@devlab.group/agent-commerce 2.4.1 → 2.5.0

package/dist/cli/{chunk-GJIMDMYT.js → chunk-QLUCNPRT.js}

@@ -1,7 +1,7 @@
-import { ACP_CHECKOUT_OPERATIONS, ACP_SPEC_VERSION } from './chunk-PIMFPCNZ.js';
-import { openSqliteDatabase } from './chunk-3MGAJ5FX.js';
-import { PACKAGE_VERSION } from './chunk-ITWNSS2B.js';
-import { NOOP_LOGGER, systemClock, toCommerceError, CommerceError } from './chunk-QQ3WY5L3.js';
+import { openSqliteDatabase } from './chunk-VJ4EO4LE.js';
+import { PACKAGE_VERSION } from './chunk-M7NXVRU5.js';
+import { NOOP_LOGGER, systemClock, transactionState } from './chunk-IDY2735M.js';
+import { toCommerceError, CommerceError } from './chunk-SYQLJXIU.js';
 import { randomUUID } from 'crypto';
 import { accessSync, constants } from 'fs';
 
@@ -40,7 +40,8 @@ function receiptToRow(receipt) {
     duration_ms: receipt.durationMs ?? null,
     protocol: receipt.protocol ?? null,
     metadata_json: receipt.metadata !== void 0 ? JSON.stringify(redact(receipt.metadata)) : null,
-    authorization_json: receipt.authorization !== void 0 ? JSON.stringify(redact(receipt.authorization)) : null
+    authorization_json: receipt.authorization !== void 0 ? JSON.stringify(redact(receipt.authorization)) : null,
+    transaction_id: receipt.transactionId ?? null
   };
 }
 function rowToReceipt(row) {
@@ -57,7 +58,8 @@ function rowToReceipt(row) {
     ...row.duration_ms !== null ? { durationMs: row.duration_ms } : {},
     ...row.protocol !== null ? { protocol: row.protocol } : {},
     ...metadata !== void 0 ? { metadata } : {},
-    ...authorization !== void 0 ? { authorization } : {}
+    ...authorization !== void 0 ? { authorization } : {},
+    ...row.transaction_id !== null ? { transactionId: row.transaction_id } : {}
   };
 }
 function eventToRow(event) {
@@ -71,7 +73,8 @@ function eventToRow(event) {
     payment_provider: event.paymentProvider ?? null,
     duration_ms: event.durationMs ?? null,
     status: event.status ?? null,
-    data_json: event.data !== void 0 ? JSON.stringify(redact(event.data)) : null
+    data_json: event.data !== void 0 ? JSON.stringify(redact(event.data)) : null,
+    transaction_id: event.transactionId ?? null
   };
 }
 function rowToEvent(row) {
@@ -86,7 +89,8 @@ function rowToEvent(row) {
     ...row.payment_provider !== null ? { paymentProvider: row.payment_provider } : {},
     ...row.duration_ms !== null ? { durationMs: row.duration_ms } : {},
     ...row.status !== null ? { status: row.status } : {},
-    ...data !== void 0 ? { data } : {}
+    ...data !== void 0 ? { data } : {},
+    ...row.transaction_id !== null ? { transactionId: row.transaction_id } : {}
   };
 }
 function rowToPaymentAttempt(row) {
@@ -104,7 +108,61 @@ function rowToPaymentAttempt(row) {
     ...row.external_reference !== null ? { externalReference: row.external_reference } : {},
     ...row.rejection_reason !== null ? { rejectionReason: row.rejection_reason } : {},
     createdAt: row.created_at,
-    updatedAt: row.updated_at
+    updatedAt: row.updated_at,
+    ...row.transaction_id !== null ? { transactionId: row.transaction_id } : {},
+    ...row.resolution_json !== null ? { resolution: JSON.parse(row.resolution_json) } : {}
+  };
+}
+function rowToTransaction(row, now) {
+  const status = row.payment_status;
+  const backend = row.backend_dispatched_at !== null && row.backend_deadline_at !== null ? {
+    dispatchedAt: row.backend_dispatched_at,
+    deadlineAt: row.backend_deadline_at,
+    ...row.backend_status !== null ? { status: row.backend_status } : {},
+    ...row.backend_error_code !== null ? { errorCode: row.backend_error_code } : {}
+  } : void 0;
+  const completedAt = row.completed_at ?? void 0;
+  const authorization = row.authorization_json !== null && row.reservation_id !== null ? {
+    ...JSON.parse(row.authorization_json),
+    reservationId: row.reservation_id
+  } : void 0;
+  return {
+    id: row.id,
+    requestId: row.request_id,
+    resourceId: row.resource_id,
+    protocol: row.protocol,
+    state: transactionState(
+      {
+        payment: { status },
+        ...backend !== void 0 ? { backend } : {},
+        ...completedAt !== void 0 ? { completedAt } : {}
+      },
+      now
+    ),
+    payment: {
+      provider: row.provider,
+      attemptId: row.attempt_id,
+      replayKey: row.replay_key,
+      status,
+      amount: row.payment_amount,
+      currency: row.payment_currency,
+      ...row.network !== null ? { network: row.network } : {},
+      ...row.asset !== null ? { asset: row.asset } : {},
+      ...row.payment_payee !== null ? { payee: row.payment_payee } : {},
+      ...row.payment_external_reference !== null ? { externalReference: row.payment_external_reference } : {},
+      ...row.locator_json !== null ? { locator: JSON.parse(row.locator_json) } : {},
+      ...row.settling_at !== null ? { settlingAt: row.settling_at } : {},
+      ...row.expires_at !== null ? { expiresAt: row.expires_at } : {}
+    },
+    ...authorization !== void 0 ? { authorization } : {},
+    ...backend !== void 0 ? { backend } : {},
+    ...row.receipt_id !== null ? { receiptId: row.receipt_id } : {},
+    ...row.input_digest !== null ? { inputDigest: row.input_digest } : {},
+    configDigest: row.config_digest,
+    ...row.persistence_failures_json !== null ? { persistenceFailures: JSON.parse(row.persistence_failures_json) } : {},
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+    ...completedAt !== void 0 ? { completedAt } : {}
   };
 }
 
@@ -199,13 +257,60 @@ var MIGRATIONS = [
         CREATE INDEX IF NOT EXISTS idx_payment_attempt_history_request_id ON payment_attempt_history(request_id);
       `);
     }
+  },
+  {
+    version: 4,
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS transactions (
+          seq                        INTEGER PRIMARY KEY AUTOINCREMENT,
+          id                         TEXT NOT NULL UNIQUE,
+          request_id                 TEXT NOT NULL,
+          resource_id                TEXT NOT NULL,
+          protocol                   TEXT NOT NULL,
+          state                      TEXT NOT NULL,
+          provider                   TEXT NOT NULL,
+          attempt_id                 TEXT NOT NULL,
+          replay_key                 TEXT NOT NULL,
+          network                    TEXT,
+          asset                      TEXT,
+          authorization_json         TEXT,
+          reservation_id             TEXT,
+          locator_json               TEXT,
+          expires_at                 TEXT,
+          input_digest               TEXT,
+          config_digest              TEXT NOT NULL,
+          settling_at                TEXT,
+          backend_dispatched_at      TEXT,
+          backend_deadline_at        TEXT,
+          backend_status             INTEGER,
+          backend_error_code         TEXT,
+          receipt_id                 TEXT,
+          persistence_failures_json  TEXT,
+          completed_at               TEXT,
+          created_at                 TEXT NOT NULL,
+          updated_at                 TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_transactions_state_seq ON transactions(state, seq);
+        CREATE INDEX IF NOT EXISTS idx_transactions_request_id ON transactions(request_id);
+        CREATE INDEX IF NOT EXISTS idx_transactions_replay_key ON transactions(replay_key);
+
+        ALTER TABLE receipts ADD COLUMN transaction_id TEXT;
+        ALTER TABLE events ADD COLUMN transaction_id TEXT;
+        ALTER TABLE payment_attempts ADD COLUMN transaction_id TEXT;
+        ALTER TABLE payment_attempts ADD COLUMN resolution_json TEXT;
+        ALTER TABLE payment_attempt_history ADD COLUMN transaction_id TEXT;
+        ALTER TABLE payment_attempt_history ADD COLUMN resolution_json TEXT;
+        CREATE INDEX IF NOT EXISTS idx_payment_attempt_history_id ON payment_attempt_history(id);
+      `);
+    }
   }
 ];
 var SCHEMA_VERSION = MIGRATIONS.at(-1)?.version ?? 0;
-function migrate(db) {
+function migrate(db, target = SCHEMA_VERSION) {
   const current = db.pragma("user_version", { simple: true });
   for (const migration of MIGRATIONS) {
-    if (migration.version <= current) continue;
+    if (migration.version <= current || migration.version > target) continue;
     const apply = db.transaction(() => {
       migration.up(db);
       db.pragma(`user_version = ${migration.version}`);
@@ -223,6 +328,22 @@ function clampListLimit(limit) {
 }
 var UNDELIVERED = "backend_status NOT BETWEEN 200 AND 299";
 var UNCERTAIN = "status IN ('settlement-uncertain', 'failed')";
+var TRANSACTION_SELECT = `
+  SELECT t.*,
+    COALESCE(a.status, h.status) AS payment_status,
+    COALESCE(a.amount, h.amount) AS payment_amount,
+    COALESCE(a.currency, h.currency) AS payment_currency,
+    COALESCE(a.payee, h.payee) AS payment_payee,
+    COALESCE(a.external_reference, h.external_reference) AS payment_external_reference
+  FROM transactions t
+  LEFT JOIN payment_attempts a ON a.id = t.attempt_id
+  LEFT JOIN payment_attempt_history h ON a.id IS NULL AND h.seq = (
+    SELECT MAX(seq) FROM payment_attempt_history
+    WHERE replay_key = t.replay_key AND id = t.attempt_id
+  )`;
+var TIME_DEPENDENT = "t.backend_deadline_at IS NOT NULL AND t.completed_at IS NULL";
+var RESOLVED_STATES = ["delivered", "payment-failed"];
+var CURSOR_PATTERN = /^[1-9][0-9]{0,15}$/;
 var defaultIds = {
   next: (prefix) => prefix !== void 0 ? `${prefix}_${randomUUID()}` : randomUUID()
 };
@@ -238,8 +359,8 @@ function createSqliteReceiptStore(options) {
   const db = openSqliteDatabase({ path, label: "Receipt database", logger });
   migrate(db);
   const insertReceiptStmt = db.prepare(
-    `INSERT INTO receipts (id, request_id, resource_id, payment_json, delivered_at, backend_status, duration_ms, protocol, metadata_json, authorization_json)
-     VALUES (@id, @request_id, @resource_id, @payment_json, @delivered_at, @backend_status, @duration_ms, @protocol, @metadata_json, @authorization_json)`
+    `INSERT INTO receipts (id, request_id, resource_id, payment_json, delivered_at, backend_status, duration_ms, protocol, metadata_json, authorization_json, transaction_id)
+     VALUES (@id, @request_id, @resource_id, @payment_json, @delivered_at, @backend_status, @duration_ms, @protocol, @metadata_json, @authorization_json, @transaction_id)`
   );
   const getReceiptStmt = db.prepare("SELECT * FROM receipts WHERE id = ?");
   const listReceiptsStmt = db.prepare(
@@ -261,8 +382,8 @@ function createSqliteReceiptStore(options) {
     `SELECT COUNT(*) AS count FROM receipts WHERE ${UNDELIVERED}`
   );
   const insertEventStmt = db.prepare(
-    `INSERT INTO events (id, type, request_id, resource_id, at, adapter, payment_provider, duration_ms, status, data_json)
-     VALUES (@id, @type, @request_id, @resource_id, @at, @adapter, @payment_provider, @duration_ms, @status, @data_json)`
+    `INSERT INTO events (id, type, request_id, resource_id, at, adapter, payment_provider, duration_ms, status, data_json, transaction_id)
+     VALUES (@id, @type, @request_id, @resource_id, @at, @adapter, @payment_provider, @duration_ms, @status, @data_json, @transaction_id)`
   );
   const listEventsStmt = db.prepare(
     "SELECT * FROM events ORDER BY at DESC, seq DESC LIMIT ?"
@@ -271,13 +392,13 @@ function createSqliteReceiptStore(options) {
     "SELECT * FROM events WHERE request_id = ? ORDER BY at DESC, seq DESC LIMIT ?"
   );
   const insertPaymentAttemptStmt = db.prepare(
-    `INSERT INTO payment_attempts (id, request_id, resource_id, provider, replay_key, status, amount, currency, payer, payee, external_reference, rejection_reason, created_at, updated_at)
-     VALUES (@id, @request_id, @resource_id, @provider, @replay_key, @status, @amount, @currency, @payer, @payee, @external_reference, @rejection_reason, @created_at, @updated_at)
+    `INSERT INTO payment_attempts (id, request_id, resource_id, provider, replay_key, status, amount, currency, payer, payee, external_reference, rejection_reason, created_at, updated_at, transaction_id)
+     VALUES (@id, @request_id, @resource_id, @provider, @replay_key, @status, @amount, @currency, @payer, @payee, @external_reference, @rejection_reason, @created_at, @updated_at, @transaction_id)
      RETURNING *`
   );
   const archiveRejectedAttemptStmt = db.prepare(
-    `INSERT INTO payment_attempt_history (id, request_id, resource_id, provider, replay_key, status, amount, currency, payer, payee, external_reference, rejection_reason, created_at, updated_at, superseded_at)
-     SELECT id, request_id, resource_id, provider, replay_key, status, amount, currency, payer, payee, external_reference, rejection_reason, created_at, updated_at, @created_at
+    `INSERT INTO payment_attempt_history (id, request_id, resource_id, provider, replay_key, status, amount, currency, payer, payee, external_reference, rejection_reason, created_at, updated_at, superseded_at, transaction_id, resolution_json)
+     SELECT id, request_id, resource_id, provider, replay_key, status, amount, currency, payer, payee, external_reference, rejection_reason, created_at, updated_at, @created_at, transaction_id, resolution_json
      FROM payment_attempts
      WHERE replay_key = @replay_key AND provider = @provider AND status = 'rejected'`
   );
@@ -285,7 +406,8 @@ function createSqliteReceiptStore(options) {
     `UPDATE payment_attempts SET id = @id, request_id = @request_id, resource_id = @resource_id,
        status = 'reserved', amount = @amount, currency = @currency,
        payer = @payer, payee = @payee, external_reference = NULL, rejection_reason = NULL,
-       created_at = @created_at, updated_at = @updated_at
+       created_at = @created_at, updated_at = @updated_at,
+       transaction_id = @transaction_id, resolution_json = NULL
      WHERE replay_key = @replay_key AND provider = @provider AND status = 'rejected'
      RETURNING *`
   );
@@ -294,7 +416,7 @@ function createSqliteReceiptStore(options) {
        external_reference = COALESCE(@external_reference, external_reference),
        rejection_reason = COALESCE(@rejection_reason, rejection_reason),
        updated_at = @updated_at
-     WHERE replay_key = @replay_key`
+     WHERE replay_key = @replay_key AND resolution_json IS NULL`
   );
   const listPaymentAttemptsStmt = db.prepare(
     "SELECT * FROM payment_attempts ORDER BY created_at DESC, seq DESC LIMIT ?"
@@ -311,13 +433,176 @@ function createSqliteReceiptStore(options) {
   const countUncertainPaymentAttemptsStmt = db.prepare(
     `SELECT COUNT(*) AS count FROM payment_attempts WHERE ${UNCERTAIN}`
   );
-  const paymentAttemptStatusStmt = db.prepare(
-    "SELECT status FROM payment_attempts WHERE replay_key = ?"
+  const paymentAttemptStatusStmt = db.prepare("SELECT id, status, resolution_json FROM payment_attempts WHERE replay_key = ?");
+  const insertTransactionStmt = db.prepare(
+    `INSERT INTO transactions (id, request_id, resource_id, protocol, state, provider, attempt_id, replay_key, network, asset, authorization_json, reservation_id, locator_json, expires_at, input_digest, config_digest, created_at, updated_at)
+     VALUES (@id, @request_id, @resource_id, @protocol, @state, @provider, @attempt_id, @replay_key, @network, @asset, @authorization_json, @reservation_id, @locator_json, @expires_at, @input_digest, @config_digest, @created_at, @created_at)`
+  );
+  const getTransactionStmt = db.prepare(
+    `${TRANSACTION_SELECT} WHERE t.id = ?`
+  );
+  const transactionsOfAttemptStmt = db.prepare(
+    `SELECT t.id FROM payment_attempts a
+     JOIN transactions t ON t.replay_key = a.replay_key AND t.attempt_id = a.id
+     WHERE a.replay_key = ?`
+  );
+  const transactionsOfAttemptIdStmt = db.prepare(
+    `SELECT t.id FROM payment_attempts a
+     JOIN transactions t ON t.replay_key = a.replay_key AND t.attempt_id = a.id
+     WHERE a.id = ?`
+  );
+  const setTransactionStateStmt = db.prepare("UPDATE transactions SET state = ? WHERE id = ?");
+  const stepStmts = {
+    settling: db.prepare(
+      "UPDATE transactions SET settling_at = @at, updated_at = @at WHERE id = @id"
+    ),
+    // A transaction without an authorization has no hold to record
+    hold: db.prepare(
+      `UPDATE transactions SET authorization_json = json_set(authorization_json, '$.hold', @hold), updated_at = @at
+       WHERE id = @id AND authorization_json IS NOT NULL`
+    ),
+    "backend-dispatched": db.prepare(
+      `UPDATE transactions SET backend_dispatched_at = @at, backend_deadline_at = @deadline_at, updated_at = @at
+       WHERE id = @id`
+    ),
+    // Preserve a backend result even when the dispatch step was not saved:
+    // use the result time for missing dispatch and deadline timestamps
+    "backend-result": db.prepare(
+      `UPDATE transactions SET backend_status = @status, backend_error_code = @error_code,
+         backend_dispatched_at = COALESCE(backend_dispatched_at, @at),
+         backend_deadline_at = COALESCE(backend_deadline_at, @at), updated_at = @at
+       WHERE id = @id`
+    ),
+    receipt: db.prepare(
+      "UPDATE transactions SET receipt_id = @receipt_id, updated_at = @at WHERE id = @id"
+    ),
+    completed: db.prepare(
+      `UPDATE transactions SET completed_at = @at, persistence_failures_json = @persistence_failures_json, updated_at = @at
+       WHERE id = @id`
+    )
+  };
+  const getPaymentAttemptStmt = db.prepare(
+    "SELECT * FROM payment_attempts WHERE id = ?"
+  );
+  const getArchivedPaymentAttemptStmt = db.prepare(
+    "SELECT * FROM payment_attempt_history WHERE id = ? ORDER BY seq DESC LIMIT 1"
+  );
+  const resolvePaymentAttemptStmt = db.prepare(
+    `UPDATE payment_attempts SET status = @status,
+       rejection_reason = COALESCE(@rejection_reason, rejection_reason),
+       external_reference = COALESCE(@external_reference, external_reference),
+       resolution_json = @resolution_json, updated_at = @updated_at
+     WHERE id = @id AND status = @expected_status AND resolution_json IS NULL`
+  );
+  function refreshTransactionState(id, now) {
+    const row = getTransactionStmt.get(id);
+    if (row !== void 0) setTransactionStateStmt.run(rowToTransaction(row, now).state, id);
+  }
+  const reserve = db.transaction(
+    (reservation, params) => {
+      let row;
+      if (reservation.reclaimRejected === true) {
+        archiveRejectedAttemptStmt.run(params);
+        row = reclaimPaymentAttemptStmt.get(params);
+      }
+      row ??= insertPaymentAttemptStmt.get({
+        ...params,
+        status: "reserved",
+        external_reference: null,
+        rejection_reason: null
+      });
+      const txn = reservation.transaction;
+      if (txn !== void 0) {
+        const { reservationId, ...authorization } = txn.authorization ?? {};
+        insertTransactionStmt.run({
+          id: txn.id,
+          request_id: reservation.requestId,
+          resource_id: reservation.resourceId,
+          protocol: txn.protocol,
+          state: transactionState({ payment: { status: "reserved" } }, row.created_at),
+          provider: reservation.provider,
+          attempt_id: row.id,
+          replay_key: reservation.replayKey,
+          network: txn.network ?? null,
+          asset: txn.asset ?? null,
+          authorization_json: reservationId !== void 0 ? JSON.stringify(redact({ ...authorization, hold: "reserved" })) : null,
+          reservation_id: reservationId ?? null,
+          locator_json: txn.locator !== void 0 ? JSON.stringify(redact(txn.locator)) : null,
+          expires_at: txn.expiresAt ?? null,
+          input_digest: txn.inputDigest ?? null,
+          config_digest: txn.configDigest,
+          created_at: row.created_at
+        });
+      }
+      return row;
+    }
   );
-  const reclaimRejectedAttempt = db.transaction(
-    (params) => {
-      archiveRejectedAttemptStmt.run(params);
-      return reclaimPaymentAttemptStmt.get(params);
+  const updateAttempt = db.transaction((update, now) => {
+    const { changes } = updatePaymentAttemptStmt.run({
+      replay_key: update.replayKey,
+      status: update.status,
+      external_reference: update.externalReference ?? null,
+      rejection_reason: update.rejectionReason ?? null,
+      updated_at: now
+    });
+    for (const { id } of transactionsOfAttemptStmt.all(update.replayKey)) {
+      refreshTransactionState(id, now);
+    }
+    return changes;
+  });
+  const recordStep = db.transaction((step) => {
+    const base = { id: step.transactionId, at: step.at };
+    let changes;
+    switch (step.kind) {
+      case "settling":
+        changes = stepStmts.settling.run(base).changes;
+        break;
+      case "hold":
+        changes = stepStmts.hold.run({ ...base, hold: step.hold }).changes;
+        break;
+      case "backend-dispatched":
+        changes = stepStmts["backend-dispatched"].run({
+          ...base,
+          deadline_at: step.deadlineAt
+        }).changes;
+        break;
+      case "backend-result":
+        changes = stepStmts["backend-result"].run({
+          ...base,
+          status: step.status,
+          error_code: step.errorCode ?? null
+        }).changes;
+        break;
+      case "receipt":
+        changes = stepStmts.receipt.run({ ...base, receipt_id: step.receiptId }).changes;
+        break;
+      case "completed":
+        changes = stepStmts.completed.run({
+          ...base,
+          persistence_failures_json: step.persistenceFailures !== void 0 && step.persistenceFailures.length > 0 ? JSON.stringify(step.persistenceFailures) : null
+        }).changes;
+        break;
+    }
+    if (changes > 0) refreshTransactionState(step.transactionId, step.at);
+    return changes;
+  });
+  const resolveAttempt = db.transaction(
+    (request, now) => {
+      const { changes } = resolvePaymentAttemptStmt.run({
+        id: request.attemptId,
+        expected_status: request.expectedStatus,
+        status: request.status,
+        rejection_reason: request.rejectionReason ?? null,
+        // An operator's reference is unverified; it stays in resolution_json only
+        external_reference: request.resolution.method === "reconcile" ? request.resolution.externalReference ?? null : null,
+        resolution_json: JSON.stringify(redact(request.resolution)),
+        updated_at: now
+      });
+      if (changes === 0) return false;
+      for (const { id } of transactionsOfAttemptIdStmt.all(request.attemptId)) {
+        refreshTransactionState(id, now);
+      }
+      return true;
     }
   );
   let closed = false;
@@ -326,7 +611,7 @@ function createSqliteReceiptStore(options) {
     kind: "storage",
     implementationVersion: PACKAGE_VERSION,
     supportedSpec: `sqlite-schema-v${SCHEMA_VERSION}`,
-    capabilities: ["receipts", "events", "payment-attempts"],
+    capabilities: ["receipts", "events", "payment-attempts", "transactions"],
     status: "stable"
   };
   const store = {
@@ -366,17 +651,12 @@ function createSqliteReceiptStore(options) {
         payer: reservation.payer ?? null,
         payee: reservation.payee ?? null,
         created_at: now,
-        updated_at: now
+        updated_at: now,
+        transaction_id: reservation.transaction?.id ?? null
       };
       let row;
       try {
-        row = (reservation.reclaimRejected === true ? reclaimRejectedAttempt.immediate(params) : void 0) ?? // RETURNING on a successful insert always yields the inserted row
-        insertPaymentAttemptStmt.get({
-          ...params,
-          status: "reserved",
-          external_reference: null,
-          rejection_reason: null
-        });
+        row = reserve.immediate(reservation, params);
       } catch (err) {
         if (isUniqueConstraintOn(err, "payment_attempts.replay_key")) {
           const existing = paymentAttemptStatusStmt.get(reservation.replayKey);
@@ -396,14 +676,23 @@ function createSqliteReceiptStore(options) {
     },
     async updatePaymentAttempt(update) {
       try {
-        const result = updatePaymentAttemptStmt.run({
-          replay_key: update.replayKey,
-          status: update.status,
-          external_reference: update.externalReference ?? null,
-          rejection_reason: update.rejectionReason ?? null,
-          updated_at: clock.nowIso()
-        });
-        if (result.changes === 0) {
+        if (updateAttempt(update, clock.nowIso()) === 0) {
+          const existing = paymentAttemptStatusStmt.get(update.replayKey);
+          if (existing?.resolution_json != null) {
+            logger.warn(
+              {
+                attemptId: existing.id,
+                resolvedStatus: existing.status,
+                status: update.status,
+                ...update.externalReference !== void 0 ? { externalReference: update.externalReference } : {}
+              },
+              "receipt-store: payment attempt already resolved; update not applied"
+            );
+            throw new CommerceError(
+              "STORAGE_ERROR",
+              `Payment attempt ${existing.id} is already resolved; the update was not applied`
+            );
+          }
           throw new CommerceError(
             "STORAGE_ERROR",
             `No payment attempt found for replayKey=${update.replayKey}`
@@ -455,6 +744,74 @@ function createSqliteReceiptStore(options) {
       const rows = listOptions.requestId !== void 0 ? (uncertain ? listUncertainPaymentAttemptsByRequestStmt : listPaymentAttemptsByRequestStmt).all(listOptions.requestId, limit) : (uncertain ? listUncertainPaymentAttemptsStmt : listPaymentAttemptsStmt).all(limit);
       return rows.map(rowToPaymentAttempt);
     },
+    async recordTransactionStep(step) {
+      try {
+        if (recordStep(step) === 0) {
+          throw new CommerceError(
+            "STORAGE_ERROR",
+            step.kind === "hold" ? `No transaction with an authorization hold found for transactionId=${step.transactionId}` : `No transaction found for transactionId=${step.transactionId}`
+          );
+        }
+      } catch (err) {
+        throw toCommerceError(err, "STORAGE_ERROR", "Failed to record transaction step");
+      }
+    },
+    async getTransaction(id) {
+      const row = getTransactionStmt.get(id);
+      return row !== void 0 ? rowToTransaction(row, clock.nowIso()) : void 0;
+    },
+    async listTransactions(listOptions = {}) {
+      const { cursor, state, unresolved, pendingHold, requestId } = listOptions;
+      if (cursor !== void 0 && !CURSOR_PATTERN.test(cursor)) {
+        throw new CommerceError("INPUT_INVALID", "Malformed transaction list cursor");
+      }
+      const limit = clampListLimit(listOptions.limit);
+      const where = [];
+      const params = [];
+      if (cursor !== void 0) {
+        where.push("t.seq < ?");
+        params.push(Number(cursor));
+      }
+      if (requestId !== void 0) {
+        where.push("t.request_id = ?");
+        params.push(requestId);
+      }
+      if (state !== void 0) {
+        where.push(`(t.state = ? OR (${TIME_DEPENDENT}))`);
+        params.push(state);
+      }
+      if (pendingHold === true) {
+        where.push("json_extract(t.authorization_json, '$.hold') IN ('reserved', 'uncertain')");
+      }
+      if (unresolved === true) {
+        where.push(`t.state NOT IN (${RESOLVED_STATES.map(() => "?").join(", ")})`);
+        params.push(...RESOLVED_STATES);
+      }
+      const rows = db.prepare(
+        `${TRANSACTION_SELECT}${where.length > 0 ? ` WHERE ${where.join(" AND ")}` : ""} ORDER BY t.seq DESC LIMIT ?`
+      ).all(...params, limit);
+      const now = clock.nowIso();
+      const resolved = RESOLVED_STATES;
+      const transactions = rows.map((row) => rowToTransaction(row, now)).filter(
+        (t) => (state === void 0 || t.state === state) && (unresolved !== true || !resolved.includes(t.state))
+      );
+      const last = rows.at(-1);
+      return {
+        transactions,
+        ...rows.length === limit && last !== void 0 ? { nextCursor: String(last.seq) } : {}
+      };
+    },
+    async getPaymentAttempt(id) {
+      const row = getPaymentAttemptStmt.get(id) ?? getArchivedPaymentAttemptStmt.get(id);
+      return row !== void 0 ? rowToPaymentAttempt(row) : void 0;
+    },
+    async resolvePaymentAttempt(request) {
+      try {
+        return resolveAttempt(request, clock.nowIso());
+      } catch (err) {
+        throw toCommerceError(err, "STORAGE_ERROR", "Failed to resolve payment attempt");
+      }
+    },
     descriptor,
     async health() {
       const startedAt = clock.monotonicMs();
@@ -520,120 +877,6 @@ function createSqliteReceiptStore(options) {
   return store;
 }
 
-// src/protocols/a2a/constants.ts
-var A2A_SPEC_VERSION = "1.0.1";
-var A2A_PROTOCOL_VERSION = "1.0";
-var A2A_PROTOCOL_BINDING = "JSONRPC";
-var A2A_AGENT_CARD_PATH = "/.well-known/agent-card.json";
-var A2A_DEFAULT_MOUNT_PATH = "/a2a";
-var A2A_JSON_MEDIA_TYPE = "application/json";
-var A2A_DEFAULT_AGENT_NAME = "agent-commerce";
-var A2A_VERSION_HEADER = "a2a-version";
-var A2A_METHOD_SEND_MESSAGE = "SendMessage";
-var A2A_PUSH_CONFIG_METHODS = [
-  "CreateTaskPushNotificationConfig",
-  "GetTaskPushNotificationConfig",
-  "ListTaskPushNotificationConfigs",
-  "DeleteTaskPushNotificationConfig"
-];
-var A2A_UNSUPPORTED_METHODS = [
-  "SendStreamingMessage",
-  "GetTask",
-  "ListTasks",
-  "CancelTask",
-  "SubscribeToTask",
-  ...A2A_PUSH_CONFIG_METHODS,
-  "GetExtendedAgentCard"
-];
-var A2A_TASK_LOOKUP_METHODS = ["GetTask", "CancelTask"];
-var A2A_TASK_STATE_COMPLETED = "TASK_STATE_COMPLETED";
-var A2A_TASK_STATE_FAILED = "TASK_STATE_FAILED";
-var A2A_TASK_STATE_INPUT_REQUIRED = "TASK_STATE_INPUT_REQUIRED";
-var A2A_EXTENSIONS_HEADER = "a2a-extensions";
-
-// src/protocols/a2a/descriptor.ts
-var A2A_CAPABILITIES = [
-  "agent-card",
-  "jsonrpc",
-  "SendMessage",
-  // The x402 A2A transport, opt-in per request
-  "x402-extension"
-];
-var A2A_UNSUPPORTED = [
-  // Methods, as the protocol names them; the transport refuses the same list
-  ...A2A_UNSUPPORTED_METHODS,
-  // Transports other than the one binding served
-  "HTTP+JSON/REST binding",
-  "gRPC binding",
-  // Behaviors
-  "SSE",
-  "long-running task persistence",
-  "task resumption other than an x402 extension payment",
-  "push notifications",
-  "multi-turn conversational continuation",
-  "authenticated extended agent cards",
-  "A2A authentication schemes",
-  "artifact types beyond Agent Commerce outcome data",
-  // Pending x402 payments live in process memory
-  "x402 extension payments across gateway restarts or instances"
-];
-function buildDescriptor(implementationVersion) {
-  return {
-    name: "a2a",
-    kind: "protocol",
-    implementationVersion,
-    supportedSpec: A2A_SPEC_VERSION,
-    capabilities: A2A_CAPABILITIES,
-    status: "experimental",
-    unsupported: A2A_UNSUPPORTED
-  };
-}
-
-// src/protocols/acp/descriptor.ts
-var ACP_CAPABILITIES = [
-  "rest transport",
-  "well-known discovery",
-  "bearer authentication",
-  "API-Version enforcement",
-  // Forwarded as received: the gateway verifies neither signature header
-  "request header forwarding to the merchant",
-  "checkout service",
-  ...ACP_CHECKOUT_OPERATIONS
-];
-var ACP_UNSUPPORTED = [
-  // Services this seller does not implement, named as ACP names them. The
-  // discovery document advertises `checkout` alone, and these are the reason.
-  "carts service",
-  "feed service",
-  "standalone orders service",
-  "delegate_payment",
-  "delegate_authentication",
-  // Bindings and delivery directions
-  "ACP MCP transport binding",
-  "webhooks",
-  "outbound merchant-to-agent delivery",
-  "ACP client role",
-  // Request authentication beyond the bearer token
-  "Signature header verification",
-  "Timestamp replay-window verification",
-  // Extensions, versioning and payment handlers
-  "discount extension",
-  "general ACP extension framework",
-  "multiple ACP API versions",
-  "seller-backed payment handler integration"
-];
-function buildDescriptor2(implementationVersion) {
-  return {
-    name: "acp",
-    kind: "protocol",
-    implementationVersion,
-    supportedSpec: ACP_SPEC_VERSION,
-    capabilities: ACP_CAPABILITIES,
-    status: "experimental",
-    unsupported: ACP_UNSUPPORTED
-  };
-}
-
-export { A2A_AGENT_CARD_PATH, A2A_DEFAULT_AGENT_NAME, A2A_DEFAULT_MOUNT_PATH, A2A_EXTENSIONS_HEADER, A2A_JSON_MEDIA_TYPE, A2A_METHOD_SEND_MESSAGE, A2A_PROTOCOL_BINDING, A2A_PROTOCOL_VERSION, A2A_PUSH_CONFIG_METHODS, A2A_SPEC_VERSION, A2A_TASK_LOOKUP_METHODS, A2A_TASK_STATE_COMPLETED, A2A_TASK_STATE_FAILED, A2A_TASK_STATE_INPUT_REQUIRED, A2A_UNSUPPORTED, A2A_UNSUPPORTED_METHODS, A2A_VERSION_HEADER, ACP_UNSUPPORTED, buildDescriptor, buildDescriptor2, createSqliteReceiptStore };
-//# sourceMappingURL=chunk-GJIMDMYT.js.map
-//# sourceMappingURL=chunk-GJIMDMYT.js.map
+export { createSqliteReceiptStore };
+//# sourceMappingURL=chunk-QLUCNPRT.js.map
+//# sourceMappingURL=chunk-QLUCNPRT.js.map