@shoppexio/storefront 1.0.71 → 1.0.73

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 1.0.73
+
+- `init({ currency })` is now enforced on every priced read (ADR-0066). `getStorefront`, `getStore`, `resolveStoreByDomain`, `getProducts`, `getStorefrontProductsPage` and `getProduct` send it as `?currency=`; before, only cart quotes and checkout used it, so a catalog could show one currency and the checkout price in another.
+- A currency the shop has not enabled fails those reads with `code: 'errors.storefront.currency_unavailable'` (`errorParams.requested`, `errorParams.available`) instead of silently serving the shop default. New export `CURRENCY_UNAVAILABLE_ERROR_CODE`.
+- `init` normalizes the currency to an upper-case ISO 4217 code and throws `ValidationError` for anything else.
+- Response cache keys carry locale and buyer currency; a re-init with another audience no longer reads the previous audience's payloads.
+- `Shop` gains `default_currency` and `available_currencies`; `Shop.currency` is documented as the currency the response is priced in.
+
+## 1.0.72
+
+- REMOVED: the checkout Turnstile verification lane. `mountCheckoutChallenge`, `CheckoutChallengeCallbacks`, `CheckoutChallengeFrame`, `ApiChallenge`, `SDKResponse.challenge`, `retryWithProof`, and the `autoResolveChallenge`/`turnstileToken` checkout options are gone; invoice creation is a single request again and rate-limit refusals are plain 429s. Bot protection moved to the platform edge. The `X-Idempotency-Key` machinery is unchanged.
+
 ## 1.0.70
 
 - One replay engine: a turnstile-challenged refusal now carries `retryWithProof` — the frozen hand-off (cart bytes, codes, currency, quote proof, and the ORIGINAL idempotency key) replays with only the fresh proof attached, and the server's create-request uniqueness is the double-invoice guarantee. Client coalescing is UX-only. New `quoteToken` option; shared Turnstile frame protocol.

package/README.md

@@ -47,6 +47,17 @@ if (line) {
 }
 ```
 
+## Buyer currency
+
+`shoppex.init('store-slug', { currency: 'EUR' })` prices every catalog read
+(`getStorefront`, `getStore`, `getProducts`, `getProduct`) in that currency and
+uses it for cart quotes and checkout. The currency must be enabled in the
+shop's settings: a read for a currency the shop does not sell in fails with
+`code: 'errors.storefront.currency_unavailable'` and `errorParams.available`
+listing the enabled ones. Nothing falls back to the shop default silently.
+`data.shop.currency` names the currency a response is priced in;
+`default_currency` and `available_currencies` describe the shop's setup.
+
 ## Multi-currency checkout
 
 When buyers can select a storefront currency, quote the cart and create the
@@ -66,46 +77,6 @@ currency-bound; Shoppex rejects a mismatch as
 `errors.checkout.quote_token_stale` instead of creating an invoice for a total
 the buyer did not approve.
 
-## Checkout verification on custom domains
-
-Shoppex can require human verification before it creates an invoice. Use the
-hosted verification broker from the SDK. Do not render the returned Turnstile
-site key directly on your custom domain.
-
-```ts
-import shoppex, { mountCheckoutChallenge } from '@shoppexio/storefront';
-
-const container = document.getElementById('checkout-verification');
-let frame: ReturnType<typeof mountCheckoutChallenge> | undefined;
-
-if (!container) throw new Error('Checkout verification container is missing.');
-
-async function startCheckout(turnstileToken?: string) {
-  const result = await shoppex.checkout({ turnstileToken });
-
-  if (result.success) return;
-  if (!result.challenge) throw new Error(result.message ?? 'Checkout could not be started.');
-
-  frame?.dispose();
-  frame = mountCheckoutChallenge(container, result.challenge, {
-    onSuccess(token) {
-      frame?.dispose();
-      frame = undefined;
-      void startCheckout(token);
-    },
-    onUnavailable() {
-      frame?.dispose();
-      frame = undefined;
-      console.error('Checkout verification could not load.');
-    },
-  });
-}
-```
-
-If your site sends a Content Security Policy, add
-`https://checkout.shoppex.io` to `frame-src`. Call `dispose()` when the checkout
-component unmounts or before you mount another challenge.
-
 ## Custom customer account
 
 Build your own OTP login, order history, and download UI without adding a