@agent-cards/checkout 0.1.0 → 0.2.1

package/dist/cdp.js

@@ -1,11 +1,275 @@
-const CARD_PATTERNS = [
-    '*pci.shopifyinc.com/sessions*',
-    '*shopifycs.com/sessions*',
-    '*api.stripe.com/v1/payment_methods*',
-    '*api.stripe.com/v1/tokens*',
-    '*braintree-api.com/graphql*',
-    '*checkout.com/tokens*',
-];
+import { BUILTIN_REGISTRY, cardUrlPatterns } from './registry.js';
+import { ApprovalDeclinedError, ApprovalTimeoutError, CardEncryptedError, CheckoutApiError, UnsupportedModeError, redactUrl, } from './client.js';
+import { substituteEncryptedFields } from './substitute.js';
+import { hostedFormSubmittedPage } from './hosted-form.js';
+// Every URL that leaves this module through onEvent is redacted to origin +
+// path first. A paused PaymentIntent confirm can carry the client secret in
+// its query string (Stripe.js puts it in the body; hand-rolled runtimes and
+// some SDKs put it in the URL), and onEvent is ordinary integrator telemetry:
+// logs, dashboards, crash reporters. None of those may receive a secret.
+/**
+ * How long a hosted form that the cardholder already submitted stays refused
+ * when the page posts it again.
+ *
+ * A hosted_form approval resolves the paused navigation with a synthetic page
+ * (hostedFormSubmittedPage), and the merchant page may still carry the same
+ * card form: an agent that clicks Pay again would pause an identical
+ * navigation and, without this, raise a second prompt on the household's
+ * phone for a payment that already left it. The API's duplicate guard covers
+ * a body the form regenerated (same supplier, session and amount inside 15
+ * minutes: 409 duplicate_submission, which the adapters quiet the way they
+ * quiet a decline, see isApprovalOutcome); this latch covers the
+ * byte-identical re-post without a round trip. Same window as the
+ * authorization's own TTL. Overridable per attach via `hostedFormRepeatQuietMs`.
+ */
+const HOSTED_FORM_REPEAT_QUIET_MS = 15 * 60_000;
+/** The same form the device already submitted, posted again inside the quiet window. */
+function isRepeatOfSubmitted(last, url, body, quietMs) {
+    return !!last && last.url === url && last.body === body && Date.now() - last.at < quietMs;
+}
+const HOSTED_FORM_REPEAT_REASON = 'already submitted on the cardholder\'s device';
+/**
+ * How long to stop asking after a person declines or ignores an approval.
+ *
+ * This exists because the two failure shapes look identical at the route
+ * handler and need opposite answers. A merchant page re-issues an aborted
+ * tokenization within milliseconds, and re-prompting on each of those turns
+ * one decline into a queue of notifications on someone's phone. A genuinely
+ * later checkout also arrives as a paused request, and that one deserves a
+ * fresh prompt, so a permanent latch is wrong too.
+ *
+ * Elapsed time is what separates them, and nothing else available here does:
+ * body, nonce and authorization id all differ between an automatic retry and a
+ * new checkout. So a decline buys a short silence, not a closed door.
+ *
+ * Kept deliberately SHORT. A page's automatic retry lands in milliseconds — the
+ * storm this exists for ran at roughly ten a second — so a few seconds absorbs
+ * a burst with room to spare, while leaving almost no window in which a person
+ * could start a genuinely new checkout and be turned away. Raise it only with
+ * evidence of a slower retry loop; every second added is a second a real
+ * checkout can be refused. Overridable per attach via `approvalCooldownMs`.
+ */
+const APPROVAL_COOLDOWN_MS = 5_000;
+/**
+ * One approval at a time, per attachment.
+ *
+ * The cooldown only arms once a failure RESOLVES, so two requests paused
+ * before the first authorize() returns both sail past it and each raise their
+ * own prompt. A checkout with several card iframes does exactly that. Nobody
+ * should get two notifications asking them to approve the same purchase, so a
+ * request arriving while one is outstanding is failed rather than queued: the
+ * page's own retry brings it back, and by then there is an answer.
+ */
+/**
+ * This one authorization was answered; see APPROVAL_COOLDOWN_MS. An
+ * AmountMismatchError is an ApprovalDeclinedError, so both amount checks land
+ * here: the pre-replay one (the row IS declined) and the create-time one (no
+ * row; the intent already disagreed). Either way the paused request is
+ * aborted with nothing charged and the page's retry is quieted, NOT latched:
+ * Stripe lets the merchant update an intent's amount until it is confirmed,
+ * so the next request on this page is a new question and is judged afresh.
+ * IntentNotConfirmableError lands here too (the row is declined).
+ *
+ * A 409 duplicate_submission is an answer of the same kind: the household
+ * already has, or already answered, the prompt for this exact submission (a
+ * hosted form the page posted again with a fresh nonce). Quieting the page's
+ * re-post is right; latching the whole attachment is not, because the prior
+ * row declines or expires and the same form is then a new question. The
+ * quiet window absorbs the burst; the next request past it is judged afresh.
+ */
+function isApprovalOutcome(err) {
+    if (err instanceof CheckoutApiError)
+        return err.code === 'duplicate_submission';
+    return err instanceof ApprovalDeclinedError || err instanceof ApprovalTimeoutError;
+}
+/**
+ * Should this failure stop us intercepting for the rest of the page's life?
+ *
+ * It matters because a failed tokenization does not end the checkout: the
+ * merchant's own page retries, we pause the retry, we fail it again, and the
+ * loop runs as fast as the page will go. A real run against Shopify with a
+ * stale user id produced ~10 authorization calls a SECOND for fifteen minutes
+ * until the agent's host killed it, every one of them a request to our API that
+ * could never have succeeded.
+ *
+ * Terminal means "will answer identically next time no matter who does what":
+ * a misconfiguration or an unsupported PSP. Nothing a person does changes
+ * those, so asking again is pure waste.
+ *
+ * Everything else stays retryable. A 5xx or a 429 clears on its own, and a
+ * decline or a timeout is answered by the cooldown above rather than by
+ * killing the page: the person said no to one authorization, not to every
+ * checkout they will ever make in this session. A 409 duplicate_submission
+ * is not `permanent` on the error itself (see CheckoutApiError) and lands in
+ * the cooldown too.
+ */
+function isTerminal(err) {
+    if (err instanceof CheckoutApiError)
+        return err.permanent;
+    return err instanceof CardEncryptedError || err instanceof UnsupportedModeError;
+}
+/**
+ * The cse continuation: the paused body with the vault's ciphertext in place
+ * of the dummy blobs. It is sent as postData ALONE. Chromium recomputes
+ * Content-Length for a continued request itself and refuses a header override
+ * that names it (Fetch.continueRequest answers -32602 "Unsafe header"), and
+ * that refusal would land after the cardholder approved, failing a paid-for
+ * request. Leaving `headers` off the command keeps every other header the
+ * browser's own, untouched, which is the point of continuing rather than
+ * fulfilling.
+ */
+function cseBody(body, replay) {
+    return substituteEncryptedFields(body, replay.substitutions);
+}
+/**
+ * The paused request's body, or null when Chromium says there is one and did
+ * not hand it over. `postData` is set only for a text body; a binary or a
+ * large one arrives as base64 `postDataEntries` instead, concatenated here
+ * byte for byte (an entry without `bytes` is a file the browser streams, which
+ * no runtime can read back). There is no CDP command to fetch it later:
+ * `Fetch.getRequestPostData` does not exist (Chrome answers -32601), so a
+ * body that is not on the event is a body this adapter cannot see.
+ */
+function pausedBody(request) {
+    if (typeof request.postData === 'string' && request.postData !== '')
+        return request.postData;
+    if (!request.hasPostData)
+        return request.postData ?? '';
+    const entries = request.postDataEntries ?? [];
+    if (!entries.length || entries.some((e) => typeof e.bytes !== 'string'))
+        return null;
+    return Buffer.concat(entries.map((e) => Buffer.from(e.bytes, 'base64'))).toString('utf8');
+}
+const BODY_UNREADABLE_REASON = 'the paused request\'s body could not be read (no postData and no postDataEntries)';
+/**
+ * The CORS headers a fulfilled CROSS-ORIGIN request needs, or null when the
+ * request is same-origin (or carries no Origin, so no CORS check applies).
+ *
+ * The browser checks a fulfilled response exactly as it checks a real one. A
+ * page that fetches a processor on another origin therefore needs
+ * `access-control-allow-origin` on the synthetic answer, or its fetch rejects
+ * with "Failed to fetch" and the page never sees the processor's reply, even
+ * though the cardholder approved and the processor answered the vault.
+ * Shopify never hit this on its current host: the checkout.pci.shopifyinc.com
+ * card iframe posts to its own origin (its older deposit.<region>.shopifycs.com
+ * host is called from the checkout.shopifycs.com frame, cross-origin, and gets
+ * the answer like everyone else). Stripe hits it on every surface (Checkout on
+ * checkout.stripe.com or a merchant domain, and Elements in the js.stripe.com
+ * frame, all call api.stripe.com), and so does every other processor whose
+ * card frame calls a separate API host. Observed live on
+ * 2026-09-03: the vault replayed a Stripe PaymentMethod into a raw-CDP
+ * runtime, the browser refused the answer for want of this header, and
+ * Stripe Checkout showed "We are experiencing connection issues".
+ *
+ * The exact Origin is echoed rather than `*`: a credentialed request refuses
+ * `*`, the echo satisfies both. The processor's own value can never reach
+ * this adapter (a browser does not expose that header to the page that
+ * replayed the call), so whatever the replay carries under these names is
+ * replaced by the one value that is right for THIS request. Playwright adds
+ * the same headers inside route.fulfill when a cross-origin fulfill carries
+ * none (microsoft/playwright#12929), which is why attachToPlaywright never
+ * needed this; it writes them itself anyway, replacing a stale value, so both
+ * adapters answer the vault's replays identically.
+ *
+ * This widens nothing. A tokenization endpoint is built for anonymous
+ * browsers and answers every origin (`access-control-allow-origin: *` on
+ * Stripe's and Shopify's own replies), so the page that made the request
+ * could always read the processor's answer to it; the replay is made exactly
+ * as visible, to exactly that page. Whether a card goes anywhere at all is
+ * decided by the cardholder on the approval screen, never by this header.
+ *
+ * Only what a browser serializes is ever echoed: one canonical http(s)
+ * origin (`new URL(origin).origin === origin`), or the opaque `null` a
+ * sandboxed or data: document sends, which Chrome matches against
+ * `access-control-allow-origin: null` and which Playwright echoes too. That
+ * refuses userinfo, a path, an explicit default port, several origins in one
+ * value, or a control character that would break the fulfill after the
+ * cardholder already approved. Anything refused simply gets no CORS answer,
+ * which is what every fulfill got before this existed.
+ */
+export function corsHeadersFor(url, requestHeaders) {
+    return corsDecision(url, requestHeaders).headers;
+}
+/** The CORS answer and its reason: `none` when no usable Origin was sent (or the url is not http(s)), `same_origin` when no check applies. */
+export function corsDecision(url, requestHeaders) {
+    const none = { headers: null, outcome: 'none' };
+    const originEntry = Object.entries(requestHeaders ?? {}).find(([name]) => name.toLowerCase() === 'origin');
+    const origin = typeof originEntry?.[1] === 'string' ? originEntry[1].trim() : '';
+    if (!origin)
+        return none;
+    let target;
+    try {
+        target = new URL(url);
+    }
+    catch {
+        return none;
+    }
+    if (target.protocol !== 'https:' && target.protocol !== 'http:')
+        return none;
+    if (origin !== 'null') {
+        let originUrl;
+        try {
+            originUrl = new URL(origin);
+        }
+        catch {
+            return none;
+        }
+        if (originUrl.protocol !== 'https:' && originUrl.protocol !== 'http:')
+            return none;
+        if (originUrl.origin !== origin)
+            return none;
+        if (target.origin === origin)
+            return { headers: null, outcome: 'same_origin' };
+    }
+    return { headers: { 'access-control-allow-origin': origin, 'access-control-allow-credentials': 'true' }, outcome: 'echoed' };
+}
+/**
+ * `headers` with the CORS answer for this request written in; the object
+ * itself when none is needed. Any header the answer names is replaced
+ * whatever its case, so a name is never sent twice. The answer varies by
+ * Origin, and a `vary` the replay already carries is extended rather than
+ * replaced (or left alone when it already covers Origin or is `*`); a `vary`
+ * the answer itself names is taken as given.
+ */
+export function withCorsHeaders(headers, cors) {
+    if (!cors)
+        return headers;
+    const replaced = new Set(Object.keys(cors).map((name) => name.toLowerCase()));
+    const out = {};
+    let varyName = null;
+    for (const [name, value] of Object.entries(headers)) {
+        const lower = name.toLowerCase();
+        if (replaced.has(lower))
+            continue;
+        if (lower === 'vary')
+            varyName = name;
+        out[name] = value;
+    }
+    Object.assign(out, cors);
+    if (replaced.has('vary'))
+        return out;
+    if (varyName === null) {
+        out.vary = 'Origin';
+    }
+    else {
+        const existing = String(out[varyName]);
+        const members = existing.split(',').map((m) => m.trim().toLowerCase());
+        if (!members.includes('origin') && !members.includes('*'))
+            out[varyName] = `${existing}, Origin`;
+    }
+    return out;
+}
+/** CDP's header shape: `{ name, value }` entries. */
+function headerEntries(headers) {
+    return Object.entries(headers).map(([name, value]) => ({ name, value: String(value) }));
+}
+/**
+ * Last-resort patterns: the built-in recognizers' hosts, derived the same way
+ * as everything else. Used only when the vault hands back nothing at all (a
+ * duck-typed client from an older SDK, or an empty registry) — a hardcoded list
+ * that drifts from the registry is exactly the bug this adapter used to have.
+ */
+const FALLBACK_CARD_PATTERNS = cardUrlPatterns(BUILTIN_REGISTRY);
 /**
  * Take over card tokenization for a page.
  *
@@ -13,16 +277,38 @@ const CARD_PATTERNS = [
  * targets. Enabling Fetch on the page session alone will never see the
  * tokenization request. This attaches recursively so every nested target is
  * armed, which is the whole reason this adapter exists.
+ *
+ * The patterns armed here come from the REGISTRY, not from a constant, so a PSP
+ * the API knows about is paused without an SDK release — call
+ * `vault.syncRegistry()` before attaching and every recognizer the server
+ * serves is covered. They are a coarse pre-filter and are deliberately wider
+ * than the recognizers (see cardUrlPatterns): each paused request is re-checked
+ * with `isCardRequest` below and continued untouched unless it is an exact
+ * match. Patterns are resolved once, at attach, so every nested target ends up
+ * armed identically.
  */
 export async function attachToCdp(cdp, pageSessionId, opts) {
     const armed = new Set();
+    // Set once a failure proves that retrying cannot help; see isTerminal.
+    let terminal = null;
+    // Silence window after a person declined or ignored one; see APPROVAL_COOLDOWN_MS.
+    const cooldownMs = opts.approvalCooldownMs ?? APPROVAL_COOLDOWN_MS;
+    let quietUntil = 0;
+    // One outstanding approval at a time; see the note above isApprovalOutcome.
+    let awaitingApproval = false;
+    // The hosted form the cardholder already submitted; see HOSTED_FORM_REPEAT_QUIET_MS.
+    const repeatQuietMs = opts.hostedFormRepeatQuietMs ?? HOSTED_FORM_REPEAT_QUIET_MS;
+    let lastSubmitted = null;
+    const derived = typeof opts.vault?.cardUrlPatterns === 'function' ? opts.vault.cardUrlPatterns() : [];
+    const urlPatterns = derived.length > 0 ? derived : FALLBACK_CARD_PATTERNS;
+    opts.onEvent?.({ type: 'fetch_armed', detail: { patterns: urlPatterns } });
     const arm = async (sessionId) => {
         const key = sessionId ?? '__root__';
         if (armed.has(key))
             return;
         armed.add(key);
         await cdp.send('Fetch.enable', {
-            patterns: CARD_PATTERNS.map((urlPattern) => ({ urlPattern, requestStage: 'Request' })),
+            patterns: urlPatterns.map((urlPattern) => ({ urlPattern, requestStage: 'Request' })),
         }, sessionId).catch(() => { });
         // Descend into this target's own children (iframes inside iframes).
         await cdp.send('Target.setAutoAttach', {
@@ -39,36 +325,111 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
         }
         if (method !== 'Fetch.requestPaused')
             return;
-        const { requestId, request } = params;
+        const { requestId, request, resourceType } = params;
         if (!opts.vault.isCardRequest(request.url, request.method)) {
             await cdp.send('Fetch.continueRequest', { requestId }, sessionId).catch(() => { });
             return;
         }
-        let body = request.postData ?? '';
-        if (!body && request.hasPostData) {
-            body = (await cdp.send('Fetch.getRequestPostData', { requestId }, sessionId).catch(() => ({ postData: '' }))).postData ?? '';
+        // Same stop condition as the Playwright adapter: once a failure proves
+        // retrying is pointless, fail the request without calling the API again.
+        if (terminal || awaitingApproval || Date.now() < quietUntil) {
+            const why = terminal ?? (awaitingApproval ? 'an approval is already outstanding' : 'awaiting approval cooldown');
+            opts.onEvent?.({ type: 'blocked', detail: String(why) });
+            await cdp.send('Fetch.failRequest', { requestId, errorReason: 'Aborted' }, sessionId).catch(() => { });
+            return;
         }
-        opts.onEvent?.({ type: 'card_request_paused', detail: { url: request.url } });
+        // Reserve BEFORE the first await (the authorize call below yields), so two
+        // requests can never both clear the check above and raise two prompts for
+        // one checkout.
+        awaitingApproval = true;
         try {
+            const body = pausedBody(request);
+            if (body === null) {
+                // Fail closed, but only THIS request: an unreadable body says nothing
+                // about the page's configuration, so the next request is judged
+                // afresh (no latch, no cooldown).
+                opts.onEvent?.({ type: 'failed', detail: BODY_UNREADABLE_REASON });
+                await cdp.send('Fetch.failRequest', { requestId, errorReason: 'Aborted' }, sessionId).catch(() => { });
+                return;
+            }
+            // The body is needed to tell a re-post of the form the cardholder
+            // already submitted from a new one, so this check sits after the read
+            // and before any API call: no second prompt, no round trip.
+            if (isRepeatOfSubmitted(lastSubmitted, request.url, body, repeatQuietMs)) {
+                opts.onEvent?.({ type: 'blocked', detail: HOSTED_FORM_REPEAT_REASON });
+                await cdp.send('Fetch.failRequest', { requestId, errorReason: 'Aborted' }, sessionId).catch(() => { });
+                return;
+            }
+            opts.onEvent?.({ type: 'card_request_paused', detail: { url: redactUrl(request.url), ...(resourceType ? { resourceType } : {}) } });
             const replay = await opts.vault.authorize({
                 user: opts.user,
                 merchant: opts.merchant,
                 amount: opts.amount,
+                amountCents: opts.amountCents,
+                currency: opts.currency,
                 onApprovalUrl: opts.onApprovalUrl,
                 request: { url: request.url, method: request.method, headers: request.headers, body },
             });
-            await cdp.send('Fetch.fulfillRequest', {
-                requestId,
-                responseCode: replay.status,
-                responseHeaders: Object.entries(replay.headers).map(([name, value]) => ({ name, value: String(value) })),
-                body: Buffer.from(replay.body).toString('base64'),
-            }, sessionId);
-            opts.onEvent?.({ type: 'authorized' });
+            if (replay.mode === 'hosted_form') {
+                // The device submitted the processor's own form; the processor
+                // answered the device. The paused NAVIGATION is fulfilled with a page
+                // that says exactly that (see hosted-form.ts for why not an abort and
+                // why not a fake result page), and the same form is refused if the
+                // page posts it again.
+                const page = hostedFormSubmittedPage({ authorizationId: replay.authorizationId, merchant: opts.merchant, submittedAt: replay.submittedAt });
+                // A navigation response is never CORS-checked, so the CORS wrap is
+                // inert here; it is applied so every fulfill goes through one path.
+                await cdp.send('Fetch.fulfillRequest', {
+                    requestId,
+                    responseCode: page.status,
+                    responseHeaders: headerEntries(withCorsHeaders(page.headers, corsHeadersFor(request.url, request.headers))),
+                    body: Buffer.from(page.body).toString('base64'),
+                }, sessionId);
+                lastSubmitted = { url: request.url, body, at: Date.now() };
+                // Named for what it is: a device-attested submission with no
+                // processor evidence, never an `authorized` event.
+                opts.onEvent?.({ type: 'submitted_on_device', detail: { authorizationId: replay.authorizationId, submittedAt: replay.submittedAt, outcome: replay.outcome } });
+            }
+            else if (replay.mode === 'cse') {
+                // The device encrypted the card for the processor; the request itself
+                // still goes out from THIS browser, with its own session, risk data
+                // and cookies, and only the four ciphertext fields swapped in. Only
+                // postData rides on the command: no header override, ever (see
+                // cseBody for why a recomputed Content-Length is refused by Chromium).
+                await cdp.send('Fetch.continueRequest', {
+                    requestId,
+                    postData: Buffer.from(cseBody(body, replay)).toString('base64'),
+                }, sessionId);
+                opts.onEvent?.({ type: 'authorized', detail: { mode: 'cse', authorizationId: replay.authorizationId, fields: Object.keys(replay.substitutions.fields) } });
+            }
+            else {
+                // The processor's answer, handed to the page as if the processor had
+                // sent it. Cross-origin, the browser then runs its CORS check on it:
+                // see corsHeadersFor for why the answer has to carry the headers. The
+                // decision rides on the event, so a fulfill the page could not read
+                // (no usable Origin on a cross-origin request) is visible in telemetry
+                // rather than only as the page's own "connection error".
+                const cors = corsDecision(request.url, request.headers);
+                await cdp.send('Fetch.fulfillRequest', {
+                    requestId,
+                    responseCode: replay.status,
+                    responseHeaders: headerEntries(withCorsHeaders(replay.headers, cors.headers)),
+                    body: Buffer.from(replay.body).toString('base64'),
+                }, sessionId);
+                opts.onEvent?.({ type: 'authorized', detail: { mode: 'token', authorizationId: replay.authorizationId, amountVerified: replay.amountVerified ?? null, cors: cors.outcome } });
+            }
         }
         catch (err) {
+            if (isTerminal(err))
+                terminal = err;
+            else if (isApprovalOutcome(err))
+                quietUntil = Date.now() + cooldownMs;
             opts.onEvent?.({ type: 'failed', detail: String(err) });
             await cdp.send('Fetch.failRequest', { requestId, errorReason: 'Aborted' }, sessionId).catch(() => { });
         }
+        finally {
+            awaitingApproval = false;
+        }
     });
     await arm(pageSessionId);
 }
@@ -95,6 +456,17 @@ export async function attachToPlaywright(page, opts) {
     //
     // page.route already spans subframes, so Playwright does the target
     // bookkeeping that attachToCdp has to do by hand for a raw connection.
+    // Set once a failure proves that retrying cannot help. The page is free to
+    // keep retrying; we simply stop asking the API and fail the request outright.
+    let terminal = null;
+    // Silence window after a person declined or ignored one; see APPROVAL_COOLDOWN_MS.
+    const cooldownMs = opts.approvalCooldownMs ?? APPROVAL_COOLDOWN_MS;
+    let quietUntil = 0;
+    // One outstanding approval at a time; see the note above isApprovalOutcome.
+    let awaitingApproval = false;
+    // The hosted form the cardholder already submitted; see HOSTED_FORM_REPEAT_QUIET_MS.
+    const repeatQuietMs = opts.hostedFormRepeatQuietMs ?? HOSTED_FORM_REPEAT_QUIET_MS;
+    let lastSubmitted = null;
     await page.route((url) => opts.vault.isCardRequest(url.toString()), async (route) => {
         const request = route.request();
         // The matcher only sees the URL; a preflight or a GET must pass through
@@ -102,22 +474,69 @@ export async function attachToPlaywright(page, opts) {
         if (!opts.vault.isCardRequest(request.url(), request.method())) {
             return route.fallback();
         }
-        const body = request.postData() ?? '';
-        opts.onEvent?.({ type: 'card_request_paused', detail: { url: request.url() } });
+        // Fail closed and stay quiet: no card may reach the PSP, but neither may
+        // the page's retry loop turn into a stream of doomed API calls. Every
+        // abort in this adapter is 'aborted' (ERR_ABORTED), the same code the
+        // CDP adapter's Fetch.failRequest uses, so a refused navigation
+        // resolves identically whichever adapter is attached.
+        if (terminal || awaitingApproval || Date.now() < quietUntil) {
+            const why = terminal ?? (awaitingApproval ? 'an approval is already outstanding' : 'awaiting approval cooldown');
+            opts.onEvent?.({ type: 'blocked', detail: String(why) });
+            return route.abort('aborted');
+        }
+        // Reserved before anything that could yield, matching attachToCdp.
+        awaitingApproval = true;
         try {
+            const body = request.postData() ?? '';
+            if (isRepeatOfSubmitted(lastSubmitted, request.url(), body, repeatQuietMs)) {
+                opts.onEvent?.({ type: 'blocked', detail: HOSTED_FORM_REPEAT_REASON });
+                return await route.abort('aborted');
+            }
+            opts.onEvent?.({ type: 'card_request_paused', detail: { url: redactUrl(request.url()) } });
             const replay = await opts.vault.authorize({
                 user: opts.user,
                 merchant: opts.merchant,
                 amount: opts.amount,
+                amountCents: opts.amountCents,
+                currency: opts.currency,
                 onApprovalUrl: opts.onApprovalUrl,
                 request: { url: request.url(), method: request.method(), headers: request.headers(), body },
             });
-            await route.fulfill({ status: replay.status, headers: replay.headers, body: replay.body });
-            opts.onEvent?.({ type: 'authorized' });
+            if (replay.mode === 'hosted_form') {
+                // Same as the CDP path: the paused navigation resolves to the
+                // synthetic page, and a re-post of this form is refused.
+                const synthetic = hostedFormSubmittedPage({ authorizationId: replay.authorizationId, merchant: opts.merchant, submittedAt: replay.submittedAt });
+                // Inert on a navigation (never CORS-checked); one path for every fulfill.
+                await route.fulfill({ status: synthetic.status, headers: withCorsHeaders(synthetic.headers, corsHeadersFor(request.url(), request.headers())), body: synthetic.body });
+                lastSubmitted = { url: request.url(), body, at: Date.now() };
+                opts.onEvent?.({ type: 'submitted_on_device', detail: { authorizationId: replay.authorizationId, submittedAt: replay.submittedAt, outcome: replay.outcome } });
+            }
+            else if (replay.mode === 'cse') {
+                // Same as the CDP path: the request continues from this browser
+                // with the ciphertext swapped in and no header override; Playwright
+                // recomputes the length itself.
+                await route.continue({ postData: cseBody(body, replay) });
+                opts.onEvent?.({ type: 'authorized', detail: { mode: 'cse', authorizationId: replay.authorizationId, fields: Object.keys(replay.substitutions.fields) } });
+            }
+            else {
+                // Playwright adds these itself when a cross-origin fulfill carries
+                // none; written here anyway (replacing a stale value) so a
+                // cross-origin answer is the same whichever adapter ran.
+                const cors = corsDecision(request.url(), request.headers());
+                await route.fulfill({ status: replay.status, headers: withCorsHeaders(replay.headers, cors.headers), body: replay.body });
+                opts.onEvent?.({ type: 'authorized', detail: { mode: 'token', authorizationId: replay.authorizationId, amountVerified: replay.amountVerified ?? null, cors: cors.outcome } });
+            }
         }
         catch (err) {
+            if (isTerminal(err))
+                terminal = err;
+            else if (isApprovalOutcome(err))
+                quietUntil = Date.now() + cooldownMs;
             opts.onEvent?.({ type: 'failed', detail: String(err) });
-            await route.abort();
+            await route.abort('aborted');
+        }
+        finally {
+            awaitingApproval = false;
         }
     });
 }