@astrasyncai/verification-gateway 5.17.1 → 5.18.0

package/dist/index.mjs

@@ -30,7 +30,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.17.1";
+var SDK_VERSION = "5.18.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -1172,17 +1172,17 @@ function normalizeDeclaredSource(value) {
   return trimmed && DECLARED_SOURCE_PATTERN.test(trimmed) ? trimmed : void 0;
 }
 function byteLength(s) {
-  let bytes = 0;
+  let bytes2 = 0;
   for (let i = 0; i < s.length; i++) {
     const code = s.charCodeAt(i);
-    if (code < 128) bytes += 1;
-    else if (code < 2048) bytes += 2;
+    if (code < 128) bytes2 += 1;
+    else if (code < 2048) bytes2 += 2;
     else if (code >= 55296 && code <= 56319) {
-      bytes += 4;
+      bytes2 += 4;
       i++;
-    } else bytes += 3;
+    } else bytes2 += 3;
   }
-  return bytes;
+  return bytes2;
 }
 function extractApiKeyFormat(rawValue) {
   if (!rawValue) return void 0;
@@ -1359,9 +1359,9 @@ function decodeBase64Url(seg) {
   const b642 = seg.replace(/-/g, "+").replace(/_/g, "/");
   const padded = b642 + "=".repeat((4 - b642.length % 4) % 4);
   const binary2 = atob(padded);
-  const bytes = new Uint8Array(binary2.length);
-  for (let i = 0; i < binary2.length; i++) bytes[i] = binary2.charCodeAt(i);
-  return new TextDecoder().decode(bytes);
+  const bytes2 = new Uint8Array(binary2.length);
+  for (let i = 0; i < binary2.length; i++) bytes2[i] = binary2.charCodeAt(i);
+  return new TextDecoder().decode(bytes2);
 }
 function sniffJwtHeader(compact) {
   try {
@@ -1400,6 +1400,23 @@ function detectCommerce(req, host) {
   }
   const signature = headerValue(req, "signature");
   const signatureInput = headerValue(req, "signature-input");
+  if (/\/checkout[-_]sessions(\/|$)/.test(req.uri) && headerValue(req, "ucp-agent")) {
+    const signed = Boolean(signature && signatureInput);
+    return {
+      protocol: "ucp",
+      artifacts: {
+        ucpRequest: { method, url, ...jsonBody && { body: jsonBody } },
+        ...signed && {
+          rfc9421: { headers, method, url, ...req.bodyText && { body: req.bodyText } }
+        }
+      },
+      evidence: {
+        path: req.uri,
+        ...signed && { keyid: signatureInput.match(/keyid="([^"]+)"/)?.[1] },
+        ...truncated
+      }
+    };
+  }
   if (signature && signatureInput) {
     const signatureAgent = headerValue(req, "signature-agent");
     const registryHint = headerValue(req, "x-agent-registry");
@@ -1434,13 +1451,6 @@ function detectCommerce(req, host) {
       evidence: { hasTimestamp: Boolean(acpTimestamp), ...truncated }
     };
   }
-  if (/\/checkout[-_]sessions(\/|$)/.test(req.uri) && headerValue(req, "ucp-agent")) {
-    return {
-      protocol: "ucp",
-      artifacts: { ucpRequest: { method, url, ...jsonBody && { body: jsonBody } } },
-      evidence: { path: req.uri, ...truncated }
-    };
-  }
   if (jsonBody) {
     const intent = jsonBody.intent_mandate ?? jsonBody.intentMandate;
     const cart = jsonBody.cart_mandate ?? jsonBody.cartMandate;
@@ -2539,6 +2549,7 @@ function createMiddleware(options) {
     anonymousBeacon = true,
     trustVerifiedHop = false,
     verifiedHopMaxAgeMs,
+    defaultRoutePolicy = "pass",
     ...config
   } = options;
   if (config.apiBaseUrl) {
@@ -2604,12 +2615,15 @@ function createMiddleware(options) {
         });
       }
       const correlationId = req.headers["x-request-id"] || req.headers["x-correlation-id"];
-      const routeConfig = findRouteConfig(cachedRoutes, req.path, req.method, {
+      const matchedRoute = findRouteConfig(cachedRoutes, req.path, req.method, {
         caseInsensitive: caseInsensitiveRouteMatch,
         logShadowDivergence: true,
         correlationId
       });
-      if (!routeConfig) {
+      const credentials = customExtractCredentials ? customExtractCredentials(req) : defaultExtractCredentials(req);
+      const credentialed = Boolean(credentials.astraId || credentials.apiKey || credentials.jwt);
+      const observeUnmatched = !matchedRoute && (config.evaluateAlwaysIfCredentialed === true && Boolean(credentials.astraId) || defaultRoutePolicy === "observe" && credentialed);
+      if (!matchedRoute && !observeUnmatched) {
         if (config.setPassThroughHeader) {
           res.setHeader("X-Astra-Gateway-Mode", "unenforced");
           res.setHeader(
@@ -2620,10 +2634,14 @@ function createMiddleware(options) {
         beaconPassThrough?.(req);
         return next();
       }
+      const routeConfig = matchedRoute ?? {
+        pattern: req.path,
+        method: req.method,
+        observe: true
+      };
       const wellKnownUrls = config.apiBaseUrl ? await getWellKnownUrls(config.apiBaseUrl).catch(() => void 0) : void 0;
-      const credentials = customExtractCredentials ? customExtractCredentials(req) : defaultExtractCredentials(req);
       const shouldEnforce = !routeConfig.observe;
-      if (routeConfig.observe && (!config.evaluateAlwaysIfCredentialed || !credentials.astraId)) {
+      if (routeConfig.observe && !observeUnmatched && (!config.evaluateAlwaysIfCredentialed || !credentials.astraId)) {
         if (config.setPassThroughHeader) {
           res.setHeader("X-Astra-Gateway-Mode", "unenforced");
           res.setHeader("X-Astra-Gateway-Reason", "route-observe");
@@ -4105,8 +4123,8 @@ function extractBase64(value) {
   }
   return null;
 }
-function bufferToBase64(bytes) {
-  return Buffer.from(bytes).toString("base64");
+function bufferToBase64(bytes2) {
+  return Buffer.from(bytes2).toString("base64");
 }
 
 // src/transport/rfc9421-verify.ts
@@ -5273,9 +5291,9 @@ async function tryVerify(subtle, jwk, signature, body, alg) {
   }
   return false;
 }
-function toBuf(bytes) {
-  const out = new ArrayBuffer(bytes.byteLength);
-  new Uint8Array(out).set(bytes);
+function toBuf(bytes2) {
+  const out = new ArrayBuffer(bytes2.byteLength);
+  new Uint8Array(out).set(bytes2);
   return out;
 }
 function checkTimestamp(headerValue3, toleranceSec, nowFn) {
@@ -5801,11 +5819,11 @@ async function thumbprintsMatch(a, b) {
 }
 async function jwkThumbprint(jwk) {
   const canonical2 = canonicalJwk(jwk);
-  const bytes = new TextEncoder().encode(JSON.stringify(canonical2));
+  const bytes2 = new TextEncoder().encode(JSON.stringify(canonical2));
   const subtle = webcrypto.subtle;
   const buffer = await new Promise((resolve, reject) => {
-    const source = new ArrayBuffer(bytes.byteLength);
-    new Uint8Array(source).set(bytes);
+    const source = new ArrayBuffer(bytes2.byteLength);
+    new Uint8Array(source).set(bytes2);
     subtle.digest("SHA-256", source).then(resolve).catch(reject);
   });
   return Buffer.from(new Uint8Array(buffer)).toString("base64url").replace(/=+$/, "");
@@ -6198,14 +6216,14 @@ function createMastercardRegistry(options = {}) {
   const cache4 = /* @__PURE__ */ new Map();
   const ttlSec = options.cacheTtlSec ?? 3600;
   const fetchFn = options.fetch ?? globalThis.fetch;
-  let warned = false;
+  let warned2 = false;
   return {
     name: "mastercard",
     async resolve(kid) {
       if (!kid) return null;
       if (!options.registryUrl) {
-        if (!warned && !options.silent) {
-          warned = true;
+        if (!warned2 && !options.silent) {
+          warned2 = true;
           console.warn(
             "[mastercard-registry] registryUrl not configured \u2014 key resolution disabled. Kid lookups will return null until a partnership registry is supplied."
           );
@@ -10758,6 +10776,7 @@ function astrasyncPaymentHandlers(handlers, specBase = "https://astrasync.ai/ucp
   }
   return out;
 }
+var UCP_ORDER_CAPABILITY = "dev.ucp.shopping.order";
 function buildUcpProfile(opts) {
   const capabilities = {
     "dev.ucp.shopping.checkout": [
@@ -10778,6 +10797,15 @@ function buildUcpProfile(opts) {
         }
       ]
     },
+    ...opts.orders && {
+      [UCP_ORDER_CAPABILITY]: [
+        {
+          version: UCP_VERSION,
+          spec: `${SPEC}/shopping/order`,
+          schema: `${SCHEMAS}/shopping/order.json`
+        }
+      ]
+    },
     ...opts.capabilities ?? {}
   };
   return {
@@ -11154,7 +11182,7 @@ async function sendUcpWebhook(opts) {
 }
 
 // src/ucp/checkout-kit.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash10, randomUUID as randomUUID2 } from "crypto";
 import { CompactSign as CompactSign2 } from "jose";
 
 // src/mandates/sd-jwt.ts
@@ -11559,8 +11587,8 @@ function requestFingerprint(body, profile = "ucp") {
   }
   return createHash8("sha256").update(text).digest("hex");
 }
-function scopeOf(authorization) {
-  return authorization ? createHash8("sha256").update(authorization).digest("hex").slice(0, 16) : "anon";
+function scopeOf(caller) {
+  return caller ? createHash8("sha256").update(caller).digest("hex").slice(0, 16) : null;
 }
 async function beginIdempotent(opts, req) {
   const methods = opts.methods ?? ["POST", "PUT", "PATCH", "DELETE"];
@@ -11581,7 +11609,16 @@ async function beginIdempotent(opts, req) {
       message: `Idempotency-Key must be at most ${MAX_KEY_LENGTH} characters.`
     };
   }
-  const storeKey = `${scopeOf(req.auth)}:${req.method.toUpperCase()} ${req.path}:${req.key}`;
+  const scope = scopeOf(req.auth);
+  if (!scope) {
+    return opts.required ? {
+      kind: "reject",
+      status: 401,
+      code: "idempotency_caller_required",
+      message: "Idempotency keys are scoped to the caller: send Authorization."
+    } : { kind: "skip" };
+  }
+  const storeKey = `${scope}:${req.method.toUpperCase()} ${req.path}:${req.key}`;
   const requestHash = requestFingerprint(req.body, opts.profile ?? "ucp");
   const ttl = opts.ttlMs ?? DEFAULT_IDEMPOTENCY_TTL_MS;
   try {
@@ -11657,7 +11694,7 @@ function idempotencyMiddleware(opts) {
       path: (req.originalUrl ?? req.url).split("?")[0],
       body,
       key: headerOf(req.headers[header]),
-      auth: headerOf(req.headers.authorization) ?? headerOf(req.headers["x-api-key"])
+      auth: headerOf(req.headers.authorization) ?? headerOf(req.headers["x-api-key"]) ?? headerOf(req.headers["x-astra-id"])
     });
     if (decision.kind === "skip") return next();
     const key = headerOf(req.headers[header]);
@@ -11696,7 +11733,7 @@ function withIdempotency(opts, handler) {
       path: new URL(req.url).pathname,
       body,
       key: req.headers.get(header) ?? void 0,
-      auth: req.headers.get("authorization") ?? req.headers.get("x-api-key") ?? void 0
+      auth: req.headers.get("authorization") ?? req.headers.get("x-api-key") ?? req.headers.get("x-astra-id") ?? void 0
     });
     if (decision.kind === "skip") return handler(req);
     const key = req.headers.get(header) ?? void 0;
@@ -11753,18 +11790,95 @@ function orderReportAmount(result, fallback) {
   return fallback;
 }
 
+// src/ucp/kit-shared.ts
+import { createHash as createHash9 } from "crypto";
+function isHeld(result) {
+  const r = result;
+  return Boolean(
+    r.requiresStepUp || r.requiresApproval || r.recommendation === "step_up_required" || r.settlementOutcome?.status === "requires_approval" || r.stepUpApproval && r.stepUpApproval.status !== "consumed"
+  );
+}
+var scopeHash = (kind, value) => `${kind}:${createHash9("sha256").update(`${kind}
+${value}`).digest("hex").slice(0, 32)}`;
+async function resolveCallerScope(req, ctx, resolve) {
+  const verified = ctx?.callerId ?? (resolve ? await resolve(req) : void 0);
+  if (verified) return scopeHash("astra", verified);
+  const auth = req.headers.get("authorization");
+  if (auth) return scopeHash("auth", auth);
+  const astraId = req.headers.get("x-astra-id");
+  if (astraId) return scopeHash("astra-header", astraId);
+  return void 0;
+}
+var fallbackScope = (kind, value) => scopeHash(kind, value);
+function pendingResult(result) {
+  const {
+    settlementToken: _t,
+    settlement: _s,
+    mandates: _m,
+    kyaToken: _k,
+    aep: _a,
+    ...rest
+  } = result;
+  return rest;
+}
+var warned = /* @__PURE__ */ new Set();
+function warnOnce(key, message) {
+  if (warned.has(key) || process.env.NODE_ENV === "test") return;
+  warned.add(key);
+  console.warn(message);
+}
+function warnInMemoryStores(kit, missing) {
+  if (!missing.length || process.env.NODE_ENV === "test") return;
+  console.warn(
+    `[astrasync] ${kit} checkout kit is using the in-memory ${missing.join(" and ")} (sessions are lost on restart and not shared across instances). Pass ${missing.map((m) => m.startsWith("idempotency") ? "idempotencyStore" : "store").join(" and ")} in production.`
+  );
+}
+
 // src/ucp/checkout-kit.ts
 var MemoryCheckoutStore = class {
   constructor() {
     this.m = /* @__PURE__ */ new Map();
+    this.orders = /* @__PURE__ */ new Map();
   }
   async get(id) {
     return this.m.get(id) ?? null;
   }
   async put(s) {
     this.m.set(s.id, s);
+    if (s.order) this.orders.set(s.order.id, s.id);
+  }
+  async claim(id, from, to) {
+    const s = this.m.get(id);
+    if (!s || s.status !== from) return false;
+    s.status = to;
+    return true;
+  }
+  async findByOrderId(orderId) {
+    const id = this.orders.get(orderId);
+    return id ? this.m.get(id) ?? null : null;
   }
 };
+function buildUcpOrder(session, opts = {}) {
+  if (!session.order) return null;
+  const version = opts.version ?? UCP_VERSION;
+  return {
+    ucp: { version, capabilities: { [UCP_ORDER_CAPABILITY]: [{ version }] } },
+    id: session.order.id,
+    checkout_id: session.id,
+    ...session.order.permalink_url && { permalink_url: session.order.permalink_url },
+    currency: session.currency,
+    line_items: session.line_items.map((l) => ({
+      id: l.id,
+      item: l.item,
+      quantity: { total: l.quantity, fulfilled: 0 },
+      totals: l.totals,
+      status: "processing"
+    })),
+    fulfillment: { expectations: [], events: [] },
+    adjustments: [],
+    totals: session.totals
+  };
+}
 var json2 = (status, body, headers = {}) => new Response(JSON.stringify(body), {
   status,
   headers: { "content-type": "application/json", ...headers }
@@ -11777,6 +11891,24 @@ function createUcpCheckoutKit(opts) {
     store: opts.idempotencyStore ?? new MemoryIdempotencyStore(),
     profile: "ucp"
   };
+  warnInMemoryStores("UCP", [
+    ...opts.store ? [] : ["checkout store"],
+    ...opts.idempotencyStore ? [] : ["idempotency store"]
+  ]);
+  if (!store.claim) {
+    warnOnce(
+      "ucp-claim",
+      "[astrasync] UCP checkout kit: your CheckoutStore has no claim() \u2014 concurrent completes of one checkout aren't locked. Implement claim(id, from, to) as an atomic compare-and-set."
+    );
+  }
+  const orderIndex = /* @__PURE__ */ new Map();
+  const ordersOn = Boolean(profile.ucp.capabilities?.[UCP_ORDER_CAPABILITY]);
+  const handlerIds = new Set(
+    Object.entries(profile.ucp.payment_handlers).flatMap(([name, entries]) => [
+      name,
+      ...entries.map((e) => e.id)
+    ])
+  );
   const fetchProfile = opts.fetchProfile ?? (async (url, fresh) => {
     const r = await fetchUcpProfile(url, { fresh });
     return r.ok ? r.profile : r;
@@ -11788,12 +11920,12 @@ function createUcpCheckoutKit(opts) {
     const [h, , sig] = attached.split(".");
     return { detached: `${h}..${sig}`, attached };
   }
-  async function render(s, status = 200) {
+  async function render(s, status = 200, mode = "persist") {
     const view = {
       ucp: {
         version: profile.ucp.version,
         capabilities: Object.fromEntries(
-          Object.keys(profile.ucp.capabilities ?? {}).filter((k) => k !== "dev.ucp.common.payment.ap2_mandate" || s._ap2).map((k) => [k, [{ version: profile.ucp.version }]])
+          Object.keys(profile.ucp.capabilities ?? {}).filter((k) => k !== "dev.ucp.common.payment.ap2_mandate" || s._ap2).filter((k) => k !== UCP_ORDER_CAPABILITY).map((k) => [k, [{ version: profile.ucp.version }]])
         ),
         payment_handlers: profile.ucp.payment_handlers
       },
@@ -11802,21 +11934,132 @@ function createUcpCheckoutKit(opts) {
       currency: s.currency,
       line_items: s.line_items,
       totals: s.totals,
+      ...opts.links?.length && { links: opts.links },
       ...s.buyer && { buyer: s.buyer },
       ...s.messages?.length && { messages: s.messages },
       ...s.continue_url && s.status === "requires_escalation" && { continue_url: s.continue_url },
       ...s.order && { order: s.order }
     };
-    if (s._ap2) {
-      const auth = await merchantAuthorization(view);
-      if (auth) {
-        view.ap2 = { merchant_authorization: auth.detached };
-        s._checkoutJwt = auth.attached;
-        await store.put(s);
+    if (s._ap2 && opts.signingKey) {
+      const viewHash = createHash10("sha256").update(canonicalJson2(view)).digest("hex");
+      if (mode === "reuse" && s._merchantAuth && s._merchantAuthFor === viewHash) {
+        view.ap2 = { merchant_authorization: s._merchantAuth };
+      } else {
+        const auth = await merchantAuthorization(view);
+        if (auth) {
+          view.ap2 = { merchant_authorization: auth.detached };
+          if (mode !== "ephemeral") {
+            s._checkoutJwt = auth.attached;
+            s._merchantAuth = auth.detached;
+            s._merchantAuthFor = viewHash;
+            await store.put(s);
+          }
+        }
       }
     }
     return json2(status, view);
   }
+  function busy(s) {
+    return render(
+      {
+        ...s,
+        messages: [
+          ...s.messages ?? [],
+          ucpError(
+            "checkout_in_progress",
+            "This checkout is already being completed. Retry shortly.",
+            "recoverable"
+          )
+        ]
+      },
+      200,
+      "ephemeral"
+    );
+  }
+  async function save(s) {
+    if (s.order) orderIndex.set(s.order.id, s.id);
+    await store.put(s);
+  }
+  function webhookTarget(s) {
+    const w = opts.webhook;
+    if (!w) return null;
+    const url = w.url ?? s._webhookUrl;
+    const privateKey = w.privateKey ?? opts.signingKey?.privateKey ?? void 0;
+    const keyId = w.keyId ?? opts.signingKey?.kid;
+    if (!url || !privateKey || !keyId) return null;
+    return { w, url, privateKey, keyId };
+  }
+  async function deliverOrder(s) {
+    const target = webhookTarget(s);
+    const order = buildUcpOrder(s, { version: profile.ucp.version });
+    if (!target || !order) return null;
+    const r = await sendUcpWebhook({
+      url: target.url,
+      body: order,
+      privateKey: target.privateKey,
+      keyId: target.keyId,
+      businessProfileUrl: target.w.businessProfileUrl ?? new URL("/.well-known/ucp", opts.profile.endpoint).toString(),
+      ...target.w.attempts && { attempts: target.w.attempts },
+      ...target.w.fetch && { fetch: target.w.fetch }
+    });
+    target.w.onResult?.(r, order);
+    return r;
+  }
+  function emitOrder(s) {
+    void deliverOrder(s).catch(() => void 0);
+  }
+  async function reportOutcome(p, settled) {
+    if (!opts.reportSettlement || !p.orderId) return;
+    await opts.reportSettlement({
+      orderId: p.orderId,
+      status: settled.status,
+      ...p.report,
+      ...settled.status === "settled" && settled.processorRef && { processorRef: settled.processorRef },
+      ...settled.status === "settled" && settled.txHash && { txHash: settled.txHash, chainId: settled.chainId },
+      ...settled.status === "failed" && settled.failureCode && { failureCode: settled.failureCode }
+    }).catch(() => void 0);
+  }
+  async function finish(s, result, p, settled) {
+    await reportOutcome(p, settled);
+    delete s._pending;
+    if (settled.status === "failed") {
+      s.status = "ready_for_complete";
+      s.messages = [
+        ucpError("payment_failed", "The payment did not go through.", "requires_buyer_input")
+      ];
+      await save(s);
+      return;
+    }
+    const order = await opts.fulfil({ session: s, result });
+    s.order = {
+      ...order,
+      ...!order.permalink_url && opts.permalinkBase && {
+        permalink_url: `${opts.permalinkBase.replace(/\/+$/, "")}/${encodeURIComponent(order.id)}`
+      }
+    };
+    s.status = "completed";
+    s.messages = [];
+    await save(s);
+    emitOrder(s);
+  }
+  async function claim2(s, from) {
+    if (store.claim) {
+      if (!await store.claim(s.id, from, "complete_in_progress")) return false;
+      s.status = "complete_in_progress";
+      return true;
+    }
+    s.status = "complete_in_progress";
+    await store.put(s);
+    return true;
+  }
+  async function bindAgent(req, result) {
+    const mode = opts.ucpAgentBinding ?? "registered";
+    if (mode === "off") return null;
+    const identities = opts.resolveIdentities ? await opts.resolveIdentities(req, result) : result.agent?.protocolIdentities;
+    if (mode === "registered" && !identities?.ucpProfile) return null;
+    const b = checkUcpAgentBinding(req.headers.get("ucp-agent"), identities);
+    return b.ok ? null : b;
+  }
   async function priceLines(lines) {
     const out = [];
     const messages = [];
@@ -11909,13 +12152,13 @@ function createUcpCheckoutKit(opts) {
       ap2: Boolean(neg.capabilities["dev.ucp.common.payment.ap2_mandate"])
     };
   }
-  async function withIdempotency2(req, body, path, run) {
+  async function withIdempotency2(req, body, path, caller, run) {
     const d = await beginIdempotent(idem, {
       method: req.method,
       path,
       body,
       key: req.headers.get("idempotency-key") ?? void 0,
-      auth: req.headers.get("ucp-agent") ?? void 0
+      auth: caller
     });
     if (d.kind === "reject")
       return json2(d.status, { type: "invalid_request", code: d.code, message: d.message });
@@ -11936,6 +12179,7 @@ function createUcpCheckoutKit(opts) {
   }
   async function complete(req, s, body) {
     if (s.status === "completed" || s.status === "canceled") return render(s);
+    if (s.status === "complete_in_progress") return busy(s);
     const ap2 = body.ap2;
     const checkoutJwt = s._ap2 ? s._checkoutJwt : void 0;
     if (s._ap2) {
@@ -11947,6 +12191,7 @@ function createUcpCheckoutKit(opts) {
             "unrecoverable"
           )
         ];
+        await store.put(s);
         return render(s);
       }
       const kidResolver = async (kid) => opts.mandateKey ? opts.mandateKey(kid, s) : (s._platformKeys ?? []).find((k) => k.kid === kid) ?? null;
@@ -11957,71 +12202,106 @@ function createUcpCheckoutKit(opts) {
       });
       if (!v.ok) {
         s.messages = [ucpError(v.code, v.error, "unrecoverable")];
+        await store.put(s);
         return render(s);
       }
     }
-    const result = await opts.verifyPurchase({
-      session: s,
-      checkoutSessionId: s._astraCheckoutSessionId ?? s.id,
-      astraId: req.headers.get("x-astra-id") ?? void 0,
-      attemptId: req.headers.get("x-astra-attempt-id") ?? void 0,
-      ...checkoutJwt && { checkoutJwt },
-      valueMajor: total(s) / 100
-    });
-    const held = result.settlementOutcome?.status === "requires_approval" || result.stepUpApproval && result.stepUpApproval.status === "pending";
-    if (held) {
-      s.status = "requires_escalation";
-      s.continue_url = result.stepUpApproval?.approvalUrl ?? opts.fallbackContinueUrl;
-      s.messages = [
-        ucpError(
-          "buyer_approval_required",
-          "The buyer needs to approve this purchase.",
-          "requires_buyer_review"
-        )
-      ];
-      await store.put(s);
-      return render(s);
-    }
-    if (!result.identityVerified || !result.policyAllowed) {
+    const instruments = body.payment?.instruments;
+    const instrument = Array.isArray(instruments) && instruments.length === 1 ? instruments[0] : null;
+    if (!instrument || typeof instrument.handler_id !== "string" || !handlerIds.has(instrument.handler_id)) {
       s.messages = [
         ucpError(
-          "agent_not_authorized",
-          "The agent is not authorized for this purchase.",
-          "unrecoverable"
+          "payment_failed",
+          "Send exactly one payment instrument whose handler_id is one of this business\u2019s payment_handlers.",
+          "recoverable",
+          "$.payment.instruments"
         )
       ];
       await store.put(s);
       return render(s);
     }
-    s.status = "complete_in_progress";
-    const instruments = body.payment?.instruments;
-    const settled = await opts.settle({ session: s, result, instrument: instruments?.[0] });
-    const orderId = result.settlementOutcome?.orderId;
-    if (opts.reportSettlement && orderId && settled.status !== "pending") {
-      await opts.reportSettlement({
-        orderId,
-        status: settled.status === "settled" ? "settled" : "failed",
-        ...orderReportAmount(result, { amountMinor: total(s), currency: s.currency }),
-        ...settled.status === "settled" && settled.processorRef && { processorRef: settled.processorRef },
-        ...settled.status === "settled" && settled.txHash && { txHash: settled.txHash, chainId: settled.chainId },
-        ...settled.status === "failed" && settled.failureCode && { failureCode: settled.failureCode }
-      }).catch(() => void 0);
+    const from = s.status;
+    if (!await claim2(s, from)) {
+      const current = await store.get(s.id);
+      return busy(current ?? s);
     }
-    if (settled.status === "failed") {
-      s.status = "ready_for_complete";
-      s.messages = [
-        ucpError("payment_failed", "The payment did not go through.", "requires_buyer_input")
-      ];
-      await store.put(s);
+    try {
+      const result = await opts.verifyPurchase({
+        session: s,
+        checkoutSessionId: s._astraCheckoutSessionId ?? s.id,
+        astraId: req.headers.get("x-astra-id") ?? void 0,
+        attemptId: req.headers.get("x-astra-attempt-id") ?? void 0,
+        ...checkoutJwt && { checkoutJwt },
+        valueMajor: total(s) / 100
+      });
+      const binding2 = await bindAgent(req, result);
+      if (binding2) {
+        s.status = from;
+        s.messages = [ucpError(binding2.code, binding2.message, "unrecoverable")];
+        await store.put(s);
+        return render(s);
+      }
+      if (isHeld(result)) {
+        s.status = "requires_escalation";
+        s.continue_url = result.stepUpApproval?.approvalUrl ?? opts.fallbackContinueUrl;
+        s.messages = [
+          ucpError(
+            "buyer_approval_required",
+            "The buyer needs to approve this purchase.",
+            "requires_buyer_review"
+          )
+        ];
+        await store.put(s);
+        return render(s);
+      }
+      if (!result.identityVerified || !result.policyAllowed) {
+        s.status = from;
+        s.messages = [
+          ucpError(
+            "agent_not_authorized",
+            "The agent is not authorized for this purchase.",
+            "unrecoverable"
+          )
+        ];
+        await store.put(s);
+        return render(s);
+      }
+      const settled = await opts.settle({ session: s, result, instrument });
+      const pending = {
+        ...result.settlementOutcome?.orderId && {
+          orderId: result.settlementOutcome.orderId
+        },
+        report: orderReportAmount(result, { amountMinor: total(s), currency: s.currency }),
+        result: pendingResult(result)
+      };
+      if (settled.status === "pending") {
+        s._pending = pending;
+        s.messages = [];
+        await store.put(s);
+        return render(s);
+      }
+      await finish(s, result, pending, settled);
       return render(s);
+    } catch (e) {
+      if (s.status === "complete_in_progress" && !s._pending) {
+        s.status = from;
+        await store.put(s).catch(() => void 0);
+      }
+      throw e;
     }
-    s.order = await opts.fulfil({ session: s, result });
-    s.status = "completed";
-    s.messages = [];
-    await store.put(s);
-    return render(s);
   }
-  async function handle(req) {
+  async function resolvePending(sessionId, outcome) {
+    const s = await store.get(sessionId);
+    if (!s) return null;
+    if (s.status !== "complete_in_progress" || !s._pending) return s;
+    await finish(s, s._pending.result, s._pending, outcome);
+    return s;
+  }
+  async function sendOrderWebhook(sessionId) {
+    const s = await store.get(sessionId);
+    return s ? deliverOrder(s) : null;
+  }
+  async function handle(req, reqCtx) {
     const base = new URL(opts.profile.endpoint).pathname.replace(/\/+$/, "");
     const url = new URL(req.url);
     const path = url.pathname.startsWith(base) ? url.pathname.slice(base.length) : url.pathname;
@@ -12035,9 +12315,11 @@ function createUcpCheckoutKit(opts) {
     const p = await platform(req, body);
     if ("error" in p && p.error) return p.error;
     const ctx = p;
+    const caller = await resolveCallerScope(req, reqCtx, opts.resolveCallerId) ?? fallbackScope("ucp-profile", ctx.profileUrl);
     if (req.method === "POST" && path === "/checkout-sessions") {
-      return withIdempotency2(req, body, path, async () => {
+      return withIdempotency2(req, body, path, caller, async () => {
         const priced = await priceLines(parsed.line_items ?? []);
+        const webhookUrl = ctx.plat.ucp.capabilities?.[UCP_ORDER_CAPABILITY]?.[0]?.config?.webhook_url;
         const s2 = {
           id: `chk_${randomUUID2().replace(/-/g, "")}`,
           status: priced.lines.length && !priced.messages.length ? "ready_for_complete" : "incomplete",
@@ -12046,9 +12328,11 @@ function createUcpCheckoutKit(opts) {
           totals: priced.totals,
           messages: priced.messages,
           ...parsed.buyer ? { buyer: parsed.buyer } : {},
+          _caller: caller,
           _platformProfile: ctx.profileUrl,
           _ap2: ctx.ap2,
           _platformKeys: ctx.plat.keys ?? [],
+          ...typeof webhookUrl === "string" && /^https:\/\//.test(webhookUrl) && { _webhookUrl: webhookUrl },
           ...req.headers.get("x-astra-checkout-session") && {
             _astraCheckoutSessionId: req.headers.get("x-astra-checkout-session").slice(0, 64)
           }
@@ -12067,16 +12351,28 @@ function createUcpCheckoutKit(opts) {
         return render(s2, 201);
       });
     }
+    const notFound = (what = "checkout session") => json2(404, { code: "not_found", content: `Unknown ${what}.` });
+    const om = /^\/orders\/([^/]+)$/.exec(path);
+    if (om && ordersOn) {
+      if (req.method !== "GET")
+        return json2(405, { code: "method_not_allowed", content: "Method not allowed." });
+      const orderId = decodeURIComponent(om[1]);
+      const viaIndex = orderIndex.get(orderId);
+      const s2 = store.findByOrderId ? await store.findByOrderId(orderId) : viaIndex ? await store.get(viaIndex) : null;
+      if (!s2 || s2._caller !== caller || s2._platformProfile !== ctx.profileUrl)
+        return notFound("order");
+      const order = buildUcpOrder(s2, { version: profile.ucp.version });
+      return order ? json2(200, order) : notFound("order");
+    }
     const m = /^\/checkout-sessions\/([^/]+)(\/complete|\/cancel)?$/.exec(path);
     if (!m) return json2(404, { code: "not_found", content: "Unknown operation." });
     const s = await store.get(m[1]);
-    if (!s) return json2(404, { code: "not_found", content: "Unknown checkout session." });
-    if (s._platformProfile !== ctx.profileUrl)
-      return json2(404, { code: "not_found", content: "Unknown checkout session." });
-    if (req.method === "GET" && !m[2]) return render(s);
+    if (!s || s._caller !== caller || s._platformProfile !== ctx.profileUrl) return notFound();
+    if (req.method === "GET" && !m[2]) return render(s, 200, "reuse");
     if (req.method === "PUT" && !m[2]) {
-      return withIdempotency2(req, body, path, async () => {
+      return withIdempotency2(req, body, path, caller, async () => {
         if (s.status === "completed" || s.status === "canceled") return render(s);
+        if (s.status === "complete_in_progress") return busy(s);
         if (parsed.line_items) {
           const priced = await priceLines(parsed.line_items);
           s.line_items = priced.lines;
@@ -12090,11 +12386,17 @@ function createUcpCheckoutKit(opts) {
       });
     }
     if (req.method === "POST" && m[2] === "/complete") {
-      return withIdempotency2(req, body, path, () => complete(req, s, parsed));
+      return withIdempotency2(req, body, path, caller, () => complete(req, s, parsed));
     }
     if (req.method === "POST" && m[2] === "/cancel") {
-      return withIdempotency2(req, body, path, async () => {
-        if (s.status !== "completed") s.status = "canceled";
+      return withIdempotency2(req, body, path, caller, async () => {
+        if (s.status === "completed" || s.status === "canceled")
+          return json2(405, {
+            code: "method_not_allowed",
+            content: `A ${s.status} checkout can't be canceled.`
+          });
+        if (s.status === "complete_in_progress") return busy(s);
+        s.status = "canceled";
         await store.put(s);
         return render(s);
       });
@@ -12104,7 +12406,9 @@ function createUcpCheckoutKit(opts) {
   return {
     handle,
     profile,
-    profileHandler: () => json2(200, profile, { "cache-control": "public, max-age=300" })
+    profileHandler: () => json2(200, profile, { "cache-control": "public, max-age=300" }),
+    resolvePending,
+    sendOrderWebhook
   };
 }
 
@@ -12157,7 +12461,7 @@ function x402PaymentMatchesOffer(payment, offered) {
 }
 
 // src/payments/mpp.ts
-import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHash as createHash11, createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var b64url = (s) => Buffer.from(s, "utf8").toString("base64url");
 function canonical(value) {
   if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
@@ -12166,27 +12470,29 @@ function canonical(value) {
   }
   return JSON.stringify(value);
 }
-var BOUND = [
-  "realm",
-  "method",
-  "intent",
-  "request",
-  "expires",
-  "digest",
-  "opaque",
-  "header"
-];
+var requestSlot = (request) => typeof request === "string" ? request : b64url(canonical(request ?? {}));
 function binding(c, secret) {
-  const material = BOUND.map(
-    (k) => `${k}=${c[k] ?? ""}`
-  ).join("\n");
-  return createHmac2("sha256", secret).update(material).digest("base64url");
+  const slots = [
+    c.realm,
+    c.method,
+    c.intent,
+    requestSlot(c.request),
+    c.expires ?? "",
+    c.digest ?? ""
+  ];
+  if (c.header && c.header.toLowerCase() !== "authorization") slots.push(c.header);
+  slots.push(c.opaque ?? "");
+  return createHmac2("sha256", secret).update(slots.join("|")).digest("base64url");
 }
 var quote = (v) => `"${v.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 function buildMppChallenge(input, hmacSecret) {
   if (!/^[a-z]+$/.test(input.method)) throw new Error("mpp: method must be lowercase ASCII");
-  const { request, ...rest } = input;
-  const c = { ...rest, request: b64url(canonical(request)) };
+  const { request, meta, ...rest } = input;
+  const c = {
+    ...rest,
+    request: b64url(canonical(request)),
+    ...rest.opaque === void 0 && meta !== void 0 && { opaque: b64url(canonical(meta)) }
+  };
   const challenge = { id: binding(c, hmacSecret), ...c };
   const parts = Object.keys(challenge).filter((k) => challenge[k] !== void 0).map((k) => `${k}=${quote(String(challenge[k]))}`);
   return { challenge, header: `Payment ${parts.join(", ")}` };
@@ -12203,13 +12509,71 @@ function parseMppCredential(header) {
     return null;
   }
 }
-function verifyMppChallenge(challenge, hmacSecret, now = /* @__PURE__ */ new Date()) {
+var MemoryMppChallengeStore = class {
+  constructor(defaultTtlMs = 60 * 60 * 1e3, now = Date.now) {
+    this.defaultTtlMs = defaultTtlMs;
+    this.now = now;
+    this.seen = /* @__PURE__ */ new Map();
+  }
+  async consume(id, expiresAt) {
+    const t = this.now();
+    for (const [k, exp] of this.seen) if (exp <= t) this.seen.delete(k);
+    if (this.seen.has(id)) return false;
+    this.seen.set(id, Number.isFinite(expiresAt) ? expiresAt : t + this.defaultTtlMs);
+    return true;
+  }
+};
+function mppBodyDigest(body) {
+  return `sha-256=${createHash11("sha256").update(body).digest("base64")}`;
+}
+function checkChallenge(challenge, hmacSecret, now) {
   const { id, ...rest } = challenge;
   const expected = Buffer.from(binding(rest, hmacSecret));
   const got = Buffer.from(String(id ?? ""));
-  if (expected.length !== got.length || !timingSafeEqual2(expected, got)) return false;
-  if (challenge.expires && Date.parse(challenge.expires) < now.getTime()) return false;
-  return true;
+  if (expected.length !== got.length || !timingSafeEqual2(expected, got))
+    return { ok: false, reason: "invalid_id" };
+  if (challenge.expires && Date.parse(challenge.expires) < now.getTime())
+    return { ok: false, reason: "expired" };
+  return { ok: true };
+}
+function verifyMppChallenge(challenge, hmacSecret, nowOrOptions = /* @__PURE__ */ new Date()) {
+  if (nowOrOptions instanceof Date) return checkChallenge(challenge, hmacSecret, nowOrOptions).ok;
+  const opts = nowOrOptions;
+  return (async () => {
+    const base = checkChallenge(challenge, hmacSecret, opts.now ?? /* @__PURE__ */ new Date());
+    if (!base.ok) return base;
+    if (challenge.digest) {
+      if (opts.body === void 0) return { ok: false, reason: "body_required" };
+      const want = Buffer.from(challenge.digest);
+      const got = Buffer.from(mppBodyDigest(opts.body));
+      if (want.length !== got.length || !timingSafeEqual2(want, got))
+        return { ok: false, reason: "digest_mismatch" };
+    }
+    if (opts.store) {
+      const expiresAt = challenge.expires ? Date.parse(challenge.expires) : NaN;
+      if (!await opts.store.consume(challenge.id, expiresAt))
+        return { ok: false, reason: "already_used" };
+    }
+    return { ok: true };
+  })();
+}
+function buildMpp402Response(challenges, problem = {}) {
+  const list = Array.isArray(challenges) ? challenges : [challenges];
+  const headers = new Headers({
+    "content-type": "application/problem+json",
+    "cache-control": "no-store"
+  });
+  for (const c of list) headers.append("www-authenticate", typeof c === "string" ? c : c.header);
+  return new Response(
+    JSON.stringify({
+      type: problem.type ?? "about:blank",
+      title: problem.title ?? "Payment Required",
+      status: 402,
+      ...problem.detail && { detail: problem.detail },
+      ...problem.instance && { instance: problem.instance }
+    }),
+    { status: 402, headers }
+  );
 }
 function decodeMppRequest(challenge) {
   try {
@@ -12292,7 +12656,7 @@ async function verifyKyaPayTokens(header, opts) {
 
 // src/aep/core.ts
 import {
-  createHash as createHash9,
+  createHash as createHash12,
   createPrivateKey,
   createPublicKey,
   sign,
@@ -12318,7 +12682,7 @@ function aepCanonicalJson(value) {
   throw new Error(`AEP canonical JSON: unsupported value of type ${typeof value}`);
 }
 function digest(input) {
-  return createHash9("sha256").update(aepCanonicalJson(input), "utf8").digest();
+  return createHash12("sha256").update(aepCanonicalJson(input), "utf8").digest();
 }
 function aepHash(input) {
   return `sha256:${digest(input).toString("hex")}`;
@@ -12338,10 +12702,10 @@ function aepPrivateKeyFromSeed(seedBase64) {
   });
 }
 function aepPublicKeyFromBase64(raw) {
-  const bytes = Buffer.from(raw, "base64");
-  if (bytes.length !== 32) throw new Error("Ed25519 public key must be 32 bytes");
+  const bytes2 = Buffer.from(raw, "base64");
+  if (bytes2.length !== 32) throw new Error("Ed25519 public key must be 32 bytes");
   return createPublicKey({
-    key: Buffer.concat([ED25519_SPKI_PREFIX, bytes]),
+    key: Buffer.concat([ED25519_SPKI_PREFIX, bytes2]),
     format: "der",
     type: "spki"
   });
@@ -12460,6 +12824,31 @@ function aepPublicKeyDocument(keys, revocations = []) {
 // src/acp/checkout-kit.ts
 import { randomUUID as randomUUID3 } from "crypto";
 var ACP_API_VERSION = "2026-04-17";
+var ACP_SUPPORTED_API_VERSIONS = [ACP_API_VERSION];
+function acpPaymentHandlers(names) {
+  return names.map((name, i) => ({
+    id: name.split(".").pop(),
+    name,
+    version: ACP_API_VERSION,
+    spec: `https://astrasync.ai/ucp/handlers/${name}`,
+    requires_delegate_payment: false,
+    requires_pci_compliance: false,
+    psp: "astrasync",
+    config_schema: `https://astrasync.ai/ucp/handlers/${name}.json`,
+    instrument_schemas: [],
+    config: {},
+    display_order: i
+  }));
+}
+function buildAcpWellKnown(opts) {
+  return {
+    protocol: "acp",
+    api_versions: [...opts.apiVersions ?? ACP_SUPPORTED_API_VERSIONS],
+    endpoint: opts.endpoint,
+    capabilities: { payment: { handlers: acpPaymentHandlers(opts.paymentHandlers) } },
+    ...opts.links?.length && { links: opts.links }
+  };
+}
 var json3 = (status, body) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
 var apiError = (status, code, message, param) => json3(status, { type: "invalid_request", code, message, ...param && { param } });
 var total2 = (s) => s.totals.find((t) => t.type === "total")?.amount ?? 0;
@@ -12467,26 +12856,30 @@ function createAcpCheckoutKit(opts) {
   const mem = /* @__PURE__ */ new Map();
   const store = opts.store ?? {
     get: async (id) => mem.get(id) ?? null,
-    put: async (s) => void mem.set(s.id, s)
+    put: async (s) => void mem.set(s.id, s),
+    claim: async (id, from, to) => {
+      const s = mem.get(id);
+      if (!s || s.status !== from) return false;
+      s.status = to;
+      return true;
+    }
   };
   const idem = {
     store: opts.idempotencyStore ?? new MemoryIdempotencyStore(),
     profile: "acp",
     required: true
   };
-  const handlers = opts.paymentHandlers.map((name, i) => ({
-    id: name.split(".").pop(),
-    name,
-    version: ACP_API_VERSION,
-    spec: `https://astrasync.ai/ucp/handlers/${name}`,
-    requires_delegate_payment: false,
-    requires_pci_compliance: false,
-    psp: "astrasync",
-    config_schema: `https://astrasync.ai/ucp/handlers/${name}.json`,
-    instrument_schemas: [],
-    config: {},
-    display_order: i
-  }));
+  warnInMemoryStores("ACP", [
+    ...opts.store ? [] : ["checkout store"],
+    ...opts.idempotencyStore ? [] : ["idempotency store"]
+  ]);
+  if (!store.claim) {
+    warnOnce(
+      "acp-claim",
+      "[astrasync] ACP checkout kit: your store has no claim() \u2014 concurrent completes of one session aren't locked. Implement claim(id, from, to) as an atomic compare-and-set."
+    );
+  }
+  const handlers = acpPaymentHandlers(opts.paymentHandlers);
   function view(s) {
     return {
       id: s.id,
@@ -12541,13 +12934,13 @@ function createAcpCheckoutKit(opts) {
       ]
     };
   }
-  async function idempotent(req, body, path, run) {
+  async function idempotent(req, body, path, caller, run) {
     const d = await beginIdempotent(idem, {
       method: req.method,
       path,
       body,
       key: req.headers.get("idempotency-key") ?? void 0,
-      auth: req.headers.get("authorization") ?? void 0
+      auth: caller
     });
     if (d.kind === "reject") return apiError(d.status, d.code, d.message);
     if (d.kind === "replay")
@@ -12564,63 +12957,21 @@ function createAcpCheckoutKit(opts) {
       });
     return res;
   }
-  async function complete(req, s, body) {
-    if (s.status === "completed" || s.status === "canceled") return json3(200, view(s));
-    if (!body.payment_data)
-      return apiError(400, "missing", "payment_data is required.", "$.payment_data");
-    const result = await opts.verifyPurchase({
-      session: s,
-      checkoutSessionId: s._astraCheckoutSessionId ?? s.id,
-      astraId: req.headers.get("x-astra-id") ?? void 0,
-      attemptId: req.headers.get("x-astra-attempt-id") ?? void 0,
-      valueMajor: total2(s) / 100
-    });
-    const held = result.settlementOutcome?.status === "requires_approval" || result.stepUpApproval?.status === "pending";
-    if (held) {
-      s.status = "pending_approval";
-      s.continue_url = result.stepUpApproval?.approvalUrl ?? opts.fallbackContinueUrl;
-      s.messages = [
-        {
-          type: "error",
-          code: "approval_required",
-          content: "The buyer needs to approve this purchase.",
-          severity: "medium",
-          resolution: "requires_buyer_review"
-        }
-      ];
-      await store.put(s);
-      return json3(200, view(s));
-    }
-    if (!result.identityVerified || !result.policyAllowed) {
-      s.messages = [
-        {
-          type: "error",
-          code: "intervention_required",
-          content: "The agent is not authorized for this purchase.",
-          severity: "high",
-          resolution: "requires_buyer_review"
-        }
-      ];
-      await store.put(s);
-      return json3(200, view(s));
-    }
-    s.status = "complete_in_progress";
-    const settled = await opts.settle({
-      session: s,
-      result,
-      paymentData: body.payment_data
-    });
-    const orderId = result.settlementOutcome?.orderId;
-    if (opts.reportSettlement && orderId && settled.status !== "pending") {
-      await opts.reportSettlement({
-        orderId,
-        status: settled.status === "settled" ? "settled" : "failed",
-        ...orderReportAmount(result, { amountMinor: total2(s), currency: s.currency }),
-        ...settled.status === "settled" && settled.processorRef && { processorRef: settled.processorRef },
-        ...settled.status === "settled" && settled.txHash && { txHash: settled.txHash, chainId: settled.chainId },
-        ...settled.status === "failed" && settled.failureCode && { failureCode: settled.failureCode }
-      }).catch(() => void 0);
-    }
+  const inProgress = () => apiError(409, "checkout_in_progress", "This checkout session is already being completed.");
+  async function reportOutcome(p, settled) {
+    if (!opts.reportSettlement || !p.orderId) return;
+    await opts.reportSettlement({
+      orderId: p.orderId,
+      status: settled.status,
+      ...p.report,
+      ...settled.status === "settled" && settled.processorRef && { processorRef: settled.processorRef },
+      ...settled.status === "settled" && settled.txHash && { txHash: settled.txHash, chainId: settled.chainId },
+      ...settled.status === "failed" && settled.failureCode && { failureCode: settled.failureCode }
+    }).catch(() => void 0);
+  }
+  async function finish(s, result, p, settled) {
+    await reportOutcome(p, settled);
+    delete s._pending;
     if (settled.status === "failed") {
       s.status = "ready_for_payment";
       s.messages = [
@@ -12633,26 +12984,126 @@ function createAcpCheckoutKit(opts) {
         }
       ];
       await store.put(s);
-      return json3(200, view(s));
+      return;
     }
     const order = await opts.fulfil({ session: s, result });
+    const permalink = order.permalink_url ?? (opts.permalinkBase && `${opts.permalinkBase.replace(/\/+$/, "")}/${encodeURIComponent(order.id)}`);
     s.order = {
       id: order.id,
+      checkout_session_id: s.id,
       status: "confirmed",
       currency: s.currency.toLowerCase(),
       total: total2(s),
-      line_items: [],
+      line_items: s.line_items.map((l) => ({
+        id: l.id,
+        item: l.item,
+        name: l.name,
+        quantity: l.quantity,
+        unit_amount: l.unit_amount,
+        totals: l.totals
+      })),
       created_at: (/* @__PURE__ */ new Date()).toISOString(),
-      ...order.permalink_url && { permalink_url: order.permalink_url }
+      ...permalink && { permalink_url: permalink }
     };
     s.status = "completed";
     s.messages = [];
     await store.put(s);
-    return json3(200, view(s));
   }
-  async function handle(req) {
-    if (!req.headers.get("api-version"))
-      return apiError(400, "missing", "The API-Version header is required.");
+  async function complete(req, s, body) {
+    if (s.status === "completed" || s.status === "canceled") return json3(200, view(s));
+    if (s.status === "complete_in_progress") return inProgress();
+    if (!body.payment_data)
+      return apiError(400, "missing", "payment_data is required.", "$.payment_data");
+    const from = s.status;
+    if (store.claim) {
+      if (!await store.claim(s.id, from, "complete_in_progress")) return inProgress();
+      s.status = "complete_in_progress";
+    } else {
+      s.status = "complete_in_progress";
+      await store.put(s);
+    }
+    try {
+      const result = await opts.verifyPurchase({
+        session: s,
+        checkoutSessionId: s._astraCheckoutSessionId ?? s.id,
+        astraId: req.headers.get("x-astra-id") ?? void 0,
+        attemptId: req.headers.get("x-astra-attempt-id") ?? void 0,
+        valueMajor: total2(s) / 100
+      });
+      if (isHeld(result)) {
+        s.status = "pending_approval";
+        s.continue_url = result.stepUpApproval?.approvalUrl ?? opts.fallbackContinueUrl;
+        s.messages = [
+          {
+            type: "error",
+            code: "approval_required",
+            content: "The buyer needs to approve this purchase.",
+            severity: "medium",
+            resolution: "requires_buyer_review"
+          }
+        ];
+        await store.put(s);
+        return json3(200, view(s));
+      }
+      if (!result.identityVerified || !result.policyAllowed) {
+        s.status = from;
+        s.messages = [
+          {
+            type: "error",
+            code: "intervention_required",
+            content: "The agent is not authorized for this purchase.",
+            severity: "high",
+            resolution: "requires_buyer_review"
+          }
+        ];
+        await store.put(s);
+        return json3(200, view(s));
+      }
+      const settled = await opts.settle({
+        session: s,
+        result,
+        paymentData: body.payment_data
+      });
+      const orderId = result.settlementOutcome?.orderId;
+      const pending = {
+        ...orderId && { orderId },
+        report: orderReportAmount(result, { amountMinor: total2(s), currency: s.currency }),
+        result: pendingResult(result)
+      };
+      if (settled.status === "pending") {
+        s._pending = pending;
+        s.messages = [];
+        await store.put(s);
+        return json3(200, view(s));
+      }
+      await finish(s, result, pending, settled);
+      return json3(200, view(s));
+    } catch (e) {
+      if (s.status === "complete_in_progress" && !s._pending) {
+        s.status = from;
+        await store.put(s).catch(() => void 0);
+      }
+      throw e;
+    }
+  }
+  async function resolvePending(sessionId, outcome) {
+    const s = await store.get(sessionId);
+    if (!s) return null;
+    if (s.status !== "complete_in_progress" || !s._pending) return s;
+    await finish(s, s._pending.result, s._pending, outcome);
+    return s;
+  }
+  async function route(req, reqCtx) {
+    const version = req.headers.get("api-version");
+    if (!version) return apiError(400, "missing", "The API-Version header is required.");
+    if (!ACP_SUPPORTED_API_VERSIONS.includes(version)) {
+      return json3(400, {
+        type: "invalid_request",
+        code: "unsupported_api_version",
+        message: `API-Version ${version} is not supported.`,
+        supported_versions: [...ACP_SUPPORTED_API_VERSIONS]
+      });
+    }
     const url = new URL(req.url);
     const base = (opts.basePath ?? "").replace(/\/+$/, "");
     const path = url.pathname.startsWith(base) ? url.pathname.slice(base.length) : url.pathname;
@@ -12663,9 +13114,11 @@ function createAcpCheckoutKit(opts) {
     } catch {
       return apiError(400, "invalid", "Body is not JSON.");
     }
-    const caller = req.headers.get("authorization") ?? "";
+    const caller = await resolveCallerScope(req, reqCtx, opts.resolveCallerId);
+    if (!caller)
+      return apiError(401, "unauthorized", "Send an Authorization header (or X-Astra-Id).");
     if (req.method === "POST" && path === "/checkout_sessions") {
-      return idempotent(req, body, path, async () => {
+      return idempotent(req, body, path, caller, async () => {
         const items = parsed.line_items ?? parsed.items;
         if (!items?.length)
           return apiError(400, "missing", "line_items is required.", "$.line_items");
@@ -12693,8 +13146,9 @@ function createAcpCheckoutKit(opts) {
     if (req.method === "GET" && !m[2]) return json3(200, view(s));
     if (req.method !== "POST") return apiError(405, "unsupported", "Method not allowed.");
     if (!m[2]) {
-      return idempotent(req, body, path, async () => {
+      return idempotent(req, body, path, caller, async () => {
         if (s.status === "completed" || s.status === "canceled") return json3(200, view(s));
+        if (s.status === "complete_in_progress") return inProgress();
         const items = parsed.line_items ?? parsed.items;
         if (items) {
           const p = await price(items);
@@ -12709,17 +13163,82 @@ function createAcpCheckoutKit(opts) {
         return json3(200, view(s));
       });
     }
-    if (m[2] === "/complete") return idempotent(req, body, path, () => complete(req, s, parsed));
-    return idempotent(req, body, path, async () => {
-      if (s.status !== "completed") s.status = "canceled";
+    if (m[2] === "/complete")
+      return idempotent(req, body, path, caller, () => complete(req, s, parsed));
+    return idempotent(req, body, path, caller, async () => {
+      if (s.status === "completed" || s.status === "canceled")
+        return apiError(405, "method_not_allowed", `A ${s.status} session can't be canceled.`);
+      if (s.status === "complete_in_progress") return inProgress();
+      s.status = "canceled";
       await store.put(s);
       return json3(200, view(s));
     });
   }
-  return { handle };
+  async function handle(req, reqCtx) {
+    const res = await route(req, reqCtx);
+    const key = req.headers.get("idempotency-key");
+    const requestId = req.headers.get("request-id");
+    if (!key && !requestId) return res;
+    const headers = new Headers(res.headers);
+    if (key) headers.set("idempotency-key", key);
+    if (requestId) headers.set("request-id", requestId);
+    return new Response(res.body, { status: res.status, headers });
+  }
+  return { handle, resolvePending };
+}
+
+// src/adapters/kit-express.ts
+var bytes = (b) => b.buffer.slice(b.byteOffset, b.byteOffset + b.byteLength);
+function rawBodyOf(req) {
+  if (req.method === "GET" || req.method === "HEAD") return void 0;
+  const raw = req.rawBody;
+  if (Buffer.isBuffer(raw)) return bytes(raw);
+  if (typeof raw === "string") return raw;
+  if (Buffer.isBuffer(req.body)) return bytes(req.body);
+  if (typeof req.body === "string") return req.body;
+  if (req.body !== void 0 && req.body !== null && typeof req.body === "object") {
+    if (Object.keys(req.body).length === 0) return void 0;
+    warnOnce(
+      "kit-express-parsed-body",
+      "[astrasync] expressHandler: the request body was already parsed \u2014 re-serialising it. Mount express.raw() on the checkout routes (or keep req.rawBody) so signatures and idempotency fingerprints see the exact bytes."
+    );
+    return JSON.stringify(req.body);
+  }
+  return void 0;
+}
+function expressHandler(kit, options = {}) {
+  return async (req, res, next) => {
+    try {
+      const host = req.get?.("host") ?? req.headers.host ?? "localhost";
+      const url = `${req.protocol ?? "http"}://${host}${req.originalUrl ?? req.url}`;
+      const headers = new Headers();
+      for (const [k, v] of Object.entries(req.headers)) {
+        if (v === void 0) continue;
+        if (Array.isArray(v)) v.forEach((x) => headers.append(k, x));
+        else headers.set(k, v);
+      }
+      const body = rawBodyOf(req);
+      const request = new Request(url, {
+        method: req.method,
+        headers,
+        ...body !== void 0 && { body }
+      });
+      const verified = req.agentVerification?.identityVerified ? req.agentVerification.agent?.astraId : void 0;
+      const callerId = options.callerId ? options.callerId(req) : verified;
+      const response = await kit.handle(request, callerId ? { callerId } : void 0);
+      res.status(response.status);
+      response.headers.forEach((value, name) => {
+        res.setHeader(name, value);
+      });
+      res.end(Buffer.from(await response.arrayBuffer()));
+    } catch (err) {
+      next(err);
+    }
+  };
 }
 export {
   ACP_API_VERSION,
+  ACP_SUPPORTED_API_VERSIONS,
   AEP_SPEC_VERSION,
   AP2_VCT,
   AepChain,
@@ -12740,6 +13259,7 @@ export {
   MCP_VERIFIED_HOP_MAX_AGE_MS,
   MemoryCheckoutStore,
   MemoryIdempotencyStore,
+  MemoryMppChallengeStore,
   PLATFORM_AGENT_SIGNATURES,
   RUNTIME_SIGNATURES,
   RedisIdempotencyStore,
@@ -12749,10 +13269,12 @@ export {
   SDK_USER_AGENT,
   SettlementReportError,
   TRUST_LEVEL_RANGES,
+  UCP_ORDER_CAPABILITY,
   UCP_VERSION,
   VERIFICATION_STATUS_HEADER,
   SDK_VERSION as VERSION,
   _resetEdgeConfigCache,
+  acpPaymentHandlers,
   aepCanonicalJson,
   aepHash,
   aepPrivateKeyFromSeed,
@@ -12767,9 +13289,12 @@ export {
   authorizeSettlement,
   awaitStepUpApproval,
   beginIdempotent,
+  buildAcpWellKnown,
   buildGuidance,
+  buildMpp402Response,
   buildMppChallenge,
   buildSdkObservedMetadata,
+  buildUcpOrder,
   buildUcpProfile,
   buildVerificationUnavailableBody,
   buildX402Challenge,
@@ -12793,6 +13318,7 @@ export {
   encodeMppReceipt,
   encodeX402SettlementResponse,
   express_exports as express,
+  expressHandler,
   extractApiKeyFormat,
   extractCredentials,
   extractMcpCredentials,
@@ -12817,6 +13343,7 @@ export {
   matchEdgePathRule,
   matchPlatformSignature,
   matchRoutePattern,
+  mppBodyDigest,
   negotiateUcp,
   nextjs_exports as nextjs,
   normalizeDeclaredSource,