@whooshbang/sdk 1.0.0-rc.26 → 1.0.0-rc.28

package/README.md

@@ -1,8 +1,8 @@
 # `@whooshbang/sdk`
 
-Fetch-injected, ESM-only client for the release-candidate WhooshBang V1
-contract. The package has no automatic retry policy, persistence, telemetry,
-Node-only runtime import, or Cloudflare binding.
+Fetch-injected, ESM-only client and opt-in browser recipient surface for the
+release-candidate WhooshBang V1 contract. The package has no automatic retry
+policy, persistence, telemetry, Node-only runtime import, or Cloudflare binding.
 
 Install the current release candidate from the public npm registry:
 
@@ -163,6 +163,18 @@ owner-voiced key enum as the service. Effective embedded-panel overrides arrive
 through the session's sparse `panel_copy`; mandatory system-owned strings are
 not writable SDK inputs.
 
+The framework-neutral recipient settings UI ships in browser-only subpaths:
+import `@whooshbang/sdk/recipient/element` to register
+`<whooshbang-recipient-settings>`, or import `mountRecipientSettings` from
+`@whooshbang/sdk/recipient` for an imperative mount. These subpaths are kept out
+of the package root, so a server or Worker importing `@whooshbang/sdk` never
+evaluates DOM globals. These subpaths are published in
+`@whooshbang/sdk@1.0.0-rc.27`; `1.0.0-rc.26` does not contain them.
+
+`@whooshbang/sdk@1.0.0-rc.28` adds the accessible WhooshBang attribution and
+canonical red fallback while leaving every configured customer name, logo, and
+accent authoritative.
+
 ## Machine clients
 
 `createMachineCredential` generates the C0-03 secret with Web Crypto and

package/dist/recipient/element.d.ts

@@ -0,0 +1,51 @@
+import { type CreateRecipientSessionResponse } from "@whooshbang/contracts";
+export declare const RECIPIENT_SETTINGS_ELEMENT = "whooshbang-recipient-settings";
+export interface RecipientSettingsConfiguration {
+    /** Where the recipient-session API lives. Defaults to the hosted service. */
+    readonly baseUrl?: string;
+    /**
+     * How the recipient reaches the provider.
+     *
+     * `popup` keeps them on the page and is the default. `redirect` navigates
+     * the whole tab and comes back to the destination the integrator's backend
+     * named with `return_to` — the right choice for a host that cannot use a
+     * popup at all, and the reason a session without a registered return
+     * destination refuses to create one.
+     */
+    readonly completionMode?: "popup" | "redirect";
+    /**
+     * Where the hosted handoff page lives.
+     *
+     * Only a local or staging build should set this. Production leaves it at the
+     * canonical origin, which is the one a popup completion is accepted from.
+     */
+    readonly hostedOrigin?: string;
+}
+type SessionInput = CreateRecipientSessionResponse | null;
+/**
+ * The one element an integrator mounts.
+ *
+ * It takes its session as a JavaScript property rather than an attribute on
+ * purpose: an attribute is something a server-rendered page would print into
+ * HTML, and the creation capability must never appear in markup, in a URL, or
+ * anywhere a page cache could keep it.
+ */
+export declare class WhooshBangRecipientSettingsElement extends HTMLElement {
+    #private;
+    constructor();
+    get session(): SessionInput;
+    /**
+     * Accepts the creation response the integrator's backend returned.
+     *
+     * Assigning it is what starts the component. Assigning a fresh one later —
+     * after an expiry, say — restarts it cleanly, which is the recovery an
+     * integrator implements with two lines rather than a reload.
+     */
+    set session(value: SessionInput);
+    get configuration(): RecipientSettingsConfiguration;
+    set configuration(value: RecipientSettingsConfiguration);
+    connectedCallback(): void;
+    disconnectedCallback(): void;
+}
+export declare function defineRecipientSettingsElement(registry?: CustomElementRegistry): void;
+export {};