v0.4.0

Breaking Changes

• buyerEmail no longer falls back to buyerIdentity — checkout.authenticated.create({ buyerIdentity, ... }) used to silently copy buyerIdentity into the outgoing buyerEmail when the caller omitted buyerEmail. It no longer does. buyerIdentity is for the JWT (merchant-side buyer identification) and buyerEmail is for pre-filling the checkout page's email input; the two fields are fully independent.

  Migration: if you were passing a non-email buyerIdentity (e.g. an internal user ID) and relying on the email input being pre-filled, pass buyerEmail: user.email explicitly alongside buyerIdentity.

Changed

• AnonymousCheckoutParams widened to full session params — now accepts buyerEmail and billingDetail so merchants can pre-fill the checkout page without issuing a session token. Equivalent to CreateCheckoutSessionParams.
• AuthenticatedCheckoutParams restructured — now extends CreateCheckoutSessionParams with a single extra field buyerIdentity. Implementation uses destructure-and-forward so buyerIdentity cannot leak into the create-session payload.

Documentation

• JSDoc rewrites — IssueSessionTokenParams.buyerIdentity, AuthenticatedCheckoutParams.buyerIdentity, and both checkout wrappers now clearly state that buyerIdentity is JWT-only and is not rendered on the checkout page.

Companion fix

Server-side fix: waffo-pancake-order-service v2026.04.15.1 — create-order no longer falls back buyerEmail to buyerIdentity.