@funnelfox/billing 0.8.0-ffb-631.40 → 0.8.0-ffb-704.42

package/dist/chunk-index.cjs.js

@@ -561,7 +561,7 @@ exports.PaymentMethod = void 0;
 /**
  * @fileoverview Constants for Funnefox SDK
  */
-const SDK_VERSION = '0.8.0-ffb-631.40';
+const SDK_VERSION = '0.8.0-ffb-704.42';
 const DEFAULTS = {
     BASE_URL: 'https://billing.funnelfox.com',
     REGION: 'default',
@@ -615,6 +615,9 @@ const ERROR_CODES = {
     CONFIGURATION_ERROR: 'CONFIGURATION_ERROR',
     NETWORK_ERROR: 'NETWORK_ERROR',
 };
+const PRIMER_DEFAULTS = {
+    PAYMENT_HANDLING: 'MANUAL',
+    API_VERSION: '2.4'};
 const ALLOWED_BUTTON_PAYMENT_METHODS = [
     exports.PaymentMethod.GOOGLE_PAY,
     exports.PaymentMethod.APPLE_PAY,
@@ -678,6 +681,13 @@ const APPLE_PAY_COLLECTING_EMAIL_OPTIONS = {
         requiredShippingContactFields: ['emailAddress'],
     },
 };
+/**
+ * Backend decline codes that mean "the 3DS check failed" (as opposed to "3DS passed, then the
+ * issuer declined"). `null`: the codes cannot tell the two apart, so any decline after a
+ * challenge is `3ds_failed` (FFB-704 spike: in production both cases share REFER_TO_CARD_ISSUER,
+ * DO_NOT_HONOR and AUTHENTICATION_REQUIRED; human decision 10).
+ */
+const THREE_DS_AUTH_DECLINE_CODES = null;
 
 /**
  * @fileoverview Input validation utilities for Funnefox SDK
@@ -1366,6 +1376,37 @@ class APIClient {
             throw new NetworkError('Network request failed', error);
         }
     }
+    /**
+     * Sends the request exactly once: no retry and no client timeout (FFB-704, decision 9).
+     * Same URL, headers and error classes as `request()`. Used only by `silentPurchase`'s
+     * `handle3DS` mode for `one_click` and `resume_payment`, which must not be POSTed twice.
+     */
+    async requestOnce(endpoint, options = {}) {
+        const url = `${this.baseUrl}/${this.orgId}${endpoint}`;
+        const requestOptions = {
+            method: 'GET',
+            headers: {
+                'Content-Type': 'application/json',
+                'X-SDK-Version': SDK_VERSION,
+                ...(options.headers || {}),
+            },
+            ...options,
+        };
+        try {
+            return await this._makeRequest(url, requestOptions);
+        }
+        catch (error) {
+            if (error instanceof APIError) {
+                // Same instance, enriched: _makeRequest leaves errorCode empty; fill it from the body.
+                error.errorCode ?? (error.errorCode = getResponseErrorCodes(error.response)[0] ?? null);
+                throw error;
+            }
+            if (error instanceof Error && error.name === 'NetworkError') {
+                throw error;
+            }
+            throw new NetworkError('Network request failed', error);
+        }
+    }
     async _makeRequest(url, options) {
         let response;
         try {
@@ -1557,6 +1598,23 @@ class APIClient {
             body: JSON.stringify(payload),
         }));
     }
+    /** `one_click`, POSTed exactly once (see `requestOnce`). */
+    async oneClickOnce(payload) {
+        return (await this.requestOnce(API_ENDPOINTS.ONE_CLICK, {
+            method: 'POST',
+            body: JSON.stringify(payload),
+        }));
+    }
+    /** `resume_payment`, POSTed exactly once (see `requestOnce`). */
+    async resumePaymentOnce(params) {
+        return (await this.requestOnce(API_ENDPOINTS.RESUME_PAYMENT, {
+            method: 'POST',
+            body: JSON.stringify({
+                order_id: params.orderId,
+                resume_token: params.resumeToken,
+            }),
+        }));
+    }
     async createSimpleClientSession(payload) {
         return (await this.request(API_ENDPOINTS.CREATE_SIMPLE_CLIENT_SESSION, {
             method: 'POST',
@@ -1568,6 +1626,19 @@ class APIClient {
         }));
     }
 }
+/**
+ * Returns the `error[].code` values of a backend error envelope
+ * (`{status: 'error', error: [{msg, code, type}]}`), e.g. from `APIError.response`.
+ */
+function getResponseErrorCodes(response) {
+    const errors = response?.error;
+    if (!Array.isArray(errors)) {
+        return [];
+    }
+    return errors
+        .map(item => item?.code)
+        .filter((code) => typeof code === 'string');
+}
 
 class SessionService {
     constructor() {
@@ -2085,9 +2156,6 @@ class CheckoutInstance extends EventEmitter {
         this.counter = 0;
         this.cachedSessionResponse = null;
         this.taxRecalcSeq = 0;
-        // WebKit allows one ApplePaySession per page: a second tap while the sheet is
-        // still opening throws InvalidAccessError, but Primer asks to start first.
-        this.isApplePaySheetOpen = false;
         this.cardSessionFieldConfig = {};
         this.isTelemetryEnabled = false;
         this.telemetryCleanup = null;
@@ -2254,7 +2322,6 @@ class CheckoutInstance extends EventEmitter {
                 primerHandler.handleFailure(error?.message || 'Payment processing failed');
             }
             finally {
-                this.isApplePaySheetOpen = false;
                 this.onLoaderChangeWithRace(false);
                 this._setState('ready');
             }
@@ -2280,7 +2347,6 @@ class CheckoutInstance extends EventEmitter {
                 primerHandler.handleFailure(error?.message || 'Payment processing failed');
             }
             finally {
-                this.isApplePaySheetOpen = false;
                 this.emit(EVENTS.PURCHASE_COMPLETED);
                 this.onLoaderChangeWithRace(false);
                 this._setState('ready');
@@ -2609,7 +2675,6 @@ class CheckoutInstance extends EventEmitter {
             onTokenizeSuccess: this.handleTokenizeSuccess,
             onResumeSuccess: this.handleResumeSuccess,
             onResumeError: error => {
-                this.isApplePaySheetOpen = false;
                 if (error.stack?.includes('PROCESSOR_3DS') &&
                     error.code === 'RESUME_ERROR' &&
                     error.message?.includes('fetch resume key')) {
@@ -2619,23 +2684,15 @@ class CheckoutInstance extends EventEmitter {
                 this.emit(EVENTS.PURCHASE_FAILURE, error);
             },
             onCheckoutFail: error => {
-                this.isApplePaySheetOpen = false;
                 this.emit(EVENTS.PURCHASE_FAILURE, error);
             },
             onTokenizeError: error => {
-                this.isApplePaySheetOpen = false;
                 this.emit(EVENTS.PURCHASE_FAILURE, error);
             },
             onTokenizeStart: () => {
                 wasPaymentProcessedStarted = true;
             },
             onTokenizeShouldStart: data => {
-                if (data.paymentMethodType === exports.PaymentMethod.APPLE_PAY) {
-                    if (this.isApplePaySheetOpen) {
-                        return false;
-                    }
-                    this.isApplePaySheetOpen = true;
-                }
                 this.activePaymentMethodType = data.paymentMethodType;
                 this.emit(EVENTS.ERROR, undefined);
                 this.emit(EVENTS.START_PURCHASE, data.paymentMethodType);
@@ -2647,7 +2704,6 @@ class CheckoutInstance extends EventEmitter {
                         this.emit(EVENTS.ERROR, undefined);
                         break;
                     case 'PAYMENT_METHOD_UNSELECTED':
-                        this.isApplePaySheetOpen = false;
                         if (!wasPaymentProcessedStarted) {
                             this.emit(EVENTS.PURCHASE_CANCELLED);
                         }
@@ -2917,6 +2973,256 @@ class CheckoutInstance extends EventEmitter {
     }
 }
 
+/**
+ * @fileoverview 3DS challenge for one-click purchases (FFB-704). Internal module.
+ *
+ * Primer can run a 3DS challenge only from a tokenization handler
+ * (`handler.continueWithNewClientToken`), and a one-click purchase has no tokenization in the
+ * browser: the backend charges the vaulted instrument. Mechanism M1 (proven by the FFB-704 spike
+ * on the Primer sandbox): open a customer-bound CHECKOUT client session, start a headless
+ * checkout, tokenize a vaulted instrument through the vault manager as a stand-in, and in
+ * `onTokenizeSuccess` continue with the one-click `action_required_token` instead. Primer then
+ * shows its 3DS overlay; `onResumeSuccess` yields the resume token for `resume_payment`.
+ */
+/** Primer client-token intents that carry a 3DS step. */
+const PRIMER_3DS_INTENTS = ['3DS_AUTHENTICATION', 'PROCESSOR_3DS'];
+/** Default `threeDSTimeoutMs`. */
+const DEFAULT_THREE_DS_TIMEOUT_MS = 600000;
+/** Close button of Primer's 3DS overlay (Primer Web SDK 2.57.3, verified in the spike). */
+const PRIMER_OVERLAY_CLOSE_SELECTOR = '[data-testid="OverlayContent.closeButton"]';
+/** Decodes the `intent` of a Primer client token (a JWT); `null` if it is not one. */
+function getPrimerTokenIntent(token) {
+    try {
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            return null;
+        }
+        const base64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+        const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+        const payload = JSON.parse(atob(padded));
+        return typeof payload?.intent === 'string' ? payload.intent : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The error Primer reports when the user closes the 3DS overlay (same check as checkout.ts). */
+function isThreeDSCloseError(error) {
+    return Boolean(error?.stack?.includes('PROCESSOR_3DS') &&
+        error.code === 'RESUME_ERROR' &&
+        error.message?.includes('fetch resume key'));
+}
+/**
+ * Picks the vaulted instrument used as the stand-in tokenization. Primer returns the vault
+ * oldest-first and has no "default" flag; the 3DS check runs on the action token, not on this
+ * instrument. Cards are preferred because their vault tokenization is silent (no CVV prompt).
+ */
+function pickVaultedMethod(methods) {
+    if (!methods || methods.length === 0) {
+        return null;
+    }
+    return (methods.find(method => method.paymentInstrumentType === 'PAYMENT_CARD') ||
+        methods[0]);
+}
+function dismissPrimerOverlay() {
+    if (typeof document === 'undefined') {
+        return;
+    }
+    const button = document.querySelector(PRIMER_OVERLAY_CLOSE_SELECTOR);
+    button?.click();
+}
+function toPrimerError(message, error) {
+    return error instanceof PrimerError ? error : new PrimerError(message, error);
+}
+function callSafely(fn) {
+    try {
+        fn();
+    }
+    catch {
+        // Primer handler calls are best effort once the result is decided.
+    }
+}
+/**
+ * Runs the 3DS challenge for a one-click order and, when Primer hands back a resume token,
+ * calls `resume_payment` once. Never rejects; the caller maps the result to an outcome.
+ */
+async function runOneClickThreeDS(params) {
+    const { apiClient, region, priceId, externalId, orderId, actionToken } = params;
+    const intent = getPrimerTokenIntent(actionToken);
+    if (!intent || !PRIMER_3DS_INTENTS.includes(intent)) {
+        return {
+            kind: 'error',
+            error: new PrimerError('Unsupported one-click action: the action token is not a Primer 3DS client token', { intent }),
+        };
+    }
+    const timeoutMs = Number.isFinite(params.timeoutMs) && params.timeoutMs > 0
+        ? params.timeoutMs
+        : DEFAULT_THREE_DS_TIMEOUT_MS;
+    return new Promise(resolve => {
+        let settled = false;
+        let tokenized = false;
+        let timer = null;
+        let headless = null;
+        const settle = (result) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            if (timer) {
+                clearTimeout(timer);
+                timer = null;
+            }
+            headless = null;
+            resolve(result);
+        };
+        timer = setTimeout(() => {
+            timer = null;
+            settle({ kind: 'abandoned' });
+            // Close Primer's overlay; the close error it raises is ignored (already settled).
+            dismissPrimerOverlay();
+        }, timeoutMs);
+        const onTokenizeSuccess = (_data, handler) => {
+            if (settled) {
+                callSafely(() => handler.handleFailure());
+                return;
+            }
+            tokenized = true;
+            // Ignore the stand-in vaulted token: run the one-click 3DS action instead.
+            handler.continueWithNewClientToken(actionToken);
+        };
+        const onResumeSuccess = async (data, handler) => {
+            if (settled) {
+                callSafely(() => handler.handleFailure());
+                return;
+            }
+            // The challenge is over: the timeout bounds only the challenge, never the POST.
+            if (timer) {
+                clearTimeout(timer);
+                timer = null;
+            }
+            let response;
+            try {
+                response = await apiClient.resumePaymentOnce({
+                    orderId,
+                    resumeToken: data.resumeToken,
+                });
+            }
+            catch (error) {
+                callSafely(() => handler.handleFailure());
+                settle({
+                    kind: 'error',
+                    error: error,
+                    failedRequest: 'resume_payment',
+                });
+                return;
+            }
+            const resumeData = response?.data;
+            if (response?.status === 'success' &&
+                resumeData?.checkout_status === 'succeeded' &&
+                !resumeData.action_required_token) {
+                callSafely(() => handler.handleSuccess());
+            }
+            else {
+                // A chained action token is never continued (no second challenge).
+                callSafely(() => handler.handleFailure(resumeData?.failed_message_for_user || undefined));
+            }
+            settle({ kind: 'resumed', response });
+        };
+        const onResumeError = (error) => {
+            if (isThreeDSCloseError(error)) {
+                settle({ kind: 'abandoned' });
+                return;
+            }
+            settle({
+                kind: 'failed',
+                error: toPrimerError('3DS authentication failed', error),
+            });
+        };
+        const onCheckoutFail = (error) => {
+            if (tokenized) {
+                settle({
+                    kind: 'failed',
+                    error: toPrimerError('3DS authentication failed', error),
+                });
+            }
+            else {
+                settle({
+                    kind: 'error',
+                    error: toPrimerError('Primer checkout failed before the 3DS challenge', error),
+                });
+            }
+        };
+        const onTokenizeError = (error) => {
+            settle({
+                kind: 'error',
+                error: toPrimerError('Failed to tokenize the saved payment method', error),
+            });
+        };
+        (async () => {
+            await new PrimerWrapper().ensurePrimerLoaded();
+            if (settled) {
+                return;
+            }
+            let clientToken;
+            try {
+                const session = await apiClient.createClientSession({
+                    priceId,
+                    externalId,
+                    region,
+                    clientMetadata: {},
+                });
+                clientToken = apiClient.processSessionResponse(session).clientToken;
+            }
+            catch (error) {
+                settle({
+                    kind: 'error',
+                    error: error,
+                    failedRequest: 'create_client_session',
+                });
+                return;
+            }
+            if (settled) {
+                return;
+            }
+            // A dedicated instance, not the HeadlessManager cache used by checkouts.
+            const instance = await window.Primer.createHeadless(clientToken, {
+                paymentHandling: PRIMER_DEFAULTS.PAYMENT_HANDLING,
+                apiVersion: PRIMER_DEFAULTS.API_VERSION,
+                onAvailablePaymentMethodsLoad: () => { },
+                onTokenizeSuccess,
+                onTokenizeError,
+                onResumeSuccess,
+                onResumeError,
+                onCheckoutFail,
+            });
+            headless = await instance;
+            await headless.start();
+            if (settled) {
+                return;
+            }
+            const vaultManager = headless.createVaultManager();
+            const methods = await vaultManager.fetchVaultedPaymentMethods();
+            const method = pickVaultedMethod(methods);
+            if (!method) {
+                settle({
+                    kind: 'error',
+                    error: new PrimerError('No saved payment method found for the one-click 3DS challenge'),
+                });
+                return;
+            }
+            if (settled) {
+                return;
+            }
+            await vaultManager.startPaymentFlow(method.id);
+        })().catch(error => {
+            settle({
+                kind: 'error',
+                error: toPrimerError('Failed to start the one-click 3DS challenge', error),
+            });
+        });
+    });
+}
+
 /**
  * @fileoverview Public API with configuration and orchestration logic
  */
@@ -2983,20 +3289,46 @@ async function createClientSession(params) {
     });
     return apiClient.processSessionResponse(sessionResponse);
 }
-async function silentPurchase(options) {
-    const { priceId, externalId, clientMetadata, orgId, baseUrl } = options;
+/**
+ * Builds the `one_click` body. The CIT fields are added only when the caller set them.
+ */
+function buildOneClickRequest(options) {
+    const payload = {
+        pp_ident: options.priceId,
+        external_id: options.externalId,
+        client_metadata: options.clientMetadata,
+    };
+    if (options.initiationType !== undefined) {
+        payload.initiation_type = options.initiationType;
+    }
+    if (options.citCardNetworks !== undefined) {
+        payload.cit_card_networks = options.citCardNetworks;
+    }
+    if (options.citGooglePayPanOnly !== undefined) {
+        payload.cit_google_pay_pan_only = options.citGooglePayPanOnly;
+    }
+    return payload;
+}
+function silentPurchase(options) {
+    if (options?.handle3DS === true) {
+        return silentPurchaseDetailed(options);
+    }
+    return silentPurchaseLegacy(options);
+}
+async function silentPurchaseLegacy(options) {
+    const { orgId, baseUrl } = options;
     const apiClient = new APIClient({
         baseUrl: baseUrl,
         orgId: orgId,
         timeout: DEFAULTS.REQUEST_TIMEOUT,
         retryAttempts: DEFAULTS.RETRY_ATTEMPTS,
     });
+    if (options.initiationType === 'cit') {
+        // eslint-disable-next-line no-console
+        console.warn('[FunnelfoxSDK] silentPurchase: initiationType "cit" can trigger a 3DS challenge, which only silentPurchase({ handle3DS: true }) handles.');
+    }
     try {
-        const response = await apiClient.oneClick({
-            pp_ident: priceId,
-            external_id: externalId,
-            client_metadata: clientMetadata,
-        });
+        const response = await apiClient.oneClick(buildOneClickRequest(options));
         if (response.status !== 'success' &&
             response.error.some(({ code }) => code === 'double_purchase')) {
             throw new APIError('This product was already purchased');
@@ -3016,6 +3348,308 @@ async function silentPurchase(options) {
         throw error;
     }
 }
+const ONE_CLICK_IN_PROGRESS = 'one_click_in_progress';
+const DOUBLE_PURCHASE = 'double_purchase';
+const oneClickInFlight = new Set();
+function declineFields(data) {
+    return {
+        failedMessageForUser: data.failed_message_for_user ?? null,
+        declineCode: data.decline_code ?? null,
+        declineCodeSource: data.decline_code_source ?? null,
+    };
+}
+function envelopeError(response, fallbackMessage) {
+    const firstError = response?.error?.[0];
+    return new APIError(firstError?.msg || fallbackMessage, null, {
+        errorCode: firstError?.code,
+        errorType: firstError?.type,
+        response,
+    });
+}
+/** Maps a 2xx `one_click` response (rows 1-4, plus "needs action"). */
+function mapOneClickResponse(response) {
+    const data = response?.data;
+    if (response?.status !== 'success' || !data) {
+        if (getResponseErrorCodes(response).includes(DOUBLE_PURCHASE)) {
+            return {
+                kind: 'result',
+                result: {
+                    outcome: 'already_purchased',
+                    orderId: null,
+                    threeDSChallenged: false,
+                },
+            };
+        }
+        return {
+            kind: 'result',
+            result: {
+                outcome: 'error',
+                orderId: data?.order_id ?? null,
+                threeDSChallenged: false,
+                error: envelopeError(response, 'One-click purchase failed'),
+                failedRequest: 'one_click',
+            },
+        };
+    }
+    const orderId = data.order_id ?? null;
+    if (data.action_required_token) {
+        return { kind: 'action', orderId, actionToken: data.action_required_token };
+    }
+    switch (data.checkout_status) {
+        case 'succeeded':
+            return {
+                kind: 'result',
+                result: { outcome: 'succeeded', orderId, threeDSChallenged: false },
+            };
+        case 'failed':
+            return {
+                kind: 'result',
+                result: {
+                    outcome: 'declined',
+                    orderId,
+                    threeDSChallenged: false,
+                    ...declineFields(data),
+                },
+            };
+        case 'processing':
+            return {
+                kind: 'result',
+                result: { outcome: 'processing', orderId, threeDSChallenged: false },
+            };
+        case 'cancelled':
+            return {
+                kind: 'result',
+                result: {
+                    outcome: 'error',
+                    orderId,
+                    threeDSChallenged: false,
+                    error: new APIError('Payment was cancelled', null, { response }),
+                },
+            };
+        default:
+            return {
+                kind: 'result',
+                result: {
+                    outcome: 'error',
+                    orderId,
+                    threeDSChallenged: false,
+                    error: new APIError(`Unhandled checkout status: ${data.checkout_status}`, null, { response }),
+                },
+            };
+    }
+}
+/** Maps a `resume_payment` response after a challenge (rows 5, 6, 6b, 6c, 7, 8). */
+function mapResumeResponse(response, orderId, threeDSAuthDeclineCodes = THREE_DS_AUTH_DECLINE_CODES) {
+    const data = response?.data;
+    if (response?.status !== 'success' || !data) {
+        return {
+            threeDS: 'error',
+            result: {
+                outcome: 'error',
+                orderId,
+                threeDSChallenged: true,
+                error: envelopeError(response, 'Resume payment failed'),
+                failedRequest: 'resume_payment',
+            },
+        };
+    }
+    if (data.action_required_token) {
+        // Chained action: not supported, no second challenge (human decision F3).
+        return {
+            threeDS: 'error',
+            result: {
+                outcome: 'error',
+                orderId,
+                threeDSChallenged: true,
+                error: new FunnefoxSDKError('resume_payment returned another action token; chained 3DS is not supported', 'one_click_chained_action'),
+            },
+        };
+    }
+    switch (data.checkout_status) {
+        case 'succeeded':
+            return {
+                threeDS: 'passed',
+                result: { outcome: 'succeeded', orderId, threeDSChallenged: true },
+            };
+        case 'processing':
+            return {
+                threeDS: 'passed',
+                result: { outcome: 'processing', orderId, threeDSChallenged: true },
+            };
+        case 'failed': {
+            const authFailed = threeDSAuthDeclineCodes === null ||
+                threeDSAuthDeclineCodes.includes(data.decline_code ?? '');
+            return {
+                threeDS: authFailed ? 'failed' : 'passed',
+                result: {
+                    outcome: authFailed ? '3ds_failed' : 'declined',
+                    orderId,
+                    threeDSChallenged: true,
+                    ...declineFields(data),
+                },
+            };
+        }
+        default:
+            return {
+                threeDS: 'error',
+                result: {
+                    outcome: 'error',
+                    orderId,
+                    threeDSChallenged: true,
+                    error: new APIError(data.checkout_status === 'cancelled'
+                        ? 'Payment was cancelled'
+                        : `Unhandled checkout status: ${data.checkout_status}`, null, { response }),
+                },
+            };
+    }
+}
+function mapThreeDSRun(run, orderId) {
+    switch (run.kind) {
+        case 'resumed':
+            return mapResumeResponse(run.response, orderId);
+        case 'failed':
+            return {
+                threeDS: 'failed',
+                result: {
+                    outcome: '3ds_failed',
+                    orderId,
+                    threeDSChallenged: true,
+                    error: run.error,
+                },
+            };
+        case 'abandoned':
+            return {
+                threeDS: 'abandoned',
+                result: { outcome: '3ds_abandoned', orderId, threeDSChallenged: true },
+            };
+        default: {
+            const result = {
+                outcome: 'error',
+                orderId,
+                threeDSChallenged: true,
+                error: run.error,
+            };
+            if (run.failedRequest) {
+                result.failedRequest = run.failedRequest;
+            }
+            return { threeDS: 'error', result };
+        }
+    }
+}
+function callHook(name, hook, info) {
+    if (typeof hook !== 'function') {
+        return;
+    }
+    try {
+        hook(info);
+    }
+    catch (error) {
+        // eslint-disable-next-line no-console
+        console.error(`[FunnelfoxSDK] silentPurchase ${name} hook threw`, error);
+    }
+}
+async function silentPurchaseDetailed(options) {
+    for (const field of ['orgId', 'baseUrl', 'priceId', 'externalId']) {
+        if (!options?.[field]) {
+            throw new ValidationError(field, 'is required', options?.[field]);
+        }
+    }
+    const { orgId, baseUrl, externalId } = options;
+    const inFlightKey = `${orgId}\u0000${externalId}`;
+    if (oneClickInFlight.has(inFlightKey)) {
+        return {
+            outcome: 'error',
+            orderId: null,
+            threeDSChallenged: false,
+            error: new FunnefoxSDKError('A one-click purchase is already in progress for this customer', ONE_CLICK_IN_PROGRESS),
+        };
+    }
+    oneClickInFlight.add(inFlightKey);
+    try {
+        const result = await runSilentPurchaseDetailed(options);
+        if (result.outcome === 'error' && result.error) {
+            const error = result.error;
+            getErrorImage(orgId, {
+                baseUrl,
+                message: error.message,
+                code: error.code,
+                req_id: error.response?.req_id,
+            });
+        }
+        return result;
+    }
+    finally {
+        oneClickInFlight.delete(inFlightKey);
+    }
+}
+async function runSilentPurchaseDetailed(options) {
+    const apiClient = new APIClient({
+        baseUrl: options.baseUrl,
+        orgId: options.orgId,
+        timeout: DEFAULTS.REQUEST_TIMEOUT,
+        retryAttempts: DEFAULTS.RETRY_ATTEMPTS,
+    });
+    let response;
+    try {
+        response = await apiClient.oneClickOnce(buildOneClickRequest(options));
+    }
+    catch (error) {
+        if (error instanceof APIError &&
+            getResponseErrorCodes(error.response).includes(DOUBLE_PURCHASE)) {
+            return {
+                outcome: 'already_purchased',
+                orderId: null,
+                threeDSChallenged: false,
+            };
+        }
+        return {
+            outcome: 'error',
+            orderId: null,
+            threeDSChallenged: false,
+            error: error,
+            failedRequest: 'one_click',
+        };
+    }
+    const step = mapOneClickResponse(response);
+    if (step.kind === 'result') {
+        return step.result;
+    }
+    const { orderId, actionToken } = step;
+    let ended = false;
+    const end = (result) => {
+        if (ended) {
+            return;
+        }
+        ended = true;
+        callHook('onThreeDSEnd', options.onThreeDSEnd, { result });
+    };
+    callHook('onThreeDSStart', options.onThreeDSStart, { orderId });
+    try {
+        const run = await runOneClickThreeDS({
+            apiClient,
+            region: defaultConfig?.region || DEFAULTS.REGION,
+            priceId: options.priceId,
+            externalId: options.externalId,
+            orderId,
+            actionToken,
+            timeoutMs: options.threeDSTimeoutMs ?? DEFAULT_THREE_DS_TIMEOUT_MS,
+        });
+        const mapped = mapThreeDSRun(run, orderId);
+        end(mapped.threeDS);
+        return mapped.result;
+    }
+    catch (error) {
+        end('error');
+        return {
+            outcome: 'error',
+            orderId,
+            threeDSChallenged: true,
+            error: error instanceof Error
+                ? error
+                : new FunnefoxSDKError('One-click 3DS step failed', undefined, error),
+        };
+    }
+}
 async function initMethod(method, element, options) {
     try {
         const checkoutInstance = new CheckoutInstance({