@trusty-squire/mcp 1.0.50 → 1.1.0

package/dist/bot/browser.js

@@ -109,6 +109,90 @@ function getChromium() {
     }
     return cachedChromium;
 }
+const CURRENCY_SYMBOLS = {
+    $: "USD",
+    "€": "EUR",
+    "£": "GBP",
+    "¥": "JPY",
+};
+function currencyMinorDigits(currency) {
+    return new Intl.NumberFormat(undefined, {
+        style: "currency",
+        currency,
+    }).resolvedOptions().maximumFractionDigits;
+}
+function parseDisplayedNumber(raw, minorDigits) {
+    const value = raw.replace(/\s/g, "");
+    const comma = value.lastIndexOf(",");
+    const dot = value.lastIndexOf(".");
+    let normalized = value;
+    if (comma >= 0 && dot >= 0) {
+        const decimalIndex = Math.max(comma, dot);
+        const fractionLength = value.length - decimalIndex - 1;
+        if (minorDigits > 0 && fractionLength > 0 && fractionLength <= minorDigits) {
+            const integer = value.slice(0, decimalIndex).replace(/[.,]/g, "");
+            normalized = `${integer}.${value.slice(decimalIndex + 1)}`;
+        }
+        else {
+            normalized = value.replace(/[.,]/g, "");
+        }
+    }
+    else if (comma >= 0) {
+        const commaCount = (value.match(/,/g) ?? []).length;
+        const fractionLength = value.length - comma - 1;
+        normalized =
+            commaCount === 1 && minorDigits > 0 && fractionLength > 0 && fractionLength <= minorDigits
+                ? value.replace(",", ".")
+                : value.replaceAll(",", "");
+    }
+    else if ((value.match(/\./g) ?? []).length > 1) {
+        normalized = value.replaceAll(".", "");
+    }
+    else if (dot >= 0) {
+        const fractionLength = value.length - dot - 1;
+        normalized =
+            minorDigits > 0 && fractionLength > 0 && fractionLength <= minorDigits
+                ? value
+                : value.replace(".", "");
+    }
+    const parsed = Number(normalized);
+    return Number.isFinite(parsed) && parsed >= 0 ? parsed : null;
+}
+export function parseCheckoutAmount(texts, fallbackCurrency) {
+    const totalPattern = /\b(?:order\s+total|grand\s+total|total\s+due|amount\s+due|total)\b\s*:?\s*(?:(USD|EUR|GBP|CAD|AUD|JPY|NZD|CHF|SEK|NOK|DKK)\s*)?([$€£¥])?\s*([0-9][0-9.,]*)(?:\s*(USD|EUR|GBP|CAD|AUD|JPY|NZD|CHF|SEK|NOK|DKK))?/gi;
+    for (const text of texts) {
+        totalPattern.lastIndex = 0;
+        for (const match of text.matchAll(totalPattern)) {
+            const currency = (match[1] ??
+                match[4] ??
+                CURRENCY_SYMBOLS[match[2] ?? ""] ??
+                fallbackCurrency)?.toUpperCase();
+            if (currency === undefined || !/^[A-Z]{3}$/.test(currency))
+                continue;
+            const minorDigits = currencyMinorDigits(currency);
+            const amount = parseDisplayedNumber(match[3] ?? "", minorDigits);
+            if (amount === null)
+                continue;
+            const scale = 10 ** minorDigits;
+            const minor = Math.round(amount * scale);
+            if (Math.abs(amount * scale - minor) > 1e-6)
+                continue;
+            return { amount_cents: minor, currency };
+        }
+    }
+    return null;
+}
+function merchantFromPage(title, siteName, url) {
+    if (siteName.trim().length > 0)
+        return siteName.trim().slice(0, 256);
+    const titlePart = title
+        .split(/\s+[|—–-]\s+/)
+        .find((part) => !/\b(checkout|payment|cart|order)\b/i.test(part));
+    if (titlePart !== undefined && titlePart.trim().length > 0) {
+        return titlePart.trim().slice(0, 256);
+    }
+    return new URL(url).hostname.replace(/^www\./, "").slice(0, 256);
+}
 const HCAPTCHA_UUID_RE = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
 export function extractHcaptchaSitekeyFromHtml(html) {
     if (!/hcaptcha\.com|h-captcha|hcaptcha/i.test(html))
@@ -207,10 +291,7 @@ function isCaptchaVariant(v) {
 function pngDimensions(buf) {
     if (buf.length < 24)
         return null;
-    if (buf[0] !== 0x89 ||
-        buf[1] !== 0x50 ||
-        buf[2] !== 0x4e ||
-        buf[3] !== 0x47) {
+    if (buf[0] !== 0x89 || buf[1] !== 0x50 || buf[2] !== 0x4e || buf[3] !== 0x47) {
         return null;
     }
     return { width: buf.readUInt32BE(16), height: buf.readUInt32BE(20) };
@@ -226,12 +307,7 @@ function pngDimensions(buf) {
 // hardest to fingerprint as automation. Stable Chrome > Edge >
 // Beta/Canary > Brave. Brave isn't a Playwright channel but its
 // binary path is well-known; we resolve it explicitly below.
-const PREFERRED_CHANNELS = [
-    "chrome",
-    "msedge",
-    "chrome-beta",
-    "chrome-canary",
-];
+const PREFERRED_CHANNELS = ["chrome", "msedge", "chrome-beta", "chrome-canary"];
 // Per-channel binary search paths. Playwright's `executablePath()` is
 // argumentless (returns the bundled Chromium path), so we can't ask it
 // "is Chrome installed?" — we have to look ourselves. These are the
@@ -784,9 +860,7 @@ export class BrowserController {
         this.humanize = opts.humanize ?? true;
         this.profileDir = opts.profileDir ?? CHROME_PROFILE_DIR;
         this.proxyOverride =
-            opts.proxyUrl !== undefined && opts.proxyUrl.trim().length > 0
-                ? opts.proxyUrl.trim()
-                : null;
+            opts.proxyUrl !== undefined && opts.proxyUrl.trim().length > 0 ? opts.proxyUrl.trim() : null;
     }
     // Per-launch egress override (verify-fleet identities each get their own IP).
     // null → use the env-global proxy. See resolveProxy().
@@ -870,7 +944,10 @@ export class BrowserController {
                 ...(params.headless ? ["--headless=new"] : []),
                 "about:blank",
             ];
-            const child = spawn(params.binary, argv, { env: params.env, stdio: ["ignore", "ignore", "pipe"] });
+            const child = spawn(params.binary, argv, {
+                env: params.env,
+                stdio: ["ignore", "ignore", "pipe"],
+            });
             this.childChrome = child;
             registerSelfManagedChrome(child);
             let chromeStderr = "";
@@ -943,17 +1020,35 @@ export class BrowserController {
             return;
         const BLOCK_TYPES = new Set(["image", "media", "font"]);
         const BLOCK_HOSTS = [
-            "google-analytics.com", "googletagmanager.com", "analytics.google.com",
-            "doubleclick.net", "static.hotjar.com", "script.hotjar.com",
-            "segment.com", "segment.io", "cdn.segment.com", "fullstory.com",
-            "mixpanel.com", "bugsnag.com", "intercom.io", "intercomcdn.com",
-            "widget.intercom.io", "connect.facebook.net", "analytics.tiktok.com",
-            "clarity.ms", "cdn.heapanalytics.com", "wistia.com",
+            "google-analytics.com",
+            "googletagmanager.com",
+            "analytics.google.com",
+            "doubleclick.net",
+            "static.hotjar.com",
+            "script.hotjar.com",
+            "segment.com",
+            "segment.io",
+            "cdn.segment.com",
+            "fullstory.com",
+            "mixpanel.com",
+            "bugsnag.com",
+            "intercom.io",
+            "intercomcdn.com",
+            "widget.intercom.io",
+            "connect.facebook.net",
+            "analytics.tiktok.com",
+            "clarity.ms",
+            "cdn.heapanalytics.com",
+            "wistia.com",
         ];
         // NEVER block — these break signup (captcha/challenge widgets + payment SDK).
         const ALWAYS_ALLOW = [
-            "challenges.cloudflare.com", "turnstile", "hcaptcha.com",
-            "newassets.hcaptcha.com", "recaptcha", "gstatic.com/recaptcha",
+            "challenges.cloudflare.com",
+            "turnstile",
+            "hcaptcha.com",
+            "newassets.hcaptcha.com",
+            "recaptcha",
+            "gstatic.com/recaptcha",
             "js.stripe.com",
         ];
         await ctx.route("**/*", async (route) => {
@@ -1393,7 +1488,6 @@ export class BrowserController {
             void (async () => {
                 if (trace) {
                     const before = await frame.evaluate(RENDERER_PROBE).catch(() => "eval-fail");
-                    // eslint-disable-next-line no-console
                     console.error(`[captcha-fp] ${cfHost} renderer BEFORE spoof: ${before}`);
                 }
                 // Retry until the spoof STICKS. The first framenavigated commonly
@@ -1412,7 +1506,6 @@ export class BrowserController {
                         await new Promise((res) => setTimeout(res, 150));
                 }
                 if (trace) {
-                    // eslint-disable-next-line no-console
                     console.error(`[captcha-fp] ${cfHost} renderer AFTER spoof:  ${landed ? "Intel (landed)" : "FAILED to land in budget"}`);
                 }
             })();
@@ -1439,8 +1532,7 @@ export class BrowserController {
                     /api\.hcaptcha\.com\/(?:checksiteconfig|getcaptcha|checkcaptcha)/.test(url)) {
                     try {
                         const body = await resp.text();
-                        bodyPreview =
-                            body.length > 400 ? body.slice(0, 400) + "…" : body;
+                        bodyPreview = body.length > 400 ? body.slice(0, 400) + "…" : body;
                     }
                     catch {
                         // body may be evicted; ignore
@@ -1590,8 +1682,7 @@ export class BrowserController {
         // not fire. MEASURED 2026-07-01 (Loops "Login link": the results list has no
         // /api/auth/callback href; opening the row reveals it).
         const els = await this.extractInteractiveElements();
-        const row = els.find((e) => e.role === "link" &&
-            (e.visibleText ?? e.ariaLabel ?? e.labelText ?? "").trim().length > 25);
+        const row = els.find((e) => e.role === "link" && (e.visibleText ?? e.ariaLabel ?? e.labelText ?? "").trim().length > 25);
         if (row === undefined)
             return false;
         await this.click(row.selector).catch(() => { });
@@ -1626,7 +1717,9 @@ export class BrowserController {
             try {
                 const left = new URL(a);
                 const right = new URL(b);
-                return left.origin === right.origin && left.pathname === right.pathname && left.search === right.search;
+                return (left.origin === right.origin &&
+                    left.pathname === right.pathname &&
+                    left.search === right.search);
             }
             catch {
                 return false;
@@ -1678,7 +1771,9 @@ export class BrowserController {
                     if (landedAuthGateForTarget(this.page.url(), url))
                         break;
                     await this.page
-                        .waitForURL((landed) => sameOriginPathAndSearch(landed.toString(), url), { timeout: 5000 })
+                        .waitForURL((landed) => sameOriginPathAndSearch(landed.toString(), url), {
+                        timeout: 5000,
+                    })
                         .then(() => undefined)
                         .catch(() => undefined);
                     if (sameOriginPathAndSearch(this.page.url(), url))
@@ -2052,7 +2147,7 @@ export class BrowserController {
                 // — the trigger updates + Next un-gates — but only when we target the
                 // option element, not its child span (which a raw coordinate click drops).
                 const optEl = el.closest('[role="option"],[role="menuitem"],[role="menuitemradio"],[cmdk-item]');
-                const optRole = optEl !== null ? optEl.getAttribute("role") ?? "option" : "";
+                const optRole = optEl !== null ? (optEl.getAttribute("role") ?? "option") : "";
                 const optText = optEl !== null ? (optEl.textContent ?? "").trim().slice(0, 80) : "";
                 return {
                     inputKind,
@@ -2076,7 +2171,9 @@ export class BrowserController {
             // NOT the anti-bot-scored gate.
             const optRole = probe.role === "option" || probe.role === "menuitem" || probe.role === "menuitemradio"
                 ? probe.role
-                : probe.optRole === "option" || probe.optRole === "menuitem" || probe.optRole === "menuitemradio"
+                : probe.optRole === "option" ||
+                    probe.optRole === "menuitem" ||
+                    probe.optRole === "menuitemradio"
                     ? probe.optRole
                     : "";
             const optName = probe.role !== "" ? probe.text : probe.optText;
@@ -2197,9 +2294,7 @@ export class BrowserController {
             // Escape regex metacharacters in the user-supplied label text so
             // a literal "(2FA)" or "." doesn't get interpreted as a pattern.
             const escaped = text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-            const locator = this.page
-                .getByText(new RegExp(escaped, "i"))
-                .first();
+            const locator = this.page.getByText(new RegExp(escaped, "i")).first();
             await locator.waitFor({ state: "visible", timeout: timeoutMs });
             if (this.humanize) {
                 await this.humanClickLocator(locator);
@@ -2322,10 +2417,16 @@ export class BrowserController {
     async ensureChecked(selector) {
         if (!this.page)
             return false;
-        if (await this.page.locator(selector).isChecked().catch(() => false))
+        if (await this.page
+            .locator(selector)
+            .isChecked()
+            .catch(() => false))
             return true;
         await this.clickAssociatedLabel(selector).catch(() => false);
-        if (await this.page.locator(selector).isChecked().catch(() => false))
+        if (await this.page
+            .locator(selector)
+            .isChecked()
+            .catch(() => false))
             return true;
         const domChecked = await this.page
             .locator(selector)
@@ -2350,7 +2451,10 @@ export class BrowserController {
             .catch(() => false);
         if (!domChecked)
             return false;
-        return await this.page.locator(selector).isChecked().catch(() => false);
+        return await this.page
+            .locator(selector)
+            .isChecked()
+            .catch(() => false);
     }
     // Click the <label> associated with a checkbox/radio input — either a
     // `<label for="<id>">` or the wrapping `<label>` ancestor. Mantine/Radix
@@ -2552,9 +2656,7 @@ export class BrowserController {
                     if (!box.checked)
                         return false;
                     const text = associatedText(box);
-                    return (!agreementRe.test(text) &&
-                        !marketingRe.test(text) &&
-                        !riskyChoiceRe.test(text));
+                    return !agreementRe.test(text) && !marketingRe.test(text) && !riskyChoiceRe.test(text);
                 });
                 if (alreadyChoseCategory)
                     return [];
@@ -2699,8 +2801,7 @@ export class BrowserController {
         // the disabled button is NOT scroll position (Railway iter ≥2 on
         // the second ToS modal: planner kept asking for scroll when the
         // form was actually waiting on something else).
-        if (target.scrollTop + target.clientHeight >=
-            target.scrollHeight - 4) {
+        if (target.scrollTop + target.clientHeight >= target.scrollHeight - 4) {
             return {
                 scrolled: false,
                 container: selector ?? "auto-detected",
@@ -2995,8 +3096,8 @@ export class BrowserController {
             '[role="option"]:visible',
             '[role="menuitem"]:visible',
             '[role="menuitemradio"]:visible',
-            'mat-option:visible',
-            '.mat-mdc-option:visible',
+            "mat-option:visible",
+            ".mat-mdc-option:visible",
             '[id^="react-select-"][role*="menu"]:visible',
             '[role="listbox"]:visible li:visible',
         ];
@@ -3092,10 +3193,10 @@ export class BrowserController {
             // CSS-escape the id so unusual characters (Sentry's `--` separator
             // is fine, but the helper is defensive against future ids that
             // include `.`, spaces, …) don't break the locator.
-            const escaped = (typeof globalThis.CSS?.escape ===
+            const escaped = typeof globalThis.CSS?.escape ===
                 "function"
                 ? globalThis.CSS.escape(resolvedId)
-                : resolvedId.replace(/([!"#$%&'()*+,./:;<=>?@[\\\]^`{|}~])/g, "\\$1"));
+                : resolvedId.replace(/([!"#$%&'()*+,./:;<=>?@[\\\]^`{|}~])/g, "\\$1");
             return `#${escaped}`;
         }
         catch {
@@ -3124,9 +3225,7 @@ export class BrowserController {
             throw new Error("Browser not started");
         const triggerLocator = this.page.locator(triggerSelector);
         try {
-            const tagName = await triggerLocator
-                .first()
-                .evaluate((node) => node.tagName.toLowerCase());
+            const tagName = await triggerLocator.first().evaluate((node) => node.tagName.toLowerCase());
             // Limit this path to input-typed triggers; native <select> and
             // <button role="combobox"> are handled by other tiers. The
             // selectFromCombobox caller has already returned for matching
@@ -3471,9 +3570,7 @@ export class BrowserController {
                                 out.webglUnmaskedVendor = gl.getParameter(dbg.UNMASKED_VENDOR_WEBGL);
                                 out.webglUnmaskedRenderer = gl.getParameter(dbg.UNMASKED_RENDERER_WEBGL);
                             }
-                            out.webglExtensions = (gl.getSupportedExtensions() ?? [])
-                                .slice(0, 6)
-                                .join(",");
+                            out.webglExtensions = (gl.getSupportedExtensions() ?? []).slice(0, 6).join(",");
                         }
                         else {
                             out.webglVendor = null;
@@ -3520,8 +3617,7 @@ export class BrowserController {
                 console.error("[fingerprint] " + JSON.stringify(fp));
             }
             catch (err) {
-                console.error("[fingerprint] probe failed: " +
-                    (err instanceof Error ? err.message : String(err)));
+                console.error("[fingerprint] probe failed: " + (err instanceof Error ? err.message : String(err)));
             }
         }
         // Click at the checkbox position. Turnstile's checkbox sits at
@@ -3656,7 +3752,10 @@ export class BrowserController {
             { kind: "turnstile", selector: 'iframe[src*="challenges.cloudflare.com"]' },
             // Visible reCAPTCHA only — the size=invisible anchor (score-mode badge)
             // is handled by the recaptchaInvisibleOnly skip above.
-            { kind: "recaptcha", selector: 'iframe[src*="recaptcha/api2/anchor"]:not([src*="size=invisible"])' },
+            {
+                kind: "recaptcha",
+                selector: 'iframe[src*="recaptcha/api2/anchor"]:not([src*="size=invisible"])',
+            },
             // hCaptcha's checkbox iframe (the anchor frame). Plausible and other
             // hCaptcha sites render this; clicking it ticks the box the same way
             // Turnstile/reCAPTCHA do.
@@ -3897,7 +3996,8 @@ export class BrowserController {
                             for (const [, v] of Object.entries(obj)) {
                                 if (v === null || typeof v !== "object")
                                     continue;
-                                if ("callback" in v && typeof v.callback === "function") {
+                                if ("callback" in v &&
+                                    typeof v.callback === "function") {
                                     try {
                                         v.callback(tok);
                                     }
@@ -4123,8 +4223,7 @@ export class BrowserController {
             const fromDom = await this.page.evaluate(() => {
                 const div = document.querySelector(".h-captcha[data-sitekey], [data-hcaptcha-sitekey]");
                 if (div !== null) {
-                    const k = div.getAttribute("data-sitekey") ??
-                        div.getAttribute("data-hcaptcha-sitekey");
+                    const k = div.getAttribute("data-sitekey") ?? div.getAttribute("data-hcaptcha-sitekey");
                     if (k !== null && k.length > 10)
                         return k;
                 }
@@ -4381,8 +4480,7 @@ export class BrowserController {
             return {
                 found: true,
                 solved: false,
-                reason: `2captcha_${solveRes.kind}` +
-                    ("reason" in solveRes ? `:${solveRes.reason}` : ""),
+                reason: `2captcha_${solveRes.kind}` + ("reason" in solveRes ? `:${solveRes.reason}` : ""),
                 clicks: 0,
                 ...("durationMs" in solveRes ? { durationMs: solveRes.durationMs } : {}),
             };
@@ -4563,7 +4661,7 @@ export class BrowserController {
     async extractText() {
         if (!this.page)
             throw new Error("Browser not started");
-        return await this.page.textContent("body") || "";
+        return (await this.page.textContent("body")) || "";
     }
     // RENDERED, visibility-respecting body text. extractText() reads
     // textContent("body"), which includes display:none / visibility:hidden /
@@ -4580,6 +4678,201 @@ export class BrowserController {
             throw new Error("Browser not started");
         return await this.page.evaluate(() => document.body?.innerText ?? "");
     }
+    async readCheckoutSummary(fallbackCurrency) {
+        if (!this.page)
+            throw new Error("Browser not started");
+        const page = this.page;
+        const identity = await page.evaluate(() => ({
+            title: document.title,
+            siteName: document.querySelector('meta[property="og:site_name"]')?.content ??
+                document.querySelector('[itemprop="merchant"]')?.textContent ??
+                "",
+        }));
+        const texts = await Promise.all(page
+            .frames()
+            .map(async (frame) => await frame.evaluate(() => document.body?.innerText ?? "").catch(() => "")));
+        const amount = parseCheckoutAmount(texts, fallbackCurrency);
+        if (amount === null)
+            throw new Error("payment_checkout_total_not_found");
+        return {
+            merchant: merchantFromPage(identity.title, identity.siteName, page.url()),
+            checkout_origin: new URL(page.url()).origin,
+            ...amount,
+        };
+    }
+    // Common autocomplete/name selectors across all CDP-reachable frames,
+    // including cross-origin hosted fields. No PSP-specific adapters.
+    async fillAndSubmitCheckout(card) {
+        if (!this.page)
+            throw new Error("Browser not started");
+        const frames = this.page.frames();
+        const filled = new Set();
+        const fillFirst = async (field, value, selectors) => {
+            if (value === undefined || value.length === 0)
+                return false;
+            for (const frame of frames) {
+                const matches = frame.locator(selectors);
+                const count = Math.min(await matches.count().catch(() => 0), 10);
+                for (let i = 0; i < count; i += 1) {
+                    const input = matches.nth(i);
+                    if (!(await input.isVisible().catch(() => false)))
+                        continue;
+                    if (!(await input.isEnabled().catch(() => false)))
+                        continue;
+                    const tag = await input.evaluate((el) => el.tagName.toLowerCase()).catch(() => "");
+                    await input.evaluate((el) => el.setAttribute("data-ts-sealed-payment", "1"));
+                    if (tag === "select") {
+                        const selected = (await input
+                            .selectOption({ value })
+                            .then(() => true)
+                            .catch(() => false)) ||
+                            (await input
+                                .selectOption({ label: value })
+                                .then(() => true)
+                                .catch(() => false));
+                        if (!selected)
+                            continue;
+                    }
+                    else {
+                        await input.fill(value);
+                    }
+                    filled.add(field);
+                    return true;
+                }
+            }
+            return false;
+        };
+        try {
+            await fillFirst("pan", card.pan, 'input[autocomplete~="cc-number"],input[name*="cardnumber" i],input[id*="card-number" i],input[id*="cardnumber" i]');
+            const combinedExpiry = `${card.exp_month.padStart(2, "0")}/${card.exp_year.slice(-2)}`;
+            const combined = await fillFirst("expiry", combinedExpiry, 'input[autocomplete~="cc-exp"],input[name*="expir" i]:not([name*="month" i]):not([name*="year" i]),input[name="exp" i],input[name*="exp-date" i],input[id*="expir" i]:not([id*="month" i]):not([id*="year" i]),input[id="exp" i],input[id*="exp-date" i]');
+            if (!combined) {
+                await fillFirst("exp_month", card.exp_month.padStart(2, "0"), '[autocomplete~="cc-exp-month"],[name*="exp_month" i],[name*="expmonth" i]');
+                await fillFirst("exp_year", card.exp_year, '[autocomplete~="cc-exp-year"],[name*="exp_year" i],[name*="expyear" i]');
+            }
+            const fields = [
+                [
+                    "cvv",
+                    card.cvv,
+                    'input[autocomplete~="cc-csc"],input[name*="cvv" i],input[name*="cvc" i],input[name*="security-code" i],input[id*="cvv" i],input[id*="cvc" i]',
+                ],
+                [
+                    "name",
+                    card.name,
+                    'input[autocomplete~="cc-name"],input[name*="cardholder" i],input[name*="card-name" i],input[id*="cardholder" i]',
+                ],
+                [
+                    "line1",
+                    card.billing.line1,
+                    '[autocomplete~="address-line1"],[name*="address_line1" i],[name*="address1" i],[name="line1" i]',
+                ],
+                [
+                    "line2",
+                    card.billing.line2,
+                    '[autocomplete~="address-line2"],[name*="address_line2" i],[name*="address2" i],[name="line2" i]',
+                ],
+                [
+                    "city",
+                    card.billing.city,
+                    '[autocomplete~="address-level2"],[name*="city" i],[name*="locality" i]',
+                ],
+                [
+                    "state",
+                    card.billing.state,
+                    '[autocomplete~="address-level1"],[name*="state" i],[name*="region" i]',
+                ],
+                [
+                    "postal_code",
+                    card.billing.postal_code,
+                    '[autocomplete~="postal-code"],[name*="postal" i],[name*="zip" i]',
+                ],
+                ["country", card.billing.country, '[autocomplete~="country"],[name*="country" i]'],
+            ];
+            for (const [field, value, selectors] of fields) {
+                await fillFirst(field, value, selectors);
+            }
+            for (const required of ["pan", "expiry", "cvv", "name"]) {
+                if (required === "expiry" && filled.has("exp_month") && filled.has("exp_year"))
+                    continue;
+                if (!filled.has(required))
+                    throw new Error(`payment_field_not_found:${required}`);
+            }
+            const submitName = /^(?:pay(?:\s+now)?|place\s+order|complete\s+(?:order|purchase|payment)|submit\s+payment|buy\s+now|confirm\s+(?:order|payment))\b/i;
+            let submitted = false;
+            for (const frame of frames) {
+                const matches = frame.locator('button,input[type="submit"],[role="button"]');
+                const count = Math.min(await matches.count().catch(() => 0), 100);
+                for (let i = 0; i < count; i += 1) {
+                    const candidate = matches.nth(i);
+                    if (!(await candidate.isVisible().catch(() => false)))
+                        continue;
+                    if (!(await candidate.isEnabled().catch(() => false)))
+                        continue;
+                    const label = await candidate
+                        .evaluate((el) => (el.getAttribute("aria-label") ||
+                        (el instanceof HTMLInputElement ? el.value : el.textContent) ||
+                        "").trim())
+                        .catch(() => "");
+                    if (!submitName.test(label))
+                        continue;
+                    await candidate.click();
+                    submitted = true;
+                    break;
+                }
+                if (submitted)
+                    break;
+            }
+            if (!submitted)
+                throw new Error("payment_submit_not_found");
+            const challengeDeadline = Date.now() + 15_000;
+            while (Date.now() < challengeDeadline) {
+                const challenge = await this.detectThreeDsChallenge();
+                if (challenge.three_ds_required)
+                    return challenge;
+                await this.page.waitForTimeout(250).catch(() => undefined);
+            }
+            return { three_ds_required: false };
+        }
+        finally {
+            for (const frame of this.page.frames()) {
+                await frame
+                    .locator('[data-ts-sealed-payment="1"]')
+                    .evaluateAll((elements) => {
+                    for (const element of elements) {
+                        if (element instanceof HTMLInputElement ||
+                            element instanceof HTMLTextAreaElement ||
+                            element instanceof HTMLSelectElement) {
+                            element.value = "";
+                        }
+                        element.removeAttribute("data-ts-sealed-payment");
+                    }
+                })
+                    .catch(() => undefined);
+            }
+        }
+    }
+    async detectThreeDsChallenge() {
+        if (!this.page)
+            throw new Error("Browser not started");
+        const urlPattern = /(?:3d[-_ ]?secure|three[-_ ]?d[-_ ]?secure|\/3ds(?:2)?\/|\/acs\/|challenge)/i;
+        for (const frame of this.page.frames()) {
+            const detected = urlPattern.test(frame.url()) ||
+                (await frame
+                    .evaluate(() => {
+                    if (document.querySelector('iframe[name*="challenge" i],iframe[title*="3d secure" i],input[name="creq" i],form[action*="acs" i]') !== null)
+                        return true;
+                    return /\b(?:3d secure|authenticate (?:this )?payment|verify (?:your )?identity|security code sent to)\b/i.test(document.body?.innerText ?? "");
+                })
+                    .catch(() => false));
+            if (detected) {
+                return {
+                    three_ds_required: true,
+                    challenge_url: frame.url() || this.page.url(),
+                };
+            }
+        }
+        return { three_ds_required: false };
+    }
     // Deterministic Firebase/GCP credential extraction. Every Firebase project
     // auto-creates a "Browser key (auto created by Firebase)" in its underlying
     // Google Cloud project — the SAME AIzaSy value as firebaseConfig.apiKey AND a
@@ -4607,8 +4900,7 @@ export class BrowserController {
         }
         // Locate the Firebase Browser-key row; return its AIzaSy if already shown,
         // else click the row's "Show key" button to reveal it.
-        const readRowKey = () => this.page
-            .evaluate(() => {
+        const readRowKey = () => this.page.evaluate(() => {
             const rows = Array.from(document.querySelectorAll("tr"));
             const row = rows.find((r) => /browser key \(auto created by firebase\)/i.test(r.textContent ?? "")) ??
                 rows.find((r) => /browser key/i.test(r.textContent ?? ""));
@@ -4621,8 +4913,7 @@ export class BrowserController {
             if (btn !== undefined)
                 btn.click();
             return null;
-        })
-            .catch(() => null);
+        }).catch(() => null);
         const first = await readRowKey();
         if (first !== null && KEY_RE.test(first))
             return first;
@@ -4702,8 +4993,7 @@ export class BrowserController {
                     // "Open Source" but stay uncommitted, so Next stays disabled); (2) empty
                     // text; (3) a clear "Select…/Choose…/Pick…" placeholder. NOT
                     // "search"/"add"/"type" — those are filter inputs we must not auto-pick.
-                    const hasPlaceholderAttr = el.hasAttribute("data-placeholder") ||
-                        el.querySelector("[data-placeholder]") !== null;
+                    const hasPlaceholderAttr = el.hasAttribute("data-placeholder") || el.querySelector("[data-placeholder]") !== null;
                     const placeholderish = hasPlaceholderAttr ||
                         txt.length === 0 ||
                         /^(?:please\s+)?(?:select|choose|pick)\b/i.test(txt);
@@ -4826,7 +5116,9 @@ export class BrowserController {
         // triggers (aria-haspopup) — those are handled in (2); a selected preset
         // trigger can also read "All access" and we must not re-open it here.
         try {
-            const allAccess = root.locator('button:not([aria-haspopup="true"])', { hasText: /^(?:all access|full access|all scopes)$/i });
+            const allAccess = root.locator('button:not([aria-haspopup="true"])', {
+                hasText: /^(?:all access|full access|all scopes)$/i,
+            });
             const n = Math.min(await allAccess.count().catch(() => 0), 3);
             for (let i = 0; i < n; i += 1) {
                 const b = allAccess.nth(i);
@@ -4848,9 +5140,7 @@ export class BrowserController {
                 const t = triggers.nth(i);
                 if (!(await t.isVisible().catch(() => false)))
                     continue;
-                const txt = ((await t.textContent().catch(() => "")) ?? "")
-                    .replace(/\s+/g, " ")
-                    .trim();
+                const txt = ((await t.textContent().catch(() => "")) ?? "").replace(/\s+/g, " ").trim();
                 // Only act on an UNSELECTED select (a "Select…/Choose…/Pick…"
                 // placeholder) — never re-pick one that already holds a value.
                 if (!/^(?:please\s+)?(?:select|choose|pick)\b/i.test(txt))
@@ -4919,7 +5209,9 @@ export class BrowserController {
         if (!this.page)
             throw new Error("Browser not started");
         return await this.page.evaluate(async (rawPrefix) => {
-            const prefix = String(rawPrefix ?? "").replace(/^\/+|\/+$/g, "").toLowerCase();
+            const prefix = String(rawPrefix ?? "")
+                .replace(/^\/+|\/+$/g, "")
+                .toLowerCase();
             const candidates = [];
             const seen = new Set();
             const add = (value) => {
@@ -5182,29 +5474,54 @@ export class BrowserController {
         return await this.page.evaluate(() => {
             const LABEL_PHRASES = [
                 // Generic
-                "api key", "api token", "api secret", "secret key", "access key",
-                "access token", "auth token", "bearer token", "personal access token",
-                "client id", "client secret", "client key",
+                "api key",
+                "api token",
+                "api secret",
+                "secret key",
+                "access key",
+                "access token",
+                "auth token",
+                "bearer token",
+                "personal access token",
+                "client id",
+                "client secret",
+                "client key",
                 // Cloudinary
-                "cloud name", "cloudname",
+                "cloud name",
+                "cloudname",
                 // Algolia
-                "application id", "app id", "admin api key", "search api key",
-                "monitoring api key", "search-only api key",
+                "application id",
+                "app id",
+                "admin api key",
+                "search api key",
+                "monitoring api key",
+                "search-only api key",
                 // Twilio
-                "account sid", "auth token",
+                "account sid",
+                "auth token",
                 // Stripe
-                "publishable key", "secret key",
+                "publishable key",
+                "secret key",
                 // AWS
-                "access key id", "secret access key",
+                "access key id",
+                "secret access key",
                 // OAuth1
-                "consumer key", "consumer secret", "access token secret",
+                "consumer key",
+                "consumer secret",
+                "access token secret",
                 // Misc
-                "project api key", "personal api key", "organization id", "org id",
-                "app key", "app secret",
+                "project api key",
+                "personal api key",
+                "organization id",
+                "org id",
+                "app key",
+                "app secret",
                 // Pusher (and other keys tables) label fields bare: key / secret /
                 // cluster. Without these the value inherits the nearest recognized
                 // label (the app_id field), mislabeling key + secret as "app id".
-                "cluster", "key", "secret",
+                "cluster",
+                "key",
+                "secret",
             ];
             const isVisible = (el) => {
                 const r = el.getBoundingClientRect();
@@ -5397,14 +5714,11 @@ export class BrowserController {
             }
             // 1. <input> / <textarea> values (visible only).
             document.querySelectorAll("input, textarea").forEach((el) => {
-                if (el instanceof HTMLInputElement &&
-                    (el.type === "hidden" || el.type === "password"))
+                if (el instanceof HTMLInputElement && (el.type === "hidden" || el.type === "password"))
                     return;
                 if (!isVisible(el))
                     return;
-                const value = el instanceof HTMLInputElement || el instanceof HTMLTextAreaElement
-                    ? el.value
-                    : "";
+                const value = el instanceof HTMLInputElement || el instanceof HTMLTextAreaElement ? el.value : "";
                 if (value.length > 0)
                     pushCandidate(value, el);
             });
@@ -5426,9 +5740,7 @@ export class BrowserController {
             });
             // 3. Structural containers (code/pre/kbd) where the credential
             //    is interpolated through nested spans.
-            document
-                .querySelectorAll('code, pre, kbd, samp, [role="textbox"]')
-                .forEach((el) => {
+            document.querySelectorAll('code, pre, kbd, samp, [role="textbox"]').forEach((el) => {
                 if (!isVisible(el))
                     return;
                 const full = (el.textContent ?? "").trim();
@@ -5488,9 +5800,7 @@ export class BrowserController {
                     return;
                 masked.push({ el, row: rowAncestor(el) });
             });
-            document
-                .querySelectorAll('input[type="password"]')
-                .forEach((el) => {
+            document.querySelectorAll('input[type="password"]').forEach((el) => {
                 if (!isVisible(el))
                     return;
                 masked.push({ el, row: rowAncestor(el) });
@@ -5576,7 +5886,12 @@ export class BrowserController {
                     const btn = showBtns[0];
                     const sel = selectorFor(btn);
                     selectors.push(sel);
-                    const label = (btn.textContent ?? btn.getAttribute("aria-label") ?? btn.getAttribute("title") ?? "").trim().slice(0, 40);
+                    const label = (btn.textContent ??
+                        btn.getAttribute("aria-label") ??
+                        btn.getAttribute("title") ??
+                        "")
+                        .trim()
+                        .slice(0, 40);
                     diagnostic.push(`row→show:"${label}"→${sel}`);
                 }
                 else if (copyBtns.length > 0) {
@@ -5624,9 +5939,7 @@ export class BrowserController {
                     !["text", "search", "url", "tel", "number", "email", ""].includes(el.type)) {
                     return;
                 }
-                const value = el instanceof HTMLInputElement || el instanceof HTMLTextAreaElement
-                    ? el.value
-                    : "";
+                const value = el instanceof HTMLInputElement || el instanceof HTMLTextAreaElement ? el.value : "";
                 if (value.trim().length > 0 && isVisible(el))
                     out.push(value.trim());
             });
@@ -5650,9 +5963,7 @@ export class BrowserController {
             // <span>s — the loop above sees an empty direct-text and skips
             // them. Push the full textContent so a UUID built as
             // <code><span>7</span><span>5</span>…</code> is still scannable.
-            document
-                .querySelectorAll('code, pre, kbd, samp, [role="textbox"]')
-                .forEach((el) => {
+            document.querySelectorAll('code, pre, kbd, samp, [role="textbox"]').forEach((el) => {
                 if (!isVisible(el))
                     return;
                 const full = (el.textContent ?? "").trim();
@@ -5881,9 +6192,7 @@ export class BrowserController {
             // (e.g. lazy-rendering the previously-blocked OAuth chooser).
             // Try networkidle first for SPA re-renders, fall back to a
             // fixed dwell.
-            await this.page
-                .waitForLoadState("networkidle", { timeout: 3000 })
-                .catch(() => undefined);
+            await this.page.waitForLoadState("networkidle", { timeout: 3000 }).catch(() => undefined);
             await this.page.waitForTimeout(800);
             return target.text;
         }
@@ -6110,9 +6419,7 @@ export class BrowserController {
                 if (r.width < 2 || r.height < 2)
                     return false;
                 const s = window.getComputedStyle(el);
-                return (s.display !== "none" &&
-                    s.visibility !== "hidden" &&
-                    parseFloat(s.opacity || "1") > 0.01);
+                return (s.display !== "none" && s.visibility !== "hidden" && parseFloat(s.opacity || "1") > 0.01);
             };
             // G12 — visually-hidden checkbox/radio surfacing. Custom-styled
             // TOS checkboxes are real `<input type=checkbox>` elements with
@@ -6246,11 +6553,15 @@ export class BrowserController {
                 const id = el.getAttribute("id");
                 const name = el.getAttribute("name");
                 if (testId !== null && testId.length > 0) {
-                    const attr = el.hasAttribute("data-testid") ? "data-testid" :
-                        el.hasAttribute("data-test-id") ? "data-test-id" :
-                            el.hasAttribute("data-test") ? "data-test" :
-                                el.hasAttribute("data-cy") ? "data-cy" :
-                                    "data-qa";
+                    const attr = el.hasAttribute("data-testid")
+                        ? "data-testid"
+                        : el.hasAttribute("data-test-id")
+                            ? "data-test-id"
+                            : el.hasAttribute("data-test")
+                                ? "data-test"
+                                : el.hasAttribute("data-cy")
+                                    ? "data-cy"
+                                    : "data-qa";
                     base = `[${attr}="${CSS.escape(testId)}"]`;
                 }
                 else if (id !== null && /^[A-Za-z][\w-]*$/.test(id)) {
@@ -6390,8 +6701,12 @@ export class BrowserController {
                 // cursor:pointer but no button/role/input semantics and no div/section
                 // wrapper, so the SELECTOR walk AND the old div-only scan both missed
                 // it, leaving the planner no clickable target.
-                const isCardTag = (t) => t === "div" || t === "li" || t === "article" ||
-                    t === "section" || t === "label" || t.includes("-");
+                const isCardTag = (t) => t === "div" ||
+                    t === "li" ||
+                    t === "article" ||
+                    t === "section" ||
+                    t === "label" ||
+                    t.includes("-");
                 // Walk the light DOM AND every open shadow root — a UI-kit chip can
                 // live inside a web component's shadow tree.
                 const scanRoot = (root) => {
@@ -6516,22 +6831,18 @@ export class BrowserController {
                 const pathLabel = isGoogleGSIIframe
                     ? "Continue with Google"
                     : isFormControlElement(el)
-                        ? labelFor(el) ?? directLabel(el) ?? iconLabelFor(el)
-                        : directLabel(el) ?? labelFor(el) ?? iconLabelFor(el);
+                        ? (labelFor(el) ?? directLabel(el) ?? iconLabelFor(el))
+                        : (directLabel(el) ?? labelFor(el) ?? iconLabelFor(el));
                 out.push({
                     tag: isGoogleGSIIframe ? "button" : el.tagName.toLowerCase(),
                     type: el.getAttribute("type"),
                     id: el.getAttribute("id"),
                     name: el.getAttribute("name"),
                     placeholder: el.getAttribute("placeholder"),
-                    ariaLabel: isGoogleGSIIframe
-                        ? "Continue with Google"
-                        : el.getAttribute("aria-label"),
+                    ariaLabel: isGoogleGSIIframe ? "Continue with Google" : el.getAttribute("aria-label"),
                     role: isGoogleGSIIframe ? "button" : el.getAttribute("role"),
                     labelText: labelFor(el),
-                    visibleText: isGoogleGSIIframe
-                        ? "Continue with Google"
-                        : clean(el.textContent),
+                    visibleText: isGoogleGSIIframe ? "Continue with Google" : clean(el.textContent),
                     selector: selectorFor(el),
                     visible: true,
                     inViewport: r.top >= 0 &&
@@ -6573,8 +6884,7 @@ export class BrowserController {
                     // caller wanting to find UNCHECKED checkboxes needs `checked`
                     // explicitly. The submit-disabled re-plan hint uses this to
                     // surface concrete unticked candidates to the planner.
-                    checked: el instanceof HTMLInputElement &&
-                        (el.type === "checkbox" || el.type === "radio")
+                    checked: el instanceof HTMLInputElement && (el.type === "checkbox" || el.type === "radio")
                         ? el.checked
                         : null,
                     // For <select>: the currently-selected option's visible text
@@ -6600,6 +6910,7 @@ export class BrowserController {
                         ? clean(el.options[el.selectedIndex]?.textContent ?? null)
                         : null,
                     interactedThisRun: el.getAttribute("data-ts-touched") === "1",
+                    sealed: el.getAttribute("data-ts-sealed-payment") === "1",
                     screenPath: `${container ?? "body:root"} > ${elementKind(el)}:` +
                         slug(pathLabel, `${elementKind(el)}-${out.length}`),
                     container,
@@ -6658,9 +6969,7 @@ export class BrowserController {
         }
         // Race a popup `page` event against the click. context-level
         // "page" fires for both window.open popups and target=_blank.
-        const popupPromise = this.context
-            .waitForEvent("page", { timeout: 8000 })
-            .catch(() => null);
+        const popupPromise = this.context.waitForEvent("page", { timeout: 8000 }).catch(() => null);
         await this.click(selector);
         const popup = await popupPromise;
         if (popup !== null && popup !== this.page && !popup.isClosed()) {
@@ -6706,7 +7015,8 @@ export class BrowserController {
                     // Capture the body of a Clerk/Stytch/WorkOS sign-in/up/callback error
                     // (>=400) — its error code is the definitive tell (captcha_invalid vs
                     // transfer vs identifier_*). JSON only, bounded.
-                    if (res.status() >= 400 && /\/v1\/client\/(sign_ins|sign_ups)|oauth_callback|\/session/i.test(url)) {
+                    if (res.status() >= 400 &&
+                        /\/v1\/client\/(sign_ins|sign_ups)|oauth_callback|\/session/i.test(url)) {
                         entry.body = (await res.text().catch(() => "")).slice(0, 800);
                     }
                     this.oauthNetLog.push(entry);
@@ -6770,7 +7080,15 @@ export class BrowserController {
             mkdirSync(dir, { recursive: true });
             const ts = process.env.OAUTH_DEBUG_TS ?? String(this.oauthNetLog.length);
             const path = join(dir, `${service}-${label}-${ts}.json`);
-            writeFileSync(path, JSON.stringify({ service, label, finalUrl: url, clerkState, cookies: cookieSummary, netLog: this.oauthNetLog, pageText: consoleText.slice(0, 600) }, null, 2));
+            writeFileSync(path, JSON.stringify({
+                service,
+                label,
+                finalUrl: url,
+                clerkState,
+                cookies: cookieSummary,
+                netLog: this.oauthNetLog,
+                pageText: consoleText.slice(0, 600),
+            }, null, 2));
             console.error(`[oauth-debug] wrote ${path} (${cookieSummary.length} cookies, ${this.oauthNetLog.length} net entries)`);
         }
         catch (err) {
@@ -6785,9 +7103,7 @@ export class BrowserController {
             return null;
         try {
             return await this.page.evaluate(() => {
-                const c = document
-                    .querySelector('meta[name="csrf-token"]')
-                    ?.getAttribute("content");
+                const c = document.querySelector('meta[name="csrf-token"]')?.getAttribute("content");
                 return c !== null && c !== undefined && c.length > 0 ? c : null;
             });
         }
@@ -6959,9 +7275,7 @@ export class BrowserController {
         // undefined (no-op) and any failure must degrade to the popup/none path.
         if (cdp !== null) {
             const promptDeadline = Date.now() + Math.min(4_000, timeoutMs);
-            while (Date.now() < promptDeadline &&
-                !fedcmResolved &&
-                this.context.pages().length <= 1) {
+            while (Date.now() < promptDeadline && !fedcmResolved && this.context.pages().length <= 1) {
                 await this.sleep(250);
             }
             if (!fedcmResolved && this.context.pages().length <= 1) {
@@ -7252,7 +7566,7 @@ export class BrowserController {
                     const bad = /\b(settings|marketplace|learn more|cancel|skip|back|terms|privacy)\b/i;
                     const candidates = Array.from(document.querySelectorAll('a[href], button, [role="button"], [role="link"]')).filter((el) => visible(el));
                     const byHref = candidates.find((el) => {
-                        const href = el instanceof HTMLAnchorElement ? el.href : el.getAttribute("href") ?? "";
+                        const href = el instanceof HTMLAnchorElement ? el.href : (el.getAttribute("href") ?? "");
                         return /\/installations\/(?:new|permissions)\b/.test(href);
                     });
                     const target = byHref ??
@@ -7562,7 +7876,9 @@ export class BrowserController {
             try {
                 this.xvfb.stop();
             }
-            catch { /* best-effort */ }
+            catch {
+                /* best-effort */
+            }
             this.xvfb = null;
         }
     }
@@ -7880,9 +8196,7 @@ export function scoreSignupButton(text, oauthProviders) {
     // Bump weight from +5 to +12 so the combined-flow button outranks
     // generic nav anchors that score 0. The compensating auth-verb
     // penalty below is also suppressed when email is present.
-    const hasEmail = t.includes("continue with email") ||
-        t.includes("sign up with email") ||
-        t.includes("email");
+    const hasEmail = t.includes("continue with email") || t.includes("sign up with email") || t.includes("email");
     if (hasEmail) {
         score += 12;
     }