@agent-cards/checkout 0.19.0 → 0.22.0

package/dist/cdp.js

@@ -1,2393 +0,0 @@
-import { BUILTIN_REGISTRY, cardUrlPatterns } from './registry.js';
-import { AdyenTestPlatformRefusedError, ApprovalDeclinedError, ApprovalTimeoutError, CardEncryptedError, CheckoutApiError, MerchantTotalError, PaymentOutcomeUnknownError, PreparationRequiredError, ProcessorRefusedError, UnsupportedModeError, } from './client.js';
-import { PreparationGate } from './preparation.js';
-import { StripeCheckoutGate } from './stripe-checkout.js';
-import { MercadoCheckoutGate } from './mercado-checkout.js';
-import { MERCADO_CHECKOUT_PATTERN } from './mercado-checkout.generated.js';
-import { dispatchPreClaim, eventUrl } from './pre-claim.js';
-import { CheckoutAttachmentError, attachmentDeadline, attachmentFailure, withinAttachmentDeadline } from './attachment.js';
-import { cseBody } from './cse-body.js';
-import { replayTemplatedUrl, reviewedMerchantProfileUrlPatterns } from './merchant-hosted.js';
-import { MerchantHandoffWatch } from './merchant-handoff.js';
-import { MERCHANT_PAGE_WAIT_MS, MerchantTotalWatch } from './merchant-total-watch.js';
-import { hostedFormSubmittedPage } from './hosted-form.js';
-import { CheckoutLifecycle, paymentEndpointGuards } from './lifecycle.js';
-// Every URL that leaves this module through onEvent is redacted to origin +
-// path first. A paused PaymentIntent confirm can carry the client secret in
-// its query string (Stripe.js puts it in the body; hand-rolled runtimes and
-// some SDKs put it in the URL), and onEvent is ordinary integrator telemetry:
-// logs, dashboards, crash reporters. None of those may receive a secret.
-/**
- * How long a hosted form that the cardholder already submitted stays refused
- * when the page posts it again.
- *
- * A hosted_form approval resolves the paused navigation with a synthetic page
- * (hostedFormSubmittedPage), and the merchant page may still carry the same
- * card form: an agent that clicks Pay again would pause an identical
- * navigation and, without this, raise a second prompt on the household's
- * device for a payment that already left it. The API's duplicate guard covers
- * a body the form regenerated (same supplier, session and amount inside 15
- * minutes: 409 duplicate_submission, which the adapters quiet the way they
- * quiet a decline, see isApprovalOutcome); this latch covers the
- * byte-identical re-post without a round trip. Same window as the
- * authorization's own TTL. Overridable per attach via `hostedFormRepeatQuietMs`.
- */
-const HOSTED_FORM_REPEAT_QUIET_MS = 15 * 60_000;
-/** The same form the device already submitted, posted again inside the quiet window. */
-function isRepeatOfSubmitted(last, url, body, quietMs) {
-    return !!last && last.url === url && last.body === body && Date.now() - last.at < quietMs;
-}
-const HOSTED_FORM_REPEAT_REASON = 'already submitted on the cardholder\'s device';
-function targetRecord(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value);
-}
-function contextId(value) {
-    return typeof value === 'string' && value.length > 0 && value.length <= 256 && !/[\u0000-\u0020\u007f]/.test(value);
-}
-/** Dedicated worker requests use their owning frame's Fetch interception.
- * Shared/service workers do not have that ownership guarantee. Refuse their
- * browser context, including newly discovered targets, before approving a card.
- * A different, explicitly identified context belongs to another checkout.
- */
-function assertContextTarget(target, merchantContext) {
-    if (!targetRecord(target))
-        throw new CheckoutAttachmentError('unavailable');
-    if (contextId(target.browserContextId) && target.browserContextId !== merchantContext)
-        return;
-    if (!['page', 'iframe', 'worker', 'browser_ui'].includes(target.type)
-        || (target.browserContextId !== undefined && !contextId(target.browserContextId))) {
-        throw new CheckoutAttachmentError('unavailable');
-    }
-}
-/**
- * How long to stop asking after a person declines or ignores an approval.
- *
- * This exists because the two failure shapes look identical at the route
- * handler and need opposite answers. A merchant page re-issues an aborted
- * tokenization within milliseconds, and re-prompting on each of those turns
- * one decline into a queue of notifications on someone's device. A genuinely
- * later checkout also arrives as a paused request, and that one deserves a
- * fresh prompt, so a permanent latch is wrong too.
- *
- * Elapsed time is what separates them, and nothing else available here does:
- * body, nonce and authorization id all differ between an automatic retry and a
- * new checkout. So a decline buys a short silence, not a closed door.
- *
- * Kept deliberately SHORT. A page's automatic retry lands in milliseconds — the
- * storm this exists for ran at roughly ten a second — so a few seconds absorbs
- * a burst with room to spare, while leaving almost no window in which a person
- * could start a genuinely new checkout and be turned away. Raise it only with
- * evidence of a slower retry loop; every second added is a second a real
- * checkout can be refused. Overridable per attach via `approvalCooldownMs`.
- */
-const APPROVAL_COOLDOWN_MS = 5_000;
-/**
- * One approval at a time, per attachment.
- *
- * The cooldown only arms once a failure RESOLVES, so two requests paused
- * before the first authorize() returns both sail past it and each raise their
- * own prompt. A checkout with several card iframes does exactly that. Nobody
- * should get two notifications asking them to approve the same purchase, so a
- * request arriving while one is outstanding is failed rather than queued: the
- * page's own retry brings it back, and by then there is an answer.
- */
-/**
- * This one authorization was answered; see APPROVAL_COOLDOWN_MS. An
- * AmountMismatchError is an ApprovalDeclinedError, so both amount checks land
- * here: the pre-replay one (the row IS declined) and the create-time one (no
- * row; the intent already disagreed). Either way the paused request is
- * aborted with nothing charged and the page's retry is quieted, NOT latched:
- * Stripe lets the merchant update an intent's amount until it is confirmed,
- * so the next request on this page is a new question and is judged afresh.
- * IntentNotConfirmableError lands here too (the row is declined).
- *
- * A 409 duplicate_submission is an answer of the same kind: the household
- * already has, or already answered, the prompt for this exact submission (a
- * hosted form the page posted again with a fresh nonce). Quieting the page's
- * re-post is right; latching the whole attachment is not, because the prior
- * row declines or expires and the same form is then a new question. The
- * quiet window absorbs the burst; the next request past it is judged afresh.
- */
-function isApprovalOutcome(err) {
-    // Processor refusals are held by the lifecycle until explicit merchant
-    // reconciliation and retry. A second timer would outlive that release and
-    // reject the application's deliberate retry even after confirmed failure.
-    if (err instanceof ProcessorRefusedError)
-        return false;
-    if (err instanceof CheckoutApiError)
-        return err.code === 'duplicate_submission';
-    return err instanceof ApprovalDeclinedError || err instanceof ApprovalTimeoutError;
-}
-/**
- * Should this failure stop us intercepting for the rest of the page's life?
- *
- * It matters because a failed tokenization does not end the checkout: the
- * merchant's own page retries, we pause the retry, we fail it again, and the
- * loop runs as fast as the page will go. A real run against Shopify with a
- * stale user id produced ~10 authorization calls a SECOND for fifteen minutes
- * until the agent's host killed it, every one of them a request to our API that
- * could never have succeeded.
- *
- * Terminal means "will answer identically next time no matter who does what":
- * a misconfiguration or an unsupported PSP. Nothing a person does changes
- * those, so asking again is pure waste.
- *
- * Other errors may be retryable unless the lifecycle holds the attachment
- * for merchant reconciliation, as it does after a processor refusal.
- * A 5xx or a 429 clears on its own, and a
- * decline or a timeout is answered by the cooldown above rather than by
- * killing the page: the person said no to one authorization, not to every
- * checkout they will ever make in this session. A 409 duplicate_submission
- * is not `permanent` on the error itself (see CheckoutApiError) and lands in
- * the cooldown too.
- */
-function isTerminal(err) {
-    if (err instanceof CheckoutApiError)
-        return err.permanent;
-    // Refused at create for Adyen's test platform: the page's next request is refused the same way.
-    if (err instanceof AdyenTestPlatformRefusedError)
-        return err.stage === 'create';
-    return err instanceof CardEncryptedError || err instanceof UnsupportedModeError || err instanceof PreparationRequiredError;
-}
-/**
- * cseBody, retiring a merchant-hosted approval it refuses. The refusal (a live body
- * that is not the one the API checked, a swap payment-core will not write) happens
- * before anything leaves the browser, so the approval went to no request: it is
- * retired as merchant_never_retried, the one runtime reason the API accepts on an
- * approved cse row, and the API stops serving its ciphertext. Not awaited, so the
- * page's request fails at once; a retirement that fails leaves the API's purge to
- * drop the ciphertext.
- */
-function cseContinuationBody(opts, body, replay, url, preparation) {
-    try {
-        return cseBody(body, replay, url, preparation);
-    }
-    catch (error) {
-        if (replay.kind === 'merchant_hosted' && typeof opts.vault?.cancelAuthorization === 'function') {
-            void Promise.resolve().then(() => opts.vault.cancelAuthorization(replay.authorizationId, 'merchant_never_retried')).catch(() => { });
-        }
-        throw error;
-    }
-}
-/** Chromium's own limit on the redirects one request follows. */
-const MAX_REDIRECT_HOPS = 20;
-/** The statuses a browser follows to the Location they name. */
-const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
-/**
- * Reports the merchant's answer to a continued merchant-hosted request to the
- * hand-off watch, from the page's own response and requestfailed events. They
- * arrive in the Playwright server's order, and Playwright routes a paused request
- * only once Chromium's renderer reported it, so an answer the page read before it
- * sent a retry is read here before that retry's route. request.response() is a
- * round trip that the retry's route can overtake.
- *
- * A followed redirect is answered by its last hop, as CDP reports it. Playwright
- * reports a hop's 3xx and then, in the same step, the next hop as a new request
- * (redirectedTo()), so a 3xx waits, and settle() takes it as the final answer once
- * any later event finds no next hop: the reply to that request's own response()
- * call, another network event, a retry's route, or the page closing. `answered`
- * runs once the final answer is known, after the watch has read it.
- */
-function watchPlaywrightHandoff(page, request, watch, answered) {
-    let redirect = null;
-    let done = false;
-    const final = (status) => {
-        stop();
-        watch.responded(status);
-        try {
-            answered?.();
-        }
-        catch { /* the charge report never breaks the page */ }
-    };
-    const inChain = (candidate) => {
-        for (let hop = 0; candidate && hop <= MAX_REDIRECT_HOPS; hop++) {
-            if (candidate === request)
-                return true;
-            candidate = typeof candidate.redirectedFrom === 'function' ? candidate.redirectedFrom() : null;
-        }
-        return false;
-    };
-    const onResponse = (response) => {
-        settle();
-        let from, status;
-        try {
-            from = response.request();
-            status = response.status();
-        }
-        catch {
-            return;
-        }
-        if (done || !inChain(from))
-            return;
-        if (REDIRECT_STATUSES.has(status)) {
-            redirect = { request: from, status };
-            if (typeof from.response === 'function')
-                Promise.resolve().then(() => from.response()).then(settle, settle);
-            return;
-        }
-        final(status);
-    };
-    const onFailed = (failed) => { settle(); if (!done && inChain(failed)) {
-        stop();
-        watch.failed();
-    } };
-    const stop = () => { done = true; page.off?.('response', onResponse); page.off?.('requestfailed', onFailed); };
-    const settle = () => {
-        if (done || !redirect)
-            return;
-        let next = null;
-        try {
-            next = typeof redirect.request.redirectedTo === 'function' ? redirect.request.redirectedTo() : null;
-        }
-        catch {
-            next = null;
-        }
-        if (next)
-            return;
-        final(redirect.status);
-    };
-    page.on?.('response', onResponse);
-    page.on?.('requestfailed', onFailed);
-    return { settle, stop, closed: () => { settle(); if (!done) {
-            stop();
-            watch.failed();
-        } } };
-}
-/** The `authorized` event's detail for a cse continuation; a merchant-hosted one names its profile and templated URL. */
-function cseAuthorizedDetail(replay, url) {
-    const base = { mode: 'cse', authorizationId: replay.authorizationId, fields: Object.keys(replay.substitutions.fields) };
-    return replay.kind === 'merchant_hosted'
-        ? { ...base, kind: 'merchant_hosted', profile: replay.profile, url: replayTemplatedUrl(replay, url) }
-        : base;
-}
-/**
- * The paused request's body, or null when Chromium says there is one and did
- * not hand it over. `postData` is set only for a text body; a binary or a
- * large one arrives as base64 `postDataEntries` instead, concatenated here
- * byte for byte (an entry without `bytes` is a file the browser streams, which
- * no runtime can read back). There is no CDP command to fetch it later:
- * `Fetch.getRequestPostData` does not exist (Chrome answers -32601), so a
- * body that is not on the event is a body this adapter cannot see.
- */
-function pausedBody(request) {
-    if (typeof request.postData === 'string' && request.postData !== '')
-        return request.postData;
-    if (!request.hasPostData)
-        return request.postData ?? '';
-    const entries = request.postDataEntries ?? [];
-    if (!entries.length || entries.some((e) => typeof e.bytes !== 'string'))
-        return null;
-    return Buffer.concat(entries.map((e) => Buffer.from(e.bytes, 'base64'))).toString('utf8');
-}
-const BODY_UNREADABLE_REASON = 'the paused request\'s body could not be read (no postData and no postDataEntries)';
-/**
- * The CORS headers a fulfilled CROSS-ORIGIN request needs, or null when the
- * request is same-origin (or carries no Origin, so no CORS check applies).
- *
- * The browser checks a fulfilled response exactly as it checks a real one. A
- * page that fetches a processor on another origin therefore needs
- * `access-control-allow-origin` on the synthetic answer, or its fetch rejects
- * with "Failed to fetch" and the page never sees the processor's reply, even
- * though the cardholder approved and the processor answered the vault.
- * Shopify never hit this on its current host: the checkout.pci.shopifyinc.com
- * card iframe posts to its own origin (its older deposit.<region>.shopifycs.com
- * host is called from the checkout.shopifycs.com frame, cross-origin, and gets
- * the answer like everyone else). Stripe hits it on every surface (Checkout on
- * checkout.stripe.com or a merchant domain, and Elements in the js.stripe.com
- * frame, all call api.stripe.com), and so does every other processor whose
- * card frame calls a separate API host. Observed live on
- * 2026-09-03: the vault replayed a Stripe PaymentMethod into a raw-CDP
- * runtime, the browser refused the answer for want of this header, and
- * Stripe Checkout showed "We are experiencing connection issues".
- *
- * The exact Origin is echoed rather than `*`: a credentialed request refuses
- * `*`, the echo satisfies both. The processor's own value can never reach
- * this adapter (a browser does not expose that header to the page that
- * replayed the call), so whatever the replay carries under these names is
- * replaced by the one value that is right for THIS request. Playwright adds
- * the same headers inside route.fulfill when a cross-origin fulfill carries
- * none (microsoft/playwright#12929), which is why attachToPlaywright never
- * needed this; it writes them itself anyway, replacing a stale value, so both
- * adapters answer the vault's replays identically.
- *
- * This widens nothing. A tokenization endpoint is built for anonymous
- * browsers and answers every origin (`access-control-allow-origin: *` on
- * Stripe's and Shopify's own replies), so the page that made the request
- * could always read the processor's answer to it; the replay is made exactly
- * as visible, to exactly that page. Whether a card goes anywhere at all is
- * decided by the cardholder on the approval screen, never by this header.
- *
- * Only what a browser serializes is ever echoed: one canonical http(s)
- * origin (`new URL(origin).origin === origin`), or the opaque `null` a
- * sandboxed or data: document sends, which Chrome matches against
- * `access-control-allow-origin: null` and which Playwright echoes too. That
- * refuses userinfo, a path, an explicit default port, several origins in one
- * value, or a control character that would break the fulfill after the
- * cardholder already approved. Anything refused simply gets no CORS answer,
- * which is what every fulfill got before this existed.
- */
-export function corsHeadersFor(url, requestHeaders) {
-    return corsDecision(url, requestHeaders).headers;
-}
-/** The CORS answer and its reason: `none` when no usable Origin was sent (or the url is not http(s)), `same_origin` when no check applies. */
-export function corsDecision(url, requestHeaders) {
-    const none = { headers: null, outcome: 'none' };
-    const originEntry = Object.entries(requestHeaders ?? {}).find(([name]) => name.toLowerCase() === 'origin');
-    const origin = typeof originEntry?.[1] === 'string' ? originEntry[1].trim() : '';
-    if (!origin)
-        return none;
-    let target;
-    try {
-        target = new URL(url);
-    }
-    catch {
-        return none;
-    }
-    if (target.protocol !== 'https:' && target.protocol !== 'http:')
-        return none;
-    if (origin !== 'null') {
-        let originUrl;
-        try {
-            originUrl = new URL(origin);
-        }
-        catch {
-            return none;
-        }
-        if (originUrl.protocol !== 'https:' && originUrl.protocol !== 'http:')
-            return none;
-        if (originUrl.origin !== origin)
-            return none;
-        if (target.origin === origin)
-            return { headers: null, outcome: 'same_origin' };
-    }
-    return { headers: { 'access-control-allow-origin': origin, 'access-control-allow-credentials': 'true' }, outcome: 'echoed' };
-}
-/**
- * `headers` with the CORS answer for this request written in; the object
- * itself when none is needed. Any header the answer names is replaced
- * whatever its case, so a name is never sent twice. The answer varies by
- * Origin, and a `vary` the replay already carries is extended rather than
- * replaced (or left alone when it already covers Origin or is `*`); a `vary`
- * the answer itself names is taken as given.
- */
-export function withCorsHeaders(headers, cors) {
-    if (!cors)
-        return headers;
-    const replaced = new Set(Object.keys(cors).map((name) => name.toLowerCase()));
-    const out = {};
-    let varyName = null;
-    for (const [name, value] of Object.entries(headers)) {
-        const lower = name.toLowerCase();
-        if (replaced.has(lower))
-            continue;
-        if (lower === 'vary')
-            varyName = name;
-        out[name] = value;
-    }
-    Object.assign(out, cors);
-    if (replaced.has('vary'))
-        return out;
-    if (varyName === null) {
-        out.vary = 'Origin';
-    }
-    else {
-        const existing = String(out[varyName]);
-        const members = existing.split(',').map((m) => m.trim().toLowerCase());
-        if (!members.includes('origin') && !members.includes('*'))
-            out[varyName] = `${existing}, Origin`;
-    }
-    return out;
-}
-/** CDP's header shape: `{ name, value }` entries. */
-function headerEntries(headers) {
-    return Object.entries(headers).map(([name, value]) => ({ name, value: String(value) }));
-}
-function readPayToInterceptMs(readClickedAt, approvalStartedAt) {
-    try {
-        const clickedAt = readClickedAt?.();
-        return typeof clickedAt === 'number' && Number.isFinite(clickedAt) && clickedAt <= approvalStartedAt
-            ? Math.round(approvalStartedAt - clickedAt)
-            : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-/**
- * The origin of the top-level document the payment form is on, read when a
- * card request pauses: the fact that names the merchant for the company's
- * presets (the API's checkout_origin). An https origin, or http://localhost
- * for local checkout; anything else, or a page that cannot be read, yields
- * undefined and the authorization goes out without one (a merchant, category
- * or place rule then refuses it as unknown, never the request itself).
- */
-function pageOriginFrom(documentUrl) {
-    if (typeof documentUrl !== 'string')
-        return undefined;
-    try {
-        const url = new URL(documentUrl);
-        if (url.username || url.password)
-            return undefined;
-        if (url.protocol === 'https:' || (url.protocol === 'http:' && url.hostname === 'localhost'))
-            return url.origin;
-        return undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-/**
- * The top-level document's URL, read once with a one-second bound when a card
- * request pauses: pageOriginFrom derives the merchant origin from it, and the
- * retry rule (sameCheckoutRequest) compares it. Undefined when the page
- * cannot be read, the attempt was stopped, or the read was late; the
- * authorization then goes out without a page origin and no retry can bind.
- */
-async function documentUrlOf(readDocumentUrl, signal) {
-    let timer;
-    let abort;
-    try {
-        const documentUrl = await Promise.race([
-            Promise.resolve().then(readDocumentUrl).catch(() => undefined),
-            new Promise((resolve) => {
-                timer = setTimeout(resolve, 1_000);
-                abort = () => resolve(undefined);
-                signal.addEventListener('abort', abort, { once: true });
-                if (signal.aborted)
-                    abort();
-            }),
-        ]);
-        return typeof documentUrl === 'string' ? documentUrl : undefined;
-    }
-    catch {
-        return undefined;
-    }
-    finally {
-        if (timer)
-            clearTimeout(timer);
-        if (abort)
-            signal.removeEventListener('abort', abort);
-    }
-}
-/**
- * The page total, the lowest amount authority, through the integrator's own
- * reader (AttachOptions.pageAmount): an integer in the smallest unit with its
- * currency, or nothing. A read is a courtesy, never a wait: it gets one
- * second, and anything unreadable yields undefined so the authorization goes
- * out without a page total.
- */
-const PAGE_AMOUNT_READ_MS = 1_000;
-async function pageAmountOf(opts) {
-    if (!opts.pageAmount)
-        return undefined;
-    let timer;
-    try {
-        const raw = await Promise.race([
-            Promise.resolve().then(() => opts.pageAmount()).catch(() => undefined),
-            new Promise((resolve) => { timer = setTimeout(() => resolve(undefined), PAGE_AMOUNT_READ_MS); }),
-        ]);
-        if (!raw || typeof raw !== 'object')
-            return undefined;
-        const { amount, currency } = raw;
-        if (!Number.isSafeInteger(amount) || amount < 0 || typeof currency !== 'string' || !/^[A-Za-z]{3}$/.test(currency))
-            return undefined;
-        return { amount: amount, currency: currency.toLowerCase() };
-    }
-    catch {
-        return undefined;
-    }
-    finally {
-        if (timer)
-            clearTimeout(timer);
-    }
-}
-/**
- * Last-resort patterns: the built-in recognizers' hosts, derived the same way
- * as everything else. Used only when the vault hands back nothing at all (a
- * duck-typed client from an older SDK, or an empty registry) — a hardcoded list
- * that drifts from the registry is exactly the bug this adapter used to have.
- */
-const FALLBACK_CARD_PATTERNS = cardUrlPatterns(BUILTIN_REGISTRY);
-/** Observer exceptions and server error envelopes must not interrupt or leak a processor handoff. */
-function safeOptions(opts) {
-    const observer = opts.onEvent;
-    return { ...opts, onEvent: (event) => { try {
-            Promise.resolve(observer?.(event)).catch(() => { });
-        }
-        catch { /* observer only */ } } };
-}
-function failureSummary(error) {
-    if (error instanceof CheckoutApiError)
-        return `${error.name}: ${error.code ?? `http_${error.status}`}`;
-    // The rule's code, as the API's own refusal carried it before the error was typed.
-    if (error instanceof AdyenTestPlatformRefusedError)
-        return `${error.name}: ${error.code}`;
-    // Why the merchant's own total could not stand behind the payment, and at which step.
-    if (error instanceof MerchantTotalError)
-        return `${error.name}: ${error.code}${error.reasonCode ? ` (${error.reasonCode})` : ''}`;
-    return error instanceof Error ? error.name : 'CheckoutError';
-}
-const STRIPE_PAYMENT_INTENT_CONFIRM = /^\/v1\/payment_intents\/pi_[A-Za-z0-9]+\/confirm$/;
-/**
- * A page that tokenized the card through an approval, then confirms the
- * payment in the browser with the token it got back (confirmCardPayment with
- * payment_method: 'pm_...', confirmPayment with a confirmation token). That
- * confirmation carries no card, and the hold after a Stripe tokenization
- * would refuse it. The API decides instead whether it is the payment the
- * cardholder approved (the approved amount and currency, on the same Stripe
- * account, paid with exactly the approved token).
- *
- * Synchronous on purpose: every paused request passes through here, and an
- * await would reorder it against the attachment's own events. Returns the
- * approval to check, with the lifecycle's one continuation claimed, or null
- * when this is not such a confirmation and the ordinary rules apply.
- */
-function claimStripeContinuation(opts, lifecycle, url, method, body) {
-    if (body == null || typeof opts.vault.checkStripeContinuation !== 'function' || !lifecycle.isBlocked()
-        || method.toUpperCase() !== 'POST')
-        return null;
-    let parsed;
-    try {
-        parsed = new URL(url);
-    }
-    catch {
-        return null;
-    }
-    if (parsed.origin !== 'https://api.stripe.com' || !STRIPE_PAYMENT_INTENT_CONFIRM.test(parsed.pathname)
-        || opts.vault.withoutCard?.(url, body) !== 'refuse')
-        return null;
-    return lifecycle.claimStripeContinuation();
-}
-/** Ask the API about a claimed continuation and settle the claim. True: continue the page's request untouched. */
-async function checkStripeContinuation(opts, lifecycle, authorizationId, request) {
-    let paymentIntentId = null;
-    try {
-        paymentIntentId = (await opts.vault.checkStripeContinuation(authorizationId, request)).paymentIntentId;
-    }
-    catch (error) {
-        opts.onEvent?.({ type: 'blocked', detail: failureSummary(error) });
-    }
-    // The checkout may have been cancelled or reconciled while the API answered.
-    const proceed = lifecycle.stripeContinuationChecked(paymentIntentId !== null);
-    if (proceed)
-        opts.onEvent?.({ type: 'stripe_payment_continued', detail: { authorizationId, paymentIntentId } });
-    else if (paymentIntentId !== null)
-        opts.onEvent?.({ type: 'blocked', detail: 'stripe_continuation_superseded' });
-    return proceed;
-}
-/**
- * How long an approval waits, after the cardholder gives it, for the page to
- * issue the request it will answer.
- *
- * This only matters when the page's own script abandoned its card request
- * while the person was deciding (Braintree's client gives up after 60
- * seconds, Square's after about 10) and did not ask again on its own. The
- * approval is real: the device sent the card to the processor and a token
- * came back, or encrypted it for the agent's browser. What is missing is a
- * request to hand it to, and the application supplies one by clicking Pay
- * again (the controller reads `ready_to_submit` with reason
- * `awaiting_merchant_retry` while this wait runs). Two minutes is a first
- * value, chosen rather than measured: long enough for an agent loop to read
- * the state and act, short enough that a minted token never sits usable for
- * the rest of the approval window. The approval window itself is the ceiling,
- * whatever this is set to. Overridable per attach via `merchantRetryWaitMs`;
- * the benchmark's retry gaps are what should replace it.
- */
-const MERCHANT_RETRY_WAIT_MS = 2 * 60_000;
-function retryWaitMs(value) {
-    if (value === undefined)
-        return MERCHANT_RETRY_WAIT_MS;
-    if (!Number.isSafeInteger(value) || value <= 0 || value > 15 * 60_000) {
-        throw new Error('merchantRetryWaitMs must be an integer between 1 and 900000.');
-    }
-    return value;
-}
-/** The page never asked again inside the retry wait; see merchantAttempt.awaitTarget. */
-class MerchantNeverRetried extends Error {
-    authorizationId;
-    constructor(authorizationId) {
-        super('the merchant page never asked again');
-        this.authorizationId = authorizationId;
-        this.name = 'MerchantNeverRetried';
-    }
-}
-/** A body field that names the purchase's amount or currency, wherever a processor puts it. */
-const AMOUNT_KEY = /^(amount|amount_?cents|total|sum|currency|currency_?code)$/i;
-/**
- * The amount and currency a body names, as `path=value` pairs: Adyen's
- * `amount.value` and `amount.currency`, Razorpay's and Nuvei's `amount`
- * and `currency`, Paysafe's `amount` and `currencyCode`, Tranzila's `sum`.
- * A pure tokenization (Braintree, Square, Shopify, a Stripe PaymentMethod)
- * names none and yields an empty list.
- */
-function bodyAmounts(value, prefix, parentKey, out) {
-    if (Array.isArray(value)) {
-        for (const item of value)
-            bodyAmounts(item, `${prefix}[]`, parentKey, out);
-        return;
-    }
-    if (value === null || typeof value !== 'object') {
-        const key = prefix.split('.').pop() ?? '';
-        if (AMOUNT_KEY.test(key) || (key === 'value' && AMOUNT_KEY.test(parentKey)))
-            out.push(`${prefix}=${String(value)}`);
-        return;
-    }
-    const own = prefix.split('.').pop() ?? '';
-    for (const [key, child] of Object.entries(value))
-        bodyAmounts(child, prefix ? `${prefix}.${key}` : key, own, out);
-}
-/** The document a request came from, as compared between a request and its retry. */
-function documentKey(url) {
-    if (typeof url !== 'string')
-        return undefined;
-    try {
-        const parsed = new URL(url);
-        parsed.hash = '';
-        return parsed.href;
-    }
-    catch {
-        return undefined;
-    }
-}
-/** Luhn, on a run of digits: the placeholder card the agent typed passes it, most other long numbers do not. */
-function luhn(digits) {
-    let sum = 0;
-    for (let i = 0; i < digits.length; i++) {
-        let d = digits.charCodeAt(digits.length - 1 - i) - 48;
-        if (i % 2 === 1) {
-            d *= 2;
-            if (d > 9)
-                d -= 9;
-        }
-        sum += d;
-    }
-    return sum % 10 === 0;
-}
-/**
- * The card-placeholder runs in a body: every 13 to 19 digit run that passes
- * Luhn, sorted. The placeholder the agent typed (4242 4242 4242 4242, 4111
- * 1111 1111 1111) passes; a millisecond timestamp or an order number fails
- * nine times in ten, and when one passes it merely makes the match stricter.
- * A client-side-encrypted body (Adyen) carries no digits at all and yields
- * an empty list on both sides.
- */
-function cardRuns(body) {
-    return (body.match(/\d{13,19}/g) ?? []).filter(luhn).sort();
-}
-/** Every key path in a JSON value, arrays flattened so an element's order or count does not count. */
-function jsonKeyPaths(value, prefix, out) {
-    if (Array.isArray(value)) {
-        for (const item of value)
-            jsonKeyPaths(item, `${prefix}[]`, out);
-        return;
-    }
-    if (value === null || typeof value !== 'object') {
-        if (prefix)
-            out.add(prefix);
-        return;
-    }
-    for (const [key, child] of Object.entries(value))
-        jsonKeyPaths(child, prefix ? `${prefix}.${key}` : key, out);
-}
-/**
- * The shape of a body plus its card placeholder, as a string two bodies can
- * be compared by. JSON: its sorted key paths and its card runs, so a body the
- * client regenerated (a new session id, a new nonce, a fresh encryption of
- * the same dummy card) still matches while a different operation, a saved
- * card or another card does not. Form-encoded: its sorted keys and its card
- * runs, so Stripe's per-attempt `time_on_page` and fraud ids do not break a
- * match but a different field set does. Anything else: the body itself.
- */
-function bodyShape(body) {
-    const runs = cardRuns(body).join(',');
-    const trimmed = body.trimStart();
-    if (trimmed.startsWith('{') || trimmed.startsWith('[')) {
-        try {
-            const parsed = JSON.parse(body);
-            const paths = new Set();
-            jsonKeyPaths(parsed, '', paths);
-            const amounts = [];
-            bodyAmounts(parsed, '', '', amounts);
-            return { shape: `json:${[...paths].sort().join('|')};cards:${runs};amounts:${amounts.sort().join('|')}`, namesAmount: amounts.length > 0 };
-        }
-        catch { /* not JSON after all */ }
-    }
-    if (/^[^=&\s]+=[^&]*(&[^=&\s]+=[^&]*)*$/.test(body)) {
-        const params = new URLSearchParams(body);
-        const keys = [...new Set([...params.keys()])].sort();
-        const amounts = [...params.entries()].filter(([key]) => AMOUNT_KEY.test(key)).map(([key, value]) => `${key}=${value}`).sort();
-        return { shape: `form:${keys.join('|')};cards:${runs};amounts:${amounts.join('|')}`, namesAmount: amounts.length > 0 };
-    }
-    return { shape: `raw:${body}`, namesAmount: false };
-}
-/** The identity of a request from its parts; see CheckoutRequestIdentity. */
-function requestIdentity(opts, url, method, body, documentUrl, pageAmount) {
-    const shaped = bodyShape(body);
-    return { url, method, documentUrl, pageAmount, body: shaped.shape,
-        amountEvidence: opts.amount != null || pageAmount !== undefined || shaped.namesAmount };
-}
-/**
- * May this request be answered from the approval the other one raised?
- *
- * The plan this implements says the rule starts strict and loosens per
- * processor with evidence, so it is strict: the same processor endpoint (the
- * full URL, query included), the same method, the same top-level document,
- * the same page total when the integrator reads one, and a body of the same
- * shape carrying the same card placeholder and the same amount when the
- * request names one. A request from another page, to another endpoint, for
- * another card, for another amount or with another set of fields is a new
- * question and is refused here, which leaves it to the ordinary "an approval
- * is already outstanding" path.
- *
- * An amount has to be in evidence somewhere: the integrator's hint (what the
- * cardholder was shown), the page total, or the request's own bytes. A
- * tokenization request names no amount, so on a checkout with no hint and no
- * page reader nothing could tell a retry for the approved cart from one for
- * a changed cart, and the approval is not reused. With a page reader, a
- * changed total refuses the retry; the hint is the integrator's statement of
- * the purchase, and the approval was given for it.
- */
-function sameCheckoutRequest(first, retry) {
-    return first.amountEvidence && first.url === retry.url && first.method.toUpperCase() === retry.method.toUpperCase()
-        && first.documentUrl !== undefined && first.documentUrl === retry.documentUrl
-        && (first.pageAmount?.amount === retry.pageAmount?.amount && first.pageAmount?.currency === retry.pageAmount?.currency)
-        && first.body === retry.body;
-}
-/**
- * Whether an approval may outlive the page's own request on this checkout.
- *
- * Yes for a plain tokenization or an encrypted-card request: the device's
- * answer is a token or ciphertext, and any request for the same purchase can
- * carry it. No for a hosted form (a navigation: there is no request to
- * answer once the page has moved on), a prepared checkout (single use, bound
- * to one native request by design), a native Stripe Checkout step, and a
- * Mercado Pago request whose claim is bound to one document read. Unknown
- * modes (a duck-typed vault without checkoutModeOf) are taken as `token`.
- */
-function survivesAbandonment(opts, url, method, navigation, bound) {
-    if (navigation || bound)
-        return false;
-    const mode = typeof opts.vault?.checkoutModeOf === 'function' ? opts.vault.checkoutModeOf(url, method) : 'token';
-    return mode === 'token' || mode === 'cse';
-}
-/**
- * One card request's attempt at an approval, and the browser request that
- * currently carries it. Separate from explicit cancellation: the client can
- * drain a late create ID.
- *
- * The request and the approval have different lives. The page's own script
- * can abandon its request (Braintree's client gives up after 60 seconds,
- * Square's after about 10) while the cardholder is still deciding on their
- * phone; nothing about the checkout changed, the page asked and stopped
- * listening. lose() records that: the approval keeps polling, the page's next
- * request for the same purchase binds through bind() and is answered from the
- * same authorization, and awaitTarget() is how the approval finds the request
- * to answer, waiting for a retry when none is live. stop() is for the page
- * itself going away (navigation of a prepared document, frame removal, close,
- * crash), a request lost once delivery began, or an attempt that cannot
- * survive abandonment at all: the approval cannot be reopened and the client
- * cancels it.
- */
-function merchantAttempt(lifecycle, survives) {
-    const controller = new AbortController();
-    let reason = 'merchant_request_aborted';
-    let target = null;
-    let lost = false;
-    let rebound = false;
-    let delivering = false;
-    let bound = null;
-    const error = () => new PaymentOutcomeUnknownError(lifecycle.getState().authorizationId, reason);
-    const attempt = {
-        signal: controller.signal,
-        /** The browser request that currently carries this attempt; null while the page has none. */
-        get target() { return target; },
-        /** The page abandoned its request and has not asked again yet. */
-        get lost() { return lost; },
-        bind(next) { target = next; rebound = lost; lost = false; bound?.(); },
-        /** Delivery to the current target has begun; a loss from here on is an unknown outcome, never a retry. */
-        beginDelivery() { delivering = true; },
-        /** The page abandoned the current request. True when the approval survives it, false when the attempt stopped. */
-        lose() {
-            if (controller.signal.aborted)
-                return false;
-            if (!survives || delivering) {
-                attempt.stop();
-                return false;
-            }
-            target = null;
-            lost = true;
-            lifecycle.merchantRequestLost();
-            return true;
-        },
-        stop(cause = 'merchant_request_aborted') {
-            if (controller.signal.aborted)
-                return;
-            reason = cause;
-            if (cause === 'merchant_request_aborted')
-                lifecycle.merchantRequestAborted();
-            else
-                lifecycle.failed(error());
-            controller.abort(error());
-        },
-        assertLive() { if (controller.signal.aborted)
-            throw error(); },
-        /**
-         * The request to answer: the live one at once, or the page's retry,
-         * waited for up to `waitMs`. Resolves `rebound` when the answer goes to
-         * a request other than the one that raised the approval, so the caller
-         * can re-run request attribution on it. Rejects with MerchantNeverRetried
-         * when the wait ends with no request, and with the attempt's own error
-         * when the page goes away meanwhile.
-         */
-        async awaitTarget(waitMs, stopSignals, onWaiting) {
-            attempt.assertLive();
-            if (target && !lost)
-                return { target, rebound };
-            onWaiting();
-            const signals = [controller.signal, ...stopSignals];
-            let timer;
-            let onAbort = () => { };
-            try {
-                await new Promise((resolve, reject) => {
-                    bound = resolve;
-                    onAbort = () => { try {
-                        attempt.assertLive();
-                        reject(new Error('checkout cancelled locally before the merchant asked again'));
-                    }
-                    catch (stopped) {
-                        reject(stopped);
-                    } };
-                    for (const signal of signals)
-                        signal.addEventListener('abort', onAbort, { once: true });
-                    if (signals.some((signal) => signal.aborted))
-                        onAbort();
-                    timer = setTimeout(() => reject(new MerchantNeverRetried(lifecycle.getState().authorizationId)), waitMs);
-                });
-            }
-            finally {
-                bound = null;
-                clearTimeout(timer);
-                for (const signal of signals)
-                    signal.removeEventListener('abort', onAbort);
-            }
-            attempt.assertLive();
-            if (!target)
-                throw new MerchantNeverRetried(lifecycle.getState().authorizationId);
-            return { target, rebound };
-        },
-    };
-    return attempt;
-}
-/**
- * The retry wait, capped by what is left of the approval window: a token
- * must never sit usable past the moment the row itself would have expired.
- */
-function boundedRetryWait(waitMs, approvalStartedAt, timeoutMs) {
-    const windowEnd = approvalStartedAt + (timeoutMs ?? 15 * 60_000);
-    return Math.max(0, Math.min(waitMs, windowEnd - Date.now()));
-}
-/**
- * Retire an approval the page never asked for again, and tell the lifecycle
- * what became of it. A confirmed retirement ends as `declined` with reason
- * `merchant_never_retried` (the cardholder's screen says the merchant did
- * not finish and nothing was charged, and the next card request is a new
- * question); anything else is an unknown outcome the application must
- * reconcile, which holds the attachment. A vault without cancelAuthorization
- * (a duck-typed client) cannot retire anything and lands there too.
- */
-async function retireUnusedApproval(opts, lifecycle, authorizationId) {
-    const cancel = typeof opts.vault?.cancelAuthorization === 'function' && authorizationId
-        ? opts.vault.cancelAuthorization(authorizationId, 'merchant_never_retried') : Promise.reject(new Error('no authorization to retire'));
-    try {
-        await cancel;
-        lifecycle.merchantNeverRetried(authorizationId);
-        opts.onEvent?.({ type: 'failed', detail: 'merchant_never_retried' });
-    }
-    catch {
-        lifecycle.failed(new PaymentOutcomeUnknownError(authorizationId, 'authorization_cancel_unconfirmed'), true);
-        opts.onEvent?.({ type: 'failed', detail: 'PaymentOutcomeUnknownError' });
-    }
-}
-/**
- * Take over card tokenization for a page.
- *
- * IMPORTANT: card fields render in cross-origin iframes, which are separate CDP
- * targets. Enabling Fetch on the page session alone will never see the
- * tokenization request. This attaches recursively so every nested target is
- * armed, which is the whole reason this adapter exists.
- *
- * The patterns armed here come from the REGISTRY, not from a constant, so a PSP
- * the API knows about is paused without an SDK release — call
- * `vault.syncRegistry()` before attaching and every recognizer the server
- * serves is covered. They are a coarse pre-filter and are deliberately wider
- * than the recognizers (see cardUrlPatterns): each paused request is re-checked
- * with `isCardRequest` below and continued untouched unless it is an exact
- * match. Patterns are resolved once, at attach, so every nested target ends up
- * armed identically. Merchant profiles are the exception to syncing first: the
- * endpoint of every profile this build reviewed is armed whatever the sync said,
- * and each paused request is judged against the profiles armed when it pauses,
- * so a sync after attach arms a profile here as it does in attachToPlaywright.
- */
-export async function attachToCdp(cdp, pageSessionId, opts) {
-    opts = safeOptions(opts);
-    const setupTimeoutMs = attachmentDeadline(opts.attachmentTimeoutMs);
-    const setupStop = new AbortController();
-    let attachmentReady = false;
-    let setupFailureReported = false;
-    const ownedSessions = new Set([pageSessionId]);
-    const sessionTypes = new Map([[pageSessionId, 'page']]);
-    const sessionParents = new Map();
-    const detachedSessions = new Set();
-    const rejectedSessions = new Set();
-    const workerOwners = new Map();
-    const ownersWithWorkers = new Set();
-    // Network IDs are scoped to their emitting session. Retired records are
-    // separate from live requests, but still disqualify an indistinguishable
-    // delayed Fetch event; deleting that evidence could approve a lost request.
-    const requestSources = new Map();
-    const retiredSources = new Map();
-    const retiredCounts = new Map();
-    // Keep exact evidence for the first 1,024 failures per owner. Later failures
-    // enter a fixed 256 KiB Bloom filter with seven positions: a membership hit
-    // refuses that Network ID, never the whole frame merely for reaching a cap.
-    // Fetch lacks the emitter session, so compact evidence uses owner + Network
-    // ID; exact records below still use session + ID. False positives may refuse
-    // a request, but a failed identity is never forgotten or treated as live.
-    // The filters are controller-local and monotonic. They are not rotated or
-    // cleared on worker detach; arbitrary late Network/Fetch delivery is allowed.
-    // A sufficiently long history can saturate a filter and reduce availability.
-    const retiredSummaries = new Map();
-    const summaryBytes = 256 * 1024;
-    const summaryPositions = (id) => {
-        const positions = [];
-        for (let seed = 1; seed <= 7; seed++) {
-            let hash = 0x811c9dc5 ^ Math.imul(seed, 0x9e3779b9);
-            for (let i = 0; i < id.length; i++)
-                hash = Math.imul(hash ^ id.charCodeAt(i), 0x01000193);
-            hash = Math.imul(hash ^ (hash >>> 16), 0x85ebca6b);
-            hash = Math.imul(hash ^ (hash >>> 13), 0xc2b2ae35);
-            positions.push((hash ^ (hash >>> 16)) & (summaryBytes * 8 - 1));
-        }
-        return positions;
-    };
-    const hasRetiredSummary = (owner, id) => {
-        const bits = retiredSummaries.get(owner);
-        return !!bits && summaryPositions(id).every(bit => (bits[bit >>> 3] & (1 << (bit & 7))) !== 0);
-    };
-    const requestKey = (sessionId, id) => JSON.stringify([sessionId, id]);
-    const sessionDetached = (sessionId) => {
-        while (sessionId) {
-            if (detachedSessions.has(sessionId))
-                return true;
-            sessionId = sessionParents.get(sessionId);
-        }
-        return false;
-    };
-    let merchantContext;
-    let targetContextKnown = false;
-    const lifecycle = new CheckoutLifecycle(opts);
-    const stripeCheckout = new StripeCheckoutGate(opts);
-    const mercadoCheckout = new MercadoCheckoutGate();
-    let preparationFrameId;
-    const readDocumentUrl = async () => {
-        const tree = await cdp.send('Page.getFrameTree', {}, pageSessionId);
-        if (typeof tree?.frameTree?.frame?.url !== 'string')
-            throw new Error('merchant_document_unavailable');
-        preparationFrameId = tree.frameTree.frame.id;
-        return tree.frameTree.frame.url;
-    };
-    const preparationGate = new PreparationGate(opts, lifecycle, readDocumentUrl);
-    // A merchant-hosted request this attachment continued with the Vault's
-    // ciphertext, and the Network identity its answer arrives under.
-    const merchantHandoff = new MerchantHandoffWatch(lifecycle, opts.onEvent);
-    let handoffNetwork = null;
-    // The page's retries of that request, each waiting for its own Network report; see awaitRetryReport.
-    const retriesAwaitingReport = new Map();
-    // The merchant's own total (merchant-total-watch.ts): its checkout responses, recorded
-    // read-only from attach on, and the approval a hand-off answers, for the charge report.
-    const merchantTotal = new MerchantTotalWatch(opts.onEvent, opts.vault);
-    let handoffReplay = null;
-    const guards = paymentEndpointGuards(opts.paymentEndpoints);
-    const armed = new Set();
-    const arming = new Map();
-    // Set once a failure proves that retrying cannot help; see isTerminal.
-    let terminal = null;
-    // Silence window after a person declined or ignored one; see APPROVAL_COOLDOWN_MS.
-    const cooldownMs = opts.approvalCooldownMs ?? APPROVAL_COOLDOWN_MS;
-    let quietUntil = 0;
-    // One outstanding approval at a time; see the note above isApprovalOutcome.
-    let awaitingApproval = false;
-    // How long an approval waits for the page to ask again; see MERCHANT_RETRY_WAIT_MS.
-    const retryWait = retryWaitMs(opts.merchantRetryWaitMs);
-    let activeRequest = null;
-    const sourceOwner = (source) => workerOwners.get(source.sessionId) ?? source.sessionId;
-    const retireSource = (source) => {
-        const owner = sourceOwner(source), key = requestKey(source.sessionId, source.networkId);
-        const count = (retiredCounts.get(owner) ?? 0) + (retiredSources.has(key) ? 0 : 1);
-        // Compact overflow without dropping failed identities or turning unrelated
-        // background failures into a permanent refusal of every request in a frame.
-        if (count > 1024) {
-            let bits = retiredSummaries.get(owner);
-            if (!bits) {
-                bits = new Uint8Array(summaryBytes);
-                retiredSummaries.set(owner, bits);
-            }
-            for (const bit of summaryPositions(source.networkId))
-                bits[bit >>> 3] |= 1 << (bit & 7);
-            if (activeRequest?.sessionId === owner && hasRetiredSummary(owner, activeRequest.networkId)) {
-                activeRequest.attempt.stop('browser_interception_unavailable');
-            }
-            return;
-        }
-        retiredCounts.set(owner, count);
-        retiredSources.set(key, source);
-    };
-    const identifyRequest = (request) => {
-        if (request.sessionId && hasRetiredSummary(request.sessionId, request.networkId)) {
-            request.attempt.stop('browser_interception_unavailable');
-            request.attempt.assertLive();
-        }
-        const matches = (source) => {
-            const metadata = source.request;
-            return sourceOwner(source) === request.sessionId
-                && source.networkId === request.networkId && (!metadata
-                || (metadata.url === request.request.url && metadata.method === request.request.method
-                    // A missing body is unknown, not evidence of a different request.
-                    && !(typeof metadata.postData === 'string' && typeof request.request.postData === 'string'
-                        && metadata.postData !== request.request.postData)));
-        };
-        const candidates = [...requestSources.values(), ...retiredSources.values()].filter(matches);
-        if (!candidates.length)
-            return false;
-        // A failure can arrive before its Network request description. Do not
-        // ignore that possible source and assign its Fetch to a live sibling.
-        if (candidates.some(source => !source.request)) {
-            if (request.sourceSessionId) {
-                request.attempt.stop('browser_interception_unavailable');
-                request.attempt.assertLive();
-            }
-            return false;
-        }
-        if (candidates.length !== 1) {
-            request.attempt.stop('browser_interception_unavailable');
-            request.attempt.assertLive();
-        }
-        const source = candidates[0];
-        if (request.sourceSessionId && request.sourceSessionId !== source.sessionId) {
-            request.attempt.stop('browser_interception_unavailable');
-        }
-        request.sourceSessionId = source.sessionId;
-        if (sessionDetached(source.sessionId) || retiredSources.has(requestKey(source.sessionId, source.networkId)))
-            request.attempt.stop();
-        request.attempt.assertLive();
-        return true;
-    };
-    /**
-     * Judges a retry of the handed-off merchant-hosted request in the page's order
-     * (MerchantHandoffWatch.retried). Fetch pauses a request in the browser process,
-     * while the renderer reports, in order on the page's session, the merchant's
-     * answer and then the page's next request (Network.requestWillBeSent). A retry's
-     * pause can arrive before an answer the page already read, so the retry is
-     * judged at its own requestWillBeSent. False when that already arrived or cannot
-     * come; otherwise the session going away or the attachment deadline ends the wait.
-     */
-    const awaitRetryReport = (sessionId, networkId, judge) => {
-        if (!sessionId || typeof networkId !== 'string' || !networkId || hasRetiredSummary(sessionId, networkId))
-            return false;
-        if ([...requestSources.values(), ...retiredSources.values()]
-            .some(source => sourceOwner(source) === sessionId && source.networkId === networkId))
-            return false;
-        const key = requestKey(sessionId, networkId);
-        let timer;
-        const reported = () => { clearTimeout(timer); retriesAwaitingReport.delete(key); judge(); };
-        timer = setTimeout(reported, setupTimeoutMs);
-        timer.unref?.();
-        retriesAwaitingReport.set(key, { sessionId, reported });
-        return true;
-    };
-    /** A frame's Fetch event does not identify which dedicated worker sent it.
-     * Require the exact Network event before asking the Vault whenever that frame
-     * has had workers. A sibling's detach proves nothing about an unknown request;
-     * missing attribution instead expires without releasing any card or token.
-     * Keep detached ancestry so a late event cannot revive a lost worker request.
-     */
-    const awaitRequestSource = async (request) => {
-        if (identifyRequest(request))
-            return;
-        if (!request.sessionId || !ownersWithWorkers.has(request.sessionId)) {
-            if (request.sessionId && retiredSources.has(requestKey(request.sessionId, request.networkId))) {
-                request.attempt.stop();
-                request.attempt.assertLive();
-            }
-            request.sourceSessionId = request.sessionId;
-            return;
-        }
-        let timer;
-        let changed = () => { };
-        const signals = [request.attempt.signal, lifecycle.abort.signal, setupStop.signal];
-        try {
-            await new Promise((resolve, reject) => {
-                changed = () => {
-                    try {
-                        request.attempt.assertLive();
-                        if (lifecycle.isCancelled())
-                            throw new Error('checkout cancelled locally before approval');
-                        if (setupStop.signal.aborted)
-                            throw new PaymentOutcomeUnknownError(null, 'browser_interception_unavailable');
-                        if (identifyRequest(request))
-                            resolve();
-                    }
-                    catch (error) {
-                        reject(error);
-                    }
-                };
-                request.attributionChanged = changed;
-                for (const signal of signals)
-                    signal.addEventListener('abort', changed, { once: true });
-                timer = setTimeout(() => reject(new PaymentOutcomeUnknownError(null, 'browser_interception_unavailable')), setupTimeoutMs);
-                changed();
-            });
-        }
-        finally {
-            clearTimeout(timer);
-            for (const signal of signals)
-                signal.removeEventListener('abort', changed);
-            delete request.attributionChanged;
-        }
-    };
-    // The hosted form the cardholder already submitted; see HOSTED_FORM_REPEAT_QUIET_MS.
-    const repeatQuietMs = opts.hostedFormRepeatQuietMs ?? HOSTED_FORM_REPEAT_QUIET_MS;
-    let lastSubmitted = null;
-    const derived = typeof opts.vault?.cardUrlPatterns === 'function' ? opts.vault.cardUrlPatterns() : [];
-    // The endpoint and siblings of every merchant profile this build reviewed
-    // (merchant-hosted.ts), which a VaultClient arms from the start: a profile's card
-    // request is paused here exactly as attachToPlaywright's per-request route catches
-    // it, before or after any syncRegistry(). The gate continues untouched a request
-    // that the vault names no profile for.
-    const merchantPatterns = [...reviewedMerchantProfileUrlPatterns(),
-        ...(typeof opts.vault?.merchantProfileUrlPatterns === 'function' ? opts.vault.merchantProfileUrlPatterns() : [])];
-    const urlPatterns = [...new Set([...(derived.length > 0 ? derived : FALLBACK_CARD_PATTERNS), ...guards.patterns,
-            ...(stripeCheckout.isEnabled() ? ['https://api.stripe.com/*'] : []), MERCADO_CHECKOUT_PATTERN, ...merchantPatterns])];
-    const arm = async (sessionId, resume = false, worker = false) => {
-        const key = sessionId ?? '__root__';
-        if (armed.has(key))
-            return;
-        if (arming.has(key))
-            return arming.get(key);
-        // Fetch's interception ID differs from Network's ID. Enable failure events
-        // before intercepting and bind each attempt to both its ID and CDP session.
-        const pending = withinAttachmentDeadline(async (assertDeadline) => {
-            const assertActive = () => {
-                assertDeadline();
-                if (sessionId && detachedSessions.has(sessionId))
-                    throw new CheckoutAttachmentError('closed');
-            };
-            await cdp.send('Network.enable', {}, sessionId);
-            assertActive();
-            // Worker Fetch does not exist in Chrome. Its requests pause on the owning
-            // frame, but its abort/finish events arrive on the worker Network session.
-            // Keep that session attached and paused until Network is listening, then
-            // resume it only after its nested workers can be attached recursively.
-            if (!worker) {
-                await cdp.send('Page.enable', {}, sessionId).catch(() => { });
-                assertActive();
-                await cdp.send('Fetch.enable', {
-                    patterns: urlPatterns.map((urlPattern) => ({ urlPattern, requestStage: 'Request' })),
-                }, sessionId);
-                assertActive();
-            }
-            // Descend into this target's own children (iframes inside iframes).
-            await cdp.send('Target.setAutoAttach', {
-                autoAttach: true, waitForDebuggerOnStart: true, flatten: true,
-            }, sessionId);
-            assertActive();
-            // A child remains part of setup until Chrome acknowledges its resume.
-            // Deduplicate this command with arming, and bound the acknowledgement too.
-            if (resume) {
-                await cdp.send('Runtime.runIfWaitingForDebugger', {}, sessionId);
-                assertActive();
-            }
-        }, setupTimeoutMs, setupStop.signal);
-        arming.set(key, pending);
-        try {
-            await pending;
-            armed.add(key);
-        }
-        catch (error) {
-            const failure = attachmentFailure(error);
-            setupStop.abort(failure);
-            throw failure;
-        }
-        finally {
-            arming.delete(key);
-        }
-    };
-    const failInterception = (error) => {
-        if (setupFailureReported)
-            return;
-        setupFailureReported = true;
-        setupStop.abort(attachmentFailure(error));
-        terminal = new Error('browser_interception_unavailable');
-        // A new target changes future interception, not the result of an earlier
-        // attempt. Preserve a settled result or handoff while still refusing new
-        // requests. Approval/preparation in progress must instead be retired.
-        const status = lifecycle.getState().status;
-        if (status === 'completed' || (!activeRequest && !['idle', 'awaiting_approval', 'ready_to_submit'].includes(status)))
-            return;
-        activeRequest?.attempt.stop();
-        preparationGate.invalidate('browser_interception_unavailable');
-        lifecycle.failed(new PaymentOutcomeUnknownError(lifecycle.getState().authorizationId, 'browser_interception_unavailable'));
-        opts.onEvent?.({ type: 'failed', detail: 'browser_interception_unavailable' });
-    };
-    cdp.on(async (method, params, sessionId) => {
-        if ((method === 'Target.targetCreated' || method === 'Target.targetInfoChanged') && targetContextKnown) {
-            try {
-                assertContextTarget(params?.targetInfo, merchantContext);
-            }
-            catch (error) {
-                failInterception(error);
-            }
-            return;
-        }
-        if (((method === 'Page.frameNavigated' && !params.frame?.parentId) || (method === 'Page.navigatedWithinDocument' && preparationFrameId && params.frameId === preparationFrameId)) && sessionId === pageSessionId) {
-            preparationGate.invalidate('merchant_document_changed');
-            mercadoCheckout.invalidate();
-            if (stripeCheckout.isPrepared()) {
-                stripeCheckout.invalidate();
-                activeRequest?.attempt.stop();
-            }
-            if (preparationGate.isEngaged())
-                activeRequest?.attempt.stop();
-            // The page that abandoned its request has moved to another document:
-            // its approval cannot be answered there and is cancelled. A reload of
-            // the same document is not that; its re-issued request is the retry.
-            if (method === 'Page.frameNavigated' && activeRequest?.attempt.lost
-                && documentKey(params.frame?.url) !== activeRequest.identity.documentUrl)
-                activeRequest.attempt.stop();
-            return;
-        }
-        if ((method === 'Inspector.detached' && sessionId === pageSessionId)
-            || (method === 'Target.detachedFromTarget' && params.sessionId === pageSessionId)) {
-            detachedSessions.add(pageSessionId);
-            setupStop.abort(new CheckoutAttachmentError('closed'));
-            preparationGate.invalidate('merchant_document_closed');
-            stripeCheckout.invalidate();
-            mercadoCheckout.invalidate();
-            // The root page owns every attached OOPIF; its loss ends child requests too.
-            activeRequest?.attempt.stop();
-            // Nothing can read the merchant's answer to a continued merchant-hosted
-            // request any more, nor the page's report of a retry: a retry is judged on
-            // what was read, then the answer is an unknown outcome unless it arrived.
-            for (const waiting of [...retriesAwaitingReport.values()])
-                waiting.reported();
-            if (handoffNetwork)
-                merchantHandoff.failed();
-        }
-        // The transport is browser-scoped. A second tab's request or child target
-        // must never be authorized with this page's merchant, amount or preparation.
-        if (!sessionId || !ownedSessions.has(sessionId))
-            return;
-        if (method === 'Network.requestWillBeSent') {
-            const owner = workerOwners.get(sessionId) ?? sessionId;
-            const matchesActive = activeRequest?.sessionId === owner && activeRequest.networkId === params.requestId;
-            // Only identification may consume a late event from a detached target.
-            // Its Fetch events, children and commands remain permanently ignored.
-            if (sessionDetached(sessionId) && !matchesActive)
-                return;
-            const key = requestKey(sessionId, params.requestId);
-            const record = { sessionId, networkId: params.requestId, request: params.request };
-            if (sessionDetached(sessionId) || retiredSources.has(key) || hasRetiredSummary(owner, params.requestId))
-                retireSource(record);
-            else
-                requestSources.set(key, record);
-            // Read-only: the page this request came from (its session and document loader), and
-            // the request itself when a priced merchant profile's rules read it.
-            if (!sessionDetached(sessionId) && params.request) {
-                merchantTotal.sent(key, { method: params.request.method, url: params.request.url,
-                    ...(typeof params.request.postData === 'string' ? { requestBody: params.request.postData } : {}),
-                    ...(typeof params.loaderId === 'string' && params.loaderId ? { page: `${owner}:${params.loaderId}` } : {}) });
-            }
-            if (matchesActive) {
-                try {
-                    identifyRequest(activeRequest);
-                }
-                catch { /* stop already retires the exact attempt */ }
-                activeRequest.attributionChanged?.();
-            }
-            retriesAwaitingReport.get(requestKey(owner, params.requestId))?.reported();
-            return;
-        }
-        if (sessionDetached(sessionId))
-            return;
-        if (method === 'Network.loadingFinished') {
-            const key = requestKey(sessionId, params.requestId);
-            requestSources.delete(key);
-            if (merchantTotal.log.tracks(key)) {
-                // When it finished, then its text: a merchant response the total or the charge is read from.
-                const completedAt = Date.now();
-                cdp.send('Network.getResponseBody', { requestId: params.requestId }, sessionId).then((read) => merchantTotal.log.read(key, typeof read?.body === 'string'
-                    ? (read.base64Encoded ? Buffer.from(read.body, 'base64').toString('utf8') : read.body) : null, completedAt), () => merchantTotal.log.read(key, null, completedAt));
-            }
-            return;
-        }
-        if (method === 'Network.responseReceived') {
-            merchantTotal.log.answered(requestKey(sessionId, params.requestId), params.response?.status);
-            // The merchant's answer to a continued merchant-hosted request: 5xx is an unknown outcome.
-            if (handoffNetwork && params.requestId === handoffNetwork.networkId && sessionId === handoffNetwork.sessionId) {
-                merchantHandoff.responded(params.response?.status);
-                // What the merchant's confirmation says it charged, once it has been read: reported from
-                // the hand-off's own answer, as the Playwright adapter does, whether or not the card
-                // request itself is one the after-payment rules read (Dick's reads its checkout calls).
-                if (handoffReplay)
-                    merchantTotal.answered(handoffReplay, opts.vault);
-            }
-            return;
-        }
-        if (method === 'Network.loadingFailed') {
-            merchantTotal.log.failed(requestKey(sessionId, params.requestId));
-            if (handoffNetwork && params.requestId === handoffNetwork.networkId && sessionId === handoffNetwork.sessionId)
-                merchantHandoff.failed();
-            if (activeRequest && activeRequest.networkId === params.requestId && activeRequest.sourceSessionId === sessionId) {
-                const dead = { requestId: activeRequest.requestId, sessionId: activeRequest.sessionId, request: activeRequest.request };
-                // A request a dedicated worker sent keeps today's behaviour: its loss
-                // stops the attempt. A worker's retry pauses on the owning frame and
-                // is attributed only through the worker's own Network events, and
-                // binding an approval across that attribution is not something this
-                // change claims to get right; the observed failure is page script.
-                const fromWorker = sessionId !== activeRequest.sessionId;
-                if (fromWorker ? (activeRequest.attempt.stop(), false) : activeRequest.attempt.lose()) {
-                    // The page's own script gave up on its request; the cardholder's
-                    // approval did not (see merchantAttempt). Release the dead
-                    // interception and forget the request's identity, so no later event
-                    // on it can pass for the retry's.
-                    activeRequest.networkId = '';
-                    activeRequest.frameId = undefined;
-                    activeRequest.sourceSessionId = undefined;
-                    opts.onEvent?.({ type: 'merchant_request_lost', detail: { authorizationId: lifecycle.getState().authorizationId } });
-                    cdp.send('Fetch.failRequest', { requestId: dead.requestId, errorReason: 'Aborted' }, dead.sessionId).catch(() => { });
-                }
-            }
-            const key = requestKey(sessionId, params.requestId);
-            retireSource(requestSources.get(key) ?? { sessionId, networkId: params.requestId });
-            requestSources.delete(key);
-            if (activeRequest?.sessionId === (workerOwners.get(sessionId) ?? sessionId) && activeRequest.networkId === params.requestId) {
-                try {
-                    identifyRequest(activeRequest);
-                }
-                catch { /* its exact origin is unavailable */ }
-                activeRequest.attributionChanged?.();
-            }
-            return;
-        }
-        if (method === 'Target.detachedFromTarget' || method === 'Inspector.detached' || method === 'Page.frameDetached') {
-            if (activeRequest && (method === 'Target.detachedFromTarget' ? activeRequest.sessionId === params.sessionId
-                : method === 'Inspector.detached' ? activeRequest.sessionId === sessionId
-                    : activeRequest.sessionId === sessionId && activeRequest.frameId === params.frameId))
-                activeRequest.attempt.stop();
-            if (method !== 'Page.frameDetached') {
-                const detached = method === 'Target.detachedFromTarget' ? params.sessionId : sessionId;
-                detachedSessions.add(detached);
-                // A retry paused there is judged on what was read, and the target a
-                // continued merchant-hosted request went out on is gone before its answer arrived.
-                for (const waiting of [...retriesAwaitingReport.values()])
-                    if (sessionDetached(waiting.sessionId))
-                        waiting.reported();
-                if (handoffNetwork && detached === handoffNetwork.sessionId)
-                    merchantHandoff.failed();
-                if (arming.has(detached))
-                    failInterception(new CheckoutAttachmentError('closed'));
-                // Terminating a worker need not emit loadingFailed. Its nested workers
-                // also lose their request. An unknown request waits for attribution;
-                // detaching an unrelated sibling must never cancel the card approval.
-                const source = activeRequest?.sourceSessionId;
-                if (activeRequest && (sessionDetached(activeRequest.sessionId) || (source && sessionDetached(source))))
-                    activeRequest.attempt.stop();
-                for (const [key, record] of requestSources)
-                    if (sessionDetached(record.sessionId)) {
-                        retireSource(record);
-                        requestSources.delete(key);
-                    }
-            }
-            return;
-        }
-        if (method === 'Target.attachedToTarget') {
-            const child = params.sessionId;
-            if (rejectedSessions.has(child))
-                return;
-            // A browser-root transport can report another context through an owned
-            // parent session. Release its debugger wait without enrolling it in this
-            // checkout. Remember the exclusion before awaiting cleanup: a duplicate
-            // event with omitted context metadata must never acquire ownership.
-            const childContext = params.targetInfo?.browserContextId;
-            if (contextId(childContext) && childContext !== merchantContext) {
-                if (typeof child !== 'string' || !child || child === pageSessionId
-                    || ownedSessions.has(child) || detachedSessions.has(child))
-                    return;
-                rejectedSessions.add(child);
-                // Owned setup may already have stopped. Foreign cleanup has its own
-                // deadline so rejection cannot freeze an unrelated frame or worker.
-                const cleanupStop = new AbortController();
-                const cleanup = (method, params, session) => withinAttachmentDeadline(async () => {
-                    await cdp.send(method, params, session);
-                }, setupTimeoutMs, cleanupStop.signal);
-                await cleanup('Runtime.runIfWaitingForDebugger', {}, child).catch(() => cleanup('Target.detachFromTarget', { sessionId: child }, sessionId).catch(() => { }));
-                return;
-            }
-            if (setupStop.signal.aborted)
-                return;
-            // CDP may omit the context ID for ordinary children; keep those attached.
-            try {
-                if (typeof child !== 'string' || !child || !['page', 'iframe', 'worker'].includes(params.targetInfo?.type)) {
-                    throw new CheckoutAttachmentError('unavailable');
-                }
-                if (child === pageSessionId || detachedSessions.has(child) || (ownedSessions.has(child)
-                    && (sessionParents.get(child) !== sessionId || sessionTypes.get(child) !== params.targetInfo.type))) {
-                    throw new CheckoutAttachmentError('unavailable');
-                }
-                ownedSessions.add(child);
-                sessionTypes.set(child, params.targetInfo.type);
-                sessionParents.set(child, sessionId);
-                if (params.targetInfo.type === 'worker') {
-                    const owner = workerOwners.get(sessionId) ?? sessionId;
-                    workerOwners.set(child, owner);
-                    ownersWithWorkers.add(owner);
-                }
-                await arm(child, true, params.targetInfo.type === 'worker');
-            }
-            catch (error) {
-                // Shared child setup and sibling cancellation can reject several
-                // handlers together. Publish the terminal setup failure only once.
-                failInterception(error);
-                // Leave this target paused: resuming an unarmed card frame would silently bypass the vault.
-                return;
-            }
-            return;
-        }
-        if (method !== 'Fetch.requestPaused')
-            return;
-        const { requestId, request, resourceType, networkId, frameId } = params;
-        // When this request paused: the merchant's total is read as of this moment.
-        const pausedAt = Date.now();
-        // One pre-claim gate registry decides and performs the mechanics through
-        // these effects; the state accessors read the same closure variables the
-        // inline gates did. It resolves synchronously for an ordinary card request,
-        // so activeRequest is still set in the paused request's own microtask. Only
-        // a pause hands work back to the claim flow below.
-        const preClaimResult = dispatchPreClaim({
-            // headers and body are read lazily, inside the gate that needs them (see PreClaimContext.request).
-            request: { url: request.url, method: request.method, get headers() { return request.headers; }, get body() { return pausedBody(request); } },
-            vault: opts.vault, guards, mercado: mercadoCheckout, stripe: stripeCheckout,
-            readDocumentUrl, lifecycle, preparationGate, onEvent: opts.onEvent, failureSummary,
-            effects: {
-                continueRequest: (postData) => cdp.send('Fetch.continueRequest', { requestId, ...(postData !== undefined ? { postData: Buffer.from(postData).toString('base64') } : {}) }, sessionId),
-                answer: (response) => cdp.send('Fetch.fulfillRequest', { requestId, responseCode: response.status,
-                    responseHeaders: Object.entries(withCorsHeaders(response.headers, corsHeadersFor(request.url, request.headers)))
-                        .map(([name, value]) => ({ name, value })),
-                    body: Buffer.from(response.body).toString('base64') }, sessionId),
-                abort: () => cdp.send('Fetch.failRequest', { requestId, errorReason: 'Aborted' }, sessionId).catch(() => { }),
-            },
-            attachmentReady: () => attachmentReady,
-            interceptionAborted: () => setupStop.signal.aborted,
-            lifecycleAborted: () => lifecycle.abort.signal.aborted,
-            terminal: () => !!terminal,
-            documentClosed: () => false,
-            stripeAttachmentBusy: () => arming.has(sessionId ?? '__root__'),
-            requestInactive: () => false,
-            awaitingApproval: () => awaitingApproval,
-            stripeStep: null,
-            merchantHandoff: { retried: (profile) => merchantHandoff.retried(profile, (judge) => awaitRetryReport(sessionId, networkId, judge)) },
-        });
-        const preClaim = preClaimResult instanceof Promise ? await preClaimResult : preClaimResult;
-        if (preClaim.kind !== 'pause')
-            return;
-        const stripeStep = preClaim.stripeStep;
-        if (!attachmentReady || arming.has(sessionId ?? '__root__') || setupStop.signal.aborted) {
-            opts.onEvent?.({ type: 'blocked', detail: 'checkout_interception_not_ready' });
-            await cdp.send('Fetch.failRequest', { requestId, errorReason: 'Aborted' }, sessionId).catch(() => { });
-            return;
-        }
-        let preparation;
-        try {
-            preparation = stripeStep ? undefined : preparationGate.claim(request.url, pausedBody(request), request.headers);
-        }
-        catch (error) {
-            opts.onEvent?.({ type: 'blocked', detail: failureSummary(error) });
-            await cdp.send('Fetch.failRequest', { requestId, errorReason: 'Aborted' }, sessionId).catch(() => { });
-            return;
-        }
-        // The page asking again for the purchase an outstanding approval is for:
-        // its own request timed out while the cardholder decides (see
-        // merchantAttempt). Bind it to that approval instead of refusing it or
-        // raising a second prompt. A request that is not the same purchase falls
-        // through to the ordinary refusal below.
-        if (awaitingApproval && activeRequest?.attempt.lost && !terminal && !setupStop.signal.aborted && !lifecycle.isCancelled()
-            && typeof networkId === 'string' && networkId) {
-            const retryBody = pausedBody(request);
-            const retry = retryBody === null ? null : requestIdentity(opts, request.url, request.method, retryBody, documentKey(await documentUrlOf(readDocumentUrl, lifecycle.abort.signal)), await pageAmountOf(opts));
-            if (retry && activeRequest?.attempt.lost && sameCheckoutRequest(activeRequest.identity, retry)) {
-                if (preparation)
-                    preparationGate.retireUnboundClaim();
-                activeRequest.requestId = requestId;
-                activeRequest.networkId = networkId;
-                activeRequest.sessionId = sessionId;
-                activeRequest.frameId = frameId;
-                activeRequest.request = request;
-                activeRequest.sourceSessionId = undefined;
-                opts.onEvent?.({ type: 'card_request_paused', detail: { url: eventUrl(opts.vault, request.url), ...(resourceType ? { resourceType } : {}),
-                        authorizationId: lifecycle.getState().authorizationId, retry: true } });
-                activeRequest.attempt.bind({ requestId, sessionId, request });
-                return;
-            }
-        }
-        // A request the catalog marks as routine without a card (a confirmation
-        // token for a saved method, a bank source, a Checkout Session confirm with
-        // the method hosted Checkout created) was never ours: it continues in
-        // every state, like a request the catalog does not recognize. One without
-        // a card anywhere else is judged after the holds below.
-        const continuationBody = pausedBody(request);
-        const withoutCard = stripeStep ? null : opts.vault.withoutCard?.(request.url, continuationBody) ?? null;
-        if (withoutCard === 'continue') {
-            if (preparation)
-                preparationGate.retireUnboundClaim();
-            await cdp.send('Fetch.continueRequest', { requestId }, sessionId).catch(() => { });
-            return;
-        }
-        // Not gated on awaitingApproval: the page can send this confirmation while
-        // the token's own delivery is still being acknowledged. The lifecycle
-        // opens the claim only once a Stripe tokenization is being handed over.
-        const continuationId = stripeStep || terminal ? null
-            : claimStripeContinuation(opts, lifecycle, request.url, request.method, continuationBody);
-        if (continuationId) {
-            if (preparation)
-                preparationGate.retireUnboundClaim();
-            if (await checkStripeContinuation(opts, lifecycle, continuationId, { url: request.url, method: request.method, headers: request.headers, body: continuationBody }) && !setupStop.signal.aborted) {
-                await cdp.send('Fetch.continueRequest', { requestId }, sessionId).catch(() => { });
-                return;
-            }
-            await cdp.send('Fetch.failRequest', { requestId, errorReason: 'Aborted' }, sessionId).catch(() => { });
-            return;
-        }
-        // Same stop condition as the Playwright adapter: once a failure proves
-        // retrying is pointless, fail the request without calling the API again.
-        if (terminal || lifecycle.isBlocked() || awaitingApproval || Date.now() < quietUntil) {
-            let repeatedAuthorizationId = null;
-            if (lastSubmitted) {
-                const body = pausedBody(request);
-                if (body !== null && isRepeatOfSubmitted(lastSubmitted, request.url, body, repeatQuietMs)) {
-                    repeatedAuthorizationId = lastSubmitted.authorizationId;
-                }
-            }
-            const why = terminal ?? (lifecycle.isBlocked() ? lifecycle.getState().status : awaitingApproval ? 'an approval is already outstanding' : 'awaiting approval cooldown');
-            opts.onEvent?.({ type: 'blocked', detail: why instanceof Error ? failureSummary(why) : String(why) });
-            if (preparation)
-                preparationGate.retireUnboundClaim();
-            await cdp.send('Fetch.failRequest', { requestId, errorReason: 'Aborted' }, sessionId).catch(() => { });
-            if (repeatedAuthorizationId)
-                void opts.vault.reportDuplicateGuard?.(repeatedAuthorizationId);
-            return;
-        }
-        // A recognized request that carries no card is not a card request: a
-        // Stripe confirmation paying with a method the page created itself. It is
-        // judged only after the holds above, so a request that would reuse an
-        // approved token is still refused there (card-fields.js requestWithoutCard).
-        if (withoutCard === 'refuse') {
-            if (preparation)
-                preparationGate.retireUnboundClaim();
-            opts.onEvent?.({ type: 'blocked', detail: 'request_without_card' });
-            await cdp.send('Fetch.failRequest', { requestId, errorReason: 'Aborted' }, sessionId).catch(() => { });
-            return;
-        }
-        // Reserve BEFORE the first await (the authorize call below yields), so two
-        // requests can never both clear the check above and raise two prompts for
-        // one checkout.
-        awaitingApproval = true;
-        const attempt = merchantAttempt(lifecycle, survivesAbandonment(opts, request.url, request.method, resourceType === 'Document', !!preparation || !!stripeStep || mercadoCheckout.requiresDocument(request.url, request.method)));
-        let handoffStarted = false;
-        // The approval the device gave, and whether it reached a browser request.
-        let approvedId = null;
-        let deliveryBegun = false;
-        try {
-            const body = pausedBody(request);
-            if (body === null) {
-                // Fail closed, but only THIS request: an unreadable body says nothing
-                // about the page's configuration, so the next request is judged
-                // afresh (no latch, no cooldown).
-                opts.onEvent?.({ type: 'failed', detail: BODY_UNREADABLE_REASON });
-                await cdp.send('Fetch.failRequest', { requestId, errorReason: 'Aborted' }, sessionId).catch(() => { });
-                return;
-            }
-            // The body is needed to tell a re-post of the form the cardholder
-            // already submitted from a new one, so this check sits after the read
-            // and before any API call: no second prompt, no round trip.
-            if (isRepeatOfSubmitted(lastSubmitted, request.url, body, repeatQuietMs)) {
-                opts.onEvent?.({ type: 'blocked', detail: HOSTED_FORM_REPEAT_REASON });
-                await cdp.send('Fetch.failRequest', { requestId, errorReason: 'Aborted' }, sessionId).catch(() => { });
-                if (lastSubmitted)
-                    void opts.vault.reportDuplicateGuard?.(lastSubmitted.authorizationId);
-                return;
-            }
-            opts.onEvent?.({ type: 'card_request_paused', detail: { url: eventUrl(opts.vault, request.url), ...(resourceType ? { resourceType } : {}) } });
-            lifecycle.begin();
-            const approvalStartedAt = Date.now();
-            const payToInterceptMs = readPayToInterceptMs(opts.payClickedAt, approvalStartedAt);
-            if (typeof networkId !== 'string' || !networkId) {
-                attempt.stop();
-                attempt.assertLive();
-            }
-            attempt.bind({ requestId, sessionId, request });
-            activeRequest = { attempt, requestId, networkId, sessionId, frameId, request,
-                identity: requestIdentity(opts, request.url, request.method, body, undefined, undefined) };
-            await awaitRequestSource(activeRequest);
-            if (preparation)
-                await preparationGate.assertDocument();
-            // One bounded read of the document serves both the merchant origin and
-            // the identity a retry has to repeat (see sameCheckoutRequest).
-            const documentUrl = await documentUrlOf(readDocumentUrl, attempt.signal);
-            const pageOrigin = pageOriginFrom(documentUrl);
-            const pageAmount = await pageAmountOf(opts);
-            attempt.assertLive();
-            activeRequest.identity.documentUrl = documentKey(documentUrl);
-            activeRequest.identity.pageAmount = pageAmount;
-            activeRequest.identity.amountEvidence ||= pageAmount !== undefined;
-            if (stripeStep)
-                stripeCheckout.assertClaim(stripeStep);
-            const merchantOrigin = preparation?.merchantOrigin ?? (opts.executionMode === 'user_approval'
-                ? opts.merchantOrigin : pageOrigin?.startsWith('https:') ? pageOrigin : opts.merchantOrigin);
-            attempt.assertLive();
-            // The card request's page is its own Network event's document, and Chromium can deliver
-            // that event after the pause: for a profile the merchant's total prices, wait for it
-            // (bounded), so a total tied to its page (Cinemark) is not refused for want of one.
-            const cardKey = requestKey(activeRequest?.sourceSessionId ?? sessionId ?? '', networkId ?? '');
-            const cardPage = merchantTotal.priced(request.url)
-                ? await merchantTotal.pageFor(cardKey, MERCHANT_PAGE_WAIT_MS, attempt.signal) : merchantTotal.pageOf(cardKey);
-            attempt.assertLive();
-            const replay = await opts.vault.authorize({
-                user: opts.user,
-                merchant: opts.merchant,
-                amount: opts.amount,
-                currency: opts.currency,
-                cardId: preparation?.cardId ?? opts.cardId,
-                executionMode: opts.executionMode,
-                grantId: opts.grantId,
-                stripeCheckoutEnvironment: opts.stripeCheckout?.environment,
-                merchantOrigin,
-                pageOrigin,
-                pageAmount,
-                ...(payToInterceptMs !== undefined ? { payToInterceptMs } : {}),
-                preparation,
-                timeoutMs: opts.timeoutMs,
-                signal: lifecycle.abort.signal,
-                merchantSignal: attempt.signal,
-                // What the merchant's own checkout said its total was, as this browser recorded it
-                // (read only for a reviewed profile priced by it): the page is the card request's.
-                merchantTotal: merchantTotal.capture(pausedAt, cardPage),
-                onAuthorizationCreated: (id) => lifecycle.approvalCreated(id),
-                onApprovalUrl: (url) => { if (!preparation && !attempt.signal.aborted) {
-                    lifecycle.approvalUrl(url);
-                    return opts.onApprovalUrl?.(url);
-                } },
-                request: stripeStep?.phase === 'final' ? stripeStep.request : { url: request.url, method: request.method, headers: request.headers, body,
-                    ...(mercadoCheckout.requiresDocument(request.url, request.method)
-                        ? { mercado_checkout: mercadoCheckout.claimToken(request.url, request.method, await readDocumentUrl()) } : {}) },
-            });
-            attempt.assertLive();
-            approvedId = replay.authorizationId;
-            if (lifecycle.isCancelled())
-                throw new Error('checkout cancelled locally after approval');
-            try {
-                await mercadoCheckout.arm(replay, request.url);
-            }
-            catch {
-                throw new PaymentOutcomeUnknownError(replay.authorizationId, 'mercado_checkout_metadata_invalid');
-            }
-            attempt.assertLive();
-            // The request to answer: the one that raised the approval while it is
-            // still paused, or the page's retry when the page gave up on the first
-            // (waited for, bounded; see merchantAttempt.awaitTarget). A retry is
-            // attributed to its frame or worker exactly as the first request was.
-            const delivery = await attempt.awaitTarget(boundedRetryWait(retryWait, approvalStartedAt, opts.timeoutMs), [lifecycle.abort.signal, setupStop.signal], () => {
-                lifecycle.awaitingMerchantRetry(replay.authorizationId);
-                opts.onEvent?.({ type: 'approval_awaiting_merchant_retry', detail: { authorizationId: replay.authorizationId } });
-            });
-            if (delivery.rebound) {
-                await awaitRequestSource(activeRequest);
-                attempt.assertLive();
-            }
-            const { requestId: deliverTo, sessionId: deliverOn, request: deliverRequest } = delivery.target;
-            const deliverBody = delivery.rebound ? pausedBody(deliverRequest) ?? body : body;
-            deliveryBegun = true;
-            attempt.beginDelivery();
-            lifecycle.prepareHandoff(replay, deliverRequest.url);
-            handoffStarted = replay.mode !== 'cse';
-            if (replay.mode === 'hosted_form') {
-                // The device submitted the processor's own form; the processor
-                // answered the device. The paused NAVIGATION is fulfilled with a page
-                // that says exactly that (see hosted-form.ts for why not an abort and
-                // why not a fake result page), and the same form is refused if the
-                // page posts it again.
-                const page = hostedFormSubmittedPage({ authorizationId: replay.authorizationId, merchant: opts.merchant, submittedAt: replay.submittedAt });
-                // A navigation response is never CORS-checked, so the CORS wrap is
-                // inert here; it is applied so every fulfill goes through one path.
-                await cdp.send('Fetch.fulfillRequest', {
-                    requestId: deliverTo,
-                    responseCode: page.status,
-                    responseHeaders: headerEntries(withCorsHeaders(page.headers, corsHeadersFor(deliverRequest.url, deliverRequest.headers))),
-                    body: Buffer.from(page.body).toString('base64'),
-                }, deliverOn);
-                attempt.assertLive();
-                lastSubmitted = { url: deliverRequest.url, body: deliverBody, at: Date.now(), authorizationId: replay.authorizationId };
-                // Named for what it is: a device-attested submission with no
-                // processor evidence, never an `authorized` event.
-                opts.onEvent?.({ type: 'submitted_on_device', detail: { authorizationId: replay.authorizationId, submittedAt: replay.submittedAt, outcome: replay.outcome } });
-            }
-            else if (replay.mode === 'cse') {
-                // The device encrypted the card for the processor; the request itself
-                // still goes out from THIS browser, with its own session, risk data
-                // and cookies, and only the four ciphertext fields swapped in. Only
-                // postData rides on the command: no header override, ever (see
-                // cse-body.ts for why a recomputed Content-Length is refused by Chromium).
-                // A total the merchant moved while the cardholder decided holds the card here.
-                if (replay.kind === 'merchant_hosted')
-                    await merchantTotal.release(replay, opts.vault, attempt.signal);
-                attempt.assertLive();
-                const postData = Buffer.from(cseContinuationBody(opts, deliverBody, replay, deliverRequest.url, preparation)).toString('base64');
-                handoffStarted = true;
-                if (replay.kind === 'merchant_hosted') {
-                    // Watched from before the continue, so an answer that races the command is still read.
-                    merchantHandoff.begin(replay.profile, replay.authorizationId, replayTemplatedUrl(replay, deliverRequest.url));
-                    handoffNetwork = { sessionId: activeRequest?.sourceSessionId ?? deliverOn, networkId: activeRequest?.networkId ?? '' };
-                    handoffReplay = replay;
-                }
-                await cdp.send('Fetch.continueRequest', {
-                    requestId: deliverTo,
-                    postData,
-                }, deliverOn);
-                attempt.assertLive();
-                opts.onEvent?.({ type: 'authorized', detail: cseAuthorizedDetail(replay, deliverRequest.url) });
-            }
-            else {
-                // The processor's answer, handed to the page as if the processor had
-                // sent it. Cross-origin, the browser then runs its CORS check on it:
-                // see corsHeadersFor for why the answer has to carry the headers. The
-                // decision rides on the event, so a fulfill the page could not read
-                // (no usable Origin on a cross-origin request) is visible in telemetry
-                // rather than only as the page's own "connection error".
-                const cors = corsDecision(deliverRequest.url, deliverRequest.headers);
-                await cdp.send('Fetch.fulfillRequest', {
-                    requestId: deliverTo,
-                    responseCode: replay.status,
-                    responseHeaders: headerEntries(withCorsHeaders(replay.headers, cors.headers)),
-                    body: Buffer.from(replay.body).toString('base64'),
-                }, deliverOn);
-                attempt.assertLive();
-                opts.onEvent?.({ type: 'authorized', detail: { mode: 'token', authorizationId: replay.authorizationId, amountVerified: replay.amountVerified ?? null, cors: cors.outcome } });
-            }
-            lifecycle.handedOff(replay);
-        }
-        catch (err) {
-            // Ignore the failure event caused by our own safe decline/error abort.
-            const dead = attempt.target ?? { requestId, sessionId };
-            if (activeRequest?.attempt === attempt)
-                activeRequest = null;
-            // Vault clients may normalize a merchantSignal abort. Preserve the
-            // adapter's more precise cause when ownership became ambiguous.
-            try {
-                attempt.assertLive();
-            }
-            catch (stopped) {
-                err = stopped;
-            }
-            if (err instanceof MerchantNeverRetried || (attempt.signal.aborted && approvedId && !deliveryBegun)) {
-                // The device approved and no request ever carried the answer: the
-                // page never asked again, or went away while the approval waited.
-                // Retire it (see retireUnusedApproval) and quiet the page's next
-                // request as after any other answered approval.
-                await retireUnusedApproval(opts, lifecycle, approvedId);
-                quietUntil = Date.now() + cooldownMs;
-            }
-            else {
-                // stop() already published the terminal state before aborting the Vault.
-                if (!attempt.signal.aborted)
-                    lifecycle.failed(err, handoffStarted);
-                if (isTerminal(err))
-                    terminal = err;
-                else if (isApprovalOutcome(err))
-                    quietUntil = Date.now() + cooldownMs;
-                opts.onEvent?.({ type: 'failed', detail: failureSummary(err) });
-            }
-            await cdp.send('Fetch.failRequest', { requestId: dead.requestId, errorReason: 'Aborted' }, dead.sessionId).catch(() => { });
-        }
-        finally {
-            if (activeRequest?.attempt === attempt)
-                activeRequest = null;
-            awaitingApproval = false;
-            lifecycle.end();
-            if (preparation)
-                preparationGate.retireUnboundClaim();
-        }
-    });
-    try {
-        await withinAttachmentDeadline(async (assertActive) => {
-            const { targetInfo } = await cdp.send('Target.getTargetInfo', {}, pageSessionId);
-            assertActive();
-            if (!targetRecord(targetInfo) || targetInfo.type !== 'page'
-                || (targetInfo.browserContextId !== undefined && !contextId(targetInfo.browserContextId))) {
-                throw new CheckoutAttachmentError('unavailable');
-            }
-            merchantContext = targetInfo.browserContextId;
-            targetContextKnown = true;
-            await cdp.send('Target.setDiscoverTargets', { discover: true });
-            assertActive();
-            const { targetInfos } = await cdp.send('Target.getTargets');
-            assertActive();
-            if (!Array.isArray(targetInfos))
-                throw new CheckoutAttachmentError('unavailable');
-            for (const target of targetInfos)
-                assertContextTarget(target, merchantContext);
-            await arm(pageSessionId);
-            // Existing OOPIFs report attachment before the parent's acknowledgement,
-            // but their Fetch setup finishes later. Do not invite the caller to press
-            // Pay while one of those already-running frames is still unprotected.
-            while (arming.size)
-                await Promise.all(arming.values());
-            assertActive();
-        }, setupTimeoutMs, setupStop.signal);
-        if (setupStop.signal.aborted)
-            throw attachmentFailure(setupStop.signal.reason);
-        attachmentReady = true;
-        opts.onEvent?.({ type: 'fetch_armed', detail: { patterns: urlPatterns } });
-    }
-    catch (error) {
-        const failure = attachmentFailure(error);
-        setupStop.abort(failure);
-        terminal = failure;
-        if (!setupFailureReported) {
-            setupFailureReported = true;
-            lifecycle.cancel();
-            opts.onEvent?.({ type: 'failed', detail: `checkout_attachment_${failure.reason}` });
-        }
-        throw failure;
-    }
-    return lifecycle;
-}
-/**
- * Playwright convenience wrapper — the path for cloud browsers that hand you a
- * CDP websocket (Kernel's `cdp_ws_url`, Browserbase, etc.):
- *
- *   const browser = await chromium.connectOverCDP(kernelBrowser.cdp_ws_url);
- *   const page = await browser.contexts()[0].newPage();
- *   await attachToPlaywright(page, { vault, user, merchant, amount });
- *
- * Uses Playwright's own request routing, which already spans subframes — see
- * the note in the body for why a hand-rolled CDPSession does not work here.
- */
-export async function attachToPlaywright(page, opts) {
-    opts = safeOptions(opts);
-    const setupTimeoutMs = attachmentDeadline(opts.attachmentTimeoutMs);
-    const setupStop = new AbortController();
-    let attachmentReady = false;
-    // Routing cannot see requests owned by a service worker. Existing controlled
-    // contexts must be recreated with serviceWorkers: 'block' before checkout.
-    if (page.context?.().serviceWorkers?.().length) {
-        throw new Error('Service workers are active; use a checkout context created with serviceWorkers: "block".');
-    }
-    const lifecycle = new CheckoutLifecycle(opts);
-    const stripeCheckout = new StripeCheckoutGate(opts);
-    const mercadoCheckout = new MercadoCheckoutGate();
-    const readDocumentUrl = async () => {
-        if (page.isClosed?.() || typeof page.url !== 'function')
-            throw new Error('merchant_document_unavailable');
-        return page.url();
-    };
-    const preparationGate = new PreparationGate(opts, lifecycle, readDocumentUrl);
-    // A merchant-hosted request this attachment continued, and its answer; see watchPlaywrightHandoff.
-    const merchantHandoff = new MerchantHandoffWatch(lifecycle, opts.onEvent);
-    let handoffAnswer = null;
-    // The merchant's own total, as attachToCdp records it. A page id is the main frame's
-    // document: it changes when the main frame commits a new document, and a document request
-    // belongs to the document it loads, so its page is read once the frame has committed it.
-    // A same-document navigation (history.pushState, a hash change) fires framenavigated too
-    // but sends no document request, so it keeps the page id, as CDP's loaderId does. Nor does
-    // a document request that commits nothing: one that failed, or one answered 204 or 205.
-    const merchantTotal = new MerchantTotalWatch(opts.onEvent, opts.vault);
-    let documentSerial = 1;
-    // The main frame's document request that no navigation has committed yet.
-    let documentRequest = null;
-    let requestSerial = 0;
-    const requestKeys = new WeakMap();
-    const keyOf = (request) => {
-        let key = requestKeys.get(request);
-        if (!key) {
-            key = `pw:${++requestSerial}`;
-            requestKeys.set(request, key);
-        }
-        return key;
-    };
-    const mainDocument = (request) => {
-        try {
-            return request.isNavigationRequest?.() === true && request.frame?.() === page.mainFrame?.();
-        }
-        catch {
-            return false;
-        }
-    };
-    page.on?.('request', (request) => {
-        // A new document is on its way: the main frame's next navigation commits it.
-        if (mainDocument(request))
-            documentRequest = request;
-        try {
-            const body = typeof request.postData === 'function' ? request.postData() : null;
-            merchantTotal.sent(keyOf(request), { method: request.method(), url: request.url(),
-                ...(typeof body === 'string' ? { requestBody: body } : {}), page: `doc:${documentSerial}` });
-        }
-        catch { /* a request the page already dropped */ }
-    });
-    page.on?.('requestfinished', (request) => {
-        // A document answered 204 or 205 loads nothing, so no navigation will commit it.
-        if (request === documentRequest) {
-            Promise.resolve().then(() => request.response()).then((response) => {
-                if (request === documentRequest && [204, 205].includes(response?.status?.()))
-                    documentRequest = null;
-            }).catch(() => { });
-        }
-        const key = keyOf(request);
-        if (!merchantTotal.log.tracks(key))
-            return;
-        const completedAt = Date.now();
-        Promise.resolve().then(async () => {
-            const response = await request.response();
-            if (!response) {
-                merchantTotal.log.failed(key);
-                return;
-            }
-            merchantTotal.log.answered(key, response.status());
-            if (mainDocument(request))
-                merchantTotal.log.repage(key, `doc:${documentSerial}`);
-            let text = null;
-            try {
-                text = await response.text();
-            }
-            catch {
-                text = null;
-            }
-            merchantTotal.log.read(key, text, completedAt);
-        }).catch(() => merchantTotal.log.failed(key));
-    });
-    const guards = paymentEndpointGuards(opts.paymentEndpoints);
-    // Playwright's own routing, NOT a hand-rolled CDP session.
-    //
-    // A CDPSession from `newCDPSession(page)` is bound to the PAGE target and its
-    // send() takes no session id, so every command meant for an attached child
-    // target lands on the page instead — the nested card iframes are never armed
-    // and the tokenization request sails past. Card fields are cross-origin
-    // iframes essentially always, so that adapter was broken for the only case
-    // that matters.
-    //
-    // page.route already spans subframes, so Playwright does the target
-    // bookkeeping that attachToCdp has to do by hand for a raw connection.
-    // Set once a failure proves that retrying cannot help. The page is free to
-    // keep retrying; we simply stop asking the API and fail the request outright.
-    let terminal = null;
-    // Silence window after a person declined or ignored one; see APPROVAL_COOLDOWN_MS.
-    const cooldownMs = opts.approvalCooldownMs ?? APPROVAL_COOLDOWN_MS;
-    let quietUntil = 0;
-    // One outstanding approval at a time; see the note above isApprovalOutcome.
-    let awaitingApproval = false;
-    // How long an approval waits for the page to ask again; see MERCHANT_RETRY_WAIT_MS.
-    const retryWait = retryWaitMs(opts.merchantRetryWaitMs);
-    let activeRequest = null;
-    page.on?.('requestfailed', (request) => {
-        // A document request that failed commits nothing either.
-        if (request === documentRequest)
-            documentRequest = null;
-        merchantTotal.log.failed(keyOf(request));
-        if (activeRequest && activeRequest.request === request && activeRequest.attempt.lose()) {
-            // The page's own script gave up on its request; the cardholder's
-            // approval did not (see merchantAttempt). Forget the request's identity
-            // so no later event on it can pass for the retry's.
-            activeRequest.request = null;
-            activeRequest.frames = [];
-            opts.onEvent?.({ type: 'merchant_request_lost', detail: { authorizationId: lifecycle.getState().authorizationId } });
-        }
-    });
-    page.on?.('close', () => { if (!attachmentReady)
-        setupStop.abort(new CheckoutAttachmentError('closed')); preparationGate.invalidate('merchant_document_closed'); stripeCheckout.invalidate(); mercadoCheckout.invalidate(); activeRequest?.attempt.stop(); handoffAnswer?.closed(); });
-    page.on?.('crash', () => { if (!attachmentReady)
-        setupStop.abort(new CheckoutAttachmentError('closed')); preparationGate.invalidate('merchant_document_closed'); stripeCheckout.invalidate(); mercadoCheckout.invalidate(); activeRequest?.attempt.stop(); handoffAnswer?.closed(); });
-    page.on?.('framenavigated', (frame) => {
-        if (frame === page.mainFrame?.()) {
-            if (documentRequest) {
-                documentRequest = null;
-                documentSerial += 1;
-            }
-            preparationGate.invalidate('merchant_document_changed');
-            mercadoCheckout.invalidate();
-            if (stripeCheckout.isPrepared()) {
-                stripeCheckout.invalidate();
-                activeRequest?.attempt.stop();
-            }
-            if (preparationGate.isEngaged())
-                activeRequest?.attempt.stop();
-            // The page that abandoned its request has moved to another document:
-            // its approval cannot be answered there and is cancelled. A reload of
-            // the same document is not that; its re-issued request is the retry.
-            let url;
-            try {
-                url = typeof frame.url === 'function' ? frame.url() : undefined;
-            }
-            catch {
-                url = undefined;
-            }
-            if (activeRequest?.attempt.lost && documentKey(url) !== activeRequest.identity.documentUrl)
-                activeRequest.attempt.stop();
-        }
-    });
-    page.on?.('framedetached', (frame) => {
-        if (activeRequest?.frames.includes(frame))
-            activeRequest.attempt.stop();
-    });
-    // The hosted form the cardholder already submitted; see HOSTED_FORM_REPEAT_QUIET_MS.
-    const repeatQuietMs = opts.hostedFormRepeatQuietMs ?? HOSTED_FORM_REPEAT_QUIET_MS;
-    let lastSubmitted = null;
-    const install = async (assertActive) => {
-        if (page.isClosed?.()) {
-            const failure = new CheckoutAttachmentError('closed');
-            setupStop.abort(failure);
-            throw failure;
-        }
-        await page.route((url) => opts.vault.isCardRequest(url.toString()) || guards.matches(url.toString()) || stripeCheckout.matches(url.toString()) || mercadoCheckout.matches(url.toString())
-            // An armed merchant profile's endpoint or a sibling of it (merchant-hosted.ts), as attachToCdp arms it.
-            || (typeof opts.vault.merchantProfileOf === 'function' && opts.vault.merchantProfileOf(url.toString()) !== null), async (route) => {
-            const request = route.request();
-            // When this request paused, and the page it came from: the merchant's total is read as of now.
-            const pausedAt = Date.now();
-            const pausedPage = merchantTotal.pageOf(keyOf(request)) ?? `doc:${documentSerial}`;
-            // One pre-claim gate registry decides and performs the mechanics through
-            // Playwright's own routing; the accessors read the same state the inline
-            // gates did. The matcher only sees the URL, so a preflight, a GET, or any
-            // non-card body continues untouched (route.fallback) or the browser's CORS
-            // check fails on a synthetic answer. It resolves synchronously for an
-            // ordinary card request. Only a pause hands work back below.
-            const preClaimResult = dispatchPreClaim({
-                // headers() and postData() are read lazily, inside the gate that needs them (see
-                // PreClaimContext.request): a Playwright request mock without headers() and no Stripe checkout
-                // never invokes it, and a body Playwright cannot read stops a Mercado checkout the way it did inline.
-                request: { url: request.url(), method: request.method(), get headers() { return request.headers(); }, get body() { return request.postData(); } },
-                vault: opts.vault, guards, mercado: mercadoCheckout, stripe: stripeCheckout,
-                readDocumentUrl, lifecycle, preparationGate, onEvent: opts.onEvent, failureSummary,
-                effects: {
-                    continueRequest: (postData) => postData !== undefined ? route.continue({ postData }) : route.fallback(),
-                    answer: (response) => route.fulfill({ ...response,
-                        headers: withCorsHeaders(response.headers, corsHeadersFor(request.url(), request.headers())) }),
-                    abort: () => route.abort('aborted'),
-                },
-                attachmentReady: () => attachmentReady,
-                interceptionAborted: () => setupStop.signal.aborted,
-                lifecycleAborted: () => lifecycle.abort.signal.aborted,
-                terminal: () => !!terminal,
-                documentClosed: () => !!page.isClosed?.(),
-                stripeAttachmentBusy: () => false,
-                requestInactive: () => !!(page.isClosed?.() || request.failure?.()),
-                awaitingApproval: () => awaitingApproval,
-                stripeStep: null,
-                // This route arrives after every answer the page read before sending it; only an unfollowed 3xx is left to settle.
-                merchantHandoff: { retried: (profile) => merchantHandoff.retried(profile, () => { handoffAnswer?.settle(); return false; }) },
-            });
-            const preClaim = preClaimResult instanceof Promise ? await preClaimResult : preClaimResult;
-            if (preClaim.kind !== 'pause')
-                return;
-            const stripeStep = preClaim.stripeStep;
-            if (!attachmentReady || setupStop.signal.aborted) {
-                opts.onEvent?.({ type: 'blocked', detail: 'checkout_interception_not_ready' });
-                return route.abort('aborted');
-            }
-            let preparation;
-            try {
-                preparation = stripeStep ? undefined : preparationGate.claim(request.url(), request.postData() ?? '', request.headers());
-            }
-            catch (error) {
-                opts.onEvent?.({ type: 'blocked', detail: failureSummary(error) });
-                return route.abort('aborted');
-            }
-            // The page asking again for the purchase an outstanding approval is
-            // for, after its own request timed out: bind it to that approval (see
-            // merchantAttempt and the same check in attachToCdp).
-            if (awaitingApproval && activeRequest?.attempt.lost && !terminal && !setupStop.signal.aborted && !lifecycle.isCancelled()) {
-                const retry = requestIdentity(opts, request.url(), request.method(), request.postData() ?? '', documentKey(await documentUrlOf(readDocumentUrl, lifecycle.abort.signal)), await pageAmountOf(opts));
-                if (activeRequest?.attempt.lost && sameCheckoutRequest(activeRequest.identity, retry)) {
-                    if (preparation)
-                        preparationGate.retireUnboundClaim();
-                    const retryFrames = [];
-                    try {
-                        for (let frame = request.frame?.(); frame; frame = frame.parentFrame?.())
-                            retryFrames.push(frame);
-                    }
-                    catch { /* covered by requestfailed */ }
-                    activeRequest.request = request;
-                    activeRequest.frames = retryFrames;
-                    opts.onEvent?.({ type: 'card_request_paused', detail: { url: eventUrl(opts.vault, request.url()), authorizationId: lifecycle.getState().authorizationId, retry: true } });
-                    activeRequest.attempt.bind({ route, request, frames: retryFrames });
-                    return;
-                }
-            }
-            // Same order as attachToCdp: a routine card-free request continues in every state.
-            const continuationBody = request.postData();
-            const withoutCard = stripeStep ? null : opts.vault.withoutCard?.(request.url(), continuationBody) ?? null;
-            if (withoutCard === 'continue') {
-                if (preparation)
-                    preparationGate.retireUnboundClaim();
-                return route.fallback();
-            }
-            const continuationId = stripeStep || terminal ? null
-                : claimStripeContinuation(opts, lifecycle, request.url(), request.method(), continuationBody);
-            if (continuationId) {
-                if (preparation)
-                    preparationGate.retireUnboundClaim();
-                if (await checkStripeContinuation(opts, lifecycle, continuationId, { url: request.url(), method: request.method(), headers: request.headers(), body: continuationBody }) && !setupStop.signal.aborted) {
-                    return route.fallback();
-                }
-                return route.abort('aborted');
-            }
-            // Fail closed and stay quiet: no card may reach the PSP, but neither may
-            // the page's retry loop turn into a stream of doomed API calls. Every
-            // abort in this adapter is 'aborted' (ERR_ABORTED), the same code the
-            // CDP adapter's Fetch.failRequest uses, so a refused navigation
-            // resolves identically whichever adapter is attached.
-            if (terminal || lifecycle.isBlocked() || awaitingApproval || Date.now() < quietUntil) {
-                let repeatedAuthorizationId = null;
-                if (lastSubmitted) {
-                    let body = null;
-                    try {
-                        body = request.postData() ?? '';
-                    }
-                    catch { /* The refusal still holds when the body cannot be read. */ }
-                    if (body !== null && isRepeatOfSubmitted(lastSubmitted, request.url(), body, repeatQuietMs)) {
-                        repeatedAuthorizationId = lastSubmitted.authorizationId;
-                    }
-                }
-                const why = terminal ?? (lifecycle.isBlocked() ? lifecycle.getState().status : awaitingApproval ? 'an approval is already outstanding' : 'awaiting approval cooldown');
-                opts.onEvent?.({ type: 'blocked', detail: why instanceof Error ? failureSummary(why) : String(why) });
-                if (preparation)
-                    preparationGate.retireUnboundClaim();
-                const refused = await route.abort('aborted');
-                if (repeatedAuthorizationId)
-                    void opts.vault.reportDuplicateGuard?.(repeatedAuthorizationId);
-                return refused;
-            }
-            // Same judgement as attachToCdp, after the same holds.
-            if (withoutCard === 'refuse') {
-                if (preparation)
-                    preparationGate.retireUnboundClaim();
-                opts.onEvent?.({ type: 'blocked', detail: 'request_without_card' });
-                return route.abort('aborted');
-            }
-            // Reserved before anything that could yield, matching attachToCdp.
-            awaitingApproval = true;
-            let navigation = false;
-            try {
-                navigation = typeof request.resourceType === 'function' && request.resourceType() === 'document';
-            }
-            catch {
-                navigation = false;
-            }
-            const attempt = merchantAttempt(lifecycle, survivesAbandonment(opts, request.url(), request.method(), navigation, !!preparation || !!stripeStep || mercadoCheckout.requiresDocument(request.url(), request.method())));
-            const frames = [];
-            try {
-                for (let frame = request.frame?.(); frame; frame = frame.parentFrame?.())
-                    frames.push(frame);
-            }
-            catch { /* requestfailed/page close still cover unavailable frame metadata */ }
-            // Judged on the request that currently carries the attempt: after a
-            // retry binds, the first request's failure is history, not a loss.
-            const assertRequestLive = () => {
-                const current = attempt.target;
-                if (current && (current.request.failure?.() || current.frames.some((frame) => frame.isDetached?.())))
-                    attempt.lose();
-                if (page.isClosed?.())
-                    attempt.stop();
-                attempt.assertLive();
-            };
-            let handoffStarted = false;
-            // The approval the device gave, and whether it reached a browser request.
-            let approvedId = null;
-            let deliveryBegun = false;
-            try {
-                const body = request.postData() ?? '';
-                if (isRepeatOfSubmitted(lastSubmitted, request.url(), body, repeatQuietMs)) {
-                    opts.onEvent?.({ type: 'blocked', detail: HOSTED_FORM_REPEAT_REASON });
-                    const refused = await route.abort('aborted');
-                    if (lastSubmitted)
-                        void opts.vault.reportDuplicateGuard?.(lastSubmitted.authorizationId);
-                    return refused;
-                }
-                opts.onEvent?.({ type: 'card_request_paused', detail: { url: eventUrl(opts.vault, request.url()) } });
-                lifecycle.begin();
-                const approvalStartedAt = Date.now();
-                const payToInterceptMs = readPayToInterceptMs(opts.payClickedAt, approvalStartedAt);
-                attempt.bind({ route, request, frames });
-                activeRequest = { request, frames, attempt,
-                    identity: requestIdentity(opts, request.url(), request.method(), body, undefined, undefined) };
-                if (preparation)
-                    await preparationGate.assertDocument();
-                // One bounded read serves the merchant origin and the retry identity; see attachToCdp.
-                const documentUrl = await documentUrlOf(readDocumentUrl, attempt.signal);
-                const pageOrigin = pageOriginFrom(documentUrl);
-                const pageAmount = await pageAmountOf(opts);
-                assertRequestLive();
-                activeRequest.identity.documentUrl = documentKey(documentUrl);
-                activeRequest.identity.pageAmount = pageAmount;
-                activeRequest.identity.amountEvidence ||= pageAmount !== undefined;
-                if (stripeStep)
-                    stripeCheckout.assertClaim(stripeStep);
-                const merchantOrigin = preparation?.merchantOrigin ?? (opts.executionMode === 'user_approval'
-                    ? opts.merchantOrigin : pageOrigin?.startsWith('https:') ? pageOrigin : opts.merchantOrigin);
-                assertRequestLive();
-                const replay = await opts.vault.authorize({
-                    user: opts.user,
-                    merchant: opts.merchant,
-                    amount: opts.amount,
-                    currency: opts.currency,
-                    cardId: preparation?.cardId ?? opts.cardId,
-                    executionMode: opts.executionMode,
-                    grantId: opts.grantId,
-                    stripeCheckoutEnvironment: opts.stripeCheckout?.environment,
-                    merchantOrigin,
-                    pageOrigin,
-                    pageAmount,
-                    ...(payToInterceptMs !== undefined ? { payToInterceptMs } : {}),
-                    preparation,
-                    timeoutMs: opts.timeoutMs,
-                    signal: lifecycle.abort.signal,
-                    merchantSignal: attempt.signal,
-                    // Same as the CDP path: the merchant's total as this browser recorded it.
-                    merchantTotal: merchantTotal.capture(pausedAt, pausedPage),
-                    onAuthorizationCreated: (id) => lifecycle.approvalCreated(id),
-                    onApprovalUrl: (url) => { if (!preparation && !attempt.signal.aborted) {
-                        lifecycle.approvalUrl(url);
-                        return opts.onApprovalUrl?.(url);
-                    } },
-                    request: stripeStep?.phase === 'final' ? stripeStep.request : { url: request.url(), method: request.method(), headers: request.headers(), body,
-                        ...(mercadoCheckout.requiresDocument(request.url(), request.method())
-                            ? { mercado_checkout: mercadoCheckout.claimToken(request.url(), request.method(), await readDocumentUrl()) } : {}) },
-                });
-                assertRequestLive();
-                approvedId = replay.authorizationId;
-                if (lifecycle.isCancelled())
-                    throw new Error('checkout cancelled locally after approval');
-                try {
-                    await mercadoCheckout.arm(replay, request.url());
-                }
-                catch {
-                    throw new PaymentOutcomeUnknownError(replay.authorizationId, 'mercado_checkout_metadata_invalid');
-                }
-                assertRequestLive();
-                // The request to answer: the paused one, or the page's retry when the
-                // page gave up on the first (see attachToCdp for the same step).
-                const delivery = await attempt.awaitTarget(boundedRetryWait(retryWait, approvalStartedAt, opts.timeoutMs), [lifecycle.abort.signal, setupStop.signal], () => {
-                    lifecycle.awaitingMerchantRetry(replay.authorizationId);
-                    opts.onEvent?.({ type: 'approval_awaiting_merchant_retry', detail: { authorizationId: replay.authorizationId } });
-                });
-                const { route: deliverTo, request: deliverRequest } = delivery.target;
-                const deliverBody = delivery.rebound ? deliverRequest.postData() ?? '' : body;
-                deliveryBegun = true;
-                attempt.beginDelivery();
-                lifecycle.prepareHandoff(replay, deliverRequest.url());
-                handoffStarted = replay.mode !== 'cse';
-                if (replay.mode === 'hosted_form') {
-                    // Same as the CDP path: the paused navigation resolves to the
-                    // synthetic page, and a re-post of this form is refused.
-                    const synthetic = hostedFormSubmittedPage({ authorizationId: replay.authorizationId, merchant: opts.merchant, submittedAt: replay.submittedAt });
-                    // Inert on a navigation (never CORS-checked); one path for every fulfill.
-                    await deliverTo.fulfill({ status: synthetic.status, headers: withCorsHeaders(synthetic.headers, corsHeadersFor(deliverRequest.url(), deliverRequest.headers())), body: synthetic.body });
-                    assertRequestLive();
-                    lastSubmitted = { url: deliverRequest.url(), body: deliverBody, at: Date.now(), authorizationId: replay.authorizationId };
-                    opts.onEvent?.({ type: 'submitted_on_device', detail: { authorizationId: replay.authorizationId, submittedAt: replay.submittedAt, outcome: replay.outcome } });
-                }
-                else if (replay.mode === 'cse') {
-                    // Same as the CDP path: the request continues from this browser
-                    // with the ciphertext swapped in and no header override; Playwright
-                    // recomputes the length itself.
-                    // A total the merchant moved while the cardholder decided holds the card here.
-                    if (replay.kind === 'merchant_hosted')
-                        await merchantTotal.release(replay, opts.vault, attempt.signal);
-                    assertRequestLive();
-                    const postData = cseContinuationBody(opts, deliverBody, replay, deliverRequest.url(), preparation);
-                    handoffStarted = true;
-                    if (replay.kind === 'merchant_hosted') {
-                        merchantHandoff.begin(replay.profile, replay.authorizationId, replayTemplatedUrl(replay, deliverRequest.url()));
-                        // Watched from before the continue: 5xx, a failure or the page closing is an unknown outcome.
-                        // Once the merchant's final answer arrived, what its confirmation says it charged is reported.
-                        handoffAnswer?.stop();
-                        handoffAnswer = watchPlaywrightHandoff(page, deliverRequest, merchantHandoff, () => merchantTotal.answered(replay, opts.vault));
-                    }
-                    await deliverTo.continue({ postData });
-                    assertRequestLive();
-                    opts.onEvent?.({ type: 'authorized', detail: cseAuthorizedDetail(replay, deliverRequest.url()) });
-                }
-                else {
-                    // Playwright adds these itself when a cross-origin fulfill carries
-                    // none; written here anyway (replacing a stale value) so a
-                    // cross-origin answer is the same whichever adapter ran.
-                    const cors = corsDecision(deliverRequest.url(), deliverRequest.headers());
-                    await deliverTo.fulfill({ status: replay.status, headers: withCorsHeaders(replay.headers, cors.headers), body: replay.body });
-                    assertRequestLive();
-                    opts.onEvent?.({ type: 'authorized', detail: { mode: 'token', authorizationId: replay.authorizationId, amountVerified: replay.amountVerified ?? null, cors: cors.outcome } });
-                }
-                lifecycle.handedOff(replay);
-            }
-            catch (err) {
-                const dead = attempt.target?.route ?? route;
-                if (activeRequest?.attempt === attempt)
-                    activeRequest = null;
-                try {
-                    attempt.assertLive();
-                }
-                catch (stopped) {
-                    err = stopped;
-                }
-                if (err instanceof MerchantNeverRetried || (attempt.signal.aborted && approvedId && !deliveryBegun)) {
-                    // The device approved and no request ever carried the answer; see
-                    // the same branch in attachToCdp.
-                    await retireUnusedApproval(opts, lifecycle, approvedId);
-                    quietUntil = Date.now() + cooldownMs;
-                }
-                else {
-                    if (!attempt.signal.aborted)
-                        lifecycle.failed(err, handoffStarted);
-                    if (isTerminal(err))
-                        terminal = err;
-                    else if (isApprovalOutcome(err))
-                        quietUntil = Date.now() + cooldownMs;
-                    opts.onEvent?.({ type: 'failed', detail: failureSummary(err) });
-                }
-                await dead.abort('aborted').catch(() => { });
-            }
-            finally {
-                if (activeRequest?.attempt === attempt)
-                    activeRequest = null;
-                awaitingApproval = false;
-                lifecycle.end();
-                if (preparation)
-                    preparationGate.retireUnboundClaim();
-            }
-        });
-        assertActive();
-    };
-    try {
-        await withinAttachmentDeadline(install, setupTimeoutMs, setupStop.signal);
-        if (setupStop.signal.aborted)
-            throw attachmentFailure(setupStop.signal.reason);
-        attachmentReady = true;
-    }
-    catch (error) {
-        const failure = attachmentFailure(error);
-        setupStop.abort(failure);
-        terminal = failure;
-        lifecycle.cancel();
-        opts.onEvent?.({ type: 'failed', detail: `checkout_attachment_${failure.reason}` });
-        // A route registration may finish after this rejection. Keep its handler
-        // inert for card traffic; removing it would reopen the failed checkout.
-        throw failure;
-    }
-    return lifecycle;
-}