@devlab.group/agent-commerce 2.0.0 → 2.2.0

package/dist/cli/chunk-2ZZOGI5I.js

@@ -0,0 +1,1352 @@
+import { SETTLE_AFTER_BACKEND_METADATA_KEY, REUSE_REJECTED_AUTHORIZATION_METADATA_KEY } from './chunk-7JNYFUT3.js';
+import { RESERVED_INPUT_FIELDS, NOOP_LOGGER, DEFAULT_BACKEND_TIMEOUT_MS, CommerceError, isCommerceError, describeError, toCommerceError } from './chunk-QQ3WY5L3.js';
+import { isRecord } from './chunk-3M6U7ILB.js';
+import { isDeepStrictEqual } from 'util';
+
+// src/config/filename.ts
+var DEFAULT_CONFIG_FILENAME = "config.yaml";
+
+// src/core/execution/backend-request.ts
+var NEVER_FORWARDED_HEADER = /^(authorization|cookie|set-cookie|host|content-length|content-type|connection|keep-alive|te|trailer|transfer-encoding|upgrade|idempotency-key|proxy-.*)$/;
+var PATH_PARAM_PATTERN = /\{([a-zA-Z0-9_.-]+)\}/g;
+function extractPathParameterNames(url) {
+  return [...url.matchAll(PATH_PARAM_PATTERN)].map((match) => match[1]);
+}
+function findUnparsedBraceToken(url) {
+  const residue = url.replace(PATH_PARAM_PATTERN, "");
+  const index = residue.search(/[{}]/);
+  if (index === -1) return void 0;
+  const token = /\{[^{}]*\}?|\}/.exec(residue.slice(index));
+  return token?.[0] ?? residue[index];
+}
+function validateBackendRequestShape(handler, input, context, backendHeaders) {
+  const inputRecord = isRecord(input) ? input : {};
+  const parts = buildBackendRequestParts(handler, inputRecord, context);
+  buildHeaders(handler, context, backendHeaders);
+  let target;
+  try {
+    target = new URL(parts.url);
+  } catch {
+    return;
+  }
+  checkQueryCollision(target, parts.query, context);
+}
+function acceptsBody(method) {
+  return method !== "GET" && method !== "DELETE";
+}
+function buildBackendRequestParts(handler, input, context) {
+  const bindings = handler.inputBindings;
+  if (bindings === void 0) {
+    const { url: url2, remaining } = applyPathTemplate(handler.url, input, context);
+    return acceptsBody(handler.method) ? { url: url2, query: {}, body: { value: remaining } } : { url: url2, query: remaining };
+  }
+  const pathValues = bindings.path === void 0 ? {} : resolveBoundGroup(input, bindings.path, "path", context);
+  const { url } = applyPathTemplate(handler.url, pathValues, context);
+  const query = bindings.query === void 0 ? {} : resolveBoundGroup(input, bindings.query, "query", context);
+  const bodyValue = bindings.body === void 0 ? void 0 : input[bindings.body];
+  if (bodyValue === void 0 || !acceptsBody(handler.method)) return { url, query };
+  return { url, query, body: { value: bodyValue } };
+}
+function resolveBoundGroup(input, key, kind, context) {
+  const value = input[key];
+  if (value === void 0) return {};
+  if (!isRecord(value)) {
+    throw new CommerceError(
+      "INPUT_INVALID",
+      `Input "${key}" must be an object of ${kind} parameters`,
+      { ...context, details: { field: key } }
+    );
+  }
+  return value;
+}
+function checkQueryCollision(target, remaining, context) {
+  const templateKeys = new Set(target.searchParams.keys());
+  for (const key of Object.keys(remaining)) {
+    if (templateKeys.has(key)) {
+      throw new CommerceError(
+        "INPUT_INVALID",
+        `Input key "${key}" collides with a query parameter already set on backend.url`,
+        { requestId: context.requestId, resourceId: context.resourceId, details: { field: key } }
+      );
+    }
+  }
+}
+var TRAVERSAL_PATH_VALUES = /* @__PURE__ */ new Set(["", ".", ".."]);
+function applyPathTemplate(template, input, context) {
+  const remaining = { ...input };
+  let missing;
+  let invalid;
+  const url = template.replace(PATH_PARAM_PATTERN, (_match, key) => {
+    if (!Object.hasOwn(remaining, key)) {
+      missing = key;
+      return "";
+    }
+    const value = remaining[key];
+    delete remaining[key];
+    const raw = stringifyPrimitive(value);
+    if (TRAVERSAL_PATH_VALUES.has(raw)) {
+      invalid = key;
+      return "";
+    }
+    return encodeURIComponent(raw);
+  });
+  if (missing !== void 0) {
+    throw new CommerceError("INPUT_INVALID", `Path parameter "${missing}" was not supplied`, {
+      ...context,
+      details: { field: missing }
+    });
+  }
+  if (invalid !== void 0) {
+    throw new CommerceError("INPUT_INVALID", `Path parameter "${invalid}" is not a valid value`, {
+      ...context,
+      details: { field: invalid }
+    });
+  }
+  return { url, remaining };
+}
+function stringifyPrimitive(value) {
+  if (value === void 0 || value === null) return "";
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return String(value);
+  }
+}
+function buildHeaders(handler, context, forwarded = {}) {
+  let headers;
+  try {
+    headers = new Headers(handler.headers);
+  } catch {
+    throw invalidHeaderError(context);
+  }
+  for (const [name, value] of Object.entries(forwarded)) {
+    if (NEVER_FORWARDED_HEADER.test(name.toLowerCase())) continue;
+    try {
+      if (!headers.has(name)) headers.set(name, value);
+    } catch {
+      throw new CommerceError("INPUT_INVALID", "A forwarded request header is invalid", {
+        ...context,
+        details: { reason: "invalid-forwarded-header" }
+      });
+    }
+  }
+  return headers;
+}
+function setHeader(headers, name, value, context) {
+  try {
+    headers.set(name, value);
+  } catch {
+    throw invalidHeaderError(context);
+  }
+}
+function invalidHeaderError(context) {
+  return new CommerceError("BACKEND_ERROR", "Backend request headers are invalid", {
+    ...context,
+    details: { reason: "invalid-header" }
+  });
+}
+
+// src/core/execution/backend-http.ts
+var MAX_BODY_SNIPPET_LENGTH = 512;
+var IDEMPOTENCY_KEY_HEADER = "idempotency-key";
+var MAX_RESPONSE_BODY_BYTES = 1024 * 1024;
+var BackendErrorResponse = class {
+  constructor(status, body, headers = {}) {
+    this.status = status;
+    this.body = body;
+    this.headers = headers;
+  }
+  status;
+  body;
+  headers;
+};
+var HttpBackendExecutor = class {
+  fetchImpl;
+  logger;
+  constructor(options = {}) {
+    this.fetchImpl = options.fetchImpl ?? fetch;
+    this.logger = options.logger ?? NOOP_LOGGER;
+  }
+  async call(handler, request) {
+    const timeoutMs = handler.timeoutMs ?? DEFAULT_BACKEND_TIMEOUT_MS;
+    const inputRecord = isRecord(request.input) ? request.input : {};
+    const context = { requestId: request.requestId, resourceId: request.resourceId };
+    const parts = buildBackendRequestParts(handler, inputRecord, context);
+    let target;
+    try {
+      target = new URL(parts.url);
+    } catch (error) {
+      throw new CommerceError("BACKEND_ERROR", "Backend URL could not be constructed from input", {
+        ...context,
+        details: { reason: "invalid-url" },
+        cause: error
+      });
+    }
+    const prefixPathname = literalPrefixPathname(handler);
+    if (prefixPathname !== void 0 && !target.pathname.startsWith(prefixPathname)) {
+      throw new CommerceError(
+        "INPUT_INVALID",
+        "Path parameters resolved outside the configured backend path",
+        context
+      );
+    }
+    const headers = buildHeaders(handler, context, request.backendHeaders);
+    if (request.idempotencyKey !== void 0) {
+      setHeader(headers, IDEMPOTENCY_KEY_HEADER, request.idempotencyKey, context);
+    }
+    let body;
+    checkQueryCollision(target, parts.query, context);
+    for (const [key, value] of Object.entries(parts.query)) {
+      target.searchParams.set(key, stringifyPrimitive(value));
+    }
+    if (parts.body !== void 0) {
+      body = JSON.stringify(parts.body.value);
+      if (!headers.has("content-type")) headers.set("content-type", "application/json");
+    }
+    const started = performance.now();
+    let response;
+    try {
+      response = await this.fetchImpl(target, {
+        method: handler.method,
+        headers,
+        ...body !== void 0 ? { body } : {},
+        redirect: "manual",
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+    } catch (error) {
+      const durationMs2 = Math.round(performance.now() - started);
+      if (isAbortError(error)) {
+        throw new CommerceError(
+          "BACKEND_TIMEOUT",
+          `Backend request timed out after ${timeoutMs}ms`,
+          {
+            requestId: request.requestId,
+            resourceId: request.resourceId,
+            details: { timeoutMs, durationMs: durationMs2 },
+            cause: error
+          }
+        );
+      }
+      throw new CommerceError("BACKEND_ERROR", "Backend request failed (transport error)", {
+        requestId: request.requestId,
+        resourceId: request.resourceId,
+        details: { durationMs: durationMs2 },
+        cause: error
+      });
+    }
+    const durationMs = Math.round(performance.now() - started);
+    const isRedirect = response.type === "opaqueredirect" || response.status >= 300 && response.status < 400;
+    if (isRedirect) {
+      throw new CommerceError(
+        "BACKEND_ERROR",
+        "Backend responded with a redirect, which is not followed",
+        {
+          requestId: request.requestId,
+          resourceId: request.resourceId,
+          details: { status: response.status, reason: "redirect-not-followed" }
+        }
+      );
+    }
+    const responseHeaders = Object.fromEntries(response.headers);
+    const contentType = response.headers.get("content-type") ?? "";
+    let parsedBody;
+    try {
+      parsedBody = await parseBody(response, contentType);
+    } catch (error) {
+      const tooLarge = isCommerceError(error);
+      throw new CommerceError(
+        "BACKEND_ERROR",
+        tooLarge ? "Backend response exceeded the maximum allowed size" : "Backend response could not be read",
+        {
+          requestId: request.requestId,
+          resourceId: request.resourceId,
+          details: tooLarge ? { reason: "response-too-large", maxBytes: MAX_RESPONSE_BODY_BYTES } : { reason: "read-error" },
+          cause: error
+        }
+      );
+    }
+    if (response.status < 200 || response.status >= 300) {
+      this.logger.debug(
+        {
+          requestId: request.requestId,
+          resourceId: request.resourceId,
+          status: response.status,
+          bodySnippet: truncateSnippet(parsedBody)
+        },
+        "Backend responded with a non-2xx status"
+      );
+      throw new CommerceError("BACKEND_ERROR", `Backend responded with status ${response.status}`, {
+        requestId: request.requestId,
+        resourceId: request.resourceId,
+        details: { status: response.status },
+        cause: new BackendErrorResponse(response.status, parsedBody, responseHeaders)
+      });
+    }
+    return {
+      status: response.status,
+      headers: responseHeaders,
+      body: parsedBody,
+      durationMs
+    };
+  }
+};
+var prefixPathnames = /* @__PURE__ */ new WeakMap();
+function literalPrefixPathname(handler) {
+  let cached = prefixPathnames.get(handler);
+  if (cached === void 0) {
+    try {
+      cached = new URL(handler.url.split("{")[0] ?? handler.url).pathname;
+    } catch {
+      cached = null;
+    }
+    prefixPathnames.set(handler, cached);
+  }
+  return cached ?? void 0;
+}
+async function readBodyCapped(response, maxBytes) {
+  if (!response.body) return "";
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      total += value.byteLength;
+      if (total > maxBytes) {
+        await reader.cancel();
+        throw new CommerceError("BACKEND_ERROR", `response body exceeded ${maxBytes} bytes`);
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function parseBody(response, contentType) {
+  const text = await readBodyCapped(response, MAX_RESPONSE_BODY_BYTES);
+  if (text.length === 0) return text;
+  if (contentType.includes("json")) {
+    try {
+      return JSON.parse(text);
+    } catch {
+      return text;
+    }
+  }
+  return text;
+}
+function truncateSnippet(body) {
+  const text = typeof body === "string" ? body : safeStringify(body);
+  return text.length > MAX_BODY_SNIPPET_LENGTH ? `${text.slice(0, MAX_BODY_SNIPPET_LENGTH)}\u2026` : text;
+}
+function safeStringify(value) {
+  try {
+    return JSON.stringify(value) ?? String(value);
+  } catch {
+    return String(value);
+  }
+}
+function isAbortError(error) {
+  return error instanceof Error && (error.name === "TimeoutError" || error.name === "AbortError");
+}
+var SUPPORTED_TYPES = /* @__PURE__ */ new Set([
+  "object",
+  "string",
+  "number",
+  "integer",
+  "boolean",
+  "array",
+  "null"
+]);
+function compileJsonSchema(schema) {
+  return (input) => {
+    if (schema === void 0) return { valid: true, value: input };
+    const errors = validateNode(schema, input, "$");
+    return errors.length === 0 ? { valid: true, value: input } : { valid: false, errors };
+  };
+}
+function matchesType(type, value) {
+  switch (type) {
+    case "object":
+      return isRecord(value);
+    case "array":
+      return Array.isArray(value);
+    case "string":
+      return typeof value === "string";
+    case "boolean":
+      return typeof value === "boolean";
+    case "number":
+      return typeof value === "number" && Number.isFinite(value);
+    case "integer":
+      return typeof value === "number" && Number.isInteger(value);
+    case "null":
+      return value === null;
+    default:
+      return true;
+  }
+}
+function describeType(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "array";
+  return typeof value;
+}
+function deepEqual(a, b) {
+  return a === b || isDeepStrictEqual(a, b);
+}
+function own(obj, key) {
+  return Object.hasOwn(obj, key) ? obj[key] : void 0;
+}
+function typeList(raw) {
+  if (typeof raw === "string") return [raw];
+  if (Array.isArray(raw) && raw.every((entry) => typeof entry === "string")) {
+    return raw;
+  }
+  return void 0;
+}
+function isObjectSchemaNode(schema) {
+  const types = typeList(schema["type"]);
+  if (types !== void 0) return types.includes("object");
+  return Object.hasOwn(schema, "properties") || Object.hasOwn(schema, "required");
+}
+function validateNode(schema, value, path) {
+  const errors = [];
+  const types = typeList(own(schema, "type"));
+  const recognizedTypes = types?.filter((entry) => SUPPORTED_TYPES.has(entry));
+  if (types !== void 0 && recognizedTypes !== void 0 && recognizedTypes.length === types.length && types.length > 0) {
+    if (!types.some((entry) => matchesType(entry, value))) {
+      errors.push({
+        path,
+        message: `expected type "${types.join(" | ")}" but got ${describeType(value)}`
+      });
+      return errors;
+    }
+  }
+  const enumRaw = own(schema, "enum");
+  if (Array.isArray(enumRaw)) {
+    const allowed = enumRaw;
+    if (!allowed.some((candidate) => deepEqual(candidate, value))) {
+      errors.push({ path, message: `must be one of ${JSON.stringify(allowed)}` });
+    }
+  }
+  if (isObjectSchemaNode(schema) && isRecord(value)) {
+    errors.push(...validateObject(schema, value, path));
+  } else if ((types?.includes("array") ?? false) && Array.isArray(value)) {
+    errors.push(...validateArray(schema, value, path));
+  }
+  return errors;
+}
+function validateObject(schema, value, path) {
+  const errors = [];
+  const propsRaw = own(schema, "properties");
+  const properties = isRecord(propsRaw) ? propsRaw : {};
+  const requiredRaw = own(schema, "required");
+  const required = Array.isArray(requiredRaw) ? requiredRaw.filter((entry) => typeof entry === "string") : [];
+  for (const key of required) {
+    if (!Object.hasOwn(value, key)) {
+      errors.push({ path: `${path}.${key}`, message: "is required" });
+    }
+  }
+  const additional = own(schema, "additionalProperties");
+  for (const key of Object.keys(value)) {
+    const propSchemaRaw = own(properties, key);
+    if (propSchemaRaw !== void 0) {
+      if (isRecord(propSchemaRaw)) {
+        errors.push(...validateNode(propSchemaRaw, value[key], `${path}.${key}`));
+      }
+      continue;
+    }
+    if (additional === false) {
+      errors.push({ path: `${path}.${key}`, message: "additional property not allowed" });
+    } else if (isRecord(additional)) {
+      errors.push(...validateNode(additional, value[key], `${path}.${key}`));
+    }
+  }
+  return errors;
+}
+function validateArray(schema, value, path) {
+  const errors = [];
+  const itemsRaw = own(schema, "items");
+  if (isRecord(itemsRaw)) {
+    value.forEach((item, index) => {
+      errors.push(...validateNode(itemsRaw, item, `${path}[${index}]`));
+    });
+  }
+  return errors;
+}
+
+// src/core/execution/pipeline/authorization.ts
+function resolveAuthorizationProviders(providers, resource, requestId) {
+  const required = resource.authorization?.required ?? [];
+  return required.map((method) => {
+    const found = providers.find((provider) => provider.name === method);
+    if (!found) {
+      throw new CommerceError(
+        "CONFIG_INVALID",
+        `Resource "${resource.id}" requires authorization method "${method}", which is not enabled`,
+        { requestId, resourceId: resource.id }
+      );
+    }
+    return found;
+  });
+}
+function createAuthorizeAndReserve(ctx) {
+  const { options, safeEmit, buildEvent } = ctx;
+  async function authorizeAndReserve(request, resource, providers, requirement, input) {
+    if (providers.length === 0) return void 0;
+    const submission = request.authorization;
+    const provider = providers.find((candidate) => candidate.name === submission?.method);
+    const unmet = providers.filter((candidate) => candidate !== provider).map((c) => c.name);
+    if (submission === void 0 || provider === void 0 || unmet.length > 0) {
+      await safeEmit(
+        buildEvent({
+          type: "authorization.rejected",
+          requestId: request.requestId,
+          resourceId: resource.id,
+          adapter: request.protocol,
+          status: "error",
+          data: { reason: "AUTHORIZATION_REQUIRED", methods: unmet }
+        })
+      );
+      throw new CommerceError(
+        "AUTHORIZATION_REQUIRED",
+        `Resource "${resource.id}" requires authorization: ${unmet.join(", ")}`,
+        {
+          requestId: request.requestId,
+          resourceId: resource.id,
+          details: { required: providers.map((candidate) => candidate.name), missing: unmet }
+        }
+      );
+    }
+    let verification;
+    try {
+      verification = await provider.verifyAndReserve({
+        requestId: request.requestId,
+        resourceId: resource.id,
+        input,
+        submission,
+        requirement
+      });
+    } catch (error) {
+      const mapped = isCommerceError(error) ? error : new CommerceError(
+        "AUTHORIZATION_PROVIDER_UNAVAILABLE",
+        "Authorization provider is unavailable",
+        {
+          requestId: request.requestId,
+          resourceId: resource.id,
+          cause: error
+        }
+      );
+      await safeEmit(
+        buildEvent({
+          type: "authorization.rejected",
+          requestId: request.requestId,
+          resourceId: resource.id,
+          adapter: request.protocol,
+          status: "error",
+          data: { reason: mapped.code, method: provider.name }
+        })
+      );
+      throw mapped;
+    }
+    await safeEmit(
+      buildEvent({
+        type: "authorization.verified",
+        requestId: request.requestId,
+        resourceId: resource.id,
+        adapter: request.protocol,
+        status: "ok",
+        data: { method: verification.method, reference: verification.reference }
+      })
+    );
+    const context = { requestId: request.requestId, resourceId: resource.id };
+    return {
+      record: {
+        method: verification.method,
+        reference: verification.reference,
+        ...verification.metadata !== void 0 ? { metadata: verification.metadata } : {}
+      },
+      async finalize(action) {
+        try {
+          await provider[action](verification.reservationId, context);
+        } catch (error) {
+          options.logger.error(
+            { err: describeError(error), requestId: request.requestId, action },
+            "Authorization finalization failed; the reservation stays reserved"
+          );
+        }
+      }
+    };
+  }
+  return authorizeAndReserve;
+}
+
+// src/core/execution/pipeline/challenge.ts
+function retryChallenge(requirement, reason) {
+  const envelope = requirement.challenge.envelope;
+  if (envelope === void 0 && reason === void 0) return {};
+  return {
+    details: {
+      ...envelope !== void 0 ? { challenge: envelope } : {},
+      ...reason !== void 0 ? { reason } : {}
+    }
+  };
+}
+var FINISHED_ATTEMPT_STATUSES = /* @__PURE__ */ new Set(["settled", "rejected"]);
+function replayError(error, requirement) {
+  if (error.code !== "PAYMENT_REPLAYED") return error;
+  const status = error.details?.["attemptStatus"];
+  const finished = typeof status === "string" && FINISHED_ATTEMPT_STATUSES.has(status);
+  const network = requirement.network;
+  if (!finished && network === void 0) return error;
+  return new CommerceError("PAYMENT_REPLAYED", error.message, {
+    ...error.requestId !== void 0 ? { requestId: error.requestId } : {},
+    ...error.resourceId !== void 0 ? { resourceId: error.resourceId } : {},
+    ...finished ? { httpStatus: 402 } : {},
+    details: {
+      ...error.details,
+      ...network !== void 0 ? { network } : {},
+      ...finished ? retryChallenge(requirement).details : {}
+    }
+  });
+}
+
+// src/core/execution/pipeline/admission.ts
+function createPaymentAdmission(ctx, authorizeAndReserve) {
+  const { options, safeEmit, buildEvent } = ctx;
+  return async function admitPayment(request, resource, pricing, validInput) {
+    const provider = pickProvider(options.paymentProviders, resource.paymentMethods);
+    if (!provider) {
+      throw new CommerceError(
+        "PAYMENT_PROVIDER_UNAVAILABLE",
+        `No enabled payment provider for resource "${resource.id}"`,
+        {
+          requestId: request.requestId,
+          resourceId: resource.id,
+          details: { paymentMethods: resource.paymentMethods }
+        }
+      );
+    }
+    const authProviders = resolveAuthorizationProviders(
+      options.authorizationProviders ?? [],
+      resource,
+      request.requestId
+    );
+    let requirement;
+    try {
+      requirement = await provider.createRequirement({
+        requestId: request.requestId,
+        resource,
+        amount: pricing.amount,
+        currency: pricing.currency,
+        requestedAt: options.clock.nowIso(),
+        // Transport facts a rail may bind into its challenge, such as a body digest
+        ...request.metadata !== void 0 ? { metadata: request.metadata } : {}
+      });
+    } catch (error) {
+      throw isCommerceError(error) ? error : new CommerceError("PAYMENT_PROVIDER_UNAVAILABLE", "Payment provider is unavailable", {
+        requestId: request.requestId,
+        resourceId: resource.id,
+        cause: error
+      });
+    }
+    if (!request.payment) {
+      await safeEmit(
+        buildEvent({
+          type: "payment.required",
+          requestId: request.requestId,
+          resourceId: resource.id,
+          adapter: request.protocol,
+          paymentProvider: provider.name
+        })
+      );
+      return {
+        kind: "payment-required",
+        requestId: request.requestId,
+        resourceId: resource.id,
+        requirement,
+        ...authProviders.length > 0 ? { authorization: authProviders.map((p) => p.requirement) } : {}
+      };
+    }
+    const payment = request.payment;
+    let verification;
+    try {
+      if (provider.selectRequirement) {
+        requirement = await provider.selectRequirement({
+          requestId: request.requestId,
+          resource,
+          requirement,
+          submission: payment
+        });
+      }
+      verification = await provider.verify({
+        requestId: request.requestId,
+        resource,
+        requirement,
+        submission: payment
+      });
+    } catch (error) {
+      const mapped = isCommerceError(error) ? error : new CommerceError("PAYMENT_INVALID", "Payment verification failed", {
+        requestId: request.requestId,
+        resourceId: resource.id,
+        cause: error,
+        ...retryChallenge(requirement)
+      });
+      await safeEmit(
+        buildEvent({
+          type: "payment.rejected",
+          requestId: request.requestId,
+          resourceId: resource.id,
+          adapter: request.protocol,
+          paymentProvider: provider.name,
+          status: "error",
+          data: { reason: mapped.code }
+        })
+      );
+      throw mapped;
+    }
+    if (verification.status !== "verified") {
+      await safeEmit(
+        buildEvent({
+          type: "payment.rejected",
+          requestId: request.requestId,
+          resourceId: resource.id,
+          adapter: request.protocol,
+          paymentProvider: provider.name,
+          status: "error",
+          data: verification.rejectionReason ? { reason: verification.rejectionReason } : {}
+        })
+      );
+      throw new CommerceError(
+        "PAYMENT_INVALID",
+        verification.rejectionReason ?? "Payment was rejected",
+        {
+          requestId: request.requestId,
+          resourceId: resource.id,
+          ...retryChallenge(requirement, verification.rejectionReason)
+        }
+      );
+    }
+    if (!verification.replayKey) {
+      await safeEmit(
+        buildEvent({
+          type: "payment.rejected",
+          requestId: request.requestId,
+          resourceId: resource.id,
+          adapter: request.protocol,
+          paymentProvider: provider.name,
+          status: "error",
+          data: { reason: "missing-replay-key" }
+        })
+      );
+      throw new CommerceError("PAYMENT_INVALID", "Payment provider did not return a replay key", {
+        requestId: request.requestId,
+        resourceId: resource.id
+      });
+    }
+    const replayKey = verification.replayKey;
+    const hold = await authorizeAndReserve(
+      request,
+      resource,
+      authProviders,
+      requirement,
+      validInput
+    );
+    try {
+      await options.store.reservePaymentAttempt({
+        requestId: request.requestId,
+        resourceId: resource.id,
+        provider: provider.name,
+        replayKey,
+        amount: verification.amount,
+        currency: verification.currency,
+        ...verification.payer !== void 0 ? { payer: verification.payer } : {},
+        ...verification.payee !== void 0 ? { payee: verification.payee } : {},
+        ...requirement.metadata?.[REUSE_REJECTED_AUTHORIZATION_METADATA_KEY] === true ? { reclaimRejected: true } : {}
+      });
+    } catch (error) {
+      const mapped = toCommerceError(
+        error,
+        "STORAGE_ERROR",
+        "Payment attempt could not be recorded"
+      );
+      await hold?.finalize("release");
+      await safeEmit(
+        buildEvent({
+          type: "payment.rejected",
+          requestId: request.requestId,
+          resourceId: resource.id,
+          adapter: request.protocol,
+          paymentProvider: provider.name,
+          status: "error",
+          data: { reason: mapped.code }
+        })
+      );
+      throw replayError(mapped, requirement);
+    }
+    await safeEmit(
+      buildEvent({
+        type: "payment.verified",
+        requestId: request.requestId,
+        resourceId: resource.id,
+        adapter: request.protocol,
+        paymentProvider: provider.name,
+        status: "ok"
+      })
+    );
+    return {
+      kind: "admitted",
+      settleArgs: {
+        request,
+        resource,
+        provider,
+        requirement,
+        payment,
+        verification,
+        replayKey,
+        hold
+      }
+    };
+  };
+}
+function pickProvider(providers, methods) {
+  for (const method of methods) {
+    const found = providers.find((provider) => provider.name === method);
+    if (found) return found;
+  }
+  return void 0;
+}
+
+// src/core/execution/pipeline/context.ts
+function createPipelineContext(options) {
+  async function safeEmit(event) {
+    try {
+      await options.events.emit(event);
+    } catch (error) {
+      options.logger.error(
+        { err: describeError(error), eventType: event.type, requestId: event.requestId },
+        "Event sink failed; commerce flow continues"
+      );
+    }
+  }
+  async function safePersist(op, label, requestId) {
+    try {
+      await op();
+    } catch (error) {
+      options.logger.error(
+        { err: describeError(error), requestId },
+        `Persistence failed: ${label}`
+      );
+    }
+  }
+  function buildEvent(partial) {
+    return { id: options.ids.next("evt"), at: options.clock.nowIso(), ...partial };
+  }
+  return { options, safeEmit, safePersist, buildEvent };
+}
+
+// src/core/execution/pipeline/settlement.ts
+function createSettlement(ctx) {
+  const { options, safeEmit, safePersist, buildEvent } = ctx;
+  async function settle(args) {
+    const { request, resource, provider, requirement, payment, verification, replayKey, hold } = args;
+    let settlement;
+    try {
+      settlement = await provider.settle({
+        requestId: request.requestId,
+        resource,
+        requirement,
+        submission: payment,
+        verification
+      });
+    } catch (error) {
+      const notSubmitted = notSubmittedReason(error);
+      if (notSubmitted !== void 0) {
+        await hold?.finalize("release");
+        await safePersist(
+          () => options.store.updatePaymentAttempt({
+            replayKey,
+            status: "rejected",
+            rejectionReason: notSubmitted
+          }),
+          "updatePaymentAttempt(not-submitted)",
+          request.requestId
+        );
+        await safeEmit(
+          buildEvent({
+            type: "payment.rejected",
+            requestId: request.requestId,
+            resourceId: resource.id,
+            adapter: request.protocol,
+            paymentProvider: provider.name,
+            status: "error",
+            data: { reason: "settlement-not-submitted", providerReason: notSubmitted }
+          })
+        );
+        throw new CommerceError(
+          "PAYMENT_PROVIDER_UNAVAILABLE",
+          "The payment provider could not settle the payment; nothing was charged",
+          { requestId: request.requestId, resourceId: resource.id, cause: error }
+        );
+      }
+      const txHash = settlementTxHash(error);
+      await hold?.finalize("markUncertain");
+      await safePersist(
+        () => options.store.updatePaymentAttempt({
+          replayKey,
+          status: "settlement-uncertain",
+          ...txHash !== void 0 ? { externalReference: txHash } : {},
+          ...error instanceof Error ? { rejectionReason: error.message } : {}
+        }),
+        "updatePaymentAttempt(settlement-uncertain)",
+        request.requestId
+      );
+      await safeEmit(
+        buildEvent({
+          type: "payment.rejected",
+          requestId: request.requestId,
+          resourceId: resource.id,
+          adapter: request.protocol,
+          paymentProvider: provider.name,
+          status: "error",
+          data: {
+            reason: "settlement-uncertain",
+            ...txHash !== void 0 ? { transactionHash: txHash } : {}
+          }
+        })
+      );
+      throw new CommerceError("PAYMENT_SETTLEMENT_FAILED", "Settlement could not be confirmed", {
+        requestId: request.requestId,
+        resourceId: resource.id,
+        cause: error,
+        details: {
+          settlementUncertain: true,
+          ...txHash !== void 0 ? { transactionHash: txHash } : {},
+          ...settlementParties(requirement, verification)
+        }
+      });
+    }
+    if (settlement.status !== "settled") {
+      await hold?.finalize("release");
+      await safePersist(
+        () => options.store.updatePaymentAttempt({
+          replayKey,
+          status: "rejected",
+          ...settlement.rejectionReason !== void 0 ? { rejectionReason: settlement.rejectionReason } : {},
+          ...settlement.externalReference !== void 0 ? { externalReference: settlement.externalReference } : {}
+        }),
+        "updatePaymentAttempt(rejected)",
+        request.requestId
+      );
+      await safeEmit(
+        buildEvent({
+          type: "payment.rejected",
+          requestId: request.requestId,
+          resourceId: resource.id,
+          adapter: request.protocol,
+          paymentProvider: provider.name,
+          status: "error",
+          data: settlement.rejectionReason ? { reason: settlement.rejectionReason } : {}
+        })
+      );
+      const rejectionDetails = retryChallenge(requirement, settlement.rejectionReason).details;
+      throw new CommerceError(
+        "PAYMENT_SETTLEMENT_FAILED",
+        settlement.rejectionReason ?? "Settlement was rejected",
+        {
+          requestId: request.requestId,
+          resourceId: resource.id,
+          httpStatus: 402,
+          details: {
+            ...rejectionDetails,
+            ...settlementParties(requirement, settlement, verification)
+          }
+        }
+      );
+    }
+    await hold?.finalize("consume");
+    await safePersist(
+      () => options.store.updatePaymentAttempt({
+        replayKey,
+        status: "settled",
+        ...settlement.externalReference !== void 0 ? { externalReference: settlement.externalReference } : {}
+      }),
+      "updatePaymentAttempt(settled)",
+      request.requestId
+    );
+    await safeEmit(
+      buildEvent({
+        type: "payment.settled",
+        requestId: request.requestId,
+        resourceId: resource.id,
+        adapter: request.protocol,
+        paymentProvider: provider.name,
+        status: "ok"
+      })
+    );
+    return settlement;
+  }
+  async function abandonSettlement(args, backendErrorCode) {
+    const { request, resource, provider, replayKey, hold } = args;
+    await hold?.finalize("release");
+    await safePersist(
+      () => options.store.updatePaymentAttempt({
+        replayKey,
+        status: "rejected",
+        rejectionReason: "backend_failed"
+      }),
+      "updatePaymentAttempt(backend-failed)",
+      request.requestId
+    );
+    await safeEmit(
+      buildEvent({
+        type: "payment.rejected",
+        requestId: request.requestId,
+        resourceId: resource.id,
+        adapter: request.protocol,
+        paymentProvider: provider.name,
+        status: "error",
+        data: { reason: "backend-failed", backendErrorCode }
+      })
+    );
+  }
+  return { settle, abandonSettlement };
+}
+function notSubmittedReason(error) {
+  if (!isCommerceError(error) || error.details?.["settlementNotSubmitted"] !== true) {
+    return void 0;
+  }
+  const reason = error.details["reason"];
+  return typeof reason === "string" ? reason : "settlement_not_submitted";
+}
+function settlementTxHash(error) {
+  const hash = isCommerceError(error) ? error.details?.["transactionHash"] : void 0;
+  return typeof hash === "string" ? hash : void 0;
+}
+function settlementParties(requirement, ...results) {
+  const network = results.find((r) => r.network !== void 0)?.network ?? requirement.network;
+  const payer = results.find((r) => r.payer !== void 0)?.payer;
+  return {
+    ...network !== void 0 ? { network } : {},
+    ...payer !== void 0 ? { payer } : {}
+  };
+}
+
+// src/core/execution/pipeline/index.ts
+function createExecutionPipeline(options) {
+  const validators = /* @__PURE__ */ new Map();
+  function getValidator(resource) {
+    const cached = validators.get(resource.id);
+    if (cached) return cached;
+    const compiled = compileJsonSchema(resource.inputSchema);
+    validators.set(resource.id, compiled);
+    return compiled;
+  }
+  const ctx = createPipelineContext(options);
+  const { safeEmit, safePersist, buildEvent } = ctx;
+  const { settle, abandonSettlement } = createSettlement(ctx);
+  const admitPayment = createPaymentAdmission(ctx, createAuthorizeAndReserve(ctx));
+  async function execute(request) {
+    const pipelineStart = options.clock.monotonicMs();
+    const resource = options.resources.get(request.resourceId);
+    if (!resource?.exposedVia.includes(request.protocol)) {
+      throw new CommerceError(
+        "RESOURCE_NOT_FOUND",
+        `Resource "${request.resourceId}" was not found`,
+        {
+          requestId: request.requestId,
+          resourceId: request.resourceId
+        }
+      );
+    }
+    await safeEmit(
+      buildEvent({
+        type: "resource.requested",
+        requestId: request.requestId,
+        resourceId: resource.id,
+        adapter: request.protocol
+      })
+    );
+    const strippedInput = stripReservedFields(request.input);
+    const validation = getValidator(resource)(strippedInput);
+    if (!validation.valid) {
+      throw new CommerceError(
+        "INPUT_INVALID",
+        `Input for resource "${resource.id}" failed validation`,
+        {
+          requestId: request.requestId,
+          resourceId: resource.id,
+          details: { errors: validation.errors }
+        }
+      );
+    }
+    const validInput = validation.value;
+    validateBackendRequestShape(
+      resource.handler,
+      validInput,
+      { requestId: request.requestId, resourceId: resource.id },
+      request.backendHeaders
+    );
+    if (resource.pricing.type === "dynamic") {
+      throw new CommerceError(
+        "CONFIG_INVALID",
+        `Resource "${resource.id}" uses unsupported dynamic pricing`,
+        {
+          requestId: request.requestId,
+          resourceId: resource.id
+        }
+      );
+    }
+    if (resource.pricing.type !== "fixed" && (resource.authorization?.required.length ?? 0) > 0) {
+      throw new CommerceError(
+        "CONFIG_INVALID",
+        `Resource "${resource.id}" requires authorization but is not a paid resource`,
+        {
+          requestId: request.requestId,
+          resourceId: resource.id
+        }
+      );
+    }
+    let paymentResult;
+    let authorization;
+    let deferredSettlement;
+    if (resource.pricing.type === "fixed") {
+      const admission = await admitPayment(request, resource, resource.pricing, validInput);
+      if (admission.kind === "payment-required") return admission;
+      const { settleArgs } = admission;
+      authorization = settleArgs.hold?.record;
+      if (settleArgs.requirement.metadata?.[SETTLE_AFTER_BACKEND_METADATA_KEY] === true) {
+        deferredSettlement = settleArgs;
+      } else {
+        paymentResult = await settle(settleArgs);
+      }
+    }
+    const backendStart = options.clock.monotonicMs();
+    let backendResponse;
+    try {
+      backendResponse = await options.backend.call(resource.handler, {
+        requestId: request.requestId,
+        resourceId: resource.id,
+        input: validInput,
+        ...request.idempotencyKey !== void 0 ? { idempotencyKey: request.idempotencyKey } : {},
+        ...request.backendHeaders !== void 0 ? { backendHeaders: request.backendHeaders } : {}
+      });
+    } catch (error) {
+      const commerceError = toCommerceError(error, "BACKEND_ERROR", "Backend call failed");
+      await safeEmit(
+        buildEvent({
+          type: "backend.failed",
+          requestId: request.requestId,
+          resourceId: resource.id,
+          adapter: request.protocol,
+          status: "error",
+          durationMs: Math.round(options.clock.monotonicMs() - backendStart),
+          data: { code: commerceError.code }
+        })
+      );
+      if (deferredSettlement !== void 0) {
+        await abandonSettlement(deferredSettlement, commerceError.code);
+        throw commerceError;
+      }
+      if (paymentResult !== void 0) {
+        const failedReceipt = {
+          id: options.ids.next("receipt"),
+          requestId: request.requestId,
+          resourceId: resource.id,
+          deliveredAt: options.clock.nowIso(),
+          backendStatus: backendErrorStatus(commerceError),
+          protocol: request.protocol,
+          payment: paymentResult,
+          ...authorization !== void 0 ? { authorization } : {},
+          metadata: { delivered: false, backendErrorCode: commerceError.code }
+        };
+        await safePersist(
+          () => options.store.saveReceipt(failedReceipt),
+          "saveReceipt(backend-failed-after-settlement)",
+          request.requestId
+        );
+        throw new CommerceError(
+          "BACKEND_ERROR",
+          "Payment settled but the backend call failed; the payment was not refunded automatically",
+          {
+            requestId: request.requestId,
+            resourceId: resource.id,
+            cause: commerceError,
+            details: {
+              payment: {
+                status: paymentResult.status,
+                provider: paymentResult.provider,
+                amount: paymentResult.amount,
+                currency: paymentResult.currency,
+                ...paymentResult.network !== void 0 ? { network: paymentResult.network } : {},
+                ...paymentResult.externalReference !== void 0 ? { externalReference: paymentResult.externalReference } : {},
+                ...paymentResult.payer !== void 0 ? { payer: paymentResult.payer } : {},
+                ...typeof paymentResult.metadata?.["amountBaseUnits"] === "string" ? { amountBaseUnits: paymentResult.metadata["amountBaseUnits"] } : {},
+                ...typeof paymentResult.metadata?.["receipt"] === "string" ? { receipt: paymentResult.metadata["receipt"] } : {}
+              }
+            }
+          }
+        );
+      }
+      throw commerceError;
+    }
+    await safeEmit(
+      buildEvent({
+        type: "backend.called",
+        requestId: request.requestId,
+        resourceId: resource.id,
+        adapter: request.protocol,
+        status: "ok",
+        durationMs: backendResponse.durationMs,
+        data: { status: backendResponse.status }
+      })
+    );
+    if (deferredSettlement !== void 0) {
+      paymentResult = await settle(deferredSettlement);
+    }
+    const receipt = {
+      id: options.ids.next("receipt"),
+      requestId: request.requestId,
+      resourceId: resource.id,
+      deliveredAt: options.clock.nowIso(),
+      backendStatus: backendResponse.status,
+      durationMs: backendResponse.durationMs,
+      protocol: request.protocol,
+      ...paymentResult !== void 0 ? { payment: paymentResult } : {},
+      ...authorization !== void 0 ? { authorization } : {}
+    };
+    await safePersist(() => options.store.saveReceipt(receipt), "saveReceipt", request.requestId);
+    const totalDurationMs = Math.round(options.clock.monotonicMs() - pipelineStart);
+    await safeEmit(
+      buildEvent({
+        type: "resource.delivered",
+        requestId: request.requestId,
+        resourceId: resource.id,
+        adapter: request.protocol,
+        status: "ok",
+        durationMs: totalDurationMs
+      })
+    );
+    return {
+      kind: "delivered",
+      requestId: request.requestId,
+      resourceId: resource.id,
+      backendStatus: backendResponse.status,
+      body: backendResponse.body,
+      headers: backendResponse.headers,
+      ...paymentResult !== void 0 ? { payment: paymentResult } : {},
+      receipt,
+      durationMs: totalDurationMs
+    };
+  }
+  return { execute };
+}
+function backendErrorStatus(error) {
+  const status = error.details?.["status"];
+  return typeof status === "number" ? status : 0;
+}
+var RESERVED_INPUT_KEYS = [...RESERVED_INPUT_FIELDS, "__proto__"];
+function stripReservedFields(input) {
+  if (!isRecord(input)) return input;
+  if (!RESERVED_INPUT_KEYS.some((key) => Object.hasOwn(input, key))) return input;
+  const rest = {};
+  for (const key of Object.keys(input)) {
+    if (!RESERVED_INPUT_KEYS.includes(key)) rest[key] = input[key];
+  }
+  return rest;
+}
+
+// src/core/execution/registry.ts
+var ResourceRegistryImpl = class {
+  byId = /* @__PURE__ */ new Map();
+  ordered;
+  constructor(resources) {
+    for (const resource of resources) {
+      if (this.byId.has(resource.id)) {
+        throw new CommerceError("CONFIG_INVALID", `Duplicate resource id "${resource.id}"`, {
+          details: { resourceId: resource.id }
+        });
+      }
+      this.byId.set(resource.id, resource);
+    }
+    this.ordered = [...resources];
+  }
+  get(id) {
+    return this.byId.get(id);
+  }
+  list() {
+    return this.ordered;
+  }
+  listExposedVia(protocol) {
+    return this.ordered.filter((resource) => resource.exposedVia.includes(protocol));
+  }
+  has(id) {
+    return this.byId.has(id);
+  }
+};
+function createResourceRegistry(resources) {
+  return new ResourceRegistryImpl(resources);
+}
+
+// src/core/execution/store-event-sink.ts
+function createStoreEventSink(options) {
+  return {
+    async emit(event) {
+      try {
+        await options.store.appendEvent(event);
+      } catch (error) {
+        options.logger.error(
+          { err: describeError(error), eventType: event.type, requestId: event.requestId },
+          "Failed to persist commerce event"
+        );
+      }
+    }
+  };
+}
+
+// src/protocols/acp/constants.ts
+var ACP_SPEC_VERSION = "2026-04-17";
+var ACP_API_VERSION = "2026-04-17";
+var ACP_WELL_KNOWN_PATH = "/.well-known/acp.json";
+var ACP_CHECKOUT_OPERATIONS = [
+  "createCheckoutSession",
+  "updateCheckoutSession",
+  "getCheckoutSession",
+  "completeCheckoutSession",
+  "cancelCheckoutSession"
+];
+var ACP_OPERATION_INPUT_KEYS = {
+  createCheckoutSession: ["body"],
+  updateCheckoutSession: ["path", "body"],
+  getCheckoutSession: ["path"],
+  completeCheckoutSession: ["path", "body"],
+  cancelCheckoutSession: ["path"]
+};
+var ACP_OPERATION_OPTIONAL_INPUT_KEYS = {
+  cancelCheckoutSession: ["body"]
+};
+var ACP_SESSION_ID_INPUT_KEY = "checkout_session_id";
+var ACP_JSON_MEDIA_TYPE = "application/json";
+var ACP_API_VERSION_HEADER = "api-version";
+var ACP_REQUEST_ID_HEADER = "request-id";
+var ACP_IDEMPOTENCY_KEY_HEADER = "idempotency-key";
+var ACP_IDEMPOTENT_REPLAYED_HEADER = "idempotent-replayed";
+var ACP_IN_FLIGHT_RETRY_AFTER_SECONDS = 1;
+var ACP_MAX_REQUEST_ID_LENGTH = 128;
+var ACP_FORWARDED_HEADERS = [
+  "accept-language",
+  "user-agent",
+  ACP_REQUEST_ID_HEADER,
+  ACP_API_VERSION_HEADER,
+  "signature",
+  "timestamp"
+];
+var ACP_MAX_FORWARDED_HEADER_LENGTH = 2048;
+var ACP_MERCHANT_RETRY_AFTER_DEFAULT_SECONDS = 5;
+var ACP_MERCHANT_RETRY_AFTER_MAX_SECONDS = 300;
+
+export { ACP_API_VERSION, ACP_API_VERSION_HEADER, ACP_CHECKOUT_OPERATIONS, ACP_FORWARDED_HEADERS, ACP_IDEMPOTENCY_KEY_HEADER, ACP_IDEMPOTENT_REPLAYED_HEADER, ACP_IN_FLIGHT_RETRY_AFTER_SECONDS, ACP_JSON_MEDIA_TYPE, ACP_MAX_FORWARDED_HEADER_LENGTH, ACP_MAX_REQUEST_ID_LENGTH, ACP_MERCHANT_RETRY_AFTER_DEFAULT_SECONDS, ACP_MERCHANT_RETRY_AFTER_MAX_SECONDS, ACP_OPERATION_INPUT_KEYS, ACP_OPERATION_OPTIONAL_INPUT_KEYS, ACP_REQUEST_ID_HEADER, ACP_SESSION_ID_INPUT_KEY, ACP_SPEC_VERSION, ACP_WELL_KNOWN_PATH, BackendErrorResponse, DEFAULT_CONFIG_FILENAME, HttpBackendExecutor, createExecutionPipeline, createResourceRegistry, createStoreEventSink, extractPathParameterNames, findUnparsedBraceToken, isObjectSchemaNode };
+//# sourceMappingURL=chunk-2ZZOGI5I.js.map
+//# sourceMappingURL=chunk-2ZZOGI5I.js.map