@seatlayer/js 0.67.11 → 0.67.12

package/dist/index.d.cts

@@ -1854,11 +1854,11 @@ interface SeatPickerOptions {
      * Where a redirecting gateway should send the buyer back to, for
      * `checkout: 'hosted'`.
      *
-     * The server keeps this URL verbatim — path and query included — and only
-     * stamps `?order=…&status=success|cancelled` onto it, so point it at
-     * whichever of YOUR pages should confirm the purchase (often just
-     * `window.location.href`). Mount a picker on that page and it resumes in
-     * place from those parameters.
+     * The server keeps this URL's path and query and adds only a non-secret
+     * `seatlayer_checkout=success|cancelled` outcome. The SDK keeps the order id
+     * in this tab's sessionStorage before leaving for the gateway. Point this at
+     * a page on the same origin (often `window.location.href`) and mount a picker
+     * there so it can resume without putting the order capability in a URL.
      *
      * It is validated, not trusted: the organizer declares their embed origins
      * in the dashboard, and an undeclared origin is ignored rather than
@@ -1866,6 +1866,8 @@ interface SeatPickerOptions {
      * SeatLayer's page. Supplying a URL therefore cannot authorize it, which is
      * what stops a copied snippet from redirecting a paid buyer anywhere it
      * likes.
+     * As with every script embed, code already running on the host origin can
+     * read that origin's sessionStorage; iframe embedding provides SOP isolation.
      */
     returnUrl?: string;
     /**
@@ -2200,11 +2202,7 @@ declare class SeatPicker implements GaPromptPicker {
     private confirmThumbHtml;
     /** True when the picker is rendered inside an iframe (snippet embed at /e/:key). */
     private isFramed;
-    /**
-     * Post a widget→host message when framed. targetOrigin is '*' because the
-     * payload carries nothing sensitive (a height number / a fullscreen flag);
-     * hosts verify `event.origin` on their side (see `attachPickerFrame`).
-     */
+    /** Post a widget→host message only when the browser identifies its origin. */
     private postToHost;
     /**
      * Height (px) to advertise to a host frame.
@@ -2259,21 +2257,7 @@ declare class SeatPicker implements GaPromptPicker {
     private observeLayout;
     /** Render the shared controller into the already-mounted canvas host. */
     private loadChart;
-    /**
-     * A hosted gateway returned this buyer to a page that runs the widget, with
-     * `?order=…&status=…` in the URL. Pick the order up and finish the story.
-     *
-     * Only `success` resumes. `cancelled` means the buyer backed out at the
-     * gateway and their seats are still held — the map they are looking at IS the
-     * right screen, and opening a card to say "you cancelled" would be noise.
-     *
-     * The two parameters are then stripped with `replaceState`, because they are a
-     * one-shot instruction: leaving them in place would re-open the confirmation
-     * on every later navigation, and would carry an order id into browser history
-     * and any Referer this page later sends. `status` is only ever removed
-     * alongside an `order` we actually consumed, so a host page that uses a
-     * `status` parameter of its own keeps it.
-     */
+    /** Resume a redirect checkout from this tab's storage, never from the URL. */
     private resumeHostedOrder;
     /**
      * Move layout-dependent chrome between its wide dock (map regions / zoom

package/dist/index.d.ts

@@ -1854,11 +1854,11 @@ interface SeatPickerOptions {
      * Where a redirecting gateway should send the buyer back to, for
      * `checkout: 'hosted'`.
      *
-     * The server keeps this URL verbatim — path and query included — and only
-     * stamps `?order=…&status=success|cancelled` onto it, so point it at
-     * whichever of YOUR pages should confirm the purchase (often just
-     * `window.location.href`). Mount a picker on that page and it resumes in
-     * place from those parameters.
+     * The server keeps this URL's path and query and adds only a non-secret
+     * `seatlayer_checkout=success|cancelled` outcome. The SDK keeps the order id
+     * in this tab's sessionStorage before leaving for the gateway. Point this at
+     * a page on the same origin (often `window.location.href`) and mount a picker
+     * there so it can resume without putting the order capability in a URL.
      *
      * It is validated, not trusted: the organizer declares their embed origins
      * in the dashboard, and an undeclared origin is ignored rather than
@@ -1866,6 +1866,8 @@ interface SeatPickerOptions {
      * SeatLayer's page. Supplying a URL therefore cannot authorize it, which is
      * what stops a copied snippet from redirecting a paid buyer anywhere it
      * likes.
+     * As with every script embed, code already running on the host origin can
+     * read that origin's sessionStorage; iframe embedding provides SOP isolation.
      */
     returnUrl?: string;
     /**
@@ -2200,11 +2202,7 @@ declare class SeatPicker implements GaPromptPicker {
     private confirmThumbHtml;
     /** True when the picker is rendered inside an iframe (snippet embed at /e/:key). */
     private isFramed;
-    /**
-     * Post a widget→host message when framed. targetOrigin is '*' because the
-     * payload carries nothing sensitive (a height number / a fullscreen flag);
-     * hosts verify `event.origin` on their side (see `attachPickerFrame`).
-     */
+    /** Post a widget→host message only when the browser identifies its origin. */
     private postToHost;
     /**
      * Height (px) to advertise to a host frame.
@@ -2259,21 +2257,7 @@ declare class SeatPicker implements GaPromptPicker {
     private observeLayout;
     /** Render the shared controller into the already-mounted canvas host. */
     private loadChart;
-    /**
-     * A hosted gateway returned this buyer to a page that runs the widget, with
-     * `?order=…&status=…` in the URL. Pick the order up and finish the story.
-     *
-     * Only `success` resumes. `cancelled` means the buyer backed out at the
-     * gateway and their seats are still held — the map they are looking at IS the
-     * right screen, and opening a card to say "you cancelled" would be noise.
-     *
-     * The two parameters are then stripped with `replaceState`, because they are a
-     * one-shot instruction: leaving them in place would re-open the confirmation
-     * on every later navigation, and would carry an order id into browser history
-     * and any Referer this page later sends. `status` is only ever removed
-     * alongside an `order` we actually consumed, so a host page that uses a
-     * `status` parameter of its own keeps it.
-     */
+    /** Resume a redirect checkout from this tab's storage, never from the URL. */
     private resumeHostedOrder;
     /**
      * Move layout-dependent chrome between its wide dock (map regions / zoom