@tagadapay/headless-sdk 1.3.2 → 1.5.0

package/dist/tagada-headless.js

@@ -1,5 +1,5 @@
 /**
- * @tagadapay/headless-sdk v1.3.2
+ * @tagadapay/headless-sdk v1.5.0
  * Headless checkout, payments, offers, and CRM
  * @license MIT
  */
@@ -123,8 +123,8 @@ var TagadaHeadlessBundle = (() => {
 
   // src/core/http.ts
   var BASE_URLS = {
-    production: "https://app.tagadapay.com",
-    development: "https://app.dev.tagadapay.com",
+    production: "https://api.tagada.io",
+    development: "https://api.tagada.dev",
     local: "http://localhost:3000"
   };
   var HttpClient = class {
@@ -241,20 +241,27 @@ var TagadaHeadlessBundle = (() => {
      *
      * @param checkoutToken The checkout token (from URL param `checkoutToken`).
      * @param sessionToken The JWT session token (from URL param `token`). Required for auth.
+     * @param opts.currency Optional presentment currency override (e.g. 'EUR').
+     *   Only applied when the session has no currency set yet (first load).
+     *   Once set, currency is locked to the session and this param is ignored.
      *
-     * Both values come from the redirect URL returned by `createSession()`.
+     * Both `checkoutToken` and `sessionToken` come from the redirect URL returned by `createSession()`.
      * Example URL: `/checkout?checkoutToken=abc123&token=eyJ...`
      */
-    async loadSession(checkoutToken, sessionToken) {
+    async loadSession(checkoutToken, sessionToken, opts) {
       var _a;
       if (sessionToken) {
         this.sessionToken = sessionToken;
         (_a = this.onTokenChange) == null ? void 0 : _a.call(this, sessionToken);
       }
+      const params = { skipAsyncWait: "false" };
+      if (opts == null ? void 0 : opts.currency) {
+        params.currency = opts.currency;
+      }
       const raw = await this.http.get(
         `/api/v1/checkout-sessions/${checkoutToken}/v2`,
         {
-          params: { skipAsyncWait: "false" },
+          params,
           token: this.sessionToken
         }
       );
@@ -277,17 +284,18 @@ var TagadaHeadlessBundle = (() => {
         storeId: this.storeId,
         lineItems
       };
-      if (opts.currency)
-        body.currency = opts.currency;
       if (opts.returnUrl)
         body.returnUrl = opts.returnUrl;
+      const customerData = {};
+      if (opts.currency)
+        customerData.currency = opts.currency;
       if (opts.customerEmail) {
-        body.customer = {
-          email: opts.customerEmail,
-          firstName: opts.customerFirstName,
-          lastName: opts.customerLastName,
-          currency: opts.currency
-        };
+        customerData.email = opts.customerEmail;
+        customerData.firstName = opts.customerFirstName;
+        customerData.lastName = opts.customerLastName;
+      }
+      if (Object.keys(customerData).length > 0) {
+        body.customer = customerData;
       }
       const res = await this.http.post("/api/v1/checkout/session/init", body);
       const url = new URL(res.checkoutUrl);
@@ -302,7 +310,18 @@ var TagadaHeadlessBundle = (() => {
         customerId: res.customerId
       };
     }
-    /** Replace the cart items for an existing session. */
+    /**
+     * Replace the cart items for an existing session.
+     *
+     * Returns a server-side mutation summary (counts of created/updated rows).
+     * It does NOT return the updated `CheckoutSession` — the underlying
+     * `POST /checkout-sessions/:id/line-items` endpoint never has and the
+     * previous typing was a lie that quietly assigned `{ success, updated, ... }`
+     * into a `CheckoutSession` slot in `useCheckout`.
+     *
+     * Call `loadSession()` after this if you need the refreshed session
+     * (the React `useCheckout` hook does this for you).
+     */
     async updateCart(sessionId, items) {
       return this.http.post(
         `/api/v1/checkout-sessions/${sessionId}/line-items`,
@@ -311,59 +330,117 @@ var TagadaHeadlessBundle = (() => {
       );
     }
     /**
-     * Update customer + address information on the session.
-     * Uses the combined endpoint with `partial: true` so missing fields are tolerated.
+     * Update customer identity (email, name, phone).
+     *
+     * Call this before `updateAddress()` — the SDK remembers the values and
+     * includes them automatically when addresses are submitted.
+     *
+     * If you prefer a single call, use `updateCustomerAndAddress()` instead.
      */
     async updateCustomer(sessionId, customer) {
+      if (customer.email)
+        this.customerEmail = customer.email;
+      if (customer.firstName)
+        this.customerFirstName = customer.firstName;
+      if (customer.lastName)
+        this.customerLastName = customer.lastName;
+      if (customer.phone)
+        this.customerPhone = customer.phone;
+    }
+    /**
+     * Update shipping and/or billing address on the session.
+     *
+     * Automatically includes customer name/phone stored from `updateCustomer()`.
+     * Uses the same atomic API call as the production checkout, so email,
+     * customer name, and addresses are all persisted together.
+     *
+     * **Shipped products**: pass `shippingAddress`. If `billingAddress` is omitted,
+     * the shipping address is automatically used as billing.
+     *
+     * **Digital products**: pass only `billingAddress` (no shipping needed).
+     *
+     * @example
+     * // Shipped product — billing = shipping automatically
+     * await checkout.updateAddress(sessionId, {
+     *   shippingAddress: { line1: '10 Rue de la Paix', city: 'Paris', postalCode: '75002', country: 'FR' },
+     * });
+     *
+     * @example
+     * // Digital product — billing only
+     * await checkout.updateAddress(sessionId, {
+     *   billingAddress: { country: 'FR' },
+     * });
+     */
+    async updateAddress(sessionId, addresses) {
+      const shipping = this.mapAddress(addresses.shippingAddress);
+      const billing = this.mapAddress(addresses.billingAddress);
+      const effectiveShipping = shipping ?? billing ?? {};
+      const effectiveBilling = billing ?? shipping;
+      const differentBilling = !!(addresses.billingAddress && addresses.shippingAddress);
       await this.http.post(
         `/api/v1/checkout-sessions/${sessionId}/customer-and-session-info`,
         {
           checkoutSessionId: sessionId,
-          partial: true,
           customerData: {
-            email: customer.email
-          },
-          shippingAddress: {
-            firstName: customer.firstName,
-            lastName: customer.lastName,
-            phone: customer.phone
+            email: this.customerEmail
           },
-          billingAddress: {},
-          differentBillingAddress: false
+          shippingAddress: effectiveShipping,
+          billingAddress: effectiveBilling ?? {},
+          differentBillingAddress: differentBilling
         },
         { token: this.sessionToken }
       );
     }
     /**
-     * Update shipping and/or billing address on the session.
+     * Set customer info + addresses in one call (mirrors production checkout).
      *
-     * Address fields use the API's naming: `address1`, `postal`, etc.
+     * Equivalent to calling `updateCustomer()` then `updateAddress()`, but
+     * in a single network request.
      */
-    async updateAddress(sessionId, addresses) {
-      const mapAddress = (a) => {
-        if (!a)
-          return void 0;
-        return {
-          address1: a.line1,
-          address2: a.line2,
-          city: a.city,
-          state: a.state,
-          postal: a.postalCode,
-          country: a.country
-        };
-      };
+    async updateCustomerAndAddress(sessionId, data) {
+      if (data.customer.email)
+        this.customerEmail = data.customer.email;
+      if (data.customer.firstName)
+        this.customerFirstName = data.customer.firstName;
+      if (data.customer.lastName)
+        this.customerLastName = data.customer.lastName;
+      if (data.customer.phone)
+        this.customerPhone = data.customer.phone;
+      const shipping = this.mapAddress(data.shippingAddress);
+      const billing = this.mapAddress(data.billingAddress);
+      const effectiveShipping = shipping ?? billing ?? {};
+      const effectiveBilling = billing ?? shipping;
+      const differentBilling = !!(data.billingAddress && data.shippingAddress);
       await this.http.post(
-        `/api/v1/checkout-sessions/${sessionId}/address`,
+        `/api/v1/checkout-sessions/${sessionId}/customer-and-session-info`,
         {
           checkoutSessionId: sessionId,
-          data: {
-            shippingAddress: mapAddress(addresses.shippingAddress) ?? {},
-            billingAddress: mapAddress(addresses.billingAddress)
-          }
+          customerData: {
+            email: this.customerEmail
+          },
+          shippingAddress: effectiveShipping,
+          billingAddress: effectiveBilling ?? {},
+          differentBillingAddress: differentBilling
         },
         { token: this.sessionToken }
       );
     }
+    /** Map an SDK Address to the API shape, injecting stored customer fields. */
+    mapAddress(a) {
+      if (!a)
+        return void 0;
+      return stripEmpty({
+        firstName: a.firstName ?? this.customerFirstName,
+        lastName: a.lastName ?? this.customerLastName,
+        phone: a.phone ?? this.customerPhone,
+        address1: a.line1,
+        address2: a.line2,
+        city: a.city,
+        state: a.state,
+        postal: a.postalCode,
+        country: a.country
+      });
+    }
     /** Apply a promotion code to the session. */
     async applyPromoCode(sessionId, code) {
       await this.http.post(
@@ -380,7 +457,13 @@ var TagadaHeadlessBundle = (() => {
         { token: this.sessionToken }
       );
     }
-    /** Fetch available shipping rates for the session's address. */
+    /**
+     * Fetch available shipping rates for the session's address.
+     * Only relevant for **shipped products** — digital products can skip this step.
+     *
+     * Requires a shipping address to be set first via `updateAddress()`.
+     * Returns an empty array if no rates are configured or address is missing.
+     */
     async getShippingRates(sessionId) {
       const res = await this.http.get(
         `/api/v1/checkout-sessions/${sessionId}/shipping-rates`,
@@ -388,7 +471,10 @@ var TagadaHeadlessBundle = (() => {
       );
       return res.rates ?? [];
     }
-    /** Select a shipping rate for the session. */
+    /**
+     * Select a shipping rate for the session.
+     * Only relevant for **shipped products** — digital products can skip this step.
+     */
     async selectShippingRate(sessionId, rateId) {
       await this.http.post(
         `/api/v1/checkout-sessions/${sessionId}/shipping-rate`,
@@ -401,17 +487,20 @@ var TagadaHeadlessBundle = (() => {
      * The raw response has nested `checkoutSession` + `summary` -- we flatten it.
      */
     normalizeSession(raw) {
+      var _a;
       const cs = raw.checkoutSession;
       const orderSummaries = cs.orderSummaries ?? [];
       const summary = raw.summary ?? cs.summary ?? orderSummaries[0] ?? {};
       const lineItems = cs.sessionLineItems ?? [];
       const customer = cs.customer;
+      const sessionCurrency = (_a = summary.currency ?? cs.selectedPresentmentCurrency) == null ? void 0 : _a.toUpperCase();
       const items = lineItems.map((li) => {
         const price = li.price;
         const variant = (price == null ? void 0 : price.variant) ?? {};
         const product = variant.product ?? {};
         const currencyOpts = (price == null ? void 0 : price.currencyOptions) ?? {};
-        const usd = currencyOpts.USD ?? currencyOpts[Object.keys(currencyOpts)[0]];
+        const priceEntry = (sessionCurrency ? currencyOpts[sessionCurrency] : void 0) ?? currencyOpts[Object.keys(currencyOpts)[0]];
+        const amount = (priceEntry == null ? void 0 : priceEntry.amount) ?? 0;
         return {
           id: li.id,
           variantId: li.variantId,
@@ -419,9 +508,9 @@ var TagadaHeadlessBundle = (() => {
           productName: product.name ?? "",
           variantName: variant.name ?? "",
           quantity: li.quantity ?? 1,
-          unitAmount: (usd == null ? void 0 : usd.amount) ?? 0,
-          totalAmount: ((usd == null ? void 0 : usd.amount) ?? 0) * (li.quantity ?? 1),
-          currency: cs.selectedPresentmentCurrency ?? "USD",
+          unitAmount: amount,
+          totalAmount: amount * (li.quantity ?? 1),
+          currency: sessionCurrency ?? "USD",
           imageUrl: variant.imageUrl ?? ""
         };
       });
@@ -430,7 +519,7 @@ var TagadaHeadlessBundle = (() => {
         id: cs.id,
         storeId: cs.storeId,
         checkoutToken: cs.checkoutToken,
-        currency: cs.selectedPresentmentCurrency ?? "USD",
+        currency: sessionCurrency ?? "USD",
         items,
         totals: {
           subtotal: summary.subtotalAmount ?? 0,
@@ -438,20 +527,55 @@ var TagadaHeadlessBundle = (() => {
           shipping: summary.shippingCost ?? 0,
           tax: summary.totalTaxAmount ?? 0,
           total: summary.totalAmount ?? summaryItems.reduce((s, i) => s + (i.amount ?? 0), 0),
-          currency: summary.currency ?? cs.selectedPresentmentCurrency ?? "USD"
+          currency: sessionCurrency ?? "USD"
         },
         customer: customer ? {
           id: customer.id,
           email: customer.email,
           firstName: customer.firstName,
-          lastName: customer.lastName
+          lastName: customer.lastName,
+          phone: customer.phone
         } : void 0,
-        shippingAddress: cs.shippingAddress,
-        billingAddress: cs.billingAddress,
+        shippingAddress: this.normalizeAddress(cs.shippingAddress),
+        billingAddress: this.normalizeAddress(cs.billingAddress),
+        selectedShippingRateId: cs.shippingRateId ?? null,
         metadata: cs.metadata
       };
     }
+    /**
+     * Map the raw API address shape (`address1`, `address2`, `postal`) onto
+     * the SDK's `Address` shape (`line1`, `line2`, `postalCode`). Without
+     * this, `session.shippingAddress.line1` is silently undefined after a
+     * reload — the type was lying about the actual key names — which is
+     * what makes the demo lose form state on refresh.
+     */
+    normalizeAddress(raw) {
+      if (!raw || typeof raw !== "object")
+        return void 0;
+      const a = raw;
+      const out = {
+        firstName: a.firstName,
+        lastName: a.lastName,
+        line1: a.line1 ?? a.address1,
+        line2: a.line2 ?? a.address2,
+        city: a.city,
+        state: a.state,
+        postalCode: a.postalCode ?? a.postal,
+        country: a.country,
+        phone: a.phone
+      };
+      return Object.values(out).some((v) => v !== void 0 && v !== "") ? out : void 0;
+    }
   };
+  function stripEmpty(obj) {
+    const result = {};
+    for (const [k, v] of Object.entries(obj)) {
+      if (v !== void 0 && v !== null && v !== "") {
+        result[k] = v;
+      }
+    }
+    return Object.keys(result).length > 0 ? result : void 0;
+  }
 
   // src/core/modules/payment.ts
   var PaymentModule = class {
@@ -467,8 +591,20 @@ var TagadaHeadlessBundle = (() => {
      * Get the full payment setup config for a checkout session.
      * Returns a map of payment methods with their configuration
      * (card, apple_pay, google_pay, klarna, etc.).
+     *
+     * Priority chain:
+     * 1. Explicit `paymentSetupConfig` parameter (developer override)
+     * 2. `window.__TGD_STEP_CONFIG__` injection (Tagada routing infra)
+     * 3. API fallback (`GET /api/v1/payment-methods`)
      */
-    async getPaymentSetup(checkoutSessionId) {
+    async getPaymentSetup(checkoutSessionId, opts) {
+      if (opts == null ? void 0 : opts.paymentSetupConfig) {
+        return opts.paymentSetupConfig;
+      }
+      const injected = this.readInjectedStepConfig();
+      if (injected) {
+        return injected;
+      }
       const methods = await this.http.get(
         "/api/v1/payment-methods",
         { params: { checkoutSessionId } }
@@ -484,12 +620,39 @@ var TagadaHeadlessBundle = (() => {
      * Get express payment methods (Apple Pay, Google Pay, PayPal, etc.)
      * filtered to only those available in the current browser.
      */
-    async getExpressMethods(checkoutSessionId) {
-      var _a, _b;
-      const setup = await this.getPaymentSetup(checkoutSessionId);
+    async getExpressMethods(checkoutSessionId, opts) {
+      var _a, _b, _c, _d, _e, _f, _g, _h, _i;
+      const setup = await this.getPaymentSetup(checkoutSessionId, opts);
       const result = {};
-      for (const [, config] of Object.entries(setup)) {
-        if (!config.enabled || !config.express)
+      for (const [key, config] of Object.entries(setup)) {
+        if (!config.enabled)
+          continue;
+        if (key.startsWith("express_checkout:") && config.methods) {
+          const base2 = {
+            available: true,
+            processorId: config.processorId,
+            publishableKey: config.publishableKey,
+            metadata: config.metadata
+          };
+          if ((_a = config.methods.apple_pay) == null ? void 0 : _a.enabled) {
+            const hasApplePay = typeof window !== "undefined" && "ApplePaySession" in window && ((_c = (_b = window.ApplePaySession) == null ? void 0 : _b.canMakePayments) == null ? void 0 : _c.call(_b));
+            result.applePay = { ...base2, type: "apple_pay", available: !!hasApplePay };
+          }
+          if ((_d = config.methods.google_pay) == null ? void 0 : _d.enabled) {
+            result.googlePay = { ...base2, type: "google_pay" };
+          }
+          if ((_e = config.methods.paypal) == null ? void 0 : _e.enabled) {
+            result.paypal = { ...base2, type: "paypal" };
+          }
+          if ((_f = config.methods.link) == null ? void 0 : _f.enabled) {
+            result.link = { ...base2, type: "link" };
+          }
+          if ((_g = config.methods.klarna_express) == null ? void 0 : _g.enabled) {
+            result.klarna = { ...base2, type: "klarna_express" };
+          }
+          continue;
+        }
+        if (!config.express)
           continue;
         const method = config.method;
         const base = {
@@ -500,7 +663,7 @@ var TagadaHeadlessBundle = (() => {
           metadata: config.metadata
         };
         if (method === "apple_pay" || config.type === "apple_pay") {
-          const hasApplePay = typeof window !== "undefined" && "ApplePaySession" in window && ((_b = (_a = window.ApplePaySession) == null ? void 0 : _a.canMakePayments) == null ? void 0 : _b.call(_a));
+          const hasApplePay = typeof window !== "undefined" && "ApplePaySession" in window && ((_i = (_h = window.ApplePaySession) == null ? void 0 : _h.canMakePayments) == null ? void 0 : _i.call(_h));
           result.applePay = { ...base, available: !!hasApplePay };
         } else if (method === "google_pay" || config.type === "google_pay") {
           result.googlePay = base;
@@ -527,8 +690,8 @@ var TagadaHeadlessBundle = (() => {
     /**
      * Convenience: return only enabled payment method keys.
      */
-    async getEnabledMethods(checkoutSessionId) {
-      const setup = await this.getPaymentSetup(checkoutSessionId);
+    async getEnabledMethods(checkoutSessionId, opts) {
+      const setup = await this.getPaymentSetup(checkoutSessionId, opts);
       return Object.entries(setup).filter(([, c]) => c.enabled).map(([key]) => key);
     }
     // ---------------------------------------------------------------------------
@@ -538,6 +701,14 @@ var TagadaHeadlessBundle = (() => {
      * Tokenize a card using @tagadapay/core-js.
      * Requires `@tagadapay/core-js` to be installed as a peer dependency.
      *
+     * Card data is sent directly to Basis Theory for tokenization and never
+     * reaches TagadaPay servers. The returned `tagadaToken` is safe to pass
+     * to the TagadaPay API.
+     *
+     * **PCI note:** Using this method means card data passes through your
+     * JavaScript environment. You are responsible for PCI DSS SAQ-A-EP
+     * compliance. See https://docs.tagada.io/developer-tools/headless-sdk/pci-compliance
+     *
      * @returns tagadaToken (base64 string) and rawToken with SCA metadata.
      */
     async tokenizeCard(card) {
@@ -598,6 +769,7 @@ var TagadaHeadlessBundle = (() => {
         return this.http.post("/api/v1/payment/pay-with-token", {
           tagadaToken: opts.tagadaToken,
           checkoutSessionId: opts.checkoutSessionId,
+          returnUrl: opts.returnUrl,
           paymentFlowId: opts.paymentFlowId,
           processorId: opts.processorId,
           paymentMethod: opts.paymentMethod,
@@ -681,6 +853,85 @@ var TagadaHeadlessBundle = (() => {
         paymentFlowId: opts.paymentFlowId
       });
     }
+    /**
+     * Initiate a Stripe Express Checkout payment (Apple Pay, Google Pay, Link, etc.).
+     *
+     * Calls `pay-v2` with `isExpress: true`, which returns a `clientSecret` in
+     * `payment.requireActionData.metadata.stripeExpressCheckout.clientSecret`.
+     * The caller must then call `stripe.confirmPayment()` with that secret.
+     *
+     * Used by the `StripeExpressCheckout` class and `useStripeExpress` hook.
+     * Not typically called directly — use the Stripe integration classes instead.
+     */
+    async processStripeExpress(opts) {
+      return this.payDirect({
+        checkoutSessionId: opts.checkoutSessionId,
+        processorId: opts.processorId,
+        paymentMethod: opts.paymentMethod,
+        isExpress: true
+      });
+    }
+    // ---------------------------------------------------------------------------
+    // High-level orchestrator — the ONE function beginners should call
+    // ---------------------------------------------------------------------------
+    /**
+     * Process a payment end-to-end: pay, handle 3DS / redirects, poll until done.
+     *
+     * This is the **recommended** way to process payments. It wraps `pay()`, detects
+     * `requireAction`, runs 3DS challenges (if `@tagadapay/core-js` is installed),
+     * and polls until a terminal status.
+     *
+     * Returns a discriminated union so you can pattern-match on `result.status`:
+     *
+     * @example
+     * ```ts
+     * const result = await payment.processPayment({
+     *   checkoutSessionId: session.id,
+     *   tagadaToken,
+     * });
+     *
+     * switch (result.status) {
+     *   case 'succeeded':
+     *     console.log('Paid!', result.payment.id);
+     *     break;
+     *   case 'requires_redirect':
+     *     // In browser: window.location.href = result.redirectUrl
+     *     // The React hook handles this automatically.
+     *     break;
+     *   case 'failed':
+     *     console.error(result.error);
+     *     break;
+     * }
+     * ```
+     */
+    async processPayment(opts) {
+      var _a, _b;
+      if (!opts.returnUrl && typeof window !== "undefined") {
+        opts = { ...opts, returnUrl: window.location.href };
+      }
+      const payResult = await this.pay(opts);
+      const payment = payResult.payment;
+      if (payment.status === "succeeded") {
+        return { status: "succeeded", payment, order: payResult.order };
+      }
+      if (payment.status === "failed" || payment.status === "declined") {
+        const msg = ((_a = payment.requireActionData) == null ? void 0 : _a.message) || ((_b = payment.requireActionData) == null ? void 0 : _b.errorCode) || `Payment ${payment.status}`;
+        return { status: "failed", error: msg, payment };
+      }
+      if (payment.requireAction && payment.requireAction !== "none" && payment.requireActionData) {
+        return this.handlePaymentAction(payment, opts);
+      }
+      return this.pollUntilDone(payment.id);
+    }
+    /**
+     * Resume a payment after the user returns from a redirect (3DS, processor auth, APM).
+     *
+     * Called automatically by `usePayment()` in React when it detects return-URL params.
+     * You can also call it manually in non-React apps.
+     */
+    async resumeAfterRedirect(paymentId) {
+      return this.pollUntilDone(paymentId);
+    }
     // ---------------------------------------------------------------------------
     // Status polling
     // ---------------------------------------------------------------------------
@@ -711,9 +962,175 @@ var TagadaHeadlessBundle = (() => {
         paymentId
       });
     }
+    /** Tell the server this action has been seen / is being processed. */
+    async markActionProcessed(paymentId) {
+      try {
+        await this.http.post("/api/v1/payments/require-action/processed", {
+          paymentId
+        });
+      } catch {
+      }
+    }
+    // ---------------------------------------------------------------------------
+    // Internal: action routing
+    // ---------------------------------------------------------------------------
+    /**
+     * Route a payment action to the appropriate handler.
+     * Returns `requires_redirect` for browser-level redirects,
+     * or attempts 3DS inline and polls to completion.
+     */
+    async handlePaymentAction(payment, opts) {
+      const actionData = payment.requireActionData;
+      await this.markActionProcessed(payment.id);
+      const actionType = actionData.type;
+      switch (actionType) {
+        case "threeds_auth":
+          return this.handleThreedsAuth(payment, opts);
+        case "processor_auth":
+        case "redirect_to_payment":
+          return this.extractRedirect(payment, actionData);
+        case "redirect":
+          return this.extractRedirect(payment, actionData);
+        case "error":
+          return {
+            status: "failed",
+            error: actionData.message || actionData.errorCode || "Payment failed",
+            payment
+          };
+        default:
+          return this.extractRedirect(payment, actionData);
+      }
+    }
+    /**
+     * Extract redirect info from actionData.
+     * Works for processor_auth (GET or POST), redirect, and any unknown type with a URL.
+     */
+    extractRedirect(payment, actionData) {
+      var _a, _b;
+      const redirect = (_a = actionData.metadata) == null ? void 0 : _a.redirect;
+      const url = (redirect == null ? void 0 : redirect.redirectUrl) || actionData.redirectUrl;
+      if (!url) {
+        return {
+          status: "failed",
+          error: `Payment requires action (${actionData.type}) but no redirect URL was provided`,
+          payment
+        };
+      }
+      return {
+        status: "requires_redirect",
+        redirectUrl: url,
+        method: ((_b = redirect == null ? void 0 : redirect.method) == null ? void 0 : _b.toUpperCase()) || "GET",
+        postData: redirect == null ? void 0 : redirect.data,
+        paymentId: payment.id
+      };
+    }
+    /**
+     * Run a 3DS challenge using @tagadapay/core-js.
+     * If core-js is not installed, falls back to redirect.
+     */
+    async handleThreedsAuth(payment, opts) {
+      var _a, _b;
+      const session = (_b = (_a = payment.requireActionData) == null ? void 0 : _a.metadata) == null ? void 0 : _b.threedsSession;
+      if (!(session == null ? void 0 : session.externalSessionId)) {
+        return this.extractRedirect(payment, payment.requireActionData);
+      }
+      let coreJs;
+      try {
+        coreJs = await import("@tagadapay/core-js");
+      } catch {
+        if (session.acsChallengeUrl) {
+          return {
+            status: "requires_redirect",
+            redirectUrl: session.acsChallengeUrl,
+            paymentId: payment.id
+          };
+        }
+        return this.extractRedirect(payment, payment.requireActionData);
+      }
+      try {
+        const manager = new coreJs.ThreedsManager({ provider: "basis_theory" });
+        await manager.initialize({ apiKey: void 0 });
+        await manager.startChallenge({
+          sessionId: session.externalSessionId,
+          acsChallengeUrl: session.acsChallengeUrl,
+          acsTransactionId: session.acsTransID,
+          threeDSVersion: session.messageVersion
+        });
+        await this.completeAfter3ds(payment.id);
+        return this.pollUntilDone(payment.id);
+      } catch {
+        if (session.acsChallengeUrl) {
+          return {
+            status: "requires_redirect",
+            redirectUrl: session.acsChallengeUrl,
+            paymentId: payment.id
+          };
+        }
+        return {
+          status: "failed",
+          error: "3D Secure authentication failed",
+          payment
+        };
+      }
+    }
+    /**
+     * Poll until the payment reaches a terminal status, then return a ProcessPaymentResult.
+     * Also handles new requireAction that may appear during polling.
+     */
+    async pollUntilDone(paymentId, opts) {
+      const interval = (opts == null ? void 0 : opts.intervalMs) ?? 1500;
+      const timeout = (opts == null ? void 0 : opts.timeoutMs) ?? 6e4;
+      const start = Date.now();
+      let consecutiveErrors = 0;
+      while (Date.now() - start < timeout) {
+        let status;
+        try {
+          status = await this.getPaymentStatus(paymentId);
+          consecutiveErrors = 0;
+        } catch {
+          consecutiveErrors++;
+          if (consecutiveErrors >= 3) {
+            return { status: "failed", error: "Payment verification failed due to network errors" };
+          }
+          await new Promise((r) => setTimeout(r, interval));
+          continue;
+        }
+        if (status.status === "succeeded" || status.status === "pending" && status.subStatus === "authorized") {
+          return { status: "succeeded", payment: status, order: status.order };
+        }
+        if (status.status === "failed" || status.status === "declined") {
+          return { status: "failed", error: status.status, payment: status };
+        }
+        if (status.requireAction && status.requireAction !== "none" && status.requireActionData && !status.requireActionData.processed) {
+          return this.handlePaymentAction(
+            status,
+            {}
+          );
+        }
+        await new Promise((r) => setTimeout(r, interval));
+      }
+      return { status: "pending", paymentId };
+    }
     // ---------------------------------------------------------------------------
     // Internal helpers
     // ---------------------------------------------------------------------------
+    /**
+     * Read paymentSetupConfig from the Tagada routing injection.
+     * Only available when running on Tagada infra (not on external hosting like Vercel).
+     */
+    readInjectedStepConfig() {
+      if (typeof window === "undefined")
+        return null;
+      const raw = window.__TGD_STEP_CONFIG__;
+      if (!raw)
+        return null;
+      try {
+        const parsed = typeof raw === "string" ? JSON.parse(raw) : raw;
+        return (parsed == null ? void 0 : parsed.paymentSetupConfig) ?? null;
+      } catch {
+        return null;
+      }
+    }
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     async loadCoreJs() {
       try {