@visa/cli 4.1.0-rc.19 → 4.1.0-rc.20

package/dist/checkout-engine/executor.d.ts

@@ -141,6 +141,31 @@ export declare function debugShotMaskPlan(fields: FieldMap): {
     }[];
 };
 export declare function isStripeLinkConsumerRequest(url: string): boolean;
+export declare function suppressStripeLink(page: Page, evidence: EvidenceLog): Promise<void>;
+export type LinkQuietResult = {
+    fired: boolean;
+    waitedMs: number;
+};
+/**
+ * Wait for the suppressed Stripe Link lookup to fire and settle BEFORE the
+ * submit click. Stripe debounces its consumer-session lookup ~300ms after the
+ * email input changes; our fill→click gap is single-digit ms, so the (aborted)
+ * lookup used to land INSIDE Stripe's in-flight submit chain and kill it
+ * silently — the click looked accepted but tokenization never ran and the page
+ * sat on the form until the outcome deadline (#5879: three identical live
+ * stalls at donate.stripe.com). Verified live A/B on that page: instant click →
+ * dead submit, no /v1/payment_methods; lookup settled first → tokenization and
+ * the confirm step both reached.
+ *
+ * If the lookup already fired, only the short settle applies (lets Stripe's
+ * abort handling unwind). If it never fires — non-Link page variants, no email
+ * field — the bound expires and the click proceeds as before.
+ */
+export declare function waitForLinkLookupQuiet(page: Page, opts?: {
+    boundMs?: number;
+    settleMs?: number;
+    delay?: (ms: number) => Promise<void>;
+}): Promise<LinkQuietResult>;
 export declare function prepareCheckout(opts: PrepareCheckoutOptions, store?: PreparedCheckoutSessionStore): Promise<PrepareCheckoutResult>;
 export declare function submitApprovedCheckout(reviewId: string, opts: SubmitApprovedCheckoutOptions, store?: PreparedCheckoutSessionStore): Promise<CheckoutResult>;
 export declare function cancelPreparedCheckout(reviewId: string, detail?: string, store?: PreparedCheckoutSessionStore): Promise<CheckoutResult>;

package/dist/checkout-engine/executor.js

@@ -630,11 +630,17 @@ async function captureDebugShot(page, dir, reviewId, label, evidence, fields) {
 export function isStripeLinkConsumerRequest(url) {
     return /(?:^|\/\/)([a-z0-9.-]*\.)?stripe\.com\/v1\/consumers\/sessions\/(?:lookup|start_verification)\b/i.test(url);
 }
-async function suppressStripeLink(page, evidence) {
-    let suppressed = 0;
+// Keyed by Page so the tracker installed at prepare time is reachable from the
+// approved-submit leg without threading through the session store types.
+const linkSuppressionByPage = new WeakMap();
+// Exported for the link-quiet unit tests (a fake Page captures the route
+// handler); production callers stay inside this module.
+export async function suppressStripeLink(page, evidence) {
+    const state = { suppressed: 0, waiters: [] };
+    linkSuppressionByPage.set(page, state);
     await page.route((u) => isStripeLinkConsumerRequest(typeof u === 'string' ? u : u.href), (route) => {
-        suppressed += 1;
-        if (suppressed === 1) {
+        state.suppressed += 1;
+        if (state.suppressed === 1) {
             // origin + pathname only — never the full URL. The lookup carries the
             // email in the POST body today, but keep an operator email out of the
             // evidence log even if Stripe moves a param to the query string (#5708).
@@ -649,9 +655,45 @@ async function suppressStripeLink(page, evidence) {
             }
             evidence.step('note', { linkSuppressed: safe });
         }
+        for (const wake of state.waiters.splice(0))
+            wake();
         return route.abort();
     });
 }
+/**
+ * Wait for the suppressed Stripe Link lookup to fire and settle BEFORE the
+ * submit click. Stripe debounces its consumer-session lookup ~300ms after the
+ * email input changes; our fill→click gap is single-digit ms, so the (aborted)
+ * lookup used to land INSIDE Stripe's in-flight submit chain and kill it
+ * silently — the click looked accepted but tokenization never ran and the page
+ * sat on the form until the outcome deadline (#5879: three identical live
+ * stalls at donate.stripe.com). Verified live A/B on that page: instant click →
+ * dead submit, no /v1/payment_methods; lookup settled first → tokenization and
+ * the confirm step both reached.
+ *
+ * If the lookup already fired, only the short settle applies (lets Stripe's
+ * abort handling unwind). If it never fires — non-Link page variants, no email
+ * field — the bound expires and the click proceeds as before.
+ */
+export async function waitForLinkLookupQuiet(page, opts = {}) {
+    const boundMs = opts.boundMs ?? 1500;
+    const settleMs = opts.settleMs ?? 250;
+    const delay = opts.delay ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const state = linkSuppressionByPage.get(page);
+    if (!state)
+        return { fired: false, waitedMs: 0 };
+    const started = Date.now();
+    if (state.suppressed === 0) {
+        await Promise.race([
+            new Promise((resolve) => state.waiters.push(resolve)),
+            delay(boundMs),
+        ]);
+    }
+    const fired = state.suppressed > 0;
+    if (fired)
+        await delay(settleMs);
+    return { fired, waitedMs: Date.now() - started };
+}
 // Payer-chosen amount inputs. Deliberately payment-link-specific (Stripe's
 // customUnitAmount): on an ordinary checkout the total is merchant-controlled
 // and typing into anything price-like must never happen.
@@ -1076,6 +1118,10 @@ export async function submitApprovedCheckout(reviewId, opts, store = defaultPrep
             evidence.setSnapshotSummary(await snapshotSummary(page));
             return makeResult('failed', state.fields, evidence, requiresAdapter, 'no submit control detected');
         }
+        // The suppressed Link lookup must settle before the click or it breaks
+        // Stripe's submit chain mid-flight (#5879) — see waitForLinkLookupQuiet.
+        const linkQuiet = await waitForLinkLookupQuiet(page);
+        evidence.step('note', { linkQuiet });
         evidence.step('submit', { clicked: true, target: submit.desc });
         await submit.click();
         await settle(page);