booking-agent-cli 0.7.0__tar.gz → 0.8.0__tar.gz

{booking_agent_cli-0.7.0 → booking_agent_cli-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: booking-agent-cli
-Version: 0.7.0
+Version: 0.8.0
 Summary: The Booking Agent CLI: a stateful USP booking flow with hard gates, plus its USP protocol library.
 Project-URL: Homepage, https://github.com/wix/booking-agent
 Project-URL: Documentation, https://github.com/wix/booking-agent/blob/master/booking-agent/README.md
@@ -78,7 +78,7 @@ Each release also publishes that skill at an immutable `skill-v<version>` tag an
 the release workflow, so a harness can pin and verify the exact text it follows:
 
 ```bash
-curl -fsSLO https://raw.githubusercontent.com/wix/booking-agent/skill-v0.55.0/booking-agent/skills/booking-agent/SKILL.md
+curl -fsSLO https://raw.githubusercontent.com/wix/booking-agent/skill-v0.56.0/booking-agent/skills/booking-agent/SKILL.md
 gh attestation verify SKILL.md --repo wix/booking-agent \
   --signer-workflow wix/booking-agent/.github/workflows/release.yml
 ```

{booking_agent_cli-0.7.0 → booking_agent_cli-0.8.0}/README.md

@@ -36,7 +36,7 @@ Each release also publishes that skill at an immutable `skill-v<version>` tag an
 the release workflow, so a harness can pin and verify the exact text it follows:
 
 ```bash
-curl -fsSLO https://raw.githubusercontent.com/wix/booking-agent/skill-v0.55.0/booking-agent/skills/booking-agent/SKILL.md
+curl -fsSLO https://raw.githubusercontent.com/wix/booking-agent/skill-v0.56.0/booking-agent/skills/booking-agent/SKILL.md
 gh attestation verify SKILL.md --repo wix/booking-agent \
   --signer-workflow wix/booking-agent/.github/workflows/release.yml
 ```

{booking_agent_cli-0.7.0 → booking_agent_cli-0.8.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "booking-agent-cli"
-version = "0.7.0"
+version = "0.8.0"
 description = "The Booking Agent CLI: a stateful USP booking flow with hard gates, plus its USP protocol library."
 readme = "README.md"
 license = "Apache-2.0"

{booking_agent_cli-0.7.0 → booking_agent_cli-0.8.0}/src/booking_agent/__init__.py

@@ -3,4 +3,4 @@
 Ships in the booking-agent-cli wheel and never imports ``booking_agent_cli``.
 """
 
-__version__ = "0.7.0"
+__version__ = "0.8.0"

{booking_agent_cli-0.7.0 → booking_agent_cli-0.8.0}/src/booking_agent/namespace.py

@@ -17,6 +17,7 @@ CAP_CATALOG = "dev.usp-protocol.services.catalog"
 CAP_AVAILABILITY = "dev.usp-protocol.services.availability"
 CAP_BOOKINGS = "dev.usp-protocol.services.bookings"
 CAP_PAID_BOOKINGS = "dev.usp-protocol.services.paid_bookings"
+CAP_PAY_AT_SERVICE = "dev.usp-protocol.services.pay_at_service"
 
 
 class NamespaceOriginError(ValueError):

{booking_agent_cli-0.7.0 → booking_agent_cli-0.8.0}/src/booking_agent/platform_profile.py

@@ -88,6 +88,17 @@ def platform_profile_doc() -> Dict[str, Any]:
                         "extends": "dev.ucp.shopping.checkout",
                     }
                 ],
+                "dev.usp-protocol.services.pay_at_service": [
+                    {
+                        "version": "2026-08-20",
+                        "spec": (
+                            "https://usp-protocol.dev/specification"
+                            "#pay-at-service-settlement-extension"
+                        ),
+                        "schema": "https://usp-protocol.dev/schemas/services/pay_at_service.json",
+                        "extends": "dev.ucp.shopping.checkout",
+                    }
+                ],
                 "dev.ucp.common.payment.terms": [
                     {
                         "version": "2026-08-25",

{booking_agent_cli-0.7.0 → booking_agent_cli-0.8.0}/src/booking_agent/ucp_capabilities.py

@@ -28,6 +28,7 @@ from __future__ import annotations
 from typing import Any, Callable, Dict, List
 
 from .ucp_negotiation import _capabilities_from_doc
+from .namespace import CAP_PAY_AT_SERVICE
 from .ucp_profile import CAP_PAID_BOOKINGS, UcpProfileValidationError
 
 
@@ -91,9 +92,14 @@ def _paid_bookings_handler(echoed_versions: List[str], platform_supported: List[
     _validate_versions_supported(CAP_PAID_BOOKINGS, echoed_versions, platform_supported)
 
 
+def _pay_at_service_handler(echoed_versions: List[str], platform_supported: List[str]) -> None:
+    _validate_versions_supported(CAP_PAY_AT_SERVICE, echoed_versions, platform_supported)
+
+
 # namespace -> handler. Register new capabilities (e.g. AP2) here.
 CAPABILITY_HANDLERS: Dict[str, CapabilityHandler] = {
     CAP_PAID_BOOKINGS: _paid_bookings_handler,
+    CAP_PAY_AT_SERVICE: _pay_at_service_handler,
 }
 
 

{booking_agent_cli-0.7.0 → booking_agent_cli-0.8.0}/src/booking_agent/ucp_checkout.py

@@ -5,6 +5,7 @@ import json
 import logging
 import uuid
 from dataclasses import dataclass
+from datetime import datetime
 from enum import Enum
 from typing import Any, Dict, List, Optional
 
@@ -489,6 +490,129 @@ def immediate_schedule_amount(term: Dict[str, Any]) -> Optional[int]:
     return amount
 
 
+PAY_AT_SERVICE_CAPABILITY = "dev.usp-protocol.services.pay_at_service"
+SETTLEMENT_MODE_OFFLINE = "offline"
+#: Disclosure code the business emits for a pay-at-service checkout (USP 11.3.5 S8).
+PAYMENT_DUE_AT_SERVICE_CODE = "payment_due_at_service"
+
+
+def is_offline_settled(checkout: Any) -> bool:
+    """True when the checkout declares ``settlement.mode == "offline"`` (USP 11.3.3)."""
+    settlement = checkout.get("settlement") if isinstance(checkout, dict) else None
+    return isinstance(settlement, dict) and settlement.get("mode") == SETTLEMENT_MODE_OFFLINE
+
+
+def _instants_equal(a: Any, b: Any) -> bool:
+    """Compare two RFC 3339 instants, tolerating a differing UTC offset spelling."""
+    if a == b:
+        return True
+    try:
+        left = datetime.fromisoformat(str(a).replace("Z", "+00:00"))
+        right = datetime.fromisoformat(str(b).replace("Z", "+00:00"))
+    except ValueError:
+        return False
+    if left.tzinfo is None or right.tzinfo is None:
+        return False
+    return left == right
+
+
+def _is_at_service_term(term: Any) -> bool:
+    schedules = term.get("schedules") if isinstance(term, dict) else None
+    return (
+        isinstance(schedules, list)
+        and bool(schedules)
+        and all(isinstance(s, dict) and s.get("type") == "at_service" for s in schedules)
+    )
+
+
+def validate_offline_settlement(
+    checkout: Dict[str, Any],
+    *,
+    negotiated_capabilities: Optional[Dict[str, Any]] = None,
+    persisted_term: Optional[Dict[str, Any]] = None,
+    slot_start: Optional[str] = None,
+) -> Dict[str, Any]:
+    """Validate a pay-at-service checkout (USP 11.3) and return its selected term.
+
+    Fails closed on anything the extension does not define: an unknown settlement
+    mode, a settlement without the terms it names (S1), more than one offline term
+    (S2), a ``due_at`` that is not the slot start (S3), or a selected term other
+    than the offline one (S4 applies only when the offline term is selected).
+    """
+    settlement = checkout.get("settlement")
+    if not isinstance(settlement, dict):
+        raise UcpProfileValidationError("Checkout settlement must be an object.")
+    if settlement.get("mode") != SETTLEMENT_MODE_OFFLINE:
+        raise UcpProfileValidationError(
+            f"Checkout settlement mode {settlement.get('mode')!r} is not supported."
+        )
+    term_id = settlement.get("term_id")
+    if not isinstance(term_id, str) or not term_id:
+        raise UcpProfileValidationError("Checkout settlement is missing term_id.")
+    caps = negotiated_capabilities or {}
+    missing = [
+        cap for cap in (PAY_AT_SERVICE_CAPABILITY, PAYMENT_TERMS_CAPABILITY) if cap not in caps
+    ]
+    if missing:
+        raise UcpProfileValidationError(
+            "Checkout declared pay-at-service settlement without negotiated capabilities "
+            f"{missing!r}."
+        )
+    payment = checkout.get("payment") if isinstance(checkout.get("payment"), dict) else {}
+    terms = payment.get("terms")
+    selected_id = payment.get("selected_term_id")
+    if not isinstance(terms, list) or not terms or not selected_id:
+        raise UcpProfileValidationError(
+            "Checkout settlement requires payment.terms and payment.selected_term_id."
+        )
+    named = [t for t in terms if isinstance(t, dict) and t.get("id") == term_id]
+    if len(named) != 1:
+        raise UcpProfileValidationError(
+            "Checkout settlement.term_id must match exactly one payment.terms[].id."
+        )
+    term = named[0]
+    offline_terms = [t for t in terms if _is_at_service_term(t)]
+    if len(offline_terms) != 1 or offline_terms[0] is not term:
+        raise UcpProfileValidationError(
+            "A pay-at-service checkout must offer exactly one pay-at-service term, "
+            "and settlement.term_id must name it."
+        )
+    if selected_id != term_id:
+        raise UcpProfileValidationError(
+            "The pay-at-service term is not the selected payment term, so the booking "
+            "cannot be completed without a payment instrument."
+        )
+    total = checkout_total_minor_units(checkout)
+    if total is None:
+        raise UcpProfileValidationError("Checkout totals must include a type=total amount.")
+    amounts: list[int] = []
+    for schedule in term["schedules"]:
+        amount = _schedule_amount(schedule)
+        if amount is None or amount <= 0:
+            raise UcpProfileValidationError(
+                "Each pay-at-service schedule must carry a positive integer amount."
+            )
+        amounts.append(amount)
+        due_at = schedule.get("due_at")
+        if not due_at:
+            raise UcpProfileValidationError(
+                "Pay-at-service schedule must set due_at to the slot start."
+            )
+        if slot_start and not _instants_equal(due_at, slot_start):
+            raise UcpProfileValidationError(
+                "Pay-at-service due_at must equal the booked slot start."
+            )
+    if sum(amounts) != int(total):
+        raise UcpProfileValidationError(
+            "Pay-at-service schedule amounts must sum to the checkout total."
+        )
+    if persisted_term is not None and persisted_term != term:
+        raise UcpProfileValidationError(
+            "The payment term changed since it was quoted. Do not complete this booking."
+        )
+    return term
+
+
 def validate_payment_terms(
     checkout: Dict[str, Any],
     *,
@@ -496,13 +620,33 @@ def validate_payment_terms(
     require_terms: bool = False,
     persisted_term: Optional[Dict[str, Any]] = None,
     slot_start: Optional[str] = None,
+    expect_offline_settlement: bool = False,
 ) -> Optional[Dict[str, Any]]:
     """Validate UCP payment terms on a checkout. Returns the selected term or None.
 
     Deposits require the negotiated terms capability, exactly one selected term,
     schedules that sum to checkout total, exactly one positive immediate amount,
     and an at-service balance with due_at.
+
+    A checkout routed as pay-at-service (``expect_offline_settlement``) must carry
+    an offline ``settlement`` and is validated by :func:`validate_offline_settlement`;
+    any other route that receives a ``settlement`` fails closed rather than being
+    treated as an ordinary charge.
     """
+    has_settlement = "settlement" in checkout
+    if has_settlement != expect_offline_settlement:
+        raise UcpProfileValidationError(
+            "Checkout carries a settlement this booking was not routed for."
+            if has_settlement
+            else "This booking was routed as pay-at-service but the checkout has no settlement."
+        )
+    if has_settlement:
+        return validate_offline_settlement(
+            checkout,
+            negotiated_capabilities=negotiated_capabilities,
+            persisted_term=persisted_term,
+            slot_start=slot_start,
+        )
     payment = checkout.get("payment") if isinstance(checkout.get("payment"), dict) else {}
     terms = payment.get("terms") if isinstance(payment, dict) else None
     has_terms = isinstance(terms, list) and len(terms) > 0

{booking_agent_cli-0.7.0 → booking_agent_cli-0.8.0}/src/booking_agent/ucp_profile.py

@@ -20,9 +20,16 @@ from pydantic import BaseModel, ConfigDict, Field
 from pydantic.alias_generators import to_camel
 
 from .authorization import AuthorizationPolicy, parse_policy
-from .namespace import CAP_CATALOG, CAP_PAID_BOOKINGS, SVC_SERVICES, check_origin_binding
+from .namespace import (
+    CAP_CATALOG,
+    CAP_PAID_BOOKINGS,
+    CAP_PAY_AT_SERVICE,
+    SVC_SERVICES,
+    check_origin_binding,
+)
 
 CAP_CHECKOUT = "dev.ucp.shopping.checkout"
+CAP_PAYMENT_TERMS = "dev.ucp.common.payment.terms"
 
 
 class UcpTransportBinding(BaseModel):
@@ -110,6 +117,20 @@ class UcpNativeContext(BaseModel):
     def requires_paid_bookings(self) -> bool:
         return CAP_PAID_BOOKINGS in self.profile.capabilities
 
+    def declares_pay_at_service(self) -> bool:
+        """True when the business declares everything the pay-at-service checkout path needs.
+
+        USP 11.3.2: a business routing ``at_service`` through a checkout declares
+        ``pay_at_service`` *and* ``dev.ucp.common.payment.terms``; declaring the
+        first without the second is malformed, so it is not treated as declared.
+        """
+        caps = self.profile.capabilities
+        return (
+            CAP_PAY_AT_SERVICE in caps
+            and CAP_PAYMENT_TERMS in caps
+            and CAP_CHECKOUT in caps
+        )
+
     def usp_authorization(self) -> Optional[AuthorizationPolicy]:
         """The ``config.authorization`` policy on the ``dev.usp-protocol.services`` binding.
 

{booking_agent_cli-0.7.0 → booking_agent_cli-0.8.0}/src/booking_agent_cli/__init__.py

@@ -1,3 +1,3 @@
 """booking_agent_cli: typer-based stateful CLI for USP booking flows."""
 
-__version__ = "0.7.0"
+__version__ = "0.8.0"

{booking_agent_cli-0.7.0 → booking_agent_cli-0.8.0}/src/booking_agent_cli/booking_summary.py

@@ -104,7 +104,7 @@ def price_text(session: Any, price_info: Dict[str, Any]) -> Optional[str]:
         return "Free"
     if not price:
         return None
-    if route == "at_service":
+    if route in ("at_service", "pay_at_service"):
         return f"{price}, paid to the business at the appointment (nothing is charged now)"
     if route == "deposit_required":
         return (
@@ -151,6 +151,18 @@ def payment_context_text(session: Any, total_display: Optional[str]) -> str:
     return text
 
 
+def pay_at_service_line(session: Any) -> str:
+    """What is owed and when, from the business's own accepted payment term."""
+    term = getattr(session, "accepted_term", None)
+    schedules = term.get("schedules") if isinstance(term, dict) else None
+    for schedule in schedules or []:
+        description = schedule.get("description") if isinstance(schedule, dict) else None
+        plain = description.get("plain") if isinstance(description, dict) else None
+        if isinstance(plain, str) and plain.strip():
+            return f"Nothing was charged. {plain.strip()}"
+    return "Nothing was charged. Payment is due at your appointment."
+
+
 def booked_message(session: Any) -> str:
     """Plain-language "you're booked" text built from saved state.
 
@@ -171,6 +183,8 @@ def booked_message(session: Any) -> str:
     link = getattr(session, "calendar_event_html_link", None)
     if link:
         text += f"\nAdded to your Google Calendar: {link}"
+    if getattr(session, "payment_route", None) == "pay_at_service":
+        text += "\n" + pay_at_service_line(session)
     booking_url = getattr(getattr(session, "booking", None), "booking_url", None)
     if booking_url:
         text += f"\nTo view, change, or cancel it later (worth saving): {booking_url}"

{booking_agent_cli-0.7.0 → booking_agent_cli-0.8.0}/src/booking_agent_cli/bundled_skill.md

@@ -1,5 +1,5 @@
 ---
-version: 0.55.0
+version: 0.56.0
 name: booking-agent
 description: |
   Books time-based services via USP from a Link wallet. Use when the user wants to book, schedule, reserve, or pay for a service from a business (haircut, lesson, repair, class, appointment, consult). The `booking-agent` CLI owns the booking state machine and refuses to proceed when human gates are skipped. Sign the user in to Link on your own, right after install and at the start of every booking (`booking-agent flow link-auth connect`, then start `booking-agent flow link-auth poll` in the background and post the sign-in URL in the same turn, exactly like `pay poll`); never wait for the user to ask to sign in or to say they approved. After `booking-agent flow business use`, follow `next_command` through `use-ucp-checkout-mode`; businesses without native checkout fail closed. Payment uses `booking-agent flow pay request` (default returns immediately with the approval URL), then start `booking-agent flow pay poll` in the background and post the approval URL to the user in the same turn; the poll finishes checkout once they approve. Confirm through `booking-agent flow book poll --wait`; never start an inbound webhook. Surface the approval URL exactly once. Personal identification (name, phone, email, address) must always come from the user's Link account via `link-cli`, never from chat or placeholders. Before any location-based search, the CLI proposes the Link shipping address and the user confirms it or gives another; online services skip this. Talk to the user in plain everyday language only; never expose CLI, UCP, auth, session, or other implementation details unless they explicitly ask.
@@ -19,7 +19,7 @@ metadata:
         - link-cli
     install:
       - kind: uv
-        package: "booking-agent-cli==0.7.0"
+        package: "booking-agent-cli==0.8.0"
         bins: [booking-agent]
 user-invocable: true
 ---
@@ -220,7 +220,7 @@ To take a fixed, published version instead of the latest, fetch it at the releas
 workflow signs it under, and check the signature before you follow it:
 
 ```bash
-curl -fsSLO https://raw.githubusercontent.com/wix/booking-agent/skill-v0.55.0/booking-agent/skills/booking-agent/SKILL.md
+curl -fsSLO https://raw.githubusercontent.com/wix/booking-agent/skill-v0.56.0/booking-agent/skills/booking-agent/SKILL.md
 gh attestation verify SKILL.md \
   --repo wix/booking-agent \
   --signer-workflow wix/booking-agent/.github/workflows/release.yml
@@ -245,17 +245,17 @@ before installing:
 
 ```bash
 dir="$HOME/.booking-agent/verified-wheels"
-uvx pip download "booking-agent-cli==0.7.0" --no-deps --only-binary :all: -d "$dir"
+uvx pip download "booking-agent-cli==0.8.0" --no-deps --only-binary :all: -d "$dir"
 uvx pypi-attestations==0.0.30 verify pypi --repository https://github.com/wix/booking-agent \
-  "$dir/booking_agent_cli-0.7.0-py3-none-any.whl"
-uv tool install --force "$dir/booking_agent_cli-0.7.0-py3-none-any.whl"
+  "$dir/booking_agent_cli-0.8.0-py3-none-any.whl"
+uv tool install --force "$dir/booking_agent_cli-0.8.0-py3-none-any.whl"
 
 booking-agent --help
 ```
 
 Install only the wheel whose verify step passed, never one that failed it. If `uvx` is not
-available, install the same pinned release with `uv tool install booking-agent-cli==0.7.0` or
-`pipx install booking-agent-cli==0.7.0`; the CLI checks its own files against the signed release
+available, install the same pinned release with `uv tool install booking-agent-cli==0.8.0` or
+`pipx install booking-agent-cli==0.8.0`; the CLI checks its own files against the signed release
 on the first `booking-agent flow init` and refuses to book or pay if they do not match.
 
 Harnesses that read the `install` block in this skill's metadata do this for you. Do not go on
@@ -308,7 +308,7 @@ prints each effective setting and where it came from; `booking-agent config init
 
 The CLI decides whether a newer version is worth mentioning; you never decide from version
 numbers or release pages. Pass this skill's version on every `flow init` (`--skill-version
-0.55.0`, from the frontmatter above), so the CLI can tell when these instructions and the
+0.56.0`, from the frontmatter above), so the CLI can tell when these instructions and the
 installed CLI no longer match.
 
 - When a command returns `awaiting_user: update_consent`, ask the question in `prompt` in plain
@@ -470,7 +470,7 @@ confirmation email or on the business's page (`booking_url`). Do not invent a lo
 **Step 1b — Create a new session:**
 
 ```bash
-booking-agent flow init --user-request "<user's exact request>" --skill-version 0.55.0 \
+booking-agent flow init --user-request "<user's exact request>" --skill-version 0.56.0 \
   --skill-path "<absolute path of the SKILL.md you loaded>"
 ```
 
@@ -786,8 +786,7 @@ If `flow book` fails with `mandatory_acceptance_pending`, show the user any poli
 `flow book`. **Never** accept policies or tick boxes on their behalf.
 
 If `data.checkout_links` or `data.checkout_policies` are present after a successful book, show
-those links before payment. If the merchant sent none, say nothing about policies; do not tell
-the user policies are "missing."
+those links before payment. If none were sent, say nothing about policies.
 
 **Free and pay-at-appointment bookings (`free`, `at_service`).** `flow book` places the booking
 directly and `next_command` is `booking-agent flow book poll --wait`. Before running it, tell the user
@@ -796,6 +795,9 @@ charged (or the price is paid at the appointment), and you are now waiting for t
 confirm. Then run `book poll --wait` and report the result. Never create a payment and skip
 Steps 6b to 6d.
 
+**Pay-at-appointment with a checkout (`pay_at_service`).** Nothing is charged; skip `pay request`. Show every `data.payment_disclosures` item (`content_display`) and the amount
+due at the appointment, then run `pay ucp-complete --disclosures-confirmed`. If `merchant_quote.total_changed`, get approval and add `--total-confirmed`.
+
 **Deposit bookings (`deposit_required`).** Before any charge, show `data.due_now_display` (the
 deposit charged now), the amount due at the appointment, and every item in
 `data.payment_schedules` and `data.payment_disclosures`, and get the user's agreement. Then run
@@ -927,8 +929,9 @@ UCP `complete_checkout` (CLI builds this internally): `handler_id: "stripe_payme
 
 **Payment notes (error recovery only):**
 
-- A live catalog with `payment_timing: at_service` is booked directly. Tell the user the quoted
-  price is paid at the appointment. Do not run a payment command.
+- A live catalog with `payment_timing: at_service` is booked directly or, when `data.payment_route`
+  is `pay_at_service`, through a checkout. Tell the user the quoted price is paid at the
+  appointment. Never run `pay request` for it.
 - A live catalog with `payment_timing: deposit_required` goes through checkout. Charge only the
   due-now (immediate) amount from the payment term. Show every disclosure and the amount due at
   the appointment, then pass `--disclosures-confirmed` on `pay request` after the user agrees.
@@ -963,8 +966,7 @@ data, credentials, or shared payment tokens.
 
 ### Step 8 and after the booking
 
-Nothing to run: `pay poll` (and `book poll --wait` for free or pay-at-appointment bookings) adds the
-calendar event and returns the final answer. See Step 7.
+Nothing to run; Step 7's command already added the calendar event.
 
 ## Important
 

{booking_agent_cli-0.7.0 → booking_agent_cli-0.8.0}/src/booking_agent_cli/catalog.py

@@ -670,15 +670,28 @@ def payment_price_for_session(
 
 
 DIRECT_BOOKING_ROUTES = frozenset({"free", "at_service"})
-CHECKOUT_BOOKING_ROUTES = frozenset({"at_booking", "deposit_required"})
+CHECKOUT_BOOKING_ROUTES = frozenset({"at_booking", "deposit_required", "pay_at_service"})
+# Routes where nothing is collected through the booking flow: no Link spend
+# request, no payment instrument. ``pay_at_service`` still goes through a UCP
+# checkout (so an order exists); ``free`` and ``at_service`` do not.
+NO_PAYMENT_ROUTES = frozenset({"free", "at_service", "pay_at_service"})
 
 
-def classify_payment_route(live_service: Dict[str, Any]) -> Dict[str, Any]:
+def classify_payment_route(
+    live_service: Dict[str, Any],
+    *,
+    pay_at_service_declared: bool = False,
+) -> Dict[str, Any]:
     """Classify a live service into a per-service payment route.
 
     Timing is a service property, not a business property. Mixed catalogs
     (at_booking, at_service, deposit_required, free on one profile) must route
     each service independently.
+
+    An ``at_service`` service takes the ``pay_at_service`` checkout route only
+    when the business declares the pay-at-service extension; otherwise it keeps
+    the direct route (USP 7.6.1: a platform MUST NOT route ``at_service``
+    through a checkout the business has not declared the extension for).
     """
     policies = live_service.get("policies") if isinstance(live_service, dict) else None
     pricing = live_service.get("pricing") if isinstance(live_service, dict) else None
@@ -734,7 +747,8 @@ def classify_payment_route(live_service: Dict[str, Any]) -> Dict[str, Any]:
     if timing == "at_booking":
         return {"route": "at_booking", "timing": timing, "refusal": None}
     if timing == "at_service":
-        return {"route": "at_service", "timing": timing, "refusal": None}
+        route = "pay_at_service" if pay_at_service_declared else "at_service"
+        return {"route": route, "timing": timing, "refusal": None}
     if timing == "deposit_required":
         return {
             "route": "deposit_required",
@@ -758,9 +772,12 @@ def payment_timing_refusal(
     live_service: Dict[str, Any],
     *,
     allow_deposits: bool = True,
+    pay_at_service_declared: bool = False,
 ) -> Optional[Dict[str, str]]:
     """Return a fail-closed error when this service cannot be booked."""
-    classified = classify_payment_route(live_service)
+    classified = classify_payment_route(
+        live_service, pay_at_service_declared=pay_at_service_declared
+    )
     if classified["refusal"] is not None:
         return classified["refusal"]
     if classified["route"] == "deposit_required" and not allow_deposits:
@@ -779,9 +796,13 @@ def payment_timing_changed_refusal(
     live_service: Dict[str, Any],
 ) -> Optional[Dict[str, str]]:
     """Fail closed when a later live read disagrees with the discovered timing."""
-    classified = classify_payment_route(live_service)
     previous = getattr(session, "payment_timing", None)
     previous_route = getattr(session, "payment_route", None)
+    # The business's declaration was read when the route was chosen; the live
+    # service read only re-checks the service's own timing.
+    classified = classify_payment_route(
+        live_service, pay_at_service_declared=previous_route == "pay_at_service"
+    )
     new_timing = classified["timing"]
     new_route = classified["route"]
     if previous is None and previous_route is None: