@cimplify/sdk 0.102.0 → 0.104.0

package/dist/{chunk-Z3K2D3TE.mjs → chunk-OCCNG6MO.mjs}

@@ -1,5 +1,6 @@
-import { isPaymentStatusRequiresAction, normalizeStatusResponse, isPaymentStatusSuccess, isPaymentStatusFailure } from './chunk-DLW3RWRK.mjs';
-import { CimplifyError, ErrorCode, currencyCode, enrichError, getErrorHint } from './chunk-O3YUHLZL.mjs';
+import { MOBILE_MONEY_PROVIDER, PAYMENT_METHOD, MAX_PAYMENT_AUTHORIZATION_STEPS } from './chunk-GOHSXBKW.mjs';
+import { normalizeStatusResponse, paymentAuthorizationUrl, isPaymentStatusSuccess, isPaymentStatusFailure, isPaymentStatusRequiresAction } from './chunk-DYIAX3WI.mjs';
+import { CimplifyError, isSupportedCurrency, ErrorCode, enrichError, getErrorHint } from './chunk-H3RATH4B.mjs';
 
 // src/types/result.ts
 function ok(value) {
@@ -784,222 +785,15 @@ var CartOperations = class {
   }
 };
 
-// src/constants.ts
-var CHECKOUT_MODE = {
-  LINK: "link",
-  GUEST: "guest"
-};
-var ORDER_TYPE = {
-  DELIVERY: "delivery",
-  PICKUP: "pickup",
-  DINE_IN: "dine-in",
-  WALK_IN: "walk-in"
-};
-var PAYMENT_METHOD = {
-  MOBILE_MONEY: "mobile_money",
-  CARD: "card"
-};
-var CHECKOUT_STEP = {
-  AUTHENTICATION: "authentication",
-  ORDER_DETAILS: "order_details",
-  PAYMENT_METHOD: "payment_method",
-  PAYMENT: "payment",
-  CONFIRMATION: "confirmation"
-};
-var PAYMENT_STATE = {
-  INITIAL: "initial",
-  PREPARING: "preparing",
-  PROCESSING: "processing",
-  VERIFYING: "verifying",
-  AWAITING_AUTHORIZATION: "awaiting_authorization",
-  SUCCESS: "success",
-  ERROR: "error",
-  TIMEOUT: "timeout"
-};
-var PICKUP_TIME_TYPE = {
-  ASAP: "asap",
-  SCHEDULED: "scheduled"
-};
-var MOBILE_MONEY_PROVIDER = {
-  MTN: "mtn",
-  VODAFONE: "vodafone",
-  TELECEL: "telecel",
-  AIRTEL: "airtel",
-  AIRTELTIGO: "airteltigo",
-  MPESA: "mpesa"
-};
-var AUTHORIZATION_TYPE = {
-  OTP: "otp",
-  PIN: "pin",
-  PHONE: "phone",
-  BIRTHDAY: "birthday",
-  ADDRESS: "address"
-};
-var DEVICE_TYPE = {
-  MOBILE: "mobile",
-  DESKTOP: "desktop",
-  TABLET: "tablet",
-  UNKNOWN: "unknown"
-};
-var CONTACT_TYPE = {
-  PHONE: "phone",
-  EMAIL: "email"
-};
-var LINK_QUERY = {
-  DATA: "link.data",
-  ADDRESSES: "link.addresses",
-  MOBILE_MONEY: "link.mobile_money",
-  PREFERENCES: "link.preferences",
-  SESSIONS: "link.sessions"
-};
-var LINK_MUTATION = {
-  CHECK_STATUS: "link.check_status",
-  ENROLL: "link.enroll",
-  ENROLL_AND_LINK_ORDER: "link.enroll_and_link_order",
-  UPDATE_PREFERENCES: "link.update_preferences",
-  CREATE_ADDRESS: "link.create_address",
-  UPDATE_ADDRESS: "link.update_address",
-  DELETE_ADDRESS: "link.delete_address",
-  SET_DEFAULT_ADDRESS: "link.set_default_address",
-  TRACK_ADDRESS_USAGE: "link.track_address_usage",
-  CREATE_MOBILE_MONEY: "link.create_mobile_money",
-  DELETE_MOBILE_MONEY: "link.delete_mobile_money",
-  SET_DEFAULT_MOBILE_MONEY: "link.set_default_mobile_money",
-  TRACK_MOBILE_MONEY_USAGE: "link.track_mobile_money_usage",
-  VERIFY_MOBILE_MONEY: "link.verify_mobile_money",
-  REVOKE_SESSION: "link.revoke_session",
-  REVOKE_ALL_SESSIONS: "link.revoke_all_sessions"
-};
-var AUTH_MUTATION = {
-  REQUEST_OTP: "auth.request_otp",
-  VERIFY_OTP: "auth.verify_otp"
-};
-var CHECKOUT_MUTATION = {
-  PROCESS: "checkout.process"
-};
-var PAYMENT_MUTATION = {
-  SUBMIT_AUTHORIZATION: "payment.submit_authorization",
-  CHECK_STATUS: "order.poll_payment_status"
-};
-var ORDER_MUTATION = {
-  UPDATE_CUSTOMER: "order.update_order_customer"
-};
-var DEFAULT_CURRENCY = "GHS";
-var DEFAULT_COUNTRY = "GHA";
-
-// src/utils/paystack.ts
-async function openPaystackPopup(options, signal) {
-  if (typeof window === "undefined") {
-    return { success: false, error: "PROVIDER_UNAVAILABLE" };
-  }
-  let PaystackPop;
-  try {
-    const specifier = "@paystack/inline-js";
-    const imported = await import(
-      /* webpackIgnore: true */
-      /* @vite-ignore */
-      specifier
-    );
-    PaystackPop = imported.default;
-  } catch {
-    return { success: false, error: "PROVIDER_UNAVAILABLE" };
-  }
-  return new Promise((resolve) => {
-    let settled = false;
-    const resolveOnce = (result) => {
-      if (settled) {
-        return;
-      }
-      settled = true;
-      if (signal) {
-        signal.removeEventListener("abort", onAbort);
-      }
-      resolve(result);
-    };
-    const onAbort = () => {
-      resolveOnce({ success: false, error: "CANCELLED" });
-    };
-    if (signal?.aborted) {
-      resolveOnce({ success: false, error: "CANCELLED" });
-      return;
-    }
-    if (signal) {
-      signal.addEventListener("abort", onAbort, { once: true });
-    }
-    try {
-      const popup = new PaystackPop();
-      popup.newTransaction({
-        key: options.key,
-        email: options.email,
-        amount: options.amount,
-        currency: options.currency,
-        reference: options.reference,
-        accessCode: options.accessCode,
-        onSuccess: (transaction) => {
-          resolveOnce({
-            success: true,
-            reference: transaction.reference ?? options.reference
-          });
-        },
-        onCancel: () => {
-          resolveOnce({ success: false, error: "PAYMENT_CANCELLED" });
-        },
-        onError: (error) => {
-          resolveOnce({
-            success: false,
-            error: error?.message || "PAYMENT_FAILED"
-          });
-        }
-      });
-    } catch {
-      resolveOnce({ success: false, error: "POPUP_BLOCKED" });
-    }
-  });
-}
-
 // src/utils/checkout-resolver.ts
 var DEFAULT_POLL_INTERVAL_MS = 3e3;
 var DEFAULT_MAX_POLL_ATTEMPTS = 60;
 var MAX_CONSECUTIVE_NETWORK_ERRORS = 5;
-var CARD_PROVIDER_PAYSTACK = "paystack";
 var NEXT_ACTION_NONE = "none";
 var NEXT_ACTION_CARD_POPUP = "card_popup";
 var NEXT_ACTION_REDIRECT = "redirect";
 var NEXT_ACTION_AUTHORIZATION = "authorization";
-function normalizeCardPopupError(error) {
-  if (!error || error === "PAYMENT_CANCELLED" || error === "CANCELLED") {
-    return "PAYMENT_CANCELLED";
-  }
-  if (error === "PROVIDER_UNAVAILABLE") {
-    return "PROVIDER_UNAVAILABLE";
-  }
-  if (error === "POPUP_BLOCKED") {
-    return "POPUP_BLOCKED";
-  }
-  return "PAYMENT_FAILED";
-}
-function normalizeCardProvider(value) {
-  const normalized = value?.trim().toLowerCase();
-  return normalized && normalized.length > 0 ? normalized : CARD_PROVIDER_PAYSTACK;
-}
-async function openCardPopup(provider, checkoutResult, email, currency, signal) {
-  if (typeof window === "undefined") {
-    return { success: false, error: "PROVIDER_UNAVAILABLE" };
-  }
-  if (provider === CARD_PROVIDER_PAYSTACK) {
-    return openPaystackPopup(
-      {
-        key: checkoutResult.public_key || "",
-        email,
-        accessCode: checkoutResult.client_secret,
-        reference: checkoutResult.payment_reference || checkoutResult.client_secret,
-        currency
-      },
-      signal
-    );
-  }
-  return { success: false, error: "PROVIDER_UNAVAILABLE" };
-}
+var NEXT_ACTION_POLL = "poll";
 var VALID_MOBILE_MONEY_PROVIDERS = new Set(Object.values(MOBILE_MONEY_PROVIDER));
 function isValidMobileMoneyProvider(value) {
   return VALID_MOBILE_MONEY_PROVIDERS.has(value);
@@ -1016,6 +810,32 @@ function normalizeAuthorizationType(value) {
   }
   return void 0;
 }
+function normalizeAuthorizationSubmission(expectedType, submission) {
+  if (!submission || submission.type !== expectedType) {
+    throw new Error(`Expected ${expectedType} authorization details.`);
+  }
+  if (submission.type === "address") {
+    const address = submission.address.trim();
+    const city = submission.city.trim();
+    const state = submission.state.trim();
+    const zipCode = submission.zip_code.trim();
+    if (!address || !city || !state || !zipCode) {
+      throw new Error("Complete all authorization address fields.");
+    }
+    return {
+      type: "address",
+      address,
+      city,
+      state,
+      zip_code: zipCode
+    };
+  }
+  const value = submission.value.trim();
+  if (!value) {
+    throw new Error("Authorization value is required.");
+  }
+  return { type: submission.type, value };
+}
 function formatMoney(value) {
   if (typeof value === "number" && Number.isFinite(value)) {
     return value.toFixed(2);
@@ -1036,6 +856,27 @@ function isAbortError(error) {
   }
   return error instanceof Error && (error.name === "AbortError" || error.message === "CANCELLED");
 }
+function waitForAbortable(promise, signal) {
+  if (!signal) return promise;
+  if (signal.aborted) return Promise.reject(createAbortError());
+  return new Promise((resolve, reject) => {
+    const onAbort = () => {
+      signal.removeEventListener("abort", onAbort);
+      reject(createAbortError());
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    promise.then(
+      (value) => {
+        signal.removeEventListener("abort", onAbort);
+        resolve(value);
+      },
+      (error) => {
+        signal.removeEventListener("abort", onAbort);
+        reject(error);
+      }
+    );
+  });
+}
 var CheckoutResolver = class {
   constructor(options) {
     this.client = options.client;
@@ -1043,6 +884,7 @@ var CheckoutResolver = class {
     this.pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
     this.maxPollAttempts = options.maxPollAttempts ?? DEFAULT_MAX_POLL_ATTEMPTS;
     this.onStatusChange = options.onStatusChange;
+    this.onAuthorizationUiChange = options.onAuthorizationUiChange;
     this.onAuthorizationRequired = options.onAuthorizationRequired;
     this.signal = options.signal;
     this.returnUrl = options.returnUrl;
@@ -1061,116 +903,22 @@ var CheckoutResolver = class {
       if (!checkoutResult.order_id) {
         return this.fail("CHECKOUT_FAILED", "Checkout did not return an order ID.", false);
       }
-      if (checkoutResult.next_action) {
-        return this.resolveNextAction(checkoutResult);
-      }
-      let latestCheckoutResult = checkoutResult;
-      let authorizationType = normalizeAuthorizationType(checkoutResult.authorization_type);
-      let paymentReference = checkoutResult.payment_reference;
       if (this.isSuccessfulStatus(checkoutResult.payment_status)) {
         return this.finalizeSuccess(checkoutResult);
       }
-      if (checkoutResult.client_secret && checkoutResult.public_key) {
-        const provider = normalizeCardProvider(checkoutResult.provider);
-        this.emit("awaiting_authorization", {
-          display_text: "Complete payment in the card authorization popup.",
-          order_id: checkoutResult.order_id,
-          order_number: checkoutResult.order_number
+      if (this.isFailureStatus(checkoutResult.payment_status)) {
+        const normalized = normalizeStatusResponse({
+          status: checkoutResult.payment_status,
+          paid: false
         });
-        if (!this.allowPopups) {
-          return this.fail(
-            "PROVIDER_UNAVAILABLE",
-            "Card payment popup is unavailable in this environment.",
-            false
-          );
-        }
-        const popupResult = await openCardPopup(
-          provider,
-          checkoutResult,
-          this.checkoutData.customer.email || "customer@cimplify.io",
-          this.getOrderCurrency(checkoutResult),
-          this.signal
+        return this.fail(
+          normalized.status.toUpperCase(),
+          checkoutResult.display_text || "Payment failed before confirmation.",
+          false
         );
-        if (!popupResult.success) {
-          const popupError = normalizeCardPopupError(popupResult.error);
-          if (popupError === "POPUP_BLOCKED") {
-            return this.fail(
-              "POPUP_BLOCKED",
-              "Unable to open card payment popup. Please allow popups and try again.",
-              true
-            );
-          }
-          if (popupError === "PROVIDER_UNAVAILABLE") {
-            return this.fail(
-              "PROVIDER_UNAVAILABLE",
-              "Card payment provider is unavailable.",
-              false
-            );
-          }
-          return this.fail(
-            "PAYMENT_CANCELLED",
-            "Card payment was cancelled before completion.",
-            true
-          );
-        }
-        paymentReference = popupResult.reference || paymentReference;
       }
-      if (checkoutResult.authorization_url) {
-        if (typeof window !== "undefined" && this.returnUrl) {
-          window.location.assign(checkoutResult.authorization_url);
-          return this.fail(
-            "REDIRECT_REQUIRED",
-            "Redirecting to complete payment authorization.",
-            true
-          );
-        }
-        if (typeof window !== "undefined") {
-          const popup = window.open(
-            checkoutResult.authorization_url,
-            "cimplify-auth",
-            "width=520,height=760,noopener,noreferrer"
-          );
-          if (!popup) {
-            return this.fail(
-              "POPUP_BLOCKED",
-              "Authorization popup was blocked. Please allow popups and retry.",
-              true
-            );
-          }
-        }
-      }
-      if (checkoutResult.requires_authorization || isPaymentStatusRequiresAction(checkoutResult.payment_status)) {
-        const authorization = await this.handleAuthorization({
-          authorizationType,
-          paymentReference,
-          displayText: checkoutResult.display_text,
-          provider: checkoutResult.provider
-        });
-        if (!authorization.ok) {
-          return authorization.result;
-        }
-        if (authorization.value) {
-          latestCheckoutResult = authorization.value;
-          paymentReference = authorization.value.payment_reference || paymentReference;
-          authorizationType = normalizeAuthorizationType(authorization.value.authorization_type) || authorizationType;
-          if (this.isSuccessfulStatus(authorization.value.payment_status)) {
-            return this.finalizeSuccess(authorization.value);
-          }
-          if (this.isFailureStatus(authorization.value.payment_status)) {
-            return this.fail(
-              "AUTHORIZATION_FAILED",
-              authorization.value.display_text || "Payment authorization failed.",
-              false
-            );
-          }
-        }
-      }
-      return this.pollUntilTerminal({
-        orderId: checkoutResult.order_id,
-        latestCheckoutResult,
-        paymentReference,
-        authorizationType
-      });
+      const nextAction = checkoutResult.next_action ?? this.deriveLegacyNextAction(checkoutResult);
+      return this.resolveNextAction({ ...checkoutResult, next_action: nextAction });
     } catch (error) {
       if (isAbortError(error)) {
         return this.fail("CANCELLED", "Checkout was cancelled.", true);
@@ -1179,99 +927,172 @@ var CheckoutResolver = class {
       return this.fail("CHECKOUT_FAILED", message, true);
     }
   }
-  async resolveNextAction(checkoutResult) {
-    const action = checkoutResult.next_action;
+  deriveLegacyNextAction(checkoutResult) {
+    if (checkoutResult.client_secret && checkoutResult.public_key) {
+      return {
+        type: NEXT_ACTION_CARD_POPUP,
+        provider: checkoutResult.provider?.trim().toLowerCase() || "",
+        client_secret: checkoutResult.client_secret,
+        public_key: checkoutResult.public_key
+      };
+    }
+    if (checkoutResult.authorization_url) {
+      return {
+        type: NEXT_ACTION_REDIRECT,
+        authorization_url: checkoutResult.authorization_url
+      };
+    }
+    if (checkoutResult.requires_authorization && checkoutResult.authorization_type) {
+      return {
+        type: NEXT_ACTION_AUTHORIZATION,
+        authorization_type: checkoutResult.authorization_type,
+        display_text: checkoutResult.display_text
+      };
+    }
+    return { type: NEXT_ACTION_POLL };
+  }
+  async runCardPopup(action, checkoutResult) {
+    if (typeof action.provider !== "string" || !action.provider.trim() || typeof action.client_secret !== "string" || !action.client_secret.trim() || typeof action.public_key !== "string" || !action.public_key.trim()) {
+      return {
+        ok: false,
+        result: this.fail(
+          "INVALID_CARD_AUTHORIZATION",
+          "The payment provider returned an incomplete card authorization response.",
+          false
+        )
+      };
+    }
+    this.emit("awaiting_authorization", {
+      display_text: "Complete payment in the card authorization window.",
+      order_id: checkoutResult.order_id,
+      order_number: checkoutResult.order_number,
+      provider: action.provider
+    });
+    if (!this.allowPopups) {
+      return {
+        ok: false,
+        result: this.fail(
+          "PROVIDER_UNAVAILABLE",
+          "Card authorization UI is unavailable in this environment.",
+          false
+        )
+      };
+    }
+    const currency = this.getOrderCurrency(checkoutResult);
+    if (!currency) {
+      return {
+        ok: false,
+        result: this.fail("INVALID_CURRENCY", "Payment currency is missing or unsupported.", false)
+      };
+    }
+    let outcome;
+    try {
+      this.notifyAuthorizationUiChange(true);
+      outcome = await this.client.checkout.authorizeCardPopup(action, {
+        email: this.checkoutData.customer.email || "customer@cimplify.io",
+        currency,
+        reference: checkoutResult.payment_reference,
+        returnUrl: this.returnUrl,
+        signal: this.signal
+      });
+    } finally {
+      this.notifyAuthorizationUiChange(false);
+    }
+    if (outcome.status === "submitted") {
+      return { ok: true, reference: outcome.reference };
+    }
+    if (outcome.status === "cancelled") {
+      return {
+        ok: false,
+        result: this.fail(
+          "PAYMENT_CANCELLED",
+          "Card payment was cancelled before submission.",
+          true
+        )
+      };
+    }
+    return {
+      ok: false,
+      result: this.fail(outcome.code, outcome.message, outcome.recoverable)
+    };
+  }
+  async resolveNextAction(checkoutResult, resolutionState = {
+    authorizationSteps: 0,
+    pollAttempts: 0,
+    consecutivePollErrors: 0
+  }) {
     if (this.isSuccessfulStatus(checkoutResult.payment_status)) {
       return this.finalizeSuccess(checkoutResult);
     }
     let latestCheckoutResult = checkoutResult;
     let paymentReference = checkoutResult.payment_reference;
-    switch (action.type) {
-      case NEXT_ACTION_NONE:
-        return this.finalizeSuccess(checkoutResult);
-      case NEXT_ACTION_CARD_POPUP: {
-        const provider = normalizeCardProvider(action.provider);
-        this.emit("awaiting_authorization", {
-          display_text: "Complete payment in the card authorization popup.",
-          order_id: checkoutResult.order_id,
-          order_number: checkoutResult.order_number
-        });
-        if (!this.allowPopups) {
-          return this.fail(
-            "PROVIDER_UNAVAILABLE",
-            "Card payment popup is unavailable in this environment.",
-            false
-          );
+    let action = checkoutResult.next_action;
+    actionLoop: while (true) {
+      this.ensureNotAborted();
+      switch (action.type) {
+        case NEXT_ACTION_NONE:
+          break actionLoop;
+        case NEXT_ACTION_CARD_POPUP: {
+          const limitFailure = this.consumeAuthorizationStep(resolutionState);
+          if (limitFailure) return limitFailure;
+          const popup = await this.runCardPopup(action, latestCheckoutResult);
+          if (!popup.ok) return popup.result;
+          paymentReference = popup.reference || paymentReference;
+          break actionLoop;
         }
-        const popupResult = await openCardPopup(
-          provider,
-          checkoutResult,
-          this.checkoutData.customer.email || "customer@cimplify.io",
-          this.getOrderCurrency(checkoutResult),
-          this.signal
-        );
-        if (!popupResult.success) {
-          const popupError = normalizeCardPopupError(popupResult.error);
-          if (popupError === "POPUP_BLOCKED") {
+        case NEXT_ACTION_REDIRECT: {
+          const limitFailure = this.consumeAuthorizationStep(resolutionState);
+          if (limitFailure) return limitFailure;
+          const authorizationUrl = paymentAuthorizationUrl(action.authorization_url);
+          if (!authorizationUrl) {
             return this.fail(
-              "POPUP_BLOCKED",
-              "Unable to open card payment popup. Please allow popups and try again.",
-              true
-            );
-          }
-          if (popupError === "PROVIDER_UNAVAILABLE") {
-            return this.fail(
-              "PROVIDER_UNAVAILABLE",
-              "Card payment provider is unavailable.",
+              "INVALID_REDIRECT_AUTHORIZATION",
+              "The payment provider returned an invalid authorization URL.",
               false
             );
           }
-          return this.fail(
-            "PAYMENT_CANCELLED",
-            "Card payment was cancelled before completion.",
-            true
-          );
-        }
-        paymentReference = popupResult.reference || paymentReference;
-        break;
-      }
-      case NEXT_ACTION_REDIRECT: {
-        if (typeof window !== "undefined" && this.returnUrl) {
-          window.location.assign(action.authorization_url);
-          return this.fail(
-            "REDIRECT_REQUIRED",
-            "Redirecting to complete payment authorization.",
-            true
-          );
-        }
-        if (typeof window !== "undefined") {
-          const popup = window.open(
-            action.authorization_url,
-            "cimplify-auth",
-            "width=520,height=760,noopener,noreferrer"
-          );
-          if (!popup) {
+          if (typeof window !== "undefined" && this.returnUrl) {
+            window.location.assign(authorizationUrl);
             return this.fail(
-              "POPUP_BLOCKED",
-              "Authorization popup was blocked. Please allow popups and retry.",
+              "REDIRECT_REQUIRED",
+              "Redirecting to complete payment authorization.",
               true
             );
           }
+          if (typeof window !== "undefined") {
+            const popup = window.open(
+              authorizationUrl,
+              "cimplify-auth",
+              "width=520,height=760,noopener,noreferrer"
+            );
+            if (!popup) {
+              return this.fail(
+                "POPUP_BLOCKED",
+                "Authorization popup was blocked. Please allow popups and retry.",
+                true
+              );
+            }
+          }
+          break actionLoop;
         }
-        break;
-      }
-      case NEXT_ACTION_AUTHORIZATION: {
-        const authType = normalizeAuthorizationType(action.authorization_type);
-        const authorization = await this.handleAuthorization({
-          authorizationType: authType,
-          paymentReference,
-          displayText: action.display_text,
-          provider: checkoutResult.provider
-        });
-        if (!authorization.ok) {
-          return authorization.result;
-        }
-        if (authorization.value) {
+        case NEXT_ACTION_AUTHORIZATION: {
+          const limitFailure = this.consumeAuthorizationStep(resolutionState);
+          if (limitFailure) return limitFailure;
+          const authType = normalizeAuthorizationType(action.authorization_type);
+          const authorization = await this.handleAuthorization({
+            authorizationType: authType,
+            paymentId: latestCheckoutResult.payment_id,
+            displayText: action.display_text,
+            provider: latestCheckoutResult.provider,
+            orderId: latestCheckoutResult.order_id,
+            orderNumber: latestCheckoutResult.order_number
+          });
+          if (!authorization.ok) {
+            return authorization.result;
+          }
+          if (!authorization.value) {
+            break actionLoop;
+          }
           latestCheckoutResult = authorization.value;
           paymentReference = authorization.value.payment_reference || paymentReference;
           if (this.isSuccessfulStatus(authorization.value.payment_status)) {
@@ -1284,24 +1105,45 @@ var CheckoutResolver = class {
               false
             );
           }
+          action = authorization.value.next_action ?? this.deriveLegacyNextAction(authorization.value);
+          continue actionLoop;
         }
-        break;
+        case NEXT_ACTION_POLL:
+          break actionLoop;
+        default:
+          return this.fail(
+            "UNSUPPORTED_NEXT_ACTION",
+            "The payment provider requested an unsupported authorization action.",
+            false
+          );
       }
     }
     return this.pollUntilTerminal({
-      orderId: checkoutResult.order_id,
+      orderId: latestCheckoutResult.order_id,
       latestCheckoutResult,
       paymentReference,
-      authorizationType: normalizeAuthorizationType(checkoutResult.authorization_type)
+      resolutionState
     });
   }
+  consumeAuthorizationStep(resolutionState) {
+    if (resolutionState.authorizationSteps >= MAX_PAYMENT_AUTHORIZATION_STEPS) {
+      return this.fail(
+        "AUTHORIZATION_LIMIT_EXCEEDED",
+        "The payment provider requested too many authorization steps.",
+        false
+      );
+    }
+    resolutionState.authorizationSteps += 1;
+    return void 0;
+  }
   async pollUntilTerminal(input) {
-    let consecutiveErrors = 0;
-    let latestCheckoutResult = input.latestCheckoutResult;
+    const latestCheckoutResult = input.latestCheckoutResult;
     let paymentReference = input.paymentReference;
-    let authorizationType = input.authorizationType;
-    for (let attempt = 0; attempt < this.maxPollAttempts; attempt++) {
+    const { resolutionState } = input;
+    while (resolutionState.pollAttempts < this.maxPollAttempts) {
       this.ensureNotAborted();
+      const attempt = resolutionState.pollAttempts;
+      resolutionState.pollAttempts += 1;
       this.emit("polling", {
         poll_attempt: attempt,
         max_poll_attempts: this.maxPollAttempts,
@@ -1310,8 +1152,8 @@ var CheckoutResolver = class {
       });
       const statusResult = await this.client.checkout.pollPaymentStatus(input.orderId);
       if (!statusResult.ok) {
-        consecutiveErrors += 1;
-        if (consecutiveErrors >= MAX_CONSECUTIVE_NETWORK_ERRORS) {
+        resolutionState.consecutivePollErrors += 1;
+        if (resolutionState.consecutivePollErrors >= MAX_CONSECUTIVE_NETWORK_ERRORS) {
           return this.fail(
             "NETWORK_ERROR",
             "Unable to confirm payment due to repeated network errors.",
@@ -1321,13 +1163,17 @@ var CheckoutResolver = class {
         await this.wait(this.pollIntervalMs);
         continue;
       }
-      consecutiveErrors = 0;
+      resolutionState.consecutivePollErrors = 0;
       if (statusResult.value.reference) {
         paymentReference = statusResult.value.reference;
       }
       const normalized = normalizeStatusResponse(statusResult.value);
       if (normalized.paid || isPaymentStatusSuccess(normalized.status)) {
-        return this.finalizeSuccess(latestCheckoutResult);
+        return this.finalizeSuccess({
+          ...latestCheckoutResult,
+          payment_status: normalized.status,
+          payment_reference: paymentReference || latestCheckoutResult.payment_reference
+        });
       }
       if (isPaymentStatusFailure(normalized.status)) {
         return this.fail(
@@ -1337,43 +1183,32 @@ var CheckoutResolver = class {
         );
       }
       if (isPaymentStatusRequiresAction(normalized.status)) {
-        const authorization = await this.handleAuthorization({
-          authorizationType,
-          paymentReference,
-          displayText: normalized.message || latestCheckoutResult.display_text,
-          provider: latestCheckoutResult.provider
-        });
-        if (!authorization.ok) {
-          return authorization.result;
-        }
-        if (authorization.value) {
-          latestCheckoutResult = authorization.value;
-          paymentReference = authorization.value.payment_reference || paymentReference;
-          authorizationType = normalizeAuthorizationType(authorization.value.authorization_type) || authorizationType;
-          if (this.isSuccessfulStatus(authorization.value.payment_status)) {
-            return this.finalizeSuccess(authorization.value);
-          }
-          if (this.isFailureStatus(authorization.value.payment_status)) {
-            return this.fail(
-              "AUTHORIZATION_FAILED",
-              authorization.value.display_text || "Payment authorization failed.",
-              false
-            );
-          }
+        const authorizationType = latestCheckoutResult.authorization_type;
+        const paymentId = latestCheckoutResult.payment_id;
+        if (!authorizationType || !normalizeAuthorizationType(authorizationType) || !paymentId) {
+          return this.fail(
+            "INVALID_AUTHORIZATION_RESPONSE",
+            "The payment provider returned an incomplete authorization response.",
+            false
+          );
         }
+        return this.resolveNextAction(
+          {
+            ...latestCheckoutResult,
+            payment_status: normalized.status,
+            payment_reference: paymentReference,
+            display_text: normalized.message || latestCheckoutResult.display_text,
+            next_action: {
+              type: NEXT_ACTION_AUTHORIZATION,
+              authorization_type: authorizationType,
+              display_text: normalized.message || latestCheckoutResult.display_text
+            }
+          },
+          resolutionState
+        );
       }
       await this.wait(this.pollIntervalMs);
     }
-    try {
-      const finalResult = await this.client.checkout.pollPaymentStatus(input.orderId);
-      if (finalResult.ok) {
-        const normalized = normalizeStatusResponse(finalResult.value);
-        if (normalized.paid || isPaymentStatusSuccess(normalized.status)) {
-          return this.finalizeSuccess(latestCheckoutResult);
-        }
-      }
-    } catch {
-    }
     return this.fail(
       "PAYMENT_TIMEOUT",
       "Payment confirmation timed out. Please retry checkout.",
@@ -1382,35 +1217,61 @@ var CheckoutResolver = class {
   }
   async handleAuthorization(input) {
     const authorizationType = input.authorizationType;
-    const paymentReference = input.paymentReference;
-    if (!authorizationType || !paymentReference) {
-      return { ok: true };
+    const paymentId = input.paymentId;
+    if (!authorizationType || !paymentId) {
+      return {
+        ok: false,
+        result: this.fail(
+          "INVALID_AUTHORIZATION_RESPONSE",
+          "The payment provider returned an incomplete authorization response.",
+          false
+        )
+      };
     }
     this.emit("awaiting_authorization", {
       authorization_type: authorizationType,
       display_text: input.displayText,
-      provider: input.provider
+      provider: input.provider,
+      order_id: input.orderId,
+      order_number: input.orderNumber
     });
-    let authorizationResult;
-    const submit = async (code) => {
+    let authorizationRequest;
+    const submit = (authorization) => {
       this.ensureNotAborted();
-      const trimmedCode = code.trim();
-      if (!trimmedCode) {
-        throw new Error("Authorization code is required.");
+      let normalizedAuthorization;
+      try {
+        normalizedAuthorization = normalizeAuthorizationSubmission(
+          authorizationType,
+          authorization
+        );
+      } catch (error) {
+        return Promise.reject(error);
       }
-      const submitResult = await this.client.checkout.submitAuthorization({
-        reference: paymentReference,
-        auth_type: authorizationType,
-        value: trimmedCode
-      });
-      if (!submitResult.ok) {
-        throw new Error(submitResult.error.message || "Authorization failed.");
+      if (!authorizationRequest) {
+        const request = this.client.checkout.submitAuthorization({
+          payment_id: paymentId,
+          authorization: normalizedAuthorization
+        }).then((submitResult) => {
+          if (!submitResult.ok) {
+            throw new Error(submitResult.error.message || "Authorization failed.");
+          }
+          return submitResult.value;
+        });
+        authorizationRequest = request;
+        void request.catch(() => {
+          if (authorizationRequest === request) {
+            authorizationRequest = void 0;
+          }
+        });
       }
-      authorizationResult = submitResult.value;
+      return authorizationRequest.then(() => void 0);
     };
     try {
       if (this.onAuthorizationRequired) {
-        await this.onAuthorizationRequired(authorizationType, submit);
+        await waitForAbortable(
+          Promise.resolve(this.onAuthorizationRequired(authorizationType, submit)),
+          this.signal
+        );
       } else {
         return {
           ok: false,
@@ -1421,6 +1282,20 @@ var CheckoutResolver = class {
           )
         };
       }
+      if (!authorizationRequest) {
+        return {
+          ok: false,
+          result: this.fail(
+            "AUTHORIZATION_NOT_SUBMITTED",
+            "The authorization callback returned without submitting a value.",
+            true
+          )
+        };
+      }
+      return {
+        ok: true,
+        value: await waitForAbortable(authorizationRequest, this.signal)
+      };
     } catch (error) {
       if (isAbortError(error)) {
         return {
@@ -1434,12 +1309,12 @@ var CheckoutResolver = class {
         result: this.fail("AUTHORIZATION_FAILED", message, true)
       };
     }
-    return {
-      ok: true,
-      value: authorizationResult
-    };
   }
   async finalizeSuccess(checkoutResult) {
+    const currency = this.getOrderCurrency(checkoutResult);
+    if (!currency) {
+      return this.fail("INVALID_CURRENCY", "Payment currency is missing or unsupported.", false);
+    }
     this.emit("finalizing", {
       order_id: checkoutResult.order_id,
       order_number: checkoutResult.order_number
@@ -1456,7 +1331,7 @@ var CheckoutResolver = class {
         order_number: checkoutResult.order_number || checkoutResult.order_id,
         status: checkoutResult.payment_status || "paid",
         total: this.getOrderTotal(checkoutResult),
-        currency: this.getOrderCurrency(checkoutResult)
+        currency
       },
       enrolled_in_link: enrolledInLink
     };
@@ -1508,7 +1383,7 @@ var CheckoutResolver = class {
     };
   }
   getEnrollmentMobileMoney() {
-    if (this.paymentData?.type === "mobile_money" && this.paymentData.phone_number && this.paymentData.provider && isValidMobileMoneyProvider(this.paymentData.provider)) {
+    if (this.paymentData?.type === PAYMENT_METHOD.MOBILE_MONEY && this.paymentData.phone_number && this.paymentData.provider && isValidMobileMoneyProvider(this.paymentData.provider)) {
       return {
         phone_number: this.paymentData.phone_number,
         provider: this.paymentData.provider,
@@ -1535,15 +1410,15 @@ var CheckoutResolver = class {
   }
   getOrderCurrency(checkoutResult) {
     if (checkoutResult.fx?.pay_currency) {
-      return checkoutResult.fx.pay_currency;
-    }
-    if (this.cartCurrency) {
-      return this.cartCurrency;
+      const currency2 = checkoutResult.fx.pay_currency.trim().toUpperCase();
+      return isSupportedCurrency(currency2) ? currency2 : void 0;
     }
     if (this.checkoutData.pay_currency) {
-      return this.checkoutData.pay_currency;
+      const currency2 = this.checkoutData.pay_currency.trim().toUpperCase();
+      return isSupportedCurrency(currency2) ? currency2 : void 0;
     }
-    return "GHS";
+    const currency = this.cartCurrency.trim().toUpperCase();
+    return isSupportedCurrency(currency) ? currency : void 0;
   }
   emit(status, context = {}) {
     if (!this.onStatusChange) {
@@ -1554,6 +1429,12 @@ var CheckoutResolver = class {
     } catch {
     }
   }
+  notifyAuthorizationUiChange(open) {
+    try {
+      this.onAuthorizationUiChange?.(open);
+    } catch {
+    }
+  }
   fail(code, message, recoverable) {
     this.emit("failed", {
       display_text: message
@@ -1618,6 +1499,43 @@ function isValidCustomerName(name) {
 function isOfflinePaymentMethod(method) {
   return method === "cash" || method === "offline";
 }
+function notifyCheckoutStatus(observer, status, context = {}) {
+  try {
+    observer?.(status, context);
+  } catch {
+  }
+}
+var MAX_STOREFRONT_COLLECTION_OPTIONS = 32;
+function normalizeCollectionOptions(value, expectedCurrency) {
+  if (!value || typeof value !== "object") return null;
+  const response = value;
+  if (response.presentment_currency !== expectedCurrency || !Array.isArray(response.options)) {
+    return null;
+  }
+  if (response.options.length > MAX_STOREFRONT_COLLECTION_OPTIONS) return null;
+  const options = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const candidate of response.options) {
+    if (!candidate || typeof candidate !== "object") continue;
+    const option = candidate;
+    if (option.method === PAYMENT_METHOD.CARD && option.network == null) {
+      if (!seen.has(PAYMENT_METHOD.CARD)) {
+        seen.add(PAYMENT_METHOD.CARD);
+        options.push({ method: PAYMENT_METHOD.CARD, network: null });
+      }
+      continue;
+    }
+    if (option.method !== PAYMENT_METHOD.MOBILE_MONEY || typeof option.network !== "string" || !option.network.trim()) {
+      continue;
+    }
+    const network = option.network.trim().toLowerCase();
+    const key = `${PAYMENT_METHOD.MOBILE_MONEY}:${network}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    options.push({ method: PAYMENT_METHOD.MOBILE_MONEY, network });
+  }
+  return { presentment_currency: expectedCurrency, options };
+}
 var CheckoutService = class {
   constructor(client) {
     this.client = client;
@@ -1643,6 +1561,40 @@ var CheckoutService = class {
     const token = this.client.getOrderToken(orderId);
     return token ? `?token=${encodeURIComponent(token)}` : "";
   }
+  /** Available storefront collection methods for one presentment currency. */
+  async collectionOptions(currency) {
+    const normalized = currency.trim().toUpperCase();
+    if (!isSupportedCurrency(normalized)) {
+      return err(
+        new CimplifyError(
+          ErrorCode.UNSUPPORTED_CURRENCY,
+          "No online payment method is available for this currency.",
+          false
+        )
+      );
+    }
+    const response = await safe(
+      this.client.get(
+        `/api/v1/payments/collection-options?currency=${encodeURIComponent(normalized)}`
+      )
+    );
+    if (!response.ok) return response;
+    const options = normalizeCollectionOptions(response.value, normalized);
+    return options ? ok(options) : err(
+      new CimplifyError(
+        ErrorCode.PAYMENT_CAPABILITY_MISMATCH,
+        "Payment methods could not be verified for this currency.",
+        false
+      )
+    );
+  }
+  /**
+   * Run provider-owned UI for a backend `card_popup` action. A submitted
+   * outcome is not proof of payment; callers must poll/verify with Cimplify.
+   */
+  authorizeCardPopup(action, options) {
+    return this.client.authorizationAdapters.authorize(action, options);
+  }
   async process(data) {
     const invalid = this.validateCheckoutData(data);
     if (invalid) {
@@ -1686,12 +1638,18 @@ var CheckoutService = class {
   async pollPaymentStatus(orderId) {
     const encodedId = encodeURIComponent(orderId);
     const tokenParam = this.orderTokenParam(orderId);
-    return safe(this.client.get(`/api/v1/orders/${encodedId}/payment-status${tokenParam}`));
+    return safe(
+      this.client.get(
+        `/api/v1/orders/${encodedId}/payment-status${tokenParam}`
+      )
+    );
   }
   async updateOrderCustomer(orderId, customer) {
     const encodedId = encodeURIComponent(orderId);
     const tokenParam = this.orderTokenParam(orderId);
-    return safe(this.client.post(`/api/v1/orders/${encodedId}/customer${tokenParam}`, customer));
+    return safe(
+      this.client.post(`/api/v1/orders/${encodedId}/customer${tokenParam}`, customer)
+    );
   }
   async verifyPayment(orderId) {
     const encodedId = encodeURIComponent(orderId);
@@ -1699,7 +1657,7 @@ var CheckoutService = class {
     return safe(this.client.post(`/api/v1/orders/${encodedId}/verify-payment${tokenParam}`));
   }
   async processAndResolve(data) {
-    data.on_status_change?.("preparing", {});
+    notifyCheckoutStatus(data.on_status_change, "preparing");
     if (!data.cart_id) {
       return ok(
         toTerminalFailure(
@@ -1711,13 +1669,7 @@ var CheckoutService = class {
     }
     const cartResult = await this.client.cart.get();
     if (!cartResult.ok || !cartResult.value?.id) {
-      return ok(
-        toTerminalFailure(
-          "INVALID_CART",
-          "Unable to load cart for checkout.",
-          false
-        )
-      );
+      return ok(toTerminalFailure("INVALID_CART", "Unable to load cart for checkout.", false));
     }
     const cart = cartResult.value;
     if (cart.id !== data.cart_id || cart.items.length === 0) {
@@ -1749,11 +1701,28 @@ var CheckoutService = class {
       voucher_code: data.voucher_code,
       pay_deposit: data.pay_deposit
     };
-    const baseCurrency = currencyCode(
-      (cart.pricing.currency || checkoutData.pay_currency || "GHS").toUpperCase()
-    );
+    const rawBaseCurrency = typeof cart.pricing.currency === "string" ? cart.pricing.currency.trim().toUpperCase() : "";
+    if (!isSupportedCurrency(rawBaseCurrency)) {
+      return ok(
+        toTerminalFailure(
+          "INVALID_CURRENCY",
+          "Cart currency is missing or unsupported. Refresh the cart before checkout.",
+          false
+        )
+      );
+    }
+    const baseCurrency = rawBaseCurrency;
     const payCurrency = data.pay_currency?.trim().toUpperCase();
-    const payCurrencyCode = payCurrency ? currencyCode(payCurrency) : void 0;
+    if (payCurrency && !isSupportedCurrency(payCurrency)) {
+      return ok(
+        toTerminalFailure(
+          "INVALID_CURRENCY",
+          "Payment currency is unsupported for checkout.",
+          false
+        )
+      );
+    }
+    const payCurrencyCode = payCurrency && isSupportedCurrency(payCurrency) ? payCurrency : void 0;
     const cartTotalAmount = typeof cart.pricing.total_price === "number" ? cart.pricing.total_price : Number.parseFloat(cart.pricing.total_price || "0");
     if (payCurrencyCode && payCurrencyCode !== baseCurrency && !checkoutData.fx_quote_id && Number.isFinite(cartTotalAmount) && cartTotalAmount > 0) {
       const fxQuoteResult = await this.client.fx.lockQuote({
@@ -1773,7 +1742,7 @@ var CheckoutService = class {
       checkoutData.pay_currency = payCurrencyCode;
       checkoutData.fx_quote_id = fxQuoteResult.value.id;
     }
-    data.on_status_change?.("processing", {});
+    notifyCheckoutStatus(data.on_status_change, "processing");
     const processResult = await this.process(checkoutData);
     if (!processResult.ok) {
       return ok(
@@ -1790,12 +1759,13 @@ var CheckoutService = class {
       pollIntervalMs: data.poll_interval_ms,
       maxPollAttempts: data.max_poll_attempts,
       onStatusChange: data.on_status_change,
+      onAuthorizationUiChange: data.on_authorization_ui_change,
       onAuthorizationRequired: data.on_authorization_required,
       signal: data.signal,
       returnUrl: data.return_url,
       enrollInLink: data.enroll_in_link,
       cartTotal: cart.pricing.total_price,
-      cartCurrency: checkoutData.pay_currency || cart.pricing.currency || "GHS",
+      cartCurrency: checkoutData.pay_currency || baseCurrency,
       orderType: checkoutData.order_type,
       allowPopups: data.allow_popups
     });
@@ -1863,43 +1833,86 @@ function encodePathSegment(value) {
 var LinkService = class {
   constructor(client) {
     this.client = client;
+    this.activationGeneration = 0;
+  }
+  beginActivation() {
+    return {
+      generation: ++this.activationGeneration,
+      sessionEpoch: this.client.getSessionEpoch(),
+      publicKeyEpoch: this.client.getPublicKeyEpoch()
+    };
+  }
+  isActivationFenceCurrent(fence) {
+    return fence.generation === this.activationGeneration && fence.sessionEpoch === this.client.getSessionEpoch() && fence.publicKeyEpoch === this.client.getPublicKeyEpoch();
+  }
+  supersededActivation() {
+    return {
+      ok: false,
+      error: new CimplifyError(
+        "session_superseded",
+        "A newer authentication session replaced this one"
+      )
+    };
+  }
+  async activateAuthenticatedSession(result, fence) {
+    if (!result.ok || !result.value.session_token) return result;
+    if (!this.isActivationFenceCurrent(fence)) return this.supersededActivation();
+    const accessToken = result.value.session_token;
+    this.client.setAccessToken(accessToken);
+    const installedSessionEpoch = this.client.getSessionEpoch();
+    if (!this.client.getPublicKey().trim()) {
+      this.client.activity.refreshIdentity();
+      return result;
+    }
+    const claim = await this.client.support.claimConversation();
+    if (fence.generation !== this.activationGeneration || fence.publicKeyEpoch !== this.client.getPublicKeyEpoch() || this.client.getAccessToken() !== accessToken) {
+      return this.supersededActivation();
+    }
+    if (!claim.ok && claim.error.code !== "already_claimed") {
+      if (this.client.getSessionEpoch() !== installedSessionEpoch) {
+        return this.supersededActivation();
+      }
+      if (this.client.hasClaimedSessionAuthority()) {
+        this.client.clearSession();
+      } else {
+        this.client.setAccessToken(null);
+      }
+      return claim;
+    }
+    this.client.activity.refreshIdentity();
+    return result;
   }
   async requestOtp(input, opts) {
     const idempotencyKey = opts?.idempotencyKey ?? generateIdempotencyKey();
     return safe(
-      this.client.linkPost("/v1/link/auth/request-otp", input, { idempotencyKey })
+      this.client.linkPost("/v1/link/auth/request-otp", input, {
+        idempotencyKey
+      })
     );
   }
   async verifyOtp(input, opts) {
     const idempotencyKey = opts?.idempotencyKey ?? generateIdempotencyKey();
+    const activationFence = opts?.activateSession === false ? null : this.beginActivation();
     const { business_id: _ignoredBusinessId, ...body } = input;
     const result = await safe(
       this.client.linkPost("/v1/link/auth/verify-otp", body, { idempotencyKey })
     );
-    if (result.ok && result.value.session_token) {
-      this.client.setAccessToken(result.value.session_token);
-      this.client.activity.refreshIdentity();
-      this.client.autoClaimChatIdentity();
-    }
-    return result;
+    return activationFence ? this.activateAuthenticatedSession(result, activationFence) : result;
   }
   async refreshSession(sessionToken, opts) {
     const idempotencyKey = opts?.idempotencyKey ?? generateIdempotencyKey();
+    const activationFence = opts?.activateSession === false ? null : this.beginActivation();
     const body = sessionToken ? { session_token: sessionToken } : {};
     const result = await safe(
       this.client.linkPost("/v1/link/auth/refresh", body, { idempotencyKey })
     );
-    if (result.ok && result.value.session_token) {
-      this.client.setAccessToken(result.value.session_token);
-      this.client.activity.refreshIdentity();
-      this.client.autoClaimChatIdentity();
-    }
-    return result;
+    return activationFence ? this.activateAuthenticatedSession(result, activationFence) : result;
   }
   async logout() {
-    const result = await safe(this.client.linkPost("/v1/link/auth/logout"));
+    this.activationGeneration += 1;
+    const request = safe(this.client.linkPost("/v1/link/auth/logout"));
     this.client.clearSession();
-    return result;
+    return request;
   }
   async checkStatus(contact) {
     return safe(this.client.linkPost("/v1/link/check-status", { contact }));
@@ -1945,11 +1958,9 @@ var LinkService = class {
   async enrollAndLinkOrder(data, opts) {
     const idempotencyKey = opts?.idempotencyKey ?? generateIdempotencyKey();
     return safe(
-      this.client.linkPost(
-        "/v1/link/enroll-and-link-order",
-        data,
-        { idempotencyKey }
-      )
+      this.client.linkPost("/v1/link/enroll-and-link-order", data, {
+        idempotencyKey
+      })
     );
   }
   async updatePreferences(preferences) {
@@ -2372,6 +2383,7 @@ var MESSAGE_TYPES = {
   INIT: "init",
   SET_TOKEN: "set_token",
   SET_SESSION: "set_session",
+  SESSION_CLEARED: "session_cleared",
   SET_CART: "set_cart",
   GET_DATA: "get_data",
   NAVIGATE: "navigate",
@@ -2388,6 +2400,8 @@ var MESSAGE_TYPES = {
   LOGOUT_COMPLETE: "logout_complete",
   AUTH_REQUESTED: "auth_requested",
   SESSION_ESTABLISHED: "session_established",
+  SESSION_ESTABLISHMENT_FAILED: "session_establishment_failed",
+  CONTINUE_WITHOUT_SAVED_DETAILS: "continue_without_saved_details",
   CONTACT_PROVIDED: "contact_provided",
   CHECKOUT_STATUS: "checkout_status",
   CHECKOUT_COMPLETE: "checkout_complete",
@@ -2751,6 +2765,7 @@ function toCheckoutError(code, message, recoverable) {
   };
 }
 var DEFAULT_LINK_URL = "https://link.cimplify.io";
+var AUTH_ESTABLISHMENT_WAIT_MS = 8e3;
 var AUTH_CONTACT_TYPES = new Set(Object.values(ELEMENTS_AUTH_CONTACT_TYPES));
 var AUTH_MODES = new Set(Object.values(ELEMENTS_AUTH_MODES));
 var AUTH_PROMPTS = new Set(Object.values(ELEMENTS_AUTH_PROMPTS));
@@ -2801,6 +2816,7 @@ var KNOWN_IFRAME_TYPES = /* @__PURE__ */ new Set([
   MESSAGE_TYPES.HEIGHT_CHANGE,
   MESSAGE_TYPES.AUTH_REQUESTED,
   MESSAGE_TYPES.SESSION_ESTABLISHED,
+  MESSAGE_TYPES.CONTINUE_WITHOUT_SAVED_DETAILS,
   MESSAGE_TYPES.ERROR,
   MESSAGE_TYPES.ADDRESS_CHANGED,
   MESSAGE_TYPES.ADDRESS_SELECTED,
@@ -2845,6 +2861,7 @@ function parseIframeMessage(data) {
       if (!record.method || typeof record.method !== "object") return null;
       break;
     case MESSAGE_TYPES.CONTACT_PROVIDED:
+    case MESSAGE_TYPES.CONTINUE_WITHOUT_SAVED_DETAILS:
       if (typeof record.contact !== "string" || typeof record.contactType !== "string") return null;
       break;
     case MESSAGE_TYPES.ERROR:
@@ -2854,7 +2871,8 @@ function parseIframeMessage(data) {
       if (typeof record.success !== "boolean") return null;
       break;
     case MESSAGE_TYPES.CHECKOUT_STATUS:
-      if (typeof record.status !== "string" || !record.context || typeof record.context !== "object") return null;
+      if (typeof record.status !== "string" || !record.context || typeof record.context !== "object")
+        return null;
       break;
     case MESSAGE_TYPES.READY:
     case MESSAGE_TYPES.HEIGHT_CHANGE:
@@ -2877,6 +2895,8 @@ var CimplifyElements = class {
     this.paymentData = null;
     this.checkoutInProgress = false;
     this.authInProgress = false;
+    this.authEstablishmentInProgress = false;
+    this.authGeneration = 0;
     this.activeCheckoutAbort = null;
     this.businessIdResolvePromise = null;
     this.client = client;
@@ -2911,6 +2931,12 @@ var CimplifyElements = class {
     }
   }
   destroy() {
+    this.authGeneration += 1;
+    if (this.authEstablishmentInProgress) {
+      this.client.setAccessToken(null);
+    }
+    this.authInProgress = false;
+    this.authEstablishmentInProgress = false;
     this.elements.forEach((element) => element.destroy());
     this.elements.clear();
     if (typeof window !== "undefined") {
@@ -2948,16 +2974,27 @@ var CimplifyElements = class {
   processCheckout(options) {
     let abortFn = null;
     const task = (async () => {
-      this.debug("[cimplify:checkout] processCheckout called", { cart_id: options.cart_id, order_type: options.order_type, location_id: options.location_id });
+      this.debug("[cimplify:checkout] processCheckout called", {
+        cart_id: options.cart_id,
+        order_type: options.order_type,
+        location_id: options.location_id
+      });
       if (this.checkoutInProgress) {
         this.debug("[cimplify:checkout] BLOCKED: already processing");
-        return toCheckoutError(
-          "ALREADY_PROCESSING",
-          "Checkout is already in progress.",
-          false
-        );
+        return toCheckoutError("ALREADY_PROCESSING", "Checkout is already in progress.", false);
       }
       this.checkoutInProgress = true;
+      if (this.authEstablishmentInProgress) {
+        await this.waitForAuthEstablishment(AUTH_ESTABLISHMENT_WAIT_MS);
+        if (this.authEstablishmentInProgress) {
+          this.checkoutInProgress = false;
+          return toCheckoutError(
+            "AUTH_INCOMPLETE",
+            "Authentication must finish establishing the checkout session.",
+            true
+          );
+        }
+      }
       if (!options.cart_id) {
         this.debug("[cimplify:checkout] BLOCKED: no cart_id");
         this.checkoutInProgress = false;
@@ -3015,7 +3052,11 @@ var CimplifyElements = class {
         }
         await this.hydrateCustomerData();
       }
-      this.debug("[cimplify:checkout] customer data hydrated", { customerData: this.customerData, accountId: this.accountId, isUnifiedCheckout });
+      this.debug("[cimplify:checkout] customer data hydrated", {
+        customerData: this.customerData,
+        accountId: this.accountId,
+        isUnifiedCheckout
+      });
       const processMessage = {
         type: MESSAGE_TYPES.PROCESS_CHECKOUT,
         cart_id: options.cart_id,
@@ -3079,7 +3120,10 @@ var CimplifyElements = class {
             return;
           }
           if (message.type === MESSAGE_TYPES.CHECKOUT_COMPLETE) {
-            this.debug("[cimplify:checkout] received checkout_complete", { success: message.success, error: message.error });
+            this.debug("[cimplify:checkout] received checkout_complete", {
+              success: message.success,
+              error: message.error
+            });
             settle({
               success: message.success,
               order: message.order,
@@ -3090,11 +3134,7 @@ var CimplifyElements = class {
           if (message.type === MESSAGE_TYPES.LOGOUT_COMPLETE) {
             checkoutElement.sendMessage({ type: MESSAGE_TYPES.ABORT_CHECKOUT });
             settle(
-              toCheckoutError(
-                "AUTH_LOST",
-                "Authentication was cleared during checkout.",
-                true
-              )
+              toCheckoutError("AUTH_LOST", "Authentication was cleared during checkout.", true)
             );
           }
         };
@@ -3103,16 +3143,16 @@ var CimplifyElements = class {
         }
         abortFn = () => {
           checkoutElement.sendMessage({ type: MESSAGE_TYPES.ABORT_CHECKOUT });
-          settle(
-            toCheckoutError(
-              "CANCELLED",
-              "Checkout was cancelled.",
-              true
-            )
-          );
+          settle(toCheckoutError("CANCELLED", "Checkout was cancelled.", true));
         };
         this.activeCheckoutAbort = abortFn;
-        this.debug("[cimplify:checkout] sending process_checkout to checkout iframe", { cart_id: processMessage.cart_id, order_type: processMessage.order_type, hasCustomer: !!processMessage.customer, hasAddress: !!processMessage.address, isUnifiedCheckout });
+        this.debug("[cimplify:checkout] sending process_checkout to checkout iframe", {
+          cart_id: processMessage.cart_id,
+          order_type: processMessage.order_type,
+          hasCustomer: !!processMessage.customer,
+          hasAddress: !!processMessage.address,
+          isUnifiedCheckout
+        });
         checkoutElement.sendMessage(processMessage);
         this.debug("[cimplify:checkout] postMessage sent, waiting for checkout_complete...");
       });
@@ -3158,11 +3198,16 @@ var CimplifyElements = class {
   getAppearance() {
     return this.options.appearance;
   }
-  async hydrateCustomerData() {
-    if (!this.accessToken || this.customerData) return;
+  isAuthGenerationCurrent(generation, token) {
+    return this.authGeneration === generation && this.client.getAccessToken() === token;
+  }
+  async hydrateCustomerData(generation = this.authGeneration, token = this.accessToken, force = false) {
+    if (!token || !this.isAuthGenerationCurrent(generation, token)) return false;
+    if (this.customerData && !force) return true;
     const linkDataResult = await this.client.link.getLinkData();
+    if (!this.isAuthGenerationCurrent(generation, token)) return false;
     if (!linkDataResult.ok || !linkDataResult.value?.customer) {
-      return;
+      return true;
     }
     const customer = linkDataResult.value.customer;
     this.customerData = {
@@ -3171,6 +3216,7 @@ var CimplifyElements = class {
       phone: customer.phone || null
     };
     this.customerId = customer.id;
+    return true;
   }
   sourceElementFor(event, message) {
     for (const element of this.elements.values()) {
@@ -3209,48 +3255,123 @@ var CimplifyElements = class {
     } catch {
     }
   }
+  clearClaimedAuthorityAfterRestoreFailure() {
+    if (!this.client.getAccessToken() && !this.client.hasClaimedSessionAuthority()) return;
+    this.accessToken = null;
+    this.accountId = null;
+    this.customerId = null;
+    this.customerData = null;
+    this.addressData = null;
+    this.paymentData = null;
+    this.authEstablishmentInProgress = false;
+    this.client.clearSession();
+    this.broadcastClearedSession();
+  }
   async restoreSession() {
     if (typeof window === "undefined" || this.accessToken) return;
+    const generation = ++this.authGeneration;
     const storageKey = this.sessionStorageKey();
     if (!storageKey) return;
     let refreshToken = null;
     try {
       refreshToken = window.localStorage.getItem(storageKey);
     } catch {
+      this.clearClaimedAuthorityAfterRestoreFailure();
       return;
     }
-    if (!refreshToken) return;
-    const result = await this.client.link.refreshSession(refreshToken);
+    if (!refreshToken) {
+      this.clearClaimedAuthorityAfterRestoreFailure();
+      return;
+    }
+    const result = await this.client.link.refreshSession(refreshToken, {
+      activateSession: false
+    });
+    if (this.authGeneration !== generation) return;
     if (!result.ok || !result.value.session_token) {
       this.clearPersistedSession();
+      this.clearClaimedAuthorityAfterRestoreFailure();
       return;
     }
     this.persistRefreshToken(result.value.refresh_token ?? void 0);
-    const data = await this.applyAccessToken(result.value.session_token);
-    this.broadcastAccessToken(result.value.session_token);
-    this.elements.forEach((element) => element._emitAuthenticated(data));
+    const application = await this.applyAccessToken(result.value.session_token, generation);
+    if (application.kind === "claim_failed") {
+      this.clearPersistedSession();
+      this.broadcastClearedSession();
+      return;
+    }
+    if (application.kind !== "authenticated" || !this.broadcastAccessToken(result.value.session_token, generation)) {
+      return;
+    }
+    this.elements.forEach((element) => element._emitAuthenticated(application.data));
   }
-  async applyAccessToken(token) {
+  async applyAccessToken(token, generation) {
+    if (this.authGeneration !== generation) return { kind: "incomplete" };
+    this.authEstablishmentInProgress = true;
+    this.accessToken = null;
+    this.accountId = null;
+    this.customerId = null;
+    this.customerData = null;
+    this.addressData = null;
+    this.paymentData = null;
+    this.client.setAccessToken(token);
+    const claim = await this.client.support.claimConversation();
+    if (!this.isAuthGenerationCurrent(generation, token)) return { kind: "incomplete" };
+    if (!claim.ok && claim.error.code !== "already_claimed") {
+      if (this.client.hasClaimedSessionAuthority()) {
+        this.client.clearSession();
+      } else {
+        this.client.setAccessToken(null);
+      }
+      this.authEstablishmentInProgress = false;
+      return {
+        kind: "claim_failed",
+        code: claim.error.code,
+        message: claim.error.userMessage
+      };
+    }
     this.accessToken = token;
     this.accountId = decodeJwtSub(token);
-    this.client.setAccessToken(token);
-    this.client.autoClaimChatIdentity();
-    await this.hydrateCustomerData();
+    if (!await this.hydrateCustomerData(generation, token, true)) {
+      return { kind: "incomplete" };
+    }
+    if (!this.isAuthGenerationCurrent(generation, token)) return { kind: "incomplete" };
+    this.authEstablishmentInProgress = false;
     return {
-      accountId: this.accountId ?? "",
-      customerId: this.customerId ?? "",
-      token,
-      customer: this.customerData ?? { name: "", email: null, phone: null }
+      kind: "authenticated",
+      data: {
+        accountId: this.accountId ?? "",
+        customerId: this.customerId ?? "",
+        token,
+        customer: this.customerData ?? { name: "", email: null, phone: null }
+      }
     };
   }
-  broadcastAccessToken(token) {
+  async waitForAuthEstablishment(timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (this.authEstablishmentInProgress && Date.now() < deadline) {
+      await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+  }
+  broadcastAccessToken(token, generation) {
+    if (!this.isAuthGenerationCurrent(generation, token) || this.accessToken !== token || this.authEstablishmentInProgress) {
+      return false;
+    }
     const sessionToken = this.client.getSessionToken();
     this.elements.forEach((element) => {
-      element.sendMessage({ type: MESSAGE_TYPES.SET_TOKEN, token });
       if (sessionToken) {
         element.sendMessage({ type: MESSAGE_TYPES.SET_SESSION, sessionToken });
       }
+      element.sendMessage({ type: MESSAGE_TYPES.SET_TOKEN, token });
+    });
+    return true;
+  }
+  broadcastClearedSession() {
+    const sessionToken = this.client.getSessionToken();
+    if (!sessionToken) return null;
+    this.elements.forEach((element) => {
+      element.sendMessage({ type: MESSAGE_TYPES.SESSION_CLEARED, sessionToken });
     });
+    return sessionToken;
   }
   startEmbeddedAuth(sourceElement, request) {
     if (this.authInProgress) return;
@@ -3264,6 +3385,7 @@ var CimplifyElements = class {
       });
       return;
     }
+    const generation = ++this.authGeneration;
     this.authInProgress = true;
     void startSignIn({
       clientId,
@@ -3278,6 +3400,7 @@ var CimplifyElements = class {
       mode: "modal",
       silentFirst: request.mode === ELEMENTS_AUTH_MODES.CHECKOUT && request.prompt !== ELEMENTS_AUTH_PROMPTS.LOGIN,
       onSuccess: async ({ accessToken }) => {
+        if (this.authGeneration !== generation) return;
         this.authInProgress = false;
         if (!accessToken) {
           sourceElement._emitError({
@@ -3286,11 +3409,18 @@ var CimplifyElements = class {
           });
           return;
         }
-        const data = await this.applyAccessToken(accessToken);
-        this.broadcastAccessToken(accessToken);
-        sourceElement._emitAuthenticated(data);
+        const application = await this.applyAccessToken(accessToken, generation);
+        if (application.kind === "authenticated" && this.broadcastAccessToken(accessToken, generation)) {
+          sourceElement._emitAuthenticated(application.data);
+        } else if (application.kind === "claim_failed") {
+          sourceElement._emitError({
+            code: application.code,
+            message: application.message
+          });
+        }
       },
       onError: (err2) => {
+        if (this.authGeneration !== generation) return;
         this.authInProgress = false;
         sourceElement._emitError({
           code: err2.error,
@@ -3298,6 +3428,7 @@ var CimplifyElements = class {
         });
       }
     }).catch((error) => {
+      if (this.authGeneration !== generation) return;
       this.authInProgress = false;
       sourceElement._emitError({
         code: "AUTH_START_FAILED",
@@ -3318,11 +3449,29 @@ var CimplifyElements = class {
         this.startEmbeddedAuth(sourceElement, message);
         break;
       case MESSAGE_TYPES.SESSION_ESTABLISHED:
-        this.persistRefreshToken(message.refreshToken);
-        void this.applyAccessToken(message.accessToken).then((data) => {
-          this.broadcastAccessToken(message.accessToken);
-          sourceElement._emitAuthenticated(data);
-        });
+        {
+          this.authInProgress = false;
+          const generation = ++this.authGeneration;
+          void this.applyAccessToken(message.accessToken, generation).then((application) => {
+            if (this.authGeneration !== generation) return;
+            if (application.kind === "claim_failed") {
+              this.clearPersistedSession();
+              sourceElement.sendMessage({
+                type: MESSAGE_TYPES.SESSION_ESTABLISHMENT_FAILED,
+                accessToken: message.accessToken,
+                code: application.code,
+                message: application.message
+              });
+              this.broadcastClearedSession();
+              return;
+            }
+            if (application.kind !== "authenticated" || !this.broadcastAccessToken(message.accessToken, generation)) {
+              return;
+            }
+            this.persistRefreshToken(message.refreshToken);
+            sourceElement._emitAuthenticated(application.data);
+          });
+        }
         break;
       case MESSAGE_TYPES.ADDRESS_CHANGED:
       case MESSAGE_TYPES.ADDRESS_SELECTED:
@@ -3341,7 +3490,35 @@ var CimplifyElements = class {
           this.customerData.phone = message.contact;
         }
         break;
+      case MESSAGE_TYPES.CONTINUE_WITHOUT_SAVED_DETAILS: {
+        this.authGeneration += 1;
+        this.authInProgress = false;
+        this.authEstablishmentInProgress = false;
+        const carriedIdentityAuthority = Boolean(this.client.getAccessToken()) || this.client.hasClaimedSessionAuthority();
+        this.accessToken = null;
+        this.accountId = null;
+        this.customerId = null;
+        this.customerData = { name: "", email: null, phone: null };
+        this.addressData = null;
+        this.paymentData = null;
+        this.clearPersistedSession();
+        if (carriedIdentityAuthority) {
+          this.client.clearSession();
+        } else {
+          this.client.setAccessToken(null);
+        }
+        this.broadcastClearedSession();
+        if (message.contactType === "email") {
+          this.customerData.email = message.contact;
+        } else {
+          this.customerData.phone = message.contact;
+        }
+        break;
+      }
       case MESSAGE_TYPES.LOGOUT_COMPLETE:
+        this.authGeneration += 1;
+        this.authInProgress = false;
+        this.authEstablishmentInProgress = false;
         if (this.checkoutInProgress && this.activeCheckoutAbort) {
           this.activeCheckoutAbort();
         }
@@ -3353,6 +3530,7 @@ var CimplifyElements = class {
         this.paymentData = null;
         this.clearPersistedSession();
         this.client.clearSession();
+        this.broadcastClearedSession();
         break;
     }
   }
@@ -3486,10 +3664,9 @@ var CimplifyElement = class {
     const iframe = this.iframe;
     if (!iframe || !iframe.isConnected) {
       if (iframe && !iframe.isConnected) {
-        console.warn(
-          "[cimplify:checkout] sendMessage DROPPED \u2014 iframe detached",
-          { type: message.type }
-        );
+        console.warn("[cimplify:checkout] sendMessage DROPPED \u2014 iframe detached", {
+          type: message.type
+        });
       }
       return;
     }
@@ -3588,13 +3765,13 @@ var CimplifyElement = class {
             submitLabel: this.options.submitLabel
           });
           const token = this.parent.getAccessToken();
-          if (token) {
-            this.sendMessage({ type: MESSAGE_TYPES.SET_TOKEN, token });
-          }
           const sessionToken = this.parent.getSessionToken();
           if (sessionToken) {
             this.sendMessage({ type: MESSAGE_TYPES.SET_SESSION, sessionToken });
           }
+          if (token) {
+            this.sendMessage({ type: MESSAGE_TYPES.SET_TOKEN, token });
+          }
           this.pendingInit = null;
         }
         this.flushPending();
@@ -3643,4 +3820,4 @@ function createElements(client, businessId, options) {
   return new CimplifyElements(client, businessId, options);
 }
 
-export { AUTHORIZATION_TYPE, AUTH_MUTATION, AuthService, BusinessService, CHECKOUT_MODE, CHECKOUT_MUTATION, CHECKOUT_STEP, CONTACT_TYPE, CartOperations, CatalogueQueries, CheckoutService, CimplifyElement, CimplifyElements, DEFAULT_COUNTRY, DEFAULT_CURRENCY, DEFAULT_ISSUER, DEVICE_TYPE, ELEMENTS_AUTH_CONTACT_TYPES, ELEMENTS_AUTH_MODES, ELEMENTS_AUTH_PROMPTS, ELEMENT_TYPES, EVENT_TYPES, FxService, InventoryService, LINK_MUTATION, LINK_QUERY, LinkService, LiteService, MESSAGE_TYPES, MOBILE_MONEY_PROVIDER, ORDER_MUTATION, ORDER_TYPE, OrderQueries, PAYMENT_METHOD, PAYMENT_MUTATION, PAYMENT_STATE, PICKUP_TIME_TYPE, PKCE_COOKIE, PKCE_COOKIE_PATH, SchedulingService, combine, combineObject, createElements, decodePkceState, err, flatMap, fromPromise, generateIdempotencyKey, generatePkce, generateState, getAuthorizationEndpoint, getOrElse, isErr, isOk, mapError, mapResult, ok, safe, startSignIn, toNullable, tryCatch, unwrap };
+export { AuthService, BusinessService, CartOperations, CatalogueQueries, CheckoutService, CimplifyElement, CimplifyElements, DEFAULT_ISSUER, ELEMENTS_AUTH_CONTACT_TYPES, ELEMENTS_AUTH_MODES, ELEMENTS_AUTH_PROMPTS, ELEMENT_TYPES, EVENT_TYPES, FxService, InventoryService, LinkService, LiteService, MESSAGE_TYPES, OrderQueries, PKCE_COOKIE, PKCE_COOKIE_PATH, SchedulingService, combine, combineObject, createElements, decodePkceState, err, flatMap, fromPromise, generateIdempotencyKey, generatePkce, generateState, getAuthorizationEndpoint, getOrElse, isErr, isOk, mapError, mapResult, ok, safe, startSignIn, toNullable, tryCatch, unwrap };