Unit tests
Test the caller-owned session adapter independently:- versioned
sessionStoragekeys include the canonical API environment, merchant, and location; - the cart capability and customer JWT never enter URLs, analytics, or
localStorage; - ETag revisions are retained;
- claim, delete, expiry, and terminal checkout handling clear persisted capability state;
- malformed or old-version records fail closed.
fetch when testing the SDK:
If-Match, and an idempotency key. For CART_CONFLICT, assert the mutation is not replayed automatically and the current cart revision is refreshed.
Checkout tests
Cover every authoritative result:payment_pendingcontinues bounded polling;order_pendingcontinues bounded polling;completedrenders the returned order and clears persisted cart state after terminal handling;failedrenders failure, never falls back to success, and clears persisted cart state after terminal handling;- authorization, timeout, and stale-revision errors remain visible.
Receipt tests
Start with a URL containing#receiptToken=.... Assert the app calls history.replaceState immediately, stores the token only for that API environment, merchant, and receipt ID in sessionStorage, and sends it in the receipt header—not in the request URL.
End-to-end sandbox flow
- Fetch published merchant, location, menu, product, distance, order-time, and gratuity data anonymously and verify no customer JWT is attached.
- Create a cart and verify the capability is returned only once for a new cart.
- Mutate the cart and verify revision changes.
- Create a PaymentIntent and confirm with a sandbox payment method.
- Observe nonterminal polling followed by exactly one terminal result.
- Verify rating and receipt access.
- Confirm no secret or capability appears in browser URLs, logs, analytics, or static assets.