# Changelog

All notable changes to `@quantaroute/checkout` are documented here.

Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
Release dates are from git history where available; earlier versions are estimated from the first public commit.

## [Unreleased]

## [1.7.2](https://github.com/quantaroute/checkout/compare/v1.7.1...v1.7.2) — 2026-07-06

### Added

- **`mapStyle` prop** on `MapPinSelector` and `CheckoutWidget` — override the MapLibre basemap URL (e.g. `OPENFREEMAP_POSITRON_STYLE_URL` when Carto credentials are unavailable)
- **`embedMode` prop** (`bundled` | `external`) — `external` waits for `window.maplibregl` from a CDN script before initialising the map (Shopify theme extensions, script-tag embeds)
- **`MapRuntime` interface** and helpers (`getExternalMapRuntime`, `waitForExternalMapRuntime`, `DEFAULT_MAP_STYLE_URL`, `OPENFREEMAP_POSITRON_STYLE_URL`) exported from the package

### Changed

- **MapPinSelector (web)** — loading/unavailable/error states when MapLibre is slow or missing; confirm and locate buttons disabled until the map is ready

## [1.7.1](https://github.com/quantaroute/checkout/compare/v1.7.0...v1.7.1) — 2026-07-06

### Fixed

- **Map locate button** — stays in the top-right on mobile (no overlap with attribution toggle); matches MapLibre zoom control size (29×29px) and alignment on all viewports
- **Map attribution** — compact attribution starts collapsed (icon only); full credits expand on click

### Added

- **Address Intelligence (opt-in)** — `enableAddressIntelligence` prop, `scoreAddressRisk()` helper, payment-step risk banner, and optional COD restriction for high-risk addresses (requires deployed `checkout-addresses` backend; defaults off)

### Changed

- `CompleteAddress` now includes saved `addressId` after `createAddress` completes

## [1.7.0](https://github.com/quantaroute/checkout/compare/v1.6.0...v1.7.0) — 2026-06-28

### Added

- **Mobile-first checkout presentation** — new `mobilePresentation` prop (`auto`, `sheet`, `card`) for storefront modals and drawers
- **Mobile labeled stepper** — compact Mobile/Address/Pay progress on small screens while preserving desktop dot progress
- **`mobileStepLabels`** prop for merchant-specific step label copy

### Changed

- Improved mobile shell styling: sticky branded header, safe-area-aware actions, larger touch targets, softer saved-address cards, compact lazy verification banner, and mobile payment option rows
- Demo app includes a mobile preview frame to inspect the sheet treatment
- README documents the host-app boundary: cart state, order summary, coupons, platform APIs, and checkout interception stay outside the npm package

## [1.6.0](https://github.com/quantaroute/checkout/compare/v1.5.0...v1.6.0) — 2026-06-23

### Added

- **Lazy DigiPin verification** — imported saved addresses without a DigiPin trigger a `verify-address` step (map pin + prepopulated form) before payment or `onComplete`
- **`selectAddress()` and `verifyDigipin()`** client helpers; `SavedAddress.digipin` is nullable for pending imports
- **`AddressFormInitialValues`** — prepopulate manual fields when verifying an imported address
- **`verify_address_step_viewed`** checkout analytics event
- **`checkout-addresses`** — `select_address` and `verify_digipin` actions; session `selected_address_id` + `address_verified` order lock
- **`checkout-payment`** — blocks `create_order`, `verify`, and `record_cod` until the selected address has a confirmed DigiPin
- **`checkout-admin`** — `import_customers` bulk import API and `import_status`; `create_linked_account` returns 501 (Mode C stub)
- **Identity linking (H8)** — merge email/phone import profiles on OTP verify via `_shared/identity.ts`
- Migration `20260623120000_customer_import_and_digipin_verify.sql` — import batches, nullable digipin, `payment_mode` on merchants

### Documentation

- `docs/byo-payment-gateway.md` — Mode A (PayU/Cashfree/Paytm) integration guide
- `docs/customer-migration-playbook.md` — merchant-facing import + lazy verify story
- `docs/hosted-payments-roadmap.md` — Mode C QuantaRoute Payments roadmap
- `docs/portal-payment-wizard-spec.md` and `docs/portal-migration-wizard-spec.md` — developer portal UI specs

## [1.5.0](https://github.com/quantaroute/checkout/compare/v1.4.5...v1.5.0) — 2026-06-21

### Added

- **Razorpay payment step** — `PaymentStep` after address completion when `enablePayment` and `paymentAmountPaise` are set
- `verifyPayment()` client helper; verify response includes `razorpay_order_id` and `razorpay_payment_id`
- `orderConfirmationUrl` prop — optional post-payment redirect with `{{sessionId}}` placeholder
- Extended `onPaymentComplete` callback — `sessionId`, `razorpayOrderId`, and `razorpayPaymentId` on prepaid success
- Payment auth guard — `enablePayment` requires phone/email OTP auth (or `codSessionToken`) before the payment step
- **`checkout-payment`** verify action returns Razorpay order and payment IDs; fires `session.completed` webhook
- **`checkout-admin`** — `get_payment_config` and `set_payment_config` actions for merchant Razorpay credentials (`x-api-key`)
- `payment_orders` Razorpay order ID index migration (`20260621120000_payment_orders_rzp_index.sql`)
- Demo app payment flow with Razorpay test-mode banner and order-complete result panel

### Documentation

- `docs/merchant-onboarding.md` — merchant onboarding from test keys through production go-live
- `docs/razorpay-e2e-setup.md` — end-to-end Razorpay test setup (Admin API, Edge Functions, demo checklist)

## [1.4.5](https://github.com/quantaroute/checkout/compare/v1.4.4...v1.4.5) — 2026-06-13

### Added

- Merchant courier serviceability checks via `checkout-addresses` `serviceability_check`, signed webhook configuration on `checkout.merchants`, and `checkServiceability()` client helper
- `enableServiceabilityCheck`, `showIndiaPostDeliveryWarning`, and `serviceabilityBlockCheckout` widget props

### Changed

- India Post "Non Delivery" is now an opt-in informational fallback instead of the default buyer-facing warning; merchant courier serviceability takes precedence

## [1.4.4](https://github.com/quantaroute/checkout/compare/v1.4.3...v1.4.4) — 2026-06-16

### Added

- **Custom "Other" address label** — text input when Other is selected; persisted as `label_text` while `label` stays `other`
- `CompleteAddress.labelText` — returned on completion and when re-selecting saved addresses
- `couldBeDigiPinInput` and `isPotentialDigiPinInput` — partial DigiPin typing no longer triggers address autocomplete
- `npm run verify:digipin` — regression script for dashed, spaced, and compact DigiPin input

### Changed

- **Address label picker** — compact pill chips with stroke SVG icons (web) and View-drawn icons (native); selected state uses primary tint instead of heavy borders
- **Native address form** — vector map-pin section icon replaces emoji in "Your details" header
- Saved address cards show custom `label_text` (e.g. "Friend's home") instead of generic "Other"

## [1.4.3](https://github.com/quantaroute/checkout/compare/v1.4.2...v1.4.3) — 2026-06-16

### Added

- `normalizeDigiPinInput`, `formatDigiPin`, and `isCompleteDigiPinInput` exports for flexible DigiPin parsing
- `CompleteAddress.addressId` — set when a buyer re-selects an existing saved address
- `CheckoutWidgetController` + `registerController` prop for host-page step navigation (e.g. Shopify pre-checkout shell)

### Changed

- **Offline DigiPin search** accepts dashed, spaced, and compact input (`4P3-J68-637F`, `4P3 J68 637F`, `4P3J68637F`)
- `looksLikeDigiPin` and `isValidDigiPin` use normalised 10-character body instead of dashed-only regex
- `createAddress` skipped when re-selecting a saved row; new addresses no longer auto-set `is_default: true`

## [1.4.2](https://github.com/quantaroute/checkout/compare/v1.4.1...v1.4.2) — 2026-06-16

### Added

- **Home / Work / Other address label picker** on the address details step (web + native)
- `AddressLabel` type and `ADDRESS_LABELS` export (`'home' | 'work' | 'other'`)
- `CompleteAddress.label` — chosen label is passed to `createAddress()` instead of hardcoded `'home'`

### Changed

- Saved addresses from the picker retain their stored label when re-selected

## [1.4.1](https://github.com/quantaroute/checkout/compare/v1.4.0...v1.4.1) — 2026-06-13

### Added

- Consistent email OTP — same code reused for up to 10 checkouts per email+merchant
- `SendEmailOtpResult` export with `reused` flag when send skips Resend
- `EmailOtpStep` copy when an existing code is still valid

### Changed

- Email OTP rate limits — max 3 fresh codes / 24h; silent reuse when code is still active
- Verify lockout after 5 failed attempts (15 min)

### Documentation

- OpenAPI spec for `/checkout-email-otp` (send, verify, `reused`, rate-limit responses)

## [1.4.0](https://github.com/quantaroute/checkout/compare/v1.3.1...v1.4.0) — 2026-06-04

### Added

- Email OTP auth (`enableEmailAuth`, `EmailStep`, `EmailOtpStep`, `checkout-email-otp` Edge Function)
- Per-merchant email templates (`email_from_name`, `email_logo_url`, `email_subject_template`)
- COD controls (`enableCod`, `CodAvailabilityBanner`, `checkCodEligibility()`)
- Server-side webhooks (`phone_verified`, `email_verified`, `address_completed`, `session.expired`)
- Automatic session expiry (`checkout-session-expiry` Edge Function + pg_cron)
- SDK exports: `sendEmailOtp`, `verifyEmailOtp`, `notifyAddressCompleted`
- Checkout events: `email_step_viewed`, `email_otp_sent`, `email_verified`

## [1.3.1](https://github.com/quantaroute/checkout/compare/v1.3.0...v1.3.1) — 2026-03-14

### Added

- Unified map search bar (`enableSearch`) with DigiPin and address autocomplete

### Fixed

- DigiPin typing in the search box

## [1.3.0](https://github.com/quantaroute/checkout/compare/v1.2.1...v1.3.0) — 2026-03-01

*Estimated — phone OTP and saved-address work landed before the 1.3.1 publish; no tagged commit.*

### Added

- Phone OTP auth (`enablePhoneAuth`, `PhoneStep`, `OtpStep`, `checkout-otp` Edge Function)
- Saved addresses (`SavedAddressStep`, `checkout-addresses` CRUD API)
- Pincode validation and non-delivery warnings in `AddressForm`
- Per-merchant branding (`brandColor`, `logoUrl`, `headerBanner`)
- Client analytics hook (`onCheckoutEvent`, `CheckoutEvent` types)
- Checkout API client exports (`sendOtp`, `verifyOtp`, address helpers)

## [1.2.1](https://github.com/quantaroute/checkout/compare/v1.2.0...v1.2.1) — 2026-02-19

### Fixed

- npm package export paths for CSS and native entry points

## [1.2.0](https://github.com/quantaroute/checkout/compare/v1.1.0...v1.2.0) — 2026-02-19

### Added

- iOS and Android support via React Native / Expo (`*.native.tsx`, `expo-plugin.js`)
- Native map pin selector, address form, and checkout widget
- GPS geolocation on native (`useGeolocation.native.ts`)
- Native design system (`checkout.native.ts`, light + dark)

## [1.1.0](https://github.com/quantaroute/checkout/compare/v1.0.0...v1.1.0) — 2026-02-18

### Added

- DigiPin badge overlay on map
- Locality alternatives dropdown
- OSM address pre-fill (building, road, suburb)
- India boundary GeoJSON overlay

## [1.0.0](https://github.com/quantaroute/checkout/releases/tag/v1.0.0) — 2026-02-17

### Added

- Web checkout widget with MapLibre GL + Carto Positron
- Offline DigiPin generation and QuantaRoute API integration
- Mobile-first layout, dark mode, reduced-motion, keyboard accessibility