@proxy-checkout/stripe-server-js 0.1.0-prx-146.162.1 → 0.1.0

package/dist/cjs/metadata.js

@@ -8,22 +8,17 @@
  * provides assertions that a Stripe object actually belongs to a Proxy session.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PROXY_CONTRACT_VERSION_METADATA_KEY = exports.PROXY_ACQUISITION_ATTEMPT_METADATA_KEY = exports.PROXY_INTEGRATION_PATH_METADATA_KEY = exports.PROXY_SESSION_METADATA_KEY = void 0;
+exports.PROXY_INTEGRATION_PATH_METADATA_KEY = exports.PROXY_SESSION_METADATA_KEY = void 0;
 exports.requiredMetadata = requiredMetadata;
 exports.injectRequiredCheckoutSessionMetadata = injectRequiredCheckoutSessionMetadata;
-exports.assertCheckoutSessionMetadataPreflight = assertCheckoutSessionMetadataPreflight;
-exports.injectRequiredPaymentIntentMetadata = injectRequiredPaymentIntentMetadata;
 exports.assertCheckoutSessionBelongsToProxy = assertCheckoutSessionBelongsToProxy;
 exports.assertSubscriptionBelongsToProxy = assertSubscriptionBelongsToProxy;
 exports.assertPaymentIntentBelongsToProxy = assertPaymentIntentBelongsToProxy;
-exports.assertProviderObjectBelongsToAcquisition = assertProviderObjectBelongsToAcquisition;
 const server_js_1 = require("@proxy-checkout/server-js");
 /** The single metadata key Proxy reads to correlate a Stripe object to a session. */
 exports.PROXY_SESSION_METADATA_KEY = "proxy_session_id";
 /** Server-owned marker that distinguishes Checkout-created child objects from direct objects. */
 exports.PROXY_INTEGRATION_PATH_METADATA_KEY = "proxy_integration_path";
-exports.PROXY_ACQUISITION_ATTEMPT_METADATA_KEY = "proxy_acquisition_attempt_id";
-exports.PROXY_CONTRACT_VERSION_METADATA_KEY = "proxy_contract_version";
 /** Build the required Stripe metadata placements for a Proxy session. */
 function requiredMetadata(proxySession) {
     const metadata = { proxy_session_id: proxySession.id };
@@ -40,8 +35,8 @@ function requiredMetadata(proxySession) {
  * every object Proxy may later need to correlate. Conflicting merchant-provided
  * proxy metadata fails before any Stripe side effect.
  */
-function injectRequiredCheckoutSessionMetadata(params, proxySessionId, acquisition) {
-    const metadata = acquisitionMetadata(proxySessionId, acquisition);
+function injectRequiredCheckoutSessionMetadata(params, proxySessionId) {
+    const metadata = { proxy_session_id: proxySessionId };
     const checkoutMetadata = {
         ...metadata,
         [exports.PROXY_INTEGRATION_PATH_METADATA_KEY]: "checkout_session",
@@ -67,44 +62,6 @@ function injectRequiredCheckoutSessionMetadata(params, proxySessionId, acquisiti
             : {}),
     };
 }
-/**
- * Validate merchant-authored Checkout metadata before reserving an acquisition.
- * The acquisition ID does not exist yet, so those reservation-owned keys must
- * be absent until the shared create owner injects their exact values.
- */
-function assertCheckoutSessionMetadataPreflight(params, proxySessionId) {
-    for (const [field, metadata] of [
-        ["metadata", params.metadata],
-        ["payment_intent_data.metadata", metadataFromNestedParams(params.payment_intent_data)],
-        ["subscription_data.metadata", metadataFromNestedParams(params.subscription_data)],
-    ]) {
-        for (const key of [
-            exports.PROXY_ACQUISITION_ATTEMPT_METADATA_KEY,
-            exports.PROXY_CONTRACT_VERSION_METADATA_KEY,
-        ]) {
-            if (metadata?.[key] !== undefined) {
-                throw new server_js_1.ProxyCheckoutValidationError(`Stripe ${field}.${key} is owned by the Proxy acquisition reservation and must not be supplied by the merchant.`, { code: "provider_binding_mismatch", field: `${field}.${key}` });
-            }
-        }
-    }
-    // Pure construction performs every session/path conflict check without
-    // contacting Proxy or Stripe. The returned params are intentionally ignored;
-    // the reservation-derived injection still happens exactly once in create.
-    injectRequiredCheckoutSessionMetadata(params, proxySessionId);
-}
-/** Inject the server-owned acquisition identity into a direct PaymentIntent. */
-function injectRequiredPaymentIntentMetadata(params, input) {
-    const required = {
-        [exports.PROXY_ACQUISITION_ATTEMPT_METADATA_KEY]: input.acquisitionAttemptId,
-        [exports.PROXY_CONTRACT_VERSION_METADATA_KEY]: "2",
-        [exports.PROXY_INTEGRATION_PATH_METADATA_KEY]: "payment_intent",
-        [exports.PROXY_SESSION_METADATA_KEY]: input.proxySessionId,
-    };
-    return {
-        ...params,
-        metadata: mergeProxyMetadata(params.metadata, required, "metadata"),
-    };
-}
 /** Assert a Stripe Checkout Session carries the expected `proxy_session_id` metadata. */
 function assertCheckoutSessionBelongsToProxy(checkoutSession, proxySessionId) {
     assertProxyMetadata(checkoutSession.metadata, proxySessionId, "Stripe checkout session");
@@ -117,39 +74,12 @@ function assertSubscriptionBelongsToProxy(subscription, proxySessionId) {
 function assertPaymentIntentBelongsToProxy(paymentIntent, proxySessionId) {
     assertProxyMetadata(paymentIntent.metadata, proxySessionId, "Stripe payment intent");
 }
-/** Assert the provider root carries the exact reserved acquisition identity. */
-function assertProviderObjectBelongsToAcquisition(object, input) {
-    assertProxyMetadata(object.metadata, input.proxySessionId, "Stripe provider object");
-    const acquisitionId = object.metadata?.[exports.PROXY_ACQUISITION_ATTEMPT_METADATA_KEY];
-    const contractVersion = object.metadata?.[exports.PROXY_CONTRACT_VERSION_METADATA_KEY];
-    const integrationPath = object.metadata?.[exports.PROXY_INTEGRATION_PATH_METADATA_KEY];
-    if (acquisitionId !== input.acquisitionAttemptId) {
-        throw new server_js_1.ProxyCheckoutValidationError(`Stripe provider object metadata.${exports.PROXY_ACQUISITION_ATTEMPT_METADATA_KEY} does not match the reserved Proxy acquisition.`, { code: "provider_binding_mismatch", field: exports.PROXY_ACQUISITION_ATTEMPT_METADATA_KEY });
-    }
-    if (contractVersion !== "2") {
-        throw new server_js_1.ProxyCheckoutValidationError(`Stripe provider object metadata.${exports.PROXY_CONTRACT_VERSION_METADATA_KEY} must be 2.`, { code: "provider_binding_mismatch", field: exports.PROXY_CONTRACT_VERSION_METADATA_KEY });
-    }
-    if (integrationPath !== input.integrationPath) {
-        throw new server_js_1.ProxyCheckoutValidationError(`Stripe provider object metadata.${exports.PROXY_INTEGRATION_PATH_METADATA_KEY} does not match ${input.integrationPath}.`, { code: "provider_binding_mismatch", field: exports.PROXY_INTEGRATION_PATH_METADATA_KEY });
-    }
-}
 function assertProxyMetadata(metadata, proxySessionId, objectLabel) {
     const value = metadata?.[exports.PROXY_SESSION_METADATA_KEY];
     if (value !== proxySessionId) {
         throw new server_js_1.ProxyCheckoutValidationError(`${objectLabel} metadata.${exports.PROXY_SESSION_METADATA_KEY} (${value ?? "missing"}) does not match Proxy session ${proxySessionId}.`, { code: "provider_binding_mismatch", field: `metadata.${exports.PROXY_SESSION_METADATA_KEY}` });
     }
 }
-function acquisitionMetadata(proxySessionId, acquisition) {
-    return {
-        ...(acquisition
-            ? {
-                [exports.PROXY_ACQUISITION_ATTEMPT_METADATA_KEY]: acquisition.id,
-                [exports.PROXY_CONTRACT_VERSION_METADATA_KEY]: acquisition.contractVersion,
-            }
-            : {}),
-        [exports.PROXY_SESSION_METADATA_KEY]: proxySessionId,
-    };
-}
 function mergeProxyMetadata(existing, required, field) {
     for (const [key, requiredValue] of Object.entries(required)) {
         const existingValue = existing?.[key];

package/dist/cjs/open-checkout.d.cts

@@ -7,7 +7,6 @@
  * metadata placement, idempotency, and binding reconciliation.
  */
 import type { JsonObject, PayerOpenedResult, ProxyCartValidator, ProxyCheckoutServerClient, ProxySessionProviderBinding } from "@proxy-checkout/server-js";
-import { type StripeCompatibilityDescriptor } from "./compatibility.js";
 import type { StripeCheckoutSessionCreateParams, StripeCheckoutSessionLike, StripeClientLike, StripeRequestOptionsWithoutIdempotencyLike } from "./types.js";
 export interface OpenCheckoutOptions<TStripe extends StripeClientLike, TCart, TOffer> {
     /** Builds app-specific Stripe Checkout Session params. Proxy metadata is injected by the SDK. */
@@ -19,13 +18,8 @@ export interface OpenCheckoutOptions<TStripe extends StripeClientLike, TCart, TO
     }) => Promise<StripeCheckoutSessionCreateParams> | StripeCheckoutSessionCreateParams;
     /** Optional schema validating the session cart snapshot into a typed cart. */
     readonly cartSchema?: ProxyCartValidator<TCart>;
-    /** New acquisition contract. Omit with the other acquisition fields only for 0.0.x compatibility. */
-    readonly commercialMode?: "one_time" | "subscription";
-    readonly compatibility?: StripeCompatibilityDescriptor;
     /** Optional extractor used to assert the cart buyer reference matches the session. */
     readonly getCartBuyerReference?: (cart: TCart) => string | null | undefined;
-    /** New acquisition contract. Defaults are intentionally not guessed for explicit callers. */
-    readonly pricingMode?: "fixed" | "provider_finalized";
     /** A Proxy server SDK client. */
     readonly proxy: ProxyCheckoutServerClient;
     readonly proxySessionId: string;
@@ -40,12 +34,8 @@ export interface OpenCheckoutOptions<TStripe extends StripeClientLike, TCart, TO
     readonly requestId?: string;
     /** The merchant's Stripe instance. */
     readonly stripe: TStripe;
-    /** Convenience alias for compatibility.apiVersion. */
-    readonly stripeApiVersion?: string;
     /** Optional Stripe request options. The SDK owns the deterministic idempotency key. */
     readonly stripeRequestOptions?: StripeRequestOptionsWithoutIdempotencyLike;
-    /** Semantic Checkout presentation. Provider aliases are normalized per Stripe generation. */
-    readonly uiMode?: "custom" | "embedded" | "hosted";
     /** Optional merchant cart validation that derives an app-specific offer. */
     readonly validateCart?: (input: {
         cart: TCart;
@@ -59,26 +49,15 @@ export interface OpenCheckoutReconciledCart<TCart> {
     readonly currency: string;
 }
 export interface OpenCheckoutResult<TCart, TOffer, TSession> {
-    readonly acquisitionAttemptId?: string;
     readonly binding: ProxySessionProviderBinding;
     readonly cart: TCart;
     readonly checkoutSession: TSession;
-    readonly checkoutSessionId?: string;
     readonly clientSecret: string | null;
     readonly offer: TOffer;
     readonly outcome: "ready";
-    readonly presentation?: {
-        readonly kind: "client_secret";
-        readonly clientSecret: string;
-        readonly uiMode: "custom" | "embedded";
-    } | {
-        readonly kind: "redirect";
-        readonly url: string;
-    };
     readonly proxySession: PayerOpenedResult;
     readonly proxySessionId: string;
 }
-export type OpenCheckoutPresentation = NonNullable<OpenCheckoutResult<unknown, unknown, unknown>["presentation"]>;
 export type OpenCheckoutTerminalResult<TCart> = {
     readonly cart: TCart;
     readonly outcome: "already_paid";

package/dist/cjs/open-checkout.d.ts

@@ -7,7 +7,6 @@
  * metadata placement, idempotency, and binding reconciliation.
  */
 import type { JsonObject, PayerOpenedResult, ProxyCartValidator, ProxyCheckoutServerClient, ProxySessionProviderBinding } from "@proxy-checkout/server-js";
-import { type StripeCompatibilityDescriptor } from "./compatibility.js";
 import type { StripeCheckoutSessionCreateParams, StripeCheckoutSessionLike, StripeClientLike, StripeRequestOptionsWithoutIdempotencyLike } from "./types.js";
 export interface OpenCheckoutOptions<TStripe extends StripeClientLike, TCart, TOffer> {
     /** Builds app-specific Stripe Checkout Session params. Proxy metadata is injected by the SDK. */
@@ -19,13 +18,8 @@ export interface OpenCheckoutOptions<TStripe extends StripeClientLike, TCart, TO
     }) => Promise<StripeCheckoutSessionCreateParams> | StripeCheckoutSessionCreateParams;
     /** Optional schema validating the session cart snapshot into a typed cart. */
     readonly cartSchema?: ProxyCartValidator<TCart>;
-    /** New acquisition contract. Omit with the other acquisition fields only for 0.0.x compatibility. */
-    readonly commercialMode?: "one_time" | "subscription";
-    readonly compatibility?: StripeCompatibilityDescriptor;
     /** Optional extractor used to assert the cart buyer reference matches the session. */
     readonly getCartBuyerReference?: (cart: TCart) => string | null | undefined;
-    /** New acquisition contract. Defaults are intentionally not guessed for explicit callers. */
-    readonly pricingMode?: "fixed" | "provider_finalized";
     /** A Proxy server SDK client. */
     readonly proxy: ProxyCheckoutServerClient;
     readonly proxySessionId: string;
@@ -40,12 +34,8 @@ export interface OpenCheckoutOptions<TStripe extends StripeClientLike, TCart, TO
     readonly requestId?: string;
     /** The merchant's Stripe instance. */
     readonly stripe: TStripe;
-    /** Convenience alias for compatibility.apiVersion. */
-    readonly stripeApiVersion?: string;
     /** Optional Stripe request options. The SDK owns the deterministic idempotency key. */
     readonly stripeRequestOptions?: StripeRequestOptionsWithoutIdempotencyLike;
-    /** Semantic Checkout presentation. Provider aliases are normalized per Stripe generation. */
-    readonly uiMode?: "custom" | "embedded" | "hosted";
     /** Optional merchant cart validation that derives an app-specific offer. */
     readonly validateCart?: (input: {
         cart: TCart;
@@ -59,26 +49,15 @@ export interface OpenCheckoutReconciledCart<TCart> {
     readonly currency: string;
 }
 export interface OpenCheckoutResult<TCart, TOffer, TSession> {
-    readonly acquisitionAttemptId?: string;
     readonly binding: ProxySessionProviderBinding;
     readonly cart: TCart;
     readonly checkoutSession: TSession;
-    readonly checkoutSessionId?: string;
     readonly clientSecret: string | null;
     readonly offer: TOffer;
     readonly outcome: "ready";
-    readonly presentation?: {
-        readonly kind: "client_secret";
-        readonly clientSecret: string;
-        readonly uiMode: "custom" | "embedded";
-    } | {
-        readonly kind: "redirect";
-        readonly url: string;
-    };
     readonly proxySession: PayerOpenedResult;
     readonly proxySessionId: string;
 }
-export type OpenCheckoutPresentation = NonNullable<OpenCheckoutResult<unknown, unknown, unknown>["presentation"]>;
 export type OpenCheckoutTerminalResult<TCart> = {
     readonly cart: TCart;
     readonly outcome: "already_paid";

package/dist/cjs/open-checkout.js

@@ -10,15 +10,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.openCheckout = openCheckout;
 const server_js_1 = require("@proxy-checkout/server-js");
-const acquisition_js_1 = require("./acquisition.js");
-const compatibility_js_1 = require("./compatibility.js");
 const errors_js_1 = require("./errors.js");
 const metadata_js_1 = require("./metadata.js");
 const psp_js_1 = require("./psp.js");
 async function openCheckout(options) {
-    if (usesAcquisitionContract(options)) {
-        return openAcquisitionCheckout(options);
-    }
     // Normalize the same way the API does on store, so the binding is recorded
     // under the normalized psp and later syncCheckoutCart validations compare
     // normalized-to-normalized.
@@ -138,7 +133,7 @@ async function openCheckout(options) {
     const checkoutSession = (await options.stripe.checkout.sessions.create((0, metadata_js_1.injectRequiredCheckoutSessionMetadata)(params, proxySession.id), buildStripeRequestOptions(options, proxySession.id, psp)));
     // Fail closed if the merchant forgot to place proxy_session_id metadata.
     (0, metadata_js_1.assertCheckoutSessionBelongsToProxy)(checkoutSession, proxySession.id);
-    const binding = await (0, acquisition_js_1.recordOrReconcileLegacyCheckoutBinding)({
+    const binding = await recordOrReconcileProviderBinding({
         checkoutSessionId: checkoutSession.id,
         expectedCartVersion: proxySession.cartVersion,
         commercialMode,
@@ -160,310 +155,6 @@ async function openCheckout(options) {
         proxySessionId: proxySession.id,
     };
 }
-async function openAcquisitionCheckout(options) {
-    if (options.commercialMode !== "one_time" ||
-        (options.uiMode !== "hosted" && options.uiMode !== "embedded" && options.uiMode !== "custom") ||
-        options.pricingMode === undefined) {
-        throw new errors_js_1.UnsupportedStripeOptionError("The explicit Checkout acquisition contract supports one_time hosted, embedded, and custom presentations only.", "uiMode");
-    }
-    if ((0, psp_js_1.normalizePsp)(options.psp ?? "stripe") !== "stripe") {
-        throw new errors_js_1.UnsupportedStripeOptionError("The Stripe acquisition helper cannot route provider creation through another PSP.", "psp");
-    }
-    (0, acquisition_js_1.assertNoConnectRequestOptions)(options.stripeRequestOptions);
-    const compatibility = compatibilityDescriptor(options);
-    (0, compatibility_js_1.assertStripePathCompatibility)(checkoutCompatibilityPath(options.uiMode), compatibility);
-    let proxySession = await options.proxy.sessions.payerOpened(options.proxySessionId, {
-        requestId: options.requestId,
-    });
-    let cart = parseCheckoutCart(options, proxySession);
-    if (proxySession.presentationState !== "checkout_available") {
-        return terminalResultFromSession(proxySession, cart);
-    }
-    let offer = options.validateCart
-        ? await options.validateCart({ cart, session: proxySession })
-        : undefined;
-    const reconciledCart = await options.reconcileCart?.({ cart, offer, session: proxySession });
-    if (reconciledCart) {
-        if (options.getCartBuyerReference) {
-            (0, server_js_1.assertCartBuyerReference)(options.getCartBuyerReference(reconciledCart.cart), proxySession);
-        }
-        try {
-            const updated = await options.proxy.sessions.cart.set(proxySession.id, {
-                amountMinor: reconciledCart.amountMinor,
-                cartSnapshot: reconciledCart.cartSnapshot,
-                currency: reconciledCart.currency,
-                expectedCartVersion: proxySession.cartVersion,
-                requestId: options.requestId,
-            });
-            proxySession = {
-                ...proxySession,
-                amountMinor: updated.amountMinor,
-                cartSnapshot: updated.cartSnapshot,
-                cartVersion: updated.cartVersion,
-                currency: updated.currency,
-            };
-        }
-        catch (cause) {
-            if (!isProxyConflict(cause))
-                throw cause;
-            const joined = await options.proxy.sessions.payerOpened(proxySession.id, {
-                requestId: options.requestId,
-            });
-            if (!sameCheckoutCart(joined, reconciledCart))
-                throw cause;
-            proxySession = joined;
-        }
-        cart = reconciledCart.cart;
-        if (options.validateCart)
-            offer = await options.validateCart({ cart, session: proxySession });
-    }
-    const current = await options.proxy.sessions.payerOpened(proxySession.id, {
-        requestId: options.requestId,
-    });
-    if (current.presentationState !== "checkout_available") {
-        return terminalResultFromSession(current, cart);
-    }
-    if (!sameCheckoutCart(current, proxySession)) {
-        throw new server_js_1.ProxyCheckoutValidationError(`Proxy session ${proxySession.id} cart changed while Checkout was being prepared.`, { code: "cart_version_conflict", field: "cart_version" });
-    }
-    proxySession = current;
-    const builtParams = await options.buildCheckoutSessionParams({
-        cart,
-        offer,
-        proxySession,
-        stripe: options.stripe,
-    });
-    validateAcquisitionCheckoutParams(builtParams, options, proxySession);
-    (0, metadata_js_1.assertCheckoutSessionMetadataPreflight)(builtParams, proxySession.id);
-    // Stripe 12 has no hosted ui_mode create field, while newer Stripe responses
-    // name the same provider value hosted_page. Omit only the hosted provider
-    // alias; client-secret paths must send their exact generation-specific mode.
-    const params = options.uiMode === "hosted" ? withoutHostedProviderUiMode(builtParams) : builtParams;
-    if (options.pricingMode === "fixed" && proxySession.amountMinor === 0) {
-        (0, compatibility_js_1.assertHostedNoCostCompatibility)(compatibility);
-    }
-    const providerOptionsFingerprint = (0, acquisition_js_1.fingerprintHostedCheckoutProviderOptions)(params);
-    const acquisitionResult = await (0, acquisition_js_1.acquireStripeRoot)({
-        checkoutUiMode: options.uiMode,
-        commercialMode: "one_time",
-        integrationPath: "checkout_session",
-        objectType: "checkout_session",
-        pricingMode: options.pricingMode,
-        create: async (reservation) => {
-            const created = (await options.stripe.checkout.sessions.create((0, metadata_js_1.injectRequiredCheckoutSessionMetadata)(params, proxySession.id, {
-                contractVersion: "2",
-                id: reservation.acquisitionAttempt.id,
-            }), {
-                ...options.stripeRequestOptions,
-                idempotencyKey: reservation.stripe.idempotencyKeys.root,
-            }));
-            return (await (0, acquisition_js_1.retrieveCheckoutSessionWithLineEvidence)({
-                id: created.id,
-                initial: created,
-                requestOptions: options.stripeRequestOptions,
-                stripe: options.stripe,
-            }));
-        },
-        providerOptionsFingerprint,
-        proxy: options.proxy,
-        proxySession,
-        requestId: options.requestId,
-        retrieve: async (id) => (await (0, acquisition_js_1.retrieveCheckoutSessionWithLineEvidence)({
-            id,
-            requestOptions: options.stripeRequestOptions,
-            stripe: options.stripe,
-        })),
-        toConfirmation: (session) => (0, acquisition_js_1.checkoutCartConfirmation)({
-            cartVersion: proxySession.cartVersion,
-            checkoutSession: session,
-            expectedLineItems: params.line_items,
-        }),
-        validateObject: (session, acquisition) => {
-            (0, metadata_js_1.assertProviderObjectBelongsToAcquisition)(session, {
-                acquisitionAttemptId: acquisition.id,
-                integrationPath: "checkout_session",
-                proxySessionId: proxySession.id,
-            });
-            assertCheckoutProviderCart(session, proxySession, options.pricingMode ?? "fixed", params.line_items, options.uiMode ?? "hosted");
-        },
-    });
-    if (acquisitionResult.outcome === "terminal") {
-        return terminalResultFromSession(acquisitionResult.proxySession, cart);
-    }
-    const acquired = acquisitionResult;
-    const presentation = checkoutPresentation(acquired.object, options.uiMode);
-    return {
-        acquisitionAttemptId: acquired.acquisition.id,
-        binding: {
-            providerCheckoutSessionId: acquired.object.id,
-            proxySessionId: proxySession.id,
-            psp: "stripe",
-            updatedAt: acquired.acquisition.updatedAt,
-        },
-        cart,
-        checkoutSession: acquired.object,
-        checkoutSessionId: acquired.object.id,
-        clientSecret: presentation.kind === "client_secret" ? presentation.clientSecret : null,
-        offer,
-        outcome: "ready",
-        presentation,
-        proxySession,
-        proxySessionId: proxySession.id,
-    };
-}
-function usesAcquisitionContract(options) {
-    const values = [options.commercialMode, options.pricingMode, options.uiMode];
-    const count = values.filter((value) => value !== undefined).length;
-    if (count !== 0 && count !== values.length) {
-        throw new server_js_1.ProxyCheckoutValidationError("commercialMode, pricingMode, and uiMode must be supplied together for the acquisition contract.", { code: "unsupported_provider_option", field: "commercialMode" });
-    }
-    return count === values.length;
-}
-function parseCheckoutCart(options, proxySession) {
-    return options.cartSchema || options.getCartBuyerReference
-        ? options.proxy.sessions.parseCart(proxySession, options.cartSchema ?? ((value) => value), { getBuyerReference: options.getCartBuyerReference })
-        : proxySession.cartSnapshot;
-}
-function compatibilityDescriptor(options) {
-    if (!options.compatibility && !options.stripeApiVersion)
-        return undefined;
-    return {
-        ...options.compatibility,
-        ...(options.stripeApiVersion ? { apiVersion: options.stripeApiVersion } : {}),
-    };
-}
-function validateAcquisitionCheckoutParams(params, options, proxySession) {
-    assertCheckoutAutomaticRecoveryDisabled(params, proxySession.id);
-    if (checkoutCommercialMode(params, proxySession.id) !== options.commercialMode) {
-        throw new errors_js_1.UnsupportedStripeOptionError("Stripe Checkout mode does not match commercialMode.", "mode");
-    }
-    const uiMode = normalizeProviderUiMode(params.ui_mode);
-    if (uiMode !== options.uiMode) {
-        throw new errors_js_1.UnsupportedStripeOptionError(`Stripe Checkout ui_mode ${uiMode} does not match requested ${options.uiMode}.`, "ui_mode");
-    }
-    if (uiMode === "hosted" && !params.success_url) {
-        throw new errors_js_1.UnsupportedStripeOptionError("Hosted Stripe Checkout requires success_url.", "success_url");
-    }
-    if (uiMode === "hosted" && params.return_url !== undefined) {
-        throw new errors_js_1.UnsupportedStripeOptionError("Hosted Stripe Checkout uses success_url and must not set return_url.", "return_url");
-    }
-    if (uiMode !== "hosted" && !params.return_url) {
-        throw new errors_js_1.UnsupportedStripeOptionError(`${uiMode} Stripe Checkout requires return_url.`, "return_url");
-    }
-    if (uiMode !== "hosted" && params.success_url !== undefined) {
-        throw new errors_js_1.UnsupportedStripeOptionError(`${uiMode} Stripe Checkout uses return_url and must not set success_url.`, "success_url");
-    }
-    const paymentIntentData = objectRecord(params.payment_intent_data);
-    for (const field of [
-        "application_fee_amount",
-        "application_fee_percent",
-        "capture_method",
-        "on_behalf_of",
-        "transfer_data",
-        "transfer_group",
-    ]) {
-        if (paymentIntentData[field] !== undefined) {
-            throw new errors_js_1.UnsupportedStripeOptionError(`One-time Checkout does not support payment_intent_data.${field}.`, `payment_intent_data.${field}`);
-        }
-    }
-    if (options.pricingMode === "fixed") {
-        for (const field of [
-            "allow_promotion_codes",
-            "shipping_address_collection",
-            "shipping_options",
-        ]) {
-            const value = params[field];
-            if (value !== undefined && value !== false) {
-                throw new errors_js_1.UnsupportedStripeOptionError(`Fixed-price Checkout cannot use provider-finalized option ${field}.`, field);
-            }
-        }
-        for (const field of ["adaptive_pricing", "automatic_tax"]) {
-            const value = objectRecord(params[field]);
-            if (value.enabled === true) {
-                throw new errors_js_1.UnsupportedStripeOptionError(`Fixed-price Checkout cannot enable provider-finalized option ${field}.`, `${field}.enabled`);
-            }
-        }
-        const lineItems = Array.isArray(params.line_items) ? params.line_items : [];
-        if (lineItems.some((line) => objectRecord(objectRecord(line).adjustable_quantity).enabled === true)) {
-            throw new errors_js_1.UnsupportedStripeOptionError("Fixed-price Checkout cannot enable adjustable line-item quantities.", "line_items.adjustable_quantity.enabled");
-        }
-    }
-}
-function assertCheckoutProviderCart(checkoutSession, proxySession, pricingMode, expectedLineItems, requestedUiMode) {
-    const confirmation = (0, acquisition_js_1.checkoutCartConfirmation)({
-        cartVersion: 0,
-        checkoutSession,
-        expectedLineItems,
-    });
-    if (checkoutSession.mode !== undefined &&
-        checkoutSession.mode !== null &&
-        checkoutSession.mode !== "payment") {
-        throw new errors_js_1.StripeResponseShapeError("Stripe Checkout response is not payment mode.", "mode");
-    }
-    if (normalizeProviderUiMode(checkoutSession.ui_mode) !== requestedUiMode) {
-        throw new errors_js_1.StripeResponseShapeError(`Stripe Checkout response is not ${requestedUiMode} UI mode.`, "ui_mode");
-    }
-    if (confirmation.currency !== proxySession.currency ||
-        (pricingMode === "fixed" && confirmation.amountMinor !== proxySession.amountMinor)) {
-        throw new server_js_1.ProxyCheckoutValidationError(`Stripe Checkout Session ${checkoutSession.id} does not represent the current Proxy cart amount and currency.`, { code: "cart_version_conflict", field: "provider_amount" });
-    }
-}
-function normalizeProviderUiMode(value) {
-    if (value === undefined || value === null || value === "hosted" || value === "hosted_page") {
-        return "hosted";
-    }
-    if (value === "embedded" || value === "embedded_page")
-        return "embedded";
-    if (value === "custom" || value === "elements")
-        return "custom";
-    return value;
-}
-function checkoutCompatibilityPath(uiMode) {
-    return `one_time.checkout.${uiMode}`;
-}
-function checkoutPresentation(checkoutSession, uiMode) {
-    const clientSecret = checkoutSession.client_secret;
-    const url = checkoutSession.url;
-    if (uiMode === "hosted") {
-        if (!isSafeHostedCheckoutUrl(url)) {
-            throw new errors_js_1.StripeResponseShapeError("Hosted Stripe Checkout response did not contain a safe HTTPS redirect URL.", "url");
-        }
-        if (clientSecret !== undefined && clientSecret !== null) {
-            throw new errors_js_1.StripeResponseShapeError("Hosted Stripe Checkout response unexpectedly contained a client secret.", "client_secret");
-        }
-        return { kind: "redirect", url };
-    }
-    if (!isCheckoutSessionClientSecret(clientSecret)) {
-        throw new errors_js_1.StripeResponseShapeError(`${uiMode} Stripe Checkout response did not contain a valid Checkout Session client secret.`, "client_secret");
-    }
-    if (url !== undefined && url !== null) {
-        throw new errors_js_1.StripeResponseShapeError(`${uiMode} Stripe Checkout response unexpectedly contained a hosted redirect URL.`, "url");
-    }
-    return { clientSecret, kind: "client_secret", uiMode };
-}
-function isCheckoutSessionClientSecret(value) {
-    return typeof value === "string" && /^cs_(?:test|live)_[A-Za-z0-9_]+$/.test(value);
-}
-function isSafeHostedCheckoutUrl(value) {
-    if (typeof value !== "string" || value !== value.trim())
-        return false;
-    try {
-        const parsed = new URL(value);
-        return parsed.protocol === "https:" && parsed.username === "" && parsed.password === "";
-    }
-    catch {
-        return false;
-    }
-}
-function withoutHostedProviderUiMode(params) {
-    if (params.ui_mode === undefined)
-        return params;
-    const { ui_mode: _providerUiMode, ...providerParams } = params;
-    return providerParams;
-}
-function objectRecord(value) {
-    return typeof value === "object" && value !== null ? value : {};
-}
 function terminalResultFromSession(proxySession, cart) {
     const common = {
         cart,
@@ -523,6 +214,31 @@ function bindingFromSession(proxySession) {
         updatedAt: proxySession.updatedAt,
     };
 }
+async function recordOrReconcileProviderBinding(input) {
+    try {
+        return await input.proxy.sessions.recordProviderBinding(input.proxySessionId, {
+            commercialMode: input.commercialMode,
+            expectedCartVersion: input.expectedCartVersion,
+            providerCheckoutSessionId: input.checkoutSessionId,
+            psp: input.psp,
+            requestId: input.requestId,
+        });
+    }
+    catch (cause) {
+        const reconciled = await readReconciledBinding(input).catch(() => undefined);
+        if (reconciled) {
+            return reconciled;
+        }
+        if (isProxyConflict(cause)) {
+            throw cause;
+        }
+        throw new errors_js_1.ProxyStripeOpenCheckoutError("Stripe Checkout Session was created but Proxy provider binding could not be recorded.", {
+            cause,
+            code: "provider_binding_failed",
+            providerCheckoutSessionId: input.checkoutSessionId,
+        });
+    }
+}
 function sameCheckoutCart(actual, expected) {
     return (actual.amountMinor === expected.amountMinor &&
         actual.currency === expected.currency &&
@@ -554,6 +270,18 @@ function assertCheckoutAutomaticRecoveryDisabled(params, proxySessionId) {
         throw new server_js_1.ProxyCheckoutValidationError(`Proxy session ${proxySessionId} does not allow Stripe Checkout automatic recovery because replacement roots require explicit Proxy supersession.`, { code: "unsupported_provider_option", field: "after_expiration.recovery.enabled" });
     }
 }
+async function readReconciledBinding(input) {
+    const current = await input.proxy.sessions.retrieve(input.proxySessionId, {
+        requestId: input.requestId,
+    });
+    if (current.providerCheckoutSessionId !== input.checkoutSessionId ||
+        current.providerCheckoutSessionPsp !== input.psp) {
+        return undefined;
+    }
+    const checkoutSession = await input.stripe.checkout.sessions.retrieve(input.checkoutSessionId, undefined, input.stripeRequestOptions);
+    (0, metadata_js_1.assertCheckoutSessionBelongsToProxy)(checkoutSession, input.proxySessionId);
+    return bindingFromSession(current);
+}
 function isProxyConflict(error) {
     return (typeof error === "object" &&
         error !== null &&

package/dist/cjs/sync-checkout-cart.d.cts

@@ -6,7 +6,7 @@
  * safest order with deterministic rollback/reconciliation on failure.
  */
 import { type JsonObject, type MerchantProxySession, type ProxyCartValidator, type ProxyCheckoutServerClient } from "@proxy-checkout/server-js";
-import type { StripeCheckoutSessionLike, StripeMutableCheckoutClientLike, StripeRequestOptionsWithoutIdempotencyLike } from "./types.js";
+import type { StripeCheckoutSessionLike, StripeClientLike, StripeRequestOptionsWithoutIdempotencyLike } from "./types.js";
 /** The next cart, expressed both as Proxy state and the typed merchant cart. */
 export interface SyncedCart<TCart> {
     readonly amountMinor: number;
@@ -14,7 +14,7 @@ export interface SyncedCart<TCart> {
     readonly cartSnapshot: JsonObject;
     readonly currency: string;
 }
-export interface SyncCheckoutCartOptions<TStripe extends StripeMutableCheckoutClientLike, TCart, TInput> {
+export interface SyncCheckoutCartOptions<TStripe extends StripeClientLike, TCart, TInput> {
     /** Compute the next cart from current state and the merchant input. */
     readonly buildNextCart: (input: {
         currentCart: TCart;
@@ -44,4 +44,4 @@ export interface SyncCheckoutCartResult<TCart> {
     readonly checkoutSession: StripeCheckoutSessionLike;
     readonly currency: string;
 }
-export declare function syncCheckoutCart<TStripe extends StripeMutableCheckoutClientLike, TCart, TInput>(options: SyncCheckoutCartOptions<TStripe, TCart, TInput>): Promise<SyncCheckoutCartResult<TCart>>;
+export declare function syncCheckoutCart<TStripe extends StripeClientLike, TCart, TInput>(options: SyncCheckoutCartOptions<TStripe, TCart, TInput>): Promise<SyncCheckoutCartResult<TCart>>;