@visa/cli 4.1.0-rc.196 → 4.1.0-rc.197

package/dist/checkout-engine/executor.d.ts

@@ -128,8 +128,8 @@ export type SubmitCandidateMeta = {
     visible: boolean;
     area: number;
 };
-export declare function preferredSubmitIndex(cands: readonly SubmitCandidateMeta[], options?: {
-    allowInertFallback?: boolean;
+export declare function preferredSubmitIndex(cands: readonly SubmitCandidateMeta[], opts?: {
+    allowDeferred?: boolean;
 }): number;
 export declare function snapshotOrigin(rawUrl: string): string;
 export type PreparedCheckoutSession = {

package/dist/checkout-engine/executor.js

@@ -131,21 +131,28 @@ async function fingerprintSubmitTarget(locator, kind, fallbackLabel) {
 // (observed live: `<h3 id="billingAddress"> intercepts pointer events`, retried
 // until the 6s timeout, deterministically, on casper.com). Rank the real
 // controls ahead of the inert ones and prefer a pay-labelled control.
-export function preferredSubmitIndex(cands, options = {}) {
-    const usable = cands
-        .map((c, i) => ({ c, i }))
-        .filter(({ c }) => c.visible && !c.ariaHidden && c.tabIndex !== -1 && c.area > 0);
-    if (usable.length > 0) {
-        const payLike = usable.find(({ c }) => PAY_LABEL.test(c.label));
-        return (payLike ?? usable[0]).i;
-    }
-    if (!options.allowInertFallback || cands.length === 0)
+export function preferredSubmitIndex(cands, opts = {}) {
+    const indexed = cands.map((c, i) => ({ c, i }));
+    const usable = indexed.filter(({ c }) => c.visible && !c.ariaHidden && c.tabIndex !== -1 && c.area > 0);
+    const usablePayLike = usable.find(({ c }) => PAY_LABEL.test(c.label));
+    if (usablePayLike)
+        return usablePayLike.i;
+    if (!opts.allowDeferred)
+        return usable[0]?.i ?? -1;
+    // A genuine multi-step checkout can keep its final submit control inside a
+    // hidden payment section until a safe, non-submit Continue button advances
+    // the page. The human still needs that exact control bound into the review
+    // before approval. Accept it for fingerprinting only when it is not marked
+    // inert; the pre-click lookup remains strict and will refuse unless the same
+    // control becomes visible and has non-zero area after reveal.
+    const deferred = indexed.filter(({ c }) => !c.ariaHidden && c.tabIndex !== -1);
+    if (deferred.length === 0)
         return -1;
-    const payLike = cands.findIndex((c) => PAY_LABEL.test(c.label));
-    return payLike >= 0 ? payLike : 0;
+    const deferredPayLike = deferred.find(({ c }) => PAY_LABEL.test(c.label));
+    return (deferredPayLike ?? usable[0] ?? deferred[0]).i;
 }
 const PAY_LABEL = /pay|place order|complete order|submit order|buy now/i;
-async function findSubmit(page, options = {}) {
+async function findSubmit(page, opts = {}) {
     const controls = page.locator('button[type="submit"], input[type="submit"]');
     const handles = await controls.all().catch(() => []);
     if (handles.length > 0) {
@@ -164,7 +171,7 @@ async function findSubmit(page, options = {}) {
                 area: box ? box.width * box.height : 0,
             };
         }));
-        const idx = preferredSubmitIndex(metas, options);
+        const idx = preferredSubmitIndex(metas, opts);
         if (idx >= 0) {
             const chosen = handles[idx];
             const label = metas[idx].label || 'submit';
@@ -917,10 +924,10 @@ export async function prepareCheckout(opts, store = defaultPreparedCheckoutStore
                 result: makeResult('blocked-by-mandate', fields, evidence, requiresAdapter, verdict.reason),
             };
         }
-        // A later checkout step may own the submit control while it is still
-        // hidden. Fingerprint that future target for human review, but do not use
-        // the inert fallback at the final click boundary below.
-        const submit = await findSubmit(page, { allowInertFallback: true });
+        // Multi-step pages may expose the final submit control in a hidden section
+        // before a safe Continue reveals it. Fingerprint that exact control for the
+        // human review; the eventual click path still requires it to be usable.
+        const submit = await findSubmit(page, { allowDeferred: true });
         const review = Object.freeze({
             id: randomUUID(),
             url: page.url(),
@@ -1043,8 +1050,8 @@ export async function submitApprovedCheckout(reviewId, opts, store = defaultPrep
         }
         // Revalidate the same future target before credential minting. This may be
         // hidden on a multi-step checkout; the final lookup after reveal requires
-        // a usable visible control before any click can happen.
-        const approvalSubmit = await findSubmit(page, { allowInertFallback: true });
+        // the reviewed control to be visible and usable before any click.
+        const approvalSubmit = await findSubmit(page, { allowDeferred: true });
         const submitChangedAtApproval = submitTargetChangeReason(checkout.review, approvalSubmit);
         if (submitChangedAtApproval) {
             evidence.step('approval', {