3.15.0

@meshconnect/web-link-sdk 3.15.0

⚠️ Behavior change

• Link tokens are now checked before Link opens (#222, PRG-1086).
  openLink accepts a token only if it points to Mesh-hosted Link over https (meshconnect.com / meshpay.com).
  Any other token is rejected: no iframe opens, no access tokens are sent, and onExit('Invalid link token!') is called.
  This stops a forged link token from receiving your accessTokens.
  If you use tokens from the Mesh API, you don't need to change anything.

New

• withdrawalRequested event (#220, PRG-1243).
  When a user confirms a withdrawal, onEvent now receives { type: 'withdrawalRequested', payload: { transferId, status } }, then Link closes.
  Treat this event, not onExit, as the confirmation. The payload has no address or amount.
• onIntegrationConnected is now optional in LinkOptions (#220). Withdrawal-only integrations no longer need a placeholder callback.

Improvements and fixes

• Backup widget (bundled fallback) (#221):
  • Close button now works on the loading and error screens.
  • Token and network lists are split into Popular and Others.
  • More bundled logos (CRO, Cronos, Arbitrum).
  • Browser Back steps back through the screens (QR → network → token).
• A link token that isn't valid base64 now calls onExit instead of throwing (#222).
• A link token that isn't written in standard form (for example https:web.meshconnect.com/...) now opens Mesh Link instead of a page on your own site (#222).