<!-- Antifraude: carregar na página de checkout, não sob demanda -->
<script src="{NETHONE_SCRIPT_URL}" async></script>

<!-- 3DS Cielo (somente se usar 3DS) — staging (mpisandbox = Braspag staging) -->
<script src="https://mpisandbox.braspag.com.br/Scripts/BP.Mpi.3ds20.min.js" async></script>
<script src="https://songbird.cardinalcommerce.com/edge/v1/songbird.js" async></script>

const fraudSessionId = crypto.randomUUID()
window.dftp?.init({ attemptReference: fraudSessionId })

// Primeira linha do handleSubmit
await window.dftp?.profileCompleted()

// Depois submeta o pagamento (via seu BFF — nunca exponha o token no cliente)
const response = await fetch('/api/cakto/checkout', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    user: MERCHANT_ID,
    paymentMethod: 'credit_card',
    amount: '149.90',
    installments: 1,
    antifraud_profiling_attempt_reference: fraudSessionId,
    card: {
      number: '4111111111111111',
      holderName: 'JOAO DA SILVA',
      expMonth: '12',
      expYear: '2029',
      cvv: '123',
    },
    customer: {
      name: 'João da Silva',
      email: 'joao@example.com',
      phone: '11999999999',
      docType: 'cpf',
      docNumber: '12345678900',
    },
    address: {
      street: 'Rua das Flores',
      number: '123',
      neighborhood: 'Centro',
      city: 'São Paulo',
      state: 'SP',
      zipcode: '01310100',
      country: 'BR',
    },
    items: [{ title: 'Produto', unitPrice: '149.90', quantity: 1 }],
    postbackUrl: 'https://sua-loja.com/webhooks/cakto',
  }),
})

const payment = await response.json()
if (payment.status === 'paid') {
  // Liberar acesso ao produto
}