@waffo/pancake-ts 0.3.4 → 0.4.1

package/CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to `@waffo/pancake-ts` will be documented in this file.
 
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.1] - 2026-04-15
+
+### Changed
+
+- **`RefundTicket.versionData` is now structured** — tightened from `Record<string, unknown> | null` to a new `RefundTicketVersionData | null` type matching the GraphQL `RefundTicketVersionData` shape: `{ reason: string; requestedAmount: RequestedAmount | null }`. Aligns with `waffo-pancake-graphql-service` v2026.04.15.1.
+
+### Added
+
+- **`RefundTicketVersionData`** — exported type. Reuses the existing `RequestedAmount` for the nested amount field.
+
+## [0.4.0] - 2026-04-15
+
+### Breaking Changes
+
+- **`buyerEmail` no longer falls back to `buyerIdentity`** — `checkout.authenticated.create({ buyerIdentity, ... })` used to silently copy `buyerIdentity` into the outgoing `buyerEmail` when the caller omitted `buyerEmail`. It no longer does. `buyerIdentity` is for the JWT (merchant-side buyer identification) and `buyerEmail` is for pre-filling the checkout page's email input; the two fields are fully independent. Migration: if you were passing a non-email `buyerIdentity` (e.g. an internal user ID) and relying on the email input being pre-filled, pass `buyerEmail: user.email` explicitly alongside `buyerIdentity`.
+
+### Changed
+
+- **`AnonymousCheckoutParams` widened to full session params** — now accepts `buyerEmail` and `billingDetail` so merchants can pre-fill the checkout page without issuing a session token. Equivalent to `CreateCheckoutSessionParams`.
+- **`AuthenticatedCheckoutParams` restructured** — now extends `CreateCheckoutSessionParams` with a single extra field `buyerIdentity`. Implementation uses destructure-and-forward so `buyerIdentity` can never leak into the create-session payload.
+
+### Documentation
+
+- **JSDoc rewrites** — `IssueSessionTokenParams.buyerIdentity`, `AuthenticatedCheckoutParams.buyerIdentity`, and both checkout wrappers now clearly state that `buyerIdentity` is JWT-only and is never rendered on the checkout page.
+
 ## [0.3.4] - 2026-04-14
 
 ### Changed

package/README.md

@@ -80,19 +80,22 @@ Both modes support **dynamic pricing** and **trial control** at checkout time:
 
 The merchant provides buyer identity — the SDK issues a session token, creates a checkout session, and returns a checkout URL with the token appended as a URL fragment. One call does everything.
 
+`buyerIdentity` is for order attribution and trial tracking only — it is not rendered on the checkout page. To pre-fill the email field on the checkout form, pass `buyerEmail` explicitly.
+
 ```typescript
-// Basic — buyer identity only
+// Basic — buyer identity only (checkout page email field stays empty)
 const result = await client.checkout.authenticated.create({
   productId: "PROD_xxx",
   currency: "USD",
-  buyerIdentity: "customer@example.com",
+  buyerIdentity: "userIdInYourSystem",
 });
 
 // With dynamic pricing — override stored price (e.g., coupon, volume discount)
 const result = await client.checkout.authenticated.create({
   productId: "PROD_xxx",
   currency: "USD",
-  buyerIdentity: "customer@example.com",
+  buyerIdentity: "userIdInYourSystem",
+  buyerEmail: "customer@example.com",
   priceSnapshot: { amount: "19.99", taxCategory: "digital_goods" },
 });
 
@@ -100,7 +103,8 @@ const result = await client.checkout.authenticated.create({
 const result = await client.checkout.authenticated.create({
   productId: "PROD_xxx",
   currency: "USD",
-  buyerIdentity: "customer@example.com",
+  buyerIdentity: "userIdInYourSystem",
+  buyerEmail: "customer@example.com",
   withTrial: true, // force enable trial (false = skip, omit = default rules)
   billingDetail: { country: "US", isBusiness: false },
 });

package/dist/index.cjs

@@ -506,11 +506,20 @@ var CheckoutAnonymousResource = class {
    * @returns Session ID, checkout URL, and expiration
    *
    * @example
+   * // Minimal — buyer fills everything on the page
    * const result = await client.checkout.anonymous.create({
    *   productId: "PROD_xxx",
    *   currency: "USD",
    * });
-   * // Redirect to result.checkoutUrl
+   *
+   * @example
+   * // Pre-fill email and billing without issuing a session token
+   * const result = await client.checkout.anonymous.create({
+   *   productId: "PROD_xxx",
+   *   currency: "USD",
+   *   buyerEmail: "customer@example.com",
+   *   billingDetail: { country: "US", isBusiness: false, postcode: "10001" },
+   * });
    */
   async create(params) {
     validateCheckoutCommon(params);
@@ -527,10 +536,12 @@ var CheckoutAuthenticatedResource = class {
    * Create an authenticated checkout session.
    *
    * Behavior:
-   * - Issues a session token via `issue-session-token`
-   * - Creates a checkout session via `create-session`
-   * - Appends the token to the checkout URL as a URL fragment
-   * - Defaults `buyerEmail` to `buyerIdentity` when omitted
+   * - Issues a session token via `issue-session-token` (receives `buyerIdentity` + `productId` only)
+   * - Creates a checkout session via `create-session` (receives every other field unchanged)
+   * - Appends the token to the checkout URL as a URL fragment (`#token=...`)
+   *
+   * `buyerIdentity` and `buyerEmail` are independent inputs: identity is for the JWT,
+   * email is for pre-filling the checkout page. The SDK forwards each to its own endpoint.
    *
    * @param params - Checkout parameters including buyer identity
    * @returns Session details with token-appended checkout URL
@@ -539,14 +550,15 @@ var CheckoutAuthenticatedResource = class {
    * const result = await client.checkout.authenticated.create({
    *   productId: "PROD_xxx",
    *   currency: "USD",
-   *   buyerIdentity: "customer@example.com",
+   *   buyerIdentity: "user-123",
+   *   buyerEmail: "customer@example.com",
    * });
    * // Redirect to result.checkoutUrl (includes #token=...)
    */
   async create(params) {
     validateCheckoutCommon(params);
     validateRequired("buyerIdentity", params.buyerIdentity);
-    const { buyerIdentity, buyerEmail, ...sessionFields } = params;
+    const { buyerIdentity, ...sessionParams } = params;
     const [tokenResult, sessionResult] = await Promise.all([
       this.http.post(
         "/v1/actions/auth/issue-session-token",
@@ -556,14 +568,7 @@ var CheckoutAuthenticatedResource = class {
         },
         { idempotencyWindow: 60 }
       ),
-      this.http.post(
-        "/v1/actions/checkout/create-session",
-        {
-          ...sessionFields,
-          buyerEmail: buyerEmail ?? buyerIdentity
-        },
-        { idempotencyWindow: 60 }
-      )
+      this.http.post("/v1/actions/checkout/create-session", sessionParams, { idempotencyWindow: 60 })
     ]);
     return {
       sessionId: sessionResult.sessionId,