@harrylabsj/kiwi 0.6.0

package/dist/handoff/ucp-checkout/client.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { UcpCartMessage, UcpCartResponse } from "./cart-types.js";
+import type { UcpCheckoutResponse } from "./types.js";
+/** REST binding 路径（UCP 2026-04-08：`POST {endpoint}/checkout-sessions`）。 */
+export declare const CHECKOUT_SESSIONS_PATH = "/checkout-sessions";
+export declare const CHECKOUT_COMPLETE_SUFFIX = "/complete";
+export declare const CHECKOUT_CANCEL_SUFFIX = "/cancel";
+/** Cart REST binding 路径（UCP 2026-04-08：`POST {endpoint}/carts`）。 */
+export declare const CARTS_PATH = "/carts";
+export declare const CART_CANCEL_SUFFIX = "/cancel";
+export type UcpCheckoutHttpErrorCode = "unsafe_target" | "timeout" | "network" | "bad_status" | "malformed";
+export interface UcpCheckoutHttpError {
+    kind: "error";
+    code: UcpCheckoutHttpErrorCode;
+    reason: string;
+    status?: number;
+}
+export type UcpCheckoutHttpResult = {
+    kind: "ok";
+    status: number;
+    response: UcpCheckoutResponse;
+} | UcpCheckoutHttpError;
+/**
+ * Cart HTTP 结果：多一档结构化 `not_found`（与 `error` 判别分开）——
+ * HTTP 404 / not_found error envelope → `{kind:"not_found"}`；ucp.status=error
+ * envelope（含 4xx）→ `{kind:"ok", response:error}` 交上层消息算法。
+ */
+export type UcpCartHttpResult = {
+    kind: "ok";
+    status: number;
+    response: UcpCartResponse;
+} | {
+    kind: "not_found";
+    status: number;
+    messages?: UcpCartMessage[];
+    continue_url?: string;
+} | UcpCheckoutHttpError;
+export interface UcpCheckoutHttpClientOptions {
+    endpoint: string;
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+    allowPrivateRanges?: boolean;
+    skipDnsCheck?: boolean;
+    resolveIp?: (hostname: string) => Promise<string[]>;
+    /** buyer 的 UCP profile URI；配置时注入 `UCP-Agent: profile="<uri>"`。 */
+    ucpAgentProfile?: string;
+    headers?: Record<string, string>;
+}
+export declare class UcpCheckoutHttpClient {
+    /** 规范化 endpoint（无尾部 `/`）。 */
+    readonly endpoint: string;
+    private readonly url;
+    private readonly timeoutMs;
+    private readonly fetchImpl;
+    private readonly allowPrivateRanges;
+    private readonly skipDnsCheck;
+    private readonly resolveIp?;
+    private readonly baseHeaders;
+    constructor(options: UcpCheckoutHttpClientOptions);
+    createSession(body: Record<string, unknown>): Promise<UcpCheckoutHttpResult>;
+    getSession(sessionId: string): Promise<UcpCheckoutHttpResult>;
+    updateSession(sessionId: string, body: Record<string, unknown>): Promise<UcpCheckoutHttpResult>;
+    completeSession(sessionId: string, body: Record<string, unknown>): Promise<UcpCheckoutHttpResult>;
+    cancelSession(sessionId: string, body: Record<string, unknown>): Promise<UcpCheckoutHttpResult>;
+    createCart(body: Record<string, unknown>): Promise<UcpCartHttpResult>;
+    getCart(cartId: string): Promise<UcpCartHttpResult>;
+    /** Update 全量替换语义：PUT 完整 cart 表示。 */
+    updateCart(cartId: string, body: Record<string, unknown>): Promise<UcpCartHttpResult>;
+    cancelCart(cartId: string): Promise<UcpCartHttpResult>;
+    /** 共享传输：SSRF 复查 + 超时 + fetch + JSON 解析。不解析 UCP 结构。 */
+    private requestRaw;
+    private request;
+    private requestCart;
+}

package/dist/handoff/ucp-checkout/client.js

@@ -0,0 +1,228 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Kiwi v0.7.0 Transaction Handoff（WP2 + 补全）— UCP Checkout/Cart HTTP 客户端
+ * （原生 fetch）。
+ *
+ * 网络面（全部 fail-closed，§4.6）：
+ *   - SSRF 复用 a2a url-policy：构造时静态校验 endpoint（unsafe_target），
+ *     每个请求前 DNS 复查解析 IP（unsafe_target）；
+ *   - 超时：AbortController（timeoutMs，缺省 10s）；
+ *   - 非 2xx / 畸形响应：非 2xx 若携带合法 UCP error envelope 仍解析（供消息算法
+ *     分支），否则 bad_status；2xx 非 JSON / 结构非法 → malformed；
+ *   - UCP-Agent 头（RFC 8941 Dictionary，§25.1）：buyer 配置了 profile URI 时注入。
+ *
+ * Cart 操作与 checkout 共享同一传输层（requestRaw），cart 实体与 checkout 同构：
+ *   - createCart / getCart / updateCart（全量替换 PUT）/ cancelCart；
+ *   - not_found 与 error 判别结构化：HTTP 404 → `{kind:"not_found"}`（spec：
+ *     Get 对不存在/过期/已取消返回 not_found）；ucp.status=error → 合法 error
+ *     envelope 交上层消息算法；传输失败 → `{kind:"error"}`。
+ *
+ * 零新增依赖：Node 22 原生 fetch + AbortController。
+ */
+import { assertResolvableTargetUrl, assertSafeTargetUrl } from "../../a2a/client/url-policy.js";
+import { isRedirectResponse, readJsonBody, SafeHttpError } from "../../net/safe-http.js";
+import { serializeUcpAgentHeader, UCP_AGENT_HEADER } from "../../a2a/ucp-agent.js";
+import { parseUcpCartResponse } from "./cart-parse.js";
+import { UcpCheckoutParseError, parseUcpCheckoutResponse } from "./parse.js";
+/** REST binding 路径（UCP 2026-04-08：`POST {endpoint}/checkout-sessions`）。 */
+export const CHECKOUT_SESSIONS_PATH = "/checkout-sessions";
+export const CHECKOUT_COMPLETE_SUFFIX = "/complete";
+export const CHECKOUT_CANCEL_SUFFIX = "/cancel";
+/** Cart REST binding 路径（UCP 2026-04-08：`POST {endpoint}/carts`）。 */
+export const CARTS_PATH = "/carts";
+export const CART_CANCEL_SUFFIX = "/cancel";
+function httpError(code, reason, status) {
+    return { kind: "error", code, reason, status };
+}
+export class UcpCheckoutHttpClient {
+    /** 规范化 endpoint（无尾部 `/`）。 */
+    endpoint;
+    url;
+    timeoutMs;
+    fetchImpl;
+    allowPrivateRanges;
+    skipDnsCheck;
+    resolveIp;
+    baseHeaders;
+    constructor(options) {
+        const url = assertSafeTargetUrl(options.endpoint, {
+            allowPrivateRanges: options.allowPrivateRanges,
+        });
+        this.url = url;
+        this.endpoint = url.href.replace(/\/+$/, "");
+        this.timeoutMs = options.timeoutMs ?? 10_000;
+        this.fetchImpl = options.fetchImpl ?? globalThis.fetch;
+        this.allowPrivateRanges = options.allowPrivateRanges ?? false;
+        this.skipDnsCheck = options.skipDnsCheck ?? false;
+        this.resolveIp = options.resolveIp;
+        this.baseHeaders = {
+            "content-type": "application/json",
+            accept: "application/json",
+            // WP3 §25.1：buyer 配置了 UCP profile URI 时宣告 UCP-Agent（RFC 8941 Dictionary）。
+            ...(options.ucpAgentProfile !== undefined
+                ? { [UCP_AGENT_HEADER]: serializeUcpAgentHeader(options.ucpAgentProfile) }
+                : {}),
+            ...options.headers,
+        };
+    }
+    createSession(body) {
+        return this.request("POST", CHECKOUT_SESSIONS_PATH, body);
+    }
+    getSession(sessionId) {
+        return this.request("GET", `${CHECKOUT_SESSIONS_PATH}/${encodeURIComponent(sessionId)}`, undefined);
+    }
+    updateSession(sessionId, body) {
+        return this.request("PUT", `${CHECKOUT_SESSIONS_PATH}/${encodeURIComponent(sessionId)}`, body);
+    }
+    completeSession(sessionId, body) {
+        return this.request("POST", `${CHECKOUT_SESSIONS_PATH}/${encodeURIComponent(sessionId)}${CHECKOUT_COMPLETE_SUFFIX}`, body);
+    }
+    cancelSession(sessionId, body) {
+        return this.request("POST", `${CHECKOUT_SESSIONS_PATH}/${encodeURIComponent(sessionId)}${CHECKOUT_CANCEL_SUFFIX}`, body);
+    }
+    // -- Cart 操作（共享 requestRaw 传输层；Cart 实体与 checkout 同构） --------------
+    createCart(body) {
+        return this.requestCart("POST", CARTS_PATH, body);
+    }
+    getCart(cartId) {
+        return this.requestCart("GET", `${CARTS_PATH}/${encodeURIComponent(cartId)}`, undefined);
+    }
+    /** Update 全量替换语义：PUT 完整 cart 表示。 */
+    updateCart(cartId, body) {
+        return this.requestCart("PUT", `${CARTS_PATH}/${encodeURIComponent(cartId)}`, body);
+    }
+    cancelCart(cartId) {
+        return this.requestCart("POST", `${CARTS_PATH}/${encodeURIComponent(cartId)}${CART_CANCEL_SUFFIX}`, {});
+    }
+    // -- 传输层 ---------------------------------------------------------
+    /** 共享传输：SSRF 复查 + 超时 + fetch + JSON 解析。不解析 UCP 结构。 */
+    async requestRaw(method, path, body) {
+        // 请求前 DNS 复查：主机名解析出的每个 IP 都不得落在私网/保留段（DNS rebinding 缓解）。
+        try {
+            await assertResolvableTargetUrl(this.url, {
+                allowPrivateRanges: this.allowPrivateRanges,
+                skipDnsCheck: this.skipDnsCheck,
+                resolveIp: this.resolveIp,
+            });
+        }
+        catch (err) {
+            return httpError("unsafe_target", `UCP endpoint rejected: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+        const url = `${this.endpoint}${path}`;
+        let response;
+        try {
+            response = await this.fetchImpl(url, {
+                method,
+                // 出站纪律（评审项 P3-1，与 a2a-client 同类的 SSRF 面）：绝不跟随
+                // 重定向——3xx 目标不经过 SSRF/DNS 复查，恶意/被攻陷的 UCP 服务器
+                // 可把 checkout 请求重定向到内网/元数据服务。
+                redirect: "manual",
+                headers: this.baseHeaders,
+                ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+                signal: controller.signal,
+            });
+        }
+        catch (err) {
+            if (controller.signal.aborted) {
+                return httpError("timeout", `UCP request timed out after ${this.timeoutMs}ms`);
+            }
+            return httpError("network", `UCP request failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        if (isRedirectResponse(response)) {
+            return httpError("network", `UCP endpoint must not redirect (HTTP ${response.status})`, response.status);
+        }
+        let raw;
+        try {
+            // 响应体读取在超时覆盖内 + 大小上限（对端停滞 body 不再永久挂起）。
+            raw = await readJsonBody(response, { signal: controller.signal });
+        }
+        catch (err) {
+            if (controller.signal.aborted) {
+                return httpError("timeout", `UCP request timed out after ${this.timeoutMs}ms`);
+            }
+            return httpError("malformed", err instanceof SafeHttpError && err.code === "response_too_large"
+                ? `UCP response too large: ${err.message}`
+                : `UCP response is not JSON${response.ok ? "" : ` (http ${response.status})`}`, response.status);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        return { kind: "ok", status: response.status, raw };
+    }
+    async request(method, path, body) {
+        const raw = await this.requestRaw(method, path, body);
+        if (raw.kind === "error")
+            return raw;
+        let parsed;
+        try {
+            parsed = parseUcpCheckoutResponse(raw.raw);
+        }
+        catch (err) {
+            const detail = err instanceof UcpCheckoutParseError ? err.message : err instanceof Error ? err.message : String(err);
+            return httpError("malformed", `UCP checkout response malformed: ${detail}`, raw.status);
+        }
+        const ok = raw.status >= 200 && raw.status < 300;
+        if (!ok) {
+            // 非 2xx：合法 UCP error envelope 仍走消息算法（fail-closed 结果，绝不 ok）；
+            // success envelope 与 HTTP 层矛盾 → bad_status。
+            if (parsed.ucp.status === "error") {
+                return { kind: "ok", status: raw.status, response: parsed };
+            }
+            return httpError("bad_status", `UCP checkout HTTP ${raw.status} with inconsistent success envelope`, raw.status);
+        }
+        return { kind: "ok", status: raw.status, response: parsed };
+    }
+    async requestCart(method, path, body) {
+        const raw = await this.requestRaw(method, path, body);
+        if (raw.kind === "error")
+            return raw;
+        const status = raw.status;
+        let parsed;
+        try {
+            parsed = parseUcpCartResponse(raw.raw);
+        }
+        catch (err) {
+            // spec 事实：Get 对不存在/过期/已取消的 cart 返回 not_found → 404 优先判别
+            // not_found（body 非 UCP envelope 也按 not_found 处理，不翻成 malformed）。
+            if (status === 404)
+                return { kind: "not_found", status };
+            const detail = err instanceof UcpCheckoutParseError ? err.message : err instanceof Error ? err.message : String(err);
+            return httpError("malformed", `UCP cart response malformed: ${detail}`, status);
+        }
+        // 404 → 结构化 not_found（携带可用的 messages/continue_url）。
+        if (status === 404) {
+            return {
+                kind: "not_found",
+                status,
+                ...(parsed.ucp.status === "error"
+                    ? { messages: parsed.messages, continue_url: parsed.continue_url }
+                    : {}),
+            };
+        }
+        const ok = status >= 200 && status < 300;
+        if (!ok) {
+            if (parsed.ucp.status === "error") {
+                return { kind: "ok", status, response: parsed };
+            }
+            return httpError("bad_status", `UCP cart HTTP ${status} with inconsistent success envelope`, status);
+        }
+        return { kind: "ok", status, response: parsed };
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/handoff/ucp-checkout/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/handoff/ucp-checkout/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACzF,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG7E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,WAAW,CAAC;AACpD,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAS,CAAC;AAEhD,oEAAoE;AACpE,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC;AACnC,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AA0C5C,SAAS,SAAS,CAChB,IAA8B,EAC9B,MAAc,EACd,MAAe;IAEf,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,OAAO,qBAAqB;IAChC,6BAA6B;IACpB,QAAQ,CAAS;IACT,GAAG,CAAM;IACT,SAAS,CAAS;IAClB,SAAS,CAAe;IACxB,kBAAkB,CAAU;IAC5B,YAAY,CAAU;IACtB,SAAS,CAA2C;IACpD,WAAW,CAAyB;IAErD,YAAY,OAAqC;QAC/C,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAAC,QAAQ,EAAE;YAChD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;SAC/C,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;QAC7C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;QACvD,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,KAAK,CAAC;QAC9D,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,KAAK,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,WAAW,GAAG;YACjB,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;YAC1B,0EAA0E;YAC1E,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS;gBACvC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;gBAC1E,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,OAAO,CAAC,OAAO;SACnB,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,IAA6B;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,sBAAsB,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,sBAAsB,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACtG,CAAC;IAED,aAAa,CACX,SAAiB,EACjB,IAA6B;QAE7B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,sBAAsB,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACjG,CAAC;IAED,eAAe,CAAC,SAAiB,EAAE,IAA6B;QAC9D,OAAO,IAAI,CAAC,OAAO,CACjB,MAAM,EACN,GAAG,sBAAsB,IAAI,kBAAkB,CAAC,SAAS,CAAC,GAAG,wBAAwB,EAAE,EACvF,IAAI,CACL,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,SAAiB,EAAE,IAA6B;QAC5D,OAAO,IAAI,CAAC,OAAO,CACjB,MAAM,EACN,GAAG,sBAAsB,IAAI,kBAAkB,CAAC,SAAS,CAAC,GAAG,sBAAsB,EAAE,EACrF,IAAI,CACL,CAAC;IACJ,CAAC;IAED,oEAAoE;IAEpE,UAAU,CAAC,IAA6B;QACtC,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,CAAC,MAAc;QACpB,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,UAAU,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAC3F,CAAC;IAED,oCAAoC;IACpC,UAAU,CAAC,MAAc,EAAE,IAA6B;QACtD,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,UAAU,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACtF,CAAC;IAED,UAAU,CAAC,MAAc;QACvB,OAAO,IAAI,CAAC,WAAW,CACrB,MAAM,EACN,GAAG,UAAU,IAAI,kBAAkB,CAAC,MAAM,CAAC,GAAG,kBAAkB,EAAE,EAClE,EAAE,CACH,CAAC;IACJ,CAAC;IAED,mEAAmE;IAEnE,sDAAsD;IAC9C,KAAK,CAAC,UAAU,CACtB,MAAc,EACd,IAAY,EACZ,IAAyC;QAEzC,yDAAyD;QACzD,IAAI,CAAC;YACH,MAAM,yBAAyB,CAAC,IAAI,CAAC,GAAG,EAAE;gBACxC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;gBAC3C,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,SAAS,CACd,eAAe,EACf,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC7E,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,EAAE,CAAC;QAEtC,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;gBACnC,MAAM;gBACN,8CAA8C;gBAC9C,6CAA6C;gBAC7C,8BAA8B;gBAC9B,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,IAAI,CAAC,WAAW;gBACzB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,OAAO,SAAS,CAAC,SAAS,EAAE,+BAA+B,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;YACjF,CAAC;YACD,OAAO,SAAS,CACd,SAAS,EACT,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1E,CAAC;QACJ,CAAC;QACD,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,OAAO,SAAS,CACd,SAAS,EACT,wCAAwC,QAAQ,CAAC,MAAM,GAAG,EAC1D,QAAQ,CAAC,MAAM,CAChB,CAAC;QACJ,CAAC;QAED,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,wCAAwC;YACxC,GAAG,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,OAAO,SAAS,CAAC,SAAS,EAAE,+BAA+B,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;YACjF,CAAC;YACD,OAAO,SAAS,CACd,WAAW,EACX,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,oBAAoB;gBAC/D,CAAC,CAAC,2BAA2B,GAAG,CAAC,OAAO,EAAE;gBAC1C,CAAC,CAAC,2BAA2B,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,QAAQ,CAAC,MAAM,GAAG,EAAE,EAChF,QAAQ,CAAC,MAAM,CAChB,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC;IACtD,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,IAAY,EACZ,IAAyC;QAEzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACtD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,GAAG,CAAC;QAErC,IAAI,MAA2B,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GACV,GAAG,YAAY,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxG,OAAO,SAAS,CAAC,WAAW,EAAE,oCAAoC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjD,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,4DAA4D;YAC5D,4CAA4C;YAC5C,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAClC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC9D,CAAC;YACD,OAAO,SAAS,CACd,YAAY,EACZ,qBAAqB,GAAG,CAAC,MAAM,qCAAqC,EACpE,GAAG,CAAC,MAAM,CACX,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC9D,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,MAAc,EACd,IAAY,EACZ,IAAyC;QAEzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACtD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,GAAG,CAAC;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAE1B,IAAI,MAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wDAAwD;YACxD,gEAAgE;YAChE,IAAI,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;YACzD,MAAM,MAAM,GACV,GAAG,YAAY,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxG,OAAO,SAAS,CAAC,WAAW,EAAE,gCAAgC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QAClF,CAAC;QAED,oDAAoD;QACpD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO;gBACL,IAAI,EAAE,WAAW;gBACjB,MAAM;gBACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,KAAK,OAAO;oBAC/B,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;oBAClE,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;QACzC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAClC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAClD,CAAC;YACD,OAAO,SAAS,CACd,YAAY,EACZ,iBAAiB,MAAM,qCAAqC,EAC5D,MAAM,CACP,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAClD,CAAC;CACF"}

package/dist/handoff/ucp-checkout/endpoint.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { UcpProfile } from "../../discovery/ucp/types.js";
+export interface FindCheckoutEndpointOptions {
+    /** 显式指定 checkout service 名（如 `com.example.checkout`）。 */
+    serviceName?: string;
+}
+/**
+ * 在 profile 中解析 checkout REST endpoint。找不到返回 undefined。
+ */
+export declare function findCheckoutEndpoint(profile: UcpProfile, opts?: FindCheckoutEndpointOptions): string | undefined;
+/**
+ * business profile 是否宣告 cart capability（`dev.ucp.shopping.cart`）。
+ * 判定：capability 名全名相等，或解析后 capability 末段为 `cart`（forward-compat，
+ * 不同 reverse-domain 的 cart capability 也认）。
+ */
+export declare function profileHasCartCapability(profile: UcpProfile): boolean;
+/**
+ * 在 profile 中解析 cart REST endpoint。与 findCheckoutEndpoint 并列；额外优先
+ * capability 宿主 service（`*.cart` capability 所在 service 的 rest endpoint）。
+ * 找不到返回 undefined。
+ */
+export declare function findCartEndpoint(profile: UcpProfile, opts?: FindCheckoutEndpointOptions): string | undefined;

package/dist/handoff/ucp-checkout/endpoint.js

@@ -0,0 +1,145 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Kiwi v0.7.0 Transaction Handoff（WP2 + 补全）— UCP checkout / cart service
+ * endpoint 解析 + cart capability 检测。
+ *
+ * 从 UCP profile（src/discovery/ucp）里找出 checkout / cart REST service endpoint：
+ *   - 显式 serviceName：取 `profile.ucp.services[serviceName]` 下第一个
+ *     transport=rest 且有 endpoint 的条目；
+ *   - 自动探测：优先 service 名最后一段为 `checkout`/`cart` 的 rest service；
+ *     cart 额外优先 capability 宿主 service（capability 名末段 == cart，
+ *     如 `dev.ucp.shopping.cart` → service `dev.ucp.shopping`）；
+ *     回退到 spec URL 含 `checkout`/`cart` 的 rest service；
+ *   - 找不到 → undefined（fail-closed：缺 endpoint 时 channel 拒绝构造）。
+ *
+ * cart capability 检测（profileHasCartCapability）：`dev.ucp.shopping.cart`
+ * 在 `profile.ucp.capabilities` 里宣告。cart_id 仅在 business profile 宣告
+ * cart capability 时可用（spec 事实）。
+ *
+ * 只解析 endpoint（不抓取、不 SSRF）；endpoint 的安全校验发生在 channel 构造
+ * 与请求前（复用 a2a url-policy）。
+ */
+import { parseCapabilityNamespace, parseServiceNamespace, } from "../../discovery/ucp/types.js";
+import { CART_CAPABILITY } from "./cart-types.js";
+function isRestWithEndpoint(decl) {
+    return decl.transport === "rest" && typeof decl.endpoint === "string" && decl.endpoint.length > 0;
+}
+/**
+ * 在 profile 中解析 checkout REST endpoint。找不到返回 undefined。
+ */
+export function findCheckoutEndpoint(profile, opts = {}) {
+    const services = profile.ucp.services;
+    if (services === undefined)
+        return undefined;
+    if (opts.serviceName !== undefined) {
+        const entries = services[opts.serviceName];
+        if (entries === undefined)
+            return undefined;
+        const hit = entries.find(isRestWithEndpoint);
+        return hit?.endpoint;
+    }
+    // 自动探测：优先 service 名末段 == checkout。
+    for (const [name, entries] of Object.entries(services)) {
+        const ns = parseServiceNamespace(name);
+        if (ns !== undefined && ns.service === "checkout") {
+            const hit = entries.find(isRestWithEndpoint);
+            if (hit !== undefined)
+                return hit.endpoint;
+        }
+    }
+    // 回退：spec URL 含 "checkout" 的 rest service。
+    for (const entries of Object.values(services)) {
+        const hit = entries.find((decl) => isRestWithEndpoint(decl) && /checkout/i.test(decl.spec));
+        if (hit !== undefined)
+            return hit.endpoint;
+    }
+    return undefined;
+}
+// ---------------------------------------------------------------------------
+// Cart endpoint + capability
+// ---------------------------------------------------------------------------
+/**
+ * business profile 是否宣告 cart capability（`dev.ucp.shopping.cart`）。
+ * 判定：capability 名全名相等，或解析后 capability 末段为 `cart`（forward-compat，
+ * 不同 reverse-domain 的 cart capability 也认）。
+ */
+export function profileHasCartCapability(profile) {
+    const caps = profile.ucp.capabilities;
+    if (caps === undefined)
+        return false;
+    for (const name of Object.keys(caps)) {
+        if (name === CART_CAPABILITY)
+            return true;
+        const ns = parseCapabilityNamespace(name);
+        if (ns !== undefined && ns.capability === "cart")
+            return true;
+    }
+    return false;
+}
+/**
+ * 在 profile 中解析 cart REST endpoint。与 findCheckoutEndpoint 并列；额外优先
+ * capability 宿主 service（`*.cart` capability 所在 service 的 rest endpoint）。
+ * 找不到返回 undefined。
+ */
+export function findCartEndpoint(profile, opts = {}) {
+    const services = profile.ucp.services;
+    if (services === undefined)
+        return undefined;
+    if (opts.serviceName !== undefined) {
+        const entries = services[opts.serviceName];
+        if (entries === undefined)
+            return undefined;
+        const hit = entries.find(isRestWithEndpoint);
+        return hit?.endpoint;
+    }
+    // 1. capability 宿主 service：capability 名末段 == cart（如 dev.ucp.shopping.cart
+    //    → service dev.ucp.shopping）。
+    const cartCapabilityServices = new Set();
+    const caps = profile.ucp.capabilities;
+    if (caps !== undefined) {
+        for (const name of Object.keys(caps)) {
+            const ns = parseCapabilityNamespace(name);
+            if (ns !== undefined && ns.capability === "cart") {
+                cartCapabilityServices.add(`${ns.reverseDomain}.${ns.service}`);
+            }
+        }
+    }
+    for (const [name, entries] of Object.entries(services)) {
+        if (cartCapabilityServices.has(name)) {
+            const hit = entries.find(isRestWithEndpoint);
+            if (hit !== undefined)
+                return hit.endpoint;
+        }
+    }
+    // 2. 自动探测：service 名末段 == cart。
+    for (const [name, entries] of Object.entries(services)) {
+        const ns = parseServiceNamespace(name);
+        if (ns !== undefined && ns.service === "cart") {
+            const hit = entries.find(isRestWithEndpoint);
+            if (hit !== undefined)
+                return hit.endpoint;
+        }
+    }
+    // 3. 回退：spec URL 含 "cart" 的 rest service。
+    for (const entries of Object.values(services)) {
+        const hit = entries.find((decl) => isRestWithEndpoint(decl) && /cart/i.test(decl.spec));
+        if (hit !== undefined)
+            return hit.endpoint;
+    }
+    return undefined;
+}
+//# sourceMappingURL=endpoint.js.map

package/dist/handoff/ucp-checkout/endpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint.js","sourceRoot":"","sources":["../../../src/handoff/ucp-checkout/endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EACL,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAOlD,SAAS,kBAAkB,CAAC,IAA2B;IACrD,OAAO,IAAI,CAAC,SAAS,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;AACpG,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAmB,EACnB,OAAoC,EAAE;IAEtC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE7C,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC7C,OAAO,GAAG,EAAE,QAAQ,CAAC;IACvB,CAAC;IAED,mCAAmC;IACnC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YAClD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC7C,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,GAAG,CAAC,QAAQ,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,2CAA2C;IAC3C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CACtB,CAAC,IAAI,EAAwD,EAAE,CAC7D,kBAAkB,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAC1D,CAAC;QACF,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC,QAAQ,CAAC;IAC7C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAmB;IAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACtC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,IAAI,KAAK,eAAe;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,EAAE,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,CAAC,UAAU,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAmB,EACnB,OAAoC,EAAE;IAEtC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE7C,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC7C,OAAO,GAAG,EAAE,QAAQ,CAAC;IACvB,CAAC;IAED,0EAA0E;IAC1E,kCAAkC;IAClC,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAU,CAAC;IACjD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACtC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,EAAE,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;gBACjD,sBAAsB,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,aAAa,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC7C,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,GAAG,CAAC,QAAQ,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,+BAA+B;IAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC7C,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,GAAG,CAAC,QAAQ,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,0CAA0C;IAC1C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CACtB,CAAC,IAAI,EAAwD,EAAE,CAC7D,kBAAkB,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CACtD,CAAC;QACF,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC,QAAQ,CAAC;IAC7C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/handoff/ucp-checkout/index.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Kiwi v0.7.0 Transaction Handoff（WP2）— UCP Checkout client。
+ *
+ * HandoffChannel 的真实 UCP 版本：在外部交易系统（business 为 Merchant of Record）
+ * 上创建 / 读取 / 全量替换更新 / 请求完成 / 取消 checkout session。与 WP1 的
+ * 同步接缝 `HandoffChannel` 相对，本包提供异步投影 `AsyncHandoffChannel`；
+ * `requestCompletion` 复用 WP1 完成门禁（completion.ts），通过后才发 Complete，
+ * 且只附 authorization 证据引用（不构造任何支付凭据）。
+ *
+ * 零新增依赖：Node 22 原生 fetch + AbortController；SSRF 复用 a2a url-policy。
+ */
+export { UcpCheckoutChannel, type AsyncHandoffChannel, type CartCheckoutLink, type UcpCheckoutChannelOptions, } from "./channel.js";
+export { CART_CANCEL_SUFFIX, CARTS_PATH, CHECKOUT_CANCEL_SUFFIX, CHECKOUT_COMPLETE_SUFFIX, CHECKOUT_SESSIONS_PATH, UcpCheckoutHttpClient, type UcpCartHttpResult, type UcpCheckoutHttpClientOptions, type UcpCheckoutHttpError, type UcpCheckoutHttpErrorCode, type UcpCheckoutHttpResult, } from "./client.js";
+export { findCartEndpoint, findCheckoutEndpoint, profileHasCartCapability, type FindCheckoutEndpointOptions, } from "./endpoint.js";
+export { CART_CAPABILITY, CART_SPEC_VERSION, UCP_CART_FAILURE_CODES, type UcpCart, type UcpCartErrorResponse, type UcpCartFailureCode, type UcpCartLineItem, type UcpCartLink, type UcpCartMessage, type UcpCartResponse, type UcpCartResult, type UcpCartTotals, } from "./cart-types.js";
+export { isUcpCartErrorResponse, isUcpCartSuccess, parseUcpCartResponse, } from "./cart-parse.js";
+export { UcpCartChannel, type UcpCartChannelOptions, } from "./cart-channel.js";
+export { UcpCheckoutParseError, decideMessages, decideResponse, groupMessages, isUcpCheckoutErrorResponse, isUcpCheckoutSuccessSession, parseUcpCheckoutResponse, summarizeMessages, type CheckoutAction, type CheckoutDecision, type MessageGrouping, } from "./parse.js";
+export { validateTotals, type TotalsValidationResult } from "./totals.js";
+export { DEFAULT_EXPIRY_MS, UCP_CHECKOUT_FAILURE_CODES, UCP_CHECKOUT_SPEC_VERSION, UCP_CHECKOUT_STATUSES, UCP_MESSAGE_SEVERITIES, UCP_MESSAGE_TYPES, type UcpCheckoutErrorResponse, type UcpCheckoutFailureCode, type UcpCheckoutLineItem, type UcpCheckoutLink, type UcpCheckoutMessage, type UcpCheckoutResponse, type UcpCheckoutResult, type UcpCheckoutSession, type UcpCheckoutStatus, type UcpCheckoutTotals, type UcpMessageSeverity, type UcpMessageType, } from "./types.js";

package/dist/handoff/ucp-checkout/index.js

@@ -0,0 +1,36 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Kiwi v0.7.0 Transaction Handoff（WP2）— UCP Checkout client。
+ *
+ * HandoffChannel 的真实 UCP 版本：在外部交易系统（business 为 Merchant of Record）
+ * 上创建 / 读取 / 全量替换更新 / 请求完成 / 取消 checkout session。与 WP1 的
+ * 同步接缝 `HandoffChannel` 相对，本包提供异步投影 `AsyncHandoffChannel`；
+ * `requestCompletion` 复用 WP1 完成门禁（completion.ts），通过后才发 Complete，
+ * 且只附 authorization 证据引用（不构造任何支付凭据）。
+ *
+ * 零新增依赖：Node 22 原生 fetch + AbortController；SSRF 复用 a2a url-policy。
+ */
+export { UcpCheckoutChannel, } from "./channel.js";
+export { CART_CANCEL_SUFFIX, CARTS_PATH, CHECKOUT_CANCEL_SUFFIX, CHECKOUT_COMPLETE_SUFFIX, CHECKOUT_SESSIONS_PATH, UcpCheckoutHttpClient, } from "./client.js";
+export { findCartEndpoint, findCheckoutEndpoint, profileHasCartCapability, } from "./endpoint.js";
+export { CART_CAPABILITY, CART_SPEC_VERSION, UCP_CART_FAILURE_CODES, } from "./cart-types.js";
+export { isUcpCartErrorResponse, isUcpCartSuccess, parseUcpCartResponse, } from "./cart-parse.js";
+export { UcpCartChannel, } from "./cart-channel.js";
+export { UcpCheckoutParseError, decideMessages, decideResponse, groupMessages, isUcpCheckoutErrorResponse, isUcpCheckoutSuccessSession, parseUcpCheckoutResponse, summarizeMessages, } from "./parse.js";
+export { validateTotals } from "./totals.js";
+export { DEFAULT_EXPIRY_MS, UCP_CHECKOUT_FAILURE_CODES, UCP_CHECKOUT_SPEC_VERSION, UCP_CHECKOUT_STATUSES, UCP_MESSAGE_SEVERITIES, UCP_MESSAGE_TYPES, } from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/handoff/ucp-checkout/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/handoff/ucp-checkout/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;GAUG;AAEH,OAAO,EACL,kBAAkB,GAInB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,qBAAqB,GAMtB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,wBAAwB,GAEzB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,sBAAsB,GAUvB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,GAEf,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,aAAa,EACb,0BAA0B,EAC1B,2BAA2B,EAC3B,wBAAwB,EACxB,iBAAiB,GAIlB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,cAAc,EAA+B,MAAM,aAAa,CAAC;AAE1E,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,GAalB,MAAM,YAAY,CAAC"}