fix: address outstanding Codex review findings

.github/workflows/publish-github-packages.yml

@@ -22,60 +22,39 @@ concurrency:
 
 jobs:
   publish:
+    # workflow_dispatch can be launched from any ref — only main may publish.
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout sumit-react
-        uses: actions/checkout@v4
-        with:
-          path: sumit-react
-
-      - name: Checkout sumit-api peer package
-        uses: actions/checkout@v4
-        with:
-          repository: Digitizers/sumit-api
-          path: sumit-api
+      - uses: actions/checkout@v4
 
       - uses: pnpm/action-setup@v4
         with:
           version: 10.26.0
 
+      # No registry-url here: install must resolve from npmjs. The publish step
+      # below configures the GitHub Packages registry and auth itself.
       - uses: actions/setup-node@v4
         with:
           node-version: 22
           cache: pnpm
-          cache-dependency-path: |
-            sumit-react/pnpm-lock.yaml
-            sumit-api/pnpm-lock.yaml
-          registry-url: https://npm.pkg.github.com
-
-      - name: Build sumit-api peer package
-        working-directory: sumit-api
-        run: |
-          pnpm install --frozen-lockfile
-          pnpm build
 
-      - name: Install sumit-react
-        working-directory: sumit-react
+      - name: Install
         run: pnpm install --frozen-lockfile
 
       - name: Typecheck
-        working-directory: sumit-react
         run: pnpm typecheck
 
       - name: Test
-        working-directory: sumit-react
         run: pnpm test
 
       - name: Build
-        working-directory: sumit-react
         run: pnpm build
 
       - name: Pack check
-        working-directory: sumit-react
         run: npm pack --dry-run
 
       - name: Build GitHub Packages tarball directory
-        working-directory: sumit-react
         run: |
           set -euo pipefail
           PACK_JSON=$(npm pack --json --ignore-scripts)
@@ -96,7 +75,7 @@ jobs:
           NODE
 
       - name: Publish scoped package to GitHub Packages
-        working-directory: sumit-react/.publish-ghpkg
+        working-directory: .publish-ghpkg
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |

.github/workflows/publish-npm.yml

@@ -21,18 +21,11 @@ concurrency:
 
 jobs:
   publish:
+    # workflow_dispatch can be launched from any ref — only main may publish.
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout sumit-react
-        uses: actions/checkout@v4
-        with:
-          path: sumit-react
-
-      - name: Checkout sumit-api peer package
-        uses: actions/checkout@v4
-        with:
-          repository: Digitizers/sumit-api
-          path: sumit-api
+      - uses: actions/checkout@v4
 
       - uses: pnpm/action-setup@v4
         with:
@@ -43,44 +36,28 @@ jobs:
           node-version: 22
           registry-url: https://registry.npmjs.org
           cache: pnpm
-          cache-dependency-path: |
-            sumit-react/pnpm-lock.yaml
-            sumit-api/pnpm-lock.yaml
-
-      - name: Build sumit-api peer package
-        working-directory: sumit-api
-        run: |
-          pnpm install --frozen-lockfile
-          pnpm build
 
-      - name: Install sumit-react
-        working-directory: sumit-react
+      - name: Install
         run: pnpm install --frozen-lockfile
 
       - name: Typecheck
-        working-directory: sumit-react
         run: pnpm typecheck
 
       - name: Test
-        working-directory: sumit-react
         run: pnpm test
 
       - name: Build
-        working-directory: sumit-react
         run: pnpm build
 
       - name: Pack check
-        working-directory: sumit-react
         run: npm pack --dry-run
 
       - name: Verify npm token
-        working-directory: sumit-react
         run: npm whoami
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Publish public package
-        working-directory: sumit-react
         run: |
           if [ "${{ inputs.dry_run }}" = "true" ]; then
             npm publish --access public --dry-run

CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to this package are documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Fixed
+
+- `SumitChargeMode` is now actually exported from `sumit-react/next` — 0.2.0 advertised the type but the barrel never re-exported it.
+- `createSumitChargeRoute` validates `mode` at creation time. An unknown mode (e.g. `"oneoff"` from an untyped consumer) now throws a clear configuration error instead of sending requests to `https://api.sumit.co.ilundefined`.
+- Publish workflows: only `main` may publish (`workflow_dispatch` was unrestricted), the stale `sumit-api` sibling checkout/build is gone (the dependency installs from npm), and the GitHub Packages workflow no longer points installs at `npm.pkg.github.com` — the publish step configures that registry itself.
+
 ## [0.2.0] - 2026-05-02
 
 ### Added

src/next/createChargeRoute.test.ts

@@ -27,6 +27,18 @@ function jsonRequest(body: unknown): Request {
 }
 
 describe("createSumitChargeRoute", () => {
+  it("throws at creation time for an unknown mode", () => {
+    expect(() => createSumitChargeRoute({ companyId: 1, apiKey: "k", mode: "oneoff" as never })).toThrow(
+      /unknown charge mode "oneoff"/,
+    );
+  });
+
+  it("rejects prototype keys as modes", () => {
+    expect(() => createSumitChargeRoute({ companyId: 1, apiKey: "k", mode: "toString" as never })).toThrow(
+      /unknown charge mode "toString"/,
+    );
+  });
+
   it("returns 400 when body is invalid JSON", async () => {
     const handler = createSumitChargeRoute({ companyId: 1, apiKey: "k" });
     const response = await handler(

src/next/createChargeRoute.ts

@@ -59,6 +59,13 @@ export type SumitChargeRouteHandler = (request: Request) => Promise<Response>;
 
 export function createSumitChargeRoute(config: SumitChargeRouteConfig): SumitChargeRouteHandler {
   const mode: SumitChargeMode = config.mode ?? "recurring";
+  // JS consumers can pass any string; an unknown mode would otherwise resolve
+  // `DEFAULT_PATHS[mode]` to undefined and target `…co.ilundefined` at runtime.
+  // Explicit comparison rather than `in`, which would accept prototype keys
+  // like "toString".
+  if (mode !== "recurring" && mode !== "oneOff") {
+    throw new Error(`sumit-react: unknown charge mode "${String(mode)}" — expected "recurring" or "oneOff".`);
+  }
   const baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\/$/, "");
   const path = config.path ?? DEFAULT_PATHS[mode];
   const upstreamFetch = config.fetch ?? fetch;

src/next/index.ts

@@ -1,5 +1,6 @@
 export { createSumitChargeRoute } from "./createChargeRoute.js";
 export type {
+  SumitChargeMode,
   SumitChargeRouteConfig,
   SumitChargeRouteHandler,
   SumitChargeRequestBody,