@agent-cards/checkout 0.11.0 → 0.13.0

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: 2f7e340ba22bc33539f11e384a3e8362ae3fa510a9f8b540783c02bebcbc1ebf
+// artifact-sha256: edd2d9de25c51bf0f4ebdbe729366e6d94b9a045b054a0910571e0565bd3cae0
 // src/definitions.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -527,19 +527,49 @@ var STRIPE_CHECKOUT_CONTEXT_HEADER = "x-agentcard-stripe-checkout-context";
 var SESSION = /^cs_(?:test|live)_[A-Za-z0-9]{1,200}(?![\s\S])/;
 var KEY = /^pk_(?:test|live)_[A-Za-z0-9_]{1,256}(?![\s\S])/;
 var SYNTHETIC = /^pm_agentcard_checkout_[A-Za-z0-9_-]{16,80}(?![\s\S])/;
-var reject = () => {
-    throw new Error("stripe_checkout_rejected");
+var STRIPE_CHECKOUT_VALIDATION_CODES = Object.freeze({
+    unclassified: "unclassified",
+    request_shape: "request_shape",
+    request_body_bounds: "request_body_bounds",
+    request_headers: "request_headers",
+    form_encoding: "form_encoding",
+    form_field_unknown: "form_field_unknown",
+    form_field_duplicate: "form_field_duplicate",
+    form_value_bounds: "form_value_bounds",
+    context_invalid: "context_invalid",
+    session_binding: "session_binding",
+    publishable_key: "publishable_key",
+    mode_binding: "mode_binding",
+    attribution_session: "attribution_session",
+    tokenization_fields: "tokenization_fields",
+    billing_email: "billing_email",
+    billing_binding: "billing_binding",
+    billing_conflict: "billing_conflict",
+    expected_amount: "expected_amount",
+    payment_method_type: "payment_method_type",
+    synthetic_payment_method: "synthetic_payment_method",
+    required_final_fields: "required_final_fields"
+});
+var validationCodes = /* @__PURE__ */ new WeakMap();
+var reject = (code = "unclassified") => {
+    const error = new Error("stripe_checkout_rejected");
+    validationCodes.set(error, code);
+    throw error;
 };
+function stripeCheckoutValidationCode(error) {
+    const code = validationCodes.get(error);
+    return Object.values(STRIPE_CHECKOUT_VALIDATION_CODES).find((value) => value === code) ?? STRIPE_CHECKOUT_VALIDATION_CODES.unclassified;
+}
 var object = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var opaque = (value) => typeof value === "string" && value.length <= 8192 && !/[\x00-\x1f\x7f]/.test(value);
 var alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
 function validateStripeCheckoutIdentity(value) {
     if (!object(value) || !["test", "production"].includes(value.environment ?? "test") || value.environment === null || !["sessionId", "publishableKey", "livemode"].some((key) => Object.hasOwn(value, key)))
-        reject();
+        reject("mode_binding");
     const environment = value.environment ?? "test", livemode = environment === "production";
     const mode = livemode ? "live" : "test";
     if (Object.hasOwn(value, "sessionId") && (typeof value.sessionId !== "string" || !SESSION.test(value.sessionId) || !value.sessionId.startsWith(`cs_${mode}_`)) || Object.hasOwn(value, "publishableKey") && (typeof value.publishableKey !== "string" || !KEY.test(value.publishableKey) || !value.publishableKey.startsWith(`pk_${mode}_`)) || Object.hasOwn(value, "livemode") && value.livemode !== livemode)
-        reject();
+        reject("mode_binding");
     return Object.freeze({ environment, livemode });
 }
 var TEST_CARDS = ["4242424242424242", "4000000000000002", "4000002500003155"];
@@ -587,7 +617,7 @@ function encodeAscii(value) {
 }
 function context(value) {
     if (!object(value) || Object.keys(value).length !== 3 || value.version !== 1 || !["version", "session_id", "synthetic_payment_method_id"].every((key) => Object.hasOwn(value, key)) || !SESSION.test(value.session_id) || !SYNTHETIC.test(value.synthetic_payment_method_id))
-        reject();
+        reject("context_invalid");
     return { version: 1, session_id: value.session_id, synthetic_payment_method_id: value.synthetic_payment_method_id };
 }
 function encodeStripeCheckoutContext(value) {
@@ -601,7 +631,7 @@ function parseStripeCheckoutContext(request) {
     if (!entries.length)
         return null;
     if (entries.length !== 1 || typeof entries[0][1] !== "string" || !/^[A-Za-z0-9_-]{1,1024}$/.test(entries[0][1]))
-        reject();
+        reject("context_invalid");
     const encoded = entries[0][1];
     let text = "", bits = 0, count = 0;
     for (const char of encoded) {
@@ -617,10 +647,10 @@ function parseStripeCheckoutContext(request) {
         value = context(JSON.parse(text));
     }
     catch {
-        reject();
+        reject("context_invalid");
     }
     if (encodeStripeCheckoutContext(value) !== encoded)
-        reject();
+        reject("context_invalid");
     return value;
 }
 function endpoint(raw) {
@@ -657,6 +687,9 @@ var finalFields = /* @__PURE__ */ new Set([
     "sid",
     "passive_captcha_token",
     "passive_captcha_ekey",
+    "pxcts",
+    "pxvid",
+    "px3",
     ...[
         "checkout_config_id",
         "checkout_session_id",
@@ -696,24 +729,32 @@ var tokenFields = /* @__PURE__ */ new Set([
     ].map((key) => `client_attribution_metadata[${key}]`)
 ]);
 function form(request, fields) {
-    if (!object(request) || request.method !== "POST" || typeof request.body !== "string" || request.body.length > 2e4 || !object(request.headers) || Object.keys(request.headers).length > 40 || Object.values(request.headers).some((value) => !opaque(value)))
-        reject();
+    if (!object(request) || request.method !== "POST" || typeof request.body !== "string")
+        reject("request_shape");
+    if (request.body.length > 2e4)
+        reject("request_body_bounds");
+    if (!object(request.headers) || Object.keys(request.headers).length > 40 || Object.values(request.headers).some((value) => !opaque(value)))
+        reject("request_headers");
     const pairs = [];
     const seen = /* @__PURE__ */ new Set();
     for (const raw of request.body.split("&")) {
         const index = raw.indexOf("=");
         if (index < 1)
-            reject();
+            reject("form_encoding");
         let key, value;
         try {
             key = decodeURIComponent(raw.slice(0, index).replace(/\+/g, " "));
             value = decodeURIComponent(raw.slice(index + 1).replace(/\+/g, " "));
         }
         catch {
-            reject();
+            reject("form_encoding");
         }
-        if (!fields.has(key) || seen.has(key) || !opaque(value))
-            reject();
+        if (!fields.has(key))
+            reject("form_field_unknown");
+        if (seen.has(key))
+            reject("form_field_duplicate");
+        if (!opaque(value))
+            reject("form_value_bounds");
         seen.add(key);
         pairs.push({ key, value, raw });
     }
@@ -722,27 +763,27 @@ function form(request, fields) {
 function keyFor(request, values, expected) {
     const authorization = Object.entries(request.headers).filter(([key2]) => key2.toLowerCase() === "authorization");
     if (authorization.length > 1)
-        reject();
+        reject("publishable_key");
     let headerKey;
     if (authorization.length) {
         const match = /^Bearer (pk_(?:test|live)_[A-Za-z0-9_]{1,256})$/.exec(authorization[0][1]);
         if (!match)
-            reject();
+            reject("publishable_key");
         headerKey = match[1];
     }
     const key = values.get("key") || headerKey;
     if (!KEY.test(key) || headerKey && headerKey !== key || expected !== void 0 && expected !== key)
-        reject();
+        reject("publishable_key");
     return key;
 }
 var billingEmail = (value) => value === null || typeof value === "string" && value.length > 0 && value.length <= 320 && opaque(value);
 function captureStripeCheckoutBilling(request, options) {
     const phase = classifyStripeCheckoutRequest(request, options);
     if (phase?.phase !== "tokenization" || !SYNTHETIC.test(options?.syntheticPaymentMethodId))
-        reject();
+        reject("billing_binding");
     const email = form(request, tokenFields).values.get("billing_details[email]") ?? null;
     if (!billingEmail(email))
-        reject();
+        reject("billing_email");
     return Object.freeze({
         session_id: phase.session_id,
         synthetic_payment_method_id: options.syntheticPaymentMethodId,
@@ -752,11 +793,11 @@ function captureStripeCheckoutBilling(request, options) {
 function attachStripeCheckoutBilling(request, captured, options) {
     const phase = classifyStripeCheckoutRequest(request, options);
     if (phase?.phase !== "final" || !object(captured) || Object.keys(captured).length !== 3 || !["session_id", "synthetic_payment_method_id", "email"].every((key) => Object.hasOwn(captured, key)) || captured.session_id !== phase.session_id || captured.synthetic_payment_method_id !== phase.synthetic_payment_method_id || !billingEmail(captured.email))
-        reject();
+        reject("billing_binding");
     const field = "payment_method_data[billing_details][email]";
     const existing = form(request, finalFields).values.get(field);
     if (existing !== void 0 && existing !== captured.email)
-        reject();
+        reject("billing_conflict");
     if (captured.email === null || existing !== void 0)
         return { ...request };
     const body = `${request.body}&${encodeURIComponent(field)}=${encodeURIComponent(captured.email)}`;
@@ -768,14 +809,14 @@ function classifyStripeCheckoutRequest(request, options = {}) {
     const url = endpoint(request?.url);
     if (!url) {
         if (hasStripeCheckoutMarker(request))
-            reject();
+            reject("context_invalid");
         return null;
     }
     const final = isStripeCheckoutEndpoint(request.url);
     const token = url.pathname === "/v1/payment_methods";
     if (!final && !token) {
         if (hasStripeCheckoutMarker(request))
-            reject();
+            reject("context_invalid");
         return null;
     }
     if (token && options.sessionId === void 0 && !hasStripeCheckoutMarker(request))
@@ -783,26 +824,34 @@ function classifyStripeCheckoutRequest(request, options = {}) {
     const marker = parseStripeCheckoutContext(request);
     const sessionId = final ? url.pathname.split("/")[3] : options.sessionId;
     if (!SESSION.test(sessionId) || options.sessionId !== void 0 && options.sessionId !== sessionId || marker && marker.session_id !== sessionId)
-        reject();
+        reject("session_binding");
     const { values } = form(request, final ? finalFields : tokenFields);
     const key = keyFor(request, values, options.publishableKey);
     validateStripeCheckoutIdentity({ environment: options.environment, sessionId, publishableKey: key });
     const attributionSession = values.get("client_attribution_metadata[checkout_session_id]");
     if (attributionSession !== void 0 && attributionSession !== sessionId)
-        reject();
+        reject("attribution_session");
     if (token) {
         const number = values.get("card[number]");
         if (values.get("type") !== "card" || typeof number !== "string" || number.length > 64 || /[^0-9 -]/.test(number) || !["4111111111111111", "4242424242424242"].includes(number.replace(/[ -]/g, "")) || !/^\d{3}$/.test(values.get("card[cvc]") ?? "") || !/^(?:0?[1-9]|1[0-2])$/.test(values.get("card[exp_month]") ?? "") || !/^(?:\d{2}|\d{4})$/.test(values.get("card[exp_year]") ?? "") || values.has("allow_redisplay") && values.get("allow_redisplay") !== "unspecified")
-            reject();
+            reject("tokenization_fields");
         return { phase: "tokenization", session_id: sessionId, publishable_key: key };
     }
     const amount = values.get("expected_amount");
     const syntheticId = values.get("payment_method");
     const email = values.get("payment_method_data[billing_details][email]");
     if (email !== void 0 && !billingEmail(email))
-        reject();
-    if (!/^[1-9]\d{0,11}$/.test(amount ?? "") || !Number.isSafeInteger(Number(amount)) || options.amountCents !== void 0 && options.amountCents !== Number(amount) || values.get("expected_payment_method_type") !== "card" || !SYNTHETIC.test(syntheticId) || ["init_checksum", "js_checksum", "version", "rv_timestamp"].some((key2) => !values.get(key2)) || options.syntheticPaymentMethodId !== void 0 && options.syntheticPaymentMethodId !== syntheticId || marker && marker.synthetic_payment_method_id !== syntheticId)
-        reject();
+        reject("billing_email");
+    if (!/^[1-9]\d{0,11}$/.test(amount ?? "") || !Number.isSafeInteger(Number(amount)) || options.amountCents !== void 0 && options.amountCents !== Number(amount))
+        reject("expected_amount");
+    if (values.get("expected_payment_method_type") !== "card")
+        reject("payment_method_type");
+    if (!SYNTHETIC.test(syntheticId))
+        reject("synthetic_payment_method");
+    if (["init_checksum", "js_checksum", "version", "rv_timestamp"].some((key2) => !values.get(key2)))
+        reject("required_final_fields");
+    if (options.syntheticPaymentMethodId !== void 0 && options.syntheticPaymentMethodId !== syntheticId || marker && marker.synthetic_payment_method_id !== syntheticId)
+        reject("synthetic_payment_method");
     return {
         phase: "final",
         session_id: sessionId,
@@ -912,4 +961,4 @@ function prepareStripeCheckoutReplay(request, card, options = {}) {
         where: Object.keys(replacements)
     };
 }
-export { STRIPE_CHECKOUT_CONTEXT_HEADER, STRIPE_CHECKOUT_OPERATION, attachStripeCheckoutBilling, captureStripeCheckoutBilling, classifyStripeCheckoutRequest, createStripeCheckoutTokenizationStub, encodeStripeCheckoutContext, hasStripeCheckoutMarker, isStripeCheckoutEndpoint, isStripeCheckoutHostedMode, parseStripeCheckoutContext, parseStripeCheckoutResponse, prepareStripeCheckoutReplay, validateStripeCheckoutCard, validateStripeCheckoutIdentity };
+export { STRIPE_CHECKOUT_CONTEXT_HEADER, STRIPE_CHECKOUT_OPERATION, STRIPE_CHECKOUT_VALIDATION_CODES, attachStripeCheckoutBilling, captureStripeCheckoutBilling, classifyStripeCheckoutRequest, createStripeCheckoutTokenizationStub, encodeStripeCheckoutContext, hasStripeCheckoutMarker, isStripeCheckoutEndpoint, isStripeCheckoutHostedMode, parseStripeCheckoutContext, parseStripeCheckoutResponse, prepareStripeCheckoutReplay, stripeCheckoutValidationCode, validateStripeCheckoutCard, validateStripeCheckoutIdentity };

package/dist/stripe-checkout.js

@@ -1,13 +1,15 @@
-import { classifyStripeCheckoutRequest, createStripeCheckoutTokenizationStub, encodeStripeCheckoutContext, isStripeCheckoutEndpoint, STRIPE_CHECKOUT_CONTEXT_HEADER, captureStripeCheckoutBilling, attachStripeCheckoutBilling, validateStripeCheckoutIdentity, } from './stripe-checkout.generated.js';
+import { classifyStripeCheckoutRequest, createStripeCheckoutTokenizationStub, encodeStripeCheckoutContext, isStripeCheckoutEndpoint, STRIPE_CHECKOUT_CONTEXT_HEADER, captureStripeCheckoutBilling, attachStripeCheckoutBilling, validateStripeCheckoutIdentity, stripeCheckoutValidationCode, STRIPE_CHECKOUT_VALIDATION_CODES, } from './stripe-checkout.generated.js';
 class StripeCheckoutRejectionError extends Error {
     stage;
     reason;
     phase;
-    constructor(message, stage, reason, phase) {
+    validationCode;
+    constructor(message, stage, reason, phase, validationCode) {
         super(message);
         this.stage = stage;
         this.reason = reason;
         this.phase = phase;
+        this.validationCode = validationCode;
     }
 }
 export function stripeCheckoutReadinessError(reason) {
@@ -59,8 +61,10 @@ export class StripeCheckoutGate {
             readiness: 'readiness_unavailable', document: 'document_unavailable', stub_response: 'stub_response_failed',
         };
         const rejection = error instanceof StripeCheckoutRejectionError ? error : undefined;
+        const reason = rejection?.reason ?? fallback[stage];
         return { version: 1, processor: 'stripe', endpoint_family: family,
-            phase: rejection?.phase ?? phase, stage: rejection?.stage ?? stage, reason: rejection?.reason ?? fallback[stage],
+            phase: rejection?.phase ?? phase, stage: rejection?.stage ?? stage, reason,
+            ...(reason === 'request_validation_failed' ? { validation_code: rejection?.validationCode ?? STRIPE_CHECKOUT_VALIDATION_CODES.unclassified } : {}),
             gate_state: this.state, disposition: error instanceof StripeCheckoutClaimConflictError ? 'active_claim_preserved' : 'checkout_stopped' };
     }
     assertClaim(step) {
@@ -73,7 +77,7 @@ export class StripeCheckoutGate {
             return;
         const url = new URL(raw);
         if (url.origin !== 'https://checkout.stripe.com' || url.username || url.password
-            || ![`/c/pay/${this.binding.sessionId}`, `/pay/${this.binding.sessionId}`].includes(url.pathname)) {
+            || ![`/c/pay/${this.binding.sessionId}`, `/pay/${this.binding.sessionId}`, `/g/pay/${this.binding.sessionId}`, `/f/pay/${this.binding.sessionId}`].includes(url.pathname)) {
             this.invalidate();
             throw new StripeCheckoutRejectionError('Native Stripe Checkout document changed.', 'document', 'document_changed');
         }
@@ -87,8 +91,8 @@ export class StripeCheckoutGate {
         try {
             phase = classifyStripeCheckoutRequest(request, this.binding);
         }
-        catch {
-            throw new StripeCheckoutRejectionError('stripe_checkout_rejected', 'classification', 'request_validation_failed', 'unknown');
+        catch (error) {
+            throw new StripeCheckoutRejectionError('stripe_checkout_rejected', 'classification', 'request_validation_failed', 'unknown', stripeCheckoutValidationCode(error));
         }
         if (!phase)
             return null;
@@ -106,7 +110,10 @@ export class StripeCheckoutGate {
                 this.billing = captureStripeCheckoutBilling(request, this.binding);
                 response = createStripeCheckoutTokenizationStub(request, this.binding);
             }
-            catch {
+            catch (error) {
+                const code = stripeCheckoutValidationCode(error);
+                if (code !== STRIPE_CHECKOUT_VALIDATION_CODES.unclassified)
+                    throw new StripeCheckoutRejectionError('stripe_checkout_rejected', 'classification', 'request_validation_failed', 'tokenization', code);
                 throw new StripeCheckoutRejectionError('stripe_checkout_rejected', 'stub_response', 'stub_response_failed', 'tokenization');
             }
             this.state = 'stubbed';
@@ -120,9 +127,9 @@ export class StripeCheckoutGate {
         try {
             final = attachStripeCheckoutBilling(request, this.billing, this.binding);
         }
-        catch {
+        catch (error) {
             this.invalidate();
-            throw new StripeCheckoutRejectionError('stripe_checkout_rejected', 'classification', 'request_validation_failed', 'final');
+            throw new StripeCheckoutRejectionError('stripe_checkout_rejected', 'classification', 'request_validation_failed', 'final', stripeCheckoutValidationCode(error));
         }
         this.state = 'submitted';
         this.billing = undefined;

package/examples/preflight/kernel-native/inventory.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
-  "catalog_version": "2026-09-14.1",
-  "catalog_sha256": "c5bf9f8f7372def80d2abf0e9f2942c1b33514ed516b66d3f60e98c11d43bf5c",
+  "catalog_version": "2026-09-15.1",
+  "catalog_sha256": "34877ca68622f17b3e10963b17e6888bf15d8268015d1ae16def4ca5fbef73fd",
   "baseline_version": "kernel-native-docs-2026-09-11.1",
   "baseline_sha256": "d86722f49633d8223fccae54cd3d485df4375aee06aa156a273cc689b7c8507c",
   "native_build": null,

package/examples/preflight/kernel-profile.empty.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "profile_version": "kernel-template-1",
-  "catalog_version": "2026-09-14.1",
+  "catalog_version": "2026-09-15.1",
   "integration": {
     "id": "kernel_native",
     "version": "example-native-adapter"

package/examples/preflight/mollie-hosted.result.json

@@ -1,7 +1,7 @@
 {
   "snapshot": {
     "schema_version": 1,
-    "catalog_version": "2026-09-14.1",
+    "catalog_version": "2026-09-15.1",
     "signals": [
       {
         "rule_id": "mollie-hosted-credit-card",
@@ -33,7 +33,7 @@
   },
   "result": {
     "schema_version": 1,
-    "catalog_version": "2026-09-14.1",
+    "catalog_version": "2026-09-15.1",
     "integration": {
       "id": "kernel_native",
       "version": "example-native-adapter"

package/examples/preflight/stripe-script.direct.result.json

@@ -1,7 +1,7 @@
 {
   "snapshot": {
     "schema_version": 1,
-    "catalog_version": "2026-09-14.1",
+    "catalog_version": "2026-09-15.1",
     "signals": [
       {
         "rule_id": "stripe-js-v3",
@@ -26,7 +26,7 @@
   },
   "result": {
     "schema_version": 1,
-    "catalog_version": "2026-09-14.1",
+    "catalog_version": "2026-09-15.1",
     "integration": {
       "id": "direct_sdk",
       "version": "bundled"

package/examples/preflight/stripe-script.result.json

@@ -1,7 +1,7 @@
 {
   "snapshot": {
     "schema_version": 1,
-    "catalog_version": "2026-09-14.1",
+    "catalog_version": "2026-09-15.1",
     "signals": [
       {
         "rule_id": "stripe-js-v3",
@@ -26,7 +26,7 @@
   },
   "result": {
     "schema_version": 1,
-    "catalog_version": "2026-09-14.1",
+    "catalog_version": "2026-09-15.1",
     "integration": {
       "id": "kernel_native",
       "version": "example-native-adapter"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/checkout",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "Let browser agents pay with the user's own card, without your infrastructure ever touching card data.",
   "type": "module",
   "main": "dist/index.js",
@@ -27,7 +27,7 @@
     "_comment_build": "The public SDK keeps zero runtime dependencies. Its build vendors deterministic metadata and substitution artifacts from the internal payment core; TypeScript remains pinned.",
     "build": "node ../payment-core/scripts/build.mjs && node scripts/generate-payment-core.mjs && npx -y -p typescript@5.9.3 tsc && node scripts/generate-preflight-contract.mjs",
     "prepublishOnly": "pnpm build",
-    "test": "node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs autopilot.test.mjs stripe-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs minimum-delay.test.mjs paysafe.test.mjs attachment.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs && node --test kernel-native-qualification.test.mjs",
+    "test": "node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs autopilot.test.mjs stripe-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs minimum-delay.test.mjs paysafe.test.mjs attachment.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs",
     "test:browser": "node browser.test.mjs && node stripe-browser.test.mjs && node preparation-browser.test.mjs && node owned-shop-browser.test.mjs",
     "check:payment-core": "node scripts/generate-payment-core.mjs --check",
     "test:preflight": "node --test preflight-package.test.mjs preflight-collector.test.mjs kernel-native-qualification.test.mjs",