chore(deps): bump @waffo/pancake-ts from 0.11.0 to 0.17.0

[dependabot]

Bumps @waffo/pancake-ts from 0.11.0 to 0.17.0.

Release notes

Sourced from @​waffo/pancake-ts's releases.

v0.17.0

supportEmail and website were never applied by the update-store endpoint — passing them was silently ignored.

Removed

• BREAKING UpdateStoreParams.supportEmail and UpdateStoreParams.website — the endpoint never wrote these fields, so passing them had no effect. They are derived from ownership verification and are set only by the flows that prove it: email code binding, domain verification, or KYB approval. Both remain readable on Store.

  Migration: drop them from your stores.update() calls; a null you were passing to "clear" them was never clearing anything.

v0.16.1

Passing billingDetail couples the hosted cashier to the order's billing country: it then offers only that country's payment market and the customer cannot switch. The country that applies is the one on the finished order, not the one you sent; a country outside the payment markets we cover applies no restriction. If the coupled market offers none of your enabled payment methods the order cannot be paid. Omit billingDetail to leave the cashier unrestricted.

Types unchanged — no code migration.

v0.16.0

Per-transaction payment method selection on the hosted checkout page.

Added

• PaymentMethod — card / applepay / googlepay / wechat
• CreateCheckoutSessionParams.includePaymentMethods — whitelist: offer only these. Every value must be supported by the product type × currency pair, otherwise the request is rejected with a 400.
• CreateCheckoutSessionParams.excludePaymentMethods — blacklist: offer everything the currency supports except these. Values the currency does not offer are ignored, so one blacklist can be reused across currencies. Mutually exclusive with includePaymentMethods; omit both to offer every method the currency supports.

Changed

• Currencies outside the payment method matrix are now rejected at checkout session creation (400) instead of falling through to the provider. One-time supports USD / EUR / GBP / HKD / JPY / CNY; subscription supports USD / EUR / GBP / HKD / JPY.
• Both fields require API Key authentication. Store Slug (visitor) sessions ignore them and always offer every method the currency supports — payment method selection is a merchant-side commercial decision (channel fees, settlement terms).

v0.15.0

BREAKING: NotificationSettings drops notifyPayoutCompleted/notifyPayoutFailed (payout notifications are platform-managed, no toggle key); adds emailUpcomingCharge. MerchantWritableNotificationSettings shrinks accordingly.

v0.14.0

Adds client.contentSafety.scanPrompt for AIGC prompt content-safety scanning (ScanPromptParams/ScanResult + enums).

v0.13.0

收银台语言 CashierLanguage + create-session language 参数

Added

• CashierLanguage — 导出的联合类型，22 个受支持收银台语言（IETF BCP 47，如 en / pt-BR / zh-Hant-TW）
• CreateCheckoutSessionParams.language（可选）— 透传 create-session，设置 hosted checkout 默认语言，消费者可切换

v0.12.0

Changed

• The buyer persona is renamed to customer across the public API: client.customer(token) is the canonical customer self-service entry.

Deprecated

• client.buyer(token) — use client.customer(token) instead.

Wire fields (buyerIdentity, buyerEmail, merchantProvidedBuyerIdentity) are unchanged.

Changelog

Sourced from @​waffo/pancake-ts's changelog.

[0.17.0] - 2026-08-03

supportEmail and website were never applied by the update-store endpoint — passing them was silently ignored.

Removed

• UpdateStoreParams.supportEmail and UpdateStoreParams.website — the endpoint never wrote these fields, so passing them had no effect. They are derived from ownership verification and are set only by the flows that prove it: email code binding, domain verification, or KYB approval. Both remain readable on Store. Migration: drop them from your stores.update() calls; a null you were passing to "clear" them was never clearing anything.

[0.16.1] - 2026-07-30

Pre-filling a billing country restricts which payment methods the hosted cashier offers.

Changed

• createCheckoutSession — passing billingDetail couples the hosted cashier to the order's billing country: it then offers only that country's payment market and the customer cannot switch. The country that applies is the one on the finished order, not the one you sent; a country outside the payment markets we cover applies no restriction. If the coupled market offers none of your enabled payment methods the order cannot be paid. Omit billingDetail to leave the cashier unrestricted. Types unchanged — no code migration.

[0.16.0] - 2026-07-28

Per-transaction payment method selection on the hosted checkout page.

Added

• PaymentMethod — payment methods offered on the checkout page: card / applepay / googlepay / wechat
• CreateCheckoutSessionParams.includePaymentMethods — whitelist: offer only these. Every value must be supported by the product type × currency pair, otherwise the request is rejected with a 400.
• CreateCheckoutSessionParams.excludePaymentMethods — blacklist: offer everything the currency supports except these. Values the currency does not offer are ignored, so one blacklist can be reused across currencies. Mutually exclusive with includePaymentMethods; omit both to offer every method the currency supports.

Changed

• Currencies outside the payment method matrix are now rejected at checkout session creation (400) instead of falling through to the provider. One-time supports USD / EUR / GBP / HKD / JPY / CNY; subscription supports USD / EUR / GBP / HKD / JPY. Affects one-time THB and subscription CNY, neither of which has ever produced a successful charge.
• Both fields require API Key authentication. Store Slug (visitor) sessions ignore them and always offer every method the currency supports — payment method selection is a merchant-side commercial decision (channel fees, settlement terms).

---

[0.15.0] - 2026-07-27

Notification settings contract update for platform-managed payout notifications.

Added

• NotificationSettings.emailUpcomingCharge — platform-managed toggle for the upcoming-charge reminder email (renewal notice sent before a subscription charge).

Removed

• Breaking: NotificationSettings.notifyPayoutCompleted / notifyPayoutFailed and their entries in MerchantWritableNotificationSettings. Payout result emails are platform-managed and always delivered (merchant-level platform notification) — they have no toggle. The update-store endpoint silently drops the legacy keys with a warnings[] entry.

[0.14.0] - 2026-07-18

Adds content-safety prompt scanning for AIGC generation.

Added

... (truncated)

Commits

• afa0205 Merge pull request #25 from waffo-com/fix/update-store-params-readonly
• 477244c fix: drop supportEmail and website from UpdateStoreParams
• e78cf82 Merge pull request #24 from waffo-com/docs/billing-country-coupling
• 8190ea5 docs: state how a pre-filled billing country constrains the cashier
• 20ad0fe Merge pull request #23 from waffo-com/release/0.16.0
• e9e8502 feat: per-transaction payment method selection
• b079042 Merge pull request #22 from waffo-com/release/0.15.0
• 59b2ec8 feat!: notification settings contract for platform-managed payout notifications
• 9779054 Merge pull request #14 from waffo-com/release/v0.14.0
• d02891f feat: add content-safety scanPrompt (v0.14.0)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
murmur	Ready	Preview	Aug 9, 2026 7:13pm

[github-actions]

🔵 PR Size: size/XS

📊 Stats:

• 1 additions
• 1 deletions
• 2 total changes
• 1 files changed

This PR is tiny and quick to review.

[dependabot]

Superseded by #490.