@agent-cards/checkout 0.9.0 → 0.10.0

package/dist/mercado-checkout.d.ts

@@ -0,0 +1,20 @@
+import type { ReplayResponse } from './client.js';
+/** Capture only the native Checkout Pro configuration. A late configuration,
+ * navigation or repeated token cannot replace the context of an issued token.
+ * Final payment requests retain the attachment's existing payment guards.
+ */
+export declare class MercadoCheckoutGate {
+    private context;
+    private started;
+    private stopped;
+    private sequence;
+    private associatedFlow;
+    private association;
+    matches(url: string): boolean;
+    requiresDocument(url: string, method: string): boolean;
+    invalidate(): void;
+    configuration(url: string, method: string, body: string, readDocument: () => Promise<string>): Promise<boolean>;
+    claimToken(url: string, method: string, documentUrl: string): unknown;
+    arm(replay: ReplayResponse, tokenUrl: string): Promise<void>;
+    associationBody(url: string, method: string, body: string, documentUrl: string): string | undefined;
+}

package/dist/mercado-checkout.generated.d.ts

@@ -0,0 +1,52 @@
+declare var MERCADO_CHECKOUT_ORIGIN: string;
+declare var MERCADO_CONFIGURATION_URL: string;
+declare var MERCADO_CHECKOUT_PATTERN: string;
+declare function mercadoCheckoutDocument(raw: any): {
+    flowId: string;
+    preferenceId: string | null;
+    query: string;
+};
+declare function parseMercadoCheckoutContext(value: any): any;
+declare function captureMercadoCheckoutContext(url: any, method: any, body: any, documentUrl: any): any;
+declare function isMercadoTokenRequest(url: any, method: any): boolean;
+declare function mercadoDigest(value: any): Promise<string>;
+declare function mercadoContextDigest(context: any, tokenUrl: any): Promise<string>;
+declare function prepareMercadoConfiguration(context: any, card: any): {
+    url: string;
+    body: string;
+};
+declare function parseMercadoConfiguration(value: any): {
+    paymentMethodId: any;
+    paymentTypeId: any;
+    paymentMethodName: any;
+    issuerId: string;
+    issuerName: any;
+};
+declare function createMercadoProcessorContext(configuration: any, context: any, tokenUrl: any, tokenBody: any): Promise<{
+    paymentMethodId: any;
+    paymentTypeId: any;
+    paymentMethodName: any;
+    issuerId: string;
+    issuerName: any;
+    version: number;
+    psp: string;
+    source: string;
+    contextDigest: string;
+    tokenDigest: string;
+}>;
+declare function validateMercadoProcessorContext(value: any, context: any, tokenUrl: any, tokenBody: any): Promise<any>;
+declare function createMercadoAssociationGate({ context, tokenUrl, tokenBody, processorContext }: {
+    context: any;
+    tokenUrl: any;
+    tokenBody: any;
+    processorContext: any;
+}): Promise<{
+    take({ url, method, body, documentUrl }: {
+        url: any;
+        method: any;
+        body: any;
+        documentUrl: any;
+    }): string;
+    readonly claimed: boolean;
+}>;
+export { MERCADO_CHECKOUT_ORIGIN, MERCADO_CHECKOUT_PATTERN, MERCADO_CONFIGURATION_URL, captureMercadoCheckoutContext, createMercadoAssociationGate, createMercadoProcessorContext, isMercadoTokenRequest, mercadoCheckoutDocument, mercadoContextDigest, mercadoDigest, parseMercadoCheckoutContext, parseMercadoConfiguration, prepareMercadoConfiguration, validateMercadoProcessorContext };

package/dist/mercado-checkout.generated.js

@@ -0,0 +1,198 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: 0ea817a75d86052699eeaa7546950e6c046bb0d7a96e4a18dfcd3a0fdd2afc99
+// src/mercado-checkout.js
+var MERCADO_CHECKOUT_ORIGIN = "https://www.mercadopago.com.mx";
+var MERCADO_CONFIGURATION_URL = MERCADO_CHECKOUT_ORIGIN + "/checkout/v1/payment/api/bricks/card-form/tokenization";
+var MERCADO_CHECKOUT_PATTERN = MERCADO_CHECKOUT_ORIGIN + "/checkout/v1/payment/api/*";
+var reject = () => {
+    throw new Error("mercado_checkout_context_invalid");
+};
+var object = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+var only = (v, keys) => object(v) && Object.keys(v).every((k) => keys.includes(k));
+var exact = (v, keys) => only(v, keys) && keys.every((k) => Object.hasOwn(v, k));
+var text = (v, max = 200) => typeof v === "string" && v.length > 0 && v.length <= max && !/[\u0000-\u001f\u007f]/.test(v);
+var id = (v) => typeof v === "string" && /^[A-Za-z0-9_-]{1,128}$/.test(v);
+var numberId = (v) => typeof v === "string" && /^\d{1,20}$/.test(v);
+var label = (v) => text(v, 120) && /\p{L}/u.test(v) && !/[<>]|\d(?:[ -]*\d){5}|https?:|javascript:|data:/i.test(v);
+var digest = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v);
+var METHODS = ["visa", "master", "amex"];
+var TYPES = ["credit_card", "debit_card", "prepaid_card"];
+function checkedUrl(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        reject();
+    }
+    if (!text(raw, 4096) || url.href !== raw || url.origin !== MERCADO_CHECKOUT_ORIGIN || url.username || url.password || url.hash)
+        reject();
+    return url;
+}
+function mercadoCheckoutDocument(raw) {
+    const url = checkedUrl(raw);
+    const match = /^\/checkout\/v1\/payment\/redirect\/([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})\/card-form\/$/.exec(url.pathname);
+    const keys = [...url.searchParams.keys()];
+    if (!match || keys.length !== 3 || new Set(keys).size !== 3 || keys.some((k) => !["preference-id", "router-request-id", "p"].includes(k)) || !id(url.searchParams.get("preference-id")) || !id(url.searchParams.get("router-request-id")) || !text(url.searchParams.get("p"), 2048))
+        reject();
+    return { flowId: match[1], preferenceId: url.searchParams.get("preference-id"), query: url.search.slice(1) };
+}
+function initialization(value) {
+    const keys = [
+        "callerId",
+        "collectorId",
+        "allowThirdPartyCard",
+        "clientId",
+        "flowId",
+        "checkoutId",
+        "scope",
+        "excludedPaymentTypesAndIds",
+        "locale",
+        "siteId",
+        "serviceRoutePrefix",
+        "productId",
+        "marketplace",
+        "platform",
+        "cardDetails"
+    ];
+    if (!exact(value, keys) || !numberId(value.callerId) || !numberId(value.collectorId) || !numberId(value.clientId) || value.allowThirdPartyCard !== true || value.flowId !== "checkout-pro-payment" || value.checkoutId !== "cow" || value.scope !== "prod" || value.locale !== "es-MX" || value.siteId !== "MLM" || value.serviceRoutePrefix !== "/checkout/v1/payment/api" || !id(value.productId) || value.marketplace !== "NONE" || value.platform !== "MP" || !Array.isArray(value.excludedPaymentTypesAndIds) || value.excludedPaymentTypesAndIds.length !== 0 || !exact(value.cardDetails, ["fieldsSetting", "identificationTypes", "additionalSteps"]) || !Array.isArray(value.cardDetails.identificationTypes) || value.cardDetails.identificationTypes.length !== 0 || JSON.stringify(value.cardDetails.additionalSteps) !== '["name"]')
+        reject();
+    const fields = value.cardDetails.fieldsSetting;
+    if (!Array.isArray(fields) || fields.length !== 5 || new Set(fields.map((f) => f?.name)).size !== 5)
+        reject();
+    for (const field of fields) {
+        if (!only(field, ["name", "type", "title", "placeholder", "length", "validationMessages", "mask", "hintMessage", "validationPattern", "autocomplete", "tooltipMessage"]) || !["card_number", "name", "expiration", "security_code", "identification_types"].includes(field.name) || field.type !== (field.name === "name" ? "text" : "number") || !text(field.title) || field.placeholder !== void 0 && !text(field.placeholder) || ["hintMessage", "validationPattern", "tooltipMessage"].some((k) => field[k] !== void 0 && !text(field[k], 1024)) || field.autocomplete !== void 0 && typeof field.autocomplete !== "boolean" || field.length !== void 0 && (!Number.isInteger(field.length) || field.length < 1 || field.length > 40) || field.mask !== void 0 && (!text(field.mask, 30) || !/^[ $/]+$/.test(field.mask)) || !only(field.validationMessages, ["emptyField", "incompleteField", "invalidField"]) || Object.values(field.validationMessages).some((v) => !text(v)))
+            reject();
+    }
+    if (JSON.stringify(value).length > 12e3)
+        reject();
+    return value;
+}
+function parseMercadoCheckoutContext(value) {
+    if (!exact(value, ["version", "documentUrl", "initializationData"]) || value.version !== 1)
+        reject();
+    mercadoCheckoutDocument(value.documentUrl);
+    initialization(value.initializationData);
+    return JSON.parse(JSON.stringify(value));
+}
+function captureMercadoCheckoutContext(url, method, body, documentUrl) {
+    if (url !== MERCADO_CONFIGURATION_URL || method !== "POST" || typeof body !== "string" || body.length > 16e3)
+        reject();
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        reject();
+    }
+    if (!exact(parsed, ["cardBin", "initializationData"]) || typeof parsed.cardBin !== "string" || !/^\d{8}$/.test(parsed.cardBin))
+        reject();
+    return parseMercadoCheckoutContext({ version: 1, documentUrl, initializationData: parsed.initializationData });
+}
+function isMercadoTokenRequest(url, method) {
+    try {
+        const value = new URL(url), names = [...value.searchParams.keys()];
+        return method === "POST" && value.href === url && value.origin === "https://api.mercadopago.com" && value.pathname === "/v1/card_tokens" && !value.username && !value.password && !value.hash && new Set(names).size === names.length && names.every((n) => ["public_key", "locale", "js_version", "referer"].includes(n)) && id(value.searchParams.get("public_key"));
+    }
+    catch {
+        return false;
+    }
+}
+async function mercadoDigest(value) {
+    const bytes = new TextEncoder().encode(value);
+    return Array.from(new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", bytes)), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function canonical(value) {
+    return Array.isArray(value) ? value.map(canonical) : object(value) ? Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonical(value[key])])) : value;
+}
+async function mercadoContextDigest(context, tokenUrl) {
+    if (!isMercadoTokenRequest(tokenUrl, "POST"))
+        reject();
+    return mercadoDigest(JSON.stringify(canonical({ context: parseMercadoCheckoutContext(context), tokenUrl })));
+}
+function prepareMercadoConfiguration(context, card) {
+    const parsed = parseMercadoCheckoutContext(context);
+    const number = card?.number;
+    if (typeof number !== "string" || !/^\d{12,19}$/.test(number))
+        reject();
+    return { url: MERCADO_CONFIGURATION_URL, body: JSON.stringify({ cardBin: number.slice(0, 8), initializationData: parsed.initializationData }) };
+}
+function parseMercadoConfiguration(value) {
+    const method = value?.paymentMethod, issuers = value?.issuersSettings;
+    if (!object(value) || !exact(method, ["paymentMethodId", "paymentTypeId", "name"]) || !METHODS.includes(method.paymentMethodId) || !TYPES.includes(method.paymentTypeId) || !label(method.name) || !Array.isArray(issuers) || issuers.length !== 1 || !object(issuers[0]) || !label(issuers[0].name))
+        reject();
+    const issuerId = String(issuers[0].id);
+    if (!/^\d{1,11}$/.test(issuerId) || typeof issuers[0].id !== "string" && !Number.isSafeInteger(issuers[0].id))
+        reject();
+    const cvc = Array.isArray(value.fieldsSetting) ? value.fieldsSetting.filter((f) => f?.name === "security_code") : [];
+    const amex = method.paymentMethodId === "amex";
+    if (cvc.length !== 1 || cvc[0].type !== "number" || cvc[0].length !== (amex ? 4 : 3) || value.securityCodeSettings?.mode !== "mandatory" || value.securityCodeSettings?.location !== (amex ? "front" : "back"))
+        reject();
+    return {
+        paymentMethodId: method.paymentMethodId,
+        paymentTypeId: method.paymentTypeId,
+        paymentMethodName: method.name,
+        issuerId,
+        issuerName: issuers[0].name
+    };
+}
+function tokenIdentity(body) {
+    let value;
+    try {
+        value = JSON.parse(body);
+    }
+    catch {
+        reject();
+    }
+    if (!object(value) || value.live_mode === false || typeof value.id !== "string" || !/^[A-Za-z0-9_-]{8,256}$/.test(value.id))
+        reject();
+    return value.id;
+}
+async function createMercadoProcessorContext(configuration, context, tokenUrl, tokenBody) {
+    return {
+        version: 1,
+        psp: "mercado_pago",
+        source: "checkout_pro_bin8",
+        contextDigest: await mercadoContextDigest(context, tokenUrl),
+        tokenDigest: await mercadoDigest(tokenIdentity(tokenBody)),
+        ...parseMercadoConfiguration(configuration)
+    };
+}
+async function validateMercadoProcessorContext(value, context, tokenUrl, tokenBody) {
+    if (!exact(value, ["version", "psp", "source", "contextDigest", "tokenDigest", "paymentMethodId", "paymentTypeId", "paymentMethodName", "issuerId", "issuerName"]) || value.version !== 1 || value.psp !== "mercado_pago" || value.source !== "checkout_pro_bin8" || !digest(value.contextDigest) || !digest(value.tokenDigest) || !METHODS.includes(value.paymentMethodId) || !TYPES.includes(value.paymentTypeId) || !label(value.paymentMethodName) || !numberId(value.issuerId) || value.issuerId.length > 11 || !label(value.issuerName) || value.contextDigest !== await mercadoContextDigest(context, tokenUrl) || value.tokenDigest !== await mercadoDigest(tokenIdentity(tokenBody)))
+        reject();
+    return { ...value };
+}
+async function createMercadoAssociationGate({ context, tokenUrl, tokenBody, processorContext }) {
+    const checked = parseMercadoCheckoutContext(context), metadata = await validateMercadoProcessorContext(processorContext, checked, tokenUrl, tokenBody);
+    const document = mercadoCheckoutDocument(checked.documentUrl), token = tokenIdentity(tokenBody);
+    let claimed = false;
+    return { take({ url, method, body, documentUrl }) {
+            if (claimed)
+                reject();
+            const target = checkedUrl(url);
+            if (method !== "PUT" || documentUrl !== checked.documentUrl || target.pathname !== "/checkout/v1/payment/api/flow/" + document.flowId || target.search || typeof body !== "string" || body.length > 64e3)
+                reject();
+            let parsed;
+            try {
+                parsed = JSON.parse(body);
+            }
+            catch {
+                reject();
+            }
+            if (!only(parsed, ["id", "values", "type", "featureFlags", "version", "prev_step", "urlParams"]) || parsed.id !== "next_step" || parsed.type !== "redirect" || parsed.version !== "checkout" || parsed.prev_step !== "card_form" || parsed.urlParams !== document.query || !only(parsed.values, ["payment_method", "card_token", "card_ui_settings", "captchaToken"]) || parsed.values.card_token !== token || !object(parsed.values.card_ui_settings) || !only(parsed.values.payment_method, ["id", "type", "name", "issuer"]) || parsed.values.payment_method.id !== metadata.paymentMethodId || parsed.values.payment_method.type !== metadata.paymentTypeId)
+                reject();
+            claimed = true;
+            parsed.values.payment_method = {
+                id: metadata.paymentMethodId,
+                type: metadata.paymentTypeId,
+                name: metadata.paymentMethodName,
+                issuer: { id: Number(metadata.issuerId), name: metadata.issuerName }
+            };
+            return JSON.stringify(parsed);
+        }, get claimed() {
+            return claimed;
+        } };
+}
+export { MERCADO_CHECKOUT_ORIGIN, MERCADO_CHECKOUT_PATTERN, MERCADO_CONFIGURATION_URL, captureMercadoCheckoutContext, createMercadoAssociationGate, createMercadoProcessorContext, isMercadoTokenRequest, mercadoCheckoutDocument, mercadoContextDigest, mercadoDigest, parseMercadoCheckoutContext, parseMercadoConfiguration, prepareMercadoConfiguration, validateMercadoProcessorContext };

package/dist/mercado-checkout.js

@@ -0,0 +1,108 @@
+import { captureMercadoCheckoutContext, createMercadoAssociationGate, isMercadoTokenRequest, MERCADO_CONFIGURATION_URL, MERCADO_CHECKOUT_ORIGIN, parseMercadoCheckoutContext } from './mercado-checkout.generated.js';
+/** Capture only the native Checkout Pro configuration. A late configuration,
+ * navigation or repeated token cannot replace the context of an issued token.
+ * Final payment requests retain the attachment's existing payment guards.
+ */
+export class MercadoCheckoutGate {
+    context = null;
+    started = false;
+    stopped = false;
+    sequence = 0;
+    associatedFlow = null;
+    association = null;
+    matches(url) {
+        try {
+            const parsed = new URL(url);
+            return parsed.origin === MERCADO_CHECKOUT_ORIGIN
+                && (parsed.pathname === new URL(MERCADO_CONFIGURATION_URL).pathname || parsed.pathname.startsWith('/checkout/v1/payment/api/flow/'));
+        }
+        catch {
+            return false;
+        }
+    }
+    requiresDocument(url, method) {
+        try {
+            const parsed = new URL(url);
+            return method.toUpperCase() === 'POST'
+                && parsed.origin === 'https://api.mercadopago.com' && /^\/v1\/card_tokens$/i.test(parsed.pathname);
+        }
+        catch {
+            return false;
+        }
+    }
+    invalidate() {
+        if (!this.context && !this.started && this.sequence === 0)
+            return;
+        this.stopped = true;
+        this.context = null;
+        this.association = null;
+        this.sequence++;
+    }
+    async configuration(url, method, body, readDocument) {
+        if (url !== MERCADO_CONFIGURATION_URL || method !== 'POST')
+            return false;
+        if (this.started || this.stopped)
+            throw new Error('mercado_checkout_configuration_changed');
+        const sequence = ++this.sequence;
+        this.context = null;
+        const documentUrl = await readDocument();
+        // A newer native BIN lookup owns the context; the older harmless lookup
+        // still continues, but cannot erase or invalidate that newer capture.
+        if (sequence !== this.sequence && !this.stopped)
+            return true;
+        const context = captureMercadoCheckoutContext(url, method, body, documentUrl);
+        if (sequence !== this.sequence || this.started || this.stopped)
+            throw new Error('mercado_checkout_configuration_changed');
+        this.context = context;
+        return true;
+    }
+    claimToken(url, method, documentUrl) {
+        if (!this.requiresDocument(url, method))
+            return undefined;
+        // Other Mercado products remain on their existing tokenization path.
+        if (!documentUrl.startsWith(MERCADO_CHECKOUT_ORIGIN + '/checkout/'))
+            return undefined;
+        if (!isMercadoTokenRequest(url, method) || this.started || this.stopped || !this.context || this.context.documentUrl !== documentUrl)
+            throw new Error('mercado_checkout_configuration_unavailable');
+        this.started = true;
+        return parseMercadoCheckoutContext(this.context);
+    }
+    async arm(replay, tokenUrl) {
+        if (!this.started)
+            return;
+        if (this.stopped || !this.context || replay.mode !== 'token' || replay.status !== 201 || !replay.processorContext)
+            throw new Error('mercado_checkout_metadata_unavailable');
+        const context = this.context;
+        const association = await createMercadoAssociationGate({ context, tokenUrl, tokenBody: replay.body, processorContext: replay.processorContext });
+        if (this.stopped || this.context !== context)
+            throw new Error('mercado_checkout_context_changed');
+        this.association = association;
+    }
+    associationBody(url, method, body, documentUrl) {
+        if (['GET', 'HEAD', 'OPTIONS'].includes(method) || !this.matches(url) || url === MERCADO_CONFIGURATION_URL)
+            return undefined;
+        let parsed;
+        try {
+            parsed = JSON.parse(body);
+        }
+        catch {
+            if (this.started)
+                throw new Error('mercado_checkout_association_invalid');
+            return undefined;
+        }
+        // The observed Pay request keeps the existing payment guards, including
+        // after the native document navigates to review. Every card association
+        // must use the checked shape; changing prev_step cannot bypass correction.
+        const cardAssociation = parsed?.id === 'next_step' || parsed?.prev_step === 'card_form'
+            || (parsed?.values && ('card_token' in parsed.values || 'payment_method' in parsed.values));
+        if (!cardAssociation && parsed?.id === 'pay' && parsed?.prev_step === 'review' && this.associatedFlow === url)
+            return undefined;
+        if (!cardAssociation && !this.started)
+            return undefined;
+        if (!this.started || this.stopped || !this.association)
+            throw new Error('mercado_checkout_association_unavailable');
+        const corrected = this.association.take({ url, method, body, documentUrl });
+        this.associatedFlow = url;
+        return corrected;
+    }
+}

package/dist/preflight-capabilities.generated.d.ts

@@ -50,6 +50,16 @@ export declare const CHECKOUT_PREFLIGHT_CAPABILITIES: {
         readonly status: "supported";
         readonly mode: "token";
         readonly operations: readonly [{
+            readonly id: "stripe.device_checkout_confirm.v1";
+            readonly path_pattern: "^/v1/payment_pages/cs_test_[A-Za-z0-9]+/confirm$";
+            readonly effect: "payment_confirmation";
+            readonly amount_binding: "expected_amount_test_evidence_currency_unqualified";
+            readonly psp: "stripe";
+            readonly version: 1;
+            readonly mode: "token";
+            readonly autopilot_eligible: false;
+            readonly requires: "reviewed_final_payment_and_continuation_evidence";
+        }, {
             readonly id: "stripe.tokenization";
             readonly path_pattern: "^/v1/(?:payment_methods|tokens)$";
             readonly effect: "token_or_method_creation";

package/dist/preflight-capabilities.generated.js

@@ -78,6 +78,17 @@ export const CHECKOUT_PREFLIGHT_CAPABILITIES = {
             "status": "supported",
             "mode": "token",
             "operations": [
+                {
+                    "id": "stripe.device_checkout_confirm.v1",
+                    "path_pattern": "^/v1/payment_pages/cs_test_[A-Za-z0-9]+/confirm$",
+                    "effect": "payment_confirmation",
+                    "amount_binding": "expected_amount_test_evidence_currency_unqualified",
+                    "psp": "stripe",
+                    "version": 1,
+                    "mode": "token",
+                    "autopilot_eligible": false,
+                    "requires": "reviewed_final_payment_and_continuation_evidence"
+                },
                 {
                     "id": "stripe.tokenization",
                     "path_pattern": "^/v1/(?:payment_methods|tokens)$",

package/dist/preflight-catalog.json

@@ -1964,6 +1964,17 @@
       "status": "supported",
       "mode": "token",
       "operations": [
+        {
+          "id": "stripe.device_checkout_confirm.v1",
+          "path_pattern": "^/v1/payment_pages/cs_test_[A-Za-z0-9]+/confirm$",
+          "effect": "payment_confirmation",
+          "amount_binding": "expected_amount_test_evidence_currency_unqualified",
+          "psp": "stripe",
+          "version": 1,
+          "mode": "token",
+          "autopilot_eligible": false,
+          "requires": "reviewed_final_payment_and_continuation_evidence"
+        },
         {
           "id": "stripe.tokenization",
           "path_pattern": "^/v1/(?:payment_methods|tokens)$",

package/dist/preflight.generated.d.ts

@@ -195,6 +195,16 @@ export declare function getCheckoutPreflightCatalog(): {
         readonly status: "supported";
         readonly mode: "token";
         readonly operations: readonly [{
+            readonly id: "stripe.device_checkout_confirm.v1";
+            readonly path_pattern: "^/v1/payment_pages/cs_test_[A-Za-z0-9]+/confirm$";
+            readonly effect: "payment_confirmation";
+            readonly amount_binding: "expected_amount_test_evidence_currency_unqualified";
+            readonly psp: "stripe";
+            readonly version: 1;
+            readonly mode: "token";
+            readonly autopilot_eligible: false;
+            readonly requires: "reviewed_final_payment_and_continuation_evidence";
+        }, {
             readonly id: "stripe.tokenization";
             readonly path_pattern: "^/v1/(?:payment_methods|tokens)$";
             readonly effect: "token_or_method_creation";

package/dist/preparation.js

@@ -20,6 +20,8 @@ export class PreparationGate {
         lifecycle.abort.signal.addEventListener('abort', () => this.invalidate('cancelled'), { once: true });
     }
     async prepare(options) {
+        if (this.opts.stripeCheckout)
+            throw new CheckoutPreparationError(null, 'unsupported_processor');
         options = { ...options };
         if (this.state !== 'unused' || this.observedRequest || this.lifecycle.getState().status !== 'idle' || this.lifecycle.isBlocked()) {
             // A late opt-in cannot turn the next native retry into ordinary approval.

package/dist/stripe-checkout.d.ts

@@ -0,0 +1,75 @@
+import type { PausedRequest } from './client.js';
+/** Explicit development enrollment; this option cannot enable production execution. */
+export interface StripeCheckoutOptions {
+    sessionId: string;
+    publishableKey: string;
+}
+type StubResponse = {
+    status: number;
+    headers: Record<string, string>;
+    body: string;
+};
+type Step = {
+    phase: 'tokenization';
+    response: StubResponse;
+} | {
+    phase: 'final';
+    request: PausedRequest;
+};
+type Phase = Step['phase'] | 'unknown';
+type GateState = 'fresh' | 'stubbed' | 'submitted' | 'stopped';
+export type StripeCheckoutBlockStage = 'request_read' | 'classification' | 'claim' | 'readiness' | 'document' | 'stub_response';
+type ReadinessReason = 'attachment_not_ready' | 'cancelled' | 'checkout_inactive' | 'approval_pending' | 'request_inactive';
+export type StripeCheckoutBlockReason = ReadinessReason | 'request_unavailable' | 'request_validation_failed' | 'context_already_present' | 'duplicate_tokenization' | 'duplicate_confirmation' | 'preparation_unavailable' | 'preparation_missing' | 'claim_invalidated' | 'document_changed' | 'document_unavailable' | 'readiness_unavailable' | 'stub_response_failed';
+/** Native pre-authorization refusal metadata. Never contains request or exception text.
+ * Classification failures intentionally do not guess which shared-core predicate rejected.
+ * gate_state is observed before the adapter retires a failed claim. A preserved duplicate
+ * belongs to a competing request: consumers must not cancel the active checkout for it.
+ */
+export interface StripeCheckoutBlockedDetail {
+    version: 1;
+    processor: 'stripe';
+    endpoint_family: 'payment_methods' | 'payment_page_confirm' | 'other';
+    phase: Phase;
+    stage: StripeCheckoutBlockStage;
+    reason: StripeCheckoutBlockReason;
+    gate_state: GateState;
+    disposition: 'active_claim_preserved' | 'checkout_stopped';
+}
+declare class StripeCheckoutRejectionError extends Error {
+    readonly stage: StripeCheckoutBlockStage;
+    readonly reason: StripeCheckoutBlockReason;
+    readonly phase?: Phase | undefined;
+    constructor(message: string, stage: StripeCheckoutBlockStage, reason: StripeCheckoutBlockReason, phase?: Phase | undefined);
+}
+export declare function stripeCheckoutReadinessError(reason: ReadinessReason): Error;
+/** A valid competing request must not retire the request that already claimed this step. */
+export declare class StripeCheckoutClaimConflictError extends StripeCheckoutRejectionError {
+    constructor(phase: Step['phase']);
+}
+/** The two native browser requests belong to one attachment and one grant.
+ * Processor rules and form transformations live in the generated shared core.
+ * The local stub contains no selected-card data and starts no authorization.
+ */
+export declare class StripeCheckoutGate {
+    private state;
+    private readonly binding?;
+    constructor(options: {
+        stripeCheckout?: StripeCheckoutOptions;
+        executionMode?: string;
+        grantId?: string;
+        amount?: number | string;
+        currency?: string;
+    });
+    matches(url: string): boolean;
+    isEnabled(): boolean;
+    isPrepared(): boolean;
+    invalidate(): void;
+    /** Observability only: this endpoint label never participates in a payment decision. */
+    describeRejection(error: unknown, rawUrl: string, stage: StripeCheckoutBlockStage, phase?: Phase): StripeCheckoutBlockedDetail;
+    assertClaim(step: Step): void;
+    /** Check the actual top-level hosted document before preparing either step. */
+    assertDocument(raw: string): void;
+    claim(request: PausedRequest): Step | null;
+}
+export {};

package/dist/stripe-checkout.generated.d.ts

@@ -0,0 +1,47 @@
+declare var STRIPE_CHECKOUT_OPERATION: string;
+declare var STRIPE_CHECKOUT_CONTEXT_HEADER: string;
+declare function isStripeCheckoutHostedMode(value: any): boolean;
+declare function encodeStripeCheckoutContext(value: any): string;
+declare function hasStripeCheckoutMarker(request: any): boolean;
+declare function parseStripeCheckoutContext(request: any): {
+    version: number;
+    session_id: any;
+    synthetic_payment_method_id: any;
+} | null | undefined;
+declare function isStripeCheckoutEndpoint(raw: any): boolean;
+declare function classifyStripeCheckoutRequest(request: any, options?: {}): {
+    phase: string;
+    session_id: any;
+    publishable_key: any;
+    synthetic_payment_method_id?: undefined;
+    amount_cents?: undefined;
+    currency?: undefined;
+} | {
+    phase: string;
+    session_id: any;
+    publishable_key: any;
+    synthetic_payment_method_id: string | undefined;
+    amount_cents: number;
+    currency: string;
+} | null;
+declare function createStripeCheckoutTokenizationStub(request: any, options: any): {
+    status: number;
+    headers: {
+        "content-type": string;
+    };
+    body: string;
+};
+declare function parseStripeCheckoutResponse(raw: any, options: any): any;
+declare function prepareStripeCheckoutReplay(request: any, card: any, options?: {}): {
+    psp: string;
+    request: {
+        url: any;
+        method: string;
+        headers: {
+            "content-type": string;
+        };
+        body: string;
+    };
+    where: string[];
+};
+export { STRIPE_CHECKOUT_CONTEXT_HEADER, STRIPE_CHECKOUT_OPERATION, classifyStripeCheckoutRequest, createStripeCheckoutTokenizationStub, encodeStripeCheckoutContext, hasStripeCheckoutMarker, isStripeCheckoutEndpoint, isStripeCheckoutHostedMode, parseStripeCheckoutContext, parseStripeCheckoutResponse, prepareStripeCheckoutReplay };