@agent-cards/checkout 0.18.0 → 0.19.0

package/dist/fiserv.js

@@ -0,0 +1,104 @@
+/**
+ * Fiserv Commerce Hub card capture, as this SDK reads it.
+ *
+ * Every rule lives in the internal payment core (payment-core src/fiserv.js), vendored
+ * here as fiserv.generated.ts so the published package installs nothing else; the
+ * backend and the Vault load the same rules. That artifact is untyped JavaScript, so
+ * this module gives the adapters, the client and callers typed names for the parts the
+ * SDK uses, the way substitute.ts types the shared substitution. It adds no rule.
+ *
+ * The request is the Secure Data Capture frame's POST to Commerce Hub's card-capture
+ * endpoint. The frame encrypts the card the agent typed and posts the envelope as
+ * source.encryptionData; the cardholder's device builds the same envelope around the
+ * approved card under a key Agentcard pinned for the merchant, and the paused capture
+ * continues from the agent's browser with the envelope's four members swapped.
+ */
+import * as generated from './fiserv.generated.js';
+const core = generated;
+/** The card-capture endpoint per environment, exactly as the Secure Data Capture frame writes it. */
+export const FISERV_CARD_CAPTURE_ENDPOINTS = core.FISERV_CARD_CAPTURE_ENDPOINTS;
+const CAPTURE_HOSTS = new Set(Object.values(core.FISERV_CARD_CAPTURE_ENDPOINTS).map((endpoint) => new URL(endpoint).hostname));
+/**
+ * Whether `url` is on one of the two card-capture hosts (connect.fiservapis.com and
+ * connect-cert.fiservapis.com), whatever its path or query. The registry's Fiserv
+ * recognizer lists exactly these hosts, so a card request on one of them is Fiserv's.
+ */
+export function isFiservCaptureHost(url) {
+    try {
+        return CAPTURE_HOSTS.has(new URL(url).hostname);
+    }
+    catch {
+        return false;
+    }
+}
+/** The pinned key with this id, in either environment, or null. */
+export function fiservKeyPinById(id) {
+    return typeof id === 'string' ? core.FISERV_KEY_PINS.find((pin) => pin.id === id) ?? null : null;
+}
+/**
+ * The id of the pin a paused capture's card may be sealed under (its envelope's key,
+ * pinned for its endpoint's environment and for the merchant its body names), or null.
+ */
+export function fiservCapturePinId(url, body) {
+    return core.fiservCapturePin({ url, body })?.id ?? null;
+}
+/** The card-capture endpoint a Fiserv preparation names for its environment. */
+export function fiservPreparationUrl(environment) {
+    return core.fiservPreparationUrl(environment);
+}
+/**
+ * Whether the SDK pauses this capture body for the cardholder, or refuses it when no
+ * preparation is ready: every body except the captures that carry no Vault card.
+ * Fastlane (PaymentToken), ACH (PaymentCheck), gift and EBT captures share the endpoint
+ * and continue untouched, each only in its exact source shape. A body not proven
+ * card-free (one the adapter could not read, one over 64 KiB, one that is not JSON, a
+ * PaymentCard with a plaintext card, a non-card type or category that also carries a card
+ * member) is judged as a card capture, so the agent's placeholder never continues to
+ * Fiserv on it.
+ */
+export function isFiservPausableBody(body) {
+    return core.isFiservPausableBody(body);
+}
+/**
+ * Whether this build pays the request only through a prepared checkout because it is
+ * Fiserv's: a recognizer named fiserv, or a request on one of Fiserv's capture hosts.
+ * The served entry says so too (preparationRequired); this build carries Fiserv's own
+ * rules, so it requires the preparation whatever the served registry says, and a
+ * registry that dropped the flag never opens an ordinary Fiserv authorization.
+ */
+export function requiresFiservPreparation(psp, url) {
+    return psp === 'fiserv' || isFiservCaptureHost(url);
+}
+/**
+ * Whether a paused request is the capture a Fiserv preparation for `environment`
+ * consents to: that environment's endpoint exactly, the capture rules on the whole
+ * request, headers included, and an envelope under a key pinned for that environment
+ * and for the merchant the body names.
+ */
+export function isPreparedFiservRequest(url, method, body, environment, headers) {
+    return core.isPreparedFiservRequest(url, method, body, environment, headers);
+}
+/**
+ * Whether an approval's substitution is exactly Fiserv's envelope: `encoding` json,
+ * `at` source.encryptionData, the four members keyId, encryptedKey, encryptionBlock and
+ * aesIv in their exact shape under a pinned key, and nothing removed.
+ */
+export function isFiservSubstitution(sub) {
+    if (!sub || typeof sub !== 'object' || Array.isArray(sub))
+        return false;
+    const value = sub;
+    return Object.keys(value).every((name) => ['encoding', 'at', 'fields', 'remove'].includes(name))
+        && value.encoding === 'json' && value.at === core.FISERV_SUBSTITUTION.at
+        && (value.remove === undefined || (Array.isArray(value.remove) && value.remove.length === 0))
+        && core.fiservSubstitutionFieldsRefusal(value.fields) === null;
+}
+/**
+ * The paused Fiserv capture with the approval's envelope written over the four members
+ * its source.encryptionData already carries, and every other byte the frame's own. It
+ * throws, writing nothing, for a body that is not the capture Agentcard covers, for any
+ * substitution but Fiserv's envelope, and for an envelope under another key than the one
+ * the paused capture names. Run this on a Fiserv approval, never substituteEncryptedFields.
+ */
+export function substituteFiservEnvelope(body, sub) {
+    return core.substituteFiservEnvelope(body, sub);
+}

package/dist/index.d.ts

@@ -1,11 +1,16 @@
-export { VaultClient, CardEncryptedError, UnsupportedModeError, ApprovalTimeoutError, ApprovalDeclinedError, AmountMismatchError, PresetRefusedError, PRESET_REFUSAL_REASONS, IntentNotConfirmableError, ProcessorRefusedError, CheckoutApiError, redactUrl, SUPPORTED_MODES, PaymentOutcomeUnknownError, CheckoutCancelledError, CheckoutPreparationError, } from './client.js';
-export type { PausedRequest, ReplayResponse, TokenReplay, CseReplay, HostedFormReplay, AmountAuthority, AuthorizeInput, VaultClientOptions, PrepareCheckoutOptions, PrepareCheckoutInput, PreparedCheckout, RazorpayProcessorError, RuntimeCancelReason, ExecutionMetadata, } from './client.js';
+export { VaultClient, CardEncryptedError, UnsupportedModeError, PreparationRequiredError, ApprovalTimeoutError, ApprovalDeclinedError, AmountMismatchError, PresetRefusedError, PRESET_REFUSAL_REASONS, IntentNotConfirmableError, ProcessorRefusedError, CheckoutApiError, redactUrl, SUPPORTED_MODES, PaymentOutcomeUnknownError, CheckoutCancelledError, CheckoutPreparationError, AdyenTestPlatformRefusedError, MerchantTotalError, } from './client.js';
+export type { PausedRequest, ReplayResponse, TokenReplay, CseReplay, MerchantHostedReplay, HostedFormReplay, AmountAuthority, AuthorizeInput, VaultClientOptions, AdyenTestPlatformRefusal, MerchantTotalRefusal, PrepareCheckoutOptions, PrepareCheckoutInput, PreparedCheckout, RazorpayProcessorError, RuntimeCancelReason, ExecutionMetadata, } from './client.js';
 export { attachToCdp, attachToPlaywright, corsHeadersFor, corsDecision, withCorsHeaders } from './cdp.js';
 export { CheckoutAttachmentError } from './attachment.js';
 export type { CdpLike, AttachOptions, CorsOutcome } from './cdp.js';
 export type { StripeCheckoutOptions, StripeCheckoutBlockedDetail, StripeCheckoutBlockStage, StripeCheckoutBlockReason } from './stripe-checkout.js';
 export { substituteEncryptedFields, SubstitutionError } from './substitute.js';
 export type { Substitutions } from './substitute.js';
+export { classifyDeclaredMerchantRequest, classifyMerchantRequest, substituteMerchantHostedBody } from './merchant-hosted.js';
+export type { MerchantProfile, MerchantProfileStatus, MerchantRequestVerdict, MerchantHostedSubstitutions, MerchantHostedFact, JsonPathStep, SandboxMerchantDeclaration } from './merchant-hosted.js';
+export { MerchantExchangeLog, merchantAmountExchanges, merchantAmountFromResponses, merchantChargeReport, merchantProfilePricedBySource, merchantTotalAtRelease, MERCHANT_EXCHANGES_MAX, } from './merchant-total.js';
+export type { MerchantAmountCard, MerchantExchange, MerchantRequestSeen, MerchantTotalApproved, MerchantTotalCapture, MerchantTotalScope } from './merchant-total.js';
+export { substituteFiservEnvelope } from './fiserv.js';
 export { hostedFormSubmittedPage, HOSTED_FORM_SUBMITTED_OUTCOME } from './hosted-form.js';
 export type { HostedFormSubmittedPageInput, SyntheticPage } from './hosted-form.js';
 export { BUILTIN_REGISTRY, cardUrlPatterns, findRecognizer } from './registry.js';

package/dist/index.js

@@ -1,6 +1,10 @@
-export { VaultClient, CardEncryptedError, UnsupportedModeError, ApprovalTimeoutError, ApprovalDeclinedError, AmountMismatchError, PresetRefusedError, PRESET_REFUSAL_REASONS, IntentNotConfirmableError, ProcessorRefusedError, CheckoutApiError, redactUrl, SUPPORTED_MODES, PaymentOutcomeUnknownError, CheckoutCancelledError, CheckoutPreparationError, } from './client.js';
+export { VaultClient, CardEncryptedError, UnsupportedModeError, PreparationRequiredError, ApprovalTimeoutError, ApprovalDeclinedError, AmountMismatchError, PresetRefusedError, PRESET_REFUSAL_REASONS, IntentNotConfirmableError, ProcessorRefusedError, CheckoutApiError, redactUrl, SUPPORTED_MODES, PaymentOutcomeUnknownError, CheckoutCancelledError, CheckoutPreparationError, AdyenTestPlatformRefusedError, MerchantTotalError, } from './client.js';
 export { attachToCdp, attachToPlaywright, corsHeadersFor, corsDecision, withCorsHeaders } from './cdp.js';
 export { CheckoutAttachmentError } from './attachment.js';
 export { substituteEncryptedFields, SubstitutionError } from './substitute.js';
+export { classifyDeclaredMerchantRequest, classifyMerchantRequest, substituteMerchantHostedBody } from './merchant-hosted.js';
+// The merchant's own total for a raw CDP runtime that intercepts on its own (merchant-total.ts).
+export { MerchantExchangeLog, merchantAmountExchanges, merchantAmountFromResponses, merchantChargeReport, merchantProfilePricedBySource, merchantTotalAtRelease, MERCHANT_EXCHANGES_MAX, } from './merchant-total.js';
+export { substituteFiservEnvelope } from './fiserv.js';
 export { hostedFormSubmittedPage, HOSTED_FORM_SUBMITTED_OUTCOME } from './hosted-form.js';
 export { BUILTIN_REGISTRY, cardUrlPatterns, findRecognizer } from './registry.js';

package/dist/lifecycle.d.ts

@@ -124,7 +124,21 @@ export declare class CheckoutLifecycle implements CheckoutController {
      * is reported through failed() instead, which holds.
      */
     merchantNeverRetried(authorizationId: string | null): void;
-    unsupported(): void;
+    /**
+     * A card request this SDK cannot pay was aborted. `reason`: an unrecognized
+     * declared payment endpoint (the default), a merchant profile Agentcard has not
+     * turned on (merchant_profile_observe), or a card request the profile cannot
+     * finish (merchant_request_unsupported).
+     */
+    unsupported(reason?: 'unrecognized_payment_endpoint' | 'merchant_profile_observe' | 'merchant_request_unsupported'): void;
+    /**
+     * A card request that only a prepared checkout pays (an Adyen merchant
+     * profile's, or a Fiserv card capture) arrived with no preparation on this
+     * attachment and was aborted before any pause, prompt or authorization.
+     * Nothing is outstanding, so nothing is held; prepare() stays refused here, as
+     * after any first card request.
+     */
+    preparationRequired(): void;
     prepareHandoff(replay: ReplayResponse, requestUrl: string): void;
     /**
      * The approval a page's card-free Stripe confirmation may continue, or null.

package/dist/lifecycle.js

@@ -1,4 +1,4 @@
-import { ApprovalDeclinedError, ApprovalTimeoutError, CheckoutCancelledError, CheckoutPreparationError, IntentNotConfirmableError, PaymentOutcomeUnknownError, ProcessorRefusedError } from './client.js';
+import { AdyenTestPlatformRefusedError, ApprovalDeclinedError, ApprovalTimeoutError, CheckoutCancelledError, CheckoutPreparationError, IntentNotConfirmableError, PaymentOutcomeUnknownError, ProcessorRefusedError } from './client.js';
 import { parseOwnedShopReceipt, OWNED_SHOP_SKU, OWNED_SHOP_AMOUNT_CENTS, OWNED_SHOP_CURRENCY } from './owned-shop.generated.js';
 /** How many times one approval's card-free Stripe confirmation may be checked before it is simply held. */
 export const MAX_STRIPE_CONTINUATION_CHECKS = 3;
@@ -119,11 +119,29 @@ export class CheckoutLifecycle {
             return;
         this.set({ ...this.state, authorizationId, status: 'declined', reason: 'merchant_never_retried' });
     }
-    unsupported() {
+    /**
+     * A card request this SDK cannot pay was aborted. `reason`: an unrecognized
+     * declared payment endpoint (the default), a merchant profile Agentcard has not
+     * turned on (merchant_profile_observe), or a card request the profile cannot
+     * finish (merchant_request_unsupported).
+     */
+    unsupported(reason = 'unrecognized_payment_endpoint') {
         this.held = true;
         if (this.state.authorizationId)
             return; // do not hide an outstanding/completed payment behind a later unsupported request
-        this.set({ ...this.state, status: 'unsupported', reason: 'unrecognized_payment_endpoint' });
+        this.set({ ...this.state, status: 'unsupported', reason });
+    }
+    /**
+     * A card request that only a prepared checkout pays (an Adyen merchant
+     * profile's, or a Fiserv card capture) arrived with no preparation on this
+     * attachment and was aborted before any pause, prompt or authorization.
+     * Nothing is outstanding, so nothing is held; prepare() stays refused here, as
+     * after any first card request.
+     */
+    preparationRequired() {
+        if (this.cancelled || this.state.authorizationId)
+            return;
+        this.set({ ...this.state, status: 'failed', reason: 'preparation_required' });
     }
     prepareHandoff(replay, requestUrl) {
         if (replay.mode === 'token' && replay.executionMode === 'autopilot' && replay.shopOrderId) {
@@ -245,6 +263,13 @@ export class CheckoutLifecycle {
             this.held = true;
             this.set({ ...this.state, authorizationId, status: 'declined', reason: 'processor_refused' });
         }
+        else if (error instanceof AdyenTestPlatformRefusedError) {
+            // Agentcard's own rule, not a person's answer: refused at create before
+            // anyone was asked, the checkout failed as it did before the error was
+            // typed; declined before the card was sent, the authorization is declined.
+            // Either way the reason names the rule.
+            this.set({ ...this.state, status: error.stage === 'create' ? 'failed' : 'declined', reason: error.code });
+        }
         else if (error instanceof ApprovalDeclinedError) {
             this.set({ ...this.state, status: 'declined', reason: 'approval_declined' });
         }

package/dist/merchant-handoff.d.ts

@@ -0,0 +1,54 @@
+import type { CheckoutLifecycle } from './lifecycle.js';
+/** onEvent is ordinary integrator telemetry; the shape matches AttachOptions.onEvent. */
+type HandoffEvent = {
+    type: string;
+    detail?: unknown;
+};
+/**
+ * A merchant-hosted card request after hand-off, shared by the CDP and
+ * Playwright adapters so both read it the same way.
+ *
+ * The browser continued the merchant's own request with the Vault's ciphertext in
+ * it; the merchant's server now charges the card through Adyen and answers its own
+ * page. Nothing Agentcard holds says whether it did. Two things after hand-off are
+ * therefore an unknown outcome, never a failure to retry:
+ *   - the continued request answers 5xx or fails in the network: the merchant may
+ *     have charged the card, and its page may never learn that it did;
+ *   - the page sends the card request again before an answer arrived (Dick's
+ *     retries on a network error or a 500, ATG on anything not OK): its retry
+ *     carries the agent's dummy card, and the approval is spent.
+ * Either reports `payment_outcome_unknown` once and holds the checkout until the
+ * application reconciles the merchant order. Every card request to the same
+ * profile after hand-off is aborted, answered or not: a prepared approval is
+ * single use.
+ *
+ * Which of the two it reports follows the order the page saw them in. A page that
+ * retries because the merchant answered 5xx read that answer first, but an
+ * adapter can read the retry first (Chrome pauses a request in the browser
+ * process, ahead of the renderer's report of the answer), so retried() judges
+ * a retry once the adapter has read what the page reported before sending it.
+ */
+export declare class MerchantHandoffWatch {
+    private readonly lifecycle;
+    private readonly onEvent?;
+    private handoff;
+    private answered;
+    private reported;
+    constructor(lifecycle: CheckoutLifecycle, onEvent?: ((event: HandoffEvent) => void) | undefined);
+    /** Record a hand-off before its continue is sent, so an answer that races the command is still read. */
+    begin(profile: string, authorizationId: string, url: string): void;
+    /** The continued request's response arrived with this status. */
+    responded(status: number): void;
+    /** The continued request failed before any response arrived. */
+    failed(): void;
+    /**
+     * The page sent a card request to a profile. True when it is the profile a
+     * hand-off already went to: the caller aborts it at once. A retry sent before
+     * any answer reached the page also reports the unknown outcome. When the
+     * adapter must first read more of what the page reported before it sent this
+     * retry, `inPageOrder` keeps `judge`, calls it once it has, and returns true.
+     */
+    retried(profile: string, inPageOrder?: (judge: () => void) => boolean): boolean;
+    private unknown;
+}
+export {};

package/dist/merchant-handoff.js

@@ -0,0 +1,100 @@
+import { PaymentOutcomeUnknownError } from './client.js';
+/**
+ * A merchant-hosted card request after hand-off, shared by the CDP and
+ * Playwright adapters so both read it the same way.
+ *
+ * The browser continued the merchant's own request with the Vault's ciphertext in
+ * it; the merchant's server now charges the card through Adyen and answers its own
+ * page. Nothing Agentcard holds says whether it did. Two things after hand-off are
+ * therefore an unknown outcome, never a failure to retry:
+ *   - the continued request answers 5xx or fails in the network: the merchant may
+ *     have charged the card, and its page may never learn that it did;
+ *   - the page sends the card request again before an answer arrived (Dick's
+ *     retries on a network error or a 500, ATG on anything not OK): its retry
+ *     carries the agent's dummy card, and the approval is spent.
+ * Either reports `payment_outcome_unknown` once and holds the checkout until the
+ * application reconciles the merchant order. Every card request to the same
+ * profile after hand-off is aborted, answered or not: a prepared approval is
+ * single use.
+ *
+ * Which of the two it reports follows the order the page saw them in. A page that
+ * retries because the merchant answered 5xx read that answer first, but an
+ * adapter can read the retry first (Chrome pauses a request in the browser
+ * process, ahead of the renderer's report of the answer), so retried() judges
+ * a retry once the adapter has read what the page reported before sending it.
+ */
+export class MerchantHandoffWatch {
+    lifecycle;
+    onEvent;
+    handoff = null;
+    answered = false;
+    reported = false;
+    constructor(lifecycle, onEvent) {
+        this.lifecycle = lifecycle;
+        this.onEvent = onEvent;
+    }
+    /** Record a hand-off before its continue is sent, so an answer that races the command is still read. */
+    begin(profile, authorizationId, url) {
+        this.handoff = { profile, authorizationId, url };
+        this.answered = false;
+        this.reported = false;
+    }
+    /** The continued request's response arrived with this status. */
+    responded(status) {
+        if (!this.handoff || this.answered)
+            return;
+        this.answered = true;
+        if (Number.isInteger(status) && status >= 500)
+            this.unknown('merchant_server_error', { status });
+    }
+    /** The continued request failed before any response arrived. */
+    failed() {
+        if (!this.handoff || this.answered)
+            return;
+        this.answered = true;
+        this.unknown('merchant_request_failed');
+    }
+    /**
+     * The page sent a card request to a profile. True when it is the profile a
+     * hand-off already went to: the caller aborts it at once. A retry sent before
+     * any answer reached the page also reports the unknown outcome. When the
+     * adapter must first read more of what the page reported before it sent this
+     * retry, `inPageOrder` keeps `judge`, calls it once it has, and returns true.
+     */
+    retried(profile, inPageOrder) {
+        const handoff = this.handoff;
+        if (!handoff || handoff.profile !== profile)
+            return false;
+        let judged = false;
+        const judge = () => {
+            if (judged)
+                return;
+            judged = true;
+            if (this.handoff === handoff && !this.answered)
+                this.unknown('merchant_retried_after_handoff');
+            this.onEvent?.({ type: 'blocked', detail: 'merchant_retried_after_handoff' });
+        };
+        let waiting = false;
+        // An order the adapter cannot establish is judged on what it has read.
+        try {
+            waiting = !this.answered && inPageOrder?.(judge) === true;
+        }
+        catch {
+            waiting = false;
+        }
+        if (!waiting)
+            judge();
+        return true;
+    }
+    unknown(reason, extra = {}) {
+        if (!this.handoff || this.reported)
+            return;
+        // A result the application already confirmed with the merchant stands.
+        if (this.lifecycle.getState().status === 'completed')
+            return;
+        this.reported = true;
+        const { authorizationId, profile, url } = this.handoff;
+        this.lifecycle.failed(new PaymentOutcomeUnknownError(authorizationId, reason), true);
+        this.onEvent?.({ type: 'payment_outcome_unknown', detail: { authorizationId, reason, profile, url, ...extra } });
+    }
+}

package/dist/merchant-hosted.d.ts

@@ -0,0 +1,140 @@
+/** 'observe': paused, reported and aborted, never paid. 'enabled': a prepared checkout may pay it. */
+export type MerchantProfileStatus = 'observe' | 'enabled';
+/**
+ * A test-mode checkout against your own Adyen TEST account: your own server's
+ * card endpoint (an exact HTTPS URL), taking a card request shaped like a reviewed
+ * profile's, encrypted under your own Adyen TEST client key (test_...). The API
+ * accepts one only from a test-mode client of an org Agentcard turned declarations
+ * on for, reads the key's public key from Adyen's TEST platform itself, and the
+ * Vault encrypts only Adyen's documented test cards under it.
+ */
+export interface SandboxMerchantDeclaration {
+    /** The reviewed profile whose card request your endpoint takes (its body rules, holder and fields). */
+    profile: string;
+    /** Your endpoint: HTTPS, written exactly as the browser sends it, no port, credentials or fragment. */
+    endpoint: string;
+    /** Your Adyen TEST client key (test_ followed by 32 letters and digits). */
+    clientKey: string;
+}
+/** A reviewed merchant profile this client arms: its id, the merchant it names, and its effective status. */
+export interface MerchantProfile {
+    readonly id: string;
+    readonly merchant: string;
+    readonly status: MerchantProfileStatus;
+    /** Present when this client armed the profile's shape at its own declared test endpoint (declareSandboxMerchant). */
+    readonly sandboxDeclaration?: Readonly<Pick<SandboxMerchantDeclaration, 'endpoint' | 'clientKey'>>;
+}
+/** A profile's verdict on a paused request; see classifyMerchantRequest. */
+export type MerchantRequestVerdict = {
+    verdict: 'pause';
+} | {
+    verdict: 'abort';
+    reason: string;
+} | {
+    verdict: 'pass';
+};
+/** One step of a JSON path: an object key, or an index into an array. */
+export type JsonPathStep = string | number;
+/** A card fact the API asks to write beside the ciphertext (reserved: no profile declares one yet). */
+export interface MerchantHostedFact {
+    path: JsonPathStep[];
+    value: string;
+}
+/**
+ * Where a merchant-hosted approval's ciphertext goes: the profile's holder path
+ * (`[]` is the body root), the merchant's names for Adyen's four fields, and the
+ * keys at the holder to drop with the swap (adyen-web's `brand`, derived from the
+ * agent's dummy digits). payment-core's substituteMerchantHosted refuses anything
+ * but exactly the profile's own values.
+ */
+export interface MerchantHostedSubstitutions {
+    encoding: 'json';
+    kind: 'merchant_hosted';
+    profile: string;
+    path: JsonPathStep[];
+    fields: Record<string, string>;
+    remove: string[];
+    /** Card facts to write after the swap. No profile declares any yet, and the substitution refuses them. */
+    set?: MerchantHostedFact[];
+}
+/**
+ * The profile's verdict on a paused request: pause (its reviewed card request),
+ * abort (encrypted card data it cannot finish, with the reason) or pass (no
+ * encrypted card data, or not its endpoint or a sibling of it). Reads only;
+ * throws for a profile id this build did not review.
+ */
+export declare const classifyMerchantRequest: (profileId: string, url: string, method: string, body: string | null | undefined) => MerchantRequestVerdict;
+/** The endpoint origin, the path TEMPLATE and the profile's own query: what an event may name. */
+export declare const merchantProfileTemplatedUrl: (profileId: string, url: string) => string;
+/** SHA-256 of a JSON body's sorted key paths, no value in it; null for a body that is not JSON. */
+export declare const merchantBodyKeyPathSha256: (body: string) => string | null;
+/** 'sandbox' for a profile on Adyen's TEST platform, 'production' for every live environment. */
+export declare const merchantProfileEnvironment: (profileId: string) => 'production' | 'sandbox';
+/** classifyMerchantRequest for a sandbox declaration: the profile's body rules at the declared endpoint instead of the profile's. */
+export declare const classifyDeclaredMerchantRequest: (profileId: string, endpoint: string, url: string, method: string, body: string | null | undefined) => MerchantRequestVerdict;
+/**
+ * The profiles this client arms: every profile this build reviewed, once each, in
+ * this build's order. A served entry is `{ merchant_profile: <the profile's wire
+ * projection> }`, and the first one that names a profile with exactly this build's
+ * rules (endpoint, body rules, holder, fields, key: everything but `status`) and a
+ * status this build knows decides it: 'enabled' only when both that entry and this
+ * build say so. Every other profile stays in 'observe': one the API did not serve (no
+ * sync yet, a failed sync, an API that predates profiles) and one the API reviewed
+ * again after this build was cut, which this build cannot pay. In 'observe' its card
+ * request is still paused and aborted, so the agent's dummy card never reaches a
+ * reviewed merchant, whatever the API answered.
+ */
+export declare function armServedProfiles(entries?: readonly unknown[]): MerchantProfile[];
+/**
+ * Arms a sandbox declaration: the reviewed profile's card request at your own
+ * endpoint, under your own Adyen TEST key. Throws a TypeError for a profile this
+ * build did not review, an endpoint the API would refuse, or a key that is not a
+ * test_ key. The endpoint rule is the API's own (payment-core sandboxDeclarationRefusal):
+ * an HTTPS URL in the exact form the browser writes it (no port, credentials or
+ * fragment), on a public domain name outside Adyen's domains, Agentcard's and every
+ * reviewed merchant's domain (declaredEndpointRefusal), and on no host this build's
+ * processor registry names. The armed entry names its host as the merchant, and is
+ * 'enabled' whatever the reviewed profile's status: it never pays the reviewed
+ * merchant, the API refuses it from a live client and from an org it has not turned
+ * declarations on for, and the Vault encrypts only Adyen's documented test cards
+ * under a test_ key.
+ */
+export declare function declareSandboxMerchant(input: SandboxMerchantDeclaration): MerchantProfile;
+/** The armed profile whose endpoint, or a sibling of it (same origin and path shape), a URL is; null for any other URL. */
+export declare function merchantProfileFor(profiles: readonly MerchantProfile[], url: string): MerchantProfile | null;
+/** The Fetch.enable globs that pause every armed profile's endpoint and its siblings, a declared endpoint included. */
+export declare function merchantProfileUrlPatterns(profiles: readonly MerchantProfile[]): string[];
+/** classifyMerchantRequest for an armed profile: at its declared endpoint when it has one. */
+export declare function classifyProfileRequest(profile: MerchantProfile, url: string, method: string, body: string | null | undefined): MerchantRequestVerdict;
+/** merchantProfileTemplatedUrl for an armed profile: a declared endpoint's origin and path, never its query. */
+export declare function profileTemplatedUrl(profile: MerchantProfile, url: string): string;
+/**
+ * The Fetch.enable globs for every profile this build reviewed. Every one of them is
+ * armed from the start (armServedProfiles), so attachToCdp arms all of them at attach
+ * and a syncRegistry() before or after it changes only a profile's status: its card
+ * request is paused and judged under CDP exactly as attachToPlaywright's per-request
+ * route judges it.
+ */
+export declare function reviewedMerchantProfileUrlPatterns(): string[];
+/**
+ * The continuation of a merchant-hosted approval: the live paused body with the
+ * Vault's ciphertext in place of the dummy fields. The API never sees the body the
+ * browser continues, so the live body must first hash to the one the API checked
+ * when the authorization was created (`bodySha256`); a page that rewrote its body
+ * while the cardholder decided is refused rather than paid. payment-core's
+ * substituteMerchantHosted then reads the profile's body rules again on the live
+ * body, writes only the profile's four fields, and refuses a profile that is not
+ * enabled, unless this client armed the endpoint from its own sandbox declaration
+ * (the replay carries `sandboxDeclaration`), where every body rule still applies.
+ * Throws SubstitutionError; nothing leaves the browser when it does.
+ */
+export declare function substituteMerchantHostedBody(body: string, replay: {
+    substitutions: MerchantHostedSubstitutions;
+    bodySha256: string;
+    sandboxDeclaration?: MerchantProfile['sandboxDeclaration'];
+}): string;
+/** The URL an event names for a merchant-hosted replay's request: its declared endpoint's origin and path, or the profile's template. */
+export declare function replayTemplatedUrl(replay: {
+    profile: string;
+    sandboxDeclaration?: MerchantProfile['sandboxDeclaration'];
+}, url: string): string;