@flopay/react 1.2.1 → 1.2.4

package/dist/index.mjs

@@ -686,6 +686,7 @@ import { jsx as jsx5, jsxs as jsxs3 } from "react/jsx-runtime";
 var DEFAULT_BUTTON_HEIGHT = 45;
 function DirectPayPalButton({
   sessionId,
+  nonce,
   billingApiUrl,
   email,
   clientId,
@@ -723,6 +724,7 @@ function DirectPayPalButton({
   const runBeforeButtonClickRef = useRef2(runBeforeButtonClick);
   const sessionRef = useRef2(session);
   const emailRef = useRef2(email);
+  const nonceRef = useRef2(nonce);
   const beforeClickRef = useRef2(null);
   useEffect3(() => {
     onTokenizedBodyRef.current = onTokenizedBody;
@@ -751,6 +753,9 @@ function DirectPayPalButton({
   useEffect3(() => {
     emailRef.current = email;
   }, [email]);
+  useEffect3(() => {
+    nonceRef.current = nonce;
+  }, [nonce]);
   useEffect3(() => {
     onLoadStateChangeRef.current?.(ready && !failed);
   }, [ready, failed]);
@@ -906,6 +911,7 @@ function DirectPayPalButton({
           effectiveUserId,
           {
             sessionId: effectiveSessionId,
+            nonce: nonceRef.current,
             tokenizedData: body,
             accountData: {
               userId: effectiveUserId,
@@ -940,9 +946,12 @@ function DirectPayPalButton({
       const prepared = beforeClickRef.current;
       const effectiveSessionId = prepared?.sessionId ?? sessionId;
       const effectiveEmail = prepared?.accountPatch?.email ?? emailRef.current;
+      const intentHeaders = { "Content-Type": "application/json" };
+      const currentNonce = nonceRef.current;
+      if (currentNonce) intentHeaders["x-checkout-session-token"] = currentNonce;
       const response = await fetch(`${baseUrl}/v1/checkouts/payments/intents`, {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: intentHeaders,
         body: JSON.stringify({
           sessionId: effectiveSessionId,
           email: effectiveEmail,
@@ -1235,6 +1244,7 @@ import { FloPayError as FloPayError3, resolveTheme } from "@flopay/shared";
 import { Fragment as Fragment2, jsx as jsx6, jsxs as jsxs4 } from "react/jsx-runtime";
 var STRIPE_RESUME_KEY = "flopay_stripe_resume";
 var LEGACY_WALLET_RESUME_KEY = "flopay_wallet_resume";
+var PAYPAL_RESUME_KEY = "flopay_paypal_resume";
 var FLOPAY_KEYFRAMES = `
 .paypal-buttons { margin: 0 !important; vertical-align: top !important; }
 @keyframes flopay-spin { to { transform: rotate(360deg); } }
@@ -1371,6 +1381,7 @@ var SplitCardForm = forwardRef(
 );
 function PayPalButtonInner({
   sessionId,
+  nonce,
   email,
   billingApiUrl,
   onTokenizedBody,
@@ -1400,6 +1411,25 @@ function PayPalButtonInner({
     const redirectStatus = params.get("redirect_status");
     if (!paymentIntentId || !clientSecret) return;
     paypalResumeAttempted.current = true;
+    let persistedOverrides;
+    try {
+      const raw = localStorage.getItem(PAYPAL_RESUME_KEY);
+      if (raw) {
+        const parsed = JSON.parse(raw);
+        if (parsed.clientSecret === clientSecret) {
+          persistedOverrides = {
+            ...parsed.accountPatch ? { accountPatch: parsed.accountPatch } : {},
+            ...parsed.sessionId ? { sessionId: parsed.sessionId } : {},
+            ...parsed.nonce ? { nonce: parsed.nonce } : {}
+          };
+        }
+      }
+    } catch {
+    }
+    try {
+      localStorage.removeItem(PAYPAL_RESUME_KEY);
+    } catch {
+    }
     const cleanedUrl = new URL(window.location.href);
     cleanedUrl.searchParams.delete("payment_intent");
     cleanedUrl.searchParams.delete("payment_intent_client_secret");
@@ -1426,7 +1456,7 @@ function PayPalButtonInner({
             type: "card",
             threeDSecureActionResultTokenId: paymentIntent.id,
             isPaypal: true
-          });
+          }, persistedOverrides);
         } else {
           const message = "PayPal payment was not completed. Please try again.";
           onErrorChange?.(message);
@@ -1452,7 +1482,8 @@ function PayPalButtonInner({
     }
     beforeClickRef.current = {
       accountPatch: beforeClick.accountPatch,
-      sessionId: beforeClick.sessionId
+      sessionId: beforeClick.sessionId,
+      nonce: beforeClick.nonce
     };
     onButtonClick?.("paypal");
     event.resolve();
@@ -1469,10 +1500,12 @@ function PayPalButtonInner({
       }
       prepared = {
         accountPatch: beforeClick.accountPatch,
-        sessionId: beforeClick.sessionId
+        sessionId: beforeClick.sessionId,
+        nonce: beforeClick.nonce
       };
     }
     const effectiveSessionId = prepared?.sessionId ?? sessionId;
+    const effectiveNonce = prepared?.nonce ?? nonce;
     const effectiveEmail = prepared?.accountPatch?.email ?? email;
     try {
       setSubmitting(true);
@@ -1488,9 +1521,11 @@ function PayPalButtonInner({
         event.paymentFailed({ reason: "fail", message });
         return;
       }
+      const intentHeaders = { "Content-Type": "application/json" };
+      if (effectiveNonce) intentHeaders["x-checkout-session-token"] = effectiveNonce;
       const intentResponse = await fetch(`${baseUrl}/v1/checkouts/payments/intents`, {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: intentHeaders,
         body: JSON.stringify({
           sessionId: effectiveSessionId,
           email: effectiveEmail,
@@ -1519,12 +1554,29 @@ function PayPalButtonInner({
       if (paymentMethod?.id) {
         confirmParams["payment_method"] = paymentMethod.id;
       }
+      if (typeof window !== "undefined") {
+        try {
+          localStorage.setItem(PAYPAL_RESUME_KEY, JSON.stringify({
+            clientSecret: intentClientSecret,
+            sessionId: effectiveSessionId,
+            nonce: effectiveNonce,
+            accountPatch: prepared?.accountPatch
+          }));
+        } catch {
+        }
+      }
       const { error: confirmError, paymentIntent } = await stripe.confirmPayment({
         clientSecret: intentClientSecret,
         confirmParams,
         redirect: "if_required"
       });
       if (confirmError) {
+        if (typeof window !== "undefined") {
+          try {
+            localStorage.removeItem(PAYPAL_RESUME_KEY);
+          } catch {
+          }
+        }
         const message = confirmError.message ?? "PayPal payment failed.";
         onErrorChange?.(message);
         onDecline?.(buildDeclineEvent("paypal", message, {
@@ -1532,6 +1584,12 @@ function PayPalButtonInner({
         }));
         return;
       }
+      if (typeof window !== "undefined") {
+        try {
+          localStorage.removeItem(PAYPAL_RESUME_KEY);
+        } catch {
+        }
+      }
       const confirmedPmId = typeof paymentIntent?.payment_method === "string" ? paymentIntent.payment_method : paymentIntent?.payment_method?.id;
       onTokenizedBody({
         id: confirmedPmId ?? paymentIntent?.id,
@@ -1540,7 +1598,8 @@ function PayPalButtonInner({
         isPaypal: true
       }, {
         accountPatch: prepared?.accountPatch,
-        sessionId: effectiveSessionId
+        sessionId: effectiveSessionId,
+        nonce: effectiveNonce
       });
       return;
     } catch (err) {
@@ -1548,7 +1607,7 @@ function PayPalButtonInner({
     } finally {
       setSubmitting(false);
     }
-  }, [stripe, elements, sessionId, email, baseUrl, onTokenizedBody, onErrorChange, onDecline, runBeforeButtonClick]);
+  }, [stripe, elements, sessionId, nonce, email, baseUrl, onTokenizedBody, onErrorChange, onDecline, runBeforeButtonClick]);
   return /* @__PURE__ */ jsxs4(Fragment2, { children: [
     /* @__PURE__ */ jsx6(
       ExpressCheckoutReadySwap,
@@ -1588,6 +1647,7 @@ function PayPalButtonInner({
 }
 function WalletButtonInner({
   sessionId,
+  nonce,
   email,
   billingApiUrl,
   expressMethods,
@@ -1624,11 +1684,13 @@ function WalletButtonInner({
         }
         prepared = {
           accountPatch: beforeClick.accountPatch,
-          sessionId: beforeClick.sessionId
+          sessionId: beforeClick.sessionId,
+          nonce: beforeClick.nonce
         };
       }
       const method = buttonMethod;
       const effectiveSessionId = prepared?.sessionId ?? sessionId;
+      const effectiveNonce = prepared?.nonce ?? nonce;
       const effectiveEmail = prepared?.accountPatch?.email ?? email;
       try {
         setSubmitting(true);
@@ -1646,9 +1708,11 @@ function WalletButtonInner({
         if (!effectiveSessionId || !effectiveEmail) {
           throw new Error("Missing sessionId or email for wallet payment");
         }
+        const intentHeaders = { "Content-Type": "application/json" };
+        if (effectiveNonce) intentHeaders["x-checkout-session-token"] = effectiveNonce;
         const intentResponse = await fetch(`${baseUrl}/v1/checkouts/payments/intents`, {
           method: "POST",
-          headers: { "Content-Type": "application/json" },
+          headers: intentHeaders,
           body: JSON.stringify({
             sessionId: effectiveSessionId,
             email: effectiveEmail,
@@ -1687,7 +1751,8 @@ function WalletButtonInner({
           threeDSecureActionResultTokenId: paymentIntent?.id
         }, {
           accountPatch: prepared?.accountPatch,
-          sessionId: effectiveSessionId
+          sessionId: effectiveSessionId,
+          nonce: effectiveNonce
         });
       } catch (err) {
         onErrorChange?.(err instanceof Error ? err.message : "Wallet payment failed. Please try again.");
@@ -1695,7 +1760,7 @@ function WalletButtonInner({
         setSubmitting(false);
       }
     },
-    [stripe, elements, sessionId, email, baseUrl, onTokenizedBody, onErrorChange, onDecline, runBeforeButtonClick]
+    [stripe, elements, sessionId, nonce, email, baseUrl, onTokenizedBody, onErrorChange, onDecline, runBeforeButtonClick]
   );
   const expressMethodMap = useMemo3(() => {
     const allKeys = ["applePay", "googlePay", "paypal", "link", "amazonPay", "klarna"];
@@ -1741,7 +1806,8 @@ function WalletButtonInner({
               }
               beforeClickRef.current = {
                 accountPatch: beforeClick.accountPatch,
-                sessionId: beforeClick.sessionId
+                sessionId: beforeClick.sessionId,
+                nonce: beforeClick.nonce
               };
               onButtonClick?.(lastWalletMethodRef.current);
               event.resolve();
@@ -1896,6 +1962,7 @@ function StripeMethodButton({
 function StripeMethodInlineForm({
   method,
   sessionId,
+  nonce,
   email,
   billingName,
   billingApiUrl,
@@ -1929,6 +1996,7 @@ function StripeMethodInlineForm({
     }
     onButtonClick?.("card");
     const effectiveSessionId = beforeClick.sessionId ?? sessionId;
+    const effectiveNonce = beforeClick.nonce ?? nonce;
     const effectiveEmail = beforeClick.accountPatch?.email ?? email;
     try {
       onErrorChange?.(null);
@@ -1946,9 +2014,11 @@ function StripeMethodInlineForm({
       if (!effectiveSessionId || !effectiveEmail) {
         throw new Error("Missing sessionId or email for payment.");
       }
+      const intentHeaders = { "Content-Type": "application/json" };
+      if (effectiveNonce) intentHeaders["x-checkout-session-token"] = effectiveNonce;
       const intentResponse = await fetch(`${baseUrl}/v1/checkouts/payments/intents`, {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: intentHeaders,
         body: JSON.stringify({
           sessionId: effectiveSessionId,
           email: effectiveEmail,
@@ -1968,7 +2038,10 @@ function StripeMethodInlineForm({
       if (typeof window !== "undefined") {
         try {
           localStorage.setItem(STRIPE_RESUME_KEY, JSON.stringify({
+            clientSecret: intentClientSecret,
             sessionId: effectiveSessionId,
+            nonce: effectiveNonce,
+            accountPatch: beforeClick.accountPatch,
             paymentMethodId: paymentMethod.id,
             paymentMethodType: paymentMethod.type ?? method,
             gateway: "stripe"
@@ -2025,7 +2098,8 @@ function StripeMethodInlineForm({
         paymentMethodType: paymentMethod.type ?? method
       }, {
         accountPatch: beforeClick.accountPatch,
-        sessionId: effectiveSessionId
+        sessionId: effectiveSessionId,
+        nonce: effectiveNonce
       });
     } catch (err) {
       onErrorChange?.(err instanceof Error ? err.message : "Payment failed. Please try again.");
@@ -2041,6 +2115,7 @@ function StripeMethodInlineForm({
     runBeforeButtonClick,
     onButtonClick,
     sessionId,
+    nonce,
     email,
     baseUrl,
     method,
@@ -2101,6 +2176,7 @@ function StripeMethodInlineForm({
 }
 function StripePaymentElementInner({
   sessionId,
+  nonce,
   email,
   billingName,
   billingApiUrl,
@@ -2146,15 +2222,18 @@ function StripePaymentElementInner({
     }
     onButtonClick?.("card");
     const effectiveSessionId = beforeClick.sessionId ?? sessionId;
+    const effectiveNonce = beforeClick.nonce ?? nonce;
     const effectiveEmail = beforeClick.accountPatch?.email ?? email;
     try {
       onErrorChange?.(null);
       if (!effectiveSessionId || !effectiveEmail) {
         throw new Error("Missing sessionId or email for payment.");
       }
+      const intentHeaders = { "Content-Type": "application/json" };
+      if (effectiveNonce) intentHeaders["x-checkout-session-token"] = effectiveNonce;
       const intentResponse = await fetch(`${baseUrl}/v1/checkouts/payments/intents`, {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: intentHeaders,
         body: JSON.stringify({
           sessionId: effectiveSessionId,
           email: effectiveEmail,
@@ -2178,7 +2257,10 @@ function StripePaymentElementInner({
       if (typeof window !== "undefined") {
         try {
           localStorage.setItem(STRIPE_RESUME_KEY, JSON.stringify({
+            clientSecret: intentClientSecret,
             sessionId: effectiveSessionId,
+            nonce: effectiveNonce,
+            accountPatch: beforeClick.accountPatch,
             paymentMethodType: method,
             gateway: "stripe"
           }));
@@ -2243,7 +2325,8 @@ function StripePaymentElementInner({
         paymentMethodType: method
       }, {
         accountPatch: beforeClick.accountPatch,
-        sessionId: effectiveSessionId
+        sessionId: effectiveSessionId,
+        nonce: effectiveNonce
       });
     } catch (err) {
       onErrorChange?.(err instanceof Error ? err.message : "Payment failed. Please try again.");
@@ -2257,6 +2340,7 @@ function StripePaymentElementInner({
     runBeforeButtonClick,
     onButtonClick,
     sessionId,
+    nonce,
     email,
     baseUrl,
     billingName,
@@ -2348,6 +2432,7 @@ function StripePaymentElementInner({
 }
 function SplitCardFormInner({
   sessionId,
+  nonce,
   billingApiUrl,
   email,
   userId,
@@ -2657,19 +2742,24 @@ function SplitCardFormInner({
   const applyInlineSessionPatch = useCallback(
     (patch, method) => {
       if (!checkout.applyInlineSessionPatch) {
-        return Promise.resolve({ error: null, sessionId });
+        return Promise.resolve({ error: null, sessionId, nonce });
       }
       return checkout.applyInlineSessionPatch(patch).then((result) => ({
         error: null,
-        sessionId: result.sessionId || sessionId
+        sessionId: result.sessionId || sessionId,
+        // A freshly bootstrapped session carries its own nonce on
+        // `session.clientSecret`. Pair it with the new sessionId so
+        // downstream continuation calls don't send the new id with the
+        // prior session-bound token.
+        nonce: result.session?.clientSecret || nonce
       })).catch((err) => {
         const floPayErr = normalizeBeforeButtonClickError(method, err);
         updateError(floPayErr.message);
         onError?.(floPayErr);
-        return { error: floPayErr, sessionId };
+        return { error: floPayErr, sessionId, nonce };
       });
     },
-    [checkout.applyInlineSessionPatch, onError, sessionId, updateError]
+    [checkout.applyInlineSessionPatch, nonce, onError, sessionId, updateError]
   );
   const runBeforeButtonClick = useCallback(async (method) => {
     if (!onBeforeButtonClick) return { proceed: true };
@@ -2696,7 +2786,8 @@ function SplitCardFormInner({
         return {
           proceed: true,
           accountPatch: result.account,
-          sessionId: patchResult.sessionId
+          sessionId: patchResult.sessionId,
+          nonce: patchResult.nonce
         };
       }
       return { proceed: true };
@@ -2715,6 +2806,7 @@ function SplitCardFormInner({
       setOverlayStatus("processing");
       updateError(null);
       const effectiveSessionId = overrides?.sessionId ?? sessionId;
+      const effectiveNonce = overrides?.nonce ?? nonce;
       const effectiveAccount = mergeAccountPatch(resolvedAccount, overrides?.accountPatch);
       const resolvedCompletionPaymentMethodId = overrides?.completionPaymentMethodId ?? resolveTokenizedPaymentMethodId(tokenizedBody);
       const requestTokenizedBody = tokenizedBody.originalPaymentMethodId ? { ...tokenizedBody, originalPaymentMethodId: void 0 } : tokenizedBody;
@@ -2722,6 +2814,7 @@ function SplitCardFormInner({
         const api = new PaymentAPI2(baseUrl);
         const response = await api.processPayment(effectiveAccount.userId ?? "", {
           sessionId: effectiveSessionId,
+          nonce: effectiveNonce,
           tokenizedData: requestTokenizedBody,
           accountData: {
             userId: effectiveAccount.userId ?? "",
@@ -2825,6 +2918,12 @@ function SplitCardFormInner({
                 type: "card",
                 threeDSecureActionResultTokenId: result.paymentIntentId
               }, {
+                // Preserve the session/nonce/account overrides resolved
+                // above so the retry talks to the same (possibly
+                // freshly bootstrapped) session as the original attempt.
+                accountPatch: overrides?.accountPatch,
+                sessionId: effectiveSessionId,
+                nonce: effectiveNonce,
                 completionPaymentMethodId: resolvedCompletionPaymentMethodId
               });
             }
@@ -2908,7 +3007,7 @@ function SplitCardFormInner({
         processingRef.current = false;
       }
     },
-    [baseUrl, sessionId, resolvedAccount, fullName, chv, flopay, paypalFlopay, onComplete, onError, updateError, emitDecline]
+    [baseUrl, sessionId, nonce, resolvedAccount, fullName, chv, flopay, paypalFlopay, onComplete, onError, updateError, emitDecline]
   );
   const dispatchTokenizedBody = useCallback(
     (tokenizedBody, overrides) => {
@@ -2966,7 +3065,17 @@ function SplitCardFormInner({
       }
     };
     const payload = readPayload(STRIPE_RESUME_KEY) ?? readPayload(LEGACY_WALLET_RESUME_KEY);
-    if (payload?.sessionId && payload.sessionId !== sessionId) return;
+    let persistedOverrides;
+    if (payload?.clientSecret) {
+      if (payload.clientSecret !== clientSecret) return;
+      persistedOverrides = {
+        ...payload.accountPatch ? { accountPatch: payload.accountPatch } : {},
+        ...payload.sessionId ? { sessionId: payload.sessionId } : {},
+        ...payload.nonce ? { nonce: payload.nonce } : {}
+      };
+    } else if (payload?.sessionId && payload.sessionId !== sessionId) {
+      return;
+    }
     stripeResumeAttemptedRef.current = true;
     localStorage.removeItem(STRIPE_RESUME_KEY);
     localStorage.removeItem(LEGACY_WALLET_RESUME_KEY);
@@ -3013,7 +3122,7 @@ function SplitCardFormInner({
         threeDSecureActionResultTokenId: paymentIntent.id,
         gateway: payload?.gateway ?? "stripe",
         paymentMethodType
-      });
+      }, persistedOverrides);
     })();
   }, [sessionId, dispatchTokenizedBody, flopay, updateError, emitDecline]);
   const handleSubmit = useCallback(
@@ -3084,9 +3193,11 @@ function SplitCardFormInner({
         if (!sessionId || !resolvedAccount.email) {
           throw new FloPayError3("Missing sessionId or email", "validation_error");
         }
+        const intentHeaders = { "Content-Type": "application/json" };
+        if (nonce) intentHeaders["x-checkout-session-token"] = nonce;
         const intentResponse = await fetch(`${baseUrl}/v1/checkouts/payments/intents`, {
           method: "POST",
-          headers: { "Content-Type": "application/json" },
+          headers: intentHeaders,
           body: JSON.stringify({
             sessionId,
             email: resolvedAccount.email,
@@ -3154,7 +3265,7 @@ function SplitCardFormInner({
         }
       }
     },
-    [flopay, elements, isSubmitting, sessionId, resolvedAccount.email, baseUrl, isSelfContained, dispatchTokenizedBody, onButtonClick, onError, updateError, emitDecline, layout]
+    [flopay, elements, isSubmitting, sessionId, nonce, resolvedAccount.email, baseUrl, isSelfContained, dispatchTokenizedBody, onButtonClick, onError, updateError, emitDecline, layout]
   );
   const isReady = flopay !== null && elements !== null;
   if (!isReady) {
@@ -3686,6 +3797,7 @@ function SplitCardFormInner({
                   DirectPayPalButton,
                   {
                     sessionId,
+                    nonce,
                     billingApiUrl: resolvedBillingApiUrl,
                     email: resolvedAccount.email,
                     clientId: directPaypal.clientId,
@@ -3711,6 +3823,7 @@ function SplitCardFormInner({
                 PayPalButtonInner,
                 {
                   sessionId,
+                  nonce,
                   email: resolvedAccount.email,
                   billingApiUrl: resolvedBillingApiUrl,
                   onTokenizedBody: dispatchTokenizedBody,
@@ -3727,6 +3840,7 @@ function SplitCardFormInner({
                 WalletButtonInner,
                 {
                   sessionId,
+                  nonce,
                   email: resolvedAccount.email,
                   billingApiUrl: resolvedBillingApiUrl,
                   expressMethods: walletExpressMethods,
@@ -3743,6 +3857,7 @@ function SplitCardFormInner({
                 StripePaymentElementInner,
                 {
                   sessionId,
+                  nonce,
                   email: resolvedAccount.email,
                   billingName: [resolvedAccount.firstName, resolvedAccount.lastName].filter(Boolean).join(" ").trim() || void 0,
                   billingApiUrl: resolvedBillingApiUrl,
@@ -3918,6 +4033,7 @@ function SplitCardFormInner({
                 {
                   method: expandedApmMethod,
                   sessionId,
+                  nonce,
                   email: resolvedAccount.email,
                   billingName: [resolvedAccount.firstName, resolvedAccount.lastName].filter(Boolean).join(" ").trim() || void 0,
                   billingApiUrl: resolvedBillingApiUrl,
@@ -4016,6 +4132,7 @@ function SplitCardFormInner({
               {
                 method: expandedApmMethod,
                 sessionId,
+                nonce,
                 email: resolvedAccount.email,
                 billingName: [resolvedAccount.firstName, resolvedAccount.lastName].filter(Boolean).join(" ").trim() || void 0,
                 billingApiUrl: resolvedBillingApiUrl,
@@ -4064,6 +4181,7 @@ function SplitCardFormInner({
           DirectPayPalButton,
           {
             sessionId,
+            nonce,
             billingApiUrl: resolvedBillingApiUrl,
             email: resolvedAccount.email,
             clientId: directPaypal.clientId,
@@ -4089,6 +4207,7 @@ function SplitCardFormInner({
         PayPalButtonInner,
         {
           sessionId,
+          nonce,
           email: resolvedAccount.email,
           billingApiUrl: resolvedBillingApiUrl,
           onTokenizedBody: dispatchTokenizedBody,
@@ -4105,6 +4224,7 @@ function SplitCardFormInner({
         WalletButtonInner,
         {
           sessionId,
+          nonce,
           email: resolvedAccount.email,
           billingApiUrl: resolvedBillingApiUrl,
           expressMethods: walletExpressMethods,
@@ -4121,6 +4241,7 @@ function SplitCardFormInner({
         StripePaymentElementInner,
         {
           sessionId,
+          nonce,
           email: resolvedAccount.email,
           billingName: [resolvedAccount.firstName, resolvedAccount.lastName].filter(Boolean).join(" ").trim() || void 0,
           billingApiUrl: resolvedBillingApiUrl,
@@ -4264,6 +4385,7 @@ function getRedirectTokenFromProcessResponse(json, options) {
 async function recover3DSRedirectResult({
   billingApiUrl,
   sessionId,
+  nonce,
   responseJson
 }) {
   const directToken = getRedirectTokenFromProcessResponse(responseJson, {
@@ -4280,7 +4402,7 @@ async function recover3DSRedirectResult({
   }
   try {
     const api = new PaymentAPI3(billingApiUrl);
-    const unified = await api.getUnifiedCheckoutSession(sessionId);
+    const unified = await api.getUnifiedCheckoutSession(sessionId, nonce);
     const refreshedToken = unified.data.stripe?.clientSecret;
     if (isStripePaymentIntentClientSecret(refreshedToken)) {
       return {
@@ -4310,6 +4432,7 @@ async function processSavedPaymentForMode({
   const api = new PaymentAPI3(baseUrl);
   const response = await retryOnceOnFetchFailure(() => api.processPayment(customerId, {
     sessionId: resolvedSessionId,
+    nonce: session.clientSecret,
     tokenizedData,
     accountData: {
       userId: customerId,
@@ -4352,6 +4475,7 @@ async function processSavedPaymentForMode({
     const recoveredRedirect = await recover3DSRedirectResult({
       billingApiUrl: baseUrl,
       sessionId: resolvedSessionId,
+      nonce: session.clientSecret,
       responseJson: json
     });
     if (recoveredRedirect) {
@@ -5546,6 +5670,7 @@ function FloPayCheckout({
           DirectPayPalButton,
           {
             sessionId: activeSessionId,
+            nonce: session.clientSecret || void 0,
             billingApiUrl: resolvedBillingUrl,
             email: session.customer?.email,
             clientId: directPaypalConfig.clientId,
@@ -5631,6 +5756,7 @@ function FloPayCheckout({
         SessionInjector,
         {
           sessionId: activeSessionId,
+          nonce: session?.clientSecret || void 0,
           billingApiUrl: resolvedBillingUrl,
           session,
           children
@@ -5640,6 +5766,7 @@ function FloPayCheckout({
       SplitCardForm,
       {
         sessionId: activeSessionId,
+        nonce: session?.clientSecret || void 0,
         email: session?.customer?.email,
         userId: session?.customer?.id,
         firstName: session?.customer?.firstName,
@@ -5690,6 +5817,7 @@ function FloPayCheckout({
 }
 function SessionInjector({
   sessionId,
+  nonce,
   billingApiUrl,
   session,
   children
@@ -5699,6 +5827,7 @@ function SessionInjector({
     const existing = child.props;
     const injected = {};
     if (!existing.sessionId) injected.sessionId = sessionId;
+    if (!existing.nonce && nonce) injected.nonce = nonce;
     if (!existing.billingApiUrl) injected.billingApiUrl = billingApiUrl;
     if (session?.customer) {
       if (!existing.email) injected.email = session.customer.email;
@@ -5948,6 +6077,7 @@ var CheckoutForm = forwardRef2(
 );
 function CheckoutFormInner({
   sessionId,
+  nonce,
   billingApiUrl,
   email,
   userId,
@@ -6002,6 +6132,7 @@ function CheckoutFormInner({
         const api = new PaymentAPI5(baseUrl);
         const response = await api.processPayment(userId ?? "", {
           sessionId,
+          nonce,
           tokenizedData: requestTokenizedBody,
           accountData: {
             userId: userId ?? "",
@@ -6101,7 +6232,7 @@ function CheckoutFormInner({
         setProcessing(false);
       }
     },
-    [baseUrl, sessionId, userId, email, firstName, lastName, chv, flopay, paypalFlopay, onComplete, onError, onDecline, updateError, emitDecline]
+    [baseUrl, sessionId, nonce, userId, email, firstName, lastName, chv, flopay, paypalFlopay, onComplete, onError, onDecline, updateError, emitDecline]
   );
   const dispatchTokenizedBody = useCallback3(
     (tokenizedBody) => {
@@ -6184,9 +6315,11 @@ function CheckoutFormInner({
         if (!sessionId || !email) {
           throw new FloPayError6("Missing sessionId or email", "validation_error");
         }
+        const intentHeaders = { "Content-Type": "application/json" };
+        if (nonce) intentHeaders["x-checkout-session-token"] = nonce;
         const intentResponse = await fetch(`${baseUrl}/v1/checkouts/payments/intents`, {
           method: "POST",
-          headers: { "Content-Type": "application/json" },
+          headers: intentHeaders,
           body: JSON.stringify({
             sessionId,
             email,
@@ -6245,7 +6378,7 @@ function CheckoutFormInner({
         }
       }
     },
-    [flopay, elements, isSubmitting, sessionId, email, baseUrl, isSelfContained, dispatchTokenizedBody, onError, updateError, emitDecline]
+    [flopay, elements, isSubmitting, sessionId, nonce, email, firstName, lastName, baseUrl, isSelfContained, dispatchTokenizedBody, onError, updateError, emitDecline]
   );
   const isReady = flopay !== null && elements !== null;
   return /* @__PURE__ */ jsxs6("form", { onSubmit: handleSubmit, className, style: { position: "relative" }, children: [
@@ -6283,6 +6416,7 @@ import { useCallback as useCallback4, useEffect as useEffect7, useRef as useRef5
 import { Fragment as Fragment5, jsx as jsx9, jsxs as jsxs7 } from "react/jsx-runtime";
 function PayPalButton({
   sessionId,
+  nonce,
   billingApiUrl,
   email,
   userId,
@@ -6307,6 +6441,7 @@ function PayPalButton({
         const api = new PaymentAPI6(baseUrl);
         const response = await api.processPayment(userId ?? "", {
           sessionId,
+          nonce,
           tokenizedData: tokenizedBody,
           accountData: {
             userId: userId ?? "",
@@ -6326,7 +6461,7 @@ function PayPalButton({
         onErrorChange?.(err instanceof Error ? err.message : "An unexpected error occurred");
       }
     },
-    [baseUrl, sessionId, userId, email, firstName, lastName, chv, onComplete, onErrorChange]
+    [baseUrl, sessionId, nonce, userId, email, firstName, lastName, chv, onComplete, onErrorChange]
   );
   const dispatchTokenizedBody = useCallback4(
     (body) => {
@@ -6397,6 +6532,7 @@ function PayPalButton({
       const result = await flopay.confirmPayPalPayment({
         billingApiUrl: baseUrl,
         sessionId,
+        nonce,
         email,
         returnUrl: window.location.href
       });
@@ -6417,7 +6553,7 @@ function PayPalButton({
     } finally {
       setSubmitting(false);
     }
-  }, [flopay, elements, sessionId, email, baseUrl, dispatchTokenizedBody, onErrorChange]);
+  }, [flopay, elements, sessionId, nonce, email, baseUrl, dispatchTokenizedBody, onErrorChange]);
   if (!flopay || !elements) {
     return /* @__PURE__ */ jsx9("div", { style: { height: 45, background: "#f0f0f0", borderRadius: 6, animation: "pulse 1.5s infinite" } });
   }