@viceme-ai/sdk 0.6.1 → 0.7.0

package/README.md

@@ -1,6 +1,6 @@
 # @viceme-ai/sdk
 
-ViceMe browser SDK for Shop-hosted engagement and origin-bound Website Work access.
+ViceMe browser SDK for Shop-hosted engagement and Website Work access.
 
 The release PR atomically owns the package version, runtime manifest, and
 changelog update. During the current preview stage, publication does not
@@ -58,7 +58,7 @@ if (!target) throw new Error('ViceMe target missing');
 
 const results = await Promise.allSettled([
   mountDanmaku(client, { target, theme: 'auto' }),
-  mountTip(client, { target, theme: 'auto' }),
+  mountTip(client, { target, theme: 'auto', presentation: 'integrated' }),
 ]);
 const mounted = results.flatMap((result) => (result.status === 'fulfilled' ? [result.value] : []));
 
@@ -68,6 +68,9 @@ client.destroy();
 
 Run those cleanup calls from the owning component's unmount path or another
 explicit lifecycle boundary, not from `pagehide` (which also covers bfcache).
+The integrated presentation uses the danmaku bar as its only visible launcher
+and opens the official Tip dialog. Standalone `mountTip()` remains inline by
+default.
 
 `createViceMe` and `ready()` are purely local and never contact Shop. A live client reports
 build support for `danmaku` and `tip`; Shop remains authoritative for whether a
@@ -86,12 +89,29 @@ use. They expose `client.auth`, `client.access`, and `client.checkout`; login,
 explicit follow, and hosted checkout remain ViceMe-owned UI. The host never
 receives a general ViceMe session or payment credential. Tests can inject a
 deterministic transport and presenter through `@viceme-ai/sdk/testing`.
+Calling `client.destroy()` cancels in-flight access requests, closes the active
+SDK-owned sign-in or checkout layer, and rejects the interrupted call with
+`CLIENT_DESTROYED`; late responses cannot restore the in-memory Work token.
+Request cancellation and timeouts remain effective until the parsed response is
+delivered. Cancelling the client's optional `signal` preserves the caller's
+`Error` reason; a request timeout rejects with retryable `NETWORK_TIMEOUT`.
+A cancelled response cannot establish a Work session even if its body has
+already finished parsing.
+
+The current Website Access release accepts any valid HTTP(S) host Origin and
+does not require DNS TXT verification. Session tokens remain bound to the
+Origin observed when they were issued, but that Origin is not compared with a
+registered allowlist. The hosted checkout iframe likewise has no parent-Origin
+`frame-ancestors` restriction; its signed launch context, expiry, official
+Shop URL, and server-authoritative entitlement checks remain enforced.
 
 Website access login renders the work-bound WeChat QR code directly in the SDK
 layer. Paid access keeps desktop QR payment and WeChat JSAPI in that layer;
 mobile H5/WAP payment may open a provider page or app. The original page polls
 the server-authoritative access decision and closes the layer after entitlement
-is active. This behavior does not change the separate Tip Widget flow.
+is active. Before login, the consent layer shows only the creator avatar,
+display name, published Work count, and the current Work title, summary, and
+cover. This behavior does not change the separate Tip Widget flow.
 
 ```ts
 const decisions = await client.access.checkMany(['members', 'pro-tools']);
@@ -110,10 +130,12 @@ scroll bucket, and sends only the opaque anchor to the hosted iframe. Destroying
 the mount removes its nodes, listeners, debounce timer, and location poll.
 
 The Tip mount sends no amount, provider, token, or application ID. It enables
-interaction only after a trusted resize handshake. Shop resets its hosted
-payment surface on Escape before sending close; the SDK forwards sanitized
-close and paid notifications, and removes its iframe, timer, media listener,
-and message listener on destroy.
+interaction only after a trusted resize handshake. In integrated mode it also
+accepts open requests only from the matching trusted danmaku controls, then
+restores focus there after close. Shop resets its hosted payment surface on
+Escape before sending close; the SDK forwards sanitized close and paid
+notifications, and removes its iframe, timer, media listener, and message
+listener on destroy.
 
 ## Headless Tip
 

package/dist/capability-mount.d.ts

@@ -3,6 +3,8 @@ export interface CapabilityMountOptions {
     /** Mount host element; the capability owns its Shadow DOM subtree. */
     target: Element;
     theme: 'light' | 'dark' | 'auto';
+    /** Use the shared danmaku controls as the visible Tip launcher. */
+    presentation?: 'inline' | 'integrated';
     /** Abort a mount that has not completed and destroy it after completion. */
     signal?: AbortSignal;
 }

package/dist/capability-mount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability-mount.d.ts","sourceRoot":"","sources":["../src/capability-mount.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,MAAM,WAAW,sBAAsB;IACrC,sEAAsE;IACtE,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;IACjC,4EAA4E;IAC5E,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,+EAA+E;AAC/E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,MAAM,MAAM,uBAAuB,GAAG,CACpC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,sBAAsB,KAC5B,OAAO,CAAC,qBAAqB,CAAC,CAAC"}
+{"version":3,"file":"capability-mount.d.ts","sourceRoot":"","sources":["../src/capability-mount.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,MAAM,WAAW,sBAAsB;IACrC,sEAAsE;IACtE,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;IACjC,mEAAmE;IACnE,YAAY,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;IACvC,4EAA4E;IAC5E,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,+EAA+E;AAC/E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,MAAM,MAAM,uBAAuB,GAAG,CACpC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,sBAAsB,KAC5B,OAAO,CAAC,qBAAqB,CAAC,CAAC"}