@autobusal/order-process 1.5.1 → 1.5.2

package/BKT/Bkt.tsx

@@ -76,7 +76,10 @@ const Bkt = ({ hash, t }: Props): JSX.Element => {
         <input type="hidden" defaultValue={ data?.currency } { ...register('currency') } />
         <input type="hidden" defaultValue={ data?.okUrl } { ...register('okUrl') } />
         <input type="hidden" defaultValue={ data?.failUrl } { ...register('failUrl') } />
-        <input type="hidden" defaultValue={ data?.orderId } { ...register('oid') } />
+        { /* Claude - 2026-09-25 (audit): the hash is signed over data.oid (the
+             per-attempt order-number reference), not the database id - posting
+             orderId made BKT reject the signature. orderId stays as ObtBktId. */ }
+        <input type="hidden" defaultValue={ data?.oid ?? data?.orderId } { ...register('oid') } />
         <input type="hidden" defaultValue={ data?.amount } { ...register('amount') } />
         <input type="hidden" defaultValue={ data?.lang } { ...register('lang') } />
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autobusal/order-process",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "author": "Ferjolt Ozuni",
   "type": "module",
   "main": "index.ts",

package/types.ts

@@ -5,7 +5,7 @@ export interface BKTFormData {
   currency: number
   okUrl: string
   failUrl: string
-  oid: number
+  oid: number | string // Claude - 2026-09-25 (audit): the order-number reference is a string
   amount: number
   lang: string
   Email: string
@@ -47,6 +47,9 @@ export interface BKTData {
   description: string
   amount: number
   orderId: number
+  // Claude - 2026-09-25 (audit): the per-attempt order-number reference
+  // obtapi signs into the hash (BKT Prepare) - what BKT must receive as oid
+  oid?: string
   labelId: number
   domain: string
   currency: number