@openreceive/browser 0.4.3 → 0.4.5

package/dist/headless.js

@@ -75,7 +75,6 @@ import {
   getNetworkIconId,
   getPaymentMethodIcon,
   getPaymentMethodIconId,
-  getRouteIconPath,
   getRouteNetworkLabel,
   getSwapOptionIcon,
   getSwapOptionIconId,
@@ -100,7 +99,6 @@ import {
   parseResolvedTheme,
   parseThemePreference,
   paymentAccentId,
-  paymentIconPaths,
   paymentIconSvgs,
   paymentIconUrls,
   paymentMethods,
@@ -121,10 +119,14 @@ import {
   swapOptionLimitSentence,
   swapPickerKey,
   updatePaymentWizardSelection
-} from "./chunk-VZ7M7ZUE.js";
+} from "./chunk-ZTB2TOBO.js";
 
 // src/headless.ts
-import { createAssetBaseUrlResolver, getPaymentWizardRoutes } from "@openreceive/provider-data";
+import {
+  getPaymentWizardRoutes,
+  loadPayTutorialImages,
+  payTutorialImage
+} from "@openreceive/provider-data";
 
 // src/internal/checkout-props.ts
 var CREATE_MODE_ONLY_PROPS = [
@@ -216,6 +218,7 @@ function createCheckoutSession(options) {
     const selection = swap.selection;
     const prefix = swap.prefix();
     const fetcher = swap.fetch();
+    const csrfHeader = swap.csrfHeader?.();
     const reference = options.reference();
     if (prefix === void 0 || fetcher === void 0) {
       const missing = [
@@ -236,11 +239,12 @@ function createCheckoutSession(options) {
     swapStartError = void 0;
     options.onChange();
     try {
-      const quote = await quoteSwapAsset(payInAsset, prefix, fetcher, reference);
+      const quote = await quoteSwapAsset(payInAsset, prefix, fetcher, reference, csrfHeader);
       if (quote !== void 0 && quote.available === false) return;
       const started = await startSwapRequest({
         fetch: fetcher,
         prefix,
+        ...csrfHeader === void 0 ? {} : { csrfHeader },
         reference,
         payInAsset,
         ...options.logger === void 0 ? {} : { logger: options.logger }
@@ -263,10 +267,11 @@ function createCheckoutSession(options) {
       startingSwapAsset = null;
     }
   }
-  async function quoteSwapAsset(payInAsset, prefix, fetcher, reference) {
+  async function quoteSwapAsset(payInAsset, prefix, fetcher, reference, csrfHeader) {
     const body = await postJson({
       fetch: fetcher,
       prefix,
+      ...csrfHeader === void 0 ? {} : { csrfHeader },
       ...options.logger === void 0 ? {} : { logger: options.logger },
       body: { reference, action: "swap_quote", pay_in_asset: payInAsset }
     });
@@ -437,6 +442,9 @@ function sharedElementAttributes(options) {
   if (isSet(options.prefix)) {
     attributes[OPENRECEIVE_CHECKOUT_ELEMENT_ATTRIBUTES.prefix] = options.prefix;
   }
+  if (isSet(options.csrfHeader)) {
+    attributes[OPENRECEIVE_CHECKOUT_ELEMENT_ATTRIBUTES.csrfHeader] = options.csrfHeader;
+  }
   if (isSet(options.theme)) {
     attributes[OPENRECEIVE_CHECKOUT_ELEMENT_ATTRIBUTES.theme] = options.theme;
   }
@@ -448,9 +456,6 @@ function sharedElementAttributes(options) {
   if (options.decodeLinkUrl !== void 0) {
     attributes[OPENRECEIVE_CHECKOUT_ELEMENT_ATTRIBUTES.decodeLinkUrl] = options.decodeLinkUrl;
   }
-  if (isSet(options.assetBaseUrl)) {
-    attributes[OPENRECEIVE_CHECKOUT_ELEMENT_ATTRIBUTES.assetBaseUrl] = options.assetBaseUrl;
-  }
   if (options.resumable !== void 0) {
     attributes[OPENRECEIVE_CHECKOUT_ELEMENT_ATTRIBUTES.resumable] = String(options.resumable);
   }
@@ -648,7 +653,6 @@ export {
   checkoutElementStyles,
   checkoutLabels,
   copyInvoice,
-  createAssetBaseUrlResolver,
   createBlockExplorerUrl,
   createCheckoutActionEvent,
   createCheckoutController,
@@ -705,13 +709,13 @@ export {
   getPaymentMethodIcon,
   getPaymentMethodIconId,
   getPaymentWizardRoutes,
-  getRouteIconPath,
   getRouteNetworkLabel,
   getSwapOptionIcon,
   getSwapOptionIconId,
   getSwapRefundFormError,
   getWizardEmptyMessage,
   isReusableLightningInvoice,
+  loadPayTutorialImages,
   mergeAttemptIntoCheckout,
   mergeAttemptIntoSnapshot,
   networkButtonClasses,
@@ -727,8 +731,8 @@ export {
   parsePaymentMethod,
   parseResolvedTheme,
   parseThemePreference,
+  payTutorialImage,
   paymentAccentId,
-  paymentIconPaths,
   paymentIconSvgs,
   paymentIconUrls,
   paymentMethods,

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { aW as BrowserLogLevel } from './status-iwqocz21.js';
-export { aX as BrowserLogEntry, X as BrowserLogger, B as BrowserLoggerOption, Y as BrowserRequestError, Z as CheckoutController, _ as CheckoutControllerOptions, h as CheckoutSnapshot, j as CheckoutState, aY as CopyInvoiceOptions, aZ as GuestCheckoutResumeController, a_ as GuestCheckoutResumeOptions, a$ as OpenWalletOptions, b0 as PrepareCheckoutOptions, b1 as QrOptions, b2 as RequestCheckoutOptions, ar as Status, b3 as StatusInvoiceLike, U as UnixSeconds, aw as copyInvoice, ay as createCheckoutController, b4 as createGuestCheckoutResume, b5 as createGuestOrderFetcher, b6 as createLightningUri, b7 as createQrPngDataUrl, aD as createQrSvg, aJ as deriveStatus, aK as enterCheckoutResumePath, aS as openWallet, aU as prepareCheckout, aV as requestCheckout } from './status-iwqocz21.js';
+import { aW as BrowserLogLevel } from './status-Doh8Wz4D.js';
+export { aX as BrowserLogEntry, X as BrowserLogger, B as BrowserLoggerOption, Y as BrowserRequestError, Z as CheckoutController, _ as CheckoutControllerOptions, h as CheckoutSnapshot, j as CheckoutState, aY as CopyInvoiceOptions, aZ as GuestCheckoutResumeController, a_ as GuestCheckoutResumeOptions, a$ as OpenWalletOptions, b0 as PrepareCheckoutOptions, b1 as QrOptions, b2 as RequestCheckoutOptions, ar as Status, b3 as StatusInvoiceLike, U as UnixSeconds, aw as copyInvoice, ay as createCheckoutController, b4 as createGuestCheckoutResume, b5 as createGuestOrderFetcher, b6 as createLightningUri, b7 as createQrPngDataUrl, aD as createQrSvg, aJ as deriveStatus, aK as enterCheckoutResumePath, aS as openWallet, aU as prepareCheckout, aV as requestCheckout } from './status-Doh8Wz4D.js';
 import '@openreceive/provider-data';
 import '@openreceive/core';
 

package/dist/index.js

@@ -13,7 +13,7 @@ import {
   openWallet,
   prepareCheckout,
   requestCheckout
-} from "./chunk-VZ7M7ZUE.js";
+} from "./chunk-ZTB2TOBO.js";
 export {
   BrowserRequestError,
   copyInvoice,

package/dist/{status-iwqocz21.d.ts → status-Doh8Wz4D.d.ts}

@@ -248,6 +248,13 @@ declare const OPENRECEIVE_CHECKOUT_ELEMENT_ATTRIBUTES: {
      * attribute — see `checkoutRoutes` in ../internal/routes.ts.
      */
     readonly prefix: "prefix";
+    /**
+     * Header name the page's `<meta name="csrf-token">` value is sent under on
+     * every request the element makes. Default `X-CSRF-Token` (Rails, Laravel);
+     * Django reads `X-CSRFToken`, WordPress REST reads `X-WP-Nonce`. The meta
+     * tag name is fixed; only the header name is the host's to choose.
+     */
+    readonly csrfHeader: "csrf-header";
     /** JSON-encoded create-time metadata forwarded to the create request. */
     readonly metadata: "metadata";
     readonly invoiceId: "invoice-id";
@@ -293,19 +300,6 @@ declare const OPENRECEIVE_CHECKOUT_ELEMENT_ATTRIBUTES: {
      * default), no decode link is rendered and the invoice never leaves the page.
      */
     readonly decodeLinkUrl: "decode-link-url";
-    /**
-     * Where this app serves the packages' `dist/assets` trees, as one base URL —
-     * the string form of the `resolveAssetUrl` seam, so plain markup and the
-     * Vue/Svelte/Angular wrappers can reach it (a function cannot cross an HTML
-     * attribute). Every packaged key is a relative path under one `assets/` root,
-     * so the value is joined to it directly: `asset-base-url="/openreceive-assets"`
-     * makes `assets/provider-icons/strike.png` load from
-     * `/openreceive-assets/assets/provider-icons/strike.png`. Only the provider
-     * images need it; the payment-method icons are compiled in and drawn inline
-     * unless a base URL is set, in which case they are served as files too. A
-     * `resolveAssetUrl` passed to `defineElements` wins over it.
-     */
-    readonly assetBaseUrl: "asset-base-url";
     /** `polling="false"` renders the snapshot without status polling (no POST /payments/check). */
     readonly polling: "polling";
     /** Status poll cadence in milliseconds; defaults to OPENRECEIVE_DEFAULT_POLL_INTERVAL_MS. */
@@ -653,6 +647,13 @@ interface CheckoutElementAttributeOptions {
      * routes without spelling them out.
      */
     readonly prefix?: string;
+    /**
+     * Header name the page's `<meta name="csrf-token">` value is sent under on
+     * every request the element makes. Emitted as the element's `csrf-header`
+     * attribute. Default `X-CSRF-Token` (Rails, Laravel); Django reads
+     * `X-CSRFToken`, WordPress REST reads `X-WP-Nonce`.
+     */
+    readonly csrfHeader?: string;
     /**
      * Optional create-time metadata (parity with the React `<Checkout metadata>`
      * prop): JSON-encoded onto the element's `metadata` attribute and sent with
@@ -688,14 +689,6 @@ interface CheckoutElementAttributeOptions {
      * renders no "Decode" link and the invoice is never sent to a third party.
      */
     readonly decodeLinkUrl?: string;
-    /**
-     * Where this app serves the packages' `dist/assets` trees, as one base URL.
-     * The string form of the `resolveAssetUrl` seam: every packaged asset key is a
-     * relative path under one `assets/` root, so the value is joined to it
-     * directly. Emitted as the element's `asset-base-url` attribute, which is how
-     * the Vue/Svelte/Angular wrappers reach a seam a function cannot cross.
-     */
-    readonly assetBaseUrl?: string;
     /** False renders the snapshot without status polling (no POST /payments/check). */
     readonly polling?: boolean;
     /** Status poll cadence in milliseconds; defaults to OPENRECEIVE_DEFAULT_POLL_INTERVAL_MS. */
@@ -824,7 +817,7 @@ interface RequestCheckoutOptions extends RequestCheckoutBaseOptions {
  * `prepareCheckout` posts only the order id — it locks the amount and lists
  * payment methods without minting — so there is no memo or metadata to carry.
  */
-type PrepareCheckoutOptions = Pick<RequestCheckoutBaseOptions, "prefix" | "reference" | "fetch" | "headers">;
+type PrepareCheckoutOptions = Pick<RequestCheckoutBaseOptions, "prefix" | "reference" | "fetch" | "headers" | "csrfHeader">;
 interface RequestCheckoutBaseOptions {
     /**
      * Base path the shipped router is mounted at (e.g. `/openreceive`). The create and
@@ -835,6 +828,12 @@ interface RequestCheckoutBaseOptions {
     readonly reference: string;
     readonly fetch?: typeof globalThis.fetch;
     readonly headers?: Readonly<Record<string, string>>;
+    /**
+     * Header name the page's `<meta name="csrf-token">` value is sent under.
+     * Default `X-CSRF-Token` (Rails, Laravel); Django reads `X-CSRFToken`,
+     * WordPress REST reads `X-WP-Nonce`. The meta tag name itself is fixed.
+     */
+    readonly csrfHeader?: string;
     readonly memo?: string;
     readonly metadata?: Record<string, unknown>;
 }
@@ -848,6 +847,8 @@ interface CreateOpenReceiveStatusFetcherOptions {
     readonly snapshot: CheckoutSnapshot;
     readonly fetch?: typeof globalThis.fetch;
     readonly headers?: Readonly<Record<string, string>>;
+    /** Header name the page's `<meta name="csrf-token">` is sent under; default `X-CSRF-Token`. */
+    readonly csrfHeader?: string;
 }
 interface CheckoutWatcherOptions {
     readonly snapshot: CheckoutSnapshot;
@@ -878,6 +879,11 @@ interface CheckoutControllerOptions extends Omit<CheckoutWatcherOptions, "onStat
     readonly polling?: boolean;
     readonly fetch?: typeof globalThis.fetch;
     readonly statusHeaders?: Readonly<Record<string, string>>;
+    /**
+     * Header name the page's `<meta name="csrf-token">` is sent under, on the
+     * status poll and the swap refund calls alike. Default `X-CSRF-Token`.
+     */
+    readonly csrfHeader?: string;
     readonly clipboard?: Pick<Clipboard, "writeText">;
     readonly open?: (uri: string) => void;
 }
@@ -1040,18 +1046,20 @@ interface WizardRouteAssetDisplay {
     readonly id: string;
     readonly label: string;
     readonly subtitle: string;
-    /** The icon as a URL: the packaged `data:` URI, or the host resolver's answer. */
+    /** The icon as a `data:` URI. */
     readonly icon: string;
     /** The key behind `icon`, into `paymentIconSvgs` for a renderer drawing it inline. */
     readonly iconId: PaymentIconId;
-    /** The packaged path behind `icon`, for a host serving the files itself. */
-    readonly iconPath: string;
     readonly selected: boolean;
 }
 interface WizardProviderTutorialDisplay {
     readonly index: number;
     readonly path: string;
-    readonly image: string;
+    /**
+     * The screenshot as a `data:` URI, or `undefined` until
+     * `loadPayTutorialImages()` has resolved (the caption renders alone until then).
+     */
+    readonly image: string | undefined;
     readonly caption: string;
 }
 interface WizardProviderDisplay {
@@ -1059,14 +1067,8 @@ interface WizardProviderDisplay {
     readonly name: string;
     readonly kind: string;
     readonly url: string;
+    /** The wallet logo as a `data:` URI. */
     readonly icon: string;
-    /**
-     * The packaged path the icon came from (`assets/provider-icons/strike.png`).
-     * `icon` is only loadable when the host's bundler resolved it; this is the
-     * key a host that serves the files itself maps, without going back to
-     * `providerRegistry` for `icon_path`.
-     */
-    readonly iconPath: string;
     readonly tutorials: readonly WizardProviderTutorialDisplay[];
     readonly copyLabel: string;
     readonly copiedLabel: string;