@agent-cards/checkout 0.18.0 → 0.21.0

package/dist/preflight.js

@@ -1,2 +0,0 @@
-// Read-only discovery is separate from request interception and authorization.
-export * from './preflight.generated.js';

package/dist/preparation.d.ts

@@ -1,31 +0,0 @@
-import { type PreparedCheckout } from './client.js';
-import type { AttachOptions } from './cdp.js';
-import type { CheckoutLifecycle } from './lifecycle.js';
-/** A local, one-use rendezvous. It never starts or retries a merchant request. */
-export declare class PreparationGate {
-    private readonly opts;
-    private readonly lifecycle;
-    private readonly readDocumentUrl;
-    private state;
-    private observedRequest;
-    private documentUrl;
-    private prepared?;
-    private stop;
-    private expiryTimer?;
-    constructor(opts: AttachOptions, lifecycle: CheckoutLifecycle, readDocumentUrl: () => Promise<string>);
-    private prepare;
-    /** Called for every recognized card mutation, before any await or local retry guard. */
-    claim(requestUrl: string, requestBody?: string | null, requestHeaders?: Record<string, string>): PreparedCheckout | undefined;
-    assertDocument(): Promise<void>;
-    private readDocument;
-    isEngaged(): boolean;
-    retireUnboundClaim(): void;
-    /** A bound native request has its own cancellation/unknown-outcome machinery. */
-    invalidate(reason: string): void;
-    /**
-     * Retire the server handle first, then report the form outcome. Neither
-     * call waits on the other: a stalled report cannot delay the cancel, and a
-     * stalled cancel cannot lose the report.
-     */
-    private cancelThenObserve;
-}

package/dist/preparation.js

@@ -1,164 +0,0 @@
-import { CheckoutPreparationError } from './client.js';
-import { validAmountInput } from './client.js';
-import { matchesPreparedRequest, validPreparationEnvironment, preparationEndpoint } from './prepared-processor.js';
-/** A local, one-use rendezvous. It never starts or retries a merchant request. */
-export class PreparationGate {
-    opts;
-    lifecycle;
-    readDocumentUrl;
-    state = 'unused';
-    observedRequest = false;
-    documentUrl = '';
-    prepared;
-    stop = new AbortController();
-    expiryTimer;
-    constructor(opts, lifecycle, readDocumentUrl) {
-        this.opts = opts;
-        this.lifecycle = lifecycle;
-        this.readDocumentUrl = readDocumentUrl;
-        lifecycle.setPreparationHandler(options => this.prepare(options));
-        lifecycle.abort.signal.addEventListener('abort', () => this.invalidate('cancelled'), { once: true });
-    }
-    async prepare(options) {
-        if (this.opts.stripeCheckout)
-            throw new CheckoutPreparationError(null, 'unsupported_processor');
-        options = { ...options };
-        if (this.state !== 'unused' || this.observedRequest || this.lifecycle.getState().status !== 'idle' || this.lifecycle.isBlocked()) {
-            // A late opt-in cannot turn the next native retry into ordinary approval.
-            // Preserve any existing authorization's state for reconciliation.
-            if (this.state === 'unused')
-                this.state = 'failed';
-            throw new CheckoutPreparationError(this.prepared?.id ?? null, 'must_prepare_before_first_request');
-        }
-        // Reserve synchronously, including while origin discovery/OAuth is pending.
-        this.state = 'preparing';
-        this.lifecycle.preparing();
-        const signal = AbortSignal.any([this.stop.signal, this.lifecycle.abort.signal, ...(options?.signal ? [options.signal] : [])]);
-        const onAbort = () => this.invalidate('cancelled');
-        signal.addEventListener('abort', onAbort, { once: true });
-        try {
-            if (!options || !validPreparationEnvironment(options.psp, options.environment))
-                throw new CheckoutPreparationError(null, 'unsupported_processor');
-            const tokenizer = preparationEndpoint(options.psp, options.environment);
-            if (!this.opts.vault.isCardRequest(tokenizer, 'POST'))
-                throw new CheckoutPreparationError(null, 'processor_interception_unavailable');
-            if (!validAmountInput(this.opts.amount) || this.opts.amount === 0 || !/^[a-z]{3}$/i.test(this.opts.currency ?? ''))
-                throw new CheckoutPreparationError(null, 'amount_required');
-            if (signal.aborted)
-                throw new CheckoutPreparationError(null, 'cancelled');
-            this.documentUrl = await this.readDocument();
-            const page = new URL(this.documentUrl);
-            if (!(page.protocol === 'https:' || (page.protocol === 'http:' && page.hostname === 'localhost')) || page.username || page.password)
-                throw new CheckoutPreparationError(null, 'merchant_origin_invalid');
-            const prepared = await this.opts.vault.prepareCheckout({
-                ...options, user: this.opts.user, merchant: this.opts.merchant,
-                amount: this.opts.amount, currency: this.opts.currency, cardId: this.opts.cardId,
-                merchantOrigin: page.origin, checkoutKey: crypto.randomUUID(), timeoutMs: this.opts.timeoutMs, signal,
-                onPreparationCreated: id => this.lifecycle.preparationCreated(id),
-                onApprovalUrl: url => {
-                    if (!signal.aborted) {
-                        this.lifecycle.approvalUrl(url);
-                        try {
-                            Promise.resolve(this.opts.onApprovalUrl?.(url)).catch(() => { });
-                        }
-                        catch { /* observer only */ }
-                    }
-                },
-            });
-            this.prepared = prepared;
-            if (prepared.psp !== options.psp || prepared.environment !== options.environment)
-                throw new CheckoutPreparationError(prepared.id, 'checkout_changed');
-            if (signal.aborted || this.state !== 'preparing') {
-                void this.cancelThenObserve(prepared.id, 'cancelled');
-                throw new CheckoutPreparationError(prepared.id, 'cancelled');
-            }
-            await this.assertDocument();
-            if (signal.aborted || this.state !== 'preparing')
-                throw new CheckoutPreparationError(prepared.id, 'cancelled');
-            const remaining = Date.parse(prepared.expiresAt) - Date.now();
-            if (!(remaining > 0))
-                throw new CheckoutPreparationError(prepared.id, 'expired');
-            this.state = 'ready';
-            this.expiryTimer = setTimeout(() => this.invalidate('expired'), remaining);
-            this.expiryTimer.unref?.();
-            this.lifecycle.prepared(prepared);
-            return prepared;
-        }
-        catch (error) {
-            const failure = error instanceof CheckoutPreparationError ? error : new CheckoutPreparationError(this.prepared?.id ?? null, 'preparation_unconfirmed');
-            this.invalidate(failure.reason);
-            throw failure;
-        }
-        // Keep the signal listener after ready: caller cancellation retires the handle too.
-    }
-    /** Called for every recognized card mutation, before any await or local retry guard. */
-    claim(requestUrl, requestBody, requestHeaders) {
-        this.observedRequest = true;
-        if (this.state === 'unused')
-            return undefined;
-        if (this.state !== 'ready' || !this.prepared) {
-            this.invalidate(this.state === 'preparing' ? 'submitted_before_ready' : 'already_used_or_unavailable');
-            throw new CheckoutPreparationError(this.prepared?.id ?? null, 'already_used_or_unavailable');
-        }
-        const prepared = this.prepared;
-        if (Date.parse(prepared.expiresAt) <= Date.now() || !matchesPreparedRequest(prepared.psp, prepared.environment, requestUrl, 'POST', requestBody, requestHeaders)) {
-            const reason = Date.parse(prepared.expiresAt) <= Date.now() ? 'expired' : 'checkout_changed';
-            this.invalidate(reason);
-            throw new CheckoutPreparationError(prepared.id, reason);
-        }
-        this.state = 'consumed';
-        clearTimeout(this.expiryTimer);
-        return prepared;
-    }
-    async assertDocument() {
-        if (this.documentUrl && await this.readDocument() !== this.documentUrl)
-            throw new CheckoutPreparationError(this.prepared?.id ?? null, 'merchant_document_changed');
-    }
-    async readDocument() {
-        const signal = AbortSignal.any([this.stop.signal, this.lifecycle.abort.signal, AbortSignal.timeout(5_000)]);
-        const failure = () => new CheckoutPreparationError(this.prepared?.id ?? null, 'merchant_document_unavailable');
-        if (signal.aborted)
-            throw failure();
-        let aborted;
-        const stopped = new Promise((_, reject) => {
-            aborted = () => reject(failure());
-            signal.addEventListener('abort', aborted, { once: true });
-        });
-        try {
-            return await Promise.race([this.readDocumentUrl(), stopped]);
-        }
-        finally {
-            signal.removeEventListener('abort', aborted);
-        }
-    }
-    isEngaged() { return this.state !== 'unused'; }
-    retireUnboundClaim() {
-        if (this.state !== 'consumed' || !this.prepared || this.lifecycle.getState().authorizationId)
-            return;
-        void this.cancelThenObserve(this.prepared.id, 'request_not_bound');
-        // No bound ID means the adapter must not leave a spent handle appearing ready.
-        if (this.lifecycle.getState().status === 'ready_to_submit')
-            this.lifecycle.preparationFailed(new CheckoutPreparationError(this.prepared.id, 'request_not_bound'));
-    }
-    /** A bound native request has its own cancellation/unknown-outcome machinery. */
-    invalidate(reason) {
-        if (this.state === 'unused' || this.state === 'consumed' || this.state === 'failed')
-            return;
-        this.state = 'failed';
-        clearTimeout(this.expiryTimer);
-        this.stop.abort();
-        if (this.prepared)
-            void this.cancelThenObserve(this.prepared.id, reason);
-        this.lifecycle.preparationFailed(new CheckoutPreparationError(this.prepared?.id ?? null, reason));
-    }
-    /**
-     * Retire the server handle first, then report the form outcome. Neither
-     * call waits on the other: a stalled report cannot delay the cancel, and a
-     * stalled cancel cannot lose the report.
-     */
-    async cancelThenObserve(id, reason) {
-        const cancellation = this.opts.vault.cancelPreparation(id).catch(() => { });
-        const observation = this.opts.vault.observePreparation?.(id, this.observedRequest ? 'presented_not_filled' : 'not_presented', reason);
-        await Promise.all([cancellation, observation?.catch(() => { })]);
-    }
-}

package/dist/prepared-processor.d.ts

@@ -1,10 +0,0 @@
-export type PreparationProcessor = 'square' | 'braintree' | 'worldpay' | 'bambora' | 'mercado_pago' | 'recurly' | 'spreedly' | 'adyen' | 'checkout_com' | 'paysafe';
-export type PreparationEnvironment = 'production' | 'sandbox' | 'shared';
-/** How the approved card reaches the processor: the device's own request (token), or ciphertext the device produces for this browser to send (cse, Adyen). */
-export type PreparationMode = 'token' | 'cse';
-export declare function preparationMode(psp: string): PreparationMode;
-/** Shared endpoint processors cannot attest test/live mode from their URL or key prefix. Adyen can: test and live are separate hosts and key prefixes. */
-export declare function validPreparationEnvironment(psp: string, environment: string): boolean;
-export declare function preparationEndpoint(psp: PreparationProcessor, environment: PreparationEnvironment): string;
-/** Processor identity and environment are part of the device's prior consent. */
-export declare function matchesPreparedRequest(psp: PreparationProcessor, environment: PreparationEnvironment, requestUrl: string, method: string, body?: string | null, headers?: Record<string, string>): boolean;

package/dist/prepared-processor.js

@@ -1,122 +0,0 @@
-import { paysafePreparationUrl, isPreparedPaysafeRequest } from './paysafe.generated.js';
-import { adyenPreparationUrl, isPreparedAdyenRequest } from './adyen.generated.js';
-import { braintreeEnvironment, isPreparedBraintreeRequest, readTokenizationJson } from './braintree.js';
-import { isPreparedRecurlyRequest } from './recurly.generated.js';
-import { isPreparedSpreedlyRequest, isSpreedlyTokenRequest, SPREEDLY_TOKEN_ENDPOINT } from './spreedly.generated.js';
-import { checkoutComPreparationUrl, isPreparedCheckoutComRequest } from './checkout-com.generated.js';
-export function preparationMode(psp) {
-    return psp === 'adyen' ? 'cse' : 'token';
-}
-/** Shared endpoint processors cannot attest test/live mode from their URL or key prefix. Adyen can: test and live are separate hosts and key prefixes. */
-export function validPreparationEnvironment(psp, environment) {
-    if (psp === 'bambora' || psp === 'mercado_pago' || psp === 'recurly' || psp === 'spreedly')
-        return environment === 'shared';
-    return ['square', 'braintree', 'worldpay', 'adyen', 'checkout_com', 'paysafe'].includes(psp) && ['production', 'sandbox'].includes(environment);
-}
-export function preparationEndpoint(psp, environment) {
-    if (!validPreparationEnvironment(psp, environment))
-        throw new Error('unsupported_preparation_processor');
-    if (psp === 'paysafe')
-        return paysafePreparationUrl(environment);
-    if (psp === 'checkout_com')
-        return checkoutComPreparationUrl(environment);
-    if (psp === 'adyen')
-        return adyenPreparationUrl(environment);
-    if (psp === 'bambora')
-        return 'https://api.bam.shift4api.net/scripts/tokenization/tokens';
-    if (psp === 'mercado_pago')
-        return 'https://api.mercadopago.com/v1/card_tokens';
-    if (psp === 'recurly')
-        return 'https://api.recurly.com/js/v1/token';
-    if (psp === 'spreedly')
-        return SPREEDLY_TOKEN_ENDPOINT;
-    if (psp === 'worldpay')
-        return environment === 'production'
-            ? 'https://access.worldpay.com/sessions/card' : 'https://try.access.worldpay.com/sessions/card';
-    if (psp === 'braintree')
-        return environment === 'production'
-            ? 'https://payments.braintree-api.com/graphql' : 'https://payments.sandbox.braintree-api.com/graphql';
-    return environment === 'production'
-        ? 'https://pci-connect.squareup.com/v2/card-nonce' : 'https://pci-connect.squareupsandbox.com/v2/card-nonce';
-}
-function record(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value);
-}
-const keys = (value, allowed) => Object.keys(value).every(key => allowed.includes(key));
-const string = (value, max = 1024) => typeof value === 'string' && value.length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
-const digits = (value, min, max) => typeof value === 'string' && value.length >= min && value.length <= max && !/[^0-9]/.test(value);
-const month = (value) => (typeof value === 'number' && Number.isInteger(value) || digits(value, 1, 2)) && Number(value) >= 1 && Number(value) <= 12;
-const year = (value) => (typeof value === 'number' && Number.isInteger(value) || digits(value, 2, 4)) && (Number(value) >= 0 && Number(value) <= 99 || Number(value) >= 2000 && Number(value) <= 9999);
-/** Native fresh-card shapes only. Saved-card, charge and recurring siblings never consume consent. */
-function freshCardBody(psp, body) {
-    const value = readTokenizationJson(body);
-    if (!value)
-        return false;
-    if (psp === 'worldpay')
-        return keys(value, ['identity', 'cardNumber', 'cardExpiryDate', 'cvc'])
-            && string(value.identity) && digits(value.cardNumber, 12, 19)
-            && record(value.cardExpiryDate) && keys(value.cardExpiryDate, ['month', 'year'])
-            && month(value.cardExpiryDate.month) && year(value.cardExpiryDate.year)
-            && (value.cvc === undefined || digits(value.cvc, 3, 4));
-    if (psp === 'bambora')
-        return keys(value, ['number', 'expiry_month', 'expiry_year', 'cvd'])
-            && digits(value.number, 12, 19) && month(value.expiry_month) && year(value.expiry_year)
-            && (value.cvd === undefined || digits(value.cvd, 3, 4));
-    if (psp !== 'mercado_pago' || !keys(value, ['card_number', 'expiration_month', 'expiration_year', 'security_code', 'cardholder', 'device'])
-        || !digits(value.card_number, 12, 19) || !month(value.expiration_month) || !year(value.expiration_year)
-        || (value.security_code !== undefined && value.security_code !== '' && !digits(value.security_code, 3, 4)) || !record(value.cardholder)
-        || !keys(value.cardholder, ['name', 'identification']))
-        return false;
-    const holder = value.cardholder;
-    if (holder.name !== undefined && holder.name !== '' && !string(holder.name))
-        return false;
-    if (holder.identification !== undefined && (!record(holder.identification) || !keys(holder.identification, ['type', 'number'])
-        || Object.values(holder.identification).some(v => v !== '' && !string(v))))
-        return false;
-    if (value.device !== undefined && (!record(value.device) || !keys(value.device, ['meli'])
-        || !record(value.device.meli) || !keys(value.device.meli, ['session_id']) || !string(value.device.meli.session_id, 4096)))
-        return false;
-    return true;
-}
-/** Processor identity and environment are part of the device's prior consent. */
-export function matchesPreparedRequest(psp, environment, requestUrl, method, body, headers) {
-    if (method.toUpperCase() !== 'POST' || !validPreparationEnvironment(psp, environment))
-        return false;
-    if (psp === 'paysafe')
-        return isPreparedPaysafeRequest(requestUrl, method, body ?? null, environment, headers);
-    if (psp === 'checkout_com')
-        return isPreparedCheckoutComRequest(requestUrl, method, body ?? null, environment, headers);
-    if (psp === 'adyen')
-        return isPreparedAdyenRequest(requestUrl, method, body ?? null, environment);
-    if (psp === 'braintree')
-        return braintreeEnvironment(requestUrl) === environment && isPreparedBraintreeRequest(body ?? null);
-    if (psp === 'spreedly')
-        return isSpreedlyTokenRequest(requestUrl, method) && isPreparedSpreedlyRequest(body ?? null);
-    try {
-        const request = new URL(requestUrl), endpoint = new URL(preparationEndpoint(psp, environment));
-        if (request.username || request.password || request.hash)
-            return false;
-        if (psp === 'recurly')
-            return [endpoint.href, 'https://api.eu.recurly.com/js/v1/token'].includes(requestUrl)
-                && isPreparedRecurlyRequest(body ?? null);
-        if (psp === 'bambora') {
-            if (![endpoint.href, 'https://api.na.bambora.com/scripts/tokenization/tokens'].includes(requestUrl))
-                return false;
-        }
-        else if (psp === 'worldpay') {
-            if (requestUrl !== endpoint.href)
-                return false;
-        }
-        else if (request.origin !== endpoint.origin || request.pathname !== endpoint.pathname)
-            return false;
-        if (psp === 'mercado_pago') {
-            const names = [...request.searchParams.keys()];
-            if (new Set(names).size !== names.length || names.some(name => !['public_key', 'locale', 'js_version', 'referer'].includes(name)))
-                return false;
-        }
-        return psp === 'square' || freshCardBody(psp, body ?? null);
-    }
-    catch {
-        return false;
-    }
-}

package/dist/recurly.generated.d.ts

@@ -1 +0,0 @@
-export declare function isPreparedRecurlyRequest(body: string | null): boolean;

package/dist/recurly.generated.js

@@ -1,87 +0,0 @@
-// Generated from @agent-cards/payment-core. Do not edit.
-// source-sha256: 6a1932841621aca1a7371165e0b54a161c4dd5bb077acc190a0c5399229fa350
-/** Normal Recurly.js 4 new-card POST, before it consumes an approval.
- * Native fields and indexed form serialization: recurly/recurly-js commit
- * 7cd9a2b131bf12d7cebfbc7eea1ba86aa54c60e7, lib/recurly/{token,request,fraud}.js
- * and risk/{risk,three-d-secure/three-d-secure}.js. Worldpay and Cybersource
- * risk sessions depend on the original card; proactive Braintree also produces
- * another token type. All nonempty risk results are refused until collection
- * can use the approved card. This function never rewrites the body.
- */
-const SCALARS = new Set(['number', 'month', 'year', 'cvv', 'type', 'key', 'version', 'deviceId', 'sessionId', 'instanceId',
-    'first_name', 'last_name', 'address1', 'address2', 'company', 'country', 'city', 'state', 'postal_code', 'phone',
-    'vat_number', 'tax_identifier', 'tax_identifier_type', 'fraud_session_id', 'card_network_preference']);
-const BROWSER = new Set(['color_depth', 'java_enabled', 'language', 'referrer_url', 'screen_height', 'screen_width', 'time_zone_offset', 'user_agent']);
-const FRAUD_PROCESSORS = new Set(['kount', 'litle_threat_metrix', 'braintree', 'fraudnet']);
-const contiguous = (values) => [...values.keys()].sort((a, b) => Number(a) - Number(b)).every((value, index) => value === String(index));
-export function isPreparedRecurlyRequest(body) {
-    if (typeof body !== 'string' || !body || body.length > 65536)
-        return false;
-    const chunks = body.split('&');
-    if (chunks.length > 200)
-        return false;
-    const fields = new Map();
-    const fraud = new Map();
-    try {
-        for (const chunk of chunks) {
-            const separator = chunk.indexOf('=');
-            if (separator < 1)
-                return false;
-            const name = decodeURIComponent(chunk.slice(0, separator).replace(/\+/g, ' '));
-            const value = decodeURIComponent(chunk.slice(separator + 1).replace(/\+/g, ' '));
-            if (fields.has(name) || value.length > 4096 || /[\u0000-\u001f\u007f]/.test(value))
-                return false;
-            fields.set(name, value);
-            if (SCALARS.has(name))
-                continue;
-            const browser = /^browser\[([a-z_]+)\]$/.exec(name);
-            if (browser && BROWSER.has(browser[1]))
-                continue;
-            const structured = /^fraud\[([0-9]|1[0-9])\]\[(.+)\]$/.exec(name);
-            if (!structured)
-                return false;
-            const [, index, leaf] = structured;
-            if (!['processor', 'session_id'].includes(leaf) && !/^udf\]\[([0-9]|1[0-9])\]\[(label|value)$/.test(leaf))
-                return false;
-            if (!fraud.has(index))
-                fraud.set(index, new Map());
-            fraud.get(index).set(leaf, value);
-        }
-    }
-    catch {
-        return false;
-    }
-    const number = fields.get('number') ?? '', month = fields.get('month') ?? '', year = fields.get('year') ?? '';
-    if (!/^[0-9]{12,19}$/.test(number) || !/^[0-9]{1,2}$/.test(month) || Number(month) < 1 || Number(month) > 12
-        || !/^(?:[0-9]{2}|20[0-9]{2})$/.test(year))
-        return false;
-    if (fields.has('cvv') && fields.get('cvv') !== '' && !/^[0-9]{3,4}$/.test(fields.get('cvv')))
-        return false;
-    if (fields.has('type') && fields.get('type') !== 'credit_card')
-        return false;
-    // A co-badged network choice belongs to the entered card's supported brands.
-    if (fields.get('card_network_preference'))
-        return false;
-    if (fields.has('key') && !fields.get('key')?.trim())
-        return false;
-    if (!contiguous(fraud))
-        return false;
-    for (const item of fraud.values()) {
-        if (!FRAUD_PROCESSORS.has(item.get('processor') ?? '') || !item.get('session_id'))
-            return false;
-        const udf = new Map();
-        for (const key of item.keys()) {
-            const field = /^udf\]\[([0-9]|1[0-9])\]\[(label|value)$/.exec(key);
-            if (!field)
-                continue;
-            if (item.get('processor') !== 'kount')
-                return false;
-            if (!udf.has(field[1]))
-                udf.set(field[1], new Set());
-            udf.get(field[1]).add(field[2]);
-        }
-        if (!contiguous(udf) || [...udf.values()].some(keys => keys.size !== 2))
-            return false;
-    }
-    return true;
-}

package/dist/registry.d.ts

@@ -1,76 +0,0 @@
-/**
- * Which outbound requests carry a raw card, and where the card sits inside them.
- *
- * This is the only merchant-specific knowledge in the system, and it is keyed by
- * PSP rather than by merchant: every Shopify store shares one entry, every Stripe
- * site shares another. The list is served from the Agentcard API at runtime so
- * integrators pick up new processors without shipping a release.
- */
-export type Encoding = 'json' | 'form';
-/**
- * How a paused request gets its card. `token` (the default when absent): the
- * cardholder's device calls the processor and the runtime replays the
- * processor's response. `cse`: the processor encrypts the card in-page
- * (Adyen); the device returns ciphertext and the runtime substitutes it into
- * the paused body and lets the request continue. `hosted_form`: the device
- * submits the processor's own form and the paused request resolves with no
- * processor answer (served only to SDKs that ask for it on sync).
- */
-export type CheckoutMode = 'token' | 'cse' | 'hosted_form';
-export interface Recognizer {
-    /** Stable id, e.g. "shopify" */
-    psp: string;
-    /** Matches the tokenization endpoint. */
-    match: RegExp;
-    /**
-     * Anchored (`^…$`) regex SOURCES for the hostnames this PSP may ever receive
-     * a card on — the server's own allowlist, served next to `match` and carried
-     * through syncRegistry() verbatim.
-     *
-     * Strings, not RegExps, because that is the wire shape and because nothing
-     * here matches with them: they exist so a transport that can only pre-filter
-     * by URL (CDP's `Fetch.enable`, which takes globs) can be armed from the
-     * registry instead of a hardcoded list. Optional so a hand-built registry
-     * (tests, pinning) still type-checks.
-     */
-    hosts?: string[];
-    encoding: Encoding;
-    /**
-     * Request headers that must be replayed verbatim for the merchant to accept
-     * the call (signatures, client tokens). Matched case-insensitively.
-     */
-    passthroughHeaders: RegExp[];
-    /**
-     * Form keys that carry the card number. When present, a request on this
-     * recognizer's endpoints is a card request only if its body carries one of
-     * them: a Stripe confirmation that pays with a method the page already
-     * created (`payment_method=pm_...`) carries none, so there is nothing for
-     * the cardholder to approve. Served by the API and carried through
-     * syncRegistry() verbatim.
-     */
-    cardFields?: string[];
-    /**
-     * With cardFields: the endpoints (regex source over hostname + pathname,
-     * anchored) where a request without a card is routine and never ours, so
-     * it continues untouched; a request without a card anywhere else is refused.
-     */
-    passWithoutCard?: string;
-    /**
-     * True when the card is encrypted inside the page before the request leaves.
-     * A digit swap is useless here; the vault must re-run the PSP's client-side
-     * crypto instead. Refused locally unless the entry also carries
-     * `mode: 'cse'`, which says the vault does exactly that.
-     */
-    clientSideEncrypted?: boolean;
-    /** How the card reaches the processor; absent means 'token'. Carried verbatim by syncRegistry. */
-    mode?: CheckoutMode;
-}
-import { BUILTIN_REGISTRY } from './builtin-registry.generated.js';
-export { BUILTIN_REGISTRY };
-export declare function findRecognizer(url: string, registry?: Recognizer[]): Recognizer | null;
-/**
- * Glob url patterns covering every host in `registry` — what to hand
- * `Fetch.enable` so a card request is ever paused. Deliberately a superset of
- * the recognizers; isCardRequest is the exact check.
- */
-export declare function cardUrlPatterns(registry: Recognizer[]): string[];