---
"@marketplaces/auth": minor
"@marketplaces/payment": minor
---

Superseded 2026-08-23: this changeset originally proposed keeping legacy-CORS-compatible request parameters as the default transport for `marketplaceDomain`. That direction is reversed — both packages now send `X-Marketplace-Domain` as a header exclusively; the query/body-parameter transport mode (`contextTransport: 'parameter'`) has been removed entirely, not just de-defaulted.

Reason for the reversal: the `feat/auth-admin-credentials-login` branch dropped param-transport while adding credentials-login, and that direction was kept rather than restoring the legacy fallback. **Backend must allow `X-Marketplace-Domain` in CORS preflight for both the Auth API and Payment API before this ships** — tracked in `BACKEND-TODO.md`. If that turns out not to be feasible, this decision needs revisiting, not silently worked around.