@visa/cli 4.1.0-rc.242 → 4.1.0-rc.243

package/dist/checkout-engine/executor.js

@@ -27,6 +27,7 @@ import { traceHandleFields } from './trace-handles.js';
 import { readGenericPageAmount } from './amount.js';
 import { webBotAuthHeadersOrNone } from './web-bot-auth.js';
 import { assertShopifyGuestCheckout, ensureShopifyGuestCheckout, isShopifyCheckoutPage, readShopifyAmount, readStableShopifyAmount, shopifyEnglishCheckoutUrl, } from './adapters/shopify.js';
+import { navigationRedirectEvidence, shopifyPrimaryDomainAlias } from './shopify-primary-domain.js';
 export { minorFromDecimal, pageCurrency } from './amount.js';
 const SUBMIT_TEXT = /pay|place order|complete|buy|submit|checkout/i;
 const REVEAL_TEXT = /continue|next|proceed|review|go to payment/i;
@@ -805,7 +806,7 @@ export async function prepareCheckout(opts, store = defaultPreparedCheckoutStore
         evidence.step('navigation', {
             url: options.trustedMerchantIdentity ? exactOrigin(options.url) : options.url,
         });
-        await page.goto(options.url, { waitUntil: 'domcontentloaded' });
+        const navigationResponse = await page.goto(options.url, { waitUntil: 'domcontentloaded' });
         await waitForStableDom(page);
         evidence.step('dom-stable', {
             url: options.trustedMerchantIdentity ? exactOrigin(page.url()) : page.url(),
@@ -824,6 +825,25 @@ export async function prepareCheckout(opts, store = defaultPreparedCheckoutStore
                 result: makeResult('blocked-by-mandate', fields, evidence, requiresAdapter, initialOriginRefusal),
             };
         }
+        if (!options.trustedMerchantIdentity) {
+            const shopifyAlias = shopifyPrimaryDomainAlias({
+                mandateHost: options.mandate.merchantHost,
+                initialUrl: options.url,
+                finalUrl: page.url(),
+                redirects: await navigationRedirectEvidence(navigationResponse),
+            });
+            if (shopifyAlias) {
+                evidence.step('note', {
+                    kind: 'shopify-primary-domain-alias',
+                    mandateHost: options.mandate.merchantHost,
+                    checkoutHost: shopifyAlias,
+                });
+                // The proof is collected before any credential is minted. Bind this
+                // prepared session to Shopify's primary storefront host so every later
+                // approval and pre-submit revalidation stays strict on that host.
+                options.mandate = { ...options.mandate, merchantHost: shopifyAlias };
+            }
+        }
         let reviewedOrigin;
         const preFill = checkMandatePreFill(mandateForPage(options, page.url()), {
             merchantHost,

package/dist/checkout-engine/shopify-primary-domain.d.ts

@@ -0,0 +1,25 @@
+import type { Response } from 'playwright-core';
+export type NavigationRedirectEvidence = {
+    sourceUrl: string;
+    status: number;
+    location: string | null;
+    redirectReason: string | null;
+    poweredBy: string | null;
+};
+/**
+ * Resolve Shopify's permanent `*.myshopify.com` identity to its configured
+ * primary storefront host using evidence from the navigation redirect chain.
+ *
+ * This deliberately does not treat a generic redirect, matching HTML, DNS, or
+ * a shared Shopify CDN as merchant ownership proof. The only accepted cross-host
+ * hop must originate on the mandate-bound `myshopify.com` host over HTTPS and
+ * carry Shopify's exact `primary_domain_redirection` response signal directly
+ * to the final checkout host.
+ */
+export declare function shopifyPrimaryDomainAlias(args: {
+    mandateHost: string | undefined;
+    initialUrl: string;
+    finalUrl: string;
+    redirects: readonly NavigationRedirectEvidence[];
+}): string | null;
+export declare function navigationRedirectEvidence(finalResponse: Response | null): Promise<NavigationRedirectEvidence[]>;

package/dist/checkout-engine/shopify-primary-domain.js

@@ -0,0 +1,96 @@
+const MYSHOPIFY_HOST = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.myshopify\.com$/;
+function hostname(value) {
+    try {
+        return new URL(value).hostname.toLowerCase();
+    }
+    catch {
+        try {
+            return new URL(`https://${value}`).hostname.toLowerCase();
+        }
+        catch {
+            return null;
+        }
+    }
+}
+function redirectTargetHost(redirect) {
+    if (!redirect.location)
+        return null;
+    try {
+        return new URL(redirect.location, redirect.sourceUrl).hostname.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve Shopify's permanent `*.myshopify.com` identity to its configured
+ * primary storefront host using evidence from the navigation redirect chain.
+ *
+ * This deliberately does not treat a generic redirect, matching HTML, DNS, or
+ * a shared Shopify CDN as merchant ownership proof. The only accepted cross-host
+ * hop must originate on the mandate-bound `myshopify.com` host over HTTPS and
+ * carry Shopify's exact `primary_domain_redirection` response signal directly
+ * to the final checkout host.
+ */
+export function shopifyPrimaryDomainAlias(args) {
+    if (!args.mandateHost)
+        return null;
+    let initial;
+    let final;
+    try {
+        initial = new URL(args.initialUrl);
+        final = new URL(args.finalUrl);
+    }
+    catch {
+        return null;
+    }
+    if (initial.protocol !== 'https:' || final.protocol !== 'https:')
+        return null;
+    const mandateHost = hostname(args.mandateHost);
+    const initialHost = initial.hostname.toLowerCase();
+    const finalHost = final.hostname.toLowerCase();
+    if (!mandateHost || mandateHost !== initialHost || !MYSHOPIFY_HOST.test(initialHost))
+        return null;
+    if (initialHost === finalHost)
+        return null;
+    const crossHostRedirects = args.redirects.filter((redirect) => {
+        const sourceHost = hostname(redirect.sourceUrl);
+        const targetHost = redirectTargetHost(redirect);
+        return sourceHost !== null && targetHost !== null && sourceHost !== targetHost;
+    });
+    if (crossHostRedirects.length !== 1)
+        return null;
+    const redirect = crossHostRedirects[0];
+    const source = new URL(redirect.sourceUrl);
+    const target = redirect.location ? new URL(redirect.location, source) : null;
+    if (source.protocol !== 'https:' ||
+        source.hostname.toLowerCase() !== initialHost ||
+        !target ||
+        target.protocol !== 'https:' ||
+        target.hostname.toLowerCase() !== finalHost ||
+        ![301, 302, 307, 308].includes(redirect.status) ||
+        redirect.redirectReason?.toLowerCase() !== 'primary_domain_redirection' ||
+        redirect.poweredBy?.toLowerCase() !== 'shopify') {
+        return null;
+    }
+    return finalHost;
+}
+export async function navigationRedirectEvidence(finalResponse) {
+    const redirects = [];
+    let request = finalResponse?.request().redirectedFrom() ?? null;
+    while (request) {
+        const response = await request.response();
+        if (response) {
+            const headers = response.headers();
+            redirects.push({
+                sourceUrl: request.url(),
+                status: response.status(),
+                location: headers.location ?? null,
+                redirectReason: headers['x-redirect-reason'] ?? null,
+                poweredBy: headers['powered-by'] ?? null,
+            });
+        }
+        request = request.redirectedFrom();
+    }
+    return redirects.reverse();
+}