fix(apple-pay): forward card expiry in webview onComplete result

[higuptabolt]

Description

In webview mode, ApplePayResult.expiration was always undefined.

ApplePayWebView mapped the Apple Pay result from the Bolt-hosted add-card-from-apple-wallet iframe's addCardFromApplePaySuccess message. That message's token is a TokenizeApplePayResult, whose expiry field is named expiry — but the handler read tokenResult?.expiration, which doesn't exist on that payload, so the value silently resolved to undefined.

This has been the case since WebView mode shipped (#42) and was carried forward through #63 and #101. Any merchant reading result.expiration in webview mode has received undefined.

Changes:

• ApplePayWebView.tsx: read tokenResult?.expiry (the actual iframe field) instead of tokenResult?.expiration. The public ApplePayResult.expiration output field is unchanged — this only fixes the source field it's populated from.
• This now matches the native ApplePay and GoogleWallet mappings, which already read tokenResult.expiry.
• ApplePayWebView.test.tsx: the existing regression test mocked the iframe payload with expiration, encoding the same wrong field name, so it passed against the bug. Corrected the mock to expiry (matching the real TokenizeApplePayResult contract); the asserted onComplete output is unchanged.

Testing

• yarn lint, yarn typecheck, yarn test all pass (180/180).
• Verified the field name against the iframe source: the addCardFromApplePaySuccess message posts token: TokenizeApplePayResult whose expiry field is expiry (no expiration field exists on it).

Security Review

Important

A security review is required for every PR in this repository to comply with PCI requirements.

• I have considered and reviewed security implications of this PR and included the summary below.

Security Impact Summary

No security impact. This corrects which field of an existing, already-handled token payload is read to populate the card expiry (MM/YY-style, non-secret) surfaced to the merchant's onComplete callback. No change to token handling, storage, transport, data exposure, or PAN/CVV processing.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.