@shoppexio/storefront 1.0.71 → 1.0.72

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 1.0.72
+
+- REMOVED: the checkout Turnstile verification lane. `mountCheckoutChallenge`, `CheckoutChallengeCallbacks`, `CheckoutChallengeFrame`, `ApiChallenge`, `SDKResponse.challenge`, `retryWithProof`, and the `autoResolveChallenge`/`turnstileToken` checkout options are gone; invoice creation is a single request again and rate-limit refusals are plain 429s. Bot protection moved to the platform edge. The `X-Idempotency-Key` machinery is unchanged.
+
 ## 1.0.70
 
 - One replay engine: a turnstile-challenged refusal now carries `retryWithProof` — the frozen hand-off (cart bytes, codes, currency, quote proof, and the ORIGINAL idempotency key) replays with only the fresh proof attached, and the server's create-request uniqueness is the double-invoice guarantee. Client coalescing is UX-only. New `quoteToken` option; shared Turnstile frame protocol.

package/README.md

@@ -66,46 +66,6 @@ currency-bound; Shoppex rejects a mismatch as
 `errors.checkout.quote_token_stale` instead of creating an invoice for a total
 the buyer did not approve.
 
-## Checkout verification on custom domains
-
-Shoppex can require human verification before it creates an invoice. Use the
-hosted verification broker from the SDK. Do not render the returned Turnstile
-site key directly on your custom domain.
-
-```ts
-import shoppex, { mountCheckoutChallenge } from '@shoppexio/storefront';
-
-const container = document.getElementById('checkout-verification');
-let frame: ReturnType<typeof mountCheckoutChallenge> | undefined;
-
-if (!container) throw new Error('Checkout verification container is missing.');
-
-async function startCheckout(turnstileToken?: string) {
-  const result = await shoppex.checkout({ turnstileToken });
-
-  if (result.success) return;
-  if (!result.challenge) throw new Error(result.message ?? 'Checkout could not be started.');
-
-  frame?.dispose();
-  frame = mountCheckoutChallenge(container, result.challenge, {
-    onSuccess(token) {
-      frame?.dispose();
-      frame = undefined;
-      void startCheckout(token);
-    },
-    onUnavailable() {
-      frame?.dispose();
-      frame = undefined;
-      console.error('Checkout verification could not load.');
-    },
-  });
-}
-```
-
-If your site sends a Content Security Policy, add
-`https://checkout.shoppex.io` to `frame-src`. Call `dispose()` when the checkout
-component unmounts or before you mount another challenge.
-
 ## Custom customer account
 
 Build your own OTP login, order history, and download UI without adding a