zeekay e6231678e6 fix(checkout): price widget lines by catalog ref; gate purchase on paid return ...

Two RED must-fix findings on the checkout.js widget path.

[high] checkout.js widget mis-charged every line as a $50 "MEGA Hat".
lineItemsOf() sent {id,name,unitPrice,quantity} and the vendored SDK's M()
mapper dropped productSlug/productId/variantSku, so the commerce server
(hasCatalogRef = productId||productSlug||variantSku) never re-priced and each
line fell to the legacy custom-hat branch (safeName('')='MEGA Hat', $50). The
server IGNORES client unitPrice, so this was a missing-catalog-ref defect, not
price tampering. Fix: lineItemsOf() now sets productSlug (i.slug), and M() in
vendor/checkout.global.js forwards productSlug/productId/variantSku so the ref
reaches the wire and the server prices the real product. Verified end-to-end
through the actual vendored SDK (productSlug reaches POST /v1/checkout/sessions).

[medium] GA4/Meta `purchase` fired for unpaid orders. thankYou() fired on ANY
/thank-you visit using a stash written at checkout START (pre-payment). Fix:
fire only on a proven paid round-trip — require ?ok=1 AND ?txn === the stashed
transaction_id; the confirmation detail line is gated the same way. Added a
cancel marker (cancelUrl -> /shop?checkout=cancel) that clears the pre-payment
stash and keeps the bag. The refresh once-guard (takePendingOrder clears the
key) and the Square fallback (no stash, no query -> never fired) are unaffected.

verify.html: purchase row + section 3 now state the paid-proof gate and the
catalog-ref repricing (place one live test order before enabling SPA_CHECKOUT_KEY
in prod). Bumped the asset cache-bust token 052 -> 053 in lockstep so the changed
JS surfaces past the 24h edge cache. Vendored bundle carries a forward-fix header
(pending upstream checkout.js >= 2.1.23). Build GREEN: node --check all site/*.js.

2026-07-24 01:44:28 -07:00

..

checkout.global.js

fix(checkout): price widget lines by catalog ref; gate purchase on paid return

2026-07-24 01:44:28 -07:00

track.min.js

commerce+analytics+replay: standards-annotated checkout demo

2026-07-24 01:06:51 -07:00