@agent-cards/checkout 0.18.0 → 0.21.0

package/dist/mercado-checkout.js

@@ -1,108 +0,0 @@
-import { captureMercadoCheckoutContext, createMercadoAssociationGate, isMercadoTokenRequest, MERCADO_CONFIGURATION_URL, MERCADO_CHECKOUT_ORIGIN, parseMercadoCheckoutContext } from './mercado-checkout.generated.js';
-/** Capture only the native Checkout Pro configuration. A late configuration,
- * navigation or repeated token cannot replace the context of an issued token.
- * Final payment requests retain the attachment's existing payment guards.
- */
-export class MercadoCheckoutGate {
-    context = null;
-    started = false;
-    stopped = false;
-    sequence = 0;
-    associatedFlow = null;
-    association = null;
-    matches(url) {
-        try {
-            const parsed = new URL(url);
-            return parsed.origin === MERCADO_CHECKOUT_ORIGIN
-                && (parsed.pathname === new URL(MERCADO_CONFIGURATION_URL).pathname || parsed.pathname.startsWith('/checkout/v1/payment/api/flow/'));
-        }
-        catch {
-            return false;
-        }
-    }
-    requiresDocument(url, method) {
-        try {
-            const parsed = new URL(url);
-            return method.toUpperCase() === 'POST'
-                && parsed.origin === 'https://api.mercadopago.com' && /^\/v1\/card_tokens$/i.test(parsed.pathname);
-        }
-        catch {
-            return false;
-        }
-    }
-    invalidate() {
-        if (!this.context && !this.started && this.sequence === 0)
-            return;
-        this.stopped = true;
-        this.context = null;
-        this.association = null;
-        this.sequence++;
-    }
-    async configuration(url, method, body, readDocument) {
-        if (url !== MERCADO_CONFIGURATION_URL || method !== 'POST')
-            return false;
-        if (this.started || this.stopped)
-            throw new Error('mercado_checkout_configuration_changed');
-        const sequence = ++this.sequence;
-        this.context = null;
-        const documentUrl = await readDocument();
-        // A newer native BIN lookup owns the context; the older harmless lookup
-        // still continues, but cannot erase or invalidate that newer capture.
-        if (sequence !== this.sequence && !this.stopped)
-            return true;
-        const context = captureMercadoCheckoutContext(url, method, body, documentUrl);
-        if (sequence !== this.sequence || this.started || this.stopped)
-            throw new Error('mercado_checkout_configuration_changed');
-        this.context = context;
-        return true;
-    }
-    claimToken(url, method, documentUrl) {
-        if (!this.requiresDocument(url, method))
-            return undefined;
-        // Other Mercado products remain on their existing tokenization path.
-        if (!documentUrl.startsWith(MERCADO_CHECKOUT_ORIGIN + '/checkout/'))
-            return undefined;
-        if (!isMercadoTokenRequest(url, method) || this.started || this.stopped || !this.context || this.context.documentUrl !== documentUrl)
-            throw new Error('mercado_checkout_configuration_unavailable');
-        this.started = true;
-        return parseMercadoCheckoutContext(this.context);
-    }
-    async arm(replay, tokenUrl) {
-        if (!this.started)
-            return;
-        if (this.stopped || !this.context || replay.mode !== 'token' || replay.status !== 201 || !replay.processorContext)
-            throw new Error('mercado_checkout_metadata_unavailable');
-        const context = this.context;
-        const association = await createMercadoAssociationGate({ context, tokenUrl, tokenBody: replay.body, processorContext: replay.processorContext });
-        if (this.stopped || this.context !== context)
-            throw new Error('mercado_checkout_context_changed');
-        this.association = association;
-    }
-    associationBody(url, method, body, documentUrl) {
-        if (['GET', 'HEAD', 'OPTIONS'].includes(method) || !this.matches(url) || url === MERCADO_CONFIGURATION_URL)
-            return undefined;
-        let parsed;
-        try {
-            parsed = JSON.parse(body);
-        }
-        catch {
-            if (this.started)
-                throw new Error('mercado_checkout_association_invalid');
-            return undefined;
-        }
-        // The observed Pay request keeps the existing payment guards, including
-        // after the native document navigates to review. Every card association
-        // must use the checked shape; changing prev_step cannot bypass correction.
-        const cardAssociation = parsed?.id === 'next_step' || parsed?.prev_step === 'card_form'
-            || (parsed?.values && ('card_token' in parsed.values || 'payment_method' in parsed.values));
-        if (!cardAssociation && parsed?.id === 'pay' && parsed?.prev_step === 'review' && this.associatedFlow === url)
-            return undefined;
-        if (!cardAssociation && !this.started)
-            return undefined;
-        if (!this.started || this.stopped || !this.association)
-            throw new Error('mercado_checkout_association_unavailable');
-        const corrected = this.association.take({ url, method, body, documentUrl });
-        this.associatedFlow = url;
-        return corrected;
-    }
-}

package/dist/owned-shop.generated.d.ts

@@ -1,24 +0,0 @@
-declare var OWNED_SHOP_OPERATION: string;
-declare var OWNED_SHOP_SKU: string;
-declare var OWNED_SHOP_AMOUNT_CENTS: number;
-declare var OWNED_SHOP_CURRENCY: string;
-declare var OWNED_SHOP_ORDER_FIELD: string;
-declare function isOwnedShopPaymentIntentId(value: any): boolean;
-declare function serializeOwnedShopOrder(value: any): string;
-declare function hasOwnedShopMarker(request: any): any;
-declare function parseOwnedShopOrder(request: any): {
-    order_id: any;
-    sku: string;
-    amount: number;
-    currency: string;
-} | null;
-declare function parseOwnedShopReceipt(value: any, expectedOrder: any): {
-    object: string;
-    order_id: any;
-    payment_intent_id: any;
-    status: string;
-    amount: number;
-    currency: string;
-    livemode: boolean;
-} | null;
-export { OWNED_SHOP_AMOUNT_CENTS, OWNED_SHOP_CURRENCY, OWNED_SHOP_OPERATION, OWNED_SHOP_ORDER_FIELD, OWNED_SHOP_SKU, hasOwnedShopMarker, isOwnedShopPaymentIntentId, parseOwnedShopOrder, parseOwnedShopReceipt, serializeOwnedShopOrder };

package/dist/owned-shop.generated.js

@@ -1,108 +0,0 @@
-// @ts-nocheck
-// Generated from @agent-cards/payment-core. Do not edit.
-// artifact-sha256: c8cfb844f3de3f156ee741a0167256d2e764ddfb7d243ce813e011761d3b711a
-// src/owned-shop.js
-var OWNED_SHOP_OPERATION = "stripe.owned_shop_token_to_payment_intent.v1";
-var OWNED_SHOP_SKU = "autopilot-pilot-100";
-var OWNED_SHOP_AMOUNT_CENTS = 100;
-var OWNED_SHOP_CURRENCY = "usd";
-var OWNED_SHOP_ORDER_FIELD = "agentcard_shop_order";
-var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}(?![\s\S])/;
-var INTENT = /^pi_[A-Za-z0-9]{1,200}(?![\s\S])/;
-var refuse = () => {
-    throw new Error("stripe_owned_shop_refused");
-};
-var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
-var keys = (value, allowed) => record(value) && Object.keys(value).length === allowed.length && Object.keys(value).every((key) => allowed.includes(key));
-function isOwnedShopPaymentIntentId(value) {
-    return typeof value === "string" && INTENT.test(value);
-}
-function order(value) {
-    if (!keys(value, ["order_id", "sku", "amount", "currency"]) || typeof value.order_id !== "string" || !UUID.test(value.order_id) || value.sku !== OWNED_SHOP_SKU || value.amount !== OWNED_SHOP_AMOUNT_CENTS || value.currency !== OWNED_SHOP_CURRENCY)
-        refuse();
-    return {
-        order_id: value.order_id,
-        sku: OWNED_SHOP_SKU,
-        amount: OWNED_SHOP_AMOUNT_CENTS,
-        currency: OWNED_SHOP_CURRENCY
-    };
-}
-function serializeOwnedShopOrder(value) {
-    return JSON.stringify(order(value));
-}
-function hasOwnedShopMarker(request) {
-    if (typeof request?.body !== "string")
-        return false;
-    return request.body.split("&").some((part) => {
-        const raw = part.split("=", 1)[0];
-        const loose = raw.replace(/\+/g, " ").replace(/%([0-9a-f]{2})/gi, (_, hex) => String.fromCharCode(parseInt(hex, 16)));
-        return loose.toLowerCase().includes(OWNED_SHOP_ORDER_FIELD);
-    });
-}
-function form(body) {
-    if (typeof body !== "string" || !body || body.length > 16384 || /[^\x21-\x7e]/.test(body))
-        refuse();
-    const chunks = body.split("&");
-    if (chunks.length > 16)
-        refuse();
-    const entries = /* @__PURE__ */ new Map();
-    const seen = /* @__PURE__ */ new Set();
-    for (const chunk of chunks) {
-        const eq = chunk.indexOf("=");
-        if (eq < 1)
-            refuse();
-        let key, value;
-        try {
-            key = decodeURIComponent(chunk.slice(0, eq).replace(/\+/g, " "));
-            value = decodeURIComponent(chunk.slice(eq + 1).replace(/\+/g, " "));
-        }
-        catch {
-            refuse();
-        }
-        if (seen.has(key.toLowerCase()) || value.length > 2048 || /[\x00-\x1f\x7f]/.test(key + value))
-            refuse();
-        seen.add(key.toLowerCase());
-        entries.set(key, value);
-    }
-    return entries;
-}
-function parseOwnedShopOrder(request) {
-    if (!hasOwnedShopMarker(request))
-        return null;
-    const entries = form(request.body);
-    if (!entries.has(OWNED_SHOP_ORDER_FIELD) || [...entries.keys()].some((key) => key !== OWNED_SHOP_ORDER_FIELD && key.toLowerCase().includes(OWNED_SHOP_ORDER_FIELD)))
-        refuse();
-    const encoded = entries.get(OWNED_SHOP_ORDER_FIELD);
-    let parsed;
-    try {
-        parsed = JSON.parse(encoded);
-    }
-    catch {
-        refuse();
-    }
-    const result = order(parsed);
-    if (serializeOwnedShopOrder(result) !== encoded)
-        refuse();
-    return result;
-}
-function parseOwnedShopReceipt(value, expectedOrder) {
-    let boundOrder;
-    try {
-        boundOrder = order(expectedOrder);
-    }
-    catch {
-        return null;
-    }
-    if (!keys(value, ["object", "order_id", "payment_intent_id", "status", "amount", "currency", "livemode"]) || value.object !== "agentcard_shop_receipt" || value.order_id !== boundOrder.order_id || !isOwnedShopPaymentIntentId(value.payment_intent_id) || value.status !== "succeeded" || value.amount !== OWNED_SHOP_AMOUNT_CENTS || value.currency !== OWNED_SHOP_CURRENCY || value.livemode !== false)
-        return null;
-    return {
-        object: "agentcard_shop_receipt",
-        order_id: boundOrder.order_id,
-        payment_intent_id: value.payment_intent_id,
-        status: "succeeded",
-        amount: OWNED_SHOP_AMOUNT_CENTS,
-        currency: OWNED_SHOP_CURRENCY,
-        livemode: false
-    };
-}
-export { OWNED_SHOP_AMOUNT_CENTS, OWNED_SHOP_CURRENCY, OWNED_SHOP_OPERATION, OWNED_SHOP_ORDER_FIELD, OWNED_SHOP_SKU, hasOwnedShopMarker, isOwnedShopPaymentIntentId, parseOwnedShopOrder, parseOwnedShopReceipt, serializeOwnedShopOrder };

package/dist/paysafe.generated.d.ts

@@ -1,12 +0,0 @@
-export type PaysafePreparationEnvironment = 'production' | 'sandbox';
-export declare function paysafePreparationUrl(environment: string): string;
-/** Exact strings refuse credentials, queries, fragments and URL normalization. */
-export declare function paysafeEnvironment(url: string): PaysafePreparationEnvironment | undefined;
-/** Checkout 1.8.0 starts a 40-second XHR when Pay is pressed. Prior approval may
- * consume only its new-card request, including native clientInfo and headers.
- * Saved cards, alternate APIs and 3DS-only requests require separate review.
- * Source: hosted.paysafe.com/checkout/1.8.0/main.bundle.js, SHA-256
- * e9e111ff03073cc936a47674e8e7c5db4a6d1050e1b65bf5e20723116fd5080c.
- * The guard checks original bytes and never changes the request.
- */
-export declare function isPreparedPaysafeRequest(url: string, method: string, body: string | null, environment: string, headers?: Record<string, string>): boolean;

package/dist/paysafe.generated.js

@@ -1,87 +0,0 @@
-// Generated from @agent-cards/payment-core. Do not edit.
-// source-sha256: 24c7940ae8974c0d24e5a365144c1b07ccc46863ae3094eb92b3c54c8307e837
-import { readTokenizationJson } from './braintree.js';
-const ENDPOINTS = {
-    production: 'https://hosted.paysafe.com/checkout/api/v1/tokenize',
-    sandbox: 'https://hosted.test.paysafe.com/checkout/api/v1/tokenize',
-};
-const record = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
-const keys = (value, allowed) => record(value) && Object.keys(value).every(key => allowed.includes(key));
-const exact = (pattern, value) => typeof value === 'string' && pattern.exec(value)?.[0] === value;
-const text = (value, max = 1024) => typeof value === 'string' && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
-const own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
-const uuid = (value) => exact(/^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/i, value);
-export function paysafePreparationUrl(environment) {
-    if (environment !== 'production' && environment !== 'sandbox')
-        throw new Error('unsupported_preparation_environment');
-    return ENDPOINTS[environment];
-}
-/** Exact strings refuse credentials, queries, fragments and URL normalization. */
-export function paysafeEnvironment(url) {
-    return url === ENDPOINTS.production ? 'production' : url === ENDPOINTS.sandbox ? 'sandbox' : undefined;
-}
-const ADDRESS_FIELDS = ['city', 'country', 'zip', 'street', 'street2', 'state'];
-function billing(value) {
-    return keys(value, ADDRESS_FIELDS) && Object.values(value).every(value => text(value))
-        && (!own(value, 'country') || exact(/^[A-Z]{2}$/, value.country));
-}
-function freshCard(value) {
-    if (!keys(value, ['card', 'clientInfo', 'billingAddress']) || !keys(value.card, ['cardNum', 'cardExpiry', 'cvv', 'holderName']))
-        return false;
-    const card = value.card;
-    if (!exact(/^[0-9]{12,19}$/, card.cardNum) || !exact(/^[0-9]{3,4}$/, card.cvv)
-        || !keys(card.cardExpiry, ['month', 'year']) || !exact(/^(?:0[1-9]|1[0-2])$/, card.cardExpiry.month)
-        || !exact(/^20[0-9]{2}$/, card.cardExpiry.year) || own(card, 'holderName') && !text(card.holderName)
-        || own(value, 'billingAddress') && !billing(value.billingAddress))
-        return false;
-    const info = value.clientInfo;
-    return keys(info, ['correlationId', 'invocationId', 'version', 'appName'])
-        && uuid(info.correlationId) && uuid(info.invocationId) && info.version === '1.8.0' && info.appName === 'paysafe.checkout';
-}
-const BROWSER_HEADERS = new Set(['accept', 'accept-language', 'accept-encoding', 'content-length', 'origin', 'referer',
-    'user-agent', 'host', 'connection', 'cache-control', 'pragma', 'priority', 'dnt',
-    'sec-fetch-dest', 'sec-fetch-mode', 'sec-fetch-site', 'sec-fetch-user']);
-function singleUseCredential(value) {
-    if (!exact(/^Basic [A-Za-z0-9+/]+={0,2}$/, value) || value.length > 1024)
-        return false;
-    try {
-        const encoded = value.slice(6), decoded = atob(encoded);
-        // Checkout receives public OT credentials, never merchant API credentials.
-        return btoa(decoded) === encoded && exact(/^OT-[0-9]{1,20}:[!-~]{1,512}$/, decoded);
-    }
-    catch {
-        return false;
-    }
-}
-function nativeHeaders(headers, correlationId) {
-    if (!record(headers))
-        return false;
-    const parsed = new Map();
-    let bytes = 0;
-    for (const [name, value] of Object.entries(headers)) {
-        const lower = name.toLowerCase();
-        if (parsed.size >= 64 || parsed.has(lower) || !exact(/^[A-Za-z0-9-]+$/, name) || !text(value, 8192)
-            || (bytes += name.length + value.length) > 32768)
-            return false;
-        if (!['content-type', 'correlationid', 'x-paysafe-credentials'].includes(lower) && !BROWSER_HEADERS.has(lower)
-            && !exact(/^sec-ch-ua(?:-[a-z0-9-]+)?$/, lower))
-            return false;
-        parsed.set(lower, value);
-    }
-    return exact(/^application\/json(?:;\s*charset=utf-8)?$/i, parsed.get('content-type'))
-        && parsed.get('correlationid') === correlationId && singleUseCredential(parsed.get('x-paysafe-credentials'));
-}
-/** Checkout 1.8.0 starts a 40-second XHR when Pay is pressed. Prior approval may
- * consume only its new-card request, including native clientInfo and headers.
- * Saved cards, alternate APIs and 3DS-only requests require separate review.
- * Source: hosted.paysafe.com/checkout/1.8.0/main.bundle.js, SHA-256
- * e9e111ff03073cc936a47674e8e7c5db4a6d1050e1b65bf5e20723116fd5080c.
- * The guard checks original bytes and never changes the request.
- */
-export function isPreparedPaysafeRequest(url, method, body, environment, headers) {
-    if (method !== 'POST' || (environment !== 'production' && environment !== 'sandbox')
-        || paysafeEnvironment(url) !== environment)
-        return false;
-    const value = readTokenizationJson(body);
-    return freshCard(value) && record(value.clientInfo) && nativeHeaders(headers, value.clientInfo.correlationId);
-}

package/dist/playwright.d.ts

@@ -1,3 +0,0 @@
-export * from './cdp.js';
-export { collectCheckoutSignals, inspectCheckout } from './preflight-playwright.js';
-export type { CheckoutInspectionFrame, CheckoutInspectionPage, CheckoutCollectionOptions, InspectCheckoutOptions, } from './preflight-playwright.js';

package/dist/playwright.js

@@ -1,3 +0,0 @@
-// Preserve the existing Playwright entry point's CDP and payment attachment exports.
-export * from './cdp.js';
-export { collectCheckoutSignals, inspectCheckout } from './preflight-playwright.js';