@reactionary/acp 0.10.42 → 0.10.44

package/lib/reactionary-acp-server.js

@@ -1,30 +1,64 @@
 import {
+  CurrencySchema,
   createInitialRequestContext,
   getHttpProtocolResultAttributes,
   MemoryCache,
   traceProtocolInvocation,
   SessionSchema
 } from "@reactionary/core";
-import {
-  ReactionaryFeedGenerator,
-  acpProductFeedTransformer
-} from "@reactionary/feeds";
+import { createHash, timingSafeEqual } from "node:crypto";
 import {
   ACPCheckoutSessionStateSchema,
   ACPCompleteCheckoutSessionRequestSchema,
   ACPCreateCheckoutSessionRequestSchema,
-  ACPUpdateCheckoutSessionRequestSchema
+  ACPUpdateCheckoutSessionRequestSchema,
+  ACP_INTERVENTION_TYPES,
+  ACPOrderRecordSchema,
+  ACPAffiliateAttributionSchema,
+  ACPCancelCheckoutSessionRequestSchema,
+  ACPCartCreateRequestSchema,
+  ACPCartStateSchema,
+  ACPCartUpdateRequestSchema,
+  ACP_AUTHENTICATED_OUTCOMES
 } from "./acp-schemas.js";
+import { ACPIdempotency, ACP_MIN_IDEMPOTENCY_TTL_SECONDS } from "./acp-idempotency.js";
+import { ACPMcpEndpoint } from "./acp-mcp.js";
+import {
+  ACP_DISCOUNT_EXTENSION,
+  applyDiscountCodes,
+  getRequestedDiscountCodes,
+  toACPDiscounts
+} from "./acp-discounts.js";
+import { ACPOrderWebhooks } from "./acp-webhooks.js";
+import {
+  getHandlerPaymentMethod
+} from "./acp-payment-handlers.js";
 const ACP_SESSION_ID_HEADER = "acp-session-id";
 const SESSION_CACHE_KEY_PREFIX = "reactionary:acp:session";
 const CHECKOUT_SESSION_CACHE_KEY_PREFIX = "reactionary:acp:checkout-session";
+const ORDER_CACHE_KEY_PREFIX = "reactionary:acp:order";
+const CART_CACHE_KEY_PREFIX = "reactionary:acp:cart";
+function createBearerTokenAuthenticator(tokensByAgentId) {
+  const entries = Object.entries(tokensByAgentId);
+  return (request) => {
+    const match = /^Bearer\s+(.+)$/i.exec(request.headers.get("authorization") ?? "");
+    const token = match?.[1]?.trim();
+    if (!token) {
+      return void 0;
+    }
+    const agent = entries.find(([, candidate]) => secureEquals(candidate, token));
+    return agent ? { id: agent[0] } : void 0;
+  };
+}
 const DEFAULT_ACP_PLACEHOLDER_EMAIL = "pending@checkout.invalid";
 const DEFAULT_ACP_PAYMENT_AUTHORIZATION_WAIT = {
   timeoutMs: 1e4,
   intervalMs: 1e3
 };
 const ACP_DISCOVERY_PATHS = ["/.well-known/acp.json", "/.well-known/acp"];
-const ACP_DEFAULT_API_VERSION = "2026-01-30";
+const ACP_API_VERSION = "2026-04-17";
+const ACP_SUPPORTED_API_VERSIONS = [ACP_API_VERSION];
+const ACP_API_VERSION_HEADER = "api-version";
 class ReactionaryACPServer {
   constructor(clientFactory, options = {}) {
     this.clientFactory = clientFactory;
@@ -35,14 +69,45 @@ class ReactionaryACPServer {
     );
     this.checkoutSessionStore = new ReactionaryACPCheckoutSessionStore(
       this.options.sessionCache ?? new MemoryCache(),
-      this.options.checkoutSessionTtlSeconds ?? 60 * 60 * 24
+      this.options.checkoutSessionTtlSeconds ?? 60 * 60 * 24,
+      this.options.orderTtlSeconds ?? 60 * 60 * 24 * 90
+    );
+    this.idempotency = new ACPIdempotency(
+      this.options.sessionCache ?? new MemoryCache(),
+      Math.max(this.options.idempotencyTtlSeconds ?? 0, ACP_MIN_IDEMPOTENCY_TTL_SECONDS)
     );
-    assertACPClient(this.clientFactory(createInitialRequestContext()));
+    const client = this.clientFactory(createInitialRequestContext());
+    assertACPClient(client);
+    assertPaymentHandlers(this.options.paymentHandlers ?? []);
+    this.supportsDiscounts = Boolean(client.cart.applyCouponCode && client.cart.removeCouponCode);
+    this.mcp = this.options.mcp ? new ACPMcpEndpoint(
+      { name: this.options.name ?? "@reactionary/acp", version: this.options.version ?? "0.0.1" },
+      (restRequest) => this.fetch(restRequest)
+    ) : void 0;
+    this.webhooks = this.options.webhooks ? new ACPOrderWebhooks(this.options.webhooks) : void 0;
+    if (this.webhooks && !client.order?.getById) {
+      throw new Error("ACP order webhooks need the client operation order.getById.");
+    }
+    if (!this.webhooks) {
+      console.warn("ACP: order webhooks are disabled; configure `webhooks` (ACP requires order_create/order_update events).");
+    }
+    if (!this.options.orderPermalinkUrl) {
+      console.warn("ACP: orders are returned without permalink_url; configure `orderPermalinkUrl` (ACP requires a permalink).");
+    } else if (!this.options.orderPermalinkUrl.includes("{orderId}")) {
+      throw new Error("ACP orderPermalinkUrl must contain an {orderId} placeholder.");
+    }
+    if (!this.options.authenticate) {
+      console.warn("ACP: checkout endpoints are unauthenticated; configure `authenticate` (ACP requires agents to authenticate).");
+    }
   }
   clientFactory;
   options;
   sessionStore;
   checkoutSessionStore;
+  idempotency;
+  webhooks;
+  supportsDiscounts;
+  mcp;
   async fetch(request) {
     return traceProtocolInvocation(
       {
@@ -50,24 +115,76 @@ class ReactionaryACPServer {
         operation: `${request.method} ${getAcpOperationPath(request, this.options.basePath)}`,
         attributes: { "http.request.method": request.method }
       },
-      () => this.handleFetch(request),
+      async () => echoRequestHeaders(request, await this.handleFetch(request)),
       getHttpProtocolResultAttributes
     );
   }
   async handleFetch(request) {
+    if (this.mcp && getProtocolPathname(request, this.options.basePath) === "/mcp") {
+      const basePath = (this.options.basePath ?? "/acp").replace(/\/$/, "");
+      return this.mcp.handle(request, `${new URL(request.url).origin}${basePath}`);
+    }
+    let agent;
+    try {
+      agent = await this.authenticate(request);
+      if (isCheckoutPost(request, this.options.basePath)) {
+        assertSupportedApiVersion(request);
+      }
+    } catch (error) {
+      return toACPErrorResponse(error);
+    }
     const sessionId = await this.resolveSessionId(request);
     const requestContext = await this.createRequestContext(sessionId);
-    const requestedFeed = this.getRequestedProductFeed(request);
-    if (requestedFeed) {
-      requestContext.languageContext = requestedFeed.feed.languageContext;
+    const locale = this.resolveLocale(request);
+    if (locale) {
+      requestContext.languageContext = { ...requestContext.languageContext, locale };
+    }
+    const currency = await this.resolveCheckoutCurrency(request);
+    if (currency) {
+      requestContext.languageContext = {
+        ...requestContext.languageContext,
+        currencyCode: currency
+      };
     }
     const client = this.clientFactory(requestContext);
     assertACPClient(client);
-    const response = await this.handleRequest(request, client, requestContext, sessionId).catch((error) => toACPErrorResponse(error));
+    const handle = () => this.handleRequest(request, client, requestContext, sessionId, agent).catch((error) => toACPErrorResponse(error));
+    const response = isCheckoutPost(request, this.options.basePath) ? await this.idempotency.run(request, agent?.id ?? "anonymous", handle) : await handle();
     await this.sessionStore.put(sessionId, requestContext.session);
     response.headers.set(ACP_SESSION_ID_HEADER, sessionId);
     return response;
   }
+  /**
+   * Checkout endpoints require an authenticated agent (checkout RFC §3.1),
+   * and a checkout session is visible only to the agent that created it, so
+   * another agent's session is reported as missing. Discovery and the
+   * readiness document stay public.
+   */
+  async authenticate(request) {
+    const pathname = getProtocolPathname(request, this.options.basePath);
+    const cartRoute = getCartRoute(request, this.options.basePath);
+    if (!this.options.authenticate || !pathname.startsWith("/checkout_sessions") && !cartRoute) {
+      return void 0;
+    }
+    const agent = await this.options.authenticate(request);
+    if (!agent) {
+      throw new ACPHttpError(401, {
+        type: "invalid_request",
+        code: "unauthorized",
+        message: "A valid Authorization bearer token is required."
+      }, { "www-authenticate": "Bearer" });
+    }
+    const checkoutSessionId = getCheckoutSessionId(request, this.options.basePath);
+    const state = checkoutSessionId ? await this.checkoutSessionStore.get(checkoutSessionId) : cartRoute?.cartId ? await this.checkoutSessionStore.getCart(cartRoute.cartId) : void 0;
+    if (state?.agentId !== void 0 && state.agentId !== agent.id) {
+      throw new ACPHttpError(404, {
+        type: "invalid_request",
+        code: checkoutSessionId ? "missing" : "not_found",
+        message: checkoutSessionId ? `Checkout session not found: ${checkoutSessionId}` : `Cart not found: ${cartRoute?.cartId}`
+      });
+    }
+    return agent;
+  }
   /**
    * Requests addressing a checkout session resume the session that created
    * it: agents need not echo the ACP session header, but backends scope carts
@@ -75,9 +192,61 @@ class ReactionaryACPServer {
    */
   async resolveSessionId(request) {
     const checkoutSessionId = getCheckoutSessionId(request, this.options.basePath);
-    const state = checkoutSessionId ? await this.checkoutSessionStore.get(checkoutSessionId) : void 0;
+    const cartId = getCartRoute(request, this.options.basePath)?.cartId;
+    const state = checkoutSessionId ? await this.checkoutSessionStore.get(checkoutSessionId) : cartId ? await this.checkoutSessionStore.getCart(cartId) : void 0;
     return state?.sessionId ?? getOrCreateSessionId(request);
   }
+  /**
+   * The best supported locale for the request's Accept-Language: an exact
+   * tag, else one of the same language. Only locales advertised in
+   * `discovery.supportedLocales` are used, as backends may not localize
+   * others.
+   */
+  resolveLocale(request) {
+    const supported = this.options.discovery?.supportedLocales ?? [];
+    const requested = parseAcceptLanguage(request.headers.get("accept-language"));
+    for (const tag of requested) {
+      const exact = supported.find((locale) => locale.toLowerCase() === tag.toLowerCase());
+      const sameLanguage = supported.find(
+        (locale) => locale.split("-")[0]?.toLowerCase() === tag.split("-")[0]?.toLowerCase()
+      );
+      if (exact ?? sameLanguage) {
+        return exact ?? sameLanguage;
+      }
+    }
+    return void 0;
+  }
+  /**
+   * The currency a checkout session is priced in: the one requested on its
+   * creation, which later requests for the session keep using.
+   */
+  async resolveCheckoutCurrency(request) {
+    const checkoutSessionId = getCheckoutSessionId(request, this.options.basePath);
+    let currency;
+    if (checkoutSessionId) {
+      currency = (await this.checkoutSessionStore.get(checkoutSessionId))?.currency;
+    } else if (request.method === "POST" && getProtocolPathname(request, this.options.basePath) === "/checkout_sessions") {
+      const body = await request.clone().json().catch(() => void 0);
+      currency = typeof body === "object" && body !== null ? Reflect.get(body, "currency") : void 0;
+    }
+    const parsed = CurrencySchema.safeParse(typeof currency === "string" ? currency.toUpperCase() : void 0);
+    return parsed.success ? parsed.data : void 0;
+  }
+  /**
+   * Sends an `order_update` event with the order's current state, e.g. when
+   * the OMS ships or cancels it. Returns false for orders not placed through
+   * an ACP checkout session, or when webhooks are not configured.
+   */
+  async notifyOrderUpdated(orderId) {
+    const record = await this.checkoutSessionStore.getOrder(orderId);
+    if (!this.webhooks || !record) {
+      return false;
+    }
+    const requestContext = await this.createRequestContext(record.sessionId ?? crypto.randomUUID());
+    const client = this.clientFactory(requestContext);
+    assertACPClient(client);
+    return this.sendOrderEvent("order_update", record, client);
+  }
   getHandler() {
     return {
       fetch: (request) => this.fetch(request),
@@ -101,12 +270,12 @@ class ReactionaryACPServer {
     }
     return requestContext;
   }
-  async handleRequest(request, client, requestContext, sessionId) {
+  async handleRequest(request, client, requestContext, sessionId, agent) {
     if (request.method === "OPTIONS") {
       return new Response(null, {
         status: 204,
         headers: {
-          allow: "GET, HEAD, OPTIONS, POST"
+          allow: "GET, HEAD, OPTIONS, POST, PUT"
         }
       });
     }
@@ -116,31 +285,18 @@ class ReactionaryACPServer {
         omitBody: request.method === "HEAD"
       });
     }
+    const cartRoute = getCartRoute(request, this.options.basePath);
+    if (cartRoute) {
+      assertSupportedApiVersion(request);
+      return this.handleCartRequest(request, cartRoute, client, sessionId, agent);
+    }
     if (request.method === "GET" || request.method === "HEAD") {
-      const productFeedId = getProductFeedId(request, this.options.basePath);
-      if (productFeedId) {
-        const feed = this.getProductFeedDefinition(productFeedId);
-        if (!feed) {
-          return acpErrorResponse(404, {
-            type: "invalid_request",
-            code: "missing",
-            message: `Product feed not found: ${productFeedId}`
-          });
-        }
-        return this.getProductFeed(
-          request,
-          productFeedId,
-          feed,
-          client,
-          requestContext,
-          request.method === "HEAD"
-        );
-      }
       const checkoutSessionId = getCheckoutSessionId(
         request,
         this.options.basePath
       );
       if (checkoutSessionId) {
+        assertSupportedApiVersion(request);
         return this.getCheckoutSession(
           checkoutSessionId,
           client,
@@ -152,7 +308,8 @@ class ReactionaryACPServer {
       });
     }
     if (request.method === "POST") {
-      return this.handlePost(request, client, requestContext, sessionId);
+      assertSupportedApiVersion(request);
+      return this.handlePost(request, client, requestContext, sessionId, agent);
     }
     return jsonResponse({
       error: {
@@ -162,32 +319,108 @@ class ReactionaryACPServer {
     }, {
       status: 405,
       headers: {
-        allow: "GET, HEAD, OPTIONS, POST"
+        allow: "GET, HEAD, OPTIONS, POST, PUT"
       }
     });
   }
+  /**
+   * The cart capability (cart RFC): pre-checkout baskets over a backend
+   * cart. Carts have no status — they exist, or answer 404 once canceled or
+   * expired — and no payment or negotiation, which belong to checkout.
+   */
+  async handleCartRequest(request, route, client, sessionId, agent) {
+    if (!route.cartId) {
+      if (request.method !== "POST") {
+        return methodNotAllowed(request.method, "POST");
+      }
+      const input = await parseJsonBody(request, ACPCartCreateRequestSchema);
+      const cart = await this.createCartForItems(input.line_items, client);
+      const state2 = {
+        id: `cart_${crypto.randomUUID()}`,
+        cartId: cart.identifier.key,
+        sessionId,
+        ...agent ? { agentId: agent.id } : {},
+        ...input.buyer ? { buyer: input.buyer } : {},
+        expiresAt: this.getCartExpiry()
+      };
+      return jsonResponse(await this.toACPCart(state2, client), { status: 201 });
+    }
+    const state = await this.checkoutSessionStore.getCart(route.cartId);
+    if (!state) {
+      return acpErrorResponse(404, { type: "invalid_request", code: "not_found", message: `Cart not found: ${route.cartId}` });
+    }
+    if (route.cancel) {
+      if (request.method !== "POST") {
+        return methodNotAllowed(request.method, "POST");
+      }
+      const final = await this.toACPCart(state, client);
+      await this.checkoutSessionStore.deleteCart(state.id);
+      await client.cart.deleteCart?.({ cart: { key: state.cartId } });
+      return jsonResponse(final);
+    }
+    if (request.method === "GET" || request.method === "HEAD") {
+      return jsonResponse(await this.toACPCart(state, client), { omitBody: request.method === "HEAD" });
+    }
+    if (request.method === "PUT") {
+      const input = await parseJsonBody(request, ACPCartUpdateRequestSchema);
+      const updated = {
+        ...state,
+        cartId: await this.replaceCartItems(state.cartId, input.line_items, client),
+        buyer: mergeBuyer(state.buyer, input.buyer),
+        expiresAt: this.getCartExpiry()
+      };
+      return jsonResponse(await this.toACPCart(updated, client));
+    }
+    return methodNotAllowed(request.method, "GET, PUT");
+  }
+  getCartExpiry() {
+    return new Date(Date.now() + (this.options.checkoutSessionTtlSeconds ?? 60 * 60 * 24) * 1e3).toISOString();
+  }
+  /** A cart's authoritative state; totals are estimates without an address. */
+  async toACPCart(state, client) {
+    await this.checkoutSessionStore.putCart(state);
+    const cart = await unwrapACPResult(client.cart.getById({ cart: { key: state.cartId } }));
+    const products = await getProducts(cart.items.map((item) => item.variant.sku), client);
+    return {
+      id: state.id,
+      line_items: cart.items.map((item) => toACPLineItem(item, products.get(item.variant.sku))),
+      ...state.buyer ? { buyer: state.buyer } : {},
+      currency: cart.price.grandTotal.currency.toLowerCase(),
+      totals: toACPTotals(cart.price),
+      messages: await this.getStockMessages(cart, client),
+      expires_at: state.expiresAt
+    };
+  }
   getDiscoveryDocument(request) {
     const discovery = this.options.discovery ?? {};
-    const version = discovery.apiVersion ?? ACP_DEFAULT_API_VERSION;
-    const supportedVersions = discovery.supportedVersions ?? [version];
     const basePath = (this.options.basePath ?? "/acp").replace(/\/$/, "");
     const apiBaseUrl = discovery.apiBaseUrl ?? `${new URL(request.url).origin}${basePath}`;
+    const extensions = this.getDiscoveryExtensions();
+    const interventionTypes = [...new Set(this.options.interventions?.supported ?? [])];
     return {
       protocol: {
         name: "acp",
-        version,
-        supported_versions: supportedVersions,
+        version: ACP_API_VERSION,
+        supported_versions: ACP_SUPPORTED_API_VERSIONS,
         ...discovery.documentationUrl ? { documentation_url: discovery.documentationUrl } : {}
       },
       api_base_url: apiBaseUrl,
-      transports: ["rest"],
+      transports: this.mcp ? ["rest", "mcp"] : ["rest"],
       capabilities: {
-        services: this.options.productFeed ? ["checkout", "feeds"] : ["checkout"],
+        // The services enum is closed per version: checkout, orders,
+        // delegate_payment and carts (discovery RFC §4.2).
+        services: this.webhooks ? ["checkout", "orders", "carts"] : ["checkout", "carts"],
+        ...extensions.length > 0 ? { extensions } : {},
+        ...interventionTypes.length > 0 ? { intervention_types: interventionTypes } : {},
         ...discovery.supportedCurrencies ? { supported_currencies: discovery.supportedCurrencies } : {},
         ...discovery.supportedLocales ? { supported_locales: discovery.supportedLocales } : {}
       }
     };
   }
+  /** The extensions the server implements; extension PRs add theirs here. */
+  getDiscoveryExtensions() {
+    return this.supportsDiscounts ? [{ name: ACP_DISCOUNT_EXTENSION.name }] : [];
+  }
   getReadinessDocument() {
     return {
       name: this.options.name ?? "@reactionary/acp",
@@ -200,52 +433,14 @@ class ReactionaryACPServer {
         "GET /checkout_sessions/{checkout_session_id}",
         "POST /checkout_sessions/{checkout_session_id}/complete",
         "POST /checkout_sessions/{checkout_session_id}/cancel",
-        "GET /product_feeds/{id}/products"
+        "POST /carts",
+        "GET /carts/{id}",
+        "PUT /carts/{id}",
+        "POST /carts/{id}/cancel"
       ]
     };
   }
-  async getProductFeed(request, feedId, feed, client, requestContext, omitBody) {
-    const format = new URL(request.url).searchParams.get("format") ?? "json";
-    if (format !== "json" && format !== "jsonl") {
-      return acpErrorResponse(400, {
-        type: "invalid_request",
-        code: "invalid",
-        message: `Unsupported product feed format: ${format}`,
-        param: "$.format"
-      });
-    }
-    const generator = new ReactionaryFeedGenerator(client, {
-      defaultFulfillmentCenterKeys: this.options.productFeed?.defaultFulfillmentCenterKeys,
-      productConcurrency: this.options.productFeed?.productConcurrency
-    });
-    const output = acpProductFeedTransformer.transform(
-      generator.products(feed, requestContext),
-      {
-        feedId,
-        feed,
-        options: { format }
-      }
-    );
-    const extension = format === "jsonl" ? "jsonl" : "json";
-    return new Response(
-      omitBody ? null : createFeedStream(output),
-      {
-        headers: {
-          "content-type": format === "jsonl" ? "application/x-ndjson; charset=utf-8" : "application/json; charset=utf-8",
-          "content-disposition": `attachment; filename="${feedId}.products.${extension}"`
-        }
-      }
-    );
-  }
-  getRequestedProductFeed(request) {
-    const id = getProductFeedId(request, this.options.basePath);
-    const feed = id ? this.getProductFeedDefinition(id) : void 0;
-    return id && feed ? { id, feed } : void 0;
-  }
-  getProductFeedDefinition(feedId) {
-    return this.options.productFeed?.feeds[feedId];
-  }
-  async handlePost(request, client, requestContext, sessionId) {
+  async handlePost(request, client, requestContext, sessionId, agent) {
     const checkoutSessionId = getCheckoutSessionId(
       request,
       this.options.basePath
@@ -255,7 +450,8 @@ class ReactionaryACPServer {
         await parseJsonBody(request, ACPCreateCheckoutSessionRequestSchema),
         client,
         requestContext,
-        sessionId
+        sessionId,
+        agent
       );
     }
     if (isCheckoutSessionCompleteRequest(request, this.options.basePath)) {
@@ -266,7 +462,11 @@ class ReactionaryACPServer {
       );
     }
     if (isCheckoutSessionCancelRequest(request, this.options.basePath)) {
-      return this.cancelCheckoutSession(checkoutSessionId, client);
+      return this.cancelCheckoutSession(
+        checkoutSessionId,
+        await parseOptionalJsonBody(request, ACPCancelCheckoutSessionRequestSchema),
+        client
+      );
     }
     return this.updateCheckoutSession(
       checkoutSessionId,
@@ -275,15 +475,28 @@ class ReactionaryACPServer {
       requestContext
     );
   }
-  async createCheckoutSession(input, client, requestContext, sessionId) {
-    const cart = await this.createCartForItems(input.items, client);
+  async createCheckoutSession(input, client, requestContext, sessionId, agent) {
+    const cart = await this.createCartForItems(input.line_items, client);
+    const discounts = await this.applyRequestedDiscounts(
+      cart.identifier.key,
+      getRequestedDiscountCodes(input.discounts, input.coupons),
+      input.capabilities,
+      client
+    );
     const state = {
+      ...discounts,
       id: `checkout_session_${crypto.randomUUID()}`,
       sessionId,
+      ...agent ? { agentId: agent.id } : {},
       cartId: cart.identifier.key,
+      currency: input.currency.toLowerCase(),
+      agentCapabilities: input.capabilities,
+      ...input.locale ? { locale: input.locale } : {},
+      ...input.timezone ? { timezone: input.timezone } : {},
+      ...input.affiliate_attribution ? { firstTouchAttribution: { ...input.affiliate_attribution, touchpoint: "first" } } : {},
       status: "not_ready_for_payment",
       buyer: input.buyer,
-      fulfillmentAddress: input.fulfillment_address
+      fulfillmentDetails: input.fulfillment_details
     };
     return jsonResponse(
       await this.toACPCheckoutSession(state, client, requestContext),
@@ -299,12 +512,23 @@ class ReactionaryACPServer {
         message: "The checkout session can no longer be modified."
       });
     }
+    const cartId = input.line_items ? await this.replaceCartItems(state.cartId, input.line_items, client) : state.cartId;
+    const discounts = await this.applyRequestedDiscounts(
+      cartId,
+      getRequestedDiscountCodes(input.discounts, input.coupons),
+      state.agentCapabilities,
+      client
+    );
     const updatedState = {
       ...state,
-      cartId: input.items ? (await this.createCartForItems(input.items, client)).identifier.key : state.cartId,
-      buyer: input.buyer ?? state.buyer,
-      fulfillmentAddress: input.fulfillment_address ?? state.fulfillmentAddress,
-      fulfillmentOptionId: input.fulfillment_option_id ?? state.fulfillmentOptionId
+      ...discounts,
+      cartId,
+      buyer: mergeBuyer(state.buyer, input.buyer),
+      // Changes to the session invalidate a pending authentication.
+      status: state.status === "authentication_required" ? "not_ready_for_payment" : state.status,
+      authenticationMetadata: void 0,
+      fulfillmentDetails: input.fulfillment_details === null ? void 0 : input.fulfillment_details ?? state.fulfillmentDetails,
+      fulfillmentOptionId: input.selected_fulfillment_options === void 0 ? state.fulfillmentOptionId : input.selected_fulfillment_options?.[0]?.option_id
     };
     return jsonResponse(
       await this.toACPCheckoutSession(updatedState, client, requestContext)
@@ -326,7 +550,8 @@ class ReactionaryACPServer {
   }
   /**
    * Creates the real checkout from the session state and finalizes it. A
-   * payment the PSP has not authorized yet leaves the session `in_progress`;
+   * payment the PSP has not authorized yet leaves the session
+   * `complete_in_progress`, without an order yet;
    * a repeated complete retries finalization.
    */
   async completeCheckoutSession(checkoutSessionId, input, client) {
@@ -338,22 +563,47 @@ class ReactionaryACPServer {
         message: "Canceled checkout sessions cannot be completed."
       });
     }
-    const buyer = input.buyer ?? state.buyer;
-    let current = { ...state, buyer };
+    const buyer = mergeBuyer(state.buyer, input.buyer);
+    let current = {
+      ...state,
+      buyer,
+      ...input.marketing_consents ? { marketingConsents: input.marketing_consents } : {},
+      // Attribution is write-once: the first last-touch claim wins.
+      ...input.affiliate_attribution && !state.lastTouchAttribution ? { lastTouchAttribution: { ...input.affiliate_attribution, touchpoint: "last" } } : {}
+    };
     if (!current.checkoutId) {
+      const handler = this.resolvePaymentHandler(input.payment_data);
       const view = await this.priceSession(current, client);
+      if (view.status === "ready_for_payment") {
+        const authentication = await this.checkAuthentication(current, input, handler, view, client);
+        if (authentication) {
+          return authentication;
+        }
+      }
       if (view.status !== "ready_for_payment") {
+        const blocking = view.messages?.find((message) => message.type === "error");
         return acpErrorResponse(400, {
           type: "invalid_request",
-          code: "invalid",
-          message: "The checkout session is missing the buyer email, fulfillment address or fulfillment option."
+          code: blocking?.code ?? "invalid",
+          message: blocking?.content ?? "The checkout session is not ready for payment.",
+          ...blocking?.param ? { param: blocking.param } : {}
         });
       }
-      const checkout = await this.placeCheckout(current, input, client);
+      const checkout = await this.placeCheckout(current, input, handler, client);
+      if (!checkout) {
+        return jsonResponse(await this.toACPCheckoutSession(current, client, void 0, [{
+          type: "error",
+          code: "payment_declined",
+          param: "$.payment_data",
+          content_type: "plain",
+          content: "The payment was declined. Please try a different payment method.",
+          resolution: "requires_buyer_input"
+        }]));
+      }
       current = {
         ...current,
         checkoutId: checkout.identifier.key,
-        status: "in_progress"
+        status: "complete_in_progress"
       };
       await this.checkoutSessionStore.put(current.id, current);
     }
@@ -368,39 +618,93 @@ class ReactionaryACPServer {
         (candidate) => Boolean(candidate.resultingOrder || candidate.readyForFinalization),
         wait
       );
-      if (checkout.resultingOrder) {
-        current = { ...current, status: "completed", orderId: checkout.resultingOrder.key };
-      } else if (checkout.readyForFinalization) {
-        const finalized = await unwrapACPResult(
-          client.checkout.finalizeCheckout({ checkout: checkout.identifier })
-        );
-        current = { ...current, status: "completed", orderId: finalized.resultingOrder?.key };
+      const orderId = checkout.resultingOrder?.key ?? (checkout.readyForFinalization ? (await unwrapACPResult(client.checkout.finalizeCheckout({ checkout: checkout.identifier }))).resultingOrder?.key : void 0);
+      if (orderId) {
+        current = { ...current, status: "completed", orderId };
       }
     }
-    return jsonResponse(await this.toACPCheckoutSession(current, client));
+    const pending = current.status === "completed" ? [] : [{
+      type: "info",
+      content_type: "plain",
+      content: "The payment is awaiting authorization. Retrieve the session, or complete it again with a new Idempotency-Key, to receive the order."
+    }];
+    return jsonResponse(await this.toACPCheckoutSession(current, client, void 0, pending));
   }
-  async cancelCheckoutSession(checkoutSessionId, client) {
+  async cancelCheckoutSession(checkoutSessionId, input, client) {
     const state = await this.getRequiredCheckoutSessionState(checkoutSessionId);
-    if (state.checkoutId || state.status === "completed" || state.status === "canceled") {
+    const placed = state.checkoutId && state.status !== "completed" ? await this.getPlacedView(state, client) : void 0;
+    if (state.status === "completed" || state.status === "canceled" || placed?.orderId) {
       return acpErrorResponse(405, {
         type: "invalid_request",
         code: "invalid",
         message: "Completed or canceled checkout sessions cannot be canceled."
       });
     }
+    if (input.intent_trace) {
+      await Promise.resolve(this.options.onIntentTrace?.(input.intent_trace, {
+        checkoutSessionId: state.id,
+        ...state.agentId ? { agentId: state.agentId } : {}
+      }))?.catch((error) => console.error("ACP: onIntentTrace failed:", error));
+    }
     return jsonResponse(
-      await this.toACPCheckoutSession({ ...state, status: "canceled" }, client)
+      await this.toACPCheckoutSession({
+        ...state,
+        status: "canceled",
+        ...input.intent_trace ? { intentTrace: input.intent_trace } : {}
+      }, client, void 0, [{
+        type: "info",
+        content_type: "plain",
+        content: "Checkout session has been canceled."
+      }])
     );
   }
+  /**
+   * Gives the session's cart exactly the requested items (line items are a
+   * full replacement), updating it in place where the backend supports it.
+   * Otherwise a new cart replaces it and the old one is deleted, if possible.
+   * Returns the cart key.
+   */
+  async replaceCartItems(cartId, items, client) {
+    const cartCapability = client.cart;
+    if (!cartCapability.changeQuantity || !cartCapability.remove) {
+      const replacement = await this.createCartForItems(items, client);
+      await client.cart.deleteCart?.({ cart: { key: cartId } });
+      return replacement.identifier.key;
+    }
+    const requested = getRequestedQuantities(items);
+    let cart = await unwrapACPResult(client.cart.getById({ cart: { key: cartId } }));
+    for (const existing of cart.items) {
+      const wanted = requested.get(existing.variant.sku);
+      if (!wanted) {
+        cart = await unwrapACPResult(cartCapability.remove({ cart: cart.identifier, item: existing.identifier }));
+      } else if (wanted.quantity !== existing.quantity) {
+        cart = await unwrapACPResult(
+          cartCapability.changeQuantity({ cart: cart.identifier, item: existing.identifier, quantity: wanted.quantity }),
+          `$.line_items[${wanted.index}].quantity`
+        );
+      }
+    }
+    const existingSkus = new Set(cart.items.map((item) => item.variant.sku));
+    for (const [sku, { quantity, index }] of requested) {
+      if (!existingSkus.has(sku)) {
+        cart = await unwrapACPResult(
+          client.cart.add({ cart: cart.identifier, variant: { sku }, quantity }),
+          `$.line_items[${index}].id`
+        );
+      }
+    }
+    return cart.identifier.key;
+  }
   async createCartForItems(items, client) {
     let cart = await unwrapACPResult(client.cart.createCart({}));
-    for (const item of items) {
+    for (const [sku, { quantity, index }] of getRequestedQuantities(items)) {
       cart = await unwrapACPResult(
         client.cart.add({
           cart: cart.identifier,
-          variant: { sku: item.id },
-          quantity: item.quantity
-        })
+          variant: { sku },
+          quantity
+        }),
+        `$.line_items[${index}].id`
       );
     }
     return cart;
@@ -416,16 +720,23 @@ class ReactionaryACPServer {
     }
     return state;
   }
-  async placeCheckout(state, input, client) {
+  async placeCheckout(state, input, handler, client) {
     const cart = await unwrapACPResult(client.cart.getById({ cart: { key: state.cartId } }));
+    const address = state.fulfillmentDetails?.address;
+    const billingAddress = input.payment_data.billing_address ?? address;
     let checkout = await unwrapACPResult(
       client.checkout.initiateCheckoutForCart({
         cart,
-        billingAddress: state.fulfillmentAddress ? toReactionaryAddress(state.fulfillmentAddress) : void 0,
-        notificationEmail: state.buyer?.email,
-        notificationPhone: state.buyer?.phone_number
+        billingAddress: billingAddress ? toReactionaryAddress(billingAddress) : void 0,
+        notificationEmail: getContactEmail(state),
+        notificationPhone: getContactPhone(state)
       })
     );
+    if (address) {
+      checkout = await unwrapACPResult(
+        client.checkout.setShippingAddress({ checkout: checkout.identifier, shippingAddress: toReactionaryAddress(address) })
+      );
+    }
     if (state.fulfillmentOptionId) {
       checkout = await unwrapACPResult(
         client.checkout.setShippingInstruction(toShippingInstruction(checkout, state.fulfillmentOptionId))
@@ -435,25 +746,28 @@ class ReactionaryACPServer {
       checkout: checkout.identifier,
       paymentInstruction: {
         amount: checkout.price.grandTotal,
-        paymentMethod: toPaymentMethodIdentifier(input.payment_data.provider),
+        paymentMethod: getHandlerPaymentMethod(handler),
         protocolData: [
           {
             key: "delegated_payment_token",
-            value: input.payment_data.token
+            value: input.payment_data.instrument.credential.token
           },
           {
             key: "delegated_payment_provider",
-            value: input.payment_data.provider
-          }
+            value: handler.handler.psp
+          },
+          { key: "acp_payment_handler_id", value: handler.handler.id },
+          { key: "acp_payment_instrument_type", value: input.payment_data.instrument.type },
+          { key: "acp_payment_credential_type", value: input.payment_data.instrument.credential.type },
+          ...input.authentication_result ? [{ key: "acp_authentication_result", value: JSON.stringify(input.authentication_result) }] : []
         ]
       }
     });
     if (!paid.success) {
-      throw new ACPHttpError(400, {
-        type: "processing_error",
-        code: "payment_declined",
-        message: "The payment could not be authorized with the delegated payment token."
-      });
+      if (checkout.identifier.key !== cart.identifier.key && client.cart.deleteCart) {
+        await client.cart.deleteCart({ cart: checkout.identifier });
+      }
+      return void 0;
     }
     return paid.value;
   }
@@ -465,18 +779,34 @@ class ReactionaryACPServer {
    */
   async priceSession(state, client) {
     const cart = await unwrapACPResult(client.cart.getById({ cart: { key: state.cartId } }));
-    if (!state.fulfillmentAddress || state.status === "canceled") {
-      return { cart, price: cart.price, options: [], status: state.status === "canceled" ? "canceled" : "not_ready_for_payment" };
+    if (state.status === "canceled") {
+      return { cart, price: cart.price, options: [], messages: [], status: "canceled" };
+    }
+    const stockMessages = await this.getStockMessages(cart, client);
+    const address = state.fulfillmentDetails?.address;
+    if (!address) {
+      return {
+        cart,
+        price: cart.price,
+        options: [],
+        messages: [...stockMessages, ...getInputMessages(state, [], false, this.options.requireFulfillment ?? true)],
+        status: "not_ready_for_payment"
+      };
     }
     let checkout = await unwrapACPResult(
       client.checkout.initiateCheckoutForCart({
         cart,
-        billingAddress: toReactionaryAddress(state.fulfillmentAddress),
-        notificationEmail: state.buyer?.email ?? this.options.placeholderEmail ?? DEFAULT_ACP_PLACEHOLDER_EMAIL,
-        notificationPhone: state.buyer?.phone_number
+        billingAddress: toReactionaryAddress(address),
+        notificationEmail: getContactEmail(state) ?? this.options.placeholderEmail ?? DEFAULT_ACP_PLACEHOLDER_EMAIL,
+        notificationPhone: getContactPhone(state)
       })
     );
     try {
+      const withAddress = await client.checkout.setShippingAddress({
+        checkout: checkout.identifier,
+        shippingAddress: toReactionaryAddress(address)
+      });
+      checkout = withAddress.success ? withAddress.value : checkout;
       const shippingMethods = await client.checkout.getAvailableShippingMethods({ checkout: checkout.identifier });
       const options = shippingMethods.success ? shippingMethods.value : [];
       const selected = options.find((option) => option.identifier.key === state.fulfillmentOptionId);
@@ -486,8 +816,14 @@ class ReactionaryACPServer {
         );
         checkout = withShipping.success ? withShipping.value : checkout;
       }
-      const ready = Boolean(state.buyer?.email) && (options.length === 0 || Boolean(selected));
+      const messages = [
+        ...stockMessages,
+        ...this.getInterventionMessages(state),
+        ...getInputMessages(state, options, true, this.options.requireFulfillment ?? true)
+      ];
+      const ready = messages.every((message) => message.type !== "error");
       return {
+        messages,
         cart,
         checkout,
         price: checkout.price,
@@ -500,68 +836,493 @@ class ReactionaryACPServer {
       }
     }
   }
-  async toACPCheckoutSession(state, client, requestContext = createInitialRequestContext()) {
+  async toACPCheckoutSession(state, client, requestContext = createInitialRequestContext(), extraMessages = []) {
     const view = state.checkoutId ? await this.getPlacedView(state, client) : await this.priceSession(state, client);
-    const persisted = { ...state, status: view.status };
+    const awaitingAuthentication = state.status === "authentication_required" && view.status === "ready_for_payment";
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const persisted = {
+      ...state,
+      createdAt: state.createdAt ?? now,
+      updatedAt: now,
+      status: awaitingAuthentication ? "authentication_required" : view.status,
+      ...view.orderId ? { orderId: view.orderId } : {}
+    };
+    const lineItems = view.checkout?.items ?? view.cart?.items ?? [];
+    const products = await getProducts(lineItems.map((item) => item.variant.sku), client);
+    const optionTitles = getOptionTitles(view.options);
+    const selectedOption = view.options.find((option) => option.identifier.key === state.fulfillmentOptionId);
+    const discountsActive = this.isDiscountExtensionActive(persisted.agentCapabilities, client);
     await this.checkoutSessionStore.put(persisted.id, persisted);
+    await this.recordOrder(persisted, client);
     return {
       id: persisted.id,
+      protocol: { version: ACP_API_VERSION },
+      capabilities: this.getNegotiatedCapabilities(persisted.agentCapabilities, client),
       ...persisted.buyer ? { buyer: persisted.buyer } : {},
-      payment_provider: await this.getPaymentProvider(view.checkout, client),
       status: persisted.status,
+      ...persisted.status === "authentication_required" && persisted.authenticationMetadata ? { authentication_metadata: persisted.authenticationMetadata } : {},
       currency: getCurrency(view.price, requestContext),
-      line_items: (view.checkout?.items ?? view.cart?.items ?? []).map(toACPLineItem),
-      ...persisted.fulfillmentAddress ? { fulfillment_address: persisted.fulfillmentAddress } : {},
-      fulfillment_options: view.options.map(toACPFulfillmentOption),
-      ...persisted.fulfillmentOptionId ? { fulfillment_option_id: persisted.fulfillmentOptionId } : {},
+      locale: persisted.locale ?? requestContext.languageContext.locale,
+      ...persisted.timezone ? { timezone: persisted.timezone } : {},
+      line_items: lineItems.map((item) => toACPLineItem(item, products.get(item.variant.sku))),
+      ...persisted.fulfillmentDetails ? { fulfillment_details: persisted.fulfillmentDetails } : {},
+      fulfillment_options: view.options.map((option) => toACPFulfillmentOption(
+        option,
+        optionTitles.get(option.identifier.key) ?? option.identifier.key,
+        this.classifyFulfillmentOption(option)
+      )),
+      // A selection is only reported while it references an offered option.
+      ...persisted.fulfillmentOptionId && view.options.some((option) => option.identifier.key === persisted.fulfillmentOptionId) ? {
+        selected_fulfillment_options: [{
+          type: selectedOption ? this.classifyFulfillmentOption(selectedOption).type : "shipping",
+          option_id: persisted.fulfillmentOptionId,
+          item_ids: lineItems.map((lineItem) => lineItem.identifier.key)
+        }]
+      } : {},
       totals: toACPTotals(view.price),
       ...persisted.orderId ? {
         order: {
+          type: "order",
           id: persisted.orderId,
           checkout_session_id: persisted.id,
-          permalink_url: ""
+          ...this.options.orderPermalinkUrl ? { permalink_url: toOrderPermalinkUrl(this.options.orderPermalinkUrl, persisted.orderId) } : {}
         }
       } : {},
-      messages: [],
-      links: this.options.links ?? []
+      ...this.options.marketingConsent?.channels.length && persisted.status !== "completed" ? { marketing_consent_options: await this.getMarketingConsentOptions(persisted) } : {},
+      ...discountsActive && view.cart ? {
+        discounts: toACPDiscounts(view.cart, persisted.discountCodes ?? [], persisted.rejectedDiscounts ?? [], toMinorUnits)
+      } : {},
+      messages: [
+        ...extraMessages,
+        ...view.messages ?? [],
+        ...discountsActive ? getRejectedDiscountMessages(persisted) : []
+      ],
+      links: this.options.links ?? [],
+      created_at: persisted.createdAt,
+      updated_at: persisted.updatedAt,
+      ...isTerminal(persisted.status) ? {} : {
+        expires_at: new Date(Date.now() + (this.options.checkoutSessionTtlSeconds ?? 60 * 60 * 24) * 1e3).toISOString(),
+        ...this.options.continueUrl ? { continue_url: this.options.continueUrl.replaceAll("{checkoutSessionId}", encodeURIComponent(persisted.id)) } : {}
+      }
     };
   }
+  classifyFulfillmentOption(method) {
+    return this.options.classifyFulfillmentOption?.(method) ?? { type: "shipping" };
+  }
+  /**
+   * Whether the discount extension is active for a session: the backend can
+   * apply coupons, and the agent declared the extension.
+   */
+  isDiscountExtensionActive(agent, client) {
+    return Boolean(client.cart?.applyCouponCode && client.cart.removeCouponCode) && (agent?.extensions ?? []).some((extension) => /^discount(@|$)/.test(extension));
+  }
+  /** Applies submitted discount codes, when the extension is active. */
+  async applyRequestedDiscounts(cartId, codes, agent, client) {
+    if (!codes || !this.isDiscountExtensionActive(agent, client)) {
+      return {};
+    }
+    const cart = await unwrapACPResult(client.cart.getById({ cart: { key: cartId } }));
+    const { rejected } = await applyDiscountCodes(client.cart, cart, codes);
+    return { discountCodes: codes, rejectedDiscounts: rejected };
+  }
+  /**
+   * 3D Secure (checkout RFC §4.4): when the authentication hook asks for it,
+   * the first completion answers `authentication_required` with the
+   * metadata; completing such a session without `authentication_result` is
+   * a 4XX `requires_3ds`. Failed or refused authentications are not
+   * authorized. Returns a response when completion must stop here.
+   */
+  async checkAuthentication(state, input, handler, view, client) {
+    const result = input.authentication_result;
+    const metadata = state.authenticationMetadata ?? (this.options.authentication ? await this.options.authentication.getMetadata({
+      checkoutSessionId: state.id,
+      handler: handler.handler,
+      instrument: input.payment_data.instrument,
+      amount: view.price.grandTotal
+    }) : void 0);
+    if (!metadata) {
+      return void 0;
+    }
+    if (!result) {
+      if (state.status === "authentication_required") {
+        throw new ACPHttpError(400, {
+          type: "invalid_request",
+          code: "requires_3ds",
+          message: "This checkout session requires issuer authentication. The request must include 'authentication_result'.",
+          param: "$.authentication_result"
+        });
+      }
+      const pending = { ...state, status: "authentication_required", authenticationMetadata: metadata };
+      await this.checkoutSessionStore.put(pending.id, pending);
+      return jsonResponse(await this.toACPCheckoutSession(pending, client));
+    }
+    if (!ACP_AUTHENTICATED_OUTCOMES.includes(result.outcome)) {
+      const pending = { ...state, status: "authentication_required", authenticationMetadata: metadata };
+      await this.checkoutSessionStore.put(pending.id, pending);
+      return jsonResponse(await this.toACPCheckoutSession(pending, client, void 0, [{
+        type: "error",
+        code: "payment_declined",
+        param: "$.authentication_result",
+        content_type: "plain",
+        content: `Card authentication did not succeed (${result.outcome}); the payment was not authorized.`,
+        resolution: "requires_buyer_input"
+      }]));
+    }
+    return void 0;
+  }
+  /**
+   * Records an order placed through a session once, and announces it to the
+   * creating agent's webhook receiver.
+   */
+  async recordOrder(state, client) {
+    if (state.status !== "completed" || !state.orderId || await this.checkoutSessionStore.getOrder(state.orderId)) {
+      return;
+    }
+    const record = {
+      id: state.orderId,
+      checkoutSessionId: state.id,
+      ...state.sessionId ? { sessionId: state.sessionId } : {},
+      ...state.agentId ? { agentId: state.agentId } : {}
+    };
+    await this.checkoutSessionStore.putOrder(record);
+    await this.reportAttribution(state, record);
+    await this.reportMarketingConsents(state, record);
+    await this.sendOrderEvent("order_create", record, client);
+  }
+  /**
+   * Reports the order's affiliate attribution once it exists: first touch
+   * from the session's creation, last touch from its completion. A failing
+   * hook never blocks the checkout.
+   */
+  async reportAttribution(state, record) {
+    const firstTouch = ACPAffiliateAttributionSchema.safeParse(state.firstTouchAttribution);
+    const lastTouch = ACPAffiliateAttributionSchema.safeParse(state.lastTouchAttribution);
+    if (!this.options.onOrderAttribution || !firstTouch.success && !lastTouch.success) {
+      return;
+    }
+    try {
+      await this.options.onOrderAttribution({
+        orderId: record.id,
+        checkoutSessionId: record.checkoutSessionId,
+        ...record.agentId ? { agentId: record.agentId } : {},
+        ...firstTouch.success ? { firstTouch: firstTouch.data } : {},
+        ...lastTouch.success ? { lastTouch: lastTouch.data } : {}
+      });
+    } catch {
+      console.error(`ACP: onOrderAttribution failed for order ${record.id}.`);
+    }
+  }
+  /**
+   * Passes the buyer's consent decisions on, once the order exists. Only
+   * offered channels with a resolvable contact count: email uses the buyer's
+   * email, falling back to the fulfillment email; sms and whatsapp the phone
+   * likewise (marketing consent RFC §3.5). Omitted channels are not consent.
+   */
+  async reportMarketingConsents(state, record) {
+    const options = this.options.marketingConsent;
+    const offered = new Set(options?.channels.map((channel) => channel.channel));
+    const consents = (state.marketingConsents ?? []).flatMap((consent) => {
+      const contact = getConsentContact(state, consent.channel);
+      return offered.has(consent.channel) && contact ? [{ channel: consent.channel, opted_in: consent.opted_in, contact }] : [];
+    });
+    if (!options || consents.length === 0) {
+      return;
+    }
+    try {
+      await options.onConsents(consents, {
+        orderId: record.id,
+        checkoutSessionId: record.checkoutSessionId,
+        ...record.agentId ? { agentId: record.agentId } : {}
+      });
+    } catch (error) {
+      console.error(`ACP: marketing consents for order ${record.id} could not be recorded:`, error);
+    }
+  }
+  /** The offered marketing channels, with the buyer's subscription state. */
+  async getMarketingConsentOptions(state) {
+    const options = this.options.marketingConsent;
+    return Promise.all((options?.channels ?? []).map(async (channel) => {
+      const contact = getConsentContact(state, channel.channel);
+      const subscribed = contact && options?.isSubscribed ? await options.isSubscribed(contact, channel.channel) : false;
+      return { ...channel, is_subscribed: subscribed };
+    }));
+  }
+  async sendOrderEvent(type, record, client) {
+    const endpoint = this.webhooks?.getEndpoint(record.agentId);
+    const order = endpoint ? await this.toACPOrder(record, client) : void 0;
+    if (!this.webhooks || !endpoint || !order) {
+      return false;
+    }
+    this.webhooks.deliver(endpoint, type, order);
+    return true;
+  }
+  /** The full current order (webhooks carry the whole order, not deltas). */
+  async toACPOrder(record, client) {
+    const result = await client.order?.getById({ order: { key: record.id } });
+    if (!result?.success) {
+      console.error(`ACP: order ${record.id} could not be read for its webhook:`, result?.error);
+      return void 0;
+    }
+    const order = result.value;
+    const products = await getProducts(order.items.map((item) => item.variant.sku), client);
+    const canceled = order.orderStatus === "Cancelled";
+    const shipped = order.orderStatus === "Shipped";
+    const lineItems = order.items.map((item) => {
+      const product = products.get(item.variant.sku);
+      const current = canceled ? 0 : item.quantity;
+      return {
+        id: item.identifier.key,
+        title: product?.name || item.variant.sku,
+        ...product ? { product_id: product.identifier.key } : {},
+        quantity: { ordered: item.quantity, current, fulfilled: shipped ? current : 0 },
+        unit_price: toMinorUnits(item.price.unitPrice),
+        subtotal: toMinorUnits(item.price.totalPrice),
+        status: canceled ? "removed" : shipped ? "fulfilled" : "processing"
+      };
+    });
+    return {
+      type: "order",
+      id: order.identifier.key,
+      checkout_session_id: record.checkoutSessionId,
+      ...this.options.orderPermalinkUrl ? { permalink_url: toOrderPermalinkUrl(this.options.orderPermalinkUrl, order.identifier.key) } : {},
+      status: toACPOrderStatus(order.orderStatus),
+      line_items: lineItems,
+      ...order.shippingMethod ? {
+        fulfillments: [{
+          id: "fulfillment_1",
+          // Order fulfillments are shipping, pickup or digital.
+          type: toOrderFulfillmentType(this.classifyFulfillmentOption(order.shippingMethod).type),
+          status: canceled ? "canceled" : shipped ? "shipped" : "processing",
+          line_items: lineItems.filter((lineItem) => lineItem.quantity.current > 0).map((lineItem) => ({ id: lineItem.id, quantity: lineItem.quantity.current })),
+          ...order.shippingMethod.carrier ? { carrier: order.shippingMethod.carrier } : {}
+        }]
+      } : {},
+      totals: toACPTotals(order.price)
+    };
+  }
+  /**
+   * The advertised handler a completion pays with. Sellers MUST check the
+   * handler is one they declared (sellers guide, "Complete a checkout
+   * session"), and raw card numbers are refused unless explicitly accepted,
+   * so they never reach the backend's persisted payment data.
+   */
+  resolvePaymentHandler(paymentData) {
+    const option = this.options.paymentHandlers?.find((candidate) => candidate.handler.id === paymentData.handler_id);
+    if (!option) {
+      throw new ACPHttpError(400, {
+        type: "invalid_request",
+        code: "invalid",
+        message: `Payment handler '${paymentData.handler_id}' is not offered for this checkout.`,
+        param: "$.payment_data.handler_id"
+      });
+    }
+    if (!this.options.acceptRawCardCredentials && isRawCardCredential(paymentData.instrument.credential)) {
+      throw new ACPHttpError(400, {
+        type: "invalid_request",
+        code: "invalid",
+        message: "Raw card credentials are not accepted; submit a delegated payment token instead.",
+        param: "$.payment_data.instrument.credential"
+      });
+    }
+    return option;
+  }
+  /**
+   * The seller's capabilities for a session: interventions are the
+   * intersection of what the agent declared and what the seller supports,
+   * plus the seller's requirements (capability negotiation RFC §4.5.1).
+   */
+  getNegotiatedCapabilities(agent, client) {
+    const seller = this.options.interventions;
+    const required = seller?.required ?? [];
+    const handlers = this.options.paymentHandlers ?? [];
+    return {
+      ...handlers.length > 0 ? { payment: { handlers: handlers.map((option) => option.handler) } } : {},
+      interventions: {
+        supported: getSupportedInterventions(agent, seller),
+        ...required.length > 0 ? { required, enforcement: seller?.enforcement ?? "conditional" } : {}
+      },
+      ...this.isDiscountExtensionActive(agent, client) ? { extensions: [ACP_DISCOUNT_EXTENSION] } : {}
+    };
+  }
+  /**
+   * An out_of_stock error per line item requesting more than the configured
+   * fulfillment centers hold (as in the UCP adapter). Back-ordered and
+   * pre-ordered items are always purchasable; without configured centers,
+   * stock is left to the backend.
+   */
+  async getStockMessages(cart, client) {
+    const fulfillmentCenterKeys = this.options.inventory?.fulfillmentCenterKeys ?? [];
+    const inventoryCapability = client.inventory;
+    if (fulfillmentCenterKeys.length === 0 || !inventoryCapability) {
+      return [];
+    }
+    const messages = await Promise.all(cart.items.map(async (item, index) => {
+      const results = await Promise.all(fulfillmentCenterKeys.map((key) => inventoryCapability.getBySKU({
+        variant: item.variant,
+        fulfilmentCenter: { key }
+      })));
+      const inventories = results.flatMap((result) => result.success ? [result.value] : []);
+      if (inventories.length === 0 || inventories.some((inventory) => inventory.status === "onBackOrder" || inventory.status === "preOrder")) {
+        return void 0;
+      }
+      const available = inventories.reduce(
+        (total, inventory) => total + (inventory.status === "inStock" ? Math.max(inventory.quantity, 0) : 0),
+        0
+      );
+      if (item.quantity <= available) {
+        return void 0;
+      }
+      const sku = item.variant.sku;
+      return {
+        type: "error",
+        code: "out_of_stock",
+        param: `$.line_items[${index}]`,
+        content_type: "plain",
+        content: available > 0 ? `Only ${available} of ${sku} are in stock.` : `${sku} is out of stock.`,
+        resolution: "requires_buyer_input"
+      };
+    }));
+    return messages.filter((message) => message !== void 0);
+  }
+  /**
+   * Required interventions the agent cannot perform block the session when
+   * they always apply (checkout RFC §5, intervention_required).
+   */
+  getInterventionMessages(state) {
+    const seller = this.options.interventions;
+    const supported = getSupportedInterventions(state.agentCapabilities, seller);
+    const missing = (seller?.required ?? []).filter((type) => !supported.includes(type));
+    if (missing.length === 0 || seller?.enforcement !== "always") {
+      return [];
+    }
+    return [{
+      type: "error",
+      code: "intervention_required",
+      param: "$.capabilities.interventions",
+      content_type: "plain",
+      content: `This checkout requires ${missing.join(", ")}, which the agent does not support.`
+    }];
+  }
   async getPlacedView(state, client) {
     const checkout = await unwrapACPResult(
       client.checkout.getById({ identifier: { key: state.checkoutId ?? "" } })
     );
+    const orderId = state.orderId ?? checkout.resultingOrder?.key;
+    const status = orderId ? "completed" : state.status === "canceled" ? "canceled" : "complete_in_progress";
+    const methods = state.fulfillmentOptionId ? await client.checkout.getAvailableShippingMethods({ checkout: checkout.identifier }) : void 0;
+    const options = methods?.success ? methods.value.filter((method) => method.identifier.key === state.fulfillmentOptionId) : [];
     return {
       checkout,
       price: checkout.price,
-      options: [],
-      status: state.status === "completed" || checkout.resultingOrder ? "completed" : "in_progress"
+      options,
+      status,
+      ...orderId ? { orderId } : {}
     };
   }
-  async getPaymentProvider(checkout, client) {
-    if (this.options.paymentProvider) {
-      return this.options.paymentProvider;
-    }
-    const result = checkout ? await client.checkout.getAvailablePaymentMethods({
-      checkout: checkout.identifier
-    }) : void 0;
-    if (result?.success) {
-      const supported = result.value.find(
-        (method) => ["stripe", "adyen", "braintree"].includes(
-          method.identifier.paymentProcessor
-        )
-      );
-      if (supported) {
-        return {
-          provider: supported.identifier.paymentProcessor,
-          supported_payment_methods: ["card"]
-        };
-      }
+}
+function getRequestedQuantities(items) {
+  const quantities = /* @__PURE__ */ new Map();
+  for (const [index, item] of items.entries()) {
+    const current = quantities.get(item.id);
+    quantities.set(item.id, { quantity: (current?.quantity ?? 0) + (item.quantity ?? 1), index: current?.index ?? index });
+  }
+  return quantities;
+}
+async function getProducts(skus, client) {
+  const products = /* @__PURE__ */ new Map();
+  await Promise.all([...new Set(skus)].map(async (sku) => {
+    const result = await client.product.getBySKU({ variant: { sku } });
+    if (result.success) {
+      products.set(sku, result.value);
     }
-    return {
-      provider: "stripe",
-      supported_payment_methods: ["card"]
-    };
+  }));
+  return products;
+}
+function secureEquals(left, right) {
+  const leftDigest = createHash("sha256").update(left).digest();
+  const rightDigest = createHash("sha256").update(right).digest();
+  return timingSafeEqual(leftDigest, rightDigest);
+}
+function isRawCardCredential(credential) {
+  return credential["type"] === "card" || credential["type"] === "pan" || ["number", "cvc", "card_number"].some((field) => credential[field] !== void 0);
+}
+function toOrderFulfillmentType(type) {
+  return type === "local_delivery" ? "shipping" : type;
+}
+function isTerminal(status) {
+  return status === "completed" || status === "canceled";
+}
+function getConsentContact(state, channel) {
+  if (channel === "email") {
+    return getContactEmail(state);
+  }
+  return channel === "sms" || channel === "whatsapp" ? getContactPhone(state) : void 0;
+}
+function getRejectedDiscountMessages(state) {
+  const codes = state.discountCodes ?? [];
+  return (state.rejectedDiscounts ?? []).map((rejected) => ({
+    type: "warning",
+    code: rejected.reason,
+    param: `$.discounts.codes[${Math.max(codes.indexOf(rejected.code), 0)}]`,
+    content_type: "plain",
+    content: rejected.message ?? `Discount code '${rejected.code}' could not be applied.`,
+    resolution: "requires_buyer_input"
+  }));
+}
+function getInputMessages(state, options, hasAddress, requireFulfillment) {
+  const messages = [];
+  const missing = (param, content) => ({
+    type: "error",
+    code: "missing",
+    param,
+    content_type: "plain",
+    content,
+    resolution: "requires_buyer_input"
+  });
+  if (!getContactEmail(state)) {
+    messages.push(missing("$.buyer.email", "A buyer email is required."));
+  }
+  if (!hasAddress) {
+    messages.push(missing("$.fulfillment_details.address", "A shipping address is required."));
   }
+  const selected = options.some((option) => option.identifier.key === state.fulfillmentOptionId);
+  if (state.fulfillmentOptionId && hasAddress && !selected) {
+    messages.push({
+      type: "error",
+      code: "invalid",
+      param: "$.selected_fulfillment_options[0].option_id",
+      content_type: "plain",
+      content: `Fulfillment option '${state.fulfillmentOptionId}' is not available for this checkout.`,
+      resolution: "recoverable"
+    });
+  } else if (options.length > 0 && !state.fulfillmentOptionId) {
+    messages.push(missing("$.selected_fulfillment_options", "A fulfillment option must be selected."));
+  } else if (options.length === 0 && hasAddress && requireFulfillment) {
+    messages.push({
+      type: "error",
+      code: "region_restricted",
+      param: "$.fulfillment_details.address",
+      content_type: "plain",
+      content: "No fulfillment option is available for this address.",
+      resolution: "requires_buyer_input"
+    });
+  }
+  return messages;
+}
+function getSupportedInterventions(agent, seller) {
+  const declared = new Set(agent?.interventions?.supported ?? []);
+  return (seller?.supported ?? []).filter(
+    (type) => ACP_INTERVENTION_TYPES.includes(type) && declared.has(type)
+  );
+}
+function getContactEmail(state) {
+  return state.buyer?.email ?? state.fulfillmentDetails?.email;
+}
+function getContactPhone(state) {
+  return state.buyer?.phone_number ?? state.fulfillmentDetails?.phone_number;
+}
+function mergeBuyer(current, update) {
+  return update ? { ...current, ...update } : current;
 }
 function toShippingInstruction(checkout, fulfillmentOptionId) {
   return {
@@ -584,13 +1345,27 @@ async function pollUntil(read, done, wait) {
   return value;
 }
 class ACPHttpError extends Error {
-  constructor(status, body) {
+  constructor(status, body, headers = {}) {
     super(body.message);
     this.status = status;
     this.body = body;
+    this.headers = headers;
   }
   status;
   body;
+  headers;
+}
+function assertSupportedApiVersion(request) {
+  const version = request.headers.get(ACP_API_VERSION_HEADER);
+  if (version && ACP_SUPPORTED_API_VERSIONS.includes(version)) {
+    return;
+  }
+  throw new ACPHttpError(400, {
+    type: "invalid_request",
+    code: version ? "unsupported_api_version" : "missing_api_version",
+    message: version ? `API version '${version}' is not supported.` : "The API-Version header is required.",
+    supported_versions: ACP_SUPPORTED_API_VERSIONS
+  });
 }
 class ReactionaryACPSessionStore {
   constructor(cache, ttlSeconds) {
@@ -620,12 +1395,14 @@ class ReactionaryACPSessionStore {
   }
 }
 class ReactionaryACPCheckoutSessionStore {
-  constructor(cache, ttlSeconds) {
+  constructor(cache, ttlSeconds, orderTtlSeconds) {
     this.cache = cache;
     this.ttlSeconds = ttlSeconds;
+    this.orderTtlSeconds = orderTtlSeconds;
   }
   cache;
   ttlSeconds;
+  orderTtlSeconds;
   async get(checkoutSessionId) {
     return await this.cache.get(
       this.getCacheKey(checkoutSessionId),
@@ -639,6 +1416,26 @@ class ReactionaryACPCheckoutSessionStore {
       dependencyIds: [this.getDependencyId(checkoutSessionId)]
     });
   }
+  async getCart(id) {
+    const state = await this.cache.get(`${CART_CACHE_KEY_PREFIX}:${id}`, ACPCartStateSchema);
+    return state && Date.parse(state.expiresAt) > Date.now() ? state : void 0;
+  }
+  async putCart(state) {
+    const key = `${CART_CACHE_KEY_PREFIX}:${state.id}`;
+    await this.cache.invalidate([key]);
+    await this.cache.put(key, state, { ttlSeconds: this.ttlSeconds, dependencyIds: [key] });
+  }
+  async deleteCart(id) {
+    await this.cache.invalidate([`${CART_CACHE_KEY_PREFIX}:${id}`]);
+  }
+  async getOrder(orderId) {
+    return await this.cache.get(`${ORDER_CACHE_KEY_PREFIX}:${orderId}`, ACPOrderRecordSchema) ?? void 0;
+  }
+  async putOrder(record) {
+    const key = `${ORDER_CACHE_KEY_PREFIX}:${record.id}`;
+    await this.cache.invalidate([key]);
+    await this.cache.put(key, record, { ttlSeconds: this.orderTtlSeconds, dependencyIds: [key] });
+  }
   getCacheKey(checkoutSessionId) {
     return `${CHECKOUT_SESSION_CACHE_KEY_PREFIX}:${checkoutSessionId}`;
   }
@@ -659,10 +1456,52 @@ function getCheckoutSessionId(request, basePath) {
   );
   return match?.[1];
 }
-function getProductFeedId(request, basePath) {
+function toACPOrderStatus(status) {
+  switch (status) {
+    case "AwaitingPayment":
+      return "created";
+    case "ReleasedToFulfillment":
+      return "confirmed";
+    case "Shipped":
+      return "shipped";
+    case "Cancelled":
+      return "canceled";
+  }
+}
+function toOrderPermalinkUrl(template, orderId) {
+  return template.replaceAll("{orderId}", encodeURIComponent(orderId));
+}
+function echoRequestHeaders(request, response) {
+  const requestId = request.headers.get("request-id");
+  const idempotencyKey = request.headers.get("idempotency-key");
+  if (requestId) {
+    response.headers.set("request-id", requestId);
+  }
+  if (idempotencyKey && request.method === "POST") {
+    response.headers.set("idempotency-key", idempotencyKey);
+  }
+  return response;
+}
+function parseAcceptLanguage(header) {
+  return (header ?? "").split(",").map((part, index) => {
+    const [tag = "", ...parameters] = part.trim().split(";");
+    const quality = parameters.map((parameter) => /^\s*q=([0-9.]+)\s*$/.exec(parameter)?.[1]).find((value) => value !== void 0);
+    return { tag: tag.trim(), quality: quality === void 0 ? 1 : Number(quality), index };
+  }).filter((entry) => entry.tag && entry.tag !== "*" && entry.quality > 0).sort((left, right) => right.quality - left.quality || left.index - right.index).map((entry) => entry.tag);
+}
+function isCheckoutPost(request, basePath) {
   const pathname = getProtocolPathname(request, basePath);
-  const match = /^\/product_feeds\/([^/]+)\/products$/.exec(pathname);
-  return match?.[1];
+  return request.method === "POST" && (pathname.startsWith("/checkout_sessions") || pathname === "/carts" || pathname.startsWith("/carts/"));
+}
+function getCartRoute(request, basePath) {
+  const match = /^\/carts(?:\/([^/]+)(\/cancel)?)?$/.exec(getProtocolPathname(request, basePath));
+  return match ? { ...match[1] ? { cartId: decodeURIComponent(match[1]) } : {}, cancel: Boolean(match[2]) } : void 0;
+}
+function methodNotAllowed(method, allow) {
+  return jsonResponse(
+    { type: "invalid_request", code: "method_not_allowed", message: `Unsupported method: ${method}` },
+    { status: 405, headers: { allow } }
+  );
 }
 function isCheckoutSessionCompleteRequest(request, basePath) {
   return getProtocolPathname(request, basePath).endsWith("/complete");
@@ -681,15 +1520,37 @@ function getProtocolPathname(request, basePath = "/acp") {
   return pathname;
 }
 async function parseJsonBody(request, schema) {
+  let body;
   try {
-    return schema.parse(await request.json());
-  } catch (error) {
+    body = await request.json();
+  } catch {
     throw new ACPHttpError(400, {
       type: "invalid_request",
-      code: "invalid",
-      message: error instanceof Error ? error.message : "Invalid request body"
+      code: "invalid_json",
+      message: "The request body must be valid JSON."
+    });
+  }
+  const parsed = schema.safeParse(body);
+  if (!parsed.success) {
+    const issue = parsed.error.issues[0];
+    throw new ACPHttpError(400, {
+      type: "invalid_request",
+      code: issue?.code === "invalid_type" && /received undefined/.test(issue.message) ? "missing" : "invalid",
+      message: issue?.message ?? "Invalid request body",
+      ...issue ? { param: toJsonPath(issue.path) } : {}
     });
   }
+  return parsed.data;
+}
+async function parseOptionalJsonBody(request, schema) {
+  const text = await request.clone().text();
+  return text.trim() ? parseJsonBody(request, schema) : schema.parse({});
+}
+function toJsonPath(path) {
+  return path.reduce(
+    (jsonPath, segment) => typeof segment === "number" ? `${jsonPath}[${segment}]` : `${jsonPath}.${String(segment)}`,
+    "$"
+  );
 }
 function jsonResponse(body, options = {}) {
   const headers = new Headers(options.headers);
@@ -705,6 +1566,18 @@ function jsonResponse(body, options = {}) {
 function acpErrorResponse(status, body) {
   return jsonResponse(body, { status });
 }
+function assertPaymentHandlers(options) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const { handler } of options) {
+    if (ids.has(handler.id)) {
+      throw new Error(`ACP payment handler ids must be unique: ${handler.id}`);
+    }
+    ids.add(handler.id);
+    if (!handler.config.merchant_id || handler.config.psp !== handler.psp) {
+      throw new Error(`ACP payment handler ${handler.id} must configure merchant_id and the handler's psp.`);
+    }
+  }
+}
 function assertACPClient(client) {
   const missing = getMissingACPClientOperations(client);
   if (missing.length > 0) {
@@ -715,12 +1588,13 @@ function assertACPClient(client) {
 }
 function toACPErrorResponse(error) {
   if (error instanceof ACPHttpError) {
-    return acpErrorResponse(error.status, error.body);
+    return jsonResponse(error.body, { status: error.status, headers: error.headers });
   }
+  console.error("ACP: request failed:", error);
   return acpErrorResponse(500, {
     type: "processing_error",
     code: "internal_error",
-    message: error instanceof Error ? error.message : String(error)
+    message: "An unexpected error occurred."
   });
 }
 function getMissingACPClientOperations(client) {
@@ -732,55 +1606,69 @@ function getMissingACPClientOperations(client) {
     ["checkout.getById", client.checkout?.getById],
     ["checkout.setShippingAddress", client.checkout?.setShippingAddress],
     ["checkout.getAvailableShippingMethods", client.checkout?.getAvailableShippingMethods],
-    ["checkout.getAvailablePaymentMethods", client.checkout?.getAvailablePaymentMethods],
     ["checkout.setShippingInstruction", client.checkout?.setShippingInstruction],
     ["checkout.addPaymentInstruction", client.checkout?.addPaymentInstruction],
     ["checkout.finalizeCheckout", client.checkout?.finalizeCheckout],
-    ["productSearch.queryByTerm", client.productSearch?.queryByTerm],
-    ["product.getBySKU", client.product?.getBySKU],
-    ["price.getListPrice", client.price?.getListPrice],
-    ["price.getCustomerPrice", client.price?.getCustomerPrice],
-    ["inventory.getBySKU", client.inventory?.getBySKU]
+    ["product.getBySKU", client.product?.getBySKU]
   ].filter(([, operation]) => typeof operation !== "function").map(([name]) => name);
 }
-async function unwrapACPResult(resultPromise) {
+async function unwrapACPResult(resultPromise, param) {
   const result = await resultPromise;
-  if (!result.success) {
+  if (result.success) {
+    return result.value;
+  }
+  const errorType = typeof result.error === "object" && result.error !== null ? Reflect.get(result.error, "type") : void 0;
+  if (param && (errorType === "NotFound" || errorType === "InvalidInput")) {
     throw new ACPHttpError(400, {
-      type: "processing_error",
-      code: "reactionary_error",
-      message: JSON.stringify(result.error)
+      type: "invalid_request",
+      code: errorType === "NotFound" ? "not_found" : "invalid",
+      message: errorType === "NotFound" ? "The referenced resource does not exist." : "The request was rejected by the commerce backend.",
+      param
     });
   }
-  return result.value;
+  console.error("ACP: commerce backend operation failed:", result.error);
+  throw new ACPHttpError(502, {
+    type: "processing_error",
+    code: "backend_error",
+    message: "The commerce backend could not process the request."
+  });
 }
 function getCurrency(price, requestContext) {
   return (price.grandTotal.currency ?? requestContext.languageContext.currencyCode).toLowerCase();
 }
-function toACPLineItem(item) {
-  const baseAmount = toMinorUnits(item.price.unitPrice.value * item.quantity);
-  const discount = toMinorUnits(item.price.totalDiscount.value);
-  const total = toMinorUnits(item.price.totalPrice.value);
+function toACPLineItem(item, product) {
+  const sku = item.variant.sku;
+  const variant = product ? [product.mainVariant, ...product.variants].find((candidate) => candidate.identifier.sku === sku) : void 0;
+  const baseAmount = toMinorUnits({ value: item.price.unitPrice.value * item.quantity, currency: item.price.unitPrice.currency });
+  const discount = Math.abs(toMinorUnits(item.price.totalDiscount));
+  const images = (variant?.images ?? product?.mainVariant.images ?? []).map((image) => image.sourceUrl).filter((url) => url.length > 0);
+  const name = variant?.name || product?.name;
   return {
     id: item.identifier.key,
-    item: {
-      id: item.variant.sku,
-      quantity: item.quantity
-    },
-    base_amount: baseAmount,
-    discount,
-    subtotal: Math.max(baseAmount - discount, 0),
-    tax: 0,
-    total
+    item: { id: sku },
+    quantity: item.quantity,
+    ...name ? { name } : {},
+    ...product?.description ? { description: product.description } : {},
+    ...images.length > 0 ? { images } : {},
+    unit_amount: toMinorUnits(item.price.unitPrice),
+    ...product ? { product_id: product.identifier.key } : {},
+    sku,
+    ...variant && variant.options.length > 0 ? { variant_options: variant.options.map((option) => ({ name: option.name, value: option.value.label })) } : {},
+    totals: [
+      { type: "items_base_amount", display_text: "Base Amount", amount: baseAmount },
+      ...discount > 0 ? [{ type: "discount", display_text: "Discount", amount: discount }] : [],
+      { type: "subtotal", display_text: "Subtotal", amount: Math.max(baseAmount - discount, 0) },
+      { type: "total", display_text: "Total", amount: toMinorUnits(item.price.totalPrice) }
+    ]
   };
 }
 function toACPTotals(price) {
-  const base = toMinorUnits(price.totalProductPrice.value);
-  const discount = toMinorUnits(price.totalDiscount.value);
+  const base = toMinorUnits(price.totalProductPrice);
+  const discount = Math.abs(toMinorUnits(price.totalDiscount));
   const subtotal = Math.max(base - discount, 0);
-  const fulfillment = toMinorUnits(price.totalShipping.value);
-  const tax = toMinorUnits(price.totalTax.value);
-  const total = toMinorUnits(price.grandTotal.value);
+  const fulfillment = toMinorUnits(price.totalShipping);
+  const tax = toMinorUnits(price.totalTax);
+  const total = toMinorUnits(price.grandTotal);
   return [
     {
       type: "items_base_amount",
@@ -814,21 +1702,33 @@ function toACPTotals(price) {
     }
   ];
 }
-function toACPFulfillmentOption(method) {
-  const amount = toMinorUnits(method.price.value);
+function toACPFulfillmentOption(method, title, classification) {
+  const description = method.deliveryTime || method.description;
+  const { type, ...details } = classification;
   return {
-    type: "shipping",
+    type,
     id: method.identifier.key,
-    title: method.name,
-    subtitle: method.deliveryTime,
-    carrier: method.carrier ?? "",
-    earliest_delivery_time: (/* @__PURE__ */ new Date()).toISOString(),
-    latest_delivery_time: (/* @__PURE__ */ new Date()).toISOString(),
-    subtotal: amount,
-    tax: 0,
-    total: amount
+    title,
+    ...description ? { description } : {},
+    // Carriers belong to shipped options only.
+    ...type === "shipping" && method.carrier ? { carrier: method.carrier } : {},
+    ...details,
+    totals: [{ type: "total", display_text: title, amount: toMinorUnits(method.price) }]
   };
 }
+function getOptionTitles(options) {
+  const titles = /* @__PURE__ */ new Map();
+  const used = /* @__PURE__ */ new Set();
+  for (const option of options) {
+    let title = option.name || option.identifier.key;
+    if (used.has(title)) {
+      title = `${title} (${option.identifier.key})`;
+    }
+    used.add(title);
+    titles.set(option.identifier.key, title);
+  }
+  return titles;
+}
 function toReactionaryAddress(address) {
   const [firstName, ...lastNameParts] = address.name.split(" ");
   return {
@@ -842,34 +1742,35 @@ function toReactionaryAddress(address) {
     countryCode: address.country
   };
 }
-function toPaymentMethodIdentifier(provider) {
-  return {
-    method: "card",
-    name: provider,
-    paymentProcessor: provider
-  };
-}
-function toMinorUnits(value) {
-  return Math.max(Math.round(value * 100), 0);
-}
-function createFeedStream(chunks) {
-  const encoder = new TextEncoder();
-  const iterator = chunks[Symbol.asyncIterator]();
-  return new ReadableStream({
-    async pull(controller) {
-      const next = await iterator.next();
-      if (next.done) {
-        controller.close();
-        return;
-      }
-      controller.enqueue(
-        typeof next.value === "string" ? encoder.encode(next.value) : next.value
-      );
-    },
-    async cancel() {
-      await iterator.return?.();
-    }
-  });
+const CURRENCY_EXPONENTS = {
+  BIF: 0,
+  CLP: 0,
+  DJF: 0,
+  GNF: 0,
+  ISK: 0,
+  JPY: 0,
+  KMF: 0,
+  KRW: 0,
+  PYG: 0,
+  RWF: 0,
+  UGX: 0,
+  UYI: 0,
+  VND: 0,
+  VUV: 0,
+  XAF: 0,
+  XOF: 0,
+  XPF: 0,
+  BHD: 3,
+  IQD: 3,
+  JOD: 3,
+  KWD: 3,
+  LYD: 3,
+  OMR: 3,
+  TND: 3
+};
+function toMinorUnits(amount) {
+  const exponent = CURRENCY_EXPONENTS[amount.currency.toUpperCase()] ?? 2;
+  return Math.round(amount.value * 10 ** exponent);
 }
 async function toWebRequest(request) {
   const headers = toWebHeaders(request.headers);
@@ -926,10 +1827,12 @@ async function sendWebResponse(response, webResponse) {
 }
 function getAcpOperationPath(request, basePath) {
   const pathname = getProtocolPathname(request, basePath);
-  return pathname.replace(/^\/checkout_sessions\/[^/]+/, "/checkout_sessions/{id}").replace(/^\/product_feeds\/[^/]+/, "/product_feeds/{id}");
+  return pathname.replace(/^\/checkout_sessions\/[^/]+/, "/checkout_sessions/{id}").replace(/^\/carts\/[^/]+/, "/carts/{id}");
 }
 export {
+  ACP_API_VERSION,
   DEFAULT_ACP_PAYMENT_AUTHORIZATION_WAIT,
   DEFAULT_ACP_PLACEHOLDER_EMAIL,
-  ReactionaryACPServer
+  ReactionaryACPServer,
+  createBearerTokenAuthenticator
 };