# Changelog

All notable changes to the zerohash Web SDK will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).


## [3.4.3]

### Fixed
- The modal now renders the new `@zerohash-sdk/*` UI whenever the JWT enables it, even when the token was set through the constructor or an earlier `setJWT` instead of passed straight to `openModal`. Those integrations previously fell back to the legacy iframe. No integration changes are needed to pick up the fix.

## [3.4.0]

### Added
- New `walletAddress` option on `sdk.openModal`, used by the Travel Rule flow to identify which wallet address the flow should collect travel-rule information for. Ignored by every other app identifier. Works the same way as the existing `depositId` option.

### Changed
- Bumped `@zerohash-sdk/travel-rule-react` to `^0.2.2`, the first version exposing the `walletAddress` prop this option forwards.

## [3.2.0] - 2026-07-13

### Added
- New Travel Rule flow, letting integrators collect travel-rule information for a deposit through the SDK. Open with `sdk.openModal({ appIdentifier: 'travel-rule', jwt, depositId })`, or preload the JWT via the new `travelRuleJWT` constructor option. Emits the standard `TRAVEL_RULE_APP_LOADED`, `TRAVEL_RULE_CLOSE_BUTTON_CLICKED`, `TRAVEL_RULE_COMPLETED`, and `TRAVEL_RULE_FAILED` events.
- New `depositId` option on `sdk.openModal`, used by the Travel Rule flow to identify which deposit the flow should collect travel-rule information for. Ignored by every other app identifier.

## [3.1.2] - 2026-06-19

### Fixed
- Restored `filters` forwarding for Crypto Buy on the new-SDK render path. `sdk.setFilters({ appIdentifier: 'crypto-buy', filters })` and `sdk.openModal({ appIdentifier: 'crypto-buy', filters })` were silently ignored when the JWT routed Crypto Buy through `@zerohash-sdk/crypto-buy-react`; they now reach the widget as documented. The legacy iframe path was unaffected.

### Changed
- Bumped `@zerohash-sdk/crypto-buy-react` from `^1.7.0` to `^1.8.0`, which adds the typed `filters` prop required by the fix above.

## [3.1.0] - 2026-06-17

### Added
- Added `sdk-cdn.zerohash.com` (prod), `sdk-cdn.cert.zerohash.com` (cert), and `sdk-cdn.dev.0hash.com` (dev) as trusted new-SDK origins. The old `sdk.connect.xyz` origins stay trusted during migration.

### Changed
- Bumped the bundled `@zerohash-sdk/*-react` and `@connect-xyz/auth-react` packages to their latest published versions.

## [3.0.1] - 2026-06-12

### Changed
- Bumped the bundled `@zerohash-sdk/*-react` and `@connect-xyz/auth-react` packages to their latest published versions, which adds better logging and error handling in cases where their webcomponent script fails to load.

## [3.0.0] - 2026-05-21

Major version bump signaling the rollout of the next-generation SDK rendering path. The integrator-facing API is unchanged for cert/prod consumers; the only public-type change is the narrowing of `env` (see Changed).

### Changed
- **Breaking (TypeScript surface):** Narrowed the public `Environment` type from `'dev' | 'cert' | 'prod'` to `'cert' | 'prod'`. The `'dev'` value targeted Zero Hash internal CDNs and was never intended for integrator use; it has been moved to a separate `InternalEnvironment` type used by our QA tooling. Integrators on cert or prod do not need to make any changes.

### Added
- Opt-in next-generation rendering for ZeroHash apps, delivering improved performance and UX across Crypto Buy/Sell, Onboarding, Fiat Deposits/Withdrawals, Crypto Withdrawals, Fund, Pay, Payouts, Profile, and Account Link flows [#97]
  - Rolled out gradually and controlled server-side — no integration changes required
  - Flows not yet migrated continue to render in the existing iframe
- SDK version is now attached to embedded-app logs to make support investigations faster [#97]
- New `theme` option on the SDK constructor (`'light' | 'dark' | 'auto'`, defaults to `'light'`) and `sdk.setTheme({ theme })` method to control the appearance of next-generation flows; legacy iframe and Connect Auth (Fund) appearance is unchanged [#97]
- New `env` option on the SDK constructor (`'cert' | 'prod'`) for explicit environment selection. When set, it takes precedence over hostname inference from `zeroHashAppsURL` and is the recommended way to target a specific deployment going forward [#97]

### Fixed
- Expanded the URL-based environment-inference allowlist to cover the full set of Zero Hash hostnames used by integrators (cert/dev, US/EU, `0hash.com`/`zerohash.com`/`zerohash.eu`/`sandbox.connect.xyz`/`gating.0hash.com`). Previously, only `web-sdk.cert.0hash.com`, `web-sdk.sandbox.connect.xyz`, and `web-sdk.dev.0hash.com` were recognized — every other Zero Hash host silently fell back to `prod`, causing cert sessions to load the production CDN. Integrators on hosts outside this list should still pass the new `env` option explicitly [#97]
- Removed the wrong-theme flash when opening a next-generation flow with `theme: 'dark'` or `'auto'`. The wrapper modal no longer paints a white background before the inner SDK renders, and it now becomes visible as soon as the SDK component reports it has loaded instead of waiting on a multi-second fallback. Light-mode and legacy iframe flows are unchanged [#97]
- Fixed Fund's Connect Auth flow targeting the wrong Connect API on non-prod hosts. The Auth env was previously inferred via a substring check against `zeroHashAppsURL` and silently fell back to `production` for dev hosts (e.g. `web-sdk.dev.0hash.com`) and partner-hosted URLs, causing the Fund modal to call `api.connect.xyz` instead of `api.sandbox.connect.xyz`. The Auth env is now resolved from the same source as the new-SDK components — explicit `env` from the SDK constructor when provided, otherwise the hostname allowlist [#97]

### Security
- Hardened the Connect Auth issuer check to use a strict hostname allowlist, replacing the previous substring match [#97]

## [2.16.0] - 2026-02-20

### Added
- Add dynamic styles for "Auth into Fund" integration

## [2.15.0] - 2026-02-18

### Added
- Add dynamic styles for "iframe" SDKs via postMessage

## [2.14.0] - 2026-01-16

### Added
- Allow existing Fund customers to integrate with Auth seamlessly
  - Existing Fund customers shall now be able to use Auth integrations aside from Manual deposit.
  Auth does not rely on an iframe, has dark and light mode, improved UI, and improved performance.

## [2.13.1] - 2026-01-08

### Added
- Adds new changelog template and guidelines

## [2.13.0] - 2026-01-02

### Fixed
- Fixed SDK wrapper positioning to prevent it from being scrolled out of view by the parent application [#81]
- The SDK now uses fixed positioning instead of absolute positioning, ensuring it remains visible even when the parent page scrolls

### Security
- Updated development dependencies to address security vulnerabilities

## [2.12.6] - 2025-10-27

### Security
- Addressed security vulnerabilities identified by automated dependency scanning [#78]
- Updated multiple dependencies to their latest secure versions

## [2.12.5] - 2025-10-22

### Changed
- Reverted bank transfer feature naming change from v2.12.3 due to compatibility concerns [#77]
- Restored original `fiat-account-link` terminology for existing integrations

## [2.12.4] - 2025-10-21

### Fixed
- Improved border styling consistency between mobile and desktop views
- Enhanced visual appearance across different device types

## [2.12.3] - 2025-10-01

### Changed
- Renamed fiat account linking feature to "bank-transfer" for improved clarity [#74]
- Updated terminology to better reflect the feature's purpose

## [2.12.2] - 2025-09-30

### Added
- New fiat account linking feature for connecting bank accounts [#73]
- Enables users to link their bank accounts directly through the SDK

## [2.12.1] - 2025-09-11

### Fixed
- Refined corner styling and border radius for improved visual consistency
- Enhanced UI polish across SDK components

## [2.12.0] - 2025-07-07

### Added
- Introduced support for new "PAY" application name [#71]
- Extended SDK compatibility for additional zerohash product offerings

## [2.11.2] - 2025-07-02

### Changed
- Improved integration with World App's MiniKit for better mobile experience [#70]
- Enhanced message passing between SDK and World App mini applications
- Optimized communication protocol for mobile wallets

## [2.11.1] - 2025-07-02

### Changed
- Enhanced World App message handling with improved error recovery [#69]
- Removed overly restrictive origin checks that could block legitimate messages
- Improved reliability of cross-frame communication

## [2.11.0] - 2025-07-01

### Security
- Added origin validation for World App event handlers [#68]
- Enhanced security when processing events from World App integration
- Prevents potential cross-site scripting attacks through event handling

---