@curless/sinocare-demo 0.67.0 → 0.69.0

package/dist/index.js

@@ -171,33 +171,6 @@ var storefrontTools = (opts) => [
       required: ["sku"]
     }
   },
-  {
-    name: "start_sinocare_uaag_handoff",
-    description: "PAY WITH A UNIONPAY CARD the person bound to their Curless wallet. Sinocare prices the order; the card comes from their wallet, not from you. Returns a URL THEY open \u2014 UnionPay authenticates the cardholder on their own page, with 3DS and a passkey, so no card number ever reaches this server. \u26A0\uFE0F This is a HANDOFF, not a completed purchase, and the distinction is subtle enough that the first person through it got it wrong: UnionPay\u2019s page is titled \u300C\u786E\u8BA4\u652F\u4ED8\u300D and shows the amount, merchant and items, so the cardholder really is approving THIS purchase. What their approval produces is a one-time token + DTVC, which the spec calls the INPUT to an authorization \u2014 a message nobody has sent yet, and the MERCHANT\u2019s acquirer is who sends it. Sinocare has no UnionPay acceptance, so nothing is charged. Returns ordered:false and paid:false always. Then call get_sinocare_uaag_status.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        sku,
-        query,
-        quantity,
-        cardId: {
-          type: "string",
-          description: "OPTIONAL, and normally omit it. The storefront reads the bound UnionPay cards from the person\u2019s own wallet and uses the one they have; pass this only to pick between several. A uaagcard_\u2026 you did not get from that list is a guess, and UnionPay answers a wrong one with a 404 that does not say what was wrong."
-        }
-      }
-    }
-  },
-  {
-    name: "get_sinocare_uaag_status",
-    description: "Has UnionPay issued the payment credential yet? Pass the paymentIntentId from start_sinocare_uaag_handoff. The cardholder authenticates in their own browser and this server is never told when they finish, so this is the only way to know. \u26A0\uFE0F `issued: true` means the cardholder confirmed and a one-time token now exists \u2014 it does NOT mean the order is paid. The MERCHANT charges that credential through their own UnionPay acceptance, which Sinocare does not have, so this demo stops there on purpose. Say both halves; never report it as paid.",
-    inputSchema: {
-      type: "object",
-      required: ["paymentIntentId"],
-      properties: {
-        paymentIntentId: { type: "string", description: "from start_sinocare_uaag_handoff" }
-      }
-    }
-  },
   {
     name: "get_sinocare_order_status",
     description: "Has this checkout been paid? Use after pay_sinocare_hosted \u2014 the approval happens in a browser and this server is never told when it does. `completed` means the money moved.",
@@ -245,12 +218,24 @@ var productsView = (products) => ({
   count: products.length,
   products: [...products]
 });
+var TERMINAL = /* @__PURE__ */ new Set(["captured", "settled", "reconciled", "refunded", "failed", "canceled"]);
 var ordersView = (orders) => ({
   view: "orders",
   orders: orders.map(
     (o) => ({
       orderId: o.id,
-      status: o.refundRequest ? o.refundRequest.status === "approved" ? "refund approved" : "refund requested" : o.status,
+      status: o.refundRequest ? o.refundRequest.status === "approved" ? "refund approved" : "refund requested" : (
+        // ⚠️ A UnionPay order is the one case where a still-uncaptured order
+        // is not "nothing happened yet". The cardholder confirmed and a
+        // one-time credential exists; the charge belongs to the merchant's
+        // own acquirer, which is why the PI — and so `o.status` — never
+        // moves. Left as the bare pending status, the person sees an unpaid
+        // order and no reason, having just confirmed a payment.
+        //
+        // ⚠️ Not "paid", and never will be from here. The wording carries
+        // both halves, which is the same rule the tool descriptions follow.
+        o.metadata?.uaag?.credentialAt && !TERMINAL.has(o.status) ? "credential issued \xB7 merchant to charge" : o.status
+      ),
       refundPending: Boolean(o.refundRequest),
       product: o.lineItems?.map((li) => `${li.name} \xD7${li.quantity}`).join(", ") ?? "",
       total: formatMinor(Number(o.amount ?? 0), String(o.currency ?? "EUR")),
@@ -414,6 +399,9 @@ var uaagCheckoutStatus = async (deps, paymentIntentId) => {
   const issued = uaag?.credential !== void 0;
   return {
     issued,
+    // Present on any order this rail ever touched, credential or not — it is
+    // what tells a shared status tool which question it is answering.
+    startedAt: uaag?.startedAt ?? null,
     // ⚠️ `issued` is not `paid`, and the two are one word apart in every
     // language this will be read in.
     ordered: false,
@@ -965,6 +953,33 @@ var RAIL_TOOLS = [
       }
     }
   },
+  {
+    name: "start_sinocare_uaag_handoff",
+    description: "PAY WITH A UNIONPAY CARD the person bound to their Curless wallet. Sinocare prices the order; the card comes from their wallet, not from you. Returns a URL THEY open \u2014 UnionPay authenticates the cardholder on their own page, with 3DS and a passkey, so no card number ever reaches this server. \u26A0\uFE0F This is a HANDOFF, not a completed purchase, and the distinction is subtle enough that the first person through it got it wrong: UnionPay\u2019s page is titled \u300C\u786E\u8BA4\u652F\u4ED8\u300D and shows the amount, merchant and items, so the cardholder really is approving THIS purchase. What their approval produces is a one-time token + DTVC, which the spec calls the INPUT to an authorization \u2014 a message nobody has sent yet, and the MERCHANT\u2019s acquirer is who sends it. Sinocare has no UnionPay acceptance, so nothing is charged. Returns ordered:false and paid:false always. Then call get_sinocare_uaag_status.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        sku: { type: "string", description: "the product's exact sku" },
+        query: { type: "string", description: "the product NAME, resolved against the catalog" },
+        quantity: { type: "integer", description: "how many, default 1" },
+        cardId: {
+          type: "string",
+          description: "OPTIONAL, and normally omit it. The storefront reads the bound UnionPay cards from the person\u2019s own wallet and uses the one they have; pass this only to pick between several. A uaagcard_\u2026 you did not get from that list is a guess, and UnionPay answers a wrong one with a 404 that does not say what was wrong."
+        }
+      }
+    }
+  },
+  {
+    name: "get_sinocare_uaag_status",
+    description: "Has UnionPay issued the payment credential yet? Pass the paymentIntentId from start_sinocare_uaag_handoff. The cardholder authenticates in their own browser and this server is never told when they finish, so this is the only way to know. \u26A0\uFE0F `issued: true` means the cardholder confirmed and a one-time token now exists \u2014 it does NOT mean the order is paid. The MERCHANT charges that credential through their own UnionPay acceptance, which Sinocare does not have, so this demo stops there on purpose. Say both halves; never report it as paid.",
+    inputSchema: {
+      type: "object",
+      required: ["paymentIntentId"],
+      properties: {
+        paymentIntentId: { type: "string", description: "from start_sinocare_uaag_handoff" }
+      }
+    }
+  },
   {
     name: "buy_sinocare_product_acp",
     description: "Buy a Sinocare product over ACP (Agentic Commerce Protocol) \u2014 Sinocare prices the product and opens a merchant-quoted checkout session; this agent completes it with a delegated card credential, settling on the card rail (test mode). One of THREE ways to pay: ACP (card) / UCP (card) / x402 (USDC). The card rail is an implementation detail, not a separate payment choice. Returns the ordered order.",