@agent-cards/checkout 0.7.0 → 0.9.0

package/examples/preflight/stripe-script.direct.result.json

@@ -0,0 +1,92 @@
+{
+  "snapshot": {
+    "schema_version": 1,
+    "catalog_version": "2026-09-11.2",
+    "signals": [
+      {
+        "rule_id": "stripe-js-v3",
+        "kind": "script",
+        "frame_id": 0,
+        "parent_frame_id": null,
+        "visible": null
+      },
+      {
+        "rule_id": "stripe-js-script",
+        "kind": "script",
+        "frame_id": 0,
+        "parent_frame_id": null,
+        "visible": null
+      }
+    ],
+    "observation": {
+      "complete": true,
+      "truncated": false,
+      "reasons": []
+    }
+  },
+  "result": {
+    "schema_version": 1,
+    "catalog_version": "2026-09-11.2",
+    "integration": {
+      "id": "direct_sdk",
+      "version": "bundled"
+    },
+    "scenario": "one_time",
+    "scenario_defaulted": false,
+    "psp": "stripe",
+    "flow": null,
+    "mode": "token",
+    "status": "supported",
+    "support_scope": "processor_integration",
+    "checkout_flow_status": "unknown",
+    "candidates": [
+      {
+        "psp": "stripe",
+        "relevance": "undetermined",
+        "evidence": [
+          {
+            "rule_id": "stripe-js-v3",
+            "kind": "script",
+            "frame_id": 0,
+            "parent_frame_id": null,
+            "visible": null,
+            "origin": "https://js.stripe.com",
+            "path_pattern": "/v3/*"
+          },
+          {
+            "rule_id": "stripe-js-script",
+            "kind": "script",
+            "frame_id": 0,
+            "parent_frame_id": null,
+            "visible": null,
+            "origin": "https://js.stripe.com",
+            "path_pattern": "^/v3/?$"
+          }
+        ]
+      }
+    ],
+    "reason_codes": [
+      "checkout_flow_unidentified",
+      "processor_supported_by_integration"
+    ],
+    "limitations": [
+      "Processor assets alone do not establish the active card payment flow.",
+      "Tokenization replays a token response; it does not authorize a later PaymentIntent confirm.",
+      "Direct PaymentIntent confirms require a card-bearing template; the intent’s amount is read from Stripe and a hint sent as amount with currency must agree with it.",
+      "Direct SetupIntent confirms require a card-bearing template and save a card without charging it; future charges are merchant-managed.",
+      "Automatic token-to-PaymentIntent or token-to-SetupIntent continuation is unsupported; tokenization does not bind a later intent.",
+      "A token response does not bind a later PaymentIntent confirmation.",
+      "A token response does not bind a later SetupIntent confirmation."
+    ],
+    "missing_evidence": [
+      "active_checkout_flow"
+    ],
+    "observation": {
+      "complete": true,
+      "truncated": false,
+      "reasons": []
+    },
+    "scope": "preflight_hint",
+    "merchant_confirmation_required": true
+  }
+}

package/examples/preflight/stripe-script.observations.json

@@ -0,0 +1,16 @@
+{
+  "signals": [
+    {
+      "kind": "script",
+      "url": "https://js.stripe.com/v3/?example=discard-this-query",
+      "frame_id": 0,
+      "parent_frame_id": null,
+      "visible": null
+    }
+  ],
+  "observation": {
+    "complete": true,
+    "truncated": false,
+    "reasons": []
+  }
+}

package/examples/preflight/stripe-script.result.json

@@ -0,0 +1,87 @@
+{
+  "snapshot": {
+    "schema_version": 1,
+    "catalog_version": "2026-09-11.2",
+    "signals": [
+      {
+        "rule_id": "stripe-js-v3",
+        "kind": "script",
+        "frame_id": 0,
+        "parent_frame_id": null,
+        "visible": null
+      },
+      {
+        "rule_id": "stripe-js-script",
+        "kind": "script",
+        "frame_id": 0,
+        "parent_frame_id": null,
+        "visible": null
+      }
+    ],
+    "observation": {
+      "complete": true,
+      "truncated": false,
+      "reasons": []
+    }
+  },
+  "result": {
+    "schema_version": 1,
+    "catalog_version": "2026-09-11.2",
+    "integration": {
+      "id": "kernel_native",
+      "version": "example-native-adapter"
+    },
+    "scenario": "one_time",
+    "scenario_defaulted": false,
+    "psp": "stripe",
+    "flow": null,
+    "mode": "token",
+    "status": "unknown",
+    "support_scope": null,
+    "checkout_flow_status": "unknown",
+    "candidates": [
+      {
+        "psp": "stripe",
+        "relevance": "undetermined",
+        "evidence": [
+          {
+            "rule_id": "stripe-js-v3",
+            "kind": "script",
+            "frame_id": 0,
+            "parent_frame_id": null,
+            "visible": null,
+            "origin": "https://js.stripe.com",
+            "path_pattern": "/v3/*"
+          },
+          {
+            "rule_id": "stripe-js-script",
+            "kind": "script",
+            "frame_id": 0,
+            "parent_frame_id": null,
+            "visible": null,
+            "origin": "https://js.stripe.com",
+            "path_pattern": "^/v3/?$"
+          }
+        ]
+      }
+    ],
+    "reason_codes": [
+      "checkout_flow_unidentified",
+      "integration_processor_undeclared"
+    ],
+    "limitations": [
+      "Processor assets alone do not establish the active card payment flow."
+    ],
+    "missing_evidence": [
+      "active_checkout_flow",
+      "integration_processor_capability"
+    ],
+    "observation": {
+      "complete": true,
+      "truncated": false,
+      "reasons": []
+    },
+    "scope": "preflight_hint",
+    "merchant_confirmation_required": true
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/checkout",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Let browser agents pay with the user's own card, without your infrastructure ever touching card data.",
   "type": "module",
   "main": "dist/index.js",
@@ -8,23 +8,32 @@
   "exports": {
     ".": "./dist/index.js",
     "./cdp": "./dist/cdp.js",
-    "./playwright": "./dist/cdp.js"
+    "./playwright": "./dist/playwright.js",
+    "./preflight": "./dist/preflight.js",
+    "./preflight/catalog.json": "./dist/preflight-catalog.json",
+    "./preflight/schemas.json": "./dist/preflight-schemas.json"
   },
   "files": [
     "dist",
     "README.md",
     "CHANGELOG.md",
-    "examples"
+    "examples",
+    "PREFLIGHT.md"
   ],
   "publishConfig": {
     "access": "public"
   },
   "scripts": {
-    "_comment_build": "TypeScript is fetched rather than declared as a devDependency ON PURPOSE. This package ships zero dependencies, which is why pnpm writes no importer for it in the workspace lockfile; adding any dep here creates one, and an importer the lockfile has not been regenerated for fails every Vercel build with ERR_PNPM_OUTDATED_LOCKFILE. Pinned so the published output is reproducible.",
-    "build": "npx -y -p typescript@5.9.3 tsc",
+    "_comment_build": "The public SDK keeps zero runtime dependencies. Its build vendors deterministic metadata and substitution artifacts from the internal payment core; TypeScript remains pinned.",
+    "build": "node ../payment-core/scripts/build.mjs && node scripts/generate-payment-core.mjs && npx -y -p typescript@5.9.3 tsc && node scripts/generate-preflight-contract.mjs",
     "prepublishOnly": "pnpm build",
-    "test": "node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs prepared-processor.test.mjs minimum-delay.test.mjs paysafe.test.mjs attachment.test.mjs",
-    "test:browser": "node browser.test.mjs && node stripe-browser.test.mjs && node preparation-browser.test.mjs"
+    "test": "node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs autopilot.test.mjs payment-core.test.mjs prepared-processor.test.mjs minimum-delay.test.mjs paysafe.test.mjs attachment.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs",
+    "test:browser": "node browser.test.mjs && node stripe-browser.test.mjs && node preparation-browser.test.mjs && node owned-shop-browser.test.mjs",
+    "check:payment-core": "node scripts/generate-payment-core.mjs --check",
+    "test:preflight": "node --test preflight-package.test.mjs preflight-collector.test.mjs",
+    "test:preflight:browser": "node preflight-browser.test.mjs",
+    "pack:preview": "node scripts/pack-preflight-preview.mjs",
+    "test:preflight:schemas": "node --test preflight-schemas.test.mjs"
   },
   "keywords": [
     "payments",