH,QAAQ,EAAE,OAAO;iBAClB;aACF,CAAC,CAAC;YAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBACvB,MAAM,SAAS,GAAI,KAA+D;qBAC/E,uBAAuB,CAAC;gBAC3B,MAAM,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAChF,CAAC,CAAC,CAAC;YAEH,IAAI,MAAM,EAAE,CAAC;gBACX,qEAAqE;gBACrE,mEAAmE;gBACnE,wCAAwC;gBACxC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;oBACvB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;wBAAE,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;oBAChD,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClB,CAAC,CAAC,CAAC;YACL,CAAC;YAED,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;gBACpB,KAAK,CAAC,KAAK,IAAI,EAAE;oBACf,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC;oBAC9B,IAAI,MAAM;wBAAE,OAAO,cAAc,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;oBAC1E;;;;;uBAKG;oBACH,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC7D,IAAI,QAAQ,IAAI,CAAC,MAAM;wBAAE,OAAO;oBAChC,oEAAoE;oBACpE,qEAAqE;oBACrE,qEAAqE;oBACrE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE;wBACpD,YAAY,EAAE,MAAM,IAAI,SAAS;wBACjC,QAAQ;wBACR,SAAS;qBACV,CAAC,CAAC;oBACH,cAAc,EAAE,CAAC,MAAM,CAAC,CAAC;gBAC3B,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACxB,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ;QACxB,MAAM;QACN;;;;;;;;WAQG;QACH,MAAM,EAAE,KAAK,EAAE,MAAsB,EAAE,EAAE;YACvC,IAAI,CAAC,QAAQ;gBAAE,OAAO;YACtB,MAAM,QAAQ,CAAC,MAAM,CAAC;gBACpB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;QACD;;;;;;WAMG;QACH,OAAO,EAAE,GAAG,EAAE;YACZ,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;YAC1C,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC;QACD,OAAO,EAAE,CAAC,YAAqB,EAAE,EAAE,CACjC,IAAI,KAAK,OAAO;YACd,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;YACzD,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;KAChG,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,YAAoB,EACpB,OAAqF;IAErF,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAClC,OAAO,aAAa,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AACvG,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,YAAoB,EACpB,OAA6E;IAE7E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,gBAAgB,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC5E,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;IAClE,OAAO,oBAAoB,CAAC,KAAK,IAAI,IAAI,EAAE,QAAQ,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,YAAY,CACzB,MAAc,EACd,QAAwB,EACxB,IAA4D;IAE5D,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC;QACvD,QAAQ;QACR,QAAQ,EAAE,aAAa;QACvB,aAAa,EAAE;YACb,mBAAmB,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE;YAClD,sEAAsE;YACtE,0EAA0E;YAC1E,4CAA4C;YAC5C,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE;SAC7B;KACF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,IAAI,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW;QAAE,OAAO,MAAM,CAAC;IAClD,sEAAsE;IACtE,MAAM,MAAM,GACV,OAAO,WAAW,EAAE,cAAc,KAAK,QAAQ;QAC7C,CAAC,CAAC,WAAW,CAAC,cAAc;QAC5B,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,EAAE,CAAC;IACtC,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,cAAc,CAC3B,MAAc,EACd,QAAwB,EACxB,IAYC;IAED,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC;QAC5C,QAAQ;QACR,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,QAAQ,EAAE,aAAa;QACvB,aAAa,EAAE;YACb;;;;;;;;eAQG;YACH,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE;YAC5B,yEAAyE;YACzE,qEAAqE;YACrE,4CAA4C;YAC5C,GAAG,CAAC,IAAI,CAAC,OAAO;gBACd,CAAC,CAAC;oBACE,mBAAmB,EAAE;wBACnB,eAAe,EAAE;4BACf,OAAO,EAAE;gCACP,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;gCAC7B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;6BAC7E;yBACF;qBACF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC,CAAC;IACH,OAAO,oBAAoB,CAAC,KAAK,IAAI,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC5D,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Stripe Elements on your own checkout screen.
+ *
+ * What this is NOT: a checkout. There is no modal, no copy, no consent
+ * sentence and no price here — those belong to the product, and the version
+ * this was taken from proved it by being 818 lines of them. What is shared
+ * between products is the mechanics underneath: mounting the three elements,
+ * confirming against a charge that may not exist yet, and agreeing on what a
+ * failure means.
+ *
+ * Nothing in this package grants anything. Entitlements follow the webhook, a
+ * moment after the payment clears — so a caller polls its own billing state
+ * rather than trusting what the page saw.
+ */
+export { mountElements, mountCardSetup, authenticate, EXPRESS_BUTTON_HEIGHT, DEFAULT_PAYMENT_METHOD_TYPES } from './elements.js';
+export type { MountOptions } from './elements.js';
+export { loadStripeJs, resetStripeJs } from './stripe-js.js';
+export type { PublishableKeySource } from './stripe-js.js';
+export { appearanceFromTheme } from './appearance.js';
+export type { ThemeSource } from './appearance.js';
+export { classifyConfirmError, DEFAULT_MESSAGES } from './outcome.js';
+export type { OutcomeMessages } from './outcome.js';
+export type { BillingAddress, CheckoutOutcome, ConfirmResult, DeferredCharge, MountIntent, MountedCheckout, WalletHooks, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AACjI,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC7D,YAAY,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACtE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,YAAY,EACV,cAAc,EACd,eAAe,EACf,aAAa,EACb,cAAc,EACd,WAAW,EACX,eAAe,EACf,WAAW,GACZ,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,19 @@
+/**
+ * Stripe Elements on your own checkout screen.
+ *
+ * What this is NOT: a checkout. There is no modal, no copy, no consent
+ * sentence and no price here — those belong to the product, and the version
+ * this was taken from proved it by being 818 lines of them. What is shared
+ * between products is the mechanics underneath: mounting the three elements,
+ * confirming against a charge that may not exist yet, and agreeing on what a
+ * failure means.
+ *
+ * Nothing in this package grants anything. Entitlements follow the webhook, a
+ * moment after the payment clears — so a caller polls its own billing state
+ * rather than trusting what the page saw.
+ */
+export { mountElements, mountCardSetup, authenticate, EXPRESS_BUTTON_HEIGHT, DEFAULT_PAYMENT_METHOD_TYPES } from './elements.js';
+export { loadStripeJs, resetStripeJs } from './stripe-js.js';
+export { appearanceFromTheme } from './appearance.js';
+export { classifyConfirmError, DEFAULT_MESSAGES } from './outcome.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAGjI,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAG7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAGtD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC"}

package/dist/outcome.d.ts

@@ -0,0 +1,39 @@
+import type { StripeError } from '@stripe/stripe-js';
+import type { ConfirmResult } from './types.js';
+/**
+ * What a Stripe failure means for the buyer, in one place.
+ *
+ * Shared by the card confirmation, the wallet sheet and the 3D Secure challenge
+ * — three entrances to the same set of outcomes. Everything that is not a card
+ * error used to collapse into one sentence with no way out but reloading the
+ * page, which is how a checkout comes to reject cards that worked minutes
+ * earlier.
+ *
+ * Exported, and pure, on purpose: the version this was taken from lived inside
+ * the module that loads Stripe.js, so its own test restated the rules in prose
+ * instead of calling them. A rule stated twice is a rule that drifts.
+ */
+/**
+ * The sentences shown when the failure is ours to explain.
+ *
+ * A card error is NOT in here: Stripe's own wording is better than anything
+ * written in advance — "insufficient funds" is actionable, "that didn't go
+ * through" is not — so it is passed through untouched.
+ *
+ * Override them to translate. The keys are the failure, not the copy.
+ */
+export type OutcomeMessages = {
+    /** A card error with no message of its own. */
+    declined: string;
+    /** Too many attempts in too short a time. */
+    rateLimited: string;
+    /** The request never arrived. */
+    offline: string;
+    /** This charge is spent; a fresh one is the only way forward. */
+    expired: string;
+    /** Ours to fix — a bad key, an outage. */
+    unavailable: string;
+};
+export declare const DEFAULT_MESSAGES: OutcomeMessages;
+export declare function classifyConfirmError(error: StripeError | null, messages?: OutcomeMessages): ConfirmResult;
+//# sourceMappingURL=outcome.d.ts.map

package/dist/outcome.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcome.d.ts","sourceRoot":"","sources":["../src/outcome.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD;;;;;;;;;;;;GAYG;AAEH;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,eAM9B,CAAC;AAEF,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,WAAW,GAAG,IAAI,EACzB,QAAQ,GAAE,eAAkC,GAC3C,aAAa,CA6Cf"}

package/dist/outcome.js

@@ -0,0 +1,50 @@
+export const DEFAULT_MESSAGES = {
+    declined: 'That payment was declined.',
+    rateLimited: 'Too many attempts just now. Wait a moment and try again.',
+    offline: 'Connection lost. Try again.',
+    expired: 'This payment expired. Press pay again to start a new one.',
+    unavailable: 'Payments are unavailable right now.',
+};
+export function classifyConfirmError(error, messages = DEFAULT_MESSAGES) {
+    if (!error)
+        return { outcome: 'completed' };
+    // The buyer's problem to fix, and Stripe's own words are better than ours.
+    if (error.type === 'card_error' || error.type === 'validation_error') {
+        return { outcome: 'closed', error: error.message ?? messages.declined };
+    }
+    // Retrying immediately makes it worse, and recreating the charge does not
+    // help — the limit is on the account, not on this payment.
+    if (error.type === 'rate_limit_error') {
+        return { outcome: 'closed', error: messages.rateLimited };
+    }
+    /**
+     * The request never arrived. The payment is untouched, so the ONLY right move
+     * is to send the same one again — rebuilding it would abandon a perfectly
+     * good charge and tell the buyer their payment expired because their wifi
+     * blinked.
+     */
+    if (error.type === 'api_connection_error') {
+        return { outcome: 'closed', error: messages.offline };
+    }
+    /**
+     * The payment itself is no longer usable.
+     *
+     * Reached after a run of failures: Stripe stops accepting confirmations
+     * against an intent that has been declined repeatedly, and every further
+     * attempt is refused for a reason that has nothing to do with the card now
+     * being typed. Without separating this out it shows as one opaque sentence on
+     * every card — including cards that worked minutes earlier — and the only way
+     * out is reloading the page, which quietly starts a fresh charge. `retry`
+     * says so, and the caller starts that fresh charge itself.
+     */
+    if (error.type === 'invalid_request_error') {
+        return { outcome: 'unavailable', retry: true, error: messages.expired };
+    }
+    /**
+     * Ours, not theirs. Deliberately NOT a rebuild: a new charge against a broken
+     * configuration is dead on arrival, and inviting the buyer to press again
+     * turns one failure into a row of them.
+     */
+    return { outcome: 'unavailable', error: messages.unavailable };
+}
+//# sourceMappingURL=outcome.js.map

package/dist/outcome.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcome.js","sourceRoot":"","sources":["../src/outcome.ts"],"names":[],"mappings":"AAwCA,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,QAAQ,EAAE,4BAA4B;IACtC,WAAW,EAAE,0DAA0D;IACvE,OAAO,EAAE,6BAA6B;IACtC,OAAO,EAAE,2DAA2D;IACpE,WAAW,EAAE,qCAAqC;CACnD,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAClC,KAAyB,EACzB,WAA4B,gBAAgB;IAE5C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAE5C,2EAA2E;IAC3E,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAC1E,CAAC;IAED,0EAA0E;IAC1E,2DAA2D;IAC3D,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC5D,CAAC;IAED;;;;;OAKG;IACH,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;QAC1C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IACxD,CAAC;IAED;;;;;;;;;;OAUG;IACH,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC1E,CAAC;IAED;;;;OAIG;IACH,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;AACjE,CAAC"}

package/dist/stripe-js.d.ts

@@ -0,0 +1,22 @@
+import { type Stripe } from '@stripe/stripe-js';
+/**
+ * Loading Stripe.js, once per page.
+ *
+ * The key is a function rather than a string because a template fetches it from
+ * its own server (`/api/billing/config`) and does not have it at import time.
+ * Returning an empty string is the "payments are switched off" answer, and it
+ * is an ordinary one: a fresh clone has no keys and must still render.
+ *
+ * Only a successful load is memoised. A flaky network on the first attempt must
+ * not leave the page permanently convinced that payments are off.
+ */
+export type PublishableKeySource = string | (() => Promise<string | null> | string | null);
+export declare function loadStripeJs(key: PublishableKeySource): Promise<Stripe | null>;
+/**
+ * Forget the memoised load.
+ *
+ * For tests, and for an app that can switch accounts without a reload. Nothing
+ * in a normal page lifetime needs it.
+ */
+export declare function resetStripeJs(): void;
+//# sourceMappingURL=stripe-js.d.ts.map

package/dist/stripe-js.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stripe-js.d.ts","sourceRoot":"","sources":["../src/stripe-js.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE5D;;;;;;;;;;GAUG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC,CAAC;AAI3F,wBAAgB,YAAY,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAU9E;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,IAAI,IAAI,CAEpC"}

package/dist/stripe-js.js

@@ -0,0 +1,24 @@
+import { loadStripe } from '@stripe/stripe-js';
+let cached = null;
+export function loadStripeJs(key) {
+    cached ??= (async () => {
+        const value = typeof key === 'function' ? await key() : key;
+        if (!value)
+            return null;
+        return loadStripe(value);
+    })().catch((err) => {
+        cached = null;
+        throw err;
+    });
+    return cached;
+}
+/**
+ * Forget the memoised load.
+ *
+ * For tests, and for an app that can switch accounts without a reload. Nothing
+ * in a normal page lifetime needs it.
+ */
+export function resetStripeJs() {
+    cached = null;
+}
+//# sourceMappingURL=stripe-js.js.map

package/dist/stripe-js.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stripe-js.js","sourceRoot":"","sources":["../src/stripe-js.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAe,MAAM,mBAAmB,CAAC;AAe5D,IAAI,MAAM,GAAkC,IAAI,CAAC;AAEjD,MAAM,UAAU,YAAY,CAAC,GAAyB;IACpD,MAAM,KAAK,CAAC,KAAK,IAAI,EAAE;QACrB,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC5D,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC1B,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,110 @@
+/**
+ * What the checkout can come to, and what the caller is handed back.
+ *
+ * Three outcomes rather than a boolean, because "the buyer closed it" and "we
+ * are broken" need different screens. A caller that collapses them tells
+ * somebody whose card was declined that payments are down.
+ */
+export type CheckoutOutcome = 'completed' | 'closed' | 'unavailable';
+/** What a confirmation attempt came to. `retry` means: build a new charge. */
+export type ConfirmResult = {
+    outcome: CheckoutOutcome;
+    /** Ready to show. Stripe's own wording where it is the buyer's to fix. */
+    error?: string;
+    /** The intent is spent — the caller must create another before trying again. */
+    retry?: boolean;
+    /**
+     * The card a SETUP just stored.
+     *
+     * Carried because attaching a card does not make it billable: Stripe charges
+     * the subscription's default payment method, then the customer's, and a card
+     * that is neither is simply on file. A caller that added a card BECAUSE the
+     * one on file was refused has to be able to say which one to use — otherwise
+     * the retry goes back to the card that just failed.
+     */
+    cardId?: string;
+};
+/**
+ * A charge that does not exist yet, described well enough to draw its form.
+ *
+ * Stripe calls this deferred intent creation, and it is what lets the checkout
+ * be ONE screen: the card form, the wallets and the total are on screen from
+ * the start, and the charge is created at the moment Pay is pressed rather than
+ * to make a form appear. Creating it first means every buyer who got as far as
+ * looking at a card form has already left an incomplete subscription behind.
+ *
+ * `recurring` picks the mode: something that renews is a `subscription` whose
+ * card must be usable again unattended; a one-off is a `payment` where keeping
+ * the card is the buyer's own choice in the element's checkbox.
+ */
+export type DeferredCharge = {
+    /** Minor units and currency, exactly as the server quoted them. */
+    amount: number;
+    currency: string;
+    recurring: boolean;
+};
+/** What the form is for: a secret to confirm, or a charge not yet created. */
+export type MountIntent = {
+    secret: string;
+    kind?: 'payment' | 'setup';
+} | {
+    deferred: DeferredCharge;
+};
+export type MountedCheckout = {
+    /**
+     * Confirm the payment. Resolves once Stripe has taken it, or says why not.
+     *
+     * The secret is an argument rather than something the form was built with,
+     * because a deferred form is mounted BEFORE the charge exists. Omitted for a
+     * form that already has one.
+     */
+    confirm: (clientSecret?: string) => Promise<ConfirmResult>;
+    /**
+     * Validate and collect, before anything is created. `null` means good to go;
+     * a string is Stripe's own complaint about the form, ready to show.
+     *
+     * Required by Stripe on a deferred form and harmless on any other: it is what
+     * turns "the buyer typed something" into payment details Stripe will accept,
+     * and it is where an incomplete card is caught — a press that reaches the
+     * server would otherwise leave a charge behind for a card never filled in.
+     */
+    submit: () => Promise<string | null>;
+    /** Re-price a deferred form when the total changes. */
+    update: (charge: DeferredCharge) => Promise<void>;
+    /** Whether the form is filled in far enough to pay. */
+    complete: () => boolean;
+    destroy: () => void;
+};
+/**
+ * A wallet's own path to a charge, and the one thing that still holds it back.
+ *
+ * Apple Pay, Google Pay and Link confirm from inside their sheet, so they never
+ * touch the caller's Pay button — and on a deferred form they need the same
+ * steps it takes: submit, create the charge, confirm. `create` is that middle
+ * one.
+ *
+ * `ready` answers a narrow question: is there a settled price to charge? A
+ * buyer who changes country and taps Apple Pay while the re-quote is still in
+ * flight would have the charge raised at the new total against a form still
+ * carrying the old one, and Stripe refuses a confirmation whose amounts
+ * disagree.
+ */
+export type WalletHooks = {
+    ready: () => boolean;
+    onNotReady: () => void;
+    create: () => Promise<string | null>;
+    /**
+     * Which wallets this visitor has, once Stripe has decided — empty when none.
+     *
+     * An empty wallet row and a wallet row still loading look identical from
+     * outside the iframe, and guessing between them is how a paywall ends up
+     * either flashing a gap or holding a spinner for ever.
+     */
+    onReady?: (available: string[]) => void;
+};
+/** The address the caller already collected, so Stripe stops asking for it. */
+export type BillingAddress = {
+    country: string;
+    postalCode?: string;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,QAAQ,GAAG,aAAa,CAAC;AAErE,8EAA8E;AAC9E,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,eAAe,CAAC;IACzB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,8EAA8E;AAC9E,MAAM,MAAM,WAAW,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,cAAc,CAAA;CAAE,CAAC;AAExG,MAAM,MAAM,eAAe,GAAG;IAC5B;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3D;;;;;;;;OAQG;IACH,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACrC,uDAAuD;IACvD,MAAM,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,uDAAuD;IACvD,QAAQ,EAAE,MAAM,OAAO,CAAC;IACxB,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,MAAM,OAAO,CAAC;IACrB,UAAU,EAAE,MAAM,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACrC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;CACzC,CAAC;AAEF,+EAA+E;AAC/E,MAAM,MAAM,cAAc,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,42 @@
 {
   "name": "@n1xv/stripe-elements",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.1",
+  "description": "Stripe Elements on your own checkout screen: deferred charges, wallet row, saved cards, 3D Secure, and one vocabulary for what a failure means",
+  "license": "MIT",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "peerDependencies": {
+    "@stripe/stripe-js": ">=9"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/n1xv/saas-kit.git",
+    "directory": "packages/stripe-elements"
+  },
+  "keywords": [
+    "stripe",
+    "stripe-elements",
+    "checkout",
+    "paywall",
+    "apple-pay",
+    "google-pay"
+  ],
+  "devDependencies": {
+    "@stripe/stripe-js": "^10.1.0",
+    "jsdom": "^30.1.3"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "lint": "echo 'lint runs from the repo root'",
+    "test": "vitest run --passWithNoTests"
+  }
 }