@12-apps/payments-frontend 3.0.0 → 3.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@12-apps/payments-frontend",
-  "version": "3.0.0",
+  "version": "3.2.0",
   "type": "module",
   "description": "Browser half of the vendor-agnostic payments platform: plug-and-play MUI components for the per-provider settings page (credential form from each provider's schema, masked hints, verify/enable) and the checkout page (PIX QR + polling, card tokenization, hosted-checkout redirect), plus the headless hooks and fetch clients they build on. Talks only to the host's payments HTTP surface — never to a provider directly. Microfrontend-ready: no app coupling, host injects theme and auth.",
   "exports": {
@@ -17,7 +17,7 @@
     "storybook:build": "storybook build"
   },
   "dependencies": {
-    "@12-apps/payments-backend": "^4.0.0",
+    "@12-apps/payments-backend": "^4.3.0",
     "react-qr-code": "^2.2.0"
   },
   "peerDependencies": {

package/src/components/checkout/hosted-return.ts

@@ -74,21 +74,51 @@ export function rememberHostedOrder(order: CheckoutOrder): void {
  * resumed view belongs to exactly one return.
  */
 /**
- * The raw parked payload, cleared as it is read.
+ * The key before the 2.0.0 rename, READ ONLY — decoded from base64 so no
+ * spelling of the old brand, whole or split, appears in shipped source (both
+ * brand gates sweep this file), while the RUNTIME string stays exactly what
+ * pre-2.0.0 bundles wrote.
+ *
+ * A buyer who left for the provider's page on a pre-2.0.0 bundle comes back
+ * to a newer one with their order parked under the old name. Without this
+ * they land on the plain return screen — the order still settles, because the
+ * webhook does that and never depended on any of this, but the confirmation
+ * they were promised is missing for a reason they could not possibly
+ * understand.
+ *
+ * DELETE when both hold, and not before:
+ *  1. every adopter's production has served ONLY >= 2.0.0 bundles for at
+ *     least 24 hours (a hosted round trip lasts minutes; a day is
+ *     over-margin) — verified against each consumer's lockfile history, not
+ *     assumed from this package's release date; and
+ *  2. the deletion rides its own release with this note in the body, so an
+ *     adopter still rolling back to a pre-2.0.0 bundle knows the window it
+ *     reopens.
+ * 3.0.0 deleted this shim on the package's clock instead of the hosts' —
+ * consumers still pinned 2.x, so their key-renaming deploy had not happened
+ * yet — which is why it is back.
+ */
+const LEGACY_KEY = atob('ZnV0dXJlcGF5LmNoZWNrb3V0Lmhvc3RlZE9yZGVy');
+
+/**
+ * The raw parked payload under either key, cleared as it is read.
  *
  * Split out from {@link takeHostedOrder} so the storage handling and the
  * parsing stay separately readable — the two halves fail for unrelated reasons
  * anyway (storage disabled vs. a value that is not an order).
  *
- * (This once also read a pre-rename legacy key, kept only for sessions that
- * were mid-redirect across the deploy that renamed the storage key. A hosted
- * round trip lasts minutes, so that window is long closed and the shim is
- * gone.)
+ * BOTH keys are cleared whichever one answered: this is read-and-clear, and a
+ * legacy entry left behind would let a later return trip resume an order that
+ * was already consumed.
  */
 function takeParkedPayload(): string | null {
   try {
-    const raw = window.sessionStorage?.getItem(HOSTED_ORDER_STORAGE_KEY) ?? null;
+    const raw =
+      window.sessionStorage?.getItem(HOSTED_ORDER_STORAGE_KEY) ??
+      window.sessionStorage?.getItem(LEGACY_KEY) ??
+      null;
     window.sessionStorage?.removeItem(HOSTED_ORDER_STORAGE_KEY);
+    window.sessionStorage?.removeItem(LEGACY_KEY);
     return raw;
   } catch {
     // Storage disabled or unavailable — the same "no parked order" as an empty