@flopay/shared 1.2.0 → 1.2.4

package/dist/index.d.cts

@@ -480,12 +480,17 @@ interface PaymentProviderAdapter {
     /**
      * Create a PayPal payment: create PM → create intent → confirm with redirect.
      * Returns the confirmed PaymentIntent ID if completed inline, or redirects to PayPal.
+     *
+     * `nonce` is the session-bound checkout token from session creation. Post-#640
+     * backends reject `POST /v1/checkouts/payments/intents` with 401 when the
+     * `x-checkout-session-token` header is missing — pass `nonce` to forward it.
      */
     confirmPayPalPayment(params: {
         billingApiUrl: string;
         sessionId: string;
         email: string;
         returnUrl: string;
+        nonce?: string;
     }): Promise<ConfirmCardPaymentResult>;
     /**
      * Resume a PayPal payment after redirect return.
@@ -871,6 +876,15 @@ interface DeclineEvent {
 type CheckoutSessionResult = {
     status: 201;
     redirectUrl: string;
+    /**
+     * Session-bound checkout token returned by the billing API alongside the
+     * session UUID. Must be echoed back on every continuation request via the
+     * `x-checkout-session-token` header — backend `TeamFloPay/backend#640`
+     * matches this value against `checkout_session.nonce` to authorize the
+     * call. Surfaced here so the redirect-style flow's caller can forward it
+     * (e.g. into a hosted checkout page that hits continuation routes).
+     */
+    nonce: string;
 } | {
     status: 204;
 } | {
@@ -882,6 +896,17 @@ type CheckoutSessionResult = {
  */
 interface ProcessPaymentParams {
     sessionId: string;
+    /**
+     * Session-bound checkout token returned from session creation. Forwarded as
+     * the `x-checkout-session-token` header on every call to
+     * `POST /v1/checkouts/sessions/:id/process`. Required by post-#640 backends —
+     * `PaymentAPI.processPayment` throws `MissingCheckoutSessionToken` when this
+     * is missing or empty so the 401 fails fast on the client instead of after
+     * the network round trip. Typed as optional so callers do not need to coerce
+     * `undefined` to `''` to satisfy the type — pass the value through verbatim
+     * and let `processPayment` surface the missing-token error.
+     */
+    nonce?: string;
     tokenizedData?: TokenizedBody;
     accountData: {
         userId: string;
@@ -973,7 +998,7 @@ declare function getConfiguredBillingApiUrl(): string;
 declare function getFloPayEnvironment(): FloPayEnvironment;
 
 /** Current SDK version. */
-declare const SDK_VERSION = "1.2.0";
+declare const SDK_VERSION = "1.2.4";
 /** Billing API URL for staging environment. */
 declare const BILLING_API_URL_STAGING = "https://api.stage.flopay.com";
 /** Billing API URL for production environment. */

package/dist/index.d.ts

@@ -480,12 +480,17 @@ interface PaymentProviderAdapter {
     /**
      * Create a PayPal payment: create PM → create intent → confirm with redirect.
      * Returns the confirmed PaymentIntent ID if completed inline, or redirects to PayPal.
+     *
+     * `nonce` is the session-bound checkout token from session creation. Post-#640
+     * backends reject `POST /v1/checkouts/payments/intents` with 401 when the
+     * `x-checkout-session-token` header is missing — pass `nonce` to forward it.
      */
     confirmPayPalPayment(params: {
         billingApiUrl: string;
         sessionId: string;
         email: string;
         returnUrl: string;
+        nonce?: string;
     }): Promise<ConfirmCardPaymentResult>;
     /**
      * Resume a PayPal payment after redirect return.
@@ -871,6 +876,15 @@ interface DeclineEvent {
 type CheckoutSessionResult = {
     status: 201;
     redirectUrl: string;
+    /**
+     * Session-bound checkout token returned by the billing API alongside the
+     * session UUID. Must be echoed back on every continuation request via the
+     * `x-checkout-session-token` header — backend `TeamFloPay/backend#640`
+     * matches this value against `checkout_session.nonce` to authorize the
+     * call. Surfaced here so the redirect-style flow's caller can forward it
+     * (e.g. into a hosted checkout page that hits continuation routes).
+     */
+    nonce: string;
 } | {
     status: 204;
 } | {
@@ -882,6 +896,17 @@ type CheckoutSessionResult = {
  */
 interface ProcessPaymentParams {
     sessionId: string;
+    /**
+     * Session-bound checkout token returned from session creation. Forwarded as
+     * the `x-checkout-session-token` header on every call to
+     * `POST /v1/checkouts/sessions/:id/process`. Required by post-#640 backends —
+     * `PaymentAPI.processPayment` throws `MissingCheckoutSessionToken` when this
+     * is missing or empty so the 401 fails fast on the client instead of after
+     * the network round trip. Typed as optional so callers do not need to coerce
+     * `undefined` to `''` to satisfy the type — pass the value through verbatim
+     * and let `processPayment` surface the missing-token error.
+     */
+    nonce?: string;
     tokenizedData?: TokenizedBody;
     accountData: {
         userId: string;
@@ -973,7 +998,7 @@ declare function getConfiguredBillingApiUrl(): string;
 declare function getFloPayEnvironment(): FloPayEnvironment;
 
 /** Current SDK version. */
-declare const SDK_VERSION = "1.2.0";
+declare const SDK_VERSION = "1.2.4";
 /** Billing API URL for staging environment. */
 declare const BILLING_API_URL_STAGING = "https://api.stage.flopay.com";
 /** Billing API URL for production environment. */

package/dist/index.mjs

@@ -79,7 +79,7 @@ var PAYMENT_METHOD_LOGOS = {
 };
 
 // src/constants.ts
-var SDK_VERSION = "1.2.0";
+var SDK_VERSION = "1.2.4";
 var BILLING_API_URL_STAGING = "https://api.stage.flopay.com";
 var BILLING_API_URL_PRODUCTION = "https://api.flopay.com";
 var DEFAULT_API_BASE_URL = BILLING_API_URL_STAGING;