@visa/cli 4.1.0-rc.193 → 4.1.0-rc.195

package/dist/checkout-engine/executor.d.ts

@@ -128,7 +128,9 @@ export type SubmitCandidateMeta = {
     visible: boolean;
     area: number;
 };
-export declare function preferredSubmitIndex(cands: readonly SubmitCandidateMeta[]): number;
+export declare function preferredSubmitIndex(cands: readonly SubmitCandidateMeta[], options?: {
+    allowInertFallback?: boolean;
+}): number;
 export declare function snapshotOrigin(rawUrl: string): string;
 export type PreparedCheckoutSession = {
     checkout: PreparedCheckout;

package/dist/checkout-engine/executor.js

@@ -131,17 +131,21 @@ async function fingerprintSubmitTarget(locator, kind, fallbackLabel) {
 // (observed live: `<h3 id="billingAddress"> intercepts pointer events`, retried
 // until the 6s timeout, deterministically, on casper.com). Rank the real
 // controls ahead of the inert ones and prefer a pay-labelled control.
-export function preferredSubmitIndex(cands) {
+export function preferredSubmitIndex(cands, options = {}) {
     const usable = cands
         .map((c, i) => ({ c, i }))
         .filter(({ c }) => c.visible && !c.ariaHidden && c.tabIndex !== -1 && c.area > 0);
-    if (usable.length === 0)
+    if (usable.length > 0) {
+        const payLike = usable.find(({ c }) => PAY_LABEL.test(c.label));
+        return (payLike ?? usable[0]).i;
+    }
+    if (!options.allowInertFallback || cands.length === 0)
         return -1;
-    const payLike = usable.find(({ c }) => PAY_LABEL.test(c.label));
-    return (payLike ?? usable[0]).i;
+    const payLike = cands.findIndex((c) => PAY_LABEL.test(c.label));
+    return payLike >= 0 ? payLike : 0;
 }
 const PAY_LABEL = /pay|place order|complete order|submit order|buy now/i;
-async function findSubmit(page) {
+async function findSubmit(page, options = {}) {
     const controls = page.locator('button[type="submit"], input[type="submit"]');
     const handles = await controls.all().catch(() => []);
     if (handles.length > 0) {
@@ -160,7 +164,7 @@ async function findSubmit(page) {
                 area: box ? box.width * box.height : 0,
             };
         }));
-        const idx = preferredSubmitIndex(metas);
+        const idx = preferredSubmitIndex(metas, options);
         if (idx >= 0) {
             const chosen = handles[idx];
             const label = metas[idx].label || 'submit';
@@ -913,7 +917,10 @@ export async function prepareCheckout(opts, store = defaultPreparedCheckoutStore
                 result: makeResult('blocked-by-mandate', fields, evidence, requiresAdapter, verdict.reason),
             };
         }
-        const submit = await findSubmit(page);
+        // A later checkout step may own the submit control while it is still
+        // hidden. Fingerprint that future target for human review, but do not use
+        // the inert fallback at the final click boundary below.
+        const submit = await findSubmit(page, { allowInertFallback: true });
         const review = Object.freeze({
             id: randomUUID(),
             url: page.url(),
@@ -1034,7 +1041,10 @@ export async function submitApprovedCheckout(reviewId, opts, store = defaultPrep
             evidence.setSnapshotSummary(await snapshotSummary(page));
             return makeResult('blocked-by-mandate', state.fields, evidence, requiresAdapter, changedAtApproval);
         }
-        const approvalSubmit = await findSubmit(page);
+        // Revalidate the same future target before credential minting. This may be
+        // hidden on a multi-step checkout; the final lookup after reveal requires
+        // a usable visible control before any click can happen.
+        const approvalSubmit = await findSubmit(page, { allowInertFallback: true });
         const submitChangedAtApproval = submitTargetChangeReason(checkout.review, approvalSubmit);
         if (submitChangedAtApproval) {
             evidence.step('approval', {