@visa/cli 4.1.0-rc.13 → 4.1.0-rc.131

package/dist/checkout-engine/detect.d.ts

@@ -1,6 +1,6 @@
 import type { Page } from 'playwright-core';
 export type FieldSource = 'autocomplete' | 'attr-heuristic' | 'label-text' | 'iframe-psp' | 'type-inference';
-export type FieldRole = 'number' | 'expMonth' | 'expYear' | 'expCombined' | 'cvc' | 'name' | 'nameFirst' | 'nameLast' | 'email' | 'addressLine1' | 'addressLine2' | 'city' | 'state' | 'postalCode' | 'country';
+export type FieldRole = 'number' | 'expMonth' | 'expYear' | 'expCombined' | 'cvc' | 'name' | 'nameFirst' | 'nameLast' | 'email' | 'phone' | 'oneTimeCode' | 'addressLine1' | 'addressLine2' | 'city' | 'state' | 'postalCode' | 'country';
 export declare const ALL_ROLES: FieldRole[];
 export type SelectOption = {
     value: string;

package/dist/checkout-engine/detect.js

@@ -21,6 +21,8 @@ export const ALL_ROLES = [
     'nameFirst',
     'nameLast',
     'email',
+    'phone',
+    'oneTimeCode',
     'addressLine1',
     'addressLine2',
     'city',
@@ -37,6 +39,18 @@ const expMonthRe = /(exp.?month|expmonth|exp_mm|(^|[^a-z])mm([^a-z]|$)|(^|[^a-z]
 const expYearRe = /(exp.?year|expyear|exp_yy|(^|[^a-z])yy(yy)?([^a-z]|$)|(^|[^a-z])year([^a-z]|$)|jahr|annee|(^|[^a-z])ano([^a-z]|$))/;
 const expCombinedRe = /(exp(iry|iration)?(.?date)?|mm.?\/.?yy|mm.?jj|valid.?thru|ablauf|caducidad)/;
 const emailRe = /(e-?mail|correo|courriel)/;
+const phoneRe = /(phone|telephone|mobile|(^|[^a-z])tel([^a-z]|$)|telefono|téléphone)/;
+// One-time verification code (merchant email/SMS OTP). Ordered AFTER cvcRe in
+// attrClassify so a card CVC ("security code"/"card code") still wins — this
+// regex deliberately omits those card phrasings. It also OMITS a bare "code":
+// `postal_code`/`zip_code`/`country_code`/`promo_code` all contain "code" and
+// would otherwise misclassify as an OTP field and starve the address fill. A
+// bare "code" is matched LAST (bareCodeRe), after every address role.
+const oneTimeCodeRe = /(one[-_ ]?time|(^|[^a-z])otp([^a-z]|$)|passcode|(^|[^a-z])pin([^a-z]|$)|verif(y|ication)?.?code|auth.?code)/;
+// Standalone verification "code" — a last-resort OTP match tried only after the
+// specific address roles (postal/country/state/city/line) have had their say,
+// so a compound `*_code` address/product field is never stolen by the OTP role.
+const bareCodeRe = /(^|[^a-z])code([^a-z]|$)/;
 const postalRe = /(zip|postal|postcode|(^|[^a-z])plz([^a-z]|$)|(^|[^a-z])cep([^a-z]|$)|codigo.?postal)/;
 const countryRe = /(country|(^|[^a-z])land([^a-z]|$)|(^|[^a-z])pais)/;
 const stateRe = /((^|[^a-z])state([^a-z]|$)|province|region|bundesland|provincia)/;
@@ -55,6 +69,9 @@ const AUTOCOMPLETE_MAP = {
     'cc-name': 'name',
     name: 'name',
     email: 'email',
+    tel: 'phone',
+    'tel-national': 'phone',
+    'one-time-code': 'oneTimeCode',
     'given-name': 'nameFirst',
     'family-name': 'nameLast',
     'address-line1': 'addressLine1',
@@ -151,6 +168,11 @@ function attrClassify(text, m) {
         return 'expCombined';
     if (emailRe.test(text))
         return 'email';
+    // OTP comes after cvc (checked above) so card CVC still classifies as 'cvc'.
+    if (oneTimeCodeRe.test(text))
+        return 'oneTimeCode';
+    if (phoneRe.test(text))
+        return 'phone';
     if (postalRe.test(text))
         return 'postalCode';
     if (countryRe.test(text))
@@ -163,6 +185,10 @@ function attrClassify(text, m) {
         return 'addressLine2';
     if (addr1Re.test(text))
         return 'addressLine1';
+    // Last-resort bare "code" → OTP, only once every address role has been ruled
+    // out, so `postal_code`/`country_code`/etc. keep their own role above.
+    if (bareCodeRe.test(text))
+        return 'oneTimeCode';
     if (nameFirstRe.test(text))
         return 'nameFirst';
     if (nameLastRe.test(text))

package/dist/checkout-engine/evidence.d.ts

@@ -1,4 +1,4 @@
-export type EvidenceStepType = 'navigation' | 'dom-stable' | 'review' | 'approval' | 'adapter-selected' | 'reveal' | 'detect' | 'field-fill' | 'amount-fill' | 'credential-minted' | 'fill-complete' | 'psp-detected' | 'mandate-verdict' | 'submit' | 'challenge-hold' | 'outcome' | 'note';
+export type EvidenceStepType = 'navigation' | 'dom-stable' | 'review' | 'approval' | 'adapter-selected' | 'reveal' | 'detect' | 'field-fill' | 'amount-fill' | 'contact-prefill' | 'credential-minted' | 'credential-skipped' | 'credential-expiry-check' | 'fill-complete' | 'psp-detected' | 'mandate-verdict' | 'submit' | 'challenge-hold' | 'outcome' | 'note';
 export type EvidenceStep = {
     ts: string;
     type: EvidenceStepType;
@@ -7,6 +7,9 @@ export type EvidenceStep = {
 export declare function maskPan(pan: string): string;
 export declare function maskCvc(_cvc: string): string;
 export declare function maskExpiry(): string;
+export declare function maskOtp(): string;
+export declare function hostOf(hostOrEmail: string): string;
+export declare function verificationLinkAllowed(link: string, messageFrom: string): boolean;
 export declare function redactContact(role: string, value: string): string;
 export declare class EvidenceLog {
     private steps;

package/dist/checkout-engine/evidence.js

@@ -3,12 +3,15 @@
 // the mandate verdict, the submit, and the final outcome, plus a compact
 // accessibility snapshot of the end state.
 //
-// Money-adjacent hygiene rule: the full PAN, the cvc, and the card expiry
-// NEVER enter the log. PANs are masked to last-4; cvc and expiry are redacted
-// entirely. maskPan/maskCvc/maskExpiry are the only sanctioned way to put a
-// card value anywhere near a log line. Contact PII (cardholder name, email,
-// address, ...) is redacted via redactContact: the log records THAT a field
-// was filled, never the personal value.
+// Money-adjacent hygiene rule: the full PAN, the cvc, the card expiry, and any
+// one-time verification code NEVER enter the log. PANs are masked to last-4;
+// cvc, expiry, and OTP codes are redacted entirely. maskPan/maskCvc/maskExpiry/
+// maskOtp are the only sanctioned way to put such a value anywhere near a log
+// line. (receipt.ts redactPanLikeDigits only catches 12-19-digit PANs, so a
+// 4-8-digit OTP would slip straight through — maskOtp at the fill site is the
+// load-bearing guarantee it never reaches the evidence log.) Contact PII
+// (cardholder name, email, address, ...) is redacted via redactContact: the
+// log records THAT a field was filled, never the personal value.
 // Mask a PAN to its last four digits. Non-digits are stripped for the count.
 export function maskPan(pan) {
     const digits = (pan || '').replace(/\D/g, '');
@@ -25,6 +28,48 @@ export function maskCvc(_cvc) {
 export function maskExpiry() {
     return 'redacted';
 }
+// A merchant one-time verification code is single-use secret material — it
+// never enters the log, in any format. Used at the oneTimeCode fill site so
+// the code is masked exactly as cvc/PAN are (see the header note above).
+export function maskOtp() {
+    return 'redacted';
+}
+// The registrable domain (approx eTLD+1) of an email address or hostname, for
+// the caller-side from-domain guard on verification links: before navigating a
+// link parsed from an untrusted OTP email, require the link host to match the
+// message sender's domain. extract.ts guarantees mechanical extraction, NOT
+// navigation safety — this guard is the anti-injection backstop.
+export function hostOf(hostOrEmail) {
+    return (hostOrEmail.split('@').pop() ?? '').trim().toLowerCase().replace(/\.$/, '');
+}
+// Strict bidirectional host-suffix match (exact / child / parent). Deliberately
+// NOT approximate eTLD+1 — that collapses shared-tenant hosts (`x.myshopify.com`,
+// `x.co.uk`) to a common suffix and lets a sibling tenant match; siblings never
+// match here. Fails SAFE: an unrelated-but-legitimate sender is skipped, not
+// trusted.
+function hostsRelated(a, b) {
+    const x = hostOf(a);
+    const y = hostOf(b);
+    if (!x || !y)
+        return false;
+    return x === y || x.endsWith('.' + y) || y.endsWith('.' + x);
+}
+// Whether a verification LINK is safe to navigate: the sender must NOT be the
+// unauthenticated inbound variant (AgentMail marks spoofable inbound with an
+// `.unauthenticated` sub-label), and the link host must belong to the sender's
+// domain. Returns false to SKIP a link that fails either check.
+export function verificationLinkAllowed(link, messageFrom) {
+    if (/\.unauthenticated\b/i.test(messageFrom))
+        return false;
+    let linkHost;
+    try {
+        linkHost = new URL(link).hostname;
+    }
+    catch {
+        return false;
+    }
+    return hostsRelated(linkHost, messageFrom);
+}
 // Contact values (cardholder name, email, address, ...) are PII and never
 // enter the log raw either. Email keeps its domain for debuggability;
 // everything else becomes a bare presence marker.

package/dist/checkout-engine/executor.d.ts

@@ -2,11 +2,14 @@ import type { Browser, BrowserContext, Page } from 'playwright-core';
 import { type FieldMap } from './detect.js';
 import { type Mandate } from './mandate.js';
 import type { Instrument } from './instrument.js';
-import type { Contact } from './types.js';
+import type { Contact, OtpResolver } from './types.js';
 import { EvidenceLog } from './evidence.js';
 import { type ObservedOutcome } from './outcome.js';
+export { minorFromDecimal, pageCurrency } from './amount.js';
 export type CheckoutMode = 'dry-run' | 'submit';
-export type CheckoutOutcome = 'filled-dry-run' | 'partial-fill' | 'adapter-required' | 'confirmed' | 'declined' | 'action-required' | 'cancelled' | 'blocked-by-mandate' | 'failed';
+export type CheckoutOutcome = 'reviewed-dry-run'
+/** Historical receipt value from the credential-disclosing dry-run. */
+ | 'filled-dry-run' | 'partial-fill' | 'adapter-required' | 'confirmed' | 'declined' | 'action-required' | 'cancelled' | 'blocked-by-mandate' | 'failed';
 export type CredentialLifecycle = 'not-requested' | 'minted-not-exposed' | 'partially-exposed' | 'fully-filled';
 export type CredentialTiming = {
     approvedAt?: string;
@@ -28,6 +31,7 @@ export type PrepareCheckoutOptions = {
     url: string;
     mandate: Mandate;
     browser: Browser;
+    contact?: Contact;
     amountMinor?: number;
     currency?: string;
     debugShotsDir?: string;
@@ -37,6 +41,7 @@ export type RunCheckoutOptions = PrepareCheckoutOptions & {
     contact: Contact;
     mode: CheckoutMode;
     outcomeDeadlineMs?: number;
+    resolveEmailOtp?: OtpResolver;
 };
 export type CheckoutReview = {
     id: string;
@@ -86,9 +91,9 @@ export type SubmitApprovedCheckoutOptions = {
     outcomeDeadlineMs?: number;
     challengeHoldMs?: number;
     onChallengeHold?: (signal: string | null) => void;
+    resolveEmailOtp?: OtpResolver;
 };
-export declare function minorFromDecimal(text: string): number | null;
-export declare function pageCurrency(text: string): string | null;
+export declare function snapshotOrigin(rawUrl: string): string;
 export type PreparedCheckoutSession = {
     checkout: PreparedCheckout;
     context: BrowserContext;
@@ -141,6 +146,31 @@ export declare function debugShotMaskPlan(fields: FieldMap): {
     }[];
 };
 export declare function isStripeLinkConsumerRequest(url: string): boolean;
+export declare function suppressStripeLink(page: Page, evidence: EvidenceLog): Promise<void>;
+export type LinkQuietResult = {
+    fired: boolean;
+    waitedMs: number;
+};
+/**
+ * Wait for the suppressed Stripe Link lookup to fire and settle BEFORE the
+ * submit click. Stripe debounces its consumer-session lookup ~300ms after the
+ * email input changes; our fill→click gap is single-digit ms, so the (aborted)
+ * lookup used to land INSIDE Stripe's in-flight submit chain and kill it
+ * silently — the click looked accepted but tokenization never ran and the page
+ * sat on the form until the outcome deadline (#5879: three identical live
+ * stalls at donate.stripe.com). Verified live A/B on that page: instant click →
+ * dead submit, no /v1/payment_methods; lookup settled first → tokenization and
+ * the confirm step both reached.
+ *
+ * If the lookup already fired, only the short settle applies (lets Stripe's
+ * abort handling unwind). If it never fires — non-Link page variants, no email
+ * field — the bound expires and the click proceeds as before.
+ */
+export declare function waitForLinkLookupQuiet(page: Page, opts?: {
+    boundMs?: number;
+    settleMs?: number;
+    delay?: (ms: number) => Promise<void>;
+}): Promise<LinkQuietResult>;
 export declare function prepareCheckout(opts: PrepareCheckoutOptions, store?: PreparedCheckoutSessionStore): Promise<PrepareCheckoutResult>;
 export declare function submitApprovedCheckout(reviewId: string, opts: SubmitApprovedCheckoutOptions, store?: PreparedCheckoutSessionStore): Promise<CheckoutResult>;
 export declare function cancelPreparedCheckout(reviewId: string, detail?: string, store?: PreparedCheckoutSessionStore): Promise<CheckoutResult>;