@qrauth/web-components 0.4.0 → 0.4.1

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @qrauth/web-components
 
+## [0.4.1] — 2026-04-29
+
+### Fixed
+- Removed dependency on `api.qrserver.com` for QR rendering. QR codes are now rendered locally as inline SVG via the `qrcode` library. Required for WP.org plugin directory submission and for any consumer with strict CSP.
+- QR quiet zone increased from 1 to 4 modules per ISO/IEC 18004 — restores the scan reliability of the previous external renderer on stricter readers (iPhone Camera, older Android, low-light captures).
+- Capacity overflow in `qrToSvg()` no longer crashes the component render — `QRCode.create` is now wrapped in try/catch and returns an empty SVG on overflow, letting the calling state render its empty-qr fallback.
+
+### Changed
+- New runtime dependency: `qrcode@1.5.4` (already pinned by `@qrauth/animated-qr`).
+- **`<qrauth-login>` and `<qrauth-2fa>` mobile "Continue with QRAuth" CTA** now appends `?dr=1` to the hosted approval URL. Forward-compatible with an upcoming server-side change at `qrauth.io/a/:token` that will gate the post-approval redirect on this flag — same-device clicks redirect, cross-device scans land on a terminal "Approved, you can close this tab" state. No behavior change until the server gating ships; safe to deploy independently.
+
 ## 0.4.0
 
 - **`<qrauth-login>` and `<qrauth-2fa>`: new `redirect-uri` attribute.** After the user taps Approve on the mobile CTA path, the QRAuth hosted approval page now navigates back to the consumer site instead of landing on a "you can close this page" dead end. The attribute is forwarded to `POST /api/v1/auth-sessions` as `redirectUrl` and validated server-side against the app's registered `redirectUrls` allowlist (same security model as OAuth 2.0 redirect URIs — strips trailing slash and ignores query + fragment before comparison). No-op on the desktop QR flow since polling in the original tab already handles the transition.

package/README.md

@@ -14,12 +14,12 @@ All three components bubble `qrauth:*` events across the Shadow DOM boundary (`c
 npm install @qrauth/web-components
 ```
 
-Or load the CDN IIFE directly in any HTML page:
+Or load the CDN IIFE directly in any HTML page (latest hashes at [`https://cdn.qrauth.io/v1/latest.json`](https://cdn.qrauth.io/v1/latest.json)):
 
 ```html
 <script
-  src="https://cdn.qrauth.io/v1/components.js"
-  integrity="sha384-..."
+  src="https://cdn.qrauth.io/v1/components-0.4.0.js"
+  integrity="sha384-ZsvnpXBK9tghmz/PCtZUtR+7qTF7XhR35/SGNfJuJgLOBxnIRi3JYhRt1oFxNtU6"
   crossorigin="anonymous"
 ></script>
 
@@ -57,6 +57,7 @@ Or load the CDN IIFE directly in any HTML page:
 | `animated` | boolean | off | Enables the pulse animation on the QR. |
 | `force-mode` | `mobile` \| `desktop` \| `auto` | `auto` | Override automatic mobile detection. |
 | `mobile-fallback-only` | boolean | off | Keep the QR-first body on every device; disables the mobile CTA path. |
+| `redirect-uri` | URL | — | Where the hosted approval page sends the user after Approve. Required for the mobile flow to feel complete. Must match the app's registered `redirectUrls` allowlist. See [docs.qrauth.io/guide/web-components](https://docs.qrauth.io/guide/web-components#the-mobile-flow) for the URL-callback handler your app needs. |
 
 ## Events
 

package/dist/login.d.ts

@@ -53,6 +53,7 @@ export declare class QRAuthLogin extends QRAuthElement {
     private _codeVerifier;
     private _status;
     private _expiresAt;
+    private _currentQrUrl;
     private _timerInterval;
     private _pollTimeout;
     get scopes(): string;
@@ -97,6 +98,11 @@ export declare class QRAuthLogin extends QRAuthElement {
      * The existing polling loop in _beginPolling picks up SCANNED / APPROVED
      * transitions from the server once the user completes the flow there,
      * so qrauth:scanned and qrauth:authenticated fire unchanged.
+     *
+     * The `dr=1` query flag tells the hosted approval page that this is a
+     * same-device click (not a cross-device QR scan), and that the
+     * post-approval redirect to redirectUrl should fire. The QR matrix
+     * encodes the bare /a/:token URL, so a scanner cannot carry this flag.
      */
     private _openApprovalPage;
     private _openModal;