> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dakota.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Cards.js Changelog

> Notable changes to @dakota-xyz/cards-js, per version

<Warning>
  **Cards is available in sandbox only while we finish development.** Dakota enables Cards per
  account. The Cards endpoints are in the [API reference](/api-reference/introduction), marked
  **Sandbox only**. Endpoints, fields, and flows can still change before release.
</Warning>

All notable changes to `@dakota-xyz/cards-js` are documented here.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). The documented [style contract](/documentation/cards/cards-js/theming#the-style-contract) is covered by semver.

## 0.1.2

The first release on the public npm registry. No code changes.

### Changed

* **Documentation moved to [docs.dakota.xyz](/documentation/cards/cards-js).** The README links here, and the package `homepage` points at the Cards.js overview.
* The package description no longer mentions PIN setup, which this version does not ship.

## 0.1.1

### Added

* **`invalid_theme` error.** `theme` values are validated at handle creation. A value that carries a CSS `var()` reference (case-insensitive) now throws immediately, with a named error, instead of failing the reveal opaquely. Custom properties cannot resolve inside the card-data processor's frames, so frame styles must be concrete values. Note that the throw site moves: creating a handle with such a theme now throws, where it previously returned a handle whose `reveal()` later failed. In React, the throw surfaces to the nearest error boundary.
* **Dark-scheme apps get transparent frames automatically.** Frame hosts declare `color-scheme: light` inline, matching the frame documents, so browsers no longer paint the value frames on an opaque white backdrop inside apps that declare `color-scheme: dark`.

### Changed

* Theming: the `theme` option's concrete-value and font-availability constraints, and custom-markup guidance for keeping revealed widgets aligned when they are placed inline with text (a revealed field has no text baseline).

## 0.1.0

The initial release of the library.

### Added

* **Secure card-detail display.** Show the full PAN, CVV, and expiry inside processor-controlled frames that your code cannot read, keeping your web front end in PCI DSS SAQ A scope.
* **Deliberate reveal.** Single-use sessions, a reveal window bounded by `autoMaskMs` and the session TTL (capped at 10 minutes), and an SDK-enforced auto-mask.
* **Backend-mints / browser-consumes session model.** A single `fetchSession` integration point that forwards `{ sessionType, origin }` to your backend. Your API key stays server-side.
* **Framework-free core** — `DakotaCards` with `cardDetails()` handles, lifecycle state, and a small event set (`ready`, `revealing`, `revealed`, `masked`, `expired`, `copied`). A failed reveal attempt emits `masked`, so event-driven consumers always see the attempt end.
* **React binding** (`@dakota-xyz/cards-js/react`) — `<DakotaCardsProvider>`, and `<CardDetails>` / `useCardDetails`. The hook's `state` reports `revealing`, so custom UIs drive their loading treatment from the SDK.
* **Reveal loading state.** `reveal()` swaps the card face to the frame side immediately. Empty value frames render as a quiet loading pulse (`.dk-field__frame:not([hidden]):empty`, restylable) until the card-data processor's frames arrive. A failed reveal swaps back to the masked face.
* **Theming** — a default stylesheet that paints the Dakota card face (charcoal gradient, DAKOTA wordmark, card-network mark, and a grain-textured disc, with self-hosted fonts), CSS custom properties on the documented DOM recipe, and a `theme` option whose text styles propagate into the value frames.
* **Internationalization** — overridable strings for the masked face and the screen-reader announcements.
* **Accessibility** — an SDK-injected aria-live region announces reveal and re-mask. It hides itself inline, so a custom stylesheet needs no rule for it.
* **Typed errors** — `DakotaCardsError` with a stable `code`, a `retryable` flag, and an optional upstream `diagnosticId`.