@shoppexio/storefront 1.0.61 → 1.0.63

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 1.0.63
+
+- Keep managed checkout verification collapsed until Cloudflare requires buyer interaction.
+
+## 1.0.62
+
+- Fail open with an unavailable callback when the hosted checkout verification broker never completes its ready handshake.
+
 ## 1.0.61
 
 - Add `mountCheckoutChallenge()` so custom storefront domains can complete the hosted checkout verification broker and retry invoice creation.

package/dist/index.cjs

@@ -20384,10 +20384,11 @@ function buildCheckoutUrlSync() {
 // ../sdk/src/modules/checkout-challenge.ts
 var TURNSTILE_FRAME_MESSAGE_SOURCE = "shoppex-turnstile";
 var TURNSTILE_FRAME_MESSAGE_VERSION = 1;
+var TURNSTILE_FRAME_READY_TIMEOUT_MS = 1e4;
 function readFrameMessage(value, nonce) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   const record2 = value;
-  if (record2.source !== TURNSTILE_FRAME_MESSAGE_SOURCE || record2.version !== TURNSTILE_FRAME_MESSAGE_VERSION || record2.nonce !== nonce || !["success", "expired", "timeout", "error"].includes(String(record2.type))) return null;
+  if (record2.source !== TURNSTILE_FRAME_MESSAGE_SOURCE || record2.version !== TURNSTILE_FRAME_MESSAGE_VERSION || record2.nonce !== nonce || !["ready", "visible", "hidden", "success", "expired", "timeout", "error"].includes(String(record2.type))) return null;
   if (record2.type === "success" && (typeof record2.token !== "string" || !record2.token.trim())) {
     return null;
   }
@@ -20416,13 +20417,24 @@ function mountCheckoutChallenge(container, challenge, callbacks) {
   frame.referrerPolicy = "no-referrer";
   frame.style.border = "0";
   frame.style.width = "100%";
-  frame.style.height = "72px";
+  frame.style.height = "0";
   let disposed = false;
+  let ready = false;
+  const readyTimeout = win.setTimeout(() => {
+    if (!disposed && !ready) callbacks.onUnavailable?.();
+  }, TURNSTILE_FRAME_READY_TIMEOUT_MS);
   const onMessage = (event) => {
     if (disposed || event.origin !== frameUrl.origin || event.source !== frame.contentWindow) return;
     const message = readFrameMessage(event.data, nonce);
     if (!message) return;
-    if (message.type === "success") callbacks.onSuccess(message.token);
+    ready = true;
+    win.clearTimeout(readyTimeout);
+    if (message.type === "visible") frame.style.height = "72px";
+    if (message.type === "hidden") frame.style.height = "0";
+    if (message.type === "success") {
+      frame.style.height = "0";
+      callbacks.onSuccess(message.token);
+    }
     if (message.type === "expired" || message.type === "timeout") callbacks.onExpired?.();
     if (message.type === "error") callbacks.onUnavailable?.();
   };
@@ -20435,6 +20447,7 @@ function mountCheckoutChallenge(container, challenge, callbacks) {
     dispose() {
       if (disposed) return;
       disposed = true;
+      win.clearTimeout(readyTimeout);
       win.removeEventListener("message", onMessage);
       frame.removeEventListener("error", onFrameError);
       frame.remove();