@agent-cards/checkout 0.7.0 → 0.8.0

package/dist/builtin-registry.generated.js

@@ -0,0 +1 @@
+export const BUILTIN_REGISTRY = [{ "psp": "shopify", "match": /(checkout\.pci\.shopifyinc\.com|deposit\.[a-z0-9-]+\.shopifycs\.com)\/sessions/i, "hosts": ["^checkout\\.pci\\.shopifyinc\\.com$", "^deposit\\.[a-z0-9-]+\\.shopifycs\\.com$"], "encoding": "json", "passthroughHeaders": [/^shopify-identification-signature$/i] }, { "psp": "stripe", "match": /api\.stripe\.com\/v1\/(payment_methods|tokens|setup_intents\/seti_\w+\/confirm|payment_intents\/pi_\w+\/confirm)/i, "hosts": ["^api\\.stripe\\.com$"], "encoding": "form", "passthroughHeaders": [/^authorization$/i, /^stripe-version$/i, /^x-stripe-client-user-agent$/i] }, { "psp": "braintree", "match": /payments(\.sandbox)?\.braintree-api\.com\/graphql/i, "hosts": ["^payments\\.braintree-api\\.com$", "^payments\\.sandbox\\.braintree-api\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^braintree-version$/i] }, { "psp": "checkout_com", "match": /(api|card-acquisition-gateway)(\.sandbox)?\.checkout\.com\/tokens/i, "hosts": ["^api\\.checkout\\.com$", "^api\\.sandbox\\.checkout\\.com$", "^card-acquisition-gateway\\.checkout\\.com$", "^card-acquisition-gateway\\.sandbox\\.checkout\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i] }, { "psp": "adyen", "match": /(checkoutshopper-(test|live(-[a-z]+)?)\.adyen\.com|([a-z0-9-]+\.)*adyenpayments\.com)\/checkoutshopper\/v1\/sessions\/[A-Za-z0-9_-]+\/payments/i, "hosts": ["^checkoutshopper-(test|live(-[a-z]+)?)\\.adyen\\.com$", "^([a-z0-9-]+\\.)*adyenpayments\\.com$"], "encoding": "json", "passthroughHeaders": [], "clientSideEncrypted": true, "mode": "cse" }, { "psp": "tranzila", "match": /(direct\.tranzila\.com\/process\/n\/|directng\.tranzila\.com\/process\/?)/i, "hosts": ["^direct\\.tranzila\\.com$", "^directng\\.tranzila\\.com$"], "encoding": "form", "passthroughHeaders": [], "mode": "hosted_form" }, { "psp": "square", "match": /pci-connect\.squareup(?:sandbox)?\.com\/v2\/card-nonce/i, "hosts": ["^pci-connect\\.squareup\\.com$", "^pci-connect\\.squareupsandbox\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "authorize_net", "match": /(api2|apitest)\.authorize\.net\/xml\/v1\/request\.api/i, "hosts": ["^api2\\.authorize\\.net$", "^apitest\\.authorize\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "worldpay", "match": /(try\.)?access\.worldpay\.com\/(sessions\/card|verifiedTokens\/sessions)/i, "hosts": ["^access\\.worldpay\\.com$", "^try\\.access\\.worldpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^accept$/i] }, { "psp": "nuvei", "match": /(secure|ppp-test)\.safecharge\.com\/ppp\/api\/v1\/(?:cardTokenization|clientPayment|websdk\/initPaymentWithCardTokenization)\.do/i, "hosts": ["^secure\\.safecharge\\.com$", "^ppp-test\\.safecharge\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "airwallex", "match": /(checkout(\.sandbox)?\.airwallex\.com|pci-api(\.sandbox)?\.airwallex\.com)\/api\/v1\/pa\/(payment_intents\/[^/?#]+\/confirm|payment_consents\/[^/?#]+\/verify|payment_methods\/create)(\?|$)/i, "hosts": ["^checkout\\.airwallex\\.com$", "^checkout\\.sandbox\\.airwallex\\.com$", "^pci-api\\.airwallex\\.com$", "^pci-api\\.sandbox\\.airwallex\\.com$"], "encoding": "json", "passthroughHeaders": [/^client-secret$/i, /^authorization$/i, /^x-auth-token$/i, /^x-on-behalf-of$/i, /^x-api-version$/i] }, { "psp": "rapyd", "match": /(api|sandboxapi)\.rapyd\.net\/v1\/(?:hosted\/collect\/card\/[^/?#]+\/payment_method|checkout\/checkout_[A-Za-z0-9]+)(?:[?#]|$)/i, "hosts": ["^api\\.rapyd\\.net$", "^sandboxapi\\.rapyd\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "dlocal", "match": /ppmcc(-sandbox)?\.dlocal\.com\/cvault\/credit-card\/temporal/i, "hosts": ["^ppmcc\\.dlocal\\.com$", "^ppmcc-sandbox\\.dlocal\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-fields-api-key$/i, /^x-uow$/i, /^x-dlocal-infrav2$/i] }, { "psp": "ebanx", "match": /(?:(?:customer-frontier|customer|api-local-latam|api|sandbox-local-latam|sandbox)\.ebanx\.com|(?:api-diamond|api|sandbox)\.ebanxpay\.com)\/ws\/token/i, "hosts": ["^customer\\.ebanx\\.com$", "^customer-frontier\\.ebanx\\.com$", "^api\\.ebanx\\.com$", "^sandbox\\.ebanx\\.com$", "^api-local-latam\\.ebanx\\.com$", "^sandbox-local-latam\\.ebanx\\.com$", "^api-diamond\\.ebanxpay\\.com$", "^api\\.ebanxpay\\.com$", "^sandbox\\.ebanxpay\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "mercado_pago", "match": /api\.mercadopago\.com\/v1\/card_tokens(?![\w/-])/i, "hosts": ["^api\\.mercadopago\\.com$"], "encoding": "json", "passthroughHeaders": [/^x-product-id$/i] }, { "psp": "payu", "match": /(secure\.payu\.com|(merch-prod|secure)\.snd\.payu\.com)\/api\/front\/tokens/i, "hosts": ["^secure\\.payu\\.com$", "^(merch-prod|secure)\\.snd\\.payu\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "razorpay", "match": /api\.razorpay\.com\/v1\/(?:standard_checkout\/)?payments\/create\/(?:ajax|checkout|fees)/i, "hosts": ["^api\\.razorpay\\.com$"], "encoding": "form", "passthroughHeaders": [/^x-razorpay-sessionid$/i, /^x-customer-access-token$/i] }, { "psp": "mollie", "match": /api\.cc\.mollie\.com\/v1\/card-tokens/i, "hosts": ["^api\\.cc\\.mollie\\.com$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "paysafe", "match": /(?:api(\.test)?\.paysafe\.com\/(?:paymenthub\/v1\/singleusepaymenthandles|js\/api\/v1\/tokenize)|hosted(\.test)?\.paysafe\.com\/checkout\/api\/v1\/tokenize)(?![\w/-])/i, "hosts": ["^api\\.paysafe\\.com$", "^api\\.test\\.paysafe\\.com$", "^hosted\\.paysafe\\.com$", "^hosted\\.test\\.paysafe\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-paysafe-credentials$/i, /^correlationid$/i] }, { "psp": "recurly", "match": /api(\.eu)?\.recurly\.com\/js\/v1\/token(?![\w-])/i, "hosts": ["^api\\.recurly\\.com$", "^api\\.eu\\.recurly\\.com$"], "encoding": "form", "passthroughHeaders": [/^recurly-credential-checkout-hostname$/i] }, { "psp": "moneris", "match": /(www3|esqa|gateway|gatewayqa|gatewayt|gatewaydev)\.moneris\.com\/HPPtoken\/request\.php/i, "hosts": ["^www3\\.moneris\\.com$", "^esqa\\.moneris\\.com$", "^gateway\\.moneris\\.com$", "^gatewayqa\\.moneris\\.com$", "^gatewayt\\.moneris\\.com$", "^gatewaydev\\.moneris\\.com$"], "encoding": "form", "passthroughHeaders": [] }, { "psp": "bambora", "match": /(api\.na\.bambora\.com|api\.bam\.shift4api\.net)\/scripts\/tokenization\/tokens/i, "hosts": ["^api\\.na\\.bambora\\.com$", "^api\\.bam\\.shift4api\\.net$"], "encoding": "json", "passthroughHeaders": [] }, { "psp": "global_payments", "match": /(?:api\.heartlandportico\.com\/SecureSubmit\.v1\/api\/token|cert\.api2\.heartlandportico\.com\/Hps\.Exchange\.PosGateway\.Hpf\.v1\/api\/token|apis(?:\.sandbox)?(?:\.eu)?\.globalpay\.com\/ucp\/(?:merchants\/[^/]+\/)?payment-methods)/i, "hosts": ["^api\\.heartlandportico\\.com$", "^cert\\.api2\\.heartlandportico\\.com$", "^apis\\.globalpay\\.com$", "^apis\\.sandbox\\.globalpay\\.com$", "^apis\\.eu\\.globalpay\\.com$", "^apis\\.sandbox\\.eu\\.globalpay\\.com$"], "encoding": "json", "passthroughHeaders": [/^authorization$/i, /^x-gp-version$/i] }];

package/dist/cdp.d.ts

@@ -1,4 +1,4 @@
-import { type VaultClient } from './client.js';
+import { type VaultClient, type ExecutionMetadata } from './client.js';
 import { type CheckoutController, type LifecycleOptions, type PaymentEndpointGuard } from './lifecycle.js';
 /**
  * The CORS headers a fulfilled CROSS-ORIGIN request needs, or null when the
@@ -71,7 +71,9 @@ export interface CdpLike {
     send(method: string, params?: any, sessionId?: string): Promise<any>;
     on(handler: (method: string, params: any, sessionId?: string) => void): void;
 }
-export interface AttachOptions extends LifecycleOptions {
+export interface AttachOptions extends LifecycleOptions, ExecutionMetadata {
+    /** Fallback when the browser cannot expose its top-level origin. Never an amount/payee authority. */
+    merchantOrigin?: string;
     vault: VaultClient;
     user: string;
     merchant: string;

package/dist/cdp.js

@@ -282,9 +282,23 @@ function headerEntries(headers) {
  * undefined and the authorization goes out without one (a merchant, category
  * or place rule then refuses it as unknown, never the request itself).
  */
-async function pageOriginOf(readDocumentUrl) {
+async function pageOriginOf(readDocumentUrl, signal) {
+    let timer;
+    let abort;
     try {
-        const url = new URL(await readDocumentUrl());
+        const documentUrl = await Promise.race([
+            Promise.resolve().then(readDocumentUrl).catch(() => undefined),
+            new Promise((resolve) => {
+                timer = setTimeout(resolve, 1_000);
+                abort = () => resolve(undefined);
+                signal.addEventListener('abort', abort, { once: true });
+                if (signal.aborted)
+                    abort();
+            }),
+        ]);
+        if (typeof documentUrl !== 'string')
+            return undefined;
+        const url = new URL(documentUrl);
         if (url.username || url.password)
             return undefined;
         if (url.protocol === 'https:' || (url.protocol === 'http:' && url.hostname === 'localhost'))
@@ -294,6 +308,12 @@ async function pageOriginOf(readDocumentUrl) {
     catch {
         return undefined;
     }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        if (abort)
+            signal.removeEventListener('abort', abort);
+    }
 }
 /**
  * The page total, the lowest amount authority, through the integrator's own
@@ -587,15 +607,21 @@ export async function attachToCdp(cdp, pageSessionId, opts) {
             activeRequest = { attempt, networkId, sessionId, frameId };
             if (preparation)
                 await preparationGate.assertDocument();
-            const pageOrigin = await pageOriginOf(readDocumentUrl);
+            const pageOrigin = await pageOriginOf(readDocumentUrl, attempt.signal);
             const pageAmount = await pageAmountOf(opts);
             attempt.assertLive();
+            const merchantOrigin = preparation?.merchantOrigin ?? (opts.executionMode === 'user_approval'
+                ? opts.merchantOrigin : pageOrigin?.startsWith('https:') ? pageOrigin : opts.merchantOrigin);
+            attempt.assertLive();
             const replay = await opts.vault.authorize({
                 user: opts.user,
                 merchant: opts.merchant,
                 amount: opts.amount,
                 currency: opts.currency,
                 cardId: preparation?.cardId ?? opts.cardId,
+                executionMode: opts.executionMode,
+                grantId: opts.grantId,
+                merchantOrigin,
                 pageOrigin,
                 pageAmount,
                 preparation,
@@ -858,15 +884,21 @@ export async function attachToPlaywright(page, opts) {
                 activeRequest = { request, frames, attempt };
                 if (preparation)
                     await preparationGate.assertDocument();
-                const pageOrigin = await pageOriginOf(readDocumentUrl);
+                const pageOrigin = await pageOriginOf(readDocumentUrl, attempt.signal);
                 const pageAmount = await pageAmountOf(opts);
                 assertRequestLive();
+                const merchantOrigin = preparation?.merchantOrigin ?? (opts.executionMode === 'user_approval'
+                    ? opts.merchantOrigin : pageOrigin?.startsWith('https:') ? pageOrigin : opts.merchantOrigin);
+                assertRequestLive();
                 const replay = await opts.vault.authorize({
                     user: opts.user,
                     merchant: opts.merchant,
                     amount: opts.amount,
                     currency: opts.currency,
                     cardId: preparation?.cardId ?? opts.cardId,
+                    executionMode: opts.executionMode,
+                    grantId: opts.grantId,
+                    merchantOrigin,
                     pageOrigin,
                     pageAmount,
                     preparation,

package/dist/client.d.ts

@@ -29,11 +29,18 @@ export declare const SUPPORTED_MODES: readonly CheckoutMode[];
 export type AmountAuthority = 'processor' | 'agent' | 'page' | 'none';
 /** An integer in the smallest unit, or a decimal string in normal units with a point; nothing else. */
 export declare function validAmountInput(amount: unknown): amount is number | string;
+/** How an existing authorization is being handled; omitted by older APIs. */
+export interface ExecutionMetadata {
+    executionMode?: 'user_approval' | 'autopilot';
+    grantId?: string;
+}
 /**
  * The token flow: the cardholder's device called the processor itself, and
  * this is the processor's answer to replay into the paused request.
  */
-export interface TokenReplay {
+export interface TokenReplay extends ExecutionMetadata {
+    /** Present only after validating the explicit owned-shop purchase receipt. */
+    shopOrderId?: string;
     /** Absent on older API versions; always 'token' here. */
     mode?: 'token';
     /** The approved authorization (`cauth_…`). */
@@ -73,7 +80,7 @@ export interface TokenReplay {
  * The processor's answer then reaches the page as it normally would; the
  * merchant's order state is where the outcome shows up.
  */
-export interface CseReplay {
+export interface CseReplay extends ExecutionMetadata {
     mode: 'cse';
     authorizationId: string;
     substitutions: Substitutions;
@@ -96,7 +103,7 @@ export interface CseReplay {
  * processor evidence on this mode and cannot obtain any. Treat it as "the
  * person paid, or tried to, on their own device" and confirm with the merchant.
  */
-export interface HostedFormReplay {
+export interface HostedFormReplay extends ExecutionMetadata {
     mode: 'hosted_form';
     /** What this resolution is: a device-attested submission, not a processor answer. */
     kind: 'submitted_on_device';
@@ -152,7 +159,9 @@ export declare class CheckoutPreparationError extends Error {
     reason: string;
     constructor(preparationId: string | null, reason: string);
 }
-export interface AuthorizeInput {
+export interface AuthorizeInput extends ExecutionMetadata {
+    /** Observed top-level HTTPS merchant origin; a routing hint, never payment authority. */
+    merchantOrigin?: string;
     /** Your identifier for the person whose card should pay. */
     user: string;
     /** Shown to the user on the approval screen. Judged by nothing: the merchant comes from the checkout page. */

package/dist/client.js

@@ -1,5 +1,6 @@
 import { BUILTIN_REGISTRY, cardUrlPatterns as deriveCardUrlPatterns, findRecognizer, } from './registry.js';
 import { matchesPreparedRequest, validPreparationEnvironment } from './prepared-processor.js';
+import { hasOwnedShopMarker, parseOwnedShopOrder, parseOwnedShopReceipt } from './owned-shop.generated.js';
 /**
  * The modes this SDK can finish. Asked for on syncRegistry (the API serves
  * only recognizers in these modes, so a request this build cannot complete
@@ -237,7 +238,7 @@ export class PresetRefusedError extends ApprovalDeclinedError {
 }
 /** A decline reason only the company presets stamp (see PresetRefusedError). */
 export const PRESET_REFUSAL_REASONS = new Set([
-    'spend_total_exceeded', 'spend_rate_exceeded', 'spend_rate_unknown',
+    'spend_total_exceeded', 'spend_rate_exceeded', 'spend_rate_unknown', 'amount_unknown', 'rate_unavailable',
     'category_denied', 'category_unknown', 'merchant_denied', 'merchant_unknown',
     'geo_denied', 'geo_unknown', 'currency_denied', 'currency_unknown',
     'time_window_denied', 'surface_denied', 'surface_unknown',
@@ -512,6 +513,27 @@ export class VaultClient {
      * response to replay into the browser. Your process never sees a card.
      */
     async authorize(input) {
+        const ownedShop = hasOwnedShopMarker(input.request);
+        const shopOrder = ownedShop ? parseOwnedShopOrder(input.request) : null;
+        if (ownedShop) {
+            if (!shopOrder || input.preparation || input.executionMode === 'user_approval' ||
+                !input.merchantOrigin || (input.amount != null && input.amount !== shopOrder.amount &&
+                !(typeof input.amount === 'string' && Number(input.amount) * 100 === shopOrder.amount)) ||
+                (input.currency !== undefined && input.currency.toLowerCase() !== shopOrder.currency))
+                throw new Error('The shop order cannot use this checkout configuration.');
+            input = { ...input, amount: shopOrder.amount, currency: shopOrder.currency };
+        }
+        if (input.executionMode !== undefined && !['user_approval', 'autopilot'].includes(input.executionMode))
+            throw new Error('Unsupported checkout execution mode.');
+        if (input.grantId !== undefined && !/^apg_[A-Za-z0-9_-]{1,128}$/.test(input.grantId))
+            throw new Error('Invalid autopilot grant ID.');
+        if (input.preparation && (input.executionMode === 'autopilot' || input.grantId))
+            throw new Error('A device preparation cannot also select autopilot.');
+        if (input.merchantOrigin !== undefined && !input.preparation) {
+            const merchantUrl = new URL(input.merchantOrigin);
+            if (merchantUrl.protocol !== 'https:' || merchantUrl.origin !== input.merchantOrigin)
+                throw new Error('merchantOrigin must be an exact HTTPS origin.');
+        }
         const preparation = input.preparation;
         if (preparation) {
             if (!this.preparations.has(preparation) || this.usedPreparations.has(preparation))
@@ -582,6 +604,9 @@ export class VaultClient {
             // the recognizer and refuses a disagreement before a row exists.
             mode,
             ...(input.cardId ? { cardId: input.cardId } : {}),
+            ...(input.executionMode ? { execution_mode: input.executionMode } : {}),
+            ...(input.grantId ? { grant_id: input.grantId } : {}),
+            ...(input.merchantOrigin && !preparation ? { merchant_origin: input.merchantOrigin } : {}),
             // A prepared checkout already carries the page origin as merchant_origin.
             ...(preparation
                 ? { preparation_id: preparation.id, checkout_key: preparation.checkoutKey, merchant_origin: preparation.merchantOrigin }
@@ -625,6 +650,20 @@ export class VaultClient {
         if (!created || typeof created.id !== 'string' || !created.id)
             throw new PaymentOutcomeUnknownError(preparation ? await this.retireUncertainPreparation(preparation, input.onAuthorizationCreated) : null, 'authorization_create_malformed');
         const authorizationId = created.id;
+        let execution = {};
+        let approvalDelivered = false;
+        const deliverApproval = (state) => {
+            if (ownedShop || preparation || approvalDelivered || execution.executionMode === 'autopilot')
+                return;
+            const url = state.approvalUrl ?? state.approval_url;
+            if (typeof url !== 'string' || !url)
+                return;
+            approvalDelivered = true;
+            try {
+                Promise.resolve(input.onApprovalUrl?.(url)).catch(() => { });
+            }
+            catch { /* observer only */ }
+        };
         let failed = false;
         const stopSignal = input.merchantSignal
             ? AbortSignal.any([input.merchantSignal, ...(input.signal ? [input.signal] : [])]) : input.signal;
@@ -635,12 +674,8 @@ export class VaultClient {
             catch { /* observer only */ }
             if (input.merchantSignal?.aborted)
                 throw new PaymentOutcomeUnknownError(authorizationId, 'merchant_request_aborted');
-            if (!preparation) {
-                try {
-                    Promise.resolve(input.onApprovalUrl?.(created.approvalUrl)).catch(() => { });
-                }
-                catch { /* approval delivery must not lose an existing authorization */ }
-            }
+            execution = executionMetadata(created, authorizationId);
+            deliverApproval(created);
             while (Date.now() < deadline) {
                 if (stopSignal?.aborted)
                     throw new PaymentOutcomeUnknownError(authorizationId, input.merchantSignal?.aborted ? 'merchant_request_aborted' : 'local_cancel');
@@ -661,6 +696,11 @@ export class VaultClient {
                 if (!s || typeof s !== 'object' || Array.isArray(s) || typeof s.status !== 'string') {
                     throw new PaymentOutcomeUnknownError(authorizationId, 'authorization_status_malformed');
                 }
+                execution = executionMetadata(s, authorizationId, execution);
+                if (shopOrder && (s.status === 'submitted_on_device' ||
+                    (s.status === 'approved' && (s.mode !== 'token' || execution.executionMode !== 'autopilot'))))
+                    throw new PaymentOutcomeUnknownError(authorizationId, 'shop_receipt_unconfirmed');
+                deliverApproval(s);
                 const amountAuthority = typeof s.amount_authority === 'string' && AMOUNT_AUTHORITIES.includes(s.amount_authority)
                     ? { amountAuthority: s.amount_authority }
                     : {};
@@ -676,7 +716,9 @@ export class VaultClient {
                     if (typeof s.submitted_at !== 'string' || !s.submitted_at) {
                         throw new PaymentOutcomeUnknownError(authorizationId, 'submission_timestamp_missing');
                     }
-                    return { mode: 'hosted_form', kind: 'submitted_on_device', outcome: 'unverified', authorizationId, submittedAt: s.submitted_at, ...amountAuthority };
+                    if (execution.executionMode === 'autopilot')
+                        throw new PaymentOutcomeUnknownError(authorizationId, 'autopilot_submission_mode_invalid');
+                    return { mode: 'hosted_form', kind: 'submitted_on_device', outcome: 'unverified', authorizationId, submittedAt: s.submitted_at, ...amountAuthority, ...execution };
                 }
                 if (s.status === 'approved') {
                     const approvedMode = typeof s.mode === 'string' ? s.mode : 'token';
@@ -687,6 +729,8 @@ export class VaultClient {
                         throw new PaymentOutcomeUnknownError(authorizationId, 'hosted_form_approval_malformed');
                     }
                     if (approvedMode === 'cse') {
+                        if (execution.executionMode === 'autopilot')
+                            throw new PaymentOutcomeUnknownError(authorizationId, 'autopilot_submission_mode_invalid');
                         const sub = s.substitutions;
                         const fieldsOk = sub && typeof sub === 'object' && sub.encoding === 'json' && typeof sub.at === 'string' && sub.at
                             && sub.fields && typeof sub.fields === 'object' && !Array.isArray(sub.fields)
@@ -711,6 +755,7 @@ export class VaultClient {
                                 ...(removeRaw ? { remove: [...removeRaw] } : {}),
                             },
                             ...amountAuthority,
+                            ...execution,
                         };
                     }
                     if (approvedMode !== 'token')
@@ -720,15 +765,29 @@ export class VaultClient {
                         || typeof response.body !== 'string' || !response.headers || typeof response.headers !== 'object' || Array.isArray(response.headers)) {
                         throw new PaymentOutcomeUnknownError(authorizationId, 'approved_response_malformed');
                     }
+                    if (shopOrder) {
+                        let receipt;
+                        try {
+                            receipt = parseOwnedShopReceipt(JSON.parse(response.body), shopOrder);
+                        }
+                        catch { /* No raw error or token replay. */ }
+                        if (execution.executionMode !== 'autopilot' || response.status !== 200 || !receipt)
+                            throw new PaymentOutcomeUnknownError(authorizationId, 'shop_receipt_unconfirmed');
+                        // Only canonical receipt fields and our content type enter the page.
+                        response.body = JSON.stringify(receipt);
+                        response.headers = { 'content-type': 'application/json' };
+                    }
                     return {
                         mode: 'token',
                         authorizationId,
+                        ...(shopOrder ? { shopOrderId: shopOrder.order_id } : {}),
                         ...response,
                         amountVerified: typeof s.amount_verified === 'boolean' ? s.amount_verified : null,
                         chargedAmount: typeof s.charged_amount === 'number' ? s.charged_amount : null,
                         chargedCurrency: typeof s.charged_currency === 'string' ? s.charged_currency : null,
                         chargedKind: s.charged_kind === 'captured' || s.charged_kind === 'authorized' || s.charged_kind === 'none' ? s.charged_kind : null,
                         ...amountAuthority,
+                        ...execution,
                     };
                 }
                 if (s.status === 'declined') {
@@ -916,6 +975,19 @@ export class VaultClient {
         return this.call(path, { signal });
     }
 }
+function executionMetadata(state, authorizationId, previous = {}) {
+    if (state.execution_mode === undefined)
+        return previous;
+    if (state.execution_mode !== 'user_approval' && state.execution_mode !== 'autopilot')
+        throw new PaymentOutcomeUnknownError(authorizationId, 'execution_mode_unrecognized');
+    if (state.execution_mode === 'user_approval')
+        return { executionMode: 'user_approval' };
+    if (typeof state.grant_id !== 'string' || !/^apg_[A-Za-z0-9_-]{1,128}$/.test(state.grant_id))
+        throw new PaymentOutcomeUnknownError(authorizationId, 'autopilot_grant_unconfirmed');
+    if (previous.grantId && previous.grantId !== state.grant_id)
+        throw new PaymentOutcomeUnknownError(authorizationId, 'autopilot_grant_changed');
+    return { executionMode: 'autopilot', grantId: state.grant_id };
+}
 /**
  * Forward only the headers the merchant needs to accept the replay. Everything
  * else (cookies, UA, tracing) is dropped so we transmit as little as possible.

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { VaultClient, CardEncryptedError, UnsupportedModeError, ApprovalTimeoutError, ApprovalDeclinedError, AmountMismatchError, PresetRefusedError, PRESET_REFUSAL_REASONS, IntentNotConfirmableError, ProcessorRefusedError, CheckoutApiError, redactUrl, SUPPORTED_MODES, PaymentOutcomeUnknownError, CheckoutCancelledError, CheckoutPreparationError, } from './client.js';
-export type { PausedRequest, ReplayResponse, TokenReplay, CseReplay, HostedFormReplay, AmountAuthority, AuthorizeInput, VaultClientOptions, PrepareCheckoutOptions, PrepareCheckoutInput, PreparedCheckout, RazorpayProcessorError, } from './client.js';
+export type { PausedRequest, ReplayResponse, TokenReplay, CseReplay, HostedFormReplay, AmountAuthority, AuthorizeInput, VaultClientOptions, PrepareCheckoutOptions, PrepareCheckoutInput, PreparedCheckout, RazorpayProcessorError, ExecutionMetadata, } from './client.js';
 export { attachToCdp, attachToPlaywright, corsHeadersFor, corsDecision, withCorsHeaders } from './cdp.js';
 export { CheckoutAttachmentError } from './attachment.js';
 export type { CdpLike, AttachOptions, CorsOutcome } from './cdp.js';

package/dist/lifecycle.d.ts

@@ -59,6 +59,7 @@ export declare class CheckoutLifecycle implements CheckoutController {
     private cancelled;
     private merchantAborted;
     private unboundStripeToken;
+    private ownedShopOrderId;
     private reconciliation;
     private preparationHandler?;
     private preparationUsed;

package/dist/lifecycle.js

@@ -1,4 +1,5 @@
 import { ApprovalDeclinedError, ApprovalTimeoutError, CheckoutCancelledError, CheckoutPreparationError, IntentNotConfirmableError, PaymentOutcomeUnknownError, ProcessorRefusedError } from './client.js';
+import { parseOwnedShopReceipt, OWNED_SHOP_SKU, OWNED_SHOP_AMOUNT_CENTS, OWNED_SHOP_CURRENCY } from './owned-shop.generated.js';
 /** Shared by the raw CDP and Playwright transports. No browser ownership or payment execution lives here. */
 export class CheckoutLifecycle {
     options;
@@ -8,6 +9,7 @@ export class CheckoutLifecycle {
     cancelled = false;
     merchantAborted = false;
     unboundStripeToken = false;
+    ownedShopOrderId = null;
     reconciliation = null;
     preparationHandler;
     preparationUsed = false;
@@ -82,6 +84,20 @@ export class CheckoutLifecycle {
         this.set({ ...this.state, status: 'unsupported', reason: 'unrecognized_payment_endpoint' });
     }
     prepareHandoff(replay, requestUrl) {
+        if (replay.mode === 'token' && replay.executionMode === 'autopilot' && replay.shopOrderId) {
+            let receipt;
+            try {
+                receipt = parseOwnedShopReceipt(JSON.parse(replay.body), {
+                    order_id: replay.shopOrderId, sku: OWNED_SHOP_SKU, amount: OWNED_SHOP_AMOUNT_CENTS, currency: OWNED_SHOP_CURRENCY,
+                });
+            }
+            catch { /* An unrecognized response remains subject to the token continuation guard. */ }
+            if (receipt) {
+                this.ownedShopOrderId = receipt.order_id;
+                this.held = true;
+                return;
+            }
+        }
         // A tokenization approval has no authoritative PaymentIntent or amount
         // binding. Neither the first observed confirm nor the returned opaque
         // token can supply one. Hold even in compatibility mode: this attachment
@@ -102,6 +118,11 @@ export class CheckoutLifecycle {
     handedOff(replay) {
         if (this.merchantAborted)
             return;
+        if (this.ownedShopOrderId) {
+            this.held = true;
+            this.set({ status: 'completed', authorizationId: replay.authorizationId, mode: 'token', orderId: this.ownedShopOrderId });
+            return;
+        }
         const mismatch = (!replay.mode || replay.mode === 'token') && replay.amountVerified === false;
         this.held = !!this.options.requireMerchantResult || replay.mode === 'hosted_form' || mismatch || this.unboundStripeToken;
         this.set({ status: 'awaiting_merchant', authorizationId: replay.authorizationId, mode: replay.mode ?? 'token',
@@ -178,7 +199,10 @@ export class CheckoutLifecycle {
             result = { status: 'unknown' };
         if (result.status === 'completed' && typeof result.orderId === 'string' && result.orderId.length > 0) {
             this.held = true;
-            this.set({ ...this.state, status: 'completed', orderId: result.orderId });
+            // Merchant completion supersedes the earlier failure or user-action
+            // reason; keep the authorization and preparation context for observers.
+            const { reason: _previousReason, ...context } = this.state;
+            this.set({ ...context, status: 'completed', orderId: result.orderId });
         }
         else if (result.status === 'failed') {
             // Keep the guard armed until the application deliberately starts another attempt.
@@ -195,6 +219,8 @@ export class CheckoutLifecycle {
         return this.getState();
     }
     retryAfterMerchantFailure(result) {
+        if (this.ownedShopOrderId)
+            throw new Error('This shop payment already has a receipt; another payment is not permitted.');
         if (this.preparationUsed)
             throw new Error('Prepared checkouts are single use. Reconcile this attempt and create a new attachment.');
         if (this.active || this.reconciliation)

package/dist/owned-shop.generated.d.ts

@@ -0,0 +1,24 @@
+declare var OWNED_SHOP_OPERATION: string;
+declare var OWNED_SHOP_SKU: string;
+declare var OWNED_SHOP_AMOUNT_CENTS: number;
+declare var OWNED_SHOP_CURRENCY: string;
+declare var OWNED_SHOP_ORDER_FIELD: string;
+declare function isOwnedShopPaymentIntentId(value: any): boolean;
+declare function serializeOwnedShopOrder(value: any): string;
+declare function hasOwnedShopMarker(request: any): any;
+declare function parseOwnedShopOrder(request: any): {
+    order_id: any;
+    sku: string;
+    amount: number;
+    currency: string;
+} | null;
+declare function parseOwnedShopReceipt(value: any, expectedOrder: any): {
+    object: string;
+    order_id: any;
+    payment_intent_id: any;
+    status: string;
+    amount: number;
+    currency: string;
+    livemode: boolean;
+} | null;
+export { OWNED_SHOP_AMOUNT_CENTS, OWNED_SHOP_CURRENCY, OWNED_SHOP_OPERATION, OWNED_SHOP_ORDER_FIELD, OWNED_SHOP_SKU, hasOwnedShopMarker, isOwnedShopPaymentIntentId, parseOwnedShopOrder, parseOwnedShopReceipt, serializeOwnedShopOrder };

package/dist/owned-shop.generated.js

@@ -0,0 +1,108 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: c8cfb844f3de3f156ee741a0167256d2e764ddfb7d243ce813e011761d3b711a
+// src/owned-shop.js
+var OWNED_SHOP_OPERATION = "stripe.owned_shop_token_to_payment_intent.v1";
+var OWNED_SHOP_SKU = "autopilot-pilot-100";
+var OWNED_SHOP_AMOUNT_CENTS = 100;
+var OWNED_SHOP_CURRENCY = "usd";
+var OWNED_SHOP_ORDER_FIELD = "agentcard_shop_order";
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}(?![\s\S])/;
+var INTENT = /^pi_[A-Za-z0-9]{1,200}(?![\s\S])/;
+var refuse = () => {
+    throw new Error("stripe_owned_shop_refused");
+};
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var keys = (value, allowed) => record(value) && Object.keys(value).length === allowed.length && Object.keys(value).every((key) => allowed.includes(key));
+function isOwnedShopPaymentIntentId(value) {
+    return typeof value === "string" && INTENT.test(value);
+}
+function order(value) {
+    if (!keys(value, ["order_id", "sku", "amount", "currency"]) || typeof value.order_id !== "string" || !UUID.test(value.order_id) || value.sku !== OWNED_SHOP_SKU || value.amount !== OWNED_SHOP_AMOUNT_CENTS || value.currency !== OWNED_SHOP_CURRENCY)
+        refuse();
+    return {
+        order_id: value.order_id,
+        sku: OWNED_SHOP_SKU,
+        amount: OWNED_SHOP_AMOUNT_CENTS,
+        currency: OWNED_SHOP_CURRENCY
+    };
+}
+function serializeOwnedShopOrder(value) {
+    return JSON.stringify(order(value));
+}
+function hasOwnedShopMarker(request) {
+    if (typeof request?.body !== "string")
+        return false;
+    return request.body.split("&").some((part) => {
+        const raw = part.split("=", 1)[0];
+        const loose = raw.replace(/\+/g, " ").replace(/%([0-9a-f]{2})/gi, (_, hex) => String.fromCharCode(parseInt(hex, 16)));
+        return loose.toLowerCase().includes(OWNED_SHOP_ORDER_FIELD);
+    });
+}
+function form(body) {
+    if (typeof body !== "string" || !body || body.length > 16384 || /[^\x21-\x7e]/.test(body))
+        refuse();
+    const chunks = body.split("&");
+    if (chunks.length > 16)
+        refuse();
+    const entries = /* @__PURE__ */ new Map();
+    const seen = /* @__PURE__ */ new Set();
+    for (const chunk of chunks) {
+        const eq = chunk.indexOf("=");
+        if (eq < 1)
+            refuse();
+        let key, value;
+        try {
+            key = decodeURIComponent(chunk.slice(0, eq).replace(/\+/g, " "));
+            value = decodeURIComponent(chunk.slice(eq + 1).replace(/\+/g, " "));
+        }
+        catch {
+            refuse();
+        }
+        if (seen.has(key.toLowerCase()) || value.length > 2048 || /[\x00-\x1f\x7f]/.test(key + value))
+            refuse();
+        seen.add(key.toLowerCase());
+        entries.set(key, value);
+    }
+    return entries;
+}
+function parseOwnedShopOrder(request) {
+    if (!hasOwnedShopMarker(request))
+        return null;
+    const entries = form(request.body);
+    if (!entries.has(OWNED_SHOP_ORDER_FIELD) || [...entries.keys()].some((key) => key !== OWNED_SHOP_ORDER_FIELD && key.toLowerCase().includes(OWNED_SHOP_ORDER_FIELD)))
+        refuse();
+    const encoded = entries.get(OWNED_SHOP_ORDER_FIELD);
+    let parsed;
+    try {
+        parsed = JSON.parse(encoded);
+    }
+    catch {
+        refuse();
+    }
+    const result = order(parsed);
+    if (serializeOwnedShopOrder(result) !== encoded)
+        refuse();
+    return result;
+}
+function parseOwnedShopReceipt(value, expectedOrder) {
+    let boundOrder;
+    try {
+        boundOrder = order(expectedOrder);
+    }
+    catch {
+        return null;
+    }
+    if (!keys(value, ["object", "order_id", "payment_intent_id", "status", "amount", "currency", "livemode"]) || value.object !== "agentcard_shop_receipt" || value.order_id !== boundOrder.order_id || !isOwnedShopPaymentIntentId(value.payment_intent_id) || value.status !== "succeeded" || value.amount !== OWNED_SHOP_AMOUNT_CENTS || value.currency !== OWNED_SHOP_CURRENCY || value.livemode !== false)
+        return null;
+    return {
+        object: "agentcard_shop_receipt",
+        order_id: boundOrder.order_id,
+        payment_intent_id: value.payment_intent_id,
+        status: "succeeded",
+        amount: OWNED_SHOP_AMOUNT_CENTS,
+        currency: OWNED_SHOP_CURRENCY,
+        livemode: false
+    };
+}
+export { OWNED_SHOP_AMOUNT_CENTS, OWNED_SHOP_CURRENCY, OWNED_SHOP_OPERATION, OWNED_SHOP_ORDER_FIELD, OWNED_SHOP_SKU, hasOwnedShopMarker, isOwnedShopPaymentIntentId, parseOwnedShopOrder, parseOwnedShopReceipt, serializeOwnedShopOrder };

package/dist/registry.d.ts

@@ -50,25 +50,8 @@ export interface Recognizer {
     /** How the card reaches the processor; absent means 'token'. Carried verbatim by syncRegistry. */
     mode?: CheckoutMode;
 }
-/**
- * Every PSP the service recognizes, shipped with the package.
- *
- * This list is the FALLBACK that decides interception whenever
- * `syncRegistry()` is skipped or its fetch fails — and that failure is silent
- * by design ("never break checkout over a registry fetch"). A PSP missing here
- * is not an error: its tokenization request is simply never paused, the vault
- * is never consulted, and the shopper pays with their OWN card.
- *
- * It shipped with only 5 of the service's 22 recognizers, which meant 17
- * processors degraded to a silent wrong-card charge for any integrator whose
- * sync had not landed. Generated from the backend registry
- * (packages/backend/src/services/checkout-recognizers.ts) so the two cannot
- * drift by transcription; `sdk-registry-drift.test.ts` fails CI if they do.
- *
- * Syncing still matters — it is how a NEW processor arrives without an npm
- * release. This list is the floor, not the ceiling.
- */
-export declare const BUILTIN_REGISTRY: Recognizer[];
+import { BUILTIN_REGISTRY } from './builtin-registry.generated.js';
+export { BUILTIN_REGISTRY };
 export declare function findRecognizer(url: string, registry?: Recognizer[]): Recognizer | null;
 /**
  * Glob url patterns covering every host in `registry` — what to hand