shopstack 0.3.2 → 0.3.3

package/README.md

@@ -6,9 +6,9 @@ guest restaurant reservations.
 ## Install
 
 ```bash
-npm install shopstack@0.3.2
+npm install shopstack@0.3.3
 # or
-npm install -g shopstack@0.3.2
+npm install -g shopstack@0.3.3
 ```
 
 Node.js 18 or newer is required.
@@ -18,7 +18,7 @@ WebSocket (Node.js 22 or newer). It reads the authenticated checkout resource
 after each notification. Older runtimes, or a failed socket connection, use the
 bounded HTTP update wait. The one-time socket token is never placed in a URL.
 
-This preview release pairs `shopstack@0.3.2` with `shopstack-mcp@0.2.2`.
+This preview release pairs `shopstack@0.3.3` with `shopstack-mcp@0.2.3`.
 Both packages use the `preview` distribution tag. The `latest` versions are
 unchanged. Use the exact versions above to install this release.
 
@@ -79,7 +79,7 @@ Configure any stdio MCP client to run:
   "mcpServers": {
     "shopstack": {
       "command": "npx",
-      "args": ["-y", "shopstack-mcp@0.2.2"],
+      "args": ["-y", "shopstack-mcp@0.2.3"],
       "env": {
         "SHOPSTACK_API_URL": "https://shopstack-release-preview.shopstack.workers.dev/v1",
         "SHOPSTACK_CONFIG_FILE": "/absolute/private/path/shopstack-config.json"
@@ -110,7 +110,7 @@ one MCP server and three focused skills:
 - `shopstack-checkout` for checkout creation and monitoring;
 - `shopstack-onboarding` for verified signup and private local profiles.
 
-The plugin pins `shopstack-mcp@0.2.1`, which installs the matching
+The plugin pins `shopstack-mcp@0.2.3`, which installs the matching
 reservation-capable `shopstack` client. Configure the API address
 before starting the plugin or use a profile already bound to that API. The existing top-level
 `SKILL.md` remains in the npm client package for compatibility.

package/SKILL.md

@@ -19,8 +19,8 @@ chat to fix an environment mismatch.
 For the JavaScript client and CLI:
 
 ```bash
-npm install shopstack@0.3.1
-npm install -g shopstack@0.3.1
+npm install shopstack@0.3.3
+npm install -g shopstack@0.3.3
 ```
 
 For MCP clients, configure the local stdio server:
@@ -30,7 +30,7 @@ For MCP clients, configure the local stdio server:
   "mcpServers": {
     "shopstack": {
       "command": "npx",
-      "args": ["-y", "shopstack-mcp@0.2.1"]
+      "args": ["-y", "shopstack-mcp@0.2.3"]
     }
   }
 }
@@ -113,7 +113,18 @@ shopstack connect list
 shopstack connect link
 ```
 
-Include `payment_provider: "link"` only when the active user's Link connection reports checkout-ready. Otherwise omit `payment_provider`. Shopstack will run until card entry and request one protected checkout-scoped card through the SDK or no-echo CLI prompt.
+When the user chooses Link, include `payment_provider: "link"` even if Link is
+not connected. Shopstack prepares the merchant checkout first. At card
+issuance, `required_input.type: "link"` supplies the exact sign-in or approval
+URL, amount, currency, and an optional verification phrase. Show those values
+and keep monitoring. Shopstack polls Link and resumes automatically; never ask
+the user to send a completion message. Link credential approval does not grant
+Shopstack final order approval.
+
+Omit `payment_provider` when the user wants to supply a card directly.
+Shopstack then requests protected checkout-scoped card input at the payment
+form through the SDK, CLI prompt, or live viewer. Connecting Link in advance
+with the commands above is optional.
 
 Never put card data in MCP arguments, natural-language messages, model output, logs, or ordinary CLI flags.
 
@@ -150,20 +161,25 @@ Run it with:
 shopstack checkout run --file checkout.json
 ```
 
-Or create with MCP, then call `poll_checkout`. Display these authoritative fields to the user when they change:
+Or create with MCP, read with `poll_checkout`, and monitor changes with
+`wait_checkout_update` using the latest `presentation_revision`. Display these
+authoritative fields to the user when they change:
 
 - `status`: one of exactly `queued`, `started`, `help_required`, `approval_required`, `submitting`, `complete`, `failed`, `cancelled`;
 - `activity`: bounded present-tense display text;
 - `intent.name`, `intent.phase`, and `intent.updated_at`: bounded mechanical action progress with no arguments or reasoning;
-- `required_input`: a typed handoff such as protected payment-card input;
+- `required_input`: a typed handoff for Link or protected payment-card input;
 - `approval`: the exact amount-bound approval request when present.
 
-Poll every two seconds for `queued`, `started`, and `submitting`; every five seconds for `help_required` and `approval_required`; stop at `complete`, `failed`, or `cancelled`.
+Keep calling `wait_checkout_update` while Link sign-in or approval is pending;
+an unchanged response is not a failure. Stop at `complete`, `failed`, or
+`cancelled`. The CLI monitor follows changes automatically.
 
 ## Respond at typed boundaries
 
 - Use `GET/POST /v1/checkout/{id}/messages` only for ordinary missing information.
 - Use protected SDK/CLI payment input when `required_input.type` is `payment_card`.
+- Show the exact URL and keep monitoring when `required_input.type` is `link`.
 - Use only the dedicated payment-approval endpoint from a separately scoped trusted backend.
 - MCP and messages cannot approve payment and expose no approval tool.
 - Never infer approval from a user's conversational message.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shopstack",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Shopstack API client and command-line checkout and reservation tools.",
   "type": "module",
   "exports": {