@agent-cards/checkout 0.13.0 → 0.15.0

package/dist/prepared-processor.js

@@ -1,20 +1,29 @@
+import { adyenPreparationUrl, isPreparedAdyenRequest } from './adyen.generated.js';
 import { braintreeEnvironment, isPreparedBraintreeRequest, readTokenizationJson } from './braintree.js';
 import { isPreparedRecurlyRequest } from './recurly.generated.js';
-/** Shared endpoint processors cannot attest test/live mode from their URL or key prefix. */
+import { isPreparedSpreedlyRequest, isSpreedlyTokenRequest, SPREEDLY_TOKEN_ENDPOINT } from './spreedly.generated.js';
+export function preparationMode(psp) {
+    return psp === 'adyen' ? 'cse' : 'token';
+}
+/** Shared endpoint processors cannot attest test/live mode from their URL or key prefix. Adyen can: test and live are separate hosts and key prefixes. */
 export function validPreparationEnvironment(psp, environment) {
-    if (psp === 'bambora' || psp === 'mercado_pago' || psp === 'recurly')
+    if (psp === 'bambora' || psp === 'mercado_pago' || psp === 'recurly' || psp === 'spreedly')
         return environment === 'shared';
-    return ['square', 'braintree', 'worldpay'].includes(psp) && ['production', 'sandbox'].includes(environment);
+    return ['square', 'braintree', 'worldpay', 'adyen'].includes(psp) && ['production', 'sandbox'].includes(environment);
 }
 export function preparationEndpoint(psp, environment) {
     if (!validPreparationEnvironment(psp, environment))
         throw new Error('unsupported_preparation_processor');
+    if (psp === 'adyen')
+        return adyenPreparationUrl(environment);
     if (psp === 'bambora')
         return 'https://api.bam.shift4api.net/scripts/tokenization/tokens';
     if (psp === 'mercado_pago')
         return 'https://api.mercadopago.com/v1/card_tokens';
     if (psp === 'recurly')
         return 'https://api.recurly.com/js/v1/token';
+    if (psp === 'spreedly')
+        return SPREEDLY_TOKEN_ENDPOINT;
     if (psp === 'worldpay')
         return environment === 'production'
             ? 'https://access.worldpay.com/sessions/card' : 'https://try.access.worldpay.com/sessions/card';
@@ -67,8 +76,12 @@ function freshCardBody(psp, body) {
 export function matchesPreparedRequest(psp, environment, requestUrl, method, body) {
     if (method.toUpperCase() !== 'POST' || !validPreparationEnvironment(psp, environment))
         return false;
+    if (psp === 'adyen')
+        return isPreparedAdyenRequest(requestUrl, method, body ?? null, environment);
     if (psp === 'braintree')
         return braintreeEnvironment(requestUrl) === environment && isPreparedBraintreeRequest(body ?? null);
+    if (psp === 'spreedly')
+        return isSpreedlyTokenRequest(requestUrl, method) && isPreparedSpreedlyRequest(body ?? null);
     try {
         const request = new URL(requestUrl), endpoint = new URL(preparationEndpoint(psp, environment));
         if (request.username || request.password || request.hash)

package/dist/spreedly.generated.d.ts

@@ -0,0 +1,10 @@
+declare var SPREEDLY_TOKEN_ENDPOINT: string;
+declare function isSpreedlyTokenRequest(url: any, method?: string): boolean;
+declare function isPreparedSpreedlyRequest(body: any): boolean;
+declare function isSpreedlyRequest(request: any): boolean;
+declare function injectSpreedlyCard(body: any, card: any): {
+    body: string;
+    where: string[];
+};
+declare function sanitizeSpreedlyTokenResponse(body: any): string;
+export { SPREEDLY_TOKEN_ENDPOINT, injectSpreedlyCard, isPreparedSpreedlyRequest, isSpreedlyRequest, isSpreedlyTokenRequest, sanitizeSpreedlyTokenResponse };

package/dist/spreedly.generated.js

@@ -0,0 +1,332 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: bd953f414724afdcc2930f895f106fbc908b78875358b33d01c0ee55985b9a29
+// src/spreedly.js
+var SPREEDLY_TOKEN_ENDPOINT = "https://core.spreedly.com/v1/payment_methods/restricted.json";
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var owns = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+var exact = (pattern, value) => typeof value === "string" && pattern.exec(value)?.[0] === value;
+var text = (value, max = 1024) => typeof value === "string" && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
+var id = (value) => exact(/^[A-Za-z0-9_-]{1,128}$/, value);
+var keys = (value, allowed) => record(value) && Object.keys(value).every((key) => allowed.includes(key));
+var digits = (value, min, max) => typeof value === "string" && value.length >= min && value.length <= max && !/[^0-9]/.test(value);
+var month = (value) => (Number.isInteger(value) || digits(value, 1, 2)) && Number(value) >= 1 && Number(value) <= 12;
+var year = (value) => (Number.isInteger(value) || digits(value, 2, 4)) && (Number(value) >= 0 && Number(value) <= 99 || Number(value) >= 2e3 && Number(value) <= 9999);
+var CARD_TEXT = [
+    "first_name",
+    "last_name",
+    "full_name",
+    "email",
+    "address1",
+    "address2",
+    "city",
+    "state",
+    "zip",
+    "country",
+    "phone_number",
+    "company",
+    "shipping_address1",
+    "shipping_address2",
+    "shipping_city",
+    "shipping_state",
+    "shipping_zip",
+    "shipping_country",
+    "shipping_phone_number"
+];
+var AUTH = ["nonce", "timestamp", "certificate_token", "signature"];
+var CARD_TYPES = /* @__PURE__ */ new Set([
+    "visa",
+    "master",
+    "american_express",
+    "diners_club",
+    "discover",
+    "jcb",
+    "maestro",
+    "maestro_no_luhn",
+    "elo",
+    "carnet",
+    "dankort",
+    "alelo",
+    "cabal",
+    "naranja",
+    "unionpay",
+    "alia",
+    "creditel",
+    "confiable",
+    "synchrony",
+    "routex",
+    "mada",
+    "passcard",
+    "edenred",
+    "anda",
+    "tarjeta_d",
+    "sodexo",
+    "sodexo_no_luhn",
+    "panal",
+    "verve",
+    "tuya",
+    "uatp",
+    "patagonia_365",
+    "tarjeta_sol",
+    "tarjeta_unica",
+    "consumax",
+    "tarjeta_fertil",
+    "favacard",
+    "elebar",
+    "tarjeta_axis",
+    "tarjeta_plan_platino",
+    "tarjeta_fiel",
+    "copeplus",
+    "tarjeta_credimas",
+    "tarjeta_local",
+    "tarjeta_sucredito",
+    "sidecreer",
+    "cliper",
+    "centrocard",
+    "wex",
+    "codensa"
+]);
+var panLike = (value) => /(?:[0-9][ _.:-]*){12,}/.test(value);
+var opaqueId = (value) => id(value) && /[A-Za-z]/.test(value) && !panLike(value);
+function readJson(body) {
+    if (typeof body !== "string" || !body || body.length > 65536)
+        return null;
+    let at = 0, nodes = 0;
+    const fail = () => {
+        throw new Error("invalid_spreedly_json");
+    };
+    const space = () => {
+        while (" 	\r\n".includes(body[at] ?? "\0"))
+            at++;
+    };
+    const string = () => {
+        space();
+        const start = at;
+        if (body[at++] !== '"')
+            fail();
+        while (at < body.length) {
+            const char = body[at++];
+            if (char === "\\") {
+                at++;
+                continue;
+            }
+            if (char === '"')
+                return JSON.parse(body.slice(start, at));
+        }
+        return fail();
+    };
+    const value = (depth) => {
+        if (depth > 12 || ++nodes > 1e3)
+            fail();
+        space();
+        const char = body[at];
+        if (char === '"')
+            return string();
+        if (char === "{") {
+            at++;
+            const result = /* @__PURE__ */ Object.create(null), seen = /* @__PURE__ */ new Set();
+            space();
+            if (body[at] === "}") {
+                at++;
+                return result;
+            }
+            while (true) {
+                const key = string();
+                if (seen.has(key) || ["__proto__", "prototype", "constructor"].includes(key))
+                    fail();
+                seen.add(key);
+                space();
+                if (body[at++] !== ":")
+                    fail();
+                result[key] = value(depth + 1);
+                space();
+                const next = body[at++];
+                if (next === "}")
+                    return result;
+                if (next !== ",")
+                    fail();
+            }
+        }
+        if (char === "[") {
+            at++;
+            const result = [];
+            space();
+            if (body[at] === "]") {
+                at++;
+                return result;
+            }
+            while (true) {
+                result.push(value(depth + 1));
+                space();
+                const next = body[at++];
+                if (next === "]")
+                    return result;
+                if (next !== ",")
+                    fail();
+            }
+        }
+        for (const literal of ["true", "false", "null"]) {
+            if (body.startsWith(literal, at)) {
+                at += literal.length;
+                return JSON.parse(literal);
+            }
+        }
+        const number = /^-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/.exec(body.slice(at));
+        if (!number)
+            fail();
+        at += number[0].length;
+        const parsed = Number(number[0]);
+        if (!Number.isFinite(parsed))
+            fail();
+        return parsed;
+    };
+    try {
+        const parsed = value(0);
+        space();
+        return at === body.length && record(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function isSpreedlyTokenRequest(url, method = "POST") {
+    if (method !== "POST" || typeof url !== "string" || !url.startsWith(SPREEDLY_TOKEN_ENDPOINT + "?"))
+        return false;
+    try {
+        const parsed = new URL(url);
+        if (parsed.href !== url || parsed.origin + parsed.pathname !== SPREEDLY_TOKEN_ENDPOINT || parsed.hash)
+            return false;
+        const seen = /* @__PURE__ */ new Set();
+        for (const pair of parsed.search.slice(1).split("&")) {
+            const separator = pair.indexOf("=");
+            const name = pair.slice(0, separator), value = pair.slice(separator + 1);
+            if (separator < 1 || seen.has(name))
+                return false;
+            seen.add(name);
+            if (name === "from" ? value !== "iframe" : name === "v" ? !exact(/^1\.[0-9]{1,4}$/, value) : name === "client" ? !exact(/^[A-Za-z0-9_.-]{1,64}$/, value) : true)
+                return false;
+        }
+        return seen.has("from") && seen.has("v");
+    }
+    catch {
+        return false;
+    }
+}
+function preparedBody(body) {
+    const value = readJson(body);
+    if (!keys(value, ["environment_key", "payment_method", ...AUTH]) || !id(value.environment_key) || !keys(value.payment_method, ["credit_card", "allow_blank_name", "allow_expired_date", "metadata"]))
+        return null;
+    const suppliedAuth = AUTH.filter((key) => owns(value, key));
+    if (suppliedAuth.length && (suppliedAuth.length !== AUTH.length || !text(value.nonce) || !value.nonce || !(digits(value.timestamp, 1, 16) || Number.isSafeInteger(value.timestamp) && value.timestamp > 0) || !id(value.certificate_token) || !exact(/^[A-Za-z0-9+/=_-]{1,8192}$/, value.signature)))
+        return null;
+    const pm = value.payment_method, cc = pm.credit_card;
+    if (!keys(cc, ["number", "verification_value", "month", "year", "eligible_for_card_updater", ...CARD_TEXT]) || !digits(cc.number, 12, 19) || !digits(cc.verification_value, 3, 4) || !month(cc.month) || !year(cc.year) || CARD_TEXT.some((key) => owns(cc, key) && !text(cc[key])) || owns(cc, "eligible_for_card_updater") && cc.eligible_for_card_updater !== false)
+        return null;
+    if (owns(pm, "allow_blank_name") && typeof pm.allow_blank_name !== "boolean" || owns(pm, "allow_expired_date") && pm.allow_expired_date !== false)
+        return null;
+    if (owns(pm, "metadata") && (!record(pm.metadata) || Object.keys(pm.metadata).length > 20 || Object.entries(pm.metadata).some(([key, value2]) => !exact(/^[A-Za-z][A-Za-z0-9_-]{0,63}$/, key) || !(value2 === null || typeof value2 === "boolean" || Number.isFinite(value2) || text(value2)))))
+        return null;
+    return value;
+}
+function isPreparedSpreedlyRequest(body) {
+    return preparedBody(body) !== null;
+}
+function isSpreedlyRequest(request) {
+    if (!record(request) || request.method !== "POST" || !isSpreedlyTokenRequest(request.url, request.method) || !record(request.headers))
+        return false;
+    const body = preparedBody(request.body);
+    if (!body)
+        return false;
+    const headers = /* @__PURE__ */ new Map();
+    for (const [name, value] of Object.entries(request.headers)) {
+        const lower = name.toLowerCase();
+        if (headers.has(lower) || !text(value, 8192))
+            return false;
+        headers.set(lower, value);
+    }
+    return exact(/^application\/json(?:;\s*charset=utf-8)?$/i, headers.get("content-type")) && headers.get("spreedly-environment-key") === body.environment_key;
+}
+function injectSpreedlyCard(body, card) {
+    const value = preparedBody(body);
+    if (!value)
+        throw new Error("Refusing to pay: unsupported Spreedly new-card request.");
+    if (!card || !digits(card.number, 12, 19) || !digits(card.cvc, 3, 4) || !month(card.month) || !year(card.year)) {
+        throw new Error("Could not fill the card fields for Spreedly. Nothing was sent.");
+    }
+    const cc = value.payment_method.credit_card;
+    cc.number = card.number;
+    cc.verification_value = card.cvc;
+    cc.month = typeof cc.month === "number" ? Number(card.month) : String(card.month);
+    const selectedYear = String(card.year), nativeYear = String(cc.year);
+    const replacementYear = nativeYear.length === 2 && selectedYear.length === 4 ? selectedYear.slice(-2) : nativeYear.length === 4 && selectedYear.length === 2 ? "20" + selectedYear : selectedYear;
+    cc.year = typeof cc.year === "number" ? Number(replacementYear) : replacementYear;
+    return { body: JSON.stringify(value), where: ["number", "verification_value", "month", "year"].map((key) => "payment_method.credit_card." + key) };
+}
+function sanitizeSpreedlyTokenResponse(body) {
+    const value = readJson(body), transaction = value?.transaction, pm = transaction?.payment_method;
+    const fail = () => {
+        throw new Error("Invalid Spreedly token response.");
+    };
+    if (!record(transaction) || !record(pm) || transaction.succeeded !== true || transaction.transaction_type !== "AddPaymentMethod" || transaction.state !== "succeeded" || pm.payment_method_type !== "credit_card" || !opaqueId(pm.token))
+        return fail();
+    if (!text(pm.number, 32) || !exact(/^[Xx*]{8,15}[0-9]{4}$/, pm.number.replace(/-/g, "")) || !digits(pm.last_four_digits, 4, 4) || !pm.number.endsWith(pm.last_four_digits) || !exact(/^[Xx*]{3,4}$/, pm.verification_value) || !month(pm.month) || !year(pm.year))
+        return fail();
+    const safePm = {
+        token: pm.token,
+        payment_method_type: "credit_card",
+        number: pm.number,
+        verification_value: pm.verification_value,
+        last_four_digits: pm.last_four_digits,
+        month: pm.month,
+        year: pm.year
+    };
+    if (owns(pm, "card_type")) {
+        if (!CARD_TYPES.has(pm.card_type))
+            return fail();
+        safePm.card_type = pm.card_type;
+    }
+    if (owns(pm, "storage_state")) {
+        if (!["cached", "retained"].includes(pm.storage_state))
+            return fail();
+        safePm.storage_state = pm.storage_state;
+    }
+    if (owns(pm, "fingerprint")) {
+        if (!opaqueId(pm.fingerprint))
+            return fail();
+        safePm.fingerprint = pm.fingerprint;
+    }
+    for (const [key, width] of [["first_six_digits", 6], ["first_eight_digits", 8]]) {
+        if (owns(pm, key) && pm[key] !== null) {
+            if (!digits(pm[key], width, width))
+                return fail();
+            safePm[key] = pm[key];
+        }
+    }
+    for (const key of ["test", "eligible_for_card_updater"]) {
+        if (owns(pm, key)) {
+            if (typeof pm[key] !== "boolean")
+                return fail();
+            safePm[key] = pm[key];
+        }
+    }
+    for (const key of CARD_TEXT) {
+        if (!owns(pm, key))
+            continue;
+        if (pm[key] !== null && (!text(pm[key]) || panLike(pm[key])))
+            return fail();
+        safePm[key] = pm[key];
+    }
+    if (owns(pm, "errors")) {
+        if (!Array.isArray(pm.errors) || pm.errors.length)
+            return fail();
+        safePm.errors = [];
+    }
+    const safeTransaction = { succeeded: true, transaction_type: "AddPaymentMethod", state: "succeeded", payment_method: safePm };
+    if (owns(transaction, "token")) {
+        if (!opaqueId(transaction.token))
+            return fail();
+        safeTransaction.token = transaction.token;
+    }
+    return JSON.stringify({ transaction: safeTransaction });
+}
+export { SPREEDLY_TOKEN_ENDPOINT, injectSpreedlyCard, isPreparedSpreedlyRequest, isSpreedlyRequest, isSpreedlyTokenRequest, sanitizeSpreedlyTokenResponse };

package/dist/stripe-checkout.generated.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 // Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: edd2d9de25c51bf0f4ebdbe729366e6d94b9a045b054a0910571e0565bd3cae0
+// artifact-sha256: 43d29486fe62b4f04eff7e737852d00589ab7fee366c25d863f25c2c0df54562
 // src/definitions.js
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -11,6 +11,14 @@ function deepFreeze(value) {
     return value;
 }
 var PROCESSOR_DEFINITIONS = deepFreeze([
+    {
+        psp: "spreedly",
+        // Native iframe new-card tokenization only; spreedly.js pins the query and body.
+        match: "core\\.spreedly\\.com/v1/payment_methods/restricted\\.json",
+        hosts: ["^core\\.spreedly\\.com$"],
+        encoding: "json",
+        passthroughHeaders: ["^spreedly-environment-key$"]
+    },
     {
         psp: "shopify",
         match: "(checkout\\.pci\\.shopifyinc\\.com|deposit\\.[a-z0-9-]+\\.shopifycs\\.com)/sessions",

package/examples/preflight/kernel-native/inventory.json

@@ -1,11 +1,20 @@
 {
   "schema_version": 1,
   "catalog_version": "2026-09-15.1",
-  "catalog_sha256": "34877ca68622f17b3e10963b17e6888bf15d8268015d1ae16def4ca5fbef73fd",
+  "catalog_sha256": "e1bbae82b91134c8be5919fddd5d60ea56f6897b570f8ccb2f305cd5b0a1c085",
   "baseline_version": "kernel-native-docs-2026-09-11.1",
   "baseline_sha256": "d86722f49633d8223fccae54cd3d485df4375aee06aa156a273cc689b7c8507c",
   "native_build": null,
   "processors": [
+    {
+      "psp": "spreedly",
+      "mode": "token",
+      "documentation": "not_documented",
+      "status": "unknown",
+      "limitations": [
+        "No adapter declaration was found in the pinned documentation. Native runtime evidence is missing."
+      ]
+    },
     {
       "psp": "shopify",
       "mode": "token",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-cards/checkout",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "Let browser agents pay with the user's own card, without your infrastructure ever touching card data.",
   "type": "module",
   "main": "dist/index.js",
@@ -28,7 +28,7 @@
     "build": "node ../payment-core/scripts/build.mjs && node scripts/generate-payment-core.mjs && npx -y -p typescript@5.9.3 tsc && node scripts/generate-preflight-contract.mjs",
     "prepublishOnly": "pnpm build",
     "test": "node test.mjs && node --test lifecycle.test.mjs merchant-abort.test.mjs preparation.test.mjs braintree.test.mjs autopilot.test.mjs stripe-checkout.test.mjs payment-core.test.mjs prepared-processor.test.mjs minimum-delay.test.mjs paysafe.test.mjs attachment.test.mjs mercado-checkout.test.mjs mercado-polling.test.mjs && node --test preflight-package.test.mjs preflight-collector.test.mjs && node --test kernel-native-qualification.test.mjs && node --test ../vault/scripts/recurly-validation/watch-duty-sdk-result.test.mjs",
-    "test:browser": "node browser.test.mjs && node stripe-browser.test.mjs && node preparation-browser.test.mjs && node owned-shop-browser.test.mjs",
+    "test:browser": "node browser.test.mjs && node stripe-browser.test.mjs && node preparation-browser.test.mjs && node owned-shop-browser.test.mjs && node spreedly-browser.test.mjs",
     "check:payment-core": "node scripts/generate-payment-core.mjs --check",
     "test:preflight": "node --test preflight-package.test.mjs preflight-collector.test.mjs kernel-native-qualification.test.mjs",
     "test:preflight:browser": "node preflight-browser.test.mjs",